mbedtls: Update to upstream version 2.16.11
(cherry picked from commit cd7b25588b)
This commit is contained in:
Rémi Verschelde
parent
1b7ada718c
commit
f73113fae8
|
|
@ -285,16 +285,16 @@ Godot build configurations, check them out when updating.
|
|||
## mbedtls
|
||||
|
||||
- Upstream: https://tls.mbed.org/
|
||||
- Version: 2.16.10 (d61fa61bef06b64132e3490543c81b8ee40fbee3, 2021)
|
||||
- Version: 2.16.11 (aa1d4e097342af799ba80dfb13640efef498227c, 2021)
|
||||
- License: Apache 2.0
|
||||
|
||||
File extracted from upstream release tarball:
|
||||
|
||||
- All `*.h` from `include/mbedtls/` to `thirdparty/mbedtls/include/mbedtls/`
|
||||
- All `*.c` from `library/` to `thirdparty/mbedtls/library/`
|
||||
- LICENSE and apache-2.0.txt files
|
||||
- Applied the patch in `thirdparty/mbedtls/patches/1453.diff` (PR 1453).
|
||||
Soon to be merged upstream. Check it out at next update.
|
||||
- All `*.h` from `include/mbedtls/` to `thirdparty/mbedtls/include/mbedtls/`.
|
||||
- All `*.c` from `library/` to `thirdparty/mbedtls/library/`.
|
||||
- `LICENSE` and `apache-2.0.txt` files.
|
||||
- Applied the patch in `thirdparty/mbedtls/patches/1453.diff` (upstream PR:
|
||||
https://github.com/ARMmbed/mbedtls/pull/1453).
|
||||
- Applied the patch in `thirdparty/mbedtls/patches/padlock.diff`. This disables
|
||||
VIA padlock support which defines a symbol `unsupported` which clashes with
|
||||
a pre-defined symbol.
|
||||
|
|
|
|||
|
|
@ -88,14 +88,14 @@
|
|||
/* MBEDTLS_ERR_ARIA_HW_ACCEL_FAILED is deprecated and should not be used. */
|
||||
#define MBEDTLS_ERR_ARIA_HW_ACCEL_FAILED -0x0058 /**< ARIA hardware accelerator failed. */
|
||||
|
||||
#if !defined(MBEDTLS_ARIA_ALT)
|
||||
// Regular implementation
|
||||
//
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
#if !defined(MBEDTLS_ARIA_ALT)
|
||||
// Regular implementation
|
||||
//
|
||||
|
||||
/**
|
||||
* \brief The ARIA context-type definition.
|
||||
*/
|
||||
|
|
|
|||
|
|
@ -71,6 +71,46 @@
|
|||
|
||||
#include "bignum.h"
|
||||
|
||||
|
||||
/*
|
||||
* Conversion macros for embedded constants:
|
||||
* build lists of mbedtls_mpi_uint's from lists of unsigned char's grouped by 8, 4 or 2
|
||||
*/
|
||||
#if defined(MBEDTLS_HAVE_INT32)
|
||||
|
||||
#define MBEDTLS_BYTES_TO_T_UINT_4( a, b, c, d ) \
|
||||
( (mbedtls_mpi_uint) (a) << 0 ) | \
|
||||
( (mbedtls_mpi_uint) (b) << 8 ) | \
|
||||
( (mbedtls_mpi_uint) (c) << 16 ) | \
|
||||
( (mbedtls_mpi_uint) (d) << 24 )
|
||||
|
||||
#define MBEDTLS_BYTES_TO_T_UINT_2( a, b ) \
|
||||
MBEDTLS_BYTES_TO_T_UINT_4( a, b, 0, 0 )
|
||||
|
||||
#define MBEDTLS_BYTES_TO_T_UINT_8( a, b, c, d, e, f, g, h ) \
|
||||
MBEDTLS_BYTES_TO_T_UINT_4( a, b, c, d ), \
|
||||
MBEDTLS_BYTES_TO_T_UINT_4( e, f, g, h )
|
||||
|
||||
#else /* 64-bits */
|
||||
|
||||
#define MBEDTLS_BYTES_TO_T_UINT_8( a, b, c, d, e, f, g, h ) \
|
||||
( (mbedtls_mpi_uint) (a) << 0 ) | \
|
||||
( (mbedtls_mpi_uint) (b) << 8 ) | \
|
||||
( (mbedtls_mpi_uint) (c) << 16 ) | \
|
||||
( (mbedtls_mpi_uint) (d) << 24 ) | \
|
||||
( (mbedtls_mpi_uint) (e) << 32 ) | \
|
||||
( (mbedtls_mpi_uint) (f) << 40 ) | \
|
||||
( (mbedtls_mpi_uint) (g) << 48 ) | \
|
||||
( (mbedtls_mpi_uint) (h) << 56 )
|
||||
|
||||
#define MBEDTLS_BYTES_TO_T_UINT_4( a, b, c, d ) \
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( a, b, c, d, 0, 0, 0, 0 )
|
||||
|
||||
#define MBEDTLS_BYTES_TO_T_UINT_2( a, b ) \
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( a, b, 0, 0, 0, 0, 0, 0 )
|
||||
|
||||
#endif /* bits in mbedtls_mpi_uint */
|
||||
|
||||
#if defined(MBEDTLS_HAVE_ASM)
|
||||
|
||||
#ifndef asm
|
||||
|
|
|
|||
|
|
@ -453,7 +453,7 @@
|
|||
* be overridden, but the wrapper functions mbedtls_aes_decrypt and mbedtls_aes_encrypt
|
||||
* must stay untouched.
|
||||
*
|
||||
* \note If you use the AES_xxx_ALT macros, then is is recommended to also set
|
||||
* \note If you use the AES_xxx_ALT macros, then it is recommended to also set
|
||||
* MBEDTLS_AES_ROM_TABLES in order to help the linker garbage-collect the AES
|
||||
* tables.
|
||||
*
|
||||
|
|
|
|||
|
|
@ -154,6 +154,40 @@ typedef struct mbedtls_ecp_point
|
|||
}
|
||||
mbedtls_ecp_point;
|
||||
|
||||
/* Determine the minimum safe value of MBEDTLS_ECP_MAX_BITS. */
|
||||
#if !defined(MBEDTLS_ECP_C)
|
||||
#define MBEDTLS_ECP_MAX_BITS_MIN 0
|
||||
/* Note: the curves must be listed in DECREASING size! */
|
||||
#elif defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
|
||||
#define MBEDTLS_ECP_MAX_BITS_MIN 521
|
||||
#elif defined(MBEDTLS_ECP_DP_BP512R1_ENABLED)
|
||||
#define MBEDTLS_ECP_MAX_BITS_MIN 512
|
||||
#elif defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
|
||||
#define MBEDTLS_ECP_MAX_BITS_MIN 448
|
||||
#elif defined(MBEDTLS_ECP_DP_BP384R1_ENABLED)
|
||||
#define MBEDTLS_ECP_MAX_BITS_MIN 384
|
||||
#elif defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
|
||||
#define MBEDTLS_ECP_MAX_BITS_MIN 384
|
||||
#elif defined(MBEDTLS_ECP_DP_BP256R1_ENABLED)
|
||||
#define MBEDTLS_ECP_MAX_BITS_MIN 256
|
||||
#elif defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED)
|
||||
#define MBEDTLS_ECP_MAX_BITS_MIN 256
|
||||
#elif defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
|
||||
#define MBEDTLS_ECP_MAX_BITS_MIN 256
|
||||
#elif defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
|
||||
#define MBEDTLS_ECP_MAX_BITS_MIN 255
|
||||
#elif defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED)
|
||||
#define MBEDTLS_ECP_MAX_BITS_MIN 225 // n is slightly above 2^224
|
||||
#elif defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED)
|
||||
#define MBEDTLS_ECP_MAX_BITS_MIN 224
|
||||
#elif defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED)
|
||||
#define MBEDTLS_ECP_MAX_BITS_MIN 192
|
||||
#elif defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED)
|
||||
#define MBEDTLS_ECP_MAX_BITS_MIN 192
|
||||
#else
|
||||
#error "MBEDTLS_ECP_C enabled, but no curve?"
|
||||
#endif
|
||||
|
||||
#if !defined(MBEDTLS_ECP_ALT)
|
||||
/*
|
||||
* default mbed TLS elliptic curve arithmetic implementation
|
||||
|
|
@ -228,7 +262,13 @@ mbedtls_ecp_group;
|
|||
* \{
|
||||
*/
|
||||
|
||||
#if !defined(MBEDTLS_ECP_MAX_BITS)
|
||||
#if defined(MBEDTLS_ECP_MAX_BITS)
|
||||
|
||||
#if MBEDTLS_ECP_MAX_BITS < MBEDTLS_ECP_MAX_BITS_MIN
|
||||
#error "MBEDTLS_ECP_MAX_BITS is smaller than the largest supported curve"
|
||||
#endif
|
||||
|
||||
#else
|
||||
/**
|
||||
* The maximum size of the groups, that is, of \c N and \c P.
|
||||
*/
|
||||
|
|
|
|||
|
|
@ -98,7 +98,7 @@ extern "C" {
|
|||
*
|
||||
* \param feature The feature to detect
|
||||
*
|
||||
* \return 1 if CPU has support for the feature, 0 otherwise
|
||||
* \return non-zero if CPU has support for the feature, 0 otherwise
|
||||
*/
|
||||
int mbedtls_padlock_has_support( int feature );
|
||||
|
||||
|
|
|
|||
|
|
@ -2237,7 +2237,7 @@ void mbedtls_ssl_conf_dhm_min_bitlen( mbedtls_ssl_config *conf,
|
|||
#if defined(MBEDTLS_ECP_C)
|
||||
/**
|
||||
* \brief Set the allowed curves in order of preference.
|
||||
* (Default: all defined curves.)
|
||||
* (Default: all defined curves in order of decreasing size.)
|
||||
*
|
||||
* On server: this only affects selection of the ECDHE curve;
|
||||
* the curves used for ECDH and ECDSA are determined by the
|
||||
|
|
@ -2269,7 +2269,9 @@ void mbedtls_ssl_conf_curves( mbedtls_ssl_config *conf,
|
|||
#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
|
||||
/**
|
||||
* \brief Set the allowed hashes for signatures during the handshake.
|
||||
* (Default: all available hashes except MD5.)
|
||||
* (Default: all SHA-2 hashes, largest first. Also SHA-1 if
|
||||
* the compile-time option
|
||||
* `MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE` is enabled.)
|
||||
*
|
||||
* \note This only affects which hashes are offered and can be used
|
||||
* for signatures during the handshake. Hashes for message
|
||||
|
|
|
|||
|
|
@ -124,7 +124,7 @@ void mbedtls_ssl_ticket_init( mbedtls_ssl_ticket_context *ctx );
|
|||
* Recommended value: 86400 (one day).
|
||||
*
|
||||
* \note It is highly recommended to select a cipher that is at
|
||||
* least as strong as the the strongest ciphersuite
|
||||
* least as strong as the strongest ciphersuite
|
||||
* supported. Usually that means a 256-bit key.
|
||||
*
|
||||
* \note The lifetime of the keys is twice the lifetime of tickets.
|
||||
|
|
|
|||
|
|
@ -65,16 +65,16 @@
|
|||
*/
|
||||
#define MBEDTLS_VERSION_MAJOR 2
|
||||
#define MBEDTLS_VERSION_MINOR 16
|
||||
#define MBEDTLS_VERSION_PATCH 10
|
||||
#define MBEDTLS_VERSION_PATCH 11
|
||||
|
||||
/**
|
||||
* The single version number has the following structure:
|
||||
* MMNNPP00
|
||||
* Major version | Minor version | Patch version
|
||||
*/
|
||||
#define MBEDTLS_VERSION_NUMBER 0x02100A00
|
||||
#define MBEDTLS_VERSION_STRING "2.16.10"
|
||||
#define MBEDTLS_VERSION_STRING_FULL "mbed TLS 2.16.10"
|
||||
#define MBEDTLS_VERSION_NUMBER 0x02100B00
|
||||
#define MBEDTLS_VERSION_STRING "2.16.11"
|
||||
#define MBEDTLS_VERSION_STRING_FULL "mbed TLS 2.16.11"
|
||||
|
||||
#if defined(MBEDTLS_VERSION_C)
|
||||
|
||||
|
|
|
|||
|
|
@ -229,12 +229,21 @@ typedef void mbedtls_x509_crt_restart_ctx;
|
|||
/**
|
||||
* Default security profile. Should provide a good balance between security
|
||||
* and compatibility with current deployments.
|
||||
*
|
||||
* This profile permits:
|
||||
* - SHA2 hashes.
|
||||
* - All supported elliptic curves.
|
||||
* - RSA with 2048 bits and above.
|
||||
*
|
||||
* New minor versions of Mbed TLS may extend this profile, for example if
|
||||
* new curves are added to the library. New minor versions of Mbed TLS will
|
||||
* not reduce this profile unless serious security concerns require it.
|
||||
*/
|
||||
extern const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_default;
|
||||
|
||||
/**
|
||||
* Expected next default profile. Recommended for new deployments.
|
||||
* Currently targets a 128-bit security level, except for RSA-2048.
|
||||
* Currently targets a 128-bit security level, except for allowing RSA-2048.
|
||||
*/
|
||||
extern const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_next;
|
||||
|
||||
|
|
|
|||
|
|
@ -952,7 +952,7 @@ static const uint8_t aria_test2_ctr_ct[3][48] = // CTR ciphertext
|
|||
{ \
|
||||
if( verbose ) \
|
||||
mbedtls_printf( "failed\n" ); \
|
||||
return( 1 ); \
|
||||
goto exit; \
|
||||
} else { \
|
||||
if( verbose ) \
|
||||
mbedtls_printf( "passed\n" ); \
|
||||
|
|
@ -966,6 +966,7 @@ int mbedtls_aria_self_test( int verbose )
|
|||
int i;
|
||||
uint8_t blk[MBEDTLS_ARIA_BLOCKSIZE];
|
||||
mbedtls_aria_context ctx;
|
||||
int ret = 1;
|
||||
|
||||
#if (defined(MBEDTLS_CIPHER_MODE_CFB) || defined(MBEDTLS_CIPHER_MODE_CTR))
|
||||
size_t j;
|
||||
|
|
@ -977,6 +978,8 @@ int mbedtls_aria_self_test( int verbose )
|
|||
uint8_t buf[48], iv[MBEDTLS_ARIA_BLOCKSIZE];
|
||||
#endif
|
||||
|
||||
mbedtls_aria_init( &ctx );
|
||||
|
||||
/*
|
||||
* Test set 1
|
||||
*/
|
||||
|
|
@ -1096,7 +1099,11 @@ int mbedtls_aria_self_test( int verbose )
|
|||
mbedtls_printf( "\n" );
|
||||
#endif /* MBEDTLS_CIPHER_MODE_CTR */
|
||||
|
||||
return( 0 );
|
||||
ret = 0;
|
||||
|
||||
exit:
|
||||
mbedtls_aria_free( &ctx );
|
||||
return( ret );
|
||||
}
|
||||
|
||||
#endif /* MBEDTLS_SELF_TEST */
|
||||
|
|
|
|||
|
|
@ -267,6 +267,36 @@ void mbedtls_mpi_swap( mbedtls_mpi *X, mbedtls_mpi *Y )
|
|||
memcpy( Y, &T, sizeof( mbedtls_mpi ) );
|
||||
}
|
||||
|
||||
/**
|
||||
* Select between two sign values in constant-time.
|
||||
*
|
||||
* This is functionally equivalent to second ? a : b but uses only bit
|
||||
* operations in order to avoid branches.
|
||||
*
|
||||
* \param[in] a The first sign; must be either +1 or -1.
|
||||
* \param[in] b The second sign; must be either +1 or -1.
|
||||
* \param[in] second Must be either 1 (return b) or 0 (return a).
|
||||
*
|
||||
* \return The selected sign value.
|
||||
*/
|
||||
static int mpi_safe_cond_select_sign( int a, int b, unsigned char second )
|
||||
{
|
||||
/* In order to avoid questions about what we can reasonnably assume about
|
||||
* the representations of signed integers, move everything to unsigned
|
||||
* by taking advantage of the fact that a and b are either +1 or -1. */
|
||||
unsigned ua = a + 1;
|
||||
unsigned ub = b + 1;
|
||||
|
||||
/* second was 0 or 1, mask is 0 or 2 as are ua and ub */
|
||||
const unsigned mask = second << 1;
|
||||
|
||||
/* select ua or ub */
|
||||
unsigned ur = ( ua & ~mask ) | ( ub & mask );
|
||||
|
||||
/* ur is now 0 or 2, convert back to -1 or +1 */
|
||||
return( (int) ur - 1 );
|
||||
}
|
||||
|
||||
/*
|
||||
* Conditionally assign dest = src, without leaking information
|
||||
* about whether the assignment was made or not.
