| package org.bouncycastle.crypto.signers; |
| |
| import org.bouncycastle.crypto.CipherParameters; |
| import org.bouncycastle.crypto.DSA; |
| import org.bouncycastle.crypto.params.DSAKeyParameters; |
| import org.bouncycastle.crypto.params.DSAParameters; |
| import org.bouncycastle.crypto.params.DSAPrivateKeyParameters; |
| import org.bouncycastle.crypto.params.DSAPublicKeyParameters; |
| import org.bouncycastle.crypto.params.ParametersWithRandom; |
| |
| import java.math.BigInteger; |
| import java.security.SecureRandom; |
| |
| /** |
| * The Digital Signature Algorithm - as described in "Handbook of Applied |
| * Cryptography", pages 452 - 453. |
| */ |
| public class DSASigner |
| implements DSA |
| { |
| DSAKeyParameters key; |
| |
| SecureRandom random; |
| |
| public void init( |
| boolean forSigning, |
| CipherParameters param) |
| { |
| if (forSigning) |
| { |
| if (param instanceof ParametersWithRandom) |
| { |
| ParametersWithRandom rParam = (ParametersWithRandom)param; |
| |
| this.random = rParam.getRandom(); |
| this.key = (DSAPrivateKeyParameters)rParam.getParameters(); |
| } |
| else |
| { |
| this.random = new SecureRandom(); |
| this.key = (DSAPrivateKeyParameters)param; |
| } |
| } |
| else |
| { |
| this.key = (DSAPublicKeyParameters)param; |
| } |
| } |
| |
| /** |
| * generate a signature for the given message using the key we were |
| * initialised with. For conventional DSA the message should be a SHA-1 |
| * hash of the message of interest. |
| * |
| * @param message the message that will be verified later. |
| */ |
| public BigInteger[] generateSignature( |
| byte[] message) |
| { |
| DSAParameters params = key.getParameters(); |
| BigInteger m = calculateE(params.getQ(), message); |
| BigInteger k; |
| int qBitLength = params.getQ().bitLength(); |
| |
| do |
| { |
| k = new BigInteger(qBitLength, random); |
| } |
| while (k.compareTo(params.getQ()) >= 0); |
| |
| BigInteger r = params.getG().modPow(k, params.getP()).mod(params.getQ()); |
| |
| k = k.modInverse(params.getQ()).multiply( |
| m.add(((DSAPrivateKeyParameters)key).getX().multiply(r))); |
| |
| BigInteger s = k.mod(params.getQ()); |
| |
| BigInteger[] res = new BigInteger[2]; |
| |
| res[0] = r; |
| res[1] = s; |
| |
| return res; |
| } |
| |
| /** |
| * return true if the value r and s represent a DSA signature for |
| * the passed in message for standard DSA the message should be a |
| * SHA-1 hash of the real message to be verified. |
| */ |
| public boolean verifySignature( |
| byte[] message, |
| BigInteger r, |
| BigInteger s) |
| { |
| DSAParameters params = key.getParameters(); |
| BigInteger m = calculateE(params.getQ(), message); |
| BigInteger zero = BigInteger.valueOf(0); |
| |
| if (zero.compareTo(r) >= 0 || params.getQ().compareTo(r) <= 0) |
| { |
| return false; |
| } |
| |
| if (zero.compareTo(s) >= 0 || params.getQ().compareTo(s) <= 0) |
| { |
| return false; |
| } |
| |
| BigInteger w = s.modInverse(params.getQ()); |
| |
| BigInteger u1 = m.multiply(w).mod(params.getQ()); |
| BigInteger u2 = r.multiply(w).mod(params.getQ()); |
| |
| u1 = params.getG().modPow(u1, params.getP()); |
| u2 = ((DSAPublicKeyParameters)key).getY().modPow(u2, params.getP()); |
| |
| BigInteger v = u1.multiply(u2).mod(params.getP()).mod(params.getQ()); |
| |
| return v.equals(r); |
| } |
| |
| private BigInteger calculateE(BigInteger n, byte[] message) |
| { |
| if (n.bitLength() >= message.length * 8) |
| { |
| return new BigInteger(1, message); |
| } |
| else |
| { |
| byte[] trunc = new byte[n.bitLength() / 8]; |
| |
| System.arraycopy(message, 0, trunc, 0, trunc.length); |
| |
| return new BigInteger(1, trunc); |
| } |
| } |
| } |