mirror of
https://github.com/trezor/trezor-firmware.git
synced 2024-11-21 23:18:13 +00:00
refactor code -> bignum.c/h
This commit is contained in:
parent
603acbd1be
commit
07d1c22730
4
Makefile
4
Makefile
@ -1,6 +1,6 @@
|
||||
CC = gcc
|
||||
CFLAGS = -Wall -Os
|
||||
OBJS = aux.o ecdsa.o secp256k1.o sha2.o rand.o hmac.o
|
||||
OBJS = bignum.o ecdsa.o secp256k1.o sha2.o rand.o hmac.o
|
||||
|
||||
all: test-rfc6979 test-speed test-verify
|
||||
|
||||
@ -17,4 +17,4 @@ test-verify: test-verify.o $(OBJS)
|
||||
gcc test-verify.o $(OBJS) -o test-verify -lcrypto
|
||||
|
||||
clean:
|
||||
rm -f $(OBJS) test-speed test-verify
|
||||
rm -f $(OBJS) test-rfc6979 test-speed test-verify
|
||||
|
45
aux.c
45
aux.c
@ -1,45 +0,0 @@
|
||||
/**
|
||||
* Copyright (c) 2013 Tomas Dzetkulic
|
||||
* Copyright (c) 2013 Pavol Rusnak
|
||||
*
|
||||
* Permission is hereby granted, free of charge, to any person obtaining
|
||||
* a copy of this software and associated documentation files (the "Software"),
|
||||
* to deal in the Software without restriction, including without limitation
|
||||
* the rights to use, copy, modify, merge, publish, distribute, sublicense,
|
||||
* and/or sell copies of the Software, and to permit persons to whom the
|
||||
* Software is furnished to do so, subject to the following conditions:
|
||||
*
|
||||
* The above copyright notice and this permission notice shall be included
|
||||
* in all copies or substantial portions of the Software.
|
||||
*
|
||||
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
|
||||
* OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
|
||||
* THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES
|
||||
* OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
|
||||
* ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
|
||||
* OTHER DEALINGS IN THE SOFTWARE.
|
||||
*/
|
||||
|
||||
#include "aux.h"
|
||||
|
||||
inline uint32_t ror(const uint32_t x, const int n)
|
||||
{
|
||||
return (x >> n) | (x << (32 - n));
|
||||
}
|
||||
|
||||
inline uint32_t read_be(const uint8_t *data)
|
||||
{
|
||||
return (((uint32_t)data[0]) << 24) |
|
||||
(((uint32_t)data[1]) << 16) |
|
||||
(((uint32_t)data[2]) << 8) |
|
||||
(((uint32_t)data[3]));
|
||||
}
|
||||
|
||||
inline void write_be(uint8_t *data, uint32_t x)
|
||||
{
|
||||
data[0] = x >> 24;
|
||||
data[1] = x >> 16;
|
||||
data[2] = x >> 8;
|
||||
data[3] = x;
|
||||
}
|
396
bignum.c
Normal file
396
bignum.c
Normal file
@ -0,0 +1,396 @@
|
||||
/**
|
||||
* Copyright (c) 2013 Tomas Dzetkulic
|
||||
* Copyright (c) 2013 Pavol Rusnak
|
||||
*
|
||||
* Permission is hereby granted, free of charge, to any person obtaining
|
||||
* a copy of this software and associated documentation files (the "Software"),
|
||||
* to deal in the Software without restriction, including without limitation
|
||||
* the rights to use, copy, modify, merge, publish, distribute, sublicense,
|
||||
* and/or sell copies of the Software, and to permit persons to whom the
|
||||
* Software is furnished to do so, subject to the following conditions:
|
||||
*
|
||||
* The above copyright notice and this permission notice shall be included
|
||||
* in all copies or substantial portions of the Software.
|
||||
*
|
||||
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
|
||||
* OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
|
||||
* THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES
|
||||
* OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
|
||||
* ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
|
||||
* OTHER DEALINGS IN THE SOFTWARE.
|
||||
*/
|
||||
|
||||
#include "bignum.h"
|
||||
#include "secp256k1.h"
|
||||
|
||||
inline uint32_t read_be(const uint8_t *data)
|
||||
{
|
||||
return (((uint32_t)data[0]) << 24) |
|
||||
(((uint32_t)data[1]) << 16) |
|
||||
(((uint32_t)data[2]) << 8) |
|
||||
(((uint32_t)data[3]));
|
||||
}
|
||||
|
||||
inline void write_be(uint8_t *data, uint32_t x)
|
||||
{
|
||||
data[0] = x >> 24;
|
||||
data[1] = x >> 16;
|
||||
data[2] = x >> 8;
|
||||
data[3] = x;
|
||||
}
|
||||
|
||||
void bn_read_be(const uint8_t *in_number, bignum256 *out_number)
|
||||
{
|
||||
int i;
|
||||
uint64_t temp = 0;
|
||||
for (i = 0; i < 8; i++) {
|
||||
temp += (((uint64_t)read_be(in_number + (7 - i) * 4)) << (2 * i));
|
||||
out_number->val[i]= temp & 0x3FFFFFFF;
|
||||
temp >>= 30;
|
||||
}
|
||||
out_number->val[8] = temp;
|
||||
}
|
||||
|
||||
void bn_write_be(const bignum256 *in_number, uint8_t *out_number)
|
||||
{
|
||||
int i, shift = 30 + 16 - 32;
|
||||
uint64_t temp = in_number->val[8];
|
||||
for (i = 0; i < 8; i++) {
|
||||
temp <<= 30;
|
||||
temp |= in_number->val[7 - i];
|
||||
write_be(out_number + i * 4, temp >> shift);
|
||||
shift -= 2;
|
||||
}
|
||||
}
|
||||
|
||||
int bn_is_zero(const bignum256 *a)
|
||||
{
|
||||
int i;
|
||||
for (i = 0; i < 9; i++) {
|
||||
if (a->val[i] != 0) return 0;
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
int bn_is_less(const bignum256 *a, const bignum256 *b)
|
||||
{
|
||||
int i;
|
||||
for (i = 8; i >= 0; i--) {
|
||||
if (a->val[i] < b->val[i]) return 1;
|
||||
if (a->val[i] > b->val[i]) return 0;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
// assumes x < 2*prime
|
||||
void bn_mod(bignum256 *x, bignum256 const *prime)
|
||||
{
|
||||
int i = 8;
|
||||
uint32_t temp;
