1 /*
2 * Copyright (c) 2022, The OpenThread Authors.
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions are met:
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
12 * 3. Neither the name of the copyright holder nor the
13 * names of its contributors may be used to endorse or promote products
14 * derived from this software without specific prior written permission.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
17 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
20 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
21 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
22 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
23 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
24 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
25 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
26 * POSSIBILITY OF SUCH DAMAGE.
27 */
28
29 /**
30 * @file
31 * This file implements ECDSA signing using TinyCrypt library.
32 */
33
34 #include "ecdsa.hpp"
35
36 #if OPENTHREAD_CONFIG_ECDSA_ENABLE
37
38 #ifdef MBEDTLS_USE_TINYCRYPT
39
40 #include <string.h>
41
42 #include <mbedtls/pk.h>
43 #include <mbedtls/version.h>
44
45 #include <tinycrypt/ecc.h>
46 #include <tinycrypt/ecc_dh.h>
47 #include <tinycrypt/ecc_dsa.h>
48
49 #include "common/code_utils.hpp"
50 #include "common/debug.hpp"
51 #include "common/random.hpp"
52 #include "crypto/mbedtls.hpp"
53
54 namespace ot {
55 namespace Crypto {
56 namespace Ecdsa {
57
Generate(void)58 Error P256::KeyPair::Generate(void)
59 {
60 mbedtls_pk_context pk;
61 mbedtls_uecc_keypair *keypair;
62 int ret;
63
64 mbedtls_pk_init(&pk);
65
66 ret = mbedtls_pk_setup(&pk, mbedtls_pk_info_from_type(MBEDTLS_PK_ECKEY));
67 VerifyOrExit(ret == 0);
68
69 keypair = mbedtls_pk_uecc(pk);
70
71 ret = uECC_make_key(keypair->public_key, keypair->private_key);
72 VerifyOrExit(ret == UECC_SUCCESS);
73
74 ret = mbedtls_pk_write_key_der(&pk, mDerBytes, sizeof(mDerBytes));
75 VerifyOrExit(ret > 0);
76
77 mDerLength = static_cast<uint8_t>(ret);
78
79 memmove(mDerBytes, mDerBytes + sizeof(mDerBytes) - mDerLength, mDerLength);
80
81 exit:
82 mbedtls_pk_free(&pk);
83
84 return (ret >= 0) ? kErrorNone : MbedTls::MapError(ret);
85 }
86
Parse(void * aContext) const87 Error P256::KeyPair::Parse(void *aContext) const
88 {
89 Error error = kErrorNone;
90 mbedtls_pk_context *pk = reinterpret_cast<mbedtls_pk_context *>(aContext);
91
92 mbedtls_pk_init(pk);
93
94 VerifyOrExit(mbedtls_pk_setup(pk, mbedtls_pk_info_from_type(MBEDTLS_PK_ECKEY)) == 0, error = kErrorFailed);
95 #if (MBEDTLS_VERSION_NUMBER >= 0x03000000)
96 VerifyOrExit(mbedtls_pk_parse_key(pk, mDerBytes, mDerLength, nullptr, 0, MbedTls::CryptoSecurePrng, nullptr) == 0,
97 error = kErrorParse);
98 #else
99 VerifyOrExit(mbedtls_pk_parse_key(pk, mDerBytes, mDerLength, nullptr, 0) == 0, error = kErrorParse);
100 #endif
101
102 exit:
103 return error;
104 }
105
GetPublicKey(PublicKey & aPublicKey) const106 Error P256::KeyPair::GetPublicKey(PublicKey &aPublicKey) const
107 {
108 Error error;
109 mbedtls_pk_context pk;
110 mbedtls_uecc_keypair *keyPair;
111 int ret;
112
113 SuccessOrExit(error = Parse(&pk));
114
115 keyPair = mbedtls_pk_uecc(pk);
116
117 memcpy(aPublicKey.mData, keyPair->public_key, kMpiSize);
118 memcpy(aPublicKey.mData + kMpiSize, keyPair->public_key + kMpiSize, kMpiSize);
119
120 exit:
121 mbedtls_pk_free(&pk);
122
123 return error;
124 }
125
Sign(const Sha256::Hash & aHash,Signature & aSignature) const126 Error P256::KeyPair::Sign(const Sha256::Hash &aHash, Signature &aSignature) const
127 {
128 Error error;
129 mbedtls_pk_context pk;
130 mbedtls_uecc_keypair *keypair;
131 int ret;
132 uint8_t sig[2 * kMpiSize];
133
134 SuccessOrExit(error = Parse(&pk));
135
136 keypair = mbedtls_pk_uecc(pk);
137
138 ret = uECC_sign(keypair->private_key, aHash.GetBytes(), Sha256::Hash::kSize, sig);
139 VerifyOrExit(ret == UECC_SUCCESS, error = MbedTls::MapError(ret));
140
141 memcpy(aSignature.mShared.mMpis.mR, sig, kMpiSize);
142 memcpy(aSignature.mShared.mMpis.mS, sig + kMpiSize, kMpiSize);
143
144 exit:
145 mbedtls_pk_free(&pk);
146
147 return error;
148 }
149
Verify(const Sha256::Hash & aHash,const Signature & aSignature) const150 Error P256::PublicKey::Verify(const Sha256::Hash &aHash, const Signature &aSignature) const
151 {
152 Error error = kErrorNone;
153 int ret;
154 uint8_t public_key[2 * kMpiSize];
155 uint8_t sig[2 * kMpiSize];
156
157 memcpy(public_key, GetBytes(), 2 * kMpiSize);
158
159 memcpy(sig, aSignature.mShared.mMpis.mR, kMpiSize);
160 memcpy(sig + kMpiSize, aSignature.mShared.mMpis.mS, kMpiSize);
161
162 ret = uECC_verify(public_key, aHash.GetBytes(), Sha256::Hash::kSize, sig);
163 VerifyOrExit(ret == UECC_SUCCESS, error = kErrorSecurity);
164
165 exit:
166 return error;
167 }
168
Sign(uint8_t * aOutput,uint16_t & aOutputLength,const uint8_t * aInputHash,uint16_t aInputHashLength,const uint8_t * aPrivateKey,uint16_t aPrivateKeyLength)169 Error Sign(uint8_t * aOutput,
170 uint16_t & aOutputLength,
171 const uint8_t *aInputHash,
172 uint16_t aInputHashLength,
173 const uint8_t *aPrivateKey,
174 uint16_t aPrivateKeyLength)
175 {
176 Error error = kErrorNone;
177 mbedtls_pk_context pkCtx;
178 mbedtls_uecc_keypair *keypair;
179 uint8_t sig[2 * NUM_ECC_BYTES];
180
181 mbedtls_pk_init(&pkCtx);
182
183 // Parse a private key in PEM format.
184 VerifyOrExit(mbedtls_pk_parse_key(&pkCtx, aPrivateKey, aPrivateKeyLength, nullptr, 0) == 0,
185 error = kErrorInvalidArgs);
186 VerifyOrExit(mbedtls_pk_get_type(&pkCtx) == MBEDTLS_PK_ECKEY, error = kErrorInvalidArgs);
187
188 keypair = mbedtls_pk_uecc(pkCtx);
189 OT_ASSERT(keypair != nullptr);
190
191 // Sign using ECDSA.
192 VerifyOrExit(uECC_sign(keypair->private_key, aInputHash, aInputHashLength, sig) == UECC_SUCCESS,
193 error = kErrorFailed);
194 VerifyOrExit(2 * NUM_ECC_BYTES <= aOutputLength, error = kErrorNoBufs);
195
196 // Concatenate the two octet sequences in the order R and then S.
197 memcpy(aOutput, sig, 2 * NUM_ECC_BYTES);
198 aOutputLength = 2 * NUM_ECC_BYTES;
199
200 exit:
201 mbedtls_pk_free(&pkCtx);
202
203 return error;
204 }
205
206 } // namespace Ecdsa
207 } // namespace Crypto
208 } // namespace ot
209
210 #endif // MBEDTLS_USE_TINYCRYPT
211 #endif // OPENTHREAD_CONFIG_ECDSA_ENABLE
212