/*
* Copyright (C) 2017 - This file is part of libecc project
*
* Authors:
* Ryad BENADJILA <ryadbenadjila@gmail.com>
* Arnaud EBALARD <arnaud.ebalard@ssi.gouv.fr>
* Jean-Pierre FLORI <jean-pierre.flori@ssi.gouv.fr>
*
* Contributors:
* Nicolas VIVET <nicolas.vivet@ssi.gouv.fr>
* Karim KHALFALLAH <karim.khalfallah@ssi.gouv.fr>
*
* This software is licensed under a dual BSD and GPL v2 license.
* See LICENSE file at the root folder of the project.
*/
#include <libecc/sig/ec_key.h>
#include <libecc/sig/sig_algs.h>
#include <libecc/curves/curves.h>
/*
* Check if given private key 'A' has been initialized. Returns 0 on success,
* -1 on error
*/
int priv_key_check_initialized(const ec_priv_key *A)
{
int ret = 0;
MUST_HAVE(((A != NULL) && (A->magic == PRIV_KEY_MAGIC) && (A->params != NULL)), ret, err);
err:
return ret;
}
/*
* Same as previous but also verifies that the signature algorithm type does
* match the one passed using 'alg_type'. Returns 0 on success, -1 on error.
*/
int priv_key_check_initialized_and_type(const ec_priv_key *A,
ec_alg_type alg_type)
{
int ret = 0;
MUST_HAVE(((A != NULL) && (A->magic == PRIV_KEY_MAGIC) &&
(A->params != NULL) && (A->key_type == alg_type)), ret, err);
err:
return ret;
}
/*
* Import a private key from a buffer with known EC parameters and algorithm
* Note that no sanity check is performed by the function to verify key
* is valid for params. Also note that no deep copy of pointed params is
* performed. The function returns 0 on success, -1 on error.
*/
int ec_priv_key_import_from_buf(ec_priv_key *priv_key,
const ec_params *params,
const u8 *priv_key_buf, u8 priv_key_buf_len,
ec_alg_type ec_key_alg)
{
int ret;
MUST_HAVE((priv_key != NULL), ret, err);
ret = nn_init_from_buf(&(priv_key->x), priv_key_buf, priv_key_buf_len); EG(ret, err);
/* Set key type and pointer to EC params */
priv_key->key_type = ec_key_alg;
priv_key->params = (const ec_params *)params;
priv_key->magic = PRIV_KEY_MAGIC;
err:
return ret;
}
/*
* Export a private key 'priv_key' to a buffer 'priv_key_buf' of length
* 'priv_key_buf_len'. The function returns 0 on sucess, -1 on error.
*/
int ec_priv_key_export_to_buf(const ec_priv_key *priv_key, u8 *priv_key_buf,
u8 priv_key_buf_len)
{
int ret;
bitcnt_t blen;
ret = priv_key_check_initialized(priv_key); EG(ret, err);
/*
* Check that there is enough room to export our private key without
* losing information.
*/
ret = nn_bitlen(&(priv_key->x), &blen); EG(ret, err);
MUST_HAVE(((8 * (u32)priv_key_buf_len) >= (u32)blen), ret, err);
/* Export our private key */
ret = nn_export_to_buf(priv_key_buf, priv_key_buf_len, &(priv_key->x));
err:
return ret;
}
/*
* Check if given public key 'A' has been initialized. Returns 0 on success,
* -1 on error
*/
int pub_key_check_initialized(const ec_pub_key *A)
{
int ret = 0;
MUST_HAVE(((A != NULL) && (A->magic == PUB_KEY_MAGIC) && (A->params != NULL)), ret, err);
err:
return ret;
}
/*
* Same as previous but also verifies that the signature algorithm type does
* match the one passed using 'alg_type'. Returns 0 on success, -1 on error.
*/
int pub_key_check_initialized_and_type(const ec_pub_key *A,
ec_alg_type alg_type)
{
int ret = 0;
MUST_HAVE(((A != NULL) && (A->magic == PUB_KEY_MAGIC) &&
(A->params != NULL) && (A->key_type == alg_type)), ret, err);
err:
return ret;
}
/*
* Import a public key from a buffer with known EC parameters and algorithm
* Note that no sanity check is performed by the function to verify key
* is valid for params. Also note that no deep copy of pointed params is
* performed. The buffer contains projective point coordinates. The function
* returns 0 on success, -1 on error.
*/
int ec_pub_key_import_from_buf(ec_pub_key *pub_key, const ec_params *params,
const u8 *pub_key_buf, u8 pub_key_buf_len,
ec_alg_type ec_key_alg)
{
int ret, isone, check;
MUST_HAVE(((pub_key != NULL) && (pub_key_buf != NULL) && (params != NULL)), ret, err);
/* Import the projective point */
ret = prj_pt_import_from_buf(&(pub_key->y),
pub_key_buf, pub_key_buf_len,
(ec_shortw_crv_src_t)&(params->ec_curve)); EG(ret, err);
/* If the cofactor of the curve is not 1, we check that
* our public key is indeed in the sub-group generated by
* our generator.
* NOTE: this is indeed a 'costly' operation, but it is necessary
* when we do not trust the public key that is provided, which can
* be the case in some protocols.
*/
ret = nn_isone(&(params->ec_gen_cofactor), &isone); EG(ret, err);
if (!isone) {
ret = check_prj_pt_order(&(pub_key->y), &(params->ec_gen_order), PUBLIC_PT, &check); EG(ret, err);
MUST_HAVE(check, ret, err);
}
/* Set key type and pointer to EC params */
pub_key->key_type = ec_key_alg;
pub_key->params = (const ec_params *)params;
pub_key->magic = PUB_KEY_MAGIC;
err:
return ret;
}
/*
* Import a public key from a buffer with known EC parameters and algorithm
* Note that no sanity check is performed by the function to verify key
* is valid for params. Also note that no deep copy of pointed params is
* performed. The buffer contains affine point coordinates. The function
* returns 0 on success, -1 on error.
*/
int ec_pub_key_import_from_aff_buf(ec_pub_key *pub_key, const ec_params *params,
const u8 *pub_key_buf, u8 pub_key_buf_len,
ec_alg_type ec_key_alg)
{
int ret, isone, check;
MUST_HAVE(((pub_key != NULL) && (pub_key_buf != NULL) && (params != NULL)), ret, err);
/* Import the projective point */
ret = prj_pt_import_from_aff_buf(&(pub_key->y),
pub_key_buf, pub_key_buf_len,
(ec_shortw_crv_src_t)&(params->ec_curve)); EG(ret, err);
/* If the cofactor of the curve is not 1, we check that
* our public key is indeed in the sub-group generated by
* our generator.
* NOTE: this is indeed a 'costly' operation, but it is necessary
* when we do not trust the public key that is provided, which can
* be the case in some protocols.
*/
ret = nn_isone(&(params->ec_gen_cofactor), &isone); EG(ret, err);
if (!isone){
ret = check_prj_pt_order(&(pub_key->y), &(params->ec_gen_order), PUBLIC_PT, &check); EG(ret, err);
MUST_HAVE(check, ret, err);
}
/* Set key type and pointer to EC params */
pub_key->key_type = ec_key_alg;
pub_key->params = (const ec_params *)params;
pub_key->magic = PUB_KEY_MAGIC;
err:
return ret;
}
/*
* Export a public key to a projective point buffer. The function returns 0 on
* success, -1 on error.
*/
int ec_pub_key_export_to_buf(const ec_pub_key *pub_key, u8 *pub_key_buf,
u8 pub_key_buf_len)
{
int ret;
ret = pub_key_check_initialized(pub_key); EG(ret, err);
ret = prj_pt_export_to_buf(&(pub_key->y), pub_key_buf, pub_key_buf_len);
err:
return ret;
}
/*
* Export a public key to an affine point buffer. The function returns 0 on
* success, -1 on error.
*/
int ec_pub_key_export_to_aff_buf(const ec_pub_key *pub_key, u8 *pub_key_buf,
u8 pub_key_buf_len)
{
int ret;
ret = pub_key_check_initialized(pub_key); EG(ret, err);
ret = prj_pt_export_to_aff_buf(&(pub_key->y), pub_key_buf,
pub_key_buf_len);
err:
return ret;
}
/*
* Check if given key pair 'A' has been initialized. Returns 0 on success,
* -1 on error
*/
int key_pair_check_initialized(const ec_key_pair *A)
{
int ret;
MUST_HAVE((A != NULL), ret, err);
ret = priv_key_check_initialized(&A->priv_key); EG(ret, err);
ret = pub_key_check_initialized(&A->pub_key);
err:
return ret;
}
/*
* Same as previous but also verifies that the signature algorithm type does
* match the one passed using 'alg_type'. Returns 0 on success, -1 on error.
*/
int key_pair_check_initialized_and_type(const ec_key_pair *A,
ec_alg_type alg_type)
{
int ret;
MUST_HAVE((A != NULL), ret, err);
ret = priv_key_check_initialized_and_type(&A->priv_key, alg_type); EG(ret, err);
ret = pub_key_check_initialized_and_type(&A->pub_key, alg_type);
err:
return ret;
}
/*
* Import a key pair from a buffer representing the private key. The associated
* public key is computed from the private key. The function returns 0 on
* success, -1 on error.
*/
int ec_key_pair_import_from_priv_key_buf(ec_key_pair *kp,
const ec_params *params,
const u8 *priv_key, u8 priv_key_len,
ec_alg_type ec_key_alg)
{
int ret;
MUST_HAVE((kp != NULL), ret, err);
/* Import private key */
ret = ec_priv_key_import_from_buf(&(kp->priv_key), params, priv_key,
priv_key_len, ec_key_alg); EG(ret, err);
/* Generate associated public key. */
ret = init_pubkey_from_privkey(&(kp->pub_key), &(kp->priv_key));
err:
return ret;
}
/*
* Import a structured private key to buffer. The structure allows some sanity
* checks. The function returns 0 on success, -1 on error.
*/
int ec_structured_priv_key_import_from_buf(ec_priv_key *priv_key,
const ec_params *params,
const u8 *priv_key_buf,
u8 priv_key_buf_len,
ec_alg_type ec_key_alg)
{
u8 metadata_len = (3 * sizeof(u8));
u8 crv_name_len;
u32 len;
int ret;
/* We first pull the metadata, consisting of:
* - One byte = the key type (public or private)
* - One byte = the algorithm type (ECDSA, ECKCDSA, ...)
* - One byte = the curve type (FRP256V1, ...)
*/
MUST_HAVE((priv_key != NULL) && (priv_key_buf != NULL) && (priv_key_buf_len > metadata_len), ret, err);
MUST_HAVE((params != NULL) && (params->curve_name != NULL), ret, err);
/* Pull and check the key type */
MUST_HAVE((EC_PRIVKEY == priv_key_buf[0]), ret, err);
/* Pull and check the algorithm type */
MUST_HAVE((ec_key_alg == priv_key_buf[1]), ret, err);
/* Pull and check the curve type */
ret = local_strlen((const char *)params->curve_name, &len); EG(ret, err);
len += 1;
MUST_HAVE((len < 256), ret, err);
crv_name_len = (u8)len;
ret = ec_check_curve_type_and_name((ec_curve_type) (priv_key_buf[2]),
params->curve_name, crv_name_len); EG(ret, err);
ret = ec_priv_key_import_from_buf(priv_key, params,
priv_key_buf + metadata_len,
(u8)(priv_key_buf_len - metadata_len),
ec_key_alg);
err:
return ret;
}
/*
* Export a structured private key to buffer. The structure allows some sanity
* checks. The function returns 0 on success, -1 on error.
*/
int ec_structured_priv_key_export_to_buf(const ec_priv_key *priv_key,
u8 *priv_key_buf, u8 priv_key_buf_len)
{
u8 metadata_len = (3 * sizeof(u8));
const u8 *curve_name;
u8 curve_name_len;
u32 len;
ec_curve_type curve_type;
int ret;
ret = priv_key_check_initialized(priv_key); EG(ret, err);
MUST_HAVE((priv_key_buf != NULL) && (priv_key_buf_len > metadata_len) && (priv_key->params->curve_name != NULL), ret, err);
/*
* We first put the metadata, consisting on:
* - One byte = the key type (public or private)
* - One byte = the algorithm type (ECDSA, ECKCDSA, ...)
* - One byte = the curve type (FRP256V1, ...)