|
||||
// compare numbers
|
||||
while (i >= 0 && prime->val[i] == x->val[i]) i--;
|
||||
// if equal
|
||||
if (i == -1) {
|
||||
// set x to zero
|
||||
for (i = 0; i < 9; i++) {
|
||||
x->val[i] = 0;
|
||||
}
|
||||
} else {
|
||||
// if x is greater
|
||||
if (x->val[i] > prime->val[i]) {
|
||||
// substract p from x
|
||||
temp = 0x40000000u;
|
||||
for (i = 0; i < 9; i++) {
|
||||
temp += x->val[i] - prime->val[i];
|
||||
x->val[i] = temp & 0x3FFFFFFF;
|
||||
temp >>= 30;
|
||||
temp += 0x3FFFFFFFu;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// x = k * x
|
||||
// both inputs and result may be bigger than prime but not bigger than 2 * prime
|
||||
void bn_multiply(const bignum256 *k, bignum256 *x, bignum256 const *prime)
|
||||
{
|
||||
int i, j;
|
||||
uint64_t temp = 0;
|
||||
uint32_t res[18], coef;
|
||||
|
||||
// compute lower half of long multiplication
|
||||
for (i = 0; i < 9; i++)
|
||||
{
|
||||
for (j = 0; j <= i; j++) {
|
||||
temp += k->val[j] * (uint64_t)x->val[i - j];
|
||||
}
|
||||
res[i] = temp & 0x3FFFFFFFu;
|
||||
temp >>= 30;
|
||||
}
|
||||
// compute upper half
|
||||
for (; i < 17; i++)
|
||||
{
|
||||
for (j = i - 8; j < 9 ; j++) {
|
||||
temp += k->val[j] * (uint64_t)x->val[i - j];
|
||||
}
|
||||
res[i] = temp & 0x3FFFFFFFu;
|
||||
temp >>= 30;
|
||||
}
|
||||
res[17] = temp;
|
||||
// compute modulo p division is only estimated so this may give result greater than prime but not bigger than 2 * prime
|
||||
for (i = 16; i >= 8; i--) {
|
||||
// estimate (res / prime)
|
||||
coef = (res[i] >> 16) + (res[i + 1] << 14);
|
||||
// substract (coef * prime) from res
|
||||
temp = 0x1000000000000000llu + res[i - 8] - prime->val[0] * (uint64_t)coef;
|
||||
res[i - 8] = temp & 0x3FFFFFFF;
|
||||
for (j = 1; j < 9; j++) {
|
||||
temp >>= 30;
|
||||
temp += 0xFFFFFFFC0000000llu + res[i - 8 + j] - prime->val[j] * (uint64_t)coef;
|
||||
res[i - 8 + j] = temp & 0x3FFFFFFF;
|
||||
}
|
||||
}
|
||||
// store the result
|
||||
for (i = 0; i < 9; i++) {
|
||||
x->val[i] = res[i];
|
||||
}
|
||||
}
|
||||
|
||||
void bn_fast_mod(bignum256 *x, bignum256 const *prime)
|
||||
{
|
||||
int j;
|
||||
uint32_t coef;
|
||||
uint64_t temp;
|
||||
|
||||
coef = x->val[8] >> 16;
|
||||
if (!coef) return;
|
||||
// substract (coef * prime) from x
|
||||
temp = 0x1000000000000000llu + x->val[0] - prime->val[0] * (uint64_t)coef;
|
||||
x->val[0] = temp & 0x3FFFFFFF;
|
||||
for (j = 1; j < 9; j++) {
|
||||
temp >>= 30;
|
||||
temp += 0xFFFFFFFC0000000llu + x->val[j] - prime->val[j] * (uint64_t)coef;
|
||||
x->val[j] = temp & 0x3FFFFFFF;
|
||||
}
|
||||
}
|
||||
|
||||
#ifndef INVERSE_FAST
|
||||
|
||||
#ifdef USE_PRECOMPUTED_IV
|
||||
#warning USE_PRECOMPUTED_IV will not be used, please undef
|
||||
#endif
|
||||
|
||||
// in field G_prime, small but slow
|
||||
void bn_inverse(bignum256 *x, bignum256 const *prime)
|
||||
{
|
||||
uint32_t i, j, limb;
|
||||
bignum256 res;
|
||||
res.val[0] = 1;
|
||||
for (i = 1; i < 9; i++) {
|
||||
res.val[i] = 0;
|
||||
}
|
||||
for (i = 0; i < 9; i++) {
|
||||
limb = prime->val[i];
|
||||
// this is not enough in general but fine for secp256k1 because prime->val[0] > 1
|
||||
if (i == 0) limb -= 2;
|
||||
for (j = 0; j < 30; j++) {
|
||||
if (i == 8 && limb == 0) break;
|
||||
if (limb & 1) {
|
||||
multiply(x, &res, prime);
|
||||
}
|
||||
limb >>= 1;
|
||||
multiply(x, x, prime);
|
||||
}
|
||||
}
|
||||
bn_mod(&res, prime);
|
||||
memcpy(x, &res, sizeof(bignum256));
|
||||
}
|
||||
|
||||
#else
|
||||
|
||||
// in field G_prime, big but fast
|
||||
void bn_inverse(bignum256 *x, bignum256 const *prime)
|
||||
{
|
||||
int i, j, k, len1, len2, mask;
|
||||
uint32_t u[9], v[9], s[10], r[10], temp, temp2;
|
||||
bn_fast_mod(x, prime);
|
||||
bn_mod(x, prime);
|
||||
for (i = 0; i < 9; i++) {
|
||||
u[i] = prime->val[i];
|
||||
v[i] = x->val[i];
|
||||
}
|
||||
len1 = 9;
|
||||
s[0] = 1;
|
||||
r[0] = 0;
|
||||
len2 = 1;
|
||||
k = 0;
|
||||
for (;;) {
|
||||
for (i = 0; i < len1; i++) {
|
||||
if (v[i]) break;
|
||||
}
|
||||
if (i == len1) break;
|
||||
for (;;) {
|
||||
for (i = 0; i < 30; i++) {
|
||||
if (u[0] & (1 << i)) break;
|
||||
}
|
||||
if (i == 0) break;
|
||||
mask = (1 << i) - 1;
|
||||
for (j = 0; j + 1 < len1; j++) {
|
||||
u[j] = (u[j] >> i) | ((u[j + 1] & mask) << (30 - i));
|
||||
}
|
||||
u[j] = (u[j] >> i);
|
||||
mask = (1 << (30 - i)) - 1;
|
||||
s[len2] = s[len2 - 1] >> (30 - i);
|
||||
for (j = len2 - 1; j > 0; j--) {
|
||||
s[j] = (s[j - 1] >> (30 - i)) | ((s[j] & mask) << i);
|
||||
}
|
||||
s[0] = (s[0] & mask) << i;
|
||||
if (s[len2]) {
|
||||
r[len2] = 0;
|
||||
len2++;
|
||||
}
|
||||
k += i;
|
||||
}
|
||||
for (;;) {
|
||||
for (i = 0; i < 30; i++) {
|
||||
if (v[0] & (1 << i)) break;
|
||||
}
|
||||
if (i == 0) break;
|
||||
mask = (1 << i) - 1;
|
||||
for (j = 0; j + 1 < len1; j++) {
|
||||
v[j] = (v[j] >> i) | ((v[j + 1] & mask) << (30 - i));
|
||||
}
|
||||
v[j] = (v[j] >> i);
|
||||
mask = (1 << (30 - i)) - 1;
|
||||
r[len2] = r[len2 - 1] >> (30 - i);
|
||||
for (j = len2 - 1; j > 0; j--) {
|
||||
r[j] = (r[j - 1] >> (30 - i)) | ((r[j] & mask) << i);
|
||||
}
|
||||
r[0] = (r[0] & mask) << i;
|
||||
if (r[len2]) {
|
||||
s[len2] = 0;
|
||||
len2++;
|
||||
}
|
||||
k += i;
|
||||
}
|
||||
|
||||
i = len1 - 1;
|
||||
while (i > 0 && u[i] == v[i]) i--;
|
||||
if (u[i] > v[i]) {
|
||||
temp = 0x40000000u + u[0] - v[0];
|
||||
u[0] = (temp >> 1) & 0x1FFFFFFF;
|
||||
temp >>= 30;
|
||||
for (i = 1; i < len1; i++) {
|
||||
temp += 0x3FFFFFFFu + u[i] - v[i];
|
||||
u[i - 1] += (temp & 1) << 29;
|
||||
u[i] = (temp >> 1) & 0x1FFFFFFF;
|
||||
temp >>= 30;
|
||||
}
|
||||
temp = temp2 = 0;
|
||||
for (i = 0; i < len2; i++) {
|
||||
temp += s[i] + r[i];
|
||||
temp2 += s[i] << 1;
|
||||
r[i] = temp & 0x3FFFFFFF;
|
||||
s[i] = temp2 & 0x3FFFFFFF;
|
||||
temp >>= 30;
|
||||
temp2 >>= 30;
|
||||
}
|
||||
if (temp != 0 || temp2 != 0) {
|
||||
r[len2] = temp;
|
||||
s[len2] = temp2;
|
||||
len2++;
|
||||
}
|
||||
} else {
|
||||
temp = 0x40000000u + v[0] - u[0];
|
||||
v[0] = (temp >> 1) & 0x1FFFFFFF;
|
||||
temp >>= 30;
|
||||
for (i = 1; i < len1; i++) {
|
||||
temp += 0x3FFFFFFFu + v[i] - u[i];
|
||||
v[i - 1] += (temp & 1) << 29;
|
||||
v[i] = (temp >> 1) & 0x1FFFFFFF;
|
||||
temp >>= 30;
|
||||
}
|
||||
temp = temp2 = 0;
|
||||
for (i = 0; i < len2; i++) {
|
||||
temp += s[i] + r[i];
|
||||
temp2 += r[i] << 1;
|
||||
s[i] = temp & 0x3FFFFFFF;
|
||||
r[i] = temp2 & 0x3FFFFFFF;
|
||||
temp >>= 30;
|
||||
temp2 >>= 30;
|
||||
}
|
||||
if (temp != 0 || temp2 != 0) {
|
||||
s[len2] = temp;
|
||||
r[len2] = temp2;
|
||||
len2++;
|
||||
}
|
||||
}
|
||||
if (u[len1 - 1] == 0 && v[len1 - 1] == 0) len1--;
|
||||
k++;
|
||||
}
|
||||
i = 8;
|
||||
while (i > 0 && r[i] == prime->val[i]) i--;
|
||||
if (r[i] >= prime->val[i]) {
|
||||
temp = 1;
|
||||
for (i = 0; i < 9; i++) {
|
||||
temp += 0x3FFFFFFF + r[i] - prime->val[i];
|
||||
r[i] = temp & 0x3FFFFFFF;
|
||||
temp >>= 30;
|
||||
}
|
||||
}
|
||||
temp = 1;
|
||||
for (i = 0; i < 9; i++) {
|
||||
temp += 0x3FFFFFFF + prime->val[i] - r[i];
|
||||
r[i] = temp & 0x3FFFFFFF;
|
||||
temp >>= 30;
|
||||
}
|
||||
int done = 0;
|
||||
#ifdef USE_PRECOMPUTED_IV
|
||||
if (prime == &prime256k1) {
|
||||
for (j = 0; j < 9; j++) {
|
||||
x->val[j] = r[j];
|
||||
}
|
||||
bn_multiply(secp256k1_iv + k - 256, x, prime);
|
||||
bn_fast_mod(x, prime);
|
||||
done = 1;
|
||||
}
|
||||
#endif
|
||||
if (!done) {
|
||||
for (j = 0; j < k; j++) {
|
||||
if (r[0] & 1) {
|
||||
temp = r[0] + prime->val[0];
|
||||
r[0] = (temp >> 1) & 0x1FFFFFFF;
|
||||
temp >>= 30;
|
||||
for (i = 1; i < 9; i++) {
|
||||
temp += r[i] + prime->val[i];
|
||||
r[i - 1] += (temp & 1) << 29;
|
||||
r[i] = (temp >> 1) & 0x1FFFFFFF;
|
||||
temp >>= 30;
|
||||
}
|
||||
} else {
|
||||
for (i = 0; i < 8; i++) {
|
||||
r[i] = (r[i] >> 1) | ((r[i + 1] & 1) << 29);
|
||||
}
|
||||
r[8] = r[8] >> 1;
|
||||
}
|
||||
}
|
||||
for (j = 0; j < 9; j++) {
|
||||
x->val[j] = r[j];
|
||||
}
|
||||
}
|
||||
}
|
||||
#endif
|
||||
|
||||
// res = a - b
|
||||
// b < 2*prime; result not normalized
|
||||
void bn_substract(const bignum256 *a, const bignum256 *b, bignum256 *res)
|
||||
{
|
||||
int i;
|
||||
uint32_t temp = 0;
|
||||
for (i = 0; i < 9; i++) {
|
||||
temp += a->val[i] + 2u *prime256k1.val[i] - b->val[i];
|
||||
res->val[i] = temp & 0x3FFFFFFF;
|
||||
temp >>= 30;
|
||||
}
|
||||
}
|
@ -21,13 +21,24 @@
|
||||
* OTHER DEALINGS IN THE SOFTWARE.
|
||||
*/
|
||||
|
||||
#ifndef __AUX_H__
|
||||
#define __AUX_H__
|
||||
#ifndef __BIGNUM_H__
|
||||
#define __BIGNUM_H__
|
||||
|
||||
#include <stdint.h>
|
||||
|
||||
// rotate uint32 right
|
||||
uint32_t ror(const uint32_t x, const int n);
|
||||
// use precomputed Inverse Values of powers of two
|
||||
#define USE_PRECOMPUTED_IV 1
|
||||
|
||||
// use precomputed Curve Points (some scalar multiples of curve base point G)
|
||||
#define USE_PRECOMPUTED_CP 1
|
||||
|
||||
#define INVERSE_FAST 1
|
||||
|
||||
// bignum256 are 256 bits stored as 8*30 bit + 1*16 bit
|
||||
// val[0] are lowest 30 bits, val[8] highest 16 bits
|
||||
typedef struct {
|
||||
uint32_t val[9];
|
||||
} bignum256;
|
||||
|
||||
// read 4 big endian bytes into uint32
|
||||
uint32_t read_be(const uint8_t *data);
|
||||
@ -35,4 +46,22 @@ uint32_t read_be(const uint8_t *data);
|
||||
// write 4 big endian bytes
|
||||
void write_be(uint8_t *data, uint32_t x);
|
||||
|
||||
void bn_read_be(const uint8_t *in_number, bignum256 *out_number);
|
||||
|
||||
void bn_write_be(const bignum256 *in_number, uint8_t *out_number);
|
||||
|
||||
int bn_is_zero(const bignum256 *a);
|
||||
|
||||
int bn_is_less(const bignum256 *a, const bignum256 *b);
|
||||
|
||||
void bn_mod(bignum256 *x, bignum256 const *prime);
|
||||
|
||||
void bn_multiply(const bignum256 *k, bignum256 *x, bignum256 const *prime);
|
||||
|
||||
void bn_fast_mod(bignum256 *x, bignum256 const *prime);
|
||||
|
||||
void bn_inverse(bignum256 *x, bignum256 const *prime);
|
||||
|
||||
void bn_substract(const bignum256 *a, const bignum256 *b, bignum256 *res);
|
||||
|
||||
#endif
|
526
ecdsa.c
526
ecdsa.c
@ -25,324 +25,11 @@
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
|
||||
#include "bignum.h"
|
||||
#include "rand.h"
|
||||
#include "sha2.h"
|
||||
#include "hmac.h"
|
||||
#include "ecdsa.h"
|
||||
#include "aux.h"
|
||||
|
||||
#define INVERSE_FAST 1
|
||||
|
||||
// assumes x < 2*prime
|
||||
void mod(bignum256 *x, bignum256 const *prime)
|
||||
{
|
||||
int i = 8;
|
||||
uint32_t temp;
|
||||
// compare numbers
|
||||
while (i >= 0 && prime->val[i] == x->val[i]) i--;
|
||||
// if equal
|
||||
if (i == -1) {
|
||||
// set x to zero
