Implement internally opaque bn access from ec

[openssl.git] / crypto / ec / ec_key.c

diff --git a/crypto/ec/ec_key.c b/crypto/ec/ec_key.c
index 1f048948e2d0b0ce2d1ecd25b952a6111e66ab5f..9ce17ae9668be87ddee48d8d0fe27d4ded9f65ea 100644 (file)
--- a/crypto/ec/ec_key.c
+++ b/crypto/ec/ec_key.c
@@ -61,12 +61,11 @@
  * contributed to the OpenSSL project.
  */
 
-#define OPENSSL_FIPSAPI
+
 
 #include <string.h>
 #include "ec_lcl.h"
 #include <openssl/err.h>
-#include <string.h>
 
 EC_KEY *EC_KEY_new(void)
        {
@@ -80,6 +79,7 @@ EC_KEY *EC_KEY_new(void)
                }
 
        ret->version = 1;       
+       ret->flags = 0;
        ret->group   = NULL;
        ret->pub_key = NULL;
        ret->priv_key= NULL;
@@ -199,6 +199,7 @@ EC_KEY *EC_KEY_copy(EC_KEY *dest, const EC_KEY *src)
        dest->enc_flag  = src->enc_flag;
        dest->conv_form = src->conv_form;
        dest->version   = src->version;
+       dest->flags = src->flags;
 
        return dest;
        }
@@ -232,36 +233,6 @@ int EC_KEY_up_ref(EC_KEY *r)
        return ((i > 1) ? 1 : 0);
        }
 
-#ifdef OPENSSL_FIPS
-
-#include <openssl/evp.h>
-
-static int fips_ec_pairwise_fail = 0;
-
-void FIPS_corrupt_ec_keygen(void)
-       {
-       fips_ec_pairwise_fail = 1;
-       }
-
-static int fips_check_ec(EC_KEY *key)
-       {
-       EVP_PKEY pk;
-       unsigned char tbs[] = "ECDSA Pairwise Check Data";
-       pk.type = EVP_PKEY_EC;
-       pk.pkey.ec = key;
-
-       if (!fips_pkey_signature_test(FIPS_TEST_PAIRWISE,
-                                       &pk, tbs, -1, NULL, 0, NULL, 0, NULL))
-               {
-               FIPSerr(FIPS_F_FIPS_CHECK_EC,FIPS_R_PAIRWISE_TEST_FAILED);
-               fips_set_selftest_fail();
-               return 0;
-               }
-       return 1;
-       }
-
-#endif
-
 int EC_KEY_generate_key(EC_KEY *eckey)
        {       
        int     ok = 0;
@@ -310,17 +281,6 @@ int EC_KEY_generate_key(EC_KEY *eckey)
        eckey->priv_key = priv_key;
        eckey->pub_key  = pub_key;
 
-#ifdef OPENSSL_FIPS
-       if (fips_ec_pairwise_fail)
-               BN_add_word(eckey->priv_key, 1);
-       if(!fips_check_ec(eckey))
-               {
-               eckey->priv_key = NULL;
-               eckey->pub_key  = NULL;
-               goto err;
-               }
-#endif
-
        ok=1;
 
 err:   
@@ -366,7 +326,7 @@ int EC_KEY_check_key(const EC_KEY *eckey)
                goto err;
                }
        /* testing whether pub_key * order is the point at infinity */
-       order = &eckey->group->order;
+       order = eckey->group->order;
        if (BN_is_zero(order))
                {
                ECerr(EC_F_EC_KEY_CHECK_KEY, EC_R_INVALID_GROUP_ORDER);
@@ -463,10 +423,12 @@ int EC_KEY_set_public_key_affine_coordinates(EC_KEY *key, BIGNUM *x, BIGNUM *y)
                                                                tx, ty, ctx))
                        goto err;
                }
-       /* Check if retrieved coordinates match originals: if not values
-        * are out of range.
+       /* Check if retrieved coordinates match originals and are less than
+        * field order: if not values are out of range.
         */
-       if (BN_cmp(x, tx) || BN_cmp(y, ty))
+       if (BN_cmp(x, tx) || BN_cmp(y, ty)
+               || (BN_cmp(x, key->group->field) >= 0)
+               || (BN_cmp(y, key->group->field) >= 0))
                {
                ECerr(EC_F_EC_KEY_SET_PUBLIC_KEY_AFFINE_COORDINATES,
                        EC_R_COORDINATES_OUT_OF_RANGE);
@@ -554,18 +516,27 @@ void EC_KEY_set_conv_form(EC_KEY *key, point_conversion_form_t cform)
 void *EC_KEY_get_key_method_data(EC_KEY *key,
        void *(*dup_func)(void *), void (*free_func)(void *), void (*clear_free_func)(void *))
        {
-       return EC_EX_DATA_get_data(key->method_data, dup_func, free_func, clear_free_func);
+       void *ret;
+
+       CRYPTO_r_lock(CRYPTO_LOCK_EC);
+       ret = EC_EX_DATA_get_data(key->method_data, dup_func, free_func, clear_free_func);
+       CRYPTO_r_unlock(CRYPTO_LOCK_EC);
+
+       return ret;
        }
 
-void EC_KEY_insert_key_method_data(EC_KEY *key, void *data,
+void *EC_KEY_insert_key_method_data(EC_KEY *key, void *data,
        void *(*dup_func)(void *), void (*free_func)(void *), void (*clear_free_func)(void *))
        {
        EC_EXTRA_DATA *ex_data;
+
        CRYPTO_w_lock(CRYPTO_LOCK_EC);
        ex_data = EC_EX_DATA_get_data(key->method_data, dup_func, free_func, clear_free_func);
        if (ex_data == NULL)
                EC_EX_DATA_set_data(&key->method_data, data, dup_func, free_func, clear_free_func);
        CRYPTO_w_unlock(CRYPTO_LOCK_EC);
+
+       return ex_data;
        }
 
 void EC_KEY_set_asn1_flag(EC_KEY *key, int flag)
@@ -580,3 +551,18 @@ int EC_KEY_precompute_mult(EC_KEY *key, BN_CTX *ctx)
                return 0;
        return EC_GROUP_precompute_mult(key->group, ctx);
        }
+
+int EC_KEY_get_flags(const EC_KEY *key)
+       {
+       return key->flags;
+       }
+
+void EC_KEY_set_flags(EC_KEY *key, int flags)
+       {
+       key->flags |= flags;
+       }
+
+void EC_KEY_clear_flags(EC_KEY *key, int flags)
+       {
+       key->flags &= ~flags;
+       }