abc/GmSSL
1
0
Fork 0
mirror of https://github.com/guanzhi/GmSSL.git synced 2026-11-15 09:05:00 +08:00
Code Issues Packages Projects Releases Wiki Activity

Clean code

Browse Source
This commit is contained in:
Zhi Guan
2026-06-22 23:40:58 +08:00
parent 8ed5e266d1
commit 5581ad21b8
18 changed files with 1105 additions and 1150 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
src/ecdh.c
View File

@@ -26,9 +26,13 @@ int secp256r1_do_ecdh(const SECP256R1_KEY *key, const SECP256R1_KEY *peer_key, u
error_print();
return -1;
}
secp256r1_point_mul(&point, key->private_key, &peer_key->public_key);
secp256r1_point_get_xy(&point, x, y);
secp256r1_to_32bytes(x, out);
if (secp256r1_point_mul(&point, key->private_key, &peer_key->public_key) != 1
|| secp256r1_point_get_xy(&point, x, y) != 1
|| secp256r1_to_32bytes(x, out) != 1) {
error_print();
gmssl_secure_clear(&point, sizeof(SECP256R1_POINT));
return -1;
}
gmssl_secure_clear(&point, sizeof(SECP256R1_POINT));
gmssl_secure_clear(x, sizeof(secp256r1_t));
@@ -50,9 +54,13 @@ int secp256r1_ecdh(const SECP256R1_KEY *key, const uint8_t uncompressed_point[65
error_print();
return -1;
}
secp256r1_point_mul(&point, key->private_key, &point);
secp256r1_point_get_xy(&point, x,y);
secp256r1_to_32bytes(x, out);
if (secp256r1_point_mul(&point, key->private_key, &point) != 1
|| secp256r1_point_get_xy(&point, x,y) != 1
|| secp256r1_to_32bytes(x, out) != 1) {
error_print();
gmssl_secure_clear(&point, sizeof(SECP256R1_POINT));
return -1;
}
gmssl_secure_clear(&point, sizeof(SECP256R1_POINT));
gmssl_secure_clear(x, sizeof(secp256r1_t));

91
src/ecdsa.c
View File

@@ -23,8 +23,11 @@ int ecdsa_signature_print_ex(FILE *fp, int fmt, int ind, const char *label, cons
{
format_print(fp, fmt, ind, "%s\n", label);
ind += 4;
secp256r1_print(fp, fmt, ind, "r", sig->r);
secp256r1_print(fp, fmt, ind, "s", sig->s);
if (secp256r1_print(fp, fmt, ind, "r", sig->r) != 1
|| secp256r1_print(fp, fmt, ind, "s", sig->s) != 1) {
error_print();
return -1;
}
return 1;
}
@@ -53,21 +56,33 @@ int ecdsa_do_sign_ex(const SECP256R1_KEY *key, const secp256r1_t k, const uint8_
SECP256R1_POINT P;
// e = hash(m)
secp256r1_from_32bytes(e, dgst);
secp256r1_modn(e, e);
if (secp256r1_from_32bytes(e, dgst) != 1
|| secp256r1_modn(e, e) != 1) {
error_print();
return -1;
}
// (x1, y1) = k*G
secp256r1_point_mul_generator(&P, k);
secp256r1_point_get_xy(&P, x1, y1);
if (secp256r1_point_mul_generator(&P, k) != 1
|| secp256r1_point_get_xy(&P, x1, y1) != 1) {
error_print();
return -1;
}
// r = x1 mod n
secp256r1_modn(sig->r, x1);
if (secp256r1_modn(sig->r, x1) != 1) {
error_print();
return -1;
}
// s = k^-1 * (e + d * r) mod n
secp256r1_modn_inv(k_inv, k);
secp256r1_modn_mul(sig->s, key->private_key, sig->r);
secp256r1_modn_add(sig->s, sig->s, e);
secp256r1_modn_mul(sig->s, sig->s, k_inv);
if (secp256r1_modn_inv(k_inv, k) != 1
|| secp256r1_modn_mul(sig->s, key->private_key, sig->r) != 1
|| secp256r1_modn_add(sig->s, sig->s, e) != 1
|| secp256r1_modn_mul(sig->s, sig->s, k_inv) != 1) {
error_print();
return -1;
}
return 1;
}
@@ -114,26 +129,46 @@ int ecdsa_do_verify(const SECP256R1_KEY *key, const uint8_t dgst[32], const ECDS
}
// e = hash(m)
secp256r1_from_32bytes(e, dgst);
secp256r1_modn(e, e);
if (secp256r1_from_32bytes(e, dgst) != 1
|| secp256r1_modn(e, e) != 1) {
error_print();
return -1;
}
// w = s^-1 (mod n)
secp256r1_modn_inv(w, sig->s);
if (secp256r1_modn_inv(w, sig->s) != 1) {
error_print();
return -1;
}
// u1 = e * w (mod n)
secp256r1_modn_mul(u1, e, w);
if (secp256r1_modn_mul(u1, e, w) != 1) {
error_print();
return -1;
}
// u2 = r * w (mod n)
secp256r1_modn_mul(u2, sig->r, w);
if (secp256r1_modn_mul(u2, sig->r, w) != 1) {
error_print();
return -1;
}
// (x1, y1) = u1*G + u2*Q
secp256r1_point_mul_generator(&P, u1);
secp256r1_point_mul(&Q, u2, &key->public_key);
secp256r1_point_add(&R, &P, &Q);
secp256r1_point_get_xy(&R, x1, y1);
if (secp256r1_point_mul_generator(&P, u1) != 1
|| secp256r1_point_mul(&Q, u2, &key->public_key) != 1
|| secp256r1_point_add(&R, &P, &Q) != 1) {
error_print();
return -1;
}
if (secp256r1_point_get_xy(&R, x1, y1) != 1) {
return 0;
}
// x1 = x1 mod n
secp256r1_modn(x1, x1);
if (secp256r1_modn(x1, x1) != 1) {
error_print();
return -1;
}
if (secp256r1_cmp(x1, sig->r) != 0) {
return 0;
@@ -151,8 +186,11 @@ int ecdsa_signature_to_der(const ECDSA_SIGNATURE *sig, uint8_t **out, size_t *ou
return 0;
}
secp256r1_to_32bytes(sig->r, r);
secp256r1_to_32bytes(sig->s, s);
if (secp256r1_to_32bytes(sig->r, r) != 1
|| secp256r1_to_32bytes(sig->s, s) != 1) {
error_print();
return -1;
}
if (asn1_integer_to_der(r, 32, NULL, &len) != 1
|| asn1_integer_to_der(s, 32, NULL, &len) != 1
@@ -186,8 +224,11 @@ int ecdsa_signature_from_der(ECDSA_SIGNATURE *sig, const uint8_t **in, size_t *i
return -1;
}
secp256r1_from_32bytes(sig->r, r);
secp256r1_from_32bytes(sig->s, s);
if (secp256r1_from_32bytes(sig->r, r) != 1
|| secp256r1_from_32bytes(sig->s, s) != 1) {
error_print();
return -1;
}
return 1;
}

324
src/secp256r1.c
View File

@@ -256,11 +256,15 @@ const SECP256R1_POINT *secp256r1_generator(void)
return &secp256r1_generator_point;
}
void secp256r1_point_set_infinity(SECP256R1_POINT *R)
int secp256r1_point_set_infinity(SECP256R1_POINT *R)
{
secp256r1_set_one(R->X);
secp256r1_set_one(R->Y);
secp256r1_set_zero(R->Z);
if (secp256r1_set_one(R->X) != 1
|| secp256r1_set_one(R->Y) != 1
|| secp256r1_set_zero(R->Z) != 1) {
error_print();
return -1;
}
return 1;
}
int secp256r1_point_is_at_infinity(const SECP256R1_POINT *P)
@@ -284,48 +288,55 @@ int secp256r1_point_is_on_curve(const SECP256R1_POINT *P)
// check Y^2 + 3 * X * Z^4 == X^3 + b * Z^6
// t0 = Y^2
secp256r1_modp_sqr(t0, P->Y);
if (secp256r1_modp_sqr(t0, P->Y) != 1) goto err;
// t1 = Z^2
secp256r1_modp_sqr(t1, P->Z);
if (secp256r1_modp_sqr(t1, P->Z) != 1) goto err;
// t2 = Z^4
secp256r1_modp_sqr(t2, t1);
if (secp256r1_modp_sqr(t2, t1) != 1) goto err;
// t1 = Z^6
secp256r1_modp_mul(t1, t1, t2);
if (secp256r1_modp_mul(t1, t1, t2) != 1) goto err;
// t1 = b * Z^6
secp256r1_modp_mul(t1, t1, SECP256R1_B);
if (secp256r1_modp_mul(t1, t1, SECP256R1_B) != 1) goto err;
// t2 = X * Z^4
secp256r1_modp_mul(t2, t2, P->X);
if (secp256r1_modp_mul(t2, t2, P->X) != 1) goto err;
// t0 = Y^2 + 3 * X * Z^4
secp256r1_modp_add(t0, t0, t2);
secp256r1_modp_add(t0, t0, t2);
secp256r1_modp_add(t0, t0, t2);
if (secp256r1_modp_add(t0, t0, t2) != 1
|| secp256r1_modp_add(t0, t0, t2) != 1
|| secp256r1_modp_add(t0, t0, t2) != 1) goto err;
// t2 = X^2
secp256r1_modp_sqr(t2, P->X);
if (secp256r1_modp_sqr(t2, P->X) != 1) goto err;
// t2 = X^3
secp256r1_modp_mul(t2, t2, P->X);
if (secp256r1_modp_mul(t2, t2, P->X) != 1) goto err;
// t1 = b * Z^6 + X^3
secp256r1_modp_add(t1, t1, t2);
if (secp256r1_modp_add(t1, t1, t2) != 1) goto err;
if (secp256r1_cmp(t0, t1) != 0) {
return 0;
}
return 1;
err:
error_print();
return -1;
}
void secp256r1_point_copy(SECP256R1_POINT *R, const SECP256R1_POINT *P)
int secp256r1_point_copy(SECP256R1_POINT *R, const SECP256R1_POINT *P)
{
secp256r1_copy(R->X, P->X);
secp256r1_copy(R->Y, P->Y);
secp256r1_copy(R->Z, P->Z);
if (secp256r1_copy(R->X, P->X) != 1
|| secp256r1_copy(R->Y, P->Y) != 1
|| secp256r1_copy(R->Z, P->Z) != 1) {
error_print();
return -1;
}
return 1;
}
int secp256r1_point_set_xy(SECP256R1_POINT *R, const secp256r1_t x, const secp256r1_t y)
@@ -338,12 +349,15 @@ int secp256r1_point_set_xy(SECP256R1_POINT *R, const secp256r1_t x, const secp25
error_print();
return -1;
}
secp256r1_copy(R->X, x);
secp256r1_copy(R->Y, y);
secp256r1_set_one(R->Z);
if (secp256r1_copy(R->X, x) != 1
|| secp256r1_copy(R->Y, y) != 1
|| secp256r1_set_one(R->Z) != 1) {
error_print();
return -1;
}
if (!secp256r1_point_is_on_curve(R)) {
if (secp256r1_point_is_on_curve(R) != 1) {
error_print();
return -1;
}
@@ -355,17 +369,21 @@ int secp256r1_point_get_xy(const SECP256R1_POINT *P, secp256r1_t x, secp256r1_t
secp256r1_t Z_inv;
if (secp256r1_point_is_at_infinity(P)) {
return 0;
error_print();
return -1;
}
if (secp256r1_modp_inv(Z_inv, P->Z) != 1
|| secp256r1_modp_mul(y, P->Y, Z_inv) != 1
|| secp256r1_modp_sqr(Z_inv, Z_inv) != 1
|| secp256r1_modp_mul(x, P->X, Z_inv) != 1
|| secp256r1_modp_mul(y, y, Z_inv) != 1) {
error_print();
return -1;
}
secp256r1_modp_inv(Z_inv, P->Z);
secp256r1_modp_mul(y, P->Y, Z_inv);
secp256r1_modp_sqr(Z_inv, Z_inv);
secp256r1_modp_mul(x, P->X, Z_inv);
secp256r1_modp_mul(y, y, Z_inv);
return 1;
}
void secp256r1_point_dbl(SECP256R1_POINT *R, const SECP256R1_POINT *P)
int secp256r1_point_dbl(SECP256R1_POINT *R, const SECP256R1_POINT *P)
{
/*
secp256r1_t T_0;
@@ -413,62 +431,71 @@ void secp256r1_point_dbl(SECP256R1_POINT *R, const SECP256R1_POINT *P)
secp256r1_t Zsqr;
secp256r1_t tmp0;
if (secp256r1_point_is_at_infinity(P)) {
return secp256r1_point_set_infinity(R);
}
// 1. S = 2Y
secp256r1_modp_dbl(S, Y1);
if (secp256r1_modp_dbl(S, Y1) != 1) goto err;
// 2. Zsqr = Z^2
secp256r1_modp_sqr(Zsqr, Z1);
if (secp256r1_modp_sqr(Zsqr, Z1) != 1) goto err;
// 3. S = S^2 = 4Y^2
secp256r1_modp_sqr(S, S);
if (secp256r1_modp_sqr(S, S) != 1) goto err;
// 4. Z = Z*Y
secp256r1_modp_mul(Z3, Z1, Y1);
if (secp256r1_modp_mul(Z3, Z1, Y1) != 1) goto err;
// 5. Z = 2*Z = 2*Y*Z ===> Z3
secp256r1_modp_dbl(Z3, Z3);
if (secp256r1_modp_dbl(Z3, Z3) != 1) goto err;
// 6. M = X + Zsqr = X + Z^2
secp256r1_modp_add(M, X1, Zsqr);
if (secp256r1_modp_add(M, X1, Zsqr) != 1) goto err;
// 7. Zsqr = X - Zsqr = X - Z^2
secp256r1_modp_sub(Zsqr, X1, Zsqr);
if (secp256r1_modp_sub(Zsqr, X1, Zsqr) != 1) goto err;
// 8. Y = S^2 = 16Y^4
secp256r1_modp_sqr(Y3, S);
if (secp256r1_modp_sqr(Y3, S) != 1) goto err;
// 9. Y = Y/2 = 8Y^4
secp256r1_modp_haf(Y3, Y3);
if (secp256r1_modp_haf(Y3, Y3) != 1) goto err;
// 10. M = M * Zsqr = (X + Z^2)*(X - Z^2) = X^2 - Z^4
secp256r1_modp_mul(M, M, Zsqr);
if (secp256r1_modp_mul(M, M, Zsqr) != 1) goto err;
// 11. M = 3M = 3X^2 - 3Z^4
secp256r1_modp_tri(M, M);
