]>
Commit | Line | Data |
---|---|---|
1 | /* | |
2 | * Copyright 2002-2018 The OpenSSL Project Authors. All Rights Reserved. | |
3 | * | |
4 | * Licensed under the Apache License 2.0 (the "License"). You may not use | |
5 | * this file except in compliance with the License. You can obtain a copy | |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
8 | */ | |
9 | ||
10 | /* | |
11 | * ECDSA low level APIs are deprecated for public use, but still ok for | |
12 | * internal use. | |
13 | */ | |
14 | #include "internal/deprecated.h" | |
15 | ||
16 | #include <string.h> | |
17 | #include <openssl/err.h> | |
18 | #include <openssl/obj_mac.h> | |
19 | #include <openssl/rand.h> | |
20 | #include "crypto/bn.h" | |
21 | #include "ec_local.h" | |
22 | ||
23 | int ossl_ecdsa_sign_setup(EC_KEY *eckey, BN_CTX *ctx_in, BIGNUM **kinvp, | |
24 | BIGNUM **rp) | |
25 | { | |
26 | if (eckey->group->meth->ecdsa_sign_setup == NULL) { | |
27 | ECerr(EC_F_OSSL_ECDSA_SIGN_SETUP, EC_R_CURVE_DOES_NOT_SUPPORT_ECDSA); | |
28 | return 0; | |
29 | } | |
30 | ||
31 | return eckey->group->meth->ecdsa_sign_setup(eckey, ctx_in, kinvp, rp); | |
32 | } | |
33 | ||
34 | ECDSA_SIG *ossl_ecdsa_sign_sig(const unsigned char *dgst, int dgst_len, | |
35 | const BIGNUM *in_kinv, const BIGNUM *in_r, | |
36 | EC_KEY *eckey) | |
37 | { | |
38 | if (eckey->group->meth->ecdsa_sign_sig == NULL) { | |
39 | ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, EC_R_CURVE_DOES_NOT_SUPPORT_ECDSA); | |
40 | return NULL; | |
41 | } | |
42 | ||
43 | return eckey->group->meth->ecdsa_sign_sig(dgst, dgst_len, | |
44 | in_kinv, in_r, eckey); | |
45 | } | |
46 | ||
47 | int ossl_ecdsa_verify_sig(const unsigned char *dgst, int dgst_len, | |
48 | const ECDSA_SIG *sig, EC_KEY *eckey) | |
49 | { | |
50 | if (eckey->group->meth->ecdsa_verify_sig == NULL) { | |
51 | ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, EC_R_CURVE_DOES_NOT_SUPPORT_ECDSA); | |
52 | return 0; | |
53 | } | |
54 | ||
55 | return eckey->group->meth->ecdsa_verify_sig(dgst, dgst_len, sig, eckey); | |
56 | } | |
57 | ||
58 | int ossl_ecdsa_sign(int type, const unsigned char *dgst, int dlen, | |
59 | unsigned char *sig, unsigned int *siglen, | |
60 | const BIGNUM *kinv, const BIGNUM *r, EC_KEY *eckey) | |
61 | { | |
62 | ECDSA_SIG *s; | |
63 | ||
64 | s = ECDSA_do_sign_ex(dgst, dlen, kinv, r, eckey); | |
65 | if (s == NULL) { | |
66 | *siglen = 0; | |
67 | return 0; | |
68 | } | |
69 | *siglen = i2d_ECDSA_SIG(s, &sig); | |
70 | ECDSA_SIG_free(s); | |
71 | return 1; | |
72 | } | |
73 | ||
74 | static int ecdsa_sign_setup(EC_KEY *eckey, BN_CTX *ctx_in, | |
75 | BIGNUM **kinvp, BIGNUM **rp, | |
76 | const unsigned char *dgst, int dlen) | |
