This post is older than 2 years and might not be relevant anymore
More Info: Consider searching for newer posts

verifying signature ecc dsa with secp256r1 zephyr

Hello,

I am trying to verify a signature with the `NIST p-256` curve. I had previously done this with the Nrf5 sdk and it is working: 

bool verify(const uint8_t message[AUTHENTICATOR_MESSAGE_SIZE], const uint8_t signature[AUTHENTICATOR_SIGNATURE_SIZE]){
    
    ret_code_t err_code;
    
    nrf_crypto_ecc_public_key_t root_key;
    err_code = nrf_crypto_ecc_public_key_from_raw(&g_nrf_crypto_ecc_secp256r1_curve_info, &root_key, ROOT_PUBLIC_KEY, AUTHENTICATOR_PUBLIC_KEY_SIZE);
    if(err_code){
        return false;
    }
    
    nrf_crypto_hash_sha256_digest_t hash_digest;
    size_t hash_digest_size = NRF_CRYPTO_HASH_SIZE_SHA256;
    nrf_crypto_hash_context_t context = { };
    err_code = nrf_crypto_hash_calculate(&context, &g_nrf_crypto_hash_sha256_info, message, AUTHENTICATOR_MESSAGE_SIZE, hash_digest, &hash_digest_size);
    if (err_code) {
		return false;
	}
	
	
	nrf_crypto_ecdsa_verify_context_t m_verify_context = { 0 };
	err_code = nrf_crypto_ecdsa_verify(&m_verify_context, &root_key, hash_digest, hash_digest_size, message_signature, AUTHENTICATOR_SIGNATURE_SIZE);
	return err_code == NRF_SUCCESS;
}

I am now trying to migrate this into zephyr using the same public key but it is not working (failing on uECC_verify). 

static const struct uECC_Curve_t *AUTH_CURVE = uECC_secp256r1();

bool verify(const uint8_t message[AUTHENTICATOR_MESSAGE_SIZE], const uint8_t signature[AUTHENTICATOR_SIGNATURE_SIZE]){
	tc_sha256_state_struct  sha;
	if (tc_sha256_init(&sha) != TC_CRYPTO_SUCCESS) {
		LOG_ERR("Failed to init sha256");
		return false;
	}
	
	if (tc_sha256_update(&sha, message, AUTHENTICATOR_MESSAGE_SIZE) != TC_CRYPTO_SUCCESS) {
		LOG_ERR("Failed to update sha256");
		return false;
	}
	
	uint8_t sha_digest[TC_SHA256_DIGEST_SIZE];
	if (tc_sha256_final(sha_digest, &sha) != TC_CRYPTO_SUCCESS) {
		LOG_ERR("Failed to finalize sha256");
		return false;
	}
	
	if (uECC_verify(ROOT_PUBLIC_KEY, sha_digest, TC_SHA256_DIGEST_SIZE, signature, AUTH_CURVE) != TC_CRYPTO_SUCCESS) {
		LOG_ERR("Failed to verify signature");
		return false;
	}
}

I assume the require public key format is different between the sdks but I can not find any examples.

Parents Reply Children
No Data
Related