|
 |
5bcc82 |
/* ecc-curves.c - Elliptic Curve parameter mangement
|
|
|
5bcc82 |
* Copyright (C) 2007, 2008, 2010, 2011 Free Software Foundation, Inc.
|
|
|
5bcc82 |
* Copyright (C) 2013 g10 Code GmbH
|
|
|
5bcc82 |
*
|
|
|
5bcc82 |
* This file is part of Libgcrypt.
|
|
|
5bcc82 |
*
|
|
|
5bcc82 |
* Libgcrypt is free software; you can redistribute it and/or modify
|
|
|
5bcc82 |
* it under the terms of the GNU Lesser General Public License as
|
|
|
5bcc82 |
* published by the Free Software Foundation; either version 2.1 of
|
|
|
5bcc82 |
* the License, or (at your option) any later version.
|
|
|
5bcc82 |
*
|
|
|
5bcc82 |
* Libgcrypt is distributed in the hope that it will be useful,
|
|
|
5bcc82 |
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
5bcc82 |
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
5bcc82 |
* GNU Lesser General Public License for more details.
|
|
|
5bcc82 |
*
|
|
|
5bcc82 |
* You should have received a copy of the GNU Lesser General Public
|
|
|
5bcc82 |
* License along with this program; if not, see <http://www.gnu.org/licenses/>.
|
|
|
5bcc82 |
*/
|
|
|
5bcc82 |
|
|
|
5bcc82 |
#include <config.h>
|
|
|
5bcc82 |
#include <stdio.h>
|
|
|
5bcc82 |
#include <stdlib.h>
|
|
|
5bcc82 |
#include <string.h>
|
|
|
5bcc82 |
#include <errno.h>
|
|
|
5bcc82 |
|
|
|
5bcc82 |
#include "g10lib.h"
|
|
|
5bcc82 |
#include "mpi.h"
|
|
|
5bcc82 |
#include "cipher.h"
|
|
|
5bcc82 |
#include "context.h"
|
|
|
5bcc82 |
#include "ec-context.h"
|
|
|
5bcc82 |
#include "pubkey-internal.h"
|
|
|
5bcc82 |
#include "ecc-common.h"
|
|
|
5bcc82 |
|
|
|
5bcc82 |
|
|
|
5bcc82 |
/* This tables defines aliases for curve names. */
|
|
|
5bcc82 |
static const struct
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
const char *name; /* Our name. */
|
|
|
5bcc82 |
const char *other; /* Other name. */
|
|
|
5bcc82 |
} curve_aliases[] =
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
{ "Curve25519", "1.3.6.1.4.1.3029.1.5.1" },
|
|
|
5bcc82 |
{ "Ed25519", "1.3.6.1.4.1.11591.15.1" },
|
|
|
5bcc82 |
|
|
|
5bcc82 |
{ "NIST P-224", "secp224r1" },
|
|
|
5bcc82 |
{ "NIST P-224", "1.3.132.0.33" }, /* SECP OID. */
|
|
|
5bcc82 |
{ "NIST P-224", "nistp224" }, /* rfc5656. */
|
|
|
5bcc82 |
|
|
|
5bcc82 |
{ "NIST P-256", "1.2.840.10045.3.1.7" }, /* From NIST SP 800-78-1. */
|
|
|
5bcc82 |
{ "NIST P-256", "prime256v1" },
|
|
|
5bcc82 |
{ "NIST P-256", "secp256r1" },
|
|
|
5bcc82 |
{ "NIST P-256", "nistp256" }, /* rfc5656. */
|
|
|
5bcc82 |
|
|
|
5bcc82 |
{ "NIST P-384", "secp384r1" },
|
|
|
5bcc82 |
{ "NIST P-384", "1.3.132.0.34" },
|
|
|
5bcc82 |
{ "NIST P-384", "nistp384" }, /* rfc5656. */
|
|
|
5bcc82 |
|
|
|
5bcc82 |
{ "NIST P-521", "secp521r1" },
|
|
|
5bcc82 |
{ "NIST P-521", "1.3.132.0.35" },
|
|
|
5bcc82 |
{ "NIST P-521", "nistp521" }, /* rfc5656. */
|
|
|
5bcc82 |
|
|
|
5bcc82 |
{ "GOST2001-test", "1.2.643.2.2.35.0" },
|
|
|
5bcc82 |
{ "GOST2001-CryptoPro-A", "1.2.643.2.2.35.1" },
|
|
|
5bcc82 |
{ "GOST2001-CryptoPro-B", "1.2.643.2.2.35.2" },
|
|
|
5bcc82 |
{ "GOST2001-CryptoPro-C", "1.2.643.2.2.35.3" },
|
|
|
5bcc82 |
{ "GOST2001-CryptoPro-A", "GOST2001-CryptoPro-XchA" },
|
|
|
5bcc82 |
{ "GOST2001-CryptoPro-C", "GOST2001-CryptoPro-XchB" },
|
|
|
5bcc82 |
{ "GOST2001-CryptoPro-A", "1.2.643.2.2.36.0" },
|
|
|
5bcc82 |
{ "GOST2001-CryptoPro-C", "1.2.643.2.2.36.1" },
|
|
|
5bcc82 |
|
|
|
5bcc82 |
{ "GOST2012-tc26-A", "1.2.643.7.1.2.1.2.1" },
|
|
|
5bcc82 |
{ "GOST2012-tc26-B", "1.2.643.7.1.2.1.2.2" },
|
|
|
5bcc82 |
|
|
|
5bcc82 |
{ "secp256k1", "1.3.132.0.10" },
|
|
|
5bcc82 |
|
|
|
5bcc82 |
{ NULL, NULL}
|
|
|
5bcc82 |
};
|
|
|
5bcc82 |
|
|
|
5bcc82 |
|
|
|
5bcc82 |
typedef struct
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
const char *desc; /* Description of the curve. */
|
|
|
5bcc82 |
unsigned int nbits; /* Number of bits. */
|
|
|
5bcc82 |
unsigned int fips:1; /* True if this is a FIPS140-2 approved curve. */
|
|
|
5bcc82 |
|
|
|
5bcc82 |
/* The model describing this curve. This is mainly used to select
|
|
|
5bcc82 |
the group equation. */
|
|
|
5bcc82 |
enum gcry_mpi_ec_models model;
|
|
|
5bcc82 |
|
|
|
5bcc82 |
/* The actual ECC dialect used. This is used for curve specific
|
|
|
5bcc82 |
optimizations and to select encodings etc. */
|
|
|
5bcc82 |
enum ecc_dialects dialect;
|
|
|
5bcc82 |
|
|
|
5bcc82 |
const char *p; /* The prime defining the field. */
|
|
|
5bcc82 |
const char *a, *b; /* The coefficients. For Twisted Edwards
|
|
|
5bcc82 |
Curves b is used for d. For Montgomery
|
|
|
5bcc82 |
Curves (a,b) has ((A-2)/4,B^-1). */
|
|
|
5bcc82 |
const char *n; /* The order of the base point. */
|
|
|
5bcc82 |
const char *g_x, *g_y; /* Base point. */
|
|
|
5bcc82 |
const char *h; /* Cofactor. */
|
|
|
5bcc82 |
} ecc_domain_parms_t;
|
|
|
5bcc82 |
|
|
|
5bcc82 |
|
|
|
5bcc82 |
/* This static table defines all available curves. */
|
|
|
5bcc82 |
static const ecc_domain_parms_t domain_parms[] =
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
/* (-x^2 + y^2 = 1 + dx^2y^2) */
|
|
|
5bcc82 |
"Ed25519", 256, 0,
|
|
|
5bcc82 |
MPI_EC_EDWARDS, ECC_DIALECT_ED25519,
|
|
|
5bcc82 |
"0x7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFED",
|
|
|
5bcc82 |
"-0x01",
|
|
|
5bcc82 |
"-0x2DFC9311D490018C7338BF8688861767FF8FF5B2BEBE27548A14B235ECA6874A",
|
|
|
5bcc82 |
"0x1000000000000000000000000000000014DEF9DEA2F79CD65812631A5CF5D3ED",
|
|
|
5bcc82 |
"0x216936D3CD6E53FEC0A4E231FDD6DC5C692CC7609525A7B2C9562D608F25D51A",
|
|
|
5bcc82 |
"0x6666666666666666666666666666666666666666666666666666666666666658",
|
|
|
5bcc82 |
"0x08"
|
|
|
5bcc82 |
},
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
/* (y^2 = x^3 + 486662*x^2 + x) */
|
|
|
5bcc82 |
"Curve25519", 256, 0,
|
|
|
5bcc82 |
MPI_EC_MONTGOMERY, ECC_DIALECT_STANDARD,
|
|
|
5bcc82 |
"0x7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFED",
|
|
|
5bcc82 |
"0x01DB41",
|
|
|
5bcc82 |
"0x01",
|
|
|
5bcc82 |
"0x1000000000000000000000000000000014DEF9DEA2F79CD65812631A5CF5D3ED",
