Source code
Revision control
Copy as Markdown
Other Tools
/*
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
* TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS OR CONTRIBUTORS
* BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/
#include "ecdsa.h"
#include "utils.h"
#include <botan/ffi.h>
#include <string.h>
#include "botan_utils.hpp"
namespace pgp {
namespace ecdsa {
static bool
load_public_key(rnp::botan::Pubkey &pubkey, const ec::Key &keydata)
{
auto curve = ec::Curve::get(keydata.curve);
if (!curve) {
RNP_LOG("unknown curve");
return false;
}
if (!keydata.p.size() || (keydata.p[0] != 0x04)) {
RNP_LOG("Failed to load public key: %02x", keydata.p[0]);
return false;
}
const size_t curve_order = curve->bytes();
if (keydata.p.size() != 2 * curve_order + 1) {
return false;
}
rnp::bn px(&keydata.p[1], curve_order);
rnp::bn py(&keydata.p[1] + curve_order, curve_order);
if (!px || !py) {
return false;
}
bool res = !botan_pubkey_load_ecdsa(&pubkey.get(), px.get(), py.get(), curve->botan_name);
if (!res) {
RNP_LOG("failed to load ecdsa %s public key", curve->botan_name);
}
return res;
}
static bool
load_secret_key(rnp::botan::Privkey &seckey, const ec::Key &keydata)
{
auto curve = ec::Curve::get(keydata.curve);
if (!curve) {
return false;
}
rnp::bn x(keydata.x);
if (!x) {
return false;
}
bool res = !botan_privkey_load_ecdsa(&seckey.get(), x.get(), curve->botan_name);
if (!res) {
RNP_LOG("Can't load private %s key", curve->botan_name);
}
return res;
}
rnp_result_t
validate_key(rnp::RNG &rng, const ec::Key &key, bool secret)
{
rnp::botan::Pubkey bpkey;
if (!load_public_key(bpkey, key) || botan_pubkey_check_key(bpkey.get(), rng.handle(), 0)) {
return RNP_ERROR_BAD_PARAMETERS;
}
if (!secret) {
return RNP_SUCCESS;
}
rnp::botan::Privkey bskey;
if (!load_secret_key(bskey, key) ||
botan_privkey_check_key(bskey.get(), rng.handle(), 0)) {
return RNP_ERROR_BAD_PARAMETERS;
}
return RNP_SUCCESS;
}
const char *
padding_str_for(pgp_hash_alg_t hash_alg)
{
switch (hash_alg) {
case PGP_HASH_MD5:
return "Raw(MD5)";
case PGP_HASH_SHA1:
return "Raw(SHA-1)";
case PGP_HASH_RIPEMD:
return "Raw(RIPEMD-160)";
case PGP_HASH_SHA256:
return "Raw(SHA-256)";
case PGP_HASH_SHA384:
return "Raw(SHA-384)";
case PGP_HASH_SHA512:
return "Raw(SHA-512)";
case PGP_HASH_SHA224:
return "Raw(SHA-224)";
case PGP_HASH_SHA3_256:
return "Raw(SHA-3(256))";
case PGP_HASH_SHA3_512:
return "Raw(SHA-3(512))";
case PGP_HASH_SM3:
return "Raw(SM3)";
default:
return "Raw";
}
}
rnp_result_t
sign(rnp::RNG & rng,
ec::Signature & sig,
pgp_hash_alg_t hash_alg,
const rnp::secure_bytes &hash,
const ec::Key & key)
{
auto curve = ec::Curve::get(key.curve);
if (!curve) {
return RNP_ERROR_BAD_PARAMETERS;
}
rnp::botan::Privkey b_key;
if (!load_secret_key(b_key, key)) {
RNP_LOG("Can't load private key");
return RNP_ERROR_GENERIC;
}
rnp::botan::op::Sign signer;
auto pad = padding_str_for(hash_alg);
if (botan_pk_op_sign_create(&signer.get(), b_key.get(), pad, 0) ||
botan_pk_op_sign_update(signer.get(), hash.data(), hash.size())) {
return RNP_ERROR_GENERIC;
}
const size_t curve_order = curve->bytes();
size_t sig_len = 2 * curve_order;
std::vector<uint8_t> out_buf(sig_len);
if (botan_pk_op_sign_finish(signer.get(), rng.handle(), out_buf.data(), &sig_len)) {
RNP_LOG("Signing failed");
return RNP_ERROR_GENERIC;
}
// Allocate memory and copy results
sig.r.assign(out_buf.data(), curve_order);
sig.s.assign(out_buf.data() + curve_order, curve_order);
return RNP_SUCCESS;
}
rnp_result_t
verify(const ec::Signature & sig,
pgp_hash_alg_t hash_alg,
const rnp::secure_bytes &hash,
const ec::Key & key)
{
auto curve = ec::Curve::get(key.curve);
if (!curve) {
RNP_LOG("unknown curve");
return RNP_ERROR_BAD_PARAMETERS;
}
size_t curve_order = curve->bytes();
size_t r_blen = sig.r.size();
size_t s_blen = sig.s.size();
if ((r_blen > curve_order) || (s_blen > curve_order) ||
(curve_order > MAX_CURVE_BYTELEN)) {
return RNP_ERROR_BAD_PARAMETERS;
}
rnp::botan::Pubkey pub;
if (!load_public_key(pub, key)) {
return RNP_ERROR_SIGNATURE_INVALID;
}
rnp::botan::op::Verify verifier;
auto pad = padding_str_for(hash_alg);
if (botan_pk_op_verify_create(&verifier.get(), pub.get(), pad, 0) ||
botan_pk_op_verify_update(verifier.get(), hash.data(), hash.size())) {
return RNP_ERROR_SIGNATURE_INVALID;
}
std::vector<uint8_t> sign_buf(2 * curve_order, 0);
// Both can't fail
sig.r.copy(sign_buf.data() + curve_order - r_blen);
sig.s.copy(sign_buf.data() + 2 * curve_order - s_blen);
if (botan_pk_op_verify_finish(verifier.get(), sign_buf.data(), sign_buf.size())) {
return RNP_ERROR_SIGNATURE_INVALID;
}
return RNP_SUCCESS;
}
} // namespace ecdsa
} // namespace pgp