ecdsa.c revision 1.9
1/* $OpenBSD: ecdsa.c,v 1.9 2023/07/05 14:41:18 tb Exp $ */ 2/* ==================================================================== 3 * Copyright (c) 2000-2002 The OpenSSL Project. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in 14 * the documentation and/or other materials provided with the 15 * distribution. 16 * 17 * 3. All advertising materials mentioning features or use of this 18 * software must display the following acknowledgment: 19 * "This product includes software developed by the OpenSSL Project 20 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" 21 * 22 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 23 * endorse or promote products derived from this software without 24 * prior written permission. For written permission, please contact 25 * licensing@OpenSSL.org. 26 * 27 * 5. Products derived from this software may not be called "OpenSSL" 28 * nor may "OpenSSL" appear in their names without prior written 29 * permission of the OpenSSL Project. 30 * 31 * 6. Redistributions of any form whatsoever must retain the following 32 * acknowledgment: 33 * "This product includes software developed by the OpenSSL Project 34 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" 35 * 36 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 37 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 38 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 39 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 40 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 41 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 42 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 43 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 44 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 45 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 46 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 47 * OF THE POSSIBILITY OF SUCH DAMAGE. 48 * ==================================================================== 49 * 50 * This product includes cryptographic software written by Eric Young 51 * (eay@cryptsoft.com). This product includes software written by Tim 52 * Hudson (tjh@cryptsoft.com). 53 * 54 */ 55 56#include <stddef.h> 57#include <stdlib.h> 58#include <string.h> 59 60#include <openssl/opensslconf.h> 61 62#include <openssl/asn1.h> 63#include <openssl/asn1t.h> 64#include <openssl/bn.h> 65#include <openssl/ecdsa.h> 66#include <openssl/ec.h> 67#include <openssl/err.h> 68#include <openssl/evp.h> 69 70#include "bn_local.h" 71#include "ec_local.h" 72#include "ecdsa_local.h" 73 74static const ASN1_TEMPLATE ECDSA_SIG_seq_tt[] = { 75 { 76 .flags = 0, 77 .tag = 0, 78 .offset = offsetof(ECDSA_SIG, r), 79 .field_name = "r", 80 .item = &BIGNUM_it, 81 }, 82 { 83 .flags = 0, 84 .tag = 0, 85 .offset = offsetof(ECDSA_SIG, s), 86 .field_name = "s", 87 .item = &BIGNUM_it, 88 }, 89}; 90 91const ASN1_ITEM ECDSA_SIG_it = { 92 .itype = ASN1_ITYPE_SEQUENCE, 93 .utype = V_ASN1_SEQUENCE, 94 .templates = ECDSA_SIG_seq_tt, 95 .tcount = sizeof(ECDSA_SIG_seq_tt) / sizeof(ASN1_TEMPLATE), 96 .funcs = NULL, 97 .size = sizeof(ECDSA_SIG), 98 .sname = "ECDSA_SIG", 99}; 100 101ECDSA_SIG * 102d2i_ECDSA_SIG(ECDSA_SIG **a, const unsigned char **in, long len) 103{ 104 return (ECDSA_SIG *)ASN1_item_d2i((ASN1_VALUE **)a, in, len, 105 &ECDSA_SIG_it); 106} 107 108int 109i2d_ECDSA_SIG(const ECDSA_SIG *a, unsigned char **out) 110{ 111 return ASN1_item_i2d((ASN1_VALUE *)a, out, &ECDSA_SIG_it); 112} 113 114ECDSA_SIG * 115ECDSA_SIG_new(void) 116{ 117 return (ECDSA_SIG *)ASN1_item_new(&ECDSA_SIG_it); 118} 119 120void 121ECDSA_SIG_free(ECDSA_SIG *a) 122{ 123 ASN1_item_free((ASN1_VALUE *)a, &ECDSA_SIG_it); 124} 125 126void 127ECDSA_SIG_get0(const ECDSA_SIG *sig, const BIGNUM **pr, const BIGNUM **ps) 128{ 129 if (pr != NULL) 130 *pr = sig->r; 131 if (ps != NULL) 132 *ps = sig->s; 133} 134 135const BIGNUM * 136ECDSA_SIG_get0_r(const ECDSA_SIG *sig) 137{ 138 return sig->r; 139} 140 141const BIGNUM * 142ECDSA_SIG_get0_s(const ECDSA_SIG *sig) 143{ 144 return sig->s; 145} 146 147int 148ECDSA_SIG_set0(ECDSA_SIG *sig, BIGNUM *r, BIGNUM *s) 149{ 150 if (r == NULL || s == NULL) 151 return 0; 152 153 BN_free(sig->r); 154 BN_free(sig->s); 155 sig->r = r; 156 sig->s = s; 157 return 1; 158} 159 160int 161ECDSA_size(const EC_KEY *r) 162{ 163 const EC_GROUP *group; 164 const BIGNUM *order = NULL; 165 ECDSA_SIG sig; 166 int ret = 0; 167 168 if (r == NULL) 169 goto err; 170 171 if ((group = EC_KEY_get0_group(r)) == NULL) 172 goto err; 173 174 if ((order = EC_GROUP_get0_order(group)) == NULL) 175 goto err; 176 177 sig.r = (BIGNUM *)order; 178 sig.s = (BIGNUM *)order; 179 180 if ((ret = i2d_ECDSA_SIG(&sig, NULL)) < 0) 181 ret = 0; 182 183 err: 184 return ret; 185} 186 187/* 188 * FIPS 186-5, section 6.4.1, step 2: convert hashed message into an integer. 189 * Use the order_bits leftmost bits if it exceeds the group order. 190 */ 191static int 192ecdsa_prepare_digest(const unsigned char *digest, int digest_len, 193 const EC_KEY *key, BIGNUM *e) 194{ 195 const EC_GROUP *group; 196 int digest_bits, order_bits; 197 198 if (BN_bin2bn(digest, digest_len, e) == NULL) { 199 ECerror(ERR_R_BN_LIB); 200 return 0; 201 } 202 203 if ((group = EC_KEY_get0_group(key)) == NULL) 204 return 0; 205 order_bits = EC_GROUP_order_bits(group); 206 207 digest_bits = 8 * digest_len; 208 if (digest_bits <= order_bits) 209 return 1; 210 211 return BN_rshift(e, e, digest_bits - order_bits); 212} 213 214int 215ecdsa_sign(int type, const unsigned char *digest, int digest_len, 216 unsigned char *signature, unsigned int *signature_len, const BIGNUM *kinv, 217 const BIGNUM *r, EC_KEY *key) 218{ 219 ECDSA_SIG *sig; 220 int out_len = 0; 221 int ret = 0; 222 223 if ((sig = ECDSA_do_sign_ex(digest, digest_len, kinv, r, key)) == NULL) 224 goto err; 225 226 if ((out_len = i2d_ECDSA_SIG(sig, &signature)) < 0) { 227 out_len = 0; 228 goto err; 229 } 230 231 ret = 1; 232 233 err: 234 *signature_len = out_len; 235 ECDSA_SIG_free(sig); 236 237 return ret; 238} 239 240/* 241 * FIPS 186-5, section 6.4.1, steps 3-8 and 11: Generate k, calculate r and 242 * kinv. If r == 0, try again with a new random k. 243 */ 244 245int 246ecdsa_sign_setup(EC_KEY *key, BN_CTX *in_ctx, BIGNUM **out_kinv, BIGNUM **out_r) 247{ 248 const EC_GROUP *group; 249 EC_POINT *point = NULL; 250 BN_CTX *ctx = NULL; 251 BIGNUM *k = NULL, *r = NULL; 252 const BIGNUM *order; 253 BIGNUM *x; 254 int order_bits; 255 int ret = 0; 256 257 BN_free(*out_kinv); 258 *out_kinv = NULL; 259 260 BN_free(*out_r); 261 *out_r = NULL; 262 263 if (key == NULL) { 264 ECerror(ERR_R_PASSED_NULL_PARAMETER); 265 goto err; 266 } 267 if ((group = EC_KEY_get0_group(key)) == NULL) { 268 ECerror(ERR_R_PASSED_NULL_PARAMETER); 269 goto err; 270 } 271 272 if ((k = BN_new()) == NULL) 273 goto err; 274 if ((r = BN_new()) == NULL) 275 goto err; 276 277 if ((ctx = in_ctx) == NULL) 278 ctx = BN_CTX_new(); 279 if (ctx == NULL) { 280 ECerror(ERR_R_MALLOC_FAILURE); 281 goto err; 282 } 283 284 BN_CTX_start(ctx); 285 286 if ((x = BN_CTX_get(ctx)) == NULL) 287 goto err; 288 289 if ((point = EC_POINT_new(group)) == NULL) { 290 ECerror(ERR_R_EC_LIB); 291 goto err; 292 } 293 if ((order = EC_GROUP_get0_order(group)) == NULL) { 294 ECerror(ERR_R_EC_LIB); 295 goto err; 296 } 297 298 if (BN_cmp(order, BN_value_one()) <= 0) { 299 ECerror(EC_R_INVALID_GROUP_ORDER); 300 goto err; 301 } 302 303 /* Reject curves with an order that is smaller than 80 bits. */ 304 if ((order_bits = BN_num_bits(order)) < 80) { 305 ECerror(EC_R_INVALID_GROUP_ORDER); 306 goto err; 307 } 308 309 /* Preallocate space. */ 310 if (!BN_set_bit(k, order_bits) || 311 !BN_set_bit(r, order_bits) || 312 !BN_set_bit(x, order_bits)) 313 goto err; 314 315 /* Step 11: repeat until r != 0. */ 316 do { 317 /* Step 3: generate random k. */ 318 if (!bn_rand_interval(k, BN_value_one(), order)) { 319 ECDSAerror(ECDSA_R_RANDOM_NUMBER_GENERATION_FAILED); 320 goto err; 321 } 322 323 /* 324 * We do not want timing information to leak the length of k, 325 * so we compute G * k using an equivalent scalar of fixed 326 * bit-length. 327 * 328 * We unconditionally perform both of these additions to prevent 329 * a small timing information leakage. We then choose the sum 330 * that is one bit longer than the order. This guarantees the 331 * code path used in the constant time implementations 332 * elsewhere. 333 * 334 * TODO: revisit the bn_copy aiming for a memory access agnostic 335 * conditional copy. 336 */ 337 if (!BN_add(r, k, order) || 338 !BN_add(x, r, order) || 339 !bn_copy(k, BN_num_bits(r) > order_bits ? r : x)) 340 goto err; 341 342 BN_set_flags(k, BN_FLG_CONSTTIME); 343 344 /* Step 5: P = k * G. */ 345 if (!EC_POINT_mul(group, point, k, NULL, NULL, ctx)) { 346 ECerror(ERR_R_EC_LIB); 347 goto err; 348 } 349 /* Steps 6 (and 7): from P = (x, y) retain the x-coordinate. */ 350 if (!EC_POINT_get_affine_coordinates(group, point, x, NULL, 351 ctx)) { 352 ECerror(ERR_R_EC_LIB); 353 goto err; 354 } 355 /* Step 8: r = x (mod order). */ 356 if (!BN_nnmod(r, x, order, ctx)) { 357 ECerror(ERR_R_BN_LIB); 358 goto err; 359 } 360 } while (BN_is_zero(r)); 361 362 /* Step 4: calculate kinv. */ 363 if (BN_mod_inverse_ct(k, k, order, ctx) == NULL) { 364 ECerror(ERR_R_BN_LIB); 365 goto err; 366 } 367 368 *out_kinv = k; 369 k = NULL; 370 371 *out_r = r; 372 r = NULL; 373 374 ret = 1; 375 376 err: 377 BN_CTX_end(ctx); 378 if (ctx != in_ctx) 379 BN_CTX_free(ctx); 380 BN_free(k); 381 BN_free(r); 382 EC_POINT_free(point); 383 384 return ret; 385} 386 387/* 388 * FIPS 186-5, section 6.4.1, step 9: compute s = inv(k)(e + xr) mod order. 389 * In order to reduce the possibility of a side-channel attack, the following 390 * is calculated using a random blinding value b in [1, order): 391 * s = inv(b)(be + bxr)inv(k) mod order. 392 */ 393 394static int 395ecdsa_compute_s(BIGNUM **out_s, const BIGNUM *e, const BIGNUM *kinv, 396 const BIGNUM *r, const EC_KEY *key, BN_CTX *ctx) 397{ 398 const EC_GROUP *group; 399 const BIGNUM *order, *priv_key; 400 BIGNUM *b, *binv, *be, *bxr; 401 BIGNUM *s = NULL; 402 int ret = 0; 403 404 *out_s = NULL; 405 406 BN_CTX_start(ctx); 407 408 if ((group = EC_KEY_get0_group(key)) == NULL) { 409 ECerror(ERR_R_PASSED_NULL_PARAMETER); 410 goto err; 411 } 412 if ((order = EC_GROUP_get0_order(group)) == NULL) { 413 ECerror(ERR_R_EC_LIB); 414 goto err; 415 } 416 if ((priv_key = EC_KEY_get0_private_key(key)) == NULL) { 417 ECerror(ERR_R_PASSED_NULL_PARAMETER); 418 goto err; 419 } 420 421 if ((b = BN_CTX_get(ctx)) == NULL) 422 goto err; 423 if ((binv = BN_CTX_get(ctx)) == NULL) 424 goto err; 425 if ((be = BN_CTX_get(ctx)) == NULL) 426 goto err; 427 if ((bxr = BN_CTX_get(ctx)) == NULL) 428 goto err; 429 430 if ((s = BN_new()) == NULL) 431 goto err; 432 433 /* 434 * In a valid ECDSA signature, r must be in [1, order). Since r can be 435 * caller provided - either directly or by replacing sign_setup() - we 436 * can't rely on this being the case. 437 */ 438 if (BN_cmp(r, BN_value_one()) < 0 || BN_cmp(r, order) >= 0) { 439 ECDSAerror(ECDSA_R_BAD_SIGNATURE); 440 goto err; 441 } 442 443 if (!bn_rand_interval(b, BN_value_one(), order)) { 444 ECerror(ERR_R_BN_LIB); 445 goto err; 446 } 447 448 if (BN_mod_inverse_ct(binv, b, order, ctx) == NULL) { 449 ECerror(ERR_R_BN_LIB); 450 goto err; 451 } 452 453 if (!BN_mod_mul(bxr, b, priv_key, order, ctx)) { 454 ECerror(ERR_R_BN_LIB); 455 goto err; 456 } 457 if (!BN_mod_mul(bxr, bxr, r, order, ctx)) { 458 ECerror(ERR_R_BN_LIB); 459 goto err; 460 } 461 if (!BN_mod_mul(be, b, e, order, ctx)) { 462 ECerror(ERR_R_BN_LIB); 463 goto err; 464 } 465 if (!BN_mod_add(s, be, bxr, order, ctx)) { 466 ECerror(ERR_R_BN_LIB); 467 goto err; 468 } 469 /* s = b(e + xr)k^-1 */ 470 if (!BN_mod_mul(s, s, kinv, order, ctx)) { 471 ECerror(ERR_R_BN_LIB); 472 goto err; 473 } 474 /* s = (e + xr)k^-1 */ 475 if (!BN_mod_mul(s, s, binv, order, ctx)) { 476 ECerror(ERR_R_BN_LIB); 477 goto err; 478 } 479 480 /* Step 11: if s == 0 start over. */ 481 if (!BN_is_zero(s)) { 482 *out_s = s; 483 s = NULL; 484 } 485 486 ret = 1; 487 488 err: 489 BN_CTX_end(ctx); 490 BN_free(s); 491 492 return ret; 493} 494 495/* 496 * It is too expensive to check curve parameters on every sign operation. 497 * Instead, cap the number of retries. A single retry is very unlikely, so 498 * allowing 32 retries is amply enough. 499 */ 500#define ECDSA_MAX_SIGN_ITERATIONS 32 501 502/* 503 * FIPS 186-5: Section 6.4.1: ECDSA signature generation, steps 2-12. 504 * The caller provides the hash of the message, thus performs step 1. 505 * Step 10, zeroing k and kinv, is done by BN_free(). 506 */ 507 508ECDSA_SIG * 509ecdsa_sign_sig(const unsigned char *digest, int digest_len, 510 const BIGNUM *in_kinv, const BIGNUM *in_r, EC_KEY *key) 511{ 512 BN_CTX *ctx = NULL; 513 BIGNUM *kinv = NULL, *r = NULL, *s = NULL; 514 BIGNUM *e; 515 int caller_supplied_values = 0; 516 int attempts = 0; 517 ECDSA_SIG *sig = NULL; 518 519 if ((ctx = BN_CTX_new()) == NULL) { 520 ECerror(ERR_R_MALLOC_FAILURE); 521 goto err; 522 } 523 524 BN_CTX_start(ctx); 525 526 if ((e = BN_CTX_get(ctx)) == NULL) 527 goto err; 528 529 /* Step 2: convert hash into an integer. */ 530 if (!ecdsa_prepare_digest(digest, digest_len, key, e)) 531 goto err; 532 533 if (in_kinv != NULL && in_r != NULL) { 534 /* 535 * Use the caller's kinv and r. Don't call ECDSA_sign_setup(). 536 * If we're unable to compute a valid signature, the caller 537 * must provide new values. 538 */ 539 caller_supplied_values = 1; 540 541 if ((kinv = BN_dup(in_kinv)) == NULL) { 542 ECerror(ERR_R_MALLOC_FAILURE); 543 goto err; 544 } 545 if ((r = BN_dup(in_r)) == NULL) { 546 ECerror(ERR_R_MALLOC_FAILURE); 547 goto err; 548 } 549 } 550 551 do { 552 /* Steps 3-8: calculate kinv and r. */ 553 if (!caller_supplied_values) { 554 if (!ECDSA_sign_setup(key, ctx, &kinv, &r)) { 555 ECDSAerror(ERR_R_ECDSA_LIB); 556 goto err; 557 } 558 } 559 560 /* 561 * Steps 9 and 11: if s is non-NULL, we have a valid signature. 562 */ 563 if (!ecdsa_compute_s(&s, e, kinv, r, key, ctx)) 564 goto err; 565 if (s != NULL) 566 break; 567 568 if (caller_supplied_values) { 569 ECDSAerror(ECDSA_R_NEED_NEW_SETUP_VALUES); 570 goto err; 571 } 572 573 if (++attempts > ECDSA_MAX_SIGN_ITERATIONS) { 574 ECerror(EC_R_WRONG_CURVE_PARAMETERS); 575 goto err; 576 } 577 } while (1); 578 579 /* Step 12: output (r, s). */ 580 if ((sig = ECDSA_SIG_new()) == NULL) { 581 ECerror(ERR_R_MALLOC_FAILURE); 582 goto err; 583 } 584 if (!ECDSA_SIG_set0(sig, r, s)) { 585 ECDSA_SIG_free(sig); 586 goto err; 587 } 588 r = NULL; 589 s = NULL; 590 591 err: 592 BN_CTX_end(ctx); 593 BN_CTX_free(ctx); 594 BN_free(kinv); 595 BN_free(r); 596 BN_free(s); 597 598 return sig; 599} 600 601int 602ecdsa_verify(int type, const unsigned char *digest, int digest_len, 603 const unsigned char *sigbuf, int sig_len, EC_KEY *key) 604{ 605 ECDSA_SIG *s; 606 unsigned char *der = NULL; 607 const unsigned char *p; 608 int der_len = 0; 609 int ret = -1; 610 611 if ((s = ECDSA_SIG_new()) == NULL) 612 goto err; 613 614 p = sigbuf; 615 if (d2i_ECDSA_SIG(&s, &p, sig_len) == NULL) 616 goto err; 617 618 /* Ensure signature uses DER and doesn't have trailing garbage. */ 619 if ((der_len = i2d_ECDSA_SIG(s, &der)) != sig_len) 620 goto err; 621 if (timingsafe_memcmp(sigbuf, der, der_len)) 622 goto err; 623 624 ret = ECDSA_do_verify(digest, digest_len, s, key); 625 626 err: 627 freezero(der, der_len); 628 ECDSA_SIG_free(s); 629 630 return ret; 631} 632 633/* 634 * FIPS 186-5, section 6.4.2: ECDSA signature verification. 635 * The caller provides us with the hash of the message, so has performed step 2. 636 */ 637 638int 639ecdsa_verify_sig(const unsigned char *digest, int digest_len, 640 const ECDSA_SIG *sig, EC_KEY *key) 641{ 642 const EC_GROUP *group; 643 const EC_POINT *pub_key; 644 EC_POINT *point = NULL; 645 const BIGNUM *order; 646 BN_CTX *ctx = NULL; 647 BIGNUM *e, *sinv, *u, *v, *x; 648 int ret = -1; 649 650 if (key == NULL || sig == NULL) { 651 ECDSAerror(ECDSA_R_MISSING_PARAMETERS); 652 goto err; 653 } 654 if ((group = EC_KEY_get0_group(key)) == NULL) { 655 ECDSAerror(ECDSA_R_MISSING_PARAMETERS); 656 goto err; 657 } 658 if ((pub_key = EC_KEY_get0_public_key(key)) == NULL) { 659 ECDSAerror(ECDSA_R_MISSING_PARAMETERS); 660 goto err; 661 } 662 663 if ((ctx = BN_CTX_new()) == NULL) { 664 ECerror(ERR_R_MALLOC_FAILURE); 665 goto err; 666 } 667 668 BN_CTX_start(ctx); 669 670 if ((e = BN_CTX_get(ctx)) == NULL) 671 goto err; 672 if ((sinv = BN_CTX_get(ctx)) == NULL) 673 goto err; 674 if ((u = BN_CTX_get(ctx)) == NULL) 675 goto err; 676 if ((v = BN_CTX_get(ctx)) == NULL) 677 goto err; 678 if ((x = BN_CTX_get(ctx)) == NULL) 679 goto err; 680 681 if ((order = EC_GROUP_get0_order(group)) == NULL) { 682 ECerror(ERR_R_EC_LIB); 683 goto err; 684 } 685 686 /* Step 1: verify that r and s are in the range [1, order). */ 687 if (BN_cmp(sig->r, BN_value_one()) < 0 || BN_cmp(sig->r, order) >= 0) { 688 ECDSAerror(ECDSA_R_BAD_SIGNATURE); 689 ret = 0; 690 goto err; 691 } 692 if (BN_cmp(sig->s, BN_value_one()) < 0 || BN_cmp(sig->s, order) >= 0) { 693 ECDSAerror(ECDSA_R_BAD_SIGNATURE); 694 ret = 0; 695 goto err; 696 } 697 698 /* Step 3: convert the hash into an integer. */ 699 if (!ecdsa_prepare_digest(digest, digest_len, key, e)) 700 goto err; 701 702 /* Step 4: compute the inverse of s modulo order. */ 703 if (BN_mod_inverse_ct(sinv, sig->s, order, ctx) == NULL) { 704 ECerror(ERR_R_BN_LIB); 705 goto err; 706 } 707 /* Step 5: compute u = s^-1 * e and v = s^-1 * r (modulo order). */ 708 if (!BN_mod_mul(u, e, sinv, order, ctx)) { 709 ECerror(ERR_R_BN_LIB); 710 goto err; 711 } 712 if (!BN_mod_mul(v, sig->r, sinv, order, ctx)) { 713 ECerror(ERR_R_BN_LIB); 714 goto err; 715 } 716 717 /* 718 * Steps 6 and 7: compute R = G * u + pub_key * v = (x, y). Reject if 719 * it's the point at infinity - getting affine coordinates fails. Keep 720 * the x coordinate. 721 */ 722 if ((point = EC_POINT_new(group)) == NULL) { 723 ECerror(ERR_R_MALLOC_FAILURE); 724 goto err; 725 } 726 if (!EC_POINT_mul(group, point, u, pub_key, v, ctx)) { 727 ECerror(ERR_R_EC_LIB); 728 goto err; 729 } 730 if (!EC_POINT_get_affine_coordinates(group, point, x, NULL, ctx)) { 731 ECerror(ERR_R_EC_LIB); 732 goto err; 733 } 734 /* Step 8: convert x to a number in [0, order). */ 735 if (!BN_nnmod(x, x, order, ctx)) { 736 ECerror(ERR_R_BN_LIB); 737 goto err; 738 } 739 740 /* Step 9: the signature is valid iff the x-coordinate is equal to r. */ 741 ret = (BN_cmp(x, sig->r) == 0); 742 743 err: 744 BN_CTX_end(ctx); 745 BN_CTX_free(ctx); 746 EC_POINT_free(point); 747 748 return ret; 749} 750 751ECDSA_SIG * 752ECDSA_do_sign(const unsigned char *digest, int digest_len, EC_KEY *key) 753{ 754 return ECDSA_do_sign_ex(digest, digest_len, NULL, NULL, key); 755} 756 757ECDSA_SIG * 758ECDSA_do_sign_ex(const unsigned char *digest, int digest_len, 759 const BIGNUM *kinv, const BIGNUM *out_r, EC_KEY *key) 760{ 761 if (key->meth->sign_sig == NULL) { 762 ECDSAerror(EVP_R_METHOD_NOT_SUPPORTED); 763 return 0; 764 } 765 return key->meth->sign_sig(digest, digest_len, kinv, out_r, key); 766} 767 768int 769ECDSA_sign(int type, const unsigned char *digest, int digest_len, 770 unsigned char *signature, unsigned int *signature_len, EC_KEY *key) 771{ 772 return ECDSA_sign_ex(type, digest, digest_len, signature, signature_len, 773 NULL, NULL, key); 774} 775 776int 777ECDSA_sign_ex(int type, const unsigned char *digest, int digest_len, 778 unsigned char *signature, unsigned int *signature_len, const BIGNUM *kinv, 779 const BIGNUM *r, EC_KEY *key) 780{ 781 if (key->meth->sign == NULL) { 782 ECDSAerror(EVP_R_METHOD_NOT_SUPPORTED); 783 return 0; 784 } 785 return key->meth->sign(type, digest, digest_len, signature, 786 signature_len, kinv, r, key); 787} 788 789int 790ECDSA_sign_setup(EC_KEY *key, BN_CTX *in_ctx, BIGNUM **out_kinv, 791 BIGNUM **out_r) 792{ 793 if (key->meth->sign_setup == NULL) { 794 ECDSAerror(EVP_R_METHOD_NOT_SUPPORTED); 795 return 0; 796 } 797 return key->meth->sign_setup(key, in_ctx, out_kinv, out_r); 798} 799 800int 801ECDSA_do_verify(const unsigned char *digest, int digest_len, 802 const ECDSA_SIG *sig, EC_KEY *key) 803{ 804 if (key->meth->verify_sig == NULL) { 805 ECDSAerror(EVP_R_METHOD_NOT_SUPPORTED); 806 return 0; 807 } 808 return key->meth->verify_sig(digest, digest_len, sig, key); 809} 810 811int 812ECDSA_verify(int type, const unsigned char *digest, int digest_len, 813 const unsigned char *sigbuf, int sig_len, EC_KEY *key) 814{ 815 if (key->meth->verify == NULL) { 816 ECDSAerror(EVP_R_METHOD_NOT_SUPPORTED); 817 return 0; 818 } 819 return key->meth->verify(type, digest, digest_len, sigbuf, sig_len, key); 820} 821