Lob a KNF grenade into the ecdsa code.

1 files changed, 114 insertions, 151 deletions

diff --git a/src/lib/libcrypto/ecdsa/ecs_ossl.c b/src/lib/libcrypto/ecdsa/ecs_ossl.c
index 0dde5386ff..31102138c0 100644
--- a/src/lib/libcrypto/ecdsa/ecs_ossl.c
+++ b/src/lib/libcrypto/ecdsa/ecs_ossl.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ecs_ossl.c,v 1.5 2014/07/12 16:03:37 miod Exp $ */
+/* $OpenBSD: ecs_ossl.c,v 1.6 2015/02/08 13:35:07 jsing Exp $ */
 /*
  * Written by Nils Larsch for the OpenSSL project
  */
@@ -10,7 +10,7 @@
  * are met:
  *
  * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer. 
+ *    notice, this list of conditions and the following disclaimer.
  *
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in
@@ -63,12 +63,12 @@
 #include <openssl/obj_mac.h>
 #include <openssl/bn.h>
 
-static ECDSA_SIG *ecdsa_do_sign(const unsigned char *dgst, int dlen, 
-                const BIGNUM *, const BIGNUM *, EC_KEY *eckey);
-static int ecdsa_sign_setup(EC_KEY *eckey, BN_CTX *ctx_in, BIGNUM **kinvp, 
-                BIGNUM **rp);
-static int ecdsa_do_verify(const unsigned char *dgst, int dgst_len, 
-                const ECDSA_SIG *sig, EC_KEY *eckey);
+static ECDSA_SIG *ecdsa_do_sign(const unsigned char *dgst, int dlen,
+    const BIGNUM *, const BIGNUM *, EC_KEY *eckey);
+static int ecdsa_sign_setup(EC_KEY *eckey, BN_CTX *ctx_in, BIGNUM **kinvp,
+    BIGNUM **rp);
+static int ecdsa_do_verify(const unsigned char *dgst, int dgst_len,
+    const ECDSA_SIG *sig, EC_KEY *eckey);
 
 static ECDSA_METHOD openssl_ecdsa_meth = {
         .name = "OpenSSL ECDSA method",
@@ -77,65 +77,58 @@ static ECDSA_METHOD openssl_ecdsa_meth = {
         .ecdsa_do_verify = ecdsa_do_verify
 };
 
-const ECDSA_METHOD *ECDSA_OpenSSL(void)
+const ECDSA_METHOD *
+ECDSA_OpenSSL(void)
 {
         return &openssl_ecdsa_meth;
 }
 
-static int ecdsa_sign_setup(EC_KEY *eckey, BN_CTX *ctx_in, BIGNUM **kinvp,
-                BIGNUM **rp)
+static int
+ecdsa_sign_setup(EC_KEY *eckey, BN_CTX *ctx_in, BIGNUM **kinvp, BIGNUM **rp)
 {
         BN_CTX   *ctx = NULL;
         BIGNUM   *k = NULL, *r = NULL, *order = NULL, *X = NULL;
-        EC_POINT *tmp_point=NULL;
+        EC_POINT *tmp_point = NULL;
         const EC_GROUP *group;
         int      ret = 0;
 
-        if (eckey == NULL || (group = EC_KEY_get0_group(eckey)) == NULL)
-        {
+        if (eckey == NULL || (group = EC_KEY_get0_group(eckey)) == NULL) {
                 ECDSAerr(ECDSA_F_ECDSA_SIGN_SETUP, ERR_R_PASSED_NULL_PARAMETER);
                 return 0;
         }
 
-        if (ctx_in == NULL) 
-        {
-                if ((ctx = BN_CTX_new()) == NULL)
-                {
-                        ECDSAerr(ECDSA_F_ECDSA_SIGN_SETUP,ERR_R_MALLOC_FAILURE);
+        if (ctx_in == NULL) {
+                if ((ctx = BN_CTX_new()) == NULL) {
+                        ECDSAerr(ECDSA_F_ECDSA_SIGN_SETUP,
+                            ERR_R_MALLOC_FAILURE);
                         return 0;
                 }
-        }
-        else
+        } else
                 ctx = ctx_in;
 
