SPRUJ17H March 2022 – October 2024 AM2631 , AM2631-Q1 , AM2632 , AM2632-Q1 , AM2634 , AM2634-Q1
The ECDSAp sign and verify operations shown in Table 7-114, ECDSA on Prime Curve y2 = x3 + ax + b (mod p), perform signature generation respectively verification according to Section 6 of [FIPS 186-3].
Besides the curve parameters p, a, and b already known from the ECpADDxyz and ECpMULxyz operations, the ECDSA operations require also the input of the curve's base (or generator) point Gx, Gy, and the order (n) of that point.
The input parameters Rz and R'z (the latter for ECDSApvrfy only) are reserved for randomizing the point multiplications with G respectively Y. This side-channel attack counter measure has not been implemented and both Rz and R'z must be set to 1 in the firmware.
The H input must be a large integer derived from the hash value for the message to signed or verified. If the size of the message digest (in bits) exceeds the size of the curve order (n) in bits, then excess bits from the right of the digest value must be dropped. Next, the digest value must be converted to a number by considering the (remaining) digest bits to represent a big integer in big-endian format, so the right-most bit of the (truncated) digest is the least significant.
The k input for the sign operation must be a random number in the range 1...n-1. The same k value must never be used twice, since this may jeopardize the secrecy of the private key used for signing.
Warning for curves with n > p: The input format requires that the curve's prime p and order n can be expressed in the same number of words, without having to add a leading-zero word to p. This restriction causes that some curves cannot be used, like SEC_P_160_R1 and SEC_P_160_R2 that have a 160-bit p but a 161-bit n.
The maximum supported Modulus size for prime fields is 768 bits (24 words).
Function | Requirements |
---|---|
ECDSApsign & ECDSApvrfy | 1 < BLen <= 24 Modulus p must be a prime > 263 The highest word of the modulus vector, as indicated by BLen, may not be zero. 0 < k < n Size of H (in bits) must not exceed the size of n (in bits). 0 < X < n Y = X * G, that is, public key Y is the curve's base point multiplied by private key X. 0 < R < Q 0 < S < Q Rz = 1 and R'z = 1 |
Function | WorkSpace size (in 32-bit Words) |
---|---|
ECDSApsign | 19 * (BLen + 2 + BLen MOD 2) |
ECDSApvrfy | 25 * (BLen + 2 + BLen MOD 2) |
Status Code | Description |
---|---|
0x01 | Command executed successfully. That is, a signature was generated or verified successfully. |
0x03 | p is even. |
0x07 | p is too small (below 33 bits). |
0x0D | Result of a point add/multiply is "at-inifinity" (1). |
0x13 | An intermediate result of a point multiply was "at-infinity" (1). |
0x17 | The inverse of k or S does not exist. |
0x23 | Invalid argument. That is, the value for k, R or S was out-of-range (not in 1...n-1). |
0x27 | On ECDSApsign: R or S came out as zero; retry the sign operation with a different value for k. On ECDSApvrfy: Signature mismatch; All calculations completed normally, but the signature does not match the given message hash. |