~mdw / catacomb / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
math/f25519.c, utils/curve25519.sage: Slightly improve `quosqrt' algorithm.
[catacomb] / progs / cc-sig.c
CommitLineData
5c3f75ec 1/* -*-c-*-
2 *
5c3f75ec 3 * Catcrypt signatures
4 *
5 * (c) 2004 Straylight/Edgeware
6 */
7
45c0fd36 8/*----- Licensing notice --------------------------------------------------*
5c3f75ec 9 *
10 * This file is part of Catacomb.
11 *
12 * Catacomb is free software; you can redistribute it and/or modify
13 * it under the terms of the GNU Library General Public License as
14 * published by the Free Software Foundation; either version 2 of the
15 * License, or (at your option) any later version.
45c0fd36 16 *
5c3f75ec 17 * Catacomb is distributed in the hope that it will be useful,
18 * but WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 * GNU Library General Public License for more details.
45c0fd36 21 *
5c3f75ec 22 * You should have received a copy of the GNU Library General Public
23 * License along with Catacomb; if not, write to the Free
24 * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
25 * MA 02111-1307, USA.
26 */
27
28/*----- Header files ------------------------------------------------------*/
29
cd6eca43
MW		 30#define _FILE_OFFSET_BITS 64
31
5c3f75ec 32#include <stdlib.h>
33
34#include <mLib/report.h>
35
36#include "rand.h"
37#include "sha.h"
38#include "has160.h"
d56fd9d1 39#include "sha512.h"
5c3f75ec 40
da4489a6 41#include "ct.h"
5c3f75ec 42#include "ec.h"
43#include "ec-keys.h"
44#include "dh.h"
45#include "gdsa.h"
46#include "gkcdsa.h"
47#include "rsa.h"
d56fd9d1 48#include "ed25519.h"
5c3f75ec 49
50#include "cc.h"
51
52/*----- Main code ---------------------------------------------------------*/
53
54/* --- RSA PKCS1 --- */
55
56typedef struct rsap1_sigctx {
57 sig s;
58 rsa_privctx rp;
59 pkcs1 p1;
60} rsap1_sigctx;
61
62static sig *rsap1_siginit(key *k, void *kd, const gchash *hc)
63{
64 rsap1_sigctx *rs = CREATE(rsap1_sigctx);
65 rsa_privcreate(&rs->rp, kd, &rand_global);
66 rs->p1.r = &rand_global;
67 rs->p1.ep = hc->name;
68 rs->p1.epsz = strlen(hc->name) + 1;
69 rs->s.h = 0;
70 return (&rs->s);
71}
72
73static int rsap1_sigdoit(sig *s, dstr *d)
74{
75 rsap1_sigctx *rs = (rsap1_sigctx *)s;
76 size_t n;
77 mp *m = rsa_sign(&rs->rp, MP_NEW,
78 GH_DONE(s->h, 0), GH_CLASS(s->h)->hashsz,
79 pkcs1_sigencode, &rs->p1);
80 if (!m) return (-1);
81 n = mp_octets(rs->rp.rp->n); dstr_ensure(d, n); mp_storeb(m, d->buf, n);
82 d->len += n; mp_drop(m);
83 return (0);
84}
85
86static const char *rsa_lengthcheck(mp *n)
87{
88 if (mp_bits(n) < 1024) return ("key too short");
89 return (0);
90}
91
92static const char *rsap1_sigcheck(sig *s)
93{
94 rsap1_sigctx *rs = (rsap1_sigctx *)s;
95 const char *e;
96 if ((e = rsa_lengthcheck(rs->rp.rp->n)) != 0) return (e);
97 return (0);
98}
99
100static void rsap1_sigdestroy(sig *s)
101{
