daa.c

// SPDX-License-Identifier: MIT
/*
MIT License

Copyright (c) 2025 UBITECH Ltd (https://ubitech.eu)

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
*/

#include "daa.h"

#include "defines.h"
#include "issuer.h"
#include "tpm_funcs.h"

#include <ecp2_FP256BN.h>
#include <ecp_FP256BN.h>
#include <fp12_FP256BN.h>
#include <ibmtss/TPM_Types.h>
#include <ibmtss/tssutils.h>
#include <mbedtls/constant_time.h>
#include <mbedtls/ecp.h>
#include <mbedtls/sha256.h>
#include <pair_FP256BN.h>
#include <stdint.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

/**
 * Allocate and initialize a new DAA_CONTEXT with BNP256 parameters.
 *
 * Returns:
 * - Pointer to a freshly allocated context; NULL on allocation failure.
 */
DAA_CONTEXT* new_daa_context() {
    DAA_CONTEXT* ctx         = malloc(sizeof(DAA_CONTEXT));
    uint8_t BNP256_ORDER[32] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFC, 0xF0, 0xCD, 0x46, 0xE5, 0xF2,
                                0x5E, 0xEE, 0x71, 0xA4, 0x9E, 0x0C, 0xDC, 0x65, 0xFB, 0x12, 0x99,
                                0x92, 0x1A, 0xF6, 0x2D, 0x53, 0x6C, 0xD1, 0x0B, 0x50, 0x0D};

    unsigned char bnp256_p[32] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFC, 0xF0, 0xCD, 0x46, 0xE5, 0xF2,
                                  0x5E, 0xEE, 0x71, 0xA4, 0x9F, 0x0C, 0xDC, 0x65, 0xFB, 0x12, 0x98,
                                  0x0A, 0x82, 0xD3, 0x29, 0x2D, 0xDB, 0xAE, 0xD3, 0x30, 0x13};

    memcpy(ctx->BNP256_ORDER, BNP256_ORDER, 32);
    memcpy(ctx->bnp256_p, bnp256_p, 32);
    ctx->signature_len = 32;
    ctx->bnp256_a[0]   = 0x00;
    ctx->bnp256_b[0]   = 0x03;
    ctx->bnp256_gX[0]  = 0x01;
    ctx->bnp256_gY[0]  = 0x02;

    return ctx;
}

/**
 * Free a DAA_CONTEXT previously allocated with new_daa_context().
 * Safe to call with NULL.
 *
 * Parameters:
 * - ctx: Context to free; may be NULL.
 */
void free_daa_context(DAA_CONTEXT* ctx) {
    if (ctx != NULL) {
        free(ctx);
    }
}

/**
 * Convert a TPM command code to a 4-byte big-endian array.
 *
 * Parameters:
 * - cc: Command code value.
 * - out: 4-byte output buffer.
 */
void cc_to_byteArray(uint16_t cc, uint8_t* out);

void cc_to_byteArray(uint16_t cc, uint8_t* out) {
    out[0] = (cc >> 24) & 0xFF;
    out[1] = (cc >> 16) & 0xFF;
    out[2] = (cc >> 8) & 0xFF;
    out[3] = (cc >> 0) & 0xFF;
}

/**
 * Compute the TPM policy digest for allowing TPM2_Commit.
 *
 * Parameters:
 * - policy: Output TPM2B_DIGEST to receive the policy digest (SHA-256, 32B).
 *
 * Returns:
 * - 0 on success; -1 on failure.
 */
int commit_policy(TPM2B_DIGEST* policy) {
    uint8_t policy_bytes[32 + 2 * CC_LEN] = {0x00};
    cc_to_byteArray(TPM_CC_PolicyCommandCode, &policy_bytes[32]);
    cc_to_byteArray(TPM_CC_Commit, &policy_bytes[32 + CC_LEN]);
    mbedtls_sha256_context* sha256_ctx;
    sha256_ctx = malloc(sizeof(mbedtls_sha256_context));
    mbedtls_sha256_init(sha256_ctx);
    mbedtls_sha256_starts(sha256_ctx, 0);
    mbedtls_sha256_update(sha256_ctx, policy_bytes, 32 + 2 * CC_LEN);
    mbedtls_sha256_finish(sha256_ctx, policy->b.buffer);
    policy->b.size = 32;
    mbedtls_sha256_free(sha256_ctx);
    free(sha256_ctx);
    return 0;
}

/**
 * Compute the TPM policy digest for allowing TPM2_Sign.
 *
 * Parameters:
 * - policy: Output TPM2B_DIGEST to receive the policy digest (SHA-256, 32B).
 *
 * Returns:
 * - 0 on success; -1 on failure.
 */
int sign_policy(TPM2B_DIGEST* policy) {
    uint8_t policy_bytes[32 + 2 * CC_LEN] = {0x00};
    cc_to_byteArray(TPM_CC_PolicyCommandCode, &policy_bytes[32]);
    cc_to_byteArray(TPM_CC_Sign, &policy_bytes[32 + CC_LEN]);
    mbedtls_sha256_context* sha256_ctx;
    sha256_ctx = malloc(sizeof(mbedtls_sha256_context));
    mbedtls_sha256_init(sha256_ctx);
    mbedtls_sha256_starts(sha256_ctx, 0);
    mbedtls_sha256_update(sha256_ctx, policy_bytes, 32 + 2 * CC_LEN);
    mbedtls_sha256_finish(sha256_ctx, policy->b.buffer);
    policy->b.size = 32;
    mbedtls_sha256_free(sha256_ctx);
    free(sha256_ctx);
    return 0;
}

