OpenSSL  1.0.1c
 All Classes Files Functions Variables Typedefs Enumerations Enumerator Macros
ecdsatest.c
Go to the documentation of this file.
1 /* crypto/ecdsa/ecdsatest.c */
2 /*
3  * Written by Nils Larsch for the OpenSSL project.
4  */
5 /* ====================================================================
6  * Copyright (c) 2000-2005 The OpenSSL Project. All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  * 1. Redistributions of source code must retain the above copyright
13  * notice, this list of conditions and the following disclaimer.
14  *
15  * 2. Redistributions in binary form must reproduce the above copyright
16  * notice, this list of conditions and the following disclaimer in
17  * the documentation and/or other materials provided with the
18  * distribution.
19  *
20  * 3. All advertising materials mentioning features or use of this
21  * software must display the following acknowledgment:
22  * "This product includes software developed by the OpenSSL Project
23  * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24  *
25  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26  * endorse or promote products derived from this software without
27  * prior written permission. For written permission, please contact
28  * [email protected].
29  *
30  * 5. Products derived from this software may not be called "OpenSSL"
31  * nor may "OpenSSL" appear in their names without prior written
32  * permission of the OpenSSL Project.
33  *
34  * 6. Redistributions of any form whatsoever must retain the following
35  * acknowledgment:
36  * "This product includes software developed by the OpenSSL Project
37  * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38  *
39  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42  * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50  * OF THE POSSIBILITY OF SUCH DAMAGE.
51  * ====================================================================
52  *
53  * This product includes cryptographic software written by Eric Young
54  * ([email protected]). This product includes software written by Tim
55  * Hudson ([email protected]).
56  *
57  */
58 /* ====================================================================
59  * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
60  *
61  * Portions of the attached software ("Contribution") are developed by
62  * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
63  *
64  * The Contribution is licensed pursuant to the OpenSSL open source
65  * license provided above.
66  *
67  * The elliptic curve binary polynomial software is originally written by
68  * Sheueling Chang Shantz and Douglas Stebila of Sun Microsystems Laboratories.
69  *
70  */
71 
72 #include <stdio.h>
73 #include <stdlib.h>
74 #include <string.h>
75 
76 #include <openssl/opensslconf.h> /* To see if OPENSSL_NO_ECDSA is defined */
77 
78 #ifdef OPENSSL_NO_ECDSA
79 int main(int argc, char * argv[])
80  {
81  puts("Elliptic curves are disabled.");
82  return 0;
83  }
84 #else
85 
86 #include <openssl/crypto.h>
87 #include <openssl/bio.h>
88 #include <openssl/evp.h>
89 #include <openssl/bn.h>
90 #include <openssl/ecdsa.h>
91 #ifndef OPENSSL_NO_ENGINE
92 #include <openssl/engine.h>
93 #endif
94 #include <openssl/err.h>
95 #include <openssl/rand.h>
96 
97 static const char rnd_seed[] = "string to make the random number generator "
98  "think it has entropy";
99 
