mirror of
https://github.com/Proxmark/proxmark3.git
synced 2025-08-22 06:13:27 -07:00
add NXP originality check
* add support for elliptic curve 'secp128r1' to mbedtls library * change ecdsa_signature_verify() to allow different curves, signature lengths, and skipping hash * add originality check in 'hf mfu info' * add another public key for Mifare Ultralight EV1
This commit is contained in:
pwpiwi
parent
905d2975dc
commit
e3176fbcbb
12 changed files with 397 additions and 275 deletions
|
|
@ -353,9 +353,9 @@ int CmdHFFidoRegister(const char *cmd) {
|
|||
&buf[1], 65, // user public key
|
||||
NULL, 0);
|
||||
//PrintAndLog("--xbuf(%d)[%d]: %s", res, xbuflen, sprint_hex(xbuf, xbuflen));
|
||||
res = ecdsa_signature_verify(public_key, xbuf, xbuflen, &buf[hashp], len - hashp);
|
||||
res = ecdsa_signature_verify(MBEDTLS_ECP_DP_SECP256R1, public_key, xbuf, xbuflen, &buf[hashp], len - hashp, true);
|
||||
if (res) {
|
||||
if (res == -0x4e00) {
|
||||
if (res == MBEDTLS_ERR_ECP_VERIFY_FAILED) {
|
||||
PrintAndLog("Signature is NOT VALID.");
|
||||
} else {
|
||||
PrintAndLog("Other signature check error: %x %s", (res<0)?-res:res, ecdsa_get_error(res));
|
||||
|
|
@ -579,9 +579,9 @@ int CmdHFFidoAuthenticate(const char *cmd) {
|
|||
data, 32, // challenge parameter
|
||||
NULL, 0);
|
||||
//PrintAndLog("--xbuf(%d)[%d]: %s", res, xbuflen, sprint_hex(xbuf, xbuflen));
|
||||
res = ecdsa_signature_verify(public_key, xbuf, xbuflen, &buf[5], len - 5);
|
||||
res = ecdsa_signature_verify(MBEDTLS_ECP_DP_SECP256R1, public_key, xbuf, xbuflen, &buf[5], len - 5, true);
|
||||
if (res) {
|
||||
if (res == -0x4e00) {
|
||||
if (res == MBEDTLS_ERR_ECP_VERIFY_FAILED) {
|
||||
PrintAndLog("Signature is NOT VALID.");
|
||||
} else {
|
||||
PrintAndLog("Other signature check error: %x %s", (res<0)?-res:res, ecdsa_get_error(res));
|
||||
|
|
|
|||
|
|
@ -22,6 +22,7 @@
|
|||
#include "util.h"
|
||||
#include "protocols.h"
|
||||
#include "taginfo.h"
|
||||
#include "crypto/libpcrypto.h"
|
||||
|
||||
#define MAX_UL_BLOCKS 0x0f
|
||||
#define MAX_ULC_BLOCKS 0x2b
|
||||
|
|
@ -51,7 +52,6 @@ uint8_t default_3des_keys[KEYS_3DES_COUNT][16] = {
|
|||
#define KEYS_PWD_COUNT 6
|
||||
uint8_t default_pwd_pack[KEYS_PWD_COUNT][4] = {
|
||||
{0xFF,0xFF,0xFF,0xFF}, // PACK 0x00,0x00 -- factory default
|
||||
|
||||
{0x4A,0xF8,0x4B,0x19}, // PACK 0xE5,0xBE -- italian bus (sniffed)
|
||||
{0x33,0x6B,0xA1,0x19}, // PACK 0x9c,0x2d -- italian bus (sniffed)
|
||||
{0xFF,0x90,0x6C,0xB2}, // PACK 0x12,0x9e -- italian bus (sniffed)
|
||||
|
|
@ -59,6 +59,13 @@ uint8_t default_pwd_pack[KEYS_PWD_COUNT][4] = {
|
|||
{0x35,0x1C,0xD0,0x19}, // PACK 0x9A,0x5a -- italian bus (sniffed)
|
||||
};
|
||||
|
||||
// known public keys for the originality check (source: https://github.com/alexbatalov/node-nxp-originality-verifier)
|
||||
uint8_t public_keys[2][33] = {{0x04,0x49,0x4e,0x1a,0x38,0x6d,0x3d,0x3c,0xfe,0x3d,0xc1,0x0e,0x5d,0xe6,0x8a,0x49,0x9b, // UL and NDEF
|
||||
0x1c,0x20,0x2d,0xb5,0xb1,0x32,0x39,0x3e,0x89,0xed,0x19,0xfe,0x5b,0xe8,0xbc,0x61},
|
||||
{0x04,0x90,0x93,0x3b,0xdc,0xd6,0xe9,0x9b,0x4e,0x25,0x5e,0x3d,0xa5,0x53,0x89,0xa8,0x27, // UL EV1
|
||||
0x56,0x4e,0x11,0x71,0x8e,0x01,0x72,0x92,0xfa,0xf2,0x32,0x26,0xa9,0x66,0x14,0xb8}
|
||||
};
|
||||
|
||||
#define MAX_UL_TYPES 18
|
||||
uint32_t UL_TYPES_ARRAY[MAX_UL_TYPES] = {UNKNOWN, UL, UL_C, UL_EV1_48, UL_EV1_128, NTAG, NTAG_203,
|
||||
NTAG_210, NTAG_212, NTAG_213, NTAG_215, NTAG_216, MY_D, MY_D_NFC, MY_D_MOVE, MY_D_MOVE_NFC, MY_D_MOVE_LEAN, FUDAN_UL};
