5c3f75ec |
1 | /* -*-c-*- |
2 | * |
c65df279 |
3 | * $Id$ |
5c3f75ec |
4 | * |
5 | * Catcrypt signatures |
6 | * |
7 | * (c) 2004 Straylight/Edgeware |
8 | */ |
9 | |
10 | /*----- Licensing notice --------------------------------------------------* |
11 | * |
12 | * This file is part of Catacomb. |
13 | * |
14 | * Catacomb is free software; you can redistribute it and/or modify |
15 | * it under the terms of the GNU Library General Public License as |
16 | * published by the Free Software Foundation; either version 2 of the |
17 | * License, or (at your option) any later version. |
18 | * |
19 | * Catacomb is distributed in the hope that it will be useful, |
20 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
21 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
22 | * GNU Library General Public License for more details. |
23 | * |
24 | * You should have received a copy of the GNU Library General Public |
25 | * License along with Catacomb; if not, write to the Free |
26 | * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, |
27 | * MA 02111-1307, USA. |
28 | */ |
29 | |
30 | /*----- Header files ------------------------------------------------------*/ |
31 | |
32 | #include <stdlib.h> |
33 | |
34 | #include <mLib/report.h> |
35 | |
36 | #include "rand.h" |
37 | #include "sha.h" |
38 | #include "has160.h" |
39 | |
40 | #include "ec.h" |
41 | #include "ec-keys.h" |
42 | #include "dh.h" |
43 | #include "gdsa.h" |
44 | #include "gkcdsa.h" |
45 | #include "rsa.h" |
46 | |
47 | #include "cc.h" |
48 | |
49 | /*----- Main code ---------------------------------------------------------*/ |
50 | |
51 | /* --- RSA PKCS1 --- */ |
52 | |
53 | typedef struct rsap1_sigctx { |
54 | sig s; |
55 | rsa_privctx rp; |
56 | pkcs1 p1; |
57 | } rsap1_sigctx; |
58 | |
59 | static sig *rsap1_siginit(key *k, void *kd, const gchash *hc) |
60 | { |
61 | rsap1_sigctx *rs = CREATE(rsap1_sigctx); |
62 | rsa_privcreate(&rs->rp, kd, &rand_global); |
63 | rs->p1.r = &rand_global; |
64 | rs->p1.ep = hc->name; |
65 | rs->p1.epsz = strlen(hc->name) + 1; |
66 | rs->s.h = 0; |
67 | return (&rs->s); |
68 | } |
69 | |
70 | static int rsap1_sigdoit(sig *s, dstr *d) |
71 | { |
72 | rsap1_sigctx *rs = (rsap1_sigctx *)s; |
73 | size_t n; |
74 | mp *m = rsa_sign(&rs->rp, MP_NEW, |
75 | GH_DONE(s->h, 0), GH_CLASS(s->h)->hashsz, |
76 | pkcs1_sigencode, &rs->p1); |
77 | if (!m) return (-1); |
78 | n = mp_octets(rs->rp.rp->n); dstr_ensure(d, n); mp_storeb(m, d->buf, n); |
79 | d->len += n; mp_drop(m); |
80 | return (0); |
81 | } |
82 | |
83 | static const char *rsa_lengthcheck(mp *n) |
84 | { |
85 | if (mp_bits(n) < 1024) return ("key too short"); |
86 | return (0); |
87 | } |
88 | |
89 | static const char *rsap1_sigcheck(sig *s) |
90 | { |
91 | rsap1_sigctx *rs = (rsap1_sigctx *)s; |
92 | const char *e; |
93 | if ((e = rsa_lengthcheck(rs->rp.rp->n)) != 0) return (e); |
94 | return (0); |
95 | } |
96 | |
97 | static void rsap1_sigdestroy(sig *s) |
98 | { |
99 | rsap1_sigctx *rs = (rsap1_sigctx *)s; |
100 | rsa_privdestroy(&rs->rp); |
101 | DESTROY(rs); |
102 | } |
103 | |
104 | static const sigops rsap1_sig = { |
105 | rsa_privfetch, sizeof(rsa_priv), |
106 | rsap1_siginit, rsap1_sigdoit, rsap1_sigcheck, rsap1_sigdestroy |
107 | }; |
108 | |
109 | typedef struct rsap1_vrfctx { |
110 | sig s; |
111 | rsa_pubctx rp; |
112 | pkcs1 p1; |
113 | } rsap1_vrfctx; |
114 | |
115 | static sig *rsap1_vrfinit(key *k, void *kd, const gchash *hc) |
116 | { |
117 | rsap1_vrfctx *rv = CREATE(rsap1_vrfctx); |
118 | rsa_pubcreate(&rv->rp, kd); |
119 | rv->p1.r = &rand_global; |
120 | rv->p1.ep = hc->name; |
121 | rv->p1.epsz = strlen(hc->name) + 1; |
122 | rv->s.h = 0; |
123 | return (&rv->s); |
124 | } |
125 | |
126 | static int rsap1_vrfdoit(sig *s, dstr *d) |
127 | { |
128 | rsap1_vrfctx *rv = (rsap1_vrfctx *)s; |
129 | mp *m = mp_loadb(MP_NEW, d->buf, d->len); |
130 | int rc = rsa_verify(&rv->rp, m, |
131 | GH_DONE(s->h, 0), GH_CLASS(s->h)->hashsz, |
132 | 0, pkcs1_sigdecode, &rv->p1); |
133 | mp_drop(m); |
134 | return (rc); |
135 | } |
136 | |
137 | static const char *rsap1_vrfcheck(sig *s) |
138 | { |
139 | rsap1_vrfctx *rv = (rsap1_vrfctx *)s; |
140 | const char *e; |
141 | if ((e = rsa_lengthcheck(rv->rp.rp->n)) != 0) return (e); |
142 | return (0); |
143 | } |
144 | |
145 | static void rsap1_vrfdestroy(sig *s) |
146 | { |
147 | rsap1_vrfctx *rv = (rsap1_vrfctx *)s; |
148 | rsa_pubdestroy(&rv->rp); |
149 | DESTROY(rv); |
150 | } |
151 | |
152 | static const sigops rsap1_vrf = { |
153 | rsa_pubfetch, sizeof(rsa_pub), |
154 | rsap1_vrfinit, rsap1_vrfdoit, rsap1_vrfcheck, rsap1_vrfdestroy |
155 | }; |
156 | |
157 | /* --- RSA PSS --- */ |
158 | |
159 | static const gccipher *getmgf(key *k, const gchash *hc) |
160 | { |
161 | dstr d = DSTR_INIT; |
162 | const gccipher *gc; |
163 | const char *mm; |
164 | |
165 | if ((mm = key_getattr(0, k, "mgf")) == 0) { |
166 | dstr_putf(&d, "%s-mgf", hc->name); |
167 | mm = d.buf; |
168 | } |
169 | if ((gc = gcipher_byname(mm)) == 0) |
170 | die(EXIT_FAILURE, "unknown encryption scheme `%s'", mm); |
171 | dstr_destroy(&d); |
172 | return (gc); |
173 | } |
174 | |
175 | typedef struct rsapss_sigctx { |
176 | sig s; |
177 | rsa_privctx rp; |
178 | pss p; |
179 | } rsapss_sigctx; |
180 | |
181 | static sig *rsapss_siginit(key *k, void *kd, const gchash *hc) |
182 | { |
183 | rsapss_sigctx *rs = CREATE(rsapss_sigctx); |