|
||||
|
|
@ -279,8 +309,23 @@ static void mpi_safe_cond_assign( size_t n,
|
|||
unsigned char assign )
|
||||
{
|
||||
size_t i;
|
||||
|
||||
/* MSVC has a warning about unary minus on unsigned integer types,
|
||||
* but this is well-defined and precisely what we want to do here. */
|
||||
#if defined(_MSC_VER)
|
||||
#pragma warning( push )
|
||||
#pragma warning( disable : 4146 )
|
||||
#endif
|
||||
|
||||
/* all-bits 1 if assign is 1, all-bits 0 if assign is 0 */
|
||||
const mbedtls_mpi_uint mask = -assign;
|
||||
|
||||
#if defined(_MSC_VER)
|
||||
#pragma warning( pop )
|
||||
#endif
|
||||
|
||||
for( i = 0; i < n; i++ )
|
||||
dest[i] = dest[i] * ( 1 - assign ) + src[i] * assign;
|
||||
dest[i] = ( src[i] & mask ) | ( dest[i] & ~mask );
|
||||
}
|
||||
|
||||
/*
|
||||
|
|
@ -292,20 +337,34 @@ int mbedtls_mpi_safe_cond_assign( mbedtls_mpi *X, const mbedtls_mpi *Y, unsigned
|
|||
{
|
||||
int ret = 0;
|
||||
size_t i;
|
||||
mbedtls_mpi_uint limb_mask;
|
||||
MPI_VALIDATE_RET( X != NULL );
|
||||
MPI_VALIDATE_RET( Y != NULL );
|
||||
|
||||
/* MSVC has a warning about unary minus on unsigned integer types,
|
||||
* but this is well-defined and precisely what we want to do here. */
|
||||
#if defined(_MSC_VER)
|
||||
#pragma warning( push )
|
||||
#pragma warning( disable : 4146 )
|
||||
#endif
|
||||
|
||||
/* make sure assign is 0 or 1 in a time-constant manner */
|
||||
assign = (assign | (unsigned char)-assign) >> 7;
|
||||
assign = (assign | (unsigned char)-assign) >> (sizeof( assign ) * 8 - 1);
|
||||
/* all-bits 1 if assign is 1, all-bits 0 if assign is 0 */
|
||||
limb_mask = -assign;
|
||||
|
||||
#if defined(_MSC_VER)
|
||||
#pragma warning( pop )
|
||||
#endif
|
||||
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_grow( X, Y->n ) );
|
||||
|
||||
X->s = X->s * ( 1 - assign ) + Y->s * assign;
|
||||
X->s = mpi_safe_cond_select_sign( X->s, Y->s, assign );
|
||||
|
||||
mpi_safe_cond_assign( Y->n, X->p, Y->p, assign );
|
||||
|
||||
for( i = Y->n; i < X->n; i++ )
|
||||
X->p[i] *= ( 1 - assign );
|
||||
X->p[i] &= ~limb_mask;
|
||||
|
||||
cleanup:
|
||||
return( ret );
|
||||
|
|
@ -321,6 +380,7 @@ int mbedtls_mpi_safe_cond_swap( mbedtls_mpi *X, mbedtls_mpi *Y, unsigned char sw
|
|||
{
|
||||
int ret, s;
|
||||
size_t i;
|
||||
mbedtls_mpi_uint limb_mask;
|
||||
mbedtls_mpi_uint tmp;
|
||||
MPI_VALIDATE_RET( X != NULL );
|
||||
MPI_VALIDATE_RET( Y != NULL );
|
||||
|
|
@ -328,22 +388,35 @@ int mbedtls_mpi_safe_cond_swap( mbedtls_mpi *X, mbedtls_mpi *Y, unsigned char sw
|
|||
if( X == Y )
|
||||
return( 0 );
|
||||
|
||||
/* MSVC has a warning about unary minus on unsigned integer types,
|
||||
* but this is well-defined and precisely what we want to do here. */
|
||||
#if defined(_MSC_VER)
|
||||
#pragma warning( push )
|
||||
#pragma warning( disable : 4146 )
|
||||
#endif
|
||||
|
||||
/* make sure swap is 0 or 1 in a time-constant manner */
|
||||
swap = (swap | (unsigned char)-swap) >> 7;
|
||||
swap = (swap | (unsigned char)-swap) >> (sizeof( swap ) * 8 - 1);
|
||||
/* all-bits 1 if swap is 1, all-bits 0 if swap is 0 */
|
||||
limb_mask = -swap;
|
||||
|
||||
#if defined(_MSC_VER)
|
||||
#pragma warning( pop )
|
||||
#endif
|
||||
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_grow( X, Y->n ) );
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_grow( Y, X->n ) );
|
||||
|
||||
s = X->s;
|
||||
X->s = X->s * ( 1 - swap ) + Y->s * swap;
|
||||
Y->s = Y->s * ( 1 - swap ) + s * swap;
|
||||
X->s = mpi_safe_cond_select_sign( X->s, Y->s, swap );
|
||||
Y->s = mpi_safe_cond_select_sign( Y->s, s, swap );
|
||||
|
||||
|
||||
for( i = 0; i < X->n; i++ )
|
||||
{
|
||||
tmp = X->p[i];
|
||||
X->p[i] = X->p[i] * ( 1 - swap ) + Y->p[i] * swap;
|
||||
Y->p[i] = Y->p[i] * ( 1 - swap ) + tmp * swap;
|
||||
X->p[i] = ( X->p[i] & ~limb_mask ) | ( Y->p[i] & limb_mask );
|
||||
Y->p[i] = ( Y->p[i] & ~limb_mask ) | ( tmp & limb_mask );
|
||||
}
|
||||
|
||||
cleanup:
|
||||
|
|
@ -500,6 +573,7 @@ int mbedtls_mpi_read_string( mbedtls_mpi *X, int radix, const char *s )
|
|||
{
|
||||
int ret;
|
||||
size_t i, j, slen, n;
|
||||
int sign = 1;
|
||||
mbedtls_mpi_uint d;
|
||||
mbedtls_mpi T;
|
||||
MPI_VALIDATE_RET( X != NULL );
|
||||
|
|
@ -510,6 +584,12 @@ int mbedtls_mpi_read_string( mbedtls_mpi *X, int radix, const char *s )
|
|||
|
||||
mbedtls_mpi_init( &T );
|
||||
|
||||
if( s[0] == '-' )
|
||||
{
|
||||
++s;
|
||||
sign = -1;
|
||||
}
|
||||
|
||||
slen = strlen( s );
|
||||
|
||||
if( radix == 16 )
|
||||
|
|
@ -524,12 +604,6 @@ int mbedtls_mpi_read_string( mbedtls_mpi *X, int radix, const char *s )
|
|||
|
||||
for( i = slen, j = 0; i > 0; i--, j++ )
|
||||
{
|
||||
if( i == 1 && s[i - 1] == '-' )
|
||||
{
|
||||
X->s = -1;
|
||||
break;
|
||||
}
|
||||
|
||||
MBEDTLS_MPI_CHK( mpi_get_digit( &d, radix, s[i - 1] ) );
|
||||
X->p[j / ( 2 * ciL )] |= d << ( ( j % ( 2 * ciL ) ) << 2 );
|
||||
}
|
||||
|
|
@ -540,26 +614,15 @@ int mbedtls_mpi_read_string( mbedtls_mpi *X, int radix, const char *s )
|
|||
|
||||
for( i = 0; i < slen; i++ )
|
||||
{
|
||||
if( i == 0 && s[i] == '-' )
|
||||
{
|
||||
X->s = -1;
|
||||
continue;
|
||||
}
|
||||
|
||||
MBEDTLS_MPI_CHK( mpi_get_digit( &d, radix, s[i] ) );
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_mul_int( &T, X, radix ) );
|
||||
|
||||
if( X->s == 1 )
|
||||
{
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_add_int( X, &T, d ) );
|
||||
}
|
||||
else
|
||||
{
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( X, &T, d ) );
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if( sign < 0 && mbedtls_mpi_bitlen( X ) != 0 )
|
||||
X->s = -1;
|
||||
|
||||
cleanup:
|
||||
|
||||
mbedtls_mpi_free( &T );
|
||||
|
|
@ -1570,6 +1633,7 @@ int mbedtls_mpi_mul_mpi( mbedtls_mpi *X, const mbedtls_mpi *A, const mbedtls_mpi
|
|||
int ret;
|
||||
size_t i, j;
|
||||
mbedtls_mpi TA, TB;
|
||||
int result_is_zero = 0;
|
||||
MPI_VALIDATE_RET( X != NULL );
|
||||
MPI_VALIDATE_RET( A != NULL );
|
||||
MPI_VALIDATE_RET( B != NULL );
|
||||
|
|
@ -1582,10 +1646,14 @@ int mbedtls_mpi_mul_mpi( mbedtls_mpi *X, const mbedtls_mpi *A, const mbedtls_mpi
|
|||
for( i = A->n; i > 0; i-- )
|
||||
if( A->p[i - 1] != 0 )
|
||||
break;
|
||||
if( i == 0 )
|
||||
result_is_zero = 1;
|
||||
|
||||
for( j = B->n; j > 0; j-- )
|
||||
if( B->p[j - 1] != 0 )
|
||||
break;
|
||||
if( j == 0 )
|
||||
result_is_zero = 1;
|
||||
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_grow( X, i + j ) );
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_lset( X, 0 ) );
|
||||
|
|
@ -1593,6 +1661,13 @@ int mbedtls_mpi_mul_mpi( mbedtls_mpi *X, const mbedtls_mpi *A, const mbedtls_mpi
|
|||
for( ; j > 0; j-- )
|
||||
mpi_mul_hlp( i, A->p, X->p + j - 1, B->p[j - 1] );
|
||||
|
||||
/* If the result is 0, we don't shortcut the operation, which reduces
|
||||
* but does not eliminate side channels leaking the zero-ness. We do
|
||||
* need to take care to set the sign bit properly since the library does
|
||||
* not fully support an MPI object with a value of 0 and s == -1. */
|
||||
if( result_is_zero )
|
||||
X->s = 1;
|
||||
else
|
||||
X->s = A->s * B->s;
|
||||
|
||||
cleanup:
|
||||
|
|
@ -2041,6 +2116,72 @@ static void mpi_montred( mbedtls_mpi *A, const mbedtls_mpi *N,
|
|||
mpi_montmul( A, &U, N, mm, T );
|
||||
}
|
||||
|
||||
/*
|
||||
* Constant-flow boolean "equal" comparison:
|
||||
* return x == y
|
||||
*
|
||||
* This function can be used to write constant-time code by replacing branches
|
||||
* with bit operations - it can be used in conjunction with
|
||||
* mbedtls_ssl_cf_mask_from_bit().
|
||||
*
|
||||
* This function is implemented without using comparison operators, as those
|
||||
* might be translated to branches by some compilers on some platforms.
|
||||
*/
|
||||
static size_t mbedtls_mpi_cf_bool_eq( size_t x, size_t y )
|
||||
{
|
||||
/* diff = 0 if x == y, non-zero otherwise */
|
||||
const size_t diff = x ^ y;
|
||||
|
||||
/* MSVC has a warning about unary minus on unsigned integer types,
|
||||
* but this is well-defined and precisely what we want to do here. */
|
||||
#if defined(_MSC_VER)
|
||||
#pragma warning( push )
|
||||
#pragma warning( disable : 4146 )
|
||||
#endif
|
||||
|
||||
/* diff_msb's most significant bit is equal to x != y */
|
||||
const size_t diff_msb = ( diff | (size_t) -diff );
|
||||
|
||||
#if defined(_MSC_VER)
|
||||
#pragma warning( pop )
|
||||
#endif
|
||||
|
||||
/* diff1 = (x != y) ? 1 : 0 */
|
||||
const size_t diff1 = diff_msb >> ( sizeof( diff_msb ) * 8 - 1 );
|
||||
|
||||
return( 1 ^ diff1 );
|
||||
}
|
||||
|
||||
/**
|
||||
* Select an MPI from a table without leaking the index.
|
||||
*
|
||||
* This is functionally equivalent to mbedtls_mpi_copy(R, T[idx]) except it
|
||||
* reads the entire table in order to avoid leaking the value of idx to an
|
||||
* attacker able to observe memory access patterns.
|
||||
*
|
||||
* \param[out] R Where to write the selected MPI.
|
||||
* \param[in] T The table to read from.
|
||||
* \param[in] T_size The number of elements in the table.
|
||||
* \param[in] idx The index of the element to select;
|
||||
* this must satisfy 0 <= idx < T_size.
|
||||
*
|
||||
* \return \c 0 on success, or a negative error code.
|
||||
*/
|
||||
static int mpi_select( mbedtls_mpi *R, const mbedtls_mpi *T, size_t T_size, size_t idx )
|
||||
{
|
||||
int ret = MBEDTLS_ERR_MPI_BAD_INPUT_DATA;
|
||||
size_t i;
|
||||
|
||||
for( i = 0; i < T_size; i++ )
|
||||
{
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_safe_cond_assign( R, &T[i],
|
||||
(unsigned char) mbedtls_mpi_cf_bool_eq( i, idx ) ) );
|
||||
}
|
||||
|
||||
cleanup:
|
||||
return( ret );
|
||||
}
|
||||
|
||||
/*
|
||||
* Sliding-window exponentiation: X = A^E mod N (HAC 14.85)
|
||||
*/
|
||||
|
|
@ -2053,7 +2194,7 @@ int mbedtls_mpi_exp_mod( mbedtls_mpi *X, const mbedtls_mpi *A,
|
|||
size_t i, j, nblimbs;
|
||||
size_t bufsize, nbits;
|
||||
mbedtls_mpi_uint ei, mm, state;
|
||||
mbedtls_mpi RR, T, W[ 1 << MBEDTLS_MPI_WINDOW_SIZE ], Apos;
|
||||
mbedtls_mpi RR, T, W[ 1 << MBEDTLS_MPI_WINDOW_SIZE ], WW, Apos;
|
||||
int neg;
|
||||
|
||||
MPI_VALIDATE_RET( X != NULL );
|
||||
|
|
@ -2077,6 +2218,7 @@ int mbedtls_mpi_exp_mod( mbedtls_mpi *X, const mbedtls_mpi *A,
|
|||
mpi_montg_init( &mm, N );
|
||||
mbedtls_mpi_init( &RR ); mbedtls_mpi_init( &T );
|
||||
mbedtls_mpi_init( &Apos );
|
||||
mbedtls_mpi_init( &WW );
|
||||
memset( W, 0, sizeof( W ) );
|
||||
|
||||
i = mbedtls_mpi_bitlen( E );
|
||||
|
|
@ -2090,6 +2232,11 @@ int mbedtls_mpi_exp_mod( mbedtls_mpi *X, const mbedtls_mpi *A,
|
|||
#endif
|
||||
|
||||
j = N->n + 1;
|
||||
/* All W[i] and X must have at least N->n limbs for the mpi_montmul()
|
||||
* and mpi_montred() calls later. Here we ensure that W[1] and X are
|
||||
* large enough, and later we'll grow other W[i] to the same length.
|
||||
* They must not be shrunk midway through this function!
|
||||
*/
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_grow( X, j ) );
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_grow( &W[1], j ) );
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_grow( &T, j * 2 ) );
|
||||
|
|
@ -2127,6 +2274,10 @@ int mbedtls_mpi_exp_mod( mbedtls_mpi *X, const mbedtls_mpi *A,
|
|||
MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &W[1], A, N ) );
|
||||
else
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &W[1], A ) );
|
||||
/* Re-grow W[1] if necessary. This should be only necessary in one corner
|
||||
* case: when A == 0 represented with A.n == 0, mbedtls_mpi_copy shrinks
|
||||
* W[1] to 0 limbs. */
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_grow( &W[1], N->n +1 ) );
|
||||
|
||||
mpi_montmul( &W[1], &RR, N, mm, &T );
|
||||
|
||||
|
|
@ -2217,7 +2368,8 @@ int mbedtls_mpi_exp_mod( mbedtls_mpi *X, const mbedtls_mpi *A,
|
|||
/*
|
||||
* X = X * W[wbits] R^-1 mod N
|
||||
*/
|
||||
mpi_montmul( X, &W[wbits], N, mm, &T );
|
||||
MBEDTLS_MPI_CHK( mpi_select( &WW, W, (size_t) 1 << wsize, wbits ) );
|
||||
mpi_montmul( X, &WW, N, mm, &T );
|
||||
|
||||
state--;
|
||||
nbits = 0;
|
||||
|
|
@ -2255,6 +2407,7 @@ cleanup:
|
|||
mbedtls_mpi_free( &W[i] );
|
||||
|
||||
mbedtls_mpi_free( &W[1] ); mbedtls_mpi_free( &T ); mbedtls_mpi_free( &Apos );
|
||||
mbedtls_mpi_free( &WW );
|
||||
|
||||
if( _RR == NULL || _RR->p == NULL )
|
||||
mbedtls_mpi_free( &RR );
|
||||
|
|
@ -2283,6 +2436,16 @@ int mbedtls_mpi_gcd( mbedtls_mpi *G, const mbedtls_mpi *A, const mbedtls_mpi *B
|
|||
lz = mbedtls_mpi_lsb( &TA );
|
||||
lzt = mbedtls_mpi_lsb( &TB );
|
||||
|
||||
/* The loop below gives the correct result when A==0 but not when B==0.
|
||||
* So have a special case for B==0. Leverage the fact that we just
|
||||
* calculated the lsb and lsb(B)==0 iff B is odd or 0 to make the test
|
||||
* slightly more efficient than cmp_int(). */
|
||||
if( lzt == 0 && mbedtls_mpi_get_bit( &TB, 0 ) == 0 )
|
||||
{
|
||||
ret = mbedtls_mpi_copy( G, A );
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
if( lzt < lz )
|
||||
lz = lzt;
|
||||
|
||||
|
|
@ -2291,11 +2454,52 @@ int mbedtls_mpi_gcd( mbedtls_mpi *G, const mbedtls_mpi *A, const mbedtls_mpi *B
|
|||
|
||||
TA.s = TB.s = 1;
|
||||
|
||||
/* We mostly follow the procedure described in HAC 14.54, but with some
|
||||
* minor differences:
|
||||
* - Sequences of multiplications or divisions by 2 are grouped into a
|
||||
* single shift operation.
|
||||
* - The procedure in HAC assumes that 0 < TB <= TA.
|
||||
* - The condition TB <= TA is not actually necessary for correctness.
|
||||
* TA and TB have symmetric roles except for the loop termination
|
||||
* condition, and the shifts at the beginning of the loop body
|
||||
* remove any significance from the ordering of TA vs TB before
|
||||
* the shifts.
|
||||
* - If TA = 0, the loop goes through 0 iterations and the result is
|
||||
* correctly TB.
|
||||
* - The case TB = 0 was short-circuited above.
|
||||
*
|
||||
* For the correctness proof below, decompose the original values of
|
||||
* A and B as
|
||||
* A = sa * 2^a * A' with A'=0 or A' odd, and sa = +-1
|
||||
* B = sb * 2^b * B' with B'=0 or B' odd, and sb = +-1
|
||||
* Then gcd(A, B) = 2^{min(a,b)} * gcd(A',B'),
|
||||
* and gcd(A',B') is odd or 0.
|
||||
*
|
||||
* At the beginning, we have TA = |A|/2^a and TB = |B|/2^b.
|
||||
* The code maintains the following invariant:
|
||||
* gcd(A,B) = 2^k * gcd(TA,TB) for some k (I)
|
||||
*/
|
||||
|
||||
/* Proof that the loop terminates:
|
||||
* At each iteration, either the right-shift by 1 is made on a nonzero
|
||||
* value and the nonnegative integer bitlen(TA) + bitlen(TB) decreases
|
||||
* by at least 1, or the right-shift by 1 is made on zero and then
|
||||
* TA becomes 0 which ends the loop (TB cannot be 0 if it is right-shifted
|
||||
* since in that case TB is calculated from TB-TA with the condition TB>TA).
|
||||
*/
|
||||
while( mbedtls_mpi_cmp_int( &TA, 0 ) != 0 )
|
||||
{
|
||||
/* Divisions by 2 preserve the invariant (I). */
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &TA, mbedtls_mpi_lsb( &TA ) ) );
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &TB, mbedtls_mpi_lsb( &TB ) ) );
|
||||
|
||||
/* Set either TA or TB to |TA-TB|/2. Since TA and TB are both odd,
|
||||
* TA-TB is even so the division by 2 has an integer result.
|
||||
* Invariant (I) is preserved since any odd divisor of both TA and TB
|
||||
* also divides |TA-TB|/2, and any odd divisor of both TA and |TA-TB|/2
|
||||
* also divides TB, and any odd divisior of both TB and |TA-TB|/2 also
|
||||
* divides TA.
|
||||
*/
|
||||
if( mbedtls_mpi_cmp_mpi( &TA, &TB ) >= 0 )
|
||||
{
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_sub_abs( &TA, &TA, &TB ) );
|
||||
|
|
@ -2306,8 +2510,18 @@ int mbedtls_mpi_gcd( mbedtls_mpi *G, const mbedtls_mpi *A, const mbedtls_mpi *B
|
|||
MBEDTLS_MPI_CHK( mbedtls_mpi_sub_abs( &TB, &TB, &TA ) );
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &TB, 1 ) );
|
||||
}
|
||||
/* Note that one of TA or TB is still odd. */
|
||||
}
|
||||
|
||||
/* By invariant (I), gcd(A,B) = 2^k * gcd(TA,TB) for some k.
|
||||
* At the loop exit, TA = 0, so gcd(TA,TB) = TB.
|
||||
* - If there was at least one loop iteration, then one of TA or TB is odd,
|
||||
* and TA = 0, so TB is odd and gcd(TA,TB) = gcd(A',B'). In this case,
|
||||
* lz = min(a,b) so gcd(A,B) = 2^lz * TB.
|
||||
* - If there was no loop iteration, then A was 0, and gcd(A,B) = B.
|
||||
* In this case, lz = 0 and B = TB so gcd(A,B) = B = 2^lz * TB as well.
|
||||
*/
|
||||
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_shift_l( &TB, lz ) );
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_copy( G, &TB ) );
|
||||
|
||||
|
|
|
|||
|
|
@ -973,9 +973,11 @@ int mbedtls_camellia_self_test( int verbose )
|
|||
unsigned char nonce_counter[16];
|
||||
unsigned char stream_block[16];
|
||||
#endif
|
||||
int ret = 1;
|
||||
|
||||
mbedtls_camellia_context ctx;
|
||||
|
||||
mbedtls_camellia_init( &ctx );
|
||||
memset( key, 0, 32 );
|
||||
|
||||
for( j = 0; j < 6; j++ ) {
|
||||
|
|
@ -1005,8 +1007,7 @@ int mbedtls_camellia_self_test( int verbose )
|
|||
{
|
||||
if( verbose != 0 )
|
||||
mbedtls_printf( "failed\n" );
|
||||
|
||||
return( 1 );
|
||||
goto exit;
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -1058,8 +1059,7 @@ int mbedtls_camellia_self_test( int verbose )
|
|||
{
|
||||
if( verbose != 0 )
|
||||
mbedtls_printf( "failed\n" );
|
||||
|
||||
return( 1 );
|
||||
goto exit;
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -1102,8 +1102,7 @@ int mbedtls_camellia_self_test( int verbose )
|
|||
{
|
||||
if( verbose != 0 )
|
||||
mbedtls_printf( "failed\n" );
|
||||
|
||||
return( 1 );
|
||||
goto exit;
|
||||
}
|
||||
}
|
||||
else
|
||||
|
|
@ -1118,8 +1117,7 @@ int mbedtls_camellia_self_test( int verbose )
|
|||
{
|
||||
if( verbose != 0 )
|
||||
mbedtls_printf( "failed\n" );
|
||||
|
||||
return( 1 );
|
||||
goto exit;
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -1131,7 +1129,11 @@ int mbedtls_camellia_self_test( int verbose )
|
|||
mbedtls_printf( "\n" );
|
||||
#endif /* MBEDTLS_CIPHER_MODE_CTR */
|
||||
|
||||
return( 0 );
|
||||
ret = 0;
|
||||
|
||||
exit:
|
||||
mbedtls_camellia_free( &ctx );
|
||||
return( ret );
|
||||
}
|
||||
|
||||
#endif /* MBEDTLS_SELF_TEST */
|
||||
|
|
|
|||
|
|
@ -261,8 +261,8 @@ void mbedtls_debug_print_mpi( const mbedtls_ssl_context *ssl, int level,
|
|||
const char *text, const mbedtls_mpi *X )
|
||||
{
|
||||
char str[DEBUG_BUF_SIZE];
|
||||
int j, k, zeros = 1;
|
||||
size_t i, n, idx = 0;
|
||||
size_t bitlen;
|
||||
size_t idx = 0;
|
||||
|
||||
if( NULL == ssl ||
|
||||
NULL == ssl->conf ||
|
||||
|
|
@ -273,55 +273,43 @@ void mbedtls_debug_print_mpi( const mbedtls_ssl_context *ssl, int level,
|
|||
return;
|
||||
}
|
||||
|
||||
for( n = X->n - 1; n > 0; n-- )
|
||||
if( X->p[n] != 0 )
|
||||
break;
|
||||
|
||||
for( j = ( sizeof(mbedtls_mpi_uint) << 3 ) - 1; j >= 0; j-- )
|
||||
if( ( ( X->p[n] >> j ) & 1 ) != 0 )
|
||||
break;
|
||||
|
||||
mbedtls_snprintf( str + idx, sizeof( str ) - idx, "value of '%s' (%d bits) is:\n",
|
||||
text, (int) ( ( n * ( sizeof(mbedtls_mpi_uint) << 3 ) ) + j + 1 ) );
|
||||
bitlen = mbedtls_mpi_bitlen( X );
|
||||
|
||||
mbedtls_snprintf( str, sizeof( str ), "value of '%s' (%u bits) is:\n",
|
||||
text, (unsigned) bitlen );
|
||||
debug_send_line( ssl, level, file, line, str );
|
||||
|
||||
idx = 0;
|
||||
for( i = n + 1, j = 0; i > 0; i-- )
|
||||
if( bitlen == 0 )
|
||||
{
|
||||
if( zeros && X->p[i - 1] == 0 )
|
||||
continue;
|
||||
|
||||
for( k = sizeof( mbedtls_mpi_uint ) - 1; k >= 0; k-- )
|
||||
{
|
||||
if( zeros && ( ( X->p[i - 1] >> ( k << 3 ) ) & 0xFF ) == 0 )
|
||||
continue;
|
||||
str[0] = ' '; str[1] = '0'; str[2] = '0';
|
||||
idx = 3;
|
||||
}
|
||||
else
|
||||
zeros = 0;
|
||||
|
||||
if( j % 16 == 0 )
|
||||
{
|
||||
if( j > 0 )
|
||||
int n;
|
||||
for( n = (int) ( ( bitlen - 1 ) / 8 ); n >= 0; n-- )
|
||||
{
|
||||
size_t limb_offset = n / sizeof( mbedtls_mpi_uint );
|
||||
size_t offset_in_limb = n % sizeof( mbedtls_mpi_uint );
|
||||
unsigned char octet =
|
||||
( X->p[limb_offset] >> ( offset_in_limb * 8 ) ) & 0xff;
|
||||
mbedtls_snprintf( str + idx, sizeof( str ) - idx, " %02x", octet );
|
||||
idx += 3;
|
||||
/* Wrap lines after 16 octets that each take 3 columns */
|
||||
if( idx >= 3 * 16 )
|
||||
{
|
||||
mbedtls_snprintf( str + idx, sizeof( str ) - idx, "\n" );
|
||||
debug_send_line( ssl, level, file, line, str );
|
||||
idx = 0;
|
||||
}
|
||||
}
|
||||
|
||||
idx += mbedtls_snprintf( str + idx, sizeof( str ) - idx, " %02x", (unsigned int)
|
||||
( X->p[i - 1] >> ( k << 3 ) ) & 0xFF );
|
||||
|
||||
j++;
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
if( zeros == 1 )
|
||||
idx += mbedtls_snprintf( str + idx, sizeof( str ) - idx, " 00" );
|
||||
|
||||
if( idx != 0 )
|
||||
{
|
||||
mbedtls_snprintf( str + idx, sizeof( str ) - idx, "\n" );
|
||||
debug_send_line( ssl, level, file, line, str );
|
||||
}
|
||||
}
|
||||
#endif /* MBEDTLS_BIGNUM_C */
|
||||
|
||||
|
|
|
|||
|
|
@ -130,22 +130,21 @@ static int dhm_read_bignum( mbedtls_mpi *X,
|
|||
*/
|
||||
static int dhm_check_range( const mbedtls_mpi *param, const mbedtls_mpi *P )
|
||||
{
|
||||
mbedtls_mpi L, U;
|
||||
mbedtls_mpi U;
|
||||
int ret = 0;
|
||||
|
||||
mbedtls_mpi_init( &L ); mbedtls_mpi_init( &U );
|
||||
mbedtls_mpi_init( &U );
|
||||
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &L, 2 ) );
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &U, P, 2 ) );
|
||||
|
||||
if( mbedtls_mpi_cmp_mpi( param, &L ) < 0 ||
|
||||
if( mbedtls_mpi_cmp_int( param, 2 ) < 0 ||
|
||||
mbedtls_mpi_cmp_mpi( param, &U ) > 0 )
|
||||
{
|
||||
ret = MBEDTLS_ERR_DHM_BAD_INPUT_DATA;
|
||||
}
|
||||
|
||||
cleanup:
|
||||
mbedtls_mpi_free( &L ); mbedtls_mpi_free( &U );
|
||||
mbedtls_mpi_free( &U );
|
||||
return( ret );
|
||||
}
|
||||
|
||||
|
|
@ -181,38 +180,54 @@ int mbedtls_dhm_read_params( mbedtls_dhm_context *ctx,
|
|||
}
|
||||
|
||||
/*
|
||||
* Setup and write the ServerKeyExchange parameters
|
||||
* Pick a random R in the range [2, M-2] for blinding or key generation.
|
||||
*/
|
||||
int mbedtls_dhm_make_params( mbedtls_dhm_context *ctx, int x_size,
|
||||
unsigned char *output, size_t *olen,
|
||||
static int dhm_random_below( mbedtls_mpi *R, const mbedtls_mpi *M,
|
||||
int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
|
||||
{
|
||||
int ret, count;
|
||||
size_t m_size = mbedtls_mpi_size( M );
|
||||
size_t m_bitlen = mbedtls_mpi_bitlen( M );
|
||||
|
||||
count = 0;
|
||||
do
|
||||
{
|
||||
if( count++ > 30 )
|
||||
return( MBEDTLS_ERR_MPI_NOT_ACCEPTABLE );
|
||||
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( R, m_size, f_rng, p_rng ) );
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( R, ( m_size * 8 ) - m_bitlen ) );
|
||||
}
|
||||
while( dhm_check_range( R, M ) != 0 );
|
||||
|
||||
cleanup:
|
||||
return( ret );
|
||||
}
|
||||
|
||||
static int dhm_make_common( mbedtls_dhm_context *ctx, int x_size,
|
||||
int (*f_rng)(void *, unsigned char *, size_t),
|
||||
void *p_rng )
|
||||
{
|
||||
int ret, count = 0;
|
||||
size_t n1, n2, n3;
|
||||
unsigned char *p;
|
||||
DHM_VALIDATE_RET( ctx != NULL );
|
||||
DHM_VALIDATE_RET( output != NULL );
|
||||
DHM_VALIDATE_RET( olen != NULL );
|
||||
DHM_VALIDATE_RET( f_rng != NULL );
|
||||
int ret = 0;
|
||||
|
||||
if( mbedtls_mpi_cmp_int( &ctx->P, 0 ) == 0 )
|
||||
return( MBEDTLS_ERR_DHM_BAD_INPUT_DATA );
|
||||
if( x_size < 0 )
|
||||
return( MBEDTLS_ERR_DHM_BAD_INPUT_DATA );
|
||||
|
||||
/*
|
||||
* Generate X as large as possible ( < P )
|
||||
*/
|
||||
do
|
||||
if( (unsigned) x_size < mbedtls_mpi_size( &ctx->P ) )
|
||||
{
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &ctx->X, x_size, f_rng, p_rng ) );
|
||||
|
||||
while( mbedtls_mpi_cmp_mpi( &ctx->X, &ctx->P ) >= 0 )
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &ctx->X, 1 ) );
|
||||
|
||||
if( count++ > 10 )
|
||||
return( MBEDTLS_ERR_DHM_MAKE_PARAMS_FAILED );
|
||||
}
|
||||
while( dhm_check_range( &ctx->X, &ctx->P ) != 0 );
|
||||
else
|
||||
{
|
||||
/* Generate X as large as possible ( <= P - 2 ) */
|
||||
ret = dhm_random_below( &ctx->X, &ctx->P, f_rng, p_rng );
|
||||
if( ret == MBEDTLS_ERR_MPI_NOT_ACCEPTABLE )
|
||||
return( MBEDTLS_ERR_DHM_MAKE_PARAMS_FAILED );
|
||||
if( ret != 0 )
|
||||
return( ret );
|
||||
}
|
||||
|
||||
/*
|
||||
* Calculate GX = G^X mod P
|
||||
|
|
@ -223,8 +238,33 @@ int mbedtls_dhm_make_params( mbedtls_dhm_context *ctx, int x_size,
|
|||
if( ( ret = dhm_check_range( &ctx->GX, &ctx->P ) ) != 0 )
|
||||
return( ret );
|
||||
|
||||
cleanup:
|
||||
return( ret );
|
||||
}
|
||||
|
||||
/*
|
||||
* Setup and write the ServerKeyExchange parameters
|
||||
*/
|
||||
int mbedtls_dhm_make_params( mbedtls_dhm_context *ctx, int x_size,
|
||||
unsigned char *output, size_t *olen,
|
||||
int (*f_rng)(void *, unsigned char *, size_t),
|
||||
void *p_rng )
|
||||
{
|
||||
int ret;
|
||||
size_t n1, n2, n3;
|
||||
unsigned char *p;
|
||||
DHM_VALIDATE_RET( ctx != NULL );
|
||||
DHM_VALIDATE_RET( output != NULL );
|
||||
DHM_VALIDATE_RET( olen != NULL );
|
||||
DHM_VALIDATE_RET( f_rng != NULL );
|
||||
|
||||
ret = dhm_make_common( ctx, x_size, f_rng, p_rng );
|
||||
if( ret != 0 )
|
||||
goto cleanup;
|
||||
|
||||
/*
|
||||
* export P, G, GX
|
||||
* Export P, G, GX. RFC 5246 §4.4 states that "leading zero octets are
|
||||
* not required". We omit leading zeros for compactness.
|
||||
*/
|
||||
#define DHM_MPI_EXPORT( X, n ) \
|
||||
do { \
|
||||
|
|
@ -250,11 +290,9 @@ int mbedtls_dhm_make_params( mbedtls_dhm_context *ctx, int x_size,
|
|||
ctx->len = n1;
|
||||
|
||||
cleanup:
|
||||
|
||||
if( ret != 0 )
|
||||
if( ret != 0 && ret > -128 )
|
||||
return( MBEDTLS_ERR_DHM_MAKE_PARAMS_FAILED + ret );
|
||||
|
||||
return( 0 );
|
||||
return( ret );
|
||||
}
|
||||
|
||||
/*
|
||||
|
|
@ -306,7 +344,7 @@ int mbedtls_dhm_make_public( mbedtls_dhm_context *ctx, int x_size,
|
|||
int (*f_rng)(void *, unsigned char *, size_t),
|
||||
void *p_rng )
|
||||
{
|
||||
int ret, count = 0;
|
||||
int ret;
|
||||
DHM_VALIDATE_RET( ctx != NULL );
|
||||
DHM_VALIDATE_RET( output != NULL );
|
||||
DHM_VALIDATE_RET( f_rng != NULL );
|
||||
|
|
@ -314,62 +352,18 @@ int mbedtls_dhm_make_public( mbedtls_dhm_context *ctx, int x_size,
|
|||
if( olen < 1 || olen > ctx->len )
|
||||
return( MBEDTLS_ERR_DHM_BAD_INPUT_DATA );
|
||||
|
||||
if( mbedtls_mpi_cmp_int( &ctx->P, 0 ) == 0 )
|
||||
return( MBEDTLS_ERR_DHM_BAD_INPUT_DATA );
|
||||
|
||||
/*
|
||||
* generate X and calculate GX = G^X mod P
|
||||
*/
|
||||
do
|
||||
{
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &ctx->X, x_size, f_rng, p_rng ) );
|
||||
|
||||
while( mbedtls_mpi_cmp_mpi( &ctx->X, &ctx->P ) >= 0 )
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &ctx->X, 1 ) );
|
||||
|
||||
if( count++ > 10 )
|
||||
ret = dhm_make_common( ctx, x_size, f_rng, p_rng );
|
||||
if( ret == MBEDTLS_ERR_DHM_MAKE_PARAMS_FAILED )
|
||||
return( MBEDTLS_ERR_DHM_MAKE_PUBLIC_FAILED );
|
||||
}
|
||||
while( dhm_check_range( &ctx->X, &ctx->P ) != 0 );
|
||||
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &ctx->GX, &ctx->G, &ctx->X,
|
||||
&ctx->P , &ctx->RP ) );
|
||||
|
||||
if( ( ret = dhm_check_range( &ctx->GX, &ctx->P ) ) != 0 )
|
||||
return( ret );
|
||||
if( ret != 0 )
|
||||
goto cleanup;
|
||||
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &ctx->GX, output, olen ) );
|
||||
|
||||
cleanup:
|
||||
|
||||
if( ret != 0 )
|
||||
if( ret != 0 && ret > -128 )
|
||||
return( MBEDTLS_ERR_DHM_MAKE_PUBLIC_FAILED + ret );
|
||||
|
||||
return( 0 );
|
||||
}
|
||||
|
||||
/*
|
||||
* Pick a random R in the range [2, M) for blinding purposes
|
||||
*/
|
||||
static int dhm_random_below( mbedtls_mpi *R, const mbedtls_mpi *M,
|
||||
int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
|
||||
{
|
||||
int ret, count;
|
||||
|
||||
count = 0;
|
||||
do
|
||||
{
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( R, mbedtls_mpi_size( M ), f_rng, p_rng ) );
|
||||
|
||||
while( mbedtls_mpi_cmp_mpi( R, M ) >= 0 )
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( R, 1 ) );
|
||||
|
||||
if( count++ > 10 )
|
||||
return( MBEDTLS_ERR_MPI_NOT_ACCEPTABLE );
|
||||
}
|
||||
while( mbedtls_mpi_cmp_int( R, 1 ) <= 0 );
|
||||
|
||||
cleanup:
|
||||
return( ret );
|
||||
}
|
||||
|
||||
|
|
@ -420,7 +414,7 @@ static int dhm_update_blinding( mbedtls_dhm_context *ctx,
|
|||
* We need to generate blinding values from scratch
|
||||
*/
|
||||
|
||||
/* Vi = random( 2, P-1 ) */
|
||||
/* Vi = random( 2, P-2 ) */
|
||||
MBEDTLS_MPI_CHK( dhm_random_below( &ctx->Vi, &ctx->P, f_rng, p_rng ) );
|
||||
|
||||
/* Vf = Vi^-X mod P
|
||||
|
|
@ -484,8 +478,9 @@ int mbedtls_dhm_calc_secret( mbedtls_dhm_context *ctx,
|
|||
MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &ctx->K, &ctx->K, &ctx->P ) );
|
||||
}
|
||||
|
||||
/* Output the secret without any leading zero byte. This is mandatory
|
||||
* for TLS per RFC 5246 §8.1.2. */
|
||||
*olen = mbedtls_mpi_size( &ctx->K );
|
||||
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &ctx->K, output, *olen ) );
|
||||
|
||||
cleanup:
|
||||
|
|
|
|||
|
|
@ -106,6 +106,7 @@
|
|||
#include "mbedtls/ecp.h"
|
||||
#include "mbedtls/threading.h"
|
||||
#include "mbedtls/platform_util.h"
|
||||
#include "mbedtls/bn_mul.h"
|
||||
|
||||
#include <string.h>
|
||||
|
||||
|
|
@ -1738,18 +1739,17 @@ static int ecp_randomize_jac( const mbedtls_ecp_group *grp, mbedtls_ecp_point *p
|
|||
/* Generate l such that 1 < l < p */
|
||||
do
|
||||
{
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &l, p_size, f_rng, p_rng ) );
|
||||
|
||||
while( mbedtls_mpi_cmp_mpi( &l, &grp->P ) >= 0 )
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &l, 1 ) );
|
||||
|
||||
if( count++ > 10 )
|
||||
if( count++ > 30 )
|
||||
{
|
||||
ret = MBEDTLS_ERR_ECP_RANDOM_FAILED;
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &l, p_size, f_rng, p_rng ) );
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &l, ( p_size * 8 ) - grp->pbits ) );
|
||||
}
|
||||
while( mbedtls_mpi_cmp_int( &l, 1 ) <= 0 );
|
||||
while( ( mbedtls_mpi_cmp_int( &l, 1 ) <= 0 ) ||
|
||||
( mbedtls_mpi_cmp_mpi( &l, &grp->P ) >= 0 ) );
|
||||
|
||||
/* Z = l * Z */
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &pt->Z, &pt->Z, &l ) ); MOD_MUL( pt->Z );
|
||||
|
|
@ -2505,7 +2505,7 @@ static int ecp_randomize_mxz( const mbedtls_ecp_group *grp, mbedtls_ecp_point *P
|
|||
|
||||
#if defined(MBEDTLS_ECP_RANDOMIZE_MXZ_ALT)
|
||||
if( mbedtls_internal_ecp_grp_capable( grp ) )
|
||||
return( mbedtls_internal_ecp_randomize_mxz( grp, P, f_rng, p_rng );
|
||||
return( mbedtls_internal_ecp_randomize_mxz( grp, P, f_rng, p_rng ) );
|
||||
#endif /* MBEDTLS_ECP_RANDOMIZE_MXZ_ALT */
|
||||
|
||||
p_size = ( grp->pbits + 7 ) / 8;
|
||||
|
|
@ -2514,18 +2514,17 @@ static int ecp_randomize_mxz( const mbedtls_ecp_group *grp, mbedtls_ecp_point *P
|
|||
/* Generate l such that 1 < l < p */
|
||||
do
|
||||
{
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &l, p_size, f_rng, p_rng ) );
|
||||
|
||||
while( mbedtls_mpi_cmp_mpi( &l, &grp->P ) >= 0 )
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &l, 1 ) );
|
||||
|
||||
if( count++ > 10 )
|
||||
if( count++ > 30 )
|
||||
{
|
||||
ret = MBEDTLS_ERR_ECP_RANDOM_FAILED;
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &l, p_size, f_rng, p_rng ) );
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &l, ( p_size * 8 ) - grp->pbits ) );
|
||||
}
|
||||
while( mbedtls_mpi_cmp_int( &l, 1 ) <= 0 );
|
||||
while( ( mbedtls_mpi_cmp_int( &l, 1 ) <= 0 ) ||
|
||||
( mbedtls_mpi_cmp_mpi( &l, &grp->P ) >= 0 ) );
|
||||
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &P->X, &P->X, &l ) ); MOD_MUL( P->X );
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &P->Z, &P->Z, &l ) ); MOD_MUL( P->Z );
|
||||
|
|
@ -2970,6 +2969,97 @@ int mbedtls_ecp_muladd( mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
|
|||
}
|
||||
|
||||
#if defined(ECP_MONTGOMERY)
|
||||
#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
|
||||
#define ECP_MPI_INIT(s, n, p) {s, (n), (mbedtls_mpi_uint *)(p)}
|
||||
#define ECP_MPI_INIT_ARRAY(x) \
|
||||
ECP_MPI_INIT(1, sizeof(x) / sizeof(mbedtls_mpi_uint), x)
|
||||
/*
|
||||
* Constants for the two points other than 0, 1, -1 (mod p) in
|
||||
* https://cr.yp.to/ecdh.html#validate
|
||||
* See ecp_check_pubkey_x25519().
|
||||
*/
|
||||
static const mbedtls_mpi_uint x25519_bad_point_1[] = {
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xe0, 0xeb, 0x7a, 0x7c, 0x3b, 0x41, 0xb8, 0xae ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x16, 0x56, 0xe3, 0xfa, 0xf1, 0x9f, 0xc4, 0x6a ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xda, 0x09, 0x8d, 0xeb, 0x9c, 0x32, 0xb1, 0xfd ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x86, 0x62, 0x05, 0x16, 0x5f, 0x49, 0xb8, 0x00 ),
|
||||
};
|
||||
static const mbedtls_mpi_uint x25519_bad_point_2[] = {
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x5f, 0x9c, 0x95, 0xbc, 0xa3, 0x50, 0x8c, 0x24 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xb1, 0xd0, 0xb1, 0x55, 0x9c, 0x83, 0xef, 0x5b ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x04, 0x44, 0x5c, 0xc4, 0x58, 0x1c, 0x8e, 0x86 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xd8, 0x22, 0x4e, 0xdd, 0xd0, 0x9f, 0x11, 0x57 ),
|
||||
};
|
||||
static const mbedtls_mpi ecp_x25519_bad_point_1 = ECP_MPI_INIT_ARRAY(
|
||||
x25519_bad_point_1 );
|
||||
static const mbedtls_mpi ecp_x25519_bad_point_2 = ECP_MPI_INIT_ARRAY(
|
||||
x25519_bad_point_2 );
|
||||
#endif /* MBEDTLS_ECP_DP_CURVE25519_ENABLED */
|
||||
|
||||
/*
|
||||
* Check that the input point is not one of the low-order points.
|
||||
* This is recommended by the "May the Fourth" paper:
|
||||
* https://eprint.iacr.org/2017/806.pdf
|
||||
* Those points are never sent by an honest peer.
|
||||
*/
|
||||
static int ecp_check_bad_points_mx( const mbedtls_mpi *X, const mbedtls_mpi *P,
|
||||
const mbedtls_ecp_group_id grp_id )
|
||||
{
|
||||
int ret;
|
||||
mbedtls_mpi XmP;
|
||||
|
||||
mbedtls_mpi_init( &XmP );
|
||||
|
||||
/* Reduce X mod P so that we only need to check values less than P.