|
|
|
5bcc82 |
"0x0000000000000000000000000000000000000000000000000000000000000009",
|
|
|
5bcc82 |
"0x20AE19A1B8A086B4E01EDD2C7748D14C923D4D7E6D7C61B229E9C5A27ECED3D9",
|
|
|
5bcc82 |
"0x08"
|
|
|
5bcc82 |
},
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
"NIST P-224", 224, 1,
|
|
|
5bcc82 |
MPI_EC_WEIERSTRASS, ECC_DIALECT_STANDARD,
|
|
|
5bcc82 |
"0xffffffffffffffffffffffffffffffff000000000000000000000001",
|
|
|
5bcc82 |
"0xfffffffffffffffffffffffffffffffefffffffffffffffffffffffe",
|
|
|
5bcc82 |
"0xb4050a850c04b3abf54132565044b0b7d7bfd8ba270b39432355ffb4",
|
|
|
5bcc82 |
"0xffffffffffffffffffffffffffff16a2e0b8f03e13dd29455c5c2a3d" ,
|
|
|
5bcc82 |
|
|
|
5bcc82 |
"0xb70e0cbd6bb4bf7f321390b94a03c1d356c21122343280d6115c1d21",
|
|
|
5bcc82 |
"0xbd376388b5f723fb4c22dfe6cd4375a05a07476444d5819985007e34",
|
|
|
5bcc82 |
"0x01"
|
|
|
5bcc82 |
},
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
"NIST P-256", 256, 1,
|
|
|
5bcc82 |
MPI_EC_WEIERSTRASS, ECC_DIALECT_STANDARD,
|
|
|
5bcc82 |
"0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff",
|
|
|
5bcc82 |
"0xffffffff00000001000000000000000000000000fffffffffffffffffffffffc",
|
|
|
5bcc82 |
"0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b",
|
|
|
5bcc82 |
"0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551",
|
|
|
5bcc82 |
|
|
|
5bcc82 |
"0x6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296",
|
|
|
5bcc82 |
"0x4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5",
|
|
|
5bcc82 |
"0x01"
|
|
|
5bcc82 |
},
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
"NIST P-384", 384, 1,
|
|
|
5bcc82 |
MPI_EC_WEIERSTRASS, ECC_DIALECT_STANDARD,
|
|
|
5bcc82 |
"0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffe"
|
|
|
5bcc82 |
"ffffffff0000000000000000ffffffff",
|
|
|
5bcc82 |
"0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffe"
|
|
|
5bcc82 |
"ffffffff0000000000000000fffffffc",
|
|
|
5bcc82 |
"0xb3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875a"
|
|
|
5bcc82 |
"c656398d8a2ed19d2a85c8edd3ec2aef",
|
|
|
5bcc82 |
"0xffffffffffffffffffffffffffffffffffffffffffffffffc7634d81f4372ddf"
|
|
|
5bcc82 |
"581a0db248b0a77aecec196accc52973",
|
|
|
5bcc82 |
|
|
|
5bcc82 |
"0xaa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741e082542a38"
|
|
|
5bcc82 |
"5502f25dbf55296c3a545e3872760ab7",
|
|
|
5bcc82 |
"0x3617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c0"
|
|
|
5bcc82 |
"0a60b1ce1d7e819d7a431d7c90ea0e5f",
|
|
|
5bcc82 |
"0x01"
|
|
|
5bcc82 |
},
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
"NIST P-521", 521, 1,
|
|
|
5bcc82 |
MPI_EC_WEIERSTRASS, ECC_DIALECT_STANDARD,
|
|
|
5bcc82 |
"0x01ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
|
|
|
5bcc82 |
"ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
|
|
|
5bcc82 |
"0x01ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
|
|
|
5bcc82 |
"fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc",
|
|
|
5bcc82 |
"0x051953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef10"
|
|
|
5bcc82 |
"9e156193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f00",
|
|
|
5bcc82 |
"0x1fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
|
|
|
5bcc82 |
"ffa51868783bf2f966b7fcc0148f709a5d03bb5c9b8899c47aebb6fb71e91386409",
|
|
|
5bcc82 |
|
|
|
5bcc82 |
"0x00c6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d"
|
|
|
5bcc82 |
"3dbaa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66",
|
|
|
5bcc82 |
"0x011839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e"
|
|
|
5bcc82 |
"662c97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650",
|
|
|
5bcc82 |
"0x01"
|
|
|
5bcc82 |
},
|
|
|
5bcc82 |
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
"GOST2001-test", 256, 0,
|
|
|
5bcc82 |
MPI_EC_WEIERSTRASS, ECC_DIALECT_STANDARD,
|
|
|
5bcc82 |
"0x8000000000000000000000000000000000000000000000000000000000000431",
|
|
|
5bcc82 |
"0x0000000000000000000000000000000000000000000000000000000000000007",
|
|
|
5bcc82 |
"0x5fbff498aa938ce739b8e022fbafef40563f6e6a3472fc2a514c0ce9dae23b7e",
|
|
|
5bcc82 |
"0x8000000000000000000000000000000150fe8a1892976154c59cfc193accf5b3",
|
|
|
5bcc82 |
|
|
|
5bcc82 |
"0x0000000000000000000000000000000000000000000000000000000000000002",
|
|
|
5bcc82 |
"0x08e2a8a0e65147d4bd6316030e16d19c85c97f0a9ca267122b96abbcea7e8fc8",
|
|
|
5bcc82 |
"0x01"
|
|
|
5bcc82 |
},
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
"GOST2001-CryptoPro-A", 256, 0,
|
|
|
5bcc82 |
MPI_EC_WEIERSTRASS, ECC_DIALECT_STANDARD,
|
|
|
5bcc82 |
"0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd97",
|
|
|
5bcc82 |
"0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd94",
|
|
|
5bcc82 |
"0x00000000000000000000000000000000000000000000000000000000000000a6",
|
|
|
5bcc82 |
"0xffffffffffffffffffffffffffffffff6c611070995ad10045841b09b761b893",
|
|
|
5bcc82 |
"0x0000000000000000000000000000000000000000000000000000000000000001",
|
|
|
5bcc82 |
"0x8d91e471e0989cda27df505a453f2b7635294f2ddf23e3b122acc99c9e9f1e14",
|
|
|
5bcc82 |
"0x01"
|
|
|
5bcc82 |
},
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
"GOST2001-CryptoPro-B", 256, 0,
|
|
|
5bcc82 |
MPI_EC_WEIERSTRASS, ECC_DIALECT_STANDARD,
|
|
|
5bcc82 |
"0x8000000000000000000000000000000000000000000000000000000000000c99",
|
|
|
5bcc82 |
"0x8000000000000000000000000000000000000000000000000000000000000c96",
|
|
|
5bcc82 |
"0x3e1af419a269a5f866a7d3c25c3df80ae979259373ff2b182f49d4ce7e1bbc8b",
|
|
|
5bcc82 |
"0x800000000000000000000000000000015f700cfff1a624e5e497161bcc8a198f",
|
|
|
5bcc82 |
"0x0000000000000000000000000000000000000000000000000000000000000001",
|
|
|
5bcc82 |
"0x3fa8124359f96680b83d1c3eb2c070e5c545c9858d03ecfb744bf8d717717efc",
|
|
|
5bcc82 |
"0x01"
|
|
|
5bcc82 |
},
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
"GOST2001-CryptoPro-C", 256, 0,
|
|
|
5bcc82 |
MPI_EC_WEIERSTRASS, ECC_DIALECT_STANDARD,
|
|
|
5bcc82 |
"0x9b9f605f5a858107ab1ec85e6b41c8aacf846e86789051d37998f7b9022d759b",
