blob: da4c9e8dad84b045bbf291e7235d0f2e201f3bf4 [file] [log] [blame]
Manuel Pégourié-Gonnard2aea1412013-01-26 16:33:44 +01001/*
2 * Elliptic curve DSA
3 *
Bence Szépkúti1e148272020-08-07 13:07:28 +02004 * Copyright The Mbed TLS Contributors
Dave Rodgman16799db2023-11-02 19:47:20 +00005 * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
Manuel Pégourié-Gonnard2aea1412013-01-26 16:33:44 +01006 */
7
8/*
9 * References:
10 *
Xiaokang Qianb92a2f62023-04-19 02:59:15 +000011 * SEC1 https://www.secg.org/sec1-v2.pdf
Manuel Pégourié-Gonnard2aea1412013-01-26 16:33:44 +010012 */
13
Gilles Peskinedb09ef62020-06-03 01:43:33 +020014#include "common.h"
Manuel Pégourié-Gonnard2aea1412013-01-26 16:33:44 +010015
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020016#if defined(MBEDTLS_ECDSA_C)
Manuel Pégourié-Gonnard2aea1412013-01-26 16:33:44 +010017
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000018#include "mbedtls/ecdsa.h"
19#include "mbedtls/asn1write.h"
Manuel Pégourié-Gonnard2aea1412013-01-26 16:33:44 +010020
Rich Evans00ab4702015-02-06 13:43:58 +000021#include <string.h>
22
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020023#if defined(MBEDTLS_ECDSA_DETERMINISTIC)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000024#include "mbedtls/hmac_drbg.h"
Manuel Pégourié-Gonnard7845fc02014-01-27 14:24:03 +010025#endif
Manuel Pégourié-Gonnard461d4162014-01-06 10:16:28 +010026
Manuel Pégourié-Gonnarda0c5bcc2017-04-21 11:33:57 +020027#include "mbedtls/platform.h"
Manuel Pégourié-Gonnarda0c5bcc2017-04-21 11:33:57 +020028
Hanno Becker319ae112018-12-14 16:43:29 +000029#include "mbedtls/platform_util.h"
Janos Follath24eed8d2019-11-22 13:21:35 +000030#include "mbedtls/error.h"
Hanno Becker319ae112018-12-14 16:43:29 +000031
Manuel Pégourié-Gonnarda0c5bcc2017-04-21 11:33:57 +020032#if defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnard5314f232017-04-21 12:36:59 +020033
Manuel Pégourié-Gonnarda0c5bcc2017-04-21 11:33:57 +020034/*
Manuel Pégourié-Gonnarda4dd7832017-09-07 11:11:39 +020035 * Sub-context for ecdsa_verify()
Manuel Pégourié-Gonnarda0c5bcc2017-04-21 11:33:57 +020036 */
Gilles Peskine449bd832023-01-11 14:50:10 +010037struct mbedtls_ecdsa_restart_ver {
Manuel Pégourié-Gonnard5314f232017-04-21 12:36:59 +020038 mbedtls_mpi u1, u2; /* intermediate values */
39 enum { /* what to do next? */
40 ecdsa_ver_init = 0, /* getting started */
41 ecdsa_ver_muladd, /* muladd step */
42 } state;
Manuel Pégourié-Gonnarda0c5bcc2017-04-21 11:33:57 +020043};
44
45/*
46 * Init verify restart sub-context
47 */
Gilles Peskine449bd832023-01-11 14:50:10 +010048static void ecdsa_restart_ver_init(mbedtls_ecdsa_restart_ver_ctx *ctx)
Manuel Pégourié-Gonnarda0c5bcc2017-04-21 11:33:57 +020049{
Gilles Peskine449bd832023-01-11 14:50:10 +010050 mbedtls_mpi_init(&ctx->u1);
51 mbedtls_mpi_init(&ctx->u2);
Manuel Pégourié-Gonnard5bd38b12017-08-23 16:55:59 +020052 ctx->state = ecdsa_ver_init;
Manuel Pégourié-Gonnarda0c5bcc2017-04-21 11:33:57 +020053}
54
55/*
56 * Free the components of a verify restart sub-context
57 */
Gilles Peskine449bd832023-01-11 14:50:10 +010058static void ecdsa_restart_ver_free(mbedtls_ecdsa_restart_ver_ctx *ctx)
Manuel Pégourié-Gonnarda0c5bcc2017-04-21 11:33:57 +020059{
Gilles Peskine449bd832023-01-11 14:50:10 +010060 if (ctx == NULL) {
Manuel Pégourié-Gonnarda0c5bcc2017-04-21 11:33:57 +020061 return;
Gilles Peskine449bd832023-01-11 14:50:10 +010062 }
Manuel Pégourié-Gonnarda0c5bcc2017-04-21 11:33:57 +020063
Gilles Peskine449bd832023-01-11 14:50:10 +010064 mbedtls_mpi_free(&ctx->u1);
65 mbedtls_mpi_free(&ctx->u2);
Manuel Pégourié-Gonnard5314f232017-04-21 12:36:59 +020066
Gilles Peskine449bd832023-01-11 14:50:10 +010067 ecdsa_restart_ver_init(ctx);
Manuel Pégourié-Gonnarda0c5bcc2017-04-21 11:33:57 +020068}
69
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +020070/*
Manuel Pégourié-Gonnarda4dd7832017-09-07 11:11:39 +020071 * Sub-context for ecdsa_sign()
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +020072 */
Gilles Peskine449bd832023-01-11 14:50:10 +010073struct mbedtls_ecdsa_restart_sig {
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +020074 int sign_tries;
75 int key_tries;
76 mbedtls_mpi k; /* per-signature random */
77 mbedtls_mpi r; /* r value */
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +020078 enum { /* what to do next? */
79 ecdsa_sig_init = 0, /* getting started */
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +020080 ecdsa_sig_mul, /* doing ecp_mul() */
81 ecdsa_sig_modn, /* mod N computations */
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +020082 } state;
83};
84
85/*
86 * Init verify sign sub-context
87 */
Gilles Peskine449bd832023-01-11 14:50:10 +010088static void ecdsa_restart_sig_init(mbedtls_ecdsa_restart_sig_ctx *ctx)
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +020089{
Manuel Pégourié-Gonnard5bd38b12017-08-23 16:55:59 +020090 ctx->sign_tries = 0;
91 ctx->key_tries = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +010092 mbedtls_mpi_init(&ctx->k);
93 mbedtls_mpi_init(&ctx->r);
Manuel Pégourié-Gonnard5bd38b12017-08-23 16:55:59 +020094 ctx->state = ecdsa_sig_init;
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +020095}
96
97/*
98 * Free the components of a sign restart sub-context
99 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100100static void ecdsa_restart_sig_free(mbedtls_ecdsa_restart_sig_ctx *ctx)
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200101{
Gilles Peskine449bd832023-01-11 14:50:10 +0100102 if (ctx == NULL) {
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200103 return;
Gilles Peskine449bd832023-01-11 14:50:10 +0100104 }
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200105
Gilles Peskine449bd832023-01-11 14:50:10 +0100106 mbedtls_mpi_free(&ctx->k);
107 mbedtls_mpi_free(&ctx->r);
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200108}
109
110#if defined(MBEDTLS_ECDSA_DETERMINISTIC)
111/*
Manuel Pégourié-Gonnarda4dd7832017-09-07 11:11:39 +0200112 * Sub-context for ecdsa_sign_det()
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200113 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100114struct mbedtls_ecdsa_restart_det {
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200115 mbedtls_hmac_drbg_context rng_ctx; /* DRBG state */
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200116 enum { /* what to do next? */
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200117 ecdsa_det_init = 0, /* getting started */
118 ecdsa_det_sign, /* make signature */
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200119 } state;
120};
121
122/*
123 * Init verify sign_det sub-context
124 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100125static void ecdsa_restart_det_init(mbedtls_ecdsa_restart_det_ctx *ctx)
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200126{
Gilles Peskine449bd832023-01-11 14:50:10 +0100127 mbedtls_hmac_drbg_init(&ctx->rng_ctx);
Manuel Pégourié-Gonnard5bd38b12017-08-23 16:55:59 +0200128 ctx->state = ecdsa_det_init;
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200129}
130
131/*
132 * Free the components of a sign_det restart sub-context
133 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100134static void ecdsa_restart_det_free(mbedtls_ecdsa_restart_det_ctx *ctx)
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200135{
Gilles Peskine449bd832023-01-11 14:50:10 +0100136 if (ctx == NULL) {
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200137 return;
Gilles Peskine449bd832023-01-11 14:50:10 +0100138 }
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200139
Gilles Peskine449bd832023-01-11 14:50:10 +0100140 mbedtls_hmac_drbg_free(&ctx->rng_ctx);
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200141
Gilles Peskine449bd832023-01-11 14:50:10 +0100142 ecdsa_restart_det_init(ctx);
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200143}
144#endif /* MBEDTLS_ECDSA_DETERMINISTIC */
145
Gilles Peskine449bd832023-01-11 14:50:10 +0100146#define ECDSA_RS_ECP (rs_ctx == NULL ? NULL : &rs_ctx->ecp)
Manuel Pégourié-Gonnarda0c5bcc2017-04-21 11:33:57 +0200147
Manuel Pégourié-Gonnard5314f232017-04-21 12:36:59 +0200148/* Utility macro for checking and updating ops budget */
Gilles Peskine449bd832023-01-11 14:50:10 +0100149#define ECDSA_BUDGET(ops) \
150 MBEDTLS_MPI_CHK(mbedtls_ecp_check_budget(grp, ECDSA_RS_ECP, ops));
Manuel Pégourié-Gonnard5314f232017-04-21 12:36:59 +0200151
Manuel Pégourié-Gonnardb948f7d2017-08-23 17:58:40 +0200152/* Call this when entering a function that needs its own sub-context */
Gilles Peskine449bd832023-01-11 14:50:10 +0100153#define ECDSA_RS_ENTER(SUB) do { \
154 /* reset ops count for this call if top-level */ \
155 if (rs_ctx != NULL && rs_ctx->ecp.depth++ == 0) \
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200156 rs_ctx->ecp.ops_done = 0; \
157 \
Gilles Peskine449bd832023-01-11 14:50:10 +0100158 /* set up our own sub-context if needed */ \
159 if (mbedtls_ecp_restart_is_enabled() && \
160 rs_ctx != NULL && rs_ctx->SUB == NULL) \
161 { \
162 rs_ctx->SUB = mbedtls_calloc(1, sizeof(*rs_ctx->SUB)); \
163 if (rs_ctx->SUB == NULL) \
164 return MBEDTLS_ERR_ECP_ALLOC_FAILED; \
165 \
166 ecdsa_restart_## SUB ##_init(rs_ctx->SUB); \
167 } \
168} while (0)
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200169
Manuel Pégourié-Gonnardb948f7d2017-08-23 17:58:40 +0200170/* Call this when leaving a function that needs its own sub-context */
Gilles Peskine449bd832023-01-11 14:50:10 +0100171#define ECDSA_RS_LEAVE(SUB) do { \
172 /* clear our sub-context when not in progress (done or error) */ \
173 if (rs_ctx != NULL && rs_ctx->SUB != NULL && \
174 ret != MBEDTLS_ERR_ECP_IN_PROGRESS) \
175 { \
176 ecdsa_restart_## SUB ##_free(rs_ctx->SUB); \
177 mbedtls_free(rs_ctx->SUB); \
178 rs_ctx->SUB = NULL; \
179 } \
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200180 \
Gilles Peskine449bd832023-01-11 14:50:10 +0100181 if (rs_ctx != NULL) \
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200182 rs_ctx->ecp.depth--; \
Gilles Peskine449bd832023-01-11 14:50:10 +0100183} while (0)
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200184
Manuel Pégourié-Gonnarda0c5bcc2017-04-21 11:33:57 +0200185#else /* MBEDTLS_ECP_RESTARTABLE */
186
187#define ECDSA_RS_ECP NULL
188
Gilles Peskine449bd832023-01-11 14:50:10 +0100189#define ECDSA_BUDGET(ops) /* no-op; for compatibility */
Manuel Pégourié-Gonnard5314f232017-04-21 12:36:59 +0200190
Gilles Peskine449bd832023-01-11 14:50:10 +0100191#define ECDSA_RS_ENTER(SUB) (void) rs_ctx
192#define ECDSA_RS_LEAVE(SUB) (void) rs_ctx
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200193
Manuel Pégourié-Gonnarda0c5bcc2017-04-21 11:33:57 +0200194#endif /* MBEDTLS_ECP_RESTARTABLE */
195
Steven Cooremanfa6641b2021-01-11 17:11:39 +0100196#if defined(MBEDTLS_ECDSA_DETERMINISTIC) || \
Thomas Daubneye3013da2024-07-18 12:26:26 +0100197 !defined(MBEDTLS_ECDSA_SIGN_ALT)
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100198/*
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100199 * Derive a suitable integer for group grp from a buffer of length len
200 * SEC1 4.1.3 step 5 aka SEC1 4.1.4 step 3
201 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100202static int derive_mpi(const mbedtls_ecp_group *grp, mbedtls_mpi *x,
203 const unsigned char *buf, size_t blen)
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100204{
Janos Follath24eed8d2019-11-22 13:21:35 +0000205 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskine449bd832023-01-11 14:50:10 +0100206 size_t n_size = (grp->nbits + 7) / 8;
Manuel Pégourié-Gonnard53048122014-01-03 12:55:15 +0100207 size_t use_size = blen > n_size ? n_size : blen;
208
Gilles Peskine449bd832023-01-11 14:50:10 +0100209 MBEDTLS_MPI_CHK(mbedtls_mpi_read_binary(x, buf, use_size));
210 if (use_size * 8 > grp->nbits) {
211 MBEDTLS_MPI_CHK(mbedtls_mpi_shift_r(x, use_size * 8 - grp->nbits));
212 }
Manuel Pégourié-Gonnard53048122014-01-03 12:55:15 +0100213
Manuel Pégourié-Gonnard461d4162014-01-06 10:16:28 +0100214 /* While at it, reduce modulo N */
Gilles Peskine449bd832023-01-11 14:50:10 +0100215 if (mbedtls_mpi_cmp_mpi(x, &grp->N) >= 0) {
216 MBEDTLS_MPI_CHK(mbedtls_mpi_sub_mpi(x, x, &grp->N));
217 }
Manuel Pégourié-Gonnard461d4162014-01-06 10:16:28 +0100218
Manuel Pégourié-Gonnard53048122014-01-03 12:55:15 +0100219cleanup:
Gilles Peskine449bd832023-01-11 14:50:10 +0100220 return ret;
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100221}
Thomas Daubneye3013da2024-07-18 12:26:26 +0100222#endif /* ECDSA_DETERMINISTIC || !ECDSA_SIGN_ALT */
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100223
JonathanWitthoeft405ec942023-04-26 10:24:12 -0500224int mbedtls_ecdsa_can_do(mbedtls_ecp_group_id gid)
225{
226 switch (gid) {
227#ifdef MBEDTLS_ECP_DP_CURVE25519_ENABLED
228 case MBEDTLS_ECP_DP_CURVE25519: return 0;
229#endif
230#ifdef MBEDTLS_ECP_DP_CURVE448_ENABLED
231 case MBEDTLS_ECP_DP_CURVE448: return 0;
232#endif
233 default: return 1;
234 }
235}
236
Ron Eldor936d2842018-11-01 13:05:52 +0200237#if !defined(MBEDTLS_ECDSA_SIGN_ALT)
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100238/*
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100239 * Compute ECDSA signature of a hashed message (SEC1 4.1.3)
240 * Obviously, compared to SEC1 4.1.3, we skip step 4 (hash message)
241 */
Paul Elliott2ba002c2022-12-09 18:59:26 +0000242int mbedtls_ecdsa_sign_restartable(mbedtls_ecp_group *grp,
243 mbedtls_mpi *r, mbedtls_mpi *s,
244 const mbedtls_mpi *d, const unsigned char *buf, size_t blen,
245 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng,
246 int (*f_rng_blind)(void *, unsigned char *, size_t),
247 void *p_rng_blind,
248 mbedtls_ecdsa_restart_ctx *rs_ctx)
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100249{
Manuel Pégourié-Gonnard50b63ba2017-04-25 12:57:22 +0200250 int ret, key_tries, sign_tries;
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200251 int *p_sign_tries = &sign_tries, *p_key_tries = &key_tries;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200252 mbedtls_ecp_point R;
253 mbedtls_mpi k, e, t;
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200254 mbedtls_mpi *pk = &k, *pr = r;
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100255
Manuel Pégourié-Gonnard97871ef2013-12-04 20:52:04 +0100256 /* Fail cleanly on curves such as Curve25519 that can't be used for ECDSA */
Gilles Peskine449bd832023-01-11 14:50:10 +0100257 if (!mbedtls_ecdsa_can_do(grp->id) || grp->N.p == NULL) {
258 return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
259 }
Manuel Pégourié-Gonnard97871ef2013-12-04 20:52:04 +0100260
Darryl Greenc64a48b2017-11-17 17:09:17 +0000261 /* Make sure d is in range 1..n-1 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100262 if (mbedtls_mpi_cmp_int(d, 1) < 0 || mbedtls_mpi_cmp_mpi(d, &grp->N) >= 0) {
263 return MBEDTLS_ERR_ECP_INVALID_KEY;
264 }
Darryl Greenc64a48b2017-11-17 17:09:17 +0000265
Gilles Peskine449bd832023-01-11 14:50:10 +0100266 mbedtls_ecp_point_init(&R);
267 mbedtls_mpi_init(&k); mbedtls_mpi_init(&e); mbedtls_mpi_init(&t);
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100268
Gilles Peskine449bd832023-01-11 14:50:10 +0100269 ECDSA_RS_ENTER(sig);
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200270
271#if defined(MBEDTLS_ECP_RESTARTABLE)
Gilles Peskine449bd832023-01-11 14:50:10 +0100272 if (rs_ctx != NULL && rs_ctx->sig != NULL) {
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200273 /* redirect to our context */
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200274 p_sign_tries = &rs_ctx->sig->sign_tries;
275 p_key_tries = &rs_ctx->sig->key_tries;
276 pk = &rs_ctx->sig->k;
277 pr = &rs_ctx->sig->r;
278
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200279 /* jump to current step */
Gilles Peskine449bd832023-01-11 14:50:10 +0100280 if (rs_ctx->sig->state == ecdsa_sig_mul) {
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200281 goto mul;
Gilles Peskine449bd832023-01-11 14:50:10 +0100282 }
283 if (rs_ctx->sig->state == ecdsa_sig_modn) {
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200284 goto modn;
Gilles Peskine449bd832023-01-11 14:50:10 +0100285 }
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200286 }
287#endif /* MBEDTLS_ECP_RESTARTABLE */
288
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200289 *p_sign_tries = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +0100290 do {
291 if ((*p_sign_tries)++ > 10) {
Manuel Pégourié-Gonnard67543962017-04-21 13:19:43 +0200292 ret = MBEDTLS_ERR_ECP_RANDOM_FAILED;
293 goto cleanup;
294 }
295
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100296 /*
297 * Steps 1-3: generate a suitable ephemeral keypair
Manuel Pégourié-Gonnard178d9ba2013-10-29 10:45:28 +0100298 * and set r = xR mod n
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100299 */
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200300 *p_key_tries = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +0100301 do {
302 if ((*p_key_tries)++ > 10) {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200303 ret = MBEDTLS_ERR_ECP_RANDOM_FAILED;
Paul Bakkercca998a2013-07-26 14:20:53 +0200304 goto cleanup;
305 }
Manuel Pégourié-Gonnard67543962017-04-21 13:19:43 +0200306
Gilles Peskine449bd832023-01-11 14:50:10 +0100307 MBEDTLS_MPI_CHK(mbedtls_ecp_gen_privkey(grp, pk, f_rng, p_rng));
Manuel Pégourié-Gonnard50b63ba2017-04-25 12:57:22 +0200308
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200309#if defined(MBEDTLS_ECP_RESTARTABLE)
Gilles Peskine449bd832023-01-11 14:50:10 +0100310 if (rs_ctx != NULL && rs_ctx->sig != NULL) {
Manuel Pégourié-Gonnard63481812017-08-24 11:16:01 +0200311 rs_ctx->sig->state = ecdsa_sig_mul;
Gilles Peskine449bd832023-01-11 14:50:10 +0100312 }
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200313
314mul:
315#endif
Gilles Peskine449bd832023-01-11 14:50:10 +0100316 MBEDTLS_MPI_CHK(mbedtls_ecp_mul_restartable(grp, &R, pk, &grp->G,
317 f_rng_blind,
318 p_rng_blind,
319 ECDSA_RS_ECP));
320 MBEDTLS_MPI_CHK(mbedtls_mpi_mod_mpi(pr, &R.X, &grp->N));
321 } while (mbedtls_mpi_cmp_int(pr, 0) == 0);
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200322
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200323#if defined(MBEDTLS_ECP_RESTARTABLE)
Gilles Peskine449bd832023-01-11 14:50:10 +0100324 if (rs_ctx != NULL && rs_ctx->sig != NULL) {
Manuel Pégourié-Gonnard63481812017-08-24 11:16:01 +0200325 rs_ctx->sig->state = ecdsa_sig_modn;
Gilles Peskine449bd832023-01-11 14:50:10 +0100326 }
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200327
328modn:
329#endif
330 /*
331 * Accounting for everything up to the end of the loop
332 * (step 6, but checking now avoids saving e and t)
333 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100334 ECDSA_BUDGET(MBEDTLS_ECP_OPS_INV + 4);
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100335
336 /*
337 * Step 5: derive MPI from hashed message
338 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100339 MBEDTLS_MPI_CHK(derive_mpi(grp, &e, buf, blen));
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100340
341 /*
Manuel Pégourié-Gonnarddd75c312014-03-31 11:55:42 +0200342 * Generate a random value to blind inv_mod in next step,
343 * avoiding a potential timing leak.
344 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100345 MBEDTLS_MPI_CHK(mbedtls_ecp_gen_privkey(grp, &t, f_rng_blind,
346 p_rng_blind));
Manuel Pégourié-Gonnarddd75c312014-03-31 11:55:42 +0200347
348 /*
349 * Step 6: compute s = (e + r * d) / k = t (e + rd) / (kt) mod n
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100350 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100351 MBEDTLS_MPI_CHK(mbedtls_mpi_mul_mpi(s, pr, d));
352 MBEDTLS_MPI_CHK(mbedtls_mpi_add_mpi(&e, &e, s));
353 MBEDTLS_MPI_CHK(mbedtls_mpi_mul_mpi(&e, &e, &t));
354 MBEDTLS_MPI_CHK(mbedtls_mpi_mul_mpi(pk, pk, &t));
355 MBEDTLS_MPI_CHK(mbedtls_mpi_mod_mpi(pk, pk, &grp->N));
356 MBEDTLS_MPI_CHK(mbedtls_mpi_inv_mod(s, pk, &grp->N));
357 MBEDTLS_MPI_CHK(mbedtls_mpi_mul_mpi(s, s, &e));
358 MBEDTLS_MPI_CHK(mbedtls_mpi_mod_mpi(s, s, &grp->N));
359 } while (mbedtls_mpi_cmp_int(s, 0) == 0);
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100360
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200361#if defined(MBEDTLS_ECP_RESTARTABLE)
Gilles Peskine449bd832023-01-11 14:50:10 +0100362 if (rs_ctx != NULL && rs_ctx->sig != NULL) {
Chien Wonge2caf412023-08-01 21:38:46 +0800363 MBEDTLS_MPI_CHK(mbedtls_mpi_copy(r, pr));
Gilles Peskine449bd832023-01-11 14:50:10 +0100364 }
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200365#endif
366
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100367cleanup:
Gilles Peskine449bd832023-01-11 14:50:10 +0100368 mbedtls_ecp_point_free(&R);
369 mbedtls_mpi_free(&k); mbedtls_mpi_free(&e); mbedtls_mpi_free(&t);
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100370
Gilles Peskine449bd832023-01-11 14:50:10 +0100371 ECDSA_RS_LEAVE(sig);
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200372
Gilles Peskine449bd832023-01-11 14:50:10 +0100373 return ret;
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100374}
Manuel Pégourié-Gonnard2aea1412013-01-26 16:33:44 +0100375
Manuel Pégourié-Gonnardaddb10e2017-04-21 12:54:46 +0200376/*
377 * Compute ECDSA signature of a hashed message
378 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100379int mbedtls_ecdsa_sign(mbedtls_ecp_group *grp, mbedtls_mpi *r, mbedtls_mpi *s,
380 const mbedtls_mpi *d, const unsigned char *buf, size_t blen,
381 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng)
Manuel Pégourié-Gonnardaddb10e2017-04-21 12:54:46 +0200382{
Janos Follathdca667a2019-01-04 14:32:30 +0000383 /* Use the same RNG for both blinding and ephemeral key generation */
Paul Elliott2ba002c2022-12-09 18:59:26 +0000384 return mbedtls_ecdsa_sign_restartable(grp, r, s, d, buf, blen,
385 f_rng, p_rng, f_rng, p_rng, NULL);
Manuel Pégourié-Gonnardaddb10e2017-04-21 12:54:46 +0200386}
Ron Eldor936d2842018-11-01 13:05:52 +0200387#endif /* !MBEDTLS_ECDSA_SIGN_ALT */
Manuel Pégourié-Gonnardaddb10e2017-04-21 12:54:46 +0200388
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200389#if defined(MBEDTLS_ECDSA_DETERMINISTIC)
Manuel Pégourié-Gonnard4daaef72014-01-06 14:25:56 +0100390/*
391 * Deterministic signature wrapper
TRodziewicz18efb732021-04-29 23:12:19 +0200392 *
TRodziewicz7e9422d2021-04-30 10:32:58 +0200393 * note: The f_rng_blind parameter must not be NULL.
TRodziewicz18efb732021-04-29 23:12:19 +0200394 *
Manuel Pégourié-Gonnard4daaef72014-01-06 14:25:56 +0100395 */
Paul Elliott2ba002c2022-12-09 18:59:26 +0000396int mbedtls_ecdsa_sign_det_restartable(mbedtls_ecp_group *grp,
397 mbedtls_mpi *r, mbedtls_mpi *s,
398 const mbedtls_mpi *d, const unsigned char *buf, size_t blen,
399 mbedtls_md_type_t md_alg,
400 int (*f_rng_blind)(void *, unsigned char *, size_t),
401 void *p_rng_blind,
402 mbedtls_ecdsa_restart_ctx *rs_ctx)
Manuel Pégourié-Gonnard4daaef72014-01-06 14:25:56 +0100403{
Janos Follath24eed8d2019-11-22 13:21:35 +0000404 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200405 mbedtls_hmac_drbg_context rng_ctx;
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200406 mbedtls_hmac_drbg_context *p_rng = &rng_ctx;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200407 unsigned char data[2 * MBEDTLS_ECP_MAX_BYTES];
Gilles Peskine449bd832023-01-11 14:50:10 +0100408 size_t grp_len = (grp->nbits + 7) / 8;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200409 const mbedtls_md_info_t *md_info;
410 mbedtls_mpi h;
Manuel Pégourié-Gonnard4daaef72014-01-06 14:25:56 +0100411
Gilles Peskine449bd832023-01-11 14:50:10 +0100412 if ((md_info = mbedtls_md_info_from_type(md_alg)) == NULL) {
413 return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
414 }
Manuel Pégourié-Gonnard4daaef72014-01-06 14:25:56 +0100415
Gilles Peskine449bd832023-01-11 14:50:10 +0100416 mbedtls_mpi_init(&h);
417 mbedtls_hmac_drbg_init(&rng_ctx);
Manuel Pégourié-Gonnard4daaef72014-01-06 14:25:56 +0100418
Gilles Peskine449bd832023-01-11 14:50:10 +0100419 ECDSA_RS_ENTER(det);
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200420
421#if defined(MBEDTLS_ECP_RESTARTABLE)
Gilles Peskine449bd832023-01-11 14:50:10 +0100422 if (rs_ctx != NULL && rs_ctx->det != NULL) {
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200423 /* redirect to our context */
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200424 p_rng = &rs_ctx->det->rng_ctx;
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200425
426 /* jump to current step */
Gilles Peskine449bd832023-01-11 14:50:10 +0100427 if (rs_ctx->det->state == ecdsa_det_sign) {
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200428 goto sign;
Gilles Peskine449bd832023-01-11 14:50:10 +0100429 }
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200430 }
431#endif /* MBEDTLS_ECP_RESTARTABLE */
432
Manuel Pégourié-Gonnardf42bca62014-01-06 15:05:01 +0100433 /* Use private key and message hash (reduced) to initialize HMAC_DRBG */
Gilles Peskine449bd832023-01-11 14:50:10 +0100434 MBEDTLS_MPI_CHK(mbedtls_mpi_write_binary(d, data, grp_len));
435 MBEDTLS_MPI_CHK(derive_mpi(grp, &h, buf, blen));
436 MBEDTLS_MPI_CHK(mbedtls_mpi_write_binary(&h, data + grp_len, grp_len));
Chien Wonge2caf412023-08-01 21:38:46 +0800437 MBEDTLS_MPI_CHK(mbedtls_hmac_drbg_seed_buf(p_rng, md_info, data, 2 * grp_len));
Manuel Pégourié-Gonnard4daaef72014-01-06 14:25:56 +0100438
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200439#if defined(MBEDTLS_ECP_RESTARTABLE)
Gilles Peskine449bd832023-01-11 14:50:10 +0100440 if (rs_ctx != NULL && rs_ctx->det != NULL) {
Manuel Pégourié-Gonnard63481812017-08-24 11:16:01 +0200441 rs_ctx->det->state = ecdsa_det_sign;
Gilles Peskine449bd832023-01-11 14:50:10 +0100442 }
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200443
444sign:
445#endif
Ron Eldor8493f802018-11-01 11:32:15 +0200446#if defined(MBEDTLS_ECDSA_SIGN_ALT)
Steven Cooreman6dce4bb2021-02-10 17:07:20 +0100447 (void) f_rng_blind;
448 (void) p_rng_blind;
Gilles Peskine449bd832023-01-11 14:50:10 +0100449 ret = mbedtls_ecdsa_sign(grp, r, s, d, buf, blen,
450 mbedtls_hmac_drbg_random, p_rng);
Ron Eldor8493f802018-11-01 11:32:15 +0200451#else
Paul Elliott2ba002c2022-12-09 18:59:26 +0000452 ret = mbedtls_ecdsa_sign_restartable(grp, r, s, d, buf, blen,
453 mbedtls_hmac_drbg_random, p_rng,
454 f_rng_blind, p_rng_blind, rs_ctx);
Ron Eldor936d2842018-11-01 13:05:52 +0200455#endif /* MBEDTLS_ECDSA_SIGN_ALT */
Manuel Pégourié-Gonnard4daaef72014-01-06 14:25:56 +0100456
457cleanup:
Gilles Peskine449bd832023-01-11 14:50:10 +0100458 mbedtls_hmac_drbg_free(&rng_ctx);
459 mbedtls_mpi_free(&h);
Manuel Pégourié-Gonnard4daaef72014-01-06 14:25:56 +0100460
Gilles Peskine449bd832023-01-11 14:50:10 +0100461 ECDSA_RS_LEAVE(det);
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200462
Gilles Peskine449bd832023-01-11 14:50:10 +0100463 return ret;
Manuel Pégourié-Gonnard4daaef72014-01-06 14:25:56 +0100464}
Manuel Pégourié-Gonnardaddb10e2017-04-21 12:54:46 +0200465
466/*
TRodziewicz18efb732021-04-29 23:12:19 +0200467 * Deterministic signature wrapper
Manuel Pégourié-Gonnardaddb10e2017-04-21 12:54:46 +0200468 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100469int mbedtls_ecdsa_sign_det_ext(mbedtls_ecp_group *grp, mbedtls_mpi *r,
470 mbedtls_mpi *s, const mbedtls_mpi *d,
471 const unsigned char *buf, size_t blen,
472 mbedtls_md_type_t md_alg,
473 int (*f_rng_blind)(void *, unsigned char *,
474 size_t),
475 void *p_rng_blind)
Janos Follathdca667a2019-01-04 14:32:30 +0000476{
Paul Elliott2ba002c2022-12-09 18:59:26 +0000477 return mbedtls_ecdsa_sign_det_restartable(grp, r, s, d, buf, blen, md_alg,
478 f_rng_blind, p_rng_blind, NULL);
Manuel Pégourié-Gonnardaddb10e2017-04-21 12:54:46 +0200479}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200480#endif /* MBEDTLS_ECDSA_DETERMINISTIC */
Paul Bakker9f3c7d72014-01-23 16:11:14 +0100481
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100482/*
483 * Verify ECDSA signature of hashed message (SEC1 4.1.4)
484 * Obviously, compared to SEC1 4.1.3, we skip step 2 (hash message)
485 */
Paul Elliott2ba002c2022-12-09 18:59:26 +0000486int mbedtls_ecdsa_verify_restartable(mbedtls_ecp_group *grp,
487 const unsigned char *buf, size_t blen,
488 const mbedtls_ecp_point *Q,
489 const mbedtls_mpi *r,
490 const mbedtls_mpi *s,
491 mbedtls_ecdsa_restart_ctx *rs_ctx)
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100492{
Janos Follath24eed8d2019-11-22 13:21:35 +0000493 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200494 mbedtls_mpi e, s_inv, u1, u2;
Manuel Pégourié-Gonnard56cc88a2015-05-11 18:40:45 +0200495 mbedtls_ecp_point R;
Manuel Pégourié-Gonnard5314f232017-04-21 12:36:59 +0200496 mbedtls_mpi *pu1 = &u1, *pu2 = &u2;
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100497
Gilles Peskine449bd832023-01-11 14:50:10 +0100498 mbedtls_ecp_point_init(&R);
499 mbedtls_mpi_init(&e); mbedtls_mpi_init(&s_inv);
500 mbedtls_mpi_init(&u1); mbedtls_mpi_init(&u2);
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100501
Manuel Pégourié-Gonnard97871ef2013-12-04 20:52:04 +0100502 /* Fail cleanly on curves such as Curve25519 that can't be used for ECDSA */
Gilles Peskine449bd832023-01-11 14:50:10 +0100503 if (!mbedtls_ecdsa_can_do(grp->id) || grp->N.p == NULL) {
504 return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
505 }
Manuel Pégourié-Gonnard97871ef2013-12-04 20:52:04 +0100506
Gilles Peskine449bd832023-01-11 14:50:10 +0100507 ECDSA_RS_ENTER(ver);
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200508
Manuel Pégourié-Gonnarda0c5bcc2017-04-21 11:33:57 +0200509#if defined(MBEDTLS_ECP_RESTARTABLE)
Gilles Peskine449bd832023-01-11 14:50:10 +0100510 if (rs_ctx != NULL && rs_ctx->ver != NULL) {
Manuel Pégourié-Gonnard5314f232017-04-21 12:36:59 +0200511 /* redirect to our context */
512 pu1 = &rs_ctx->ver->u1;
513 pu2 = &rs_ctx->ver->u2;
514
515 /* jump to current step */
Gilles Peskine449bd832023-01-11 14:50:10 +0100516 if (rs_ctx->ver->state == ecdsa_ver_muladd) {
Manuel Pégourié-Gonnard5314f232017-04-21 12:36:59 +0200517 goto muladd;
Gilles Peskine449bd832023-01-11 14:50:10 +0100518 }
Manuel Pégourié-Gonnard5314f232017-04-21 12:36:59 +0200519 }
Manuel Pégourié-Gonnarda0c5bcc2017-04-21 11:33:57 +0200520#endif /* MBEDTLS_ECP_RESTARTABLE */
521
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100522 /*
523 * Step 1: make sure r and s are in range 1..n-1
524 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100525 if (mbedtls_mpi_cmp_int(r, 1) < 0 || mbedtls_mpi_cmp_mpi(r, &grp->N) >= 0 ||
526 mbedtls_mpi_cmp_int(s, 1) < 0 || mbedtls_mpi_cmp_mpi(s, &grp->N) >= 0) {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200527 ret = MBEDTLS_ERR_ECP_VERIFY_FAILED;
Paul Bakkercca998a2013-07-26 14:20:53 +0200528 goto cleanup;
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100529 }
530
531 /*
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100532 * Step 3: derive MPI from hashed message
533 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100534 MBEDTLS_MPI_CHK(derive_mpi(grp, &e, buf, blen));
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100535
536 /*
537 * Step 4: u1 = e / s mod n, u2 = r / s mod n