|
||||
for (i = 0; i < 9; i++) {
|
||||
x->val[i] = 0;
|
||||
}
|
||||
} else {
|
||||
// if x is greater
|
||||
if (x->val[i] > prime->val[i]) {
|
||||
// substract p from x
|
||||
temp = 0x40000000u;
|
||||
for (i = 0; i < 9; i++) {
|
||||
temp += x->val[i] - prime->val[i];
|
||||
x->val[i] = temp & 0x3FFFFFFF;
|
||||
temp >>= 30;
|
||||
temp += 0x3FFFFFFFu;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// x = k * x
|
||||
// both inputs and result may be bigger than prime but not bigger than 2 * prime
|
||||
void multiply(const bignum256 *k, bignum256 *x, bignum256 const *prime)
|
||||
{
|
||||
int i, j;
|
||||
uint64_t temp = 0;
|
||||
uint32_t res[18], coef;
|
||||
|
||||
// compute lower half of long multiplication
|
||||
for (i = 0; i < 9; i++)
|
||||
{
|
||||
for (j = 0; j <= i; j++) {
|
||||
temp += k->val[j] * (uint64_t)x->val[i - j];
|
||||
}
|
||||
res[i] = temp & 0x3FFFFFFFu;
|
||||
temp >>= 30;
|
||||
}
|
||||
// compute upper half
|
||||
for (; i < 17; i++)
|
||||
{
|
||||
for (j = i - 8; j < 9 ; j++) {
|
||||
temp += k->val[j] * (uint64_t)x->val[i - j];
|
||||
}
|
||||
res[i] = temp & 0x3FFFFFFFu;
|
||||
temp >>= 30;
|
||||
}
|
||||
res[17] = temp;
|
||||
// compute modulo p division is only estimated so this may give result greater than prime but not bigger than 2 * prime
|
||||
for (i = 16; i >= 8; i--) {
|
||||
// estimate (res / prime)
|
||||
coef = (res[i] >> 16) + (res[i + 1] << 14);
|
||||
// substract (coef * prime) from res
|
||||
temp = 0x1000000000000000llu + res[i - 8] - prime->val[0] * (uint64_t)coef;
|
||||
res[i - 8] = temp & 0x3FFFFFFF;
|
||||
for (j = 1; j < 9; j++) {
|
||||
temp >>= 30;
|
||||
temp += 0xFFFFFFFC0000000llu + res[i - 8 + j] - prime->val[j] * (uint64_t)coef;
|
||||
res[i - 8 + j] = temp & 0x3FFFFFFF;
|
||||
}
|
||||
}
|
||||
// store the result
|
||||
for (i = 0; i < 9; i++) {
|
||||
x->val[i] = res[i];
|
||||
}
|
||||
}
|
||||
|
||||
void fast_mod(bignum256 *x, bignum256 const *prime)
|
||||
{
|
||||
int j;
|
||||
uint32_t coef;
|
||||
uint64_t temp;
|
||||
|
||||
coef = x->val[8] >> 16;
|
||||
if (!coef) return;
|
||||
// substract (coef * prime) from x
|
||||
temp = 0x1000000000000000llu + x->val[0] - prime->val[0] * (uint64_t)coef;
|
||||
x->val[0] = temp & 0x3FFFFFFF;
|
||||
for (j = 1; j < 9; j++) {
|
||||
temp >>= 30;
|
||||
temp += 0xFFFFFFFC0000000llu + x->val[j] - prime->val[j] * (uint64_t)coef;
|
||||
x->val[j] = temp & 0x3FFFFFFF;
|
||||
}
|
||||
}
|
||||
|
||||
#ifndef INVERSE_FAST
|
||||
|
||||
#ifdef USE_PRECOMPUTED_IV
|
||||
#warning USE_PRECOMPUTED_IV will not be used, please undef
|
||||
#endif
|
||||
// in field G_prime, small but slow
|
||||
void inverse(bignum256 *x, bignum256 const *prime)
|
||||
{
|
||||
uint32_t i, j, limb;
|
||||
bignum256 res;
|
||||
res.val[0] = 1;
|
||||
for (i = 1; i < 9; i++) {
|
||||
res.val[i] = 0;
|
||||
}
|
||||
for (i = 0; i < 9; i++) {
|
||||
limb = prime->val[i];
|
||||
// this is not enough in general but fine for secp256k1 because prime->val[0] > 1
|
||||
if (i == 0) limb -= 2;
|
||||
for (j = 0; j < 30; j++) {
|
||||
if (i == 8 && limb == 0) break;
|
||||
if (limb & 1) {
|
||||
multiply(x, &res, prime);
|
||||
}
|
||||
limb >>= 1;
|
||||
multiply(x, x, prime);
|
||||
}
|
||||
}
|
||||
mod(&res, prime);
|
||||
memcpy(x, &res, sizeof(bignum256));
|
||||
}
|
||||
|
||||
#else
|
||||
|
||||
// in field G_prime, big but fast
|
||||
void inverse(bignum256 *x, bignum256 const *prime)
|
||||
{
|
||||
int i, j, k, len1, len2, mask;
|
||||
uint32_t u[9], v[9], s[10], r[10], temp, temp2;
|
||||
fast_mod(x, prime);
|
||||
mod(x, prime);
|
||||
for (i = 0; i < 9; i++) {
|
||||
u[i] = prime->val[i];
|
||||
v[i] = x->val[i];
|
||||
}
|
||||
len1 = 9;
|
||||
s[0] = 1;
|
||||
r[0] = 0;
|
||||
len2 = 1;
|
||||
k = 0;
|
||||
for (;;) {
|
||||
for (i = 0; i < len1; i++) {
|
||||
if (v[i]) break;
|
||||
}
|
||||
if (i == len1) break;
|
||||
for (;;) {
|
||||
for (i = 0; i < 30; i++) {
|
||||
if (u[0] & (1 << i)) break;
|
||||
}
|
||||
if (i == 0) break;
|
||||
mask = (1 << i) - 1;
|
||||
for (j = 0; j + 1 < len1; j++) {
|
||||
u[j] = (u[j] >> i) | ((u[j + 1] & mask) << (30 - i));
|
||||
}
|
||||
u[j] = (u[j] >> i);
|
||||
mask = (1 << (30 - i)) - 1;
|
||||
s[len2] = s[len2 - 1] >> (30 - i);
|
||||
for (j = len2 - 1; j > 0; j--) {
|
||||
s[j] = (s[j - 1] >> (30 - i)) | ((s[j] & mask) << i);
|
||||
}
|
||||
s[0] = (s[0] & mask) << i;
|
||||
if (s[len2]) {
|
||||
r[len2] = 0;
|
||||
len2++;
|
||||
}
|
||||
k += i;
|
||||
}
|
||||
for (;;) {
|
||||
for (i = 0; i < 30; i++) {
|
||||
if (v[0] & (1 << i)) break;
|
||||
}
|
||||
if (i == 0) break;
|
||||
mask = (1 << i) - 1;
|
||||
for (j = 0; j + 1 < len1; j++) {
|
||||
v[j] = (v[j] >> i) | ((v[j + 1] & mask) << (30 - i));
|
||||
}
|
||||
v[j] = (v[j] >> i);
|
||||
mask = (1 << (30 - i)) - 1;
|
||||
r[len2] = r[len2 - 1] >> (30 - i);
|
||||
for (j = len2 - 1; j > 0; j--) {
|
||||
r[j] = (r[j - 1] >> (30 - i)) | ((r[j] & mask) << i);
|
||||
}
|
||||
r[0] = (r[0] & mask) << i;
|
||||
if (r[len2]) {
|
||||
s[len2] = 0;
|
||||
len2++;
|
||||
}
|
||||
k += i;
|
||||
}
|
||||
|
||||
i = len1 - 1;
|
||||
while (i > 0 && u[i] == v[i]) i--;
|
||||
if (u[i] > v[i]) {
|
||||
temp = 0x40000000u + u[0] - v[0];
|
||||
u[0] = (temp >> 1) & 0x1FFFFFFF;
|
||||
temp >>= 30;
|
||||
for (i = 1; i < len1; i++) {
|
||||