|
||||
|
|
@ -502,14 +509,21 @@ static int ulev1_print_counters(){
|
|||
return len;
|
||||
}
|
||||
|
||||
static int ulev1_print_signature( uint8_t *data, uint8_t len){
|
||||
PrintAndLog("\n--- Tag Signature");
|
||||
|
||||
static int ulev1_print_signature(TagTypeUL_t tagtype, uint8_t *uid, uint8_t *signature, size_t signature_len){
|
||||
uint8_t public_key = 0;
|
||||
if (tagtype == UL_EV1_48 || tagtype == UL_EV1_128) {
|
||||
public_key = 1;
|
||||
}
|
||||
int res = ecdsa_signature_r_s_verify(MBEDTLS_ECP_DP_SECP128R1, public_keys[public_key], uid, 7, signature, signature_len, false);
|
||||
bool signature_valid = (res == 0);
|
||||
|
||||
PrintAndLog("\n--- Tag Originality Signature");
|
||||
//PrintAndLog("IC signature public key name : NXP NTAG21x 2013"); // don't know if there is other NXP public keys.. :(
|
||||
PrintAndLog("IC signature public key value : 04494e1a386d3d3cfe3dc10e5de68a499b1c202db5b132393e89ed19fe5be8bc61");
|
||||
PrintAndLog(" Signature public key : %s", sprint_hex(public_keys[public_key]+1, sizeof(public_keys[public_key])-1));
|
||||
PrintAndLog(" Elliptic curve parameters : secp128r1");
|
||||
PrintAndLog(" Tag ECC Signature : %s", sprint_hex(data, len));
|
||||
//to do: verify if signature is valid
|
||||
//PrintAndLog("IC signature status: %s valid", (iseccvalid() )?"":"not");
|
||||
PrintAndLog(" Tag ECC Signature : %s", sprint_hex(signature, signature_len));
|
||||
PrintAndLog(" Originality signature check : signature is %svalid", signature_valid?"":"NOT ");
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
|
@ -678,6 +692,7 @@ int CmdHF14AMfUInfo(const char *Cmd){
|
|||
|
||||
uint8_t authlim = 0xff;
|
||||
uint8_t data[16] = {0x00};
|
||||
uint8_t uid[7];
|
||||
iso14a_card_select_t card;
|
||||
int status;
|
||||
bool errors = false;
|
||||
|
|
@ -748,6 +763,8 @@ int CmdHF14AMfUInfo(const char *Cmd){
|
|||
PrintAndLog("Error: tag didn't answer to READ");
|
||||
return status;
|
||||
} else if (status == 16) {
|
||||
memcpy(uid, data, 3);
|
||||
memcpy(uid+3, data+4, 4);
|
||||
ul_print_default(data);
|
||||
ndef_print_CC(data+12);
|
||||
} else {
|
||||
|
|
@ -818,8 +835,9 @@ int CmdHF14AMfUInfo(const char *Cmd){
|
|||
DropField();
|
||||
return status;
|
||||
}
|
||||
if (status == 32) ulev1_print_signature( ulev1_signature, sizeof(ulev1_signature));
|
||||
else {
|
||||
if (status == 32) {
|
||||
ulev1_print_signature(tagtype, uid, ulev1_signature, sizeof(ulev1_signature));
|
||||
} else {
|
||||
// re-select
|
||||
if (!ul_auth_select( &card, tagtype, hasAuthKey, authkeyptr, pack, sizeof(pack))) return -1;
|
||||
}
|
||||
|
|
@ -1827,8 +1845,8 @@ static command_t CommandTable[] =
|
|||
{"rdbl", CmdHF14AMfURdBl, 0, "Read block"},
|
||||
{"wrbl", CmdHF14AMfUWrBl, 0, "Write block"},
|
||||
{"cauth", CmdHF14AMfucAuth, 0, "Authentication - Ultralight C"},
|
||||
{"setpwd", CmdHF14AMfucSetPwd, 1, "Set 3des password - Ultralight-C"},
|
||||
{"setuid", CmdHF14AMfucSetUid, 1, "Set UID - MAGIC tags only"},
|
||||
{"setpwd", CmdHF14AMfucSetPwd, 0, "Set 3des password - Ultralight-C"},
|
||||
{"setuid", CmdHF14AMfucSetUid, 0, "Set UID - MAGIC tags only"},
|
||||
{"gen", CmdHF14AMfuGenDiverseKeys , 1, "Generate 3des mifare diversified keys"},
|
||||
{NULL, NULL, 0, NULL}
|
||||
};
|
||||
|
|
|
|||
|
|
@ -26,6 +26,7 @@
|
|||
#include <crypto/asn1utils.h>
|
||||
#include <util.h>
|
||||
|
||||
|
||||
// NIST Special Publication 800-38A — Recommendation for block cipher modes of operation: methods and techniques, 2001.
