~mdw / catacomb / blob
? search:


a416c6e51235a0da9e9a92680fd891bafde056fb
[catacomb] / progs / cc-sig.c
1 /* -*-c-*-
2 *
3 * Catcrypt signatures
4 *
5 * (c) 2004 Straylight/Edgeware
6 */
7
8 /*----- Licensing notice --------------------------------------------------*
9 *
10 * This file is part of Catacomb.
11 *
12 * Catacomb is free software; you can redistribute it and/or modify
13 * it under the terms of the GNU Library General Public License as
14 * published by the Free Software Foundation; either version 2 of the
15 * License, or (at your option) any later version.
16 *
17 * Catacomb is distributed in the hope that it will be useful,
18 * but WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 * GNU Library General Public License for more details.
21 *
22 * You should have received a copy of the GNU Library General Public
23 * License along with Catacomb; if not, write to the Free
24 * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
25 * MA 02111-1307, USA.
26 */
27
28 /*----- Header files ------------------------------------------------------*/
29
30 #define _FILE_OFFSET_BITS 64
31
32 #include <stdlib.h>
33
34 #include <mLib/report.h>
35
36 #include "rand.h"
37 #include "sha.h"
38 #include "has160.h"
39 #include "sha512.h"
40 #include "sha3.h"
41
42 #include "ct.h"
43 #include "ec.h"
44 #include "ec-keys.h"
45 #include "dh.h"
46 #include "gdsa.h"
47 #include "gkcdsa.h"
48 #include "rsa.h"
49 #include "ed25519.h"
50 #include "ed448.h"
51
52 #include "cc.h"
53
54 /*----- Main code ---------------------------------------------------------*/
55
56 /* --- RSA PKCS1 --- */
57
58 typedef struct rsap1_sigctx {
59 sig s;
60 rsa_privctx rp;
61 pkcs1 p1;
62 } rsap1_sigctx;
63
64 static sig *rsap1_siginit(key *k, void *kd, const gchash *hc)
65 {
66 rsap1_sigctx *rs = CREATE(rsap1_sigctx);
67 rsa_privcreate(&rs->rp, kd, &rand_global);
68 rs->p1.r = &rand_global;
69 rs->p1.ep = hc->name;
70 rs->p1.epsz = strlen(hc->name) + 1;
71 rs->s.h = 0;
72 return (&rs->s);
73 }
74
75 static int rsap1_sigdoit(sig *s, dstr *d)
76 {
77 rsap1_sigctx *rs = (rsap1_sigctx *)s;
78 size_t n;
79 mp *m = rsa_sign(&rs->rp, MP_NEW,
80 GH_DONE(s->h, 0), GH_CLASS(s->h)->hashsz,
81 pkcs1_sigencode, &rs->p1);
82 if (!m) return (-1);
83 n = mp_octets(rs->rp.rp->n); dstr_ensure(d, n); mp_storeb(m, d->buf, n);
84 d->len += n; mp_drop(m);
85 return (0);
86 }
87
88 static const char *rsa_lengthcheck(mp *n)
89 {
90 if (mp_bits(n) < 1024) return ("key too short");
91 return (0);
92 }
93
94 static const char *rsap1_sigcheck(sig *s)
95 {
96 rsap1_sigctx *rs = (rsap1_sigctx *)s;
97 const char *e;
98 if ((e = rsa_lengthcheck(rs->rp.rp->n)) != 0) return (e);
99 return (0);
100 }
101
102 static void rsap1_sigdestroy(sig *s)
103 {
104 rsap1_sigctx *rs = (rsap1_sigctx *)s;
105 rsa_privdestroy(&rs->rp);
106 DESTROY(rs);
107 }
108
109 static const sigops rsap1_sig = {
110 rsa_privfetch, sizeof(rsa_priv),
111 rsap1_siginit, rsap1_sigdoit, rsap1_sigcheck, rsap1_sigdestroy
112 };
113
114 typedef struct rsap1_vrfctx {
115 sig s;
116 rsa_pubctx rp;
117 pkcs1 p1;
118 } rsap1_vrfctx;
119
120 static sig *rsap1_vrfinit(key *k, void *kd, const gchash *hc)
121 {
122 rsap1_vrfctx *rv = CREATE(rsap1_vrfctx);
123 rsa_pubcreate(&rv->rp, kd);
124 rv->p1.r = &rand_global;
125 rv->p1.ep = hc->name;
126 rv->p1.epsz = strlen(hc->name) + 1;
127 rv->s.h = 0;
128 return (&rv->s);
129 }
130
131 static int rsap1_vrfdoit(sig *s, dstr *d)
132 {
133 rsap1_vrfctx *rv = (rsap1_vrfctx *)s;
134 mp *m = mp_loadb(MP_NEW, d->buf, d->len);
135 int rc = rsa_verify(&rv->rp, m,
136 GH_DONE(s->h, 0), GH_CLASS(s->h)->hashsz,
137 0, pkcs1_sigdecode, &rv->p1);
138 mp_drop(m);
139 return (rc);
140 }
141
142 static const char *rsap1_vrfcheck(sig *s)
143 {
144 rsap1_vrfctx *rv = (rsap1_vrfctx *)s;
145 const char *e;
146 if ((e = rsa_lengthcheck(rv->rp.rp->n)) != 0) return (e);
147 return (0);
148 }
149
150 static void rsap1_vrfdestroy(sig *s)
151 {
152 rsap1_vrfctx *rv = (rsap1_vrfctx *)s;
153 rsa_pubdestroy(&rv->rp);
154 DESTROY(rv);
155 }
156
157 static const sigops rsap1_vrf = {
158 rsa_pubfetch, sizeof(rsa_pub),
159 rsap1_vrfinit, rsap1_vrfdoit, rsap1_vrfcheck, rsap1_vrfdestroy
160 };
161
162 /* --- RSA PSS --- */
163
164 static const gccipher *getmgf(key *k, const gchash *hc)
165 {
166 dstr d = DSTR_INIT;
167 const gccipher *gc;
168 const char *mm;
169
170 if ((mm = key_getattr(0, k, "mgf")) == 0) {
171 dstr_putf(&d, "%s-mgf", hc->name);
172 mm = d.buf;
173 }
174 if ((gc = gcipher_byname(mm)) == 0)
175 die(EXIT_FAILURE, "unknown encryption scheme `%s'", mm);
176 dstr_destroy(&d);
177 return (gc);
178 }
179
180 typedef struct rsapss_sigctx {
181 sig s;
182 rsa_privctx rp;
183 pss p;
184 } rsapss_sigctx;
185
186 static sig *rsapss_siginit(key *k, void *kd, const gchash *hc)
187 {
188 rsapss_sigctx *rs = CREATE(rsapss_sigctx);
189 rsa_privcreate(&rs->rp, kd, &rand_global);
190 rs->s.h = 0;
191 rs->p.r = &rand_global;
192 rs->p.cc = getmgf(k, hc);
193 rs->p.ch = hc;
194 rs->p.ssz = hc->hashsz;
195 return (&rs->s);
196 }
197
198 static int rsapss_sigdoit(sig *s, dstr *d)
199 {
200 rsapss_sigctx *rs = (rsapss_sigctx *)s;
201 size_t n;
202 mp *m = rsa_sign(&rs->rp, MP_NEW,
203 GH_DONE(s->h, 0), GH_CLASS(s->h)->hashsz,
204 pss_encode, &rs->p);
205 if (!m) return (-1);
206 n = mp_octets(rs->rp.rp->n); dstr_ensure(d, n); mp_storeb(m, d->buf, n);
207 d->len += n; mp_drop(m);
208 return (0);
209 }
210
211 static const char *rsapss_sigcheck(sig *s)
212 {
213 rsapss_sigctx *rs = (rsapss_sigctx *)s;
214 const char *e;
215 if ((e = rsa_lengthcheck(rs->rp.rp->n)) != 0) return (e);
216 return (0);
217 }
218
219 static void rsapss_sigdestroy(sig *s)
220 {
221 rsapss_sigctx *rs = (rsapss_sigctx *)s;
222 rsa_privdestroy(&rs->rp);
223 DESTROY(rs);
224 }
225
226 static const sigops rsapss_sig = {
227 rsa_privfetch, sizeof(rsa_priv),
228 rsapss_siginit, rsapss_sigdoit, rsapss_sigcheck, rsapss_sigdestroy