/**
 * Build a composite policy that authorizes either TPM2_Commit or TPM2_Sign
 * for the DAA key (PolicyCommandCode OR construction).
 *
 * Parameters:
 * - policy: Output policy digest.
 *
 * Returns:
 * - 0 on success; -1 on failure.
 */
int create_daa_key_policy(TPM2B_DIGEST* policy) {
    uint8_t      policy_bytes[32 + 2 * CC_LEN] = {0x00};
    TPM2B_DIGEST or_digest[2];
    cc_to_byteArray(TPM_CC_PolicyCommandCode, &policy_bytes[32]);
    cc_to_byteArray(TPM_CC_Commit, &policy_bytes[32 + CC_LEN]);
    mbedtls_sha256_context* sha256_ctx;
    sha256_ctx = malloc(sizeof(mbedtls_sha256_context));
    mbedtls_sha256_init(sha256_ctx);
    mbedtls_sha256_starts(sha256_ctx, 0);
    mbedtls_sha256_update(sha256_ctx, policy_bytes, 32 + 2 * CC_LEN);
    mbedtls_sha256_finish(sha256_ctx, or_digest[0].b.buffer);
    or_digest[0].b.size = 32;
    mbedtls_sha256_free(sha256_ctx);
    cc_to_byteArray(TPM_CC_PolicyCommandCode, &policy_bytes[32]);
    cc_to_byteArray(TPM_CC_Sign, &policy_bytes[32 + CC_LEN]);
    mbedtls_sha256_init(sha256_ctx);
    mbedtls_sha256_starts(sha256_ctx, 0);
    mbedtls_sha256_update(sha256_ctx, policy_bytes, 32 + 2 * CC_LEN);
    mbedtls_sha256_finish(sha256_ctx, or_digest[1].b.buffer);
    or_digest[1].b.size = 32;
    mbedtls_sha256_free(sha256_ctx);
    mbedtls_sha256_init(sha256_ctx);
    mbedtls_sha256_starts(sha256_ctx, 0);
    mbedtls_sha256_update(sha256_ctx, policy_bytes, 32);
    cc_to_byteArray(TPM_CC_PolicyOR, &policy_bytes[32]);
    mbedtls_sha256_update(sha256_ctx, &policy_bytes[32], CC_LEN);
    mbedtls_sha256_update(sha256_ctx, or_digest[0].b.buffer, 32);
    mbedtls_sha256_update(sha256_ctx, or_digest[1].b.buffer, 32);
    mbedtls_sha256_finish(sha256_ctx, policy->b.buffer);
    policy->b.size = 32;
    mbedtls_sha256_free(sha256_ctx);
    free(sha256_ctx);

    return 0;
}

/**
 * Verify a DAA credential (A,B,C,D) against issuer public key and user pubkey.
 *
 * Parameters:
 * - ctx: DAA context with curve and parameters.
 * - daa_issuer_key: Issuer public parameters.
 * - daa_credential: Credential to verify.
 * - daa_public_key: User's public key (x,y).
 *
 * Returns:
 * - 0 if valid; -1 otherwise.
 */
int verify_daa_credential(DAA_CONTEXT* ctx, issuer_key daa_issuer_key,
                          DAA_CREDENTIAL daa_credential, EC_POINT daa_public_key) {
    int           ret = 0;
    ECP2_FP256BN* Y   = NULL;
    ECP2_FP256BN* X   = NULL;
    ECP2_FP256BN* H   = NULL;
    ECP_FP256BN*  A   = NULL;
    ECP_FP256BN*  B   = NULL;
    ECP_FP256BN*  C   = NULL;
    ECP_FP256BN*  AD  = NULL;
    octet         Y_octet;
    octet         X_octet;
    octet         H_octet;
    octet         A_octet;
    octet         B_octet;
    octet         C_octet;
    octet         AD_octet;
    FP12_FP256BN* lhs = NULL;
    FP12_FP256BN* rhs = NULL;

    Y_octet.val  = (char*)daa_issuer_key.public_key2;
    Y_octet.len  = sizeof(daa_issuer_key.public_key2);
    X_octet.val  = (char*)daa_issuer_key.public_key1;
    X_octet.len  = sizeof(daa_issuer_key.public_key1);
    H_octet.val  = (char*)daa_issuer_key.generator;
    H_octet.len  = sizeof(daa_issuer_key.generator);
    A_octet.val  = (char*)daa_credential.A;
    A_octet.len  = sizeof(daa_credential.A);
    B_octet.val  = (char*)daa_credential.B;
    B_octet.len  = sizeof(daa_credential.B);
    C_octet.val  = (char*)daa_credential.C;
    C_octet.len  = sizeof(daa_credential.C);
    AD_octet.val = (char*)daa_credential.D;
    AD_octet.len = sizeof(daa_credential.D);

