Skip to content

Commit 5934eb3

Browse files
karel-mkarel-m
authored
Merge pull request #280 from libtom/pr/fix-dsa-cdf
fixes necessary to pass DSA cdf tests
2 parents c908eb1 + bb6a7e1 commit 5934eb3

5 files changed

Lines changed: 180 additions & 50 deletions

File tree

‎src/headers/tomcrypt_pk.h‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -479,7 +479,12 @@ int dsa_decrypt_key(const unsigned char *in, unsigned long inlen,
479479
int dsa_import(const unsigned char *in, unsigned long inlen, dsa_key *key);
480480
int dsa_export(unsigned char *out, unsigned long *outlen, int type, dsa_key *key);
481481
int dsa_verify_key(dsa_key *key, int *stat);
482-
482+
#ifdef LTC_SOURCE
483+
/* internal helper functions */
484+
int dsa_int_validate_xy(dsa_key *key, int *stat);
485+
int dsa_int_validate_pqg(dsa_key *key, int *stat);
486+
int dsa_int_validate_primes(dsa_key *key, int *stat);
487+
#endif
483488
int dsa_shared_secret(void *private_key, void *base,
484489
dsa_key *public_key,
485490
unsigned char *out, unsigned long *outlen);

‎src/pk/dsa/dsa_import.c‎

Lines changed: 15 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
*/
2525
int dsa_import(const unsigned char *in, unsigned long inlen, dsa_key *key)
2626
{
27-
int err;
27+
int err, stat;
2828
unsigned long zero = 0;
2929
unsigned char* tmpbuf = NULL;
3030
unsigned char flags[1];
@@ -116,10 +116,21 @@ int dsa_import(const unsigned char *in, unsigned long inlen, dsa_key *key)
116116
}
117117

118118
LBL_OK:
119-
key->qord = mp_unsigned_bin_size(key->q);
119+
key->qord = mp_unsigned_bin_size(key->q);
120120

121-
if (key->qord >= LTC_MDSA_MAX_GROUP || key->qord <= 15 ||
122-
(unsigned long)key->qord >= mp_unsigned_bin_size(key->p) || (mp_unsigned_bin_size(key->p) - key->qord) >= LTC_MDSA_DELTA) {
121+
/* quick p, q, g validation, without primality testing */
122+
if ((err = dsa_int_validate_pqg(key, &stat)) != CRYPT_OK) {
123+
goto LBL_ERR;
124+
}
125+
if (stat == 0) {
126+
err = CRYPT_INVALID_PACKET;
127+
goto LBL_ERR;
128+
}
129+
/* validate x, y */
130+
if ((err = dsa_int_validate_xy(key, &stat)) != CRYPT_OK) {
131+
goto LBL_ERR;
132+
}
133+
if (stat == 0) {
123134
err = CRYPT_INVALID_PACKET;
124135
goto LBL_ERR;
125136
}

‎src/pk/dsa/dsa_set.c‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ int dsa_set_pqg(const unsigned char *p, unsigned long plen,
2727
const unsigned char *g, unsigned long glen,
2828
dsa_key *key)
2929
{
30-
int err;
30+
int err, stat;
3131

3232
LTC_ARGCHK(p != NULL);
3333
LTC_ARGCHK(q != NULL);
@@ -45,11 +45,13 @@ int dsa_set_pqg(const unsigned char *p, unsigned long plen,
4545

4646
key->qord = mp_unsigned_bin_size(key->q);
4747

48-
if (key->qord >= LTC_MDSA_MAX_GROUP || key->qord <= 15 ||
49-
(unsigned long)key->qord >= mp_unsigned_bin_size(key->p) || (mp_unsigned_bin_size(key->p) - key->qord) >= LTC_MDSA_DELTA) {
48+
/* do only a quick validation, without primality testing */
49+
if ((err = dsa_int_validate_pqg(key, &stat)) != CRYPT_OK) { goto LBL_ERR; }
50+
if (stat == 0) {
5051
err = CRYPT_INVALID_PACKET;
5152
goto LBL_ERR;
5253
}
54+
5355
return CRYPT_OK;
5456

