1/* ==================================================================== 2 * Copyright (c) 1998-2005 The OpenSSL Project. All rights reserved. 3 * 4 * Redistribution and use in source and binary forms, with or without 5 * modification, are permitted provided that the following conditions 6 * are met: 7 * 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in 13 * the documentation and/or other materials provided with the 14 * distribution. 15 * 16 * 3. All advertising materials mentioning features or use of this 17 * software must display the following acknowledgment: 18 * "This product includes software developed by the OpenSSL Project 19 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" 20 * 21 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 22 * endorse or promote products derived from this software without 23 * prior written permission. For written permission, please contact 24 * openssl-core@OpenSSL.org. 25 * 26 * 5. Products derived from this software may not be called "OpenSSL" 27 * nor may "OpenSSL" appear in their names without prior written 28 * permission of the OpenSSL Project. 29 * 30 * 6. Redistributions of any form whatsoever must retain the following 31 * acknowledgment: 32 * "This product includes software developed by the OpenSSL Project 33 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" 34 * 35 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 36 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 37 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 38 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 39 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 40 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 41 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 42 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 43 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 44 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 45 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 46 * OF THE POSSIBILITY OF SUCH DAMAGE. 47 * ==================================================================== 48 * 49 * This product includes cryptographic software written by Eric Young 50 * (eay@cryptsoft.com). This product includes software written by Tim 51 * Hudson (tjh@cryptsoft.com). */ 52 53#include <openssl/ecdsa.h> 54 55#include <vector> 56 57#include <gtest/gtest.h> 58 59#include <openssl/bn.h> 60#include <openssl/crypto.h> 61#include <openssl/ec.h> 62#include <openssl/err.h> 63#include <openssl/mem.h> 64#include <openssl/nid.h> 65#include <openssl/rand.h> 66 67#include "../ec/internal.h" 68#include "../../test/file_test.h" 69 70 71enum API { 72 kEncodedAPI, 73 kRawAPI, 74}; 75 76// VerifyECDSASig checks that verifying |ecdsa_sig| gives |expected_result|. 77static void VerifyECDSASig(API api, const uint8_t *digest, size_t digest_len, 78 const ECDSA_SIG *ecdsa_sig, EC_KEY *eckey, 79 int expected_result) { 80 switch (api) { 81 case kEncodedAPI: { 82 uint8_t *der; 83 size_t der_len; 84 ASSERT_TRUE(ECDSA_SIG_to_bytes(&der, &der_len, ecdsa_sig)); 85 bssl::UniquePtr<uint8_t> delete_der(der); 86 EXPECT_EQ(expected_result, 87 ECDSA_verify(0, digest, digest_len, der, der_len, eckey)); 88 break; 89 } 90 91 case kRawAPI: 92 EXPECT_EQ(expected_result, 93 ECDSA_do_verify(digest, digest_len, ecdsa_sig, eckey)); 94 break; 95 96 default: 97 FAIL() << "Unknown API type."; 98 } 99} 100 101// TestTamperedSig verifies that signature verification fails when a valid 102// signature is tampered with. |ecdsa_sig| must be a valid signature, which will 103// be modified. 