]>
Commit | Line | Data |
---|---|---|
c6700d27 | 1 | /* |
8020d79b | 2 | * Copyright 2002-2021 The OpenSSL Project Authors. All Rights Reserved. |
4d94ae00 | 3 | * |
a7f182b7 | 4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
aa6bb135 RS |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
4d94ae00 | 8 | */ |
0bee0e62 | 9 | |
579422c8 P |
10 | /* |
11 | * ECDSA low level APIs are deprecated for public use, but still ok for | |
12 | * internal use. | |
13 | */ | |
14 | #include "internal/deprecated.h" | |
15 | ||
a200a817 | 16 | #include <string.h> |
0bee0e62 | 17 | #include <openssl/err.h> |
14a7cfb3 | 18 | #include <openssl/obj_mac.h> |
8a99cb29 | 19 | #include <openssl/rand.h> |
25f2138b | 20 | #include "crypto/bn.h" |
706457b7 | 21 | #include "ec_local.h" |
190c615d | 22 | |
9bf682f6 PS |
23 | int ossl_ecdsa_sign_setup(EC_KEY *eckey, BN_CTX *ctx_in, BIGNUM **kinvp, |
24 | BIGNUM **rp) | |
25 | { | |
26 | if (eckey->group->meth->ecdsa_sign_setup == NULL) { | |
9311d0c4 | 27 | ERR_raise(ERR_LIB_EC, EC_R_CURVE_DOES_NOT_SUPPORT_ECDSA); |
9bf682f6 PS |
28 | return 0; |
29 | } | |
30 | ||
31 | return eckey->group->meth->ecdsa_sign_setup(eckey, ctx_in, kinvp, rp); | |
32 | } | |
33 | ||
34 | ECDSA_SIG *ossl_ecdsa_sign_sig(const unsigned char *dgst, int dgst_len, | |
35 | const BIGNUM *in_kinv, const BIGNUM *in_r, | |
36 | EC_KEY *eckey) | |
37 | { | |
38 | if (eckey->group->meth->ecdsa_sign_sig == NULL) { | |
9311d0c4 | 39 | ERR_raise(ERR_LIB_EC, EC_R_CURVE_DOES_NOT_SUPPORT_ECDSA); |
9bf682f6 PS |
40 | return NULL; |
41 | } | |
42 | ||
43 | return eckey->group->meth->ecdsa_sign_sig(dgst, dgst_len, | |
44 | in_kinv, in_r, eckey); | |
45 | } | |
46 | ||
47 | int ossl_ecdsa_verify_sig(const unsigned char *dgst, int dgst_len, | |
48 | const ECDSA_SIG *sig, EC_KEY *eckey) | |
49 | { | |
50 | if (eckey->group->meth->ecdsa_verify_sig == NULL) { | |
9311d0c4 | 51 | ERR_raise(ERR_LIB_EC, EC_R_CURVE_DOES_NOT_SUPPORT_ECDSA); |
9bf682f6 PS |
52 | return 0; |
53 | } | |
54 | ||
55 | return eckey->group->meth->ecdsa_verify_sig(dgst, dgst_len, sig, eckey); | |
56 | } | |
57 | ||
a200a817 DSH |
58 | int ossl_ecdsa_sign(int type, const unsigned char *dgst, int dlen, |
59 | unsigned char *sig, unsigned int *siglen, | |
60 | const BIGNUM *kinv, const BIGNUM *r, EC_KEY *eckey) | |
61 | { | |
62 | ECDSA_SIG *s; | |
75e2c877 | 63 | |
a200a817 DSH |
64 | s = ECDSA_do_sign_ex(dgst, dlen, kinv, r, eckey); |
65 | if (s == NULL) { | |
66 | *siglen = 0; | |
67 | return 0; | |
68 | } | |
69 | *siglen = i2d_ECDSA_SIG(s, &sig); | |
70 | ECDSA_SIG_free(s); | |
71 | return 1; | |
72 | } | |
73 | ||
8d6a75dc | 74 | static int ecdsa_sign_setup(EC_KEY *eckey, BN_CTX *ctx_in, |
0f113f3e MC |
75 | BIGNUM **kinvp, BIGNUM **rp, |
76 | const unsigned char *dgst, int dlen) | |
4d94ae00 | 77 | { |
0f113f3e | 78 | BN_CTX *ctx = NULL; |
be2e334f DSH |
79 | BIGNUM *k = NULL, *r = NULL, *X = NULL; |
80 | const BIGNUM *order; | |
0f113f3e MC |
81 | EC_POINT *tmp_point = NULL; |
82 | const EC_GROUP *group; | |
