5079590438

Committed 25 May 2023 12:28PM UTC coverage: 92.228% (+0.5%) from 91.723%

Build # 5079590438

Build Type

Pull #3502

github

Pull Request Pull Request #3502: Apply clang-format to the codebase

Run Details

75589 of 81959 relevant lines covered (92.23%)

12139530.51 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

94.39

/src/lib/pubkey/dsa/dsa.cpp

/*
* DSA
* (C) 1999-2010,2014,2016,2023 Jack Lloyd
* (C) 2016 René Korthaus
*
* Botan is released under the Simplified BSD License (see license.txt)
*/

#include <botan/dsa.h>

#include <botan/numthry.h>
#include <botan/internal/divide.h>
#include <botan/internal/dl_scheme.h>
#include <botan/internal/keypair.h>
#include <botan/internal/pk_ops_impl.h>

#if defined(BOTAN_HAS_RFC6979_GENERATOR)
   #include <botan/internal/rfc6979.h>
#endif

namespace Botan {

size_t DSA_PublicKey::message_part_size() const { return m_public_key->group().q_bytes(); }

size_t DSA_PublicKey::estimated_strength() const { return m_public_key->estimated_strength(); }

size_t DSA_PublicKey::key_length() const { return m_public_key->p_bits(); }

const BigInt& DSA_PublicKey::get_int_field(std::string_view field) const {
   return m_public_key->get_int_field(algo_name(), field);
}

AlgorithmIdentifier DSA_PublicKey::algorithm_identifier() const {
   return AlgorithmIdentifier(object_identifier(), m_public_key->group().DER_encode(DL_Group_Format::ANSI_X9_57));
}

std::vector<uint8_t> DSA_PublicKey::public_key_bits() const { return m_public_key->DER_encode(); }

bool DSA_PublicKey::check_key(RandomNumberGenerator& rng, bool strong) const {
   return m_public_key->check_key(rng, strong);
}

DSA_PublicKey::DSA_PublicKey(const AlgorithmIdentifier& alg_id, std::span<const uint8_t> key_bits) {
   m_public_key = std::make_shared<DL_PublicKey>(alg_id, key_bits, DL_Group_Format::ANSI_X9_57);

   BOTAN_ARG_CHECK(m_public_key->group().has_q(), "Q parameter must be set for DSA");
}

DSA_PublicKey::DSA_PublicKey(const DL_Group& group, const BigInt& y) {
   m_public_key = std::make_shared<DL_PublicKey>(group, y);

   BOTAN_ARG_CHECK(m_public_key->group().has_q(), "Q parameter must be set for DSA");
}

DSA_PrivateKey::DSA_PrivateKey(RandomNumberGenerator& rng, const DL_Group& group) {
   m_private_key = std::make_shared<DL_PrivateKey>(group, rng);
   m_public_key = m_private_key->public_key();
}

DSA_PrivateKey::DSA_PrivateKey(const DL_Group& group, const BigInt& x) {
   m_private_key = std::make_shared<DL_PrivateKey>(group, x);
   m_public_key = m_private_key->public_key();
}

DSA_PrivateKey::DSA_PrivateKey(const AlgorithmIdentifier& alg_id, std::span<const uint8_t> key_bits) {
   m_private_key = std::make_shared<DL_PrivateKey>(alg_id, key_bits, DL_Group_Format::ANSI_X9_57);
   m_public_key = m_private_key->public_key();
}

bool DSA_PrivateKey::check_key(RandomNumberGenerator& rng, bool strong) const {
   if(!m_private_key->check_key(rng, strong))
      return false;

   if(m_private_key->private_key() >= m_private_key->group().get_q())
      return false;

   return KeyPair::signature_consistency_check(rng, *this, "SHA-256");
}

secure_vector<uint8_t> DSA_PrivateKey::private_key_bits() const { return m_private_key->DER_encode(); }

secure_vector<uint8_t> DSA_PrivateKey::raw_private_key_bits() const { return m_private_key->raw_private_key_bits(); }

const BigInt& DSA_PrivateKey::get_int_field(std::string_view field) const {
   return m_private_key->get_int_field(algo_name(), field);
}

std::unique_ptr<Public_Key> DSA_PrivateKey::public_key() const {
   // can't use make_unique here due to private constructor
   return std::unique_ptr<DSA_PublicKey>(new DSA_PublicKey(m_public_key));
}

namespace {

/**
* Object that can create a DSA signature
*/
class DSA_Signature_Operation final : public PK_Ops::Signature_with_Hash {
   public:
      DSA_Signature_Operation(const std::shared_ptr<const DL_PrivateKey>& key,
                              std::string_view emsa,
                              RandomNumberGenerator& rng) :
            PK_Ops::Signature_with_Hash(emsa), m_key(key) {
         m_b = BigInt::random_integer(rng, 2, m_key->group().get_q());
         m_b_inv = m_key->group().inverse_mod_q(m_b);
      }

      size_t signature_length() const override { return 2 * m_key->group().q_bytes(); }

      secure_vector<uint8_t> raw_sign(const uint8_t msg[], size_t msg_len, RandomNumberGenerator& rng) override;

