mdw@git.distorted.org.uk Git - catacomb/blob - progs/cc-sig.c

   1 /* -*-c-*-
   2  *
   3  * Catcrypt signatures
   4  *
   5  * (c) 2004 Straylight/Edgeware
   6  */
   7
   8 /*----- Licensing notice --------------------------------------------------*
   9  *
  10  * This file is part of Catacomb.
  11  *
  12  * Catacomb is free software; you can redistribute it and/or modify
  13  * it under the terms of the GNU Library General Public License as
  14  * published by the Free Software Foundation; either version 2 of the
  15  * License, or (at your option) any later version.
  16  *
  17  * Catacomb is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU Library General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU Library General Public
  23  * License along with Catacomb; if not, write to the Free
  24  * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
  25  * MA 02111-1307, USA.
  26  */
  27
  28 /*----- Header files ------------------------------------------------------*/
  29
  30 #define _FILE_OFFSET_BITS 64
  31
  32 #include <stdlib.h>
  33
  34 #include <mLib/macros.h>
  35 #include <mLib/report.h>
  36
  37 #include "rand.h"
  38 #include "sha.h"
  39 #include "has160.h"
  40 #include "sha512.h"
  41 #include "sha3.h"
  42
  43 #include "ct.h"
  44 #include "ec.h"
  45 #include "ec-keys.h"
  46 #include "dh.h"
  47 #include "gdsa.h"
  48 #include "gkcdsa.h"
  49 #include "rsa.h"
  50 #include "ed25519.h"
  51 #include "ed448.h"
  52
  53 #include "cc.h"
  54
  55 /*----- Main code ---------------------------------------------------------*/
  56
  57 /* --- RSA PKCS1 --- */
  58
  59 typedef struct rsap1_sigctx {
  60   sig s;
  61   rsa_privctx rp;
  62   pkcs1 p1;
  63 } rsap1_sigctx;
  64
  65 static sig *rsap1_siginit(key *k, void *kd, const gchash *hc)
  66 {
  67   rsap1_sigctx *rs = CREATE(rsap1_sigctx);
  68   rsa_privcreate(&rs->rp, kd, &rand_global);
  69   rs->p1.r = &rand_global;
  70   rs->p1.ep = hc->name;
  71   rs->p1.epsz = strlen(hc->name) + 1;
  72   rs->s.h = 0;
  73   return (&rs->s);
  74 }
  75
  76 static int rsap1_sigdoit(sig *s, dstr *d)
  77 {
  78   rsap1_sigctx *rs = (rsap1_sigctx *)s;
  79   size_t n;
  80   mp *m = rsa_sign(&rs->rp, MP_NEW,
  81                    GH_DONE(s->h, 0), GH_CLASS(s->h)->hashsz,
  82                    pkcs1_sigencode, &rs->p1);
  83   if (!m) return (-1);
  84   n = mp_octets(rs->rp.rp->n); dstr_ensure(d, n); mp_storeb(m, d->buf, n);
  85   d->len += n; mp_drop(m);
  86   return (0);
  87 }
  88
  89 static const char *rsa_lengthcheck(mp *n)
  90 {
  91   if (mp_bits(n) < 1024) return ("key too short");
  92   return (0);
  93 }
  94
  95 static const char *rsap1_sigcheck(sig *s)
  96 {
  97   rsap1_sigctx *rs = (rsap1_sigctx *)s;
  98   const char *e;
  99   if ((e = rsa_lengthcheck(rs->rp.rp->n)) != 0) return (e);
 100   return (0);
 101 }
 102
 103 static void rsap1_sigdestroy(sig *s)
 104 {
 105   rsap1_sigctx *rs = (rsap1_sigctx *)s;
 106   rsa_privdestroy(&rs->rp);
 107   DESTROY(rs);
 108 }
 109
 110 static const sigops rsap1_sig = {
 111   rsa_privfetch, sizeof(rsa_priv),
 112   rsap1_siginit, rsap1_sigdoit, rsap1_sigcheck, rsap1_sigdestroy
 113 };
 114
 115 typedef struct rsap1_vrfctx {
 116   sig s;
 117   rsa_pubctx rp;
 118   pkcs1 p1;
 119 } rsap1_vrfctx;
 120
 121 static sig *rsap1_vrfinit(key *k, void *kd, const gchash *hc)
 122 {
 123   rsap1_vrfctx *rv = CREATE(rsap1_vrfctx);
 124   rsa_pubcreate(&rv->rp, kd);
 125   rv->p1.r = &rand_global;
 126   rv->p1.ep = hc->name;
 127   rv->p1.epsz = strlen(hc->name) + 1;
 128   rv->s.h = 0;
 129   return (&rv->s);
 130 }
 131
