ecdsa.c File Reference

Elliptic curve digital signature algorithm (ECDSA). More...

#include <stdlib.h>
#include <errno.h>
#include <string.h>
#include <ipxe/crypto.h>
#include <ipxe/bigint.h>
#include <ipxe/hmac_drbg.h>
#include <ipxe/ecdsa.h>

Go to the source code of this file.

Data Structures
struct	ecdsa_key
	An ECDSA key. More...
struct	ecdsa_context
	ECDSA context. More...

Macros
#define	EINVAL_POINTSIZE   __einfo_error ( EINFO_EINVAL_POINTSIZE )
#define	EINFO_EINVAL_POINTSIZE   __einfo_uniqify ( EINFO_EINVAL, 0x01, "Invalid point size" )
#define	EINVAL_KEYSIZE   __einfo_error ( EINFO_EINVAL_KEYSIZE )
#define	EINFO_EINVAL_KEYSIZE   __einfo_uniqify ( EINFO_EINVAL, 0x02, "Invalid key size" )
#define	EINVAL_COMPRESSION   __einfo_error ( EINFO_EINVAL_COMPRESSION )
#define	EINFO_EINVAL_COMPRESSION   __einfo_uniqify ( EINFO_EINVAL, 0x03, "Invalid compression")
#define	EINVAL_INFINITY   __einfo_error ( EINFO_EINVAL_INFINITY )
#define	EINFO_EINVAL_INFINITY   __einfo_uniqify ( EINFO_EINVAL, 0x04, "Point is infinity" )
#define	EINVAL_SIGNATURE   __einfo_error ( EINFO_EINVAL_SIGNATURE )
#define	EINFO_EINVAL_SIGNATURE   __einfo_uniqify ( EINFO_EINVAL, 0x05, "Invalid signature" )

Functions
	FILE_LICENCE (GPL2_OR_LATER_OR_UBDL)
	FILE_SECBOOT (PERMITTED)
static int	ecdsa_parse_key (struct ecdsa_key *key, const struct asn1_cursor *raw)
	Parse ECDSA key.
static int	ecdsa_parse_signature (struct ecdsa_context *ctx, bigint_element_t *rs0, const struct asn1_cursor *raw)
	Parse ECDSA signature value.
static int	ecdsa_prepend_signature (struct ecdsa_context *ctx, bigint_element_t *rs0, struct asn1_builder *builder)
	Prepend ECDSA signature value.
static int	ecdsa_alloc (struct ecdsa_context *ctx)
	Allocate ECDSA context dynamic storage.
static void	ecdsa_free (struct ecdsa_context *ctx)
	Free ECDSA context dynamic storage.
static void	ecdsa_init_values (struct ecdsa_context *ctx, struct digest_algorithm *digest, const void *value)
	Initialise ECDSA values.
static int	ecdsa_init (struct ecdsa_context *ctx, const struct asn1_cursor *key, struct digest_algorithm *digest, const void *value)
	Initialise ECDSA context.
static void	ecdsa_invert (struct ecdsa_context *ctx, bigint_element_t *val0)
	Invert ECDSA value.
static int	ecdsa_sign_rs (struct ecdsa_context *ctx)
	Generate ECDSA "r" and "s" values.
static int	ecdsa_verify_rs (struct ecdsa_context *ctx)
	Verify ECDSA "r" and "s" values.
static int	ecdsa_sign (struct pubkey_algorithm *pubkey __unused, const struct asn1_cursor *key, struct digest_algorithm *digest, const void *value, struct asn1_builder *signature)
	Sign digest value using ECDSA.
static int	ecdsa_verify (struct pubkey_algorithm *pubkey __unused, const struct asn1_cursor *key, struct digest_algorithm *digest, const void *value, const struct asn1_cursor *signature)
	Verify signed digest using ECDSA.
static int	ecdsa_match (struct pubkey_algorithm *pubkey __unused, const struct asn1_cursor *private_key, const struct asn1_cursor *public_key)
	Check for matching ECDSA public/private key pair.

Variables
static uint8_t	oid_ecpublickey [] = { ASN1_OID_ECPUBLICKEY }
	"ecPublicKey" object identifier
struct asn1_algorithm ecpubkey_algorithm	__asn1_algorithm
	Generic elliptic curve container algorithm.
struct pubkey_algorithm	ecdsa_algorithm
	ECDSA public-key algorithm.

Detailed Description

Elliptic curve digital signature algorithm (ECDSA).

The elliptic curve public key format is documented in RFC 5480. The original private key format is documented in RFC 5915, and the generic container PKCS#8 format documented in RFC 5208.

Definition in file ecdsa.c.

Macro Definition Documentation

EINVAL_POINTSIZE

#define EINVAL_POINTSIZE   __einfo_error ( EINFO_EINVAL_POINTSIZE )

Definition at line 46 of file ecdsa.c.

#define EINVAL_POINTSIZE \
        __einfo_error ( EINFO_EINVAL_POINTSIZE )

Referenced by ecdsa_parse_key().

EINFO_EINVAL_POINTSIZE

#define EINFO_EINVAL_POINTSIZE   __einfo_uniqify ( EINFO_EINVAL, 0x01, "Invalid point size" )

Definition at line 48 of file ecdsa.c.

#define EINFO_EINVAL_POINTSIZE \
        __einfo_uniqify ( EINFO_EINVAL, 0x01, "Invalid point size" )

EINVAL_KEYSIZE

#define EINVAL_KEYSIZE   __einfo_error ( EINFO_EINVAL_KEYSIZE )

Definition at line 50 of file ecdsa.c.

