src/libstrongswan/plugins/openssl/openssl_ec_diffie_hellman.c

   1 /*
   2  * Copyright (C) 2008-2013 Tobias Brunner
   3  * Hochschule fuer Technik Rapperswil
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  */
  15
  16 #include <openssl/opensslconf.h>
  17
  18 #ifndef OPENSSL_NO_EC
  19
  20 #include <openssl/ec.h>
  21 #include <openssl/objects.h>
  22 #include <openssl/bn.h>
  23
  24 #include "openssl_ec_diffie_hellman.h"
  25 #include "openssl_util.h"
  26
  27 #include <utils/debug.h>
  28
  29 typedef struct private_openssl_ec_diffie_hellman_t private_openssl_ec_diffie_hellman_t;
  30
  31 /**
  32  * Private data of an openssl_ec_diffie_hellman_t object.
  33  */
  34 struct private_openssl_ec_diffie_hellman_t {
  35         /**
  36          * Public openssl_ec_diffie_hellman_t interface.
  37          */
  38         openssl_ec_diffie_hellman_t public;
  39
  40         /**
  41          * Diffie Hellman group number.
  42          */
  43         u_int16_t group;
  44
  45         /**
  46          * EC private (public) key
  47          */
  48         EC_KEY *key;
  49
  50         /**
  51          * EC group
  52          */
  53         const EC_GROUP *ec_group;
  54
  55         /**
  56          * Other public key
  57          */
  58         EC_POINT *pub_key;
  59
  60         /**
  61          * Shared secret
  62          */
  63         chunk_t shared_secret;
  64
  65         /**
  66          * True if shared secret is computed
  67          */
  68         bool computed;
  69 };
  70
  71 /**
  72  * Convert a chunk to an EC_POINT (which must already exist). The x and y
  73  * coordinates of the point have to be concatenated in the chunk.
  74  */
  75 static bool chunk2ecp(const EC_GROUP *group, chunk_t chunk, EC_POINT *point)
  76 {
  77         BN_CTX *ctx;
  78         BIGNUM *x, *y;
  79         bool ret = FALSE;
  80
  81         ctx = BN_CTX_new();
  82         if (!ctx)
  83         {
  84                 return FALSE;
  85         }
  86
  87         BN_CTX_start(ctx);
  88         x = BN_CTX_get(ctx);
  89         y = BN_CTX_get(ctx);
  90         if (!x || !y)
  91         {
  92                 goto error;
  93         }
  94
  95         if (!openssl_bn_split(chunk, x, y))
  96         {
  97                 goto error;
  98         }
  99
 100         if (!EC_POINT_set_affine_coordinates_GFp(group, point, x, y, ctx))
 101         {
 102                 goto error;
 103         }
 104
 105         ret = TRUE;
 106 error:
 107         BN_CTX_end(ctx);
 108         BN_CTX_free(ctx);
 109         return ret;
 110 }
 111
 112 /**
 113  * Convert an EC_POINT to a chunk by concatenating the x and y coordinates of
 114  * the point. This function allocates memory for the chunk.
 115  */
 116 static bool ecp2chunk(const EC_GROUP *group, const EC_POINT *point,
 117                                           chunk_t *chunk, bool x_coordinate_only)
 118 {
 119         BN_CTX *ctx;
 120         BIGNUM *x, *y;
 121         bool ret = FALSE;
 122
 123         ctx = BN_CTX_new();
 124         if (!ctx)
 125         {
 126                 return FALSE;
 127         }
 128
 129         BN_CTX_start(ctx);
 130         x = BN_CTX_get(ctx);
 131         y = BN_CTX_get(ctx);
 132         if (!x || !y)
 133         {
 134                 goto error;
 135         }
 136
 137         if (!EC_POINT_get_affine_coordinates_GFp(group, point, x, y, ctx))
 138         {
 139                 goto error;
 140         }
 141
 142         if (x_coordinate_only)
 143         {
 144                 y = NULL;
 145         }
 146         if (!openssl_bn_cat(EC_FIELD_ELEMENT_LEN(group), x, y, chunk))
 147         {
 148                 goto error;
 149         }
 150
 151         ret = TRUE;
 152 error:
 153         BN_CTX_end(ctx);
 154         BN_CTX_free(ctx);
 155         return ret;
 156 }
 157
 158 /**
 159  * Compute the shared secret.
