2021年07月30日 | mbedtls | 09 - 数字签名算法的配置与使用

一、数字签名算法

1. 什么是数字签名

数字签名类似于盖章和签字，数字签名可以检查消息是否被篡改、并验证消息的可靠性，因为私钥只有签名者持有，所以还可以防止否认。

2. 数字签名算法

① RSA数字签名

RSA数字签名算法基于RSA非对称加密算法，在用于数字签名时公钥和私钥的用法刚好相反：

• 发送方使用私钥对消息执行加密操作 = 对消息进行签名；

• 接收方使用公钥对签名进行解密 = 对签名进行认证；

RSA签名算法还需要包括填充方法，有两种：PKCS1-V1.5和PSS（使用随机数填充，推荐使用）。

② DSA算法

③ ECDSA算法

在相同的安全等级下，ECDSA算法具有秘钥短、执行效率高的特点，更适合物联网应用。

二、RSA数字签名功能模块的配置与使用

1. 配置宏

使用RSA功能需要提前开启伪随机数生成器（依赖AES算法、SHA256算法、MD通用接口），其中伪随机数生成器的硬件适配移植实现已经讲述，请参考对应的第二篇博客，不再赘述。

综合上述，本实验中需要开启的宏如下表：

新建配置文件mbedtls_config_rsa_sign.h，编写以下内容：

/**

 * @brief   Minimal configuration for RSA Sign Function

 * @author  mculover666

 * @date    2020/10/03

*/

#ifndef _MBEDTLS_CONFIG_RSA_SIGN_H_

#define _MBEDTLS_CONFIG_RSA_SIGN_H_

/* System support */

#define MBEDTLS_HAVE_ASM

//#define MBEDTLS_HAVE_TIME

/* mbed feature support */

#define MBEDTLS_ENTROPY_HARDWARE_ALT

//#define MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES

#define MBEDTLS_NO_PLATFORM_ENTROPY

/* mbed modules */

#define MBEDTLS_AES_C

#define MBEDTLS_AES_ROM_TABLES

#define MBEDTLS_CTR_DRBG_C

#define MBEDTLS_ENTROPY_C

#define MBEDTLS_SHA256_C

#define MBEDTLS_MD_C

#define MBEDTLS_BIGNUM_C

#define MBEDTLS_GENPRIME

#define MBEDTLS_OID_C

#define MBEDTLS_RSA_C

#define MBEDTLS_PKCS1_V21

#include "mbedtls/check_config.h"

#endif /* _MBEDTLS_CONFIG_RSA_SIGN_H_ */

在MDK中设置使用该配置文件：

2. RSA数字签名功能模块API说明

使用该功能模块需要包含头文件：

#include "mbedtls/rsa.h"

① RSA签名接口

/**

 * brief          This function performs a private RSA operation to sign

 *                 a message digest using PKCS#1.

 *

 *                 It is the generic wrapper for performing a PKCS#1

 *                 signature using the p mode from the context.

 *

 * note           The p sig buffer must be as large as the size

 *                 of p ctx->N. For example, 128 Bytes if RSA-1024 is used.

 *

 * note           For PKCS#1 v2.1 encoding, see comments on

 *                 mbedtls_rsa_rsassa_pss_sign() for details on

 *                 p md_alg and p hash_id.

 *

 * deprecated     It is deprecated and discouraged to call this function

 *                 in #MBEDTLS_RSA_PUBLIC mode. Future versions of the library

 *                 are likely to remove the p mode argument and have it

 *                 implicitly set to #MBEDTLS_RSA_PRIVATE.

 *

 * note           Alternative implementations of RSA need not support

 *                 mode being set to #MBEDTLS_RSA_PUBLIC and might instead

 *                 return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED.

 *

 * param ctx      The initialized RSA context to use.

 * param f_rng    The RNG function to use. If the padding mode is PKCS#1 v2.1,

 *                 this must be provided. If the padding mode is PKCS#1 v1.5 and

 *                 p mode is #MBEDTLS_RSA_PRIVATE, it is used for blinding

 *                 and should be provided; see mbedtls_rsa_private() for more

 *                 more. It is ignored otherwise.

 * param p_rng    The RNG context to be passed to p f_rng. This may be c NULL

 *                 if p f_rng is c NULL or doesn't need a context argument.

 * param mode     The mode of operation. This must be either

 *                 #MBEDTLS_RSA_PRIVATE or #MBEDTLS_RSA_PUBLIC (deprecated).

 * param md_alg   The message-digest algorithm used to hash the original data.

 *                 Use #MBEDTLS_MD_NONE for signing raw data.

 * param hashlen  The length of the message digest.

 *                 Ths is only used if p md_alg is #MBEDTLS_MD_NONE.

 * param hash     The buffer holding the message digest or raw data.

 *                 If p md_alg is #MBEDTLS_MD_NONE, this must be a readable

 *                 buffer of length p hashlen Bytes. If p md_alg is not

 *                 #MBEDTLS_MD_NONE, it must be a readable buffer of length

 *                 the size of the hash corresponding to p md_alg.

 * param sig      The buffer to hold the signature. This must be a writable

 *                 buffer of length c ctx->len Bytes. For example, c 256 Bytes

 *                 for an 2048-bit RSA modulus. A buffer length of

 *                 #MBEDTLS_MPI_MAX_SIZE is always safe.

 *

 * return         c 0 if the signing operation was successful.

 * return         An c MBEDTLS_ERR_RSA_XXX error code on failure.

 */

int mbedtls_rsa_pkcs1_sign( mbedtls_rsa_context *ctx,

                    int (*f_rng)(void *, unsigned char *, size_t),

                    void *p_rng,

                    int mode,

                    mbedtls_md_type_t md_alg,

                    unsigned int hashlen,

                    const unsigned char *hash,

                    unsigned char *sig );

② RSA验证签名接口

/**

 * brief          This function performs a public RSA operation and checks

 *                 the message digest.

 *

 *                 This is the generic wrapper for performing a PKCS#1

 *                 verification using the mode from the context.

 *

 * note           For PKCS#1 v2.1 encoding, see comments on

 *                 mbedtls_rsa_rsassa_pss_verify() about p md_alg and

 *                 p hash_id.

 *

 * deprecated     It is deprecated and discouraged to call this function

 *                 in #MBEDTLS_RSA_PRIVATE mode. Future versions of the library

 *                 are likely to remove the p mode argument and have it

 *                 set to #MBEDTLS_RSA_PUBLIC.

 *

 * note           Alternative implementations of RSA need not support

 *                 mode being set to #MBEDTLS_RSA_PRIVATE and might instead

 *                 return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED.

 *

 * param ctx      The initialized RSA public key context to use.

 * param f_rng    The RNG function to use. If p mode is #MBEDTLS_RSA_PRIVATE,

 *                 this is used for blinding and should be provided; see

 *                 mbedtls_rsa_private() for more. Otherwise, it is ignored.

 * param p_rng    The RNG context to be passed to p f_rng. This may be

 *                 c NULL if p f_rng is c NULL or doesn't need a context.

 * param mode     The mode of operation. This must be either

 *                 #MBEDTLS_RSA_PUBLIC or #MBEDTLS_RSA_PRIVATE (deprecated).

 * param md_alg   The message-digest algorithm used to hash the original data.

 *                 Use #MBEDTLS_MD_NONE for signing raw data.

 * param hashlen  The length of the message digest.

 *                 This is only used if p md_alg is #MBEDTLS_MD_NONE.

 * param hash     The buffer holding the message digest or raw data.

 *                 If p md_alg is #MBEDTLS_MD_NONE, this must be a readable

 *                 buffer of length p hashlen Bytes. If p md_alg is not