229 };
230
231 typedef struct rsapss_vrfctx {
232 sig s;
233 rsa_pubctx rp;
234 pss p;
235 } rsapss_vrfctx;
236
237 static sig *rsapss_vrfinit(key *k, void *kd, const gchash *hc)
238 {
239 rsapss_vrfctx *rv = CREATE(rsapss_vrfctx);
240 rsa_pubcreate(&rv->rp, kd);
241 rv->s.h = 0;
242 rv->p.r = &rand_global;
243 rv->p.cc = getmgf(k, hc);
244 rv->p.ch = hc;
245 rv->p.ssz = hc->hashsz;
246 return (&rv->s);
247 }
248
249 static int rsapss_vrfdoit(sig *s, dstr *d)
250 {
251 rsapss_vrfctx *rv = (rsapss_vrfctx *)s;
252 mp *m = mp_loadb(MP_NEW, d->buf, d->len);
253 int rc = rsa_verify(&rv->rp, m,
254 GH_DONE(s->h, 0), GH_CLASS(s->h)->hashsz,
255 0, pss_decode, &rv->p);
256 mp_drop(m);
257 return (rc);
258 }
259
260 static const char *rsapss_vrfcheck(sig *s)
261 {
262 rsapss_vrfctx *rv = (rsapss_vrfctx *)s;
263 const char *e;
264 if ((e = rsa_lengthcheck(rv->rp.rp->n)) != 0) return (e);
265 return (0);
266 }
267
268 static void rsapss_vrfdestroy(sig *s)
269 {
270 rsapss_vrfctx *rv = (rsapss_vrfctx *)s;
271 rsa_pubdestroy(&rv->rp);
272 DESTROY(rv);
273 }
274
275 static const sigops rsapss_vrf = {
276 rsa_pubfetch, sizeof(rsa_pub),
277 rsapss_vrfinit, rsapss_vrfdoit, rsapss_vrfcheck, rsapss_vrfdestroy
278 };
279
280 /* --- DSA and ECDSA --- */
281
282 typedef struct dsa_sigctx {
283 sig s;
284 gdsa g;
285 } dsa_sigctx;
286
287 static void dsa_initcommon(dsa_sigctx *ds, const gchash *hc,
288 const char *ktag)
289 {
290 ds->g.r = &rand_global;
291 ds->g.h = hc;
292 ds->g.u = MP_NEW;
293 ds->s.h = 0;
294 }
295
296 static dsa_sigctx *dsa_doinit(key *k, const gprime_param *gp,
297 mp *y, const gchash *hc,
298 group *(*makegroup)(const gprime_param *),
299 const char *what)
300 {
301 dsa_sigctx *ds = CREATE(dsa_sigctx);
302 dstr t = DSTR_INIT;
303
304 key_fulltag(k, &t);
305 if ((ds->g.g = makegroup(gp)) == 0)
306 die(EXIT_FAILURE, "bad %s group in key `%s'", what, t.buf);
307 ds->g.p = G_CREATE(ds->g.g);
308 if (G_FROMINT(ds->g.g, ds->g.p, y))
309 die(EXIT_FAILURE, "bad public key in key `%s'", t.buf);
310 dsa_initcommon(ds, hc, t.buf);
311 dstr_destroy(&t);
312 return (ds);
313 }
314
315 static dsa_sigctx *ecdsa_doinit(key *k, const char *cstr,
316 ec *y, const gchash *hc)
317 {
318 dsa_sigctx *ds = CREATE(dsa_sigctx);
319 ec_info ei;
320 const char *e;
321 dstr t = DSTR_INIT;
322
323 key_fulltag(k, &t);
324 if ((e = ec_getinfo(&ei, cstr)) != 0)
325 die(EXIT_FAILURE, "bad curve in key `%s': %s", t.buf, e);
326 ds->g.g = group_ec(&ei);
327 ds->g.p = G_CREATE(ds->g.g);
328 if (G_FROMEC(ds->g.g, ds->g.p, y))
329 die(EXIT_FAILURE, "bad public key in key `%s'", t.buf);
330 dsa_initcommon(ds, hc, t.buf);
331 dstr_destroy(&t);
332 return (ds);
333 }
334
335 static sig *dsa_siginit(key *k, void *kd, const gchash *hc)
336 {
337 dh_priv *dp = kd;
338 dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_prime, "prime");
339 ds->g.u = MP_COPY(dp->x);
340 return (&ds->s);
341 }
342
343 static sig *bindsa_siginit(key *k, void *kd, const gchash *hc)
344 {
345 dh_priv *dp = kd;
346 dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_binary, "binary");
347 ds->g.u = MP_COPY(dp->x);
348 return (&ds->s);
349 }
350
351 static sig *ecdsa_siginit(key *k, void *kd, const gchash *hc)
352 {
353 ec_priv *ep = kd;
354 dsa_sigctx *ds = ecdsa_doinit(k, ep->cstr, &ep->p, hc);
355 ds->g.u = MP_COPY(ep->x);
356 return (&ds->s);
357 }
358
359 static int dsa_sigdoit(sig *s, dstr *d)
360 {
361 dsa_sigctx *ds = (dsa_sigctx *)s;
362 gdsa_sig ss = GDSA_SIG_INIT;
363 size_t n = mp_octets(ds->g.g->r);
364
365 gdsa_sign(&ds->g, &ss, GH_DONE(ds->s.h, 0), 0);
366 dstr_ensure(d, 2 * n);
367 mp_storeb(ss.r, d->buf, n);
368 mp_storeb(ss.s, d->buf + n, n);
369 d->len += 2 * n;
370 mp_drop(ss.r); mp_drop(ss.s);
371 return (0);
372 }
373
374 static const char *dsa_sigcheck(sig *s)
375 {
376 dsa_sigctx *ds = (dsa_sigctx *)s;
377 const char *e;
378 if ((e = G_CHECK(ds->g.g, &rand_global)) != 0)
379 return (0);
380 if (group_check(ds->g.g, ds->g.p))
381 return ("public key not in subgroup");
382 return (0);
383 }
384
385 static void dsa_sigdestroy(sig *s)
386 {
387 dsa_sigctx *ds = (dsa_sigctx *)s;
388 G_DESTROY(ds->g.g, ds->g.p);
389 mp_drop(ds->g.u);
390 G_DESTROYGROUP(ds->g.g);
391 DESTROY(ds);
392 }
393
394 static const sigops dsa_sig = {
395 dh_privfetch, sizeof(dh_priv),
396 dsa_siginit, dsa_sigdoit, dsa_sigcheck, dsa_sigdestroy
397 };
398
399 static const sigops bindsa_sig = {
400 dh_privfetch, sizeof(dh_priv),
401 bindsa_siginit, dsa_sigdoit, dsa_sigcheck, dsa_sigdestroy
402 };
403
404 static const sigops ecdsa_sig = {
405 ec_privfetch, sizeof(ec_priv),
406 ecdsa_siginit, dsa_sigdoit, dsa_sigcheck, dsa_sigdestroy
407 };
408
409 static sig *dsa_vrfinit(key *k, void *kd, const gchash *hc)
410 {
411 dh_pub *dp = kd;
412 dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_prime, "prime");
413 return (&ds->s);
414 }
415
416 static sig *bindsa_vrfinit(key *k, void *kd, const gchash *hc)
417 {
418 dh_pub *dp = kd;
419 dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_binary, "binary");
420 return (&ds->s);
421 }
422
423 static sig *ecdsa_vrfinit(key *k, void *kd, const gchash *hc)
424 {
425 ec_pub *ep = kd;
426 dsa_sigctx *ds = ecdsa_doinit(k, ep->cstr, &ep->p, hc);
427 return (&ds->s);
428 }
429
430 static int dsa_vrfdoit(sig *s, dstr *d)
431 {
432 dsa_sigctx *ds = (dsa_sigctx *)s;
433 gdsa_sig ss;
434 size_t n = d->len/2;
435 int rc;
436
437 ss.r = mp_loadb(MP_NEW, d->buf, n);
438 ss.s = mp_loadb(MP_NEW, d->buf + n, d->len - n);
439 rc = gdsa_verify(&ds->g, &ss, GH_DONE(ds->s.h, 0));
440 mp_drop(ss.r); mp_drop(ss.s);
441 return (rc);
442 }
443
444 static const sigops dsa_vrf = {
445 dh_pubfetch, sizeof(dh_pub),
446 dsa_vrfinit, dsa_vrfdoit, dsa_sigcheck, dsa_sigdestroy
447 };
448
449 static const sigops bindsa_vrf = {
450 dh_pubfetch, sizeof(dh_pub),
451 bindsa_vrfinit, dsa_vrfdoit, dsa_sigcheck, dsa_sigdestroy
452 };
453
454 static const sigops ecdsa_vrf = {