184 | rsa_privcreate(&rs->rp, kd, &rand_global); |
185 | rs->p.r = &rand_global; |
186 | rs->p.cc = getmgf(k, hc); |
187 | rs->p.ch = hc; |
188 | rs->p.ssz = hc->hashsz; |
189 | rsa_privdestroy(&rs->rp); |
190 | return (&rs->s); |
191 | } |
192 | |
193 | static int rsapss_sigdoit(sig *s, dstr *d) |
194 | { |
195 | rsapss_sigctx *rs = (rsapss_sigctx *)s; |
196 | size_t n; |
197 | mp *m = rsa_sign(&rs->rp, MP_NEW, |
198 | GH_DONE(s->h, 0), GH_CLASS(s->h)->hashsz, |
199 | pss_encode, &rs->p); |
200 | if (!m) return (-1); |
201 | n = mp_octets(rs->rp.rp->n); dstr_ensure(d, n); mp_storeb(m, d->buf, n); |
202 | d->len += n; mp_drop(m); |
203 | return (0); |
204 | } |
205 | |
206 | static const char *rsapss_sigcheck(sig *s) |
207 | { |
208 | rsapss_sigctx *rs = (rsapss_sigctx *)s; |
209 | const char *e; |
210 | if ((e = rsa_lengthcheck(rs->rp.rp->n)) != 0) return (e); |
211 | return (0); |
212 | } |
213 | |
214 | static void rsapss_sigdestroy(sig *s) |
215 | { |
216 | rsapss_sigctx *rs = (rsapss_sigctx *)s; |
217 | rsa_privdestroy(&rs->rp); |
218 | DESTROY(rs); |
219 | } |
220 | |
221 | static const sigops rsapss_sig = { |
222 | rsa_privfetch, sizeof(rsa_priv), |
223 | rsapss_siginit, rsapss_sigdoit, rsapss_sigcheck, rsapss_sigdestroy |
224 | }; |
225 | |
226 | typedef struct rsapss_vrfctx { |
227 | sig s; |
228 | rsa_pubctx rp; |
229 | pss p; |
230 | } rsapss_vrfctx; |
231 | |
232 | static sig *rsapss_vrfinit(key *k, void *kd, const gchash *hc) |
233 | { |
234 | rsapss_vrfctx *rv = CREATE(rsapss_vrfctx); |
235 | rsa_pubcreate(&rv->rp, kd); |
236 | rv->p.r = &rand_global; |
237 | rv->p.cc = getmgf(k, hc); |
238 | rv->p.ch = hc; |
239 | rv->p.ssz = hc->hashsz; |
240 | return (&rv->s); |
241 | } |
242 | |
243 | static int rsapss_vrfdoit(sig *s, dstr *d) |
244 | { |
245 | rsapss_vrfctx *rv = (rsapss_vrfctx *)s; |
246 | mp *m = mp_loadb(MP_NEW, d->buf, d->len); |
247 | int rc = rsa_verify(&rv->rp, m, |
248 | GH_DONE(s->h, 0), GH_CLASS(s->h)->hashsz, |
249 | 0, pss_decode, &rv->p); |
250 | mp_drop(m); |
251 | return (rc); |
252 | } |
253 | |
254 | static const char *rsapss_vrfcheck(sig *s) |
255 | { |
256 | rsapss_vrfctx *rv = (rsapss_vrfctx *)s; |
257 | const char *e; |
258 | if ((e = rsa_lengthcheck(rv->rp.rp->n)) != 0) return (e); |
259 | return (0); |
260 | } |
261 | |
262 | static void rsapss_vrfdestroy(sig *s) |
263 | { |
264 | rsapss_vrfctx *rv = (rsapss_vrfctx *)s; |
265 | rsa_pubdestroy(&rv->rp); |
266 | DESTROY(rv); |
267 | } |
268 | |
269 | static const sigops rsapss_vrf = { |
270 | rsa_pubfetch, sizeof(rsa_pub), |
271 | rsapss_vrfinit, rsapss_vrfdoit, rsapss_vrfcheck, rsapss_vrfdestroy |
272 | }; |
273 | |
274 | /* --- DSA and ECDSA --- */ |
