]>
git.ipfire.org Git - thirdparty/openssl.git/blob - crypto/srp/srp_lib.c
7a47acd039a3ab037e3be4a03b8b8a5c870bfa5e
1 /* crypto/srp/srp_lib.c */
3 * Written by Christophe Renou (christophe.renou@edelweb.fr) with the
4 * precious help of Peter Sylvester (peter.sylvester@edelweb.fr) for the
5 * EdelKey project and contributed to the OpenSSL project 2004.
7 /* ====================================================================
8 * Copyright (c) 2004 The OpenSSL Project. All rights reserved.
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
14 * 1. Redistributions of source code must retain the above copyright
15 * notice, this list of conditions and the following disclaimer.
17 * 2. Redistributions in binary form must reproduce the above copyright
18 * notice, this list of conditions and the following disclaimer in
19 * the documentation and/or other materials provided with the
22 * 3. All advertising materials mentioning features or use of this
23 * software must display the following acknowledgment:
24 * "This product includes software developed by the OpenSSL Project
25 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
27 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
28 * endorse or promote products derived from this software without
29 * prior written permission. For written permission, please contact
30 * licensing@OpenSSL.org.
32 * 5. Products derived from this software may not be called "OpenSSL"
33 * nor may "OpenSSL" appear in their names without prior written
34 * permission of the OpenSSL Project.
36 * 6. Redistributions of any form whatsoever must retain the following
38 * "This product includes software developed by the OpenSSL Project
39 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
41 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
42 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
44 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
45 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
46 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
47 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
48 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
49 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
50 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
51 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
52 * OF THE POSSIBILITY OF SUCH DAMAGE.
53 * ====================================================================
55 * This product includes cryptographic software written by Eric Young
56 * (eay@cryptsoft.com). This product includes software written by Tim
57 * Hudson (tjh@cryptsoft.com).
60 #ifndef OPENSSL_NO_SRP
61 # include "cryptlib.h"
62 # include <openssl/sha.h>
63 # include <openssl/srp.h>
64 # include <openssl/evp.h>
65 # include "internal/bn_srp.h"
67 static BIGNUM
*srp_Calc_k(BIGNUM
*N
, BIGNUM
*g
)
69 /* k = SHA1(N | PAD(g)) -- tls-srp draft 8 */
71 unsigned char digest
[SHA_DIGEST_LENGTH
];
75 int longN
= BN_num_bytes(N
);
77 if (BN_ucmp(g
, N
) >= 0)
80 if ((tmp
= OPENSSL_malloc(longN
)) == NULL
)
84 EVP_MD_CTX_init(&ctxt
);
85 EVP_DigestInit_ex(&ctxt
, EVP_sha1(), NULL
);
86 EVP_DigestUpdate(&ctxt
, tmp
, longN
);
88 memset(tmp
, 0, longN
);
89 longg
= BN_bn2bin(g
, tmp
);
90 /* use the zeros behind to pad on left */
91 EVP_DigestUpdate(&ctxt
, tmp
+ longg
, longN
- longg
);
92 EVP_DigestUpdate(&ctxt
, tmp
, longg
);
95 EVP_DigestFinal_ex(&ctxt
, digest
, NULL
);
96 EVP_MD_CTX_cleanup(&ctxt
);
97 return BN_bin2bn(digest
, sizeof(digest
), NULL
);
100 BIGNUM
*SRP_Calc_u(BIGNUM
*A
, BIGNUM
*B
, BIGNUM
*N
)
102 /* k = SHA1(PAD(A) || PAD(B) ) -- tls-srp draft 8 */
105 unsigned char cu
[SHA_DIGEST_LENGTH
];
109 if ((A
== NULL
) || (B
== NULL
) || (N
== NULL
))
112 if (BN_ucmp(A
, N
) >= 0 || BN_ucmp(B
, N
) >= 0)
115 longN
= BN_num_bytes(N
);
117 if ((cAB
= OPENSSL_malloc(2 * longN
)) == NULL
)
120 memset(cAB
, 0, longN
);
122 EVP_MD_CTX_init(&ctxt
);
123 EVP_DigestInit_ex(&ctxt
, EVP_sha1(), NULL
);
124 EVP_DigestUpdate(&ctxt
, cAB
+ BN_bn2bin(A
, cAB
+ longN
), longN
);
125 EVP_DigestUpdate(&ctxt
, cAB
+ BN_bn2bin(B
, cAB
+ longN
), longN
);
127 EVP_DigestFinal_ex(&ctxt
, cu
, NULL
);
128 EVP_MD_CTX_cleanup(&ctxt
);
130 if (!(u
= BN_bin2bn(cu
, sizeof(cu
), NULL
)))
138 BIGNUM
*SRP_Calc_server_key(BIGNUM
*A
, BIGNUM
*v
, BIGNUM
*u
, BIGNUM
*b
,
141 BIGNUM
*tmp
= NULL
, *S
= NULL
;
144 if (u
== NULL
|| A
== NULL
|| v
== NULL
|| b
== NULL
|| N
== NULL
)
147 if ((bn_ctx
= BN_CTX_new()) == NULL
||
148 (tmp
= BN_new()) == NULL
|| (S
= BN_new()) == NULL
)
151 /* S = (A*v**u) ** b */
153 if (!BN_mod_exp(tmp
, v
, u
, N
, bn_ctx
))
155 if (!BN_mod_mul(tmp
, A
, tmp
, N
, bn_ctx
))
157 if (!BN_mod_exp(S
, tmp
, b
, N
, bn_ctx
))
165 BIGNUM
*SRP_Calc_B(BIGNUM
*b
, BIGNUM
*N
, BIGNUM
*g
, BIGNUM
*v
)
167 BIGNUM
*kv
= NULL
, *gb
= NULL
;
168 BIGNUM
*B
= NULL
, *k
= NULL
;
171 if (b
== NULL
|| N
== NULL
|| g
== NULL
|| v
== NULL
||
172 (bn_ctx
= BN_CTX_new()) == NULL
)
175 if ((kv
= BN_new()) == NULL
||
176 (gb
= BN_new()) == NULL
|| (B
= BN_new()) == NULL
)
181 if (!BN_mod_exp(gb
, g
, b
, N
, bn_ctx
) ||
182 !(k
= srp_Calc_k(N
, g
)) ||
183 !BN_mod_mul(kv
, v
, k
, N
, bn_ctx
) ||
184 !BN_mod_add(B
, gb
, kv
, N
, bn_ctx
)) {
196 BIGNUM
*SRP_Calc_x(BIGNUM
*s
, const char *user
, const char *pass
)
198 unsigned char dig
[SHA_DIGEST_LENGTH
];
202 if ((s
== NULL
) || (user
== NULL
) || (pass
== NULL
))
205 if ((cs
= OPENSSL_malloc(BN_num_bytes(s
))) == NULL
)
208 EVP_MD_CTX_init(&ctxt
);
209 EVP_DigestInit_ex(&ctxt
, EVP_sha1(), NULL
);
210 EVP_DigestUpdate(&ctxt
, user
, strlen(user
));
211 EVP_DigestUpdate(&ctxt
, ":", 1);
212 EVP_DigestUpdate(&ctxt
, pass
, strlen(pass
));
213 EVP_DigestFinal_ex(&ctxt
, dig
, NULL
);
215 EVP_DigestInit_ex(&ctxt
, EVP_sha1(), NULL
);
217 EVP_DigestUpdate(&ctxt
, cs
, BN_num_bytes(s
));
219 EVP_DigestUpdate(&ctxt
, dig
, sizeof(dig
));
220 EVP_DigestFinal_ex(&ctxt
, dig
, NULL
);
221 EVP_MD_CTX_cleanup(&ctxt
);
223 return BN_bin2bn(dig
, sizeof(dig
), NULL
);
226 BIGNUM
*SRP_Calc_A(BIGNUM
*a
, BIGNUM
*N
, BIGNUM
*g
)
231 if (a
== NULL
|| N
== NULL
|| g
== NULL
|| (bn_ctx
= BN_CTX_new()) == NULL
)
234 if ((A
= BN_new()) != NULL
&& !BN_mod_exp(A
, g
, a
, N
, bn_ctx
)) {
242 BIGNUM
*SRP_Calc_client_key(BIGNUM
*N
, BIGNUM
*B
, BIGNUM
*g
, BIGNUM
*x
,
243 BIGNUM
*a
, BIGNUM
*u
)
245 BIGNUM
*tmp
= NULL
, *tmp2
= NULL
, *tmp3
= NULL
, *k
= NULL
, *K
= NULL
;
248 if (u
== NULL
|| B
== NULL
|| N
== NULL
|| g
== NULL
|| x
== NULL
249 || a
== NULL
|| (bn_ctx
= BN_CTX_new()) == NULL
)
252 if ((tmp
= BN_new()) == NULL
||
253 (tmp2
= BN_new()) == NULL
||
254 (tmp3
= BN_new()) == NULL
||
255 (K
= BN_new()) == NULL
)
258 if (!BN_mod_exp(tmp
, g
, x
, N
, bn_ctx
))
260 if (!(k
= srp_Calc_k(N
, g
)))
262 if (!BN_mod_mul(tmp2
, tmp
, k
, N
, bn_ctx
))
264 if (!BN_mod_sub(tmp
, B
, tmp2
, N
, bn_ctx
))
267 if (!BN_mod_mul(tmp3
, u
, x
, N
, bn_ctx
))
269 if (!BN_mod_add(tmp2
, a
, tmp3
, N
, bn_ctx
))
271 if (!BN_mod_exp(K
, tmp
, tmp2
, N
, bn_ctx
))
283 int SRP_Verify_B_mod_N(BIGNUM
*B
, BIGNUM
*N
)
289 if (B
== NULL
|| N
== NULL
|| (bn_ctx
= BN_CTX_new()) == NULL
)
292 if ((r
= BN_new()) == NULL
)
294 /* Checks if B % N == 0 */
295 if (!BN_nnmod(r
, B
, N
, bn_ctx
))
297 ret
= !BN_is_zero(r
);
304 int SRP_Verify_A_mod_N(BIGNUM
*A
, BIGNUM
*N
)
306 /* Checks if A % N == 0 */
307 return SRP_Verify_B_mod_N(A
, N
);
311 * Check if G and N are kwown parameters. The values have been generated
312 * from the ietf-tls-srp draft version 8
314 char *SRP_check_known_gN_param(BIGNUM
*g
, BIGNUM
*N
)
317 if ((g
== NULL
) || (N
== NULL
))
320 for (i
= 0; i
< KNOWN_GN_NUMBER
; i
++) {
321 if (BN_cmp(knowngN
[i
].g
, g
) == 0 && BN_cmp(knowngN
[i
].N
, N
) == 0)
322 return knowngN
[i
].id
;
327 SRP_gN
*SRP_get_default_gN(const char *id
)
333 for (i
= 0; i
< KNOWN_GN_NUMBER
; i
++) {
334 if (strcmp(knowngN
[i
].id
, id
) == 0)