ecc256.cpp

#include <stdlib.h>
#include <string.h>
#include <openssl/evp.h>
#include <openssl/ec.h>
#include <openssl/bn.h>
#include <openssl/err.h>
#include <openssl/sha.h>

#include "crypto.h"

int ecc256_open_context(ecc_state_handle_t* p_ecc_handle) {
	if (p_ecc_handle == NULL) {
		return -1;
	}

	/* construct a curve p-256 */
	EC_GROUP* ec_group = EC_GROUP_new_by_curve_name(NID_X9_62_prime256v1);
	if (NULL == ec_group) {
		return -1;
	} else {
		*p_ecc_handle = (void*)ec_group;
	}
	return 0;
}

void ecc256_close_context(ecc_state_handle_t ecc_handle) {
	if (ecc_handle == NULL) {
		return;
	}

	EC_GROUP_free((EC_GROUP*)ecc_handle);
}

int ecc256_create_key_pair(
	sgx_ec256_private_t *p_private,
    sgx_ec256_public_t *p_public,
    ecc_state_handle_t ecc_handle
    ) {
	if ((ecc_handle == NULL) || (p_private == NULL) || (p_public == NULL)) {
		return -1;
	}

	EC_GROUP *ec_group = (EC_GROUP*) ecc_handle;
	EC_KEY *ec_key = NULL;
	BIGNUM *pub_k_x = NULL;
	BIGNUM *pub_k_y = NULL;
	const EC_POINT *public_k = NULL;
	const BIGNUM *private_k = NULL;
	int ret = -1;

	do {
		// create new EC key
		//
		ec_key = EC_KEY_new();
		if (NULL == ec_key) {
			break;
		}

		// set key's group (curve)
		//
		if (0 == EC_KEY_set_group (ec_key, ec_group)) {
			break;
		}

		// generate key pair, based on the curve set
		//
		if (0 == EC_KEY_generate_key(ec_key)) {
			break;
		}

		pub_k_x = BN_new();
		pub_k_y = BN_new();
		if (NULL ==  pub_k_x || NULL == pub_k_y) {
			break;
		}

		// This OPENSSL API doesn't validate user's parameters
		// get public and private keys
		//
		public_k = EC_KEY_get0_public_key(ec_key);
		if (NULL == public_k) {
			break;
		}

		private_k = EC_KEY_get0_private_key(ec_key);
		if (NULL == private_k) {
			break;
		}

		// extract two BNs representing the public key
		//
		if (!EC_POINT_get_affine_coordinates(ec_group, public_k, pub_k_x, pub_k_y, NULL)) {
			break;
		}

		// convert private key BN to little-endian unsigned char form
		//
		if (-1 == BN_bn2lebinpad(private_k, (unsigned char*)p_private, SGX_ECP256_KEY_SIZE)) {
			break;
		}

		// convert public key BN to little-endian unsigned char form
		//
		if (-1 == BN_bn2lebinpad(pub_k_x, (unsigned char*)p_public->gx, SGX_ECP256_KEY_SIZE)) {
			break;
		}
		// convert public key BN to little-endian unsigned char form
		//
		if (-1 == BN_bn2lebinpad(pub_k_y, (unsigned char*)p_public->gy, SGX_ECP256_KEY_SIZE)) {
			break;
		}

		ret = 0;
	} while(0);

	if (!ret) {
		// in case of error, clear output buffers
		//
		memset(p_private, sizeof(p_private), 0);
		memset(p_public->gx, sizeof(p_public->gx), 0);
		memset(p_public->gy, sizeof(p_public->gy), 0);
	}

	//free temp data
	//
	EC_KEY_free(ec_key);
	BN_clear_free(pub_k_x);
	BN_clear_free(pub_k_y);

	return ret;
}

int ecc256_compute_shared_dhkey(
	const sgx_ec256_private_t *p_private_b,
    const sgx_ec256_public_t *p_public_ga,
    sgx_ec256_dh_shared_t *p_shared_key,
    ecc_state_handle_t ecc_handle
    ) {
	if ((ecc_handle == NULL) || (p_private_b == NULL) || (p_public_ga == NULL) || (p_shared_key == NULL)) {
		return -1;
	}

	int ret = -1;
	EC_GROUP *ec_group = (EC_GROUP*) ecc_handle;
	EC_POINT *point_pubA = NULL;
	EC_KEY* private_key = NULL;
	BIGNUM *BN_dh_privB = NULL;
	BIGNUM *pubA_gx = NULL;
	BIGNUM *pubA_gy = NULL;
	BIGNUM *tmp = NULL;