      AlgorithmIdentifier algorithm_identifier() const override;

   private:
      std::shared_ptr<const DL_PrivateKey> m_key;
      BigInt m_b, m_b_inv;
};

AlgorithmIdentifier DSA_Signature_Operation::algorithm_identifier() const {
   const std::string full_name = "DSA/" + hash_function();
   const OID oid = OID::from_string(full_name);
   return AlgorithmIdentifier(oid, AlgorithmIdentifier::USE_EMPTY_PARAM);
}

secure_vector<uint8_t> DSA_Signature_Operation::raw_sign(const uint8_t msg[],
                                                         size_t msg_len,
                                                         RandomNumberGenerator& rng) {
   const DL_Group& group = m_key->group();
   const BigInt& q = group.get_q();

   BigInt m = BigInt::from_bytes_with_max_bits(msg, msg_len, group.q_bits());

   if(m >= q)
      m -= q;

#if defined(BOTAN_HAS_RFC6979_GENERATOR)
   BOTAN_UNUSED(rng);
   const BigInt k = generate_rfc6979_nonce(m_key->private_key(), q, m, this->rfc6979_hash_function());
#else
   const BigInt k = BigInt::random_integer(rng, 1, q);
#endif

   const BigInt k_inv = group.inverse_mod_q(k);

   /*
   * It may not be strictly necessary for the reduction (g^k mod p) mod q to be
   * const time, since r is published as part of the signature, and deriving
   * anything useful about k from g^k mod p would seem to require computing a
   * discrete logarithm.
   *
   * However it only increases the cost of signatures by about 7-10%, and DSA is
   * only for legacy use anyway so we don't care about the performance so much.
   */
   const BigInt r = ct_modulo(group.power_g_p(k, group.q_bits()), group.get_q());

   /*
   * Blind the input message and compute x*r+m as (x*r*b + m*b)/b
   */
   m_b = group.square_mod_q(m_b);
   m_b_inv = group.square_mod_q(m_b_inv);

   m = group.multiply_mod_q(m_b, m);
   const BigInt xr = group.multiply_mod_q(m_b, m_key->private_key(), r);

   const BigInt s = group.multiply_mod_q(m_b_inv, k_inv, group.mod_q(xr + m));

   // With overwhelming probability, a bug rather than actual zero r/s
   if(r.is_zero() || s.is_zero())
      throw Internal_Error("Computed zero r/s during DSA signature");

   return BigInt::encode_fixed_length_int_pair(r, s, q.bytes());
}

/**
* Object that can verify a DSA signature
*/
class DSA_Verification_Operation final : public PK_Ops::Verification_with_Hash {
   public:
      DSA_Verification_Operation(const std::shared_ptr<const DL_PublicKey>& key, std::string_view emsa) :
            PK_Ops::Verification_with_Hash(emsa), m_key(key) {}

      DSA_Verification_Operation(const std::shared_ptr<const DL_PublicKey>& key, const AlgorithmIdentifier& alg_id) :
            PK_Ops::Verification_with_Hash(alg_id, "DSA"), m_key(key) {}

      bool verify(const uint8_t msg[], size_t msg_len, const uint8_t sig[], size_t sig_len) override;

   private:
      std::shared_ptr<const DL_PublicKey> m_key;
};

bool DSA_Verification_Operation::verify(const uint8_t msg[], size_t msg_len, const uint8_t sig[], size_t sig_len) {
   const auto group = m_key->group();

   const BigInt& q = group.get_q();
   const size_t q_bytes = q.bytes();

   if(sig_len != 2 * q_bytes)
      return false;

   BigInt r(sig, q_bytes);
   BigInt s(sig + q_bytes, q_bytes);
   BigInt i = BigInt::from_bytes_with_max_bits(msg, msg_len, group.q_bits());
   if(i >= q)
      i -= q;

   if(r <= 0 || r >= q || s <= 0 || s >= q)
      return false;

   s = inverse_mod(s, q);

   const BigInt sr = group.multiply_mod_q(s, r);
   const BigInt si = group.multiply_mod_q(s, i);

   s = group.multi_exponentiate(si, m_key->public_key(), sr);