102 rsap1_sigctx *rs = (rsap1_sigctx *)s;
103 rsa_privdestroy(&rs->rp);
104 DESTROY(rs);
105}
106
107static const sigops rsap1_sig = {
108 rsa_privfetch, sizeof(rsa_priv),
109 rsap1_siginit, rsap1_sigdoit, rsap1_sigcheck, rsap1_sigdestroy
110};
111
112typedef struct rsap1_vrfctx {
113 sig s;
114 rsa_pubctx rp;
115 pkcs1 p1;
116} rsap1_vrfctx;
117
118static sig *rsap1_vrfinit(key *k, void *kd, const gchash *hc)
119{
120 rsap1_vrfctx *rv = CREATE(rsap1_vrfctx);
121 rsa_pubcreate(&rv->rp, kd);
122 rv->p1.r = &rand_global;
123 rv->p1.ep = hc->name;
124 rv->p1.epsz = strlen(hc->name) + 1;
125 rv->s.h = 0;
126 return (&rv->s);
127}
128
129static int rsap1_vrfdoit(sig *s, dstr *d)
130{
131 rsap1_vrfctx *rv = (rsap1_vrfctx *)s;
132 mp *m = mp_loadb(MP_NEW, d->buf, d->len);
133 int rc = rsa_verify(&rv->rp, m,
134 GH_DONE(s->h, 0), GH_CLASS(s->h)->hashsz,
135 0, pkcs1_sigdecode, &rv->p1);
136 mp_drop(m);
137 return (rc);
138}
139
140static const char *rsap1_vrfcheck(sig *s)
141{
142 rsap1_vrfctx *rv = (rsap1_vrfctx *)s;
143 const char *e;
144 if ((e = rsa_lengthcheck(rv->rp.rp->n)) != 0) return (e);
145 return (0);
146}
147
148static void rsap1_vrfdestroy(sig *s)
149{
150 rsap1_vrfctx *rv = (rsap1_vrfctx *)s;
151 rsa_pubdestroy(&rv->rp);
152 DESTROY(rv);
153}
154
155static const sigops rsap1_vrf = {
156 rsa_pubfetch, sizeof(rsa_pub),
157 rsap1_vrfinit, rsap1_vrfdoit, rsap1_vrfcheck, rsap1_vrfdestroy
158};
159
160/* --- RSA PSS --- */
161
162static const gccipher *getmgf(key *k, const gchash *hc)
163{
164 dstr d = DSTR_INIT;
165 const gccipher *gc;
166 const char *mm;
167
168 if ((mm = key_getattr(0, k, "mgf")) == 0) {
169 dstr_putf(&d, "%s-mgf", hc->name);
170 mm = d.buf;
171 }
172 if ((gc = gcipher_byname(mm)) == 0)
173 die(EXIT_FAILURE, "unknown encryption scheme `%s'", mm);
174 dstr_destroy(&d);
175 return (gc);
176}
177
178typedef struct rsapss_sigctx {
179 sig s;
180 rsa_privctx rp;
181 pss p;
182} rsapss_sigctx;
183
184static sig *rsapss_siginit(key *k, void *kd, const gchash *hc)
185{
186 rsapss_sigctx *rs = CREATE(rsapss_sigctx);
187 rsa_privcreate(&rs->rp, kd, &rand_global);
8acb0587 188 rs->s.h = 0;
5c3f75ec 189 rs->p.r = &rand_global;
190 rs->p.cc = getmgf(k, hc);
191 rs->p.ch = hc;
192 rs->p.ssz = hc->hashsz;
5c3f75ec 193 return (&rs->s);
194}
195
196static int rsapss_sigdoit(sig *s, dstr *d)
197{
198 rsapss_sigctx *rs = (rsapss_sigctx *)s;
199 size_t n;
200 mp *m = rsa_sign(&rs->rp, MP_NEW,
201 GH_DONE(s->h, 0), GH_CLASS(s->h)->hashsz,
202 pss_encode, &rs->p);
203 if (!m) return (-1);
204 n = mp_octets(rs->rp.rp->n); dstr_ensure(d, n); mp_storeb(m, d->buf, n);
45c0fd36 205 d->len += n; mp_drop(m);
5c3f75ec 206 return (0);
207}
208
209static const char *rsapss_sigcheck(sig *s)
210{
211 rsapss_sigctx *rs = (rsapss_sigctx *)s;
212 const char *e;
213 if ((e = rsa_lengthcheck(rs->rp.rp->n)) != 0) return (e);
214 return (0);
215}
216
217static void rsapss_sigdestroy(sig *s)
218{
219 rsapss_sigctx *rs = (rsapss_sigctx *)s;
220 rsa_privdestroy(&rs->rp);
221 DESTROY(rs);
222}
223
224static const sigops rsapss_sig = {
225 rsa_privfetch, sizeof(rsa_priv),
226 rsapss_siginit, rsapss_sigdoit, rsapss_sigcheck, rsapss_sigdestroy
227};
228
229typedef struct rsapss_vrfctx {
230 sig s;
231 rsa_pubctx rp;
232 pss p;
233} rsapss_vrfctx;
234
235static sig *rsapss_vrfinit(key *k, void *kd, const gchash *hc)
236{
237 rsapss_vrfctx *rv = CREATE(rsapss_vrfctx);
238 rsa_pubcreate(&rv->rp, kd);
8acb0587 239 rv->s.h = 0;
5c3f75ec 240 rv->p.r = &rand_global;
241 rv->p.cc = getmgf(k, hc);
242 rv->p.ch = hc;
243 rv->p.ssz = hc->hashsz;
244 return (&rv->s);
245}
246
247static int rsapss_vrfdoit(sig *s, dstr *d)
248{
249 rsapss_vrfctx *rv = (rsapss_vrfctx *)s;
250 mp *m = mp_loadb(MP_NEW, d->buf, d->len);
251 int rc = rsa_verify(&rv->rp, m,
252 GH_DONE(s->h, 0), GH_CLASS(s->h)->hashsz,
253 0, pss_decode, &rv->p);
254 mp_drop(m);
255 return (rc);
256}
257
258static const char *rsapss_vrfcheck(sig *s)
259{
260 rsapss_vrfctx *rv = (rsapss_vrfctx *)s;
261 const char *e;
262 if ((e = rsa_lengthcheck(rv->rp.rp->n)) != 0) return (e);
263 return (0);
264}
265
266static void rsapss_vrfdestroy(sig *s)
267{
268 rsapss_vrfctx *rv = (rsapss_vrfctx *)s;
269 rsa_pubdestroy(&rv->rp);
270 DESTROY(rv);
271}
272
273static const sigops rsapss_vrf = {
274 rsa_pubfetch, sizeof(rsa_pub),
275 rsapss_vrfinit, rsapss_vrfdoit, rsapss_vrfcheck, rsapss_vrfdestroy
276};
277
278/* --- DSA and ECDSA --- */
279
280typedef struct dsa_sigctx {
281 sig s;
282 gdsa g;
283} dsa_sigctx;
284
285static void dsa_initcommon(dsa_sigctx *ds, const gchash *hc,
286 const char *ktag)
287{
288 ds->g.r = &rand_global;
289 ds->g.h = hc;
290 ds->g.u = MP_NEW;
291 ds->s.h = 0;
292}
293
294static dsa_sigctx *dsa_doinit(key *k, const gprime_param *gp,
3688eb75 295 mp *y, const gchash *hc,
296 group *(*makegroup)(const gprime_param *),
297 const char *what)
5c3f75ec 298{
299 dsa_sigctx *ds = CREATE(dsa_sigctx);
300 dstr t = DSTR_INIT;
301
302 key_fulltag(k, &t);
3688eb75 303 if ((ds->g.g = makegroup(gp)) == 0)
304 die(EXIT_FAILURE, "bad %s group in key `%s'", what, t.buf);
5c3f75ec 305 ds->g.p = G_CREATE(ds->g.g);
306 if (G_FROMINT(ds->g.g, ds->g.p, y))
307 die(EXIT_FAILURE, "bad public key in key `%s'", t.buf);
308 dsa_initcommon(ds, hc, t.buf);
309 dstr_destroy(&t);
310 return (ds);
311}
312
313static dsa_sigctx *ecdsa_doinit(key *k, const char *cstr,
314 ec *y, const gchash *hc)
315{
316 dsa_sigctx *ds = CREATE(dsa_sigctx);
317 ec_info ei;
318 const char *e;
319 dstr t = DSTR_INIT;
320
321 key_fulltag(k, &t);
322 if ((e = ec_getinfo(&ei, cstr)) != 0)
323 die(EXIT_FAILURE, "bad curve in key `%s': %s", t.buf, e);
324 ds->g.g = group_ec(&ei);
325 ds->g.p = G_CREATE(ds->g.g);
326 if (G_FROMEC(ds->g.g, ds->g.p, y))
327 die(EXIT_FAILURE, "bad public key in key `%s'", t.buf);
328 dsa_initcommon(ds, hc, t.buf);
329 dstr_destroy(&t);
330 return (ds);
331}
332
333static sig *dsa_siginit(key *k, void *kd, const gchash *hc)
334{
335 dh_priv *dp = kd;
3688eb75 336 dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_prime, "prime");
337 ds->g.u = MP_COPY(dp->x);
338 return (&ds->s);
339}
340
341static sig *bindsa_siginit(key *k, void *kd, const gchash *hc)
342{
343 dh_priv *dp = kd;
344 dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_binary, "binary");
5c3f75ec 345 ds->g.u = MP_COPY(dp->x);
346 return (&ds->s);
347}
348
349static sig *ecdsa_siginit(key *k, void *kd, const gchash *hc)
350{
351 ec_priv *ep = kd;
352 dsa_sigctx *ds = ecdsa_doinit(k, ep->cstr, &ep->p, hc);
353 ds->g.u = MP_COPY(ep->x);
354 return (&ds->s);
355}
356
357static int dsa_sigdoit(sig *s, dstr *d)
358{
359 dsa_sigctx *ds = (dsa_sigctx *)s;
360 gdsa_sig ss = GDSA_SIG_INIT;
361 size_t n = mp_octets(ds->g.g->r);
362
363 gdsa_sign(&ds->g, &ss, GH_DONE(ds->s.h, 0), 0);
364 dstr_ensure(d, 2 * n);
365 mp_storeb(ss.r, d->buf, n);
366 mp_storeb(ss.s, d->buf + n, n);
367 d->len += 2 * n;
368 mp_drop(ss.r); mp_drop(ss.s);
369 return (0);
370}
371
372static const char *dsa_sigcheck(sig *s)
373{
374 dsa_sigctx *ds = (dsa_sigctx *)s;
375 const char *e;
376 if ((e = G_CHECK(ds->g.g, &rand_global)) != 0)
377 return (0);
378 if (group_check(ds->g.g, ds->g.p))
379 return ("public key not in subgroup");
380 return (0);
381}
382
383static void dsa_sigdestroy(sig *s)
384{
385 dsa_sigctx *ds = (dsa_sigctx *)s;
386 G_DESTROY(ds->g.g, ds->g.p);
387 mp_drop(ds->g.u);
388 G_DESTROYGROUP(ds->g.g);
ef13e9a4 389 DESTROY(ds);
5c3f75ec 390}
391
392static const sigops dsa_sig = {
393 dh_privfetch, sizeof(dh_priv),
394 dsa_siginit, dsa_sigdoit, dsa_sigcheck, dsa_sigdestroy
395};
396
3688eb75 397static const sigops bindsa_sig = {
398 dh_privfetch, sizeof(dh_priv),
399 bindsa_siginit, dsa_sigdoit, dsa_sigcheck, dsa_sigdestroy
400};
401
5c3f75ec 402static const sigops ecdsa_sig = {
403 ec_privfetch, sizeof(ec_priv),
404 ecdsa_siginit, dsa_sigdoit, dsa_sigcheck, dsa_sigdestroy
405};
406
407static sig *dsa_vrfinit(key *k, void *kd, const gchash *hc)
408{
409 dh_pub *dp = kd;
3688eb75 410 dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_prime, "prime");
411 return (&ds->s);
412}
413
414static sig *bindsa_vrfinit(key *k, void *kd, const gchash *hc)
415{
416 dh_pub *dp = kd;
417 dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_binary, "binary");
5c3f75ec 418 return (&ds->s);
419}
420
421static sig *ecdsa_vrfinit(key *k, void *kd, const gchash *hc)
422{
423 ec_pub *ep = kd;
424 dsa_sigctx *ds = ecdsa_doinit(k, ep->cstr, &ep->p, hc);
425 return (&ds->s);
426}
427
428static int dsa_vrfdoit(sig *s, dstr *d)
429{
430 dsa_sigctx *ds = (dsa_sigctx *)s;
431 gdsa_sig ss;
432 size_t n = d->len/2;
433 int rc;
434
435 ss.r = mp_loadb(MP_NEW, d->buf, n);
436 ss.s = mp_loadb(MP_NEW, d->buf + n, d->len - n);
