1 /* $OpenBSD: ecdsatest.c,v 1.6 2018/07/17 17:10:04 tb Exp $ */
2 /*
3 * Written by Nils Larsch for the OpenSSL project.
4 */
5 /* ====================================================================
6 * Copyright (c) 2000-2005 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58 /* ====================================================================
59 * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
60 *
61 * Portions of the attached software ("Contribution") are developed by
62 * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
63 *
64 * The Contribution is licensed pursuant to the OpenSSL open source
65 * license provided above.
66 *
67 * The elliptic curve binary polynomial software is originally written by
68 * Sheueling Chang Shantz and Douglas Stebila of Sun Microsystems Laboratories.
69 *
70 */
71
72 #include <stdio.h>
73 #include <stdlib.h>
74 #include <string.h>
75
76 #include <openssl/crypto.h>
77 #include <openssl/bio.h>
78 #include <openssl/evp.h>
79 #include <openssl/bn.h>
80 #include <openssl/ecdsa.h>
81 #ifndef OPENSSL_NO_ENGINE
82 #include <openssl/engine.h>
83 #endif
84 #include <openssl/err.h>
85
86 /* declaration of the test functions */
87 int x9_62_test_internal(BIO *out, int nid, const char *r, const char *s);
88 int test_builtin(BIO *);
89
90 /* some tests from the X9.62 draft */
91 int
x9_62_test_internal(BIO * out,int nid,const char * r_in,const char * s_in)92 x9_62_test_internal(BIO *out, int nid, const char *r_in, const char *s_in)
93 {
94 int ret = 0;
95 const char message[] = "abc";
96 unsigned char digest[20];
97 unsigned int dgst_len = 0;
98 EVP_MD_CTX md_ctx;
99 EC_KEY *key = NULL;
100 ECDSA_SIG *signature = NULL;
101 BIGNUM *r = NULL, *s = NULL;
102
103 EVP_MD_CTX_init(&md_ctx);
104 /* get the message digest */
105 EVP_DigestInit(&md_ctx, EVP_ecdsa());
106 EVP_DigestUpdate(&md_ctx, (const void*)message, 3);
107 EVP_DigestFinal(&md_ctx, digest, &dgst_len);
108
109 BIO_printf(out, "testing %s: ", OBJ_nid2sn(nid));
110 /* create the key */
111 if ((key = EC_KEY_new_by_curve_name(nid)) == NULL)
112 goto x962_int_err;
113 if (!EC_KEY_generate_key(key))
114 goto x962_int_err;
115 BIO_printf(out, ".");
116 (void)BIO_flush(out);
117 /* create the signature */
118 signature = ECDSA_do_sign(digest, 20, key);
119 if (signature == NULL)
120 goto x962_int_err;
121 BIO_printf(out, ".");
122 (void)BIO_flush(out);
123 /* compare the created signature with the expected signature */
124 if ((r = BN_new()) == NULL || (s = BN_new()) == NULL)
125 goto x962_int_err;
126 if (!BN_dec2bn(&r, r_in) ||
127 !BN_dec2bn(&s, s_in))
128 goto x962_int_err;
129 if (BN_cmp(signature->r ,r) || BN_cmp(signature->s, s))
130 goto x962_int_err;
131 BIO_printf(out, ".");
132 (void)BIO_flush(out);
133 /* verify the signature */
134 if (ECDSA_do_verify(digest, 20, signature, key) != 1)
135 goto x962_int_err;
136 BIO_printf(out, ".");
137 (void)BIO_flush(out);
138
139 BIO_printf(out, " ok\n");
140 ret = 1;
141 x962_int_err:
142 if (!ret)
143 BIO_printf(out, " failed\n");
144 if (key)
145 EC_KEY_free(key);
146 if (signature)
147 ECDSA_SIG_free(signature);
148 if (r)
149 BN_free(r);
150 if (s)
151 BN_free(s);
152 EVP_MD_CTX_cleanup(&md_ctx);
153 return ret;
154 }
155
156 int
test_builtin(BIO * out)157 test_builtin(BIO *out)
158 {
159 EC_builtin_curve *curves = NULL;
160 size_t num_curves = 0, n = 0;
161 EC_KEY *eckey = NULL, *wrong_eckey = NULL;
162 EC_GROUP *group;
163 ECDSA_SIG *ecdsa_sig = NULL;
164 unsigned char digest[20], wrong_digest[20];
165 unsigned char *signature = NULL;
166 const unsigned char *sig_ptr;
167 unsigned char *sig_ptr2;
168 unsigned char *raw_buf = NULL;
