diff --git a/cipher/dsa-common.c b/cipher/dsa-common.c index fe49248d..7000903a 100644 --- a/cipher/dsa-common.c +++ b/cipher/dsa-common.c @@ -1,418 +1,473 @@ /* dsa-common.c - Common code for DSA * Copyright (C) 1998, 1999 Free Software Foundation, Inc. * Copyright (C) 2013 g10 Code GmbH * * This file is part of Libgcrypt. * * Libgcrypt is free software; you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as * published by the Free Software Foundation; either version 2.1 of * the License, or (at your option) any later version. * * Libgcrypt is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public * License along with this program; if not, see . */ #include #include #include #include #include "g10lib.h" #include "mpi.h" #include "cipher.h" #include "pubkey-internal.h" /* * Modify K, so that computation time difference can be small, * by making K large enough. * * Originally, (EC)DSA computation requires k where 0 < k < q. Here, * we add q (the order), to keep k in a range: q < k < 2*q (or, * addming more q, to keep k in a range: 2*q < k < 3*q), so that * timing difference of the EC multiply (or exponentiation) operation * can be small. The result of (EC)DSA computation is same. */ void _gcry_dsa_modify_k (gcry_mpi_t k, gcry_mpi_t q, int qbits) { gcry_mpi_t k1 = mpi_new (qbits+2); mpi_resize (k, (qbits+2+BITS_PER_MPI_LIMB-1) / BITS_PER_MPI_LIMB); k->nlimbs = k->alloced; mpi_add (k, k, q); mpi_add (k1, k, q); mpi_set_cond (k, k1, !mpi_test_bit (k, qbits)); mpi_free (k1); } /* * Generate a random secret exponent K less than Q. * Note that ECDSA uses this code also to generate D. */ gcry_mpi_t _gcry_dsa_gen_k (gcry_mpi_t q, int security_level) { gcry_mpi_t k = mpi_alloc_secure (mpi_get_nlimbs (q)); unsigned int nbits = mpi_get_nbits (q); unsigned int nbytes = (nbits+7)/8; char *rndbuf = NULL; /* To learn why we don't use mpi_mod to get the requested bit size, read the paper: "The Insecurity of the Digital Signature Algorithm with Partially Known Nonces" by Nguyen and Shparlinski. Journal of Cryptology, New York. Vol 15, nr 3 (2003) */ if (DBG_CIPHER) log_debug ("choosing a random k of %u bits at seclevel %d\n", nbits, security_level); for (;;) { if ( !rndbuf || nbits < 32 ) { xfree (rndbuf); rndbuf = _gcry_random_bytes_secure (nbytes, security_level); } else { /* Change only some of the higher bits. We could improve this by directly requesting more memory at the first call to get_random_bytes() and use these extra bytes here. However the required management code is more complex and thus we better use this simple method. */ char *pp = _gcry_random_bytes_secure (4, security_level); memcpy (rndbuf, pp, 4); xfree (pp); } _gcry_mpi_set_buffer (k, rndbuf, nbytes, 0); /* Make sure we have the requested number of bits. This code looks a bit funny but it is easy to understand if you consider that mpi_set_highbit clears all higher bits. We don't have a clear_highbit, thus we first set the high bit and then clear it again. */ if (mpi_test_bit (k, nbits-1)) mpi_set_highbit (k, nbits-1); else { mpi_set_highbit (k, nbits-1); mpi_clear_bit (k, nbits-1); } if (!(mpi_cmp (k, q) < 0)) /* check: k < q */ { if (DBG_CIPHER) log_debug ("\tk too large - again\n"); continue; /* no */ } if (!(mpi_cmp_ui (k, 0) > 0)) /* check: k > 0 */ { if (DBG_CIPHER) log_debug ("\tk is zero - again\n"); continue; /* no */ } break; /* okay */ } xfree (rndbuf); return k; } /* Turn VALUE into an octet string and store it in an allocated buffer at R_FRAME. If the resulting octet string is shorter than NBYTES the result will be left padded with zeroes. If VALUE does not fit into NBYTES an error code is returned. */ static gpg_err_code_t int2octets (unsigned char **r_frame, gcry_mpi_t value, size_t nbytes) { gpg_err_code_t rc; size_t nframe, noff, n; unsigned char *frame; rc = _gcry_mpi_print (GCRYMPI_FMT_USG, NULL, 0, &nframe, value); if (rc) return rc; if (nframe > nbytes) return GPG_ERR_TOO_LARGE; /* Value too long to fit into NBYTES. */ noff = (nframe < nbytes)? nbytes - nframe : 0; n = nframe + noff; frame = mpi_is_secure (value)? xtrymalloc_secure (n) : xtrymalloc (n); if (!frame) return gpg_err_code_from_syserror (); if (noff) memset (frame, 0, noff); nframe += noff; rc = _gcry_mpi_print (GCRYMPI_FMT_USG, frame+noff, nframe-noff, NULL, value); if (rc) { xfree (frame); return rc; } *r_frame = frame; return 0; } /* Connert the bit string BITS of length NBITS into an octet string with a length of (QBITS+7)/8 bytes. On success store the result at R_FRAME. */ static gpg_err_code_t bits2octets (unsigned char **r_frame, const void *bits, unsigned int nbits, gcry_mpi_t q, unsigned int qbits) { gpg_err_code_t rc; gcry_mpi_t z1; /* z1 = bits2int (b) */ rc = _gcry_mpi_scan (&z1, GCRYMPI_FMT_USG, bits, (nbits+7)/8, NULL); if (rc) return rc; if (nbits > qbits) mpi_rshift (z1, z1, nbits - qbits); /* z2 - z1 mod q */ if (mpi_cmp (z1, q) >= 0) mpi_sub (z1, z1, q); /* Convert to an octet string. */ rc = int2octets (r_frame, z1, (qbits+7)/8); mpi_free (z1); return rc; } /* * Generate a deterministic secret exponent K less than DSA_Q. H1 is * the to be signed digest with a length of HLEN bytes. HALGO is the * algorithm used to create the hash. On success the value for K is * stored at R_K. */ gpg_err_code_t _gcry_dsa_gen_rfc6979_k (gcry_mpi_t *r_k, gcry_mpi_t dsa_q, gcry_mpi_t dsa_x, const unsigned char *h1, unsigned int hlen, int halgo, unsigned int extraloops) { gpg_err_code_t rc; unsigned char *V = NULL; unsigned char *K = NULL; unsigned char *x_buf = NULL; unsigned char *h1_buf = NULL; gcry_md_hd_t hd = NULL; unsigned char *t = NULL; gcry_mpi_t k = NULL; unsigned int tbits, qbits; int i; qbits = mpi_get_nbits (dsa_q); if (!qbits || !h1 || !hlen) return GPG_ERR_EINVAL; if (_gcry_md_get_algo_dlen (halgo) != hlen) return GPG_ERR_DIGEST_ALGO; /* Step b: V = 0x01 0x01 0x01 ... 0x01 */ V = xtrymalloc (hlen); if (!V) { rc = gpg_err_code_from_syserror (); goto leave; } for (i=0; i < hlen; i++) V[i] = 1; /* Step c: K = 0x00 0x00 0x00 ... 0x00 */ K = xtrycalloc (1, hlen); if (!K) { rc = gpg_err_code_from_syserror (); goto leave; } rc = int2octets (&x_buf, dsa_x, (qbits+7)/8); if (rc) goto leave; rc = bits2octets (&h1_buf, h1, hlen*8, dsa_q, qbits); if (rc) goto leave; /* Create a handle to compute the HMACs. */ rc = _gcry_md_open (&hd, halgo, (GCRY_MD_FLAG_SECURE | GCRY_MD_FLAG_HMAC)); if (rc) goto leave; /* Step d: K = HMAC_K(V || 0x00 || int2octets(x) || bits2octets(h1) */ rc = _gcry_md_setkey (hd, K, hlen); if (rc) goto leave; _gcry_md_write (hd, V, hlen); _gcry_md_write (hd, "", 1); _gcry_md_write (hd, x_buf, (qbits+7)/8); _gcry_md_write (hd, h1_buf, (qbits+7)/8); memcpy (K, _gcry_md_read (hd, 0), hlen); /* Step e: V = HMAC_K(V) */ rc = _gcry_md_setkey (hd, K, hlen); if (rc) goto leave; _gcry_md_write (hd, V, hlen); memcpy (V, _gcry_md_read (hd, 0), hlen); /* Step f: K = HMAC_K(V || 0x01 || int2octets(x) || bits2octets(h1) */ rc = _gcry_md_setkey (hd, K, hlen); if (rc) goto leave; _gcry_md_write (hd, V, hlen); _gcry_md_write (hd, "\x01", 1); _gcry_md_write (hd, x_buf, (qbits+7)/8); _gcry_md_write (hd, h1_buf, (qbits+7)/8); memcpy (K, _gcry_md_read (hd, 0), hlen); /* Step g: V = HMAC_K(V) */ rc = _gcry_md_setkey (hd, K, hlen); if (rc) goto leave; _gcry_md_write (hd, V, hlen); memcpy (V, _gcry_md_read (hd, 0), hlen); /* Step h. */ t = xtrymalloc_secure ((qbits+7)/8+hlen); if (!t) { rc = gpg_err_code_from_syserror (); goto leave; } again: for (tbits = 0; tbits < qbits;) { /* V = HMAC_K(V) */ rc = _gcry_md_setkey (hd, K, hlen); if (rc) goto leave; _gcry_md_write (hd, V, hlen); memcpy (V, _gcry_md_read (hd, 0), hlen); /* T = T || V */ memcpy (t+(tbits+7)/8, V, hlen); tbits += 8*hlen; } /* k = bits2int (T) */ mpi_free (k); k = NULL; rc = _gcry_mpi_scan (&k, GCRYMPI_FMT_USG, t, (tbits+7)/8, NULL); if (rc) goto leave; if (tbits > qbits) mpi_rshift (k, k, tbits - qbits); /* Check: k < q and k > 1 */ if (!(mpi_cmp (k, dsa_q) < 0 && mpi_cmp_ui (k, 0) > 0)) { /* K = HMAC_K(V || 0x00) */ rc = _gcry_md_setkey (hd, K, hlen); if (rc) goto leave; _gcry_md_write (hd, V, hlen); _gcry_md_write (hd, "", 1); memcpy (K, _gcry_md_read (hd, 0), hlen); /* V = HMAC_K(V) */ rc = _gcry_md_setkey (hd, K, hlen); if (rc) goto leave; _gcry_md_write (hd, V, hlen); memcpy (V, _gcry_md_read (hd, 0), hlen); goto again; } /* The caller may have requested that we introduce some extra loops. This is for example useful if the caller wants another value for K because the last returned one yielded an R of 0. Because this is very unlikely we implement it in a straightforward way. */ if (extraloops) { extraloops--; /* K = HMAC_K(V || 0x00) */ rc = _gcry_md_setkey (hd, K, hlen); if (rc) goto leave; _gcry_md_write (hd, V, hlen); _gcry_md_write (hd, "", 1); memcpy (K, _gcry_md_read (hd, 0), hlen); /* V = HMAC_K(V) */ rc = _gcry_md_setkey (hd, K, hlen); if (rc) goto leave; _gcry_md_write (hd, V, hlen); memcpy (V, _gcry_md_read (hd, 0), hlen); goto again; } /* log_mpidump (" k", k); */ leave: xfree (t); _gcry_md_close (hd); xfree (h1_buf); xfree (x_buf); xfree (K); xfree (V); if (rc) mpi_free (k); else *r_k = k; return rc; } + + +/* + * For DSA/ECDSA, as prehash function, compute hash with HASHALGO for + * INPUT. Result hash value is returned in R_HASH as an opaque MPI. + * Returns error code. + */ +gpg_err_code_t +_gcry_dsa_compute_hash (gcry_mpi_t *r_hash, gcry_mpi_t input, int hashalgo) +{ + gpg_err_code_t rc = 0; + size_t hlen; + void *hashbuf; + void *abuf; + unsigned int abits; + unsigned int n; + + hlen = _gcry_md_get_algo_dlen (hashalgo); + hashbuf = xtrymalloc (hlen); + if (!hashbuf) + { + rc = gpg_err_code_from_syserror (); + return rc; + } + + if (mpi_is_opaque (input)) + { + abuf = mpi_get_opaque (input, &abits); + n = (abits+7)/8; + _gcry_md_hash_buffer (hashalgo, hashbuf, abuf, n); + } + else + { + abits = mpi_get_nbits (input); + n = (abits+7)/8; + abuf = xtrymalloc (n); + if (!abuf) + { + rc = gpg_err_code_from_syserror (); + xfree (hashbuf); + return rc; + } + _gcry_mpi_to_octet_string (NULL, abuf, input, n); + _gcry_md_hash_buffer (hashalgo, hashbuf, abuf, n); + xfree (abuf); + } + + *r_hash = mpi_set_opaque (NULL, hashbuf, hlen*8); + if (!*r_hash) + rc = GPG_ERR_INV_OBJ; + + return rc; +} + + /* * Truncate opaque hash value to qbits for DSA. * Non-opaque input is not truncated, in hope that user * knows what is passed. It is not possible to correctly * trucate non-opaque inputs. */ gpg_err_code_t _gcry_dsa_normalize_hash (gcry_mpi_t input, gcry_mpi_t *out, unsigned int qbits) { gpg_err_code_t rc = 0; const void *abuf; unsigned int abits; gcry_mpi_t hash; if (mpi_is_opaque (input)) { abuf = mpi_get_opaque (input, &abits); rc = _gcry_mpi_scan (&hash, GCRYMPI_FMT_USG, abuf, (abits+7)/8, NULL); if (rc) return rc; if (abits > qbits) mpi_rshift (hash, hash, abits - qbits); } else hash = input; *out = hash; return rc; } diff --git a/cipher/dsa.c b/cipher/dsa.c index d793b9aa..a66db334 100644 --- a/cipher/dsa.c +++ b/cipher/dsa.c @@ -1,1394 +1,1421 @@ /* dsa.c - DSA signature algorithm * Copyright (C) 1998, 2000, 2001, 2002, 2003, * 2006, 2008 Free Software Foundation, Inc. * Copyright (C) 2013 g10 Code GmbH. * * This file is part of Libgcrypt. * * Libgcrypt is free software; you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as * published by the Free Software Foundation; either version 2.1 of * the License, or (at your option) any later version. * * Libgcrypt is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public * License along with this program; if not, see . */ #include #include #include #include #include "g10lib.h" #include "mpi.h" #include "cipher.h" #include "pubkey-internal.h" typedef struct { gcry_mpi_t p; /* prime */ gcry_mpi_t q; /* group order */ gcry_mpi_t g; /* group generator */ gcry_mpi_t y; /* g^x mod p */ } DSA_public_key; typedef struct { gcry_mpi_t p; /* prime */ gcry_mpi_t q; /* group order */ gcry_mpi_t g; /* group generator */ gcry_mpi_t y; /* g^x mod p */ gcry_mpi_t x; /* secret exponent */ } DSA_secret_key; /* A structure used to hold domain parameters. */ typedef struct { gcry_mpi_t p; /* prime */ gcry_mpi_t q; /* group order */ gcry_mpi_t g; /* group generator */ } dsa_domain_t; static const char *dsa_names[] = { "dsa", "openpgp-dsa", NULL, }; /* A sample 1024 bit DSA key used for the selftests. Not anymore * used, kept only for reference. */ #if 0 static const char sample_secret_key_1024[] = "(private-key" " (dsa" " (p #00AD7C0025BA1A15F775F3F2D673718391D00456978D347B33D7B49E7F32EDAB" " 96273899DD8B2BB46CD6ECA263FAF04A28903503D59062A8865D2AE8ADFB5191" " CF36FFB562D0E2F5809801A1F675DAE59698A9E01EFE8D7DCFCA084F4C6F5A44" " 44D499A06FFAEA5E8EF5E01F2FD20A7B7EF3F6968AFBA1FB8D91F1559D52D8777B#)" " (q #00EB7B5751D25EBBB7BD59D920315FD840E19AEBF9#)" " (g #1574363387FDFD1DDF38F4FBE135BB20C7EE4772FB94C337AF86EA8E49666503" " AE04B6BE81A2F8DD095311E0217ACA698A11E6C5D33CCDAE71498ED35D13991E" " B02F09AB40BD8F4C5ED8C75DA779D0AE104BC34C960B002377068AB4B5A1F984" " 3FBA91F537F1B7CAC4D8DD6D89B0D863AF7025D549F9C765D2FC07EE208F8D15#)" " (y #64B11EF8871BE4AB572AA810D5D3CA11A6CDBC637A8014602C72960DB135BF46" " A1816A724C34F87330FC9E187C5D66897A04535CC2AC9164A7150ABFA8179827" " 6E45831AB811EEE848EBB24D9F5F2883B6E5DDC4C659DEF944DCFD80BF4D0A20" " 42CAA7DC289F0C5A9D155F02D3D551DB741A81695B74D4C8F477F9C7838EB0FB#)" " (x #11D54E4ADBD3034160F2CED4B7CD292A4EBF3EC0#)))"; /* A sample 1024 bit DSA key used for the selftests (public only). */ static const char sample_public_key_1024[] = "(public-key" " (dsa" " (p #00AD7C0025BA1A15F775F3F2D673718391D00456978D347B33D7B49E7F32EDAB" " 96273899DD8B2BB46CD6ECA263FAF04A28903503D59062A8865D2AE8ADFB5191" " CF36FFB562D0E2F5809801A1F675DAE59698A9E01EFE8D7DCFCA084F4C6F5A44" " 44D499A06FFAEA5E8EF5E01F2FD20A7B7EF3F6968AFBA1FB8D91F1559D52D8777B#)" " (q #00EB7B5751D25EBBB7BD59D920315FD840E19AEBF9#)" " (g #1574363387FDFD1DDF38F4FBE135BB20C7EE4772FB94C337AF86EA8E49666503" " AE04B6BE81A2F8DD095311E0217ACA698A11E6C5D33CCDAE71498ED35D13991E" " B02F09AB40BD8F4C5ED8C75DA779D0AE104BC34C960B002377068AB4B5A1F984" " 3FBA91F537F1B7CAC4D8DD6D89B0D863AF7025D549F9C765D2FC07EE208F8D15#)" " (y #64B11EF8871BE4AB572AA810D5D3CA11A6CDBC637A8014602C72960DB135BF46" " A1816A724C34F87330FC9E187C5D66897A04535CC2AC9164A7150ABFA8179827" " 6E45831AB811EEE848EBB24D9F5F2883B6E5DDC4C659DEF944DCFD80BF4D0A20" " 42CAA7DC289F0C5A9D155F02D3D551DB741A81695B74D4C8F477F9C7838EB0FB#)))"; #endif /*0*/ /* 2048 DSA key from RFC 6979 A.2.2 */ static const char sample_public_key_2048[] = "(public-key" " (dsa" " (p #9DB6FB5951B66BB6FE1E140F1D2CE5502374161FD6538DF1648218642F0B5C48C8F7A41AADFA187324B87674FA1822B00F1ECF8136943D7C55757264E5A1A44FFE012E9936E00C1D3E9310B01C7D179805D3058B2A9F4BB6F9716BFE6117C6B5B3CC4D9BE341104AD4A80AD6C94E005F4B993E14F091EB51743BF33050C38DE235567E1B34C3D6A5C0CEAA1A0F368213C3D19843D0B4B09DCB9FC72D39C8DE41F1BF14D4BB4563CA28371621CAD3324B6A2D392145BEBFAC748805236F5CA2FE92B871CD8F9C36D3292B5509CA8CAA77A2ADFC7BFD77DDA6F71125A7456FEA153E433256A2261C6A06ED3693797E7995FAD5AABBCFBE3EDA2741E375404AE25B#)" " (q #F2C3119374CE76C9356990B465374A17F23F9ED35089BD969F61C6DDE9998C1F#)" " (g #5C7FF6B06F8F143FE8288433493E4769C4D988ACE5BE25A0E24809670716C613D7B0CEE6932F8FAA7C44D2CB24523DA53FBE4F6EC3595892D1AA58C4328A06C46A15662E7EAA703A1DECF8BBB2D05DBE2EB956C142A338661D10461C0D135472085057F3494309FFA73C611F78B32ADBB5740C361C9F35BE90997DB2014E2EF5AA61782F52ABEB8BD6432C4DD097BC5423B285DAFB60DC364E8161F4A2A35ACA3A10B1C4D203CC76A470A33AFDCBDD92959859ABD8B56E1725252D78EAC66E71BA9AE3F1DD2487199874393CD4D832186800654760E1E34C09E4D155179F9EC0DC4473F996BDCE6EED1CABED8B6F116F7AD9CF505DF0F998E34AB27514B0FFE7#)" " (y #667098C654426C78D7F8201EAC6C203EF030D43605032C2F1FA937E5237DBD949F34A0A2564FE126DC8B715C5141802CE0979C8246463C40E6B6BDAA2513FA611728716C2E4FD53BC95B89E69949D96512E873B9C8F8DFD499CC312882561ADECB31F658E934C0C197F2C4D96B05CBAD67381E7B768891E4DA3843D24D94CDFB5126E9B8BF21E8358EE0E0A30EF13FD6A664C0DCE3731F7FB49A4845A4FD8254687972A2D382599C9BAC4E0ED7998193078913032558134976410B89D2C171D123AC35FD977219597AA7D15C1A9A428E59194F75C721EBCBCFAE44696A499AFA74E04299F132026601638CB87AB79190D4A0986315DA8EEC6561C938996BEADF#)))"; static const char sample_secret_key_2048[] = "(private-key" " (dsa" " (p #9DB6FB5951B66BB6FE1E140F1D2CE5502374161FD6538DF1648218642F0B5C48C8F7A41AADFA187324B87674FA1822B00F1ECF8136943D7C55757264E5A1A44FFE012E9936E00C1D3E9310B01C7D179805D3058B2A9F4BB6F9716BFE6117C6B5B3CC4D9BE341104AD4A80AD6C94E005F4B993E14F091EB51743BF33050C38DE235567E1B34C3D6A5C0CEAA1A0F368213C3D19843D0B4B09DCB9FC72D39C8DE41F1BF14D4BB4563CA28371621CAD3324B6A2D392145BEBFAC748805236F5CA2FE92B871CD8F9C36D3292B5509CA8CAA77A2ADFC7BFD77DDA6F71125A7456FEA153E433256A2261C6A06ED3693797E7995FAD5AABBCFBE3EDA2741E375404AE25B#)" " (q #F2C3119374CE76C9356990B465374A17F23F9ED35089BD969F61C6DDE9998C1F#)" " (g #5C7FF6B06F8F143FE8288433493E4769C4D988ACE5BE25A0E24809670716C613D7B0CEE6932F8FAA7C44D2CB24523DA53FBE4F6EC3595892D1AA58C4328A06C46A15662E7EAA703A1DECF8BBB2D05DBE2EB956C142A338661D10461C0D135472085057F3494309FFA73C611F78B32ADBB5740C361C9F35BE90997DB2014E2EF5AA61782F52ABEB8BD6432C4DD097BC5423B285DAFB60DC364E8161F4A2A35ACA3A10B1C4D203CC76A470A33AFDCBDD92959859ABD8B56E1725252D78EAC66E71BA9AE3F1DD2487199874393CD4D832186800654760E1E34C09E4D155179F9EC0DC4473F996BDCE6EED1CABED8B6F116F7AD9CF505DF0F998E34AB27514B0FFE7#)" " (y #667098C654426C78D7F8201EAC6C203EF030D43605032C2F1FA937E5237DBD949F34A0A2564FE126DC8B715C5141802CE0979C8246463C40E6B6BDAA2513FA611728716C2E4FD53BC95B89E69949D96512E873B9C8F8DFD499CC312882561ADECB31F658E934C0C197F2C4D96B05CBAD67381E7B768891E4DA3843D24D94CDFB5126E9B8BF21E8358EE0E0A30EF13FD6A664C0DCE3731F7FB49A4845A4FD8254687972A2D382599C9BAC4E0ED7998193078913032558134976410B89D2C171D123AC35FD977219597AA7D15C1A9A428E59194F75C721EBCBCFAE44696A499AFA74E04299F132026601638CB87AB79190D4A0986315DA8EEC6561C938996BEADF#)" " (x #69C7548C21D0DFEA6B9A51C9EAD4E27C33D3B3F180316E5BCAB92C933F0E4DBC#)))"; static int test_keys (DSA_secret_key *sk, unsigned int qbits); static int check_secret_key (DSA_secret_key *sk); static gpg_err_code_t generate (DSA_secret_key *sk, unsigned int nbits, unsigned int qbits, int transient_key, dsa_domain_t *domain, gcry_mpi_t **ret_factors); static gpg_err_code_t sign (gcry_mpi_t r, gcry_mpi_t s, gcry_mpi_t input, DSA_secret_key *skey, int flags, int hashalgo); static gpg_err_code_t verify (gcry_mpi_t r, gcry_mpi_t s, gcry_mpi_t input, - DSA_public_key *pkey); + DSA_public_key *pkey, int flags, int hashalgo); static unsigned int dsa_get_nbits (gcry_sexp_t parms); static void (*progress_cb) (void *,const char *, int, int, int ); static void *progress_cb_data; void _gcry_register_pk_dsa_progress (void (*cb) (void *, const char *, int, int, int), void *cb_data) { progress_cb = cb; progress_cb_data = cb_data; } static void progress (int c) { if (progress_cb) progress_cb (progress_cb_data, "pk_dsa", c, 0, 0); } /* Check that a freshly generated key actually works. Returns 0 on success. */ static int test_keys (DSA_secret_key *sk, unsigned int qbits) { int result = -1; /* Default to failure. */ DSA_public_key pk; gcry_mpi_t data = mpi_new (qbits); gcry_mpi_t sig_a = mpi_new (qbits); gcry_mpi_t sig_b = mpi_new (qbits); /* Put the relevant parameters into a public key structure. */ pk.p = sk->p; pk.q = sk->q; pk.g = sk->g; pk.y = sk->y; /* Create a random plaintext. */ _gcry_mpi_randomize (data, qbits, GCRY_WEAK_RANDOM); /* Sign DATA using the secret key. */ sign (sig_a, sig_b, data, sk, 0, 0); /* Verify the signature using the public key. */ - if ( verify (sig_a, sig_b, data, &pk) ) + if ( verify (sig_a, sig_b, data, &pk, 0, 0) ) goto leave; /* Signature does not match. */ /* Modify the data and check that the signing fails. */ mpi_add_ui (data, data, 1); - if ( !verify (sig_a, sig_b, data, &pk) ) + if ( !verify (sig_a, sig_b, data, &pk, 0, 0) ) goto leave; /* Signature matches but should not. */ result = 0; /* The test succeeded. */ leave: _gcry_mpi_release (sig_b); _gcry_mpi_release (sig_a); _gcry_mpi_release (data); return result; } /* Generate a DSA key pair with a key of size NBITS. If transient_key is true the key is generated using the standard RNG and not the very secure one. Returns: 2 structures filled with all needed values and an array with the n-1 factors of (p-1) */ static gpg_err_code_t generate (DSA_secret_key *sk, unsigned int nbits, unsigned int qbits, int transient_key, dsa_domain_t *domain, gcry_mpi_t **ret_factors ) { gpg_err_code_t rc; gcry_mpi_t p; /* the prime */ gcry_mpi_t q; /* the 160 bit prime factor */ gcry_mpi_t g; /* the generator */ gcry_mpi_t y; /* g^x mod p */ gcry_mpi_t x; /* the secret exponent */ gcry_mpi_t h, e; /* helper */ unsigned char *rndbuf; gcry_random_level_t random_level; if (qbits) ; /* Caller supplied qbits. Use this value. */ else if ( nbits >= 512 && nbits <= 1024 ) qbits = 160; else if ( nbits == 2048 ) qbits = 224; else if ( nbits == 3072 ) qbits = 256; else if ( nbits == 7680 ) qbits = 384; else if ( nbits == 15360 ) qbits = 512; else return GPG_ERR_INV_VALUE; if (qbits < 160 || qbits > 512 || (qbits%8) ) return GPG_ERR_INV_VALUE; if (nbits < 2*qbits || nbits > 15360) return GPG_ERR_INV_VALUE; if (fips_mode ()) { if (nbits < 1024) return GPG_ERR_INV_VALUE; if (transient_key) return GPG_ERR_INV_VALUE; } if (domain->p && domain->q && domain->g) { /* Domain parameters are given; use them. */ p = mpi_copy (domain->p); q = mpi_copy (domain->q); g = mpi_copy (domain->g); gcry_assert (mpi_get_nbits (p) == nbits); gcry_assert (mpi_get_nbits (q) == qbits); h = mpi_alloc (0); e = NULL; } else { /* Generate new domain parameters. */ rc = _gcry_generate_elg_prime (1, nbits, qbits, NULL, &p, ret_factors); if (rc) return rc; /* Get q out of factors. */ q = mpi_copy ((*ret_factors)[0]); gcry_assert (mpi_get_nbits (q) == qbits); /* Find a generator g (h and e are helpers). e = (p-1)/q */ e = mpi_alloc (mpi_get_nlimbs (p)); mpi_sub_ui (e, p, 1); mpi_fdiv_q (e, e, q); g = mpi_alloc (mpi_get_nlimbs (p)); h = mpi_alloc_set_ui (1); /* (We start with 2.) */ do { mpi_add_ui (h, h, 1); /* g = h^e mod p */ mpi_powm (g, h, e, p); } while (!mpi_cmp_ui (g, 1)); /* Continue until g != 1. */ } /* Select a random number X with the property: * 0 < x < q-1 * * FIXME: Why do we use the requirement x < q-1 ? It should be * sufficient to test for x < q. FIPS-186-3 check x < q-1 but it * does not check for 0 < x because it makes sure that Q is unsigned * and finally adds one to the result so that 0 will never be * returned. We should replace the code below with _gcry_dsa_gen_k. * * This must be a very good random number because this is the secret * part. The random quality depends on the transient_key flag. */ random_level = transient_key ? GCRY_STRONG_RANDOM : GCRY_VERY_STRONG_RANDOM; if (DBG_CIPHER) log_debug("choosing a random x%s\n", transient_key? " (transient-key)":""); gcry_assert( qbits >= 160 ); x = mpi_alloc_secure( mpi_get_nlimbs(q) ); mpi_sub_ui( h, q, 1 ); /* put q-1 into h */ rndbuf = NULL; do { if( DBG_CIPHER ) progress('.'); if( !rndbuf ) rndbuf = _gcry_random_bytes_secure ((qbits+7)/8, random_level); else { /* Change only some of the higher bits (= 2 bytes)*/ char *r = _gcry_random_bytes_secure (2, random_level); memcpy(rndbuf, r, 2 ); xfree(r); } _gcry_mpi_set_buffer( x, rndbuf, (qbits+7)/8, 0 ); mpi_clear_highbit( x, qbits+1 ); } while ( !( mpi_cmp_ui( x, 0 )>0 && mpi_cmp( x, h )<0 ) ); xfree(rndbuf); mpi_free( e ); mpi_free( h ); /* y = g^x mod p */ y = mpi_alloc( mpi_get_nlimbs(p) ); mpi_powm (y, g, x, p); if( DBG_CIPHER ) { progress('\n'); log_mpidump("dsa p", p ); log_mpidump("dsa q", q ); log_mpidump("dsa g", g ); log_mpidump("dsa y", y ); log_mpidump("dsa x", x ); } /* Copy the stuff to the key structures. */ sk->p = p; sk->q = q; sk->g = g; sk->y = y; sk->x = x; /* Now we can test our keys (this should never fail!). */ if ( test_keys (sk, qbits) ) { _gcry_mpi_release (sk->p); sk->p = NULL; _gcry_mpi_release (sk->q); sk->q = NULL; _gcry_mpi_release (sk->g); sk->g = NULL; _gcry_mpi_release (sk->y); sk->y = NULL; _gcry_mpi_release (sk->x); sk->x = NULL; fips_signal_error ("self-test after key generation failed"); return GPG_ERR_SELFTEST_FAILED; } return 0; } /* Generate a DSA key pair with a key of size NBITS using the algorithm given in FIPS-186-3. If USE_FIPS186_2 is true, FIPS-186-2 is used and thus the length is restricted to 1024/160. If DERIVEPARMS is not NULL it may contain a seed value. If domain parameters are specified in DOMAIN, DERIVEPARMS may not be given and NBITS and QBITS must match the specified domain parameters. */ static gpg_err_code_t generate_fips186 (DSA_secret_key *sk, unsigned int nbits, unsigned int qbits, gcry_sexp_t deriveparms, int use_fips186_2, dsa_domain_t *domain, int *r_counter, void **r_seed, size_t *r_seedlen, gcry_mpi_t *r_h) { gpg_err_code_t ec; struct { gcry_sexp_t sexp; const void *seed; size_t seedlen; } initial_seed = { NULL, NULL, 0 }; gcry_mpi_t prime_q = NULL; gcry_mpi_t prime_p = NULL; gcry_mpi_t value_g = NULL; /* The generator. */ gcry_mpi_t value_y = NULL; /* g^x mod p */ gcry_mpi_t value_x = NULL; /* The secret exponent. */ gcry_mpi_t value_h = NULL; /* Helper. */ gcry_mpi_t value_e = NULL; /* Helper. */ gcry_mpi_t value_c = NULL; /* helper for x */ gcry_mpi_t value_qm2 = NULL; /* q - 2 */ /* Preset return values. */ *r_counter = 0; *r_seed = NULL; *r_seedlen = 0; *r_h = NULL; /* Derive QBITS from NBITS if requested */ if (!qbits) { if (nbits == 1024) qbits = 160; else if (nbits == 2048) qbits = 224; else if (nbits == 3072) qbits = 256; } /* Check that QBITS and NBITS match the standard. Note that FIPS 186-3 uses N for QBITS and L for NBITS. */ if (nbits == 1024 && qbits == 160 && use_fips186_2) ; /* Allowed in FIPS 186-2 mode. */ else if (nbits == 2048 && qbits == 224) ; else if (nbits == 2048 && qbits == 256) ; else if (nbits == 3072 && qbits == 256) ; else return GPG_ERR_INV_VALUE; if (domain->p && domain->q && domain->g) { /* Domain parameters are given; use them. */ prime_p = mpi_copy (domain->p); prime_q = mpi_copy (domain->q); value_g = mpi_copy (domain->g); gcry_assert (mpi_get_nbits (prime_p) == nbits); gcry_assert (mpi_get_nbits (prime_q) == qbits); gcry_assert (!deriveparms); ec = 0; } else { /* Generate new domain parameters. */ /* Get an initial seed value. */ if (deriveparms) { initial_seed.sexp = sexp_find_token (deriveparms, "seed", 0); if (initial_seed.sexp) initial_seed.seed = sexp_nth_data (initial_seed.sexp, 1, &initial_seed.seedlen); } if (use_fips186_2) ec = _gcry_generate_fips186_2_prime (nbits, qbits, initial_seed.seed, initial_seed.seedlen, &prime_q, &prime_p, r_counter, r_seed, r_seedlen); else ec = _gcry_generate_fips186_3_prime (nbits, qbits, initial_seed.seed, initial_seed.seedlen, &prime_q, &prime_p, r_counter, r_seed, r_seedlen, NULL); sexp_release (initial_seed.sexp); if (ec) goto leave; /* Find a generator g (h and e are helpers). * e = (p-1)/q */ value_e = mpi_alloc_like (prime_p); mpi_sub_ui (value_e, prime_p, 1); mpi_fdiv_q (value_e, value_e, prime_q ); value_g = mpi_alloc_like (prime_p); value_h = mpi_alloc_set_ui (1); do { mpi_add_ui (value_h, value_h, 1); /* g = h^e mod p */ mpi_powm (value_g, value_h, value_e, prime_p); } while (!mpi_cmp_ui (value_g, 1)); /* Continue until g != 1. */ } value_c = mpi_snew (qbits); value_x = mpi_snew (qbits); value_qm2 = mpi_snew (qbits); mpi_sub_ui (value_qm2, prime_q, 2); /* FIPS 186-4 B.1.2 steps 4-6 */ do { if( DBG_CIPHER ) progress('.'); _gcry_mpi_randomize (value_c, qbits, GCRY_VERY_STRONG_RANDOM); mpi_clear_highbit (value_c, qbits+1); } while (!(mpi_cmp_ui (value_c, 0) > 0 && mpi_cmp (value_c, value_qm2) < 0)); /* while (mpi_cmp (value_c, value_qm2) > 0); */ /* x = c + 1 */ mpi_add_ui(value_x, value_c, 1); /* y = g^x mod p */ value_y = mpi_alloc_like (prime_p); mpi_powm (value_y, value_g, value_x, prime_p); if (DBG_CIPHER) { progress('\n'); log_mpidump("dsa p", prime_p ); log_mpidump("dsa q", prime_q ); log_mpidump("dsa g", value_g ); log_mpidump("dsa y", value_y ); log_mpidump("dsa x", value_x ); log_mpidump("dsa h", value_h ); } /* Copy the stuff to the key structures. */ sk->p = prime_p; prime_p = NULL; sk->q = prime_q; prime_q = NULL; sk->g = value_g; value_g = NULL; sk->y = value_y; value_y = NULL; sk->x = value_x; value_x = NULL; *r_h = value_h; value_h = NULL; leave: _gcry_mpi_release (prime_p); _gcry_mpi_release (prime_q); _gcry_mpi_release (value_g); _gcry_mpi_release (value_y); _gcry_mpi_release (value_x); _gcry_mpi_release (value_h); _gcry_mpi_release (value_e); _gcry_mpi_release (value_c); _gcry_mpi_release (value_qm2); /* As a last step test this keys (this should never fail of course). */ if (!ec && test_keys (sk, qbits) ) { _gcry_mpi_release (sk->p); sk->p = NULL; _gcry_mpi_release (sk->q); sk->q = NULL; _gcry_mpi_release (sk->g); sk->g = NULL; _gcry_mpi_release (sk->y); sk->y = NULL; _gcry_mpi_release (sk->x); sk->x = NULL; fips_signal_error ("self-test after key generation failed"); ec = GPG_ERR_SELFTEST_FAILED; } if (ec) { *r_counter = 0; xfree (*r_seed); *r_seed = NULL; *r_seedlen = 0; _gcry_mpi_release (*r_h); *r_h = NULL; } return ec; } /* Test whether the secret key is valid. Returns: if this is a valid key. */ static int check_secret_key( DSA_secret_key *sk ) { int rc; gcry_mpi_t y = mpi_alloc( mpi_get_nlimbs(sk->y) ); mpi_powm( y, sk->g, sk->x, sk->p ); rc = !mpi_cmp( y, sk->y ); mpi_free( y ); return rc; } /* Make a DSA signature from INPUT and put it into r and s. INPUT may either be a plain MPI or an opaque MPI which is then internally converted to a plain MPI. FLAGS and HASHALGO may both be 0 for standard operation mode. The return value is 0 on success or an error code. Note that for backward compatibility the function will not return any error if FLAGS and HASHALGO are both 0 and INPUT is a plain MPI. */ static gpg_err_code_t sign (gcry_mpi_t r, gcry_mpi_t s, gcry_mpi_t input, DSA_secret_key *skey, int flags, int hashalgo) { gpg_err_code_t rc; gcry_mpi_t hash; gcry_mpi_t k; gcry_mpi_t kinv; gcry_mpi_t tmp; const void *abuf; unsigned int abits, qbits; int extraloops = 0; + gcry_mpi_t hash_computed_internally = NULL; qbits = mpi_get_nbits (skey->q); + if ((flags & PUBKEY_FLAG_PREHASH)) + { + rc = _gcry_dsa_compute_hash (&hash_computed_internally, input, hashalgo); + if (rc) + return rc; + input = hash_computed_internally; + } + /* Convert the INPUT into an MPI. */ rc = _gcry_dsa_normalize_hash (input, &hash, qbits); if (rc) - return rc; + { + mpi_free (hash_computed_internally); + return rc; + } again: /* Create the K value. */ if ((flags & PUBKEY_FLAG_RFC6979) && hashalgo) { /* Use Pornin's method for deterministic DSA. If this flag is set, it is expected that HASH is an opaque MPI with the to be signed hash. That hash is also used as h1 from 3.2.a. */ if (!mpi_is_opaque (input)) { rc = GPG_ERR_CONFLICT; goto leave; } abuf = mpi_get_opaque (input, &abits); rc = _gcry_dsa_gen_rfc6979_k (&k, skey->q, skey->x, abuf, (abits+7)/8, hashalgo, extraloops); if (rc) goto leave; } else { /* Select a random k with 0 < k < q */ k = _gcry_dsa_gen_k (skey->q, GCRY_STRONG_RANDOM); } /* kinv = k^(-1) mod q */ kinv = mpi_alloc( mpi_get_nlimbs(k) ); mpi_invm(kinv, k, skey->q ); _gcry_dsa_modify_k (k, skey->q, qbits); /* r = (a^k mod p) mod q */ mpi_powm( r, skey->g, k, skey->p ); mpi_fdiv_r( r, r, skey->q ); /* s = (kinv * ( hash + x * r)) mod q */ tmp = mpi_alloc( mpi_get_nlimbs(skey->p) ); mpi_mul( tmp, skey->x, r ); mpi_add( tmp, tmp, hash ); mpi_mulm( s , kinv, tmp, skey->q ); mpi_free(k); mpi_free(kinv); mpi_free(tmp); if (!mpi_cmp_ui (r, 0)) { /* This is a highly unlikely code path. */ extraloops++; goto again; } rc = 0; leave: if (hash != input) mpi_free (hash); + mpi_free (hash_computed_internally); return rc; } /* Returns true if the signature composed from R and S is valid. */ static gpg_err_code_t -verify (gcry_mpi_t r, gcry_mpi_t s, gcry_mpi_t input, DSA_public_key *pkey ) +verify (gcry_mpi_t r, gcry_mpi_t s, gcry_mpi_t input, DSA_public_key *pkey, + int flags, int hashalgo) { gpg_err_code_t rc = 0; gcry_mpi_t w, u1, u2, v; gcry_mpi_t base[3]; gcry_mpi_t ex[3]; gcry_mpi_t hash; unsigned int nbits; + gcry_mpi_t hash_computed_internally = NULL; if( !(mpi_cmp_ui( r, 0 ) > 0 && mpi_cmp( r, pkey->q ) < 0) ) return GPG_ERR_BAD_SIGNATURE; /* Assertion 0 < r < n failed. */ if( !(mpi_cmp_ui( s, 0 ) > 0 && mpi_cmp( s, pkey->q ) < 0) ) return GPG_ERR_BAD_SIGNATURE; /* Assertion 0 < s < n failed. */ nbits = mpi_get_nbits (pkey->q); + if ((flags & PUBKEY_FLAG_PREHASH)) + { + rc = _gcry_dsa_compute_hash (&hash_computed_internally, input, hashalgo); + if (rc) + return rc; + input = hash_computed_internally; + } rc = _gcry_dsa_normalize_hash (input, &hash, nbits); if (rc) - return rc; + { + mpi_free (hash_computed_internally); + return rc; + } w = mpi_alloc( mpi_get_nlimbs(pkey->q) ); u1 = mpi_alloc( mpi_get_nlimbs(pkey->q) ); u2 = mpi_alloc( mpi_get_nlimbs(pkey->q) ); v = mpi_alloc( mpi_get_nlimbs(pkey->p) ); /* w = s^(-1) mod q */ mpi_invm( w, s, pkey->q ); /* u1 = (hash * w) mod q */ mpi_mulm( u1, hash, w, pkey->q ); /* u2 = r * w mod q */ mpi_mulm( u2, r, w, pkey->q ); /* v = g^u1 * y^u2 mod p mod q */ base[0] = pkey->g; ex[0] = u1; base[1] = pkey->y; ex[1] = u2; base[2] = NULL; ex[2] = NULL; mpi_mulpowm( v, base, ex, pkey->p ); mpi_fdiv_r( v, v, pkey->q ); if (mpi_cmp( v, r )) { if (DBG_CIPHER) { log_mpidump (" i", input); log_mpidump (" h", hash); log_mpidump (" v", v); log_mpidump (" r", r); log_mpidump (" s", s); } rc = GPG_ERR_BAD_SIGNATURE; } mpi_free(w); mpi_free(u1); mpi_free(u2); mpi_free(v); if (hash != input) mpi_free (hash); + mpi_free (hash_computed_internally); return rc; } /********************************************* ************** interface ****************** *********************************************/ static gcry_err_code_t dsa_generate (const gcry_sexp_t genparms, gcry_sexp_t *r_skey) { gpg_err_code_t rc; unsigned int nbits; gcry_sexp_t domainsexp; DSA_secret_key sk; gcry_sexp_t l1; unsigned int qbits = 0; gcry_sexp_t deriveparms = NULL; gcry_sexp_t seedinfo = NULL; gcry_sexp_t misc_info = NULL; int flags = 0; dsa_domain_t domain; gcry_mpi_t *factors = NULL; memset (&sk, 0, sizeof sk); memset (&domain, 0, sizeof domain); rc = _gcry_pk_util_get_nbits (genparms, &nbits); if (rc) return rc; /* Parse the optional flags list. */ l1 = sexp_find_token (genparms, "flags", 0); if (l1) { rc = _gcry_pk_util_parse_flaglist (l1, &flags, NULL); sexp_release (l1); if (rc) return rc;\ } /* Parse the optional qbits element. */ l1 = sexp_find_token (genparms, "qbits", 0); if (l1) { char buf[50]; const char *s; size_t n; s = sexp_nth_data (l1, 1, &n); if (!s || n >= DIM (buf) - 1 ) { sexp_release (l1); return GPG_ERR_INV_OBJ; /* No value or value too large. */ } memcpy (buf, s, n); buf[n] = 0; qbits = (unsigned int)strtoul (buf, NULL, 0); sexp_release (l1); } /* Parse the optional transient-key flag. */ if (!(flags & PUBKEY_FLAG_TRANSIENT_KEY)) { l1 = sexp_find_token (genparms, "transient-key", 0); if (l1) { flags |= PUBKEY_FLAG_TRANSIENT_KEY; sexp_release (l1); } } /* Get the optional derive parameters. */ deriveparms = sexp_find_token (genparms, "derive-parms", 0); /* Parse the optional "use-fips186" flags. */ if (!(flags & PUBKEY_FLAG_USE_FIPS186)) { l1 = sexp_find_token (genparms, "use-fips186", 0); if (l1) { flags |= PUBKEY_FLAG_USE_FIPS186; sexp_release (l1); } } if (!(flags & PUBKEY_FLAG_USE_FIPS186_2)) { l1 = sexp_find_token (genparms, "use-fips186-2", 0); if (l1) { flags |= PUBKEY_FLAG_USE_FIPS186_2; sexp_release (l1); } } /* Check whether domain parameters are given. */ domainsexp = sexp_find_token (genparms, "domain", 0); if (domainsexp) { /* DERIVEPARMS can't be used together with domain parameters. NBITS abnd QBITS may not be specified because there values are derived from the domain parameters. */ if (deriveparms || qbits || nbits) { sexp_release (domainsexp); sexp_release (deriveparms); return GPG_ERR_INV_VALUE; } /* Put all domain parameters into the domain object. */ l1 = sexp_find_token (domainsexp, "p", 0); domain.p = sexp_nth_mpi (l1, 1, GCRYMPI_FMT_USG); sexp_release (l1); l1 = sexp_find_token (domainsexp, "q", 0); domain.q = sexp_nth_mpi (l1, 1, GCRYMPI_FMT_USG); sexp_release (l1); l1 = sexp_find_token (domainsexp, "g", 0); domain.g = sexp_nth_mpi (l1, 1, GCRYMPI_FMT_USG); sexp_release (l1); sexp_release (domainsexp); /* Check that all domain parameters are available. */ if (!domain.p || !domain.q || !domain.g) { _gcry_mpi_release (domain.p); _gcry_mpi_release (domain.q); _gcry_mpi_release (domain.g); sexp_release (deriveparms); return GPG_ERR_MISSING_VALUE; } /* Get NBITS and QBITS from the domain parameters. */ nbits = mpi_get_nbits (domain.p); qbits = mpi_get_nbits (domain.q); } if (deriveparms || (flags & PUBKEY_FLAG_USE_FIPS186) || (flags & PUBKEY_FLAG_USE_FIPS186_2) || fips_mode ()) { int counter; void *seed; size_t seedlen; gcry_mpi_t h_value; rc = generate_fips186 (&sk, nbits, qbits, deriveparms, !!(flags & PUBKEY_FLAG_USE_FIPS186_2), &domain, &counter, &seed, &seedlen, &h_value); if (!rc && h_value) { /* Format the seed-values unless domain parameters are used for which a H_VALUE of NULL is an indication. */ rc = sexp_build (&seedinfo, NULL, "(seed-values(counter %d)(seed %b)(h %m))", counter, (int)seedlen, seed, h_value); xfree (seed); _gcry_mpi_release (h_value); } } else { rc = generate (&sk, nbits, qbits, !!(flags & PUBKEY_FLAG_TRANSIENT_KEY), &domain, &factors); } if (!rc) { /* Put the factors into MISC_INFO. Note that the factors are not confidential thus we can store them in standard memory. */ int nfactors, i, j; char *p; char *format = NULL; void **arg_list = NULL; for (nfactors=0; factors && factors[nfactors]; nfactors++) ; /* Allocate space for the format string: "(misc-key-info%S(pm1-factors%m))" with one "%m" for each factor and construct it. */ format = xtrymalloc (50 + 2*nfactors); if (!format) rc = gpg_err_code_from_syserror (); else { p = stpcpy (format, "(misc-key-info"); if (seedinfo) p = stpcpy (p, "%S"); if (nfactors) { p = stpcpy (p, "(pm1-factors"); for (i=0; i < nfactors; i++) p = stpcpy (p, "%m"); p = stpcpy (p, ")"); } p = stpcpy (p, ")"); /* Allocate space for the list of factors plus one for the seedinfo s-exp plus an extra NULL entry for safety and fill it with the factors. */ arg_list = xtrycalloc (nfactors+1+1, sizeof *arg_list); if (!arg_list) rc = gpg_err_code_from_syserror (); else { i = 0; if (seedinfo) arg_list[i++] = &seedinfo; for (j=0; j < nfactors; j++) arg_list[i++] = factors + j; arg_list[i] = NULL; rc = sexp_build_array (&misc_info, NULL, format, arg_list); } } xfree (arg_list); xfree (format); } if (!rc) rc = sexp_build (r_skey, NULL, "(key-data" " (public-key" " (dsa(p%m)(q%m)(g%m)(y%m)))" " (private-key" " (dsa(p%m)(q%m)(g%m)(y%m)(x%m)))" " %S)", sk.p, sk.q, sk.g, sk.y, sk.p, sk.q, sk.g, sk.y, sk.x, misc_info); _gcry_mpi_release (sk.p); _gcry_mpi_release (sk.q); _gcry_mpi_release (sk.g); _gcry_mpi_release (sk.y); _gcry_mpi_release (sk.x); _gcry_mpi_release (domain.p); _gcry_mpi_release (domain.q); _gcry_mpi_release (domain.g); sexp_release (seedinfo); sexp_release (misc_info); sexp_release (deriveparms); if (factors) { gcry_mpi_t *mp; for (mp = factors; *mp; mp++) mpi_free (*mp); xfree (factors); } return rc; } static gcry_err_code_t dsa_check_secret_key (gcry_sexp_t keyparms) { gcry_err_code_t rc; DSA_secret_key sk = {NULL, NULL, NULL, NULL, NULL}; rc = _gcry_sexp_extract_param (keyparms, NULL, "pqgyx", &sk.p, &sk.q, &sk.g, &sk.y, &sk.x, NULL); if (rc) goto leave; if (!check_secret_key (&sk)) rc = GPG_ERR_BAD_SECKEY; leave: _gcry_mpi_release (sk.p); _gcry_mpi_release (sk.q); _gcry_mpi_release (sk.g); _gcry_mpi_release (sk.y); _gcry_mpi_release (sk.x); if (DBG_CIPHER) log_debug ("dsa_testkey => %s\n", gpg_strerror (rc)); return rc; } static gcry_err_code_t dsa_sign (gcry_sexp_t *r_sig, gcry_sexp_t s_data, gcry_sexp_t keyparms) { gcry_err_code_t rc; struct pk_encoding_ctx ctx; gcry_mpi_t data = NULL; DSA_secret_key sk = {NULL, NULL, NULL, NULL, NULL}; gcry_mpi_t sig_r = NULL; gcry_mpi_t sig_s = NULL; _gcry_pk_util_init_encoding_ctx (&ctx, PUBKEY_OP_SIGN, dsa_get_nbits (keyparms)); /* Extract the data. */ rc = _gcry_pk_util_data_to_mpi (s_data, &data, &ctx); if (rc) goto leave; if (DBG_CIPHER) log_mpidump ("dsa_sign data", data); /* Extract the key. */ rc = _gcry_sexp_extract_param (keyparms, NULL, "pqgyx", &sk.p, &sk.q, &sk.g, &sk.y, &sk.x, NULL); if (rc) goto leave; if (DBG_CIPHER) { log_mpidump ("dsa_sign p", sk.p); log_mpidump ("dsa_sign q", sk.q); log_mpidump ("dsa_sign g", sk.g); log_mpidump ("dsa_sign y", sk.y); if (!fips_mode ()) log_mpidump ("dsa_sign x", sk.x); } sig_r = mpi_new (0); sig_s = mpi_new (0); rc = sign (sig_r, sig_s, data, &sk, ctx.flags, ctx.hash_algo); if (rc) goto leave; if (DBG_CIPHER) { log_mpidump ("dsa_sign sig_r", sig_r); log_mpidump ("dsa_sign sig_s", sig_s); } rc = sexp_build (r_sig, NULL, "(sig-val(dsa(r%M)(s%M)))", sig_r, sig_s); leave: _gcry_mpi_release (sig_r); _gcry_mpi_release (sig_s); _gcry_mpi_release (sk.p); _gcry_mpi_release (sk.q); _gcry_mpi_release (sk.g); _gcry_mpi_release (sk.y); _gcry_mpi_release (sk.x); _gcry_mpi_release (data); _gcry_pk_util_free_encoding_ctx (&ctx); if (DBG_CIPHER) log_debug ("dsa_sign => %s\n", gpg_strerror (rc)); return rc; } static gcry_err_code_t dsa_verify (gcry_sexp_t s_sig, gcry_sexp_t s_data, gcry_sexp_t s_keyparms) { gcry_err_code_t rc; struct pk_encoding_ctx ctx; gcry_sexp_t l1 = NULL; gcry_mpi_t sig_r = NULL; gcry_mpi_t sig_s = NULL; gcry_mpi_t data = NULL; DSA_public_key pk = { NULL, NULL, NULL, NULL }; _gcry_pk_util_init_encoding_ctx (&ctx, PUBKEY_OP_VERIFY, dsa_get_nbits (s_keyparms)); /* Extract the data. */ rc = _gcry_pk_util_data_to_mpi (s_data, &data, &ctx); if (rc) goto leave; if (DBG_CIPHER) log_mpidump ("dsa_verify data", data); /* Extract the signature value. */ rc = _gcry_pk_util_preparse_sigval (s_sig, dsa_names, &l1, NULL); if (rc) goto leave; rc = _gcry_sexp_extract_param (l1, NULL, "rs", &sig_r, &sig_s, NULL); if (rc) goto leave; if (DBG_CIPHER) { log_mpidump ("dsa_verify s_r", sig_r); log_mpidump ("dsa_verify s_s", sig_s); } /* Extract the key. */ rc = _gcry_sexp_extract_param (s_keyparms, NULL, "pqgy", &pk.p, &pk.q, &pk.g, &pk.y, NULL); if (rc) goto leave; if (DBG_CIPHER) { log_mpidump ("dsa_verify p", pk.p); log_mpidump ("dsa_verify q", pk.q); log_mpidump ("dsa_verify g", pk.g); log_mpidump ("dsa_verify y", pk.y); } /* Verify the signature. */ - rc = verify (sig_r, sig_s, data, &pk); + rc = verify (sig_r, sig_s, data, &pk, ctx.flags, ctx.hash_algo); leave: _gcry_mpi_release (pk.p); _gcry_mpi_release (pk.q); _gcry_mpi_release (pk.g); _gcry_mpi_release (pk.y); _gcry_mpi_release (data); _gcry_mpi_release (sig_r); _gcry_mpi_release (sig_s); sexp_release (l1); _gcry_pk_util_free_encoding_ctx (&ctx); if (DBG_CIPHER) log_debug ("dsa_verify => %s\n", rc?gpg_strerror (rc):"Good"); return rc; } /* Return the number of bits for the key described by PARMS. On error * 0 is returned. The format of PARMS starts with the algorithm name; * for example: * * (dsa * (p ) * (q ) * (g ) * (y )) * * More parameters may be given but we only need P here. */ static unsigned int dsa_get_nbits (gcry_sexp_t parms) { gcry_sexp_t l1; gcry_mpi_t p; unsigned int nbits; l1 = sexp_find_token (parms, "p", 1); if (!l1) return 0; /* Parameter P not found. */ p = sexp_nth_mpi (l1, 1, GCRYMPI_FMT_USG); sexp_release (l1); nbits = p? mpi_get_nbits (p) : 0; _gcry_mpi_release (p); return nbits; } /* Self-test section. */ static const char * selftest_sign (gcry_sexp_t pkey, gcry_sexp_t skey) { /* Sample data from RFC 6979 section A.2.2, hash is of message "sample" */ static const char sample_data[] = - "(data (flags rfc6979)" - " (hash sha256 #af2bdbe1aa9b6ec1e2ade1d694f41fc71a831d0268e9891562113d8a62add1bf#))"; + "(data (flags rfc6979 prehash)" + " (hash-algo sha256)" + " (value 6:sample))"; static const char sample_data_bad[] = "(data (flags rfc6979)" " (hash sha256 #bf2bdbe1aa9b6ec1e2ade1d694f41fc71a831d0268e9891562113d8a62add1bf#))"; static const char signature_r[] = "eace8bdbbe353c432a795d9ec556c6d021f7a03f42c36e9bc87e4ac7932cc809"; static const char signature_s[] = "7081e175455f9247b812b74583e9e94f9ea79bd640dc962533b0680793a38d53"; const char *errtxt = NULL; gcry_error_t err; gcry_sexp_t data = NULL; gcry_sexp_t data_bad = NULL; gcry_sexp_t sig = NULL; gcry_sexp_t l1 = NULL; gcry_sexp_t l2 = NULL; gcry_mpi_t r = NULL; gcry_mpi_t s = NULL; gcry_mpi_t calculated_r = NULL; gcry_mpi_t calculated_s = NULL; int cmp; err = sexp_sscan (&data, NULL, sample_data, strlen (sample_data)); if (!err) err = sexp_sscan (&data_bad, NULL, sample_data_bad, strlen (sample_data_bad)); if (!err) err = _gcry_mpi_scan (&r, GCRYMPI_FMT_HEX, signature_r, 0, NULL); if (!err) err = _gcry_mpi_scan (&s, GCRYMPI_FMT_HEX, signature_s, 0, NULL); if (err) { errtxt = "converting data failed"; goto leave; } err = _gcry_pk_sign (&sig, data, skey); if (err) { errtxt = "signing failed"; goto leave; } /* check against known signature */ errtxt = "signature validity failed"; l1 = _gcry_sexp_find_token (sig, "sig-val", 0); if (!l1) goto leave; l2 = _gcry_sexp_find_token (l1, "dsa", 0); if (!l2) goto leave; sexp_release (l1); l1 = l2; l2 = _gcry_sexp_find_token (l1, "r", 0); if (!l2) goto leave; calculated_r = _gcry_sexp_nth_mpi (l2, 1, GCRYMPI_FMT_USG); if (!calculated_r) goto leave; sexp_release (l2); l2 = _gcry_sexp_find_token (l1, "s", 0); if (!l2) goto leave; calculated_s = _gcry_sexp_nth_mpi (l2, 1, GCRYMPI_FMT_USG); if (!calculated_s) goto leave; errtxt = "known sig check failed"; cmp = _gcry_mpi_cmp (r, calculated_r); if (cmp) goto leave; cmp = _gcry_mpi_cmp (s, calculated_s); if (cmp) goto leave; errtxt = NULL; err = _gcry_pk_verify (sig, data, pkey); if (err) { errtxt = "verify failed"; goto leave; } err = _gcry_pk_verify (sig, data_bad, pkey); if (gcry_err_code (err) != GPG_ERR_BAD_SIGNATURE) { errtxt = "bad signature not detected"; goto leave; } leave: _gcry_mpi_release (calculated_s); _gcry_mpi_release (calculated_r); _gcry_mpi_release (s); _gcry_mpi_release (r); sexp_release (l2); sexp_release (l1); sexp_release (sig); sexp_release (data_bad); sexp_release (data); return errtxt; } static gpg_err_code_t selftests_dsa_2048 (selftest_report_func_t report) { const char *what; const char *errtxt; gcry_error_t err; gcry_sexp_t skey = NULL; gcry_sexp_t pkey = NULL; /* Convert the S-expressions into the internal representation. */ what = "convert"; err = sexp_sscan (&skey, NULL, sample_secret_key_2048, strlen (sample_secret_key_2048)); if (!err) err = sexp_sscan (&pkey, NULL, sample_public_key_2048, strlen (sample_public_key_2048)); if (err) { errtxt = _gcry_strerror (err); goto failed; } what = "key consistency"; err = _gcry_pk_testkey (skey); if (err) { errtxt = _gcry_strerror (err); goto failed; } what = "sign"; errtxt = selftest_sign (pkey, skey); if (errtxt) goto failed; sexp_release (pkey); sexp_release (skey); return 0; /* Succeeded. */ failed: sexp_release (pkey); sexp_release (skey); if (report) report ("pubkey", GCRY_PK_DSA, what, errtxt); return GPG_ERR_SELFTEST_FAILED; } /* Run a full self-test for ALGO and return 0 on success. */ static gpg_err_code_t run_selftests (int algo, int extended, selftest_report_func_t report) { gpg_err_code_t ec; (void)extended; switch (algo) { case GCRY_PK_DSA: ec = selftests_dsa_2048 (report); break; default: ec = GPG_ERR_PUBKEY_ALGO; break; } return ec; } gcry_pk_spec_t _gcry_pubkey_spec_dsa = { GCRY_PK_DSA, { 0, 1 }, GCRY_PK_USAGE_SIGN, "DSA", dsa_names, "pqgy", "pqgyx", "", "rs", "pqgy", dsa_generate, dsa_check_secret_key, NULL, NULL, dsa_sign, dsa_verify, dsa_get_nbits, run_selftests }; diff --git a/cipher/ecc-common.h b/cipher/ecc-common.h index edd14295..c128aeb3 100644 --- a/cipher/ecc-common.h +++ b/cipher/ecc-common.h @@ -1,142 +1,143 @@ /* ecc-common.h - Declarations of common ECC code * Copyright (C) 2013 g10 Code GmbH * * This file is part of Libgcrypt. * * Libgcrypt is free software; you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as * published by the Free Software Foundation; either version 2.1 of * the License, or (at your option) any later version. * * Libgcrypt is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public * License along with this program; if not, see . */ #ifndef GCRY_ECC_COMMON_H #define GCRY_ECC_COMMON_H /* Definition of a curve. */ typedef struct { enum gcry_mpi_ec_models model;/* The model descrinbing this curve. */ enum ecc_dialects dialect; /* The dialect used with the curve. */ gcry_mpi_t p; /* Prime specifying the field GF(p). */ gcry_mpi_t a; /* First coefficient of the Weierstrass equation. */ gcry_mpi_t b; /* Second coefficient of the Weierstrass equation. or d as used by Twisted Edwards curves. */ mpi_point_struct G; /* Base point (generator). */ gcry_mpi_t n; /* Order of G. */ unsigned int h; /* Cofactor. */ const char *name; /* Name of the curve or NULL. */ } elliptic_curve_t; /* Set the value from S into D. */ static inline void point_set (mpi_point_t d, mpi_point_t s) { mpi_set (d->x, s->x); mpi_set (d->y, s->y); mpi_set (d->z, s->z); } #define point_init(a) _gcry_mpi_point_init ((a)) #define point_free(a) _gcry_mpi_point_free_parts ((a)) /*-- ecc-curves.c --*/ gpg_err_code_t _gcry_ecc_fill_in_curve (unsigned int nbits, const char *name, elliptic_curve_t *curve, unsigned int *r_nbits); gpg_err_code_t _gcry_ecc_update_curve_param (const char *name, enum gcry_mpi_ec_models *model, enum ecc_dialects *dialect, gcry_mpi_t *p, gcry_mpi_t *a, gcry_mpi_t *b, gcry_mpi_t *g, gcry_mpi_t *n); const char *_gcry_ecc_get_curve (gcry_sexp_t keyparms, int iterator, unsigned int *r_nbits); gcry_sexp_t _gcry_ecc_get_param_sexp (const char *name); /*-- ecc-misc.c --*/ void _gcry_ecc_curve_free (elliptic_curve_t *E); elliptic_curve_t _gcry_ecc_curve_copy (elliptic_curve_t E); const char *_gcry_ecc_model2str (enum gcry_mpi_ec_models model); const char *_gcry_ecc_dialect2str (enum ecc_dialects dialect); unsigned char *_gcry_ecc_ec2os_buf (gcry_mpi_t x, gcry_mpi_t y, gcry_mpi_t p, unsigned int *r_length); gcry_mpi_t _gcry_ecc_ec2os (gcry_mpi_t x, gcry_mpi_t y, gcry_mpi_t p); mpi_point_t _gcry_ecc_compute_public (mpi_point_t Q, mpi_ec_t ec); gpg_err_code_t _gcry_ecc_mont_encodepoint (gcry_mpi_t x, unsigned int nbits, int with_prefix, unsigned char **r_buffer, unsigned int *r_buflen); /*-- ecc.c --*/ /*-- ecc-ecdsa.c --*/ gpg_err_code_t _gcry_ecc_ecdsa_sign (gcry_mpi_t input, mpi_ec_t ec, gcry_mpi_t r, gcry_mpi_t s, int flags, int hashalgo); gpg_err_code_t _gcry_ecc_ecdsa_verify (gcry_mpi_t input, mpi_ec_t ec, - gcry_mpi_t r, gcry_mpi_t s); + gcry_mpi_t r, gcry_mpi_t s, + int flags, int hashalgo); /*-- ecc-eddsa.c --*/ gpg_err_code_t _gcry_ecc_eddsa_recover_x (gcry_mpi_t x, gcry_mpi_t y, int sign, mpi_ec_t ec); gpg_err_code_t _gcry_ecc_eddsa_encodepoint (mpi_point_t point, mpi_ec_t ctx, gcry_mpi_t x, gcry_mpi_t y, int with_prefix, unsigned char **r_buffer, unsigned int *r_buflen); gpg_err_code_t _gcry_ecc_eddsa_ensure_compact (gcry_mpi_t value, unsigned int nbits); gpg_err_code_t _gcry_ecc_eddsa_compute_h_d (unsigned char **r_digest, mpi_ec_t ec); gpg_err_code_t _gcry_ecc_eddsa_genkey (mpi_ec_t ec, int flags); gpg_err_code_t _gcry_ecc_eddsa_sign (gcry_mpi_t input, mpi_ec_t ec, gcry_mpi_t r_r, gcry_mpi_t s, struct pk_encoding_ctx *ctx); gpg_err_code_t _gcry_ecc_eddsa_verify (gcry_mpi_t input, mpi_ec_t ec, gcry_mpi_t r, gcry_mpi_t s, struct pk_encoding_ctx *ctx); void reverse_buffer (unsigned char *buffer, unsigned int length); /*-- ecc-gost.c --*/ gpg_err_code_t _gcry_ecc_gost_sign (gcry_mpi_t input, mpi_ec_t ec, gcry_mpi_t r, gcry_mpi_t s); gpg_err_code_t _gcry_ecc_gost_verify (gcry_mpi_t input, mpi_ec_t ec, gcry_mpi_t r, gcry_mpi_t s); /*-- ecc-sm2.c --*/ gpg_err_code_t _gcry_ecc_sm2_encrypt (gcry_sexp_t *r_ciph, gcry_mpi_t input, mpi_ec_t ec); gpg_err_code_t _gcry_ecc_sm2_decrypt (gcry_sexp_t *r_plain, gcry_sexp_t data_list, mpi_ec_t ec); gpg_err_code_t _gcry_ecc_sm2_sign (gcry_mpi_t input, mpi_ec_t ec, gcry_mpi_t r, gcry_mpi_t s, int flags, int hashalgo); gpg_err_code_t _gcry_ecc_sm2_verify (gcry_mpi_t input, mpi_ec_t ec, gcry_mpi_t r, gcry_mpi_t s); #endif /*GCRY_ECC_COMMON_H*/ diff --git a/cipher/ecc-ecdsa.c b/cipher/ecc-ecdsa.c index 30103f14..c7f4c8d5 100644 --- a/cipher/ecc-ecdsa.c +++ b/cipher/ecc-ecdsa.c @@ -1,248 +1,277 @@ /* ecc-ecdsa.c - Elliptic Curve ECDSA signatures * Copyright (C) 2007, 2008, 2010, 2011 Free Software Foundation, Inc. * Copyright (C) 2013 g10 Code GmbH * * This file is part of Libgcrypt. * * Libgcrypt is free software; you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as * published by the Free Software Foundation; either version 2.1 of * the License, or (at your option) any later version. * * Libgcrypt is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public * License along with this program; if not, see . */ #include #include #include #include #include #include "g10lib.h" #include "mpi.h" #include "cipher.h" #include "context.h" #include "ec-context.h" #include "pubkey-internal.h" #include "ecc-common.h" /* Compute an ECDSA signature. * Return the signature struct (r,s) from the message hash. The caller * must have allocated R and S. */ gpg_err_code_t _gcry_ecc_ecdsa_sign (gcry_mpi_t input, mpi_ec_t ec, gcry_mpi_t r, gcry_mpi_t s, int flags, int hashalgo) { gpg_err_code_t rc = 0; int extraloops = 0; gcry_mpi_t k, dr, sum, k_1, x; mpi_point_struct I; gcry_mpi_t hash; const void *abuf; unsigned int abits, qbits; gcry_mpi_t b; /* Random number needed for blinding. */ gcry_mpi_t bi; /* multiplicative inverse of B. */ + gcry_mpi_t hash_computed_internally = NULL; if (DBG_CIPHER) log_mpidump ("ecdsa sign hash ", input ); qbits = mpi_get_nbits (ec->n); + if ((flags & PUBKEY_FLAG_PREHASH)) + { + rc = _gcry_dsa_compute_hash (&hash_computed_internally, input, hashalgo); + if (rc) + return rc; + input = hash_computed_internally; + } + /* Convert the INPUT into an MPI if needed. */ rc = _gcry_dsa_normalize_hash (input, &hash, qbits); + if (rc) - return rc; + { + mpi_free (hash_computed_internally); + return rc; + } b = mpi_snew (qbits); bi = mpi_snew (qbits); do { _gcry_mpi_randomize (b, qbits, GCRY_WEAK_RANDOM); mpi_mod (b, b, ec->n); } while (!mpi_invm (bi, b, ec->n)); k = NULL; dr = mpi_alloc (0); sum = mpi_alloc (0); k_1 = mpi_alloc (0); x = mpi_alloc (0); point_init (&I); /* Two loops to avoid R or S are zero. This is more of a joke than a real demand because the probability of them being zero is less than any hardware failure. Some specs however require it. */ do { do { mpi_free (k); k = NULL; if ((flags & PUBKEY_FLAG_RFC6979) && hashalgo) { /* Use Pornin's method for deterministic DSA. If this flag is set, it is expected that HASH is an opaque MPI with the to be signed hash. That hash is also used as h1 from 3.2.a. */ if (!mpi_is_opaque (input)) { rc = GPG_ERR_CONFLICT; goto leave; } abuf = mpi_get_opaque (input, &abits); rc = _gcry_dsa_gen_rfc6979_k (&k, ec->n, ec->d, abuf, (abits+7)/8, hashalgo, extraloops); if (rc) goto leave; extraloops++; } else k = _gcry_dsa_gen_k (ec->n, GCRY_STRONG_RANDOM); mpi_invm (k_1, k, ec->n); /* k_1 = k^(-1) mod n */ _gcry_dsa_modify_k (k, ec->n, qbits); _gcry_mpi_ec_mul_point (&I, k, ec->G, ec); if (_gcry_mpi_ec_get_affine (x, NULL, &I, ec)) { if (DBG_CIPHER) log_debug ("ecc sign: Failed to get affine coordinates\n"); rc = GPG_ERR_BAD_SIGNATURE; goto leave; } mpi_mod (r, x, ec->n); /* r = x mod n */ } while (!mpi_cmp_ui (r, 0)); /* Computation of dr, sum, and s are blinded with b. */ mpi_mulm (dr, b, ec->d, ec->n); mpi_mulm (dr, dr, r, ec->n); /* dr = d*r mod n */ mpi_mulm (sum, b, hash, ec->n); mpi_addm (sum, sum, dr, ec->n); /* sum = hash + (d*r) mod n */ mpi_mulm (s, k_1, sum, ec->n); /* s = k^(-1)*(hash+(d*r)) mod n */ /* Undo blinding by b^-1 */ mpi_mulm (s, bi, s, ec->n); } while (!mpi_cmp_ui (s, 0)); if (DBG_CIPHER) { log_mpidump ("ecdsa sign result r ", r); log_mpidump ("ecdsa sign result s ", s); } leave: mpi_free (b); mpi_free (bi); point_free (&I); mpi_free (x); mpi_free (k_1); mpi_free (sum); mpi_free (dr); mpi_free (k); if (hash != input) mpi_free (hash); + mpi_free (hash_computed_internally); return rc; } /* Verify an ECDSA signature. * Check if R and S verifies INPUT. */ gpg_err_code_t _gcry_ecc_ecdsa_verify (gcry_mpi_t input, mpi_ec_t ec, - gcry_mpi_t r, gcry_mpi_t s) + gcry_mpi_t r, gcry_mpi_t s, + int flags, int hashalgo) { gpg_err_code_t err = 0; gcry_mpi_t hash, h, h1, h2, x; mpi_point_struct Q, Q1, Q2; unsigned int nbits; + gcry_mpi_t hash_computed_internally = NULL; if (!_gcry_mpi_ec_curve_point (ec->Q, ec)) return GPG_ERR_BROKEN_PUBKEY; if( !(mpi_cmp_ui (r, 0) > 0 && mpi_cmp (r, ec->n) < 0) ) return GPG_ERR_BAD_SIGNATURE; /* Assertion 0 < r < n failed. */ if( !