Skip to content

Commit a282a71

Browse files
justsmthjustsmth
committed
Consolidate EVP_DigestSign/EVP_DigestVerify usage
1 parent 4bc6b71 commit a282a71

File tree

8 files changed

+103
-330
lines changed

8 files changed

+103
-330
lines changed

‎aws-lc-rs/src/bn.rs

+1-5
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
22
// SPDX-License-Identifier: Apache-2.0 OR ISC
33

4-
use crate::aws_lc::{BN_bin2bn, BN_bn2bin, BN_new, BN_num_bits, BN_num_bytes, BN_set_u64, BIGNUM};
4+
use crate::aws_lc::{BN_bin2bn, BN_bn2bin, BN_new, BN_num_bytes, BN_set_u64, BIGNUM};
55
use crate::ptr::{ConstPointer, DetachableLcPtr, LcPtr};
66
use core::ptr::null_mut;
77

@@ -60,8 +60,4 @@ impl ConstPointer<BIGNUM> {
6060
byte_vec
6161
}
6262
}
63-
64-
pub(crate) fn num_bits(&self) -> u32 {
65-
unsafe { BN_num_bits(**self) }
66-
}
6763
}

‎aws-lc-rs/src/ec/key_pair.rs

+10-73
Original file line numberDiff line numberDiff line change
@@ -5,31 +5,28 @@
55

66
use core::fmt;
77
use core::fmt::{Debug, Formatter};
8-
use core::mem::MaybeUninit;
9-
use core::ptr::{null, null_mut};
108

11-
use crate::aws_lc::{EVP_DigestSign, EVP_DigestSignInit, EVP_PKEY_cmp, EVP_PKEY, EVP_PKEY_EC};
9+
use crate::aws_lc::{EVP_PKEY_cmp, EVP_PKEY, EVP_PKEY_EC};
1210

13-
use crate::digest::digest_ctx::DigestContext;
1411
use crate::ec::evp_key_generate;
1512
use crate::ec::signature::{EcdsaSignatureFormat, EcdsaSigningAlgorithm, PublicKey};
1613
#[cfg(feature = "fips")]
1714
use crate::ec::validate_evp_key;
1815
#[cfg(not(feature = "fips"))]
1916
use crate::ec::verify_evp_key_nid;
2017

18+
use crate::ec;
2119
use crate::ec::encoding::rfc5915::{marshal_rfc5915_private_key, parse_rfc5915_private_key};
2220
use crate::ec::encoding::sec1::{
2321
marshal_sec1_private_key, parse_sec1_private_bn, parse_sec1_public_point,
2422
};
2523
use crate::encoding::{AsBigEndian, AsDer, EcPrivateKeyBin, EcPrivateKeyRfc5915Der};
2624
use crate::error::{KeyRejected, Unspecified};
27-
use crate::fips::indicator_check;
25+
use crate::evp_pkey::No_EVP_PKEY_CTX_consumer;
2826
use crate::pkcs8::{Document, Version};
2927
use crate::ptr::LcPtr;
3028
use crate::rand::SecureRandom;
3129
use crate::signature::{KeyPair, Signature};
32-
use crate::{digest, ec};
3330

3431
/// An ECDSA key pair, used for signing.
3532
#[allow(clippy::module_name_repetitions)]
@@ -212,82 +209,22 @@ impl EcdsaKeyPair {
212209
// * Digest Algorithms: SHA256, SHA384, SHA512
213210
#[inline]
214211
pub fn sign(&self, _rng: &dyn SecureRandom, message: &[u8]) -> Result<Signature, Unspecified> {
215-
let mut md_ctx = DigestContext::new_uninit();
216-
217-
let digest = digest::match_digest_type(&self.algorithm.digest.id);
218-
219-
if 1 != unsafe {
220-
// EVP_DigestSignInit does not mutate |pkey| for thread-safety purposes and may be
221-
// used concurrently with other non-mutating functions on |pkey|.
222-
// https://github.com/aws/aws-lc/blob/9b4b5a15a97618b5b826d742419ccd54c819fa42/include/openssl/evp.h#L297-L313
223-
EVP_DigestSignInit(
224-
md_ctx.as_mut_ptr(),
225-
null_mut(),
226-
*digest,
227-
null_mut(),
228-
*self.evp_pkey.as_mut_unsafe(),
229-
)
230-
} {
231-
return Err(Unspecified);
232-
}
233-
234-
let mut out_sig = vec![0u8; get_signature_length(&mut md_ctx)?];
235-
236-
let out_sig = compute_ecdsa_signature(&mut md_ctx, message, out_sig.as_mut_slice())?;
212+
let out_sig = self.evp_pkey.sign(
213+
message,
214+
Some(self.algorithm.digest),
215+
No_EVP_PKEY_CTX_consumer,
216+
)?;
237217

238218
Ok(match self.algorithm.sig_format {
239219
EcdsaSignatureFormat::ASN1 => Signature::new(|slice| {
240-
slice[..out_sig.len()].copy_from_slice(out_sig);
220+
slice[..out_sig.len()].copy_from_slice(&out_sig);
241221
out_sig.len()
242222
}),
243-
EcdsaSignatureFormat::Fixed => ec::ecdsa_asn1_to_fixed(self.algorithm.id, out_sig)?,
223+
EcdsaSignatureFormat::Fixed => ec::ecdsa_asn1_to_fixed(self.algorithm.id, &out_sig)?,
244224
})
245225
}
246226
}
247227

248-
#[inline]
249-
fn get_signature_length(ctx: &mut DigestContext) -> Result<usize, Unspecified> {
250-
let mut out_sig_len = MaybeUninit::<usize>::uninit();
251-
252-
// determine signature size
253-
if 1 != unsafe {
254-
EVP_DigestSign(
255-
ctx.as_mut_ptr(),
256-
null_mut(),
257-
out_sig_len.as_mut_ptr(),
258-
null(),
259-
0,
260-
)
261-
} {
262-
return Err(Unspecified);
263-
}
264-
265-
Ok(unsafe { out_sig_len.assume_init() })
266-
}
267-
268-
#[inline]
269-
fn compute_ecdsa_signature<'a>(
270-
ctx: &mut DigestContext,
271-
message: &[u8],
272-
signature: &'a mut [u8],
273-
) -> Result<&'a mut [u8], Unspecified> {
274-
let mut out_sig_len = signature.len();
275-
276-
if 1 != indicator_check!(unsafe {
277-
EVP_DigestSign(
278-
ctx.as_mut_ptr(),
279-
signature.as_mut_ptr(),
280-
&mut out_sig_len,
281-
message.as_ptr(),
282-
message.len(),
283-
)
284-
}) {
285-
return Err(Unspecified);
286-
}
287-
288-
Ok(&mut signature[0..out_sig_len])
289-
}
290-
291228
/// Elliptic curve private key.
292229
pub struct PrivateKey<'a>(&'a EcdsaKeyPair);
293230

‎aws-lc-rs/src/ec/signature.rs

+5-35
Original file line numberDiff line numberDiff line change
@@ -2,19 +2,18 @@
22
// SPDX-License-Identifier: Apache-2.0 OR ISC
33

44
use crate::aws_lc::{
5-
ECDSA_SIG_new, ECDSA_SIG_set0, ECDSA_SIG_to_bytes, EVP_DigestVerify, EVP_DigestVerifyInit,
6-
NID_X9_62_prime256v1, NID_secp256k1, NID_secp384r1, NID_secp521r1, BIGNUM, ECDSA_SIG, EVP_PKEY,
5+
ECDSA_SIG_new, ECDSA_SIG_set0, ECDSA_SIG_to_bytes, NID_X9_62_prime256v1, NID_secp256k1,
6+
NID_secp384r1, NID_secp521r1, BIGNUM, ECDSA_SIG, EVP_PKEY,
77
};
88

9-
use crate::digest::digest_ctx::DigestContext;
109
use crate::ec::compressed_public_key_size_bytes;
1110
use crate::ec::encoding::parse_ec_public_key;
1211
use crate::ec::encoding::sec1::marshal_sec1_public_point;
1312
use crate::encoding::{
1413
AsBigEndian, AsDer, EcPublicKeyCompressedBin, EcPublicKeyUncompressedBin, PublicKeyX509Der,
1514
};
1615
use crate::error::Unspecified;
17-
use crate::fips::indicator_check;
16+
use crate::evp_pkey::No_EVP_PKEY_CTX_consumer;
1817
use crate::ptr::{DetachableLcPtr, LcPtr};
1918
use crate::signature::VerificationAlgorithm;
2019
use crate::{digest, sealed};
@@ -232,37 +231,8 @@ fn verify_asn1_signature(
232231
msg: &[u8],
233232
signature: &[u8],
234233
) -> Result<(), Unspecified> {
235-
let mut pkey = parse_ec_public_key(public_key, alg.nid())?;
236-
237-
let mut md_ctx = DigestContext::new_uninit();
238-
239-
let digest = digest::match_digest_type(&digest.id);
240-
241-
if 1 != unsafe {
242-
EVP_DigestVerifyInit(
243-
md_ctx.as_mut_ptr(),
244-
null_mut(),
245-
*digest,
246-
null_mut(),
247-
*pkey.as_mut(),
248-
)
249-
} {
250-
return Err(Unspecified);
251-
}
252-
253-
if 1 != indicator_check!(unsafe {
254-
EVP_DigestVerify(
255-
md_ctx.as_mut_ptr(),
256-
signature.as_ptr(),
257-
signature.len(),
258-
msg.as_ptr(),
259-
msg.len(),
260-
)
261-
}) {
262-
return Err(Unspecified);
263-
}
264-
265-
Ok(())
234+
let evp_pkey = parse_ec_public_key(public_key, alg.nid())?;
235+
evp_pkey.verify(msg, Some(digest), No_EVP_PKEY_CTX_consumer, signature)
266236
}
267237

268238
#[inline]

‎aws-lc-rs/src/ed25519.rs

+10-65
Original file line numberDiff line numberDiff line change
@@ -12,16 +12,15 @@ use std::marker::PhantomData;
1212
use untrusted::Input;
1313

1414
use crate::aws_lc::{
15-
EVP_DigestSign, EVP_DigestSignInit, EVP_DigestVerify, EVP_DigestVerifyInit,
1615
EVP_PKEY_CTX_new_id, EVP_PKEY_keygen, EVP_PKEY_keygen_init, EVP_PKEY, EVP_PKEY_ED25519,
1716
};
1817

1918
use crate::buffer::Buffer;
20-
use crate::digest::digest_ctx::DigestContext;
2119
use crate::encoding::{
2220
AsBigEndian, AsDer, Curve25519SeedBin, Pkcs8V1Der, Pkcs8V2Der, PublicKeyX509Der,
2321
};
2422
use crate::error::{KeyRejected, Unspecified};
23+
use crate::evp_pkey::No_EVP_PKEY_CTX_consumer;
2524
use crate::fips::indicator_check;
2625
use crate::pkcs8::{Document, Version};
2726
use crate::ptr::LcPtr;
@@ -30,8 +29,8 @@ use crate::signature::{KeyPair, Signature, VerificationAlgorithm};
3029
use crate::{constant_time, hex, sealed};
3130

3231
/// The length of an Ed25519 public key.
33-
pub const ED25519_PUBLIC_KEY_LEN: usize = aws_lc::ED25519_PUBLIC_KEY_LEN as usize;
34-
const ED25519_SIGNATURE_LEN: usize = aws_lc::ED25519_SIGNATURE_LEN as usize;
32+
pub const ED25519_PUBLIC_KEY_LEN: usize = crate::aws_lc::ED25519_PUBLIC_KEY_LEN as usize;
33+
const ED25519_SIGNATURE_LEN: usize = crate::aws_lc::ED25519_SIGNATURE_LEN as usize;
3534
const ED25519_SEED_LEN: usize = 32;
3635

