visaljs 0.0.2 → 0.0.3

package/runtime/third_party/bearssl/src/ec/ecdsa_i15_sign_raw.c

@@ -1,174 +0,0 @@
-/*
- * Copyright (c) 2017 Thomas Pornin <pornin@bolet.org>
- *
- * Permission is hereby granted, free of charge, to any person obtaining 
- * a copy of this software and associated documentation files (the
- * "Software"), to deal in the Software without restriction, including
- * without limitation the rights to use, copy, modify, merge, publish,
- * distribute, sublicense, and/or sell copies of the Software, and to
- * permit persons to whom the Software is furnished to do so, subject to
- * the following conditions:
- *
- * The above copyright notice and this permission notice shall be 
- * included in all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
- * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
- * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
- * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- */
-
-#include "inner.h"
-
-#define I15_LEN     ((BR_MAX_EC_SIZE + 29) / 15)
-#define POINT_LEN   (1 + (((BR_MAX_EC_SIZE + 7) >> 3) << 1))
-#define ORDER_LEN   ((BR_MAX_EC_SIZE + 7) >> 3)
-
-/* see bearssl_ec.h */
-size_t
-br_ecdsa_i15_sign_raw(const br_ec_impl *impl,
-	const br_hash_class *hf, const void *hash_value,
-	const br_ec_private_key *sk, void *sig)
-{
-	/*
-	 * IMPORTANT: this code is fit only for curves with a prime
-	 * order. This is needed so that modular reduction of the X
-	 * coordinate of a point can be done with a simple subtraction.
-	 * We also rely on the last byte of the curve order to be distinct
-	 * from 0 and 1.
-	 */
-	const br_ec_curve_def *cd;
-	uint16_t n[I15_LEN], r[I15_LEN], s[I15_LEN], x[I15_LEN];
-	uint16_t m[I15_LEN], k[I15_LEN], t1[I15_LEN], t2[I15_LEN];
-	unsigned char tt[ORDER_LEN << 1];
-	unsigned char eU[POINT_LEN];
-	size_t hash_len, nlen, ulen;
-	uint16_t n0i;
-	uint32_t ctl;
-	br_hmac_drbg_context drbg;
-
-	/*
-	 * If the curve is not supported, then exit with an error.
-	 */
-	if (((impl->supported_curves >> sk->curve) & 1) == 0) {
-		return 0;
-	}
-
-	/*
-	 * Get the curve parameters (generator and order).
-	 */
-	switch (sk->curve) {
-	case BR_EC_secp256r1:
-		cd = &br_secp256r1;
-		break;
-	case BR_EC_secp384r1:
-		cd = &br_secp384r1;
-		break;
-	case BR_EC_secp521r1:
-		cd = &br_secp521r1;
-		break;
-	default:
-		return 0;
-	}
-
-	/*
-	 * Get modulus.
-	 */
-	nlen = cd->order_len;
-	br_i15_decode(n, cd->order, nlen);
-	n0i = br_i15_ninv15(n[1]);
-
-	/*
-	 * Get private key as an i15 integer. This also checks that the
-	 * private key is well-defined (not zero, and less than the
-	 * curve order).
-	 */
-	if (!br_i15_decode_mod(x, sk->x, sk->xlen, n)) {
-		return 0;
-	}
-	if (br_i15_iszero(x)) {
-		return 0;
-	}
-
-	/*
-	 * Get hash length.
-	 */
-	hash_len = (hf->desc >> BR_HASHDESC_OUT_OFF) & BR_HASHDESC_OUT_MASK;
-
-	/*
-	 * Truncate and reduce the hash value modulo the curve order.
-	 */
-	br_ecdsa_i15_bits2int(m, hash_value, hash_len, n[0]);
-	br_i15_sub(m, n, br_i15_sub(m, n, 0) ^ 1);
-
-	/*
-	 * RFC 6979 generation of the "k" value.
-	 *
-	 * The process uses HMAC_DRBG (with the hash function used to
-	 * process the message that is to be signed). The seed is the
-	 * concatenation of the encodings of the private key and
-	 * the hash value (after truncation and modular reduction).
-	 */
-	br_i15_encode(tt, nlen, x);
-	br_i15_encode(tt + nlen, nlen, m);
-	br_hmac_drbg_init(&drbg, hf, tt, nlen << 1);
-	for (;;) {
-		br_hmac_drbg_generate(&drbg, tt, nlen);
-		br_ecdsa_i15_bits2int(k, tt, nlen, n[0]);
-		if (br_i15_iszero(k)) {
-			continue;
-		}
-		if (br_i15_sub(k, n, 0)) {
-			break;
-		}
-	}
-
-	/*
-	 * Compute k*G and extract the X coordinate, then reduce it
-	 * modulo the curve order. Since we support only curves with
-	 * prime order, that reduction is only a matter of computing
-	 * a subtraction.
-	 */
-	br_i15_encode(tt, nlen, k);
-	ulen = impl->mulgen(eU, tt, nlen, sk->curve);
-	br_i15_zero(r, n[0]);
-	br_i15_decode(r, &eU[1], ulen >> 1);
-	r[0] = n[0];
-	br_i15_sub(r, n, br_i15_sub(r, n, 0) ^ 1);
-
-	/*
-	 * Compute 1/k in double-Montgomery representation. We do so by
-	 * first converting _from_ Montgomery representation (twice),
-	 * then using a modular exponentiation.
-	 */
-	br_i15_from_monty(k, n, n0i);
-	br_i15_from_monty(k, n, n0i);
-	memcpy(tt, cd->order, nlen);
-	tt[nlen - 1] -= 2;
-	br_i15_modpow(k, tt, nlen, n, n0i, t1, t2);
-
-	/*
-	 * Compute s = (m+xr)/k (mod n).
-	 * The k[] array contains R^2/k (double-Montgomery representation);
-	 * we thus can use direct Montgomery multiplications and conversions
-	 * from Montgomery, avoiding any call to br_i15_to_monty() (which
-	 * is slower).
-	 */
-	br_i15_from_monty(m, n, n0i);
-	br_i15_montymul(t1, x, r, n, n0i);
-	ctl = br_i15_add(t1, m, 1);
-	ctl |= br_i15_sub(t1, n, 0) ^ 1;
-	br_i15_sub(t1, n, ctl);
-	br_i15_montymul(s, t1, k, n, n0i);
-
-	/*
-	 * Encode r and s in the signature.
-	 */
-	br_i15_encode(sig, nlen, r);
-	br_i15_encode((unsigned char *)sig + nlen, nlen, s);
-	return nlen << 1;
-}

