The spec is obviously insane.
rsa-priv.c rsa-pub.c rsa-gen.c rsa-recover.c rsa-fetch.c \
oaep.c pkcs1.c pss.c \
dh-gen.c dh-limlee.c dh-kcdsa.c dh-check.c dh-fetch.c dh-param.c \
- dsarand.c dsa-sign.c dsa-verify.c dsa-gen.c dsa-check.c \
+ dsarand.c dsa-misc.c dsa-sign.c dsa-verify.c dsa-gen.c dsa-check.c \
gdsa.c gkcdsa.c \
key-data.c key-flags.c key-text.c key-binary.c key-pass.c \
key-pack.c key-misc.c key-file.c key-attr.c key-io.c key-moan.c \
--- /dev/null
+/* -*-c-*-
+ *
+ * Useful functions for doing DSA
+ *
+ * (c) 2008 Straylight/Edgeware
+ */
+
+/*----- Licensing notice --------------------------------------------------*
+ *
+ * This file is part of Catacomb.
+ *
+ * Catacomb is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Library General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * Catacomb is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public
+ * License along with Catacomb; if not, write to the Free
+ * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
+ * MA 02111-1307, USA.
+ */
+
+/*----- Header files ------------------------------------------------------*/
+
+#include "dsa.h"
+
+/*----- Main code ---------------------------------------------------------*/
+
+/* --- @dsa_h2n@ --- *
+ *
+ * Arguments: @mp *d@ = destination integer
+ * @mp *r@ = order of the DSA group
+ * @const void *h@ = pointer to message hash
+ * @size_t hsz@ = size (in bytes) of the hash output
+ *
+ * Returns: Resulting integer.
+ *
+ * Use: Converts a hash to an integer in the demented way necessary
+ * for DSA/ECDSA. This is, of course, completely insane, but
+ * there you go.
+ */
+
+mp *dsa_h2n(mp *d, mp *r, const void *h, size_t hsz)
+{
+ size_t n = mp_bits(r);
+ size_t l = hsz;
+ size_t s = 0;
+
+ if (n < 8*l) {
+ l = (n + 7)/8;
+ s = 8*l - n;
+ }
+ d = mp_loadb(d, h, l);
+ if (s)
+ d = mp_lsr(d, d, s);
+ return (d);
+}
+
+/*----- That's all, folks -------------------------------------------------*/
const void *m, size_t msz, const void *k, size_t ksz,
void *r, size_t rsz, void *s, size_t ssz)
{
- mp *mm = mp_loadb(MP_NEW, m, msz);
+ mp *mm = dsa_h2n(MP_NEW, dp->q, m, msz);
mp *km = mp_loadb(MP_NEW, k, ksz);
mp *rm = MP_NEW, *sm = MP_NEW;
dsa_mksig(dp, a, mm, km, &rm, &sm);
const void *r, size_t rsz,
const void *s, size_t ssz)
{
- mp *mm = mp_loadb(MP_NEW, m, msz);
+ mp *mm = dsa_h2n(MP_NEW, dp->q, m, msz);
mp *rm = mp_loadb(MP_NEW, r, rsz);
mp *sm = mp_loadb(MP_NEW, s, ssz);
int ok = dsa_vrfy(dp, y, mm, rm, sm);
extern int dsa_checkparam(keycheck */*kc*/, const dsa_param */*dp*/,
const dsa_seed */*ds*/);
+/* --- @dsa_h2n@ --- *
+ *
+ * Arguments: @mp *d@ = destination integer
+ * @mp *r@ = order of the DSA group
+ * @const void *h@ = pointer to message hash
+ * @size_t hsz@ = size (in bytes) of the hash output
+ *
+ * Returns: Resulting integer.
+ *
+ * Use: Converts a hash to an integer in the demented way necessary
+ * for DSA/ECDSA. This is, of course, completely insane, but
+ * there you go.
+ */
+
+extern mp *dsa_h2n(mp */*d*/, mp */*r*/, const void */*h*/, size_t /*hsz*/);
+
/* --- @dsa_mksig@ --- *
*
* Arguments: @const dsa_param *dp@ = pointer to DSA parameters
void gdsa_sign(const gdsa *c, gdsa_sig *s, const void *m, mp *k)
{
group *g = c->g;
- mp *mr = mp_loadb(MP_NEW, m, c->h->hashsz);
+ mp *mr = dsa_h2n(MP_NEW, g->r, m, c->h->hashsz);
ge *z = G_CREATE(g);
mp *sr = s->r, *ss = s->s;
mpbarrett b;
return (-1);
mpbarrett_create(&b, g->r); h = mp_modinv(MP_NEW, s->s, g->r);
e[0].base = g->g; e[1].base = c->p;
- t = mp_loadb(MP_NEW, m, c->h->hashsz); mp_div(0, &t, t, g->r);
+ t = dsa_h2n(MP_NEW, g->r, m, c->h->hashsz); mp_div(0, &t, t, g->r);
t = mp_mul(t, t, h); e[0].exp = t = mpbarrett_reduce(&b, t, t);
h = mp_mul(h, s->r, h); e[1].exp = h = mpbarrett_reduce(&b, h, h);
w = G_CREATE(g); G_MEXP(g, w, e, 2);
0x8d68905434b020ccb849e17a03a5c441d2a104aaf523699c1cc7a93174d21d9c
0xb30f954bfb624041e56f09ece884c17c74f866c24149bba0712303a9530142a6
0x1076bd32f298aaffa8c6242d881d928b1c4e0f5ad7e8ce3c4d815fe348a9666a;
+
+ # --- Test for over-long hash ---
+
+ "ec { sect131r1 }" sha
+ 0x85bd9fd28a7e7f915891208fbb2b05c0
+ "An example message"
+ 0xee98d38c001731403af6fbf77356f8ea
+ 0x1cba36e768c0247d537a744b7ea62e3b9
+ 0x216e5d02a0b1fb11d6d2fc4b383dcb168;
}
verify {
0xb30f954bfb624041e56f09ece884c17c74f866c24149bba0712303a9530142a6
0x1076bd32f298aaffa8c6242d881d928b1c4e0f5ad7e8ce3c4d815fe348a9666a
0;
+
+ # --- Test for over-long hash ---
+
+ "ec { sect131r1 }" sha
+ "0x2218ba2b57a7821be97c0015b797d82fe, 0x666aed14fd7a2abf867c6fa222ab26fcc"
+ "An example message"
+ 0x1cba36e768c0247d537a744b7ea62e3b9
+ 0x216e5d02a0b1fb11d6d2fc4b383dcb168
+ 0;
+
+ "ec { sect131r1 }" sha
+ "0x2218ba2b57a7821be97c0015b797d82fe, 0x666aed14fd7a2abf867c6fa222ab26fcc"
+ "An example messag"
+ 0x1cba36e768c0247d537a744b7ea62e3b9
+ 0x216e5d02a0b1fb11d6d2fc4b383dcb168
+ -1;
+
+ "ec { nist-b163 }" sha512
+ "0x385a32536d1cb46d10cf3034a3dd39eb25e4f5123,
+ 0x29ee1edfa37d0f306c4da17b8d883f01ce3be4d46"
+ "qpwmoeqpofaosdaspdpqoweopdoagnqornifnasd"
+ 0x0231b6a807f6af1aee0598768b3fabb863d14a7f8d
+ 0x01c2f638e9dffe03b562e48ca4e1a380cf8c3055f1
+ 0;
}