437 rc = gdsa_verify(&ds->g, &ss, GH_DONE(ds->s.h, 0));
438 mp_drop(ss.r); mp_drop(ss.s);
439 return (rc);
440}
441
442static const sigops dsa_vrf = {
443 dh_pubfetch, sizeof(dh_pub),
444 dsa_vrfinit, dsa_vrfdoit, dsa_sigcheck, dsa_sigdestroy
445};
446
3688eb75 447static const sigops bindsa_vrf = {
448 dh_pubfetch, sizeof(dh_pub),
449 bindsa_vrfinit, dsa_vrfdoit, dsa_sigcheck, dsa_sigdestroy
450};
451
5c3f75ec 452static const sigops ecdsa_vrf = {
453 ec_pubfetch, sizeof(ec_pub),
454 ecdsa_vrfinit, dsa_vrfdoit, dsa_sigcheck, dsa_sigdestroy
455};
456
457/* --- KCDSA and ECKCDSA --- */
458
459static void kcdsa_privkey(dsa_sigctx *ds, mp *x)
460 { ds->g.u = mp_modinv(MP_NEW, x, ds->g.g->r); }
461
462static void kcdsa_sethash(dsa_sigctx *ds, const gchash *hc)
463 { ds->s.h = gkcdsa_beginhash(&ds->g); }
464
465static sig *kcdsa_siginit(key *k, void *kd, const gchash *hc)
466{
467 dh_priv *dp = kd;
3688eb75 468 dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_prime, "prime");
469 kcdsa_privkey(ds, dp->x);
470 kcdsa_sethash(ds, hc);
471 return (&ds->s);
472}
473
474static sig *binkcdsa_siginit(key *k, void *kd, const gchash *hc)
475{
476 dh_priv *dp = kd;
477 dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_binary, "binary");
5c3f75ec 478 kcdsa_privkey(ds, dp->x);
479 kcdsa_sethash(ds, hc);
480 return (&ds->s);
481}
482
483static sig *eckcdsa_siginit(key *k, void *kd, const gchash *hc)
484{
485 ec_priv *ep = kd;
486 dsa_sigctx *ds = ecdsa_doinit(k, ep->cstr, &ep->p, hc);
487 kcdsa_privkey(ds, ep->x);
488 kcdsa_sethash(ds, hc);
489 return (&ds->s);
490}
491
492static int kcdsa_sigdoit(sig *s, dstr *d)
493{
494 dsa_sigctx *ds = (dsa_sigctx *)s;
495 gkcdsa_sig ss = GKCDSA_SIG_INIT;
496 size_t hsz = ds->g.h->hashsz, n = mp_octets(ds->g.g->r);
497
498 gkcdsa_sign(&ds->g, &ss, GH_DONE(ds->s.h, 0), 0);
499 dstr_ensure(d, hsz + n);
500 memcpy(d->buf, ss.r, hsz);
501 mp_storeb(ss.s, d->buf + hsz, n);
502 d->len += hsz + n;
503 xfree(ss.r); mp_drop(ss.s);
504 return (0);
505}
506
507static const sigops kcdsa_sig = {
508 dh_privfetch, sizeof(dh_priv),
509 kcdsa_siginit, kcdsa_sigdoit, dsa_sigcheck, dsa_sigdestroy
510};
511
3688eb75 512static const sigops binkcdsa_sig = {
513 dh_privfetch, sizeof(dh_priv),
514 binkcdsa_siginit, kcdsa_sigdoit, dsa_sigcheck, dsa_sigdestroy
515};
516
5c3f75ec 517static const sigops eckcdsa_sig = {
518 ec_privfetch, sizeof(ec_priv),
519 eckcdsa_siginit, kcdsa_sigdoit, dsa_sigcheck, dsa_sigdestroy
520};
521
522static sig *kcdsa_vrfinit(key *k, void *kd, const gchash *hc)
523{
524 dh_pub *dp = kd;
3688eb75 525 dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_prime, "prime");
526 kcdsa_sethash(ds, hc);
527 return (&ds->s);
528}
529
530static sig *binkcdsa_vrfinit(key *k, void *kd, const gchash *hc)
531{
532 dh_pub *dp = kd;
533 dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_binary, "binary");
5c3f75ec 534 kcdsa_sethash(ds, hc);