100 /* declaration of the test functions */
101 int x9_62_tests(BIO *);
102 int x9_62_test_internal(BIO *out, int nid, const char *r, const char *s);
103 int test_builtin(BIO *);
104 
105 /* functions to change the RAND_METHOD */
106 int change_rand(void);
107 int restore_rand(void);
108 int fbytes(unsigned char *buf, int num);
109 
110 RAND_METHOD fake_rand;
111 const RAND_METHOD *old_rand;
112 
113 int change_rand(void)
114  {
115  /* save old rand method */
116  if ((old_rand = RAND_get_rand_method()) == NULL)
117  return 0;
118 
119  fake_rand.seed = old_rand->seed;
120  fake_rand.cleanup = old_rand->cleanup;
121  fake_rand.add = old_rand->add;
122  fake_rand.status = old_rand->status;
123  /* use own random function */
124  fake_rand.bytes = fbytes;
125  fake_rand.pseudorand = old_rand->bytes;
126  /* set new RAND_METHOD */
127  if (!RAND_set_rand_method(&fake_rand))
128  return 0;
129  return 1;
130  }
131 
132 int restore_rand(void)
133  {
134  if (!RAND_set_rand_method(old_rand))
135  return 0;
136  else
137  return 1;
138  }
139 
140 static int fbytes_counter = 0;
141 static const char *numbers[8] = {
142  "651056770906015076056810763456358567190100156695615665659",
143  "6140507067065001063065065565667405560006161556565665656654",
144  "8763001015071075675010661307616710783570106710677817767166"
145  "71676178726717",
146  "7000000175690566466555057817571571075705015757757057795755"
147  "55657156756655",
148  "1275552191113212300012030439187146164646146646466749494799",
149  "1542725565216523985789236956265265265235675811949404040041",
150  "1456427555219115346513212300075341203043918714616464614664"
151  "64667494947990",
152  "1712787255652165239672857892369562652652652356758119494040"
153  "40041670216363"};
154 
155 int fbytes(unsigned char *buf, int num)
156  {
157  int ret;
158  BIGNUM *tmp = NULL;
159 
160  if (fbytes_counter >= 8)
161  return 0;
162  tmp = BN_new();
163  if (!tmp)
164  return 0;
165  if (!BN_dec2bn(&tmp, numbers[fbytes_counter]))
166  {
167  BN_free(tmp);
168  return 0;
169  }
170  fbytes_counter ++;
171  if (num != BN_num_bytes(tmp) || !BN_bn2bin(tmp, buf))
172  ret = 0;
173  else
174  ret = 1;
175  if (tmp)
176  BN_free(tmp);
177  return ret;
178  }
179 
180 /* some tests from the X9.62 draft */
181 int x9_62_test_internal(BIO *out, int nid, const char *r_in, const char *s_in)
182  {
183  int ret = 0;
184  const char message[] = "abc";
185  unsigned char digest[20];
186  unsigned int dgst_len = 0;
187  EVP_MD_CTX md_ctx;
188  EC_KEY *key = NULL;
189  ECDSA_SIG *signature = NULL;
190  BIGNUM *r = NULL, *s = NULL;
191 
192  EVP_MD_CTX_init(&md_ctx);
193  /* get the message digest */
194  EVP_DigestInit(&md_ctx, EVP_ecdsa());
195  EVP_DigestUpdate(&md_ctx, (const void*)message, 3);
196  EVP_DigestFinal(&md_ctx, digest, &dgst_len);
197 
198  BIO_printf(out, "testing %s: ", OBJ_nid2sn(nid));
199  /* create the key */
200  if ((key = EC_KEY_new_by_curve_name(nid)) == NULL)
201  goto x962_int_err;
202  if (!EC_KEY_generate_key(key))
203  goto x962_int_err;
204  BIO_printf(out, ".");
205  (void)BIO_flush(out);
206  /* create the signature */
207  signature = ECDSA_do_sign(digest, 20, key);
208  if (signature == NULL)
209  goto x962_int_err;
210  BIO_printf(out, ".");
211  (void)BIO_flush(out);
212  /* compare the created signature with the expected signature */
213  if ((r = BN_new()) == NULL || (s = BN_new()) == NULL)
214  goto x962_int_err;
215  if (!BN_dec2bn(&r, r_in) ||
216  !BN_dec2bn(&s, s_in))
217  goto x962_int_err;
218  if (BN_cmp(signature->r ,r) || BN_cmp(signature->s, s))
219  goto x962_int_err;
220  BIO_printf(out, ".");
221  (void)BIO_flush(out);
222  /* verify the signature */
223  if (ECDSA_do_verify(digest, 20, signature, key) != 1)
224  goto x962_int_err;
225  BIO_printf(out, ".");
226  (void)BIO_flush(out);
227 
228  BIO_printf(out, " ok\n");
229  ret = 1;
230 x962_int_err:
231  if (!ret)
232  BIO_printf(out, " failed\n");
233  if (key)
234  EC_KEY_free(key);
235  if (signature)
236  ECDSA_SIG_free(signature);
237  if (r)
238  BN_free(r);
239  if (s)
240  BN_free(s);
241  EVP_MD_CTX_cleanup(&md_ctx);
242  return ret;
243  }
244 
245 int x9_62_tests(BIO *out)
246  {
247  int ret = 0;
248 
249  BIO_printf(out, "some tests from X9.62:\n");
250 
251  /* set own rand method */
252  if (!change_rand())
253  goto x962_err;
254 
255  if (!x9_62_test_internal(out, NID_X9_62_prime192v1,
256  "3342403536405981729393488334694600415596881826869351677613",
257  "5735822328888155254683894997897571951568553642892029982342"))
258  goto x962_err;
259  if (!x9_62_test_internal(out, NID_X9_62_prime239v1,
260  "3086361431751678114926225473006680188549593787585317781474"
261  "62058306432176",
262  "3238135532097973577080787768312505059318910517550078427819"
263  "78505179448783"))
264  goto x962_err;
265 #ifndef OPENSSL_NO_EC2M
266  if (!x9_62_test_internal(out, NID_X9_62_c2tnb191v1,
267  "87194383164871543355722284926904419997237591535066528048",
268  "308992691965804947361541664549085895292153777025772063598"))
269  goto x962_err;
270  if (!x9_62_test_internal(out, NID_X9_62_c2tnb239v1,
271  "2159633321041961198501834003903461262881815148684178964245"
272  "5876922391552",
273  "1970303740007316867383349976549972270528498040721988191026"
274  "49413465737174"))
275  goto x962_err;
276 #endif
277  ret = 1;
278 x962_err:
279  if (!restore_rand())
280  ret = 0;
281  return ret;
282  }
283 
284 int test_builtin(BIO *out)
285  {
286  EC_builtin_curve *curves = NULL;
287  size_t crv_len = 0, n = 0;
288  EC_KEY *eckey = NULL, *wrong_eckey = NULL;
289  EC_GROUP *group;
290  ECDSA_SIG *ecdsa_sig = NULL;
291  unsigned char digest[20], wrong_digest[20];
292  unsigned char *signature = NULL;
293  const unsigned char *sig_ptr;
294  unsigned char *sig_ptr2;
295  unsigned char *raw_buf = NULL;
296  unsigned int sig_len, degree, r_len, s_len, bn_len, buf_len;
297  int nid, ret = 0;
298 
299  /* fill digest values with some random data */
300  if (!RAND_pseudo_bytes(digest, 20) ||
301  !RAND_pseudo_bytes(wrong_digest, 20))
302  {
303  BIO_printf(out, "ERROR: unable to get random data\n");
304  goto builtin_err;
305  }
306 
307  /* create and verify a ecdsa signature with every availble curve
308  * (with ) */
309  BIO_printf(out, "\ntesting ECDSA_sign() and ECDSA_verify() "
310  "with some internal curves:\n");
311 
312  /* get a list of all internal curves */
313  crv_len = EC_get_builtin_curves(NULL, 0);
314 
315  curves = OPENSSL_malloc(sizeof(EC_builtin_curve) * crv_len);
316 
317  if (curves == NULL)
318  {
319  BIO_printf(out, "malloc error\n");
320  goto builtin_err;
321  }
322 
323  if (!EC_get_builtin_curves(curves, crv_len))
324  {
325  BIO_printf(out, "unable to get internal curves\n");
326  goto builtin_err;
327  }
328 
329  /* now create and verify a signature for every curve */