 160  *
 161  * We cannot use the function ECDH_compute_key() because that returns only the
 162  * x coordinate of the shared secret point (which is defined, for instance, in
 163  * 'NIST SP 800-56A').
 164  * However, we need both coordinates as RFC 4753 says: "The Diffie-Hellman
 165  *   public value is obtained by concatenating the x and y values. The format
 166  *   of the Diffie-Hellman shared secret value is the same as that of the
 167  *   Diffie-Hellman public value."
 168  */
 169 static bool compute_shared_key(private_openssl_ec_diffie_hellman_t *this,
 170                                                            chunk_t *shared_secret)
 171 {
 172         const BIGNUM *priv_key;
 173         EC_POINT *secret = NULL;
 174         bool x_coordinate_only, ret = FALSE;
 175
 176         priv_key = EC_KEY_get0_private_key(this->key);
 177         if (!priv_key)
 178         {
 179                 goto error;
 180         }
 181
 182         secret = EC_POINT_new(this->ec_group);
 183         if (!secret)
 184         {
 185                 goto error;
 186         }
 187
 188         if (!EC_POINT_mul(this->ec_group, secret, NULL, this->pub_key, priv_key, NULL))
 189         {
 190                 goto error;
 191         }
 192
 193         /*
 194          * The default setting ecp_x_coordinate_only = TRUE
 195          * applies the following errata for RFC 4753:
 196          * http://www.rfc-editor.org/errata_search.php?eid=9
 197          */
 198         x_coordinate_only = lib->settings->get_bool(lib->settings,
 199                                                         "libstrongswan.ecp_x_coordinate_only", TRUE);
 200         if (!ecp2chunk(this->ec_group, secret, shared_secret, x_coordinate_only))
 201         {
 202                 goto error;
 203         }
 204
 205         ret = TRUE;
 206 error:
 207         if (secret)
 208         {
 209                 EC_POINT_clear_free(secret);
 210         }
 211         return ret;
 212 }
 213
 214 METHOD(diffie_hellman_t, set_other_public_value, void,
 215         private_openssl_ec_diffie_hellman_t *this, chunk_t value)
 216 {
 217         if (!chunk2ecp(this->ec_group, value, this->pub_key))
 218         {
 219                 DBG1(DBG_LIB, "ECDH public value is malformed");
 220                 return;
 221         }
 222
 223         chunk_clear(&this->shared_secret);
 224
 225         if (!compute_shared_key(this, &this->shared_secret)) {
 226                 DBG1(DBG_LIB, "ECDH shared secret computation failed");
 227                 return;
 228         }
 229
 230         this->computed = TRUE;
 231 }
 232
 233 METHOD(diffie_hellman_t, get_my_public_value, void,
 234         private_openssl_ec_diffie_hellman_t *this,chunk_t *value)
 235 {
 236         ecp2chunk(this->ec_group, EC_KEY_get0_public_key(this->key), value, FALSE);
 237 }
 238
 239 METHOD(diffie_hellman_t, get_shared_secret, status_t,
 240         private_openssl_ec_diffie_hellman_t *this, chunk_t *secret)
 241 {
 242         if (!this->computed)
 243         {
 244                 return FAILED;
 245         }
 246         *secret = chunk_clone(this->shared_secret);
 247         return SUCCESS;
 248 }
 249
 250 METHOD(diffie_hellman_t, get_dh_group, diffie_hellman_group_t,
 251         private_openssl_ec_diffie_hellman_t *this)
 252 {
 253         return this->group;
 254 }
 255
 256 METHOD(diffie_hellman_t, destroy, void,
 257         private_openssl_ec_diffie_hellman_t *this)
 258 {
 259         if (this->pub_key)
 260         {
 261                 EC_POINT_clear_free(this->pub_key);
 262         }
 263         if (this->key)
 264         {
 265                 EC_KEY_free(this->key);
 266         }
 267         chunk_clear(&this->shared_secret);
 268         free(this);
 269 }
 270
 271 /**
 272  * ECC Brainpool curves are not available in OpenSSL releases < 1.0.2, but we
 273  * don't check the version in case somebody backported them.
 274  */
 275 #if (!defined(NID_brainpoolP224r1) || !defined(NID_brainpoolP256r1) || \
 276          !defined(NID_brainpoolP384r1) || !defined(NID_brainpoolP512r1))
 277
 278 /**
 279  * Parameters for ECC Brainpool curves
 280  */
 281 typedef struct {
 282         /** DH group */
 283         diffie_hellman_group_t group;
 284
 285         /** The prime p specifying the base field */
 286         const chunk_t p;
 287
 288         /** Coefficient a of the elliptic curve E: y^2 = x^3 + ax + b (mod p) */
 289         const chunk_t a;
 290
 291         /** Coefficient b */
 292         const chunk_t b;
 293
 294         /** x coordinate of base point G (a point in E of prime order) */
 295         const chunk_t x;
 296
 297         /** y coordinate of base point G */
 298         const chunk_t y;
 299
 300         /** Prime order q of the group generated by G */
 301         const chunk_t q;
 302
 303 } bp_curve;
 304
 305 /**
 306  * List of ECC Brainpool curves
 307  */
 308 static bp_curve bp_curves[] = {
 309         {
 310                 /* ECC Brainpool 224-bit curve (RFC 5639), brainpoolP224r1 */
 311                 .group = ECP_224_BP,
 312                 .p = chunk_from_chars(
 313                         0xD7,0xC1,0x34,0xAA,0x26,0x43,0x66,0x86,0x2A,0x18,0x30,0x25,0x75,0xD1,0xD7,0x87,
 314                         0xB0,0x9F,0x07,0x57,0x97,0xDA,0x89,0xF5,0x7E,0xC8,0xC0,0xFF),
 315                 .a = chunk_from_chars(
 316                         0x68,0xA5,0xE6,0x2C,0xA9,0xCE,0x6C,0x1C,0x29,0x98,0x03,0xA6,0xC1,0x53,0x0B,0x51,
 317                         0x4E,0x18,0x2A,0xD8,0xB0,0x04,0x2A,0x59,0xCA,0xD2,0x9F,0x43),
 318                 .b = chunk_from_chars(
 319                         0x25,0x80,0xF6,0x3C,0xCF,0xE4,0x41,0x38,0x87,0x07,0x13,0xB1,0xA9,0x23,0x69,0xE3,
 320                         0x3E,0x21,0x35,0xD2,0x66,0xDB,0xB3,0x72,0x38,0x6C,0x40,0x0B),
 321                 .x = chunk_from_chars(
 322                         0x0D,0x90,0x29,0xAD,0x2C,0x7E,0x5C,0xF4,0x34,0x08,0x23,0xB2,0xA8,0x7D,0xC6,0x8C,
 323                         0x9E,0x4C,0xE3,0x17,0x4C,0x1E,0x6E,0xFD,0xEE,0x12,0xC0,0x7D),
 324                 .y = chunk_from_chars(
 325                         0x58,0xAA,0x56,0xF7,0x72,0xC0,0x72,0x6F,0x24,0xC6,0xB8,0x9E,0x4E,0xCD,0xAC,0x24,
 326                         0x35,0x4B,0x9E,0x99,0xCA,0xA3,0xF6,0xD3,0x76,0x14,0x02,0xCD),
 327                 .q = chunk_from_chars(
 328                         0xD7,0xC1,0x34,0xAA,0x26,0x43,0x66,0x86,0x2A,0x18,0x30,0x25,0x75,0xD0,0xFB,0x98,
 329                         0xD1,0x16,0xBC,0x4B,0x6D,0xDE,0xBC,0xA3,0xA5,0xA7,0x93,0x9F),
 330         },
 331         {
 332                 /* ECC Brainpool 256-bit curve (RFC 5639), brainpoolP256r1 */
 333                 .group = ECP_256_BP,
 334                 .p = chunk_from_chars(
 335                         0xA9,0xFB,0x57,0xDB,0xA1,0xEE,0xA9,0xBC,0x3E,0x66,0x0A,0x90,0x9D,0x83,0x8D,0x72,
 336                         0x6E,0x3B,0xF6,0x23,0xD5,0x26,0x20,0x28,0x20,0x13,0x48,0x1D,0x1F,0x6E,0x53,0x77),
 337                 .a = chunk_from_chars(
 338                         0x7D,0x5A,0x09,0x75,0xFC,0x2C,0x30,0x57,0xEE,0xF6,0x75,0x30,0x41,0x7A,0xFF,0xE7,
 339                         0xFB,0x80,0x55,0xC1,0x26,0xDC,0x5C,0x6C,0xE9,0x4A,0x4B,0x44,0xF3,0x30,0xB5,0xD9),
