yuzu-emu/mbedtls
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Add ecdsa_{read,write}_signature()

Browse source
This commit is contained in:
Manuel Pégourié-Gonnard 2013-08-08 13:30:57 +02:00
parent 5a8a62ce1c
commit b694b4896c
6 changed files with 206 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

42
include/polarssl/ecdsa.h
View file

@ -83,6 +83,48 @@ int ecdsa_verify( const ecp_group *grp,
const unsigned char *buf, size_t blen,
const ecp_point *Q, const mpi *r, const mpi *s);
/**
* \brief Compute ECDSA signature and write it to buffer
*
* \param ctx ECDSA context
* \param hash Message hash
* \param hlen Length of hash
* \param sig Buffer that will hold the signature
* \param slen Length of the signature written
* \param f_rng RNG function
* \param p_rng RNG parameter
*
* \note The "sig" buffer must be at least as large as twice the
* size of the curve used, plus 7 (eg. 71 bytes if a 256-bit
* curve is used).
*
* \return 0 if successful,
* or a POLARSSL_ERR_ECP, POLARSSL_ERR_MPI or
* POLARSSL_ERR_ASN1 error code
*/
int ecdsa_write_signature( ecdsa_context *ctx,
const unsigned char *hash, size_t hlen,
unsigned char *sig, size_t *slen,
int (*f_rng)(void *, unsigned char *, size_t),
void *p_rng );
/**
* \brief Read and verify an ECDSA signature
*
* \param ctx ECDSA context
* \param hash Message hash
* \param hlen Size of hash
* \param sig Signature to read and verify
* \param slen Size of sig
*
* \return 0 if successful,
* POLARSSL_ERR_ECP_BAD_INPUT_DATA if signature is invalid
* or a POLARSSL_ERR_ECP or POLARSSL_ERR_MPI error code
*/
int ecdsa_read_signature( ecdsa_context *ctx,
const unsigned char *hash, size_t hlen,
const unsigned char *sig, size_t slen );
/**
* \brief Initialize context
*

5
include/polarssl/ecp.h
View file

@ -126,9 +126,10 @@ ecp_keypair;
#define POLARSSL_ECP_DP_SECP521R1 25
/**
* Maximum bit size of the groups (that is, of N)
* Maximum size of the groups (that is, of N and P)
*/
#define POLARSSL_ECP_MAX_N_BITS 521
#define POLARSSL_ECP_MAX_BITS 521
#define POLARSSL_ECP_MAX_BYTES ( ( POLARSSL_ECP_MAX_BITS + 7 ) / 8 )
/*
* Maximum window size (actually, NAF width) used for point multipliation.

86
library/ecdsa.c
View file

@ -34,6 +34,7 @@
#if defined(POLARSSL_ECDSA_C)
#include "polarssl/ecdsa.h"
#include "polarssl/asn1write.h"
/*
* Derive a suitable integer for group grp from a buffer of length len
@ -187,6 +188,91 @@ cleanup:
return( ret );
}
/*
* RFC 4492 page 20:
*
* Ecdsa-Sig-Value ::= SEQUENCE {
* r INTEGER,
* s INTEGER
* }
*
* Size is at most
* 1 (tag) + 1 (len) + 1 (initial 0) + ECP_MAX_BYTES for each of r and s,
* twice that + 1 (tag) + 2 (len) for the sequence
* (assuming ECP_MAX_BYTES is less than 126 for r and s,
* and less than 124 (total len <= 255) for the sequence)
*/
#if POLARSSL_ECP_MAX_BYTES > 124
#error "POLARSSL_ECP_MAX_BYTES bigger than expected, please fix MAX_SIG_LEN"
#endif
#define MAX_SIG_LEN ( 3 + 2 * ( 2 + POLARSSL_ECP_MAX_BYTES ) )
/*
* Compute and write signature
*/
int ecdsa_write_signature( ecdsa_context *ctx,
const unsigned char *hash, size_t hlen,
unsigned char *sig, size_t *slen,
int (*f_rng)(void *, unsigned char *, size_t),
void *p_rng )
{
int ret;
unsigned char buf[MAX_SIG_LEN];
unsigned char *p = buf + MAX_SIG_LEN - 1;
size_t len = 0;
if( ( ret = ecdsa_sign( &ctx->grp, &ctx->r, &ctx->s, &ctx->d,
hash, hlen, f_rng, p_rng ) ) != 0 )
{
return( ret );
}
ASN1_CHK_ADD( len, asn1_write_mpi( &p, buf, &ctx->s ) );
ASN1_CHK_ADD( len, asn1_write_mpi( &p, buf, &ctx->r ) );
ASN1_CHK_ADD( len, asn1_write_len( &p, buf, len ) );
ASN1_CHK_ADD( len, asn1_write_tag( &p, buf,
ASN1_CONSTRUCTED | ASN1_SEQUENCE ) );
memcpy( sig, p, len );
*slen = len;
return( 0 );
}
/*
* Read and check signature
*/
int ecdsa_read_signature( ecdsa_context *ctx,
const unsigned char *hash, size_t hlen,
const unsigned char *sig, size_t slen )
{
int ret;
unsigned char *p = (unsigned char *) sig;
const unsigned char *end = sig + slen;
size_t len;
if( ( ret = asn1_get_tag( &p, end, &len,
ASN1_CONSTRUCTED | ASN1_SEQUENCE ) ) != 0 )
{
return( POLARSSL_ERR_ECP_BAD_INPUT_DATA + ret );
}
if( p + len != end )
return( POLARSSL_ERR_ECP_BAD_INPUT_DATA +
POLARSSL_ERR_ASN1_LENGTH_MISMATCH );
if( ( ret = asn1_get_mpi( &p, end, &ctx->r ) ) != 0 ||
( ret = asn1_get_mpi( &p, end, &ctx->s ) ) != 0 )
return( POLARSSL_ERR_ECP_BAD_INPUT_DATA + ret );
if( p != end )
return( POLARSSL_ERR_ECP_BAD_INPUT_DATA +
POLARSSL_ERR_ASN1_LENGTH_MISMATCH );
return( ecdsa_verify( &ctx->grp, hash, hlen, &ctx->Q, &ctx->r, &ctx->s ) );
}
/*
* Initialize context
*/

2
library/ecp.c
View file

@ -1146,7 +1146,7 @@ cleanup:
* (that is: grp->nbits / w + 1)
* Allow p_bits + 1 bits in case M = grp->N + 1 is one bit longer than N.
*/
#define MAX_NAF_LEN ( POLARSSL_ECP_MAX_N_BITS / 2 + 1 )
#define MAX_NAF_LEN ( POLARSSL_ECP_MAX_BITS / 2 + 1 )
/*
* Integer multiplication: R = m * P

14
tests/suites/test_suite_ecdsa.data
View file

@ -22,3 +22,17 @@ ecdsa_prim_test_vectors:POLARSSL_ECP_DP_SECP384R1:"0BEB646634BA87735D77AE4809A0E
ECDSA primitive rfc 4754 p521
ecdsa_prim_test_vectors:POLARSSL_ECP_DP_SECP521R1:"0065FDA3409451DCAB0A0EAD45495112A3D813C17BFD34BDF8C1209D7DF5849120597779060A7FF9D704ADF78B570FFAD6F062E95C7E0C5D5481C5B153B48B375FA1":"0151518F1AF0F563517EDD5485190DF95A4BF57B5CBA4CF2A9A3F6474725A35F7AFE0A6DDEB8BEDBCD6A197E592D40188901CECD650699C9B5E456AEA5ADD19052A8":"006F3B142EA1BFFF7E2837AD44C9E4FF6D2D34C73184BBAD90026DD5E6E85317D9DF45CAD7803C6C20035B2F3FF63AFF4E1BA64D1C077577DA3F4286C58F0AEAE643":"00C1C2B305419F5A41344D7E4359933D734096F556197A9B244342B8B62F46F9373778F9DE6B6497B1EF825FF24F42F9B4A4BD7382CFC3378A540B1B7F0C1B956C2F":"DDAF35A193617ABACC417349AE20413112E6FA4E89A97EA20A9EEEE64B55D39A2192992A274FC1A836BA3C23A3FEEBBD454D4423643CE80E2A9AC94FA54CA49F":"0154FD3836AF92D0DCA57DD5341D3053988534FDE8318FC6AAAAB68E2E6F4339B19F2F281A7E0B22C269D93CF8794A9278880ED7DBB8D9362CAEACEE544320552251":"017705A7030290D1CEB605A9A1BB03FF9CDD521E87A696EC926C8C10C8362DF4975367101F67D1CF9BCCBF2F3D239534FA509E70AAC851AE01AAC68D62F866472660"
ECDSA write-read random #1
ecdsa_write_read_random:POLARSSL_ECP_DP_SECP192R1
ECDSA write-read random #2
ecdsa_write_read_random:POLARSSL_ECP_DP_SECP224R1
ECDSA write-read random #3
ecdsa_write_read_random:POLARSSL_ECP_DP_SECP256R1
ECDSA write-read random #4
ecdsa_write_read_random:POLARSSL_ECP_DP_SECP384R1
ECDSA write-read random #5
ecdsa_write_read_random:POLARSSL_ECP_DP_SECP521R1

60
tests/suites/test_suite_ecdsa.function
View file

@ -76,3 +76,63 @@ void ecdsa_prim_test_vectors( int id, char *d_str, char *xQ_str, char *yQ_str,
mpi_free( &r_check ); mpi_free( &s_check );
}
/* END_CASE */
/* BEGIN_CASE */
void ecdsa_write_read_random( int id )
{
ecdsa_context ctx;
rnd_pseudo_info rnd_info;
unsigned char hash[66];
unsigned char sig[200];
size_t sig_len, i;
ecdsa_init( &ctx );
memset( &rnd_info, 0x00, sizeof( rnd_pseudo_info ) );
memset( hash, 0, sizeof( hash ) );
memset( sig, 0x2a, sizeof( sig ) );
/* prepare material for signature */
TEST_ASSERT( rnd_pseudo_rand( &rnd_info, hash, sizeof( hash ) ) == 0 );
/* generate signing key */
TEST_ASSERT( ecp_use_known_dp( &ctx.grp, id ) == 0 );
TEST_ASSERT( ecp_gen_keypair( &ctx.grp, &ctx.d, &ctx.Q,
&rnd_pseudo_rand, &rnd_info ) == 0 );
/* generate and write signature, then read and verify it */
TEST_ASSERT( ecdsa_write_signature( &ctx, hash, sizeof( hash ),
sig, &sig_len, &rnd_pseudo_rand, &rnd_info ) == 0 );
TEST_ASSERT( ecdsa_read_signature( &ctx, hash, sizeof( hash ),
sig, sig_len ) == 0 );
/* check we didn't write past the announced length */
for( i = sig_len; i < sizeof( sig ); i++ )
TEST_ASSERT( sig[i] == 0x2a );
/* try verification with invalid length */
TEST_ASSERT( ecdsa_read_signature( &ctx, hash, sizeof( hash ),
sig, sig_len - 1 ) != 0 );
TEST_ASSERT( ecdsa_read_signature( &ctx, hash, sizeof( hash ),
sig, sig_len + 1 ) != 0 );
/* try invalid sequence tag */
sig[0]++;
TEST_ASSERT( ecdsa_read_signature( &ctx, hash, sizeof( hash ),
sig, sig_len ) != 0 );
sig[0]--;
/* try modifying r */
sig[10]++;
TEST_ASSERT( ecdsa_read_signature( &ctx, hash, sizeof( hash ),
sig, sig_len ) != 0 );
sig[10]--;
/* try modifying s */
sig[sig_len - 1]++;
TEST_ASSERT( ecdsa_read_signature( &ctx, hash, sizeof( hash ),
sig, sig_len ) != 0 );
sig[sig_len - 1]--;
ecdsa_free( &ctx );
}
/* END_CASE */