Add minified HMAC_DRBG for deterministic ECDSA

include/polarssl/config.h

@@ -278,6 +278,18 @@
  */
 #define POLARSSL_ECP_NIST_OPTIM
 
+/**
+ * \def POLARSSL_ECDSA_DETERMINISTIC
+ *
+ * Enable deterministic ECDSA (RFC 6979).
+ * Standard ECDSA is "fragile" in the sense that lack of entropy when signing
+ * may result in a compromise of the long-term signing key. This is avoided by
+ * the deterministic variant.
+ *
+ * Comment this macro to disable deterministic ECDSA.
+ */
+#define POLARSSL_ECDSA_DETERMINISTIC
+
 /**
  * \def POLARSSL_KEY_EXCHANGE_PSK_ENABLED
  *

library/ecdsa.c

@@ -36,6 +36,125 @@
 #include "polarssl/ecdsa.h"
 #include "polarssl/asn1write.h"
 
+#if defined(POLARSSL_ECDSA_DETERMINISTIC)
+#include "polarssl/md.h"
+#endif
+
+/*
+ * If using deterministic ECDSA (RFC 6979), we need HMAC_DRBG.
+ * Actually a simplified version is enough, so we implement it below.
+ */
+#if defined(POLARSSL_ECDSA_DETERMINISTIC)
+/*
+ * Simplified HMAC_DRBG context.
+ * No reseed counter, no prediction resistance flag.
+ */
+typedef struct
+{
+    md_context_t md_ctx;
+    unsigned char V[POLARSSL_MD_MAX_SIZE];
+    unsigned char K[POLARSSL_MD_MAX_SIZE];
+} hmac_drbg_context;
+
+/*
+ * Simplified HMAC_DRBG initialisation.
+ *
+ * Uses an entropy buffer rather than callback,
+ * assumes personalisation is not null,
+ * assumes md_info is not NULL and valid.
+ */
+static int hmac_drbg_init( hmac_drbg_context *ctx,
+                           const md_info_t * md_info,
+                           const unsigned char *entropy, size_t entropy_len,
+                           const unsigned char *pers, size_t pers_len )
+{
+    unsigned char sep[1];
+    size_t md_len = md_info->size;
+
+    memset( ctx, 0, sizeof( hmac_drbg_context ) );
+    md_init_ctx( &ctx->md_ctx, md_info );
+
+    memset( ctx->V, 0x01, md_len );
+    /* ctx->K is already 0 */
+
+    sep[0] = 0x00;
+    md_hmac_starts( &ctx->md_ctx, ctx->K, md_len );
+    md_hmac_update( &ctx->md_ctx, ctx->V, md_len );
+    md_hmac_update( &ctx->md_ctx, sep, 1 );
+    md_hmac_update( &ctx->md_ctx, entropy, entropy_len );
+    md_hmac_update( &ctx->md_ctx, pers, pers_len );
+    md_hmac_finish( &ctx->md_ctx, ctx->K );
+
+    /* Step e */
+    md_hmac_starts( &ctx->md_ctx, ctx->K, md_len );
+    md_hmac_update( &ctx->md_ctx, ctx->V, md_len );
+    md_hmac_finish( &ctx->md_ctx, ctx->V );
+
+    /* Step f */
+    sep[0] = 0x01;
+    md_hmac_starts( &ctx->md_ctx, ctx->K, md_len );
+    md_hmac_update( &ctx->md_ctx, ctx->V, md_len );
+    md_hmac_update( &ctx->md_ctx, sep, 1 );
+    md_hmac_update( &ctx->md_ctx, entropy, entropy_len );
+    md_hmac_update( &ctx->md_ctx, pers, pers_len );
+    md_hmac_finish( &ctx->md_ctx, ctx->K );
+
+    /* Step g */
+    md_hmac_starts( &ctx->md_ctx, ctx->K, md_len );
+    md_hmac_update( &ctx->md_ctx, ctx->V, md_len );
+    md_hmac_finish( &ctx->md_ctx, ctx->V );
+
+    return( 0 );
+}
+
+/*
+ * Simplified HMAC_DRBG random function
+ */
+static int hmac_drbg_random( void *state,
+                             unsigned char *output, size_t out_len )
+{
+    hmac_drbg_context *ctx = (hmac_drbg_context *) state;
+    unsigned char sep[1] = { 0 };
+    size_t md_len = ctx->md_ctx.md_info->size;
+    size_t left = out_len;
+    unsigned char *out = output;
+
+    while( left != 0 )
+    {
+        size_t use_len = left > md_len ? md_len : left;
+
+        md_hmac_starts( &ctx->md_ctx, ctx->K, md_len );
+        md_hmac_update( &ctx->md_ctx, ctx->V, md_len );
+        md_hmac_finish( &ctx->md_ctx, ctx->V );
+
+        memcpy( out, ctx->V, use_len );
+        out += use_len;
+        left -= use_len;
+    }
+
+    md_hmac_starts( &ctx->md_ctx, ctx->K, md_len );
+    md_hmac_update( &ctx->md_ctx, ctx->V, md_len );
+    md_hmac_update( &ctx->md_ctx, sep, 1 );
+    md_hmac_finish( &ctx->md_ctx, ctx->K );
+
+    md_hmac_starts( &ctx->md_ctx, ctx->K, md_len );
+    md_hmac_update( &ctx->md_ctx, ctx->V, md_len );
+    md_hmac_finish( &ctx->md_ctx, ctx->V );
+
+    return( 0 );
+}
+
+static void hmac_drbg_free( hmac_drbg_context *ctx )
+{
+    if( ctx == NULL )
+        return;
+
+    md_free_ctx( &ctx->md_ctx );
+
+    memset( ctx, 0, sizeof( hmac_drbg_context ) );
+}
+#endif
+
 /*
  * Derive a suitable integer for group grp from a buffer of length len
  * SEC1 4.1.3 step 5 aka SEC1 4.1.4 step 3
@@ -51,6 +170,10 @@ static int derive_mpi( const ecp_group *grp, mpi *x,
     if( use_size * 8 > grp->nbits )
         MPI_CHK( mpi_shift_r( x, use_size * 8 - grp->nbits ) );
 
+    /* While at it, reduce modulo N */
+    if( mpi_cmp_mpi( x, &grp->N ) >= 0 )
+        MPI_CHK( mpi_sub_mpi( x, x, &grp->N ) );
+
 cleanup:
     return( ret );
 }