tpm2: Use new API in BnValidateSignatureEcdsa (OSSL 3)

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>

src/tpm2/crypto/openssl/CryptEccSignature.c

@@ -747,9 +747,16 @@ BnValidateSignatureEcdsa(
 			 )
 {
     int               retVal;
-    int               rc;
     ECDSA_SIG        *sig = NULL;
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+    EVP_PKEY_CTX     *vctx = NULL;
+    EVP_PKEY         *pkey = NULL;
+    size_t            sigbuf_len;
+    unsigned char    *sigbuf = NULL;
+#else
+    int               rc;
     EC_KEY           *eckey = NULL;
+#endif
     BIGNUM           *r = BN_new();
     BIGNUM           *s = BN_new();
     EC_POINT         *q = EcPointInitialized(ecQ, E);
@@ -758,6 +765,22 @@ BnValidateSignatureEcdsa(
     s = BigInitialized(s, bnS);
 
     sig = ECDSA_SIG_new();
+
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+
+    if ((retVal = BuildEcPublicKey(&pkey, E->G, q)))
+        goto Exit;
+
+    if ((vctx = EVP_PKEY_CTX_new_from_pkey(NULL, pkey, NULL)) == NULL)
+        ERROR_RETURN(TPM_RC_FAILURE);
+
+    if (ECDSA_SIG_set0(sig, r, s) != 1 ||
+        (sigbuf_len = i2d_ECDSA_SIG(sig, &sigbuf)) <= 0 ||
+        EVP_PKEY_verify_init(vctx) != 1 ||
+        EVP_PKEY_verify(vctx, sigbuf, sigbuf_len, digest->b.buffer, digest->b.size) != 1)
+        ERROR_RETURN(TPM_RC_FAILURE);
+
+#else
     eckey = EC_KEY_new();
 
     if (r == NULL || s == NULL || q == NULL || sig == NULL || eckey == NULL)
@@ -788,13 +811,19 @@ BnValidateSignatureEcdsa(
         retVal = TPM_RC_FAILURE;
         break;
     }
+#endif
 
  Exit:
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+    EVP_PKEY_free(pkey);
+    EVP_PKEY_CTX_free(vctx);
+#else
     EC_KEY_free(eckey);
-    ECDSA_SIG_free(sig);
-    EC_POINT_clear_free(q);
     BN_clear_free(r);
     BN_clear_free(s);
+#endif
+    ECDSA_SIG_free(sig);
+    EC_POINT_clear_free(q);
 
     return retVal;
 }

src/tpm2/crypto/openssl/Helpers.c

@@ -373,7 +373,8 @@ TPM_RC DoEVPGetIV(
 static OSSL_PARAM *
 OpenSSLBuildEcParams(
                      const EC_GROUP   *G,  // IN: the group to convert to OSSL_PARAM
-                     const BIGNUM     *D   // IN: optional private key
+                     const BIGNUM     *D,  // IN: optional private key
+                     const EC_POINT   *Q   // IN: optional public point
                      )
 {
     const char     *field_name;
@@ -385,6 +386,8 @@ OpenSSLBuildEcParams(
     unsigned char  *buffer = NULL;
     size_t          buffer_size;
     OSSL_PARAM     *params = NULL;
+    unsigned char  *qbuffer = NULL;
+    size_t          qbuffer_size;
 
     pAssert(G != NULL);
 
@@ -422,10 +425,22 @@ OpenSSLBuildEcParams(
         OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PRIV_KEY, D) != 1)
         goto Exit;
 
+    if (Q) {
+        if ((qbuffer_size = EC_POINT_point2oct(G, Q, POINT_CONVERSION_UNCOMPRESSED,
+                                               NULL, 0, NULL)) <= 0 ||
+            (qbuffer = OPENSSL_malloc(qbuffer_size)) == NULL ||
+            EC_POINT_point2oct(G, Q, POINT_CONVERSION_UNCOMPRESSED,
+                               qbuffer, qbuffer_size, NULL) != qbuffer_size ||
+            OSSL_PARAM_BLD_push_octet_string(bld, OSSL_PKEY_PARAM_PUB_KEY,
+                                             qbuffer, qbuffer_size) != 1)
+        goto Exit;
+    }
+
     params = OSSL_PARAM_BLD_to_param(bld);
 
  Exit:
     OSSL_PARAM_BLD_free(bld);
+    OPENSSL_free(qbuffer);
     OPENSSL_free(buffer);
     BN_free(b);
     BN_free(a);
@@ -453,7 +468,7 @@ OpenSSLEccGetPrivate(
 
     if ((ctx = EVP_PKEY_CTX_new_from_name(NULL, "EC", NULL)) == NULL ||
         EVP_PKEY_keygen_init(ctx) != 1 ||
-        (params = OpenSSLBuildEcParams(G, NULL)) == NULL ||
+        (params = OpenSSLBuildEcParams(G, NULL, NULL)) == NULL ||
         EVP_PKEY_CTX_set_params(ctx, params) != 1)
         goto Exit;
 
@@ -518,7 +533,7 @@ TPM_RC BuildEcPrivateKey(
         EVP_PKEY_fromdata_init(ctx) != 1)
         ERROR_RETURN(TPM_RC_FAILURE);
 
-    if ((grp_params = OpenSSLBuildEcParams(G, D)) == NULL)
+    if ((grp_params = OpenSSLBuildEcParams(G, D, NULL)) == NULL)
         ERROR_RETURN(TPM_RC_FAILURE);
 
     if (EVP_PKEY_fromdata(ctx, ppkey, EVP_PKEY_KEY_PARAMETERS | EVP_PKEY_KEYPAIR, grp_params) != 1)
@@ -531,6 +546,35 @@ TPM_RC BuildEcPrivateKey(
     return retVal;
 }
 
+TPM_RC BuildEcPublicKey(
+                        EVP_PKEY         **ppkey, // OUT
+                        const EC_GROUP    *G,     // IN: group of the key
+                        const EC_POINT    *Q      // IN: public point
+                       )
+{
+    TPM_RC          retVal = 0;
+    EVP_PKEY_CTX   *ctx = NULL;
+    OSSL_PARAM     *grp_params = NULL;
+
+    if ((ctx = EVP_PKEY_CTX_new_from_name(NULL, "EC", NULL)) == NULL ||
+        EVP_PKEY_fromdata_init(ctx) != 1)
+        ERROR_RETURN(TPM_RC_FAILURE);
+
+    if ((grp_params = OpenSSLBuildEcParams(G, NULL, Q)) == NULL)
+        ERROR_RETURN(TPM_RC_FAILURE);
+
+    if (EVP_PKEY_fromdata(ctx, ppkey,
+                          EVP_PKEY_KEY_PARAMETERS | EVP_PKEY_PUBLIC_KEY,
+                          grp_params) != 1)
+        ERROR_RETURN(TPM_RC_FAILURE);
+
+ Exit:
+    OSSL_PARAM_free(grp_params);
+    EVP_PKEY_CTX_free(ctx);
+
+    return retVal;
+}
+
 #else
 
 BOOL

src/tpm2/crypto/openssl/Helpers_fp.h

@@ -100,6 +100,12 @@ TPM_RC BuildEcPrivateKey(
                          const EC_GROUP    *G,     // IN: group of the key
                          const BIGNUM      *D      // IN: private key
                         );
+
+TPM_RC BuildEcPublicKey(
+                        EVP_PKEY         **ppkey, // OUT
+                        const EC_GROUP    *G,     // IN: group of the key
+                        const EC_POINT    *Q      // IN: public point
+                       );
 #endif
 #endif