275 | |
276 | typedef struct dsa_sigctx { |
277 | sig s; |
278 | gdsa g; |
279 | } dsa_sigctx; |
280 | |
281 | static void dsa_initcommon(dsa_sigctx *ds, const gchash *hc, |
282 | const char *ktag) |
283 | { |
284 | ds->g.r = &rand_global; |
285 | ds->g.h = hc; |
286 | ds->g.u = MP_NEW; |
287 | ds->s.h = 0; |
288 | } |
289 | |
290 | static dsa_sigctx *dsa_doinit(key *k, const gprime_param *gp, |
3688eb75 |
291 | mp *y, const gchash *hc, |
292 | group *(*makegroup)(const gprime_param *), |
293 | const char *what) |
5c3f75ec |
294 | { |
295 | dsa_sigctx *ds = CREATE(dsa_sigctx); |
296 | dstr t = DSTR_INIT; |
297 | |
298 | key_fulltag(k, &t); |
3688eb75 |
299 | if ((ds->g.g = makegroup(gp)) == 0) |
300 | die(EXIT_FAILURE, "bad %s group in key `%s'", what, t.buf); |
5c3f75ec |
301 | ds->g.p = G_CREATE(ds->g.g); |
302 | if (G_FROMINT(ds->g.g, ds->g.p, y)) |
303 | die(EXIT_FAILURE, "bad public key in key `%s'", t.buf); |
304 | dsa_initcommon(ds, hc, t.buf); |
305 | dstr_destroy(&t); |
306 | return (ds); |
307 | } |
308 | |
309 | static dsa_sigctx *ecdsa_doinit(key *k, const char *cstr, |
310 | ec *y, const gchash *hc) |
311 | { |
312 | dsa_sigctx *ds = CREATE(dsa_sigctx); |
313 | ec_info ei; |
314 | const char *e; |
315 | dstr t = DSTR_INIT; |
316 | |
317 | key_fulltag(k, &t); |
318 | if ((e = ec_getinfo(&ei, cstr)) != 0) |
319 | die(EXIT_FAILURE, "bad curve in key `%s': %s", t.buf, e); |
320 | ds->g.g = group_ec(&ei); |
321 | ds->g.p = G_CREATE(ds->g.g); |
322 | if (G_FROMEC(ds->g.g, ds->g.p, y)) |
323 | die(EXIT_FAILURE, "bad public key in key `%s'", t.buf); |
324 | dsa_initcommon(ds, hc, t.buf); |
325 | dstr_destroy(&t); |
326 | return (ds); |
327 | } |
328 | |
329 | static sig *dsa_siginit(key *k, void *kd, const gchash *hc) |
330 | { |
331 | dh_priv *dp = kd; |
3688eb75 |
332 | dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_prime, "prime"); |
333 | ds->g.u = MP_COPY(dp->x); |
334 | return (&ds->s); |
335 | } |
336 | |
337 | static sig *bindsa_siginit(key *k, void *kd, const gchash *hc) |
338 | { |
339 | dh_priv *dp = kd; |
340 | dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_binary, "binary"); |
5c3f75ec |
341 | ds->g.u = MP_COPY(dp->x); |
342 | return (&ds->s); |
343 | } |
344 | |
345 | static sig *ecdsa_siginit(key *k, void *kd, const gchash *hc) |
346 | { |
347 | ec_priv *ep = kd; |
348 | dsa_sigctx *ds = ecdsa_doinit(k, ep->cstr, &ep->p, hc); |
349 | ds->g.u = MP_COPY(ep->x); |
350 | return (&ds->s); |
351 | } |
352 | |
353 | static int dsa_sigdoit(sig *s, dstr *d) |
354 | { |
355 | dsa_sigctx *ds = (dsa_sigctx *)s; |
356 | gdsa_sig ss = GDSA_SIG_INIT; |
357 | size_t n = mp_octets(ds->g.g->r); |
358 | |
