commit 7967ec5d25cfa2e9c7dd20abff4a6b688f209be0
author Gilles Peskine <Gilles.Peskine@arm.com> Mon Mar 29 21:53:58 2021 +0200
committer Gilles Peskine <Gilles.Peskine@arm.com> Wed Jun 02 21:31:24 2021 +0200
tree aab60f080b1eb78244b99b36298532c288bfd85c
parent 6373fab865410533a422d715ceabb5d60420b3f7

mbedtls_ecp_gen_privkey_sw: generalize to mbedtls_mpi_random

Rename mbedtls_ecp_gen_privkey_sw to mbedtls_mpi_random since it has
no particular connection to elliptic curves beyond the fact that its
operation is defined by the deterministic ECDSA specification. This is
a generic function that generates a random MPI between 1 inclusive and
N exclusive.

Slightly generalize the function to accept a different lower bound,
which adds a negligible amount of complexity.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>

library/ecp.c

diff --git a/library/ecp.c b/library/ecp.c
index 983a67f..1447a5a 100644
--- a/library/ecp.c
+++ b/library/ecp.c
@@ -3076,15 +3076,17 @@
 
 #if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
 MBEDTLS_STATIC_TESTABLE
-int mbedtls_ecp_gen_privkey_sw( const mbedtls_mpi *N, size_t n_bits,
-                                mbedtls_mpi *d,
-                                int (*f_rng)(void *, unsigned char *, size_t),
-                                void *p_rng )
+int mbedtls_mpi_random( mbedtls_mpi *X,
+                        mbedtls_mpi_sint min,
+                        const mbedtls_mpi *N,
+                        int (*f_rng)(void *, unsigned char *, size_t),
+                        void *p_rng )
 {
-    /* SEC1 3.2.1: Generate d such that 1 <= n < N */
-    int ret = MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
+    /* SEC1 3.2.1: Generate X such that 1 <= n < N */
+    int ret = MBEDTLS_ERR_MPI_BAD_INPUT_DATA;
     int count = 0;
     unsigned cmp = 0;
+    size_t n_bits = mbedtls_mpi_bitlen( N );
     size_t n_bytes = ( n_bits + 7 ) / 8;
 
     /*
@@ -3097,8 +3099,8 @@
      */
     do
     {
-        MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( d, n_bytes, f_rng, p_rng ) );
-        MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( d, 8 * n_bytes - n_bits ) );
+        MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( X, n_bytes, f_rng, p_rng ) );
+        MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( X, 8 * n_bytes - n_bits ) );
 
         /*
          * Each try has at worst a probability 1/2 of failing (the msb has
@@ -3111,17 +3113,17 @@
          */
         if( ++count > 30 )
         {
-            ret = MBEDTLS_ERR_ECP_RANDOM_FAILED;
+            ret = MBEDTLS_ERR_MPI_NOT_ACCEPTABLE;
             goto cleanup;
         }
 
-        ret = mbedtls_mpi_lt_mpi_ct( d, N, &cmp );
+        ret = mbedtls_mpi_lt_mpi_ct( X, N, &cmp );
         if( ret != 0 )
         {
             goto cleanup;
         }
     }
-    while( mbedtls_mpi_cmp_int( d, 1 ) < 0 || cmp != 1 );
+    while( mbedtls_mpi_cmp_int( X, min ) < 0 || cmp != 1 );
 
 cleanup:
     return( ret );
@@ -3147,8 +3149,7 @@
 
 #if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
     if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS )
-        return( mbedtls_ecp_gen_privkey_sw( &grp->N, grp->nbits, d,
-                                            f_rng, p_rng ) );
+        return( mbedtls_mpi_random( d, 1, &grp->N, f_rng, p_rng ) );
 #endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
 
     return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );