[catacomb] / progs / cc-sig.c

/* -*-c-*-
 *
 * Catcrypt signatures
 *
 * (c) 2004 Straylight/Edgeware
 */

/*----- Licensing notice --------------------------------------------------*
 *
 * This file is part of Catacomb.
 *
 * Catacomb is free software; you can redistribute it and/or modify
 * it under the terms of the GNU Library General Public License as
 * published by the Free Software Foundation; either version 2 of the
 * License, or (at your option) any later version.
 *
 * Catacomb is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU Library General Public License for more details.
 *
 * You should have received a copy of the GNU Library General Public
 * License along with Catacomb; if not, write to the Free
 * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
 * MA 02111-1307, USA.
 */

/*----- Header files ------------------------------------------------------*/

#define _FILE_OFFSET_BITS 64

#include <stdlib.h>

#include <mLib/report.h>

#include "rand.h"
#include "sha.h"
#include "has160.h"

#include "ec.h"
#include "ec-keys.h"
#include "dh.h"
#include "gdsa.h"
#include "gkcdsa.h"
#include "rsa.h"

#include "cc.h"

/*----- Main code ---------------------------------------------------------*/

/* --- RSA PKCS1 --- */

typedef struct rsap1_sigctx {
  sig s;
  rsa_privctx rp;
  pkcs1 p1;
} rsap1_sigctx;

static sig *rsap1_siginit(key *k, void *kd, const gchash *hc)
{
  rsap1_sigctx *rs = CREATE(rsap1_sigctx);
  rsa_privcreate(&rs->rp, kd, &rand_global);
  rs->p1.r = &rand_global;
  rs->p1.ep = hc->name;
  rs->p1.epsz = strlen(hc->name) + 1;
  rs->s.h = 0;
  return (&rs->s);
}

static int rsap1_sigdoit(sig *s, dstr *d)
{
  rsap1_sigctx *rs = (rsap1_sigctx *)s;
  size_t n;
  mp *m = rsa_sign(&rs->rp, MP_NEW,
		   GH_DONE(s->h, 0), GH_CLASS(s->h)->hashsz,
		   pkcs1_sigencode, &rs->p1);
  if (!m) return (-1);
  n = mp_octets(rs->rp.rp->n); dstr_ensure(d, n); mp_storeb(m, d->buf, n);
  d->len += n; mp_drop(m);
  return (0);
}

static const char *rsa_lengthcheck(mp *n)
{
  if (mp_bits(n) < 1024) return ("key too short");
  return (0);
}

static const char *rsap1_sigcheck(sig *s)
{
  rsap1_sigctx *rs = (rsap1_sigctx *)s;
  const char *e;
  if ((e = rsa_lengthcheck(rs->rp.rp->n)) != 0) return (e);
  return (0);
}

static void rsap1_sigdestroy(sig *s)
{
  rsap1_sigctx *rs = (rsap1_sigctx *)s;
  rsa_privdestroy(&rs->rp);
  DESTROY(rs);
}

static const sigops rsap1_sig = {
  rsa_privfetch, sizeof(rsa_priv),
  rsap1_siginit, rsap1_sigdoit, rsap1_sigcheck, rsap1_sigdestroy
};

typedef struct rsap1_vrfctx {
  sig s;
  rsa_pubctx rp;
  pkcs1 p1;
} rsap1_vrfctx;

static sig *rsap1_vrfinit(key *k, void *kd, const gchash *hc)
{
  rsap1_vrfctx *rv = CREATE(rsap1_vrfctx);
  rsa_pubcreate(&rv->rp, kd);
  rv->p1.r = &rand_global;
  rv->p1.ep = hc->name;
  rv->p1.epsz = strlen(hc->name) + 1;
  rv->s.h = 0;
  return (&rv->s);
}

static int rsap1_vrfdoit(sig *s, dstr *d)
{
  rsap1_vrfctx *rv = (rsap1_vrfctx *)s;
  mp *m = mp_loadb(MP_NEW, d->buf, d->len);
  int rc = rsa_verify(&rv->rp, m,
		      GH_DONE(s->h, 0), GH_CLASS(s->h)->hashsz,
		      0, pkcs1_sigdecode, &rv->p1);
  mp_drop(m);
  return (rc);
}

static const char *rsap1_vrfcheck(sig *s)
{
  rsap1_vrfctx *rv = (rsap1_vrfctx *)s;
  const char *e;
  if ((e = rsa_lengthcheck(rv->rp.rp->n)) != 0) return (e);
  return (0);
}

static void rsap1_vrfdestroy(sig *s)
{
  rsap1_vrfctx *rv = (rsap1_vrfctx *)s;
  rsa_pubdestroy(&rv->rp);
  DESTROY(rv);
}

static const sigops rsap1_vrf = {
  rsa_pubfetch, sizeof(rsa_pub),
  rsap1_vrfinit, rsap1_vrfdoit, rsap1_vrfcheck, rsap1_vrfdestroy
};

/* --- RSA PSS --- */

static const gccipher *getmgf(key *k, const gchash *hc)
{
  dstr d = DSTR_INIT;
  const gccipher *gc;
  const char *mm;

  if ((mm = key_getattr(0, k, "mgf")) == 0) {
    dstr_putf(&d, "%s-mgf", hc->name);
    mm = d.buf;
  }
  if ((gc = gcipher_byname(mm)) == 0)
    die(EXIT_FAILURE, "unknown encryption scheme `%s'", mm);
  dstr_destroy(&d);
  return (gc);
}

typedef struct rsapss_sigctx {
  sig s;
  rsa_privctx rp;
  pss p;
} rsapss_sigctx;

static sig *rsapss_siginit(key *k, void *kd, const gchash *hc)
{
  rsapss_sigctx *rs = CREATE(rsapss_sigctx);
  rsa_privcreate(&rs->rp, kd, &rand_global);
  rs->s.h = 0;
  rs->p.r = &rand_global;
  rs->p.cc = getmgf(k, hc);
  rs->p.ch = hc;
  rs->p.ssz = hc->hashsz;
  return (&rs->s);
}

static int rsapss_sigdoit(sig *s, dstr *d)
{
  rsapss_sigctx *rs = (rsapss_sigctx *)s;
  size_t n;
  mp *m = rsa_sign(&rs->rp, MP_NEW,
		   GH_DONE(s->h, 0), GH_CLASS(s->h)->hashsz,
		   pss_encode, &rs->p);
  if (!m) return (-1);
  n = mp_octets(rs->rp.rp->n); dstr_ensure(d, n); mp_storeb(m, d->buf, n);
  d->len += n;	mp_drop(m);
  return (0);
}

static const char *rsapss_sigcheck(sig *s)
{
  rsapss_sigctx *rs = (rsapss_sigctx *)s;
  const char *e;
  if ((e = rsa_lengthcheck(rs->rp.rp->n)) != 0) return (e);
  return (0);
}

static void rsapss_sigdestroy(sig *s)
{
  rsapss_sigctx *rs = (rsapss_sigctx *)s;
  rsa_privdestroy(&rs->rp);
  DESTROY(rs);
}

static const sigops rsapss_sig = {
  rsa_privfetch, sizeof(rsa_priv),
  rsapss_siginit, rsapss_sigdoit, rsapss_sigcheck, rsapss_sigdestroy
};

typedef struct rsapss_vrfctx {
  sig s;
  rsa_pubctx rp;
  pss p;
} rsapss_vrfctx;

