yuzu-emu/mbedtls
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

mbedtls_ecp_gen_privkey_sw: generalize to mbedtls_mpi_random

Browse source 
Rename mbedtls_ecp_gen_privkey_sw to mbedtls_mpi_random since it has
no particular connection to elliptic curves beyond the fact that its
operation is defined by the deterministic ECDSA specification. This is
a generic function that generates a random MPI between 1 inclusive and
N exclusive.

Slightly generalize the function to accept a different lower bound,
which adds a negligible amount of complexity.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
This commit is contained in:
Gilles Peskine 2021-03-29 21:53:58 +02:00
parent 7888073147
commit 8cfffb30b3
4 changed files with 119 additions and 99 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
library/ecp.c
View file

@ -3093,15 +3093,17 @@ cleanup:
#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) #if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
MBEDTLS_STATIC_TESTABLE MBEDTLS_STATIC_TESTABLE
int mbedtls_ecp_gen_privkey_sw( const mbedtls_mpi *N, size_t n_bits, int mbedtls_mpi_random( mbedtls_mpi *X,
mbedtls_mpi *d, mbedtls_mpi_sint min,
int (*f_rng)(void *, unsigned char *, size_t), const mbedtls_mpi *N,
void *p_rng ) int (*f_rng)(void *, unsigned char *, size_t),
void *p_rng )
{ {
/* SEC1 3.2.1: Generate d such that 1 <= n < N */ /* SEC1 3.2.1: Generate X such that 1 <= n < N */
int ret = MBEDTLS_ERR_ECP_BAD_INPUT_DATA; int ret = MBEDTLS_ERR_MPI_BAD_INPUT_DATA;
int count = 0; int count = 0;
unsigned cmp = 0; unsigned cmp = 0;
size_t n_bits = mbedtls_mpi_bitlen( N );
size_t n_bytes = ( n_bits + 7 ) / 8; size_t n_bytes = ( n_bits + 7 ) / 8;
/* /*
@ -3114,8 +3116,8 @@ int mbedtls_ecp_gen_privkey_sw( const mbedtls_mpi *N, size_t n_bits,
*/ */
do do
{ {
MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( d, n_bytes, f_rng, p_rng ) ); MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( X, n_bytes, f_rng, p_rng ) );
MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( d, 8 * n_bytes - n_bits ) ); MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( X, 8 * n_bytes - n_bits ) );
/* /*
* Each try has at worst a probability 1/2 of failing (the msb has * Each try has at worst a probability 1/2 of failing (the msb has
@ -3128,17 +3130,17 @@ int mbedtls_ecp_gen_privkey_sw( const mbedtls_mpi *N, size_t n_bits,
*/ */
if( ++count > 30 ) if( ++count > 30 )
{ {
ret = MBEDTLS_ERR_ECP_RANDOM_FAILED; ret = MBEDTLS_ERR_MPI_NOT_ACCEPTABLE;
goto cleanup; goto cleanup;
} }
ret = mbedtls_mpi_lt_mpi_ct( d, N, &cmp ); ret = mbedtls_mpi_lt_mpi_ct( X, N, &cmp );
if( ret != 0 ) if( ret != 0 )
{ {
goto cleanup; goto cleanup;
} }
} }
while( mbedtls_mpi_cmp_int( d, 1 ) < 0 || cmp != 1 ); while( mbedtls_mpi_cmp_int( X, min ) < 0 || cmp != 1 );
cleanup: cleanup:
return( ret ); return( ret );
@ -3164,8 +3166,7 @@ int mbedtls_ecp_gen_privkey( const mbedtls_ecp_group *grp,
#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) #if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS ) if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS )
return( mbedtls_ecp_gen_privkey_sw( &grp->N, grp->nbits, d, return( mbedtls_mpi_random( d, 1, &grp->N, f_rng, p_rng ) );
f_rng, p_rng ) );
#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */ #endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA ); return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );

39
library/ecp_invasive.h
View file

@ -77,25 +77,36 @@ int mbedtls_ecp_gen_privkey_mx( size_t n_bits,
#endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */ #endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */
#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) #if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
/** Generate a private key on a short Weierstrass curve. /** Generate a random number uniformly in a range.
*
* This function generates a random number between \p min inclusive and
* \p N exclusive.
* *
* The procedure complies with RFC 6979 §3.3 (deterministic ECDSA) * The procedure complies with RFC 6979 §3.3 (deterministic ECDSA)
* when the RNG is a suitably parametrized instance of HMAC_DRBG. * when the RNG is a suitably parametrized instance of HMAC_DRBG
* and \p min is \c 1.
* *
* \p N The upper bound of the range. * \note There are `N - min` possible outputs. The lower bound
* \p n_bits The size of \p N in bits. This value must be correct, * \p min can be reached, but the upper bound \p N cannot.
* otherwise the result is unpredictable.
* \param d A random number, uniformly generated in the range [1, N-1].
* \param f_rng The RNG function.
* \param p_rng The RNG context to be passed to \p f_rng.
* *
* \return \c 0 on success. * \param X The destination MPI. This must point to an initialized MPI.
* \return \c MBEDTLS_ERR_ECP_xxx or MBEDTLS_ERR_MPI_xxx on failure. * \param min The minimum value to return.
* It must be nonnegative.
* \param N The upper bound of the range, exclusive.
* In other words, this is one plus the maximum value to return.
* \p N must be strictly larger than \p min.
* \param f_rng The RNG function to use. This must not be \c NULL.
* \param p_rng The RNG parameter to be passed to \p f_rng.
*
* \return \c 0 if successful.
* \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed.
* \return Another negative error code on failure.
*/ */
int mbedtls_ecp_gen_privkey_sw( const mbedtls_mpi *N, size_t n_bits, int mbedtls_mpi_random( mbedtls_mpi *X,
mbedtls_mpi *d, mbedtls_mpi_sint min,
int (*f_rng)(void *, unsigned char *, size_t), const mbedtls_mpi *N,
void *p_rng ); int (*f_rng)(void *, unsigned char *, size_t),
void *p_rng );
#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */ #endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
#endif /* MBEDTLS_TEST_HOOKS && MBEDTLS_ECP_C */ #endif /* MBEDTLS_TEST_HOOKS && MBEDTLS_ECP_C */

