]>
Commit | Line | Data |
---|---|---|
aa6bb135 | 1 | /* |
f11f86f6 | 2 | * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved. |
d02b48c6 | 3 | * |
e38873f5 | 4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
aa6bb135 RS |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
d02b48c6 RE |
8 | */ |
9 | ||
ada66e78 P |
10 | /* |
11 | * DH low level APIs are deprecated for public use, but still ok for | |
12 | * internal use. | |
13 | */ | |
14 | #include "internal/deprecated.h" | |
15 | ||
d02b48c6 | 16 | #include <stdio.h> |
b39fc560 | 17 | #include "internal/cryptlib.h" |
706457b7 | 18 | #include "dh_local.h" |
25f2138b | 19 | #include "crypto/bn.h" |
62f49b90 | 20 | #include "crypto/dh.h" |
d02b48c6 | 21 | |
13066cee | 22 | static int generate_key(DH *dh); |
f971ccb2 | 23 | static int dh_bn_mod_exp(const DH *dh, BIGNUM *r, |
0f113f3e MC |
24 | const BIGNUM *a, const BIGNUM *p, |
25 | const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx); | |
13066cee DSH |
26 | static int dh_init(DH *dh); |
27 | static int dh_finish(DH *dh); | |
28 | ||
8083fd3a | 29 | static int compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh) |
0f113f3e | 30 | { |
62f49b90 SL |
31 | BN_CTX *ctx = NULL; |
32 | BN_MONT_CTX *mont = NULL; | |
33 | BIGNUM *tmp; | |
34 | int ret = -1; | |
35 | #ifndef FIPS_MODE | |
36 | int check_result; | |
37 | #endif | |
38 | ||
dc8de3e6 | 39 | if (BN_num_bits(dh->params.p) > OPENSSL_DH_MAX_MODULUS_BITS) { |
62f49b90 SL |
40 | DHerr(0, DH_R_MODULUS_TOO_LARGE); |
41 | goto err; | |
42 | } | |
43 | ||
dc8de3e6 | 44 | if (BN_num_bits(dh->params.p) < DH_MIN_MODULUS_BITS) { |
62f49b90 SL |
45 | DHerr(0, DH_R_MODULUS_TOO_SMALL); |
46 | return 0; | |
47 | } | |
48 | ||
8083fd3a | 49 | ctx = BN_CTX_new_ex(dh->libctx); |
62f49b90 SL |
50 | if (ctx == NULL) |
51 | goto err; | |
52 | BN_CTX_start(ctx); | |
53 | tmp = BN_CTX_get(ctx); | |
54 | if (tmp == NULL) | |
55 | goto err; | |
56 | ||
57 | if (dh->priv_key == NULL) { | |
58 | DHerr(0, DH_R_NO_PRIVATE_VALUE); | |
59 | goto err; | |
60 | } | |
61 | ||
62 | if (dh->flags & DH_FLAG_CACHE_MONT_P) { | |
63 | mont = BN_MONT_CTX_set_locked(&dh->method_mont_p, | |
dc8de3e6 | 64 | dh->lock, dh->params.p, ctx); |
62f49b90 SL |
65 | BN_set_flags(dh->priv_key, BN_FLG_CONSTTIME); |
66 | if (!mont) | |
67 | goto err; | |
68 | } | |
69 | /* TODO(3.0) : Solve in a PR related to Key validation for DH */ | |
70 | #ifndef FIPS_MODE | |
71 | if (!DH_check_pub_key(dh, pub_key, &check_result) || check_result) { | |
72 | DHerr(0, DH_R_INVALID_PUBKEY); | |
73 | goto err; | |
74 | } | |
75 | #endif | |
dc8de3e6 | 76 | if (!dh->meth->bn_mod_exp(dh, tmp, pub_key, dh->priv_key, dh->params.p, ctx, |
62f49b90 SL |
77 | mont)) { |
78 | DHerr(0, ERR_R_BN_LIB); | |
79 | goto err; | |
80 | } | |
81 | ||
82 | ret = BN_bn2bin(tmp, key); | |
83 | err: | |
84 | BN_CTX_end(ctx); | |
85 | BN_CTX_free(ctx); | |
86 | return ret; | |
0f113f3e | 87 | } |
13066cee | 88 | |
8083fd3a | 89 | int DH_compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh) |
0f113f3e | 90 | { |
8083fd3a SL |
91 | #ifdef FIPS_MODE |
92 | return compute_key(key, pub_key, dh); | |
93 | #else | |
94 | return dh->meth->compute_key(key, pub_key, dh); | |
95 | #endif | |
0f113f3e | 96 | } |
13066cee | 97 | |
8083fd3a | 98 | int DH_compute_key_padded(unsigned char *key, const BIGNUM *pub_key, DH *dh) |
0f113f3e MC |
99 | { |
100 | int rv, pad; | |
62f49b90 SL |
101 | |
102 | #ifdef FIPS_MODE | |
8083fd3a | 103 | rv = compute_key(key, pub_key, dh); |
62f49b90 | 104 | #else |
0f113f3e | 105 | rv = dh->meth->compute_key(key, pub_key, dh); |
62f49b90 | 106 | #endif |
0f113f3e MC |
107 | if (rv <= 0) |
108 | return rv; | |
dc8de3e6 | 109 | pad = BN_num_bytes(dh->params.p) - rv; |
0f113f3e MC |
110 | if (pad > 0) { |
111 | memmove(key + pad, key, rv); | |
112 | memset(key, 0, pad); | |
113 | } | |
114 | return rv + pad; | |
115 | } | |
bc91494e | 116 | |
13066cee | 117 | static DH_METHOD dh_ossl = { |
0f113f3e MC |
118 | "OpenSSL DH Method", |
119 | generate_key, | |
120 | compute_key, | |
121 | dh_bn_mod_exp, | |
122 | dh_init, | |
123 | dh_finish, | |
124 | DH_FLAG_FIPS_METHOD, | |
125 | NULL, | |
126 | NULL | |
13066cee DSH |
127 | }; |
128 | ||
076fc555 RS |
129 | static const DH_METHOD *default_DH_method = &dh_ossl; |
130 | ||
f971ccb2 | 131 | const DH_METHOD *DH_OpenSSL(void) |
13066cee | 132 | { |
0f113f3e | 133 | return &dh_ossl; |
13066cee DSH |
134 | } |
135 | ||
62f49b90 SL |
136 | const DH_METHOD *DH_get_default_method(void) |
137 | { | |
138 | return default_DH_method; | |
139 | } | |
140 | ||
141 | static int dh_bn_mod_exp(const DH *dh, BIGNUM *r, | |
142 | const BIGNUM *a, const BIGNUM *p, | |
143 | const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx) | |
144 | { | |
145 | return BN_mod_exp_mont(r, a, p, m, ctx, m_ctx); | |
146 | } | |
147 | ||
148 | static int dh_init(DH *dh) | |
149 | { | |
150 | dh->flags |= DH_FLAG_CACHE_MONT_P; | |
dc8de3e6 | 151 | ffc_params_init(&dh->params); |
f11f86f6 | 152 | dh->dirty_cnt++; |
62f49b90 SL |
153 | return 1; |
154 | } | |
155 | ||
156 | static int dh_finish(DH *dh) | |
157 | { | |
158 | BN_MONT_CTX_free(dh->method_mont_p); | |
159 | return 1; | |
160 | } | |
161 | ||
162 | #ifndef FIPS_MODE | |
076fc555 RS |
163 | void DH_set_default_method(const DH_METHOD *meth) |
164 | { | |
165 | default_DH_method = meth; | |
166 | } | |
8083fd3a | 167 | #endif /* FIPS_MODE */ |
076fc555 | 168 | |
62f49b90 | 169 | int DH_generate_key(DH *dh) |
076fc555 | 170 | { |
8083fd3a SL |
171 | #ifdef FIPS_MODE |
172 | return generate_key(dh); | |
173 | #else | |
62f49b90 | 174 | return dh->meth->generate_key(dh); |
8083fd3a | 175 | #endif |
076fc555 RS |
176 | } |
177 | ||
8083fd3a SL |
178 | int dh_generate_public_key(BN_CTX *ctx, DH *dh, const BIGNUM *priv_key, |
179 | BIGNUM *pub_key) | |
180 | { | |
181 | int ret = 0; | |
182 | BIGNUM *prk = BN_new(); | |
183 | BN_MONT_CTX *mont = NULL; | |
184 | ||
185 | if (prk == NULL) | |
186 | return 0; | |
187 | ||
188 | if (dh->flags & DH_FLAG_CACHE_MONT_P) { | |
189 | mont = BN_MONT_CTX_set_locked(&dh->method_mont_p, | |
190 | dh->lock, dh->params.p, ctx); | |
191 | if (mont == NULL) | |
