ECDSA signature verification is missing a modular operation

[DualTachyon]

Hi,

I think that a mpi_mod_mpi is missing from ecdsa_signature as shown below.
Without that line addition, ECDSA verification in DTCP-IP doesn't work.
I'm no ECP expert, so let me know if you disagree with this change.
For reference, I compared the values of each MPI at every line of code with my own reference ECDSA implementation, and that is the only place that differs in PolarSSL.

Thanks.

if( ecp_is_zero( &R ) )
{
    ret = POLARSSL_ERR_ECP_VERIFY_FAILED;
    goto cleanup;
}

// Make sure R.X is mod n.
MPI_CHK( mpi_mod_mpi( &R.X, &R.X, &grp->N ) );

/*
 * Step 6: check that xR == r
 */
if( mpi_cmp_mpi( &R.X, r ) != 0 )

[DualTachyon]

I forgot to mention I'm using the 1.3.1 release of PolarSSL.

[mpg]

Thanks for your report! Indeed you're right, and reduction mod n should be performed. This just got fixed in the internal development branch and will be in the next minor release.

I'm rather surprised you ran into this issue, since heuristically it seems to me it should happen roughly with probability 2^(-l/2) where l is the bit length of "the curve" (that is, of P or N), so it should be very unlikely with the kind of curve size used in cryptographic applications.

[pjbakker]

Updated in private branch ready for 1.3.2 release