NAME
ECDSA_SIG_new,
ECDSA_SIG_free,
ECDSA_SIG_get0,
ECDSA_SIG_get0_r,
ECDSA_SIG_get0_s,
ECDSA_SIG_set0,
i2d_ECDSA_SIG,
d2i_ECDSA_SIG, ECDSA_size,
ECDSA_sign_setup,
ECDSA_sign, ECDSA_sign_ex,
ECDSA_verify, ECDSA_do_sign,
ECDSA_do_sign_ex,
ECDSA_do_verify,
ECDSA_OpenSSL,
ECDSA_get_default_method,
ECDSA_set_default_method,
ECDSA_set_method —
Elliptic Curve Digital Signature
Algorithm
SYNOPSIS
#include
<openssl/ecdsa.h>
ECDSA_SIG*
ECDSA_SIG_new(void);
void
ECDSA_SIG_free(ECDSA_SIG
*sig);
void
ECDSA_SIG_get0(const ECDSA_SIG
*sig, const BIGNUM **r, const
BIGNUM **s);
const BIGNUM *
ECDSA_SIG_get0_r(const ECDSA_SIG
*sig);
const BIGNUM *
ECDSA_SIG_get0_s(const ECDSA_SIG
*sig);
int
ECDSA_SIG_set0(ECDSA_SIG *sig,
BIGNUM *r, BIGNUM *s);
int
i2d_ECDSA_SIG(const ECDSA_SIG
*sig_in, unsigned char **der_out);
ECDSA_SIG*
d2i_ECDSA_SIG(ECDSA_SIG
**sig_out, const unsigned char **der_in,
long len);
int
ECDSA_size(const EC_KEY
*eckey);
int
ECDSA_sign_setup(EC_KEY *eckey,
BN_CTX *ctx, BIGNUM **kinv,
BIGNUM **rp);
int
ECDSA_sign(int type,
const unsigned char *dgst, int
dgstlen, unsigned char *sig,
unsigned int *siglen, EC_KEY
*eckey);
int
ECDSA_sign_ex(int type,
const unsigned char *dgst, int
dgstlen, unsigned char *sig,
unsigned int *siglen, const BIGNUM
*kinv, const BIGNUM *rp, EC_KEY
*eckey);
int
ECDSA_verify(int type,
const unsigned char *dgst, int
dgstlen, const unsigned char *sig,
int siglen, EC_KEY *eckey);
ECDSA_SIG*
ECDSA_do_sign(const unsigned char
*dgst, int dgst_len, EC_KEY
*eckey);
ECDSA_SIG*
ECDSA_do_sign_ex(const unsigned char
*dgst, int dgstlen, const BIGNUM
*kinv, const BIGNUM *rp, EC_KEY
*eckey);
int
ECDSA_do_verify(const unsigned char
*dgst, int dgst_len, const
ECDSA_SIG *sig, EC_KEY* eckey);
const ECDSA_METHOD*
ECDSA_OpenSSL(void);
const ECDSA_METHOD*
ECDSA_get_default_method(void);
void
ECDSA_set_default_method(const
ECDSA_METHOD *meth);
int
ECDSA_set_method(EC_KEY *eckey,
const ECDSA_METHOD *meth);
DESCRIPTION
These functions provide a low level interface to ECDSA. Most applications should use the higher level EVP interface such as EVP_DigestSignInit(3) or EVP_DigestVerifyInit(3) instead. Creation of the required EC_KEY objects is described in EC_KEY_new(3).
The ECDSA_SIG structure consists of two BIGNUMs for the r and s value of an ECDSA signature (see X9.62 or FIPS 186-2).
struct {
BIGNUM *r;
BIGNUM *s;
} ECDSA_SIG;
ECDSA_SIG_new()
allocates a new ECDSA_SIG structure (note: this
function also allocates the BIGNUMs) and initializes
it.
ECDSA_SIG_free()
frees the ECDSA_SIG structure
sig.
ECDSA_SIG_get0()
retrieves internal pointers the r and
s values contained in sig. The
values r and s can also be
retrieved separately by the corresponding function
ECDSA_SIG_get0_r()
and
ECDSA_SIG_get0_s(),
respectively.
ECDSA_SIG_set0()
sets the r and s values in
sig. Calling this function transfers the memory
management of the values to sig. Therefore, the values
that have been passed in should not be freed by the caller.
i2d_ECDSA_SIG()
creates the DER encoding of the ECDSA signature sig_in
and writes the encoded signature to *der_out.
d2i_ECDSA_SIG()
decodes the DER-encoded signature stored in the buffer
*der_in which is len bytes long
into *sig_out. For details about the semantics,
examples, caveats, and bugs, see
ASN1_item_d2i(3).
ECDSA_size()
returns the maximum length of a DER-encoded ECDSA signature created with the
private EC key eckey.
ECDSA_sign_setup()
may be used to precompute parts of the signing operation.
eckey is the private EC key and
ctx is a pointer to a BN_CTX
structure (or NULL). The precomputed values are
returned in kinv and rp and can
be used in a later call to ECDSA_sign_ex or
ECDSA_do_sign_ex.