83 | int ret = 0; | |
4a089bbd | 84 | int order_bits; |
7408f675 | 85 | const BIGNUM *priv_key; |
9dd84053 | 86 | |
0f113f3e | 87 | if (eckey == NULL || (group = EC_KEY_get0_group(eckey)) == NULL) { |
9311d0c4 | 88 | ERR_raise(ERR_LIB_EC, ERR_R_PASSED_NULL_PARAMETER); |
0f113f3e MC |
89 | return 0; |
90 | } | |
7408f675 | 91 | if ((priv_key = EC_KEY_get0_private_key(eckey)) == NULL) { |
9311d0c4 | 92 | ERR_raise(ERR_LIB_EC, EC_R_MISSING_PRIVATE_KEY); |
7408f675 DO |
93 | return 0; |
94 | } | |
a74333f9 | 95 | |
4b0555ec | 96 | if (!EC_KEY_can_sign(eckey)) { |
9311d0c4 | 97 | ERR_raise(ERR_LIB_EC, EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING); |
4b0555ec DSH |
98 | return 0; |
99 | } | |
100 | ||
fff7a0dc | 101 | if ((ctx = ctx_in) == NULL) { |
a9612d6c | 102 | if ((ctx = BN_CTX_new_ex(eckey->libctx)) == NULL) { |
9311d0c4 | 103 | ERR_raise(ERR_LIB_EC, ERR_R_MALLOC_FAILURE); |
0f113f3e MC |
104 | return 0; |
105 | } | |
fff7a0dc | 106 | } |
4d94ae00 | 107 | |
bb315ca7 | 108 | k = BN_secure_new(); /* this value is later returned in *kinvp */ |
0f113f3e | 109 | r = BN_new(); /* this value is later returned in *rp */ |
0f113f3e | 110 | X = BN_new(); |
be2e334f | 111 | if (k == NULL || r == NULL || X == NULL) { |
9311d0c4 | 112 | ERR_raise(ERR_LIB_EC, ERR_R_MALLOC_FAILURE); |
0f113f3e MC |
113 | goto err; |
114 | } | |
115 | if ((tmp_point = EC_POINT_new(group)) == NULL) { | |
9311d0c4 | 116 | ERR_raise(ERR_LIB_EC, ERR_R_EC_LIB); |
0f113f3e MC |
117 | goto err; |
118 | } | |
be2e334f | 119 | order = EC_GROUP_get0_order(group); |
cac4fb58 | 120 | |
4a089bbd P |
121 | /* Preallocate space */ |
122 | order_bits = BN_num_bits(order); | |
123 | if (!BN_set_bit(k, order_bits) | |
124 | || !BN_set_bit(r, order_bits) | |
125 | || !BN_set_bit(X, order_bits)) | |
126 | goto err; | |
127 | ||
0f113f3e MC |
128 | do { |
129 | /* get random k */ | |
fff7a0dc | 130 | do { |
0f113f3e | 131 | if (dgst != NULL) { |
7408f675 | 132 | if (!BN_generate_dsa_nonce(k, order, priv_key, |
fff7a0dc | 133 | dgst, dlen, ctx)) { |
9311d0c4 | 134 | ERR_raise(ERR_LIB_EC, EC_R_RANDOM_NUMBER_GENERATION_FAILED); |
0f113f3e MC |
135 | goto err; |
136 | } | |
474e469b | 137 | } else { |
5cbd2ea3 | 138 | if (!BN_priv_rand_range_ex(k, order, 0, ctx)) { |
9311d0c4 | 139 | ERR_raise(ERR_LIB_EC, EC_R_RANDOM_NUMBER_GENERATION_FAILED); |
0f113f3e MC |
140 | goto err; |
141 | } | |
142 | } | |
fff7a0dc | 143 | } while (BN_is_zero(k)); |
4d94ae00 | 144 | |
0f113f3e MC |
145 | /* compute r the x-coordinate of generator * k */ |
146 | if (!EC_POINT_mul(group, tmp_point, k, NULL, NULL, ctx)) { | |
9311d0c4 | 147 | ERR_raise(ERR_LIB_EC, ERR_R_EC_LIB); |
0f113f3e MC |
148 | goto err; |
149 | } | |
9cc570d4 MC |
150 | |
151 | if (!EC_POINT_get_affine_coordinates(group, tmp_point, X, NULL, ctx)) { | |
9311d0c4 | 152 | ERR_raise(ERR_LIB_EC, ERR_R_EC_LIB); |
9cc570d4 | 153 | goto err; |
0f113f3e | 154 | } |
9cc570d4 | 155 | |
0f113f3e | 156 | if (!BN_nnmod(r, X, order, ctx)) { |