169 unsigned int sig_len, degree, r_len, s_len, bn_len, buf_len;
170 int nid, ret = 0;
171
172 /* fill digest values with some random data */
173 arc4random_buf(digest, 20);
174 arc4random_buf(wrong_digest, 20);
175
176 /* create and verify a ecdsa signature with every available curve */
177 BIO_printf(out, "\ntesting ECDSA_sign() and ECDSA_verify() "
178 "with some internal curves:\n");
179
180 /* get a list of all internal curves */
181 num_curves = EC_get_builtin_curves(NULL, 0);
182
183 curves = reallocarray(NULL, sizeof(EC_builtin_curve), num_curves);
184
185 if (curves == NULL) {
186 BIO_printf(out, "reallocarray error\n");
187 goto builtin_err;
188 }
189
190 if (!EC_get_builtin_curves(curves, num_curves)) {
191 BIO_printf(out, "unable to get internal curves\n");
192 goto builtin_err;
193 }
194
195 /* now create and verify a signature for every curve */
196 for (n = 0; n < num_curves; n++) {
197 unsigned char dirt, offset;
198
199 nid = curves[n].nid;
200 if (nid == NID_ipsec4)
201 continue;
202 /* create new ecdsa key (== EC_KEY) */
203 if ((eckey = EC_KEY_new()) == NULL)
204 goto builtin_err;
205 group = EC_GROUP_new_by_curve_name(nid);
206 if (group == NULL)
207 goto builtin_err;
208 if (EC_KEY_set_group(eckey, group) == 0)
209 goto builtin_err;
210 EC_GROUP_free(group);
211 degree = EC_GROUP_get_degree(EC_KEY_get0_group(eckey));
212 if (degree < 160) {
213 /* drop the curve */
214 EC_KEY_free(eckey);
215 eckey = NULL;
216 continue;
217 }
218 BIO_printf(out, "%s: ", OBJ_nid2sn(nid));
219 /* create key */
220 if (!EC_KEY_generate_key(eckey)) {
221 BIO_printf(out, " failed\n");
222 goto builtin_err;
223 }
224 /* create second key */
225 if ((wrong_eckey = EC_KEY_new()) == NULL)
226 goto builtin_err;
227 group = EC_GROUP_new_by_curve_name(nid);
228 if (group == NULL)
229 goto builtin_err;
230 if (EC_KEY_set_group(wrong_eckey, group) == 0)
231 goto builtin_err;
232 EC_GROUP_free(group);
233 if (!EC_KEY_generate_key(wrong_eckey)) {
234 BIO_printf(out, " failed\n");
235 goto builtin_err;
236 }
237
238 BIO_printf(out, ".");
239 (void)BIO_flush(out);
240 /* check key */
241 if (!EC_KEY_check_key(eckey)) {
242 BIO_printf(out, " failed\n");
243 goto builtin_err;
244 }
245 BIO_printf(out, ".");
246 (void)BIO_flush(out);
247 /* create signature */
248 sig_len = ECDSA_size(eckey);
249 if ((signature = malloc(sig_len)) == NULL)
250 goto builtin_err;
251 if (!ECDSA_sign(0, digest, 20, signature, &sig_len, eckey)) {
252 BIO_printf(out, " failed\n");
253 goto builtin_err;
254 }
255 BIO_printf(out, ".");
256 (void)BIO_flush(out);
257 /* verify signature */
258 if (ECDSA_verify(0, digest, 20, signature, sig_len,
259 eckey) != 1) {
260 BIO_printf(out, " failed\n");
261 goto builtin_err;
262 }
263 BIO_printf(out, ".");
264 (void)BIO_flush(out);
265 /* verify signature with the wrong key */
266 if (ECDSA_verify(0, digest, 20, signature, sig_len,
267 wrong_eckey) == 1) {
268 BIO_printf(out, " failed\n");
269 goto builtin_err;
270 }
271 BIO_printf(out, ".");
272 (void)BIO_flush(out);
273 /* wrong digest */
274 if (ECDSA_verify(0, wrong_digest, 20, signature, sig_len,
275 eckey) == 1) {
276 BIO_printf(out, " failed\n");
277 goto builtin_err;
278 }
279 BIO_printf(out, ".");
280 (void)BIO_flush(out);
281 /* wrong length */
282 if (ECDSA_verify(0, digest, 20, signature, sig_len - 1,
283 eckey) == 1) {
284 BIO_printf(out, " failed\n");
285 goto builtin_err;
286 }
287 BIO_printf(out, ".");
288 (void)BIO_flush(out);
289
290 /*
291 * Modify a single byte of the signature: to ensure we don't
292 * garble the ASN1 structure, we read the raw signature and
293 * modify a byte in one of the bignums directly.
