// This file was extracted from the TCG Published

// Trusted Platform Module Library

// Part 4: Supporting Routines

// Family "2.0"

// Level 00 Revision 01.16

// October 30, 2014

#include <string.h>

#include   "OsslCryptoEngine.h"

#ifdef TPM_ALG_ECC

#include   "CpriDataEcc.h"

#include   "CpriDataEcc.c"

//

//

//      Functions

//

//      _cpri__EccStartup()

//

//     This function is called at TPM Startup to initialize the crypto units.

//     In this implementation, no initialization is performed at startup but a future version may initialize the self-

//     test functions here.

//

LIB_EXPORT BOOL

_cpri__EccStartup(

    void

    )

{

    return TRUE;

}

//

//

//      _cpri__GetCurveIdByIndex()

//

//     This function returns the number of the i-th implemented curve. The normal use would be to call this

//     function with i starting at 0. When the i is greater than or equal to the number of implemented curves,

//     TPM_ECC_NONE is returned.

//

LIB_EXPORT TPM_ECC_CURVE

_cpri__GetCurveIdByIndex(

    UINT16                i

    )

{

    if(i >= ECC_CURVE_COUNT)

        return TPM_ECC_NONE;

    return eccCurves[i].curveId;

}

LIB_EXPORT UINT32

_cpri__EccGetCurveCount(

    void

    )

{

    return ECC_CURVE_COUNT;

}

//

//

//      _cpri__EccGetParametersByCurveId()

//

//     This function returns a pointer to the curve data that is associated with the indicated curveId. If there is no

//     curve with the indicated ID, the function returns NULL.

//

//

//

//

//     Return Value                      Meaning

//

//     NULL                              curve with the      indicated   TPM_ECC_CURVE    value   is   not

//                                       implemented

//     non-NULL                          pointer to the curve data

//

LIB_EXPORT const ECC_CURVE *

_cpri__EccGetParametersByCurveId(

   TPM_ECC_CURVE       curveId               // IN: the curveID

   )

{

   int          i;

   for(i = 0; i < ECC_CURVE_COUNT; i++)

   {

       if(eccCurves[i].curveId == curveId)

           return &eccCurves[i];

   }

   FAIL(FATAL_ERROR_INTERNAL);

   return NULL; // Never reached.

}

static const ECC_CURVE_DATA *

GetCurveData(

   TPM_ECC_CURVE       curveId               // IN: the curveID

   )

{

   const ECC_CURVE     *curve = _cpri__EccGetParametersByCurveId(curveId);

   return curve->curveData;

}

//

//

//      Point2B()

//

//     This function makes a TPMS_ECC_POINT from a BIGNUM EC_POINT.

//

static BOOL

Point2B(

   EC_GROUP           *group,                //   IN: group for the point

   TPMS_ECC_POINT     *p,                    //   OUT: receives the converted point

   EC_POINT           *ecP,                  //   IN: the point to convert

   INT16               size,                 //   IN: size of the coordinates

   BN_CTX             *context               //   IN: working context

   )

{

   BIGNUM             *bnX;

   BIGNUM             *bnY;

   BN_CTX_start(context);

   bnX = BN_CTX_get(context);

   bnY = BN_CTX_get(context);

   if(        bnY == NULL

        // Get the coordinate values

       || EC_POINT_get_affine_coordinates_GFp(group, ecP, bnX, bnY, context) != 1

       // Convert x

       || (!BnTo2B(&p->x.b, bnX, size))

       // Convert y

       || (!BnTo2B(&p->y.b, bnY, size))

      )

            FAIL(FATAL_ERROR_INTERNAL);

   BN_CTX_end(context);

   return TRUE;

}

//

//

//       EccCurveInit()

//

//      This function initializes the OpenSSL() group definition structure

//      This function is only used within this file.

//      It is a fatal error if groupContext is not provided.

//

//      Return Value                       Meaning

//

//      NULL                               the TPM_ECC_CURVE is not valid

//      non-NULL                           points to a structure in groupContext static EC_GROUP *

//

static EC_GROUP *

EccCurveInit(

    TPM_ECC_CURVE         curveId,             // IN: the ID of the curve

    BN_CTX               *groupContext         // IN: the context in which the group is to be

                                               //     created

    )

{

    const ECC_CURVE_DATA            *curveData = GetCurveData(curveId);

    EC_GROUP                        *group = NULL;

    EC_POINT                        *P = NULL;

    BN_CTX                          *context;

    BIGNUM                          *bnP;

    BIGNUM                          *bnA;

    BIGNUM                          *bnB;

    BIGNUM                          *bnX;

    BIGNUM                          *bnY;

    BIGNUM                          *bnN;

    BIGNUM                          *bnH;

    int                              ok = FALSE;

    // Context must be provided and curve selector must be valid

    pAssert(groupContext != NULL && curveData != NULL);

    context = BN_CTX_new();

    if(context == NULL)