9311d0c4 | 157 | ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB); |
0f113f3e MC |
158 | goto err; |
159 | } | |
fff7a0dc | 160 | } while (BN_is_zero(r)); |
4d94ae00 | 161 | |
c11d372b | 162 | /* compute the inverse of k */ |
32ab57cb | 163 | if (!ossl_ec_group_do_inverse_ord(group, k, k, ctx)) { |
9311d0c4 | 164 | ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB); |
c11d372b | 165 | goto err; |
0f113f3e | 166 | } |
f54be179 | 167 | |
0f113f3e | 168 | /* clear old values if necessary */ |
23a1d5e9 RS |
169 | BN_clear_free(*rp); |
170 | BN_clear_free(*kinvp); | |
0f113f3e MC |
171 | /* save the pre-computed values */ |
172 | *rp = r; | |
173 | *kinvp = k; | |
174 | ret = 1; | |
175 | err: | |
176 | if (!ret) { | |
23a1d5e9 RS |
177 | BN_clear_free(k); |
178 | BN_clear_free(r); | |
0f113f3e | 179 | } |
23a1d5e9 | 180 | if (ctx != ctx_in) |
0f113f3e | 181 | BN_CTX_free(ctx); |
8fdc3734 | 182 | EC_POINT_free(tmp_point); |
23a1d5e9 | 183 | BN_clear_free(X); |
26a7d938 | 184 | return ret; |
4d94ae00 BM |
185 | } |
186 | ||
32ab57cb SL |
187 | int ossl_ecdsa_simple_sign_setup(EC_KEY *eckey, BN_CTX *ctx_in, BIGNUM **kinvp, |
188 | BIGNUM **rp) | |
6a47db45 DSH |
189 | { |
190 | return ecdsa_sign_setup(eckey, ctx_in, kinvp, rp, NULL, 0); | |
191 | } | |
192 | ||
32ab57cb SL |
193 | ECDSA_SIG *ossl_ecdsa_simple_sign_sig(const unsigned char *dgst, int dgst_len, |
194 | const BIGNUM *in_kinv, const BIGNUM *in_r, | |
195 | EC_KEY *eckey) | |
4d94ae00 | 196 | { |
0f113f3e | 197 | int ok = 0, i; |
37132c97 | 198 | BIGNUM *kinv = NULL, *s, *m = NULL; |
be2e334f | 199 | const BIGNUM *order, *ckinv; |
0f113f3e MC |
200 | BN_CTX *ctx = NULL; |
201 | const EC_GROUP *group; | |
202 | ECDSA_SIG *ret; | |
0f113f3e MC |
203 | const BIGNUM *priv_key; |
204 | ||
0f113f3e MC |
205 | group = EC_KEY_get0_group(eckey); |
206 | priv_key = EC_KEY_get0_private_key(eckey); | |
14a7cfb3 | 207 | |
7408f675 | 208 | if (group == NULL) { |
9311d0c4 | 209 | ERR_raise(ERR_LIB_EC, ERR_R_PASSED_NULL_PARAMETER); |
0f113f3e MC |
210 | return NULL; |
211 | } | |
7408f675 | 212 | if (priv_key == NULL) { |
9311d0c4 | 213 | ERR_raise(ERR_LIB_EC, EC_R_MISSING_PRIVATE_KEY); |
7408f675 DO |
214 | return NULL; |
215 | } | |
4d94ae00 | 216 | |
4b0555ec | 217 | if (!EC_KEY_can_sign(eckey)) { |
9311d0c4 | 218 | ERR_raise(ERR_LIB_EC, EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING); |
4b0555ec DSH |
219 | return NULL; |
220 | } | |
221 | ||
0f113f3e | 222 | ret = ECDSA_SIG_new(); |
90945fa3 | 223 | if (ret == NULL) { |
9311d0c4 | 224 | ERR_raise(ERR_LIB_EC, ERR_R_MALLOC_FAILURE); |
0f113f3e MC |
225 | return NULL; |
226 | } | |
8cc44d97 DSH |
227 | ret->r = BN_new(); |
228 | ret->s = BN_new(); | |
229 | if (ret->r == NULL || ret->s == NULL) { | |
9311d0c4 | 230 | ERR_raise(ERR_LIB_EC, ERR_R_MALLOC_FAILURE); |
8cc44d97 DSH |
231 | goto err; |
232 | } | |
0f113f3e | 233 | s = ret->s; |
c6700d27 | 234 | |
a9612d6c | 235 | if ((ctx = BN_CTX_new_ex(eckey->libctx)) == NULL |
37132c97 | 236 | || (m = BN_new()) == NULL) { |