    Y = (ECP2_FP256BN*)calloc(1, sizeof(ECP2_FP256BN));
    H = (ECP2_FP256BN*)calloc(1, sizeof(ECP2_FP256BN));
    B = (ECP_FP256BN*)calloc(1, sizeof(ECP_FP256BN));
    A = (ECP_FP256BN*)calloc(1, sizeof(ECP_FP256BN));
    if (!ECP2_FP256BN_fromOctet(Y, &Y_octet)) {
        ret = -1;
        goto cleanup;
    }
    if (!ECP2_FP256BN_fromOctet(H, &H_octet)) {
        ret = -1;
        goto cleanup;
    }
    if (!ECP_FP256BN_fromOctet(B, &B_octet)) {
        ret = -1;
        goto cleanup;
    }
    if (!ECP_FP256BN_fromOctet(A, &A_octet)) {
        ret = -1;
        goto cleanup;
    }
    lhs = (FP12_FP256BN*)calloc(1, sizeof(FP12_FP256BN));
    rhs = (FP12_FP256BN*)calloc(1, sizeof(FP12_FP256BN));

    PAIR_FP256BN_ate(lhs, Y, A);
    PAIR_FP256BN_fexp(lhs);

    PAIR_FP256BN_ate(rhs, H, B);
    PAIR_FP256BN_fexp(rhs);

    if (FP12_FP256BN_equals(lhs, rhs) == 0) {
        ret = -1;
        goto cleanup;
    }

    X  = (ECP2_FP256BN*)calloc(1, sizeof(ECP2_FP256BN));
    C  = (ECP_FP256BN*)calloc(1, sizeof(ECP_FP256BN));
    AD = (ECP_FP256BN*)calloc(1, sizeof(ECP_FP256BN));
    if (!ECP2_FP256BN_fromOctet(X, &X_octet)) {
        ret = -1;
        goto cleanup;
    }
    if (!ECP_FP256BN_fromOctet(C, &C_octet)) {
        ret = -1;
        goto cleanup;
    }
    if (!ECP_FP256BN_fromOctet(AD, &AD_octet)) {
        ret = -1;
        goto cleanup;
    }
    ECP_FP256BN_add(AD, A);
    PAIR_FP256BN_ate(lhs, H, C);
    PAIR_FP256BN_fexp(lhs);

    PAIR_FP256BN_ate(rhs, X, AD);
    PAIR_FP256BN_fexp(rhs);

    if (FP12_FP256BN_equals(lhs, rhs) == 0) {
        ret = -1;
        goto cleanup;
    }
    if ((ret = verify_schnorr_proof(ctx, daa_credential, daa_public_key)) != 0) {
        ret = -1;
        goto cleanup;
    }

cleanup:
    free(Y);
    free(H);
    free(B);
    free(A);
    free(lhs);
    free(rhs);
    free(X);
    free(C);
    free(AD);
    return ret;
}

/**
 * Verify the Schnorr proof bound to a DAA credential.
 *
 * Parameters:
 * - ctx: DAA context.
 * - daa_credential: Credential carrying (sigma, c, B, D) used in the proof.
 * - daa_public_key: User public key used in challenge computation.
 *
 * Returns:
 * - 0 on success; -1 on failure.
 */
int verify_schnorr_proof(DAA_CONTEXT* ctx, DAA_CREDENTIAL daa_credential, EC_POINT daa_public_key) {
    int                     ret       = 0;
    mbedtls_mpi*            sigma_mpi = NULL;
    mbedtls_mpi*            c_mpi     = NULL;
    mbedtls_ecp_point*      B         = NULL;
    mbedtls_ecp_point*      D         = NULL;
    mbedtls_ecp_point*      tmp_ecp   = NULL;
    uint8_t                 temp_bytes[65];
    uint8_t                 cv[32];
    size_t                  outlen     = 0;
    mbedtls_sha256_context* sha256_ctx = NULL;

    mbedtls_ecp_group* grp = NULL;
    sigma_mpi              = (mbedtls_mpi*)calloc(1, sizeof(mbedtls_mpi));
    c_mpi                  = (mbedtls_mpi*)calloc(1, sizeof(mbedtls_mpi));
    mbedtls_mpi_init(sigma_mpi);
    mbedtls_mpi_init(c_mpi);
    if ((ret = mbedtls_mpi_read_binary(sigma_mpi, daa_credential.sigma,
                                       sizeof(daa_credential.sigma))) != 0) {
        ret = -1;
        goto cleanup;
    }
    if ((ret = mbedtls_mpi_read_binary(c_mpi, daa_credential.c, sizeof(daa_credential.c))) != 0) {
        ret = -1;
        goto cleanup;
    }
    if ((ret = get_ec_group_bnp256(ctx, &grp)) != 0) {
        ret = -1;
        goto cleanup;
    }
    B = (mbedtls_ecp_point*)calloc(1, sizeof(mbedtls_ecp_point));
    D = (mbedtls_ecp_point*)calloc(1, sizeof(mbedtls_ecp_point));
    mbedtls_ecp_point_init(B);
    mbedtls_ecp_point_init(D);
    if ((ret = mbedtls_ecp_point_read_binary(grp, B, daa_credential.B, sizeof(daa_credential.B))) !=
        0) {
        ret = -1;
        goto cleanup;
    }
    if ((ret = mbedtls_ecp_point_read_binary(grp, D, daa_credential.D, sizeof(daa_credential.D))) !=
        0) {
        ret = -1;
        goto cleanup;
    }
    tmp_ecp = (mbedtls_ecp_point*)calloc(1, sizeof(mbedtls_ecp_point));
    mbedtls_ecp_point_init(tmp_ecp);

