Coverage Report

Created: 2024-11-21 07:03

/src/mbedtls/library/ecdsa.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
 *  Elliptic curve DSA
3
 *
4
 *  Copyright The Mbed TLS Contributors
5
 *  SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
6
 */
7
8
/*
9
 * References:
10
 *
11
 * SEC1 https://www.secg.org/sec1-v2.pdf
12
 */
13
14
#include "common.h"
15
16
#if defined(MBEDTLS_ECDSA_C)
17
18
#include "mbedtls/ecdsa.h"
19
#include "mbedtls/asn1write.h"
20
21
#include <string.h>
22
23
#if defined(MBEDTLS_ECDSA_DETERMINISTIC)
24
#include "mbedtls/hmac_drbg.h"
25
#endif
26
27
#include "mbedtls/platform.h"
28
29
#include "mbedtls/platform_util.h"
30
#include "mbedtls/error.h"
31
32
#if defined(MBEDTLS_ECP_RESTARTABLE)
33
34
/*
35
 * Sub-context for ecdsa_verify()
36
 */
37
struct mbedtls_ecdsa_restart_ver {
38
    mbedtls_mpi u1, u2;     /* intermediate values  */
39
    enum {                  /* what to do next?     */
40
        ecdsa_ver_init = 0, /* getting started      */
41
        ecdsa_ver_muladd,   /* muladd step          */
42
    } state;
43
};
44
45
/*
46
 * Init verify restart sub-context
47
 */
48
static void ecdsa_restart_ver_init(mbedtls_ecdsa_restart_ver_ctx *ctx)
49
{
50
    mbedtls_mpi_init(&ctx->u1);
51
    mbedtls_mpi_init(&ctx->u2);
52
    ctx->state = ecdsa_ver_init;
53
}
54
55
/*
56
 * Free the components of a verify restart sub-context
57
 */
58
static void ecdsa_restart_ver_free(mbedtls_ecdsa_restart_ver_ctx *ctx)
59
{
60
    if (ctx == NULL) {
61
        return;
62
    }
63
64
    mbedtls_mpi_free(&ctx->u1);
65
    mbedtls_mpi_free(&ctx->u2);
66
67
    ecdsa_restart_ver_init(ctx);
68
}
69
70
/*
71
 * Sub-context for ecdsa_sign()
72
 */
73
struct mbedtls_ecdsa_restart_sig {
74
    int sign_tries;
75
    int key_tries;
76
    mbedtls_mpi k;          /* per-signature random */
77
    mbedtls_mpi r;          /* r value              */
78
    enum {                  /* what to do next?     */
79
        ecdsa_sig_init = 0, /* getting started      */
80
        ecdsa_sig_mul,      /* doing ecp_mul()      */
81
        ecdsa_sig_modn,     /* mod N computations   */
82
    } state;
83
};
84
85
/*
86
 * Init verify sign sub-context
87
 */
88
static void ecdsa_restart_sig_init(mbedtls_ecdsa_restart_sig_ctx *ctx)
89
{
90
    ctx->sign_tries = 0;
91
    ctx->key_tries = 0;
92
    mbedtls_mpi_init(&ctx->k);
93
    mbedtls_mpi_init(&ctx->r);
94
    ctx->state = ecdsa_sig_init;
95
}
96
97
/*
98
 * Free the components of a sign restart sub-context
99
 */
100
static void ecdsa_restart_sig_free(mbedtls_ecdsa_restart_sig_ctx *ctx)
101
{
102
    if (ctx == NULL) {
103
        return;
104
    }
105
106
    mbedtls_mpi_free(&ctx->k);
107
    mbedtls_mpi_free(&ctx->r);
108
}
109
110
#if defined(MBEDTLS_ECDSA_DETERMINISTIC)
111
/*
112
 * Sub-context for ecdsa_sign_det()
113
 */
114
struct mbedtls_ecdsa_restart_det {
115
    mbedtls_hmac_drbg_context rng_ctx;  /* DRBG state   */
116
    enum {                      /* what to do next?     */
117
        ecdsa_det_init = 0,     /* getting started      */
118
        ecdsa_det_sign,         /* make signature       */
119
    } state;
120
};
121
122
/*
123
 * Init verify sign_det sub-context
124
 */
125
static void ecdsa_restart_det_init(mbedtls_ecdsa_restart_det_ctx *ctx)
126
{
127
    mbedtls_hmac_drbg_init(&ctx->rng_ctx);
128
    ctx->state = ecdsa_det_init;
129
}
130
131
/*
132
 * Free the components of a sign_det restart sub-context
133
 */
134
static void ecdsa_restart_det_free(mbedtls_ecdsa_restart_det_ctx *ctx)
135
{
136
    if (ctx == NULL) {
137
        return;
138
    }
139
140
    mbedtls_hmac_drbg_free(&ctx->rng_ctx);
141
142
    ecdsa_restart_det_init(ctx);
143
}
144
#endif /* MBEDTLS_ECDSA_DETERMINISTIC */
145
146
#define ECDSA_RS_ECP    (rs_ctx == NULL ? NULL : &rs_ctx->ecp)
147
148
/* Utility macro for checking and updating ops budget */
149
#define ECDSA_BUDGET(ops)   \
150
    MBEDTLS_MPI_CHK(mbedtls_ecp_check_budget(grp, ECDSA_RS_ECP, ops));
151
152
/* Call this when entering a function that needs its own sub-context */
153
#define ECDSA_RS_ENTER(SUB)   do {                                 \
154
        /* reset ops count for this call if top-level */                 \
155
        if (rs_ctx != NULL && rs_ctx->ecp.depth++ == 0)                 \
156
        rs_ctx->ecp.ops_done = 0;                                    \
157
                                                                     \
158
        /* set up our own sub-context if needed */                       \
159
        if (mbedtls_ecp_restart_is_enabled() &&                          \
160
            rs_ctx != NULL && rs_ctx->SUB == NULL)                      \
161
        {                                                                \
162
            rs_ctx->SUB = mbedtls_calloc(1, sizeof(*rs_ctx->SUB));   \
163
            if (rs_ctx->SUB == NULL)                                    \
164
            return MBEDTLS_ERR_ECP_ALLOC_FAILED;                  \
165
                                                                   \
166
            ecdsa_restart_## SUB ##_init(rs_ctx->SUB);                 \
167
        }                                                                \
168
} while (0)
169
170
/* Call this when leaving a function that needs its own sub-context */
171
#define ECDSA_RS_LEAVE(SUB)   do {                                 \
172
        /* clear our sub-context when not in progress (done or error) */ \
173
        if (rs_ctx != NULL && rs_ctx->SUB != NULL &&                     \
174
            ret != MBEDTLS_ERR_ECP_IN_PROGRESS)                         \
175
        {                                                                \
176
            ecdsa_restart_## SUB ##_free(rs_ctx->SUB);                 \
177
            mbedtls_free(rs_ctx->SUB);                                 \
178
            rs_ctx->SUB = NULL;                                          \
179
        }                                                                \
180
                                                                     \
181
        if (rs_ctx != NULL)                                             \
182
        rs_ctx->ecp.depth--;                                         \
183
} while (0)
184
185
#else /* MBEDTLS_ECP_RESTARTABLE */
186
187
#define ECDSA_RS_ECP    NULL
188
189
#define ECDSA_BUDGET(ops)     /* no-op; for compatibility */
190
191
535
#define ECDSA_RS_ENTER(SUB)   (void) rs_ctx
192
535
#define ECDSA_RS_LEAVE(SUB)   (void) rs_ctx
193
194
#endif /* MBEDTLS_ECP_RESTARTABLE */
195
196
#if defined(MBEDTLS_ECDSA_DETERMINISTIC) || \
197
    !defined(MBEDTLS_ECDSA_SIGN_ALT)     || \
198
    !defined(MBEDTLS_ECDSA_VERIFY_ALT)
199
/*
200
 * Derive a suitable integer for group grp from a buffer of length len
201
 * SEC1 4.1.3 step 5 aka SEC1 4.1.4 step 3
202
 */
203
static int derive_mpi(const mbedtls_ecp_group *grp, mbedtls_mpi *x,
204
                      const unsigned char *buf, size_t blen)
205
476
{
206
476
    int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
207
476
    size_t n_size = (grp->nbits + 7) / 8;
208
476
    size_t use_size = blen > n_size ? n_size : blen;
209
210
476
    MBEDTLS_MPI_CHK(mbedtls_mpi_read_binary(x, buf, use_size));
211
476
    if (use_size * 8 > grp->nbits) {
212
2
        MBEDTLS_MPI_CHK(mbedtls_mpi_shift_r(x, use_size * 8 - grp->nbits));
213
2
    }
214
215
    /* While at it, reduce modulo N */
216
476
    if (mbedtls_mpi_cmp_mpi(x, &grp->N) >= 0) {
217
1
        MBEDTLS_MPI_CHK(mbedtls_mpi_sub_mpi(x, x, &grp->N));
218
1
    }
219
220
476
cleanup:
221
476
    return ret;
222
476
}
223
#endif /* ECDSA_DETERMINISTIC || !ECDSA_SIGN_ALT || !ECDSA_VERIFY_ALT */
224
225
int mbedtls_ecdsa_can_do(mbedtls_ecp_group_id gid)
226
547
{
227
547
    switch (gid) {
228
0
#ifdef MBEDTLS_ECP_DP_CURVE25519_ENABLED
229
0
        case MBEDTLS_ECP_DP_CURVE25519: return 0;
230
0
#endif
231
0
#ifdef MBEDTLS_ECP_DP_CURVE448_ENABLED
232
0
        case MBEDTLS_ECP_DP_CURVE448: return 0;
233
0
#endif
234
547
        default: return 1;
235
547
    }
236
547
}
237
238
#if !defined(MBEDTLS_ECDSA_SIGN_ALT)
239
/*
240
 * Compute ECDSA signature of a hashed message (SEC1 4.1.3)
241
 * Obviously, compared to SEC1 4.1.3, we skip step 4 (hash message)
242
 */
243
int mbedtls_ecdsa_sign_restartable(mbedtls_ecp_group *grp,
244
                                   mbedtls_mpi *r, mbedtls_mpi *s,
245
                                   const mbedtls_mpi *d, const unsigned char *buf, size_t blen,
246
                                   int (*f_rng)(void *, unsigned char *, size_t), void *p_rng,
247
                                   int (*f_rng_blind)(void *, unsigned char *, size_t),
248
                                   void *p_rng_blind,
249
                                   mbedtls_ecdsa_restart_ctx *rs_ctx)
250
206
{
251
206
    int ret, key_tries, sign_tries;
252
206
    int *p_sign_tries = &sign_tries, *p_key_tries = &key_tries;
253
206
    mbedtls_ecp_point R;
254
206
    mbedtls_mpi k, e, t;
255
206
    mbedtls_mpi *pk = &k, *pr = r;
256
257
    /* Fail cleanly on curves such as Curve25519 that can't be used for ECDSA */
258
206
    if (!mbedtls_ecdsa_can_do(grp->id) || grp->N.p == NULL) {
259
0
        return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
260
0
    }
261
262
    /* Make sure d is in range 1..n-1 */
263
206
    if (mbedtls_mpi_cmp_int(d, 1) < 0 || mbedtls_mpi_cmp_mpi(d, &grp->N) >= 0) {
264
12
        return MBEDTLS_ERR_ECP_INVALID_KEY;
265
12
    }
266
267
194
    mbedtls_ecp_point_init(&R);
268
194
    mbedtls_mpi_init(&k); mbedtls_mpi_init(&e); mbedtls_mpi_init(&t);
269
270
194
    ECDSA_RS_ENTER(sig);
271
272
#if defined(MBEDTLS_ECP_RESTARTABLE)
273
    if (rs_ctx != NULL && rs_ctx->sig != NULL) {
274
        /* redirect to our context */
275
        p_sign_tries = &rs_ctx->sig->sign_tries;
276
        p_key_tries = &rs_ctx->sig->key_tries;
277
        pk = &rs_ctx->sig->k;
278
        pr = &rs_ctx->sig->r;
279
280
        /* jump to current step */
281
        if (rs_ctx->sig->state == ecdsa_sig_mul) {
282
            goto mul;
283
        }
284
        if (rs_ctx->sig->state == ecdsa_sig_modn) {
285
            goto modn;
286
        }
287
    }
288
#endif /* MBEDTLS_ECP_RESTARTABLE */
289
290
194
    *p_sign_tries = 0;
291
194
    do {
292
194
        if ((*p_sign_tries)++ > 10) {
293
0
            ret = MBEDTLS_ERR_ECP_RANDOM_FAILED;
294
0
            goto cleanup;
295
0
        }
296
297
        /*
298
         * Steps 1-3: generate a suitable ephemeral keypair
299
         * and set r = xR mod n
300
         */
301
194
        *p_key_tries = 0;
302
194
        do {
303
194
            if ((*p_key_tries)++ > 10) {
304
0
                ret = MBEDTLS_ERR_ECP_RANDOM_FAILED;
305
0
                goto cleanup;
306
0
            }
307
308
194
            MBEDTLS_MPI_CHK(mbedtls_ecp_gen_privkey(grp, pk, f_rng, p_rng));
309
310
#if defined(MBEDTLS_ECP_RESTARTABLE)
311
            if (rs_ctx != NULL && rs_ctx->sig != NULL) {
312
                rs_ctx->sig->state = ecdsa_sig_mul;
313
            }
314
315
mul:
316
#endif
317
146
            MBEDTLS_MPI_CHK(mbedtls_ecp_mul_restartable(grp, &R, pk, &grp->G,
318
146
                                                        f_rng_blind,
319
146
                                                        p_rng_blind,
320
146
                                                        ECDSA_RS_ECP));
321
145
            MBEDTLS_MPI_CHK(mbedtls_mpi_mod_mpi(pr, &R.X, &grp->N));
322
145
        } while (mbedtls_mpi_cmp_int(pr, 0) == 0);
323
324
#if defined(MBEDTLS_ECP_RESTARTABLE)
325
        if (rs_ctx != NULL && rs_ctx->sig != NULL) {
326
            rs_ctx->sig->state = ecdsa_sig_modn;
327
        }
328
329
modn:
330
#endif
331
        /*
332
         * Accounting for everything up to the end of the loop
333
         * (step 6, but checking now avoids saving e and t)
334
         */
335
145
        ECDSA_BUDGET(MBEDTLS_ECP_OPS_INV + 4);
336
337
        /*
338
         * Step 5: derive MPI from hashed message
339
         */
340
145
        MBEDTLS_MPI_CHK(derive_mpi(grp, &e, buf, blen));
341
342
        /*
343
         * Generate a random value to blind inv_mod in next step,
344
         * avoiding a potential timing leak.
345
         */
346
145
        MBEDTLS_MPI_CHK(mbedtls_ecp_gen_privkey(grp, &t, f_rng_blind,
347
145
                                                p_rng_blind));
348
349
        /*
350
         * Step 6: compute s = (e + r * d) / k = t (e + rd) / (kt) mod n
351
         */
352
144
        MBEDTLS_MPI_CHK(mbedtls_mpi_mul_mpi(s, pr, d));
353
144
        MBEDTLS_MPI_CHK(mbedtls_mpi_add_mpi(&e, &e, s));
354
144
        MBEDTLS_MPI_CHK(mbedtls_mpi_mul_mpi(&e, &e, &t));
355
144
        MBEDTLS_MPI_CHK(mbedtls_mpi_mul_mpi(pk, pk, &t));
356
144
        MBEDTLS_MPI_CHK(mbedtls_mpi_mod_mpi(pk, pk, &grp->N));
357
144
        MBEDTLS_MPI_CHK(mbedtls_mpi_inv_mod(s, pk, &grp->N));
358
144
        MBEDTLS_MPI_CHK(mbedtls_mpi_mul_mpi(s, s, &e));
359
144
        MBEDTLS_MPI_CHK(mbedtls_mpi_mod_mpi(s, s, &grp->N));
360
144
    } while (mbedtls_mpi_cmp_int(s, 0) == 0);
361
362
#if defined(MBEDTLS_ECP_RESTARTABLE)
363
    if (rs_ctx != NULL && rs_ctx->sig != NULL) {
364
        MBEDTLS_MPI_CHK(mbedtls_mpi_copy(r, pr));
365
    }
366
#endif
367
368
194
cleanup:
369
194
    mbedtls_ecp_point_free(&R);
370
194
    mbedtls_mpi_free(&k); mbedtls_mpi_free(&e); mbedtls_mpi_free(&t);
371
372
194
    ECDSA_RS_LEAVE(sig);
373
374
194
    return ret;
375
194
}
376
377
/*
378
 * Compute ECDSA signature of a hashed message
379
 */
380
int mbedtls_ecdsa_sign(mbedtls_ecp_group *grp, mbedtls_mpi *r, mbedtls_mpi *s,
381
                       const mbedtls_mpi *d, const unsigned char *buf, size_t blen,
382
                       int (*f_rng)(void *, unsigned char *, size_t), void *p_rng)
383
206
{
384
    /* Use the same RNG for both blinding and ephemeral key generation */
385
206
    return mbedtls_ecdsa_sign_restartable(grp, r, s, d, buf, blen,
386
206
                                          f_rng, p_rng, f_rng, p_rng, NULL);
387
206
}
388
#endif /* !MBEDTLS_ECDSA_SIGN_ALT */
389
390
#if defined(MBEDTLS_ECDSA_DETERMINISTIC)
391
/*
392
 * Deterministic signature wrapper
393
 *
394
 * note:    The f_rng_blind parameter must not be NULL.
395
 *
396
 */
397
int mbedtls_ecdsa_sign_det_restartable(mbedtls_ecp_group *grp,
398
                                       mbedtls_mpi *r, mbedtls_mpi *s,
399
                                       const mbedtls_mpi *d, const unsigned char *buf, size_t blen,
400
                                       mbedtls_md_type_t md_alg,
401
                                       int (*f_rng_blind)(void *, unsigned char *, size_t),
402
                                       void *p_rng_blind,
403
                                       mbedtls_ecdsa_restart_ctx *rs_ctx)
404
0
{
405
0
    int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
406
0
    mbedtls_hmac_drbg_context rng_ctx;
407
0
    mbedtls_hmac_drbg_context *p_rng = &rng_ctx;
408
0
    unsigned char data[2 * MBEDTLS_ECP_MAX_BYTES];
409
0
    size_t grp_len = (grp->nbits + 7) / 8;
410
0
    const mbedtls_md_info_t *md_info;
411
0
    mbedtls_mpi h;
412
413
0
    if ((md_info = mbedtls_md_info_from_type(md_alg)) == NULL) {
414
0
        return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
415
0
    }
416
417
0
    mbedtls_mpi_init(&h);
418
0
    mbedtls_hmac_drbg_init(&rng_ctx);
419
420
0
    ECDSA_RS_ENTER(det);
421
422
#if defined(MBEDTLS_ECP_RESTARTABLE)
423
    if (rs_ctx != NULL && rs_ctx->det != NULL) {
424
        /* redirect to our context */
425
        p_rng = &rs_ctx->det->rng_ctx;
426
427
        /* jump to current step */
428
        if (rs_ctx->det->state == ecdsa_det_sign) {
429
            goto sign;
430
        }
431
    }
432
#endif /* MBEDTLS_ECP_RESTARTABLE */
433
434
    /* Use private key and message hash (reduced) to initialize HMAC_DRBG */
435
0
    MBEDTLS_MPI_CHK(mbedtls_mpi_write_binary(d, data, grp_len));
436
0
    MBEDTLS_MPI_CHK(derive_mpi(grp, &h, buf, blen));
437
0
    MBEDTLS_MPI_CHK(mbedtls_mpi_write_binary(&h, data + grp_len, grp_len));
438
0
    MBEDTLS_MPI_CHK(mbedtls_hmac_drbg_seed_buf(p_rng, md_info, data, 2 * grp_len));
439
440
#if defined(MBEDTLS_ECP_RESTARTABLE)
441
    if (rs_ctx != NULL && rs_ctx->det != NULL) {
442
        rs_ctx->det->state = ecdsa_det_sign;
443
    }
444
445
sign:
446
#endif
447
#if defined(MBEDTLS_ECDSA_SIGN_ALT)
448
    (void) f_rng_blind;
449
    (void) p_rng_blind;
450
    ret = mbedtls_ecdsa_sign(grp, r, s, d, buf, blen,
451
                             mbedtls_hmac_drbg_random, p_rng);
452
#else
453
0
    ret = mbedtls_ecdsa_sign_restartable(grp, r, s, d, buf, blen,
454
0
                                         mbedtls_hmac_drbg_random, p_rng,
455
0
                                         f_rng_blind, p_rng_blind, rs_ctx);
456
0
#endif /* MBEDTLS_ECDSA_SIGN_ALT */
457
458
0
cleanup:
459
0
    mbedtls_hmac_drbg_free(&rng_ctx);
460
0
    mbedtls_mpi_free(&h);
461
462
0
    ECDSA_RS_LEAVE(det);
463
464
0
    return ret;
465
0
}
466
467
/*
468
 * Deterministic signature wrapper
469
 */
470
int mbedtls_ecdsa_sign_det_ext(mbedtls_ecp_group *grp, mbedtls_mpi *r,
471
                               mbedtls_mpi *s, const mbedtls_mpi *d,
472
                               const unsigned char *buf, size_t blen,
473
                               mbedtls_md_type_t md_alg,
474
                               int (*f_rng_blind)(void *, unsigned char *,
475
                                                  size_t),
476
                               void *p_rng_blind)
477
0
{
478
0
    return mbedtls_ecdsa_sign_det_restartable(grp, r, s, d, buf, blen, md_alg,
479
0
                                              f_rng_blind, p_rng_blind, NULL);
480
0
}
481
#endif /* MBEDTLS_ECDSA_DETERMINISTIC */
482
483
#if !defined(MBEDTLS_ECDSA_VERIFY_ALT)
484
/*
485
 * Verify ECDSA signature of hashed message (SEC1 4.1.4)
486
 * Obviously, compared to SEC1 4.1.3, we skip step 2 (hash message)
487
 */
488
int mbedtls_ecdsa_verify_restartable(mbedtls_ecp_group *grp,
489
                                     const unsigned char *buf, size_t blen,
490
                                     const mbedtls_ecp_point *Q,
491
                                     const mbedtls_mpi *r,
492
                                     const mbedtls_mpi *s,
493
                                     mbedtls_ecdsa_restart_ctx *rs_ctx)
494
341
{
495
341
    int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
496
341
    mbedtls_mpi e, s_inv, u1, u2;
497
341
    mbedtls_ecp_point R;
498
341
    mbedtls_mpi *pu1 = &u1, *pu2 = &u2;
499
500
341
    mbedtls_ecp_point_init(&R);
501
341
    mbedtls_mpi_init(&e); mbedtls_mpi_init(&s_inv);
502
341
    mbedtls_mpi_init(&u1); mbedtls_mpi_init(&u2);
503
504
    /* Fail cleanly on curves such as Curve25519 that can't be used for ECDSA */
505
341
    if (!mbedtls_ecdsa_can_do(grp->id) || grp->N.p == NULL) {
506
0
        return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
507
0
    }
508
509
341
    ECDSA_RS_ENTER(ver);
510
511
#if defined(MBEDTLS_ECP_RESTARTABLE)
512
    if (rs_ctx != NULL && rs_ctx->ver != NULL) {
513
        /* redirect to our context */
514
        pu1 = &rs_ctx->ver->u1;
515
        pu2 = &rs_ctx->ver->u2;
516
517
        /* jump to current step */
518
        if (rs_ctx->ver->state == ecdsa_ver_muladd) {
519
            goto muladd;
520
        }
521
    }
522
#endif /* MBEDTLS_ECP_RESTARTABLE */
523
524
    /*
525
     * Step 1: make sure r and s are in range 1..n-1
526
     */
527
341
    if (mbedtls_mpi_cmp_int(r, 1) < 0 || mbedtls_mpi_cmp_mpi(r, &grp->N) >= 0 ||
528
341
        mbedtls_mpi_cmp_int(s, 1) < 0 || mbedtls_mpi_cmp_mpi(s, &grp->N) >= 0) {
529
10
        ret = MBEDTLS_ERR_ECP_VERIFY_FAILED;
530
10
        goto cleanup;
531
10
    }
532
533
    /*
534
     * Step 3: derive MPI from hashed message
535
     */
536
331
    MBEDTLS_MPI_CHK(derive_mpi(grp, &e, buf, blen));
537
538
    /*
539
     * Step 4: u1 = e / s mod n, u2 = r / s mod n
540
     */
541
331
    ECDSA_BUDGET(MBEDTLS_ECP_OPS_CHK + MBEDTLS_ECP_OPS_INV + 2);
542
543
331
    MBEDTLS_MPI_CHK(mbedtls_mpi_inv_mod(&s_inv, s, &grp->N));
544
545
331
    MBEDTLS_MPI_CHK(mbedtls_mpi_mul_mpi(pu1, &e, &s_inv));
546
331
    MBEDTLS_MPI_CHK(mbedtls_mpi_mod_mpi(pu1, pu1, &grp->N));
547
548
331
    MBEDTLS_MPI_CHK(mbedtls_mpi_mul_mpi(pu2, r, &s_inv));
549
331
    MBEDTLS_MPI_CHK(mbedtls_mpi_mod_mpi(pu2, pu2, &grp->N));
550
551
#if defined(MBEDTLS_ECP_RESTARTABLE)
552
    if (rs_ctx != NULL && rs_ctx->ver != NULL) {
553
        rs_ctx->ver->state = ecdsa_ver_muladd;
554
    }
555
556
muladd:
557
#endif
558
    /*
559
     * Step 5: R = u1 G + u2 Q
560
     */
561
331
    MBEDTLS_MPI_CHK(mbedtls_ecp_muladd_restartable(grp,
562
331
                                                   &R, pu1, &grp->G, pu2, Q, ECDSA_RS_ECP));
563
564
331
    if (mbedtls_ecp_is_zero(&R)) {
565
0
        ret = MBEDTLS_ERR_ECP_VERIFY_FAILED;
566
0
        goto cleanup;
567
0
    }
568
569
    /*
570
     * Step 6: convert xR to an integer (no-op)
571
     * Step 7: reduce xR mod n (gives v)
572
     */
573
331
    MBEDTLS_MPI_CHK(mbedtls_mpi_mod_mpi(&R.X, &R.X, &grp->N));
574
575
    /*
576
     * Step 8: check if v (that is, R.X) is equal to r
577
     */
578
331
    if (mbedtls_mpi_cmp_mpi(&R.X, r) != 0) {
579
46
        ret = MBEDTLS_ERR_ECP_VERIFY_FAILED;
580
46
        goto cleanup;
581
46
    }
582
583
341
cleanup:
584
341
    mbedtls_ecp_point_free(&R);
585
341
    mbedtls_mpi_free(&e); mbedtls_mpi_free(&s_inv);
586
341
    mbedtls_mpi_free(&u1); mbedtls_mpi_free(&u2);
587
588
341
    ECDSA_RS_LEAVE(ver);
589
590
341
    return ret;
591
331
}
592
593
/*
594
 * Verify ECDSA signature of hashed message
595
 */
596
int mbedtls_ecdsa_verify(mbedtls_ecp_group *grp,
597
                         const unsigned char *buf, size_t blen,
598
                         const mbedtls_ecp_point *Q,
599
                         const mbedtls_mpi *r,
600
                         const mbedtls_mpi *s)
601
341
{
602
341
    return mbedtls_ecdsa_verify_restartable(grp, buf, blen, Q, r, s, NULL);
603
341
}
604
#endif /* !MBEDTLS_ECDSA_VERIFY_ALT */
605
606
/*
607
 * Convert a signature (given by context) to ASN.1
608
 */
609
static int ecdsa_signature_to_asn1(const mbedtls_mpi *r, const mbedtls_mpi *s,
610
                                   unsigned char *sig, size_t sig_size,
611
                                   size_t *slen)
612
0
{
613
0
    int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
614
0
    unsigned char buf[MBEDTLS_ECDSA_MAX_LEN] = { 0 };
615
0
    unsigned char *p = buf + sizeof(buf);
616
0
    size_t len = 0;
617
618
0
    MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_mpi(&p, buf, s));
619
0
    MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_mpi(&p, buf, r));
620
621
0
    MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_len(&p, buf, len));
622
0
    MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_tag(&p, buf,
623
0
                                                     MBEDTLS_ASN1_CONSTRUCTED |
624
0
                                                     MBEDTLS_ASN1_SEQUENCE));
625
626
0
    if (len > sig_size) {
627
0
        return MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL;
628
0
    }
629
630
0
    memcpy(sig, p, len);
631
0
    *slen = len;
632
633
0
    return 0;
634
0
}
635
636
/*
637
 * Compute and write signature
638
 */
639
int mbedtls_ecdsa_write_signature_restartable(mbedtls_ecdsa_context *ctx,
640
                                              mbedtls_md_type_t md_alg,
641
                                              const unsigned char *hash, size_t hlen,
642
                                              unsigned char *sig, size_t sig_size, size_t *slen,
643
                                              int (*f_rng)(void *, unsigned char *, size_t),
644
                                              void *p_rng,
645
                                              mbedtls_ecdsa_restart_ctx *rs_ctx)
646
0
{
647
0
    int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
648
0
    mbedtls_mpi r, s;
649
0
    if (f_rng == NULL) {
650
0
        return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
651
0
    }
652
653
0
    mbedtls_mpi_init(&r);
654
0
    mbedtls_mpi_init(&s);
655
656
0
#if defined(MBEDTLS_ECDSA_DETERMINISTIC)
657
0
    MBEDTLS_MPI_CHK(mbedtls_ecdsa_sign_det_restartable(&ctx->grp, &r, &s, &ctx->d,
658
0
                                                       hash, hlen, md_alg, f_rng,
659
0
                                                       p_rng, rs_ctx));
660
#else
661
    (void) md_alg;
662
663
#if defined(MBEDTLS_ECDSA_SIGN_ALT)
664
    (void) rs_ctx;
665
666
    MBEDTLS_MPI_CHK(mbedtls_ecdsa_sign(&ctx->grp, &r, &s, &ctx->d,
667
                                       hash, hlen, f_rng, p_rng));
668
#else
669
    /* Use the same RNG for both blinding and ephemeral key generation */
670
    MBEDTLS_MPI_CHK(mbedtls_ecdsa_sign_restartable(&ctx->grp, &r, &s, &ctx->d,
671
                                                   hash, hlen, f_rng, p_rng, f_rng,
672
                                                   p_rng, rs_ctx));
673
#endif /* MBEDTLS_ECDSA_SIGN_ALT */
674
#endif /* MBEDTLS_ECDSA_DETERMINISTIC */
675
676
0
    MBEDTLS_MPI_CHK(ecdsa_signature_to_asn1(&r, &s, sig, sig_size, slen));
677
678
0
cleanup:
679
0
    mbedtls_mpi_free(&r);
680
0
    mbedtls_mpi_free(&s);
681
682
0
    return ret;
683
0
}
684
685
/*
686
 * Compute and write signature
687
 */
688
int mbedtls_ecdsa_write_signature(mbedtls_ecdsa_context *ctx,
689
                                  mbedtls_md_type_t md_alg,
690
                                  const unsigned char *hash, size_t hlen,
691
                                  unsigned char *sig, size_t sig_size, size_t *slen,
692
                                  int (*f_rng)(void *, unsigned char *, size_t),
693
                                  void *p_rng)
694
0
{
695
0
    return mbedtls_ecdsa_write_signature_restartable(
696
0
        ctx, md_alg, hash, hlen, sig, sig_size, slen,
697
0
        f_rng, p_rng, NULL);
698
0
}
699
700
/*
701
 * Read and check signature
702
 */
703
int mbedtls_ecdsa_read_signature(mbedtls_ecdsa_context *ctx,
704
                                 const unsigned char *hash, size_t hlen,
705
                                 const unsigned char *sig, size_t slen)
706
0
{
707
0
    return mbedtls_ecdsa_read_signature_restartable(
708
0
        ctx, hash, hlen, sig, slen, NULL);
709
0
}
710
711
/*
712
 * Restartable read and check signature
713
 */
714
int mbedtls_ecdsa_read_signature_restartable(mbedtls_ecdsa_context *ctx,
715
                                             const unsigned char *hash, size_t hlen,
716
                                             const unsigned char *sig, size_t slen,
717
                                             mbedtls_ecdsa_restart_ctx *rs_ctx)
718
0
{
719
0
    int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
720
0
    unsigned char *p = (unsigned char *) sig;
721
0
    const unsigned char *end = sig + slen;
722
0
    size_t len;
723
0
    mbedtls_mpi r, s;
724
0
    mbedtls_mpi_init(&r);
725
0
    mbedtls_mpi_init(&s);
726
727
0
    if ((ret = mbedtls_asn1_get_tag(&p, end, &len,
728
0
                                    MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) {
729
0
        ret += MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
730
0
        goto cleanup;
731
0
    }
732
733
0
    if (p + len != end) {
734
0
        ret = MBEDTLS_ERROR_ADD(MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
735
0
                                MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
736
0
        goto cleanup;
737
0
    }
738
739
0
    if ((ret = mbedtls_asn1_get_mpi(&p, end, &r)) != 0 ||
740
0
        (ret = mbedtls_asn1_get_mpi(&p, end, &s)) != 0) {
741
0
        ret += MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
742
0
        goto cleanup;
743
0
    }
744
#if defined(MBEDTLS_ECDSA_VERIFY_ALT)
745
    (void) rs_ctx;
746
747
    if ((ret = mbedtls_ecdsa_verify(&ctx->grp, hash, hlen,
748
                                    &ctx->Q, &r, &s)) != 0) {
749
        goto cleanup;
750
    }
751
#else
752
0
    if ((ret = mbedtls_ecdsa_verify_restartable(&ctx->grp, hash, hlen,
753
0
                                                &ctx->Q, &r, &s, rs_ctx)) != 0) {
754
0
        goto cleanup;
755
0
    }
756
0
#endif /* MBEDTLS_ECDSA_VERIFY_ALT */
757
758
    /* At this point we know that the buffer starts with a valid signature.
759
     * Return 0 if the buffer just contains the signature, and a specific
760
     * error code if the valid signature is followed by more data. */
761
0
    if (p != end) {
762
0
        ret = MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH;
763
0
    }
764
765
0
cleanup:
766
0
    mbedtls_mpi_free(&r);
767
0
    mbedtls_mpi_free(&s);
768
769
0
    return ret;
770
0
}
771
772
#if !defined(MBEDTLS_ECDSA_GENKEY_ALT)
773
/*
774
 * Generate key pair
775
 */
776
int mbedtls_ecdsa_genkey(mbedtls_ecdsa_context *ctx, mbedtls_ecp_group_id gid,
777
                         int (*f_rng)(void *, unsigned char *, size_t), void *p_rng)
778
0
{
779
0
    int ret = 0;
780
0
    ret = mbedtls_ecp_group_load(&ctx->grp, gid);
781
0
    if (ret != 0) {
782
0
        return ret;
783
0
    }
784
785
0
    return mbedtls_ecp_gen_keypair(&ctx->grp, &ctx->d,
786
0
                                   &ctx->Q, f_rng, p_rng);
787
0
}
788
#endif /* !MBEDTLS_ECDSA_GENKEY_ALT */
789
790
/*
791
 * Set context from an mbedtls_ecp_keypair
792
 */
793
int mbedtls_ecdsa_from_keypair(mbedtls_ecdsa_context *ctx, const mbedtls_ecp_keypair *key)
794
0
{
795
0
    int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
796
0
    if ((ret = mbedtls_ecp_group_copy(&ctx->grp, &key->grp)) != 0 ||
797
0
        (ret = mbedtls_mpi_copy(&ctx->d, &key->d)) != 0 ||
798
0
        (ret = mbedtls_ecp_copy(&ctx->Q, &key->Q)) != 0) {
799
0
        mbedtls_ecdsa_free(ctx);
800
0
    }
801
802
0
    return ret;
803
0
}
804
805
/*
806
 * Initialize context
807
 */
808
void mbedtls_ecdsa_init(mbedtls_ecdsa_context *ctx)
809
233
{
810
233
    mbedtls_ecp_keypair_init(ctx);
811
233
}
812
813
/*
814
 * Free context
815
 */
816
void mbedtls_ecdsa_free(mbedtls_ecdsa_context *ctx)
817
233
{
818
233
    if (ctx == NULL) {
819
0
        return;
820
0
    }
821
822
233
    mbedtls_ecp_keypair_free(ctx);
823
233
}
824
825
#if defined(MBEDTLS_ECP_RESTARTABLE)
826
/*
827
 * Initialize a restart context
828
 */
829
void mbedtls_ecdsa_restart_init(mbedtls_ecdsa_restart_ctx *ctx)
830
{
831
    mbedtls_ecp_restart_init(&ctx->ecp);
832
833
    ctx->ver = NULL;
834
    ctx->sig = NULL;
835
#if defined(MBEDTLS_ECDSA_DETERMINISTIC)
836
    ctx->det = NULL;
837
#endif
838
}
839
840
/*
841
 * Free the components of a restart context
842
 */
843
void mbedtls_ecdsa_restart_free(mbedtls_ecdsa_restart_ctx *ctx)
844
{
845
    if (ctx == NULL) {
846
        return;
847
    }
848
849
    mbedtls_ecp_restart_free(&ctx->ecp);
850
851
    ecdsa_restart_ver_free(ctx->ver);
852
    mbedtls_free(ctx->ver);
853
    ctx->ver = NULL;
854
855
    ecdsa_restart_sig_free(ctx->sig);
856
    mbedtls_free(ctx->sig);
857
    ctx->sig = NULL;
858
859
#if defined(MBEDTLS_ECDSA_DETERMINISTIC)
860
    ecdsa_restart_det_free(ctx->det);
861
    mbedtls_free(ctx->det);
862
    ctx->det = NULL;
863
#endif
864
}
865
#endif /* MBEDTLS_ECP_RESTARTABLE */
866
867
#endif /* MBEDTLS_ECDSA_C */