|
||||
* We know X < 2^256 so we can proceed by subtraction. */
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &XmP, X ) );
|
||||
while( mbedtls_mpi_cmp_mpi( &XmP, P ) >= 0 )
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &XmP, &XmP, P ) );
|
||||
|
||||
/* Check against the known bad values that are less than P. For Curve448
|
||||
* these are 0, 1 and -1. For Curve25519 we check the values less than P
|
||||
* from the following list: https://cr.yp.to/ecdh.html#validate */
|
||||
if( mbedtls_mpi_cmp_int( &XmP, 1 ) <= 0 ) /* takes care of 0 and 1 */
|
||||
{
|
||||
ret = MBEDTLS_ERR_ECP_INVALID_KEY;
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
|
||||
if( grp_id == MBEDTLS_ECP_DP_CURVE25519 )
|
||||
{
|
||||
if( mbedtls_mpi_cmp_mpi( &XmP, &ecp_x25519_bad_point_1 ) == 0 )
|
||||
{
|
||||
ret = MBEDTLS_ERR_ECP_INVALID_KEY;
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
if( mbedtls_mpi_cmp_mpi( &XmP, &ecp_x25519_bad_point_2 ) == 0 )
|
||||
{
|
||||
ret = MBEDTLS_ERR_ECP_INVALID_KEY;
|
||||
goto cleanup;
|
||||
}
|
||||
}
|
||||
#else
|
||||
(void) grp_id;
|
||||
#endif
|
||||
|
||||
/* Final check: check if XmP + 1 is P (final because it changes XmP!) */
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_add_int( &XmP, &XmP, 1 ) );
|
||||
if( mbedtls_mpi_cmp_mpi( &XmP, P ) == 0 )
|
||||
{
|
||||
ret = MBEDTLS_ERR_ECP_INVALID_KEY;
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
ret = 0;
|
||||
|
||||
cleanup:
|
||||
mbedtls_mpi_free( &XmP );
|
||||
|
||||
return( ret );
|
||||
}
|
||||
|
||||
/*
|
||||
* Check validity of a public key for Montgomery curves with x-only schemes
|
||||
*/
|
||||
|
|
@ -2981,7 +3071,13 @@ static int ecp_check_pubkey_mx( const mbedtls_ecp_group *grp, const mbedtls_ecp_
|
|||
if( mbedtls_mpi_size( &pt->X ) > ( grp->nbits + 7 ) / 8 )
|
||||
return( MBEDTLS_ERR_ECP_INVALID_KEY );
|
||||
|
||||
return( 0 );
|
||||
/* Implicit in all standards (as they don't consider negative numbers):
|
||||
* X must be non-negative. This is normally ensured by the way it's
|
||||
* encoded for transmission, but let's be extra sure. */
|
||||
if( mbedtls_mpi_cmp_int( &pt->X, 0 ) < 0 )
|
||||
return( MBEDTLS_ERR_ECP_INVALID_KEY );
|
||||
|
||||
return( ecp_check_bad_points_mx( &pt->X, &grp->P, grp->id ) );
|
||||
}
|
||||
#endif /* ECP_MONTGOMERY */
|
||||
|
||||
|
|
@ -3059,6 +3155,11 @@ int mbedtls_ecp_gen_privkey( const mbedtls_ecp_group *grp,
|
|||
{
|
||||
int ret = MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
|
||||
size_t n_size;
|
||||
#if defined(ECP_SHORTWEIERSTRASS)
|
||||
mbedtls_mpi one;
|
||||
|
||||
mbedtls_mpi_init( &one );
|
||||
#endif
|
||||
|
||||
ECP_VALIDATE_RET( grp != NULL );
|
||||
ECP_VALIDATE_RET( d != NULL );
|
||||
|
|
@ -3099,7 +3200,10 @@ int mbedtls_ecp_gen_privkey( const mbedtls_ecp_group *grp,
|
|||
{
|
||||
/* SEC1 3.2.1: Generate d such that 1 <= n < N */
|
||||
int count = 0;
|
||||
unsigned cmp = 0;
|
||||
unsigned lt_lower = 1, lt_upper = 0;
|
||||
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_grow( &one, grp->N.n ) );
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &one, 1 ) );
|
||||
|
||||
/*
|
||||
* Match the procedure given in RFC 6979 (deterministic ECDSA):
|
||||
|
|
@ -3123,19 +3227,22 @@ int mbedtls_ecp_gen_privkey( const mbedtls_ecp_group *grp,
|
|||
* such as secp224k1 are actually very close to the worst case.
|
||||
*/
|
||||
if( ++count > 30 )
|
||||
return( MBEDTLS_ERR_ECP_RANDOM_FAILED );
|
||||
|
||||
ret = mbedtls_mpi_lt_mpi_ct( d, &grp->N, &cmp );
|
||||
if( ret != 0 )
|
||||
{
|
||||
ret = MBEDTLS_ERR_ECP_RANDOM_FAILED;
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_lt_mpi_ct( d, &grp->N, <_upper ) );
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_lt_mpi_ct( d, &one, <_lower ) );
|
||||
}
|
||||
while( mbedtls_mpi_cmp_int( d, 1 ) < 0 || cmp != 1 );
|
||||
while( lt_lower != 0 || lt_upper == 0 );
|
||||
}
|
||||
#endif /* ECP_SHORTWEIERSTRASS */
|
||||
|
||||
cleanup:
|
||||
#if defined(ECP_SHORTWEIERSTRASS)
|
||||
mbedtls_mpi_free( &one );
|
||||
#endif
|
||||
return( ret );
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -54,6 +54,7 @@
|
|||
|
||||
#include "mbedtls/ecp.h"
|
||||
#include "mbedtls/platform_util.h"
|
||||
#include "mbedtls/bn_mul.h"
|
||||
|
||||
#include <string.h>
|
||||
|
||||
|
|
@ -70,44 +71,10 @@
|
|||
#define inline __inline
|
||||
#endif
|
||||
|
||||
/*
|
||||
* Conversion macros for embedded constants:
|
||||
* build lists of mbedtls_mpi_uint's from lists of unsigned char's grouped by 8, 4 or 2
|
||||
*/
|
||||
#if defined(MBEDTLS_HAVE_INT32)
|
||||
#define ECP_MPI_INIT(s, n, p) {s, (n), (mbedtls_mpi_uint *)(p)}
|
||||
|
||||
#define BYTES_TO_T_UINT_4( a, b, c, d ) \
|
||||
( (mbedtls_mpi_uint) (a) << 0 ) | \
|
||||
( (mbedtls_mpi_uint) (b) << 8 ) | \
|
||||
( (mbedtls_mpi_uint) (c) << 16 ) | \
|
||||
( (mbedtls_mpi_uint) (d) << 24 )
|
||||
|
||||
#define BYTES_TO_T_UINT_2( a, b ) \
|
||||
BYTES_TO_T_UINT_4( a, b, 0, 0 )
|
||||
|
||||
#define BYTES_TO_T_UINT_8( a, b, c, d, e, f, g, h ) \
|
||||
BYTES_TO_T_UINT_4( a, b, c, d ), \
|
||||
BYTES_TO_T_UINT_4( e, f, g, h )
|
||||
|
||||
#else /* 64-bits */
|
||||
|
||||
#define BYTES_TO_T_UINT_8( a, b, c, d, e, f, g, h ) \
|
||||
( (mbedtls_mpi_uint) (a) << 0 ) | \
|
||||
( (mbedtls_mpi_uint) (b) << 8 ) | \
|
||||
( (mbedtls_mpi_uint) (c) << 16 ) | \
|
||||
( (mbedtls_mpi_uint) (d) << 24 ) | \
|
||||
( (mbedtls_mpi_uint) (e) << 32 ) | \
|
||||
( (mbedtls_mpi_uint) (f) << 40 ) | \
|
||||
( (mbedtls_mpi_uint) (g) << 48 ) | \
|
||||
( (mbedtls_mpi_uint) (h) << 56 )
|
||||
|
||||
#define BYTES_TO_T_UINT_4( a, b, c, d ) \
|
||||
BYTES_TO_T_UINT_8( a, b, c, d, 0, 0, 0, 0 )
|
||||
|
||||
#define BYTES_TO_T_UINT_2( a, b ) \
|
||||
BYTES_TO_T_UINT_8( a, b, 0, 0, 0, 0, 0, 0 )
|
||||
|
||||
#endif /* bits in mbedtls_mpi_uint */
|
||||
#define ECP_MPI_INIT_ARRAY(x) \
|
||||
ECP_MPI_INIT(1, sizeof(x) / sizeof(mbedtls_mpi_uint), x)
|
||||
|
||||
/*
|
||||
* Note: the constants are in little-endian order
|
||||
|
|
@ -119,29 +86,29 @@
|
|||
*/
|
||||
#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED)
|
||||
static const mbedtls_mpi_uint secp192r1_p[] = {
|
||||
BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
BYTES_TO_T_UINT_8( 0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
};
|
||||
static const mbedtls_mpi_uint secp192r1_b[] = {
|
||||
BYTES_TO_T_UINT_8( 0xB1, 0xB9, 0x46, 0xC1, 0xEC, 0xDE, 0xB8, 0xFE ),
|
||||
BYTES_TO_T_UINT_8( 0x49, 0x30, 0x24, 0x72, 0xAB, 0xE9, 0xA7, 0x0F ),
|
||||
BYTES_TO_T_UINT_8( 0xE7, 0x80, 0x9C, 0xE5, 0x19, 0x05, 0x21, 0x64 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xB1, 0xB9, 0x46, 0xC1, 0xEC, 0xDE, 0xB8, 0xFE ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x49, 0x30, 0x24, 0x72, 0xAB, 0xE9, 0xA7, 0x0F ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xE7, 0x80, 0x9C, 0xE5, 0x19, 0x05, 0x21, 0x64 ),
|
||||
};
|
||||
static const mbedtls_mpi_uint secp192r1_gx[] = {
|
||||
BYTES_TO_T_UINT_8( 0x12, 0x10, 0xFF, 0x82, 0xFD, 0x0A, 0xFF, 0xF4 ),
|
||||
BYTES_TO_T_UINT_8( 0x00, 0x88, 0xA1, 0x43, 0xEB, 0x20, 0xBF, 0x7C ),
|
||||
BYTES_TO_T_UINT_8( 0xF6, 0x90, 0x30, 0xB0, 0x0E, 0xA8, 0x8D, 0x18 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x12, 0x10, 0xFF, 0x82, 0xFD, 0x0A, 0xFF, 0xF4 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x00, 0x88, 0xA1, 0x43, 0xEB, 0x20, 0xBF, 0x7C ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xF6, 0x90, 0x30, 0xB0, 0x0E, 0xA8, 0x8D, 0x18 ),
|
||||
};
|
||||
static const mbedtls_mpi_uint secp192r1_gy[] = {
|
||||
BYTES_TO_T_UINT_8( 0x11, 0x48, 0x79, 0x1E, 0xA1, 0x77, 0xF9, 0x73 ),
|
||||
BYTES_TO_T_UINT_8( 0xD5, 0xCD, 0x24, 0x6B, 0xED, 0x11, 0x10, 0x63 ),
|
||||
BYTES_TO_T_UINT_8( 0x78, 0xDA, 0xC8, 0xFF, 0x95, 0x2B, 0x19, 0x07 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x11, 0x48, 0x79, 0x1E, 0xA1, 0x77, 0xF9, 0x73 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xD5, 0xCD, 0x24, 0x6B, 0xED, 0x11, 0x10, 0x63 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x78, 0xDA, 0xC8, 0xFF, 0x95, 0x2B, 0x19, 0x07 ),
|
||||
};
|
||||
static const mbedtls_mpi_uint secp192r1_n[] = {
|
||||
BYTES_TO_T_UINT_8( 0x31, 0x28, 0xD2, 0xB4, 0xB1, 0xC9, 0x6B, 0x14 ),
|
||||
BYTES_TO_T_UINT_8( 0x36, 0xF8, 0xDE, 0x99, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x31, 0x28, 0xD2, 0xB4, 0xB1, 0xC9, 0x6B, 0x14 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x36, 0xF8, 0xDE, 0x99, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
};
|
||||
#endif /* MBEDTLS_ECP_DP_SECP192R1_ENABLED */
|
||||
|
||||
|
|
@ -150,34 +117,34 @@ static const mbedtls_mpi_uint secp192r1_n[] = {
|
|||
*/
|
||||
#if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED)
|
||||
static const mbedtls_mpi_uint secp224r1_p[] = {
|
||||
BYTES_TO_T_UINT_8( 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 ),
|
||||
BYTES_TO_T_UINT_8( 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00 ),
|
||||
};
|
||||
static const mbedtls_mpi_uint secp224r1_b[] = {
|
||||
BYTES_TO_T_UINT_8( 0xB4, 0xFF, 0x55, 0x23, 0x43, 0x39, 0x0B, 0x27 ),
|
||||
BYTES_TO_T_UINT_8( 0xBA, 0xD8, 0xBF, 0xD7, 0xB7, 0xB0, 0x44, 0x50 ),
|
||||
BYTES_TO_T_UINT_8( 0x56, 0x32, 0x41, 0xF5, 0xAB, 0xB3, 0x04, 0x0C ),
|
||||
BYTES_TO_T_UINT_4( 0x85, 0x0A, 0x05, 0xB4 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xB4, 0xFF, 0x55, 0x23, 0x43, 0x39, 0x0B, 0x27 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xBA, 0xD8, 0xBF, 0xD7, 0xB7, 0xB0, 0x44, 0x50 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x56, 0x32, 0x41, 0xF5, 0xAB, 0xB3, 0x04, 0x0C ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_4( 0x85, 0x0A, 0x05, 0xB4 ),
|
||||
};
|
||||
static const mbedtls_mpi_uint secp224r1_gx[] = {
|
||||
BYTES_TO_T_UINT_8( 0x21, 0x1D, 0x5C, 0x11, 0xD6, 0x80, 0x32, 0x34 ),
|
||||
BYTES_TO_T_UINT_8( 0x22, 0x11, 0xC2, 0x56, 0xD3, 0xC1, 0x03, 0x4A ),
|
||||
BYTES_TO_T_UINT_8( 0xB9, 0x90, 0x13, 0x32, 0x7F, 0xBF, 0xB4, 0x6B ),
|
||||
BYTES_TO_T_UINT_4( 0xBD, 0x0C, 0x0E, 0xB7 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x21, 0x1D, 0x5C, 0x11, 0xD6, 0x80, 0x32, 0x34 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x22, 0x11, 0xC2, 0x56, 0xD3, 0xC1, 0x03, 0x4A ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xB9, 0x90, 0x13, 0x32, 0x7F, 0xBF, 0xB4, 0x6B ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_4( 0xBD, 0x0C, 0x0E, 0xB7 ),
|
||||
};
|
||||
static const mbedtls_mpi_uint secp224r1_gy[] = {
|
||||
BYTES_TO_T_UINT_8( 0x34, 0x7E, 0x00, 0x85, 0x99, 0x81, 0xD5, 0x44 ),
|
||||
BYTES_TO_T_UINT_8( 0x64, 0x47, 0x07, 0x5A, 0xA0, 0x75, 0x43, 0xCD ),
|
||||
BYTES_TO_T_UINT_8( 0xE6, 0xDF, 0x22, 0x4C, 0xFB, 0x23, 0xF7, 0xB5 ),
|
||||
BYTES_TO_T_UINT_4( 0x88, 0x63, 0x37, 0xBD ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x34, 0x7E, 0x00, 0x85, 0x99, 0x81, 0xD5, 0x44 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x64, 0x47, 0x07, 0x5A, 0xA0, 0x75, 0x43, 0xCD ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xE6, 0xDF, 0x22, 0x4C, 0xFB, 0x23, 0xF7, 0xB5 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_4( 0x88, 0x63, 0x37, 0xBD ),
|
||||
};
|
||||
static const mbedtls_mpi_uint secp224r1_n[] = {
|
||||
BYTES_TO_T_UINT_8( 0x3D, 0x2A, 0x5C, 0x5C, 0x45, 0x29, 0xDD, 0x13 ),
|
||||
BYTES_TO_T_UINT_8( 0x3E, 0xF0, 0xB8, 0xE0, 0xA2, 0x16, 0xFF, 0xFF ),
|
||||
BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
BYTES_TO_T_UINT_4( 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x3D, 0x2A, 0x5C, 0x5C, 0x45, 0x29, 0xDD, 0x13 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x3E, 0xF0, 0xB8, 0xE0, 0xA2, 0x16, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_4( 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
};
|
||||
#endif /* MBEDTLS_ECP_DP_SECP224R1_ENABLED */
|
||||
|
||||
|
|
@ -186,34 +153,34 @@ static const mbedtls_mpi_uint secp224r1_n[] = {
|
|||
*/
|
||||
#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
|
||||
static const mbedtls_mpi_uint secp256r1_p[] = {
|
||||
BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00 ),
|
||||
BYTES_TO_T_UINT_8( 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 ),
|
||||
BYTES_TO_T_UINT_8( 0x01, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x01, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
};
|
||||
static const mbedtls_mpi_uint secp256r1_b[] = {
|
||||
BYTES_TO_T_UINT_8( 0x4B, 0x60, 0xD2, 0x27, 0x3E, 0x3C, 0xCE, 0x3B ),
|
||||
BYTES_TO_T_UINT_8( 0xF6, 0xB0, 0x53, 0xCC, 0xB0, 0x06, 0x1D, 0x65 ),
|
||||
BYTES_TO_T_UINT_8( 0xBC, 0x86, 0x98, 0x76, 0x55, 0xBD, 0xEB, 0xB3 ),
|
||||
BYTES_TO_T_UINT_8( 0xE7, 0x93, 0x3A, 0xAA, 0xD8, 0x35, 0xC6, 0x5A ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x4B, 0x60, 0xD2, 0x27, 0x3E, 0x3C, 0xCE, 0x3B ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xF6, 0xB0, 0x53, 0xCC, 0xB0, 0x06, 0x1D, 0x65 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xBC, 0x86, 0x98, 0x76, 0x55, 0xBD, 0xEB, 0xB3 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xE7, 0x93, 0x3A, 0xAA, 0xD8, 0x35, 0xC6, 0x5A ),
|
||||
};
|
||||
static const mbedtls_mpi_uint secp256r1_gx[] = {
|
||||
BYTES_TO_T_UINT_8( 0x96, 0xC2, 0x98, 0xD8, 0x45, 0x39, 0xA1, 0xF4 ),
|
||||
BYTES_TO_T_UINT_8( 0xA0, 0x33, 0xEB, 0x2D, 0x81, 0x7D, 0x03, 0x77 ),
|
||||
BYTES_TO_T_UINT_8( 0xF2, 0x40, 0xA4, 0x63, 0xE5, 0xE6, 0xBC, 0xF8 ),
|
||||
BYTES_TO_T_UINT_8( 0x47, 0x42, 0x2C, 0xE1, 0xF2, 0xD1, 0x17, 0x6B ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x96, 0xC2, 0x98, 0xD8, 0x45, 0x39, 0xA1, 0xF4 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xA0, 0x33, 0xEB, 0x2D, 0x81, 0x7D, 0x03, 0x77 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xF2, 0x40, 0xA4, 0x63, 0xE5, 0xE6, 0xBC, 0xF8 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x47, 0x42, 0x2C, 0xE1, 0xF2, 0xD1, 0x17, 0x6B ),
|
||||
};
|
||||
static const mbedtls_mpi_uint secp256r1_gy[] = {
|
||||
BYTES_TO_T_UINT_8( 0xF5, 0x51, 0xBF, 0x37, 0x68, 0x40, 0xB6, 0xCB ),
|
||||
BYTES_TO_T_UINT_8( 0xCE, 0x5E, 0x31, 0x6B, 0x57, 0x33, 0xCE, 0x2B ),
|
||||
BYTES_TO_T_UINT_8( 0x16, 0x9E, 0x0F, 0x7C, 0x4A, 0xEB, 0xE7, 0x8E ),
|
||||
BYTES_TO_T_UINT_8( 0x9B, 0x7F, 0x1A, 0xFE, 0xE2, 0x42, 0xE3, 0x4F ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xF5, 0x51, 0xBF, 0x37, 0x68, 0x40, 0xB6, 0xCB ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xCE, 0x5E, 0x31, 0x6B, 0x57, 0x33, 0xCE, 0x2B ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x16, 0x9E, 0x0F, 0x7C, 0x4A, 0xEB, 0xE7, 0x8E ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x9B, 0x7F, 0x1A, 0xFE, 0xE2, 0x42, 0xE3, 0x4F ),
|
||||
};
|
||||
static const mbedtls_mpi_uint secp256r1_n[] = {
|
||||
BYTES_TO_T_UINT_8( 0x51, 0x25, 0x63, 0xFC, 0xC2, 0xCA, 0xB9, 0xF3 ),
|
||||
BYTES_TO_T_UINT_8( 0x84, 0x9E, 0x17, 0xA7, 0xAD, 0xFA, 0xE6, 0xBC ),
|
||||
BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
BYTES_TO_T_UINT_8( 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x51, 0x25, 0x63, 0xFC, 0xC2, 0xCA, 0xB9, 0xF3 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x84, 0x9E, 0x17, 0xA7, 0xAD, 0xFA, 0xE6, 0xBC ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
};
|
||||
#endif /* MBEDTLS_ECP_DP_SECP256R1_ENABLED */
|
||||
|
||||
|
|
@ -222,44 +189,44 @@ static const mbedtls_mpi_uint secp256r1_n[] = {
|
|||
*/
|
||||
#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
|
||||
static const mbedtls_mpi_uint secp384r1_p[] = {
|
||||
BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00 ),
|
||||
BYTES_TO_T_UINT_8( 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
BYTES_TO_T_UINT_8( 0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
};
|
||||
static const mbedtls_mpi_uint secp384r1_b[] = {
|
||||
BYTES_TO_T_UINT_8( 0xEF, 0x2A, 0xEC, 0xD3, 0xED, 0xC8, 0x85, 0x2A ),
|
||||
BYTES_TO_T_UINT_8( 0x9D, 0xD1, 0x2E, 0x8A, 0x8D, 0x39, 0x56, 0xC6 ),
|
||||
BYTES_TO_T_UINT_8( 0x5A, 0x87, 0x13, 0x50, 0x8F, 0x08, 0x14, 0x03 ),
|
||||
BYTES_TO_T_UINT_8( 0x12, 0x41, 0x81, 0xFE, 0x6E, 0x9C, 0x1D, 0x18 ),
|
||||
BYTES_TO_T_UINT_8( 0x19, 0x2D, 0xF8, 0xE3, 0x6B, 0x05, 0x8E, 0x98 ),
|
||||
BYTES_TO_T_UINT_8( 0xE4, 0xE7, 0x3E, 0xE2, 0xA7, 0x2F, 0x31, 0xB3 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xEF, 0x2A, 0xEC, 0xD3, 0xED, 0xC8, 0x85, 0x2A ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x9D, 0xD1, 0x2E, 0x8A, 0x8D, 0x39, 0x56, 0xC6 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x5A, 0x87, 0x13, 0x50, 0x8F, 0x08, 0x14, 0x03 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x12, 0x41, 0x81, 0xFE, 0x6E, 0x9C, 0x1D, 0x18 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x19, 0x2D, 0xF8, 0xE3, 0x6B, 0x05, 0x8E, 0x98 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xE4, 0xE7, 0x3E, 0xE2, 0xA7, 0x2F, 0x31, 0xB3 ),
|
||||
};
|
||||
static const mbedtls_mpi_uint secp384r1_gx[] = {
|
||||
BYTES_TO_T_UINT_8( 0xB7, 0x0A, 0x76, 0x72, 0x38, 0x5E, 0x54, 0x3A ),
|
||||
BYTES_TO_T_UINT_8( 0x6C, 0x29, 0x55, 0xBF, 0x5D, 0xF2, 0x02, 0x55 ),
|
||||
BYTES_TO_T_UINT_8( 0x38, 0x2A, 0x54, 0x82, 0xE0, 0x41, 0xF7, 0x59 ),
|
||||
BYTES_TO_T_UINT_8( 0x98, 0x9B, 0xA7, 0x8B, 0x62, 0x3B, 0x1D, 0x6E ),
|
||||
BYTES_TO_T_UINT_8( 0x74, 0xAD, 0x20, 0xF3, 0x1E, 0xC7, 0xB1, 0x8E ),
|
||||
BYTES_TO_T_UINT_8( 0x37, 0x05, 0x8B, 0xBE, 0x22, 0xCA, 0x87, 0xAA ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xB7, 0x0A, 0x76, 0x72, 0x38, 0x5E, 0x54, 0x3A ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x6C, 0x29, 0x55, 0xBF, 0x5D, 0xF2, 0x02, 0x55 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x38, 0x2A, 0x54, 0x82, 0xE0, 0x41, 0xF7, 0x59 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x98, 0x9B, 0xA7, 0x8B, 0x62, 0x3B, 0x1D, 0x6E ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x74, 0xAD, 0x20, 0xF3, 0x1E, 0xC7, 0xB1, 0x8E ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x37, 0x05, 0x8B, 0xBE, 0x22, 0xCA, 0x87, 0xAA ),
|
||||
};
|
||||
static const mbedtls_mpi_uint secp384r1_gy[] = {
|
||||
BYTES_TO_T_UINT_8( 0x5F, 0x0E, 0xEA, 0x90, 0x7C, 0x1D, 0x43, 0x7A ),
|
||||
BYTES_TO_T_UINT_8( 0x9D, 0x81, 0x7E, 0x1D, 0xCE, 0xB1, 0x60, 0x0A ),
|
||||
BYTES_TO_T_UINT_8( 0xC0, 0xB8, 0xF0, 0xB5, 0x13, 0x31, 0xDA, 0xE9 ),
|
||||
BYTES_TO_T_UINT_8( 0x7C, 0x14, 0x9A, 0x28, 0xBD, 0x1D, 0xF4, 0xF8 ),
|
||||
BYTES_TO_T_UINT_8( 0x29, 0xDC, 0x92, 0x92, 0xBF, 0x98, 0x9E, 0x5D ),
|
||||
BYTES_TO_T_UINT_8( 0x6F, 0x2C, 0x26, 0x96, 0x4A, 0xDE, 0x17, 0x36 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x5F, 0x0E, 0xEA, 0x90, 0x7C, 0x1D, 0x43, 0x7A ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x9D, 0x81, 0x7E, 0x1D, 0xCE, 0xB1, 0x60, 0x0A ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xC0, 0xB8, 0xF0, 0xB5, 0x13, 0x31, 0xDA, 0xE9 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x7C, 0x14, 0x9A, 0x28, 0xBD, 0x1D, 0xF4, 0xF8 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x29, 0xDC, 0x92, 0x92, 0xBF, 0x98, 0x9E, 0x5D ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x6F, 0x2C, 0x26, 0x96, 0x4A, 0xDE, 0x17, 0x36 ),
|
||||
};
|
||||
static const mbedtls_mpi_uint secp384r1_n[] = {
|
||||
BYTES_TO_T_UINT_8( 0x73, 0x29, 0xC5, 0xCC, 0x6A, 0x19, 0xEC, 0xEC ),
|
||||
BYTES_TO_T_UINT_8( 0x7A, 0xA7, 0xB0, 0x48, 0xB2, 0x0D, 0x1A, 0x58 ),
|
||||
BYTES_TO_T_UINT_8( 0xDF, 0x2D, 0x37, 0xF4, 0x81, 0x4D, 0x63, 0xC7 ),
|
||||
BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x73, 0x29, 0xC5, 0xCC, 0x6A, 0x19, 0xEC, 0xEC ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x7A, 0xA7, 0xB0, 0x48, 0xB2, 0x0D, 0x1A, 0x58 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xDF, 0x2D, 0x37, 0xF4, 0x81, 0x4D, 0x63, 0xC7 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
};
|
||||
#endif /* MBEDTLS_ECP_DP_SECP384R1_ENABLED */
|
||||
|
||||
|
|
@ -268,154 +235,154 @@ static const mbedtls_mpi_uint secp384r1_n[] = {
|
|||
*/
|
||||
#if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
|
||||
static const mbedtls_mpi_uint secp521r1_p[] = {
|
||||
BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
BYTES_TO_T_UINT_2( 0xFF, 0x01 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_2( 0xFF, 0x01 ),
|
||||
};
|
||||
static const mbedtls_mpi_uint secp521r1_b[] = {
|
||||
BYTES_TO_T_UINT_8( 0x00, 0x3F, 0x50, 0x6B, 0xD4, 0x1F, 0x45, 0xEF ),
|
||||
BYTES_TO_T_UINT_8( 0xF1, 0x34, 0x2C, 0x3D, 0x88, 0xDF, 0x73, 0x35 ),
|
||||
BYTES_TO_T_UINT_8( 0x07, 0xBF, 0xB1, 0x3B, 0xBD, 0xC0, 0x52, 0x16 ),
|
||||
BYTES_TO_T_UINT_8( 0x7B, 0x93, 0x7E, 0xEC, 0x51, 0x39, 0x19, 0x56 ),
|
||||
BYTES_TO_T_UINT_8( 0xE1, 0x09, 0xF1, 0x8E, 0x91, 0x89, 0xB4, 0xB8 ),
|
||||
BYTES_TO_T_UINT_8( 0xF3, 0x15, 0xB3, 0x99, 0x5B, 0x72, 0xDA, 0xA2 ),
|
||||
BYTES_TO_T_UINT_8( 0xEE, 0x40, 0x85, 0xB6, 0xA0, 0x21, 0x9A, 0x92 ),
|
||||
BYTES_TO_T_UINT_8( 0x1F, 0x9A, 0x1C, 0x8E, 0x61, 0xB9, 0x3E, 0x95 ),
|
||||
BYTES_TO_T_UINT_2( 0x51, 0x00 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x00, 0x3F, 0x50, 0x6B, 0xD4, 0x1F, 0x45, 0xEF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xF1, 0x34, 0x2C, 0x3D, 0x88, 0xDF, 0x73, 0x35 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x07, 0xBF, 0xB1, 0x3B, 0xBD, 0xC0, 0x52, 0x16 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x7B, 0x93, 0x7E, 0xEC, 0x51, 0x39, 0x19, 0x56 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xE1, 0x09, 0xF1, 0x8E, 0x91, 0x89, 0xB4, 0xB8 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xF3, 0x15, 0xB3, 0x99, 0x5B, 0x72, 0xDA, 0xA2 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xEE, 0x40, 0x85, 0xB6, 0xA0, 0x21, 0x9A, 0x92 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x1F, 0x9A, 0x1C, 0x8E, 0x61, 0xB9, 0x3E, 0x95 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_2( 0x51, 0x00 ),
|
||||
};
|
||||
static const mbedtls_mpi_uint secp521r1_gx[] = {
|
||||
BYTES_TO_T_UINT_8( 0x66, 0xBD, 0xE5, 0xC2, 0x31, 0x7E, 0x7E, 0xF9 ),
|
||||
BYTES_TO_T_UINT_8( 0x9B, 0x42, 0x6A, 0x85, 0xC1, 0xB3, 0x48, 0x33 ),
|
||||
BYTES_TO_T_UINT_8( 0xDE, 0xA8, 0xFF, 0xA2, 0x27, 0xC1, 0x1D, 0xFE ),
|
||||
BYTES_TO_T_UINT_8( 0x28, 0x59, 0xE7, 0xEF, 0x77, 0x5E, 0x4B, 0xA1 ),
|
||||
BYTES_TO_T_UINT_8( 0xBA, 0x3D, 0x4D, 0x6B, 0x60, 0xAF, 0x28, 0xF8 ),
|
||||
BYTES_TO_T_UINT_8( 0x21, 0xB5, 0x3F, 0x05, 0x39, 0x81, 0x64, 0x9C ),
|
||||
BYTES_TO_T_UINT_8( 0x42, 0xB4, 0x95, 0x23, 0x66, 0xCB, 0x3E, 0x9E ),
|
||||
BYTES_TO_T_UINT_8( 0xCD, 0xE9, 0x04, 0x04, 0xB7, 0x06, 0x8E, 0x85 ),
|
||||
BYTES_TO_T_UINT_2( 0xC6, 0x00 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x66, 0xBD, 0xE5, 0xC2, 0x31, 0x7E, 0x7E, 0xF9 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x9B, 0x42, 0x6A, 0x85, 0xC1, 0xB3, 0x48, 0x33 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xDE, 0xA8, 0xFF, 0xA2, 0x27, 0xC1, 0x1D, 0xFE ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x28, 0x59, 0xE7, 0xEF, 0x77, 0x5E, 0x4B, 0xA1 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xBA, 0x3D, 0x4D, 0x6B, 0x60, 0xAF, 0x28, 0xF8 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x21, 0xB5, 0x3F, 0x05, 0x39, 0x81, 0x64, 0x9C ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x42, 0xB4, 0x95, 0x23, 0x66, 0xCB, 0x3E, 0x9E ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xCD, 0xE9, 0x04, 0x04, 0xB7, 0x06, 0x8E, 0x85 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_2( 0xC6, 0x00 ),
|
||||
};
|
||||
static const mbedtls_mpi_uint secp521r1_gy[] = {
|
||||
BYTES_TO_T_UINT_8( 0x50, 0x66, 0xD1, 0x9F, 0x76, 0x94, 0xBE, 0x88 ),
|
||||
BYTES_TO_T_UINT_8( 0x40, 0xC2, 0x72, 0xA2, 0x86, 0x70, 0x3C, 0x35 ),
|
||||
BYTES_TO_T_UINT_8( 0x61, 0x07, 0xAD, 0x3F, 0x01, 0xB9, 0x50, 0xC5 ),
|
||||
BYTES_TO_T_UINT_8( 0x40, 0x26, 0xF4, 0x5E, 0x99, 0x72, 0xEE, 0x97 ),
|
||||
BYTES_TO_T_UINT_8( 0x2C, 0x66, 0x3E, 0x27, 0x17, 0xBD, 0xAF, 0x17 ),
|
||||
BYTES_TO_T_UINT_8( 0x68, 0x44, 0x9B, 0x57, 0x49, 0x44, 0xF5, 0x98 ),
|
||||
BYTES_TO_T_UINT_8( 0xD9, 0x1B, 0x7D, 0x2C, 0xB4, 0x5F, 0x8A, 0x5C ),
|
||||
BYTES_TO_T_UINT_8( 0x04, 0xC0, 0x3B, 0x9A, 0x78, 0x6A, 0x29, 0x39 ),
|
||||
BYTES_TO_T_UINT_2( 0x18, 0x01 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x50, 0x66, 0xD1, 0x9F, 0x76, 0x94, 0xBE, 0x88 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x40, 0xC2, 0x72, 0xA2, 0x86, 0x70, 0x3C, 0x35 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x61, 0x07, 0xAD, 0x3F, 0x01, 0xB9, 0x50, 0xC5 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x40, 0x26, 0xF4, 0x5E, 0x99, 0x72, 0xEE, 0x97 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x2C, 0x66, 0x3E, 0x27, 0x17, 0xBD, 0xAF, 0x17 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x68, 0x44, 0x9B, 0x57, 0x49, 0x44, 0xF5, 0x98 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xD9, 0x1B, 0x7D, 0x2C, 0xB4, 0x5F, 0x8A, 0x5C ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x04, 0xC0, 0x3B, 0x9A, 0x78, 0x6A, 0x29, 0x39 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_2( 0x18, 0x01 ),
|
||||
};
|
||||
static const mbedtls_mpi_uint secp521r1_n[] = {
|
||||
BYTES_TO_T_UINT_8( 0x09, 0x64, 0x38, 0x91, 0x1E, 0xB7, 0x6F, 0xBB ),
|
||||
BYTES_TO_T_UINT_8( 0xAE, 0x47, 0x9C, 0x89, 0xB8, 0xC9, 0xB5, 0x3B ),
|
||||
BYTES_TO_T_UINT_8( 0xD0, 0xA5, 0x09, 0xF7, 0x48, 0x01, 0xCC, 0x7F ),
|
||||
BYTES_TO_T_UINT_8( 0x6B, 0x96, 0x2F, 0xBF, 0x83, 0x87, 0x86, 0x51 ),
|
||||
BYTES_TO_T_UINT_8( 0xFA, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
BYTES_TO_T_UINT_2( 0xFF, 0x01 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x09, 0x64, 0x38, 0x91, 0x1E, 0xB7, 0x6F, 0xBB ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xAE, 0x47, 0x9C, 0x89, 0xB8, 0xC9, 0xB5, 0x3B ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xD0, 0xA5, 0x09, 0xF7, 0x48, 0x01, 0xCC, 0x7F ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x6B, 0x96, 0x2F, 0xBF, 0x83, 0x87, 0x86, 0x51 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xFA, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_2( 0xFF, 0x01 ),
|
||||
};
|
||||
#endif /* MBEDTLS_ECP_DP_SECP521R1_ENABLED */
|
||||
|
||||
#if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED)
|
||||
static const mbedtls_mpi_uint secp192k1_p[] = {
|
||||
BYTES_TO_T_UINT_8( 0x37, 0xEE, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF ),
|
||||
BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x37, 0xEE, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
};
|
||||
static const mbedtls_mpi_uint secp192k1_a[] = {
|
||||
BYTES_TO_T_UINT_2( 0x00, 0x00 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_2( 0x00, 0x00 ),
|
||||
};
|
||||
static const mbedtls_mpi_uint secp192k1_b[] = {
|
||||
BYTES_TO_T_UINT_2( 0x03, 0x00 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_2( 0x03, 0x00 ),
|
||||
};
|
||||
static const mbedtls_mpi_uint secp192k1_gx[] = {
|
||||
BYTES_TO_T_UINT_8( 0x7D, 0x6C, 0xE0, 0xEA, 0xB1, 0xD1, 0xA5, 0x1D ),
|
||||
BYTES_TO_T_UINT_8( 0x34, 0xF4, 0xB7, 0x80, 0x02, 0x7D, 0xB0, 0x26 ),
|
||||
BYTES_TO_T_UINT_8( 0xAE, 0xE9, 0x57, 0xC0, 0x0E, 0xF1, 0x4F, 0xDB ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x7D, 0x6C, 0xE0, 0xEA, 0xB1, 0xD1, 0xA5, 0x1D ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x34, 0xF4, 0xB7, 0x80, 0x02, 0x7D, 0xB0, 0x26 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xAE, 0xE9, 0x57, 0xC0, 0x0E, 0xF1, 0x4F, 0xDB ),
|
||||
};
|
||||
static const mbedtls_mpi_uint secp192k1_gy[] = {
|
||||
BYTES_TO_T_UINT_8( 0x9D, 0x2F, 0x5E, 0xD9, 0x88, 0xAA, 0x82, 0x40 ),
|
||||
BYTES_TO_T_UINT_8( 0x34, 0x86, 0xBE, 0x15, 0xD0, 0x63, 0x41, 0x84 ),
|
||||
BYTES_TO_T_UINT_8( 0xA7, 0x28, 0x56, 0x9C, 0x6D, 0x2F, 0x2F, 0x9B ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x9D, 0x2F, 0x5E, 0xD9, 0x88, 0xAA, 0x82, 0x40 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x34, 0x86, 0xBE, 0x15, 0xD0, 0x63, 0x41, 0x84 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xA7, 0x28, 0x56, 0x9C, 0x6D, 0x2F, 0x2F, 0x9B ),
|
||||
};
|
||||
static const mbedtls_mpi_uint secp192k1_n[] = {
|
||||
BYTES_TO_T_UINT_8( 0x8D, 0xFD, 0xDE, 0x74, 0x6A, 0x46, 0x69, 0x0F ),
|
||||
BYTES_TO_T_UINT_8( 0x17, 0xFC, 0xF2, 0x26, 0xFE, 0xFF, 0xFF, 0xFF ),
|
||||
BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x8D, 0xFD, 0xDE, 0x74, 0x6A, 0x46, 0x69, 0x0F ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x17, 0xFC, 0xF2, 0x26, 0xFE, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
};
|
||||
#endif /* MBEDTLS_ECP_DP_SECP192K1_ENABLED */
|
||||
|
||||
#if defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED)
|
||||
static const mbedtls_mpi_uint secp224k1_p[] = {
|
||||
BYTES_TO_T_UINT_8( 0x6D, 0xE5, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF ),
|
||||
BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
BYTES_TO_T_UINT_4( 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x6D, 0xE5, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_4( 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
};
|
||||
static const mbedtls_mpi_uint secp224k1_a[] = {
|
||||
BYTES_TO_T_UINT_2( 0x00, 0x00 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_2( 0x00, 0x00 ),
|
||||
};
|
||||
static const mbedtls_mpi_uint secp224k1_b[] = {
|
||||
BYTES_TO_T_UINT_2( 0x05, 0x00 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_2( 0x05, 0x00 ),
|
||||
};
|
||||
static const mbedtls_mpi_uint secp224k1_gx[] = {
|
||||
BYTES_TO_T_UINT_8( 0x5C, 0xA4, 0xB7, 0xB6, 0x0E, 0x65, 0x7E, 0x0F ),
|
||||
BYTES_TO_T_UINT_8( 0xA9, 0x75, 0x70, 0xE4, 0xE9, 0x67, 0xA4, 0x69 ),
|
||||
BYTES_TO_T_UINT_8( 0xA1, 0x28, 0xFC, 0x30, 0xDF, 0x99, 0xF0, 0x4D ),
|
||||
BYTES_TO_T_UINT_4( 0x33, 0x5B, 0x45, 0xA1 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x5C, 0xA4, 0xB7, 0xB6, 0x0E, 0x65, 0x7E, 0x0F ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xA9, 0x75, 0x70, 0xE4, 0xE9, 0x67, 0xA4, 0x69 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xA1, 0x28, 0xFC, 0x30, 0xDF, 0x99, 0xF0, 0x4D ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_4( 0x33, 0x5B, 0x45, 0xA1 ),
|
||||
};
|
||||
static const mbedtls_mpi_uint secp224k1_gy[] = {
|
||||
BYTES_TO_T_UINT_8( 0xA5, 0x61, 0x6D, 0x55, 0xDB, 0x4B, 0xCA, 0xE2 ),
|
||||
BYTES_TO_T_UINT_8( 0x59, 0xBD, 0xB0, 0xC0, 0xF7, 0x19, 0xE3, 0xF7 ),
|
||||
BYTES_TO_T_UINT_8( 0xD6, 0xFB, 0xCA, 0x82, 0x42, 0x34, 0xBA, 0x7F ),
|
||||
BYTES_TO_T_UINT_4( 0xED, 0x9F, 0x08, 0x7E ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xA5, 0x61, 0x6D, 0x55, 0xDB, 0x4B, 0xCA, 0xE2 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x59, 0xBD, 0xB0, 0xC0, 0xF7, 0x19, 0xE3, 0xF7 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xD6, 0xFB, 0xCA, 0x82, 0x42, 0x34, 0xBA, 0x7F ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_4( 0xED, 0x9F, 0x08, 0x7E ),
|
||||
};
|
||||
static const mbedtls_mpi_uint secp224k1_n[] = {
|
||||
BYTES_TO_T_UINT_8( 0xF7, 0xB1, 0x9F, 0x76, 0x71, 0xA9, 0xF0, 0xCA ),
|
||||
BYTES_TO_T_UINT_8( 0x84, 0x61, 0xEC, 0xD2, 0xE8, 0xDC, 0x01, 0x00 ),
|
||||
BYTES_TO_T_UINT_8( 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 ),
|
||||
BYTES_TO_T_UINT_8( 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xF7, 0xB1, 0x9F, 0x76, 0x71, 0xA9, 0xF0, 0xCA ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x84, 0x61, 0xEC, 0xD2, 0xE8, 0xDC, 0x01, 0x00 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00 ),
|
||||
};
|
||||
#endif /* MBEDTLS_ECP_DP_SECP224K1_ENABLED */
|
||||
|
||||
#if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED)
|
||||
static const mbedtls_mpi_uint secp256k1_p[] = {
|
||||
BYTES_TO_T_UINT_8( 0x2F, 0xFC, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF ),
|
||||
BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x2F, 0xFC, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
};
|
||||
static const mbedtls_mpi_uint secp256k1_a[] = {
|
||||
BYTES_TO_T_UINT_2( 0x00, 0x00 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_2( 0x00, 0x00 ),
|
||||
};
|
||||
static const mbedtls_mpi_uint secp256k1_b[] = {
|
||||
BYTES_TO_T_UINT_2( 0x07, 0x00 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_2( 0x07, 0x00 ),
|
||||
};
|
||||
static const mbedtls_mpi_uint secp256k1_gx[] = {
|
||||
BYTES_TO_T_UINT_8( 0x98, 0x17, 0xF8, 0x16, 0x5B, 0x81, 0xF2, 0x59 ),
|
||||
BYTES_TO_T_UINT_8( 0xD9, 0x28, 0xCE, 0x2D, 0xDB, 0xFC, 0x9B, 0x02 ),
|
||||
BYTES_TO_T_UINT_8( 0x07, 0x0B, 0x87, 0xCE, 0x95, 0x62, 0xA0, 0x55 ),
|
||||
BYTES_TO_T_UINT_8( 0xAC, 0xBB, 0xDC, 0xF9, 0x7E, 0x66, 0xBE, 0x79 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x98, 0x17, 0xF8, 0x16, 0x5B, 0x81, 0xF2, 0x59 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xD9, 0x28, 0xCE, 0x2D, 0xDB, 0xFC, 0x9B, 0x02 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x07, 0x0B, 0x87, 0xCE, 0x95, 0x62, 0xA0, 0x55 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xAC, 0xBB, 0xDC, 0xF9, 0x7E, 0x66, 0xBE, 0x79 ),
|
||||
};
|
||||
static const mbedtls_mpi_uint secp256k1_gy[] = {
|
||||
BYTES_TO_T_UINT_8( 0xB8, 0xD4, 0x10, 0xFB, 0x8F, 0xD0, 0x47, 0x9C ),
|
||||
BYTES_TO_T_UINT_8( 0x19, 0x54, 0x85, 0xA6, 0x48, 0xB4, 0x17, 0xFD ),
|
||||
BYTES_TO_T_UINT_8( 0xA8, 0x08, 0x11, 0x0E, 0xFC, 0xFB, 0xA4, 0x5D ),
|
||||
BYTES_TO_T_UINT_8( 0x65, 0xC4, 0xA3, 0x26, 0x77, 0xDA, 0x3A, 0x48 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xB8, 0xD4, 0x10, 0xFB, 0x8F, 0xD0, 0x47, 0x9C ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x19, 0x54, 0x85, 0xA6, 0x48, 0xB4, 0x17, 0xFD ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xA8, 0x08, 0x11, 0x0E, 0xFC, 0xFB, 0xA4, 0x5D ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x65, 0xC4, 0xA3, 0x26, 0x77, 0xDA, 0x3A, 0x48 ),
|
||||
};
|
||||
static const mbedtls_mpi_uint secp256k1_n[] = {
|
||||
BYTES_TO_T_UINT_8( 0x41, 0x41, 0x36, 0xD0, 0x8C, 0x5E, 0xD2, 0xBF ),
|
||||
BYTES_TO_T_UINT_8( 0x3B, 0xA0, 0x48, 0xAF, 0xE6, 0xDC, 0xAE, 0xBA ),
|
||||
BYTES_TO_T_UINT_8( 0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x41, 0x41, 0x36, 0xD0, 0x8C, 0x5E, 0xD2, 0xBF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x3B, 0xA0, 0x48, 0xAF, 0xE6, 0xDC, 0xAE, 0xBA ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
};
|
||||
#endif /* MBEDTLS_ECP_DP_SECP256K1_ENABLED */
|
||||
|
||||
|
|
@ -424,40 +391,40 @@ static const mbedtls_mpi_uint secp256k1_n[] = {
|
|||
*/
|
||||
#if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED)
|
||||
static const mbedtls_mpi_uint brainpoolP256r1_p[] = {
|
||||
BYTES_TO_T_UINT_8( 0x77, 0x53, 0x6E, 0x1F, 0x1D, 0x48, 0x13, 0x20 ),
|
||||
BYTES_TO_T_UINT_8( 0x28, 0x20, 0x26, 0xD5, 0x23, 0xF6, 0x3B, 0x6E ),
|
||||
BYTES_TO_T_UINT_8( 0x72, 0x8D, 0x83, 0x9D, 0x90, 0x0A, 0x66, 0x3E ),
|
||||
BYTES_TO_T_UINT_8( 0xBC, 0xA9, 0xEE, 0xA1, 0xDB, 0x57, 0xFB, 0xA9 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x77, 0x53, 0x6E, 0x1F, 0x1D, 0x48, 0x13, 0x20 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x28, 0x20, 0x26, 0xD5, 0x23, 0xF6, 0x3B, 0x6E ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x72, 0x8D, 0x83, 0x9D, 0x90, 0x0A, 0x66, 0x3E ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xBC, 0xA9, 0xEE, 0xA1, 0xDB, 0x57, 0xFB, 0xA9 ),
|
||||
};
|
||||
static const mbedtls_mpi_uint brainpoolP256r1_a[] = {
|
||||
BYTES_TO_T_UINT_8( 0xD9, 0xB5, 0x30, 0xF3, 0x44, 0x4B, 0x4A, 0xE9 ),
|
||||
BYTES_TO_T_UINT_8( 0x6C, 0x5C, 0xDC, 0x26, 0xC1, 0x55, 0x80, 0xFB ),
|
||||
BYTES_TO_T_UINT_8( 0xE7, 0xFF, 0x7A, 0x41, 0x30, 0x75, 0xF6, 0xEE ),
|
||||
BYTES_TO_T_UINT_8( 0x57, 0x30, 0x2C, 0xFC, 0x75, 0x09, 0x5A, 0x7D ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xD9, 0xB5, 0x30, 0xF3, 0x44, 0x4B, 0x4A, 0xE9 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x6C, 0x5C, 0xDC, 0x26, 0xC1, 0x55, 0x80, 0xFB ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xE7, 0xFF, 0x7A, 0x41, 0x30, 0x75, 0xF6, 0xEE ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x57, 0x30, 0x2C, 0xFC, 0x75, 0x09, 0x5A, 0x7D ),
|
||||
};
|
||||
static const mbedtls_mpi_uint brainpoolP256r1_b[] = {
|
||||
BYTES_TO_T_UINT_8( 0xB6, 0x07, 0x8C, 0xFF, 0x18, 0xDC, 0xCC, 0x6B ),
|
||||
BYTES_TO_T_UINT_8( 0xCE, 0xE1, 0xF7, 0x5C, 0x29, 0x16, 0x84, 0x95 ),
|
||||
BYTES_TO_T_UINT_8( 0xBF, 0x7C, 0xD7, 0xBB, 0xD9, 0xB5, 0x30, 0xF3 ),
|
||||
BYTES_TO_T_UINT_8( 0x44, 0x4B, 0x4A, 0xE9, 0x6C, 0x5C, 0xDC, 0x26 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xB6, 0x07, 0x8C, 0xFF, 0x18, 0xDC, 0xCC, 0x6B ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xCE, 0xE1, 0xF7, 0x5C, 0x29, 0x16, 0x84, 0x95 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xBF, 0x7C, 0xD7, 0xBB, 0xD9, 0xB5, 0x30, 0xF3 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x44, 0x4B, 0x4A, 0xE9, 0x6C, 0x5C, 0xDC, 0x26 ),
|
||||
};
|
||||
static const mbedtls_mpi_uint brainpoolP256r1_gx[] = {
|
||||
BYTES_TO_T_UINT_8( 0x62, 0x32, 0xCE, 0x9A, 0xBD, 0x53, 0x44, 0x3A ),
|
||||
BYTES_TO_T_UINT_8( 0xC2, 0x23, 0xBD, 0xE3, 0xE1, 0x27, 0xDE, 0xB9 ),
|
||||
BYTES_TO_T_UINT_8( 0xAF, 0xB7, 0x81, 0xFC, 0x2F, 0x48, 0x4B, 0x2C ),
|
||||
BYTES_TO_T_UINT_8( 0xCB, 0x57, 0x7E, 0xCB, 0xB9, 0xAE, 0xD2, 0x8B ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x62, 0x32, 0xCE, 0x9A, 0xBD, 0x53, 0x44, 0x3A ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xC2, 0x23, 0xBD, 0xE3, 0xE1, 0x27, 0xDE, 0xB9 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xAF, 0xB7, 0x81, 0xFC, 0x2F, 0x48, 0x4B, 0x2C ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xCB, 0x57, 0x7E, 0xCB, 0xB9, 0xAE, 0xD2, 0x8B ),
|
||||
};
|
||||
static const mbedtls_mpi_uint brainpoolP256r1_gy[] = {
|
||||
BYTES_TO_T_UINT_8( 0x97, 0x69, 0x04, 0x2F, 0xC7, 0x54, 0x1D, 0x5C ),
|
||||
BYTES_TO_T_UINT_8( 0x54, 0x8E, 0xED, 0x2D, 0x13, 0x45, 0x77, 0xC2 ),
|
||||
BYTES_TO_T_UINT_8( 0xC9, 0x1D, 0x61, 0x14, 0x1A, 0x46, 0xF8, 0x97 ),
|
||||
BYTES_TO_T_UINT_8( 0xFD, 0xC4, 0xDA, 0xC3, 0x35, 0xF8, 0x7E, 0x54 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x97, 0x69, 0x04, 0x2F, 0xC7, 0x54, 0x1D, 0x5C ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x54, 0x8E, 0xED, 0x2D, 0x13, 0x45, 0x77, 0xC2 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xC9, 0x1D, 0x61, 0x14, 0x1A, 0x46, 0xF8, 0x97 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xFD, 0xC4, 0xDA, 0xC3, 0x35, 0xF8, 0x7E, 0x54 ),
|
||||
};
|
||||
static const mbedtls_mpi_uint brainpoolP256r1_n[] = {
|
||||
BYTES_TO_T_UINT_8( 0xA7, 0x56, 0x48, 0x97, 0x82, 0x0E, 0x1E, 0x90 ),
|
||||
BYTES_TO_T_UINT_8( 0xF7, 0xA6, 0x61, 0xB5, 0xA3, 0x7A, 0x39, 0x8C ),
|
||||
BYTES_TO_T_UINT_8( 0x71, 0x8D, 0x83, 0x9D, 0x90, 0x0A, 0x66, 0x3E ),
|
||||
BYTES_TO_T_UINT_8( 0xBC, 0xA9, 0xEE, 0xA1, 0xDB, 0x57, 0xFB, 0xA9 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xA7, 0x56, 0x48, 0x97, 0x82, 0x0E, 0x1E, 0x90 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xF7, 0xA6, 0x61, 0xB5, 0xA3, 0x7A, 0x39, 0x8C ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x71, 0x8D, 0x83, 0x9D, 0x90, 0x0A, 0x66, 0x3E ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xBC, 0xA9, 0xEE, 0xA1, 0xDB, 0x57, 0xFB, 0xA9 ),
|
||||
};
|
||||
#endif /* MBEDTLS_ECP_DP_BP256R1_ENABLED */
|
||||
|
||||
|
|
@ -466,52 +433,52 @@ static const mbedtls_mpi_uint brainpoolP256r1_n[] = {
|
|||
*/
|
||||
#if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED)
|
||||
static const mbedtls_mpi_uint brainpoolP384r1_p[] = {
|
||||
BYTES_TO_T_UINT_8( 0x53, 0xEC, 0x07, 0x31, 0x13, 0x00, 0x47, 0x87 ),
|
||||
BYTES_TO_T_UINT_8( 0x71, 0x1A, 0x1D, 0x90, 0x29, 0xA7, 0xD3, 0xAC ),
|
||||
BYTES_TO_T_UINT_8( 0x23, 0x11, 0xB7, 0x7F, 0x19, 0xDA, 0xB1, 0x12 ),
|
||||
BYTES_TO_T_UINT_8( 0xB4, 0x56, 0x54, 0xED, 0x09, 0x71, 0x2F, 0x15 ),
|
||||
BYTES_TO_T_UINT_8( 0xDF, 0x41, 0xE6, 0x50, 0x7E, 0x6F, 0x5D, 0x0F ),
|
||||
BYTES_TO_T_UINT_8( 0x28, 0x6D, 0x38, 0xA3, 0x82, 0x1E, 0xB9, 0x8C ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x53, 0xEC, 0x07, 0x31, 0x13, 0x00, 0x47, 0x87 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x71, 0x1A, 0x1D, 0x90, 0x29, 0xA7, 0xD3, 0xAC ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x23, 0x11, 0xB7, 0x7F, 0x19, 0xDA, 0xB1, 0x12 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xB4, 0x56, 0x54, 0xED, 0x09, 0x71, 0x2F, 0x15 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xDF, 0x41, 0xE6, 0x50, 0x7E, 0x6F, 0x5D, 0x0F ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x28, 0x6D, 0x38, 0xA3, 0x82, 0x1E, 0xB9, 0x8C ),
|
||||
};
|
||||
static const mbedtls_mpi_uint brainpoolP384r1_a[] = {
|
||||
BYTES_TO_T_UINT_8( 0x26, 0x28, 0xCE, 0x22, 0xDD, 0xC7, 0xA8, 0x04 ),
|
||||
BYTES_TO_T_UINT_8( 0xEB, 0xD4, 0x3A, 0x50, 0x4A, 0x81, 0xA5, 0x8A ),
|
||||
BYTES_TO_T_UINT_8( 0x0F, 0xF9, 0x91, 0xBA, 0xEF, 0x65, 0x91, 0x13 ),
|
||||
BYTES_TO_T_UINT_8( 0x87, 0x27, 0xB2, 0x4F, 0x8E, 0xA2, 0xBE, 0xC2 ),
|
||||
BYTES_TO_T_UINT_8( 0xA0, 0xAF, 0x05, 0xCE, 0x0A, 0x08, 0x72, 0x3C ),
|
||||
BYTES_TO_T_UINT_8( 0x0C, 0x15, 0x8C, 0x3D, 0xC6, 0x82, 0xC3, 0x7B ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x26, 0x28, 0xCE, 0x22, 0xDD, 0xC7, 0xA8, 0x04 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xEB, 0xD4, 0x3A, 0x50, 0x4A, 0x81, 0xA5, 0x8A ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x0F, 0xF9, 0x91, 0xBA, 0xEF, 0x65, 0x91, 0x13 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x87, 0x27, 0xB2, 0x4F, 0x8E, 0xA2, 0xBE, 0xC2 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xA0, 0xAF, 0x05, 0xCE, 0x0A, 0x08, 0x72, 0x3C ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x0C, 0x15, 0x8C, 0x3D, 0xC6, 0x82, 0xC3, 0x7B ),
|
||||
};
|
||||
static const mbedtls_mpi_uint brainpoolP384r1_b[] = {
|
||||
BYTES_TO_T_UINT_8( 0x11, 0x4C, 0x50, 0xFA, 0x96, 0x86, 0xB7, 0x3A ),
|
||||
BYTES_TO_T_UINT_8( 0x94, 0xC9, 0xDB, 0x95, 0x02, 0x39, 0xB4, 0x7C ),
|
||||
BYTES_TO_T_UINT_8( 0xD5, 0x62, 0xEB, 0x3E, 0xA5, 0x0E, 0x88, 0x2E ),
|
||||
BYTES_TO_T_UINT_8( 0xA6, 0xD2, 0xDC, 0x07, 0xE1, 0x7D, 0xB7, 0x2F ),
|
||||
BYTES_TO_T_UINT_8( 0x7C, 0x44, 0xF0, 0x16, 0x54, 0xB5, 0x39, 0x8B ),
|
||||
BYTES_TO_T_UINT_8( 0x26, 0x28, 0xCE, 0x22, 0xDD, 0xC7, 0xA8, 0x04 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x11, 0x4C, 0x50, 0xFA, 0x96, 0x86, 0xB7, 0x3A ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x94, 0xC9, 0xDB, 0x95, 0x02, 0x39, 0xB4, 0x7C ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xD5, 0x62, 0xEB, 0x3E, 0xA5, 0x0E, 0x88, 0x2E ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xA6, 0xD2, 0xDC, 0x07, 0xE1, 0x7D, 0xB7, 0x2F ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x7C, 0x44, 0xF0, 0x16, 0x54, 0xB5, 0x39, 0x8B ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x26, 0x28, 0xCE, 0x22, 0xDD, 0xC7, 0xA8, 0x04 ),