192 | goto err; | |
193 | } | |
194 | BN_with_flags(prk, priv_key, BN_FLG_CONSTTIME); | |
195 | ||
196 | /* pub_key = g^priv_key mod p */ | |
197 | if (!dh->meth->bn_mod_exp(dh, pub_key, dh->params.g, prk, dh->params.p, | |
198 | ctx, mont)) | |
199 | goto err; | |
200 | ret = 1; | |
201 | err: | |
202 | BN_clear_free(prk); | |
203 | return ret; | |
204 | } | |
205 | ||
206 | static int generate_key(DH *dh) | |
0f113f3e MC |
207 | { |
208 | int ok = 0; | |
209 | int generate_new_key = 0; | |
f11f86f6 | 210 | #ifndef FIPS_MODE |
0f113f3e | 211 | unsigned l; |
f11f86f6 | 212 | #endif |
91f7361f | 213 | BN_CTX *ctx = NULL; |
0f113f3e | 214 | BIGNUM *pub_key = NULL, *priv_key = NULL; |
d02b48c6 | 215 | |
dc8de3e6 | 216 | if (BN_num_bits(dh->params.p) > OPENSSL_DH_MAX_MODULUS_BITS) { |
f11f86f6 | 217 | DHerr(0, DH_R_MODULUS_TOO_LARGE); |
91f7361f GV |
218 | return 0; |
219 | } | |
220 | ||
dc8de3e6 | 221 | if (BN_num_bits(dh->params.p) < DH_MIN_MODULUS_BITS) { |
f11f86f6 | 222 | DHerr(0, DH_R_MODULUS_TOO_SMALL); |
6de1fe90 BE |
223 | return 0; |
224 | } | |
225 | ||
8083fd3a | 226 | ctx = BN_CTX_new_ex(dh->libctx); |
0f113f3e MC |
227 | if (ctx == NULL) |
228 | goto err; | |
d02b48c6 | 229 | |
0f113f3e | 230 | if (dh->priv_key == NULL) { |
74924dcb | 231 | priv_key = BN_secure_new(); |
0f113f3e MC |
232 | if (priv_key == NULL) |
233 | goto err; | |
234 | generate_new_key = 1; | |
8083fd3a | 235 | } else { |
0f113f3e | 236 | priv_key = dh->priv_key; |
8083fd3a | 237 | } |
d02b48c6 | 238 | |
0f113f3e MC |
239 | if (dh->pub_key == NULL) { |
240 | pub_key = BN_new(); | |
241 | if (pub_key == NULL) | |
242 | goto err; | |
8083fd3a | 243 | } else { |
0f113f3e | 244 | pub_key = dh->pub_key; |
0f113f3e | 245 | } |
0f113f3e | 246 | if (generate_new_key) { |
f11f86f6 SL |
247 | /* Is it an approved safe prime ?*/ |
248 | if (DH_get_nid(dh) != NID_undef) { | |
a38c878c | 249 | /* |
f11f86f6 SL |
250 | * The safe prime group code sets N = 2*s |
251 | * (where s = max security strength supported). | |
252 | * N = dh->length (N = maximum bit length of private key) | |
a38c878c | 253 | */ |
f11f86f6 SL |
254 | if (dh->length == 0 |
255 | || dh->params.q == NULL | |
256 | || dh->length > BN_num_bits(dh->params.q)) | |
257 | goto err; | |
258 | if (!ffc_generate_private_key(ctx, &dh->params, dh->length, | |
259 | dh->length / 2, priv_key)) | |
260 | goto err; | |
261 | } else { | |
262 | #ifdef FIPS_MODE | |
263 | if (dh->params.q == NULL) | |
264 | goto err; | |
265 | #else | |
266 | if (dh->params.q == NULL) { | |
267 | /* secret exponent length */ | |
268 | l = dh->length ? dh->length : BN_num_bits(dh->params.p) - 1; | |
269 | if (!BN_priv_rand_ex(priv_key, l, BN_RAND_TOP_ONE, | |
270 | BN_RAND_BOTTOM_ANY, ctx)) | |
271 | goto err; | |
272 | /* | |
273 | * We handle just one known case where g is a quadratic non-residue: | |
274 | * for g = 2: p % 8 == 3 | |
275 | */ | |
276 | if (BN_is_word(dh->params.g, DH_GENERATOR_2) | |
277 | && !BN_is_bit_set(dh->params.p, 2)) { | |
278 | /* clear bit 0, since it won't be a secret anyway */ | |
279 | if (!BN_clear_bit(priv_key, 0)) | |
