Fix bug in ecc_ecdsa_verify.

* ecc-ecdsa-verify.c (ecc_ecdsa_verify): Use ecc_mod_mul_canonical
to compute the scalars used for ecc multiplication.
* testsuite/ecdsa-verify-test.c (test_main): Add test case that
triggers an assert on 64-bit platforms, without above fix.
* testsuite/ecdsa-sign-test.c (test_main): Test case generating
the same signature.

(cherry picked from commit 2397757b3f95fcae1e2d3011bf99ca5b5438378f)

diff --git a/ChangeLog b/ChangeLog
index 2a9217a6e1d417051802c26cb8a20bb78dfa4a3f..63848f538eae7b2d3f2a0fc7d68e3704c605751d 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,7 +1,15 @@
 2021-03-13  Niels Möller  <nisse@lysator.liu.se>
 
-       * eddsa-verify.c (equal_h): Use ecc_mod_mul_canonical.
+       * ecc-ecdsa-verify.c (ecc_ecdsa_verify): Use ecc_mod_mul_canonical
+       to compute the scalars used for ecc multiplication.
+       * testsuite/ecdsa-verify-test.c (test_main): Add test case that
+       triggers an assert on 64-bit platforms, without above fix.
+       * testsuite/ecdsa-sign-test.c (test_main): Test case generating
+       the same signature.
+
+2021-03-13  Niels Möller  <nisse@lysator.liu.se>
 
+       * eddsa-verify.c (equal_h): Use ecc_mod_mul_canonical.
 2021-03-11  Niels Möller  <nisse@lysator.liu.se>
 
        * ecc-mod-arith.c (ecc_mod_mul_canonical, ecc_mod_sqr_canonical):

diff --git a/ecc-ecdsa-verify.c b/ecc-ecdsa-verify.c
index 1b2dcca7bde9c9d248f2af947552479c6639f0ef..f3b112b0360c00d53f1c6050f683b2147bc72fe9 100644 (file)
--- a/ecc-ecdsa-verify.c
+++ b/ecc-ecdsa-verify.c
@@ -102,10 +102,10 @@ ecc_ecdsa_verify (const struct ecc_curve *ecc,
 
   /* u1 = h / s, P1 = u1 * G */
   ecc_hash (&ecc->q, hp, length, digest);
-  ecc_mod_mul (&ecc->q, u1, hp, sinv, u1);
+  ecc_mod_mul_canonical (&ecc->q, u1, hp, sinv, u1);
 
   /* u2 = r / s, P2 = u2 * Y */
-  ecc_mod_mul (&ecc->q, u2, rp, sinv, u2);
+  ecc_mod_mul_canonical (&ecc->q, u2, rp, sinv, u2);
 
    /* Total storage: 5*ecc->p.size + ecc->mul_itch */
   ecc->mul (ecc, P2, u2, pp, u2 + ecc->p.size);

diff --git a/testsuite/ecdsa-sign-test.c b/testsuite/ecdsa-sign-test.c
index b240a31b237e0a7dceb73d594db331016bb9029d..08a10a1d22662f71d7b142c8af7b58bad8a1beb8 100644 (file)
--- a/testsuite/ecdsa-sign-test.c
+++ b/testsuite/ecdsa-sign-test.c
@@ -58,6 +58,19 @@ test_ecdsa (const struct ecc_curve *ecc,
 void
 test_main (void)
 {
+  /* Producing the signature for corresponding test in
+     ecdsa-verify-test.c, with special u1 and u2. */
+  test_ecdsa (&_nettle_secp_224r1,
+             "99b5b787484def12894ca507058b3bf5"
+             "43d72d82fa7721d2e805e5e6",
+             "2",
+             SHEX("cdb887ac805a3b42e22d224c85482053"
+                  "16c755d4a736bb2032c92553"),
+             "706a46dc76dcb76798e60e6d89474788"
+             "d16dc18032d268fd1a704fa6", /* r */
+             "3a41e1423b1853e8aa89747b1f987364"
+             "44705d6d6d8371ea1f578f2e"); /* s */
+
   /* Test cases for the smaller groups, verified with a
      proof-of-concept implementation done for Yubico AB. */
   test_ecdsa (&_nettle_secp_192r1,

diff --git a/testsuite/ecdsa-verify-test.c b/testsuite/ecdsa-verify-test.c
index 3ceac0eb5b27bcc7396533fe84834b7c4f9f9390..8110c64dc2c7da758af24765bde5b2406f8982e0 100644 (file)
--- a/testsuite/ecdsa-verify-test.c
+++ b/testsuite/ecdsa-verify-test.c
@@ -81,6 +81,26 @@ test_ecdsa (const struct ecc_curve *ecc,
 void
 test_main (void)
 {
+  /* Corresponds to nonce k = 2 and private key z =
+     0x99b5b787484def12894ca507058b3bf543d72d82fa7721d2e805e5e6. z and
+     hash are chosen so that intermediate scalars in the verify
+     equations are u1 = 0x6b245680e700, u2 =
+     259da6542d4ba7d21ad916c3bd57f811. These values require canonical
+     reduction of the scalars. Bug caused by missing canonical
+     reduction reported by Guido Vranken. */
+  test_ecdsa (&_nettle_secp_224r1,
+             "9e7e6cc6b1bdfa8ee039b66ad85e5490"
+             "7be706a900a3cba1c8fdd014", /* x */
+             "74855db3f7c1b4097ae095745fc915e3"
+             "8a79d2a1de28f282eafb22ba", /* y */
+
+             SHEX("cdb887ac805a3b42e22d224c85482053"
+                  "16c755d4a736bb2032c92553"),
+             "706a46dc76dcb76798e60e6d89474788"
+             "d16dc18032d268fd1a704fa6", /* r */
+             "3a41e1423b1853e8aa89747b1f987364"
+             "44705d6d6d8371ea1f578f2e"); /* s */
+
   /* Test case provided by Guido Vranken, from oss-fuzz */
   test_ecdsa (&_nettle_secp_192r1,
              "14683086 f1734c6d e68743a6 48181b54 a74d4c5b 383eb6a8", /* x */