Merge pull request #10663 from rizlik/pubkey_ecc_operation_cb

Introduce ECC Make PUB and ECC Check Pub crypto callbacks

Author: douzzer

doc/dox_comments/header_files/cryptocb.h

@@ -251,3 +251,63 @@ void wc_CryptoCb_InfoString(wc_CryptoInfo* info);
     \sa wc_AesInit
 */
 int wc_CryptoCb_AesSetKey(Aes* aes, const byte* key, word32 keySz);
+
+/*!
+    \ingroup CryptoCb
+
+    \brief Offload deriving an ECC public key Q = d*G from its private key to a
+    CryptoCB device.
+
+    Used by wc_ecc_make_pub / wc_ecc_make_pub_ex. The callback boundary is
+    math-free: the resulting public point crosses as X9.63 uncompressed bytes
+    (0x04 || X || Y, each ordinate zero-padded to the curve size) in
+    wc_CryptoInfo.pk.ecc_make_pub (\c pubOut / \c pubOutSz). This wrapper performs
+    all bignum (de)serialization, so a device handler only deals with byte arrays
+    and never with wolfCrypt's internal mp_int representation. The private scalar
+    is taken from the ecc_key (resident in a secure element, or key->k); curve
+    identity comes from key->dp.
+
+    \param key    ECC key providing the device id, curve identity, heap hint and
+                  the private scalar
+    \param pubOut [out] resulting affine public point Q = d*G
+
+    \return 0 on success
+    \return CRYPTOCB_UNAVAILABLE if no device handles the operation, or key or
+            pubOut is NULL (wolfCrypt falls back to software, which reports
+            the argument error)
+
+    \sa wc_CryptoCb_RegisterDevice
+    \sa wc_ecc_make_pub
+*/
+int wc_CryptoCb_EccMakePub(ecc_key* key, ecc_point* pubOut);
+
+/*!
+    \ingroup CryptoCb
+
+    \brief Offload validating an ECC key to a CryptoCB device.
+
+    Used by wc_ecc_check_key and the key generation / import validation paths.
+    The public point crosses the (math-free) callback boundary as X9.63
+    uncompressed bytes in wc_CryptoInfo.pk.ecc_check_pub (\c pubKey /
+    \c pubKeySz); this wrapper serializes key->pubkey so a device handler only
+    deals with byte arrays. When the key state is \c ECC_PRIVATEKEY_ONLY,
+    \c pubKey is NULL and \c pubKeySz is 0 so the handler can distinguish "no
+    public point" from an invalid zero-coordinate public point that must be
+    validated and rejected. The caller's intent crosses in \c checkOrder and
+    \c checkPriv.
+
+    \param key        ECC key to validate (curve identity from key->dp)
+    \param checkOrder when 1 the caller requested validation that the point
+                      has the curve order (point * order == infinity)
+    \param checkPriv  when 1 the caller also requested validation of the
+                      private part (scalar range, consistency with the public
+                      point)
+
+    \return 0 if the key is valid
+    \return CRYPTOCB_UNAVAILABLE if no device handles the operation (wolfCrypt
+            falls back to software)
+
+    \sa wc_CryptoCb_RegisterDevice
+    \sa wc_ecc_check_key
+*/
+int wc_CryptoCb_EccCheckPubKey(ecc_key* key, int checkOrder, int checkPriv);

tests/swdev/swdev.c

@@ -153,6 +153,89 @@ static int swdev_ecc_get_sig_size(wc_CryptoInfo* info)
     *info->pk.ecc_get_sig_size.sigSize = sz;
     return 0;
 }
+
+static int swdev_ecc_make_pub(wc_CryptoInfo* info)
+{
+    int        ret;
+    ecc_key*   key = info->pk.ecc_make_pub.key;
+    ecc_point* pub = wc_ecc_new_point_h(key->heap);
+
+    if (pub == NULL)
+        return MEMORY_E;
+
+    /* derive Q = d*G in software, then emit X9.63 uncompressed bytes. The
+     * point is serialized with the curve size from key->dp so custom-curve
+     * keys (idx == ECC_CUSTOM_IDX) work too; wc_ecc_export_point_der rejects
+     * negative curve indices. */
+    ret = wc_ecc_make_pub(key, pub);
+    if (ret == 0) {
+        byte*  out     = info->pk.ecc_make_pub.pubOut;
+        word32 curveSz = (word32)key->dp->size;
+        word32 ptSz    = 1 + 2 * curveSz;
+        word32 xSz     = curveSz;
+        word32 ySz     = curveSz;
+
+        if (*info->pk.ecc_make_pub.pubOutSz < ptSz) {
+            ret = BUFFER_E;
+        }
+        else {
+            out[0] = ECC_POINT_UNCOMP;
+            ret = wc_export_int(pub->x, out + 1, &xSz, curveSz,
+                WC_TYPE_UNSIGNED_BIN);
+            if (ret == MP_OKAY)
+                ret = wc_export_int(pub->y, out + 1 + curveSz, &ySz, curveSz,
+                    WC_TYPE_UNSIGNED_BIN);
+            if (ret == MP_OKAY)
+                *info->pk.ecc_make_pub.pubOutSz = ptSz;
+        }
+    }
+
+    wc_ecc_del_point_h(pub, key->heap);
+    return ret;
+}
+
+#ifdef HAVE_ECC_CHECK_KEY
+static int swdev_ecc_check_pub(wc_CryptoInfo* info)
+{
+    ecc_key* key = info->pk.ecc_check_pub.key;
+    int      ret = 0;
+    int      validatedFromWire = 0;
+
+    if (info->pk.ecc_check_pub.pubKeySz == 0) {
+        return ECC_INF_E;
+    }
+#ifdef HAVE_ECC_KEY_IMPORT
+    if (key->idx >= 0) {
+        WC_DECLARE_VAR(pubOnly, ecc_key, 1, key->heap);
+        WC_ALLOC_VAR(pubOnly, ecc_key, 1, key->heap);
+        if (!WC_VAR_OK(pubOnly))
+            ret = MEMORY_E;
+        else
+            ret = wc_ecc_init_ex(pubOnly, key->heap, INVALID_DEVID);
+        if (ret == 0) {
+            ret = wc_ecc_import_x963_ex(info->pk.ecc_check_pub.pubKey,
+                info->pk.ecc_check_pub.pubKeySz, pubOnly, key->dp->id);
+            if (ret == 0 &&
+                    wc_ecc_cmp_point(&pubOnly->pubkey, &key->pubkey) != MP_EQ) {
+                /* wire bytes disagree with key->pubkey */
+                ret = BAD_STATE_E;
+            }
+            if (ret == 0)
+                ret = wc_ecc_check_key(pubOnly);
+            wc_ecc_free(pubOnly);
+        }
+        WC_FREE_VAR(pubOnly, key->heap);
+        validatedFromWire = 1;
+    }
+#endif
+    if (ret == 0 && (!validatedFromWire ||
+            (info->pk.ecc_check_pub.checkPriv &&
+             key->type == ECC_PRIVATEKEY))) {
+        ret = wc_ecc_check_key(key);
+    }
+    return ret;
+}
+#endif /* HAVE_ECC_CHECK_KEY */
 #endif /* HAVE_ECC */
 
 #ifndef NO_SHA256
@@ -712,6 +795,12 @@ WC_SWDEV_EXPORT int wc_SwDev_Callback(int devId, wc_CryptoInfo* info,
             return swdev_ecc_get_size(info);
         case WC_PK_TYPE_EC_GET_SIG_SIZE:
             return swdev_ecc_get_sig_size(info);
+        case WC_PK_TYPE_EC_MAKE_PUB:
+            return swdev_ecc_make_pub(info);
+    #ifdef HAVE_ECC_CHECK_KEY
+        case WC_PK_TYPE_EC_CHECK_PUB_KEY:
+            return swdev_ecc_check_pub(info);
+    #endif
     #endif /* HAVE_ECC */
         default:
             return CRYPTOCB_UNAVAILABLE;

wolfcrypt/src/cryptocb.c

@@ -157,6 +157,8 @@ static const char* GetPkTypeStr(int pk)
         case WC_PK_TYPE_EC_KEYGEN: return "ECC KeyGen";
         case WC_PK_TYPE_EC_GET_SIZE: return "ECC GetSize";
         case WC_PK_TYPE_EC_GET_SIG_SIZE: return "ECC GetSigSize";
+        case WC_PK_TYPE_EC_MAKE_PUB: return "ECC MakePub";
+        case WC_PK_TYPE_EC_CHECK_PUB_KEY: return "ECC CheckPubKey";
     }
     return NULL;
 }
@@ -882,6 +884,127 @@ int wc_CryptoCb_EccGetSigSize(const ecc_key* key, int* sigSize)
 
     return wc_CryptoCb_TranslateErrorCode(ret);
 }
+
+int wc_CryptoCb_EccMakePub(ecc_key* key, ecc_point* pubOut)
+{
+    int ret = WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE);
+    CryptoCb* dev;
+
+    if (key == NULL || pubOut == NULL || key->dp == NULL)
+        return ret;
+
+    if (key->dp->size > MAX_ECC_BYTES)
+        return ret;
+
+    dev = wc_CryptoCb_FindDevice(key->devId, WC_ALGO_TYPE_PK);
+    if (dev && dev->cb) {
+        wc_CryptoInfo cryptoInfo;
+        word32 curveSz = (word32)key->dp->size;
+        word32 ptSz    = 1 + 2 * curveSz;          /* X9.63 uncompressed length */
+        word32 outSz   = 1 + 2 * MAX_ECC_BYTES;    /* buffer size on input */
+        WC_DECLARE_VAR(buf, byte, (1 + 2 * MAX_ECC_BYTES), key->heap);
+        WC_ALLOC_VAR_EX(buf, byte, (1 + 2 * MAX_ECC_BYTES), key->heap,
+            DYNAMIC_TYPE_ECC_BUFFER, return MEMORY_E);
+
+        /* zero the result buffer so a handler that returns success without
+         * writing output is rejected deterministically by the tag check */
+        XMEMSET(buf, 0, ptSz);
+
+        XMEMSET(&cryptoInfo, 0, sizeof(cryptoInfo));
+        cryptoInfo.algo_type = WC_ALGO_TYPE_PK;
+        cryptoInfo.pk.type = WC_PK_TYPE_EC_MAKE_PUB;
+        cryptoInfo.pk.ecc_make_pub.key = key;
+        cryptoInfo.pk.ecc_make_pub.pubOut = buf;
+        cryptoInfo.pk.ecc_make_pub.pubOutSz = &outSz;
+
+        ret = dev->cb(dev->devId, &cryptoInfo, dev->ctx);
+
+        /* deserialize X9.63 uncompressed result into pubOut; reject a result
+         * whose size is not exactly the curve's X9.63 length */
+        if (ret == 0) {
+            if (outSz != ptSz || buf[0] != ECC_POINT_UNCOMP) {
+                ret = BUFFER_E;
+            }
+            else {
+                int err = mp_read_unsigned_bin(pubOut->x, buf + 1, curveSz);
+                if (err == MP_OKAY)
+                    err = mp_read_unsigned_bin(pubOut->y, buf + 1 + curveSz,
+                        curveSz);
+                if (err == MP_OKAY)
+                    err = mp_set(pubOut->z, 1);
+                if (err != MP_OKAY)
+                    ret = err;
+            }
+        }
+
+        WC_FREE_VAR_EX(buf, key->heap, DYNAMIC_TYPE_ECC_BUFFER);
+    }
+
+    return wc_CryptoCb_TranslateErrorCode(ret);
+}
+
+#ifdef HAVE_ECC_CHECK_KEY
+int wc_CryptoCb_EccCheckPubKey(ecc_key* key, int checkOrder, int checkPriv)
+{
+    int ret = WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE);
+    CryptoCb* dev;
+
+    if (key == NULL || key->dp == NULL)
+        return ret;
+
+    if (key->dp->size > MAX_ECC_BYTES)
+        return ret;
+
+    /* locate registered callback */
+    dev = wc_CryptoCb_FindDevice(key->devId, WC_ALGO_TYPE_PK);
+    if (dev && dev->cb) {
+        wc_CryptoInfo cryptoInfo;
+        word32 curveSz = (word32)key->dp->size;
+        word32 ptSz    = 1 + 2 * curveSz;
+        word32 xSz     = curveSz;
+        word32 ySz     = curveSz;
+        /* a key with no host-side public point is represented by
+         * ECC_PRIVATEKEY_ONLY and crosses as pubKey = NULL / pubKeySz = 0.
+         * If the key state says a public point exists, serialize it even when
+         * the coordinates are invalid (e.g. 0,0) so the device can reject the
+         * actual input instead of seeing "no public point". */
+        int havePub    = (key->type != ECC_PRIVATEKEY_ONLY);
+        WC_DECLARE_VAR(buf, byte, (1 + 2 * MAX_ECC_BYTES), key->heap);
+
+        ret = MP_OKAY;
+        if (havePub) {
+            WC_ALLOC_VAR_EX(buf, byte, (1 + 2 * MAX_ECC_BYTES), key->heap,
+                DYNAMIC_TYPE_ECC_BUFFER, return MEMORY_E);
+            /* serialize key->pubkey to X9.63 uncompressed (0x04 || X || Y) */
+            buf[0] = ECC_POINT_UNCOMP;
+            ret = wc_export_int(key->pubkey.x, buf + 1, &xSz, curveSz,
+                WC_TYPE_UNSIGNED_BIN);
+            if (ret == MP_OKAY)
+                ret = wc_export_int(key->pubkey.y, buf + 1 + curveSz, &ySz,
+                    curveSz, WC_TYPE_UNSIGNED_BIN);
+        }
+
+        if (ret == MP_OKAY) {
+            XMEMSET(&cryptoInfo, 0, sizeof(cryptoInfo));
+            cryptoInfo.algo_type = WC_ALGO_TYPE_PK;
+            cryptoInfo.pk.type = WC_PK_TYPE_EC_CHECK_PUB_KEY;
+            cryptoInfo.pk.ecc_check_pub.key = key;
+            cryptoInfo.pk.ecc_check_pub.pubKey = havePub ? buf : NULL;
+            cryptoInfo.pk.ecc_check_pub.pubKeySz = havePub ? ptSz : 0;
+            cryptoInfo.pk.ecc_check_pub.checkOrder = checkOrder;
+            cryptoInfo.pk.ecc_check_pub.checkPriv = checkPriv;
+
+            ret = dev->cb(dev->devId, &cryptoInfo, dev->ctx);
+        }
+
+        if (havePub) {
+            WC_FREE_VAR_EX(buf, key->heap, DYNAMIC_TYPE_ECC_BUFFER);
+        }
+    }
+
+    return wc_CryptoCb_TranslateErrorCode(ret);
+}
+#endif /* HAVE_ECC_CHECK_KEY */
 #endif /* HAVE_ECC */
 
 #ifdef HAVE_CURVE25519