diff options
author | Nils Larsch <nils@openssl.org> | 2005-05-16 10:11:04 +0000 |
---|---|---|
committer | Nils Larsch <nils@openssl.org> | 2005-05-16 10:11:04 +0000 |
commit | 9dd84053419aa220b5e66a5f9fcf809dbd6d9369 (patch) | |
tree | 7818c598a88a5b457333fd9f5951836fe96834b6 /apps | |
parent | 46a643763de6d8e39ecf6f76fa79b4d04885aa59 (diff) |
ecc api cleanup; summary:
- hide the EC_KEY structure definition in ec_lcl.c + add
some functions to use/access the EC_KEY fields
- change the way how method specific data (ecdsa/ecdh) is
attached to a EC_KEY
- add ECDSA_sign_ex and ECDSA_do_sign_ex functions with
additional parameters for pre-computed values
- rebuild libeay.num from 0.9.7
Diffstat (limited to 'apps')
-rw-r--r-- | apps/ec.c | 16 | ||||
-rw-r--r-- | apps/ecparam.c | 8 | ||||
-rw-r--r-- | apps/req.c | 19 | ||||
-rw-r--r-- | apps/s_server.c | 18 | ||||
-rw-r--r-- | apps/speed.c | 278 |
5 files changed, 156 insertions, 183 deletions
@@ -3,7 +3,7 @@ * Written by Nils Larsch for the OpenSSL project. */ /* ==================================================================== - * Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved. + * Copyright (c) 1998-2005 The OpenSSL Project. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions @@ -89,6 +89,7 @@ int MAIN(int argc, char **argv) #endif int ret = 1; EC_KEY *eckey = NULL; + const EC_GROUP *group; int i, badops = 0; const EVP_CIPHER *enc = NULL; BIO *in = NULL, *out = NULL; @@ -328,14 +329,13 @@ bad: } } + group = EC_KEY_get0_group(eckey); + if (new_form) - { - EC_GROUP_set_point_conversion_form(eckey->group, form); - eckey->conv_form = form; - } + EC_KEY_set_conv_form(eckey, form); if (new_asn1_flag) - EC_GROUP_set_asn1_flag(eckey->group, asn1_flag); + EC_KEY_set_asn1_flag(eckey, asn1_flag); if (text) if (!EC_KEY_print(out, eckey, 0)) @@ -352,7 +352,7 @@ bad: if (outformat == FORMAT_ASN1) { if (param_out) - i = i2d_ECPKParameters_bio(out, eckey->group); + i = i2d_ECPKParameters_bio(out, group); else if (pubin || pubout) i = i2d_EC_PUBKEY_bio(out, eckey); else @@ -361,7 +361,7 @@ bad: else if (outformat == FORMAT_PEM) { if (param_out) - i = PEM_write_bio_ECPKParameters(out, eckey->group); + i = PEM_write_bio_ECPKParameters(out, group); else if (pubin || pubout) i = PEM_write_bio_EC_PUBKEY(out, eckey); else diff --git a/apps/ecparam.c b/apps/ecparam.c index b9786288d9..167fd1faaa 100644 --- a/apps/ecparam.c +++ b/apps/ecparam.c @@ -3,7 +3,7 @@ * Written by Nils Larsch for the OpenSSL project. */ /* ==================================================================== - * Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved. + * Copyright (c) 1998-2005 The OpenSSL Project. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions @@ -647,11 +647,11 @@ bad: assert(need_rand); - eckey->group = group; + if (EC_KEY_set_group(eckey, group) == 0) + goto end; if (!EC_KEY_generate_key(eckey)) { - eckey->group = NULL; EC_KEY_free(eckey); goto end; } @@ -664,11 +664,9 @@ bad: { BIO_printf(bio_err, "bad output format specified " "for outfile\n"); - eckey->group = NULL; EC_KEY_free(eckey); goto end; } - eckey->group = NULL; EC_KEY_free(eckey); } diff --git a/apps/req.c b/apps/req.c index db70dc2275..764ef2906f 100644 --- a/apps/req.c +++ b/apps/req.c @@ -344,6 +344,7 @@ int MAIN(int argc, char **argv) { X509 *xtmp=NULL; EVP_PKEY *dtmp; + EC_GROUP *group; pkey_type=TYPE_EC; p+=3; @@ -354,10 +355,10 @@ int MAIN(int argc, char **argv) } if ((ec_params = EC_KEY_new()) == NULL) goto end; - if ((ec_params->group = PEM_read_bio_ECPKParameters(in, NULL, NULL, NULL)) == NULL) + group = PEM_read_bio_ECPKParameters(in, NULL, NULL, NULL); + if (group == NULL) { - if (ec_params) - EC_KEY_free(ec_params); + EC_KEY_free(ec_params); ERR_clear_error(); (void)BIO_reset(in); if ((xtmp=PEM_read_bio_X509(in,NULL,NULL,NULL)) == NULL) @@ -369,7 +370,7 @@ int MAIN(int argc, char **argv) if ((dtmp=X509_get_pubkey(xtmp))==NULL) goto end; if (dtmp->type == EVP_PKEY_EC) - ec_params = ECParameters_dup(dtmp->pkey.eckey); + ec_params = EC_KEY_dup(dtmp->pkey.ec); EVP_PKEY_free(dtmp); X509_free(xtmp); if (ec_params == NULL) @@ -378,12 +379,16 @@ int MAIN(int argc, char **argv) goto end; } } + else + { + if (EC_KEY_set_group(ec_params, group) == 0) + goto end; + EC_GROUP_free(group); + } BIO_free(in); in=NULL; - - newkey = EC_GROUP_get_degree(ec_params->group); - + newkey = EC_GROUP_get_degree(EC_KEY_get0_group(ec_params)); } else #endif diff --git a/apps/s_server.c b/apps/s_server.c index ea19a50bff..59b6305e97 100644 --- a/apps/s_server.c +++ b/apps/s_server.c @@ -981,13 +981,6 @@ bad: { EC_KEY *ecdh=NULL; - ecdh = EC_KEY_new(); - if (ecdh == NULL) - { - BIO_printf(bio_err,"Could not create ECDH struct.\n"); - goto end; - } - if (named_curve) { int nid = OBJ_sn2nid(named_curve); @@ -998,9 +991,8 @@ bad: named_curve); goto end; } - - ecdh->group = EC_GROUP_new_by_curve_name(nid); - if (ecdh->group == NULL) + ecdh = EC_KEY_new_by_curve_name(nid); + if (ecdh == NULL) { BIO_printf(bio_err, "unable to create curve (%s)\n", named_curve); @@ -1008,15 +1000,15 @@ bad: } } - if (ecdh->group != NULL) + if (ecdh != NULL) { BIO_printf(bio_s_out,"Setting temp ECDH parameters\n"); } else { BIO_printf(bio_s_out,"Using default temp ECDH parameters\n"); - ecdh->group=EC_GROUP_new_by_curve_name(NID_sect163r2); - if (ecdh->group == NULL) + ecdh = EC_KEY_new_by_curve_name(NID_sect163r2); + if (ecdh == NULL) { BIO_printf(bio_err, "unable to create curve (sect163r2)\n"); goto end; diff --git a/apps/speed.c b/apps/speed.c index 2ecbb1e9c6..50a110df04 100644 --- a/apps/speed.c +++ b/apps/speed.c @@ -2040,7 +2040,7 @@ int MAIN(int argc, char **argv) int ret; if (!ecdsa_doit[j]) continue; /* Ignore Curve */ - ecdsa[j] = EC_KEY_new(); + ecdsa[j] = EC_KEY_new_by_curve_name(test_curves[j]); if (ecdsa[j] == NULL) { BIO_printf(bio_err,"ECDSA failure.