-        k     = BN_new();       /* this value is later returned in *kinvp */
-        r     = BN_new();       /* this value is later returned in *rp    */
+        k = BN_new();   /* this value is later returned in *kinvp */
+        r = BN_new();   /* this value is later returned in *rp    */
         order = BN_new();
-        X     = BN_new();
-        if (!k || !r || !order || !X)
-        {
+        X = BN_new();
+        if (!k || !r || !order || !X) {
                 ECDSAerr(ECDSA_F_ECDSA_SIGN_SETUP, ERR_R_MALLOC_FAILURE);
                 goto err;
         }
-        if ((tmp_point = EC_POINT_new(group)) == NULL)
-        {
+        if ((tmp_point = EC_POINT_new(group)) == NULL) {
                 ECDSAerr(ECDSA_F_ECDSA_SIGN_SETUP, ERR_R_EC_LIB);
                 goto err;
         }
-        if (!EC_GROUP_get_order(group, order, ctx))
-        {
+        if (!EC_GROUP_get_order(group, order, ctx)) {
                 ECDSAerr(ECDSA_F_ECDSA_SIGN_SETUP, ERR_R_EC_LIB);
                 goto err;
         }
-        
-        do
-        {
-                /* get random k */      
+
+        do {
+                /* get random k */
                 do
-                        if (!BN_rand_range(k, order))
-                        {
+                        if (!BN_rand_range(k, order)) {
                                 ECDSAerr(ECDSA_F_ECDSA_SIGN_SETUP,
-                                 ECDSA_R_RANDOM_NUMBER_GENERATION_FAILED);      
+                                    ECDSA_R_RANDOM_NUMBER_GENERATION_FAILED);
                                 goto err;
                         }
                 while (BN_is_zero(k));
@@ -143,23 +136,23 @@ static int ecdsa_sign_setup(EC_KEY *eckey, BN_CTX *ctx_in, BIGNUM **kinvp,
                 /* We do not want timing information to leak the length of k,
                  * so we compute G*k using an equivalent scalar of fixed
                  * bit-length. */
-
-                if (!BN_add(k, k, order)) goto err;
+                if (!BN_add(k, k, order))
+                        goto err;
                 if (BN_num_bits(k) <= BN_num_bits(order))
-                        if (!BN_add(k, k, order)) goto err;
+                        if (!BN_add(k, k, order))
+                                goto err;
 
                 /* compute r the x-coordinate of generator * k */
-                if (!EC_POINT_mul(group, tmp_point, k, NULL, NULL, ctx))
-                {
+                if (!EC_POINT_mul(group, tmp_point, k, NULL, NULL, ctx)) {
                         ECDSAerr(ECDSA_F_ECDSA_SIGN_SETUP, ERR_R_EC_LIB);
                         goto err;
                 }
-                if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) == NID_X9_62_prime_field)
-                {
+                if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) ==
+                    NID_X9_62_prime_field) {
                         if (!EC_POINT_get_affine_coordinates_GFp(group,
-                                tmp_point, X, NULL, ctx))
-                        {
-                                ECDSAerr(ECDSA_F_ECDSA_SIGN_SETUP,ERR_R_EC_LIB);
+                            tmp_point, X, NULL, ctx)) {
+                                ECDSAerr(ECDSA_F_ECDSA_SIGN_SETUP,
+                                    ERR_R_EC_LIB);
                                 goto err;
                         }
                 }
@@ -167,53 +160,52 @@ static int ecdsa_sign_setup(EC_KEY *eckey, BN_CTX *ctx_in, BIGNUM **kinvp,
                 else /* NID_X9_62_characteristic_two_field */
                 {
                         if (!EC_POINT_get_affine_coordinates_GF2m(group,
-                                tmp_point, X, NULL, ctx))
-                        {
-                                ECDSAerr(ECDSA_F_ECDSA_SIGN_SETUP,ERR_R_EC_LIB);
+                            tmp_point, X, NULL, ctx)) {
+                                ECDSAerr(ECDSA_F_ECDSA_SIGN_SETUP,
+                                    ERR_R_EC_LIB);
                                 goto err;
                         }
                 }
 #endif
-                if (!BN_nnmod(r, X, order, ctx))
-                {
+                if (!BN_nnmod(r, X, order, ctx)) {
                         ECDSAerr(ECDSA_F_ECDSA_SIGN_SETUP, ERR_R_BN_LIB);
                         goto err;
                 }
-        }
-        while (BN_is_zero(r));
+        } while (BN_is_zero(r));
 
