Elliptic curve digital signature algorithm (ECDSA). More...

#include <stdlib.h>
#include <errno.h>
#include <string.h>
#include <ipxe/crypto.h>
#include <ipxe/bigint.h>
#include <ipxe/hmac_drbg.h>
#include <ipxe/ecdsa.h>

Data Structures
struct	ecdsa_key
	An ECDSA key. More...
struct	ecdsa_context
	ECDSA context. More...

Macros
#define	EINVAL_POINTSIZE __einfo_error ( EINFO_EINVAL_POINTSIZE )
#define	EINFO_EINVAL_POINTSIZE __einfo_uniqify ( EINFO_EINVAL, 0x01, "Invalid point size" )
#define	EINVAL_KEYSIZE __einfo_error ( EINFO_EINVAL_KEYSIZE )
#define	EINFO_EINVAL_KEYSIZE __einfo_uniqify ( EINFO_EINVAL, 0x02, "Invalid key size" )
#define	EINVAL_COMPRESSION __einfo_error ( EINFO_EINVAL_COMPRESSION )
#define	EINFO_EINVAL_COMPRESSION __einfo_uniqify ( EINFO_EINVAL, 0x03, "Invalid compression")
#define	EINVAL_INFINITY __einfo_error ( EINFO_EINVAL_INFINITY )
#define	EINFO_EINVAL_INFINITY __einfo_uniqify ( EINFO_EINVAL, 0x04, "Point is infinity" )
#define	EINVAL_SIGNATURE __einfo_error ( EINFO_EINVAL_SIGNATURE )
#define	EINFO_EINVAL_SIGNATURE __einfo_uniqify ( EINFO_EINVAL, 0x05, "Invalid signature" )

Functions
	FILE_LICENCE (GPL2_OR_LATER_OR_UBDL)
	FILE_SECBOOT (PERMITTED)
static int	ecdsa_parse_key (struct ecdsa_key key, const struct asn1_cursor raw)
	Parse ECDSA key.
static int	ecdsa_parse_signature (struct ecdsa_context ctx, bigint_element_t rs0, const struct asn1_cursor *raw)
	Parse ECDSA signature value.
static int	ecdsa_prepend_signature (struct ecdsa_context ctx, bigint_element_t rs0, struct asn1_builder *builder)
	Prepend ECDSA signature value.
static int	ecdsa_alloc (struct ecdsa_context *ctx)
	Allocate ECDSA context dynamic storage.
static void	ecdsa_free (struct ecdsa_context *ctx)
	Free ECDSA context dynamic storage.
static void	ecdsa_init_values (struct ecdsa_context ctx, struct digest_algorithm digest, const void *value)
	Initialise ECDSA values.
static int	ecdsa_init (struct ecdsa_context ctx, const struct asn1_cursor key, struct digest_algorithm digest, const void value)
	Initialise ECDSA context.
static void	ecdsa_invert (struct ecdsa_context ctx, bigint_element_t val0)
	Invert ECDSA value.
static int	ecdsa_sign_rs (struct ecdsa_context *ctx)
	Generate ECDSA "r" and "s" values.
static int	ecdsa_verify_rs (struct ecdsa_context *ctx)
	Verify ECDSA "r" and "s" values.
static int	ecdsa_sign (struct pubkey_algorithm pubkey __unused, const struct asn1_cursor key, struct digest_algorithm digest, const void value, struct asn1_builder *signature)
	Sign digest value using ECDSA.
static int	ecdsa_verify (struct pubkey_algorithm pubkey __unused, const struct asn1_cursor key, struct digest_algorithm digest, const void value, const struct asn1_cursor *signature)
	Verify signed digest using ECDSA.
static int	ecdsa_match (struct pubkey_algorithm pubkey __unused, const struct asn1_cursor private_key, const struct asn1_cursor *public_key)
	Check for matching ECDSA public/private key pair.

Variables
static uint8_t	oid_ecpublickey [] = { ASN1_OID_ECPUBLICKEY }
	"ecPublicKey" object identifier
struct asn1_algorithm ecpubkey_algorithm	__asn1_algorithm
	Generic elliptic curve container algorithm.
struct pubkey_algorithm	ecdsa_algorithm
	ECDSA public-key algorithm.

Detailed Description

Elliptic curve digital signature algorithm (ECDSA).

The elliptic curve public key format is documented in RFC 5480. The original private key format is documented in RFC 5915, and the generic container PKCS#8 format documented in RFC 5208.

Definition in file ecdsa.c.

Macro Definition Documentation

◆ EINVAL_POINTSIZE

#define EINVAL_POINTSIZE __einfo_error ( EINFO_EINVAL_POINTSIZE )

Definition at line 46 of file ecdsa.c.

46#define EINVAL_POINTSIZE \

47 __einfo_error ( EINFO_EINVAL_POINTSIZE )

Referenced by ecdsa_parse_key().

◆ EINFO_EINVAL_POINTSIZE

#define EINFO_EINVAL_POINTSIZE __einfo_uniqify ( EINFO_EINVAL, 0x01, "Invalid point size" )

Definition at line 48 of file ecdsa.c.

48#define EINFO_EINVAL_POINTSIZE \

49 __einfo_uniqify ( EINFO_EINVAL, 0x01, "Invalid point size" )

◆ EINVAL_KEYSIZE

#define EINVAL_KEYSIZE __einfo_error ( EINFO_EINVAL_KEYSIZE )

Definition at line 50 of file ecdsa.c.

50#define EINVAL_KEYSIZE \

51 __einfo_error ( EINFO_EINVAL_KEYSIZE )

Referenced by ecdsa_parse_key(), and ecdsa_parse_signature().

