mbedtls_ecp_gen_privkey_sw: generalize to mbedtls_mpi_random
Rename mbedtls_ecp_gen_privkey_sw to mbedtls_mpi_random since it has
no particular connection to elliptic curves beyond the fact that its
operation is defined by the deterministic ECDSA specification. This is
a generic function that generates a random MPI between 1 inclusive and
N exclusive.
Slightly generalize the function to accept a different lower bound,
which adds a negligible amount of complexity.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
diff --git a/library/ecp.c b/library/ecp.c
index 983a67f..1447a5a 100644
--- a/library/ecp.c
+++ b/library/ecp.c
@@ -3076,15 +3076,17 @@
#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
MBEDTLS_STATIC_TESTABLE
-int mbedtls_ecp_gen_privkey_sw( const mbedtls_mpi *N, size_t n_bits,
- mbedtls_mpi *d,
- int (*f_rng)(void *, unsigned char *, size_t),
- void *p_rng )
+int mbedtls_mpi_random( mbedtls_mpi *X,
+ mbedtls_mpi_sint min,
+ const mbedtls_mpi *N,
+ int (*f_rng)(void *, unsigned char *, size_t),
+ void *p_rng )
{
- /* SEC1 3.2.1: Generate d such that 1 <= n < N */
- int ret = MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
+ /* SEC1 3.2.1: Generate X such that 1 <= n < N */
+ int ret = MBEDTLS_ERR_MPI_BAD_INPUT_DATA;
int count = 0;
unsigned cmp = 0;
+ size_t n_bits = mbedtls_mpi_bitlen( N );
size_t n_bytes = ( n_bits + 7 ) / 8;
/*
@@ -3097,8 +3099,8 @@
*/
do
{
- MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( d, n_bytes, f_rng, p_rng ) );
- MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( d, 8 * n_bytes - n_bits ) );
+ MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( X, n_bytes, f_rng, p_rng ) );
+ MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( X, 8 * n_bytes - n_bits ) );
/*
* Each try has at worst a probability 1/2 of failing (the msb has
@@ -3111,17 +3113,17 @@
*/
if( ++count > 30 )
{
- ret = MBEDTLS_ERR_ECP_RANDOM_FAILED;
+ ret = MBEDTLS_ERR_MPI_NOT_ACCEPTABLE;
goto cleanup;
}
- ret = mbedtls_mpi_lt_mpi_ct( d, N, &cmp );
+ ret = mbedtls_mpi_lt_mpi_ct( X, N, &cmp );
if( ret != 0 )
{
goto cleanup;
}
}
- while( mbedtls_mpi_cmp_int( d, 1 ) < 0 || cmp != 1 );
+ while( mbedtls_mpi_cmp_int( X, min ) < 0 || cmp != 1 );
cleanup:
return( ret );
@@ -3147,8 +3149,7 @@
#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS )
- return( mbedtls_ecp_gen_privkey_sw( &grp->N, grp->nbits, d,
- f_rng, p_rng ) );
+ return( mbedtls_mpi_random( d, 1, &grp->N, f_rng, p_rng ) );
#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
diff --git a/library/ecp_invasive.h b/library/ecp_invasive.h
index eeb4305..1ca65fd 100644
--- a/library/ecp_invasive.h
+++ b/library/ecp_invasive.h
@@ -77,25 +77,36 @@
#endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */
#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
-/** Generate a private key on a short Weierstrass curve.
+/** Generate a random number uniformly in a range.
+ *
+ * This function generates a random number between \p min inclusive and
+ * \p N exclusive.
*
* The procedure complies with RFC 6979 §3.3 (deterministic ECDSA)
- * when the RNG is a suitably parametrized instance of HMAC_DRBG.
+ * when the RNG is a suitably parametrized instance of HMAC_DRBG
+ * and \p min is \c 1.
*
- * \p N The upper bound of the range.
- * \p n_bits The size of \p N in bits. This value must be correct,
- * otherwise the result is unpredictable.
- * \param d A random number, uniformly generated in the range [1, N-1].
- * \param f_rng The RNG function.
- * \param p_rng The RNG context to be passed to \p f_rng.
+ * \note There are `N - min` possible outputs. The lower bound
+ * \p min can be reached, but the upper bound \p N cannot.
*
- * \return \c 0 on success.
- * \return \c MBEDTLS_ERR_ECP_xxx or MBEDTLS_ERR_MPI_xxx on failure.
+ * \param X The destination MPI. This must point to an initialized MPI.
+ * \param min The minimum value to return.
+ * It must be nonnegative.
+ * \param N The upper bound of the range, exclusive.
+ * In other words, this is one plus the maximum value to return.
+ * \p N must be strictly larger than \p min.
+ * \param f_rng The RNG function to use. This must not be \c NULL.
+ * \param p_rng The RNG parameter to be passed to \p f_rng.
+ *
+ * \return \c 0 if successful.
+ * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed.
+ * \return Another negative error code on failure.
*/
-int mbedtls_ecp_gen_privkey_sw( const mbedtls_mpi *N, size_t n_bits,
- mbedtls_mpi *d,
- int (*f_rng)(void *, unsigned char *, size_t),
- void *p_rng );
+int mbedtls_mpi_random( mbedtls_mpi *X,
+ mbedtls_mpi_sint min,
+ const mbedtls_mpi *N,
+ int (*f_rng)(void *, unsigned char *, size_t),
+ void *p_rng );
#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
#endif /* MBEDTLS_TEST_HOOKS && MBEDTLS_ECP_C */