Skip to content

DSA cdf tests #280

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
karel-m merged 15 commits into from
Sep 14, 2017
Merged

DSA cdf tests #280

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
2505e3b
add basic validity tests to dsa_set
karel-m Aug 29, 2017
053ba6d
introducing dsa_verify_key_ex
karel-m Sep 11, 2017
1625ce4
re-factor & re-name internal dsa key validation
sjaeckel Sep 11, 2017
aa5b9da
fix dsa_int_validate_key related compiler warnings
karel-m Sep 12, 2017
5fb4c9f
another approach for dsa_int_validate_*
karel-m Sep 14, 2017
1ea4fec
FIPS 186-4 DSA validity tests
karel-m Sep 14, 2017
c806ea1
fix dsa_int_validate_xy
karel-m Sep 14, 2017
45b6b94
dsa_int_validate_primes & LTC_MILLER_RABIN_REPS
karel-m Sep 14, 2017
9765bef
do dsa_int_validate_pqg in dsa_set_pqg_dsaparam
karel-m Sep 14, 2017
fd94e95
move qord trest to dsa_int_validate_pqg
karel-m Sep 14, 2017
444d9f3
do dsa_int_validate_* in dsa_import
karel-m Sep 14, 2017
d91d594
fix de-referencing stat before checking for NULL
karel-m Sep 14, 2017
6200f30
add comment #ifdef LTC_SOURCE + internal helper functions
karel-m Sep 14, 2017
a990a82
mp_clear_multi - reverse the order
karel-m Sep 14, 2017
bb6a7e1
if dsa_int_validate_* fails return consistently CRYPT_INVALID_PACKET
karel-m Sep 14, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion src/headers/tomcrypt_pk.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -479,7 +479,12 @@ int dsa_decrypt_key(const unsigned char *in, unsigned long inlen,
int dsa_import(const unsigned char *in, unsigned long inlen, dsa_key *key);
int dsa_export(unsigned char *out, unsigned long *outlen, int type, dsa_key *key);
int dsa_verify_key(dsa_key *key, int *stat);

#ifdef LTC_SOURCE
Copy link
Copy Markdown
Member

@sjaeckel sjaeckel Sep 14, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can you please add the obligatory /* internal helper functions */ comment

/* internal helper functions */
int dsa_int_validate_xy(dsa_key *key, int *stat);
int dsa_int_validate_pqg(dsa_key *key, int *stat);
int dsa_int_validate_primes(dsa_key *key, int *stat);
#endif
int dsa_shared_secret(void *private_key, void *base,
dsa_key *public_key,
unsigned char *out, unsigned long *outlen);
Expand Down
19 changes: 15 additions & 4 deletions src/pk/dsa/dsa_import.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@
*/
int dsa_import(const unsigned char *in, unsigned long inlen, dsa_key *key)
{
int err;
int err, stat;
unsigned long zero = 0;
unsigned char* tmpbuf = NULL;
unsigned char flags[1];
Expand Down Expand Up @@ -116,10 +116,21 @@ int dsa_import(const unsigned char *in, unsigned long inlen, dsa_key *key)
}

LBL_OK:
key->qord = mp_unsigned_bin_size(key->q);
key->qord = mp_unsigned_bin_size(key->q);

if (key->qord >= LTC_MDSA_MAX_GROUP || key->qord <= 15 ||
(unsigned long)key->qord >= mp_unsigned_bin_size(key->p) || (mp_unsigned_bin_size(key->p) - key->qord) >= LTC_MDSA_DELTA) {
/* quick p, q, g validation, without primality testing */
if ((err = dsa_int_validate_pqg(key, &stat)) != CRYPT_OK) {
goto LBL_ERR;
}
if (stat == 0) {
err = CRYPT_INVALID_PACKET;
Copy link
Copy Markdown
Member

@sjaeckel sjaeckel Sep 14, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks like we inconsistently return either CRYPT_INVALID_PACKET or CRYPT_INVALID_ARG, we should always use the same error code. I'd say we should go for CRYPT_INVALID_PACKET (an alternative could be to introduce a new error code, but not sure if that's really necessary).

goto LBL_ERR;
}
/* validate x, y */
if ((err = dsa_int_validate_xy(key, &stat)) != CRYPT_OK) {
goto LBL_ERR;
}
if (stat == 0) {
err = CRYPT_INVALID_PACKET;
goto LBL_ERR;
}
Expand Down
16 changes: 12 additions & 4 deletions src/pk/dsa/dsa_set.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ int dsa_set_pqg(const unsigned char *p, unsigned long plen,
const unsigned char *g, unsigned long glen,
dsa_key *key)
{
int err;
int err, stat;

LTC_ARGCHK(p != NULL);
LTC_ARGCHK(q != NULL);
Expand All @@ -45,11 +45,13 @@ int dsa_set_pqg(const unsigned char *p, unsigned long plen,

key->qord = mp_unsigned_bin_size(key->q);

if (key->qord >= LTC_MDSA_MAX_GROUP || key->qord <= 15 ||
(unsigned long)key->qord >= mp_unsigned_bin_size(key->p) || (mp_unsigned_bin_size(key->p) - key->qord) >= LTC_MDSA_DELTA) {
/* do only a quick validation, without primality testing */
if ((err = dsa_int_validate_pqg(key, &stat)) != CRYPT_OK) { goto LBL_ERR; }
if (stat == 0) {
err = CRYPT_INVALID_PACKET;
goto LBL_ERR;
}

return CRYPT_OK;

LBL_ERR:
Expand All @@ -70,7 +72,7 @@ int dsa_set_pqg(const unsigned char *p, unsigned long plen,
*/
int dsa_set_key(const unsigned char *in, unsigned long inlen, int type, dsa_key *key)
{
int err;
int err, stat = 0;

LTC_ARGCHK(key != NULL);
LTC_ARGCHK(key->x != NULL);
Expand All @@ -90,6 +92,12 @@ int dsa_set_key(const unsigned char *in, unsigned long inlen, int type, dsa_key
if ((err = mp_read_unsigned_bin(key->y, (unsigned char *)in, inlen)) != CRYPT_OK) { goto LBL_ERR; }
}

if ((err = dsa_int_validate_xy(key, &stat)) != CRYPT_OK) { goto LBL_ERR; }
if (stat == 0) {
err = CRYPT_INVALID_PACKET;
goto LBL_ERR;
}

return CRYPT_OK;

LBL_ERR:
Expand Down
10 changes: 7 additions & 3 deletions src/pk/dsa/dsa_set_pqg_dsaparam.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@
int dsa_set_pqg_dsaparam(const unsigned char *dsaparam, unsigned long dsaparamlen,
dsa_key *key)
{
int err;
int err, stat;

LTC_ARGCHK(dsaparam != NULL);
LTC_ARGCHK(key != NULL);
Expand All @@ -44,11 +44,15 @@ int dsa_set_pqg_dsaparam(const unsigned char *dsaparam, unsigned long dsaparamle

key->qord = mp_unsigned_bin_size(key->q);

if (key->qord >= LTC_MDSA_MAX_GROUP || key->qord <= 15 ||
(unsigned long)key->qord >= mp_unsigned_bin_size(key->p) || (mp_unsigned_bin_size(key->p) - key->qord) >= LTC_MDSA_DELTA) {
/* quick p, q, g validation, without primality testing */
if ((err = dsa_int_validate_pqg(key, &stat)) != CRYPT_OK) {
goto LBL_ERR;
}
if (stat == 0) {
err = CRYPT_INVALID_PACKET;
goto LBL_ERR;
}

return CRYPT_OK;

LBL_ERR:
Expand Down
178 changes: 140 additions & 38 deletions src/pk/dsa/dsa_verify_key.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,81 +16,183 @@
#ifdef LTC_MDSA

/**
Verify a DSA key for validity
@param key The key to verify
Validate a DSA key

Yeah, this function should've been called dsa_validate_key()
in the first place and for compat-reasons we keep it
as it was (for now).