#define EINVAL_KEYSIZE \
        __einfo_error ( EINFO_EINVAL_KEYSIZE )

Referenced by ecdsa_parse_key(), and ecdsa_parse_signature().

EINFO_EINVAL_KEYSIZE

#define EINFO_EINVAL_KEYSIZE   __einfo_uniqify ( EINFO_EINVAL, 0x02, "Invalid key size" )

Definition at line 52 of file ecdsa.c.

#define EINFO_EINVAL_KEYSIZE \
        __einfo_uniqify ( EINFO_EINVAL, 0x02, "Invalid key size" )

EINVAL_COMPRESSION

#define EINVAL_COMPRESSION   __einfo_error ( EINFO_EINVAL_COMPRESSION )

Definition at line 54 of file ecdsa.c.

#define EINVAL_COMPRESSION \
        __einfo_error ( EINFO_EINVAL_COMPRESSION )

Referenced by ecdsa_parse_key().

EINFO_EINVAL_COMPRESSION

#define EINFO_EINVAL_COMPRESSION   __einfo_uniqify ( EINFO_EINVAL, 0x03, "Invalid compression")

Definition at line 56 of file ecdsa.c.

#define EINFO_EINVAL_COMPRESSION \
        __einfo_uniqify ( EINFO_EINVAL, 0x03, "Invalid compression")

EINVAL_INFINITY

#define EINVAL_INFINITY   __einfo_error ( EINFO_EINVAL_INFINITY )

Definition at line 58 of file ecdsa.c.

#define EINVAL_INFINITY \
        __einfo_error ( EINFO_EINVAL_INFINITY )

Referenced by ecdsa_parse_key().

EINFO_EINVAL_INFINITY

#define EINFO_EINVAL_INFINITY   __einfo_uniqify ( EINFO_EINVAL, 0x04, "Point is infinity" )

Definition at line 60 of file ecdsa.c.

#define EINFO_EINVAL_INFINITY \
        __einfo_uniqify ( EINFO_EINVAL, 0x04, "Point is infinity" )

EINVAL_SIGNATURE

#define EINVAL_SIGNATURE   __einfo_error ( EINFO_EINVAL_SIGNATURE )

Definition at line 62 of file ecdsa.c.

#define EINVAL_SIGNATURE \
        __einfo_error ( EINFO_EINVAL_SIGNATURE )

Referenced by ecdsa_verify_rs().

EINFO_EINVAL_SIGNATURE

#define EINFO_EINVAL_SIGNATURE   __einfo_uniqify ( EINFO_EINVAL, 0x05, "Invalid signature" )

Definition at line 64 of file ecdsa.c.

#define EINFO_EINVAL_SIGNATURE \
        __einfo_uniqify ( EINFO_EINVAL, 0x05, "Invalid signature" )

Function Documentation

FILE_LICENCE()

FILE_LICENCE

(

GPL2_OR_LATER_OR_UBDL

)

FILE_SECBOOT()

FILE_SECBOOT

(

PERMITTED

)

ecdsa_parse_key()

int ecdsa_parse_key ( struct ecdsa_key * key, const struct asn1_cursor * raw )

static

Parse ECDSA key.

Parameters

key	ECDSA key
raw	ASN.1 cursor

Return values

rc	Return status code

Definition at line 141 of file ecdsa.c.

                                                             {
        struct asn1_algorithm *algorithm;
        struct asn1_cursor cursor;
        struct asn1_cursor curve;
        struct asn1_cursor private;
        const uint8_t *compression;
        int is_private;
        int rc;
 
        /* Enter subjectPublicKeyInfo/ECPrivateKey */
        memcpy ( &cursor, raw, sizeof ( cursor ) );
        asn1_enter ( &cursor, ASN1_SEQUENCE );
        asn1_invalidate_cursor ( &curve );
        asn1_invalidate_cursor ( &private );
 
        /* Determine key format */
        if ( asn1_type ( &cursor ) == ASN1_INTEGER ) {
 
                /* Private key */
                is_private = 1;
 
                /* Skip version */
                asn1_skip_any ( &cursor );
 
                /* Parse privateKeyAlgorithm, if present */
                if ( asn1_type ( &cursor ) == ASN1_SEQUENCE ) {
 
                        /* PKCS#8 format */
                        DBGC ( key, "ECDSA %p is in PKCS#8 format\n", key );
 
                        /* Parse privateKeyAlgorithm */
                        memcpy ( &curve, &cursor, sizeof ( curve ) );
                        asn1_skip_any ( &cursor );
 
                        /* Enter privateKey */
                        asn1_enter ( &cursor, ASN1_OCTET_STRING );
 
                        /* Enter ECPrivateKey */
                        asn1_enter ( &cursor, ASN1_SEQUENCE );
 
                        /* Skip version */
                        asn1_skip ( &cursor, ASN1_INTEGER );
                }
 
                /* Parse privateKey */
                memcpy ( &private, &cursor, sizeof ( private ) );
                asn1_enter ( &private, ASN1_OCTET_STRING );
                asn1_skip_any ( &cursor );
 
                /* Parse parameters, if present */
                if ( asn1_type ( &cursor ) == ASN1_EXPLICIT_TAG ( 0 ) ) {
                        memcpy ( &curve, &cursor, sizeof ( curve ) );
                        asn1_enter_any ( &curve );
                        asn1_skip_any ( &cursor );
                }
 
                /* Enter publicKey */
                asn1_enter ( &cursor, ASN1_EXPLICIT_TAG ( 1 ) );
 
        } else {
 
                /* Public key */
                is_private = 0;
 
                /* Parse algorithm */
                memcpy ( &curve, &cursor, sizeof ( curve ) );
                asn1_skip_any ( &cursor );
        }
 
        /* Enter publicKey */
        asn1_enter_bits ( &cursor, NULL );
 
        /* Identify curve */
        if ( ( rc = asn1_curve_algorithm ( &curve, &ecpubkey_algorithm,
                                           &algorithm ) ) != 0 ) {
                DBGC ( key, "ECDSA %p unknown curve: %s\n",
                       key, strerror ( rc ) );
                DBGC_HDA ( key, 0, raw->data, raw->len );
                return rc;
        }
        key->curve = algorithm->curve;
        DBGC ( key, "ECDSA %p is a %s (%s) %s key\n", key, algorithm->name,
               key->curve->name, ( is_private ? "private" : "public" ) );
 
        /* Check public key length */
        if ( cursor.len != ( sizeof ( *compression ) +
                             key->curve->pointsize ) ) {
                DBGC ( key, "ECDSA %p invalid public key length %zd\n",
                       key, cursor.len );
                DBGC_HDA ( key, 0, raw->data, raw->len );
                return -EINVAL_POINTSIZE;
        }
 
        /* Check that key is uncompressed */
        compression = cursor.data;
        if ( *compression != ECDSA_UNCOMPRESSED ) {
                DBGC ( key, "ECDSA %p invalid compression %#02x\n",
                       key, *compression );
                DBGC_HDA ( key, 0, raw->data, raw->len );
                return -EINVAL_COMPRESSION;
        }
 
        /* Extract public curve point */
        key->public = ( cursor.data + sizeof ( *compression ) );
        DBGC ( key, "ECDSA %p public curve point:\n", key );
        DBGC_HDA ( key, 0, key->public, key->curve->pointsize );
 
        /* Check that public key is not the point at infinity */
        if ( elliptic_is_infinity ( key->curve, key->public ) ) {
                DBGC ( key, "ECDSA %p public curve point is infinity\n", key );
                return -EINVAL_INFINITY;
        }
 
        /* Extract private key, if applicable */
        if ( is_private ) {
 
                /* Check private key length */
                if ( private.len != key->curve->keysize ) {
                        DBGC ( key, "ECDSA %p invalid private key length "
                               "%zd\n", key, private.len );
                        DBGC_HDA ( key, 0, raw->data, raw->len );
                        return -EINVAL_KEYSIZE;
                }
 
                /* Extract private key */
                key->private = private.data;
                DBGC ( key, "ECDSA %p private multiplier:\n", key );
                DBGC_HDA ( key, 0, key->private, key->curve->keysize );
 
        } else {
 
                /* No private key */
                key->private = NULL;
        }
 
        return 0;
}

References algorithm, asn1_curve_algorithm(), asn1_enter(), asn1_enter_any(), asn1_enter_bits(), ASN1_EXPLICIT_TAG, ASN1_INTEGER, asn1_invalidate_cursor(), ASN1_OCTET_STRING, ASN1_SEQUENCE, asn1_skip(), asn1_skip_any(), asn1_type(), asn1_cursor::data, DBGC, DBGC_HDA, ECDSA_UNCOMPRESSED, EINVAL_COMPRESSION, EINVAL_INFINITY, EINVAL_KEYSIZE, EINVAL_POINTSIZE, elliptic_is_infinity(), key, asn1_cursor::len, len, memcpy(), NULL, raw, rc, and strerror().

Referenced by ecdsa_init(), and ecdsa_match().

ecdsa_parse_signature()

int ecdsa_parse_signature ( struct ecdsa_context * ctx, bigint_element_t * rs0, const struct asn1_cursor * raw )

static

Parse ECDSA signature value.

Parameters

ctx	ECDSA context
rs0	Element 0 of signature "r" or "s" value
raw	ASN.1 cursor

Return values

rc	Return status code

Definition at line 288 of file ecdsa.c.

                                                                   {
        size_t keysize = ctx->key.curve->keysize;
        unsigned int size = ctx->size;
        bigint_t ( size ) __attribute__ (( may_alias )) *modulus =
                ( ( void * ) ctx->modulus0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *rs =
                ( ( void * ) rs0 );
        struct asn1_cursor cursor;
        int rc;
 
        /* Enter integer */
        memcpy ( &cursor, raw, sizeof ( cursor ) );
        if ( ( rc = asn1_enter_unsigned ( &cursor ) ) != 0 ) {
                DBGC ( ctx, "ECDSA %p invalid integer:\n", ctx );
                DBGC_HDA ( ctx, 0, raw->data, raw->len );
                return rc;
        }
 
        /* Extract value */
        if ( cursor.len > keysize ) {
                DBGC ( ctx, "ECDSA %p invalid signature value:\n", ctx );
                DBGC_HDA ( ctx, 0, raw->data, raw->len );
                return -EINVAL_KEYSIZE;
        }
        bigint_init ( rs, cursor.data, cursor.len );
 
        /* Check that value is within the required range */
        if ( bigint_is_zero ( rs ) || bigint_is_geq ( rs, modulus ) ) {
                DBGC ( ctx, "ECDSA %p out-of-range signature value:\n", ctx );
                DBGC_HDA ( ctx, 0, raw->data, raw->len );
                return -ERANGE;
        }
 
        return 0;
}

References __attribute__, asn1_enter_unsigned(), bigint_init, bigint_is_geq, bigint_is_zero, bigint_t, ctx, asn1_cursor::data, DBGC, DBGC_HDA, EINVAL_KEYSIZE, ERANGE, keysize, asn1_cursor::len, memcpy(), raw, rc, and size.

