diff options
31 files changed, 964 insertions, 63 deletions
diff --git a/crypto/build.info b/crypto/build.info index c064351b5a..95b6eebf3c 100644 --- a/crypto/build.info +++ b/crypto/build.info @@ -108,7 +108,7 @@ SOURCE[../libcrypto]=$UTIL_COMMON \ mem.c mem_sec.c \ cversion.c info.c cpt_err.c ebcdic.c uid.c o_time.c o_dir.c \ o_fopen.c getenv.c o_init.c init.c trace.c provider.c provider_child.c \ - punycode.c passphrase.c sleep.c + punycode.c passphrase.c sleep.c deterministic_nonce.c SOURCE[../providers/libfips.a]=$UTIL_COMMON SOURCE[../libcrypto]=$UPLINKSRC diff --git a/crypto/deterministic_nonce.c b/crypto/deterministic_nonce.c new file mode 100644 index 0000000000..cd28cce513 --- /dev/null +++ b/crypto/deterministic_nonce.c @@ -0,0 +1,195 @@ +/* + * Copyright 2022 The OpenSSL Project Authors. All Rights Reserved. + * + * Licensed under the Apache License 2.0 (the "License"). You may not use + * this file except in compliance with the License. You can obtain a copy + * in the file LICENSE in the source distribution or at + * https://www.openssl.org/source/license.html + */ + +#include <openssl/bn.h> +#include <openssl/evp.h> +#include <openssl/core_names.h> +#include <openssl/kdf.h> +#include "internal/deterministic_nonce.h" + +/* + * Convert a Bit String to an Integer (See RFC 6979 Section 2.3.2) + * + * Params: + * out The returned Integer as a BIGNUM + * qlen_bits The maximum size of the returned integer in bits. The returned + * Integer is shifted right if inlen is larger than qlen_bits.. + * in, inlen The input Bit String (in bytes). + * Returns: 1 if successful, or 0 otherwise. + */ +static int bits2int(BIGNUM *out, int qlen_bits, + const unsigned char *in, size_t inlen) +{ + int blen_bits = inlen * 8; + int shift; + + if (BN_bin2bn(in, (int)inlen, out) == NULL) + return 0; + + shift = blen_bits - qlen_bits; + if (shift > 0) + return BN_rshift(out, out, shift); + return 1; +} + +/* + * Convert an Integer to an Octet String (See RFC 6979 2.3.3). + * The value is zero padded if required. + * + * Params: + * out The returned Octet String + * num The input Integer + * rlen The required size of the returned Octet String in bytes + * Returns: 1 if successful, or 0 otherwis + */ +static int int2octets(unsigned char *out, const BIGNUM *num, int rlen) +{ + return BN_bn2binpad(num, out, rlen) >= 0; +} + +/* + * Convert a Bit String to an Octet String (See RFC 6979 Section 2.3.4) + * + * Params: + * out The returned octet string. + * q The modulus + * qlen_bits The length of q in bits + * rlen The value of qlen_bits rounded up to the nearest 8 bits. + * in, inlen The input bit string (in bytes) + * Returns: 1 if successful, or 0 otherwise. + */ +static int bits2octets(unsigned char *out, const BIGNUM *q, int qlen_bits, + int rlen, const unsigned char *in, size_t inlen) +{ + int ret = 0; + BIGNUM *z = BN_new(); + + if (z == NULL + || !bits2int(z, qlen_bits, in, inlen)) + goto err; + + /* z2 = z1 mod q (Do a simple subtract, since z1 < 2^qlen_bits) */ + if (BN_cmp(z, q) >= 0 + && !BN_usub(z, z, q)) + goto err; + + ret = int2octets(out, z, rlen); +err: + BN_free(z); + return ret; +} + +/* + * Setup a KDF HMAC_DRBG object using fixed entropy and nonce data. + * + * Params: + * digestname The digest name for the HMAC + * entropy, entropylen A fixed input entropy buffer + * nonce, noncelen A fixed input nonce buffer + * libctx, propq Are used for fetching algorithms + * + * Returns: The created KDF HMAC_DRBG object if successful, or NULL otherwise. + */ +static EVP_KDF_CTX *kdf_setup(const char *digestname, + const unsigned char *entropy, size_t entropylen, + const unsigned char *nonce, size_t noncelen, + OSSL_LIB_CTX *libctx, const char *propq) +{ + EVP_KDF_CTX *ctx = NULL; + EVP_KDF *kdf = NULL; + OSSL_PARAM params[5], *p; + + kdf = EVP_KDF_fetch(libctx, "HMAC-DRBG-KDF", propq); + ctx = EVP_KDF_CTX_new(kdf); + EVP_KDF_free(kdf); + if (ctx == NULL) + goto err; + + p = params; + *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST, + (char *)digestname, 0); + if (propq != NULL) + *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_PROPERTIES, + (char *)propq, 0); + *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_HMACDRBG_ENTROPY, + (void *)entropy, entropylen); + *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_HMACDRBG_NONCE, + (void *)nonce, noncelen); + *p = OSSL_PARAM_construct_end(); + + if (EVP_KDF_CTX_set_params(ctx, params) <= 0) + goto err; + + return ctx; +err: + EVP_KDF_CTX_free(ctx); + return NULL; +} + +/* + * Generate a Deterministic nonce 'k' for DSA/ECDSA as defined in + * RFC 6979 Section 3.3. "Alternate Description of the Generation of k" + * + * Params: + * out Returns the generated deterministic nonce 'k' + * q A large prime number used for modulus operations for DSA and ECDSA. + * priv The private key in the range [1, q-1] + * hm, hmlen The digested message buffer in bytes + * digestname The digest name used for signing. It is used as the HMAC digest. + * libctx, propq Used for fetching algorithms + * + * Returns: 1 if successful, or 0 otherwise. + */ +int ossl_gen_deterministic_nonce_rfc6979(BIGNUM *out, const BIGNUM *q, + const BIGNUM *priv, + const unsigned char *hm, size_t hmlen, + const char *digestname, + OSSL_LIB_CTX *libctx, + const char *propq) +{ + EVP_KDF_CTX *kdfctx = NULL; + int ret = 0, rlen = 0, qlen_bits = 0; + unsigned char *entropyx = NULL, *nonceh = NULL, *T = NULL; + size_t allocsz = 0; + + qlen_bits = BN_num_bits(q); + if (qlen_bits == 0) + goto end; + + /* Note rlen used here is in bytes since the input values are byte arrays */ + rlen = (qlen_bits + 7) / 8; + allocsz = 3 * rlen; + + /* Use a single alloc for the