]>
Commit | Line | Data |
---|---|---|
c6700d27 | 1 | /* |
4a089bbd | 2 | * Copyright 2002-2017 The OpenSSL Project Authors. All Rights Reserved. |
4d94ae00 | 3 | * |
aa6bb135 RS |
4 | * Licensed under the OpenSSL license (the "License"). You may not use |
5 | * this file except in compliance with the License. You can obtain a copy | |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
4d94ae00 | 8 | */ |
0bee0e62 | 9 | |
a200a817 | 10 | #include <string.h> |
0bee0e62 | 11 | #include <openssl/err.h> |
14a7cfb3 | 12 | #include <openssl/obj_mac.h> |
0f814687 | 13 | #include <openssl/bn.h> |
8a99cb29 | 14 | #include <openssl/rand.h> |
6a47db45 DSH |
15 | #include <openssl/ec.h> |
16 | #include "ec_lcl.h" | |
190c615d | 17 | |
a200a817 DSH |
18 | int ossl_ecdsa_sign(int type, const unsigned char *dgst, int dlen, |
19 | unsigned char *sig, unsigned int *siglen, | |
20 | const BIGNUM *kinv, const BIGNUM *r, EC_KEY *eckey) | |
21 | { | |
22 | ECDSA_SIG *s; | |
75e2c877 | 23 | |
a200a817 DSH |
24 | s = ECDSA_do_sign_ex(dgst, dlen, kinv, r, eckey); |
25 | if (s == NULL) { | |
26 | *siglen = 0; | |
27 | return 0; | |
28 | } | |
29 | *siglen = i2d_ECDSA_SIG(s, &sig); | |
30 | ECDSA_SIG_free(s); | |
31 | return 1; | |
32 | } | |
33 | ||
8d6a75dc | 34 | static int ecdsa_sign_setup(EC_KEY *eckey, BN_CTX *ctx_in, |
0f113f3e MC |
35 | BIGNUM **kinvp, BIGNUM **rp, |
36 | const unsigned char *dgst, int dlen) | |
4d94ae00 | 37 | { |
0f113f3e | 38 | BN_CTX *ctx = NULL; |
be2e334f DSH |
39 | BIGNUM *k = NULL, *r = NULL, *X = NULL; |
40 | const BIGNUM *order; | |
0f113f3e MC |
41 | EC_POINT *tmp_point = NULL; |
42 | const EC_GROUP *group; | |
43 | int ret = 0; | |
4a089bbd | 44 | int order_bits; |
9dd84053 | 45 | |
0f113f3e | 46 | if (eckey == NULL || (group = EC_KEY_get0_group(eckey)) == NULL) { |
6a47db45 | 47 | ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_PASSED_NULL_PARAMETER); |
0f113f3e MC |
48 | return 0; |
49 | } | |
a74333f9 | 50 | |
4b0555ec DSH |
51 | if (!EC_KEY_can_sign(eckey)) { |
52 | ECerr(EC_F_ECDSA_SIGN_SETUP, EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING); | |
53 | return 0; | |
54 | } | |
55 | ||
0f113f3e MC |
56 | if (ctx_in == NULL) { |
57 | if ((ctx = BN_CTX_new()) == NULL) { | |
6a47db45 | 58 | ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_MALLOC_FAILURE); |
0f113f3e MC |
59 | return 0; |
60 | } | |
61 | } else | |
62 | ctx = ctx_in; | |
4d94ae00 | 63 | |
0f113f3e MC |
64 | k = BN_new(); /* this value is later returned in *kinvp */ |
65 | r = BN_new(); /* this value is later returned in *rp */ | |
0f113f3e | 66 | X = BN_new(); |
be2e334f | 67 | if (k == NULL || r == NULL || X == NULL) { |
6a47db45 | 68 | ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_MALLOC_FAILURE); |
0f113f3e MC |
69 | goto err; |
70 | } | |
71 | if ((tmp_point = EC_POINT_new(group)) == NULL) { | |
6a47db45 | 72 | ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_EC_LIB); |
0f113f3e MC |
73 | goto err; |
74 | } | |
be2e334f DSH |
75 | order = EC_GROUP_get0_order(group); |
76 | if (order == NULL) { | |
6a47db45 | 77 | ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_EC_LIB); |
0f113f3e MC |
78 | goto err; |
79 | } | |
cac4fb58 | 80 | |
4a089bbd P |
81 | /* Preallocate space */ |
82 | order_bits = BN_num_bits(order); | |
83 | if (!BN_set_bit(k, order_bits) | |
84 | || !BN_set_bit(r, order_bits) | |
85 | || !BN_set_bit(X, order_bits)) | |
86 | goto err; | |
87 | ||
0f113f3e MC |
88 | do { |
89 | /* get random k */ | |
90 | do | |
0f113f3e MC |
91 | if (dgst != NULL) { |
92 | if (!BN_generate_dsa_nonce | |
93 | (k, order, EC_KEY_get0_private_key(eckey), dgst, dlen, | |
94 | ctx)) { | |
6a47db45 DSH |
95 | ECerr(EC_F_ECDSA_SIGN_SETUP, |
96 | EC_R_RANDOM_NUMBER_GENERATION_FAILED); | |
0f113f3e MC |
97 | goto err; |
98 | } | |
474e469b | 99 | } else { |
ddc6a5c8 | 100 | if (!BN_priv_rand_range(k, order)) { |
6a47db45 DSH |
101 | ECerr(EC_F_ECDSA_SIGN_SETUP, |
102 | EC_R_RANDOM_NUMBER_GENERATION_FAILED); | |
0f113f3e MC |
103 | goto err; |
104 | } | |
105 | } | |
106 | while (BN_is_zero(k)); | |
4d94ae00 | 107 | |
0f113f3e MC |
108 | /* |
109 | * We do not want timing information to leak the length of k, so we | |
110 | * compute G*k using an equivalent scalar of fixed bit-length. | |
4a089bbd P |
111 | * |
112 | * We unconditionally perform both of these additions to prevent a | |
113 | * small timing information leakage. We then choose the sum that is | |
114 | * one bit longer than the order. This guarantees the code | |
115 | * path used in the constant time implementations elsewhere. | |
116 | * | |
117 | * TODO: revisit the BN_copy aiming for a memory access agnostic | |
118 | * conditional copy. | |
0f113f3e | 119 | */ |
4a089bbd P |
120 | if (!BN_add(r, k, order) |
121 | || !BN_add(X, r, order) | |
122 | || !BN_copy(k, BN_num_bits(r) > order_bits ? r : X)) | |
0f113f3e | 123 | goto err; |
992bdde6 | 124 | |
0f113f3e MC |
125 | /* compute r the x-coordinate of generator * k */ |
126 | if (!EC_POINT_mul(group, tmp_point, k, NULL, NULL, ctx)) { | |
6a47db45 | 127 | ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_EC_LIB); |
0f113f3e MC |
128 | goto err; |
129 | } | |
130 | if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) == | |
131 | NID_X9_62_prime_field) { | |
132 | if (!EC_POINT_get_affine_coordinates_GFp | |
133 | (group, tmp_point, X, NULL, ctx)) { | |
6a47db45 | 134 | ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_EC_LIB); |
0f113f3e MC |
135 | goto err; |
136 | } | |
137 | } | |
b3310161 | 138 | #ifndef OPENSSL_NO_EC2M |
0f113f3e MC |
139 | else { /* NID_X9_62_characteristic_two_field */ |
140 | ||
141 | if (!EC_POINT_get_affine_coordinates_GF2m(group, | |
142 | tmp_point, X, NULL, | |
143 | ctx)) { | |
6a47db45 | 144 | ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_EC_LIB); |
0f113f3e MC |
145 | goto err; |
146 | } | |
147 | } | |
b3310161 | 148 | #endif |
0f113f3e | 149 | if (!BN_nnmod(r, X, order, ctx)) { |
6a47db45 | 150 | ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_BN_LIB); |
0f113f3e MC |
151 | goto err; |
152 | } | |
153 | } | |
154 | while (BN_is_zero(r)); | |
4d94ae00 | 155 | |
0f113f3e MC |
156 | /* compute the inverse of k */ |
157 | if (EC_GROUP_get_mont_data(group) != NULL) { | |
158 | /* | |
159 | * We want inverse in constant time, therefore we utilize the fact | |
46f4e1be | 160 | * order must be prime and use Fermat's Little Theorem instead. |
0f113f3e MC |
161 | */ |
162 | if (!BN_set_word(X, 2)) { | |
6a47db45 | 163 | ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_BN_LIB); |
0f113f3e MC |
164 | goto err; |
165 | } | |
166 | if (!BN_mod_sub(X, order, X, order, ctx)) { | |
6a47db45 | 167 | ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_BN_LIB); |
0f113f3e MC |
168 | goto err; |
169 | } | |
170 | BN_set_flags(X, BN_FLG_CONSTTIME); | |
171 | if (!BN_mod_exp_mont_consttime | |
172 | (k, k, X, order, ctx, EC_GROUP_get_mont_data(group))) { | |
6a47db45 | 173 | ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_BN_LIB); |
0f113f3e MC |
174 | goto err; |
175 | } | |
176 | } else { | |
177 | if (!BN_mod_inverse(k, k, order, ctx)) { | |
6a47db45 | 178 | ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_BN_LIB); |
0f113f3e MC |
179 | goto err; |
180 | } | |
181 | } | |
f54be179 | 182 | |
0f113f3e | 183 | /* clear old values if necessary */ |
23a1d5e9 RS |
184 | BN_clear_free(*rp); |
185 | BN_clear_free(*kinvp); | |
0f113f3e MC |
186 | /* save the pre-computed values */ |
187 | *rp = r; | |
188 | *kinvp = k; | |
189 | ret = 1; | |
190 | err: | |
191 | if (!ret) { | |
23a1d5e9 RS |
192 | BN_clear_free(k); |
193 | BN_clear_free(r); | |
0f113f3e | 194 | } |
23a1d5e9 | 195 | if (ctx != ctx_in) |
0f113f3e | 196 | BN_CTX_free(ctx); |
8fdc3734 | 197 | EC_POINT_free(tmp_point); |
23a1d5e9 | 198 | BN_clear_free(X); |
26a7d938 | 199 | return ret; |
4d94ae00 BM |
200 | } |
201 | ||
6a47db45 DSH |
202 | int ossl_ecdsa_sign_setup(EC_KEY *eckey, BN_CTX *ctx_in, BIGNUM **kinvp, |
203 | BIGNUM **rp) | |
204 | { | |
205 | return ecdsa_sign_setup(eckey, ctx_in, kinvp, rp, NULL, 0); | |
206 | } | |
207 | ||
208 | ECDSA_SIG *ossl_ecdsa_sign_sig(const unsigned char *dgst, int dgst_len, | |
209 | const BIGNUM *in_kinv, const BIGNUM *in_r, | |
210 | EC_KEY *eckey) | |
4d94ae00 | 211 | { |
0f113f3e | 212 | int ok = 0, i; |
be2e334f DSH |
213 | BIGNUM *kinv = NULL, *s, *m = NULL, *tmp = NULL; |
214 | const BIGNUM *order, *ckinv; | |
0f113f3e MC |
215 | BN_CTX *ctx = NULL; |
216 | const EC_GROUP *group; | |
217 | ECDSA_SIG *ret; | |
0f113f3e MC |
218 | const BIGNUM *priv_key; |
219 | ||
0f113f3e MC |
220 | group = EC_KEY_get0_group(eckey); |
221 | priv_key = EC_KEY_get0_private_key(eckey); | |
14a7cfb3 | 222 | |
6a47db45 DSH |
223 | if (group == NULL || priv_key == NULL) { |
224 | ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_PASSED_NULL_PARAMETER); | |
0f113f3e MC |
225 | return NULL; |
226 | } | |
4d94ae00 | 227 | |
4b0555ec DSH |
228 | if (!EC_KEY_can_sign(eckey)) { |
229 | ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING); | |
230 | return NULL; | |
231 | } | |
232 | ||
0f113f3e | 233 | ret = ECDSA_SIG_new(); |
90945fa3 | 234 | if (ret == NULL) { |
6a47db45 | 235 | ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_MALLOC_FAILURE); |
0f113f3e MC |
236 | return NULL; |
237 | } | |
8cc44d97 DSH |
238 | ret->r = BN_new(); |
239 | ret->s = BN_new(); | |
240 | if (ret->r == NULL || ret->s == NULL) { | |
241 | ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_MALLOC_FAILURE); | |
242 | goto err; | |
243 | } | |
0f113f3e | 244 | s = ret->s; |
c6700d27 | 245 | |
be2e334f | 246 | if ((ctx = BN_CTX_new()) == NULL || |
0f113f3e | 247 | (tmp = BN_new()) == NULL || (m = BN_new()) == NULL) { |
6a47db45 | 248 | ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_MALLOC_FAILURE); |
0f113f3e MC |
249 | goto err; |
250 | } | |
4d94ae00 | 251 | |
be2e334f DSH |
252 | order = EC_GROUP_get0_order(group); |
253 | if (order == NULL) { | |
6a47db45 | 254 | ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_EC_LIB); |
0f113f3e MC |
255 | goto err; |
256 | } | |
257 | i = BN_num_bits(order); | |
258 | /* | |
259 | * Need to truncate digest if it is too long: first truncate whole bytes. | |
260 | */ | |
261 | if (8 * dgst_len > i) | |
262 | dgst_len = (i + 7) / 8; | |
263 | if (!BN_bin2bn(dgst, dgst_len, m)) { | |
6a47db45 | 264 | ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB); |
0f113f3e MC |
265 | goto err; |
266 | } | |
267 | /* If still too long truncate remaining bits with a shift */ | |
268 | if ((8 * dgst_len > i) && !BN_rshift(m, m, 8 - (i & 0x7))) { | |
6a47db45 | 269 | ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB); |
0f113f3e MC |
270 | goto err; |
271 | } | |
272 | do { | |
273 | if (in_kinv == NULL || in_r == NULL) { | |
274 | if (!ecdsa_sign_setup(eckey, ctx, &kinv, &ret->r, dgst, dgst_len)) { | |
6a47db45 | 275 | ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_ECDSA_LIB); |
0f113f3e MC |
276 | goto err; |
277 | } | |
278 | ckinv = kinv; | |
279 | } else { | |
280 | ckinv = in_kinv; | |
281 | if (BN_copy(ret->r, in_r) == NULL) { | |
6a47db45 | 282 | ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_MALLOC_FAILURE); |
0f113f3e MC |
283 | goto err; |
284 | } | |
285 | } | |
4d94ae00 | 286 | |
0f113f3e | 287 | if (!BN_mod_mul(tmp, priv_key, ret->r, order, ctx)) { |
6a47db45 | 288 | ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB); |
0f113f3e MC |
289 | goto err; |
290 | } | |
291 | if (!BN_mod_add_quick(s, tmp, m, order)) { | |
6a47db45 | 292 | ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB); |
0f113f3e MC |
293 | goto err; |
294 | } | |
295 | if (!BN_mod_mul(s, s, ckinv, order, ctx)) { | |
6a47db45 | 296 | ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB); |
0f113f3e MC |
297 | goto err; |
298 | } | |
299 | if (BN_is_zero(s)) { | |
300 | /* | |
301 | * if kinv and r have been supplied by the caller don't to | |
302 | * generate new kinv and r values | |
303 | */ | |
304 | if (in_kinv != NULL && in_r != NULL) { | |
6a47db45 | 305 | ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, EC_R_NEED_NEW_SETUP_VALUES); |
0f113f3e MC |
306 | goto err; |
307 | } | |
308 | } else | |
309 | /* s != 0 => we have a valid signature */ | |
310 | break; | |
311 | } | |
312 | while (1); | |
4d94ae00 | 313 | |
0f113f3e MC |
314 | ok = 1; |
315 | err: | |
316 | if (!ok) { | |
317 | ECDSA_SIG_free(ret); | |
318 | ret = NULL; | |
319 | } | |
23a1d5e9 RS |
320 | BN_CTX_free(ctx); |
321 | BN_clear_free(m); | |
322 | BN_clear_free(tmp); | |
23a1d5e9 | 323 | BN_clear_free(kinv); |
0f113f3e | 324 | return ret; |
4d94ae00 BM |
325 | } |
326 | ||
a200a817 DSH |
327 | /*- |
328 | * returns | |
329 | * 1: correct signature | |
330 | * 0: incorrect signature | |
331 | * -1: error | |
332 | */ | |
333 | int ossl_ecdsa_verify(int type, const unsigned char *dgst, int dgst_len, | |
334 | const unsigned char *sigbuf, int sig_len, EC_KEY *eckey) | |
335 | { | |
336 | ECDSA_SIG *s; | |
337 | const unsigned char *p = sigbuf; | |
338 | unsigned char *der = NULL; | |
339 | int derlen = -1; | |
340 | int ret = -1; | |
341 | ||
342 | s = ECDSA_SIG_new(); | |
343 | if (s == NULL) | |
26a7d938 | 344 | return ret; |
a200a817 DSH |
345 | if (d2i_ECDSA_SIG(&s, &p, sig_len) == NULL) |
346 | goto err; | |
347 | /* Ensure signature uses DER and doesn't have trailing garbage */ | |
348 | derlen = i2d_ECDSA_SIG(s, &der); | |
91e7bcc2 | 349 | if (derlen != sig_len || memcmp(sigbuf, der, derlen) != 0) |
a200a817 DSH |
350 | goto err; |
351 | ret = ECDSA_do_verify(dgst, dgst_len, s, eckey); | |
352 | err: | |
353 | OPENSSL_clear_free(der, derlen); | |
354 | ECDSA_SIG_free(s); | |
26a7d938 | 355 | return ret; |
a200a817 DSH |
356 | } |
357 | ||
6a47db45 DSH |
358 | int ossl_ecdsa_verify_sig(const unsigned char *dgst, int dgst_len, |
359 | const ECDSA_SIG *sig, EC_KEY *eckey) | |
4d94ae00 | 360 | { |
0f113f3e MC |
361 | int ret = -1, i; |
362 | BN_CTX *ctx; | |
be2e334f DSH |
363 | const BIGNUM *order; |
364 | BIGNUM *u1, *u2, *m, *X; | |
0f113f3e MC |
365 | EC_POINT *point = NULL; |
366 | const EC_GROUP *group; | |
367 | const EC_POINT *pub_key; | |
9dd84053 | 368 | |
0f113f3e MC |
369 | /* check input values */ |
370 | if (eckey == NULL || (group = EC_KEY_get0_group(eckey)) == NULL || | |
371 | (pub_key = EC_KEY_get0_public_key(eckey)) == NULL || sig == NULL) { | |
6a47db45 | 372 | ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, EC_R_MISSING_PARAMETERS); |
0f113f3e MC |
373 | return -1; |
374 | } | |
4d94ae00 | 375 | |
4b0555ec DSH |
376 | if (!EC_KEY_can_sign(eckey)) { |
377 | ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING); | |
378 | return -1; | |
379 | } | |
380 | ||
0f113f3e | 381 | ctx = BN_CTX_new(); |
90945fa3 | 382 | if (ctx == NULL) { |
6a47db45 | 383 | ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_MALLOC_FAILURE); |
0f113f3e MC |
384 | return -1; |
385 | } | |
386 | BN_CTX_start(ctx); | |
0f113f3e MC |
387 | u1 = BN_CTX_get(ctx); |
388 | u2 = BN_CTX_get(ctx); | |
389 | m = BN_CTX_get(ctx); | |
390 | X = BN_CTX_get(ctx); | |
91e7bcc2 | 391 | if (X == NULL) { |
6a47db45 | 392 | ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB); |
0f113f3e MC |
393 | goto err; |
394 | } | |
c6700d27 | 395 | |
be2e334f DSH |
396 | order = EC_GROUP_get0_order(group); |
397 | if (order == NULL) { | |
6a47db45 | 398 | ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_EC_LIB); |
0f113f3e MC |
399 | goto err; |
400 | } | |
4d94ae00 | 401 | |
0f113f3e MC |
402 | if (BN_is_zero(sig->r) || BN_is_negative(sig->r) || |