static sig *rsapss_vrfinit(key *k, void *kd, const gchash *hc)
{
  rsapss_vrfctx *rv = CREATE(rsapss_vrfctx);
  rsa_pubcreate(&rv->rp, kd);
  rv->s.h = 0;
  rv->p.r = &rand_global;
  rv->p.cc = getmgf(k, hc);
  rv->p.ch = hc;
  rv->p.ssz = hc->hashsz;
  return (&rv->s);
}

static int rsapss_vrfdoit(sig *s, dstr *d)
{
  rsapss_vrfctx *rv = (rsapss_vrfctx *)s;
  mp *m = mp_loadb(MP_NEW, d->buf, d->len);
  int rc = rsa_verify(&rv->rp, m,
		      GH_DONE(s->h, 0), GH_CLASS(s->h)->hashsz,
		      0, pss_decode, &rv->p);
  mp_drop(m);
  return (rc);
}

static const char *rsapss_vrfcheck(sig *s)
{
  rsapss_vrfctx *rv = (rsapss_vrfctx *)s;
  const char *e;
  if ((e = rsa_lengthcheck(rv->rp.rp->n)) != 0) return (e);
  return (0);
}

static void rsapss_vrfdestroy(sig *s)
{
  rsapss_vrfctx *rv = (rsapss_vrfctx *)s;
  rsa_pubdestroy(&rv->rp);
  DESTROY(rv);
}

static const sigops rsapss_vrf = {
  rsa_pubfetch, sizeof(rsa_pub),
  rsapss_vrfinit, rsapss_vrfdoit, rsapss_vrfcheck, rsapss_vrfdestroy
};

/* --- DSA and ECDSA --- */

typedef struct dsa_sigctx {
  sig s;
  gdsa g;
} dsa_sigctx;

static void dsa_initcommon(dsa_sigctx *ds, const gchash *hc,
			   const char *ktag)
{
  ds->g.r = &rand_global;
  ds->g.h = hc;
  ds->g.u = MP_NEW;
  ds->s.h = 0;
}

static dsa_sigctx *dsa_doinit(key *k, const gprime_param *gp,
			      mp *y, const gchash *hc,
			      group *(*makegroup)(const gprime_param *),
			      const char *what)
{
  dsa_sigctx *ds = CREATE(dsa_sigctx);
  dstr t = DSTR_INIT;

  key_fulltag(k, &t);
  if ((ds->g.g = makegroup(gp)) == 0)
    die(EXIT_FAILURE, "bad %s group in key `%s'", what, t.buf);
  ds->g.p = G_CREATE(ds->g.g);
  if (G_FROMINT(ds->g.g, ds->g.p, y))
    die(EXIT_FAILURE, "bad public key in key `%s'", t.buf);
  dsa_initcommon(ds, hc, t.buf);
  dstr_destroy(&t);
  return (ds);
}

static dsa_sigctx *ecdsa_doinit(key *k, const char *cstr,
				ec *y, const gchash *hc)
{
  dsa_sigctx *ds = CREATE(dsa_sigctx);
  ec_info ei;
  const char *e;
  dstr t = DSTR_INIT;

  key_fulltag(k, &t);
  if ((e = ec_getinfo(&ei, cstr)) != 0)
    die(EXIT_FAILURE, "bad curve in key `%s': %s", t.buf, e);
  ds->g.g = group_ec(&ei);
  ds->g.p = G_CREATE(ds->g.g);
  if (G_FROMEC(ds->g.g, ds->g.p, y))
    die(EXIT_FAILURE, "bad public key in key `%s'", t.buf);
  dsa_initcommon(ds, hc, t.buf);
  dstr_destroy(&t);
  return (ds);
}

static sig *dsa_siginit(key *k, void *kd, const gchash *hc)
{
  dh_priv *dp = kd;
  dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_prime, "prime");
  ds->g.u = MP_COPY(dp->x);
  return (&ds->s);
}

static sig *bindsa_siginit(key *k, void *kd, const gchash *hc)
{
  dh_priv *dp = kd;
  dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_binary, "binary");
  ds->g.u = MP_COPY(dp->x);
  return (&ds->s);
}

static sig *ecdsa_siginit(key *k, void *kd, const gchash *hc)
{
  ec_priv *ep = kd;
  dsa_sigctx *ds = ecdsa_doinit(k, ep->cstr, &ep->p, hc);
  ds->g.u = MP_COPY(ep->x);
  return (&ds->s);
}

static int dsa_sigdoit(sig *s, dstr *d)
{
  dsa_sigctx *ds = (dsa_sigctx *)s;
  gdsa_sig ss = GDSA_SIG_INIT;
  size_t n = mp_octets(ds->g.g->r);

  gdsa_sign(&ds->g, &ss, GH_DONE(ds->s.h, 0), 0);
  dstr_ensure(d, 2 * n);
  mp_storeb(ss.r, d->buf, n);
  mp_storeb(ss.s, d->buf + n, n);
  d->len += 2 * n;
  mp_drop(ss.r); mp_drop(ss.s);
  return (0);
}

static const char *dsa_sigcheck(sig *s)
{
  dsa_sigctx *ds = (dsa_sigctx *)s;
  const char *e;
  if ((e = G_CHECK(ds->g.g, &rand_global)) != 0)
    return (0);
  if (group_check(ds->g.g, ds->g.p))
    return ("public key not in subgroup");
  return (0);
}

static void dsa_sigdestroy(sig *s)
{
  dsa_sigctx *ds = (dsa_sigctx *)s;
  G_DESTROY(ds->g.g, ds->g.p);
  mp_drop(ds->g.u);
  G_DESTROYGROUP(ds->g.g);
  DESTROY(ds);
}

static const sigops dsa_sig = {
  dh_privfetch, sizeof(dh_priv),
  dsa_siginit, dsa_sigdoit, dsa_sigcheck, dsa_sigdestroy
};

static const sigops bindsa_sig = {
  dh_privfetch, sizeof(dh_priv),
  bindsa_siginit, dsa_sigdoit, dsa_sigcheck, dsa_sigdestroy
};

static const sigops ecdsa_sig = {
  ec_privfetch, sizeof(ec_priv),
  ecdsa_siginit, dsa_sigdoit, dsa_sigcheck, dsa_sigdestroy
};

static sig *dsa_vrfinit(key *k, void *kd, const gchash *hc)
{
  dh_pub *dp = kd;
  dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_prime, "prime");
  return (&ds->s);
}

static sig *bindsa_vrfinit(key *k, void *kd, const gchash *hc)
{
  dh_pub *dp = kd;
  dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_binary, "binary");
  return (&ds->s);
}

static sig *ecdsa_vrfinit(key *k, void *kd, const gchash *hc)
{
  ec_pub *ep = kd;
  dsa_sigctx *ds = ecdsa_doinit(k, ep->cstr, &ep->p, hc);
  return (&ds->s);
}

static int dsa_vrfdoit(sig *s, dstr *d)
{
  dsa_sigctx *ds = (dsa_sigctx *)s;
  gdsa_sig ss;
  size_t n = d->len/2;
  int rc;

  ss.r = mp_loadb(MP_NEW, d->buf, n);
  ss.s = mp_loadb(MP_NEW, d->buf + n, d->len - n);
  rc = gdsa_verify(&ds->g, &ss, GH_DONE(ds->s.h, 0));
  mp_drop(ss.r); mp_drop(ss.s);
  return (rc);
}

static const sigops dsa_vrf = {
  dh_pubfetch, sizeof(dh_pub),
  dsa_vrfinit, dsa_vrfdoit, dsa_sigcheck, dsa_sigdestroy
};

static const sigops bindsa_vrf = {
  dh_pubfetch, sizeof(dh_pub),
  bindsa_vrfinit, dsa_vrfdoit, dsa_sigcheck, dsa_sigdestroy
};

static const sigops ecdsa_vrf = {
  ec_pubfetch, sizeof(ec_pub),
  ecdsa_vrfinit, dsa_vrfdoit, dsa_sigcheck, dsa_sigdestroy
};