 132 static int rsap1_vrfdoit(sig *s, dstr *d)
 133 {
 134   rsap1_vrfctx *rv = (rsap1_vrfctx *)s;
 135   mp *m = mp_loadb(MP_NEW, d->buf, d->len);
 136   int rc = rsa_verify(&rv->rp, m,
 137                       GH_DONE(s->h, 0), GH_CLASS(s->h)->hashsz,
 138                       0, pkcs1_sigdecode, &rv->p1);
 139   mp_drop(m);
 140   return (rc);
 141 }
 142
 143 static const char *rsap1_vrfcheck(sig *s)
 144 {
 145   rsap1_vrfctx *rv = (rsap1_vrfctx *)s;
 146   const char *e;
 147   if ((e = rsa_lengthcheck(rv->rp.rp->n)) != 0) return (e);
 148   return (0);
 149 }
 150
 151 static void rsap1_vrfdestroy(sig *s)
 152 {
 153   rsap1_vrfctx *rv = (rsap1_vrfctx *)s;
 154   rsa_pubdestroy(&rv->rp);
 155   DESTROY(rv);
 156 }
 157
 158 static const sigops rsap1_vrf = {
 159   rsa_pubfetch, sizeof(rsa_pub),
 160   rsap1_vrfinit, rsap1_vrfdoit, rsap1_vrfcheck, rsap1_vrfdestroy
 161 };
 162
 163 /* --- RSA PSS --- */
 164
 165 static const gccipher *getmgf(key *k, const gchash *hc)
 166 {
 167   dstr d = DSTR_INIT;
 168   const gccipher *gc;
 169   const char *mm;
 170
 171   if ((mm = key_getattr(0, k, "mgf")) == 0) {
 172     dstr_putf(&d, "%s-mgf", hc->name);
 173     mm = d.buf;
 174   }
 175   if ((gc = gcipher_byname(mm)) == 0)
 176     die(EXIT_FAILURE, "unknown encryption scheme `%s'", mm);
 177   dstr_destroy(&d);
 178   return (gc);
 179 }
 180
 181 typedef struct rsapss_sigctx {
 182   sig s;
 183   rsa_privctx rp;
 184   pss p;
 185 } rsapss_sigctx;
 186
 187 static sig *rsapss_siginit(key *k, void *kd, const gchash *hc)
 188 {
 189   rsapss_sigctx *rs = CREATE(rsapss_sigctx);
 190   rsa_privcreate(&rs->rp, kd, &rand_global);
 191   rs->s.h = 0;
 192   rs->p.r = &rand_global;
 193   rs->p.cc = getmgf(k, hc);
 194   rs->p.ch = hc;
 195   rs->p.ssz = hc->hashsz;
 196   return (&rs->s);
 197 }
 198
 199 static int rsapss_sigdoit(sig *s, dstr *d)
 200 {
 201   rsapss_sigctx *rs = (rsapss_sigctx *)s;
 202   size_t n;
 203   mp *m = rsa_sign(&rs->rp, MP_NEW,
 204                    GH_DONE(s->h, 0), GH_CLASS(s->h)->hashsz,
 205                    pss_encode, &rs->p);
 206   if (!m) return (-1);
 207   n = mp_octets(rs->rp.rp->n); dstr_ensure(d, n); mp_storeb(m, d->buf, n);
 208   d->len += n;  mp_drop(m);
 209   return (0);
 210 }
 211
 212 static const char *rsapss_sigcheck(sig *s)
 213 {
 214   rsapss_sigctx *rs = (rsapss_sigctx *)s;
 215   const char *e;
 216   if ((e = rsa_lengthcheck(rs->rp.rp->n)) != 0) return (e);
 217   return (0);
 218 }
 219
 220 static void rsapss_sigdestroy(sig *s)
 221 {
 222   rsapss_sigctx *rs = (rsapss_sigctx *)s;
 223   rsa_privdestroy(&rs->rp);
 224   DESTROY(rs);
 225 }
 226
 227 static const sigops rsapss_sig = {
 228   rsa_privfetch, sizeof(rsa_priv),
 229   rsapss_siginit, rsapss_sigdoit, rsapss_sigcheck, rsapss_sigdestroy
 230 };
 231
 232 typedef struct rsapss_vrfctx {
 233   sig s;
 234   rsa_pubctx rp;
 235   pss p;
 236 } rsapss_vrfctx;
 237
 238 static sig *rsapss_vrfinit(key *k, void *kd, const gchash *hc)
 239 {
 240   rsapss_vrfctx *rv = CREATE(rsapss_vrfctx);
 241   rsa_pubcreate(&rv->rp, kd);
 242   rv->s.h = 0;
 243   rv->p.r = &rand_global;
 244   rv->p.cc = getmgf(k, hc);
 245   rv->p.ch = hc;
 246   rv->p.ssz = hc->hashsz;
 247   return (&rv->s);
 248 }
 249
 250 static int rsapss_vrfdoit(sig *s, dstr *d)
 251 {
 252   rsapss_vrfctx *rv = (rsapss_vrfctx *)s;
 253   mp *m = mp_loadb(MP_NEW, d->buf, d->len);
 254   int rc = rsa_verify(&rv->rp, m,
 255                       GH_DONE(s->h, 0), GH_CLASS(s->h)->hashsz,
 256                       0, pss_decode, &rv->p);
 257   mp_drop(m);
 258   return (rc);
 259 }
 260