359 | gdsa_sign(&ds->g, &ss, GH_DONE(ds->s.h, 0), 0); |
360 | dstr_ensure(d, 2 * n); |
361 | mp_storeb(ss.r, d->buf, n); |
362 | mp_storeb(ss.s, d->buf + n, n); |
363 | d->len += 2 * n; |
364 | mp_drop(ss.r); mp_drop(ss.s); |
365 | return (0); |
366 | } |
367 | |
368 | static const char *dsa_sigcheck(sig *s) |
369 | { |
370 | dsa_sigctx *ds = (dsa_sigctx *)s; |
371 | const char *e; |
372 | if ((e = G_CHECK(ds->g.g, &rand_global)) != 0) |
373 | return (0); |
374 | if (group_check(ds->g.g, ds->g.p)) |
375 | return ("public key not in subgroup"); |
376 | return (0); |
377 | } |
378 | |
379 | static void dsa_sigdestroy(sig *s) |
380 | { |
381 | dsa_sigctx *ds = (dsa_sigctx *)s; |
382 | G_DESTROY(ds->g.g, ds->g.p); |
383 | mp_drop(ds->g.u); |
384 | G_DESTROYGROUP(ds->g.g); |
ef13e9a4 |
385 | DESTROY(ds); |
5c3f75ec |
386 | } |
387 | |
388 | static const sigops dsa_sig = { |
389 | dh_privfetch, sizeof(dh_priv), |
390 | dsa_siginit, dsa_sigdoit, dsa_sigcheck, dsa_sigdestroy |
391 | }; |
392 | |
3688eb75 |
393 | static const sigops bindsa_sig = { |
394 | dh_privfetch, sizeof(dh_priv), |
395 | bindsa_siginit, dsa_sigdoit, dsa_sigcheck, dsa_sigdestroy |
396 | }; |
397 | |
5c3f75ec |
398 | static const sigops ecdsa_sig = { |
399 | ec_privfetch, sizeof(ec_priv), |
400 | ecdsa_siginit, dsa_sigdoit, dsa_sigcheck, dsa_sigdestroy |
401 | }; |
402 | |
403 | static sig *dsa_vrfinit(key *k, void *kd, const gchash *hc) |
404 | { |
405 | dh_pub *dp = kd; |
3688eb75 |
406 | dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_prime, "prime"); |
407 | return (&ds->s); |
408 | } |
409 | |
410 | static sig *bindsa_vrfinit(key *k, void *kd, const gchash *hc) |
411 | { |
412 | dh_pub *dp = kd; |
413 | dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_binary, "binary"); |
5c3f75ec |
414 | return (&ds->s); |
415 | } |
416 | |
417 | static sig *ecdsa_vrfinit(key *k, void *kd, const gchash *hc) |
418 | { |
419 | ec_pub *ep = kd; |
420 | dsa_sigctx *ds = ecdsa_doinit(k, ep->cstr, &ep->p, hc); |
421 | return (&ds->s); |
422 | } |
423 | |
424 | static int dsa_vrfdoit(sig *s, dstr *d) |
425 | { |
426 | dsa_sigctx *ds = (dsa_sigctx *)s; |
427 | gdsa_sig ss; |
428 | size_t n = d->len/2; |
429 | int rc; |
430 | |
431 | ss.r = mp_loadb(MP_NEW, d->buf, n); |
432 | ss.s = mp_loadb(MP_NEW, d->buf + n, d->len - n); |
433 | rc = gdsa_verify(&ds->g, &ss, GH_DONE(ds->s.h, 0)); |
434 | mp_drop(ss.r); mp_drop(ss.s); |
435 | return (rc); |
436 | } |
437 | |
438 | static const sigops dsa_vrf = { |
439 | dh_pubfetch, sizeof(dh_pub), |
440 | dsa_vrfinit, dsa_vrfdoit, dsa_sigcheck, dsa_sigdestroy |
441 | }; |
442 | |
3688eb75 |
443 | static const sigops bindsa_vrf = { |
444 | dh_pubfetch, sizeof(dh_pub), |