ECDSA_sign()
is a wrapper function for ECDSA_sign_ex with
kinv and rp set to
NULL.
ECDSA_sign_ex()
computes a digital signature of the dgstlen bytes hash
value dgst using the private EC key
eckey and the optional pre-computed values
kinv and rp. The DER-encoded
signature is stored in sig and its length is returned
in siglen. Note: sig must point
to ECDSA_size() bytes of memory. The parameter
type is ignored.
ECDSA_verify()
verifies that the signature in sig of size
siglen is a valid ECDSA signature of the hash value
dgst of size dgstlen using the
public key eckey. The parameter
type is ignored.
ECDSA_do_sign()
is a wrapper function for ECDSA_do_sign_ex() with
kinv and rp set to
NULL.
ECDSA_do_sign_ex()
computes a digital signature of the dgst_len bytes
hash value dgst using the private key
eckey and the optional pre-computed values
kinv and rp. The signature is
returned in a newly allocated ECDSA_SIG structure (or
NULL on error).
ECDSA_do_verify()
verifies that the signature sig is a valid ECDSA
signature of the hash value dgst of size
dgst_len using the public key
eckey.
RETURN VALUES
ECDSA_SIG_new() returns the new
ECDSA_SIG object or NULL if an
error occurs.
i2d_ECDSA_SIG() returns the number of
bytes successfully encoded or a negative value if an error occurs.
d2i_ECDSA_SIG() returns a pointer to the
decoded ECDSA_SIG structure or
NULL if an error occurs.
ECDSA_size() returns the maximum length
signature or 0 on error.
ECDSA_SIG_get0_r() and
ECDSA_SIG_get0_s() return a pointer owned by the
ECDSA_SIG object if it has been set or
NULL otherwise.
ECDSA_SIG_set0(),
ECDSA_sign(),
ECDSA_sign_ex(), and
ECDSA_sign_setup() return 1 if successful or 0 on
error.
ECDSA_do_sign() and
ECDSA_do_sign_ex() return a pointer to an allocated
ECDSA_SIG structure or NULL on
error.
ECDSA_verify() and
ECDSA_do_verify() return 1 for a valid signature, 0
for an invalid signature and -1 on error. The error codes can be obtained by
ERR_get_error(3).
EXAMPLES
Creating an ECDSA signature of given SHA-1 hash value using the named curve secp192k1.
First step: create an EC_KEY object. This part is not ECDSA specific.
int ret;
ECDSA_SIG *sig;
EC_KEY *eckey;
eckey = EC_KEY_new_by_curve_name(NID_secp192k1);
if (eckey == NULL) {
/* error */
}
if (!EC_KEY_generate_key(eckey)) {
/* error */
}
Second step: compute the ECDSA signature of a SHA-1 hash value
using ECDSA_do_sign()
sig = ECDSA_do_sign(digest, 20, eckey);
if (sig == NULL) {
/* error */
}
or using ECDSA_sign()
unsigned char *buffer, *pp;
int buf_len;
buf_len = ECDSA_size(eckey);
buffer = malloc(buf_len);
pp = buffer;
if (!ECDSA_sign(0, dgst, dgstlen, pp, &buf_len, eckey) {
/* error */
}
Third step: verify the created ECDSA signature using
ECDSA_do_verify()
ret = ECDSA_do_verify(digest, 20,
sig, eckey);or using ECDSA_verify()
ret = ECDSA_verify(0, digest, 20,
buffer, buf_len, eckey);and finally evaluate the return value:
if (ret == -1) {
/* error */
} else if (ret == 0) {
/* incorrect signature */
} else {
/* ret == 1 */
/* signature ok */
}
SEE ALSO
crypto(3), d2i_ECPKParameters(3), DSA_new(3), EC_GROUP_new(3), EC_KEY_METHOD_new(3), EC_KEY_new(3), ECDSA_set_ex_data(3), EVP_DigestSignInit(3), EVP_DigestVerifyInit(3), RSA_new(3)
STANDARDS
ANSI X9.62, US Federal Information Processing Standard FIPS 186-2 (Digital Signature Standard, DSS)
HISTORY
ECDSA_SIG_new(),
ECDSA_SIG_free(),
i2d_ECDSA_SIG(),
d2i_ECDSA_SIG(),
ECDSA_size(),
ECDSA_sign_setup(),
ECDSA_sign(),
ECDSA_sign_ex(),
ECDSA_verify(),
ECDSA_do_sign(),
ECDSA_do_sign_ex(),
ECDSA_do_verify(),
ECDSA_OpenSSL(),
ECDSA_get_default_method(),
ECDSA_set_default_method(), and
ECDSA_set_method() first appeared in OpenSSL 0.9.8
and have been available since OpenBSD 4.5.
ECDSA_SIG_get0() and
ECDSA_SIG_set0() first appeared in OpenSSL 1.1.0 and
have been available since OpenBSD 6.3.
ECDSA_SIG_get0_r() and
ECDSA_SIG_get0_s() first appeared in OpenSSL 1.1.1
and have been available since OpenBSD 7.1.
AUTHORS
Nils Larsch for the OpenSSL project.