455 ec_pubfetch, sizeof(ec_pub),
456 ecdsa_vrfinit, dsa_vrfdoit, dsa_sigcheck, dsa_sigdestroy
457 };
458
459 /* --- KCDSA and ECKCDSA --- */
460
461 static void kcdsa_privkey(dsa_sigctx *ds, mp *x)
462 { ds->g.u = mp_modinv(MP_NEW, x, ds->g.g->r); }
463
464 static void kcdsa_sethash(dsa_sigctx *ds, const gchash *hc)
465 { ds->s.h = gkcdsa_beginhash(&ds->g); }
466
467 static sig *kcdsa_siginit(key *k, void *kd, const gchash *hc)
468 {
469 dh_priv *dp = kd;
470 dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_prime, "prime");
471 kcdsa_privkey(ds, dp->x);
472 kcdsa_sethash(ds, hc);
473 return (&ds->s);
474 }
475
476 static sig *binkcdsa_siginit(key *k, void *kd, const gchash *hc)
477 {
478 dh_priv *dp = kd;
479 dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_binary, "binary");
480 kcdsa_privkey(ds, dp->x);
481 kcdsa_sethash(ds, hc);
482 return (&ds->s);
483 }
484
485 static sig *eckcdsa_siginit(key *k, void *kd, const gchash *hc)
486 {
487 ec_priv *ep = kd;
488 dsa_sigctx *ds = ecdsa_doinit(k, ep->cstr, &ep->p, hc);
489 kcdsa_privkey(ds, ep->x);
490 kcdsa_sethash(ds, hc);
491 return (&ds->s);
492 }
493
494 static int kcdsa_sigdoit(sig *s, dstr *d)
495 {
496 dsa_sigctx *ds = (dsa_sigctx *)s;
497 gkcdsa_sig ss = GKCDSA_SIG_INIT;
498 size_t hsz = ds->g.h->hashsz, n = mp_octets(ds->g.g->r);
499
500 gkcdsa_sign(&ds->g, &ss, GH_DONE(ds->s.h, 0), 0);
501 dstr_ensure(d, hsz + n);
502 memcpy(d->buf, ss.r, hsz);
503 mp_storeb(ss.s, d->buf + hsz, n);
504 d->len += hsz + n;
505 xfree(ss.r); mp_drop(ss.s);
506 return (0);
507 }
508
509 static const sigops kcdsa_sig = {
510 dh_privfetch, sizeof(dh_priv),
511 kcdsa_siginit, kcdsa_sigdoit, dsa_sigcheck, dsa_sigdestroy
512 };
513
514 static const sigops binkcdsa_sig = {
515 dh_privfetch, sizeof(dh_priv),
516 binkcdsa_siginit, kcdsa_sigdoit, dsa_sigcheck, dsa_sigdestroy
517 };
518
519 static const sigops eckcdsa_sig = {
520 ec_privfetch, sizeof(ec_priv),
521 eckcdsa_siginit, kcdsa_sigdoit, dsa_sigcheck, dsa_sigdestroy
522 };
523
524 static sig *kcdsa_vrfinit(key *k, void *kd, const gchash *hc)
525 {
526 dh_pub *dp = kd;
527 dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_prime, "prime");
528 kcdsa_sethash(ds, hc);
529 return (&ds->s);
530 }
531
532 static sig *binkcdsa_vrfinit(key *k, void *kd, const gchash *hc)
533 {
534 dh_pub *dp = kd;
535 dsa_sigctx *ds = dsa_doinit(k, &dp->dp, dp->y, hc, group_binary, "binary");
536 kcdsa_sethash(ds, hc);
537 return (&ds->s);
538 }
539
540 static sig *eckcdsa_vrfinit(key *k, void *kd, const gchash *hc)
541 {
542 ec_pub *ep = kd;
543 dsa_sigctx *ds = ecdsa_doinit(k, ep->cstr, &ep->p, hc);
544 kcdsa_sethash(ds, hc);
545 return (&ds->s);
546 }
547
548 static int kcdsa_vrfdoit(sig *s, dstr *d)
549 {
550 dsa_sigctx *ds = (dsa_sigctx *)s;
551 gkcdsa_sig ss;
552 size_t hsz = ds->g.h->hashsz, n = d->len - hsz;
553 int rc;
554
555 if (d->len < hsz)
556 return (-1);
557 ss.r = (octet *)d->buf;
558 ss.s = mp_loadb(MP_NEW, d->buf + hsz, n);
559 rc = gkcdsa_verify(&ds->g, &ss, GH_DONE(ds->s.h, 0));
560 mp_drop(ss.s);
561 return (rc);
562 }
563
564 static const sigops kcdsa_vrf = {
565 dh_pubfetch, sizeof(dh_pub),
566 kcdsa_vrfinit, kcdsa_vrfdoit, dsa_sigcheck, dsa_sigdestroy
567 };
568
569 static const sigops binkcdsa_vrf = {
570 dh_pubfetch, sizeof(dh_pub),
571 binkcdsa_vrfinit, kcdsa_vrfdoit, dsa_sigcheck, dsa_sigdestroy
572 };
573
574 static const sigops eckcdsa_vrf = {
575 ec_pubfetch, sizeof(ec_pub),
576 eckcdsa_vrfinit, kcdsa_vrfdoit, dsa_sigcheck, dsa_sigdestroy
577 };
578
579 /* --- EdDSA --- */
580
581 #define EDDSAS(_) \
582 _(ed25519, ed25519ctx, ED25519, "Ed25519", sha512) \
583 _(ed448, ed448, ED448, "Ed448", shake256)
584
585 typedef struct eddsa_sigctx {
586 sig s;
587 const char *perso;
588 } eddsa_sigctx;
589
590 static sig *eddsa_siginit(key *k, void *kd, const gchash *hc)
591 {
592 eddsa_sigctx *es = CREATE(eddsa_sigctx);
593 es->s.h = 0;
594 es->perso = key_getattr(0, k, "perso");
595 if (es->perso && strlen(es->perso) > ED25519_MAXPERSOSZ) {
596 die(1, "EdDSA personalization string too long (max length %d)",
597 ED25519_MAXPERSOSZ);
598 }
599 return (&es->s);
600 }
601
602 static void eddsa_sigdestroy(sig *s)
603 { eddsa_sigctx *es = (eddsa_sigctx *)s; DESTROY(es); }
604
605 #define EDDSADEF(ed, sigver, ED, name, hash) \
606 \
607 static int ed##_sigdoit(sig *s, dstr *d) \
608 { \
609 eddsa_sigctx *es = (eddsa_sigctx *)s; \
610 ed##_priv *k = es->s.kd; \
611 \
612 dstr_ensure(d, ED##_SIGSZ); \
613 sigver##_sign((octet *)d->buf, k->priv.k, k->priv.sz, k->pub.k, \
614 es->perso ? 1 : -1, es->perso, \
615 es->perso ? strlen(es->perso) : 0, \
616 GH_DONE(es->s.h, 0), GH_CLASS(es->s.h)->hashsz); \
617 d->len += ED##_SIGSZ; \
618 return (0); \
619 } \
620 \
621 static const char *ed##_sigcheck(sig *s) \
622 { \
623 eddsa_sigctx *es = (eddsa_sigctx *)s; \
624 ed##_priv *k = es->s.kd; \
625 \
626 if (k->pub.sz != ED##_PUBSZ) \
627 return ("incorrect " #name " public key length"); \
628 return (0); \
629 } \
630 \
631 static const sigops ed##_sig = { \
632 ed##_privfetch, sizeof(ed##_priv), \
633 eddsa_siginit, ed##_sigdoit, ed##_sigcheck, eddsa_sigdestroy \
634 }; \
635 \
636 static int ed##_vrfdoit(sig *s, dstr *d) \
637 { \
638 eddsa_sigctx *es = (eddsa_sigctx *)s; \
639 ed##_pub *k = es->s.kd; \
640 \
641 if (d->len != ED##_SIGSZ) return (-1); \
642 return (sigver##_verify(k->pub.k, \
643 es->perso ? 1 : -1, es->perso, \
644 es->perso ? strlen(es->perso) : 0, \
645 GH_DONE(s->h, 0), GH_CLASS(s->h)->hashsz, \
646 (const octet *)d->buf)); \
647 } \
648 \
649 static const char *ed##_vrfcheck(sig *s) \
650 { \
651 ed##_pub *k = s->kd; \
652 \
653 if (k->pub.sz != ED##_PUBSZ) \
654 return ("incorrect " #name " public key length"); \
655 return (0); \
656 } \
657 \
658 static const sigops ed##_vrf = { \
659 ed##_pubfetch, sizeof(ed##_pub), \
660 eddsa_siginit, ed##_vrfdoit, ed##_vrfcheck, eddsa_sigdestroy \
661 };
662
663 EDDSAS(EDDSADEF)
664 #undef EDDSADEF
665
666 /* --- Symmetric message authentication --- */
667
668 typedef struct mac_ctx {
669 sig s;
670 const gcmac *mc;
671 gmac *m;
672 key_packdef kp;
673 key_bin kb;
674 } mac_ctx;
675
676 static sig *mac_init(key *k, void *kd, const gchash *hc)
677 {
678 mac_ctx *m;
679 dstr d = DSTR_INIT;
680 int err;
681 const char *mm;
682
683 m = CREATE(mac_ctx);
684
685 key_fulltag(k, &d);
686 m->kp.e = KENC_BINARY;
687 m->kp.p = &m->kb;
688 m->kp.kd = 0;
689
690 if ((mm = key_getattr(0 /*yik*/, k, "mac")) == 0) {
691 dstr_putf(&d, "%s-hmac", hc->name);
692 mm = d.buf;
693 }
694 if ((m->mc = gmac_byname(mm)) == 0)
695 die(EXIT_FAILURE, "unknown message authentication scheme `%s'", mm);
696 dstr_reset(&d);
697
698 if ((err = key_unpack(&m->kp, kd, &d)) != 0) {
699 die(EXIT_FAILURE, "failed to unpack symmetric key `%s': %s",
700 d.buf, key_strerror(err));
701 }
702 dstr_destroy(&d);
703
704 if (keysz(m->kb.sz, m->mc->keysz) != m->kb.sz) {
705 die(EXIT_FAILURE, "bad key size %lu for `%s'",
706 (unsigned long)m->kb.sz, m->mc->name);
707 }
708 m->m = GM_KEY(m->mc, m->kb.k, m->kb.sz);
709 m->s.h = GM_INIT(m->m);
710 return (&m->s);
711 }
712
713 static int mac_sigdoit(sig *s, dstr *d)
714 {
715 mac_ctx *m = (mac_ctx *)s;
716
717 dstr_ensure(d, m->mc->hashsz);
718 GH_DONE(m->s.h, d->buf);
719 d->len += m->mc->hashsz;
720 return (0);
721 }
722
723 static int mac_vrfdoit(sig *s, dstr *d)
724 {
725 mac_ctx *m = (mac_ctx *)s;
726 const octet *t;
727
728 t = GH_DONE(m->s.h, 0);
729 if (d->len != m->mc->hashsz || !ct_memeq(d->buf, t, d->len))
730 return (-1);
731 return (0);
732 }
733
734 static const char *mac_check(sig *s) { return (0); }
735
736 static void mac_destroy(sig *s)
737 {
738 mac_ctx *m = (mac_ctx *)s;
739 GM_DESTROY(m->m);
740 key_unpackdone(&m->kp);
741 }
742
743 static const sigops mac_sig = {
744 0, 0,
745 mac_init, mac_sigdoit, mac_check, mac_destroy
746 };
747
748 static const sigops mac_vrf = {
749 0, 0,
750 mac_init, mac_vrfdoit, mac_check, mac_destroy
751 };
752
753 /* --- The switch table --- */
754
755 const struct sigtab sigtab[] = {
756 { "rsapkcs1", &rsap1_sig, &rsap1_vrf, &sha },
757 { "rsapss", &rsapss_sig, &rsapss_vrf, &sha },
758 { "dsa", &dsa_sig, &dsa_vrf, &sha },
759 { "bindsa", &bindsa_sig, &bindsa_vrf, &sha },
760 { "ecdsa", &ecdsa_sig, &ecdsa_vrf, &sha },
761 { "kcdsa", &kcdsa_sig, &kcdsa_vrf, &has160 },
762 { "binkcdsa", &binkcdsa_sig, &binkcdsa_vrf, &has160 },
763 { "eckcdsa", &eckcdsa_sig, &eckcdsa_vrf, &has160 },
764 #define EDDSATAB(ed, sigver, ED, name, hash) \
765 { #ed, &ed##_sig, &ed##_vrf, &hash },
766 EDDSAS(EDDSATAB)
767 #undef EDDSATAB
768 { "mac", &mac_sig, &mac_vrf, &rmd160 },
769 { 0, 0, 0 }
770 };
771
772 /* --- @getsig@ --- *
773 *
774 * Arguments: @key *k@ = the key to load
775 * @const char *app@ = application name
776 * @int wantpriv@ = nonzero if we want to sign
777 *
778 * Returns: A signature-making thing.
