Thanks Steve, I have been having a discussion with some friends of mine on this. They were thinking that the problem from the recent random number issue is a real problem in older 32 bit systems. I was thinking it is not as bad as they are thinking. Since I was looking into this with the old bitcoin code I thought I would take a look. The myriad of code in the EC area is a problem to back trace. So I picked up the old 0.9.8h and bitcoin 1.0. This would be a good way to diagram how it works. I see a BN _new and then a bunch of work after that. One suggestion is they used a get milli command to fill the 64 bits. I thought that was silly. So I thought I would ask. Attached is the key h file. I was nto sure if it can be diagrammed as there are some base changes as best I can tell.
Dave. On 7/30/2014 3:44 PM, Dr. Stephen Henson wrote: > On Wed, Jul 30, 2014, Jason Schultz wrote: > >> OK. So as far as you're aware, there's not a way to avoid the requirement of >> the combined root cert/CRL file when checking for revoked certificates? I >> would prefer to just have to deal with the CRL in PEM format, but the CRL >> file must always be the CRL appended to the root cert, as far as I can tell. >> Thanks for your prompt responses, by the way. >> > The CRL can come from anywhere as long as it is supplied to OpenSSL in the > appropriate way. > > There are some standard places a CRL can be included such as a file or > directory containing the set of trusted certificates but it is not a > requirement. > > I can't really comment more without seeing a sample of how your code is > loading the CRL and how it is enabling CRL checks. > > Steve. > -- > Dr Stephen N. Henson. OpenSSL project core developer. > Commercial tech support now available see: http://www.openssl.org > ______________________________________________________________________ > OpenSSL Project http://www.openssl.org > User Support Mailing List openssl-users@openssl.org > Automated List Manager majord...@openssl.org -- Dave Paxton dpax...@me.com 208 570 9755 skype: dpaxton
// Copyright (c) 2009 Satoshi Nakamoto // Distributed under the MIT/X11 software license, see the accompanying // file license.txt or http://www.opensource.org/licenses/mit-license.php. // secp160k1 // const unsigned int PRIVATE_KEY_SIZE = 192; // const unsigned int PUBLIC_KEY_SIZE = 41; // const unsigned int SIGNATURE_SIZE = 48; // // secp192k1 // const unsigned int PRIVATE_KEY_SIZE = 222; // const unsigned int PUBLIC_KEY_SIZE = 49; // const unsigned int SIGNATURE_SIZE = 57; // // secp224k1 // const unsigned int PRIVATE_KEY_SIZE = 250; // const unsigned int PUBLIC_KEY_SIZE = 57; // const unsigned int SIGNATURE_SIZE = 66; // // secp256k1: // const unsigned int PRIVATE_KEY_SIZE = 279; // const unsigned int PUBLIC_KEY_SIZE = 65; // const unsigned int SIGNATURE_SIZE = 72; // // see www.keylength.com // script supports up to 75 for single byte push class key_error : public std::runtime_error { public: explicit key_error(const std::string& str) : std::runtime_error(str) {} }; // secure_allocator is defined is serialize.h typedef vector<unsigned char, secure_allocator<unsigned char> > CPrivKey; class CKey { protected: EC_KEY* pkey; public: CKey() { pkey = EC_KEY_new_by_curve_name(NID_secp256k1); if (pkey == NULL) throw key_error("CKey::CKey() : EC_KEY_new_by_curve_name failed"); } CKey(const CKey& b) { pkey = EC_KEY_dup(b.pkey); if (pkey == NULL) throw key_error("CKey::CKey(const CKey&) : EC_KEY_dup failed"); } CKey& operator=(const CKey& b) { if (!EC_KEY_copy(pkey, b.pkey)) throw key_error("CKey::operator=(const CKey&) : EC_KEY_copy failed"); return (*this); } ~CKey() { EC_KEY_free(pkey); } void MakeNewKey() { if (!EC_KEY_generate_key(pkey)) throw key_error("CKey::MakeNewKey() : EC_KEY_generate_key failed"); } bool SetPrivKey(const CPrivKey& vchPrivKey) { const unsigned char* pbegin = &vchPrivKey[0]; if (!d2i_ECPrivateKey(&pkey, &pbegin, vchPrivKey.size())) return false; return true; } CPrivKey GetPrivKey() const { unsigned int nSize = i2d_ECPrivateKey(pkey, NULL); if (!nSize) throw key_error("CKey::GetPrivKey() : i2d_ECPrivateKey failed"); CPrivKey vchPrivKey(nSize, 0); unsigned char* pbegin = &vchPrivKey[0]; if (i2d_ECPrivateKey(pkey, &pbegin) != nSize) throw key_error("CKey::GetPrivKey() : i2d_ECPrivateKey returned unexpected size"); return vchPrivKey; } bool SetPubKey(const vector<unsigned char>& vchPubKey) { const unsigned char* pbegin = &vchPubKey[0]; if (!o2i_ECPublicKey(&pkey, &pbegin, vchPubKey.size())) return false; return true; } vector<unsigned char> GetPubKey() const { unsigned int nSize = i2o_ECPublicKey(pkey, NULL); if (!nSize) throw key_error("CKey::GetPubKey() : i2o_ECPublicKey failed"); vector<unsigned char> vchPubKey(nSize, 0); unsigned char* pbegin = &vchPubKey[0]; if (i2o_ECPublicKey(pkey, &pbegin) != nSize) throw key_error("CKey::GetPubKey() : i2o_ECPublicKey returned unexpected size"); return vchPubKey; } bool Sign(uint256 hash, vector<unsigned char>& vchSig) { vchSig.clear(); unsigned char pchSig[10000]; unsigned int nSize = 0; if (!ECDSA_sign(0, (unsigned char*)&hash, sizeof(hash), pchSig, &nSize, pkey)) return false; vchSig.resize(nSize); memcpy(&vchSig[0], pchSig, nSize); return true; } bool Verify(uint256 hash, const vector<unsigned char>& vchSig) { // -1 = error, 0 = bad sig, 1 = good if (ECDSA_verify(0, (unsigned char*)&hash, sizeof(hash), &vchSig[0], vchSig.size(), pkey) != 1) return false; return true; } static bool Sign(const CPrivKey& vchPrivKey, uint256 hash, vector<unsigned char>& vchSig) { CKey key; if (!key.SetPrivKey(vchPrivKey)) return false; return key.Sign(hash, vchSig); } static bool Verify(const vector<unsigned char>& vchPubKey, uint256 hash, const vector<unsigned char>& vchSig) { CKey key; if (!key.SetPubKey(vchPubKey)) return false; return key.Verify(hash, vchSig); } };
