1 /* ====================================================================
2  * Copyright (c) 1998-2005 The OpenSSL Project.  All rights reserved.
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  *
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in
13  *    the documentation and/or other materials provided with the
14  *    distribution.
15  *
16  * 3. All advertising materials mentioning features or use of this
17  *    software must display the following acknowledgment:
18  *    "This product includes software developed by the OpenSSL Project
19  *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
20  *
21  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
22  *    endorse or promote products derived from this software without
23  *    prior written permission. For written permission, please contact
24  *    openssl-core@OpenSSL.org.
25  *
26  * 5. Products derived from this software may not be called "OpenSSL"
27  *    nor may "OpenSSL" appear in their names without prior written
28  *    permission of the OpenSSL Project.
29  *
30  * 6. Redistributions of any form whatsoever must retain the following
31  *    acknowledgment:
32  *    "This product includes software developed by the OpenSSL Project
33  *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
34  *
35  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
36  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
37  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
38  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
39  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
40  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
41  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
42  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
43  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
44  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
45  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
46  * OF THE POSSIBILITY OF SUCH DAMAGE.
47  * ====================================================================
48  *
49  * This product includes cryptographic software written by Eric Young
50  * (eay@cryptsoft.com).  This product includes software written by Tim
51  * Hudson (tjh@cryptsoft.com). */
52 
53 #include <openssl/ecdsa.h>
54 
55 #include <limits.h>
56 #include <string.h>
57 
58 #include <openssl/bn.h>
59 #include <openssl/bytestring.h>
60 #include <openssl/err.h>
61 #include <openssl/ec_key.h>
62 #include <openssl/mem.h>
63 
64 #include "../bytestring/internal.h"
65 #include "../ec/internal.h"
66 
67 
ECDSA_size(const EC_KEY * key)68 size_t ECDSA_size(const EC_KEY *key) {
69   if (key == NULL) {
70     return 0;
71   }
72 
73   size_t group_order_size;
74   if (key->ecdsa_meth && key->ecdsa_meth->group_order_size) {
75     group_order_size = key->ecdsa_meth->group_order_size(key);
76   } else {
77     const EC_GROUP *group = EC_KEY_get0_group(key);
78     if (group == NULL) {
79       return 0;
80     }
81 
82     group_order_size = BN_num_bytes(EC_GROUP_get0_order(group));
83   }
84 
85   return ECDSA_SIG_max_len(group_order_size);
86 }
87 
ECDSA_SIG_new(void)88 ECDSA_SIG *ECDSA_SIG_new(void) {
89   ECDSA_SIG *sig = OPENSSL_malloc(sizeof(ECDSA_SIG));
90   if (sig == NULL) {
91     return NULL;
92   }
93   sig->r = BN_new();
94   sig->s = BN_new();
95   if (sig->r == NULL || sig->s == NULL) {
96     ECDSA_SIG_free(sig);
97     return NULL;
98   }
99   return sig;
100 }
101 
ECDSA_SIG_free(ECDSA_SIG * sig)102 void ECDSA_SIG_free(ECDSA_SIG *sig) {
103   if (sig == NULL) {
104     return;
105   }
106 
107   BN_free(sig->r);
108   BN_free(sig->s);
109   OPENSSL_free(sig);
110 }
111 
