use super::digest_scalar::digest_scalar;
use crate::{
arithmetic::montgomery::*,
cpu, digest,
ec::{
self,
suite_b::{ops::*, private_key},
},
error,
io::der,
limb, pkcs8, rand, sealed, signature,
};
use untrusted;
pub struct EcdsaSigningAlgorithm {
curve: &'static ec::Curve,
private_scalar_ops: &'static PrivateScalarOps,
private_key_ops: &'static PrivateKeyOps,
digest_alg: &'static digest::Algorithm,
pkcs8_template: &'static pkcs8::Template,
format_rs: fn(ops: &'static ScalarOps, r: &Scalar, s: &Scalar, out: &mut [u8]) -> usize,
id: AlgorithmID,
}
#[derive(Debug, Eq, PartialEq)]
enum AlgorithmID {
ECDSA_P256_SHA256_FIXED_SIGNING,
ECDSA_P384_SHA384_FIXED_SIGNING,
ECDSA_P256_SHA256_ASN1_SIGNING,
ECDSA_P384_SHA384_ASN1_SIGNING,
}
derive_debug_via_id!(EcdsaSigningAlgorithm);
impl PartialEq for EcdsaSigningAlgorithm {
fn eq(&self, other: &Self) -> bool {
self.id == other.id
}
}
impl Eq for EcdsaSigningAlgorithm {}
impl sealed::Sealed for EcdsaSigningAlgorithm {}
pub struct EcdsaKeyPair {
d: Scalar<R>,
alg: &'static EcdsaSigningAlgorithm,
public_key: PublicKey,
}
derive_debug_via_field!(EcdsaKeyPair, stringify!(EcdsaKeyPair), public_key);
impl EcdsaKeyPair {
pub fn generate_pkcs8(
alg: &'static EcdsaSigningAlgorithm,
rng: &dyn rand::SecureRandom,
) -> Result<pkcs8::Document, error::Unspecified> {
let private_key = ec::Seed::generate(alg.curve, rng, cpu::features())?;
let public_key = private_key.compute_public_key()?;
Ok(pkcs8::wrap_key(
&alg.pkcs8_template,
private_key.bytes_less_safe(),
public_key.as_ref(),
))
}
pub fn from_pkcs8(
alg: &'static EcdsaSigningAlgorithm,
pkcs8: &[u8],
) -> Result<Self, error::KeyRejected> {
let key_pair = ec::suite_b::key_pair_from_pkcs8(
alg.curve,
alg.pkcs8_template,
untrusted::Input::from(pkcs8),
cpu::features(),
)?;
Ok(Self::new(alg, key_pair))
}
pub fn from_private_key_and_public_key(
alg: &'static EcdsaSigningAlgorithm,
private_key: &[u8],
public_key: &[u8],
) -> Result<Self, error::KeyRejected> {
let key_pair = ec::suite_b::key_pair_from_bytes(
alg.curve,
untrusted::Input::from(private_key),
untrusted::Input::from(public_key),
cpu::features(),
)?;
Ok(Self::new(alg, key_pair))
}
fn new(alg: &'static EcdsaSigningAlgorithm, key_pair: ec::KeyPair) -> Self {
let (seed, public_key) = key_pair.split();
let d = private_key::private_key_as_scalar(alg.private_key_ops, &seed);
let d = alg
.private_scalar_ops
.scalar_ops
.scalar_product(&d, &alg.private_scalar_ops.oneRR_mod_n);
Self {
d,
alg,
public_key: PublicKey(public_key),
}
}
pub fn sign(
&self,
rng: &dyn rand::SecureRandom,
message: &[u8],
) -> Result<signature::Signature, error::Unspecified> {
let h = digest::digest(self.alg.digest_alg, message);
self.sign_(rng, h)
}
fn sign_(
&self,
rng: &dyn rand::SecureRandom,
h: digest::Digest,
) -> Result<signature::Signature, error::Unspecified> {
let ops = self.alg.private_scalar_ops;
let scalar_ops = ops.scalar_ops;
let cops = scalar_ops.common;
let private_key_ops = self.alg.private_key_ops;
for _ in 0..100 {
let k = private_key::random_scalar(self.alg.private_key_ops, rng)?;
let k_inv = scalar_ops.scalar_inv_to_mont(&k);
let r = private_key_ops.point_mul_base(&k);
let r = {
let (x, _) = private_key::affine_from_jacobian(private_key_ops, &r)?;
let x = cops.elem_unencoded(&x);
elem_reduced_to_scalar(cops, &x)
};
if cops.is_zero(&r) {
continue;
}
let e = digest_scalar(scalar_ops, h);
let s = {
let dr = scalar_ops.scalar_product(&self.d, &r);
let e_plus_dr = scalar_sum(cops, &e, &dr);
scalar_ops.scalar_product(&k_inv, &e_plus_dr)
};
if cops.is_zero(&s) {
continue;
}
return Ok(signature::Signature::new(|sig_bytes| {
(self.alg.format_rs)(scalar_ops, &r, &s, sig_bytes)
}));
}
Err(error::Unspecified)
}
}
impl signature::KeyPair for EcdsaKeyPair {
type PublicKey = PublicKey;
fn public_key(&self) -> &Self::PublicKey {
&self.public_key
}
}
#[derive(Clone, Copy)]
pub struct PublicKey(ec::PublicKey);
derive_debug_self_as_ref_hex_bytes!(PublicKey);
impl AsRef<[u8]> for PublicKey {
fn as_ref(&self) -> &[u8] {
self.0.as_ref()
}
}
fn format_rs_fixed(ops: &'static ScalarOps, r: &Scalar, s: &Scalar, out: &mut [u8]) -> usize {
let scalar_len = ops.scalar_bytes_len();
let (r_out, rest) = out.split_at_mut(scalar_len);
limb::big_endian_from_limbs(&r.limbs[..ops.common.num_limbs], r_out);
let (s_out, _) = rest.split_at_mut(scalar_len);
limb::big_endian_from_limbs(&s.limbs[..ops.common.num_limbs], s_out);
2 * scalar_len
}
fn format_rs_asn1(ops: &'static ScalarOps, r: &Scalar, s: &Scalar, out: &mut [u8]) -> usize {
fn format_integer_tlv(ops: &ScalarOps, a: &Scalar, out: &mut [u8]) -> usize {
let mut fixed = [0u8; ec::SCALAR_MAX_BYTES + 1];
let fixed = &mut fixed[..(ops.scalar_bytes_len() + 1)];
limb::big_endian_from_limbs(&a.limbs[..ops.common.num_limbs], &mut fixed[1..]);
debug_assert_eq!(fixed[0], 0);
let first_index = fixed.iter().position(|b| *b != 0).unwrap();
let first_index = if fixed[first_index] & 0x80 != 0 {
first_index - 1
} else {
first_index
};
let value = &fixed[first_index..];
out[0] = der::Tag::Integer as u8;
assert!(value.len() < 128);
out[1] = value.len() as u8;
out[2..][..value.len()].copy_from_slice(&value);
2 + value.len()
}
out[0] = der::Tag::Sequence as u8;
let r_tlv_len = format_integer_tlv(ops, r, &mut out[2..]);
let s_tlv_len = format_integer_tlv(ops, s, &mut out[2..][r_tlv_len..]);
let value_len = r_tlv_len + s_tlv_len;
assert!(value_len < 128);
out[1] = value_len as u8;
2 + value_len
}
pub static ECDSA_P256_SHA256_FIXED_SIGNING: EcdsaSigningAlgorithm = EcdsaSigningAlgorithm {
curve: &ec::suite_b::curve::P256,
private_scalar_ops: &p256::PRIVATE_SCALAR_OPS,
private_key_ops: &p256::PRIVATE_KEY_OPS,
digest_alg: &digest::SHA256,
pkcs8_template: &EC_PUBLIC_KEY_P256_PKCS8_V1_TEMPLATE,
format_rs: format_rs_fixed,
id: AlgorithmID::ECDSA_P256_SHA256_FIXED_SIGNING,
};
pub static ECDSA_P384_SHA384_FIXED_SIGNING: EcdsaSigningAlgorithm = EcdsaSigningAlgorithm {
curve: &ec::suite_b::curve::P384,
private_scalar_ops: &p384::PRIVATE_SCALAR_OPS,
private_key_ops: &p384::PRIVATE_KEY_OPS,
digest_alg: &digest::SHA384,
pkcs8_template: &EC_PUBLIC_KEY_P384_PKCS8_V1_TEMPLATE,
format_rs: format_rs_fixed,
id: AlgorithmID::ECDSA_P384_SHA384_FIXED_SIGNING,
};
pub static ECDSA_P256_SHA256_ASN1_SIGNING: EcdsaSigningAlgorithm = EcdsaSigningAlgorithm {
curve: &ec::suite_b::curve::P256,
private_scalar_ops: &p256::PRIVATE_SCALAR_OPS,