|
|
|
5bcc82 |
"0x9b9f605f5a858107ab1ec85e6b41c8aacf846e86789051d37998f7b9022d7598",
|
|
|
5bcc82 |
"0x000000000000000000000000000000000000000000000000000000000000805a",
|
|
|
5bcc82 |
"0x9b9f605f5a858107ab1ec85e6b41c8aa582ca3511eddfb74f02f3a6598980bb9",
|
|
|
5bcc82 |
"0x0000000000000000000000000000000000000000000000000000000000000000",
|
|
|
5bcc82 |
"0x41ece55743711a8c3cbf3783cd08c0ee4d4dc440d4641a8f366e550dfdb3bb67",
|
|
|
5bcc82 |
"0x01"
|
|
|
5bcc82 |
},
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
"GOST2012-test", 511, 0,
|
|
|
5bcc82 |
MPI_EC_WEIERSTRASS, ECC_DIALECT_STANDARD,
|
|
|
5bcc82 |
"0x4531acd1fe0023c7550d267b6b2fee80922b14b2ffb90f04d4eb7c09b5d2d15d"
|
|
|
5bcc82 |
"f1d852741af4704a0458047e80e4546d35b8336fac224dd81664bbf528be6373",
|
|
|
5bcc82 |
"0x0000000000000000000000000000000000000000000000000000000000000007",
|
|
|
5bcc82 |
"0x1cff0806a31116da29d8cfa54e57eb748bc5f377e49400fdd788b649eca1ac4"
|
|
|
5bcc82 |
"361834013b2ad7322480a89ca58e0cf74bc9e540c2add6897fad0a3084f302adc",
|
|
|
5bcc82 |
"0x4531acd1fe0023c7550d267b6b2fee80922b14b2ffb90f04d4eb7c09b5d2d15d"
|
|
|
5bcc82 |
"a82f2d7ecb1dbac719905c5eecc423f1d86e25edbe23c595d644aaf187e6e6df",
|
|
|
5bcc82 |
|
|
|
5bcc82 |
"0x24d19cc64572ee30f396bf6ebbfd7a6c5213b3b3d7057cc825f91093a68cd762"
|
|
|
5bcc82 |
"fd60611262cd838dc6b60aa7eee804e28bc849977fac33b4b530f1b120248a9a",
|
|
|
5bcc82 |
"0x2bb312a43bd2ce6e0d020613c857acddcfbf061e91e5f2c3f32447c259f39b2"
|
|
|
5bcc82 |
"c83ab156d77f1496bf7eb3351e1ee4e43dc1a18b91b24640b6dbb92cb1add371e",
|
|
|
5bcc82 |
"0x01"
|
|
|
5bcc82 |
},
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
"GOST2012-tc26-A", 512, 0,
|
|
|
5bcc82 |
MPI_EC_WEIERSTRASS, ECC_DIALECT_STANDARD,
|
|
|
5bcc82 |
"0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
|
|
|
5bcc82 |
"fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffdc7",
|
|
|
5bcc82 |
"0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
|
|
|
5bcc82 |
"fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffdc4",
|
|
|
5bcc82 |
"0xe8c2505dedfc86ddc1bd0b2b6667f1da34b82574761cb0e879bd081cfd0b6265"
|
|
|
5bcc82 |
"ee3cb090f30d27614cb4574010da90dd862ef9d4ebee4761503190785a71c760",
|
|
|
5bcc82 |
"0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
|
|
|
5bcc82 |
"27e69532f48d89116ff22b8d4e0560609b4b38abfad2b85dcacdb1411f10b275",
|
|
|
5bcc82 |
"0x0000000000000000000000000000000000000000000000000000000000000000"
|
|
|
5bcc82 |
"0000000000000000000000000000000000000000000000000000000000000003",
|
|
|
5bcc82 |
"0x7503cfe87a836ae3a61b8816e25450e6ce5e1c93acf1abc1778064fdcbefa921"
|
|
|
5bcc82 |
"df1626be4fd036e93d75e6a50e3a41e98028fe5fc235f5b889a589cb5215f2a4",
|
|
|
5bcc82 |
"0x01"
|
|
|
5bcc82 |
},
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
"GOST2012-tc26-B", 512, 0,
|
|
|
5bcc82 |
MPI_EC_WEIERSTRASS, ECC_DIALECT_STANDARD,
|
|
|
5bcc82 |
"0x8000000000000000000000000000000000000000000000000000000000000000"
|
|
|
5bcc82 |
"000000000000000000000000000000000000000000000000000000000000006f",
|
|
|
5bcc82 |
"0x8000000000000000000000000000000000000000000000000000000000000000"
|
|
|
5bcc82 |
"000000000000000000000000000000000000000000000000000000000000006c",
|
|
|
5bcc82 |
"0x687d1b459dc841457e3e06cf6f5e2517b97c7d614af138bcbf85dc806c4b289f"
|
|
|
5bcc82 |
"3e965d2db1416d217f8b276fad1ab69c50f78bee1fa3106efb8ccbc7c5140116",
|
|
|
5bcc82 |
"0x8000000000000000000000000000000000000000000000000000000000000001"
|
|
|
5bcc82 |
"49a1ec142565a545acfdb77bd9d40cfa8b996712101bea0ec6346c54374f25bd",
|
|
|
5bcc82 |
"0x0000000000000000000000000000000000000000000000000000000000000000"
|
|
|
5bcc82 |
"0000000000000000000000000000000000000000000000000000000000000002",
|
|
|
5bcc82 |
"0x1a8f7eda389b094c2c071e3647a8940f3c123b697578c213be6dd9e6c8ec7335"
|
|
|
5bcc82 |
"dcb228fd1edf4a39152cbcaaf8c0398828041055f94ceeec7e21340780fe41bd",
|
|
|
5bcc82 |
"0x01"
|
|
|
5bcc82 |
},
|
|
|
5bcc82 |
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
"secp256k1", 256, 0,
|
|
|
5bcc82 |
MPI_EC_WEIERSTRASS, ECC_DIALECT_STANDARD,
|
|
|
5bcc82 |
"0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F",
|
|
|
5bcc82 |
"0x0000000000000000000000000000000000000000000000000000000000000000",
|
|
|
5bcc82 |
"0x0000000000000000000000000000000000000000000000000000000000000007",
|
|
|
5bcc82 |
"0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141",
|
|
|
5bcc82 |
"0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798",
|
|
|
5bcc82 |
"0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8",
|
|
|
5bcc82 |
"0x01"
|
|
|
5bcc82 |
},
|
|
|
5bcc82 |
|
|
|
5bcc82 |
{ NULL, 0, 0, 0, 0, NULL, NULL, NULL, NULL, NULL }
|
|
|
5bcc82 |
};
|
|
|
5bcc82 |
|
|
|
5bcc82 |
|
|
|
5bcc82 |
|
|
|
5bcc82 |
|
|
|
5bcc82 |
/* Return a copy of POINT. */
|
|
|
5bcc82 |
static gcry_mpi_point_t
|
|
|
5bcc82 |
point_copy (gcry_mpi_point_t point)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
gcry_mpi_point_t newpoint;
|
|
|
5bcc82 |
|
|
|
5bcc82 |
if (point)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
newpoint = mpi_point_new (0);
|
|
|
5bcc82 |
point_set (newpoint, point);
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
else
|
|
|
5bcc82 |
newpoint = NULL;
|
|
|
5bcc82 |
return newpoint;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
|
|
|
5bcc82 |
|
|
|
5bcc82 |
/* Helper to scan a hex string. */
|
|
|
5bcc82 |
static gcry_mpi_t
|
|
|
5bcc82 |
scanval (const char *string)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
gpg_err_code_t rc;
|
|
|
5bcc82 |
gcry_mpi_t val;
|
|
|
5bcc82 |
|
|
|
5bcc82 |
rc = _gcry_mpi_scan (&val, GCRYMPI_FMT_HEX, string, 0, NULL);
|
|
|
5bcc82 |
if (rc)
|
|
|
5bcc82 |
log_fatal ("scanning ECC parameter failed: %s\n", gpg_strerror (rc));
|
|
|
5bcc82 |
return val;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
|
|
|
5bcc82 |
|
|
|
5bcc82 |
/* Return the index of the domain_parms table for a curve with NAME.