129
tests/suites/test_suite_ecp.data
View file

@ -312,95 +312,104 @@ genkey_mx_known_answer:447:"ffffffffffffffffffffffffffffffffffffffffffffffffffff
ECP generate Montgomery key: Curve448, not enough entropy ECP generate Montgomery key: Curve448, not enough entropy
genkey_mx_known_answer:447:"4f0102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f30313233343536":"" genkey_mx_known_answer:447:"4f0102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f30313233343536":""
ECP generate in range: 4 MPI random in range: 1..4
genkey_sw_many:"04":1000 mpi_random_many:1:"04":1000
ECP generate in range: 5 MPI random in range: 1..5
genkey_sw_many:"05":1000 mpi_random_many:1:"05":1000
ECP generate in range: 6 MPI random in range: 1..6
genkey_sw_many:"06":1000 mpi_random_many:1:"06":1000
ECP generate in range: 7 MPI random in range: 1..7
genkey_sw_many:"07":1000 mpi_random_many:1:"07":1000
ECP generate in range: 8 MPI random in range: 1..8
genkey_sw_many:"08":1000 mpi_random_many:1:"08":1000
ECP generate in range: 9 MPI random in range: 1..9
genkey_sw_many:"09":1000 mpi_random_many:1:"09":1000
ECP generate in range: 10 MPI random in range: 1..10
genkey_sw_many:"0a":1000 mpi_random_many:1:"0a":1000
ECP generate in range: 11 MPI random in range: 1..11
genkey_sw_many:"0b":1000 mpi_random_many:1:"0b":1000
ECP generate in range: 12 MPI random in range: 1..12
genkey_sw_many:"0c":1000 mpi_random_many:1:"0c":1000
ECP generate in range: 255 MPI random in range: 1..255
genkey_sw_many:"ff":100 mpi_random_many:1:"ff":100
ECP generate in range: 256 MPI random in range: 1..256
genkey_sw_many:"0100":100 mpi_random_many:1:"0100":100
ECP generate in range: 257 MPI random in range: 1..257
genkey_sw_many:"0101":100 mpi_random_many:1:"0101":100
ECP generate in range: 272 MPI random in range: 1..272
genkey_sw_many:"0110":100 mpi_random_many:1:"0110":100
ECP generate in range: 2^64-1 MPI random in range: 1..2^64-1
genkey_sw_many:"ffffffffffffffff":100 mpi_random_many:1:"ffffffffffffffff":100
ECP generate in range: 2^64 MPI random in range: 1..2^64
genkey_sw_many:"010000000000000000":100 mpi_random_many:1:"010000000000000000":100
ECP generate in range: 2^64+1 MPI random in range: 1..2^64+1
genkey_sw_many:"010000000000000001":100 mpi_random_many:1:"010000000000000001":100
ECP generate in range: 2^64+2^63 MPI random in range: 1..2^64+2^63
genkey_sw_many:"018000000000000000":100 mpi_random_many:1:"018000000000000000":100
ECP generate in range: 2^65-1 MPI random in range: 1..2^65-1
genkey_sw_many:"01ffffffffffffffff":100 mpi_random_many:1:"01ffffffffffffffff":100
ECP generate in range: 2^65 MPI random in range: 1..2^65
genkey_sw_many:"020000000000000000":100 mpi_random_many:1:"020000000000000000":100
ECP generate in range: 2^65+1 MPI random in range: 1..2^65+1
genkey_sw_many:"020000000000000001":100 mpi_random_many:1:"020000000000000001":100
ECP generate in range: 2^65+2^64 MPI random in range: 1..2^65+2^64
genkey_sw_many:"030000000000000000":100 mpi_random_many:1:"030000000000000000":100
ECP generate in range: 2^66+2^65 MPI random in range: 1..2^66+2^65
genkey_sw_many:"060000000000000000":100 mpi_random_many:1:"060000000000000000":100
ECP generate in range: 2^71-1 MPI random in range: 1..2^71-1
genkey_sw_many:"7fffffffffffffffff":100 mpi_random_many:1:"7fffffffffffffffff":100
ECP generate in range: 2^71 MPI random in range: 1..2^71
genkey_sw_many:"800000000000000000":100 mpi_random_many:1:"800000000000000000":100
ECP generate in range: 2^71+1 MPI random in range: 1..2^71+1
genkey_sw_many:"800000000000000001":100 mpi_random_many:1:"800000000000000001":100
ECP generate in range: 2^71+2^63 MPI random in range: 1..2^71+2^63
genkey_sw_many:"c00000000000000000":100 mpi_random_many:1:"c00000000000000000":100
ECP generate in range: 2^72-1 MPI random in range: 1..2^72-1
genkey_sw_many:"ffffffffffffffffff":100 mpi_random_many:1:"ffffffffffffffffff":100
ECP generate in range: 2^72 MPI random in range: 1..2^72
genkey_sw_many:"01000000000000000000":100 mpi_random_many:1:"01000000000000000000":100
ECP generate in range: 2^72+1 MPI random in range: 1..2^72+1
genkey_sw_many:"01000000000000000001":100 mpi_random_many:1:"01000000000000000001":100
ECP generate in range: 2^72+2^63 MPI random in range: 1..2^72+2^63
genkey_sw_many:"01800000000000000000":100 mpi_random_many:1:"01800000000000000000":100
MPI random in range: 0..4
mpi_random_many:0:"04":1000
MPI random in range: 2..4
mpi_random_many:1:"04":1000
MPI random in range: 3..4
mpi_random_many:1:"04":1000
ECP read key #1 (short weierstrass, too small) ECP read key #1 (short weierstrass, too small)
depends_on:MBEDTLS_ECP_DP_SECP192R1_ENABLED depends_on:MBEDTLS_ECP_DP_SECP192R1_ENABLED