9311d0c4 | 237 | ERR_raise(ERR_LIB_EC, ERR_R_MALLOC_FAILURE); |
0f113f3e MC |
238 | goto err; |
239 | } | |
4d94ae00 | 240 | |
be2e334f | 241 | order = EC_GROUP_get0_order(group); |
0f113f3e MC |
242 | i = BN_num_bits(order); |
243 | /* | |
244 | * Need to truncate digest if it is too long: first truncate whole bytes. | |
245 | */ | |
246 | if (8 * dgst_len > i) | |
247 | dgst_len = (i + 7) / 8; | |
248 | if (!BN_bin2bn(dgst, dgst_len, m)) { | |
9311d0c4 | 249 | ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB); |
0f113f3e MC |
250 | goto err; |
251 | } | |
fff7a0dc | 252 | /* If still too long, truncate remaining bits with a shift */ |
0f113f3e | 253 | if ((8 * dgst_len > i) && !BN_rshift(m, m, 8 - (i & 0x7))) { |
9311d0c4 | 254 | ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB); |
0f113f3e MC |
255 | goto err; |
256 | } | |
257 | do { | |
258 | if (in_kinv == NULL || in_r == NULL) { | |
259 | if (!ecdsa_sign_setup(eckey, ctx, &kinv, &ret->r, dgst, dgst_len)) { | |
9311d0c4 | 260 | ERR_raise(ERR_LIB_EC, ERR_R_ECDSA_LIB); |
0f113f3e MC |
261 | goto err; |
262 | } | |
263 | ckinv = kinv; | |
264 | } else { | |
265 | ckinv = in_kinv; | |
266 | if (BN_copy(ret->r, in_r) == NULL) { | |
9311d0c4 | 267 | ERR_raise(ERR_LIB_EC, ERR_R_MALLOC_FAILURE); |
0f113f3e MC |
268 | goto err; |
269 | } | |
270 | } | |
4d94ae00 | 271 | |
37132c97 AP |
272 | /* |
273 | * With only one multiplicant being in Montgomery domain | |
274 | * multiplication yields real result without post-conversion. | |
275 | * Also note that all operations but last are performed with | |
276 | * zero-padded vectors. Last operation, BN_mod_mul_montgomery | |
277 | * below, returns user-visible value with removed zero padding. | |
278 | */ | |
279 | if (!bn_to_mont_fixed_top(s, ret->r, group->mont_data, ctx) | |
280 | || !bn_mul_mont_fixed_top(s, s, priv_key, group->mont_data, ctx)) { | |
9311d0c4 | 281 | ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB); |
a3e9d5aa MC |
282 | goto err; |
283 | } | |
37132c97 | 284 | if (!bn_mod_add_fixed_top(s, s, m, order)) { |
9311d0c4 | 285 | ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB); |
0f113f3e MC |
286 | goto err; |
287 | } | |
37132c97 AP |
288 | /* |
289 | * |s| can still be larger than modulus, because |m| can be. In | |
290 | * such case we count on Montgomery reduction to tie it up. | |
291 | */ | |
292 | if (!bn_to_mont_fixed_top(s, s, group->mont_data, ctx) | |
293 | || !BN_mod_mul_montgomery(s, s, ckinv, group->mont_data, ctx)) { | |
9311d0c4 | 294 | ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB); |
a3e9d5aa MC |
295 | goto err; |
296 | } | |
37132c97 | 297 | |
0f113f3e MC |
298 | if (BN_is_zero(s)) { |
299 | /* | |
532b1183 | 300 | * if kinv and r have been supplied by the caller, don't |
0f113f3e MC |
301 | * generate new kinv and r values |
302 | */ | |
303 | if (in_kinv != NULL && in_r != NULL) { | |
9311d0c4 | 304 | ERR_raise(ERR_LIB_EC, EC_R_NEED_NEW_SETUP_VALUES); |
0f113f3e MC |
305 | goto err; |
306 | } | |