        FAIL(FATAL_ERROR_ALLOCATION);

    BN_CTX_start(context);

    bnP = BN_CTX_get(context);

    bnA = BN_CTX_get(context);

    bnB = BN_CTX_get(context);

    bnX = BN_CTX_get(context);

    bnY = BN_CTX_get(context);

    bnN = BN_CTX_get(context);

    bnH = BN_CTX_get(context);

    if (bnH == NULL)

        goto Cleanup;

    // Convert the number formats

    BnFrom2B(bnP,      curveData->p);

    BnFrom2B(bnA,      curveData->a);

    BnFrom2B(bnB,      curveData->b);

    BnFrom2B(bnX,      curveData->x);

    BnFrom2B(bnY,      curveData->y);

    BnFrom2B(bnN,      curveData->n);

    BnFrom2B(bnH,      curveData->h);

   // initialize EC group, associate a generator point and initialize the point

   // from the parameter data

   ok = (   (group = EC_GROUP_new_curve_GFp(bnP, bnA, bnB, groupContext)) != NULL

         && (P = EC_POINT_new(group)) != NULL

         && EC_POINT_set_affine_coordinates_GFp(group, P, bnX, bnY, groupContext)

         && EC_GROUP_set_generator(group, P, bnN, bnH)

        );

Cleanup:

   if (!ok && group != NULL)

   {

       EC_GROUP_free(group);

       group = NULL;

   }

   if(P != NULL)

       EC_POINT_free(P);

   BN_CTX_end(context);

   BN_CTX_free(context);

   return group;

}

//

//

//       PointFrom2B()

//

//      This function sets the coordinates of an existing BN Point from a TPMS_ECC_POINT.

//

static EC_POINT *

PointFrom2B(

   EC_GROUP           *group,           //   IN:   the group for the point

   EC_POINT           *ecP,             //   IN:   an existing BN point in the group

   TPMS_ECC_POINT     *p,               //   IN:   the 2B coordinates of the point

   BN_CTX             *context          //   IN:   the BIGNUM context

   )

{

   BIGNUM             *bnX;

   BIGNUM             *bnY;

   // If the point is not allocated then just return a NULL

   if(ecP == NULL)

       return NULL;

   BN_CTX_start(context);

   bnX = BN_CTX_get(context);

   bnY = BN_CTX_get(context);

   if( // Set the coordinates of the point

         bnY == NULL

      || BN_bin2bn(p->x.t.buffer, p->x.t.size, bnX) == NULL

      || BN_bin2bn(p->y.t.buffer, p->y.t.size, bnY) == NULL

      )

      FAIL(FATAL_ERROR_INTERNAL);

   if(   !EC_POINT_set_affine_coordinates_GFp(group, ecP, bnX, bnY, context)

      || EC_POINT_is_on_curve(group, ecP, context) <= 0

      )

      ecP = NULL; // Point is not on curve

   BN_CTX_end(context);

   return ecP;

}

//

//

//       EccInitPoint2B()

//

//      This function allocates a point in the provided group and initializes it with the values in a

//      TPMS_ECC_POINT.

//

static EC_POINT *

EccInitPoint2B(

   EC_GROUP           *group,           // IN: group for the point

   TPMS_ECC_POINT     *p,               // IN: the coordinates for the point

    BN_CTX              *context                // IN: the BIGNUM context

    )

{

    EC_POINT            *ecP;

    BN_CTX_start(context);

    ecP = EC_POINT_new(group);

    if(PointFrom2B(group, ecP, p, context) == NULL)

    {

        EC_POINT_free(ecP);

        ecP = NULL;

    }

    BN_CTX_end(context);

    return ecP;

}

//

//

//       PointMul()

//

//      This function does a point multiply and checks for the result being the point at infinity. Q = ([A]G + [B]P)

//

//      Return Value                      Meaning

//

//      CRYPT_NO_RESULT                   point is at infinity

//      CRYPT_SUCCESS                     point not at infinity

//

static CRYPT_RESULT

PointMul(

    EC_GROUP            *group,                 //      IN: group curve

    EC_POINT            *ecpQ,                  //      OUT: result

    BIGNUM              *bnA,                   //      IN: scalar for [A]G

    EC_POINT            *ecpP,                  //      IN: point for [B]P

    BIGNUM              *bnB,                   //      IN: scalar for [B]P

    BN_CTX              *context                //      IN: working context

    )

{

       if(EC_POINT_mul(group, ecpQ, bnA, ecpP, bnB, context) != 1)

            FAIL(FATAL_ERROR_INTERNAL);

        if(EC_POINT_is_at_infinity(group, ecpQ))

            return CRYPT_NO_RESULT;

        return CRYPT_SUCCESS;

}

//

//

//       GetRandomPrivate()

//

//      This function gets a random value (d) to use as a private ECC key and then qualifies the key so that it is

//      between 0 < d < n.

//      It is a fatal error if dOut or pIn is not provided or if the size of pIn is larger than MAX_ECC_KEY_BYTES

//      (the largest buffer size of a TPM2B_ECC_PARAMETER)

//

static void

GetRandomPrivate(

    TPM2B_ECC_PARAMETER            *dOut,                    // OUT: the qualified random value

    const TPM2B                    *pIn                      // IN: the maximum value for the key

    )

{

    int             i;

    BYTE           *pb;

    pAssert(pIn != NULL && dOut != NULL && pIn->size <= MAX_ECC_KEY_BYTES);

    // Set the size of the output

    dOut->t.size = pIn->size;

    // Get some random bits

    while(TRUE)

    {

        _cpri__GenerateRandom(dOut->t.size, dOut->t.buffer);

        // See if the d < n

        if(memcmp(dOut->t.buffer, pIn->buffer, pIn->size) < 0)

        {

            // dOut < n so make sure that 0 < dOut

            for(pb = dOut->t.buffer, i = dOut->t.size; i > 0; i--)

            {

                if(*pb++ != 0)

                    return;

            }

        }

    }

}

//

//

//       _cpri__EccPointMultiply

//

//      This function computes 'R := [dIn]G + [uIn]QIn. Where dIn and uIn are scalars, G and QIn are points on

//      the specified curve and G is the default generator of the curve.

//      The xOut and yOut parameters are optional and may be set to NULL if not used.

//      It is not necessary to provide uIn if QIn is specified but one of uIn and dIn must be provided. If dIn and

//      QIn are specified but uIn is not provided, then R = [dIn]QIn.

//      If the multiply produces the point at infinity, the CRYPT_NO_RESULT is returned.

//      The sizes of xOut and yOut' will be set to be the size of the degree of the curve

//      It is a fatal error if dIn and uIn are both unspecified (NULL) or if Qin or Rout is unspecified.

//

//

//

//

//      Return Value                    Meaning

//

//      CRYPT_SUCCESS                   point multiplication succeeded

//      CRYPT_POINT                     the point Qin is not on the curve

//      CRYPT_NO_RESULT                 the product point is at infinity

//

LIB_EXPORT CRYPT_RESULT

_cpri__EccPointMultiply(

   TPMS_ECC_POINT                *Rout,                  //   OUT: the product point R

   TPM_ECC_CURVE                  curveId,               //   IN: the curve to use

   TPM2B_ECC_PARAMETER           *dIn,                   //   IN: value to multiply against the

                                                         //       curve generator

   TPMS_ECC_POINT                *Qin,                   //   IN: point Q

   TPM2B_ECC_PARAMETER           *uIn                    //   IN: scalar value for the multiplier

                                                         //       of Q

   )

{

   BN_CTX                    *context;

   BIGNUM                    *bnD;

   BIGNUM                    *bnU;

   EC_GROUP                  *group;

   EC_POINT                  *R = NULL;

   EC_POINT                  *Q = NULL;

   CRYPT_RESULT               retVal = CRYPT_SUCCESS;

   // Validate that the required parameters are provided.

   pAssert((dIn != NULL || uIn != NULL) && (Qin != NULL || dIn != NULL));

   // If a point is provided for the multiply, make sure that it is on the curve

   if(Qin != NULL && !_cpri__EccIsPointOnCurve(curveId, Qin))

       return CRYPT_POINT;

   context = BN_CTX_new();

   if(context == NULL)

       FAIL(FATAL_ERROR_ALLOCATION);

   BN_CTX_start(context);

   bnU = BN_CTX_get(context);

   bnD = BN_CTX_get(context);

   group = EccCurveInit(curveId, context);

   // There should be no path for getting a bad curve ID into this function.

   pAssert(group != NULL);

   // check allocations should have worked and allocate R

   if(   bnD == NULL

      || (R = EC_POINT_new(group)) == NULL)

       FAIL(FATAL_ERROR_ALLOCATION);

   // If Qin is present, create the point

   if(Qin != NULL)

   {

       // Assume the size variables do not overflow. This should not happen in

       // the contexts in which this function will be called.

       assert2Bsize(Qin->x.t);

       assert2Bsize(Qin->x.t);

       if (!(Q = EccInitPoint2B(group, Qin, context)))

       {

          retVal = CRYPT_POINT;

          goto Cleanup;

       }

   }

   if(dIn != NULL)

   {

       // Assume the size variables do not overflow, which should not happen in

       // the contexts that this function will be called.

       assert2Bsize(dIn->t);

        BnFrom2B(bnD, &dIn->b);

    }

    else

        bnD = NULL;

    // If uIn is specified, initialize its BIGNUM

    if(uIn != NULL)

    {

        // Assume the size variables do not overflow, which should not happen in

        // the contexts that this function will be called.

        assert2Bsize(uIn->t);

        BnFrom2B(bnU, &uIn->b);