◆ EINFO_EINVAL_KEYSIZE

#define EINFO_EINVAL_KEYSIZE __einfo_uniqify ( EINFO_EINVAL, 0x02, "Invalid key size" )

Definition at line 52 of file ecdsa.c.

52#define EINFO_EINVAL_KEYSIZE \

53 __einfo_uniqify ( EINFO_EINVAL, 0x02, "Invalid key size" )

◆ EINVAL_COMPRESSION

#define EINVAL_COMPRESSION __einfo_error ( EINFO_EINVAL_COMPRESSION )

Definition at line 54 of file ecdsa.c.

54#define EINVAL_COMPRESSION \

55 __einfo_error ( EINFO_EINVAL_COMPRESSION )

Referenced by ecdsa_parse_key().

◆ EINFO_EINVAL_COMPRESSION

#define EINFO_EINVAL_COMPRESSION __einfo_uniqify ( EINFO_EINVAL, 0x03, "Invalid compression")

Definition at line 56 of file ecdsa.c.

56#define EINFO_EINVAL_COMPRESSION \

57 __einfo_uniqify ( EINFO_EINVAL, 0x03, "Invalid compression")

◆ EINVAL_INFINITY

#define EINVAL_INFINITY __einfo_error ( EINFO_EINVAL_INFINITY )

Definition at line 58 of file ecdsa.c.

58#define EINVAL_INFINITY \

59 __einfo_error ( EINFO_EINVAL_INFINITY )

Referenced by ecdsa_parse_key().

◆ EINFO_EINVAL_INFINITY

#define EINFO_EINVAL_INFINITY __einfo_uniqify ( EINFO_EINVAL, 0x04, "Point is infinity" )

Definition at line 60 of file ecdsa.c.

60#define EINFO_EINVAL_INFINITY \

61 __einfo_uniqify ( EINFO_EINVAL, 0x04, "Point is infinity" )

◆ EINVAL_SIGNATURE

#define EINVAL_SIGNATURE __einfo_error ( EINFO_EINVAL_SIGNATURE )

Definition at line 62 of file ecdsa.c.

62#define EINVAL_SIGNATURE \

63 __einfo_error ( EINFO_EINVAL_SIGNATURE )

Referenced by ecdsa_verify(), and ecdsa_verify_rs().

◆ EINFO_EINVAL_SIGNATURE

#define EINFO_EINVAL_SIGNATURE __einfo_uniqify ( EINFO_EINVAL, 0x05, "Invalid signature" )

Definition at line 64 of file ecdsa.c.

64#define EINFO_EINVAL_SIGNATURE \

65 __einfo_uniqify ( EINFO_EINVAL, 0x05, "Invalid signature" )

Function Documentation

◆ FILE_LICENCE()

FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL )

◆ FILE_SECBOOT()

FILE_SECBOOT ( PERMITTED )

◆ ecdsa_parse_key()

int ecdsa_parse_key	(	struct ecdsa_key *	key,
		const struct asn1_cursor *	raw )

static

Parse ECDSA key.

Parameters

key	ECDSA key
raw	ASN.1 cursor

Return values

rc	Return status code

Definition at line 141 of file ecdsa.c.

                                                             {
        struct asn1_algorithm *algorithm;
        struct asn1_cursor cursor;
        struct asn1_cursor curve;
        struct asn1_cursor private;
        const uint8_t *compression;
        int is_private;
        int rc;
 
        /* Enter subjectPublicKeyInfo/ECPrivateKey */
        memcpy ( &cursor, raw, sizeof ( cursor ) );
        asn1_enter ( &cursor, ASN1_SEQUENCE );
        asn1_invalidate_cursor ( &curve );
        asn1_invalidate_cursor ( &private );
 
        /* Determine key format */
        if ( asn1_type ( &cursor ) == ASN1_INTEGER ) {
 
                /* Private key */
                is_private = 1;
 
                /* Skip version */
                asn1_skip_any ( &cursor );
 
                /* Parse privateKeyAlgorithm, if present */
                if ( asn1_type ( &cursor ) == ASN1_SEQUENCE ) {
 
                        /* PKCS#8 format */
                        DBGC ( key, "ECDSA %p is in PKCS#8 format\n", key );
 
                        /* Parse privateKeyAlgorithm */
                        memcpy ( &curve, &cursor, sizeof ( curve ) );
                        asn1_skip_any ( &cursor );
 
                        /* Enter privateKey */
                        asn1_enter ( &cursor, ASN1_OCTET_STRING );
 
                        /* Enter ECPrivateKey */
                        asn1_enter ( &cursor, ASN1_SEQUENCE );
 
                        /* Skip version */
                        asn1_skip ( &cursor, ASN1_INTEGER );
                }
 
                /* Parse privateKey */
                memcpy ( &private, &cursor, sizeof ( private ) );
                asn1_enter ( &private, ASN1_OCTET_STRING );
                asn1_skip_any ( &cursor );
 
                /* Parse parameters, if present */
                if ( asn1_type ( &cursor ) == ASN1_EXPLICIT_TAG ( 0 ) ) {
                        memcpy ( &curve, &cursor, sizeof ( curve ) );
                        asn1_enter_any ( &curve );
                        asn1_skip_any ( &cursor );
                }
 
                /* Enter publicKey */
                asn1_enter ( &cursor, ASN1_EXPLICIT_TAG ( 1 ) );
 
        } else {
 
                /* Public key */
                is_private = 0;
 
                /* Parse algorithm */
                memcpy ( &curve, &cursor, sizeof ( curve ) );
                asn1_skip_any ( &cursor );
        }
 
        /* Enter publicKey */
        asn1_enter_bits ( &cursor, NULL );
 
