1 /**********************************************************************
3 * Copyright (c) 2005-2013 Cryptocom LTD *
4 * This file is distributed under the same license as OpenSSL *
6 * Implementation of GOST R 34.10-2001 *
7 * Requires OpenSSL 1.0.0+ for compilation *
8 **********************************************************************/
10 #include "gost_params.h"
12 #include <openssl/rand.h>
13 #include <openssl/ecdsa.h>
14 #include <openssl/err.h>
15 #include "e_gost_err.h"
18 void dump_signature(const char *message, const unsigned char *buffer,
20 void dump_dsa_sig(const char *message, DSA_SIG *sig);
23 # define dump_signature(a,b,c)
24 # define dump_dsa_sig(a,b)
27 static R3410_ec_params *gost_nid2params(int nid)
29 R3410_ec_params *params;
31 /* Search nid in 2012 paramset */
32 params = R3410_2012_512_paramset;
33 while (params->nid != NID_undef) {
34 if (params->nid == nid)
39 /* Search nid in 2001 paramset */
40 params = R3410_2001_paramset;
41 while (params->nid != NID_undef) {
42 if (params->nid == nid)
51 * Fills EC_KEY structure hidden in the app_data field of DSA structure
52 * with parameter information, extracted from parameter array in
55 * Also fils DSA->q field with copy of EC_GROUP order field to make
56 * DSA_size function work
58 int fill_GOST_EC_params(EC_KEY *eckey, int nid)
60 R3410_ec_params *params = gost_nid2params(nid);
63 BIGNUM *p = NULL, *q = NULL, *a = NULL, *b = NULL, *x = NULL, *y = NULL;
67 if (!eckey || !params) {
68 GOSTerr(GOST_F_FILL_GOST_EC_PARAMS, GOST_R_UNSUPPORTED_PARAMETER_SET);
72 if (!(ctx = BN_CTX_new())) {
73 GOSTerr(GOST_F_FILL_GOST_EC_PARAMS, ERR_R_MALLOC_FAILURE);
84 if (!p || !a || !b || !x || !y || !q) {
85 GOSTerr(GOST_F_FILL_GOST_EC_PARAMS, ERR_R_MALLOC_FAILURE);
89 if (!BN_hex2bn(&p, params->p)
90 || !BN_hex2bn(&a, params->a)
91 || !BN_hex2bn(&b, params->b)) {
92 GOSTerr(GOST_F_FILL_GOST_EC_PARAMS, ERR_R_INTERNAL_ERROR);
96 grp = EC_GROUP_new_curve_GFp(p, a, b, ctx);
98 GOSTerr(GOST_F_FILL_GOST_EC_PARAMS, ERR_R_MALLOC_FAILURE);
102 P = EC_POINT_new(grp);
104 GOSTerr(GOST_F_FILL_GOST_EC_PARAMS, ERR_R_MALLOC_FAILURE);
108 if (!BN_hex2bn(&x, params->x)
109 || !BN_hex2bn(&y, params->y)
110 || !EC_POINT_set_affine_coordinates_GFp(grp, P, x, y, ctx)
111 || !BN_hex2bn(&q, params->q)) {
112 GOSTerr(GOST_F_FILL_GOST_EC_PARAMS, ERR_R_INTERNAL_ERROR);
116 if (!EC_GROUP_set_generator(grp, P, q, NULL)) {
117 GOSTerr(GOST_F_FILL_GOST_EC_PARAMS, ERR_R_INTERNAL_ERROR);
120 EC_GROUP_set_curve_name(grp, params->nid);
121 if (!EC_KEY_set_group(eckey, grp)) {
122 GOSTerr(GOST_F_FILL_GOST_EC_PARAMS, ERR_R_INTERNAL_ERROR);
137 * Computes gost_ec signature as DSA_SIG structure
140 DSA_SIG *gost_ec_sign(const unsigned char *dgst, int dlen, EC_KEY *eckey)
142 DSA_SIG *newsig = NULL, *ret = NULL;
144 BIGNUM *order = NULL;
145 const EC_GROUP *group;
146 const BIGNUM *priv_key;
147 BIGNUM *r = NULL, *s = NULL, *X = NULL, *tmp = NULL, *tmp2 = NULL,
148 *k = NULL, *e = NULL;
152 OPENSSL_assert(dgst != NULL && eckey != NULL);
154 if (!(ctx = BN_CTX_new())) {
155 GOSTerr(GOST_F_GOST_EC_SIGN, ERR_R_MALLOC_FAILURE);
160 OPENSSL_assert(dlen == 32 || dlen == 64);
161 md = hashsum2bn(dgst, dlen);