   // s is too big for Barrett, and verification doesn't need to be const-time
   return (s % group.get_q() == r);
}

}

std::unique_ptr<PK_Ops::Verification> DSA_PublicKey::create_verification_op(std::string_view params,
                                                                            std::string_view provider) const {
   if(provider == "base" || provider.empty())
      return std::make_unique<DSA_Verification_Operation>(this->m_public_key, params);
   throw Provider_Not_Found(algo_name(), provider);
}

std::unique_ptr<PK_Ops::Verification> DSA_PublicKey::create_x509_verification_op(
   const AlgorithmIdentifier& signature_algorithm, std::string_view provider) const {
   if(provider == "base" || provider.empty())
      return std::make_unique<DSA_Verification_Operation>(this->m_public_key, signature_algorithm);

   throw Provider_Not_Found(algo_name(), provider);
}

std::unique_ptr<PK_Ops::Signature> DSA_PrivateKey::create_signature_op(RandomNumberGenerator& rng,
                                                                       std::string_view params,
                                                                       std::string_view provider) const {
   if(provider == "base" || provider.empty())
      return std::make_unique<DSA_Signature_Operation>(this->m_private_key, params, rng);
   throw Provider_Not_Found(algo_name(), provider);
}

}

1	/*
2	* DSA
3	* (C) 1999-2010,2014,2016,2023 Jack Lloyd
4	* (C) 2016 René Korthaus
5	*
6	* Botan is released under the Simplified BSD License (see license.txt)
7	*/
8
9	#include <botan/dsa.h>
10
11	#include <botan/numthry.h>
12	#include <botan/internal/divide.h>
13	#include <botan/internal/dl_scheme.h>
14	#include <botan/internal/keypair.h>
15	#include <botan/internal/pk_ops_impl.h>
16
17	#if defined(BOTAN_HAS_RFC6979_GENERATOR)
18	#include <botan/internal/rfc6979.h>
19	#endif
20
21	namespace Botan {
22
23	size_t DSA_PublicKey::message_part_size() const { return m_public_key->group().q_bytes(); }	442✔
24
25	size_t DSA_PublicKey::estimated_strength() const { return m_public_key->estimated_strength(); }	24✔
26
27	size_t DSA_PublicKey::key_length() const { return m_public_key->p_bits(); }	×
28
29	const BigInt& DSA_PublicKey::get_int_field(std::string_view field) const {	8✔
30	return m_public_key->get_int_field(algo_name(), field);	8✔
31	}
32
33	AlgorithmIdentifier DSA_PublicKey::algorithm_identifier() const {	92✔
34	return AlgorithmIdentifier(object_identifier(), m_public_key->group().DER_encode(DL_Group_Format::ANSI_X9_57));	184✔
35	}
36
37	std::vector<uint8_t> DSA_PublicKey::public_key_bits() const { return m_public_key->DER_encode(); }	65✔
38
39	bool DSA_PublicKey::check_key(RandomNumberGenerator& rng, bool strong) const {	7✔
40	return m_public_key->check_key(rng, strong);	7✔
41	}
42
43	DSA_PublicKey::DSA_PublicKey(const AlgorithmIdentifier& alg_id, std::span<const uint8_t> key_bits) {	235✔
44	m_public_key = std::make_shared<DL_PublicKey>(alg_id, key_bits, DL_Group_Format::ANSI_X9_57);	235✔
45
46	BOTAN_ARG_CHECK(m_public_key->group().has_q(), "Q parameter must be set for DSA");	121✔
47	}	235✔
48
49	DSA_PublicKey::DSA_PublicKey(const DL_Group& group, const BigInt& y) {	4✔
50	m_public_key = std::make_shared<DL_PublicKey>(group, y);	4✔
51
52	BOTAN_ARG_CHECK(m_public_key->group().has_q(), "Q parameter must be set for DSA");	4✔
53	}	4✔
54
55	DSA_PrivateKey::DSA_PrivateKey(RandomNumberGenerator& rng, const DL_Group& group) {	14✔
56	m_private_key = std::make_shared<DL_PrivateKey>(group, rng);	14✔
57	m_public_key = m_private_key->public_key();	14✔
58	}	14✔
59
60	DSA_PrivateKey::DSA_PrivateKey(const DL_Group& group, const BigInt& x) {	325✔
