2 * Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
4 * Permission is hereby granted, free of charge, to any person obtaining
5 * a copy of this software and associated documentation files (the
6 * "Software"), to deal in the Software without restriction, including
7 * without limitation the rights to use, copy, modify, merge, publish,
8 * distribute, sublicense, and/or sell copies of the Software, and to
9 * permit persons to whom the Software is furnished to do so, subject to
10 * the following conditions:
12 * The above copyright notice and this permission notice shall be
13 * included in all copies or substantial portions of the Software.
15 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
16 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
17 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
18 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
19 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
20 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
21 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
25 #ifndef BR_BEARSSL_EC_H__
26 #define BR_BEARSSL_EC_H__
35 /** \file bearssl_ec.h
39 * This file documents the EC implementations provided with BearSSL, and
42 * ## Elliptic Curve API
44 * Only "named curves" are supported. Each EC implementation supports
45 * one or several named curves, identified by symbolic identifiers.
46 * These identifiers are small integers, that correspond to the values
48 * [IANA](http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8).
50 * Since all currently defined elliptic curve identifiers are in the 0..31
51 * range, it is convenient to encode support of some curves in a 32-bit
52 * word, such that bit x corresponds to curve of identifier x.
54 * An EC implementation is incarnated by a `br_ec_impl` instance, that
55 * offers the following fields:
57 * - `supported_curves`
59 * A 32-bit word that documents the identifiers of the curves supported
60 * by this implementation.
64 * Callback method that returns a pointer to the conventional generator
65 * point for that curve.
69 * Callback method that returns a pointer to the subgroup order for
70 * that curve. That value uses unsigned big-endian encoding.
74 * Callback method that returns the offset and length of the X
75 * coordinate in an encoded point.
79 * Multiply a curve point with an integer.
83 * Multiply the curve generator with an integer. This may be faster
84 * than the generic `mul()`.
88 * Multiply two curve points by two integers, and return the sum of
91 * All curve points are represented in uncompressed format. The `mul()`
92 * and `muladd()` methods take care to validate that the provided points
93 * are really part of the relevant curve subgroup.
95 * For all point multiplication functions, the following holds:
97 * - Functions validate that the provided points are valid members
98 * of the relevant curve subgroup. An error is reported if that is
101 * - Processing is constant-time, even if the point operands are not
102 * valid. This holds for both the source and resulting points, and
103 * the multipliers (integers). Only the byte length of the provided
104 * multiplier arrays (not their actual value length in bits) may
105 * leak through timing-based side channels.
107 * - The multipliers (integers) MUST be lower than the subgroup order.
108 * If this property is not met, then the result is indeterminate,
109 * but an error value is not ncessearily returned.
114 * ECDSA signatures have two standard formats, called "raw" and "asn1".
115 * Internally, such a signature is a pair of modular integers `(r,s)`.
116 * The "raw" format is the concatenation of the unsigned big-endian
117 * encodings of these two integers, possibly left-padded with zeros so
118 * that they have the same encoded length. The "asn1" format is the
119 * DER encoding of an ASN.1 structure that contains the two integer
122 * ECDSASignature ::= SEQUENCE {
127 * In general, in all of X.509 and SSL/TLS, the "asn1" format is used.
128 * BearSSL offers ECDSA implementations for both formats; conversion
129 * functions between the two formats are also provided. Conversion of a
130 * "raw" format signature into "asn1" may enlarge a signature by no more
131 * than 9 bytes for all supported curves; conversely, conversion of an
132 * "asn1" signature to "raw" may expand the signature but the "raw"
133 * length will never be more than twice the length of the "asn1" length
134 * (and usually it will be shorter).
136 * Note that for a given signature, the "raw" format is not fully
137 * deterministic, in that it does not enforce a minimal common length.
141 * Standard curve ID. These ID are equal to the assigned numerical
142 * identifiers assigned to these curves for TLS:
143 * http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8
146 /** \brief Identifier for named curve sect163k1. */
147 #define BR_EC_sect163k1 1
149 /** \brief Identifier for named curve sect163r1. */
150 #define BR_EC_sect163r1 2
152 /** \brief Identifier for named curve sect163r2. */
153 #define BR_EC_sect163r2 3
155 /** \brief Identifier for named curve sect193r1. */
156 #define BR_EC_sect193r1 4
158 /** \brief Identifier for named curve sect193r2. */
159 #define BR_EC_sect193r2 5
161 /** \brief Identifier for named curve sect233k1. */
162 #define BR_EC_sect233k1 6
164 /** \brief Identifier for named curve sect233r1. */
165 #define BR_EC_sect233r1 7
167 /** \brief Identifier for named curve sect239k1. */
168 #define BR_EC_sect239k1 8
170 /** \brief Identifier for named curve sect283k1. */
171 #define BR_EC_sect283k1 9
173 /** \brief Identifier for named curve sect283r1. */
174 #define BR_EC_sect283r1 10
176 /** \brief Identifier for named curve sect409k1. */
177 #define BR_EC_sect409k1 11
179 /** \brief Identifier for named curve sect409r1. */
180 #define BR_EC_sect409r1 12
182 /** \brief Identifier for named curve sect571k1. */
183 #define BR_EC_sect571k1 13
185 /** \brief Identifier for named curve sect571r1. */
186 #define BR_EC_sect571r1 14
188 /** \brief Identifier for named curve secp160k1. */
189 #define BR_EC_secp160k1 15
191 /** \brief Identifier for named curve secp160r1. */
192 #define BR_EC_secp160r1 16
194 /** \brief Identifier for named curve secp160r2. */
195 #define BR_EC_secp160r2 17
197 /** \brief Identifier for named curve secp192k1. */
198 #define BR_EC_secp192k1 18
200 /** \brief Identifier for named curve secp192r1. */
201 #define BR_EC_secp192r1 19
203 /** \brief Identifier for named curve secp224k1. */
204 #define BR_EC_secp224k1 20
206 /** \brief Identifier for named curve secp224r1. */
207 #define BR_EC_secp224r1 21
209 /** \brief Identifier for named curve secp256k1. */
210 #define BR_EC_secp256k1 22
212 /** \brief Identifier for named curve secp256r1. */
213 #define BR_EC_secp256r1 23
215 /** \brief Identifier for named curve secp384r1. */
216 #define BR_EC_secp384r1 24
218 /** \brief Identifier for named curve secp521r1. */
219 #define BR_EC_secp521r1 25
221 /** \brief Identifier for named curve brainpoolP256r1. */
222 #define BR_EC_brainpoolP256r1 26
224 /** \brief Identifier for named curve brainpoolP384r1. */
225 #define BR_EC_brainpoolP384r1 27
227 /** \brief Identifier for named curve brainpoolP512r1. */
228 #define BR_EC_brainpoolP512r1 28
230 /** \brief Identifier for named curve Curve25519. */
231 #define BR_EC_curve25519 29
233 /** \brief Identifier for named curve Curve448. */
234 #define BR_EC_curve448 30
237 * \brief Structure for an EC public key.
240 /** \brief Identifier for the curve used by this key. */
242 /** \brief Public curve point (uncompressed format). */
244 /** \brief Length of public curve point (in bytes). */
249 * \brief Structure for an EC private key.
251 * The private key is an integer modulo the curve subgroup order. The
252 * encoding below tolerates extra leading zeros. In general, it is
253 * recommended that the private key has the same length as the curve
257 /** \brief Identifier for the curve used by this key. */
259 /** \brief Private key (integer, unsigned big-endian encoding). */
261 /** \brief Private key length (in bytes). */
266 * \brief Type for an EC implementation.
270 * \brief Supported curves.
272 * This word is a bitfield: bit `x` is set if the curve of ID `x`
273 * is supported. E.g. an implementation supporting both NIST P-256
274 * (secp256r1, ID 23) and NIST P-384 (secp384r1, ID 24) will have
275 * value `0x01800000` in this field.
277 uint32_t supported_curves
;
280 * \brief Get the conventional generator.
282 * This function returns the conventional generator (encoded
283 * curve point) for the specified curve. This function MUST NOT
284 * be called if the curve is not supported.
286 * \param curve curve identifier.
287 * \param len receiver for the encoded generator length (in bytes).
288 * \return the encoded generator.
290 const unsigned char *(*generator
)(int curve
, size_t *len
);
293 * \brief Get the subgroup order.
295 * This function returns the order of the subgroup generated by
296 * the conventional generator, for the specified curve. Unsigned
297 * big-endian encoding is used. This function MUST NOT be called
298 * if the curve is not supported.
300 * \param curve curve identifier.
301 * \param len receiver for the encoded order length (in bytes).
302 * \return the encoded order.
304 const unsigned char *(*order
)(int curve
, size_t *len
);
307 * \brief Get the offset and length for the X coordinate.
309 * This function returns the offset and length (in bytes) of
310 * the X coordinate in an encoded non-zero point.
312 * \param curve curve identifier.
313 * \param len receiver for the X coordinate length (in bytes).
314 * \return the offset for the X coordinate (in bytes).
316 size_t (*xoff
)(int curve
, size_t *len
);
319 * \brief Multiply a curve point by an integer.
321 * The source point is provided in array `G` (of size `Glen` bytes);
322 * the multiplication result is written over it. The multiplier
323 * `x` (of size `xlen` bytes) uses unsigned big-endian encoding.
327 * - The specified curve MUST be supported.
329 * - The source point must be a valid point on the relevant curve
330 * subgroup (and not the "point at infinity" either). If this is
331 * not the case, then this function returns an error (0).
333 * - The multiplier integer MUST be non-zero and less than the
334 * curve subgroup order. If this property does not hold, then
335 * the result is indeterminate and an error code is not
338 * Returned value is 1 on success, 0 on error. On error, the
339 * contents of `G` are indeterminate.
341 * \param G point to multiply.
342 * \param Glen length of the encoded point (in bytes).
343 * \param x multiplier (unsigned big-endian).
344 * \param xlen multiplier length (in bytes).
345 * \param curve curve identifier.
346 * \return 1 on success, 0 on error.
348 uint32_t (*mul
)(unsigned char *G
, size_t Glen
,
349 const unsigned char *x
, size_t xlen
, int curve
);
352 * \brief Multiply the generator by an integer.
354 * The multiplier MUST be non-zero and less than the curve
355 * subgroup order. Results are indeterminate if this property
358 * \param R output buffer for the point.
359 * \param x multiplier (unsigned big-endian).
360 * \param xlen multiplier length (in bytes).
361 * \param curve curve identifier.
362 * \return encoded result point length (in bytes).
364 size_t (*mulgen
)(unsigned char *R
,
365 const unsigned char *x
, size_t xlen
, int curve
);
368 * \brief Multiply two points by two integers and add the
371 * The point `x*A + y*B` is computed and written back in the `A`
376 * - The specified curve MUST be supported.
378 * - The source points (`A` and `B`) must be valid points on
379 * the relevant curve subgroup (and not the "point at
380 * infinity" either). If this is not the case, then this
381 * function returns an error (0).
383 * - If the `B` pointer is `NULL`, then the conventional
384 * subgroup generator is used. With some implementations,
385 * this may be faster than providing a pointer to the
388 * - The multiplier integers (`x` and `y`) MUST be non-zero
389 * and less than the curve subgroup order. If either integer
390 * is zero, then an error is reported, but if one of them is
391 * not lower than the subgroup order, then the result is
392 * indeterminate and an error code is not guaranteed.
394 * - If the final result is the point at infinity, then an
397 * Returned value is 1 on success, 0 on error. On error, the
398 * contents of `A` are indeterminate.
400 * \param A first point to multiply.
401 * \param B second point to multiply (`NULL` for the generator).
402 * \param len common length of the encoded points (in bytes).
403 * \param x multiplier for `A` (unsigned big-endian).
404 * \param xlen length of multiplier for `A` (in bytes).
405 * \param y multiplier for `A` (unsigned big-endian).
406 * \param ylen length of multiplier for `A` (in bytes).
407 * \param curve curve identifier.
408 * \return 1 on success, 0 on error.
410 uint32_t (*muladd
)(unsigned char *A
, const unsigned char *B
, size_t len
,
411 const unsigned char *x
, size_t xlen
,
412 const unsigned char *y
, size_t ylen
, int curve
);
416 * \brief EC implementation "i31".
418 * This implementation internally uses generic code for modular integers,
419 * with a representation as sequences of 31-bit words. It supports secp256r1,
420 * secp384r1 and secp521r1 (aka NIST curves P-256, P-384 and P-521).
422 extern const br_ec_impl br_ec_prime_i31
;
425 * \brief EC implementation "i15".
427 * This implementation internally uses generic code for modular integers,
428 * with a representation as sequences of 15-bit words. It supports secp256r1,
429 * secp384r1 and secp521r1 (aka NIST curves P-256, P-384 and P-521).
431 extern const br_ec_impl br_ec_prime_i15
;
434 * \brief EC implementation "m15" for P-256.
436 * This implementation uses specialised code for curve secp256r1 (also
437 * known as NIST P-256), with optional Karatsuba decomposition, and fast
438 * modular reduction thanks to the field modulus special format. Only
439 * 32-bit multiplications are used (with 32-bit results, not 64-bit).
441 extern const br_ec_impl br_ec_p256_m15
;
444 * \brief EC implementation "m31" for P-256.
446 * This implementation uses specialised code for curve secp256r1 (also
447 * known as NIST P-256), relying on multiplications of 31-bit values
450 extern const br_ec_impl br_ec_p256_m31
;
453 * \brief EC implementation "i15" (generic code) for Curve25519.
455 * This implementation uses the generic code for modular integers (with
456 * 15-bit words) to support Curve25519. Due to the specificities of the
457 * curve definition, the following applies:
459 * - `muladd()` is not implemented (the function returns 0 systematically).
460 * - `order()` returns 2^255-1, since the point multiplication algorithm
461 * accepts any 32-bit integer as input (it clears the top bit and low
462 * three bits systematically).
464 extern const br_ec_impl br_ec_c25519_i15
;
467 * \brief EC implementation "i31" (generic code) for Curve25519.
469 * This implementation uses the generic code for modular integers (with
470 * 31-bit words) to support Curve25519. Due to the specificities of the
471 * curve definition, the following applies:
473 * - `muladd()` is not implemented (the function returns 0 systematically).
474 * - `order()` returns 2^255-1, since the point multiplication algorithm
475 * accepts any 32-bit integer as input (it clears the top bit and low
476 * three bits systematically).
478 extern const br_ec_impl br_ec_c25519_i31
;
481 * \brief EC implementation "m15" (specialised code) for Curve25519.
483 * This implementation uses custom code relying on multiplication of
484 * integers up to 15 bits. Due to the specificities of the curve
485 * definition, the following applies:
487 * - `muladd()` is not implemented (the function returns 0 systematically).
488 * - `order()` returns 2^255-1, since the point multiplication algorithm
489 * accepts any 32-bit integer as input (it clears the top bit and low
490 * three bits systematically).
492 extern const br_ec_impl br_ec_c25519_m15
;
495 * \brief EC implementation "m31" (specialised code) for Curve25519.
497 * This implementation uses custom code relying on multiplication of
498 * integers up to 31 bits. Due to the specificities of the curve
499 * definition, the following applies:
501 * - `muladd()` is not implemented (the function returns 0 systematically).
502 * - `order()` returns 2^255-1, since the point multiplication algorithm
503 * accepts any 32-bit integer as input (it clears the top bit and low
504 * three bits systematically).
506 extern const br_ec_impl br_ec_c25519_m31
;
509 * \brief Aggregate EC implementation "m15".
511 * This implementation is a wrapper for:
513 * - `br_ec_c25519_m15` for Curve25519
514 * - `br_ec_p256_m15` for NIST P-256
515 * - `br_ec_prime_i15` for other curves (NIST P-384 and NIST-P512)
517 extern const br_ec_impl br_ec_all_m15
;
520 * \brief Aggregate EC implementation "m31".
522 * This implementation is a wrapper for:
524 * - `br_ec_c25519_m31` for Curve25519
525 * - `br_ec_p256_m31` for NIST P-256
526 * - `br_ec_prime_i31` for other curves (NIST P-384 and NIST-P512)
528 extern const br_ec_impl br_ec_all_m31
;
531 * \brief Get the "default" EC implementation for the current system.
533 * This returns a pointer to the preferred implementation on the
536 * \return the default EC implementation.
538 const br_ec_impl
*br_ec_get_default(void);
541 * \brief Convert a signature from "raw" to "asn1".
543 * Conversion is done "in place" and the new length is returned.
544 * Conversion may enlarge the signature, but by no more than 9 bytes at
545 * most. On error, 0 is returned (error conditions include an odd raw
546 * signature length, or an oversized integer).
548 * \param sig signature to convert.
549 * \param sig_len signature length (in bytes).
550 * \return the new signature length, or 0 on error.
552 size_t br_ecdsa_raw_to_asn1(void *sig
, size_t sig_len
);
555 * \brief Convert a signature from "asn1" to "raw".
557 * Conversion is done "in place" and the new length is returned.
558 * Conversion may enlarge the signature, but the new signature length
559 * will be less than twice the source length at most. On error, 0 is
560 * returned (error conditions include an invalid ASN.1 structure or an
561 * oversized integer).
563 * \param sig signature to convert.
564 * \param sig_len signature length (in bytes).
565 * \return the new signature length, or 0 on error.
567 size_t br_ecdsa_asn1_to_raw(void *sig
, size_t sig_len
);
570 * \brief Type for an ECDSA signer function.
572 * A pointer to the EC implementation is provided. The hash value is
573 * assumed to have the length inferred from the designated hash function
576 * Signature is written in the buffer pointed to by `sig`, and the length
577 * (in bytes) is returned. On error, nothing is written in the buffer,
578 * and 0 is returned. This function returns 0 if the specified curve is
579 * not supported by the provided EC implementation.
581 * The signature format is either "raw" or "asn1", depending on the
582 * implementation; maximum length is predictable from the implemented
585 * | curve | raw | asn1 |
586 * | :--------- | --: | ---: |
587 * | NIST P-256 | 64 | 72 |
588 * | NIST P-384 | 96 | 104 |
589 * | NIST P-521 | 132 | 139 |
591 * \param impl EC implementation to use.
592 * \param hf hash function used to process the data.
593 * \param hash_value signed data (hashed).
594 * \param sk EC private key.
595 * \param sig destination buffer.
596 * \return the signature length (in bytes), or 0 on error.
598 typedef size_t (*br_ecdsa_sign
)(const br_ec_impl
*impl
,
599 const br_hash_class
*hf
, const void *hash_value
,
600 const br_ec_private_key
*sk
, void *sig
);
603 * \brief Type for an ECDSA signature verification function.
605 * A pointer to the EC implementation is provided. The hashed value,
606 * computed over the purportedly signed data, is also provided with
609 * The signature format is either "raw" or "asn1", depending on the
612 * Returned value is 1 on success (valid signature), 0 on error. This
613 * function returns 0 if the specified curve is not supported by the
614 * provided EC implementation.
616 * \param impl EC implementation to use.
617 * \param hash signed data (hashed).
618 * \param hash_len hash value length (in bytes).
619 * \param pk EC public key.
620 * \param sig signature.
621 * \param sig_len signature length (in bytes).
622 * \return 1 on success, 0 on error.
624 typedef uint32_t (*br_ecdsa_vrfy
)(const br_ec_impl
*impl
,
625 const void *hash
, size_t hash_len
,
626 const br_ec_public_key
*pk
, const void *sig
, size_t sig_len
);
629 * \brief ECDSA signature generator, "i31" implementation, "asn1" format.
631 * \see br_ecdsa_sign()
633 * \param impl EC implementation to use.
634 * \param hf hash function used to process the data.
635 * \param hash_value signed data (hashed).
636 * \param sk EC private key.
637 * \param sig destination buffer.
638 * \return the signature length (in bytes), or 0 on error.
640 size_t br_ecdsa_i31_sign_asn1(const br_ec_impl
*impl
,
641 const br_hash_class
*hf
, const void *hash_value
,
642 const br_ec_private_key
*sk
, void *sig
);
645 * \brief ECDSA signature generator, "i31" implementation, "raw" format.
647 * \see br_ecdsa_sign()
649 * \param impl EC implementation to use.
650 * \param hf hash function used to process the data.
651 * \param hash_value signed data (hashed).
652 * \param sk EC private key.
653 * \param sig destination buffer.
654 * \return the signature length (in bytes), or 0 on error.
656 size_t br_ecdsa_i31_sign_raw(const br_ec_impl
*impl
,
657 const br_hash_class
*hf
, const void *hash_value
,
658 const br_ec_private_key
*sk
, void *sig
);
661 * \brief ECDSA signature verifier, "i31" implementation, "asn1" format.
663 * \see br_ecdsa_vrfy()
665 * \param impl EC implementation to use.
666 * \param hash signed data (hashed).
667 * \param hash_len hash value length (in bytes).
668 * \param pk EC public key.
669 * \param sig signature.
670 * \param sig_len signature length (in bytes).
671 * \return 1 on success, 0 on error.
673 uint32_t br_ecdsa_i31_vrfy_asn1(const br_ec_impl
*impl
,
674 const void *hash
, size_t hash_len
,
675 const br_ec_public_key
*pk
, const void *sig
, size_t sig_len
);
678 * \brief ECDSA signature verifier, "i31" implementation, "raw" format.
680 * \see br_ecdsa_vrfy()
682 * \param impl EC implementation to use.
683 * \param hash signed data (hashed).
684 * \param hash_len hash value length (in bytes).
685 * \param pk EC public key.
686 * \param sig signature.
687 * \param sig_len signature length (in bytes).
688 * \return 1 on success, 0 on error.
690 uint32_t br_ecdsa_i31_vrfy_raw(const br_ec_impl
*impl
,
691 const void *hash
, size_t hash_len
,
692 const br_ec_public_key
*pk
, const void *sig
, size_t sig_len
);
695 * \brief ECDSA signature generator, "i15" implementation, "asn1" format.
697 * \see br_ecdsa_sign()
699 * \param impl EC implementation to use.
700 * \param hf hash function used to process the data.
701 * \param hash_value signed data (hashed).
702 * \param sk EC private key.
703 * \param sig destination buffer.
704 * \return the signature length (in bytes), or 0 on error.
706 size_t br_ecdsa_i15_sign_asn1(const br_ec_impl
*impl
,
707 const br_hash_class
*hf
, const void *hash_value
,
708 const br_ec_private_key
*sk
, void *sig
);
711 * \brief ECDSA signature generator, "i15" implementation, "raw" format.
713 * \see br_ecdsa_sign()
715 * \param impl EC implementation to use.
716 * \param hf hash function used to process the data.
717 * \param hash_value signed data (hashed).
718 * \param sk EC private key.
719 * \param sig destination buffer.
720 * \return the signature length (in bytes), or 0 on error.
722 size_t br_ecdsa_i15_sign_raw(const br_ec_impl
*impl
,
723 const br_hash_class
*hf
, const void *hash_value
,
724 const br_ec_private_key
*sk
, void *sig
);
727 * \brief ECDSA signature verifier, "i15" implementation, "asn1" format.
729 * \see br_ecdsa_vrfy()
731 * \param impl EC implementation to use.
732 * \param hash signed data (hashed).
733 * \param hash_len hash value length (in bytes).
734 * \param pk EC public key.
735 * \param sig signature.
736 * \param sig_len signature length (in bytes).
737 * \return 1 on success, 0 on error.
739 uint32_t br_ecdsa_i15_vrfy_asn1(const br_ec_impl
*impl
,
740 const void *hash
, size_t hash_len
,
741 const br_ec_public_key
*pk
, const void *sig
, size_t sig_len
);
744 * \brief ECDSA signature verifier, "i15" implementation, "raw" format.
746 * \see br_ecdsa_vrfy()
748 * \param impl EC implementation to use.
749 * \param hash signed data (hashed).
750 * \param hash_len hash value length (in bytes).
751 * \param pk EC public key.
752 * \param sig signature.
753 * \param sig_len signature length (in bytes).
754 * \return 1 on success, 0 on error.
756 uint32_t br_ecdsa_i15_vrfy_raw(const br_ec_impl
*impl
,
757 const void *hash
, size_t hash_len
,
758 const br_ec_public_key
*pk
, const void *sig
, size_t sig_len
);
761 * \brief Get "default" ECDSA implementation (signer, asn1 format).
763 * This returns the preferred implementation of ECDSA signature generation
764 * ("asn1" output format) on the current system.
766 * \return the default implementation.
768 br_ecdsa_sign
br_ecdsa_sign_asn1_get_default(void);
771 * \brief Get "default" ECDSA implementation (signer, raw format).
773 * This returns the preferred implementation of ECDSA signature generation
774 * ("raw" output format) on the current system.
776 * \return the default implementation.
778 br_ecdsa_sign
br_ecdsa_sign_raw_get_default(void);
781 * \brief Get "default" ECDSA implementation (verifier, asn1 format).
783 * This returns the preferred implementation of ECDSA signature verification
784 * ("asn1" output format) on the current system.
786 * \return the default implementation.
788 br_ecdsa_vrfy
br_ecdsa_vrfy_asn1_get_default(void);
791 * \brief Get "default" ECDSA implementation (verifier, raw format).
793 * This returns the preferred implementation of ECDSA signature verification
794 * ("raw" output format) on the current system.
796 * \return the default implementation.
798 br_ecdsa_vrfy
br_ecdsa_vrfy_raw_get_default(void);