         /* compute the inverse of k */
-        if (!BN_mod_inverse(k, k, order, ctx))
-        {
+        if (!BN_mod_inverse(k, k, order, ctx)) {
                 ECDSAerr(ECDSA_F_ECDSA_SIGN_SETUP, ERR_R_BN_LIB);
-                goto err;       
+                goto err;
         }
         /* clear old values if necessary */
         BN_clear_free(*rp);
         BN_clear_free(*kinvp);
         /* save the pre-computed values  */
-        *rp    = r;
+        *rp = r;
         *kinvp = k;
         ret = 1;
+
 err:
         if (!ret) {
                 BN_clear_free(k);
                 BN_clear_free(r);
         }
-        if (ctx_in == NULL) 
+        if (ctx_in == NULL)
                 BN_CTX_free(ctx);
         BN_free(order);
         EC_POINT_free(tmp_point);
         BN_clear_free(X);
-        return(ret);
+        return (ret);
 }
 
 
-static ECDSA_SIG *ecdsa_do_sign(const unsigned char *dgst, int dgst_len, 
-                const BIGNUM *in_kinv, const BIGNUM *in_r, EC_KEY *eckey)
+static ECDSA_SIG *
+ecdsa_do_sign(const unsigned char *dgst, int dgst_len,
+    const BIGNUM *in_kinv, const BIGNUM *in_r, EC_KEY *eckey)
 {
         int     ok = 0, i;
-        BIGNUM *kinv=NULL, *s, *m=NULL,*tmp=NULL,*order=NULL;
+        BIGNUM *kinv = NULL, *s, *m = NULL, *tmp = NULL, *order = NULL;
         const BIGNUM *ckinv;
         BN_CTX     *ctx = NULL;
         const EC_GROUP   *group;
@@ -221,33 +213,29 @@ static ECDSA_SIG *ecdsa_do_sign(const unsigned char *dgst, int dgst_len,
         ECDSA_DATA *ecdsa;
         const BIGNUM *priv_key;
 
-        ecdsa    = ecdsa_check(eckey);
-        group    = EC_KEY_get0_group(eckey);
+        ecdsa = ecdsa_check(eckey);
+        group = EC_KEY_get0_group(eckey);
         priv_key = EC_KEY_get0_private_key(eckey);
-        
-        if (group == NULL || priv_key == NULL || ecdsa == NULL)
-        {
+
+        if (group == NULL || priv_key == NULL || ecdsa == NULL) {
                 ECDSAerr(ECDSA_F_ECDSA_DO_SIGN, ERR_R_PASSED_NULL_PARAMETER);
                 return NULL;
         }
 
         ret = ECDSA_SIG_new();
-        if (!ret)
-        {
+        if (!ret) {
                 ECDSAerr(ECDSA_F_ECDSA_DO_SIGN, ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
         s = ret->s;
 
         if ((ctx = BN_CTX_new()) == NULL || (order = BN_new()) == NULL ||
-                (tmp = BN_new()) == NULL || (m = BN_new()) == NULL)
-        {
+            (tmp = BN_new()) == NULL || (m = BN_new()) == NULL) {
                 ECDSAerr(ECDSA_F_ECDSA_DO_SIGN, ERR_R_MALLOC_FAILURE);
                 goto err;
         }
 
-        if (!EC_GROUP_get_order(group, order, ctx))
-        {
+        if (!EC_GROUP_get_order(group, order, ctx)) {
                 ECDSAerr(ECDSA_F_ECDSA_DO_SIGN, ERR_R_EC_LIB);
                 goto err;
         }
@@ -257,73 +245,61 @@ static ECDSA_SIG *ecdsa_do_sign(const unsigned char *dgst, int dgst_len,
          */
         if (8 * dgst_len > i)
                 dgst_len = (i + 7)/8;
-        if (!BN_bin2bn(dgst, dgst_len, m))
-        {
+        if (!BN_bin2bn(dgst, dgst_len, m)) {
                 ECDSAerr(ECDSA_F_ECDSA_DO_SIGN, ERR_R_BN_LIB);
                 goto err;
         }
         /* If still too long truncate remaining bits with a shift */
-        if ((8 * dgst_len > i) && !BN_rshift(m, m, 8 - (i & 0x7)))
-        {
+        if ((8 * dgst_len > i) && !BN_rshift(m, m, 8 - (i & 0x7))) {
                 ECDSAerr(ECDSA_F_ECDSA_DO_SIGN, ERR_R_BN_LIB);
                 goto err;
         }
-        do
-        {
-                if (in_kinv == NULL || in_r == NULL)
-                {
-                        if (!ECDSA_sign_setup(eckey, ctx, &kinv, &ret->r))
-                        {
-                                ECDSAerr(ECDSA_F_ECDSA_DO_SIGN,ERR_R_ECDSA_LIB);
+        do {
+                if (in_kinv == NULL || in_r == NULL) {
+                        if (!ECDSA_sign_setup(eckey, ctx, &kinv, &ret->r)) {
+                                ECDSAerr(ECDSA_F_ECDSA_DO_SIGN,
+                                    ERR_R_ECDSA_LIB);
                                 goto err;
                         }
                         ckinv = kinv;
-                }
-                else
-                {
-                        ckinv  = in_kinv;
-                        if (BN_copy(ret->r, in_r) == NULL)
-                        {
-                                ECDSAerr(ECDSA_F_ECDSA_DO_SIGN, ERR_R_MALLOC_FAILURE);
+                } else {
+                        ckinv = in_kinv;
+                        if (BN_copy(ret->r, in_r) == NULL) {
+                                ECDSAerr(ECDSA_F_ECDSA_DO_SIGN,
+                                    ERR_R_MALLOC_FAILURE);
                                 goto err;
                         }
                 }
 
-                if (!BN_mod_mul(tmp, priv_key, ret->r, order, ctx))
-                {
+                if (!BN_mod_mul(tmp, priv_key, ret->r, order, ctx)) {
                         ECDSAerr(ECDSA_F_ECDSA_DO_SIGN, ERR_R_BN_LIB);
                         goto err;
                 }
-                if (!BN_mod_add_quick(s, tmp, m, order))
-                {
+                if (!BN_mod_add_quick(s, tmp, m, order)) {
                         ECDSAerr(ECDSA_F_ECDSA_DO_SIGN, ERR_R_BN_LIB);
                         goto err;
                 }
-                if (!BN_mod_mul(s, s, ckinv, order, ctx))
-                {
+                if (!BN_mod_mul(s, s, ckinv, order, ctx)) {
                         ECDSAerr(ECDSA_F_ECDSA_DO_SIGN, ERR_R_BN_LIB);
                         goto err;
                 }
-                if (BN_is_zero(s))
-                {
+                if (BN_is_zero(s)) {
                         /* if kinv and r have been supplied by the caller
                          * don't to generate new kinv and r values */
-                        if (in_kinv != NULL && in_r != NULL)
-                        {
-                                ECDSAerr(ECDSA_F_ECDSA_DO_SIGN, ECDSA_R_NEED_NEW_SETUP_VALUES);
+                        if (in_kinv != NULL && in_r != NULL) {
+                                ECDSAerr(ECDSA_F_ECDSA_DO_SIGN,
+                                    ECDSA_R_NEED_NEW_SETUP_VALUES);
                                 goto err;
                         }
-                }
-                else
+                } else
                         /* s != 0 => we have a valid signature */
                         break;
-        }
-        while (1);
+        } while (1);
 