535 return (&ds->s);
536}
537
538static sig *eckcdsa_vrfinit(key *k, void *kd, const gchash *hc)
539{
540 ec_pub *ep = kd;
541 dsa_sigctx *ds = ecdsa_doinit(k, ep->cstr, &ep->p, hc);
542 kcdsa_sethash(ds, hc);
543 return (&ds->s);
544}
545
546static int kcdsa_vrfdoit(sig *s, dstr *d)
547{
548 dsa_sigctx *ds = (dsa_sigctx *)s;
549 gkcdsa_sig ss;
550 size_t hsz = ds->g.h->hashsz, n = d->len - hsz;
551 int rc;
552
553 if (d->len < hsz)
554 return (-1);
555 ss.r = (octet *)d->buf;
556 ss.s = mp_loadb(MP_NEW, d->buf + hsz, n);
557 rc = gkcdsa_verify(&ds->g, &ss, GH_DONE(ds->s.h, 0));
558 mp_drop(ss.s);
559 return (rc);
560}
561
562static const sigops kcdsa_vrf = {
563 dh_pubfetch, sizeof(dh_pub),
564 kcdsa_vrfinit, kcdsa_vrfdoit, dsa_sigcheck, dsa_sigdestroy
565};
566
3688eb75 567static const sigops binkcdsa_vrf = {
568 dh_pubfetch, sizeof(dh_pub),
569 binkcdsa_vrfinit, kcdsa_vrfdoit, dsa_sigcheck, dsa_sigdestroy
570};
571
5c3f75ec 572static const sigops eckcdsa_vrf = {
573 ec_pubfetch, sizeof(ec_pub),
574 eckcdsa_vrfinit, kcdsa_vrfdoit, dsa_sigcheck, dsa_sigdestroy
575};
576
593f7bd3
MW		 577/* --- EdDSA --- */
578
579#define EDDSAS(_) \
580 _(ed25519, ED25519, "Ed25519", sha512)
581
582static sig *eddsa_siginit(key *k, void *kd, const gchash *hc)
583{
584 sig *s = CREATE(sig);
585 s->h = 0;
586 return (s);
587}
588
589static void eddsa_sigdestroy(sig *s) { DESTROY(s); }
590
591#define EDDSADEF(ed, ED, name, hash) \
592 \
593 static int ed##_sigdoit(sig *s, dstr *d) \
594 { \
595 ed##_priv *k = s->kd; \
596 \
597 dstr_ensure(d, ED##_SIGSZ); \
598 ed##_sign((octet *)d->buf, k->priv.k, k->priv.sz, k->pub.k, \
599 GH_DONE(s->h, 0), GH_CLASS(s->h)->hashsz); \
600 d->len += ED##_SIGSZ; \
601 return (0); \
602 } \
603 \
604 static const char *ed##_sigcheck(sig *s) \
605 { \
606 ed##_priv *k = s->kd; \
607 \
608 if (k->pub.sz != ED##_PUBSZ) \
609 return ("incorrect " #name " public key length"); \
610 return (0); \
611 } \
612 \
613 static const sigops ed##_sig = { \
614 ed##_privfetch, sizeof(ed##_priv), \
615 eddsa_siginit, ed##_sigdoit, ed##_sigcheck, eddsa_sigdestroy \
616 }; \
617 \
618 static int ed##_vrfdoit(sig *s, dstr *d) \
619 { \
620 ed##_pub *k = s->kd; \
621 \
622 if (d->len != ED##_SIGSZ) return (-1); \
623 return (ed##_verify(k->pub.k, \
624 GH_DONE(s->h, 0), GH_CLASS(s->h)->hashsz, \
625 (const octet *)d->buf)); \
626 } \
627 \
628 static const char *ed##_vrfcheck(sig *s) \
629 { \
630 ed##_pub *k = s->kd; \
631 \
632 if (k->pub.sz != ED##_PUBSZ) \
633 return ("incorrect " #name " public key length"); \
634 return (0); \
635 } \
636 \
637 static const sigops ed##_vrf = { \
638 ed##_pubfetch, sizeof(ed##_pub), \
639 eddsa_siginit, ed##_vrfdoit, ed##_vrfcheck, eddsa_sigdestroy \
640 };
641
642EDDSAS(EDDSADEF)
643#undef EDDSADEF
d56fd9d1 644
02dfbd5b
MW		 645/* --- Symmetric message authentication --- */
646
647typedef struct mac_ctx {