77 | { | |
78 | BN_CTX *ctx = NULL; | |
79 | BIGNUM *k = NULL, *r = NULL, *X = NULL; | |
80 | const BIGNUM *order; | |
81 | EC_POINT *tmp_point = NULL; | |
82 | const EC_GROUP *group; | |
83 | int ret = 0; | |
84 | int order_bits; | |
85 | const BIGNUM *priv_key; | |
86 | ||
87 | if (eckey == NULL || (group = EC_KEY_get0_group(eckey)) == NULL) { | |
88 | ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_PASSED_NULL_PARAMETER); | |
89 | return 0; | |
90 | } | |
91 | if ((priv_key = EC_KEY_get0_private_key(eckey)) == NULL) { | |
92 | ECerr(EC_F_ECDSA_SIGN_SETUP, EC_R_MISSING_PRIVATE_KEY); | |
93 | return 0; | |
94 | } | |
95 | ||
96 | if (!EC_KEY_can_sign(eckey)) { | |
97 | ECerr(EC_F_ECDSA_SIGN_SETUP, EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING); | |
98 | return 0; | |
99 | } | |
100 | ||
101 | if ((ctx = ctx_in) == NULL) { | |
102 | if ((ctx = BN_CTX_new_ex(eckey->libctx)) == NULL) { | |
103 | ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_MALLOC_FAILURE); | |
104 | return 0; | |
105 | } | |
106 | } | |
107 | ||
108 | k = BN_secure_new(); /* this value is later returned in *kinvp */ | |
109 | r = BN_new(); /* this value is later returned in *rp */ | |
110 | X = BN_new(); | |
111 | if (k == NULL || r == NULL || X == NULL) { | |
112 | ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_MALLOC_FAILURE); | |
113 | goto err; | |
114 | } | |
115 | if ((tmp_point = EC_POINT_new(group)) == NULL) { | |
116 | ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_EC_LIB); | |
117 | goto err; | |
118 | } | |
119 | order = EC_GROUP_get0_order(group); | |
120 | ||
121 | /* Preallocate space */ | |
122 | order_bits = BN_num_bits(order); | |
123 | if (!BN_set_bit(k, order_bits) | |
124 | || !BN_set_bit(r, order_bits) | |
125 | || !BN_set_bit(X, order_bits)) | |
126 | goto err; | |
127 | ||
128 | do { | |
129 | /* get random k */ | |
130 | do { | |
131 | if (dgst != NULL) { | |
132 | if (!BN_generate_dsa_nonce(k, order, priv_key, | |
133 | dgst, dlen, ctx)) { | |
134 | ECerr(EC_F_ECDSA_SIGN_SETUP, | |
135 | EC_R_RANDOM_NUMBER_GENERATION_FAILED); | |
136 | goto err; | |
137 | } | |
138 | } else { | |
139 | if (!BN_priv_rand_range_ex(k, order, ctx)) { | |
140 | ECerr(EC_F_ECDSA_SIGN_SETUP, | |
141 | EC_R_RANDOM_NUMBER_GENERATION_FAILED); | |
142 | goto err; | |
143 | } | |
144 | } | |
145 | } while (BN_is_zero(k)); | |
146 | ||
147 | /* compute r the x-coordinate of generator * k */ | |
148 | if (!EC_POINT_mul(group, tmp_point, k, NULL, NULL, ctx)) { | |
149 | ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_EC_LIB); | |
150 | goto err; | |
151 | } | |
152 | ||
153 | if (!EC_POINT_get_affine_coordinates(group, tmp_point, X, NULL, ctx)) { | |
154 | ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_EC_LIB); | |
155 | goto err; | |
156 | } | |
157 | ||
158 | if (!BN_nnmod(r, X, order, ctx)) { | |
159 | ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_BN_LIB); | |
160 | goto err; | |
161 | } | |
162 | } while (BN_is_zero(r)); | |
163 | ||
164 | /* compute the inverse of k */ | |
165 | if (!ec_group_do_inverse_ord(group, k, k, ctx)) { | |
166 | ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_BN_LIB); | |
167 | goto err; | |
168 | } | |
169 | ||
170 | /* clear old values if necessary */ | |
171 | BN_clear_free(*rp); | |
172 | BN_clear_free(*kinvp); | |
173 | /* save the pre-computed values */ | |
174 | *rp = r; | |
175 | *kinvp = k; | |
176 | ret = 1; | |
177 | err: | |
178 | if (!ret) { | |
179 | BN_clear_free(k); | |
180 | BN_clear_free(r); | |
181 | } | |
182 | if (ctx != ctx_in) | |
183 | BN_CTX_free(ctx); | |
184 | EC_POINT_free(tmp_point); | |
185 | BN_clear_free(X); | |
186 | return ret; | |
187 | } | |
188 | ||
189 | int ecdsa_simple_sign_setup(EC_KEY *eckey, BN_CTX *ctx_in, BIGNUM **kinvp, | |
190 | BIGNUM **rp) | |
191 | { | |
192 | return ecdsa_sign_setup(eckey, ctx_in, kinvp, rp, NULL, 0); | |
193 | } | |
194 | ||
195 | ECDSA_SIG *ecdsa_simple_sign_sig(const unsigned char *dgst, int dgst_len, | |
196 | const BIGNUM *in_kinv, const BIGNUM *in_r, | |
197 | EC_KEY *eckey) | |
198 | { | |
199 | int ok = 0, i; | |
200 | BIGNUM *kinv = NULL, *s, *m = NULL; | |
201 | const BIGNUM *order, *ckinv; | |
202 | BN_CTX *ctx = NULL; | |
203 | const EC_GROUP *group; | |
204 | ECDSA_SIG *ret; | |
205 | const BIGNUM *priv_key; | |
206 | ||
207 | group = EC_KEY_get0_group(eckey); | |
208 | priv_key = EC_KEY_get0_private_key(eckey); | |
209 | ||
210 | if (group == NULL) { | |
211 | ECerr(EC_F_ECDSA_SIMPLE_SIGN_SIG, ERR_R_PASSED_NULL_PARAMETER); | |
212 | return NULL; | |
213 | } | |
214 | if (priv_key == NULL) { | |
215 | ECerr(EC_F_ECDSA_SIMPLE_SIGN_SIG, EC_R_MISSING_PRIVATE_KEY); | |
216 | return NULL; | |
217 | } | |
218 | ||
219 | if (!EC_KEY_can_sign(eckey)) { | |
220 | ECerr(EC_F_ECDSA_SIMPLE_SIGN_SIG, EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING); | |
221 | return NULL; | |
222 | } | |
223 | ||
224 | ret = ECDSA_SIG_new(); | |
225 | if (ret == NULL) { | |
226 | ECerr(EC_F_ECDSA_SIMPLE_SIGN_SIG, ERR_R_MALLOC_FAILURE); | |
227 | return NULL; | |
228 | } | |
229 | ret->r = BN_new(); | |
230 | ret->s = BN_new(); | |
231 | if (ret->r == NULL || ret->s == NULL) { | |
232 | ECerr(EC_F_ECDSA_SIMPLE_SIGN_SIG, ERR_R_MALLOC_FAILURE); | |
233 | goto err; | |
234 | } | |
235 | s = ret->s; | |
236 | ||
237 | if ((ctx = BN_CTX_new_ex(eckey->libctx)) == NULL | |
238 | || (m = BN_new()) == NULL) { | |
239 | ECerr(EC_F_ECDSA_SIMPLE_SIGN_SIG, ERR_R_MALLOC_FAILURE); | |
240 | goto err; | |
241 | } | |
242 | ||
243 | order = EC_GROUP_get0_order(group); | |
244 | i = BN_num_bits(order); | |
245 | /* | |
246 | * Need to truncate digest if it is too long: first truncate whole bytes. | |
247 | */ | |
248 | if (8 * dgst_len > i) | |
249 | dgst_len = (i + 7) / 8; | |
250 | if (!BN_bin2bn(dgst, dgst_len, m)) { | |
251 | ECerr(EC_F_ECDSA_SIMPLE_SIGN_SIG, ERR_R_BN_LIB); | |
252 | goto err; | |
253 | } | |
254 | /* If still too long, truncate remaining bits with a shift */ | |
255 | if ((8 * dgst_len > i) && !BN_rshift(m, m, 8 - (i & 0x7))) { | |
256 | ECerr(EC_F_ECDSA_SIMPLE_SIGN_SIG, ERR_R_BN_LIB); | |
257 | goto err; | |
258 | } | |
259 | do { | |
260 | if (in_kinv == NULL || in_r == NULL) { | |
261 | if (!ecdsa_sign_setup(eckey, ctx, &kinv, &ret->r, dgst, dgst_len)) { | |
262 | ECerr(EC_F_ECDSA_SIMPLE_SIGN_SIG, ERR_R_ECDSA_LIB); | |
263 | goto err; | |
264 | } | |
265 | ckinv = kinv; | |
266 | } else { | |
267 | ckinv = in_kinv; | |
268 | if (BN_copy(ret->r, in_r) == NULL) { | |
269 | ECerr(EC_F_ECDSA_SIMPLE_SIGN_SIG, ERR_R_MALLOC_FAILURE); | |
270 | goto err; | |
271 | } | |
272 | } | |
273 | ||
274 | /* | |
275 | * With only one multiplicant being in Montgomery domain | |
276 | * multiplication yields real result without post-conversion. | |
277 | * Also note that all operations but last are performed with | |
278 | * zero-padded vectors. Last operation, BN_mod_mul_montgomery | |
279 | * below, returns user-visible value with removed zero padding. | |
280 | */ | |
281 | if (!bn_to_mont_fixed_top(s, ret->r, group->mont_data, ctx) | |
282 | || !bn_mul_mont_fixed_top(s, s, priv_key, group->mont_data, ctx)) { | |
283 | ECerr(EC_F_ECDSA_SIMPLE_SIGN_SIG, ERR_R_BN_LIB); | |
284 | goto err; | |
285 | } | |
286 | if (!bn_mod_add_fixed_top(s, s, m, order)) { | |
287 | ECerr(EC_F_ECDSA_SIMPLE_SIGN_SIG, ERR_R_BN_LIB); | |
288 | goto err; | |
289 | } | |
290 | /* | |
291 | * |s| can still be larger than modulus, because |m| can be. In | |
292 | * such case we count on Montgomery reduction to tie it up. | |
293 | */ | |
294 | if (!bn_to_mont_fixed_top(s, s, group->mont_data, ctx) | |
295 | || !BN_mod_mul_montgomery(s, s, ckinv, group->mont_data, ctx)) { | |
296 | ECerr(EC_F_ECDSA_SIMPLE_SIGN_SIG, ERR_R_BN_LIB); | |
297 | goto err; | |
298 | } | |
299 | ||
300 | if (BN_is_zero(s)) { | |
301 | /* | |
302 | * if kinv and r have been supplied by the caller, don't | |
303 | * generate new kinv and r values | |
304 | */ | |
305 | if (in_kinv != NULL && in_r != NULL) { | |
306 | ECerr(EC_F_ECDSA_SIMPLE_SIGN_SIG, EC_R_NEED_NEW_SETUP_VALUES); | |
307 | goto err; | |
308 | } | |
309 | } else { | |
310 | /* s != 0 => we have a valid signature */ | |
311 | break; | |
312 | } | |
313 | } while (1); | |
314 | ||
315 | ok = 1; | |
316 | err: | |
317 | if (!ok) { | |
318 | ECDSA_SIG_free(ret); | |
319 | ret = NULL; | |
320 | } | |
321 | BN_CTX_free(ctx); | |
322 | BN_clear_free(m); | |
323 | BN_clear_free(kinv); | |
324 | return ret; | |
325 | } | |
326 | ||
327 | /*- | |
328 | * returns | |
329 | * 1: correct signature | |
330 | * 0: incorrect signature | |
331 | * -1: error | |
332 | */ | |
333 | int ossl_ecdsa_verify(int type, const unsigned char *dgst, int dgst_len, | |
334 | const unsigned char *sigbuf, int sig_len, EC_KEY *eckey) | |
335 | { | |
336 | ECDSA_SIG *s; | |
337 | const unsigned char *p = sigbuf; | |
338 | unsigned char *der = NULL; | |
339 | int derlen = -1; | |
340 | int ret = -1; | |
341 | ||
342 | s = ECDSA_SIG_new(); | |
343 | if (s == NULL) | |
344 | return ret; | |
345 | if (d2i_ECDSA_SIG(&s, &p, sig_len) == NULL) | |
346 | goto err; | |
347 | /* Ensure signature uses DER and doesn't have trailing garbage */ | |
348 | derlen = i2d_ECDSA_SIG(s, &der); | |
349 | if (derlen != sig_len || memcmp(sigbuf, der, derlen) != 0) | |
350 | goto err; | |
351 | ret = ECDSA_do_verify(dgst, dgst_len, s, eckey); | |
352 | err: | |
353 | OPENSSL_free(der); | |
354 | ECDSA_SIG_free(s); | |
355 | return ret; | |
356 | } | |
357 | ||
358 | int ecdsa_simple_verify_sig(const unsigned char *dgst, int dgst_len, | |
359 | const ECDSA_SIG *sig, EC_KEY *eckey) | |
360 | { | |
361 | int ret = -1, i; | |
362 | BN_CTX *ctx; | |
363 | const BIGNUM *order; | |
364 | BIGNUM *u1, *u2, *m, *X; | |
365 | EC_POINT *point = NULL; | |
366 | const EC_GROUP *group; | |
367 | const EC_POINT *pub_key; | |
368 | ||
369 | /* check input values */ | |
370 | if (eckey == NULL || (group = EC_KEY_get0_group(eckey)) == NULL || | |
371 | (pub_key = EC_KEY_get0_public_key(eckey)) == NULL || sig == NULL) { | |
372 | ECerr(EC_F_ECDSA_SIMPLE_VERIFY_SIG, EC_R_MISSING_PARAMETERS); | |
373 | return -1; | |
374 | } | |
375 | ||
376 | if (!EC_KEY_can_sign(eckey)) { | |
377 | ECerr(EC_F_ECDSA_SIMPLE_VERIFY_SIG, EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING); | |
378 | return -1; | |
379 | } | |
380 | ||
381 | ctx = BN_CTX_new_ex(eckey->libctx); | |
382 | if (ctx == NULL) { | |
383 | ECerr(EC_F_ECDSA_SIMPLE_VERIFY_SIG, ERR_R_MALLOC_FAILURE); | |
384 | return -1; | |
385 | } | |
386 | BN_CTX_start(ctx); | |
387 | u1 = BN_CTX_get(ctx); | |
388 | u2 = BN_CTX_get(ctx); | |
389 | m = BN_CTX_get(ctx); | |
390 | X = BN_CTX_get(ctx); | |
391 | if (X == NULL) { | |
392 | ECerr(EC_F_ECDSA_SIMPLE_VERIFY_SIG, ERR_R_BN_LIB); | |
393 | goto err; | |
394 | } | |
395 | ||
396 | order = EC_GROUP_get0_order(group); | |
397 | if (order == NULL) { | |
398 | ECerr(EC_F_ECDSA_SIMPLE_VERIFY_SIG, ERR_R_EC_LIB); | |
399 | goto err; | |
400 | } | |
401 | ||
402 | if (BN_is_zero(sig->r) || BN_is_negative(sig->r) || | |
403 | BN_ucmp(sig->r, order) >= 0 || BN_is_zero(sig->s) || | |
404 | BN_is_negative(sig->s) || BN_ucmp(sig->s, order) >= 0) { | |
405 | ECerr(EC_F_ECDSA_SIMPLE_VERIFY_SIG, EC_R_BAD_SIGNATURE); | |
406 | ret = 0; /* signature is invalid */ | |
407 | goto err; | |
408 | } | |
409 | /* calculate tmp1 = inv(S) mod order */ | |
410 | if (!ec_group_do_inverse_ord(group, u2, sig->s, ctx)) { | |
411 | ECerr(EC_F_ECDSA_SIMPLE_VERIFY_SIG, ERR_R_BN_LIB); | |
412 | goto err; | |
413 | } | |
414 | /* digest -> m */ | |
415 | i = BN_num_bits(order); | |
416 | /* | |
417 | * Need to truncate digest if it is too long: first truncate whole bytes. | |
418 | */ | |
419 | if (8 * dgst_len > i) | |
420 | dgst_len = (i + 7) / 8; | |
421 | if (!BN_bin2bn(dgst, dgst_len, m)) { | |
422 | ECerr(EC_F_ECDSA_SIMPLE_VERIFY_SIG, ERR_R_BN_LIB); | |
423 | goto err; | |
424 | } | |
425 | /* If still too long truncate remaining bits with a shift */ | |
426 | if ((8 * dgst_len > i) && !BN_rshift(m, m, 8 - (i & 0x7))) { | |
427 | ECerr(EC_F_ECDSA_SIMPLE_VERIFY_SIG, ERR_R_BN_LIB); | |
428 | goto err; | |
429 | } | |
430 | /* u1 = m * tmp mod order */ | |
431 | if (!BN_mod_mul(u1, m, u2, order, ctx)) { | |
432 | ECerr(EC_F_ECDSA_SIMPLE_VERIFY_SIG, ERR_R_BN_LIB); | |
433 | goto err; | |
434 | } | |
435 | /* u2 = r * w mod q */ | |
436 | if (!BN_mod_mul(u2, sig->r, u2, order, ctx)) { | |
437 | ECerr(EC_F_ECDSA_SIMPLE_VERIFY_SIG, ERR_R_BN_LIB); | |
438 | goto err; | |
439 | } | |
440 | ||
441 | if ((point = EC_POINT_new(group)) == NULL) { | |
442 | ECerr(EC_F_ECDSA_SIMPLE_VERIFY_SIG, ERR_R_MALLOC_FAILURE); | |
443 | goto err; | |
444 | } | |
445 | if (!EC_POINT_mul(group, point, u1, pub_key, u2, ctx)) { | |
446 | ECerr(EC_F_ECDSA_SIMPLE_VERIFY_SIG, ERR_R_EC_LIB); | |
447 | goto err; | |
448 | } | |
449 | ||
450 | if (!EC_POINT_get_affine_coordinates(group, point, X, NULL, ctx)) { | |
451 | ECerr(EC_F_ECDSA_SIMPLE_VERIFY_SIG, ERR_R_EC_LIB); | |
452 | goto err; | |
453 | } | |
454 | ||
455 | if (!BN_nnmod(u1, X, order, ctx)) { | |
456 | ECerr(EC_F_ECDSA_SIMPLE_VERIFY_SIG, ERR_R_BN_LIB); | |
457 | goto err; | |
458 | } | |
459 | /* if the signature is correct u1 is equal to sig->r */ | |
460 | ret = (BN_ucmp(u1, sig->r) == 0); | |
461 | err: | |
462 | BN_CTX_end(ctx); | |
463 | BN_CTX_free(ctx); | |
464 | EC_POINT_free(point); | |
465 | return ret; | |
466 | } |