byteRep.c
1 /* Copyright (c) 1998,2011,2014 Apple Inc. All Rights Reserved. 2 * 3 * NOTICE: USE OF THE MATERIALS ACCOMPANYING THIS NOTICE IS SUBJECT 4 * TO THE TERMS OF THE SIGNED "FAST ELLIPTIC ENCRYPTION (FEE) REFERENCE 5 * SOURCE CODE EVALUATION AGREEMENT" BETWEEN APPLE, INC. AND THE 6 * ORIGINAL LICENSEE THAT OBTAINED THESE MATERIALS FROM APPLE, 7 * INC. ANY USE OF THESE MATERIALS NOT PERMITTED BY SUCH AGREEMENT WILL 8 * EXPOSE YOU TO LIABILITY. 9 *************************************************************************** 10 * 11 * byteRep.c - FEE portable byte representation support 12 * 13 * Revision History 14 * ---------------- 15 * 10/06/98 ap 16 * Changed to compile with C++. 17 * 18 Apr 98 at Apple 18 * Mods for variable size giantDigit. 19 * 20 Jan 98 at Apple 20 * Added curve param fields for CURVE_PARAM_VERSION 2. 21 * 17 Jul 97 at Apple 22 * Added signature routines. 23 * 9 Jan 97 at NeXT 24 * Split off from utilities.c 25 */ 26 27 #include "byteRep.h" 28 #include "feeTypes.h" 29 #include "curveParams.h" 30 #include "giantIntegers.h" 31 #include "elliptic.h" 32 #include "falloc.h" 33 #include "ckutilities.h" 34 #include "feeDebug.h" 35 #include <stdlib.h> 36 37 #ifndef NULL 38 #define NULL ((void *)0) 39 #endif /* NULL */ 40 41 /* 42 * Support for portable bytestream representation of keys and signatures. 43 * Platform and endianness independent; format shared with JavaFEE 44 * implementation. 45 */ 46 47 /* 48 * Some handy macros. 49 */ 50 #define ENC_BYTE(n, b, bytes) \ 51 *b++ = n; \ 52 bytes++; 53 54 #define ENC_INT(n, b, bytes, i) \ 55 i = intToByteRep(n, b); \ 56 bytes += i; \ 57 b += i; 58 59 #define ENC_GIANT(g, b, bytes, i) \ 60 i = giantToByteRep(g, b); \ 61 bytes += i; \ 62 b += i; 63 64 #define DEC_BYTE(n, b, blen, bytes) \ 65 n = *b++; \ 66 bytes++; \ 67 blen--; 68 69 #define DEC_INT(n, b, blen, bytes) \ 70 n = byteRepToInt(b); \ 71 b += sizeof(int); \ 72 bytes += sizeof(int); \ 73 blen -= gLen; 74 75 #define DEC_GIANT(g, b, blen, glen, bytes, out) \ 76 g = byteRepToGiant(b, blen, &glen); \ 77 if(g == NULL) { \ 78 goto out; \ 79 } \ 80 b += glen; \ 81 bytes += glen; \ 82 blen -= gLen; 83 84 85 86 87 /* 88 * The routines which convert various types to byte reps return the number 89 * of bytes written to the output stream. 90 */ 91 int intToByteRep(int i, unsigned char *buf) 92 { 93 *buf++ = (unsigned char)((i >> 24) & 0xff); 94 *buf++ = (unsigned char)((i >> 16) & 0xff); 95 *buf++ = (unsigned char)((i >> 8) & 0xff); 96 *buf = (unsigned char)(i & 0xff); 97 return 4; 98 } 99 100 int shortToByteRep(short s, unsigned char *buf) 101 { 102 *buf++ = (unsigned char)((s >> 8) & 0xff); 103 *buf = (unsigned char)(s & 0xff); 104 return 2; 105 } 106 107 /* 108 * 7 Apr 1998 : leading int is now the number of bytes in the giant's 109 * giantDigits array. This value is signed. 