ecdsa.h 28 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604
  1. /**
  2. * \file ecdsa.h
  3. *
  4. * \brief This file contains ECDSA definitions and functions.
  5. *
  6. * The Elliptic Curve Digital Signature Algorithm (ECDSA) is defined in
  7. * <em>Standards for Efficient Cryptography Group (SECG):
  8. * SEC1 Elliptic Curve Cryptography</em>.
  9. * The use of ECDSA for TLS is defined in <em>RFC-4492: Elliptic Curve
  10. * Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS)</em>.
  11. *
  12. */
  13. /*
  14. * Copyright (C) 2006-2018, Arm Limited (or its affiliates), All Rights Reserved
  15. * SPDX-License-Identifier: Apache-2.0
  16. *
  17. * Licensed under the Apache License, Version 2.0 (the "License"); you may
  18. * not use this file except in compliance with the License.
  19. * You may obtain a copy of the License at
  20. *
  21. * http://www.apache.org/licenses/LICENSE-2.0
  22. *
  23. * Unless required by applicable law or agreed to in writing, software
  24. * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  25. * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  26. * See the License for the specific language governing permissions and
  27. * limitations under the License.
  28. *
  29. * This file is part of Mbed TLS (https://tls.mbed.org)
  30. */
  31. #ifndef MBEDTLS_ECDSA_H
  32. #define MBEDTLS_ECDSA_H
  33. #if !defined(MBEDTLS_CONFIG_FILE)
  34. #include "config.h"
  35. #else
  36. #include MBEDTLS_CONFIG_FILE
  37. #endif
  38. #include "ecp.h"
  39. #include "md.h"
  40. /*
  41. * RFC-4492 page 20:
  42. *
  43. * Ecdsa-Sig-Value ::= SEQUENCE {
  44. * r INTEGER,
  45. * s INTEGER
  46. * }
  47. *
  48. * Size is at most
  49. * 1 (tag) + 1 (len) + 1 (initial 0) + ECP_MAX_BYTES for each of r and s,
  50. * twice that + 1 (tag) + 2 (len) for the sequence
  51. * (assuming ECP_MAX_BYTES is less than 126 for r and s,
  52. * and less than 124 (total len <= 255) for the sequence)
  53. */
  54. #if MBEDTLS_ECP_MAX_BYTES > 124
  55. #error "MBEDTLS_ECP_MAX_BYTES bigger than expected, please fix MBEDTLS_ECDSA_MAX_LEN"
  56. #endif
  57. /** The maximal size of an ECDSA signature in Bytes. */
  58. #define MBEDTLS_ECDSA_MAX_LEN ( 3 + 2 * ( 3 + MBEDTLS_ECP_MAX_BYTES ) )
  59. #ifdef __cplusplus
  60. extern "C" {
  61. #endif
  62. /**
  63. * \brief The ECDSA context structure.
  64. *
  65. * \warning Performing multiple operations concurrently on the same
  66. * ECDSA context is not supported; objects of this type
  67. * should not be shared between multiple threads.