buffers T, nonceh and entropyx */ + T = (unsigned char *)OPENSSL_zalloc(allocsz); + if (T == NULL) + goto end; + nonceh = T + rlen; + entropyx = nonceh + rlen; + + if (!int2octets(entropyx, priv, rlen) + || !bits2octets(nonceh, q, qlen_bits, rlen, hm, hmlen)) + goto end; + + kdfctx = kdf_setup(digestname, entropyx, rlen, nonceh, rlen, libctx, propq); + if (kdfctx == NULL) + goto end; + + do { + if (!EVP_KDF_derive(kdfctx, T, rlen, NULL) + || !bits2int(out, qlen_bits, T, rlen)) + goto end; + } while (BN_is_zero(out) || BN_is_one(out) || BN_cmp(out, q) >= 0); + ret = 1; + +end: + EVP_KDF_CTX_free(kdfctx); + OPENSSL_clear_free(T, allocsz); + return ret; +} diff --git a/crypto/dsa/dsa_local.h b/crypto/dsa/dsa_local.h index cb7f903a04..38cb64a829 100644 --- a/crypto/dsa/dsa_local.h +++ b/crypto/dsa/dsa_local.h @@ -69,4 +69,6 @@ struct dsa_method { int (*dsa_keygen) (DSA *dsa); }; -DSA_SIG *ossl_dsa_do_sign_int(const unsigned char *dgst, int dlen, DSA *dsa); +DSA_SIG *ossl_dsa_do_sign_int(const unsigned char *dgst, int dlen, DSA *dsa, + unsigned int nonce_type, const char *digestname, + OSSL_LIB_CTX *libctx, const char *propq); diff --git a/crypto/dsa/dsa_ossl.c b/crypto/dsa/dsa_ossl.c index 86d89f4c72..888e415724 100644 --- a/crypto/dsa/dsa_ossl.c +++ b/crypto/dsa/dsa_ossl.c @@ -20,12 +20,15 @@ #include <openssl/sha.h> #include "dsa_local.h" #include <openssl/asn1.h> +#include "internal/deterministic_nonce.h" static DSA_SIG *dsa_do_sign(const unsigned char *dgst, int dlen, DSA *dsa); static int dsa_sign_setup_no_digest(DSA *dsa, BN_CTX *ctx_in, BIGNUM **kinvp, BIGNUM **rp); static int dsa_sign_setup(DSA *dsa, BN_CTX *ctx_in, BIGNUM **kinvp, - BIGNUM **rp, const unsigned char *dgst, int dlen); + BIGNUM **rp, const unsigned char *dgst, int dlen, + unsigned int nonce_type, const char *digestname, + OSSL_LIB_CTX *libctx, const char *propq); static int dsa_do_verify(const unsigned char *dgst, int dgst_len, DSA_SIG *sig, DSA *dsa); static int dsa_init(DSA *dsa); @@ -67,7 +70,9 @@ const DSA_METHOD *DSA_OpenSSL(void) return &openssl_dsa_meth; } -DSA_SIG *ossl_dsa_do_sign_int(const unsigned char *dgst, int dlen, DSA *dsa) +DSA_SIG *ossl_dsa_do_sign_int(const unsigned char *dgst, int dlen, DSA *dsa, + unsigned int nonce_type, const char *digestname, + OSSL_LIB_CTX *libctx, const char *propq) { BIGNUM *kinv = NULL; BIGNUM *m, *blind, *blindm, *tmp; @@ -106,7 +111,8 @@ DSA_SIG *ossl_dsa_do_sign_int(const unsigned char *dgst, int dlen, DSA *dsa) goto err; redo: - if (!dsa_sign_setup(dsa, ctx, &kinv, &ret->r, dgst, dlen)) + if (!dsa_sign_setup(dsa, ctx, &kinv, &ret->r, dgst, dlen, + nonce_type, digestname, libctx, propq)) goto err; if (dlen > BN_num_bytes(dsa->params.q)) @@ -185,18 +191,22 @@ DSA_SIG *ossl_dsa_do_sign_int(const unsigned char *dgst, int dlen, DSA *dsa) static DSA_SIG *dsa_do_sign(const unsigned