providers/implementations/exchange/ecdh_exch.c

   1 /*
   2  * Copyright 2020 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 /*
  11  * ECDH low level APIs are deprecated for public use, but still ok for
  12  * internal use.
  13  */
  14 #include "internal/deprecated.h"
  15
  16 #include <string.h>
  17 #include <openssl/crypto.h>
  18 #include <openssl/evp.h>
  19 #include <openssl/core_dispatch.h>
  20 #include <openssl/core_names.h>
  21 #include <openssl/ec.h>
  22 #include <openssl/params.h>
  23 #include <openssl/err.h>
  24 #include "prov/provider_ctx.h"
  25 #include "prov/implementations.h"
  26 #include "crypto/ec.h" /* ecdh_KDF_X9_63() */
  27
  28 static OSSL_OP_keyexch_newctx_fn ecdh_newctx;
  29 static OSSL_OP_keyexch_init_fn ecdh_init;
  30 static OSSL_OP_keyexch_set_peer_fn ecdh_set_peer;
  31 static OSSL_OP_keyexch_derive_fn ecdh_derive;
  32 static OSSL_OP_keyexch_freectx_fn ecdh_freectx;
  33 static OSSL_OP_keyexch_dupctx_fn ecdh_dupctx;
  34 static OSSL_OP_keyexch_set_ctx_params_fn ecdh_set_ctx_params;
  35 static OSSL_OP_keyexch_settable_ctx_params_fn ecdh_settable_ctx_params;
  36 static OSSL_OP_keyexch_get_ctx_params_fn ecdh_get_ctx_params;
  37 static OSSL_OP_keyexch_gettable_ctx_params_fn ecdh_gettable_ctx_params;
  38
  39 enum kdf_type {
  40     PROV_ECDH_KDF_NONE = 0,
  41     PROV_ECDH_KDF_X9_63
  42 };
  43
  44 /*
  45  * What's passed as an actual key is defined by the KEYMGMT interface.
  46  * We happen to know that our KEYMGMT simply passes EC_KEY structures, so
  47  * we use that here too.
  48  */
  49
  50 typedef struct {
  51     OPENSSL_CTX *libctx;
  52
  53     EC_KEY *k;
  54     EC_KEY *peerk;
  55
  56     /*
  57      * ECDH cofactor mode:
  58      *
  59      *  . 0  disabled
  60      *  . 1  enabled
  61      *  . -1 use cofactor mode set for k
  62      */
  63     int cofactor_mode;
  64
  65     /************
  66      * ECDH KDF *
  67      ************/
  68     /* KDF (if any) to use for ECDH */
  69     enum kdf_type kdf_type;
  70     /* Message digest to use for key derivation */
  71     EVP_MD *kdf_md;
  72     /* User key material */
  73     unsigned char *kdf_ukm;
  74     size_t kdf_ukmlen;
  75     /* KDF output length */
  76     size_t kdf_outlen;
  77 } PROV_ECDH_CTX;
  78
  79 static
  80 void *ecdh_newctx(void *provctx)
  81 {
  82     PROV_ECDH_CTX *pectx = OPENSSL_zalloc(sizeof(*pectx));
  83
  84     if (pectx == NULL)
  85         return NULL;
  86
  87     pectx->libctx = PROV_LIBRARY_CONTEXT_OF(provctx);
  88     pectx->cofactor_mode = -1;
  89     pectx->kdf_type = PROV_ECDH_KDF_NONE;
  90
  91     return (void *)pectx;
  92 }
  93
  94 static
  95 int ecdh_init(void *vpecdhctx, void *vecdh)
  96 {
  97     PROV_ECDH_CTX *pecdhctx = (PROV_ECDH_CTX *)vpecdhctx;
  98
  99     if (pecdhctx == NULL || vecdh == NULL || !EC_KEY_up_ref(vecdh))
 100         return 0;
 101     EC_KEY_free(pecdhctx->k);
 102     pecdhctx->k = vecdh;
 103     pecdhctx->cofactor_mode = -1;
 104     pecdhctx->kdf_type = PROV_ECDH_KDF_NONE;
 105     return 1;
 106 }
 107
 108 static
 109 int ecdh_set_peer(void *vpecdhctx, void *vecdh)
 110 {
 111     PROV_ECDH_CTX *pecdhctx = (PROV_ECDH_CTX *)vpecdhctx;
 112
 113     if (pecdhctx == NULL || vecdh == NULL || !EC_KEY_up_ref(vecdh))
 114         return 0;
 115     EC_KEY_free(pecdhctx->peerk);
 116     pecdhctx->peerk = vecdh;
 117     return 1;
 118 }
 119
 120 static
 121 void ecdh_freectx(void *vpecdhctx)
 122 {
 123     PROV_ECDH_CTX *pecdhctx = (PROV_ECDH_CTX *)vpecdhctx;
 124
 125     EC_KEY_free(pecdhctx->k);
 126     EC_KEY_free(pecdhctx->peerk);
 127
 128     EVP_MD_free(pecdhctx->kdf_md);
 129     OPENSSL_clear_free(pecdhctx->kdf_ukm, pecdhctx->kdf_ukmlen);
 130
 131     OPENSSL_free(pecdhctx);
 132 }
 133
 134 static
 135 void *ecdh_dupctx(void *vpecdhctx)
 136 {
 137     PROV_ECDH_CTX *srcctx = (PROV_ECDH_CTX *)vpecdhctx;
 138     PROV_ECDH_CTX *dstctx;
 139
 140     dstctx = OPENSSL_zalloc(sizeof(*srcctx));
 141     if (dstctx == NULL)
 142         return NULL;
 143
 144     *dstctx = *srcctx;
 145
 146     /* clear all pointers */
 147
 148     dstctx->k= NULL;
 149     dstctx->peerk = NULL;
 150     dstctx->kdf_md = NULL;
 151     dstctx->kdf_ukm = NULL;
 152
 153     /* up-ref all ref-counted objects referenced in dstctx */
 154
 155     if (srcctx->k != NULL && !EC_KEY_up_ref(srcctx->k))
 156         goto err;
 157     else
 158         dstctx->k = srcctx->k;
 159
 160     if (srcctx->peerk != NULL && !EC_KEY_up_ref(srcctx->peerk))
 161         goto err;
 162     else
 163         dstctx->peerk = srcctx->peerk;
 164
 165     if (srcctx->kdf_md != NULL && !EVP_MD_up_ref(srcctx->kdf_md))
 166         goto err;
 167     else
 168         dstctx->kdf_md = srcctx->kdf_md;
 169
 170     /* Duplicate UKM data if present */
 171     if (srcctx->kdf_ukm != NULL && srcctx->kdf_ukmlen > 0) {
 172         dstctx->kdf_ukm = OPENSSL_memdup(srcctx->kdf_ukm,
 173                                          srcctx->kdf_ukmlen);
 174         if (dstctx->kdf_ukm == NULL)
 175             goto err;
 176     }
 177
 178     return dstctx;
 179
 180  err:
 181     ecdh_freectx(dstctx);
 182     return NULL;
 183 }
 184
 185 static
 186 int ecdh_set_ctx_params(void *vpecdhctx, const OSSL_PARAM params[])
 187 {
 188     char name[80] = { '\0' }; /* should be big enough */
 189     char *str = NULL;
 190     PROV_ECDH_CTX *pectx = (PROV_ECDH_CTX *)vpecdhctx;
 191     const OSSL_PARAM *p;
 192
 193     if (pectx == NULL || params == NULL)
 194         return 0;
 195
 196     p = OSSL_PARAM_locate_const(params, OSSL_EXCHANGE_PARAM_EC_ECDH_COFACTOR_MODE);
 197     if (p != NULL) {
 198         int mode;
 199
 200         if (!OSSL_PARAM_get_int(p, &mode))
 201             return 0;
 202
 203         if (mode < -1 || mode > 1)
