generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Add pairwise consistency test to EC.

Browse Source
This commit is contained in:
Dr. Stephen Henson
2011-02-15 16:58:28 +00:00
parent c81f8f59be
commit 0fbf8f447b
4 changed files with 57 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
crypto/ec/ec_key.c
View File

@@ -232,6 +232,35 @@ int EC_KEY_up_ref(EC_KEY *r)
return ((i > 1) ? 1 : 0);
}
#ifdef OPENSSL_FIPS
#include <openssl/evp.h>
static int fips_ec_pairwise_fail = 0;
void FIPS_corrupt_ec_keygen(void)
{
fips_ec_pairwise_fail = 1;
}
static int fips_check_ec(EC_KEY *key)
{
EVP_PKEY pk;
unsigned char tbs[] = "ECDSA Pairwise Check Data";
pk.type = EVP_PKEY_EC;
pk.pkey.ec = key;
if (!fips_pkey_signature_test(&pk, tbs, -1, NULL, 0, NULL, 0, NULL))
{
FIPSerr(FIPS_F_FIPS_CHECK_EC,FIPS_R_PAIRWISE_TEST_FAILED);
fips_set_selftest_fail();
return 0;
}
return 1;
}
#endif
int EC_KEY_generate_key(EC_KEY *eckey)
{
int ok = 0;
@@ -280,6 +309,17 @@ int EC_KEY_generate_key(EC_KEY *eckey)
eckey->priv_key = priv_key;
eckey->pub_key = pub_key;
#ifdef OPENSSL_FIPS
if (fips_ec_pairwise_fail)
BN_add_word(eckey->priv_key, 1);
if(!fips_check_ec(eckey))
{
eckey->priv_key = NULL;
eckey->pub_key = NULL;
goto err;
}
#endif
ok=1;
err: