1e71b7053SJung-uk Kim /*
29a3ae0cdSJung-uk Kim * Copyright 2017-2021 The OpenSSL Project Authors. All Rights Reserved.
3e71b7053SJung-uk Kim * Copyright 2017 Ribose Inc. All Rights Reserved.
4e71b7053SJung-uk Kim * Ported from Ribose contributions from Botan.
5e71b7053SJung-uk Kim *
6b077aed3SPierre Pronchery * Licensed under the Apache License 2.0 (the "License"). You may not use
7e71b7053SJung-uk Kim * this file except in compliance with the License. You can obtain a copy
8e71b7053SJung-uk Kim * in the file LICENSE in the source distribution or at
9e71b7053SJung-uk Kim * https://www.openssl.org/source/license.html
10e71b7053SJung-uk Kim */
11e71b7053SJung-uk Kim
12b077aed3SPierre Pronchery /*
13b077aed3SPierre Pronchery * ECDSA low level APIs are deprecated for public use, but still ok for
14b077aed3SPierre Pronchery * internal use.
15b077aed3SPierre Pronchery */
16b077aed3SPierre Pronchery #include "internal/deprecated.h"
17b077aed3SPierre Pronchery
1817f01e99SJung-uk Kim #include "crypto/sm2.h"
1917f01e99SJung-uk Kim #include "crypto/sm2err.h"
20b077aed3SPierre Pronchery #include "crypto/ec.h" /* ossl_ecdh_kdf_X9_63() */
21e71b7053SJung-uk Kim #include <openssl/err.h>
22e71b7053SJung-uk Kim #include <openssl/evp.h>
23e71b7053SJung-uk Kim #include <openssl/bn.h>
24e71b7053SJung-uk Kim #include <openssl/asn1.h>
25e71b7053SJung-uk Kim #include <openssl/asn1t.h>
26e71b7053SJung-uk Kim #include <string.h>
27e71b7053SJung-uk Kim
28e71b7053SJung-uk Kim typedef struct SM2_Ciphertext_st SM2_Ciphertext;
29e71b7053SJung-uk Kim DECLARE_ASN1_FUNCTIONS(SM2_Ciphertext)
30e71b7053SJung-uk Kim
31e71b7053SJung-uk Kim struct SM2_Ciphertext_st {
32e71b7053SJung-uk Kim BIGNUM *C1x;
33e71b7053SJung-uk Kim BIGNUM *C1y;
34e71b7053SJung-uk Kim ASN1_OCTET_STRING *C3;
35e71b7053SJung-uk Kim ASN1_OCTET_STRING *C2;
36e71b7053SJung-uk Kim };
37e71b7053SJung-uk Kim
38e71b7053SJung-uk Kim ASN1_SEQUENCE(SM2_Ciphertext) = {
39e71b7053SJung-uk Kim ASN1_SIMPLE(SM2_Ciphertext, C1x, BIGNUM),
40e71b7053SJung-uk Kim ASN1_SIMPLE(SM2_Ciphertext, C1y, BIGNUM),
41e71b7053SJung-uk Kim ASN1_SIMPLE(SM2_Ciphertext, C3, ASN1_OCTET_STRING),
42e71b7053SJung-uk Kim ASN1_SIMPLE(SM2_Ciphertext, C2, ASN1_OCTET_STRING),
43e71b7053SJung-uk Kim } ASN1_SEQUENCE_END(SM2_Ciphertext)
44e71b7053SJung-uk Kim
45e71b7053SJung-uk Kim IMPLEMENT_ASN1_FUNCTIONS(SM2_Ciphertext)
46e71b7053SJung-uk Kim
47e71b7053SJung-uk Kim static size_t ec_field_size(const EC_GROUP *group)
48e71b7053SJung-uk Kim {
49e71b7053SJung-uk Kim /* Is there some simpler way to do this? */
50e71b7053SJung-uk Kim BIGNUM *p = BN_new();
51e71b7053SJung-uk Kim BIGNUM *a = BN_new();
52e71b7053SJung-uk Kim BIGNUM *b = BN_new();
53e71b7053SJung-uk Kim size_t field_size = 0;
54e71b7053SJung-uk Kim
55e71b7053SJung-uk Kim if (p == NULL || a == NULL || b == NULL)
56e71b7053SJung-uk Kim goto done;
57e71b7053SJung-uk Kim
58e71b7053SJung-uk Kim if (!EC_GROUP_get_curve(group, p, a, b, NULL))
59e71b7053SJung-uk Kim goto done;
60e71b7053SJung-uk Kim field_size = (BN_num_bits(p) + 7) / 8;
61e71b7053SJung-uk Kim
62e71b7053SJung-uk Kim done:
63e71b7053SJung-uk Kim BN_free(p);
64e71b7053SJung-uk Kim BN_free(a);
65e71b7053SJung-uk Kim BN_free(b);
66e71b7053SJung-uk Kim
67e71b7053SJung-uk Kim return field_size;
68e71b7053SJung-uk Kim }
69e71b7053SJung-uk Kim
ossl_sm2_plaintext_size(const unsigned char * ct,size_t ct_size,size_t * pt_size)70b077aed3SPierre Pronchery int ossl_sm2_plaintext_size(const unsigned char *ct, size_t ct_size,
71b077aed3SPierre Pronchery size_t *pt_size)
72e71b7053SJung-uk Kim {
73aef815e7SGordon Tetlow struct SM2_Ciphertext_st *sm2_ctext = NULL;
74e71b7053SJung-uk Kim
75aef815e7SGordon Tetlow sm2_ctext = d2i_SM2_Ciphertext(NULL, &ct, ct_size);
76e71b7053SJung-uk Kim
77aef815e7SGordon Tetlow if (sm2_ctext == NULL) {
78b077aed3SPierre Pronchery ERR_raise(ERR_LIB_SM2, SM2_R_INVALID_ENCODING);
79e71b7053SJung-uk Kim return 0;
80e71b7053SJung-uk Kim }
81e71b7053SJung-uk Kim
82aef815e7SGordon Tetlow *pt_size = sm2_ctext->C2->length;
83aef815e7SGordon Tetlow SM2_Ciphertext_free(sm2_ctext);
84aef815e7SGordon Tetlow
85e71b7053SJung-uk Kim return 1;
86e71b7053SJung-uk Kim }
87e71b7053SJung-uk Kim
ossl_sm2_ciphertext_size(const EC_KEY * key,const EVP_MD * digest,size_t msg_len,size_t * ct_size)88b077aed3SPierre Pronchery int ossl_sm2_ciphertext_size(const EC_KEY *key, const EVP_MD *digest,
89b077aed3SPierre Pronchery size_t msg_len, size_t *ct_size)
90e71b7053SJung-uk Kim {
91e71b7053SJung-uk Kim const size_t field_size = ec_field_size(EC_KEY_get0_group(key));
92b077aed3SPierre Pronchery const int md_size = EVP_MD_get_size(digest);
93e71b7053SJung-uk Kim size_t sz;
94e71b7053SJung-uk Kim
95e71b7053SJung-uk Kim if (field_size == 0 || md_size < 0)
96e71b7053SJung-uk Kim return 0;
97e71b7053SJung-uk Kim
98e71b7053SJung-uk Kim /* Integer and string are simple type; set constructed = 0, means primitive and definite length encoding. */
99e71b7053SJung-uk Kim sz = 2 * ASN1_object_size(0, field_size + 1, V_ASN1_INTEGER)
100e71b7053SJung-uk Kim + ASN1_object_size(0, md_size, V_ASN1_OCTET_STRING)
