blob: c6f6302b34713f2ac72728a757cd353574107c7f [file] [log] [blame]
Manuel Pégourié-Gonnardd73b3c12013-08-12 17:06:05 +02001/*
2 * Public Key abstraction layer: wrapper functions
3 *
Manuel Pégourié-Gonnard6fb81872015-07-27 11:11:48 +02004 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +02005 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
Manuel Pégourié-Gonnardd73b3c12013-08-12 17:06:05 +020018 *
Manuel Pégourié-Gonnardfe446432015-03-06 13:17:10 +000019 * This file is part of mbed TLS (https://tls.mbed.org)
Manuel Pégourié-Gonnardd73b3c12013-08-12 17:06:05 +020020 */
21
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020022#if !defined(MBEDTLS_CONFIG_FILE)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000023#include "mbedtls/config.h"
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020024#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020025#include MBEDTLS_CONFIG_FILE
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020026#endif
Manuel Pégourié-Gonnardd73b3c12013-08-12 17:06:05 +020027
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020028#if defined(MBEDTLS_PK_C)
Manuel Pégourié-Gonnard50518f42015-05-26 11:04:15 +020029#include "mbedtls/pk_internal.h"
Manuel Pégourié-Gonnardd73b3c12013-08-12 17:06:05 +020030
Manuel Pégourié-Gonnarde511ffc2013-08-22 17:33:21 +020031/* Even if RSA not activated, for the sake of RSA-alt */
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000032#include "mbedtls/rsa.h"
Manuel Pégourié-Gonnardd73b3c12013-08-12 17:06:05 +020033
Rich Evans00ab4702015-02-06 13:43:58 +000034#include <string.h>
35
Jarno Lamsa42b83db2019-04-16 16:48:22 +030036#if defined(MBEDTLS_USE_TINYCRYPT)
37#include "mbedtls/ecc.h"
38#include "mbedtls/ecc_dsa.h"
39#include "mbedtls/asn1.h"
40#include "mbedtls/asn1write.h"
41#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020042#if defined(MBEDTLS_ECP_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000043#include "mbedtls/ecp.h"
Manuel Pégourié-Gonnardd73b3c12013-08-12 17:06:05 +020044#endif
45
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020046#if defined(MBEDTLS_ECDSA_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000047#include "mbedtls/ecdsa.h"
Manuel Pégourié-Gonnardd73b3c12013-08-12 17:06:05 +020048#endif
Jarno Lamsa42b83db2019-04-16 16:48:22 +030049#endif /* MBEDTLS_USE_TINYCRYPT */
Manuel Pégourié-Gonnardd73b3c12013-08-12 17:06:05 +020050
Andres Amaya Garciae32df082017-10-25 09:37:04 +010051#if defined(MBEDTLS_PK_RSA_ALT_SUPPORT)
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050052#include "mbedtls/platform_util.h"
Andres Amaya Garciae32df082017-10-25 09:37:04 +010053#endif
54
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020055#if defined(MBEDTLS_PLATFORM_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000056#include "mbedtls/platform.h"
Manuel Pégourié-Gonnard765db072013-08-14 15:00:27 +020057#else
58#include <stdlib.h>
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +020059#define mbedtls_calloc calloc
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020060#define mbedtls_free free
Manuel Pégourié-Gonnard765db072013-08-14 15:00:27 +020061#endif
62
Andres AG72849872017-01-19 11:24:33 +000063#include <limits.h>
Andres Amaya Garcia7c02c502017-08-04 13:32:15 +010064#include <stdint.h>
Paul Bakker34617722014-06-13 17:20:13 +020065
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020066#if defined(MBEDTLS_RSA_C)
67static int rsa_can_do( mbedtls_pk_type_t type )
Manuel Pégourié-Gonnardf18c3e02013-08-12 18:41:18 +020068{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020069 return( type == MBEDTLS_PK_RSA ||
70 type == MBEDTLS_PK_RSASSA_PSS );
Manuel Pégourié-Gonnardf18c3e02013-08-12 18:41:18 +020071}
72
Manuel Pégourié-Gonnard39a48f42015-06-18 16:06:55 +020073static size_t rsa_get_bitlen( const void *ctx )
Manuel Pégourié-Gonnardf8c948a2013-08-12 19:45:32 +020074{
Hanno Becker6a1e7e52017-08-22 13:55:00 +010075 const mbedtls_rsa_context * rsa = (const mbedtls_rsa_context *) ctx;
76 return( 8 * mbedtls_rsa_get_len( rsa ) );
Manuel Pégourié-Gonnardf8c948a2013-08-12 19:45:32 +020077}
78
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020079static int rsa_verify_wrap( void *ctx, mbedtls_md_type_t md_alg,
Manuel Pégourié-Gonnardf73da022013-08-17 14:36:32 +020080 const unsigned char *hash, size_t hash_len,
Manuel Pégourié-Gonnardd73b3c12013-08-12 17:06:05 +020081 const unsigned char *sig, size_t sig_len )
82{
Manuel Pégourié-Gonnard2abed842014-04-08 12:40:15 +020083 int ret;
Hanno Becker6a1e7e52017-08-22 13:55:00 +010084 mbedtls_rsa_context * rsa = (mbedtls_rsa_context *) ctx;
85 size_t rsa_len = mbedtls_rsa_get_len( rsa );
Manuel Pégourié-Gonnard2abed842014-04-08 12:40:15 +020086
Andres Amaya Garcia7c02c502017-08-04 13:32:15 +010087#if SIZE_MAX > UINT_MAX
Andres AG72849872017-01-19 11:24:33 +000088 if( md_alg == MBEDTLS_MD_NONE && UINT_MAX < hash_len )
89 return( MBEDTLS_ERR_PK_BAD_INPUT_DATA );
Andres Amaya Garcia7c02c502017-08-04 13:32:15 +010090#endif /* SIZE_MAX > UINT_MAX */
Andres AG72849872017-01-19 11:24:33 +000091
Hanno Becker6a1e7e52017-08-22 13:55:00 +010092 if( sig_len < rsa_len )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020093 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
Manuel Pégourié-Gonnardd73b3c12013-08-12 17:06:05 +020094
Hanno Becker6a1e7e52017-08-22 13:55:00 +010095 if( ( ret = mbedtls_rsa_pkcs1_verify( rsa, NULL, NULL,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020096 MBEDTLS_RSA_PUBLIC, md_alg,
Manuel Pégourié-Gonnard2abed842014-04-08 12:40:15 +020097 (unsigned int) hash_len, hash, sig ) ) != 0 )
98 return( ret );
99
Gilles Peskine5114d3e2018-03-30 07:12:15 +0200100 /* The buffer contains a valid signature followed by extra data.
