gdsa: Fix the conversion of hashes to integers to conform to the spec.

The spec is obviously insane.

diff --git a/Makefile.m4 b/Makefile.m4
index 5d5420a..812d210 100644 (file)
--- a/Makefile.m4
+++ b/Makefile.m4
@@ -230,7 +230,7 @@ define(`PGEN_SOURCES',
        rsa-priv.c rsa-pub.c rsa-gen.c rsa-recover.c rsa-fetch.c \
        oaep.c pkcs1.c pss.c \
        dh-gen.c dh-limlee.c dh-kcdsa.c dh-check.c dh-fetch.c dh-param.c \
-       dsarand.c dsa-sign.c dsa-verify.c dsa-gen.c dsa-check.c \
+       dsarand.c dsa-misc.c dsa-sign.c dsa-verify.c dsa-gen.c dsa-check.c \
        gdsa.c gkcdsa.c \
        key-data.c key-flags.c key-text.c key-binary.c key-pass.c \
        key-pack.c key-misc.c key-file.c key-attr.c key-io.c key-moan.c \

diff --git a/dsa-misc.c b/dsa-misc.c
new file mode 100644 (file)
index 0000000..4d8bc2a
--- /dev/null
+++ b/dsa-misc.c
@@ -0,0 +1,64 @@
+/* -*-c-*-
+ *
+ * Useful functions for doing DSA
+ *
+ * (c) 2008 Straylight/Edgeware
+ */
+
+/*----- Licensing notice --------------------------------------------------*
+ *
+ * This file is part of Catacomb.
+ *
+ * Catacomb is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Library General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * Catacomb is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public
+ * License along with Catacomb; if not, write to the Free
+ * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
+ * MA 02111-1307, USA.
+ */
+
+/*----- Header files ------------------------------------------------------*/
+
+#include "dsa.h"
+
+/*----- Main code ---------------------------------------------------------*/
+
+/* --- @dsa_h2n@ --- *
+ *
+ * Arguments:  @mp *d@ = destination integer
+ *             @mp *r@ = order of the DSA group
+ *             @const void *h@ = pointer to message hash
+ *             @size_t hsz@ = size (in bytes) of the hash output
+ *
+ * Returns:    Resulting integer.
+ *
+ * Use:                Converts a hash to an integer in the demented way necessary
+ *             for DSA/ECDSA.  This is, of course, completely insane, but
+ *             there you go.
+ */
+
+mp *dsa_h2n(mp *d, mp *r, const void *h, size_t hsz)
+{
+  size_t n = mp_bits(r);
+  size_t l = hsz;
+  size_t s = 0;
+
+  if (n < 8*l) {
+    l = (n + 7)/8;
+    s = 8*l - n;
+  }
+  d = mp_loadb(d, h, l);
+  if (s)
+    d = mp_lsr(d, d, s);
+  return (d);
+}
+
+/*----- That's all, folks -------------------------------------------------*/

diff --git a/dsa-sign.c b/dsa-sign.c
index c4117bc..9d30dd9 100644 (file)
--- a/dsa-sign.c
+++ b/dsa-sign.c
@@ -106,7 +106,7 @@ void dsa_sign(dsa_param *dp, mp *a,
              const void *m, size_t msz, const void *k, size_t ksz,
              void *r, size_t rsz, void *s, size_t ssz)
 {
-  mp *mm = mp_loadb(MP_NEW, m, msz);
+  mp *mm = dsa_h2n(MP_NEW, dp->q, m, msz);
   mp *km = mp_loadb(MP_NEW, k, ksz);
   mp *rm = MP_NEW, *sm = MP_NEW;
   dsa_mksig(dp, a, mm, km, &rm, &sm);

diff --git a/dsa-verify.c b/dsa-verify.c
index ec40b27..90895b4 100644 (file)
--- a/dsa-verify.c
+++ b/dsa-verify.c
@@ -119,7 +119,7 @@ int dsa_verify(const dsa_param *dp, mp *y,
               const void *r, size_t rsz,
               const void *s, size_t ssz)
 {
-  mp *mm = mp_loadb(MP_NEW, m, msz);
+  mp *mm = dsa_h2n(MP_NEW, dp->q, m, msz);
   mp *rm = mp_loadb(MP_NEW, r, rsz);
   mp *sm = mp_loadb(MP_NEW, s, ssz);
   int ok = dsa_vrfy(dp, y, mm, rm, sm);

diff --git a/dsa.h b/dsa.h
index 3cd65f5..43ff845 100644 (file)
--- a/dsa.h
+++ b/dsa.h
@@ -176,6 +176,22 @@ extern int dsa_gen(dsa_param */*dp*/, unsigned /*ql*/, unsigned /*pl*/,
 extern int dsa_checkparam(keycheck */*kc*/, const dsa_param */*dp*/,
                          const dsa_seed */*ds*/);
 
+/* --- @dsa_h2n@ --- *
+ *
+ * Arguments:  @mp *d@ = destination integer
+ *             @mp *r@ = order of the DSA group
+ *             @const void *h@ = pointer to message hash
+ *             @size_t hsz@ = size (in bytes) of the hash output
+ *
+ * Returns:    Resulting integer.
+ *
+ * Use:                Converts a hash to an integer in the demented way necessary
+ *             for DSA/ECDSA.  This is, of course, completely insane, but
+ *             there you go.
+ */
+
+extern mp *dsa_h2n(mp */*d*/, mp */*r*/, const void */*h*/, size_t /*hsz*/);
+
 /* --- @dsa_mksig@ --- *
  *
  * Arguments:  @const dsa_param *dp@ = pointer to DSA parameters

diff --git a/gdsa.c b/gdsa.c
index 10f6b6d..83f4d06 100644 (file)
--- a/gdsa.c
+++ b/gdsa.c
@@ -79,7 +79,7 @@ void gdsa_endhash(const gdsa *c, ghash *h) { ; }
 void gdsa_sign(const gdsa *c, gdsa_sig *s, const void *m, mp *k)
 {
   group *g = c->g;
-  mp *mr = mp_loadb(MP_NEW, m, c->h->hashsz);
+  mp *mr = dsa_h2n(MP_NEW, g->r, m, c->h->hashsz);
   ge *z = G_CREATE(g);
   mp *sr = s->r, *ss = s->s;
   mpbarrett b;
@@ -128,7 +128,7 @@ int gdsa_verify(const gdsa *c, const gdsa_sig *s, const void *m)
     return (-1);
   mpbarrett_create(&b, g->r); h = mp_modinv(MP_NEW, s->s, g->r);
   e[0].base = g->g; e[1].base = c->p;
-  t = mp_loadb(MP_NEW, m, c->h->hashsz); mp_div(0, &t, t, g->r);
+  t = dsa_h2n(MP_NEW, g->r, m, c->h->hashsz); mp_div(0, &t, t, g->r);
   t = mp_mul(t, t, h); e[0].exp = t = mpbarrett_reduce(&b, t, t);
   h = mp_mul(h, s->r, h); e[1].exp = h = mpbarrett_reduce(&b, h, h);
   w = G_CREATE(g); G_MEXP(g, w, e, 2);

diff --git a/tests/gdsa b/tests/gdsa
index 6627d47..45df0b3 100644 (file)
--- a/tests/gdsa
+++ b/tests/gdsa
@@ -82,6 +82,15 @@ sign {
   0x8d68905434b020ccb849e17a03a5c441d2a104aaf523699c1cc7a93174d21d9c
   0xb30f954bfb624041e56f09ece884c17c74f866c24149bba0712303a9530142a6
   0x1076bd32f298aaffa8c6242d881d928b1c4e0f5ad7e8ce3c4d815fe348a9666a;
+
+  # --- Test for over-long hash ---
+
+  "ec { sect131r1 }" sha
+  0x85bd9fd28a7e7f915891208fbb2b05c0
+  "An example message"
+  0xee98d38c001731403af6fbf77356f8ea
+  0x1cba36e768c0247d537a744b7ea62e3b9
+  0x216e5d02a0b1fb11d6d2fc4b383dcb168;
 }
 
 verify {
@@ -206,4 +215,28 @@ verify {
   0xb30f954bfb624041e56f09ece884c17c74f866c24149bba0712303a9530142a6
   0x1076bd32f298aaffa8c6242d881d928b1c4e0f5ad7e8ce3c4d815fe348a9666a
   0;
+
+  # --- Test for over-long hash ---
+
+  "ec { sect131r1 }" sha
+  "0x2218ba2b57a7821be97c0015b797d82fe, 0x666aed14fd7a2abf867c6fa222ab26fcc"
+  "An example message"
+  0x1cba36e768c0247d537a744b7ea62e3b9
+  0x216e5d02a0b1fb11d6d2fc4b383dcb168
+  0;
+
+  "ec { sect131r1 }" sha
+  "0x2218ba2b57a7821be97c0015b797d82fe, 0x666aed14fd7a2abf867c6fa222ab26fcc"
+  "An example messag"
+  0x1cba36e768c0247d537a744b7ea62e3b9
+  0x216e5d02a0b1fb11d6d2fc4b383dcb168
+  -1;
+
+  "ec { nist-b163 }" sha512
+  "0x385a32536d1cb46d10cf3034a3dd39eb25e4f5123,
+    0x29ee1edfa37d0f306c4da17b8d883f01ce3be4d46"
+  "qpwmoeqpofaosdaspdpqoweopdoagnqornifnasd"
+  0x0231b6a807f6af1aee0598768b3fabb863d14a7f8d
+  0x01c2f638e9dffe03b562e48ca4e1a380cf8c3055f1
+  0;
 }