110 */ 111 int giantToByteRep(giant g, unsigned char *buf) 112 { 113 int numBytes = g->sign * GIANT_BYTES_PER_DIGIT; 114 unsigned aNumBytes = abs(numBytes); 115 116 CKASSERT(g != NULL); 117 intToByteRep(numBytes, buf); 118 buf += sizeof(int); 119 serializeGiant(g, buf, aNumBytes); 120 return (sizeof(int) + aNumBytes); 121 } 122 123 int keyToByteRep(key k, unsigned char *buf) 124 { 125 int numBytes = 0; 126 int i; 127 128 CKASSERT(k != NULL); 129 ENC_GIANT(k->x, buf, numBytes, i); 130 131 /* only write y for plus curve */ 132 if(k->twist == CURVE_PLUS) { 133 CKASSERT(k->y != NULL); 134 ENC_GIANT(k->y, buf, numBytes, i); 135 } 136 return numBytes; 137 } 138 139 #define CURVE_PARAM_VERSION 3 140 #define CURVE_PARAM_VERSION_MIN 3 141 142 int curveParamsToByteRep(curveParams *cp, unsigned char *buf) 143 { 144 int numBytes = 0; 145 int i; 146 147 CKASSERT(cp != NULL); 148 ENC_INT(CURVE_PARAM_VERSION, buf, numBytes, i); 149 ENC_INT(CURVE_PARAM_VERSION_MIN, buf, numBytes, i); 150 ENC_BYTE(cp->primeType, buf, numBytes); 151 ENC_BYTE(cp->curveType, buf, numBytes); 152 ENC_INT(cp->q, buf, numBytes, i); 153 ENC_INT(cp->k, buf, numBytes, i); 154 ENC_INT(cp->m, buf, numBytes, i); 155 ENC_INT(0, buf, numBytes, i); // spare 156 157 ENC_GIANT(cp->a, buf, numBytes, i); 158 ENC_GIANT(cp->b, buf, numBytes, i); 159 ENC_GIANT(cp->c, buf, numBytes, i); 160 ENC_GIANT(cp->x1Plus, buf, numBytes, i); 161 ENC_GIANT(cp->x1Minus, buf, numBytes, i); 162 ENC_GIANT(cp->cOrderPlus, buf, numBytes, i); 163 ENC_GIANT(cp->cOrderMinus, buf, numBytes, i); 164 ENC_GIANT(cp->x1OrderPlus, buf, numBytes, i); 165 ENC_GIANT(cp->x1OrderMinus, buf, numBytes, i); 166 if(cp->primeType == FPT_General) { 167 ENC_GIANT(cp->basePrime, buf, numBytes, i); 168 } 169 return numBytes; 170 } 171 172 int sigToByteRep(int magic, 173 int version, 174 int minVersion, 175 giant g0, 176 giant g1, 177 unsigned char *buf) 178 { 179 int numBytes = 0; 180 int i; 181 182 ENC_INT(magic, buf, numBytes, i); 183 ENC_INT(version, buf, numBytes, i); 184 ENC_INT(minVersion, buf, numBytes, i); 185 ENC_INT(0, buf, numBytes, i); // spare 186 ENC_GIANT(g0, buf, numBytes, i); 187 ENC_GIANT(g1, buf, numBytes, i); 188 189 return numBytes; 190 } 191 192 193 /* 194 * return the size of various data types' byte representations. 195 */ 196 int lengthOfByteRepGiant(giant g) 197 { 198 CKASSERT(g != NULL); 199 return sizeof(int) + (GIANT_BYTES_PER_DIGIT * abs(g->sign)); 200 } 201 202 int lengthOfByteRepKey(key k) 203 { 204 int len = lengthOfByteRepGiant(k->x); 205 206 CKASSERT(k != NULL); 207 if(k->twist == CURVE_PLUS) { 208 CKASSERT(k->y != NULL); 209 len += lengthOfByteRepGiant(k->y); 210 } 211 return len; 212 } 213 214 int lengthOfByteRepCurveParams(curveParams *cp) 215 { 216 int length; 217 218 CKASSERT(cp != NULL); 219 length = (6 * sizeof(int)) + // ver, minVers, q, k, m, spare 220 2 + // primeType + curveType 221 lengthOfByteRepGiant(cp->a) + 222 lengthOfByteRepGiant(cp->b) + 223 lengthOfByteRepGiant(cp->c) + 224 lengthOfByteRepGiant(cp->x1Plus) + 225 lengthOfByteRepGiant(cp->x1Minus) + 226 lengthOfByteRepGiant(cp->cOrderPlus) + 227 lengthOfByteRepGiant(cp->cOrderMinus) + 228 lengthOfByteRepGiant(cp->x1OrderPlus) + 229 lengthOfByteRepGiant(cp->x1OrderMinus); 230 if(cp->primeType == FPT_General) { 231 length += lengthOfByteRepGiant(cp->basePrime); 232 } 233 return length; 234 } 235 236 int lengthOfByteRepSig(giant g0, 237 giant g1) 238 { 239 int length = (4 * sizeof(int)) + // magic, version, minVersion, 240 // spare 241 lengthOfByteRepGiant(g0) + 242 lengthOfByteRepGiant(g1); 243 return length; 244 } 245 246 /* 247 * Routine to cons up various types from a byte rep stream. 248 */ 249 int byteRepToInt(const unsigned char *buf) { 250 int result; 251 252 result = (((int)buf[0] << 24) & 0xff000000) | 253 (((int)buf[1] << 16) & 0x00ff0000) | 254 (((int)buf[2] << 8) & 0xff00) | 255 (((int)buf[3]) & 0xff); 256 return result; 257 } 258 259 unsigned short byteRepToShort(const unsigned char *buf) { 260 unsigned short result; 261 262 result = (((unsigned short)buf[0] << 8) & 0xff00) | 263 (((unsigned short)buf[1]) & 0xff); 264 return result; 265 } 266 267 /* 268 * Probably need byteRepToShortArray... 269 */ 270 271 /* 272 * byte rep stream to giant. Returns NULL on error; returns number of bytes 273 * of *buf snarfed in *giantLen if successful. 274 * 275 * 7 Apr 1998 : leading int is now the number of bytes in the giant's 276 * giantDigits array. This value is signed. 277 */ 278 giant byteRepToGiant(const unsigned char *buf, 279 unsigned bufLen, 280 unsigned *giantLen) 281 { 282 giant g; 283 int numDigits; 284 int numBytes; // signed! 285 unsigned aNumBytes; 286 287 if(bufLen < sizeof(int)) { 288 return (giant)NULL; 289 } 290 numBytes = byteRepToInt(buf); 291 aNumBytes = abs(numBytes); 292 numDigits = BYTES_TO_GIANT_DIGITS(aNumBytes); 293 buf += sizeof(int); 294 bufLen -= sizeof(int); 295 if(numDigits > MAX_DIGITS) { 296 return (giant)NULL; 297 } 298 299 if(bufLen < aNumBytes) { 300 return (giant)NULL; 301 } 302 303 /* 9 Apr 1998 - sign = 0 means no following n[] bytes in the 304 * byteRep. We do need to alloc one digit, in this case, though... 305 * Note that the giantstruct has one implicit digit in n[]. 306 */ 307 if(aNumBytes == 0) { 308 g = (giant)fmalloc(sizeof(giantstruct)); 309 g->capacity = 1; 310 } 311 else { 312 g = (giant)fmalloc(sizeof(giantstruct) + 313 aNumBytes - GIANT_BYTES_PER_DIGIT); 314 g->capacity = numDigits; 315 } 316 deserializeGiant(buf, g, aNumBytes); 317 318 /* deserializeGiant always cooks up positive giant; sign is 319 * properly trimmed to handle trailing (M.S.) zeroes. */ 320 if(numBytes < 0) { 321 g->sign = -g->sign; 322 } 323 *giantLen = sizeof(int) + aNumBytes; 324 return g; 325 326 } 327 328 /* 329 * Convert a byte stream (and some other parameters) into a 330 * keystruct. 331 * Returns NULL on error; returns number of bytes of *buf snarfed in 332 * *keyLen if successful. 333 */ 334 key byteRepToKey(const unsigned char *buf, 335 unsigned bufLen, 336 int twist, 337 curveParams *cp, 338 unsigned *keyLen) // returned 339 { 340 key k; 341 giant x; 342 giant y; 343 unsigned gLen; 344 unsigned totalLen; 345 346 x = byteRepToGiant(buf, bufLen, &gLen); 347 if(x == NULL) { 348 return NULL; 349 } 350 bufLen -= gLen; 351 buf += gLen; 352 totalLen = gLen; 353 if(twist == CURVE_PLUS) { 354 /* this also contains y */ 355 y = byteRepToGiant(buf, bufLen, &gLen); 356 if(y == NULL) { 357 freeGiant(x); 358 return NULL; 359 } 360 totalLen += gLen; 361 } 362 else { 363 /* minus curve, y is not used */ 364 y = newGiant(1); 365 int_to_giant(0, y); 366 } 367 k = (key)fmalloc(sizeof(keystruct)); 368 k->twist = twist; 369 k->cp = cp; 370 k->x = x; 371 k->y = y; 372 *keyLen = totalLen; 373 return k; 374 } 375 376 curveParams *byteRepToCurveParams(const unsigned char *buf, 377 unsigned bufLen, 378 unsigned *cpLen) 379 { 380 curveParams *cp; 381 unsigned gLen = 0; 382 int version; 383 int minVersion; 384 int spare; 385 int bytes = 0; 386 387 if(bufLen < (5 * sizeof(int))) { // ver, minVers, q, k, spare 388 return NULL; 389 } 390 cp = newCurveParams(); 391 392 DEC_INT(version, buf, bufLen, bytes); 393 DEC_INT(minVersion, buf, bufLen, bytes); 394 if(minVersion > CURVE_PARAM_VERSION) { 395 /* 396 * Can't parse this; things have changed too much between 397 * this version of the code and the time this curveParams 398 * was written. 399 */ 400 goto abort; 401 } 402 403 DEC_BYTE(cp->primeType, buf, bufLen, bytes); 404 DEC_BYTE(cp->curveType, buf, bufLen, bytes); 405 DEC_INT(cp->q, buf, bufLen, bytes); 406 DEC_INT(cp->k, buf, bufLen, bytes); 407 DEC_INT(cp->m, buf, bufLen, bytes); 408 DEC_INT(spare, buf, bufLen, bytes); 409 410 DEC_GIANT(cp->a, buf, bufLen, gLen, bytes, abort); 411 DEC_GIANT(cp->b, buf, bufLen, gLen, bytes, abort); 412 DEC_GIANT(cp->c, buf, bufLen, gLen, bytes, abort); 413 DEC_GIANT(cp->x1Plus, buf, bufLen, gLen, bytes, abort); 414 DEC_GIANT(cp->x1Minus, buf, bufLen, gLen, bytes, abort); 415 DEC_GIANT(cp->cOrderPlus, buf, bufLen, gLen, bytes, abort); 416 DEC_GIANT(cp->cOrderMinus, buf, bufLen, gLen, bytes, abort); 417 DEC_GIANT(cp->x1OrderPlus, buf, bufLen, gLen, bytes, abort); 418 DEC_GIANT(cp->x1OrderMinus, buf, bufLen, gLen, bytes, abort); 419 420 /* 421 * basePrime only present in byte rep for PT_GENERAL 422 */ 423 if(cp->primeType == FPT_General) { 424 DEC_GIANT(cp->basePrime, buf, bufLen, gLen, bytes, abort); 425 } 426 427 /* remaining fields inferred */ 428 curveParamsInferFields(cp); 429 allocRecipGiants(cp); 430 431 *cpLen = bytes; 432 return cp; 433 434 abort: 435 freeCurveParams(cp); 436 return NULL; 437 } 438 439 /* 440 * Returns 0 if bad format, e.g., if minVersion of sig is > than codeVersion. 441 */ 442 int byteRepToSig(const unsigned char *buf, 443 unsigned bufLen, 444 int codeVersion, 445 int *sigMagic, // RETURNED 446 int *sigVersion, // RETURNED 447 int *sigMinVersion, // RETURNED 448 giant *g0, // alloc'd & RETURNED 449 giant *g1) // alloc'd & RETURNED 450 { 451 unsigned gLen = 0; 452 int spare; 453 int bytes = 0; 454 455 if(bufLen < (4 * sizeof(int))) { // magic, version, minVersion, 456 // spare 457 return 0; 458 } 459 DEC_INT(*sigMagic, buf, bufLen, bytes); 460 DEC_INT(*sigVersion, buf, bufLen, bytes); 461 DEC_INT(*sigMinVersion, buf, bufLen, bytes); 462 if(*sigMinVersion > codeVersion) { 463 return 0; 464 } 465 DEC_INT(spare, buf, bufLen, bytes); 466 // deleted 2/20/01 DEC_INT(*signerLen, buf, bufLen, bytes); 467 // deleted 2/20/01 *signer = byteRepToUnichars(buf, *signerLen); 468 // deleted 2/20/01 buf += (2 * *signerLen); 469 // deleted 2/20/01 bufLen -= (2 * *signerLen); 470 DEC_GIANT(*g0, buf, bufLen, gLen, bytes, abort); 471 DEC_GIANT(*g1, buf, bufLen, gLen, bytes, abort); 472 473 return 1; 474 abort: 475 return 0; 476 }