104static void TestTamperedSig(API api, const uint8_t *digest, 105 size_t digest_len, ECDSA_SIG *ecdsa_sig, 106 EC_KEY *eckey, const BIGNUM *order) { 107 SCOPED_TRACE(api); 108 // Modify a single byte of the signature: to ensure we don't 109 // garble the ASN1 structure, we read the raw signature and 110 // modify a byte in one of the bignums directly. 111 112 // Store the two BIGNUMs in raw_buf. 113 size_t r_len = BN_num_bytes(ecdsa_sig->r); 114 size_t s_len = BN_num_bytes(ecdsa_sig->s); 115 size_t bn_len = BN_num_bytes(order); 116 ASSERT_LE(r_len, bn_len); 117 ASSERT_LE(s_len, bn_len); 118 size_t buf_len = 2 * bn_len; 119 std::vector<uint8_t> raw_buf(buf_len); 120 // Pad the bignums with leading zeroes. 121 ASSERT_TRUE(BN_bn2bin_padded(raw_buf.data(), bn_len, ecdsa_sig->r)); 122 ASSERT_TRUE(BN_bn2bin_padded(raw_buf.data() + bn_len, bn_len, ecdsa_sig->s)); 123 124 // Modify a single byte in the buffer. 125 size_t offset = raw_buf[10] % buf_len; 126 uint8_t dirt = raw_buf[11] ? raw_buf[11] : 1; 127 raw_buf[offset] ^= dirt; 128 // Now read the BIGNUMs back in from raw_buf. 129 ASSERT_TRUE(BN_bin2bn(raw_buf.data(), bn_len, ecdsa_sig->r)); 130 ASSERT_TRUE(BN_bin2bn(raw_buf.data() + bn_len, bn_len, ecdsa_sig->s)); 131 VerifyECDSASig(api, digest, digest_len, ecdsa_sig, eckey, 0); 132 133 // Sanity check: Undo the modification and verify signature. 134 raw_buf[offset] ^= dirt; 135 ASSERT_TRUE(BN_bin2bn(raw_buf.data(), bn_len, ecdsa_sig->r)); 136 ASSERT_TRUE(BN_bin2bn(raw_buf.data() + bn_len, bn_len, ecdsa_sig->s)); 137 VerifyECDSASig(api, digest, digest_len, ecdsa_sig, eckey, 1); 138} 139 140TEST(ECDSATest, BuiltinCurves) { 141 // Fill digest values with some random data. 142 uint8_t digest[20], wrong_digest[20]; 143 ASSERT_TRUE(RAND_bytes(digest, 20)); 144 ASSERT_TRUE(RAND_bytes(wrong_digest, 20)); 145 146 static const struct { 147 int nid; 148 const char *name; 149 } kCurves[] = { 150 { NID_secp224r1, "secp224r1" }, 151 { NID_X9_62_prime256v1, "secp256r1" }, 152 { NID_secp384r1, "secp384r1" }, 153 { NID_secp521r1, "secp521r1" }, 154 }; 155 156 for (const auto &curve : kCurves) { 157 SCOPED_TRACE(curve.name); 158 159 int nid = curve.nid; 160 bssl::UniquePtr<EC_GROUP> group(EC_GROUP_new_by_curve_name(nid)); 161 ASSERT_TRUE(group); 162 const BIGNUM *order = EC_GROUP_get0_order(group.get()); 163 164 // Create a new ECDSA key. 165 bssl::UniquePtr<EC_KEY> eckey(EC_KEY_new()); 166 ASSERT_TRUE(eckey); 167 ASSERT_TRUE(EC_KEY_set_group(eckey.get(), group.get())); 168 ASSERT_TRUE(EC_KEY_generate_key(eckey.get())); 169 170 // Create a second key. 171 bssl::UniquePtr<EC_KEY> wrong_eckey(EC_KEY_new()); 172 ASSERT_TRUE(wrong_eckey); 173 ASSERT_TRUE(EC_KEY_set_group(wrong_eckey.get(), group.get())); 174 ASSERT_TRUE(EC_KEY_generate_key(wrong_eckey.get())); 175 176 // Check the key. 177 EXPECT_TRUE(EC_KEY_check_key(eckey.get())); 178 179 // Test ASN.1-encoded signatures. 180 // Create a signature. 181 unsigned sig_len = ECDSA_size(eckey.get()); 182 std::vector<uint8_t> signature(sig_len); 183 ASSERT_TRUE( 184 ECDSA_sign(0, digest, 20, signature.data(), &sig_len, eckey.get())); 185 signature.resize(sig_len); 186 187 // Verify the signature. 188 EXPECT_TRUE(ECDSA_verify(0, digest, 20, signature.data(), signature.size(), 189 eckey.get())); 190 191 // Verify the signature with the wrong key. 192 EXPECT_FALSE(ECDSA_verify(0, digest, 20, signature.data(), signature.size(), 193 wrong_eckey.get())); 194 ERR_clear_error(); 195 196 // Verify the signature using the wrong digest. 197 EXPECT_FALSE(ECDSA_verify(0, wrong_digest, 20, signature.data(), 198 signature.size(), eckey.get())); 199 ERR_clear_error(); 200 201 // Verify a truncated signature. 