  68. */
  69. typedef mbedtls_ecp_keypair mbedtls_ecdsa_context;
  70. #if defined(MBEDTLS_ECP_RESTARTABLE)
  71. /**
  72. * \brief Internal restart context for ecdsa_verify()
  73. *
  74. * \note Opaque struct, defined in ecdsa.c
  75. */
  76. typedef struct mbedtls_ecdsa_restart_ver mbedtls_ecdsa_restart_ver_ctx;
  77. /**
  78. * \brief Internal restart context for ecdsa_sign()
  79. *
  80. * \note Opaque struct, defined in ecdsa.c
  81. */
  82. typedef struct mbedtls_ecdsa_restart_sig mbedtls_ecdsa_restart_sig_ctx;
  83. #if defined(MBEDTLS_ECDSA_DETERMINISTIC)
  84. /**
  85. * \brief Internal restart context for ecdsa_sign_det()
  86. *
  87. * \note Opaque struct, defined in ecdsa.c
  88. */
  89. typedef struct mbedtls_ecdsa_restart_det mbedtls_ecdsa_restart_det_ctx;
  90. #endif
  91. /**
  92. * \brief General context for resuming ECDSA operations
  93. */
  94. typedef struct
  95. {
  96. mbedtls_ecp_restart_ctx ecp; /*!< base context for ECP restart and
  97. shared administrative info */
  98. mbedtls_ecdsa_restart_ver_ctx *ver; /*!< ecdsa_verify() sub-context */
  99. mbedtls_ecdsa_restart_sig_ctx *sig; /*!< ecdsa_sign() sub-context */
  100. #if defined(MBEDTLS_ECDSA_DETERMINISTIC)
  101. mbedtls_ecdsa_restart_det_ctx *det; /*!< ecdsa_sign_det() sub-context */
  102. #endif
  103. } mbedtls_ecdsa_restart_ctx;
  104. #else /* MBEDTLS_ECP_RESTARTABLE */
  105. /* Now we can declare functions that take a pointer to that */
  106. typedef void mbedtls_ecdsa_restart_ctx;
  107. #endif /* MBEDTLS_ECP_RESTARTABLE */
  108. /**
  109. * \brief This function computes the ECDSA signature of a
  110. * previously-hashed message.
  111. *
  112. * \note The deterministic version implemented in
  113. * mbedtls_ecdsa_sign_det() is usually preferred.
  114. *
  115. * \note If the bitlength of the message hash is larger than the
  116. * bitlength of the group order, then the hash is truncated
  117. * as defined in <em>Standards for Efficient Cryptography Group
  118. * (SECG): SEC1 Elliptic Curve Cryptography</em>, section
  119. * 4.1.3, step 5.
  120. *
  121. * \see ecp.h
  122. *
  123. * \param grp The context for the elliptic curve to use.
  124. * This must be initialized and have group parameters
  125. * set, for example through mbedtls_ecp_group_load().
  126. * \param r The MPI context in which to store the first part
  127. * the signature. This must be initialized.
  128. * \param s The MPI context in which to store the second part
  129. * the signature. This must be initialized.
  130. * \param d The private signing key. This must be initialized.
  131. * \param buf The content to be signed. This is usually the hash of
  132. * the original data to be signed. This must be a readable
  133. * buffer of length \p blen Bytes. It may be \c NULL if
  134. * \p blen is zero.
  135. * \param blen The length of \p buf in Bytes.
  136. * \param f_rng The RNG function. This must not be \c NULL.
  137. * \param p_rng The RNG context to be passed to \p f_rng. This may be
  138. * \c NULL if \p f_rng doesn't need a context parameter.
  139. *
  140. * \return \c 0 on success.
  141. * \return An \c MBEDTLS_ERR_ECP_XXX
  142. * or \c MBEDTLS_MPI_XXX error code on failure.
  143. */
  144. int mbedtls_ecdsa_sign( mbedtls_ecp_group *grp, mbedtls_mpi *r, mbedtls_mpi *s,
  145. const mbedtls_mpi *d, const unsigned char *buf, size_t blen,
  146. int (*f_rng)(void *, unsigned char *, size_t), void *p_rng );
  147. #if defined(MBEDTLS_ECDSA_DETERMINISTIC)
  148. /**
  149. * \brief This function computes the ECDSA signature of a
  150. * previously-hashed message, deterministic version.
  151. *
  152. * For more information, see <em>RFC-6979: Deterministic
  153. * Usage of the Digital Signature Algorithm (DSA) and Elliptic
  154. * Curve Digital Signature Algorithm (ECDSA)</em>.
  155. *
  156. * \note If the bitlength of the message hash is larger than the
  157. * bitlength of the group order, then the hash is truncated as
  158. * defined in <em>Standards for Efficient Cryptography Group
  159. * (SECG): SEC1 Elliptic Curve Cryptography</em>, section
  160. * 4.1.3, step 5.
  161. *
  162. * \warning Since the output of the internal RNG is always the same for
  163. * the same key and message, this limits the efficiency of
  164. * blinding and leaks information through side channels. For
  165. * secure behavior use mbedtls_ecdsa_sign_det_ext() instead.
