+static int rsapss_sigdoit(sig *s, dstr *d)
+{
+ rsapss_sigctx *rs = (rsapss_sigctx *)s;
+ size_t n;
+ mp *m = rsa_sign(&rs->rp, MP_NEW,
+ GH_DONE(s->h, 0), GH_CLASS(s->h)->hashsz,
+ pss_encode, &rs->p);
+ if (!m) return (-1);
+ n = mp_octets(rs->rp.rp->n); dstr_ensure(d, n); mp_storeb(m, d->buf, n);
+ d->len += n; mp_drop(m);
+ return (0);
+}
+
+static void rsapss_sigdestroy(sig *s)
+{
+ rsapss_sigctx *rs = (rsapss_sigctx *)s;
+ DESTROY(rs);
+}
+
+static const sigops rsapss_sig = {
+ rsa_privfetch, sizeof(rsa_priv),
+ rsapss_siginit, rsapss_sigdoit, rsapss_sigdestroy
+};
+
+typedef struct rsapss_vrfctx {
+ sig s;
+ rsa_pubctx rp;
+ pss p;
+} rsapss_vrfctx;
+
+static sig *rsapss_vrfinit(key *k, void *kd, const gchash *hc)
+{
+ rsapss_vrfctx *rv = CREATE(rsapss_vrfctx);
+ rsa_pubcreate(&rv->rp, kd);
+ rv->p.r = &rand_global;
+ rv->p.cc = getmgf(k, hc);
+ rv->p.ch = hc;
+ rv->p.ssz = hc->hashsz;
+ return (&rv->s);
+}
+
+static int rsapss_vrfdoit(sig *s, dstr *d)
+{
+ rsapss_vrfctx *rv = (rsapss_vrfctx *)s;
+ mp *m = mp_loadb(MP_NEW, d->buf, d->len);
+ int rc = rsa_verify(&rv->rp, m,
+ GH_DONE(s->h, 0), GH_CLASS(s->h)->hashsz,
+ 0, pss_decode, &rv->p);
+ mp_drop(m);
+ return (rc);
+}
+
+static void rsapss_vrfdestroy(sig *s)
+{
+ rsapss_vrfctx *rv = (rsapss_vrfctx *)s;
+ DESTROY(rv);
+}
+
+static const sigops rsapss_vrf = {
+ rsa_pubfetch, sizeof(rsa_pub),
+ rsapss_vrfinit, rsapss_vrfdoit, rsapss_vrfdestroy
+};
+
+/* --- DSA and ECDSA --- */
+
+typedef struct dsa_sigctx {
+ sig s;
+ gdsa g;
+} dsa_sigctx;
+
+static dsa_sigctx *dsa_doinit(key *k, const gprime_param *gp,
+ mp *y, const gchash *hc)
+{
+ dsa_sigctx *ds = CREATE(dsa_sigctx);
+ dstr t = DSTR_INIT;
+
+ key_fulltag(k, &t);
+ if ((ds->g.g = group_prime(gp)) == 0)
+ die(EXIT_FAILURE, "bad prime group in key `%s'", t.buf);
+ ds->g.u = MP_NEW;
+ ds->g.p = G_CREATE(ds->g.g);
+ if (G_FROMINT(ds->g.g, ds->g.p, y))
+ die(EXIT_FAILURE, "bad public key in key `%s'", t.buf);
+ ds->g.r = &rand_global;
+ ds->g.h = hc;
+ ds->s.h = 0;
+ dstr_destroy(&t);
+ return (ds);
+}
+
+static dsa_sigctx *ecdsa_doinit(key *k, const char *cstr,
+ ec *y, const gchash *hc)
+{
+ dsa_sigctx *ds = CREATE(dsa_sigctx);
+ ec_info ei;
+ const char *e;
+ dstr t = DSTR_INIT;
+
+ key_fulltag(k, &t);
+ if ((e = ec_getinfo(&ei, cstr)) != 0)
+ die(EXIT_FAILURE, "bad curve in key `%s': %s", t.buf, e);
+ ds->g.g = group_ec(&ei);
+ ds->g.u = MP_NEW;
+ ds->g.p = G_CREATE(ds->g.g);
+ if (G_FROMEC(ds->g.g, ds->g.p, y))
+ die(EXIT_FAILURE, "bad public key in key `%s'", t.buf);
+ ds->g.r = &rand_global;
+ ds->g.h = hc;
+ ds->s.h = 0;
+ dstr_destroy(&t);
+ return (ds);
+}
+
+static sig *dsa_siginit(key *k, void *kd, const gchash *hc)
+{
+ dh_priv *dp = kd;
+ dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc);
+ ds->g.u = MP_COPY(dp->x);
+ return (&ds->s);
+}
+
+static sig *ecdsa_siginit(key *k, void *kd, const gchash *hc)
+{
+ ec_priv *ep = kd;
+ dsa_sigctx *ds = ecdsa_doinit(k, ep->cstr, &ep->p, hc);
+ ds->g.u = MP_COPY(ep->x);
+ return (&ds->s);
+}
+
+static int dsa_sigdoit(sig *s, dstr *d)
+{
+ dsa_sigctx *ds = (dsa_sigctx *)s;
+ gdsa_sig ss = GDSA_SIG_INIT;
+ size_t n = mp_octets(ds->g.g->r);
+
+ gdsa_sign(&ds->g, &ss, GH_DONE(ds->s.h, 0), 0);
+ dstr_ensure(d, 2 * n);
+ mp_storeb(ss.r, d->buf, n);
+ mp_storeb(ss.s, d->buf + n, n);
+ d->len += 2 * n;
+ mp_drop(ss.r); mp_drop(ss.s);
+ return (0);
+}
+
+static void dsa_sigdestroy(sig *s)
+{
+ dsa_sigctx *ds = (dsa_sigctx *)s;
+ G_DESTROY(ds->g.g, ds->g.p);
+ mp_drop(ds->g.u);
+ G_DESTROYGROUP(ds->g.g);
+}
+
+static const sigops dsa_sig = {
+ dh_privfetch, sizeof(dh_priv),
+ dsa_siginit, dsa_sigdoit, dsa_sigdestroy
+};
+
+static const sigops ecdsa_sig = {
+ ec_privfetch, sizeof(ec_priv),
+ ecdsa_siginit, dsa_sigdoit, dsa_sigdestroy
+};
+
+static sig *dsa_vrfinit(key *k, void *kd, const gchash *hc)
+{
+ dh_pub *dp = kd;
+ dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc);
+ return (&ds->s);
+}
+
+static sig *ecdsa_vrfinit(key *k, void *kd, const gchash *hc)
+{
+ ec_pub *ep = kd;
+ dsa_sigctx *ds = ecdsa_doinit(k, ep->cstr, &ep->p, hc);
+ return (&ds->s);
+}
+
+static int dsa_vrfdoit(sig *s, dstr *d)
+{
+ dsa_sigctx *ds = (dsa_sigctx *)s;
+ gdsa_sig ss;
+ size_t n = d->len/2;
+ int rc;
+
+ ss.r = mp_loadb(MP_NEW, d->buf, n);
+ ss.s = mp_loadb(MP_NEW, d->buf + n, d->len - n);
+ rc = gdsa_verify(&ds->g, &ss, GH_DONE(ds->s.h, 0));
+ mp_drop(ss.r); mp_drop(ss.s);
+ return (rc);
+}
+
+static const sigops dsa_vrf = {
+ dh_pubfetch, sizeof(dh_pub),
+ dsa_vrfinit, dsa_vrfdoit, dsa_sigdestroy