if (secp256r1_modp_tri(M, M) != 1) goto err;
// 12. S = S * X = 4X*Y^2
secp256r1_modp_mul(S, S, X1);
if (secp256r1_modp_mul(S, S, X1) != 1) goto err;
// 13. tmp0 = 2 * S = 8X*Y^2
secp256r1_modp_dbl(tmp0, S);
if (secp256r1_modp_dbl(tmp0, S) != 1) goto err;
// 14. X = M^2 = (3X^2 - 3Z^4)^2
secp256r1_modp_sqr(X3, M);
if (secp256r1_modp_sqr(X3, M) != 1) goto err;
// 15. X = X - tmp0 = (3X^2 - 3Z^4)^2 - 8X*Y^2 ===> X3
secp256r1_modp_sub(X3, X3, tmp0);
if (secp256r1_modp_sub(X3, X3, tmp0) != 1) goto err;
// 16. S = S - X3 = 4X*Y^2 - X3
secp256r1_modp_sub(S, S, X3);
if (secp256r1_modp_sub(S, S, X3) != 1) goto err;
// 17. S = S * M = (3X^2 - 3Z^4)*(4X*Y^2 - X3)
secp256r1_modp_mul(S, S, M);
if (secp256r1_modp_mul(S, S, M) != 1) goto err;
// 18. Y = S - Y = (3X^2 - 3Z^4)*(4X*Y^2 - X3) - 8Y^4 ===> Y3
secp256r1_modp_sub(Y3, S, Y3);
if (secp256r1_modp_sub(Y3, S, Y3) != 1) goto err;
return 1;
err:
error_print();
return -1;
}
void secp256r1_point_add(SECP256R1_POINT *R, const SECP256R1_POINT *P, const SECP256R1_POINT *Q)
int secp256r1_point_add(SECP256R1_POINT *R, const SECP256R1_POINT *P, const SECP256R1_POINT *Q)
{
secp256r1_t T_1;
secp256r1_t T_2;
@@ -480,101 +507,126 @@ void secp256r1_point_add(SECP256R1_POINT *R, const SECP256R1_POINT *P, const SEC
secp256r1_t T_8;
if (secp256r1_point_is_at_infinity(P)) {
*R = *Q;
return;
return secp256r1_point_copy(R, Q);
}
if (secp256r1_point_is_at_infinity(Q)) {
*R = *P;
return;
return secp256r1_point_copy(R, P);
}
// 这里的代码是来自zkrypt的，不确定是否有问题
secp256r1_modp_sqr(T_1, P->Z); // T_1 = Z_1^2
secp256r1_modp_sqr(T_2, Q->Z); // T_2 = Z_2^2
secp256r1_modp_mul(T_3, Q->X, T_1); // T_3 = X_2 * Z_1^2
secp256r1_modp_mul(T_4, P->X, T_2); // T_4 = X_1 * Z_2^2
secp256r1_modp_add(T_5, T_3, T_4); // T_5 = X_2 * Z_1^2 + X_1 * Z_2^2 = C
secp256r1_modp_sub(T_3, T_3, T_4); // T_3 = X_2 * Z_1^2 - X_1 * Z_2^2 = B
secp256r1_modp_mul(T_1, T_1, P->Z); // T_1 = Z_1^3
secp256r1_modp_mul(T_1, T_1, Q->Y); // T_1 = Y_2 * Z_1^3
secp256r1_modp_mul(T_2, T_2, Q->Z); // T_2 = Z_2^3
secp256r1_modp_mul(T_2, T_2, P->Y); // T_2 = Y_1 * Z_2^3
secp256r1_modp_add(T_6, T_1, T_2); // T_6 = Y_2 * Z_1^3 + Y_1 * Z_2^3 = D
secp256r1_modp_sub(T_1, T_1, T_2); // T_1 = Y_2 * Z_1^3 - Y_1 * Z_2^3 = A
if (secp256r1_modp_sqr(T_1, P->Z) != 1 // T_1 = Z_1^2
|| secp256r1_modp_sqr(T_2, Q->Z) != 1 // T_2 = Z_2^2
|| secp256r1_modp_mul(T_3, Q->X, T_1) != 1 // T_3 = X_2 * Z_1^2
|| secp256r1_modp_mul(T_4, P->X, T_2) != 1 // T_4 = X_1 * Z_2^2
|| secp256r1_modp_add(T_5, T_3, T_4) != 1 // T_5 = X_2 * Z_1^2 + X_1 * Z_2^2 = C
|| secp256r1_modp_sub(T_3, T_3, T_4) != 1 // T_3 = X_2 * Z_1^2 - X_1 * Z_2^2 = B
|| secp256r1_modp_mul(T_1, T_1, P->Z) != 1 // T_1 = Z_1^3
|| secp256r1_modp_mul(T_1, T_1, Q->Y) != 1 // T_1 = Y_2 * Z_1^3
|| secp256r1_modp_mul(T_2, T_2, Q->Z) != 1 // T_2 = Z_2^3
|| secp256r1_modp_mul(T_2, T_2, P->Y) != 1 // T_2 = Y_1 * Z_2^3
|| secp256r1_modp_add(T_6, T_1, T_2) != 1 // T_6 = Y_2 * Z_1^3 + Y_1 * Z_2^3 = D
|| secp256r1_modp_sub(T_1, T_1, T_2) != 1) { // T_1 = Y_2 * Z_1^3 - Y_1 * Z_2^3 = A
error_print();
return -1;
}
if (secp256r1_is_zero(T_1) && secp256r1_is_zero(T_3)) {
secp256r1_point_dbl(R, P);
return;
return secp256r1_point_dbl(R, P);
}
if (secp256r1_is_one(T_1) && secp256r1_is_zero(T_6)) {
secp256r1_point_set_infinity(R);
return;
if (secp256r1_is_zero(T_3) && secp256r1_is_zero(T_6)) {
return secp256r1_point_set_infinity(R);
}
secp256r1_modp_sqr(T_6, T_1); // T_6 = A^2
secp256r1_modp_mul(T_7, T_3, P->Z); // T_7 = B * Z_1
secp256r1_modp_mul(T_7, T_7, Q->Z); // T_7 = B * Z_1 * Z_2 = Z_3
secp256r1_modp_sqr(T_8, T_3); // T_8 = B^2
secp256r1_modp_mul(T_5, T_5, T_8); // T_5 = B^2 * C
secp256r1_modp_mul(T_3, T_3, T_8); // T_3 = B^3
secp256r1_modp_mul(T_4, T_4, T_8); // T_4 = B^2 * X_1 * Z_2^2
secp256r1_modp_sub(T_6, T_6, T_5); // T_6 = A^2 - B^2 * C = X_3
secp256r1_modp_sub(T_4, T_4, T_6); // T_4 = B^2 * X_1 * Z_2^2 - X_3
secp256r1_modp_mul(T_1, T_1, T_4); // T_1 = A * (B^2 * X_1 * Z_2^2 - X_3)
secp256r1_modp_mul(T_2, T_2, T_3); // T_2 = B^3 * Y_1 * Z_1^3
secp256r1_modp_sub(T_1, T_1, T_2); // T_1 = A * (B^2 * X_1 * Z_2^2 - X_3) - B^3 * Y_1 * Z_1^3 = Y_3
if (secp256r1_modp_sqr(T_6, T_1) != 1 // T_6 = A^2
|| secp256r1_modp_mul(T_7, T_3, P->Z) != 1 // T_7 = B * Z_1
|| secp256r1_modp_mul(T_7, T_7, Q->Z) != 1 // T_7 = B * Z_1 * Z_2 = Z_3
|| secp256r1_modp_sqr(T_8, T_3) != 1 // T_8 = B^2
|| secp256r1_modp_mul(T_5, T_5, T_8) != 1 // T_5 = B^2 * C
|| secp256r1_modp_mul(T_3, T_3, T_8) != 1 // T_3 = B^3
|| secp256r1_modp_mul(T_4, T_4, T_8) != 1 // T_4 = B^2 * X_1 * Z_2^2
|| secp256r1_modp_sub(T_6, T_6, T_5) != 1 // T_6 = A^2 - B^2 * C = X_3
|| secp256r1_modp_sub(T_4, T_4, T_6) != 1 // T_4 = B^2 * X_1 * Z_2^2 - X_3
|| secp256r1_modp_mul(T_1, T_1, T_4) != 1 // T_1 = A * (B^2 * X_1 * Z_2^2 - X_3)
|| secp256r1_modp_mul(T_2, T_2, T_3) != 1 // T_2 = B^3 * Y_1 * Z_1^3
|| secp256r1_modp_sub(T_1, T_1, T_2) != 1) { // T_1 = A * (B^2 * X_1 * Z_2^2 - X_3) - B^3 * Y_1 * Z_1^3 = Y_3