|
||||
};
|
||||
static const mbedtls_mpi_uint brainpoolP384r1_gx[] = {
|
||||
BYTES_TO_T_UINT_8( 0x1E, 0xAF, 0xD4, 0x47, 0xE2, 0xB2, 0x87, 0xEF ),
|
||||
BYTES_TO_T_UINT_8( 0xAA, 0x46, 0xD6, 0x36, 0x34, 0xE0, 0x26, 0xE8 ),
|
||||
BYTES_TO_T_UINT_8( 0xE8, 0x10, 0xBD, 0x0C, 0xFE, 0xCA, 0x7F, 0xDB ),
|
||||
BYTES_TO_T_UINT_8( 0xE3, 0x4F, 0xF1, 0x7E, 0xE7, 0xA3, 0x47, 0x88 ),
|
||||
BYTES_TO_T_UINT_8( 0x6B, 0x3F, 0xC1, 0xB7, 0x81, 0x3A, 0xA6, 0xA2 ),
|
||||
BYTES_TO_T_UINT_8( 0xFF, 0x45, 0xCF, 0x68, 0xF0, 0x64, 0x1C, 0x1D ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x1E, 0xAF, 0xD4, 0x47, 0xE2, 0xB2, 0x87, 0xEF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xAA, 0x46, 0xD6, 0x36, 0x34, 0xE0, 0x26, 0xE8 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xE8, 0x10, 0xBD, 0x0C, 0xFE, 0xCA, 0x7F, 0xDB ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xE3, 0x4F, 0xF1, 0x7E, 0xE7, 0xA3, 0x47, 0x88 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x6B, 0x3F, 0xC1, 0xB7, 0x81, 0x3A, 0xA6, 0xA2 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0x45, 0xCF, 0x68, 0xF0, 0x64, 0x1C, 0x1D ),
|
||||
};
|
||||
static const mbedtls_mpi_uint brainpoolP384r1_gy[] = {
|
||||
BYTES_TO_T_UINT_8( 0x15, 0x53, 0x3C, 0x26, 0x41, 0x03, 0x82, 0x42 ),
|
||||
BYTES_TO_T_UINT_8( 0x11, 0x81, 0x91, 0x77, 0x21, 0x46, 0x46, 0x0E ),
|
||||
BYTES_TO_T_UINT_8( 0x28, 0x29, 0x91, 0xF9, 0x4F, 0x05, 0x9C, 0xE1 ),
|
||||
BYTES_TO_T_UINT_8( 0x64, 0x58, 0xEC, 0xFE, 0x29, 0x0B, 0xB7, 0x62 ),
|
||||
BYTES_TO_T_UINT_8( 0x52, 0xD5, 0xCF, 0x95, 0x8E, 0xEB, 0xB1, 0x5C ),
|
||||
BYTES_TO_T_UINT_8( 0xA4, 0xC2, 0xF9, 0x20, 0x75, 0x1D, 0xBE, 0x8A ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x15, 0x53, 0x3C, 0x26, 0x41, 0x03, 0x82, 0x42 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x11, 0x81, 0x91, 0x77, 0x21, 0x46, 0x46, 0x0E ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x28, 0x29, 0x91, 0xF9, 0x4F, 0x05, 0x9C, 0xE1 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x64, 0x58, 0xEC, 0xFE, 0x29, 0x0B, 0xB7, 0x62 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x52, 0xD5, 0xCF, 0x95, 0x8E, 0xEB, 0xB1, 0x5C ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xA4, 0xC2, 0xF9, 0x20, 0x75, 0x1D, 0xBE, 0x8A ),
|
||||
};
|
||||
static const mbedtls_mpi_uint brainpoolP384r1_n[] = {
|
||||
BYTES_TO_T_UINT_8( 0x65, 0x65, 0x04, 0xE9, 0x02, 0x32, 0x88, 0x3B ),
|
||||
BYTES_TO_T_UINT_8( 0x10, 0xC3, 0x7F, 0x6B, 0xAF, 0xB6, 0x3A, 0xCF ),
|
||||
BYTES_TO_T_UINT_8( 0xA7, 0x25, 0x04, 0xAC, 0x6C, 0x6E, 0x16, 0x1F ),
|
||||
BYTES_TO_T_UINT_8( 0xB3, 0x56, 0x54, 0xED, 0x09, 0x71, 0x2F, 0x15 ),
|
||||
BYTES_TO_T_UINT_8( 0xDF, 0x41, 0xE6, 0x50, 0x7E, 0x6F, 0x5D, 0x0F ),
|
||||
BYTES_TO_T_UINT_8( 0x28, 0x6D, 0x38, 0xA3, 0x82, 0x1E, 0xB9, 0x8C ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x65, 0x65, 0x04, 0xE9, 0x02, 0x32, 0x88, 0x3B ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x10, 0xC3, 0x7F, 0x6B, 0xAF, 0xB6, 0x3A, 0xCF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xA7, 0x25, 0x04, 0xAC, 0x6C, 0x6E, 0x16, 0x1F ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xB3, 0x56, 0x54, 0xED, 0x09, 0x71, 0x2F, 0x15 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xDF, 0x41, 0xE6, 0x50, 0x7E, 0x6F, 0x5D, 0x0F ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x28, 0x6D, 0x38, 0xA3, 0x82, 0x1E, 0xB9, 0x8C ),
|
||||
};
|
||||
#endif /* MBEDTLS_ECP_DP_BP384R1_ENABLED */
|
||||
|
||||
|
|
@ -520,64 +487,64 @@ static const mbedtls_mpi_uint brainpoolP384r1_n[] = {
|
|||
*/
|
||||
#if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED)
|
||||
static const mbedtls_mpi_uint brainpoolP512r1_p[] = {
|
||||
BYTES_TO_T_UINT_8( 0xF3, 0x48, 0x3A, 0x58, 0x56, 0x60, 0xAA, 0x28 ),
|
||||
BYTES_TO_T_UINT_8( 0x85, 0xC6, 0x82, 0x2D, 0x2F, 0xFF, 0x81, 0x28 ),
|
||||
BYTES_TO_T_UINT_8( 0xE6, 0x80, 0xA3, 0xE6, 0x2A, 0xA1, 0xCD, 0xAE ),
|
||||
BYTES_TO_T_UINT_8( 0x42, 0x68, 0xC6, 0x9B, 0x00, 0x9B, 0x4D, 0x7D ),
|
||||
BYTES_TO_T_UINT_8( 0x71, 0x08, 0x33, 0x70, 0xCA, 0x9C, 0x63, 0xD6 ),
|
||||
BYTES_TO_T_UINT_8( 0x0E, 0xD2, 0xC9, 0xB3, 0xB3, 0x8D, 0x30, 0xCB ),
|
||||
BYTES_TO_T_UINT_8( 0x07, 0xFC, 0xC9, 0x33, 0xAE, 0xE6, 0xD4, 0x3F ),
|
||||
BYTES_TO_T_UINT_8( 0x8B, 0xC4, 0xE9, 0xDB, 0xB8, 0x9D, 0xDD, 0xAA ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xF3, 0x48, 0x3A, 0x58, 0x56, 0x60, 0xAA, 0x28 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x85, 0xC6, 0x82, 0x2D, 0x2F, 0xFF, 0x81, 0x28 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xE6, 0x80, 0xA3, 0xE6, 0x2A, 0xA1, 0xCD, 0xAE ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x42, 0x68, 0xC6, 0x9B, 0x00, 0x9B, 0x4D, 0x7D ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x71, 0x08, 0x33, 0x70, 0xCA, 0x9C, 0x63, 0xD6 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x0E, 0xD2, 0xC9, 0xB3, 0xB3, 0x8D, 0x30, 0xCB ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x07, 0xFC, 0xC9, 0x33, 0xAE, 0xE6, 0xD4, 0x3F ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x8B, 0xC4, 0xE9, 0xDB, 0xB8, 0x9D, 0xDD, 0xAA ),
|
||||
};
|
||||
static const mbedtls_mpi_uint brainpoolP512r1_a[] = {
|
||||
BYTES_TO_T_UINT_8( 0xCA, 0x94, 0xFC, 0x77, 0x4D, 0xAC, 0xC1, 0xE7 ),
|
||||
BYTES_TO_T_UINT_8( 0xB9, 0xC7, 0xF2, 0x2B, 0xA7, 0x17, 0x11, 0x7F ),
|
||||
BYTES_TO_T_UINT_8( 0xB5, 0xC8, 0x9A, 0x8B, 0xC9, 0xF1, 0x2E, 0x0A ),
|
||||
BYTES_TO_T_UINT_8( 0xA1, 0x3A, 0x25, 0xA8, 0x5A, 0x5D, 0xED, 0x2D ),
|
||||
BYTES_TO_T_UINT_8( 0xBC, 0x63, 0x98, 0xEA, 0xCA, 0x41, 0x34, 0xA8 ),
|
||||
BYTES_TO_T_UINT_8( 0x10, 0x16, 0xF9, 0x3D, 0x8D, 0xDD, 0xCB, 0x94 ),
|
||||
BYTES_TO_T_UINT_8( 0xC5, 0x4C, 0x23, 0xAC, 0x45, 0x71, 0x32, 0xE2 ),
|
||||
BYTES_TO_T_UINT_8( 0x89, 0x3B, 0x60, 0x8B, 0x31, 0xA3, 0x30, 0x78 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xCA, 0x94, 0xFC, 0x77, 0x4D, 0xAC, 0xC1, 0xE7 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xB9, 0xC7, 0xF2, 0x2B, 0xA7, 0x17, 0x11, 0x7F ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xB5, 0xC8, 0x9A, 0x8B, 0xC9, 0xF1, 0x2E, 0x0A ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xA1, 0x3A, 0x25, 0xA8, 0x5A, 0x5D, 0xED, 0x2D ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xBC, 0x63, 0x98, 0xEA, 0xCA, 0x41, 0x34, 0xA8 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x10, 0x16, 0xF9, 0x3D, 0x8D, 0xDD, 0xCB, 0x94 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xC5, 0x4C, 0x23, 0xAC, 0x45, 0x71, 0x32, 0xE2 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x89, 0x3B, 0x60, 0x8B, 0x31, 0xA3, 0x30, 0x78 ),
|
||||
};
|
||||
static const mbedtls_mpi_uint brainpoolP512r1_b[] = {
|
||||
BYTES_TO_T_UINT_8( 0x23, 0xF7, 0x16, 0x80, 0x63, 0xBD, 0x09, 0x28 ),
|
||||
BYTES_TO_T_UINT_8( 0xDD, 0xE5, 0xBA, 0x5E, 0xB7, 0x50, 0x40, 0x98 ),
|
||||
BYTES_TO_T_UINT_8( 0x67, 0x3E, 0x08, 0xDC, 0xCA, 0x94, 0xFC, 0x77 ),
|
||||
BYTES_TO_T_UINT_8( 0x4D, 0xAC, 0xC1, 0xE7, 0xB9, 0xC7, 0xF2, 0x2B ),
|
||||
BYTES_TO_T_UINT_8( 0xA7, 0x17, 0x11, 0x7F, 0xB5, 0xC8, 0x9A, 0x8B ),
|
||||
BYTES_TO_T_UINT_8( 0xC9, 0xF1, 0x2E, 0x0A, 0xA1, 0x3A, 0x25, 0xA8 ),
|
||||
BYTES_TO_T_UINT_8( 0x5A, 0x5D, 0xED, 0x2D, 0xBC, 0x63, 0x98, 0xEA ),
|
||||
BYTES_TO_T_UINT_8( 0xCA, 0x41, 0x34, 0xA8, 0x10, 0x16, 0xF9, 0x3D ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x23, 0xF7, 0x16, 0x80, 0x63, 0xBD, 0x09, 0x28 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xDD, 0xE5, 0xBA, 0x5E, 0xB7, 0x50, 0x40, 0x98 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x67, 0x3E, 0x08, 0xDC, 0xCA, 0x94, 0xFC, 0x77 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x4D, 0xAC, 0xC1, 0xE7, 0xB9, 0xC7, 0xF2, 0x2B ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xA7, 0x17, 0x11, 0x7F, 0xB5, 0xC8, 0x9A, 0x8B ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xC9, 0xF1, 0x2E, 0x0A, 0xA1, 0x3A, 0x25, 0xA8 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x5A, 0x5D, 0xED, 0x2D, 0xBC, 0x63, 0x98, 0xEA ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xCA, 0x41, 0x34, 0xA8, 0x10, 0x16, 0xF9, 0x3D ),
|
||||
};
|
||||
static const mbedtls_mpi_uint brainpoolP512r1_gx[] = {
|
||||
BYTES_TO_T_UINT_8( 0x22, 0xF8, 0xB9, 0xBC, 0x09, 0x22, 0x35, 0x8B ),
|
||||
BYTES_TO_T_UINT_8( 0x68, 0x5E, 0x6A, 0x40, 0x47, 0x50, 0x6D, 0x7C ),
|
||||
BYTES_TO_T_UINT_8( 0x5F, 0x7D, 0xB9, 0x93, 0x7B, 0x68, 0xD1, 0x50 ),
|
||||
BYTES_TO_T_UINT_8( 0x8D, 0xD4, 0xD0, 0xE2, 0x78, 0x1F, 0x3B, 0xFF ),
|
||||
BYTES_TO_T_UINT_8( 0x8E, 0x09, 0xD0, 0xF4, 0xEE, 0x62, 0x3B, 0xB4 ),
|
||||
BYTES_TO_T_UINT_8( 0xC1, 0x16, 0xD9, 0xB5, 0x70, 0x9F, 0xED, 0x85 ),
|
||||
BYTES_TO_T_UINT_8( 0x93, 0x6A, 0x4C, 0x9C, 0x2E, 0x32, 0x21, 0x5A ),
|
||||
BYTES_TO_T_UINT_8( 0x64, 0xD9, 0x2E, 0xD8, 0xBD, 0xE4, 0xAE, 0x81 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x22, 0xF8, 0xB9, 0xBC, 0x09, 0x22, 0x35, 0x8B ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x68, 0x5E, 0x6A, 0x40, 0x47, 0x50, 0x6D, 0x7C ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x5F, 0x7D, 0xB9, 0x93, 0x7B, 0x68, 0xD1, 0x50 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x8D, 0xD4, 0xD0, 0xE2, 0x78, 0x1F, 0x3B, 0xFF ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x8E, 0x09, 0xD0, 0xF4, 0xEE, 0x62, 0x3B, 0xB4 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xC1, 0x16, 0xD9, 0xB5, 0x70, 0x9F, 0xED, 0x85 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x93, 0x6A, 0x4C, 0x9C, 0x2E, 0x32, 0x21, 0x5A ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x64, 0xD9, 0x2E, 0xD8, 0xBD, 0xE4, 0xAE, 0x81 ),
|
||||
};
|
||||
static const mbedtls_mpi_uint brainpoolP512r1_gy[] = {
|
||||
BYTES_TO_T_UINT_8( 0x92, 0x08, 0xD8, 0x3A, 0x0F, 0x1E, 0xCD, 0x78 ),
|
||||
BYTES_TO_T_UINT_8( 0x06, 0x54, 0xF0, 0xA8, 0x2F, 0x2B, 0xCA, 0xD1 ),
|
||||
BYTES_TO_T_UINT_8( 0xAE, 0x63, 0x27, 0x8A, 0xD8, 0x4B, 0xCA, 0x5B ),
|
||||
BYTES_TO_T_UINT_8( 0x5E, 0x48, 0x5F, 0x4A, 0x49, 0xDE, 0xDC, 0xB2 ),
|
||||
BYTES_TO_T_UINT_8( 0x11, 0x81, 0x1F, 0x88, 0x5B, 0xC5, 0x00, 0xA0 ),
|
||||
BYTES_TO_T_UINT_8( 0x1A, 0x7B, 0xA5, 0x24, 0x00, 0xF7, 0x09, 0xF2 ),
|
||||
BYTES_TO_T_UINT_8( 0xFD, 0x22, 0x78, 0xCF, 0xA9, 0xBF, 0xEA, 0xC0 ),
|
||||
BYTES_TO_T_UINT_8( 0xEC, 0x32, 0x63, 0x56, 0x5D, 0x38, 0xDE, 0x7D ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x92, 0x08, 0xD8, 0x3A, 0x0F, 0x1E, 0xCD, 0x78 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x06, 0x54, 0xF0, 0xA8, 0x2F, 0x2B, 0xCA, 0xD1 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xAE, 0x63, 0x27, 0x8A, 0xD8, 0x4B, 0xCA, 0x5B ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x5E, 0x48, 0x5F, 0x4A, 0x49, 0xDE, 0xDC, 0xB2 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x11, 0x81, 0x1F, 0x88, 0x5B, 0xC5, 0x00, 0xA0 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x1A, 0x7B, 0xA5, 0x24, 0x00, 0xF7, 0x09, 0xF2 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xFD, 0x22, 0x78, 0xCF, 0xA9, 0xBF, 0xEA, 0xC0 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xEC, 0x32, 0x63, 0x56, 0x5D, 0x38, 0xDE, 0x7D ),
|
||||
};
|
||||
static const mbedtls_mpi_uint brainpoolP512r1_n[] = {
|
||||
BYTES_TO_T_UINT_8( 0x69, 0x00, 0xA9, 0x9C, 0x82, 0x96, 0x87, 0xB5 ),
|
||||
BYTES_TO_T_UINT_8( 0xDD, 0xDA, 0x5D, 0x08, 0x81, 0xD3, 0xB1, 0x1D ),
|
||||
BYTES_TO_T_UINT_8( 0x47, 0x10, 0xAC, 0x7F, 0x19, 0x61, 0x86, 0x41 ),
|
||||
BYTES_TO_T_UINT_8( 0x19, 0x26, 0xA9, 0x4C, 0x41, 0x5C, 0x3E, 0x55 ),
|
||||
BYTES_TO_T_UINT_8( 0x70, 0x08, 0x33, 0x70, 0xCA, 0x9C, 0x63, 0xD6 ),
|
||||
BYTES_TO_T_UINT_8( 0x0E, 0xD2, 0xC9, 0xB3, 0xB3, 0x8D, 0x30, 0xCB ),
|
||||
BYTES_TO_T_UINT_8( 0x07, 0xFC, 0xC9, 0x33, 0xAE, 0xE6, 0xD4, 0x3F ),
|
||||
BYTES_TO_T_UINT_8( 0x8B, 0xC4, 0xE9, 0xDB, 0xB8, 0x9D, 0xDD, 0xAA ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x69, 0x00, 0xA9, 0x9C, 0x82, 0x96, 0x87, 0xB5 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xDD, 0xDA, 0x5D, 0x08, 0x81, 0xD3, 0xB1, 0x1D ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x47, 0x10, 0xAC, 0x7F, 0x19, 0x61, 0x86, 0x41 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x19, 0x26, 0xA9, 0x4C, 0x41, 0x5C, 0x3E, 0x55 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x70, 0x08, 0x33, 0x70, 0xCA, 0x9C, 0x63, 0xD6 ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x0E, 0xD2, 0xC9, 0xB3, 0xB3, 0x8D, 0x30, 0xCB ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x07, 0xFC, 0xC9, 0x33, 0xAE, 0xE6, 0xD4, 0x3F ),
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x8B, 0xC4, 0xE9, 0xDB, 0xB8, 0x9D, 0xDD, 0xAA ),
|
||||
};
|
||||
#endif /* MBEDTLS_ECP_DP_BP512R1_ENABLED */
|
||||
|
||||
|
|
@ -689,6 +656,13 @@ static int ecp_mod_p256k1( mbedtls_mpi * );
|
|||
G ## _n, sizeof( G ## _n ) )
|
||||
|
||||
#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
|
||||
/* Constants used by ecp_use_curve25519() */
|
||||
static const mbedtls_mpi_sint curve25519_a24 = 0x01DB42;
|
||||
static const unsigned char curve25519_part_of_n[] = {
|
||||
0x14, 0xDE, 0xF9, 0xDE, 0xA2, 0xF7, 0x9C, 0xD6,
|
||||
0x58, 0x12, 0x63, 0x1A, 0x5C, 0xF5, 0xD3, 0xED,
|
||||
};
|
||||
|
||||
/*
|
||||
* Specialized function for creating the Curve25519 group
|
||||
*/
|
||||
|
|
@ -697,7 +671,7 @@ static int ecp_use_curve25519( mbedtls_ecp_group *grp )
|
|||
int ret;
|
||||
|
||||
/* Actually ( A + 2 ) / 4 */
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &grp->A, 16, "01DB42" ) );
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &grp->A, curve25519_a24 ) );
|
||||
|
||||
/* P = 2^255 - 19 */
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &grp->P, 1 ) );
|
||||
|
|
@ -706,8 +680,8 @@ static int ecp_use_curve25519( mbedtls_ecp_group *grp )
|
|||
grp->pbits = mbedtls_mpi_bitlen( &grp->P );
|
||||
|
||||
/* N = 2^252 + 27742317777372353535851937790883648493 */
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &grp->N, 16,
|
||||
"14DEF9DEA2F79CD65812631A5CF5D3ED" ) );
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &grp->N,
|
||||
curve25519_part_of_n, sizeof( curve25519_part_of_n ) ) );
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( &grp->N, 252, 1 ) );
|
||||
|
||||
/* Y intentionally not set, since we use x/z coordinates.
|
||||
|
|
@ -728,6 +702,15 @@ cleanup:
|
|||
#endif /* MBEDTLS_ECP_DP_CURVE25519_ENABLED */
|
||||
|
||||
#if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
|
||||
/* Constants used by ecp_use_curve448() */
|
||||
static const mbedtls_mpi_sint curve448_a24 = 0x98AA;
|
||||
static const unsigned char curve448_part_of_n[] = {
|
||||
0x83, 0x35, 0xDC, 0x16, 0x3B, 0xB1, 0x24,
|
||||
0xB6, 0x51, 0x29, 0xC9, 0x6F, 0xDE, 0x93,
|
||||
0x3D, 0x8D, 0x72, 0x3A, 0x70, 0xAA, 0xDC,
|
||||
0x87, 0x3D, 0x6D, 0x54, 0xA7, 0xBB, 0x0D,
|
||||
};
|
||||
|
||||
/*
|
||||
* Specialized function for creating the Curve448 group
|
||||
*/
|
||||
|
|
@ -739,7 +722,7 @@ static int ecp_use_curve448( mbedtls_ecp_group *grp )
|
|||
mbedtls_mpi_init( &Ns );
|
||||
|
||||
/* Actually ( A + 2 ) / 4 */
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &grp->A, 16, "98AA" ) );
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &grp->A, curve448_a24 ) );
|
||||
|
||||
/* P = 2^448 - 2^224 - 1 */
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &grp->P, 1 ) );
|
||||
|
|
@ -757,8 +740,8 @@ static int ecp_use_curve448( mbedtls_ecp_group *grp )
|
|||
|
||||
/* N = 2^446 - 13818066809895115352007386748515426880336692474882178609894547503885 */
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( &grp->N, 446, 1 ) );
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &Ns, 16,
|
||||
"8335DC163BB124B65129C96FDE933D8D723A70AADC873D6D54A7BB0D" ) );
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &Ns,
|
||||
curve448_part_of_n, sizeof( curve448_part_of_n ) ) );
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &grp->N, &grp->N, &Ns ) );
|
||||
|
||||
/* Actually, the required msb for private keys */
|
||||
|
|
@ -1048,13 +1031,13 @@ static inline void sub32( uint32_t *dst, uint32_t src, signed char *carry )
|
|||
|
||||
/*
|
||||
* If the result is negative, we get it in the form
|
||||
* c * 2^(bits + 32) + N, with c negative and N positive shorter than 'bits'
|
||||
* c * 2^bits + N, with c negative and N positive shorter than 'bits'
|
||||
*/
|
||||
static inline int fix_negative( mbedtls_mpi *N, signed char c, mbedtls_mpi *C, size_t bits )
|
||||
{
|
||||
int ret;
|
||||
|
||||
/* C = - c * 2^(bits + 32) */
|
||||
/* C = - c * 2^bits */
|
||||
#if !defined(MBEDTLS_HAVE_INT64)
|
||||
((void) bits);
|
||||
#else
|
||||
|
|
@ -1452,9 +1435,11 @@ cleanup:
|
|||
static int ecp_mod_p192k1( mbedtls_mpi *N )
|
||||
{
|
||||
static mbedtls_mpi_uint Rp[] = {
|
||||
BYTES_TO_T_UINT_8( 0xC9, 0x11, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00 ) };
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xC9, 0x11, 0x00, 0x00, 0x01, 0x00, 0x00,
|
||||
0x00 ) };
|
||||
|
||||
return( ecp_mod_koblitz( N, Rp, 192 / 8 / sizeof( mbedtls_mpi_uint ), 0, 0, 0 ) );
|
||||
return( ecp_mod_koblitz( N, Rp, 192 / 8 / sizeof( mbedtls_mpi_uint ), 0, 0,
|
||||
0 ) );
|
||||
}
|
||||
#endif /* MBEDTLS_ECP_DP_SECP192K1_ENABLED */
|
||||
|
||||
|
|
@ -1466,12 +1451,14 @@ static int ecp_mod_p192k1( mbedtls_mpi *N )
|
|||
static int ecp_mod_p224k1( mbedtls_mpi *N )
|
||||
{
|
||||
static mbedtls_mpi_uint Rp[] = {
|
||||
BYTES_TO_T_UINT_8( 0x93, 0x1A, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00 ) };
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0x93, 0x1A, 0x00, 0x00, 0x01, 0x00, 0x00,
|
||||
0x00 ) };
|
||||
|
||||
#if defined(MBEDTLS_HAVE_INT64)
|
||||
return( ecp_mod_koblitz( N, Rp, 4, 1, 32, 0xFFFFFFFF ) );
|
||||
#else
|
||||
return( ecp_mod_koblitz( N, Rp, 224 / 8 / sizeof( mbedtls_mpi_uint ), 0, 0, 0 ) );
|
||||
return( ecp_mod_koblitz( N, Rp, 224 / 8 / sizeof( mbedtls_mpi_uint ), 0, 0,
|
||||
0 ) );
|
||||
#endif
|
||||
}
|
||||
|
||||
|
|
@ -1485,8 +1472,10 @@ static int ecp_mod_p224k1( mbedtls_mpi *N )
|
|||
static int ecp_mod_p256k1( mbedtls_mpi *N )
|
||||
{
|
||||
static mbedtls_mpi_uint Rp[] = {
|
||||
BYTES_TO_T_UINT_8( 0xD1, 0x03, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00 ) };
|
||||
return( ecp_mod_koblitz( N, Rp, 256 / 8 / sizeof( mbedtls_mpi_uint ), 0, 0, 0 ) );
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( 0xD1, 0x03, 0x00, 0x00, 0x01, 0x00, 0x00,
|
||||
0x00 ) };
|
||||
return( ecp_mod_koblitz( N, Rp, 256 / 8 / sizeof( mbedtls_mpi_uint ), 0, 0,
|
||||
0 ) );
|
||||
}
|
||||
#endif /* MBEDTLS_ECP_DP_SECP256K1_ENABLED */
|
||||
|
||||
|
|
|
|||
|
|
@ -494,14 +494,20 @@ int mbedtls_entropy_update_nv_seed( mbedtls_entropy_context *ctx )
|
|||
int mbedtls_entropy_write_seed_file( mbedtls_entropy_context *ctx, const char *path )
|
||||
{
|
||||
int ret = MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR;
|
||||
FILE *f;
|
||||
FILE *f = NULL;
|
||||
unsigned char buf[MBEDTLS_ENTROPY_BLOCK_SIZE];
|
||||
|
||||
if( ( f = fopen( path, "wb" ) ) == NULL )
|
||||
return( MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR );
|
||||
|
||||
if( ( ret = mbedtls_entropy_func( ctx, buf, MBEDTLS_ENTROPY_BLOCK_SIZE ) ) != 0 )
|
||||
{
|
||||
ret = MBEDTLS_ERR_ENTROPY_SOURCE_FAILED;
|
||||
goto exit;
|
||||
}
|
||||
|
||||
if( ( f = fopen( path, "wb" ) ) == NULL )
|
||||
{
|
||||
ret = MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR;
|
||||
goto exit;
|
||||
}
|
||||
|
||||
if( fwrite( buf, 1, MBEDTLS_ENTROPY_BLOCK_SIZE, f ) != MBEDTLS_ENTROPY_BLOCK_SIZE )
|
||||
{
|
||||
|
|
@ -514,7 +520,9 @@ int mbedtls_entropy_write_seed_file( mbedtls_entropy_context *ctx, const char *p
|
|||
exit:
|
||||
mbedtls_platform_zeroize( buf, sizeof( buf ) );
|
||||
|
||||
if( f != NULL )
|
||||
fclose( f );
|
||||
|
||||
return( ret );
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -47,11 +47,15 @@
|
|||
/* Enable definition of getaddrinfo() even when compiling with -std=c99. Must
|
||||
* be set before config.h, which pulls in glibc's features.h indirectly.
|
||||
* Harmless on other platforms. */
|
||||
#ifndef _POSIX_C_SOURCE
|
||||
#define _POSIX_C_SOURCE 200112L
|
||||
#endif
|
||||
|
||||
#if defined(__NetBSD__)
|
||||
#ifndef _XOPEN_SOURCE
|
||||
#define _XOPEN_SOURCE 600 /* sockaddr_storage */
|
||||
#endif
|
||||
#endif
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "mbedtls/config.h"
|
||||
|
|
@ -162,6 +166,31 @@ static int net_prepare( void )
|
|||
return( 0 );
|
||||
}
|
||||
|
||||
/*
|
||||
* Return 0 if the file descriptor is valid, an error otherwise.
|
||||
* If for_select != 0, check whether the file descriptor is within the range
|
||||
* allowed for fd_set used for the FD_xxx macros and the select() function.
|
||||
*/
|
||||
static int check_fd( int fd, int for_select )
|
||||
{
|
||||
if( fd < 0 )
|
||||
return( MBEDTLS_ERR_NET_INVALID_CONTEXT );
|
||||
|
||||
#if (defined(_WIN32) || defined(_WIN32_WCE)) && !defined(EFIX64) && \
|
||||
!defined(EFI32)
|
||||
(void) for_select;
|
||||
#else
|
||||
/* A limitation of select() is that it only works with file descriptors
|
||||
* that are strictly less than FD_SETSIZE. This is a limitation of the
|
||||
* fd_set type. Error out early, because attempting to call FD_SET on a
|
||||
* large file descriptor is a buffer overflow on typical platforms. */
|
||||
if( for_select && fd >= FD_SETSIZE )
|
||||
return( MBEDTLS_ERR_NET_POLL_FAILED );
|
||||
#endif
|
||||
|
||||
return( 0 );
|
||||
}
|
||||
|
||||
/*
|
||||
* Initialize a context
|
||||
*/
|
||||
|
|
@ -493,15 +522,9 @@ int mbedtls_net_poll( mbedtls_net_context *ctx, uint32_t rw, uint32_t timeout )
|
|||
|
||||
int fd = ctx->fd;
|
||||
|
||||
if( fd < 0 )
|
||||
return( MBEDTLS_ERR_NET_INVALID_CONTEXT );
|
||||
|
||||
/* A limitation of select() is that it only works with file descriptors
|
||||
* that are strictly less than FD_SETSIZE. This is a limitation of the
|
||||
* fd_set type. Error out early, because attempting to call FD_SET on a
|
||||
* large file descriptor is a buffer overflow on typical platforms. */
|
||||
if( fd >= FD_SETSIZE )
|
||||
return( MBEDTLS_ERR_NET_POLL_FAILED );
|
||||
ret = check_fd( fd, 1 );
|
||||
if( ret != 0 )
|
||||
return( ret );
|
||||
|
||||
#if defined(__has_feature)
|
||||
#if __has_feature(memory_sanitizer)
|
||||
|
|
@ -580,8 +603,9 @@ int mbedtls_net_recv( void *ctx, unsigned char *buf, size_t len )
|
|||
int ret;
|
||||
int fd = ((mbedtls_net_context *) ctx)->fd;
|
||||
|
||||
if( fd < 0 )
|
||||
return( MBEDTLS_ERR_NET_INVALID_CONTEXT );
|
||||
ret = check_fd( fd, 0 );
|
||||
if( ret != 0 )
|
||||
return( ret );
|
||||
|
||||
ret = (int) read( fd, buf, len );
|
||||
|
||||
|
|
@ -619,15 +643,9 @@ int mbedtls_net_recv_timeout( void *ctx, unsigned char *buf,
|
|||
fd_set read_fds;
|
||||
int fd = ((mbedtls_net_context *) ctx)->fd;
|
||||
|
||||
if( fd < 0 )
|
||||
return( MBEDTLS_ERR_NET_INVALID_CONTEXT );
|
||||
|
||||
/* A limitation of select() is that it only works with file descriptors
|
||||
* that are strictly less than FD_SETSIZE. This is a limitation of the
|
||||
* fd_set type. Error out early, because attempting to call FD_SET on a
|
||||
* large file descriptor is a buffer overflow on typical platforms. */
|
||||
if( fd >= FD_SETSIZE )
|
||||
return( MBEDTLS_ERR_NET_POLL_FAILED );
|
||||
ret = check_fd( fd, 1 );
|
||||
if( ret != 0 )
|
||||
return( ret );
|
||||
|
||||
FD_ZERO( &read_fds );
|
||||
FD_SET( fd, &read_fds );
|
||||
|
|
@ -667,8 +685,9 @@ int mbedtls_net_send( void *ctx, const unsigned char *buf, size_t len )
|
|||
int ret;
|
||||
int fd = ((mbedtls_net_context *) ctx)->fd;
|
||||
|
||||
if( fd < 0 )
|
||||
return( MBEDTLS_ERR_NET_INVALID_CONTEXT );
|
||||
ret = check_fd( fd, 0 );
|
||||
if( ret != 0 )
|
||||
return( ret );
|
||||
|
||||
ret = (int) write( fd, buf, len );
|
||||
|
||||
|
|
|
|||
|
|
@ -219,8 +219,6 @@ int mbedtls_nist_kw_wrap( mbedtls_nist_kw_context *ctx,
|
|||
uint64_t t = 0;
|
||||
unsigned char outbuff[KW_SEMIBLOCK_LENGTH * 2];
|
||||
unsigned char inbuff[KW_SEMIBLOCK_LENGTH * 2];
|
||||
unsigned char *R2 = output + KW_SEMIBLOCK_LENGTH;
|
||||
unsigned char *A = output;
|
||||
|
||||
*out_len = 0;
|
||||
/*
|
||||
|
|
@ -296,6 +294,9 @@ int mbedtls_nist_kw_wrap( mbedtls_nist_kw_context *ctx,
|
|||
}
|
||||
else
|
||||
{
|
||||
unsigned char *R2 = output + KW_SEMIBLOCK_LENGTH;
|
||||
unsigned char *A = output;
|
||||
|
||||
/*
|
||||
* Do the wrapping function W, as defined in RFC 3394 section 2.2.1
|
||||
*/
|
||||
|
|
@ -359,7 +360,7 @@ static int unwrap( mbedtls_nist_kw_context *ctx,
|
|||
uint64_t t = 0;
|
||||
unsigned char outbuff[KW_SEMIBLOCK_LENGTH * 2];
|
||||
unsigned char inbuff[KW_SEMIBLOCK_LENGTH * 2];
|
||||
unsigned char *R = output + ( semiblocks - 2 ) * KW_SEMIBLOCK_LENGTH;
|
||||
unsigned char *R = NULL;
|
||||
*out_len = 0;
|
||||
|
||||
if( semiblocks < MIN_SEMIBLOCKS_COUNT )
|
||||
|
|
@ -369,6 +370,7 @@ static int unwrap( mbedtls_nist_kw_context *ctx,
|
|||
|
||||
memcpy( A, input, KW_SEMIBLOCK_LENGTH );
|
||||
memmove( output, input + KW_SEMIBLOCK_LENGTH, ( semiblocks - 1 ) * KW_SEMIBLOCK_LENGTH );
|
||||
R = output + ( semiblocks - 2 ) * KW_SEMIBLOCK_LENGTH;
|
||||
|
||||
/* Calculate intermediate values */
|
||||
for( t = s; t >= 1; t-- )
|
||||
|
|
|
|||
|
|
@ -225,12 +225,15 @@ static inline int pk_hashlen_helper( mbedtls_md_type_t md_alg, size_t *hash_len
|
|||
{
|
||||
const mbedtls_md_info_t *md_info;
|
||||
|
||||
if( *hash_len != 0 )
|
||||
if( *hash_len != 0 && md_alg == MBEDTLS_MD_NONE )
|
||||
return( 0 );
|
||||
|
||||
if( ( md_info = mbedtls_md_info_from_type( md_alg ) ) == NULL )
|
||||
return( -1 );
|
||||
|
||||
if ( *hash_len != 0 && *hash_len < mbedtls_md_get_size( md_info ) )
|
||||
return ( -1 );
|
||||
|
||||
*hash_len = mbedtls_md_get_size( md_info );
|
||||
return( 0 );
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1070,7 +1070,7 @@ static int pk_parse_key_pkcs8_unencrypted_der(
|
|||
return( MBEDTLS_ERR_PK_KEY_INVALID_VERSION + ret );
|
||||
|
||||
if( ( ret = pk_get_pk_alg( &p, end, &pk_alg, ¶ms ) ) != 0 )
|
||||
return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
|
||||
return( ret );
|
||||
|
||||
if( ( ret = mbedtls_asn1_get_tag( &p, end, &len, MBEDTLS_ASN1_OCTET_STRING ) ) != 0 )
|
||||
return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
|
||||
|
|
|
|||
|
|
@ -918,13 +918,13 @@ static const mbedtls_ssl_ciphersuite_t ciphersuite_definitions[] =
|
|||
0 },
|
||||
#endif /* MBEDTLS_SHA256_C */
|
||||
|
||||
#if defined(MBEDTLS_SHA1_C)
|
||||
#if defined(MBEDTLS_SHA512_C)
|
||||
{ MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384, "TLS-RSA-WITH-CAMELLIA-256-GCM-SHA384",
|
||||
MBEDTLS_CIPHER_CAMELLIA_256_GCM, MBEDTLS_MD_SHA384, MBEDTLS_KEY_EXCHANGE_RSA,
|
||||
MBEDTLS_SSL_MAJOR_VERSION_3, MBEDTLS_SSL_MINOR_VERSION_3,
|
||||
MBEDTLS_SSL_MAJOR_VERSION_3, MBEDTLS_SSL_MINOR_VERSION_3,
|
||||
0 },
|
||||
#endif /* MBEDTLS_SHA1_C */
|
||||
#endif /* MBEDTLS_SHA512_C */
|
||||
#endif /* MBEDTLS_GCM_C */
|
||||
#endif /* MBEDTLS_CAMELLIA_C */
|
||||
|
||||
|
|
|
|||
|
|
@ -1318,7 +1318,7 @@ static int ssl_parse_max_fragment_length_ext( mbedtls_ssl_context *ssl,
|
|||
mbedtls_ssl_send_alert_message(
|
||||
ssl,
|
||||
MBEDTLS_SSL_ALERT_LEVEL_FATAL,
|
||||
MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
|
||||
MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
|
||||
return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
|
||||
}
|
||||
|
||||
|
|
@ -1365,7 +1365,7 @@ static int ssl_parse_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
|
|||
mbedtls_ssl_send_alert_message(
|
||||
ssl,
|
||||
MBEDTLS_SSL_ALERT_LEVEL_FATAL,
|
||||
MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
|
||||
MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT );
|
||||
return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
|
||||
}
|
||||
|
||||
|
|
@ -1391,7 +1391,7 @@ static int ssl_parse_extended_ms_ext( mbedtls_ssl_context *ssl,
|
|||
mbedtls_ssl_send_alert_message(
|
||||
ssl,
|
||||
MBEDTLS_SSL_ALERT_LEVEL_FATAL,
|
||||
MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
|
||||
MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT );
|
||||
return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
|
||||
}
|
||||
|
||||
|
|
@ -1416,7 +1416,7 @@ static int ssl_parse_session_ticket_ext( mbedtls_ssl_context *ssl,
|
|||
mbedtls_ssl_send_alert_message(
|
||||
ssl,
|
||||
MBEDTLS_SSL_ALERT_LEVEL_FATAL,
|
||||
MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
|
||||
MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT );
|
||||
return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
|
||||
}
|
||||
|
||||
|
|
@ -1522,7 +1522,7 @@ static int ssl_parse_alpn_ext( mbedtls_ssl_context *ssl,
|
|||
mbedtls_ssl_send_alert_message(
|
||||
ssl,
|
||||
MBEDTLS_SSL_ALERT_LEVEL_FATAL,
|
||||
MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
|
||||
MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT );
|
||||
return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
|
||||
}
|
||||
|
||||
|
|
@ -2209,6 +2209,7 @@ static int ssl_parse_server_dh_params( mbedtls_ssl_context *ssl,
|
|||
unsigned char *end )
|
||||
{
|
||||
int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
|
||||
size_t dhm_actual_bitlen;
|
||||
|
||||
/*
|
||||
* Ephemeral DH parameters:
|
||||
|
|
@ -2226,10 +2227,11 @@ static int ssl_parse_server_dh_params( mbedtls_ssl_context *ssl,
|
|||
return( ret );
|
||||
}
|
||||
|
||||
if( ssl->handshake->dhm_ctx.len * 8 < ssl->conf->dhm_min_bitlen )
|
||||
dhm_actual_bitlen = mbedtls_mpi_bitlen( &ssl->handshake->dhm_ctx.P );
|
||||
if( dhm_actual_bitlen < ssl->conf->dhm_min_bitlen )
|
||||
{
|
||||
MBEDTLS_SSL_DEBUG_MSG( 1, ( "DHM prime too short: %d < %d",
|
||||
ssl->handshake->dhm_ctx.len * 8,
|
||||
MBEDTLS_SSL_DEBUG_MSG( 1, ( "DHM prime too short: %u < %u",
|
||||
(unsigned) dhm_actual_bitlen,
|
||||
ssl->conf->dhm_min_bitlen ) );
|
||||
return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1895,6 +1895,9 @@ int mbedtls_ssl_cf_hmac(
|
|||
MD_CHK( mbedtls_md_update( ctx, data + offset, 1 ) );
|
||||
}
|
||||
|
||||
/* The context needs to finish() before it starts() again */
|
||||
MD_CHK( mbedtls_md_finish( ctx, aux_out ) );
|
||||
|
||||
/* Now compute HASH(okey + inner_hash) */
|
||||
MD_CHK( mbedtls_md_starts( ctx ) );
|
||||
MD_CHK( mbedtls_md_update( ctx, okey, block_size ) );
|
||||
|
|
@ -6364,8 +6367,6 @@ static void ssl_calc_finished_tls_sha256(
|
|||
|
||||
#if defined(MBEDTLS_SHA512_C)
|
||||
|
||||
typedef int (*finish_sha384_t)(mbedtls_sha512_context*, unsigned char*);
|
||||
|
||||
static void ssl_calc_finished_tls_sha384(
|
||||
mbedtls_ssl_context *ssl, unsigned char *buf, int from )
|
||||
{
|
||||
|
|
@ -6373,12 +6374,6 @@ static void ssl_calc_finished_tls_sha384(
|
|||
const char *sender;
|
||||
mbedtls_sha512_context sha512;
|
||||
unsigned char padbuf[48];
|
||||
/*
|
||||
* For SHA-384, we can save 16 bytes by keeping padbuf 48 bytes long.
|
||||
* However, to avoid stringop-overflow warning in gcc, we have to cast
|
||||
* mbedtls_sha512_finish_ret().
|
||||
*/
|
||||
finish_sha384_t finish_sha384 = (finish_sha384_t)mbedtls_sha512_finish_ret;
|
||||
|
||||
mbedtls_ssl_session *session = ssl->session_negotiate;
|
||||
if( !session )
|
||||
|
|
@ -6404,8 +6399,19 @@ static void ssl_calc_finished_tls_sha384(
|
|||
sender = ( from == MBEDTLS_SSL_IS_CLIENT )
|
||||
? "client finished"
|
||||
: "server finished";
|
||||
|
||||
finish_sha384( &sha512, padbuf );
|
||||
/* mbedtls_sha512_finish_ret's output parameter is declared as a
|
||||
* 64-byte buffer, but sice we're using SHA-384, we know that the
|
||||
* output fits in 48 bytes. This is correct C, but GCC 11.1 warns
|
||||
* about it.
|
||||
*/
|
||||
#if defined(__GNUC__) && __GNUC__ >= 11
|
||||
#pragma GCC diagnostic push
|
||||
#pragma GCC diagnostic ignored "-Wstringop-overflow"
|
||||
#endif
|
||||
mbedtls_sha512_finish_ret( &sha512, padbuf );
|
||||
#if defined(__GNUC__) && __GNUC__ >= 11
|
||||
#pragma GCC diagnostic pop
|
||||
#endif
|
||||
|
||||
ssl->handshake->tls_prf( session->master, 48, sender,
|
||||
padbuf, 48, buf, len );
|
||||
|
|
@ -6678,7 +6684,7 @@ int mbedtls_ssl_parse_finished( mbedtls_ssl_context *ssl )
|
|||
{
|
||||
MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
|
||||
mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
|
||||
MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
|
||||
MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR );
|
||||
return( MBEDTLS_ERR_SSL_BAD_HS_FINISHED );
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -129,9 +129,8 @@ typedef struct {
|
|||
*/
|
||||
#define X509_MAX_VERIFY_CHAIN_SIZE ( MBEDTLS_X509_MAX_INTERMEDIATE_CA + 2 )
|
||||
|
||||
/*
|
||||
* Default profile
|
||||
*/
|
||||
/* Default profile. Do not remove items unless there are serious security
|
||||
* concerns. */
|
||||
const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_default =
|
||||
{
|
||||
#if defined(MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_CERTIFICATES)
|
||||
|
|
|
|||
Loading…
Reference in New Issue