(mpi_cmp_ui (s, 0) > 0 && mpi_cmp (s, ec->n) < 0) ) return GPG_ERR_BAD_SIGNATURE; /* Assertion 0 < s < n failed. */ nbits = mpi_get_nbits (ec->n); + if ((flags & PUBKEY_FLAG_PREHASH)) + { + err = _gcry_dsa_compute_hash (&hash_computed_internally, input, + hashalgo); + if (err) + return err; + input = hash_computed_internally; + } + err = _gcry_dsa_normalize_hash (input, &hash, nbits); if (err) - return err; + { + mpi_free (hash_computed_internally); + return err; + } h = mpi_alloc (0); h1 = mpi_alloc (0); h2 = mpi_alloc (0); x = mpi_alloc (0); point_init (&Q); point_init (&Q1); point_init (&Q2); /* h = s^(-1) (mod n) */ mpi_invm (h, s, ec->n); /* h1 = hash * s^(-1) (mod n) */ mpi_mulm (h1, hash, h, ec->n); /* Q1 = [ hash * s^(-1) ]G */ _gcry_mpi_ec_mul_point (&Q1, h1, ec->G, ec); /* h2 = r * s^(-1) (mod n) */ mpi_mulm (h2, r, h, ec->n); /* Q2 = [ r * s^(-1) ]Q */ _gcry_mpi_ec_mul_point (&Q2, h2, ec->Q, ec); /* Q = ([hash * s^(-1)]G) + ([r * s^(-1)]Q) */ _gcry_mpi_ec_add_points (&Q, &Q1, &Q2, ec); if (!mpi_cmp_ui (Q.z, 0)) { if (DBG_CIPHER) log_debug ("ecc verify: Rejected\n"); err = GPG_ERR_BAD_SIGNATURE; goto leave; } if (_gcry_mpi_ec_get_affine (x, NULL, &Q, ec)) { if (DBG_CIPHER) log_debug ("ecc verify: Failed to get affine coordinates\n"); err = GPG_ERR_BAD_SIGNATURE; goto leave; } mpi_mod (x, x, ec->n); /* x = x mod E_n */ if (mpi_cmp (x, r)) /* x != r */ { if (DBG_CIPHER) { log_mpidump (" x", x); log_mpidump (" r", r); log_mpidump (" s", s); } err = GPG_ERR_BAD_SIGNATURE; goto leave; } leave: point_free (&Q2); point_free (&Q1); point_free (&Q); mpi_free (x); mpi_free (h2); mpi_free (h1); mpi_free (h); if (hash != input) mpi_free (hash); + mpi_free (hash_computed_internally); return err; } diff --git a/cipher/ecc.c b/cipher/ecc.c index db200738..77f9417f 100644 --- a/cipher/ecc.c +++ b/cipher/ecc.c @@ -1,1871 +1,1872 @@ /* ecc.c - Elliptic Curve Cryptography * Copyright (C) 2007, 2008, 2010, 2011 Free Software Foundation, Inc. * Copyright (C) 2013, 2015 g10 Code GmbH * * This file is part of Libgcrypt. * * Libgcrypt is free software; you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as * published by the Free Software Foundation; either version 2.1 of * the License, or (at your option) any later version. * * Libgcrypt is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public * License along with this program; if not, see . */ /* This code is originally based on the Patch 0.1.6 for the gnupg 1.4.x branch as retrieved on 2007-03-21 from http://www.calcurco.cat/eccGnuPG/src/gnupg-1.4.6-ecc0.2.0beta1.diff.bz2 The original authors are: Written by Sergi Blanch i Torne , Ramiro Moreno Chiral Maintainers Sergi Blanch i Torne Ramiro Moreno Chiral Mikael Mylnikov (mmr) For use in Libgcrypt the code has been heavily modified and cleaned up. In fact there is not much left of the originally code except for some variable names and the text book implementaion of the sign and verification algorithms. The arithmetic functions have entirely been rewritten and moved to mpi/ec.c. ECDH encrypt and decrypt code written by Andrey Jivsov. */ /* TODO: - In mpi/ec.c we use mpi_powm for x^2 mod p: Either implement a special case in mpi_powm or check whether mpi_mulm is faster. */ #include #include #include #include #include #include "g10lib.h" #include "mpi.h" #include "cipher.h" #include "context.h" #include "ec-context.h" #include "pubkey-internal.h" #include "ecc-common.h" static const char *ecc_names[] = { "ecc", "ecdsa", "ecdh", "eddsa", "gost", "sm2", NULL, }; /* Sample NIST P-256 key from RFC 6979 A.2.5 */ static const char sample_public_key_secp256[] = "(public-key" " (ecc" " (curve secp256r1)" " (q #04" /**/ "60FED4BA255A9D31C961EB74C6356D68C049B8923B61FA6CE669622E60F29FB6" /**/ "7903FE1008B8BC99A41AE9E95628BC64F2F1B20C2D7E9F5177A3C294D4462299#)))"; static const char sample_secret_key_secp256[] = "(private-key" " (ecc" " (curve secp256r1)" " (d #C9AFA9D845BA75166B5C215767B1D6934E50C3DB36E89B127B8A622B120F6721#)" " (q #04" /**/ "60FED4BA255A9D31C961EB74C6356D68C049B8923B61FA6CE669622E60F29FB6" /**/ "7903FE1008B8BC99A41AE9E95628BC64F2F1B20C2D7E9F5177A3C294D4462299#)))"; /* Registered progress function and its callback value. */ static void (*progress_cb) (void *, const char*, int, int, int); static void *progress_cb_data; /* Local prototypes. */ static void test_keys (mpi_ec_t ec, unsigned int nbits); static void test_ecdh_only_keys (mpi_ec_t ec, unsigned int nbits, int flags); static unsigned int ecc_get_nbits (gcry_sexp_t parms); void _gcry_register_pk_ecc_progress (void (*cb) (void *, const char *, int, int, int), void *cb_data) { progress_cb = cb; progress_cb_data = cb_data; } /* static void */ /* progress (int c) */ /* { */ /* if (progress_cb) */ /* progress_cb (progress_cb_data, "pk_ecc", c, 0, 0); */ /* } */ /** * nist_generate_key - Standard version of the ECC key generation. * @ec: Elliptic curve computation context. * @flags: Flags controlling aspects of the creation. * @r_x: On success this receives an allocated MPI with the affine * x-coordinate of the poblic key. On error NULL is stored. * @r_y: Ditto for the y-coordinate. * * Return: An error code. * * The @flags bits used by this function are %PUBKEY_FLAG_TRANSIENT to * use a faster RNG, and %PUBKEY_FLAG_NO_KEYTEST to skip the assertion * that the key works as expected. * * FIXME: Check whether N is needed. */ static gpg_err_code_t nist_generate_key (mpi_ec_t ec, int flags, gcry_mpi_t *r_x, gcry_mpi_t *r_y) { mpi_point_struct Q; gcry_random_level_t random_level; gcry_mpi_t x, y; const unsigned int pbits = ec->nbits; point_init (&Q); if ((flags & PUBKEY_FLAG_TRANSIENT_KEY)) random_level = GCRY_STRONG_RANDOM; else random_level = GCRY_VERY_STRONG_RANDOM; /* Generate a secret. */ if (ec->dialect == ECC_DIALECT_ED25519 || ec->dialect == ECC_DIALECT_SAFECURVE || (flags & PUBKEY_FLAG_DJB_TWEAK)) { char *rndbuf; int len = (pbits+7)/8; rndbuf = _gcry_random_bytes_secure (len, random_level); if (ec->dialect == ECC_DIALECT_SAFECURVE) ec->d = mpi_set_opaque (NULL, rndbuf, len*8); else { ec->d = mpi_snew (pbits); if ((pbits % 8)) rndbuf[0] &= (1 << (pbits % 8)) - 1; rndbuf[0] |= (1 << ((pbits + 7) % 8)); rndbuf[len-1] &= (256 - ec->h); _gcry_mpi_set_buffer (ec->d, rndbuf, len, 0); xfree (rndbuf); } } else ec->d = _gcry_dsa_gen_k (ec->n, random_level); /* Compute Q. */ _gcry_mpi_ec_mul_point (&Q, ec->d, ec->G, ec); x = mpi_new (pbits); if (r_y == NULL) y = NULL; else y = mpi_new (pbits); if (_gcry_mpi_ec_get_affine (x, y, &Q, ec)) log_fatal ("ecgen: Failed to get affine coordinates for %s\n", "Q"); /* We want the Q=(x,y) be a "compliant key" in terms of the * http://tools.ietf.org/html/draft-jivsov-ecc-compact, which simply * means that we choose either Q=(x,y) or -Q=(x,p-y) such that we * end up with the min(y,p-y) as the y coordinate. Such a public * key allows the most efficient compression: y can simply be * dropped because we know that it's a minimum of the two * possibilities without any loss of security. Note that we don't * do that for Ed25519 so that we do not violate the special * construction of the secret key. */ if (r_y == NULL || ec->dialect == ECC_DIALECT_ED25519) ec->Q = mpi_point_set (NULL, Q.x, Q.y, Q.z); else { gcry_mpi_t negative; negative = mpi_new (pbits); if (ec->model == MPI_EC_WEIERSTRASS) mpi_sub (negative, ec->p, y); /* negative = p - y */ else mpi_sub (negative, ec->p, x); /* negative = p - x */ if (mpi_cmp (negative, y) < 0) /* p - y < p */ { /* We need to end up with -Q; this assures that new Q's y is the smallest one */ if (ec->model == MPI_EC_WEIERSTRASS) { mpi_free (y); y = negative; } else { mpi_free (x); x = negative; } mpi_sub (ec->d, ec->n, ec->d); /* d = order - d */ ec->Q = mpi_point_set (NULL, x, y, mpi_const (MPI_C_ONE)); if (DBG_CIPHER) log_debug ("ecgen converted Q to a compliant point\n"); } else /* p - y >= p */ { /* No change is needed exactly 50% of the time: just copy. */ mpi_free (negative); ec->Q = mpi_point_set (NULL, Q.x, Q.y, Q.z); if (DBG_CIPHER) log_debug ("ecgen didn't need to convert Q to a compliant point\n"); } } *r_x = x; if (r_y) *r_y = y; point_free (&Q); /* Now we can test our keys (this should never fail!). */ if ((flags & PUBKEY_FLAG_NO_KEYTEST)) ; /* User requested to skip the test. */ else if (ec->model == MPI_EC_MONTGOMERY) test_ecdh_only_keys (ec, ec->nbits - 63, flags); else test_keys (ec, ec->nbits - 64); return 0; } /* * To verify correct skey it use a random information. * First, encrypt and decrypt this dummy value, * test if the information is recuperated. * Second, test with the sign and verify functions. */ static void test_keys (mpi_ec_t ec, unsigned int nbits) { gcry_mpi_t test = mpi_new (nbits); mpi_point_struct R_; gcry_mpi_t c = mpi_new (nbits); gcry_mpi_t out = mpi_new (nbits); gcry_mpi_t r = mpi_new (nbits); gcry_mpi_t s = mpi_new (nbits); if (DBG_CIPHER) log_debug ("Testing key.\n"); point_init (&R_); _gcry_mpi_randomize (test, nbits, GCRY_WEAK_RANDOM); if (_gcry_ecc_ecdsa_sign (test, ec, r, s, 0, 0) ) log_fatal ("ECDSA operation: sign failed\n"); - if (_gcry_ecc_ecdsa_verify (test, ec, r, s)) + if (_gcry_ecc_ecdsa_verify (test, ec, r, s, 0, 0)) { log_fatal ("ECDSA operation: sign, verify failed\n"); } if (DBG_CIPHER) log_debug ("ECDSA operation: sign, verify ok.\n"); point_free (&R_); mpi_free (s); mpi_free (r); mpi_free (out); mpi_free (c); mpi_free (test); } static void test_ecdh_only_keys (mpi_ec_t ec, unsigned int nbits, int flags) { gcry_mpi_t test; mpi_point_struct R_; gcry_mpi_t x0, x1; if (DBG_CIPHER) log_debug ("Testing ECDH only key.\n"); point_init (&R_); if (ec->dialect == ECC_DIALECT_SAFECURVE || (flags & PUBKEY_FLAG_DJB_TWEAK)) { char *rndbuf; const unsigned int pbits = ec->nbits; int len = (pbits+7)/8; rndbuf = _gcry_random_bytes (len, GCRY_WEAK_RANDOM); if (ec->dialect == ECC_DIALECT_SAFECURVE) test = mpi_set_opaque (NULL, rndbuf, len*8); else { test = mpi_new (pbits); if ((pbits % 8)) rndbuf[0] &= (1 << (pbits % 8)) - 1; rndbuf[0] |= (1 << ((pbits + 7) % 8)); rndbuf[len-1] &= (256 - ec->h); _gcry_mpi_set_buffer (test, rndbuf, len, 0); xfree (rndbuf); } } else { test = mpi_new (nbits); _gcry_mpi_randomize (test, nbits, GCRY_WEAK_RANDOM); } x0 = mpi_new (0); x1 = mpi_new (0); /* R_ = hkQ <=> R_ = hkdG */ _gcry_mpi_ec_mul_point (&R_, test, ec->Q, ec); if (ec->dialect == ECC_DIALECT_STANDARD && !(flags & PUBKEY_FLAG_DJB_TWEAK)) _gcry_mpi_ec_mul_point (&R_, _gcry_mpi_get_const (ec->h), &R_, ec); if (_gcry_mpi_ec_get_affine (x0, NULL, &R_, ec)) log_fatal ("ecdh: Failed to get affine coordinates for hkQ\n"); _gcry_mpi_ec_mul_point (&R_, test, ec->G, ec); _gcry_mpi_ec_mul_point (&R_, ec->d, &R_, ec); /* R_ = hdkG */ if (ec->dialect == ECC_DIALECT_STANDARD && !(flags & PUBKEY_FLAG_DJB_TWEAK)) _gcry_mpi_ec_mul_point (&R_, _gcry_mpi_get_const (ec->h), &R_, ec); if (_gcry_mpi_ec_get_affine (x1, NULL, &R_, ec)) log_fatal ("ecdh: Failed to get affine coordinates for hdkG\n"); if (mpi_cmp (x0, x1)) { log_fatal ("ECDH test failed.\n"); } mpi_free (x0); mpi_free (x1); point_free (&R_); mpi_free (test); } /* * To check the validity of the value, recalculate the correspondence * between the public value and the secret one. */ static int check_secret_key (mpi_ec_t ec, int flags) { int rc = 1; mpi_point_struct Q; gcry_mpi_t x1, y1; gcry_mpi_t x2 = NULL; gcry_mpi_t y2 = NULL; point_init (&Q); x1 = mpi_new (0); if (ec->model == MPI_EC_MONTGOMERY) y1 = NULL; else y1 = mpi_new (0); /* G in E(F_p) */ if (!_gcry_mpi_ec_curve_point (ec->G, ec)) { if (DBG_CIPHER) log_debug ("Bad check: Point 'G' does not belong to curve 'E'!\n"); goto leave; } /* G != PaI */ if (!mpi_cmp_ui (ec->G->z, 0)) { if (DBG_CIPHER) log_debug ("Bad check: 'G' cannot be Point at Infinity!\n"); goto leave; } /* Check order of curve. */ if (ec->dialect == ECC_DIALECT_STANDARD && !(flags & PUBKEY_FLAG_DJB_TWEAK)) { _gcry_mpi_ec_mul_point (&Q, ec->n, ec->G, ec); if (mpi_cmp_ui (Q.z, 0)) { if (DBG_CIPHER) log_debug ("check_secret_key: E is not a curve of order n\n"); goto leave; } } /* Pubkey cannot be PaI */ if (!mpi_cmp_ui (ec->Q->z, 0)) { if (DBG_CIPHER) log_debug ("Bad check: Q can not be a Point at Infinity!\n"); goto leave; } /* pubkey = [d]G over E */ if (!_gcry_ecc_compute_public (&Q, ec)) { if (DBG_CIPHER) log_debug ("Bad check: computation of dG failed\n"); goto leave; } if (_gcry_mpi_ec_get_affine (x1, y1, &Q, ec)) { if (DBG_CIPHER) log_debug ("Bad check: Q can not be a Point at Infinity!\n"); goto leave; } if ((flags & PUBKEY_FLAG_EDDSA) || (ec->model == MPI_EC_EDWARDS && ec->dialect == ECC_DIALECT_SAFECURVE)) ; /* Fixme: EdDSA is special. */ else if (!mpi_cmp_ui (ec->Q->z, 1)) { /* Fast path if Q is already in affine coordinates. */ if (mpi_cmp (x1, ec->Q->x) || (y1 && mpi_cmp (y1, ec->Q->y))) { if (DBG_CIPHER) log_debug ("Bad check: There is NO correspondence between 'd' and 'Q'!\n"); goto leave; } } else { x2 = mpi_new (0); y2 = mpi_new (0); if (_gcry_mpi_ec_get_affine (x2, y2, ec->Q, ec)) { if (DBG_CIPHER) log_debug ("Bad check: Q can not be a Point at Infinity!\n"); goto leave; } if (mpi_cmp (x1, x2) || mpi_cmp (y1, y2)) { if (DBG_CIPHER) log_debug ("Bad check: There is NO correspondence between 'd' and 'Q'!\n"); goto leave; } } rc = 0; /* Okay. */ leave: mpi_free (x2); mpi_free (x1); mpi_free (y1); mpi_free (y2); point_free (&Q); return rc; } /********************************************* ************** interface ****************** *********************************************/ static gcry_err_code_t ecc_generate (const gcry_sexp_t genparms, gcry_sexp_t *r_skey) { gpg_err_code_t rc; gcry_mpi_t Gx = NULL; gcry_mpi_t Gy = NULL; gcry_mpi_t Qx = NULL; gcry_mpi_t Qy = NULL; mpi_ec_t ec = NULL; gcry_sexp_t curve_info = NULL; gcry_sexp_t curve_flags = NULL; gcry_mpi_t base = NULL; gcry_mpi_t public = NULL; int flags = 0; rc = _gcry_mpi_ec_internal_new (&ec, &flags, "ecgen curve", genparms, NULL); if (rc) goto leave; if ((flags & PUBKEY_FLAG_EDDSA) || (ec->model == MPI_EC_EDWARDS && ec->dialect == ECC_DIALECT_SAFECURVE)) rc = _gcry_ecc_eddsa_genkey (ec, flags); else if (ec->model == MPI_EC_MONTGOMERY) rc = nist_generate_key (ec, flags, &Qx, NULL); else rc = nist_generate_key (ec, flags, &Qx, &Qy); if (rc) goto leave; /* Copy data to the result. */ Gx = mpi_new (0); Gy = mpi_new (0); if (ec->model != MPI_EC_MONTGOMERY) { if (_gcry_mpi_ec_get_affine (Gx, Gy, ec->G, ec)) log_fatal ("ecgen: Failed to get affine coordinates for %s\n", "G"); base = _gcry_ecc_ec2os (Gx, Gy, ec->p); } if (((ec->dialect == ECC_DIALECT_SAFECURVE && ec->model == MPI_EC_EDWARDS) || ec->dialect == ECC_DIALECT_ED25519 || ec->model == MPI_EC_MONTGOMERY) && !(flags & PUBKEY_FLAG_NOCOMP)) { unsigned char *encpk; unsigned int encpklen; if (ec->model == MPI_EC_MONTGOMERY) rc = _gcry_ecc_mont_encodepoint (Qx, ec->nbits, ec->dialect != ECC_DIALECT_SAFECURVE, &encpk, &encpklen); else /* (Gx and Gy are used as scratch variables) */ rc = _gcry_ecc_eddsa_encodepoint (ec->Q, ec, Gx, Gy, (ec->dialect != ECC_DIALECT_SAFECURVE && !!(flags & PUBKEY_FLAG_COMP)), &encpk, &encpklen); if (rc) goto leave; public = mpi_new (0); mpi_set_opaque (public, encpk, encpklen*8); } else { if (!Qx) { /* This is the case for a key from _gcry_ecc_eddsa_generate with no compression. */ Qx = mpi_new (0); Qy = mpi_new (0); if (_gcry_mpi_ec_get_affine (Qx, Qy, ec->Q, ec)) log_fatal ("ecgen: Failed to get affine coordinates for %s\n", "Q"); } public = _gcry_ecc_ec2os (Qx, Qy, ec->p); } if (ec->name) { rc = sexp_build (&curve_info, NULL, "(curve %s)", ec->name); if (rc) goto leave; } if ((flags & PUBKEY_FLAG_PARAM) || (flags & PUBKEY_FLAG_EDDSA) || (flags & PUBKEY_FLAG_DJB_TWEAK)) { rc = sexp_build (&curve_flags, NULL, ((flags & PUBKEY_FLAG_PARAM) && (flags & PUBKEY_FLAG_EDDSA))? "(flags param eddsa)" : ((flags & PUBKEY_FLAG_PARAM) && (flags & PUBKEY_FLAG_DJB_TWEAK))? "(flags param djb-tweak)" : ((flags & PUBKEY_FLAG_PARAM))? "(flags param)" : ((flags & PUBKEY_FLAG_EDDSA))? "(flags eddsa)" : "(flags djb-tweak)" ); if (rc) goto leave; } if ((flags & PUBKEY_FLAG_PARAM) && ec->name) rc = sexp_build (r_skey, NULL, "(key-data" " (public-key" " (ecc%S%S(p%m)(a%m)(b%m)(g%m)(n%m)(h%u)(q%m)))" " (private-key" " (ecc%S%S(p%m)(a%m)(b%m)(g%m)(n%m)(h%u)(q%m)(d%m)))" " )", curve_info, curve_flags, ec->p, ec->a, ec->b, base, ec->n, ec->h, public, curve_info, curve_flags, ec->p, ec->a, ec->b, base, ec->n, ec->h, public, ec->d); else rc = sexp_build (r_skey, NULL, "(key-data" " (public-key" " (ecc%S%S(q%m)))" " (private-key" " (ecc%S%S(q%m)(d%m)))" " )", curve_info, curve_flags, public, curve_info, curve_flags, public, ec->d); if (rc) goto leave; if (DBG_CIPHER) { log_printmpi ("ecgen result p", ec->p); log_printmpi ("ecgen result a", ec->a); log_printmpi ("ecgen result b", ec->b); log_printmpi ("ecgen result G", base); log_printmpi ("ecgen result n", ec->n); log_debug ("ecgen result h:+%02x\n", ec->h); log_printmpi ("ecgen result Q", public); log_printmpi ("ecgen result d", ec->d); if ((flags & PUBKEY_FLAG_EDDSA)) log_debug ("ecgen result using Ed25519+EdDSA\n"); } leave: mpi_free (public); mpi_free (base); mpi_free (Gx); mpi_free (Gy); mpi_free (Qx); mpi_free (Qy); _gcry_mpi_ec_free (ec); sexp_release (curve_flags); sexp_release (curve_info); return rc; } static gcry_err_code_t ecc_check_secret_key (gcry_sexp_t keyparms) { gcry_err_code_t rc; int flags = 0; mpi_ec_t ec = NULL; /* * Extract the key. */ rc = _gcry_mpi_ec_internal_new (&ec, &flags, "ecc_testkey", keyparms, NULL); if (rc) goto leave; if (!ec->p || !ec->a || !ec->b || !ec->G || !ec->n || !ec->Q || !ec->d) { rc = GPG_ERR_NO_OBJ; goto leave; } if (check_secret_key (ec, flags)) rc = GPG_ERR_BAD_SECKEY; leave: _gcry_mpi_ec_free (ec); if (DBG_CIPHER) log_debug ("ecc_testkey => %s\n", gpg_strerror (rc)); return rc; } static gcry_err_code_t ecc_sign (gcry_sexp_t *r_sig, gcry_sexp_t s_data, gcry_sexp_t keyparms) { gcry_err_code_t rc; struct pk_encoding_ctx ctx; gcry_mpi_t data = NULL; gcry_mpi_t sig_r = NULL; gcry_mpi_t sig_s = NULL; mpi_ec_t ec = NULL; int flags = 0; _gcry_pk_util_init_encoding_ctx (&ctx, PUBKEY_OP_SIGN, 0); /* * Extract the key. */ rc = _gcry_mpi_ec_internal_new (&ec, &flags, "ecc_sign", keyparms, NULL); if (rc) goto leave; if (!ec->p || !ec->a || !ec->b || !ec->G || !ec->n || !ec->d) { rc = GPG_ERR_NO_OBJ; goto leave; } ctx.flags |= flags; if (ec->model == MPI_EC_EDWARDS && ec->dialect == ECC_DIALECT_SAFECURVE) ctx.flags |= PUBKEY_FLAG_EDDSA; /* Clear hash algo for EdDSA. */ if ((ctx.flags & PUBKEY_FLAG_EDDSA)) ctx.hash_algo = GCRY_MD_NONE; /* Extract the data. */ rc = _gcry_pk_util_data_to_mpi (s_data, &data, &ctx); if (rc) goto leave; if (DBG_CIPHER) log_mpidump ("ecc_sign data", data); /* Hash algo is determined by curve in EdDSA. Fill it if not specified. */ if ((ctx.flags & PUBKEY_FLAG_EDDSA) && !ctx.hash_algo) { if (ec->dialect == ECC_DIALECT_ED25519) ctx.hash_algo = GCRY_MD_SHA512; else if (ec->dialect == ECC_DIALECT_SAFECURVE) ctx.hash_algo = GCRY_MD_SHAKE256; } sig_r = mpi_new (0); sig_s = mpi_new (0); if ((ctx.flags & PUBKEY_FLAG_EDDSA)) { /* EdDSA requires the public key. */ rc = _gcry_ecc_eddsa_sign (data, ec, sig_r, sig_s, &ctx); if (!rc) rc = sexp_build (r_sig, NULL, "(sig-val(eddsa(r%M)(s%M)))", sig_r, sig_s); } else if ((ctx.flags & PUBKEY_FLAG_GOST)) { rc = _gcry_ecc_gost_sign (data, ec, sig_r, sig_s); if (!rc) rc = sexp_build (r_sig, NULL, "(sig-val(gost(r%M)(s%M)))", sig_r, sig_s); } else if ((ctx.flags & PUBKEY_FLAG_SM2)) { rc = _gcry_ecc_sm2_sign (data, ec, sig_r, sig_s, ctx.flags, ctx.hash_algo); if (!rc) rc = sexp_build (r_sig, NULL, "(sig-val(sm2(r%M)(s%M)))", sig_r, sig_s); } else { rc = _gcry_ecc_ecdsa_sign (data, ec, sig_r, sig_s, ctx.flags, ctx.hash_algo); if (!rc) rc = sexp_build (r_sig, NULL, "(sig-val(ecdsa(r%M)(s%M)))", sig_r, sig_s); } leave: _gcry_mpi_release (sig_r); _gcry_mpi_release (sig_s); _gcry_mpi_release (data); _gcry_mpi_ec_free (ec); _gcry_pk_util_free_encoding_ctx (&ctx); if (DBG_CIPHER) log_debug ("ecc_sign => %s\n", gpg_strerror (rc)); return rc; } static gcry_err_code_t ecc_verify (gcry_sexp_t s_sig, gcry_sexp_t s_data, gcry_sexp_t s_keyparms) { gcry_err_code_t rc; struct pk_encoding_ctx ctx; gcry_sexp_t l1 = NULL; gcry_mpi_t sig_r = NULL; gcry_mpi_t sig_s = NULL; gcry_mpi_t data = NULL; int sigflags; mpi_ec_t ec = NULL; int flags = 0; _gcry_pk_util_init_encoding_ctx (&ctx, PUBKEY_OP_VERIFY, ecc_get_nbits (s_keyparms)); /* * Extract the key. */ rc = _gcry_mpi_ec_internal_new (&ec, &flags, "ecc_verify", s_keyparms, NULL); if (rc) goto leave; if (!ec->p || !ec->a || !ec->b || !ec->G || !ec->n || !ec->Q) { rc = GPG_ERR_NO_OBJ; goto leave; } if (ec->model == MPI_EC_MONTGOMERY) { if (DBG_CIPHER) log_debug ("ecc_verify: Can't use a Montgomery curve\n"); rc = GPG_ERR_INTERNAL; goto leave; } ctx.flags |= flags; if (ec->model == MPI_EC_EDWARDS && ec->dialect == ECC_DIALECT_SAFECURVE) ctx.flags |= PUBKEY_FLAG_EDDSA; /* Clear hash algo for EdDSA. */ if ((ctx.flags & PUBKEY_FLAG_EDDSA)) ctx.hash_algo = GCRY_MD_NONE; /* Extract the data. */ rc = _gcry_pk_util_data_to_mpi (s_data, &data, &ctx); if (rc) goto leave; if (DBG_CIPHER) log_mpidump ("ecc_verify data", data); /* Hash algo is determined by curve in EdDSA. Fill it if not specified. */ if ((ctx.flags & PUBKEY_FLAG_EDDSA) && !ctx.hash_algo) { if (ec->dialect == ECC_DIALECT_ED25519) ctx.hash_algo = GCRY_MD_SHA512; else if (ec->dialect == ECC_DIALECT_SAFECURVE) ctx.hash_algo = GCRY_MD_SHAKE256; } /* * Extract the signature value. */ rc = _gcry_pk_util_preparse_sigval (s_sig, ecc_names, &l1, &sigflags); if (rc) goto leave; rc = sexp_extract_param (l1, NULL, (sigflags & PUBKEY_FLAG_EDDSA)? "/rs":"rs", &sig_r, &sig_s, NULL); if (rc) goto leave; if (DBG_CIPHER) { log_mpidump ("ecc_verify s_r", sig_r); log_mpidump ("ecc_verify s_s", sig_s); } if ((ctx.flags & PUBKEY_FLAG_EDDSA) ^ (sigflags & PUBKEY_FLAG_EDDSA)) { rc = GPG_ERR_CONFLICT; /* Inconsistent use of flag/algoname. */ goto leave; } /* * Verify the signature. */ if ((sigflags & PUBKEY_FLAG_EDDSA)) { rc = _gcry_ecc_eddsa_verify (data, ec, sig_r, sig_s, &ctx); } else if ((sigflags & PUBKEY_FLAG_GOST)) { rc = _gcry_ecc_gost_verify (data, ec, sig_r, sig_s); } else if ((sigflags & PUBKEY_FLAG_SM2)) { rc = _gcry_ecc_sm2_verify (data, ec, sig_r, sig_s); } else { - rc = _gcry_ecc_ecdsa_verify (data, ec, sig_r, sig_s); + rc = _gcry_ecc_ecdsa_verify (data, ec, sig_r, sig_s, + ctx.flags, ctx.hash_algo); } leave: _gcry_mpi_release (data); _gcry_mpi_release (sig_r); _gcry_mpi_release (sig_s); _gcry_mpi_ec_free (ec); sexp_release (l1); _gcry_pk_util_free_encoding_ctx (&ctx); if (DBG_CIPHER) log_debug ("ecc_verify => %s\n", rc?gpg_strerror (rc):"Good"); return rc; } /* ecdh raw is classic 2-round DH protocol published in 1976. * * Overview of ecc_encrypt_raw and ecc_decrypt_raw. * * As with any PK operation, encrypt version uses a public key and * decrypt -- private. * * Symbols used below: * G - field generator point * d - private long-term scalar * dG - public long-term key * k - ephemeral scalar * kG - ephemeral public key * dkG - shared secret * * ecc_encrypt_raw description: * input: * data[0] : private scalar (k) * output: A new S-expression with the parameters: * s : shared point (kdG) * e : generated ephemeral public key (kG) * * ecc_decrypt_raw description: * input: * data[0] : a point kG (ephemeral public key) * output: * result[0] : shared point (kdG) */ static gcry_err_code_t ecc_encrypt_raw (gcry_sexp_t *r_ciph, gcry_sexp_t s_data, gcry_sexp_t keyparms) { unsigned int nbits; gcry_err_code_t rc; struct pk_encoding_ctx ctx; gcry_mpi_t mpi_s = NULL; gcry_mpi_t mpi_e = NULL; gcry_mpi_t data = NULL; mpi_ec_t ec = NULL; int flags = 0; int no_error_on_infinity; _gcry_pk_util_init_encoding_ctx (&ctx, PUBKEY_OP_ENCRYPT, (nbits = ecc_get_nbits (keyparms))); /* * Extract the key. */ rc = _gcry_mpi_ec_internal_new (&ec, &flags, "ecc_encrypt", keyparms, NULL); if (rc) goto leave; if (ec->dialect == ECC_DIALECT_SAFECURVE) { ctx.flags |= PUBKEY_FLAG_RAW_FLAG; no_error_on_infinity = 1; } else if ((flags & PUBKEY_FLAG_DJB_TWEAK)) no_error_on_infinity = 1; else no_error_on_infinity = 0; /* * Extract the data. */ rc = _gcry_pk_util_data_to_mpi (s_data, &data, &ctx); if (rc) goto leave; /* * Tweak the scalar bits by cofactor and number of bits of the field. * It assumes the cofactor is a power of 2. */ if ((flags & PUBKEY_FLAG_DJB_TWEAK)) { int i; for (i = 0; (ec->h & (1 << i)) == 0; i++) mpi_clear_bit (data, i); mpi_set_highbit (data, ec->nbits - 1); } if (DBG_CIPHER) log_mpidump ("ecc_encrypt data", data); if (!ec->p || !ec->a || !ec->b || !ec->G || !ec->n || !ec->Q) { rc = GPG_ERR_NO_OBJ; goto leave; } if ((ctx.flags & PUBKEY_FLAG_SM2)) { /* All encryption will be done, return it. */ rc = _gcry_ecc_sm2_encrypt (r_ciph, data, ec); goto leave; } /* The following is false: assert( mpi_cmp_ui( R.x, 1 )==0 );, so */ { mpi_point_struct R; /* Result that we return. */ gcry_mpi_t x, y; unsigned char *rawmpi; unsigned int rawmpilen; rc = 0; x = mpi_new (0); if (ec->model == MPI_EC_MONTGOMERY) y = NULL; else y = mpi_new (0); point_init (&R); /* R = kQ <=> R = kdG */ _gcry_mpi_ec_mul_point (&R, data, ec->Q, ec); if (_gcry_mpi_ec_get_affine (x, y, &R, ec)) { /* * Here, X is 0. In the X25519 computation on Curve25519, X0 * function maps infinity to zero. So, when PUBKEY_FLAG_DJB_TWEAK * is enabled, return the result of 0 not raising an error. * * This is a corner case. It never occurs with properly * generated public keys, but it might happen with blindly * imported public key which might not follow the key * generation procedure. */ if (!no_error_on_infinity) { /* It's not for X25519, then, the input data was simply wrong. */ rc = GPG_ERR_INV_DATA; goto leave_main; } } if (y) mpi_s = _gcry_ecc_ec2os (x, y, ec->p); else { rc = _gcry_ecc_mont_encodepoint (x, nbits, ec->dialect != ECC_DIALECT_SAFECURVE, &rawmpi, &rawmpilen); if (rc) goto leave_main; mpi_s = mpi_new (0); mpi_set_opaque (mpi_s, rawmpi, rawmpilen*8); } /* R = kG */ _gcry_mpi_ec_mul_point (&R, data, ec->G, ec); if (_gcry_mpi_ec_get_affine (x, y, &R, ec)) { rc = GPG_ERR_INV_DATA; goto leave_main; } if (y) mpi_e = _gcry_ecc_ec2os (x, y, ec->p); else { rc = _gcry_ecc_mont_encodepoint (x, nbits, ec->dialect != ECC_DIALECT_SAFECURVE, &rawmpi, &rawmpilen); if (!rc) { mpi_e = mpi_new (0); mpi_set_opaque (mpi_e, rawmpi, rawmpilen*8); } } leave_main: mpi_free (x); mpi_free (y); point_free (&R); if (rc) goto leave; } if (!rc) rc = sexp_build (r_ciph, NULL, "(enc-val(ecdh(s%m)(e%m)))", mpi_s, mpi_e); leave: _gcry_mpi_release (data); _gcry_mpi_release (mpi_s); _gcry_mpi_release (mpi_e); _gcry_mpi_ec_free (ec); _gcry_pk_util_free_encoding_ctx (&ctx); if (DBG_CIPHER) log_debug ("ecc_encrypt => %s\n", gpg_strerror (rc)); return rc; } /* input: * data[0] : a point kG (ephemeral public key) * output: * resaddr[0] : shared point kdG * * see ecc_encrypt_raw for details. */ static gcry_err_code_t ecc_decrypt_raw (gcry_sexp_t *r_plain, gcry_sexp_t s_data, gcry_sexp_t keyparms) { unsigned int nbits; gpg_err_code_t rc; struct pk_encoding_ctx ctx; gcry_sexp_t l1 = NULL; gcry_mpi_t data_e = NULL; mpi_ec_t ec = NULL; mpi_point_struct kG; mpi_point_struct R; gcry_mpi_t r = NULL; int flags = 0; int enable_specific_point_validation; point_init (&kG); point_init (&R); _gcry_pk_util_init_encoding_ctx (&ctx, PUBKEY_OP_DECRYPT, (nbits = ecc_get_nbits (keyparms))); /* * Extract the key. */ rc = _gcry_mpi_ec_internal_new (&ec, &flags, "ecc_decrypt", keyparms, NULL); if (rc) goto leave; if (!ec->p || !ec->a || !ec->b || !ec->G || !ec->n || !ec->d) { rc = GPG_ERR_NO_OBJ; goto leave; } /* * Extract the data. */ rc = _gcry_pk_util_preparse_encval (s_data, ecc_names, &l1, &ctx); if (rc) goto leave; if ((ctx.flags & PUBKEY_FLAG_SM2)) { /* All decryption will be done, return it. */ rc = _gcry_ecc_sm2_decrypt (r_plain, l1, ec); goto leave; } else { rc = sexp_extract_param (l1, NULL, "/e", &data_e, NULL); if (rc) goto leave; if (DBG_CIPHER) log_printmpi ("ecc_decrypt d_e", data_e); } if (ec->dialect == ECC_DIALECT_SAFECURVE || (flags & PUBKEY_FLAG_DJB_TWEAK)) enable_specific_point_validation = 1; else enable_specific_point_validation = 0; /* * Compute the plaintext. */ if (ec->model == MPI_EC_MONTGOMERY) rc = _gcry_ecc_mont_decodepoint (data_e, ec, &kG); else rc = _gcry_ecc_sec_decodepoint (data_e, ec, &kG); if (rc) goto leave; if (DBG_CIPHER) log_printpnt ("ecc_decrypt kG", &kG, NULL); if (enable_specific_point_validation) { /* For X25519, by its definition, validation should not be done. */ /* (Instead, we do output check.) * * However, to mitigate secret key leak from our implementation, * we also do input validation here. For constant-time * implementation, we can remove this input validation. */ if (_gcry_mpi_ec_bad_point (&kG, ec)) { rc = GPG_ERR_INV_DATA; goto leave; } } else if (!_gcry_mpi_ec_curve_point (&kG, ec)) { rc = GPG_ERR_INV_DATA; goto leave; } /* R = dkG */ _gcry_mpi_ec_mul_point (&R, ec->d, &kG, ec); /* The following is false: assert( mpi_cmp_ui( R.x, 1 )==0 );, so: */ { gcry_mpi_t x, y; x = mpi_new (0); if (ec->model == MPI_EC_MONTGOMERY) y = NULL; else y = mpi_new (0); if (_gcry_mpi_ec_get_affine (x, y, &R, ec)) { rc = GPG_ERR_INV_DATA; goto leave; /* * Note for X25519. * * By the definition of X25519, this is the case where X25519 * returns 0, mapping infinity to zero. However, we * deliberately let it return an error. * * For X25519 ECDH, comming here means that it might be * decrypted by anyone with the shared secret of 0 (the result * of this function could be always 0 by other scalar values, * other than the private key of D). * * So, it looks like an encrypted message but it can be * decrypted by anyone, or at least something wrong * happens. Recipient should not proceed as if it were * properly encrypted message. * * This handling is needed for our major usage of GnuPG, * where it does the One-Pass Diffie-Hellman method, * C(1, 1, ECC CDH), with an ephemeral key. */ } if (y) r = _gcry_ecc_ec2os (x, y, ec->p); else { unsigned char *rawmpi; unsigned int rawmpilen; rc = _gcry_ecc_mont_encodepoint (x, nbits, ec->dialect != ECC_DIALECT_SAFECURVE, &rawmpi, &rawmpilen); if (rc) goto leave; r = mpi_new (0); mpi_set_opaque (r, rawmpi, rawmpilen*8); } if (!r) rc = gpg_err_code_from_syserror (); else rc = 0; mpi_free (x); mpi_free (y); } if (DBG_CIPHER) log_printmpi ("ecc_decrypt res", r); if (!rc) rc = sexp_build (r_plain, NULL, "(value %m)", r); leave: point_free (&R); point_free (&kG); _gcry_mpi_release (r); _gcry_mpi_release (data_e); sexp_release (l1); _gcry_mpi_ec_free (ec); _gcry_pk_util_free_encoding_ctx (&ctx); if (DBG_CIPHER) log_debug ("ecc_decrypt => %s\n", gpg_strerror (rc)); return rc; } /* Return the number of bits for the key described by PARMS. On error * 0 is returned. The format of PARMS starts with the algorithm name; * for example: * * (ecc * (curve ) * (p ) * (a ) * (b ) * (g ) * (n ) * (q )) * * More parameters may be given. Either P or CURVE is needed. */ static unsigned int ecc_get_nbits (gcry_sexp_t parms) { gcry_sexp_t l1; gcry_mpi_t p; unsigned int nbits = 0; char *curve; l1 = sexp_find_token (parms, "p", 1); if (!l1) { /* Parameter P not found - check whether we have "curve". */ l1 = sexp_find_token (parms, "curve", 5); if (!l1) return 0; /* Neither P nor CURVE found. */ curve = sexp_nth_string (l1, 1); sexp_release (l1); if (!curve) return 0; /* No curve name given (or out of core). */ if (_gcry_ecc_fill_in_curve (0, curve, NULL, &nbits)) nbits = 0; xfree (curve); } else { p = sexp_nth_mpi (l1, 1, GCRYMPI_FMT_USG); sexp_release (l1); if (p) { nbits = mpi_get_nbits (p); _gcry_mpi_release (p); } } return nbits; } /* See rsa.c for a description of this function. */ static gpg_err_code_t compute_keygrip (gcry_md_hd_t md, gcry_sexp_t keyparms) { #define N_COMPONENTS 6 static const char names[N_COMPONENTS] = "pabgnq"; gpg_err_code_t rc; gcry_sexp_t l1; gcry_mpi_t values[N_COMPONENTS]; int idx; char *curvename = NULL; int flags = 0; enum gcry_mpi_ec_models model = 0; enum ecc_dialects dialect = 0; const unsigned char *raw; unsigned int n; int maybe_uncompress; /* Clear the values first. */ for (idx=0; idx < N_COMPONENTS; idx++) values[idx] = NULL; /* Look for flags. */ l1 = sexp_find_token (keyparms, "flags", 0); if (l1) { rc = _gcry_pk_util_parse_flaglist (l1, &flags, NULL); if (rc) goto leave; } /* Extract the parameters. */ if ((flags & PUBKEY_FLAG_PARAM)) rc = sexp_extract_param (keyparms, NULL, "p?a?b?g?n?/q", &values[0], &values[1], &values[2], &values[3], &values[4], &values[5], NULL); else rc = sexp_extract_param (keyparms, NULL, "/q", &values[5], NULL); if (rc) goto leave; /* Check whether a curve parameter is available and use that to fill in missing values. */ sexp_release (l1); l1 = sexp_find_token (keyparms, "curve", 5); if (l1) { curvename = sexp_nth_string (l1, 1); if (curvename) { rc = _gcry_ecc_update_curve_param (curvename, &model, &dialect, &values[0], &values[1], &values[2], &values[3], &values[4]); if (rc) goto leave; } } /* Guess required fields if a curve parameter has not been given. FIXME: This is a crude hacks. We need to fix that. */ if (!curvename) { model = ((flags & PUBKEY_FLAG_EDDSA) ? MPI_EC_EDWARDS : MPI_EC_WEIERSTRASS); dialect = ((flags & PUBKEY_FLAG_EDDSA) ? ECC_DIALECT_ED25519 : ECC_DIALECT_STANDARD); } /* Check that all parameters are known and normalize all MPIs (that should not be required but we use an internal function later and thus we better make 100% sure that they are normalized). */ for (idx = 0; idx < N_COMPONENTS; idx++) if (!values[idx]) { rc = GPG_ERR_NO_OBJ; goto leave; } else _gcry_mpi_normalize (values[idx]); /* Uncompress the public key with the exception of EdDSA where compression is the default and we thus compute the keygrip using the compressed version. Because we don't support any non-eddsa compression, the only thing we need to do is to compress EdDSA. */ if ((flags & PUBKEY_FLAG_EDDSA) && dialect == ECC_DIALECT_ED25519) { const unsigned int pbits = mpi_get_nbits (values[0]); rc = _gcry_ecc_eddsa_ensure_compact (values[5], pbits); if (rc) goto leave; maybe_uncompress = 0; } else if ((flags & PUBKEY_FLAG_DJB_TWEAK)) { /* Remove the prefix 0x40 for keygrip computation. */ raw = mpi_get_opaque (values[5], &n); if (raw) { n = (n + 7)/8; if (n > 1 && (n%2) && raw[0] == 0x40) if (!_gcry_mpi_set_opaque_copy (values[5], raw + 1, (n - 1)*8)) rc = gpg_err_code_from_syserror (); } else { rc = GPG_ERR_INV_OBJ; goto leave; } maybe_uncompress = 0; } else maybe_uncompress = 1; /* Hash them all. */ for (idx = 0; idx < N_COMPONENTS; idx++) { char buf[30]; unsigned char *rawbuffer; unsigned int rawlen; if (mpi_is_opaque (values[idx])) { rawbuffer = NULL; raw = mpi_get_opaque (values[idx], &rawlen); rawlen = (rawlen + 7)/8; } else { rawbuffer = _gcry_mpi_get_buffer (values[idx], 0, &rawlen, NULL); if (!rawbuffer) { rc = gpg_err_code_from_syserror (); goto leave; } raw = rawbuffer; } if (maybe_uncompress && idx == 5 && rawlen > 1 && (*raw == 0x02 || *raw == 0x03)) { /* This is a compressed Q - uncompress. */ mpi_ec_t ec = NULL; gcry_mpi_t x, y; gcry_mpi_t x3; gcry_mpi_t t; gcry_mpi_t p1_4; int y_bit = (*raw == 0x03); /* We need to get the curve parameters as MPIs so that we * can do computations. We have them in VALUES but it is * possible that the caller provided them as opaque MPIs. */ rc = _gcry_mpi_ec_internal_new (&ec, &flags, "ecc_keygrip", keyparms, NULL); if (rc) goto leave; if (!ec->p || !ec->a || !ec->b || !ec->G || !ec->n) { rc = GPG_ERR_NO_OBJ; _gcry_mpi_ec_free (ec); goto leave; } if (!mpi_test_bit (ec->p, 1)) { /* No support for point compression for this curve. */ rc = GPG_ERR_NOT_IMPLEMENTED; _gcry_mpi_ec_free (ec); xfree (rawbuffer); goto leave; } raw++; rawlen--; rc = _gcry_mpi_scan (&x, GCRYMPI_FMT_USG, raw, rawlen, NULL); if (rc) { _gcry_mpi_ec_free (ec); xfree (rawbuffer); goto leave; } /* * Recover Y. The Weierstrass curve: y^2 = x^3 + a*x + b */ x3 = mpi_new (0); t = mpi_new (0); p1_4 = mpi_new (0); y = mpi_new (0); /* Compute right hand side. */ mpi_powm (x3, x, mpi_const (MPI_C_THREE), ec->p); mpi_mul (t, ec->a, x); mpi_mod (t, t, ec->p); mpi_add (t, t, ec->b); mpi_mod (t, t, ec->p); mpi_add (t, t, x3); mpi_mod (t, t, ec->p); /* * When p mod 4 = 3, modular square root of A can be computed by * A^((p+1)/4) mod p */ /* Compute (p+1)/4 into p1_4 */ mpi_rshift (p1_4, ec->p, 2); _gcry_mpi_add_ui (p1_4, p1_4, 1); mpi_powm (y, t, p1_4, ec->p); if (y_bit != mpi_test_bit (y, 0)) mpi_sub (y, ec->p, y); mpi_free (p1_4); mpi_free (t); mpi_free (x3); xfree (rawbuffer); rawbuffer = _gcry_ecc_ec2os_buf (x, y, ec->p, &rawlen); raw = rawbuffer; mpi_free (x); mpi_free (y); _gcry_mpi_ec_free (ec); } snprintf (buf, sizeof buf, "(1:%c%u:", names[idx], rawlen); _gcry_md_write (md, buf, strlen (buf)); _gcry_md_write (md, raw, rawlen); _gcry_md_write (md, ")", 1); xfree (rawbuffer); } leave: xfree (curvename); sexp_release (l1); for (idx = 0; idx < N_COMPONENTS; idx++) _gcry_mpi_release (values[idx]); return rc; #undef N_COMPONENTS } /* Low-level API helper functions. */ /* This is the worker function for gcry_pubkey_get_sexp for ECC algorithms. Note that the caller has already stored NULL at R_SEXP. */ gpg_err_code_t _gcry_pk_ecc_get_sexp (gcry_sexp_t *r_sexp, int mode, mpi_ec_t ec) { gpg_err_code_t rc; gcry_mpi_t mpi_G = NULL; gcry_mpi_t mpi_Q = NULL; if (!ec->p || !ec->a || !ec->b || !ec->G || !ec->n) return GPG_ERR_BAD_CRYPT_CTX; if (mode == GCRY_PK_GET_SECKEY && !ec->d) return GPG_ERR_NO_SECKEY; /* Compute the public point if it is missing. */ if (!ec->Q && ec->d) ec->Q = _gcry_ecc_compute_public (NULL, ec); /* Encode G and Q. */ mpi_G = _gcry_mpi_ec_ec2os (ec->G, ec); if (!mpi_G) { rc = GPG_ERR_BROKEN_PUBKEY; goto leave; } if (!ec->Q) { rc = GPG_ERR_BAD_CRYPT_CTX; goto leave; } if (ec->dialect == ECC_DIALECT_ED25519) { unsigned char *encpk; unsigned int encpklen; rc = _gcry_ecc_eddsa_encodepoint (ec->Q, ec, NULL, NULL, 0, &encpk, &encpklen); if (rc) goto leave; mpi_Q = mpi_set_opaque (NULL, encpk, encpklen*8); encpk = NULL; } else if (ec->model == MPI_EC_MONTGOMERY) { unsigned char *encpk; unsigned int encpklen; rc = _gcry_ecc_mont_encodepoint (ec->Q->x, ec->nbits, ec->dialect != ECC_DIALECT_SAFECURVE, &encpk, &encpklen); if (rc) goto leave; mpi_Q = mpi_set_opaque (NULL, encpk, encpklen*8); } else { mpi_Q = _gcry_mpi_ec_ec2os (ec->Q, ec); } if (!mpi_Q) { rc = GPG_ERR_BROKEN_PUBKEY; goto leave; } /* Fixme: We should return a curve name instead of the parameters if if know that they match a curve. */ if (ec->d && (!mode || mode == GCRY_PK_GET_SECKEY)) { /* Let's return a private key. */ rc = sexp_build (r_sexp, NULL, "(private-key(ecc(p%m)(a%m)(b%m)(g%m)(n%m)(h%u)(q%m)(d%m)))", ec->p, ec->a, ec->b, mpi_G, ec->n, ec->h, mpi_Q, ec->d); } else if (ec->Q) { /* Let's return a public key. */ rc = sexp_build (r_sexp, NULL, "(public-key(ecc(p%m)(a%m)(b%m)(g%m)(n%m)(h%u)(q%m)))", ec->p, ec->a, ec->b, mpi_G, ec->n, ec->h, mpi_Q); } else rc = GPG_ERR_BAD_CRYPT_CTX; leave: mpi_free (mpi_Q); mpi_free (mpi_G); return rc; } /* Self-test section. */ static const char * selftest_sign (gcry_sexp_t pkey, gcry_sexp_t skey) { /* Sample data from RFC 6979 section A.2.5, hash is of message "sample" */ static const char sample_data[] = - "(data (flags rfc6979)" - " (hash sha256 #af2bdbe1aa9b6ec1e2ade1d694f41fc71a831d0268e98915" - /**/ "62113d8a62add1bf#))"; + "(data (flags rfc6979 prehash)" + " (hash-algo sha256)" + " (value 6:sample))"; static const char sample_data_bad[] = "(data (flags rfc6979)" " (hash sha256 #bf2bdbe1aa9b6ec1e2ade1d694f41fc71a831d0268e98915" /**/ "62113d8a62add1bf#))"; static const char signature_r[] = "efd48b2aacb6a8fd1140dd9cd45e81d69d2c877b56aaf991c34d0ea84eaf3716"; static const char signature_s[] = "f7cb1c942d657c41d436c7a1b6e29f65f3e900dbb9aff4064dc4ab2f843acda8"; const char *errtxt = NULL; gcry_error_t err; gcry_sexp_t data = NULL; gcry_sexp_t data_bad = NULL; gcry_sexp_t sig = NULL; gcry_sexp_t l1 = NULL; gcry_sexp_t l2 = NULL; gcry_mpi_t r = NULL; gcry_mpi_t s = NULL; gcry_mpi_t calculated_r = NULL; gcry_mpi_t calculated_s = NULL; int cmp; err = sexp_sscan (&data, NULL, sample_data, strlen (sample_data)); if (!err) err = sexp_sscan (&data_bad, NULL, sample_data_bad, strlen (sample_data_bad)); if (!err) err = _gcry_mpi_scan (&r, GCRYMPI_FMT_HEX, signature_r, 0, NULL); if (!err) err = _gcry_mpi_scan (&s, GCRYMPI_FMT_HEX, signature_s, 0, NULL); if (err) { errtxt = "converting data failed"; goto leave; } err = _gcry_pk_sign (&sig, data, skey); if (err) { errtxt = "signing failed"; goto leave; } /* check against known signature */ errtxt = "signature validity failed"; l1 = _gcry_sexp_find_token (sig, "sig-val", 0); if (!l1) goto leave; l2 = _gcry_sexp_find_token (l1, "ecdsa", 0); if (!l2) goto leave; sexp_release (l1); l1 = l2; l2 = _gcry_sexp_find_token (l1, "r", 0); if (!l2) goto leave; calculated_r = _gcry_sexp_nth_mpi (l2, 1, GCRYMPI_FMT_USG); if (!calculated_r) goto leave; sexp_release (l2); l2 = _gcry_sexp_find_token (l1, "s", 0); if (!l2) goto leave; calculated_s = _gcry_sexp_nth_mpi (l2, 1, GCRYMPI_FMT_USG); if (!calculated_s) goto leave; errtxt = "known sig check failed"; cmp = _gcry_mpi_cmp (r, calculated_r); if (cmp) goto leave; cmp = _gcry_mpi_cmp (s, calculated_s); if (cmp) goto leave; errtxt = NULL; /* verify generated signature */ err = _gcry_pk_verify (sig, data, pkey); if (err) { errtxt = "verify failed"; goto leave; } err = _gcry_pk_verify (sig, data_bad, pkey); if (gcry_err_code (err) != GPG_ERR_BAD_SIGNATURE) { errtxt = "bad signature not detected"; goto leave; } leave: sexp_release (sig); sexp_release (data_bad); sexp_release (data); sexp_release (l1); sexp_release (l2); mpi_release (r); mpi_release (s); mpi_release (calculated_r); mpi_release (calculated_s); return errtxt; } static gpg_err_code_t selftests_ecdsa (selftest_report_func_t report) { const char *what; const char *errtxt; gcry_error_t err; gcry_sexp_t skey = NULL; gcry_sexp_t pkey = NULL; what = "convert"; err = sexp_sscan (&skey, NULL, sample_secret_key_secp256, strlen (sample_secret_key_secp256)); if (!err) err = sexp_sscan (&pkey, NULL, sample_public_key_secp256, strlen (sample_public_key_secp256)); if (err) { errtxt = _gcry_strerror (err); goto failed; } what = "key consistency"; err = ecc_check_secret_key(skey); if (err) { errtxt = _gcry_strerror (err); goto failed; } what = "sign"; errtxt = selftest_sign (pkey, skey); if (errtxt) goto failed; sexp_release(pkey); sexp_release(skey); return 0; /* Succeeded. */ failed: sexp_release(pkey); sexp_release(skey); if (report) report ("pubkey", GCRY_PK_ECC, what, errtxt); return GPG_ERR_SELFTEST_FAILED; } /* Run a full self-test for ALGO and return 0 on success. */ static gpg_err_code_t run_selftests (int algo, int extended, selftest_report_func_t report) { (void)extended; if (algo != GCRY_PK_ECC) return GPG_ERR_PUBKEY_ALGO; return selftests_ecdsa (report); } gcry_pk_spec_t _gcry_pubkey_spec_ecc = { GCRY_PK_ECC, { 0, 1 }, (GCRY_PK_USAGE_SIGN | GCRY_PK_USAGE_ENCR), "ECC", ecc_names, "pabgnhq", "pabgnhqd", "se", "rs", "pabgnhq", ecc_generate, ecc_check_secret_key, ecc_encrypt_raw, ecc_decrypt_raw, ecc_sign, ecc_verify, ecc_get_nbits, run_selftests, compute_keygrip, _gcry_ecc_get_curve, _gcry_ecc_get_param_sexp }; diff --git a/cipher/pubkey-internal.h b/cipher/pubkey-internal.h index 2806fa8b..0ca77099 100644 --- a/cipher/pubkey-internal.h +++ b/cipher/pubkey-internal.h @@ -1,106 +1,107 @@ /* pubkey-internal.h - Internal defs for pubkey.c * Copyright (C) 2013 g10 code GmbH * * This file is part of Libgcrypt. * * Libgcrypt is free software; you can redistribute it and/or modify * it under the terms of the GNU Lesser general Public License as * published by the Free Software Foundation; either version 2.1 of * the License, or (at your option) any later version. * * Libgcrypt is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public * License along with this program; if not, see . */ #ifndef GCRY_PUBKEY_INTERNAL_H #define GCRY_PUBKEY_INTERNAL_H /*-- pubkey-util.c --*/ gpg_err_code_t _gcry_pk_util_parse_flaglist (gcry_sexp_t list, int *r_flags, enum pk_encoding *r_encoding); gpg_err_code_t _gcry_pk_util_get_nbits (gcry_sexp_t list, unsigned int *r_nbits); gpg_err_code_t _gcry_pk_util_get_rsa_use_e (gcry_sexp_t list, unsigned long *r_e); gpg_err_code_t _gcry_pk_util_preparse_sigval (gcry_sexp_t s_sig, const char **algo_names, gcry_sexp_t *r_parms, int *r_eccflags); gpg_err_code_t _gcry_pk_util_preparse_encval (gcry_sexp_t sexp, const char **algo_names, gcry_sexp_t *r_parms, struct pk_encoding_ctx *ctx); void _gcry_pk_util_init_encoding_ctx (struct pk_encoding_ctx *ctx, enum pk_operation op, unsigned int nbits); void _gcry_pk_util_free_encoding_ctx (struct pk_encoding_ctx *ctx); gcry_err_code_t _gcry_pk_util_data_to_mpi (gcry_sexp_t input, gcry_mpi_t *ret_mpi, struct pk_encoding_ctx *ctx); /*-- rsa-common.c --*/ gpg_err_code_t _gcry_rsa_pkcs1_encode_for_enc (gcry_mpi_t *r_result, unsigned int nbits, const unsigned char *value, size_t valuelen, const unsigned char *random_override, size_t random_override_len); gpg_err_code_t _gcry_rsa_pkcs1_decode_for_enc (unsigned char **r_result, size_t *r_resultlen, unsigned int nbits, gcry_mpi_t value); gpg_err_code_t _gcry_rsa_pkcs1_encode_raw_for_sig (gcry_mpi_t *r_result, unsigned int nbits, const unsigned char *value, size_t valuelen); gpg_err_code_t _gcry_rsa_pkcs1_encode_for_sig (gcry_mpi_t *r_result, unsigned int nbits, const unsigned char *value, size_t valuelen, int algo); gpg_err_code_t _gcry_rsa_oaep_encode (gcry_mpi_t *r_result, unsigned int nbits, int algo, const unsigned char *value, size_t valuelen, const unsigned char *label, size_t labellen, const void *random_override, size_t random_override_len); gpg_err_code_t _gcry_rsa_oaep_decode (unsigned char **r_result, size_t *r_resultlen, unsigned int nbits, int algo, gcry_mpi_t value, const unsigned char *label, size_t labellen); gpg_err_code_t _gcry_rsa_pss_encode (gcry_mpi_t *r_result, unsigned int nbits, int algo, int hashed_already, int saltlen, const unsigned char *value, size_t valuelen, const void *random_override); gpg_err_code_t _gcry_rsa_pss_verify (gcry_mpi_t value, int hashed_already, gcry_mpi_t encoded, unsigned int nbits, int algo, size_t saltlen); /*-- dsa-common.c --*/ void _gcry_dsa_modify_k (gcry_mpi_t k, gcry_mpi_t q, int qbits); gcry_mpi_t _gcry_dsa_gen_k (gcry_mpi_t q, int security_level); gpg_err_code_t _gcry_dsa_gen_rfc6979_k (gcry_mpi_t *r_k, gcry_mpi_t dsa_q, gcry_mpi_t dsa_x, const unsigned char *h1, unsigned int h1len, int halgo, unsigned int extraloops); - +gpg_err_code_t _gcry_dsa_compute_hash (gcry_mpi_t *r_hash, gcry_mpi_t input, + int hashalgo); gpg_err_code_t _gcry_dsa_normalize_hash (gcry_mpi_t input, gcry_mpi_t *out, unsigned int qbits); /*-- ecc.c --*/ gpg_err_code_t _gcry_pk_ecc_get_sexp (gcry_sexp_t *r_sexp, int mode, mpi_ec_t ec); #endif /*GCRY_PUBKEY_INTERNAL_H*/ diff --git a/cipher/pubkey-util.c b/cipher/pubkey-util.c index e2ea9567..970d9d97 100644 --- a/cipher/pubkey-util.c +++ b/cipher/pubkey-util.c @@ -1,1216 +1,1259 @@ /* pubkey-util.c - Supporting functions for all pubkey modules. * Copyright (C) 1998, 1999, 2000, 2002, 2003, 2005, * 2007, 2008, 2011 Free Software Foundation, Inc. * Copyright (C) 2013, 2015 g10 Code GmbH * * This file is part of Libgcrypt. * * Libgcrypt is free software; you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as * published by the Free Software Foundation; either version 2.1 of * the License, or (at your option) any later version. * * Libgcrypt is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public * License along with this program; if not, see . */ #include #include #include #include #include "g10lib.h" #include "mpi.h" #include "cipher.h" #include "pubkey-internal.h" /* Callback for the pubkey algorithm code to verify PSS signatures. OPAQUE is the data provided by the actual caller. The meaning of TMP depends on the actual algorithm (but there is only RSA); now for RSA it is the output of running the public key function on the input. */ static int pss_verify_cmp (void *opaque, gcry_mpi_t tmp) { struct pk_encoding_ctx *ctx = opaque; gcry_mpi_t value = ctx->verify_arg; return _gcry_rsa_pss_verify (value, !(ctx->flags & PUBKEY_FLAG_PREHASH), tmp, ctx->nbits - 1, ctx->hash_algo, ctx->saltlen); } /* Parser for a flag list. On return the encoding is stored at R_ENCODING and the flags are stored at R_FLAGS. If any of them is not needed, NULL may be passed. The function returns 0 on success or an error code. */ gpg_err_code_t _gcry_pk_util_parse_flaglist (gcry_sexp_t list, int *r_flags, enum pk_encoding *r_encoding) { gpg_err_code_t rc = 0; const char *s; size_t n; int i; int encoding = PUBKEY_ENC_UNKNOWN; int flags = 0; int igninvflag = 0; for (i = list ? sexp_length (list)-1 : 0; i > 0; i--) { s = sexp_nth_data (list, i, &n); if (!s) continue; /* Not a data element. */ switch (n) { case 3: if (!memcmp (s, "pss", 3) && encoding == PUBKEY_ENC_UNKNOWN) { encoding = PUBKEY_ENC_PSS; flags |= PUBKEY_FLAG_FIXEDLEN; } else if (!memcmp (s, "raw", 3) && encoding == PUBKEY_ENC_UNKNOWN) { encoding = PUBKEY_ENC_RAW; flags |= PUBKEY_FLAG_RAW_FLAG; /* Explicitly given. */ } else if (!memcmp (s, "sm2", 3)) { encoding = PUBKEY_ENC_RAW; flags |= PUBKEY_FLAG_SM2 | PUBKEY_FLAG_RAW_FLAG; } else if (!igninvflag) rc = GPG_ERR_INV_FLAG; break; case 4: if (!memcmp (s, "comp", 4)) flags |= PUBKEY_FLAG_COMP; else if (!memcmp (s, "oaep", 4) && encoding == PUBKEY_ENC_UNKNOWN) { encoding = PUBKEY_ENC_OAEP; flags |= PUBKEY_FLAG_FIXEDLEN; } else if (!memcmp (s, "gost", 4)) { encoding = PUBKEY_ENC_RAW; flags |= PUBKEY_FLAG_GOST; } else if (!igninvflag) rc = GPG_ERR_INV_FLAG; break; case 5: if (!memcmp (s, "eddsa", 5)) { encoding = PUBKEY_ENC_RAW; flags |= PUBKEY_FLAG_EDDSA; flags |= PUBKEY_FLAG_DJB_TWEAK; } else if (!memcmp (s, "pkcs1", 5) && encoding == PUBKEY_ENC_UNKNOWN) { encoding = PUBKEY_ENC_PKCS1; flags |= PUBKEY_FLAG_FIXEDLEN; } else if (!memcmp (s, "param", 5)) flags |= PUBKEY_FLAG_PARAM; else if (!igninvflag) rc = GPG_ERR_INV_FLAG; break; case 6: if (!memcmp (s, "nocomp", 6)) flags |= PUBKEY_FLAG_NOCOMP; else if (!igninvflag) rc = GPG_ERR_INV_FLAG; break; case 7: if (!memcmp (s, "rfc6979", 7)) flags |= PUBKEY_FLAG_RFC6979; else if (!memcmp (s, "noparam", 7)) ; /* Ignore - it is the default. */ else if (!memcmp (s, "prehash", 7)) flags |= PUBKEY_FLAG_PREHASH; else if (!igninvflag) rc = GPG_ERR_INV_FLAG; break; case 8: if (!memcmp (s, "use-x931", 8)) flags |= PUBKEY_FLAG_USE_X931; else if (!igninvflag) rc = GPG_ERR_INV_FLAG; break; case 9: if (!memcmp (s, "pkcs1-raw", 9) && encoding == PUBKEY_ENC_UNKNOWN) { encoding = PUBKEY_ENC_PKCS1_RAW; flags |= PUBKEY_FLAG_FIXEDLEN; } else if (!memcmp (s, "djb-tweak", 9)) { encoding = PUBKEY_ENC_RAW; flags |= PUBKEY_FLAG_DJB_TWEAK; } else if (!igninvflag) rc = GPG_ERR_INV_FLAG; break; case 10: if (!memcmp (s, "igninvflag", 10)) igninvflag = 1; else if (!memcmp (s, "no-keytest", 10)) flags |= PUBKEY_FLAG_NO_KEYTEST; else if (!igninvflag) rc = GPG_ERR_INV_FLAG; break; case 11: if (!memcmp (s, "no-blinding", 11)) flags |= PUBKEY_FLAG_NO_BLINDING; else if (!memcmp (s, "use-fips186", 11)) flags |= PUBKEY_FLAG_USE_FIPS186; else if (!igninvflag) rc = GPG_ERR_INV_FLAG; break; case 13: if (!memcmp (s, "use-fips186-2", 13)) flags |= PUBKEY_FLAG_USE_FIPS186_2; else if (!memcmp (s, "transient-key", 13)) flags |= PUBKEY_FLAG_TRANSIENT_KEY; else if (!igninvflag) rc = GPG_ERR_INV_FLAG; break; default: if (!igninvflag) rc = GPG_ERR_INV_FLAG; break; } } if (r_flags) *r_flags = flags; if (r_encoding) *r_encoding = encoding; return rc; } static int get_hash_algo (const char *s, size_t n) { static const struct { const char *name; int algo; } hashnames[] = { { "sha1", GCRY_MD_SHA1 }, { "md5", GCRY_MD_MD5 }, { "sha256", GCRY_MD_SHA256 }, { "ripemd160", GCRY_MD_RMD160 }, { "rmd160", GCRY_MD_RMD160 }, { "sha384", GCRY_MD_SHA384 }, { "sha512", GCRY_MD_SHA512 }, { "sha224", GCRY_MD_SHA224 }, { "md2", GCRY_MD_MD2 }, { "md4", GCRY_MD_MD4 }, { "tiger", GCRY_MD_TIGER }, { "haval", GCRY_MD_HAVAL }, { "sha3-224", GCRY_MD_SHA3_224 }, { "sha3-256", GCRY_MD_SHA3_256 }, { "sha3-384", GCRY_MD_SHA3_384 }, { "sha3-512", GCRY_MD_SHA3_512 }, { "sm3", GCRY_MD_SM3 }, { "shake128", GCRY_MD_SHAKE128 }, { "shake256", GCRY_MD_SHAKE256 }, { NULL, 0 } }; int algo; int i; for (i=0; hashnames[i].name; i++) { if ( strlen (hashnames[i].name) == n && !memcmp (hashnames[i].name, s, n)) break; } if (hashnames[i].name) algo = hashnames[i].algo; else { /* In case of not listed or dynamically allocated hash algorithm we fall back to this somewhat slower method. Further, it also allows to use OIDs as algorithm names. */ char *tmpname; tmpname = xtrymalloc (n+1); if (!tmpname) algo = 0; /* Out of core - silently give up. */ else { memcpy (tmpname, s, n); tmpname[n] = 0; algo = _gcry_md_map_name (tmpname); xfree (tmpname); } } return algo; } /* Get the "nbits" parameter from an s-expression of the format: * * (algo * (parameter_name_1 ....) * .... * (parameter_name_n ....)) * * Example: * * (rsa * (nbits 4:2048)) * * On success the value for nbits is stored at R_NBITS. If no nbits * parameter is found, the function returns success and stores 0 at * R_NBITS. For parsing errors the function returns an error code and * stores 0 at R_NBITS. */ gpg_err_code_t _gcry_pk_util_get_nbits (gcry_sexp_t list, unsigned int *r_nbits) { char buf[50]; const char *s; size_t n; *r_nbits = 0; list = sexp_find_token (list, "nbits", 0); if (!list) return 0; /* No NBITS found. */ s = sexp_nth_data (list, 1, &n); if (!s || n >= DIM (buf) - 1 ) { /* NBITS given without a cdr. */ sexp_release (list); return GPG_ERR_INV_OBJ; } memcpy (buf, s, n); buf[n] = 0; *r_nbits = (unsigned int)strtoul (buf, NULL, 0); sexp_release (list); return 0; } /* Get the optional "rsa-use-e" parameter from an s-expression of the * format: * * (algo * (parameter_name_1 ....) * .... * (parameter_name_n ....)) * * Example: * * (rsa * (nbits 4:2048) * (rsa-use-e 2:41)) * * On success the value for nbits is stored at R_E. If no rsa-use-e * parameter is found, the function returns success and stores 65537 at * R_E. For parsing errors the function returns an error code and * stores 0 at R_E. */ gpg_err_code_t _gcry_pk_util_get_rsa_use_e (gcry_sexp_t list, unsigned long *r_e) { char buf[50]; const char *s; size_t n; *r_e = 0; list = sexp_find_token (list, "rsa-use-e", 0); if (!list) { *r_e = 65537; /* Not given, use the value generated by old versions. */ return 0; } s = sexp_nth_data (list, 1, &n); if (!s || n >= DIM (buf) - 1 ) { /* No value or value too large. */ sexp_release (list); return GPG_ERR_INV_OBJ; } memcpy (buf, s, n); buf[n] = 0; *r_e = strtoul (buf, NULL, 0); sexp_release (list); return 0; } /* Parse a "sig-val" s-expression and store the inner parameter list at R_PARMS. ALGO_NAMES is used to verify that the algorithm in "sig-val" is valid. Returns 0 on success and stores a new list at R_PARMS which must be freed by the caller. On error R_PARMS is set to NULL and an error code returned. If R_ECCFLAGS is not NULL flag values are set into it; as of now they are only used with ecc algorithms. */ gpg_err_code_t _gcry_pk_util_preparse_sigval (gcry_sexp_t s_sig, const char **algo_names, gcry_sexp_t *r_parms, int *r_eccflags) { gpg_err_code_t rc; gcry_sexp_t l1 = NULL; gcry_sexp_t l2 = NULL; char *name = NULL; int i; *r_parms = NULL; if (r_eccflags) *r_eccflags = 0; /* Extract the signature value. */ l1 = sexp_find_token (s_sig, "sig-val", 0); if (!l1) { rc = GPG_ERR_INV_OBJ; /* Does not contain a signature value object. */ goto leave; } l2 = sexp_nth (l1, 1); if (!l2) { rc = GPG_ERR_NO_OBJ; /* No cadr for the sig object. */ goto leave; } name = sexp_nth_string (l2, 0); if (!name) { rc = GPG_ERR_INV_OBJ; /* Invalid structure of object. */ goto leave; } else if (!strcmp (name, "flags")) { /* Skip a "flags" parameter and look again for the algorithm name. This is not used but here just for the sake of consistent S-expressions we need to handle it. */ sexp_release (l2); l2 = sexp_nth (l1, 2); if (!l2) { rc = GPG_ERR_INV_OBJ; goto leave; } xfree (name); name = sexp_nth_string (l2, 0); if (!name) { rc = GPG_ERR_INV_OBJ; /* Invalid structure of object. */ goto leave; } } for (i=0; algo_names[i]; i++) if (!stricmp (name, algo_names[i])) break; if (!algo_names[i]) { rc = GPG_ERR_CONFLICT; /* "sig-val" uses an unexpected algo. */ goto leave; } if (r_eccflags) { if (!strcmp (name, "eddsa")) *r_eccflags = PUBKEY_FLAG_EDDSA; if (!strcmp (name, "gost")) *r_eccflags = PUBKEY_FLAG_GOST; if (!strcmp (name, "sm2")) *r_eccflags = PUBKEY_FLAG_SM2; } *r_parms = l2; l2 = NULL; rc = 0; leave: xfree (name); sexp_release (l2); sexp_release (l1); return rc; } /* Parse a "enc-val" s-expression and store the inner parameter list at R_PARMS. ALGO_NAMES is used to verify that the algorithm in "enc-val" is valid. Returns 0 on success and stores a new list at R_PARMS which must be freed by the caller. On error R_PARMS is set to NULL and an error code returned. If R_ECCFLAGS is not NULL flag values are set into it; as of now they are only used with ecc algorithms. (enc-val [(flags [raw, pkcs1, oaep, no-blinding])] [(hash-algo )] [(label