error_print();
return -1;
}
secp256r1_copy(R->X, T_6);
secp256r1_copy(R->Y, T_1);
secp256r1_copy(R->Z, T_7);
if (secp256r1_copy(R->X, T_6) != 1
|| secp256r1_copy(R->Y, T_1) != 1
|| secp256r1_copy(R->Z, T_7) != 1) {
error_print();
return -1;
}
return 1;
}
void secp256r1_point_neg(SECP256R1_POINT *R, const SECP256R1_POINT *P)
int secp256r1_point_neg(SECP256R1_POINT *R, const SECP256R1_POINT *P)
{
if (secp256r1_point_is_at_infinity(P)) {
secp256r1_point_set_infinity(R);
return;
return secp256r1_point_set_infinity(R);
}
secp256r1_copy(R->X, P->X);
secp256r1_modp_neg(R->Y, P->Y);
secp256r1_copy(R->Z, P->Z);
if (secp256r1_copy(R->X, P->X) != 1
|| secp256r1_modp_neg(R->Y, P->Y) != 1
|| secp256r1_copy(R->Z, P->Z) != 1) {
error_print();
return -1;
}
return 1;
}
void secp256r1_point_sub(SECP256R1_POINT *R, const SECP256R1_POINT *P, const SECP256R1_POINT *Q)
int secp256r1_point_sub(SECP256R1_POINT *R, const SECP256R1_POINT *P, const SECP256R1_POINT *Q)
{
SECP256R1_POINT T;
secp256r1_point_neg(&T, Q);
secp256r1_point_add(R, P, &T);
if (secp256r1_point_neg(&T, Q) != 1
|| secp256r1_point_add(R, P, &T) != 1) {
error_print();
return -1;
}
return 1;
}
void secp256r1_point_mul(SECP256R1_POINT *R, const secp256r1_t k, const SECP256R1_POINT *P)
int secp256r1_point_mul(SECP256R1_POINT *R, const secp256r1_t k, const SECP256R1_POINT *P)
{
SECP256R1_POINT T;
uint32_t bits;
int nbits;
int i;
secp256r1_point_set_infinity(&T);
if (secp256r1_point_set_infinity(&T) != 1) {
error_print();
return -1;
}
for (i = 7; i >= 0; i--) {
bits = k[i];
nbits = 32;
while (nbits-- > 0) {
secp256r1_point_dbl(&T, &T);
if (secp256r1_point_dbl(&T, &T) != 1) {
error_print();
return -1;
}
if (bits & 0x80000000) {
secp256r1_point_add(&T, &T, P);
if (secp256r1_point_add(&T, &T, P) != 1) {
error_print();
return -1;
}
}
bits <<= 1;
}
}
secp256r1_point_copy(R, &T);
if (secp256r1_point_copy(R, &T) != 1) {
error_print();
return -1;
}
return 1;
}
void secp256r1_point_mul_generator(SECP256R1_POINT *R, const secp256r1_t k)
int secp256r1_point_mul_generator(SECP256R1_POINT *R, const secp256r1_t k)
{
secp256r1_point_mul(R, k, secp256r1_generator());
return secp256r1_point_mul(R, k, secp256r1_generator());
}
int secp256r1_point_print(FILE *fp, int fmt, int ind, const char *label, const SECP256R1_POINT *P)
@@ -583,11 +635,20 @@ int secp256r1_point_print(FILE *fp, int fmt, int ind, const char *label, const S
format_print(fp, fmt, ind, "%s\n", label);
ind += 4;
secp256r1_to_32bytes(P->X, bytes);
if (secp256r1_to_32bytes(P->X, bytes) != 1) {
error_print();
return -1;
}
format_bytes(fp, fmt, ind, "X", bytes, 32);
secp256r1_to_32bytes(P->Y, bytes);
if (secp256r1_to_32bytes(P->Y, bytes) != 1) {
error_print();
return -1;
}
format_bytes(fp, fmt, ind, "Y", bytes, 32);
secp256r1_to_32bytes(P->Z, bytes);
if (secp256r1_to_32bytes(P->Z, bytes) != 1) {
error_print();
return -1;
}
format_bytes(fp, fmt, ind, "Z", bytes, 32);
return 1;
}
@@ -602,8 +663,11 @@ int secp256r1_point_to_uncompressed_octets(const SECP256R1_POINT *P, uint8_t oct
return -1;
}
octets[0] = 0x04;
secp256r1_to_32bytes(x, octets + 1);
secp256r1_to_32bytes(y, octets + 33);
if (secp256r1_to_32bytes(x, octets + 1) != 1
|| secp256r1_to_32bytes(y, octets + 33) != 1) {
error_print();
return -1;
}
return 1;
}
@@ -616,8 +680,11 @@ int secp256r1_point_from_uncompressed_octets(SECP256R1_POINT *P, const uint8_t o
error_print();
return -1;
}
secp256r1_from_32bytes(x, octets + 1);
secp256r1_from_32bytes(y, octets + 33);
if (secp256r1_from_32bytes(x, octets + 1) != 1
|| secp256r1_from_32bytes(y, octets + 33) != 1) {
error_print();
return -1;
}
if (secp256r1_point_set_xy(P, x, y) != 1) {
error_print();
@@ -628,15 +695,36 @@ int secp256r1_point_from_uncompressed_octets(SECP256R1_POINT *P, const uint8_t o
int secp256r1_point_equ(const SECP256R1_POINT *P, const SECP256R1_POINT *Q)
{
uint8_t p_octets[65];
uint8_t q_octets[65];
secp256r1_t t0;
secp256r1_t t1;
secp256r1_t t2;
secp256r1_t t3;
(void)secp256r1_point_to_uncompressed_octets(P, p_octets);
(void)secp256r1_point_to_uncompressed_octets(Q, q_octets);
if (memcmp(p_octets, q_octets, 65) == 0) {
return 1;
} else {
if (secp256r1_point_is_at_infinity(P)) {
return secp256r1_point_is_at_infinity(Q);
}
if (secp256r1_point_is_at_infinity(Q)) {
return 0;
}
if (secp256r1_modp_sqr(t0, P->Z) != 1 // t0 = Z1^2
|| secp256r1_modp_sqr(t1, Q->Z) != 1 // t1 = Z2^2
|| secp256r1_modp_mul(t2, Q->X, t0) != 1 // t2 = X2 * Z1^2
|| secp256r1_modp_mul(t3, P->X, t1) != 1) { // t3 = X1 * Z2^2
error_print();
return -1;
}
if (secp256r1_cmp(t2, t3) != 0) {
return 0;
}
if (secp256r1_modp_mul(t0, t0, P->Z) != 1 // t0 = Z1^3
|| secp256r1_modp_mul(t0, t0, Q->Y) != 1 // t0 = Y2 * Z1^3
|| secp256r1_modp_mul(t1, t1, Q->Z) != 1 // t1 = Z2^3
|| secp256r1_modp_mul(t1, t1, P->Y) != 1) { // t1 = Y1 * Z2^3
error_print();
return -1;
}
return secp256r1_cmp(t0, t1) == 0;
}

45
src/secp256r1_key.c
View File

@@ -34,7 +34,10 @@ int secp256r1_key_generate(SECP256R1_KEY *key)
}
} while (secp256r1_is_zero(key->private_key) || secp256r1_cmp(key->private_key, SECP256R1_N) >= 0);
secp256r1_point_mul_generator(&key->public_key, key->private_key);
if (secp256r1_point_mul_generator(&key->public_key, key->private_key) != 1) {
error_print();
return -1;
}
return 1;
}
@@ -51,8 +54,11 @@ int secp256r1_key_set_private_key(SECP256R1_KEY *key, const secp256r1_t private_
}
memset(key, 0, sizeof(SECP256R1_KEY));
secp256r1_copy(key->private_key, private_key);
secp256r1_point_mul_generator(&key->public_key, key->private_key);
if (secp256r1_copy(key->private_key, private_key) != 1
|| secp256r1_point_mul_generator(&key->public_key, key->private_key) != 1) {
error_print();
return -1;
}
return 1;
}
@@ -114,13 +120,19 @@ int secp256r1_public_key_print(FILE *fp, int fmt, int ind, const char *label, co
format_print(fp, fmt, ind, "%s\n", label);
ind += 4;
secp256r1_print(fp, fmt, ind, "X", key->public_key.X);
secp256r1_print(fp, fmt, ind, "Y", key->public_key.Y);
secp256r1_print(fp, fmt, ind, "Z", key->public_key.Z);
if (secp256r1_print(fp, fmt, ind, "X", key->public_key.X) != 1
|| secp256r1_print(fp, fmt, ind, "Y", key->public_key.Y) != 1
|| secp256r1_print(fp, fmt, ind, "Z", key->public_key.Z) != 1) {
error_print();
return -1;
}
secp256r1_point_get_xy(&key->public_key, x, y);
secp256r1_print(fp, fmt, ind, "x", x);
secp256r1_print(fp, fmt, ind, "y", y);
if (secp256r1_point_get_xy(&key->public_key, x, y) != 1
|| secp256r1_print(fp, fmt, ind, "x", x) != 1
|| secp256r1_print(fp, fmt, ind, "y", y) != 1) {
error_print();
return -1;
}
return 1;
}
@@ -128,7 +140,10 @@ int secp256r1_private_key_print(FILE *fp, int fmt, int ind, const char *label, c
{
uint8_t buf[32];
secp256r1_to_32bytes(key->private_key, buf);
if (secp256r1_to_32bytes(key->private_key, buf) != 1) {
error_print();
return -1;
}
format_print(fp, fmt, ind, "%s\n", label);
ind += 4;
@@ -229,7 +244,10 @@ int secp256r1_private_key_to_der(const SECP256R1_KEY *key, uint8_t **out, size_t
}
// fprintf(stderr, "%s %d: params_len = %zu\n", params_len);
// fprintf(stderr, "%s %d: pubkey_len = %zu\n", pubkey_len);
secp256r1_to_32bytes(key->private_key, prikey);
if (secp256r1_to_32bytes(key->private_key, prikey) != 1) {
error_print();
return -1;
}
if (asn1_int_to_der(EC_private_key_version, NULL, &len) != 1
|| asn1_octet_string_to_der(prikey, 32, NULL, &len) != 1
|| asn1_explicit_to_der(0, params, params_len, NULL, &len) != 1
@@ -297,7 +315,10 @@ int secp256r1_private_key_from_der(SECP256R1_KEY *key, const uint8_t **in, size_
error_print();
return -1;
}
secp256r1_from_32bytes(private_key, prikey);
if (secp256r1_from_32bytes(private_key, prikey) != 1) {
error_print();
return -1;
}
if (secp256r1_key_set_private_key(key, private_key) != 1) {
gmssl_secure_clear(private_key, 32);
error_print();

230
src/sphincs.c
View File

@@ -267,11 +267,11 @@ void sphincs_wots_derive_sk(const sphincs_hash128_t secret,
const sphincs_hash128_t seed, const sphincs_adrs_t in_adrs,
sphincs_wots_key_t sk)
{
uint8_t block[SPHINCS_HASH256_BLOCK_SIZE] = {0};
uint8_t block[SM3_BLOCK_SIZE] = {0};
sphincs_adrs_t adrs;
sphincs_adrsc_t adrsc;
SPHINCS_HASH256_CTX ctx;
sphincs_hash256_t dgst;
SM3_CTX ctx;
sphincs_sm3_digest_t dgst;
int i;
memcpy(block, seed, sizeof(sphincs_hash128_t));
@@ -287,11 +287,11 @@ void sphincs_wots_derive_sk(const sphincs_hash128_t secret,
sphincs_adrs_compress(adrs, adrsc);
// sk[i] = prf(secret, adrs)
sphincs_hash256_init(&ctx);
sphincs_hash256_update(&ctx, block, sizeof(block));
sphincs_hash256_update(&ctx, adrsc, sizeof(adrsc));
sphincs_hash256_update(&ctx, secret, sizeof(sphincs_hash128_t));
sphincs_hash256_finish(&ctx, dgst);
sm3_init(&ctx);
sm3_update(&ctx, block, sizeof(block));
sm3_update(&ctx, adrsc, sizeof(adrsc));
sm3_update(&ctx, secret, sizeof(sphincs_hash128_t));
sm3_finish(&ctx, dgst);
memcpy(sk[i], dgst, sizeof(sphincs_hash128_t));
}
@@ -303,11 +303,11 @@ void sphincs_wots_chain(const sphincs_hash128_t x,
int start, int steps, sphincs_hash128_t y)
{
const uint8_t uint32_zero[4] = {0};
uint8_t block[SPHINCS_HASH256_BLOCK_SIZE] = {0};
uint8_t block[SM3_BLOCK_SIZE] = {0};
sphincs_adrs_t adrs;
sphincs_adrsc_t adrsc;
SPHINCS_HASH256_CTX ctx;
sphincs_hash256_t dgst;
SM3_CTX ctx;
sphincs_sm3_digest_t dgst;
int i;
memcpy(block, seed, sizeof(sphincs_hash128_t));
@@ -324,12 +324,12 @@ void sphincs_wots_chain(const sphincs_hash128_t x,
sphincs_adrs_set_hash_address(adrs, start + i);
sphincs_adrs_compress(adrs, adrsc);
// y = hash256(blockpad(seed) || adrsc || y)
sphincs_hash256_init(&ctx);
sphincs_hash256_update(&ctx, block, sizeof(block));
sphincs_hash256_update(&ctx, adrsc, sizeof(sphincs_adrsc_t));
sphincs_hash256_update(&ctx, y, sizeof(sphincs_hash128_t));
sphincs_hash256_finish(&ctx, dgst);
// y = block_hash(blockpad(seed) || adrsc || y)
sm3_init(&ctx);
sm3_update(&ctx, block, sizeof(block));
sm3_update(&ctx, adrsc, sizeof(sphincs_adrsc_t));
sm3_update(&ctx, y, sizeof(sphincs_hash128_t));
sm3_finish(&ctx, dgst);
memcpy(y, dgst, sizeof(sphincs_hash128_t));
}
@@ -438,11 +438,11 @@ void sphincs_wots_pk_to_root(const sphincs_wots_key_t pk,
const sphincs_hash128_t seed, const sphincs_adrs_t in_adrs,
sphincs_hash128_t root)
{
uint8_t block[SPHINCS_HASH256_BLOCK_SIZE] = {0};
uint8_t block[SM3_BLOCK_SIZE] = {0};
sphincs_adrs_t adrs = {0};
sphincs_adrsc_t adrsc;
SPHINCS_HASH256_CTX ctx;
sphincs_hash256_t dgst;
SM3_CTX ctx;
sphincs_sm3_digest_t dgst;
memcpy(block, seed, sizeof(sphincs_hash128_t));
@@ -452,11 +452,11 @@ void sphincs_wots_pk_to_root(const sphincs_wots_key_t pk,
sphincs_adrs_copy_keypair_address(adrs, in_adrs);
sphincs_adrs_compress(adrs, adrsc);
sphincs_hash256_init(&ctx);
sphincs_hash256_update(&ctx, block, sizeof(block));
sphincs_hash256_update(&ctx, adrsc, sizeof(adrsc));
sphincs_hash256_update(&ctx, pk[0], sizeof(sphincs_wots_key_t));
sphincs_hash256_finish(&ctx, dgst);
sm3_init(&ctx);
sm3_update(&ctx, block, sizeof(block));
sm3_update(&ctx, adrsc, sizeof(adrsc));
sm3_update(&ctx, pk[0], sizeof(sphincs_wots_key_t));
sm3_finish(&ctx, dgst);
memcpy(root, dgst, sizeof(sphincs_hash128_t));
}
@@ -465,15 +465,15 @@ void sphincs_tree_hash(const sphincs_hash128_t left_child, const sphincs_hash128
const sphincs_hash128_t seed, const sphincs_adrs_t adrs,
sphincs_hash128_t parent)
{
SPHINCS_HASH256_CTX ctx;
sphincs_hash256_t dgst;
SM3_CTX ctx;
sphincs_sm3_digest_t dgst;
sphincs_hash256_init(&ctx);
sphincs_hash256_update(&ctx, seed, sizeof(sphincs_hash128_t));
sphincs_hash256_update(&ctx, adrs, sizeof(sphincs_adrs_t));
sphincs_hash256_update(&ctx, left_child, sizeof(sphincs_hash128_t));
sphincs_hash256_update(&ctx, right_child, sizeof(sphincs_hash128_t));
sphincs_hash256_finish(&ctx, dgst);
sm3_init(&ctx);
sm3_update(&ctx, seed, sizeof(sphincs_hash128_t));
sm3_update(&ctx, adrs, sizeof(sphincs_adrs_t));
sm3_update(&ctx, left_child, sizeof(sphincs_hash128_t));
sm3_update(&ctx, right_child, sizeof(sphincs_hash128_t));
sm3_finish(&ctx, dgst);
memcpy(parent, dgst, sizeof(sphincs_hash128_t));
}
@@ -801,11 +801,11 @@ void sphincs_fors_derive_sk(const sphincs_hash128_t secret,
const sphincs_hash128_t seed, const sphincs_adrs_t in_adrs,
uint32_t fors_index, sphincs_hash128_t sk)
{
uint8_t block[SPHINCS_HASH256_BLOCK_SIZE] = {0};
uint8_t block[SM3_BLOCK_SIZE] = {0};
sphincs_adrs_t adrs;
sphincs_adrsc_t adrsc;
SPHINCS_HASH256_CTX ctx;
sphincs_hash256_t dgst;
SM3_CTX ctx;
sphincs_sm3_digest_t dgst;
// blockpad(seed)
memcpy(block, seed, sizeof(sphincs_hash128_t));
@@ -820,12 +820,12 @@ void sphincs_fors_derive_sk(const sphincs_hash128_t secret,
// compress adrs
sphincs_adrs_compress(adrs, adrsc);
// sk = prf(seed, secret, adrs) = hash256(blockpad(seed)||adrsc||secret)
sphincs_hash256_init(&ctx);
sphincs_hash256_update(&ctx, block, sizeof(block));
sphincs_hash256_update(&ctx, adrsc, sizeof(adrsc));
sphincs_hash256_update(&ctx, secret, sizeof(sphincs_hash128_t));
sphincs_hash256_finish(&ctx, dgst);
// sk = prf(seed, secret, adrs) = block_hash(blockpad(seed)||adrsc||secret)
sm3_init(&ctx);
sm3_update(&ctx, block, sizeof(block));
sm3_update(&ctx, adrsc, sizeof(adrsc));
sm3_update(&ctx, secret, sizeof(sphincs_hash128_t));
sm3_finish(&ctx, dgst);
memcpy(sk, dgst, sizeof(sphincs_hash128_t));
gmssl_secure_clear(dgst, sizeof(dgst));
@@ -840,8 +840,8 @@ void sphincs_fors_build_tree(const sphincs_hash128_t secret,
sphincs_adrsc_t adrsc;
uint32_t n = 1 << SPHINCS_FORS_TREE_HEIGHT;
uint32_t tree_index;
SPHINCS_HASH256_CTX ctx;
sphincs_hash256_t dgst;
SM3_CTX ctx;
sphincs_sm3_digest_t dgst;