101e71b7053SJung-uk Kim + ASN1_object_size(0, msg_len, V_ASN1_OCTET_STRING);
102e71b7053SJung-uk Kim /* Sequence is structured type; set constructed = 1, means constructed and definite length encoding. */
103e71b7053SJung-uk Kim *ct_size = ASN1_object_size(1, sz, V_ASN1_SEQUENCE);
104e71b7053SJung-uk Kim
105e71b7053SJung-uk Kim return 1;
106e71b7053SJung-uk Kim }
107e71b7053SJung-uk Kim
ossl_sm2_encrypt(const EC_KEY * key,const EVP_MD * digest,const uint8_t * msg,size_t msg_len,uint8_t * ciphertext_buf,size_t * ciphertext_len)108b077aed3SPierre Pronchery int ossl_sm2_encrypt(const EC_KEY *key,
109e71b7053SJung-uk Kim const EVP_MD *digest,
110b077aed3SPierre Pronchery const uint8_t *msg, size_t msg_len,
111b077aed3SPierre Pronchery uint8_t *ciphertext_buf, size_t *ciphertext_len)
112e71b7053SJung-uk Kim {
113e71b7053SJung-uk Kim int rc = 0, ciphertext_leni;
114e71b7053SJung-uk Kim size_t i;
115e71b7053SJung-uk Kim BN_CTX *ctx = NULL;
116e71b7053SJung-uk Kim BIGNUM *k = NULL;
117e71b7053SJung-uk Kim BIGNUM *x1 = NULL;
118e71b7053SJung-uk Kim BIGNUM *y1 = NULL;
119e71b7053SJung-uk Kim BIGNUM *x2 = NULL;
120e71b7053SJung-uk Kim BIGNUM *y2 = NULL;
121e71b7053SJung-uk Kim EVP_MD_CTX *hash = EVP_MD_CTX_new();
122e71b7053SJung-uk Kim struct SM2_Ciphertext_st ctext_struct;
123e71b7053SJung-uk Kim const EC_GROUP *group = EC_KEY_get0_group(key);
124e71b7053SJung-uk Kim const BIGNUM *order = EC_GROUP_get0_order(group);
125e71b7053SJung-uk Kim const EC_POINT *P = EC_KEY_get0_public_key(key);
126e71b7053SJung-uk Kim EC_POINT *kG = NULL;
127e71b7053SJung-uk Kim EC_POINT *kP = NULL;
128e71b7053SJung-uk Kim uint8_t *msg_mask = NULL;
129e71b7053SJung-uk Kim uint8_t *x2y2 = NULL;
130e71b7053SJung-uk Kim uint8_t *C3 = NULL;
131e71b7053SJung-uk Kim size_t field_size;
132b077aed3SPierre Pronchery const int C3_size = EVP_MD_get_size(digest);
133b077aed3SPierre Pronchery EVP_MD *fetched_digest = NULL;
134b077aed3SPierre Pronchery OSSL_LIB_CTX *libctx = ossl_ec_key_get_libctx(key);
135b077aed3SPierre Pronchery const char *propq = ossl_ec_key_get0_propq(key);
136e71b7053SJung-uk Kim
137e71b7053SJung-uk Kim /* NULL these before any "goto done" */
138e71b7053SJung-uk Kim ctext_struct.C2 = NULL;
139e71b7053SJung-uk Kim ctext_struct.C3 = NULL;
140e71b7053SJung-uk Kim
141e71b7053SJung-uk Kim if (hash == NULL || C3_size <= 0) {
142b077aed3SPierre Pronchery ERR_raise(ERR_LIB_SM2, ERR_R_INTERNAL_ERROR);
143e71b7053SJung-uk Kim goto done;
144e71b7053SJung-uk Kim }
145e71b7053SJung-uk Kim
146e71b7053SJung-uk Kim field_size = ec_field_size(group);