101 * We have a special error code for that so that so that callers can
102 * use mbedtls_pk_verify() to check "Does the buffer start with a
103 * valid signature?" and not just "Does the buffer contain a valid
104 * signature?". */
Hanno Becker6a1e7e52017-08-22 13:55:00 +0100105 if( sig_len > rsa_len )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200106 return( MBEDTLS_ERR_PK_SIG_LEN_MISMATCH );
Manuel Pégourié-Gonnard2abed842014-04-08 12:40:15 +0200107
108 return( 0 );
Manuel Pégourié-Gonnardd73b3c12013-08-12 17:06:05 +0200109}
110
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200111static int rsa_sign_wrap( void *ctx, mbedtls_md_type_t md_alg,
Manuel Pégourié-Gonnard8df27692013-08-21 10:34:38 +0200112 const unsigned char *hash, size_t hash_len,
113 unsigned char *sig, size_t *sig_len,
114 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
115{
Hanno Becker6a1e7e52017-08-22 13:55:00 +0100116 mbedtls_rsa_context * rsa = (mbedtls_rsa_context *) ctx;
117
Andres Amaya Garcia7c02c502017-08-04 13:32:15 +0100118#if SIZE_MAX > UINT_MAX
Andres AG72849872017-01-19 11:24:33 +0000119 if( md_alg == MBEDTLS_MD_NONE && UINT_MAX < hash_len )
120 return( MBEDTLS_ERR_PK_BAD_INPUT_DATA );
Andres Amaya Garcia7c02c502017-08-04 13:32:15 +0100121#endif /* SIZE_MAX > UINT_MAX */
Andres AG72849872017-01-19 11:24:33 +0000122
Hanno Becker6a1e7e52017-08-22 13:55:00 +0100123 *sig_len = mbedtls_rsa_get_len( rsa );
Manuel Pégourié-Gonnard8df27692013-08-21 10:34:38 +0200124
Hanno Becker6a1e7e52017-08-22 13:55:00 +0100125 return( mbedtls_rsa_pkcs1_sign( rsa, f_rng, p_rng, MBEDTLS_RSA_PRIVATE,
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200126 md_alg, (unsigned int) hash_len, hash, sig ) );
Manuel Pégourié-Gonnard8df27692013-08-21 10:34:38 +0200127}
128
Manuel Pégourié-Gonnarda2d3f222013-08-21 11:51:08 +0200129static int rsa_decrypt_wrap( void *ctx,
130 const unsigned char *input, size_t ilen,
131 unsigned char *output, size_t *olen, size_t osize,
132 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
133{
Hanno Becker6a1e7e52017-08-22 13:55:00 +0100134 mbedtls_rsa_context * rsa = (mbedtls_rsa_context *) ctx;
135
136 if( ilen != mbedtls_rsa_get_len( rsa ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200137 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Manuel Pégourié-Gonnarda2d3f222013-08-21 11:51:08 +0200138
Hanno Becker6a1e7e52017-08-22 13:55:00 +0100139 return( mbedtls_rsa_pkcs1_decrypt( rsa, f_rng, p_rng,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200140 MBEDTLS_RSA_PRIVATE, olen, input, output, osize ) );
Manuel Pégourié-Gonnarda2d3f222013-08-21 11:51:08 +0200141}
142
143static int rsa_encrypt_wrap( void *ctx,
144 const unsigned char *input, size_t ilen,
145 unsigned char *output, size_t *olen, size_t osize,
146 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
147{
Hanno Becker6a1e7e52017-08-22 13:55:00 +0100148 mbedtls_rsa_context * rsa = (mbedtls_rsa_context *) ctx;
149 *olen = mbedtls_rsa_get_len( rsa );
Manuel Pégourié-Gonnarda2d3f222013-08-21 11:51:08 +0200150
Manuel Pégourié-Gonnarda1efcb02014-11-08 17:08:08 +0100151 if( *olen > osize )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200152 return( MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE );
Manuel Pégourié-Gonnarda1efcb02014-11-08 17:08:08 +0100153
Hanno Becker6a1e7e52017-08-22 13:55:00 +0100154 return( mbedtls_rsa_pkcs1_encrypt( rsa, f_rng, p_rng, MBEDTLS_RSA_PUBLIC,
155 ilen, input, output ) );
Manuel Pégourié-Gonnarda2d3f222013-08-21 11:51:08 +0200156}
157
Manuel Pégourié-Gonnard70bdadf2014-11-06 16:51:20 +0100158static int rsa_check_pair_wrap( const void *pub, const void *prv )
159{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200160 return( mbedtls_rsa_check_pub_priv( (const mbedtls_rsa_context *) pub,
161 (const mbedtls_rsa_context *) prv ) );
Manuel Pégourié-Gonnard70bdadf2014-11-06 16:51:20 +0100162}
163
Manuel Pégourié-Gonnard765db072013-08-14 15:00:27 +0200164static void *rsa_alloc_wrap( void )
165{
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200166 void *ctx = mbedtls_calloc( 1, sizeof( mbedtls_rsa_context ) );
Manuel Pégourié-Gonnard765db072013-08-14 15:00:27 +0200167
168 if( ctx != NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200169 mbedtls_rsa_init( (mbedtls_rsa_context *) ctx, 0, 0 );
Manuel Pégourié-Gonnard765db072013-08-14 15:00:27 +0200170
Paul Bakkerd8bb8262014-06-17 14:06:49 +0200171 return( ctx );
Manuel Pégourié-Gonnard765db072013-08-14 15:00:27 +0200172}
173
174static void rsa_free_wrap( void *ctx )
175{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200176 mbedtls_rsa_free( (mbedtls_rsa_context *) ctx );
177 mbedtls_free( ctx );
Manuel Pégourié-Gonnard765db072013-08-14 15:00:27 +0200178}
179
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200180static void rsa_debug( const void *ctx, mbedtls_pk_debug_item *items )
Manuel Pégourié-Gonnardc6ac8872013-08-14 18:04:18 +0200181{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200182 items->type = MBEDTLS_PK_DEBUG_MPI;
Manuel Pégourié-Gonnardc6ac8872013-08-14 18:04:18 +0200183 items->name = "rsa.N";
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200184 items->value = &( ((mbedtls_rsa_context *) ctx)->N );
Manuel Pégourié-Gonnardc6ac8872013-08-14 18:04:18 +0200185
186 items++;
187
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200188 items->type = MBEDTLS_PK_DEBUG_MPI;
Manuel Pégourié-Gonnardc6ac8872013-08-14 18:04:18 +0200189 items->name = "rsa.E";
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200190 items->value = &( ((mbedtls_rsa_context *) ctx)->E );
Manuel Pégourié-Gonnardc6ac8872013-08-14 18:04:18 +0200191}
192
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200193const mbedtls_pk_info_t mbedtls_rsa_info = {
194 MBEDTLS_PK_RSA,
Manuel Pégourié-Gonnardf8c948a2013-08-12 19:45:32 +0200195 "RSA",
Manuel Pégourié-Gonnard39a48f42015-06-18 16:06:55 +0200196 rsa_get_bitlen,
Manuel Pégourié-Gonnardf18c3e02013-08-12 18:41:18 +0200197 rsa_can_do,
Manuel Pégourié-Gonnardd73b3c12013-08-12 17:06:05 +0200198 rsa_verify_wrap,
Manuel Pégourié-Gonnard8df27692013-08-21 10:34:38 +0200199 rsa_sign_wrap,
Manuel Pégourié-Gonnardaaa98142017-08-18 17:30:37 +0200200#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnard1f596062017-05-09 10:42:40 +0200201 NULL,
202 NULL,
203#endif
Manuel Pégourié-Gonnarda2d3f222013-08-21 11:51:08 +0200204 rsa_decrypt_wrap,
205 rsa_encrypt_wrap,
Manuel Pégourié-Gonnard70bdadf2014-11-06 16:51:20 +0100206 rsa_check_pair_wrap,
Manuel Pégourié-Gonnard765db072013-08-14 15:00:27 +0200207 rsa_alloc_wrap,
208 rsa_free_wrap,
Manuel Pégourié-Gonnardaaa98142017-08-18 17:30:37 +0200209#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnard0bbc66c2017-08-18 16:22:06 +0200210 NULL,
211 NULL,
212#endif
Manuel Pégourié-Gonnardc6ac8872013-08-14 18:04:18 +0200213 rsa_debug,
Manuel Pégourié-Gonnardd73b3c12013-08-12 17:06:05 +0200214};
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200215#endif /* MBEDTLS_RSA_C */
Manuel Pégourié-Gonnardd73b3c12013-08-12 17:06:05 +0200216
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200217#if defined(MBEDTLS_ECP_C)
Manuel Pégourié-Gonnard835eb592013-08-12 18:51:26 +0200218/*
219 * Generic EC key
220 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200221static int eckey_can_do( mbedtls_pk_type_t type )
Manuel Pégourié-Gonnardf18c3e02013-08-12 18:41:18 +0200222{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200223 return( type == MBEDTLS_PK_ECKEY ||
224 type == MBEDTLS_PK_ECKEY_DH ||
225 type == MBEDTLS_PK_ECDSA );
Manuel Pégourié-Gonnardf18c3e02013-08-12 18:41:18 +0200226}
227
Manuel Pégourié-Gonnard39a48f42015-06-18 16:06:55 +0200228static size_t eckey_get_bitlen( const void *ctx )
Manuel Pégourié-Gonnardf8c948a2013-08-12 19:45:32 +0200229{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200230 return( ((mbedtls_ecp_keypair *) ctx)->grp.pbits );
Manuel Pégourié-Gonnardf8c948a2013-08-12 19:45:32 +0200231}
232
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200233#if defined(MBEDTLS_ECDSA_C)
Manuel Pégourié-Gonnard8df27692013-08-21 10:34:38 +0200234/* Forward declarations */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200235static int ecdsa_verify_wrap( void *ctx, mbedtls_md_type_t md_alg,
Manuel Pégourié-Gonnardf73da022013-08-17 14:36:32 +0200236 const unsigned char *hash, size_t hash_len,
Manuel Pégourié-Gonnard09162dd2013-08-14 18:16:50 +0200237 const unsigned char *sig, size_t sig_len );
Manuel Pégourié-Gonnard09162dd2013-08-14 18:16:50 +0200238
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200239static int ecdsa_sign_wrap( void *ctx, mbedtls_md_type_t md_alg,
Manuel Pégourié-Gonnard8df27692013-08-21 10:34:38 +0200240 const unsigned char *hash, size_t hash_len,
241 unsigned char *sig, size_t *sig_len,
242 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng );
243
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200244static int eckey_verify_wrap( void *ctx, mbedtls_md_type_t md_alg,
Manuel Pégourié-Gonnardf73da022013-08-17 14:36:32 +0200245 const unsigned char *hash, size_t hash_len,
Manuel Pégourié-Gonnardd73b3c12013-08-12 17:06:05 +0200246 const unsigned char *sig, size_t sig_len )
247{
Manuel Pégourié-Gonnardd73b3c12013-08-12 17:06:05 +0200248 int ret;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200249 mbedtls_ecdsa_context ecdsa;
Manuel Pégourié-Gonnardd73b3c12013-08-12 17:06:05 +0200250
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200251 mbedtls_ecdsa_init( &ecdsa );
Manuel Pégourié-Gonnardd73b3c12013-08-12 17:06:05 +0200252
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200253 if( ( ret = mbedtls_ecdsa_from_keypair( &ecdsa, ctx ) ) == 0 )
Manuel Pégourié-Gonnard583b6082013-08-20 16:58:13 +0200254 ret = ecdsa_verify_wrap( &ecdsa, md_alg, hash, hash_len, sig, sig_len );
Manuel Pégourié-Gonnardd73b3c12013-08-12 17:06:05 +0200255
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200256 mbedtls_ecdsa_free( &ecdsa );
Manuel Pégourié-Gonnardd73b3c12013-08-12 17:06:05 +0200257
258 return( ret );
Manuel Pégourié-Gonnardd73b3c12013-08-12 17:06:05 +0200259}
Manuel Pégourié-Gonnard8df27692013-08-21 10:34:38 +0200260
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200261static int eckey_sign_wrap( void *ctx, mbedtls_md_type_t md_alg,
Manuel Pégourié-Gonnard8df27692013-08-21 10:34:38 +0200262 const unsigned char *hash, size_t hash_len,
263 unsigned char *sig, size_t *sig_len,
264 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
265{
266 int ret;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200267 mbedtls_ecdsa_context ecdsa;
Manuel Pégourié-Gonnard8df27692013-08-21 10:34:38 +0200268
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200269 mbedtls_ecdsa_init( &ecdsa );
Manuel Pégourié-Gonnard8df27692013-08-21 10:34:38 +0200270
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200271 if( ( ret = mbedtls_ecdsa_from_keypair( &ecdsa, ctx ) ) == 0 )
Manuel Pégourié-Gonnard8df27692013-08-21 10:34:38 +0200272 ret = ecdsa_sign_wrap( &ecdsa, md_alg, hash, hash_len, sig, sig_len,
273 f_rng, p_rng );
274
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200275 mbedtls_ecdsa_free( &ecdsa );
Manuel Pégourié-Gonnard8df27692013-08-21 10:34:38 +0200276
277 return( ret );
278}
279
Manuel Pégourié-Gonnard1f596062017-05-09 10:42:40 +0200280#if defined(MBEDTLS_ECP_RESTARTABLE)
281/* Forward declarations */
282static int ecdsa_verify_rs_wrap( void *ctx, mbedtls_md_type_t md_alg,
283 const unsigned char *hash, size_t hash_len,
284 const unsigned char *sig, size_t sig_len,
285 void *rs_ctx );
286
287static int ecdsa_sign_rs_wrap( void *ctx, mbedtls_md_type_t md_alg,
288 const unsigned char *hash, size_t hash_len,
289 unsigned char *sig, size_t *sig_len,
290 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng,
291 void *rs_ctx );
292
Manuel Pégourié-Gonnardfe687702017-08-18 17:04:07 +0200293/*
294 * Restart context for ECDSA operations with ECKEY context
295 *
296 * We need to store an actual ECDSA context, as we need to pass the same to
297 * the underlying ecdsa function, so we can't create it on the fly every time.
298 */
299typedef struct
300{
301 mbedtls_ecdsa_restart_ctx ecdsa_rs;
302 mbedtls_ecdsa_context ecdsa_ctx;
303} eckey_restart_ctx;
304
305static void *eckey_rs_alloc( void )
306{
307 eckey_restart_ctx *rs_ctx;
308
309 void *ctx = mbedtls_calloc( 1, sizeof( eckey_restart_ctx ) );
310
311 if( ctx != NULL )
312 {
313 rs_ctx = ctx;
314 mbedtls_ecdsa_restart_init( &rs_ctx->ecdsa_rs );
315 mbedtls_ecdsa_init( &rs_ctx->ecdsa_ctx );
316 }
317
318 return( ctx );
319}
320
321static void eckey_rs_free( void *ctx )
322{
323 eckey_restart_ctx *rs_ctx;
324
325 if( ctx == NULL)
326 return;
327
328 rs_ctx = ctx;
329 mbedtls_ecdsa_restart_free( &rs_ctx->ecdsa_rs );
330 mbedtls_ecdsa_free( &rs_ctx->ecdsa_ctx );
331
332 mbedtls_free( ctx );
333}
334
Manuel Pégourié-Gonnard1f596062017-05-09 10:42:40 +0200335static int eckey_verify_rs_wrap( void *ctx, mbedtls_md_type_t md_alg,
336 const unsigned char *hash, size_t hash_len,
337 const unsigned char *sig, size_t sig_len,
Manuel Pégourié-Gonnardfe687702017-08-18 17:04:07 +0200338 void *rs_ctx )
Manuel Pégourié-Gonnard1f596062017-05-09 10:42:40 +0200339{
340 int ret;
Manuel Pégourié-Gonnardfe687702017-08-18 17:04:07 +0200341 eckey_restart_ctx *rs = rs_ctx;
Manuel Pégourié-Gonnard1f596062017-05-09 10:42:40 +0200342
Manuel Pégourié-Gonnardfe687702017-08-18 17:04:07 +0200343 /* Should never happen */
344 if( rs == NULL )
345 return( MBEDTLS_ERR_PK_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard1f596062017-05-09 10:42:40 +0200346
Manuel Pégourié-Gonnardee68cff2018-10-15 15:27:49 +0200347 /* set up our own sub-context if needed (that is, on first run) */
Manuel Pégourié-Gonnardfe687702017-08-18 17:04:07 +0200348 if( rs->ecdsa_ctx.grp.pbits == 0 )
349 MBEDTLS_MPI_CHK( mbedtls_ecdsa_from_keypair( &rs->ecdsa_ctx, ctx ) );
Manuel Pégourié-Gonnard1f596062017-05-09 10:42:40 +0200350
Manuel Pégourié-Gonnardfe687702017-08-18 17:04:07 +0200351 MBEDTLS_MPI_CHK( ecdsa_verify_rs_wrap( &rs->ecdsa_ctx,
352 md_alg, hash, hash_len,
353 sig, sig_len, &rs->ecdsa_rs ) );
Manuel Pégourié-Gonnard1f596062017-05-09 10:42:40 +0200354
355cleanup:
Manuel Pégourié-Gonnard1f596062017-05-09 10:42:40 +0200356 return( ret );
357}
358
359static int eckey_sign_rs_wrap( void *ctx, mbedtls_md_type_t md_alg,
360 const unsigned char *hash, size_t hash_len,
361 unsigned char *sig, size_t *sig_len,
362 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng,
Manuel Pégourié-Gonnardfe687702017-08-18 17:04:07 +0200363 void *rs_ctx )
Manuel Pégourié-Gonnard1f596062017-05-09 10:42:40 +0200364{
365 int ret;
Manuel Pégourié-Gonnardfe687702017-08-18 17:04:07 +0200366 eckey_restart_ctx *rs = rs_ctx;
Manuel Pégourié-Gonnard1f596062017-05-09 10:42:40 +0200367
Manuel Pégourié-Gonnardfe687702017-08-18 17:04:07 +0200368 /* Should never happen */
369 if( rs == NULL )
370 return( MBEDTLS_ERR_PK_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard1f596062017-05-09 10:42:40 +0200371
Manuel Pégourié-Gonnardee68cff2018-10-15 15:27:49 +0200372 /* set up our own sub-context if needed (that is, on first run) */
Manuel Pégourié-Gonnardfe687702017-08-18 17:04:07 +0200373 if( rs->ecdsa_ctx.grp.pbits == 0 )
374 MBEDTLS_MPI_CHK( mbedtls_ecdsa_from_keypair( &rs->ecdsa_ctx, ctx ) );
Manuel Pégourié-Gonnard1f596062017-05-09 10:42:40 +0200375
Manuel Pégourié-Gonnardfe687702017-08-18 17:04:07 +0200376 MBEDTLS_MPI_CHK( ecdsa_sign_rs_wrap( &rs->ecdsa_ctx, md_alg,
377 hash, hash_len, sig, sig_len,
378 f_rng, p_rng, &rs->ecdsa_rs ) );
Manuel Pégourié-Gonnard1f596062017-05-09 10:42:40 +0200379
380cleanup:
Manuel Pégourié-Gonnard1f596062017-05-09 10:42:40 +0200381 return( ret );
382}
383#endif /* MBEDTLS_ECP_RESTARTABLE */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200384#endif /* MBEDTLS_ECDSA_C */
Manuel Pégourié-Gonnardd73b3c12013-08-12 17:06:05 +0200385
Manuel Pégourié-Gonnard70bdadf2014-11-06 16:51:20 +0100386static int eckey_check_pair( const void *pub, const void *prv )
387{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200388 return( mbedtls_ecp_check_pub_priv( (const mbedtls_ecp_keypair *) pub,
389 (const mbedtls_ecp_keypair *) prv ) );
Manuel Pégourié-Gonnard70bdadf2014-11-06 16:51:20 +0100390}
391
Manuel Pégourié-Gonnard765db072013-08-14 15:00:27 +0200392static void *eckey_alloc_wrap( void )
393{
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200394 void *ctx = mbedtls_calloc( 1, sizeof( mbedtls_ecp_keypair ) );
Manuel Pégourié-Gonnard765db072013-08-14 15:00:27 +0200395
396 if( ctx != NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200397 mbedtls_ecp_keypair_init( ctx );
Manuel Pégourié-Gonnard765db072013-08-14 15:00:27 +0200398
399 return( ctx );
400}
401
402static void eckey_free_wrap( void *ctx )
403{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200404 mbedtls_ecp_keypair_free( (mbedtls_ecp_keypair *) ctx );
405 mbedtls_free( ctx );
Manuel Pégourié-Gonnard765db072013-08-14 15:00:27 +0200406}
407
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200408static void eckey_debug( const void *ctx, mbedtls_pk_debug_item *items )
Manuel Pégourié-Gonnardc6ac8872013-08-14 18:04:18 +0200409{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200410 items->type = MBEDTLS_PK_DEBUG_ECP;
Manuel Pégourié-Gonnardc6ac8872013-08-14 18:04:18 +0200411 items->name = "eckey.Q";
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200412 items->value = &( ((mbedtls_ecp_keypair *) ctx)->Q );
Manuel Pégourié-Gonnardc6ac8872013-08-14 18:04:18 +0200413}
414
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200415const mbedtls_pk_info_t mbedtls_eckey_info = {
416 MBEDTLS_PK_ECKEY,
Manuel Pégourié-Gonnardf8c948a2013-08-12 19:45:32 +0200417 "EC",
Manuel Pégourié-Gonnard39a48f42015-06-18 16:06:55 +0200418 eckey_get_bitlen,
Manuel Pégourié-Gonnardf18c3e02013-08-12 18:41:18 +0200419 eckey_can_do,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200420#if defined(MBEDTLS_ECDSA_C)
Manuel Pégourié-Gonnardd73b3c12013-08-12 17:06:05 +0200421 eckey_verify_wrap,
Manuel Pégourié-Gonnard8df27692013-08-21 10:34:38 +0200422 eckey_sign_wrap,
Manuel Pégourié-Gonnard1f596062017-05-09 10:42:40 +0200423#if defined(MBEDTLS_ECP_RESTARTABLE)
424 eckey_verify_rs_wrap,
425 eckey_sign_rs_wrap,
426#endif
427#else /* MBEDTLS_ECDSA_C */
428 NULL,
429 NULL,
Manuel Pégourié-Gonnard1f596062017-05-09 10:42:40 +0200430#endif /* MBEDTLS_ECDSA_C */
Manuel Pégourié-Gonnarda2d3f222013-08-21 11:51:08 +0200431 NULL,
432 NULL,
Manuel Pégourié-Gonnard70bdadf2014-11-06 16:51:20 +0100433 eckey_check_pair,
Manuel Pégourié-Gonnard765db072013-08-14 15:00:27 +0200434 eckey_alloc_wrap,
435 eckey_free_wrap,
Manuel Pégourié-Gonnardaaa98142017-08-18 17:30:37 +0200436#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnard0bbc66c2017-08-18 16:22:06 +0200437 eckey_rs_alloc,
438 eckey_rs_free,
439#endif
Manuel Pégourié-Gonnardc6ac8872013-08-14 18:04:18 +0200440 eckey_debug,
Manuel Pégourié-Gonnardd73b3c12013-08-12 17:06:05 +0200441};
Manuel Pégourié-Gonnard835eb592013-08-12 18:51:26 +0200442
443/*
Paul Bakker75342a62014-04-08 17:35:40 +0200444 * EC key restricted to ECDH
Manuel Pégourié-Gonnard835eb592013-08-12 18:51:26 +0200445 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200446static int eckeydh_can_do( mbedtls_pk_type_t type )
Manuel Pégourié-Gonnard835eb592013-08-12 18:51:26 +0200447{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200448 return( type == MBEDTLS_PK_ECKEY ||
449 type == MBEDTLS_PK_ECKEY_DH );
Manuel Pégourié-Gonnard835eb592013-08-12 18:51:26 +0200450}
451
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200452const mbedtls_pk_info_t mbedtls_eckeydh_info = {
453 MBEDTLS_PK_ECKEY_DH,
Manuel Pégourié-Gonnardf8c948a2013-08-12 19:45:32 +0200454 "EC_DH",
Manuel Pégourié-Gonnard39a48f42015-06-18 16:06:55 +0200455 eckey_get_bitlen, /* Same underlying key structure */
Manuel Pégourié-Gonnard835eb592013-08-12 18:51:26 +0200456 eckeydh_can_do,
Manuel Pégourié-Gonnardfff80f82013-08-17 15:20:06 +0200457 NULL,
Manuel Pégourié-Gonnard8df27692013-08-21 10:34:38 +0200458 NULL,
Manuel Pégourié-Gonnardaaa98142017-08-18 17:30:37 +0200459#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnard1f596062017-05-09 10:42:40 +0200460 NULL,
461 NULL,
462#endif
Manuel Pégourié-Gonnarda2d3f222013-08-21 11:51:08 +0200463 NULL,
464 NULL,
Manuel Pégourié-Gonnard70bdadf2014-11-06 16:51:20 +0100465 eckey_check_pair,
Manuel Pégourié-Gonnard765db072013-08-14 15:00:27 +0200466 eckey_alloc_wrap, /* Same underlying key structure */
467 eckey_free_wrap, /* Same underlying key structure */
Manuel Pégourié-Gonnardaaa98142017-08-18 17:30:37 +0200468#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnard0bbc66c2017-08-18 16:22:06 +0200469 NULL,
470 NULL,
471#endif
Manuel Pégourié-Gonnard09162dd2013-08-14 18:16:50 +0200472 eckey_debug, /* Same underlying key structure */
Manuel Pégourié-Gonnard835eb592013-08-12 18:51:26 +0200473};
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200474#endif /* MBEDTLS_ECP_C */
Manuel Pégourié-Gonnard09162dd2013-08-14 18:16:50 +0200475
Jarno Lamsa42b83db2019-04-16 16:48:22 +0300476#if defined(MBEDTLS_USE_TINYCRYPT)
477static int extract_ecdsa_sig_int( unsigned char **from, const unsigned char *end,
478 unsigned char *to, size_t to_len )
479{
480 int ret;
481 size_t unpadded_len, padding_len;
482
483 if( ( ret = mbedtls_asn1_get_tag( from, end, &unpadded_len,
484 MBEDTLS_ASN1_INTEGER ) ) != 0 )
485 {
486 return( ret );
487 }
488
489 while( unpadded_len > 0 && **from == 0x00 )
490 {
491 ( *from )++;
492 unpadded_len--;
493 }
494
495 if( unpadded_len > to_len || unpadded_len == 0 )
496 return( MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
497
498 padding_len = to_len - unpadded_len;
499 memset( to, 0x00, padding_len );
500 memcpy( to + padding_len, *from, unpadded_len );
501 ( *from ) += unpadded_len;
502
503 return( 0 );
504}
505
506/*
507 * Convert a signature from an ASN.1 sequence of two integers
508 * to a raw {r,s} buffer. Note: the provided sig buffer must be at least
509 * twice as big as int_size.
510 */
511static int extract_ecdsa_sig( unsigned char **p, const unsigned char *end,
512 unsigned char *sig, size_t int_size )
513{
514 int ret;
515 size_t tmp_size;
516
517 if( ( ret = mbedtls_asn1_get_tag( p, end, &tmp_size,
518 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
519 return( ret );
520
521 /* Extract r */
522 if( ( ret = extract_ecdsa_sig_int( p, end, sig, int_size ) ) != 0 )
523 return( ret );
524 /* Extract s */
525 if( ( ret = extract_ecdsa_sig_int( p, end, sig + int_size, int_size ) ) != 0 )
526 return( ret );
527
528 return( 0 );
529}
530
531static size_t uecc_ecdsa_get_bitlen( const void *ctx )
532{
533 (void) ctx;
534 return( (size_t) 2 * NUM_ECC_BYTES );
535}
536
537static int uecc_ecdsa_can_do( mbedtls_pk_type_t type )
538{
539 return( type == MBEDTLS_PK_ECDSA );
540}
541
542static int uecc_ecdsa_verify_wrap( void *ctx, mbedtls_md_type_t md_alg,
543 const unsigned char *hash, size_t hash_len,
544 const unsigned char *sig, size_t sig_len )
545{
546 int ret;
547 uint8_t signature[2*NUM_ECC_BYTES];
548 unsigned char *p;
549 const struct uECC_Curve_t * uecc_curve = uECC_secp256r1();
550
551 ((void) md_alg);
552 p = (unsigned char*) sig;
553
554 if( (ret = extract_ecdsa_sig( &p, sig + sig_len, signature, NUM_ECC_BYTES ) ) != 0 )
555 return( ret );
556
557 if( (ret = uECC_verify( (uint8_t *) ctx, hash, (unsigned) hash_len, signature, uecc_curve ) ) != 0 )
558 return( MBEDTLS_ERR_PK_SIG_LEN_MISMATCH );
559
560 return( ret );
561}
562
563/*
564 * Simultaneously convert and move raw MPI from the beginning of a buffer
565 * to an ASN.1 MPI at the end of the buffer.
566 * See also mbedtls_asn1_write_mpi().
567 *
568 * p: pointer to the end of the output buffer
569 * start: start of the output buffer, and also of the mpi to write at the end
570 * n_len: length of the mpi to read from start
571 */
572static int asn1_write_mpibuf( unsigned char **p, unsigned char *start,
573 size_t n_len )
574{
575 int ret;
576 size_t len = 0;
577
578 if( (size_t)( *p - start ) < n_len )
579 return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL );
580
581 len = n_len;
582 *p -= len;
583 memmove( *p, start, len );
584
585 /* ASN.1 DER encoding requires minimal length, so skip leading 0s.
586 * Neither r nor s should be 0, but as a failsafe measure, still detect
587 * that rather than overflowing the buffer in case of a PSA error. */
588 while( len > 0 && **p == 0x00 )
589 {
590 ++(*p);
591 --len;
592 }
593
594 /* this is only reached if the signature was invalid */
595 if( len == 0 )
596 return( MBEDTLS_ERR_PK_HW_ACCEL_FAILED );
597
598 /* if the msb is 1, ASN.1 requires that we prepend a 0.
599 * Neither r nor s can be 0, so we can assume len > 0 at all times. */
600 if( **p & 0x80 )
601 {
602 if( *p - start < 1 )
603 return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL );
604
605 *--(*p) = 0x00;
606 len += 1;
607 }
608
609 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( p, start, len ) );
610 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( p, start,
611 MBEDTLS_ASN1_INTEGER ) );
612
613 return( (int) len );
614}
615
Jarno Lamsaad789312019-04-23 09:15:54 +0300616/* Transcode signature from uECC format to ASN.1 sequence.
Jarno Lamsa42b83db2019-04-16 16:48:22 +0300617 * See ecdsa_signature_to_asn1 in ecdsa.c, but with byte buffers instead of
618 * MPIs, and in-place.
619 *
620 * [in/out] sig: the signature pre- and post-transcoding
621 * [in/out] sig_len: signature length pre- and post-transcoding
622 * [int] buf_len: the available size the in/out buffer
623 */
624static int pk_ecdsa_sig_asn1_from_psa( unsigned char *sig, size_t *sig_len,
625 size_t buf_len )
626{
627 int ret;
628 size_t len = 0;
629 const size_t rs_len = *sig_len / 2;
630 unsigned char *p = sig + buf_len;
631
632 MBEDTLS_ASN1_CHK_ADD( len, asn1_write_mpibuf( &p, sig + rs_len, rs_len ) );
633 MBEDTLS_ASN1_CHK_ADD( len, asn1_write_mpibuf( &p, sig, rs_len ) );
634
635 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &p, sig, len ) );
636 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &p, sig,
637 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) );
638
639 memmove( sig, p, len );
640 *sig_len = len;
641
642 return( 0 );
643}
644
645static int uecc_ecdsa_sign_wrap( void *ctx, mbedtls_md_type_t md_alg,
646 const unsigned char *hash, size_t hash_len,
647 unsigned char *sig, size_t *sig_len,
648 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
649{
Jarno Lamsaad789312019-04-23 09:15:54 +0300650 const mbedtls_uecc_keypair *keypair = (const mbedtls_uecc_keypair *) ctx;
651 const struct uECC_Curve_t * uecc_curve = uECC_secp256r1();
652
653 uECC_sign(keypair->private_key, hash, hash_len, sig, uecc_curve);
654
655 /* uECC owns its rng function pointer */
Jarno Lamsa42b83db2019-04-16 16:48:22 +0300656 (void) f_rng;
657 (void) p_rng;
Jarno Lamsaad789312019-04-23 09:15:54 +0300658 (void) md_alg;
Jarno Lamsa42b83db2019-04-16 16:48:22 +0300659
Jarno Lamsaad789312019-04-23 09:15:54 +0300660 return( pk_ecdsa_sig_asn1_from_psa( sig, sig_len, 2*NUM_ECC_BYTES ) );
Jarno Lamsa42b83db2019-04-16 16:48:22 +0300661}
662
663static void *uecc_ecdsa_alloc_wrap( void )
664{
665 /*void *ctx = mbedtls_calloc( 1, sizeof( mbedtls_ecdsa_context ) );
666
667 if( ctx != NULL )
668 mbedtls_ecdsa_init( (mbedtls_ecdsa_context *) ctx );
669
670 return( ctx );*/
671 return NULL;
672}
673
674static void uecc_ecdsa_free_wrap( void *ctx )
675{
676 (void) ctx;
677 /*mbedtls_ecdsa_free( (mbedtls_ecdsa_context *) ctx );
678 mbedtls_free( ctx );*/
679}
680
681const mbedtls_pk_info_t mbedtls_uecc_ecdsa_info = {
682 MBEDTLS_PK_ECDSA,
683 "ECDSA",
684 uecc_ecdsa_get_bitlen,
685 uecc_ecdsa_can_do,
686 uecc_ecdsa_verify_wrap,
687 uecc_ecdsa_sign_wrap,
688 NULL,
689 NULL,
690 NULL,
691 uecc_ecdsa_alloc_wrap,
692 uecc_ecdsa_free_wrap,
693 NULL,
694};
695#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200696#if defined(MBEDTLS_ECDSA_C)
697static int ecdsa_can_do( mbedtls_pk_type_t type )
Manuel Pégourié-Gonnard09162dd2013-08-14 18:16:50 +0200698{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200699 return( type == MBEDTLS_PK_ECDSA );
Manuel Pégourié-Gonnard09162dd2013-08-14 18:16:50 +0200700}
701
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200702static int ecdsa_verify_wrap( void *ctx, mbedtls_md_type_t md_alg,
Manuel Pégourié-Gonnardf73da022013-08-17 14:36:32 +0200703 const unsigned char *hash, size_t hash_len,
Manuel Pégourié-Gonnard09162dd2013-08-14 18:16:50 +0200704 const unsigned char *sig, size_t sig_len )
705{
Manuel Pégourié-Gonnard2abed842014-04-08 12:40:15 +0200706 int ret;
Manuel Pégourié-Gonnardf73da022013-08-17 14:36:32 +0200707 ((void) md_alg);
708
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200709 ret = mbedtls_ecdsa_read_signature( (mbedtls_ecdsa_context *) ctx,
Manuel Pégourié-Gonnard2abed842014-04-08 12:40:15 +0200710 hash, hash_len, sig, sig_len );
711
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200712 if( ret == MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH )
713 return( MBEDTLS_ERR_PK_SIG_LEN_MISMATCH );
Manuel Pégourié-Gonnard2abed842014-04-08 12:40:15 +0200714
715 return( ret );
Manuel Pégourié-Gonnard09162dd2013-08-14 18:16:50 +0200716}
717
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200718static int ecdsa_sign_wrap( void *ctx, mbedtls_md_type_t md_alg,
Manuel Pégourié-Gonnard8df27692013-08-21 10:34:38 +0200719 const unsigned char *hash, size_t hash_len,
720 unsigned char *sig, size_t *sig_len,
721 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
722{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200723 return( mbedtls_ecdsa_write_signature( (mbedtls_ecdsa_context *) ctx,
Manuel Pégourié-Gonnarddfdcac92015-03-31 11:41:42 +0200724 md_alg, hash, hash_len, sig, sig_len, f_rng, p_rng ) );
Manuel Pégourié-Gonnard8df27692013-08-21 10:34:38 +0200725}
726
Manuel Pégourié-Gonnard1f596062017-05-09 10:42:40 +0200727#if defined(MBEDTLS_ECP_RESTARTABLE)
728static int ecdsa_verify_rs_wrap( void *ctx, mbedtls_md_type_t md_alg,
729 const unsigned char *hash, size_t hash_len,
730 const unsigned char *sig, size_t sig_len,
731 void *rs_ctx )
732{
733 int ret;
734 ((void) md_alg);
735
736 ret = mbedtls_ecdsa_read_signature_restartable(
737 (mbedtls_ecdsa_context *) ctx,
738 hash, hash_len, sig, sig_len,
739 (mbedtls_ecdsa_restart_ctx *) rs_ctx );
740
741 if( ret == MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH )
742 return( MBEDTLS_ERR_PK_SIG_LEN_MISMATCH );
743
744 return( ret );
745}
746
747static int ecdsa_sign_rs_wrap( void *ctx, mbedtls_md_type_t md_alg,
748 const unsigned char *hash, size_t hash_len,
749 unsigned char *sig, size_t *sig_len,
750 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng,
751 void *rs_ctx )
752{
753 return( mbedtls_ecdsa_write_signature_restartable(
754 (mbedtls_ecdsa_context *) ctx,
755 md_alg, hash, hash_len, sig, sig_len, f_rng, p_rng,
756 (mbedtls_ecdsa_restart_ctx *) rs_ctx ) );
757
758}
759#endif /* MBEDTLS_ECP_RESTARTABLE */
760
Manuel Pégourié-Gonnard09162dd2013-08-14 18:16:50 +0200761static void *ecdsa_alloc_wrap( void )
762{
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200763 void *ctx = mbedtls_calloc( 1, sizeof( mbedtls_ecdsa_context ) );
Manuel Pégourié-Gonnard09162dd2013-08-14 18:16:50 +0200764
765 if( ctx != NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200766 mbedtls_ecdsa_init( (mbedtls_ecdsa_context *) ctx );
Manuel Pégourié-Gonnard09162dd2013-08-14 18:16:50 +0200767
768 return( ctx );
769}
770
771static void ecdsa_free_wrap( void *ctx )
772{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200773 mbedtls_ecdsa_free( (mbedtls_ecdsa_context *) ctx );
774 mbedtls_free( ctx );
Manuel Pégourié-Gonnard09162dd2013-08-14 18:16:50 +0200775}
776
Manuel Pégourié-Gonnardfe687702017-08-18 17:04:07 +0200777#if defined(MBEDTLS_ECP_RESTARTABLE)
778static void *ecdsa_rs_alloc( void )
779{
780 void *ctx = mbedtls_calloc( 1, sizeof( mbedtls_ecdsa_restart_ctx ) );
781
782 if( ctx != NULL )
783 mbedtls_ecdsa_restart_init( ctx );
784
785 return( ctx );
786}
787
788static void ecdsa_rs_free( void *ctx )
789{
790 mbedtls_ecdsa_restart_free( ctx );
791 mbedtls_free( ctx );
792}
793#endif /* MBEDTLS_ECP_RESTARTABLE */
794
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200795const mbedtls_pk_info_t mbedtls_ecdsa_info = {
796 MBEDTLS_PK_ECDSA,
Manuel Pégourié-Gonnard09162dd2013-08-14 18:16:50 +0200797 "ECDSA",
Manuel Pégourié-Gonnard39a48f42015-06-18 16:06:55 +0200798 eckey_get_bitlen, /* Compatible key structures */
Manuel Pégourié-Gonnard09162dd2013-08-14 18:16:50 +0200799 ecdsa_can_do,
800 ecdsa_verify_wrap,
Manuel Pégourié-Gonnard8df27692013-08-21 10:34:38 +0200801 ecdsa_sign_wrap,
Manuel Pégourié-Gonnard1f596062017-05-09 10:42:40 +0200802#if defined(MBEDTLS_ECP_RESTARTABLE)
803 ecdsa_verify_rs_wrap,
804 ecdsa_sign_rs_wrap,
805#endif
Manuel Pégourié-Gonnarda2d3f222013-08-21 11:51:08 +0200806 NULL,
807 NULL,
Manuel Pégourié-Gonnard70bdadf2014-11-06 16:51:20 +0100808 eckey_check_pair, /* Compatible key structures */
Manuel Pégourié-Gonnard09162dd2013-08-14 18:16:50 +0200809 ecdsa_alloc_wrap,
810 ecdsa_free_wrap,
Manuel Pégourié-Gonnard0bbc66c2017-08-18 16:22:06 +0200811#if defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnardfe687702017-08-18 17:04:07 +0200812 ecdsa_rs_alloc,
813 ecdsa_rs_free,
Manuel Pégourié-Gonnard0bbc66c2017-08-18 16:22:06 +0200814#endif
Manuel Pégourié-Gonnard09162dd2013-08-14 18:16:50 +0200815 eckey_debug, /* Compatible key structures */
816};
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200817#endif /* MBEDTLS_ECDSA_C */
Jarno Lamsa42b83db2019-04-16 16:48:22 +0300818#endif /* MBEDTLS_USE_TINYCRYPT */
Manuel Pégourié-Gonnard12c1ff02013-08-21 12:28:31 +0200819
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200820#if defined(MBEDTLS_PK_RSA_ALT_SUPPORT)
Manuel Pégourié-Gonnard12c1ff02013-08-21 12:28:31 +0200821/*
822 * Support for alternative RSA-private implementations
823 */
824
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200825static int rsa_alt_can_do( mbedtls_pk_type_t type )
Manuel Pégourié-Gonnard20422e92014-06-05 13:41:44 +0200826{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200827 return( type == MBEDTLS_PK_RSA );
Manuel Pégourié-Gonnard20422e92014-06-05 13:41:44 +0200828}
829
Manuel Pégourié-Gonnard39a48f42015-06-18 16:06:55 +0200830static size_t rsa_alt_get_bitlen( const void *ctx )
Manuel Pégourié-Gonnard12c1ff02013-08-21 12:28:31 +0200831{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200832 const mbedtls_rsa_alt_context *rsa_alt = (const mbedtls_rsa_alt_context *) ctx;
Manuel Pégourié-Gonnard12c1ff02013-08-21 12:28:31 +0200833
Manuel Pégourié-Gonnard01488752014-04-03 22:09:18 +0200834 return( 8 * rsa_alt->key_len_func( rsa_alt->key ) );
Manuel Pégourié-Gonnard12c1ff02013-08-21 12:28:31 +0200835}
836
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200837static int rsa_alt_sign_wrap( void *ctx, mbedtls_md_type_t md_alg,
Manuel Pégourié-Gonnard12c1ff02013-08-21 12:28:31 +0200838 const unsigned char *hash, size_t hash_len,
839 unsigned char *sig, size_t *sig_len,
840 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
841{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200842 mbedtls_rsa_alt_context *rsa_alt = (mbedtls_rsa_alt_context *) ctx;
Manuel Pégourié-Gonnard12c1ff02013-08-21 12:28:31 +0200843
Andres Amaya Garcia7c02c502017-08-04 13:32:15 +0100844#if SIZE_MAX > UINT_MAX
Andres AG72849872017-01-19 11:24:33 +0000845 if( UINT_MAX < hash_len )
846 return( MBEDTLS_ERR_PK_BAD_INPUT_DATA );
Andres Amaya Garcia7c02c502017-08-04 13:32:15 +0100847#endif /* SIZE_MAX > UINT_MAX */
Andres AG72849872017-01-19 11:24:33 +0000848
Manuel Pégourié-Gonnard12c1ff02013-08-21 12:28:31 +0200849 *sig_len = rsa_alt->key_len_func( rsa_alt->key );
850
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200851 return( rsa_alt->sign_func( rsa_alt->key, f_rng, p_rng, MBEDTLS_RSA_PRIVATE,
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200852 md_alg, (unsigned int) hash_len, hash, sig ) );
Manuel Pégourié-Gonnard12c1ff02013-08-21 12:28:31 +0200853}
854
855static int rsa_alt_decrypt_wrap( void *ctx,
856 const unsigned char *input, size_t ilen,
857 unsigned char *output, size_t *olen, size_t osize,
858 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
859{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200860 mbedtls_rsa_alt_context *rsa_alt = (mbedtls_rsa_alt_context *) ctx;
Manuel Pégourié-Gonnard12c1ff02013-08-21 12:28:31 +0200861
862 ((void) f_rng);
863 ((void) p_rng);
864
865 if( ilen != rsa_alt->key_len_func( rsa_alt->key ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200866 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard12c1ff02013-08-21 12:28:31 +0200867
868 return( rsa_alt->decrypt_func( rsa_alt->key,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200869 MBEDTLS_RSA_PRIVATE, olen, input, output, osize ) );
Manuel Pégourié-Gonnard12c1ff02013-08-21 12:28:31 +0200870}
871
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200872#if defined(MBEDTLS_RSA_C)
Manuel Pégourié-Gonnarda1efcb02014-11-08 17:08:08 +0100873static int rsa_alt_check_pair( const void *pub, const void *prv )
874{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200875 unsigned char sig[MBEDTLS_MPI_MAX_SIZE];
Manuel Pégourié-Gonnarda1efcb02014-11-08 17:08:08 +0100876 unsigned char hash[32];
877 size_t sig_len = 0;
878 int ret;
879
Manuel Pégourié-Gonnard39a48f42015-06-18 16:06:55 +0200880 if( rsa_alt_get_bitlen( prv ) != rsa_get_bitlen( pub ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200881 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
Manuel Pégourié-Gonnarda1efcb02014-11-08 17:08:08 +0100882
883 memset( hash, 0x2a, sizeof( hash ) );
884
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200885 if( ( ret = rsa_alt_sign_wrap( (void *) prv, MBEDTLS_MD_NONE,
Manuel Pégourié-Gonnarda1efcb02014-11-08 17:08:08 +0100886 hash, sizeof( hash ),
887 sig, &sig_len, NULL, NULL ) ) != 0 )
888 {
889 return( ret );
890 }
891
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200892 if( rsa_verify_wrap( (void *) pub, MBEDTLS_MD_NONE,
Manuel Pégourié-Gonnarda1efcb02014-11-08 17:08:08 +0100893 hash, sizeof( hash ), sig, sig_len ) != 0 )
894 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200895 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
Manuel Pégourié-Gonnarda1efcb02014-11-08 17:08:08 +0100896 }
897
898 return( 0 );
899}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200900#endif /* MBEDTLS_RSA_C */
Manuel Pégourié-Gonnarda1efcb02014-11-08 17:08:08 +0100901
Manuel Pégourié-Gonnard12c1ff02013-08-21 12:28:31 +0200902static void *rsa_alt_alloc_wrap( void )
903{
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200904 void *ctx = mbedtls_calloc( 1, sizeof( mbedtls_rsa_alt_context ) );
Manuel Pégourié-Gonnard12c1ff02013-08-21 12:28:31 +0200905
906 if( ctx != NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200907 memset( ctx, 0, sizeof( mbedtls_rsa_alt_context ) );
Manuel Pégourié-Gonnard12c1ff02013-08-21 12:28:31 +0200908
Paul Bakkerd8bb8262014-06-17 14:06:49 +0200909 return( ctx );
Manuel Pégourié-Gonnard12c1ff02013-08-21 12:28:31 +0200910}
911
912static void rsa_alt_free_wrap( void *ctx )
913{
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500914 mbedtls_platform_zeroize( ctx, sizeof( mbedtls_rsa_alt_context ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200915 mbedtls_free( ctx );
Manuel Pégourié-Gonnard12c1ff02013-08-21 12:28:31 +0200916}
917
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200918const mbedtls_pk_info_t mbedtls_rsa_alt_info = {
919 MBEDTLS_PK_RSA_ALT,
Manuel Pégourié-Gonnard12c1ff02013-08-21 12:28:31 +0200920 "RSA-alt",
Manuel Pégourié-Gonnard39a48f42015-06-18 16:06:55 +0200921 rsa_alt_get_bitlen,
Manuel Pégourié-Gonnard20422e92014-06-05 13:41:44 +0200922 rsa_alt_can_do,
Manuel Pégourié-Gonnard12c1ff02013-08-21 12:28:31 +0200923 NULL,
924 rsa_alt_sign_wrap,
Manuel Pégourié-Gonnardaaa98142017-08-18 17:30:37 +0200925#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnard1f596062017-05-09 10:42:40 +0200926 NULL,
927 NULL,
928#endif
Manuel Pégourié-Gonnard12c1ff02013-08-21 12:28:31 +0200929 rsa_alt_decrypt_wrap,
930 NULL,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200931#if defined(MBEDTLS_RSA_C)
Manuel Pégourié-Gonnarda1efcb02014-11-08 17:08:08 +0100932 rsa_alt_check_pair,
Manuel Pégourié-Gonnard7c13d692014-11-12 00:01:34 +0100933#else
934 NULL,
935#endif
Manuel Pégourié-Gonnard12c1ff02013-08-21 12:28:31 +0200936 rsa_alt_alloc_wrap,
937 rsa_alt_free_wrap,
Manuel Pégourié-Gonnardaaa98142017-08-18 17:30:37 +0200938#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnard0bbc66c2017-08-18 16:22:06 +0200939 NULL,
940 NULL,
941#endif
Manuel Pégourié-Gonnard12c1ff02013-08-21 12:28:31 +0200942 NULL,
943};
Manuel Pégourié-Gonnardc40b4c32013-08-22 13:29:31 +0200944
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200945#endif /* MBEDTLS_PK_RSA_ALT_SUPPORT */
Manuel Pégourié-Gonnard348bcb32015-03-31 14:01:33 +0200946
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200947#endif /* MBEDTLS_PK_C */