]>
git.ipfire.org Git - thirdparty/openssl.git/blob - crypto/srp/srp_lib.c
4b0ae0d198537de76ed44d5f199909743f17b719
1 /* crypto/srp/srp_lib.c */
3 * Written by Christophe Renou (christophe.renou@edelweb.fr) with the
4 * precious help of Peter Sylvester (peter.sylvester@edelweb.fr) for the
5 * EdelKey project and contributed to the OpenSSL project 2004.
7 /* ====================================================================
8 * Copyright (c) 2004 The OpenSSL Project. All rights reserved.
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
14 * 1. Redistributions of source code must retain the above copyright
15 * notice, this list of conditions and the following disclaimer.
17 * 2. Redistributions in binary form must reproduce the above copyright
18 * notice, this list of conditions and the following disclaimer in
19 * the documentation and/or other materials provided with the
22 * 3. All advertising materials mentioning features or use of this
23 * software must display the following acknowledgment:
24 * "This product includes software developed by the OpenSSL Project
25 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
27 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
28 * endorse or promote products derived from this software without
29 * prior written permission. For written permission, please contact
30 * licensing@OpenSSL.org.
32 * 5. Products derived from this software may not be called "OpenSSL"
33 * nor may "OpenSSL" appear in their names without prior written
34 * permission of the OpenSSL Project.
36 * 6. Redistributions of any form whatsoever must retain the following
38 * "This product includes software developed by the OpenSSL Project
39 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
41 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
42 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
44 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
45 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
46 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
47 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
48 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
49 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
50 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
51 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
52 * OF THE POSSIBILITY OF SUCH DAMAGE.
53 * ====================================================================
55 * This product includes cryptographic software written by Eric Young
56 * (eay@cryptsoft.com). This product includes software written by Tim
57 * Hudson (tjh@cryptsoft.com).
60 #ifndef OPENSSL_NO_SRP
61 # include "internal/cryptlib.h"
62 # include <openssl/sha.h>
63 # include <openssl/srp.h>
64 # include <openssl/evp.h>
65 # include "internal/bn_srp.h"
67 static BIGNUM
*srp_Calc_k(BIGNUM
*N
, BIGNUM
*g
)
69 /* k = SHA1(N | PAD(g)) -- tls-srp draft 8 */
71 unsigned char digest
[SHA_DIGEST_LENGTH
];
73 EVP_MD_CTX
*ctxt
= NULL
;
75 int longN
= BN_num_bytes(N
);
78 if (BN_ucmp(g
, N
) >= 0)
81 ctxt
= EVP_MD_CTX_new();
84 if ((tmp
= OPENSSL_malloc(longN
)) == NULL
)
88 EVP_DigestInit_ex(ctxt
, EVP_sha1(), NULL
);
89 EVP_DigestUpdate(ctxt
, tmp
, longN
);
91 memset(tmp
, 0, longN
);
92 longg
= BN_bn2bin(g
, tmp
);
93 /* use the zeros behind to pad on left */
94 EVP_DigestUpdate(ctxt
, tmp
+ longg
, longN
- longg
);
95 EVP_DigestUpdate(ctxt
, tmp
, longg
);
98 EVP_DigestFinal_ex(ctxt
, digest
, NULL
);
99 res
= BN_bin2bn(digest
, sizeof(digest
), NULL
);
101 EVP_MD_CTX_free(ctxt
);
105 BIGNUM
*SRP_Calc_u(BIGNUM
*A
, BIGNUM
*B
, BIGNUM
*N
)
107 /* k = SHA1(PAD(A) || PAD(B) ) -- tls-srp draft 8 */
110 unsigned char cu
[SHA_DIGEST_LENGTH
];
111 unsigned char *cAB
= NULL
;
112 EVP_MD_CTX
*ctxt
= NULL
;
114 if ((A
== NULL
) || (B
== NULL
) || (N
== NULL
))
117 if (BN_ucmp(A
, N
) >= 0 || BN_ucmp(B
, N
) >= 0)
120 longN
= BN_num_bytes(N
);
122 ctxt
= EVP_MD_CTX_new();
125 if ((cAB
= OPENSSL_malloc(2 * longN
)) == NULL
)
128 memset(cAB
, 0, longN
);
130 EVP_DigestInit_ex(ctxt
, EVP_sha1(), NULL
);
131 EVP_DigestUpdate(ctxt
, cAB
+ BN_bn2bin(A
, cAB
+ longN
), longN
);
132 EVP_DigestUpdate(ctxt
, cAB
+ BN_bn2bin(B
, cAB
+ longN
), longN
);
134 EVP_DigestFinal_ex(ctxt
, cu
, NULL
);
136 if ((u
= BN_bin2bn(cu
, sizeof(cu
), NULL
)) == NULL
)
143 EVP_MD_CTX_free(ctxt
);
148 BIGNUM
*SRP_Calc_server_key(BIGNUM
*A
, BIGNUM
*v
, BIGNUM
*u
, BIGNUM
*b
,
151 BIGNUM
*tmp
= NULL
, *S
= NULL
;
154 if (u
== NULL
|| A
== NULL
|| v
== NULL
|| b
== NULL
|| N
== NULL
)
157 if ((bn_ctx
= BN_CTX_new()) == NULL
||
158 (tmp
= BN_new()) == NULL
|| (S
= BN_new()) == NULL
)
161 /* S = (A*v**u) ** b */
163 if (!BN_mod_exp(tmp
, v
, u
, N
, bn_ctx
))
165 if (!BN_mod_mul(tmp
, A
, tmp
, N
, bn_ctx
))
167 if (!BN_mod_exp(S
, tmp
, b
, N
, bn_ctx
))
175 BIGNUM
*SRP_Calc_B(BIGNUM
*b
, BIGNUM
*N
, BIGNUM
*g
, BIGNUM
*v
)
177 BIGNUM
*kv
= NULL
, *gb
= NULL
;
178 BIGNUM
*B
= NULL
, *k
= NULL
;
181 if (b
== NULL
|| N
== NULL
|| g
== NULL
|| v
== NULL
||
182 (bn_ctx
= BN_CTX_new()) == NULL
)
185 if ((kv
= BN_new()) == NULL
||
186 (gb
= BN_new()) == NULL
|| (B
= BN_new()) == NULL
)
191 if (!BN_mod_exp(gb
, g
, b
, N
, bn_ctx
)
192 || (k
= srp_Calc_k(N
, g
)) == NULL
193 || !BN_mod_mul(kv
, v
, k
, N
, bn_ctx
)
194 || !BN_mod_add(B
, gb
, kv
, N
, bn_ctx
)) {
206 BIGNUM
*SRP_Calc_x(BIGNUM
*s
, const char *user
, const char *pass
)
208 unsigned char dig
[SHA_DIGEST_LENGTH
];
213 if ((s
== NULL
) || (user
== NULL
) || (pass
== NULL
))
216 ctxt
= EVP_MD_CTX_new();
219 if ((cs
= OPENSSL_malloc(BN_num_bytes(s
))) == NULL
)
222 EVP_DigestInit_ex(ctxt
, EVP_sha1(), NULL
);
223 EVP_DigestUpdate(ctxt
, user
, strlen(user
));
224 EVP_DigestUpdate(ctxt
, ":", 1);
225 EVP_DigestUpdate(ctxt
, pass
, strlen(pass
));
226 EVP_DigestFinal_ex(ctxt
, dig
, NULL
);
228 EVP_DigestInit_ex(ctxt
, EVP_sha1(), NULL
);
230 EVP_DigestUpdate(ctxt
, cs
, BN_num_bytes(s
));
232 EVP_DigestUpdate(ctxt
, dig
, sizeof(dig
));
233 EVP_DigestFinal_ex(ctxt
, dig
, NULL
);
235 res
= BN_bin2bn(dig
, sizeof(dig
), NULL
);
237 EVP_MD_CTX_free(ctxt
);
241 BIGNUM
*SRP_Calc_A(BIGNUM
*a
, BIGNUM
*N
, BIGNUM
*g
)
246 if (a
== NULL
|| N
== NULL
|| g
== NULL
|| (bn_ctx
= BN_CTX_new()) == NULL
)
249 if ((A
= BN_new()) != NULL
&& !BN_mod_exp(A
, g
, a
, N
, bn_ctx
)) {
257 BIGNUM
*SRP_Calc_client_key(BIGNUM
*N
, BIGNUM
*B
, BIGNUM
*g
, BIGNUM
*x
,
258 BIGNUM
*a
, BIGNUM
*u
)
260 BIGNUM
*tmp
= NULL
, *tmp2
= NULL
, *tmp3
= NULL
, *k
= NULL
, *K
= NULL
;
263 if (u
== NULL
|| B
== NULL
|| N
== NULL
|| g
== NULL
|| x
== NULL
264 || a
== NULL
|| (bn_ctx
= BN_CTX_new()) == NULL
)
267 if ((tmp
= BN_new()) == NULL
||
268 (tmp2
= BN_new()) == NULL
||
269 (tmp3
= BN_new()) == NULL
||
270 (K
= BN_new()) == NULL
)
273 if (!BN_mod_exp(tmp
, g
, x
, N
, bn_ctx
))
275 if ((k
= srp_Calc_k(N
, g
)) == NULL
)
277 if (!BN_mod_mul(tmp2
, tmp
, k
, N
, bn_ctx
))
279 if (!BN_mod_sub(tmp
, B
, tmp2
, N
, bn_ctx
))
281 if (!BN_mod_mul(tmp3
, u
, x
, N
, bn_ctx
))
283 if (!BN_mod_add(tmp2
, a
, tmp3
, N
, bn_ctx
))
285 if (!BN_mod_exp(K
, tmp
, tmp2
, N
, bn_ctx
))
297 int SRP_Verify_B_mod_N(BIGNUM
*B
, BIGNUM
*N
)
303 if (B
== NULL
|| N
== NULL
|| (bn_ctx
= BN_CTX_new()) == NULL
)
306 if ((r
= BN_new()) == NULL
)
308 /* Checks if B % N == 0 */
309 if (!BN_nnmod(r
, B
, N
, bn_ctx
))
311 ret
= !BN_is_zero(r
);
318 int SRP_Verify_A_mod_N(BIGNUM
*A
, BIGNUM
*N
)
320 /* Checks if A % N == 0 */
321 return SRP_Verify_B_mod_N(A
, N
);
324 static SRP_gN knowngN
[] = {
325 {"8192", (BIGNUM
*)&bn_generator_19
, (BIGNUM
*)&bn_group_8192
},
326 {"6144", (BIGNUM
*)&bn_generator_5
, (BIGNUM
*)&bn_group_6144
},
327 {"4096", (BIGNUM
*)&bn_generator_5
, (BIGNUM
*)&bn_group_4096
},
328 {"3072", (BIGNUM
*)&bn_generator_5
, (BIGNUM
*)&bn_group_3072
},
329 {"2048", (BIGNUM
*)&bn_generator_2
, (BIGNUM
*)&bn_group_2048
},
330 {"1536", (BIGNUM
*)&bn_generator_2
, (BIGNUM
*)&bn_group_1536
},
331 {"1024", (BIGNUM
*)&bn_generator_2
, (BIGNUM
*)&bn_group_1024
},
334 # define KNOWN_GN_NUMBER sizeof(knowngN) / sizeof(SRP_gN)
337 * Check if G and N are kwown parameters. The values have been generated
338 * from the ietf-tls-srp draft version 8
340 char *SRP_check_known_gN_param(BIGNUM
*g
, BIGNUM
*N
)
343 if ((g
== NULL
) || (N
== NULL
))
346 for (i
= 0; i
< KNOWN_GN_NUMBER
; i
++) {
347 if (BN_cmp(knowngN
[i
].g
, g
) == 0 && BN_cmp(knowngN
[i
].N
, N
) == 0)
348 return knowngN
[i
].id
;
353 SRP_gN
*SRP_get_default_gN(const char *id
)
359 for (i
= 0; i
< KNOWN_GN_NUMBER
; i
++) {
360 if (strcmp(knowngN
[i
].id
, id
) == 0)