  166. *
  167. * (Optimally the blinding is a random value that is different
  168. * on every execution. In this case the blinding is still
  169. * random from the attackers perspective, but is the same on
  170. * each execution. This means that this blinding does not
  171. * prevent attackers from recovering secrets by combining
  172. * several measurement traces, but may prevent some attacks
  173. * that exploit relationships between secret data.)
  174. *
  175. * \see ecp.h
  176. *
  177. * \param grp The context for the elliptic curve to use.
  178. * This must be initialized and have group parameters
  179. * set, for example through mbedtls_ecp_group_load().
  180. * \param r The MPI context in which to store the first part
  181. * the signature. This must be initialized.
  182. * \param s The MPI context in which to store the second part
  183. * the signature. This must be initialized.
  184. * \param d The private signing key. This must be initialized
  185. * and setup, for example through mbedtls_ecp_gen_privkey().
  186. * \param buf The hashed content to be signed. This must be a readable
  187. * buffer of length \p blen Bytes. It may be \c NULL if
  188. * \p blen is zero.
  189. * \param blen The length of \p buf in Bytes.
  190. * \param md_alg The hash algorithm used to hash the original data.
  191. *
  192. * \return \c 0 on success.
  193. * \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX
  194. * error code on failure.
  195. */
  196. int mbedtls_ecdsa_sign_det( mbedtls_ecp_group *grp, mbedtls_mpi *r,
  197. mbedtls_mpi *s, const mbedtls_mpi *d,
  198. const unsigned char *buf, size_t blen,
  199. mbedtls_md_type_t md_alg );
  200. /**
  201. * \brief This function computes the ECDSA signature of a
  202. * previously-hashed message, deterministic version.
  203. *
  204. * For more information, see <em>RFC-6979: Deterministic
  205. * Usage of the Digital Signature Algorithm (DSA) and Elliptic
  206. * Curve Digital Signature Algorithm (ECDSA)</em>.
  207. *
  208. * \note If the bitlength of the message hash is larger than the
  209. * bitlength of the group order, then the hash is truncated as
  210. * defined in <em>Standards for Efficient Cryptography Group
  211. * (SECG): SEC1 Elliptic Curve Cryptography</em>, section
  212. * 4.1.3, step 5.
  213. *
  214. * \see ecp.h
  215. *
  216. * \param grp The context for the elliptic curve to use.
  217. * This must be initialized and have group parameters
  218. * set, for example through mbedtls_ecp_group_load().
  219. * \param r The MPI context in which to store the first part
  220. * the signature. This must be initialized.
  221. * \param s The MPI context in which to store the second part
  222. * the signature. This must be initialized.
  223. * \param d The private signing key. This must be initialized
  224. * and setup, for example through mbedtls_ecp_gen_privkey().
  225. * \param buf The hashed content to be signed. This must be a readable
  226. * buffer of length \p blen Bytes. It may be \c NULL if
  227. * \p blen is zero.
  228. * \param blen The length of \p buf in Bytes.
  229. * \param md_alg The hash algorithm used to hash the original data.
  230. * \param f_rng_blind The RNG function used for blinding. This must not be
  231. * \c NULL.
  232. * \param p_rng_blind The RNG context to be passed to \p f_rng. This may be
  233. * \c NULL if \p f_rng doesn't need a context parameter.
  234. *
  235. * \return \c 0 on success.
  236. * \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX
  237. * error code on failure.
  238. */
  239. int mbedtls_ecdsa_sign_det_ext( mbedtls_ecp_group *grp, mbedtls_mpi *r,
  240. mbedtls_mpi *s, const mbedtls_mpi *d,
  241. const unsigned char *buf, size_t blen,
  242. mbedtls_md_type_t md_alg,
  243. int (*f_rng_blind)(void *, unsigned char *,
  244. size_t),
  245. void *p_rng_blind );
  246. #endif /* MBEDTLS_ECDSA_DETERMINISTIC */
  247. /**
  248. * \brief This function verifies the ECDSA signature of a
  249. * previously-hashed message.
