linux-sgx-trts-modified/psw/ae/common/se_ecdsa_verify_internal.cpp

/*
 * Copyright (C) 2011-2018 Intel Corporation. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 *   * Redistributions of source code must retain the above copyright
 *     notice, this list of conditions and the following disclaimer.
 *   * Redistributions in binary form must reproduce the above copyright
 *     notice, this list of conditions and the following disclaimer in
 *     the documentation and/or other materials provided with the
 *     distribution.
 *   * Neither the name of Intel Corporation nor the names of its
 *     contributors may be used to endorse or promote products derived
 *     from this software without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 */


#include "stdlib.h"
#include "string.h"
#include "ipp_wrapper.h"
#include "se_ecdsa_verify_internal.h"

#if !defined(SWAP_ENDIAN_DW)
#define SWAP_ENDIAN_DW(dw)	((((dw) & 0x000000ff) << 24)                    \
                            | (((dw) & 0x0000ff00) << 8)                    \
                            | (((dw) & 0x00ff0000) >> 8)                    \
                            | (((dw) & 0xff000000) >> 24))
#endif

// LE<->BE translation of 32 byte big number
#if !defined(SWAP_ENDIAN_32B)
#define SWAP_ENDIAN_32B(ptr)												\
{																			\
    unsigned int temp = 0;													\
    temp = SWAP_ENDIAN_DW(((unsigned int*)(ptr))[0]);						\
    ((unsigned int*)(ptr))[0] = SWAP_ENDIAN_DW(((unsigned int*)(ptr))[7]);	\
    ((unsigned int*)(ptr))[7] = temp;										\
    temp = SWAP_ENDIAN_DW(((unsigned int*)(ptr))[1]);						\
    ((unsigned int*)(ptr))[1] = SWAP_ENDIAN_DW(((unsigned int*)(ptr))[6]);	\
    ((unsigned int*)(ptr))[6] = temp;										\
    temp = SWAP_ENDIAN_DW(((unsigned int*)(ptr))[2]);						\
    ((unsigned int*)(ptr))[2] = SWAP_ENDIAN_DW(((unsigned int*)(ptr))[5]);	\
    ((unsigned int*)(ptr))[5] = temp;										\
    temp = SWAP_ENDIAN_DW(((unsigned int*)(ptr))[3]);						\
    ((unsigned int*)(ptr))[3] = SWAP_ENDIAN_DW(((unsigned int*)(ptr))[4]);	\
    ((unsigned int*)(ptr))[4] = temp;										\
}
#endif

#if !defined(ntohs)
#define ntohs(u16)                                      \
  ((uint16_t)(((((unsigned char*)&(u16))[0]) << 8)        \
            + (((unsigned char*)&(u16))[1])))
#endif


static const uint32_t g_nistp256_r[] = {
   0xFC632551, 0xF3B9CAC2, 0xA7179E84, 0xBCE6FAAD, 0xFFFFFFFF, 0xFFFFFFFF,
   0x00000000, 0xFFFFFFFF};

/*
 * An utility function used to verify ecc signature.
 *
 * @param p_ecp Pointer to ecc context.
 * @param p_pubkey The ecc public key.
 * @param p_signature The signature, in little endian
 * @param p_sig_rl_hash Output from sgx_sha256_get_hash
 * @param p_result Verify result
 * @return sgx_status_t Return SGX_SUCCESS if p_result is valid. Need to check
 * the p_result for detailed result. ippECValid means signature match.
 * ippECInvalidSignature means the input signature is invalid.
 */
sgx_status_t se_ecdsa_verify_internal(
    IppsECCPState *p_ecp,
    sgx_ec256_public_t *p_pubkey,
    sgx_ec256_signature_t *p_signature,
    const se_ae_ecdsa_hash_t *p_sig_rl_hash,
    IppECResult *p_result)
{
    sgx_status_t ret = SGX_SUCCESS;
    IppStatus ipp_ret = ippStsNoErr;
    Ipp32u cmpZeroResult = 0;
    IppsBigNumState* p_bn_ecp_order = NULL;
    IppsBigNumState* p_bn_sig_rl_hash = NULL;
    IppsBigNumState* p_bn_sig_rl_msg = NULL;
    IppsBigNumState* p_bn_sign_x = NULL;
    IppsBigNumState* p_bn_sign_y = NULL;
    IppsBigNumState* p_bn_p_x = NULL;
    IppsBigNumState* p_bn_p_y = NULL;
    IppsECCPPointState *p_reg_pub_key = NULL;
    int ctxSize = 0;
    IppECResult ecc_result = ippECValid;
    uint32_t sig_rl_hash_le[8] = {0};
    const uint32_t zero = 0;
    IppsBigNumState* p_bn_zero = NULL;

    if(NULL == p_ecp || NULL == p_pubkey || NULL == p_signature
       || NULL == p_sig_rl_hash || NULL == p_result)
        return SGX_ERROR_INVALID_PARAMETER;

    const int order_size = sizeof(g_nistp256_r);

    ipp_ret = newBN(g_nistp256_r, order_size, &p_bn_ecp_order);
    if(ipp_ret != ippStsNoErr)
    {
        ret = SGX_ERROR_UNEXPECTED;
        goto CLEANUP;
    }

    memcpy(sig_rl_hash_le, p_sig_rl_hash->hash, sizeof(sig_rl_hash_le));
    SWAP_ENDIAN_32B(sig_rl_hash_le);
    ipp_ret = newBN(sig_rl_hash_le, sizeof(sig_rl_hash_le),
                    &p_bn_sig_rl_hash);
    if(ipp_ret != ippStsNoErr)
    {
        ret = SGX_ERROR_UNEXPECTED;
        goto CLEANUP;
    }

