3 * Probabistic signature scheme
5 * (c) 2000 Straylight/Edgeware
8 /*----- Licensing notice --------------------------------------------------*
10 * This file is part of Catacomb.
12 * Catacomb is free software; you can redistribute it and/or modify
13 * it under the terms of the GNU Library General Public License as
14 * published by the Free Software Foundation; either version 2 of the
15 * License, or (at your option) any later version.
17 * Catacomb is distributed in the hope that it will be useful,
18 * but WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 * GNU Library General Public License for more details.
22 * You should have received a copy of the GNU Library General Public
23 * License along with Catacomb; if not, write to the Free
24 * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
28 /*----- Header files ------------------------------------------------------*/
32 #include <mLib/alloc.h>
33 #include <mLib/bits.h>
34 #include <mLib/dstr.h>
41 /*----- Magic statics -----------------------------------------------------*/
43 static const octet z8[8] = { 0 };
45 /*----- Main code ---------------------------------------------------------*/
47 /* --- @pss_encode@ --- *
49 * Arguments: @mp *d@ = where to put the answer
50 * @const void *m@ = pointer to the message hash
51 * @size_t msz@ = the size of the message hash
52 * @octet *b@ = scratch buffer
53 * @size_t sz@ = sizeo of the buffer (large enough)
54 * @unsigned long nbits@ = size in bits of @n@
55 * @void *p@ = pointer to the PSS parameters
57 * Returns: Encoded message representative, or null on error.
59 * Use: Implements the operation @EMSA-PSS-ENCODE@, as defined in
60 * PKCS#1 v. 2.1 (RFC3447).
63 mp *pss_encode(mp *d, const void *m, size_t msz, octet *b, size_t sz,
64 unsigned long nbits, void *p)
71 size_t pssz, hsz = pp->ch->hashsz;
73 /* --- Check the message length --- */
77 mask = (1 << nbits%8) - 1;
78 if (!mask) mask = 0xff;
79 if (hsz + pp->ssz + 2 > sz)
82 /* --- Generate a random salt --- */
84 pssz = sz - pp->ssz - hsz - 2;
89 GR_FILL(pp->r, s, pp->ssz);
91 /* --- Compute the salted hash --- */
96 GH_HASH(h, s, pp->ssz);
100 /* --- Do the masking --- */
102 c = GC_INIT(pp->cc, r, hsz);
103 GC_ENCRYPT(c, b, b, pssz + pp->ssz + 1);
106 return (mp_loadb(d, b, sz));
109 /* --- @pss_decode@ --- *
111 * Arguments: @mp *s@ = the message representative
112 * @const void *m@ = the original message
113 * @size_t msz@ = the message size
114 * @octet *b@ = a scratch buffer
115 * @size_t sz@ = size of the buffer (large enough)
116 * @unsigned long nbits@ = number of bits in @n@
117 * @void *p@ = pointer to PKCS1 parameters
119 * Returns: The length of the output string if successful, negative on
122 * Use: Implements the operation @EMSA_PSS_VERIFY@, as defined in
123 * PCSK#1 v. 2.1 (RFC3447).
126 int pss_decode(mp *mi, const void *m, size_t msz, octet *b, size_t sz,
127 unsigned long nbits, void *p)
134 size_t pssz, hsz = pp->ch->hashsz, i;
137 /* --- Check the message length --- */
141 if (mp_octets(mi) > sz)
143 mask = (1 << nbits%8) - 1;
144 if (!mask) mask = 0xff;
145 if (hsz + pp->ssz + 2 > sz)
147 mp_storeb(mi, b, sz);
149 /* --- Split up the buffer --- */
151 pssz = sz - hsz - pp->ssz - 2;
157 /* --- Decode the seed --- */
161 c = GC_INIT(pp->cc, r, hsz);
162 GC_DECRYPT(c, b, b, pssz + pp->ssz + 1);
165 for (i = 0; i < pssz; i++)
166 if (b[i]) return (-1);
170 /* --- Hash the message --- */
175 GH_HASH(h, s, pp->ssz);
177 rc = !memcmp(s, r, hsz);
179 if (!rc) return (-1);
186 /*----- That's all, folks -------------------------------------------------*/