Coverage Report

Created: 2025-03-06 06:58

/src/nettle/ecc-gostdsa-verify.c
Line
Count
Source (jump to first uncovered line)
1
/* ecc-gostdsa-verify.c
2
3
   Copyright (C) 2015 Dmitry Eremin-Solenikov
4
   Copyright (C) 2013, 2014 Niels Möller
5
6
   This file is part of GNU Nettle.
7
8
   GNU Nettle is free software: you can redistribute it and/or
9
   modify it under the terms of either:
10
11
     * the GNU Lesser General Public License as published by the Free
12
       Software Foundation; either version 3 of the License, or (at your
13
       option) any later version.
14
15
   or
16
17
     * the GNU General Public License as published by the Free
18
       Software Foundation; either version 2 of the License, or (at your
19
       option) any later version.
20
21
   or both in parallel, as here.
22
23
   GNU Nettle is distributed in the hope that it will be useful,
24
   but WITHOUT ANY WARRANTY; without even the implied warranty of
25
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
26
   General Public License for more details.
27
28
   You should have received copies of the GNU General Public License and
29
   the GNU Lesser General Public License along with this program.  If
30
   not, see http://www.gnu.org/licenses/.
31
*/
32
33
#if HAVE_CONFIG_H
34
# include "config.h"
35
#endif
36
37
#include <assert.h>
38
#include <stdlib.h>
39
40
#include "gostdsa.h"
41
#include "dsa-internal.h"
42
#include "ecc-internal.h"
43
44
/* Low-level GOST DSA verify */
45
46
static int
47
ecdsa_in_range (const struct ecc_curve *ecc, const mp_limb_t *xp)
48
0
{
49
0
  return !mpn_zero_p (xp, ecc->p.size)
50
0
    && mpn_cmp (xp, ecc->q.m, ecc->p.size) < 0;
51
0
}
52
53
mp_size_t
54
ecc_gostdsa_verify_itch (const struct ecc_curve *ecc)
55
0
{
56
  /* Largest storage need is for the ecc_mul_a call. */
57
0
  return 5*ecc->p.size + ECC_MUL_A_ITCH (ecc->p.size);
58
0
}
59
60
/* FIXME: Use faster primitives, not requiring side-channel silence. */
61
int
62
ecc_gostdsa_verify (const struct ecc_curve *ecc,
63
      const mp_limb_t *pp, /* Public key */
64
      size_t length, const uint8_t *digest,
65
      const mp_limb_t *rp, const mp_limb_t *sp,
66
      mp_limb_t *scratch)
67
0
{
68
  /* Procedure, according to GOST R 34.10. q denotes the group
69
     order.
70
71
     1. Check 0 < r, s < q.
72
73
     2. v <-- h^{-1}  (mod q)
74
75
     3. z1  <-- s * v (mod q)
76
77
     4. z2  <-- -r * v (mod q)
78
79
     5. R = u1 G + u2 Y
80
81
     6. Signature is valid if R_x = r (mod q).
82
  */
83
84
0
#define hp (scratch)
85
0
#define vp (scratch + ecc->p.size)
86
0
#define z1 (scratch + 3*ecc->p.size)
87
0
#define z2 (scratch + 4*ecc->p.size)
88
89
0
#define P1 (scratch + 4*ecc->p.size)
90
0
#define P2 (scratch)
91
92
93
0
  if (! (ecdsa_in_range (ecc, rp)
94
0
   && ecdsa_in_range (ecc, sp)))
95
0
    return 0;
96
97
0
  _nettle_gostdsa_hash (hp, ecc->q.bit_size, length, digest);
98
99
0
  if (mpn_zero_p (hp, ecc->p.size))
100
0
    mpn_add_1 (hp, hp, ecc->p.size, 1);
101
102
  /* Compute v */
103
0
  ecc->q.invert (&ecc->q, vp, hp, vp + ecc->p.size);
104
105
  /* z1 = s / h, P1 = z1 * G */
106
0
  ecc_mod_mul_canonical (&ecc->q, z1, sp, vp, z1);
107
108
  /* z2 = - r / h, P2 = z2 * Y */
109
0
  mpn_sub_n (hp, ecc->q.m, rp, ecc->p.size);
110
0
  ecc_mod_mul_canonical (&ecc->q, z2, hp, vp, z2);
111
112
   /* Total storage: 5*ecc->p.size + ECC_MUL_A_ITCH */
113
0
  ecc_mul_a (ecc, P2, z2, pp, z2 + ecc->p.size);
114
115
  /* Total storage: 7*ecc->p.size + ECC_MUL_G_ITCH */
116
0
  ecc_mul_g (ecc, P1, z1, P1 + 3*ecc->p.size);
117
118
  /* Total storage: 6*ecc->p.size + ECC_ADD_JJJ_ITCH */
119
0
  if (!ecc_nonsec_add_jjj (ecc, P1, P1, P2, P1 + 3*ecc->p.size))
120
0
    return 0;
121
122
  /* x coordinate only, modulo q */
123
0
  ecc_j_to_a (ecc, 2, P2, P1, P1 + 3*ecc->p.size);
124
125
0
  return (mpn_cmp (rp, P2, ecc->p.size) == 0);
126
0
#undef P2
127
0
#undef P1
128
0
#undef z2
129
0
#undef z1
130
0
#undef hp
131
0
#undef vp
132
0
}