sphincs_hash128_t *children;
sphincs_hash128_t *parents;
uint32_t h;
@@ -864,11 +864,11 @@ void sphincs_fors_build_tree(const sphincs_hash128_t secret,
sphincs_adrs_compress(adrs, adrsc);
sphincs_hash256_init(&ctx);
sphincs_hash256_update(&ctx, block, sizeof(block));
sphincs_hash256_update(&ctx, adrsc, sizeof(adrsc));
sphincs_hash256_update(&ctx, tree[i], sizeof(sphincs_hash128_t));
sphincs_hash256_finish(&ctx, dgst);
sm3_init(&ctx);
sm3_update(&ctx, block, sizeof(block));
sm3_update(&ctx, adrsc, sizeof(adrsc));
sm3_update(&ctx, tree[i], sizeof(sphincs_hash128_t));
sm3_finish(&ctx, dgst);
memcpy(tree[i], dgst, sizeof(sphincs_hash128_t));
}
@@ -898,8 +898,8 @@ void sphincs_fors_derive_root(const sphincs_hash128_t secret,
sphincs_adrsc_t adrsc;
sphincs_hash128_t tree[SPHINCS_FORS_TREE_NUM_NODES];
sphincs_hash128_t roots[SPHINCS_FORS_NUM_TREES];
SPHINCS_HASH256_CTX ctx;
sphincs_hash256_t dgst;
SM3_CTX ctx;
sphincs_sm3_digest_t dgst;
int i;
memcpy(block, seed, sizeof(sphincs_hash128_t));
@@ -917,11 +917,11 @@ void sphincs_fors_derive_root(const sphincs_hash128_t secret,
memcpy(roots[i], tree[SPHINCS_FORS_TREE_NUM_NODES - 1], sizeof(sphincs_hash128_t));
}
sphincs_hash256_init(&ctx);
sphincs_hash256_update(&ctx, block, sizeof(block));
sphincs_hash256_update(&ctx, adrsc, sizeof(adrsc));
sphincs_hash256_update(&ctx, roots[0], sizeof(roots));
sphincs_hash256_finish(&ctx, dgst);
sm3_init(&ctx);
sm3_update(&ctx, block, sizeof(block));
sm3_update(&ctx, adrsc, sizeof(adrsc));
sm3_update(&ctx, roots[0], sizeof(roots));
sm3_finish(&ctx, dgst);
memcpy(root, dgst, sizeof(sphincs_hash128_t));
}
@@ -1013,8 +1013,8 @@ void sphincs_fors_sign(const sphincs_hash128_t secret,
uint8_t block[64] = {0};
sphincs_adrs_t adrs;
sphincs_adrsc_t adrsc;
SPHINCS_HASH256_CTX ctx;
sphincs_hash256_t root;
SM3_CTX ctx;
sphincs_sm3_digest_t root;
tree_index = index[0];
@@ -1027,11 +1027,11 @@ void sphincs_fors_sign(const sphincs_hash128_t secret,
sphincs_adrs_compress(adrs, adrsc);
sphincs_hash256_init(&ctx);
sphincs_hash256_update(&ctx, block, sizeof(block));
sphincs_hash256_update(&ctx, adrsc, sizeof(adrsc));
sphincs_hash256_update(&ctx, sig->fors_sk[0], sizeof(sphincs_hash128_t));
sphincs_hash256_finish(&ctx, root);
sm3_init(&ctx);
sm3_update(&ctx, block, sizeof(block));
sm3_update(&ctx, adrsc, sizeof(adrsc));
sm3_update(&ctx, sig->fors_sk[0], sizeof(sphincs_hash128_t));
sm3_finish(&ctx, root);
format_bytes(stderr, 0, 4, "fors_tree[0]", root, 16);
@@ -1072,8 +1072,8 @@ void sphincs_fors_sig_to_root(const SPHINCS_FORS_SIGNATURE *sig,
uint8_t block[64] = {0};
sphincs_adrs_t adrs;
sphincs_adrsc_t adrsc;
SPHINCS_HASH256_CTX ctx;
sphincs_hash256_t dgst;
SM3_CTX ctx;
sphincs_sm3_digest_t dgst;
uint32_t index[14];
uint32_t tree_index;
@@ -1103,11 +1103,11 @@ void sphincs_fors_sig_to_root(const SPHINCS_FORS_SIGNATURE *sig,
sphincs_adrs_compress(adrs, adrsc);
sphincs_hash256_init(&ctx);
sphincs_hash256_update(&ctx, block, sizeof(block));
sphincs_hash256_update(&ctx, adrsc, sizeof(adrsc));
sphincs_hash256_update(&ctx, sig->fors_sk[i], sizeof(sphincs_hash128_t));
sphincs_hash256_finish(&ctx, dgst);
sm3_init(&ctx);
sm3_update(&ctx, block, sizeof(block));
sm3_update(&ctx, adrsc, sizeof(adrsc));
sm3_update(&ctx, sig->fors_sk[i], sizeof(sphincs_hash128_t));
sm3_finish(&ctx, dgst);
memcpy(root, dgst, 16);
@@ -1148,11 +1148,11 @@ void sphincs_fors_sig_to_root(const SPHINCS_FORS_SIGNATURE *sig,
sphincs_adrs_compress(adrs, adrsc);
sphincs_hash256_init(&ctx);
sphincs_hash256_update(&ctx, block, sizeof(block));
sphincs_hash256_update(&ctx, adrsc, sizeof(adrsc));
sphincs_hash256_update(&ctx, fors_tree_roots[0], sizeof(fors_tree_roots));
sphincs_hash256_finish(&ctx, dgst);
sm3_init(&ctx);
sm3_update(&ctx, block, sizeof(block));
sm3_update(&ctx, adrsc, sizeof(adrsc));
sm3_update(&ctx, fors_tree_roots[0], sizeof(fors_tree_roots));
sm3_finish(&ctx, dgst);
memcpy(root, dgst, 16);
@@ -1419,10 +1419,10 @@ int sphincs_sign_init_ex(SPHINCS_SIGN_CTX *ctx, const SPHINCS_KEY *key, const sp
ctx->key = *key;
// R = PRF_msg(sk_prf, optrand, M) = HMAC(sk_prf, opt_rand|M)
sphincs_hmac256_init(&ctx->hmac_ctx, key->sk_prf, sizeof(sphincs_hash128_t));
sm3_hmac_init(&ctx->hmac_ctx, key->sk_prf, sizeof(sphincs_hash128_t));
if (opt_rand)
sphincs_hmac256_update(&ctx->hmac_ctx, opt_rand, sizeof(sphincs_hash128_t));
else sphincs_hmac256_update(&ctx->hmac_ctx, key->public_key.seed, sizeof(sphincs_hash128_t));
sm3_hmac_update(&ctx->hmac_ctx, opt_rand, sizeof(sphincs_hash128_t));
else sm3_hmac_update(&ctx->hmac_ctx, key->public_key.seed, sizeof(sphincs_hash128_t));
// state
ctx->state = 1;
@@ -1463,7 +1463,7 @@ int sphincs_sign_prepare(SPHINCS_SIGN_CTX *ctx, const uint8_t *data, size_t data
if (data && datalen) {
// R = PRF_msg(sk_prf, optrand, M) = HMAC(sk_prf, opt_rand|M...)
sphincs_hmac256_update(&ctx->hmac_ctx, data, datalen);
sm3_hmac_update(&ctx->hmac_ctx, data, datalen);
// sum datalen
ctx->round1_msglen += datalen;
}
@@ -1480,17 +1480,17 @@ int sphincs_sign_update(SPHINCS_SIGN_CTX *ctx, const uint8_t *data, size_t datal
// state
if (ctx->state == 2) {
sphincs_hash256_t dgst;
sphincs_sm3_digest_t dgst;
// R = PRF_msg(sk_prf, optrand, M) = HMAC(sk_prf, opt_rand|M)
sphincs_hmac256_finish(&ctx->hmac_ctx, dgst);
sm3_hmac_finish(&ctx->hmac_ctx, dgst);
memcpy(ctx->sig.random, dgst, sizeof(sphincs_hash128_t));
// dgst = HASH256(R|seed|root|M...)
sphincs_hash256_init(&ctx->hash_ctx);
sphincs_hash256_update(&ctx->hash_ctx, ctx->sig.random, sizeof(sphincs_hash128_t));
sphincs_hash256_update(&ctx->hash_ctx, ctx->key.public_key.seed, sizeof(sphincs_hash128_t));
sphincs_hash256_update(&ctx->hash_ctx, ctx->key.public_key.root, sizeof(sphincs_hash128_t));