162 newsig = DSA_SIG_new();
163 if (!newsig || !md) {
164 GOSTerr(GOST_F_GOST_EC_SIGN, GOST_R_NO_MEMORY);
167 group = EC_KEY_get0_group(eckey);
169 GOSTerr(GOST_F_GOST_EC_SIGN, ERR_R_INTERNAL_ERROR);
172 order = BN_CTX_get(ctx);
173 if (!order || !EC_GROUP_get_order(group, order, ctx)) {
174 GOSTerr(GOST_F_GOST_EC_SIGN, ERR_R_INTERNAL_ERROR);
177 priv_key = EC_KEY_get0_private_key(eckey);
179 GOSTerr(GOST_F_GOST_EC_SIGN, ERR_R_INTERNAL_ERROR);
183 if (!e || !BN_mod(e, md, order, ctx)) {
184 GOSTerr(GOST_F_GOST_EC_SIGN, ERR_R_INTERNAL_ERROR);
188 fprintf(stderr, "digest as bignum=");
189 BN_print_fp(stderr, md);
190 fprintf(stderr, "\ndigest mod q=");
191 BN_print_fp(stderr, e);
192 fprintf(stderr, "\n");
198 C = EC_POINT_new(group);
200 GOSTerr(GOST_F_GOST_EC_SIGN, ERR_R_MALLOC_FAILURE);
206 if (!BN_rand_range(k, order)) {
207 GOSTerr(GOST_F_GOST_EC_SIGN,
208 GOST_R_RANDOM_NUMBER_GENERATOR_FAILED);
212 * To avoid timing information leaking the length of k,
213 * compute C*k using an equivalent scalar of fixed bit-length */
214 if (!BN_add(k, k, order)
215 || (BN_num_bits(k) <= BN_num_bits(order)
216 && !BN_add(k, k, order))) {
219 if (!EC_POINT_mul(group, C, k, NULL, NULL, ctx)) {
220 GOSTerr(GOST_F_GOST_EC_SIGN, ERR_R_EC_LIB);
228 GOSTerr(GOST_F_GOST_EC_SIGN, ERR_R_MALLOC_FAILURE);
231 if (!EC_POINT_get_affine_coordinates_GFp(group, C, X, NULL, ctx)) {
232 GOSTerr(GOST_F_GOST_EC_SIGN, ERR_R_EC_LIB);
236 if (!BN_nnmod(r, X, order, ctx)) {
237 GOSTerr(GOST_F_GOST_EC_SIGN, ERR_R_INTERNAL_ERROR);
241 while (BN_is_zero(r));
242 /* s = (r*priv_key+k*e) mod order */
244 tmp = BN_CTX_get(ctx);
246 tmp2 = BN_CTX_get(ctx);
249 if (!tmp || !tmp2 || !s) {
250 GOSTerr(GOST_F_GOST_EC_SIGN, ERR_R_MALLOC_FAILURE);
254 if (!BN_mod_mul(tmp, priv_key, r, order, ctx)
255 || !BN_mod_mul(tmp2, k, e, order, ctx)
256 || !BN_mod_add(s, tmp, tmp2, order, ctx)) {
257 GOSTerr(GOST_F_GOST_EC_SIGN, ERR_R_INTERNAL_ERROR);
261 while (BN_is_zero(s));
263 newsig->s = BN_dup(s);
264 newsig->r = BN_dup(r);
265 if (!newsig->s || !newsig->r) {
266 GOSTerr(GOST_F_GOST_EC_SIGN, ERR_R_MALLOC_FAILURE);
278 if (!ret && newsig) {
279 DSA_SIG_free(newsig);
285 * Verifies gost ec signature
288 int gost_ec_verify(const unsigned char *dgst, int dgst_len,
289 DSA_SIG *sig, EC_KEY *ec)
292 const EC_GROUP *group = (ec) ? EC_KEY_get0_group(ec) : NULL;
294 BIGNUM *md = NULL, *e = NULL, *R = NULL, *v = NULL,
295 *z1 = NULL, *z2 = NULL;
296 BIGNUM *X = NULL, *tmp = NULL;
298 const EC_POINT *pub_key = NULL;
301 OPENSSL_assert(dgst != NULL && sig != NULL && group != NULL);
303 if (!(ctx = BN_CTX_new())) {
304 GOSTerr(GOST_F_GOST_EC_VERIFY, GOST_R_NO_MEMORY);
309 order = BN_CTX_get(ctx);
311 z1 = BN_CTX_get(ctx);
312 z2 = BN_CTX_get(ctx);
313 tmp = BN_CTX_get(ctx);
317 if (!order || !e || !z1 || !z2 || !tmp || !X || !R || !v) {
318 GOSTerr(GOST_F_GOST_EC_VERIFY, ERR_R_MALLOC_FAILURE);
322 pub_key = EC_KEY_get0_public_key(ec);
323 if (!pub_key || !EC_GROUP_get_order(group, order, ctx)) {
324 GOSTerr(GOST_F_GOST_EC_VERIFY, ERR_R_INTERNAL_ERROR);
328 if (BN_is_zero(sig->s) || BN_is_zero(sig->r) ||
329 (BN_cmp(sig->s, order) >= 1) || (BN_cmp(sig->r, order) >= 1)) {