    }

    // If uIn is not specified but Q is, then we are going to

    // do R = [d]Q

    else if(Qin != NULL)

    {

        bnU = bnD;

        bnD = NULL;

    }

    // If neither Q nor u is specified, then null this pointer

    else

        bnU = NULL;

    // Use the generator of the curve

    if((retVal = PointMul(group, R, bnD, Q, bnU, context)) == CRYPT_SUCCESS)

        Point2B(group, Rout, R, (INT16) ((EC_GROUP_get_degree(group)+7)/8), context);

Cleanup:

    if (Q)

        EC_POINT_free(Q);

    if(R)

        EC_POINT_free(R);

    if(group)

        EC_GROUP_free(group);

    BN_CTX_end(context);

    BN_CTX_free(context);

    return retVal;

}

#if defined TPM_ALG_ECDAA || defined TPM_ALG_SM2 //%

//

//

//       ClearPoint2B()

//

//      Initialize the size values of a point

//

static void

ClearPoint2B(

    TPMS_ECC_POINT       *p                 // IN: the point

    )

{

    if(p != NULL) {

        p->x.t.size = 0;

        p->y.t.size = 0;

    }

}

//

//

//       _cpri__EccCommitCompute()

//

//      This function performs the point multiply operations required by TPM2_Commit().

//      If B or M is provided, they must be on the curve defined by curveId. This routine does not check that they

//      are on the curve and results are unpredictable if they are not.

//

//

//

//      It is a fatal error if r or d is NULL. If B is not NULL, then it is a fatal error if K and L are both NULL. If M is

//      not NULL, then it is a fatal error if E is NULL.

//

//      Return Value                       Meaning

//

//      CRYPT_SUCCESS                      computations completed normally

//      CRYPT_NO_RESULT                    if K, L or E was computed to be the point at infinity

//      CRYPT_CANCEL                       a cancel indication was asserted during this function

//

LIB_EXPORT CRYPT_RESULT

_cpri__EccCommitCompute(

    TPMS_ECC_POINT                  *K,                   //   OUT: [d]B or [r]Q

    TPMS_ECC_POINT                  *L,                   //   OUT: [r]B

    TPMS_ECC_POINT                  *E,                   //   OUT: [r]M

    TPM_ECC_CURVE                    curveId,             //   IN: the curve for the computations

    TPMS_ECC_POINT                  *M,                   //   IN: M (optional)

    TPMS_ECC_POINT                  *B,                   //   IN: B (optional)

    TPM2B_ECC_PARAMETER             *d,                   //   IN: d (required)

    TPM2B_ECC_PARAMETER             *r                    //   IN: the computed r value (required)

    )

{

    BN_CTX                    *context;

    BIGNUM                    *bnY, *bnR, *bnD;

    EC_GROUP                  *group;

    EC_POINT                  *pK = NULL, *pL = NULL, *pE = NULL, *pM = NULL, *pB = NULL;

    UINT16                     keySizeInBytes;

    CRYPT_RESULT               retVal = CRYPT_SUCCESS;

    // Validate that the required parameters are provided.

    // Note: E has to be provided if computing E := [r]Q or E := [r]M. Will do

    // E := [r]Q if both M and B are NULL.

    pAssert((r && (K || !B) && (L || !B)) || (E || (!M && B)));

    context = BN_CTX_new();

    if(context == NULL)

        FAIL(FATAL_ERROR_ALLOCATION);

    BN_CTX_start(context);

    bnR = BN_CTX_get(context);

    bnD = BN_CTX_get(context);

    bnY = BN_CTX_get(context);

    if(bnY == NULL)

        FAIL(FATAL_ERROR_ALLOCATION);

    // Initialize the output points in case they are not computed

    ClearPoint2B(K);

    ClearPoint2B(L);

    ClearPoint2B(E);

    if((group = EccCurveInit(curveId, context)) == NULL)

    {

        retVal = CRYPT_PARAMETER;

        goto Cleanup2;

    }

    keySizeInBytes = (UINT16) ((EC_GROUP_get_degree(group)+7)/8);

    // Size of the r parameter may not be zero

    pAssert((int) r->t.size > 0);

    // Convert scalars to BIGNUM

    BnFrom2B(bnR, &r->b);

   // If B is provided, compute K=[d]B and L=[r]B

   if(B != NULL)

   {

       // Size of the d parameter may not be zero

       pAssert((int) d->t.size > 0);

       BnFrom2B(bnD, &d->b);

       // Allocate the points to receive the value

       if(    (pK = EC_POINT_new(group)) == NULL

           || (pL = EC_POINT_new(group)) == NULL)

       FAIL(FATAL_ERROR_ALLOCATION);

       // need to compute K = [d]B

       // Allocate and initialize BIGNUM version of B

       if (!(pB = EccInitPoint2B(group, B, context)))

       {

            retVal = CRYPT_POINT;

            goto Cleanup;

