]>
Commit | Line | Data |
---|---|---|
aa6bb135 | 1 | /* |
8020d79b | 2 | * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved. |
0f113f3e | 3 | * |
e38873f5 | 4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
aa6bb135 RS |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
d02b48c6 RE |
8 | */ |
9 | ||
0f113f3e MC |
10 | /* |
11 | * NB: These functions have been upgraded - the previous prototypes are in | |
12 | * dh_depr.c as wrappers to these ones. - Geoff | |
e9224c71 GT |
13 | */ |
14 | ||
ada66e78 P |
15 | /* |
16 | * DH low level APIs are deprecated for public use, but still ok for | |
17 | * internal use. | |
47c239c6 SL |
18 | * |
19 | * NOTE: When generating keys for key-agreement schemes - FIPS 140-2 IG 9.9 | |
20 | * states that no additional pairwise tests are required (apart from the tests | |
21 | * specified in SP800-56A) when generating keys. Hence DH pairwise tests are | |
22 | * omitted here. | |
ada66e78 P |
23 | */ |
24 | #include "internal/deprecated.h" | |
25 | ||
d02b48c6 | 26 | #include <stdio.h> |
b39fc560 | 27 | #include "internal/cryptlib.h" |
ec577822 | 28 | #include <openssl/bn.h> |
7165593c | 29 | #include <openssl/sha.h> |
f11f86f6 | 30 | #include "crypto/dh.h" |
ddb13b28 | 31 | #include "crypto/security_bits.h" |
706457b7 | 32 | #include "dh_local.h" |
71fa4513 | 33 | |
f844f9eb | 34 | #ifndef FIPS_MODULE |
0f113f3e MC |
35 | static int dh_builtin_genparams(DH *ret, int prime_len, int generator, |
36 | BN_GENCB *cb); | |
f844f9eb | 37 | #endif /* FIPS_MODULE */ |
f11f86f6 | 38 | |
19dbb742 SL |
39 | int ossl_dh_generate_ffc_parameters(DH *dh, int type, int pbits, int qbits, |
40 | BN_GENCB *cb) | |
f11f86f6 SL |
41 | { |
42 | int ret, res; | |
43 | ||
f844f9eb | 44 | #ifndef FIPS_MODULE |
7165593c | 45 | if (type == DH_PARAMGEN_TYPE_FIPS_186_2) |
5357c106 P |
46 | ret = ossl_ffc_params_FIPS186_2_generate(dh->libctx, &dh->params, |
47 | FFC_PARAM_TYPE_DH, | |
48 | pbits, qbits, &res, cb); | |
7165593c SL |
49 | else |
50 | #endif | |
5357c106 P |
51 | ret = ossl_ffc_params_FIPS186_4_generate(dh->libctx, &dh->params, |
52 | FFC_PARAM_TYPE_DH, | |
53 | pbits, qbits, &res, cb); | |
f11f86f6 SL |
54 | if (ret > 0) |
55 | dh->dirty_cnt++; | |
56 | return ret; | |
57 | } | |
0e4aa0d2 | 58 | |
19dbb742 | 59 | int ossl_dh_get_named_group_uid_from_size(int pbits) |
0f113f3e | 60 | { |
f11f86f6 SL |
61 | /* |
62 | * Just choose an approved safe prime group. | |
63 | * The alternative to this is to generate FIPS186-4 domain parameters i.e. | |
7165593c | 64 | * return dh_generate_ffc_parameters(ret, prime_len, 0, NULL, cb); |
8da42c8b | 65 | * As the FIPS186-4 generated params are for backwards compatibility, |
f11f86f6 SL |
66 | * the safe prime group should be used as the default. |
67 | */ | |
7165593c | 68 | int nid; |
f11f86f6 | 69 | |
7165593c | 70 | switch (pbits) { |
f11f86f6 SL |
71 | case 2048: |
72 | nid = NID_ffdhe2048; | |
73 | break; | |
74 | case 3072: | |
75 | nid = NID_ffdhe3072; | |
76 | break; | |
77 | case 4096: | |
