providers/implementations/keymgmt/ec_kmgmt.c

   1 /*
   2  * Copyright 2020 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 /*
  11  * ECDH/ECDSA low level APIs are deprecated for public use, but still ok for
  12  * internal use.
  13  */
  14 #include "internal/deprecated.h"
  15
  16 #include "e_os.h" /* strcasecmp */
  17 #include <string.h>
  18 #include <openssl/core_dispatch.h>
  19 #include <openssl/core_names.h>
  20 #include <openssl/bn.h>
  21 #include <openssl/err.h>
  22 #include <openssl/objects.h>
  23 #include "crypto/bn.h"
  24 #include "crypto/ec.h"
  25 #include "prov/implementations.h"
  26 #include "prov/providercommon.h"
  27 #include "prov/providercommonerr.h"
  28 #include "prov/provider_ctx.h"
  29 #include "internal/param_build_set.h"
  30
  31 static OSSL_FUNC_keymgmt_new_fn ec_newdata;
  32 static OSSL_FUNC_keymgmt_gen_init_fn ec_gen_init;
  33 static OSSL_FUNC_keymgmt_gen_set_template_fn ec_gen_set_template;
  34 static OSSL_FUNC_keymgmt_gen_set_params_fn ec_gen_set_params;
  35 static OSSL_FUNC_keymgmt_gen_settable_params_fn ec_gen_settable_params;
  36 static OSSL_FUNC_keymgmt_gen_fn ec_gen;
  37 static OSSL_FUNC_keymgmt_gen_cleanup_fn ec_gen_cleanup;
  38 static OSSL_FUNC_keymgmt_load_fn ec_load;
  39 static OSSL_FUNC_keymgmt_free_fn ec_freedata;
  40 static OSSL_FUNC_keymgmt_get_params_fn ec_get_params;
  41 static OSSL_FUNC_keymgmt_gettable_params_fn ec_gettable_params;
  42 static OSSL_FUNC_keymgmt_set_params_fn ec_set_params;
  43 static OSSL_FUNC_keymgmt_settable_params_fn ec_settable_params;
  44 static OSSL_FUNC_keymgmt_has_fn ec_has;
  45 static OSSL_FUNC_keymgmt_match_fn ec_match;
  46 static OSSL_FUNC_keymgmt_validate_fn ec_validate;
  47 static OSSL_FUNC_keymgmt_import_fn ec_import;
  48 static OSSL_FUNC_keymgmt_import_types_fn ec_import_types;
  49 static OSSL_FUNC_keymgmt_export_fn ec_export;
  50 static OSSL_FUNC_keymgmt_export_types_fn ec_export_types;
  51 static OSSL_FUNC_keymgmt_query_operation_name_fn ec_query_operation_name;
  52
  53 #define EC_DEFAULT_MD "SHA256"
  54 #define EC_POSSIBLE_SELECTIONS                                                 \
  55     (OSSL_KEYMGMT_SELECT_KEYPAIR | OSSL_KEYMGMT_SELECT_ALL_PARAMETERS)
  56
  57 static
  58 const char *ec_query_operation_name(int operation_id)
  59 {
  60     switch (operation_id) {
  61     case OSSL_OP_KEYEXCH:
  62         return "ECDH";
  63     case OSSL_OP_SIGNATURE:
  64         return "ECDSA";
  65     }
  66     return NULL;
  67 }
  68
  69 /*
  70  * Callers of key_to_params MUST make sure that domparams_to_params is also
  71  * called!
  72  *
  73  * This function only exports the bare keypair, domain parameters and other
  74  * parameters are exported separately.
  75  */
  76 static ossl_inline
  77 int key_to_params(const EC_KEY *eckey, OSSL_PARAM_BLD *tmpl,
  78                   OSSL_PARAM params[], int include_private,
  79                   unsigned char **pub_key)
  80 {
  81     BIGNUM *x = NULL, *y = NULL;
  82     const BIGNUM *priv_key = NULL;
  83     const EC_POINT *pub_point = NULL;
  84     const EC_GROUP *ecg = NULL;
  85     size_t pub_key_len = 0;
  86     int ret = 0;
  87     BN_CTX *bnctx = NULL;
  88
  89     if (eckey == NULL
  90         || (ecg = EC_KEY_get0_group(eckey)) == NULL)
  91         return 0;
  92
  93     priv_key = EC_KEY_get0_private_key(eckey);
  94     pub_point = EC_KEY_get0_public_key(eckey);
  95
  96     if (pub_point != NULL) {
  97         OSSL_PARAM *p = NULL, *px = NULL, *py = NULL;
  98         /*
  99          * EC_POINT_point2buf() can generate random numbers in some
 100          * implementations so we need to ensure we use the correct libctx.
 101          */
 102         bnctx = BN_CTX_new_ex(ec_key_get_libctx(eckey));
 103         if (bnctx == NULL)
 104             goto err;
 105
 106
 107         /* If we are doing a get then check first before decoding the point */
 108         if (tmpl == NULL) {
 109             p = OSSL_PARAM_locate(params, OSSL_PKEY_PARAM_PUB_KEY);
 110             px = OSSL_PARAM_locate(params, OSSL_PKEY_PARAM_EC_PUB_X);
 111             py = OSSL_PARAM_locate(params, OSSL_PKEY_PARAM_EC_PUB_Y);
 112         }
 113
 114         if (p != NULL || tmpl != NULL) {
 115             /* convert pub_point to a octet string according to the SECG standard */
 116             if ((pub_key_len = EC_POINT_point2buf(ecg, pub_point,
 117                                                   POINT_CONVERSION_COMPRESSED,
 118                                                   pub_key, bnctx)) == 0
 119                 || !ossl_param_build_set_octet_string(tmpl, p,
 120                                                       OSSL_PKEY_PARAM_PUB_KEY,
 121                                                       *pub_key, pub_key_len))
 122                 goto err;
 123         }
 124         if (px != NULL || py != NULL) {
 125             if (px != NULL)
 126                 x = BN_CTX_get(bnctx);
 127             if (py != NULL)
 128                 y = BN_CTX_get(bnctx);
 129
 130             if (!EC_POINT_get_affine_coordinates(ecg, pub_point, x, y, bnctx))
 131                 goto err;
 132             if (px != NULL
 133                 && !ossl_param_build_set_bn(tmpl, px,
 134                                             OSSL_PKEY_PARAM_EC_PUB_X, x))
 135                 goto err;
 136             if (py != NULL
 137                 && !ossl_param_build_set_bn(tmpl, py,
 138                                             OSSL_PKEY_PARAM_EC_PUB_Y, y))
 139                 goto err;
 140         }
 141     }
 142
 143     if (priv_key != NULL && include_private) {
 144         size_t sz;
 145         int ecbits;
 146
 147         /*
 148          * Key import/export should never leak the bit length of the secret
 149          * scalar in the key.
