owner-nrf52sdk/nRF5_SDK_17.0.2/external/infineon/examples/ecdsa_utils/ecdsa_utils.c

/**
* MIT License
*
* Copyright (c) 2019 Infineon Technologies AG
*
* Permission is hereby granted, free of charge, to any person obtaining a copy
* of this software and associated documentation files (the "Software"), to deal
* in the Software without restriction, including without limitation the rights
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
* copies of the Software, and to permit persons to whom the Software is
* furnished to do so, subject to the following conditions:
*
* The above copyright notice and this permission notice shall be included in all
* copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
* SOFTWARE
*
*
* \file ecdsa_utils.c
*
* \brief   This file provides functions to convert raw r and s components of the ECDSA signature to asn1 encoding
*
*
* \addtogroup grOptigaUtil
* @{
*/

#include "ecdsa_utils.h"

#include <string.h>

// This implementation only supports a single byte LENGTH field. The maximum
// possible value than can be encoded within a single byte is 0x7F (127 dec).
// For higher values, the length must be coded in a multi-byte field.
#define DER_INTEGER_MAX_LEN 0x7F

// This implementation only supports a single byte LENGTH field. The maximum
// possible value than can be encoded within a single byte is 0x7F (127 dec).
// For higher values, the length must be coded in a multi-byte field.
#define DER_SEQUENCE_MAX_LEN 0x7F

// ASN.1 DER TAG field offset
#define ASN1_DER_TAG_OFFSET 0

// ASN.1 DER LENGTH field offset
#define ASN1_DER_LEN_OFFSET 1

// ASN.1 DER VALUE field offset
// Only for this implementation!
#define ASN1_DER_VAL_OFFSET 2

// ASN.1 DER Tag for INTEGER
#define DER_TAG_INTEGER 0x02

// ASN.1 DER Tag for SEQUENCE
#define DER_TAG_SEQUENCE 0x30

#define DER_UINT_MASK 0x80

/**
 * @brief Encodes a byte buffer as unsigned ASN.1 DER INTEGER
 *
 * @param  data[in]            Buffer containing the bytes to be encoded
 * @param  data_len[in]        Length of the data buffer
 * @param  out_buf[out]        Output buffer for the encoded ASN.1 bytes
 * @param  out_buf_len[in]     Size of the out_buf buffer
 * @return The number of bytes of the ASN.1 encoded stream on success, 0 on error
 * @note   The parameters to this function must not be NULL.
 */
static size_t encode_der_integer(const uint8_t* data, size_t data_len,
                                 uint8_t* out_buf, size_t out_buf_len)
{
    // all write access must be smaller or equal to this pointer
    const uint8_t* const out_end = out_buf + out_buf_len - 1;

    // fixed position fields
    uint8_t* const tag_field = &out_buf[ASN1_DER_TAG_OFFSET];
    uint8_t* const length_field = &out_buf[ASN1_DER_LEN_OFFSET];
    uint8_t* const integer_field_start = &out_buf[ASN1_DER_VAL_OFFSET];

    // write pointer
    uint8_t* integer_field_cur = integer_field_start;

    // search for beginning of integer
    const uint8_t* cur_data = data;
    const uint8_t* const data_end = data + data_len;

    // check if something to encode, else next loop condition overflows
    if (data_len == 0) {
        return 0;
    }

    // don't check the last byte, it will always be a data byte
    for(; cur_data < (data_end - 1); cur_data++) {
        if (*cur_data != 0x00) {
            break;
        }
    }

    // check if stuffing byte needed
    if (*cur_data & DER_UINT_MASK) {
        integer_field_cur++;
    }

    // calculate number of bytes left in data
    const size_t write_length = data_end - cur_data;
    // check if it fits in the output buffer
    if ((integer_field_cur + write_length - 1) > out_end) {
        // Prevented out-of-bounds write
        return 0;
    }

    // ensure we can encode the length
    const size_t integer_len = (integer_field_cur + write_length) - integer_field_start;
    if (integer_len > DER_INTEGER_MAX_LEN) {
        // This implementation support single-byte LENGTH fields only
        return 0;
    }

    // commit writes
    memcpy(integer_field_cur, cur_data, write_length);
    *tag_field = DER_TAG_INTEGER;
    *length_field = integer_len;
    // check if we have a stuffing byte, and explicitly zero it
    if (integer_field_cur != integer_field_start) {
        *integer_field_start = 0x00;
    }

    return integer_len + ASN1_DER_VAL_OFFSET;
}

bool ecdsa_rs_to_asn1_integers(const uint8_t* r, const uint8_t* s, size_t rs_len,
                               uint8_t* asn_sig, size_t* asn_sig_len)
{
    if (r == NULL || s == NULL || asn_sig == NULL || asn_sig_len == NULL) {
        // No NULL paramters allowed
        return false;
    }

    // encode R component
    const size_t out_len_r = encode_der_integer(r, rs_len, asn_sig, *asn_sig_len);
    if (out_len_r == 0) {
        // error while encoding R as DER INTEGER
        return false;
    }

    uint8_t* const s_start = asn_sig + out_len_r;
    const size_t s_len = *asn_sig_len - out_len_r;

    // encode S component
    const size_t out_len_s = encode_der_integer(s, rs_len, s_start, s_len);
    if (out_len_s == 0) {
        // error while encoding S as DER INTEGER
        return false;
    }