        /* Identify curve */
        if ( ( rc = asn1_curve_algorithm ( &curve, &ecpubkey_algorithm,
                                           &algorithm ) ) != 0 ) {
                DBGC ( key, "ECDSA %p unknown curve: %s\n",
                       key, strerror ( rc ) );
                DBGC_HDA ( key, 0, raw->data, raw->len );
                return rc;
        }
        key->curve = algorithm->curve;
        DBGC ( key, "ECDSA %p is a %s (%s) %s key\n", key, algorithm->name,
               key->curve->name, ( is_private ? "private" : "public" ) );
 
        /* Check public key length */
        if ( cursor.len != ( sizeof ( *compression ) +
                             key->curve->pointsize ) ) {
                DBGC ( key, "ECDSA %p invalid public key length %zd\n",
                       key, cursor.len );
                DBGC_HDA ( key, 0, raw->data, raw->len );
                return -EINVAL_POINTSIZE;
        }
 
        /* Check that key is uncompressed */
        compression = cursor.data;
        if ( *compression != ECDSA_UNCOMPRESSED ) {
                DBGC ( key, "ECDSA %p invalid compression %#02x\n",
                       key, *compression );
                DBGC_HDA ( key, 0, raw->data, raw->len );
                return -EINVAL_COMPRESSION;
        }
 
        /* Extract public curve point */
        key->public = ( cursor.data + sizeof ( *compression ) );
        DBGC ( key, "ECDSA %p public curve point:\n", key );
        DBGC_HDA ( key, 0, key->public, key->curve->pointsize );
 
        /* Check that public key is not the point at infinity */
        if ( elliptic_is_infinity ( key->curve, key->public ) ) {
                DBGC ( key, "ECDSA %p public curve point is infinity\n", key );
                return -EINVAL_INFINITY;
        }
 
        /* Extract private key, if applicable */
        if ( is_private ) {
 
                /* Check private key length */
                if ( private.len != key->curve->keysize ) {
                        DBGC ( key, "ECDSA %p invalid private key length "
                               "%zd\n", key, private.len );
                        DBGC_HDA ( key, 0, raw->data, raw->len );
                        return -EINVAL_KEYSIZE;
                }
 
                /* Extract private key */
                key->private = private.data;
                DBGC ( key, "ECDSA %p private multiplier:\n", key );
                DBGC_HDA ( key, 0, key->private, key->curve->keysize );
 
        } else {
 
                /* No private key */
                key->private = NULL;
        }
 
        return 0;
}

References algorithm, asn1_curve_algorithm(), asn1_enter(), asn1_enter_any(), asn1_enter_bits(), ASN1_EXPLICIT_TAG, ASN1_INTEGER, asn1_invalidate_cursor(), ASN1_OCTET_STRING, ASN1_SEQUENCE, asn1_skip(), asn1_skip_any(), asn1_type(), asn1_cursor::data, DBGC, DBGC_HDA, ECDSA_UNCOMPRESSED, EINVAL_COMPRESSION, EINVAL_INFINITY, EINVAL_KEYSIZE, EINVAL_POINTSIZE, elliptic_is_infinity(), key, asn1_cursor::len, len, memcpy(), NULL, raw, rc, and strerror().

Referenced by ecdsa_init(), and ecdsa_match().

◆ ecdsa_parse_signature()

int ecdsa_parse_signature	(	struct ecdsa_context *	ctx,
		bigint_element_t *	rs0,
		const struct asn1_cursor *	raw )

static

Parse ECDSA signature value.

Parameters

ctx	ECDSA context
rs0	Element 0 of signature "r" or "s" value
raw	ASN.1 cursor

Return values

len	Canonical length of "r"/"s", or negative error

Definition at line 288 of file ecdsa.c.

                                                                   {
        size_t keysize = ctx->key.curve->keysize;
        unsigned int size = ctx->size;
        bigint_t ( size ) __attribute__ (( may_alias )) *modulus =
                ( ( void * ) ctx->modulus0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *rs =
                ( ( void * ) rs0 );
        struct asn1_cursor cursor;
        uint8_t msb;
        size_t len;
        int rc;
 
        /* Enter integer */
        memcpy ( &cursor, raw, sizeof ( cursor ) );
        if ( ( rc = asn1_enter_unsigned ( &cursor ) ) != 0 ) {
                DBGC ( ctx, "ECDSA %p invalid integer:\n", ctx );
                DBGC_HDA ( ctx, 0, raw->data, raw->len );
                return rc;
        }
 
        /* Extract value */
        if ( cursor.len > keysize ) {
                DBGC ( ctx, "ECDSA %p invalid signature value:\n", ctx );
                DBGC_HDA ( ctx, 0, raw->data, raw->len );
                return -EINVAL_KEYSIZE;
        }
        bigint_init ( rs, cursor.data, cursor.len );
 
        /* Check that value is within the required range */
        if ( bigint_is_zero ( rs ) || bigint_is_geq ( rs, modulus ) ) {
                DBGC ( ctx, "ECDSA %p out-of-range signature value:\n", ctx );
                DBGC_HDA ( ctx, 0, raw->data, raw->len );
                return -ERANGE;
        }
 
        /* Calculate canonical length */
        msb = *( ( const uint8_t * ) cursor.data );
        len = ( cursor.len + ( ( msb & 0x80 ) ? 1 : 0 ) );
        len += asn1_header_len ( len );
 
        return len;
}

References __attribute__, asn1_enter_unsigned(), asn1_header_len(), bigint_init, bigint_is_geq, bigint_is_zero, bigint_t, ctx, asn1_cursor::data, DBGC, DBGC_HDA, EINVAL_KEYSIZE, ERANGE, keysize, asn1_cursor::len, len, memcpy(), raw, rc, and size.

Referenced by ecdsa_verify().