|
|
|
5bcc82 |
Return -1 if not found. */
|
|
|
5bcc82 |
static int
|
|
|
5bcc82 |
find_domain_parms_idx (const char *name)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
int idx, aliasno;
|
|
|
5bcc82 |
|
|
|
5bcc82 |
/* First check our native curves. */
|
|
|
5bcc82 |
for (idx = 0; domain_parms[idx].desc; idx++)
|
|
|
5bcc82 |
if (!strcmp (name, domain_parms[idx].desc))
|
|
|
5bcc82 |
return idx;
|
|
|
5bcc82 |
|
|
|
5bcc82 |
/* If not found consult the alias table. */
|
|
|
5bcc82 |
if (!domain_parms[idx].desc)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
for (aliasno = 0; curve_aliases[aliasno].name; aliasno++)
|
|
|
5bcc82 |
if (!strcmp (name, curve_aliases[aliasno].other))
|
|
|
5bcc82 |
break;
|
|
|
5bcc82 |
if (curve_aliases[aliasno].name)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
for (idx = 0; domain_parms[idx].desc; idx++)
|
|
|
5bcc82 |
if (!strcmp (curve_aliases[aliasno].name, domain_parms[idx].desc))
|
|
|
5bcc82 |
return idx;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
|
|
|
5bcc82 |
return -1;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
|
|
|
5bcc82 |
|
|
|
5bcc82 |
/* Generate the crypto system setup. This function takes the NAME of
|
|
|
5bcc82 |
a curve or the desired number of bits and stores at R_CURVE the
|
|
|
5bcc82 |
parameters of the named curve or those of a suitable curve. If
|
|
|
5bcc82 |
R_NBITS is not NULL, the chosen number of bits is stored there.
|
|
|
5bcc82 |
NULL may be given for R_CURVE, if the value is not required and for
|
|
|
5bcc82 |
example only a quick test for availability is desired. Note that
|
|
|
5bcc82 |
the curve fields should be initialized to zero because fields which
|
|
|
5bcc82 |
are not NULL are skipped. */
|
|
|
5bcc82 |
gpg_err_code_t
|
|
|
5bcc82 |
_gcry_ecc_fill_in_curve (unsigned int nbits, const char *name,
|
|
|
5bcc82 |
elliptic_curve_t *curve, unsigned int *r_nbits)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
int idx;
|
|
|
5bcc82 |
const char *resname = NULL; /* Set to a found curve name. */
|
|
|
5bcc82 |
|
|
|
5bcc82 |
if (name)
|
|
|
5bcc82 |
idx = find_domain_parms_idx (name);
|
|
|
5bcc82 |
else
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
for (idx = 0; domain_parms[idx].desc; idx++)
|
|
|
5bcc82 |
if (nbits == domain_parms[idx].nbits
|
|
|
5bcc82 |
&& domain_parms[idx].model == MPI_EC_WEIERSTRASS)
|
|
|
5bcc82 |
break;
|
|
|
5bcc82 |
if (!domain_parms[idx].desc)
|
|
|
5bcc82 |
idx = -1;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
if (idx < 0)
|
|
|
5bcc82 |
return GPG_ERR_UNKNOWN_CURVE;
|
|
|
5bcc82 |
|
|
|
5bcc82 |
resname = domain_parms[idx].desc;
|
|
|
5bcc82 |
|
|
|
5bcc82 |
/* In fips mode we only support NIST curves. Note that it is
|
|
|
5bcc82 |
possible to bypass this check by specifying the curve parameters
|
|
|
5bcc82 |
directly. */
|
|
|
5bcc82 |
if (fips_mode () && !domain_parms[idx].fips )
|
|
|
5bcc82 |
return GPG_ERR_NOT_SUPPORTED;
|
|
|
5bcc82 |
|
|
|
5bcc82 |
switch (domain_parms[idx].model)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
case MPI_EC_WEIERSTRASS:
|
|
|
5bcc82 |
case MPI_EC_EDWARDS:
|
|
|
5bcc82 |
case MPI_EC_MONTGOMERY:
|
|
|
5bcc82 |
break;
|
|
|
5bcc82 |
default:
|
|
|
5bcc82 |
return GPG_ERR_BUG;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
|
|
|
5bcc82 |
|
|
|
5bcc82 |
if (r_nbits)
|
|
|
5bcc82 |
*r_nbits = domain_parms[idx].nbits;
|
|
|
5bcc82 |
|
|
|
5bcc82 |
if (curve)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
curve->model = domain_parms[idx].model;
|
|
|
5bcc82 |
curve->dialect = domain_parms[idx].dialect;
|
|
|
5bcc82 |
if (!curve->p)
|
|
|
5bcc82 |
curve->p = scanval (domain_parms[idx].p);
|
|
|
5bcc82 |
if (!curve->a)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
curve->a = scanval (domain_parms[idx].a);
|
|
|
5bcc82 |
if (curve->a->sign)
|
|
|
5bcc82 |
mpi_add (curve->a, curve->p, curve->a);
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
if (!curve->b)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
curve->b = scanval (domain_parms[idx].b);
|
|
|
5bcc82 |
if (curve->b->sign)
|
|
|
5bcc82 |
mpi_add (curve->b, curve->p, curve->b);
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
if (!curve->n)
|
|
|
5bcc82 |
curve->n = scanval (domain_parms[idx].n);
|
|
|
5bcc82 |
if (!curve->h)
|
|
|
5bcc82 |
curve->h = scanval (domain_parms[idx].h);
|
|
|
5bcc82 |
if (!curve->G.x)
|
|
|
5bcc82 |
curve->G.x = scanval (domain_parms[idx].g_x);
|
|
|
5bcc82 |
if (!curve->G.y)
|
|
|
5bcc82 |
curve->G.y = scanval (domain_parms[idx].g_y);
|
|
|
5bcc82 |
if (!curve->G.z)
|
|
|
5bcc82 |
curve->G.z = mpi_alloc_set_ui (1);
|
|
|
5bcc82 |
if (!curve->name)
|
|
|
5bcc82 |
curve->name = resname;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
|
|
|
5bcc82 |
return 0;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
|
|
|
5bcc82 |
|
|
|
5bcc82 |
/* Give the name of the curve NAME, store the curve parameters into P,
|
|
|
5bcc82 |
A, B, G, N, and H if they point to NULL value. Note that G is returned
|
|
|
5bcc82 |
in standard uncompressed format. Also update MODEL and DIALECT if
|
|
|
5bcc82 |
they are not NULL. */
|
|
|
5bcc82 |
gpg_err_code_t
|
|
|
5bcc82 |
_gcry_ecc_update_curve_param (const char *name,
|
|
|
5bcc82 |
enum gcry_mpi_ec_models *model,
|
|
|
5bcc82 |
enum ecc_dialects *dialect,
|
|
|
5bcc82 |
gcry_mpi_t *p, gcry_mpi_t *a, gcry_mpi_t *b,
|
|
|
5bcc82 |
gcry_mpi_t *g, gcry_mpi_t *n, gcry_mpi_t *h)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
int idx;
|
|
|
5bcc82 |
|
|
|
5bcc82 |
idx = find_domain_parms_idx (name);
|
|
|
5bcc82 |
if (idx < 0)
|
|
|
5bcc82 |
return GPG_ERR_UNKNOWN_CURVE;
|
|
|
5bcc82 |
|
|
|
5bcc82 |
if (g)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
char *buf;
|
|
|
5bcc82 |
size_t len;
|
|
|
5bcc82 |
|
|
|
5bcc82 |
len = 4;
|
|
|
5bcc82 |
len += strlen (domain_parms[idx].g_x+2);
|
|
|
5bcc82 |
len += strlen (domain_parms[idx].g_y+2);
|
|
|
5bcc82 |
len++;
|
|
|
5bcc82 |
buf = xtrymalloc (len);
|
|
|
5bcc82 |
if (!buf)
|
|
|
5bcc82 |
return gpg_err_code_from_syserror ();
|
|
|
5bcc82 |
strcpy (stpcpy (stpcpy (buf, "0x04"), domain_parms[idx].g_x+2),
|
|
|
5bcc82 |
domain_parms[idx].g_y+2);
|
|
|
5bcc82 |
_gcry_mpi_release (*g);
|
|
|
5bcc82 |
*g = scanval (buf);
|
|
|
5bcc82 |
xfree (buf);
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
if (model)
|
|
|
5bcc82 |
*model = domain_parms[idx].model;
|
|
|
5bcc82 |
if (dialect)
|
|
|
5bcc82 |
*dialect = domain_parms[idx].dialect;
|
|
|
5bcc82 |
if (p)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
_gcry_mpi_release (*p);
|
|
|
5bcc82 |
*p = scanval (domain_parms[idx].p);
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
if (a)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
_gcry_mpi_release (*a);
|
|
|
5bcc82 |
*a = scanval (domain_parms[idx].a);
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
if (b)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
_gcry_mpi_release (*b);
|
|
|
5bcc82 |
*b = scanval (domain_parms[idx].b);
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
if (n)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
_gcry_mpi_release (*n);
|
|
|
5bcc82 |
*n = scanval (domain_parms[idx].n);
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
if (h)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
_gcry_mpi_release (*h);
|
|
|
5bcc82 |
*h = scanval (domain_parms[idx].h);
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
return 0;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
|
|
|
5bcc82 |
|
|
|
5bcc82 |
/* Return the name matching the parameters in PKEY. This works only
|
|
|
5bcc82 |
with curves described by the Weierstrass equation. */
|
|
|
5bcc82 |
const char *
|
|
|
5bcc82 |
_gcry_ecc_get_curve (gcry_sexp_t keyparms, int iterator, unsigned int *r_nbits)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
gpg_err_code_t rc;
|
|
|
5bcc82 |
const char *result = NULL;
|
|
|
5bcc82 |
elliptic_curve_t E;
|
|
|
5bcc82 |
gcry_mpi_t mpi_g = NULL;
|
|
|
5bcc82 |
gcry_mpi_t tmp = NULL;
|
|
|
5bcc82 |
int idx;
|
|
|
5bcc82 |
|
|
|
5bcc82 |
memset (&E, 0, sizeof E);
|
|
|
5bcc82 |
|
|
|
5bcc82 |
if (r_nbits)
|
|
|
5bcc82 |
*r_nbits = 0;
|
|
|
5bcc82 |
|
|
|
5bcc82 |
if (!keyparms)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
idx = iterator;
|
|
|
5bcc82 |
if (idx >= 0 && idx < DIM (domain_parms))
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
result = domain_parms[idx].desc;
|
|
|
5bcc82 |
if (r_nbits)
|
|
|
5bcc82 |
*r_nbits = domain_parms[idx].nbits;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
return result;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
|
|
|
5bcc82 |
|
|
|
5bcc82 |
/*
|
|
|
5bcc82 |
* Extract the curve parameters..
