General tidy up of existing code, and add first half of DSA support for

CryptoSwift (this currently only does signing, verification will be
hooked in shortly).

diff --git a/crypto/engine/engine.h b/crypto/engine/engine.h
index a85776a8e6e75de5c0abe81ea1410df581dd6e07..4d625887116d185e69a98b621c8267763f5ec7a9 100644 (file)
--- a/crypto/engine/engine.h
+++ b/crypto/engine/engine.h
@@ -252,6 +252,7 @@ void ERR_load_ENGINE_strings(void);
 /* Error codes for the ENGINE functions. */
 
 /* Function codes. */
+#define ENGINE_F_CSWIFT_DSA_SIGN                        133
 #define ENGINE_F_CSWIFT_FINISH                          100
 #define ENGINE_F_CSWIFT_INIT                            101
 #define ENGINE_F_CSWIFT_MOD_EXP                                 102

diff --git a/crypto/engine/engine_err.c b/crypto/engine/engine_err.c
index 2ba0d301a603fb0bb86a08a69f071599e82bad7c..ff58ef2d0e8e9d52b88012201a72f6e9217cd58d 100644 (file)
--- a/crypto/engine/engine_err.c
+++ b/crypto/engine/engine_err.c
@@ -66,11 +66,12 @@
 #ifndef NO_ERR
 static ERR_STRING_DATA ENGINE_str_functs[]=
        {
-{ERR_PACK(0,ENGINE_F_CSWIFT_FINISH,0), "CSWIFT_FINISH"},
-{ERR_PACK(0,ENGINE_F_CSWIFT_INIT,0),   "CSWIFT_INIT"},
-{ERR_PACK(0,ENGINE_F_CSWIFT_MOD_EXP,0),        "CSWIFT_MOD_EXP"},
-{ERR_PACK(0,ENGINE_F_CSWIFT_MOD_EXP_CRT,0),    "CSWIFT_MOD_EXP_CRT"},
-{ERR_PACK(0,ENGINE_F_CSWIFT_RSA_MOD_EXP,0),    "CSWIFT_RSA_MOD_EXP"},
+{ERR_PACK(0,ENGINE_F_CSWIFT_DSA_SIGN,0),       "cswift_dsa_sign"},
+{ERR_PACK(0,ENGINE_F_CSWIFT_FINISH,0), "cswift_finish"},
+{ERR_PACK(0,ENGINE_F_CSWIFT_INIT,0),   "cswift_init"},
+{ERR_PACK(0,ENGINE_F_CSWIFT_MOD_EXP,0),        "cswift_mod_exp"},
+{ERR_PACK(0,ENGINE_F_CSWIFT_MOD_EXP_CRT,0),    "cswift_mod_exp_crt"},
+{ERR_PACK(0,ENGINE_F_CSWIFT_RSA_MOD_EXP,0),    "cswift_rsa_mod_exp"},
 {ERR_PACK(0,ENGINE_F_ENGINE_ADD,0),    "ENGINE_add"},
 {ERR_PACK(0,ENGINE_F_ENGINE_BY_ID,0),  "ENGINE_by_id"},
 {ERR_PACK(0,ENGINE_F_ENGINE_FINISH,0), "ENGINE_finish"},
@@ -86,13 +87,13 @@ static ERR_STRING_DATA ENGINE_str_functs[]=
 {ERR_PACK(0,ENGINE_F_ENGINE_GET_RAND,0),       "ENGINE_get_RAND"},
 {ERR_PACK(0,ENGINE_F_ENGINE_GET_RSA,0),        "ENGINE_get_RSA"},
 {ERR_PACK(0,ENGINE_F_ENGINE_INIT,0),   "ENGINE_init"},
-{ERR_PACK(0,ENGINE_F_ENGINE_LIST_ADD,0),       "ENGINE_LIST_ADD"},
-{ERR_PACK(0,ENGINE_F_ENGINE_LIST_REMOVE,0),    "ENGINE_LIST_REMOVE"},
+{ERR_PACK(0,ENGINE_F_ENGINE_LIST_ADD,0),       "ENGINE_list_add"},
+{ERR_PACK(0,ENGINE_F_ENGINE_LIST_REMOVE,0),    "ENGINE_list_remove"},
 {ERR_PACK(0,ENGINE_F_ENGINE_NEW,0),    "ENGINE_new"},
 {ERR_PACK(0,ENGINE_F_ENGINE_REMOVE,0), "ENGINE_remove"},
 {ERR_PACK(0,ENGINE_F_ENGINE_SET_BN_MOD_EXP,0), "ENGINE_set_BN_mod_exp"},
 {ERR_PACK(0,ENGINE_F_ENGINE_SET_BN_MOD_EXP_CRT,0),     "ENGINE_set_BN_mod_exp_crt"},
-{ERR_PACK(0,ENGINE_F_ENGINE_SET_DEFAULT_TYPE,0),       "ENGINE_SET_DEFAULT_TYPE"},
+{ERR_PACK(0,ENGINE_F_ENGINE_SET_DEFAULT_TYPE,0),       "engine_set_default_type"},
 {ERR_PACK(0,ENGINE_F_ENGINE_SET_DH,0), "ENGINE_set_DH"},
 {ERR_PACK(0,ENGINE_F_ENGINE_SET_DSA,0),        "ENGINE_set_DSA"},
 {ERR_PACK(0,ENGINE_F_ENGINE_SET_ID,0), "ENGINE_set_id"},