◆ ecdsa_prepend_signature()

int ecdsa_prepend_signature	(	struct ecdsa_context *	ctx,
		bigint_element_t *	rs0,
		struct asn1_builder *	builder )

static

Prepend ECDSA signature value.

Parameters

ctx	ECDSA context
rs0	Element 0 of signature "r" or "s" value
builder	ASN.1 builder

Return values

rc	Return status code

Definition at line 341 of file ecdsa.c.

                                                                    {
        size_t keysize = ctx->key.curve->keysize;
        unsigned int size = ctx->size;
        bigint_t ( size ) __attribute__ (( may_alias )) *rs =
                ( ( void * ) rs0 );
        uint8_t buf[ 1 /* potential sign byte */ + keysize ];
        uint8_t *data;
        size_t len;
        int rc;
 
        /* Construct value */
        buf[0] = 0;
        bigint_done ( rs, &buf[1], keysize );
 
        /* Strip leading zeros */
        data = buf;
        len = sizeof ( buf );
        while ( ( len > 1 ) && ( data[0] == 0 ) && ( data[1] < 0x80 ) ) {
                data++;
                len--;
        }
 
        /* Prepend integer */
        if ( ( rc = asn1_prepend ( builder, ASN1_INTEGER, data, len ) ) != 0 )
                return rc;
 
        return 0;
}

References __attribute__, ASN1_INTEGER, asn1_prepend(), bigint_done, bigint_t, ctx, data, keysize, len, rc, and size.

Referenced by ecdsa_sign().

◆ ecdsa_alloc()

int ecdsa_alloc ( struct ecdsa_context * ctx )

static

Allocate ECDSA context dynamic storage.

Parameters

ctx	ECDSA context

Return values

rc	Return status code

Definition at line 378 of file ecdsa.c.

                                                     {
        struct elliptic_curve *curve = ctx->key.curve;
        size_t pointsize = curve->pointsize;
        size_t keysize = curve->keysize;
        unsigned int size =
                bigint_required_size ( keysize + 1 /* for addition */ );
        struct {
                bigint_t ( size ) modulus;
                bigint_t ( size ) fermat;
                bigint_t ( size ) square;
                bigint_t ( size ) one;
                bigint_t ( size ) z;
                bigint_t ( size ) k;
                bigint_t ( size ) r;
                bigint_t ( size ) s;
                bigint_t ( size ) temp;
                bigint_t ( size * 2 ) product;
                uint8_t point1[pointsize];
                uint8_t point2[pointsize];
                uint8_t scalar[keysize];
                struct hmac_drbg_state drbg;
        } *dynamic;
 
        /* Allocate dynamic storage */
        dynamic = malloc ( sizeof ( *dynamic ) );
        if ( ! dynamic )
                return -ENOMEM;
 
        /* Populate context */
        ctx->size = size;
        ctx->dynamic = dynamic;
        ctx->modulus0 = dynamic->modulus.element;
        ctx->fermat0 = dynamic->fermat.element;
        ctx->square0 = dynamic->square.element;
        ctx->one0 = dynamic->one.element;
        ctx->z0 = dynamic->z.element;
        ctx->k0 = dynamic->k.element;
        ctx->r0 = dynamic->r.element;
        ctx->s0 = dynamic->s.element;
        ctx->temp0 = dynamic->temp.element;
        ctx->product0 = dynamic->product.element;
        ctx->point1 = dynamic->point1;
        ctx->point2 = dynamic->point2;
        ctx->scalar = dynamic->scalar;
        ctx->drbg = &dynamic->drbg;
 
        return 0;
}

References bigint_required_size, bigint_t, ctx, ENOMEM, k, elliptic_curve::keysize, keysize, malloc(), elliptic_curve::pointsize, product, r, and size.

Referenced by ecdsa_init().

◆ ecdsa_free()

void ecdsa_free ( struct ecdsa_context * ctx )

static

Free ECDSA context dynamic storage.

Parameters

ctx	ECDSA context

Definition at line 432 of file ecdsa.c.

                                                     {
 
        /* Free dynamic storage */
        zfree ( ctx->dynamic );
}

References ctx, and zfree().

Referenced by ecdsa_init(), ecdsa_sign(), and ecdsa_verify().

◆ ecdsa_init_values()

void ecdsa_init_values	(	struct ecdsa_context *	ctx,
		struct digest_algorithm *	digest,
		const void *	value )

static

Initialise ECDSA values.

Parameters

ctx	ECDSA context
digest	Digest algorithm
value	Digest value

Definition at line 445 of file ecdsa.c.

                                                    {
        struct elliptic_curve *curve = ctx->key.curve;
        unsigned int size = ctx->size;
        bigint_t ( size ) __attribute__ (( may_alias )) *modulus =
                ( ( void * ) ctx->modulus0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *fermat =
                ( ( void * ) ctx->fermat0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *square =
                ( ( void * ) ctx->square0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *one =
                ( ( void * ) ctx->one0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *z =
                ( ( void * ) ctx->z0 );
        bigint_t ( size * 2 ) __attribute__ (( may_alias )) *product =
                ( ( void * ) ctx->product0 );
        static const uint8_t two_raw[] = { 2 };
        size_t zlen;
 
        /* Initialise modulus N */
        bigint_init ( modulus, curve->order, curve->keysize );
        DBGC2 ( ctx, "ECDSA %p       N = %s\n", ctx, bigint_ntoa ( modulus ) );
 
        /* Calculate N-2 (using Montgomery constant as temporary buffer) */
        bigint_copy ( modulus, fermat );
        bigint_init ( square, two_raw, sizeof ( two_raw ) );
        bigint_subtract ( square, fermat );
 