temp += 0x3FFFFFFFu + u[i] - v[i];
|
||||
u[i - 1] += (temp & 1) << 29;
|
||||
u[i] = (temp >> 1) & 0x1FFFFFFF;
|
||||
temp >>= 30;
|
||||
}
|
||||
temp = temp2 = 0;
|
||||
for (i = 0; i < len2; i++) {
|
||||
temp += s[i] + r[i];
|
||||
temp2 += s[i] << 1;
|
||||
r[i] = temp & 0x3FFFFFFF;
|
||||
s[i] = temp2 & 0x3FFFFFFF;
|
||||
temp >>= 30;
|
||||
temp2 >>= 30;
|
||||
}
|
||||
if (temp != 0 || temp2 != 0) {
|
||||
r[len2] = temp;
|
||||
s[len2] = temp2;
|
||||
len2++;
|
||||
}
|
||||
} else {
|
||||
temp = 0x40000000u + v[0] - u[0];
|
||||
v[0] = (temp >> 1) & 0x1FFFFFFF;
|
||||
temp >>= 30;
|
||||
for (i = 1; i < len1; i++) {
|
||||
temp += 0x3FFFFFFFu + v[i] - u[i];
|
||||
v[i - 1] += (temp & 1) << 29;
|
||||
v[i] = (temp >> 1) & 0x1FFFFFFF;
|
||||
temp >>= 30;
|
||||
}
|
||||
temp = temp2 = 0;
|
||||
for (i = 0; i < len2; i++) {
|
||||
temp += s[i] + r[i];
|
||||
temp2 += r[i] << 1;
|
||||
s[i] = temp & 0x3FFFFFFF;
|
||||
r[i] = temp2 & 0x3FFFFFFF;
|
||||
temp >>= 30;
|
||||
temp2 >>= 30;
|
||||
}
|
||||
if (temp != 0 || temp2 != 0) {
|
||||
s[len2] = temp;
|
||||
r[len2] = temp2;
|
||||
len2++;
|
||||
}
|
||||
}
|
||||
if (u[len1 - 1] == 0 && v[len1 - 1] == 0) len1--;
|
||||
k++;
|
||||
}
|
||||
i = 8;
|
||||
while (i > 0 && r[i] == prime->val[i]) i--;
|
||||
if (r[i] >= prime->val[i]) {
|
||||
temp = 1;
|
||||
for (i = 0; i < 9; i++) {
|
||||
temp += 0x3FFFFFFF + r[i] - prime->val[i];
|
||||
r[i] = temp & 0x3FFFFFFF;
|
||||
temp >>= 30;
|
||||
}
|
||||
}
|
||||
temp = 1;
|
||||
for (i = 0; i < 9; i++) {
|
||||
temp += 0x3FFFFFFF + prime->val[i] - r[i];
|
||||
r[i] = temp & 0x3FFFFFFF;
|
||||
temp >>= 30;
|
||||
}
|
||||
int done = 0;
|
||||
#ifdef USE_PRECOMPUTED_IV
|
||||
if (prime == &prime256k1) {
|
||||
for (j = 0; j < 9; j++) {
|
||||
x->val[j] = r[j];
|
||||
}
|
||||
multiply(secp256k1_iv + k - 256, x, prime);
|
||||
fast_mod(x, prime);
|
||||
done = 1;
|
||||
}
|
||||
#endif
|
||||
if (!done) {
|
||||
for (j = 0; j < k; j++) {
|
||||
if (r[0] & 1) {
|
||||
temp = r[0] + prime->val[0];
|
||||
r[0] = (temp >> 1) & 0x1FFFFFFF;
|
||||
temp >>= 30;
|
||||
for (i = 1; i < 9; i++) {
|
||||
temp += r[i] + prime->val[i];
|
||||
r[i - 1] += (temp & 1) << 29;
|
||||
r[i] = (temp >> 1) & 0x1FFFFFFF;
|
||||
temp >>= 30;
|
||||
}
|
||||
} else {
|
||||
for (i = 0; i < 8; i++) {
|
||||
r[i] = (r[i] >> 1) | ((r[i + 1] & 1) << 29);
|
||||
}
|
||||
r[8] = r[8] >> 1;
|
||||
}
|
||||
}
|
||||
for (j = 0; j < 9; j++) {
|
||||
x->val[j] = r[j];
|
||||
}
|
||||
}
|
||||
}
|
||||
#endif
|
||||
|
||||
// res = a - b
|
||||
// b < 2*prime; result not normalized
|
||||
void fast_substract(const bignum256 *a, const bignum256 *b, bignum256 *res)
|
||||
{
|
||||
int i;
|
||||
uint32_t temp = 0;
|
||||
for (i = 0; i < 9; i++) {
|
||||
temp += a->val[i] + 2u *prime256k1.val[i] - b->val[i];
|
||||
res->val[i] = temp & 0x3FFFFFFF;
|
||||
temp >>= 30;
|
||||
}
|
||||
}
|
||||
|
||||
// cp2 = cp1 + cp2
|
||||
void point_add(const curve_point *cp1, curve_point *cp2)
|
||||
@ -350,25 +37,25 @@ void point_add(const curve_point *cp1, curve_point *cp2)
|
||||
int i;
|
||||
uint32_t temp;
|
||||
bignum256 lambda, inv, xr, yr;
|
||||
fast_substract(&(cp2->x), &(cp1->x), &inv);
|
||||
inverse(&inv, &prime256k1);
|
||||
fast_substract(&(cp2->y), &(cp1->y), &lambda);
|
||||
multiply(&inv, &lambda, &prime256k1);
|
||||
bn_substract(&(cp2->x), &(cp1->x), &inv);
|
||||
bn_inverse(&inv, &prime256k1);
|
||||
bn_substract(&(cp2->y), &(cp1->y), &lambda);
|
||||
bn_multiply(&inv, &lambda, &prime256k1);
|
||||
memcpy(&xr, &lambda, sizeof(bignum256));
|
||||
multiply(&xr, &xr, &prime256k1);
|
||||
bn_multiply(&xr, &xr, &prime256k1);
|
||||
temp = 0;
|
||||
for (i = 0; i < 9; i++) {
|
||||
temp += xr.val[i] + 3u * prime256k1.val[i] - cp1->x.val[i] - cp2->x.val[i];
|
||||
xr.val[i] = temp & 0x3FFFFFFF;
|
||||
temp >>= 30;
|
||||
}
|
||||
fast_mod(&xr, &prime256k1);
|
||||
fast_substract(&(cp1->x), &xr, &yr);
|
||||
bn_fast_mod(&xr, &prime256k1);
|
||||
bn_substract(&(cp1->x), &xr, &yr);
|
||||
// no need to fast_mod here
|
||||
// fast_mod(&yr);
|
||||
multiply(&lambda, &yr, &prime256k1);
|
||||
fast_substract(&yr, &(cp1->y), &yr);
|
||||
fast_mod(&yr, &prime256k1);
|
||||
// bn_fast_mod(&yr);
|
||||
bn_multiply(&lambda, &yr, &prime256k1);
|
||||
bn_substract(&yr, &(cp1->y), &yr);
|
||||
bn_fast_mod(&yr, &prime256k1);
|
||||
memcpy(&(cp2->x), &xr, sizeof(bignum256));
|
||||
memcpy(&(cp2->y), &yr, sizeof(bignum256));
|
||||
}
|
||||
@ -380,26 +67,26 @@ void point_double(curve_point *cp)
|
||||
uint32_t temp;
|
||||
bignum256 lambda, inverse_y, xr, yr;
|
||||
memcpy(&inverse_y, &(cp->y), sizeof(bignum256));
|
||||
inverse(&inverse_y, &prime256k1);
|
||||
bn_inverse(&inverse_y, &prime256k1);
|
||||
memcpy(&lambda, &three_over_two256k1, sizeof(bignum256));
|
||||
multiply(&inverse_y, &lambda, &prime256k1);
|
||||
multiply(&(cp->x), &lambda, &prime256k1);
|
||||
multiply(&(cp->x), &lambda, &prime256k1);
|
||||
bn_multiply(&inverse_y, &lambda, &prime256k1);
|
||||
bn_multiply(&(cp->x), &lambda, &prime256k1);
|
||||
bn_multiply(&(cp->x), &lambda, &prime256k1);
|
||||
memcpy(&xr, &lambda, sizeof(bignum256));
|
||||
multiply(&xr, &xr, &prime256k1);
|
||||
bn_multiply(&xr, &xr, &prime256k1);
|
||||
temp = 0;
|
||||
for (i = 0; i < 9; i++) {
|
||||
temp += xr.val[i] + 3u * prime256k1.val[i] - 2u * cp->x.val[i];
