Mercurial > dropbear
view libtommath/bn_mp_kronecker.c @ 1855:35d504d59c05
Implement server-side support for sk-ecdsa U2F-backed keys (#142)
* Implement server-side support for sk-ecdsa U2F-backed keys
* Fix out-of-bounds read on normal ecdsa-sha2-[identifier] keys
* Fix one more potential out-of-bounds read
* Check if nistp256 curve is used in sk-ecdsa-sha2- key
It's the only allowed curve per PROTOCOL.u2f specification
* Implement server-side support for sk-ed25519 FIDO2-backed keys
* Keys with type sk-* make no sense as host keys, so they should be
disabled
* fix typo
* Make sk-ecdsa call buf_ecdsa_verify
This reduces code duplication, the SK code just handles the
different message format.
* Reduce sk specific code
The application id can be stored in signkey, then we don't need
to call sk-specific functions from svr-authpubkey
* Remove debugging output, which causes compilation errors with DEBUG_TRACE disabled
* Proper cleanup of sk_app
Co-authored-by: Matt Johnston <[email protected]>
author | egor-duda <egor-duda@users.noreply.github.com> |
---|---|
date | Sat, 22 Jan 2022 16:53:04 +0300 |
parents | 1051e4eea25a |
children |
line wrap: on
line source
#include "tommath_private.h" #ifdef BN_MP_KRONECKER_C /* LibTomMath, multiple-precision integer library -- Tom St Denis */ /* SPDX-License-Identifier: Unlicense */ /* Kronecker symbol (a|p) Straightforward implementation of algorithm 1.4.10 in Henri Cohen: "A Course in Computational Algebraic Number Theory" @book{cohen2013course, title={A course in computational algebraic number theory}, author={Cohen, Henri}, volume={138}, year={2013}, publisher={Springer Science \& Business Media} } */ mp_err mp_kronecker(const mp_int *a, const mp_int *p, int *c) { mp_int a1, p1, r; mp_err err; int v, k; static const int table[8] = {0, 1, 0, -1, 0, -1, 0, 1}; if (MP_IS_ZERO(p)) { if ((a->used == 1) && (a->dp[0] == 1u)) { *c = 1; } else { *c = 0; } return MP_OKAY; } if (MP_IS_EVEN(a) && MP_IS_EVEN(p)) { *c = 0; return MP_OKAY; } if ((err = mp_init_copy(&a1, a)) != MP_OKAY) { return err; } if ((err = mp_init_copy(&p1, p)) != MP_OKAY) { goto LBL_KRON_0; } v = mp_cnt_lsb(&p1); if ((err = mp_div_2d(&p1, v, &p1, NULL)) != MP_OKAY) { goto LBL_KRON_1; } if ((v & 1) == 0) { k = 1; } else { k = table[a->dp[0] & 7u]; } if (p1.sign == MP_NEG) { p1.sign = MP_ZPOS; if (a1.sign == MP_NEG) { k = -k; } } if ((err = mp_init(&r)) != MP_OKAY) { goto LBL_KRON_1; } for (;;) { if (MP_IS_ZERO(&a1)) { if (mp_cmp_d(&p1, 1uL) == MP_EQ) { *c = k; goto LBL_KRON; } else { *c = 0; goto LBL_KRON; } } v = mp_cnt_lsb(&a1); if ((err = mp_div_2d(&a1, v, &a1, NULL)) != MP_OKAY) { goto LBL_KRON; } if ((v & 1) == 1) { k = k * table[p1.dp[0] & 7u]; } if (a1.sign == MP_NEG) { /* * Compute k = (-1)^((a1)*(p1-1)/4) * k * a1.dp[0] + 1 cannot overflow because the MSB * of the type mp_digit is not set by definition */ if (((a1.dp[0] + 1u) & p1.dp[0] & 2u) != 0u) { k = -k; } } else { /* compute k = (-1)^((a1-1)*(p1-1)/4) * k */ if ((a1.dp[0] & p1.dp[0] & 2u) != 0u) { k = -k; } } if ((err = mp_copy(&a1, &r)) != MP_OKAY) { goto LBL_KRON; } r.sign = MP_ZPOS; if ((err = mp_mod(&p1, &r, &a1)) != MP_OKAY) { goto LBL_KRON; } if ((err = mp_copy(&r, &p1)) != MP_OKAY) { goto LBL_KRON; } } LBL_KRON: mp_clear(&r); LBL_KRON_1: mp_clear(&p1); LBL_KRON_0: mp_clear(&a1); return err; } #endif