330  for (n = 0; n < crv_len; n++)
331  {
332  unsigned char dirt, offset;
333 
334  nid = curves[n].nid;
335  if (nid == NID_ipsec4)
336  continue;
337  /* create new ecdsa key (== EC_KEY) */
338  if ((eckey = EC_KEY_new()) == NULL)
339  goto builtin_err;
340  group = EC_GROUP_new_by_curve_name(nid);
341  if (group == NULL)
342  goto builtin_err;
343  if (EC_KEY_set_group(eckey, group) == 0)
344  goto builtin_err;
345  EC_GROUP_free(group);
346  degree = EC_GROUP_get_degree(EC_KEY_get0_group(eckey));
347  if (degree < 160)
348  /* drop the curve */
349  {
350  EC_KEY_free(eckey);
351  eckey = NULL;
352  continue;
353  }
354  BIO_printf(out, "%s: ", OBJ_nid2sn(nid));
355  /* create key */
356  if (!EC_KEY_generate_key(eckey))
357  {
358  BIO_printf(out, " failed\n");
359  goto builtin_err;
360  }
361  /* create second key */
362  if ((wrong_eckey = EC_KEY_new()) == NULL)
363  goto builtin_err;
364  group = EC_GROUP_new_by_curve_name(nid);
365  if (group == NULL)
366  goto builtin_err;
367  if (EC_KEY_set_group(wrong_eckey, group) == 0)
368  goto builtin_err;
369  EC_GROUP_free(group);
370  if (!EC_KEY_generate_key(wrong_eckey))
371  {
372  BIO_printf(out, " failed\n");
373  goto builtin_err;
374  }
375 
376  BIO_printf(out, ".");
377  (void)BIO_flush(out);
378  /* check key */
379  if (!EC_KEY_check_key(eckey))
380  {
381  BIO_printf(out, " failed\n");
382  goto builtin_err;
383  }
384  BIO_printf(out, ".");
385  (void)BIO_flush(out);
386  /* create signature */
387  sig_len = ECDSA_size(eckey);
388  if ((signature = OPENSSL_malloc(sig_len)) == NULL)
389  goto builtin_err;
390  if (!ECDSA_sign(0, digest, 20, signature, &sig_len, eckey))
391  {
392  BIO_printf(out, " failed\n");
393  goto builtin_err;
394  }
395  BIO_printf(out, ".");
396  (void)BIO_flush(out);
397  /* verify signature */
398  if (ECDSA_verify(0, digest, 20, signature, sig_len, eckey) != 1)
399  {
400  BIO_printf(out, " failed\n");
401  goto builtin_err;
402  }
403  BIO_printf(out, ".");
404  (void)BIO_flush(out);
405  /* verify signature with the wrong key */
406  if (ECDSA_verify(0, digest, 20, signature, sig_len,
407  wrong_eckey) == 1)
408  {
409  BIO_printf(out, " failed\n");
410  goto builtin_err;
411  }
412  BIO_printf(out, ".");
413  (void)BIO_flush(out);
414  /* wrong digest */
415  if (ECDSA_verify(0, wrong_digest, 20, signature, sig_len,
416  eckey) == 1)
417  {
418  BIO_printf(out, " failed\n");
419  goto builtin_err;
420  }
421  BIO_printf(out, ".");
422  (void)BIO_flush(out);
423  /* wrong length */
424  if (ECDSA_verify(0, digest, 20, signature, sig_len - 1,
425  eckey) == 1)
426  {
427  BIO_printf(out, " failed\n");
428  goto builtin_err;
429  }
430  BIO_printf(out, ".");
431  (void)BIO_flush(out);
432 
433  /* Modify a single byte of the signature: to ensure we don't
434  * garble the ASN1 structure, we read the raw signature and
435  * modify a byte in one of the bignums directly. */
436  sig_ptr = signature;
437  if ((ecdsa_sig = d2i_ECDSA_SIG(NULL, &sig_ptr, sig_len)) == NULL)
438  {
439  BIO_printf(out, " failed\n");
440  goto builtin_err;
441  }
442 
443  /* Store the two BIGNUMs in raw_buf. */
444  r_len = BN_num_bytes(ecdsa_sig->r);
445  s_len = BN_num_bytes(ecdsa_sig->s);
446  bn_len = (degree + 7) / 8;
447  if ((r_len > bn_len) || (s_len > bn_len))
448  {
449  BIO_printf(out, " failed\n");
450  goto builtin_err;
451  }