 204             return 0;
 205
 206         pectx->cofactor_mode = mode;
 207     }
 208
 209     p = OSSL_PARAM_locate_const(params, OSSL_EXCHANGE_PARAM_KDF_TYPE);
 210     if (p != NULL) {
 211         str = name;
 212         if (!OSSL_PARAM_get_utf8_string(p, &str, sizeof(name)))
 213             return 0;
 214
 215         if (name[0] == '\0')
 216             pectx->kdf_type = PROV_ECDH_KDF_NONE;
 217         else if (strcmp(name, OSSL_KDF_NAME_X963KDF) == 0)
 218             pectx->kdf_type = PROV_ECDH_KDF_X9_63;
 219         else
 220             return 0;
 221     }
 222
 223     p = OSSL_PARAM_locate_const(params, OSSL_EXCHANGE_PARAM_KDF_DIGEST);
 224     if (p != NULL) {
 225         char mdprops[80] = { '\0' }; /* should be big enough */
 226
 227         str = name;
 228         if (!OSSL_PARAM_get_utf8_string(p, &str, sizeof(name)))
 229             return 0;
 230
 231         str = mdprops;
 232         p = OSSL_PARAM_locate_const(params,
 233                                     OSSL_EXCHANGE_PARAM_KDF_DIGEST_PROPS);
 234
 235         if (p != NULL) {
 236             if (!OSSL_PARAM_get_utf8_string(p, &str, sizeof(mdprops)))
 237                 return 0;
 238         }
 239
 240         EVP_MD_free(pectx->kdf_md);
 241         pectx->kdf_md = EVP_MD_fetch(pectx->libctx, name, mdprops);
 242
 243         if (pectx->kdf_md == NULL)
 244             return 0;
 245     }
 246
 247     p = OSSL_PARAM_locate_const(params, OSSL_EXCHANGE_PARAM_KDF_OUTLEN);
 248     if (p != NULL) {
 249         size_t outlen;
 250
 251         if (!OSSL_PARAM_get_size_t(p, &outlen))
 252             return 0;
 253         pectx->kdf_outlen = outlen;
 254     }
 255
 256     p = OSSL_PARAM_locate_const(params, OSSL_EXCHANGE_PARAM_KDF_UKM);
 257     if (p != NULL) {
 258         void *tmp_ukm = NULL;
 259         size_t tmp_ukmlen;
 260
 261         if (!OSSL_PARAM_get_octet_string(p, &tmp_ukm, 0, &tmp_ukmlen))
 262             return 0;
 263         OPENSSL_free(pectx->kdf_ukm);
 264         pectx->kdf_ukm = tmp_ukm;
 265         pectx->kdf_ukmlen = tmp_ukmlen;
 266     }
 267
 268     return 1;
 269 }
 270
 271 static const OSSL_PARAM known_settable_ctx_params[] = {
 272     OSSL_PARAM_int(OSSL_EXCHANGE_PARAM_EC_ECDH_COFACTOR_MODE, NULL),
 273     OSSL_PARAM_utf8_string(OSSL_EXCHANGE_PARAM_KDF_TYPE, NULL, 0),
 274     OSSL_PARAM_utf8_string(OSSL_EXCHANGE_PARAM_KDF_DIGEST, NULL, 0),
 275     OSSL_PARAM_utf8_string(OSSL_EXCHANGE_PARAM_KDF_DIGEST_PROPS, NULL, 0),
 276     OSSL_PARAM_size_t(OSSL_EXCHANGE_PARAM_KDF_OUTLEN, NULL),
 277     OSSL_PARAM_octet_string(OSSL_EXCHANGE_PARAM_KDF_UKM, NULL, 0),
 278     OSSL_PARAM_END
 279 };
 280
 281 static
 282 const OSSL_PARAM *ecdh_settable_ctx_params(void)
 283 {
 284     return known_settable_ctx_params;
 285 }
 286
 287 static
 288 int ecdh_get_ctx_params(void *vpecdhctx, OSSL_PARAM params[])
 289 {
