3 * Copyright (C) 2006-2014 wolfSSL Inc.
5 * This file is part of CyaSSL.
7 * CyaSSL is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 2 of the License, or
10 * (at your option) any later version.
12 * CyaSSL is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, write to the Free Software
19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
26 #include <cyassl/ctaocrypt/settings.h>
30 #include <cyassl/ctaocrypt/dsa.h>
31 #include <cyassl/ctaocrypt/sha.h>
32 #include <cyassl/ctaocrypt/random.h>
33 #include <cyassl/ctaocrypt/error-crypt.h>
37 DSA_HALF_SIZE = 20, /* r and s size */
38 DSA_SIG_SIZE = 40 /* signature size */
44 static INLINE word32 min(word32 a, word32 b)
52 void InitDsaKey(DsaKey* key)
54 key->type = -1; /* haven't decided yet */
56 /* TomsFastMath doesn't use memory allocation */
58 key->p.dp = 0; /* public alloc parts */
63 key->x.dp = 0; /* private alloc parts */
68 void FreeDsaKey(DsaKey* key)
71 /* TomsFastMath doesn't use memory allocation */
73 if (key->type == DSA_PRIVATE)
83 int DsaSign(const byte* digest, byte* out, DsaKey* key, RNG* rng)
85 mp_int k, kInv, r, s, H;
87 byte buffer[DSA_HALF_SIZE];
89 sz = min(sizeof(buffer), mp_unsigned_bin_size(&key->q));
92 ret = RNG_GenerateBlock(rng, buffer, sz);
98 if (mp_init_multi(&k, &kInv, &r, &s, &H, 0) != MP_OKAY)
101 if (mp_read_unsigned_bin(&k, buffer, sz) != MP_OKAY)
104 if (ret == 0 && mp_cmp_d(&k, 1) != MP_GT)
107 /* inverse k mod q */
108 if (ret == 0 && mp_invmod(&k, &key->q, &kInv) != MP_OKAY)
111 /* generate r, r = (g exp k mod p) mod q */
112 if (ret == 0 && mp_exptmod(&key->g, &k, &key->p, &r) != MP_OKAY)
115 if (ret == 0 && mp_mod(&r, &key->q, &r) != MP_OKAY)
118 /* generate H from sha digest */
119 if (ret == 0 && mp_read_unsigned_bin(&H, digest,SHA_DIGEST_SIZE) != MP_OKAY)
122 /* generate s, s = (kInv * (H + x*r)) % q */
123 if (ret == 0 && mp_mul(&key->x, &r, &s) != MP_OKAY)
126 if (ret == 0 && mp_add(&s, &H, &s) != MP_OKAY)
129 if (ret == 0 && mp_mulmod(&s, &kInv, &key->q, &s) != MP_OKAY)
134 int rSz = mp_unsigned_bin_size(&r);
135 int sSz = mp_unsigned_bin_size(&s);
137 if (rSz == DSA_HALF_SIZE - 1) {
142 if (mp_to_unsigned_bin(&r, out) != MP_OKAY)
145 if (sSz == DSA_HALF_SIZE - 1) {
149 ret = mp_to_unsigned_bin(&s, out + rSz);
163 int DsaVerify(const byte* digest, const byte* sig, DsaKey* key, int* answer)
165 mp_int w, u1, u2, v, r, s;
168 if (mp_init_multi(&w, &u1, &u2, &v, &r, &s) != MP_OKAY)
171 /* set r and s from signature */
172 if (mp_read_unsigned_bin(&r, sig, DSA_HALF_SIZE) != MP_OKAY ||
173 mp_read_unsigned_bin(&s, sig + DSA_HALF_SIZE, DSA_HALF_SIZE) != MP_OKAY)
179 /* put H into u1 from sha digest */
180 if (ret == 0 && mp_read_unsigned_bin(&u1,digest,SHA_DIGEST_SIZE) != MP_OKAY)
184 if (ret == 0 && mp_invmod(&s, &key->q, &w) != MP_OKAY)
187 /* u1 = (H * w) % q */
188 if (ret == 0 && mp_mulmod(&u1, &w, &key->q, &u1) != MP_OKAY)
191 /* u2 = (r * w) % q */
192 if (ret == 0 && mp_mulmod(&r, &w, &key->q, &u2) != MP_OKAY)
195 /* verify v = ((g^u1 * y^u2) mod p) mod q */
196 if (ret == 0 && mp_exptmod(&key->g, &u1, &key->p, &u1) != MP_OKAY)
199 if (ret == 0 && mp_exptmod(&key->y, &u2, &key->p, &u2) != MP_OKAY)
202 if (ret == 0 && mp_mulmod(&u1, &u2, &key->p, &v) != MP_OKAY)
205 if (ret == 0 && mp_mod(&v, &key->q, &v) != MP_OKAY)
209 if (ret == 0 && mp_cmp(&r, &v) == MP_EQ)