       }

        // do the math for K = [d]B

        if((retVal = PointMul(group, pK, NULL, pB, bnD, context)) != CRYPT_SUCCESS)

            goto Cleanup;

        // Convert BN K to TPM2B K

        Point2B(group, K, pK, (INT16)keySizeInBytes, context);

        // compute L= [r]B after checking for cancel

        if(_plat__IsCanceled())

        {

            retVal = CRYPT_CANCEL;

            goto Cleanup;

        }

        // compute L = [r]B

        if((retVal = PointMul(group, pL, NULL, pB, bnR, context)) != CRYPT_SUCCESS)

            goto Cleanup;

        // Convert BN L to TPM2B L

        Point2B(group, L, pL, (INT16)keySizeInBytes, context);

   }

   if(M != NULL || B == NULL)

   {

       // if this is the third point multiply, check for cancel first

       if(B != NULL && _plat__IsCanceled())

       {

           retVal = CRYPT_CANCEL;

           goto Cleanup;

       }

        // Allocate E

        if((pE = EC_POINT_new(group)) == NULL)

            FAIL(FATAL_ERROR_ALLOCATION);

        // Create BIGNUM version of M unless M is NULL

        if(M != NULL)

        {

             // M provided so initialize a BIGNUM M and compute E = [r]M

             if (!(pM = EccInitPoint2B(group, M, context)))

             {

                 retVal = CRYPT_POINT;

                 goto Cleanup;

             }

             retVal = PointMul(group, pE, NULL, pM, bnR, context);

        }

        else

             // compute E = [r]G (this is only done if M and B are both NULL

             retVal = PointMul(group, pE, bnR, NULL, NULL, context);

        if(retVal == CRYPT_SUCCESS)

            // Convert E to 2B format

            Point2B(group, E, pE, (INT16)keySizeInBytes, context);

   }

Cleanup:

   EC_GROUP_free(group);

   if(pK != NULL) EC_POINT_free(pK);

   if(pL != NULL) EC_POINT_free(pL);

   if(pE != NULL) EC_POINT_free(pE);

   if(pM != NULL) EC_POINT_free(pM);

   if(pB != NULL) EC_POINT_free(pB);

Cleanup2:

   BN_CTX_end(context);

   BN_CTX_free(context);

   return retVal;

}

#endif //%

//

//

//       _cpri__EccIsPointOnCurve()

//

//      This function is used to test if a point is on a defined curve. It does this by checking that y^2 mod p = x^3

//      + a*x + b mod p

//      It is a fatal error if Q is not specified (is NULL).

//

//      Return Value                        Meaning

//

//      TRUE                                point is on curve

//      FALSE                               point is not on curve or curve is not supported

//

LIB_EXPORT BOOL

_cpri__EccIsPointOnCurve(

    TPM_ECC_CURVE          curveId,             // IN: the curve selector

    TPMS_ECC_POINT        *Q                    // IN: the point.

    )

{

    BN_CTX                           *context;

    BIGNUM                           *bnX;

    BIGNUM                           *bnY;

    BIGNUM                           *bnA;

    BIGNUM                           *bnB;

    BIGNUM                           *bnP;

    BIGNUM                           *bn3;

    const ECC_CURVE_DATA             *curveData = GetCurveData(curveId);

    BOOL                              retVal;

    pAssert(Q != NULL && curveData != NULL);

    if((context = BN_CTX_new()) == NULL)

        FAIL(FATAL_ERROR_ALLOCATION);

    BN_CTX_start(context);

    bnX = BN_CTX_get(context);

    bnY = BN_CTX_get(context);

    bnA = BN_CTX_get(context);

    bnB = BN_CTX_get(context);

    bn3 = BN_CTX_get(context);

    bnP = BN_CTX_get(context);

    if(bnP == NULL)

        FAIL(FATAL_ERROR_ALLOCATION);

    // Convert values

    if (    !BN_bin2bn(Q->x.t.buffer, Q->x.t.size, bnX)

         || !BN_bin2bn(Q->y.t.buffer, Q->y.t.size, bnY)

         || !BN_bin2bn(curveData->p->buffer, curveData->p->size, bnP)

         || !BN_bin2bn(curveData->a->buffer, curveData->a->size, bnA)

         || !BN_set_word(bn3, 3)

         || !BN_bin2bn(curveData->b->buffer, curveData->b->size, bnB)

       )

         FAIL(FATAL_ERROR_INTERNAL);

    // The following sequence is probably not optimal but it seems to be correct.