 290     PROV_ECDH_CTX *pectx = (PROV_ECDH_CTX *)vpecdhctx;
 291     OSSL_PARAM *p;
 292
 293     if (pectx == NULL || params == NULL)
 294         return 0;
 295
 296     p = OSSL_PARAM_locate(params, OSSL_EXCHANGE_PARAM_EC_ECDH_COFACTOR_MODE);
 297     if (p != NULL) {
 298         int mode = pectx->cofactor_mode;
 299
 300         if (mode == -1) {
 301             /* check what is the default for pecdhctx->k */
 302             mode = EC_KEY_get_flags(pectx->k) & EC_FLAG_COFACTOR_ECDH ? 1 : 0;
 303         }
 304
 305         if (!OSSL_PARAM_set_int(p, mode))
 306             return 0;
 307     }
 308
 309     p = OSSL_PARAM_locate(params, OSSL_EXCHANGE_PARAM_KDF_TYPE);
 310     if (p != NULL) {
 311         const char *kdf_type = NULL;
 312
 313         switch (pectx->kdf_type) {
 314             case PROV_ECDH_KDF_NONE:
 315                 kdf_type = "";
 316                 break;
 317             case PROV_ECDH_KDF_X9_63:
 318                 kdf_type = OSSL_KDF_NAME_X963KDF;
 319                 break;
 320             default:
 321                 return 0;
 322         }
 323
 324         if (!OSSL_PARAM_set_utf8_string(p, kdf_type))
 325             return 0;
 326     }
 327
 328     p = OSSL_PARAM_locate(params, OSSL_EXCHANGE_PARAM_KDF_DIGEST);
 329     if (p != NULL
 330             && !OSSL_PARAM_set_utf8_string(p, pectx->kdf_md == NULL
 331                                            ? ""
 332                                            : EVP_MD_name(pectx->kdf_md))){
 333         return 0;
 334     }
 335
 336     p = OSSL_PARAM_locate(params, OSSL_EXCHANGE_PARAM_KDF_OUTLEN);
 337     if (p != NULL && !OSSL_PARAM_set_size_t(p, pectx->kdf_outlen))
 338         return 0;
 339
 340     p = OSSL_PARAM_locate(params, OSSL_EXCHANGE_PARAM_KDF_UKM);
 341     if (p != NULL && !OSSL_PARAM_set_octet_ptr(p, pectx->kdf_ukm, 0))
 342         return 0;
 343
 344     p = OSSL_PARAM_locate(params, OSSL_EXCHANGE_PARAM_KDF_UKM_LEN);
 345     if (p != NULL && !OSSL_PARAM_set_size_t(p, pectx->kdf_ukmlen))
 346         return 0;
 347
 348     return 1;
 349 }
 350
 351 static const OSSL_PARAM known_gettable_ctx_params[] = {
 352     OSSL_PARAM_int(OSSL_EXCHANGE_PARAM_EC_ECDH_COFACTOR_MODE, NULL),
 353     OSSL_PARAM_utf8_string(OSSL_EXCHANGE_PARAM_KDF_TYPE, NULL, 0),
 354     OSSL_PARAM_utf8_string(OSSL_EXCHANGE_PARAM_KDF_DIGEST, NULL, 0),
 355     OSSL_PARAM_size_t(OSSL_EXCHANGE_PARAM_KDF_OUTLEN, NULL),
 356     OSSL_PARAM_DEFN(OSSL_EXCHANGE_PARAM_KDF_UKM, OSSL_PARAM_OCTET_PTR,
 357                     NULL, 0),
 358     OSSL_PARAM_size_t(OSSL_EXCHANGE_PARAM_KDF_UKM_LEN, NULL),
 359     OSSL_PARAM_END
 360 };
 361
 362 static
 363 const OSSL_PARAM *ecdh_gettable_ctx_params(void)
 364 {
 365     return known_gettable_ctx_params;
 366 }
 367
 368 static ossl_inline
 369 size_t ecdh_size(const EC_KEY *k)
 370 {
 371     size_t degree = 0;
 372     const EC_GROUP *group;
 373