Referenced by ecdsa_verify().

ecdsa_prepend_signature()

int ecdsa_prepend_signature ( struct ecdsa_context * ctx, bigint_element_t * rs0, struct asn1_builder * builder )

static

Prepend ECDSA signature value.

Parameters

ctx	ECDSA context
rs0	Element 0 of signature "r" or "s" value
builder	ASN.1 builder

Return values

rc	Return status code

Definition at line 334 of file ecdsa.c.

                                                                    {
        size_t keysize = ctx->key.curve->keysize;
        unsigned int size = ctx->size;
        bigint_t ( size ) __attribute__ (( may_alias )) *rs =
                ( ( void * ) rs0 );
        uint8_t buf[ 1 /* potential sign byte */ + keysize ];
        uint8_t *data;
        size_t len;
        int rc;
 
        /* Construct value */
        buf[0] = 0;
        bigint_done ( rs, &buf[1], keysize );
 
        /* Strip leading zeros */
        data = buf;
        len = sizeof ( buf );
        while ( ( len > 1 ) && ( data[0] == 0 ) && ( data[1] < 0x80 ) ) {
                data++;
                len--;
        }
 
        /* Prepend integer */
        if ( ( rc = asn1_prepend ( builder, ASN1_INTEGER, data, len ) ) != 0 )
                return rc;
 
        return 0;
}

References __attribute__, ASN1_INTEGER, asn1_prepend(), bigint_done, bigint_t, ctx, data, keysize, len, rc, and size.

Referenced by ecdsa_sign().

ecdsa_alloc()

int ecdsa_alloc ( struct ecdsa_context * ctx )

static

Allocate ECDSA context dynamic storage.

Parameters

ctx	ECDSA context

Return values

rc	Return status code

Definition at line 371 of file ecdsa.c.

                                                     {
        struct elliptic_curve *curve = ctx->key.curve;
        size_t pointsize = curve->pointsize;
        size_t keysize = curve->keysize;
        unsigned int size =
                bigint_required_size ( keysize + 1 /* for addition */ );
        struct {
                bigint_t ( size ) modulus;
                bigint_t ( size ) fermat;
                bigint_t ( size ) square;
                bigint_t ( size ) one;
                bigint_t ( size ) z;
                bigint_t ( size ) k;
                bigint_t ( size ) r;
                bigint_t ( size ) s;
                bigint_t ( size ) temp;
                bigint_t ( size * 2 ) product;
                uint8_t point1[pointsize];
                uint8_t point2[pointsize];
                uint8_t scalar[keysize];
                struct hmac_drbg_state drbg;
        } *dynamic;
 
        /* Allocate dynamic storage */
        dynamic = malloc ( sizeof ( *dynamic ) );
        if ( ! dynamic )
                return -ENOMEM;
 
        /* Populate context */
        ctx->size = size;
        ctx->dynamic = dynamic;
        ctx->modulus0 = dynamic->modulus.element;
        ctx->fermat0 = dynamic->fermat.element;
        ctx->square0 = dynamic->square.element;
        ctx->one0 = dynamic->one.element;
        ctx->z0 = dynamic->z.element;
        ctx->k0 = dynamic->k.element;
        ctx->r0 = dynamic->r.element;
        ctx->s0 = dynamic->s.element;
        ctx->temp0 = dynamic->temp.element;
        ctx->product0 = dynamic->product.element;
        ctx->point1 = dynamic->point1;
        ctx->point2 = dynamic->point2;
        ctx->scalar = dynamic->scalar;
        ctx->drbg = &dynamic->drbg;
 
        return 0;
}

References bigint_required_size, bigint_t, ctx, ENOMEM, k, elliptic_curve::keysize, keysize, malloc(), elliptic_curve::pointsize, product, r, and size.

Referenced by ecdsa_init().

ecdsa_free()

void ecdsa_free ( struct ecdsa_context * ctx )

static

Free ECDSA context dynamic storage.

Parameters

ctx	ECDSA context

Definition at line 425 of file ecdsa.c.

                                                     {
 
        /* Free dynamic storage */
        zfree ( ctx->dynamic );
}

References ctx, and zfree().

Referenced by ecdsa_init(), ecdsa_sign(), and ecdsa_verify().

ecdsa_init_values()

void ecdsa_init_values ( struct ecdsa_context * ctx, struct digest_algorithm * digest, const void * value )

static

Initialise ECDSA values.

Parameters

ctx	ECDSA context
digest	Digest algorithm
value	Digest value

Definition at line 438 of file ecdsa.c.