    // compute x^3 + a*x + b mod p

            // first, compute a*x mod p

    if(   !BN_mod_mul(bnA, bnA, bnX, bnP, context)

//

              // next, compute a*x + b mod p

         || !BN_mod_add(bnA, bnA, bnB, bnP, context)

              // next, compute X^3 mod p

         || !BN_mod_exp(bnX, bnX, bn3, bnP, context)

              // finally, compute x^3 + a*x + b mod p

         || !BN_mod_add(bnX, bnX, bnA, bnP, context)

              // then compute y^2

         || !BN_mod_mul(bnY, bnY, bnY, bnP, context)

        )

          FAIL(FATAL_ERROR_INTERNAL);

    retVal = BN_cmp(bnX, bnY) == 0;

    BN_CTX_end(context);

    BN_CTX_free(context);

    return retVal;

}

//

//

//       _cpri__GenerateKeyEcc()

//

//      This function generates an ECC key pair based on the input parameters. This routine uses KDFa() to

//      produce candidate numbers. The method is according to FIPS 186-3, section B.4.1 "GKey() Pair

//      Generation Using Extra Random Bits." According to the method in FIPS 186-3, the resulting private value

//      d should be 1 <= d < n where n is the order of the base point. In this implementation, the range of the

//      private value is further restricted to be 2^(nLen/2) <= d < n where nLen is the order of n.

//

//      EXAMPLE:         If the curve is NIST-P256, then nLen is 256 bits and d will need to be between 2^128 <= d < n

//

//      It is a fatal error if Qout, dOut, or seed is not provided (is NULL).

//

//      Return Value                         Meaning

//

//      CRYPT_PARAMETER                      the hash algorithm is not supported

//

LIB_EXPORT CRYPT_RESULT

_cpri__GenerateKeyEcc(

    TPMS_ECC_POINT                    *Qout,                  //   OUT: the public point

    TPM2B_ECC_PARAMETER               *dOut,                  //   OUT: the private scalar

    TPM_ECC_CURVE                      curveId,               //   IN: the curve identifier

    TPM_ALG_ID                         hashAlg,               //   IN: hash algorithm to use in the key

                                                              //       generation process

    TPM2B                             *seed,                  //   IN: the seed to use

    const char                        *label,                 //   IN: A label for the generation

                                                              //       process.

    TPM2B                             *extra,                 //   IN: Party 1 data for the KDF

    UINT32                            *counter                //   IN/OUT: Counter value to allow KDF

                                                              //       iteration to be propagated across

                                                              //       multiple functions

    )

{

    const ECC_CURVE_DATA              *curveData = GetCurveData(curveId);

    INT16                              keySizeInBytes;

    UINT32                             count = 0;

    CRYPT_RESULT                       retVal;

    UINT16                             hLen = _cpri__GetDigestSize(hashAlg);

    BIGNUM                            *bnNm1;          // Order of the curve minus one

    BIGNUM                            *bnD;            // the private scalar

    BN_CTX                            *context;        // the context for the BIGNUM values

    BYTE                               withExtra[MAX_ECC_KEY_BYTES + 8]; // trial key with

                                                                           //extra bits

    TPM2B_4_BYTE_VALUE                 marshaledCounter = {.t = {4}};

    UINT32                             totalBits;

    // Validate parameters (these are fatal)

   pAssert(     seed != NULL && dOut != NULL && Qout != NULL && curveData != NULL);

   // Non-fatal parameter checks.

   if(hLen <= 0)

       return CRYPT_PARAMETER;

   // allocate the local BN values

   context = BN_CTX_new();

   if(context == NULL)

       FAIL(FATAL_ERROR_ALLOCATION);

   BN_CTX_start(context);

   bnNm1 = BN_CTX_get(context);

   bnD = BN_CTX_get(context);

   // The size of the input scalars is limited by the size of the size of a

   // TPM2B_ECC_PARAMETER. Make sure that it is not irrational.

   pAssert((int) curveData->n->size <= MAX_ECC_KEY_BYTES);

   if(   bnD == NULL

      || BN_bin2bn(curveData->n->buffer, curveData->n->size, bnNm1) == NULL

      || (keySizeInBytes = (INT16) BN_num_bytes(bnNm1)) > MAX_ECC_KEY_BYTES)

       FAIL(FATAL_ERROR_INTERNAL);

   // get the total number of bits

   totalBits = BN_num_bits(bnNm1) + 64;

   // Reduce bnNm1 from 'n' to 'n' - 1

   BN_sub_word(bnNm1, 1);

   // Initialize the count value

   if(counter != NULL)

       count = *counter;

   if(count == 0)

       count = 1;

   // Start search for key (should be quick)

   for(; count != 0; count++)

   {

        UINT32_TO_BYTE_ARRAY(count, marshaledCounter.t.buffer);

        _cpri__KDFa(hashAlg, seed, label, extra, &marshaledCounter.b,

                    totalBits, withExtra, NULL, FALSE);

        // Convert the result and modular reduce

        // Assume the size variables do not overflow, which should not happen in

        // the contexts that this function will be called.

        pAssert(keySizeInBytes <= MAX_ECC_KEY_BYTES);

        if (    BN_bin2bn(withExtra, keySizeInBytes+8, bnD) == NULL

             || BN_mod(bnD, bnD, bnNm1, context) != 1)