        /* Calculate Montgomery constant */
        bigint_reduce ( modulus, square );
        DBGC2 ( ctx, "ECDSA %p     R^2 = %s mod N\n",
                ctx, bigint_ntoa ( square ) );
 
        /* Construct one in Montgomery form */
        bigint_grow ( square, product );
        bigint_montgomery ( modulus, product, one );
        DBGC2 ( ctx, "ECDSA %p       R = %s mod N\n",
                ctx, bigint_ntoa ( one ) );
 
        /* Initialise digest */
        ctx->digest = digest;
        zlen = ctx->key.curve->keysize;
        if ( zlen > digest->digestsize )
                zlen = digest->digestsize;
        ctx->zlen = zlen;
        bigint_init ( z, value, zlen );
        DBGC2 ( ctx, "ECDSA %p       z = %s (%s)\n",
                ctx, bigint_ntoa ( z ), digest->name );
}

References __attribute__, bigint_copy, bigint_grow, bigint_init, bigint_montgomery, bigint_ntoa, bigint_reduce, bigint_subtract, bigint_t, ctx, DBGC2, digest_algorithm::digestsize, elliptic_curve::keysize, digest_algorithm::name, elliptic_curve::order, product, size, and value.

Referenced by ecdsa_init().

◆ ecdsa_init()

int ecdsa_init	(	struct ecdsa_context *	ctx,
		const struct asn1_cursor *	key,
		struct digest_algorithm *	digest,
		const void *	value )

static

Initialise ECDSA context.

Parameters

ctx	ECDSA context
key	Key
digest	Digest algorithm
value	Digest value

Return values

rc	Return status code

Definition at line 505 of file ecdsa.c.

                                            {
        int rc;
 
        /* Parse key */
        if ( ( rc = ecdsa_parse_key ( &ctx->key, key ) ) != 0 )
                goto err_parse;
 
        /* Allocate dynamic storage */
        if ( ( rc = ecdsa_alloc ( ctx ) ) != 0 )
                goto err_alloc;
 
        /* Initialise values */
        ecdsa_init_values ( ctx, digest, value );
 
        return 0;
 
        ecdsa_free ( ctx );
 err_alloc:
 err_parse:
        return rc;
}

References ctx, ecdsa_alloc(), ecdsa_free(), ecdsa_init_values(), ecdsa_parse_key(), key, rc, and value.

Referenced by ecdsa_sign(), and ecdsa_verify().

◆ ecdsa_invert()

void ecdsa_invert	(	struct ecdsa_context *	ctx,
		bigint_element_t *	val0 )

static

Invert ECDSA value.

Parameters

ctx	ECDSA context
val0	Element 0 of value to invert

Definition at line 536 of file ecdsa.c.

                                                    {
        unsigned int size = ctx->size;
        bigint_t ( size ) __attribute__ (( may_alias )) *modulus =
                ( ( void * ) ctx->modulus0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *fermat =
                ( ( void * ) ctx->fermat0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *square =
                ( ( void * ) ctx->square0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *one =
                ( ( void * ) ctx->one0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *temp =
                ( ( void * ) ctx->temp0 );
        bigint_t ( size * 2 ) __attribute__ (( may_alias )) *product =
                ( ( void * ) ctx->product0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *val =
                ( ( void * ) val0 );
 
        /* Convert value to Montgomery form */
        bigint_multiply ( val, square, product );
        bigint_montgomery ( modulus, product, temp );
 
        /* Invert value via Fermat's little theorem */
        bigint_copy ( one, val );
        bigint_ladder ( val, temp, fermat, bigint_mod_exp_ladder, modulus,
                        product );
}

References __attribute__, bigint_copy, bigint_ladder, bigint_mod_exp_ladder(), bigint_montgomery, bigint_multiply, bigint_t, ctx, product, size, and val.

Referenced by ecdsa_sign_rs(), and ecdsa_verify_rs().

◆ ecdsa_sign_rs()

int ecdsa_sign_rs ( struct ecdsa_context * ctx )

static

Generate ECDSA "r" and "s" values.

Parameters

ctx	ECDSA context
sig	Signature

Return values

rc	Return status code

Definition at line 571 of file ecdsa.c.

                                                       {
        struct digest_algorithm *digest = ctx->digest;
        struct elliptic_curve *curve = ctx->key.curve;
        size_t pointsize = curve->pointsize;
        size_t keysize = curve->keysize;
        unsigned int size = ctx->size;
        bigint_t ( size ) __attribute__ (( may_alias )) *modulus =
                ( ( void * ) ctx->modulus0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *square =
                ( ( void * ) ctx->square0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *one =
                ( ( void * ) ctx->one0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *z =
                ( ( void * ) ctx->z0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *k =
                ( ( void * ) ctx->k0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *r =
                ( ( void * ) ctx->r0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *s =
                ( ( void * ) ctx->s0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *temp =
                ( ( void * ) ctx->temp0 );
        bigint_t ( size * 2 ) __attribute__ (( may_alias )) *product =
                ( ( void * ) ctx->product0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *x1 =
                ( ( void * ) temp );
        void *point1 = ctx->point1;
        void *scalar = ctx->scalar;
        int rc;
 
        /* Loop until a suitable signature is generated */
        while ( 1 ) {
 
                /* Generate pseudo-random data */
                if ( ( rc = hmac_drbg_generate ( digest, ctx->drbg, NULL, 0,
                                                 scalar, keysize ) ) != 0 ) {
                        DBGC ( ctx, "ECDSA %p could not generate: %s\n",
                               ctx, strerror ( rc ) );
                        return rc;
                }
 
                /* Check suitability of pseudo-random data */
                bigint_init ( k, scalar, keysize );
                DBGC2 ( ctx, "ECDSA %p       k = %s\n",
                        ctx, bigint_ntoa ( k ) );
                if ( bigint_is_zero ( k ) )
                        continue;
                if ( bigint_is_geq ( k, modulus ) )
                        continue;
 
                /* Calculate (x1,y1) = k*G */
                elliptic_multiply ( curve, curve->base, scalar, point1 );
                bigint_init ( x1, point1, ( pointsize / 2 ) );
                DBGC2 ( ctx, "ECDSA %p      x1 = %s mod N\n",
                        ctx, bigint_ntoa ( x1 ) );
 
                /* Calculate r = x1 mod N */
                bigint_multiply ( x1, one, product );
                bigint_montgomery ( modulus, product, r );
                DBGC2 ( ctx, "ECDSA %p       r = %s\n",
                        ctx, bigint_ntoa ( r ) );
 
                /* Check suitability of r */
                if ( bigint_is_zero ( r ) )
                        continue;
 
                /* Calculate k^-1 mod N (in Montgomery form) */
                ecdsa_invert ( ctx, k->element );
                DBGC2 ( ctx, "ECDSA %p (k^-1)R = %s mod N\n",
                        ctx, bigint_ntoa ( k ) );
 
                /* Calculate r * dA */
                bigint_init ( temp, ctx->key.private, keysize );
                DBGC2 ( ctx, "ECDSA %p      dA = %s\n",
                        ctx, bigint_ntoa ( temp ) );
                bigint_multiply ( r, temp, product );
                bigint_montgomery ( modulus, product, temp );
                bigint_multiply ( temp, square, product );
                bigint_montgomery ( modulus, product, temp );
                DBGC2 ( ctx, "ECDSA %p    r*dA = %s mod N\n",
                        ctx, bigint_ntoa ( temp ) );
 
                /* Calculate k^-1 * (z + r*dA) */
                bigint_add ( z, temp );
                DBGC2 ( ctx, "ECDSA %p  z+r*dA = %s mod N\n",
                        ctx, bigint_ntoa ( temp ) );
                bigint_multiply ( k, temp, product );
                bigint_montgomery ( modulus, product, s );
                DBGC2 ( ctx, "ECDSA %p       s = %s\n",
                        ctx, bigint_ntoa ( s ) );
 
                /* Check suitability of s */
                if ( bigint_is_zero ( s ) )
                        continue;
 
                return 0;
        }
}

References __attribute__, elliptic_curve::base, bigint_add, bigint_init, bigint_is_geq, bigint_is_zero, bigint_montgomery, bigint_multiply, bigint_ntoa, bigint_t, ctx, DBGC, DBGC2, ecdsa_invert(), elliptic_multiply(), hmac_drbg_generate(), k, elliptic_curve::keysize, keysize, NULL, elliptic_curve::pointsize, product, r, rc, size, and strerror().

Referenced by ecdsa_sign().

◆ ecdsa_verify_rs()

int ecdsa_verify_rs ( struct ecdsa_context * ctx )

static

Verify ECDSA "r" and "s" values.

Parameters

ctx	ECDSA context
sig	Signature

Return values

rc	Return status code

Definition at line 677 of file ecdsa.c.

                                                         {
        struct elliptic_curve *curve = ctx->key.curve;
        size_t pointsize = curve->pointsize;
        size_t keysize = curve->keysize;
        const void *public = ctx->key.public;
        unsigned int size = ctx->size;
        bigint_t ( size ) __attribute__ (( may_alias )) *modulus =
                ( ( void * ) ctx->modulus0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *one =
                ( ( void * ) ctx->one0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *z =
                ( ( void * ) ctx->z0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *r =
                ( ( void * ) ctx->r0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *s =
                ( ( void * ) ctx->s0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *temp =
                ( ( void * ) ctx->temp0 );
        bigint_t ( size * 2 ) __attribute__ (( may_alias )) *product =
                ( ( void * ) ctx->product0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *u1 =
                ( ( void * ) temp );
        bigint_t ( size ) __attribute__ (( may_alias )) *u2 =
                ( ( void * ) temp );
        bigint_t ( size ) __attribute__ (( may_alias )) *x1 =
                ( ( void * ) temp );
        void *point1 = ctx->point1;
        void *point2 = ctx->point2;
        void *scalar = ctx->scalar;
        int valid;
        int rc;
 
        DBGC2 ( ctx, "ECDSA %p       r = %s\n", ctx, bigint_ntoa ( r ) );
        DBGC2 ( ctx, "ECDSA %p       s = %s\n", ctx, bigint_ntoa ( s ) );
 
        /* Calculate s^-1 mod N (in Montgomery form) */
        ecdsa_invert ( ctx, s->element );
        DBGC2 ( ctx, "ECDSA %p (s^-1)R = %s mod N\n", ctx, bigint_ntoa ( s ) );
 
        /* Calculate u1 = (z * s^-1) mod N */
        bigint_multiply ( z, s, product );
        bigint_montgomery ( modulus, product, u1 );
        DBGC2 ( ctx, "ECDSA %p      u1 = %s mod N\n",
                ctx, bigint_ntoa ( u1 ) );
        bigint_done ( u1, scalar, keysize );
 
        /* Calculate u1 * G */
        if ( ( rc = elliptic_multiply ( curve, curve->base, scalar,
                                        point1 ) ) != 0 ) {
                DBGC ( ctx, "ECDSA %p could not calculate u1*G: %s\n",
                       ctx, strerror ( rc ) );
                return rc;
        }
 
        /* Calculate u2 = (r * s^-1) mod N */
        bigint_multiply ( r, s, product );
        bigint_montgomery ( modulus, product, u2 );
        bigint_done ( u2, scalar, keysize );
        DBGC2 ( ctx, "ECDSA %p      u2 = %s mod N\n",
                ctx, bigint_ntoa ( u2 ) );
 