|
|
|
5bcc82 |
*/
|
|
|
5bcc82 |
rc = gpg_err_code (sexp_extract_param (keyparms, NULL, "-pabgnh",
|
|
|
5bcc82 |
&E.p, &E.a, &E.b, &mpi_g, &E.n, &E.h,
|
|
|
5bcc82 |
NULL));
|
|
|
5bcc82 |
if (rc == GPG_ERR_NO_OBJ)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
/* This might be the second use case of checking whether a
|
|
|
5bcc82 |
specific curve given by name is supported. */
|
|
|
5bcc82 |
gcry_sexp_t l1;
|
|
|
5bcc82 |
char *name;
|
|
|
5bcc82 |
|
|
|
5bcc82 |
l1 = sexp_find_token (keyparms, "curve", 5);
|
|
|
5bcc82 |
if (!l1)
|
|
|
5bcc82 |
goto leave; /* No curve name parameter. */
|
|
|
5bcc82 |
|
|
|
5bcc82 |
name = sexp_nth_string (l1, 1);
|
|
|
5bcc82 |
sexp_release (l1);
|
|
|
5bcc82 |
if (!name)
|
|
|
5bcc82 |
goto leave; /* Name missing or out of core. */
|
|
|
5bcc82 |
|
|
|
5bcc82 |
idx = find_domain_parms_idx (name);
|
|
|
5bcc82 |
xfree (name);
|
|
|
5bcc82 |
if (idx >= 0) /* Curve found. */
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
result = domain_parms[idx].desc;
|
|
|
5bcc82 |
if (r_nbits)
|
|
|
5bcc82 |
*r_nbits = domain_parms[idx].nbits;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
return result;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
|
|
|
5bcc82 |
if (rc)
|
|
|
5bcc82 |
goto leave;
|
|
|
5bcc82 |
|
|
|
5bcc82 |
if (mpi_g)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
_gcry_mpi_point_init (&E.G);
|
|
|
5bcc82 |
if (_gcry_ecc_os2ec (&E.G, mpi_g))
|
|
|
5bcc82 |
goto leave;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
|
|
|
5bcc82 |
for (idx = 0; domain_parms[idx].desc; idx++)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
mpi_free (tmp);
|
|
|
5bcc82 |
tmp = scanval (domain_parms[idx].p);
|
|
|
5bcc82 |
if (!mpi_cmp (tmp, E.p))
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
mpi_free (tmp);
|
|
|
5bcc82 |
tmp = scanval (domain_parms[idx].a);
|
|
|
5bcc82 |
if (!mpi_cmp (tmp, E.a))
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
mpi_free (tmp);
|
|
|
5bcc82 |
tmp = scanval (domain_parms[idx].b);
|
|
|
5bcc82 |
if (!mpi_cmp (tmp, E.b))
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
mpi_free (tmp);
|
|
|
5bcc82 |
tmp = scanval (domain_parms[idx].n);
|
|
|
5bcc82 |
if (!mpi_cmp (tmp, E.n))
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
mpi_free (tmp);
|
|
|
5bcc82 |
tmp = scanval (domain_parms[idx].h);
|
|
|
5bcc82 |
if (!mpi_cmp (tmp, E.h))
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
mpi_free (tmp);
|
|
|
5bcc82 |
tmp = scanval (domain_parms[idx].g_x);
|
|
|
5bcc82 |
if (!mpi_cmp (tmp, E.G.x))
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
mpi_free (tmp);
|
|
|
5bcc82 |
tmp = scanval (domain_parms[idx].g_y);
|
|
|
5bcc82 |
if (!mpi_cmp (tmp, E.G.y))
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
result = domain_parms[idx].desc;
|
|
|
5bcc82 |
if (r_nbits)
|
|
|
5bcc82 |
*r_nbits = domain_parms[idx].nbits;
|
|
|
5bcc82 |
goto leave;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
|
|
|
5bcc82 |
leave:
|
|
|
5bcc82 |
_gcry_mpi_release (tmp);
|
|
|
5bcc82 |
_gcry_mpi_release (E.p);
|
|
|
5bcc82 |
_gcry_mpi_release (E.a);
|
|
|
5bcc82 |
_gcry_mpi_release (E.b);
|
|
|
5bcc82 |
_gcry_mpi_release (mpi_g);
|
|
|
5bcc82 |
_gcry_mpi_point_free_parts (&E.G);
|
|
|
5bcc82 |
_gcry_mpi_release (E.n);
|
|
|
5bcc82 |
_gcry_mpi_release (E.h);
|
|
|
5bcc82 |
return result;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
|
|
|
5bcc82 |
|
|
|
5bcc82 |
/* Helper to extract an MPI from key parameters. */
|
|
|
5bcc82 |
static gpg_err_code_t
|
|
|
5bcc82 |
mpi_from_keyparam (gcry_mpi_t *r_a, gcry_sexp_t keyparam, const char *name)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
gcry_err_code_t ec = 0;
|
|
|
5bcc82 |
gcry_sexp_t l1;
|
|
|
5bcc82 |
|
|
|
5bcc82 |
l1 = sexp_find_token (keyparam, name, 0);
|
|
|
5bcc82 |
if (l1)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
*r_a = sexp_nth_mpi (l1, 1, GCRYMPI_FMT_USG);
|
|
|
5bcc82 |
sexp_release (l1);
|
|
|
5bcc82 |
if (!*r_a)
|
|
|
5bcc82 |
ec = GPG_ERR_INV_OBJ;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
return ec;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
|
|
|
5bcc82 |
/* Helper to extract a point from key parameters. If no parameter
|
|
|
5bcc82 |
with NAME is found, the functions tries to find a non-encoded point
|
|
|
5bcc82 |
by appending ".x", ".y" and ".z" to NAME. ".z" is in this case
|
|
|
5bcc82 |
optional and defaults to 1. EC is the context which at this point
|
|
|
5bcc82 |
may not be fully initialized. */
|
|
|
5bcc82 |
static gpg_err_code_t
|
|
|
5bcc82 |
point_from_keyparam (gcry_mpi_point_t *r_a,
|
|
|
5bcc82 |
gcry_sexp_t keyparam, const char *name, mpi_ec_t ec)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
gcry_err_code_t rc;
|
|
|
5bcc82 |
gcry_sexp_t l1;
|
|
|
5bcc82 |
gcry_mpi_point_t point;
|
|
|
5bcc82 |
|
|
|
5bcc82 |
l1 = sexp_find_token (keyparam, name, 0);
|
|
|
5bcc82 |
if (l1)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
gcry_mpi_t a;
|
|
|
5bcc82 |
|
|
|
5bcc82 |
a = sexp_nth_mpi (l1, 1, GCRYMPI_FMT_OPAQUE);
|
|
|
5bcc82 |
sexp_release (l1);
|
|
|
5bcc82 |
if (!a)
|
|
|
5bcc82 |
return GPG_ERR_INV_OBJ;
|
|
|
5bcc82 |
|
|
|
5bcc82 |
point = mpi_point_new (0);
|
|
|
5bcc82 |
if (ec && ec->dialect == ECC_DIALECT_ED25519)
|
|
|
5bcc82 |
rc = _gcry_ecc_eddsa_decodepoint (a, ec, point, NULL, NULL);
|
|
|
5bcc82 |
else
|
|
|
5bcc82 |
rc = _gcry_ecc_os2ec (point, a);
|
|
|
5bcc82 |
mpi_free (a);
|
|
|
5bcc82 |
if (rc)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
mpi_point_release (point);
|
|
|
5bcc82 |
return rc;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
else
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
char *tmpname;
|
|
|
5bcc82 |
gcry_mpi_t x = NULL;
|
|
|
5bcc82 |
gcry_mpi_t y = NULL;
|
|
|
5bcc82 |
gcry_mpi_t z = NULL;
|
|
|
5bcc82 |
|
|
|
5bcc82 |
tmpname = xtrymalloc (strlen (name) + 2 + 1);
|
|
|
5bcc82 |
if (!tmpname)
|
|
|
5bcc82 |
return gpg_err_code_from_syserror ();
|
|
|
5bcc82 |
strcpy (stpcpy (tmpname, name), ".x");
|
|
|
5bcc82 |
rc = mpi_from_keyparam (&x, keyparam, tmpname);
|
|
|
5bcc82 |
if (rc)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
xfree (tmpname);
|
|
|
5bcc82 |
return rc;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
strcpy (stpcpy (tmpname, name), ".y");
|
|
|
5bcc82 |
rc = mpi_from_keyparam (&y, keyparam, tmpname);
|
|
|
5bcc82 |
if (rc)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
mpi_free (x);
|
|
|
5bcc82 |
xfree (tmpname);
|
|
|
5bcc82 |
return rc;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
strcpy (stpcpy (tmpname, name), ".z");
|
|
|
5bcc82 |
rc = mpi_from_keyparam (&z, keyparam, tmpname);
|
|
|
5bcc82 |
if (rc)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
mpi_free (y);
|
|
|
5bcc82 |
mpi_free (x);
|
|
|
5bcc82 |
xfree (tmpname);
|
|
|
5bcc82 |
return rc;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
if (!z)
|
|
|
5bcc82 |
z = mpi_set_ui (NULL, 1);
|
|
|
5bcc82 |
if (x && y)
|
|
|
5bcc82 |
point = mpi_point_snatch_set (NULL, x, y, z);
|
|
|
5bcc82 |
else
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
mpi_free (x);
|
|
|
5bcc82 |
mpi_free (y);
|
|
|
5bcc82 |
mpi_free (z);
|
|
|
5bcc82 |
point = NULL;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
xfree (tmpname);
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
|
|
|
5bcc82 |
if (point)
|
|
|
5bcc82 |
*r_a = point;
|
|
|
5bcc82 |
return 0;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
|
|
|
5bcc82 |
|
|
|
5bcc82 |
/* This function creates a new context for elliptic curve operations.
|
|
|
5bcc82 |
Either KEYPARAM or CURVENAME must be given. If both are given and
|
|
|
5bcc82 |
KEYPARAM has no curve parameter, CURVENAME is used to add missing
|
|
|
5bcc82 |
parameters. On success 0 is returned and the new context stored at
|
|
|
5bcc82 |
R_CTX. On error NULL is stored at R_CTX and an error code is
|
|
|
5bcc82 |
returned. The context needs to be released using
|
|
|
5bcc82 |
gcry_ctx_release. */
|
|
|
5bcc82 |
gpg_err_code_t
|
|
|
5bcc82 |
_gcry_mpi_ec_new (gcry_ctx_t *r_ctx,
|
|
|
5bcc82 |
gcry_sexp_t keyparam, const char *curvename)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
gpg_err_code_t errc;
|
|
|
5bcc82 |
gcry_ctx_t ctx = NULL;
|
|
|
5bcc82 |
enum gcry_mpi_ec_models model = MPI_EC_WEIERSTRASS;
|
|
|
5bcc82 |
enum ecc_dialects dialect = ECC_DIALECT_STANDARD;
|
|
|
5bcc82 |
gcry_mpi_t p = NULL;
|
|
|
5bcc82 |
gcry_mpi_t a = NULL;
|
|
|
5bcc82 |
gcry_mpi_t b = NULL;
|
|
|
5bcc82 |
gcry_mpi_point_t G = NULL;
|
|
|
5bcc82 |
gcry_mpi_t n = NULL;
|
|
|
5bcc82 |
gcry_mpi_t h = NULL;
|
|
|
5bcc82 |
gcry_mpi_point_t Q = NULL;
|
|
|
5bcc82 |
gcry_mpi_t d = NULL;
|
|
|
5bcc82 |
int flags = 0;
|
|
|
5bcc82 |
gcry_sexp_t l1;
|
|
|
5bcc82 |
|
|
|
5bcc82 |
*r_ctx = NULL;
|
|
|
5bcc82 |
|
|
|
5bcc82 |
if (keyparam)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
/* Parse an optional flags list. */
|
|
|
5bcc82 |
l1 = sexp_find_token (keyparam, "flags", 0);
|
|
|
5bcc82 |
if (l1)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
errc = _gcry_pk_util_parse_flaglist (l1, &flags, NULL);
|
|
|
5bcc82 |
sexp_release (l1);
|
|
|
5bcc82 |
l1 = NULL;
|
|
|
5bcc82 |
if (errc)
|
|
|
5bcc82 |
goto leave;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
|
|
|
5bcc82 |
/* Check whether a curve name was given. */
|
|
|
5bcc82 |
l1 = sexp_find_token (keyparam, "curve", 5);
|
|
|
5bcc82 |
|
|
|
5bcc82 |
/* If we don't have a curve name or if override parameters have
|
|
|
5bcc82 |
explicitly been requested, parse them. */
|
|
|
5bcc82 |
if (!l1 || (flags & PUBKEY_FLAG_PARAM))
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
errc = mpi_from_keyparam (&p, keyparam, "p");
|
|
|
5bcc82 |
if (errc)
|
|
|
5bcc82 |
goto leave;
|
|
|
5bcc82 |
errc = mpi_from_keyparam (&a, keyparam, "a");
|
|
|
5bcc82 |
if (errc)
|
|
|
5bcc82 |
goto leave;
|
|
|
5bcc82 |
errc = mpi_from_keyparam (&b, keyparam, "b");
|
|
|
5bcc82 |
if (errc)
|
|
|
5bcc82 |
goto leave;
|
|
|
5bcc82 |
errc = point_from_keyparam (&G, keyparam, "g", NULL);
|
|
|
5bcc82 |
if (errc)
|
|
|
5bcc82 |
goto leave;
|
|
|
5bcc82 |
errc = mpi_from_keyparam (&n, keyparam, "n");
|
|
|
5bcc82 |
if (errc)
|
|
|
5bcc82 |
goto leave;
|
|
|
5bcc82 |
errc = mpi_from_keyparam (&h, keyparam, "h");
|
|
|
5bcc82 |
if (errc)
|
|
|
5bcc82 |
goto leave;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
else
|
|
|
5bcc82 |
l1 = NULL; /* No curvename. */
|
|
|
5bcc82 |
|
|
|
5bcc82 |
/* Check whether a curve parameter is available and use that to fill
|
|
|
5bcc82 |
in missing values. If no curve parameter is available try an
|
|
|
5bcc82 |
optional provided curvename. If only the curvename has been
|
|
|
5bcc82 |
given use that one. */
|
|
|
5bcc82 |
if (l1 || curvename)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
char *name;
|
|
|
5bcc82 |
elliptic_curve_t *E;
|
|
|
5bcc82 |
|
|
|
5bcc82 |
if (l1)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
name = sexp_nth_string (l1, 1);
|
|
|
5bcc82 |
sexp_release (l1);
|
|
|
5bcc82 |
if (!name)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
errc = GPG_ERR_INV_OBJ; /* Name missing or out of core. */
|
|
|
5bcc82 |
goto leave;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
else
|
|
|
5bcc82 |
name = NULL;
|
|
|
5bcc82 |
|
|
|
5bcc82 |
E = xtrycalloc (1, sizeof *E);
|
|
|
5bcc82 |
if (!E)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
errc = gpg_err_code_from_syserror ();
|
|
|
5bcc82 |
xfree (name);
|
|
|
5bcc82 |
goto leave;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
|
|
|
5bcc82 |
errc = _gcry_ecc_fill_in_curve (0, name? name : curvename, E, NULL);
|
|
|
5bcc82 |
xfree (name);
|
|
|
5bcc82 |
if (errc)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
xfree (E);
|
|
|
5bcc82 |
goto leave;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
|
|
|
5bcc82 |
model = E->model;
|
|
|
5bcc82 |
dialect = E->dialect;
|
|
|
5bcc82 |
|
|
|
5bcc82 |
if (!p)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
p = E->p;
|
|
|
5bcc82 |
E->p = NULL;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
if (!a)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
a = E->a;
|
|
|
5bcc82 |
E->a = NULL;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
if (!b)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
b = E->b;
|
|
|
5bcc82 |
E->b = NULL;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
if (!G)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
G = mpi_point_snatch_set (NULL, E->G.x, E->G.y, E->G.z);
|
|
|
5bcc82 |
E->G.x = NULL;
|
|
|
5bcc82 |
E->G.y = NULL;
|
|
|
5bcc82 |
E->G.z = NULL;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
if (!n)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
n = E->n;
|
|
|
5bcc82 |
E->n = NULL;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
if (!h)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
h = E->h;
|
|
|
5bcc82 |
E->h = NULL;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
_gcry_ecc_curve_free (E);
|
|
|
5bcc82 |
xfree (E);
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
|
|
|
5bcc82 |
|
|
|
5bcc82 |
errc = _gcry_mpi_ec_p_new (&ctx, model, dialect, flags, p, a, b);
|
|
|
5bcc82 |
if (!errc)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
mpi_ec_t ec = _gcry_ctx_get_pointer (ctx, CONTEXT_TYPE_EC);
|
|
|
5bcc82 |
|
|
|
5bcc82 |
if (b)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
mpi_free (ec->b);
|
|
|
5bcc82 |
ec->b = b;
|
|
|
5bcc82 |
b = NULL;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
if (G)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
ec->G = G;
|
|
|
5bcc82 |
G = NULL;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
if (n)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
ec->n = n;
|
|
|
5bcc82 |
n = NULL;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
if (h)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
ec->h = h;
|
|
|
5bcc82 |
h = NULL;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
|
|
|
5bcc82 |
/* Now that we know the curve name we can look for the public key
|
|
|
5bcc82 |
Q. point_from_keyparam needs to know the curve parameters so
|
|
|
5bcc82 |
that it is able to use the correct decompression. Parsing
|
|
|
5bcc82 |
the private key D could have been done earlier but it is less
|
|
|
5bcc82 |
surprising if we do it here as well. */
|
|
|
5bcc82 |
if (keyparam)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
errc = point_from_keyparam (&Q, keyparam, "q", ec);
|
|
|
5bcc82 |
if (errc)
|
|
|
5bcc82 |
goto leave;
|
|
|
5bcc82 |
errc = mpi_from_keyparam (&d, keyparam, "d");
|
|
|
5bcc82 |
if (errc)
|
|
|
5bcc82 |
goto leave;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
|
|
|
5bcc82 |
if (Q)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
ec->Q = Q;
|
|
|
5bcc82 |
Q = NULL;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
if (d)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
ec->d = d;
|
|
|
5bcc82 |
d = NULL;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
|
|
|
5bcc82 |
*r_ctx = ctx;
|
|
|
5bcc82 |
ctx = NULL;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
|
|
|
5bcc82 |
leave:
|
|
|
5bcc82 |
_gcry_ctx_release (ctx);
|
|
|
5bcc82 |
mpi_free (p);
|
|
|
5bcc82 |
mpi_free (a);
|
|
|
5bcc82 |
mpi_free (b);
|
|
|
5bcc82 |
_gcry_mpi_point_release (G);
|
|
|
5bcc82 |
mpi_free (n);
|
|
|
5bcc82 |
mpi_free (h);
|
|
|
5bcc82 |
_gcry_mpi_point_release (Q);
|
|
|
5bcc82 |
mpi_free (d);
|
|
|
5bcc82 |
return errc;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
|
|
|
5bcc82 |
|
|
|
5bcc82 |
/* Return the parameters of the curve NAME as an S-expression. */
|
|
|
5bcc82 |
gcry_sexp_t
|
|
|
5bcc82 |
_gcry_ecc_get_param_sexp (const char *name)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
unsigned int nbits;
|
|
|
5bcc82 |
elliptic_curve_t E;
|
|
|
5bcc82 |
mpi_ec_t ctx;
|
|
|
5bcc82 |
gcry_mpi_t g_x, g_y;
|
|
|
5bcc82 |
gcry_mpi_t pkey[7];
|
|
|
5bcc82 |
gcry_sexp_t result;
|
|
|
5bcc82 |
int i;
|
|
|
5bcc82 |
|
|
|
5bcc82 |
memset (&E, 0, sizeof E);
|
|
|
5bcc82 |
if (_gcry_ecc_fill_in_curve (0, name, &E, &nbits))
|
|
|
5bcc82 |
return NULL;
|
|
|
5bcc82 |
|
|
|
5bcc82 |
g_x = mpi_new (0);
|
|
|
5bcc82 |
g_y = mpi_new (0);
|
|
|
5bcc82 |
ctx = _gcry_mpi_ec_p_internal_new (MPI_EC_WEIERSTRASS,
|
|
|
5bcc82 |
ECC_DIALECT_STANDARD,
|
|
|
5bcc82 |
0,
|
|
|
5bcc82 |
E.p, E.a, NULL);
|
|
|
5bcc82 |
if (_gcry_mpi_ec_get_affine (g_x, g_y, &E.G, ctx))
|
|
|
5bcc82 |
log_fatal ("ecc get param: Failed to get affine coordinates\n");
|
|
|
5bcc82 |
_gcry_mpi_ec_free (ctx);
|
|
|
5bcc82 |
_gcry_mpi_point_free_parts (&E.G);
|
|
|
5bcc82 |
|
|
|
5bcc82 |
pkey[0] = E.p;
|
|
|
5bcc82 |
pkey[1] = E.a;
|
|
|
5bcc82 |
pkey[2] = E.b;
|
|
|
5bcc82 |
pkey[3] = _gcry_ecc_ec2os (g_x, g_y, E.p);
|
|
|
5bcc82 |
pkey[4] = E.n;
|
|
|
5bcc82 |
pkey[5] = E.h;
|
|
|
5bcc82 |
pkey[6] = NULL;
|
|
|
5bcc82 |
|
|
|
5bcc82 |
mpi_free (g_x);
|
|
|
5bcc82 |
mpi_free (g_y);
|
|
|
5bcc82 |
|
|
|
5bcc82 |
if (sexp_build (&result, NULL,
|
|
|
5bcc82 |
"(public-key(ecc(p%m)(a%m)(b%m)(g%m)(n%m)(h%m)))",
|
|
|
5bcc82 |
pkey[0], pkey[1], pkey[2], pkey[3], pkey[4], pkey[5]))
|
|
|
5bcc82 |
result = NULL;
|
|
|
5bcc82 |
|
|
|
5bcc82 |
for (i=0; pkey[i]; i++)
|
|
|
5bcc82 |
_gcry_mpi_release (pkey[i]);
|
|
|
5bcc82 |
|
|
|
5bcc82 |
return result;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
|
|
|
5bcc82 |
|
|
|
5bcc82 |
/* Return an MPI (or opaque MPI) described by NAME and the context EC.