             FAIL(FATAL_ERROR_INTERNAL);

        // Add one to get 0 < d < n

        BN_add_word(bnD, 1);

        if(BnTo2B(&dOut->b, bnD, keySizeInBytes) != 1)

                FAIL(FATAL_ERROR_INTERNAL);

        // Do the point multiply to create the public portion of the key. If

        // the multiply generates the point at infinity (unlikely), do another

        // iteration.

        if(    (retVal = _cpri__EccPointMultiply(Qout, curveId, dOut, NULL, NULL))

            != CRYPT_NO_RESULT)

            break;

   }

   if(count == 0) // if counter wrapped, then the TPM should go into failure mode

       FAIL(FATAL_ERROR_INTERNAL);

   // Free up allocated BN values

   BN_CTX_end(context);

   BN_CTX_free(context);

   if(counter != NULL)

       *counter = count;

   return retVal;

}

//

//

//       _cpri__GetEphemeralEcc()

//

//      This function creates an ephemeral ECC. It is ephemeral in that is expected that the private part of the

//      key will be discarded

//

LIB_EXPORT CRYPT_RESULT

_cpri__GetEphemeralEcc(

   TPMS_ECC_POINT                *Qout,            // OUT: the public point

   TPM2B_ECC_PARAMETER           *dOut,            // OUT: the private scalar

   TPM_ECC_CURVE                  curveId          // IN: the curve for the key

   )

{

   CRYPT_RESULT                   retVal;

   const ECC_CURVE_DATA          *curveData = GetCurveData(curveId);

   pAssert(curveData != NULL);

   // Keep getting random values until one is found that doesn't create a point

   // at infinity. This will never, ever, ever, ever, ever, happen but if it does

   // we have to get a next random value.

   while(TRUE)

   {

       GetRandomPrivate(dOut, curveData->p);

        // _cpri__EccPointMultiply does not return CRYPT_ECC_POINT if no point is

        // provided. CRYPT_PARAMTER should not be returned because the curve ID

        // has to be supported. Thus the only possible error is CRYPT_NO_RESULT.

        retVal = _cpri__EccPointMultiply(Qout, curveId, dOut, NULL, NULL);

        if(retVal != CRYPT_NO_RESULT)

            return retVal; // Will return CRYPT_SUCCESS

   }

}

#ifdef TPM_ALG_ECDSA      //%

//

//

//       SignEcdsa()

//

//      This function implements the ECDSA signing algorithm. The method is described in the comments below.

//      It is a fatal error if rOut, sOut, dIn, or digest are not provided.

//

LIB_EXPORT CRYPT_RESULT

SignEcdsa(

   TPM2B_ECC_PARAMETER           *rOut,            //   OUT: r component of the signature

   TPM2B_ECC_PARAMETER           *sOut,            //   OUT: s component of the signature

   TPM_ECC_CURVE                  curveId,         //   IN: the curve used in the signature

                                                   //       process

   TPM2B_ECC_PARAMETER           *dIn,             //   IN: the private key

   TPM2B                         *digest           //   IN: the value to sign

   )

{

   BIGNUM                        *bnK;

   BIGNUM                        *bnIk;

   BIGNUM                        *bnN;

   BIGNUM                        *bnR;

//

    BIGNUM                    *bnD;

    BIGNUM                    *bnZ;

    TPM2B_ECC_PARAMETER        k;

    TPMS_ECC_POINT             R;

    BN_CTX                    *context;

    CRYPT_RESULT               retVal = CRYPT_SUCCESS;

    const ECC_CURVE_DATA      *curveData = GetCurveData(curveId);

    pAssert(rOut != NULL && sOut != NULL && dIn != NULL && digest != NULL);

    context = BN_CTX_new();

    if(context == NULL)

        FAIL(FATAL_ERROR_ALLOCATION);

    BN_CTX_start(context);

    bnN = BN_CTX_get(context);

    bnZ = BN_CTX_get(context);

    bnR = BN_CTX_get(context);

    bnD = BN_CTX_get(context);

    bnIk = BN_CTX_get(context);

    bnK = BN_CTX_get(context);

    // Assume the size variables do not overflow, which should not happen in

    // the contexts that this function will be called.

    pAssert(curveData->n->size <= MAX_ECC_PARAMETER_BYTES);

    if(   bnK == NULL

       || BN_bin2bn(curveData->n->buffer, curveData->n->size, bnN) == NULL)

        FAIL(FATAL_ERROR_INTERNAL);

//   The algorithm as described in "Suite B Implementer's Guide to FIPS 186-3(ECDSA)"

//   1. Use one of the routines in Appendix A.2 to generate (k, k^-1), a per-message

//      secret number and its inverse modulo n. Since n is prime, the

//      output will be invalid only if there is a failure in the RBG.

//   2. Compute the elliptic curve point R = [k]G = (xR, yR) using EC scalar

//      multiplication (see [Routines]), where G is the base point included in

//      the set of domain parameters.

//   3. Compute r = xR mod n. If r = 0, then return to Step 1. 1.

//   4. Use the selected hash function to compute H = Hash(M).

//   5. Convert the bit string H to an integer e as described in Appendix B.2.

//   6. Compute s = (k^-1 * (e + d * r)) mod n. If s = 0, return to Step 1.2.

//   7. Return (r, s).

    // Generate a random value k in the range 1 <= k < n

    // Want a K value that is the same size as the curve order

    k.t.size = curveData->n->size;

    while(TRUE) // This implements the loop at step 6. If s is zero, start over.

    {

        while(TRUE)

        {

            // Step 1 and 2 -- generate an ephemeral key and the modular inverse

            // of the private key.

            while(TRUE)

            {

                GetRandomPrivate(&k, curveData->n);

                  // Do the point multiply to generate a point and check to see if

                  // the point it at infinity

                  if(    _cpri__EccPointMultiply(&R, curveId, &k, NULL, NULL)

                      != CRYPT_NO_RESULT)

                      break; // can only be CRYPT_SUCCESS

              }

              // x coordinate is mod p. Make it mod n

              // Assume the size variables do not overflow, which should not happen

              // in the contexts that this function will be called.

              assert2Bsize(R.x.t);

              BN_bin2bn(R.x.t.buffer, R.x.t.size, bnR);

              BN_mod(bnR, bnR, bnN, context);

              // Make sure that it is not zero;

              if(BN_is_zero(bnR))

                  continue;

              // Make sure that a modular inverse exists

              // Assume the size variables do not overflow, which should not happen

              // in the contexts that this function will be called.

              assert2Bsize(k.t);

              BN_bin2bn(k.t.buffer, k.t.size, bnK);

              if( BN_mod_inverse(bnIk, bnK, bnN, context) != NULL)

                  break;

        }

        // Set z = leftmost bits of the digest

        // NOTE: This is implemented such that the key size needs to be

        //        an even number of bytes in length.

        if(digest->size > curveData->n->size)

        {

             // Assume the size variables do not overflow, which should not happen

             // in the contexts that this function will be called.

             pAssert(curveData->n->size <= MAX_ECC_KEY_BYTES);

             // digest is larger than n so truncate

             BN_bin2bn(digest->buffer, curveData->n->size, bnZ);

        }

        else

        {

             // Assume the size variables do not overflow, which should not happen

             // in the contexts that this function will be called.

             pAssert(digest->size <= MAX_DIGEST_SIZE);

             // digest is same or smaller than n so use it all

             BN_bin2bn(digest->buffer, digest->size, bnZ);

        }

        // Assume the size variables do not overflow, which should not happen in

        // the contexts that this function will be called.

        assert2Bsize(dIn->t);

        if(   bnZ == NULL

             // need the private scalar of the signing key

             || BN_bin2bn(dIn->t.buffer, dIn->t.size, bnD) == NULL)

              FAIL(FATAL_ERROR_INTERNAL);

        //   NOTE: When the result of an operation is going to be reduced mod x

        //   any modular multiplication is done so that the intermediate values

        //   don't get too large.

        //

        // now have inverse of K (bnIk), z (bnZ), r (bnR),      d (bnD) and n (bnN)

        // Compute s = k^-1 (z + r*d)(mod n)

            // first do d = r*d mod n

        if( !BN_mod_mul(bnD, bnR, bnD, bnN, context)

             // d = z + r * d

             || !BN_add(bnD, bnZ, bnD)

             // d = k^(-1)(z + r * d)(mod n)

             || !BN_mod_mul(bnD, bnIk, bnD, bnN, context)

             // convert to TPM2B format

             || !BnTo2B(&sOut->b, bnD, curveData->n->size)

             //   and write the modular reduced version of r

             //   NOTE: this was deferred to reduce the number of

             //   error checks.

             ||   !BnTo2B(&rOut->b, bnR, curveData->n->size))

              FAIL(FATAL_ERROR_INTERNAL);

        if(!BN_is_zero(bnD))

            break; // signature not zero so done

        // if the signature value was zero, start over

   }

   // Free up allocated BN values

   BN_CTX_end(context);

   BN_CTX_free(context);

   return retVal;

}

#endif //%

#if defined TPM_ALG_ECDAA || defined TPM_ALG_ECSCHNORR                //%

//

//

//       EcDaa()

//

//      This function is used to perform a modified Schnorr signature for ECDAA.

//      This function performs s = k + T * d mod n where

//      a) 'k is a random, or pseudo-random value used in the commit phase

//      b) T is the digest to be signed, and

//      c) d is a private key.

//      If tIn is NULL then use tOut as T

//

//      Return Value                        Meaning

//

//      CRYPT_SUCCESS                       signature created

//

static CRYPT_RESULT

EcDaa(

   TPM2B_ECC_PARAMETER              *tOut,             //   OUT: T component of the signature