        /* Calculate u2 * Qa */
        if ( ( rc = elliptic_multiply ( curve, public, scalar,
                                        point2 ) ) != 0 ) {
                DBGC ( ctx, "ECDSA %p could not calculate u2*Qa: %s\n",
                       ctx, strerror ( rc ) );
                return rc;
        }
 
        /* Calculate u1 * G + u2 * Qa */
        if ( ( rc = elliptic_add ( curve, point1, point2, point1 ) ) != 0 ) {
                DBGC ( ctx, "ECDSA %p could not calculate u1*G+u2*Qa: %s\n",
                       ctx, strerror ( rc ) );
                return rc;
        }
 
        /* Check that result is not the point at infinity */
        if ( elliptic_is_infinity ( curve, point1 ) ) {
                DBGC ( ctx, "ECDSA %p result is point at infinity\n", ctx );
                return -EINVAL;
        }
 
        /* Calculate x1 mod N */
        bigint_init ( x1, point1, ( pointsize / 2 ) );
        DBGC2 ( ctx, "ECDSA %p      x1 = %s mod N\n", ctx, bigint_ntoa ( x1 ) );
        bigint_multiply ( x1, one, product );
        bigint_montgomery ( modulus, product, x1 );
        DBGC2 ( ctx, "ECDSA %p      x1 = %s\n", ctx, bigint_ntoa ( x1 ) );
 
        /* Check signature */
        bigint_subtract ( x1, r );
        valid = bigint_is_zero ( r );
        DBGC2 ( ctx, "ECDSA %p signature is%s valid\n",
                ctx, ( valid ? "" : " not" ) );
 
        return ( valid ? 0 : -EINVAL_SIGNATURE );
}

References __attribute__, elliptic_curve::base, bigint_done, bigint_init, bigint_is_zero, bigint_montgomery, bigint_multiply, bigint_ntoa, bigint_subtract, bigint_t, ctx, DBGC, DBGC2, ecdsa_invert(), EINVAL, EINVAL_SIGNATURE, elliptic_add(), elliptic_is_infinity(), elliptic_multiply(), elliptic_curve::keysize, keysize, elliptic_curve::pointsize, product, r, rc, size, and strerror().

Referenced by ecdsa_verify().

◆ ecdsa_sign()

int ecdsa_sign	(	struct pubkey_algorithm *pubkey	__unused,
		const struct asn1_cursor *	key,
		struct digest_algorithm *	digest,
		const void *	value,
		struct asn1_builder *	signature )

static

Sign digest value using ECDSA.

Parameters

pubkey	Public-key algorithm
key	Key
digest	Digest algorithm
value	Digest value
signature	Signature

Return values

rc	Return status code

Definition at line 785 of file ecdsa.c.

                                                         {
        struct ecdsa_context ctx;
        int rc;
 
        /* Initialise context */
        if ( ( rc = ecdsa_init ( &ctx, key, digest, value ) ) != 0 )
                goto err_init;
 
        /* Fail unless we have a private key */
        if ( ! ctx.key.private ) {
                rc = -ENOTTY;
                goto err_no_key;
        }
 
        /* Instantiate DRBG */
        hmac_drbg_instantiate ( digest, ctx.drbg, ctx.key.private,
                                ctx.key.curve->keysize, value, ctx.zlen );
 
        /* Create signature */
        if ( ( rc = ecdsa_sign_rs ( &ctx ) ) != 0 )
                goto err_signature;
 
        /* Construct "r" and "s" values */
        if ( ( rc = ecdsa_prepend_signature ( &ctx, ctx.s0, signature ) ) != 0)
                goto err_s;
        if ( ( rc = ecdsa_prepend_signature ( &ctx, ctx.r0, signature ) ) != 0)
                goto err_r;
        if ( ( rc = asn1_wrap ( signature, ASN1_SEQUENCE ) ) != 0 )
                goto err_wrap;
 
        /* Free context */
        ecdsa_free ( &ctx );
 
        return 0;
 
 err_wrap:
 err_r:
 err_s:
 err_signature:
 err_no_key:
        ecdsa_free ( &ctx );
 err_init:
        return rc;
}

References __unused, ASN1_SEQUENCE, asn1_wrap(), ctx, ecdsa_context::digest, ecdsa_free(), ecdsa_init(), ecdsa_prepend_signature(), ecdsa_sign_rs(), ENOTTY, hmac_drbg_instantiate(), key, rc, signature, and value.

◆ ecdsa_verify()

int ecdsa_verify	(	struct pubkey_algorithm *pubkey	__unused,
		const struct asn1_cursor *	key,
		struct digest_algorithm *	digest,
		const void *	value,
		const struct asn1_cursor *	signature )

static

Verify signed digest using ECDSA.

Parameters

pubkey	Public-key algorithm
key	Key
digest	Digest algorithm
value	Digest value
signature	Signature

Return values

rc	Return status code

Definition at line 843 of file ecdsa.c.