3736
/// Parameters for `EdDSA` signing and verification.
@@ -49,9 +48,11 @@ impl VerificationAlgorithm for EdDSAParameters {
4948
msg: Input<'_>,
5049
signature: Input<'_>,
5150
) -> Result<(), Unspecified> {
52-
self.verify_sig(
53-
public_key.as_slice_less_safe(),
51+
let evp_pkey = try_ed25519_public_key_from_bytes(public_key.as_slice_less_safe())?;
52+
evp_pkey.verify(
5453
msg.as_slice_less_safe(),
54+
None,
55+
No_EVP_PKEY_CTX_consumer,
5556
signature.as_slice_less_safe(),
5657
)
5758
}
@@ -62,35 +63,8 @@ impl VerificationAlgorithm for EdDSAParameters {
6263
msg: &[u8],
6364
signature: &[u8],
6465
) -> Result<(), Unspecified> {
65-
let public_key = try_ed25519_public_key_from_bytes(public_key)?;
66-
67-
let mut evp_md_ctx = DigestContext::new_uninit();
68-
69-
if 1 != unsafe {
70-
EVP_DigestVerifyInit(
71-
evp_md_ctx.as_mut_ptr(),
72-
null_mut(),
73-
null_mut(),
74-
null_mut(),
75-
*public_key.as_mut_unsafe(),
76-
)
77-
} {
78-
return Err(Unspecified);
79-
}
80-
81-
if 1 != indicator_check!(unsafe {
82-
EVP_DigestVerify(
83-
evp_md_ctx.as_mut_ptr(),
84-
signature.as_ptr(),
85-
signature.len(),
86-
msg.as_ptr(),
87-
msg.len(),
88-
)
89-
}) {
90-
return Err(Unspecified);
91-
}
92-
93-
Ok(())
66+
let evp_pkey = try_ed25519_public_key_from_bytes(public_key)?;
67+
evp_pkey.verify(msg, None, No_EVP_PKEY_CTX_consumer, signature)
9468
}
9569
}
9670

@@ -433,36 +407,7 @@ impl Ed25519KeyPair {
433407

434408
#[inline]
435409
fn try_sign(&self, msg: &[u8]) -> Result<Signature, Unspecified> {
436-
let mut sig_bytes = [0u8; ED25519_SIGNATURE_LEN];
437-
438-
let mut evp_md_ctx = DigestContext::new_uninit();
439-
440-
if 1 != unsafe {
441-
EVP_DigestSignInit(
442-
evp_md_ctx.as_mut_ptr(),
443-
null_mut(),
444-
null_mut(),
445-
null_mut(),
446-
*self.evp_pkey.as_mut_unsafe(),
447-
)
448-
} {
449-
return Err(Unspecified);
450-
}
451-
452-
let mut out_sig_len = sig_bytes.len();
453-
if 1 != indicator_check!(unsafe {
454-
EVP_DigestSign(
455-
evp_md_ctx.as_mut_ptr(),
456-
sig_bytes.as_mut_ptr().cast(),
457-
&mut out_sig_len,
458-
msg.as_ptr(),
459-
msg.len(),
460-
)
461-
}) {
462-
return Err(Unspecified);
463-
}
464-
465-
debug_assert_eq!(out_sig_len, sig_bytes.len());
410+
let sig_bytes = self.evp_pkey.sign(msg, None, No_EVP_PKEY_CTX_consumer)?;
466411

467412
Ok(Signature::new(|slice| {
468413
slice[0..ED25519_SIGNATURE_LEN].copy_from_slice(&sig_bytes);

0 commit comments

Comments
 (0)