|
||||
int aes_encode(uint8_t *iv, uint8_t *key, uint8_t *input, uint8_t *output, int length){
|
||||
uint8_t iiv[16] = {0};
|
||||
|
|
@ -43,6 +44,7 @@ int aes_encode(uint8_t *iv, uint8_t *key, uint8_t *input, uint8_t *output, int l
|
|||
return 0;
|
||||
}
|
||||
|
||||
|
||||
int aes_decode(uint8_t *iv, uint8_t *key, uint8_t *input, uint8_t *output, int length){
|
||||
uint8_t iiv[16] = {0};
|
||||
if (iv)
|
||||
|
|
@ -59,6 +61,7 @@ int aes_decode(uint8_t *iv, uint8_t *key, uint8_t *input, uint8_t *output, int l
|
|||
return 0;
|
||||
}
|
||||
|
||||
|
||||
// NIST Special Publication 800-38B — Recommendation for block cipher modes of operation: The CMAC mode for authentication.
|
||||
// https://csrc.nist.gov/CSRC/media/Projects/Cryptographic-Standards-and-Guidelines/documents/examples/AES_CMAC.pdf
|
||||
int aes_cmac(uint8_t *iv, uint8_t *key, uint8_t *input, uint8_t *mac, int length) {
|
||||
|
|
@ -68,6 +71,7 @@ int aes_cmac(uint8_t *iv, uint8_t *key, uint8_t *input, uint8_t *mac, int length
|
|||
return mbedtls_aes_cmac_prf_128(key, MBEDTLS_AES_BLOCK_SIZE, input, length, mac);
|
||||
}
|
||||
|
||||
|
||||
int aes_cmac8(uint8_t *iv, uint8_t *key, uint8_t *input, uint8_t *mac, int length) {
|
||||
uint8_t cmac[16] = {0};
|
||||
memset(mac, 0x00, 8);
|
||||
|
|
@ -82,7 +86,9 @@ int aes_cmac8(uint8_t *iv, uint8_t *key, uint8_t *input, uint8_t *mac, int lengt
|
|||
return 0;
|
||||
}
|
||||
|
||||
|
||||
static uint8_t fixed_rand_value[250] = {0};
|
||||
|
||||
static int fixed_rand(void *rng_state, unsigned char *output, size_t len) {
|
||||
if (len <= 250) {
|
||||
memcpy(output, fixed_rand_value, len);
|
||||
|
|
@ -93,6 +99,7 @@ static int fixed_rand(void *rng_state, unsigned char *output, size_t len) {
|
|||
return 0;
|
||||
}
|
||||
|
||||
|
||||
int sha256hash(uint8_t *input, int length, uint8_t *hash) {
|
||||
if (!hash || !input)
|
||||
return 1;
|
||||
|
|
@ -107,6 +114,7 @@ int sha256hash(uint8_t *input, int length, uint8_t *hash) {
|
|||
return 0;
|
||||
}
|
||||
|
||||
|
||||
int sha512hash(uint8_t *input, int length, uint8_t *hash) {
|
||||
if (!hash || !input)
|
||||
return 1;
|
||||
|
|
@ -121,14 +129,15 @@ int sha512hash(uint8_t *input, int length, uint8_t *hash) {
|
|||
return 0;
|
||||
}
|
||||
|
||||
int ecdsa_init_str(mbedtls_ecdsa_context *ctx, char * key_d, char *key_x, char *key_y) {
|
||||
|
||||
int ecdsa_init_str(mbedtls_ecdsa_context *ctx, mbedtls_ecp_group_id curveID, char *key_d, char *key_x, char *key_y) {
|
||||
if (!ctx)
|
||||
return 1;
|
||||
|
||||
int res;
|
||||
|
||||
mbedtls_ecdsa_init(ctx);
|
||||
res = mbedtls_ecp_group_load(&ctx->grp, MBEDTLS_ECP_DP_SECP256R1); // secp256r1
|
||||
res = mbedtls_ecp_group_load(&ctx->grp, curveID);
|
||||
if (res)
|
||||
return res;
|
||||
|
||||
|
|
@ -147,25 +156,27 @@ int ecdsa_init_str(mbedtls_ecdsa_context *ctx, char * key_d, char *key_x, char *
|
|||
return 0;
|
||||
}
|
||||
|
||||
int ecdsa_init(mbedtls_ecdsa_context *ctx, uint8_t * key_d, uint8_t *key_xy) {
|
||||
|
||||
int ecdsa_init(mbedtls_ecdsa_context *ctx, mbedtls_ecp_group_id curveID, uint8_t *key_d, uint8_t *key_xy) {
|
||||
if (!ctx)
|
||||
return 1;
|
||||
|
||||
int res;
|
||||
|
||||
mbedtls_ecdsa_init(ctx);
|
||||
res = mbedtls_ecp_group_load(&ctx->grp, MBEDTLS_ECP_DP_SECP256R1); // secp256r1
|
||||
res = mbedtls_ecp_group_load(&ctx->grp, curveID);
|
||||
if (res)
|
||||
return res;
|
||||
|
||||
size_t keylen = (ctx->grp.nbits + 7 ) / 8;
|
||||
if (key_d) {
|
||||
res = mbedtls_mpi_read_binary(&ctx->d, key_d, 32);
|
||||
res = mbedtls_mpi_read_binary(&ctx->d, key_d, keylen);
|
||||
if (res)
|
||||
return res;
|
||||
}
|
||||
|
||||
if (key_xy) {
|
||||
res = mbedtls_ecp_point_read_binary(&ctx->grp, &ctx->Q, key_xy, 32 * 2 + 1);
|
||||
res = mbedtls_ecp_point_read_binary(&ctx->grp, &ctx->Q, key_xy, keylen * 2 + 1);
|
||||
if (res)
|
||||
return res;
|
||||
}
|
||||
|
|
@ -173,10 +184,11 @@ int ecdsa_init(mbedtls_ecdsa_context *ctx, uint8_t * key_d, uint8_t *key_xy) {
|
|||
return 0;
|
||||
}
|
||||
|
||||
int ecdsa_key_create(uint8_t * key_d, uint8_t *key_xy) {
|
||||
|
||||
int ecdsa_key_create(mbedtls_ecp_group_id curveID, uint8_t *key_d, uint8_t *key_xy) {
|
||||
int res;
|
||||
mbedtls_ecdsa_context ctx;
|
||||
ecdsa_init(&ctx, NULL, NULL);
|
||||
ecdsa_init(&ctx, curveID, NULL, NULL);
|
||||
|
||||
|
||||
mbedtls_entropy_context entropy;
|
||||
|
|
@ -190,25 +202,26 @@ int ecdsa_key_create(uint8_t * key_d, uint8_t *key_xy) {
|
|||
if (res)
|
||||
goto exit;
|
||||
|
||||
res = mbedtls_ecdsa_genkey(&ctx, MBEDTLS_ECP_DP_SECP256R1, mbedtls_ctr_drbg_random, &ctr_drbg);
|
||||
res = mbedtls_ecdsa_genkey(&ctx, curveID, mbedtls_ctr_drbg_random, &ctr_drbg);
|
||||
if (res)
|
||||
goto exit;
|
||||
|
||||
res = mbedtls_mpi_write_binary(&ctx.d, key_d, 32);
|
||||
size_t keylen = (ctx.grp.nbits + 7) / 8;
|
||||
res = mbedtls_mpi_write_binary(&ctx.d, key_d, keylen);
|
||||
if (res)
|
||||
goto exit;
|
||||
|
||||
size_t keylen = 0;
|
||||
size_t public_keylen = 0;
|
||||
uint8_t public_key[200] = {0};
|
||||
res = mbedtls_ecp_point_write_binary(&ctx.grp, &ctx.Q, MBEDTLS_ECP_PF_UNCOMPRESSED, &keylen, public_key, sizeof(public_key));
|
||||
res = mbedtls_ecp_point_write_binary(&ctx.grp, &ctx.Q, MBEDTLS_ECP_PF_UNCOMPRESSED, &public_keylen, public_key, sizeof(public_key));
|
||||
if (res)
|
||||
goto exit;
|
||||
|
||||
if (keylen != 65) { // 0x04 <key x 32b><key y 32b>
|
||||
if (public_keylen != 1 + 2 * keylen) { // 0x04 <key x><key y>
|
||||
res = 1;
|
||||
goto exit;
|
||||
}
|
||||
memcpy(key_xy, public_key, 65);
|
||||
memcpy(key_xy, public_key, public_keylen);
|
||||
|
||||
exit:
|
||||
mbedtls_entropy_free(&entropy);
|
||||
|
|
@ -217,6 +230,7 @@ exit:
|
|||
return res;
|
||||
}
|
||||
|
||||
|
||||
char *ecdsa_get_error(int ret) {
|
||||
static char retstr[300];
|
||||
memset(retstr, 0x00, sizeof(retstr));
|
||||
|
|
@ -224,32 +238,38 @@ char *ecdsa_get_error(int ret) {
|
|||
return retstr;
|
||||
}
|
||||
|
||||
int ecdsa_public_key_from_pk(mbedtls_pk_context *pk, uint8_t *key, size_t keylen) {
|
||||
|
||||
int ecdsa_public_key_from_pk(mbedtls_pk_context *pk, mbedtls_ecp_group_id curveID, uint8_t *key, size_t keylen) {
|
||||
int res = 0;
|
||||
size_t realkeylen = 0;
|
||||
if (keylen < 65)
|
||||
return 1;
|
||||
|
||||
mbedtls_ecdsa_context ctx;
|
||||
mbedtls_ecdsa_init(&ctx);
|
||||
|
||||
res = mbedtls_ecp_group_load(&ctx.grp, MBEDTLS_ECP_DP_SECP256R1); // secp256r1
|
||||
res = mbedtls_ecp_group_load(&ctx.grp, curveID);
|
||||
if (res)
|
||||
goto exit;
|
||||
|
||||
size_t private_keylen = (ctx.grp.nbits + 7) / 8;
|
||||
if (keylen < 1 + 2 * private_keylen) {
|
||||
res = 1;
|
||||
goto exit;
|
||||
}
|
||||
|
||||
res = mbedtls_ecdsa_from_keypair(&ctx, mbedtls_pk_ec(*pk) );
|
||||
if (res)
|
||||
goto exit;
|
||||
|
||||
res = mbedtls_ecp_point_write_binary(&ctx.grp, &ctx.Q, MBEDTLS_ECP_PF_UNCOMPRESSED, &realkeylen, key, keylen);
|
||||
if (realkeylen != 65)
|
||||
if (realkeylen != 1 + 2 * private_keylen)
|
||||
res = 2;
|
||||
exit:
|
||||
mbedtls_ecdsa_free(&ctx);
|
||||
return res;
|
||||
}
|
||||
|
||||
int ecdsa_signature_create(uint8_t *key_d, uint8_t *key_xy, uint8_t *input, int length, uint8_t *signature, size_t *signaturelen) {
|
||||
|
||||
int ecdsa_signature_create(mbedtls_ecp_group_id curveID, uint8_t *key_d, uint8_t *key_xy, uint8_t *input, int length, uint8_t *signature, size_t *signaturelen, bool hash) {
|
||||
int res;
|
||||
*signaturelen = 0;
|
||||
|
||||
|
|
