2 #include "mbedtls/ecdsa.h"
6 * depends_on:MBEDTLS_ECDSA_C
10 /* BEGIN_CASE depends_on:MBEDTLS_CHECK_PARAMS:!MBEDTLS_PARAM_FAILED_ALT */
11 void ecdsa_invalid_param( )
13 mbedtls_ecdsa_context ctx;
14 mbedtls_ecp_keypair key;
15 mbedtls_ecp_group grp;
16 mbedtls_ecp_group_id valid_group = MBEDTLS_ECP_DP_SECP192R1;
18 mbedtls_md_type_t valid_md = MBEDTLS_MD_SHA256;
21 unsigned char buf[42] = { 0 };
23 TEST_INVALID_PARAM( mbedtls_ecdsa_init( NULL ) );
24 TEST_VALID_PARAM( mbedtls_ecdsa_free( NULL ) );
26 #if defined(MBEDTLS_ECP_RESTARTABLE)
27 TEST_INVALID_PARAM( mbedtls_ecdsa_restart_init( NULL ) );
28 TEST_VALID_PARAM( mbedtls_ecdsa_restart_free( NULL ) );
29 #endif /* MBEDTLS_ECP_RESTARTABLE */
31 TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
32 mbedtls_ecdsa_sign( NULL, &m, &m, &m,
34 rnd_std_rand, NULL ) );
35 TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
36 mbedtls_ecdsa_sign( &grp, NULL, &m, &m,
38 rnd_std_rand, NULL ) );
39 TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
40 mbedtls_ecdsa_sign( &grp, &m, NULL, &m,
42 rnd_std_rand, NULL ) );
43 TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
44 mbedtls_ecdsa_sign( &grp, &m, &m, NULL,
46 rnd_std_rand, NULL ) );
47 TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
48 mbedtls_ecdsa_sign( &grp, &m, &m, &m,
50 rnd_std_rand, NULL ) );
51 TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
52 mbedtls_ecdsa_sign( &grp, &m, &m, &m,
56 #if defined(MBEDTLS_ECDSA_DETERMINISTIC)
57 TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
58 mbedtls_ecdsa_sign_det( NULL, &m, &m, &m,
61 TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
62 mbedtls_ecdsa_sign_det( &grp, NULL, &m, &m,
65 TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
66 mbedtls_ecdsa_sign_det( &grp, &m, NULL, &m,
69 TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
70 mbedtls_ecdsa_sign_det( &grp, &m, &m, NULL,
73 TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
74 mbedtls_ecdsa_sign_det( &grp, &m, &m, &m,
77 #endif /* MBEDTLS_ECDSA_DETERMINISTIC */
79 TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
80 mbedtls_ecdsa_verify( NULL,
83 TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
84 mbedtls_ecdsa_verify( &grp,
87 TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
88 mbedtls_ecdsa_verify( &grp,
91 TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
92 mbedtls_ecdsa_verify( &grp,
95 TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
96 mbedtls_ecdsa_verify( &grp,
100 TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
101 mbedtls_ecdsa_write_signature( NULL,
107 TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
108 mbedtls_ecdsa_write_signature( &ctx,
114 TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
115 mbedtls_ecdsa_write_signature( &ctx,
121 TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
122 mbedtls_ecdsa_write_signature( &ctx,
129 TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
130 mbedtls_ecdsa_write_signature_restartable( NULL,
136 TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
137 mbedtls_ecdsa_write_signature_restartable( &ctx,