445 | bindsa_vrfinit, dsa_vrfdoit, dsa_sigcheck, dsa_sigdestroy |
446 | }; |
447 | |
5c3f75ec |
448 | static const sigops ecdsa_vrf = { |
449 | ec_pubfetch, sizeof(ec_pub), |
450 | ecdsa_vrfinit, dsa_vrfdoit, dsa_sigcheck, dsa_sigdestroy |
451 | }; |
452 | |
453 | /* --- KCDSA and ECKCDSA --- */ |
454 | |
455 | static void kcdsa_privkey(dsa_sigctx *ds, mp *x) |
456 | { ds->g.u = mp_modinv(MP_NEW, x, ds->g.g->r); } |
457 | |
458 | static void kcdsa_sethash(dsa_sigctx *ds, const gchash *hc) |
459 | { ds->s.h = gkcdsa_beginhash(&ds->g); } |
460 | |
461 | static sig *kcdsa_siginit(key *k, void *kd, const gchash *hc) |
462 | { |
463 | dh_priv *dp = kd; |
3688eb75 |
464 | dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_prime, "prime"); |
465 | kcdsa_privkey(ds, dp->x); |
466 | kcdsa_sethash(ds, hc); |
467 | return (&ds->s); |
468 | } |
469 | |
470 | static sig *binkcdsa_siginit(key *k, void *kd, const gchash *hc) |
471 | { |
472 | dh_priv *dp = kd; |
473 | dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_binary, "binary"); |
5c3f75ec |
474 | kcdsa_privkey(ds, dp->x); |
475 | kcdsa_sethash(ds, hc); |
476 | return (&ds->s); |
477 | } |
478 | |
479 | static sig *eckcdsa_siginit(key *k, void *kd, const gchash *hc) |
480 | { |
481 | ec_priv *ep = kd; |
482 | dsa_sigctx *ds = ecdsa_doinit(k, ep->cstr, &ep->p, hc); |
483 | kcdsa_privkey(ds, ep->x); |
484 | kcdsa_sethash(ds, hc); |
485 | return (&ds->s); |
486 | } |
487 | |
488 | static int kcdsa_sigdoit(sig *s, dstr *d) |
489 | { |
490 | dsa_sigctx *ds = (dsa_sigctx *)s; |
491 | gkcdsa_sig ss = GKCDSA_SIG_INIT; |
492 | size_t hsz = ds->g.h->hashsz, n = mp_octets(ds->g.g->r); |
493 | |
494 | gkcdsa_sign(&ds->g, &ss, GH_DONE(ds->s.h, 0), 0); |
495 | dstr_ensure(d, hsz + n); |
496 | memcpy(d->buf, ss.r, hsz); |
497 | mp_storeb(ss.s, d->buf + hsz, n); |
498 | d->len += hsz + n; |
499 | xfree(ss.r); mp_drop(ss.s); |
500 | return (0); |
501 | } |
502 | |
503 | static const sigops kcdsa_sig = { |
504 | dh_privfetch, sizeof(dh_priv), |
505 | kcdsa_siginit, kcdsa_sigdoit, dsa_sigcheck, dsa_sigdestroy |
506 | }; |
507 | |
3688eb75 |
508 | static const sigops binkcdsa_sig = { |
509 | dh_privfetch, sizeof(dh_priv), |
510 | binkcdsa_siginit, kcdsa_sigdoit, dsa_sigcheck, dsa_sigdestroy |
511 | }; |
512 | |
5c3f75ec |
513 | static const sigops eckcdsa_sig = { |
514 | ec_privfetch, sizeof(ec_priv), |
515 | eckcdsa_siginit, kcdsa_sigdoit, dsa_sigcheck, dsa_sigdestroy |
516 | }; |
517 | |
518 | static sig *kcdsa_vrfinit(key *k, void *kd, const gchash *hc) |
519 | { |
520 | dh_pub *dp = kd; |
3688eb75 |
521 | dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_prime, "prime"); |
522 | kcdsa_sethash(ds, hc); |
523 | return (&ds->s); |
524 | } |
525 | |
526 | static sig *binkcdsa_vrfinit(key *k, void *kd, const gchash *hc) |
527 | { |
528 | dh_pub *dp = kd; |
529 | dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_binary, "binary"); |
5c3f75ec |
530 | kcdsa_sethash(ds, hc); |
531 | return (&ds->s); |
532 | } |
533 | |
534 | static sig *eckcdsa_vrfinit(key *k, void *kd, const gchash *hc) |
535 | { |
536 | ec_pub *ep = kd; |
537 | dsa_sigctx *ds = ecdsa_doinit(k, ep->cstr, &ep->p, hc); |
538 | kcdsa_sethash(ds, hc); |
539 | return (&ds->s); |
540 | } |
541 | |
542 | static int kcdsa_vrfdoit(sig *s, dstr *d) |
543 | { |
544 | dsa_sigctx *ds = (dsa_sigctx *)s; |
545 | gkcdsa_sig ss; |
546 | size_t hsz = ds->g.h->hashsz, n = d->len - hsz; |
547 | int rc; |
548 | |
549 | if (d->len < hsz) |
550 | return (-1); |
551 | ss.r = (octet *)d->buf; |
552 | ss.s = mp_loadb(MP_NEW, d->buf + hsz, n); |
553 | rc = gkcdsa_verify(&ds->g, &ss, GH_DONE(ds->s.h, 0)); |
554 | mp_drop(ss.s); |
555 | return (rc); |
556 | } |
557 | |
558 | static const sigops kcdsa_vrf = { |
559 | dh_pubfetch, sizeof(dh_pub), |
560 | kcdsa_vrfinit, kcdsa_vrfdoit, dsa_sigcheck, dsa_sigdestroy |
561 | }; |
562 | |
3688eb75 |
563 | static const sigops binkcdsa_vrf = { |
564 | dh_pubfetch, sizeof(dh_pub), |
565 | binkcdsa_vrfinit, kcdsa_vrfdoit, dsa_sigcheck, dsa_sigdestroy |
566 | }; |
567 | |
5c3f75ec |
568 | static const sigops eckcdsa_vrf = { |
569 | ec_pubfetch, sizeof(ec_pub), |
570 | eckcdsa_vrfinit, kcdsa_vrfdoit, dsa_sigcheck, dsa_sigdestroy |
571 | }; |
572 | |
573 | /* --- The switch table --- */ |
574 | |
c65df279 |
575 | const struct sigtab sigtab[] = { |
5c3f75ec |
576 | { "rsapkcs1", &rsap1_sig, &rsap1_vrf, &sha }, |
577 | { "rsapss", &rsapss_sig, &rsapss_vrf, &sha }, |
578 | { "dsa", &dsa_sig, &dsa_vrf, &sha }, |
3688eb75 |
579 | { "bindsa", &bindsa_sig, &bindsa_vrf, &sha }, |
5c3f75ec |
580 | { "ecdsa", &ecdsa_sig, &ecdsa_vrf, &sha }, |
581 | { "kcdsa", &kcdsa_sig, &kcdsa_vrf, &has160 }, |
3688eb75 |
582 | { "binkcdsa", &binkcdsa_sig, &binkcdsa_vrf, &has160 }, |
5c3f75ec |
583 | { "eckcdsa", &eckcdsa_sig, &eckcdsa_vrf, &has160 }, |
584 | { 0, 0, 0 } |
585 | }; |
586 | |
587 | /* --- @getsig@ --- * |
588 | * |
589 | * Arguments: @key *k@ = the key to load |
590 | * @const char *app@ = application name |
591 | * @int wantpriv@ = nonzero if we want to sign |
592 | * |
593 | * Returns: A signature-making thing. |
594 | * |
595 | * Use: Loads a key and starts hashing. |
596 | */ |
597 | |
598 | sig *getsig(key *k, const char *app, int wantpriv) |
599 | { |
600 | const char *salg, *halg = 0; |
601 | dstr d = DSTR_INIT; |
602 | dstr t = DSTR_INIT; |
603 | char *p = 0; |