147e71b7053SJung-uk Kim if (field_size == 0) {
148b077aed3SPierre Pronchery ERR_raise(ERR_LIB_SM2, ERR_R_INTERNAL_ERROR);
149e71b7053SJung-uk Kim goto done;
150e71b7053SJung-uk Kim }
151e71b7053SJung-uk Kim
152e71b7053SJung-uk Kim kG = EC_POINT_new(group);
153e71b7053SJung-uk Kim kP = EC_POINT_new(group);
154b077aed3SPierre Pronchery ctx = BN_CTX_new_ex(libctx);
155e71b7053SJung-uk Kim if (kG == NULL || kP == NULL || ctx == NULL) {
156b077aed3SPierre Pronchery ERR_raise(ERR_LIB_SM2, ERR_R_MALLOC_FAILURE);
157e71b7053SJung-uk Kim goto done;
158e71b7053SJung-uk Kim }
159e71b7053SJung-uk Kim
160e71b7053SJung-uk Kim BN_CTX_start(ctx);
161e71b7053SJung-uk Kim k = BN_CTX_get(ctx);
162e71b7053SJung-uk Kim x1 = BN_CTX_get(ctx);
163e71b7053SJung-uk Kim x2 = BN_CTX_get(ctx);
164e71b7053SJung-uk Kim y1 = BN_CTX_get(ctx);
165e71b7053SJung-uk Kim y2 = BN_CTX_get(ctx);
166e71b7053SJung-uk Kim
167e71b7053SJung-uk Kim if (y2 == NULL) {
168b077aed3SPierre Pronchery ERR_raise(ERR_LIB_SM2, ERR_R_BN_LIB);
169e71b7053SJung-uk Kim goto done;
170e71b7053SJung-uk Kim }
171e71b7053SJung-uk Kim
172e71b7053SJung-uk Kim x2y2 = OPENSSL_zalloc(2 * field_size);
173e71b7053SJung-uk Kim C3 = OPENSSL_zalloc(C3_size);
174e71b7053SJung-uk Kim
175e71b7053SJung-uk Kim if (x2y2 == NULL || C3 == NULL) {
176b077aed3SPierre Pronchery ERR_raise(ERR_LIB_SM2, ERR_R_MALLOC_FAILURE);
177e71b7053SJung-uk Kim goto done;
178e71b7053SJung-uk Kim }
179e71b7053SJung-uk Kim
180e71b7053SJung-uk Kim memset(ciphertext_buf, 0, *ciphertext_len);
181e71b7053SJung-uk Kim
182b077aed3SPierre Pronchery if (!BN_priv_rand_range_ex(k, order, 0, ctx)) {
183b077aed3SPierre Pronchery ERR_raise(ERR_LIB_SM2, ERR_R_INTERNAL_ERROR);
184e71b7053SJung-uk Kim goto done;
185e71b7053SJung-uk Kim }
186e71b7053SJung-uk Kim
187e71b7053SJung-uk Kim if (!EC_POINT_mul(group, kG, k, NULL, NULL, ctx)
188e71b7053SJung-uk Kim || !EC_POINT_get_affine_coordinates(group, kG, x1, y1, ctx)
189e71b7053SJung-uk Kim || !EC_POINT_mul(group, kP, NULL, P, k, ctx)
190e71b7053SJung-uk Kim || !EC_POINT_get_affine_coordinates(group, kP, x2, y2, ctx)) {
191b077aed3SPierre Pronchery ERR_raise(ERR_LIB_SM2, ERR_R_EC_LIB);
192e71b7053SJung-uk Kim goto done;
193e71b7053SJung-uk Kim }
194e71b7053SJung-uk Kim
195e71b7053SJung-uk Kim if (BN_bn2binpad(x2, x2y2, field_size) < 0
196e71b7053SJung-uk Kim || BN_bn2binpad(y2, x2y2 + field_size, field_size) < 0) {
197b077aed3SPierre Pronchery ERR_raise(ERR_LIB_SM2, ERR_R_INTERNAL_ERROR);
198e71b7053SJung-uk Kim goto done;
199e71b7053SJung-uk Kim }
200e71b7053SJung-uk Kim