5557
LBL_ERR:
@@ -70,7 +72,7 @@ int dsa_set_pqg(const unsigned char *p, unsigned long plen,
7072
*/
7173
int dsa_set_key(const unsigned char *in, unsigned long inlen, int type, dsa_key *key)
7274
{
73-
int err;
75+
int err, stat = 0;
7476

7577
LTC_ARGCHK(key != NULL);
7678
LTC_ARGCHK(key->x != NULL);
@@ -90,6 +92,12 @@ int dsa_set_key(const unsigned char *in, unsigned long inlen, int type, dsa_key
9092
if ((err = mp_read_unsigned_bin(key->y, (unsigned char *)in, inlen)) != CRYPT_OK) { goto LBL_ERR; }
9193
}
9294

95+
if ((err = dsa_int_validate_xy(key, &stat)) != CRYPT_OK) { goto LBL_ERR; }
96+
if (stat == 0) {
97+
err = CRYPT_INVALID_PACKET;
98+
goto LBL_ERR;
99+
}
100+
93101
return CRYPT_OK;
94102

95103
LBL_ERR:

‎src/pk/dsa/dsa_set_pqg_dsaparam.c‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
int dsa_set_pqg_dsaparam(const unsigned char *dsaparam, unsigned long dsaparamlen,
2525
dsa_key *key)
2626
{
27-
int err;
27+
int err, stat;
2828

2929
LTC_ARGCHK(dsaparam != NULL);
3030
LTC_ARGCHK(key != NULL);
@@ -44,11 +44,15 @@ int dsa_set_pqg_dsaparam(const unsigned char *dsaparam, unsigned long dsaparamle
4444

4545
key->qord = mp_unsigned_bin_size(key->q);
4646

47-
if (key->qord >= LTC_MDSA_MAX_GROUP || key->qord <= 15 ||
48-
(unsigned long)key->qord >= mp_unsigned_bin_size(key->p) || (mp_unsigned_bin_size(key->p) - key->qord) >= LTC_MDSA_DELTA) {
47+
/* quick p, q, g validation, without primality testing */
48+
if ((err = dsa_int_validate_pqg(key, &stat)) != CRYPT_OK) {
49+
goto LBL_ERR;
50+
}
51+
if (stat == 0) {
4952
err = CRYPT_INVALID_PACKET;
5053
goto LBL_ERR;
5154
}
55+
5256
return CRYPT_OK;
5357

5458
LBL_ERR:

‎src/pk/dsa/dsa_verify_key.c‎

Lines changed: 140 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -16,81 +16,183 @@
1616
#ifdef LTC_MDSA
1717

1818
/**
19-
Verify a DSA key for validity
20-
@param key The key to verify
19+
Validate a DSA key
20+
21+
Yeah, this function should've been called dsa_validate_key()
22+
in the first place and for compat-reasons we keep it
23+
as it was (for now).
24+
25+
@param key The key to validate
2126
@param stat [out] Result of test, 1==valid, 0==invalid
2227
@return CRYPT_OK if successful
2328
*/
2429
int dsa_verify_key(dsa_key *key, int *stat)
2530
{
26-
void *tmp, *tmp2;
27-
int res, err;
31+
int err;
32+
33+
err = dsa_int_validate_primes(key, stat);
34+
if (err != CRYPT_OK || *stat == 0) return err;
35+
36+
err = dsa_int_validate_pqg(key, stat);
37+
if (err != CRYPT_OK || *stat == 0) return err;
38+
39+
return dsa_int_validate_xy(key, stat);
40+
}
41+
42+
/**
43+
Non-complex part (no primality testing) of the validation
44+
of DSA params (p, q, g)
45+
46+
@param key The key to validate
47+
@param stat [out] Result of test, 1==valid, 0==invalid
48+
@return CRYPT_OK if successful
49+
*/
50+
int dsa_int_validate_pqg(dsa_key *key, int *stat)
51+
{
52+
void *tmp1, *tmp2;
53+
int err;
2854