|
|
|
5bcc82 |
If COPY is true a copy is returned, if not a const MPI may be
|
|
|
5bcc82 |
returned. In any case mpi_free must be used. */
|
|
|
5bcc82 |
gcry_mpi_t
|
|
|
5bcc82 |
_gcry_ecc_get_mpi (const char *name, mpi_ec_t ec, int copy)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
if (!*name)
|
|
|
5bcc82 |
return NULL;
|
|
|
5bcc82 |
|
|
|
5bcc82 |
if (!strcmp (name, "p") && ec->p)
|
|
|
5bcc82 |
return mpi_is_const (ec->p) && !copy? ec->p : mpi_copy (ec->p);
|
|
|
5bcc82 |
if (!strcmp (name, "a") && ec->a)
|
|
|
5bcc82 |
return mpi_is_const (ec->a) && !copy? ec->a : mpi_copy (ec->a);
|
|
|
5bcc82 |
if (!strcmp (name, "b") && ec->b)
|
|
|
5bcc82 |
return mpi_is_const (ec->b) && !copy? ec->b : mpi_copy (ec->b);
|
|
|
5bcc82 |
if (!strcmp (name, "n") && ec->n)
|
|
|
5bcc82 |
return mpi_is_const (ec->n) && !copy? ec->n : mpi_copy (ec->n);
|
|
|
5bcc82 |
if (!strcmp (name, "h") && ec->h)
|
|
|
5bcc82 |
return mpi_is_const (ec->h) && !copy? ec->h : mpi_copy (ec->h);
|
|
|
5bcc82 |
if (!strcmp (name, "d") && ec->d)
|
|
|
5bcc82 |
return mpi_is_const (ec->d) && !copy? ec->d : mpi_copy (ec->d);
|
|
|
5bcc82 |
|
|
|
5bcc82 |
/* Return a requested point coordinate. */
|
|
|
5bcc82 |
if (!strcmp (name, "g.x") && ec->G && ec->G->x)
|
|
|
5bcc82 |
return mpi_is_const (ec->G->x) && !copy? ec->G->x : mpi_copy (ec->G->x);
|
|
|
5bcc82 |
if (!strcmp (name, "g.y") && ec->G && ec->G->y)
|
|
|
5bcc82 |
return mpi_is_const (ec->G->y) && !copy? ec->G->y : mpi_copy (ec->G->y);
|
|
|
5bcc82 |
if (!strcmp (name, "q.x") && ec->Q && ec->Q->x)
|
|
|
5bcc82 |
return mpi_is_const (ec->Q->x) && !copy? ec->Q->x : mpi_copy (ec->Q->x);
|
|
|
5bcc82 |
if (!strcmp (name, "q.y") && ec->Q && ec->Q->y)
|
|
|
5bcc82 |
return mpi_is_const (ec->Q->y) && !copy? ec->Q->y : mpi_copy (ec->Q->y);
|
|
|
5bcc82 |
|
|
|
5bcc82 |
/* If the base point has been requested, return it in standard
|
|
|
5bcc82 |
encoding. */
|
|
|
5bcc82 |
if (!strcmp (name, "g") && ec->G)
|
|
|
5bcc82 |
return _gcry_mpi_ec_ec2os (ec->G, ec);
|
|
|
5bcc82 |
|
|
|
5bcc82 |
/* If the public key has been requested, return it by default in
|
|
|
5bcc82 |
standard uncompressed encoding or if requested in other
|
|
|
5bcc82 |
encodings. */
|
|
|
5bcc82 |
if (*name == 'q' && (!name[1] || name[1] == '@'))
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
/* If only the private key is given, compute the public key. */
|
|
|
5bcc82 |
if (!ec->Q)
|
|
|
5bcc82 |
ec->Q = _gcry_ecc_compute_public (NULL, ec, NULL, NULL);
|
|
|
5bcc82 |
|
|
|
5bcc82 |
if (!ec->Q)
|
|
|
5bcc82 |
return NULL;
|
|
|
5bcc82 |
|
|
|
5bcc82 |
if (name[1] != '@')
|
|
|
5bcc82 |
return _gcry_mpi_ec_ec2os (ec->Q, ec);
|
|
|
5bcc82 |
|
|
|
5bcc82 |
if (!strcmp (name+2, "eddsa") && ec->model == MPI_EC_EDWARDS)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
unsigned char *encpk;
|
|
|
5bcc82 |
unsigned int encpklen;
|
|
|
5bcc82 |
|
|
|
5bcc82 |
if (!_gcry_ecc_eddsa_encodepoint (ec->Q, ec, NULL, NULL, 0,
|
|
|
5bcc82 |
&encpk, &encpklen))
|
|
|
5bcc82 |
return mpi_set_opaque (NULL, encpk, encpklen*8);
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
|
|
|
5bcc82 |
return NULL;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
|
|
|
5bcc82 |
|
|
|
5bcc82 |
/* Return a point described by NAME and the context EC. */
|
|
|
5bcc82 |
gcry_mpi_point_t
|
|
|
5bcc82 |
_gcry_ecc_get_point (const char *name, mpi_ec_t ec)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
if (!strcmp (name, "g") && ec->G)
|
|
|
5bcc82 |
return point_copy (ec->G);
|
|
|
5bcc82 |
if (!strcmp (name, "q"))
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
/* If only the private key is given, compute the public key. */
|
|
|
5bcc82 |
if (!ec->Q)
|
|
|
5bcc82 |
ec->Q = _gcry_ecc_compute_public (NULL, ec, NULL, NULL);
|
|
|
5bcc82 |
|
|
|
5bcc82 |
if (ec->Q)
|
|
|
5bcc82 |
return point_copy (ec->Q);
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
|
|
|
5bcc82 |
return NULL;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
|
|
|
5bcc82 |
|
|
|
5bcc82 |
/* Store the MPI NEWVALUE into the context EC under NAME. */
|
|
|
5bcc82 |
gpg_err_code_t
|
|
|
5bcc82 |
_gcry_ecc_set_mpi (const char *name, gcry_mpi_t newvalue, mpi_ec_t ec)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
gpg_err_code_t rc = 0;
|
|
|
5bcc82 |
|
|
|
5bcc82 |
if (!*name)
|
|
|
5bcc82 |
;
|
|
|
5bcc82 |
else if (!strcmp (name, "p"))
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
mpi_free (ec->p);
|
|
|
5bcc82 |
ec->p = mpi_copy (newvalue);
|
|
|
5bcc82 |
_gcry_mpi_ec_get_reset (ec);
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
else if (!strcmp (name, "a"))
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
mpi_free (ec->a);
|
|
|
5bcc82 |
ec->a = mpi_copy (newvalue);
|
|
|
5bcc82 |
_gcry_mpi_ec_get_reset (ec);
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
else if (!strcmp (name, "b"))
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
mpi_free (ec->b);
|
|
|
5bcc82 |
ec->b = mpi_copy (newvalue);
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
else if (!strcmp (name, "n"))
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
mpi_free (ec->n);
|
|
|
5bcc82 |
ec->n = mpi_copy (newvalue);
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
else if (!strcmp (name, "h"))
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
mpi_free (ec->h);
|
|
|
5bcc82 |
ec->h = mpi_copy (newvalue);
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
else if (*name == 'q' && (!name[1] || name[1] == '@'))
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
if (newvalue)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
if (!ec->Q)
|
|
|
5bcc82 |
ec->Q = mpi_point_new (0);
|
|
|
5bcc82 |
if (ec->dialect == ECC_DIALECT_ED25519)
|
|
|
5bcc82 |
rc = _gcry_ecc_eddsa_decodepoint (newvalue, ec, ec->Q, NULL, NULL);
|
|
|
5bcc82 |
else
|
|
|
5bcc82 |
rc = _gcry_ecc_os2ec (ec->Q, newvalue);
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
if (rc || !newvalue)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
_gcry_mpi_point_release (ec->Q);
|
|
|
5bcc82 |
ec->Q = NULL;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
/* Note: We assume that Q matches d and thus do not reset d. */
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
else if (!strcmp (name, "d"))
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
mpi_free (ec->d);
|
|
|
5bcc82 |
ec->d = mpi_copy (newvalue);
|
|
|
5bcc82 |
if (ec->d)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
/* We need to reset the public key because it may not
|
|
|
5bcc82 |
anymore match. */
|
|
|
5bcc82 |
_gcry_mpi_point_release (ec->Q);
|
|
|
5bcc82 |
ec->Q = NULL;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
else
|
|
|
5bcc82 |
rc = GPG_ERR_UNKNOWN_NAME;
|
|
|
5bcc82 |
|
|
|
5bcc82 |
return rc;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
|
|
|
5bcc82 |
|
|
|
5bcc82 |
/* Store the point NEWVALUE into the context EC under NAME. */
|
|
|
5bcc82 |
gpg_err_code_t
|
|
|
5bcc82 |
_gcry_ecc_set_point (const char *name, gcry_mpi_point_t newvalue, mpi_ec_t ec)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
if (!strcmp (name, "g"))
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
_gcry_mpi_point_release (ec->G);
|
|
|
5bcc82 |
ec->G = point_copy (newvalue);
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
else if (!strcmp (name, "q"))
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
_gcry_mpi_point_release (ec->Q);
|
|
|
5bcc82 |
ec->Q = point_copy (newvalue);
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
else
|
|
|
5bcc82 |
return GPG_ERR_UNKNOWN_NAME;
|
|
|
5bcc82 |
|
|
|
5bcc82 |
return 0;
|
|
|
5bcc82 |
}
|