Lines Matching +full:compute +full:-
2 * Copyright (C) 2017 - This file is part of libecc project
7 * Jean-Pierre FLORI <jean-pierre.flori@ssi.gouv.fr>
32 * NOTE: ISO/IEC 14888-3 standard seems to diverge from the existing implementations
34 * in RFC 7091 and draft-deremin-rfc4491-bis. While in ISO/IEC 14888-3 it is explicitely asked
37 * (this discrepancy is exhibited and confirmed by test vectors present in ISO/IEC 14888-3, and
39 * ISO/IEC 14888-3 algorithm description that must be fixed there.
42 * other implemetations, but keeps the ISO/IEC 14888-3 behavior if forced/asked by the user using
60 buf[i] = buf[buf_size - 1 - i]; in _reverse_endianness()
61 buf[buf_size - 1 - i] = tmp; in _reverse_endianness()
83 q = &(in_priv->params->ec_gen_order); in ecrdsa_init_pub_key()
86 MUST_HAVE((!nn_cmp(&(in_priv->x), q, &cmp)) && (cmp < 0), ret, err); in ecrdsa_init_pub_key()
89 G = &(in_priv->params->ec_gen); in ecrdsa_init_pub_key()
91 ret = prj_pt_mul_blind(&(out_pub->y), &(in_priv->x), G); EG(ret, err); in ecrdsa_init_pub_key()
93 out_pub->key_type = ECRDSA; in ecrdsa_init_pub_key()
94 out_pub->params = in_priv->params; in ecrdsa_init_pub_key()
95 out_pub->magic = PUB_KEY_MAGIC; in ecrdsa_init_pub_key()
117 * Generic *internal* EC-RDSA signature functions (init, update and finalize).
123 * Global EC-RDSA signature process is as follows (I,U,F provides
127 *| IUF - EC-RDSA signature
129 *| UF 1. Compute h = H(m)
131 *| F 3. Compute W = (W_x,W_y) = kG
132 *| F 4. Compute r = W_x mod q
134 *| F 6. Compute e = OS2I(h) mod q. If e is 0, set e to 1.
135 *| NOTE: here, ISO/IEC 14888-3 and RFCs differ in the way e treated.
136 *| e = OS2I(h) for ISO/IEC 14888-3, or e = OS2I(reversed(h)) when endianness of h
138 *| F 7. Compute s = (rx + ke) mod q
147 ((A)->magic == ECRDSA_SIGN_MAGIC), ret, err)
157 ret = key_pair_check_initialized_and_type(ctx->key_pair, ECRDSA); EG(ret, err); in _ecrdsa_sign_init()
158 MUST_HAVE((ctx->h != NULL) && (ctx->h->digest_size <= MAX_DIGEST_SIZE) && in _ecrdsa_sign_init()
159 (ctx->h->block_size <= MAX_BLOCK_SIZE), ret, err); in _ecrdsa_sign_init()
166 ret = hash_mapping_callbacks_sanity_check(ctx->h); EG(ret, err); in _ecrdsa_sign_init()
167 ret = ctx->h->hfunc_init(&(ctx->sign_data.ecrdsa.h_ctx)); EG(ret, err); in _ecrdsa_sign_init()
169 ctx->sign_data.ecrdsa.magic = ECRDSA_SIGN_MAGIC; in _ecrdsa_sign_init()
181 * part too. This guarantees the context is an EC-RDSA in _ecrdsa_sign_update()
186 ECRDSA_SIGN_CHECK_INITIALIZED(&(ctx->sign_data.ecrdsa), ret, err); in _ecrdsa_sign_update()
189 ret = hash_mapping_callbacks_sanity_check(ctx->h); EG(ret, err); in _ecrdsa_sign_update()
190 ret = ctx->h->hfunc_update(&(ctx->sign_data.ecrdsa.h_ctx), chunk, chunklen); in _ecrdsa_sign_update()
219 * part too. This guarantees the context is an EC-RDSA in _ecrdsa_sign_finalize()
223 ECRDSA_SIGN_CHECK_INITIALIZED(&(ctx->sign_data.ecrdsa), ret, err); in _ecrdsa_sign_finalize()
229 priv_key = &(ctx->key_pair->priv_key); in _ecrdsa_sign_finalize()
230 G = &(priv_key->params->ec_gen); in _ecrdsa_sign_finalize()
231 q = &(priv_key->params->ec_gen_order); in _ecrdsa_sign_finalize()
232 p_bit_len = priv_key->params->ec_fp.p_bitlen; in _ecrdsa_sign_finalize()
233 q_bit_len = priv_key->params->ec_gen_order_bitlen; in _ecrdsa_sign_finalize()
234 x = &(priv_key->x); in _ecrdsa_sign_finalize()
237 hsize = ctx->h->digest_size; in _ecrdsa_sign_finalize()
246 dbg_nn_print("p", &(priv_key->params->ec_fp.p)); in _ecrdsa_sign_finalize()
249 dbg_pub_key_print("Y", &(ctx->key_pair->pub_key)); in _ecrdsa_sign_finalize()
260 MUST_HAVE((ctx->rand == nn_get_random_mod), ret, err); in _ecrdsa_sign_finalize()
262 MUST_HAVE((ctx->rand != NULL), ret, err); in _ecrdsa_sign_finalize()
263 ret = ctx->rand(&k, q); EG(ret, err); in _ecrdsa_sign_finalize()
273 /* 3. Compute W = kG = (Wx, Wy) */ in _ecrdsa_sign_finalize()
284 /* 4. Compute r = Wx mod q */ in _ecrdsa_sign_finalize()
297 /* 6. Compute e = OS2I(h) mod q. If e is 0, set e to 1. */ in _ecrdsa_sign_finalize()
300 ret = hash_mapping_callbacks_sanity_check(ctx->h); EG(ret, err); in _ecrdsa_sign_finalize()
301 ret = ctx->h->hfunc_finalize(&(ctx->sign_data.ecrdsa.h_ctx), h_buf); EG(ret, err); in _ecrdsa_sign_finalize()
303 /* NOTE: this handles a discrepancy between ISO/IEC 14888-3 and in _ecrdsa_sign_finalize()
324 /* Compute s = (rx + ke) mod q */ in _ecrdsa_sign_finalize()
368 IGNORE_RET_VAL(local_memset(&(ctx->sign_data.ecrdsa), 0, sizeof(ecrdsa_sign_data))); in _ecrdsa_sign_finalize()
388 ((A)->magic == ECRDSA_VERIFY_MAGIC), ret, err)
391 * Generic *internal* EC-RDSA verification functions (init, update and finalize).
397 * Global EC-RDSA verification process is as follows (I,U,F provides
401 *| IUF - EC-RDSA verification
404 *| F 2. Compute h = H(m)
405 *| F 3. Compute e = OS2I(h)^-1 mod q
406 *| NOTE: here, ISO/IEC 14888-3 and RFCs differ in the way e treated.
407 *| e = OS2I(h) for ISO/IEC 14888-3, or e = OS2I(reversed(h)) when endianness of h
409 *| F 4. Compute u = es mod q
410 *| F 5. Compute v = -er mod q
411 *| F 6. Compute W' = uG + vY = (W'_x, W'_y)
412 *| F 7. Compute r' = W'_x mod q
431 ret = pub_key_check_initialized_and_type(ctx->pub_key, ECRDSA); EG(ret, err); in _ecrdsa_verify_init()
432 MUST_HAVE((ctx->h != NULL) && (ctx->h->digest_size <= MAX_DIGEST_SIZE) && in _ecrdsa_verify_init()
433 (ctx->h->block_size <= MAX_BLOCK_SIZE), ret, err); in _ecrdsa_verify_init()
436 q = &(ctx->pub_key->params->ec_gen_order); in _ecrdsa_verify_init()
437 q_bit_len = ctx->pub_key->params->ec_gen_order_bitlen; in _ecrdsa_verify_init()
453 ret = nn_copy(&(ctx->verify_data.ecrdsa.r), &r); EG(ret, err); in _ecrdsa_verify_init()
454 ret = nn_copy(&(ctx->verify_data.ecrdsa.s), &s); EG(ret, err); in _ecrdsa_verify_init()
456 ret = hash_mapping_callbacks_sanity_check(ctx->h); EG(ret, err); in _ecrdsa_verify_init()
457 ret = ctx->h->hfunc_init(&(ctx->verify_data.ecrdsa.h_ctx)); EG(ret, err); in _ecrdsa_verify_init()
459 ctx->verify_data.ecrdsa.magic = ECRDSA_VERIFY_MAGIC; in _ecrdsa_verify_init()
481 * part too. This guarantees the context is an EC-RDSA in _ecrdsa_verify_update()
486 ECRDSA_VERIFY_CHECK_INITIALIZED(&(ctx->verify_data.ecrdsa), ret, err); in _ecrdsa_verify_update()
488 /* 2. Compute h = H(m) */ in _ecrdsa_verify_update()
490 ret = hash_mapping_callbacks_sanity_check(ctx->h); EG(ret, err); in _ecrdsa_verify_update()
491 ret = ctx->h->hfunc_update(&(ctx->verify_data.ecrdsa.h_ctx), chunk, in _ecrdsa_verify_update()
518 * part too. This guarantees the context is an EC-RDSA in _ecrdsa_verify_finalize()
522 ECRDSA_VERIFY_CHECK_INITIALIZED(&(ctx->verify_data.ecrdsa), ret, err); in _ecrdsa_verify_finalize()
529 G = &(ctx->pub_key->params->ec_gen); in _ecrdsa_verify_finalize()
530 Y = &(ctx->pub_key->y); in _ecrdsa_verify_finalize()
531 q = &(ctx->pub_key->params->ec_gen_order); in _ecrdsa_verify_finalize()
532 r = &(ctx->verify_data.ecrdsa.r); in _ecrdsa_verify_finalize()
533 s = &(ctx->verify_data.ecrdsa.s); in _ecrdsa_verify_finalize()
534 hsize = ctx->h->digest_size; in _ecrdsa_verify_finalize()
536 /* 2. Compute h = H(m) */ in _ecrdsa_verify_finalize()
539 ret = hash_mapping_callbacks_sanity_check(ctx->h); EG(ret, err); in _ecrdsa_verify_finalize()
540 ret = ctx->h->hfunc_finalize(&(ctx->verify_data.ecrdsa.h_ctx), h_buf); EG(ret, err); in _ecrdsa_verify_finalize()
542 /* NOTE: this handles a discrepancy between ISO/IEC 14888-3 and in _ecrdsa_verify_finalize()
549 /* 3. Compute e = OS2I(h)^-1 mod q */ in _ecrdsa_verify_finalize()
557 ret = nn_modinv(&e, &h, q); EG(ret, err); /* e = h^-1 mod q */ in _ecrdsa_verify_finalize()
559 /* 4. Compute u = es mod q */ in _ecrdsa_verify_finalize()
562 /* 5. Compute v = -er mod q in _ecrdsa_verify_finalize()
564 * Because we only support positive integers, we compute in _ecrdsa_verify_finalize()
565 * v = -er mod q = q - (er mod q) (except when er is 0). in _ecrdsa_verify_finalize()
572 /* 6. Compute W' = uG + vY = (W'_x, W'_y) */ in _ecrdsa_verify_finalize()
577 dbg_nn_print("W'_x", &(Wprime->X.fp_val)); in _ecrdsa_verify_finalize()
578 dbg_nn_print("W'_y", &(Wprime->Y.fp_val)); in _ecrdsa_verify_finalize()
580 /* 7. Compute r' = W'_x mod q */ in _ecrdsa_verify_finalize()
581 ret = nn_mod(&r_prime, &(Wprime->X.fp_val), q); EG(ret, err); in _ecrdsa_verify_finalize()
585 ret = (cmp == 0) ? 0 : -1; in _ecrdsa_verify_finalize()
601 IGNORE_RET_VAL(local_memset(&(ctx->verify_data.ecrdsa), 0, in _ecrdsa_verify_finalize()