OLD | NEW |
1 /* This Source Code Form is subject to the terms of the Mozilla Public | 1 /* This Source Code Form is subject to the terms of the Mozilla Public |
2 * License, v. 2.0. If a copy of the MPL was not distributed with this | 2 * License, v. 2.0. If a copy of the MPL was not distributed with this |
3 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ | 3 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ |
4 | 4 |
5 /* | 5 /* |
6 * PQG parameter generation/verification. Based on FIPS 186-3. | 6 * PQG parameter generation/verification. Based on FIPS 186-3. |
7 */ | 7 */ |
8 #ifdef FREEBL_NO_DEPEND | 8 #ifdef FREEBL_NO_DEPEND |
9 #include "stubs.h" | 9 #include "stubs.h" |
10 #endif | 10 #endif |
(...skipping 210 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
221 PQG_Check(const PQGParams *params) | 221 PQG_Check(const PQGParams *params) |
222 { | 222 { |
223 unsigned int L,N; | 223 unsigned int L,N; |
224 SECStatus rv = SECSuccess; | 224 SECStatus rv = SECSuccess; |
225 | 225 |
226 if (params == NULL) { | 226 if (params == NULL) { |
227 PORT_SetError(SEC_ERROR_INVALID_ARGS); | 227 PORT_SetError(SEC_ERROR_INVALID_ARGS); |
228 return SECFailure; | 228 return SECFailure; |
229 } | 229 } |
230 | 230 |
231 L = PQG_GetLength(¶ms->prime)*BITS_PER_BYTE; | 231 L = PQG_GetLength(¶ms->prime)*PR_BITS_PER_BYTE; |
232 N = PQG_GetLength(¶ms->subPrime)*BITS_PER_BYTE; | 232 N = PQG_GetLength(¶ms->subPrime)*PR_BITS_PER_BYTE; |
233 | 233 |
234 if (L < 1024) { | 234 if (L < 1024) { |
235 int j; | 235 int j; |
236 | 236 |
237 /* handle DSA1 pqg parameters with less thatn 1024 bits*/ | 237 /* handle DSA1 pqg parameters with less thatn 1024 bits*/ |
238 if ( N != DSA1_Q_BITS ) { | 238 if ( N != DSA1_Q_BITS ) { |
239 PORT_SetError(SEC_ERROR_INVALID_ARGS); | 239 PORT_SetError(SEC_ERROR_INVALID_ARGS); |
240 return SECFailure; | 240 return SECFailure; |
241 } | 241 } |
242 j = PQG_PBITS_TO_INDEX(L); | 242 j = PQG_PBITS_TO_INDEX(L); |
(...skipping 11 matching lines...) Expand all Loading... |
254 HASH_HashType | 254 HASH_HashType |
255 PQG_GetHashType(const PQGParams *params) | 255 PQG_GetHashType(const PQGParams *params) |
256 { | 256 { |
257 unsigned int L,N; | 257 unsigned int L,N; |
258 | 258 |
259 if (params == NULL) { | 259 if (params == NULL) { |
260 PORT_SetError(SEC_ERROR_INVALID_ARGS); | 260 PORT_SetError(SEC_ERROR_INVALID_ARGS); |
261 return HASH_AlgNULL; | 261 return HASH_AlgNULL; |
262 } | 262 } |
263 | 263 |
264 L = PQG_GetLength(¶ms->prime)*BITS_PER_BYTE; | 264 L = PQG_GetLength(¶ms->prime)*PR_BITS_PER_BYTE; |
265 N = PQG_GetLength(¶ms->subPrime)*BITS_PER_BYTE; | 265 N = PQG_GetLength(¶ms->subPrime)*PR_BITS_PER_BYTE; |
266 return getFirstHash(L, N); | 266 return getFirstHash(L, N); |
267 } | 267 } |
268 | 268 |
269 /* Get a seed for generating P and Q. If in testing mode, copy in the | 269 /* Get a seed for generating P and Q. If in testing mode, copy in the |