|
||||
xr.val[i] = temp & 0x3FFFFFFF;
|
||||
temp >>= 30;
|
||||
}
|
||||
fast_mod(&xr, &prime256k1);
|
||||
fast_substract(&(cp->x), &xr, &yr);
|
||||
bn_fast_mod(&xr, &prime256k1);
|
||||
bn_substract(&(cp->x), &xr, &yr);
|
||||
// no need to fast_mod here
|
||||
// fast_mod(&yr);
|
||||
multiply(&lambda, &yr, &prime256k1);
|
||||
fast_substract(&yr, &(cp->y), &yr);
|
||||
fast_mod(&yr, &prime256k1);
|
||||
// bn_fast_mod(&yr);
|
||||
bn_multiply(&lambda, &yr, &prime256k1);
|
||||
bn_substract(&yr, &(cp->y), &yr);
|
||||
bn_fast_mod(&yr, &prime256k1);
|
||||
memcpy(&(cp->x), &xr, sizeof(bignum256));
|
||||
memcpy(&(cp->y), &yr, sizeof(bignum256));
|
||||
}
|
||||
@ -443,12 +130,39 @@ void scalar_multiply(bignum256 *k, curve_point *res)
|
||||
#endif
|
||||
}
|
||||
}
|
||||
mod(&(res->x), &prime256k1);
|
||||
mod(&(res->y), &prime256k1);
|
||||
bn_mod(&(res->x), &prime256k1);
|
||||
bn_mod(&(res->y), &prime256k1);
|
||||
}
|
||||
|
||||
// does not validate that this is valid der encoding
|
||||
// assumes it is der encoding containing 1 number
|
||||
void der_read_single(const uint8_t *der, bignum256 *elem)
|
||||
{
|
||||
int i, j;
|
||||
uint8_t val[32];
|
||||
i = 1 + der[1];
|
||||
j = 31;
|
||||
// we ignore all bytes after 32nd. if there are any, those are either zero or invalid for secp256k1
|
||||
while (i > 1 && j >= 0) {
|
||||
val[j] = der[i];
|
||||
i--; j--;
|
||||
}
|
||||
for (i = 0; i <= j; i++) {
|
||||
val[i] = 0;
|
||||
}
|
||||
bn_read_be(val, elem);
|
||||
}
|
||||
|
||||
// does not validate that this is valid der encoding
|
||||
// assumes it is der encoding containing 2 numbers (either public key or ecdsa signature)
|
||||
void der_read_pair(const uint8_t *der, bignum256 *elem1, bignum256 *elem2)
|
||||
{
|
||||
der_read_single(der + 2, elem1);
|
||||
der_read_single(der + 4 + der[3], elem2);
|
||||
}
|
||||
|
||||
// write DER encoding of number to buffer
|
||||
void write_der(const bignum256 *x, uint8_t *buf)
|
||||
void der_write(const bignum256 *x, uint8_t *buf)
|
||||
{
|
||||
int i, j = 8, k = 8, len = 0;
|
||||
uint8_t r = 0, temp;
|
||||
@ -471,49 +185,6 @@ void write_der(const bignum256 *x, uint8_t *buf)
|
||||
buf[1] = len;
|
||||
}
|
||||
|
||||
void read_32byte_big_endian(const uint8_t *in_number, bignum256 *out_number)
|
||||
{
|
||||
int i;
|
||||
uint64_t temp = 0;
|
||||
for (i = 0; i < 8; i++) {
|
||||
temp += (((uint64_t)read_be(in_number + (7 - i) * 4)) << (2 * i));
|
||||
out_number->val[i]= temp & 0x3FFFFFFF;
|
||||
temp >>= 30;
|
||||
}
|
||||
out_number->val[8] = temp;
|
||||
}
|
||||
|
||||
void write_32byte_big_endian(const bignum256 *in_number, uint8_t *out_number)
|
||||
{
|
||||
int i, shift = 30 + 16 - 32;
|
||||
uint64_t temp = in_number->val[8];
|
||||
for (i = 0; i < 8; i++) {
|
||||
temp <<= 30;
|
||||
temp |= in_number->val[7 - i];
|
||||
write_be(out_number + i * 4, temp >> shift);
|
||||
shift -= 2;
|
||||
}
|
||||
}
|
||||
|
||||
int is_zero(const bignum256 *a)
|
||||
{
|
||||
int i;
|
||||
for (i = 0; i < 9; i++) {
|
||||
if (a->val[i] != 0) return 0;
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
int is_less(const bignum256 *a, const bignum256 *b)
|
||||
{
|
||||
int i;
|
||||
for (i = 8; i >= 0; i--) {
|
||||
if (a->val[i] < b->val[i]) return 1;
|
||||
if (a->val[i] > b->val[i]) return 0;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
// generate random K for signing
|
||||
void generate_k_random(bignum256 *k) {
|
||||
int i;
|
||||
@ -537,9 +208,9 @@ void generate_k_rfc6979(bignum256 *secret, const uint8_t *priv_key, const uint8_
|
||||
bignum256 z1;
|
||||
|
||||
memcpy(bx, priv_key, 32);
|
||||
read_32byte_big_endian(hash, &z1);
|
||||
mod(&z1, &order256k1);
|
||||
write_32byte_big_endian(&z1, bx + 32);
|
||||
bn_read_be(hash, &z1);
|
||||
bn_mod(&z1, &order256k1);
|
||||
bn_write_be(&z1, bx + 32);
|
||||
|
||||
memset(v, 1, sizeof(v));
|
||||
memset(k, 0, sizeof(k));
|
||||
@ -558,8 +229,8 @@ void generate_k_rfc6979(bignum256 *secret, const uint8_t *priv_key, const uint8_
|
||||
|
||||
for (;;) {
|
||||
hmac_sha256(k, sizeof(k), v, sizeof(v), t);
|
||||
read_32byte_big_endian(t, secret);
|
||||
if ( !is_zero(secret) && is_less(secret, &order256k1) ) {
|
||||
bn_read_be(t, secret);
|
||||
if ( !bn_is_zero(secret) && bn_is_less(secret, &order256k1) ) {
|
||||
return;
|
||||
}
|
||||
memcpy(buf, v, sizeof(v));
|
||||
@ -587,7 +258,7 @@ void ecdsa_sign(const uint8_t *priv_key, const uint8_t *msg, uint32_t msg_len, u
|
||||
// if double hash is required uncomment the following line:
|
||||
// SHA256_Raw(hash, 32, hash);
|
||||
|
||||
read_32byte_big_endian(hash, &z);
|
||||
bn_read_be(hash, &z);
|
||||
for (;;) {
|
||||
|
||||
// generate random number k
|
||||
@ -599,23 +270,23 @@ void ecdsa_sign(const uint8_t *priv_key, const uint8_t *msg, uint32_t msg_len, u
|
||||
// compute k*G
|
||||
scalar_multiply(&k, &R);
|
||||
// r = (rx mod n)
|
||||
mod(&R.x, &order256k1);
|
||||
bn_mod(&R.x, &order256k1);
|
||||
// if r is zero, we try different k
|
||||
for (i = 0; i < 9; i++) {
|
||||
if (R.x.val[i] != 0) break;
|
||||
}
|
||||
if (i == 9) continue;
|
||||
inverse(&k, &order256k1);
|
||||
read_32byte_big_endian(priv_key, da);
|
||||
multiply(&R.x, da, &order256k1);
|
||||
bn_inverse(&k, &order256k1);
|
||||
bn_read_be(priv_key, da);
|
||||
bn_multiply(&R.x, da, &order256k1);
|
||||
for (i = 0; i < 8; i++) {
|
||||
da->val[i] += z.val[i];
|
||||
da->val[i + 1] += (da->val[i] >> 30);
|
||||
da->val[i] &= 0x3FFFFFFF;
|
||||
}
|
||||
da->val[8] += z.val[8];
|
||||
multiply(da, &k, &order256k1);
|
||||
mod(&k, &order256k1);
|
||||
bn_multiply(da, &k, &order256k1);
|
||||
bn_mod(&k, &order256k1);
|
||||
for (i = 0; i < 9; i++) {
|
||||
if (k.val[i] != 0) break;
|
||||
}
|
||||
@ -623,9 +294,9 @@ void ecdsa_sign(const uint8_t *priv_key, const uint8_t *msg, uint32_t msg_len, u
|
||||
// we are done, R.x and k is the result signature
|
||||
break;
|
||||
}
|
||||
write_der(&R.x, sig + 2);
|
||||
der_write(&R.x, sig + 2);
|
||||
i = sig[3] + 2;
|
||||
write_der(&k, sig + 2 + i);
|
||||
der_write(&k, sig + 2 + i);
|
||||
i += sig[3 + i] + 2;
|
||||
sig[0] = 0x30;
|
||||
sig[1] = i;
|
||||
@ -641,45 +312,18 @@ void ecdsa_get_public_key(const uint8_t *priv_key, uint8_t *pub_key, uint32_t *p
|
||||
curve_point R;
|
||||
bignum256 k;
|
||||
|
||||
read_32byte_big_endian(priv_key, &k);
|
||||
bn_read_be(priv_key, &k);
|
||||
// compute k*G
|
||||
scalar_multiply(&k, &R);
|
||||
write_der(&R.x, pub_key + 2);
|
||||
der_write(&R.x, pub_key + 2);
|
||||
i = pub_key[3] + 2;
|
||||
write_der(&R.y, pub_key + 2 + i);
|
||||
der_write(&R.y, pub_key + 2 + i);
|
||||
i += pub_key[3 + i] + 2;
|
||||
pub_key[0] = 0x30;
|
||||
pub_key[1] = i;
|
||||
*pub_key_len = i + 2;
|
||||
}
|
||||
|
||||
// does not validate that this is valid der encoding
|
||||
// assumes it is der encoding containing 1 number
|
||||
void read_der_single(const uint8_t *der, bignum256 *elem)
|
||||
{
|
||||
int i, j;
|
||||
uint8_t val[32];
|
||||
i = 1 + der[1];
|
||||
j = 31;
|
||||
// we ignore all bytes after 32nd. if there are any, those are either zero or invalid for secp256k1
|
||||
while (i > 1 && j >= 0) {
|
||||
val[j] = der[i];
|
||||
i--; j--;
|
||||
}
|
||||
for (i = 0; i <= j; i++) {
|
||||
val[i] = 0;
|
||||
}
|
||||
read_32byte_big_endian(val, elem);
|
||||
}
|
||||
|
||||
// does not validate that this is valid der encoding
|
||||
// assumes it is der encoding containing 2 numbers (either public key or ecdsa signature)
|
||||
void read_der_pair(const uint8_t *der, bignum256 *elem1, bignum256 *elem2)
|
||||
{
|
||||
read_der_single(der + 2, elem1);
|
||||
read_der_single(der + 4 + der[3], elem2);
|
||||
}
|
||||
|
||||
// uses secp256k1 curve
|
||||
// pub_key and signature are DER encoded
|
||||
// msg is a data that was signed
|
||||
@ -698,21 +342,21 @@ int ecdsa_verify(const uint8_t *pub_key, const uint8_t *signature, const uint8_t
|
||||
// if double hash is required uncomment the following line:
|
||||
// SHA256_Raw(hash, 32, hash);
|
||||
|
||||
read_32byte_big_endian(hash, &z);
|
||||
read_der_pair(pub_key, &pub.x, &pub.y);
|
||||
read_der_pair(signature, &r, &s);
|
||||
bn_read_be(hash, &z);
|
||||
der_read_pair(pub_key, &pub.x, &pub.y);
|
||||
der_read_pair(signature, &r, &s);
|
||||
|
||||
if (is_zero(&r) ||
|
||||
is_zero(&s) ||
|
||||
(!is_less(&r, &order256k1)) ||
|
||||
(!is_less(&s, &order256k1))) return 1;
|
||||
if (bn_is_zero(&r) ||
|
||||
bn_is_zero(&s) ||
|
||||
(!bn_is_less(&r, &order256k1)) ||
|
||||
(!bn_is_less(&s, &order256k1))) return 1;
|
||||
|
||||
inverse(&s, &order256k1); // s^-1
|
||||
multiply(&s, &z, &order256k1); // z*s^-1
|
||||
mod(&z, &order256k1);
|
||||
multiply(&r, &s, &order256k1); // r*s^-1
|
||||
mod(&s, &order256k1);
|
||||
if (is_zero(&z)) {
|
||||
bn_inverse(&s, &order256k1); // s^-1
|
||||
bn_multiply(&s, &z, &order256k1); // z*s^-1
|
||||
bn_mod(&z, &order256k1);
|
||||
bn_multiply(&r, &s, &order256k1); // r*s^-1
|
||||
bn_mod(&s, &order256k1);
|
||||
if (bn_is_zero(&z)) {
|
||||
// our message hashes to zero
|
||||
// I don't expect this to happen any time soon
|
||||
res_is_zero = 1;
|
||||
@ -731,8 +375,8 @@ int ecdsa_verify(const uint8_t *pub_key, const uint8_t *signature, const uint8_t
|
||||
}
|
||||
}
|
||||
|
||||
mod(&(res.x), &prime256k1);
|
||||
mod(&(res.x), &order256k1);
|
||||
bn_mod(&(res.x), &prime256k1);
|
||||
bn_mod(&(res.x), &order256k1);
|
||||
for (i = 0; i < 9; i++) {
|
||||
if (res.x.val[i] != r.val[i]) {
|
||||
return 1;
|
||||
|
2
ecdsa.h
2
ecdsa.h
@ -28,7 +28,7 @@
|
||||
|
||||
#include "secp256k1.h"
|
||||
|
||||
// uses secp256k1 curve
|
||||
// all functions use secp256k1 curve
|
||||
void ecdsa_sign(const uint8_t *priv_key, const uint8_t *msg, uint32_t msg_len, uint8_t *sig, uint32_t *sig_len);
|
||||
void ecdsa_get_public_key(const uint8_t *priv_key, uint8_t *pub_key, uint32_t *pub_key_len);
|
||||
int ecdsa_verify(const uint8_t *pub_key, const uint8_t *signature, const uint8_t *msg, uint32_t msg_len);
|
||||
|
12
secp256k1.h
12
secp256k1.h
@ -26,17 +26,7 @@
|
||||
|
||||
#include <stdint.h>
|
||||
|
||||
// use precomputed Inverse Values of powers of two
|
||||
#define USE_PRECOMPUTED_IV 1
|
||||
|
||||
// use precomputed Curve Points (some scalar multiples of curve base point G)
|
||||
#define USE_PRECOMPUTED_CP 1
|
||||
|
||||
// bignum256 are 256 bits stored as 8*30 bit + 1*16 bit
|
||||
// val[0] are lowest 30 bits, val[8] highest 16 bits
|
||||
typedef struct {
|
||||
uint32_t val[9];
|
||||
} bignum256;
|
||||
#include "bignum.h"
|
||||
|
||||
// curve point x and y
|
||||
typedef struct {
|
||||
|
25
sha2.c
25
sha2.c
@ -82,6 +82,11 @@
|
||||
* made).
|
||||
*/
|
||||
|
||||
#ifndef LITTLE_ENDIAN
|
||||
#define LITTLE_ENDIAN 1234
|
||||
#define BIG_ENDIAN 4321
|
||||
#endif
|
||||
|
||||
#ifndef BYTE_ORDER
|
||||
#define BYTE_ORDER LITTLE_ENDIAN
|
||||
#endif
|
||||
@ -176,7 +181,7 @@ void SHA512_Transform(SHA512_CTX*, const sha2_word64*);
|
||||
|
||||
/*** SHA-XYZ INITIAL HASH VALUES AND CONSTANTS ************************/
|
||||
/* Hash constant words K for SHA-256: */
|
||||
const static sha2_word32 K256[64] = {
|
||||
static const sha2_word32 K256[64] = {
|
||||
0x428a2f98UL, 0x71374491UL, 0xb5c0fbcfUL, 0xe9b5dba5UL,
|
||||
0x3956c25bUL, 0x59f111f1UL, 0x923f82a4UL, 0xab1c5ed5UL,
|
||||
0xd807aa98UL, 0x12835b01UL, 0x243185beUL, 0x550c7dc3UL,
|
||||
@ -196,7 +201,7 @@ const static sha2_word32 K256[64] = {
|
||||
};
|
||||
|
||||
/* Initial hash value H for SHA-256: */
|
||||
const static sha2_word32 sha256_initial_hash_value[8] = {
|
||||
static const sha2_word32 sha256_initial_hash_value[8] = {
|
||||
0x6a09e667UL,
|
||||
0xbb67ae85UL,
|
||||
0x3c6ef372UL,
|
||||
@ -208,7 +213,7 @@ const static sha2_word32 sha256_initial_hash_value[8] = {
|
||||
};
|
||||
|
||||
/* Hash constant words K for SHA-384 and SHA-512: */
|
||||
const static sha2_word64 K512[80] = {
|
||||
static const sha2_word64 K512[80] = {
|
||||
0x428a2f98d728ae22ULL, 0x7137449123ef65cdULL,
|
||||
0xb5c0fbcfec4d3b2fULL, 0xe9b5dba58189dbbcULL,
|
||||
0x3956c25bf348b538ULL, 0x59f111f1b605d019ULL,
|
||||
@ -252,7 +257,7 @@ const static sha2_word64 K512[80] = {
|
||||
};
|
||||
|
||||
/* Initial hash value H for SHA-384 */
|
||||
const static sha2_word64 sha384_initial_hash_value[8] = {
|
||||
static const sha2_word64 sha384_initial_hash_value[8] = {
|
||||
0xcbbb9d5dc1059ed8ULL,
|
||||
0x629a292a367cd507ULL,
|
||||
0x9159015a3070dd17ULL,
|
||||
@ -264,7 +269,7 @@ const static sha2_word64 sha384_initial_hash_value[8] = {
|
||||
};
|
||||
|
||||
/* Initial hash value H for SHA-512 */
|
||||
const static sha2_word64 sha512_initial_hash_value[8] = {
|
||||
static const sha2_word64 sha512_initial_hash_value[8] = {
|
||||
0x6a09e667f3bcc908ULL,
|
||||
0xbb67ae8584caa73bULL,
|
||||
0x3c6ef372fe94f82bULL,
|
||||
@ -548,7 +553,8 @@ void SHA256_Final(sha2_byte digest[], SHA256_CTX* context) {
|
||||
*context->buffer = 0x80;
|
||||
}
|
||||
/* Set the bit count: */
|
||||
*(sha2_word64*)&context->buffer[SHA256_SHORT_BLOCK_LENGTH] = context->bitcount;
|
||||
sha2_word64 *t = (sha2_word64 *)&context->buffer[SHA256_SHORT_BLOCK_LENGTH];
|
||||
*t = context->bitcount;
|
||||
|
||||
/* Final transform: */
|
||||
SHA256_Transform(context, (sha2_word32*)context->buffer);
|
||||
@ -866,8 +872,11 @@ void SHA512_Last(SHA512_CTX* context) {
|
||||
*context->buffer = 0x80;
|
||||
}
|
||||
/* Store the length of input data (in bits): */
|
||||
*(sha2_word64*)&context->buffer[SHA512_SHORT_BLOCK_LENGTH] = context->bitcount[1];
|
||||
*(sha2_word64*)&context->buffer[SHA512_SHORT_BLOCK_LENGTH+8] = context->bitcount[0];
|
||||
sha2_word64 *t;
|
||||
t = (sha2_word64 *)&context->buffer[SHA512_SHORT_BLOCK_LENGTH];
|
||||
*t = context->bitcount[1];
|
||||
t = (sha2_word64 *)&context->buffer[SHA512_SHORT_BLOCK_LENGTH+8];
|
||||
*t = context->bitcount[0];
|
||||
|
||||
/* Final transform: */
|
||||
SHA512_Transform(context, (sha2_word64*)context->buffer);
|
||||
|
@ -1,8 +1,9 @@
|
||||
NAME = speed
|
||||
OBJS += aux.o
|
||||
OBJS += bignum.o
|
||||
OBJS += ecdsa.o
|
||||
OBJS += rand.o
|
||||
OBJS += secp256k1.o
|
||||
OBJS += sha256.o
|
||||
OBJS += hmac.o
|
||||
OBJS += sha2.o
|
||||
|
||||
include Makefile.include
|
||||
|
@ -1 +0,0 @@
|
||||
../aux.c
|
@ -1 +0,0 @@
|
||||
../aux.h
|
1
speed-stm32/bignum.c
Symbolic link
1
speed-stm32/bignum.c
Symbolic link
@ -0,0 +1 @@
|
||||
../bignum.c
|
1
speed-stm32/bignum.h
Symbolic link
1
speed-stm32/bignum.h
Symbolic link
@ -0,0 +1 @@
|
||||
../bignum.h
|
1
speed-stm32/hmac.c
Symbolic link
1
speed-stm32/hmac.c
Symbolic link
@ -0,0 +1 @@
|
||||
../hmac.c
|
1
speed-stm32/hmac.h
Symbolic link
1
speed-stm32/hmac.h
Symbolic link
@ -0,0 +1 @@
|
||||
../hmac.h
|
1
speed-stm32/sha2.c
Symbolic link
1
speed-stm32/sha2.c
Symbolic link
@ -0,0 +1 @@
|
||||
../sha2.c
|
1
speed-stm32/sha2.h
Symbolic link
1
speed-stm32/sha2.h
Symbolic link
@ -0,0 +1 @@
|
||||
../sha2.h
|
@ -1 +0,0 @@
|
||||
../sha256.c
|
@ -1 +0,0 @@
|
||||
../sha256.h
|
@ -21,6 +21,7 @@
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include "bignum.h"
|
||||
#include "ecdsa.h"
|
||||
#include "sha2.h"
|
||||
|
||||
@ -29,7 +30,6 @@ uint8_t kb[32];
|
||||
uint8_t priv[32] = {0xcc, 0xa9, 0xfb, 0xcc, 0x1b, 0x41, 0xe5, 0xa9, 0x5d, 0x36, 0x9e, 0xaa, 0x6d, 0xdc, 0xff, 0x73, 0xb6, 0x1a, 0x4e, 0xfa, 0xa2, 0x79, 0xcf, 0xc6, 0x56, 0x7e, 0x8d, 0xaa, 0x39, 0xcb, 0xaf, 0x50};
|
||||
uint8_t hash[32];
|
||||
|
||||
void write_32byte_big_endian(const bignum256 *in_number, uint8_t *out_number);
|
||||
void generate_k_rfc6979(bignum256 *k, const uint8_t *priv_key, const uint8_t *hash);
|
||||
|
||||
int main()
|
||||
@ -40,7 +40,7 @@ int main()
|
||||
printf("hash : ");
|
||||
for (i = 0; i < 32; i++) printf("%02x", hash[i]); printf("\n");
|
||||
generate_k_rfc6979(&k, priv, hash);
|
||||
write_32byte_big_endian(&k, kb);
|
||||
bn_write_be(&k, kb);
|
||||
|
||||
printf("expected : 2df40ca70e639d89528a6b670d9d48d9165fdc0febc0974056bdce192b8e16a3\n");
|
||||
printf("got : ");
|
||||
|
Loading…
Reference in New Issue
Block a user