From bf69ea5b8f882af439ac3b288b7063ce6757e730 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Thu, 27 May 2021 23:53:07 +0200 Subject: [PATCH] Make some fields of mbedtls_ecp_group public The Mbed TLS code relies heavily on reading certain fields of mbedtls_ecp_group directly. Make these fields public. Require that MBEDTLS_ECP_ALT alternative implementations have them. Signed-off-by: Gilles Peskine --- include/mbedtls/ecp.h | 32 ++++++++++++++++++++------------ programs/pkey/ecdsa.c | 2 +- programs/pkey/gen_key.c | 2 +- 3 files changed, 22 insertions(+), 14 deletions(-) diff --git a/include/mbedtls/ecp.h b/include/mbedtls/ecp.h index 61d29a99a2..49e85d9419 100644 --- a/include/mbedtls/ecp.h +++ b/include/mbedtls/ecp.h @@ -206,25 +206,33 @@ mbedtls_ecp_point; * additions or subtractions. Therefore, it is only an approximative modular * reduction. It must return 0 on success and non-zero on failure. * - * \note Alternative implementations must keep the group IDs distinct. If - * two group structures have the same ID, then they must be - * identical. - * + * \note Alternative implementations of the ECP module must obey the + * following constraints. + * * Group IDs must be distinct: if two group structures have + * the same ID, then they must be identical. + * * The fields \c id, \c P, \c A, \c B, \c G, \c N, + * \c pbits and \c nbits must have the same type and semantics + * as in the built-in implementation. + * They must be available for reading, but direct modification + * of these fields does not need to be supported. + * They do not need to be at the same offset in the structure. */ typedef struct mbedtls_ecp_group { - mbedtls_ecp_group_id MBEDTLS_PRIVATE(id); /*!< An internal group identifier. */ - mbedtls_mpi MBEDTLS_PRIVATE(P); /*!< The prime modulus of the base field. */ - mbedtls_mpi MBEDTLS_PRIVATE(A); /*!< For Short Weierstrass: \p A in the equation. For + mbedtls_ecp_group_id id; /*!< An internal group identifier. */ + mbedtls_mpi P; /*!< The prime modulus of the base field. */ + mbedtls_mpi A; /*!< For Short Weierstrass: \p A in the equation. For Montgomery curves: (A + 2) / 4. */ - mbedtls_mpi MBEDTLS_PRIVATE(B); /*!< For Short Weierstrass: \p B in the equation. + mbedtls_mpi B; /*!< For Short Weierstrass: \p B in the equation. For Montgomery curves: unused. */ - mbedtls_ecp_point MBEDTLS_PRIVATE(G); /*!< The generator of the subgroup used. */ - mbedtls_mpi MBEDTLS_PRIVATE(N); /*!< The order of \p G. */ - size_t MBEDTLS_PRIVATE(pbits); /*!< The number of bits in \p P.*/ - size_t MBEDTLS_PRIVATE(nbits); /*!< For Short Weierstrass: The number of bits in \p P. + mbedtls_ecp_point G; /*!< The generator of the subgroup used. */ + mbedtls_mpi N; /*!< The order of \p G. */ + size_t pbits; /*!< The number of bits in \p P.*/ + size_t nbits; /*!< For Short Weierstrass: The number of bits in \p P. For Montgomery curves: the number of bits in the private keys. */ + /* End of public fields */ + unsigned int MBEDTLS_PRIVATE(h); /*!< \internal 1 if the constants are static. */ int (*MBEDTLS_PRIVATE(modp))(mbedtls_mpi *); /*!< The function for fast pseudo-reduction mod \p P (see above).*/ diff --git a/programs/pkey/ecdsa.c b/programs/pkey/ecdsa.c index 3dacd75d31..3dd85bf90a 100644 --- a/programs/pkey/ecdsa.c +++ b/programs/pkey/ecdsa.c @@ -156,7 +156,7 @@ int main( int argc, char *argv[] ) goto exit; } - mbedtls_printf( " ok (key size: %d bits)\n", (int) ctx_sign.MBEDTLS_PRIVATE(grp).MBEDTLS_PRIVATE(pbits) ); + mbedtls_printf( " ok (key size: %d bits)\n", (int) ctx_sign.MBEDTLS_PRIVATE(grp).pbits ); dump_pubkey( " + Public key: ", &ctx_sign ); diff --git a/programs/pkey/gen_key.c b/programs/pkey/gen_key.c index 9ad1190fc7..941553012e 100644 --- a/programs/pkey/gen_key.c +++ b/programs/pkey/gen_key.c @@ -395,7 +395,7 @@ int main( int argc, char *argv[] ) { mbedtls_ecp_keypair *ecp = mbedtls_pk_ec( key ); mbedtls_printf( "curve: %s\n", - mbedtls_ecp_curve_info_from_grp_id( ecp->MBEDTLS_PRIVATE(grp).MBEDTLS_PRIVATE(id) )->MBEDTLS_PRIVATE(name) ); + mbedtls_ecp_curve_info_from_grp_id( ecp->MBEDTLS_PRIVATE(grp).id )->MBEDTLS_PRIVATE(name) ); mbedtls_mpi_write_file( "X_Q: ", &ecp->MBEDTLS_PRIVATE(Q).MBEDTLS_PRIVATE(X), 16, NULL ); mbedtls_mpi_write_file( "Y_Q: ", &ecp->MBEDTLS_PRIVATE(Q).MBEDTLS_PRIVATE(Y), 16, NULL ); mbedtls_mpi_write_file( "D: ", &ecp->MBEDTLS_PRIVATE(d) , 16, NULL );