RPM Package Manager, CVS Repository http://rpm5.org/cvs/ ____________________________________________________________________________
Server: rpm5.org Name: Jeff Johnson Root: /v/rpm/cvs Email: [email protected] Module: rpm Date: 09-Jun-2010 21:19:45 Branch: HEAD Handle: 2010060919194302 Modified files: rpm CHANGES rpm/rpmio rpmgc.c rpmnss.c rpm/tests tecdsa.c tpgp.c Log: - pgp: add ECDSA generate/sign/verify tests using gcrypt/openssl. Summary: Revision Changes Path 1.3385 +1 -0 rpm/CHANGES 2.33 +24 -10 rpm/rpmio/rpmgc.c 1.38 +129 -7 rpm/rpmio/rpmnss.c 1.22 +4 -4 rpm/tests/tecdsa.c 1.4 +3 -2 rpm/tests/tpgp.c ____________________________________________________________________________ patch -p0 <<'@@ .' Index: rpm/CHANGES ============================================================================ $ cvs diff -u -r1.3384 -r1.3385 CHANGES --- rpm/CHANGES 9 Jun 2010 02:29:04 -0000 1.3384 +++ rpm/CHANGES 9 Jun 2010 19:19:43 -0000 1.3385 @@ -1,4 +1,5 @@ 5.3.0 -> 5.4a1: + - jbj: pgp: add ECDSA generate/sign/verify tests using gcrypt/openssl. - jbj: pgp: buff the chrome. - jbj: nss: add a strerror to decode errors to something meaningful. - jbj: nss: generate "real" PQG params for DSA. @@ . patch -p0 <<'@@ .' Index: rpm/rpmio/rpmgc.c ============================================================================ $ cvs diff -u -r2.32 -r2.33 rpmgc.c --- rpm/rpmio/rpmgc.c 9 Jun 2010 02:29:05 -0000 2.32 +++ rpm/rpmio/rpmgc.c 9 Jun 2010 19:19:44 -0000 2.33 @@ -60,7 +60,7 @@ void rpmgcDump(const char * msg, gcry_sexp_t sexp) /*...@*/ { - if (_pgp_debug) { + if (_rpmgc_debug || _pgp_debug) { size_t nb = gcry_sexp_sprint(sexp, GCRYSEXP_FMT_ADVANCED, NULL, 0); char * buf = alloca(nb+1); @@ -91,6 +91,9 @@ const char * hash_algo_name = NULL; int rc; int xx; +pgpDigParams pubp = pgpGetPubkey(dig); +dig->pubkey_algoN = rpmgcPubkeyAlgo2Name(pubp->pubkey_algo); +dig->hash_algoN = rpmgcHashAlgo2Name(sigp->hash_algo); switch (sigp->hash_algo) { case PGPHASHALGO_MD5: @@ -159,6 +162,9 @@ gcry_error_t err; int rc; int xx; +pgpDigParams pubp = pgpGetPubkey(dig); +dig->pubkey_algoN = rpmgcPubkeyAlgo2Name(pubp->pubkey_algo); +dig->hash_algoN = rpmgcHashAlgo2Name(sigp->hash_algo); assert(sigp->hash_algo == rpmDigestAlgo(ctx)); xx = rpmDigestFinal(ctx, (void **)&gc->digest, &gc->digestlen, 0); @@ -190,6 +196,9 @@ rpmgc gc = dig->impl; int rc = 1; /* XXX always fail. */ int xx; +pgpDigParams pubp = pgpGetPubkey(dig); +dig->pubkey_algoN = rpmgcPubkeyAlgo2Name(pubp->pubkey_algo); +dig->hash_algoN = rpmgcHashAlgo2Name(sigp->hash_algo); assert(sigp->hash_algo == rpmDigestAlgo(ctx)); xx = rpmDigestFinal(ctx, (void **)&gc->digest, &gc->digestlen, 0); @@ -208,6 +217,9 @@ int rc = 1; /* assume failure. */ gpg_error_t err; int xx; +pgpDigParams pubp = pgpGetPubkey(dig); +dig->pubkey_algoN = rpmgcPubkeyAlgo2Name(pubp->pubkey_algo); +dig->hash_algoN = rpmgcHashAlgo2Name(sigp->hash_algo); assert(sigp->hash_algo == rpmDigestAlgo(ctx)); gc->digest = _free(gc->digest); @@ -228,6 +240,7 @@ } /* Compare leading 16 bits of digest for quick check. */ + rc = 0; SPEW(0, !rc, dig); return rc; @@ -395,13 +408,11 @@ pgpDigParams pubp = pgpGetPubkey(dig); dig->pubkey_algoN = rpmgcPubkeyAlgo2Name(pubp->pubkey_algo); -if (gc->nbits == 0) gc->nbits = 1024; /* XXX FIXME */ -assert(gc->nbits); - /* XXX FIXME: gc->{key_spec,key_pair} could be local. */ /* XXX FIXME: gc->qbits w DSA? curve w ECDSA? other params? */ switch (pubp->pubkey_algo) { case PGPPUBKEYALGO_RSA: +if (gc->nbits == 0) gc->nbits = 1024; /* XXX FIXME */ gc->err = rpmgcErr(gc, "gc->key_spec", gcry_sexp_build(&gc->key_spec, NULL, gc->in_fips_mode @@ -410,6 +421,7 @@ gc->nbits)); break; case PGPPUBKEYALGO_DSA: +if (gc->nbits == 0) gc->nbits = 1024; /* XXX FIXME */ gc->err = rpmgcErr(gc, "gc->key_spec", gcry_sexp_build(&gc->key_spec, NULL, gc->in_fips_mode @@ -418,6 +430,7 @@ gc->nbits)); break; case PGPPUBKEYALGO_ELGAMAL: /* XXX FIXME: untested. */ +if (gc->nbits == 0) gc->nbits = 1024; /* XXX FIXME */ gc->err = rpmgcErr(gc, "gc->key_spec", gcry_sexp_build(&gc->key_spec, NULL, gc->in_fips_mode @@ -426,6 +439,7 @@ gc->nbits)); break; case PGPPUBKEYALGO_ECDSA: +if (gc->nbits == 0) gc->nbits = 256; /* XXX FIXME */ #ifdef DYING gc->err = rpmgcErr(gc, "gc->key_spec", gcry_sexp_build(&gc->key_spec, NULL, @@ -437,8 +451,8 @@ gc->err = rpmgcErr(gc, "gc->key_spec", gcry_sexp_build(&gc->key_spec, NULL, gc->in_fips_mode - ? "(genkey (ECDSA (nbits 3:256)(curve prime256v1)))" - : "(genkey (ECDSA (nbits 3:256)(curve prime256v1)(transient-key)))", + ? "(genkey (ECDSA (curve prime256v1)))" + : "(genkey (ECDSA (curve prime256v1)(transient-key)))", gc->nbits)); #endif break; @@ -448,26 +462,26 @@ } if (gc->err) goto exit; -if (_pgp_debug < 0 && gc->key_spec) rpmgcDump("gc->key_spec", gc->key_spec); +if ((_rpmgc_debug || _pgp_debug < 0) && gc->key_spec) rpmgcDump("gc->key_spec", gc->key_spec); /* Generate the key pair. */ gc->err = rpmgcErr(gc, "gc->key_pair", gcry_pk_genkey(&gc->key_pair, gc->key_spec)); if (gc->err) goto exit; -if (_pgp_debug < 0 && gc->key_pair) rpmgcDump("gc->key_pair", gc->key_pair); +if ((_rpmgc_debug || _pgp_debug < 0) && gc->key_pair) rpmgcDump("gc->key_pair", gc->key_pair); gc->pub_key = gcry_sexp_find_token(gc->key_pair, "public-key", 0); if (gc->pub_key == NULL) /* XXX FIXME: refactor errmsg here. */ goto exit; -if (_pgp_debug < 0 && gc->pub_key) rpmgcDump("gc->pub_key", gc->pub_key); +if ((_rpmgc_debug || _pgp_debug < 0) && gc->pub_key) rpmgcDump("gc->pub_key", gc->pub_key); gc->sec_key = gcry_sexp_find_token(gc->key_pair, "private-key", 0); if (gc->sec_key == NULL) /* XXX FIXME: refactor errmsg here. */ goto exit; -if (_pgp_debug < 0 && gc->sec_key) rpmgcDump("gc->sec_key", gc->sec_key); +if ((_rpmgc_debug || _pgp_debug < 0) && gc->sec_key) rpmgcDump("gc->sec_key", gc->sec_key); exit: @@ . patch -p0 <<'@@ .' Index: rpm/rpmio/rpmnss.c ============================================================================ $ cvs diff -u -r1.37 -r1.38 rpmnss.c --- rpm/rpmio/rpmnss.c 8 Jun 2010 23:00:53 -0000 1.37 +++ rpm/rpmio/rpmnss.c 9 Jun 2010 19:19:44 -0000 1.38 @@ -724,6 +724,94 @@ return rc; } +static +int rpmnssSignECDSA(/*...@unused@*/pgpDig dig) + /*...@*/ +{ + rpmnss nss = dig->impl; +pgpDigParams sigp = pgpGetSignature(dig); + int rc = 0; /* assume failure. */ + +SECOidTag sigalg = SEC_OID_UNKNOWN; + switch (sigp->hash_algo) { + case PGPHASHALGO_MD5: + break; + case PGPHASHALGO_SHA1: + sigalg = SEC_OID_SHA1; + break; + case PGPHASHALGO_RIPEMD160: + break; + case PGPHASHALGO_MD2: + break; + case PGPHASHALGO_MD4: + break; + case PGPHASHALGO_TIGER192: + break; + case PGPHASHALGO_HAVAL_5_160: + break; + case PGPHASHALGO_SHA256: + sigalg = SEC_OID_SHA256; + break; + case PGPHASHALGO_SHA384: + sigalg = SEC_OID_SHA384; + break; + case PGPHASHALGO_SHA512: + sigalg = SEC_OID_SHA512; + break; + case PGPHASHALGO_SHA224: + break; + default: + break; + } + if (sigalg == SEC_OID_UNKNOWN) + goto exit; + +if (nss->sig != NULL) { + SECITEM_ZfreeItem(nss->sig, PR_TRUE); + nss->sig = NULL; +} +nss->sig = SECITEM_AllocItem(NULL, NULL, 0); +nss->sig->type = siBuffer; + + rc = rpmnssErr(nss, "SGN_Digest", + SGN_Digest(nss->sec_key, sigalg, nss->sig, &nss->item)); + + rc = (rc == SECSuccess); + +exit: +SPEW(!rc, rc, dig); + return rc; +} + +static +int rpmnssGenerateECDSA(/*...@unused@*/pgpDig dig) + /*...@*/ +{ + rpmnss nss = dig->impl; + int rc = 0; /* assume failure. */ + + { CK_MECHANISM_TYPE _type = CKM_EC_KEY_PAIR_GEN; + PK11SlotInfo * _slot = PK11_GetBestSlot(_type, NULL); + int _isPerm = PR_FALSE; + int _isSensitive = PR_FALSE; + void * _cx = NULL; + + if (_slot) { + + nss->sec_key = PK11_GenerateKeyPair(_slot, _type, nss->ecparams, + &nss->pub_key, _isPerm, _isSensitive, _cx); + + PK11_FreeSlot(_slot); + } + } + + rc = (nss->sec_key && nss->pub_key); + +SPEW(!rc, rc, dig); + + return rc; +} + static int rpmnssErrChk(pgpDig dig, const char * msg, int rc, unsigned expected) { #ifdef NOTYET @@ -770,6 +858,7 @@ static int rpmnssVerify(pgpDig dig) { + rpmnss nss = dig->impl; int rc = 0; /* assume failure */ pgpDigParams pubp = pgpGetPubkey(dig); pgpDigParams sigp = pgpGetSignature(dig); @@ -791,7 +880,8 @@ #endif break; case PGPPUBKEYALGO_ECDSA: - rc = rpmnssVerifyECDSA(dig); + if (nss->sigalg != SEC_OID_UNKNOWN) + rc = rpmnssVerifyECDSA(dig); break; } SPEW(0, rc, dig); @@ -800,6 +890,7 @@ static int rpmnssSign(pgpDig dig) { + rpmnss nss = dig->impl; int rc = 0; /* assume failure */ pgpDigParams pubp = pgpGetPubkey(dig); dig->pubkey_algoN = _pgpPubkeyAlgo2Name(pubp->pubkey_algo); @@ -818,20 +909,51 @@ #endif break; case PGPPUBKEYALGO_ECDSA: -#ifdef NOTYET - rc = rpmnssSignECDSA(dig); -#endif + if (nss->sigalg != SEC_OID_UNKNOWN) + rc = rpmnssSignECDSA(dig); break; } SPEW(!rc, rc, dig); return rc; } +static int rpmnssLoadParams(pgpDig dig, const char * name) +{ + rpmnss nss = dig->impl; +#ifdef NOTYET + SECOidTag curveOidTag = curve2oid(name); +#else + SECOidTag curveOidTag = !strcmp(name, "nistp256") + ? SEC_OID_SECG_EC_SECP256R1 : SEC_OID_UNKNOWN; +#endif + SECOidData * oidData = SECOID_FindOIDByTag(curveOidTag); + int rc = 1; /* assume failure. */ + + if (curveOidTag == SEC_OID_UNKNOWN || oidData == NULL) { + nss->sigalg = curveOidTag; + goto exit; + } + + nss->sigalg = curveOidTag; + + nss->ecparams = SECITEM_AllocItem(NULL, NULL, (2 + oidData->oid.len)); + nss->ecparams->data[0] = SEC_ASN1_OBJECT_ID; + nss->ecparams->data[1] = oidData->oid.len; + memcpy(nss->ecparams->data + 2, oidData->oid.data, oidData->oid.len); + rc = 0; + +exit: +if (1 || _pgp_debug) +fprintf(stderr, "<-- %s(%p,%s) oid %u params %p\n", __FUNCTION__, dig, name, nss->sigalg, nss->ecparams); + return rc; +} + static int rpmnssGenerate(pgpDig dig) { int rc = 0; /* assume failure */ pgpDigParams pubp = pgpGetPubkey(dig); dig->pubkey_algoN = _pgpPubkeyAlgo2Name(pubp->pubkey_algo); + switch (pubp->pubkey_algo) { default: break; @@ -847,9 +969,9 @@ #endif break; case PGPPUBKEYALGO_ECDSA: -#ifdef NOTYET - rc = rpmnssGenerateECDSA(dig); -#endif + rc = rpmnssLoadParams(dig, "nistp256"); + if (!rc) + rc = rpmnssGenerateECDSA(dig); break; } SPEW(!rc, rc, dig); @@ . patch -p0 <<'@@ .' Index: rpm/tests/tecdsa.c ============================================================================ $ cvs diff -u -r1.21 -r1.22 tecdsa.c --- rpm/tests/tecdsa.c 9 Jun 2010 02:29:06 -0000 1.21 +++ rpm/tests/tecdsa.c 9 Jun 2010 19:19:45 -0000 1.22 @@ -77,14 +77,14 @@ #define _RPMPGP_INTERNAL #include <poptIO.h> -#define _RPMNSS_INTERNAL -#include <rpmnss.h> +#define _RPMGC_INTERNAL +#include <rpmgc.h> #ifdef NOTNOW #define _RPMBC_INTERNAL #include <rpmbc.h> -#define _RPMGC_INTERNAL -#include <rpmgc.h> +#define _RPMNSS_INTERNAL +#include <rpmnss.h> #define _RPMSSL_INTERNAL #include <rpmssl.h> @@ . patch -p0 <<'@@ .' Index: rpm/tests/tpgp.c ============================================================================ $ cvs diff -u -r1.3 -r1.4 tpgp.c --- rpm/tests/tpgp.c 9 Jun 2010 02:29:06 -0000 1.3 +++ rpm/tests/tpgp.c 9 Jun 2010 19:19:45 -0000 1.4 @@ -158,9 +158,10 @@ if (rc != RPMRC_OK) ec++; } #endif - if (pgpImplVecs == &rpmsslImplVecs) { + + if (pgpImplVecs == &rpmgcImplVecs || pgpImplVecs == &rpmsslImplVecs) { fprintf(stderr, " ECDSA"); - rc = generateTest(ts, "abc", PGPPUBKEYALGO_ECDSA, PGPHASHALGO_SHA1); + rc = generateTest(ts, "abc", PGPPUBKEYALGO_ECDSA, PGPHASHALGO_SHA256); if (rc != RPMRC_OK) ec++; } fprintf(stderr, "\n"); @@ . ______________________________________________________________________ RPM Package Manager http://rpm5.org CVS Sources Repository [email protected]