diff --git a/crypto/engine/hw_cswift.c b/crypto/engine/hw_cswift.c
index dc160ff5370cb86e9bc5ebfd0d0b4dfad7a5c106..27ff72e50f0fb95f794c830ff6c200da81096923 100644 (file)
--- a/crypto/engine/hw_cswift.c
+++ b/crypto/engine/hw_cswift.c
@@ -82,20 +82,30 @@
 static int cswift_init();
 static int cswift_finish();
 
+/* BIGNUM stuff */
 static int cswift_mod_exp(BIGNUM *r, BIGNUM *a, const BIGNUM *p,
                const BIGNUM *m, BN_CTX *ctx);
 static int cswift_mod_exp_crt(BIGNUM *r, BIGNUM *a, const BIGNUM *p,
                const BIGNUM *q, const BIGNUM *dmp1, const BIGNUM *dmq1,
                const BIGNUM *iqmp, BN_CTX *ctx);
 
+/* RSA stuff */
 static int cswift_rsa_mod_exp(BIGNUM *r0, BIGNUM *I, RSA *rsa);
 /* This function is aliased to mod_exp (with the mont stuff dropped). */
 static int cswift_mod_exp_mont(BIGNUM *r, BIGNUM *a, const BIGNUM *p,
                const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
+
+/* DSA stuff */
+static DSA_SIG *cswift_dsa_sign(const unsigned char *dgst, int dlen, DSA *dsa);
+static int cswift_dsa_verify(const unsigned char *dgst, int dgst_len,
+                               DSA_SIG *sig, DSA *dsa);
+
+/* DH stuff */
 /* This function is alised to mod_exp (with the DH and mont dropped). */
 static int cswift_mod_exp_dh(DH *dh, BIGNUM *r, BIGNUM *a, const BIGNUM *p,
                const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
 
+
 /* Our internal RSA_METHOD that we provide pointers to */
 static RSA_METHOD cswift_rsa =
        {
@@ -114,6 +124,21 @@ static RSA_METHOD cswift_rsa =
        NULL
        };
 
