check in v3.8.1 source
This commit is contained in:
1021
crypto/ec/ec_ameth.c
Normal file
1021
crypto/ec/ec_ameth.c
Normal file
File diff suppressed because it is too large
Load Diff
1411
crypto/ec/ec_asn1.c
Normal file
1411
crypto/ec/ec_asn1.c
Normal file
File diff suppressed because it is too large
Load Diff
112
crypto/ec/ec_check.c
Normal file
112
crypto/ec/ec_check.c
Normal file
@@ -0,0 +1,112 @@
|
||||
/* $OpenBSD: ec_check.c,v 1.15 2023/07/07 13:54:45 beck Exp $ */
|
||||
/* ====================================================================
|
||||
* Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in
|
||||
* the documentation and/or other materials provided with the
|
||||
* distribution.
|
||||
*
|
||||
* 3. All advertising materials mentioning features or use of this
|
||||
* software must display the following acknowledgment:
|
||||
* "This product includes software developed by the OpenSSL Project
|
||||
* for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
|
||||
*
|
||||
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
|
||||
* endorse or promote products derived from this software without
|
||||
* prior written permission. For written permission, please contact
|
||||
* openssl-core@openssl.org.
|
||||
*
|
||||
* 5. Products derived from this software may not be called "OpenSSL"
|
||||
* nor may "OpenSSL" appear in their names without prior written
|
||||
* permission of the OpenSSL Project.
|
||||
*
|
||||
* 6. Redistributions of any form whatsoever must retain the following
|
||||
* acknowledgment:
|
||||
* "This product includes software developed by the OpenSSL Project
|
||||
* for use in the OpenSSL Toolkit (http://www.openssl.org/)"
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
|
||||
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
|
||||
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
||||
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
||||
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
||||
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
||||
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
||||
* OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
* ====================================================================
|
||||
*
|
||||
* This product includes cryptographic software written by Eric Young
|
||||
* (eay@cryptsoft.com). This product includes software written by Tim
|
||||
* Hudson (tjh@cryptsoft.com).
|
||||
*
|
||||
*/
|
||||
|
||||
#include "ec_local.h"
|
||||
#include <openssl/err.h>
|
||||
|
||||
int
|
||||
EC_GROUP_check(const EC_GROUP *group, BN_CTX *ctx_in)
|
||||
{
|
||||
BN_CTX *ctx;
|
||||
EC_POINT *point = NULL;
|
||||
const BIGNUM *order;
|
||||
int ret = 0;
|
||||
|
||||
if ((ctx = ctx_in) == NULL)
|
||||
ctx = BN_CTX_new();
|
||||
if (ctx == NULL)
|
||||
goto err;
|
||||
|
||||
/* check the discriminant */
|
||||
if (!EC_GROUP_check_discriminant(group, ctx)) {
|
||||
ECerror(EC_R_DISCRIMINANT_IS_ZERO);
|
||||
goto err;
|
||||
}
|
||||
/* check the generator */
|
||||
if (group->generator == NULL) {
|
||||
ECerror(EC_R_UNDEFINED_GENERATOR);
|
||||
goto err;
|
||||
}
|
||||
if (EC_POINT_is_on_curve(group, group->generator, ctx) <= 0) {
|
||||
ECerror(EC_R_POINT_IS_NOT_ON_CURVE);
|
||||
goto err;
|
||||
}
|
||||
/* check the order of the generator */
|
||||
if ((point = EC_POINT_new(group)) == NULL)
|
||||
goto err;
|
||||
if ((order = EC_GROUP_get0_order(group)) == NULL)
|
||||
goto err;
|
||||
if (BN_is_zero(order)) {
|
||||
ECerror(EC_R_UNDEFINED_ORDER);
|
||||
goto err;
|
||||
}
|
||||
if (!EC_POINT_mul(group, point, order, NULL, NULL, ctx))
|
||||
goto err;
|
||||
if (EC_POINT_is_at_infinity(group, point) <= 0) {
|
||||
ECerror(EC_R_INVALID_GROUP_ORDER);
|
||||
goto err;
|
||||
}
|
||||
|
||||
ret = 1;
|
||||
|
||||
err:
|
||||
if (ctx != ctx_in)
|
||||
BN_CTX_free(ctx);
|
||||
|
||||
EC_POINT_free(point);
|
||||
|
||||
return ret;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_GROUP_check);
|
||||
3193
crypto/ec/ec_curve.c
Normal file
3193
crypto/ec/ec_curve.c
Normal file
File diff suppressed because it is too large
Load Diff
103
crypto/ec/ec_cvt.c
Normal file
103
crypto/ec/ec_cvt.c
Normal file
@@ -0,0 +1,103 @@
|
||||
/* $OpenBSD: ec_cvt.c,v 1.12 2023/07/07 13:54:45 beck Exp $ */
|
||||
/*
|
||||
* Originally written by Bodo Moeller for the OpenSSL project.
|
||||
*/
|
||||
/* ====================================================================
|
||||
* Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in
|
||||
* the documentation and/or other materials provided with the
|
||||
* distribution.
|
||||
*
|
||||
* 3. All advertising materials mentioning features or use of this
|
||||
* software must display the following acknowledgment:
|
||||
* "This product includes software developed by the OpenSSL Project
|
||||
* for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
|
||||
*
|
||||
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
|
||||
* endorse or promote products derived from this software without
|
||||
* prior written permission. For written permission, please contact
|
||||
* openssl-core@openssl.org.
|
||||
*
|
||||
* 5. Products derived from this software may not be called "OpenSSL"
|
||||
* nor may "OpenSSL" appear in their names without prior written
|
||||
* permission of the OpenSSL Project.
|
||||
*
|
||||
* 6. Redistributions of any form whatsoever must retain the following
|
||||
* acknowledgment:
|
||||
* "This product includes software developed by the OpenSSL Project
|
||||
* for use in the OpenSSL Toolkit (http://www.openssl.org/)"
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
|
||||
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
|
||||
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
||||
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
||||
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
||||
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
||||
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
||||
* OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
* ====================================================================
|
||||
*
|
||||
* This product includes cryptographic software written by Eric Young
|
||||
* (eay@cryptsoft.com). This product includes software written by Tim
|
||||
* Hudson (tjh@cryptsoft.com).
|
||||
*
|
||||
*/
|
||||
/* ====================================================================
|
||||
* Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
|
||||
*
|
||||
* Portions of the attached software ("Contribution") are developed by
|
||||
* SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
|
||||
*
|
||||
* The Contribution is licensed pursuant to the OpenSSL open source
|
||||
* license provided above.
|
||||
*
|
||||
* The elliptic curve binary polynomial software is originally written by
|
||||
* Sheueling Chang Shantz and Douglas Stebila of Sun Microsystems Laboratories.
|
||||
*
|
||||
*/
|
||||
|
||||
#include <openssl/opensslconf.h>
|
||||
|
||||
#include <openssl/err.h>
|
||||
#include "ec_local.h"
|
||||
|
||||
static EC_GROUP *
|
||||
ec_group_new_curve(const EC_METHOD *method, const BIGNUM *p, const BIGNUM *a,
|
||||
const BIGNUM *b, BN_CTX *ctx)
|
||||
{
|
||||
EC_GROUP *group;
|
||||
|
||||
if ((group = EC_GROUP_new(method)) == NULL)
|
||||
goto err;
|
||||
|
||||
if (!EC_GROUP_set_curve(group, p, a, b, ctx))
|
||||
goto err;
|
||||
|
||||
return group;
|
||||
|
||||
err:
|
||||
EC_GROUP_free(group);
|
||||
|
||||
return NULL;
|
||||
}
|
||||
|
||||
EC_GROUP *
|
||||
EC_GROUP_new_curve_GFp(const BIGNUM *p, const BIGNUM *a, const BIGNUM *b,
|
||||
BN_CTX *ctx)
|
||||
{
|
||||
return ec_group_new_curve(EC_GFp_mont_method(), p, a, b, ctx);
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_GROUP_new_curve_GFp);
|
||||
151
crypto/ec/ec_err.c
Normal file
151
crypto/ec/ec_err.c
Normal file
@@ -0,0 +1,151 @@
|
||||
/* $OpenBSD: ec_err.c,v 1.18 2023/07/28 09:28:37 tb Exp $ */
|
||||
/* ====================================================================
|
||||
* Copyright (c) 1999-2011 The OpenSSL Project. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in
|
||||
* the documentation and/or other materials provided with the
|
||||
* distribution.
|
||||
*
|
||||
* 3. All advertising materials mentioning features or use of this
|
||||
* software must display the following acknowledgment:
|
||||
* "This product includes software developed by the OpenSSL Project
|
||||
* for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
|
||||
*
|
||||
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
|
||||
* endorse or promote products derived from this software without
|
||||
* prior written permission. For written permission, please contact
|
||||
* openssl-core@OpenSSL.org.
|
||||
*
|
||||
* 5. Products derived from this software may not be called "OpenSSL"
|
||||
* nor may "OpenSSL" appear in their names without prior written
|
||||
* permission of the OpenSSL Project.
|
||||
*
|
||||
* 6. Redistributions of any form whatsoever must retain the following
|
||||
* acknowledgment:
|
||||
* "This product includes software developed by the OpenSSL Project
|
||||
* for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
|
||||
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
|
||||
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
||||
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
||||
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
||||
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
||||
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
||||
* OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
* ====================================================================
|
||||
*
|
||||
* This product includes cryptographic software written by Eric Young
|
||||
* (eay@cryptsoft.com). This product includes software written by Tim
|
||||
* Hudson (tjh@cryptsoft.com).
|
||||
*
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
|
||||
#include <openssl/opensslconf.h>
|
||||
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/ec.h>
|
||||
|
||||
#ifndef OPENSSL_NO_ERR
|
||||
|
||||
#define ERR_FUNC(func) ERR_PACK(ERR_LIB_EC,func,0)
|
||||
#define ERR_REASON(reason) ERR_PACK(ERR_LIB_EC,0,reason)
|
||||
|
||||
static ERR_STRING_DATA EC_str_functs[] = {
|
||||
{ERR_FUNC(0xfff), "CRYPTO_internal"},
|
||||
{0, NULL}
|
||||
};
|
||||
|
||||
static ERR_STRING_DATA EC_str_reasons[] =
|
||||
{
|
||||
{ERR_REASON(EC_R_ASN1_ERROR), "asn1 error"},
|
||||
{ERR_REASON(EC_R_ASN1_UNKNOWN_FIELD), "asn1 unknown field"},
|
||||
{ERR_REASON(EC_R_BAD_SIGNATURE), "bad signature"},
|
||||
{ERR_REASON(EC_R_BIGNUM_OUT_OF_RANGE), "bignum out of range"},
|
||||
{ERR_REASON(EC_R_BUFFER_TOO_SMALL), "buffer too small"},
|
||||
{ERR_REASON(EC_R_COORDINATES_OUT_OF_RANGE), "coordinates out of range"},
|
||||
{ERR_REASON(EC_R_D2I_ECPKPARAMETERS_FAILURE), "d2i ecpkparameters failure"},
|
||||
{ERR_REASON(EC_R_DECODE_ERROR), "decode error"},
|
||||
{ERR_REASON(EC_R_DISCRIMINANT_IS_ZERO), "discriminant is zero"},
|
||||
{ERR_REASON(EC_R_EC_GROUP_NEW_BY_NAME_FAILURE), "ec group new by name failure"},
|
||||
{ERR_REASON(EC_R_FIELD_TOO_LARGE), "field too large"},
|
||||
{ERR_REASON(EC_R_GF2M_NOT_SUPPORTED), "gf2m not supported"},
|
||||
{ERR_REASON(EC_R_GROUP2PKPARAMETERS_FAILURE), "group2pkparameters failure"},
|
||||
{ERR_REASON(EC_R_I2D_ECPKPARAMETERS_FAILURE), "i2d ecpkparameters failure"},
|
||||
{ERR_REASON(EC_R_INCOMPATIBLE_OBJECTS), "incompatible objects"},
|
||||
{ERR_REASON(EC_R_INVALID_ARGUMENT), "invalid argument"},
|
||||
{ERR_REASON(EC_R_INVALID_COMPRESSED_POINT), "invalid compressed point"},
|
||||
{ERR_REASON(EC_R_INVALID_COMPRESSION_BIT), "invalid compression bit"},
|
||||
{ERR_REASON(EC_R_INVALID_CURVE), "invalid curve"},
|
||||
{ERR_REASON(EC_R_INVALID_DIGEST), "invalid digest"},
|
||||
{ERR_REASON(EC_R_INVALID_DIGEST_TYPE), "invalid digest type"},
|
||||
{ERR_REASON(EC_R_INVALID_ENCODING), "invalid encoding"},
|
||||
{ERR_REASON(EC_R_INVALID_FIELD), "invalid field"},
|
||||
{ERR_REASON(EC_R_INVALID_FORM), "invalid form"},
|
||||
{ERR_REASON(EC_R_INVALID_GROUP_ORDER), "invalid group order"},
|
||||
{ERR_REASON(EC_R_INVALID_KEY), "invalid key"},
|
||||
{ERR_REASON(EC_R_INVALID_OUTPUT_LENGTH), "invalid output length"},
|
||||
{ERR_REASON(EC_R_INVALID_PEER_KEY), "invalid peer key"},
|
||||
{ERR_REASON(EC_R_INVALID_PENTANOMIAL_BASIS), "invalid pentanomial basis"},
|
||||
{ERR_REASON(EC_R_INVALID_PRIVATE_KEY), "invalid private key"},
|
||||
{ERR_REASON(EC_R_INVALID_TRINOMIAL_BASIS), "invalid trinomial basis"},
|
||||
{ERR_REASON(EC_R_KDF_FAILED), "kdf failed"},
|
||||
{ERR_REASON(EC_R_KDF_PARAMETER_ERROR), "kdf parameter error"},
|
||||
{ERR_REASON(EC_R_KEY_TRUNCATION), "key would be truncated"},
|
||||
{ERR_REASON(EC_R_KEYS_NOT_SET), "keys not set"},
|
||||
{ERR_REASON(EC_R_MISSING_PARAMETERS), "missing parameters"},
|
||||
{ERR_REASON(EC_R_MISSING_PRIVATE_KEY), "missing private key"},
|
||||
{ERR_REASON(EC_R_NEED_NEW_SETUP_VALUES), "need new setup values"},
|
||||
{ERR_REASON(EC_R_NOT_A_NIST_PRIME), "not a NIST prime"},
|
||||
{ERR_REASON(EC_R_NOT_A_SUPPORTED_NIST_PRIME), "not a supported NIST prime"},
|
||||
{ERR_REASON(EC_R_NOT_IMPLEMENTED), "not implemented"},
|
||||
{ERR_REASON(EC_R_NOT_INITIALIZED), "not initialized"},
|
||||
{ERR_REASON(EC_R_NO_FIELD_MOD), "no field mod"},
|
||||
{ERR_REASON(EC_R_NO_PARAMETERS_SET), "no parameters set"},
|
||||
{ERR_REASON(EC_R_PASSED_NULL_PARAMETER), "passed null parameter"},
|
||||
{ERR_REASON(EC_R_PEER_KEY_ERROR), "peer key error"},
|
||||
{ERR_REASON(EC_R_PKPARAMETERS2GROUP_FAILURE), "pkparameters2group failure"},
|
||||
{ERR_REASON(EC_R_POINT_ARITHMETIC_FAILURE), "point arithmetic failure"},
|
||||
{ERR_REASON(EC_R_POINT_AT_INFINITY), "point at infinity"},
|
||||
{ERR_REASON(EC_R_POINT_IS_NOT_ON_CURVE), "point is not on curve"},
|
||||
{ERR_REASON(EC_R_SHARED_INFO_ERROR), "shared info error"},
|
||||
{ERR_REASON(EC_R_SLOT_FULL), "slot full"},
|
||||
{ERR_REASON(EC_R_UNDEFINED_GENERATOR), "undefined generator"},
|
||||
{ERR_REASON(EC_R_UNDEFINED_ORDER), "undefined order"},
|
||||
{ERR_REASON(EC_R_UNKNOWN_COFACTOR), "unknown cofactor"},
|
||||
{ERR_REASON(EC_R_UNKNOWN_GROUP), "unknown group"},
|
||||
{ERR_REASON(EC_R_UNKNOWN_ORDER), "unknown order"},
|
||||
{ERR_REASON(EC_R_UNSUPPORTED_FIELD), "unsupported field"},
|
||||
{ERR_REASON(EC_R_WRONG_CURVE_PARAMETERS), "wrong curve parameters"},
|
||||
{ERR_REASON(EC_R_WRONG_ORDER), "wrong order"},
|
||||
{0, NULL}
|
||||
};
|
||||
|
||||
#endif
|
||||
|
||||
void
|
||||
ERR_load_EC_strings(void)
|
||||
{
|
||||
#ifndef OPENSSL_NO_ERR
|
||||
|
||||
if (ERR_func_error_string(EC_str_functs[0].error) == NULL) {
|
||||
ERR_load_strings(0, EC_str_functs);
|
||||
ERR_load_strings(0, EC_str_reasons);
|
||||
}
|
||||
#endif
|
||||
}
|
||||
LCRYPTO_ALIAS(ERR_load_EC_strings);
|
||||
553
crypto/ec/ec_key.c
Normal file
553
crypto/ec/ec_key.c
Normal file
@@ -0,0 +1,553 @@
|
||||
/* $OpenBSD: ec_key.c,v 1.37 2023/08/03 18:53:56 tb Exp $ */
|
||||
/*
|
||||
* Written by Nils Larsch for the OpenSSL project.
|
||||
*/
|
||||
/* ====================================================================
|
||||
* Copyright (c) 1998-2005 The OpenSSL Project. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in
|
||||
* the documentation and/or other materials provided with the
|
||||
* distribution.
|
||||
*
|
||||
* 3. All advertising materials mentioning features or use of this
|
||||
* software must display the following acknowledgment:
|
||||
* "This product includes software developed by the OpenSSL Project
|
||||
* for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
|
||||
*
|
||||
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
|
||||
* endorse or promote products derived from this software without
|
||||
* prior written permission. For written permission, please contact
|
||||
* openssl-core@openssl.org.
|
||||
*
|
||||
* 5. Products derived from this software may not be called "OpenSSL"
|
||||
* nor may "OpenSSL" appear in their names without prior written
|
||||
* permission of the OpenSSL Project.
|
||||
*
|
||||
* 6. Redistributions of any form whatsoever must retain the following
|
||||
* acknowledgment:
|
||||
* "This product includes software developed by the OpenSSL Project
|
||||
* for use in the OpenSSL Toolkit (http://www.openssl.org/)"
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
|
||||
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
|
||||
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
||||
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
||||
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
||||
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
||||
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
||||
* OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
* ====================================================================
|
||||
*
|
||||
* This product includes cryptographic software written by Eric Young
|
||||
* (eay@cryptsoft.com). This product includes software written by Tim
|
||||
* Hudson (tjh@cryptsoft.com).
|
||||
*
|
||||
*/
|
||||
/* ====================================================================
|
||||
* Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
|
||||
* Portions originally developed by SUN MICROSYSTEMS, INC., and
|
||||
* contributed to the OpenSSL project.
|
||||
*/
|
||||
|
||||
#include <string.h>
|
||||
|
||||
#include <openssl/opensslconf.h>
|
||||
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
#include <openssl/engine.h>
|
||||
#endif
|
||||
#include <openssl/err.h>
|
||||
|
||||
#include "bn_local.h"
|
||||
#include "ec_local.h"
|
||||
|
||||
EC_KEY *
|
||||
EC_KEY_new(void)
|
||||
{
|
||||
return EC_KEY_new_method(NULL);
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_new);
|
||||
|
||||
EC_KEY *
|
||||
EC_KEY_new_by_curve_name(int nid)
|
||||
{
|
||||
EC_KEY *ret = EC_KEY_new();
|
||||
if (ret == NULL)
|
||||
return NULL;
|
||||
ret->group = EC_GROUP_new_by_curve_name(nid);
|
||||
if (ret->group == NULL) {
|
||||
EC_KEY_free(ret);
|
||||
return NULL;
|
||||
}
|
||||
if (ret->meth->set_group != NULL &&
|
||||
ret->meth->set_group(ret, ret->group) == 0) {
|
||||
EC_KEY_free(ret);
|
||||
return NULL;
|
||||
}
|
||||
return ret;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_new_by_curve_name);
|
||||
|
||||
void
|
||||
EC_KEY_free(EC_KEY *r)
|
||||
{
|
||||
int i;
|
||||
|
||||
if (r == NULL)
|
||||
return;
|
||||
|
||||
i = CRYPTO_add(&r->references, -1, CRYPTO_LOCK_EC);
|
||||
if (i > 0)
|
||||
return;
|
||||
|
||||
if (r->meth != NULL && r->meth->finish != NULL)
|
||||
r->meth->finish(r);
|
||||
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
ENGINE_finish(r->engine);
|
||||
#endif
|
||||
CRYPTO_free_ex_data(CRYPTO_EX_INDEX_EC_KEY, r, &r->ex_data);
|
||||
|
||||
EC_GROUP_free(r->group);
|
||||
EC_POINT_free(r->pub_key);
|
||||
BN_free(r->priv_key);
|
||||
|
||||
freezero(r, sizeof(EC_KEY));
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_free);
|
||||
|
||||
EC_KEY *
|
||||
EC_KEY_copy(EC_KEY *dest, const EC_KEY *src)
|
||||
{
|
||||
if (dest == NULL || src == NULL) {
|
||||
ECerror(ERR_R_PASSED_NULL_PARAMETER);
|
||||
return NULL;
|
||||
}
|
||||
if (src->meth != dest->meth) {
|
||||
if (dest->meth != NULL && dest->meth->finish != NULL)
|
||||
dest->meth->finish(dest);
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
if (ENGINE_finish(dest->engine) == 0)
|
||||
return 0;
|
||||
dest->engine = NULL;
|
||||
#endif
|
||||
}
|
||||
/* copy the parameters */
|
||||
if (src->group) {
|
||||
const EC_METHOD *meth = EC_GROUP_method_of(src->group);
|
||||
/* clear the old group */
|
||||
EC_GROUP_free(dest->group);
|
||||
dest->group = EC_GROUP_new(meth);
|
||||
if (dest->group == NULL)
|
||||
return NULL;
|
||||
if (!EC_GROUP_copy(dest->group, src->group))
|
||||
return NULL;
|
||||
}
|
||||
/* copy the public key */
|
||||
if (src->pub_key && src->group) {
|
||||
EC_POINT_free(dest->pub_key);
|
||||
dest->pub_key = EC_POINT_new(src->group);
|
||||
if (dest->pub_key == NULL)
|
||||
return NULL;
|
||||
if (!EC_POINT_copy(dest->pub_key, src->pub_key))
|
||||
return NULL;
|
||||
}
|
||||
/* copy the private key */
|
||||
if (src->priv_key) {
|
||||
if (dest->priv_key == NULL) {
|
||||
dest->priv_key = BN_new();
|
||||
if (dest->priv_key == NULL)
|
||||
return NULL;
|
||||
}
|
||||
if (!bn_copy(dest->priv_key, src->priv_key))
|
||||
return NULL;
|
||||
}
|
||||
|
||||
/* copy the rest */
|
||||
dest->enc_flag = src->enc_flag;
|
||||
dest->conv_form = src->conv_form;
|
||||
dest->version = src->version;
|
||||
dest->flags = src->flags;
|
||||
|
||||
if (!CRYPTO_dup_ex_data(CRYPTO_EX_INDEX_EC_KEY, &dest->ex_data,
|
||||
&((EC_KEY *)src)->ex_data)) /* XXX const */
|
||||
return NULL;
|
||||
|
||||
if (src->meth != dest->meth) {
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
if (src->engine != NULL && ENGINE_init(src->engine) == 0)
|
||||
return 0;
|
||||
dest->engine = src->engine;
|
||||
#endif
|
||||
dest->meth = src->meth;
|
||||
}
|
||||
|
||||
if (src->meth != NULL && src->meth->copy != NULL &&
|
||||
src->meth->copy(dest, src) == 0)
|
||||
return 0;
|
||||
|
||||
return dest;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_copy);
|
||||
|
||||
EC_KEY *
|
||||
EC_KEY_dup(const EC_KEY *ec_key)
|
||||
{
|
||||
EC_KEY *ret;
|
||||
|
||||
if ((ret = EC_KEY_new_method(ec_key->engine)) == NULL)
|
||||
return NULL;
|
||||
if (EC_KEY_copy(ret, ec_key) == NULL) {
|
||||
EC_KEY_free(ret);
|
||||
return NULL;
|
||||
}
|
||||
return ret;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_dup);
|
||||
|
||||
int
|
||||
EC_KEY_up_ref(EC_KEY *r)
|
||||
{
|
||||
int i = CRYPTO_add(&r->references, 1, CRYPTO_LOCK_EC);
|
||||
return ((i > 1) ? 1 : 0);
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_up_ref);
|
||||
|
||||
int
|
||||
EC_KEY_set_ex_data(EC_KEY *r, int idx, void *arg)
|
||||
{
|
||||
return CRYPTO_set_ex_data(&r->ex_data, idx, arg);
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_set_ex_data);
|
||||
|
||||
void *
|
||||
EC_KEY_get_ex_data(const EC_KEY *r, int idx)
|
||||
{
|
||||
return CRYPTO_get_ex_data(&r->ex_data, idx);
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_get_ex_data);
|
||||
|
||||
int
|
||||
EC_KEY_generate_key(EC_KEY *eckey)
|
||||
{
|
||||
if (eckey->meth->keygen != NULL)
|
||||
return eckey->meth->keygen(eckey);
|
||||
ECerror(EC_R_NOT_IMPLEMENTED);
|
||||
return 0;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_generate_key);
|
||||
|
||||
int
|
||||
ec_key_gen(EC_KEY *eckey)
|
||||
{
|
||||
BIGNUM *priv_key = NULL;
|
||||
EC_POINT *pub_key = NULL;
|
||||
const BIGNUM *order;
|
||||
int ret = 0;
|
||||
|
||||
if (eckey == NULL || eckey->group == NULL) {
|
||||
ECerror(ERR_R_PASSED_NULL_PARAMETER);
|
||||
goto err;
|
||||
}
|
||||
|
||||
if ((priv_key = BN_new()) == NULL)
|
||||
goto err;
|
||||
if ((pub_key = EC_POINT_new(eckey->group)) == NULL)
|
||||
goto err;
|
||||
|
||||
if ((order = EC_GROUP_get0_order(eckey->group)) == NULL)
|
||||
goto err;
|
||||
if (!bn_rand_interval(priv_key, 1, order))
|
||||
goto err;
|
||||
if (!EC_POINT_mul(eckey->group, pub_key, priv_key, NULL, NULL, NULL))
|
||||
goto err;
|
||||
|
||||
BN_free(eckey->priv_key);
|
||||
eckey->priv_key = priv_key;
|
||||
priv_key = NULL;
|
||||
|
||||
EC_POINT_free(eckey->pub_key);
|
||||
eckey->pub_key = pub_key;
|
||||
pub_key = NULL;
|
||||
|
||||
ret = 1;
|
||||
|
||||
err:
|
||||
EC_POINT_free(pub_key);
|
||||
BN_free(priv_key);
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
int
|
||||
EC_KEY_check_key(const EC_KEY *eckey)
|
||||
{
|
||||
BN_CTX *ctx = NULL;
|
||||
EC_POINT *point = NULL;
|
||||
const BIGNUM *order;
|
||||
int ret = 0;
|
||||
|
||||
if (eckey == NULL || eckey->group == NULL || eckey->pub_key == NULL) {
|
||||
ECerror(ERR_R_PASSED_NULL_PARAMETER);
|
||||
goto err;
|
||||
}
|
||||
|
||||
if (EC_POINT_is_at_infinity(eckey->group, eckey->pub_key) > 0) {
|
||||
ECerror(EC_R_POINT_AT_INFINITY);
|
||||
goto err;
|
||||
}
|
||||
|
||||
if ((ctx = BN_CTX_new()) == NULL)
|
||||
goto err;
|
||||
|
||||
if ((point = EC_POINT_new(eckey->group)) == NULL)
|
||||
goto err;
|
||||
|
||||
/* Ensure public key is on the elliptic curve. */
|
||||
if (EC_POINT_is_on_curve(eckey->group, eckey->pub_key, ctx) <= 0) {
|
||||
ECerror(EC_R_POINT_IS_NOT_ON_CURVE);
|
||||
goto err;
|
||||
}
|
||||
|
||||
/* Ensure public key multiplied by the order is the point at infinity. */
|
||||
if ((order = EC_GROUP_get0_order(eckey->group)) == NULL) {
|
||||
ECerror(EC_R_INVALID_GROUP_ORDER);
|
||||
goto err;
|
||||
}
|
||||
if (!EC_POINT_mul(eckey->group, point, NULL, eckey->pub_key, order, ctx)) {
|
||||
ECerror(ERR_R_EC_LIB);
|
||||
goto err;
|
||||
}
|
||||
if (EC_POINT_is_at_infinity(eckey->group, point) <= 0) {
|
||||
ECerror(EC_R_WRONG_ORDER);
|
||||
goto err;
|
||||
}
|
||||
|
||||
/*
|
||||
* If the private key is present, ensure that the private key multiplied
|
||||
* by the generator matches the public key.
|
||||
*/
|
||||
if (eckey->priv_key != NULL) {
|
||||
if (BN_cmp(eckey->priv_key, order) >= 0) {
|
||||
ECerror(EC_R_WRONG_ORDER);
|
||||
goto err;
|
||||
}
|
||||
if (!EC_POINT_mul(eckey->group, point, eckey->priv_key, NULL,
|
||||
NULL, ctx)) {
|
||||
ECerror(ERR_R_EC_LIB);
|
||||
goto err;
|
||||
}
|
||||
if (EC_POINT_cmp(eckey->group, point, eckey->pub_key,
|
||||
ctx) != 0) {
|
||||
ECerror(EC_R_INVALID_PRIVATE_KEY);
|
||||
goto err;
|
||||
}
|
||||
}
|
||||
|
||||
ret = 1;
|
||||
|
||||
err:
|
||||
BN_CTX_free(ctx);
|
||||
EC_POINT_free(point);
|
||||
|
||||
return ret;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_check_key);
|
||||
|
||||
int
|
||||
EC_KEY_set_public_key_affine_coordinates(EC_KEY *key, BIGNUM *x, BIGNUM *y)
|
||||
{
|
||||
BN_CTX *ctx = NULL;
|
||||
EC_POINT *point = NULL;
|
||||
BIGNUM *tx, *ty;
|
||||
int ret = 0;
|
||||
|
||||
if (key == NULL || key->group == NULL || x == NULL || y == NULL) {
|
||||
ECerror(ERR_R_PASSED_NULL_PARAMETER);
|
||||
goto err;
|
||||
}
|
||||
|
||||
if ((ctx = BN_CTX_new()) == NULL)
|
||||
goto err;
|
||||
|
||||
BN_CTX_start(ctx);
|
||||
|
||||
if ((tx = BN_CTX_get(ctx)) == NULL)
|
||||
goto err;
|
||||
if ((ty = BN_CTX_get(ctx)) == NULL)
|
||||
goto err;
|
||||
|
||||
if ((point = EC_POINT_new(key->group)) == NULL)
|
||||
goto err;
|
||||
|
||||
if (!EC_POINT_set_affine_coordinates(key->group, point, x, y, ctx))
|
||||
goto err;
|
||||
if (!EC_POINT_get_affine_coordinates(key->group, point, tx, ty, ctx))
|
||||
goto err;
|
||||
|
||||
/*
|
||||
* Check if retrieved coordinates match originals: if not values are
|
||||
* out of range.
|
||||
*/
|
||||
if (BN_cmp(x, tx) != 0 || BN_cmp(y, ty) != 0) {
|
||||
ECerror(EC_R_COORDINATES_OUT_OF_RANGE);
|
||||
goto err;
|
||||
}
|
||||
if (!EC_KEY_set_public_key(key, point))
|
||||
goto err;
|
||||
if (EC_KEY_check_key(key) == 0)
|
||||
goto err;
|
||||
|
||||
ret = 1;
|
||||
|
||||
err:
|
||||
BN_CTX_end(ctx);
|
||||
BN_CTX_free(ctx);
|
||||
EC_POINT_free(point);
|
||||
|
||||
return ret;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_set_public_key_affine_coordinates);
|
||||
|
||||
const EC_GROUP *
|
||||
EC_KEY_get0_group(const EC_KEY *key)
|
||||
{
|
||||
return key->group;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_get0_group);
|
||||
|
||||
int
|
||||
EC_KEY_set_group(EC_KEY *key, const EC_GROUP *group)
|
||||
{
|
||||
if (key->meth->set_group != NULL &&
|
||||
key->meth->set_group(key, group) == 0)
|
||||
return 0;
|
||||
EC_GROUP_free(key->group);
|
||||
key->group = EC_GROUP_dup(group);
|
||||
return (key->group == NULL) ? 0 : 1;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_set_group);
|
||||
|
||||
const BIGNUM *
|
||||
EC_KEY_get0_private_key(const EC_KEY *key)
|
||||
{
|
||||
return key->priv_key;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_get0_private_key);
|
||||
|
||||
int
|
||||
EC_KEY_set_private_key(EC_KEY *key, const BIGNUM *priv_key)
|
||||
{
|
||||
if (key->meth->set_private != NULL &&
|
||||
key->meth->set_private(key, priv_key) == 0)
|
||||
return 0;
|
||||
|
||||
BN_free(key->priv_key);
|
||||
if ((key->priv_key = BN_dup(priv_key)) == NULL)
|
||||
return 0;
|
||||
|
||||
return 1;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_set_private_key);
|
||||
|
||||
const EC_POINT *
|
||||
EC_KEY_get0_public_key(const EC_KEY *key)
|
||||
{
|
||||
return key->pub_key;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_get0_public_key);
|
||||
|
||||
int
|
||||
EC_KEY_set_public_key(EC_KEY *key, const EC_POINT *pub_key)
|
||||
{
|
||||
if (key->meth->set_public != NULL &&
|
||||
key->meth->set_public(key, pub_key) == 0)
|
||||
return 0;
|
||||
|
||||
EC_POINT_free(key->pub_key);
|
||||
if ((key->pub_key = EC_POINT_dup(pub_key, key->group)) == NULL)
|
||||
return 0;
|
||||
|
||||
return 1;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_set_public_key);
|
||||
|
||||
unsigned int
|
||||
EC_KEY_get_enc_flags(const EC_KEY *key)
|
||||
{
|
||||
return key->enc_flag;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_get_enc_flags);
|
||||
|
||||
void
|
||||
EC_KEY_set_enc_flags(EC_KEY *key, unsigned int flags)
|
||||
{
|
||||
key->enc_flag = flags;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_set_enc_flags);
|
||||
|
||||
point_conversion_form_t
|
||||
EC_KEY_get_conv_form(const EC_KEY *key)
|
||||
{
|
||||
return key->conv_form;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_get_conv_form);
|
||||
|
||||
void
|
||||
EC_KEY_set_conv_form(EC_KEY *key, point_conversion_form_t cform)
|
||||
{
|
||||
key->conv_form = cform;
|
||||
if (key->group != NULL)
|
||||
EC_GROUP_set_point_conversion_form(key->group, cform);
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_set_conv_form);
|
||||
|
||||
void
|
||||
EC_KEY_set_asn1_flag(EC_KEY *key, int flag)
|
||||
{
|
||||
if (key->group != NULL)
|
||||
EC_GROUP_set_asn1_flag(key->group, flag);
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_set_asn1_flag);
|
||||
|
||||
int
|
||||
EC_KEY_precompute_mult(EC_KEY *key, BN_CTX *ctx)
|
||||
{
|
||||
if (key->group == NULL)
|
||||
return 0;
|
||||
return EC_GROUP_precompute_mult(key->group, ctx);
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_precompute_mult);
|
||||
|
||||
int
|
||||
EC_KEY_get_flags(const EC_KEY *key)
|
||||
{
|
||||
return key->flags;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_get_flags);
|
||||
|
||||
void
|
||||
EC_KEY_set_flags(EC_KEY *key, int flags)
|
||||
{
|
||||
key->flags |= flags;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_set_flags);
|
||||
|
||||
void
|
||||
EC_KEY_clear_flags(EC_KEY *key, int flags)
|
||||
{
|
||||
key->flags &= ~flags;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_clear_flags);
|
||||
353
crypto/ec/ec_kmeth.c
Normal file
353
crypto/ec/ec_kmeth.c
Normal file
@@ -0,0 +1,353 @@
|
||||
/* $OpenBSD: ec_kmeth.c,v 1.12 2023/07/28 09:28:37 tb Exp $ */
|
||||
/*
|
||||
* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
|
||||
* project.
|
||||
*/
|
||||
/* ====================================================================
|
||||
* Copyright (c) 2015 The OpenSSL Project. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in
|
||||
* the documentation and/or other materials provided with the
|
||||
* distribution.
|
||||
*
|
||||
* 3. All advertising materials mentioning features or use of this
|
||||
* software must display the following acknowledgment:
|
||||
* "This product includes software developed by the OpenSSL Project
|
||||
* for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
|
||||
*
|
||||
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
|
||||
* endorse or promote products derived from this software without
|
||||
* prior written permission. For written permission, please contact
|
||||
* licensing@OpenSSL.org.
|
||||
*
|
||||
* 5. Products derived from this software may not be called "OpenSSL"
|
||||
* nor may "OpenSSL" appear in their names without prior written
|
||||
* permission of the OpenSSL Project.
|
||||
*
|
||||
* 6. Redistributions of any form whatsoever must retain the following
|
||||
* acknowledgment:
|
||||
* "This product includes software developed by the OpenSSL Project
|
||||
* for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
|
||||
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
|
||||
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
||||
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
||||
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
||||
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
||||
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
||||
* OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
* ====================================================================
|
||||
*/
|
||||
|
||||
#include <openssl/ec.h>
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
#include <openssl/engine.h>
|
||||
#endif
|
||||
#include <openssl/err.h>
|
||||
|
||||
#include "bn_local.h"
|
||||
#include "ec_local.h"
|
||||
#include "ecdsa_local.h"
|
||||
|
||||
static const EC_KEY_METHOD openssl_ec_key_method = {
|
||||
.name = "OpenSSL EC_KEY method",
|
||||
.flags = 0,
|
||||
|
||||
.init = NULL,
|
||||
.finish = NULL,
|
||||
.copy = NULL,
|
||||
|
||||
.set_group = NULL,
|
||||
.set_private = NULL,
|
||||
.set_public = NULL,
|
||||
|
||||
.keygen = ec_key_gen,
|
||||
.compute_key = ecdh_compute_key,
|
||||
|
||||
.sign = ecdsa_sign,
|
||||
.sign_setup = ecdsa_sign_setup,
|
||||
.sign_sig = ecdsa_sign_sig,
|
||||
|
||||
.verify = ecdsa_verify,
|
||||
.verify_sig = ecdsa_verify_sig,
|
||||
};
|
||||
|
||||
const EC_KEY_METHOD *default_ec_key_meth = &openssl_ec_key_method;
|
||||
|
||||
const EC_KEY_METHOD *
|
||||
EC_KEY_OpenSSL(void)
|
||||
{
|
||||
return &openssl_ec_key_method;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_OpenSSL);
|
||||
|
||||
const EC_KEY_METHOD *
|
||||
EC_KEY_get_default_method(void)
|
||||
{
|
||||
return default_ec_key_meth;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_get_default_method);
|
||||
|
||||
void
|
||||
EC_KEY_set_default_method(const EC_KEY_METHOD *meth)
|
||||
{
|
||||
if (meth == NULL)
|
||||
default_ec_key_meth = &openssl_ec_key_method;
|
||||
else
|
||||
default_ec_key_meth = meth;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_set_default_method);
|
||||
|
||||
const EC_KEY_METHOD *
|
||||
EC_KEY_get_method(const EC_KEY *key)
|
||||
{
|
||||
return key->meth;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_get_method);
|
||||
|
||||
int
|
||||
EC_KEY_set_method(EC_KEY *key, const EC_KEY_METHOD *meth)
|
||||
{
|
||||
void (*finish)(EC_KEY *key) = key->meth->finish;
|
||||
|
||||
if (finish != NULL)
|
||||
finish(key);
|
||||
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
ENGINE_finish(key->engine);
|
||||
key->engine = NULL;
|
||||
#endif
|
||||
|
||||
key->meth = meth;
|
||||
if (meth->init != NULL)
|
||||
return meth->init(key);
|
||||
return 1;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_set_method);
|
||||
|
||||
EC_KEY *
|
||||
EC_KEY_new_method(ENGINE *engine)
|
||||
{
|
||||
EC_KEY *ret;
|
||||
|
||||
if ((ret = calloc(1, sizeof(EC_KEY))) == NULL) {
|
||||
ECerror(ERR_R_MALLOC_FAILURE);
|
||||
return NULL;
|
||||
}
|
||||
ret->meth = EC_KEY_get_default_method();
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
if (engine != NULL) {
|
||||
if (!ENGINE_init(engine)) {
|
||||
ECerror(ERR_R_ENGINE_LIB);
|
||||
goto err;
|
||||
}
|
||||
ret->engine = engine;
|
||||
} else
|
||||
ret->engine = ENGINE_get_default_EC();
|
||||
if (ret->engine) {
|
||||
ret->meth = ENGINE_get_EC(ret->engine);
|
||||
if (ret->meth == NULL) {
|
||||
ECerror(ERR_R_ENGINE_LIB);
|
||||
goto err;
|
||||
}
|
||||
}
|
||||
#endif
|
||||
ret->version = 1;
|
||||
ret->flags = 0;
|
||||
ret->group = NULL;
|
||||
ret->pub_key = NULL;
|
||||
ret->priv_key = NULL;
|
||||
ret->enc_flag = 0;
|
||||
ret->conv_form = POINT_CONVERSION_UNCOMPRESSED;
|
||||
ret->references = 1;
|
||||
|
||||
if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_RSA, ret, &ret->ex_data))
|
||||
goto err;
|
||||
if (ret->meth->init != NULL && ret->meth->init(ret) == 0)
|
||||
goto err;
|
||||
|
||||
return ret;
|
||||
|
||||
err:
|
||||
EC_KEY_free(ret);
|
||||
return NULL;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_new_method);
|
||||
|
||||
EC_KEY_METHOD *
|
||||
EC_KEY_METHOD_new(const EC_KEY_METHOD *meth)
|
||||
{
|
||||
EC_KEY_METHOD *ret;
|
||||
|
||||
if ((ret = calloc(1, sizeof(*meth))) == NULL)
|
||||
return NULL;
|
||||
if (meth != NULL)
|
||||
*ret = *meth;
|
||||
ret->flags |= EC_KEY_METHOD_DYNAMIC;
|
||||
return ret;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_METHOD_new);
|
||||
|
||||
void
|
||||
EC_KEY_METHOD_free(EC_KEY_METHOD *meth)
|
||||
{
|
||||
if (meth == NULL)
|
||||
return;
|
||||
if (meth->flags & EC_KEY_METHOD_DYNAMIC)
|
||||
free(meth);
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_METHOD_free);
|
||||
|
||||
void
|
||||
EC_KEY_METHOD_set_init(EC_KEY_METHOD *meth,
|
||||
int (*init)(EC_KEY *key),
|
||||
void (*finish)(EC_KEY *key),
|
||||
int (*copy)(EC_KEY *dest, const EC_KEY *src),
|
||||
int (*set_group)(EC_KEY *key, const EC_GROUP *grp),
|
||||
int (*set_private)(EC_KEY *key, const BIGNUM *priv_key),
|
||||
int (*set_public)(EC_KEY *key, const EC_POINT *pub_key))
|
||||
{
|
||||
meth->init = init;
|
||||
meth->finish = finish;
|
||||
meth->copy = copy;
|
||||
meth->set_group = set_group;
|
||||
meth->set_private = set_private;
|
||||
meth->set_public = set_public;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_METHOD_set_init);
|
||||
|
||||
void
|
||||
EC_KEY_METHOD_set_keygen(EC_KEY_METHOD *meth, int (*keygen)(EC_KEY *key))
|
||||
{
|
||||
meth->keygen = keygen;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_METHOD_set_keygen);
|
||||
|
||||
void
|
||||
EC_KEY_METHOD_set_compute_key(EC_KEY_METHOD *meth,
|
||||
int (*ckey)(unsigned char **out, size_t *out_len, const EC_POINT *pub_key,
|
||||
const EC_KEY *ecdh))
|
||||
{
|
||||
meth->compute_key = ckey;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_METHOD_set_compute_key);
|
||||
|
||||
void
|
||||
EC_KEY_METHOD_set_sign(EC_KEY_METHOD *meth,
|
||||
int (*sign)(int type, const unsigned char *dgst,
|
||||
int dlen, unsigned char *sig, unsigned int *siglen,
|
||||
const BIGNUM *kinv, const BIGNUM *r, EC_KEY *eckey),
|
||||
int (*sign_setup)(EC_KEY *eckey, BN_CTX *ctx_in,
|
||||
BIGNUM **kinvp, BIGNUM **rp),
|
||||
ECDSA_SIG *(*sign_sig)(const unsigned char *dgst,
|
||||
int dgst_len, const BIGNUM *in_kinv,
|
||||
const BIGNUM *in_r, EC_KEY *eckey))
|
||||
{
|
||||
meth->sign = sign;
|
||||
meth->sign_setup = sign_setup;
|
||||
meth->sign_sig = sign_sig;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_METHOD_set_sign);
|
||||
|
||||
void
|
||||
EC_KEY_METHOD_set_verify(EC_KEY_METHOD *meth,
|
||||
int (*verify)(int type, const unsigned char *dgst, int dgst_len,
|
||||
const unsigned char *sigbuf, int sig_len, EC_KEY *eckey),
|
||||
int (*verify_sig)(const unsigned char *dgst, int dgst_len,
|
||||
const ECDSA_SIG *sig, EC_KEY *eckey))
|
||||
{
|
||||
meth->verify = verify;
|
||||
meth->verify_sig = verify_sig;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_METHOD_set_verify);
|
||||
|
||||
|
||||
void
|
||||
EC_KEY_METHOD_get_init(const EC_KEY_METHOD *meth,
|
||||
int (**pinit)(EC_KEY *key),
|
||||
void (**pfinish)(EC_KEY *key),
|
||||
int (**pcopy)(EC_KEY *dest, const EC_KEY *src),
|
||||
int (**pset_group)(EC_KEY *key, const EC_GROUP *grp),
|
||||
int (**pset_private)(EC_KEY *key, const BIGNUM *priv_key),
|
||||
int (**pset_public)(EC_KEY *key, const EC_POINT *pub_key))
|
||||
{
|
||||
if (pinit != NULL)
|
||||
*pinit = meth->init;
|
||||
if (pfinish != NULL)
|
||||
*pfinish = meth->finish;
|
||||
if (pcopy != NULL)
|
||||
*pcopy = meth->copy;
|
||||
if (pset_group != NULL)
|
||||
*pset_group = meth->set_group;
|
||||
if (pset_private != NULL)
|
||||
*pset_private = meth->set_private;
|
||||
if (pset_public != NULL)
|
||||
*pset_public = meth->set_public;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_METHOD_get_init);
|
||||
|
||||
void
|
||||
EC_KEY_METHOD_get_keygen(const EC_KEY_METHOD *meth,
|
||||
int (**pkeygen)(EC_KEY *key))
|
||||
{
|
||||
if (pkeygen != NULL)
|
||||
*pkeygen = meth->keygen;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_METHOD_get_keygen);
|
||||
|
||||
void
|
||||
EC_KEY_METHOD_get_compute_key(const EC_KEY_METHOD *meth,
|
||||
int (**pck)(unsigned char **out, size_t *out_len, const EC_POINT *pub_key,
|
||||
const EC_KEY *ecdh))
|
||||
{
|
||||
if (pck != NULL)
|
||||
*pck = meth->compute_key;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_METHOD_get_compute_key);
|
||||
|
||||
void
|
||||
EC_KEY_METHOD_get_sign(const EC_KEY_METHOD *meth,
|
||||
int (**psign)(int type, const unsigned char *dgst,
|
||||
int dlen, unsigned char *sig, unsigned int *siglen,
|
||||
const BIGNUM *kinv, const BIGNUM *r, EC_KEY *eckey),
|
||||
int (**psign_setup)(EC_KEY *eckey, BN_CTX *ctx_in,
|
||||
BIGNUM **kinvp, BIGNUM **rp),
|
||||
ECDSA_SIG *(**psign_sig)(const unsigned char *dgst,
|
||||
int dgst_len, const BIGNUM *in_kinv, const BIGNUM *in_r,
|
||||
EC_KEY *eckey))
|
||||
{
|
||||
if (psign != NULL)
|
||||
*psign = meth->sign;
|
||||
if (psign_setup != NULL)
|
||||
*psign_setup = meth->sign_setup;
|
||||
if (psign_sig != NULL)
|
||||
*psign_sig = meth->sign_sig;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_METHOD_get_sign);
|
||||
|
||||
void
|
||||
EC_KEY_METHOD_get_verify(const EC_KEY_METHOD *meth,
|
||||
int (**pverify)(int type, const unsigned char *dgst, int dgst_len,
|
||||
const unsigned char *sigbuf, int sig_len, EC_KEY *eckey),
|
||||
int (**pverify_sig)(const unsigned char *dgst, int dgst_len,
|
||||
const ECDSA_SIG *sig, EC_KEY *eckey))
|
||||
{
|
||||
if (pverify != NULL)
|
||||
*pverify = meth->verify;
|
||||
if (pverify_sig != NULL)
|
||||
*pverify_sig = meth->verify_sig;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_METHOD_get_verify);
|
||||
1331
crypto/ec/ec_lib.c
Normal file
1331
crypto/ec/ec_lib.c
Normal file
File diff suppressed because it is too large
Load Diff
365
crypto/ec/ec_local.h
Normal file
365
crypto/ec/ec_local.h
Normal file
@@ -0,0 +1,365 @@
|
||||
/* $OpenBSD: ec_local.h,v 1.26 2023/07/28 15:50:33 tb Exp $ */
|
||||
/*
|
||||
* Originally written by Bodo Moeller for the OpenSSL project.
|
||||
*/
|
||||
/* ====================================================================
|
||||
* Copyright (c) 1998-2010 The OpenSSL Project. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in
|
||||
* the documentation and/or other materials provided with the
|
||||
* distribution.
|
||||
*
|
||||
* 3. All advertising materials mentioning features or use of this
|
||||
* software must display the following acknowledgment:
|
||||
* "This product includes software developed by the OpenSSL Project
|
||||
* for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
|
||||
*
|
||||
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
|
||||
* endorse or promote products derived from this software without
|
||||
* prior written permission. For written permission, please contact
|
||||
* openssl-core@openssl.org.
|
||||
*
|
||||
* 5. Products derived from this software may not be called "OpenSSL"
|
||||
* nor may "OpenSSL" appear in their names without prior written
|
||||
* permission of the OpenSSL Project.
|
||||
*
|
||||
* 6. Redistributions of any form whatsoever must retain the following
|
||||
* acknowledgment:
|
||||
* "This product includes software developed by the OpenSSL Project
|
||||
* for use in the OpenSSL Toolkit (http://www.openssl.org/)"
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
|
||||
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
|
||||
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
||||
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
||||
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
||||
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
||||
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
||||
* OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
* ====================================================================
|
||||
*
|
||||
* This product includes cryptographic software written by Eric Young
|
||||
* (eay@cryptsoft.com). This product includes software written by Tim
|
||||
* Hudson (tjh@cryptsoft.com).
|
||||
*
|
||||
*/
|
||||
/* ====================================================================
|
||||
* Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
|
||||
*
|
||||
* Portions of the attached software ("Contribution") are developed by
|
||||
* SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
|
||||
*
|
||||
* The Contribution is licensed pursuant to the OpenSSL open source
|
||||
* license provided above.
|
||||
*
|
||||
* The elliptic curve binary polynomial software is originally written by
|
||||
* Sheueling Chang Shantz and Douglas Stebila of Sun Microsystems Laboratories.
|
||||
*
|
||||
*/
|
||||
|
||||
#include <stdlib.h>
|
||||
|
||||
#include <openssl/bn.h>
|
||||
#include <openssl/ec.h>
|
||||
#include <openssl/objects.h>
|
||||
|
||||
#include "bn_local.h"
|
||||
|
||||
__BEGIN_HIDDEN_DECLS
|
||||
|
||||
#if defined(__SUNPRO_C)
|
||||
# if __SUNPRO_C >= 0x520
|
||||
# pragma error_messages (off,E_ARRAY_OF_INCOMPLETE_NONAME,E_ARRAY_OF_INCOMPLETE)
|
||||
# endif
|
||||
#endif
|
||||
|
||||
struct ec_method_st {
|
||||
int field_type;
|
||||
|
||||
int (*group_init)(EC_GROUP *);
|
||||
void (*group_finish)(EC_GROUP *);
|
||||
int (*group_copy)(EC_GROUP *, const EC_GROUP *);
|
||||
|
||||
int (*group_set_curve)(EC_GROUP *, const BIGNUM *p, const BIGNUM *a,
|
||||
const BIGNUM *b, BN_CTX *);
|
||||
int (*group_get_curve)(const EC_GROUP *, BIGNUM *p, BIGNUM *a,
|
||||
BIGNUM *b, BN_CTX *);
|
||||
|
||||
int (*group_get_degree)(const EC_GROUP *);
|
||||
int (*group_order_bits)(const EC_GROUP *);
|
||||
int (*group_check_discriminant)(const EC_GROUP *, BN_CTX *);
|
||||
|
||||
int (*point_init)(EC_POINT *);
|
||||
void (*point_finish)(EC_POINT *);
|
||||
int (*point_copy)(EC_POINT *, const EC_POINT *);
|
||||
|
||||
int (*point_set_to_infinity)(const EC_GROUP *, EC_POINT *);
|
||||
int (*point_set_Jprojective_coordinates)(const EC_GROUP *, EC_POINT *,
|
||||
const BIGNUM *x, const BIGNUM *y, const BIGNUM *z, BN_CTX *);
|
||||
int (*point_get_Jprojective_coordinates)(const EC_GROUP *,
|
||||
const EC_POINT *, BIGNUM *x, BIGNUM *y, BIGNUM *z, BN_CTX *);
|
||||
int (*point_set_affine_coordinates)(const EC_GROUP *, EC_POINT *,
|
||||
const BIGNUM *x, const BIGNUM *y, BN_CTX *);
|
||||
int (*point_get_affine_coordinates)(const EC_GROUP *, const EC_POINT *,
|
||||
BIGNUM *x, BIGNUM *y, BN_CTX *);
|
||||
int (*point_set_compressed_coordinates)(const EC_GROUP *, EC_POINT *,
|
||||
const BIGNUM *x, int y_bit, BN_CTX *);
|
||||
|
||||
size_t (*point2oct)(const EC_GROUP *, const EC_POINT *,
|
||||
point_conversion_form_t form, unsigned char *buf, size_t len,
|
||||
BN_CTX *);
|
||||
int (*oct2point)(const EC_GROUP *, EC_POINT *, const unsigned char *buf,
|
||||
size_t len, BN_CTX *);
|
||||
|
||||
int (*add)(const EC_GROUP *, EC_POINT *r, const EC_POINT *a,
|
||||
const EC_POINT *b, BN_CTX *);
|
||||
int (*dbl)(const EC_GROUP *, EC_POINT *r, const EC_POINT *a, BN_CTX *);
|
||||
int (*invert)(const EC_GROUP *, EC_POINT *, BN_CTX *);
|
||||
|
||||
int (*is_at_infinity)(const EC_GROUP *, const EC_POINT *);
|
||||
int (*is_on_curve)(const EC_GROUP *, const EC_POINT *, BN_CTX *);
|
||||
int (*point_cmp)(const EC_GROUP *, const EC_POINT *a, const EC_POINT *b,
|
||||
BN_CTX *);
|
||||
|
||||
int (*make_affine)(const EC_GROUP *, EC_POINT *, BN_CTX *);
|
||||
int (*points_make_affine)(const EC_GROUP *, size_t num, EC_POINT *[],
|
||||
BN_CTX *);
|
||||
|
||||
int (*mul_generator_ct)(const EC_GROUP *, EC_POINT *r,
|
||||
const BIGNUM *scalar, BN_CTX *);
|
||||
int (*mul_single_ct)(const EC_GROUP *group, EC_POINT *r,
|
||||
const BIGNUM *scalar, const EC_POINT *point, BN_CTX *);
|
||||
int (*mul_double_nonct)(const EC_GROUP *group, EC_POINT *r,
|
||||
const BIGNUM *g_scalar, const BIGNUM *p_scalar,
|
||||
const EC_POINT *point, BN_CTX *);
|
||||
|
||||
/*
|
||||
* Internal methods.
|
||||
*/
|
||||
|
||||
/*
|
||||
* These can be used by 'add' and 'dbl' so that the same implementations
|
||||
* of point operations can be used with different optimized versions of
|
||||
* expensive field operations.
|
||||
*/
|
||||
int (*field_mul)(const EC_GROUP *, BIGNUM *r, const BIGNUM *a,
|
||||
const BIGNUM *b, BN_CTX *);
|
||||
int (*field_sqr)(const EC_GROUP *, BIGNUM *r, const BIGNUM *a,
|
||||
BN_CTX *);
|
||||
int (*field_div)(const EC_GROUP *, BIGNUM *r, const BIGNUM *a,
|
||||
const BIGNUM *b, BN_CTX *);
|
||||
|
||||
/* Encode to and decode from other forms (e.g. Montgomery). */
|
||||
int (*field_encode)(const EC_GROUP *, BIGNUM *r, const BIGNUM *a,
|
||||
BN_CTX *);
|
||||
int (*field_decode)(const EC_GROUP *, BIGNUM *r, const BIGNUM *a,
|
||||
BN_CTX *);
|
||||
|
||||
int (*field_set_to_one)(const EC_GROUP *, BIGNUM *r, BN_CTX *);
|
||||
int (*blind_coordinates)(const EC_GROUP *group, EC_POINT *p,
|
||||
BN_CTX *ctx);
|
||||
} /* EC_METHOD */;
|
||||
|
||||
struct ec_group_st {
|
||||
/*
|
||||
* Methods and members exposed via the public API.
|
||||
*/
|
||||
|
||||
const EC_METHOD *meth;
|
||||
|
||||
EC_POINT *generator; /* Optional */
|
||||
BIGNUM order;
|
||||
BIGNUM cofactor;
|
||||
|
||||
int curve_name; /* Optional NID for named curve. */
|
||||
|
||||
/* ASN.1 encoding controls. */
|
||||
int asn1_flag;
|
||||
point_conversion_form_t asn1_form;
|
||||
|
||||
/* Optional seed for parameters (appears in ASN.1). */
|
||||
unsigned char *seed;
|
||||
size_t seed_len;
|
||||
|
||||
/*
|
||||
* Internal methods and members. Handled by the method functions, even
|
||||
* if they appear to be generic.
|
||||
*/
|
||||
|
||||
/*
|
||||
* Field specification. For GF(p) this is the modulus; for GF(2^m),
|
||||
* this is the irreducible polynomial defining the field.
|
||||
*/
|
||||
BIGNUM field;
|
||||
|
||||
/*
|
||||
* Curve coefficients. In characteristic > 3, the curve is defined by a
|
||||
* Weierstrass equation of the form y^2 = x^3 + a*x + b.
|
||||
*/
|
||||
BIGNUM a, b;
|
||||
|
||||
/* Enables optimized point arithmetics for special case. */
|
||||
int a_is_minus3;
|
||||
|
||||
/* Montgomery context and values used by EC_GFp_mont_method. */
|
||||
BN_MONT_CTX *mont_ctx;
|
||||
BIGNUM *mont_one;
|
||||
|
||||
int (*field_mod_func)(BIGNUM *, const BIGNUM *, const BIGNUM *,
|
||||
BN_CTX *);
|
||||
} /* EC_GROUP */;
|
||||
|
||||
struct ec_key_st {
|
||||
const EC_KEY_METHOD *meth;
|
||||
ENGINE *engine;
|
||||
|
||||
int version;
|
||||
|
||||
EC_GROUP *group;
|
||||
|
||||
EC_POINT *pub_key;
|
||||
BIGNUM *priv_key;
|
||||
|
||||
unsigned int enc_flag;
|
||||
point_conversion_form_t conv_form;
|
||||
|
||||
int references;
|
||||
int flags;
|
||||
|
||||
CRYPTO_EX_DATA ex_data;
|
||||
} /* EC_KEY */;
|
||||
|
||||
struct ec_point_st {
|
||||
const EC_METHOD *meth;
|
||||
|
||||
/*
|
||||
* All members except 'meth' are handled by the method functions,
|
||||
* even if they appear generic.
|
||||
*/
|
||||
|
||||
/*
|
||||
* Jacobian projective coordinates: (X, Y, Z) represents (X/Z^2, Y/Z^3)
|
||||
* if Z != 0
|
||||
*/
|
||||
BIGNUM X;
|
||||
BIGNUM Y;
|
||||
BIGNUM Z;
|
||||
int Z_is_one; /* enable optimized point arithmetics for special case */
|
||||
} /* EC_POINT */;
|
||||
|
||||
/* method functions in ec_mult.c
|
||||
* (ec_lib.c uses these as defaults if group->method->mul is 0) */
|
||||
int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
|
||||
size_t num, const EC_POINT *points[], const BIGNUM *scalars[], BN_CTX *);
|
||||
|
||||
/* method functions in ecp_smpl.c */
|
||||
int ec_GFp_simple_group_init(EC_GROUP *);
|
||||
void ec_GFp_simple_group_finish(EC_GROUP *);
|
||||
int ec_GFp_simple_group_copy(EC_GROUP *, const EC_GROUP *);
|
||||
int ec_GFp_simple_group_set_curve(EC_GROUP *, const BIGNUM *p, const BIGNUM *a, const BIGNUM *b, BN_CTX *);
|
||||
int ec_GFp_simple_group_get_curve(const EC_GROUP *, BIGNUM *p, BIGNUM *a, BIGNUM *b, BN_CTX *);
|
||||
int ec_GFp_simple_group_get_degree(const EC_GROUP *);
|
||||
int ec_GFp_simple_group_check_discriminant(const EC_GROUP *, BN_CTX *);
|
||||
int ec_GFp_simple_point_init(EC_POINT *);
|
||||
void ec_GFp_simple_point_finish(EC_POINT *);
|
||||
int ec_GFp_simple_point_copy(EC_POINT *, const EC_POINT *);
|
||||
int ec_GFp_simple_point_set_to_infinity(const EC_GROUP *, EC_POINT *);
|
||||
int ec_GFp_simple_set_Jprojective_coordinates(const EC_GROUP *, EC_POINT *,
|
||||
const BIGNUM *x, const BIGNUM *y, const BIGNUM *z, BN_CTX *);
|
||||
int ec_GFp_simple_get_Jprojective_coordinates(const EC_GROUP *,
|
||||
const EC_POINT *, BIGNUM *x, BIGNUM *y, BIGNUM *z, BN_CTX *);
|
||||
int ec_GFp_simple_point_set_affine_coordinates(const EC_GROUP *, EC_POINT *,
|
||||
const BIGNUM *x, const BIGNUM *y, BN_CTX *);
|
||||
int ec_GFp_simple_point_get_affine_coordinates(const EC_GROUP *, const EC_POINT *,
|
||||
BIGNUM *x, BIGNUM *y, BN_CTX *);
|
||||
int ec_GFp_simple_set_compressed_coordinates(const EC_GROUP *, EC_POINT *,
|
||||
const BIGNUM *x, int y_bit, BN_CTX *);
|
||||
size_t ec_GFp_simple_point2oct(const EC_GROUP *, const EC_POINT *, point_conversion_form_t form,
|
||||
unsigned char *buf, size_t len, BN_CTX *);
|
||||
int ec_GFp_simple_oct2point(const EC_GROUP *, EC_POINT *,
|
||||
const unsigned char *buf, size_t len, BN_CTX *);
|
||||
int ec_GFp_simple_add(const EC_GROUP *, EC_POINT *r, const EC_POINT *a, const EC_POINT *b, BN_CTX *);
|
||||
int ec_GFp_simple_dbl(const EC_GROUP *, EC_POINT *r, const EC_POINT *a, BN_CTX *);
|
||||
int ec_GFp_simple_invert(const EC_GROUP *, EC_POINT *, BN_CTX *);
|
||||
int ec_GFp_simple_is_at_infinity(const EC_GROUP *, const EC_POINT *);
|
||||
int ec_GFp_simple_is_on_curve(const EC_GROUP *, const EC_POINT *, BN_CTX *);
|
||||
int ec_GFp_simple_cmp(const EC_GROUP *, const EC_POINT *a, const EC_POINT *b, BN_CTX *);
|
||||
int ec_GFp_simple_make_affine(const EC_GROUP *, EC_POINT *, BN_CTX *);
|
||||
int ec_GFp_simple_points_make_affine(const EC_GROUP *, size_t num, EC_POINT *[], BN_CTX *);
|
||||
int ec_GFp_simple_field_mul(const EC_GROUP *, BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *);
|
||||
int ec_GFp_simple_field_sqr(const EC_GROUP *, BIGNUM *r, const BIGNUM *a, BN_CTX *);
|
||||
int ec_GFp_simple_blind_coordinates(const EC_GROUP *group, EC_POINT *p, BN_CTX *ctx);
|
||||
int ec_GFp_simple_mul_generator_ct(const EC_GROUP *, EC_POINT *r, const BIGNUM *scalar, BN_CTX *);
|
||||
int ec_GFp_simple_mul_single_ct(const EC_GROUP *, EC_POINT *r, const BIGNUM *scalar,
|
||||
const EC_POINT *point, BN_CTX *);
|
||||
int ec_GFp_simple_mul_double_nonct(const EC_GROUP *, EC_POINT *r, const BIGNUM *g_scalar,
|
||||
const BIGNUM *p_scalar, const EC_POINT *point, BN_CTX *);
|
||||
|
||||
int ec_group_simple_order_bits(const EC_GROUP *group);
|
||||
int ec_point_blind_coordinates(const EC_GROUP *group, EC_POINT *p, BN_CTX *ctx);
|
||||
|
||||
/* EC_METHOD definitions */
|
||||
|
||||
struct ec_key_method_st {
|
||||
const char *name;
|
||||
int32_t flags;
|
||||
int (*init)(EC_KEY *key);
|
||||
void (*finish)(EC_KEY *key);
|
||||
int (*copy)(EC_KEY *dest, const EC_KEY *src);
|
||||
int (*set_group)(EC_KEY *key, const EC_GROUP *grp);
|
||||
int (*set_private)(EC_KEY *key, const BIGNUM *priv_key);
|
||||
int (*set_public)(EC_KEY *key, const EC_POINT *pub_key);
|
||||
int (*keygen)(EC_KEY *key);
|
||||
int (*compute_key)(unsigned char **out, size_t *out_len,
|
||||
const EC_POINT *pub_key, const EC_KEY *ecdh);
|
||||
int (*sign)(int type, const unsigned char *dgst, int dlen, unsigned char
|
||||
*sig, unsigned int *siglen, const BIGNUM *kinv,
|
||||
const BIGNUM *r, EC_KEY *eckey);
|
||||
int (*sign_setup)(EC_KEY *eckey, BN_CTX *ctx_in, BIGNUM **kinvp,
|
||||
BIGNUM **rp);
|
||||
ECDSA_SIG *(*sign_sig)(const unsigned char *dgst, int dgst_len,
|
||||
const BIGNUM *in_kinv, const BIGNUM *in_r,
|
||||
EC_KEY *eckey);
|
||||
int (*verify)(int type, const unsigned char *dgst, int dgst_len,
|
||||
const unsigned char *sigbuf, int sig_len, EC_KEY *eckey);
|
||||
int (*verify_sig)(const unsigned char *dgst, int dgst_len,
|
||||
const ECDSA_SIG *sig, EC_KEY *eckey);
|
||||
} /* EC_KEY_METHOD */;
|
||||
|
||||
#define EC_KEY_METHOD_DYNAMIC 1
|
||||
|
||||
int ec_key_gen(EC_KEY *eckey);
|
||||
int ecdh_compute_key(unsigned char **out, size_t *out_len,
|
||||
const EC_POINT *pub_key, const EC_KEY *ecdh);
|
||||
int ecdsa_verify(int type, const unsigned char *dgst, int dgst_len,
|
||||
const unsigned char *sigbuf, int sig_len, EC_KEY *eckey);
|
||||
int ecdsa_verify_sig(const unsigned char *dgst, int dgst_len,
|
||||
const ECDSA_SIG *sig, EC_KEY *eckey);
|
||||
|
||||
/*
|
||||
* ECDH Key Derivation Function as defined in ANSI X9.63.
|
||||
*/
|
||||
int ecdh_KDF_X9_63(unsigned char *out, size_t outlen, const unsigned char *Z,
|
||||
size_t Zlen, const unsigned char *sinfo, size_t sinfolen, const EVP_MD *md);
|
||||
|
||||
int EC_POINT_set_Jprojective_coordinates(const EC_GROUP *group, EC_POINT *p,
|
||||
const BIGNUM *x, const BIGNUM *y, const BIGNUM *z, BN_CTX *ctx);
|
||||
int EC_POINT_get_Jprojective_coordinates(const EC_GROUP *group,
|
||||
const EC_POINT *p, BIGNUM *x, BIGNUM *y, BIGNUM *z, BN_CTX *ctx);
|
||||
|
||||
/* Public API in OpenSSL */
|
||||
const BIGNUM *EC_GROUP_get0_order(const EC_GROUP *group);
|
||||
|
||||
__END_HIDDEN_DECLS
|
||||
450
crypto/ec/ec_mult.c
Normal file
450
crypto/ec/ec_mult.c
Normal file
@@ -0,0 +1,450 @@
|
||||
/* $OpenBSD: ec_mult.c,v 1.31 2023/06/24 17:49:44 jsing Exp $ */
|
||||
/*
|
||||
* Originally written by Bodo Moeller and Nils Larsch for the OpenSSL project.
|
||||
*/
|
||||
/* ====================================================================
|
||||
* Copyright (c) 1998-2007 The OpenSSL Project. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in
|
||||
* the documentation and/or other materials provided with the
|
||||
* distribution.
|
||||
*
|
||||
* 3. All advertising materials mentioning features or use of this
|
||||
* software must display the following acknowledgment:
|
||||
* "This product includes software developed by the OpenSSL Project
|
||||
* for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
|
||||
*
|
||||
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
|
||||
* endorse or promote products derived from this software without
|
||||
* prior written permission. For written permission, please contact
|
||||
* openssl-core@openssl.org.
|
||||
*
|
||||
* 5. Products derived from this software may not be called "OpenSSL"
|
||||
* nor may "OpenSSL" appear in their names without prior written
|
||||
* permission of the OpenSSL Project.
|
||||
*
|
||||
* 6. Redistributions of any form whatsoever must retain the following
|
||||
* acknowledgment:
|
||||
* "This product includes software developed by the OpenSSL Project
|
||||
* for use in the OpenSSL Toolkit (http://www.openssl.org/)"
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
|
||||
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
|
||||
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
||||
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
||||
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
||||
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
||||
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
||||
* OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
* ====================================================================
|
||||
*
|
||||
* This product includes cryptographic software written by Eric Young
|
||||
* (eay@cryptsoft.com). This product includes software written by Tim
|
||||
* Hudson (tjh@cryptsoft.com).
|
||||
*
|
||||
*/
|
||||
/* ====================================================================
|
||||
* Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
|
||||
* Portions of this software developed by SUN MICROSYSTEMS, INC.,
|
||||
* and contributed to the OpenSSL project.
|
||||
*/
|
||||
|
||||
#include <string.h>
|
||||
|
||||
#include <openssl/err.h>
|
||||
|
||||
#include "ec_local.h"
|
||||
|
||||
/*
|
||||
* This file implements the wNAF-based interleaving multi-exponentation method
|
||||
* (<URL:http://www.informatik.tu-darmstadt.de/TI/Mitarbeiter/moeller.html#multiexp>);
|
||||
* for multiplication with precomputation, we use wNAF splitting
|
||||
* (<URL:http://www.informatik.tu-darmstadt.de/TI/Mitarbeiter/moeller.html#fastexp>).
|
||||
*/
|
||||
|
||||
/* Determine the modified width-(w+1) Non-Adjacent Form (wNAF) of 'scalar'.
|
||||
* This is an array r[] of values that are either zero or odd with an
|
||||
* absolute value less than 2^w satisfying
|
||||
* scalar = \sum_j r[j]*2^j
|
||||
* where at most one of any w+1 consecutive digits is non-zero
|
||||
* with the exception that the most significant digit may be only
|
||||
* w-1 zeros away from that next non-zero digit.
