mirror of
https://github.com/yuzu-emu/mbedtls.git
synced 2025-03-28 09:56:56 +00:00
Merge remote-tracking branch 'public/pr/2889' into baremetal
This commit is contained in:
Simon Butcher
commit
c759b88194
|
|
@ -111,6 +111,7 @@ typedef uint64_t uECC_dword_t;
|
|||
#define NUM_ECC_WORDS 8
|
||||
/* Number of bytes to represent an element of the the curve p-256: */
|
||||
#define NUM_ECC_BYTES (uECC_WORD_SIZE*NUM_ECC_WORDS)
|
||||
#define NUM_ECC_BITS 256
|
||||
|
||||
/* structure that represents an elliptic curve (e.g. p256):*/
|
||||
struct uECC_Curve_t;
|
||||
|
|
@ -282,32 +283,19 @@ int uECC_compute_public_key(const uint8_t *private_key,
|
|||
uECC_word_t EccPoint_compute_public_key(uECC_word_t *result,
|
||||
uECC_word_t *private_key, uECC_Curve curve);
|
||||
|
||||
/*
|
||||
* @brief Regularize the bitcount for the private key so that attackers cannot
|
||||
* use a side channel attack to learn the number of leading zeros.
|
||||
* @return Regularized k
|
||||
* @param k IN -- private-key
|
||||
* @param k0 IN/OUT -- regularized k
|
||||
* @param k1 IN/OUT -- regularized k
|
||||
* @param curve IN -- elliptic curve
|
||||
*/
|
||||
uECC_word_t regularize_k(const uECC_word_t * const k, uECC_word_t *k0,
|
||||
uECC_word_t *k1, uECC_Curve curve);
|
||||
|
||||
/*
|
||||
* @brief Point multiplication algorithm using Montgomery's ladder with co-Z
|
||||
* coordinates. See http://eprint.iacr.org/2011/338.pdf.
|
||||
* Uses scalar regularization and coordinate randomization (if a global RNG
|
||||
* function is set) in order to protect against some side channel attacks.
|
||||
* @note Result may overlap point.
|
||||
* @param result OUT -- returns scalar*point
|
||||
* @param point IN -- elliptic curve point
|
||||
* @param scalar IN -- scalar
|
||||
* @param initial_Z IN -- initial value for z
|
||||
* @param num_bits IN -- number of bits in scalar
|
||||
* @param curve IN -- elliptic curve
|
||||
*/
|
||||
void EccPoint_mult(uECC_word_t * result, const uECC_word_t * point,
|
||||
const uECC_word_t * scalar, const uECC_word_t * initial_Z,
|
||||
bitcount_t num_bits, uECC_Curve curve);
|
||||
int EccPoint_mult_safer(uECC_word_t * result, const uECC_word_t * point,
|
||||
const uECC_word_t * scalar, uECC_Curve curve);
|
||||
|
||||
/*
|
||||
* @brief Constant-time comparison to zero - secure way to compare long integers
|
||||
|
|
@ -315,7 +303,7 @@ void EccPoint_mult(uECC_word_t * result, const uECC_word_t * point,
|
|||
* @param num_words IN -- number of words in the vli
|
||||
* @return 1 if vli == 0, 0 otherwise.
|
||||
*/
|
||||
uECC_word_t uECC_vli_isZero(const uECC_word_t *vli, wordcount_t num_words);
|
||||
uECC_word_t uECC_vli_isZero(const uECC_word_t *vli);
|
||||
|
||||
/*
|
||||
* @brief Check if 'point' is the point at infinity
|
||||
|
|
@ -332,8 +320,7 @@ uECC_word_t EccPoint_isZero(const uECC_word_t *point, uECC_Curve curve);
|
|||
* @param num_words IN -- number of words
|
||||
* @return the sign of left - right
|
||||
*/
|
||||
cmpresult_t uECC_vli_cmp(const uECC_word_t *left, const uECC_word_t *right,
|
||||
wordcount_t num_words);
|
||||
cmpresult_t uECC_vli_cmp(const uECC_word_t *left, const uECC_word_t *right);
|
||||
|
||||
/*
|
||||
* @brief computes sign of left - right, not in constant time.
