Commit | Line | Data |
---|---|---|
5c3f75ec | 1 | /* -*-c-*- |
5c3f75ec | 2 | * |
3 | * Catcrypt signatures | |
4 | * | |
5 | * (c) 2004 Straylight/Edgeware | |
6 | */ | |
7 | ||
45c0fd36 | 8 | /*----- Licensing notice --------------------------------------------------* |
5c3f75ec | 9 | * |
10 | * This file is part of Catacomb. | |
11 | * | |
12 | * Catacomb is free software; you can redistribute it and/or modify | |
13 | * it under the terms of the GNU Library General Public License as | |
14 | * published by the Free Software Foundation; either version 2 of the | |
15 | * License, or (at your option) any later version. | |
45c0fd36 | 16 | * |
5c3f75ec | 17 | * Catacomb is distributed in the hope that it will be useful, |
18 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
19 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
20 | * GNU Library General Public License for more details. | |
45c0fd36 | 21 | * |
5c3f75ec | 22 | * You should have received a copy of the GNU Library General Public |
23 | * License along with Catacomb; if not, write to the Free | |
24 | * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, | |
25 | * MA 02111-1307, USA. | |
26 | */ | |
27 | ||
28 | /*----- Header files ------------------------------------------------------*/ | |
29 | ||
cd6eca43 MW |
30 | #define _FILE_OFFSET_BITS 64 |
31 | ||
5c3f75ec | 32 | #include <stdlib.h> |
33 | ||
34 | #include <mLib/report.h> | |
35 | ||
36 | #include "rand.h" | |
37 | #include "sha.h" | |
38 | #include "has160.h" | |
d56fd9d1 | 39 | #include "sha512.h" |
c578d5d8 | 40 | #include "sha3.h" |
5c3f75ec | 41 | |
da4489a6 | 42 | #include "ct.h" |
5c3f75ec | 43 | #include "ec.h" |
44 | #include "ec-keys.h" | |
45 | #include "dh.h" | |
46 | #include "gdsa.h" | |
47 | #include "gkcdsa.h" | |
48 | #include "rsa.h" | |
d56fd9d1 | 49 | #include "ed25519.h" |
c578d5d8 | 50 | #include "ed448.h" |
5c3f75ec | 51 | |
52 | #include "cc.h" | |
53 | ||
54 | /*----- Main code ---------------------------------------------------------*/ | |
55 | ||
56 | /* --- RSA PKCS1 --- */ | |
57 | ||
58 | typedef struct rsap1_sigctx { | |
59 | sig s; | |
60 | rsa_privctx rp; | |
61 | pkcs1 p1; | |
62 | } rsap1_sigctx; | |
63 | ||
64 | static sig *rsap1_siginit(key *k, void *kd, const gchash *hc) | |
65 | { | |
66 | rsap1_sigctx *rs = CREATE(rsap1_sigctx); | |
67 | rsa_privcreate(&rs->rp, kd, &rand_global); | |
68 | rs->p1.r = &rand_global; | |
69 | rs->p1.ep = hc->name; | |
70 | rs->p1.epsz = strlen(hc->name) + 1; | |
71 | rs->s.h = 0; | |
72 | return (&rs->s); | |
73 | } | |
74 | ||
75 | static int rsap1_sigdoit(sig *s, dstr *d) | |
76 | { | |
77 | rsap1_sigctx *rs = (rsap1_sigctx *)s; | |
78 | size_t n; | |
79 | mp *m = rsa_sign(&rs->rp, MP_NEW, | |
80 | GH_DONE(s->h, 0), GH_CLASS(s->h)->hashsz, | |
81 | pkcs1_sigencode, &rs->p1); | |
82 | if (!m) return (-1); | |
83 | n = mp_octets(rs->rp.rp->n); dstr_ensure(d, n); mp_storeb(m, d->buf, n); | |
84 | d->len += n; mp_drop(m); | |
85 | return (0); | |
86 | } | |
87 | ||
88 | static const char *rsa_lengthcheck(mp *n) | |
89 | { | |
90 | if (mp_bits(n) < 1024) return ("key too short"); | |
91 | return (0); | |
92 | } | |
93 | ||
94 | static const char *rsap1_sigcheck(sig *s) | |
95 | { | |
96 | rsap1_sigctx *rs = (rsap1_sigctx *)s; | |
97 | const char *e; | |
98 | if ((e = rsa_lengthcheck(rs->rp.rp->n)) != 0) return (e); | |
99 | return (0); | |
100 | } | |
101 | ||
102 | static void rsap1_sigdestroy(sig *s) | |
103 | { | |
104 | rsap1_sigctx *rs = (rsap1_sigctx *)s; | |
105 | rsa_privdestroy(&rs->rp); | |
106 | DESTROY(rs); | |
107 | } | |
108 | ||
109 | static const sigops rsap1_sig = { | |
110 | rsa_privfetch, sizeof(rsa_priv), | |
111 | rsap1_siginit, rsap1_sigdoit, rsap1_sigcheck, rsap1_sigdestroy | |
112 | }; | |
113 | ||
114 | typedef struct rsap1_vrfctx { | |
115 | sig s; | |
116 | rsa_pubctx rp; | |
117 | pkcs1 p1; | |
118 | } rsap1_vrfctx; | |
119 | ||
120 | static sig *rsap1_vrfinit(key *k, void *kd, const gchash *hc) | |
121 | { | |
122 | rsap1_vrfctx *rv = CREATE(rsap1_vrfctx); | |
123 | rsa_pubcreate(&rv->rp, kd); | |
124 | rv->p1.r = &rand_global; | |
125 | rv->p1.ep = hc->name; | |
126 | rv->p1.epsz = strlen(hc->name) + 1; | |
127 | rv->s.h = 0; | |
128 | return (&rv->s); | |
129 | } | |
130 | ||
131 | static int rsap1_vrfdoit(sig *s, dstr *d) | |
132 | { | |
133 | rsap1_vrfctx *rv = (rsap1_vrfctx *)s; | |
134 | mp *m = mp_loadb(MP_NEW, d->buf, d->len); | |
135 | int rc = rsa_verify(&rv->rp, m, | |
136 | GH_DONE(s->h, 0), GH_CLASS(s->h)->hashsz, | |
137 | 0, pkcs1_sigdecode, &rv->p1); | |
138 | mp_drop(m); | |
139 | return (rc); | |
140 | } | |
141 | ||
142 | static const char *rsap1_vrfcheck(sig *s) | |
143 | { | |
144 | rsap1_vrfctx *rv = (rsap1_vrfctx *)s; | |
145 | const char *e; | |
146 | if ((e = rsa_lengthcheck(rv->rp.rp->n)) != 0) return (e); | |
147 | return (0); | |
148 | } | |
149 | ||
150 | static void rsap1_vrfdestroy(sig *s) | |
151 | { | |
152 | rsap1_vrfctx *rv = (rsap1_vrfctx *)s; | |
153 | rsa_pubdestroy(&rv->rp); | |
154 | DESTROY(rv); | |
155 | } | |
156 | ||
157 | static const sigops rsap1_vrf = { | |
158 | rsa_pubfetch, sizeof(rsa_pub), | |
159 | rsap1_vrfinit, rsap1_vrfdoit, rsap1_vrfcheck, rsap1_vrfdestroy | |
160 | }; | |
161 | ||
162 | /* --- RSA PSS --- */ | |
163 | ||
164 | static const gccipher *getmgf(key *k, const gchash *hc) | |
165 | { | |
166 | dstr d = DSTR_INIT; | |
167 | const gccipher *gc; | |
168 | const char *mm; | |
169 | ||
170 | if ((mm = key_getattr(0, k, "mgf")) == 0) { | |
171 | dstr_putf(&d, "%s-mgf", hc->name); | |
172 | mm = d.buf; | |
173 | } | |
174 | if ((gc = gcipher_byname(mm)) == 0) | |
175 | die(EXIT_FAILURE, "unknown encryption scheme `%s'", mm); | |
176 | dstr_destroy(&d); | |
177 | return (gc); | |
178 | } | |
179 | ||
180 | typedef struct rsapss_sigctx { | |
181 | sig s; | |
182 | rsa_privctx rp; | |
183 | pss p; | |
184 | } rsapss_sigctx; | |
185 | ||
186 | static sig *rsapss_siginit(key *k, void *kd, const gchash *hc) | |
187 | { | |
188 | rsapss_sigctx *rs = CREATE(rsapss_sigctx); | |
189 | rsa_privcreate(&rs->rp, kd, &rand_global); | |
8acb0587 | 190 | rs->s.h = 0; |
5c3f75ec | 191 | rs->p.r = &rand_global; |
192 | rs->p.cc = getmgf(k, hc); | |
193 | rs->p.ch = hc; | |
194 | rs->p.ssz = hc->hashsz; | |
5c3f75ec | 195 | return (&rs->s); |
196 | } | |
197 | ||
198 | static int rsapss_sigdoit(sig *s, dstr *d) | |
199 | { | |
200 | rsapss_sigctx *rs = (rsapss_sigctx *)s; | |
201 | size_t n; | |
202 | mp *m = rsa_sign(&rs->rp, MP_NEW, | |
203 | GH_DONE(s->h, 0), GH_CLASS(s->h)->hashsz, | |
204 | pss_encode, &rs->p); | |
205 | if (!m) return (-1); | |
206 | n = mp_octets(rs->rp.rp->n); dstr_ensure(d, n); mp_storeb(m, d->buf, n); | |
45c0fd36 | 207 | d->len += n; mp_drop(m); |
5c3f75ec | 208 | return (0); |
209 | } | |
210 | ||
211 | static const char *rsapss_sigcheck(sig *s) | |
212 | { | |
213 | rsapss_sigctx *rs = (rsapss_sigctx *)s; | |
214 | const char *e; | |
215 | if ((e = rsa_lengthcheck(rs->rp.rp->n)) != 0) return (e); | |
216 | return (0); | |
217 | } | |
218 | ||
219 | static void rsapss_sigdestroy(sig *s) | |
220 | { | |
221 | rsapss_sigctx *rs = (rsapss_sigctx *)s; | |
222 | rsa_privdestroy(&rs->rp); | |
223 | DESTROY(rs); | |
224 | } | |
225 | ||
226 | static const sigops rsapss_sig = { | |
227 | rsa_privfetch, sizeof(rsa_priv), | |
228 | rsapss_siginit, rsapss_sigdoit, rsapss_sigcheck, rsapss_sigdestroy | |
229 | }; | |
230 | ||
231 | typedef struct rsapss_vrfctx { | |
232 | sig s; | |
233 | rsa_pubctx rp; | |
234 | pss p; | |
235 | } rsapss_vrfctx; | |
236 | ||
237 | static sig *rsapss_vrfinit(key *k, void *kd, const gchash *hc) | |
238 | { | |
239 | rsapss_vrfctx *rv = CREATE(rsapss_vrfctx); | |
240 | rsa_pubcreate(&rv->rp, kd); | |
8acb0587 | 241 | rv->s.h = 0; |
5c3f75ec | 242 | rv->p.r = &rand_global; |
243 | rv->p.cc = getmgf(k, hc); | |
244 | rv->p.ch = hc; | |
245 | rv->p.ssz = hc->hashsz; | |
246 | return (&rv->s); | |
247 | } | |
248 | ||
249 | static int rsapss_vrfdoit(sig *s, dstr *d) | |
250 | { | |
251 | rsapss_vrfctx *rv = (rsapss_vrfctx *)s; | |
252 | mp *m = mp_loadb(MP_NEW, d->buf, d->len); | |
253 | int rc = rsa_verify(&rv->rp, m, | |
254 | GH_DONE(s->h, 0), GH_CLASS(s->h)->hashsz, | |
255 | 0, pss_decode, &rv->p); | |
256 | mp_drop(m); | |
257 | return (rc); | |
258 | } | |
259 | ||
260 | static const char *rsapss_vrfcheck(sig *s) | |
261 | { | |
262 | rsapss_vrfctx *rv = (rsapss_vrfctx *)s; | |
263 | const char *e; | |
264 | if ((e = rsa_lengthcheck(rv->rp.rp->n)) != 0) return (e); | |
265 | return (0); | |
266 | } | |
267 | ||
268 | static void rsapss_vrfdestroy(sig *s) | |
269 | { | |
270 | rsapss_vrfctx *rv = (rsapss_vrfctx *)s; | |
271 | rsa_pubdestroy(&rv->rp); | |
272 | DESTROY(rv); | |
273 | } | |
274 | ||
275 | static const sigops rsapss_vrf = { | |
276 | rsa_pubfetch, sizeof(rsa_pub), | |
277 | rsapss_vrfinit, rsapss_vrfdoit, rsapss_vrfcheck, rsapss_vrfdestroy | |
278 | }; | |
279 | ||
280 | /* --- DSA and ECDSA --- */ | |
281 | ||
282 | typedef struct dsa_sigctx { | |
283 | sig s; | |
284 | gdsa g; | |
285 | } dsa_sigctx; | |
286 | ||
287 | static void dsa_initcommon(dsa_sigctx *ds, const gchash *hc, | |
288 | const char *ktag) | |
289 | { | |
290 | ds->g.r = &rand_global; | |
291 | ds->g.h = hc; | |
292 | ds->g.u = MP_NEW; | |
293 | ds->s.h = 0; | |
294 | } | |
295 | ||
296 | static dsa_sigctx *dsa_doinit(key *k, const gprime_param *gp, | |
3688eb75 | 297 | mp *y, const gchash *hc, |
298 | group *(*makegroup)(const gprime_param *), | |
299 | const char *what) | |
5c3f75ec | 300 | { |
301 | dsa_sigctx *ds = CREATE(dsa_sigctx); | |
302 | dstr t = DSTR_INIT; | |
303 | ||
304 | key_fulltag(k, &t); | |
3688eb75 | 305 | if ((ds->g.g = makegroup(gp)) == 0) |
306 | die(EXIT_FAILURE, "bad %s group in key `%s'", what, t.buf); | |
5c3f75ec | 307 | ds->g.p = G_CREATE(ds->g.g); |
308 | if (G_FROMINT(ds->g.g, ds->g.p, y)) | |
309 | die(EXIT_FAILURE, "bad public key in key `%s'", t.buf); | |
310 | dsa_initcommon(ds, hc, t.buf); | |
311 | dstr_destroy(&t); | |
312 | return (ds); | |
313 | } | |
314 | ||
315 | static dsa_sigctx *ecdsa_doinit(key *k, const char *cstr, | |
316 | ec *y, const gchash *hc) | |
317 | { | |
318 | dsa_sigctx *ds = CREATE(dsa_sigctx); | |
319 | ec_info ei; | |
320 | const char *e; | |
321 | dstr t = DSTR_INIT; | |
322 | ||
323 | key_fulltag(k, &t); | |
324 | if ((e = ec_getinfo(&ei, cstr)) != 0) | |
325 | die(EXIT_FAILURE, "bad curve in key `%s': %s", t.buf, e); | |
326 | ds->g.g = group_ec(&ei); | |
327 | ds->g.p = G_CREATE(ds->g.g); | |
328 | if (G_FROMEC(ds->g.g, ds->g.p, y)) | |
329 | die(EXIT_FAILURE, "bad public key in key `%s'", t.buf); | |
330 | dsa_initcommon(ds, hc, t.buf); | |
331 | dstr_destroy(&t); | |
332 | return (ds); | |
333 | } | |
334 | ||
335 | static sig *dsa_siginit(key *k, void *kd, const gchash *hc) | |
336 | { | |
337 | dh_priv *dp = kd; | |
3688eb75 | 338 | dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_prime, "prime"); |
339 | ds->g.u = MP_COPY(dp->x); | |
340 | return (&ds->s); | |
341 | } | |
342 | ||
343 | static sig *bindsa_siginit(key *k, void *kd, const gchash *hc) | |
344 | { | |
345 | dh_priv *dp = kd; | |
346 | dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_binary, "binary"); | |
5c3f75ec | 347 | ds->g.u = MP_COPY(dp->x); |
348 | return (&ds->s); | |
349 | } | |
350 | ||
351 | static sig *ecdsa_siginit(key *k, void *kd, const gchash *hc) | |
352 | { | |
353 | ec_priv *ep = kd; | |
354 | dsa_sigctx *ds = ecdsa_doinit(k, ep->cstr, &ep->p, hc); | |
355 | ds->g.u = MP_COPY(ep->x); | |
356 | return (&ds->s); | |
357 | } | |
358 | ||
359 | static int dsa_sigdoit(sig *s, dstr *d) | |
360 | { | |
361 | dsa_sigctx *ds = (dsa_sigctx *)s; | |
362 | gdsa_sig ss = GDSA_SIG_INIT; | |
363 | size_t n = mp_octets(ds->g.g->r); | |
364 | ||
365 | gdsa_sign(&ds->g, &ss, GH_DONE(ds->s.h, 0), 0); | |
366 | dstr_ensure(d, 2 * n); | |
367 | mp_storeb(ss.r, d->buf, n); | |
368 | mp_storeb(ss.s, d->buf + n, n); | |
369 | d->len += 2 * n; | |
370 | mp_drop(ss.r); mp_drop(ss.s); | |
371 | return (0); | |
372 | } | |
373 | ||
374 | static const char *dsa_sigcheck(sig *s) | |
375 | { | |
376 | dsa_sigctx *ds = (dsa_sigctx *)s; | |
377 | const char *e; | |
378 | if ((e = G_CHECK(ds->g.g, &rand_global)) != 0) | |
379 | return (0); | |
380 | if (group_check(ds->g.g, ds->g.p)) | |
381 | return ("public key not in subgroup"); | |
382 | return (0); | |
383 | } | |
384 | ||
385 | static void dsa_sigdestroy(sig *s) | |
386 | { | |
387 | dsa_sigctx *ds = (dsa_sigctx *)s; | |
388 | G_DESTROY(ds->g.g, ds->g.p); | |
389 | mp_drop(ds->g.u); | |
390 | G_DESTROYGROUP(ds->g.g); | |
ef13e9a4 | 391 | DESTROY(ds); |
5c3f75ec | 392 | } |
393 | ||
394 | static const sigops dsa_sig = { | |
395 | dh_privfetch, sizeof(dh_priv), | |
396 | dsa_siginit, dsa_sigdoit, dsa_sigcheck, dsa_sigdestroy | |
397 | }; | |
398 | ||
3688eb75 | 399 | static const sigops bindsa_sig = { |
400 | dh_privfetch, sizeof(dh_priv), | |
401 | bindsa_siginit, dsa_sigdoit, dsa_sigcheck, dsa_sigdestroy | |
402 | }; | |
403 | ||
5c3f75ec | 404 | static const sigops ecdsa_sig = { |
405 | ec_privfetch, sizeof(ec_priv), | |
406 | ecdsa_siginit, dsa_sigdoit, dsa_sigcheck, dsa_sigdestroy | |
407 | }; | |
408 | ||
409 | static sig *dsa_vrfinit(key *k, void *kd, const gchash *hc) | |
410 | { | |
411 | dh_pub *dp = kd; | |
3688eb75 | 412 | dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_prime, "prime"); |
413 | return (&ds->s); | |
414 | } | |
415 | ||
416 | static sig *bindsa_vrfinit(key *k, void *kd, const gchash *hc) | |
417 | { | |
418 | dh_pub *dp = kd; | |
419 | dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_binary, "binary"); | |
5c3f75ec | 420 | return (&ds->s); |
421 | } | |
422 | ||
423 | static sig *ecdsa_vrfinit(key *k, void *kd, const gchash *hc) | |
424 | { | |
425 | ec_pub *ep = kd; | |
426 | dsa_sigctx *ds = ecdsa_doinit(k, ep->cstr, &ep->p, hc); | |
427 | return (&ds->s); | |
428 | } | |
429 | ||
430 | static int dsa_vrfdoit(sig *s, dstr *d) | |
431 | { | |
432 | dsa_sigctx *ds = (dsa_sigctx *)s; | |
433 | gdsa_sig ss; | |
434 | size_t n = d->len/2; | |
435 | int rc; | |
436 | ||
437 | ss.r = mp_loadb(MP_NEW, d->buf, n); | |
438 | ss.s = mp_loadb(MP_NEW, d->buf + n, d->len - n); | |
439 | rc = gdsa_verify(&ds->g, &ss, GH_DONE(ds->s.h, 0)); | |
440 | mp_drop(ss.r); mp_drop(ss.s); | |
441 | return (rc); | |
442 | } | |
443 | ||
444 | static const sigops dsa_vrf = { | |
445 | dh_pubfetch, sizeof(dh_pub), | |
446 | dsa_vrfinit, dsa_vrfdoit, dsa_sigcheck, dsa_sigdestroy | |
447 | }; | |
448 | ||
3688eb75 | 449 | static const sigops bindsa_vrf = { |
450 | dh_pubfetch, sizeof(dh_pub), | |
451 | bindsa_vrfinit, dsa_vrfdoit, dsa_sigcheck, dsa_sigdestroy | |
452 | }; | |
453 | ||
5c3f75ec | 454 | static const sigops ecdsa_vrf = { |
455 | ec_pubfetch, sizeof(ec_pub), | |
456 | ecdsa_vrfinit, dsa_vrfdoit, dsa_sigcheck, dsa_sigdestroy | |
457 | }; | |
458 | ||
459 | /* --- KCDSA and ECKCDSA --- */ | |
460 | ||
461 | static void kcdsa_privkey(dsa_sigctx *ds, mp *x) | |
462 | { ds->g.u = mp_modinv(MP_NEW, x, ds->g.g->r); } | |
463 | ||
464 | static void kcdsa_sethash(dsa_sigctx *ds, const gchash *hc) | |
465 | { ds->s.h = gkcdsa_beginhash(&ds->g); } | |
466 | ||
467 | static sig *kcdsa_siginit(key *k, void *kd, const gchash *hc) | |
468 | { | |
469 | dh_priv *dp = kd; | |
3688eb75 | 470 | dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_prime, "prime"); |
471 | kcdsa_privkey(ds, dp->x); | |
472 | kcdsa_sethash(ds, hc); | |
473 | return (&ds->s); | |
474 | } | |
475 | ||
476 | static sig *binkcdsa_siginit(key *k, void *kd, const gchash *hc) | |
477 | { | |
478 | dh_priv *dp = kd; | |
479 | dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_binary, "binary"); | |
5c3f75ec | 480 | kcdsa_privkey(ds, dp->x); |
481 | kcdsa_sethash(ds, hc); | |
482 | return (&ds->s); | |
483 | } | |
484 | ||
485 | static sig *eckcdsa_siginit(key *k, void *kd, const gchash *hc) | |
486 | { | |
487 | ec_priv *ep = kd; | |
488 | dsa_sigctx *ds = ecdsa_doinit(k, ep->cstr, &ep->p, hc); | |
489 | kcdsa_privkey(ds, ep->x); | |
490 | kcdsa_sethash(ds, hc); | |
491 | return (&ds->s); | |
492 | } | |
493 | ||
494 | static int kcdsa_sigdoit(sig *s, dstr *d) | |
495 | { | |
496 | dsa_sigctx *ds = (dsa_sigctx *)s; | |
497 | gkcdsa_sig ss = GKCDSA_SIG_INIT; | |
498 | size_t hsz = ds->g.h->hashsz, n = mp_octets(ds->g.g->r); | |
499 | ||
500 | gkcdsa_sign(&ds->g, &ss, GH_DONE(ds->s.h, 0), 0); | |
501 | dstr_ensure(d, hsz + n); | |
502 | memcpy(d->buf, ss.r, hsz); | |
503 | mp_storeb(ss.s, d->buf + hsz, n); | |
504 | d->len += hsz + n; | |
505 | xfree(ss.r); mp_drop(ss.s); | |
506 | return (0); | |
507 | } | |
508 | ||
509 | static const sigops kcdsa_sig = { | |
510 | dh_privfetch, sizeof(dh_priv), | |
511 | kcdsa_siginit, kcdsa_sigdoit, dsa_sigcheck, dsa_sigdestroy | |
512 | }; | |
513 | ||
3688eb75 | 514 | static const sigops binkcdsa_sig = { |
515 | dh_privfetch, sizeof(dh_priv), | |
516 | binkcdsa_siginit, kcdsa_sigdoit, dsa_sigcheck, dsa_sigdestroy | |
517 | }; | |
518 | ||
5c3f75ec | 519 | static const sigops eckcdsa_sig = { |
520 | ec_privfetch, sizeof(ec_priv), | |
521 | eckcdsa_siginit, kcdsa_sigdoit, dsa_sigcheck, dsa_sigdestroy | |
522 | }; | |
523 | ||
524 | static sig *kcdsa_vrfinit(key *k, void *kd, const gchash *hc) | |
525 | { | |
526 | dh_pub *dp = kd; | |
3688eb75 | 527 | dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_prime, "prime"); |
528 | kcdsa_sethash(ds, hc); | |
529 | return (&ds->s); | |
530 | } | |
531 | ||
532 | static sig *binkcdsa_vrfinit(key *k, void *kd, const gchash *hc) | |
533 | { | |
534 | dh_pub *dp = kd; | |
535 | dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_binary, "binary"); | |
5c3f75ec | 536 | kcdsa_sethash(ds, hc); |
537 | return (&ds->s); | |
538 | } | |
539 | ||
540 | static sig *eckcdsa_vrfinit(key *k, void *kd, const gchash *hc) | |
541 | { | |
542 | ec_pub *ep = kd; | |
543 | dsa_sigctx *ds = ecdsa_doinit(k, ep->cstr, &ep->p, hc); | |
544 | kcdsa_sethash(ds, hc); | |
545 | return (&ds->s); | |
546 | } | |
547 | ||
548 | static int kcdsa_vrfdoit(sig *s, dstr *d) | |
549 | { | |
550 | dsa_sigctx *ds = (dsa_sigctx *)s; | |
551 | gkcdsa_sig ss; | |
552 | size_t hsz = ds->g.h->hashsz, n = d->len - hsz; | |
553 | int rc; | |
554 | ||
555 | if (d->len < hsz) | |
556 | return (-1); | |
557 | ss.r = (octet *)d->buf; | |
558 | ss.s = mp_loadb(MP_NEW, d->buf + hsz, n); | |
