ta/wallet_ta.c
/** Create a deterministic ECDSA signature of a given message (digest) and
  * private key.
  * This is an implementation of the algorithm described in the document
  * "SEC 1: Elliptic Curve Cryptography" by Certicom research, obtained
  * 15-August-2011 from: http://www.secg.org/collateral/sec1_final.pdf
  * section 4.1.3 ("Signing Operation"). The ephemeral private key "k" will
  * be deterministically generated according to RFC 6979.
  * \param session_data A data pointer to a session context.
  * \param private_key The private key to use in the signing operation,
  *                    represented as a 32 byte multi-precision number.
  * \param params A pointer to an array of four parameters. See ecdsa_sign().
  */
Create a deterministic ECDSA signature of a given message (digest) and
private key.
Create a deterministic ECDSA signature of a given message ( digest ) and private key .
static void ecdsa_sign_internal(Session_data * session_data, uint8_t * private_key, TEE_Param params[4])
{
	HMACDRBGState state;
	PointAffine big_r;
	uint8_t seed_material[32 + SHA256_HASH_LENGTH];
	uint8_t k[32];
	big_assign_internal(seed_material, private_key);
	swap_endian256_internal(seed_material); 
	big_assign_internal(&(seed_material[32]),
						(BigNum256)(params[2].memref.buffer));
	swap_endian256_internal(&(seed_material[32]));  
	drbg_instantiate_internal(session_data, &state,
							seed_material,
							sizeof(seed_material));
	while (true)
	{
		drbg_generate_internal(session_data, k, &state, 32, NULL, 0);
		swap_endian256_internal(k); 
		if (big_is_zero_internal(k))
			continue;
		if (big_compare_internal(k, (BigNum256)secp256k1_n) != BIGCMP_LESS)
			continue;
		set_to_g_internal(&big_r);
		point_multiply_internal(session_data, &big_r, k);
		set_field_to_n_internal(session_data);
		big_modulo_internal(session_data,
							(BigNum256)(params[0].memref.buffer),
							big_r.x);
		if (big_is_zero_internal((BigNum256)(params[0].memref.buffer)))
			continue;
		big_multiply_internal(session_data,
							(BigNum256)(params[1].memref.buffer),
							(BigNum256)(params[0].memref.buffer),
							private_key);
		big_modulo_internal(session_data,
							big_r.y,
							(BigNum256)(params[2].memref.buffer)); 
		big_add_internal(session_data,
						(BigNum256)(params[1].memref.buffer),
						(BigNum256)(params[1].memref.buffer),
						big_r.y);
		big_invert_internal(session_data, big_r.y, k);
		big_multiply_internal(session_data,
							(BigNum256)(params[1].memref.buffer),
							(BigNum256)(params[1].memref.buffer),
							big_r.y);
		if (big_is_zero_internal((BigNum256)(params[1].memref.buffer)))
			continue;
		big_shift_right_no_modulo_internal(k, (const BigNum256)secp256k1_n); 
		if (big_compare_internal((BigNum256)(params[1].memref.buffer), k) == BIGCMP_GREATER)
			big_subtract_no_modulo_internal((BigNum256)(params[1].memref.buffer),
											(BigNum256)secp256k1_n,
											(BigNum256)(params[1].memref.buffer));
		break;
  	}
}
static void ecdsa_sign_internal ( Session_data * session_data , uint8_t * private_key , TEE_Param params [ 4 ] ) { HMACDRBGState state ; PointAffine big_r ; uint8_t seed_material [ 32 + SHA256_HASH_LENGTH ] ; uint8_t k [ 32 ] ; big_assign_internal ( seed_material , private_key ) ; swap_endian256_internal ( seed_material ) ; big_assign_internal ( & ( seed_material [ 32 ] ) , ( BigNum256 ) ( params [ 2 ] . memref . buffer ) ) ; swap_endian256_internal ( & ( seed_material [ 32 ] ) ) ; drbg_instantiate_internal ( session_data , & state , seed_material , sizeof ( seed_material ) ) ; while ( true ) { drbg_generate_internal ( session_data , k , & state , 32 , NULL , 0 ) ; swap_endian256_internal ( k ) ; if ( big_is_zero_internal ( k ) ) continue ; if ( big_compare_internal ( k , ( BigNum256 ) secp256k1_n ) != BIGCMP_LESS ) continue ; set_to_g_internal ( & big_r ) ; point_multiply_internal ( session_data , & big_r , k ) ; set_field_to_n_internal ( session_data ) ; big_modulo_internal ( session_data , ( BigNum256 ) ( params [ 0 ] . memref . buffer ) , big_r . x ) ; if ( big_is_zero_internal ( ( BigNum256 ) ( params [ 0 ] . memref . buffer ) ) ) continue ; big_multiply_internal ( session_data , ( BigNum256 ) ( params [ 1 ] . memref . buffer ) , ( BigNum256 ) ( params [ 0 ] . memref . buffer ) , private_key ) ; big_modulo_internal ( session_data , big_r . y , ( BigNum256 ) ( params [ 2 ] . memref . buffer ) ) ; big_add_internal ( session_data , ( BigNum256 ) ( params [ 1 ] . memref . buffer ) , ( BigNum256 ) ( params [ 1 ] . memref . buffer ) , big_r . y ) ; big_invert_internal ( session_data , big_r . y , k ) ; big_multiply_internal ( session_data , ( BigNum256 ) ( params [ 1 ] . memref . buffer ) , ( BigNum256 ) ( params [ 1 ] . memref . buffer ) , big_r . y ) ; if ( big_is_zero_internal ( ( BigNum256 ) ( params [ 1 ] . memref . buffer ) ) ) continue ; big_shift_right_no_modulo_internal ( k , ( const BigNum256 ) secp256k1_n ) ; if ( big_compare_internal ( ( BigNum256 ) ( params [ 1 ] . memref . buffer ) , k ) == BIGCMP_GREATER ) big_subtract_no_modulo_internal ( ( BigNum256 ) ( params [ 1 ] . memref . buffer ) , ( BigNum256 ) secp256k1_n , ( BigNum256 ) ( params [ 1 ] . memref . buffer ) ) ; break ; } }
Create a deterministic ECDSA signature of a given message (digest) and
 private key.
Create a deterministic ECDSA signature of a given message ( digest ) and private key .
/*
	 * From RFC 6979, section 3.3a:
	 * seed_material = int2octets(private_key) || bits2octets(hash)
	 * int2octets and bits2octets both interpret the number as big-endian.
	 * However, both the private_key and hash parameters are BigNum256, which
	 * is little-endian.
	 */ /* little-endian -> big-endian */ /* little-endian -> big-endian */ /*
		 * From RFC 6979, section 3.3b, the output of the DRBG is run through
		 * the bits2int function, which interprets the output as a big-endian
		 * integer. However, functions in bignum256.c expect a little-endian
		 * integer.
		 */ /* big-endian -> little-endian */ /*
		 * This is one of many data-dependent branches in this function. They do
		 * not compromise timing attack resistance because these branches are
		 * expected to occur extremely infrequently.
		 */ /* Compute ephemeral elliptic curve key pair (k, big_r). */ /* big_r now contains k * G. */ /* r now contains (k * G).x (mod n). */ /* use big_r.y as temporary */ /* s now contains (hash + (r * private_key)) / k (mod n). */ /*
		 * Canonicalise s by negating it if s > secp256k1_n / 2.
		 * See https://github.com/bitcoin/bitcoin/pull/3016 for more info.
		 */ /* use k as temporary */