|
||||
|
|
@ -343,8 +330,7 @@ cmpresult_t uECC_vli_cmp(const uECC_word_t *left, const uECC_word_t *right,
|
|||
* @param num_words IN -- number of words
|
||||
* @return the sign of left - right
|
||||
*/
|
||||
cmpresult_t uECC_vli_cmp_unsafe(const uECC_word_t *left, const uECC_word_t *right,
|
||||
wordcount_t num_words);
|
||||
cmpresult_t uECC_vli_cmp_unsafe(const uECC_word_t *left, const uECC_word_t *right);
|
||||
|
||||
/*
|
||||
* @brief Computes result = (left - right) % mod.
|
||||
|
|
@ -357,8 +343,7 @@ cmpresult_t uECC_vli_cmp_unsafe(const uECC_word_t *left, const uECC_word_t *righ
|
|||
* @param num_words IN -- number of words
|
||||
*/
|
||||
void uECC_vli_modSub(uECC_word_t *result, const uECC_word_t *left,
|
||||
const uECC_word_t *right, const uECC_word_t *mod,
|
||||
wordcount_t num_words);
|
||||
const uECC_word_t *right, const uECC_word_t *mod);
|
||||
|
||||
/*
|
||||
* @brief Computes P' = (x1', y1', Z3), P + Q = (x3, y3, Z3) or
|
||||
|
|
@ -380,8 +365,7 @@ void XYcZ_add(uECC_word_t * X1, uECC_word_t * Y1, uECC_word_t * X2,
|
|||
* @param Z IN -- z value
|
||||
* @param curve IN -- elliptic curve
|
||||
*/
|
||||
void apply_z(uECC_word_t * X1, uECC_word_t * Y1, const uECC_word_t * const Z,
|
||||
uECC_Curve curve);
|
||||
void apply_z(uECC_word_t * X1, uECC_word_t * Y1, const uECC_word_t * const Z);
|
||||
|
||||
/*
|
||||
* @brief Check if bit is set.
|
||||
|
|
@ -402,7 +386,7 @@ uECC_word_t uECC_vli_testBit(const uECC_word_t *vli, bitcount_t bit);
|
|||
* @warning Currently only designed to work for curve_p or curve_n.
|
||||
*/
|
||||
void uECC_vli_mmod(uECC_word_t *result, uECC_word_t *product,
|
||||
const uECC_word_t *mod, wordcount_t num_words);
|
||||
const uECC_word_t *mod);
|
||||
|
||||
/*
|
||||
* @brief Computes modular product (using curve->mmod_fast)
|
||||
|
|
@ -412,7 +396,7 @@ void uECC_vli_mmod(uECC_word_t *result, uECC_word_t *product,
|
|||
* @param curve IN -- elliptic curve
|
||||
*/
|
||||
void uECC_vli_modMult_fast(uECC_word_t *result, const uECC_word_t *left,
|
||||
const uECC_word_t *right, uECC_Curve curve);
|
||||
const uECC_word_t *right);
|
||||
|
||||
/*
|
||||
* @brief Computes result = left - right.
|
||||
|
|
@ -424,7 +408,7 @@ void uECC_vli_modMult_fast(uECC_word_t *result, const uECC_word_t *left,
|
|||
* @return borrow
|
||||
*/
|
||||
uECC_word_t uECC_vli_sub(uECC_word_t *result, const uECC_word_t *left,
|
||||
const uECC_word_t *right, wordcount_t num_words);
|
||||
const uECC_word_t *right);
|
||||
|
||||
/*
|
||||
* @brief Constant-time comparison function(secure way to compare long ints)
|
||||
|
|
@ -433,8 +417,7 @@ uECC_word_t uECC_vli_sub(uECC_word_t *result, const uECC_word_t *left,
|
|||
* @param num_words IN -- number of words
|
||||
* @return Returns 0 if left == right, 1 otherwise.