// dgst = SM3(R|seed|root|M...)
sm3_init(&ctx->hash_ctx);
sm3_update(&ctx->hash_ctx, ctx->sig.random, sizeof(sphincs_hash128_t));
sm3_update(&ctx->hash_ctx, ctx->key.public_key.seed, sizeof(sphincs_hash128_t));
sm3_update(&ctx->hash_ctx, ctx->key.public_key.root, sizeof(sphincs_hash128_t));
ctx->state = 3;
}
@@ -1500,8 +1500,8 @@ int sphincs_sign_update(SPHINCS_SIGN_CTX *ctx, const uint8_t *data, size_t datal
}
if (data && datalen) {
// dgst = HASH256(R|seed|root|M...)
sphincs_hash256_update(&ctx->hash_ctx, data, datalen);
// dgst = SM3(R|seed|root|M...)
sm3_update(&ctx->hash_ctx, data, datalen);
// sum datalen
ctx->round2_msglen += datalen;
}
@@ -1511,7 +1511,7 @@ int sphincs_sign_update(SPHINCS_SIGN_CTX *ctx, const uint8_t *data, size_t datal
int sphincs_sign_finish_ex(SPHINCS_SIGN_CTX *ctx, SPHINCS_SIGNATURE *sig)
{
sphincs_hash256_t dgst;
sphincs_sm3_digest_t dgst;
uint8_t tbs[SPHINCS_TBS_SIZE];
uint32_t i;
uint8_t tree_address_buf[8] = {0};
@@ -1534,22 +1534,22 @@ int sphincs_sign_finish_ex(SPHINCS_SIGN_CTX *ctx, SPHINCS_SIGNATURE *sig)
return -1;
}
// dgst = HASH256(R|seed|root|M)
sphincs_hash256_finish(&ctx->hash_ctx, dgst);
// dgst = SM3(R|seed|root|M)
sm3_finish(&ctx->hash_ctx, dgst);
// tbs = H_msg(R, seed, root, M) = MGF1(R|seed|dgst, tbs_len)
for (i = 0; i < (SPHINCS_TBS_SIZE + 31)/32; i++) {
uint8_t count[4];
sphincs_hash256_t h_msg;
sphincs_sm3_digest_t h_msg;
size_t left;
PUTU32(count, i);
sphincs_hash256_init(&ctx->hash_ctx);
sphincs_hash256_update(&ctx->hash_ctx, ctx->sig.random, sizeof(sphincs_hash128_t));
sphincs_hash256_update(&ctx->hash_ctx, ctx->key.public_key.seed, sizeof(sphincs_hash128_t));
sphincs_hash256_update(&ctx->hash_ctx, dgst, sizeof(dgst));
sphincs_hash256_update(&ctx->hash_ctx, count, sizeof(count));
sphincs_hash256_finish(&ctx->hash_ctx, h_msg);
sm3_init(&ctx->hash_ctx);
sm3_update(&ctx->hash_ctx, ctx->sig.random, sizeof(sphincs_hash128_t));
sm3_update(&ctx->hash_ctx, ctx->key.public_key.seed, sizeof(sphincs_hash128_t));
sm3_update(&ctx->hash_ctx, dgst, sizeof(dgst));
sm3_update(&ctx->hash_ctx, count, sizeof(count));
sm3_finish(&ctx->hash_ctx, h_msg);
left = SPHINCS_TBS_SIZE - sizeof(dgst) * i;
left = left < sizeof(dgst) ? left : sizeof(dgst);
@@ -1626,11 +1626,11 @@ int sphincs_verify_init_ex(SPHINCS_SIGN_CTX *ctx, const SPHINCS_KEY *key, const
ctx->sig = *sig;
}
// dgst = HASH256(R|seed|root|M)
sphincs_hash256_init(&ctx->hash_ctx);
sphincs_hash256_update(&ctx->hash_ctx, sig->random, sizeof(sphincs_hash128_t));
sphincs_hash256_update(&ctx->hash_ctx, key->public_key.seed, sizeof(sphincs_hash128_t));
sphincs_hash256_update(&ctx->hash_ctx, key->public_key.root, sizeof(sphincs_hash128_t));
// dgst = SM3(R|seed|root|M)
sm3_init(&ctx->hash_ctx);
sm3_update(&ctx->hash_ctx, sig->random, sizeof(sphincs_hash128_t));
sm3_update(&ctx->hash_ctx, key->public_key.seed, sizeof(sphincs_hash128_t));
sm3_update(&ctx->hash_ctx, key->public_key.root, sizeof(sphincs_hash128_t));
return 1;
}
@@ -1661,8 +1661,8 @@ int sphincs_verify_update(SPHINCS_SIGN_CTX *ctx, const uint8_t *data, size_t dat
}
if (data && datalen) {
// dgst = HASH256(R|seed|root|M)
sphincs_hash256_update(&ctx->hash_ctx, data, datalen);
// dgst = SM3(R|seed|root|M)
sm3_update(&ctx->hash_ctx, data, datalen);
ctx->round1_msglen += datalen;
}
@@ -1671,7 +1671,7 @@ int sphincs_verify_update(SPHINCS_SIGN_CTX *ctx, const uint8_t *data, size_t dat
int sphincs_verify_finish(SPHINCS_SIGN_CTX *ctx)
{
sphincs_hash256_t dgst;
sphincs_sm3_digest_t dgst;
uint8_t tbs[SPHINCS_TBS_SIZE];
uint8_t tree_address_buf[8] = {0};
uint8_t keypair_address_buf[4] = {0};
@@ -1686,22 +1686,22 @@ int sphincs_verify_finish(SPHINCS_SIGN_CTX *ctx)
return -1;
}
// dgst = HASH256(R|seed|root|M)
sphincs_hash256_finish(&ctx->hash_ctx, dgst);
// dgst = SM3(R|seed|root|M)
sm3_finish(&ctx->hash_ctx, dgst);
// tbs = H_msg(R, seed, root, M) = MGF1(R|seed|dgst, tbs_len)
for (i = 0; i < (SPHINCS_TBS_SIZE + 31)/32; i++) {
uint8_t count[4];
sphincs_hash256_t h_msg;
sphincs_sm3_digest_t h_msg;
size_t left;
PUTU32(count, i);
sphincs_hash256_init(&ctx->hash_ctx);
sphincs_hash256_update(&ctx->hash_ctx, ctx->sig.random, sizeof(sphincs_hash128_t));
sphincs_hash256_update(&ctx->hash_ctx, ctx->key.public_key.seed, sizeof(sphincs_hash128_t));
sphincs_hash256_update(&ctx->hash_ctx, dgst, sizeof(dgst));
sphincs_hash256_update(&ctx->hash_ctx, count, sizeof(count));
sphincs_hash256_finish(&ctx->hash_ctx, h_msg);
sm3_init(&ctx->hash_ctx);
sm3_update(&ctx->hash_ctx, ctx->sig.random, sizeof(sphincs_hash128_t));
sm3_update(&ctx->hash_ctx, ctx->key.public_key.seed, sizeof(sphincs_hash128_t));
sm3_update(&ctx->hash_ctx, dgst, sizeof(dgst));
sm3_update(&ctx->hash_ctx, count, sizeof(count));
sm3_finish(&ctx->hash_ctx, h_msg);
left = SPHINCS_TBS_SIZE - sizeof(dgst) * i;
left = left < sizeof(dgst) ? left : sizeof(dgst);

10
src/x509_key.c
View File

@@ -1049,7 +1049,10 @@ int ec_private_key_to_der(const X509_KEY *key, int encode_params, int encode_pub
}
pubkey = pubkey_buf;
}
secp256r1_to_32bytes(key->u.secp256r1_key.private_key, prikey);
if (secp256r1_to_32bytes(key->u.secp256r1_key.private_key, prikey) != 1) {
error_print();
return -1;
}
break;
#endif
default:
@@ -1159,7 +1162,10 @@ int ec_private_key_from_der(X509_KEY *key, int opt_curve, const uint8_t **in, si
secp256r1_t p256_private;
SECP256R1_KEY p256_pub;
secp256r1_from_32bytes(p256_private, prikey);
if (secp256r1_from_32bytes(p256_private, prikey) != 1) {
error_print();
return -1;
}
if (secp256r1_key_set_private_key(&key->u.secp256r1_key, p256_private) != 1) {
gmssl_secure_clear(p256_private, sizeof(secp256r1_t));
error_print();

640
src/xmss.c
View File

File diff suppressed because it is too large Load Diff