                                                    {
        struct elliptic_curve *curve = ctx->key.curve;
        unsigned int size = ctx->size;
        bigint_t ( size ) __attribute__ (( may_alias )) *modulus =
                ( ( void * ) ctx->modulus0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *fermat =
                ( ( void * ) ctx->fermat0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *square =
                ( ( void * ) ctx->square0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *one =
                ( ( void * ) ctx->one0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *z =
                ( ( void * ) ctx->z0 );
        bigint_t ( size * 2 ) __attribute__ (( may_alias )) *product =
                ( ( void * ) ctx->product0 );
        static const uint8_t two_raw[] = { 2 };
        size_t zlen;
 
        /* Initialise modulus N */
        bigint_init ( modulus, curve->order, curve->keysize );
        DBGC2 ( ctx, "ECDSA %p       N = %s\n", ctx, bigint_ntoa ( modulus ) );
 
        /* Calculate N-2 (using Montgomery constant as temporary buffer) */
        bigint_copy ( modulus, fermat );
        bigint_init ( square, two_raw, sizeof ( two_raw ) );
        bigint_subtract ( square, fermat );
 
        /* Calculate Montgomery constant */
        bigint_reduce ( modulus, square );
        DBGC2 ( ctx, "ECDSA %p     R^2 = %s mod N\n",
                ctx, bigint_ntoa ( square ) );
 
        /* Construct one in Montgomery form */
        bigint_grow ( square, product );
        bigint_montgomery ( modulus, product, one );
        DBGC2 ( ctx, "ECDSA %p       R = %s mod N\n",
                ctx, bigint_ntoa ( one ) );
 
        /* Initialise digest */
        ctx->digest = digest;
        zlen = ctx->key.curve->keysize;
        if ( zlen > digest->digestsize )
                zlen = digest->digestsize;
        ctx->zlen = zlen;
        bigint_init ( z, value, zlen );
        DBGC2 ( ctx, "ECDSA %p       z = %s (%s)\n",
                ctx, bigint_ntoa ( z ), digest->name );
}

References __attribute__, bigint_copy, bigint_grow, bigint_init, bigint_montgomery, bigint_ntoa, bigint_reduce, bigint_subtract, bigint_t, ctx, DBGC2, digest_algorithm::digestsize, elliptic_curve::keysize, digest_algorithm::name, elliptic_curve::order, product, size, and value.

Referenced by ecdsa_init().

ecdsa_init()

int ecdsa_init ( struct ecdsa_context * ctx, const struct asn1_cursor * key, struct digest_algorithm * digest, const void * value )

static

Initialise ECDSA context.

Parameters

ctx	ECDSA context
key	Key
digest	Digest algorithm
value	Digest value

Return values

rc	Return status code

Definition at line 498 of file ecdsa.c.

                                            {
        int rc;
 
        /* Parse key */
        if ( ( rc = ecdsa_parse_key ( &ctx->key, key ) ) != 0 )
                goto err_parse;
 
        /* Allocate dynamic storage */
        if ( ( rc = ecdsa_alloc ( ctx ) ) != 0 )
                goto err_alloc;
 
        /* Initialise values */
        ecdsa_init_values ( ctx, digest, value );
 
        return 0;
 
        ecdsa_free ( ctx );
 err_alloc:
 err_parse:
        return rc;
}

References ctx, ecdsa_alloc(), ecdsa_free(), ecdsa_init_values(), ecdsa_parse_key(), key, rc, and value.

Referenced by ecdsa_sign(), and ecdsa_verify().

ecdsa_invert()

void ecdsa_invert ( struct ecdsa_context * ctx, bigint_element_t * val0 )

static

Invert ECDSA value.

Parameters

ctx	ECDSA context
val0	Element 0 of value to invert

Definition at line 529 of file ecdsa.c.

                                                    {
        unsigned int size = ctx->size;
        bigint_t ( size ) __attribute__ (( may_alias )) *modulus =
                ( ( void * ) ctx->modulus0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *fermat =
                ( ( void * ) ctx->fermat0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *square =
                ( ( void * ) ctx->square0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *one =
                ( ( void * ) ctx->one0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *temp =
                ( ( void * ) ctx->temp0 );
        bigint_t ( size * 2 ) __attribute__ (( may_alias )) *product =
                ( ( void * ) ctx->product0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *val =
                ( ( void * ) val0 );
 
        /* Convert value to Montgomery form */
        bigint_multiply ( val, square, product );
        bigint_montgomery ( modulus, product, temp );
 
        /* Invert value via Fermat's little theorem */
        bigint_copy ( one, val );
        bigint_ladder ( val, temp, fermat, bigint_mod_exp_ladder, modulus,
                        product );
}

References __attribute__, bigint_copy, bigint_ladder, bigint_mod_exp_ladder(), bigint_montgomery, bigint_multiply, bigint_t, ctx, product, size, and val.

Referenced by ecdsa_sign_rs(), and ecdsa_verify_rs().

ecdsa_sign_rs()

int ecdsa_sign_rs ( struct ecdsa_context * ctx )

static

Generate ECDSA "r" and "s" values.

Parameters

ctx	ECDSA context
sig	Signature

Return values

rc	Return status code

Definition at line 564 of file ecdsa.c.

                                                       {
        struct digest_algorithm *digest = ctx->digest;
        struct elliptic_curve *curve = ctx->key.curve;
        size_t pointsize = curve->pointsize;
        size_t keysize = curve->keysize;
        unsigned int size = ctx->size;
        bigint_t ( size ) __attribute__ (( may_alias )) *modulus =
                ( ( void * ) ctx->modulus0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *square =
                ( ( void * ) ctx->square0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *one =
                ( ( void * ) ctx->one0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *z =
                ( ( void * ) ctx->z0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *k =
                ( ( void * ) ctx->k0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *r =
                ( ( void * ) ctx->r0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *s =
                ( ( void * ) ctx->s0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *temp =
                ( ( void * ) ctx->temp0 );
        bigint_t ( size * 2 ) __attribute__ (( may_alias )) *product =
                ( ( void * ) ctx->product0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *x1 =
                ( ( void * ) temp );
        void *point1 = ctx->point1;
        void *scalar = ctx->scalar;
        int rc;
 
        /* Loop until a suitable signature is generated */
        while ( 1 ) {
 
                /* Generate pseudo-random data */
                if ( ( rc = hmac_drbg_generate ( digest, ctx->drbg, NULL, 0,
                                                 scalar, keysize ) ) != 0 ) {
                        DBGC ( ctx, "ECDSA %p could not generate: %s\n",
                               ctx, strerror ( rc ) );
                        return rc;
                }
 
                /* Check suitability of pseudo-random data */
                bigint_init ( k, scalar, keysize );
                DBGC2 ( ctx, "ECDSA %p       k = %s\n",
                        ctx, bigint_ntoa ( k ) );
                if ( bigint_is_zero ( k ) )
                        continue;
                if ( bigint_is_geq ( k, modulus ) )
                        continue;
 
                /* Calculate (x1,y1) = k*G */
                elliptic_multiply ( curve, curve->base, scalar, point1 );
                bigint_init ( x1, point1, ( pointsize / 2 ) );
                DBGC2 ( ctx, "ECDSA %p      x1 = %s mod N\n",
                        ctx, bigint_ntoa ( x1 ) );
 
                /* Calculate r = x1 mod N */
                bigint_multiply ( x1, one, product );
                bigint_montgomery ( modulus, product, r );
                DBGC2 ( ctx, "ECDSA %p       r = %s\n",
                        ctx, bigint_ntoa ( r ) );
 
                /* Check suitability of r */
                if ( bigint_is_zero ( r ) )
                        continue;
 
                /* Calculate k^-1 mod N (in Montgomery form) */
                ecdsa_invert ( ctx, k->element );
                DBGC2 ( ctx, "ECDSA %p (k^-1)R = %s mod N\n",
                        ctx, bigint_ntoa ( k ) );
 
                /* Calculate r * dA */
                bigint_init ( temp, ctx->key.private, keysize );
                DBGC2 ( ctx, "ECDSA %p      dA = %s\n",
                        ctx, bigint_ntoa ( temp ) );
                bigint_multiply ( r, temp, product );
                bigint_montgomery ( modulus, product, temp );
                bigint_multiply ( temp, square, product );
                bigint_montgomery ( modulus, product, temp );
                DBGC2 ( ctx, "ECDSA %p    r*dA = %s mod N\n",
                        ctx, bigint_ntoa ( temp ) );
 
                /* Calculate k^-1 * (z + r*dA) */
                bigint_add ( z, temp );
                DBGC2 ( ctx, "ECDSA %p  z+r*dA = %s mod N\n",
                        ctx, bigint_ntoa ( temp ) );
                bigint_multiply ( k, temp, product );
                bigint_montgomery ( modulus, product, s );
                DBGC2 ( ctx, "ECDSA %p       s = %s\n",
                        ctx, bigint_ntoa ( s ) );
 
                /* Check suitability of s */
                if ( bigint_is_zero ( s ) )
                        continue;
 
                return 0;
        }
}

References __attribute__, elliptic_curve::base, bigint_add, bigint_init, bigint_is_geq, bigint_is_zero, bigint_montgomery, bigint_multiply, bigint_ntoa, bigint_t, ctx, DBGC, DBGC2, ecdsa_invert(), elliptic_multiply(), hmac_drbg_generate(), k, elliptic_curve::keysize, keysize, NULL, elliptic_curve::pointsize, product, r, rc, size, and strerror().

Referenced by ecdsa_sign().

ecdsa_verify_rs()

int ecdsa_verify_rs ( struct ecdsa_context * ctx )

static

Verify ECDSA "r" and "s" values.

Parameters

ctx	ECDSA context
sig	Signature

Return values

rc	Return status code

Definition at line 670 of file ecdsa.c.

                                                         {
        struct elliptic_curve *curve = ctx->key.curve;
        size_t pointsize = curve->pointsize;
        size_t keysize = curve->keysize;
        const void *public = ctx->key.public;
        unsigned int size = ctx->size;
        bigint_t ( size ) __attribute__ (( may_alias )) *modulus =
                ( ( void * ) ctx->modulus0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *one =
                ( ( void * ) ctx->one0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *z =
                ( ( void * ) ctx->z0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *r =
                ( ( void * ) ctx->r0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *s =
                ( ( void * ) ctx->s0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *temp =
                ( ( void * ) ctx->temp0 );
        bigint_t ( size * 2 ) __attribute__ (( may_alias )) *product =
                ( ( void * ) ctx->product0 );
        bigint_t ( size ) __attribute__ (( may_alias )) *u1 =
                ( ( void * ) temp );
        bigint_t ( size ) __attribute__ (( may_alias )) *u2 =
                ( ( void * ) temp );
        bigint_t ( size ) __attribute__ (( may_alias )) *x1 =
                ( ( void * ) temp );
        void *point1 = ctx->point1;
        void *point2 = ctx->point2;
        void *scalar = ctx->scalar;
        int valid;
        int rc;
 
        DBGC2 ( ctx, "ECDSA %p       r = %s\n", ctx, bigint_ntoa ( r ) );
        DBGC2 ( ctx, "ECDSA %p       s = %s\n", ctx, bigint_ntoa ( s ) );
 
        /* Calculate s^-1 mod N (in Montgomery form) */
        ecdsa_invert ( ctx, s->element );
        DBGC2 ( ctx, "ECDSA %p (s^-1)R = %s mod N\n", ctx, bigint_ntoa ( s ) );
 
        /* Calculate u1 = (z * s^-1) mod N */
        bigint_multiply ( z, s, product );
        bigint_montgomery ( modulus, product, u1 );
        DBGC2 ( ctx, "ECDSA %p      u1 = %s mod N\n",
                ctx, bigint_ntoa ( u1 ) );
        bigint_done ( u1, scalar, keysize );
 
        /* Calculate u1 * G */
        if ( ( rc = elliptic_multiply ( curve, curve->base, scalar,
                                        point1 ) ) != 0 ) {
                DBGC ( ctx, "ECDSA %p could not calculate u1*G: %s\n",
                       ctx, strerror ( rc ) );
                return rc;
        }
 
        /* Calculate u2 = (r * s^-1) mod N */
        bigint_multiply ( r, s, product );
        bigint_montgomery ( modulus, product, u2 );
        bigint_done ( u2, scalar, keysize );
        DBGC2 ( ctx, "ECDSA %p      u2 = %s mod N\n",
                ctx, bigint_ntoa ( u2 ) );
 
        /* Calculate u2 * Qa */
        if ( ( rc = elliptic_multiply ( curve, public, scalar,
                                        point2 ) ) != 0 ) {
                DBGC ( ctx, "ECDSA %p could not calculate u2*Qa: %s\n",
                       ctx, strerror ( rc ) );
                return rc;
        }
 
        /* Calculate u1 * G + u2 * Qa */
        if ( ( rc = elliptic_add ( curve, point1, point2, point1 ) ) != 0 ) {
                DBGC ( ctx, "ECDSA %p could not calculate u1*G+u2*Qa: %s\n",
                       ctx, strerror ( rc ) );
                return rc;
        }
 
        /* Check that result is not the point at infinity */
        if ( elliptic_is_infinity ( curve, point1 ) ) {
                DBGC ( ctx, "ECDSA %p result is point at infinity\n", ctx );
                return -EINVAL;
        }
 
        /* Calculate x1 mod N */
        bigint_init ( x1, point1, ( pointsize / 2 ) );
        DBGC2 ( ctx, "ECDSA %p      x1 = %s mod N\n", ctx, bigint_ntoa ( x1 ) );
        bigint_multiply ( x1, one, product );
        bigint_montgomery ( modulus, product, x1 );
        DBGC2 ( ctx, "ECDSA %p      x1 = %s\n", ctx, bigint_ntoa ( x1 ) );
 
        /* Check signature */
        bigint_subtract ( x1, r );
        valid = bigint_is_zero ( r );
        DBGC2 ( ctx, "ECDSA %p signature is%s valid\n",
                ctx, ( valid ? "" : " not" ) );
 
        return ( valid ? 0 : -EINVAL_SIGNATURE );
}

References __attribute__, elliptic_curve::base, bigint_done, bigint_init, bigint_is_zero, bigint_montgomery, bigint_multiply, bigint_ntoa, bigint_subtract, bigint_t, ctx, DBGC, DBGC2, ecdsa_invert(), EINVAL, EINVAL_SIGNATURE, elliptic_add(), elliptic_is_infinity(), elliptic_multiply(), elliptic_curve::keysize, keysize, elliptic_curve::pointsize, product, r, rc, size, and strerror().

Referenced by ecdsa_verify().

ecdsa_sign()

int ecdsa_sign ( struct pubkey_algorithm *pubkey __unused, const struct asn1_cursor * key, struct digest_algorithm * digest, const void * value, struct asn1_builder * signature )

static

Sign digest value using ECDSA.

Parameters

pubkey	Public-key algorithm
key	Key
digest	Digest algorithm
value	Digest value
signature	Signature

Return values

rc	Return status code

Definition at line 778 of file ecdsa.c.

                                                         {
        struct ecdsa_context ctx;
        int rc;
 
        /* Initialise context */
        if ( ( rc = ecdsa_init ( &ctx, key, digest, value ) ) != 0 )
                goto err_init;
 
        /* Fail unless we have a private key */
        if ( ! ctx.key.private ) {
                rc = -ENOTTY;
                goto err_no_key;
        }
 
        /* Instantiate DRBG */
        hmac_drbg_instantiate ( digest, ctx.drbg, ctx.key.private,
                                ctx.key.curve->keysize, value, ctx.zlen );
 
        /* Create signature */
        if ( ( rc = ecdsa_sign_rs ( &ctx ) ) != 0 )
                goto err_signature;
 
        /* Construct "r" and "s" values */
        if ( ( rc = ecdsa_prepend_signature ( &ctx, ctx.s0, signature ) ) != 0)
                goto err_s;
        if ( ( rc = ecdsa_prepend_signature ( &ctx, ctx.r0, signature ) ) != 0)
                goto err_r;
        if ( ( rc = asn1_wrap ( signature, ASN1_SEQUENCE ) ) != 0 )
                goto err_wrap;
 
        /* Free context */
        ecdsa_free ( &ctx );
 
        return 0;
 
 err_wrap:
 err_r:
 err_s:
 err_signature:
 err_no_key:
        ecdsa_free ( &ctx );
 err_init:
        return rc;
}

References __unused, ASN1_SEQUENCE, asn1_wrap(), ctx, ecdsa_context::digest, ecdsa_free(), ecdsa_init(), ecdsa_prepend_signature(), ecdsa_sign_rs(), ENOTTY, hmac_drbg_instantiate(), key, rc, signature, and value.

ecdsa_verify()

int ecdsa_verify ( struct pubkey_algorithm *pubkey __unused, const struct asn1_cursor * key, struct digest_algorithm * digest, const void * value, const struct asn1_cursor * signature )

static

Verify signed digest using ECDSA.