|
||||
*/
|
||||
uECC_word_t uECC_vli_equal(const uECC_word_t *left, const uECC_word_t *right,
|
||||
wordcount_t num_words);
|
||||
uECC_word_t uECC_vli_equal(const uECC_word_t *left, const uECC_word_t *right);
|
||||
|
||||
/*
|
||||
* @brief Computes (left * right) % mod
|
||||
|
|
@ -445,8 +428,7 @@ uECC_word_t uECC_vli_equal(const uECC_word_t *left, const uECC_word_t *right,
|
|||
* @param num_words IN -- number of words
|
||||
*/
|
||||
void uECC_vli_modMult(uECC_word_t *result, const uECC_word_t *left,
|
||||
const uECC_word_t *right, const uECC_word_t *mod,
|
||||
wordcount_t num_words);
|
||||
const uECC_word_t *right, const uECC_word_t *mod);
|
||||
|
||||
/*
|
||||
* @brief Computes (1 / input) % mod
|
||||
|
|
@ -458,7 +440,7 @@ void uECC_vli_modMult(uECC_word_t *result, const uECC_word_t *left,
|
|||
* @param num_words -- number of words
|
||||
*/
|
||||
void uECC_vli_modInv(uECC_word_t *result, const uECC_word_t *input,
|
||||
const uECC_word_t *mod, wordcount_t num_words);
|
||||
const uECC_word_t *mod);
|
||||
|
||||
/*
|
||||
* @brief Sets dest = src.
|
||||
|
|
@ -466,8 +448,7 @@ void uECC_vli_modInv(uECC_word_t *result, const uECC_word_t *input,
|
|||
* @param src IN -- origin buffer
|
||||
* @param num_words IN -- number of words
|
||||
*/
|
||||
void uECC_vli_set(uECC_word_t *dest, const uECC_word_t *src,
|
||||
wordcount_t num_words);
|
||||
void uECC_vli_set(uECC_word_t *dest, const uECC_word_t *src);
|
||||
|
||||
/*
|
||||
* @brief Computes (left + right) % mod.
|
||||
|
|
@ -480,8 +461,7 @@ void uECC_vli_set(uECC_word_t *dest, const uECC_word_t *src,
|
|||
* @param num_words IN -- number of words
|
||||
*/
|
||||
void uECC_vli_modAdd(uECC_word_t *result, const uECC_word_t *left,
|
||||
const uECC_word_t *right, const uECC_word_t *mod,
|
||||
wordcount_t num_words);
|
||||
const uECC_word_t *right, const uECC_word_t *mod);
|
||||
|
||||
/*
|
||||
* @brief Counts the number of bits required to represent vli.
|
||||
|
|
@ -489,15 +469,14 @@ void uECC_vli_modAdd(uECC_word_t *result, const uECC_word_t *left,
|
|||
* @param max_words IN -- number of words
|
||||
* @return number of bits in given vli
|
||||
*/
|
||||
bitcount_t uECC_vli_numBits(const uECC_word_t *vli,
|
||||
const wordcount_t max_words);
|
||||
bitcount_t uECC_vli_numBits(const uECC_word_t *vli);
|
||||
|
||||
/*
|
||||
* @brief Erases (set to 0) vli
|
||||
* @param vli IN -- very long integer
|
||||
* @param num_words IN -- number of words
|
||||
*/
|
||||
void uECC_vli_clear(uECC_word_t *vli, wordcount_t num_words);
|
||||
void uECC_vli_clear(uECC_word_t *vli);
|
||||
|
||||
/*
|
||||
* @brief check if it is a valid point in the curve
|
||||
|
|
|
|||
636
tinycrypt/ecc.c
636
tinycrypt/ecc.c
File diff suppressed because it is too large
Load diff
|
|
@ -72,12 +72,6 @@
|
|||
#include <string.h>
|
||||
#include "mbedtls/platform_util.h"
|
||||
|
||||
#if default_RNG_defined
|
||||
static uECC_RNG_Function g_rng_function = &default_CSPRNG;
|
||||
#else
|
||||
static uECC_RNG_Function g_rng_function = 0;
|
||||
#endif
|
||||
|
||||
int uECC_make_key_with_d(uint8_t *public_key, uint8_t *private_key,
|
||||
unsigned int *d, uECC_Curve curve)
|
||||
{
|
||||
|
|
@ -129,7 +123,7 @@ int uECC_make_key(uint8_t *public_key, uint8_t *private_key, uECC_Curve curve)
|
|||
}
|
||||
|
||||
/* computing modular reduction of _random (see FIPS 186.4 B.4.1): */
|
||||
uECC_vli_mmod(_private, _random, curve->n, BITS_TO_WORDS(curve->num_n_bits));
|
||||
uECC_vli_mmod(_private, _random, curve->n);
|
||||
|
||||
/* Computing public-key from private: */
|
||||
if (EccPoint_compute_public_key(_public, _private, curve)) {
|
||||
|
|
@ -160,15 +154,16 @@ int uECC_shared_secret(const uint8_t *public_key, const uint8_t *private_key,
|
|||
|
||||
uECC_word_t _public[NUM_ECC_WORDS * 2];
|
||||
uECC_word_t _private[NUM_ECC_WORDS];
|
||||
|
||||
uECC_word_t tmp[NUM_ECC_WORDS];
|
||||
uECC_word_t *p2[2] = {_private, tmp};
|
||||
uECC_word_t *initial_Z = 0;
|
||||
uECC_word_t carry;
|
||||
wordcount_t num_words = curve->num_words;
|
||||
wordcount_t num_bytes = curve->num_bytes;
|
||||
int r;
|
||||
|
||||
/* Protect against invalid curve attacks */
|
||||
if (uECC_valid_public_key(public_key, curve) != 0) {
|
||||
r = 0;
|
||||
goto clear_and_out;
|
||||
}
|
||||
|
||||
/* Converting buffers to correct bit order: */
|
||||
uECC_vli_bytesToNative(_private,
|
||||
private_key,
|
||||
|
|
@ -180,30 +175,15 @@ int uECC_shared_secret(const uint8_t *public_key, const uint8_t *private_key,
|
|||
public_key + num_bytes,
|
||||
num_bytes);
|
||||
|
||||
/* Regularize the bitcount for the private key so that attackers cannot use a
|
||||
* side channel attack to learn the number of leading zeros. */
|
||||
carry = regularize_k(_private, _private, tmp, curve);
|
||||
|
||||
/* If an RNG function was specified, try to get a random initial Z value to
|
||||
* improve protection against side-channel attacks. */
|
||||
if (g_rng_function) {
|
||||
if (!uECC_generate_random_int(p2[carry], curve->p, num_words)) {
|
||||
r = 0;
|
||||
goto clear_and_out;
|
||||
}
|
||||
initial_Z = p2[carry];
|
||||
}
|
||||
|
||||
EccPoint_mult(_public, _public, p2[!carry], initial_Z, curve->num_n_bits + 1,
|
||||
curve);
|
||||
r = EccPoint_mult_safer(_public, _public, _private, curve);
|
||||
if (r == 0)
|
||||
goto clear_and_out;
|
||||
|
||||
uECC_vli_nativeToBytes(secret, num_bytes, _public);
|
||||
r = !EccPoint_isZero(_public, curve);
|
||||
|
||||
clear_and_out:
|
||||
/* erasing temporary buffer used to store secret: */
|
||||
mbedtls_platform_zeroize(p2, sizeof(p2));
|
||||
mbedtls_platform_zeroize(tmp, sizeof(tmp));
|
||||
mbedtls_platform_zeroize(_private, sizeof(_private));
|
||||
|
||||
return r;
|
||||
|
|
|
|||
|
|
@ -87,7 +87,7 @@ static void bits2int(uECC_word_t *native, const uint8_t *bits,
|
|||
bits_size = num_n_bytes;
|
||||
}
|
||||
|
||||
uECC_vli_clear(native, num_n_words);
|
||||
uECC_vli_clear(native);
|
||||
uECC_vli_bytesToNative(native, bits, bits_size);
|
||||
if (bits_size * 8 <= (unsigned)curve->num_n_bits) {
|
||||
return;
|
||||
|
|
@ -102,8 +102,8 @@ static void bits2int(uECC_word_t *native, const uint8_t *bits,
|
|||
}
|
||||
|
||||
/* Reduce mod curve_n */
|
||||
if (uECC_vli_cmp_unsafe(curve->n, native, num_n_words) != 1) {
|
||||
uECC_vli_sub(native, native, curve->n, num_n_words);
|
||||
if (uECC_vli_cmp_unsafe(curve->n, native) != 1) {
|
||||
uECC_vli_sub(native, native, curve->n);
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -114,29 +114,26 @@ int uECC_sign_with_k(const uint8_t *private_key, const uint8_t *message_hash,
|
|||
|
||||
uECC_word_t tmp[NUM_ECC_WORDS];
|
||||
uECC_word_t s[NUM_ECC_WORDS];
|
||||
uECC_word_t *k2[2] = {tmp, s};
|
||||
uECC_word_t p[NUM_ECC_WORDS * 2];
|
||||
uECC_word_t carry;
|
||||
wordcount_t num_words = curve->num_words;
|
||||
wordcount_t num_n_words = BITS_TO_WORDS(curve->num_n_bits);
|
||||
bitcount_t num_n_bits = curve->num_n_bits;
|
||||
int r;
|
||||
|
||||
|
||||
/* Make sure 0 < k < curve_n */
|
||||
if (uECC_vli_isZero(k, num_words) ||
|
||||
uECC_vli_cmp(curve->n, k, num_n_words) != 1) {
|
||||
if (uECC_vli_isZero(k) ||
|
||||
uECC_vli_cmp(curve->n, k) != 1) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
carry = regularize_k(k, tmp, s, curve);
|
||||
EccPoint_mult(p, curve->G, k2[!carry], 0, num_n_bits + 1, curve);
|
||||
if (uECC_vli_isZero(p, num_words)) {
|
||||
r = EccPoint_mult_safer(p, curve->G, k, curve);
|
||||
if (r == 0 || uECC_vli_isZero(p)) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* If an RNG function was specified, get a random number
|
||||
to prevent side channel analysis of k. */
|
||||
if (!g_rng_function) {
|
||||
uECC_vli_clear(tmp, num_n_words);
|
||||
uECC_vli_clear(tmp);
|
||||
tmp[0] = 1;
|
||||
}
|
||||
else if (!uECC_generate_random_int(tmp, curve->n, num_n_words)) {
|
||||
|
|
@ -145,9 +142,9 @@ int uECC_sign_with_k(const uint8_t *private_key, const uint8_t *message_hash,
|
|||
|
||||
/* Prevent side channel analysis of uECC_vli_modInv() to determine
|
||||
bits of k / the private key by premultiplying by a random number */
|
||||
uECC_vli_modMult(k, k, tmp, curve->n, num_n_words); /* k' = rand * k */
|
||||
uECC_vli_modInv(k, k, curve->n, num_n_words); /* k = 1 / k' */
|
||||
uECC_vli_modMult(k, k, tmp, curve->n, num_n_words); /* k = 1 / k */
|
||||
uECC_vli_modMult(k, k, tmp, curve->n); /* k' = rand * k */
|
||||
uECC_vli_modInv(k, k, curve->n); /* k = 1 / k' */
|
||||
uECC_vli_modMult(k, k, tmp, curve->n); /* k = 1 / k */
|
||||
|
||||
uECC_vli_nativeToBytes(signature, curve->num_bytes, p); /* store r */
|
||||
|
||||
|
|
@ -155,13 +152,13 @@ int uECC_sign_with_k(const uint8_t *private_key, const uint8_t *message_hash,
|
|||
uECC_vli_bytesToNative(tmp, private_key, BITS_TO_BYTES(curve->num_n_bits));
|
||||
|
||||
s[num_n_words - 1] = 0;
|
||||
uECC_vli_set(s, p, num_words);
|
||||
uECC_vli_modMult(s, tmp, s, curve->n, num_n_words); /* s = r*d */
|
||||
uECC_vli_set(s, p);
|
||||
uECC_vli_modMult(s, tmp, s, curve->n); /* s = r*d */
|
||||
|
||||
bits2int(tmp, message_hash, hash_size, curve);
|
||||
uECC_vli_modAdd(s, tmp, s, curve->n, num_n_words); /* s = e + r*d */
|
||||
uECC_vli_modMult(s, s, k, curve->n, num_n_words); /* s = (e + r*d) / k */
|
||||
if (uECC_vli_numBits(s, num_n_words) > (bitcount_t)curve->num_bytes * 8) {
|
||||
uECC_vli_modAdd(s, tmp, s, curve->n); /* s = e + r*d */
|
||||
uECC_vli_modMult(s, s, k, curve->n); /* s = (e + r*d) / k */
|
||||
if (uECC_vli_numBits(s) > (bitcount_t)curve->num_bytes * 8) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
|
@ -185,7 +182,7 @@ int uECC_sign(const uint8_t *private_key, const uint8_t *message_hash,
|
|||
}
|
||||
|
||||
// computing k as modular reduction of _random (see FIPS 186.4 B.5.1):
|
||||
uECC_vli_mmod(k, _random, curve->n, BITS_TO_WORDS(curve->num_n_bits));
|
||||
uECC_vli_mmod(k, _random, curve->n);
|
||||
|
||||
if (uECC_sign_with_k(private_key, message_hash, hash_size, k, signature,
|
||||
curve)) {
|
||||
|
|
@ -223,6 +220,9 @@ int uECC_verify(const uint8_t *public_key, const uint8_t *message_hash,
|
|||
wordcount_t num_words = curve->num_words;
|
||||
wordcount_t num_n_words = BITS_TO_WORDS(curve->num_n_bits);
|
||||
|
||||
if (curve != uECC_secp256r1())
|
||||
return 0;
|
||||
|
||||
rx[num_n_words - 1] = 0;
|
||||
r[num_n_words - 1] = 0;
|
||||
s[num_n_words - 1] = 0;
|
||||
|
|
@ -234,46 +234,46 @@ int uECC_verify(const uint8_t *public_key, const uint8_t *message_hash,
|
|||
uECC_vli_bytesToNative(s, signature + curve->num_bytes, curve->num_bytes);
|
||||
|
||||
/* r, s must not be 0. */
|
||||
if (uECC_vli_isZero(r, num_words) || uECC_vli_isZero(s, num_words)) {
|
||||
if (uECC_vli_isZero(r) || uECC_vli_isZero(s)) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* r, s must be < n. */
|
||||
if (uECC_vli_cmp_unsafe(curve->n, r, num_n_words) != 1 ||
|
||||
uECC_vli_cmp_unsafe(curve->n, s, num_n_words) != 1) {
|
||||
if (uECC_vli_cmp_unsafe(curve->n, r) != 1 ||
|
||||
uECC_vli_cmp_unsafe(curve->n, s) != 1) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* Calculate u1 and u2. */
|
||||
uECC_vli_modInv(z, s, curve->n, num_n_words); /* z = 1/s */
|
||||
uECC_vli_modInv(z, s, curve->n); /* z = 1/s */
|
||||
u1[num_n_words - 1] = 0;
|
||||
bits2int(u1, message_hash, hash_size, curve);
|
||||
uECC_vli_modMult(u1, u1, z, curve->n, num_n_words); /* u1 = e/s */
|
||||
uECC_vli_modMult(u2, r, z, curve->n, num_n_words); /* u2 = r/s */
|
||||
uECC_vli_modMult(u1, u1, z, curve->n); /* u1 = e/s */
|
||||
uECC_vli_modMult(u2, r, z, curve->n); /* u2 = r/s */
|
||||
|
||||
/* Calculate sum = G + Q. */
|
||||
uECC_vli_set(sum, _public, num_words);
|
||||
uECC_vli_set(sum + num_words, _public + num_words, num_words);
|
||||
uECC_vli_set(tx, curve->G, num_words);
|
||||
uECC_vli_set(ty, curve->G + num_words, num_words);
|
||||
uECC_vli_modSub(z, sum, tx, curve->p, num_words); /* z = x2 - x1 */
|
||||
uECC_vli_set(sum, _public);
|
||||
uECC_vli_set(sum + num_words, _public + num_words);
|
||||
uECC_vli_set(tx, curve->G);
|
||||
uECC_vli_set(ty, curve->G + num_words);
|
||||
uECC_vli_modSub(z, sum, tx, curve->p); /* z = x2 - x1 */
|
||||
XYcZ_add(tx, ty, sum, sum + num_words, curve);
|
||||
uECC_vli_modInv(z, z, curve->p, num_words); /* z = 1/z */
|
||||
apply_z(sum, sum + num_words, z, curve);
|
||||
uECC_vli_modInv(z, z, curve->p); /* z = 1/z */
|
||||
apply_z(sum, sum + num_words, z);
|
||||
|
||||
/* Use Shamir's trick to calculate u1*G + u2*Q */
|
||||
points[0] = 0;
|
||||
points[1] = curve->G;
|
||||
points[2] = _public;
|
||||
points[3] = sum;
|
||||
num_bits = smax(uECC_vli_numBits(u1, num_n_words),
|
||||
uECC_vli_numBits(u2, num_n_words));
|
||||
num_bits = smax(uECC_vli_numBits(u1),
|
||||
uECC_vli_numBits(u2));
|
||||
|
||||
point = points[(!!uECC_vli_testBit(u1, num_bits - 1)) |
|
||||
((!!uECC_vli_testBit(u2, num_bits - 1)) << 1)];
|
||||
uECC_vli_set(rx, point, num_words);
|
||||
uECC_vli_set(ry, point + num_words, num_words);
|
||||
uECC_vli_clear(z, num_words);
|
||||
uECC_vli_set(rx, point);
|
||||
uECC_vli_set(ry, point + num_words);
|
||||
uECC_vli_clear(z);
|
||||
z[0] = 1;
|
||||
|
||||
for (i = num_bits - 2; i >= 0; --i) {
|
||||
|
|
@ -283,25 +283,25 @@ int uECC_verify(const uint8_t *public_key, const uint8_t *message_hash,
|
|||
index = (!!uECC_vli_testBit(u1, i)) | ((!!uECC_vli_testBit(u2, i)) << 1);
|
||||
point = points[index];
|
||||
if (point) {
|
||||
uECC_vli_set(tx, point, num_words);
|
||||
uECC_vli_set(ty, point + num_words, num_words);
|
||||
apply_z(tx, ty, z, curve);
|
||||
uECC_vli_modSub(tz, rx, tx, curve->p, num_words); /* Z = x2 - x1 */
|
||||
uECC_vli_set(tx, point);
|
||||
uECC_vli_set(ty, point + num_words);
|
||||
apply_z(tx, ty, z);
|
||||
uECC_vli_modSub(tz, rx, tx, curve->p); /* Z = x2 - x1 */
|
||||
XYcZ_add(tx, ty, rx, ry, curve);
|
||||
uECC_vli_modMult_fast(z, z, tz, curve);
|
||||
uECC_vli_modMult_fast(z, z, tz);
|
||||
}
|
||||
}
|
||||
|
||||
uECC_vli_modInv(z, z, curve->p, num_words); /* Z = 1/Z */
|
||||
apply_z(rx, ry, z, curve);
|
||||
uECC_vli_modInv(z, z, curve->p); /* Z = 1/Z */
|
||||
apply_z(rx, ry, z);
|
||||
|
||||
/* v = x1 (mod n) */
|
||||
if (uECC_vli_cmp_unsafe(curve->n, rx, num_n_words) != 1) {
|
||||
uECC_vli_sub(rx, rx, curve->n, num_n_words);
|
||||
if (uECC_vli_cmp_unsafe(curve->n, rx) != 1) {
|
||||
uECC_vli_sub(rx, rx, curve->n);
|
||||
}
|
||||
|
||||
/* Accept only if v == r. */
|
||||
return (int)(uECC_vli_equal(rx, r, num_words) == 0);
|
||||
return (int)(uECC_vli_equal(rx, r) == 0);
|
||||
}
|
||||
#else
|
||||
typedef int mbedtls_dummy_tinycrypt_def;
|
||||
|
|
|
|||
Loading…
Reference in a new issue