    ipp_ret = newBN(0, order_size, &p_bn_sig_rl_msg);
    if(ipp_ret != ippStsNoErr)
    {
        ret = SGX_ERROR_UNEXPECTED;
        goto CLEANUP;
    }

    ipp_ret = ippsMod_BN(p_bn_sig_rl_hash, p_bn_ecp_order, p_bn_sig_rl_msg);
    if(ipp_ret != ippStsNoErr)
    {
        ret = SGX_ERROR_UNEXPECTED;
        goto CLEANUP;
    }

    ipp_ret = newBN(p_signature->x, order_size, &p_bn_sign_x);
    if(ipp_ret != ippStsNoErr)
    {
        ret = SGX_ERROR_UNEXPECTED;
        goto CLEANUP;
    }

    // Create a Big Number whose value is zero
    ipp_ret = newBN(&zero, sizeof(zero), &p_bn_zero);
    if(ipp_ret != ippStsNoErr)
    {
        ret = SGX_ERROR_UNEXPECTED;
        goto CLEANUP;
    }

    // Make sure none of the 2 signature big numbers is 0.
    ipp_ret = ippsCmp_BN(p_bn_sign_x, p_bn_zero, &cmpZeroResult);
    if(ipp_ret != ippStsNoErr)
    {
        ret = SGX_ERROR_UNEXPECTED;
        goto CLEANUP;
    }
    if(IS_ZERO == cmpZeroResult)
    {
        // Return SGX_SUCCESS and *p_result to be ippECInvalidSignature to report invalid signature.
        ret = SGX_SUCCESS;
        *p_result = ippECInvalidSignature;
        goto CLEANUP;
    }

    ipp_ret = newBN(p_signature->y, order_size, &p_bn_sign_y);
    if(ipp_ret != ippStsNoErr)
    {
        ret = SGX_ERROR_UNEXPECTED;
        goto CLEANUP;
    }

    ipp_ret = ippsCmp_BN(p_bn_sign_y, p_bn_zero, &cmpZeroResult);
    if(ipp_ret != ippStsNoErr)
    {
        ret = SGX_ERROR_UNEXPECTED;
        goto CLEANUP;
    }
    if(IS_ZERO == cmpZeroResult)
    {
        // Return SGX_SUCCESS and  *p_result to be ippECInvalidSignature to report invalid signature
        ret = SGX_SUCCESS;
        *p_result = ippECInvalidSignature;
        goto CLEANUP;
    }

    ipp_ret = newBN((Ipp32u *)p_pubkey->gx, order_size, &p_bn_p_x);
    if(ipp_ret != ippStsNoErr)
    {
        ret = SGX_ERROR_UNEXPECTED;
        goto CLEANUP;
    }

    ipp_ret = newBN((Ipp32u *)p_pubkey->gy, order_size, &p_bn_p_y);
    if(ipp_ret != ippStsNoErr)
    {
        ret = SGX_ERROR_UNEXPECTED;
        goto CLEANUP;
    }

    ipp_ret = ippsECCPPointGetSize(256, &ctxSize);
    if(ipp_ret != ippStsNoErr)
    {
        ret = SGX_ERROR_UNEXPECTED;
        goto CLEANUP;
    }

    p_reg_pub_key = (IppsECCPPointState *)malloc(ctxSize);
    if(NULL == p_reg_pub_key)
    {
        ret = SGX_ERROR_UNEXPECTED;
        goto CLEANUP;
    }

    ipp_ret = ippsECCPPointInit(256, p_reg_pub_key);
    if(ipp_ret != ippStsNoErr)
    {
        ret = SGX_ERROR_UNEXPECTED;
        goto CLEANUP;
    }

    ipp_ret = ippsECCPSetPoint(p_bn_p_x, p_bn_p_y, p_reg_pub_key, p_ecp);
    if(ipp_ret != ippStsNoErr)
    {
        ret = SGX_ERROR_UNEXPECTED;
        goto CLEANUP;
    }

    /* Set the regular pub key. */
    ipp_ret = ippsECCPSetKeyPair(NULL, p_reg_pub_key, ippTrue, p_ecp);
    if(ipp_ret != ippStsNoErr)
    {
        ret = SGX_ERROR_UNEXPECTED;
        goto CLEANUP;
    }

    ipp_ret = ippsECCPVerifyDSA(p_bn_sig_rl_msg, p_bn_sign_x, p_bn_sign_y,
                                &ecc_result, p_ecp);
    if(ipp_ret != ippStsNoErr)
    {
        ret = SGX_ERROR_UNEXPECTED;
        goto CLEANUP;
    }

    *p_result = ecc_result;

CLEANUP:
    if(p_bn_ecp_order)
        free(p_bn_ecp_order);
    if(p_bn_sig_rl_hash)
        free(p_bn_sig_rl_hash);
    if(p_bn_sig_rl_msg)
        free(p_bn_sig_rl_msg);
    if(p_bn_sign_x)
        free(p_bn_sign_x);
    if(p_bn_sign_y)
        free(p_bn_sign_y);
    if(p_bn_p_x)
        free(p_bn_p_x);
    if(p_bn_p_y)
        free(p_bn_p_y);
    if(p_reg_pub_key)
        free(p_reg_pub_key);
    if(p_bn_zero)
        free(p_bn_zero);
    return ret;
}