 150          *
 151          * For this reason, on export we use padded BIGNUMs with fixed length.
 152          *
 153          * When importing we also should make sure that, even if short lived,
 154          * the newly created BIGNUM is marked with the BN_FLG_CONSTTIME flag as
 155          * soon as possible, so that any processing of this BIGNUM might opt for
 156          * constant time implementations in the backend.
 157          *
 158          * Setting the BN_FLG_CONSTTIME flag alone is never enough, we also have
 159          * to preallocate the BIGNUM internal buffer to a fixed public size big
 160          * enough that operations performed during the processing never trigger
 161          * a realloc which would leak the size of the scalar through memory
 162          * accesses.
 163          *
 164          * Fixed Length
 165          * ------------
 166          *
 167          * The order of the large prime subgroup of the curve is our choice for
 168          * a fixed public size, as that is generally the upper bound for
 169          * generating a private key in EC cryptosystems and should fit all valid
 170          * secret scalars.
 171          *
 172          * For padding on export we just use the bit length of the order
 173          * converted to bytes (rounding up).
 174          *
 175          * For preallocating the BIGNUM storage we look at the number of "words"
 176          * required for the internal representation of the order, and we
 177          * preallocate 2 extra "words" in case any of the subsequent processing
 178          * might temporarily overflow the order length.
 179          */
 180         ecbits = EC_GROUP_order_bits(ecg);
 181         if (ecbits <= 0)
 182             goto err;
 183         sz = (ecbits + 7 ) / 8;
 184
 185         if (!ossl_param_build_set_bn_pad(tmpl, params,
 186                                          OSSL_PKEY_PARAM_PRIV_KEY,
 187                                          priv_key, sz))
 188             goto err;
 189     }
 190     ret = 1;
 191  err:
 192     BN_CTX_free(bnctx);
 193     return ret;
 194 }
 195
 196 static ossl_inline
 197 int otherparams_to_params(const EC_KEY *ec, OSSL_PARAM_BLD *tmpl,
 198                           OSSL_PARAM params[])
 199 {
 200     int ecdh_cofactor_mode = 0;
 201
 202     if (ec == NULL)
 203         return 0;
 204
 205     ecdh_cofactor_mode =
 206         (EC_KEY_get_flags(ec) & EC_FLAG_COFACTOR_ECDH) ? 1 : 0;
 207     return ossl_param_build_set_int(tmpl, params,
 208                                     OSSL_PKEY_PARAM_USE_COFACTOR_ECDH,
 209                                     ecdh_cofactor_mode);
 210 }
 211
 212 static
 213 void *ec_newdata(void *provctx)
 214 {
 215     if (!ossl_prov_is_running())
 216         return NULL;
 217     return EC_KEY_new_with_libctx(PROV_LIBRARY_CONTEXT_OF(provctx), NULL);
 218 }
 219
 220 static
 221 void ec_freedata(void *keydata)
 222 {
 223     EC_KEY_free(keydata);
 224 }
 225
 226 static
 227 int ec_has(void *keydata, int selection)
 228 {
 229     EC_KEY *ec = keydata;
 230     int ok = 0;
 231
 232     if (ossl_prov_is_running() && ec != NULL) {
 233         if ((selection & EC_POSSIBLE_SELECTIONS) != 0)
 234             ok = 1;
 235
 236         if ((selection & OSSL_KEYMGMT_SELECT_PUBLIC_KEY) != 0)
 237             ok = ok && (EC_KEY_get0_public_key(ec) != NULL);
 238         if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0)
 239             ok = ok && (EC_KEY_get0_private_key(ec) != NULL);
 240         if ((selection & OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS) != 0)
 241             ok = ok && (EC_KEY_get0_group(ec) != NULL);
 242         /*
 243          * We consider OSSL_KEYMGMT_SELECT_OTHER_PARAMETERS to always be
 244          * available, so no extra check is needed other than the previous one
 245          * against EC_POSSIBLE_SELECTIONS.
 246          */
 247     }
 248     return ok;
 249 }
 250
 251 static int ec_match(const void *keydata1, const void *keydata2, int selection)
 252 {
 253     const EC_KEY *ec1 = keydata1;
 254     const EC_KEY *ec2 = keydata2;
 255     const EC_GROUP *group_a = EC_KEY_get0_group(ec1);
 256     const EC_GROUP *group_b = EC_KEY_get0_group(ec2);
 257     BN_CTX *ctx = BN_CTX_new_ex(ec_key_get_libctx(ec1));
 258     int ok = 1;
 259
 260     if (!ossl_prov_is_running())
 261         return 0;
 262
 263     if ((selection & OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS) != 0)
 264         ok = ok && group_a != NULL && group_b != NULL
 265             && EC_GROUP_cmp(group_a, group_b, ctx) == 0;
 266     if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0) {
 267         const BIGNUM *pa = EC_KEY_get0_private_key(ec1);
 268         const BIGNUM *pb = EC_KEY_get0_private_key(ec2);
 269
 270         ok = ok && BN_cmp(pa, pb) == 0;
 271     }
 272     if ((selection & OSSL_KEYMGMT_SELECT_PUBLIC_KEY) != 0) {
 273         const EC_POINT *pa = EC_KEY_get0_public_key(ec1);
 274         const EC_POINT *pb = EC_KEY_get0_public_key(ec2);
 275
 276         ok = ok && EC_POINT_cmp(group_b, pa, pb, ctx) == 0;
 277     }
 278     BN_CTX_free(ctx);
 279     return ok;
 280 }
 281
 282 static
 283 int ec_import(void *keydata, int selection, const OSSL_PARAM params[])
 284 {
 285     EC_KEY *ec = keydata;
 286     int ok = 1;
 287
 288     if (!ossl_prov_is_running() || ec == NULL)
 289         return 0;
 290
 291     /*
 292      * In this implementation, we can export/import only keydata in the
 293      * following combinations:
 294      *   - domain parameters (+optional other params)
 295      *   - public key with associated domain parameters (+optional other params)
 296      *   - private key with associated public key and domain parameters
 297      *         (+optional other params)
 298      *
 299      * This means:
 300      *   - domain parameters must always be requested
 301      *   - private key must be requested alongside public key
 302      *   - other parameters are always optional
 303      */
 304     if ((selection & OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS) == 0)
 305         return 0;
 306     if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0
 307             && (selection & OSSL_KEYMGMT_SELECT_PUBLIC_KEY) == 0)
 308         return 0;
 309
 310     if ((selection & OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS) != 0)
 311         ok = ok && ec_group_fromdata(ec, params);
 312     if ((selection & OSSL_KEYMGMT_SELECT_KEYPAIR) != 0) {
 313         int include_private =
 314             selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY ? 1 : 0;
 315
 316         ok = ok && ec_key_fromdata(ec, params, include_private);
 317     }
 318     if ((selection & OSSL_KEYMGMT_SELECT_OTHER_PARAMETERS) != 0)
 319         ok = ok && ec_key_otherparams_fromdata(ec, params);
 320
 321     return ok;
 322 }
 323
 324 static
 325 int ec_export(void *keydata, int selection, OSSL_CALLBACK *param_cb,
 326               void *cbarg)
 327 {
 328     EC_KEY *ec = keydata;
 329     OSSL_PARAM_BLD *tmpl = NULL;
 330     OSSL_PARAM *params = NULL;
 331     unsigned char *pub_key = NULL, *genbuf = NULL;
 332     BN_CTX *bnctx = NULL;
 333     int ok = 1;
 334
 335     if (!ossl_prov_is_running() || ec == NULL)
 336         return 0;
 337
 338     /*
 339      * In this implementation, we can export/import only keydata in the
 340      * following combinations:
 341      *   - domain parameters (+optional other params)
 342      *   - public key with associated domain parameters (+optional other params)
 343      *   - private key with associated public key and domain parameters
 344      *         (+optional other params)
 345      *
 346      * This means:
 347      *   - domain parameters must always be requested
 348      *   - private key must be requested alongside public key
 349      *   - other parameters are always optional
 350      */
 351     if ((selection & OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS) == 0)
 352         return 0;
 353     if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0
 354             && (selection & OSSL_KEYMGMT_SELECT_PUBLIC_KEY) == 0)
 355         return 0;
 356     if ((selection & OSSL_KEYMGMT_SELECT_OTHER_PARAMETERS) != 0
 357             && (selection & OSSL_KEYMGMT_SELECT_KEYPAIR) == 0)
 358         return 0;
 359
 360     tmpl = OSSL_PARAM_BLD_new();
 361     if (tmpl == NULL)
 362         return 0;
 363
 364     if ((selection & OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS) != 0) {
 365         bnctx = BN_CTX_new_ex(ec_key_get_libctx(ec));
 366         if (bnctx == NULL) {
 367             ok = 0;
 368             goto end;
 369         }
 370         BN_CTX_start(bnctx);
 371         ok = ok && ec_group_todata(EC_KEY_get0_group(ec), tmpl, NULL,
 372                                    ec_key_get_libctx(ec), ec_key_get0_propq(ec),
 373                                    bnctx, &genbuf);
 374     }
 375
 376     if ((selection & OSSL_KEYMGMT_SELECT_KEYPAIR) != 0) {
 377         int include_private =
 378             selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY ? 1 : 0;
 379
 380         ok = ok && key_to_params(ec, tmpl, NULL, include_private, &pub_key);
 381     }
 382     if ((selection & OSSL_KEYMGMT_SELECT_OTHER_PARAMETERS) != 0)
 383         ok = ok && otherparams_to_params(ec, tmpl, NULL);
 384
 385     if (ok && (params = OSSL_PARAM_BLD_to_param(tmpl)) != NULL)
 386         ok = param_cb(params, cbarg);
 387 end:
 388     OSSL_PARAM_BLD_free_params(params);
 389     OSSL_PARAM_BLD_free(tmpl);
 390     OPENSSL_free(pub_key);
 391     OPENSSL_free(genbuf);
 392     BN_CTX_end(bnctx);
 393     BN_CTX_free(bnctx);
 394     return ok;
 395 }
 396
 397 /* IMEXPORT = IMPORT + EXPORT */
 398
 399 # define EC_IMEXPORTABLE_DOM_PARAMETERS                                        \
 400     OSSL_PARAM_utf8_string(OSSL_PKEY_PARAM_GROUP_NAME, NULL, 0),               \
 401     OSSL_PARAM_utf8_string(OSSL_PKEY_PARAM_EC_ENCODING, NULL, 0),              \
 402     OSSL_PARAM_utf8_string(OSSL_PKEY_PARAM_EC_FIELD_TYPE, NULL, 0),            \
 403     OSSL_PARAM_BN(OSSL_PKEY_PARAM_EC_P, NULL, 0),                              \
 404     OSSL_PARAM_BN(OSSL_PKEY_PARAM_EC_A, NULL, 0),                              \
 405     OSSL_PARAM_BN(OSSL_PKEY_PARAM_EC_B, NULL, 0),                              \
 406     OSSL_PARAM_octet_string(OSSL_PKEY_PARAM_EC_GENERATOR, NULL, 0),            \
 407     OSSL_PARAM_BN(OSSL_PKEY_PARAM_EC_ORDER, NULL, 0),                          \
 408     OSSL_PARAM_BN(OSSL_PKEY_PARAM_EC_COFACTOR, NULL, 0),                       \
 409     OSSL_PARAM_octet_string(OSSL_PKEY_PARAM_EC_SEED, NULL, 0)
 410
 411 # define EC_IMEXPORTABLE_PUBLIC_KEY                                            \
 412     OSSL_PARAM_octet_string(OSSL_PKEY_PARAM_PUB_KEY, NULL, 0)
 413 # define EC_IMEXPORTABLE_PRIVATE_KEY                                           \
 414     OSSL_PARAM_BN(OSSL_PKEY_PARAM_PRIV_KEY, NULL, 0)
 415 # define EC_IMEXPORTABLE_OTHER_PARAMETERS                                      \
 416     OSSL_PARAM_int(OSSL_PKEY_PARAM_USE_COFACTOR_ECDH, NULL)
 417
 418 /*
 419  * Include all the possible combinations of OSSL_PARAM arrays for
 420  * ec_imexport_types().
 421  *
 422  * They are in a separate file as it is ~100 lines of unreadable and
 423  * uninteresting machine generated stuff.
 424  *
 425  * TODO(3.0): the generated list looks quite ugly, as to cover all possible
 426  * combinations of the bits in `selection`, it also includes combinations that
 427  * are not really useful: we might want to consider alternatives to this
 428  * solution.
 429  */
 430 #include "ec_kmgmt_imexport.inc"
 431
 432 static ossl_inline
 433 const OSSL_PARAM *ec_imexport_types(int selection)
 434 {
 435     int type_select = 0;
 436
 437     if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0)
 438         type_select += 1;
 439     if ((selection & OSSL_KEYMGMT_SELECT_PUBLIC_KEY) != 0)
 440         type_select += 2;
 441     if ((selection & OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS) != 0)
 442         type_select += 4;
 443     if ((selection & OSSL_KEYMGMT_SELECT_OTHER_PARAMETERS) != 0)
 444         type_select += 8;
 445     return ec_types[type_select];
 446 }
 447
 448 static
 449 const OSSL_PARAM *ec_import_types(int selection)
 450 {
 451     return ec_imexport_types(selection);
 452 }
 453
 454 static
 455 const OSSL_PARAM *ec_export_types(int selection)
 456 {
 457     return ec_imexport_types(selection);
 458 }
 459
 460 static int ec_get_ecm_params(const EC_GROUP *group, OSSL_PARAM params[])
 461 {
 462 #ifdef OPENSSL_NO_EC2M
 463     return 1;
 464 #else
 465     int ret = 0, m;
 466     unsigned int k1 = 0, k2 = 0, k3 = 0;
 467     int basis_nid;
 468     const char *basis_name = NULL;
 469     int fid = EC_GROUP_get_field_type(group);
 470
 471     if (fid != NID_X9_62_characteristic_two_field)
 472         return 1;
 473
 474     basis_nid = EC_GROUP_get_basis_type(group);
 475     if (basis_nid == NID_X9_62_tpBasis)
 476         basis_name = SN_X9_62_tpBasis;
 477     else if (basis_nid == NID_X9_62_ppBasis)
 478         basis_name = SN_X9_62_ppBasis;
 479     else
 480         goto err;
 481
 482     m = EC_GROUP_get_degree(group);
 483     if (!ossl_param_build_set_int(NULL, params, OSSL_PKEY_PARAM_EC_CHAR2_M, m)
 484         || !ossl_param_build_set_utf8_string(NULL, params,
 485                                              OSSL_PKEY_PARAM_EC_CHAR2_TYPE,
 486                                              basis_name))
 487         goto err;
 488
 489     if (basis_nid == NID_X9_62_tpBasis) {
 490         if (!EC_GROUP_get_trinomial_basis(group, &k1)
 491             || !ossl_param_build_set_int(NULL, params,
 492                                          OSSL_PKEY_PARAM_EC_CHAR2_TP_BASIS,
 493                                          (int)k1))
 494             goto err;
 495     } else {
 496         if (!EC_GROUP_get_pentanomial_basis(group, &k1, &k2, &k3)
 497             || !ossl_param_build_set_int(NULL, params,
 498                                          OSSL_PKEY_PARAM_EC_CHAR2_PP_K1, (int)k1)
 499             || !ossl_param_build_set_int(NULL, params,
 500                                          OSSL_PKEY_PARAM_EC_CHAR2_PP_K2, (int)k2)
 501             || !ossl_param_build_set_int(NULL, params,
 502                                          OSSL_PKEY_PARAM_EC_CHAR2_PP_K3, (int)k3))
 503             goto err;
 504     }
 505     ret = 1;
 506 err:
 507     return ret;
 508 #endif /* OPENSSL_NO_EC2M */
 509 }
 510
 511 static
 512 int ec_get_params(void *key, OSSL_PARAM params[])
 513 {
 514     int ret = 0;
 515     EC_KEY *eck = key;
 516     const EC_GROUP *ecg = NULL;
 517     OSSL_PARAM *p;
 518     unsigned char *pub_key = NULL, *genbuf = NULL;
 519     OPENSSL_CTX *libctx;
 520     const char *propq;
 521     BN_CTX *bnctx = NULL;
 522
 523     ecg = EC_KEY_get0_group(eck);
 524     if (ecg == NULL)
 525         return 0;
 526
 527     libctx = ec_key_get_libctx(eck);
 528     propq = ec_key_get0_propq(eck);
 529
 530     bnctx = BN_CTX_new_ex(libctx);
 531     if (bnctx == NULL)
 532         return 0;
 533     BN_CTX_start(bnctx);
 534
 535     if ((p = OSSL_PARAM_locate(params, OSSL_PKEY_PARAM_MAX_SIZE)) != NULL
 536         && !OSSL_PARAM_set_int(p, ECDSA_size(eck)))
 537         goto err;
 538     if ((p = OSSL_PARAM_locate(params, OSSL_PKEY_PARAM_BITS)) != NULL
 539         && !OSSL_PARAM_set_int(p, EC_GROUP_order_bits(ecg)))
 540         goto err;
 541     if ((p = OSSL_PARAM_locate(params, OSSL_PKEY_PARAM_SECURITY_BITS)) != NULL) {
 542         int ecbits, sec_bits;
 543
 544         ecbits = EC_GROUP_order_bits(ecg);
 545
 546         /*
 547          * The following estimates are based on the values published
 548          * in Table 2 of "NIST Special Publication 800-57 Part 1 Revision 4"
 549          * at http://dx.doi.org/10.6028/NIST.SP.800-57pt1r4 .
 550          *
 551          * Note that the above reference explicitly categorizes algorithms in a
 552          * discrete set of values {80, 112, 128, 192, 256}, and that it is
 553          * relevant only for NIST approved Elliptic Curves, while OpenSSL
 554          * applies the same logic also to other curves.
 555          *
 556          * Classifications produced by other standardazing bodies might differ,
 557          * so the results provided for "bits of security" by this provider are
 558          * to be considered merely indicative, and it is the users'
 559          * responsibility to compare these values against the normative
 560          * references that may be relevant for their intent and purposes.
 561          */
 562         if (ecbits >= 512)
 563             sec_bits = 256;
 564         else if (ecbits >= 384)
 565             sec_bits = 192;
 566         else if (ecbits >= 256)
 567             sec_bits = 128;
 568         else if (ecbits >= 224)
 569             sec_bits = 112;
 570         else if (ecbits >= 160)
 571             sec_bits = 80;
 572         else
 573             sec_bits = ecbits / 2;
 574
 575         if (!OSSL_PARAM_set_int(p, sec_bits))
 576             goto err;
 577     }
 578
 579     if ((p = OSSL_PARAM_locate(params, OSSL_PKEY_PARAM_DEFAULT_DIGEST)) != NULL
 580         && !OSSL_PARAM_set_utf8_string(p, EC_DEFAULT_MD))
 581         goto err;
 582
 583     p = OSSL_PARAM_locate(params, OSSL_PKEY_PARAM_USE_COFACTOR_ECDH);
 584     if (p != NULL) {
 585         int ecdh_cofactor_mode = 0;
 586
 587         ecdh_cofactor_mode =
 588             (EC_KEY_get_flags(eck) & EC_FLAG_COFACTOR_ECDH) ? 1 : 0;
 589
 590         if (!OSSL_PARAM_set_int(p, ecdh_cofactor_mode))
 591             goto err;
 592     }
 593     if ((p = OSSL_PARAM_locate(params, OSSL_PKEY_PARAM_TLS_ENCODED_PT)) != NULL) {
 594         p->return_size = EC_POINT_point2oct(EC_KEY_get0_group(key),
 595                                             EC_KEY_get0_public_key(key),
 596                                             POINT_CONVERSION_UNCOMPRESSED,
 597                                             p->data, p->return_size, bnctx);
 598         if (p->return_size == 0)
 599             goto err;
 600     }
 601
 602     ret = ec_get_ecm_params(ecg, params)
 603           && ec_group_todata(ecg, NULL, params, libctx, propq, bnctx, &genbuf)
 604           && key_to_params(eck, NULL, params, 1, &pub_key)
 605           && otherparams_to_params(eck, NULL, params);
 606 err:
 607     OPENSSL_free(genbuf);
 608     OPENSSL_free(pub_key);
 609     BN_CTX_end(bnctx);
 610     BN_CTX_free(bnctx);
 611     return ret;
 612 }
 613
 614 #ifndef OPENSSL_NO_EC2M
 615 # define EC2M_GETTABLE_DOM_PARAMS                                              \
 616         OSSL_PARAM_int(OSSL_PKEY_PARAM_EC_CHAR2_M, NULL),                      \
 617         OSSL_PARAM_utf8_string(OSSL_PKEY_PARAM_EC_CHAR2_TYPE, NULL, 0),        \
 618         OSSL_PARAM_int(OSSL_PKEY_PARAM_EC_CHAR2_TP_BASIS, NULL),               \
 619         OSSL_PARAM_int(OSSL_PKEY_PARAM_EC_CHAR2_PP_K1, NULL),                  \
 620         OSSL_PARAM_int(OSSL_PKEY_PARAM_EC_CHAR2_PP_K2, NULL),                  \
 621         OSSL_PARAM_int(OSSL_PKEY_PARAM_EC_CHAR2_PP_K3, NULL),
 622 #else
 623 # define EC2M_GETTABLE_DOM_PARAMS
 624 #endif
 625
 626 static const OSSL_PARAM ec_known_gettable_params[] = {
 627     OSSL_PARAM_int(OSSL_PKEY_PARAM_BITS, NULL),
 628     OSSL_PARAM_int(OSSL_PKEY_PARAM_SECURITY_BITS, NULL),
 629     OSSL_PARAM_int(OSSL_PKEY_PARAM_MAX_SIZE, NULL),
 630     OSSL_PARAM_octet_string(OSSL_PKEY_PARAM_TLS_ENCODED_PT, NULL, 0),
 631     EC_IMEXPORTABLE_DOM_PARAMETERS,
 632     EC2M_GETTABLE_DOM_PARAMS
 633     EC_IMEXPORTABLE_PUBLIC_KEY,
 634     OSSL_PARAM_octet_string(OSSL_PKEY_PARAM_EC_PUB_X, NULL, 0),
 635     OSSL_PARAM_octet_string(OSSL_PKEY_PARAM_EC_PUB_Y, NULL, 0),
 636     EC_IMEXPORTABLE_PRIVATE_KEY,
 637     EC_IMEXPORTABLE_OTHER_PARAMETERS,
 638     OSSL_PARAM_END
 639 };
 640
 641 static
 642 const OSSL_PARAM *ec_gettable_params(void *provctx)
 643 {
 644     return ec_known_gettable_params;
 645 }
 646
 647 static const OSSL_PARAM ec_known_settable_params[] = {
 648     OSSL_PARAM_int(OSSL_PKEY_PARAM_USE_COFACTOR_ECDH, NULL),
 649     OSSL_PARAM_octet_string(OSSL_PKEY_PARAM_TLS_ENCODED_PT, NULL, 0),
 650     OSSL_PARAM_END
 651 };
 652
 653 static
 654 const OSSL_PARAM *ec_settable_params(void *provctx)
 655 {
 656     return ec_known_settable_params;
 657 }
 658
 659 static
 660 int ec_set_params(void *key, const OSSL_PARAM params[])
 661 {
 662     EC_KEY *eck = key;
 663     const OSSL_PARAM *p;
 664
 665     p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_TLS_ENCODED_PT);
 666     if (p != NULL) {
 667         BN_CTX *ctx = BN_CTX_new_ex(ec_key_get_libctx(key));
 668         int ret = 1;
 669
 670         if (ctx == NULL
 671                 || p->data_type != OSSL_PARAM_OCTET_STRING
 672                 || !EC_KEY_oct2key(key, p->data, p->data_size, ctx))
 673             ret = 0;
 674         BN_CTX_free(ctx);
 675         if (!ret)
 676             return 0;
 677     }
 678
 679     return ec_key_otherparams_fromdata(eck, params);
 680 }
 681
 682 static
 683 int ec_validate(void *keydata, int selection)
 684 {
 685     EC_KEY *eck = keydata;
 686     int ok = 0;
 687     BN_CTX *ctx = BN_CTX_new_ex(ec_key_get_libctx(eck));
 688
 689     if (!ossl_prov_is_running() || ctx == NULL)
 690         return 0;
 691
 692     if ((selection & EC_POSSIBLE_SELECTIONS) != 0)
 693         ok = 1;
 694
 695     if ((selection & OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS) != 0)
 696         ok = ok && EC_GROUP_check(EC_KEY_get0_group(eck), ctx);
 697
 698     if ((selection & OSSL_KEYMGMT_SELECT_PUBLIC_KEY) != 0)
 699         ok = ok && ec_key_public_check(eck, ctx);
 700
 701     if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0)
 702         ok = ok && ec_key_private_check(eck);
 703
 704     if ((selection & OSSL_KEYMGMT_SELECT_KEYPAIR) == OSSL_KEYMGMT_SELECT_KEYPAIR)
 705         ok = ok && ec_key_pairwise_check(eck, ctx);
 706
 707     BN_CTX_free(ctx);
 708     return ok;
 709 }
 710
 711 struct ec_gen_ctx {
 712     OPENSSL_CTX *libctx;
 713     char *group_name;
 714     char *encoding;
 715     char *field_type;
 716     BIGNUM *p, *a, *b, *order, *cofactor;
 717     unsigned char *gen, *seed;
 718     size_t gen_len, seed_len;
 719     int selection;
 720     int ecdh_mode;
 721     EC_GROUP *gen_group;
 722 };
 723
 724 static void *ec_gen_init(void *provctx, int selection)
 725 {
 726     OPENSSL_CTX *libctx = PROV_LIBRARY_CONTEXT_OF(provctx);
 727     struct ec_gen_ctx *gctx = NULL;
 728
 729     if (!ossl_prov_is_running() || (selection & (EC_POSSIBLE_SELECTIONS)) == 0)
 730         return NULL;
 731
 732     if ((gctx = OPENSSL_zalloc(sizeof(*gctx))) != NULL) {
 733         gctx->libctx = libctx;
 734         gctx->selection = selection;
 735         gctx->ecdh_mode = 0;
 736     }
 737     return gctx;
 738 }
 739
 740 static int ec_gen_set_group(void *genctx, const EC_GROUP *src)
 741 {
 742     struct ec_gen_ctx *gctx = genctx;
 743     EC_GROUP *group;
 744
 745     group = EC_GROUP_dup(src);
 746     if (group == NULL) {
 747         ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_CURVE);
 748         return 0;
 749     }
 750     EC_GROUP_free(gctx->gen_group);
 751     gctx->gen_group = group;
 752     return 1;
 753 }
 754
 755 static int ec_gen_set_template(void *genctx, void *templ)
 756 {
 757     struct ec_gen_ctx *gctx = genctx;
 758     EC_KEY *ec = templ;
 759     const EC_GROUP *ec_group;
 760
 761     if (!ossl_prov_is_running() || gctx == NULL || ec == NULL)
 762         return 0;
 763     if ((ec_group = EC_KEY_get0_group(ec)) == NULL)
 764         return 0;
 765     return ec_gen_set_group(gctx, ec_group);
 766 }
 767
 768 #define COPY_INT_PARAM(params, key, val)                                       \
 769 p = OSSL_PARAM_locate_const(params, key);                                      \
 770 if (p != NULL && !OSSL_PARAM_get_int(p, &val))                                 \
 771     goto err;
 772
 773 #define COPY_UTF8_PARAM(params, key, val)                                      \
 774 p = OSSL_PARAM_locate_const(params, key);                                      \
 775 if (p != NULL) {                                                               \
 776     if (p->data_type != OSSL_PARAM_UTF8_STRING)                                \
 777         goto err;                                                              \
 778     OPENSSL_free(val);                                                         \
 779     val = OPENSSL_strdup(p->data);                                             \
 780     if (val == NULL)                                                           \
 781         goto err;                                                              \
 782 }
 783
 784 #define COPY_OCTET_PARAM(params, key, val, len)                                \
 785 p = OSSL_PARAM_locate_const(params, key);                                      \
 786 if (p != NULL) {                                                               \
 787     if (p->data_type != OSSL_PARAM_OCTET_STRING)                               \
 788         goto err;                                                              \
 789     OPENSSL_free(val);                                                         \
 790     len = p->data_size;                                                        \
 791     val = OPENSSL_memdup(p->data, p->data_size);                               \
 792     if (val == NULL)                                                           \
 793         goto err;                                                              \
 794 }
 795
 796 #define COPY_BN_PARAM(params, key, bn)                                         \
 797 p = OSSL_PARAM_locate_const(params, key);                                      \
 798 if (p != NULL) {                                                               \
 799     if (bn == NULL)                                                            \
 800         bn = BN_new();                                                         \
 801     if (bn == NULL || !OSSL_PARAM_get_BN(p, &bn))                              \
 802         goto err;                                                              \
 803 }
 804
 805 static int ec_gen_set_params(void *genctx, const OSSL_PARAM params[])
 806 {
 807     int ret = 0;
 808     struct ec_gen_ctx *gctx = genctx;
 809     const OSSL_PARAM *p;
 810     EC_GROUP *group = NULL;
 811
 812     COPY_INT_PARAM(params, OSSL_PKEY_PARAM_USE_COFACTOR_ECDH, gctx->ecdh_mode);
 813
 814     COPY_UTF8_PARAM(params, OSSL_PKEY_PARAM_GROUP_NAME, gctx->group_name);
 815     COPY_UTF8_PARAM(params, OSSL_PKEY_PARAM_EC_FIELD_TYPE, gctx->field_type);
 816     COPY_UTF8_PARAM(params, OSSL_PKEY_PARAM_EC_ENCODING, gctx->encoding);
 817
 818     COPY_BN_PARAM(params, OSSL_PKEY_PARAM_EC_P, gctx->p);
 819     COPY_BN_PARAM(params, OSSL_PKEY_PARAM_EC_A, gctx->a);
 820     COPY_BN_PARAM(params, OSSL_PKEY_PARAM_EC_B, gctx->b);
 821     COPY_BN_PARAM(params, OSSL_PKEY_PARAM_EC_ORDER, gctx->order);
 822     COPY_BN_PARAM(params, OSSL_PKEY_PARAM_EC_COFACTOR, gctx->cofactor);
 823
 824     COPY_OCTET_PARAM(params, OSSL_PKEY_PARAM_EC_SEED, gctx->seed, gctx->seed_len);
 825     COPY_OCTET_PARAM(params, OSSL_PKEY_PARAM_EC_GENERATOR, gctx->gen,
 826                      gctx->gen_len);
 827
 828     ret = 1;
 829 err:
 830     EC_GROUP_free(group);
 831     return ret;
 832 }
 833
 834 static int ec_gen_set_group_from_params(struct ec_gen_ctx *gctx)
 835 {
 836     int ret = 0;
 837     OSSL_PARAM_BLD *bld;
 838     OSSL_PARAM *params = NULL;
 839     EC_GROUP *group = NULL;
 840
 841     bld = OSSL_PARAM_BLD_new();
 842     if (bld == NULL)
 843         return 0;
 844
 845     if (gctx->encoding != NULL
 846         && !OSSL_PARAM_BLD_push_utf8_string(bld, OSSL_PKEY_PARAM_EC_ENCODING,
 847                                             gctx->encoding, 0))
 848         goto err;
 849
 850     if (gctx->group_name != NULL) {
 851         if (!OSSL_PARAM_BLD_push_utf8_string(bld, OSSL_PKEY_PARAM_GROUP_NAME,
 852                                              gctx->group_name, 0))
 853             goto err;
 854         /* Ignore any other parameters if there is a group name */
 855         goto build;
 856     } else if (gctx->field_type != NULL) {
 857         if (!OSSL_PARAM_BLD_push_utf8_string(bld, OSSL_PKEY_PARAM_EC_FIELD_TYPE,
 858                                              gctx->field_type, 0))
 859             goto err;
 860     } else {
 861         goto err;
 862     }
 863     if (gctx->p == NULL
 864         || gctx->a == NULL
 865         || gctx->b == NULL
 866         || gctx->order == NULL
 867         || !OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_EC_P, gctx->p)
 868         || !OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_EC_A, gctx->a)
 869         || !OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_EC_B, gctx->b)
 870         || !OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_EC_ORDER, gctx->order))
 871         goto err;
 872
 873     if (gctx->cofactor != NULL
 874         && !OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_EC_COFACTOR,
 875                                    gctx->cofactor))
 876         goto err;
 877
 878     if (gctx->seed != NULL
 879         && !OSSL_PARAM_BLD_push_octet_string(bld, OSSL_PKEY_PARAM_EC_SEED,
 880                                              gctx->seed, gctx->seed_len))
 881         goto err;
 882
 883     if (gctx->gen == NULL
 884         || !OSSL_PARAM_BLD_push_octet_string(bld, OSSL_PKEY_PARAM_EC_GENERATOR,
 885                                              gctx->gen, gctx->gen_len))
 886         goto err;
 887 build:
 888     params = OSSL_PARAM_BLD_to_param(bld);
 889     if (params == NULL)
 890         goto err;
 891     group = EC_GROUP_new_from_params(params, gctx->libctx, NULL);
 892     if (group == NULL)
 893         goto err;
 894
 895     EC_GROUP_free(gctx->gen_group);
 896     gctx->gen_group = group;
 897
 898     ret = 1;
 899 err:
 900     OSSL_PARAM_BLD_free_params(params);
 901     OSSL_PARAM_BLD_free(bld);
 902     return ret;
 903 }
 904
 905 static const OSSL_PARAM *ec_gen_settable_params(void *provctx)
 906 {
 907     static OSSL_PARAM settable[] = {
 908         OSSL_PARAM_utf8_string(OSSL_PKEY_PARAM_GROUP_NAME, NULL, 0),
 909         OSSL_PARAM_int(OSSL_PKEY_PARAM_USE_COFACTOR_ECDH, NULL),
 910         OSSL_PARAM_utf8_string(OSSL_PKEY_PARAM_EC_ENCODING, NULL, 0),
 911         OSSL_PARAM_utf8_string(OSSL_PKEY_PARAM_EC_FIELD_TYPE, NULL, 0),
 912         OSSL_PARAM_BN(OSSL_PKEY_PARAM_EC_P, NULL, 0),
 913         OSSL_PARAM_BN(OSSL_PKEY_PARAM_EC_A, NULL, 0),
 914         OSSL_PARAM_BN(OSSL_PKEY_PARAM_EC_B, NULL, 0),
 915         OSSL_PARAM_octet_string(OSSL_PKEY_PARAM_EC_GENERATOR, NULL, 0),
 916         OSSL_PARAM_BN(OSSL_PKEY_PARAM_EC_ORDER, NULL, 0),
 917         OSSL_PARAM_BN(OSSL_PKEY_PARAM_EC_COFACTOR, NULL, 0),
 918         OSSL_PARAM_octet_string(OSSL_PKEY_PARAM_EC_SEED, NULL, 0),
 919         OSSL_PARAM_END
 920     };
 921
 922     return settable;
 923 }
 924
 925 static int ec_gen_assign_group(EC_KEY *ec, EC_GROUP *group)
 926 {
 927     if (group == NULL) {
 928         ERR_raise(ERR_LIB_PROV, PROV_R_NO_PARAMETERS_SET);
 929         return 0;
 930     }
 931     return EC_KEY_set_group(ec, group) > 0;
 932 }
 933
 934 /*
 935  * The callback arguments (osslcb & cbarg) are not used by EC_KEY generation
 936  */
 937 static void *ec_gen(void *genctx, OSSL_CALLBACK *osslcb, void *cbarg)
 938 {
 939     struct ec_gen_ctx *gctx = genctx;
 940     EC_KEY *ec = NULL;
 941     int ret = 0;
 942
 943     if (!ossl_prov_is_running()
 944         || gctx == NULL
 945         || (ec = EC_KEY_new_with_libctx(gctx->libctx, NULL)) == NULL)
 946         return NULL;
 947
 948     if (gctx->gen_group == NULL) {
 949         if (!ec_gen_set_group_from_params(gctx))
 950             goto err;
 951     } else {
 952         if (gctx->encoding) {
 953             int flags = ec_encoding_name2id(gctx->encoding);
 954             if (flags < 0)
 955                 goto err;
 956             EC_GROUP_set_asn1_flag(gctx->gen_group, flags);
 957         }
 958     }
 959
 960     /* We must always assign a group, no matter what */
 961     ret = ec_gen_assign_group(ec, gctx->gen_group);
 962
 963     /* Whether you want it or not, you get a keypair, not just one half */
 964     if ((gctx->selection & OSSL_KEYMGMT_SELECT_KEYPAIR) != 0)
 965         ret = ret && EC_KEY_generate_key(ec);
 966
 967     if (gctx->ecdh_mode != -1)
 968         ret = ret && ec_set_ecdh_cofactor_mode(ec, gctx->ecdh_mode);
 969
 970     if (ret)
 971         return ec;
 972 err:
 973     /* Something went wrong, throw the key away */
 974     EC_KEY_free(ec);
 975     return NULL;
 976 }
 977
 978 static void ec_gen_cleanup(void *genctx)
 979 {
 980     struct ec_gen_ctx *gctx = genctx;
 981
 982     if (gctx == NULL)
 983         return;
 984
 985     EC_GROUP_free(gctx->gen_group);
 986     BN_free(gctx->p);
 987     BN_free(gctx->a);
 988     BN_free(gctx->b);
 989     BN_free(gctx->order);
 990     BN_free(gctx->cofactor);
 991     OPENSSL_free(gctx->group_name);
 992     OPENSSL_free(gctx->field_type);;
 993     OPENSSL_free(gctx->encoding);
 994     OPENSSL_free(gctx->seed);
 995     OPENSSL_free(gctx->gen);
 996     OPENSSL_free(gctx);
 997 }
 998
 999 void *ec_load(const void *reference, size_t reference_sz)
1000 {
1001     EC_KEY *ec = NULL;
1002
1003     if (ossl_prov_is_running() && reference_sz == sizeof(ec)) {
1004         /* The contents of the reference is the address to our object */
1005         ec = *(EC_KEY **)reference;
1006         /* We grabbed, so we detach it */
1007         *(EC_KEY **)reference = NULL;
1008         return ec;
1009     }
1010     return NULL;
1011 }
1012
1013 const OSSL_DISPATCH ec_keymgmt_functions[] = {
1014     { OSSL_FUNC_KEYMGMT_NEW, (void (*)(void))ec_newdata },
1015     { OSSL_FUNC_KEYMGMT_GEN_INIT, (void (*)(void))ec_gen_init },
1016     { OSSL_FUNC_KEYMGMT_GEN_SET_TEMPLATE,
1017       (void (*)(void))ec_gen_set_template },
1018     { OSSL_FUNC_KEYMGMT_GEN_SET_PARAMS, (void (*)(void))ec_gen_set_params },
1019     { OSSL_FUNC_KEYMGMT_GEN_SETTABLE_PARAMS,
1020       (void (*)(void))ec_gen_settable_params },
1021     { OSSL_FUNC_KEYMGMT_GEN, (void (*)(void))ec_gen },
1022     { OSSL_FUNC_KEYMGMT_GEN_CLEANUP, (void (*)(void))ec_gen_cleanup },
1023     { OSSL_FUNC_KEYMGMT_LOAD, (void (*)(void))ec_load },
1024     { OSSL_FUNC_KEYMGMT_FREE, (void (*)(void))ec_freedata },
1025     { OSSL_FUNC_KEYMGMT_GET_PARAMS, (void (*) (void))ec_get_params },
1026     { OSSL_FUNC_KEYMGMT_GETTABLE_PARAMS, (void (*) (void))ec_gettable_params },
1027     { OSSL_FUNC_KEYMGMT_SET_PARAMS, (void (*) (void))ec_set_params },
1028     { OSSL_FUNC_KEYMGMT_SETTABLE_PARAMS, (void (*) (void))ec_settable_params },
1029     { OSSL_FUNC_KEYMGMT_HAS, (void (*)(void))ec_has },
1030     { OSSL_FUNC_KEYMGMT_MATCH, (void (*)(void))ec_match },
1031     { OSSL_FUNC_KEYMGMT_VALIDATE, (void (*)(void))ec_validate },
1032     { OSSL_FUNC_KEYMGMT_IMPORT, (void (*)(void))ec_import },
1033     { OSSL_FUNC_KEYMGMT_IMPORT_TYPES, (void (*)(void))ec_import_types },
1034     { OSSL_FUNC_KEYMGMT_EXPORT, (void (*)(void))ec_export },
1035     { OSSL_FUNC_KEYMGMT_EXPORT_TYPES, (void (*)(void))ec_export_types },
1036     { OSSL_FUNC_KEYMGMT_QUERY_OPERATION_NAME,
1037       (void (*)(void))ec_query_operation_name },
1038     { 0, NULL }
1039 };