78 | nid = NID_ffdhe4096; | |
79 | break; | |
80 | case 6144: | |
81 | nid = NID_ffdhe6144; | |
82 | break; | |
83 | case 8192: | |
84 | nid = NID_ffdhe8192; | |
85 | break; | |
86 | /* unsupported prime_len */ | |
87 | default: | |
7165593c | 88 | return NID_undef; |
f11f86f6 | 89 | } |
7165593c SL |
90 | return nid; |
91 | } | |
92 | ||
f844f9eb | 93 | #ifdef FIPS_MODULE |
7165593c | 94 | |
b4250010 | 95 | static int dh_gen_named_group(OSSL_LIB_CTX *libctx, DH *ret, int prime_len) |
7165593c SL |
96 | { |
97 | DH *dh; | |
98 | int ok = 0; | |
19dbb742 | 99 | int nid = ossl_dh_get_named_group_uid_from_size(prime_len); |
7165593c SL |
100 | |
101 | if (nid == NID_undef) | |
102 | return 0; | |
103 | ||
19dbb742 | 104 | dh = ossl_dh_new_by_nid_ex(libctx, nid); |
7165593c | 105 | if (dh != NULL |
5357c106 | 106 | && ossl_ffc_params_copy(&ret->params, &dh->params)) { |
f11f86f6 SL |
107 | ok = 1; |
108 | ret->dirty_cnt++; | |
109 | } | |
110 | DH_free(dh); | |
111 | return ok; | |
7165593c | 112 | } |
f844f9eb | 113 | #endif /* FIPS_MODULE */ |
7165593c SL |
114 | |
115 | int DH_generate_parameters_ex(DH *ret, int prime_len, int generator, | |
116 | BN_GENCB *cb) | |
117 | { | |
f844f9eb | 118 | #ifdef FIPS_MODULE |
7165593c SL |
119 | if (generator != 2) |
120 | return 0; | |
121 | return dh_gen_named_group(ret->libctx, ret, prime_len); | |
f11f86f6 | 122 | #else |
0f113f3e MC |
123 | if (ret->meth->generate_params) |
124 | return ret->meth->generate_params(ret, prime_len, generator, cb); | |
125 | return dh_builtin_genparams(ret, prime_len, generator, cb); | |
f844f9eb | 126 | #endif /* FIPS_MODULE */ |
0f113f3e | 127 | } |
0e4aa0d2 | 128 | |
f844f9eb | 129 | #ifndef FIPS_MODULE |
1d97c843 TH |
130 | /*- |
131 | * We generate DH parameters as follows | |
a38c878c BE |
132 | * find a prime p which is prime_len bits long, |
133 | * where q=(p-1)/2 is also prime. | |
134 | * In the following we assume that g is not 0, 1 or p-1, since it | |
135 | * would generate only trivial subgroups. | |
136 | * For this case, g is a generator of the order-q subgroup if | |
137 | * g^q mod p == 1. | |
138 | * Or in terms of the Legendre symbol: (g/p) == 1. | |
d02b48c6 RE |
139 | * |
140 | * Having said all that, | |
141 | * there is another special case method for the generators 2, 3 and 5. | |
a38c878c BE |
142 | * Using the quadratic reciprocity law it is possible to solve |
143 | * (g/p) == 1 for the special values 2, 3, 5: | |
144 | * (2/p) == 1 if p mod 8 == 1 or 7. | |
145 | * (3/p) == 1 if p mod 12 == 1 or 11. | |
146 | * (5/p) == 1 if p mod 5 == 1 or 4. | |
147 | * See for instance: https://en.wikipedia.org/wiki/Legendre_symbol | |
d02b48c6 | 148 | * |
a38c878c BE |
149 | * Since all safe primes > 7 must satisfy p mod 12 == 11 |
150 | * and all safe primes > 11 must satisfy p mod 5 != 1 | |
151 | * we can further improve the condition for g = 2, 3 and 5: | |
152 | * for 2, p mod 24 == 23 | |
153 | * for 3, p mod 12 == 11 | |
154 | * for 5, p mod 60 == 59 | |
82652aaf | 155 | */ |
0f113f3e MC |
156 | static int dh_builtin_genparams(DH *ret, int prime_len, int generator, |
157 | BN_GENCB *cb) | |
158 | { | |
159 | BIGNUM *t1, *t2; | |
160 | int g, ok = -1; | |
161 | BN_CTX *ctx = NULL; | |
d02b48c6 | 162 | |
6de1fe90 | 163 | if (prime_len > OPENSSL_DH_MAX_MODULUS_BITS) { |
9311d0c4 | 164 | ERR_raise(ERR_LIB_DH, DH_R_MODULUS_TOO_LARGE); |
6de1fe90 BE |
165 | return 0; |
166 | } | |
167 | ||
168 | if (prime_len < DH_MIN_MODULUS_BITS) { | |
9311d0c4 | 169 | ERR_raise(ERR_LIB_DH, DH_R_MODULUS_TOO_SMALL); |
6de1fe90 BE |
170 | return 0; |
171 | } | |
172 | ||
990d280d | 173 | ctx = BN_CTX_new_ex(ret->libctx); |
0f113f3e MC |
174 | if (ctx == NULL) |
175 | goto err; | |
176 | BN_CTX_start(ctx); | |
177 | t1 = BN_CTX_get(ctx); | |
178 | t2 = BN_CTX_get(ctx); | |
edea42c6 | 179 | if (t2 == NULL) |
0f113f3e | 180 | goto err; |
e9224c71 | 181 | |
0f113f3e | 182 | /* Make sure 'ret' has the necessary elements */ |
dc8de3e6 | 183 | if (ret->params.p == NULL && ((ret->params.p = BN_new()) == NULL)) |
0f113f3e | 184 | goto err; |
dc8de3e6 | 185 | if (ret->params.g == NULL && ((ret->params.g = BN_new()) == NULL)) |
0f113f3e MC |
186 | goto err; |
187 | ||
188 | if (generator <= 1) { | |
9311d0c4 | 189 | ERR_raise(ERR_LIB_DH, DH_R_BAD_GENERATOR); |
0f113f3e MC |
190 | goto err; |
191 | } | |
192 | if (generator == DH_GENERATOR_2) { | |
193 | if (!BN_set_word(t1, 24)) | |
194 | goto err; | |
a38c878c | 195 | if (!BN_set_word(t2, 23)) |
0f113f3e MC |
196 | goto err; |
197 | g = 2; | |
dfb56425 | 198 | } else if (generator == DH_GENERATOR_5) { |
a38c878c | 199 | if (!BN_set_word(t1, 60)) |
0f113f3e | 200 | goto err; |
a38c878c | 201 | if (!BN_set_word(t2, 59)) |
0f113f3e | 202 | goto err; |
0f113f3e MC |
203 | g = 5; |
204 | } else { | |
205 | /* | |
206 | * in the general case, don't worry if 'generator' is a generator or | |
207 | * not: since we are using safe primes, it will generate either an | |
208 | * order-q or an order-2q group, which both is OK | |
209 | */ | |
a38c878c | 210 | if (!BN_set_word(t1, 12)) |
0f113f3e | 211 | goto err; |
a38c878c | 212 | if (!BN_set_word(t2, 11)) |
0f113f3e MC |
213 | goto err; |
214 | g = generator; | |
215 | } | |
216 | ||
990d280d | 217 | if (!BN_generate_prime_ex2(ret->params.p, prime_len, 1, t1, t2, cb, ctx)) |
0f113f3e MC |
218 | goto err; |
219 | if (!BN_GENCB_call(cb, 3, 0)) | |
220 | goto err; | |
dc8de3e6 | 221 | if (!BN_set_word(ret->params.g, g)) |
0f113f3e | 222 | goto err; |
ddb13b28 TM |
223 | /* We are using safe prime p, set key length equivalent to RFC 7919 */ |
224 | ret->length = (2 * ossl_ifc_ffc_compute_security_bits(prime_len) | |
225 | + 24) / 25 * 25; | |
8b84b075 | 226 | ret->dirty_cnt++; |
0f113f3e MC |
227 | ok = 1; |
228 | err: | |
229 | if (ok == -1) { | |
9311d0c4 | 230 | ERR_raise(ERR_LIB_DH, ERR_R_BN_LIB); |
0f113f3e MC |
231 | ok = 0; |
232 | } | |
d02b48c6 | 233 | |
ce1415ed SL |
234 | BN_CTX_end(ctx); |
235 | BN_CTX_free(ctx); | |
0f113f3e MC |
236 | return ok; |
237 | } | |
f844f9eb | 238 | #endif /* FIPS_MODULE */ |