]>
Commit | Line | Data |
---|---|---|
aa6bb135 | 1 | /* |
fd38836b | 2 | * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved. |
d02b48c6 | 3 | * |
e38873f5 | 4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
aa6bb135 RS |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
d02b48c6 RE |
8 | */ |
9 | ||
10 | #include <stdio.h> | |
b39fc560 | 11 | #include "internal/cryptlib.h" |
0aeddcfa | 12 | #include "dh_locl.h" |
829ccf6a | 13 | #include "internal/bn_int.h" |
d02b48c6 | 14 | |
13066cee | 15 | static int generate_key(DH *dh); |
f971ccb2 RL |
16 | static int compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh); |
17 | static int dh_bn_mod_exp(const DH *dh, BIGNUM *r, | |
0f113f3e MC |
18 | const BIGNUM *a, const BIGNUM *p, |
19 | const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx); | |
13066cee DSH |
20 | static int dh_init(DH *dh); |
21 | static int dh_finish(DH *dh); | |
22 | ||
6b691a5c | 23 | int DH_generate_key(DH *dh) |
0f113f3e MC |
24 | { |
25 | return dh->meth->generate_key(dh); | |
26 | } | |
13066cee | 27 | |
f971ccb2 | 28 | int DH_compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh) |
0f113f3e MC |
29 | { |
30 | return dh->meth->compute_key(key, pub_key, dh); | |
31 | } | |
13066cee | 32 | |
bc91494e | 33 | int DH_compute_key_padded(unsigned char *key, const BIGNUM *pub_key, DH *dh) |
0f113f3e MC |
34 | { |
35 | int rv, pad; | |
36 | rv = dh->meth->compute_key(key, pub_key, dh); | |
37 | if (rv <= 0) | |
38 | return rv; | |
39 | pad = BN_num_bytes(dh->p) - rv; | |
40 | if (pad > 0) { | |
41 | memmove(key + pad, key, rv); | |
42 | memset(key, 0, pad); | |
43 | } | |
44 | return rv + pad; | |
45 | } | |
bc91494e | 46 | |
13066cee | 47 | static DH_METHOD dh_ossl = { |
0f113f3e MC |
48 | "OpenSSL DH Method", |
49 | generate_key, | |
50 | compute_key, | |
51 | dh_bn_mod_exp, | |
52 | dh_init, | |
53 | dh_finish, | |
54 | DH_FLAG_FIPS_METHOD, | |
55 | NULL, | |
56 | NULL | |
13066cee DSH |
57 | }; |
58 | ||
076fc555 RS |
59 | static const DH_METHOD *default_DH_method = &dh_ossl; |
60 | ||
f971ccb2 | 61 | const DH_METHOD *DH_OpenSSL(void) |
13066cee | 62 | { |
0f113f3e | 63 | return &dh_ossl; |
13066cee DSH |
64 | } |
65 | ||
076fc555 RS |
66 | void DH_set_default_method(const DH_METHOD *meth) |
67 | { | |
68 | default_DH_method = meth; | |
69 | } | |
70 | ||
71 | const DH_METHOD *DH_get_default_method(void) | |
72 | { | |
73 | return default_DH_method; | |
74 | } | |
75 | ||
13066cee | 76 | static int generate_key(DH *dh) |
0f113f3e MC |
77 | { |
78 | int ok = 0; | |
79 | int generate_new_key = 0; | |
80 | unsigned l; | |
91f7361f | 81 | BN_CTX *ctx = NULL; |
0f113f3e MC |
82 | BN_MONT_CTX *mont = NULL; |
83 | BIGNUM *pub_key = NULL, *priv_key = NULL; | |
d02b48c6 | 84 | |
91f7361f GV |
85 | if (BN_num_bits(dh->p) > OPENSSL_DH_MAX_MODULUS_BITS) { |
86 | DHerr(DH_F_GENERATE_KEY, DH_R_MODULUS_TOO_LARGE); | |
87 | return 0; | |
88 | } | |
89 | ||
0f113f3e MC |
90 | ctx = BN_CTX_new(); |
91 | if (ctx == NULL) | |
92 | goto err; | |
d02b48c6 | 93 | |
0f113f3e | 94 | if (dh->priv_key == NULL) { |
74924dcb | 95 | priv_key = BN_secure_new(); |
0f113f3e MC |
96 | if (priv_key == NULL) |
97 | goto err; | |
98 | generate_new_key = 1; | |
99 | } else | |
100 | priv_key = dh->priv_key; | |
d02b48c6 | 101 | |
0f113f3e MC |
102 | if (dh->pub_key == NULL) { |
103 | pub_key = BN_new(); | |
104 | if (pub_key == NULL) | |
105 | goto err; | |
106 | } else | |
107 | pub_key = dh->pub_key; | |
d02b48c6 | 108 | |
0f113f3e MC |
109 | if (dh->flags & DH_FLAG_CACHE_MONT_P) { |
110 | mont = BN_MONT_CTX_set_locked(&dh->method_mont_p, | |
d188a536 | 111 | dh->lock, dh->p, ctx); |
0f113f3e MC |
112 | if (!mont) |
113 | goto err; | |
114 | } | |
6ec8e63a | 115 | |
0f113f3e MC |
116 | if (generate_new_key) { |
117 | if (dh->q) { | |
118 | do { | |
ddc6a5c8 | 119 | if (!BN_priv_rand_range(priv_key, dh->q)) |