270 ** seed from FIPS 186-1 appendix 5. Otherwise, obtain bytes from the | 270 ** seed from FIPS 186-1 appendix 5. Otherwise, obtain bytes from the |
271 ** global random number generator. | 271 ** global random number generator. |
272 */ | 272 */ |
273 static SECStatus | 273 static SECStatus |
274 getPQseed(SECItem *seed, PRArenaPool* arena) | 274 getPQseed(SECItem *seed, PLArenaPool* arena) |
275 { | 275 { |
276 SECStatus rv; | 276 SECStatus rv; |
277 | 277 |
278 if (!seed->data) { | 278 if (!seed->data) { |
279 seed->data = (unsigned char*)PORT_ArenaZAlloc(arena, seed->len); | 279 seed->data = (unsigned char*)PORT_ArenaZAlloc(arena, seed->len); |
280 } | 280 } |
281 if (!seed->data) { | 281 if (!seed->data) { |
282 PORT_SetError(SEC_ERROR_NO_MEMORY); | 282 PORT_SetError(SEC_ERROR_NO_MEMORY); |
283 return SECFailure; | 283 return SECFailure; |
284 } | 284 } |
(...skipping 151 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
436 static SECStatus | 436 static SECStatus |
437 makeQ2fromSeed( | 437 makeQ2fromSeed( |
438 HASH_HashType hashtype, /* selected Hashing algorithm */ | 438 HASH_HashType hashtype, /* selected Hashing algorithm */ |
439 unsigned int N, /* input. Length of q in bits. */ | 439 unsigned int N, /* input. Length of q in bits. */ |
440 const SECItem * seed, /* input. */ | 440 const SECItem * seed, /* input. */ |
441 mp_int * Q) /* output. */ | 441 mp_int * Q) /* output. */ |
442 { | 442 { |
443 unsigned char U[HASH_LENGTH_MAX]; | 443 unsigned char U[HASH_LENGTH_MAX]; |
444 SECStatus rv = SECSuccess; | 444 SECStatus rv = SECSuccess; |
445 mp_err err = MP_OKAY; | 445 mp_err err = MP_OKAY; |
446 int N_bytes = N/BITS_PER_BYTE; /* length of N in bytes rather than bits */ | 446 int N_bytes = N/PR_BITS_PER_BYTE; /* length of N in bytes rather than bits *
/ |
447 int hashLen = HASH_ResultLen(hashtype); | 447 int hashLen = HASH_ResultLen(hashtype); |
448 int offset = 0; | 448 int offset = 0; |
449 | 449 |
450 /* ****************************************************************** | 450 /* ****************************************************************** |
451 ** Step 6. | 451 ** Step 6. |
452 ** "Compute U = hash[SEED] mod 2**N-1]." | 452 ** "Compute U = hash[SEED] mod 2**N-1]." |
453 **/ | 453 **/ |
454 CHECK_SEC_OK( HASH_HashBuf(hashtype, U, seed->data, seed->len) ); | 454 CHECK_SEC_OK( HASH_HashBuf(hashtype, U, seed->data, seed->len) ); |
455 /* mod 2**N . Step 7 will explicitly set the top bit to 1, so no need | 455 /* mod 2**N . Step 7 will explicitly set the top bit to 1, so no need |
456 * to handle mod 2**N-1 */ | 456 * to handle mod 2**N-1 */ |
(...skipping 21 matching lines...) Expand all Loading... |
478 | 478 |
479 /* | 479 /* |
480 ** Perform steps from FIPS 186-3, Appendix A.1.2.1 and Appendix C.6 | 480 ** Perform steps from FIPS 186-3, Appendix A.1.2.1 and Appendix C.6 |
481 ** | 481 ** |
482 ** This generates a provable prime from two smaller prime. The resulting | 482 ** This generates a provable prime from two smaller prime. The resulting |
483 ** prime p will have q0 as a multiple of p-1. q0 can be 1. | 483 ** prime p will have q0 as a multiple of p-1. q0 can be 1. |
484 ** | 484 ** |
485 ** This implments steps 4 thorough 22 of FIPS 186-3 A.1.2.1 and | 485 ** This implments steps 4 thorough 22 of FIPS 186-3 A.1.2.1 and |
486 ** steps 16 through 34 of FIPS 186-2 C.6 | 486 ** steps 16 through 34 of FIPS 186-2 C.6 |
487 */ | 487 */ |
488 #define MAX_ST_SEED_BITS HASH_LENGTH_MAX*BITS_PER_BYTE | 488 #define MAX_ST_SEED_BITS (HASH_LENGTH_MAX*PR_BITS_PER_BYTE) |
489 SECStatus | 489 SECStatus |
490 makePrimefromPrimesShaweTaylor( | 490 makePrimefromPrimesShaweTaylor( |
491 HASH_HashType hashtype, /* selected Hashing algorithm */ | 491 HASH_HashType hashtype, /* selected Hashing algorithm */ |
492 unsigned int length, /* input. Length of prime in bits. */ | 492 unsigned int length, /* input. Length of prime in bits. */ |
493 mp_int * c0, /* seed prime */ | 493 mp_int * c0, /* seed prime */ |
494 mp_int * q, /* sub prime, can be 1 */ | 494 mp_int * q, /* sub prime, can be 1 */ |
495 mp_int * prime, /* output. */ | 495 mp_int * prime, /* output. */ |
496 SECItem * prime_seed, /* input/output. */ | 496 SECItem * prime_seed, /* input/output. */ |
497 int * prime_gen_counter) /* input/output. */ | 497 int * prime_gen_counter) /* input/output. */ |
498 { | 498 { |
499 mp_int c; | 499 mp_int c; |
500 mp_int c0_2; | 500 mp_int c0_2; |
501 mp_int t; | 501 mp_int t; |
502 mp_int a; | 502 mp_int a; |
503 mp_int z; | 503 mp_int z; |
504 mp_int two_length_minus_1; | 504 mp_int two_length_minus_1; |
505 SECStatus rv = SECFailure; | 505 SECStatus rv = SECFailure; |
506 int hashlen = HASH_ResultLen(hashtype); | 506 int hashlen = HASH_ResultLen(hashtype); |
507 int outlen = hashlen*BITS_PER_BYTE; | 507 int outlen = hashlen*PR_BITS_PER_BYTE; |
508 int offset; | 508 int offset; |
509 unsigned char bit, mask; | 509 unsigned char bit, mask; |
510 /* x needs to hold roundup(L/outlen)*outlen. | 510 /* x needs to hold roundup(L/outlen)*outlen. |
511 * This can be no larger than L+outlen-1, So we set it's size to | 511 * This can be no larger than L+outlen-1, So we set it's size to |
512 * our max L + max outlen and know we are safe */ | 512 * our max L + max outlen and know we are safe */ |
513 unsigned char x[DSA_MAX_P_BITS/8+HASH_LENGTH_MAX]; | 513 unsigned char x[DSA_MAX_P_BITS/8+HASH_LENGTH_MAX]; |
514 mp_err err = MP_OKAY; | 514 mp_err err = MP_OKAY; |
515 int i; | 515 int i; |
516 int iterations; | 516 int iterations; |
517 int old_counter; | 517 int old_counter; |
(...skipping 55 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
573 ** Step 9/21 x = 2 ** (length-1) + x mod 2 ** (length-1) | 573 ** Step 9/21 x = 2 ** (length-1) + x mod 2 ** (length-1) |
574 ** | 574 ** |
575 ** This step mathematically sets the high bit and clears out | 575 ** This step mathematically sets the high bit and clears out |
576 ** all the other bits higher than length. 'x' is stored | 576 ** all the other bits higher than length. 'x' is stored |
577 ** in the x array, MSB first. The above formula gives us an 'x' | 577 ** in the x array, MSB first. The above formula gives us an 'x' |
578 ** which is length bytes long and has the high bit set. We also know | 578 ** which is length bytes long and has the high bit set. We also know |
579 ** that length <= iterations*outlen since | 579 ** that length <= iterations*outlen since |
580 ** iterations=ceiling(length/outlen). First we find the offset in | 580 ** iterations=ceiling(length/outlen). First we find the offset in |
581 ** bytes into the array where the high bit is. | 581 ** bytes into the array where the high bit is. |
582 */ | 582 */ |
583 offset = (outlen*iterations - length)/BITS_PER_BYTE; | 583 offset = (outlen*iterations - length)/PR_BITS_PER_BYTE; |
584 /* now we want to set the 'high bit', since length may not be a | 584 /* now we want to set the 'high bit', since length may not be a |
585 * multiple of 8,*/ | 585 * multiple of 8,*/ |
586 bit = 1 << ((length-1) & 0x7); /* select the proper bit in the byte */ | 586 bit = 1 << ((length-1) & 0x7); /* select the proper bit in the byte */ |
587 /* we need to zero out the rest of the bits in the byte above */ | 587 /* we need to zero out the rest of the bits in the byte above */ |
588 mask = (bit-1); | 588 mask = (bit-1); |
589 /* now we set it */ | 589 /* now we set it */ |
590 x[offset] = (mask & x[offset]) | bit; | 590 x[offset] = (mask & x[offset]) | bit; |
591 /* | 591 /* |
592 ** Comment: Generate a candidate prime c in the interval | 592 ** Comment: Generate a candidate prime c in the interval |
593 ** [2**(lenght-1), 2**length]. | 593 ** [2**(lenght-1), 2**length]. |
(...skipping 133 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
727 const SECItem * input_seed, /* input. */ | 727 const SECItem * input_seed, /* input. */ |
728 mp_int * prime, /* output. */ | 728 mp_int * prime, /* output. */ |
729 SECItem * prime_seed, /* output. */ | 729 SECItem * prime_seed, /* output. */ |
730 int * prime_gen_counter) /* output. */ | 730 int * prime_gen_counter) /* output. */ |
731 { | 731 { |
732 mp_int c; | 732 mp_int c; |
733 mp_int c0; | 733 mp_int c0; |
734 mp_int one; | 734 mp_int one; |
735 SECStatus rv = SECFailure; | 735 SECStatus rv = SECFailure; |
736 int hashlen = HASH_ResultLen(hashtype); | 736 int hashlen = HASH_ResultLen(hashtype); |
737 int outlen = hashlen*BITS_PER_BYTE; | 737 int outlen = hashlen*PR_BITS_PER_BYTE; |
738 int offset; | 738 int offset; |
739 unsigned char bit, mask; | 739 unsigned char bit, mask; |
740 unsigned char x[HASH_LENGTH_MAX*2]; | 740 unsigned char x[HASH_LENGTH_MAX*2]; |
741 mp_digit dummy; | 741 mp_digit dummy; |
742 mp_err err = MP_OKAY; | 742 mp_err err = MP_OKAY; |
743 int i; | 743 int i; |
744 | 744 |
745 MP_DIGITS(&c) = 0; | 745 MP_DIGITS(&c) = 0; |
746 MP_DIGITS(&c0) = 0; | 746 MP_DIGITS(&c0) = 0; |
747 MP_DIGITS(&one) = 0; | 747 MP_DIGITS(&one) = 0; |
(...skipping 40 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
788 } | 788 } |
789 /* Step 6 c = 2**length-1 + c mod 2**length-1 */ | 789 /* Step 6 c = 2**length-1 + c mod 2**length-1 */ |
790 /* This step mathematically sets the high bit and clears out | 790 /* This step mathematically sets the high bit and clears out |
791 ** all the other bits higher than length. Right now c is stored | 791 ** all the other bits higher than length. Right now c is stored |
792 ** in the x array, MSB first. The above formula gives us a c which | 792 ** in the x array, MSB first. The above formula gives us a c which |
793 ** is length bytes long and has the high bit set. We also know that | 793 ** is length bytes long and has the high bit set. We also know that |
794 ** length < outlen since the smallest outlen is 160 bits and the largest | 794 ** length < outlen since the smallest outlen is 160 bits and the largest |
795 ** length at this point is 32 bits. So first we find the offset in bytes | 795 ** length at this point is 32 bits. So first we find the offset in bytes |
796 ** into the array where the high bit is. | 796 ** into the array where the high bit is. |
797 */ | 797 */ |
798 offset = (outlen - length)/BITS_PER_BYTE; | 798 offset = (outlen - length)/PR_BITS_PER_BYTE; |
799 /* now we want to set the 'high bit'. We have to calculate this since | 799 /* now we want to set the 'high bit'. We have to calculate this since |
800 * length may not be a multiple of 8.*/ | 800 * length may not be a multiple of 8.*/ |
801 bit = 1 << ((length-1) & 0x7); /* select the proper bit in the byte */ | 801 bit = 1 << ((length-1) & 0x7); /* select the proper bit in the byte */ |
802 /* we need to zero out the rest of the bits in the byte above */ | 802 /* we need to zero out the rest of the bits in the byte above */ |
803 mask = (bit-1); | 803 mask = (bit-1); |
804 /* now we set it */ | 804 /* now we set it */ |
805 x[offset] = (mask & x[offset]) | bit; | 805 x[offset] = (mask & x[offset]) | bit; |
806 /* Step 7 c = c*floor(c/2) + 1 */ | 806 /* Step 7 c = c*floor(c/2) + 1 */ |
807 /* set the low bit. much easier to find (the end of the array) */ | 807 /* set the low bit. much easier to find (the end of the array) */ |
808 x[hashlen-1] |= 1; | 808 x[hashlen-1] |= 1; |
(...skipping 193 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1002 MP_DIGITS(&V_n) = 0; | 1002 MP_DIGITS(&V_n) = 0; |
1003 MP_DIGITS(&tmp) = 0; | 1003 MP_DIGITS(&tmp) = 0; |
1004 CHECK_MPI_OK( mp_init(&W) ); | 1004 CHECK_MPI_OK( mp_init(&W) ); |
1005 CHECK_MPI_OK( mp_init(&X) ); | 1005 CHECK_MPI_OK( mp_init(&X) ); |
1006 CHECK_MPI_OK( mp_init(&c) ); | 1006 CHECK_MPI_OK( mp_init(&c) ); |
1007 CHECK_MPI_OK( mp_init(&twoQ) ); | 1007 CHECK_MPI_OK( mp_init(&twoQ) ); |
1008 CHECK_MPI_OK( mp_init(&tmp) ); | 1008 CHECK_MPI_OK( mp_init(&tmp) ); |
1009 CHECK_MPI_OK( mp_init(&V_n) ); | 1009 CHECK_MPI_OK( mp_init(&V_n) ); |
1010 | 1010 |
1011 hashlen = HASH_ResultLen(hashtype); | 1011 hashlen = HASH_ResultLen(hashtype); |
1012 outlen = hashlen*BITS_PER_BYTE; | 1012 outlen = hashlen*PR_BITS_PER_BYTE; |
1013 | 1013 |
1014 /* L - 1 = n*outlen + b */ | 1014 /* L - 1 = n*outlen + b */ |
1015 n = (L - 1) / outlen; | 1015 n = (L - 1) / outlen; |
1016 b = (L - 1) % outlen; | 1016 b = (L - 1) % outlen; |
1017 | 1017 |
1018 /* ****************************************************************** | 1018 /* ****************************************************************** |
1019 ** Step 11.1 (Step 7 in 186-1) | 1019 ** Step 11.1 (Step 7 in 186-1) |
1020 ** "for j = 0 ... n let | 1020 ** "for j = 0 ... n let |
1021 ** V_j = SHA[(SEED + offset + j) mod 2**seedlen]." | 1021 ** V_j = SHA[(SEED + offset + j) mod 2**seedlen]." |
1022 ** | 1022 ** |
(...skipping 207 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1230 { | 1230 { |
1231 unsigned int n; /* Per FIPS 186, app 2.2. 186-3 app A.1.1.2 */ | 1231 unsigned int n; /* Per FIPS 186, app 2.2. 186-3 app A.1.1.2 */ |
1232 unsigned int b; /* Per FIPS 186, app 2.2. 186-3 app A.1.1.2 */ | 1232 unsigned int b; /* Per FIPS 186, app 2.2. 186-3 app A.1.1.2 */ |
1233 unsigned int seedlen; /* Per FIPS 186-3 app A.1.1.2 (was 'g' 186-1)*/ | 1233 unsigned int seedlen; /* Per FIPS 186-3 app A.1.1.2 (was 'g' 186-1)*/ |
1234 unsigned int counter; /* Per FIPS 186, app 2.2. 186-3 app A.1.1.2 */ | 1234 unsigned int counter; /* Per FIPS 186, app 2.2. 186-3 app A.1.1.2 */ |
1235 unsigned int offset; /* Per FIPS 186, app 2.2. 186-3 app A.1.1.2 */ | 1235 unsigned int offset; /* Per FIPS 186, app 2.2. 186-3 app A.1.1.2 */ |
1236 unsigned int outlen; /* Per FIPS 186-3, appendix A.1.1.2. */ | 1236 unsigned int outlen; /* Per FIPS 186-3, appendix A.1.1.2. */ |
1237 unsigned int maxCount; | 1237 unsigned int maxCount; |
1238 HASH_HashType hashtype; | 1238 HASH_HashType hashtype; |
1239 SECItem *seed; /* Per FIPS 186, app 2.2. 186-3 app A.1.1.2 */ | 1239 SECItem *seed; /* Per FIPS 186, app 2.2. 186-3 app A.1.1.2 */ |
1240 PRArenaPool *arena = NULL; | 1240 PLArenaPool *arena = NULL; |
1241 PQGParams *params = NULL; | 1241 PQGParams *params = NULL; |
1242 PQGVerify *verify = NULL; | 1242 PQGVerify *verify = NULL; |
1243 PRBool passed; | 1243 PRBool passed; |
1244 SECItem hit = { 0, 0, 0 }; | 1244 SECItem hit = { 0, 0, 0 }; |
1245 SECItem firstseed = { 0, 0, 0 }; | 1245 SECItem firstseed = { 0, 0, 0 }; |
1246 SECItem qseed = { 0, 0, 0 }; | 1246 SECItem qseed = { 0, 0, 0 }; |
1247 SECItem pseed = { 0, 0, 0 }; | 1247 SECItem pseed = { 0, 0, 0 }; |
1248 mp_int P, Q, G, H, l, p0; | 1248 mp_int P, Q, G, H, l, p0; |
1249 mp_err err = MP_OKAY; | 1249 mp_err err = MP_OKAY; |
1250 SECStatus rv = SECFailure; | 1250 SECStatus rv = SECFailure; |
1251 int iterations = 0; | 1251 int iterations = 0; |
1252 | 1252 |
1253 | 1253 |
1254 /* Step 1. L and N already checked by caller*/ | 1254 /* Step 1. L and N already checked by caller*/ |
1255 /* Step 2. if (seedlen < N) return INVALID; */ | 1255 /* Step 2. if (seedlen < N) return INVALID; */ |
1256 if (seedBytes < N/BITS_PER_BYTE || !pParams || !pVfy) { | 1256 if (seedBytes < N/PR_BITS_PER_BYTE || !pParams || !pVfy) { |
1257 PORT_SetError(SEC_ERROR_INVALID_ARGS); | 1257 PORT_SetError(SEC_ERROR_INVALID_ARGS); |
1258 return SECFailure; | 1258 return SECFailure; |
1259 } | 1259 } |
1260 /* Initialize an arena for the params. */ | 1260 /* Initialize an arena for the params. */ |
1261 arena = PORT_NewArena(NSS_FREEBL_DEFAULT_CHUNKSIZE); | 1261 arena = PORT_NewArena(NSS_FREEBL_DEFAULT_CHUNKSIZE); |
1262 if (!arena) { | 1262 if (!arena) { |
1263 PORT_SetError(SEC_ERROR_NO_MEMORY); | 1263 PORT_SetError(SEC_ERROR_NO_MEMORY); |
1264 return SECFailure; | 1264 return SECFailure; |
1265 } | 1265 } |
1266 params = (PQGParams *)PORT_ArenaZAlloc(arena, sizeof(PQGParams)); | 1266 params = (PQGParams *)PORT_ArenaZAlloc(arena, sizeof(PQGParams)); |
(...skipping 31 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1298 CHECK_MPI_OK( mp_init(&Q) ); | 1298 CHECK_MPI_OK( mp_init(&Q) ); |
1299 CHECK_MPI_OK( mp_init(&G) ); | 1299 CHECK_MPI_OK( mp_init(&G) ); |
1300 CHECK_MPI_OK( mp_init(&H) ); | 1300 CHECK_MPI_OK( mp_init(&H) ); |
1301 CHECK_MPI_OK( mp_init(&l) ); | 1301 CHECK_MPI_OK( mp_init(&l) ); |
1302 CHECK_MPI_OK( mp_init(&p0) ); | 1302 CHECK_MPI_OK( mp_init(&p0) ); |
1303 | 1303 |
1304 /* Select Hash and Compute lengths. */ | 1304 /* Select Hash and Compute lengths. */ |
1305 /* getFirstHash gives us the smallest acceptable hash for this key | 1305 /* getFirstHash gives us the smallest acceptable hash for this key |
1306 * strength */ | 1306 * strength */ |
1307 hashtype = getFirstHash(L,N); | 1307 hashtype = getFirstHash(L,N); |
1308 outlen = HASH_ResultLen(hashtype)*BITS_PER_BYTE; | 1308 outlen = HASH_ResultLen(hashtype)*PR_BITS_PER_BYTE; |
1309 | 1309 |
1310 /* Step 3: n = Ceil(L/outlen)-1; (same as n = Floor((L-1)/outlen)) */ | 1310 /* Step 3: n = Ceil(L/outlen)-1; (same as n = Floor((L-1)/outlen)) */ |
1311 n = (L - 1) / outlen; | 1311 n = (L - 1) / outlen; |
1312 /* Step 4: b = L -1 - (n*outlen); (same as n = (L-1) mod outlen) */ | 1312 /* Step 4: b = L -1 - (n*outlen); (same as n = (L-1) mod outlen) */ |
1313 b = (L - 1) % outlen; | 1313 b = (L - 1) % outlen; |
1314 seedlen = seedBytes * BITS_PER_BYTE; /* bits in seed */ | 1314 seedlen = seedBytes * PR_BITS_PER_BYTE; /* bits in seed */ |
1315 step_5: | 1315 step_5: |
1316 /* ****************************************************************** | 1316 /* ****************************************************************** |
1317 ** Step 5. (Step 1 in 186-1) | 1317 ** Step 5. (Step 1 in 186-1) |
1318 ** "Choose an abitrary sequence of at least N bits and call it SEED. | 1318 ** "Choose an abitrary sequence of at least N bits and call it SEED. |
1319 ** Let g be the length of SEED in bits." | 1319 ** Let g be the length of SEED in bits." |
1320 */ | 1320 */ |
