feedc0de/wolfssl
1
0
Fork 0
forked from wolfSSL/wolfssl
Code Pull Requests Activity

Merge pull request #6103 from SparkiDev/sp_ecdsa_sig_r0

Browse Source 
SP ECC sign: reject random k when r is 0
This commit is contained in:
David Garske
2023-02-17 13:58:53 -08:00
committed by GitHub
parent 8a6483f13a 26b7052b3f
commit c476dd6e28
7 changed files with 268 additions and 177 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
wolfcrypt/src/sp_arm32.c
View File

@@ -75856,16 +75856,20 @@ int sp_ecc_sign_256(const byte* hash, word32 hashLen, WC_RNG* rng,
(sp_digit)0 - (sp_digit)(c >= 0));
sp_256_norm_8(r);
if (sp_256_iszero_8(r) == 0) {
/* x is modified in calculation of s. */
sp_256_from_mp(x, 8, priv);
/* s ptr == e ptr, e is modified in calculation of s. */
sp_256_from_bin(e, 8, hash, (int)hashLen);
err = sp_256_calc_s_8(s, r, k, x, e, tmp);
}
/* Check that signature is usable. */
if ((err == MP_OKAY) && (sp_256_iszero_8(s) == 0)) {
break;
}
}
}
#ifdef WOLFSSL_ECDSA_SET_K_ONE_LOOP
i = 1;
#endif
@@ -93466,16 +93470,20 @@ int sp_ecc_sign_384(const byte* hash, word32 hashLen, WC_RNG* rng,
(sp_digit)0 - (sp_digit)(c >= 0));
sp_384_norm_12(r);
if (sp_384_iszero_12(r) == 0) {
/* x is modified in calculation of s. */
sp_384_from_mp(x, 12, priv);
/* s ptr == e ptr, e is modified in calculation of s. */
sp_384_from_bin(e, 12, hash, (int)hashLen);
err = sp_384_calc_s_12(s, r, k, x, e, tmp);
}
/* Check that signature is usable. */
if ((err == MP_OKAY) && (sp_384_iszero_12(s) == 0)) {
break;
}
}
}
#ifdef WOLFSSL_ECDSA_SET_K_ONE_LOOP
i = 1;
#endif
@@ -121604,20 +121612,25 @@ int sp_ecc_sign_521(const byte* hash, word32 hashLen, WC_RNG* rng,
(sp_digit)0 - (sp_digit)(c >= 0));
sp_521_norm_17(r);
if (sp_521_iszero_17(r) == 0) {
/* x is modified in calculation of s. */
sp_521_from_mp(x, 17, priv);
/* s ptr == e ptr, e is modified in calculation of s. */
sp_521_from_bin(e, 17, hash, (int)hashLen);
/* Take 521 leftmost bits of hash. */
if (hashLen == 66U) {
sp_521_rshift_17(e, e, 7);
}
err = sp_521_calc_s_17(s, r, k, x, e, tmp);
}
/* Check that signature is usable. */
if ((err == MP_OKAY) && (sp_521_iszero_17(s) == 0)) {
break;
}
}
}
#ifdef WOLFSSL_ECDSA_SET_K_ONE_LOOP
i = 1;
#endif