403 | BN_ucmp(sig->r, order) >= 0 || BN_is_zero(sig->s) || | |
404 | BN_is_negative(sig->s) || BN_ucmp(sig->s, order) >= 0) { | |
6a47db45 | 405 | ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, EC_R_BAD_SIGNATURE); |
0f113f3e MC |
406 | ret = 0; /* signature is invalid */ |
407 | goto err; | |
408 | } | |
409 | /* calculate tmp1 = inv(S) mod order */ | |
410 | if (!BN_mod_inverse(u2, sig->s, order, ctx)) { | |
6a47db45 | 411 | ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB); |
0f113f3e MC |
412 | goto err; |
413 | } | |
414 | /* digest -> m */ | |
415 | i = BN_num_bits(order); | |
416 | /* | |
417 | * Need to truncate digest if it is too long: first truncate whole bytes. | |
418 | */ | |
419 | if (8 * dgst_len > i) | |
420 | dgst_len = (i + 7) / 8; | |
421 | if (!BN_bin2bn(dgst, dgst_len, m)) { | |
6a47db45 | 422 | ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB); |
0f113f3e MC |
423 | goto err; |
424 | } | |
425 | /* If still too long truncate remaining bits with a shift */ | |
426 | if ((8 * dgst_len > i) && !BN_rshift(m, m, 8 - (i & 0x7))) { | |
6a47db45 | 427 | ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB); |
0f113f3e MC |
428 | goto err; |
429 | } | |
430 | /* u1 = m * tmp mod order */ | |
431 | if (!BN_mod_mul(u1, m, u2, order, ctx)) { | |
6a47db45 | 432 | ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB); |
0f113f3e MC |
433 | goto err; |
434 | } | |
435 | /* u2 = r * w mod q */ | |
436 | if (!BN_mod_mul(u2, sig->r, u2, order, ctx)) { | |
6a47db45 | 437 | ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB); |
0f113f3e MC |
438 | goto err; |
439 | } | |
440 | ||
441 | if ((point = EC_POINT_new(group)) == NULL) { | |
6a47db45 | 442 | ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_MALLOC_FAILURE); |
0f113f3e MC |
443 | goto err; |
444 | } | |
445 | if (!EC_POINT_mul(group, point, u1, pub_key, u2, ctx)) { | |
6a47db45 | 446 | ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_EC_LIB); |
0f113f3e MC |
447 | goto err; |
448 | } | |
449 | if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) == | |
450 | NID_X9_62_prime_field) { | |
451 | if (!EC_POINT_get_affine_coordinates_GFp(group, point, X, NULL, ctx)) { | |
6a47db45 | 452 | ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_EC_LIB); |
0f113f3e MC |
453 | goto err; |
454 | } | |
455 | } | |
b3310161 | 456 | #ifndef OPENSSL_NO_EC2M |
0f113f3e MC |
457 | else { /* NID_X9_62_characteristic_two_field */ |
458 | ||
459 | if (!EC_POINT_get_affine_coordinates_GF2m(group, point, X, NULL, ctx)) { | |
6a47db45 | 460 | ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_EC_LIB); |
0f113f3e MC |
461 | goto err; |
462 | } | |
463 | } | |
464 | #endif | |
465 | if (!BN_nnmod(u1, X, order, ctx)) { | |
6a47db45 | 466 | ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB); |
0f113f3e MC |
467 | goto err; |
468 | } | |
469 | /* if the signature is correct u1 is equal to sig->r */ | |
470 | ret = (BN_ucmp(u1, sig->r) == 0); | |
471 | err: | |
472 | BN_CTX_end(ctx); | |
473 | BN_CTX_free(ctx); | |
8fdc3734 | 474 | EC_POINT_free(point); |
0f113f3e | 475 | return ret; |
4d94ae00 | 476 | } |