/* --- KCDSA and ECKCDSA --- */

static void kcdsa_privkey(dsa_sigctx *ds, mp *x)
  { ds->g.u = mp_modinv(MP_NEW, x, ds->g.g->r); }

static void kcdsa_sethash(dsa_sigctx *ds, const gchash *hc)
  { ds->s.h = gkcdsa_beginhash(&ds->g); }

static sig *kcdsa_siginit(key *k, void *kd, const gchash *hc)
{
  dh_priv *dp = kd;
  dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_prime, "prime");
  kcdsa_privkey(ds, dp->x);
  kcdsa_sethash(ds, hc);
  return (&ds->s);
}

static sig *binkcdsa_siginit(key *k, void *kd, const gchash *hc)
{
  dh_priv *dp = kd;
  dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_binary, "binary");
  kcdsa_privkey(ds, dp->x);
  kcdsa_sethash(ds, hc);
  return (&ds->s);
}

static sig *eckcdsa_siginit(key *k, void *kd, const gchash *hc)
{
  ec_priv *ep = kd;
  dsa_sigctx *ds = ecdsa_doinit(k, ep->cstr, &ep->p, hc);
  kcdsa_privkey(ds, ep->x);
  kcdsa_sethash(ds, hc);
  return (&ds->s);
}

static int kcdsa_sigdoit(sig *s, dstr *d)
{
  dsa_sigctx *ds = (dsa_sigctx *)s;
  gkcdsa_sig ss = GKCDSA_SIG_INIT;
  size_t hsz = ds->g.h->hashsz, n = mp_octets(ds->g.g->r);

  gkcdsa_sign(&ds->g, &ss, GH_DONE(ds->s.h, 0), 0);
  dstr_ensure(d, hsz + n);
  memcpy(d->buf, ss.r, hsz);
  mp_storeb(ss.s, d->buf + hsz, n);
  d->len += hsz + n;
  xfree(ss.r); mp_drop(ss.s);
  return (0);
}

static const sigops kcdsa_sig = {
  dh_privfetch, sizeof(dh_priv),
  kcdsa_siginit, kcdsa_sigdoit, dsa_sigcheck, dsa_sigdestroy
};

static const sigops binkcdsa_sig = {
  dh_privfetch, sizeof(dh_priv),
  binkcdsa_siginit, kcdsa_sigdoit, dsa_sigcheck, dsa_sigdestroy
};

static const sigops eckcdsa_sig = {
  ec_privfetch, sizeof(ec_priv),
  eckcdsa_siginit, kcdsa_sigdoit, dsa_sigcheck, dsa_sigdestroy
};

static sig *kcdsa_vrfinit(key *k, void *kd, const gchash *hc)
{
  dh_pub *dp = kd;
  dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_prime, "prime");
  kcdsa_sethash(ds, hc);
  return (&ds->s);
}

static sig *binkcdsa_vrfinit(key *k, void *kd, const gchash *hc)
{
  dh_pub *dp = kd;
  dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_binary, "binary");
  kcdsa_sethash(ds, hc);
  return (&ds->s);
}

static sig *eckcdsa_vrfinit(key *k, void *kd, const gchash *hc)
{
  ec_pub *ep = kd;
  dsa_sigctx *ds = ecdsa_doinit(k, ep->cstr, &ep->p, hc);
  kcdsa_sethash(ds, hc);
  return (&ds->s);
}

static int kcdsa_vrfdoit(sig *s, dstr *d)
{
  dsa_sigctx *ds = (dsa_sigctx *)s;
  gkcdsa_sig ss;
  size_t hsz = ds->g.h->hashsz, n = d->len - hsz;
  int rc;

  if (d->len < hsz)
    return (-1);
  ss.r = (octet *)d->buf;
  ss.s = mp_loadb(MP_NEW, d->buf + hsz, n);
  rc = gkcdsa_verify(&ds->g, &ss, GH_DONE(ds->s.h, 0));
  mp_drop(ss.s);
  return (rc);
}

static const sigops kcdsa_vrf = {
  dh_pubfetch, sizeof(dh_pub),
  kcdsa_vrfinit, kcdsa_vrfdoit, dsa_sigcheck, dsa_sigdestroy
};

static const sigops binkcdsa_vrf = {
  dh_pubfetch, sizeof(dh_pub),
  binkcdsa_vrfinit, kcdsa_vrfdoit, dsa_sigcheck, dsa_sigdestroy
};

static const sigops eckcdsa_vrf = {
  ec_pubfetch, sizeof(ec_pub),
  eckcdsa_vrfinit, kcdsa_vrfdoit, dsa_sigcheck, dsa_sigdestroy
};

/* --- Symmetric message authentication --- */

typedef struct mac_ctx {
  sig s;
  const gcmac *mc;
  gmac *m;
  key_packdef kp;
  key_bin kb;
} mac_ctx;

static sig *mac_init(key *k, void *kd, const gchash *hc)
{
  mac_ctx *m;
  dstr d = DSTR_INIT;
  int err;
  const char *mm;

  m = CREATE(mac_ctx);

  key_fulltag(k, &d);
  m->kp.e = KENC_BINARY;
  m->kp.p = &m->kb;
  m->kp.kd = 0;

  if ((mm = key_getattr(0 /*yik*/, k, "mac")) == 0) {
    dstr_putf(&d, "%s-hmac", hc->name);
    mm = d.buf;
  }
  if ((m->mc = gmac_byname(mm)) == 0)
    die(EXIT_FAILURE, "unknown message authentication scheme `%s'", mm);
  dstr_reset(&d);

  if ((err = key_unpack(&m->kp, kd, &d)) != 0) {
    die(EXIT_FAILURE, "failed to unpack symmetric key `%s': %s",
	d.buf, key_strerror(err));
  }
  dstr_destroy(&d);

  if (keysz(m->kb.sz, m->mc->keysz) != m->kb.sz) {
    die(EXIT_FAILURE, "bad key size %lu for `%s'",
	(unsigned long)m->kb.sz, m->mc->name);
  }
  m->m = GM_KEY(m->mc, m->kb.k, m->kb.sz);
  m->s.h = GM_INIT(m->m);
  return (&m->s);
}

static int mac_sigdoit(sig *s, dstr *d)
{
  mac_ctx *m = (mac_ctx *)s;

  dstr_ensure(d, m->mc->hashsz);
  GH_DONE(m->s.h, d->buf);
  d->len += m->mc->hashsz;
  return (0);
}

static int mac_vrfdoit(sig *s, dstr *d)
{
  mac_ctx *m = (mac_ctx *)s;
  const octet *t;

  t = GH_DONE(m->s.h, 0);
  if (d->len != m->mc->hashsz || memcmp(d->buf, t, d->len) != 0)
    return (-1);
  return (0);
}

static const char *mac_check(sig *s) { return (0); }

static void mac_destroy(sig *s)
{
  mac_ctx *m = (mac_ctx *)s;
  GM_DESTROY(m->m);
  key_unpackdone(&m->kp);
}

static const sigops mac_sig = {
  0, 0,
  mac_init, mac_sigdoit, mac_check, mac_destroy
};

static const sigops mac_vrf = {
  0, 0,
  mac_init, mac_vrfdoit, mac_check, mac_destroy
};