@ -270,8 +290,8 @@ int ecdsa_signature_create(uint8_t *key_d, uint8_t *key_xy, uint8_t *input, int
|
|||
goto exit;
|
||||
|
||||
mbedtls_ecdsa_context ctx;
|
||||
ecdsa_init(&ctx, key_d, key_xy);
|
||||
res = mbedtls_ecdsa_write_signature(&ctx, MBEDTLS_MD_SHA256, shahash, sizeof(shahash), signature, signaturelen, mbedtls_ctr_drbg_random, &ctr_drbg);
|
||||
ecdsa_init(&ctx, curveID, key_d, key_xy);
|
||||
res = mbedtls_ecdsa_write_signature(&ctx, MBEDTLS_MD_SHA256, hash?shahash:input, hash?sizeof(shahash):length, signature, signaturelen, mbedtls_ctr_drbg_random, &ctr_drbg);
|
||||
|
||||
exit:
|
||||
mbedtls_ctr_drbg_free(&ctr_drbg);
|
||||
|
|
@ -279,7 +299,8 @@ exit:
|
|||
return res;
|
||||
}
|
||||
|
||||
int ecdsa_signature_create_test(char * key_d, char *key_x, char *key_y, char *random, uint8_t *input, int length, uint8_t *signature, size_t *signaturelen) {
|
||||
|
||||
int ecdsa_signature_create_test(mbedtls_ecp_group_id curveID, char *key_d, char *key_x, char *key_y, char *random, uint8_t *input, int length, uint8_t *signature, size_t *signaturelen) {
|
||||
int res;
|
||||
*signaturelen = 0;
|
||||
|
||||
|
|
@ -292,14 +313,15 @@ int ecdsa_signature_create_test(char * key_d, char *key_x, char *key_y, char *ra
|
|||
param_gethex_to_eol(random, 0, fixed_rand_value, sizeof(fixed_rand_value), &rndlen);
|
||||
|
||||
mbedtls_ecdsa_context ctx;
|
||||
ecdsa_init_str(&ctx, key_d, key_x, key_y);
|
||||
ecdsa_init_str(&ctx, curveID, key_d, key_x, key_y);
|
||||
res = mbedtls_ecdsa_write_signature(&ctx, MBEDTLS_MD_SHA256, shahash, sizeof(shahash), signature, signaturelen, fixed_rand, NULL);
|
||||
|
||||
mbedtls_ecdsa_free(&ctx);
|
||||
return res;
|
||||
}
|
||||
|
||||
int ecdsa_signature_verify_keystr(char *key_x, char *key_y, uint8_t *input, int length, uint8_t *signature, size_t signaturelen) {
|
||||
|
||||
int ecdsa_signature_verify_keystr(mbedtls_ecp_group_id curveID, char *key_x, char *key_y, uint8_t *input, int length, uint8_t *signature, size_t signaturelen, bool hash) {
|
||||
int res;
|
||||
uint8_t shahash[32] = {0};
|
||||
res = sha256hash(input, length, shahash);
|
||||
|
|
@ -307,28 +329,58 @@ int ecdsa_signature_verify_keystr(char *key_x, char *key_y, uint8_t *input, int
|
|||
return res;
|
||||
|
||||
mbedtls_ecdsa_context ctx;
|
||||
ecdsa_init_str(&ctx, NULL, key_x, key_y);
|
||||
res = mbedtls_ecdsa_read_signature(&ctx, shahash, sizeof(shahash), signature, signaturelen);
|
||||
ecdsa_init_str(&ctx, curveID, NULL, key_x, key_y);
|
||||
res = mbedtls_ecdsa_read_signature(&ctx, hash?shahash:input, hash?sizeof(shahash):length, signature, signaturelen);
|
||||
|
||||
mbedtls_ecdsa_free(&ctx);
|
||||
return res;
|
||||
}
|
||||
|
||||
int ecdsa_signature_verify(uint8_t *key_xy, uint8_t *input, int length, uint8_t *signature, size_t signaturelen) {
|
||||
|
||||
int ecdsa_signature_verify(mbedtls_ecp_group_id curveID, uint8_t *key_xy, uint8_t *input, int length, uint8_t *signature, size_t signaturelen, bool hash) {
|
||||
int res;
|
||||
uint8_t shahash[32] = {0};
|
||||
if (hash) {
|
||||
res = sha256hash(input, length, shahash);
|
||||
if (res)
|
||||
return res;
|
||||
}
|
||||
|
||||
mbedtls_ecdsa_context ctx;
|
||||
ecdsa_init(&ctx, NULL, key_xy);
|
||||
res = mbedtls_ecdsa_read_signature(&ctx, shahash, sizeof(shahash), signature, signaturelen);
|
||||
res = ecdsa_init(&ctx, curveID, NULL, key_xy);
|
||||
res = mbedtls_ecdsa_read_signature(&ctx, hash?shahash:input, hash?sizeof(shahash):length, signature, signaturelen);
|
||||
|
||||
mbedtls_ecdsa_free(&ctx);
|
||||
return res;
|
||||
}
|
||||
|
||||
|
||||
int ecdsa_signature_r_s_verify(mbedtls_ecp_group_id curveID, uint8_t *key_xy, uint8_t *input, int length, uint8_t *r_s, size_t r_s_len, bool hash) {
|
||||
int res;
