/src/nettle/ecc-gostdsa-verify.c
Line | Count | Source (jump to first uncovered line) |
1 | | /* ecc-gostdsa-verify.c |
2 | | |
3 | | Copyright (C) 2015 Dmitry Eremin-Solenikov |
4 | | Copyright (C) 2013, 2014 Niels Möller |
5 | | |
6 | | This file is part of GNU Nettle. |
7 | | |
8 | | GNU Nettle is free software: you can redistribute it and/or |
9 | | modify it under the terms of either: |
10 | | |
11 | | * the GNU Lesser General Public License as published by the Free |
12 | | Software Foundation; either version 3 of the License, or (at your |
13 | | option) any later version. |
14 | | |
15 | | or |
16 | | |
17 | | * the GNU General Public License as published by the Free |
18 | | Software Foundation; either version 2 of the License, or (at your |
19 | | option) any later version. |
20 | | |
21 | | or both in parallel, as here. |
22 | | |
23 | | GNU Nettle is distributed in the hope that it will be useful, |
24 | | but WITHOUT ANY WARRANTY; without even the implied warranty of |
25 | | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
26 | | General Public License for more details. |
27 | | |
28 | | You should have received copies of the GNU General Public License and |
29 | | the GNU Lesser General Public License along with this program. If |
30 | | not, see http://www.gnu.org/licenses/. |
31 | | */ |
32 | | |
33 | | #if HAVE_CONFIG_H |
34 | | # include "config.h" |
35 | | #endif |
36 | | |
37 | | #include <assert.h> |
38 | | #include <stdlib.h> |
39 | | |
40 | | #include "gostdsa.h" |
41 | | #include "dsa-internal.h" |
42 | | #include "ecc-internal.h" |
43 | | |
44 | | /* Low-level GOST DSA verify */ |
45 | | |
46 | | static int |
47 | | ecdsa_in_range (const struct ecc_curve *ecc, const mp_limb_t *xp) |
48 | 0 | { |
49 | 0 | return !mpn_zero_p (xp, ecc->p.size) |
50 | 0 | && mpn_cmp (xp, ecc->q.m, ecc->p.size) < 0; |
51 | 0 | } |
52 | | |
53 | | mp_size_t |
54 | | ecc_gostdsa_verify_itch (const struct ecc_curve *ecc) |
55 | 0 | { |
56 | | /* Largest storage need is for the ecc_mul_a call. */ |
57 | 0 | return 5*ecc->p.size + ECC_MUL_A_ITCH (ecc->p.size); |
58 | 0 | } |
59 | | |
60 | | /* FIXME: Use faster primitives, not requiring side-channel silence. */ |
61 | | int |
62 | | ecc_gostdsa_verify (const struct ecc_curve *ecc, |
63 | | const mp_limb_t *pp, /* Public key */ |
64 | | size_t length, const uint8_t *digest, |
65 | | const mp_limb_t *rp, const mp_limb_t *sp, |
66 | | mp_limb_t *scratch) |
67 | 0 | { |
68 | | /* Procedure, according to GOST R 34.10. q denotes the group |
69 | | order. |
70 | | |
71 | | 1. Check 0 < r, s < q. |
72 | | |
73 | | 2. v <-- h^{-1} (mod q) |
74 | | |
75 | | 3. z1 <-- s * v (mod q) |
76 | | |
77 | | 4. z2 <-- -r * v (mod q) |
78 | | |
79 | | 5. R = u1 G + u2 Y |
80 | | |
81 | | 6. Signature is valid if R_x = r (mod q). |
82 | | */ |
83 | |
|
84 | 0 | #define hp (scratch) |
85 | 0 | #define vp (scratch + ecc->p.size) |
86 | 0 | #define z1 (scratch + 3*ecc->p.size) |
87 | 0 | #define z2 (scratch + 4*ecc->p.size) |
88 | |
|
89 | 0 | #define P1 (scratch + 4*ecc->p.size) |
90 | 0 | #define P2 (scratch) |
91 | | |
92 | |
|
93 | 0 | if (! (ecdsa_in_range (ecc, rp) |
94 | 0 | && ecdsa_in_range (ecc, sp))) |
95 | 0 | return 0; |
96 | | |
97 | 0 | _nettle_gostdsa_hash (hp, ecc->q.bit_size, length, digest); |
98 | |
|
99 | 0 | if (mpn_zero_p (hp, ecc->p.size)) |
100 | 0 | mpn_add_1 (hp, hp, ecc->p.size, 1); |
101 | | |
102 | | /* Compute v */ |
103 | 0 | ecc->q.invert (&ecc->q, vp, hp, vp + ecc->p.size); |
104 | | |
105 | | /* z1 = s / h, P1 = z1 * G */ |
106 | 0 | ecc_mod_mul_canonical (&ecc->q, z1, sp, vp, z1); |
107 | | |
108 | | /* z2 = - r / h, P2 = z2 * Y */ |
109 | 0 | mpn_sub_n (hp, ecc->q.m, rp, ecc->p.size); |
110 | 0 | ecc_mod_mul_canonical (&ecc->q, z2, hp, vp, z2); |
111 | | |
112 | | /* Total storage: 5*ecc->p.size + ECC_MUL_A_ITCH */ |
113 | 0 | ecc_mul_a (ecc, P2, z2, pp, z2 + ecc->p.size); |
114 | | |
115 | | /* Total storage: 7*ecc->p.size + ECC_MUL_G_ITCH */ |
116 | 0 | ecc_mul_g (ecc, P1, z1, P1 + 3*ecc->p.size); |
117 | | |
118 | | /* Total storage: 6*ecc->p.size + ECC_ADD_JJJ_ITCH */ |
119 | 0 | if (!ecc_nonsec_add_jjj (ecc, P1, P1, P2, P1 + 3*ecc->p.size)) |
120 | 0 | return 0; |
121 | | |
122 | | /* x coordinate only, modulo q */ |
123 | 0 | ecc_j_to_a (ecc, 2, P2, P1, P1 + 3*ecc->p.size); |
124 | |
|
125 | 0 | return (mpn_cmp (rp, P2, ecc->p.size) == 0); |
126 | 0 | #undef P2 |
127 | 0 | #undef P1 |
128 | 0 | #undef z2 |
129 | 0 | #undef z1 |
130 | 0 | #undef hp |
131 | 0 | #undef vp |
132 | 0 | } |