+/* Our internal DSA_METHOD that we provide pointers to */
+static DSA_METHOD cswift_dsa =
+       {
+       "CryptoSwift DSA method",
+       cswift_dsa_sign,
+       NULL, /* dsa_sign_setup */
+       cswift_dsa_verify,
+       NULL, /* dsa_mod_exp */
+       NULL, /* bn_mod_exp */
+       NULL, /* init */
+       NULL, /* finish */
+       0, /* flags */
+       NULL /* app_data */
+       };
+
 /* Our internal DH_METHOD that we provide pointers to */
 static DH_METHOD cswift_dh =
        {
@@ -133,7 +158,7 @@ static ENGINE engine_cswift =
        "cswift",
        "CryptoSwift hardware engine support",
        &cswift_rsa,
-       NULL,
+       &cswift_dsa,
        &cswift_dh,
        NULL,
        cswift_mod_exp,
@@ -374,22 +399,18 @@ static int cswift_mod_exp_crt(BIGNUM *r, BIGNUM *a, const BIGNUM *p,
                        const BIGNUM *q, const BIGNUM *dmp1,
                        const BIGNUM *dmq1, const BIGNUM *iqmp, BN_CTX *ctx)
        {
-       BIGNUM *rsa_p;
-       BIGNUM *rsa_q;
-       BIGNUM *rsa_dmp1;
-       BIGNUM *rsa_dmq1;
-       BIGNUM *rsa_iqmp;
-       BIGNUM *argument;
-       BIGNUM *result;
        SW_LARGENUMBER arg, res;
        SW_PARAM sw_param;
        SW_CONTEXT_HANDLE hac;
-       int to_return, acquired;
- 
-       rsa_p = rsa_q = rsa_dmp1 = rsa_dmq1 = rsa_iqmp =
-               argument = result = NULL;
-       to_return = 0; /* expect failure */
-       acquired = 0;
+       BIGNUM *rsa_p = NULL;
+       BIGNUM *rsa_q = NULL;
+       BIGNUM *rsa_dmp1 = NULL;
+       BIGNUM *rsa_dmq1 = NULL;
+       BIGNUM *rsa_iqmp = NULL;
+       BIGNUM *argument = NULL;
+       BIGNUM *result = NULL;
+       int to_return = 0; /* expect failure */
+       int acquired = 0;
  
        if(!get_context(&hac))
                {
@@ -497,6 +518,116 @@ static int cswift_mod_exp_mont(BIGNUM *r, BIGNUM *a, const BIGNUM *p,
        return cswift_mod_exp(r, a, p, m, ctx);
        }
 
+static DSA_SIG *cswift_dsa_sign(const unsigned char *dgst, int dlen, DSA *dsa)
+       {
+       SW_CONTEXT_HANDLE hac;
+       SW_PARAM sw_param;
+       SW_STATUS sw_status;
+       SW_LARGENUMBER arg, res;
+       unsigned char *ptr;
+       BN_CTX *ctx;
+       BIGNUM *dsa_p = NULL;
+       BIGNUM *dsa_q = NULL;
+       BIGNUM *dsa_g = NULL;
+       BIGNUM *dsa_key = NULL;
+       BIGNUM *result = NULL;
+       DSA_SIG *to_return = NULL;
+       int acquired = 0;
+
+       if((ctx = BN_CTX_new()) == NULL)
+               goto err;
+       if(!get_context(&hac))
+               {
+               ENGINEerr(ENGINE_F_CSWIFT_DSA_SIGN,ENGINE_R_GET_HANDLE_FAILED);
+               goto err;
+               }
+       acquired = 1;
+       /* Prepare the params */
+       dsa_p = BN_CTX_get(ctx);
+       dsa_q = BN_CTX_get(ctx);
+       dsa_g = BN_CTX_get(ctx);
+       dsa_key = BN_CTX_get(ctx);
+       result = BN_CTX_get(ctx);
+       if(!dsa_p || !dsa_q || !dsa_g || !dsa_key || !result)
+               {
+               ENGINEerr(ENGINE_F_CSWIFT_DSA_SIGN,ENGINE_R_BN_CTX_FULL);
+               goto err;
+               }
+       if(!bn_wexpand(dsa_p, dsa->p->top) ||
+                       !bn_wexpand(dsa_q, dsa->q->top) ||
+                       !bn_wexpand(dsa_g, dsa->g->top) ||
+                       !bn_wexpand(dsa_key, dsa->priv_key->top) ||
+                       !bn_wexpand(result, dsa->p->top))
+               {
+               ENGINEerr(ENGINE_F_CSWIFT_DSA_SIGN,ENGINE_R_BN_EXPAND_FAIL);
+               goto err;
+               }
+       sw_param.type = SW_ALG_DSA;
+       sw_param.up.dsa.p.nbytes = BN_bn2bin(dsa->p,
+                               (unsigned char *)dsa_p->d);
+       sw_param.up.dsa.p.value = (unsigned char *)dsa_p->d;
+       sw_param.up.dsa.q.nbytes = BN_bn2bin(dsa->q,
+                               (unsigned char *)dsa_q->d);
+       sw_param.up.dsa.q.value = (unsigned char *)dsa_q->d;
+       sw_param.up.dsa.g.nbytes = BN_bn2bin(dsa->g,
+                               (unsigned char *)dsa_g->d);
+       sw_param.up.dsa.g.value = (unsigned char *)dsa_g->d;
+       sw_param.up.dsa.key.nbytes = BN_bn2bin(dsa->priv_key,
+                               (unsigned char *)dsa_key->d);
+       sw_param.up.dsa.key.value = (unsigned char *)dsa_key->d;
+       /* Attach the key params */
+       if(p_CSwift_AttachKeyParam(hac, &sw_param) != SW_OK)
+               {
+               ENGINEerr(ENGINE_F_CSWIFT_DSA_SIGN,ENGINE_R_PROVIDE_PARAMETERS);
+               goto err;
+               }
+       /* Prepare the argument and response */
+       arg.nbytes = dlen;
+       arg.value = (unsigned char *)dgst;
+       res.nbytes = BN_num_bytes(dsa->p);
+       memset(result->d, 0, res.nbytes);
+       res.value = (unsigned char *)result->d;
+       /* Perform the operation */
+       sw_status = p_CSwift_SimpleRequest(hac, SW_CMD_DSS_SIGN, &arg, 1,
+                       &res, 1);
+       if(sw_status != SW_OK)
+               {
+               ENGINEerr(ENGINE_F_CSWIFT_DSA_SIGN,ENGINE_R_REQUEST_FAILED);
+               goto err;
+               }
+       /* Convert the response */
+       ptr = (unsigned char *)result->d;
+       if((to_return = DSA_SIG_new()) == NULL)
+               goto err;
+       to_return->r = BN_bin2bn((unsigned char *)result->d, 20, NULL);
+       to_return->s = BN_bin2bn((unsigned char *)result->d + 20, 20, NULL);
+
+err:
+       if(acquired)
+               release_context(hac);
+       if(dsa_p) ctx->tos--;
+       if(dsa_q) ctx->tos--;
+       if(dsa_g) ctx->tos--;
+       if(dsa_key) ctx->tos--;
+       if(result) ctx->tos--;
+       if(ctx)
+               BN_CTX_free(ctx);
+       return to_return;
+       }
+
+static int cswift_dsa_verify(const unsigned char *dgst, int dgst_len,
+                               DSA_SIG *sig, DSA *dsa)
+       {
+       DSA_METHOD *meth, *tmp_meth;
+       int ret;
+       meth = DSA_OpenSSL();
+       tmp_meth = ENGINE_get_DSA(dsa->handle);
+       ENGINE_set_DSA(dsa->handle, meth);
+       ret = DSA_do_verify(dgst, dgst_len, sig, dsa);
+       ENGINE_set_DSA(dsa->handle, tmp_meth);
+       return ret;
+       }
+
 /* This function is aliased to mod_exp (with the dh and mont dropped). */
 static int cswift_mod_exp_dh(DH *dh, BIGNUM *r, BIGNUM *a, const BIGNUM *p,
                const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx)