mirror of
https://github.com/Mbed-TLS/mbedtls.git
synced 2025-07-29 11:41:15 +03:00
Merge branch 'development' into development-restricted
* development: (55 commits) Log change as bugfix Add changelog entry Clarify updates to the persistent state in storage With multiple applicable transparent drivers, the order is unspecified Minor clarifications Give some examples of purpsoses of pure-software transparent driver Fix typos Add a link to the PSA API specification Explain locations vs lifetimes Initialize key pointer in ecdh to NULL Add buffer zeroization when ecp_write_key fails Simplified key slot deletion Style fixes Use arc4random_buf instead of rand on NetBSD Apply review feedback Update open question section about public key storage Remove the paragraph about declaring application needs Change driver persistent data to a callback interface Rework and expand key management in opaque drivers Fix typos and copypasta ...
This commit is contained in:
Manuel Pégourié-Gonnard
297
library/ecp.c
297
library/ecp.c
@ -501,25 +501,6 @@ int mbedtls_ecp_check_budget( const mbedtls_ecp_group *grp,
|
||||
|
||||
#endif /* MBEDTLS_ECP_RESTARTABLE */
|
||||
|
||||
#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_BP256R1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_BP384R1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_BP512R1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED)
|
||||
#define ECP_SHORTWEIERSTRASS
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
|
||||
#define ECP_MONTGOMERY
|
||||
#endif
|
||||
|
||||
/*
|
||||
* List of supported curves:
|
||||
* - internal ID
|
||||
@ -897,7 +878,8 @@ int mbedtls_ecp_point_write_binary( const mbedtls_ecp_group *grp,
|
||||
|
||||
plen = mbedtls_mpi_size( &grp->P );
|
||||
|
||||
#if defined(ECP_MONTGOMERY)
|
||||
#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
|
||||
(void) format; /* Montgomery curves always use the same point format */
|
||||
if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_MONTGOMERY )
|
||||
{
|
||||
*olen = plen;
|
||||
@ -907,7 +889,7 @@ int mbedtls_ecp_point_write_binary( const mbedtls_ecp_group *grp,
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary_le( &P->X, buf, plen ) );
|
||||
}
|
||||
#endif
|
||||
#if defined(ECP_SHORTWEIERSTRASS)
|
||||
#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
|
||||
if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS )
|
||||
{
|
||||
/*
|
||||
@ -970,7 +952,7 @@ int mbedtls_ecp_point_read_binary( const mbedtls_ecp_group *grp,
|
||||
|
||||
plen = mbedtls_mpi_size( &grp->P );
|
||||
|
||||
#if defined(ECP_MONTGOMERY)
|
||||
#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
|
||||
if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_MONTGOMERY )
|
||||
{
|
||||
if( plen != ilen )
|
||||
@ -986,7 +968,7 @@ int mbedtls_ecp_point_read_binary( const mbedtls_ecp_group *grp,
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &pt->Z, 1 ) );
|
||||
}
|
||||
#endif
|
||||
#if defined(ECP_SHORTWEIERSTRASS)
|
||||
#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
|
||||
if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS )
|
||||
{
|
||||
if( buf[0] == 0x00 )
|
||||
@ -1304,7 +1286,7 @@ cleanup:
|
||||
return( ret );
|
||||
}
|
||||
|
||||
#if defined(ECP_SHORTWEIERSTRASS)
|
||||
#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
|
||||
/*
|
||||
* For curves in short Weierstrass form, we do all the internal operations in
|
||||
* Jacobian coordinates.
|
||||
@ -2413,9 +2395,9 @@ cleanup:
|
||||
return( ret );
|
||||
}
|
||||
|
||||
#endif /* ECP_SHORTWEIERSTRASS */
|
||||
#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
|
||||
|
||||
#if defined(ECP_MONTGOMERY)
|
||||
#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
|
||||
/*
|
||||
* For Montgomery curves, we do all the internal arithmetic in projective
|
||||
* coordinates. Import/export of points uses only the x coordinates, which is
|
||||
@ -2649,7 +2631,7 @@ cleanup:
|
||||
return( ret );
|
||||
}
|
||||
|
||||
#endif /* ECP_MONTGOMERY */
|
||||
#endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */
|
||||
|
||||
/*
|
||||
* Restartable multiplication R = m * P
|
||||
@ -2672,6 +2654,8 @@ int mbedtls_ecp_mul_restartable( mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
|
||||
/* reset ops count for this call if top-level */
|
||||
if( rs_ctx != NULL && rs_ctx->depth++ == 0 )
|
||||
rs_ctx->ops_done = 0;
|
||||
#else
|
||||
(void) rs_ctx;
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_ECP_INTERNAL_ALT)
|
||||
@ -2693,11 +2677,11 @@ int mbedtls_ecp_mul_restartable( mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
|
||||
}
|
||||
|
||||
ret = MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
|
||||
#if defined(ECP_MONTGOMERY)
|
||||
#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
|
||||
if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_MONTGOMERY )
|
||||
MBEDTLS_MPI_CHK( ecp_mul_mxz( grp, R, m, P, f_rng, p_rng ) );
|
||||
#endif
|
||||
#if defined(ECP_SHORTWEIERSTRASS)
|
||||
#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
|
||||
if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS )
|
||||
MBEDTLS_MPI_CHK( ecp_mul_comb( grp, R, m, P, f_rng, p_rng, rs_ctx ) );
|
||||
#endif
|
||||
@ -2731,7 +2715,7 @@ int mbedtls_ecp_mul( mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
|
||||
return( mbedtls_ecp_mul_restartable( grp, R, m, P, f_rng, p_rng, NULL ) );
|
||||
}
|
||||
|
||||
#if defined(ECP_SHORTWEIERSTRASS)
|
||||
#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
|
||||
/*
|
||||
* Check that an affine point is valid as a public key,
|
||||
* short weierstrass curves (SEC1 3.2.3.1)
|
||||
@ -2779,8 +2763,9 @@ cleanup:
|
||||
|
||||
return( ret );
|
||||
}
|
||||
#endif /* ECP_SHORTWEIERSTRASS */
|
||||
#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
|
||||
|
||||
#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
|
||||
/*
|
||||
* R = m * P with shortcuts for m == 1 and m == -1
|
||||
* NOT constant-time - ONLY for short Weierstrass!
|
||||
@ -2926,8 +2911,9 @@ int mbedtls_ecp_muladd( mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
|
||||
ECP_VALIDATE_RET( Q != NULL );
|
||||
return( mbedtls_ecp_muladd_restartable( grp, R, m, P, n, Q, NULL ) );
|
||||
}
|
||||
#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
|
||||
|
||||
#if defined(ECP_MONTGOMERY)
|
||||
#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
|
||||
/*
|
||||
* Check validity of a public key for Montgomery curves with x-only schemes
|
||||
*/
|
||||
@ -2941,7 +2927,7 @@ static int ecp_check_pubkey_mx( const mbedtls_ecp_group *grp, const mbedtls_ecp_
|
||||
|
||||
return( 0 );
|
||||
}
|
||||
#endif /* ECP_MONTGOMERY */
|
||||
#endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */
|
||||
|
||||
/*
|
||||
* Check that a point is valid as a public key
|
||||
@ -2956,11 +2942,11 @@ int mbedtls_ecp_check_pubkey( const mbedtls_ecp_group *grp,
|
||||
if( mbedtls_mpi_cmp_int( &pt->Z, 1 ) != 0 )
|
||||
return( MBEDTLS_ERR_ECP_INVALID_KEY );
|
||||
|
||||
#if defined(ECP_MONTGOMERY)
|
||||
#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
|
||||
if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_MONTGOMERY )
|
||||
return( ecp_check_pubkey_mx( grp, pt ) );
|
||||
#endif
|
||||
#if defined(ECP_SHORTWEIERSTRASS)
|
||||
#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
|
||||
if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS )
|
||||
return( ecp_check_pubkey_sw( grp, pt ) );
|
||||
#endif
|
||||
@ -2976,7 +2962,7 @@ int mbedtls_ecp_check_privkey( const mbedtls_ecp_group *grp,
|
||||
ECP_VALIDATE_RET( grp != NULL );
|
||||
ECP_VALIDATE_RET( d != NULL );
|
||||
|
||||
#if defined(ECP_MONTGOMERY)
|
||||
#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
|
||||
if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_MONTGOMERY )
|
||||
{
|
||||
/* see RFC 7748 sec. 5 para. 5 */
|
||||
@ -2991,8 +2977,8 @@ int mbedtls_ecp_check_privkey( const mbedtls_ecp_group *grp,
|
||||
|
||||
return( 0 );
|
||||
}
|
||||
#endif /* ECP_MONTGOMERY */
|
||||
#if defined(ECP_SHORTWEIERSTRASS)
|
||||
#endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */
|
||||
#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
|
||||
if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS )
|
||||
{
|
||||
/* see SEC1 3.2 */
|
||||
@ -3002,7 +2988,7 @@ int mbedtls_ecp_check_privkey( const mbedtls_ecp_group *grp,
|
||||
else
|
||||
return( 0 );
|
||||
}
|
||||
#endif /* ECP_SHORTWEIERSTRASS */
|
||||
#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
|
||||
|
||||
return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
|
||||
}
|
||||
@ -3024,7 +3010,7 @@ int mbedtls_ecp_gen_privkey( const mbedtls_ecp_group *grp,
|
||||
|
||||
n_size = ( grp->nbits + 7 ) / 8;
|
||||
|
||||
#if defined(ECP_MONTGOMERY)
|
||||
#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
|
||||
if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_MONTGOMERY )
|
||||
{
|
||||
/* [M225] page 5 */
|
||||
@ -3050,9 +3036,9 @@ int mbedtls_ecp_gen_privkey( const mbedtls_ecp_group *grp,
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( d, 2, 0 ) );
|
||||
}
|
||||
}
|
||||
#endif /* ECP_MONTGOMERY */
|
||||
#endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */
|
||||
|
||||
#if defined(ECP_SHORTWEIERSTRASS)
|
||||
#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
|
||||
if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS )
|
||||
{
|
||||
/* SEC1 3.2.1: Generate d such that 1 <= n < N */
|
||||
@ -3094,7 +3080,7 @@ int mbedtls_ecp_gen_privkey( const mbedtls_ecp_group *grp,
|
||||
}
|
||||
while( mbedtls_mpi_cmp_int( d, 1 ) < 0 || cmp != 1 );
|
||||
}
|
||||
#endif /* ECP_SHORTWEIERSTRASS */
|
||||
#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
|
||||
|
||||
cleanup:
|
||||
return( ret );
|
||||
@ -3172,7 +3158,7 @@ int mbedtls_ecp_read_key( mbedtls_ecp_group_id grp_id, mbedtls_ecp_keypair *key,
|
||||
|
||||
ret = MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE;
|
||||
|
||||
#if defined(ECP_MONTGOMERY)
|
||||
#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
|
||||
if( mbedtls_ecp_get_type( &key->grp ) == MBEDTLS_ECP_TYPE_MONTGOMERY )
|
||||
{
|
||||
/*
|
||||
@ -3207,7 +3193,7 @@ int mbedtls_ecp_read_key( mbedtls_ecp_group_id grp_id, mbedtls_ecp_keypair *key,
|
||||
}
|
||||
|
||||
#endif
|
||||
#if defined(ECP_SHORTWEIERSTRASS)
|
||||
#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
|
||||
if( mbedtls_ecp_get_type( &key->grp ) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS )
|
||||
{
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &key->d, buf, buflen ) );
|
||||
@ -3235,7 +3221,7 @@ int mbedtls_ecp_write_key( mbedtls_ecp_keypair *key,
|
||||
ECP_VALIDATE_RET( key != NULL );
|
||||
ECP_VALIDATE_RET( buf != NULL );
|
||||
|
||||
#if defined(ECP_MONTGOMERY)
|
||||
#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
|
||||
if( mbedtls_ecp_get_type( &key->grp ) == MBEDTLS_ECP_TYPE_MONTGOMERY )
|
||||
{
|
||||
if( key->grp.id == MBEDTLS_ECP_DP_CURVE25519 )
|
||||
@ -3250,7 +3236,7 @@ int mbedtls_ecp_write_key( mbedtls_ecp_keypair *key,
|
||||
}
|
||||
|
||||
#endif
|
||||
#if defined(ECP_SHORTWEIERSTRASS)
|
||||
#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
|
||||
if( mbedtls_ecp_get_type( &key->grp ) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS )
|
||||
{
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &key->d, buf, buflen ) );
|
||||
@ -3309,33 +3295,141 @@ cleanup:
|
||||
|
||||
#if defined(MBEDTLS_SELF_TEST)
|
||||
|
||||
/* Adjust the exponent to be a valid private point for the specified curve.
|
||||
* This is sometimes necessary because we use a single set of exponents
|
||||
* for all curves but the validity of values depends on the curve. */
|
||||
static int self_test_adjust_exponent( const mbedtls_ecp_group *grp,
|
||||
mbedtls_mpi *m )
|
||||
{
|
||||
int ret = 0;
|
||||
switch( grp->id )
|
||||
{
|
||||
/* If Curve25519 is available, then that's what we use for the
|
||||
* Montgomery test, so we don't need the adjustment code. */
|
||||
#if ! defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
|
||||
#if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
|
||||
case MBEDTLS_ECP_DP_CURVE448:
|
||||
/* Move highest bit from 254 to N-1. Setting bit N-1 is
|
||||
* necessary to enforce the highest-bit-set constraint. */
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( m, 254, 0 ) );
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( m, grp->nbits, 1 ) );
|
||||
/* Copy second-highest bit from 253 to N-2. This is not
|
||||
* necessary but improves the test variety a bit. */
|
||||
MBEDTLS_MPI_CHK(
|
||||
mbedtls_mpi_set_bit( m, grp->nbits - 1,
|
||||
mbedtls_mpi_get_bit( m, 253 ) ) );
|
||||
break;
|
||||
#endif
|
||||
#endif /* ! defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED) */
|
||||
default:
|
||||
/* Non-Montgomery curves and Curve25519 need no adjustment. */
|
||||
(void) grp;
|
||||
(void) m;
|
||||
goto cleanup;
|
||||
}
|
||||
cleanup:
|
||||
return( ret );
|
||||
}
|
||||
|
||||
/* Calculate R = m.P for each m in exponents. Check that the number of
|
||||
* basic operations doesn't depend on the value of m. */
|
||||
static int self_test_point( int verbose,
|
||||
mbedtls_ecp_group *grp,
|
||||
mbedtls_ecp_point *R,
|
||||
mbedtls_mpi *m,
|
||||
const mbedtls_ecp_point *P,
|
||||
const char *const *exponents,
|
||||
size_t n_exponents )
|
||||
{
|
||||
int ret = 0;
|
||||
size_t i = 0;
|
||||
unsigned long add_c_prev, dbl_c_prev, mul_c_prev;
|
||||
add_count = 0;
|
||||
dbl_count = 0;
|
||||
mul_count = 0;
|
||||
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( m, 16, exponents[0] ) );
|
||||
MBEDTLS_MPI_CHK( self_test_adjust_exponent( grp, m ) );
|
||||
MBEDTLS_MPI_CHK( mbedtls_ecp_mul( grp, R, m, P, NULL, NULL ) );
|
||||
|
||||
for( i = 1; i < n_exponents; i++ )
|
||||
{
|
||||
add_c_prev = add_count;
|
||||
dbl_c_prev = dbl_count;
|
||||
mul_c_prev = mul_count;
|
||||
add_count = 0;
|
||||
dbl_count = 0;
|
||||
mul_count = 0;
|
||||
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( m, 16, exponents[i] ) );
|
||||
MBEDTLS_MPI_CHK( self_test_adjust_exponent( grp, m ) );
|
||||
MBEDTLS_MPI_CHK( mbedtls_ecp_mul( grp, R, m, P, NULL, NULL ) );
|
||||
|
||||
if( add_count != add_c_prev ||
|
||||
dbl_count != dbl_c_prev ||
|
||||
mul_count != mul_c_prev )
|
||||
{
|
||||
ret = 1;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
cleanup:
|
||||
if( verbose != 0 )
|
||||
{
|
||||
if( ret != 0 )
|
||||
mbedtls_printf( "failed (%u)\n", (unsigned int) i );
|
||||
else
|
||||
mbedtls_printf( "passed\n" );
|
||||
}
|
||||
return( ret );
|
||||
}
|
||||
|
||||
/*
|
||||
* Checkup routine
|
||||
*/
|
||||
int mbedtls_ecp_self_test( int verbose )
|
||||
{
|
||||
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
|
||||
size_t i;
|
||||
mbedtls_ecp_group grp;
|
||||
mbedtls_ecp_point R, P;
|
||||
mbedtls_mpi m;
|
||||
unsigned long add_c_prev, dbl_c_prev, mul_c_prev;
|
||||
/* exponents especially adapted for secp192r1 */
|
||||
const char *exponents[] =
|
||||
|
||||
#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
|
||||
/* Exponents especially adapted for secp192k1, which has the lowest
|
||||
* order n of all supported curves (secp192r1 is in a slightly larger
|
||||
* field but the order of its base point is slightly smaller). */
|
||||
const char *sw_exponents[] =
|
||||
{
|
||||
"000000000000000000000000000000000000000000000001", /* one */
|
||||
"FFFFFFFFFFFFFFFFFFFFFFFF99DEF836146BC9B1B4D22830", /* N - 1 */
|
||||
"FFFFFFFFFFFFFFFFFFFFFFFE26F2FC170F69466A74DEFD8C", /* n - 1 */
|
||||
"5EA6F389A38B8BC81E767753B15AA5569E1782E30ABE7D25", /* random */
|
||||
"400000000000000000000000000000000000000000000000", /* one and zeros */
|
||||
"7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF", /* all ones */
|
||||
"555555555555555555555555555555555555555555555555", /* 101010... */
|
||||
};
|
||||
#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
|
||||
#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
|
||||
const char *m_exponents[] =
|
||||
{
|
||||
/* Valid private values for Curve25519. In a build with Curve448
|
||||
* but not Curve25519, they will be adjusted in
|
||||
* self_test_adjust_exponent(). */
|
||||
"4000000000000000000000000000000000000000000000000000000000000000",
|
||||
"5C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C30",
|
||||
"5715ECCE24583F7A7023C24164390586842E816D7280A49EF6DF4EAE6B280BF8",
|
||||
"41A2B017516F6D254E1F002BCCBADD54BE30F8CEC737A0E912B4963B6BA74460",
|
||||
"5555555555555555555555555555555555555555555555555555555555555550",
|
||||
"7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF8",
|
||||
};
|
||||
#endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */
|
||||
|
||||
mbedtls_ecp_group_init( &grp );
|
||||
mbedtls_ecp_point_init( &R );
|
||||
mbedtls_ecp_point_init( &P );
|
||||
mbedtls_mpi_init( &m );
|
||||
|
||||
#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
|
||||
/* Use secp192r1 if available, or any available curve */
|
||||
#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED)
|
||||
MBEDTLS_MPI_CHK( mbedtls_ecp_group_load( &grp, MBEDTLS_ECP_DP_SECP192R1 ) );
|
||||
@ -3344,81 +3438,48 @@ int mbedtls_ecp_self_test( int verbose )
|
||||
#endif
|
||||
|
||||
if( verbose != 0 )
|
||||
mbedtls_printf( " ECP test #1 (constant op_count, base point G): " );
|
||||
|
||||
mbedtls_printf( " ECP SW test #1 (constant op_count, base point G): " );
|
||||
/* Do a dummy multiplication first to trigger precomputation */
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &m, 2 ) );
|
||||
MBEDTLS_MPI_CHK( mbedtls_ecp_mul( &grp, &P, &m, &grp.G, NULL, NULL ) );
|
||||
|
||||
add_count = 0;
|
||||
dbl_count = 0;
|
||||
mul_count = 0;
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &m, 16, exponents[0] ) );
|
||||
MBEDTLS_MPI_CHK( mbedtls_ecp_mul( &grp, &R, &m, &grp.G, NULL, NULL ) );
|
||||
|
||||
for( i = 1; i < sizeof( exponents ) / sizeof( exponents[0] ); i++ )
|
||||
{
|
||||
add_c_prev = add_count;
|
||||
dbl_c_prev = dbl_count;
|
||||
mul_c_prev = mul_count;
|
||||
add_count = 0;
|
||||
dbl_count = 0;
|
||||
mul_count = 0;
|
||||
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &m, 16, exponents[i] ) );
|
||||
MBEDTLS_MPI_CHK( mbedtls_ecp_mul( &grp, &R, &m, &grp.G, NULL, NULL ) );
|
||||
|
||||
if( add_count != add_c_prev ||
|
||||
dbl_count != dbl_c_prev ||
|
||||
mul_count != mul_c_prev )
|
||||
{
|
||||
if( verbose != 0 )
|
||||
mbedtls_printf( "failed (%u)\n", (unsigned int) i );
|
||||
|
||||
ret = 1;
|
||||
goto cleanup;
|
||||
}
|
||||
}
|
||||
ret = self_test_point( verbose,
|
||||
&grp, &R, &m, &grp.G,
|
||||
sw_exponents,
|
||||
sizeof( sw_exponents ) / sizeof( sw_exponents[0] ));
|
||||
if( ret != 0 )
|
||||
goto cleanup;
|
||||
|
||||
if( verbose != 0 )
|
||||
mbedtls_printf( "passed\n" );
|
||||
|
||||
if( verbose != 0 )
|
||||
mbedtls_printf( " ECP test #2 (constant op_count, other point): " );
|
||||
mbedtls_printf( " ECP SW test #2 (constant op_count, other point): " );
|
||||
/* We computed P = 2G last time, use it */
|
||||
ret = self_test_point( verbose,
|
||||
&grp, &R, &m, &P,
|
||||
sw_exponents,
|
||||
sizeof( sw_exponents ) / sizeof( sw_exponents[0] ));
|
||||
if( ret != 0 )
|
||||
goto cleanup;
|
||||
|
||||
add_count = 0;
|
||||
dbl_count = 0;
|
||||
mul_count = 0;
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &m, 16, exponents[0] ) );
|
||||
MBEDTLS_MPI_CHK( mbedtls_ecp_mul( &grp, &R, &m, &P, NULL, NULL ) );
|
||||
|
||||
for( i = 1; i < sizeof( exponents ) / sizeof( exponents[0] ); i++ )
|
||||
{
|
||||
add_c_prev = add_count;
|
||||
dbl_c_prev = dbl_count;
|
||||
mul_c_prev = mul_count;
|
||||
add_count = 0;
|
||||
dbl_count = 0;
|
||||
mul_count = 0;
|
||||
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &m, 16, exponents[i] ) );
|
||||
MBEDTLS_MPI_CHK( mbedtls_ecp_mul( &grp, &R, &m, &P, NULL, NULL ) );
|
||||
|
||||
if( add_count != add_c_prev ||
|
||||
dbl_count != dbl_c_prev ||
|
||||
mul_count != mul_c_prev )
|
||||
{
|
||||
if( verbose != 0 )
|
||||
mbedtls_printf( "failed (%u)\n", (unsigned int) i );
|
||||
|
||||
ret = 1;
|
||||
goto cleanup;
|
||||
}
|
||||
}
|
||||
mbedtls_ecp_group_free( &grp );
|
||||
mbedtls_ecp_point_free( &R );
|
||||
#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
|
||||
|
||||
#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
|
||||
if( verbose != 0 )
|
||||
mbedtls_printf( "passed\n" );
|
||||
mbedtls_printf( " ECP Montgomery test (constant op_count): " );
|
||||
#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
|
||||
MBEDTLS_MPI_CHK( mbedtls_ecp_group_load( &grp, MBEDTLS_ECP_DP_CURVE25519 ) );
|
||||
#elif defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
|
||||
MBEDTLS_MPI_CHK( mbedtls_ecp_group_load( &grp, MBEDTLS_ECP_DP_CURVE448 ) );
|
||||
#else
|
||||
#error "MBEDTLS_ECP_MONTGOMERY_ENABLED is defined, but no curve is supported for self-test"
|
||||
#endif
|
||||
ret = self_test_point( verbose,
|
||||
&grp, &R, &m, &grp.G,
|
||||
m_exponents,
|
||||
sizeof( m_exponents ) / sizeof( m_exponents[0] ));
|
||||
if( ret != 0 )
|
||||
goto cleanup;
|
||||
#endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */
|
||||
|
||||
cleanup:
|
||||
|
||||
|
||||
@ -553,6 +553,22 @@ static const mbedtls_mpi_uint brainpoolP512r1_n[] = {
|
||||
};
|
||||
#endif /* MBEDTLS_ECP_DP_BP512R1_ENABLED */
|
||||
|
||||
#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_BP256R1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_BP384R1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_BP512R1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED)
|
||||
/* For these curves, we build the group parameters dynamically. */
|
||||
#define ECP_LOAD_GROUP
|
||||
#endif
|
||||
|
||||
#if defined(ECP_LOAD_GROUP)
|
||||
/*
|
||||
* Create an MPI from embedded constants
|
||||
* (assumes len is an exact multiple of sizeof mbedtls_mpi_uint)
|
||||
@ -603,6 +619,7 @@ static int ecp_group_load( mbedtls_ecp_group *grp,
|
||||
|
||||
return( 0 );
|
||||
}
|
||||
#endif /* ECP_LOAD_GROUP */
|
||||
|
||||
#if defined(MBEDTLS_ECP_NIST_OPTIM)
|
||||
/* Forward declarations */
|
||||
@ -644,6 +661,7 @@ static int ecp_mod_p224k1( mbedtls_mpi * );
|
||||
static int ecp_mod_p256k1( mbedtls_mpi * );
|
||||
#endif
|
||||
|
||||
#if defined(ECP_LOAD_GROUP)
|
||||
#define LOAD_GROUP_A( G ) ecp_group_load( grp, \
|
||||
G ## _p, sizeof( G ## _p ), \
|
||||
G ## _a, sizeof( G ## _a ), \
|
||||
@ -659,6 +677,7 @@ static int ecp_mod_p256k1( mbedtls_mpi * );
|
||||
G ## _gx, sizeof( G ## _gx ), \
|
||||
G ## _gy, sizeof( G ## _gy ), \
|
||||
G ## _n, sizeof( G ## _n ) )
|
||||
#endif /* ECP_LOAD_GROUP */
|
||||
|
||||
#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
|
||||
/*
|
||||
|
||||
1126
library/psa_crypto.c
1126
library/psa_crypto.c
File diff suppressed because it is too large
Load Diff
@ -32,9 +32,6 @@
|
||||
#include "psa/crypto.h"
|
||||
#include "psa/crypto_se_driver.h"
|
||||
|
||||
#include "mbedtls/ecp.h"
|
||||
#include "mbedtls/rsa.h"
|
||||
|
||||
/** The data structure representing a key slot, containing key material
|
||||
* and metadata for one key.
|
||||
*/
|
||||
@ -43,20 +40,13 @@ typedef struct
|
||||
psa_core_key_attributes_t attr;
|
||||
union
|
||||
{
|
||||
/* Raw-data key (key_type_is_raw_bytes() in psa_crypto.c) */
|
||||
struct raw_data
|
||||
/* Dynamically allocated key data buffer.
|
||||
* Format as specified in psa_export_key(). */
|
||||
struct key_data
|
||||
{
|
||||
uint8_t *data;
|
||||
size_t bytes;
|
||||
} raw;
|
||||
#if defined(MBEDTLS_RSA_C)
|
||||
/* RSA public key or key pair */
|
||||
mbedtls_rsa_context *rsa;
|
||||
#endif /* MBEDTLS_RSA_C */
|
||||
#if defined(MBEDTLS_ECP_C)
|
||||
/* EC public key or key pair */
|
||||
mbedtls_ecp_keypair *ecp;
|
||||
#endif /* MBEDTLS_ECP_C */
|
||||
} key;
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
|
||||
/* Any key type in a secure element */
|
||||
struct se
|
||||
|
||||
@ -53,7 +53,7 @@
|
||||
#include "mbedtls/md.h"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_PKCS1_V15) && !defined(__OpenBSD__)
|
||||
#if defined(MBEDTLS_PKCS1_V15) && !defined(__OpenBSD__) && !defined(__NetBSD__)
|
||||
#include <stdlib.h>
|
||||
#endif
|
||||
|
||||
@ -2595,7 +2595,7 @@ void mbedtls_rsa_free( mbedtls_rsa_context *ctx )
|
||||
#if defined(MBEDTLS_PKCS1_V15)
|
||||
static int myrand( void *rng_state, unsigned char *output, size_t len )
|
||||
{
|
||||
#if !defined(__OpenBSD__)
|
||||
#if !defined(__OpenBSD__) && !defined(__NetBSD__)
|
||||
size_t i;
|
||||
|
||||
if( rng_state != NULL )
|
||||
@ -2608,7 +2608,7 @@ static int myrand( void *rng_state, unsigned char *output, size_t len )
|
||||
rng_state = NULL;
|
||||
|
||||
arc4random_buf( output, len );
|
||||
#endif /* !OpenBSD */
|
||||
#endif /* !OpenBSD && !NetBSD */
|
||||
|
||||
return( 0 );
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user