\n"); @@ -2049,100 +2049,89 @@ int MAIN(int argc, char **argv) } else { - ecdsa[j]->group = EC_GROUP_new_by_curve_name(test_curves[j]); - /* Could not obtain group information */ - if (ecdsa[j]->group == NULL) +#if 1 + EC_KEY_precompute_mult(ecdsa[j], NULL); +#endif + /* Perform ECDSA signature test */ + EC_KEY_generate_key(ecdsa[j]); + ret = ECDSA_sign(0, buf, 20, ecdsasig, + &ecdsasiglen, ecdsa[j]); + if (ret == 0) { - BIO_printf(bio_err,"ECDSA failure.Could not obtain group information\n"); + BIO_printf(bio_err,"ECDSA sign failure. No ECDSA sign will be done.\n"); ERR_print_errors(bio_err); rsa_count=1; } else { -#if 1 - EC_GROUP_precompute_mult(ecdsa[j]->group, NULL); -#endif - /* Perform ECDSA signature test */ - EC_KEY_generate_key(ecdsa[j]); - ret = ECDSA_sign(0, buf, 20, ecdsasig, - &ecdsasiglen, ecdsa[j]); - if (ret == 0) - { - BIO_printf(bio_err,"ECDSA sign failure. No ECDSA sign will be done.\n"); - ERR_print_errors(bio_err); - rsa_count=1; - } - else + pkey_print_message("sign","ecdsa", + ecdsa_c[j][0], + test_curves_bits[j], + ECDSA_SECONDS); + + Time_F(START); + for (count=0,run=1; COND(ecdsa_c[j][0]); + count++) { - pkey_print_message("sign","ecdsa", - ecdsa_c[j][0], - test_curves_bits[j], - ECDSA_SECONDS); - - Time_F(START); - for (count=0,run=1; COND(ecdsa_c[j][0]); - count++) + ret=ECDSA_sign(0, buf, 20, + ecdsasig, &ecdsasiglen, + ecdsa[j]); + if (ret == 0) { - ret=ECDSA_sign(0, buf, 20, - ecdsasig, &ecdsasiglen, - ecdsa[j]); - if (ret == 0) - { - BIO_printf(bio_err, "ECDSA sign failure\n"); - ERR_print_errors(bio_err); - count=1; - break; - } + BIO_printf(bio_err, "ECDSA sign failure\n"); + ERR_print_errors(bio_err); + count=1; + break; } - d=Time_F(STOP); - - BIO_printf(bio_err, mr ? "+R5:%ld:%d:%.2f\n" : - "%ld %d bit ECDSA signs in %.2fs \n", - count, test_curves_bits[j], d); - ecdsa_results[j][0]=d/(double)count; - rsa_count=count; } + d=Time_F(STOP); - /* Perform ECDSA verification test */ - ret=ECDSA_verify(0, buf, 20, ecdsasig, - ecdsasiglen, ecdsa[j]); - if (ret != 1) - { - BIO_printf(bio_err,"ECDSA verify failure. No ECDSA verify will be done.\n"); - ERR_print_errors(bio_err); - ecdsa_doit[j] = 0; - } - else + BIO_printf(bio_err, mr ? "+R5:%ld:%d:%.2f\n" : + "%ld %d bit ECDSA signs in %.2fs \n", + count, test_curves_bits[j], d); + ecdsa_results[j][0]=d/(double)count; + rsa_count=count; + } + + /* Perform ECDSA verification test */ + ret=ECDSA_verify(0, buf, 20, ecdsasig, + ecdsasiglen, ecdsa[j]); + if (ret != 1) + { + BIO_printf(bio_err,"ECDSA verify failure. No ECDSA verify will be done.\n"); + ERR_print_errors(bio_err); + ecdsa_doit[j] = 0; + } + else + { + pkey_print_message("verify","ecdsa", + ecdsa_c[j][1], + test_curves_bits[j], + ECDSA_SECONDS); + Time_F(START); + for (count=0,run=1; COND(ecdsa_c[j][1]); count++) { - pkey_print_message("verify","ecdsa", - ecdsa_c[j][1], - test_curves_bits[j], - ECDSA_SECONDS); - Time_F(START); - for (count=0,run=1; COND(ecdsa_c[j][1]); count++) + ret=ECDSA_verify(0, buf, 20, ecdsasig, ecdsasiglen, ecdsa[j]); + if (ret != 1) { - ret=ECDSA_verify(0, buf, 20, ecdsasig, ecdsasiglen, ecdsa[j]); - if (ret != 1) - { - BIO_printf(bio_err, "ECDSA verify failure\n"); - ERR_print_errors(bio_err); - count=1; - break; - } + BIO_printf(bio_err, "ECDSA verify failure\n"); + ERR_print_errors(bio_err); + count=1; + break; } - d=Time_F(STOP); - BIO_printf(bio_err, mr? "+R6:%ld:%d:%.2f\n" - : "%ld %d bit ECDSA verify in %.2fs\n", - count, test_curves_bits[j], d); - ecdsa_results[j][1]=d/(double)count; } + d=Time_F(STOP); + BIO_printf(bio_err, mr? "+R6:%ld:%d:%.2f\n" + : "%ld %d bit ECDSA verify in %.2fs\n", + count, test_curves_bits[j], d); + ecdsa_results[j][1]=d/(double)count; + } - if (rsa_count <= 1) - { - /* if longer than 10s, don't do any more */ - for (j++; j<EC_NUM; j++) - ecdsa_doit[j]=0; - } + if (rsa_count <= 1) + { + /* if longer than 10s, don't do any more */ + for (j++; j<EC_NUM; j++) + ecdsa_doit[j]=0; } } } @@ -2158,8 +2147,8 @@ int MAIN(int argc, char **argv) for (j=0; j<EC_NUM; j++) { if (!ecdh_doit[j]) continue; - ecdh_a[j] = EC_KEY_new(); - ecdh_b[j] = EC_KEY_new(); + ecdh_a[j] = EC_KEY_new_by_curve_name(test_curves[j]); + ecdh_b[j] = EC_KEY_new_by_curve_name(test_curves[j]); if ((ecdh_a[j] == NULL) || (ecdh_b[j] == NULL)) { BIO_printf(bio_err,"ECDH failure.\n"); @@ -2168,90 +2157,79 @@ int MAIN(int argc, char **argv) } else { - ecdh_a[j]->group = EC_GROUP_new_by_curve_name(test_curves[j]); - if (ecdh_a[j]->group == NULL) + /* generate two ECDH key pairs */ + if (!EC_KEY_generate_key(ecdh_a[j]) || + !EC_KEY_generate_key(ecdh_b[j])) { - BIO_printf(bio_err,"ECDH failure.\n"); + BIO_printf(bio_err,"ECDH key generation failure.\n"); ERR_print_errors(bio_err); - rsa_count=1; + rsa_count=1; } else { - ecdh_b[j]->group = EC_GROUP_dup(ecdh_a[j]->group); - - /* generate two ECDH key pairs */ - if (!EC_KEY_generate_key(ecdh_a[j]) || - !EC_KEY_generate_key(ecdh_b[j])) + /* If field size is not more than 24 octets, then use SHA-1 hash of result; + * otherwise, use result (see section 4.8 of draft-ietf-tls-ecc-03.txt). + */ + int field_size, outlen; + void *(*kdf)(const void *in, size_t inlen, void *out, size_t *xoutlen); + field_size = EC_GROUP_get_degree(EC_KEY_get0_group(ecdh_a[j])); + if (field_size <= 24 * 8) { - BIO_printf(bio_err,"ECDH key generation failure.\n"); - ERR_print_errors(bio_err); - rsa_count=1; + outlen = KDF1_SHA1_len; + kdf = KDF1_SHA1; } else { - /* If field size is not more than 24 octets, then use SHA-1 hash of result; - * otherwise, use result (see section 4.8 of draft-ietf-tls-ecc-03.txt). - */ - int field_size, outlen; - void *(*kdf)(const void *in, size_t inlen, void *out, size_t *xoutlen); - field_size = EC_GROUP_get_degree(ecdh_a[j]->group); - if (field_size <= 24 * 8) - { - outlen = KDF1_SHA1_len; - kdf = KDF1_SHA1; - } - else - { - outlen = (field_size+7)/8; - kdf = NULL; - } - secret_size_a = ECDH_compute_key(secret_a, outlen, - ecdh_b[j]->pub_key, - ecdh_a[j], kdf); - secret_size_b = ECDH_compute_key(secret_b, outlen, - ecdh_a[j]->pub_key, - ecdh_b[j], kdf); - if (secret_size_a != secret_size_b) - ecdh_checks = 0; - else - ecdh_checks = 1; - - for (secret_idx = 0; - (secret_idx < secret_size_a) - && (ecdh_checks == 1); - secret_idx++) - { - if (secret_a[secret_idx] != secret_b[secret_idx]) - ecdh_checks = 0; - } + outlen = (field_size+7)/8; + kdf = NULL; + } + secret_size_a = ECDH_compute_key(secret_a, outlen, + EC_KEY_get0_public_key(ecdh_b[j]), + ecdh_a[j], kdf); + secret_size_b = ECDH_compute_key(secret_b, outlen, + EC_KEY_get0_public_key(ecdh_a[j]), + ecdh_b[j], kdf); + if (secret_size_a != secret_size_b) + ecdh_checks = 0; + else + ecdh_checks = 1; - if (ecdh_checks == 0) - { - BIO_printf(bio_err,"ECDH computations don't match.\n"); - ERR_print_errors(bio_err); - rsa_count=1; - } + for (secret_idx = 0; + (secret_idx < secret_size_a) + && (ecdh_checks == 1); + secret_idx++) + { + if (secret_a[secret_idx] != secret_b[secret_idx]) + ecdh_checks = 0; + } - pkey_print_message("","ecdh", - ecdh_c[j][0], - test_curves_bits[j], - ECDH_SECONDS); - Time_F(START); - for (count=0,run=1; COND(ecdh_c[j][0]); count++) - { - ECDH_compute_key(secret_a, outlen, - ecdh_b[j]->pub_key, - ecdh_a[j], kdf); - } - d=Time_F(STOP); - BIO_printf(bio_err, mr ? "+R7:%ld:%d:%.2f\n" :"%ld %d-bit ECDH ops in %.2fs\n", - count, test_curves_bits[j], d); - ecdh_results[j][0]=d/(double)count; - rsa_count=count; + if (ecdh_checks == 0) + { + BIO_printf(bio_err,"ECDH computations don't match.\n"); + ERR_print_errors(bio_err); + rsa_count=1; } + + pkey_print_message("","ecdh", + ecdh_c[j][0], + test_curves_bits[j], + ECDH_SECONDS); + Time_F(START); + for (count=0,run=1; COND(ecdh_c[j][0]); count++) + { + ECDH_compute_key(secret_a, outlen, + EC_KEY_get0_public_key(ecdh_b[j]), + ecdh_a[j], kdf); + } + d=Time_F(STOP); + BIO_printf(bio_err, mr ? "+R7:%ld:%d:%.2f\n" :"%ld %d-bit ECDH ops in %.2fs\n", + count, test_curves_bits[j], d); + ecdh_results[j][0]=d/(double)count; + rsa_count=count; } } + if (rsa_count <= 1) { /* if longer than 10s, don't do any more */ |