23
tests/suites/test_suite_ecp.function
View file

@ -1324,7 +1324,7 @@ exit:
/* END_CASE */ /* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_TEST_HOOKS:MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */ /* BEGIN_CASE depends_on:MBEDTLS_TEST_HOOKS:MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
void genkey_sw_many( data_t *bound_bytes, int iterations ) void mpi_random_many( int min, data_t *bound_bytes, int iterations )
{ {
/* Generate numbers in the range 1..bound-1. Do it iterations times. /* Generate numbers in the range 1..bound-1. Do it iterations times.
* This function assumes that the value of bound is at least 2 and * This function assumes that the value of bound is at least 2 and
@ -1332,11 +1332,11 @@ void genkey_sw_many( data_t *bound_bytes, int iterations )
* effectively never occurs. * effectively never occurs.
*/ */
mbedtls_mpi bound; mbedtls_mpi upper_bound;
size_t n_bits; size_t n_bits;
mbedtls_mpi result; mbedtls_mpi result;
size_t b; size_t b;
/* If bound is small, stats[b] is the number of times the value b /* If upper_bound is small, stats[b] is the number of times the value b
* has been generated. Otherwise stats[b] is the number of times a * has been generated. Otherwise stats[b] is the number of times a
* value with bit b set has been generated. */ * value with bit b set has been generated. */
size_t *stats = NULL; size_t *stats = NULL;
@ -1344,12 +1344,12 @@ void genkey_sw_many( data_t *bound_bytes, int iterations )
int full_stats; int full_stats;
size_t i; size_t i;
mbedtls_mpi_init( &bound ); mbedtls_mpi_init( &upper_bound );
mbedtls_mpi_init( &result ); mbedtls_mpi_init( &result );
TEST_EQUAL( 0, mbedtls_mpi_read_binary( &bound, TEST_EQUAL( 0, mbedtls_mpi_read_binary( &upper_bound,
bound_bytes->x, bound_bytes->len ) ); bound_bytes->x, bound_bytes->len ) );
n_bits = mbedtls_mpi_bitlen( &bound ); n_bits = mbedtls_mpi_bitlen( &upper_bound );
/* Consider a bound "small" if it's less than 2^5. This value is chosen /* Consider a bound "small" if it's less than 2^5. This value is chosen
* to be small enough that the probability of missing one value is * to be small enough that the probability of missing one value is
* negligible given the number of iterations. It must be less than * negligible given the number of iterations. It must be less than
@ -1370,12 +1370,11 @@ void genkey_sw_many( data_t *bound_bytes, int iterations )
for( i = 0; i < (size_t) iterations; i++ ) for( i = 0; i < (size_t) iterations; i++ )
{ {
mbedtls_test_set_step( i ); mbedtls_test_set_step( i );
TEST_EQUAL( 0, mbedtls_ecp_gen_privkey_sw( TEST_EQUAL( 0, mbedtls_mpi_random( &result, min, &upper_bound,
&bound, n_bits, &result, mbedtls_test_rnd_std_rand, NULL ) );
mbedtls_test_rnd_std_rand, NULL ) );
TEST_ASSERT( mbedtls_mpi_cmp_mpi( &result, &bound ) < 0 ); TEST_ASSERT( mbedtls_mpi_cmp_mpi( &result, &upper_bound ) < 0 );
TEST_ASSERT( mbedtls_mpi_cmp_int( &result, 1 ) >= 0 ); TEST_ASSERT( mbedtls_mpi_cmp_int( &result, min ) >= 0 );
if( full_stats ) if( full_stats )
{ {
uint8_t value; uint8_t value;
@ -1425,7 +1424,7 @@ void genkey_sw_many( data_t *bound_bytes, int iterations )
} }
exit: exit:
mbedtls_mpi_free( &bound ); mbedtls_mpi_free( &upper_bound );
mbedtls_mpi_free( &result ); mbedtls_mpi_free( &result );
mbedtls_free( stats ); mbedtls_free( stats );
} }