779 *
780 * Use: Loads a key and starts hashing.
781 */
782
783 sig *getsig(key *k, const char *app, int wantpriv)
784 {
785 const char *salg, *halg = 0;
786 dstr d = DSTR_INIT;
787 dstr t = DSTR_INIT;
788 char *p = 0;
789 const char *q;
790 sig *s;
791 size_t n;
792 const struct sigtab *st;
793 const sigops *so;
794 const gchash *ch;
795 void *kd;
796 int e;
797 key_packdef *kp;
798
799 /* --- Setup stuff --- */
800
801 key_fulltag(k, &t);
802
803 /* --- Get the signature algorithm --- *
804 *
805 * Take the attribute if it's there; otherwise use the key type.
806 */
807
808 n = strlen(app);
809 if ((q = key_getattr(0, k, "sig")) != 0) {
810 dstr_puts(&d, q);
811 p = d.buf;
812 } else if (strncmp(k->type, app, n) == 0 && k->type[n] == '-') {
813 dstr_puts(&d, k->type);
814 p = d.buf + n + 1;
815 } else
816 die(EXIT_FAILURE, "no signature algorithm for key `%s'", t.buf);
817
818 /* --- Grab the hash algorithm --- *
819 *
820 * Grab it from the signature algorithm if it's there. But override that
821 * from the attribute.
822 */
823
824 salg = p;
825 if ((p = strchr(p, '/')) != 0) {
826 *p++ = 0;
827 halg = p;
828 }
829 if ((q = key_getattr(0, k, "hash")) != 0)
830 halg = q;
831
832 /* --- Look up the algorithms in the table --- */
833
834 for (st = sigtab; st->name; st++) {
835 if (strcmp(st->name, salg) == 0)
836 goto s_found;
837 }
838 die(EXIT_FAILURE, "signature algorithm `%s' not found in key `%s'",
839 salg, t.buf);
840 s_found:;
841 if (!halg)
842 ch = st->ch;
843 else {
844 if ((ch = ghash_byname(halg)) == 0) {
845 die(EXIT_FAILURE, "hash algorithm `%s' not found in key `%s'",
846 halg, t.buf);
847 }
848 }
849 so = wantpriv ? st->signops : st->verifyops;
850
851 /* --- Load the key --- */
852
853 if (!so->kf) {
854 kd = k->k;
855 key_incref(kd);
856 kp = 0;
857 } else {
858 kd = xmalloc(so->kdsz);
859 kp = key_fetchinit(so->kf, 0, kd);
860 if ((e = key_fetch(kp, k)) != 0) {
861 die(EXIT_FAILURE, "error fetching key `%s': %s",
862 t.buf, key_strerror(e));
863 }
864 }
865 s = so->init(k, kd, ch);
866 if (!s->h)
867 s->h = GH_INIT(ch);
868 s->kp = kp;
869 s->ops = so;
870 s->kd = kd;
871 s->ch = ch;
872
873 /* --- Free stuff up --- */
874
875 dstr_destroy(&d);
876 dstr_destroy(&t);
877 return (s);
878 }
879
880 /* --- @freesig@ --- *
881 *
882 * Arguments: @sig *s@ = signature-making thing
883 *
884 * Returns: ---
885 *
886 * Use: Frees up a signature-making thing
887 */
888
889 void freesig(sig *s)
890 {
891 GH_DESTROY(s->h);
892 if (!s->ops->kf)
893 key_drop(s->kd);
894 else {
895 key_fetchdone(s->kp);
896 xfree(s->kd);
897 }
898 s->ops->destroy(s);
899 }
900
901 /*----- That's all, folks -------------------------------------------------*/
Catacomb cryptographic library