    *asn_sig_len = out_len_r + out_len_s;

    return true;
}

bool ecdsa_rs_to_asn1_signature(const uint8_t* r, const uint8_t* s, size_t rs_len,
                                uint8_t* asn_sig, size_t* asn_sig_len)
{
    if (r == NULL || s == NULL || asn_sig == NULL || asn_sig_len == NULL) {
        // No NULL paramters allowed
        return false;
    }

    if (*asn_sig_len < ASN1_DER_VAL_OFFSET) {
        // Not enough space, can't encode anything
        return false;
    }

     // fixed position fields
    uint8_t* const tag_field = &asn_sig[ASN1_DER_TAG_OFFSET];
    uint8_t* const length_field = &asn_sig[ASN1_DER_LEN_OFFSET];
    uint8_t* const value_field_start = &asn_sig[ASN1_DER_VAL_OFFSET];

    // compute size left after SEQUENCE header TAG and LENGTH fields
    size_t integers_len = *asn_sig_len - ASN1_DER_VAL_OFFSET;

    if (!ecdsa_rs_to_asn1_integers(r, s, rs_len, value_field_start, &integers_len)) {
        // Failed to encode R and S as INTEGERs
        return false;
    }

    if (integers_len > DER_SEQUENCE_MAX_LEN) {
        // This implementation support single-byte LENGTH fields only
        return false;
    }

    // write SEQUENCE header
    *tag_field = DER_TAG_SEQUENCE;
    *length_field = integers_len;
    *asn_sig_len = integers_len + ASN1_DER_VAL_OFFSET;

    return true;
}

/**
 * @brief Decodes an ASN.1 encoded integer to a byte buffer
 *
 * @param  asn1[in]            Buffer containing the ASN.1 encoded data
 * @param  asn1_len[in]        Length of the asn1 buffer
 * @param  out_int[out]        Output buffer for the decoded integer bytes
 * @param  out_int_len[in,out] Size of the out_int buffer, contains the number of written bytes afterwards
 * @return The number of bytes advanced in the ASN.1 stream on success, 0 on failure
 * @note   The parameters to this function must not be NULL.
 */
static size_t decode_asn1_uint(const uint8_t* asn1, size_t asn1_len,
                               uint8_t* out_int, size_t* out_int_len)
{
    if (asn1_len < (ASN1_DER_VAL_OFFSET + 1)) {
        // Not enough data to decode anything
        return 0;
    }

    // all read access must be before this pointer
    const uint8_t* const asn1_end = asn1 + asn1_len;

    // fixed position fields
    const uint8_t* const tag_field = &asn1[ASN1_DER_TAG_OFFSET];
    const uint8_t* const length_field = &asn1[ASN1_DER_LEN_OFFSET];

    if (*tag_field != DER_TAG_INTEGER) {
        // Not an DER INTEGER
        return 0;
    }

    if (*length_field == 0 || *length_field > DER_INTEGER_MAX_LEN) {
        // Invalid length value
        return  0;
    }

    uint8_t integer_length = *length_field;
    const uint8_t* integer_field_cur = &asn1[ASN1_DER_VAL_OFFSET];

    if ((integer_field_cur + integer_length - 1) > (asn1_end - 1)) {
        // prevented out-of-bounds read
        return 0;
    }

    // one byte can never be a stuffing byte
    if (integer_length > 1) {
        if (*integer_field_cur == 0x00) {
            // remove stuffing byte
            integer_length--;
            integer_field_cur++;
        }

        if (*integer_field_cur == 0x00) {
            // second zero byte is an encoding error
            return 0;
        }
    }

    if (integer_length > *out_int_len) {
        // prevented out-of-bounds write
        return 0;
    }

    // insert padding zeros to ensure position of least significant byte matches
    const size_t padding = *out_int_len - integer_length;
    memset(out_int, 0, padding);

    memcpy(out_int + padding, integer_field_cur, integer_length);
    *out_int_len = integer_length;

    // return number of consumed ASN.1 bytes
    return integer_field_cur + integer_length - tag_field;
}

bool asn1_to_ecdsa_rs_sep(const uint8_t* asn1, size_t asn1_len,
                      uint8_t* r, size_t* r_len,
                      uint8_t* s, size_t* s_len)
{
    if (asn1 == NULL || r == NULL || r_len == NULL || s == NULL || s_len == NULL) {
        // No NULL paramters allowed
        return false;
    }

    // decode R component
    const size_t consumed_r = decode_asn1_uint(asn1, asn1_len, r, r_len);
    if (consumed_r == 0) {
        // error while decoding R component
        return false;
    }

    const uint8_t* const asn1_s = asn1 + consumed_r;
    const size_t asn1_s_len = asn1_len - consumed_r;

    // decode S component
    const size_t consumed_s = decode_asn1_uint(asn1_s, asn1_s_len, s, s_len);
    if (consumed_s == 0) {
        // error while decoding R component
        return false;
    }

    return true;
}

bool asn1_to_ecdsa_rs(const uint8_t* asn1, size_t asn1_len,
                      uint8_t* rs, size_t rs_len)
{
    if (asn1 == NULL || rs == NULL || rs_len == 0) {
        // No NULL paramters allowed
        return false;
    }

    if ((rs_len % 2) != 0) {
        // length of the output buffer must be 2 times the component size and even
        return false;
    }

    const size_t component_length = rs_len / 2;
    size_t r_len = component_length;
    size_t s_len = component_length;

    return asn1_to_ecdsa_rs_sep(asn1, asn1_len, rs, &r_len, rs + component_length, &s_len);
}