@param key The key to validate
@param stat [out] Result of test, 1==valid, 0==invalid
@return CRYPT_OK if successful
*/
int dsa_verify_key(dsa_key *key, int *stat)
{
void *tmp, *tmp2;
int res, err;
int err;

err = dsa_int_validate_primes(key, stat);
if (err != CRYPT_OK || *stat == 0) return err;

err = dsa_int_validate_pqg(key, stat);
if (err != CRYPT_OK || *stat == 0) return err;

return dsa_int_validate_xy(key, stat);
}

/**
Non-complex part (no primality testing) of the validation
of DSA params (p, q, g)

@param key The key to validate
@param stat [out] Result of test, 1==valid, 0==invalid
@return CRYPT_OK if successful
*/
int dsa_int_validate_pqg(dsa_key *key, int *stat)
{
void *tmp1, *tmp2;
int err;

LTC_ARGCHK(key != NULL);
LTC_ARGCHK(stat != NULL);

/* default to an invalid key */
*stat = 0;

/* first make sure key->q and key->p are prime */
if ((err = mp_prime_is_prime(key->q, 8, &res)) != CRYPT_OK) {
return err;
/* check q-order */
if ( key->qord >= LTC_MDSA_MAX_GROUP || key->qord <= 15 ||
(unsigned long)key->qord >= mp_unsigned_bin_size(key->p) ||
(mp_unsigned_bin_size(key->p) - key->qord) >= LTC_MDSA_DELTA ) {
err = CRYPT_OK;
goto error;
}
if (res == 0) {

/* FIPS 186-4 chapter 4.1: 1 < g < p */
if (mp_cmp_d(key->g, 1) != LTC_MP_GT || mp_cmp(key->g, key->p) != LTC_MP_LT) {
return CRYPT_OK;
}

if ((err = mp_prime_is_prime(key->p, 8, &res)) != CRYPT_OK) {
if ((err = mp_init_multi(&tmp1, &tmp2, NULL)) != CRYPT_OK) { return err; }

/* FIPS 186-4 chapter 4.1: q is a divisor of (p - 1) */
if ((err = mp_sub_d(key->p, 1, tmp1)) != CRYPT_OK) { goto error; }
if ((err = mp_div(tmp1, key->q, tmp1, tmp2)) != CRYPT_OK) { goto error; }
if (mp_iszero(tmp2) != LTC_MP_YES) {
err = CRYPT_OK;
goto error;
}

/* FIPS 186-4 chapter 4.1: g is a generator of a subgroup of order q in
* the multiplicative group of GF(p) - so we make sure that g^q mod p = 1
*/
if ((err = mp_exptmod(key->g, key->q, key->p, tmp1)) != CRYPT_OK) { goto error; }
if (mp_cmp_d(tmp1, 1) != LTC_MP_EQ) {
err = CRYPT_OK;
goto error;
}

err = CRYPT_OK;
*stat = 1;
error:
mp_clear_multi(tmp2, tmp1, NULL);
return err;
}

/**
Primality testing of DSA params p and q

@param key The key to validate
@param stat [out] Result of test, 1==valid, 0==invalid
@return CRYPT_OK if successful
*/
int dsa_int_validate_primes(dsa_key *key, int *stat)
{
int err, res;

*stat = 0;
LTC_ARGCHK(key != NULL);
LTC_ARGCHK(stat != NULL);

/* key->q prime? */
if ((err = mp_prime_is_prime(key->q, LTC_MILLER_RABIN_REPS, &res)) != CRYPT_OK) {
return err;
}
if (res == 0) {
if (res == LTC_MP_NO) {
return CRYPT_OK;
}