|
||||
*/
|
||||
static signed char *
|
||||
compute_wNAF(const BIGNUM *scalar, int w, size_t *ret_len)
|
||||
{
|
||||
int window_val;
|
||||
int ok = 0;
|
||||
signed char *r = NULL;
|
||||
int sign = 1;
|
||||
int bit, next_bit, mask;
|
||||
size_t len = 0, j;
|
||||
|
||||
if (BN_is_zero(scalar)) {
|
||||
r = malloc(1);
|
||||
if (!r) {
|
||||
ECerror(ERR_R_MALLOC_FAILURE);
|
||||
goto err;
|
||||
}
|
||||
r[0] = 0;
|
||||
*ret_len = 1;
|
||||
return r;
|
||||
}
|
||||
if (w <= 0 || w > 7) {
|
||||
/* 'signed char' can represent integers with
|
||||
* absolute values less than 2^7 */
|
||||
ECerror(ERR_R_INTERNAL_ERROR);
|
||||
goto err;
|
||||
}
|
||||
bit = 1 << w; /* at most 128 */
|
||||
next_bit = bit << 1; /* at most 256 */
|
||||
mask = next_bit - 1; /* at most 255 */
|
||||
|
||||
if (BN_is_negative(scalar)) {
|
||||
sign = -1;
|
||||
}
|
||||
if (scalar->d == NULL || scalar->top == 0) {
|
||||
ECerror(ERR_R_INTERNAL_ERROR);
|
||||
goto err;
|
||||
}
|
||||
len = BN_num_bits(scalar);
|
||||
r = malloc(len + 1); /* modified wNAF may be one digit longer than
|
||||
* binary representation (*ret_len will be
|
||||
* set to the actual length, i.e. at most
|
||||
* BN_num_bits(scalar) + 1) */
|
||||
if (r == NULL) {
|
||||
ECerror(ERR_R_MALLOC_FAILURE);
|
||||
goto err;
|
||||
}
|
||||
window_val = scalar->d[0] & mask;
|
||||
j = 0;
|
||||
while ((window_val != 0) || (j + w + 1 < len)) {
|
||||
/* if j+w+1 >= len, window_val will not increase */
|
||||
int digit = 0;
|
||||
|
||||
/* 0 <= window_val <= 2^(w+1) */
|
||||
if (window_val & 1) {
|
||||
/* 0 < window_val < 2^(w+1) */
|
||||
if (window_val & bit) {
|
||||
digit = window_val - next_bit; /* -2^w < digit < 0 */
|
||||
|
||||
#if 1 /* modified wNAF */
|
||||
if (j + w + 1 >= len) {
|
||||
/*
|
||||
* special case for generating
|
||||
* modified wNAFs: no new bits will
|
||||
* be added into window_val, so using
|
||||
* a positive digit here will
|
||||
* decrease the total length of the
|
||||
* representation
|
||||
*/
|
||||
|
||||
digit = window_val & (mask >> 1); /* 0 < digit < 2^w */
|
||||
}
|
||||
#endif
|
||||
} else {
|
||||
digit = window_val; /* 0 < digit < 2^w */
|
||||
}
|
||||
|
||||
if (digit <= -bit || digit >= bit || !(digit & 1)) {
|
||||
ECerror(ERR_R_INTERNAL_ERROR);
|
||||
goto err;
|
||||
}
|
||||
window_val -= digit;
|
||||
|
||||
/*
|
||||
* now window_val is 0 or 2^(w+1) in standard wNAF
|
||||
* generation; for modified window NAFs, it may also
|
||||
* be 2^w
|
||||
*/
|
||||
if (window_val != 0 && window_val != next_bit && window_val != bit) {
|
||||
ECerror(ERR_R_INTERNAL_ERROR);
|
||||
goto err;
|
||||
}
|
||||
}
|
||||
r[j++] = sign * digit;
|
||||
|
||||
window_val >>= 1;
|
||||
window_val += bit * BN_is_bit_set(scalar, j + w);
|
||||
|
||||
if (window_val > next_bit) {
|
||||
ECerror(ERR_R_INTERNAL_ERROR);
|
||||
goto err;
|
||||
}
|
||||
}
|
||||
|
||||
if (j > len + 1) {
|
||||
ECerror(ERR_R_INTERNAL_ERROR);
|
||||
goto err;
|
||||
}
|
||||
len = j;
|
||||
ok = 1;
|
||||
|
||||
err:
|
||||
if (!ok) {
|
||||
free(r);
|
||||
r = NULL;
|
||||
}
|
||||
if (ok)
|
||||
*ret_len = len;
|
||||
return r;
|
||||
}
|
||||
|
||||
|
||||
/* TODO: table should be optimised for the wNAF-based implementation,
|
||||
* sometimes smaller windows will give better performance
|
||||
* (thus the boundaries should be increased)
|
||||
*/
|
||||
#define EC_window_bits_for_scalar_size(b) \
|
||||
((size_t) \
|
||||
((b) >= 2000 ? 6 : \
|
||||
(b) >= 800 ? 5 : \
|
||||
(b) >= 300 ? 4 : \
|
||||
(b) >= 70 ? 3 : \
|
||||
(b) >= 20 ? 2 : \
|
||||
1))
|
||||
|
||||
/* Compute
|
||||
* \sum scalars[i]*points[i],
|
||||
* also including
|
||||
* scalar*generator
|
||||
* in the addition if scalar != NULL
|
||||
*/
|
||||
int
|
||||
ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
|
||||
size_t num, const EC_POINT *points[], const BIGNUM *scalars[], BN_CTX *ctx)
|
||||
{
|
||||
const EC_POINT *generator = NULL;
|
||||
EC_POINT *tmp = NULL;
|
||||
size_t totalnum;
|
||||
size_t numblocks = 0; /* for wNAF splitting */
|
||||
size_t i, j;
|
||||
int k;
|
||||
int r_is_inverted = 0;
|
||||
int r_is_at_infinity = 1;
|
||||
size_t *wsize = NULL; /* individual window sizes */
|
||||
signed char **wNAF = NULL; /* individual wNAFs */
|
||||
signed char *tmp_wNAF = NULL;
|
||||
size_t *wNAF_len = NULL;
|
||||
size_t max_len = 0;
|
||||
size_t num_val;
|
||||
EC_POINT **val = NULL; /* precomputation */
|
||||
EC_POINT **v;
|
||||
EC_POINT ***val_sub = NULL; /* pointers to sub-arrays of 'val' or
|
||||
* 'pre_comp->points' */
|
||||
int num_scalar = 0; /* flag: will be set to 1 if 'scalar' must be
|
||||
* treated like other scalars, i.e.
|
||||
* precomputation is not available */
|
||||
int ret = 0;
|
||||
|
||||
if (group->meth != r->meth) {
|
||||
ECerror(EC_R_INCOMPATIBLE_OBJECTS);
|
||||
return 0;
|
||||
}
|
||||
if ((scalar == NULL) && (num == 0)) {
|
||||
return EC_POINT_set_to_infinity(group, r);
|
||||
}
|
||||
for (i = 0; i < num; i++) {
|
||||
if (group->meth != points[i]->meth) {
|
||||
ECerror(EC_R_INCOMPATIBLE_OBJECTS);
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
|
||||
if (scalar != NULL) {
|
||||
generator = EC_GROUP_get0_generator(group);
|
||||
if (generator == NULL) {
|
||||
ECerror(EC_R_UNDEFINED_GENERATOR);
|
||||
goto err;
|
||||
}
|
||||
|
||||
numblocks = 1;
|
||||
num_scalar = 1; /* treat 'scalar' like 'num'-th
|
||||
* element of 'scalars' */
|
||||
}
|
||||
totalnum = num + numblocks;
|
||||
|
||||
/* includes space for pivot */
|
||||
wNAF = reallocarray(NULL, (totalnum + 1), sizeof wNAF[0]);
|
||||
if (wNAF == NULL) {
|
||||
ECerror(ERR_R_MALLOC_FAILURE);
|
||||
goto err;
|
||||
}
|
||||
|
||||
wNAF[0] = NULL; /* preliminary pivot */
|
||||
|
||||
wsize = reallocarray(NULL, totalnum, sizeof wsize[0]);
|
||||
wNAF_len = reallocarray(NULL, totalnum, sizeof wNAF_len[0]);
|
||||
val_sub = reallocarray(NULL, totalnum, sizeof val_sub[0]);
|
||||
|
||||
if (wsize == NULL || wNAF_len == NULL || val_sub == NULL) {
|
||||
ECerror(ERR_R_MALLOC_FAILURE);
|
||||
goto err;
|
||||
}
|
||||
|
||||
/* num_val will be the total number of temporarily precomputed points */
|
||||
num_val = 0;
|
||||
|
||||
for (i = 0; i < num + num_scalar; i++) {
|
||||
size_t bits;
|
||||
|
||||
bits = i < num ? BN_num_bits(scalars[i]) : BN_num_bits(scalar);
|
||||
wsize[i] = EC_window_bits_for_scalar_size(bits);
|
||||
num_val += (size_t) 1 << (wsize[i] - 1);
|
||||
wNAF[i + 1] = NULL; /* make sure we always have a pivot */
|
||||
wNAF[i] = compute_wNAF((i < num ? scalars[i] : scalar), wsize[i], &wNAF_len[i]);
|
||||
if (wNAF[i] == NULL)
|
||||
goto err;
|
||||
if (wNAF_len[i] > max_len)
|
||||
max_len = wNAF_len[i];
|
||||
}
|
||||
|
||||
if (numblocks) {
|
||||
/* we go here iff scalar != NULL */
|
||||
|
||||
if (num_scalar != 1) {
|
||||
ECerror(ERR_R_INTERNAL_ERROR);
|
||||
goto err;
|
||||
}
|
||||
}
|
||||
/*
|
||||
* All points we precompute now go into a single array 'val'.
|
||||
* 'val_sub[i]' is a pointer to the subarray for the i-th point, or
|
||||
* to a subarray of 'pre_comp->points' if we already have
|
||||
* precomputation.
|
||||
*/
|
||||
val = reallocarray(NULL, (num_val + 1), sizeof val[0]);
|
||||
if (val == NULL) {
|
||||
ECerror(ERR_R_MALLOC_FAILURE);
|
||||
goto err;
|
||||
}
|
||||
val[num_val] = NULL; /* pivot element */
|
||||
|
||||
/* allocate points for precomputation */
|
||||
v = val;
|
||||
for (i = 0; i < num + num_scalar; i++) {
|
||||
val_sub[i] = v;
|
||||
for (j = 0; j < ((size_t) 1 << (wsize[i] - 1)); j++) {
|
||||
*v = EC_POINT_new(group);
|
||||
if (*v == NULL)
|
||||
goto err;
|
||||
v++;
|
||||
}
|
||||
}
|
||||
if (!(v == val + num_val)) {
|
||||
ECerror(ERR_R_INTERNAL_ERROR);
|
||||
goto err;
|
||||
}
|
||||
if (!(tmp = EC_POINT_new(group)))
|
||||
goto err;
|
||||
|
||||
/*
|
||||
* prepare precomputed values: val_sub[i][0] := points[i]
|
||||
* val_sub[i][1] := 3 * points[i] val_sub[i][2] := 5 * points[i] ...
|
||||
*/
|
||||
for (i = 0; i < num + num_scalar; i++) {
|
||||
if (i < num) {
|
||||
if (!EC_POINT_copy(val_sub[i][0], points[i]))
|
||||
goto err;
|
||||
} else {
|
||||
if (!EC_POINT_copy(val_sub[i][0], generator))
|
||||
goto err;
|
||||
}
|
||||
|
||||
if (wsize[i] > 1) {
|
||||
if (!EC_POINT_dbl(group, tmp, val_sub[i][0], ctx))
|
||||
goto err;
|
||||
for (j = 1; j < ((size_t) 1 << (wsize[i] - 1)); j++) {
|
||||
if (!EC_POINT_add(group, val_sub[i][j], val_sub[i][j - 1], tmp, ctx))
|
||||
goto err;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if (!EC_POINTs_make_affine(group, num_val, val, ctx))
|
||||
goto err;
|
||||
|
||||
r_is_at_infinity = 1;
|
||||
|
||||
for (k = max_len - 1; k >= 0; k--) {
|
||||
if (!r_is_at_infinity) {
|
||||
if (!EC_POINT_dbl(group, r, r, ctx))
|
||||
goto err;
|
||||
}
|
||||
for (i = 0; i < totalnum; i++) {
|
||||
if (wNAF_len[i] > (size_t) k) {
|
||||
int digit = wNAF[i][k];
|
||||
int is_neg;
|
||||
|
||||
if (digit) {
|
||||
is_neg = digit < 0;
|
||||
|
||||
if (is_neg)
|
||||
digit = -digit;
|
||||
|
||||
if (is_neg != r_is_inverted) {
|
||||
if (!r_is_at_infinity) {
|
||||
if (!EC_POINT_invert(group, r, ctx))
|
||||
goto err;
|
||||
}
|
||||
r_is_inverted = !r_is_inverted;
|
||||
}
|
||||
/* digit > 0 */
|
||||
|
||||
if (r_is_at_infinity) {
|
||||
if (!EC_POINT_copy(r, val_sub[i][digit >> 1]))
|
||||
goto err;
|
||||
r_is_at_infinity = 0;
|
||||
} else {
|
||||
if (!EC_POINT_add(group, r, r, val_sub[i][digit >> 1], ctx))
|
||||
goto err;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if (r_is_at_infinity) {
|
||||
if (!EC_POINT_set_to_infinity(group, r))
|
||||
goto err;
|
||||
} else {
|
||||
if (r_is_inverted)
|
||||
if (!EC_POINT_invert(group, r, ctx))
|
||||
goto err;
|
||||
}
|
||||
|
||||
ret = 1;
|
||||
|
||||
err:
|
||||
EC_POINT_free(tmp);
|
||||
free(wsize);
|
||||
free(wNAF_len);
|
||||
free(tmp_wNAF);
|
||||
if (wNAF != NULL) {
|
||||
signed char **w;
|
||||
|
||||
for (w = wNAF; *w != NULL; w++)
|
||||
free(*w);
|
||||
|
||||
free(wNAF);
|
||||
}
|
||||
if (val != NULL) {
|
||||
for (v = val; *v != NULL; v++)
|
||||
EC_POINT_free(*v);
|
||||
free(val);
|
||||
}
|
||||
free(val_sub);
|
||||
return ret;
|
||||
}
|
||||
170
crypto/ec/ec_oct.c
Normal file
170
crypto/ec/ec_oct.c
Normal file
@@ -0,0 +1,170 @@
|
||||
/* $OpenBSD: ec_oct.c,v 1.16 2023/07/07 19:37:53 beck Exp $ */
|
||||
/*
|
||||
* Originally written by Bodo Moeller for the OpenSSL project.
|
||||
*/
|
||||
/* ====================================================================
|
||||
* Copyright (c) 1998-2003 The OpenSSL Project. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in
|
||||
* the documentation and/or other materials provided with the
|
||||
* distribution.
|
||||
*
|
||||
* 3. All advertising materials mentioning features or use of this
|
||||
* software must display the following acknowledgment:
|
||||
* "This product includes software developed by the OpenSSL Project
|
||||
* for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
|
||||
*
|
||||
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
|
||||
* endorse or promote products derived from this software without
|
||||
* prior written permission. For written permission, please contact
|
||||
* openssl-core@openssl.org.
|
||||
*
|
||||
* 5. Products derived from this software may not be called "OpenSSL"
|
||||
* nor may "OpenSSL" appear in their names without prior written
|
||||
* permission of the OpenSSL Project.
|
||||
*
|
||||
* 6. Redistributions of any form whatsoever must retain the following
|
||||
* acknowledgment:
|
||||
* "This product includes software developed by the OpenSSL Project
|
||||
* for use in the OpenSSL Toolkit (http://www.openssl.org/)"
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
|
||||
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
|
||||
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
||||
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
||||
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
||||
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
||||
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
||||
* OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
* ====================================================================
|
||||
*
|
||||
* This product includes cryptographic software written by Eric Young
|
||||
* (eay@cryptsoft.com). This product includes software written by Tim
|
||||
* Hudson (tjh@cryptsoft.com).
|
||||
*
|
||||
*/
|
||||
/* ====================================================================
|
||||
* Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
|
||||
* Binary polynomial ECC support in OpenSSL originally developed by
|
||||
* SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
|
||||
*/
|
||||
|
||||
#include <string.h>
|
||||
|
||||
#include <openssl/opensslconf.h>
|
||||
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/opensslv.h>
|
||||
|
||||
#include "ec_local.h"
|
||||
|
||||
int
|
||||
EC_POINT_set_compressed_coordinates(const EC_GROUP *group, EC_POINT *point,
|
||||
const BIGNUM *x, int y_bit, BN_CTX *ctx_in)
|
||||
{
|
||||
BN_CTX *ctx;
|
||||
int ret = 0;
|
||||
|
||||
if ((ctx = ctx_in) == NULL)
|
||||
ctx = BN_CTX_new();
|
||||
if (ctx == NULL)
|
||||
goto err;
|
||||
|
||||
if (group->meth->point_set_compressed_coordinates == NULL) {
|
||||
ECerror(ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
|
||||
goto err;
|
||||
}
|
||||
if (group->meth != point->meth) {
|
||||
ECerror(EC_R_INCOMPATIBLE_OBJECTS);
|
||||
goto err;
|
||||
}
|
||||
ret = group->meth->point_set_compressed_coordinates(group, point,
|
||||
x, y_bit, ctx);
|
||||
|
||||
err:
|
||||
if (ctx != ctx_in)
|
||||
BN_CTX_free(ctx);
|
||||
|
||||
return ret;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_POINT_set_compressed_coordinates);
|
||||
|
||||
int
|
||||
EC_POINT_set_compressed_coordinates_GFp(const EC_GROUP *group, EC_POINT *point,
|
||||
const BIGNUM *x, int y_bit, BN_CTX *ctx)
|
||||
{
|
||||
return EC_POINT_set_compressed_coordinates(group, point, x, y_bit, ctx);
|
||||
}
|
||||
|
||||
size_t
|
||||
EC_POINT_point2oct(const EC_GROUP *group, const EC_POINT *point,
|
||||
point_conversion_form_t form, unsigned char *buf, size_t len,
|
||||
BN_CTX *ctx_in)
|
||||
{
|
||||
BN_CTX *ctx;
|
||||
size_t ret = 0;
|
||||
|
||||
if ((ctx = ctx_in) == NULL)
|
||||
ctx = BN_CTX_new();
|
||||
if (ctx == NULL)
|
||||
goto err;
|
||||
|
||||
if (group->meth->point2oct == NULL) {
|
||||
ECerror(ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
|
||||
goto err;
|
||||
}
|
||||
if (group->meth != point->meth) {
|
||||
ECerror(EC_R_INCOMPATIBLE_OBJECTS);
|
||||
goto err;
|
||||
}
|
||||
ret = group->meth->point2oct(group, point, form, buf, len, ctx);
|
||||
|
||||
err:
|
||||
if (ctx != ctx_in)
|
||||
BN_CTX_free(ctx);
|
||||
|
||||
return ret;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_POINT_point2oct);
|
||||
|
||||
int
|
||||
EC_POINT_oct2point(const EC_GROUP *group, EC_POINT *point,
|
||||
const unsigned char *buf, size_t len, BN_CTX *ctx_in)
|
||||
{
|
||||
BN_CTX *ctx;
|
||||
int ret = 0;
|
||||
|
||||
if ((ctx = ctx_in) == NULL)
|
||||
ctx = BN_CTX_new();
|
||||
if (ctx == NULL)
|
||||
goto err;
|
||||
|
||||
if (group->meth->oct2point == NULL) {
|
||||
ECerror(ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
|
||||
goto err;
|
||||
}
|
||||
if (group->meth != point->meth) {
|
||||
ECerror(EC_R_INCOMPATIBLE_OBJECTS);
|
||||
goto err;
|
||||
}
|
||||
ret = group->meth->oct2point(group, point, buf, len, ctx);
|
||||
|
||||
err:
|
||||
if (ctx != ctx_in)
|
||||
BN_CTX_free(ctx);
|
||||
|
||||
return ret;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_POINT_oct2point);
|
||||
524
crypto/ec/ec_pmeth.c
Normal file
524
crypto/ec/ec_pmeth.c
Normal file
@@ -0,0 +1,524 @@
|
||||
/* $OpenBSD: ec_pmeth.c,v 1.19 2023/07/28 15:50:33 tb Exp $ */
|
||||
/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
|
||||
* project 2006.
|
||||
*/
|
||||
/* ====================================================================
|
||||
* Copyright (c) 2006 The OpenSSL Project. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in
|
||||
* the documentation and/or other materials provided with the
|
||||
* distribution.
|
||||
*
|
||||
* 3. All advertising materials mentioning features or use of this
|
||||
* software must display the following acknowledgment:
|
||||
* "This product includes software developed by the OpenSSL Project
|
||||
* for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
|
||||
*
|
||||
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
|
||||
* endorse or promote products derived from this software without
|
||||
* prior written permission. For written permission, please contact
|
||||
* licensing@OpenSSL.org.
|
||||
*
|
||||
* 5. Products derived from this software may not be called "OpenSSL"
|
||||
* nor may "OpenSSL" appear in their names without prior written
|
||||
* permission of the OpenSSL Project.
|
||||
*
|
||||
* 6. Redistributions of any form whatsoever must retain the following
|
||||
* acknowledgment:
|
||||
* "This product includes software developed by the OpenSSL Project
|
||||
* for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
|
||||
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
|
||||
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
||||
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
||||
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
||||
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
||||
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
||||
* OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
* ====================================================================
|
||||
*
|
||||
* This product includes cryptographic software written by Eric Young
|
||||
* (eay@cryptsoft.com). This product includes software written by Tim
|
||||
* Hudson (tjh@cryptsoft.com).
|
||||
*
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
|
||||
#include <openssl/asn1t.h>
|
||||
#include <openssl/ec.h>
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/evp.h>
|
||||
#include <openssl/x509.h>
|
||||
|
||||
#include "bn_local.h"
|
||||
#include "ec_local.h"
|
||||
#include "evp_local.h"
|
||||
|
||||
/* EC pkey context structure */
|
||||
|
||||
typedef struct {
|
||||
/* Key and paramgen group */
|
||||
EC_GROUP *gen_group;
|
||||
/* message digest */
|
||||
const EVP_MD *md;
|
||||
/* Duplicate key if custom cofactor needed */
|
||||
EC_KEY *co_key;
|
||||
/* Cofactor mode */
|
||||
signed char cofactor_mode;
|
||||
/* KDF (if any) to use for ECDH */
|
||||
char kdf_type;
|
||||
/* Message digest to use for key derivation */
|
||||
const EVP_MD *kdf_md;
|
||||
/* User key material */
|
||||
unsigned char *kdf_ukm;
|
||||
size_t kdf_ukmlen;
|
||||
/* KDF output length */
|
||||
size_t kdf_outlen;
|
||||
} EC_PKEY_CTX;
|
||||
|
||||
static int
|
||||
pkey_ec_init(EVP_PKEY_CTX *ctx)
|
||||
{
|
||||
EC_PKEY_CTX *dctx;
|
||||
|
||||
if ((dctx = calloc(1, sizeof(EC_PKEY_CTX))) == NULL) {
|
||||
ECerror(ERR_R_MALLOC_FAILURE);
|
||||
return 0;
|
||||
}
|
||||
|
||||
dctx->cofactor_mode = -1;
|
||||
dctx->kdf_type = EVP_PKEY_ECDH_KDF_NONE;
|
||||
|
||||
ctx->data = dctx;
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
static int
|
||||
pkey_ec_copy(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src)
|
||||
{
|
||||
EC_PKEY_CTX *dctx, *sctx;
|
||||
if (!pkey_ec_init(dst))
|
||||
return 0;
|
||||
sctx = src->data;
|
||||
dctx = dst->data;
|
||||
if (sctx->gen_group) {
|
||||
dctx->gen_group = EC_GROUP_dup(sctx->gen_group);
|
||||
if (!dctx->gen_group)
|
||||
return 0;
|
||||
}
|
||||
dctx->md = sctx->md;
|
||||
|
||||
if (sctx->co_key) {
|
||||
dctx->co_key = EC_KEY_dup(sctx->co_key);
|
||||
if (!dctx->co_key)
|
||||
return 0;
|
||||
}
|
||||
dctx->kdf_type = sctx->kdf_type;
|
||||
dctx->kdf_md = sctx->kdf_md;
|
||||
dctx->kdf_outlen = sctx->kdf_outlen;
|
||||
if (sctx->kdf_ukm) {
|
||||
if ((dctx->kdf_ukm = calloc(1, sctx->kdf_ukmlen)) == NULL)
|
||||
return 0;
|
||||
memcpy(dctx->kdf_ukm, sctx->kdf_ukm, sctx->kdf_ukmlen);
|
||||
} else
|
||||
dctx->kdf_ukm = NULL;
|
||||
|
||||
dctx->kdf_ukmlen = sctx->kdf_ukmlen;
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
static void
|
||||
pkey_ec_cleanup(EVP_PKEY_CTX *ctx)
|
||||
{
|
||||
EC_PKEY_CTX *dctx = ctx->data;
|
||||
|
||||
if (dctx != NULL) {
|
||||
EC_GROUP_free(dctx->gen_group);
|
||||
EC_KEY_free(dctx->co_key);
|
||||
free(dctx->kdf_ukm);
|
||||
free(dctx);
|
||||
ctx->data = NULL;
|
||||
}
|
||||
}
|
||||
|
||||
static int
|
||||
pkey_ec_sign(EVP_PKEY_CTX *ctx, unsigned char *sig, size_t *siglen,
|
||||
const unsigned char *tbs, size_t tbslen)
|
||||
{
|
||||
int ret, type;
|
||||
unsigned int sltmp;
|
||||
EC_PKEY_CTX *dctx = ctx->data;
|
||||
EC_KEY *ec = ctx->pkey->pkey.ec;
|
||||
|
||||
if (!sig) {
|
||||
*siglen = ECDSA_size(ec);
|
||||
return 1;
|
||||
} else if (*siglen < (size_t) ECDSA_size(ec)) {
|
||||
ECerror(EC_R_BUFFER_TOO_SMALL);
|
||||
return 0;
|
||||
}
|
||||
if (dctx->md)
|
||||
type = EVP_MD_type(dctx->md);
|
||||
else
|
||||
type = NID_sha1;
|
||||
|
||||
ret = ECDSA_sign(type, tbs, tbslen, sig, &sltmp, ec);
|
||||
if (ret <= 0)
|
||||
return ret;
|
||||
*siglen = (size_t) sltmp;
|
||||
return 1;
|
||||
}
|
||||
|
||||
static int
|
||||
pkey_ec_verify(EVP_PKEY_CTX *ctx,
|
||||
const unsigned char *sig, size_t siglen,
|
||||
const unsigned char *tbs, size_t tbslen)
|
||||
{
|
||||
int ret, type;
|
||||
EC_PKEY_CTX *dctx = ctx->data;
|
||||
EC_KEY *ec = ctx->pkey->pkey.ec;
|
||||
|
||||
if (dctx->md)
|
||||
type = EVP_MD_type(dctx->md);
|
||||
else
|
||||
type = NID_sha1;
|
||||
|
||||
ret = ECDSA_verify(type, tbs, tbslen, sig, siglen, ec);
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
static int
|
||||
pkey_ec_derive(EVP_PKEY_CTX *ctx, unsigned char *key, size_t *keylen)
|
||||
{
|
||||
int ret;
|
||||
size_t outlen;
|
||||
const EC_POINT *pubkey = NULL;
|
||||
EC_KEY *eckey;
|
||||
EC_PKEY_CTX *dctx = ctx->data;
|
||||
|
||||
if (!ctx->pkey || !ctx->peerkey) {
|
||||
ECerror(EC_R_KEYS_NOT_SET);
|
||||
return 0;
|
||||
}
|
||||
|
||||
eckey = dctx->co_key ? dctx->co_key : ctx->pkey->pkey.ec;
|
||||
if (!key) {
|
||||
const EC_GROUP *group;
|
||||
group = EC_KEY_get0_group(eckey);
|
||||
*keylen = (EC_GROUP_get_degree(group) + 7) / 8;
|
||||
return 1;
|
||||
}
|
||||
pubkey = EC_KEY_get0_public_key(ctx->peerkey->pkey.ec);
|
||||
|
||||
/*
|
||||
* NB: unlike PKCS#3 DH, if *outlen is less than maximum size this is
|
||||
* not an error, the result is truncated.
|
||||
*/
|
||||
|
||||
outlen = *keylen;
|
||||
|
||||
ret = ECDH_compute_key(key, outlen, pubkey, eckey, 0);
|
||||
if (ret <= 0)
|
||||
return 0;
|
||||
|
||||
*keylen = ret;
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
static int
|
||||
pkey_ec_kdf_derive(EVP_PKEY_CTX *ctx, unsigned char *key, size_t *keylen)
|
||||
{
|
||||
EC_PKEY_CTX *dctx = ctx->data;
|
||||
unsigned char *ktmp = NULL;
|
||||
size_t ktmplen;
|
||||
int rv = 0;
|
||||
|
||||
if (dctx->kdf_type == EVP_PKEY_ECDH_KDF_NONE)
|
||||
return pkey_ec_derive(ctx, key, keylen);
|
||||
|
||||
if (!key) {
|
||||
*keylen = dctx->kdf_outlen;
|
||||
return 1;
|
||||
}
|
||||
if (*keylen != dctx->kdf_outlen)
|
||||
return 0;
|
||||
if (!pkey_ec_derive(ctx, NULL, &ktmplen))
|
||||
return 0;
|
||||
if ((ktmp = calloc(1, ktmplen)) == NULL) {
|
||||
ECerror(ERR_R_MALLOC_FAILURE);
|
||||
return 0;
|
||||
}
|
||||
if (!pkey_ec_derive(ctx, ktmp, &ktmplen))
|
||||
goto err;
|
||||
/* Do KDF stuff */
|
||||
if (!ecdh_KDF_X9_63(key, *keylen, ktmp, ktmplen, dctx->kdf_ukm,
|
||||
dctx->kdf_ukmlen, dctx->kdf_md))
|
||||
goto err;
|
||||
rv = 1;
|
||||
|
||||
err:
|
||||
freezero(ktmp, ktmplen);
|
||||
|
||||
return rv;
|
||||
}
|
||||
|
||||
static int
|
||||
pkey_ec_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2)
|
||||
{
|
||||
EC_PKEY_CTX *dctx = ctx->data;
|
||||
EC_GROUP *group;
|
||||
|
||||
switch (type) {
|
||||
case EVP_PKEY_CTRL_EC_PARAMGEN_CURVE_NID:
|
||||
group = EC_GROUP_new_by_curve_name(p1);
|
||||
if (group == NULL) {
|
||||
ECerror(EC_R_INVALID_CURVE);
|
||||
return 0;
|
||||
}
|
||||
EC_GROUP_free(dctx->gen_group);
|
||||
dctx->gen_group = group;
|
||||
return 1;
|
||||
|
||||
case EVP_PKEY_CTRL_EC_PARAM_ENC:
|
||||
if (!dctx->gen_group) {
|
||||
ECerror(EC_R_NO_PARAMETERS_SET);
|
||||
return 0;
|
||||
}
|
||||
EC_GROUP_set_asn1_flag(dctx->gen_group, p1);
|
||||
return 1;
|
||||
|
||||
case EVP_PKEY_CTRL_EC_ECDH_COFACTOR:
|
||||
if (p1 == -2) {
|
||||
if (dctx->cofactor_mode != -1)
|
||||
return dctx->cofactor_mode;
|
||||
else {
|
||||
EC_KEY *ec_key = ctx->pkey->pkey.ec;
|
||||
return EC_KEY_get_flags(ec_key) & EC_FLAG_COFACTOR_ECDH ? 1 : 0;
|
||||
}
|
||||
} else if (p1 < -1 || p1 > 1)
|
||||
return -2;
|
||||
dctx->cofactor_mode = p1;
|
||||
if (p1 != -1) {
|
||||
EC_KEY *ec_key = ctx->pkey->pkey.ec;
|
||||
if (!ec_key->group)
|
||||
return -2;
|
||||
/* If cofactor is 1 cofactor mode does nothing */
|
||||
if (BN_is_one(&ec_key->group->cofactor))
|
||||
return 1;
|
||||
if (!dctx->co_key) {
|
||||
dctx->co_key = EC_KEY_dup(ec_key);
|
||||
if (!dctx->co_key)
|
||||
return 0;
|
||||
}
|
||||
if (p1)
|
||||
EC_KEY_set_flags(dctx->co_key, EC_FLAG_COFACTOR_ECDH);
|
||||
else
|
||||
EC_KEY_clear_flags(dctx->co_key, EC_FLAG_COFACTOR_ECDH);
|
||||
} else {
|
||||
EC_KEY_free(dctx->co_key);
|
||||
dctx->co_key = NULL;
|
||||
}
|
||||
return 1;
|
||||
|
||||
case EVP_PKEY_CTRL_EC_KDF_TYPE:
|
||||
if (p1 == -2)
|
||||
return dctx->kdf_type;
|
||||
if (p1 != EVP_PKEY_ECDH_KDF_NONE && p1 != EVP_PKEY_ECDH_KDF_X9_63)
|
||||
return -2;
|
||||
dctx->kdf_type = p1;
|
||||
return 1;
|
||||
|
||||
case EVP_PKEY_CTRL_EC_KDF_MD:
|
||||
dctx->kdf_md = p2;
|
||||
return 1;
|
||||
|
||||
case EVP_PKEY_CTRL_GET_EC_KDF_MD:
|
||||
*(const EVP_MD **)p2 = dctx->kdf_md;
|
||||
return 1;
|
||||
|
||||
case EVP_PKEY_CTRL_EC_KDF_OUTLEN:
|
||||
if (p1 <= 0)
|
||||
return -2;
|
||||
dctx->kdf_outlen = (size_t)p1;
|
||||
return 1;
|
||||
|
||||
case EVP_PKEY_CTRL_GET_EC_KDF_OUTLEN:
|
||||
*(int *)p2 = dctx->kdf_outlen;
|
||||
return 1;
|
||||
|
||||
case EVP_PKEY_CTRL_EC_KDF_UKM:
|
||||
free(dctx->kdf_ukm);
|
||||
dctx->kdf_ukm = p2;
|
||||
if (p2)
|
||||
dctx->kdf_ukmlen = p1;
|
||||
else
|
||||
dctx->kdf_ukmlen = 0;
|
||||
return 1;
|
||||
|
||||
case EVP_PKEY_CTRL_GET_EC_KDF_UKM:
|
||||
*(unsigned char **)p2 = dctx->kdf_ukm;
|
||||
return dctx->kdf_ukmlen;
|
||||
|
||||
case EVP_PKEY_CTRL_MD:
|
||||
/* RFC 3279, RFC 5758 and NIST CSOR. */
|
||||
if (EVP_MD_type((const EVP_MD *) p2) != NID_sha1 &&
|
||||
EVP_MD_type((const EVP_MD *) p2) != NID_ecdsa_with_SHA1 &&
|
||||
EVP_MD_type((const EVP_MD *) p2) != NID_sha224 &&
|
||||
EVP_MD_type((const EVP_MD *) p2) != NID_sha256 &&
|
||||
EVP_MD_type((const EVP_MD *) p2) != NID_sha384 &&
|
||||
EVP_MD_type((const EVP_MD *) p2) != NID_sha512 &&
|
||||
EVP_MD_type((const EVP_MD *) p2) != NID_sha3_224 &&
|
||||
EVP_MD_type((const EVP_MD *) p2) != NID_sha3_256 &&
|
||||
EVP_MD_type((const EVP_MD *) p2) != NID_sha3_384 &&
|
||||
EVP_MD_type((const EVP_MD *) p2) != NID_sha3_512) {
|
||||
ECerror(EC_R_INVALID_DIGEST_TYPE);
|
||||
return 0;
|
||||
}
|
||||
dctx->md = p2;
|
||||
return 1;
|
||||
|
||||
case EVP_PKEY_CTRL_GET_MD:
|
||||
*(const EVP_MD **)p2 = dctx->md;
|
||||
return 1;
|
||||
|
||||
case EVP_PKEY_CTRL_PEER_KEY:
|
||||
/* Default behaviour is OK */
|
||||
case EVP_PKEY_CTRL_DIGESTINIT:
|
||||
case EVP_PKEY_CTRL_PKCS7_SIGN:
|
||||
case EVP_PKEY_CTRL_CMS_SIGN:
|
||||
return 1;
|
||||
|
||||
default:
|
||||
return -2;
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
static int
|
||||
pkey_ec_ctrl_str(EVP_PKEY_CTX *ctx, const char *type, const char *value)
|
||||
{
|
||||
if (!strcmp(type, "ec_paramgen_curve")) {
|
||||
int nid;
|
||||
nid = EC_curve_nist2nid(value);
|
||||
if (nid == NID_undef)
|
||||
nid = OBJ_sn2nid(value);
|
||||
if (nid == NID_undef)
|
||||
nid = OBJ_ln2nid(value);
|
||||
if (nid == NID_undef) {
|
||||
ECerror(EC_R_INVALID_CURVE);
|
||||
return 0;
|
||||
}
|
||||
return EVP_PKEY_CTX_set_ec_paramgen_curve_nid(ctx, nid);
|
||||
} else if (strcmp(type, "ec_param_enc") == 0) {
|
||||
int param_enc;
|
||||
if (strcmp(value, "explicit") == 0)
|
||||
param_enc = 0;
|
||||
else if (strcmp(value, "named_curve") == 0)
|
||||
param_enc = OPENSSL_EC_NAMED_CURVE;
|
||||
else
|
||||
return -2;
|
||||
return EVP_PKEY_CTX_set_ec_param_enc(ctx, param_enc);
|
||||
} else if (strcmp(type, "ecdh_kdf_md") == 0) {
|
||||
const EVP_MD *md;
|
||||
if ((md = EVP_get_digestbyname(value)) == NULL) {
|
||||
ECerror(EC_R_INVALID_DIGEST);
|
||||
return 0;
|
||||
}
|
||||
return EVP_PKEY_CTX_set_ecdh_kdf_md(ctx, md);
|
||||
} else if (strcmp(type, "ecdh_cofactor_mode") == 0) {
|
||||
int co_mode;
|
||||
co_mode = atoi(value);
|
||||
return EVP_PKEY_CTX_set_ecdh_cofactor_mode(ctx, co_mode);
|
||||
}
|
||||
return -2;
|
||||
}
|
||||
|
||||
static int
|
||||
pkey_ec_paramgen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)
|
||||
{
|
||||
EC_KEY *ec = NULL;
|
||||
EC_PKEY_CTX *dctx = ctx->data;
|
||||
int ret = 0;
|
||||
if (dctx->gen_group == NULL) {
|
||||
ECerror(EC_R_NO_PARAMETERS_SET);
|
||||
return 0;
|
||||
}
|
||||
ec = EC_KEY_new();
|
||||
if (!ec)
|
||||
return 0;
|
||||
ret = EC_KEY_set_group(ec, dctx->gen_group);
|
||||
if (ret)
|
||||
EVP_PKEY_assign_EC_KEY(pkey, ec);
|
||||
else
|
||||
EC_KEY_free(ec);
|
||||
return ret;
|
||||
}
|
||||
|
||||
static int
|
||||
pkey_ec_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)
|
||||
{
|
||||
EC_KEY *ec = NULL;
|
||||
EC_PKEY_CTX *dctx = ctx->data;
|
||||
|
||||
if (ctx->pkey == NULL && dctx->gen_group == NULL) {
|
||||
ECerror(EC_R_NO_PARAMETERS_SET);
|
||||
return 0;
|
||||
}
|
||||
ec = EC_KEY_new();
|
||||
if (ec == NULL)
|
||||
return 0;
|
||||
if (!EVP_PKEY_assign_EC_KEY(pkey, ec)) {
|
||||
EC_KEY_free(ec);
|
||||
return 0;
|
||||
}
|
||||
/* Note: if error is returned, we count on caller to free pkey->pkey.ec */
|
||||
if (ctx->pkey != NULL) {
|
||||
if (!EVP_PKEY_copy_parameters(pkey, ctx->pkey))
|
||||
return 0;
|
||||
} else {
|
||||
if (!EC_KEY_set_group(ec, dctx->gen_group))
|
||||
return 0;
|
||||
}
|
||||
|
||||
return EC_KEY_generate_key(ec);
|
||||
}
|
||||
|
||||
const EVP_PKEY_METHOD ec_pkey_meth = {
|
||||
.pkey_id = EVP_PKEY_EC,
|
||||
|
||||
.init = pkey_ec_init,
|
||||
.copy = pkey_ec_copy,
|
||||
.cleanup = pkey_ec_cleanup,
|
||||
|
||||
.paramgen = pkey_ec_paramgen,
|
||||
|
||||
.keygen = pkey_ec_keygen,
|
||||
|
||||
.sign = pkey_ec_sign,
|
||||
|
||||
.verify = pkey_ec_verify,
|
||||
|
||||
.derive = pkey_ec_kdf_derive,
|
||||
|
||||
.ctrl = pkey_ec_ctrl,
|
||||
.ctrl_str = pkey_ec_ctrl_str
|
||||
};
|
||||
182
crypto/ec/ec_print.c
Normal file
182
crypto/ec/ec_print.c
Normal file
@@ -0,0 +1,182 @@
|
||||
/* $OpenBSD: ec_print.c,v 1.13 2023/07/07 13:54:45 beck Exp $ */
|
||||
/* ====================================================================
|
||||
* Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in
|
||||
* the documentation and/or other materials provided with the
|
||||
* distribution.
|
||||
*
|
||||
* 3. All advertising materials mentioning features or use of this
|
||||
* software must display the following acknowledgment:
|
||||
* "This product includes software developed by the OpenSSL Project
|
||||
* for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
|
||||
*
|
||||
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
|
||||
* endorse or promote products derived from this software without
|
||||
* prior written permission. For written permission, please contact
|
||||
* openssl-core@openssl.org.
|
||||
*
|
||||
* 5. Products derived from this software may not be called "OpenSSL"
|
||||
* nor may "OpenSSL" appear in their names without prior written
|
||||
* permission of the OpenSSL Project.
|
||||
*
|
||||
* 6. Redistributions of any form whatsoever must retain the following
|
||||
* acknowledgment:
|
||||
* "This product includes software developed by the OpenSSL Project
|
||||
* for use in the OpenSSL Toolkit (http://www.openssl.org/)"
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
|
||||
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
|
||||
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
||||
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
||||
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
||||
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
||||
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
||||
* OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
* ====================================================================
|
||||
*
|
||||
* This product includes cryptographic software written by Eric Young
|
||||
* (eay@cryptsoft.com). This product includes software written by Tim
|
||||
* Hudson (tjh@cryptsoft.com).
|
||||
*
|
||||
*/
|
||||
|
||||
#include <openssl/crypto.h>
|
||||
#include "ec_local.h"
|
||||
|
||||
BIGNUM *
|
||||
EC_POINT_point2bn(const EC_GROUP *group, const EC_POINT *point,
|
||||
point_conversion_form_t form, BIGNUM *ret, BN_CTX *ctx)
|
||||
{
|
||||
size_t buf_len = 0;
|
||||
unsigned char *buf;
|
||||
|
||||
buf_len = EC_POINT_point2oct(group, point, form,
|
||||
NULL, 0, ctx);
|
||||
if (buf_len == 0)
|
||||
return NULL;
|
||||
|
||||
if ((buf = malloc(buf_len)) == NULL)
|
||||
return NULL;
|
||||
|
||||
if (!EC_POINT_point2oct(group, point, form, buf, buf_len, ctx)) {
|
||||
free(buf);
|
||||
return NULL;
|
||||
}
|
||||
ret = BN_bin2bn(buf, buf_len, ret);
|
||||
|
||||
free(buf);
|
||||
|
||||
return ret;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_POINT_point2bn);
|
||||
|
||||
EC_POINT *
|
||||
EC_POINT_bn2point(const EC_GROUP *group,
|
||||
const BIGNUM *bn, EC_POINT *point, BN_CTX *ctx)
|
||||
{
|
||||
size_t buf_len = 0;
|
||||
unsigned char *buf;
|
||||
EC_POINT *ret;
|
||||
|
||||
if ((buf_len = BN_num_bytes(bn)) == 0)
|
||||
return NULL;
|
||||
buf = malloc(buf_len);
|
||||
if (buf == NULL)
|
||||
return NULL;
|
||||
|
||||
if (!BN_bn2bin(bn, buf)) {
|
||||
free(buf);
|
||||
return NULL;
|
||||
}
|
||||
if (point == NULL) {
|
||||
if ((ret = EC_POINT_new(group)) == NULL) {
|
||||
free(buf);
|
||||
return NULL;
|
||||
}
|
||||
} else
|
||||
ret = point;
|
||||
|
||||
if (!EC_POINT_oct2point(group, ret, buf, buf_len, ctx)) {
|
||||
if (point == NULL)
|
||||
EC_POINT_free(ret);
|
||||
free(buf);
|
||||
return NULL;
|
||||
}
|
||||
free(buf);
|
||||
return ret;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_POINT_bn2point);
|
||||
|
||||
static const char *HEX_DIGITS = "0123456789ABCDEF";
|
||||
|
||||
/* the return value must be freed (using free()) */
|
||||
char *
|
||||
EC_POINT_point2hex(const EC_GROUP *group, const EC_POINT *point,
|
||||
point_conversion_form_t form, BN_CTX *ctx)
|
||||
{
|
||||
char *ret, *p;
|
||||
size_t buf_len = 0, i;
|
||||
unsigned char *buf, *pbuf;
|
||||
|
||||
buf_len = EC_POINT_point2oct(group, point, form,
|
||||
NULL, 0, ctx);
|
||||
if (buf_len == 0 || buf_len + 1 == 0)
|
||||
return NULL;
|
||||
|
||||
if ((buf = malloc(buf_len)) == NULL)
|
||||
return NULL;
|
||||
|
||||
if (!EC_POINT_point2oct(group, point, form, buf, buf_len, ctx)) {
|
||||
free(buf);
|
||||
return NULL;
|
||||
}
|
||||
ret = reallocarray(NULL, buf_len + 1, 2);
|
||||
if (ret == NULL) {
|
||||
free(buf);
|
||||
return NULL;
|
||||
}
|
||||
p = ret;
|
||||
pbuf = buf;
|
||||
for (i = buf_len; i > 0; i--) {
|
||||
int v = (int) *(pbuf++);
|
||||
*(p++) = HEX_DIGITS[v >> 4];
|
||||
*(p++) = HEX_DIGITS[v & 0x0F];
|
||||
}
|
||||
*p = '\0';
|
||||
|
||||
free(buf);
|
||||
|
||||
return ret;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_POINT_point2hex);
|
||||
|
||||
EC_POINT *
|
||||
EC_POINT_hex2point(const EC_GROUP *group, const char *buf,
|
||||
EC_POINT *point, BN_CTX *ctx)
|
||||
{
|
||||
EC_POINT *ret = NULL;
|
||||
BIGNUM *tmp_bn = NULL;
|
||||
|
||||
if (BN_hex2bn(&tmp_bn, buf) == 0)
|
||||
return NULL;
|
||||
|
||||
ret = EC_POINT_bn2point(group, tmp_bn, point, ctx);
|
||||
|
||||
BN_free(tmp_bn);
|
||||
|
||||
return ret;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_POINT_hex2point);
|
||||
353
crypto/ec/eck_prn.c
Normal file
353
crypto/ec/eck_prn.c
Normal file
@@ -0,0 +1,353 @@
|
||||
/* $OpenBSD: eck_prn.c,v 1.28 2023/07/07 13:54:45 beck Exp $ */
|
||||
/*
|
||||
* Written by Nils Larsch for the OpenSSL project.
|
||||
*/
|
||||
/* ====================================================================
|
||||
* Copyright (c) 1998-2005 The OpenSSL Project. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in
|
||||
* the documentation and/or other materials provided with the
|
||||
* distribution.
|
||||
*
|
||||
* 3. All advertising materials mentioning features or use of this
|
||||
* software must display the following acknowledgment:
|
||||
* "This product includes software developed by the OpenSSL Project
|
||||
* for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
|
||||
*
|
||||
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
|
||||
* endorse or promote products derived from this software without
|
||||
* prior written permission. For written permission, please contact
|
||||
* openssl-core@openssl.org.
|
||||
*
|
||||
* 5. Products derived from this software may not be called "OpenSSL"
|
||||
* nor may "OpenSSL" appear in their names without prior written
|
||||
* permission of the OpenSSL Project.
|
||||
*
|
||||
* 6. Redistributions of any form whatsoever must retain the following
|
||||
* acknowledgment:
|
||||
* "This product includes software developed by the OpenSSL Project
|
||||
* for use in the OpenSSL Toolkit (http://www.openssl.org/)"
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
|
||||
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
|
||||
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
||||
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
||||
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
||||
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
||||
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
||||
* OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
* ====================================================================
|
||||
*
|
||||
* This product includes cryptographic software written by Eric Young
|
||||
* (eay@cryptsoft.com). This product includes software written by Tim
|
||||
* Hudson (tjh@cryptsoft.com).
|
||||
*
|
||||
*/
|
||||
/* ====================================================================
|
||||
* Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
|
||||
* Portions originally developed by SUN MICROSYSTEMS, INC., and
|
||||
* contributed to the OpenSSL project.
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
|
||||
#include <openssl/bn.h>
|
||||
#include <openssl/ec.h>
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/evp.h>
|
||||
|
||||
#include "ec_local.h"
|
||||
|
||||
int
|
||||
ECPKParameters_print_fp(FILE *fp, const EC_GROUP *x, int off)
|
||||
{
|
||||
BIO *b;
|
||||
int ret;
|
||||
|
||||
if ((b = BIO_new(BIO_s_file())) == NULL) {
|
||||
ECerror(ERR_R_BUF_LIB);
|
||||
return (0);
|
||||
}
|
||||
BIO_set_fp(b, fp, BIO_NOCLOSE);
|
||||
ret = ECPKParameters_print(b, x, off);
|
||||
BIO_free(b);
|
||||
return (ret);
|
||||
}
|
||||
LCRYPTO_ALIAS(ECPKParameters_print_fp);
|
||||
|
||||
int
|
||||
EC_KEY_print_fp(FILE *fp, const EC_KEY *x, int off)
|
||||
{
|
||||
BIO *b;
|
||||
int ret;
|
||||
|
||||
if ((b = BIO_new(BIO_s_file())) == NULL) {
|
||||
ECerror(ERR_R_BIO_LIB);
|
||||
return (0);
|
||||
}
|
||||
BIO_set_fp(b, fp, BIO_NOCLOSE);
|
||||
ret = EC_KEY_print(b, x, off);
|
||||
BIO_free(b);
|
||||
return (ret);
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_print_fp);
|
||||
|
||||
int
|
||||
ECParameters_print_fp(FILE *fp, const EC_KEY *x)
|
||||
{
|
||||
BIO *b;
|
||||
int ret;
|
||||
|
||||
if ((b = BIO_new(BIO_s_file())) == NULL) {
|
||||
ECerror(ERR_R_BIO_LIB);
|
||||
return (0);
|
||||
}
|
||||
BIO_set_fp(b, fp, BIO_NOCLOSE);
|
||||
ret = ECParameters_print(b, x);
|
||||
BIO_free(b);
|
||||
return (ret);
|
||||
}
|
||||
LCRYPTO_ALIAS(ECParameters_print_fp);
|
||||
|
||||
int
|
||||
EC_KEY_print(BIO *bp, const EC_KEY *x, int off)
|
||||
{
|
||||
EVP_PKEY *pk;
|
||||
int ret = 0;
|
||||
|
||||
if ((pk = EVP_PKEY_new()) == NULL)
|
||||
goto err;
|
||||
|
||||
if (!EVP_PKEY_set1_EC_KEY(pk, (EC_KEY *) x))
|
||||
goto err;
|
||||
|
||||
ret = EVP_PKEY_print_private(bp, pk, off, NULL);
|
||||
err:
|
||||
EVP_PKEY_free(pk);
|
||||
return ret;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_KEY_print);
|
||||
|
||||
int
|
||||
ECParameters_print(BIO *bp, const EC_KEY *x)
|
||||
{
|
||||
EVP_PKEY *pk;
|
||||
int ret = 0;
|
||||
|
||||
if ((pk = EVP_PKEY_new()) == NULL)
|
||||
goto err;
|
||||
|
||||
if (!EVP_PKEY_set1_EC_KEY(pk, (EC_KEY *) x))
|
||||
goto err;
|
||||
|
||||
ret = EVP_PKEY_print_params(bp, pk, 4, NULL);
|
||||
err:
|
||||
EVP_PKEY_free(pk);
|
||||
return ret;
|
||||
}
|
||||
LCRYPTO_ALIAS(ECParameters_print);
|
||||
|
||||
static int
|
||||
print_bin(BIO *fp, const char *str, const unsigned char *num,
|
||||
size_t len, int off);
|
||||
|
||||
static int
|
||||
ecpk_print_asn1_parameters(BIO *bp, const EC_GROUP *group, int off)
|
||||
{
|
||||
const char *nist_name;
|
||||
int nid;
|
||||
int ret = 0;
|
||||
|
||||
if (!BIO_indent(bp, off, 128)) {
|
||||
ECerror(ERR_R_BIO_LIB);
|
||||
goto err;
|
||||
}
|
||||
|
||||
if ((nid = EC_GROUP_get_curve_name(group)) == NID_undef) {
|
||||
ECerror(ERR_R_INTERNAL_ERROR);
|
||||
goto err;
|
||||
}
|
||||
|
||||
if (BIO_printf(bp, "ASN1 OID: %s\n", OBJ_nid2sn(nid)) <= 0) {
|
||||
ECerror(ERR_R_BIO_LIB);
|
||||
goto err;
|
||||
}
|
||||
|
||||
if ((nist_name = EC_curve_nid2nist(nid)) != NULL) {
|
||||
if (!BIO_indent(bp, off, 128)) {
|
||||
ECerror(ERR_R_BIO_LIB);
|
||||
goto err;
|
||||
}
|
||||
if (BIO_printf(bp, "NIST CURVE: %s\n", nist_name) <= 0) {
|
||||
ECerror(ERR_R_BIO_LIB);
|
||||
goto err;
|
||||
}
|
||||
}
|
||||
|
||||
ret = 1;
|
||||
err:
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
static int
|
||||
ecpk_print_explicit_parameters(BIO *bp, const EC_GROUP *group, int off)
|
||||
{
|
||||
BN_CTX *ctx = NULL;
|
||||
const BIGNUM *order;
|
||||
BIGNUM *p, *a, *b, *cofactor;
|
||||
BIGNUM *gen = NULL;
|
||||
const EC_POINT *generator;
|
||||
const char *conversion_form;
|
||||
const unsigned char *seed;
|
||||
size_t seed_len;
|
||||
point_conversion_form_t form;
|
||||
int nid;
|
||||
int ret = 0;
|
||||
|
||||
if ((ctx = BN_CTX_new()) == NULL) {
|
||||
ECerror(ERR_R_MALLOC_FAILURE);
|
||||
goto err;
|
||||
}
|
||||
|
||||
BN_CTX_start(ctx);
|
||||
|
||||
if ((p = BN_CTX_get(ctx)) == NULL)
|
||||
goto err;
|
||||
if ((a = BN_CTX_get(ctx)) == NULL)
|
||||
goto err;
|
||||
if ((b = BN_CTX_get(ctx)) == NULL)
|
||||
goto err;
|
||||
if ((cofactor = BN_CTX_get(ctx)) == NULL)
|
||||
goto err;
|
||||
if ((gen = BN_CTX_get(ctx)) == NULL)
|
||||
goto err;
|
||||
|
||||
if (!EC_GROUP_get_curve(group, p, a, b, ctx)) {
|
||||
ECerror(ERR_R_EC_LIB);
|
||||
goto err;
|
||||
}
|
||||
if ((order = EC_GROUP_get0_order(group)) == NULL) {
|
||||
ECerror(ERR_R_EC_LIB);
|
||||
goto err;
|
||||
}
|
||||
if (!EC_GROUP_get_cofactor(group, cofactor, NULL)) {
|
||||
ECerror(ERR_R_EC_LIB);
|
||||
goto err;
|
||||
}
|
||||
|
||||
if ((generator = EC_GROUP_get0_generator(group)) == NULL) {
|
||||
ECerror(ERR_R_EC_LIB);
|
||||
goto err;
|
||||
}
|
||||
form = EC_GROUP_get_point_conversion_form(group);
|
||||
if (EC_POINT_point2bn(group, generator, form, gen, ctx) == NULL) {
|
||||
ECerror(ERR_R_EC_LIB);
|
||||
goto err;
|
||||
}
|
||||
|
||||
if (!BIO_indent(bp, off, 128))
|
||||
goto err;
|
||||
|
||||
nid = EC_METHOD_get_field_type(EC_GROUP_method_of(group));
|
||||
if (BIO_printf(bp, "Field Type: %s\n", OBJ_nid2sn(nid)) <= 0)
|
||||
goto err;
|
||||
|
||||
if (!bn_printf(bp, p, off, "Prime:"))
|
||||
goto err;
|
||||
if (!bn_printf(bp, a, off, "A: "))
|
||||
goto err;
|
||||
if (!bn_printf(bp, b, off, "B: "))
|
||||
goto err;
|
||||
|
||||
if (form == POINT_CONVERSION_COMPRESSED)
|
||||
conversion_form = "compressed";
|
||||
else if (form == POINT_CONVERSION_UNCOMPRESSED)
|
||||
conversion_form = "uncompressed";
|
||||
else if (form == POINT_CONVERSION_HYBRID)
|
||||
conversion_form = "hybrid";
|
||||
else
|
||||
conversion_form = "unknown";
|
||||
if (!bn_printf(bp, gen, off, "Generator (%s):", conversion_form))
|
||||
goto err;
|
||||
|
||||
if (!bn_printf(bp, order, off, "Order: "))
|
||||
goto err;
|
||||
if (!bn_printf(bp, cofactor, off, "Cofactor: "))
|
||||
goto err;
|
||||
if ((seed = EC_GROUP_get0_seed(group)) != NULL) {
|
||||
seed_len = EC_GROUP_get_seed_len(group);
|
||||
if (!print_bin(bp, "Seed:", seed, seed_len, off))
|
||||
goto err;
|
||||
}
|
||||
|
||||
ret = 1;
|
||||
err:
|
||||
BN_CTX_end(ctx);
|
||||
BN_CTX_free(ctx);
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
int
|
||||
ECPKParameters_print(BIO *bp, const EC_GROUP *group, int off)
|
||||
{
|
||||
if (group == NULL) {
|
||||
ECerror(ERR_R_PASSED_NULL_PARAMETER);
|
||||
return 0;
|
||||
}
|
||||
|
||||
if (EC_GROUP_get_asn1_flag(group))
|
||||
return ecpk_print_asn1_parameters(bp, group, off);
|
||||
|
||||
return ecpk_print_explicit_parameters(bp, group, off);
|
||||
}
|
||||
LCRYPTO_ALIAS(ECPKParameters_print);
|
||||
|
||||
static int
|
||||
print_bin(BIO *fp, const char *name, const unsigned char *buf,
|
||||
size_t len, int off)
|
||||
{
|
||||
size_t i;
|
||||
char str[128];
|
||||
|
||||
if (buf == NULL)
|
||||
return 1;
|
||||
if (off) {
|
||||
if (off > 128)
|
||||
off = 128;
|
||||
memset(str, ' ', off);
|
||||
if (BIO_write(fp, str, off) <= 0)
|
||||
return 0;
|
||||
}
|
||||
if (BIO_printf(fp, "%s", name) <= 0)
|
||||
return 0;
|
||||
|
||||
for (i = 0; i < len; i++) {
|
||||
if ((i % 15) == 0) {
|
||||
str[0] = '\n';
|
||||
memset(&(str[1]), ' ', off + 4);
|
||||
if (BIO_write(fp, str, off + 1 + 4) <= 0)
|
||||
return 0;
|
||||
}
|
||||
if (BIO_printf(fp, "%02x%s", buf[i], ((i + 1) == len) ? "" : ":") <= 0)
|
||||
return 0;
|
||||
}
|
||||
if (BIO_write(fp, "\n", 1) <= 0)
|
||||
return 0;
|
||||
|
||||
return 1;
|
||||
}
|
||||
272
crypto/ec/ecp_mont.c
Normal file
272
crypto/ec/ecp_mont.c
Normal file
@@ -0,0 +1,272 @@
|
||||
/* $OpenBSD: ecp_mont.c,v 1.30 2023/07/07 13:54:45 beck Exp $ */
|
||||
/*
|
||||
* Originally written by Bodo Moeller for the OpenSSL project.
|
||||
*/
|
||||
/* ====================================================================
|
||||
* Copyright (c) 1998-2001 The OpenSSL Project. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in
|
||||
* the documentation and/or other materials provided with the
|
||||
* distribution.
|
||||
*
|
||||
* 3. All advertising materials mentioning features or use of this
|
||||
* software must display the following acknowledgment:
|
||||
* "This product includes software developed by the OpenSSL Project
|
||||
* for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
|
||||
*
|
||||
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
|
||||
* endorse or promote products derived from this software without
|
||||
* prior written permission. For written permission, please contact
|
||||
* openssl-core@openssl.org.
|
||||
*
|
||||
* 5. Products derived from this software may not be called "OpenSSL"
|
||||
* nor may "OpenSSL" appear in their names without prior written
|
||||
* permission of the OpenSSL Project.
|
||||
*
|
||||
* 6. Redistributions of any form whatsoever must retain the following
|
||||
* acknowledgment:
|
||||
* "This product includes software developed by the OpenSSL Project
|
||||
* for use in the OpenSSL Toolkit (http://www.openssl.org/)"
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
|
||||
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
|
||||
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
||||
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
||||
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
||||
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
||||
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
||||
* OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
* ====================================================================
|
||||
*
|
||||
* This product includes cryptographic software written by Eric Young
|
||||
* (eay@cryptsoft.com). This product includes software written by Tim
|
||||
* Hudson (tjh@cryptsoft.com).
|
||||
*
|
||||
*/
|
||||
/* ====================================================================
|
||||
* Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
|
||||
* Portions of this software developed by SUN MICROSYSTEMS, INC.,
|
||||
* and contributed to the OpenSSL project.
|
||||
*/
|
||||
|
||||
#include <openssl/err.h>
|
||||
|
||||
#include "ec_local.h"
|
||||
|
||||
static void
|
||||
ec_GFp_mont_group_clear(EC_GROUP *group)
|
||||
{
|
||||
BN_MONT_CTX_free(group->mont_ctx);
|
||||
group->mont_ctx = NULL;
|
||||
|
||||
BN_free(group->mont_one);
|
||||
group->mont_one = NULL;
|
||||
}
|
||||
|
||||
static int
|
||||
ec_GFp_mont_group_init(EC_GROUP *group)
|
||||
{
|
||||
int ok;
|
||||
|
||||
ok = ec_GFp_simple_group_init(group);
|
||||
group->mont_ctx = NULL;
|
||||
group->mont_one = NULL;
|
||||
return ok;
|
||||
}
|
||||
|
||||
static void
|
||||
ec_GFp_mont_group_finish(EC_GROUP *group)
|
||||
{
|
||||
ec_GFp_mont_group_clear(group);
|
||||
ec_GFp_simple_group_finish(group);
|
||||
}
|
||||
|
||||
static int
|
||||
ec_GFp_mont_group_copy(EC_GROUP *dest, const EC_GROUP *src)
|
||||
{
|
||||
ec_GFp_mont_group_clear(dest);
|
||||
|
||||
if (!ec_GFp_simple_group_copy(dest, src))
|
||||
return 0;
|
||||
|
||||
if (src->mont_ctx != NULL) {
|
||||
dest->mont_ctx = BN_MONT_CTX_new();
|
||||
if (dest->mont_ctx == NULL)
|
||||
return 0;
|
||||
if (!BN_MONT_CTX_copy(dest->mont_ctx, src->mont_ctx))
|
||||
goto err;
|
||||
}
|
||||
if (src->mont_one != NULL) {
|
||||
dest->mont_one = BN_dup(src->mont_one);
|
||||
if (dest->mont_one == NULL)
|
||||
goto err;
|
||||
}
|
||||
return 1;
|
||||
|
||||
err:
|
||||
if (dest->mont_ctx != NULL) {
|
||||
BN_MONT_CTX_free(dest->mont_ctx);
|
||||
dest->mont_ctx = NULL;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
static int
|
||||
ec_GFp_mont_group_set_curve(EC_GROUP *group, const BIGNUM *p, const BIGNUM *a,
|
||||
const BIGNUM *b, BN_CTX *ctx)
|
||||
{
|
||||
BN_MONT_CTX *mont = NULL;
|
||||
BIGNUM *one = NULL;
|
||||
int ret = 0;
|
||||
|
||||
ec_GFp_mont_group_clear(group);
|
||||
|
||||
mont = BN_MONT_CTX_new();
|
||||
if (mont == NULL)
|
||||
goto err;
|
||||
if (!BN_MONT_CTX_set(mont, p, ctx)) {
|
||||
ECerror(ERR_R_BN_LIB);
|
||||
goto err;
|
||||
}
|
||||
one = BN_new();
|
||||
if (one == NULL)
|
||||
goto err;
|
||||
if (!BN_to_montgomery(one, BN_value_one(), mont, ctx))
|
||||
goto err;
|
||||
|
||||
group->mont_ctx = mont;
|
||||
mont = NULL;
|
||||
group->mont_one = one;
|
||||
one = NULL;
|
||||
|
||||
ret = ec_GFp_simple_group_set_curve(group, p, a, b, ctx);
|
||||
if (!ret)
|
||||
ec_GFp_mont_group_clear(group);
|
||||
|
||||
err:
|
||||
BN_MONT_CTX_free(mont);
|
||||
BN_free(one);
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
static int
|
||||
ec_GFp_mont_field_mul(const EC_GROUP *group, BIGNUM *r, const BIGNUM *a,
|
||||
const BIGNUM *b, BN_CTX *ctx)
|
||||
{
|
||||
if (group->mont_ctx == NULL) {
|
||||
ECerror(EC_R_NOT_INITIALIZED);
|
||||
return 0;
|
||||
}
|
||||
return BN_mod_mul_montgomery(r, a, b, group->mont_ctx, ctx);
|
||||
}
|
||||
|
||||
static int
|
||||
ec_GFp_mont_field_sqr(const EC_GROUP *group, BIGNUM *r, const BIGNUM *a,
|
||||
BN_CTX *ctx)
|
||||
{
|
||||
if (group->mont_ctx == NULL) {
|
||||
ECerror(EC_R_NOT_INITIALIZED);
|
||||
return 0;
|
||||
}
|
||||
return BN_mod_mul_montgomery(r, a, a, group->mont_ctx, ctx);
|
||||
}
|
||||
|
||||
static int
|
||||
ec_GFp_mont_field_encode(const EC_GROUP *group, BIGNUM *r, const BIGNUM *a,
|
||||
BN_CTX *ctx)
|
||||
{
|
||||
if (group->mont_ctx == NULL) {
|
||||
ECerror(EC_R_NOT_INITIALIZED);
|
||||
return 0;
|
||||
}
|
||||
return BN_to_montgomery(r, a, group->mont_ctx, ctx);
|
||||
}
|
||||
|
||||
static int
|
||||
ec_GFp_mont_field_decode(const EC_GROUP *group, BIGNUM *r, const BIGNUM *a,
|
||||
BN_CTX *ctx)
|
||||
{
|
||||
if (group->mont_ctx == NULL) {
|
||||
ECerror(EC_R_NOT_INITIALIZED);
|
||||
return 0;
|
||||
}
|
||||
return BN_from_montgomery(r, a, group->mont_ctx, ctx);
|
||||
}
|
||||
|
||||
static int
|
||||
ec_GFp_mont_field_set_to_one(const EC_GROUP *group, BIGNUM *r, BN_CTX *ctx)
|
||||
{
|
||||
if (group->mont_one == NULL) {
|
||||
ECerror(EC_R_NOT_INITIALIZED);
|
||||
return 0;
|
||||
}
|
||||
if (!bn_copy(r, group->mont_one))
|
||||
return 0;
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
static const EC_METHOD ec_GFp_mont_method = {
|
||||
.field_type = NID_X9_62_prime_field,
|
||||
.group_init = ec_GFp_mont_group_init,
|
||||
.group_finish = ec_GFp_mont_group_finish,
|
||||
.group_copy = ec_GFp_mont_group_copy,
|
||||
.group_set_curve = ec_GFp_mont_group_set_curve,
|
||||
.group_get_curve = ec_GFp_simple_group_get_curve,
|
||||
.group_get_degree = ec_GFp_simple_group_get_degree,
|
||||
.group_order_bits = ec_group_simple_order_bits,
|
||||
.group_check_discriminant = ec_GFp_simple_group_check_discriminant,
|
||||
.point_init = ec_GFp_simple_point_init,
|
||||
.point_finish = ec_GFp_simple_point_finish,
|
||||
.point_copy = ec_GFp_simple_point_copy,
|
||||
.point_set_to_infinity = ec_GFp_simple_point_set_to_infinity,
|
||||
.point_set_Jprojective_coordinates =
|
||||
ec_GFp_simple_set_Jprojective_coordinates,
|
||||
.point_get_Jprojective_coordinates =
|
||||
ec_GFp_simple_get_Jprojective_coordinates,
|
||||
.point_set_affine_coordinates =
|
||||
ec_GFp_simple_point_set_affine_coordinates,
|
||||
.point_get_affine_coordinates =
|
||||
ec_GFp_simple_point_get_affine_coordinates,
|
||||
.point_set_compressed_coordinates =
|
||||
ec_GFp_simple_set_compressed_coordinates,
|
||||
.point2oct = ec_GFp_simple_point2oct,
|
||||
.oct2point = ec_GFp_simple_oct2point,
|
||||
.add = ec_GFp_simple_add,
|
||||
.dbl = ec_GFp_simple_dbl,
|
||||
.invert = ec_GFp_simple_invert,
|
||||
.is_at_infinity = ec_GFp_simple_is_at_infinity,
|
||||
.is_on_curve = ec_GFp_simple_is_on_curve,
|
||||
.point_cmp = ec_GFp_simple_cmp,
|
||||
.make_affine = ec_GFp_simple_make_affine,
|
||||
.points_make_affine = ec_GFp_simple_points_make_affine,
|
||||
.mul_generator_ct = ec_GFp_simple_mul_generator_ct,
|
||||
.mul_single_ct = ec_GFp_simple_mul_single_ct,
|
||||
.mul_double_nonct = ec_GFp_simple_mul_double_nonct,
|
||||
.field_mul = ec_GFp_mont_field_mul,
|
||||
.field_sqr = ec_GFp_mont_field_sqr,
|
||||
.field_encode = ec_GFp_mont_field_encode,
|
||||
.field_decode = ec_GFp_mont_field_decode,
|
||||
.field_set_to_one = ec_GFp_mont_field_set_to_one,
|
||||
.blind_coordinates = ec_GFp_simple_blind_coordinates,
|
||||
};
|
||||
|
||||
const EC_METHOD *
|
||||
EC_GFp_mont_method(void)
|
||||
{
|
||||
return &ec_GFp_mont_method;
|
||||
}
|
||||
LCRYPTO_ALIAS(EC_GFp_mont_method);
|
||||
365
crypto/ec/ecp_oct.c
Normal file
365
crypto/ec/ecp_oct.c
Normal file
@@ -0,0 +1,365 @@
|
||||
/* $OpenBSD: ecp_oct.c,v 1.21 2023/04/18 18:29:32 tb Exp $ */
|
||||
/* Includes code written by Lenka Fibikova <fibikova@exp-math.uni-essen.de>
|
||||
* for the OpenSSL project.
|
||||
* Includes code written by Bodo Moeller for the OpenSSL project.
|
||||
*/
|
||||
/* ====================================================================
|
||||
* Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in
|
||||
* the documentation and/or other materials provided with the
|
||||
* distribution.
|
||||
*
|
||||
* 3. All advertising materials mentioning features or use of this
|
||||
* software must display the following acknowledgment:
|
||||
* "This product includes software developed by the OpenSSL Project
|
||||
* for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
|
||||
*
|
||||
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
|
||||
* endorse or promote products derived from this software without
|
||||
* prior written permission. For written permission, please contact
|
||||
* openssl-core@openssl.org.
|
||||
*
|
||||
* 5. Products derived from this software may not be called "OpenSSL"
|
||||
* nor may "OpenSSL" appear in their names without prior written
|
||||
* permission of the OpenSSL Project.
|
||||
*
|
||||
* 6. Redistributions of any form whatsoever must retain the following
|
||||
* acknowledgment:
|
||||
* "This product includes software developed by the OpenSSL Project
|
||||
* for use in the OpenSSL Toolkit (http://www.openssl.org/)"
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
|
||||
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
|
||||
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
||||
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
||||
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
||||
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
||||
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
||||
* OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
* ====================================================================
|
||||
*
|
||||
* This product includes cryptographic software written by Eric Young
|
||||
* (eay@cryptsoft.com). This product includes software written by Tim
|
||||
* Hudson (tjh@cryptsoft.com).
|
||||
*
|
||||
*/
|
||||
/* ====================================================================
|
||||
* Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
|
||||
* Portions of this software developed by SUN MICROSYSTEMS, INC.,
|
||||
* and contributed to the OpenSSL project.
|
||||
*/
|
||||
|
||||
#include <openssl/err.h>
|
||||
|
||||
#include "ec_local.h"
|
||||
|
||||
int
|
||||
ec_GFp_simple_set_compressed_coordinates(const EC_GROUP *group,
|
||||
EC_POINT *point, const BIGNUM *x_, int y_bit, BN_CTX *ctx)
|
||||
{
|
||||
BIGNUM *tmp1, *tmp2, *x, *y;
|
||||
int ret = 0;
|
||||
|
||||
/* clear error queue */
|
||||
ERR_clear_error();
|
||||
|
||||
y_bit = (y_bit != 0);
|
||||
|
||||
BN_CTX_start(ctx);
|
||||
|
||||
if ((tmp1 = BN_CTX_get(ctx)) == NULL)
|
||||
goto err;
|
||||
if ((tmp2 = BN_CTX_get(ctx)) == NULL)
|
||||
goto err;
|
||||
if ((x = BN_CTX_get(ctx)) == NULL)
|
||||
goto err;
|
||||
if ((y = BN_CTX_get(ctx)) == NULL)
|
||||
goto err;
|
||||
|
||||
/*
|
||||
* Recover y. We have a Weierstrass equation y^2 = x^3 + a*x + b, so
|
||||
* y is one of the square roots of x^3 + a*x + b.
|
||||
*/
|
||||
|
||||
/* tmp1 := x^3 */
|
||||
if (!BN_nnmod(x, x_, &group->field, ctx))
|
||||
goto err;
|
||||
if (group->meth->field_decode == NULL) {
|
||||
/* field_{sqr,mul} work on standard representation */
|
||||
if (!group->meth->field_sqr(group, tmp2, x_, ctx))
|
||||
goto err;
|
||||
if (!group->meth->field_mul(group, tmp1, tmp2, x_, ctx))
|
||||
goto err;
|
||||
} else {
|
||||
if (!BN_mod_sqr(tmp2, x_, &group->field, ctx))
|
||||
goto err;
|
||||
if (!BN_mod_mul(tmp1, tmp2, x_, &group->field, ctx))
|
||||
goto err;
|
||||
}
|
||||
|
||||
/* tmp1 := tmp1 + a*x */
|
||||
if (group->a_is_minus3) {
|
||||
if (!BN_mod_lshift1_quick(tmp2, x, &group->field))
|
||||
goto err;
|
||||
if (!BN_mod_add_quick(tmp2, tmp2, x, &group->field))
|
||||
goto err;
|
||||
if (!BN_mod_sub_quick(tmp1, tmp1, tmp2, &group->field))
|
||||
goto err;
|
||||
} else {
|
||||
if (group->meth->field_decode) {
|
||||
if (!group->meth->field_decode(group, tmp2, &group->a, ctx))
|
||||
goto err;
|
||||
if (!BN_mod_mul(tmp2, tmp2, x, &group->field, ctx))
|
||||
goto err;
|
||||
} else {
|
||||
/* field_mul works on standard representation */
|
||||
if (!group->meth->field_mul(group, tmp2, &group->a, x, ctx))
|
||||
goto err;
|
||||
}
|
||||
|
||||
if (!BN_mod_add_quick(tmp1, tmp1, tmp2, &group->field))
|
||||
goto err;
|
||||
}
|
||||
|
||||
/* tmp1 := tmp1 + b */
|
||||
if (group->meth->field_decode != NULL) {
|
||||
if (!group->meth->field_decode(group, tmp2, &group->b, ctx))
|
||||
goto err;
|
||||
if (!BN_mod_add_quick(tmp1, tmp1, tmp2, &group->field))
|
||||
goto err;
|
||||
} else {
|
||||
if (!BN_mod_add_quick(tmp1, tmp1, &group->b, &group->field))
|
||||
goto err;
|
||||
}
|
||||
|
||||
if (!BN_mod_sqrt(y, tmp1, &group->field, ctx)) {
|
||||
unsigned long err = ERR_peek_last_error();
|
||||
|
||||
if (ERR_GET_LIB(err) == ERR_LIB_BN && ERR_GET_REASON(err) == BN_R_NOT_A_SQUARE) {
|
||||
ERR_clear_error();
|
||||
ECerror(EC_R_INVALID_COMPRESSED_POINT);
|
||||
} else
|
||||
ECerror(ERR_R_BN_LIB);
|
||||
goto err;
|
||||
}
|
||||
if (y_bit != BN_is_odd(y)) {
|
||||
if (BN_is_zero(y)) {
|
||||
ECerror(EC_R_INVALID_COMPRESSION_BIT);
|
||||
goto err;
|
||||
}
|
||||
if (!BN_usub(y, &group->field, y))
|
||||
goto err;
|
||||
if (y_bit != BN_is_odd(y)) {
|
||||
ECerror(ERR_R_INTERNAL_ERROR);
|
||||
goto err;
|
||||
}
|
||||
}
|
||||
if (!EC_POINT_set_affine_coordinates(group, point, x, y, ctx))
|
||||
goto err;
|
||||
|
||||
ret = 1;
|
||||
|
||||
err:
|
||||
BN_CTX_end(ctx);
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
size_t
|
||||
ec_GFp_simple_point2oct(const EC_GROUP *group, const EC_POINT *point,
|
||||
point_conversion_form_t form, unsigned char *buf, size_t len, BN_CTX *ctx)
|
||||
{
|
||||
BIGNUM *x, *y;
|
||||
size_t field_len, i, skip;
|
||||
size_t ret = 0;
|
||||
|
||||
if (form != POINT_CONVERSION_COMPRESSED &&
|
||||
form != POINT_CONVERSION_UNCOMPRESSED &&
|
||||
form != POINT_CONVERSION_HYBRID) {
|
||||
ECerror(EC_R_INVALID_FORM);
|
||||
return 0;
|
||||
}
|
||||
|
||||
if (EC_POINT_is_at_infinity(group, point) > 0) {
|
||||
/* encodes to a single 0 octet */
|
||||
if (buf != NULL) {
|
||||
if (len < 1) {
|
||||
ECerror(EC_R_BUFFER_TOO_SMALL);
|
||||
return 0;
|
||||
}
|
||||
buf[0] = 0;
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
/* ret := required output buffer length */
|
||||
field_len = BN_num_bytes(&group->field);
|
||||
ret = (form == POINT_CONVERSION_COMPRESSED) ? 1 + field_len : 1 + 2 * field_len;
|
||||
|
||||
BN_CTX_start(ctx);
|
||||
|
||||
/* if 'buf' is NULL, just return required length */
|
||||
if (buf != NULL) {
|
||||
if (len < ret) {
|
||||
ECerror(EC_R_BUFFER_TOO_SMALL);
|
||||
goto err;
|
||||
}
|
||||
|
||||
if ((x = BN_CTX_get(ctx)) == NULL)
|
||||
goto err;
|
||||
if ((y = BN_CTX_get(ctx)) == NULL)
|
||||
goto err;
|
||||
|
||||
if (!EC_POINT_get_affine_coordinates(group, point, x, y, ctx))
|
||||
goto err;
|
||||
|
||||
if ((form == POINT_CONVERSION_COMPRESSED || form == POINT_CONVERSION_HYBRID) && BN_is_odd(y))
|
||||
buf[0] = form + 1;
|
||||
else
|
||||
buf[0] = form;
|
||||
|
||||
i = 1;
|
||||
|
||||
skip = field_len - BN_num_bytes(x);
|
||||
if (skip > field_len) {
|
||||
ECerror(ERR_R_INTERNAL_ERROR);
|
||||
goto err;
|
||||
}
|
||||
while (skip > 0) {
|
||||
buf[i++] = 0;
|
||||
skip--;
|
||||
}
|
||||
skip = BN_bn2bin(x, buf + i);
|
||||
i += skip;
|
||||
if (i != 1 + field_len) {
|
||||
ECerror(ERR_R_INTERNAL_ERROR);
|
||||
goto err;
|
||||
}
|
||||
if (form == POINT_CONVERSION_UNCOMPRESSED || form == POINT_CONVERSION_HYBRID) {
|
||||
skip = field_len - BN_num_bytes(y);
|
||||
if (skip > field_len) {
|
||||
ECerror(ERR_R_INTERNAL_ERROR);
|
||||
goto err;
|
||||
}
|
||||
while (skip > 0) {
|
||||
buf[i++] = 0;
|
||||
skip--;
|
||||
}
|
||||
skip = BN_bn2bin(y, buf + i);
|
||||
i += skip;
|
||||
}
|
||||
if (i != ret) {
|
||||
ECerror(ERR_R_INTERNAL_ERROR);
|
||||
goto err;
|
||||
}
|
||||
}
|
||||
|
||||
err:
|
||||
BN_CTX_end(ctx);
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
int
|
||||
ec_GFp_simple_oct2point(const EC_GROUP *group, EC_POINT *point,
|
||||
const unsigned char *buf, size_t len, BN_CTX *ctx)
|
||||
{
|
||||
point_conversion_form_t form;
|
||||
int y_bit;
|
||||
BIGNUM *x, *y;
|
||||
size_t field_len, enc_len;
|
||||
int ret = 0;
|
||||
|
||||
if (len == 0) {
|
||||
ECerror(EC_R_BUFFER_TOO_SMALL);
|
||||
return 0;
|
||||
}
|
||||
form = buf[0];
|
||||
y_bit = form & 1;
|
||||
form = form & ~1U;
|
||||
if ((form != 0) && (form != POINT_CONVERSION_COMPRESSED)
|
||||
&& (form != POINT_CONVERSION_UNCOMPRESSED)
|
||||
&& (form != POINT_CONVERSION_HYBRID)) {
|
||||
ECerror(EC_R_INVALID_ENCODING);
|
||||
return 0;
|
||||
}
|
||||
if ((form == 0 || form == POINT_CONVERSION_UNCOMPRESSED) && y_bit) {
|
||||
ECerror(EC_R_INVALID_ENCODING);
|
||||
return 0;
|
||||
}
|
||||
if (form == 0) {
|
||||
if (len != 1) {
|
||||
ECerror(EC_R_INVALID_ENCODING);
|
||||
return 0;
|
||||
}
|
||||
return EC_POINT_set_to_infinity(group, point);
|
||||
}
|
||||
field_len = BN_num_bytes(&group->field);
|
||||
enc_len = (form == POINT_CONVERSION_COMPRESSED) ? 1 + field_len : 1 + 2 * field_len;
|
||||
|
||||
if (len != enc_len) {
|
||||
ECerror(EC_R_INVALID_ENCODING);
|
||||
return 0;
|
||||
}
|
||||
|
||||
BN_CTX_start(ctx);
|
||||
|
||||
if ((x = BN_CTX_get(ctx)) == NULL)
|
||||
goto err;
|
||||
if ((y = BN_CTX_get(ctx)) == NULL)
|
||||
goto err;
|
||||
|
||||
if (!BN_bin2bn(buf + 1, field_len, x))
|
||||
goto err;
|
||||
if (BN_ucmp(x, &group->field) >= 0) {
|
||||
ECerror(EC_R_INVALID_ENCODING);
|
||||
goto err;
|
||||
}
|
||||
if (form == POINT_CONVERSION_COMPRESSED) {
|
||||
/*
|
||||
* EC_POINT_set_compressed_coordinates checks that the point
|
||||
* is on the curve as required by X9.62.
|
||||
*/
|
||||
if (!EC_POINT_set_compressed_coordinates(group, point, x, y_bit, ctx))
|
||||
goto err;
|
||||
} else {
|
||||
if (!BN_bin2bn(buf + 1 + field_len, field_len, y))
|
||||
goto err;
|
||||
if (BN_ucmp(y, &group->field) >= 0) {
|
||||
ECerror(EC_R_INVALID_ENCODING);
|
||||
goto err;
|
||||
}
|
||||
if (form == POINT_CONVERSION_HYBRID) {
|
||||
if (y_bit != BN_is_odd(y)) {
|
||||
ECerror(EC_R_INVALID_ENCODING);
|
||||
goto err;
|
||||
}
|
||||
}
|
||||
/*
|
||||
* EC_POINT_set_affine_coordinates checks that the point is
|
||||
* on the curve as required by X9.62.
|
||||
*/
|
||||
if (!EC_POINT_set_affine_coordinates(group, point, x, y, ctx))
|
||||
goto err;
|
||||
}
|
||||
|
||||
ret = 1;
|
||||
|
||||
err:
|
||||
BN_CTX_end(ctx);
|
||||
|
||||
return ret;
|
||||
}
|
||||
1560
crypto/ec/ecp_smpl.c
Normal file
1560
crypto/ec/ecp_smpl.c
Normal file
File diff suppressed because it is too large
Load Diff
897
crypto/ec/ecx_methods.c
Normal file
897
crypto/ec/ecx_methods.c
Normal file
@@ -0,0 +1,897 @@
|
||||
/* $OpenBSD: ecx_methods.c,v 1.9 2023/07/22 19:33:25 tb Exp $ */
|
||||
/*
|
||||
* Copyright (c) 2022 Joel Sing <jsing@openbsd.org>
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
* purpose with or without fee is hereby granted, provided that the above
|
||||
* copyright notice and this permission notice appear in all copies.
|
||||
*
|
||||
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
|
||||
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
|
||||
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
|
||||
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
|
||||
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
|
||||
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
|
||||
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
#include <string.h>
|
||||
|
||||
#include <openssl/curve25519.h>
|
||||
#include <openssl/ec.h>
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/evp.h>
|
||||
#include <openssl/x509.h>
|
||||
|
||||
#include "asn1_local.h"
|
||||
#include "bytestring.h"
|
||||
#include "curve25519_internal.h"
|
||||
#include "evp_local.h"
|
||||
|
||||
/*
|
||||
* EVP PKEY and PKEY ASN.1 methods Ed25519 and X25519.
|
||||
*
|
||||
* RFC 7748 - Elliptic Curves for Security.
|
||||
* RFC 8032 - Edwards-Curve Digital Signature Algorithm (EdDSA).
|
||||
*/
|
||||
|
||||
#define ED25519_BITS 253
|
||||
#define ED25519_SECURITY_BITS 128
|
||||
#define ED25519_SIG_SIZE 64
|
||||
|
||||
#define X25519_BITS 253
|
||||
#define X25519_SECURITY_BITS 128
|
||||
|
||||
static int
|
||||
ecx_key_len(int nid)
|
||||
{
|
||||
switch (nid) {
|
||||
case NID_ED25519:
|
||||
return ED25519_KEYLEN;
|
||||
case NID_X25519:
|
||||
return X25519_KEYLEN;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
static struct ecx_key_st *
|
||||
ecx_key_new(int nid)
|
||||
{
|
||||
struct ecx_key_st *ecx_key;
|
||||
int key_len;
|
||||
|
||||
if ((key_len = ecx_key_len(nid)) == 0)
|
||||
return NULL;
|
||||
|
||||
if ((ecx_key = calloc(1, sizeof(*ecx_key))) == NULL)
|
||||
return NULL;
|
||||
|
||||
ecx_key->nid = nid;
|
||||
ecx_key->key_len = key_len;
|
||||
|
||||
return ecx_key;
|
||||
}
|
||||
|
||||
static void
|
||||
ecx_key_clear(struct ecx_key_st *ecx_key)
|
||||
{
|
||||
freezero(ecx_key->priv_key, ecx_key->priv_key_len);
|
||||
ecx_key->priv_key = NULL;
|
||||
ecx_key->priv_key_len = 0;
|
||||
|
||||
freezero(ecx_key->pub_key, ecx_key->pub_key_len);
|
||||
ecx_key->pub_key = NULL;
|
||||
ecx_key->pub_key_len = 0;
|
||||
}
|
||||
|
||||
static void
|
||||
ecx_key_free(struct ecx_key_st *ecx_key)
|
||||
{
|
||||
if (ecx_key == NULL)
|
||||
return;
|
||||
|
||||
ecx_key_clear(ecx_key);
|
||||
|
||||
freezero(ecx_key, sizeof(*ecx_key));
|
||||
}
|
||||
|
||||
static int
|
||||
ecx_key_generate(struct ecx_key_st *ecx_key)
|
||||
{
|
||||
uint8_t *pub_key = NULL, *priv_key = NULL;
|
||||
int ret = 0;
|
||||
|
||||
ecx_key_clear(ecx_key);
|
||||
|
||||
if ((pub_key = calloc(1, ecx_key->key_len)) == NULL)
|
||||
goto err;
|
||||
if ((priv_key = calloc(1, ecx_key->key_len)) == NULL)
|
||||
goto err;
|
||||
|
||||
switch (ecx_key->nid) {
|
||||
case NID_ED25519:
|
||||
ED25519_keypair(pub_key, priv_key);
|
||||
break;
|
||||
case NID_X25519:
|
||||
X25519_keypair(pub_key, priv_key);
|
||||
break;
|
||||
default:
|
||||
goto err;
|
||||
}
|
||||
|
||||
ecx_key->priv_key = priv_key;
|
||||
ecx_key->priv_key_len = ecx_key->key_len;
|
||||
priv_key = NULL;
|
||||
|
||||
ecx_key->pub_key = pub_key;
|
||||
ecx_key->pub_key_len = ecx_key->key_len;
|
||||
pub_key = NULL;
|
||||
|
||||
ret = 1;
|
||||
|
||||
err:
|
||||
freezero(pub_key, ecx_key->key_len);
|
||||
freezero(priv_key, ecx_key->key_len);
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
static int
|
||||
ecx_key_set_priv(struct ecx_key_st *ecx_key, const uint8_t *priv_key,
|
||||
size_t priv_key_len)
|
||||
{
|
||||
uint8_t *pub_key = NULL;
|
||||
CBS cbs;
|
||||
|
||||
ecx_key_clear(ecx_key);
|
||||
|
||||
if (priv_key_len != ecx_key->key_len)
|
||||
goto err;
|
||||
|
||||
if ((pub_key = calloc(1, ecx_key->key_len)) == NULL)
|
||||
goto err;
|
||||
|
||||
switch (ecx_key->nid) {
|
||||
case NID_ED25519:
|
||||
ED25519_public_from_private(pub_key, priv_key);
|
||||
break;
|
||||
case NID_X25519:
|
||||
X25519_public_from_private(pub_key, priv_key);
|
||||
break;
|
||||
default:
|
||||
goto err;
|
||||
}
|
||||
|
||||
CBS_init(&cbs, priv_key, priv_key_len);
|
||||
if (!CBS_stow(&cbs, &ecx_key->priv_key, &ecx_key->priv_key_len))
|
||||
goto err;
|
||||
|
||||
ecx_key->pub_key = pub_key;
|
||||
ecx_key->pub_key_len = ecx_key->key_len;
|
||||
pub_key = NULL;
|
||||
|
||||
err:
|
||||
freezero(pub_key, ecx_key->key_len);
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
static int
|
||||
ecx_key_set_pub(struct ecx_key_st *ecx_key, const uint8_t *pub_key,
|
||||
size_t pub_key_len)
|
||||
{
|
||||
CBS cbs;
|
||||
|
||||
ecx_key_clear(ecx_key);
|
||||
|
||||
if (pub_key_len != ecx_key->key_len)
|
||||
return 0;
|
||||
|
||||
CBS_init(&cbs, pub_key, pub_key_len);
|
||||
if (!CBS_stow(&cbs, &ecx_key->pub_key, &ecx_key->pub_key_len))
|
||||
return 0;
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
static int
|
||||
ecx_pub_decode(EVP_PKEY *pkey, X509_PUBKEY *xpubkey)
|
||||
{
|
||||
struct ecx_key_st *ecx_key = NULL;
|
||||
X509_ALGOR *algor;
|
||||
int algor_type;
|
||||
const uint8_t *param;
|
||||
int param_len;
|
||||
int ret = 0;
|
||||
|
||||
if (!X509_PUBKEY_get0_param(NULL, ¶m, ¶m_len, &algor, xpubkey))
|
||||
goto err;
|
||||
|
||||
/* Ensure that parameters have not been specified in the encoding. */
|
||||
if (algor != NULL) {
|
||||
X509_ALGOR_get0(NULL, &algor_type, NULL, algor);
|
||||
if (algor_type != V_ASN1_UNDEF) {
|
||||
ECerror(EC_R_INVALID_ENCODING);
|
||||
goto err;
|
||||
}
|
||||
}
|
||||
|
||||
if (param == NULL || param_len != ecx_key_len(pkey->ameth->pkey_id)) {
|
||||
ECerror(EC_R_INVALID_ENCODING);
|
||||
goto err;
|
||||
}
|
||||
|
||||
if ((ecx_key = ecx_key_new(pkey->ameth->pkey_id)) == NULL)
|
||||
goto err;
|
||||
if (!ecx_key_set_pub(ecx_key, param, param_len))
|
||||
goto err;
|
||||
if (!EVP_PKEY_assign(pkey, pkey->ameth->pkey_id, ecx_key))
|
||||
goto err;
|
||||
ecx_key = NULL;
|
||||
|
||||
ret = 1;
|
||||
|
||||
err:
|
||||
ecx_key_free(ecx_key);
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
static int
|
||||
ecx_pub_encode(X509_PUBKEY *xpubkey, const EVP_PKEY *pkey)
|
||||
{
|
||||
const struct ecx_key_st *ecx_key = pkey->pkey.ecx;
|
||||
uint8_t *pub_key = NULL;
|
||||
size_t pub_key_len = 0;
|
||||
ASN1_OBJECT *aobj;
|
||||
CBS cbs;
|
||||
int ret = 0;
|
||||
|
||||
if (ecx_key == NULL) {
|
||||
ECerror(EC_R_INVALID_KEY);
|
||||
goto err;
|
||||
}
|
||||
|
||||
if (ecx_key->pub_key_len != ecx_key->key_len)
|
||||
goto err;
|
||||
|
||||
if ((aobj = OBJ_nid2obj(pkey->ameth->pkey_id)) == NULL)
|
||||
goto err;
|
||||
|
||||
CBS_init(&cbs, ecx_key->pub_key, ecx_key->pub_key_len);
|
||||
if (!CBS_stow(&cbs, &pub_key, &pub_key_len))
|
||||
goto err;
|
||||
|
||||
if (!X509_PUBKEY_set0_param(xpubkey, aobj, V_ASN1_UNDEF, NULL,
|
||||
pub_key, pub_key_len))
|
||||
goto err;
|
||||
|
||||
pub_key = NULL;
|
||||
pub_key_len = 0;
|
||||
|
||||
ret = 1;
|
||||
|
||||
err:
|
||||
free(pub_key);
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
static int
|
||||
ecx_pub_cmp(const EVP_PKEY *pkey1, const EVP_PKEY *pkey2)
|
||||
{
|
||||
if (pkey1->pkey.ecx == NULL || pkey1->pkey.ecx->pub_key == NULL)
|
||||
return -2;
|
||||
if (pkey2->pkey.ecx == NULL || pkey2->pkey.ecx->pub_key == NULL)
|
||||
return -2;
|
||||
if (pkey1->pkey.ecx->pub_key_len != pkey2->pkey.ecx->pub_key_len)
|
||||
return -2;
|
||||
|
||||
return timingsafe_memcmp(pkey1->pkey.ecx->pub_key, pkey2->pkey.ecx->pub_key,
|
||||
pkey1->pkey.ecx->pub_key_len) == 0;
|
||||
}
|
||||
|
||||
/* Reimplementation of ASN1_buf_print() that adds a secondary indent of 4. */
|
||||
static int
|
||||
ecx_buf_print(BIO *bio, const uint8_t *buf, size_t buf_len, int indent)
|
||||
{
|
||||
uint8_t u8;
|
||||
size_t octets = 0;
|
||||
const char *sep = ":", *nl = "";
|
||||
CBS cbs;
|
||||
|
||||
if (indent > 60)
|
||||
indent = 60;
|
||||
indent += 4;
|
||||
if (indent < 0)
|
||||
indent = 0;
|
||||
|
||||
CBS_init(&cbs, buf, buf_len);
|
||||
while (CBS_len(&cbs) > 0) {
|
||||
if (!CBS_get_u8(&cbs, &u8))
|
||||
return 0;
|
||||
if (octets++ % 15 == 0) {
|
||||
if (BIO_printf(bio, "%s%*s", nl, indent, "") < 0)
|
||||
return 0;
|
||||
nl = "\n";
|
||||
}
|
||||
if (CBS_len(&cbs) == 0)
|
||||
sep = "";
|
||||
if (BIO_printf(bio, "%02x%s", u8, sep) <= 0)
|
||||
return 0;
|
||||
}
|
||||
|
||||
if (BIO_printf(bio, "\n") <= 0)
|
||||
return 0;
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
static int
|
||||
ecx_pub_print(BIO *bio, const EVP_PKEY *pkey, int indent, ASN1_PCTX *ctx)
|
||||
{
|
||||
struct ecx_key_st *ecx_key = pkey->pkey.ecx;
|
||||
const char *name;
|
||||
|
||||
if ((name = OBJ_nid2ln(pkey->ameth->pkey_id)) == NULL)
|
||||
return 0;
|
||||
|
||||
if (ecx_key == NULL || ecx_key->pub_key == NULL)
|
||||
return BIO_printf(bio, "%*s<INVALID PUBLIC KEY>\n",
|
||||
indent, "") > 0;
|
||||
|
||||
if (BIO_printf(bio, "%*s%s Public-Key:\n", indent, "", name) <= 0)
|
||||
return 0;
|
||||
if (BIO_printf(bio, "%*spub:\n", indent, "") <= 0)
|
||||
return 0;
|
||||
if (!ecx_buf_print(bio, ecx_key->pub_key, ecx_key->pub_key_len, indent))
|
||||
return 0;
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
static int
|
||||
ecx_priv_decode(EVP_PKEY *pkey, const PKCS8_PRIV_KEY_INFO *p8pki)
|
||||
{
|
||||
struct ecx_key_st *ecx_key = NULL;
|
||||
ASN1_OCTET_STRING *aos = NULL;
|
||||
const X509_ALGOR *algor;
|
||||
int algor_type;
|
||||
const uint8_t *param;
|
||||
int param_len;
|
||||
int ret = 0;
|
||||
|
||||
if (!PKCS8_pkey_get0(NULL, ¶m, ¶m_len, &algor, p8pki))
|
||||
goto err;
|
||||
if ((aos = d2i_ASN1_OCTET_STRING(NULL, ¶m, param_len)) == NULL)
|
||||
goto err;
|
||||
|
||||
/* Ensure that parameters have not been specified in the encoding. */
|
||||
if (algor != NULL) {
|
||||
X509_ALGOR_get0(NULL, &algor_type, NULL, algor);
|
||||
if (algor_type != V_ASN1_UNDEF) {
|
||||
ECerror(EC_R_INVALID_ENCODING);
|
||||
goto err;
|
||||
}
|
||||
}
|
||||
|
||||
if (ASN1_STRING_get0_data(aos) == NULL ||
|
||||
ASN1_STRING_length(aos) != ecx_key_len(pkey->ameth->pkey_id)) {
|
||||
ECerror(EC_R_INVALID_ENCODING);
|
||||
goto err;
|
||||
}
|
||||
|
||||
if ((ecx_key = ecx_key_new(pkey->ameth->pkey_id)) == NULL)
|
||||
goto err;
|
||||
if (!ecx_key_set_priv(ecx_key, ASN1_STRING_get0_data(aos),
|
||||
ASN1_STRING_length(aos)))
|
||||
goto err;
|
||||
if (!EVP_PKEY_assign(pkey, pkey->ameth->pkey_id, ecx_key))
|
||||
goto err;
|
||||
ecx_key = NULL;
|
||||
|
||||
ret = 1;
|
||||
|
||||
err:
|
||||
ASN1_OCTET_STRING_free(aos);
|
||||
ecx_key_free(ecx_key);
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
static int
|
||||
ecx_priv_encode(PKCS8_PRIV_KEY_INFO *p8pki, const EVP_PKEY *pkey)
|
||||
{
|
||||
struct ecx_key_st *ecx_key = pkey->pkey.ecx;
|
||||
ASN1_OCTET_STRING *aos = NULL;
|
||||
ASN1_OBJECT *aobj;
|
||||
uint8_t *der = NULL;
|
||||
int der_len = 0;
|
||||
int ret = 0;
|
||||
|
||||
if (ecx_key == NULL || ecx_key->priv_key == NULL) {
|
||||
ECerror(EC_R_INVALID_PRIVATE_KEY);
|
||||
goto err;
|
||||
}
|
||||
|
||||
if ((aobj = OBJ_nid2obj(pkey->ameth->pkey_id)) == NULL)
|
||||
goto err;
|
||||
|
||||
if ((aos = ASN1_OCTET_STRING_new()) == NULL)
|
||||
goto err;
|
||||
if (!ASN1_OCTET_STRING_set(aos, ecx_key->priv_key,
|
||||
ecx_key->priv_key_len))
|
||||
goto err;
|
||||
if ((der_len = i2d_ASN1_OCTET_STRING(aos, &der)) < 0)
|
||||
goto err;
|
||||
if (!PKCS8_pkey_set0(p8pki, aobj, 0, V_ASN1_UNDEF, NULL, der, der_len))
|
||||
goto err;
|
||||
|
||||
der = NULL;
|
||||
der_len = 0;
|
||||
|
||||
ret = 1;
|
||||
|
||||
err:
|
||||
freezero(der, der_len);
|
||||
ASN1_OCTET_STRING_free(aos);
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
static int
|
||||
ecx_priv_print(BIO *bio, const EVP_PKEY *pkey, int indent, ASN1_PCTX *ctx)
|
||||
{
|
||||
struct ecx_key_st *ecx_key = pkey->pkey.ecx;
|
||||
const char *name;
|
||||
|
||||
if ((name = OBJ_nid2ln(pkey->ameth->pkey_id)) == NULL)
|
||||
return 0;
|
||||
|
||||
if (ecx_key == NULL || ecx_key->priv_key == NULL)
|
||||
return BIO_printf(bio, "%*s<INVALID PRIVATE KEY>\n",
|
||||
indent, "") > 0;
|
||||
|
||||
if (BIO_printf(bio, "%*s%s Private-Key:\n", indent, "", name) <= 0)
|
||||
return 0;
|
||||
if (BIO_printf(bio, "%*spriv:\n", indent, "") <= 0)
|
||||
return 0;
|
||||
if (!ecx_buf_print(bio, ecx_key->priv_key, ecx_key->priv_key_len, indent))
|
||||
return 0;
|
||||
if (BIO_printf(bio, "%*spub:\n", indent, "") <= 0)
|
||||
return 0;
|
||||
if (!ecx_buf_print(bio, ecx_key->pub_key, ecx_key->pub_key_len, indent))
|
||||
return 0;
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
static int
|
||||
ecx_size(const EVP_PKEY *pkey)
|
||||
{
|
||||
return ecx_key_len(pkey->ameth->pkey_id);
|
||||
}
|
||||
|
||||
static int
|
||||
ecx_sig_size(const EVP_PKEY *pkey)
|
||||
{
|
||||
switch (pkey->ameth->pkey_id) {
|
||||
case EVP_PKEY_ED25519:
|
||||
return ED25519_SIG_SIZE;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
static int
|
||||
ecx_bits(const EVP_PKEY *pkey)
|
||||
{
|
||||
switch (pkey->ameth->pkey_id) {
|
||||
case EVP_PKEY_ED25519:
|
||||
return ED25519_BITS;
|
||||
case EVP_PKEY_X25519:
|
||||
return X25519_BITS;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
static int
|
||||
ecx_security_bits(const EVP_PKEY *pkey)
|
||||
{
|
||||
switch (pkey->ameth->pkey_id) {
|
||||
case EVP_PKEY_ED25519:
|
||||
return ED25519_SECURITY_BITS;
|
||||
case EVP_PKEY_X25519:
|
||||
return X25519_SECURITY_BITS;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
static int
|
||||
ecx_param_cmp(const EVP_PKEY *pkey1, const EVP_PKEY *pkey2)
|
||||
{
|
||||
/* No parameters, so always equivalent. */
|
||||
return 1;
|
||||
}
|
||||
|
||||
static void
|
||||
ecx_free(EVP_PKEY *pkey)
|
||||
{
|
||||
struct ecx_key_st *ecx_key = pkey->pkey.ecx;
|
||||
|
||||
ecx_key_free(ecx_key);
|
||||
}
|
||||
|
||||
static int
|
||||
ecx_ctrl(EVP_PKEY *pkey, int op, long arg1, void *arg2)
|
||||
{
|
||||
/* Not supported. */
|
||||
return -2;
|
||||
}
|
||||
|
||||
static int
|
||||
ecx_sign_ctrl(EVP_PKEY *pkey, int op, long arg1, void *arg2)
|
||||
{
|
||||
switch (op) {
|
||||
case ASN1_PKEY_CTRL_DEFAULT_MD_NID:
|
||||
/* PureEdDSA does its own hashing. */
|
||||
*(int *)arg2 = NID_undef;
|
||||
return 2;
|
||||
}
|
||||
return -2;
|
||||
}
|
||||
|
||||
static int
|
||||
ecx_set_priv_key(EVP_PKEY *pkey, const uint8_t *priv, size_t len)
|
||||
{
|
||||
struct ecx_key_st *ecx_key = NULL;
|
||||
int ret = 0;
|
||||
|
||||
if (priv == NULL || len != ecx_key_len(pkey->ameth->pkey_id)) {
|
||||
ECerror(EC_R_INVALID_ENCODING);
|
||||
goto err;
|
||||
}
|
||||
|
||||
if ((ecx_key = ecx_key_new(pkey->ameth->pkey_id)) == NULL)
|
||||
goto err;
|
||||
if (!ecx_key_set_priv(ecx_key, priv, len))
|
||||
goto err;
|
||||
if (!EVP_PKEY_assign(pkey, pkey->ameth->pkey_id, ecx_key))
|
||||
goto err;
|
||||
ecx_key = NULL;
|
||||
|
||||
ret = 1;
|
||||
|
||||
err:
|
||||
ecx_key_free(ecx_key);
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
static int
|
||||
ecx_set_pub_key(EVP_PKEY *pkey, const uint8_t *pub, size_t len)
|
||||
{
|
||||
struct ecx_key_st *ecx_key = NULL;
|
||||
int ret = 0;
|
||||
|
||||
if (pub == NULL || len != ecx_key_len(pkey->ameth->pkey_id)) {
|
||||
ECerror(EC_R_INVALID_ENCODING);
|
||||
goto err;
|
||||
}
|
||||
|
||||
if ((ecx_key = ecx_key_new(pkey->ameth->pkey_id)) == NULL)
|
||||
goto err;
|
||||
if (!ecx_key_set_pub(ecx_key, pub, len))
|
||||
goto err;
|
||||
if (!EVP_PKEY_assign(pkey, pkey->ameth->pkey_id, ecx_key))
|
||||
goto err;
|
||||
ecx_key = NULL;
|
||||
|
||||
ret = 1;
|
||||
|
||||
err:
|
||||
ecx_key_free(ecx_key);
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
static int
|
||||
ecx_get_priv_key(const EVP_PKEY *pkey, unsigned char *out_priv, size_t *out_len)
|
||||
{
|
||||
struct ecx_key_st *ecx_key = pkey->pkey.ecx;
|
||||
CBS cbs;
|
||||
|
||||
if (out_priv == NULL) {
|
||||
*out_len = ecx_key_len(pkey->ameth->pkey_id);
|
||||
return 1;
|
||||
}
|
||||
|
||||
if (ecx_key == NULL || ecx_key->priv_key == NULL)
|
||||
return 0;
|
||||
|
||||
CBS_init(&cbs, ecx_key->priv_key, ecx_key->priv_key_len);
|
||||
if (!CBS_write_bytes(&cbs, out_priv, *out_len, out_len))
|
||||
return 0;
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
static int
|
||||
ecx_get_pub_key(const EVP_PKEY *pkey, unsigned char *out_pub, size_t *out_len)
|
||||
{
|
||||
struct ecx_key_st *ecx_key = pkey->pkey.ecx;
|
||||
CBS cbs;
|
||||
|
||||
if (out_pub == NULL) {
|
||||
*out_len = ecx_key_len(pkey->ameth->pkey_id);
|
||||
return 1;
|
||||
}
|
||||
|
||||
if (ecx_key == NULL || ecx_key->pub_key == NULL)
|
||||
return 0;
|
||||
|
||||
CBS_init(&cbs, ecx_key->pub_key, ecx_key->pub_key_len);
|
||||
if (!CBS_write_bytes(&cbs, out_pub, *out_len, out_len))
|
||||
return 0;
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
static int
|
||||
pkey_ecx_keygen(EVP_PKEY_CTX *pkey_ctx, EVP_PKEY *pkey)
|
||||
{
|
||||
struct ecx_key_st *ecx_key = NULL;
|
||||
int ret = 0;
|
||||
|
||||
if ((ecx_key = ecx_key_new(pkey_ctx->pmeth->pkey_id)) == NULL)
|
||||
goto err;
|
||||
if (!ecx_key_generate(ecx_key))
|
||||
goto err;
|
||||
if (!EVP_PKEY_assign(pkey, pkey_ctx->pmeth->pkey_id, ecx_key))
|
||||
goto err;
|
||||
ecx_key = NULL;
|
||||
|
||||
ret = 1;
|
||||
|
||||
err:
|
||||
ecx_key_free(ecx_key);
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
static int
|
||||
pkey_ecx_derive(EVP_PKEY_CTX *pkey_ctx, unsigned char *out_key,
|
||||
size_t *out_key_len)
|
||||
{
|
||||
struct ecx_key_st *ecx_key, *ecx_peer_key;
|
||||
|
||||
if (pkey_ctx->pkey == NULL || pkey_ctx->peerkey == NULL) {
|
||||
ECerror(EC_R_KEYS_NOT_SET);
|
||||
return 0;
|
||||
}
|
||||
|
||||
if ((ecx_key = pkey_ctx->pkey->pkey.ecx) == NULL) {
|
||||
ECerror(EC_R_INVALID_PRIVATE_KEY);
|
||||
return 0;
|
||||
}
|
||||
if (ecx_key->priv_key == NULL) {
|
||||
ECerror(EC_R_INVALID_PRIVATE_KEY);
|
||||
return 0;
|
||||
}
|
||||
|
||||
if ((ecx_peer_key = pkey_ctx->peerkey->pkey.ecx) == NULL) {
|
||||
ECerror(EC_R_INVALID_PEER_KEY);
|
||||
return 0;
|
||||
}
|
||||
|
||||
if (out_key != NULL) {
|
||||
if (!X25519(out_key, ecx_key->priv_key, ecx_peer_key->pub_key))
|
||||
return 0;
|
||||
}
|
||||
|
||||
*out_key_len = X25519_KEYLEN;
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
static int
|
||||
pkey_ecx_ctrl(EVP_PKEY_CTX *pkey_ctx, int op, int arg1, void *arg2)
|
||||
{
|
||||
if (op == EVP_PKEY_CTRL_PEER_KEY)
|
||||
return 1;
|
||||
|
||||
return -2;
|
||||
}
|
||||
|
||||
static int
|
||||
ecx_item_verify(EVP_MD_CTX *md_ctx, const ASN1_ITEM *it, void *asn,
|
||||
X509_ALGOR *algor, ASN1_BIT_STRING *abs, EVP_PKEY *pkey)
|
||||
{
|
||||
const ASN1_OBJECT *aobj;
|
||||
int nid, param_type;
|
||||
|
||||
X509_ALGOR_get0(&aobj, ¶m_type, NULL, algor);
|
||||
|
||||
nid = OBJ_obj2nid(aobj);
|
||||
|
||||
if (nid != NID_ED25519 || param_type != V_ASN1_UNDEF) {
|
||||
ECerror(EC_R_INVALID_ENCODING);
|
||||
return -1;
|
||||
}
|
||||
|
||||
if (!EVP_DigestVerifyInit(md_ctx, NULL, NULL, NULL, pkey))
|
||||
return -1;
|
||||
|
||||
return 2;
|
||||
}
|
||||
|
||||
static int
|
||||
ecx_item_sign(EVP_MD_CTX *md_ctx, const ASN1_ITEM *it, void *asn,
|
||||
X509_ALGOR *algor1, X509_ALGOR *algor2, ASN1_BIT_STRING *abs)
|
||||
{
|
||||
ASN1_OBJECT *aobj;
|
||||
|
||||
if ((aobj = OBJ_nid2obj(NID_ED25519)) == NULL)
|
||||
return 0;
|
||||
|
||||
if (!X509_ALGOR_set0(algor1, aobj, V_ASN1_UNDEF, NULL))
|
||||
return 0;
|
||||
|
||||
if (algor2 != NULL) {
|
||||
if (!X509_ALGOR_set0(algor2, aobj, V_ASN1_UNDEF, NULL))
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* Tell ASN1_item_sign_ctx() that identifiers are set and it needs to sign. */
|
||||
return 3;
|
||||
}
|
||||
|
||||
static int
|
||||
pkey_ecx_digestsign(EVP_MD_CTX *md_ctx, unsigned char *out_sig,
|
||||
size_t *out_sig_len, const unsigned char *message, size_t message_len)
|
||||
{
|
||||
struct ecx_key_st *ecx_key;
|
||||
EVP_PKEY_CTX *pkey_ctx;
|
||||
|
||||
pkey_ctx = EVP_MD_CTX_pkey_ctx(md_ctx);
|
||||
ecx_key = pkey_ctx->pkey->pkey.ecx;
|
||||
|
||||
if (out_sig == NULL) {
|
||||
*out_sig_len = ecx_sig_size(pkey_ctx->pkey);
|
||||
return 1;
|
||||
}
|
||||
if (*out_sig_len < ecx_sig_size(pkey_ctx->pkey)) {
|
||||
ECerror(EC_R_BUFFER_TOO_SMALL);
|
||||
return 0;
|
||||
}
|
||||
|
||||
if (ecx_key == NULL)
|
||||
return 0;
|
||||
if (ecx_key->priv_key == NULL || ecx_key->pub_key == NULL)
|
||||
return 0;
|
||||
|
||||
if (!ED25519_sign(out_sig, message, message_len, ecx_key->pub_key,
|
||||
ecx_key->priv_key))
|
||||
return 0;
|
||||
|
||||
*out_sig_len = ecx_sig_size(pkey_ctx->pkey);
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
static int
|
||||
pkey_ecx_digestverify(EVP_MD_CTX *md_ctx, const unsigned char *sig,
|
||||
size_t sig_len, const unsigned char *message, size_t message_len)
|
||||
{
|
||||
struct ecx_key_st *ecx_key;
|
||||
EVP_PKEY_CTX *pkey_ctx;
|
||||
|
||||
pkey_ctx = EVP_MD_CTX_pkey_ctx(md_ctx);
|
||||
ecx_key = pkey_ctx->pkey->pkey.ecx;
|
||||
|
||||
if (ecx_key == NULL || ecx_key->pub_key == NULL)
|
||||
return -1;
|
||||
if (sig_len != ecx_sig_size(pkey_ctx->pkey))
|
||||
return -1;
|
||||
|
||||
return ED25519_verify(message, message_len, sig, ecx_key->pub_key);
|
||||
}
|
||||
|
||||
static int
|
||||
pkey_ecx_ed_ctrl(EVP_PKEY_CTX *pkey_ctx, int op, int arg1, void *arg2)
|
||||
{
|
||||
switch (op) {
|
||||
case EVP_PKEY_CTRL_MD:
|
||||
/* PureEdDSA does its own hashing. */
|
||||
if (arg2 != NULL && (const EVP_MD *)arg2 != EVP_md_null()) {
|
||||
ECerror(EC_R_INVALID_DIGEST_TYPE);
|
||||
return 0;
|
||||
}
|
||||
return 1;
|
||||
|
||||
case EVP_PKEY_CTRL_DIGESTINIT:
|
||||
return 1;
|
||||
}
|
||||
return -2;
|
||||
}
|
||||
|
||||
const EVP_PKEY_ASN1_METHOD x25519_asn1_meth = {
|
||||
.pkey_id = EVP_PKEY_X25519,
|
||||
.pkey_base_id = EVP_PKEY_X25519,
|
||||
.pkey_flags = 0,
|
||||
.pem_str = "X25519",
|
||||
.info = "OpenSSL X25519 algorithm",
|
||||
|
||||
.pub_decode = ecx_pub_decode,
|
||||
.pub_encode = ecx_pub_encode,
|
||||
.pub_cmp = ecx_pub_cmp,
|
||||
.pub_print = ecx_pub_print,
|
||||
|
||||
.priv_decode = ecx_priv_decode,
|
||||
.priv_encode = ecx_priv_encode,
|
||||
.priv_print = ecx_priv_print,
|
||||
|
||||
.pkey_size = ecx_size,
|
||||
.pkey_bits = ecx_bits,
|
||||
.pkey_security_bits = ecx_security_bits,
|
||||
|
||||
.param_cmp = ecx_param_cmp,
|
||||
|
||||
.pkey_free = ecx_free,
|
||||
.pkey_ctrl = ecx_ctrl,
|
||||
|
||||
.set_priv_key = ecx_set_priv_key,
|
||||
.set_pub_key = ecx_set_pub_key,
|
||||
.get_priv_key = ecx_get_priv_key,
|
||||
.get_pub_key = ecx_get_pub_key,
|
||||
};
|
||||
|
||||
const EVP_PKEY_METHOD x25519_pkey_meth = {
|
||||
.pkey_id = EVP_PKEY_X25519,
|
||||
.keygen = pkey_ecx_keygen,
|
||||
.derive = pkey_ecx_derive,
|
||||
.ctrl = pkey_ecx_ctrl,
|
||||
};
|
||||
|
||||
const EVP_PKEY_ASN1_METHOD ed25519_asn1_meth = {
|
||||
.pkey_id = EVP_PKEY_ED25519,
|
||||
.pkey_base_id = EVP_PKEY_ED25519,
|
||||
.pkey_flags = 0,
|
||||
.pem_str = "ED25519",
|
||||
.info = "OpenSSL ED25519 algorithm",
|
||||
|
||||
.pub_decode = ecx_pub_decode,
|
||||
.pub_encode = ecx_pub_encode,
|
||||
.pub_cmp = ecx_pub_cmp,
|
||||
.pub_print = ecx_pub_print,
|
||||
|
||||
.priv_decode = ecx_priv_decode,
|
||||
.priv_encode = ecx_priv_encode,
|
||||
.priv_print = ecx_priv_print,
|
||||
|
||||
.pkey_size = ecx_sig_size,
|
||||
.pkey_bits = ecx_bits,
|
||||
.pkey_security_bits = ecx_security_bits,
|
||||
|
||||
.param_cmp = ecx_param_cmp,
|
||||
|
||||
.pkey_free = ecx_free,
|
||||
.pkey_ctrl = ecx_sign_ctrl,
|
||||
|
||||
.item_verify = ecx_item_verify,
|
||||
.item_sign = ecx_item_sign,
|
||||
|
||||
.set_priv_key = ecx_set_priv_key,
|
||||
.set_pub_key = ecx_set_pub_key,
|
||||
.get_priv_key = ecx_get_priv_key,
|
||||
.get_pub_key = ecx_get_pub_key,
|
||||
};
|
||||
|
||||
const EVP_PKEY_METHOD ed25519_pkey_meth = {
|
||||
.pkey_id = EVP_PKEY_ED25519,
|
||||
.flags = EVP_PKEY_FLAG_SIGCTX_CUSTOM,
|
||||
.keygen = pkey_ecx_keygen,
|
||||
.ctrl = pkey_ecx_ed_ctrl,
|
||||
.digestsign = pkey_ecx_digestsign,
|
||||
.digestverify = pkey_ecx_digestverify,
|
||||
};
|
||||
Reference in New Issue
Block a user