8

To allow a small C++ application to update itself at clients connected over the internet, I am in need of a mechanism that validates the download based on a public key. Algorithms such as DSA or RSA seem to be able to do this nicely.

However, looking at well-known available libraries for this (Crypto++, LibTomCrypt) they all end up making my binary > 500k larger, while it seems to me such logic can be implemented in a couple of k. Are there any libraries that implement RSA/DSA hash verification in a, say, <20k footprint?

Emiel Mols
  • 436
  • 4
  • 12
  • And the problem with 500k is? Seriously. Whose hard drive or connection can't survive 500kb? – Puppy Jul 21 '10 at 18:54
  • 4
    500k is a lot actually. Especially when a bit of googling can yield stand alone implementations of RSA and MD5. All you need is a hash algo (MD5), and then RSA to perform the public/private key part. – Chris Becke Jul 21 '10 at 19:00

6 Answers6

3

Since I found no libraries that fitted my specific need, I whipped up my own library for this: http://github.com/paiq/dsa_verify. The current implementation has a ~50k footprint of program memory, mainly due to the included bignum math lib, but future versions may be stripped even more.

Emiel Mols
  • 436
  • 4
  • 12
1

If you are windows only you may be able to link against the windows Crypto API as long as your apps are deployed on win2k or greater. Windows Crypto MSDN article.

EDIT: Another possible solution, if you just need to verify the the download did not get corrupted a quick bit of googleing found the source to this small implementation of MD5. according to the read-me at the top 3k of object code compiled.

Scott Chamberlain
  • 124,994
  • 33
  • 282
  • 431
1

In http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.143.3049&rep=rep1&type=pdf an elliptic curve library is described which according to the authors can be configured to need only about 7k ROM and below 200 bytes of RAM on a microcontroller

Peter G.
  • 14,786
  • 7
  • 57
  • 75
1

Do you really need ciphers ? Generally, to validate a download, you can use a hash function like MD5 or SHA. Maybe you can find a small library using these.

Either way, you can try the openssl library. However the .a on my machine is about 400K and 250K stripped.

Scharron
  • 17,233
  • 6
  • 44
  • 63
  • 1
    The whole point is not to verify the download on whether the bytes are in the right order, but to verify its authenticity and to prevent someone on the same network segment from forcing an update with a malicious binary. – Emiel Mols Jul 23 '10 at 09:12
0

I think you might find that the MIRACL library meets your needs.

President James K. Polk
  • 40,516
  • 21
  • 95
  • 125
0

checksums can easily handle validation jobs like these.

d-live
  • 7,926
  • 3
  • 22
  • 16
  • 1
    The whole point is not to verify the download on whether the bytes are in the right order, but to verify its authenticity and to prevent someone on the same network segment from forcing an update with a malicious binary. – Emiel Mols Jul 23 '10 at 09:13