143 TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
144 mbedtls_ecdsa_write_signature_restartable( &ctx,
150 TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
151 mbedtls_ecdsa_write_signature_restartable( &ctx,
158 TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
159 mbedtls_ecdsa_read_signature( NULL,
161 buf, sizeof( buf ) ) );
162 TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
163 mbedtls_ecdsa_read_signature( &ctx,
165 buf, sizeof( buf ) ) );
166 TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
167 mbedtls_ecdsa_read_signature( &ctx,
169 NULL, sizeof( buf ) ) );
171 TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
172 mbedtls_ecdsa_read_signature_restartable( NULL,
176 TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
177 mbedtls_ecdsa_read_signature_restartable( &ctx,
181 TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
182 mbedtls_ecdsa_read_signature_restartable( &ctx,
187 TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
188 mbedtls_ecdsa_genkey( NULL, valid_group,
189 rnd_std_rand, NULL ) );
190 TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
191 mbedtls_ecdsa_genkey( &ctx, valid_group,
195 TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
196 mbedtls_ecdsa_from_keypair( NULL, &key ) );
197 TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
198 mbedtls_ecdsa_from_keypair( &ctx, NULL ) );
206 void ecdsa_prim_random( int id )
208 mbedtls_ecp_group grp;
211 rnd_pseudo_info rnd_info;
212 unsigned char buf[MBEDTLS_MD_MAX_SIZE];
214 mbedtls_ecp_group_init( &grp );
215 mbedtls_ecp_point_init( &Q );
216 mbedtls_mpi_init( &d ); mbedtls_mpi_init( &r ); mbedtls_mpi_init( &s );
217 memset( &rnd_info, 0x00, sizeof( rnd_pseudo_info ) );
218 memset( buf, 0, sizeof( buf ) );
220 /* prepare material for signature */
221 TEST_ASSERT( rnd_pseudo_rand( &rnd_info, buf, sizeof( buf ) ) == 0 );
222 TEST_ASSERT( mbedtls_ecp_group_load( &grp, id ) == 0 );
223 TEST_ASSERT( mbedtls_ecp_gen_keypair( &grp, &d, &Q, &rnd_pseudo_rand, &rnd_info )
226 TEST_ASSERT( mbedtls_ecdsa_sign( &grp, &r, &s, &d, buf, sizeof( buf ),
227 &rnd_pseudo_rand, &rnd_info ) == 0 );
228 TEST_ASSERT( mbedtls_ecdsa_verify( &grp, buf, sizeof( buf ), &Q, &r, &s ) == 0 );
231 mbedtls_ecp_group_free( &grp );
232 mbedtls_ecp_point_free( &Q );
233 mbedtls_mpi_free( &d ); mbedtls_mpi_free( &r ); mbedtls_mpi_free( &s );
238 void ecdsa_prim_test_vectors( int id, char * d_str, char * xQ_str,
239 char * yQ_str, data_t * rnd_buf,
240 data_t * hash, char * r_str, char * s_str,
243 mbedtls_ecp_group grp;
245 mbedtls_mpi d, r, s, r_check, s_check;
246 rnd_buf_info rnd_info;
248 mbedtls_ecp_group_init( &grp );
249 mbedtls_ecp_point_init( &Q );
250 mbedtls_mpi_init( &d ); mbedtls_mpi_init( &r ); mbedtls_mpi_init( &s );
251 mbedtls_mpi_init( &r_check ); mbedtls_mpi_init( &s_check );
253 TEST_ASSERT( mbedtls_ecp_group_load( &grp, id ) == 0 );
254 TEST_ASSERT( mbedtls_ecp_point_read_string( &Q, 16, xQ_str, yQ_str ) == 0 );
255 TEST_ASSERT( mbedtls_mpi_read_string( &d, 16, d_str ) == 0 );
256 TEST_ASSERT( mbedtls_mpi_read_string( &r_check, 16, r_str ) == 0 );
257 TEST_ASSERT( mbedtls_mpi_read_string( &s_check, 16, s_str ) == 0 );
