[thirdparty/openssl.git] / crypto / dh / dh_check.c

/*
 * Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

#include <stdio.h>
#include "internal/cryptlib.h"
#include <openssl/bn.h>
#include "dh_local.h"

/*-
 * Check that p and g are suitable enough
 *
 * p is odd
 * 1 < g < p - 1
 */
int DH_check_params_ex(const DH *dh)
{
    int errflags = 0;

    if (!DH_check_params(dh, &errflags))
        return 0;

    if ((errflags & DH_CHECK_P_NOT_PRIME) != 0)
        DHerr(DH_F_DH_CHECK_PARAMS_EX, DH_R_CHECK_P_NOT_PRIME);
    if ((errflags & DH_NOT_SUITABLE_GENERATOR) != 0)
        DHerr(DH_F_DH_CHECK_PARAMS_EX, DH_R_NOT_SUITABLE_GENERATOR);
    if ((errflags & DH_MODULUS_TOO_SMALL) != 0)
        DHerr(DH_F_DH_CHECK_PARAMS_EX, DH_R_MODULUS_TOO_SMALL);
    if ((errflags & DH_MODULUS_TOO_LARGE) != 0)
        DHerr(DH_F_DH_CHECK_PARAMS_EX, DH_R_MODULUS_TOO_LARGE);

    return errflags == 0;
}

int DH_check_params(const DH *dh, int *ret)
{
    int ok = 0;
    BIGNUM *tmp = NULL;
    BN_CTX *ctx = NULL;

    *ret = 0;
    ctx = BN_CTX_new();
    if (ctx == NULL)
        goto err;
    BN_CTX_start(ctx);
    tmp = BN_CTX_get(ctx);
    if (tmp == NULL)
        goto err;

    if (!BN_is_odd(dh->p))
        *ret |= DH_CHECK_P_NOT_PRIME;
    if (BN_is_negative(dh->g) || BN_is_zero(dh->g) || BN_is_one(dh->g))
        *ret |= DH_NOT_SUITABLE_GENERATOR;
    if (BN_copy(tmp, dh->p) == NULL || !BN_sub_word(tmp, 1))
        goto err;
    if (BN_cmp(dh->g, tmp) >= 0)
        *ret |= DH_NOT_SUITABLE_GENERATOR;
    if (BN_num_bits(dh->p) < DH_MIN_MODULUS_BITS)
        *ret |= DH_MODULUS_TOO_SMALL;
    if (BN_num_bits(dh->p) > OPENSSL_DH_MAX_MODULUS_BITS)
        *ret |= DH_MODULUS_TOO_LARGE;

    ok = 1;
 err:
    BN_CTX_end(ctx);
    BN_CTX_free(ctx);
    return ok;
}

/*-
 * Check that p is a safe prime and
 * g is a suitable generator.
 */
int DH_check_ex(const DH *dh)
{
    int errflags = 0;

    if (!DH_check(dh, &errflags))
        return 0;

    if ((errflags & DH_NOT_SUITABLE_GENERATOR) != 0)
        DHerr(DH_F_DH_CHECK_EX, DH_R_NOT_SUITABLE_GENERATOR);
    if ((errflags & DH_CHECK_Q_NOT_PRIME) != 0)
        DHerr(DH_F_DH_CHECK_EX, DH_R_CHECK_Q_NOT_PRIME);
    if ((errflags & DH_CHECK_INVALID_Q_VALUE) != 0)
        DHerr(DH_F_DH_CHECK_EX, DH_R_CHECK_INVALID_Q_VALUE);
    if ((errflags & DH_CHECK_INVALID_J_VALUE) != 0)
        DHerr(DH_F_DH_CHECK_EX, DH_R_CHECK_INVALID_J_VALUE);
    if ((errflags & DH_UNABLE_TO_CHECK_GENERATOR) != 0)
        DHerr(DH_F_DH_CHECK_EX, DH_R_UNABLE_TO_CHECK_GENERATOR);
    if ((errflags & DH_CHECK_P_NOT_PRIME) != 0)
        DHerr(DH_F_DH_CHECK_EX, DH_R_CHECK_P_NOT_PRIME);
    if ((errflags & DH_CHECK_P_NOT_SAFE_PRIME) != 0)
        DHerr(DH_F_DH_CHECK_EX, DH_R_CHECK_P_NOT_SAFE_PRIME);
    if ((errflags & DH_MODULUS_TOO_SMALL) != 0)
        DHerr(DH_F_DH_CHECK_EX, DH_R_MODULUS_TOO_SMALL);
    if ((errflags & DH_MODULUS_TOO_LARGE) != 0)
        DHerr(DH_F_DH_CHECK_EX, DH_R_MODULUS_TOO_LARGE);

    return errflags == 0;
}

int DH_check(const DH *dh, int *ret)
{
    int ok = 0, r;
    BN_CTX *ctx = NULL;
    BIGNUM *t1 = NULL, *t2 = NULL;

    if (!DH_check_params(dh, ret))
        return 0;

    ctx = BN_CTX_new();
    if (ctx == NULL)
        goto err;
    BN_CTX_start(ctx);
    t1 = BN_CTX_get(ctx);
    t2 = BN_CTX_get(ctx);
    if (t2 == NULL)
        goto err;

    if (dh->q) {
        if (BN_cmp(dh->g, BN_value_one()) <= 0)
            *ret |= DH_NOT_SUITABLE_GENERATOR;
        else if (BN_cmp(dh->g, dh->p) >= 0)
            *ret |= DH_NOT_SUITABLE_GENERATOR;
        else {
            /* Check g^q == 1 mod p */
            if (!BN_mod_exp(t1, dh->g, dh->q, dh->p, ctx))
                goto err;
            if (!BN_is_one(t1))
                *ret |= DH_NOT_SUITABLE_GENERATOR;
        }
        r = BN_check_prime(dh->q, ctx, NULL);
        if (r < 0)
            goto err;
        if (!r)
            *ret |= DH_CHECK_Q_NOT_PRIME;
        /* Check p == 1 mod q  i.e. q divides p - 1 */
        if (!BN_div(t1, t2, dh->p, dh->q, ctx))
            goto err;
        if (!BN_is_one(t2))
            *ret |= DH_CHECK_INVALID_Q_VALUE;
        if (dh->j && BN_cmp(dh->j, t1))
            *ret |= DH_CHECK_INVALID_J_VALUE;
    }

    r = BN_check_prime(dh->p, ctx, NULL);
    if (r < 0)
        goto err;
    if (!r)
        *ret |= DH_CHECK_P_NOT_PRIME;
    else if (!dh->q) {
        if (!BN_rshift1(t1, dh->p))
            goto err;
        r = BN_check_prime(t1, ctx, NULL);
        if (r < 0)
            goto err;
        if (!r)
            *ret |= DH_CHECK_P_NOT_SAFE_PRIME;
    }
    ok = 1;
 err:
    BN_CTX_end(ctx);
    BN_CTX_free(ctx);
    return ok;
}

int DH_check_pub_key_ex(const DH *dh, const BIGNUM *pub_key)
{
    int errflags = 0;

    if (!DH_check_pub_key(dh, pub_key, &errflags))
        return 0;

    if ((errflags & DH_CHECK_PUBKEY_TOO_SMALL) != 0)
        DHerr(DH_F_DH_CHECK_PUB_KEY_EX, DH_R_CHECK_PUBKEY_TOO_SMALL);
    if ((errflags & DH_CHECK_PUBKEY_TOO_LARGE) != 0)
        DHerr(DH_F_DH_CHECK_PUB_KEY_EX, DH_R_CHECK_PUBKEY_TOO_LARGE);
    if ((errflags & DH_CHECK_PUBKEY_INVALID) != 0)
        DHerr(DH_F_DH_CHECK_PUB_KEY_EX, DH_R_CHECK_PUBKEY_INVALID);

    return errflags == 0;
}

int DH_check_pub_key(const DH *dh, const BIGNUM *pub_key, int *ret)
{
    int ok = 0;
    BIGNUM *tmp = NULL;
    BN_CTX *ctx = NULL;

    *ret = 0;
    ctx = BN_CTX_new();
    if (ctx == NULL)
        goto err;
    BN_CTX_start(ctx);
    tmp = BN_CTX_get(ctx);
    if (tmp == NULL || !BN_set_word(tmp, 1))
        goto err;
    if (BN_cmp(pub_key, tmp) <= 0)
        *ret |= DH_CHECK_PUBKEY_TOO_SMALL;
    if (BN_copy(tmp, dh->p) == NULL || !BN_sub_word(tmp, 1))
        goto err;
    if (BN_cmp(pub_key, tmp) >= 0)
        *ret |= DH_CHECK_PUBKEY_TOO_LARGE;

    if (dh->q != NULL) {
        /* Check pub_key^q == 1 mod p */
        if (!BN_mod_exp(tmp, pub_key, dh->q, dh->p, ctx))
            goto err;
        if (!BN_is_one(tmp))
            *ret |= DH_CHECK_PUBKEY_INVALID;
    }

    ok = 1;
 err:
    BN_CTX_end(ctx);
    BN_CTX_free(ctx);
    return ok;
}
Commit	Line	Data
aa6bb135	1	/*
a38c878c	2	* Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved.
d02b48c6	3	*
e38873f5	4	* Licensed under the Apache License 2.0 (the "License"). You may not use
aa6bb135 RS	5	* this file except in compliance with the License. You can obtain a copy
	6	* in the file LICENSE in the source distribution or at
	7	* https://www.openssl.org/source/license.html
d02b48c6 RE	8	*/
	9
	10	#include <stdio.h>
b39fc560	11	#include "internal/cryptlib.h"
ec577822	12	#include <openssl/bn.h>
706457b7	13	#include "dh_local.h"
d02b48c6	14
26505153 RL	15	/*-
	16	* Check that p and g are suitable enough
	17	*
	18	* p is odd
	19	* 1 < g < p - 1
	20	*/
b0004708 PY	21	int DH_check_params_ex(const DH *dh)
	22	{
	23	int errflags = 0;
	24
a38c878c BE	25	if (!DH_check_params(dh, &errflags))
a38c878c BE	26	return 0;
b0004708 PY	27
	28	if ((errflags & DH_CHECK_P_NOT_PRIME) != 0)
	29	DHerr(DH_F_DH_CHECK_PARAMS_EX, DH_R_CHECK_P_NOT_PRIME);
	30	if ((errflags & DH_NOT_SUITABLE_GENERATOR) != 0)
	31	DHerr(DH_F_DH_CHECK_PARAMS_EX, DH_R_NOT_SUITABLE_GENERATOR);
feeb7ecd BE	32	if ((errflags & DH_MODULUS_TOO_SMALL) != 0)
	33	DHerr(DH_F_DH_CHECK_PARAMS_EX, DH_R_MODULUS_TOO_SMALL);
	34	if ((errflags & DH_MODULUS_TOO_LARGE) != 0)
	35	DHerr(DH_F_DH_CHECK_PARAMS_EX, DH_R_MODULUS_TOO_LARGE);
b0004708 PY	36
	37	return errflags == 0;
	38	}
26505153 RL	39
	40	int DH_check_params(const DH dh, int ret)
	41	{
	42	int ok = 0;
	43	BIGNUM *tmp = NULL;
	44	BN_CTX *ctx = NULL;
	45
	46	*ret = 0;
	47	ctx = BN_CTX_new();
	48	if (ctx == NULL)
	49	goto err;
	50	BN_CTX_start(ctx);
	51	tmp = BN_CTX_get(ctx);
	52	if (tmp == NULL)
	53	goto err;
	54
	55	if (!BN_is_odd(dh->p))
	56	*ret \|= DH_CHECK_P_NOT_PRIME;
	57	if (BN_is_negative(dh->g) \|\| BN_is_zero(dh->g) \|\| BN_is_one(dh->g))
	58	*ret \|= DH_NOT_SUITABLE_GENERATOR;
	59	if (BN_copy(tmp, dh->p) == NULL \|\| !BN_sub_word(tmp, 1))
	60	goto err;
	61	if (BN_cmp(dh->g, tmp) >= 0)
	62	*ret \|= DH_NOT_SUITABLE_GENERATOR;
feeb7ecd BE	63	if (BN_num_bits(dh->p) < DH_MIN_MODULUS_BITS)
	64	*ret \|= DH_MODULUS_TOO_SMALL;
	65	if (BN_num_bits(dh->p) > OPENSSL_DH_MAX_MODULUS_BITS)
	66	*ret \|= DH_MODULUS_TOO_LARGE;
26505153 RL	67
	68	ok = 1;
	69	err:
ce1415ed SL	70	BN_CTX_end(ctx);
ce1415ed SL	71	BN_CTX_free(ctx);
26a7d938	72	return ok;
26505153 RL	73	}
26505153 RL	74
1d97c843 TH	75	/*-
1d97c843 TH	76	* Check that p is a safe prime and
a38c878c	77	* g is a suitable generator.
d02b48c6	78	*/
b0004708 PY	79	int DH_check_ex(const DH *dh)
	80	{
	81	int errflags = 0;
	82
a38c878c BE	83	if (!DH_check(dh, &errflags))
a38c878c BE	84	return 0;
b0004708 PY	85
	86	if ((errflags & DH_NOT_SUITABLE_GENERATOR) != 0)
	87	DHerr(DH_F_DH_CHECK_EX, DH_R_NOT_SUITABLE_GENERATOR);
	88	if ((errflags & DH_CHECK_Q_NOT_PRIME) != 0)
	89	DHerr(DH_F_DH_CHECK_EX, DH_R_CHECK_Q_NOT_PRIME);
	90	if ((errflags & DH_CHECK_INVALID_Q_VALUE) != 0)
	91	DHerr(DH_F_DH_CHECK_EX, DH_R_CHECK_INVALID_Q_VALUE);
	92	if ((errflags & DH_CHECK_INVALID_J_VALUE) != 0)
	93	DHerr(DH_F_DH_CHECK_EX, DH_R_CHECK_INVALID_J_VALUE);
	94	if ((errflags & DH_UNABLE_TO_CHECK_GENERATOR) != 0)
	95	DHerr(DH_F_DH_CHECK_EX, DH_R_UNABLE_TO_CHECK_GENERATOR);
	96	if ((errflags & DH_CHECK_P_NOT_PRIME) != 0)
	97	DHerr(DH_F_DH_CHECK_EX, DH_R_CHECK_P_NOT_PRIME);
	98	if ((errflags & DH_CHECK_P_NOT_SAFE_PRIME) != 0)
	99	DHerr(DH_F_DH_CHECK_EX, DH_R_CHECK_P_NOT_SAFE_PRIME);
feeb7ecd BE	100	if ((errflags & DH_MODULUS_TOO_SMALL) != 0)
	101	DHerr(DH_F_DH_CHECK_EX, DH_R_MODULUS_TOO_SMALL);
	102	if ((errflags & DH_MODULUS_TOO_LARGE) != 0)
	103	DHerr(DH_F_DH_CHECK_EX, DH_R_MODULUS_TOO_LARGE);
b0004708 PY	104
	105	return errflags == 0;
	106	}
d02b48c6	107
f971ccb2	108	int DH_check(const DH dh, int ret)
0f113f3e	109	{
748e8530	110	int ok = 0, r;
0f113f3e	111	BN_CTX *ctx = NULL;
0f113f3e MC	112	BIGNUM t1 = NULL, t2 = NULL;
0f113f3e MC	113
a38c878c BE	114	if (!DH_check_params(dh, ret))
	115	return 0;
	116
0f113f3e MC	117	ctx = BN_CTX_new();
	118	if (ctx == NULL)
	119	goto err;
	120	BN_CTX_start(ctx);
	121	t1 = BN_CTX_get(ctx);
0f113f3e MC	122	t2 = BN_CTX_get(ctx);
	123	if (t2 == NULL)
	124	goto err;
d02b48c6	125
0f113f3e MC	126	if (dh->q) {
	127	if (BN_cmp(dh->g, BN_value_one()) <= 0)
	128	*ret \|= DH_NOT_SUITABLE_GENERATOR;
	129	else if (BN_cmp(dh->g, dh->p) >= 0)
	130	*ret \|= DH_NOT_SUITABLE_GENERATOR;
	131	else {
	132	/* Check g^q == 1 mod p */
	133	if (!BN_mod_exp(t1, dh->g, dh->q, dh->p, ctx))
	134	goto err;
	135	if (!BN_is_one(t1))
	136	*ret \|= DH_NOT_SUITABLE_GENERATOR;
	137	}
42619397	138	r = BN_check_prime(dh->q, ctx, NULL);
748e8530 DB	139	if (r < 0)
	140	goto err;
	141	if (!r)
0f113f3e MC	142	*ret \|= DH_CHECK_Q_NOT_PRIME;
	143	/* Check p == 1 mod q i.e. q divides p - 1 */
	144	if (!BN_div(t1, t2, dh->p, dh->q, ctx))
	145	goto err;
	146	if (!BN_is_one(t2))
	147	*ret \|= DH_CHECK_INVALID_Q_VALUE;
	148	if (dh->j && BN_cmp(dh->j, t1))
	149	*ret \|= DH_CHECK_INVALID_J_VALUE;
a38c878c	150	}
d02b48c6	151
42619397	152	r = BN_check_prime(dh->p, ctx, NULL);
748e8530 DB	153	if (r < 0)
	154	goto err;
	155	if (!r)
0f113f3e MC	156	*ret \|= DH_CHECK_P_NOT_PRIME;
	157	else if (!dh->q) {
	158	if (!BN_rshift1(t1, dh->p))
	159	goto err;
42619397	160	r = BN_check_prime(t1, ctx, NULL);
748e8530 DB	161	if (r < 0)
748e8530 DB	162	goto err;
e705fcf1	163	if (!r)
0f113f3e MC	164	*ret \|= DH_CHECK_P_NOT_SAFE_PRIME;
	165	}
	166	ok = 1;
	167	err:
ce1415ed SL	168	BN_CTX_end(ctx);
ce1415ed SL	169	BN_CTX_free(ctx);
26a7d938	170	return ok;
0f113f3e	171	}
bf3d6c0c	172
b0004708 PY	173	int DH_check_pub_key_ex(const DH dh, const BIGNUM pub_key)
	174	{
	175	int errflags = 0;
	176
2b95e8ef BE	177	if (!DH_check_pub_key(dh, pub_key, &errflags))
2b95e8ef BE	178	return 0;
b0004708 PY	179
	180	if ((errflags & DH_CHECK_PUBKEY_TOO_SMALL) != 0)
	181	DHerr(DH_F_DH_CHECK_PUB_KEY_EX, DH_R_CHECK_PUBKEY_TOO_SMALL);
	182	if ((errflags & DH_CHECK_PUBKEY_TOO_LARGE) != 0)
	183	DHerr(DH_F_DH_CHECK_PUB_KEY_EX, DH_R_CHECK_PUBKEY_TOO_LARGE);
	184	if ((errflags & DH_CHECK_PUBKEY_INVALID) != 0)
	185	DHerr(DH_F_DH_CHECK_PUB_KEY_EX, DH_R_CHECK_PUBKEY_INVALID);
	186
	187	return errflags == 0;
	188	}
	189
bf3d6c0c	190	int DH_check_pub_key(const DH dh, const BIGNUM pub_key, int *ret)
0f113f3e MC	191	{
0f113f3e MC	192	int ok = 0;
b128abc3 MC	193	BIGNUM *tmp = NULL;
b128abc3 MC	194	BN_CTX *ctx = NULL;
bf3d6c0c	195
0f113f3e	196	*ret = 0;
b128abc3 MC	197	ctx = BN_CTX_new();
b128abc3 MC	198	if (ctx == NULL)
0f113f3e	199	goto err;
b128abc3 MC	200	BN_CTX_start(ctx);
b128abc3 MC	201	tmp = BN_CTX_get(ctx);
f5a12207	202	if (tmp == NULL \|\| !BN_set_word(tmp, 1))
b128abc3	203	goto err;
b128abc3	204	if (BN_cmp(pub_key, tmp) <= 0)
0f113f3e	205	*ret \|= DH_CHECK_PUBKEY_TOO_SMALL;
f5a12207 MC	206	if (BN_copy(tmp, dh->p) == NULL \|\| !BN_sub_word(tmp, 1))
f5a12207 MC	207	goto err;
b128abc3	208	if (BN_cmp(pub_key, tmp) >= 0)
0f113f3e	209	*ret \|= DH_CHECK_PUBKEY_TOO_LARGE;
bf3d6c0c	210
b128abc3 MC	211	if (dh->q != NULL) {
	212	/* Check pub_key^q == 1 mod p */
	213	if (!BN_mod_exp(tmp, pub_key, dh->q, dh->p, ctx))
	214	goto err;
	215	if (!BN_is_one(tmp))
	216	*ret \|= DH_CHECK_PUBKEY_INVALID;
	217	}
	218
0f113f3e MC	219	ok = 1;
0f113f3e MC	220	err:
ce1415ed SL	221	BN_CTX_end(ctx);
ce1415ed SL	222	BN_CTX_free(ctx);
26a7d938	223	return ok;
0f113f3e	224	}