  250. *
  251. * \note If the bitlength of the message hash is larger than the
  252. * bitlength of the group order, then the hash is truncated as
  253. * defined in <em>Standards for Efficient Cryptography Group
  254. * (SECG): SEC1 Elliptic Curve Cryptography</em>, section
  255. * 4.1.4, step 3.
  256. *
  257. * \see ecp.h
  258. *
  259. * \param grp The ECP group to use.
  260. * This must be initialized and have group parameters
  261. * set, for example through mbedtls_ecp_group_load().
  262. * \param buf The hashed content that was signed. This must be a readable
  263. * buffer of length \p blen Bytes. It may be \c NULL if
  264. * \p blen is zero.
  265. * \param blen The length of \p buf in Bytes.
  266. * \param Q The public key to use for verification. This must be
  267. * initialized and setup.
  268. * \param r The first integer of the signature.
  269. * This must be initialized.
  270. * \param s The second integer of the signature.
  271. * This must be initialized.
  272. *
  273. * \return \c 0 on success.
  274. * \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the signature
  275. * is invalid.
  276. * \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX
  277. * error code on failure for any other reason.
  278. */
  279. int mbedtls_ecdsa_verify( mbedtls_ecp_group *grp,
  280. const unsigned char *buf, size_t blen,
  281. const mbedtls_ecp_point *Q, const mbedtls_mpi *r,
  282. const mbedtls_mpi *s);
  283. /**
  284. * \brief This function computes the ECDSA signature and writes it
  285. * to a buffer, serialized as defined in <em>RFC-4492:
  286. * Elliptic Curve Cryptography (ECC) Cipher Suites for
  287. * Transport Layer Security (TLS)</em>.
  288. *
  289. * \warning It is not thread-safe to use the same context in
  290. * multiple threads.
  291. *
  292. * \note The deterministic version is used if
  293. * #MBEDTLS_ECDSA_DETERMINISTIC is defined. For more
  294. * information, see <em>RFC-6979: Deterministic Usage
  295. * of the Digital Signature Algorithm (DSA) and Elliptic
  296. * Curve Digital Signature Algorithm (ECDSA)</em>.
  297. *
  298. * \note If the bitlength of the message hash is larger than the
  299. * bitlength of the group order, then the hash is truncated as
  300. * defined in <em>Standards for Efficient Cryptography Group
  301. * (SECG): SEC1 Elliptic Curve Cryptography</em>, section
  302. * 4.1.3, step 5.
  303. *
  304. * \see ecp.h
  305. *
  306. * \param ctx The ECDSA context to use. This must be initialized
  307. * and have a group and private key bound to it, for example
  308. * via mbedtls_ecdsa_genkey() or mbedtls_ecdsa_from_keypair().
  309. * \param md_alg The message digest that was used to hash the message.
  310. * \param hash The message hash to be signed. This must be a readable
  311. * buffer of length \p blen Bytes.
  312. * \param hlen The length of the hash \p hash in Bytes.
  313. * \param sig The buffer to which to write the signature. This must be a
  314. * writable buffer of length at least twice as large as the
  315. * size of the curve used, plus 9. For example, 73 Bytes if
  316. * a 256-bit curve is used. A buffer length of
  317. * #MBEDTLS_ECDSA_MAX_LEN is always safe.
  318. * \param slen The address at which to store the actual length of
  319. * the signature written. Must not be \c NULL.
  320. * \param f_rng The RNG function. This must not be \c NULL if
  321. * #MBEDTLS_ECDSA_DETERMINISTIC is unset. Otherwise,
  322. * it is unused and may be set to \c NULL.
  323. * \param p_rng The RNG context to be passed to \p f_rng. This may be
  324. * \c NULL if \p f_rng is \c NULL or doesn't use a context.
  325. *
  326. * \return \c 0 on success.
  327. * \return An \c MBEDTLS_ERR_ECP_XXX, \c MBEDTLS_ERR_MPI_XXX or
  328. * \c MBEDTLS_ERR_ASN1_XXX error code on failure.
  329. */
  330. int mbedtls_ecdsa_write_signature( mbedtls_ecdsa_context *ctx,
  331. mbedtls_md_type_t md_alg,
  332. const unsigned char *hash, size_t hlen,
  333. unsigned char *sig, size_t *slen,
  334. int (*f_rng)(void *, unsigned char *, size_t),
  335. void *p_rng );
  336. /**
  337. * \brief This function computes the ECDSA signature and writes it
  338. * to a buffer, in a restartable way.
  339. *
  340. * \see \c mbedtls_ecdsa_write_signature()
  341. *
  342. * \note This function is like \c mbedtls_ecdsa_write_signature()
  343. * but it can return early and restart according to the limit
  344. * set with \c mbedtls_ecp_set_max_ops() to reduce blocking.
  345. *
  346. * \param ctx The ECDSA context to use. This must be initialized
  347. * and have a group and private key bound to it, for example
  348. * via mbedtls_ecdsa_genkey() or mbedtls_ecdsa_from_keypair().
  349. * \param md_alg The message digest that was used to hash the message.
  350. * \param hash The message hash to be signed. This must be a readable
  351. * buffer of length \p blen Bytes.
  352. * \param hlen The length of the hash \p hash in Bytes.
  353. * \param sig The buffer to which to write the signature. This must be a
  354. * writable buffer of length at least twice as large as the
  355. * size of the curve used, plus 9. For example, 73 Bytes if
  356. * a 256-bit curve is used. A buffer length of
  357. * #MBEDTLS_ECDSA_MAX_LEN is always safe.
  358. * \param slen The address at which to store the actual length of
  359. * the signature written. Must not be \c NULL.
  360. * \param f_rng The RNG function. This must not be \c NULL if
  361. * #MBEDTLS_ECDSA_DETERMINISTIC is unset. Otherwise,
  362. * it is unused and may be set to \c NULL.
  363. * \param p_rng The RNG context to be passed to \p f_rng. This may be
  364. * \c NULL if \p f_rng is \c NULL or doesn't use a context.
  365. * \param rs_ctx The restart context to use. This may be \c NULL to disable
  366. * restarting. If it is not \c NULL, it must point to an
  367. * initialized restart context.
  368. *
  369. * \return \c 0 on success.
  370. * \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of
  371. * operations was reached: see \c mbedtls_ecp_set_max_ops().
  372. * \return Another \c MBEDTLS_ERR_ECP_XXX, \c MBEDTLS_ERR_MPI_XXX or
  373. * \c MBEDTLS_ERR_ASN1_XXX error code on failure.
  374. */
  375. int mbedtls_ecdsa_write_signature_restartable( mbedtls_ecdsa_context *ctx,
  376. mbedtls_md_type_t md_alg,
  377. const unsigned char *hash, size_t hlen,
  378. unsigned char *sig, size_t *slen,
  379. int (*f_rng)(void *, unsigned char *, size_t),
  380. void *p_rng,
  381. mbedtls_ecdsa_restart_ctx *rs_ctx );
  382. #if defined(MBEDTLS_ECDSA_DETERMINISTIC)
  383. #if ! defined(MBEDTLS_DEPRECATED_REMOVED)
  384. #if defined(MBEDTLS_DEPRECATED_WARNING)
  385. #define MBEDTLS_DEPRECATED __attribute__((deprecated))
  386. #else
  387. #define MBEDTLS_DEPRECATED
  388. #endif
  389. /**
  390. * \brief This function computes an ECDSA signature and writes
  391. * it to a buffer, serialized as defined in <em>RFC-4492:
  392. * Elliptic Curve Cryptography (ECC) Cipher Suites for
  393. * Transport Layer Security (TLS)</em>.
  394. *
  395. * The deterministic version is defined in <em>RFC-6979:
  396. * Deterministic Usage of the Digital Signature Algorithm (DSA)
  397. * and Elliptic Curve Digital Signature Algorithm (ECDSA)</em>.
  398. *
  399. * \warning It is not thread-safe to use the same context in
  400. * multiple threads.
  401. *
  402. * \note If the bitlength of the message hash is larger than the
  403. * bitlength of the group order, then the hash is truncated as
  404. * defined in <em>Standards for Efficient Cryptography Group
  405. * (SECG): SEC1 Elliptic Curve Cryptography</em>, section
  406. * 4.1.3, step 5.
  407. *
  408. * \see ecp.h
  409. *
  410. * \deprecated Superseded by mbedtls_ecdsa_write_signature() in
  411. * Mbed TLS version 2.0 and later.
  412. *
  413. * \param ctx The ECDSA context to use. This must be initialized
  414. * and have a group and private key bound to it, for example
  415. * via mbedtls_ecdsa_genkey() or mbedtls_ecdsa_from_keypair().
  416. * \param hash The message hash to be signed. This must be a readable
  417. * buffer of length \p blen Bytes.
  418. * \param hlen The length of the hash \p hash in Bytes.
  419. * \param sig The buffer to which to write the signature. This must be a
  420. * writable buffer of length at least twice as large as the
  421. * size of the curve used, plus 9. For example, 73 Bytes if
  422. * a 256-bit curve is used. A buffer length of
  423. * #MBEDTLS_ECDSA_MAX_LEN is always safe.
  424. * \param slen The address at which to store the actual length of
  425. * the signature written. Must not be \c NULL.
  426. * \param md_alg The message digest that was used to hash the message.
  427. *
  428. * \return \c 0 on success.
  429. * \return An \c MBEDTLS_ERR_ECP_XXX, \c MBEDTLS_ERR_MPI_XXX or
  430. * \c MBEDTLS_ERR_ASN1_XXX error code on failure.
  431. */
  432. int mbedtls_ecdsa_write_signature_det( mbedtls_ecdsa_context *ctx,
  433. const unsigned char *hash, size_t hlen,
  434. unsigned char *sig, size_t *slen,
  435. mbedtls_md_type_t md_alg ) MBEDTLS_DEPRECATED;
  436. #undef MBEDTLS_DEPRECATED
  437. #endif /* MBEDTLS_DEPRECATED_REMOVED */
  438. #endif /* MBEDTLS_ECDSA_DETERMINISTIC */
  439. /**
  440. * \brief This function reads and verifies an ECDSA signature.
  441. *
  442. * \note If the bitlength of the message hash is larger than the
  443. * bitlength of the group order, then the hash is truncated as
  444. * defined in <em>Standards for Efficient Cryptography Group
  445. * (SECG): SEC1 Elliptic Curve Cryptography</em>, section
  446. * 4.1.4, step 3.
  447. *
  448. * \see ecp.h
  449. *
  450. * \param ctx The ECDSA context to use. This must be initialized
  451. * and have a group and public key bound to it.
  452. * \param hash The message hash that was signed. This must be a readable
  453. * buffer of length \p size Bytes.
  454. * \param hlen The size of the hash \p hash.
  455. * \param sig The signature to read and verify. This must be a readable
  456. * buffer of length \p slen Bytes.
  457. * \param slen The size of \p sig in Bytes.
  458. *
  459. * \return \c 0 on success.
  460. * \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if signature is invalid.
  461. * \return #MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH if there is a valid
  462. * signature in \p sig, but its length is less than \p siglen.
  463. * \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_ERR_MPI_XXX
  464. * error code on failure for any other reason.
  465. */
  466. int mbedtls_ecdsa_read_signature( mbedtls_ecdsa_context *ctx,
  467. const unsigned char *hash, size_t hlen,
  468. const unsigned char *sig, size_t slen );
  469. /**
  470. * \brief This function reads and verifies an ECDSA signature,
  471. * in a restartable way.
  472. *
  473. * \see \c mbedtls_ecdsa_read_signature()
  474. *
  475. * \note This function is like \c mbedtls_ecdsa_read_signature()
  476. * but it can return early and restart according to the limit
  477. * set with \c mbedtls_ecp_set_max_ops() to reduce blocking.
  478. *
  479. * \param ctx The ECDSA context to use. This must be initialized
  480. * and have a group and public key bound to it.
  481. * \param hash The message hash that was signed. This must be a readable
  482. * buffer of length \p size Bytes.
  483. * \param hlen The size of the hash \p hash.
  484. * \param sig The signature to read and verify. This must be a readable
  485. * buffer of length \p slen Bytes.
  486. * \param slen The size of \p sig in Bytes.
