crypto/sm2/sm2_sign.c

   1 /*
   2  * Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
   3  * Copyright 2017 Ribose Inc. All Rights Reserved.
   4  * Ported from Ribose contributions from Botan.
   5  *
   6  * Licensed under the OpenSSL license (the "License").  You may not use
   7  * this file except in compliance with the License.  You can obtain a copy
   8  * in the file LICENSE in the source distribution or at
   9  * https://www.openssl.org/source/license.html
  10  */
  11
  12 #include "internal/sm2.h"
  13 #include "internal/sm2err.h"
  14 #include <openssl/err.h>
  15 #include <openssl/evp.h>
  16 #include <openssl/err.h>
  17 #include <openssl/bn.h>
  18 #include <string.h>
  19
  20 static BIGNUM *sm2_compute_msg_hash(const EVP_MD *digest,
  21                                     const EC_KEY *key,
  22                                     const char *user_id,
  23                                     const uint8_t *msg, size_t msg_len)
  24 {
  25     EVP_MD_CTX *hash = EVP_MD_CTX_new();
  26     const int md_size = EVP_MD_size(digest);
  27     uint8_t *za = OPENSSL_zalloc(md_size);
  28     BIGNUM *e = NULL;
  29
  30     if (hash == NULL || za == NULL) {
  31         SM2err(SM2_F_SM2_COMPUTE_MSG_HASH, ERR_R_MALLOC_FAILURE);
  32         goto done;
  33     }
  34
  35     if (md_size < 0) {
  36         SM2err(SM2_F_SM2_COMPUTE_MSG_HASH, SM2_R_INVALID_DIGEST);
  37         goto done;
  38     }
  39
  40     if (!sm2_compute_userid_digest(za, digest, user_id, key)) {
  41         /* SM2err already called */
  42         goto done;
  43     }
  44
  45     if (!EVP_DigestInit(hash, digest)
  46             || !EVP_DigestUpdate(hash, za, md_size)
  47             || !EVP_DigestUpdate(hash, msg, msg_len)
  48                /* reuse za buffer to hold H(ZA || M) */
  49             || !EVP_DigestFinal(hash, za, NULL)) {
  50         SM2err(SM2_F_SM2_COMPUTE_MSG_HASH, ERR_R_EVP_LIB);
  51         goto done;
  52     }
  53
  54     e = BN_bin2bn(za, md_size, NULL);
  55     if (e == NULL)
  56         SM2err(SM2_F_SM2_COMPUTE_MSG_HASH, ERR_R_INTERNAL_ERROR);
  57
  58  done:
  59     OPENSSL_free(za);
  60     EVP_MD_CTX_free(hash);
  61     return e;
  62 }
  63
  64 static ECDSA_SIG *sm2_sig_gen(const EC_KEY *key, const BIGNUM *e)
  65 {
  66     const BIGNUM *dA = EC_KEY_get0_private_key(key);
  67     const EC_GROUP *group = EC_KEY_get0_group(key);
  68     const BIGNUM *order = EC_GROUP_get0_order(group);
  69     ECDSA_SIG *sig = NULL;
  70     EC_POINT *kG = NULL;
  71     BN_CTX *ctx = NULL;
  72     BIGNUM *k = NULL;
  73     BIGNUM *rk = NULL;
  74     BIGNUM *r = NULL;
  75     BIGNUM *s = NULL;
  76     BIGNUM *x1 = NULL;
  77     BIGNUM *tmp = NULL;
  78
  79     kG = EC_POINT_new(group);
  80     ctx = BN_CTX_new();
  81     if (kG == NULL || ctx == NULL) {
  82         SM2err(SM2_F_SM2_SIG_GEN, ERR_R_MALLOC_FAILURE);
  83         goto done;
  84     }
  85
  86
  87     BN_CTX_start(ctx);
  88     k = BN_CTX_get(ctx);
  89     rk = BN_CTX_get(ctx);
  90     x1 = BN_CTX_get(ctx);
  91     tmp = BN_CTX_get(ctx);
  92     if (tmp == NULL) {
  93         SM2err(SM2_F_SM2_SIG_GEN, ERR_R_MALLOC_FAILURE);
  94         goto done;
  95     }
  96
  97     /*
  98      * These values are returned and so should not be allocated out of the
  99      * context
 100      */
 101     r = BN_new();
 102     s = BN_new();
 103
 104     if (r == NULL || s == NULL) {
 105         SM2err(SM2_F_SM2_SIG_GEN, ERR_R_MALLOC_FAILURE);
 106         goto done;
 107     }
 108
 109     for (;;) {
 110         if (!BN_priv_rand_range(k, order)) {
 111             SM2err(SM2_F_SM2_SIG_GEN, ERR_R_INTERNAL_ERROR);
 112                 goto done;
 113         }
 114
 115         if (!EC_POINT_mul(group, kG, k, NULL, NULL, ctx)
 116                 || !EC_POINT_get_affine_coordinates_GFp(group, kG, x1, NULL,
 117                                                         ctx)
 118                 || !BN_mod_add(r, e, x1, order, ctx)) {
 119             SM2err(SM2_F_SM2_SIG_GEN, ERR_R_INTERNAL_ERROR);
 120             goto done;
 121         }
 122
 123         /* try again if r == 0 or r+k == n */
 124         if (BN_is_zero(r))
 125             continue;
 126
 127         if (!BN_add(rk, r, k)) {
 128             SM2err(SM2_F_SM2_SIG_GEN, ERR_R_INTERNAL_ERROR);
 129             goto done;
 130         }
 131
 132         if (BN_cmp(rk, order) == 0)
 133             continue;
 134
 135         if (!BN_add(s, dA, BN_value_one())
 136                 || !BN_mod_inverse(s, s, order, ctx)
 137                 || !BN_mod_mul(tmp, dA, r, order, ctx)
 138                 || !BN_sub(tmp, k, tmp)
 139                 || !BN_mod_mul(s, s, tmp, order, ctx)) {
 140             SM2err(SM2_F_SM2_SIG_GEN, ERR_R_BN_LIB);
 141             goto done;
 142         }
 143
 144         sig = ECDSA_SIG_new();
 145         if (sig == NULL) {
 146             SM2err(SM2_F_SM2_SIG_GEN, ERR_R_MALLOC_FAILURE);
 147             goto done;
 148         }
 149
 150          /* takes ownership of r and s */
 151         ECDSA_SIG_set0(sig, r, s);
 152         break;
 153     }
 154
 155  done:
 156     if (sig == NULL) {
 157         BN_free(r);
 158         BN_free(s);
 159     }
 160
 161     BN_CTX_free(ctx);
 162     EC_POINT_free(kG);
 163     return sig;
 164 }
 165
 166 static int sm2_sig_verify(const EC_KEY *key, const ECDSA_SIG *sig,
 167                           const BIGNUM *e)
 168 {
 169     int ret = 0;
 170     const EC_GROUP *group = EC_KEY_get0_group(key);
 171     const BIGNUM *order = EC_GROUP_get0_order(group);
 172     BN_CTX *ctx = NULL;
 173     EC_POINT *pt = NULL;
 174     BIGNUM *t = NULL;
 175     BIGNUM *x1 = NULL;
 176     const BIGNUM *r = NULL;
 177     const BIGNUM *s = NULL;
 178
 179     ctx = BN_CTX_new();
 180     pt = EC_POINT_new(group);
 181     if (ctx == NULL || pt == NULL) {
 182         SM2err(SM2_F_SM2_SIG_VERIFY, ERR_R_MALLOC_FAILURE);
 183         goto done;
 184     }
 185
 186     BN_CTX_start(ctx);
 187     t = BN_CTX_get(ctx);
 188     x1 = BN_CTX_get(ctx);
 189     if (x1 == NULL) {
 190         SM2err(SM2_F_SM2_SIG_VERIFY, ERR_R_MALLOC_FAILURE);
 191         goto done;
 192     }
 193
 194     /*
 195      * B1: verify whether r' in [1,n-1], verification failed if not
 196      * B2: vefify whether s' in [1,n-1], verification failed if not
 197      * B3: set M'~=ZA || M'
 198      * B4: calculate e'=Hv(M'~)
 199      * B5: calculate t = (r' + s') modn, verification failed if t=0
 200      * B6: calculate the point (x1', y1')=[s']G + [t]PA
 201      * B7: calculate R=(e'+x1') modn, verfication pass if yes, otherwise failed
 202      */
 203
 204     ECDSA_SIG_get0(sig, &r, &s);
 205
 206     if (BN_cmp(r, BN_value_one()) < 0
 207             || BN_cmp(s, BN_value_one()) < 0
 208             || BN_cmp(order, r) <= 0
 209             || BN_cmp(order, s) <= 0) {
 210         SM2err(SM2_F_SM2_SIG_VERIFY, SM2_R_BAD_SIGNATURE);
 211         goto done;
 212     }
 213
 214     if (!BN_mod_add(t, r, s, order, ctx)) {
 215         SM2err(SM2_F_SM2_SIG_VERIFY, ERR_R_BN_LIB);
 216         goto done;
 217     }
 218
 219     if (BN_is_zero(t)) {
 220         SM2err(SM2_F_SM2_SIG_VERIFY, SM2_R_BAD_SIGNATURE);
 221         goto done;
 222     }
 223
 224     if (!EC_POINT_mul(group, pt, s, EC_KEY_get0_public_key(key), t, ctx)
 225             || !EC_POINT_get_affine_coordinates_GFp(group, pt, x1, NULL, ctx)) {
 226         SM2err(SM2_F_SM2_SIG_VERIFY, ERR_R_EC_LIB);
 227         goto done;
 228     }
 229
 230     if (!BN_mod_add(t, e, x1, order, ctx)) {
 231         SM2err(SM2_F_SM2_SIG_VERIFY, ERR_R_BN_LIB);
 232         goto done;
 233     }
 234
 235     if (BN_cmp(r, t) == 0)
 236         ret = 1;
 237
 238  done:
 239     EC_POINT_free(pt);
 240     BN_CTX_free(ctx);
 241     return ret;
 242 }
 243
 244 ECDSA_SIG *sm2_do_sign(const EC_KEY *key,
 245                        const EVP_MD *digest,
 246                        const char *user_id, const uint8_t *msg, size_t msg_len)
 247 {
 248     BIGNUM *e = NULL;
 249     ECDSA_SIG *sig = NULL;
 250
 251     e = sm2_compute_msg_hash(digest, key, user_id, msg, msg_len);
 252     if (e == NULL) {
 253         /* SM2err already called */
 254         goto done;
 255     }
 256
 257     sig = sm2_sig_gen(key, e);
 258
 259  done:
 260     BN_free(e);
 261     return sig;
 262 }
 263
 264 int sm2_do_verify(const EC_KEY *key,
 265                   const EVP_MD *digest,
 266                   const ECDSA_SIG *sig,
 267                   const char *user_id, const uint8_t *msg, size_t msg_len)
 268 {
 269     BIGNUM *e = NULL;
 270     int ret = 0;
 271
 272     e = sm2_compute_msg_hash(digest, key, user_id, msg, msg_len);
 273     if (e == NULL) {
 274         /* SM2err already called */
 275         goto done;
 276     }
 277
 278     ret = sm2_sig_verify(key, sig, e);
 279
 280  done:
 281     BN_free(e);
 282     return ret;
 283 }
 284
 285 int sm2_sign(const unsigned char *dgst, int dgstlen,
 286              unsigned char *sig, unsigned int *siglen, EC_KEY *eckey)
 287 {
 288     BIGNUM *e = NULL;
 289     ECDSA_SIG *s = NULL;
 290     int sigleni;
 291     int ret = -1;
 292
 293     e = BN_bin2bn(dgst, dgstlen, NULL);
 294     if (e == NULL) {
 295        SM2err(SM2_F_SM2_SIGN, ERR_R_BN_LIB);
 296        goto done;
 297     }
 298
 299     s = sm2_sig_gen(eckey, e);
 300
 301     sigleni = i2d_ECDSA_SIG(s, &sig);
 302     if (sigleni < 0) {
 303        SM2err(SM2_F_SM2_SIGN, ERR_R_INTERNAL_ERROR);
 304        goto done;
 305     }
 306     *siglen = (unsigned int)sigleni;
 307
 308     ret = 1;
 309
 310  done:
 311     ECDSA_SIG_free(s);
 312     BN_free(e);
 313     return ret;
 314 }
 315
 316 int sm2_verify(const unsigned char *dgst, int dgstlen,
 317                const unsigned char *sig, int sig_len, EC_KEY *eckey)
 318 {
 319     ECDSA_SIG *s = NULL;
 320     BIGNUM *e = NULL;
 321     const unsigned char *p = sig;
 322     unsigned char *der = NULL;
 323     int derlen = -1;
 324     int ret = -1;
 325
 326     s = ECDSA_SIG_new();
 327     if (s == NULL) {
 328         SM2err(SM2_F_SM2_VERIFY, ERR_R_MALLOC_FAILURE);
 329         goto done;
 330     }
 331     if (d2i_ECDSA_SIG(&s, &p, sig_len) == NULL) {
 332         SM2err(SM2_F_SM2_VERIFY, SM2_R_INVALID_ENCODING);
 333         goto done;
 334     }
 335     /* Ensure signature uses DER and doesn't have trailing garbage */
 336     derlen = i2d_ECDSA_SIG(s, &der);
 337     if (derlen != sig_len || memcmp(sig, der, derlen) != 0) {
 338         SM2err(SM2_F_SM2_VERIFY, SM2_R_INVALID_ENCODING);
 339         goto done;
 340     }
 341
 342     e = BN_bin2bn(dgst, dgstlen, NULL);
 343     if (e == NULL) {
 344         SM2err(SM2_F_SM2_VERIFY, ERR_R_BN_LIB);
 345         goto done;
 346     }
 347
 348     ret = sm2_sig_verify(eckey, s, e);
 349
 350  done:
 351     OPENSSL_free(der);
 352     BN_free(e);
 353     ECDSA_SIG_free(s);
 354     return ret;
 355 }