258 rnd_info.buf = rnd_buf->x;
259 rnd_info.length = rnd_buf->len;
261 /* Fix rnd_buf->x by shifting it left if necessary */
262 if( grp.nbits % 8 != 0 )
264 unsigned char shift = 8 - ( grp.nbits % 8 );
267 for( i = 0; i < rnd_info.length - 1; i++ )
268 rnd_buf->x[i] = rnd_buf->x[i] << shift | rnd_buf->x[i+1] >> ( 8 - shift );
270 rnd_buf->x[rnd_info.length-1] <<= shift;
273 TEST_ASSERT( mbedtls_ecdsa_sign( &grp, &r, &s, &d, hash->x, hash->len,
274 rnd_buffer_rand, &rnd_info ) == result );
278 TEST_ASSERT( mbedtls_mpi_cmp_mpi( &r, &r_check ) == 0 );
279 TEST_ASSERT( mbedtls_mpi_cmp_mpi( &s, &s_check ) == 0 );
281 TEST_ASSERT( mbedtls_ecdsa_verify( &grp, hash->x, hash->len, &Q, &r_check, &s_check ) == 0 );
283 TEST_ASSERT( mbedtls_mpi_sub_int( &r, &r, 1 ) == 0 );
284 TEST_ASSERT( mbedtls_mpi_add_int( &s, &s, 1 ) == 0 );
286 TEST_ASSERT( mbedtls_ecdsa_verify( &grp, hash->x, hash->len,
287 &Q, &r, &s_check ) == MBEDTLS_ERR_ECP_VERIFY_FAILED );
288 TEST_ASSERT( mbedtls_ecdsa_verify( &grp, hash->x, hash->len,
289 &Q, &r_check, &s ) == MBEDTLS_ERR_ECP_VERIFY_FAILED );
290 TEST_ASSERT( mbedtls_ecdsa_verify( &grp, hash->x, hash->len,
291 &grp.G, &r_check, &s_check ) == MBEDTLS_ERR_ECP_VERIFY_FAILED );
295 mbedtls_ecp_group_free( &grp );
296 mbedtls_ecp_point_free( &Q );
297 mbedtls_mpi_free( &d ); mbedtls_mpi_free( &r ); mbedtls_mpi_free( &s );
298 mbedtls_mpi_free( &r_check ); mbedtls_mpi_free( &s_check );
302 /* BEGIN_CASE depends_on:MBEDTLS_ECDSA_DETERMINISTIC */
303 void ecdsa_det_test_vectors( int id, char * d_str, int md_alg, char * msg,
304 char * r_str, char * s_str )
306 mbedtls_ecp_group grp;
307 mbedtls_mpi d, r, s, r_check, s_check;
308 unsigned char hash[MBEDTLS_MD_MAX_SIZE];
310 const mbedtls_md_info_t *md_info;
312 mbedtls_ecp_group_init( &grp );
313 mbedtls_mpi_init( &d ); mbedtls_mpi_init( &r ); mbedtls_mpi_init( &s );
314 mbedtls_mpi_init( &r_check ); mbedtls_mpi_init( &s_check );
315 memset( hash, 0, sizeof( hash ) );
317 TEST_ASSERT( mbedtls_ecp_group_load( &grp, id ) == 0 );
318 TEST_ASSERT( mbedtls_mpi_read_string( &d, 16, d_str ) == 0 );
319 TEST_ASSERT( mbedtls_mpi_read_string( &r_check, 16, r_str ) == 0 );
320 TEST_ASSERT( mbedtls_mpi_read_string( &s_check, 16, s_str ) == 0 );
322 md_info = mbedtls_md_info_from_type( md_alg );
323 TEST_ASSERT( md_info != NULL );
324 hlen = mbedtls_md_get_size( md_info );
325 TEST_ASSERT( mbedtls_md( md_info, (const unsigned char *) msg,
326 strlen( msg ), hash ) == 0 );
328 TEST_ASSERT( mbedtls_ecdsa_sign_det( &grp, &r, &s, &d, hash, hlen, md_alg ) == 0 );
330 TEST_ASSERT( mbedtls_mpi_cmp_mpi( &r, &r_check ) == 0 );
331 TEST_ASSERT( mbedtls_mpi_cmp_mpi( &s, &s_check ) == 0 );
334 mbedtls_ecp_group_free( &grp );
335 mbedtls_mpi_free( &d ); mbedtls_mpi_free( &r ); mbedtls_mpi_free( &s );
336 mbedtls_mpi_free( &r_check ); mbedtls_mpi_free( &s_check );
340 /* BEGIN_CASE depends_on:MBEDTLS_SHA256_C */
341 void ecdsa_write_read_random( int id )
343 mbedtls_ecdsa_context ctx;
344 rnd_pseudo_info rnd_info;
345 unsigned char hash[32];
346 unsigned char sig[200];
349 mbedtls_ecdsa_init( &ctx );