package/runtime/third_party/bearssl/src/ec/ecdsa_i15_vrfy_asn1.c

@@ -1,48 +0,0 @@
-/*
- * Copyright (c) 2017 Thomas Pornin <pornin@bolet.org>
- *
- * Permission is hereby granted, free of charge, to any person obtaining 
- * a copy of this software and associated documentation files (the
- * "Software"), to deal in the Software without restriction, including
- * without limitation the rights to use, copy, modify, merge, publish,
- * distribute, sublicense, and/or sell copies of the Software, and to
- * permit persons to whom the Software is furnished to do so, subject to
- * the following conditions:
- *
- * The above copyright notice and this permission notice shall be 
- * included in all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
- * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
- * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
- * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- */
-
-#include "inner.h"
-
-#define FIELD_LEN   ((BR_MAX_EC_SIZE + 7) >> 3)
-
-/* see bearssl_ec.h */
-uint32_t
-br_ecdsa_i15_vrfy_asn1(const br_ec_impl *impl,
-	const void *hash, size_t hash_len,
-	const br_ec_public_key *pk,
-	const void *sig, size_t sig_len)
-{
-	/*
-	 * We use a double-sized buffer because a malformed ASN.1 signature
-	 * may trigger a size expansion when converting to "raw" format.
-	 */
-	unsigned char rsig[(FIELD_LEN << 2) + 24];
-
-	if (sig_len > ((sizeof rsig) >> 1)) {
-		return 0;
-	}
-	memcpy(rsig, sig, sig_len);
-	sig_len = br_ecdsa_asn1_to_raw(rsig, sig_len);
-	return br_ecdsa_i15_vrfy_raw(impl, hash, hash_len, pk, rsig, sig_len);
-}

package/runtime/third_party/bearssl/src/ec/ecdsa_i15_vrfy_raw.c

@@ -1,166 +0,0 @@
-/*
- * Copyright (c) 2017 Thomas Pornin <pornin@bolet.org>
- *
- * Permission is hereby granted, free of charge, to any person obtaining 
- * a copy of this software and associated documentation files (the
- * "Software"), to deal in the Software without restriction, including
- * without limitation the rights to use, copy, modify, merge, publish,
- * distribute, sublicense, and/or sell copies of the Software, and to
- * permit persons to whom the Software is furnished to do so, subject to
- * the following conditions:
- *
- * The above copyright notice and this permission notice shall be 
- * included in all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
- * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
- * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
- * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- */
-
-#include "inner.h"
-
-#define I15_LEN     ((BR_MAX_EC_SIZE + 29) / 15)
-#define POINT_LEN   (1 + (((BR_MAX_EC_SIZE + 7) >> 3) << 1))
-
-/* see bearssl_ec.h */
-uint32_t
-br_ecdsa_i15_vrfy_raw(const br_ec_impl *impl,
-	const void *hash, size_t hash_len,
-	const br_ec_public_key *pk,
-	const void *sig, size_t sig_len)
-{
-	/*
-	 * IMPORTANT: this code is fit only for curves with a prime
-	 * order. This is needed so that modular reduction of the X
-	 * coordinate of a point can be done with a simple subtraction.
-	 */
-	const br_ec_curve_def *cd;
-	uint16_t n[I15_LEN], r[I15_LEN], s[I15_LEN], t1[I15_LEN], t2[I15_LEN];
-	unsigned char tx[(BR_MAX_EC_SIZE + 7) >> 3];
-	unsigned char ty[(BR_MAX_EC_SIZE + 7) >> 3];
-	unsigned char eU[POINT_LEN];
-	size_t nlen, rlen, ulen;
-	uint16_t n0i;
-	uint32_t res;
-
-	/*
-	 * If the curve is not supported, then report an error.
-	 */
-	if (((impl->supported_curves >> pk->curve) & 1) == 0) {
-		return 0;
-	}
-
-	/*
-	 * Get the curve parameters (generator and order).
-	 */
-	switch (pk->curve) {
-	case BR_EC_secp256r1:
-		cd = &br_secp256r1;
-		break;
-	case BR_EC_secp384r1:
-		cd = &br_secp384r1;
-		break;
-	case BR_EC_secp521r1:
-		cd = &br_secp521r1;
-		break;
-	default:
-		return 0;
-	}
-
-	/*
-	 * Signature length must be even.
-	 */
-	if (sig_len & 1) {
-		return 0;
-	}
-	rlen = sig_len >> 1;
-
-	/*
-	 * Public key point must have the proper size for this curve.
-	 */
-	if (pk->qlen != cd->generator_len) {
-		return 0;
-	}
-
-	/*
-	 * Get modulus; then decode the r and s values. They must be
-	 * lower than the modulus, and s must not be null.
-	 */
-	nlen = cd->order_len;
-	br_i15_decode(n, cd->order, nlen);
-	n0i = br_i15_ninv15(n[1]);
-	if (!br_i15_decode_mod(r, sig, rlen, n)) {
-		return 0;
-	}
-	if (!br_i15_decode_mod(s, (const unsigned char *)sig + rlen, rlen, n)) {
-		return 0;
-	}
-	if (br_i15_iszero(s)) {
-		return 0;
-	}
-
-	/*
-	 * Invert s. We do that with a modular exponentiation; we use
-	 * the fact that for all the curves we support, the least
-	 * significant byte is not 0 or 1, so we can subtract 2 without
-	 * any carry to process.
-	 * We also want 1/s in Montgomery representation, which can be
-	 * done by converting _from_ Montgomery representation before
-	 * the inversion (because (1/s)*R = 1/(s/R)).
-	 */
-	br_i15_from_monty(s, n, n0i);
-	memcpy(tx, cd->order, nlen);
-	tx[nlen - 1] -= 2;
-	br_i15_modpow(s, tx, nlen, n, n0i, t1, t2);
-
-	/*
-	 * Truncate the hash to the modulus length (in bits) and reduce
-	 * it modulo the curve order. The modular reduction can be done
-	 * with a subtraction since the truncation already reduced the
-	 * value to the modulus bit length.
-	 */
-	br_ecdsa_i15_bits2int(t1, hash, hash_len, n[0]);
-	br_i15_sub(t1, n, br_i15_sub(t1, n, 0) ^ 1);
-
-	/*
-	 * Multiply the (truncated, reduced) hash value with 1/s, result in
-	 * t2, encoded in ty.
-	 */
-	br_i15_montymul(t2, t1, s, n, n0i);
-	br_i15_encode(ty, nlen, t2);
-
-	/*
-	 * Multiply r with 1/s, result in t1, encoded in tx.
-	 */
-	br_i15_montymul(t1, r, s, n, n0i);
-	br_i15_encode(tx, nlen, t1);
-
-	/*
-	 * Compute the point x*Q + y*G.
-	 */
-	ulen = cd->generator_len;
-	memcpy(eU, pk->q, ulen);
-	res = impl->muladd(eU, NULL, ulen,
-		tx, nlen, ty, nlen, cd->curve);
-
-	/*
-	 * Get the X coordinate, reduce modulo the curve order, and
-	 * compare with the 'r' value.
-	 *
-	 * The modular reduction can be done with subtractions because
-	 * we work with curves of prime order, so the curve order is
-	 * close to the field order (Hasse's theorem).
-	 */
-	br_i15_zero(t1, n[0]);
-	br_i15_decode(t1, &eU[1], ulen >> 1);
-	t1[0] = n[0];
-	br_i15_sub(t1, n, br_i15_sub(t1, n, 0) ^ 1);
-	res &= ~br_i15_sub(t1, r, 1);
-	res &= br_i15_iszero(t1);
-	return res;
-}

package/runtime/third_party/bearssl/src/ec/ecdsa_i31_bits.c

@@ -1,47 +0,0 @@
-/*
- * Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
- *
- * Permission is hereby granted, free of charge, to any person obtaining 
- * a copy of this software and associated documentation files (the
- * "Software"), to deal in the Software without restriction, including
- * without limitation the rights to use, copy, modify, merge, publish,
- * distribute, sublicense, and/or sell copies of the Software, and to
- * permit persons to whom the Software is furnished to do so, subject to
- * the following conditions:
- *
- * The above copyright notice and this permission notice shall be 
- * included in all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
- * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
- * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
- * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- */
-
-#include "inner.h"
-
-/* see inner.h */
-void
-br_ecdsa_i31_bits2int(uint32_t *x,
-	const void *src, size_t len, uint32_t ebitlen)
-{
-	uint32_t bitlen, hbitlen;
-	int sc;
-
-	bitlen = ebitlen - (ebitlen >> 5);
-	hbitlen = (uint32_t)len << 3;
-	if (hbitlen > bitlen) {
-		len = (bitlen + 7) >> 3;
-		sc = (int)((hbitlen - bitlen) & 7);
-	} else {
-		sc = 0;
-	}
-	br_i31_zero(x, ebitlen);
-	br_i31_decode(x, src, len);
-	br_i31_rshift(x, sc);
-	x[0] = ebitlen;
-}

package/runtime/third_party/bearssl/src/ec/ecdsa_i31_sign_asn1.c

@@ -1,45 +0,0 @@
-/*
- * Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
- *
- * Permission is hereby granted, free of charge, to any person obtaining 
- * a copy of this software and associated documentation files (the
- * "Software"), to deal in the Software without restriction, including
- * without limitation the rights to use, copy, modify, merge, publish,
- * distribute, sublicense, and/or sell copies of the Software, and to
- * permit persons to whom the Software is furnished to do so, subject to
- * the following conditions:
- *
- * The above copyright notice and this permission notice shall be 
- * included in all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
- * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
- * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
- * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- */
-
-#include "inner.h"
-
-#define ORDER_LEN   ((BR_MAX_EC_SIZE + 7) >> 3)
-
-/* see bearssl_ec.h */
-size_t
-br_ecdsa_i31_sign_asn1(const br_ec_impl *impl,
-	const br_hash_class *hf, const void *hash_value,
-	const br_ec_private_key *sk, void *sig)
-{
-	unsigned char rsig[(ORDER_LEN << 1) + 12];
-	size_t sig_len;
-
-	sig_len = br_ecdsa_i31_sign_raw(impl, hf, hash_value, sk, rsig);
-	if (sig_len == 0) {
-		return 0;
-	}
-	sig_len = br_ecdsa_raw_to_asn1(rsig, sig_len);
-	memcpy(sig, rsig, sig_len);
-	return sig_len;
-}

package/runtime/third_party/bearssl/src/ec/ecdsa_i31_sign_raw.c

@@ -1,173 +0,0 @@
-/*
- * Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
- *
- * Permission is hereby granted, free of charge, to any person obtaining 
- * a copy of this software and associated documentation files (the
- * "Software"), to deal in the Software without restriction, including
- * without limitation the rights to use, copy, modify, merge, publish,
- * distribute, sublicense, and/or sell copies of the Software, and to
- * permit persons to whom the Software is furnished to do so, subject to
- * the following conditions:
- *
- * The above copyright notice and this permission notice shall be 
- * included in all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
- * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
- * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
- * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- */
-
-#include "inner.h"
-
-#define I31_LEN     ((BR_MAX_EC_SIZE + 61) / 31)
-#define POINT_LEN   (1 + (((BR_MAX_EC_SIZE + 7) >> 3) << 1))
-#define ORDER_LEN   ((BR_MAX_EC_SIZE + 7) >> 3)
-
-/* see bearssl_ec.h */
-size_t
-br_ecdsa_i31_sign_raw(const br_ec_impl *impl,
-	const br_hash_class *hf, const void *hash_value,
-	const br_ec_private_key *sk, void *sig)
-{
-	/*
-	 * IMPORTANT: this code is fit only for curves with a prime
-	 * order. This is needed so that modular reduction of the X
-	 * coordinate of a point can be done with a simple subtraction.
-	 * We also rely on the last byte of the curve order to be distinct
-	 * from 0 and 1.
-	 */
-	const br_ec_curve_def *cd;
-	uint32_t n[I31_LEN], r[I31_LEN], s[I31_LEN], x[I31_LEN];
-	uint32_t m[I31_LEN], k[I31_LEN], t1[I31_LEN], t2[I31_LEN];
-	unsigned char tt[ORDER_LEN << 1];
-	unsigned char eU[POINT_LEN];
-	size_t hash_len, nlen, ulen;
-	uint32_t n0i, ctl;
-	br_hmac_drbg_context drbg;
-
-	/*
-	 * If the curve is not supported, then exit with an error.
-	 */
-	if (((impl->supported_curves >> sk->curve) & 1) == 0) {
-		return 0;
-	}
-
-	/*
-	 * Get the curve parameters (generator and order).
-	 */
-	switch (sk->curve) {
-	case BR_EC_secp256r1:
-		cd = &br_secp256r1;
-		break;
-	case BR_EC_secp384r1:
-		cd = &br_secp384r1;
-		break;
-	case BR_EC_secp521r1:
-		cd = &br_secp521r1;
-		break;
-	default:
-		return 0;
-	}
-
-	/*
-	 * Get modulus.
-	 */
-	nlen = cd->order_len;
-	br_i31_decode(n, cd->order, nlen);
-	n0i = br_i31_ninv31(n[1]);
-
-	/*
-	 * Get private key as an i31 integer. This also checks that the
-	 * private key is well-defined (not zero, and less than the
-	 * curve order).
-	 */
-	if (!br_i31_decode_mod(x, sk->x, sk->xlen, n)) {
-		return 0;
-	}
-	if (br_i31_iszero(x)) {
-		return 0;
-	}
-
-	/*
-	 * Get hash length.
-	 */
-	hash_len = (hf->desc >> BR_HASHDESC_OUT_OFF) & BR_HASHDESC_OUT_MASK;
-
-	/*
-	 * Truncate and reduce the hash value modulo the curve order.
-	 */
-	br_ecdsa_i31_bits2int(m, hash_value, hash_len, n[0]);
-	br_i31_sub(m, n, br_i31_sub(m, n, 0) ^ 1);
-
-	/*
-	 * RFC 6979 generation of the "k" value.
-	 *
-	 * The process uses HMAC_DRBG (with the hash function used to
-	 * process the message that is to be signed). The seed is the
-	 * concatenation of the encodings of the private key and
-	 * the hash value (after truncation and modular reduction).
-	 */
-	br_i31_encode(tt, nlen, x);
-	br_i31_encode(tt + nlen, nlen, m);
-	br_hmac_drbg_init(&drbg, hf, tt, nlen << 1);
-	for (;;) {
-		br_hmac_drbg_generate(&drbg, tt, nlen);
-		br_ecdsa_i31_bits2int(k, tt, nlen, n[0]);
-		if (br_i31_iszero(k)) {
-			continue;
-		}
-		if (br_i31_sub(k, n, 0)) {
-			break;
-		}
-	}
-
-	/*
-	 * Compute k*G and extract the X coordinate, then reduce it
-	 * modulo the curve order. Since we support only curves with
-	 * prime order, that reduction is only a matter of computing
-	 * a subtraction.
-	 */
-	br_i31_encode(tt, nlen, k);
-	ulen = impl->mulgen(eU, tt, nlen, sk->curve);
-	br_i31_zero(r, n[0]);
-	br_i31_decode(r, &eU[1], ulen >> 1);
-	r[0] = n[0];
-	br_i31_sub(r, n, br_i31_sub(r, n, 0) ^ 1);
-
-	/*
-	 * Compute 1/k in double-Montgomery representation. We do so by
-	 * first converting _from_ Montgomery representation (twice),
-	 * then using a modular exponentiation.
-	 */
-	br_i31_from_monty(k, n, n0i);
-	br_i31_from_monty(k, n, n0i);
-	memcpy(tt, cd->order, nlen);
-	tt[nlen - 1] -= 2;
-	br_i31_modpow(k, tt, nlen, n, n0i, t1, t2);
-
-	/*
-	 * Compute s = (m+xr)/k (mod n).
-	 * The k[] array contains R^2/k (double-Montgomery representation);
-	 * we thus can use direct Montgomery multiplications and conversions
-	 * from Montgomery, avoiding any call to br_i31_to_monty() (which
-	 * is slower).
-	 */
-	br_i31_from_monty(m, n, n0i);
-	br_i31_montymul(t1, x, r, n, n0i);
-	ctl = br_i31_add(t1, m, 1);
-	ctl |= br_i31_sub(t1, n, 0) ^ 1;
-	br_i31_sub(t1, n, ctl);
-	br_i31_montymul(s, t1, k, n, n0i);
-
-	/*
-	 * Encode r and s in the signature.
-	 */
-	br_i31_encode(sig, nlen, r);
-	br_i31_encode((unsigned char *)sig + nlen, nlen, s);
-	return nlen << 1;
-}

package/runtime/third_party/bearssl/src/ec/ecdsa_i31_vrfy_asn1.c

@@ -1,48 +0,0 @@
-/*
- * Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
- *
- * Permission is hereby granted, free of charge, to any person obtaining 
- * a copy of this software and associated documentation files (the
- * "Software"), to deal in the Software without restriction, including
- * without limitation the rights to use, copy, modify, merge, publish,
- * distribute, sublicense, and/or sell copies of the Software, and to
- * permit persons to whom the Software is furnished to do so, subject to
- * the following conditions:
- *
- * The above copyright notice and this permission notice shall be 
- * included in all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
- * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
- * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
- * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- */
-
-#include "inner.h"
-
-#define FIELD_LEN   ((BR_MAX_EC_SIZE + 7) >> 3)
-
-/* see bearssl_ec.h */
-uint32_t
-br_ecdsa_i31_vrfy_asn1(const br_ec_impl *impl,
-	const void *hash, size_t hash_len,
-	const br_ec_public_key *pk,
-	const void *sig, size_t sig_len)
-{
-	/*
-	 * We use a double-sized buffer because a malformed ASN.1 signature
-	 * may trigger a size expansion when converting to "raw" format.
-	 */
-	unsigned char rsig[(FIELD_LEN << 2) + 24];
-
-	if (sig_len > ((sizeof rsig) >> 1)) {
-		return 0;
-	}
-	memcpy(rsig, sig, sig_len);
-	sig_len = br_ecdsa_asn1_to_raw(rsig, sig_len);
-	return br_ecdsa_i31_vrfy_raw(impl, hash, hash_len, pk, rsig, sig_len);
-}