feedc0de/wolfssl
1
0
Fork 0
forked from wolfSSL/wolfssl
Code Pull Requests Activity

SP ECC sign: reject random k when r is 0

Browse Source 
SP ECC signing code was generating signatures with r of 0.
This is not allowed by the algorithm description.
Retry sig gen when r is 0 like when s is 0.
This commit is contained in:
Sean Parkinson
2023-02-17 08:55:59 +10:00
parent 0b31d5577c
commit 26b7052b3f
7 changed files with 268 additions and 177 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
wolfcrypt/src/sp_arm32.c
View File

@ -75856,16 +75856,20 @@ int sp_ecc_sign_256(const byte* hash, word32 hashLen, WC_RNG* rng,
(sp_digit)0 - (sp_digit)(c >= 0));
sp_256_norm_8(r);
if (sp_256_iszero_8(r) == 0) {
/* x is modified in calculation of s. */
sp_256_from_mp(x, 8, priv);
/* s ptr == e ptr, e is modified in calculation of s. */
sp_256_from_bin(e, 8, hash, (int)hashLen);
err = sp_256_calc_s_8(s, r, k, x, e, tmp);
}
/* Check that signature is usable. */
if ((err == MP_OKAY) && (sp_256_iszero_8(s) == 0)) {
break;
}
}
}
#ifdef WOLFSSL_ECDSA_SET_K_ONE_LOOP
i = 1;
#endif
@ -93466,16 +93470,20 @@ int sp_ecc_sign_384(const byte* hash, word32 hashLen, WC_RNG* rng,
(sp_digit)0 - (sp_digit)(c >= 0));
sp_384_norm_12(r);
if (sp_384_iszero_12(r) == 0) {
/* x is modified in calculation of s. */
sp_384_from_mp(x, 12, priv);
/* s ptr == e ptr, e is modified in calculation of s. */
sp_384_from_bin(e, 12, hash, (int)hashLen);
err = sp_384_calc_s_12(s, r, k, x, e, tmp);
}
/* Check that signature is usable. */
if ((err == MP_OKAY) && (sp_384_iszero_12(s) == 0)) {
break;
}
}
}
#ifdef WOLFSSL_ECDSA_SET_K_ONE_LOOP
i = 1;
#endif
@ -121604,20 +121612,25 @@ int sp_ecc_sign_521(const byte* hash, word32 hashLen, WC_RNG* rng,
(sp_digit)0 - (sp_digit)(c >= 0));
sp_521_norm_17(r);
if (sp_521_iszero_17(r) == 0) {
/* x is modified in calculation of s. */
sp_521_from_mp(x, 17, priv);
/* s ptr == e ptr, e is modified in calculation of s. */
sp_521_from_bin(e, 17, hash, (int)hashLen);
/* Take 521 leftmost bits of hash. */
if (hashLen == 66U) {
sp_521_rshift_17(e, e, 7);
}
err = sp_521_calc_s_17(s, r, k, x, e, tmp);
}
/* Check that signature is usable. */
if ((err == MP_OKAY) && (sp_521_iszero_17(s) == 0)) {
break;
}
}
}
#ifdef WOLFSSL_ECDSA_SET_K_ONE_LOOP
i = 1;
#endif

19
wolfcrypt/src/sp_arm64.c
View File

@ -40604,16 +40604,20 @@ int sp_ecc_sign_256(const byte* hash, word32 hashLen, WC_RNG* rng,
(sp_digit)0 - (sp_digit)(c >= 0));
sp_256_norm_4(r);
if (sp_256_iszero_4(r) == 0) {
/* x is modified in calculation of s. */
sp_256_from_mp(x, 4, priv);
/* s ptr == e ptr, e is modified in calculation of s. */
sp_256_from_bin(e, 4, hash, (int)hashLen);
err = sp_256_calc_s_4(s, r, k, x, e, tmp);
}
/* Check that signature is usable. */
if ((err == MP_OKAY) && (sp_256_iszero_4(s) == 0)) {
break;
}
}
}
#ifdef WOLFSSL_ECDSA_SET_K_ONE_LOOP
i = 1;
#endif
@ -66724,16 +66728,20 @@ int sp_ecc_sign_384(const byte* hash, word32 hashLen, WC_RNG* rng,
(sp_digit)0 - (sp_digit)(c >= 0));
sp_384_norm_6(r);
if (sp_384_iszero_6(r) == 0) {
/* x is modified in calculation of s. */
sp_384_from_mp(x, 6, priv);
/* s ptr == e ptr, e is modified in calculation of s. */
sp_384_from_bin(e, 6, hash, (int)hashLen);
err = sp_384_calc_s_6(s, r, k, x, e, tmp);
}
/* Check that signature is usable. */
if ((err == MP_OKAY) && (sp_384_iszero_6(s) == 0)) {
break;
}
}
}
#ifdef WOLFSSL_ECDSA_SET_K_ONE_LOOP
i = 1;
#endif
@ -111542,20 +111550,25 @@ int sp_ecc_sign_521(const byte* hash, word32 hashLen, WC_RNG* rng,
(sp_digit)0 - (sp_digit)(c >= 0));
sp_521_norm_9(r);
if (sp_521_iszero_9(r) == 0) {
/* x is modified in calculation of s. */
sp_521_from_mp(x, 9, priv);
/* s ptr == e ptr, e is modified in calculation of s. */
sp_521_from_bin(e, 9, hash, (int)hashLen);
/* Take 521 leftmost bits of hash. */
if (hashLen == 66U) {
sp_521_rshift_9(e, e, 7);
}
err = sp_521_calc_s_9(s, r, k, x, e, tmp);
}
/* Check that signature is usable. */
if ((err == MP_OKAY) && (sp_521_iszero_9(s) == 0)) {
break;
}
}
}
#ifdef WOLFSSL_ECDSA_SET_K_ONE_LOOP
i = 1;
#endif

19
wolfcrypt/src/sp_armthumb.c
View File

@ -105816,16 +105816,20 @@ int sp_ecc_sign_256(const byte* hash, word32 hashLen, WC_RNG* rng,
(sp_digit)0 - (sp_digit)(c >= 0));
sp_256_norm_8(r);
if (sp_256_iszero_8(r) == 0) {
/* x is modified in calculation of s. */
sp_256_from_mp(x, 8, priv);
/* s ptr == e ptr, e is modified in calculation of s. */
sp_256_from_bin(e, 8, hash, (int)hashLen);
err = sp_256_calc_s_8(s, r, k, x, e, tmp);
}
/* Check that signature is usable. */
if ((err == MP_OKAY) && (sp_256_iszero_8(s) == 0)) {
break;
}
}
}
#ifdef WOLFSSL_ECDSA_SET_K_ONE_LOOP
i = 1;
#endif
@ -116585,16 +116589,20 @@ int sp_ecc_sign_384(const byte* hash, word32 hashLen, WC_RNG* rng,
(sp_digit)0 - (sp_digit)(c >= 0));
sp_384_norm_12(r);
if (sp_384_iszero_12(r) == 0) {
/* x is modified in calculation of s. */
sp_384_from_mp(x, 12, priv);
/* s ptr == e ptr, e is modified in calculation of s. */
sp_384_from_bin(e, 12, hash, (int)hashLen);
err = sp_384_calc_s_12(s, r, k, x, e, tmp);
}
/* Check that signature is usable. */
if ((err == MP_OKAY) && (sp_384_iszero_12(s) == 0)) {
break;
}
}
}
#ifdef WOLFSSL_ECDSA_SET_K_ONE_LOOP
i = 1;
#endif
@ -132784,20 +132792,25 @@ int sp_ecc_sign_521(const byte* hash, word32 hashLen, WC_RNG* rng,
(sp_digit)0 - (sp_digit)(c >= 0));
sp_521_norm_17(r);
if (sp_521_iszero_17(r) == 0) {
/* x is modified in calculation of s. */
sp_521_from_mp(x, 17, priv);
/* s ptr == e ptr, e is modified in calculation of s. */
sp_521_from_bin(e, 17, hash, (int)hashLen);
/* Take 521 leftmost bits of hash. */
if (hashLen == 66U) {
sp_521_rshift_17(e, e, 7);
}
err = sp_521_calc_s_17(s, r, k, x, e, tmp);
}
/* Check that signature is usable. */
if ((err == MP_OKAY) && (sp_521_iszero_17(s) == 0)) {
break;
}
}
}
#ifdef WOLFSSL_ECDSA_SET_K_ONE_LOOP
i = 1;
#endif

19
wolfcrypt/src/sp_c32.c
View File

@ -25796,16 +25796,20 @@ int sp_ecc_sign_256(const byte* hash, word32 hashLen, WC_RNG* rng,
(sp_digit)0 - (sp_digit)(c >= 0));
sp_256_norm_9(r);
if (sp_256_iszero_9(r) == 0) {
/* x is modified in calculation of s. */
sp_256_from_mp(x, 9, priv);
/* s ptr == e ptr, e is modified in calculation of s. */
sp_256_from_bin(e, 9, hash, (int)hashLen);
err = sp_256_calc_s_9(s, r, k, x, e, tmp);
}
/* Check that signature is usable. */
if ((err == MP_OKAY) && (sp_256_iszero_9(s) == 0)) {
break;
}
}
}
#ifdef WOLFSSL_ECDSA_SET_K_ONE_LOOP
i = 1;
#endif
@ -33873,16 +33877,20 @@ int sp_ecc_sign_384(const byte* hash, word32 hashLen, WC_RNG* rng,
(sp_digit)0 - (sp_digit)(c >= 0));
sp_384_norm_15(r);
if (sp_384_iszero_15(r) == 0) {
/* x is modified in calculation of s. */
sp_384_from_mp(x, 15, priv);
/* s ptr == e ptr, e is modified in calculation of s. */
sp_384_from_bin(e, 15, hash, (int)hashLen);
err = sp_384_calc_s_15(s, r, k, x, e, tmp);
}
/* Check that signature is usable. */
if ((err == MP_OKAY) && (sp_384_iszero_15(s) == 0)) {
break;
}
}
}
#ifdef WOLFSSL_ECDSA_SET_K_ONE_LOOP
i = 1;
#endif
@ -42024,21 +42032,26 @@ int sp_ecc_sign_521(const byte* hash, word32 hashLen, WC_RNG* rng,
(sp_digit)0 - (sp_digit)(c >= 0));
sp_521_norm_21(r);
if (sp_521_iszero_21(r) == 0) {
/* x is modified in calculation of s. */
sp_521_from_mp(x, 21, priv);
/* s ptr == e ptr, e is modified in calculation of s. */
sp_521_from_bin(e, 21, hash, (int)hashLen);
/* Take 521 leftmost bits of hash. */
if (hashLen == 66U) {
sp_521_rshift_21(e, e, 7);
e[20] |= ((sp_digit)hash[0]) << 13;
}
err = sp_521_calc_s_21(s, r, k, x, e, tmp);
}
/* Check that signature is usable. */
if ((err == MP_OKAY) && (sp_521_iszero_21(s) == 0)) {
break;
}
}
}
#ifdef WOLFSSL_ECDSA_SET_K_ONE_LOOP
i = 1;
#endif

19
wolfcrypt/src/sp_c64.c
View File

@ -26689,16 +26689,20 @@ int sp_ecc_sign_256(const byte* hash, word32 hashLen, WC_RNG* rng,
(sp_digit)0 - (sp_digit)(c >= 0));
sp_256_norm_5(r);
if (sp_256_iszero_5(r) == 0) {
/* x is modified in calculation of s. */
sp_256_from_mp(x, 5, priv);
/* s ptr == e ptr, e is modified in calculation of s. */
sp_256_from_bin(e, 5, hash, (int)hashLen);
err = sp_256_calc_s_5(s, r, k, x, e, tmp);
}
/* Check that signature is usable. */
if ((err == MP_OKAY) && (sp_256_iszero_5(s) == 0)) {
break;
}
}
}
#ifdef WOLFSSL_ECDSA_SET_K_ONE_LOOP
i = 1;
#endif
@ -34157,16 +34161,20 @@ int sp_ecc_sign_384(const byte* hash, word32 hashLen, WC_RNG* rng,
(sp_digit)0 - (sp_digit)(c >= 0));
sp_384_norm_7(r);
if (sp_384_iszero_7(r) == 0) {
/* x is modified in calculation of s. */
sp_384_from_mp(x, 7, priv);
/* s ptr == e ptr, e is modified in calculation of s. */
sp_384_from_bin(e, 7, hash, (int)hashLen);
err = sp_384_calc_s_7(s, r, k, x, e, tmp);
}
/* Check that signature is usable. */
if ((err == MP_OKAY) && (sp_384_iszero_7(s) == 0)) {
break;
}
}
}
#ifdef WOLFSSL_ECDSA_SET_K_ONE_LOOP
i = 1;
#endif
@ -41622,21 +41630,26 @@ int sp_ecc_sign_521(const byte* hash, word32 hashLen, WC_RNG* rng,
(sp_digit)0 - (sp_digit)(c >= 0));
sp_521_norm_9(r);
if (sp_521_iszero_9(r) == 0) {
/* x is modified in calculation of s. */
sp_521_from_mp(x, 9, priv);
/* s ptr == e ptr, e is modified in calculation of s. */
sp_521_from_bin(e, 9, hash, (int)hashLen);
/* Take 521 leftmost bits of hash. */
if (hashLen == 66U) {
sp_521_rshift_9(e, e, 7);
e[8] |= ((sp_digit)hash[0]) << 49;
}
err = sp_521_calc_s_9(s, r, k, x, e, tmp);
}
/* Check that signature is usable. */
if ((err == MP_OKAY) && (sp_521_iszero_9(s) == 0)) {
break;
}
}
}
#ifdef WOLFSSL_ECDSA_SET_K_ONE_LOOP
i = 1;
#endif

19
wolfcrypt/src/sp_cortexm.c
View File

@ -23710,16 +23710,20 @@ int sp_ecc_sign_256(const byte* hash, word32 hashLen, WC_RNG* rng,
(sp_digit)0 - (sp_digit)(c >= 0));
sp_256_norm_8(r);
if (sp_256_iszero_8(r) == 0) {
/* x is modified in calculation of s. */
sp_256_from_mp(x, 8, priv);
/* s ptr == e ptr, e is modified in calculation of s. */
sp_256_from_bin(e, 8, hash, (int)hashLen);
err = sp_256_calc_s_8(s, r, k, x, e, tmp);
}
/* Check that signature is usable. */
if ((err == MP_OKAY) && (sp_256_iszero_8(s) == 0)) {
break;
}
}
}
#ifdef WOLFSSL_ECDSA_SET_K_ONE_LOOP
i = 1;
#endif
@ -31035,16 +31039,20 @@ int sp_ecc_sign_384(const byte* hash, word32 hashLen, WC_RNG* rng,
(sp_digit)0 - (sp_digit)(c >= 0));
sp_384_norm_12(r);
if (sp_384_iszero_12(r) == 0) {
/* x is modified in calculation of s. */
sp_384_from_mp(x, 12, priv);
/* s ptr == e ptr, e is modified in calculation of s. */
sp_384_from_bin(e, 12, hash, (int)hashLen);
err = sp_384_calc_s_12(s, r, k, x, e, tmp);
}
/* Check that signature is usable. */
if ((err == MP_OKAY) && (sp_384_iszero_12(s) == 0)) {
break;
}
}
}
#ifdef WOLFSSL_ECDSA_SET_K_ONE_LOOP
i = 1;
#endif
@ -39987,20 +39995,25 @@ int sp_ecc_sign_521(const byte* hash, word32 hashLen, WC_RNG* rng,
(sp_digit)0 - (sp_digit)(c >= 0));
sp_521_norm_17(r);
if (sp_521_iszero_17(r) == 0) {
/* x is modified in calculation of s. */
sp_521_from_mp(x, 17, priv);
/* s ptr == e ptr, e is modified in calculation of s. */
sp_521_from_bin(e, 17, hash, (int)hashLen);
/* Take 521 leftmost bits of hash. */
if (hashLen == 66U) {
sp_521_rshift_17(e, e, 7);
}
err = sp_521_calc_s_17(s, r, k, x, e, tmp);
}
/* Check that signature is usable. */
if ((err == MP_OKAY) && (sp_521_iszero_17(s) == 0)) {
break;
}
}
}
#ifdef WOLFSSL_ECDSA_SET_K_ONE_LOOP
i = 1;
#endif

19
wolfcrypt/src/sp_x86_64.c
View File

@ -25767,16 +25767,20 @@ int sp_ecc_sign_256(const byte* hash, word32 hashLen, WC_RNG* rng,
(sp_digit)0 - (sp_digit)(c >= 0));
sp_256_norm_4(r);
if (sp_256_iszero_4(r) == 0) {
/* x is modified in calculation of s. */
sp_256_from_mp(x, 4, priv);
/* s ptr == e ptr, e is modified in calculation of s. */
sp_256_from_bin(e, 4, hash, (int)hashLen);
err = sp_256_calc_s_4(s, r, k, x, e, tmp);
}
/* Check that signature is usable. */
if ((err == MP_OKAY) && (sp_256_iszero_4(s) == 0)) {
break;
}
}
}
#ifdef WOLFSSL_ECDSA_SET_K_ONE_LOOP
i = 1;
#endif
@ -50660,16 +50664,20 @@ int sp_ecc_sign_384(const byte* hash, word32 hashLen, WC_RNG* rng,
(sp_digit)0 - (sp_digit)(c >= 0));
sp_384_norm_6(r);
if (sp_384_iszero_6(r) == 0) {
/* x is modified in calculation of s. */
sp_384_from_mp(x, 6, priv);
/* s ptr == e ptr, e is modified in calculation of s. */
sp_384_from_bin(e, 6, hash, (int)hashLen);
err = sp_384_calc_s_6(s, r, k, x, e, tmp);
}
/* Check that signature is usable. */
if ((err == MP_OKAY) && (sp_384_iszero_6(s) == 0)) {
break;
}
}
}
#ifdef WOLFSSL_ECDSA_SET_K_ONE_LOOP
i = 1;
#endif
@ -91792,20 +91800,25 @@ int sp_ecc_sign_521(const byte* hash, word32 hashLen, WC_RNG* rng,
(sp_digit)0 - (sp_digit)(c >= 0));
sp_521_norm_9(r);
if (sp_521_iszero_9(r) == 0) {
/* x is modified in calculation of s. */
sp_521_from_mp(x, 9, priv);
/* s ptr == e ptr, e is modified in calculation of s. */
sp_521_from_bin(e, 9, hash, (int)hashLen);
/* Take 521 leftmost bits of hash. */
if (hashLen == 66U) {
sp_521_rshift_9(e, e, 7);
}
err = sp_521_calc_s_9(s, r, k, x, e, tmp);
}
/* Check that signature is usable. */
if ((err == MP_OKAY) && (sp_521_iszero_9(s) == 0)) {
break;
}
}
}
#ifdef WOLFSSL_ECDSA_SET_K_ONE_LOOP
i = 1;
#endif