1321 if (++iterations > MAX_ITERATIONS) { /* give up after a while */ | 1321 if (++iterations > MAX_ITERATIONS) { /* give up after a while */ |
1322 PORT_SetError(SEC_ERROR_NEED_RANDOM); | 1322 PORT_SetError(SEC_ERROR_NEED_RANDOM); |
1323 goto cleanup; | 1323 goto cleanup; |
1324 } | 1324 } |
(...skipping 405 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1730 /* make sure pseed wasn't tampered with (since it is part of | 1730 /* make sure pseed wasn't tampered with (since it is part of |
1731 * calculating G) */ | 1731 * calculating G) */ |
1732 CHECKPARAM( SECITEM_CompareItem(&pseed, &pseed_) == SECEqual ); | 1732 CHECKPARAM( SECITEM_CompareItem(&pseed, &pseed_) == SECEqual ); |
1733 } else if (vfy->counter == -1) { | 1733 } else if (vfy->counter == -1) { |
1734 /* If counter is set to -1, we are really only verifying G, skip | 1734 /* If counter is set to -1, we are really only verifying G, skip |
1735 * the remainder of the checks for P */ | 1735 * the remainder of the checks for P */ |
1736 CHECKPARAM(type != FIPS186_1_TYPE); /* we only do this for DSA2 */ | 1736 CHECKPARAM(type != FIPS186_1_TYPE); /* we only do this for DSA2 */ |
1737 } else { | 1737 } else { |
1738 /* 10. P generated from (L, counter, g, SEED, Q) matches P | 1738 /* 10. P generated from (L, counter, g, SEED, Q) matches P |
1739 * in PQGParams. */ | 1739 * in PQGParams. */ |
1740 » outlen = HASH_ResultLen(hashtype)*BITS_PER_BYTE; | 1740 » outlen = HASH_ResultLen(hashtype)*PR_BITS_PER_BYTE; |
1741 n = (L - 1) / outlen; | 1741 n = (L - 1) / outlen; |
1742 offset = vfy->counter * (n + 1) + ((type == FIPS186_1_TYPE) ? 2 : 1); | 1742 offset = vfy->counter * (n + 1) + ((type == FIPS186_1_TYPE) ? 2 : 1); |
1743 CHECK_SEC_OK( makePfromQandSeed(hashtype, L, N, offset, g, &vfy->seed, | 1743 CHECK_SEC_OK( makePfromQandSeed(hashtype, L, N, offset, g, &vfy->seed, |
1744 &Q, &P_) ); | 1744 &Q, &P_) ); |
1745 CHECKPARAM( mp_cmp(&P, &P_) == 0 ); | 1745 CHECKPARAM( mp_cmp(&P, &P_) == 0 ); |
1746 } | 1746 } |
1747 | 1747 |
1748 /* now check G, skip if don't have a g */ | 1748 /* now check G, skip if don't have a g */ |
1749 if (params->base.len == 0) goto cleanup; | 1749 if (params->base.len == 0) goto cleanup; |
1750 | 1750 |
(...skipping 87 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1838 if (vfy == NULL) | 1838 if (vfy == NULL) |
1839 return; | 1839 return; |
1840 if (vfy->arena != NULL) { | 1840 if (vfy->arena != NULL) { |
1841 PORT_FreeArena(vfy->arena, PR_FALSE); /* don't zero it */ | 1841 PORT_FreeArena(vfy->arena, PR_FALSE); /* don't zero it */ |
1842 } else { | 1842 } else { |
1843 SECITEM_FreeItem(&vfy->seed, PR_FALSE); /* don't free seed */ | 1843 SECITEM_FreeItem(&vfy->seed, PR_FALSE); /* don't free seed */ |
1844 SECITEM_FreeItem(&vfy->h, PR_FALSE); /* don't free h */ | 1844 SECITEM_FreeItem(&vfy->h, PR_FALSE); /* don't free h */ |
1845 PORT_Free(vfy); | 1845 PORT_Free(vfy); |
1846 } | 1846 } |
1847 } | 1847 } |
OLD | NEW |