private_key_ops: &p256::PRIVATE_KEY_OPS,
digest_alg: &digest::SHA256,
pkcs8_template: &EC_PUBLIC_KEY_P256_PKCS8_V1_TEMPLATE,
format_rs: format_rs_asn1,
id: AlgorithmID::ECDSA_P256_SHA256_ASN1_SIGNING,
};
pub static ECDSA_P384_SHA384_ASN1_SIGNING: EcdsaSigningAlgorithm = EcdsaSigningAlgorithm {
curve: &ec::suite_b::curve::P384,
private_scalar_ops: &p384::PRIVATE_SCALAR_OPS,
private_key_ops: &p384::PRIVATE_KEY_OPS,
digest_alg: &digest::SHA384,
pkcs8_template: &EC_PUBLIC_KEY_P384_PKCS8_V1_TEMPLATE,
format_rs: format_rs_asn1,
id: AlgorithmID::ECDSA_P384_SHA384_ASN1_SIGNING,
};
static EC_PUBLIC_KEY_P256_PKCS8_V1_TEMPLATE: pkcs8::Template = pkcs8::Template {
bytes: include_bytes!("ecPublicKey_p256_pkcs8_v1_template.der"),
alg_id_range: core::ops::Range { start: 8, end: 27 },
curve_id_index: 9,
private_key_index: 0x24,
};
static EC_PUBLIC_KEY_P384_PKCS8_V1_TEMPLATE: pkcs8::Template = pkcs8::Template {
bytes: include_bytes!("ecPublicKey_p384_pkcs8_v1_template.der"),
alg_id_range: core::ops::Range { start: 8, end: 24 },
curve_id_index: 9,
private_key_index: 0x23,
};
#[cfg(test)]
mod tests {
use crate::{signature, test};
#[test]
fn signature_ecdsa_sign_fixed_test() {
test::run(
test_file!("ecdsa_sign_fixed_tests.txt"),
|section, test_case| {
assert_eq!(section, "");
let curve_name = test_case.consume_string("Curve");
let digest_name = test_case.consume_string("Digest");
let msg = test_case.consume_bytes("Msg");
let d = test_case.consume_bytes("d");
let q = test_case.consume_bytes("Q");
let k = test_case.consume_bytes("k");
let expected_result = test_case.consume_bytes("Sig");
let alg = match (curve_name.as_str(), digest_name.as_str()) {
("P-256", "SHA256") => &signature::ECDSA_P256_SHA256_FIXED_SIGNING,
("P-384", "SHA384") => &signature::ECDSA_P384_SHA384_FIXED_SIGNING,
_ => {
panic!("Unsupported curve+digest: {}+{}", curve_name, digest_name);
}
};
let private_key =
signature::EcdsaKeyPair::from_private_key_and_public_key(alg, &d, &q).unwrap();
let rng = test::rand::FixedSliceRandom { bytes: &k };
let actual_result = private_key.sign(&rng, &msg).unwrap();
assert_eq!(actual_result.as_ref(), &expected_result[..]);
Ok(())
},
);
}
#[test]
fn signature_ecdsa_sign_asn1_test() {
test::run(
test_file!("ecdsa_sign_asn1_tests.txt"),
|section, test_case| {
assert_eq!(section, "");
let curve_name = test_case.consume_string("Curve");
let digest_name = test_case.consume_string("Digest");
let msg = test_case.consume_bytes("Msg");
let d = test_case.consume_bytes("d");
let q = test_case.consume_bytes("Q");
let k = test_case.consume_bytes("k");
let expected_result = test_case.consume_bytes("Sig");
let alg = match (curve_name.as_str(), digest_name.as_str()) {
("P-256", "SHA256") => &signature::ECDSA_P256_SHA256_ASN1_SIGNING,
("P-384", "SHA384") => &signature::ECDSA_P384_SHA384_ASN1_SIGNING,
_ => {
panic!("Unsupported curve+digest: {}+{}", curve_name, digest_name);
}
};
let private_key =
signature::EcdsaKeyPair::from_private_key_and_public_key(alg, &d, &q).unwrap();
let rng = test::rand::FixedSliceRandom { bytes: &k };
let actual_result = private_key.sign(&rng, &msg).unwrap();
assert_eq!(actual_result.as_ref(), &expected_result[..]);
Ok(())
},
);
}
}