202 EXPECT_FALSE(ECDSA_verify(0, digest, 20, signature.data(), 203 signature.size() - 1, eckey.get())); 204 ERR_clear_error(); 205 206 // Verify a tampered signature. 207 bssl::UniquePtr<ECDSA_SIG> ecdsa_sig( 208 ECDSA_SIG_from_bytes(signature.data(), signature.size())); 209 ASSERT_TRUE(ecdsa_sig); 210 TestTamperedSig(kEncodedAPI, digest, 20, ecdsa_sig.get(), eckey.get(), 211 order); 212 213 // Test ECDSA_SIG signing and verification. 214 // Create a signature. 215 ecdsa_sig.reset(ECDSA_do_sign(digest, 20, eckey.get())); 216 ASSERT_TRUE(ecdsa_sig); 217 218 // Verify the signature using the correct key. 219 EXPECT_TRUE(ECDSA_do_verify(digest, 20, ecdsa_sig.get(), eckey.get())); 220 221 // Verify the signature with the wrong key. 222 EXPECT_FALSE( 223 ECDSA_do_verify(digest, 20, ecdsa_sig.get(), wrong_eckey.get())); 224 ERR_clear_error(); 225 226 // Verify the signature using the wrong digest. 227 EXPECT_FALSE( 228 ECDSA_do_verify(wrong_digest, 20, ecdsa_sig.get(), eckey.get())); 229 ERR_clear_error(); 230 231 // Verify a tampered signature. 232 TestTamperedSig(kRawAPI, digest, 20, ecdsa_sig.get(), eckey.get(), order); 233 } 234} 235 236static size_t BitsToBytes(size_t bits) { 237 return (bits / 8) + (7 + (bits % 8)) / 8; 238} 239 240TEST(ECDSATest, MaxSigLen) { 241 static const size_t kBits[] = {224, 256, 384, 521, 10000}; 242 for (size_t bits : kBits) { 243 SCOPED_TRACE(bits); 244 size_t order_len = BitsToBytes(bits); 245 246 // Create the largest possible |ECDSA_SIG| of the given constraints. 247 bssl::UniquePtr<ECDSA_SIG> sig(ECDSA_SIG_new()); 248 ASSERT_TRUE(sig); 249 std::vector<uint8_t> bytes(order_len, 0xff); 250 ASSERT_TRUE(BN_bin2bn(bytes.data(), bytes.size(), sig->r)); 251 ASSERT_TRUE(BN_bin2bn(bytes.data(), bytes.size(), sig->s)); 252 // Serialize it. 253 uint8_t *der; 254 size_t der_len; 255 ASSERT_TRUE(ECDSA_SIG_to_bytes(&der, &der_len, sig.get())); 256 OPENSSL_free(der); 257 258 EXPECT_EQ(der_len, ECDSA_SIG_max_len(order_len)); 259 } 260} 261 262static bssl::UniquePtr<EC_GROUP> GetCurve(FileTest *t, const char *key) { 263 std::string curve_name; 264 if (!t->GetAttribute(&curve_name, key)) { 265 return nullptr; 266 } 267 268 if (curve_name == "P-224") { 269 return bssl::UniquePtr<EC_GROUP>(EC_GROUP_new_by_curve_name(NID_secp224r1)); 270 } 271 if (curve_name == "P-256") { 272 return bssl::UniquePtr<EC_GROUP>( 273 EC_GROUP_new_by_curve_name(NID_X9_62_prime256v1)); 274 } 275 if (curve_name == "P-384") { 276 return bssl::UniquePtr<EC_GROUP>(EC_GROUP_new_by_curve_name(NID_secp384r1)); 277 } 278 if (curve_name == "P-521") { 279 return bssl::UniquePtr<EC_GROUP>(EC_GROUP_new_by_curve_name(NID_secp521r1)); 280 } 281 282 ADD_FAILURE() << "Unknown curve: " << curve_name; 283 return nullptr; 284} 285 286static bssl::UniquePtr<EC_GROUP> MakeCustomClone(const EC_GROUP *group) { 287 bssl::UniquePtr<BN_CTX> ctx(BN_CTX_new()); 288 bssl::UniquePtr<BIGNUM> p(BN_new()), a(BN_new()), b(BN_new()), x(BN_new()), 289 y(BN_new()); 290 if (!ctx || !p || !a || !b || !x || !y || 291 !EC_GROUP_get_curve_GFp(group, p.get(), a.get(), b.get(), ctx.get()) || 292 !EC_POINT_get_affine_coordinates_GFp( 293 group, EC_GROUP_get0_generator(group), x.get(), y.get(), ctx.get())) { 294 return nullptr; 295 } 296 bssl::UniquePtr<EC_GROUP> ret( 297 EC_GROUP_new_curve_GFp(p.get(), a.get(), b.get(), ctx.get())); 298 if (!ret) { 299 return nullptr; 300 } 301 bssl::UniquePtr<EC_POINT> g(EC_POINT_new(ret.get())); 302 if (!g || 303 !EC_POINT_set_affine_coordinates_GFp(ret.get(), g.get(), x.get(), y.get(), 304 ctx.get()) || 305 !EC_GROUP_set_generator(ret.get(), g.get(), EC_GROUP_get0_order(group), 306 BN_value_one())) { 307 return nullptr; 308 } 309 return ret; 310} 311 312static bssl::UniquePtr<BIGNUM> GetBIGNUM(FileTest *t, const char *key) { 313 std::vector<uint8_t> bytes; 314 if (!t->GetBytes(&bytes, key)) { 315 return nullptr; 316 } 317 318 return bssl::UniquePtr<BIGNUM>(BN_bin2bn(bytes.data(), bytes.size(), nullptr)); 319} 320 321TEST(ECDSATest, VerifyTestVectors) { 322 FileTestGTest("crypto/fipsmodule/ecdsa/ecdsa_verify_tests.txt", 323 [](FileTest *t) { 324 for (bool custom_group : {false, true}) { 325 SCOPED_TRACE(custom_group); 326 bssl::UniquePtr<EC_GROUP> group = GetCurve(t, "Curve"); 327 ASSERT_TRUE(group); 328 if (custom_group) { 329 group = MakeCustomClone(group.get()); 330 ASSERT_TRUE(group); 331 } 332 bssl::UniquePtr<BIGNUM> x = GetBIGNUM(t, "X"); 333 ASSERT_TRUE(x); 334 bssl::UniquePtr<BIGNUM> y = GetBIGNUM(t, "Y"); 335 ASSERT_TRUE(y); 336 bssl::UniquePtr<BIGNUM> r = GetBIGNUM(t, "R"); 337 ASSERT_TRUE(r); 338 bssl::UniquePtr<BIGNUM> s = GetBIGNUM(t, "S"); 339 ASSERT_TRUE(s); 340 std::vector<uint8_t> digest; 341 ASSERT_TRUE(t->GetBytes(&digest, "Digest")); 342 343 bssl::UniquePtr<EC_KEY> key(EC_KEY_new()); 344 ASSERT_TRUE(key); 345 bssl::UniquePtr<EC_POINT> pub_key(EC_POINT_new(group.get())); 346 ASSERT_TRUE(pub_key); 347 bssl::UniquePtr<ECDSA_SIG> sig(ECDSA_SIG_new()); 348 ASSERT_TRUE(sig); 349 ASSERT_TRUE(EC_KEY_set_group(key.get(), group.get())); 350 ASSERT_TRUE(EC_POINT_set_affine_coordinates_GFp( 351 group.get(), pub_key.get(), x.get(), y.get(), nullptr)); 352 ASSERT_TRUE(EC_KEY_set_public_key(key.get(), pub_key.get())); 353 ASSERT_TRUE(BN_copy(sig->r, r.get())); 354 ASSERT_TRUE(BN_copy(sig->s, s.get())); 355 356 EXPECT_EQ( 357 t->HasAttribute("Invalid") ? 0 : 1, 358 ECDSA_do_verify(digest.data(), digest.size(), sig.get(), key.get())); 359 } 360 }); 361} 362 363TEST(ECDSATest, SignTestVectors) { 364 FileTestGTest("crypto/fipsmodule/ecdsa/ecdsa_sign_tests.txt", 365 [](FileTest *t) { 366 for (bool custom_group : {false, true}) { 367 SCOPED_TRACE(custom_group); 368 bssl::UniquePtr<EC_GROUP> group = GetCurve(t, "Curve"); 369 ASSERT_TRUE(group); 370 if (custom_group) { 371 group = MakeCustomClone(group.get()); 372 ASSERT_TRUE(group); 373 } 374 bssl::UniquePtr<BIGNUM> priv_key = GetBIGNUM(t, "Private"); 375 ASSERT_TRUE(priv_key); 376 bssl::UniquePtr<BIGNUM> x = GetBIGNUM(t, "X"); 377 ASSERT_TRUE(x); 378 bssl::UniquePtr<BIGNUM> y = GetBIGNUM(t, "Y"); 379 ASSERT_TRUE(y); 380 bssl::UniquePtr<BIGNUM> k = GetBIGNUM(t, "K"); 381 ASSERT_TRUE(k); 382 bssl::UniquePtr<BIGNUM> r = GetBIGNUM(t, "R"); 383 ASSERT_TRUE(r); 384 bssl::UniquePtr<BIGNUM> s = GetBIGNUM(t, "S"); 385 ASSERT_TRUE(s); 386 std::vector<uint8_t> digest; 387 ASSERT_TRUE(t->GetBytes(&digest, "Digest")); 388 389 bssl::UniquePtr<EC_KEY> key(EC_KEY_new()); 390 ASSERT_TRUE(key); 391 bssl::UniquePtr<EC_POINT> pub_key(EC_POINT_new(group.get())); 392 ASSERT_TRUE(pub_key); 393 ASSERT_TRUE(EC_KEY_set_group(key.get(), group.get())); 394 ASSERT_TRUE(EC_KEY_set_private_key(key.get(), priv_key.get())); 395 ASSERT_TRUE(EC_POINT_set_affine_coordinates_GFp( 396 group.get(), pub_key.get(), x.get(), y.get(), nullptr)); 397 ASSERT_TRUE(EC_KEY_set_public_key(key.get(), pub_key.get())); 398 ASSERT_TRUE(EC_KEY_check_key(key.get())); 399 400 // Set the fixed k for testing purposes. 401 key->fixed_k = k.release(); 402 bssl::UniquePtr<ECDSA_SIG> sig( 403 ECDSA_do_sign(digest.data(), digest.size(), key.get())); 404 ASSERT_TRUE(sig); 405 406 EXPECT_EQ(0, BN_cmp(r.get(), sig->r)); 407 EXPECT_EQ(0, BN_cmp(s.get(), sig->s)); 408 } 409 }); 410} 411