 261 static const char *rsapss_vrfcheck(sig *s)
 262 {
 263   rsapss_vrfctx *rv = (rsapss_vrfctx *)s;
 264   const char *e;
 265   if ((e = rsa_lengthcheck(rv->rp.rp->n)) != 0) return (e);
 266   return (0);
 267 }
 268
 269 static void rsapss_vrfdestroy(sig *s)
 270 {
 271   rsapss_vrfctx *rv = (rsapss_vrfctx *)s;
 272   rsa_pubdestroy(&rv->rp);
 273   DESTROY(rv);
 274 }
 275
 276 static const sigops rsapss_vrf = {
 277   rsa_pubfetch, sizeof(rsa_pub),
 278   rsapss_vrfinit, rsapss_vrfdoit, rsapss_vrfcheck, rsapss_vrfdestroy
 279 };
 280
 281 /* --- DSA and ECDSA --- */
 282
 283 typedef struct dsa_sigctx {
 284   sig s;
 285   gdsa g;
 286 } dsa_sigctx;
 287
 288 static void dsa_initcommon(dsa_sigctx *ds, const gchash *hc,
 289                            const char *ktag)
 290 {
 291   ds->g.r = &rand_global;
 292   ds->g.h = hc;
 293   ds->g.u = MP_NEW;
 294   ds->s.h = 0;
 295 }
 296
 297 static dsa_sigctx *dsa_doinit(key *k, const gprime_param *gp,
 298                               mp *y, const gchash *hc,
 299                               group *(*makegroup)(const gprime_param *),
 300                               const char *what)
 301 {
 302   dsa_sigctx *ds = CREATE(dsa_sigctx);
 303   dstr t = DSTR_INIT;
 304
 305   key_fulltag(k, &t);
 306   if ((ds->g.g = makegroup(gp)) == 0)
 307     die(EXIT_FAILURE, "bad %s group in key `%s'", what, t.buf);
 308   ds->g.p = G_CREATE(ds->g.g);
 309   if (G_FROMINT(ds->g.g, ds->g.p, y))
 310     die(EXIT_FAILURE, "bad public key in key `%s'", t.buf);
 311   dsa_initcommon(ds, hc, t.buf);
 312   dstr_destroy(&t);
 313   return (ds);
 314 }
 315
 316 static dsa_sigctx *ecdsa_doinit(key *k, const char *cstr,
 317                                 ec *y, const gchash *hc)
 318 {
 319   dsa_sigctx *ds = CREATE(dsa_sigctx);
 320   ec_info ei;
 321   const char *e;
 322   dstr t = DSTR_INIT;
 323
 324   key_fulltag(k, &t);
 325   if ((e = ec_getinfo(&ei, cstr)) != 0)
 326     die(EXIT_FAILURE, "bad curve in key `%s': %s", t.buf, e);
 327   ds->g.g = group_ec(&ei);
 328   ds->g.p = G_CREATE(ds->g.g);
 329   if (G_FROMEC(ds->g.g, ds->g.p, y))
 330     die(EXIT_FAILURE, "bad public key in key `%s'", t.buf);
 331   dsa_initcommon(ds, hc, t.buf);
 332   dstr_destroy(&t);
 333   return (ds);
 334 }
 335
 336 static sig *dsa_siginit(key *k, void *kd, const gchash *hc)
 337 {
 338   dh_priv *dp = kd;
 339   dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_prime, "prime");
 340   ds->g.u = MP_COPY(dp->x);
 341   return (&ds->s);
 342 }
 343
 344 static sig *bindsa_siginit(key *k, void *kd, const gchash *hc)
 345 {
 346   dh_priv *dp = kd;
 347   dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_binary, "binary");
 348   ds->g.u = MP_COPY(dp->x);
 349   return (&ds->s);
 350 }
 351
 352 static sig *ecdsa_siginit(key *k, void *kd, const gchash *hc)
 353 {
 354   ec_priv *ep = kd;
 355   dsa_sigctx *ds = ecdsa_doinit(k, ep->cstr, &ep->p, hc);
 356   ds->g.u = MP_COPY(ep->x);
 357   return (&ds->s);
 358 }
 359
 360 static int dsa_sigdoit(sig *s, dstr *d)
 361 {
 362   dsa_sigctx *ds = (dsa_sigctx *)s;
 363   gdsa_sig ss = GDSA_SIG_INIT;
 364   size_t n = mp_octets(ds->g.g->r);
 365
 366   gdsa_sign(&ds->g, &ss, GH_DONE(ds->s.h, 0), 0);
 367   dstr_ensure(d, 2 * n);
 368   mp_storeb(ss.r, d->buf, n);
 369   mp_storeb(ss.s, d->buf + n, n);
 370   d->len += 2 * n;
 371   mp_drop(ss.r); mp_drop(ss.s);
 372   return (0);
 373 }
 374
 375 static const char *dsa_sigcheck(sig *s)
 376 {
 377   dsa_sigctx *ds = (dsa_sigctx *)s;
 378   const char *e;
 379   if ((e = G_CHECK(ds->g.g, &rand_global)) != 0)
 380     return (0);
 381   if (group_check(ds->g.g, ds->g.p))
 382     return ("public key not in subgroup");
 383   return (0);
 384 }
 385
 386 static void dsa_sigdestroy(sig *s)
 387 {
 388   dsa_sigctx *ds = (dsa_sigctx *)s;
 389   G_DESTROY(ds->g.g, ds->g.p);
 390   mp_drop(ds->g.u);
 391   G_DESTROYGROUP(ds->g.g);
 392   DESTROY(ds);
 393 }
 394
 395 static const sigops dsa_sig = {
 396   dh_privfetch, sizeof(dh_priv),
 397   dsa_siginit, dsa_sigdoit, dsa_sigcheck, dsa_sigdestroy
 398 };
 399
 400 static const sigops bindsa_sig = {
 401   dh_privfetch, sizeof(dh_priv),
 402   bindsa_siginit, dsa_sigdoit, dsa_sigcheck, dsa_sigdestroy
 403 };
 404
 405 static const sigops ecdsa_sig = {
 406   ec_privfetch, sizeof(ec_priv),
 407   ecdsa_siginit, dsa_sigdoit, dsa_sigcheck, dsa_sigdestroy
 408 };
 409
 410 static sig *dsa_vrfinit(key *k, void *kd, const gchash *hc)
 411 {
 412   dh_pub *dp = kd;
 413   dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_prime, "prime");
 414   return (&ds->s);
 415 }
 416
 417 static sig *bindsa_vrfinit(key *k, void *kd, const gchash *hc)
 418 {
 419   dh_pub *dp = kd;
 420   dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_binary, "binary");
 421   return (&ds->s);
 422 }
 423
 424 static sig *ecdsa_vrfinit(key *k, void *kd, const gchash *hc)
 425 {
 426   ec_pub *ep = kd;
 427   dsa_sigctx *ds = ecdsa_doinit(k, ep->cstr, &ep->p, hc);
 428   return (&ds->s);
 429 }
 430
 431 static int dsa_vrfdoit(sig *s, dstr *d)
 432 {
 433   dsa_sigctx *ds = (dsa_sigctx *)s;
 434   gdsa_sig ss;
 435   size_t n = d->len/2;
 436   int rc;
 437
 438   ss.r = mp_loadb(MP_NEW, d->buf, n);
 439   ss.s = mp_loadb(MP_NEW, d->buf + n, d->len - n);
 440   rc = gdsa_verify(&ds->g, &ss, GH_DONE(ds->s.h, 0));
 441   mp_drop(ss.r); mp_drop(ss.s);
 442   return (rc);
 443 }
 444
 445 static const sigops dsa_vrf = {
 446   dh_pubfetch, sizeof(dh_pub),
 447   dsa_vrfinit, dsa_vrfdoit, dsa_sigcheck, dsa_sigdestroy
 448 };
 449
 450 static const sigops bindsa_vrf = {
 451   dh_pubfetch, sizeof(dh_pub),
 452   bindsa_vrfinit, dsa_vrfdoit, dsa_sigcheck, dsa_sigdestroy
 453 };
 454
 455 static const sigops ecdsa_vrf = {
 456   ec_pubfetch, sizeof(ec_pub),
 457   ecdsa_vrfinit, dsa_vrfdoit, dsa_sigcheck, dsa_sigdestroy
 458 };
 459
 460 /* --- KCDSA and ECKCDSA --- */
 461
 462 static void kcdsa_privkey(dsa_sigctx *ds, mp *x)
 463   { ds->g.u = mp_modinv(MP_NEW, x, ds->g.g->r); }
 464
 465 static void kcdsa_sethash(dsa_sigctx *ds, const gchash *hc)
 466   { ds->s.h = gkcdsa_beginhash(&ds->g); }
 467
 468 static sig *kcdsa_siginit(key *k, void *kd, const gchash *hc)
 469 {
 470   dh_priv *dp = kd;
 471   dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_prime, "prime");
 472   kcdsa_privkey(ds, dp->x);
 473   kcdsa_sethash(ds, hc);
 474   return (&ds->s);
 475 }
 476
 477 static sig *binkcdsa_siginit(key *k, void *kd, const gchash *hc)
 478 {
 479   dh_priv *dp = kd;
 480   dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_binary, "binary");
 481   kcdsa_privkey(ds, dp->x);
 482   kcdsa_sethash(ds, hc);
 483   return (&ds->s);
 484 }
 485
 486 static sig *eckcdsa_siginit(key *k, void *kd, const gchash *hc)
 487 {
 488   ec_priv *ep = kd;
 489   dsa_sigctx *ds = ecdsa_doinit(k, ep->cstr, &ep->p, hc);
 490   kcdsa_privkey(ds, ep->x);
 491   kcdsa_sethash(ds, hc);
 492   return (&ds->s);
 493 }
 494
 495 static int kcdsa_sigdoit(sig *s, dstr *d)
 496 {
 497   dsa_sigctx *ds = (dsa_sigctx *)s;
 498   gkcdsa_sig ss = GKCDSA_SIG_INIT;
 499   size_t hsz = ds->g.h->hashsz, n = mp_octets(ds->g.g->r);
 500
 501   gkcdsa_sign(&ds->g, &ss, GH_DONE(ds->s.h, 0), 0);
 502   dstr_ensure(d, hsz + n);
 503   memcpy(d->buf, ss.r, hsz);
 504   mp_storeb(ss.s, d->buf + hsz, n);
 505   d->len += hsz + n;
 506   xfree(ss.r); mp_drop(ss.s);
 507   return (0);
 508 }
 509
 510 static const sigops kcdsa_sig = {
 511   dh_privfetch, sizeof(dh_priv),
 512   kcdsa_siginit, kcdsa_sigdoit, dsa_sigcheck, dsa_sigdestroy
 513 };
 514
 515 static const sigops binkcdsa_sig = {
 516   dh_privfetch, sizeof(dh_priv),
 517   binkcdsa_siginit, kcdsa_sigdoit, dsa_sigcheck, dsa_sigdestroy
 518 };
 519
 520 static const sigops eckcdsa_sig = {
 521   ec_privfetch, sizeof(ec_priv),
 522   eckcdsa_siginit, kcdsa_sigdoit, dsa_sigcheck, dsa_sigdestroy
 523 };
 524
 525 static sig *kcdsa_vrfinit(key *k, void *kd, const gchash *hc)
 526 {
 527   dh_pub *dp = kd;
 528   dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_prime, "prime");
 529   kcdsa_sethash(ds, hc);
 530   return (&ds->s);
 531 }
 532
 533 static sig *binkcdsa_vrfinit(key *k, void *kd, const gchash *hc)
 534 {
 535   dh_pub *dp = kd;
 536   dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_binary, "binary");
 537   kcdsa_sethash(ds, hc);
 538   return (&ds->s);
 539 }
 540
 541 static sig *eckcdsa_vrfinit(key *k, void *kd, const gchash *hc)
 542 {
 543   ec_pub *ep = kd;
 544   dsa_sigctx *ds = ecdsa_doinit(k, ep->cstr, &ep->p, hc);
 545   kcdsa_sethash(ds, hc);
 546   return (&ds->s);
 547 }
 548
 549 static int kcdsa_vrfdoit(sig *s, dstr *d)
 550 {
 551   dsa_sigctx *ds = (dsa_sigctx *)s;
 552   gkcdsa_sig ss;
 553   size_t hsz = ds->g.h->hashsz, n = d->len - hsz;
 554   int rc;
 555
 556   if (d->len < hsz)
 557     return (-1);
 558   ss.r = (octet *)d->buf;
 559   ss.s = mp_loadb(MP_NEW, d->buf + hsz, n);
 560   rc = gkcdsa_verify(&ds->g, &ss, GH_DONE(ds->s.h, 0));
 561   mp_drop(ss.s);
 562   return (rc);
 563 }
 564
 565 static const sigops kcdsa_vrf = {
 566   dh_pubfetch, sizeof(dh_pub),
 567   kcdsa_vrfinit, kcdsa_vrfdoit, dsa_sigcheck, dsa_sigdestroy
 568 };
 569
 570 static const sigops binkcdsa_vrf = {
 571   dh_pubfetch, sizeof(dh_pub),
 572   binkcdsa_vrfinit, kcdsa_vrfdoit, dsa_sigcheck, dsa_sigdestroy
 573 };
 574
 575 static const sigops eckcdsa_vrf = {
 576   ec_pubfetch, sizeof(ec_pub),
 577   eckcdsa_vrfinit, kcdsa_vrfdoit, dsa_sigcheck, dsa_sigdestroy
 578 };
 579
 580 /* --- EdDSA --- */
 581
 582 #define EDDSAS(_)                                                       \
 583   _(ed25519, ed25519ctx, ED25519, "Ed25519", sha512)                    \
 584   _(ed448, ed448, ED448, "Ed448", shake256)
 585
 586 typedef struct eddsa_sigctx {
 587   sig s;
 588   const char *perso;
 589 } eddsa_sigctx;
 590
 591 static sig *eddsa_siginit(key *k, void *kd, const gchash *hc)
 592 {
 593   eddsa_sigctx *es = CREATE(eddsa_sigctx);
 594   es->s.h = 0;
 595   es->perso = key_getattr(0, k, "perso");
 596   if (es->perso && strlen(es->perso) > ED25519_MAXPERSOSZ) {
 597     die(1, "EdDSA personalization string too long (max length %d)",
 598         ED25519_MAXPERSOSZ);
 599   }
 600   return (&es->s);
 601 }
 602
 603 static void eddsa_sigdestroy(sig *s)
 604   { eddsa_sigctx *es = (eddsa_sigctx *)s; DESTROY(es); }
 605
 606 #define EDDSADEF(ed, sigver, ED, name, hash)                            \
 607                                                                         \
 608   static int ed##_sigdoit(sig *s, dstr *d)                              \
 609   {                                                                     \
 610     eddsa_sigctx *es = (eddsa_sigctx *)s;                               \
 611     ed##_priv *k = es->s.kd;                                            \
 612                                                                         \
 613     dstr_ensure(d, ED##_SIGSZ);                                         \
 614     sigver##_sign((octet *)d->buf, k->priv.k, k->priv.sz, k->pub.k,     \
 615                   es->perso ? 1 : -1, es->perso,                        \
 616                   es->perso ? strlen(es->perso) : 0,                    \
 617                   GH_DONE(es->s.h, 0), GH_CLASS(es->s.h)->hashsz);      \
 618     d->len += ED##_SIGSZ;                                               \
 619     return (0);                                                         \
 620   }                                                                     \
 621                                                                         \
 622   static const char *ed##_sigcheck(sig *s)                              \
 623   {                                                                     \
 624     eddsa_sigctx *es = (eddsa_sigctx *)s;                               \
 625     ed##_priv *k = es->s.kd;                                            \
 626                                                                         \
 627     if (k->pub.sz != ED##_PUBSZ)                                        \
 628       return ("incorrect " #name " public key length");                 \
 629     return (0);                                                         \
 630   }                                                                     \
 631                                                                         \
 632   static const sigops ed##_sig = {                                      \
 633     ed##_privfetch, sizeof(ed##_priv),                                  \
 634     eddsa_siginit, ed##_sigdoit, ed##_sigcheck, eddsa_sigdestroy        \
 635   };                                                                    \
 636                                                                         \
 637   static int ed##_vrfdoit(sig *s, dstr *d)                              \
 638   {                                                                     \
 639     eddsa_sigctx *es = (eddsa_sigctx *)s;                               \
 640     ed##_pub *k = es->s.kd;                                             \
 641                                                                         \
 642     if (d->len != ED##_SIGSZ) return (-1);                              \
 643     return (sigver##_verify(k->pub.k,                                   \
 644                             es->perso ? 1 : -1, es->perso,              \
 645                             es->perso ? strlen(es->perso) : 0,          \
 646                             GH_DONE(s->h, 0), GH_CLASS(s->h)->hashsz,   \
 647                             (const octet *)d->buf));                    \
 648   }                                                                     \
 649                                                                         \
 650   static const char *ed##_vrfcheck(sig *s)                              \
 651   {                                                                     \
 652     ed##_pub *k = s->kd;                                                \
 653                                                                         \
 654     if (k->pub.sz != ED##_PUBSZ)                                        \
 655       return ("incorrect " #name " public key length");                 \
 656     return (0);                                                         \
 657   }                                                                     \
 658                                                                         \
 659   static const sigops ed##_vrf = {                                      \
 660     ed##_pubfetch, sizeof(ed##_pub),                                    \
 661     eddsa_siginit, ed##_vrfdoit, ed##_vrfcheck, eddsa_sigdestroy        \
 662   };
 663
 664 EDDSAS(EDDSADEF)
 665 #undef EDDSADEF
 666
 667 /* --- Symmetric message authentication --- */
 668
 669 typedef struct mac_ctx {
 670   sig s;
 671   const gcmac *mc;
 672   gmac *m;
 673   key_packdef kp;
 674   key_bin kb;
 675 } mac_ctx;
 676
 677 static sig *mac_init(key *k, void *kd, const gchash *hc)
 678 {
 679   mac_ctx *m;
 680   dstr d = DSTR_INIT;
 681   int err;
 682   const char *mm;
 683
 684   m = CREATE(mac_ctx);
 685
 686   key_fulltag(k, &d);
 687   m->kp.e = KENC_BINARY;
 688   m->kp.p = &m->kb;
 689   m->kp.kd = 0;
 690
 691   if ((mm = key_getattr(0 /*yik*/, k, "mac")) == 0) {
 692     dstr_putf(&d, "%s-hmac", hc->name);
 693     mm = d.buf;
 694   }
 695   if ((m->mc = gmac_byname(mm)) == 0)
 696     die(EXIT_FAILURE, "unknown message authentication scheme `%s'", mm);
 697   dstr_reset(&d);
 698
 699   if ((err = key_unpack(&m->kp, kd, &d)) != 0) {
 700     die(EXIT_FAILURE, "failed to unpack symmetric key `%s': %s",
 701         d.buf, key_strerror(err));
 702   }
 703   dstr_destroy(&d);
 704
 705   if (keysz(m->kb.sz, m->mc->keysz) != m->kb.sz) {
 706     die(EXIT_FAILURE, "bad key size %lu for `%s'",
 707         (unsigned long)m->kb.sz, m->mc->name);
 708   }
 709   m->m = GM_KEY(m->mc, m->kb.k, m->kb.sz);
 710   m->s.h = GM_INIT(m->m);
 711   return (&m->s);
 712 }
 713
 714 static int mac_sigdoit(sig *s, dstr *d)
 715 {
 716   mac_ctx *m = (mac_ctx *)s;
 717
 718   dstr_ensure(d, m->mc->hashsz);
 719   GH_DONE(m->s.h, d->buf);
 720   d->len += m->mc->hashsz;
 721   return (0);
 722 }
 723
 724 static int mac_vrfdoit(sig *s, dstr *d)
 725 {
 726   mac_ctx *m = (mac_ctx *)s;
 727   const octet *t;
 728
 729   t = GH_DONE(m->s.h, 0);
 730   if (d->len != m->mc->hashsz || !ct_memeq(d->buf, t, d->len))
 731     return (-1);
 732   return (0);
 733 }
 734
 735 static const char *mac_check(sig *s) { return (0); }
 736
 737 static void mac_destroy(sig *s)
 738 {
 739   mac_ctx *m = (mac_ctx *)s;
 740   GM_DESTROY(m->m);
 741   key_unpackdone(&m->kp);
 742 }
 743
 744 static const sigops mac_sig = {
 745   0, 0,
 746   mac_init, mac_sigdoit, mac_check, mac_destroy
 747 };
 748
 749 static const sigops mac_vrf = {
 750   0, 0,
 751   mac_init, mac_vrfdoit, mac_check, mac_destroy
 752 };
 753
 754 /* --- The switch table --- */
 755
 756 const struct sigtab sigtab[] = {
 757   { "rsapkcs1", &rsap1_sig,     &rsap1_vrf,     &sha },
 758   { "rsapss",   &rsapss_sig,    &rsapss_vrf,    &sha },
 759   { "dsa",      &dsa_sig,       &dsa_vrf,       &sha },
 760   { "bindsa",   &bindsa_sig,    &bindsa_vrf,    &sha },
 761   { "ecdsa",    &ecdsa_sig,     &ecdsa_vrf,     &sha },
 762   { "kcdsa",    &kcdsa_sig,     &kcdsa_vrf,     &has160 },
 763   { "binkcdsa", &binkcdsa_sig,  &binkcdsa_vrf,  &has160 },
 764   { "eckcdsa",  &eckcdsa_sig,   &eckcdsa_vrf,   &has160 },
 765 #define EDDSATAB(ed, sigver, ED, name, hash)                            \
 766   { #ed,        &ed##_sig,      &ed##_vrf,      &hash },
 767   EDDSAS(EDDSATAB)
 768 #undef EDDSATAB
 769   { "mac",      &mac_sig,       &mac_vrf,       &rmd160 },
 770   { 0,          0,              0 }
 771 };
 772
 773 /* --- @getsig@ --- *
 774  *
 775  * Arguments:   @key *k@ = the key to load
 776  *              @const char *app@ = application name
 777  *              @int wantpriv@ = nonzero if we want to sign
 778  *
 779  * Returns:     A signature-making thing.
 780  *
 781  * Use:         Loads a key and starts hashing.
 782  */
 783
 784 sig *getsig(key *k, const char *app, int wantpriv)
 785 {
 786   const char *salg, *halg = 0;
 787   dstr d = DSTR_INIT;
 788   dstr t = DSTR_INIT;
 789   char *p = 0;
 790   const char *q;
 791   sig *s;
 792   size_t n;
 793   const struct sigtab *st;
 794   const sigops *so;
 795   const gchash *ch;
 796   void *kd;
 797   int e;
 798   key_packdef *kp;
 799
 800   /* --- Setup stuff --- */
 801
 802   key_fulltag(k, &t);
 803
 804   /* --- Get the signature algorithm --- *
 805    *
 806    * Take the attribute if it's there; otherwise use the key type.
 807    */
 808
 809   n = strlen(app);
 810   if ((q = key_getattr(0, k, "sig")) != 0) {
 811     dstr_puts(&d, q);
 812     p = d.buf;
 813   } else if (STRNCMP(k->type, ==, app, n) && k->type[n] == '-') {
 814     dstr_puts(&d, k->type);
 815     p = d.buf + n + 1;
 816   } else
 817     die(EXIT_FAILURE, "no signature algorithm for key `%s'", t.buf);
 818
 819   /* --- Grab the hash algorithm --- *
 820    *
 821    * Grab it from the signature algorithm if it's there.  But override that
 822    * from the attribute.
 823    */
 824
 825   salg = p;
 826   if ((p = strchr(p, '/')) != 0) {
 827     *p++ = 0;
 828     halg = p;
 829   }
 830   if ((q = key_getattr(0, k, "hash")) != 0)
 831     halg = q;
 832
 833   /* --- Look up the algorithms in the table --- */
 834
 835   for (st = sigtab; st->name; st++) {
 836     if (STRCMP(st->name, ==, salg))
 837       goto s_found;
 838   }
 839   die(EXIT_FAILURE, "signature algorithm `%s' not found in key `%s'",
 840       salg, t.buf);
 841 s_found:;
 842   if (!halg)
 843     ch = st->ch;
 844   else {
 845     if ((ch = ghash_byname(halg)) == 0) {
 846       die(EXIT_FAILURE, "hash algorithm `%s' not found in key `%s'",
 847           halg, t.buf);
 848     }
 849   }
 850   so = wantpriv ? st->signops : st->verifyops;
 851
 852   /* --- Load the key --- */
 853
 854   if (!so->kf) {
 855     kd = k->k;
 856     key_incref(kd);
 857     kp = 0;
 858   } else {
 859     kd = xmalloc(so->kdsz);
 860     kp = key_fetchinit(so->kf, 0, kd);
 861     if ((e = key_fetch(kp, k)) != 0) {
 862       die(EXIT_FAILURE, "error fetching key `%s': %s",
 863           t.buf, key_strerror(e));
 864     }
 865   }
 866   s = so->init(k, kd, ch);
 867   if (!s->h)
 868     s->h = GH_INIT(ch);
 869   s->kp = kp;
 870   s->ops = so;
 871   s->kd = kd;
 872   s->ch = ch;
 873
 874   /* --- Free stuff up --- */
 875
 876   dstr_destroy(&d);
 877   dstr_destroy(&t);
 878   return (s);
 879 }
 880
 881 /* --- @freesig@ --- *
 882  *
 883  * Arguments:   @sig *s@ = signature-making thing
 884  *
 885  * Returns:     ---
 886  *
 887  * Use:         Frees up a signature-making thing
 888  */
 889
 890 void freesig(sig *s)
 891 {
 892   GH_DESTROY(s->h);
 893   if (!s->ops->kf)
 894     key_drop(s->kd);
 895   else {
 896     key_fetchdone(s->kp);
 897     xfree(s->kd);
 898   }
 899   s->ops->destroy(s);
 900 }
 901
 902 /*----- That's all, folks -------------------------------------------------*/