/* now make sure that g is not -1, 0 or 1 and <p */
if (mp_cmp_d(key->g, 0) == LTC_MP_EQ || mp_cmp_d(key->g, 1) == LTC_MP_EQ) {
return CRYPT_OK;
/* key->p prime? */
if ((err = mp_prime_is_prime(key->p, LTC_MILLER_RABIN_REPS, &res)) != CRYPT_OK) {
return err;
}
if ((err = mp_init_multi(&tmp, &tmp2, NULL)) != CRYPT_OK) { return err; }
if ((err = mp_sub_d(key->p, 1, tmp)) != CRYPT_OK) { goto error; }
if (mp_cmp(tmp, key->g) == LTC_MP_EQ || mp_cmp(key->g, key->p) != LTC_MP_LT) {
err = CRYPT_OK;
goto error;
if (res == LTC_MP_NO) {
return CRYPT_OK;
}

*stat = 1;
return CRYPT_OK;
}

/**
Validation of a DSA key (x and y values)

@param key The key to validate
@param stat [out] Result of test, 1==valid, 0==invalid
@return CRYPT_OK if successful
*/
int dsa_int_validate_xy(dsa_key *key, int *stat)
{
void *tmp;
int err;

*stat = 0;
LTC_ARGCHK(key != NULL);
LTC_ARGCHK(stat != NULL);

/* 1 < y < p-1 */
if (!(mp_cmp_d(key->y, 1) == LTC_MP_GT && mp_cmp(key->y, tmp) == LTC_MP_LT)) {
err = CRYPT_OK;
goto error;
if ((err = mp_init(&tmp)) != CRYPT_OK) {
return err;
}

/* now we have to make sure that g^q = 1, and that p-1/q gives 0 remainder */
if ((err = mp_div(tmp, key->q, tmp, tmp2)) != CRYPT_OK) { goto error; }
if (mp_iszero(tmp2) != LTC_MP_YES) {
err = CRYPT_OK;
if ((err = mp_sub_d(key->p, 1, tmp)) != CRYPT_OK) {
goto error;
}

if ((err = mp_exptmod(key->g, key->q, key->p, tmp)) != CRYPT_OK) { goto error; }
if (mp_cmp_d(tmp, 1) != LTC_MP_EQ) {
if (mp_cmp_d(key->y, 1) != LTC_MP_GT || mp_cmp(key->y, tmp) != LTC_MP_LT) {
err = CRYPT_OK;
goto error;
}

/* now we have to make sure that y^q = 1, this makes sure y \in g^x mod p */
if ((err = mp_exptmod(key->y, key->q, key->p, tmp)) != CRYPT_OK) { goto error; }
if (mp_cmp_d(tmp, 1) != LTC_MP_EQ) {
err = CRYPT_OK;
goto error;
if (key->type == PK_PRIVATE) {
/* FIPS 186-4 chapter 4.1: 0 < x < q */
if (mp_cmp_d(key->x, 0) != LTC_MP_GT || mp_cmp(key->x, key->q) != LTC_MP_LT) {
err = CRYPT_OK;
goto error;
}
/* FIPS 186-4 chapter 4.1: y = g^x mod p */
if ((err = mp_exptmod(key->g, key->x, key->p, tmp)) != CRYPT_OK) {
goto error;
}
if (mp_cmp(tmp, key->y) != LTC_MP_EQ) {
err = CRYPT_OK;
goto error;
}
}
else {
/* with just a public key we cannot test y = g^x mod p therefore we
* only test that y^q mod p = 1, which makes sure y is in g^x mod p
*/
if ((err = mp_exptmod(key->y, key->q, key->p, tmp)) != CRYPT_OK) {
goto error;
}
if (mp_cmp_d(tmp, 1) != LTC_MP_EQ) {
err = CRYPT_OK;
goto error;
}
}

/* at this point we are out of tests ;-( */
err = CRYPT_OK;
*stat = 1;
error:
mp_clear_multi(tmp, tmp2, NULL);
mp_clear(tmp);
return err;
}

#endif

/* ref: $Format:%D$ */
Expand Down