/* --- The switch table --- */

const struct sigtab sigtab[] = {
  { "rsapkcs1",	&rsap1_sig,	&rsap1_vrf,	&sha },
  { "rsapss",	&rsapss_sig,	&rsapss_vrf,	&sha },
  { "dsa",	&dsa_sig,	&dsa_vrf,	&sha },
  { "bindsa",	&bindsa_sig,	&bindsa_vrf,	&sha },
  { "ecdsa",	&ecdsa_sig,	&ecdsa_vrf,	&sha },
  { "kcdsa",	&kcdsa_sig,	&kcdsa_vrf,	&has160 },
  { "binkcdsa",	&binkcdsa_sig,	&binkcdsa_vrf,	&has160 },
  { "eckcdsa",	&eckcdsa_sig,	&eckcdsa_vrf,	&has160 },
  { "mac",	&mac_sig,	&mac_vrf,	&rmd160 },
  { 0,		0,		0 }
};

/* --- @getsig@ --- *
 *
 * Arguments:	@key *k@ = the key to load
 *		@const char *app@ = application name
 *		@int wantpriv@ = nonzero if we want to sign
 *
 * Returns:	A signature-making thing.
 *
 * Use:		Loads a key and starts hashing.
 */

sig *getsig(key *k, const char *app, int wantpriv)
{
  const char *salg, *halg = 0;
  dstr d = DSTR_INIT;
  dstr t = DSTR_INIT;
  char *p = 0;
  const char *q;
  sig *s;
  size_t n;
  const struct sigtab *st;
  const sigops *so;
  const gchash *ch;
  void *kd;
  int e;
  key_packdef *kp;

  /* --- Setup stuff --- */

  key_fulltag(k, &t);

  /* --- Get the signature algorithm --- *
   *
   * Take the attribute if it's there; otherwise use the key type.
   */

  n = strlen(app);
  if ((q = key_getattr(0, k, "sig")) != 0) {
    dstr_puts(&d, q);
    p = d.buf;
  } else if (strncmp(k->type, app, n) == 0 && k->type[n] == '-') {
    dstr_puts(&d, k->type);
    p = d.buf + n + 1;
  } else
    die(EXIT_FAILURE, "no signature algorithm for key `%s'", t.buf);

  /* --- Grab the hash algorithm --- *
   *
   * Grab it from the signature algorithm if it's there.  But override that
   * from the attribute.
   */

  salg = p;
  if ((p = strchr(p, '/')) != 0) {
    *p++ = 0;
    halg = p;
  }
  if ((q = key_getattr(0, k, "hash")) != 0)
    halg = q;

  /* --- Look up the algorithms in the table --- */

  for (st = sigtab; st->name; st++) {
    if (strcmp(st->name, salg) == 0)
      goto s_found;
  }
  die(EXIT_FAILURE, "signature algorithm `%s' not found in key `%s'",
      salg, t.buf);
s_found:;
  if (!halg)
    ch = st->ch;
  else {
    if ((ch = ghash_byname(halg)) == 0) {
      die(EXIT_FAILURE, "hash algorithm `%s' not found in key `%s'",
	  halg, t.buf);
    }
  }
  so = wantpriv ? st->signops : st->verifyops;

  /* --- Load the key --- */

  if (!so->kf) {
    kd = k->k;
    key_incref(kd);
    kp = 0;
  } else {
    kd = xmalloc(so->kdsz);
    kp = key_fetchinit(so->kf, 0, kd);
    if ((e = key_fetch(kp, k)) != 0) {
      die(EXIT_FAILURE, "error fetching key `%s': %s",
	  t.buf, key_strerror(e));
    }
  }
  s = so->init(k, kd, ch);
  if (!s->h)
    s->h = GH_INIT(ch);
  s->kp = kp;
  s->ops = so;
  s->kd = kd;
  s->ch = ch;

  /* --- Free stuff up --- */

  dstr_destroy(&d);
  dstr_destroy(&t);
  return (s);
}

/* --- @freesig@ --- *
 *
 * Arguments:	@sig *s@ = signature-making thing
 *
 * Returns:	---
 *
 * Use:		Frees up a signature-making thing
 */

void freesig(sig *s)
{
  GH_DESTROY(s->h);
  if (!s->ops->kf)
    key_drop(s->kd);
  else {
    key_fetchdone(s->kp);
    xfree(s->kd);
  }
  s->ops->destroy(s);
}

/*----- That's all, folks -------------------------------------------------*/
Commit	Line	Data
5c3f75ec	1	/* --c--
5c3f75ec	2	*
5c3f75ec	3	* Catcrypt signatures
	4	*
	5	* (c) 2004 Straylight/Edgeware
	6	*/
	7
45c0fd36	8	/----- Licensing notice --------------------------------------------------
5c3f75ec	9	*
	10	* This file is part of Catacomb.
	11	*
	12	* Catacomb is free software; you can redistribute it and/or modify
	13	* it under the terms of the GNU Library General Public License as
	14	* published by the Free Software Foundation; either version 2 of the
	15	* License, or (at your option) any later version.
45c0fd36	16	*
5c3f75ec	17	* Catacomb is distributed in the hope that it will be useful,
	18	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	19	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	20	* GNU Library General Public License for more details.
45c0fd36	21	*
5c3f75ec	22	* You should have received a copy of the GNU Library General Public
	23	* License along with Catacomb; if not, write to the Free
	24	* Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
	25	* MA 02111-1307, USA.
	26	*/
	27
	28	/----- Header files ------------------------------------------------------/
	29
cd6eca43 MW	30	#define _FILE_OFFSET_BITS 64
cd6eca43 MW	31
5c3f75ec	32	#include <stdlib.h>
	33
	34	#include <mLib/report.h>
	35
	36	#include "rand.h"
	37	#include "sha.h"
	38	#include "has160.h"
	39
	40	#include "ec.h"
	41	#include "ec-keys.h"
	42	#include "dh.h"
	43	#include "gdsa.h"
	44	#include "gkcdsa.h"
	45	#include "rsa.h"
	46
	47	#include "cc.h"
	48
	49	/----- Main code ---------------------------------------------------------/
	50
	51	/* --- RSA PKCS1 --- */
	52
	53	typedef struct rsap1_sigctx {
	54	sig s;
	55	rsa_privctx rp;
	56	pkcs1 p1;
	57	} rsap1_sigctx;
	58
	59	static sig rsap1_siginit(key k, void kd, const gchash hc)
	60	{
	61	rsap1_sigctx *rs = CREATE(rsap1_sigctx);
	62	rsa_privcreate(&rs->rp, kd, &rand_global);
	63	rs->p1.r = &rand_global;
	64	rs->p1.ep = hc->name;
	65	rs->p1.epsz = strlen(hc->name) + 1;
	66	rs->s.h = 0;
	67	return (&rs->s);
	68	}
	69
	70	static int rsap1_sigdoit(sig s, dstr d)
	71	{
	72	rsap1_sigctx rs = (rsap1_sigctx )s;
	73	size_t n;
	74	mp *m = rsa_sign(&rs->rp, MP_NEW,
	75	GH_DONE(s->h, 0), GH_CLASS(s->h)->hashsz,
	76	pkcs1_sigencode, &rs->p1);
	77	if (!m) return (-1);
	78	n = mp_octets(rs->rp.rp->n); dstr_ensure(d, n); mp_storeb(m, d->buf, n);
	79	d->len += n; mp_drop(m);
	80	return (0);
	81	}
	82
	83	static const char rsa_lengthcheck(mp n)
	84	{
	85	if (mp_bits(n) < 1024) return ("key too short");
	86	return (0);
	87	}
	88
	89	static const char rsap1_sigcheck(sig s)
	90	{
	91	rsap1_sigctx rs = (rsap1_sigctx )s;
	92	const char *e;
	93	if ((e = rsa_lengthcheck(rs->rp.rp->n)) != 0) return (e);
	94	return (0);
	95	}
96
97	static void rsap1_sigdestroy(sig *s)
98	{
99	rsap1_sigctx rs = (rsap1_sigctx )s;
100	rsa_privdestroy(&rs->rp);
101	DESTROY(rs);
102	}
103
104	static const sigops rsap1_sig = {
105	rsa_privfetch, sizeof(rsa_priv),
106	rsap1_siginit, rsap1_sigdoit, rsap1_sigcheck, rsap1_sigdestroy
107	};
108
109	typedef struct rsap1_vrfctx {
110	sig s;
111	rsa_pubctx rp;
112	pkcs1 p1;
113	} rsap1_vrfctx;
114
115	static sig rsap1_vrfinit(key k, void kd, const gchash hc)
116	{
117	rsap1_vrfctx *rv = CREATE(rsap1_vrfctx);
118	rsa_pubcreate(&rv->rp, kd);
119	rv->p1.r = &rand_global;
120	rv->p1.ep = hc->name;
121	rv->p1.epsz = strlen(hc->name) + 1;
122	rv->s.h = 0;
123	return (&rv->s);
124	}
125
126	static int rsap1_vrfdoit(sig s, dstr d)
127	{
128	rsap1_vrfctx rv = (rsap1_vrfctx )s;
129	mp *m = mp_loadb(MP_NEW, d->buf, d->len);
130	int rc = rsa_verify(&rv->rp, m,
131	GH_DONE(s->h, 0), GH_CLASS(s->h)->hashsz,
132	0, pkcs1_sigdecode, &rv->p1);
133	mp_drop(m);
134	return (rc);
135	}
136
137	static const char rsap1_vrfcheck(sig s)
138	{
139	rsap1_vrfctx rv = (rsap1_vrfctx )s;
140	const char *e;
141	if ((e = rsa_lengthcheck(rv->rp.rp->n)) != 0) return (e);
142	return (0);
143	}
144
145	static void rsap1_vrfdestroy(sig *s)
146	{
147	rsap1_vrfctx rv = (rsap1_vrfctx )s;
148	rsa_pubdestroy(&rv->rp);
149	DESTROY(rv);
150	}
151
152	static const sigops rsap1_vrf = {
153	rsa_pubfetch, sizeof(rsa_pub),
154	rsap1_vrfinit, rsap1_vrfdoit, rsap1_vrfcheck, rsap1_vrfdestroy
155	};
156
157	/* --- RSA PSS --- */
158
159	static const gccipher getmgf(key k, const gchash *hc)
160	{
161	dstr d = DSTR_INIT;
162	const gccipher *gc;
163	const char *mm;
164
165	if ((mm = key_getattr(0, k, "mgf")) == 0) {
166	dstr_putf(&d, "%s-mgf", hc->name);
167	mm = d.buf;
168	}
169	if ((gc = gcipher_byname(mm)) == 0)
170	die(EXIT_FAILURE, "unknown encryption scheme `%s'", mm);
171	dstr_destroy(&d);
172	return (gc);
173	}
174
175	typedef struct rsapss_sigctx {
176	sig s;
177	rsa_privctx rp;
178	pss p;
179	} rsapss_sigctx;
180
181	static sig rsapss_siginit(key k, void kd, const gchash hc)
182	{
183	rsapss_sigctx *rs = CREATE(rsapss_sigctx);
184	rsa_privcreate(&rs->rp, kd, &rand_global);
8acb0587	185	rs->s.h = 0;
5c3f75ec	186	rs->p.r = &rand_global;
	187	rs->p.cc = getmgf(k, hc);
	188	rs->p.ch = hc;
	189	rs->p.ssz = hc->hashsz;
5c3f75ec	190	return (&rs->s);
	191	}
	192
	193	static int rsapss_sigdoit(sig s, dstr d)
	194	{
	195	rsapss_sigctx rs = (rsapss_sigctx )s;
	196	size_t n;
	197	mp *m = rsa_sign(&rs->rp, MP_NEW,
	198	GH_DONE(s->h, 0), GH_CLASS(s->h)->hashsz,
	199	pss_encode, &rs->p);
	200	if (!m) return (-1);
	201	n = mp_octets(rs->rp.rp->n); dstr_ensure(d, n); mp_storeb(m, d->buf, n);
45c0fd36	202	d->len += n; mp_drop(m);
5c3f75ec	203	return (0);
	204	}
	205
	206	static const char rsapss_sigcheck(sig s)
	207	{
	208	rsapss_sigctx rs = (rsapss_sigctx )s;
	209	const char *e;
	210	if ((e = rsa_lengthcheck(rs->rp.rp->n)) != 0) return (e);
	211	return (0);
	212	}
	213
	214	static void rsapss_sigdestroy(sig *s)
	215	{
	216	rsapss_sigctx rs = (rsapss_sigctx )s;
	217	rsa_privdestroy(&rs->rp);
	218	DESTROY(rs);
	219	}
	220
	221	static const sigops rsapss_sig = {
	222	rsa_privfetch, sizeof(rsa_priv),
	223	rsapss_siginit, rsapss_sigdoit, rsapss_sigcheck, rsapss_sigdestroy
	224	};
	225
	226	typedef struct rsapss_vrfctx {
	227	sig s;
	228	rsa_pubctx rp;
	229	pss p;
	230	} rsapss_vrfctx;
	231
	232	static sig rsapss_vrfinit(key k, void kd, const gchash hc)
	233	{
	234	rsapss_vrfctx *rv = CREATE(rsapss_vrfctx);
	235	rsa_pubcreate(&rv->rp, kd);
8acb0587	236	rv->s.h = 0;
5c3f75ec	237	rv->p.r = &rand_global;
	238	rv->p.cc = getmgf(k, hc);
	239	rv->p.ch = hc;
	240	rv->p.ssz = hc->hashsz;
	241	return (&rv->s);
	242	}
	243
	244	static int rsapss_vrfdoit(sig s, dstr d)
	245	{
	246	rsapss_vrfctx rv = (rsapss_vrfctx )s;
	247	mp *m = mp_loadb(MP_NEW, d->buf, d->len);
	248	int rc = rsa_verify(&rv->rp, m,
	249	GH_DONE(s->h, 0), GH_CLASS(s->h)->hashsz,
	250	0, pss_decode, &rv->p);
	251	mp_drop(m);
	252	return (rc);
	253	}
	254
	255	static const char rsapss_vrfcheck(sig s)
	256	{
	257	rsapss_vrfctx rv = (rsapss_vrfctx )s;
	258	const char *e;
	259	if ((e = rsa_lengthcheck(rv->rp.rp->n)) != 0) return (e);
	260	return (0);
	261	}
	262
	263	static void rsapss_vrfdestroy(sig *s)
	264	{
	265	rsapss_vrfctx rv = (rsapss_vrfctx )s;
	266	rsa_pubdestroy(&rv->rp);
	267	DESTROY(rv);
	268	}
	269
	270	static const sigops rsapss_vrf = {
	271	rsa_pubfetch, sizeof(rsa_pub),
	272	rsapss_vrfinit, rsapss_vrfdoit, rsapss_vrfcheck, rsapss_vrfdestroy
	273	};
	274
	275	/* --- DSA and ECDSA --- */
	276
	277	typedef struct dsa_sigctx {
	278	sig s;
	279	gdsa g;
	280	} dsa_sigctx;
	281
	282	static void dsa_initcommon(dsa_sigctx ds, const gchash hc,
	283	const char *ktag)
	284	{
	285	ds->g.r = &rand_global;
	286	ds->g.h = hc;
	287	ds->g.u = MP_NEW;
	288	ds->s.h = 0;
	289	}
	290
	291	static dsa_sigctx dsa_doinit(key k, const gprime_param *gp,
3688eb75	292	mp y, const gchash hc,
	293	group (makegroup)(const gprime_param *),
	294	const char *what)
5c3f75ec	295	{
	296	dsa_sigctx *ds = CREATE(dsa_sigctx);
	297	dstr t = DSTR_INIT;
	298
	299	key_fulltag(k, &t);
3688eb75	300	if ((ds->g.g = makegroup(gp)) == 0)
3688eb75	301	die(EXIT_FAILURE, "bad %s group in key `%s'", what, t.buf);
5c3f75ec	302	ds->g.p = G_CREATE(ds->g.g);
	303	if (G_FROMINT(ds->g.g, ds->g.p, y))
	304	die(EXIT_FAILURE, "bad public key in key `%s'", t.buf);
	305	dsa_initcommon(ds, hc, t.buf);
	306	dstr_destroy(&t);
	307	return (ds);
	308	}
	309
	310	static dsa_sigctx ecdsa_doinit(key k, const char *cstr,
	311	ec y, const gchash hc)
	312	{
	313	dsa_sigctx *ds = CREATE(dsa_sigctx);
	314	ec_info ei;
	315	const char *e;
	316	dstr t = DSTR_INIT;
	317
	318	key_fulltag(k, &t);
	319	if ((e = ec_getinfo(&ei, cstr)) != 0)
	320	die(EXIT_FAILURE, "bad curve in key `%s': %s", t.buf, e);
	321	ds->g.g = group_ec(&ei);
	322	ds->g.p = G_CREATE(ds->g.g);
	323	if (G_FROMEC(ds->g.g, ds->g.p, y))
	324	die(EXIT_FAILURE, "bad public key in key `%s'", t.buf);
	325	dsa_initcommon(ds, hc, t.buf);
	326	dstr_destroy(&t);
	327	return (ds);
	328	}
	329
	330	static sig dsa_siginit(key k, void kd, const gchash hc)
	331	{
	332	dh_priv *dp = kd;
3688eb75	333	dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_prime, "prime");
	334	ds->g.u = MP_COPY(dp->x);
	335	return (&ds->s);
	336	}
	337
	338	static sig bindsa_siginit(key k, void kd, const gchash hc)
	339	{
	340	dh_priv *dp = kd;
	341	dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_binary, "binary");
5c3f75ec	342	ds->g.u = MP_COPY(dp->x);
	343	return (&ds->s);
	344	}
	345
	346	static sig ecdsa_siginit(key k, void kd, const gchash hc)
	347	{
	348	ec_priv *ep = kd;
	349	dsa_sigctx *ds = ecdsa_doinit(k, ep->cstr, &ep->p, hc);
	350	ds->g.u = MP_COPY(ep->x);
	351	return (&ds->s);
	352	}
	353
	354	static int dsa_sigdoit(sig s, dstr d)
	355	{
	356	dsa_sigctx ds = (dsa_sigctx )s;
	357	gdsa_sig ss = GDSA_SIG_INIT;
	358	size_t n = mp_octets(ds->g.g->r);
	359
	360	gdsa_sign(&ds->g, &ss, GH_DONE(ds->s.h, 0), 0);
	361	dstr_ensure(d, 2 * n);
	362	mp_storeb(ss.r, d->buf, n);
	363	mp_storeb(ss.s, d->buf + n, n);
	364	d->len += 2 * n;
	365	mp_drop(ss.r); mp_drop(ss.s);
	366	return (0);
	367	}
	368
	369	static const char dsa_sigcheck(sig s)
	370	{
	371	dsa_sigctx ds = (dsa_sigctx )s;
	372	const char *e;
	373	if ((e = G_CHECK(ds->g.g, &rand_global)) != 0)
	374	return (0);
	375	if (group_check(ds->g.g, ds->g.p))
	376	return ("public key not in subgroup");
	377	return (0);
	378	}
	379
	380	static void dsa_sigdestroy(sig *s)
	381	{
	382	dsa_sigctx ds = (dsa_sigctx )s;
	383	G_DESTROY(ds->g.g, ds->g.p);
	384	mp_drop(ds->g.u);
	385	G_DESTROYGROUP(ds->g.g);
ef13e9a4	386	DESTROY(ds);
5c3f75ec	387	}
	388
	389	static const sigops dsa_sig = {
	390	dh_privfetch, sizeof(dh_priv),
	391	dsa_siginit, dsa_sigdoit, dsa_sigcheck, dsa_sigdestroy
	392	};
	393
3688eb75	394	static const sigops bindsa_sig = {
	395	dh_privfetch, sizeof(dh_priv),
	396	bindsa_siginit, dsa_sigdoit, dsa_sigcheck, dsa_sigdestroy
	397	};
	398
5c3f75ec	399	static const sigops ecdsa_sig = {
	400	ec_privfetch, sizeof(ec_priv),
	401	ecdsa_siginit, dsa_sigdoit, dsa_sigcheck, dsa_sigdestroy
	402	};
	403
	404	static sig dsa_vrfinit(key k, void kd, const gchash hc)
	405	{
	406	dh_pub *dp = kd;
3688eb75	407	dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_prime, "prime");
	408	return (&ds->s);
	409	}
	410
	411	static sig bindsa_vrfinit(key k, void kd, const gchash hc)
	412	{
	413	dh_pub *dp = kd;
	414	dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_binary, "binary");
5c3f75ec	415	return (&ds->s);
	416	}
	417
	418	static sig ecdsa_vrfinit(key k, void kd, const gchash hc)
	419	{
	420	ec_pub *ep = kd;
	421	dsa_sigctx *ds = ecdsa_doinit(k, ep->cstr, &ep->p, hc);
	422	return (&ds->s);
	423	}
	424
	425	static int dsa_vrfdoit(sig s, dstr d)
	426	{
	427	dsa_sigctx ds = (dsa_sigctx )s;
	428	gdsa_sig ss;
	429	size_t n = d->len/2;
	430	int rc;
	431
	432	ss.r = mp_loadb(MP_NEW, d->buf, n);
	433	ss.s = mp_loadb(MP_NEW, d->buf + n, d->len - n);
	434	rc = gdsa_verify(&ds->g, &ss, GH_DONE(ds->s.h, 0));
	435	mp_drop(ss.r); mp_drop(ss.s);
	436	return (rc);
	437	}
	438
	439	static const sigops dsa_vrf = {
	440	dh_pubfetch, sizeof(dh_pub),
	441	dsa_vrfinit, dsa_vrfdoit, dsa_sigcheck, dsa_sigdestroy
	442	};
	443
3688eb75	444	static const sigops bindsa_vrf = {
	445	dh_pubfetch, sizeof(dh_pub),
	446	bindsa_vrfinit, dsa_vrfdoit, dsa_sigcheck, dsa_sigdestroy
	447	};
	448
5c3f75ec	449	static const sigops ecdsa_vrf = {
	450	ec_pubfetch, sizeof(ec_pub),
	451	ecdsa_vrfinit, dsa_vrfdoit, dsa_sigcheck, dsa_sigdestroy
	452	};
	453
	454	/* --- KCDSA and ECKCDSA --- */
	455
	456	static void kcdsa_privkey(dsa_sigctx ds, mp x)
	457	{ ds->g.u = mp_modinv(MP_NEW, x, ds->g.g->r); }
	458
	459	static void kcdsa_sethash(dsa_sigctx ds, const gchash hc)
	460	{ ds->s.h = gkcdsa_beginhash(&ds->g); }
	461
	462	static sig kcdsa_siginit(key k, void kd, const gchash hc)
	463	{
	464	dh_priv *dp = kd;
3688eb75	465	dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_prime, "prime");
	466	kcdsa_privkey(ds, dp->x);
	467	kcdsa_sethash(ds, hc);
	468	return (&ds->s);
	469	}
	470
	471	static sig binkcdsa_siginit(key k, void kd, const gchash hc)
	472	{
	473	dh_priv *dp = kd;
	474	dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_binary, "binary");
5c3f75ec	475	kcdsa_privkey(ds, dp->x);
	476	kcdsa_sethash(ds, hc);
	477	return (&ds->s);
	478	}
	479
	480	static sig eckcdsa_siginit(key k, void kd, const gchash hc)
	481	{
	482	ec_priv *ep = kd;
	483	dsa_sigctx *ds = ecdsa_doinit(k, ep->cstr, &ep->p, hc);
	484	kcdsa_privkey(ds, ep->x);
	485	kcdsa_sethash(ds, hc);
	486	return (&ds->s);
	487	}
	488
	489	static int kcdsa_sigdoit(sig s, dstr d)
	490	{
	491	dsa_sigctx ds = (dsa_sigctx )s;
	492	gkcdsa_sig ss = GKCDSA_SIG_INIT;
	493	size_t hsz = ds->g.h->hashsz, n = mp_octets(ds->g.g->r);
	494
	495	gkcdsa_sign(&ds->g, &ss, GH_DONE(ds->s.h, 0), 0);
	496	dstr_ensure(d, hsz + n);
	497	memcpy(d->buf, ss.r, hsz);
	498	mp_storeb(ss.s, d->buf + hsz, n);
	499	d->len += hsz + n;
	500	xfree(ss.r); mp_drop(ss.s);
	501	return (0);
	502	}
	503
	504	static const sigops kcdsa_sig = {
	505	dh_privfetch, sizeof(dh_priv),
	506	kcdsa_siginit, kcdsa_sigdoit, dsa_sigcheck, dsa_sigdestroy
	507	};
	508
3688eb75	509	static const sigops binkcdsa_sig = {
	510	dh_privfetch, sizeof(dh_priv),
	511	binkcdsa_siginit, kcdsa_sigdoit, dsa_sigcheck, dsa_sigdestroy
	512	};
	513
5c3f75ec	514	static const sigops eckcdsa_sig = {
	515	ec_privfetch, sizeof(ec_priv),
	516	eckcdsa_siginit, kcdsa_sigdoit, dsa_sigcheck, dsa_sigdestroy
	517	};
	518
	519	static sig kcdsa_vrfinit(key k, void kd, const gchash hc)
	520	{
	521	dh_pub *dp = kd;
3688eb75	522	dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_prime, "prime");
	523	kcdsa_sethash(ds, hc);
	524	return (&ds->s);
	525	}
	526
	527	static sig binkcdsa_vrfinit(key k, void kd, const gchash hc)
	528	{
	529	dh_pub *dp = kd;
	530	dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_binary, "binary");
5c3f75ec	531	kcdsa_sethash(ds, hc);
	532	return (&ds->s);
	533	}
	534
	535	static sig eckcdsa_vrfinit(key k, void kd, const gchash hc)
	536	{
	537	ec_pub *ep = kd;
	538	dsa_sigctx *ds = ecdsa_doinit(k, ep->cstr, &ep->p, hc);
	539	kcdsa_sethash(ds, hc);
	540	return (&ds->s);
	541	}
	542
	543	static int kcdsa_vrfdoit(sig s, dstr d)
	544	{
	545	dsa_sigctx ds = (dsa_sigctx )s;
	546	gkcdsa_sig ss;
	547	size_t hsz = ds->g.h->hashsz, n = d->len - hsz;
	548	int rc;
	549
	550	if (d->len < hsz)
	551	return (-1);
	552	ss.r = (octet *)d->buf;
	553	ss.s = mp_loadb(MP_NEW, d->buf + hsz, n);
	554	rc = gkcdsa_verify(&ds->g, &ss, GH_DONE(ds->s.h, 0));
	555	mp_drop(ss.s);
	556	return (rc);
	557	}
	558
	559	static const sigops kcdsa_vrf = {
	560	dh_pubfetch, sizeof(dh_pub),
	561	kcdsa_vrfinit, kcdsa_vrfdoit, dsa_sigcheck, dsa_sigdestroy
	562	};
	563
3688eb75	564	static const sigops binkcdsa_vrf = {
	565	dh_pubfetch, sizeof(dh_pub),
	566	binkcdsa_vrfinit, kcdsa_vrfdoit, dsa_sigcheck, dsa_sigdestroy
	567	};
	568
5c3f75ec	569	static const sigops eckcdsa_vrf = {
	570	ec_pubfetch, sizeof(ec_pub),
	571	eckcdsa_vrfinit, kcdsa_vrfdoit, dsa_sigcheck, dsa_sigdestroy
	572	};
	573
02dfbd5b MW	574	/* --- Symmetric message authentication --- */
	575
	576	typedef struct mac_ctx {
	577	sig s;
	578	const gcmac *mc;
	579	gmac *m;
	580	key_packdef kp;
	581	key_bin kb;
	582	} mac_ctx;
	583
	584	static sig mac_init(key k, void kd, const gchash hc)
	585	{
	586	mac_ctx *m;
	587	dstr d = DSTR_INIT;
	588	int err;
	589	const char *mm;
	590
	591	m = CREATE(mac_ctx);
	592
	593	key_fulltag(k, &d);
	594	m->kp.e = KENC_BINARY;
	595	m->kp.p = &m->kb;
	596	m->kp.kd = 0;
	597
	598	if ((mm = key_getattr(0 /yik/, k, "mac")) == 0) {
	599	dstr_putf(&d, "%s-hmac", hc->name);
	600	mm = d.buf;
	601	}
	602	if ((m->mc = gmac_byname(mm)) == 0)
	603	die(EXIT_FAILURE, "unknown message authentication scheme `%s'", mm);
	604	dstr_reset(&d);
	605
	606	if ((err = key_unpack(&m->kp, kd, &d)) != 0) {
	607	die(EXIT_FAILURE, "failed to unpack symmetric key `%s': %s",
	608	d.buf, key_strerror(err));
	609	}
	610	dstr_destroy(&d);
	611
	612	if (keysz(m->kb.sz, m->mc->keysz) != m->kb.sz) {
	613	die(EXIT_FAILURE, "bad key size %lu for `%s'",
	614	(unsigned long)m->kb.sz, m->mc->name);
	615	}
	616	m->m = GM_KEY(m->mc, m->kb.k, m->kb.sz);
	617	m->s.h = GM_INIT(m->m);
	618	return (&m->s);
	619	}
	620
	621	static int mac_sigdoit(sig s, dstr d)
	622	{
	623	mac_ctx m = (mac_ctx )s;
	624
	625	dstr_ensure(d, m->mc->hashsz);
	626	GH_DONE(m->s.h, d->buf);
	627	d->len += m->mc->hashsz;
	628	return (0);
	629	}
	630
	631	static int mac_vrfdoit(sig s, dstr d)
	632	{
	633	mac_ctx m = (mac_ctx )s;
	634	const octet *t;
	635
	636	t = GH_DONE(m->s.h, 0);
	637	if (d->len != m->mc->hashsz \|\| memcmp(d->buf, t, d->len) != 0)
638	return (-1);
639	return (0);
640	}
641
642	static const char mac_check(sig s) { return (0); }
643
644	static void mac_destroy(sig *s)
645	{
646	mac_ctx m = (mac_ctx )s;
647	GM_DESTROY(m->m);
648	key_unpackdone(&m->kp);
649	}
650
651	static const sigops mac_sig = {
652	0, 0,
653	mac_init, mac_sigdoit, mac_check, mac_destroy
654	};
655
656	static const sigops mac_vrf = {
657	0, 0,
658	mac_init, mac_vrfdoit, mac_check, mac_destroy
659	};
660
5c3f75ec	661	/* --- The switch table --- */
5c3f75ec	662
c65df279	663	const struct sigtab sigtab[] = {
5c3f75ec	664	{ "rsapkcs1", &rsap1_sig, &rsap1_vrf, &sha },
	665	{ "rsapss", &rsapss_sig, &rsapss_vrf, &sha },
	666	{ "dsa", &dsa_sig, &dsa_vrf, &sha },
3688eb75	667	{ "bindsa", &bindsa_sig, &bindsa_vrf, &sha },
5c3f75ec	668	{ "ecdsa", &ecdsa_sig, &ecdsa_vrf, &sha },
5c3f75ec	669	{ "kcdsa", &kcdsa_sig, &kcdsa_vrf, &has160 },
3688eb75	670	{ "binkcdsa", &binkcdsa_sig, &binkcdsa_vrf, &has160 },
5c3f75ec	671	{ "eckcdsa", &eckcdsa_sig, &eckcdsa_vrf, &has160 },
02dfbd5b	672	{ "mac", &mac_sig, &mac_vrf, &rmd160 },
5c3f75ec	673	{ 0, 0, 0 }
	674	};
	675
	676	/* --- @getsig@ --- *
	677	*
	678	* Arguments: @key *k@ = the key to load
	679	* @const char *app@ = application name
	680	* @int wantpriv@ = nonzero if we want to sign
	681	*
	682	* Returns: A signature-making thing.
	683	*
	684	* Use: Loads a key and starts hashing.
	685	*/
	686
	687	sig getsig(key k, const char *app, int wantpriv)
	688	{
	689	const char salg, halg = 0;
	690	dstr d = DSTR_INIT;
	691	dstr t = DSTR_INIT;
	692	char *p = 0;
	693	const char *q;
	694	sig *s;
	695	size_t n;
	696	const struct sigtab *st;
	697	const sigops *so;
	698	const gchash *ch;
	699	void *kd;
	700	int e;
	701	key_packdef *kp;
	702
	703	/* --- Setup stuff --- */
	704
	705	key_fulltag(k, &t);
	706
	707	/* --- Get the signature algorithm --- *
	708	*
	709	* Take the attribute if it's there; otherwise use the key type.
	710	*/
	711
	712	n = strlen(app);
	713	if ((q = key_getattr(0, k, "sig")) != 0) {
	714	dstr_puts(&d, q);
	715	p = d.buf;
	716	} else if (strncmp(k->type, app, n) == 0 && k->type[n] == '-') {
	717	dstr_puts(&d, k->type);
	718	p = d.buf + n + 1;
	719	} else
	720	die(EXIT_FAILURE, "no signature algorithm for key `%s'", t.buf);
	721
	722	/* --- Grab the hash algorithm --- *
	723	*
	724	* Grab it from the signature algorithm if it's there. But override that
	725	* from the attribute.
	726	*/
	727
	728	salg = p;
	729	if ((p = strchr(p, '/')) != 0) {
	730	*p++ = 0;
	731	halg = p;
	732	}
	733	if ((q = key_getattr(0, k, "hash")) != 0)
	734	halg = q;
	735
	736	/* --- Look up the algorithms in the table --- */
737
738	for (st = sigtab; st->name; st++) {
739	if (strcmp(st->name, salg) == 0)
740	goto s_found;
741	}
742	die(EXIT_FAILURE, "signature algorithm `%s' not found in key `%s'",
743	salg, t.buf);
744	s_found:;
745	if (!halg)
746	ch = st->ch;
747	else {
748	if ((ch = ghash_byname(halg)) == 0) {
749	die(EXIT_FAILURE, "hash algorithm `%s' not found in key `%s'",
750	halg, t.buf);
751	}
752	}
753	so = wantpriv ? st->signops : st->verifyops;
754
755	/* --- Load the key --- */
756
02dfbd5b MW	757	if (!so->kf) {
	758	kd = k->k;
	759	key_incref(kd);
78ec50fa	760	kp = 0;
02dfbd5b MW	761	} else {
	762	kd = xmalloc(so->kdsz);
	763	kp = key_fetchinit(so->kf, 0, kd);
	764	if ((e = key_fetch(kp, k)) != 0) {
	765	die(EXIT_FAILURE, "error fetching key `%s': %s",
	766	t.buf, key_strerror(e));
	767	}
	768	}
5c3f75ec	769	s = so->init(k, kd, ch);
	770	if (!s->h)
	771	s->h = GH_INIT(ch);
	772	s->kp = kp;
	773	s->ops = so;
	774	s->kd = kd;
02dfbd5b	775	s->ch = ch;
5c3f75ec	776
	777	/* --- Free stuff up --- */
	778
	779	dstr_destroy(&d);
	780	dstr_destroy(&t);
	781	return (s);
	782	}
	783
	784	/* --- @freesig@ --- *
	785	*
	786	* Arguments: @sig *s@ = signature-making thing
	787	*
	788	* Returns: ---
	789	*
	790	* Use: Frees up a signature-making thing
	791	*/
	792
	793	void freesig(sig *s)
	794	{
	795	GH_DESTROY(s->h);
02dfbd5b MW	796	if (!s->ops->kf)
02dfbd5b MW	797	key_drop(s->kd);
45c0fd36	798	else {
02dfbd5b MW	799	key_fetchdone(s->kp);
	800	xfree(s->kd);
	801	}
5c3f75ec	802	s->ops->destroy(s);
	803	}
	804
	805	/----- That's all, folks -------------------------------------------------/