|
||||
uint8_t signature[MBEDTLS_ECDSA_MAX_LEN];
|
||||
size_t signature_len;
|
||||
|
||||
// convert r & s to ASN.1 signature
|
||||
mbedtls_mpi r, s;
|
||||
mbedtls_mpi_init(&r);
|
||||
mbedtls_mpi_init(&s);
|
||||
mbedtls_mpi_read_binary(&r, r_s, r_s_len/2);
|
||||
mbedtls_mpi_read_binary(&s, r_s + r_s_len/2, r_s_len/2);
|
||||
|
||||
res = ecdsa_signature_to_asn1(&r, &s, signature, &signature_len);
|
||||
if (res < 0) {
|
||||
return res;
|
||||
}
|
||||
|
||||
res = ecdsa_signature_verify(curveID, key_xy, input, length, signature, signature_len, hash);
|
||||
|
||||
mbedtls_mpi_free(&r);
|
||||
mbedtls_mpi_free(&s);
|
||||
|
||||
return res;
|
||||
}
|
||||
|
||||
|
||||
#define T_PRIVATE_KEY "C477F9F65C22CCE20657FAA5B2D1D8122336F851A508A1ED04E479C34985BF96"
|
||||
#define T_Q_X "B7E08AFDFE94BAD3F1DC8C734798BA1C62B3A0AD1E9EA2A38201CD0889BC7A19"
|
||||
#define T_Q_Y "3603F747959DBF7A4BB226E41928729063ADC7AE43529E61B563BBC606CC5E09"
|
||||
|
|
@ -339,6 +391,7 @@ int ecdsa_signature_verify(uint8_t *key_xy, uint8_t *input, int length, uint8_t
|
|||
int ecdsa_nist_test(bool verbose) {
|
||||
int res;
|
||||
uint8_t input[] = "Example of ECDSA with P-256";
|
||||
mbedtls_ecp_group_id curveID = MBEDTLS_ECP_DP_SECP256R1;
|
||||
int length = strlen((char *)input);
|
||||
uint8_t signature[300] = {0};
|
||||
size_t siglen = 0;
|
||||
|
|
@ -347,7 +400,7 @@ int ecdsa_nist_test(bool verbose) {
|
|||
if (verbose)
|
||||
printf(" ECDSA NIST test: ");
|
||||
// make signature
|
||||
res = ecdsa_signature_create_test(T_PRIVATE_KEY, T_Q_X, T_Q_Y, T_K, input, length, signature, &siglen);
|
||||
res = ecdsa_signature_create_test(curveID, T_PRIVATE_KEY, T_Q_X, T_Q_Y, T_K, input, length, signature, &siglen);
|
||||
// printf("res: %x signature[%x]: %s\n", (res<0)?-res:res, siglen, sprint_hex(signature, siglen));
|
||||
if (res)
|
||||
goto exit;
|
||||
|
|
@ -371,13 +424,13 @@ int ecdsa_nist_test(bool verbose) {
|
|||
}
|
||||
|
||||
// verify signature
|
||||
res = ecdsa_signature_verify_keystr(T_Q_X, T_Q_Y, input, length, signature, siglen);
|
||||
res = ecdsa_signature_verify_keystr(curveID, T_Q_X, T_Q_Y, input, length, signature, siglen, true);
|
||||
if (res)
|
||||
goto exit;
|
||||
|
||||
// verify wrong signature
|
||||
input[0] ^= 0xFF;
|
||||
res = ecdsa_signature_verify_keystr(T_Q_X, T_Q_Y, input, length, signature, siglen);
|
||||
res = ecdsa_signature_verify_keystr(curveID, T_Q_X, T_Q_Y, input, length, signature, siglen, true);
|
||||
if (!res) {
|
||||
res = 1;
|
||||
goto exit;
|
||||
|
|
@ -394,20 +447,20 @@ int ecdsa_nist_test(bool verbose) {
|
|||
memset(signature, 0x00, sizeof(signature));
|
||||
siglen = 0;
|
||||
|
||||
res = ecdsa_key_create(key_d, key_xy);
|
||||
res = ecdsa_key_create(curveID, key_d, key_xy);
|
||||
if (res)
|
||||
goto exit;
|
||||
|
||||
res = ecdsa_signature_create(key_d, key_xy, input, length, signature, &siglen);
|
||||
res = ecdsa_signature_create(curveID, key_d, key_xy, input, length, signature, &siglen, true);
|
||||
if (res)
|
||||
goto exit;
|
||||
|
||||
res = ecdsa_signature_verify(key_xy, input, length, signature, siglen);
|
||||
res = ecdsa_signature_verify(curveID, key_xy, input, length, signature, siglen, true);
|
||||
if (res)
|
||||
goto exit;
|
||||
|
||||
input[0] ^= 0xFF;
|
||||
res = ecdsa_signature_verify(key_xy, input, length, signature, siglen);
|
||||
res = ecdsa_signature_verify(curveID, key_xy, input, length, signature, siglen, true);
|
||||
if (!res)
|
||||
goto exit;
|
||||
|
||||
|
|
|
|||
|
|
@ -24,10 +24,11 @@ extern int aes_cmac8(uint8_t *iv, uint8_t *key, uint8_t *input, uint8_t *mac, in
|
|||
extern int sha256hash(uint8_t *input, int length, uint8_t *hash);
|
||||
extern int sha512hash(uint8_t *input, int length, uint8_t *hash);