	do {
		// get BN from public key and private key
		//
		BN_dh_privB = BN_lebin2bn((unsigned char*)p_private_b->r, sizeof(sgx_ec256_private_t), 0);
		if (BN_dh_privB == NULL) {
			break;
		}

		pubA_gx = BN_lebin2bn((unsigned char*)p_public_ga->gx, sizeof(sgx_ec256_private_t), 0);
		if (pubA_gx == NULL) {
			break;
		}

		pubA_gy = BN_lebin2bn((unsigned char*)p_public_ga->gy, sizeof(sgx_ec256_private_t), 0);
		if (pubA_gy == NULL) {
			break;
		}

		// set point based on pub key x and y
		//
		point_pubA = EC_POINT_new(ec_group);
		if (point_pubA == NULL) {
			break;
		}

		// create point (public key) based on public key's x,y coordinates
		//
		if (EC_POINT_set_affine_coordinates(ec_group, point_pubA, pubA_gx, pubA_gy, NULL) != 1) {
			break;
		}

		// check point if valid, point is on curve
		//
		if (EC_POINT_is_on_curve(ec_group, point_pubA, NULL) != 1) {
			break;
		}

		// create empty shared key BN
		//
		private_key = EC_KEY_new();
		if (private_key == NULL) {
			break;
		}

		// init private key group (set curve)
		//
		if (EC_KEY_set_group (private_key, ec_group) != 1) {
			break;
		}

		// init private key with BN value
		//
		if (EC_KEY_set_private_key(private_key, BN_dh_privB) != 1) {
			break;
		}

		// calculate shared dh key
		//
		size_t shared_key_len = sizeof(sgx_ec256_dh_shared_t);
		shared_key_len = ECDH_compute_key(&(p_shared_key->s), shared_key_len, point_pubA, private_key, NULL);
		if (shared_key_len <= 0 || shared_key_len != sizeof(sgx_ec256_dh_shared_t)) {
			break;
		}

		// convert big endian to little endian
		//
		tmp = BN_bin2bn((unsigned char*)&(p_shared_key->s), sizeof(sgx_ec256_dh_shared_t), 0);
	if (tmp == NULL) {
		break;
	}
		if (BN_bn2lebinpad(tmp, p_shared_key->s, sizeof(sgx_ec256_dh_shared_t)) == -1) {
			break;
		}
		ret = 0;
	} while(0);

	if (!ret) {
		memset(p_shared_key->s, sizeof(p_shared_key->s), 0);
	}

	// clear and free memory
	//
	EC_POINT_clear_free(point_pubA);
	EC_KEY_free(private_key);
	BN_clear_free(BN_dh_privB);
	BN_clear_free(pubA_gx);
	BN_clear_free(pubA_gy);
	BN_clear_free(tmp);

	return ret;
}

int ecc256_calculate_pub_from_priv(const sgx_ec256_private_t *p_priv_key, sgx_ec256_public_t  *p_pub_key) {
    if ((p_priv_key == NULL) || (p_pub_key == NULL)) {
        return -1;
    }

    int ret = -1;
    EC_GROUP* ec_group = NULL;
    EC_POINT *pub_ec_point = NULL;
    BIGNUM *bn_o = NULL;
    BIGNUM *bn_x = NULL;
    BIGNUM *bn_y = NULL;
    BN_CTX *tmp = NULL;

    do {
        //create empty BNs
        //
        bn_x = BN_new();
        if (NULL == bn_x) {
            break;
        }
        bn_y = BN_new();
        if (NULL == bn_y) {
            break;
        }
        tmp = BN_CTX_new();
        if (NULL == tmp) {
            break;
        }

        //init bn_o with private key value
        //
        bn_o = BN_lebin2bn((const unsigned char*)p_priv_key, (int)sizeof(sgx_ec256_private_t), bn_o);
        // BN_CHECK_BREAK(bn_o);

        //create a new ecc group and initialize it to NID_X9_62_prime256v1 curve
        //
        ec_group = EC_GROUP_new_by_curve_name(NID_X9_62_prime256v1);
        if (ec_group == NULL) {
            break;
        }

        //create a new EC point
        //
        pub_ec_point = EC_POINT_new(ec_group);
        if (pub_ec_point == NULL) {
            break;
        }

        //calculate public key (point) based on private key. (pub = priv * curve_griup)
        //
        if (!EC_POINT_mul(ec_group, pub_ec_point, bn_o, NULL, NULL, tmp)) {
            break;
        }