 374     if (k == NULL
 375             || (group = EC_KEY_get0_group(k)) == NULL)
 376         return 0;
 377
 378     degree = EC_GROUP_get_degree(group);
 379
 380     return (degree + 7) / 8;
 381 }
 382
 383 static ossl_inline
 384 int ecdh_plain_derive(void *vpecdhctx, unsigned char *secret,
 385                       size_t *psecretlen, size_t outlen)
 386 {
 387     PROV_ECDH_CTX *pecdhctx = (PROV_ECDH_CTX *)vpecdhctx;
 388     int retlen, ret = 0;
 389     size_t ecdhsize, size;
 390     const EC_POINT *ppubkey = NULL;
 391     EC_KEY *privk = NULL;
 392     const EC_GROUP *group;
 393     const BIGNUM *cofactor;
 394     int key_cofactor_mode;
 395
 396     if (pecdhctx->k == NULL || pecdhctx->peerk == NULL) {
 397         ERR_raise(ERR_LIB_PROV, EC_R_KEYS_NOT_SET);
 398         return 0;
 399     }
 400
 401     ecdhsize = ecdh_size(pecdhctx->k);
 402     if (secret == NULL) {
 403         *psecretlen = ecdhsize;
 404         return 1;
 405     }
 406
 407     if ((group = EC_KEY_get0_group(pecdhctx->k)) == NULL
 408             || (cofactor = EC_GROUP_get0_cofactor(group)) == NULL )
 409         return 0;
 410
 411     /*
 412      * NB: unlike PKCS#3 DH, if outlen is less than maximum size this is not
 413      * an error, the result is truncated.
 414      */
 415     size = outlen < ecdhsize ? outlen : ecdhsize;
 416
 417     /*
 418      * The ctx->cofactor_mode flag has precedence over the
 419      * cofactor_mode flag set on ctx->k.
 420      *
 421      * - if ctx->cofactor_mode == -1, use ctx->k directly
 422      * - if ctx->cofactor_mode == key_cofactor_mode, use ctx->k directly
 423      * - if ctx->cofactor_mode != key_cofactor_mode:
 424      *     - if ctx->k->cofactor == 1, the cofactor_mode flag is irrelevant, use
 425      *          ctx->k directly
 426      *     - if ctx->k->cofactor != 1, use a duplicate of ctx->k with the flag
 427      *          set to ctx->cofactor_mode
 428      */
 429     key_cofactor_mode =
 430         (EC_KEY_get_flags(pecdhctx->k) & EC_FLAG_COFACTOR_ECDH) ? 1 : 0;
 431     if (pecdhctx->cofactor_mode != -1
 432             && pecdhctx->cofactor_mode != key_cofactor_mode
 433             && !BN_is_one(cofactor)) {
 434         if ((privk = EC_KEY_dup(pecdhctx->k)) == NULL)
 435             return 0;
 436
 437         if (pecdhctx->cofactor_mode == 1)
 438             EC_KEY_set_flags(privk, EC_FLAG_COFACTOR_ECDH);
 439         else
 440             EC_KEY_clear_flags(privk, EC_FLAG_COFACTOR_ECDH);
 441     } else {
 442         privk = pecdhctx->k;
 443     }
 444
 445     ppubkey = EC_KEY_get0_public_key(pecdhctx->peerk);
 446
 447     retlen = ECDH_compute_key(secret, size, ppubkey, privk, NULL);
 448
 449     if (retlen <= 0)
 450         goto end;
 451
 452     *psecretlen = retlen;
 453     ret = 1;
 454
 455  end:
 456     if (privk != pecdhctx->k)
 457         EC_KEY_free(privk);
 458     return ret;
 459 }
 460
 461 #ifndef FIPS_MODULE
 462 static ossl_inline
 463 int ecdh_X9_63_kdf_derive(void *vpecdhctx, unsigned char *secret,
 464                           size_t *psecretlen, size_t outlen)
 465 {
 466     PROV_ECDH_CTX *pecdhctx = (PROV_ECDH_CTX *)vpecdhctx;
 467     unsigned char *stmp = NULL;
 468     size_t stmplen;
 469     int ret = 0;
 470
 471     if (secret == NULL) {
 472         *psecretlen = pecdhctx->kdf_outlen;
 473         return 1;
 474     }
 475
 476     if (pecdhctx->kdf_outlen > outlen)
 477         return 0;
 478     if (!ecdh_plain_derive(vpecdhctx, NULL, &stmplen, 0))
 479         return 0;
 480     if ((stmp = OPENSSL_secure_malloc(stmplen)) == NULL) {
 481         ERR_raise(ERR_LIB_PROV, ERR_R_MALLOC_FAILURE);
 482         return 0;
 483     }
 484     if (!ecdh_plain_derive(vpecdhctx, stmp, &stmplen, stmplen))
 485         goto err;
 486
 487     /* Do KDF stuff */
 488     if (!ecdh_KDF_X9_63(secret, pecdhctx->kdf_outlen,
 489                         stmp, stmplen,
 490                         pecdhctx->kdf_ukm,
 491                         pecdhctx->kdf_ukmlen,
 492                         pecdhctx->kdf_md))
 493         goto err;
 494     *psecretlen = pecdhctx->kdf_outlen;
 495     ret = 1;
 496
 497  err:
 498     OPENSSL_secure_clear_free(stmp, stmplen);
 499     return ret;
 500 }
 501 #endif /* FIPS_MODULE */
 502
 503 static
 504 int ecdh_derive(void *vpecdhctx, unsigned char *secret,
 505                 size_t *psecretlen, size_t outlen)
 506 {
 507     PROV_ECDH_CTX *pecdhctx = (PROV_ECDH_CTX *)vpecdhctx;
 508
 509     switch (pecdhctx->kdf_type) {
 510         case PROV_ECDH_KDF_NONE:
 511             return ecdh_plain_derive(vpecdhctx, secret, psecretlen, outlen);
 512 #ifndef FIPS_MODULE
 513         case PROV_ECDH_KDF_X9_63:
 514             return ecdh_X9_63_kdf_derive(vpecdhctx, secret, psecretlen, outlen);
 515
 516 #endif /* FIPS_MODULE */
 517         default:
 518             break;
 519     }
 520
 521     return 0;
 522 }
 523
 524
 525
 526 const OSSL_DISPATCH ecdh_keyexch_functions[] = {
 527     { OSSL_FUNC_KEYEXCH_NEWCTX, (void (*)(void))ecdh_newctx },
 528     { OSSL_FUNC_KEYEXCH_INIT, (void (*)(void))ecdh_init },
 529     { OSSL_FUNC_KEYEXCH_DERIVE, (void (*)(void))ecdh_derive },
 530     { OSSL_FUNC_KEYEXCH_SET_PEER, (void (*)(void))ecdh_set_peer },
 531     { OSSL_FUNC_KEYEXCH_FREECTX, (void (*)(void))ecdh_freectx },
 532     { OSSL_FUNC_KEYEXCH_DUPCTX, (void (*)(void))ecdh_dupctx },
 533     { OSSL_FUNC_KEYEXCH_SET_CTX_PARAMS, (void (*)(void))ecdh_set_ctx_params },
 534     { OSSL_FUNC_KEYEXCH_SETTABLE_CTX_PARAMS,
 535       (void (*)(void))ecdh_settable_ctx_params },
 536     { OSSL_FUNC_KEYEXCH_GET_CTX_PARAMS, (void (*)(void))ecdh_get_ctx_params },
 537     { OSSL_FUNC_KEYEXCH_GETTABLE_CTX_PARAMS,
 538       (void (*)(void))ecdh_gettable_ctx_params },
 539     { 0, NULL }
 540 };