*/
/* Push the key type */
priv_key_buf[0] = (u8)EC_PRIVKEY;
/* Push the algorithm type */
priv_key_buf[1] = (u8)priv_key->key_type;
/* Push the curve type */
curve_name = priv_key->params->curve_name;
ret = local_strlen((const char *)curve_name, &len); EG(ret, err);
len += 1;
MUST_HAVE((len < 256), ret, err);
curve_name_len = (u8)len;
ret = ec_get_curve_type_by_name(curve_name, curve_name_len, &curve_type); EG(ret, err);
priv_key_buf[2] = (u8)curve_type;
/* Push the raw private key buffer */
ret = ec_priv_key_export_to_buf(priv_key, priv_key_buf + metadata_len,
(u8)(priv_key_buf_len - metadata_len));
err:
return ret;
}
/*
* Import a structured pub key from buffer. The structure allows some sanity
* checks. The function returns 0 on success, -1 on error.
*/
int ec_structured_pub_key_import_from_buf(ec_pub_key *pub_key,
const ec_params *params,
const u8 *pub_key_buf,
u8 pub_key_buf_len,
ec_alg_type ec_key_alg)
{
u8 metadata_len = (3 * sizeof(u8));
u8 crv_name_len;
u32 len;
int ret;
MUST_HAVE((pub_key_buf != NULL) && (pub_key_buf_len > metadata_len), ret, err);
MUST_HAVE((params != NULL) && (params->curve_name != NULL), ret, err);
/*
* We first pull the metadata, consisting of:
* - One byte = the key type (public or private)
* - One byte = the algorithm type (ECDSA, ECKCDSA, ...)
* - One byte = the curve type (FRP256V1, ...)
*/
/* Pull and check the key type */
MUST_HAVE((EC_PUBKEY == pub_key_buf[0]), ret, err);
/* Pull and check the algorithm type */
MUST_HAVE((ec_key_alg == pub_key_buf[1]), ret, err);
/* Pull and check the curve type */
ret = local_strlen((const char *)params->curve_name, &len); EG(ret, err);
len += 1;
MUST_HAVE((len < 256), ret, err);
crv_name_len = (u8)len;
ret = ec_check_curve_type_and_name((ec_curve_type) (pub_key_buf[2]),
params->curve_name, crv_name_len); EG(ret, err);
ret = ec_pub_key_import_from_buf(pub_key, params,
pub_key_buf + metadata_len,
(u8)(pub_key_buf_len - metadata_len),
ec_key_alg);
err:
return ret;
}
/*
* Export a structured pubate key to buffer. The structure allows some sanity
* checks. The function returns 0 on success, -1 on error.
*/
int ec_structured_pub_key_export_to_buf(const ec_pub_key *pub_key,
u8 *pub_key_buf, u8 pub_key_buf_len)
{
u8 metadata_len = (3 * sizeof(u8));
const u8 *curve_name;
u8 curve_name_len;
u32 len;
ec_curve_type curve_type;
int ret;
ret = pub_key_check_initialized(pub_key); EG(ret, err);
MUST_HAVE((pub_key_buf != NULL) && (pub_key_buf_len > metadata_len), ret, err);
MUST_HAVE((pub_key->params->curve_name != NULL), ret, err);
/*
* We first put the metadata, consisting of:
* - One byte = the key type (public or private)
* - One byte = the algorithm type (ECDSA, ECKCDSA, ...)
* - One byte = the curve type (FRP256V1, ...)
*/
/* Push the key type */
pub_key_buf[0] = (u8)EC_PUBKEY;
/* Push the algorithm type */
pub_key_buf[1] = (u8)pub_key->key_type;
/* Push the curve type */
curve_name = pub_key->params->curve_name;
ret = local_strlen((const char *)curve_name, &len); EG(ret, err);
len += 1;
MUST_HAVE((len < 256), ret, err);
curve_name_len = (u8)len;
ret = ec_get_curve_type_by_name(curve_name, curve_name_len, &curve_type); EG(ret, err);
pub_key_buf[2] = (u8)curve_type;
/* Push the raw pub key buffer */
ret = ec_pub_key_export_to_buf(pub_key, pub_key_buf + metadata_len,
(u8)(pub_key_buf_len - metadata_len));
err:
return ret;
}
/*
* Import a key pair from a structured private key buffer. The structure allows
* some sanity checks. The function returns 0 on success, -1 on error.
*/
int ec_structured_key_pair_import_from_priv_key_buf(ec_key_pair *kp,
const ec_params *params,
const u8 *priv_key_buf,
u8 priv_key_buf_len,
ec_alg_type ec_key_alg)
{
u8 metadata_len = (3 * sizeof(u8));
u8 crv_name_len;
u32 len;
int ret;
MUST_HAVE((kp != NULL) && (priv_key_buf != NULL) && (priv_key_buf_len > metadata_len), ret, err);
MUST_HAVE((params != NULL) && (params->curve_name != NULL), ret, err);
/* We first pull the metadata, consisting on:
* - One byte = the key type (public or private)
* - One byte = the algorithm type (ECDSA, ECKCDSA, ...)
* - One byte = the curve type (FRP256V1, ...)
*/
/* Pull and check the key type */
MUST_HAVE((EC_PRIVKEY == priv_key_buf[0]), ret, err);
/* Pull and check the algorithm type */
MUST_HAVE((ec_key_alg == priv_key_buf[1]), ret, err);
/* Pull and check the curve type */
ret = local_strlen((const char *)params->curve_name, &len); EG(ret, err);
len += 1;
MUST_HAVE((len < 256), ret, err);
crv_name_len = (u8)len;
ret = ec_check_curve_type_and_name((ec_curve_type) (priv_key_buf[2]),
params->curve_name, crv_name_len); EG(ret, err);
ret = ec_key_pair_import_from_priv_key_buf(kp, params,
priv_key_buf + metadata_len,
(u8)(priv_key_buf_len - metadata_len),
ec_key_alg);
err:
return ret;
}
/*
* Import a key pair from a two structured key buffer (private and public one)
* The function does not verify the coherency between private and public parts.
* The function returns 0 on success, -1 on error.
*
* NOTE: please use this API with care as it does not check the consistency
* between the private and public keys! On one side, this "saves" a costly
* scalar multiplication when there is confidence in the source of the buffers,
* but on the other side the user of the API MUST check the source (integrity)
* of the private/public key pair. If unsure, it is advised to use the
* ec_structured_key_pair_import_from_priv_key_buf API that safely derives the
* public key from the private key.
*
*/
int ec_structured_key_pair_import_from_buf(ec_key_pair *kp,
const ec_params *params,
const u8 *priv_key_buf,
u8 priv_key_buf_len,
const u8 *pub_key_buf,
u8 pub_key_buf_len,
ec_alg_type ec_key_alg)
{
int ret;
MUST_HAVE((kp != NULL), ret, err);
ret = ec_structured_pub_key_import_from_buf(&kp->pub_key, params,
pub_key_buf,
pub_key_buf_len,
ec_key_alg); EG(ret, err);
ret = ec_structured_priv_key_import_from_buf(&kp->priv_key, params,
priv_key_buf,
priv_key_buf_len,
ec_key_alg);
err:
return ret;
}
/*
* Generate a public/private key pair for given signature algorithm, using
* given EC params. The function returns 0 on success, -1 on error.
*/
int ec_key_pair_gen(ec_key_pair *kp, const ec_params *params,
ec_alg_type ec_key_alg)
{
int ret;
MUST_HAVE((kp != NULL) && (params != NULL), ret, err);
/* Get a random value in ]0,q[ */
ret = nn_get_random_mod(&(kp->priv_key.x), &(params->ec_gen_order)); EG(ret, err);
/* Set key type and pointer to EC params for private key */
kp->priv_key.key_type = ec_key_alg;
kp->priv_key.params = (const ec_params *)params;
kp->priv_key.magic = PRIV_KEY_MAGIC;
/* Call our private key generation function */
ret = gen_priv_key(&(kp->priv_key)); EG(ret, err);
/* Generate associated public key. */
ret = init_pubkey_from_privkey(&(kp->pub_key), &(kp->priv_key));
err:
if (ret && (kp != NULL)) {
IGNORE_RET_VAL(local_memset(kp, 0, sizeof(ec_key_pair)));
}
return ret;
}