201e71b7053SJung-uk Kim msg_mask = OPENSSL_zalloc(msg_len);
202e71b7053SJung-uk Kim if (msg_mask == NULL) {
203b077aed3SPierre Pronchery ERR_raise(ERR_LIB_SM2, ERR_R_MALLOC_FAILURE);
204e71b7053SJung-uk Kim goto done;
205e71b7053SJung-uk Kim }
206e71b7053SJung-uk Kim
207e71b7053SJung-uk Kim /* X9.63 with no salt happens to match the KDF used in SM2 */
208b077aed3SPierre Pronchery if (!ossl_ecdh_kdf_X9_63(msg_mask, msg_len, x2y2, 2 * field_size, NULL, 0,
209b077aed3SPierre Pronchery digest, libctx, propq)) {
210b077aed3SPierre Pronchery ERR_raise(ERR_LIB_SM2, ERR_R_EVP_LIB);
211e71b7053SJung-uk Kim goto done;
212e71b7053SJung-uk Kim }
213e71b7053SJung-uk Kim
214e71b7053SJung-uk Kim for (i = 0; i != msg_len; ++i)
215e71b7053SJung-uk Kim msg_mask[i] ^= msg[i];
216e71b7053SJung-uk Kim
217b077aed3SPierre Pronchery fetched_digest = EVP_MD_fetch(libctx, EVP_MD_get0_name(digest), propq);
218b077aed3SPierre Pronchery if (fetched_digest == NULL) {
219b077aed3SPierre Pronchery ERR_raise(ERR_LIB_SM2, ERR_R_INTERNAL_ERROR);
220b077aed3SPierre Pronchery goto done;
221b077aed3SPierre Pronchery }
222b077aed3SPierre Pronchery if (EVP_DigestInit(hash, fetched_digest) == 0
223e71b7053SJung-uk Kim || EVP_DigestUpdate(hash, x2y2, field_size) == 0
224e71b7053SJung-uk Kim || EVP_DigestUpdate(hash, msg, msg_len) == 0
225e71b7053SJung-uk Kim || EVP_DigestUpdate(hash, x2y2 + field_size, field_size) == 0
226e71b7053SJung-uk Kim || EVP_DigestFinal(hash, C3, NULL) == 0) {
227b077aed3SPierre Pronchery ERR_raise(ERR_LIB_SM2, ERR_R_EVP_LIB);
228e71b7053SJung-uk Kim goto done;
229e71b7053SJung-uk Kim }
230e71b7053SJung-uk Kim
231e71b7053SJung-uk Kim ctext_struct.C1x = x1;
232e71b7053SJung-uk Kim ctext_struct.C1y = y1;
233e71b7053SJung-uk Kim ctext_struct.C3 = ASN1_OCTET_STRING_new();
234e71b7053SJung-uk Kim ctext_struct.C2 = ASN1_OCTET_STRING_new();
235e71b7053SJung-uk Kim
236e71b7053SJung-uk Kim if (ctext_struct.C3 == NULL || ctext_struct.C2 == NULL) {
237b077aed3SPierre Pronchery ERR_raise(ERR_LIB_SM2, ERR_R_MALLOC_FAILURE);
238e71b7053SJung-uk Kim goto done;
239e71b7053SJung-uk Kim }
240e71b7053SJung-uk Kim if (!ASN1_OCTET_STRING_set(ctext_struct.C3, C3, C3_size)
241e71b7053SJung-uk Kim || !ASN1_OCTET_STRING_set(ctext_struct.C2, msg_mask, msg_len)) {
242b077aed3SPierre Pronchery ERR_raise(ERR_LIB_SM2, ERR_R_INTERNAL_ERROR);
243e71b7053SJung-uk Kim goto done;
244e71b7053SJung-uk Kim }
245e71b7053SJung-uk Kim
246e71b7053SJung-uk Kim ciphertext_leni = i2d_SM2_Ciphertext(&ctext_struct, &ciphertext_buf);
247e71b7053SJung-uk Kim /* Ensure cast to size_t is safe */
248e71b7053SJung-uk Kim if (ciphertext_leni < 0) {
249b077aed3SPierre Pronchery ERR_raise(ERR_LIB_SM2, ERR_R_INTERNAL_ERROR);
250e71b7053SJung-uk Kim goto done;
251e71b7053SJung-uk Kim }
252e71b7053SJung-uk Kim *ciphertext_len = (size_t)ciphertext_leni;
253e71b7053SJung-uk Kim
254e71b7053SJung-uk Kim rc = 1;
255e71b7053SJung-uk Kim
256e71b7053SJung-uk Kim done:
257b077aed3SPierre Pronchery EVP_MD_free(fetched_digest);
258e71b7053SJung-uk Kim ASN1_OCTET_STRING_free(ctext_struct.C2);
259e71b7053SJung-uk Kim ASN1_OCTET_STRING_free(ctext_struct.C3);
260e71b7053SJung-uk Kim OPENSSL_free(msg_mask);
261e71b7053SJung-uk Kim OPENSSL_free(x2y2);
262e71b7053SJung-uk Kim OPENSSL_free(C3);
263e71b7053SJung-uk Kim EVP_MD_CTX_free(hash);
264e71b7053SJung-uk Kim BN_CTX_free(ctx);
265e71b7053SJung-uk Kim EC_POINT_free(kG);
266e71b7053SJung-uk Kim EC_POINT_free(kP);
267e71b7053SJung-uk Kim return rc;
268e71b7053SJung-uk Kim }
269e71b7053SJung-uk Kim
ossl_sm2_decrypt(const EC_KEY * key,const EVP_MD * digest,const uint8_t * ciphertext,size_t ciphertext_len,uint8_t * ptext_buf,size_t * ptext_len)270b077aed3SPierre Pronchery int ossl_sm2_decrypt(const EC_KEY *key,
271e71b7053SJung-uk Kim const EVP_MD *digest,
272b077aed3SPierre Pronchery const uint8_t *ciphertext, size_t ciphertext_len,
273b077aed3SPierre Pronchery uint8_t *ptext_buf, size_t *ptext_len)
274e71b7053SJung-uk Kim {
275e71b7053SJung-uk Kim int rc = 0;
276e71b7053SJung-uk Kim int i;
277e71b7053SJung-uk Kim BN_CTX *ctx = NULL;
278e71b7053SJung-uk Kim const EC_GROUP *group = EC_KEY_get0_group(key);
279e71b7053SJung-uk Kim EC_POINT *C1 = NULL;
280e71b7053SJung-uk Kim struct SM2_Ciphertext_st *sm2_ctext = NULL;
281e71b7053SJung-uk Kim BIGNUM *x2 = NULL;
282e71b7053SJung-uk Kim BIGNUM *y2 = NULL;
283e71b7053SJung-uk Kim uint8_t *x2y2 = NULL;
284e71b7053SJung-uk Kim uint8_t *computed_C3 = NULL;
285e71b7053SJung-uk Kim const size_t field_size = ec_field_size(group);
286b077aed3SPierre Pronchery const int hash_size = EVP_MD_get_size(digest);
287e71b7053SJung-uk Kim uint8_t *msg_mask = NULL;
288e71b7053SJung-uk Kim const uint8_t *C2 = NULL;
289e71b7053SJung-uk Kim const uint8_t *C3 = NULL;
290e71b7053SJung-uk Kim int msg_len = 0;
291e71b7053SJung-uk Kim EVP_MD_CTX *hash = NULL;
292b077aed3SPierre Pronchery OSSL_LIB_CTX *libctx = ossl_ec_key_get_libctx(key);
293b077aed3SPierre Pronchery const char *propq = ossl_ec_key_get0_propq(key);
294e71b7053SJung-uk Kim
295e71b7053SJung-uk Kim if (field_size == 0 || hash_size <= 0)
296e71b7053SJung-uk Kim goto done;
297e71b7053SJung-uk Kim
298e71b7053SJung-uk Kim memset(ptext_buf, 0xFF, *ptext_len);
299e71b7053SJung-uk Kim
300e71b7053SJung-uk Kim sm2_ctext = d2i_SM2_Ciphertext(NULL, &ciphertext, ciphertext_len);
301e71b7053SJung-uk Kim
302e71b7053SJung-uk Kim if (sm2_ctext == NULL) {
303b077aed3SPierre Pronchery ERR_raise(ERR_LIB_SM2, SM2_R_ASN1_ERROR);
304e71b7053SJung-uk Kim goto done;
305e71b7053SJung-uk Kim }
306e71b7053SJung-uk Kim
307e71b7053SJung-uk Kim if (sm2_ctext->C3->length != hash_size) {
308b077aed3SPierre Pronchery ERR_raise(ERR_LIB_SM2, SM2_R_INVALID_ENCODING);
309e71b7053SJung-uk Kim goto done;
310e71b7053SJung-uk Kim }
311e71b7053SJung-uk Kim
312e71b7053SJung-uk Kim C2 = sm2_ctext->C2->data;
313e71b7053SJung-uk Kim C3 = sm2_ctext->C3->data;
314e71b7053SJung-uk Kim msg_len = sm2_ctext->C2->length;
315aef815e7SGordon Tetlow if (*ptext_len < (size_t)msg_len) {
316b077aed3SPierre Pronchery ERR_raise(ERR_LIB_SM2, SM2_R_BUFFER_TOO_SMALL);
317aef815e7SGordon Tetlow goto done;
318aef815e7SGordon Tetlow }
319e71b7053SJung-uk Kim
320b077aed3SPierre Pronchery ctx = BN_CTX_new_ex(libctx);
321e71b7053SJung-uk Kim if (ctx == NULL) {
322b077aed3SPierre Pronchery ERR_raise(ERR_LIB_SM2, ERR_R_MALLOC_FAILURE);
323e71b7053SJung-uk Kim goto done;
324e71b7053SJung-uk Kim }
325e71b7053SJung-uk Kim
326e71b7053SJung-uk Kim BN_CTX_start(ctx);
327e71b7053SJung-uk Kim x2 = BN_CTX_get(ctx);
328e71b7053SJung-uk Kim y2 = BN_CTX_get(ctx);
329e71b7053SJung-uk Kim
330e71b7053SJung-uk Kim if (y2 == NULL) {
331b077aed3SPierre Pronchery ERR_raise(ERR_LIB_SM2, ERR_R_BN_LIB);
332e71b7053SJung-uk Kim goto done;
333e71b7053SJung-uk Kim }
334e71b7053SJung-uk Kim
335e71b7053SJung-uk Kim msg_mask = OPENSSL_zalloc(msg_len);
336e71b7053SJung-uk Kim x2y2 = OPENSSL_zalloc(2 * field_size);
337e71b7053SJung-uk Kim computed_C3 = OPENSSL_zalloc(hash_size);
338e71b7053SJung-uk Kim
339e71b7053SJung-uk Kim if (msg_mask == NULL || x2y2 == NULL || computed_C3 == NULL) {
340b077aed3SPierre Pronchery ERR_raise(ERR_LIB_SM2, ERR_R_MALLOC_FAILURE);
341e71b7053SJung-uk Kim goto done;
342e71b7053SJung-uk Kim }
343e71b7053SJung-uk Kim
344e71b7053SJung-uk Kim C1 = EC_POINT_new(group);
345e71b7053SJung-uk Kim if (C1 == NULL) {
346b077aed3SPierre Pronchery ERR_raise(ERR_LIB_SM2, ERR_R_MALLOC_FAILURE);
347e71b7053SJung-uk Kim goto done;
348e71b7053SJung-uk Kim }
349e71b7053SJung-uk Kim
350e71b7053SJung-uk Kim if (!EC_POINT_set_affine_coordinates(group, C1, sm2_ctext->C1x,
351e71b7053SJung-uk Kim sm2_ctext->C1y, ctx)
352e71b7053SJung-uk Kim || !EC_POINT_mul(group, C1, NULL, C1, EC_KEY_get0_private_key(key),
353e71b7053SJung-uk Kim ctx)
354e71b7053SJung-uk Kim || !EC_POINT_get_affine_coordinates(group, C1, x2, y2, ctx)) {
355b077aed3SPierre Pronchery ERR_raise(ERR_LIB_SM2, ERR_R_EC_LIB);
356e71b7053SJung-uk Kim goto done;
357e71b7053SJung-uk Kim }
358e71b7053SJung-uk Kim
359e71b7053SJung-uk Kim if (BN_bn2binpad(x2, x2y2, field_size) < 0
360e71b7053SJung-uk Kim || BN_bn2binpad(y2, x2y2 + field_size, field_size) < 0
361b077aed3SPierre Pronchery || !ossl_ecdh_kdf_X9_63(msg_mask, msg_len, x2y2, 2 * field_size,
362b077aed3SPierre Pronchery NULL, 0, digest, libctx, propq)) {
363b077aed3SPierre Pronchery ERR_raise(ERR_LIB_SM2, ERR_R_INTERNAL_ERROR);
364e71b7053SJung-uk Kim goto done;
365e71b7053SJung-uk Kim }
366e71b7053SJung-uk Kim
367e71b7053SJung-uk Kim for (i = 0; i != msg_len; ++i)
368e71b7053SJung-uk Kim ptext_buf[i] = C2[i] ^ msg_mask[i];
369e71b7053SJung-uk Kim
370e71b7053SJung-uk Kim hash = EVP_MD_CTX_new();
371e71b7053SJung-uk Kim if (hash == NULL) {
372b077aed3SPierre Pronchery ERR_raise(ERR_LIB_SM2, ERR_R_MALLOC_FAILURE);
373e71b7053SJung-uk Kim goto done;
374e71b7053SJung-uk Kim }
375e71b7053SJung-uk Kim
376e71b7053SJung-uk Kim if (!EVP_DigestInit(hash, digest)
377e71b7053SJung-uk Kim || !EVP_DigestUpdate(hash, x2y2, field_size)
378e71b7053SJung-uk Kim || !EVP_DigestUpdate(hash, ptext_buf, msg_len)
379e71b7053SJung-uk Kim || !EVP_DigestUpdate(hash, x2y2 + field_size, field_size)
380e71b7053SJung-uk Kim || !EVP_DigestFinal(hash, computed_C3, NULL)) {
381b077aed3SPierre Pronchery ERR_raise(ERR_LIB_SM2, ERR_R_EVP_LIB);
382e71b7053SJung-uk Kim goto done;
383e71b7053SJung-uk Kim }
384e71b7053SJung-uk Kim
385e71b7053SJung-uk Kim if (CRYPTO_memcmp(computed_C3, C3, hash_size) != 0) {
386b077aed3SPierre Pronchery ERR_raise(ERR_LIB_SM2, SM2_R_INVALID_DIGEST);
387e71b7053SJung-uk Kim goto done;
388e71b7053SJung-uk Kim }
389e71b7053SJung-uk Kim
390e71b7053SJung-uk Kim rc = 1;
391e71b7053SJung-uk Kim *ptext_len = msg_len;
392e71b7053SJung-uk Kim
393e71b7053SJung-uk Kim done:
394e71b7053SJung-uk Kim if (rc == 0)
395e71b7053SJung-uk Kim memset(ptext_buf, 0, *ptext_len);
396e71b7053SJung-uk Kim
397e71b7053SJung-uk Kim OPENSSL_free(msg_mask);
398e71b7053SJung-uk Kim OPENSSL_free(x2y2);
399e71b7053SJung-uk Kim OPENSSL_free(computed_C3);
400e71b7053SJung-uk Kim EC_POINT_free(C1);
401e71b7053SJung-uk Kim BN_CTX_free(ctx);
402e71b7053SJung-uk Kim SM2_Ciphertext_free(sm2_ctext);
403e71b7053SJung-uk Kim EVP_MD_CTX_free(hash);
404e71b7053SJung-uk Kim
405e71b7053SJung-uk Kim return rc;
406e71b7053SJung-uk Kim }
407