char *dgst, int dlen, DSA *dsa) { - return ossl_dsa_do_sign_int(dgst, dlen, dsa); + return ossl_dsa_do_sign_int(dgst, dlen, dsa, + 0, NULL, NULL, NULL); } static int dsa_sign_setup_no_digest(DSA *dsa, BN_CTX *ctx_in, BIGNUM **kinvp, BIGNUM **rp) { - return dsa_sign_setup(dsa, ctx_in, kinvp, rp, NULL, 0); + return dsa_sign_setup(dsa, ctx_in, kinvp, rp, NULL, 0, + 0, NULL, NULL, NULL); } static int dsa_sign_setup(DSA *dsa, BN_CTX *ctx_in, BIGNUM **kinvp, BIGNUM **rp, - const unsigned char *dgst, int dlen) + const unsigned char *dgst, int dlen, + unsigned int nonce_type, const char *digestname, + OSSL_LIB_CTX *libctx, const char *propq) { BN_CTX *ctx = NULL; BIGNUM *k, *kinv = NULL, *r = *rp; @@ -243,13 +253,24 @@ static int dsa_sign_setup(DSA *dsa, BN_CTX *ctx_in, /* Get random k */ do { if (dgst != NULL) { - /* - * We calculate k from SHA512(private_key + H(message) + random). - * This protects the private key from a weak PRNG. - */ - if (!BN_generate_dsa_nonce(k, dsa->params.q, dsa->priv_key, dgst, - dlen, ctx)) - goto err; + if (nonce_type == 1) { +#ifndef FIPS_MODULE + if (!ossl_gen_deterministic_nonce_rfc6979(k, dsa->params.q, + dsa->priv_key, + dgst, dlen, + digestname, + libctx, propq)) +#endif + goto err; + } else { + /* + * We calculate k from SHA512(private_key + H(message) + random). + * This protects the private key from a weak PRNG. + */ + if (!BN_generate_dsa_nonce(k, dsa->params.q, dsa->priv_key, dgst, + dlen, ctx)) + goto err; + } } else if (!BN_priv_rand_range_ex(k, dsa->params.q, 0, ctx)) goto err; } while (BN_is_zero(k)); diff --git a/crypto/dsa/dsa_sign.c b/crypto/dsa/dsa_sign.c index d942fa2afe..96d103d6f2 100644 --- a/crypto/dsa/dsa_sign.c +++ b/crypto/dsa/dsa_sign.c @@ -151,7 +151,9 @@ int DSA_SIG_set0(DSA_SIG *sig, BIGNUM *r, BIGNUM *s) } int ossl_dsa_sign_int(int type, const unsigned char *dgst, int dlen, - unsigned char *sig, unsigned int *siglen, DSA *dsa) + unsigned char *sig, unsigned int *siglen, DSA *dsa, + unsigned int nonce_type, const char *digestname, + OSSL_LIB_CTX *libctx, const char *propq) { DSA_SIG *s; @@ -159,7 +161,8 @@ int ossl_dsa_sign_int(int type, const unsigned char *dgst, int dlen, if (dsa->libctx == NULL || dsa->meth != DSA_get_default_method()) s = DSA_do_sign(dgst, dlen, dsa); else - s = ossl_dsa_do_sign_int(dgst, dlen, dsa); + s = ossl_dsa_do_sign_int(dgst, dlen, dsa, + nonce_type, digestname, libctx, propq); if (s == NULL) { *siglen = 0; return 0; @@ -172,7 +175,8 @@ int ossl_dsa_sign_int(int type, const unsigned char *dgst, int dlen, int DSA_sign(int type, const unsigned char *dgst, int dlen, unsigned char *sig, unsigned int *siglen, DSA *dsa) { - return ossl_dsa_sign_int(type, dgst, dlen, sig, siglen, dsa); + return ossl_dsa_sign_int(type, dgst, dlen, sig, siglen, dsa, + 0, NULL, NULL, NULL); } /* data has already been hashed (probably