fff7a0dc | 307 | } else { |
0f113f3e MC |
308 | /* s != 0 => we have a valid signature */ |
309 | break; | |
fff7a0dc AP |
310 | } |
311 | } while (1); | |
4d94ae00 | 312 | |
0f113f3e MC |
313 | ok = 1; |
314 | err: | |
315 | if (!ok) { | |
316 | ECDSA_SIG_free(ret); | |
317 | ret = NULL; | |
318 | } | |
23a1d5e9 | 319 | BN_CTX_free(ctx); |
3fc7a9b9 | 320 | BN_clear_free(m); |
23a1d5e9 | 321 | BN_clear_free(kinv); |
0f113f3e | 322 | return ret; |
4d94ae00 BM |
323 | } |
324 | ||
a200a817 DSH |
325 | /*- |
326 | * returns | |
327 | * 1: correct signature | |
328 | * 0: incorrect signature | |
329 | * -1: error | |
330 | */ | |
331 | int ossl_ecdsa_verify(int type, const unsigned char *dgst, int dgst_len, | |
332 | const unsigned char *sigbuf, int sig_len, EC_KEY *eckey) | |
333 | { | |
334 | ECDSA_SIG *s; | |
335 | const unsigned char *p = sigbuf; | |
336 | unsigned char *der = NULL; | |
337 | int derlen = -1; | |
338 | int ret = -1; | |
339 | ||
340 | s = ECDSA_SIG_new(); | |
341 | if (s == NULL) | |
26a7d938 | 342 | return ret; |
a200a817 DSH |
343 | if (d2i_ECDSA_SIG(&s, &p, sig_len) == NULL) |
344 | goto err; | |
345 | /* Ensure signature uses DER and doesn't have trailing garbage */ | |
346 | derlen = i2d_ECDSA_SIG(s, &der); | |
91e7bcc2 | 347 | if (derlen != sig_len || memcmp(sigbuf, der, derlen) != 0) |
a200a817 DSH |
348 | goto err; |
349 | ret = ECDSA_do_verify(dgst, dgst_len, s, eckey); | |
350 | err: | |
cff7d199 | 351 | OPENSSL_free(der); |
a200a817 | 352 | ECDSA_SIG_free(s); |
26a7d938 | 353 | return ret; |
a200a817 DSH |
354 | } |
355 | ||
32ab57cb SL |
356 | int ossl_ecdsa_simple_verify_sig(const unsigned char *dgst, int dgst_len, |
357 | const ECDSA_SIG *sig, EC_KEY *eckey) | |
4d94ae00 | 358 | { |
0f113f3e MC |
359 | int ret = -1, i; |
360 | BN_CTX *ctx; | |
be2e334f DSH |
361 | const BIGNUM *order; |
362 | BIGNUM *u1, *u2, *m, *X; | |
0f113f3e MC |
363 | EC_POINT *point = NULL; |
364 | const EC_GROUP *group; | |
365 | const EC_POINT *pub_key; | |
9dd84053 | 366 | |
0f113f3e MC |
367 | /* check input values */ |
368 | if (eckey == NULL || (group = EC_KEY_get0_group(eckey)) == NULL || | |
369 | (pub_key = EC_KEY_get0_public_key(eckey)) == NULL || sig == NULL) { | |
9311d0c4 | 370 | ERR_raise(ERR_LIB_EC, EC_R_MISSING_PARAMETERS); |
0f113f3e MC |
371 | return -1; |
372 | } | |
4d94ae00 | 373 | |
4b0555ec | 374 | if (!EC_KEY_can_sign(eckey)) { |
9311d0c4 | 375 | ERR_raise(ERR_LIB_EC, EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING); |
4b0555ec DSH |
376 | return -1; |
377 | } | |
378 | ||
a9612d6c | 379 | ctx = BN_CTX_new_ex(eckey->libctx); |
90945fa3 | 380 | if (ctx == NULL) { |
9311d0c4 | 381 | ERR_raise(ERR_LIB_EC, ERR_R_MALLOC_FAILURE); |
0f113f3e MC |
382 | return -1; |
383 | } | |
384 | BN_CTX_start(ctx); | |
0f113f3e MC |
385 | u1 = BN_CTX_get(ctx); |
386 | u2 = BN_CTX_get(ctx); | |
387 | m = BN_CTX_get(ctx); | |
388 | X = BN_CTX_get(ctx); | |
91e7bcc2 | 389 | if (X == NULL) { |
9311d0c4 | 390 | ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB); |