559 | rc = gkcdsa_verify(&ds->g, &ss, GH_DONE(ds->s.h, 0)); | |
560 | mp_drop(ss.s); | |
561 | return (rc); | |
562 | } | |
563 | ||
564 | static const sigops kcdsa_vrf = { | |
565 | dh_pubfetch, sizeof(dh_pub), | |
566 | kcdsa_vrfinit, kcdsa_vrfdoit, dsa_sigcheck, dsa_sigdestroy | |
567 | }; | |
568 | ||
3688eb75 | 569 | static const sigops binkcdsa_vrf = { |
570 | dh_pubfetch, sizeof(dh_pub), | |
571 | binkcdsa_vrfinit, kcdsa_vrfdoit, dsa_sigcheck, dsa_sigdestroy | |
572 | }; | |
573 | ||
5c3f75ec | 574 | static const sigops eckcdsa_vrf = { |
575 | ec_pubfetch, sizeof(ec_pub), | |
576 | eckcdsa_vrfinit, kcdsa_vrfdoit, dsa_sigcheck, dsa_sigdestroy | |
577 | }; | |
578 | ||
593f7bd3 MW |
579 | /* --- EdDSA --- */ |
580 | ||
581 | #define EDDSAS(_) \ | |
c578d5d8 MW |
582 | _(ed25519, ed25519ctx, ED25519, "Ed25519", sha512) \ |
583 | _(ed448, ed448, ED448, "Ed448", shake256) | |
a7aa36f2 MW |
584 | |
585 | typedef struct eddsa_sigctx { | |
586 | sig s; | |
587 | const char *perso; | |
588 | } eddsa_sigctx; | |
593f7bd3 MW |
589 | |
590 | static sig *eddsa_siginit(key *k, void *kd, const gchash *hc) | |
591 | { | |
a7aa36f2 MW |
592 | eddsa_sigctx *es = CREATE(eddsa_sigctx); |
593 | es->s.h = 0; | |
594 | es->perso = key_getattr(0, k, "perso"); | |
595 | if (es->perso && strlen(es->perso) > ED25519_MAXPERSOSZ) { | |
596 | die(1, "EdDSA personalization string too long (max length %d)", | |
597 | ED25519_MAXPERSOSZ); | |
598 | } | |
599 | return (&es->s); | |
593f7bd3 MW |
600 | } |
601 | ||
a7aa36f2 MW |
602 | static void eddsa_sigdestroy(sig *s) |
603 | { eddsa_sigctx *es = (eddsa_sigctx *)s; DESTROY(es); } | |
593f7bd3 | 604 | |
a7aa36f2 | 605 | #define EDDSADEF(ed, sigver, ED, name, hash) \ |
593f7bd3 MW |
606 | \ |
607 | static int ed##_sigdoit(sig *s, dstr *d) \ | |
608 | { \ | |
a7aa36f2 MW |
609 | eddsa_sigctx *es = (eddsa_sigctx *)s; \ |
610 | ed##_priv *k = es->s.kd; \ | |
593f7bd3 MW |
611 | \ |
612 | dstr_ensure(d, ED##_SIGSZ); \ | |
a7aa36f2 MW |
613 | sigver##_sign((octet *)d->buf, k->priv.k, k->priv.sz, k->pub.k, \ |
614 | es->perso ? 1 : -1, es->perso, \ | |
615 | es->perso ? strlen(es->perso) : 0, \ | |
616 | GH_DONE(es->s.h, 0), GH_CLASS(es->s.h)->hashsz); \ | |
593f7bd3 MW |
617 | d->len += ED##_SIGSZ; \ |
618 | return (0); \ | |
619 | } \ | |
620 | \ | |
621 | static const char *ed##_sigcheck(sig *s) \ | |
622 | { \ | |
a7aa36f2 MW |
623 | eddsa_sigctx *es = (eddsa_sigctx *)s; \ |
624 | ed##_priv *k = es->s.kd; \ | |
593f7bd3 MW |
625 | \ |
626 | if (k->pub.sz != ED##_PUBSZ) \ | |
627 | return ("incorrect " #name " public key length"); \ | |
628 | return (0); \ | |
629 | } \ | |
630 | \ | |
631 | static const sigops ed##_sig = { \ | |
632 | ed##_privfetch, sizeof(ed##_priv), \ | |
633 | eddsa_siginit, ed##_sigdoit, ed##_sigcheck, eddsa_sigdestroy \ | |
634 | }; \ | |
635 | \ | |
636 | static int ed##_vrfdoit(sig *s, dstr *d) \ | |
637 | { \ | |
a7aa36f2 MW |
638 | eddsa_sigctx *es = (eddsa_sigctx *)s; \ |
639 | ed##_pub *k = es->s.kd; \ | |
593f7bd3 MW |
640 | \ |
641 | if (d->len != ED##_SIGSZ) return (-1); \ | |
a7aa36f2 MW |
642 | return (sigver##_verify(k->pub.k, \ |
643 | es->perso ? 1 : -1, es->perso, \ | |
644 | es->perso ? strlen(es->perso) : 0, \ | |
645 | GH_DONE(s->h, 0), GH_CLASS(s->h)->hashsz, \ | |
646 | (const octet *)d->buf)); \ | |
593f7bd3 MW |
647 | } \ |
648 | \ | |
649 | static const char *ed##_vrfcheck(sig *s) \ | |
650 | { \ | |
651 | ed##_pub *k = s->kd; \ | |
652 | \ | |
653 | if (k->pub.sz != ED##_PUBSZ) \ | |
654 | return ("incorrect " #name " public key length"); \ | |
655 | return (0); \ | |
656 | } \ | |
657 | \ | |
658 | static const sigops ed##_vrf = { \ | |
659 | ed##_pubfetch, sizeof(ed##_pub), \ | |
660 | eddsa_siginit, ed##_vrfdoit, ed##_vrfcheck, eddsa_sigdestroy \ | |
661 | }; | |
662 | ||
663 | EDDSAS(EDDSADEF) | |
664 | #undef EDDSADEF | |
d56fd9d1 | 665 | |
02dfbd5b MW |
666 | /* --- Symmetric message authentication --- */ |
667 | ||
668 | typedef struct mac_ctx { | |
669 | sig s; | |
670 | const gcmac *mc; | |
671 | gmac *m; | |
672 | key_packdef kp; | |
673 | key_bin kb; | |
674 | } mac_ctx; | |
675 | ||
676 | static sig *mac_init(key *k, void *kd, const gchash *hc) | |
677 | { | |
678 | mac_ctx *m; | |
679 | dstr d = DSTR_INIT; | |
680 | int err; | |
681 | const char *mm; | |
682 | ||
683 | m = CREATE(mac_ctx); | |
684 | ||
685 | key_fulltag(k, &d); | |
686 | m->kp.e = KENC_BINARY; | |
687 | m->kp.p = &m->kb; | |
688 | m->kp.kd = 0; | |
689 | ||
690 | if ((mm = key_getattr(0 /*yik*/, k, "mac")) == 0) { | |
691 | dstr_putf(&d, "%s-hmac", hc->name); | |
692 | mm = d.buf; | |
693 | } | |
694 | if ((m->mc = gmac_byname(mm)) == 0) | |
695 | die(EXIT_FAILURE, "unknown message authentication scheme `%s'", mm); | |
696 | dstr_reset(&d); | |
697 | ||
698 | if ((err = key_unpack(&m->kp, kd, &d)) != 0) { | |
699 | die(EXIT_FAILURE, "failed to unpack symmetric key `%s': %s", | |
700 | d.buf, key_strerror(err)); | |
701 | } | |
702 | dstr_destroy(&d); | |
703 | ||
704 | if (keysz(m->kb.sz, m->mc->keysz) != m->kb.sz) { | |
705 | die(EXIT_FAILURE, "bad key size %lu for `%s'", | |
706 | (unsigned long)m->kb.sz, m->mc->name); | |
707 | } | |
708 | m->m = GM_KEY(m->mc, m->kb.k, m->kb.sz); | |
709 | m->s.h = GM_INIT(m->m); | |
710 | return (&m->s); | |
711 | } | |
712 | ||
713 | static int mac_sigdoit(sig *s, dstr *d) | |
714 | { | |
715 | mac_ctx *m = (mac_ctx *)s; | |
716 | ||
717 | dstr_ensure(d, m->mc->hashsz); | |
718 | GH_DONE(m->s.h, d->buf); | |
719 | d->len += m->mc->hashsz; | |
720 | return (0); | |
721 | } | |
722 | ||
723 | static int mac_vrfdoit(sig *s, dstr *d) | |
724 | { | |
725 | mac_ctx *m = (mac_ctx *)s; | |
726 | const octet *t; | |
727 | ||
728 | t = GH_DONE(m->s.h, 0); | |
da4489a6 | 729 | if (d->len != m->mc->hashsz || !ct_memeq(d->buf, t, d->len)) |
02dfbd5b MW |
730 | return (-1); |
731 | return (0); | |
732 | } | |
733 | ||
734 | static const char *mac_check(sig *s) { return (0); } | |
735 | ||
736 | static void mac_destroy(sig *s) | |
737 | { | |
738 | mac_ctx *m = (mac_ctx *)s; | |
739 | GM_DESTROY(m->m); | |
740 | key_unpackdone(&m->kp); | |
741 | } | |
742 | ||
743 | static const sigops mac_sig = { | |
744 | 0, 0, | |
745 | mac_init, mac_sigdoit, mac_check, mac_destroy | |
746 | }; | |
747 | ||
748 | static const sigops mac_vrf = { | |
749 | 0, 0, | |
750 | mac_init, mac_vrfdoit, mac_check, mac_destroy | |
751 | }; | |
752 | ||
5c3f75ec | 753 | /* --- The switch table --- */ |
754 | ||
c65df279 | 755 | const struct sigtab sigtab[] = { |
5c3f75ec | 756 | { "rsapkcs1", &rsap1_sig, &rsap1_vrf, &sha }, |
757 | { "rsapss", &rsapss_sig, &rsapss_vrf, &sha }, | |
758 | { "dsa", &dsa_sig, &dsa_vrf, &sha }, | |
3688eb75 | 759 | { "bindsa", &bindsa_sig, &bindsa_vrf, &sha }, |
5c3f75ec | 760 | { "ecdsa", &ecdsa_sig, &ecdsa_vrf, &sha }, |
761 | { "kcdsa", &kcdsa_sig, &kcdsa_vrf, &has160 }, | |
3688eb75 | 762 | { "binkcdsa", &binkcdsa_sig, &binkcdsa_vrf, &has160 }, |
5c3f75ec | 763 | { "eckcdsa", &eckcdsa_sig, &eckcdsa_vrf, &has160 }, |
a7aa36f2 | 764 | #define EDDSATAB(ed, sigver, ED, name, hash) \ |
593f7bd3 MW |
765 | { #ed, &ed##_sig, &ed##_vrf, &hash }, |
766 | EDDSAS(EDDSATAB) | |
767 | #undef EDDSATAB | |
02dfbd5b | 768 | { "mac", &mac_sig, &mac_vrf, &rmd160 }, |
5c3f75ec | 769 | { 0, 0, 0 } |
770 | }; | |
771 | ||
772 | /* --- @getsig@ --- * | |
773 | * | |
774 | * Arguments: @key *k@ = the key to load | |
775 | * @const char *app@ = application name | |
776 | * @int wantpriv@ = nonzero if we want to sign | |
777 | * | |
778 | * Returns: A signature-making thing. | |
779 | * | |
780 | * Use: Loads a key and starts hashing. | |
781 | */ | |
782 | ||
783 | sig *getsig(key *k, const char *app, int wantpriv) | |
784 | { | |
785 | const char *salg, *halg = 0; | |
786 | dstr d = DSTR_INIT; | |
787 | dstr t = DSTR_INIT; | |
788 | char *p = 0; | |
789 | const char *q; | |
790 | sig *s; | |
791 | size_t n; | |
792 | const struct sigtab *st; | |
793 | const sigops *so; | |
794 | const gchash *ch; | |
795 | void *kd; | |
796 | int e; | |
797 | key_packdef *kp; | |
798 | ||
799 | /* --- Setup stuff --- */ | |
800 | ||
801 | key_fulltag(k, &t); | |
802 | ||
803 | /* --- Get the signature algorithm --- * | |
804 | * | |
805 | * Take the attribute if it's there; otherwise use the key type. | |
806 | */ | |
807 | ||
808 | n = strlen(app); | |
809 | if ((q = key_getattr(0, k, "sig")) != 0) { | |
810 | dstr_puts(&d, q); | |
811 | p = d.buf; | |
812 | } else if (strncmp(k->type, app, n) == 0 && k->type[n] == '-') { | |
813 | dstr_puts(&d, k->type); | |
814 | p = d.buf + n + 1; | |
815 | } else | |
816 | die(EXIT_FAILURE, "no signature algorithm for key `%s'", t.buf); | |
817 | ||
818 | /* --- Grab the hash algorithm --- * | |
819 | * | |
820 | * Grab it from the signature algorithm if it's there. But override that | |
821 | * from the attribute. | |
822 | */ | |
823 | ||
824 | salg = p; | |
825 | if ((p = strchr(p, '/')) != 0) { | |
826 | *p++ = 0; | |
827 | halg = p; | |
828 | } | |
829 | if ((q = key_getattr(0, k, "hash")) != 0) | |
830 | halg = q; | |
831 | ||
832 | /* --- Look up the algorithms in the table --- */ | |
833 | ||
834 | for (st = sigtab; st->name; st++) { | |
835 | if (strcmp(st->name, salg) == 0) | |
836 | goto s_found; | |
837 | } | |
838 | die(EXIT_FAILURE, "signature algorithm `%s' not found in key `%s'", | |
839 | salg, t.buf); | |
840 | s_found:; | |
841 | if (!halg) | |
842 | ch = st->ch; | |
843 | else { | |
844 | if ((ch = ghash_byname(halg)) == 0) { | |
845 | die(EXIT_FAILURE, "hash algorithm `%s' not found in key `%s'", | |
846 | halg, t.buf); | |
847 | } | |
848 | } | |
849 | so = wantpriv ? st->signops : st->verifyops; | |
850 | ||
851 | /* --- Load the key --- */ | |
852 | ||
02dfbd5b MW |
853 | if (!so->kf) { |
854 | kd = k->k; | |
855 | key_incref(kd); | |
78ec50fa | 856 | kp = 0; |
02dfbd5b MW |
857 | } else { |
858 | kd = xmalloc(so->kdsz); | |
859 | kp = key_fetchinit(so->kf, 0, kd); | |
860 | if ((e = key_fetch(kp, k)) != 0) { | |
861 | die(EXIT_FAILURE, "error fetching key `%s': %s", | |
862 | t.buf, key_strerror(e)); | |
863 | } | |
864 | } | |
5c3f75ec | 865 | s = so->init(k, kd, ch); |
866 | if (!s->h) | |
867 | s->h = GH_INIT(ch); | |
868 | s->kp = kp; | |
869 | s->ops = so; | |
870 | s->kd = kd; | |
02dfbd5b | 871 | s->ch = ch; |
5c3f75ec | 872 | |
873 | /* --- Free stuff up --- */ | |
874 | ||
875 | dstr_destroy(&d); | |
876 | dstr_destroy(&t); | |
877 | return (s); | |
878 | } | |
879 | ||
880 | /* --- @freesig@ --- * | |
881 | * | |
882 | * Arguments: @sig *s@ = signature-making thing | |
883 | * | |
884 | * Returns: --- | |
885 | * | |
886 | * Use: Frees up a signature-making thing | |
887 | */ | |
888 | ||
889 | void freesig(sig *s) | |
890 | { | |
891 | GH_DESTROY(s->h); | |
02dfbd5b MW |
892 | if (!s->ops->kf) |
893 | key_drop(s->kd); | |
45c0fd36 | 894 | else { |
02dfbd5b MW |
895 | key_fetchdone(s->kp); |
896 | xfree(s->kd); | |
897 | } | |
5c3f75ec | 898 | s->ops->destroy(s); |
899 | } | |
900 | ||
901 | /*----- That's all, folks -------------------------------------------------*/ |