with SHA or SHA-1). */ diff --git a/crypto/ec/ecdsa_ossl.c b/crypto/ec/ecdsa_ossl.c index 96dab38adf..30e130dbba 100644 --- a/crypto/ec/ecdsa_ossl.c +++ b/crypto/ec/ecdsa_ossl.c @@ -19,6 +19,13 @@ #include <openssl/rand.h> #include "crypto/bn.h" #include "ec_local.h" +#include "internal/deterministic_nonce.h" + +static int ecdsa_sign_setup(EC_KEY *eckey, BN_CTX *ctx_in, + BIGNUM **kinvp, BIGNUM **rp, + const unsigned char *dgst, int dlen, + unsigned int nonce_type, const char *digestname, + OSSL_LIB_CTX *libctx, const char *propq); int ossl_ecdsa_sign_setup(EC_KEY *eckey, BN_CTX *ctx_in, BIGNUM **kinvp, BIGNUM **rp) @@ -71,9 +78,39 @@ int ossl_ecdsa_sign(int type, const unsigned char *dgst, int dlen, return 1; } +int ossl_ecdsa_deterministic_sign(const unsigned char *dgst, int dlen, + unsigned char *sig, unsigned int *siglen, + EC_KEY *eckey, unsigned int nonce_type, + const char *digestname, + OSSL_LIB_CTX *libctx, const char *propq) +{ + ECDSA_SIG *s; + BIGNUM *kinv = NULL, *r = NULL; + int ret = 0; + + *siglen = 0; + if (!ecdsa_sign_setup(eckey, NULL, &kinv, &r, dgst, dlen, + nonce_type, digestname, libctx, propq)) + return 0; + + s = ECDSA_do_sign_ex(dgst, dlen, kinv, r, eckey); + if (s == NULL) + goto end; + + *siglen = i2d_ECDSA_SIG(s, &sig); + ECDSA_SIG_free(s); + ret = 1; +end: + BN_clear_free(kinv); + BN_clear_free(r); + return ret; +} + static int ecdsa_sign_setup(EC_KEY *eckey, BN_CTX *ctx_in, BIGNUM **kinvp, BIGNUM **rp, - const unsigned char *dgst, int dlen) + const unsigned char *dgst, int dlen, + unsigned int nonce_type, const char *digestname, + OSSL_LIB_CTX *libctx, const char *propq) { BN_CTX *ctx = NULL; BIGNUM *k = NULL, *r = NULL, *X = NULL; @@ -126,19 +163,29 @@ static int ecdsa_sign_setup(EC_KEY *eckey, BN_CTX *ctx_in, goto err; do { - /* get random k */ + /* get random or determinstic value of k */ do { + int res = 0; + if (dgst != NULL) { - if (!BN_generate_dsa_nonce(k, order, priv_key, - dgst, dlen, ctx)) { - ERR_raise(ERR_LIB_EC, EC_R_RANDOM_NUMBER_GENERATION_FAILED); - goto err; + if (nonce_type == 1) { +#ifndef FIPS_MODULE + res = ossl_gen_deterministic_nonce_rfc6979(k, order, + priv_key, + dgst, dlen, + digestname, + libctx, propq); +#endif + } else { + res = BN_generate_dsa_nonce(k, order, priv_key, dgst, dlen, + ctx); } } else { - if (!BN_priv_rand_range_ex(k, order, 0, ctx)) { - ERR_raise(ERR_LIB_EC, EC_R_RANDOM_NUMBER_GENERATION_FAILED); - goto err; - } + res = BN_priv_rand_range_ex(k, order, 0, ctx); + } + if (!res) { + ERR_raise(ERR_LIB_EC, EC_R_RANDOM_NUMBER_GENERATION_FAILED); + goto err; } } while (BN_is_zero(k)); @@ -187,7 +234,8 @@ static int ecdsa_sign_setup(EC_KEY *eckey, BN_CTX *ctx_in, int ossl_ecdsa_simple_sign_setup(EC_KEY *eckey, BN_CTX *ctx_in, BIGNUM **kinvp, BIGNUM **rp) { - return ecdsa_sign_setup(eckey, ctx_in, kinvp, rp, NULL, 0); + return ecdsa_sign_setup(eckey, ctx_in, kinvp, rp, NULL, 0, + 0, NULL, NULL, NULL); } ECDSA_SIG *ossl_ecdsa_simple_sign_sig(const unsigned char *dgst, int dgst_len, @@ -256,7 +304,8 @@ ECDSA_SIG *ossl_ecdsa_simple_sign_sig(const unsigned char *dgst, int dgst_len, } do { if (in_kinv == NULL || in_r == NULL) { - if (!ecdsa_sign_setup(eckey, ctx, &kinv, &ret->r, dgst, dgst_len)) { + if (!ecdsa_sign_setup(eckey, ctx, &kinv, &ret->r, dgst, dgst_len, + 0, NULL, NULL, NULL)) { ERR_raise(ERR_LIB_EC, ERR_R_ECDSA_LIB); goto err; } diff --git a/doc/build.info b/doc/build.info index c18438d7cf..7d3b2fe774 100644 --- a/doc/build.info +++ b/doc/build.info @@ -4193,6 +4193,10 @@ DEPEND[html/man7/EVP_KDF-HKDF.html]=man7/EVP_KDF-HKDF.pod GENERATE[html/man7/EVP_KDF-HKDF.html]=man7/EVP_KDF-HKDF.pod DEPEND[man/man7/EVP_KDF-HKDF.7]=man7/EVP_KDF-HKDF.pod GENERATE[man/man7/EVP_KDF-HKDF.7]=man7/EVP_KDF-HKDF.pod +DEPEND[html/man7/EVP_KDF-HMAC-DRBG.html]=man7/EVP_KDF-HMAC-DRBG.pod +GENERATE[html/man7/EVP_KDF-HMAC-DRBG.html]=man7/EVP_KDF-HMAC-DRBG.pod +DEPEND[man/man7/EVP_KDF-HMAC-DRBG.7]=man7/EVP_KDF-HMAC-DRBG.pod +GENERATE[man/man7/EVP_KDF-HMAC-DRBG.7]=man7/EVP_KDF-HMAC-DRBG.pod DEPEND[html/man7/EVP_KDF-KB.html]=man7/EVP_KDF-KB.pod GENERATE[html/man7/EVP_KDF-KB.html]=man7/EVP_KDF-KB.pod DEPEND[man/man7/EVP_KDF-KB.7]=man7/EVP_KDF-KB.pod @@ -4665,6 +4669,7 @@ html/man7/EVP_CIPHER-RC5.html \ html/man7/EVP_CIPHER-SEED.html \ html/man7/EVP_CIPHER-SM4.html \ html/man7/EVP_KDF-HKDF.html \ +html/man7/EVP_KDF-HMAC-DRBG.html \ html/man7/EVP_KDF-KB.html \ html/man7/EVP_KDF-KRB5KDF.html \ html/man7/EVP_KDF-PBKDF1.html \ @@ -4793,6 +4798,7 @@ man/man7/EVP_CIPHER-RC5.7 \ man/man7/EVP_CIPHER-SEED.7 \ man/man7/EVP_CIPHER-SM4.7 \ man/man7/EVP_KDF-HKDF.7 \ +man/man7/EVP_KDF-HMAC-DRBG.7 \ man/man7/EVP_KDF-KB.7 \ man/man7/EVP_KDF-KRB5KDF.7 \ man/man7/EVP_KDF-PBKDF1.7 \ diff --git a/doc/man7/EVP_KDF-HMAC-DRBG.pod b/doc/man7/EVP_KDF-HMAC-DRBG.pod new file mode 100644 index 0000000000..eb240da333 --- /dev/null +++ b/doc/man7/EVP_KDF-HMAC-DRBG.pod @@ -0,0 +1,71 @@ +=pod + +=head1 NAME + +EVP_KDF-HMAC-DRBG +- The HMAC DRBG DETERMINISTIC EVP_KDF implementation + +=head1 DESCRIPTION + +Support for a deterministic HMAC DRBG using the B<EVP_KDF> API. This is similiar +to L<EVP_RAND-HMAC-DRBG(7)>, but uses fixed values for its entropy and nonce +values. This is used to generate deterministic nonce value required by ECDSA +and DSA (as defined in RFC 6979). + +=head2 Identity + +"HMAC-DRBG-KDF" is the name for this implementation; it can be used +with the EVP_KDF_fetch() function. + +=head2 Supported parameters + +The supported parameters are: + +=over 4 + +=item "digest" (B<OSSL_DRBG_PARAM_DIGEST>) <UTF8 string> + +=item "properties" (B<OSSL_DRBG_PARAM_PROPERTIES>) <UTF8 string> + +These parameters work as described in L<EVP_KDF(3)/PARAMETERS>. + +=item "entropy" (B<OSSL_KDF_PARAM_HMACDRBG_ENTROPY>) <octet string> + +Sets the entropy bytes supplied to the HMAC-DRBG. + +=item "nonce" (B<OSSL_KDF_PARAM_HMACDRBG_NONCE>) <octet string> + +Sets the nonce bytes supplied to the HMAC-DRBG. + +=back + +=head1 NOTES + +A context for KDF HMAC DRBG can be obtained by calling: + + EVP_KDF *kdf = EVP_KDF_fetch(NULL, "HMAC-DRBG-KDF", NULL); + EVP_KDF_CTX *kdf_ctx = EVP_KDF_CTX_new(kdf, NULL); + +=head1 CONFORMING TO + +RFC 6979 + +=head1 SEE ALSO + +L<EVP_KDF(3)>, +L<EVP_KDF(3)/PARAMETERS> + +=head1 HISTORY + +The EVP_KDF-HMAC-DRBG functionality was added in OpenSSL 3.2. + +=head1 COPYRIGHT + +Copyright 2022 The OpenSSL Project Authors. All Rights Reserved. + +Licensed under the Apache License 2.0 (the "License"). You may not use +this file except in compliance with the License. You can obtain a copy +in the file LICENSE in the source distribution or at +L<https://www.openssl.org/source/license.html>. + +=cut diff --git a/doc/man7/EVP_RAND-HMAC-DRBG.pod b/doc/man7/EVP_RAND-HMAC-DRBG.pod index 54ae61478d..ae3a51dbd7 100644 --- a/doc/man7/EVP_RAND-HMAC-DRBG.pod +++ b/doc/man7/EVP_RAND-HMAC-DRBG.pod @@ -59,7 +59,7 @@ These parameters work as described in L<EVP_RAND(3)/PARAMETERS>. A context for HMAC DRBG can be obtained by calling: EVP_RAND *rand = EVP_RAND_fetch(NULL, "HMAC-DRBG", NULL); - EVP_RAND_CTX *rctx = EVP_RAND_CTX_new(rand); + EVP_RAND_CTX *rctx = EVP_RAND_CTX_new(rand, NULL); =head1 EXAMPLES diff --git a/doc/man7/EVP_SIGNATURE-DSA.pod b/doc/man7/EVP_SIGNATURE-DSA.pod index 4801cf9994..7eeb234f75 100644 --- a/doc/man7/EVP_SIGNATURE-DSA.pod +++ b/doc/man7/EVP_SIGNATURE-DSA.pod @@ -22,6 +22,8 @@ and before calling EVP_PKEY_sign() or EVP_PKEY_verify(). =item "properties" (B<OSSL_SIGNATURE_PARAM_PROPERTIES>) <UTF8 string> +=item "nonce-type" (B<OSSL_SIGNATURE_PARAM_NONCE_TYPE>) <unsigned integer> + The settable parameters are described in L<provider-signature(7)>. =back diff --git a/doc/man7/EVP_SIGNATURE-ECDSA.pod b/doc/man7/EVP_SIGNATURE-ECDSA.pod index 0ac3f78461..b1757f2630 100644 --- a/doc/man7/EVP_SIGNATURE-ECDSA.pod +++ b/doc/man7/EVP_SIGNATURE-ECDSA.pod @@ -21,6 +21,8 @@ and before calling EVP_PKEY_sign() or EVP_PKEY_verify(). =item "properties" (B<OSSL_SIGNATURE_PARAM_PROPERTIES>) <UTF8 string> +=item "nonce-type" (B<OSSL_SIGNATURE_PARAM_NONCE_TYPE>) <unsigned integer> + These parameters are described in L<provider-signature(7)>. =back diff --git a/doc/man7/OSSL_PROVIDER-default.pod b/doc/man7/OSSL_PROVIDER-default.pod index 35ca0f8ccb..9724b0ab23 100644 --- a/doc/man7/OSSL_PROVIDER-default.pod +++ b/doc/man7/OSSL_PROVIDER-default.pod @@ -145,6 +145,7 @@ The OpenSSL default provider supports these operations and algorithms: =item KRB5KDF, see L<EVP_KDF-KRB5KDF(7)> +=item HMAC-DRBG, see L<EVP_KDF-HMAC-DRBG(7)> =back diff --git a/doc/man7/provider-signature.pod b/doc/man7/provider-signature.pod index 7c35037316..d77979cd8e 100644 --- a/doc/man7/provider-signature.pod +++ b/doc/man7/provider-signature.pod @@ -363,6 +363,15 @@ The length of the "digest-size" parameter should not exceed that of a B<size_t>. Gets the DER encoded AlgorithmIdentifier that corresponds to the combination of signature algorithm and digest algorithm for the signature operation. +=item "nonce-type" (B<OSSL_SIGNATURE_PARAM_NONCE_TYPE>) <unsigned integer> + +Set this to 1 to use a deterministic ECDSA or DSA digital signature as +defined in RFC #6979 (See Section 3.2 "Generation of k"). +The default value of 0 uses a random value for the nonce B<k> as defined in +FIPS 186-4 Section 6.3 "Secret Number Generation". +Before using deterministic digital signature please read +RFC #6979 Section 4 "Security Considerations". + =item "kat" (B<OSSL_SIGNATURE_PARAM_KAT>) <unsigned integer> Sets a flag to modify the sign operation to return an error if the initial diff --git a/include/crypto/dsa.h b/include/crypto/dsa.h index 260c30fa4b..85d92a18cb 100644 --- a/include/crypto/dsa.h +++ b/include/crypto/dsa.h @@ -26,7 +26,9 @@ int ossl_dsa_generate_ffc_parameters(DSA *dsa, int type, int pbits, int qbits, BN_GENCB *cb); int ossl_dsa_sign_int(int type, const unsigned char *dgst, int dlen, - unsigned char *sig, unsigned int *siglen, DSA *dsa); + unsigned char *sig, unsigned int *siglen, DSA *dsa, + unsigned int nonce_type, const char *digestname, + OSSL_LIB_CTX *libctx, const char *propq); FFC_PARAMS *ossl_dsa_get0_params(DSA *dsa); int ossl_dsa_ffc_params_fromdata(DSA *dsa, const OSSL_PARAM params[]); diff --git a/include/crypto/ec.h b/include/crypto/ec.h index bb3cb0f979..da85a7bd88 100644 --- a/include/crypto/ec.h +++ b/include/crypto/ec.h @@ -97,5 +97,10 @@ char *ossl_ec_check_group_type_id2name(int flags); int ossl_ec_set_check_group_type_from_name(EC_KEY *ec, const char *name); int ossl_ec_generate_key_dhkem(EC_KEY *eckey, const unsigned char *ikm, size_t ikmlen); +int ossl_ecdsa_deterministic_sign(const unsigned char *dgst, int dlen, + unsigned char *sig, unsigned int *siglen, + EC_KEY *eckey, unsigned int nonce_type, + const char *digestname, + OSSL_LIB_CTX *libctx, const char *propq); # endif /* OPENSSL_NO_EC */ #endif diff --git a/include/internal/deterministic_nonce.h b/include/internal/deterministic_nonce.h new file mode 100644 index 0000000000..5f0313fe38 --- /dev/null +++ b/include/internal/deterministic_nonce.h @@ -0,0 +1,24 @@ +/* + * Copyright 2022 The OpenSSL Project Authors. All Rights Reserved. + * + * Licensed under the Apache License 2.0 (the "License"). You may not use + * this file except in compliance with the License. You can obtain a copy + * in the file LICENSE in the source distribution or at + * https://www.openssl.org/source/l |