|
||||
|
||||
extern int ecdsa_key_create(uint8_t * key_d, uint8_t *key_xy);
|
||||
extern int ecdsa_public_key_from_pk(mbedtls_pk_context *pk, uint8_t *key, size_t keylen);
|
||||
extern int ecdsa_signature_create(uint8_t *key_d, uint8_t *key_xy, uint8_t *input, int length, uint8_t *signature, size_t *signaturelen);
|
||||
extern int ecdsa_signature_verify(uint8_t *key_xy, uint8_t *input, int length, uint8_t *signature, size_t signaturelen);
|
||||
extern int ecdsa_key_create(mbedtls_ecp_group_id curveID, uint8_t * key_d, uint8_t *key_xy);
|
||||
extern int ecdsa_public_key_from_pk(mbedtls_pk_context *pk, mbedtls_ecp_group_id curveID, uint8_t *key, size_t keylen);
|
||||
extern int ecdsa_signature_create(mbedtls_ecp_group_id curveID, uint8_t *key_d, uint8_t *key_xy, uint8_t *input, int length, uint8_t *signature, size_t *signaturelen, bool hash);
|
||||
extern int ecdsa_signature_verify(mbedtls_ecp_group_id curveID, uint8_t *key_xy, uint8_t *input, int length, uint8_t *signature, size_t signaturelen, bool hash);
|
||||
extern int ecdsa_signature_r_s_verify(mbedtls_ecp_group_id curveID, uint8_t *key_xy, uint8_t *input, int length, uint8_t *r_s, size_t r_s_len, bool hash);
|
||||
extern char *ecdsa_get_error(int ret);
|
||||
|
||||
extern int ecdsa_nist_test(bool verbose);
|
||||
|
|
|
|||
|
|
@ -279,7 +279,7 @@ int FIDOCheckDERAndGetKey(uint8_t *der, size_t derLen, bool verbose, uint8_t *pu
|
|||
}
|
||||
|
||||
// get public key
|
||||
res = ecdsa_public_key_from_pk(&cert.pk, publicKey, publicKeyMaxLen);
|
||||
res = ecdsa_public_key_from_pk(&cert.pk, MBEDTLS_ECP_DP_SECP256R1, publicKey, publicKeyMaxLen);
|
||||
if (res) {
|
||||
PrintAndLog("ERROR: getting public key from certificate 0x%x - %s", (res<0)?-res:res, ecdsa_get_error(res));
|
||||
} else {
|
||||
|
|
@ -396,9 +396,9 @@ int FIDO2CheckSignature(json_t *root, uint8_t *publickey, uint8_t *sign, size_t
|
|||
clientDataHash, 32, // Hash of the serialized client data. "$.ClientDataHash" from json
|
||||
NULL, 0);
|
||||
//PrintAndLog("--xbuf(%d)[%d]: %s", res, xbuflen, sprint_hex(xbuf, xbuflen));
|
||||
res = ecdsa_signature_verify(publickey, xbuf, xbuflen, sign, signLen);
|
||||
res = ecdsa_signature_verify(MBEDTLS_ECP_DP_SECP256R1, publickey, xbuf, xbuflen, sign, signLen, true);
|
||||
if (res) {
|
||||
if (res == -0x4e00) {
|
||||
if (res == MBEDTLS_ERR_ECP_VERIFY_FAILED) {
|
||||
PrintAndLog("Signature is NOT VALID.");
|
||||
} else {
|
||||
PrintAndLog("Other signature check error: %x %s", (res<0)?-res:res, ecdsa_get_error(res));
|
||||
|
|
|
|||
|
|
@ -115,6 +115,7 @@
|
|||
#endif
|
||||
|
||||
#if defined(MBEDTLS_ECP_C) && ( !defined(MBEDTLS_BIGNUM_C) || ( \
|
||||
!defined(MBEDTLS_ECP_DP_SECP128R1_ENABLED) && \
|
||||
!defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) && \
|
||||
!defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) && \
|
||||
!defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) && \
|
||||
|
|
|
|||
|
|
@ -645,6 +645,7 @@
|
|||
*
|
||||
* Comment macros to disable the curve and functions for it
|
||||
*/
|
||||
#define MBEDTLS_ECP_DP_SECP128R1_ENABLED
|
||||
#define MBEDTLS_ECP_DP_SECP192R1_ENABLED
|
||||
#define MBEDTLS_ECP_DP_SECP224R1_ENABLED
|
||||
#define MBEDTLS_ECP_DP_SECP256R1_ENABLED
|
||||
|
|
|
|||
|
|
@ -291,7 +291,7 @@ cleanup:
|
|||
/*
|
||||
* Convert a signature (given by context) to ASN.1
|
||||
*/
|
||||
static int ecdsa_signature_to_asn1( const mbedtls_mpi *r, const mbedtls_mpi *s,
|
||||
int ecdsa_signature_to_asn1( const mbedtls_mpi *r, const mbedtls_mpi *s,
|
||||
unsigned char *sig, size_t *slen )
|
||||
{
|
||||
int ret;
|
||||
|
|
|
|||
|
|
@ -334,6 +334,8 @@ void mbedtls_ecdsa_init( mbedtls_ecdsa_context *ctx );
|
|||
*/
|
||||
void mbedtls_ecdsa_free( mbedtls_ecdsa_context *ctx );
|
||||
|
||||
int ecdsa_signature_to_asn1( const mbedtls_mpi *r, const mbedtls_mpi *s, unsigned char *sig, size_t *slen );
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
|
|
|||
|
|
@ -84,7 +84,8 @@
|
|||
static unsigned long add_count, dbl_count, mul_count;
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) || \
|
||||
#if defined(MBEDTLS_ECP_DP_SECP128R1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) || \
|
||||
|
|
@ -159,6 +160,9 @@ static const mbedtls_ecp_curve_info ecp_supported_curves[] =
|
|||
#endif
|
||||
#if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED)
|
||||
{ MBEDTLS_ECP_DP_SECP192K1, 18, 192, "secp192k1" },
|
||||
#endif
|
||||
#if defined(MBEDTLS_ECP_DP_SECP128R1_ENABLED)
|
||||
{ MBEDTLS_ECP_DP_SECP128R1, 0xFE00, 128, "secp128r1" },
|
||||
#endif
|
||||
{ MBEDTLS_ECP_DP_NONE, 0, 0, NULL },
|
||||
};
|
||||
|
|
|
|||
|
|
@ -82,6 +82,7 @@ typedef enum
|
|||
MBEDTLS_ECP_DP_SECP224K1, /*!< Domain parameters for 224-bit "Koblitz" curve. */
|
||||
MBEDTLS_ECP_DP_SECP256K1, /*!< Domain parameters for 256-bit "Koblitz" curve. */
|
||||
MBEDTLS_ECP_DP_CURVE448, /*!< Domain parameters for Curve448. */
|
||||
MBEDTLS_ECP_DP_SECP128R1, /*!< Domain parameters for the 128-bit curve used for NXP originality check. */
|
||||
} mbedtls_ecp_group_id;
|
||||
|
||||
/**
|
||||
|
|
|
|||
|
|
@ -84,6 +84,42 @@
|
|||
* to be directly usable in MPIs
|
||||
*/
|
||||
|
||||
/*
|
||||
* Domain parameters for secp128r1
|
||||
*/
|
||||
#if defined(MBEDTLS_ECP_DP_SECP128R1_ENABLED)
|
||||
static const mbedtls_mpi_uint secp128r1_p[] = {
|
||||
// 2^128 - 2^97 - 1 // TODO
|
||||
BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFD, 0xFF, 0xFF, 0xFF ),
|
||||
};
|
||||
static const mbedtls_mpi_uint secp128r1_a[] = {
|
||||
// FFFFFFFDFFFFFFFF FFFFFFFFFFFFFFFC
|
||||
BYTES_TO_T_UINT_8( 0xFC, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
|
||||
BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFD, 0xFF, 0xFF, 0xFF ),
|
||||
};
|
||||
static const mbedtls_mpi_uint secp128r1_b[] = {
|
||||
// E87579C11079F43D D824993C2CEE5ED3
|
||||
BYTES_TO_T_UINT_8( 0xD3, 0x5E, 0xEE, 0x2C, 0x3C, 0x99, 0x24, 0xD8 ),
|
||||
BYTES_TO_T_UINT_8( 0x3D, 0xF4, 0x79, 0x10, 0xC1, 0x79, 0x75, 0xE8 ),
|
||||
};
|
||||
static const mbedtls_mpi_uint secp128r1_gx[] = {
|
||||
// 161FF7528B899B2D 0C28607CA52C5B86
|
||||
BYTES_TO_T_UINT_8( 0x86, 0x5B, 0x2C, 0xA5, 0x7C, 0x60, 0x28, 0x0C ),
|
||||
BYTES_TO_T_UINT_8( 0x2D, 0x9B, 0x89, 0x8B, 0x52, 0xF7, 0x1F, 0x16 ),
|
||||
};
|
||||
static const mbedtls_mpi_uint secp128r1_gy[] = {
|
||||
// CF5AC8395BAFEB13 C02DA292DDED7A83
|
||||
BYTES_TO_T_UINT_8( 0x83, 0x7A, 0xED, 0xDD, 0x92, 0xA2, 0x2D, 0xC0 ),
|
||||
BYTES_TO_T_UINT_8( 0x13, 0xEB, 0xAF, 0x5B, 0x39, 0xC8, 0x5A, 0xCF ),
|
||||
};
|
||||
static const mbedtls_mpi_uint secp128r1_n[] = {
|
||||
// FFFFFFFE00000000 75A30D1B9038A115
|
||||
BYTES_TO_T_UINT_8( 0x15, 0xA1, 0x38, 0x90, 0x1B, 0x0D, 0xA3, 0x75 ),
|
||||
BYTES_TO_T_UINT_8( 0x00, 0x00, 0x00, 0x00, 0xFE, 0xFF, 0xFF, 0xFF ),
|
||||
};
|
||||
#endif /* MBEDTLS_ECP_DP_SECP128R1_ENABLED */
|
||||
|
||||
/*
|
||||
* Domain parameters for secp192r1
|
||||
*/
|
||||
|
|
@ -754,6 +790,11 @@ int mbedtls_ecp_group_load( mbedtls_ecp_group *grp, mbedtls_ecp_group_id id )
|
|||
|
||||
switch( id )
|
||||
{
|
||||
#if defined(MBEDTLS_ECP_DP_SECP128R1_ENABLED)
|
||||
case MBEDTLS_ECP_DP_SECP128R1:
|
||||
grp->modp = NULL;
|
||||
return( LOAD_GROUP_A( secp128r1 ) );
|
||||
#endif /* MBEDTLS_ECP_DP_SECP128R1_ENABLED */
|
||||
#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED)
|
||||
case MBEDTLS_ECP_DP_SECP192R1:
|
||||
NIST_MODP( p192 );
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue