commit 50b63ba2f588910123f4366c5145435ea9df3c9c
author Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com> Tue Apr 25 12:57:22 2017 +0200
committer Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com> Wed Aug 09 11:44:53 2017 +0200
tree 003f1350b46b05f8ece3b53597c5fe846dd7787b
parent 675439620d3029c313e0a804e0ae1e24d6ef376a

Use ecp_gen_privkey() in ECDSA sign

Two different changes:

- the first one will allow us to store k in the restart context while
  restarting the following ecp_mul() operation

- the second one is an simplification, unrelated to restartability, made
  possible by the fact that ecp_gen_privkey() is now public

library/ecdsa.c

diff --git a/library/ecdsa.c b/library/ecdsa.c
index 14854ff..b8aef5d 100644
--- a/library/ecdsa.c
+++ b/library/ecdsa.c
@@ -225,7 +225,7 @@
                 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng,
                 mbedtls_ecdsa_restart_ctx *rs_ctx )
 {
-    int ret, key_tries, sign_tries, blind_tries;
+    int ret, key_tries, sign_tries;
     mbedtls_ecp_point R;
     mbedtls_mpi k, e, t;
 
@@ -271,7 +271,10 @@
                 goto cleanup;
             }
 
-            MBEDTLS_MPI_CHK( mbedtls_ecp_gen_keypair( grp, &k, &R, f_rng, p_rng ) );
+            MBEDTLS_MPI_CHK( mbedtls_ecp_gen_privkey( grp, &k, f_rng, p_rng ) );
+
+            MBEDTLS_MPI_CHK( mbedtls_ecp_mul( grp, &R, &k, &grp->G,
+                                              f_rng, p_rng ) );
             MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( r, &R.X, &grp->N ) );
         }
         while( mbedtls_mpi_cmp_int( r, 0 ) == 0 );
@@ -285,19 +288,7 @@
          * Generate a random value to blind inv_mod in next step,
          * avoiding a potential timing leak.
          */
-        blind_tries = 0;
-        do
-        {
-            size_t n_size = ( grp->nbits + 7 ) / 8;
-            MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &t, n_size, f_rng, p_rng ) );
-            MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &t, 8 * n_size - grp->nbits ) );
-
-            /* See mbedtls_ecp_gen_keypair() */
-            if( ++blind_tries > 30 )
-                return( MBEDTLS_ERR_ECP_RANDOM_FAILED );
-        }
-        while( mbedtls_mpi_cmp_int( &t, 1 ) < 0 ||
-               mbedtls_mpi_cmp_mpi( &t, &grp->N ) >= 0 );
+        MBEDTLS_MPI_CHK( mbedtls_ecp_gen_privkey( grp, &t, f_rng, p_rng ) );
 
         /*
          * Step 6: compute s = (e + r * d) / k = t (e + rd) / (kt) mod n