Intel® Enhanced Privacy ID SDK 2.0.0

verifysig.c

This is an example of how to call the SDK verifier APIs.

/*############################################################################
# Copyright 2016 Intel Corporation
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
############################################################################*/
#include "src/verifysig.h"
#include <stdlib.h>
#include "util/buffutil.h"
#include "util/envutil.h"
bool IsCaCertAuthorizedByRootCa(void const* data, size_t size) {
// Implementation of this function is out of scope of the sample.
// In an actual implementation Issuing CA certificate must be validated
// with CA Root certificate before using it in parse functions.
(void)data;
(void)size;
return true;
}
EpidStatus AuthenticateAndAllocateRl(void const* buf, size_t len,
EpidCaCertificate const* cert,
EpidFileType file_type, const char* name,
void** new_rl, size_t* rl_len);
EpidStatus Verify(EpidSignature const* sig, size_t sig_len, void const* msg,
size_t msg_len, void const* basename, size_t basename_len,
void const* signed_priv_rl, size_t signed_priv_rl_size,
void const* signed_sig_rl, size_t signed_sig_rl_size,
void const* signed_grp_rl, size_t signed_grp_rl_size,
VerifierRl const* ver_rl, size_t ver_rl_size,
void const* signed_pub_key, size_t signed_pub_key_size,
EpidCaCertificate const* cacert, HashAlg hash_alg,
VerifierPrecomp* precomp, bool is_precomp_init) {
EpidStatus result = kEpidErr;
VerifierCtx* ctx = NULL;
PrivRl* priv_rl = NULL;
size_t priv_rl_size = 0;
SigRl* sig_rl = NULL;
size_t sig_rl_size = 0;
GroupRl* grp_rl = NULL;
size_t grp_rl_size = 0;
do {
GroupPubKey pub_key = {0};
// authenticate and extract group public key
result = EpidParseGroupPubKeyFile(signed_pub_key, signed_pub_key_size,
cacert, &pub_key);
if (kEpidNoErr != result) {
break;
}
if (is_precomp_init && precomp) {
// create verifier
result = EpidVerifierCreate(&pub_key, precomp, &ctx);
if (kEpidNoErr != result) {
break;
}
} else {
// create verifier
result = EpidVerifierCreate(&pub_key, NULL, &ctx);
if (kEpidNoErr != result) {
break;
}
// initialize pre-computation blob
result = EpidVerifierWritePrecomp(ctx, precomp);
if (kEpidNoErr != result) {
break;
}
}
// set hash algorithm used for signing
result = EpidVerifierSetHashAlg(ctx, hash_alg);
if (kEpidNoErr != result) {
break;
}
if (signed_priv_rl) {
result = AuthenticateAndAllocateRl(signed_priv_rl, signed_priv_rl_size,
cacert, kPrivRlFile, "PrivRl",
(void**)&priv_rl, &priv_rl_size);
if (kEpidNoErr != result) {
break;
}
// set private key based revocation list
result = EpidVerifierSetPrivRl(ctx, priv_rl, priv_rl_size);
if (kEpidNoErr != result) {
break;
}
}
if (signed_sig_rl) {
result = AuthenticateAndAllocateRl(signed_sig_rl, signed_sig_rl_size,
cacert, kSigRlFile, "SigRl",
(void**)&sig_rl, &sig_rl_size);
if (kEpidNoErr != result) {
break;
}
// set signature based revocation list
result = EpidVerifierSetSigRl(ctx, sig_rl, sig_rl_size);
if (kEpidNoErr != result) {
break;
}
}
if (signed_grp_rl) {
result = AuthenticateAndAllocateRl(signed_grp_rl, signed_grp_rl_size,
cacert, kGroupRlFile, "GroupRl",
(void**)&grp_rl, &grp_rl_size);
if (kEpidNoErr != result) {
break;
}
// set group based revocation list
result = EpidVerifierSetGroupRl(ctx, grp_rl, grp_rl_size);
if (kEpidNoErr != result) {
break;
}
}
if (ver_rl) {
// set verifier based revocation list
result = EpidVerifierSetVerifierRl(ctx, ver_rl, ver_rl_size);
if (kEpidNoErr != result) {
break;
}
}
// verify signature
result =
EpidVerify(ctx, sig, sig_len, msg, msg_len, basename, basename_len);
if (kEpidNoErr != result) {
break;
}
} while (0);
// delete verifier
EpidVerifierDelete(&ctx);
if (priv_rl) free(priv_rl);
if (sig_rl) free(sig_rl);
if (grp_rl) free(grp_rl);
return result;
}
EpidStatus AuthenticateAndAllocateRl(void const* buf, size_t len,
EpidCaCertificate const* cert,
EpidFileType file_type, const char* name,
void** new_rl, size_t* rl_len) {
typedef EpidStatus (*ParseFuncType)(void const* buf, size_t len,
EpidCaCertificate const* cert,
unsigned char* rl, size_t* rl_len);
EpidStatus result = kEpidErr;
void* parsed_rl = NULL;
ParseFuncType ParseFunc = NULL;
if (!buf || !cert || !new_rl || !rl_len || !name) {
return kEpidBadArgErr;
}
switch (file_type) {
case kPrivRlFile:
ParseFunc = (ParseFuncType)&EpidParsePrivRlFile;
break;
case kSigRlFile:
ParseFunc = (ParseFuncType)&EpidParseSigRlFile;
break;
case kGroupRlFile:
ParseFunc = (ParseFuncType)&EpidParseGroupRlFile;
break;
default:
return kEpidBadArgErr;
}
do {
size_t parsed_len = 0;
// authenticate and determine space needed for RL
result = ParseFunc(buf, len, cert, NULL, &parsed_len);
if (kEpidSigInvalid == result) {
// authentication failure
break;
}
if (kEpidNoErr != result) {
break;
}
parsed_rl = AllocBuffer(parsed_len);
if (!parsed_rl) {
result = kEpidMemAllocErr;
break;
}
// fill the rl
result = ParseFunc(buf, len, cert, parsed_rl, &parsed_len);
if (kEpidNoErr != result) {
break;
}
*rl_len = parsed_len;
*new_rl = parsed_rl;
} while (0);
if (kEpidNoErr != result) {
if (parsed_rl) free(parsed_rl);
}
return result;
}