538 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100539 ECDSA_BUDGET(MBEDTLS_ECP_OPS_CHK + MBEDTLS_ECP_OPS_INV + 2);
Manuel Pégourié-Gonnardbfa19722017-08-23 17:39:18 +0200540
Gilles Peskine449bd832023-01-11 14:50:10 +0100541 MBEDTLS_MPI_CHK(mbedtls_mpi_inv_mod(&s_inv, s, &grp->N));
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100542
Gilles Peskine449bd832023-01-11 14:50:10 +0100543 MBEDTLS_MPI_CHK(mbedtls_mpi_mul_mpi(pu1, &e, &s_inv));
544 MBEDTLS_MPI_CHK(mbedtls_mpi_mod_mpi(pu1, pu1, &grp->N));
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100545
Gilles Peskine449bd832023-01-11 14:50:10 +0100546 MBEDTLS_MPI_CHK(mbedtls_mpi_mul_mpi(pu2, r, &s_inv));
547 MBEDTLS_MPI_CHK(mbedtls_mpi_mod_mpi(pu2, pu2, &grp->N));
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100548
Manuel Pégourié-Gonnard5314f232017-04-21 12:36:59 +0200549#if defined(MBEDTLS_ECP_RESTARTABLE)
Gilles Peskine449bd832023-01-11 14:50:10 +0100550 if (rs_ctx != NULL && rs_ctx->ver != NULL) {
Manuel Pégourié-Gonnard63481812017-08-24 11:16:01 +0200551 rs_ctx->ver->state = ecdsa_ver_muladd;
Gilles Peskine449bd832023-01-11 14:50:10 +0100552 }
Manuel Pégourié-Gonnard5314f232017-04-21 12:36:59 +0200553
554muladd:
555#endif
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100556 /*
557 * Step 5: R = u1 G + u2 Q
558 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100559 MBEDTLS_MPI_CHK(mbedtls_ecp_muladd_restartable(grp,
560 &R, pu1, &grp->G, pu2, Q, ECDSA_RS_ECP));
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100561
Gilles Peskine449bd832023-01-11 14:50:10 +0100562 if (mbedtls_ecp_is_zero(&R)) {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200563 ret = MBEDTLS_ERR_ECP_VERIFY_FAILED;
Paul Bakkercca998a2013-07-26 14:20:53 +0200564 goto cleanup;
565 }
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100566
567 /*
Manuel Pégourié-Gonnard178d9ba2013-10-29 10:45:28 +0100568 * Step 6: convert xR to an integer (no-op)
569 * Step 7: reduce xR mod n (gives v)
570 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100571 MBEDTLS_MPI_CHK(mbedtls_mpi_mod_mpi(&R.X, &R.X, &grp->N));
Manuel Pégourié-Gonnard178d9ba2013-10-29 10:45:28 +0100572
573 /*
574 * Step 8: check if v (that is, R.X) is equal to r
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100575 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100576 if (mbedtls_mpi_cmp_mpi(&R.X, r) != 0) {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200577 ret = MBEDTLS_ERR_ECP_VERIFY_FAILED;
Paul Bakkercca998a2013-07-26 14:20:53 +0200578 goto cleanup;
579 }
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100580
581cleanup:
Gilles Peskine449bd832023-01-11 14:50:10 +0100582 mbedtls_ecp_point_free(&R);
583 mbedtls_mpi_free(&e); mbedtls_mpi_free(&s_inv);
584 mbedtls_mpi_free(&u1); mbedtls_mpi_free(&u2);
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100585
Gilles Peskine449bd832023-01-11 14:50:10 +0100586 ECDSA_RS_LEAVE(ver);
Manuel Pégourié-Gonnarda0c5bcc2017-04-21 11:33:57 +0200587
Gilles Peskine449bd832023-01-11 14:50:10 +0100588 return ret;
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100589}
590
Manuel Pégourié-Gonnard7c8934e2013-06-27 12:54:02 +0200591/*
Manuel Pégourié-Gonnard32aa4372017-04-21 10:29:13 +0200592 * Verify ECDSA signature of hashed message
593 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100594int mbedtls_ecdsa_verify(mbedtls_ecp_group *grp,
595 const unsigned char *buf, size_t blen,
596 const mbedtls_ecp_point *Q,
597 const mbedtls_mpi *r,
598 const mbedtls_mpi *s)
Manuel Pégourié-Gonnard32aa4372017-04-21 10:29:13 +0200599{
Paul Elliott2ba002c2022-12-09 18:59:26 +0000600 return mbedtls_ecdsa_verify_restartable(grp, buf, blen, Q, r, s, NULL);
Manuel Pégourié-Gonnard32aa4372017-04-21 10:29:13 +0200601}
602
603/*
Manuel Pégourié-Gonnard937340b2014-01-06 10:27:16 +0100604 * Convert a signature (given by context) to ASN.1
Manuel Pégourié-Gonnardb694b482013-08-08 13:30:57 +0200605 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100606static int ecdsa_signature_to_asn1(const mbedtls_mpi *r, const mbedtls_mpi *s,
607 unsigned char *sig, size_t sig_size,
608 size_t *slen)
Manuel Pégourié-Gonnardb694b482013-08-08 13:30:57 +0200609{
Janos Follath24eed8d2019-11-22 13:21:35 +0000610 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskine449bd832023-01-11 14:50:10 +0100611 unsigned char buf[MBEDTLS_ECDSA_MAX_LEN] = { 0 };
612 unsigned char *p = buf + sizeof(buf);
Manuel Pégourié-Gonnardb694b482013-08-08 13:30:57 +0200613 size_t len = 0;
614
Gilles Peskine449bd832023-01-11 14:50:10 +0100615 MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_mpi(&p, buf, s));
616 MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_mpi(&p, buf, r));
Manuel Pégourié-Gonnardb694b482013-08-08 13:30:57 +0200617
Gilles Peskine449bd832023-01-11 14:50:10 +0100618 MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_len(&p, buf, len));
619 MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_tag(&p, buf,
620 MBEDTLS_ASN1_CONSTRUCTED |
621 MBEDTLS_ASN1_SEQUENCE));
Manuel Pégourié-Gonnardb694b482013-08-08 13:30:57 +0200622
Gilles Peskine449bd832023-01-11 14:50:10 +0100623 if (len > sig_size) {
624 return MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL;
625 }
Gilles Peskinef00f1522021-06-22 00:09:00 +0200626
Gilles Peskine449bd832023-01-11 14:50:10 +0100627 memcpy(sig, p, len);
Manuel Pégourié-Gonnardb694b482013-08-08 13:30:57 +0200628 *slen = len;
629
Gilles Peskine449bd832023-01-11 14:50:10 +0100630 return 0;
Manuel Pégourié-Gonnardb694b482013-08-08 13:30:57 +0200631}
632
633/*
Manuel Pégourié-Gonnard937340b2014-01-06 10:27:16 +0100634 * Compute and write signature
635 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100636int mbedtls_ecdsa_write_signature_restartable(mbedtls_ecdsa_context *ctx,
637 mbedtls_md_type_t md_alg,
638 const unsigned char *hash, size_t hlen,
639 unsigned char *sig, size_t sig_size, size_t *slen,
640 int (*f_rng)(void *, unsigned char *, size_t),
641 void *p_rng,
642 mbedtls_ecdsa_restart_ctx *rs_ctx)
Manuel Pégourié-Gonnard937340b2014-01-06 10:27:16 +0100643{
Janos Follath24eed8d2019-11-22 13:21:35 +0000644 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200645 mbedtls_mpi r, s;
Gilles Peskine449bd832023-01-11 14:50:10 +0100646 if (f_rng == NULL) {
647 return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
648 }
Manuel Pégourié-Gonnard8fce9372015-03-31 13:06:41 +0200649
Gilles Peskine449bd832023-01-11 14:50:10 +0100650 mbedtls_mpi_init(&r);
651 mbedtls_mpi_init(&s);
Manuel Pégourié-Gonnard937340b2014-01-06 10:27:16 +0100652
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200653#if defined(MBEDTLS_ECDSA_DETERMINISTIC)
Paul Elliott2ba002c2022-12-09 18:59:26 +0000654 MBEDTLS_MPI_CHK(mbedtls_ecdsa_sign_det_restartable(&ctx->grp, &r, &s, &ctx->d,
655 hash, hlen, md_alg, f_rng,
656 p_rng, rs_ctx));
Manuel Pégourié-Gonnarddfdcac92015-03-31 11:41:42 +0200657#else
658 (void) md_alg;
659
Ron Eldor8493f802018-11-01 11:32:15 +0200660#if defined(MBEDTLS_ECDSA_SIGN_ALT)
Steven Cooremanfa6641b2021-01-11 17:11:39 +0100661 (void) rs_ctx;
662
Gilles Peskine449bd832023-01-11 14:50:10 +0100663 MBEDTLS_MPI_CHK(mbedtls_ecdsa_sign(&ctx->grp, &r, &s, &ctx->d,
664 hash, hlen, f_rng, p_rng));
Ron Eldor8493f802018-11-01 11:32:15 +0200665#else
Janos Follathdca667a2019-01-04 14:32:30 +0000666 /* Use the same RNG for both blinding and ephemeral key generation */
Paul Elliott2ba002c2022-12-09 18:59:26 +0000667 MBEDTLS_MPI_CHK(mbedtls_ecdsa_sign_restartable(&ctx->grp, &r, &s, &ctx->d,
668 hash, hlen, f_rng, p_rng, f_rng,
669 p_rng, rs_ctx));
Ron Eldor936d2842018-11-01 13:05:52 +0200670#endif /* MBEDTLS_ECDSA_SIGN_ALT */
Ron Eldor5ed8c1e2018-11-05 14:04:26 +0200671#endif /* MBEDTLS_ECDSA_DETERMINISTIC */
Manuel Pégourié-Gonnard937340b2014-01-06 10:27:16 +0100672
Gilles Peskine449bd832023-01-11 14:50:10 +0100673 MBEDTLS_MPI_CHK(ecdsa_signature_to_asn1(&r, &s, sig, sig_size, slen));
Manuel Pégourié-Gonnard8fce9372015-03-31 13:06:41 +0200674
675cleanup:
Gilles Peskine449bd832023-01-11 14:50:10 +0100676 mbedtls_mpi_free(&r);
677 mbedtls_mpi_free(&s);
Manuel Pégourié-Gonnard8fce9372015-03-31 13:06:41 +0200678
Gilles Peskine449bd832023-01-11 14:50:10 +0100679 return ret;
Manuel Pégourié-Gonnard937340b2014-01-06 10:27:16 +0100680}
681
Manuel Pégourié-Gonnardaddb10e2017-04-21 12:54:46 +0200682/*
683 * Compute and write signature
684 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100685int mbedtls_ecdsa_write_signature(mbedtls_ecdsa_context *ctx,
686 mbedtls_md_type_t md_alg,
687 const unsigned char *hash, size_t hlen,
688 unsigned char *sig, size_t sig_size, size_t *slen,
689 int (*f_rng)(void *, unsigned char *, size_t),
690 void *p_rng)
Manuel Pégourié-Gonnardaddb10e2017-04-21 12:54:46 +0200691{
Gilles Peskine449bd832023-01-11 14:50:10 +0100692 return mbedtls_ecdsa_write_signature_restartable(
693 ctx, md_alg, hash, hlen, sig, sig_size, slen,
694 f_rng, p_rng, NULL);
Manuel Pégourié-Gonnardaddb10e2017-04-21 12:54:46 +0200695}
696
Manuel Pégourié-Gonnard937340b2014-01-06 10:27:16 +0100697/*
Manuel Pégourié-Gonnardb694b482013-08-08 13:30:57 +0200698 * Read and check signature
699 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100700int mbedtls_ecdsa_read_signature(mbedtls_ecdsa_context *ctx,
701 const unsigned char *hash, size_t hlen,
702 const unsigned char *sig, size_t slen)
Manuel Pégourié-Gonnardb694b482013-08-08 13:30:57 +0200703{
Gilles Peskine449bd832023-01-11 14:50:10 +0100704 return mbedtls_ecdsa_read_signature_restartable(
705 ctx, hash, hlen, sig, slen, NULL);
Manuel Pégourié-Gonnard32aa4372017-04-21 10:29:13 +0200706}
707
708/*
709 * Restartable read and check signature
710 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100711int mbedtls_ecdsa_read_signature_restartable(mbedtls_ecdsa_context *ctx,
712 const unsigned char *hash, size_t hlen,
713 const unsigned char *sig, size_t slen,
714 mbedtls_ecdsa_restart_ctx *rs_ctx)
Manuel Pégourié-Gonnard32aa4372017-04-21 10:29:13 +0200715{
Janos Follath24eed8d2019-11-22 13:21:35 +0000716 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnardb694b482013-08-08 13:30:57 +0200717 unsigned char *p = (unsigned char *) sig;
718 const unsigned char *end = sig + slen;
719 size_t len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200720 mbedtls_mpi r, s;
Gilles Peskine449bd832023-01-11 14:50:10 +0100721 mbedtls_mpi_init(&r);
722 mbedtls_mpi_init(&s);
Manuel Pégourié-Gonnardb694b482013-08-08 13:30:57 +0200723
Gilles Peskine449bd832023-01-11 14:50:10 +0100724 if ((ret = mbedtls_asn1_get_tag(&p, end, &len,
725 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200726 ret += MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
Manuel Pégourié-Gonnard8fce9372015-03-31 13:06:41 +0200727 goto cleanup;
Manuel Pégourié-Gonnardb694b482013-08-08 13:30:57 +0200728 }
729
Gilles Peskine449bd832023-01-11 14:50:10 +0100730 if (p + len != end) {
731 ret = MBEDTLS_ERROR_ADD(MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
732 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
Manuel Pégourié-Gonnard8fce9372015-03-31 13:06:41 +0200733 goto cleanup;
734 }
Manuel Pégourié-Gonnardb694b482013-08-08 13:30:57 +0200735
Gilles Peskine449bd832023-01-11 14:50:10 +0100736 if ((ret = mbedtls_asn1_get_mpi(&p, end, &r)) != 0 ||
737 (ret = mbedtls_asn1_get_mpi(&p, end, &s)) != 0) {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200738 ret += MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
Manuel Pégourié-Gonnard8fce9372015-03-31 13:06:41 +0200739 goto cleanup;
740 }
Steven Cooremanfa6641b2021-01-11 17:11:39 +0100741
Paul Elliott2ba002c2022-12-09 18:59:26 +0000742 if ((ret = mbedtls_ecdsa_verify_restartable(&ctx->grp, hash, hlen,
743 &ctx->Q, &r, &s, rs_ctx)) != 0) {
Manuel Pégourié-Gonnard8fce9372015-03-31 13:06:41 +0200744 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +0100745 }
Manuel Pégourié-Gonnardb694b482013-08-08 13:30:57 +0200746
Gilles Peskine5114d3e2018-03-30 07:12:15 +0200747 /* At this point we know that the buffer starts with a valid signature.
748 * Return 0 if the buffer just contains the signature, and a specific
749 * error code if the valid signature is followed by more data. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100750 if (p != end) {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200751 ret = MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH;
Gilles Peskine449bd832023-01-11 14:50:10 +0100752 }
Manuel Pégourié-Gonnard35e95dd2014-04-08 12:17:41 +0200753
Manuel Pégourié-Gonnard8fce9372015-03-31 13:06:41 +0200754cleanup:
Gilles Peskine449bd832023-01-11 14:50:10 +0100755 mbedtls_mpi_free(&r);
756 mbedtls_mpi_free(&s);
Manuel Pégourié-Gonnard8fce9372015-03-31 13:06:41 +0200757
Gilles Peskine449bd832023-01-11 14:50:10 +0100758 return ret;
Manuel Pégourié-Gonnardb694b482013-08-08 13:30:57 +0200759}
760
Ron Eldor314adb62017-10-10 18:28:25 +0300761#if !defined(MBEDTLS_ECDSA_GENKEY_ALT)
Manuel Pégourié-Gonnardb694b482013-08-08 13:30:57 +0200762/*
Manuel Pégourié-Gonnard8eebd012013-08-09 16:21:34 +0200763 * Generate key pair
764 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100765int mbedtls_ecdsa_genkey(mbedtls_ecdsa_context *ctx, mbedtls_ecp_group_id gid,
766 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng)
Manuel Pégourié-Gonnard8eebd012013-08-09 16:21:34 +0200767{
Ron Eldoradb52342018-12-17 10:06:12 +0200768 int ret = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +0100769 ret = mbedtls_ecp_group_load(&ctx->grp, gid);
770 if (ret != 0) {
771 return ret;
772 }
Ron Eldoradb52342018-12-17 10:06:12 +0200773
Gilles Peskine449bd832023-01-11 14:50:10 +0100774 return mbedtls_ecp_gen_keypair(&ctx->grp, &ctx->d,
775 &ctx->Q, f_rng, p_rng);
Manuel Pégourié-Gonnard8eebd012013-08-09 16:21:34 +0200776}
Ron Eldor936d2842018-11-01 13:05:52 +0200777#endif /* !MBEDTLS_ECDSA_GENKEY_ALT */
Manuel Pégourié-Gonnard8eebd012013-08-09 16:21:34 +0200778
Manuel Pégourié-Gonnardf4999932013-08-12 17:02:59 +0200779/*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200780 * Set context from an mbedtls_ecp_keypair
Manuel Pégourié-Gonnardf4999932013-08-12 17:02:59 +0200781 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100782int mbedtls_ecdsa_from_keypair(mbedtls_ecdsa_context *ctx, const mbedtls_ecp_keypair *key)
Manuel Pégourié-Gonnardf4999932013-08-12 17:02:59 +0200783{
Janos Follath24eed8d2019-11-22 13:21:35 +0000784 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskine449bd832023-01-11 14:50:10 +0100785 if ((ret = mbedtls_ecp_group_copy(&ctx->grp, &key->grp)) != 0 ||
786 (ret = mbedtls_mpi_copy(&ctx->d, &key->d)) != 0 ||
787 (ret = mbedtls_ecp_copy(&ctx->Q, &key->Q)) != 0) {
788 mbedtls_ecdsa_free(ctx);
Manuel Pégourié-Gonnard1001e322013-10-27 14:53:48 +0100789 }
Manuel Pégourié-Gonnardf4999932013-08-12 17:02:59 +0200790
Gilles Peskine449bd832023-01-11 14:50:10 +0100791 return ret;
Manuel Pégourié-Gonnardf4999932013-08-12 17:02:59 +0200792}
Manuel Pégourié-Gonnard8eebd012013-08-09 16:21:34 +0200793
794/*
Manuel Pégourié-Gonnard7c8934e2013-06-27 12:54:02 +0200795 * Initialize context
796 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100797void mbedtls_ecdsa_init(mbedtls_ecdsa_context *ctx)
Manuel Pégourié-Gonnard7c8934e2013-06-27 12:54:02 +0200798{
Gilles Peskine449bd832023-01-11 14:50:10 +0100799 mbedtls_ecp_keypair_init(ctx);
Manuel Pégourié-Gonnard7c8934e2013-06-27 12:54:02 +0200800}
801
802/*
803 * Free context
804 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100805void mbedtls_ecdsa_free(mbedtls_ecdsa_context *ctx)
Manuel Pégourié-Gonnard7c8934e2013-06-27 12:54:02 +0200806{
Gilles Peskine449bd832023-01-11 14:50:10 +0100807 if (ctx == NULL) {
Hanno Becker319ae112018-12-14 16:43:29 +0000808 return;
Gilles Peskine449bd832023-01-11 14:50:10 +0100809 }
Hanno Becker319ae112018-12-14 16:43:29 +0000810
Gilles Peskine449bd832023-01-11 14:50:10 +0100811 mbedtls_ecp_keypair_free(ctx);
Manuel Pégourié-Gonnard7c8934e2013-06-27 12:54:02 +0200812}
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100813
Manuel Pégourié-Gonnard32aa4372017-04-21 10:29:13 +0200814#if defined(MBEDTLS_ECP_RESTARTABLE)
815/*
816 * Initialize a restart context
817 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100818void mbedtls_ecdsa_restart_init(mbedtls_ecdsa_restart_ctx *ctx)
Manuel Pégourié-Gonnard32aa4372017-04-21 10:29:13 +0200819{
Gilles Peskine449bd832023-01-11 14:50:10 +0100820 mbedtls_ecp_restart_init(&ctx->ecp);
Manuel Pégourié-Gonnarda0c5bcc2017-04-21 11:33:57 +0200821
822 ctx->ver = NULL;
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200823 ctx->sig = NULL;
824#if defined(MBEDTLS_ECDSA_DETERMINISTIC)
825 ctx->det = NULL;
826#endif
Manuel Pégourié-Gonnard32aa4372017-04-21 10:29:13 +0200827}
828
829/*
830 * Free the components of a restart context
831 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100832void mbedtls_ecdsa_restart_free(mbedtls_ecdsa_restart_ctx *ctx)
Manuel Pégourié-Gonnard32aa4372017-04-21 10:29:13 +0200833{
Gilles Peskine449bd832023-01-11 14:50:10 +0100834 if (ctx == NULL) {
Hanno Becker319ae112018-12-14 16:43:29 +0000835 return;
Gilles Peskine449bd832023-01-11 14:50:10 +0100836 }
Hanno Becker319ae112018-12-14 16:43:29 +0000837
Gilles Peskine449bd832023-01-11 14:50:10 +0100838 mbedtls_ecp_restart_free(&ctx->ecp);
Manuel Pégourié-Gonnarda0c5bcc2017-04-21 11:33:57 +0200839
Gilles Peskine449bd832023-01-11 14:50:10 +0100840 ecdsa_restart_ver_free(ctx->ver);
841 mbedtls_free(ctx->ver);
Manuel Pégourié-Gonnarda0c5bcc2017-04-21 11:33:57 +0200842 ctx->ver = NULL;
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200843
Gilles Peskine449bd832023-01-11 14:50:10 +0100844 ecdsa_restart_sig_free(ctx->sig);
845 mbedtls_free(ctx->sig);
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200846 ctx->sig = NULL;
847
848#if defined(MBEDTLS_ECDSA_DETERMINISTIC)
Gilles Peskine449bd832023-01-11 14:50:10 +0100849 ecdsa_restart_det_free(ctx->det);
850 mbedtls_free(ctx->det);
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200851 ctx->det = NULL;
852#endif
Manuel Pégourié-Gonnard32aa4372017-04-21 10:29:13 +0200853}
854#endif /* MBEDTLS_ECP_RESTARTABLE */
855
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200856#endif /* MBEDTLS_ECDSA_C */