3 * DSA signing operation
5 * (c) 1999 Straylight/Edgeware
8 /*----- Licensing notice --------------------------------------------------*
10 * This file is part of Catacomb.
12 * Catacomb is free software; you can redistribute it and/or modify
13 * it under the terms of the GNU Library General Public License as
14 * published by the Free Software Foundation; either version 2 of the
15 * License, or (at your option) any later version.
17 * Catacomb is distributed in the hope that it will be useful,
18 * but WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 * GNU Library General Public License for more details.
22 * You should have received a copy of the GNU Library General Public
23 * License along with Catacomb; if not, write to the Free
24 * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
28 /*----- Header files ------------------------------------------------------*/
30 #define CATACOMB_DSAIMPL
33 #include "mpbarrett.h"
36 /*----- Main code ---------------------------------------------------------*/
38 /* --- @dsa_mksig@ --- *
40 * Arguments: @const dsa_param *dp@ = pointer to DSA parameters
41 * @mp *a@ = secret signing key
42 * @mp *m@ = message to be signed
43 * @mp *k@ = random data
44 * @mp **rr, **ss@ = where to put output parameters
48 * Use: Computes a DSA signature of a message.
51 void dsa_mksig(const dsa_param
*dp
, mp
*a
, mp
*m
, mp
*k
, mp
**rr
, mp
**ss
)
58 /* --- Compute %$r = (g^k \bmod p) \bmod q$% --- */
60 mpmont_create(&pm
, dp
->p
);
61 r
= mpmont_exp(&pm
, MP_NEW
, dp
->g
, k
);
63 mp_div(0, &r
, r
, dp
->q
);
65 /* --- Compute %$k^{-1} \bmod q$% --- */
67 k1
= mp_modinv(MP_NEW
, k
, dp
->q
);
69 /* --- Now for %$k^{-1}(m + ar)$% --- */
71 mpbarrett_create(&qb
, dp
->q
);
72 ar
= mp_mul(MP_NEW
, a
, r
);
73 ar
= mp_add(ar
, ar
, m
);
74 ar
= mpbarrett_reduce(&qb
, ar
, ar
);
75 ar
= mp_mul(ar
, ar
, k1
);
76 ar
= mpbarrett_reduce(&qb
, ar
, ar
);
77 mpbarrett_destroy(&qb
);
79 if (*rr
) MP_DROP(*rr
);
80 if (*ss
) MP_DROP(*ss
);
85 /* --- @dsa_sign@ --- *
87 * Arguments: @dsa_param *dp@ = pointer to DSA parameters
88 * @mp *a@ = pointer to secret signing key
89 * @const void *m@ = pointer to message
90 * @size_t msz@ = size of the message
91 * @const void *k@ = secret random data for securing signature
92 * @size_t ksz@ = size of secret data
93 * @void *r@ = pointer to output space for @r@
94 * @size_t rsz@ = size of output space for @r@
95 * @void *s@ = pointer to output space for @s@
96 * @size_t ssz@ = size of output space for @s@
100 * Use: Signs a message, storing the results in a big-endian binary
104 void dsa_sign(dsa_param
*dp
, mp
*a
,
105 const void *m
, size_t msz
, const void *k
, size_t ksz
,
106 void *r
, size_t rsz
, void *s
, size_t ssz
)
108 mp
*mm
= dsa_h2n(MP_NEW
, dp
->q
, m
, msz
);
109 mp
*km
= mp_loadb(MP_NEW
, k
, ksz
);
110 mp
*rm
= MP_NEW
, *sm
= MP_NEW
;
111 dsa_mksig(dp
, a
, mm
, km
, &rm
, &sm
);
112 mp_storeb(rm
, r
, rsz
);
113 mp_storeb(sm
, s
, ssz
);
114 mp_drop(mm
); mp_drop(km
);
115 mp_drop(rm
); mp_drop(sm
);
118 /*----- Test rig ----------------------------------------------------------*/
122 #include <mLib/testrig.h>
126 static int verify(dstr
*v
)
131 octet hash
[SHA_HASHSZ
];
135 dp
.q
= *(mp
**)v
[0].buf
;
136 dp
.p
= *(mp
**)v
[1].buf
;
137 dp
.g
= *(mp
**)v
[2].buf
;
138 x
= *(mp
**)v
[3].buf
;
141 sha_hash(&c
, v
[4].buf
, v
[4].len
);
144 dsa_sign(&dp
, x
, hash
, sizeof(hash
), v
[5].buf
, v
[5].len
,
145 s
.r
, sizeof(s
.r
), s
.s
, sizeof(s
.s
));
147 if (v
[6].len
!= sizeof(s
.r
) || v
[7].len
!= sizeof(s
.s
) ||
148 memcmp(s
.r
, v
[6].buf
, sizeof(s
.r
)) != 0 ||
149 memcmp(s
.s
, v
[7].buf
, sizeof(s
.s
)) != 0) {
150 fputs("\n*** signature failed", stderr
);
151 fputs("\nq = ", stderr
); mp_writefile(dp
.q
, stderr
, 16);
152 fputs("\np = ", stderr
); mp_writefile(dp
.p
, stderr
, 16);
153 fputs("\ng = ", stderr
); mp_writefile(dp
.g
, stderr
, 16);
154 fputs("\nx = ", stderr
); mp_writefile(x
, stderr
, 16);
155 fprintf(stderr
, "\nmessage = `%s'", v
[4].buf
);
156 fputs("\nk = ", stderr
); type_hex
.dump(&v
[5], stderr
);
157 fputs("\nR = ", stderr
); type_hex
.dump(&v
[6], stderr
);
158 fputs("\nS = ", stderr
); type_hex
.dump(&v
[7], stderr
);
162 m
= mp_loadb(m
, hash
, sizeof(hash
));
163 fputs("\nm = ", stderr
); mp_writefile(m
, stderr
, 16);
164 m
= mp_loadb(m
, s
.r
, sizeof(s
.r
));
165 fputs("\nr = ", stderr
); mp_writefile(m
, stderr
, 16);
166 m
= mp_loadb(m
, s
.s
, sizeof(s
.s
));
167 fputs("\ns = ", stderr
); mp_writefile(m
, stderr
, 16);
179 assert(mparena_count(MPARENA_GLOBAL
) == 0);
183 static test_chunk tests
[] = {
185 { &type_mp
, &type_mp
, &type_mp
, &type_mp
,
186 &type_string
, &type_hex
, &type_hex
, &type_hex
, 0 } },
190 int main(int argc
, char *argv
[])
193 test_run(argc
, argv
, tests
, SRCDIR
"/t/dsa");
199 /*----- That's all, folks -------------------------------------------------*/