ECDSA_SIG_parse(CBS * cbs)112 ECDSA_SIG *ECDSA_SIG_parse(CBS *cbs) {
113   ECDSA_SIG *ret = ECDSA_SIG_new();
114   if (ret == NULL) {
115     return NULL;
116   }
117   CBS child;
118   if (!CBS_get_asn1(cbs, &child, CBS_ASN1_SEQUENCE) ||
119       !BN_parse_asn1_unsigned(&child, ret->r) ||
120       !BN_parse_asn1_unsigned(&child, ret->s) ||
121       CBS_len(&child) != 0) {
122     OPENSSL_PUT_ERROR(ECDSA, ECDSA_R_BAD_SIGNATURE);
123     ECDSA_SIG_free(ret);
124     return NULL;
125   }
126   return ret;
127 }
128 
ECDSA_SIG_from_bytes(const uint8_t * in,size_t in_len)129 ECDSA_SIG *ECDSA_SIG_from_bytes(const uint8_t *in, size_t in_len) {
130   CBS cbs;
131   CBS_init(&cbs, in, in_len);
132   ECDSA_SIG *ret = ECDSA_SIG_parse(&cbs);
133   if (ret == NULL || CBS_len(&cbs) != 0) {
134     OPENSSL_PUT_ERROR(ECDSA, ECDSA_R_BAD_SIGNATURE);
135     ECDSA_SIG_free(ret);
136     return NULL;
137   }
138   return ret;
139 }
140 
ECDSA_SIG_marshal(CBB * cbb,const ECDSA_SIG * sig)141 int ECDSA_SIG_marshal(CBB *cbb, const ECDSA_SIG *sig) {
142   CBB child;
143   if (!CBB_add_asn1(cbb, &child, CBS_ASN1_SEQUENCE) ||
144       !BN_marshal_asn1(&child, sig->r) ||
145       !BN_marshal_asn1(&child, sig->s) ||
146       !CBB_flush(cbb)) {
147     OPENSSL_PUT_ERROR(ECDSA, ECDSA_R_ENCODE_ERROR);
148     return 0;
149   }
150   return 1;
151 }
152 
ECDSA_SIG_to_bytes(uint8_t ** out_bytes,size_t * out_len,const ECDSA_SIG * sig)153 int ECDSA_SIG_to_bytes(uint8_t **out_bytes, size_t *out_len,
154                        const ECDSA_SIG *sig) {
155   CBB cbb;
156   CBB_zero(&cbb);
157   if (!CBB_init(&cbb, 0) ||
158       !ECDSA_SIG_marshal(&cbb, sig) ||
159       !CBB_finish(&cbb, out_bytes, out_len)) {
160     OPENSSL_PUT_ERROR(ECDSA, ECDSA_R_ENCODE_ERROR);
161     CBB_cleanup(&cbb);
162     return 0;
163   }
164   return 1;
165 }
166 
167 /* der_len_len returns the number of bytes needed to represent a length of |len|
168  * in DER. */
der_len_len(size_t len)169 static size_t der_len_len(size_t len) {
170   if (len < 0x80) {
171     return 1;
172   }
173   size_t ret = 1;
174   while (len > 0) {
175     ret++;
176     len >>= 8;
177   }
178   return ret;
179 }
180 
ECDSA_SIG_max_len(size_t order_len)181 size_t ECDSA_SIG_max_len(size_t order_len) {
182   /* Compute the maximum length of an |order_len| byte integer. Defensively
183    * assume that the leading 0x00 is included. */
184   size_t integer_len = 1 /* tag */ + der_len_len(order_len + 1) + 1 + order_len;
185   if (integer_len < order_len) {
186     return 0;
187   }
188   /* An ECDSA signature is two INTEGERs. */
189   size_t value_len = 2 * integer_len;
190   if (value_len < integer_len) {
191     return 0;
192   }
193   /* Add the header. */
194   size_t ret = 1 /* tag */ + der_len_len(value_len) + value_len;
195   if (ret < value_len) {
196     return 0;
197   }
198   return ret;
199 }
200 
d2i_ECDSA_SIG(ECDSA_SIG ** out,const uint8_t ** inp,long len)201 ECDSA_SIG *d2i_ECDSA_SIG(ECDSA_SIG **out, const uint8_t **inp, long len) {
202   if (len < 0) {
203     return NULL;
204   }
205   CBS cbs;
206   CBS_init(&cbs, *inp, (size_t)len);
207   ECDSA_SIG *ret = ECDSA_SIG_parse(&cbs);
208   if (ret == NULL) {
209     return NULL;
210   }
211   if (out != NULL) {
212     ECDSA_SIG_free(*out);
213     *out = ret;
214   }
215   *inp = CBS_data(&cbs);
216   return ret;
217 }
218 
i2d_ECDSA_SIG(const ECDSA_SIG * sig,uint8_t ** outp)219 int i2d_ECDSA_SIG(const ECDSA_SIG *sig, uint8_t **outp) {
220   CBB cbb;
221   if (!CBB_init(&cbb, 0) ||
222       !ECDSA_SIG_marshal(&cbb, sig)) {
223     CBB_cleanup(&cbb);
224     return -1;
225   }
226   return CBB_finish_i2d(&cbb, outp);
227 }
228