         ok = 1;
+
 err:
-        if (!ok)
-        {
+        if (!ok) {
                 ECDSA_SIG_free(ret);
                 ret = NULL;
         }
@@ -335,8 +311,9 @@ err:
         return ret;
 }
 
-static int ecdsa_do_verify(const unsigned char *dgst, int dgst_len,
-                const ECDSA_SIG *sig, EC_KEY *eckey)
+static int
+ecdsa_do_verify(const unsigned char *dgst, int dgst_len, const ECDSA_SIG *sig,
+    EC_KEY *eckey)
 {
         int ret = -1, i;
         BN_CTX   *ctx;
@@ -347,47 +324,41 @@ static int ecdsa_do_verify(const unsigned char *dgst, int dgst_len,
 
         /* check input values */
         if (eckey == NULL || (group = EC_KEY_get0_group(eckey)) == NULL ||
-            (pub_key = EC_KEY_get0_public_key(eckey)) == NULL || sig == NULL)
-        {
+            (pub_key = EC_KEY_get0_public_key(eckey)) == NULL || sig == NULL) {
                 ECDSAerr(ECDSA_F_ECDSA_DO_VERIFY, ECDSA_R_MISSING_PARAMETERS);
                 return -1;
         }
 
         ctx = BN_CTX_new();
-        if (!ctx)
-        {
+        if (!ctx) {
                 ECDSAerr(ECDSA_F_ECDSA_DO_VERIFY, ERR_R_MALLOC_FAILURE);
                 return -1;
         }
         BN_CTX_start(ctx);
-        order = BN_CTX_get(ctx);        
-        u1    = BN_CTX_get(ctx);
-        u2    = BN_CTX_get(ctx);
-        m     = BN_CTX_get(ctx);
-        X     = BN_CTX_get(ctx);
-        if (!X)
-        {
+        order = BN_CTX_get(ctx);
+        u1 = BN_CTX_get(ctx);
+        u2 = BN_CTX_get(ctx);
+        m = BN_CTX_get(ctx);
+        X = BN_CTX_get(ctx);
+        if (!X) {
                 ECDSAerr(ECDSA_F_ECDSA_DO_VERIFY, ERR_R_BN_LIB);
                 goto err;
         }
-        
-        if (!EC_GROUP_get_order(group, order, ctx))
-        {
+
+        if (!EC_GROUP_get_order(group, order, ctx)) {
                 ECDSAerr(ECDSA_F_ECDSA_DO_VERIFY, ERR_R_EC_LIB);
                 goto err;
         }
 
-        if (BN_is_zero(sig->r)          || BN_is_negative(sig->r) || 
+        if (BN_is_zero(sig->r)          || BN_is_negative(sig->r) ||
             BN_ucmp(sig->r, order) >= 0 || BN_is_zero(sig->s)  ||
-            BN_is_negative(sig->s)      || BN_ucmp(sig->s, order) >= 0)
-        {
+            BN_is_negative(sig->s)      || BN_ucmp(sig->s, order) >= 0) {
                 ECDSAerr(ECDSA_F_ECDSA_DO_VERIFY, ECDSA_R_BAD_SIGNATURE);
                 ret = 0;        /* signature is invalid */
                 goto err;
         }
         /* calculate tmp1 = inv(S) mod order */
-        if (!BN_mod_inverse(u2, sig->s, order, ctx))
-        {
+        if (!BN_mod_inverse(u2, sig->s, order, ctx)) {
                 ECDSAerr(ECDSA_F_ECDSA_DO_VERIFY, ERR_R_BN_LIB);
                 goto err;
         }
@@ -398,45 +369,38 @@ static int ecdsa_do_verify(const unsigned char *dgst, int dgst_len,
          */
         if (8 * dgst_len > i)
                 dgst_len = (i + 7)/8;
-        if (!BN_bin2bn(dgst, dgst_len, m))
-        {
+        if (!BN_bin2bn(dgst, dgst_len, m)) {
                 ECDSAerr(ECDSA_F_ECDSA_DO_VERIFY, ERR_R_BN_LIB);
                 goto err;
         }
         /* If still too long truncate remaining bits with a shift */
-        if ((8 * dgst_len > i) && !BN_rshift(m, m, 8 - (i & 0x7)))
-        {
+        if ((8 * dgst_len > i) && !BN_rshift(m, m, 8 - (i & 0x7))) {
                 ECDSAerr(ECDSA_F_ECDSA_DO_VERIFY, ERR_R_BN_LIB);
                 goto err;
         }
         /* u1 = m * tmp mod order */
-        if (!BN_mod_mul(u1, m, u2, order, ctx))
-        {
+        if (!BN_mod_mul(u1, m, u2, order, ctx)) {
                 ECDSAerr(ECDSA_F_ECDSA_DO_VERIFY, ERR_R_BN_LIB);
                 goto err;
         }
         /* u2 = r * w mod q */
-        if (!BN_mod_mul(u2, sig->r, u2, order, ctx))
-        {
+        if (!BN_mod_mul(u2, sig->r, u2, order, ctx)) {
                 ECDSAerr(ECDSA_F_ECDSA_DO_VERIFY, ERR_R_BN_LIB);
                 goto err;
         }
 
-        if ((point = EC_POINT_new(group)) == NULL)
-        {
+        if ((point = EC_POINT_new(group)) == NULL) {
                 ECDSAerr(ECDSA_F_ECDSA_DO_VERIFY, ERR_R_MALLOC_FAILURE);
                 goto err;
         }
-        if (!EC_POINT_mul(group, point, u1, pub_key, u2, ctx))
-        {
+        if (!EC_POINT_mul(group, point, u1, pub_key, u2, ctx)) {
                 ECDSAerr(ECDSA_F_ECDSA_DO_VERIFY, ERR_R_EC_LIB);
                 goto err;
         }
-        if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) == NID_X9_62_prime_field)
-        {
+        if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) ==
+            NID_X9_62_prime_field) {
                 if (!EC_POINT_get_affine_coordinates_GFp(group,
-                        point, X, NULL, ctx))
-                {
+                    point, X, NULL, ctx)) {
                         ECDSAerr(ECDSA_F_ECDSA_DO_VERIFY, ERR_R_EC_LIB);
                         goto err;
                 }
@@ -445,20 +409,19 @@ static int ecdsa_do_verify(const unsigned char *dgst, int dgst_len,
         else /* NID_X9_62_characteristic_two_field */
         {
                 if (!EC_POINT_get_affine_coordinates_GF2m(group,
-                        point, X, NULL, ctx))
-                {
+                    point, X, NULL, ctx)) {
                         ECDSAerr(ECDSA_F_ECDSA_DO_VERIFY, ERR_R_EC_LIB);
                         goto err;
                 }
         }
-#endif  
-        if (!BN_nnmod(u1, X, order, ctx))
-        {
+#endif
+        if (!BN_nnmod(u1, X, order, ctx)) {
                 ECDSAerr(ECDSA_F_ECDSA_DO_VERIFY, ERR_R_BN_LIB);
                 goto err;
         }
         /*  if the signature is correct u1 is equal to sig->r */
         ret = (BN_ucmp(u1, sig->r) == 0);
+
 err:
         BN_CTX_end(ctx);
         BN_CTX_free(ctx);