61	m_private_key = std::make_shared<DL_PrivateKey>(group, x);	325✔
62	m_public_key = m_private_key->public_key();	325✔
63	}	325✔
64
65	DSA_PrivateKey::DSA_PrivateKey(const AlgorithmIdentifier& alg_id, std::span<const uint8_t> key_bits) {	212✔
66	m_private_key = std::make_shared<DL_PrivateKey>(alg_id, key_bits, DL_Group_Format::ANSI_X9_57);	212✔
67	m_public_key = m_private_key->public_key();	66✔
68	}	212✔
69
70	bool DSA_PrivateKey::check_key(RandomNumberGenerator& rng, bool strong) const {	5✔
71	if(!m_private_key->check_key(rng, strong))	5✔
72	return false;
73
74	if(m_private_key->private_key() >= m_private_key->group().get_q())	5✔
75	return false;
76
77	return KeyPair::signature_consistency_check(rng, *this, "SHA-256");	5✔
78	}
79
80	secure_vector<uint8_t> DSA_PrivateKey::private_key_bits() const { return m_private_key->DER_encode(); }	31✔
81
82	secure_vector<uint8_t> DSA_PrivateKey::raw_private_key_bits() const { return m_private_key->raw_private_key_bits(); }	×
83
84	const BigInt& DSA_PrivateKey::get_int_field(std::string_view field) const {	10✔
85	return m_private_key->get_int_field(algo_name(), field);	10✔
86	}
87
88	std::unique_ptr<Public_Key> DSA_PrivateKey::public_key() const {	305✔
89	// can't use make_unique here due to private constructor
90	return std::unique_ptr<DSA_PublicKey>(new DSA_PublicKey(m_public_key));	610✔
91	}
92
93	namespace {
94
95	/**
96	* Object that can create a DSA signature
97	*/
98	class DSA_Signature_Operation final : public PK_Ops::Signature_with_Hash {	×
99	public:
100	DSA_Signature_Operation(const std::shared_ptr<const DL_PrivateKey>& key,	68✔
101	std::string_view emsa,
102	RandomNumberGenerator& rng) :	68✔
103	PK_Ops::Signature_with_Hash(emsa), m_key(key) {	68✔
104	m_b = BigInt::random_integer(rng, 2, m_key->group().get_q());	136✔
105	m_b_inv = m_key->group().inverse_mod_q(m_b);	136✔
106	}	68✔
107
108	size_t signature_length() const override { return 2 * m_key->group().q_bytes(); }	23✔
109
110	secure_vector<uint8_t> raw_sign(const uint8_t msg[], size_t msg_len, RandomNumberGenerator& rng) override;
111
112	AlgorithmIdentifier algorithm_identifier() const override;
113
114	private:
115	std::shared_ptr<const DL_PrivateKey> m_key;
116	BigInt m_b, m_b_inv;
117	};
118
119	AlgorithmIdentifier DSA_Signature_Operation::algorithm_identifier() const {	37✔
120	const std::string full_name = "DSA/" + hash_function();	37✔
121	const OID oid = OID::from_string(full_name);	37✔
122	return AlgorithmIdentifier(oid, AlgorithmIdentifier::USE_EMPTY_PARAM);	37✔
123	}	37✔
124
125	secure_vector<uint8_t> DSA_Signature_Operation::raw_sign(const uint8_t msg[],	77✔
126	size_t msg_len,
127	RandomNumberGenerator& rng) {
128	const DL_Group& group = m_key->group();	77✔
129	const BigInt& q = group.get_q();	77✔
130
131	BigInt m = BigInt::from_bytes_with_max_bits(msg, msg_len, group.q_bits());	77✔
132
133	if(m >= q)	77✔
134	m -= q;	24✔
135
136	#if defined(BOTAN_HAS_RFC6979_GENERATOR)
137	BOTAN_UNUSED(rng);	77✔
138	const BigInt k = generate_rfc6979_nonce(m_key->private_key(), q, m, this->rfc6979_hash_function());	77✔
139	#else
140	const BigInt k = BigInt::random_integer(rng, 1, q);
141	#endif
142
143	const BigInt k_inv = group.inverse_mod_q(k);	77✔
144
145	/*
146	* It may not be strictly necessary for the reduction (g^k mod p) mod q to be
147	* const time, since r is published as part of the signature, and deriving
148	* anything useful about k from g^k mod p would seem to require computing a
149	* discrete logarithm.
150	*
151	* However it only increases the cost of signatures by about 7-10%, and DSA is
152	* only for legacy use anyway so we don't care about the performance so much.
153	*/
154	const BigInt r = ct_modulo(group.power_g_p(k, group.q_bits()), group.get_q());	77✔
155
156	/*
157	* Blind the input message and compute xr+m as (xrb + mb)/b
158	*/
159	m_b = group.square_mod_q(m_b);	77✔
160	m_b_inv = group.square_mod_q(m_b_inv);	77✔
161
162	m = group.multiply_mod_q(m_b, m);	77✔
163	const BigInt xr = group.multiply_mod_q(m_b, m_key->private_key(), r);	77✔
164
165	const BigInt s = group.multiply_mod_q(m_b_inv, k_inv, group.mod_q(xr + m));	154✔
166
167	// With overwhelming probability, a bug rather than actual zero r/s
168	if(r.is_zero() \|\| s.is_zero())	154✔
169	throw Internal_Error("Computed zero r/s during DSA signature");	×
170
171	return BigInt::encode_fixed_length_int_pair(r, s, q.bytes());	77✔
172	}	462✔
173
174	/**
175	* Object that can verify a DSA signature
176	*/
177	class DSA_Verification_Operation final : public PK_Ops::Verification_with_Hash {	×
178	public:
179	DSA_Verification_Operation(const std::shared_ptr<const DL_PublicKey>& key, std::string_view emsa) :	335✔
180	PK_Ops::Verification_with_Hash(emsa), m_key(key) {}	335✔
181
182	DSA_Verification_Operation(const std::shared_ptr<const DL_PublicKey>& key, const AlgorithmIdentifier& alg_id) :	80✔
183	PK_Ops::Verification_with_Hash(alg_id, "DSA"), m_key(key) {}	80✔
184
185	bool verify(const uint8_t msg[], size_t msg_len, const uint8_t sig[], size_t sig_len) override;
186
187	private:
188	std::shared_ptr<const DL_PublicKey> m_key;
189	};
190
191	bool DSA_Verification_Operation::verify(const uint8_t msg[], size_t msg_len, const uint8_t sig[], size_t sig_len) {	7,238✔
192	const auto group = m_key->group();	7,238✔
193
194	const BigInt& q = group.get_q();	7,238✔
195	const size_t q_bytes = q.bytes();	7,238✔
196
197	if(sig_len != 2 * q_bytes)	7,238✔
198	return false;
199
200	BigInt r(sig, q_bytes);	7,238✔
201	BigInt s(sig + q_bytes, q_bytes);	7,238✔
202	BigInt i = BigInt::from_bytes_with_max_bits(msg, msg_len, group.q_bits());	7,238✔
203	if(i >= q)	7,238✔
204	i -= q;	1,372✔
205
206	if(r <= 0 \|\| r >= q \|\| s <= 0 \|\| s >= q)	27,895✔
207	return false;	401✔
208
209	s = inverse_mod(s, q);	6,837✔
210
211	const BigInt sr = group.multiply_mod_q(s, r);	6,837✔
212	const BigInt si = group.multiply_mod_q(s, i);	6,837✔
213
214	s = group.multi_exponentiate(si, m_key->public_key(), sr);	6,837✔
215
216	// s is too big for Barrett, and verification doesn't need to be const-time
217	return (s % group.get_q() == r);	20,511✔
218	}	43,027✔
219
220	}
221
222	std::unique_ptr<PK_Ops::Verification> DSA_PublicKey::create_verification_op(std::string_view params,	1,310✔
223	std::string_view provider) const {
224	if(provider == "base" \|\| provider.empty())	1,635✔
225	return std::make_unique<DSA_Verification_Operation>(this->m_public_key, params);	335✔
226	throw Provider_Not_Found(algo_name(), provider);	1,950✔
227	}
228
229	std::unique_ptr<PK_Ops::Verification> DSA_PublicKey::create_x509_verification_op(	80✔
230	const AlgorithmIdentifier& signature_algorithm, std::string_view provider) const {
231	if(provider == "base" \|\| provider.empty())	80✔
232	return std::make_unique<DSA_Verification_Operation>(this->m_public_key, signature_algorithm);	80✔
233
234	throw Provider_Not_Found(algo_name(), provider);	×
235	}
236
237	std::unique_ptr<PK_Ops::Signature> DSA_PrivateKey::create_signature_op(RandomNumberGenerator& rng,	131✔
238	std::string_view params,
239	std::string_view provider) const {
240	if(provider == "base" \|\| provider.empty())	152✔
241	return std::make_unique<DSA_Signature_Operation>(this->m_private_key, params, rng);	68✔
242	throw Provider_Not_Found(algo_name(), provider);	126✔
243	}
244
245	}

randombit / botan / 5079590438

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous