mirror of
https://github.com/Laupetin/OpenAssetTools.git
synced 2025-04-22 17:15:46 +00:00
201 lines
7.4 KiB
C
201 lines
7.4 KiB
C
/* LibTomCrypt, modular cryptographic library -- Tom St Denis
|
|
*
|
|
* LibTomCrypt is a library that provides various cryptographic
|
|
* algorithms in a highly modular and flexible manner.
|
|
*
|
|
* The library is free for all purposes without any express
|
|
* guarantee it works.
|
|
*/
|
|
|
|
#include "tomcrypt.h"
|
|
|
|
#ifdef LTC_MECC
|
|
|
|
/**
|
|
@file ecc_verify_hash.c
|
|
ECC Crypto, Tom St Denis
|
|
*/
|
|
|
|
static int _ecc_verify_hash(const unsigned char *sig, unsigned long siglen,
|
|
const unsigned char *hash, unsigned long hashlen,
|
|
int *stat, ecc_key *key, int sigformat)
|
|
{
|
|
ecc_point *mG, *mQ;
|
|
void *r, *s, *v, *w, *u1, *u2, *e, *p, *m;
|
|
void *mp;
|
|
int err;
|
|
unsigned long pbits, pbytes, i, shift_right;
|
|
unsigned char ch, buf[MAXBLOCKSIZE];
|
|
|
|
LTC_ARGCHK(sig != NULL);
|
|
LTC_ARGCHK(hash != NULL);
|
|
LTC_ARGCHK(stat != NULL);
|
|
LTC_ARGCHK(key != NULL);
|
|
|
|
/* default to invalid signature */
|
|
*stat = 0;
|
|
mp = NULL;
|
|
|
|
/* is the IDX valid ? */
|
|
if (ltc_ecc_is_valid_idx(key->idx) != 1) {
|
|
return CRYPT_PK_INVALID_TYPE;
|
|
}
|
|
|
|
/* allocate ints */
|
|
if ((err = mp_init_multi(&r, &s, &v, &w, &u1, &u2, &p, &e, &m, NULL)) != CRYPT_OK) {
|
|
return CRYPT_MEM;
|
|
}
|
|
|
|
/* allocate points */
|
|
mG = ltc_ecc_new_point();
|
|
mQ = ltc_ecc_new_point();
|
|
if (mQ == NULL || mG == NULL) {
|
|
err = CRYPT_MEM;
|
|
goto error;
|
|
}
|
|
|
|
if (sigformat == 1) {
|
|
/* RFC7518 format */
|
|
if ((siglen % 2) == 1) {
|
|
err = CRYPT_INVALID_PACKET;
|
|
goto error;
|
|
}
|
|
i = siglen / 2;
|
|
if ((err = mp_read_unsigned_bin(r, (unsigned char *)sig, i)) != CRYPT_OK) { goto error; }
|
|
if ((err = mp_read_unsigned_bin(s, (unsigned char *)sig+i, i)) != CRYPT_OK) { goto error; }
|
|
}
|
|
else {
|
|
/* ASN.1 format */
|
|
if ((err = der_decode_sequence_multi(sig, siglen,
|
|
LTC_ASN1_INTEGER, 1UL, r,
|
|
LTC_ASN1_INTEGER, 1UL, s,
|
|
LTC_ASN1_EOL, 0UL, NULL)) != CRYPT_OK) { goto error; }
|
|
}
|
|
|
|
/* get the order */
|
|
if ((err = mp_read_radix(p, (char *)key->dp->order, 16)) != CRYPT_OK) { goto error; }
|
|
|
|
/* get the modulus */
|
|
if ((err = mp_read_radix(m, (char *)key->dp->prime, 16)) != CRYPT_OK) { goto error; }
|
|
|
|
/* check for zero */
|
|
if (mp_iszero(r) || mp_iszero(s) || mp_cmp(r, p) != LTC_MP_LT || mp_cmp(s, p) != LTC_MP_LT) {
|
|
err = CRYPT_INVALID_PACKET;
|
|
goto error;
|
|
}
|
|
|
|
/* read hash - truncate if needed */
|
|
pbits = mp_count_bits(p);
|
|
pbytes = (pbits+7) >> 3;
|
|
if (pbits > hashlen*8) {
|
|
if ((err = mp_read_unsigned_bin(e, (unsigned char *)hash, hashlen)) != CRYPT_OK) { goto error; }
|
|
}
|
|
else if (pbits % 8 == 0) {
|
|
if ((err = mp_read_unsigned_bin(e, (unsigned char *)hash, pbytes)) != CRYPT_OK) { goto error; }
|
|
}
|
|
else {
|
|
shift_right = 8 - pbits % 8;
|
|
for (i=0, ch=0; i<pbytes; i++) {
|
|
buf[i] = ch;
|
|
ch = (hash[i] << (8-shift_right));
|
|
buf[i] = buf[i] ^ (hash[i] >> shift_right);
|
|
}
|
|
if ((err = mp_read_unsigned_bin(e, (unsigned char *)buf, pbytes)) != CRYPT_OK) { goto error; }
|
|
}
|
|
|
|
/* w = s^-1 mod n */
|
|
if ((err = mp_invmod(s, p, w)) != CRYPT_OK) { goto error; }
|
|
|
|
/* u1 = ew */
|
|
if ((err = mp_mulmod(e, w, p, u1)) != CRYPT_OK) { goto error; }
|
|
|
|
/* u2 = rw */
|
|
if ((err = mp_mulmod(r, w, p, u2)) != CRYPT_OK) { goto error; }
|
|
|
|
/* find mG and mQ */
|
|
if ((err = mp_read_radix(mG->x, (char *)key->dp->Gx, 16)) != CRYPT_OK) { goto error; }
|
|
if ((err = mp_read_radix(mG->y, (char *)key->dp->Gy, 16)) != CRYPT_OK) { goto error; }
|
|
if ((err = mp_set(mG->z, 1)) != CRYPT_OK) { goto error; }
|
|
|
|
if ((err = mp_copy(key->pubkey.x, mQ->x)) != CRYPT_OK) { goto error; }
|
|
if ((err = mp_copy(key->pubkey.y, mQ->y)) != CRYPT_OK) { goto error; }
|
|
if ((err = mp_copy(key->pubkey.z, mQ->z)) != CRYPT_OK) { goto error; }
|
|
|
|
/* compute u1*mG + u2*mQ = mG */
|
|
if (ltc_mp.ecc_mul2add == NULL) {
|
|
if ((err = ltc_mp.ecc_ptmul(u1, mG, mG, m, 0)) != CRYPT_OK) { goto error; }
|
|
if ((err = ltc_mp.ecc_ptmul(u2, mQ, mQ, m, 0)) != CRYPT_OK) { goto error; }
|
|
|
|
/* find the montgomery mp */
|
|
if ((err = mp_montgomery_setup(m, &mp)) != CRYPT_OK) { goto error; }
|
|
|
|
/* add them */
|
|
if ((err = ltc_mp.ecc_ptadd(mQ, mG, mG, m, mp)) != CRYPT_OK) { goto error; }
|
|
|
|
/* reduce */
|
|
if ((err = ltc_mp.ecc_map(mG, m, mp)) != CRYPT_OK) { goto error; }
|
|
} else {
|
|
/* use Shamir's trick to compute u1*mG + u2*mQ using half of the doubles */
|
|
if ((err = ltc_mp.ecc_mul2add(mG, u1, mQ, u2, mG, m)) != CRYPT_OK) { goto error; }
|
|
}
|
|
|
|
/* v = X_x1 mod n */
|
|
if ((err = mp_mod(mG->x, p, v)) != CRYPT_OK) { goto error; }
|
|
|
|
/* does v == r */
|
|
if (mp_cmp(v, r) == LTC_MP_EQ) {
|
|
*stat = 1;
|
|
}
|
|
|
|
/* clear up and return */
|
|
err = CRYPT_OK;
|
|
error:
|
|
ltc_ecc_del_point(mG);
|
|
ltc_ecc_del_point(mQ);
|
|
mp_clear_multi(r, s, v, w, u1, u2, p, e, m, NULL);
|
|
if (mp != NULL) {
|
|
mp_montgomery_free(mp);
|
|
}
|
|
return err;
|
|
}
|
|
|
|
/**
|
|
Verify an ECC signature
|
|
@param sig The signature to verify
|
|
@param siglen The length of the signature (octets)
|
|
@param hash The hash (message digest) that was signed
|
|
@param hashlen The length of the hash (octets)
|
|
@param stat Result of signature, 1==valid, 0==invalid
|
|
@param key The corresponding public ECC key
|
|
@return CRYPT_OK if successful (even if the signature is not valid)
|
|
*/
|
|
int ecc_verify_hash(const unsigned char *sig, unsigned long siglen,
|
|
const unsigned char *hash, unsigned long hashlen,
|
|
int *stat, ecc_key *key)
|
|
{
|
|
return _ecc_verify_hash(sig, siglen, hash, hashlen, stat, key, 0);
|
|
}
|
|
|
|
/**
|
|
Verify an ECC signature in RFC7518 format
|
|
@param sig The signature to verify
|
|
@param siglen The length of the signature (octets)
|
|
@param hash The hash (message digest) that was signed
|
|
@param hashlen The length of the hash (octets)
|
|
@param stat Result of signature, 1==valid, 0==invalid
|
|
@param key The corresponding public ECC key
|
|
@return CRYPT_OK if successful (even if the signature is not valid)
|
|
*/
|
|
int ecc_verify_hash_rfc7518(const unsigned char *sig, unsigned long siglen,
|
|
const unsigned char *hash, unsigned long hashlen,
|
|
int *stat, ecc_key *key)
|
|
{
|
|
return _ecc_verify_hash(sig, siglen, hash, hashlen, stat, key, 1);
|
|
}
|
|
|
|
#endif
|
|
|
|
/* ref: HEAD -> master, tag: v1.18.2 */
|
|
/* git commit: 7e7eb695d581782f04b24dc444cbfde86af59853 */
|
|
/* commit time: 2018-07-01 22:49:01 +0200 */
|