 340                 .b = chunk_from_chars(
 341                         0x26,0xDC,0x5C,0x6C,0xE9,0x4A,0x4B,0x44,0xF3,0x30,0xB5,0xD9,0xBB,0xD7,0x7C,0xBF,
 342                         0x95,0x84,0x16,0x29,0x5C,0xF7,0xE1,0xCE,0x6B,0xCC,0xDC,0x18,0xFF,0x8C,0x07,0xB6),
 343                 .x = chunk_from_chars(
 344                         0x8B,0xD2,0xAE,0xB9,0xCB,0x7E,0x57,0xCB,0x2C,0x4B,0x48,0x2F,0xFC,0x81,0xB7,0xAF,
 345                         0xB9,0xDE,0x27,0xE1,0xE3,0xBD,0x23,0xC2,0x3A,0x44,0x53,0xBD,0x9A,0xCE,0x32,0x62),
 346                 .y = chunk_from_chars(
 347                         0x54,0x7E,0xF8,0x35,0xC3,0xDA,0xC4,0xFD,0x97,0xF8,0x46,0x1A,0x14,0x61,0x1D,0xC9,
 348                         0xC2,0x77,0x45,0x13,0x2D,0xED,0x8E,0x54,0x5C,0x1D,0x54,0xC7,0x2F,0x04,0x69,0x97),
 349                 .q = chunk_from_chars(
 350                         0xA9,0xFB,0x57,0xDB,0xA1,0xEE,0xA9,0xBC,0x3E,0x66,0x0A,0x90,0x9D,0x83,0x8D,0x71,
 351                         0x8C,0x39,0x7A,0xA3,0xB5,0x61,0xA6,0xF7,0x90,0x1E,0x0E,0x82,0x97,0x48,0x56,0xA7),
 352         },
 353         {
 354                 /* ECC Brainpool 384-bit curve (RFC 5639), brainpoolP384r1 */
 355                 .group = ECP_384_BP,
 356                 .p = chunk_from_chars(
 357                         0x8C,0xB9,0x1E,0x82,0xA3,0x38,0x6D,0x28,0x0F,0x5D,0x6F,0x7E,0x50,0xE6,0x41,0xDF,
 358                         0x15,0x2F,0x71,0x09,0xED,0x54,0x56,0xB4,0x12,0xB1,0xDA,0x19,0x7F,0xB7,0x11,0x23,
 359                         0xAC,0xD3,0xA7,0x29,0x90,0x1D,0x1A,0x71,0x87,0x47,0x00,0x13,0x31,0x07,0xEC,0x53),
 360                 .a = chunk_from_chars(
 361                         0x7B,0xC3,0x82,0xC6,0x3D,0x8C,0x15,0x0C,0x3C,0x72,0x08,0x0A,0xCE,0x05,0xAF,0xA0,
 362                         0xC2,0xBE,0xA2,0x8E,0x4F,0xB2,0x27,0x87,0x13,0x91,0x65,0xEF,0xBA,0x91,0xF9,0x0F,
 363                         0x8A,0xA5,0x81,0x4A,0x50,0x3A,0xD4,0xEB,0x04,0xA8,0xC7,0xDD,0x22,0xCE,0x28,0x26),
 364                 .b = chunk_from_chars(
 365                         0x04,0xA8,0xC7,0xDD,0x22,0xCE,0x28,0x26,0x8B,0x39,0xB5,0x54,0x16,0xF0,0x44,0x7C,
 366                         0x2F,0xB7,0x7D,0xE1,0x07,0xDC,0xD2,0xA6,0x2E,0x88,0x0E,0xA5,0x3E,0xEB,0x62,0xD5,
 367                         0x7C,0xB4,0x39,0x02,0x95,0xDB,0xC9,0x94,0x3A,0xB7,0x86,0x96,0xFA,0x50,0x4C,0x11),
 368                 .x = chunk_from_chars(
 369                         0x1D,0x1C,0x64,0xF0,0x68,0xCF,0x45,0xFF,0xA2,0xA6,0x3A,0x81,0xB7,0xC1,0x3F,0x6B,
 370                         0x88,0x47,0xA3,0xE7,0x7E,0xF1,0x4F,0xE3,0xDB,0x7F,0xCA,0xFE,0x0C,0xBD,0x10,0xE8,
 371                         0xE8,0x26,0xE0,0x34,0x36,0xD6,0x46,0xAA,0xEF,0x87,0xB2,0xE2,0x47,0xD4,0xAF,0x1E),
 372                 .y = chunk_from_chars(
 373                         0x8A,0xBE,0x1D,0x75,0x20,0xF9,0xC2,0xA4,0x5C,0xB1,0xEB,0x8E,0x95,0xCF,0xD5,0x52,
 374                         0x62,0xB7,0x0B,0x29,0xFE,0xEC,0x58,0x64,0xE1,0x9C,0x05,0x4F,0xF9,0x91,0x29,0x28,
 375                         0x0E,0x46,0x46,0x21,0x77,0x91,0x81,0x11,0x42,0x82,0x03,0x41,0x26,0x3C,0x53,0x15),
 376                 .q = chunk_from_chars(
 377                         0x8C,0xB9,0x1E,0x82,0xA3,0x38,0x6D,0x28,0x0F,0x5D,0x6F,0x7E,0x50,0xE6,0x41,0xDF,
 378                         0x15,0x2F,0x71,0x09,0xED,0x54,0x56,0xB3,0x1F,0x16,0x6E,0x6C,0xAC,0x04,0x25,0xA7,
 379                         0xCF,0x3A,0xB6,0xAF,0x6B,0x7F,0xC3,0x10,0x3B,0x88,0x32,0x02,0xE9,0x04,0x65,0x65),
 380         },
 381         {
 382                 /* ECC Brainpool 512-bit curve (RFC 5639), brainpoolP512r1 */
 383                 .group = ECP_512_BP,
 384                 .p = chunk_from_chars(
 385                         0xAA,0xDD,0x9D,0xB8,0xDB,0xE9,0xC4,0x8B,0x3F,0xD4,0xE6,0xAE,0x33,0xC9,0xFC,0x07,
 386                         0xCB,0x30,0x8D,0xB3,0xB3,0xC9,0xD2,0x0E,0xD6,0x63,0x9C,0xCA,0x70,0x33,0x08,0x71,
 387                         0x7D,0x4D,0x9B,0x00,0x9B,0xC6,0x68,0x42,0xAE,0xCD,0xA1,0x2A,0xE6,0xA3,0x80,0xE6,
 388                         0x28,0x81,0xFF,0x2F,0x2D,0x82,0xC6,0x85,0x28,0xAA,0x60,0x56,0x58,0x3A,0x48,0xF3),
 389                 .a = chunk_from_chars(
 390                         0x78,0x30,0xA3,0x31,0x8B,0x60,0x3B,0x89,0xE2,0x32,0x71,0x45,0xAC,0x23,0x4C,0xC5,
 391                         0x94,0xCB,0xDD,0x8D,0x3D,0xF9,0x16,0x10,0xA8,0x34,0x41,0xCA,0xEA,0x98,0x63,0xBC,
 392                         0x2D,0xED,0x5D,0x5A,0xA8,0x25,0x3A,0xA1,0x0A,0x2E,0xF1,0xC9,0x8B,0x9A,0xC8,0xB5,
 393                         0x7F,0x11,0x17,0xA7,0x2B,0xF2,0xC7,0xB9,0xE7,0xC1,0xAC,0x4D,0x77,0xFC,0x94,0xCA),
 394                 .b = chunk_from_chars(
 395                         0x3D,0xF9,0x16,0x10,0xA8,0x34,0x41,0xCA,0xEA,0x98,0x63,0xBC,0x2D,0xED,0x5D,0x5A,
 396                         0xA8,0x25,0x3A,0xA1,0x0A,0x2E,0xF1,0xC9,0x8B,0x9A,0xC8,0xB5,0x7F,0x11,0x17,0xA7,
 397                         0x2B,0xF2,0xC7,0xB9,0xE7,0xC1,0xAC,0x4D,0x77,0xFC,0x94,0xCA,0xDC,0x08,0x3E,0x67,
 398                         0x98,0x40,0x50,0xB7,0x5E,0xBA,0xE5,0xDD,0x28,0x09,0xBD,0x63,0x80,0x16,0xF7,0x23),
 399                 .x = chunk_from_chars(
 400                         0x81,0xAE,0xE4,0xBD,0xD8,0x2E,0xD9,0x64,0x5A,0x21,0x32,0x2E,0x9C,0x4C,0x6A,0x93,
 401                         0x85,0xED,0x9F,0x70,0xB5,0xD9,0x16,0xC1,0xB4,0x3B,0x62,0xEE,0xF4,0xD0,0x09,0x8E,
 402                         0xFF,0x3B,0x1F,0x78,0xE2,0xD0,0xD4,0x8D,0x50,0xD1,0x68,0x7B,0x93,0xB9,0x7D,0x5F,
 403                         0x7C,0x6D,0x50,0x47,0x40,0x6A,0x5E,0x68,0x8B,0x35,0x22,0x09,0xBC,0xB9,0xF8,0x22),
 404                 .y = chunk_from_chars(
 405                         0x7D,0xDE,0x38,0x5D,0x56,0x63,0x32,0xEC,0xC0,0xEA,0xBF,0xA9,0xCF,0x78,0x22,0xFD,
 406                         0xF2,0x09,0xF7,0x00,0x24,0xA5,0x7B,0x1A,0xA0,0x00,0xC5,0x5B,0x88,0x1F,0x81,0x11,
 407                         0xB2,0xDC,0xDE,0x49,0x4A,0x5F,0x48,0x5E,0x5B,0xCA,0x4B,0xD8,0x8A,0x27,0x63,0xAE,
 408                         0xD1,0xCA,0x2B,0x2F,0xA8,0xF0,0x54,0x06,0x78,0xCD,0x1E,0x0F,0x3A,0xD8,0x08,0x92),
 409                 .q = chunk_from_chars(
 410                         0xAA,0xDD,0x9D,0xB8,0xDB,0xE9,0xC4,0x8B,0x3F,0xD4,0xE6,0xAE,0x33,0xC9,0xFC,0x07,
 411                         0xCB,0x30,0x8D,0xB3,0xB3,0xC9,0xD2,0x0E,0xD6,0x63,0x9C,0xCA,0x70,0x33,0x08,0x70,
 412                         0x55,0x3E,0x5C,0x41,0x4C,0xA9,0x26,0x19,0x41,0x86,0x61,0x19,0x7F,0xAC,0x10,0x47,
 413                         0x1D,0xB1,0xD3,0x81,0x08,0x5D,0xDA,0xDD,0xB5,0x87,0x96,0x82,0x9C,0xA9,0x00,0x69),
 414         },
 415 };
 416
 417 /**
 418  * Create an EC_GROUP object for an ECC Brainpool curve
 419  */
 420 EC_GROUP *ec_group_new_brainpool(bp_curve *curve)
 421 {
 422         BIGNUM *p, *a, *b, *x, *y, *q;
 423         const BIGNUM *h;
 424         EC_POINT *G = NULL;
 425         EC_GROUP *group = NULL, *result = NULL;
 426         BN_CTX *ctx = NULL;
 427
 428         ctx = BN_CTX_new();
 429         p = BN_bin2bn(curve->p.ptr, curve->p.len, NULL);
 430         a = BN_bin2bn(curve->a.ptr, curve->a.len, NULL);
 431         b = BN_bin2bn(curve->b.ptr, curve->b.len, NULL);
 432         x = BN_bin2bn(curve->x.ptr, curve->x.len, NULL);
 433         y = BN_bin2bn(curve->y.ptr, curve->y.len, NULL);
 434         q = BN_bin2bn(curve->q.ptr, curve->q.len, NULL);
 435         /* all supported groups have a cofactor of 1 */
 436         h = BN_value_one();
 437         if (!ctx || !p || !a || !b || !x || !y || !q)
 438         {
 439                 goto failed;
 440         }
 441         group = EC_GROUP_new_curve_GFp(p, a, b, ctx);
 442         if (!group)
 443         {
 444                 goto failed;
 445         }
 446         G = EC_POINT_new(group);
 447         if (!G || !EC_POINT_set_affine_coordinates_GFp(group, G, x, y, ctx))
 448         {
 449                 goto failed;
 450         }
 451         if (!EC_GROUP_set_generator(group, G, q, h))
 452         {
 453                 goto failed;
 454         }
 455         result = group;
 456
 457 failed:
 458         if (!result && group)
 459         {
 460                 EC_GROUP_free(group);
 461         }
 462         if (G)
 463         {
 464                 EC_POINT_free(G);
 465         }
 466         BN_CTX_free(ctx);
 467         BN_free(p);
 468         BN_free(a);
 469         BN_free(b);
 470         BN_free(x);
 471         BN_free(y);
 472         BN_free(q);
 473         return result;
 474 }
 475
 476 /**
 477  * Create an EC_KEY for ECC Brainpool curves as defined above
 478  */
 479 static EC_KEY *ec_key_new_brainpool(diffie_hellman_group_t group)
 480 {
 481         bp_curve *curve = NULL;
 482         EC_GROUP *ec_group;
 483         EC_KEY *key = NULL;
 484         int i;
 485
 486         for (i = 0; i < countof(bp_curves); i++)
 487         {
 488                 if (bp_curves[i].group == group)
 489                 {
 490                         curve = &bp_curves[i];
 491                 }
 492         }
 493         if (!curve)
 494         {
 495                 return NULL;
 496         }
 497         ec_group = ec_group_new_brainpool(curve);
 498         if (!ec_group)
 499         {
 500                 return NULL;
 501         }
 502         key = EC_KEY_new();
 503         if (!key || !EC_KEY_set_group(key, ec_group))
 504         {
 505                 EC_KEY_free(key);
 506                 key = NULL;
 507         }
 508         EC_GROUP_free(ec_group);
 509         return key;
 510 }
 511
 512 #else /* !NID_brainpoolP224r1 || ... */
 513
 514 /**
 515  * Create an EC_KEY for ECC Brainpool curves as defined by OpenSSL
 516  */
 517 static EC_KEY *ec_key_new_brainpool(diffie_hellman_group_t group)
 518 {
 519         switch (group)
 520         {
 521                 case ECP_224_BP:
 522                         return EC_KEY_new_by_curve_name(NID_brainpoolP224r1);
 523                 case ECP_256_BP:
 524                         return EC_KEY_new_by_curve_name(NID_brainpoolP256r1);
 525                 case ECP_384_BP:
 526                         return EC_KEY_new_by_curve_name(NID_brainpoolP384r1);
 527                 case ECP_512_BP:
 528                         return EC_KEY_new_by_curve_name(NID_brainpoolP512r1);
 529                 default:
 530                         return NULL;
 531         }
 532 }
 533
 534 #endif /* !NID_brainpoolP224r1 || ... */
 535
 536 /*
 537  * Described in header.
 538  */
 539 openssl_ec_diffie_hellman_t *openssl_ec_diffie_hellman_create(diffie_hellman_group_t group)
 540 {
 541         private_openssl_ec_diffie_hellman_t *this;
 542
 543         INIT(this,
 544                 .public = {
 545                         .dh = {
 546                                 .get_shared_secret = _get_shared_secret,
 547                                 .set_other_public_value = _set_other_public_value,
 548                                 .get_my_public_value = _get_my_public_value,
 549                                 .get_dh_group = _get_dh_group,
 550                                 .destroy = _destroy,
 551                         },
 552                 },
 553                 .group = group,
 554         );
 555
 556         switch (group)
 557         {
 558                 case ECP_192_BIT:
 559                         this->key = EC_KEY_new_by_curve_name(NID_X9_62_prime192v1);
 560                         break;
 561                 case ECP_224_BIT:
 562                         this->key = EC_KEY_new_by_curve_name(NID_secp224r1);
 563                         break;
 564                 case ECP_256_BIT:
 565                         this->key = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
 566                         break;
 567                 case ECP_384_BIT:
 568                         this->key = EC_KEY_new_by_curve_name(NID_secp384r1);
 569                         break;
 570                 case ECP_521_BIT:
 571                         this->key = EC_KEY_new_by_curve_name(NID_secp521r1);
 572                         break;
 573                 case ECP_224_BP:
 574                 case ECP_256_BP:
 575                 case ECP_384_BP:
 576                 case ECP_512_BP:
 577                         this->key = ec_key_new_brainpool(group);
 578                         break;
 579                 default:
 580                         this->key = NULL;
 581                         break;
 582         }
 583
 584         if (!this->key)
 585         {
 586                 free(this);
 587                 return NULL;
 588         }
 589
 590         /* caching the EC group */
 591         this->ec_group = EC_KEY_get0_group(this->key);
 592
 593         this->pub_key = EC_POINT_new(this->ec_group);
 594         if (!this->pub_key)
 595         {
 596                 destroy(this);
 597                 return NULL;
 598         }
 599
 600         /* generate an EC private (public) key */
 601         if (!EC_KEY_generate_key(this->key))
 602         {
 603                 destroy(this);
 604                 return NULL;
 605         }
 606
 607         return &this->public;
 608 }
 609 #endif /* OPENSSL_NO_EC */