0f113f3e MC |
120 | goto err; |
121 | } | |
122 | while (BN_is_zero(priv_key) || BN_is_one(priv_key)); | |
123 | } else { | |
124 | /* secret exponent length */ | |
125 | l = dh->length ? dh->length : BN_num_bits(dh->p) - 1; | |
ddc6a5c8 | 126 | if (!BN_priv_rand(priv_key, l, BN_RAND_TOP_ONE, BN_RAND_BOTTOM_ANY)) |
0f113f3e MC |
127 | goto err; |
128 | } | |
129 | } | |
dfeab068 | 130 | |
0f113f3e | 131 | { |
5584f65a | 132 | BIGNUM *prk = BN_new(); |
46a64376 | 133 | |
5584f65a MC |
134 | if (prk == NULL) |
135 | goto err; | |
136 | BN_with_flags(prk, priv_key, BN_FLG_CONSTTIME); | |
46a64376 | 137 | |
0f113f3e | 138 | if (!dh->meth->bn_mod_exp(dh, pub_key, dh->g, prk, dh->p, ctx, mont)) { |
5584f65a | 139 | BN_free(prk); |
0f113f3e MC |
140 | goto err; |
141 | } | |
5584f65a MC |
142 | /* We MUST free prk before any further use of priv_key */ |
143 | BN_free(prk); | |
0f113f3e | 144 | } |
46a64376 | 145 | |
0f113f3e MC |
146 | dh->pub_key = pub_key; |
147 | dh->priv_key = priv_key; | |
148 | ok = 1; | |
149 | err: | |
150 | if (ok != 1) | |
151 | DHerr(DH_F_GENERATE_KEY, ERR_R_BN_LIB); | |
d02b48c6 | 152 | |
23a1d5e9 | 153 | if (pub_key != dh->pub_key) |
0f113f3e | 154 | BN_free(pub_key); |
23a1d5e9 | 155 | if (priv_key != dh->priv_key) |
0f113f3e MC |
156 | BN_free(priv_key); |
157 | BN_CTX_free(ctx); | |
26a7d938 | 158 | return ok; |
0f113f3e | 159 | } |
d02b48c6 | 160 | |
f971ccb2 | 161 | static int compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh) |
0f113f3e MC |
162 | { |
163 | BN_CTX *ctx = NULL; | |
164 | BN_MONT_CTX *mont = NULL; | |
165 | BIGNUM *tmp; | |
166 | int ret = -1; | |
167 | int check_result; | |
d02b48c6 | 168 | |
0f113f3e MC |
169 | if (BN_num_bits(dh->p) > OPENSSL_DH_MAX_MODULUS_BITS) { |
170 | DHerr(DH_F_COMPUTE_KEY, DH_R_MODULUS_TOO_LARGE); | |
171 | goto err; | |
172 | } | |
5e3225cc | 173 | |
0f113f3e MC |
174 | ctx = BN_CTX_new(); |
175 | if (ctx == NULL) | |
176 | goto err; | |
177 | BN_CTX_start(ctx); | |
178 | tmp = BN_CTX_get(ctx); | |
7928ee4d BE |
179 | if (tmp == NULL) |
180 | goto err; | |
6ec8e63a | 181 | |
0f113f3e MC |
182 | if (dh->priv_key == NULL) { |
183 | DHerr(DH_F_COMPUTE_KEY, DH_R_NO_PRIVATE_VALUE); | |
184 | goto err; | |
185 | } | |
dfeab068 | 186 | |
0f113f3e MC |
187 | if (dh->flags & DH_FLAG_CACHE_MONT_P) { |
188 | mont = BN_MONT_CTX_set_locked(&dh->method_mont_p, | |
d188a536 | 189 | dh->lock, dh->p, ctx); |
5584f65a | 190 | BN_set_flags(dh->priv_key, BN_FLG_CONSTTIME); |
0f113f3e MC |
191 | if (!mont) |
192 | goto err; | |
193 | } | |
bf3d6c0c | 194 | |
0f113f3e MC |
195 | if (!DH_check_pub_key(dh, pub_key, &check_result) || check_result) { |
196 | DHerr(DH_F_COMPUTE_KEY, DH_R_INVALID_PUBKEY); | |
197 | goto err; | |
198 | } | |
d02b48c6 | 199 | |
0f113f3e MC |
200 | if (!dh-> |
201 | meth->bn_mod_exp(dh, tmp, pub_key, dh->priv_key, dh->p, ctx, mont)) { | |
202 | DHerr(DH_F_COMPUTE_KEY, ERR_R_BN_LIB); | |
203 | goto err; | |
204 | } | |
13066cee | 205 | |
0f113f3e MC |
206 | ret = BN_bn2bin(tmp, key); |
207 | err: | |
208 | if (ctx != NULL) { | |
209 | BN_CTX_end(ctx); | |
210 | BN_CTX_free(ctx); | |
211 | } | |
26a7d938 | 212 | return ret; |
0f113f3e | 213 | } |
6dad7bd6 | 214 | |
0f113f3e MC |
215 | static int dh_bn_mod_exp(const DH *dh, BIGNUM *r, |
216 | const BIGNUM *a, const BIGNUM *p, | |
217 | const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx) | |
218 | { | |
5584f65a | 219 | return BN_mod_exp_mont(r, a, p, m, ctx, m_ctx); |
0f113f3e | 220 | } |
13066cee DSH |
221 | |
222 | static int dh_init(DH *dh) | |
0f113f3e MC |
223 | { |
224 | dh->flags |= DH_FLAG_CACHE_MONT_P; | |
208fb891 | 225 | return 1; |
0f113f3e | 226 | } |
13066cee DSH |
227 | |
228 | static int dh_finish(DH *dh) | |
0f113f3e | 229 | { |
23a1d5e9 | 230 | BN_MONT_CTX_free(dh->method_mont_p); |
208fb891 | 231 | return 1; |
0f113f3e | 232 | } |