        //retrieve x and y coordinates into BNs
        //
        if (!EC_POINT_get_affine_coordinates(ec_group, pub_ec_point, bn_x, bn_y, tmp)) {
            break;
        }

        //convert the absolute value of BNs into little-endian buffers
        //
        if (!BN_bn2lebinpad(bn_x, p_pub_key->gx, BN_num_bytes(bn_x))) {
            break;
        }

        if (!BN_bn2lebinpad(bn_y, p_pub_key->gy, BN_num_bytes(bn_y))) {
            break;
        }

        ret = 0;
    } while (0);

    //in case of failure clear public key
    //
    if (!ret) {
        (void)memset(p_pub_key, sizeof(sgx_ec256_public_t), 0);
    }

    BN_clear_free(bn_o);
    BN_clear_free(bn_x);
    BN_clear_free(bn_y);
    BN_CTX_free(tmp);
    EC_GROUP_clear_free(ec_group);
    EC_POINT_clear_free(pub_ec_point);

    return ret;
}

int ecdsa_sign(const uint8_t *p_data,
               uint32_t data_size,
               const sgx_ec256_private_t *p_private,
               sgx_ec256_signature_t *p_signature,
               ecc_state_handle_t ecc_handle) {
	if ((ecc_handle == NULL) || (p_private == NULL) || (p_signature == NULL) || (p_data == NULL) || (data_size < 1)) {
		return SGX_ERROR_INVALID_PARAMETER;
	}

	EC_KEY *private_key = NULL;
	BIGNUM *bn_priv = NULL;
	ECDSA_SIG *ecdsa_sig = NULL;
	const BIGNUM *r = NULL;
	const BIGNUM *s = NULL;
	unsigned char digest[SGX_SHA256_HASH_SIZE] = { 0 };
	int written_bytes = 0;
	int sig_size = 0;
	int max_sig_size = 0;
	int retval = -1;

	do {
		// converts the r value of private key, represented as positive integer in little-endian into a BIGNUM
		//
		bn_priv = BN_lebin2bn((unsigned char*)p_private->r, sizeof(p_private->r), 0);
		if (NULL == bn_priv) {
			break;
		}

		// create empty ecc key
		//
		private_key = EC_KEY_new();
		if (NULL == private_key) {
			break;
		}

		// sets ecc key group (set curve)
		//
		if (1 != EC_KEY_set_group(private_key, (EC_GROUP*)ecc_handle)) {
			break;
		}

		// uses bn_priv to set the ecc private key
		//
		if (1 != EC_KEY_set_private_key(private_key, bn_priv)) {
			break;
		}

		/* generates digest of p_data */
		if (NULL == SHA256((const unsigned char *)p_data, data_size, (unsigned char *)digest)) {
			break;
		}

		// computes a digital signature of the SGX_SHA256_HASH_SIZE bytes hash value dgst using the private EC key private_key.
		// the signature is returned as a newly allocated ECDSA_SIG structure.
		//
		ecdsa_sig = ECDSA_do_sign(digest, SGX_SHA256_HASH_SIZE, private_key);
		if (NULL == ecdsa_sig) {
			break;
		}

		// returns internal pointers the r and s values contained in ecdsa_sig.
		ECDSA_SIG_get0(ecdsa_sig, &r, &s);

		// converts the r BIGNUM of the signature to little endian buffer, bounded with the len of out buffer
		//
		written_bytes = BN_bn2lebinpad(r, (unsigned char*)p_signature->x, SGX_ECP256_KEY_SIZE);
		if (0 >= written_bytes) {
			break;
		}
		sig_size = written_bytes;

		// converts the s BIGNUM of the signature to little endian buffer, bounded with the len of out buffer
		//
		written_bytes = BN_bn2lebinpad(s, (unsigned char*)p_signature->y, SGX_ECP256_KEY_SIZE);
		if (0 >= written_bytes) {
			break;
		}
		sig_size += written_bytes;

		// returns the maximum length of a DER encoded ECDSA signature created with the private EC key.
		//
		max_sig_size = ECDSA_size(private_key);
		if (max_sig_size <= 0) {
			break;
		}

		// checks if the signature size not larger than the max len of valid signature
		// this check if done for validity, not for overflow.
		//
		if (sig_size > max_sig_size) {
			break;
		}

		retval = 0;
	} while(0);

	if (bn_priv)
		BN_clear_free(bn_priv);
	if (ecdsa_sig)
		ECDSA_SIG_free(ecdsa_sig);
	if (private_key)
		EC_KEY_free(private_key);

	return retval;
}