summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/ecdsa (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Rename EC_KEY from r to key like in the rest of the filetb2023-07-101-4/+4
|
* Hide symbols in hkdf, evp, err, ecdsa, and ecbeck2023-07-073-3/+27
| | | | | | (part 2 of commit) ok jsing@
* Mop up last uses of ECDHerror() and ECDSAerror()tb2023-07-051-17/+15
| | | | ok jsing
* One more ECDSAerror goes.tb2023-07-051-2/+2
|
* ECDHerror() and ECDSAerror will go awaytb2023-07-051-37/+37
| | | | | | Move some trivial ones to ECerror(). discussed with jsing
* Drop an incorrect part from a commenttb2023-07-051-2/+2
|
* Missing . in commenttb2023-07-051-2/+2
|
* Fix #includestb2023-07-051-2/+6
|
* Remove local prototypes for public API (?!)tb2023-07-051-6/+1
|
* Improve BN_bn2bin() error check for readabilitytb2023-07-051-2/+2
|
* Move ECDSA_size() to a more sensible place in this filetb2023-07-051-28/+28
|
* Merge ECDSA code that will stay into ecdsa.ctb2023-07-052-157/+95
| | | | discussed with jsing
* Rename ecs_local.h into ecdsa_local.htb2023-07-054-7/+7
|
* Make variables in prototypes match function declarationstb2023-07-051-6/+6
|
* Drop useless ossl_ prefixestb2023-07-053-15/+14
| | | | discussed with jsing
* Avoid outputting invalid signaturestb2023-07-041-1/+11
| | | | | | | | | | | | The caller can provide an r which will be added to the ECDSA_SIG unchecked. This can happen via ECDSA_{,do_}sign_ex() or ECDSA_sign_setup() or else via a custom sign_sig() handler. Therefore add a check that it is in the bounds required. Since k was long thrown away, there's no way to check kinv, so it needs to be trusted. Misdesigned APIs that will output garbage everywhere... ok jsing
* Clean up ECDSA verificationtb2023-07-041-14/+29
| | | | | | | | Use variable names that correspond more closely to the standard. Use an additional variable for s^-1 for readability. Annotate the code with the corresponding steps from FIPS 186-5. ok jsing
* ECDSA signing: annotate code with steps corresponding to FIPS 185-6.tb2023-07-041-3/+25
| | | | ok jsing
* Extract private key and group order in s computationtb2023-07-041-19/+18
| | | | | | | This pushes a few variables no longer needed in ossl_ecdsa_sign_sig() into ecdsa_compute_s() separating API logic and pure computation a bit more. ok beck
* Use key for the EC_KEY everywheretb2023-07-041-39/+38
|
* Some more consistency in variable namestb2023-07-041-15/+15
|
* Normalize ECDSA_SIG to be sig everywheretb2023-07-041-11/+11
|
* Normalize on digest and digest_len rather than dgst dlen dgstlen, etc.tb2023-07-041-28/+34
|
* Rework ecdsa_prepare_digest()tb2023-07-041-35/+35
| | | | | | | | Make it take an EC_KEY instead of a group order in preparation for further cleanup. Rename m into e to match the standard better. Also buy some vowels for jsing. ok beck jsing
* Factor the computation of ECDSA s into a functiontb2023-07-041-69/+88
| | | | | | | | ossl_ecdsa_sign_sig() is already complicated enough. The math bit is entirely self contained and does not need to obfuscate control flow and logic. with feedback from and ok jsing
* sign_sig: drop ckinvtb2023-07-031-5/+7
| | | | | | | | The only reason ckinv exists is to be able to avoid a copy. This copy leaks some timing info, that will be mitigated in a subsequent step. It is an unused or at least uncommonly used codepath. ok jsing
* Rework the logic in ECDSA sign_sig()tb2023-07-031-24/+30
| | | | | | | | | | | If the caller supplied both kinv and r, we don't loop but rather throw an undocumented error code that no one uses, which is intended to tell the caller to run ECDSA_sign_setup() and try again. Use a boolean that indicates this situation so that the logic becomes a bit more transparent. ok jsing
* sign_sig: test on assignmenttb2023-07-031-5/+6
|
* sign_setup: split another check into twotb2023-07-031-2/+6
|
* Split range checks for ECDSA r and ECDSA stb2023-07-031-3/+8
| | | | requested by jsing
* Switch a couple of test from ucmp to cmptb2023-07-031-4/+4
| | | | | | | | This is confusing, as both sides involved should be unsigned. The ec code is undecided on whether the group order can be negative. It should never be, so lets see what happen with this slightly stricter check. discussed with jsing
* ossl_ecdsa_verify_sig(): simplify range checkstb2023-07-031-6/+4
| | | | | | | The checks whether r and s lie in the interval [1, order) were a bit uglier than necessary. Clean this up. ok beck jsing
* List variables in a somewhat more sensible ordertb2023-07-031-4/+4
|
* In ossl_ecdsa_verify_sig() use BN_CTX more idiomaticallytb2023-07-031-8/+10
| | | | ok beck jsing
* Split a bunch of unrelated checkstb2023-07-031-3/+10
| | | | ok beck jsing
* Make ossl_ecdsa_verify_sig() single exittb2023-07-031-4/+4
| | | | ok beck jsing
* Switch ossl_ecdsa_verify() to timingsafe_memcmp()tb2023-07-031-2/+2
| | | | Requested by jsing
* Streamline ossl_ecdsa_verify()tb2023-07-031-7/+13
| | | | | | | Make it single exit and use API more idiomatically and some other cosmetics. ok beck jsing
* Switch ECDSA code to using EC_GROUP_get0_order()tb2023-07-031-25/+17
| | | | ok jsing
* Another empty line did not want to go intb2023-07-031-1/+2
|
* Trade a pair of extra braces for a missing empty linetb2023-07-031-3/+3
|
* Switch sign_sig() and sign_setup() to using BN_CTXtb2023-07-021-47/+73
| | | | | | | | | | | Both these functions use a BN_CTX internally to deal with the EC API that usually requires one. However, they don't actually make use of it. Get the BIGNUMs from the BN_CTX instead, which simplifies the cleanup. Also defer allocation of the ECDSA_SIG to the very end. Instead of using its internal r and s, use two local r and s variables and transfer those to the ECDSA_SIG on success. ok beck jsing
* Revert hunk accidentally committed in r1.39tb2023-07-021-11/+1
|
* Rework handling of the out_kinv and out_r pointerstb2023-07-021-8/+15
| | | | suggested by jsing
* Rename ctx_in into in_ctx, kinvp into out_kinv and rp into out_rtb2023-07-021-12/+13
|
* Rename a few variables from X to xtb2023-07-021-14/+14
|
* Simplify things by switching to bn_rand_interval()tb2023-07-021-22/+19
| | | | | | | | This avoids some silly dances in ECDSA signature generation by replacing them with a single API call. Also garbage collect the now unnecessary range. ok beck jsing
* ECDSA_size(): move order a few lines downtb2023-07-021-2/+2
|
* Invert method checks to avoid stupid line breakstb2023-07-021-22/+26
|
* Move ECDSA_size() to ecs_ossl.c to match what was done in ecdhtb2023-06-252-34/+34
|
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-05-22 00:26:02 +0000