                                                                {
        struct ecdsa_context ctx;
        struct asn1_cursor cursor;
        int rlen;
        int slen;
        size_t len;
        int rc;
 
        /* Initialise context */
        if ( ( rc = ecdsa_init ( &ctx, key, digest, value ) ) != 0 )
                goto err_init;
 
        /* Enter sequence */
        memcpy ( &cursor, signature, sizeof ( cursor ) );
        asn1_enter ( &cursor, ASN1_SEQUENCE );
 
        /* Extract "r" and "s" values */
        if ( ( rlen = ecdsa_parse_signature ( &ctx, ctx.r0, &cursor ) ) < 0 ) {
                rc = rlen;
                goto err_parse;
        }
        asn1_skip_any ( &cursor );
        if ( ( slen = ecdsa_parse_signature ( &ctx, ctx.s0, &cursor ) ) < 0 ) {
                rc = slen;
                goto err_parse;
        }
 
        /* Check for any extraneous content in signature */
        len = ( rlen + slen );
        len += asn1_header_len ( len );
        if ( len != signature->len ) {
                DBGC ( &ctx, "ECDSA %p non-canonical signature:\n", &ctx );
                DBGC_HDA ( &ctx, 0, signature->data, signature->len );
                rc = -EINVAL_SIGNATURE;
                goto err_parse;
        }
 
        /* Verify signature */
        if ( ( rc = ecdsa_verify_rs ( &ctx ) ) != 0 )
                goto err_verify;
 
        /* Free context */
        ecdsa_free ( &ctx );
 
        return 0;
 
 err_verify:
 err_parse:
        ecdsa_free ( &ctx );
 err_init:
        return rc;
}

References __unused, asn1_enter(), asn1_header_len(), ASN1_SEQUENCE, asn1_skip_any(), ctx, DBGC, DBGC_HDA, ecdsa_free(), ecdsa_init(), ecdsa_parse_signature(), ecdsa_verify_rs(), EINVAL_SIGNATURE, key, len, memcpy(), rc, signature, and value.

◆ ecdsa_match()

int ecdsa_match	(	struct pubkey_algorithm *pubkey	__unused,
		const struct asn1_cursor *	private_key,
		const struct asn1_cursor *	public_key )

static

Check for matching ECDSA public/private key pair.

Parameters

pubkey	Public-key algorithm
private_key	Private key
public_key	Public key

Return values

rc	Return status code

Definition at line 907 of file ecdsa.c.

                                                                {
        struct elliptic_curve *curve;
        struct ecdsa_key private;
        struct ecdsa_key public;
        int rc;
 
        /* Parse keys */
        if ( ( rc = ecdsa_parse_key ( &private, private_key ) ) != 0 )
                return rc;
        if ( ( rc = ecdsa_parse_key ( &public, public_key ) ) != 0 )
                return rc;
 
        /* Compare curves */
        if ( private.curve != public.curve )
                return -ENOTTY;
        curve = private.curve;
 
        /* Compare public curve points */
        if ( memcmp ( private.public, public.public, curve->pointsize ) != 0 )
                return -ENOTTY;
 
        return 0;
}

References __unused, ecdsa_key::curve, ecdsa_parse_key(), ENOTTY, memcmp(), elliptic_curve::pointsize, ecdsa_key::private, ecdsa_key::public, and rc.

Variable Documentation

◆ oid_ecpublickey

uint8_t oid_ecpublickey[] = { ASN1_OID_ECPUBLICKEY }

static

"ecPublicKey" object identifier

Definition at line 68 of file ecdsa.c.

68{ ASN1_OID_ECPUBLICKEY };

ASN1_OID_ECPUBLICKEY

#define ASN1_OID_ECPUBLICKEY

ASN.1 OID for ecPublicKey (1.2.840.10045.2.1).

Definition asn1.h:135

◆ __asn1_algorithm

struct asn1_algorithm ecpubkey_algorithm __asn1_algorithm

Initial value:

                    = {
        .name = "ecPublicKey",
        .oid = ASN1_CURSOR ( oid_ecpublickey ),
        .pubkey = &ecdsa_algorithm,
}

Generic elliptic curve container algorithm.

The actual curve to be used is identified via the algorithm parameters, rather than the top-level OID.

Definition at line 75 of file ecdsa.c.

                                                          {
        .name = "ecPublicKey",
        .oid = ASN1_CURSOR ( oid_ecpublickey ),
        .pubkey = &ecdsa_algorithm,
};

◆ ecdsa_algorithm

struct pubkey_algorithm ecdsa_algorithm

Initial value:

                      = {
        .name           = "ecdsa",
        .encrypt        = pubkey_null_encrypt,
        .decrypt        = pubkey_null_decrypt,
        .sign           = ecdsa_sign,
        .verify         = ecdsa_verify,
        .match          = ecdsa_match,
}

ECDSA public-key algorithm.

Definition at line 934 of file ecdsa.c.

                                        {
        .name           = "ecdsa",
        .encrypt        = pubkey_null_encrypt,
        .decrypt        = pubkey_null_decrypt,
        .sign           = ecdsa_sign,
        .verify         = ecdsa_verify,
        .match          = ecdsa_match,
};

Data Structures

Macros

Functions

Variables

Detailed Description

Macro Definition Documentation

◆ EINVAL_POINTSIZE

◆ EINFO_EINVAL_POINTSIZE

◆ EINVAL_KEYSIZE

◆ EINFO_EINVAL_KEYSIZE

◆ EINVAL_COMPRESSION

◆ EINFO_EINVAL_COMPRESSION

◆ EINVAL_INFINITY

◆ EINFO_EINVAL_INFINITY

◆ EINVAL_SIGNATURE

◆ EINFO_EINVAL_SIGNATURE

Function Documentation

◆ FILE_LICENCE()

◆ FILE_SECBOOT()

◆ ecdsa_parse_key()

◆ ecdsa_parse_signature()

◆ ecdsa_prepend_signature()

◆ ecdsa_alloc()

◆ ecdsa_free()

◆ ecdsa_init_values()

◆ ecdsa_init()

◆ ecdsa_invert()

◆ ecdsa_sign_rs()

◆ ecdsa_verify_rs()

◆ ecdsa_sign()

◆ ecdsa_verify()

◆ ecdsa_match()

Variable Documentation

◆ oid_ecpublickey

◆ __asn1_algorithm

◆ ecdsa_algorithm