  487. * \param rs_ctx The restart context to use. This may be \c NULL to disable
  488. * restarting. If it is not \c NULL, it must point to an
  489. * initialized restart context.
  490. *
  491. * \return \c 0 on success.
  492. * \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if signature is invalid.
  493. * \return #MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH if there is a valid
  494. * signature in \p sig, but its length is less than \p siglen.
  495. * \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of
  496. * operations was reached: see \c mbedtls_ecp_set_max_ops().
  497. * \return Another \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_ERR_MPI_XXX
  498. * error code on failure for any other reason.
  499. */
  500. int mbedtls_ecdsa_read_signature_restartable( mbedtls_ecdsa_context *ctx,
  501. const unsigned char *hash, size_t hlen,
  502. const unsigned char *sig, size_t slen,
  503. mbedtls_ecdsa_restart_ctx *rs_ctx );
  504. /**
  505. * \brief This function generates an ECDSA keypair on the given curve.
  506. *
  507. * \see ecp.h
  508. *
  509. * \param ctx The ECDSA context to store the keypair in.
  510. * This must be initialized.
  511. * \param gid The elliptic curve to use. One of the various
  512. * \c MBEDTLS_ECP_DP_XXX macros depending on configuration.
  513. * \param f_rng The RNG function to use. This must not be \c NULL.
  514. * \param p_rng The RNG context to be passed to \p f_rng. This may be
  515. * \c NULL if \p f_rng doesn't need a context argument.
  516. *
  517. * \return \c 0 on success.
  518. * \return An \c MBEDTLS_ERR_ECP_XXX code on failure.
  519. */
  520. int mbedtls_ecdsa_genkey( mbedtls_ecdsa_context *ctx, mbedtls_ecp_group_id gid,
  521. int (*f_rng)(void *, unsigned char *, size_t), void *p_rng );
  522. /**
  523. * \brief This function sets up an ECDSA context from an EC key pair.
  524. *
  525. * \see ecp.h
  526. *
  527. * \param ctx The ECDSA context to setup. This must be initialized.
  528. * \param key The EC key to use. This must be initialized and hold
  529. * a private-public key pair or a public key. In the former
  530. * case, the ECDSA context may be used for signature creation
  531. * and verification after this call. In the latter case, it
  532. * may be used for signature verification.
  533. *
  534. * \return \c 0 on success.
  535. * \return An \c MBEDTLS_ERR_ECP_XXX code on failure.
  536. */
  537. int mbedtls_ecdsa_from_keypair( mbedtls_ecdsa_context *ctx,
  538. const mbedtls_ecp_keypair *key );
  539. /**
  540. * \brief This function initializes an ECDSA context.
  541. *
  542. * \param ctx The ECDSA context to initialize.
  543. * This must not be \c NULL.
  544. */
  545. void mbedtls_ecdsa_init( mbedtls_ecdsa_context *ctx );
  546. /**
  547. * \brief This function frees an ECDSA context.
  548. *
  549. * \param ctx The ECDSA context to free. This may be \c NULL,
  550. * in which case this function does nothing. If it
  551. * is not \c NULL, it must be initialized.
  552. */
  553. void mbedtls_ecdsa_free( mbedtls_ecdsa_context *ctx );
  554. #if defined(MBEDTLS_ECP_RESTARTABLE)
  555. /**
  556. * \brief Initialize a restart context.
  557. *
  558. * \param ctx The restart context to initialize.
  559. * This must not be \c NULL.
  560. */
  561. void mbedtls_ecdsa_restart_init( mbedtls_ecdsa_restart_ctx *ctx );
  562. /**
  563. * \brief Free the components of a restart context.
  564. *
  565. * \param ctx The restart context to free. This may be \c NULL,
  566. * in which case this function does nothing. If it
  567. * is not \c NULL, it must be initialized.
  568. */
  569. void mbedtls_ecdsa_restart_free( mbedtls_ecdsa_restart_ctx *ctx );
  570. #endif /* MBEDTLS_ECP_RESTARTABLE */
  571. #ifdef __cplusplus
  572. }
  573. #endif
  574. #endif /* ecdsa.h */