604 | const char *q; |
605 | sig *s; |
606 | size_t n; |
607 | const struct sigtab *st; |
608 | const sigops *so; |
609 | const gchash *ch; |
610 | void *kd; |
611 | int e; |
612 | key_packdef *kp; |
613 | |
614 | /* --- Setup stuff --- */ |
615 | |
616 | key_fulltag(k, &t); |
617 | |
618 | /* --- Get the signature algorithm --- * |
619 | * |
620 | * Take the attribute if it's there; otherwise use the key type. |
621 | */ |
622 | |
623 | n = strlen(app); |
624 | if ((q = key_getattr(0, k, "sig")) != 0) { |
625 | dstr_puts(&d, q); |
626 | p = d.buf; |
627 | } else if (strncmp(k->type, app, n) == 0 && k->type[n] == '-') { |
628 | dstr_puts(&d, k->type); |
629 | p = d.buf + n + 1; |
630 | } else |
631 | die(EXIT_FAILURE, "no signature algorithm for key `%s'", t.buf); |
632 | |
633 | /* --- Grab the hash algorithm --- * |
634 | * |
635 | * Grab it from the signature algorithm if it's there. But override that |
636 | * from the attribute. |
637 | */ |
638 | |
639 | salg = p; |
640 | if ((p = strchr(p, '/')) != 0) { |
641 | *p++ = 0; |
642 | halg = p; |
643 | } |
644 | if ((q = key_getattr(0, k, "hash")) != 0) |
645 | halg = q; |
646 | |
647 | /* --- Look up the algorithms in the table --- */ |
648 | |
649 | for (st = sigtab; st->name; st++) { |
650 | if (strcmp(st->name, salg) == 0) |
651 | goto s_found; |
652 | } |
653 | die(EXIT_FAILURE, "signature algorithm `%s' not found in key `%s'", |
654 | salg, t.buf); |
655 | s_found:; |
656 | if (!halg) |
657 | ch = st->ch; |
658 | else { |
659 | if ((ch = ghash_byname(halg)) == 0) { |
660 | die(EXIT_FAILURE, "hash algorithm `%s' not found in key `%s'", |
661 | halg, t.buf); |
662 | } |
663 | } |
664 | so = wantpriv ? st->signops : st->verifyops; |
665 | |
666 | /* --- Load the key --- */ |
667 | |
668 | kd = xmalloc(so->kdsz); |
669 | kp = key_fetchinit(so->kf, 0, kd); |
670 | if ((e = key_fetch(kp, k)) != 0) |
671 | die(EXIT_FAILURE, "error fetching key `%s': %s", t.buf, key_strerror(e)); |
672 | s = so->init(k, kd, ch); |
673 | if (!s->h) |
674 | s->h = GH_INIT(ch); |
675 | s->kp = kp; |
676 | s->ops = so; |
677 | s->kd = kd; |
678 | |
679 | /* --- Free stuff up --- */ |
680 | |
681 | dstr_destroy(&d); |
682 | dstr_destroy(&t); |
683 | return (s); |
684 | } |
685 | |
686 | /* --- @freesig@ --- * |
687 | * |
688 | * Arguments: @sig *s@ = signature-making thing |
689 | * |
690 | * Returns: --- |
691 | * |
692 | * Use: Frees up a signature-making thing |
693 | */ |
694 | |
695 | void freesig(sig *s) |
696 | { |
697 | GH_DESTROY(s->h); |
698 | key_fetchdone(s->kp); |
699 | xfree(s->kd); |
700 | s->ops->destroy(s); |
701 | } |
702 | |
703 | /*----- That's all, folks -------------------------------------------------*/ |