2955
LTC_ARGCHK(key != NULL);
3056
LTC_ARGCHK(stat != NULL);
31-
32-
/* default to an invalid key */
3357
*stat = 0;
3458

35-
/* first make sure key->q and key->p are prime */
36-
if ((err = mp_prime_is_prime(key->q, 8, &res)) != CRYPT_OK) {
37-
return err;
59+
/* check q-order */
60+
if ( key->qord >= LTC_MDSA_MAX_GROUP || key->qord <= 15 ||
61+
(unsigned long)key->qord >= mp_unsigned_bin_size(key->p) ||
62+
(mp_unsigned_bin_size(key->p) - key->qord) >= LTC_MDSA_DELTA ) {
63+
err = CRYPT_OK;
64+
goto error;
3865
}
39-
if (res == 0) {
66+
67+
/* FIPS 186-4 chapter 4.1: 1 < g < p */
68+
if (mp_cmp_d(key->g, 1) != LTC_MP_GT || mp_cmp(key->g, key->p) != LTC_MP_LT) {
4069
return CRYPT_OK;
4170
}
4271

43-
if ((err = mp_prime_is_prime(key->p, 8, &res)) != CRYPT_OK) {
72+
if ((err = mp_init_multi(&tmp1, &tmp2, NULL)) != CRYPT_OK) { return err; }
73+
74+
/* FIPS 186-4 chapter 4.1: q is a divisor of (p - 1) */
75+
if ((err = mp_sub_d(key->p, 1, tmp1)) != CRYPT_OK) { goto error; }
76+
if ((err = mp_div(tmp1, key->q, tmp1, tmp2)) != CRYPT_OK) { goto error; }
77+
if (mp_iszero(tmp2) != LTC_MP_YES) {
78+
err = CRYPT_OK;
79+
goto error;
80+
}
81+
82+
/* FIPS 186-4 chapter 4.1: g is a generator of a subgroup of order q in
83+
* the multiplicative group of GF(p) - so we make sure that g^q mod p = 1
84+
*/
85+
if ((err = mp_exptmod(key->g, key->q, key->p, tmp1)) != CRYPT_OK) { goto error; }
86+
if (mp_cmp_d(tmp1, 1) != LTC_MP_EQ) {
87+
err = CRYPT_OK;
88+
goto error;
89+
}
90+
91+
err = CRYPT_OK;
92+
*stat = 1;
93+
error:
94+
mp_clear_multi(tmp2, tmp1, NULL);
95+
return err;
96+
}
97+
98+
/**
99+
Primality testing of DSA params p and q
100+
101+
@param key The key to validate
102+
@param stat [out] Result of test, 1==valid, 0==invalid
103+
@return CRYPT_OK if successful
104+
*/
105+
int dsa_int_validate_primes(dsa_key *key, int *stat)
106+
{
107+
int err, res;
108+
109+
*stat = 0;
110+
LTC_ARGCHK(key != NULL);
111+
LTC_ARGCHK(stat != NULL);
112+
113+
/* key->q prime? */
114+
if ((err = mp_prime_is_prime(key->q, LTC_MILLER_RABIN_REPS, &res)) != CRYPT_OK) {
44115
return err;
45116
}
46-
if (res == 0) {
117+
if (res == LTC_MP_NO) {
47118
return CRYPT_OK;
48119
}
49120

50-
/* now make sure that g is not -1, 0 or 1 and <p */
51-
if (mp_cmp_d(key->g, 0) == LTC_MP_EQ || mp_cmp_d(key->g, 1) == LTC_MP_EQ) {
52-
return CRYPT_OK;
121+
/* key->p prime? */
122+
if ((err = mp_prime_is_prime(key->p, LTC_MILLER_RABIN_REPS, &res)) != CRYPT_OK) {
123+
return err;
53124
}
54-
if ((err = mp_init_multi(&tmp, &tmp2, NULL)) != CRYPT_OK) { return err; }
55-
if ((err = mp_sub_d(key->p, 1, tmp)) != CRYPT_OK) { goto error; }
56-
if (mp_cmp(tmp, key->g) == LTC_MP_EQ || mp_cmp(key->g, key->p) != LTC_MP_LT) {
57-
err = CRYPT_OK;
58-
goto error;
125+
if (res == LTC_MP_NO) {
126+
return CRYPT_OK;
59127
}
60128

129+
*stat = 1;
130+
return CRYPT_OK;
131+
}
132+
133+
/**
134+
Validation of a DSA key (x and y values)
135+
136+
@param key The key to validate
137+
@param stat [out] Result of test, 1==valid, 0==invalid
138+
@return CRYPT_OK if successful
139+
*/
140+
int dsa_int_validate_xy(dsa_key *key, int *stat)
141+
{
142+
void *tmp;
143+
int err;
144+
145+
*stat = 0;
146+
LTC_ARGCHK(key != NULL);
147+
LTC_ARGCHK(stat != NULL);
148+
61149
/* 1 < y < p-1 */
62-
if (!(mp_cmp_d(key->y, 1) == LTC_MP_GT && mp_cmp(key->y, tmp) == LTC_MP_LT)) {
63-
err = CRYPT_OK;
64-
goto error;
150+
if ((err = mp_init(&tmp)) != CRYPT_OK) {
151+
return err;
65152
}
66-
67-
/* now we have to make sure that g^q = 1, and that p-1/q gives 0 remainder */
68-
if ((err = mp_div(tmp, key->q, tmp, tmp2)) != CRYPT_OK) { goto error; }
69-
if (mp_iszero(tmp2) != LTC_MP_YES) {
70-
err = CRYPT_OK;
153+
if ((err = mp_sub_d(key->p, 1, tmp)) != CRYPT_OK) {
71154
goto error;
72155
}
73-
74-
if ((err = mp_exptmod(key->g, key->q, key->p, tmp)) != CRYPT_OK) { goto error; }
75-
if (mp_cmp_d(tmp, 1) != LTC_MP_EQ) {
156+
if (mp_cmp_d(key->y, 1) != LTC_MP_GT || mp_cmp(key->y, tmp) != LTC_MP_LT) {
76157
err = CRYPT_OK;
77158
goto error;
78159
}
79160

80-
/* now we have to make sure that y^q = 1, this makes sure y \in g^x mod p */
81-
if ((err = mp_exptmod(key->y, key->q, key->p, tmp)) != CRYPT_OK) { goto error; }
82-
if (mp_cmp_d(tmp, 1) != LTC_MP_EQ) {
83-
err = CRYPT_OK;
84-
goto error;
161+
if (key->type == PK_PRIVATE) {
162+
/* FIPS 186-4 chapter 4.1: 0 < x < q */
163+
if (mp_cmp_d(key->x, 0) != LTC_MP_GT || mp_cmp(key->x, key->q) != LTC_MP_LT) {
164+
err = CRYPT_OK;
165+
goto error;
166+
}
167+
/* FIPS 186-4 chapter 4.1: y = g^x mod p */
168+
if ((err = mp_exptmod(key->g, key->x, key->p, tmp)) != CRYPT_OK) {
169+
goto error;
170+
}
171+
if (mp_cmp(tmp, key->y) != LTC_MP_EQ) {
172+
err = CRYPT_OK;
173+
goto error;
174+
}
175+
}
176+
else {
177+
/* with just a public key we cannot test y = g^x mod p therefore we
178+
* only test that y^q mod p = 1, which makes sure y is in g^x mod p
179+
*/
180+
if ((err = mp_exptmod(key->y, key->q, key->p, tmp)) != CRYPT_OK) {
181+
goto error;
182+
}
183+
if (mp_cmp_d(tmp, 1) != LTC_MP_EQ) {
184+
err = CRYPT_OK;
185+
goto error;
186+
}
85187
}
86188

87-
/* at this point we are out of tests ;-( */
88189
err = CRYPT_OK;
89190
*stat = 1;
90191
error:
91-
mp_clear_multi(tmp, tmp2, NULL);
192+
mp_clear(tmp);
92193
return err;
93194
}
195+
94196
#endif
95197

96198
/* ref: $Format:%D$ */

0 commit comments

Comments
 (0)