Parameters

pubkey	Public-key algorithm
key	Key
digest	Digest algorithm
value	Digest value
signature	Signature

Return values

rc	Return status code

Definition at line 836 of file ecdsa.c.

                                                                {
        struct ecdsa_context ctx;
        struct asn1_cursor cursor;
        int rc;
 
        /* Initialise context */
        if ( ( rc = ecdsa_init ( &ctx, key, digest, value ) ) != 0 )
                goto err_init;
 
        /* Enter sequence */
        memcpy ( &cursor, signature, sizeof ( cursor ) );
        asn1_enter ( &cursor, ASN1_SEQUENCE );
 
        /* Extract "r" and "s" values */
        if ( ( rc = ecdsa_parse_signature ( &ctx, ctx.r0, &cursor ) ) != 0 )
                goto err_r;
        asn1_skip_any ( &cursor );
        if ( ( rc = ecdsa_parse_signature ( &ctx, ctx.s0, &cursor ) ) != 0 )
                goto err_s;
 
        /* Verify signature */
        if ( ( rc = ecdsa_verify_rs ( &ctx ) ) != 0 )
                goto err_verify;
 
        /* Free context */
        ecdsa_free ( &ctx );
 
        return 0;
 
 err_verify:
 err_s:
 err_r:
        ecdsa_free ( &ctx );
 err_init:
        return rc;
}

References __unused, asn1_enter(), ASN1_SEQUENCE, asn1_skip_any(), ctx, ecdsa_free(), ecdsa_init(), ecdsa_parse_signature(), ecdsa_verify_rs(), key, memcpy(), rc, signature, and value.

ecdsa_match()

int ecdsa_match ( struct pubkey_algorithm *pubkey __unused, const struct asn1_cursor * private_key, const struct asn1_cursor * public_key )

static

Check for matching ECDSA public/private key pair.

Parameters

pubkey	Public-key algorithm
private_key	Private key
public_key	Public key

Return values

rc	Return status code

Definition at line 884 of file ecdsa.c.

                                                                {
        struct elliptic_curve *curve;
        struct ecdsa_key private;
        struct ecdsa_key public;
        int rc;
 
        /* Parse keys */
        if ( ( rc = ecdsa_parse_key ( &private, private_key ) ) != 0 )
                return rc;
        if ( ( rc = ecdsa_parse_key ( &public, public_key ) ) != 0 )
                return rc;
 
        /* Compare curves */
        if ( private.curve != public.curve )
                return -ENOTTY;
        curve = private.curve;
 
        /* Compare public curve points */
        if ( memcmp ( private.public, public.public, curve->pointsize ) != 0 )
                return -ENOTTY;
 
        return 0;
}

References __unused, ecdsa_key::curve, ecdsa_parse_key(), ENOTTY, memcmp(), elliptic_curve::pointsize, ecdsa_key::private, ecdsa_key::public, and rc.

Variable Documentation

oid_ecpublickey

uint8_t oid_ecpublickey[] = { ASN1_OID_ECPUBLICKEY }

static

"ecPublicKey" object identifier

Definition at line 68 of file ecdsa.c.

{ ASN1_OID_ECPUBLICKEY };

__asn1_algorithm

struct asn1_algorithm ecpubkey_algorithm __asn1_algorithm

Initial value:

                    = {
        .name = "ecPublicKey",
        .oid = ASN1_CURSOR ( oid_ecpublickey ),
        .pubkey = &ecdsa_algorithm,
}

Generic elliptic curve container algorithm.

The actual curve to be used is identified via the algorithm parameters, rather than the top-level OID.

Definition at line 75 of file ecdsa.c.

                                                          {
        .name = "ecPublicKey",
        .oid = ASN1_CURSOR ( oid_ecpublickey ),
        .pubkey = &ecdsa_algorithm,
};

ecdsa_algorithm

struct pubkey_algorithm ecdsa_algorithm

Initial value:

                      = {
        .name           = "ecdsa",
        .encrypt        = pubkey_null_encrypt,
        .decrypt        = pubkey_null_decrypt,
        .sign           = ecdsa_sign,
        .verify         = ecdsa_verify,
        .match          = ecdsa_match,
}

ECDSA public-key algorithm.

Definition at line 911 of file ecdsa.c.

                                        {
        .name           = "ecdsa",
        .encrypt        = pubkey_null_encrypt,
        .decrypt        = pubkey_null_decrypt,
        .sign           = ecdsa_sign,
        .verify         = ecdsa_verify,
        .match          = ecdsa_match,
};

Referenced by __tls_cipher_suite(), __tls_cipher_suite(), __tls_cipher_suite(), __tls_cipher_suite(), __tls_cipher_suite(), __tls_cipher_suite(), PUBKEY_SIGN_TEST(), PUBKEY_SIGN_TEST(), PUBKEY_SIGN_TEST(), and PUBKEY_SIGN_TEST().