330 GOSTerr(GOST_F_GOST_EC_VERIFY, GOST_R_SIGNATURE_PARTS_GREATER_THAN_Q);
335 OPENSSL_assert(dgst_len == 32 || dgst_len == 64);
336 md = hashsum2bn(dgst, dgst_len);
337 if (!md || !BN_mod(e, md, order, ctx)) {
338 GOSTerr(GOST_F_GOST_EC_VERIFY, ERR_R_INTERNAL_ERROR);
342 fprintf(stderr, "digest as bignum: ");
343 BN_print_fp(stderr, md);
344 fprintf(stderr, "\ndigest mod q: ");
345 BN_print_fp(stderr, e);
347 if (BN_is_zero(e) && !BN_one(e)) {
348 GOSTerr(GOST_F_GOST_EC_VERIFY, ERR_R_INTERNAL_ERROR);
351 v = BN_mod_inverse(v, e, order, ctx);
353 || !BN_mod_mul(z1, sig->s, v, order, ctx)
354 || !BN_sub(tmp, order, sig->r)
355 || !BN_mod_mul(z2, tmp, v, order, ctx)) {
356 GOSTerr(GOST_F_GOST_EC_VERIFY, ERR_R_INTERNAL_ERROR);
360 fprintf(stderr, "\nInverted digest value: ");
361 BN_print_fp(stderr, v);
362 fprintf(stderr, "\nz1: ");
363 BN_print_fp(stderr, z1);
364 fprintf(stderr, "\nz2: ");
365 BN_print_fp(stderr, z2);
367 C = EC_POINT_new(group);
369 GOSTerr(GOST_F_GOST_EC_VERIFY, ERR_R_MALLOC_FAILURE);
372 if (!EC_POINT_mul(group, C, z1, pub_key, z2, ctx)) {
373 GOSTerr(GOST_F_GOST_EC_VERIFY, ERR_R_EC_LIB);
376 if (!EC_POINT_get_affine_coordinates_GFp(group, C, X, NULL, ctx)) {
377 GOSTerr(GOST_F_GOST_EC_VERIFY, ERR_R_EC_LIB);
380 if (!BN_mod(R, X, order, ctx)) {
381 GOSTerr(GOST_F_GOST_EC_VERIFY, ERR_R_INTERNAL_ERROR);
385 fprintf(stderr, "\nX=");
386 BN_print_fp(stderr, X);
387 fprintf(stderr, "\nX mod q=");
388 BN_print_fp(stderr, R);
389 fprintf(stderr, "\n");
391 if (BN_cmp(R, sig->r) != 0) {
392 GOSTerr(GOST_F_GOST_EC_VERIFY, GOST_R_SIGNATURE_MISMATCH);
407 * Computes GOST R 34.10-2001 public key
408 * or GOST R 34.10-2012 public key
411 int gost_ec_compute_public(EC_KEY *ec)
413 const EC_GROUP *group = (ec) ? EC_KEY_get0_group(ec) : NULL;
414 EC_POINT *pub_key = NULL;
415 const BIGNUM *priv_key = NULL;
420 GOSTerr(GOST_F_GOST_EC_COMPUTE_PUBLIC, GOST_R_KEY_IS_NOT_INITIALIZED);
426 GOSTerr(GOST_F_GOST_EC_COMPUTE_PUBLIC, ERR_R_MALLOC_FAILURE);
431 priv_key = EC_KEY_get0_private_key(ec);
433 GOSTerr(GOST_F_GOST_EC_COMPUTE_PUBLIC, ERR_R_EC_LIB);
437 pub_key = EC_POINT_new(group);
439 GOSTerr(GOST_F_GOST_EC_COMPUTE_PUBLIC, ERR_R_MALLOC_FAILURE);
443 if (!EC_POINT_mul(group, pub_key, priv_key, NULL, NULL, ctx)) {
444 GOSTerr(GOST_F_GOST_EC_COMPUTE_PUBLIC, ERR_R_EC_LIB);
447 if (!EC_KEY_set_public_key(ec, pub_key)) {
448 GOSTerr(GOST_F_GOST_EC_COMPUTE_PUBLIC, ERR_R_EC_LIB);
454 EC_POINT_free(pub_key);
462 * Generates GOST R 34.10-2001
463 * or GOST R 34.10-2012 keypair
466 int gost_ec_keygen(EC_KEY *ec)
468 BIGNUM *order = NULL, *d = NULL;
469 const EC_GROUP *group = (ec) ? EC_KEY_get0_group(ec) : NULL;
473 GOSTerr(GOST_F_GOST_EC_KEYGEN, ERR_R_INTERNAL_ERROR);
480 GOSTerr(GOST_F_GOST_EC_KEYGEN, ERR_R_MALLOC_FAILURE);
484 if (!EC_GROUP_get_order(group, order, NULL)) {
485 GOSTerr(GOST_F_GOST_EC_KEYGEN, ERR_R_INTERNAL_ERROR);
490 if (!BN_rand_range(d, order)) {
491 GOSTerr(GOST_F_GOST_EC_KEYGEN,
492 GOST_R_RANDOM_NUMBER_GENERATOR_FAILED);
496 while (BN_is_zero(d));
498 if (!EC_KEY_set_private_key(ec, d)) {
499 GOSTerr(GOST_F_GOST_EC_KEYGEN, ERR_R_INTERNAL_ERROR);
510 return (ok) ? gost_ec_compute_public(ec) : 0;