350 memset( &rnd_info, 0x00, sizeof( rnd_pseudo_info ) );
351 memset( hash, 0, sizeof( hash ) );
352 memset( sig, 0x2a, sizeof( sig ) );
354 /* prepare material for signature */
355 TEST_ASSERT( rnd_pseudo_rand( &rnd_info, hash, sizeof( hash ) ) == 0 );
357 /* generate signing key */
358 TEST_ASSERT( mbedtls_ecdsa_genkey( &ctx, id, &rnd_pseudo_rand, &rnd_info ) == 0 );
360 /* generate and write signature, then read and verify it */
361 TEST_ASSERT( mbedtls_ecdsa_write_signature( &ctx, MBEDTLS_MD_SHA256,
362 hash, sizeof( hash ),
363 sig, &sig_len, &rnd_pseudo_rand, &rnd_info ) == 0 );
364 TEST_ASSERT( mbedtls_ecdsa_read_signature( &ctx, hash, sizeof( hash ),
365 sig, sig_len ) == 0 );
367 /* check we didn't write past the announced length */
368 for( i = sig_len; i < sizeof( sig ); i++ )
369 TEST_ASSERT( sig[i] == 0x2a );
371 /* try verification with invalid length */
372 TEST_ASSERT( mbedtls_ecdsa_read_signature( &ctx, hash, sizeof( hash ),
373 sig, sig_len - 1 ) != 0 );
374 TEST_ASSERT( mbedtls_ecdsa_read_signature( &ctx, hash, sizeof( hash ),
375 sig, sig_len + 1 ) != 0 );
377 /* try invalid sequence tag */
379 TEST_ASSERT( mbedtls_ecdsa_read_signature( &ctx, hash, sizeof( hash ),
380 sig, sig_len ) != 0 );
383 /* try modifying r */
385 TEST_ASSERT( mbedtls_ecdsa_read_signature( &ctx, hash, sizeof( hash ),
386 sig, sig_len ) == MBEDTLS_ERR_ECP_VERIFY_FAILED );
389 /* try modifying s */
391 TEST_ASSERT( mbedtls_ecdsa_read_signature( &ctx, hash, sizeof( hash ),
392 sig, sig_len ) == MBEDTLS_ERR_ECP_VERIFY_FAILED );
396 mbedtls_ecdsa_free( &ctx );
400 /* BEGIN_CASE depends_on:MBEDTLS_ECP_RESTARTABLE */
401 void ecdsa_read_restart( int id, char *k_str, char *h_str, char *s_str,
402 int max_ops, int min_restart, int max_restart )
404 mbedtls_ecdsa_context ctx;
405 mbedtls_ecdsa_restart_ctx rs_ctx;
406 unsigned char hash[64];
407 unsigned char sig[200];
408 unsigned char pk[65];
409 size_t sig_len, hash_len, pk_len;
410 int ret, cnt_restart;
412 mbedtls_ecdsa_init( &ctx );
413 mbedtls_ecdsa_restart_init( &rs_ctx );
415 hash_len = unhexify(hash, h_str);
416 sig_len = unhexify(sig, s_str);
417 pk_len = unhexify(pk, k_str);
419 TEST_ASSERT( mbedtls_ecp_group_load( &ctx.grp, id ) == 0 );
420 TEST_ASSERT( mbedtls_ecp_point_read_binary( &ctx.grp, &ctx.Q, pk, pk_len ) == 0 );
422 mbedtls_ecp_set_max_ops( max_ops );
426 ret = mbedtls_ecdsa_read_signature_restartable( &ctx,
427 hash, hash_len, sig, sig_len, &rs_ctx );
428 } while( ret == MBEDTLS_ERR_ECP_IN_PROGRESS && ++cnt_restart );
430 TEST_ASSERT( ret == 0 );
431 TEST_ASSERT( cnt_restart >= min_restart );
432 TEST_ASSERT( cnt_restart <= max_restart );
434 /* try modifying r */
437 ret = mbedtls_ecdsa_read_signature_restartable( &ctx,
438 hash, hash_len, sig, sig_len, &rs_ctx );
439 } while( ret == MBEDTLS_ERR_ECP_IN_PROGRESS );
440 TEST_ASSERT( ret == MBEDTLS_ERR_ECP_VERIFY_FAILED );
443 /* try modifying s */
446 ret = mbedtls_ecdsa_read_signature_restartable( &ctx,
447 hash, hash_len, sig, sig_len, &rs_ctx );
448 } while( ret == MBEDTLS_ERR_ECP_IN_PROGRESS );
449 TEST_ASSERT( ret == MBEDTLS_ERR_ECP_VERIFY_FAILED );
452 /* Do we leak memory when aborting an operation?
453 * This test only makes sense when we actually restart */
454 if( min_restart > 0 )
456 ret = mbedtls_ecdsa_read_signature_restartable( &ctx,
457 hash, hash_len, sig, sig_len, &rs_ctx );
458 TEST_ASSERT( ret == MBEDTLS_ERR_ECP_IN_PROGRESS );
462 mbedtls_ecdsa_free( &ctx );
463 mbedtls_ecdsa_restart_free( &rs_ctx );
467 /* BEGIN_CASE depends_on:MBEDTLS_ECP_RESTARTABLE:MBEDTLS_ECDSA_DETERMINISTIC */
468 void ecdsa_write_restart( int id, char *d_str, int md_alg,
469 char *msg, char *sig_str,
470 int max_ops, int min_restart, int max_restart )
472 int ret, cnt_restart;
473 mbedtls_ecdsa_restart_ctx rs_ctx;
474 mbedtls_ecdsa_context ctx;
475 unsigned char hash[MBEDTLS_MD_MAX_SIZE];
476 unsigned char sig[MBEDTLS_ECDSA_MAX_LEN];
477 unsigned char sig_check[MBEDTLS_ECDSA_MAX_LEN];
478 size_t hlen, slen, slen_check;
479 const mbedtls_md_info_t *md_info;
481 mbedtls_ecdsa_restart_init( &rs_ctx );
482 mbedtls_ecdsa_init( &ctx );
483 memset( hash, 0, sizeof( hash ) );
484 memset( sig, 0, sizeof( sig ) );
485 memset( sig_check, 0, sizeof( sig_check ) );
487 TEST_ASSERT( mbedtls_ecp_group_load( &ctx.grp, id ) == 0 );
488 TEST_ASSERT( mbedtls_mpi_read_string( &ctx.d, 16, d_str ) == 0 );
489 slen_check = unhexify( sig_check, sig_str );
491 md_info = mbedtls_md_info_from_type( md_alg );
492 TEST_ASSERT( md_info != NULL );
494 hlen = mbedtls_md_get_size( md_info );
495 mbedtls_md( md_info, (const unsigned char *) msg, strlen( msg ), hash );
497 mbedtls_ecp_set_max_ops( max_ops );
499 slen = sizeof( sig );
502 ret = mbedtls_ecdsa_write_signature_restartable( &ctx,
503 md_alg, hash, hlen, sig, &slen, NULL, NULL, &rs_ctx );
504 } while( ret == MBEDTLS_ERR_ECP_IN_PROGRESS && ++cnt_restart );
506 TEST_ASSERT( ret == 0 );
507 TEST_ASSERT( slen == slen_check );
508 TEST_ASSERT( memcmp( sig, sig_check, slen ) == 0 );
510 TEST_ASSERT( cnt_restart >= min_restart );
511 TEST_ASSERT( cnt_restart <= max_restart );
513 /* Do we leak memory when aborting an operation?
514 * This test only makes sense when we actually restart */
515 if( min_restart > 0 )
517 ret = mbedtls_ecdsa_write_signature_restartable( &ctx,
518 md_alg, hash, hlen, sig, &slen, NULL, NULL, &rs_ctx );
519 TEST_ASSERT( ret == MBEDTLS_ERR_ECP_IN_PROGRESS );
523 mbedtls_ecdsa_restart_free( &rs_ctx );
524 mbedtls_ecdsa_free( &ctx );