19
wolfcrypt/src/sp_arm64.c
View File

@@ -40604,16 +40604,20 @@ int sp_ecc_sign_256(const byte* hash, word32 hashLen, WC_RNG* rng,
(sp_digit)0 - (sp_digit)(c >= 0));
sp_256_norm_4(r);
if (sp_256_iszero_4(r) == 0) {
/* x is modified in calculation of s. */
sp_256_from_mp(x, 4, priv);
/* s ptr == e ptr, e is modified in calculation of s. */
sp_256_from_bin(e, 4, hash, (int)hashLen);
err = sp_256_calc_s_4(s, r, k, x, e, tmp);
}
/* Check that signature is usable. */
if ((err == MP_OKAY) && (sp_256_iszero_4(s) == 0)) {
break;
}
}
}
#ifdef WOLFSSL_ECDSA_SET_K_ONE_LOOP
i = 1;
#endif
@@ -66724,16 +66728,20 @@ int sp_ecc_sign_384(const byte* hash, word32 hashLen, WC_RNG* rng,
(sp_digit)0 - (sp_digit)(c >= 0));
sp_384_norm_6(r);
if (sp_384_iszero_6(r) == 0) {
/* x is modified in calculation of s. */
sp_384_from_mp(x, 6, priv);
/* s ptr == e ptr, e is modified in calculation of s. */
sp_384_from_bin(e, 6, hash, (int)hashLen);
err = sp_384_calc_s_6(s, r, k, x, e, tmp);
}
/* Check that signature is usable. */
if ((err == MP_OKAY) && (sp_384_iszero_6(s) == 0)) {
break;
}
}
}
#ifdef WOLFSSL_ECDSA_SET_K_ONE_LOOP
i = 1;
#endif
@@ -111542,20 +111550,25 @@ int sp_ecc_sign_521(const byte* hash, word32 hashLen, WC_RNG* rng,
(sp_digit)0 - (sp_digit)(c >= 0));
sp_521_norm_9(r);
if (sp_521_iszero_9(r) == 0) {
/* x is modified in calculation of s. */
sp_521_from_mp(x, 9, priv);
/* s ptr == e ptr, e is modified in calculation of s. */
sp_521_from_bin(e, 9, hash, (int)hashLen);
/* Take 521 leftmost bits of hash. */
if (hashLen == 66U) {
sp_521_rshift_9(e, e, 7);
}
err = sp_521_calc_s_9(s, r, k, x, e, tmp);
}
/* Check that signature is usable. */
if ((err == MP_OKAY) && (sp_521_iszero_9(s) == 0)) {
break;
}
}
}
#ifdef WOLFSSL_ECDSA_SET_K_ONE_LOOP
i = 1;
#endif

19
wolfcrypt/src/sp_armthumb.c
View File

@@ -105816,16 +105816,20 @@ int sp_ecc_sign_256(const byte* hash, word32 hashLen, WC_RNG* rng,
(sp_digit)0 - (sp_digit)(c >= 0));
sp_256_norm_8(r);
if (sp_256_iszero_8(r) == 0) {
/* x is modified in calculation of s. */
sp_256_from_mp(x, 8, priv);
/* s ptr == e ptr, e is modified in calculation of s. */
sp_256_from_bin(e, 8, hash, (int)hashLen);
err = sp_256_calc_s_8(s, r, k, x, e, tmp);
}
/* Check that signature is usable. */
if ((err == MP_OKAY) && (sp_256_iszero_8(s) == 0)) {
break;
}
}
}
#ifdef WOLFSSL_ECDSA_SET_K_ONE_LOOP
i = 1;
#endif
@@ -116585,16 +116589,20 @@ int sp_ecc_sign_384(const byte* hash, word32 hashLen, WC_RNG* rng,
(sp_digit)0 - (sp_digit)(c >= 0));
sp_384_norm_12(r);
if (sp_384_iszero_12(r) == 0) {
/* x is modified in calculation of s. */
sp_384_from_mp(x, 12, priv);
/* s ptr == e ptr, e is modified in calculation of s. */
sp_384_from_bin(e, 12, hash, (int)hashLen);
err = sp_384_calc_s_12(s, r, k, x, e, tmp);
}
/* Check that signature is usable. */
if ((err == MP_OKAY) && (sp_384_iszero_12(s) == 0)) {
break;
}
}
}
#ifdef WOLFSSL_ECDSA_SET_K_ONE_LOOP
i = 1;
#endif
@@ -132784,20 +132792,25 @@ int sp_ecc_sign_521(const byte* hash, word32 hashLen, WC_RNG* rng,
(sp_digit)0 - (sp_digit)(c >= 0));
sp_521_norm_17(r);
if (sp_521_iszero_17(r) == 0) {
/* x is modified in calculation of s. */
sp_521_from_mp(x, 17, priv);
/* s ptr == e ptr, e is modified in calculation of s. */
sp_521_from_bin(e, 17, hash, (int)hashLen);
/* Take 521 leftmost bits of hash. */
if (hashLen == 66U) {
sp_521_rshift_17(e, e, 7);
}
err = sp_521_calc_s_17(s, r, k, x, e, tmp);
}
/* Check that signature is usable. */
if ((err == MP_OKAY) && (sp_521_iszero_17(s) == 0)) {
break;
}
}
}
#ifdef WOLFSSL_ECDSA_SET_K_ONE_LOOP
i = 1;
#endif

19
wolfcrypt/src/sp_c32.c
View File

@@ -25796,16 +25796,20 @@ int sp_ecc_sign_256(const byte* hash, word32 hashLen, WC_RNG* rng,
(sp_digit)0 - (sp_digit)(c >= 0));
sp_256_norm_9(r);
if (sp_256_iszero_9(r) == 0) {
/* x is modified in calculation of s. */
sp_256_from_mp(x, 9, priv);
/* s ptr == e ptr, e is modified in calculation of s. */
sp_256_from_bin(e, 9, hash, (int)hashLen);
err = sp_256_calc_s_9(s, r, k, x, e, tmp);
}
/* Check that signature is usable. */
if ((err == MP_OKAY) && (sp_256_iszero_9(s) == 0)) {
break;
}
}
}
#ifdef WOLFSSL_ECDSA_SET_K_ONE_LOOP
i = 1;
#endif
@@ -33873,16 +33877,20 @@ int sp_ecc_sign_384(const byte* hash, word32 hashLen, WC_RNG* rng,
(sp_digit)0 - (sp_digit)(c >= 0));
sp_384_norm_15(r);
if (sp_384_iszero_15(r) == 0) {
/* x is modified in calculation of s. */
sp_384_from_mp(x, 15, priv);
/* s ptr == e ptr, e is modified in calculation of s. */
sp_384_from_bin(e, 15, hash, (int)hashLen);
err = sp_384_calc_s_15(s, r, k, x, e, tmp);
}
/* Check that signature is usable. */
if ((err == MP_OKAY) && (sp_384_iszero_15(s) == 0)) {
break;
}
}
}
#ifdef WOLFSSL_ECDSA_SET_K_ONE_LOOP
i = 1;
#endif
@@ -42024,21 +42032,26 @@ int sp_ecc_sign_521(const byte* hash, word32 hashLen, WC_RNG* rng,
(sp_digit)0 - (sp_digit)(c >= 0));
sp_521_norm_21(r);
if (sp_521_iszero_21(r) == 0) {
/* x is modified in calculation of s. */
sp_521_from_mp(x, 21, priv);
/* s ptr == e ptr, e is modified in calculation of s. */
sp_521_from_bin(e, 21, hash, (int)hashLen);
/* Take 521 leftmost bits of hash. */
if (hashLen == 66U) {
sp_521_rshift_21(e, e, 7);
e[20] |= ((sp_digit)hash[0]) << 13;
}
err = sp_521_calc_s_21(s, r, k, x, e, tmp);
}
/* Check that signature is usable. */
if ((err == MP_OKAY) && (sp_521_iszero_21(s) == 0)) {
break;
}
}
}
#ifdef WOLFSSL_ECDSA_SET_K_ONE_LOOP
i = 1;
#endif

19
wolfcrypt/src/sp_c64.c
View File

@@ -26689,16 +26689,20 @@ int sp_ecc_sign_256(const byte* hash, word32 hashLen, WC_RNG* rng,
(sp_digit)0 - (sp_digit)(c >= 0));
sp_256_norm_5(r);
if (sp_256_iszero_5(r) == 0) {
/* x is modified in calculation of s. */
sp_256_from_mp(x, 5, priv);
/* s ptr == e ptr, e is modified in calculation of s. */
sp_256_from_bin(e, 5, hash, (int)hashLen);
err = sp_256_calc_s_5(s, r, k, x, e, tmp);
}
/* Check that signature is usable. */
if ((err == MP_OKAY) && (sp_256_iszero_5(s) == 0)) {
break;
}
}
}
#ifdef WOLFSSL_ECDSA_SET_K_ONE_LOOP
i = 1;
#endif
@@ -34157,16 +34161,20 @@ int sp_ecc_sign_384(const byte* hash, word32 hashLen, WC_RNG* rng,
(sp_digit)0 - (sp_digit)(c >= 0));
sp_384_norm_7(r);
if (sp_384_iszero_7(r) == 0) {
/* x is modified in calculation of s. */
sp_384_from_mp(x, 7, priv);
/* s ptr == e ptr, e is modified in calculation of s. */
sp_384_from_bin(e, 7, hash, (int)hashLen);
err = sp_384_calc_s_7(s, r, k, x, e, tmp);
}
/* Check that signature is usable. */
if ((err == MP_OKAY) && (sp_384_iszero_7(s) == 0)) {
break;
}
}
}
#ifdef WOLFSSL_ECDSA_SET_K_ONE_LOOP
i = 1;
#endif
@@ -41622,21 +41630,26 @@ int sp_ecc_sign_521(const byte* hash, word32 hashLen, WC_RNG* rng,
(sp_digit)0 - (sp_digit)(c >= 0));
sp_521_norm_9(r);
if (sp_521_iszero_9(r) == 0) {
/* x is modified in calculation of s. */
sp_521_from_mp(x, 9, priv);
/* s ptr == e ptr, e is modified in calculation of s. */
sp_521_from_bin(e, 9, hash, (int)hashLen);
/* Take 521 leftmost bits of hash. */
if (hashLen == 66U) {
sp_521_rshift_9(e, e, 7);
e[8] |= ((sp_digit)hash[0]) << 49;
}
err = sp_521_calc_s_9(s, r, k, x, e, tmp);
}
/* Check that signature is usable. */
if ((err == MP_OKAY) && (sp_521_iszero_9(s) == 0)) {
break;
}
}
}
#ifdef WOLFSSL_ECDSA_SET_K_ONE_LOOP
i = 1;
#endif

19
wolfcrypt/src/sp_cortexm.c
View File

@@ -23710,16 +23710,20 @@ int sp_ecc_sign_256(const byte* hash, word32 hashLen, WC_RNG* rng,
(sp_digit)0 - (sp_digit)(c >= 0));
sp_256_norm_8(r);
if (sp_256_iszero_8(r) == 0) {
/* x is modified in calculation of s. */
sp_256_from_mp(x, 8, priv);
/* s ptr == e ptr, e is modified in calculation of s. */
sp_256_from_bin(e, 8, hash, (int)hashLen);
err = sp_256_calc_s_8(s, r, k, x, e, tmp);
}
/* Check that signature is usable. */
if ((err == MP_OKAY) && (sp_256_iszero_8(s) == 0)) {
break;
}
}
}
#ifdef WOLFSSL_ECDSA_SET_K_ONE_LOOP
i = 1;
#endif
@@ -31035,16 +31039,20 @@ int sp_ecc_sign_384(const byte* hash, word32 hashLen, WC_RNG* rng,
(sp_digit)0 - (sp_digit)(c >= 0));
sp_384_norm_12(r);
if (sp_384_iszero_12(r) == 0) {
/* x is modified in calculation of s. */
sp_384_from_mp(x, 12, priv);
/* s ptr == e ptr, e is modified in calculation of s. */
sp_384_from_bin(e, 12, hash, (int)hashLen);
err = sp_384_calc_s_12(s, r, k, x, e, tmp);
}
/* Check that signature is usable. */
if ((err == MP_OKAY) && (sp_384_iszero_12(s) == 0)) {
break;
}
}
}
#ifdef WOLFSSL_ECDSA_SET_K_ONE_LOOP
i = 1;
#endif
@@ -39987,20 +39995,25 @@ int sp_ecc_sign_521(const byte* hash, word32 hashLen, WC_RNG* rng,
(sp_digit)0 - (sp_digit)(c >= 0));
sp_521_norm_17(r);
if (sp_521_iszero_17(r) == 0) {
/* x is modified in calculation of s. */
sp_521_from_mp(x, 17, priv);
/* s ptr == e ptr, e is modified in calculation of s. */
sp_521_from_bin(e, 17, hash, (int)hashLen);
/* Take 521 leftmost bits of hash. */
if (hashLen == 66U) {
sp_521_rshift_17(e, e, 7);
}
err = sp_521_calc_s_17(s, r, k, x, e, tmp);
}
/* Check that signature is usable. */
if ((err == MP_OKAY) && (sp_521_iszero_17(s) == 0)) {
break;
}
}
}
#ifdef WOLFSSL_ECDSA_SET_K_ONE_LOOP
i = 1;
#endif

19
wolfcrypt/src/sp_x86_64.c
View File

@@ -25767,16 +25767,20 @@ int sp_ecc_sign_256(const byte* hash, word32 hashLen, WC_RNG* rng,
(sp_digit)0 - (sp_digit)(c >= 0));
sp_256_norm_4(r);
if (sp_256_iszero_4(r) == 0) {
/* x is modified in calculation of s. */
sp_256_from_mp(x, 4, priv);
/* s ptr == e ptr, e is modified in calculation of s. */
sp_256_from_bin(e, 4, hash, (int)hashLen);
err = sp_256_calc_s_4(s, r, k, x, e, tmp);
}
/* Check that signature is usable. */
if ((err == MP_OKAY) && (sp_256_iszero_4(s) == 0)) {
break;
}
}
}
#ifdef WOLFSSL_ECDSA_SET_K_ONE_LOOP
i = 1;
#endif
@@ -50660,16 +50664,20 @@ int sp_ecc_sign_384(const byte* hash, word32 hashLen, WC_RNG* rng,
(sp_digit)0 - (sp_digit)(c >= 0));
sp_384_norm_6(r);
if (sp_384_iszero_6(r) == 0) {
/* x is modified in calculation of s. */
sp_384_from_mp(x, 6, priv);
/* s ptr == e ptr, e is modified in calculation of s. */
sp_384_from_bin(e, 6, hash, (int)hashLen);
err = sp_384_calc_s_6(s, r, k, x, e, tmp);
}
/* Check that signature is usable. */
if ((err == MP_OKAY) && (sp_384_iszero_6(s) == 0)) {
break;
}
}
}
#ifdef WOLFSSL_ECDSA_SET_K_ONE_LOOP
i = 1;
#endif
@@ -91792,20 +91800,25 @@ int sp_ecc_sign_521(const byte* hash, word32 hashLen, WC_RNG* rng,
(sp_digit)0 - (sp_digit)(c >= 0));
sp_521_norm_9(r);
if (sp_521_iszero_9(r) == 0) {
/* x is modified in calculation of s. */
sp_521_from_mp(x, 9, priv);
/* s ptr == e ptr, e is modified in calculation of s. */
sp_521_from_bin(e, 9, hash, (int)hashLen);
/* Take 521 leftmost bits of hash. */
if (hashLen == 66U) {
sp_521_rshift_9(e, e, 7);
}
err = sp_521_calc_s_9(s, r, k, x, e, tmp);
}
/* Check that signature is usable. */
if ((err == MP_OKAY) && (sp_521_iszero_9(s) == 0)) {
break;
}
}
}
#ifdef WOLFSSL_ECDSA_SET_K_ONE_LOOP
i = 1;
#endif