    if ((ret = mbedtls_ecp_muladd(grp, tmp_ecp, sigma_mpi, &grp->G, c_mpi, B)) != 0) {
        ret = -1;
        goto cleanup;
    }
    if ((ret = mbedtls_ecp_point_write_binary(grp, tmp_ecp, MBEDTLS_ECP_PF_UNCOMPRESSED, &outlen,
                                              temp_bytes, sizeof(temp_bytes))) != 0) {
        ret = -1;
        goto cleanup;
    }
    sha256_ctx = (mbedtls_sha256_context*)calloc(1, sizeof(mbedtls_sha256_context));
    mbedtls_sha256_init(sha256_ctx);
    if ((ret = mbedtls_sha256_starts(sha256_ctx, 0)) != 0) {
        ret = -1;
        goto cleanup;
    }
    if ((ret = mbedtls_sha256_update(sha256_ctx, temp_bytes, sizeof(temp_bytes))) != 0) {
        ret = -1;
        goto cleanup;
    }

    memcpy(temp_bytes + 1, daa_public_key.coord_x, sizeof(daa_public_key.coord_x));
    memcpy(temp_bytes + 33, daa_public_key.coord_y, sizeof(daa_public_key.coord_y));
    if ((ret = mbedtls_ecp_point_read_binary(grp, tmp_ecp, temp_bytes, sizeof(temp_bytes))) != 0) {
        ret = -1;
        goto cleanup;
    }
    if ((ret = mbedtls_ecp_muladd(grp, tmp_ecp, sigma_mpi, tmp_ecp, c_mpi, D)) != 0) {
        ret = -1;
        goto cleanup;
    }
    if ((ret = mbedtls_ecp_point_write_binary(grp, tmp_ecp, MBEDTLS_ECP_PF_UNCOMPRESSED, &outlen,
                                              temp_bytes, sizeof(temp_bytes))) != 0) {
        ret = -1;
        goto cleanup;
    }
    if ((ret = mbedtls_sha256_update(sha256_ctx, temp_bytes, sizeof(temp_bytes))) != 0) {
        ret = -1;
        goto cleanup;
    }
    if ((ret = mbedtls_sha256_update(sha256_ctx, daa_credential.B, sizeof(daa_credential.B))) !=
        0) {
        ret = -1;
        goto cleanup;
    }
    if ((ret = mbedtls_sha256_update(sha256_ctx, daa_credential.D, sizeof(daa_credential.D))) !=
        0) {
        ret = -1;
        goto cleanup;
    }
    if ((ret = mbedtls_sha256_finish(sha256_ctx, cv)) != 0) {
        ret = -1;
        goto cleanup;
    }
    if (mbedtls_ct_memcmp(cv, daa_credential.c, sizeof(daa_credential.c)) != 0) {
        ret = -1;
        goto cleanup;
    }

cleanup:
    if (sigma_mpi != NULL) {
        mbedtls_mpi_free(sigma_mpi);
        free(sigma_mpi);
    }
    if (c_mpi != NULL) {
        mbedtls_mpi_free(c_mpi);
        free(c_mpi);
    }
    if (B != NULL) {
        mbedtls_ecp_point_free(B);
        free(B);
    }
    if (D != NULL) {
        mbedtls_ecp_point_free(D);
        free(D);
    }
    if (tmp_ecp != NULL) {
        mbedtls_ecp_point_free(tmp_ecp);
        free(tmp_ecp);
    }
    if (sha256_ctx != NULL) {
        mbedtls_sha256_free(sha256_ctx);
        free(sha256_ctx);
    }
    free_ec_group_bnp256(grp);
    return ret;
}

/**
 * Create a DAA signature using the TPM and provided DAA credential.
 *
 * Parameters:
 * - daa_ctx: DAA context with group parameters.
 * - ctx: TSS/TPM context.
 * - daa_credential: Validated credential (A,B,C,D, c, sigma).
 * - daa_handle: TPM handle of the DAA key.
 * - message: 32-byte message to sign.
 * - daa_signature: Output signature structure (populated on success).
 *
 * Returns:
 * - 0 on success; -1 on failure.
 */
int daa_sign(DAA_CONTEXT* daa_ctx, TSS_CONTEXT* ctx, DAA_CREDENTIAL daa_credential,
             TPM_HANDLE daa_handle, uint8_t* message, DAA_SIGNATURE* daa_signature) {
    int                ret = 0;
    TPMT_SIG_SCHEME    inScheme;
    mbedtls_mpi*       z_mpi   = NULL;
    mbedtls_ecp_point* A_prime = NULL;
    mbedtls_ecp_point* B_prime = NULL;
    mbedtls_ecp_point* C_prime = NULL;
    mbedtls_ecp_point* D_prime = NULL;
    TPM2B_ECC_POINT    tpm_tmp_ecp;
    TPM2B_MAX_BUFFER   tpm_buffer;
    uint8_t            z[32];
    uint8_t            temp_bytes[65];
    size_t             outlen = 0;
    TPM2B_DIGEST       policy_digest[2];

    mbedtls_ecp_group*      grp        = NULL;
    mbedtls_sha256_context* sha256_ctx = NULL;

    if ((ret = random_bytes_mod(z, &outlen, daa_ctx->BNP256_ORDER, sizeof(z))) != 0) {
        ret = -1;
        goto cleanup;
    }
    z_mpi = (mbedtls_mpi*)calloc(1, sizeof(mbedtls_mpi));
    mbedtls_mpi_init(z_mpi);
    if ((ret = mbedtls_mpi_read_binary(z_mpi, z, sizeof(z))) != 0) {
        ret = -1;
        goto cleanup;
    }
    if ((ret = get_ec_group_bnp256(daa_ctx, &grp)) != 0) {
        ret = -1;
        goto cleanup;
    }
    A_prime = (mbedtls_ecp_point*)calloc(1, sizeof(mbedtls_ecp_point));
    B_prime = (mbedtls_ecp_point*)calloc(1, sizeof(mbedtls_ecp_point));
    C_prime = (mbedtls_ecp_point*)calloc(1, sizeof(mbedtls_ecp_point));
    D_prime = (mbedtls_ecp_point*)calloc(1, sizeof(mbedtls_ecp_point));
    mbedtls_ecp_point_init(A_prime);
    mbedtls_ecp_point_init(B_prime);
    mbedtls_ecp_point_init(C_prime);
    mbedtls_ecp_point_init(D_prime);
    if ((ret = mbedtls_ecp_point_read_binary(grp, A_prime, daa_credential.A,
                                             sizeof(daa_credential.A))) != 0) {
        ret = -1;
        goto cleanup;
    }
    if ((ret = mbedtls_ecp_point_read_binary(grp, B_prime, daa_credential.B,
                                             sizeof(daa_credential.B))) != 0) {
        ret = -1;
        goto cleanup;
    }
    if ((ret = mbedtls_ecp_point_read_binary(grp, C_prime, daa_credential.C,
                                             sizeof(daa_credential.C))) != 0) {
        ret = -1;
        goto cleanup;
    }
    if ((ret = mbedtls_ecp_point_read_binary(grp, D_prime, daa_credential.D,
                                             sizeof(daa_credential.D))) != 0) {
        ret = -1;
        goto cleanup;
    }
    if ((ret = mbedtls_ecp_mul(grp, A_prime, z_mpi, A_prime, random_bytes, NULL)) != 0) {
        ret = -1;
        goto cleanup;
    }
    if ((ret = mbedtls_ecp_mul(grp, B_prime, z_mpi, B_prime, random_bytes, NULL)) != 0) {
        ret = -1;
        goto cleanup;
    }
    if ((ret = mbedtls_ecp_mul(grp, C_prime, z_mpi, C_prime, random_bytes, NULL)) != 0) {
        ret = -1;
        goto cleanup;
    }
    if ((ret = mbedtls_ecp_mul(grp, D_prime, z_mpi, D_prime, random_bytes, NULL)) != 0) {
        ret = -1;
        goto cleanup;
    }
    if ((ret = mbedtls_ecp_point_write_binary(grp, B_prime, MBEDTLS_ECP_PF_UNCOMPRESSED, &outlen,
                                              temp_bytes, sizeof(temp_bytes))) != 0) {
        ret = -1;
        goto cleanup;
    }
    memcpy(tpm_tmp_ecp.point.x.t.buffer, temp_bytes + 1, 32);
    tpm_tmp_ecp.point.x.t.size = 32;
    memcpy(tpm_tmp_ecp.point.y.t.buffer, temp_bytes + 33, 32);
    tpm_tmp_ecp.point.y.t.size = 32;

    StartAuthSession_Out session_out = auth_session(ctx, TPM_SE_POLICY);

    policy_command_code(ctx, session_out, TPM_CC_Commit);

    commit_policy(&policy_digest[0]);
    sign_policy(&policy_digest[1]);
    policy_or(ctx, session_out, policy_digest, 2);

    Commit_Out commit_out =
        commit(ctx, daa_handle, &tpm_tmp_ecp, session_out.sessionHandle, NULL, NULL);

    sha256_ctx = (mbedtls_sha256_context*)calloc(1, sizeof(mbedtls_sha256_context));
    mbedtls_sha256_init(sha256_ctx);
    if ((ret = mbedtls_sha256_starts(sha256_ctx, 0)) != 0) {
        ret = -1;
        goto cleanup;
    }
    if ((ret = mbedtls_sha256_update(sha256_ctx, message, sizeof(daa_signature->message))) != 0) {
        ret = -1;
        goto cleanup;
    }

    if ((ret = mbedtls_ecp_point_write_binary(grp, A_prime, MBEDTLS_ECP_PF_UNCOMPRESSED, &outlen,
                                              daa_signature->A_prime,
                                              sizeof(daa_signature->A_prime))) != 0) {
        ret = -1;
        goto cleanup;
    }
    if ((ret = mbedtls_sha256_update(sha256_ctx, daa_signature->A_prime, outlen)) != 0) {
        ret = -1;
        goto cleanup;
    }

    if ((ret = mbedtls_ecp_point_write_binary(grp, B_prime, MBEDTLS_ECP_PF_UNCOMPRESSED, &outlen,
                                              daa_signature->B_prime,
                                              sizeof(daa_signature->B_prime))) != 0) {
        ret = -1;
        goto cleanup;
    }
    if ((ret = mbedtls_sha256_update(sha256_ctx, daa_signature->B_prime, outlen)) != 0) {
        ret = -1;
        goto cleanup;
    }

    if ((ret = mbedtls_ecp_point_write_binary(grp, C_prime, MBEDTLS_ECP_PF_UNCOMPRESSED, &outlen,
                                              daa_signature->C_prime,
                                              sizeof(daa_signature->C_prime))) != 0) {
        ret = -1;
        goto cleanup;
    }
    if ((ret = mbedtls_sha256_update(sha256_ctx, daa_signature->C_prime, outlen)) != 0) {
        ret = -1;
        goto cleanup;
    }

    if ((ret = mbedtls_ecp_point_write_binary(grp, D_prime, MBEDTLS_ECP_PF_UNCOMPRESSED, &outlen,
                                              daa_signature->D_prime,
                                              sizeof(daa_signature->D_prime))) != 0) {
        ret = -1;
        goto cleanup;
    }
    if ((ret = mbedtls_sha256_update(sha256_ctx, daa_signature->D_prime, outlen)) != 0) {
        ret = -1;
        goto cleanup;
    }

    if (commit_out.K.point.x.t.size != 0 || commit_out.K.point.y.t.size != 0) {
        memcpy(temp_bytes + 1, commit_out.K.point.x.t.buffer, commit_out.K.point.x.t.size);
        memcpy(temp_bytes + 33, commit_out.K.point.y.t.buffer, commit_out.K.point.y.t.size);
    } else {
        memset(temp_bytes + 1, 0, sizeof(temp_bytes) - 1);
    }
    memcpy(daa_signature->K, temp_bytes, sizeof(temp_bytes));
    if ((ret = mbedtls_sha256_update(sha256_ctx, temp_bytes, sizeof(temp_bytes))) != 0) {
        ret = -1;
        goto cleanup;
    }

    if (commit_out.L.point.x.t.size != 0 || commit_out.L.point.y.t.size != 0) {
        memcpy(temp_bytes + 1, commit_out.L.point.x.t.buffer, commit_out.L.point.x.t.size);
        memcpy(temp_bytes + 33, commit_out.L.point.y.t.buffer, commit_out.L.point.y.t.size);
    } else {
        memset(temp_bytes + 1, 0, sizeof(temp_bytes) - 1);
    }
    memcpy(daa_signature->L, temp_bytes, sizeof(temp_bytes));
    if ((ret = mbedtls_sha256_update(sha256_ctx, temp_bytes, sizeof(temp_bytes))) != 0) {
        ret = -1;
        goto cleanup;
    }

    if (commit_out.E.point.x.t.size != 0 || commit_out.E.point.y.t.size != 0) {
        memcpy(temp_bytes + 1, commit_out.E.point.x.t.buffer, commit_out.E.point.x.t.size);
        memcpy(temp_bytes + 33, commit_out.E.point.y.t.buffer, commit_out.E.point.y.t.size);
    } else {
        memset(temp_bytes + 1, 0, sizeof(temp_bytes) - 1);
    }
    memcpy(daa_signature->E, temp_bytes, sizeof(temp_bytes));
    if ((ret = mbedtls_sha256_update(sha256_ctx, temp_bytes, sizeof(temp_bytes))) != 0) {
        ret = -1;
        goto cleanup;
    }

    if ((ret = mbedtls_sha256_finish(sha256_ctx, tpm_buffer.b.buffer)) != 0) {
        ret = -1;
        goto cleanup;
    }
    tpm_buffer.b.size = 32;

    Hash_Out digest = hash(ctx, &tpm_buffer, TPM_RH_OWNER, TPM_ALG_SHA256);

    inScheme.scheme                = TPM_ALG_ECDAA;
    inScheme.details.ecdaa.hashAlg = TPM_ALG_SHA256;
    inScheme.details.ecdaa.count   = commit_out.counter;
    session_out                    = auth_session(ctx, TPM_SE_POLICY);

    policy_command_code(ctx, session_out, TPM_CC_Sign);

    policy_or(ctx, session_out, policy_digest, 2);

    Sign_Out sign_out = sign(ctx, daa_handle, session_out, &inScheme, digest);

    mbedtls_sha256_init(sha256_ctx);
    mbedtls_sha256_starts(sha256_ctx, 0);
    if ((ret = mbedtls_sha256_update(sha256_ctx,
                                     sign_out.signature.signature.ecdaa.signatureR.t.buffer,
                                     sign_out.signature.signature.ecdaa.signatureR.t.size)) != 0) {
        ret = -1;
        goto cleanup;
    }
    if ((ret = mbedtls_sha256_update(sha256_ctx, digest.outHash.b.buffer, digest.outHash.b.size)) !=
        0) {
        ret = -1;
        goto cleanup;
    }
    if ((ret = mbedtls_sha256_finish(sha256_ctx, daa_signature->c)) != 0) {
        ret = -1;
        goto cleanup;
    }
    memcpy(daa_signature->signatureR, sign_out.signature.signature.ecdaa.signatureR.t.buffer,
           sizeof(daa_signature->signatureR));
    memcpy(daa_signature->signatureS, sign_out.signature.signature.ecdaa.signatureS.t.buffer,
           sizeof(daa_signature->signatureS));
    memcpy(daa_signature->message, message, sizeof(daa_signature->message));

cleanup:
    if (z_mpi != NULL) {
        mbedtls_mpi_free(z_mpi);
        free(z_mpi);
    }
    if (A_prime != NULL) {
        mbedtls_ecp_point_free(A_prime);
        free(A_prime);
    }
    if (B_prime != NULL) {
        mbedtls_ecp_point_free(B_prime);
        free(B_prime);
    }
    if (C_prime != NULL) {
        mbedtls_ecp_point_free(C_prime);
        free(C_prime);
    }
    if (D_prime != NULL) {
        mbedtls_ecp_point_free(D_prime);
        free(D_prime);
    }
    if (sha256_ctx != NULL) {
        mbedtls_sha256_free(sha256_ctx);
        free(sha256_ctx);
    }
    free_ec_group_bnp256(grp);
    return ret;
}

/**
 * Verify a DAA signature produced by daa_sign().
 *
 * Parameters:
 * - daa_ctx: DAA context.
 * - daa_signature: Signature to verify.
 *
 * Returns:
 * - 0 if the signature is valid; -1 otherwise.
 */
int verify_daa_signature(DAA_CONTEXT* daa_ctx, DAA_SIGNATURE daa_signature) {
    int ret = 0;

    mbedtls_ecp_group* grp     = NULL;
    mbedtls_mpi*       s_mpi   = NULL;
    mbedtls_mpi*       cv_mpi  = NULL;
    mbedtls_mpi*       tmp_mpi = NULL;

    mbedtls_ecp_point*      sB_prime   = NULL;
    mbedtls_ecp_point*      cD_prime   = NULL;
    mbedtls_ecp_point*      tmp_ecp    = NULL;
    mbedtls_mpi_sint        z          = 1;
    mbedtls_sha256_context* sha256_ctx = NULL;

    uint8_t cv_prime[32];
    size_t  outlen = 0;
    uint8_t temp_bytes[65];

    if ((ret = get_ec_group_bnp256(daa_ctx, &grp)) != 0) {
        ret = -1;
        goto cleanup;
    }
    s_mpi  = (mbedtls_mpi*)calloc(1, sizeof(mbedtls_mpi));
    cv_mpi = (mbedtls_mpi*)calloc(1, sizeof(mbedtls_mpi));
    mbedtls_mpi_init(s_mpi);
    mbedtls_mpi_init(cv_mpi);

    if ((ret = mbedtls_mpi_read_binary(s_mpi, daa_signature.signatureS,
                                       sizeof(daa_signature.signatureS))) != 0) {
        ret = -1;
        goto cleanup;
    }
    if ((ret = mbedtls_mpi_read_binary(cv_mpi, daa_signature.c, sizeof(daa_signature.c))) != 0) {
        ret = -1;
        goto cleanup;
    }
    cD_prime = (mbedtls_ecp_point*)calloc(1, sizeof(mbedtls_ecp_point));
    mbedtls_ecp_point_init(cD_prime);
    if ((ret = mbedtls_ecp_point_read_binary(grp, cD_prime, daa_signature.D_prime,
                                             sizeof(daa_signature.D_prime))) != 0) {
        ret = -1;
        goto cleanup;
    }
    if ((ret = mbedtls_ecp_mul(grp, cD_prime, cv_mpi, cD_prime, random_bytes, NULL)) != 0) {
        ret = -1;
        goto cleanup;
    }
    sB_prime = (mbedtls_ecp_point*)calloc(1, sizeof(mbedtls_ecp_point));
    mbedtls_ecp_point_init(sB_prime);
    if ((ret = mbedtls_ecp_point_read_binary(grp, sB_prime, daa_signature.B_prime,
                                             sizeof(daa_signature.B_prime))) != 0) {
        ret = -1;
        goto cleanup;
    }
    tmp_ecp = (mbedtls_ecp_point*)calloc(1, sizeof(mbedtls_ecp_point));
    mbedtls_ecp_point_init(tmp_ecp);
    tmp_mpi = (mbedtls_mpi*)calloc(1, sizeof(mbedtls_mpi));
    mbedtls_mpi_init(tmp_mpi);
    if ((ret = mbedtls_mpi_lset(tmp_mpi, z)) != 0) {
        ret = -1;
        goto cleanup;
    }
    ecp_negate(grp, cD_prime, cD_prime);

    if ((ret = mbedtls_ecp_muladd(grp, tmp_ecp, s_mpi, sB_prime, tmp_mpi, cD_prime)) != 0) {
        ret = -1;
        goto cleanup;
    }

    sha256_ctx = (mbedtls_sha256_context*)calloc(1, sizeof(mbedtls_sha256_context));
    mbedtls_sha256_init(sha256_ctx);
    if ((ret = mbedtls_sha256_starts(sha256_ctx, 0)) != 0) {
        ret = -1;
        goto cleanup;
    }
    if ((ret = mbedtls_sha256_update(sha256_ctx, daa_signature.message,
                                     sizeof(daa_signature.message))) != 0) {
        ret = -1;
        goto cleanup;
    }

    if ((ret = mbedtls_sha256_update(sha256_ctx, daa_signature.A_prime,
                                     sizeof(daa_signature.A_prime))) != 0) {
        ret = -1;
        goto cleanup;
    }

    if ((ret = mbedtls_sha256_update(sha256_ctx, daa_signature.B_prime,
                                     sizeof(daa_signature.B_prime))) != 0) {
        ret = -1;
        goto cleanup;
    }

    if ((ret = mbedtls_sha256_update(sha256_ctx, daa_signature.C_prime,
                                     sizeof(daa_signature.C_prime))) != 0) {
        ret = -1;
        goto cleanup;
    }

    if ((ret = mbedtls_sha256_update(sha256_ctx, daa_signature.D_prime,
                                     sizeof(daa_signature.D_prime))) != 0) {
        ret = -1;
        goto cleanup;
    }

    if ((ret = mbedtls_sha256_update(sha256_ctx, daa_signature.K, sizeof(daa_signature.K))) != 0) {
        ret = -1;
        goto cleanup;
    }

    if ((ret = mbedtls_sha256_update(sha256_ctx, daa_signature.L, sizeof(daa_signature.L))) != 0) {
        ret = -1;
        goto cleanup;
    }

    if ((ret = mbedtls_ecp_point_write_binary(grp, tmp_ecp, MBEDTLS_ECP_PF_UNCOMPRESSED, &outlen,
                                              temp_bytes, sizeof(temp_bytes))) != 0) {
        ret = -1;
        goto cleanup;
    }
    if ((ret = mbedtls_sha256_update(sha256_ctx, temp_bytes, sizeof(temp_bytes))) != 0) {
        ret = -1;
        goto cleanup;
    }

    if ((ret = mbedtls_sha256_finish(sha256_ctx, cv_prime)) != 0) {
        ret = -1;
        goto cleanup;
    }
    mbedtls_sha256_free(sha256_ctx);
    if ((ret = mbedtls_sha256_starts(sha256_ctx, 0)) != 0) {
        ret = -1;
        goto cleanup;
    }
    if ((ret = mbedtls_sha256_update(sha256_ctx, cv_prime, sizeof(cv_prime))) != 0) {
        ret = -1;
        goto cleanup;
    }
    if ((ret = mbedtls_sha256_finish(sha256_ctx, cv_prime)) != 0) {
        ret = -1;
        goto cleanup;
    }

    mbedtls_sha256_free(sha256_ctx);
    if ((ret = mbedtls_sha256_starts(sha256_ctx, 0)) != 0) {
        ret = -1;
        goto cleanup;
    }
    if ((ret = mbedtls_sha256_update(sha256_ctx, daa_signature.signatureR,
                                     sizeof(daa_signature.signatureR))) != 0) {
        ret = -1;
        goto cleanup;
    }
    if ((ret = mbedtls_sha256_update(sha256_ctx, cv_prime, sizeof(cv_prime))) != 0) {
        ret = -1;
        goto cleanup;
    }
    if ((ret = mbedtls_sha256_finish(sha256_ctx, cv_prime)) != 0) {
        ret = -1;
        goto cleanup;
    }
    if (mbedtls_ct_memcmp(cv_prime, daa_signature.c, sizeof(daa_signature.c)) != 0) {
        ret = -1;
        goto cleanup;
    }

cleanup:
    free_ec_group_bnp256(grp);
    if (s_mpi != NULL) {
        mbedtls_mpi_free(s_mpi);
        free(s_mpi);
    }
    if (cv_mpi != NULL) {
        mbedtls_mpi_free(cv_mpi);
        free(cv_mpi);
    }
    if (tmp_mpi != NULL) {
        mbedtls_mpi_free(tmp_mpi);
        free(tmp_mpi);
    }
    if (sB_prime != NULL) {
        mbedtls_ecp_point_free(sB_prime);
        free(sB_prime);
    }
    if (cD_prime != NULL) {
        mbedtls_ecp_point_free(cD_prime);
        free(cD_prime);
    }
    if (tmp_ecp != NULL) {
        mbedtls_ecp_point_free(tmp_ecp);
        free(tmp_ecp);
    }
    if (sha256_ctx != NULL) {
        mbedtls_sha256_free(sha256_ctx);
        free(sha256_ctx);
    }

    return ret;
}