280 | goto err; | |
281 | } | |
282 | } else | |
283 | #endif | |
284 | { | |
285 | /* | |
286 | * For FFC FIPS 186-4 keygen | |
287 | * security strength s = 112, | |
288 | * Max Private key size N = len(q) | |
289 | */ | |
290 | if (!ffc_generate_private_key(ctx, &dh->params, | |
291 | BN_num_bits(dh->params.q), 112, | |
292 | priv_key)) | |
a38c878c BE |
293 | goto err; |
294 | } | |
0f113f3e MC |
295 | } |
296 | } | |
dfeab068 | 297 | |
8083fd3a SL |
298 | if (!dh_generate_public_key(ctx, dh, priv_key, pub_key)) |
299 | goto err; | |
46a64376 | 300 | |
0f113f3e MC |
301 | dh->pub_key = pub_key; |
302 | dh->priv_key = priv_key; | |
8b84b075 | 303 | dh->dirty_cnt++; |
0f113f3e MC |
304 | ok = 1; |
305 | err: | |
306 | if (ok != 1) | |
f11f86f6 | 307 | DHerr(0, ERR_R_BN_LIB); |
d02b48c6 | 308 | |
23a1d5e9 | 309 | if (pub_key != dh->pub_key) |
0f113f3e | 310 | BN_free(pub_key); |
23a1d5e9 | 311 | if (priv_key != dh->priv_key) |
0f113f3e MC |
312 | BN_free(priv_key); |
313 | BN_CTX_free(ctx); | |
26a7d938 | 314 | return ok; |
0f113f3e | 315 | } |
d02b48c6 | 316 | |
9aaecbfc | 317 | int dh_buf2key(DH *dh, const unsigned char *buf, size_t len) |
318 | { | |
319 | int err_reason = DH_R_BN_ERROR; | |
320 | BIGNUM *pubkey = NULL; | |
321 | const BIGNUM *p; | |
322 | size_t p_size; | |
323 | ||
324 | if ((pubkey = BN_bin2bn(buf, len, NULL)) == NULL) | |
325 | goto err; | |
326 | DH_get0_pqg(dh, &p, NULL, NULL); | |
327 | if (p == NULL || (p_size = BN_num_bytes(p)) == 0) { | |
328 | err_reason = DH_R_NO_PARAMETERS_SET; | |
329 | goto err; | |
330 | } | |
331 | /* | |
332 | * As per Section 4.2.8.1 of RFC 8446 fail if DHE's | |
333 | * public key is of size not equal to size of p | |
334 | */ | |
335 | if (BN_is_zero(pubkey) || p_size != len) { | |
336 | err_reason = DH_R_INVALID_PUBKEY; | |
337 | goto err; | |
338 | } | |
339 | if (DH_set0_key(dh, pubkey, NULL) != 1) | |
340 | goto err; | |
341 | return 1; | |
342 | err: | |
343 | DHerr(DH_F_DH_BUF2KEY, err_reason); | |
344 | BN_free(pubkey); | |
345 | return 0; | |
346 | } | |
347 | ||
348 | size_t dh_key2buf(const DH *dh, unsigned char **pbuf_out) | |
349 | { | |
350 | const BIGNUM *pubkey; | |
351 | unsigned char *pbuf; | |
352 | const BIGNUM *p; | |
353 | int p_size; | |
354 | ||
355 | DH_get0_pqg(dh, &p, NULL, NULL); | |
356 | DH_get0_key(dh, &pubkey, NULL); | |
357 | if (p == NULL || pubkey == NULL | |
358 | || (p_size = BN_num_bytes(p)) == 0 | |
359 | || BN_num_bytes(pubkey) == 0) { | |
360 | DHerr(DH_F_DH_KEY2BUF, DH_R_INVALID_PUBKEY); | |
361 | return 0; | |
362 | } | |
363 | if ((pbuf = OPENSSL_malloc(p_size)) == NULL) { | |
364 | DHerr(DH_F_DH_KEY2BUF, ERR_R_MALLOC_FAILURE); | |
365 | return 0; | |
366 | } | |
367 | /* | |
368 | * As per Section 4.2.8.1 of RFC 8446 left pad public | |
369 | * key with zeros to the size of p | |
370 | */ | |
371 | if (BN_bn2binpad(pubkey, pbuf, p_size) < 0) { | |
372 | OPENSSL_free(pbuf); | |
373 | DHerr(DH_F_DH_KEY2BUF, DH_R_BN_ERROR); | |
374 | return 0; | |
375 | } | |
376 | *pbuf_out = pbuf; | |
377 | return p_size; | |
378 | } |