0f113f3e MC |
391 | goto err; |
392 | } | |
c6700d27 | 393 | |
be2e334f DSH |
394 | order = EC_GROUP_get0_order(group); |
395 | if (order == NULL) { | |
9311d0c4 | 396 | ERR_raise(ERR_LIB_EC, ERR_R_EC_LIB); |
0f113f3e MC |
397 | goto err; |
398 | } | |
4d94ae00 | 399 | |
0f113f3e MC |
400 | if (BN_is_zero(sig->r) || BN_is_negative(sig->r) || |
401 | BN_ucmp(sig->r, order) >= 0 || BN_is_zero(sig->s) || | |
402 | BN_is_negative(sig->s) || BN_ucmp(sig->s, order) >= 0) { | |
9311d0c4 | 403 | ERR_raise(ERR_LIB_EC, EC_R_BAD_SIGNATURE); |
0f113f3e MC |
404 | ret = 0; /* signature is invalid */ |
405 | goto err; | |
406 | } | |
407 | /* calculate tmp1 = inv(S) mod order */ | |
32ab57cb | 408 | if (!ossl_ec_group_do_inverse_ord(group, u2, sig->s, ctx)) { |
9311d0c4 | 409 | ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB); |
c11d372b | 410 | goto err; |
0f113f3e MC |
411 | } |
412 | /* digest -> m */ | |
413 | i = BN_num_bits(order); | |
414 | /* | |
415 | * Need to truncate digest if it is too long: first truncate whole bytes. | |
416 | */ | |
417 | if (8 * dgst_len > i) | |
418 | dgst_len = (i + 7) / 8; | |
419 | if (!BN_bin2bn(dgst, dgst_len, m)) { | |
9311d0c4 | 420 | ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB); |
0f113f3e MC |
421 | goto err; |
422 | } | |
423 | /* If still too long truncate remaining bits with a shift */ | |
424 | if ((8 * dgst_len > i) && !BN_rshift(m, m, 8 - (i & 0x7))) { | |
9311d0c4 | 425 | ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB); |
0f113f3e MC |
426 | goto err; |
427 | } | |
428 | /* u1 = m * tmp mod order */ | |
429 | if (!BN_mod_mul(u1, m, u2, order, ctx)) { | |
9311d0c4 | 430 | ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB); |
0f113f3e MC |
431 | goto err; |
432 | } | |
433 | /* u2 = r * w mod q */ | |
434 | if (!BN_mod_mul(u2, sig->r, u2, order, ctx)) { | |
9311d0c4 | 435 | ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB); |
0f113f3e MC |
436 | goto err; |
437 | } | |
438 | ||
439 | if ((point = EC_POINT_new(group)) == NULL) { | |
9311d0c4 | 440 | ERR_raise(ERR_LIB_EC, ERR_R_MALLOC_FAILURE); |
0f113f3e MC |
441 | goto err; |
442 | } | |
443 | if (!EC_POINT_mul(group, point, u1, pub_key, u2, ctx)) { | |
9311d0c4 | 444 | ERR_raise(ERR_LIB_EC, ERR_R_EC_LIB); |
0f113f3e MC |
445 | goto err; |
446 | } | |
0f113f3e | 447 | |
9cc570d4 | 448 | if (!EC_POINT_get_affine_coordinates(group, point, X, NULL, ctx)) { |
9311d0c4 | 449 | ERR_raise(ERR_LIB_EC, ERR_R_EC_LIB); |
9cc570d4 | 450 | goto err; |
0f113f3e | 451 | } |
9cc570d4 | 452 | |
0f113f3e | 453 | if (!BN_nnmod(u1, X, order, ctx)) { |
9311d0c4 | 454 | ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB); |
0f113f3e MC |
455 | goto err; |
456 | } | |
457 | /* if the signature is correct u1 is equal to sig->r */ | |
458 | ret = (BN_ucmp(u1, sig->r) == 0); | |
459 | err: | |
460 | BN_CTX_end(ctx); | |
461 | BN_CTX_free(ctx); | |
8fdc3734 | 462 | EC_POINT_free(point); |
0f113f3e | 463 | return ret; |
4d94ae00 | 464 | } |