294 */
295 sig_ptr = signature;
296 if ((ecdsa_sig = d2i_ECDSA_SIG(NULL, &sig_ptr,
297 sig_len)) == NULL) {
298 BIO_printf(out, " failed\n");
299 goto builtin_err;
300 }
301
302 /* Store the two BIGNUMs in raw_buf. */
303 r_len = BN_num_bytes(ecdsa_sig->r);
304 s_len = BN_num_bytes(ecdsa_sig->s);
305 bn_len = (degree + 7) / 8;
306 if ((r_len > bn_len) || (s_len > bn_len)) {
307 BIO_printf(out, " failed\n");
308 goto builtin_err;
309 }
310 buf_len = 2 * bn_len;
311 if ((raw_buf = calloc(1, buf_len)) == NULL)
312 goto builtin_err;
313 BN_bn2bin(ecdsa_sig->r, raw_buf + bn_len - r_len);
314 BN_bn2bin(ecdsa_sig->s, raw_buf + buf_len - s_len);
315
316 /* Modify a single byte in the buffer. */
317 offset = raw_buf[10] % buf_len;
318 dirt = raw_buf[11] ? raw_buf[11] : 1;
319 raw_buf[offset] ^= dirt;
320 /* Now read the BIGNUMs back in from raw_buf. */
321 if ((BN_bin2bn(raw_buf, bn_len, ecdsa_sig->r) == NULL) ||
322 (BN_bin2bn(raw_buf + bn_len, bn_len, ecdsa_sig->s) == NULL))
323 goto builtin_err;
324
325 sig_ptr2 = signature;
326 sig_len = i2d_ECDSA_SIG(ecdsa_sig, &sig_ptr2);
327 if (ECDSA_verify(0, digest, 20, signature, sig_len,
328 eckey) == 1) {
329 BIO_printf(out, " failed\n");
330 goto builtin_err;
331 }
332 /* Sanity check: undo the modification and verify signature. */
333 raw_buf[offset] ^= dirt;
334 if ((BN_bin2bn(raw_buf, bn_len, ecdsa_sig->r) == NULL) ||
335 (BN_bin2bn(raw_buf + bn_len, bn_len, ecdsa_sig->s) == NULL))
336 goto builtin_err;
337
338 sig_ptr2 = signature;
339 sig_len = i2d_ECDSA_SIG(ecdsa_sig, &sig_ptr2);
340 if (ECDSA_verify(0, digest, 20, signature, sig_len,
341 eckey) != 1) {
342 BIO_printf(out, " failed\n");
343 goto builtin_err;
344 }
345 BIO_printf(out, ".");
346 (void)BIO_flush(out);
347
348 BIO_printf(out, " ok\n");
349 /* cleanup */
350 /* clean bogus errors */
351 ERR_clear_error();
352 free(signature);
353 signature = NULL;
354 EC_KEY_free(eckey);
355 eckey = NULL;
356 EC_KEY_free(wrong_eckey);
357 wrong_eckey = NULL;
358 ECDSA_SIG_free(ecdsa_sig);
359 ecdsa_sig = NULL;
360 free(raw_buf);
361 raw_buf = NULL;
362 }
363
364 ret = 1;
365 builtin_err:
366 EC_KEY_free(eckey);
367 EC_KEY_free(wrong_eckey);
368 ECDSA_SIG_free(ecdsa_sig);
369 free(signature);
370 free(raw_buf);
371 free(curves);
372
373 return ret;
374 }
375
376 int
main(void)377 main(void)
378 {
379 int ret = 1;
380 BIO *out;
381
382 out = BIO_new_fp(stdout, BIO_NOCLOSE);
383
384 ERR_load_crypto_strings();
385
386 /* the tests */
387 if (!test_builtin(out))
388 goto err;
389
390 ret = 0;
391 err:
392 if (ret)
393 BIO_printf(out, "\nECDSA test failed\n");
394 else
395 BIO_printf(out, "\nECDSA test passed\n");
396 if (ret)
397 ERR_print_errors(out);
398 CRYPTO_cleanup_all_ex_data();
399 ERR_remove_thread_state(NULL);
400 ERR_free_strings();
401 CRYPTO_mem_leaks(out);
402 if (out != NULL)
403 BIO_free(out);
404 return ret;
405 }
406