452  buf_len = 2 * bn_len;
453  if ((raw_buf = OPENSSL_malloc(buf_len)) == NULL)
454  goto builtin_err;
455  /* Pad the bignums with leading zeroes. */
456  memset(raw_buf, 0, buf_len);
457  BN_bn2bin(ecdsa_sig->r, raw_buf + bn_len - r_len);
458  BN_bn2bin(ecdsa_sig->s, raw_buf + buf_len - s_len);
459 
460  /* Modify a single byte in the buffer. */
461  offset = raw_buf[10] % buf_len;
462  dirt = raw_buf[11] ? raw_buf[11] : 1;
463  raw_buf[offset] ^= dirt;
464  /* Now read the BIGNUMs back in from raw_buf. */
465  if ((BN_bin2bn(raw_buf, bn_len, ecdsa_sig->r) == NULL) ||
466  (BN_bin2bn(raw_buf + bn_len, bn_len, ecdsa_sig->s) == NULL))
467  goto builtin_err;
468 
469  sig_ptr2 = signature;
470  sig_len = i2d_ECDSA_SIG(ecdsa_sig, &sig_ptr2);
471  if (ECDSA_verify(0, digest, 20, signature, sig_len, eckey) == 1)
472  {
473  BIO_printf(out, " failed\n");
474  goto builtin_err;
475  }
476  /* Sanity check: undo the modification and verify signature. */
477  raw_buf[offset] ^= dirt;
478  if ((BN_bin2bn(raw_buf, bn_len, ecdsa_sig->r) == NULL) ||
479  (BN_bin2bn(raw_buf + bn_len, bn_len, ecdsa_sig->s) == NULL))
480  goto builtin_err;
481 
482  sig_ptr2 = signature;
483  sig_len = i2d_ECDSA_SIG(ecdsa_sig, &sig_ptr2);
484  if (ECDSA_verify(0, digest, 20, signature, sig_len, eckey) != 1)
485  {
486  BIO_printf(out, " failed\n");
487  goto builtin_err;
488  }
489  BIO_printf(out, ".");
490  (void)BIO_flush(out);
491 
492  BIO_printf(out, " ok\n");
493  /* cleanup */
494  /* clean bogus errors */
495  ERR_clear_error();
496  OPENSSL_free(signature);
497  signature = NULL;
498  EC_KEY_free(eckey);
499  eckey = NULL;
500  EC_KEY_free(wrong_eckey);
501  wrong_eckey = NULL;
502  ECDSA_SIG_free(ecdsa_sig);
503  ecdsa_sig = NULL;
504  OPENSSL_free(raw_buf);
505  raw_buf = NULL;
506  }
507 
508  ret = 1;
509 builtin_err:
510  if (eckey)
511  EC_KEY_free(eckey);
512  if (wrong_eckey)
513  EC_KEY_free(wrong_eckey);
514  if (ecdsa_sig)
515  ECDSA_SIG_free(ecdsa_sig);
516  if (signature)
517  OPENSSL_free(signature);
518  if (raw_buf)
519  OPENSSL_free(raw_buf);
520  if (curves)
521  OPENSSL_free(curves);
522 
523  return ret;
524  }
525 
526 int main(void)
527  {
528  int ret = 1;
529  BIO *out;
530 
531  out = BIO_new_fp(stdout, BIO_NOCLOSE);
532 
533  /* enable memory leak checking unless explicitly disabled */
534  if (!((getenv("OPENSSL_DEBUG_MEMORY") != NULL) &&
535  (0 == strcmp(getenv("OPENSSL_DEBUG_MEMORY"), "off"))))
536  {
537  CRYPTO_malloc_debug_init();
538  CRYPTO_set_mem_debug_options(V_CRYPTO_MDEBUG_ALL);
539  }
540  else
541  {
542  /* OPENSSL_DEBUG_MEMORY=off */
543  CRYPTO_set_mem_debug_functions(0, 0, 0, 0, 0);
544  }
545  CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
546 
547  ERR_load_crypto_strings();
548 
549  /* initialize the prng */
550  RAND_seed(rnd_seed, sizeof(rnd_seed));
551 
552  /* the tests */
553  if (!x9_62_tests(out)) goto err;
554  if (!test_builtin(out)) goto err;
555 
556  ret = 0;
557 err:
558  if (ret)
559  BIO_printf(out, "\nECDSA test failed\n");
560  else
561  BIO_printf(out, "\nECDSA test passed\n");
562  if (ret)
563  ERR_print_errors(out);
564  CRYPTO_cleanup_all_ex_data();
565  ERR_remove_thread_state(NULL);
566  ERR_free_strings();
567  CRYPTO_mem_leaks(out);
568  if (out != NULL)
569  BIO_free(out);
570  return ret;
571  }
572 #endif
Generated on Thu Jan 10 2013 09:53:36 for OpenSSL by   doxygen 1.8.2