blob: dfdd0b46be4c46737ecd54806b00ce32b5819e7d [file] [log] [blame]
Manuel Pégourié-Gonnard2aea1412013-01-26 16:33:44 +01001/*
2 * Elliptic curve DSA
3 *
Bence Szépkúti1e148272020-08-07 13:07:28 +02004 * Copyright The Mbed TLS Contributors
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +02005 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
Manuel Pégourié-Gonnard2aea1412013-01-26 16:33:44 +010018 */
19
20/*
21 * References:
22 *
23 * SEC1 http://www.secg.org/index.php?action=secg,docs_secg
24 */
25
Gilles Peskinedb09ef62020-06-03 01:43:33 +020026#include "common.h"
Manuel Pégourié-Gonnard2aea1412013-01-26 16:33:44 +010027
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020028#if defined(MBEDTLS_ECDSA_C)
Manuel Pégourié-Gonnard2aea1412013-01-26 16:33:44 +010029
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000030#include "mbedtls/ecdsa.h"
31#include "mbedtls/asn1write.h"
Manuel Pégourié-Gonnard2aea1412013-01-26 16:33:44 +010032
Rich Evans00ab4702015-02-06 13:43:58 +000033#include <string.h>
34
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020035#if defined(MBEDTLS_ECDSA_DETERMINISTIC)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000036#include "mbedtls/hmac_drbg.h"
Manuel Pégourié-Gonnard7845fc02014-01-27 14:24:03 +010037#endif
Manuel Pégourié-Gonnard461d4162014-01-06 10:16:28 +010038
Manuel Pégourié-Gonnarda0c5bcc2017-04-21 11:33:57 +020039#if defined(MBEDTLS_PLATFORM_C)
40#include "mbedtls/platform.h"
41#else
42#include <stdlib.h>
43#define mbedtls_calloc calloc
44#define mbedtls_free free
45#endif
46
Hanno Becker319ae112018-12-14 16:43:29 +000047#include "mbedtls/platform_util.h"
Janos Follath24eed8d2019-11-22 13:21:35 +000048#include "mbedtls/error.h"
Hanno Becker319ae112018-12-14 16:43:29 +000049
50/* Parameter validation macros based on platform_util.h */
51#define ECDSA_VALIDATE_RET( cond ) \
52 MBEDTLS_INTERNAL_VALIDATE_RET( cond, MBEDTLS_ERR_ECP_BAD_INPUT_DATA )
53#define ECDSA_VALIDATE( cond ) \
54 MBEDTLS_INTERNAL_VALIDATE( cond )
55
Manuel Pégourié-Gonnarda0c5bcc2017-04-21 11:33:57 +020056#if defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnard5314f232017-04-21 12:36:59 +020057
Manuel Pégourié-Gonnarda0c5bcc2017-04-21 11:33:57 +020058/*
Manuel Pégourié-Gonnarda4dd7832017-09-07 11:11:39 +020059 * Sub-context for ecdsa_verify()
Manuel Pégourié-Gonnarda0c5bcc2017-04-21 11:33:57 +020060 */
61struct mbedtls_ecdsa_restart_ver
62{
Manuel Pégourié-Gonnard5314f232017-04-21 12:36:59 +020063 mbedtls_mpi u1, u2; /* intermediate values */
64 enum { /* what to do next? */
65 ecdsa_ver_init = 0, /* getting started */
66 ecdsa_ver_muladd, /* muladd step */
67 } state;
Manuel Pégourié-Gonnarda0c5bcc2017-04-21 11:33:57 +020068};
69
70/*
71 * Init verify restart sub-context
72 */
73static void ecdsa_restart_ver_init( mbedtls_ecdsa_restart_ver_ctx *ctx )
74{
Manuel Pégourié-Gonnard5bd38b12017-08-23 16:55:59 +020075 mbedtls_mpi_init( &ctx->u1 );
76 mbedtls_mpi_init( &ctx->u2 );
77 ctx->state = ecdsa_ver_init;
Manuel Pégourié-Gonnarda0c5bcc2017-04-21 11:33:57 +020078}
79
80/*
81 * Free the components of a verify restart sub-context
82 */
83static void ecdsa_restart_ver_free( mbedtls_ecdsa_restart_ver_ctx *ctx )
84{
85 if( ctx == NULL )
86 return;
87
Manuel Pégourié-Gonnard5314f232017-04-21 12:36:59 +020088 mbedtls_mpi_free( &ctx->u1 );
89 mbedtls_mpi_free( &ctx->u2 );
90
Manuel Pégourié-Gonnard5bd38b12017-08-23 16:55:59 +020091 ecdsa_restart_ver_init( ctx );
Manuel Pégourié-Gonnarda0c5bcc2017-04-21 11:33:57 +020092}
93
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +020094/*
Manuel Pégourié-Gonnarda4dd7832017-09-07 11:11:39 +020095 * Sub-context for ecdsa_sign()
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +020096 */
97struct mbedtls_ecdsa_restart_sig
98{
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +020099 int sign_tries;
100 int key_tries;
101 mbedtls_mpi k; /* per-signature random */
102 mbedtls_mpi r; /* r value */
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200103 enum { /* what to do next? */
104 ecdsa_sig_init = 0, /* getting started */
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200105 ecdsa_sig_mul, /* doing ecp_mul() */
106 ecdsa_sig_modn, /* mod N computations */
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200107 } state;
108};
109
110/*
111 * Init verify sign sub-context
112 */
113static void ecdsa_restart_sig_init( mbedtls_ecdsa_restart_sig_ctx *ctx )
114{
Manuel Pégourié-Gonnard5bd38b12017-08-23 16:55:59 +0200115 ctx->sign_tries = 0;
116 ctx->key_tries = 0;
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200117 mbedtls_mpi_init( &ctx->k );
118 mbedtls_mpi_init( &ctx->r );
Manuel Pégourié-Gonnard5bd38b12017-08-23 16:55:59 +0200119 ctx->state = ecdsa_sig_init;
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200120}
121
122/*
123 * Free the components of a sign restart sub-context
124 */
125static void ecdsa_restart_sig_free( mbedtls_ecdsa_restart_sig_ctx *ctx )
126{
127 if( ctx == NULL )
128 return;
129
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200130 mbedtls_mpi_free( &ctx->k );
131 mbedtls_mpi_free( &ctx->r );
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200132}
133
134#if defined(MBEDTLS_ECDSA_DETERMINISTIC)
135/*
Manuel Pégourié-Gonnarda4dd7832017-09-07 11:11:39 +0200136 * Sub-context for ecdsa_sign_det()
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200137 */
138struct mbedtls_ecdsa_restart_det
139{
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200140 mbedtls_hmac_drbg_context rng_ctx; /* DRBG state */
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200141 enum { /* what to do next? */
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200142 ecdsa_det_init = 0, /* getting started */
143 ecdsa_det_sign, /* make signature */
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200144 } state;
145};
146
147/*
148 * Init verify sign_det sub-context
149 */
150static void ecdsa_restart_det_init( mbedtls_ecdsa_restart_det_ctx *ctx )
151{
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200152 mbedtls_hmac_drbg_init( &ctx->rng_ctx );
Manuel Pégourié-Gonnard5bd38b12017-08-23 16:55:59 +0200153 ctx->state = ecdsa_det_init;
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200154}
155
156/*
157 * Free the components of a sign_det restart sub-context
158 */
159static void ecdsa_restart_det_free( mbedtls_ecdsa_restart_det_ctx *ctx )
160{
161 if( ctx == NULL )
162 return;
163
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200164 mbedtls_hmac_drbg_free( &ctx->rng_ctx );
165
Manuel Pégourié-Gonnard5bd38b12017-08-23 16:55:59 +0200166 ecdsa_restart_det_init( ctx );
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200167}
168#endif /* MBEDTLS_ECDSA_DETERMINISTIC */
169
Hanno Becker59c92ed2019-07-19 12:42:21 +0100170#define ECDSA_RS_ECP ( rs_ctx == NULL ? NULL : &rs_ctx->ecp )
Manuel Pégourié-Gonnarda0c5bcc2017-04-21 11:33:57 +0200171
Manuel Pégourié-Gonnard5314f232017-04-21 12:36:59 +0200172/* Utility macro for checking and updating ops budget */
173#define ECDSA_BUDGET( ops ) \
Hanno Becker59c92ed2019-07-19 12:42:21 +0100174 MBEDTLS_MPI_CHK( mbedtls_ecp_check_budget( grp, ECDSA_RS_ECP, ops ) );
Manuel Pégourié-Gonnard5314f232017-04-21 12:36:59 +0200175
Manuel Pégourié-Gonnardb948f7d2017-08-23 17:58:40 +0200176/* Call this when entering a function that needs its own sub-context */
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200177#define ECDSA_RS_ENTER( SUB ) do { \
178 /* reset ops count for this call if top-level */ \
179 if( rs_ctx != NULL && rs_ctx->ecp.depth++ == 0 ) \
180 rs_ctx->ecp.ops_done = 0; \
181 \
182 /* set up our own sub-context if needed */ \
Manuel Pégourié-Gonnardb843b152018-10-16 10:41:31 +0200183 if( mbedtls_ecp_restart_is_enabled() && \
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200184 rs_ctx != NULL && rs_ctx->SUB == NULL ) \
185 { \
186 rs_ctx->SUB = mbedtls_calloc( 1, sizeof( *rs_ctx->SUB ) ); \
187 if( rs_ctx->SUB == NULL ) \
188 return( MBEDTLS_ERR_ECP_ALLOC_FAILED ); \
189 \
190 ecdsa_restart_## SUB ##_init( rs_ctx->SUB ); \
191 } \
192} while( 0 )
193
Manuel Pégourié-Gonnardb948f7d2017-08-23 17:58:40 +0200194/* Call this when leaving a function that needs its own sub-context */
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200195#define ECDSA_RS_LEAVE( SUB ) do { \
196 /* clear our sub-context when not in progress (done or error) */ \
Manuel Pégourié-Gonnardb948f7d2017-08-23 17:58:40 +0200197 if( rs_ctx != NULL && rs_ctx->SUB != NULL && \
198 ret != MBEDTLS_ERR_ECP_IN_PROGRESS ) \
Manuel Pégourié-Gonnard31f0ef72017-05-17 10:05:58 +0200199 { \
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200200 ecdsa_restart_## SUB ##_free( rs_ctx->SUB ); \
201 mbedtls_free( rs_ctx->SUB ); \
202 rs_ctx->SUB = NULL; \
203 } \
204 \
205 if( rs_ctx != NULL ) \
206 rs_ctx->ecp.depth--; \
207} while( 0 )
208
Manuel Pégourié-Gonnarda0c5bcc2017-04-21 11:33:57 +0200209#else /* MBEDTLS_ECP_RESTARTABLE */
210
211#define ECDSA_RS_ECP NULL
212
Manuel Pégourié-Gonnard5314f232017-04-21 12:36:59 +0200213#define ECDSA_BUDGET( ops ) /* no-op; for compatibility */
214
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200215#define ECDSA_RS_ENTER( SUB ) (void) rs_ctx
216#define ECDSA_RS_LEAVE( SUB ) (void) rs_ctx
217
Manuel Pégourié-Gonnarda0c5bcc2017-04-21 11:33:57 +0200218#endif /* MBEDTLS_ECP_RESTARTABLE */
219
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100220/*
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100221 * Derive a suitable integer for group grp from a buffer of length len
222 * SEC1 4.1.3 step 5 aka SEC1 4.1.4 step 3
223 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200224static int derive_mpi( const mbedtls_ecp_group *grp, mbedtls_mpi *x,
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100225 const unsigned char *buf, size_t blen )
226{
Janos Follath24eed8d2019-11-22 13:21:35 +0000227 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker66d5d072014-06-17 16:39:18 +0200228 size_t n_size = ( grp->nbits + 7 ) / 8;
Manuel Pégourié-Gonnard53048122014-01-03 12:55:15 +0100229 size_t use_size = blen > n_size ? n_size : blen;
230
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200231 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( x, buf, use_size ) );
Manuel Pégourié-Gonnard53048122014-01-03 12:55:15 +0100232 if( use_size * 8 > grp->nbits )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200233 MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( x, use_size * 8 - grp->nbits ) );
Manuel Pégourié-Gonnard53048122014-01-03 12:55:15 +0100234
Manuel Pégourié-Gonnard461d4162014-01-06 10:16:28 +0100235 /* While at it, reduce modulo N */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200236 if( mbedtls_mpi_cmp_mpi( x, &grp->N ) >= 0 )
237 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( x, x, &grp->N ) );
Manuel Pégourié-Gonnard461d4162014-01-06 10:16:28 +0100238
Manuel Pégourié-Gonnard53048122014-01-03 12:55:15 +0100239cleanup:
240 return( ret );
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100241}
242
Ron Eldor936d2842018-11-01 13:05:52 +0200243#if !defined(MBEDTLS_ECDSA_SIGN_ALT)
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100244/*
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100245 * Compute ECDSA signature of a hashed message (SEC1 4.1.3)
246 * Obviously, compared to SEC1 4.1.3, we skip step 4 (hash message)
247 */
Manuel Pégourié-Gonnardaddb10e2017-04-21 12:54:46 +0200248static int ecdsa_sign_restartable( mbedtls_ecp_group *grp,
249 mbedtls_mpi *r, mbedtls_mpi *s,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200250 const mbedtls_mpi *d, const unsigned char *buf, size_t blen,
Manuel Pégourié-Gonnardaddb10e2017-04-21 12:54:46 +0200251 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng,
Janos Follathdca667a2019-01-04 14:32:30 +0000252 int (*f_rng_blind)(void *, unsigned char *, size_t),
253 void *p_rng_blind,
Manuel Pégourié-Gonnardaddb10e2017-04-21 12:54:46 +0200254 mbedtls_ecdsa_restart_ctx *rs_ctx )
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100255{
Manuel Pégourié-Gonnard50b63ba2017-04-25 12:57:22 +0200256 int ret, key_tries, sign_tries;
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200257 int *p_sign_tries = &sign_tries, *p_key_tries = &key_tries;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200258 mbedtls_ecp_point R;
259 mbedtls_mpi k, e, t;
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200260 mbedtls_mpi *pk = &k, *pr = r;
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100261
Manuel Pégourié-Gonnard97871ef2013-12-04 20:52:04 +0100262 /* Fail cleanly on curves such as Curve25519 that can't be used for ECDSA */
Christoph M. Wintersteigerc25df682019-04-16 12:54:56 +0100263 if( ! mbedtls_ecdsa_can_do( grp->id ) || grp->N.p == NULL )
Christoph M. Wintersteigerfba94e92018-12-06 17:18:24 +0000264 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard97871ef2013-12-04 20:52:04 +0100265
Darryl Greenc64a48b2017-11-17 17:09:17 +0000266 /* Make sure d is in range 1..n-1 */
267 if( mbedtls_mpi_cmp_int( d, 1 ) < 0 || mbedtls_mpi_cmp_mpi( d, &grp->N ) >= 0 )
268 return( MBEDTLS_ERR_ECP_INVALID_KEY );
269
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200270 mbedtls_ecp_point_init( &R );
271 mbedtls_mpi_init( &k ); mbedtls_mpi_init( &e ); mbedtls_mpi_init( &t );
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100272
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200273 ECDSA_RS_ENTER( sig );
274
275#if defined(MBEDTLS_ECP_RESTARTABLE)
276 if( rs_ctx != NULL && rs_ctx->sig != NULL )
277 {
278 /* redirect to our context */
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200279 p_sign_tries = &rs_ctx->sig->sign_tries;
280 p_key_tries = &rs_ctx->sig->key_tries;
281 pk = &rs_ctx->sig->k;
282 pr = &rs_ctx->sig->r;
283
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200284 /* jump to current step */
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200285 if( rs_ctx->sig->state == ecdsa_sig_mul )
286 goto mul;
287 if( rs_ctx->sig->state == ecdsa_sig_modn )
288 goto modn;
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200289 }
290#endif /* MBEDTLS_ECP_RESTARTABLE */
291
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200292 *p_sign_tries = 0;
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100293 do
294 {
Manuel Pégourié-Gonnardee4ba542020-01-24 12:11:56 +0100295 if( (*p_sign_tries)++ > 10 )
Manuel Pégourié-Gonnard67543962017-04-21 13:19:43 +0200296 {
297 ret = MBEDTLS_ERR_ECP_RANDOM_FAILED;
298 goto cleanup;
299 }
300
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100301 /*
302 * Steps 1-3: generate a suitable ephemeral keypair
Manuel Pégourié-Gonnard178d9ba2013-10-29 10:45:28 +0100303 * and set r = xR mod n
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100304 */
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200305 *p_key_tries = 0;
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100306 do
307 {
Manuel Pégourié-Gonnardee4ba542020-01-24 12:11:56 +0100308 if( (*p_key_tries)++ > 10 )
Paul Bakkercca998a2013-07-26 14:20:53 +0200309 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200310 ret = MBEDTLS_ERR_ECP_RANDOM_FAILED;
Paul Bakkercca998a2013-07-26 14:20:53 +0200311 goto cleanup;
312 }
Manuel Pégourié-Gonnard67543962017-04-21 13:19:43 +0200313
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200314 MBEDTLS_MPI_CHK( mbedtls_ecp_gen_privkey( grp, pk, f_rng, p_rng ) );
Manuel Pégourié-Gonnard50b63ba2017-04-25 12:57:22 +0200315
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200316#if defined(MBEDTLS_ECP_RESTARTABLE)
317 if( rs_ctx != NULL && rs_ctx->sig != NULL )
Manuel Pégourié-Gonnard63481812017-08-24 11:16:01 +0200318 rs_ctx->sig->state = ecdsa_sig_mul;
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200319
320mul:
321#endif
322 MBEDTLS_MPI_CHK( mbedtls_ecp_mul_restartable( grp, &R, pk, &grp->G,
Janos Follathdca667a2019-01-04 14:32:30 +0000323 f_rng_blind,
324 p_rng_blind,
325 ECDSA_RS_ECP ) );
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200326 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( pr, &R.X, &grp->N ) );
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100327 }
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200328 while( mbedtls_mpi_cmp_int( pr, 0 ) == 0 );
329
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200330#if defined(MBEDTLS_ECP_RESTARTABLE)
331 if( rs_ctx != NULL && rs_ctx->sig != NULL )
Manuel Pégourié-Gonnard63481812017-08-24 11:16:01 +0200332 rs_ctx->sig->state = ecdsa_sig_modn;
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200333
334modn:
335#endif
336 /*
337 * Accounting for everything up to the end of the loop
338 * (step 6, but checking now avoids saving e and t)
339 */
340 ECDSA_BUDGET( MBEDTLS_ECP_OPS_INV + 4 );
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100341
342 /*
343 * Step 5: derive MPI from hashed message
344 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200345 MBEDTLS_MPI_CHK( derive_mpi( grp, &e, buf, blen ) );
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100346
347 /*
Manuel Pégourié-Gonnarddd75c312014-03-31 11:55:42 +0200348 * Generate a random value to blind inv_mod in next step,
349 * avoiding a potential timing leak.
350 */
Janos Follathdca667a2019-01-04 14:32:30 +0000351 MBEDTLS_MPI_CHK( mbedtls_ecp_gen_privkey( grp, &t, f_rng_blind,
352 p_rng_blind ) );
Manuel Pégourié-Gonnarddd75c312014-03-31 11:55:42 +0200353
354 /*
355 * Step 6: compute s = (e + r * d) / k = t (e + rd) / (kt) mod n
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100356 */
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200357 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( s, pr, d ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200358 MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &e, &e, s ) );
359 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &e, &e, &t ) );
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200360 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( pk, pk, &t ) );
Janos Follath247c4d32019-10-17 10:18:51 +0100361 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( pk, pk, &grp->N ) );
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200362 MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( s, pk, &grp->N ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200363 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( s, s, &e ) );
364 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( s, s, &grp->N ) );
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100365 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200366 while( mbedtls_mpi_cmp_int( s, 0 ) == 0 );
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100367
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200368#if defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnard28d16282017-08-23 17:33:27 +0200369 if( rs_ctx != NULL && rs_ctx->sig != NULL )
370 mbedtls_mpi_copy( r, pr );
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200371#endif
372
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100373cleanup:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200374 mbedtls_ecp_point_free( &R );
375 mbedtls_mpi_free( &k ); mbedtls_mpi_free( &e ); mbedtls_mpi_free( &t );
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100376
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200377 ECDSA_RS_LEAVE( sig );
378
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100379 return( ret );
380}
Manuel Pégourié-Gonnard2aea1412013-01-26 16:33:44 +0100381
Christoph M. Wintersteiger0082f9d2019-01-07 13:47:30 +0000382int mbedtls_ecdsa_can_do( mbedtls_ecp_group_id gid )
383{
384 switch( gid )
385 {
386#ifdef MBEDTLS_ECP_DP_CURVE25519_ENABLED
Christoph M. Wintersteiger3ff60bc2019-02-15 12:59:59 +0000387 case MBEDTLS_ECP_DP_CURVE25519: return 0;
Christoph M. Wintersteiger0082f9d2019-01-07 13:47:30 +0000388#endif
389#ifdef MBEDTLS_ECP_DP_CURVE448_ENABLED
Christoph M. Wintersteiger3ff60bc2019-02-15 12:59:59 +0000390 case MBEDTLS_ECP_DP_CURVE448: return 0;
Christoph M. Wintersteiger0082f9d2019-01-07 13:47:30 +0000391#endif
392 default: return 1;
393 }
394}
395
Manuel Pégourié-Gonnardaddb10e2017-04-21 12:54:46 +0200396/*
397 * Compute ECDSA signature of a hashed message
398 */
399int mbedtls_ecdsa_sign( mbedtls_ecp_group *grp, mbedtls_mpi *r, mbedtls_mpi *s,
400 const mbedtls_mpi *d, const unsigned char *buf, size_t blen,
401 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
402{
Hanno Becker319ae112018-12-14 16:43:29 +0000403 ECDSA_VALIDATE_RET( grp != NULL );
404 ECDSA_VALIDATE_RET( r != NULL );
405 ECDSA_VALIDATE_RET( s != NULL );
406 ECDSA_VALIDATE_RET( d != NULL );
407 ECDSA_VALIDATE_RET( f_rng != NULL );
408 ECDSA_VALIDATE_RET( buf != NULL || blen == 0 );
409
Janos Follathdca667a2019-01-04 14:32:30 +0000410 /* Use the same RNG for both blinding and ephemeral key generation */
Manuel Pégourié-Gonnardaddb10e2017-04-21 12:54:46 +0200411 return( ecdsa_sign_restartable( grp, r, s, d, buf, blen,
Janos Follathdca667a2019-01-04 14:32:30 +0000412 f_rng, p_rng, f_rng, p_rng, NULL ) );
Manuel Pégourié-Gonnardaddb10e2017-04-21 12:54:46 +0200413}
Ron Eldor936d2842018-11-01 13:05:52 +0200414#endif /* !MBEDTLS_ECDSA_SIGN_ALT */
Manuel Pégourié-Gonnardaddb10e2017-04-21 12:54:46 +0200415
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200416#if defined(MBEDTLS_ECDSA_DETERMINISTIC)
Manuel Pégourié-Gonnard4daaef72014-01-06 14:25:56 +0100417/*
418 * Deterministic signature wrapper
TRodziewicz18efb732021-04-29 23:12:19 +0200419 *
420 * \note The f_rng_blind parameter must not be \c NULL.
421 *
Manuel Pégourié-Gonnard4daaef72014-01-06 14:25:56 +0100422 */
Manuel Pégourié-Gonnardaddb10e2017-04-21 12:54:46 +0200423static int ecdsa_sign_det_restartable( mbedtls_ecp_group *grp,
424 mbedtls_mpi *r, mbedtls_mpi *s,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200425 const mbedtls_mpi *d, const unsigned char *buf, size_t blen,
Manuel Pégourié-Gonnardaddb10e2017-04-21 12:54:46 +0200426 mbedtls_md_type_t md_alg,
Janos Follathdca667a2019-01-04 14:32:30 +0000427 int (*f_rng_blind)(void *, unsigned char *, size_t),
428 void *p_rng_blind,
Manuel Pégourié-Gonnardaddb10e2017-04-21 12:54:46 +0200429 mbedtls_ecdsa_restart_ctx *rs_ctx )
Manuel Pégourié-Gonnard4daaef72014-01-06 14:25:56 +0100430{
Janos Follath24eed8d2019-11-22 13:21:35 +0000431 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200432 mbedtls_hmac_drbg_context rng_ctx;
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200433 mbedtls_hmac_drbg_context *p_rng = &rng_ctx;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200434 unsigned char data[2 * MBEDTLS_ECP_MAX_BYTES];
Manuel Pégourié-Gonnard4daaef72014-01-06 14:25:56 +0100435 size_t grp_len = ( grp->nbits + 7 ) / 8;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200436 const mbedtls_md_info_t *md_info;
437 mbedtls_mpi h;
Manuel Pégourié-Gonnard4daaef72014-01-06 14:25:56 +0100438
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200439 if( ( md_info = mbedtls_md_info_from_type( md_alg ) ) == NULL )
440 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard4daaef72014-01-06 14:25:56 +0100441
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200442 mbedtls_mpi_init( &h );
Manuel Pégourié-Gonnardf9e94812015-04-28 22:07:14 +0200443 mbedtls_hmac_drbg_init( &rng_ctx );
Manuel Pégourié-Gonnard4daaef72014-01-06 14:25:56 +0100444
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200445 ECDSA_RS_ENTER( det );
446
447#if defined(MBEDTLS_ECP_RESTARTABLE)
448 if( rs_ctx != NULL && rs_ctx->det != NULL )
449 {
450 /* redirect to our context */
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200451 p_rng = &rs_ctx->det->rng_ctx;
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200452
453 /* jump to current step */
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200454 if( rs_ctx->det->state == ecdsa_det_sign )
455 goto sign;
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200456 }
457#endif /* MBEDTLS_ECP_RESTARTABLE */
458
Manuel Pégourié-Gonnardf42bca62014-01-06 15:05:01 +0100459 /* Use private key and message hash (reduced) to initialize HMAC_DRBG */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200460 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( d, data, grp_len ) );
461 MBEDTLS_MPI_CHK( derive_mpi( grp, &h, buf, blen ) );
462 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &h, data + grp_len, grp_len ) );
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200463 mbedtls_hmac_drbg_seed_buf( p_rng, md_info, data, 2 * grp_len );
Manuel Pégourié-Gonnard4daaef72014-01-06 14:25:56 +0100464
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200465#if defined(MBEDTLS_ECP_RESTARTABLE)
466 if( rs_ctx != NULL && rs_ctx->det != NULL )
Manuel Pégourié-Gonnard63481812017-08-24 11:16:01 +0200467 rs_ctx->det->state = ecdsa_det_sign;
Manuel Pégourié-Gonnardaf081f52017-04-25 13:44:19 +0200468
469sign:
470#endif
Ron Eldor8493f802018-11-01 11:32:15 +0200471#if defined(MBEDTLS_ECDSA_SIGN_ALT)
472 ret = mbedtls_ecdsa_sign( grp, r, s, d, buf, blen,
473 mbedtls_hmac_drbg_random, p_rng );
474#else
TRodziewicz18efb732021-04-29 23:12:19 +0200475 ret = ecdsa_sign_restartable( grp, r, s, d, buf, blen,
476 mbedtls_hmac_drbg_random, p_rng,
477 f_rng_blind, p_rng_blind, rs_ctx );
Ron Eldor936d2842018-11-01 13:05:52 +0200478#endif /* MBEDTLS_ECDSA_SIGN_ALT */
Manuel Pégourié-Gonnard4daaef72014-01-06 14:25:56 +0100479
480cleanup:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200481 mbedtls_hmac_drbg_free( &rng_ctx );
482 mbedtls_mpi_free( &h );
Manuel Pégourié-Gonnard4daaef72014-01-06 14:25:56 +0100483
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200484 ECDSA_RS_LEAVE( det );
485
Manuel Pégourié-Gonnard4daaef72014-01-06 14:25:56 +0100486 return( ret );
487}
Manuel Pégourié-Gonnardaddb10e2017-04-21 12:54:46 +0200488
489/*
TRodziewicz18efb732021-04-29 23:12:19 +0200490 * Deterministic signature wrapper
Manuel Pégourié-Gonnardaddb10e2017-04-21 12:54:46 +0200491 */
Janos Follathdca667a2019-01-04 14:32:30 +0000492int mbedtls_ecdsa_sign_det_ext( mbedtls_ecp_group *grp, mbedtls_mpi *r,
493 mbedtls_mpi *s, const mbedtls_mpi *d,
494 const unsigned char *buf, size_t blen,
495 mbedtls_md_type_t md_alg,
496 int (*f_rng_blind)(void *, unsigned char *,
497 size_t),
498 void *p_rng_blind )
499{
500 ECDSA_VALIDATE_RET( grp != NULL );
501 ECDSA_VALIDATE_RET( r != NULL );
502 ECDSA_VALIDATE_RET( s != NULL );
503 ECDSA_VALIDATE_RET( d != NULL );
504 ECDSA_VALIDATE_RET( buf != NULL || blen == 0 );
505 ECDSA_VALIDATE_RET( f_rng_blind != NULL );
506
507 return( ecdsa_sign_det_restartable( grp, r, s, d, buf, blen, md_alg,
508 f_rng_blind, p_rng_blind, NULL ) );
Manuel Pégourié-Gonnardaddb10e2017-04-21 12:54:46 +0200509}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200510#endif /* MBEDTLS_ECDSA_DETERMINISTIC */
Paul Bakker9f3c7d72014-01-23 16:11:14 +0100511
Ron Eldor936d2842018-11-01 13:05:52 +0200512#if !defined(MBEDTLS_ECDSA_VERIFY_ALT)
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100513/*
514 * Verify ECDSA signature of hashed message (SEC1 4.1.4)
515 * Obviously, compared to SEC1 4.1.3, we skip step 2 (hash message)
516 */
Manuel Pégourié-Gonnard32aa4372017-04-21 10:29:13 +0200517static int ecdsa_verify_restartable( mbedtls_ecp_group *grp,
518 const unsigned char *buf, size_t blen,
519 const mbedtls_ecp_point *Q,
520 const mbedtls_mpi *r, const mbedtls_mpi *s,
521 mbedtls_ecdsa_restart_ctx *rs_ctx )
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100522{
Janos Follath24eed8d2019-11-22 13:21:35 +0000523 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200524 mbedtls_mpi e, s_inv, u1, u2;
Manuel Pégourié-Gonnard56cc88a2015-05-11 18:40:45 +0200525 mbedtls_ecp_point R;
Manuel Pégourié-Gonnard5314f232017-04-21 12:36:59 +0200526 mbedtls_mpi *pu1 = &u1, *pu2 = &u2;
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100527
Manuel Pégourié-Gonnard56cc88a2015-05-11 18:40:45 +0200528 mbedtls_ecp_point_init( &R );
Manuel Pégourié-Gonnard411079f2017-04-20 15:41:08 +0200529 mbedtls_mpi_init( &e ); mbedtls_mpi_init( &s_inv );
530 mbedtls_mpi_init( &u1 ); mbedtls_mpi_init( &u2 );
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100531
Manuel Pégourié-Gonnard97871ef2013-12-04 20:52:04 +0100532 /* Fail cleanly on curves such as Curve25519 that can't be used for ECDSA */
Christoph M. Wintersteigerc25df682019-04-16 12:54:56 +0100533 if( ! mbedtls_ecdsa_can_do( grp->id ) || grp->N.p == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200534 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard97871ef2013-12-04 20:52:04 +0100535
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200536 ECDSA_RS_ENTER( ver );
537
Manuel Pégourié-Gonnarda0c5bcc2017-04-21 11:33:57 +0200538#if defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnard5314f232017-04-21 12:36:59 +0200539 if( rs_ctx != NULL && rs_ctx->ver != NULL )
540 {
541 /* redirect to our context */
542 pu1 = &rs_ctx->ver->u1;
543 pu2 = &rs_ctx->ver->u2;
544
545 /* jump to current step */
546 if( rs_ctx->ver->state == ecdsa_ver_muladd )
547 goto muladd;
548 }
Manuel Pégourié-Gonnarda0c5bcc2017-04-21 11:33:57 +0200549#endif /* MBEDTLS_ECP_RESTARTABLE */
550
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100551 /*
552 * Step 1: make sure r and s are in range 1..n-1
553 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200554 if( mbedtls_mpi_cmp_int( r, 1 ) < 0 || mbedtls_mpi_cmp_mpi( r, &grp->N ) >= 0 ||
555 mbedtls_mpi_cmp_int( s, 1 ) < 0 || mbedtls_mpi_cmp_mpi( s, &grp->N ) >= 0 )
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100556 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200557 ret = MBEDTLS_ERR_ECP_VERIFY_FAILED;
Paul Bakkercca998a2013-07-26 14:20:53 +0200558 goto cleanup;
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100559 }
560
561 /*
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100562 * Step 3: derive MPI from hashed message
563 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200564 MBEDTLS_MPI_CHK( derive_mpi( grp, &e, buf, blen ) );
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100565
566 /*
567 * Step 4: u1 = e / s mod n, u2 = r / s mod n
568 */
Manuel Pégourié-Gonnardbfa19722017-08-23 17:39:18 +0200569 ECDSA_BUDGET( MBEDTLS_ECP_OPS_CHK + MBEDTLS_ECP_OPS_INV + 2 );
570
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200571 MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( &s_inv, s, &grp->N ) );
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100572
Manuel Pégourié-Gonnard5314f232017-04-21 12:36:59 +0200573 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( pu1, &e, &s_inv ) );
574 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( pu1, pu1, &grp->N ) );
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100575
Manuel Pégourié-Gonnard5314f232017-04-21 12:36:59 +0200576 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( pu2, r, &s_inv ) );
577 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( pu2, pu2, &grp->N ) );
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100578
Manuel Pégourié-Gonnard5314f232017-04-21 12:36:59 +0200579#if defined(MBEDTLS_ECP_RESTARTABLE)
580 if( rs_ctx != NULL && rs_ctx->ver != NULL )
Manuel Pégourié-Gonnard63481812017-08-24 11:16:01 +0200581 rs_ctx->ver->state = ecdsa_ver_muladd;
Manuel Pégourié-Gonnard5314f232017-04-21 12:36:59 +0200582
583muladd:
584#endif
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100585 /*
586 * Step 5: R = u1 G + u2 Q
587 */
Manuel Pégourié-Gonnarda0c5bcc2017-04-21 11:33:57 +0200588 MBEDTLS_MPI_CHK( mbedtls_ecp_muladd_restartable( grp,
Manuel Pégourié-Gonnard5314f232017-04-21 12:36:59 +0200589 &R, pu1, &grp->G, pu2, Q, ECDSA_RS_ECP ) );
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100590
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200591 if( mbedtls_ecp_is_zero( &R ) )
Paul Bakkercca998a2013-07-26 14:20:53 +0200592 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200593 ret = MBEDTLS_ERR_ECP_VERIFY_FAILED;
Paul Bakkercca998a2013-07-26 14:20:53 +0200594 goto cleanup;
595 }
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100596
597 /*
Manuel Pégourié-Gonnard178d9ba2013-10-29 10:45:28 +0100598 * Step 6: convert xR to an integer (no-op)
599 * Step 7: reduce xR mod n (gives v)
600 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200601 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &R.X, &R.X, &grp->N ) );
Manuel Pégourié-Gonnard178d9ba2013-10-29 10:45:28 +0100602
603 /*
604 * Step 8: check if v (that is, R.X) is equal to r
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100605 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200606 if( mbedtls_mpi_cmp_mpi( &R.X, r ) != 0 )
Paul Bakkercca998a2013-07-26 14:20:53 +0200607 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200608 ret = MBEDTLS_ERR_ECP_VERIFY_FAILED;
Paul Bakkercca998a2013-07-26 14:20:53 +0200609 goto cleanup;
610 }
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100611
612cleanup:
Manuel Pégourié-Gonnard56cc88a2015-05-11 18:40:45 +0200613 mbedtls_ecp_point_free( &R );
Manuel Pégourié-Gonnard411079f2017-04-20 15:41:08 +0200614 mbedtls_mpi_free( &e ); mbedtls_mpi_free( &s_inv );
615 mbedtls_mpi_free( &u1 ); mbedtls_mpi_free( &u2 );
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100616
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200617 ECDSA_RS_LEAVE( ver );
Manuel Pégourié-Gonnarda0c5bcc2017-04-21 11:33:57 +0200618
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100619 return( ret );
620}
621
Manuel Pégourié-Gonnard7c8934e2013-06-27 12:54:02 +0200622/*
Manuel Pégourié-Gonnard32aa4372017-04-21 10:29:13 +0200623 * Verify ECDSA signature of hashed message
624 */
625int mbedtls_ecdsa_verify( mbedtls_ecp_group *grp,
Hanno Becker319ae112018-12-14 16:43:29 +0000626 const unsigned char *buf, size_t blen,
627 const mbedtls_ecp_point *Q,
628 const mbedtls_mpi *r,
629 const mbedtls_mpi *s)
Manuel Pégourié-Gonnard32aa4372017-04-21 10:29:13 +0200630{
Hanno Becker319ae112018-12-14 16:43:29 +0000631 ECDSA_VALIDATE_RET( grp != NULL );
632 ECDSA_VALIDATE_RET( Q != NULL );
633 ECDSA_VALIDATE_RET( r != NULL );
634 ECDSA_VALIDATE_RET( s != NULL );
635 ECDSA_VALIDATE_RET( buf != NULL || blen == 0 );
636
Manuel Pégourié-Gonnard32aa4372017-04-21 10:29:13 +0200637 return( ecdsa_verify_restartable( grp, buf, blen, Q, r, s, NULL ) );
638}
Ron Eldor936d2842018-11-01 13:05:52 +0200639#endif /* !MBEDTLS_ECDSA_VERIFY_ALT */
Manuel Pégourié-Gonnard32aa4372017-04-21 10:29:13 +0200640
641/*
Manuel Pégourié-Gonnard937340b2014-01-06 10:27:16 +0100642 * Convert a signature (given by context) to ASN.1
Manuel Pégourié-Gonnardb694b482013-08-08 13:30:57 +0200643 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200644static int ecdsa_signature_to_asn1( const mbedtls_mpi *r, const mbedtls_mpi *s,
Manuel Pégourié-Gonnard937340b2014-01-06 10:27:16 +0100645 unsigned char *sig, size_t *slen )
Manuel Pégourié-Gonnardb694b482013-08-08 13:30:57 +0200646{
Janos Follath24eed8d2019-11-22 13:21:35 +0000647 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200648 unsigned char buf[MBEDTLS_ECDSA_MAX_LEN];
Manuel Pégourié-Gonnard4cf06862013-09-16 12:07:45 +0200649 unsigned char *p = buf + sizeof( buf );
Manuel Pégourié-Gonnardb694b482013-08-08 13:30:57 +0200650 size_t len = 0;
651
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200652 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_mpi( &p, buf, s ) );
653 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_mpi( &p, buf, r ) );
Manuel Pégourié-Gonnardb694b482013-08-08 13:30:57 +0200654
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200655 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &p, buf, len ) );
656 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &p, buf,
657 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) );
Manuel Pégourié-Gonnardb694b482013-08-08 13:30:57 +0200658
659 memcpy( sig, p, len );
660 *slen = len;
661
662 return( 0 );
663}
664
665/*
Manuel Pégourié-Gonnard937340b2014-01-06 10:27:16 +0100666 * Compute and write signature
667 */
Manuel Pégourié-Gonnardaddb10e2017-04-21 12:54:46 +0200668int mbedtls_ecdsa_write_signature_restartable( mbedtls_ecdsa_context *ctx,
669 mbedtls_md_type_t md_alg,
Manuel Pégourié-Gonnard937340b2014-01-06 10:27:16 +0100670 const unsigned char *hash, size_t hlen,
671 unsigned char *sig, size_t *slen,
672 int (*f_rng)(void *, unsigned char *, size_t),
Manuel Pégourié-Gonnardaddb10e2017-04-21 12:54:46 +0200673 void *p_rng,
674 mbedtls_ecdsa_restart_ctx *rs_ctx )
Manuel Pégourié-Gonnard937340b2014-01-06 10:27:16 +0100675{
Janos Follath24eed8d2019-11-22 13:21:35 +0000676 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200677 mbedtls_mpi r, s;
TRodziewicz18efb732021-04-29 23:12:19 +0200678 ECDSA_VALIDATE_RET( ctx != NULL );
679 ECDSA_VALIDATE_RET( hash != NULL );
680 ECDSA_VALIDATE_RET( sig != NULL );
681 ECDSA_VALIDATE_RET( slen != NULL );
682 ECDSA_VALIDATE_RET( f_rng != NULL );
Manuel Pégourié-Gonnard8fce9372015-03-31 13:06:41 +0200683
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200684 mbedtls_mpi_init( &r );
685 mbedtls_mpi_init( &s );
Manuel Pégourié-Gonnard937340b2014-01-06 10:27:16 +0100686
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200687#if defined(MBEDTLS_ECDSA_DETERMINISTIC)
Manuel Pégourié-Gonnardaddb10e2017-04-21 12:54:46 +0200688 MBEDTLS_MPI_CHK( ecdsa_sign_det_restartable( &ctx->grp, &r, &s, &ctx->d,
Janos Follathdca667a2019-01-04 14:32:30 +0000689 hash, hlen, md_alg, f_rng,
690 p_rng, rs_ctx ) );
Manuel Pégourié-Gonnarddfdcac92015-03-31 11:41:42 +0200691#else
692 (void) md_alg;
693
Ron Eldor8493f802018-11-01 11:32:15 +0200694#if defined(MBEDTLS_ECDSA_SIGN_ALT)
695 MBEDTLS_MPI_CHK( mbedtls_ecdsa_sign( &ctx->grp, &r, &s, &ctx->d,
696 hash, hlen, f_rng, p_rng ) );
697#else
Janos Follathdca667a2019-01-04 14:32:30 +0000698 /* Use the same RNG for both blinding and ephemeral key generation */
Manuel Pégourié-Gonnardaddb10e2017-04-21 12:54:46 +0200699 MBEDTLS_MPI_CHK( ecdsa_sign_restartable( &ctx->grp, &r, &s, &ctx->d,
Janos Follathdca667a2019-01-04 14:32:30 +0000700 hash, hlen, f_rng, p_rng, f_rng,
701 p_rng, rs_ctx ) );
Ron Eldor936d2842018-11-01 13:05:52 +0200702#endif /* MBEDTLS_ECDSA_SIGN_ALT */
Ron Eldor5ed8c1e2018-11-05 14:04:26 +0200703#endif /* MBEDTLS_ECDSA_DETERMINISTIC */
Manuel Pégourié-Gonnard937340b2014-01-06 10:27:16 +0100704
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200705 MBEDTLS_MPI_CHK( ecdsa_signature_to_asn1( &r, &s, sig, slen ) );
Manuel Pégourié-Gonnard8fce9372015-03-31 13:06:41 +0200706
707cleanup:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200708 mbedtls_mpi_free( &r );
709 mbedtls_mpi_free( &s );
Manuel Pégourié-Gonnard8fce9372015-03-31 13:06:41 +0200710
711 return( ret );
Manuel Pégourié-Gonnard937340b2014-01-06 10:27:16 +0100712}
713
Manuel Pégourié-Gonnardaddb10e2017-04-21 12:54:46 +0200714/*
715 * Compute and write signature
716 */
Hanno Becker319ae112018-12-14 16:43:29 +0000717int mbedtls_ecdsa_write_signature( mbedtls_ecdsa_context *ctx,
718 mbedtls_md_type_t md_alg,
719 const unsigned char *hash, size_t hlen,
720 unsigned char *sig, size_t *slen,
721 int (*f_rng)(void *, unsigned char *, size_t),
722 void *p_rng )
Manuel Pégourié-Gonnardaddb10e2017-04-21 12:54:46 +0200723{
Hanno Becker319ae112018-12-14 16:43:29 +0000724 ECDSA_VALIDATE_RET( ctx != NULL );
725 ECDSA_VALIDATE_RET( hash != NULL );
726 ECDSA_VALIDATE_RET( sig != NULL );
727 ECDSA_VALIDATE_RET( slen != NULL );
Manuel Pégourié-Gonnardaddb10e2017-04-21 12:54:46 +0200728 return( mbedtls_ecdsa_write_signature_restartable(
729 ctx, md_alg, hash, hlen, sig, slen, f_rng, p_rng, NULL ) );
730}
731
Manuel Pégourié-Gonnard937340b2014-01-06 10:27:16 +0100732/*
Manuel Pégourié-Gonnardb694b482013-08-08 13:30:57 +0200733 * Read and check signature
734 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200735int mbedtls_ecdsa_read_signature( mbedtls_ecdsa_context *ctx,
Manuel Pégourié-Gonnardb694b482013-08-08 13:30:57 +0200736 const unsigned char *hash, size_t hlen,
737 const unsigned char *sig, size_t slen )
738{
Hanno Becker319ae112018-12-14 16:43:29 +0000739 ECDSA_VALIDATE_RET( ctx != NULL );
740 ECDSA_VALIDATE_RET( hash != NULL );
741 ECDSA_VALIDATE_RET( sig != NULL );
Manuel Pégourié-Gonnard32aa4372017-04-21 10:29:13 +0200742 return( mbedtls_ecdsa_read_signature_restartable(
743 ctx, hash, hlen, sig, slen, NULL ) );
744}
745
746/*
747 * Restartable read and check signature
748 */
749int mbedtls_ecdsa_read_signature_restartable( mbedtls_ecdsa_context *ctx,
750 const unsigned char *hash, size_t hlen,
751 const unsigned char *sig, size_t slen,
752 mbedtls_ecdsa_restart_ctx *rs_ctx )
753{
Janos Follath24eed8d2019-11-22 13:21:35 +0000754 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnardb694b482013-08-08 13:30:57 +0200755 unsigned char *p = (unsigned char *) sig;
756 const unsigned char *end = sig + slen;
757 size_t len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200758 mbedtls_mpi r, s;
Hanno Becker319ae112018-12-14 16:43:29 +0000759 ECDSA_VALIDATE_RET( ctx != NULL );
760 ECDSA_VALIDATE_RET( hash != NULL );
761 ECDSA_VALIDATE_RET( sig != NULL );
Manuel Pégourié-Gonnard8fce9372015-03-31 13:06:41 +0200762
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200763 mbedtls_mpi_init( &r );
764 mbedtls_mpi_init( &s );
Manuel Pégourié-Gonnardb694b482013-08-08 13:30:57 +0200765
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200766 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
767 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
Manuel Pégourié-Gonnardb694b482013-08-08 13:30:57 +0200768 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200769 ret += MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
Manuel Pégourié-Gonnard8fce9372015-03-31 13:06:41 +0200770 goto cleanup;
Manuel Pégourié-Gonnardb694b482013-08-08 13:30:57 +0200771 }
772
773 if( p + len != end )
Manuel Pégourié-Gonnard8fce9372015-03-31 13:06:41 +0200774 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200775 ret = MBEDTLS_ERR_ECP_BAD_INPUT_DATA +
776 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH;
Manuel Pégourié-Gonnard8fce9372015-03-31 13:06:41 +0200777 goto cleanup;
778 }
Manuel Pégourié-Gonnardb694b482013-08-08 13:30:57 +0200779
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200780 if( ( ret = mbedtls_asn1_get_mpi( &p, end, &r ) ) != 0 ||
781 ( ret = mbedtls_asn1_get_mpi( &p, end, &s ) ) != 0 )
Manuel Pégourié-Gonnard8fce9372015-03-31 13:06:41 +0200782 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200783 ret += MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
Manuel Pégourié-Gonnard8fce9372015-03-31 13:06:41 +0200784 goto cleanup;
785 }
Ron Eldor8493f802018-11-01 11:32:15 +0200786#if defined(MBEDTLS_ECDSA_VERIFY_ALT)
787 if( ( ret = mbedtls_ecdsa_verify( &ctx->grp, hash, hlen,
788 &ctx->Q, &r, &s ) ) != 0 )
789 goto cleanup;
790#else
Manuel Pégourié-Gonnard32aa4372017-04-21 10:29:13 +0200791 if( ( ret = ecdsa_verify_restartable( &ctx->grp, hash, hlen,
792 &ctx->Q, &r, &s, rs_ctx ) ) != 0 )
Manuel Pégourié-Gonnard8fce9372015-03-31 13:06:41 +0200793 goto cleanup;
Ron Eldor936d2842018-11-01 13:05:52 +0200794#endif /* MBEDTLS_ECDSA_VERIFY_ALT */
Manuel Pégourié-Gonnardb694b482013-08-08 13:30:57 +0200795
Gilles Peskine5114d3e2018-03-30 07:12:15 +0200796 /* At this point we know that the buffer starts with a valid signature.
797 * Return 0 if the buffer just contains the signature, and a specific
798 * error code if the valid signature is followed by more data. */
Manuel Pégourié-Gonnard35e95dd2014-04-08 12:17:41 +0200799 if( p != end )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200800 ret = MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH;
Manuel Pégourié-Gonnard35e95dd2014-04-08 12:17:41 +0200801
Manuel Pégourié-Gonnard8fce9372015-03-31 13:06:41 +0200802cleanup:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200803 mbedtls_mpi_free( &r );
804 mbedtls_mpi_free( &s );
Manuel Pégourié-Gonnard8fce9372015-03-31 13:06:41 +0200805
806 return( ret );
Manuel Pégourié-Gonnardb694b482013-08-08 13:30:57 +0200807}
808
Ron Eldor314adb62017-10-10 18:28:25 +0300809#if !defined(MBEDTLS_ECDSA_GENKEY_ALT)
Manuel Pégourié-Gonnardb694b482013-08-08 13:30:57 +0200810/*
Manuel Pégourié-Gonnard8eebd012013-08-09 16:21:34 +0200811 * Generate key pair
812 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200813int mbedtls_ecdsa_genkey( mbedtls_ecdsa_context *ctx, mbedtls_ecp_group_id gid,
Manuel Pégourié-Gonnard8eebd012013-08-09 16:21:34 +0200814 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
815{
Ron Eldoradb52342018-12-17 10:06:12 +0200816 int ret = 0;
Hanno Becker319ae112018-12-14 16:43:29 +0000817 ECDSA_VALIDATE_RET( ctx != NULL );
818 ECDSA_VALIDATE_RET( f_rng != NULL );
819
Ron Eldoradb52342018-12-17 10:06:12 +0200820 ret = mbedtls_ecp_group_load( &ctx->grp, gid );
821 if( ret != 0 )
822 return( ret );
823
824 return( mbedtls_ecp_gen_keypair( &ctx->grp, &ctx->d,
825 &ctx->Q, f_rng, p_rng ) );
Manuel Pégourié-Gonnard8eebd012013-08-09 16:21:34 +0200826}
Ron Eldor936d2842018-11-01 13:05:52 +0200827#endif /* !MBEDTLS_ECDSA_GENKEY_ALT */
Manuel Pégourié-Gonnard8eebd012013-08-09 16:21:34 +0200828
Manuel Pégourié-Gonnardf4999932013-08-12 17:02:59 +0200829/*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200830 * Set context from an mbedtls_ecp_keypair
Manuel Pégourié-Gonnardf4999932013-08-12 17:02:59 +0200831 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200832int mbedtls_ecdsa_from_keypair( mbedtls_ecdsa_context *ctx, const mbedtls_ecp_keypair *key )
Manuel Pégourié-Gonnardf4999932013-08-12 17:02:59 +0200833{
Janos Follath24eed8d2019-11-22 13:21:35 +0000834 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Becker319ae112018-12-14 16:43:29 +0000835 ECDSA_VALIDATE_RET( ctx != NULL );
836 ECDSA_VALIDATE_RET( key != NULL );
Manuel Pégourié-Gonnardf4999932013-08-12 17:02:59 +0200837
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200838 if( ( ret = mbedtls_ecp_group_copy( &ctx->grp, &key->grp ) ) != 0 ||
839 ( ret = mbedtls_mpi_copy( &ctx->d, &key->d ) ) != 0 ||
840 ( ret = mbedtls_ecp_copy( &ctx->Q, &key->Q ) ) != 0 )
Manuel Pégourié-Gonnard1001e322013-10-27 14:53:48 +0100841 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200842 mbedtls_ecdsa_free( ctx );
Manuel Pégourié-Gonnard1001e322013-10-27 14:53:48 +0100843 }
Manuel Pégourié-Gonnardf4999932013-08-12 17:02:59 +0200844
845 return( ret );
846}
Manuel Pégourié-Gonnard8eebd012013-08-09 16:21:34 +0200847
848/*
Manuel Pégourié-Gonnard7c8934e2013-06-27 12:54:02 +0200849 * Initialize context
850 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200851void mbedtls_ecdsa_init( mbedtls_ecdsa_context *ctx )
Manuel Pégourié-Gonnard7c8934e2013-06-27 12:54:02 +0200852{
Hanno Becker319ae112018-12-14 16:43:29 +0000853 ECDSA_VALIDATE( ctx != NULL );
854
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200855 mbedtls_ecp_keypair_init( ctx );
Manuel Pégourié-Gonnard7c8934e2013-06-27 12:54:02 +0200856}
857
858/*
859 * Free context
860 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200861void mbedtls_ecdsa_free( mbedtls_ecdsa_context *ctx )
Manuel Pégourié-Gonnard7c8934e2013-06-27 12:54:02 +0200862{
Hanno Becker319ae112018-12-14 16:43:29 +0000863 if( ctx == NULL )
864 return;
865
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200866 mbedtls_ecp_keypair_free( ctx );
Manuel Pégourié-Gonnard7c8934e2013-06-27 12:54:02 +0200867}
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100868
Manuel Pégourié-Gonnard32aa4372017-04-21 10:29:13 +0200869#if defined(MBEDTLS_ECP_RESTARTABLE)
870/*
871 * Initialize a restart context
872 */
873void mbedtls_ecdsa_restart_init( mbedtls_ecdsa_restart_ctx *ctx )
874{
Hanno Becker319ae112018-12-14 16:43:29 +0000875 ECDSA_VALIDATE( ctx != NULL );
876
Manuel Pégourié-Gonnard722e5152017-04-21 11:04:47 +0200877 mbedtls_ecp_restart_init( &ctx->ecp );
Manuel Pégourié-Gonnarda0c5bcc2017-04-21 11:33:57 +0200878
879 ctx->ver = NULL;
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200880 ctx->sig = NULL;
881#if defined(MBEDTLS_ECDSA_DETERMINISTIC)
882 ctx->det = NULL;
883#endif
Manuel Pégourié-Gonnard32aa4372017-04-21 10:29:13 +0200884}
885
886/*
887 * Free the components of a restart context
888 */
889void mbedtls_ecdsa_restart_free( mbedtls_ecdsa_restart_ctx *ctx )
890{
Hanno Becker319ae112018-12-14 16:43:29 +0000891 if( ctx == NULL )
892 return;
893
Manuel Pégourié-Gonnard722e5152017-04-21 11:04:47 +0200894 mbedtls_ecp_restart_free( &ctx->ecp );
Manuel Pégourié-Gonnarda0c5bcc2017-04-21 11:33:57 +0200895
896 ecdsa_restart_ver_free( ctx->ver );
897 mbedtls_free( ctx->ver );
898 ctx->ver = NULL;
Manuel Pégourié-Gonnardb90883d2017-04-25 11:33:10 +0200899
900 ecdsa_restart_sig_free( ctx->sig );
901 mbedtls_free( ctx->sig );
902 ctx->sig = NULL;
903
904#if defined(MBEDTLS_ECDSA_DETERMINISTIC)
905 ecdsa_restart_det_free( ctx->det );
906 mbedtls_free( ctx->det );
907 ctx->det = NULL;
908#endif
Manuel Pégourié-Gonnard32aa4372017-04-21 10:29:13 +0200909}
910#endif /* MBEDTLS_ECP_RESTARTABLE */
911
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200912#endif /* MBEDTLS_ECDSA_C */