648 sig s;
649 const gcmac *mc;
650 gmac *m;
651 key_packdef kp;
652 key_bin kb;
653} mac_ctx;
654
655static sig *mac_init(key *k, void *kd, const gchash *hc)
656{
657 mac_ctx *m;
658 dstr d = DSTR_INIT;
659 int err;
660 const char *mm;
661
662 m = CREATE(mac_ctx);
663
664 key_fulltag(k, &d);
665 m->kp.e = KENC_BINARY;
666 m->kp.p = &m->kb;
667 m->kp.kd = 0;
668
669 if ((mm = key_getattr(0 /*yik*/, k, "mac")) == 0) {
670 dstr_putf(&d, "%s-hmac", hc->name);
671 mm = d.buf;
672 }
673 if ((m->mc = gmac_byname(mm)) == 0)
674 die(EXIT_FAILURE, "unknown message authentication scheme `%s'", mm);
675 dstr_reset(&d);
676
677 if ((err = key_unpack(&m->kp, kd, &d)) != 0) {
678 die(EXIT_FAILURE, "failed to unpack symmetric key `%s': %s",
679 d.buf, key_strerror(err));
680 }
681 dstr_destroy(&d);
682
683 if (keysz(m->kb.sz, m->mc->keysz) != m->kb.sz) {
684 die(EXIT_FAILURE, "bad key size %lu for `%s'",
685 (unsigned long)m->kb.sz, m->mc->name);
686 }
687 m->m = GM_KEY(m->mc, m->kb.k, m->kb.sz);
688 m->s.h = GM_INIT(m->m);
689 return (&m->s);
690}
691
692static int mac_sigdoit(sig *s, dstr *d)
693{
694 mac_ctx *m = (mac_ctx *)s;
695
696 dstr_ensure(d, m->mc->hashsz);
697 GH_DONE(m->s.h, d->buf);
698 d->len += m->mc->hashsz;
699 return (0);
700}
701
702static int mac_vrfdoit(sig *s, dstr *d)
703{
704 mac_ctx *m = (mac_ctx *)s;
705 const octet *t;
706
707 t = GH_DONE(m->s.h, 0);
da4489a6 708 if (d->len != m->mc->hashsz || !ct_memeq(d->buf, t, d->len))
02dfbd5b
MW		 709 return (-1);
710 return (0);
711}
712
713static const char *mac_check(sig *s) { return (0); }
714
715static void mac_destroy(sig *s)
716{
717 mac_ctx *m = (mac_ctx *)s;
718 GM_DESTROY(m->m);
719 key_unpackdone(&m->kp);
720}
721
722static const sigops mac_sig = {
723 0, 0,
724 mac_init, mac_sigdoit, mac_check, mac_destroy
725};
726
727static const sigops mac_vrf = {
728 0, 0,
729 mac_init, mac_vrfdoit, mac_check, mac_destroy
730};
731
5c3f75ec 732/* --- The switch table --- */
733
c65df279 734const struct sigtab sigtab[] = {
5c3f75ec 735 { "rsapkcs1", &rsap1_sig, &rsap1_vrf, &sha },
736 { "rsapss", &rsapss_sig, &rsapss_vrf, &sha },
737 { "dsa", &dsa_sig, &dsa_vrf, &sha },
3688eb75 738 { "bindsa", &bindsa_sig, &bindsa_vrf, &sha },
5c3f75ec 739 { "ecdsa", &ecdsa_sig, &ecdsa_vrf, &sha },
740 { "kcdsa", &kcdsa_sig, &kcdsa_vrf, &has160 },
3688eb75 741 { "binkcdsa", &binkcdsa_sig, &binkcdsa_vrf, &has160 },
5c3f75ec 742 { "eckcdsa", &eckcdsa_sig, &eckcdsa_vrf, &has160 },
593f7bd3
MW		 743#define EDDSATAB(ed, ED, name, hash) \
744 { #ed, &ed##_sig, &ed##_vrf, &hash },
745 EDDSAS(EDDSATAB)
746#undef EDDSATAB
02dfbd5b 747 { "mac", &mac_sig, &mac_vrf, &rmd160 },
5c3f75ec 748 { 0, 0, 0 }
749};
750
751/* --- @getsig@ --- *
752 *
753 * Arguments: @key *k@ = the key to load
754 * @const char *app@ = application name
755 * @int wantpriv@ = nonzero if we want to sign
756 *
757 * Returns: A signature-making thing.
758 *
759 * Use: Loads a key and starts hashing.
760 */
761
762sig *getsig(key *k, const char *app, int wantpriv)
763{
764 const char *salg, *halg = 0;
765 dstr d = DSTR_INIT;
766 dstr t = DSTR_INIT;
767 char *p = 0;
768 const char *q;
769 sig *s;
770 size_t n;
771 const struct sigtab *st;
772 const sigops *so;
773 const gchash *ch;
774 void *kd;
775 int e;
776 key_packdef *kp;
777
778 /* --- Setup stuff --- */
779
780 key_fulltag(k, &t);
781
782 /* --- Get the signature algorithm --- *
783 *
784 * Take the attribute if it's there; otherwise use the key type.
785 */
786
787 n = strlen(app);
788 if ((q = key_getattr(0, k, "sig")) != 0) {
789 dstr_puts(&d, q);
790 p = d.buf;
791 } else if (strncmp(k->type, app, n) == 0 && k->type[n] == '-') {
792 dstr_puts(&d, k->type);
793 p = d.buf + n + 1;
794 } else
795 die(EXIT_FAILURE, "no signature algorithm for key `%s'", t.buf);
796
797 /* --- Grab the hash algorithm --- *
798 *
799 * Grab it from the signature algorithm if it's there. But override that
800 * from the attribute.
801 */
802
803 salg = p;
804 if ((p = strchr(p, '/')) != 0) {
805 *p++ = 0;
806 halg = p;
807 }
808 if ((q = key_getattr(0, k, "hash")) != 0)
809 halg = q;
810
811 /* --- Look up the algorithms in the table --- */
812
813 for (st = sigtab; st->name; st++) {
814 if (strcmp(st->name, salg) == 0)
815 goto s_found;
816 }
817 die(EXIT_FAILURE, "signature algorithm `%s' not found in key `%s'",
818 salg, t.buf);
819s_found:;
820 if (!halg)
821 ch = st->ch;
822 else {
823 if ((ch = ghash_byname(halg)) == 0) {
824 die(EXIT_FAILURE, "hash algorithm `%s' not found in key `%s'",
825 halg, t.buf);
826 }
827 }
828 so = wantpriv ? st->signops : st->verifyops;
829
830 /* --- Load the key --- */
831
02dfbd5b
MW		 832 if (!so->kf) {
833 kd = k->k;
834 key_incref(kd);
78ec50fa 835 kp = 0;
02dfbd5b
MW		 836 } else {
837 kd = xmalloc(so->kdsz);
838 kp = key_fetchinit(so->kf, 0, kd);
839 if ((e = key_fetch(kp, k)) != 0) {
840 die(EXIT_FAILURE, "error fetching key `%s': %s",
841 t.buf, key_strerror(e));
842 }
843 }
5c3f75ec 844 s = so->init(k, kd, ch);
845 if (!s->h)
846 s->h = GH_INIT(ch);
847 s->kp = kp;
848 s->ops = so;
849 s->kd = kd;
02dfbd5b 850 s->ch = ch;
5c3f75ec 851
852 /* --- Free stuff up --- */
853
854 dstr_destroy(&d);
855 dstr_destroy(&t);
856 return (s);
857}
858
859/* --- @freesig@ --- *
860 *
861 * Arguments: @sig *s@ = signature-making thing
862 *
863 * Returns: ---
864 *
865 * Use: Frees up a signature-making thing
866 */
867
868void freesig(sig *s)
869{
870 GH_DESTROY(s->h);
02dfbd5b
MW		 871 if (!s->ops->kf)
872 key_drop(s->kd);
45c0fd36 873 else {
02dfbd5b
MW		 874 key_fetchdone(s->kp);
875 xfree(s->kd);
876 }
5c3f75ec 877 s->ops->destroy(s);
878}
879
880/*----- That's all, folks -------------------------------------------------*/
Catacomb cryptographic library