]>
Commit | Line | Data |
---|---|---|
3d328a44 | 1 | /* |
b0edda11 | 2 | * Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved. |
3d328a44 JL |
3 | * Copyright 2017 Ribose Inc. All Rights Reserved. |
4 | * Ported from Ribose contributions from Botan. | |
5 | * | |
6 | * Licensed under the OpenSSL license (the "License"). You may not use | |
7 | * this file except in compliance with the License. You can obtain a copy | |
8 | * in the file LICENSE in the source distribution or at | |
9 | * https://www.openssl.org/source/license.html | |
10 | */ | |
11 | ||
e425f90f | 12 | #include "internal/sm2.h" |
2398404e JL |
13 | #include "internal/sm2err.h" |
14 | #include <openssl/err.h> | |
3d328a44 JL |
15 | #include <openssl/evp.h> |
16 | #include <openssl/bn.h> | |
17 | #include <openssl/asn1.h> | |
18 | #include <openssl/asn1t.h> | |
19 | #include <string.h> | |
20 | ||
21 | typedef struct SM2_Ciphertext_st SM2_Ciphertext; | |
22 | DECLARE_ASN1_FUNCTIONS(SM2_Ciphertext) | |
23 | ||
24 | struct SM2_Ciphertext_st { | |
25 | BIGNUM *C1x; | |
26 | BIGNUM *C1y; | |
27 | ASN1_OCTET_STRING *C3; | |
28 | ASN1_OCTET_STRING *C2; | |
29 | }; | |
30 | ||
31 | ASN1_SEQUENCE(SM2_Ciphertext) = { | |
32 | ASN1_SIMPLE(SM2_Ciphertext, C1x, BIGNUM), | |
33 | ASN1_SIMPLE(SM2_Ciphertext, C1y, BIGNUM), | |
34 | ASN1_SIMPLE(SM2_Ciphertext, C3, ASN1_OCTET_STRING), | |
35 | ASN1_SIMPLE(SM2_Ciphertext, C2, ASN1_OCTET_STRING), | |
36 | } ASN1_SEQUENCE_END(SM2_Ciphertext) | |
37 | ||
38 | IMPLEMENT_ASN1_FUNCTIONS(SM2_Ciphertext) | |
39 | ||
2167239a | 40 | static size_t ec_field_size(const EC_GROUP *group) |
3d328a44 JL |
41 | { |
42 | /* Is there some simpler way to do this? */ | |
43 | BIGNUM *p = BN_new(); | |
44 | BIGNUM *a = BN_new(); | |
45 | BIGNUM *b = BN_new(); | |
46 | size_t field_size = 0; | |
47 | ||
48 | if (p == NULL || a == NULL || b == NULL) | |
49 | goto done; | |
50 | ||
51 | EC_GROUP_get_curve_GFp(group, p, a, b, NULL); | |
52 | field_size = (BN_num_bits(p) + 7) / 8; | |
53 | ||
54 | done: | |
55 | BN_free(p); | |
56 | BN_free(a); | |
57 | BN_free(b); | |
58 | ||
59 | return field_size; | |
60 | } | |
61 | ||
2167239a | 62 | int sm2_plaintext_size(const EC_KEY *key, const EVP_MD *digest, size_t msg_len, |
e14d6cf6 | 63 | size_t *pt_size) |
4e664750 | 64 | { |
2167239a | 65 | const size_t field_size = ec_field_size(EC_KEY_get0_group(key)); |
e14d6cf6 MC |
66 | const int md_size = EVP_MD_size(digest); |
67 | size_t overhead; | |
4e664750 | 68 | |
e14d6cf6 | 69 | if (md_size < 0) { |
245be530 | 70 | SM2err(SM2_F_SM2_PLAINTEXT_SIZE, SM2_R_INVALID_DIGEST); |
e14d6cf6 MC |
71 | return 0; |
72 | } | |
73 | if (field_size == 0) { | |
245be530 | 74 | SM2err(SM2_F_SM2_PLAINTEXT_SIZE, SM2_R_INVALID_FIELD); |
e14d6cf6 MC |
75 | return 0; |
76 | } | |
4e664750 | 77 | |
e14d6cf6 | 78 | overhead = 10 + 2 * field_size + (size_t)md_size; |
245be530 MC |
79 | if (msg_len <= overhead) { |
80 | SM2err(SM2_F_SM2_PLAINTEXT_SIZE, SM2_R_INVALID_ENCODING); | |
e14d6cf6 MC |
81 | return 0; |
82 | } | |
83 | ||
84 | *pt_size = msg_len - overhead; | |
85 | return 1; | |
4e664750 JL |
86 | } |
87 | ||
2167239a | 88 | int sm2_ciphertext_size(const EC_KEY *key, const EVP_MD *digest, size_t msg_len, |
e14d6cf6 | 89 | size_t *ct_size) |
3d328a44 | 90 | { |
2167239a | 91 | const size_t field_size = ec_field_size(EC_KEY_get0_group(key)); |
e14d6cf6 MC |
92 | const int md_size = EVP_MD_size(digest); |
93 | ||
94 | if (field_size == 0 || md_size < 0) | |
95 | return 0; | |
96 | ||
97 | *ct_size = 10 + 2 * field_size + (size_t)md_size + msg_len; | |
98 | return 1; | |
3d328a44 JL |
99 | } |
100 | ||
2167239a | 101 | int sm2_encrypt(const EC_KEY *key, |
3d328a44 JL |
102 | const EVP_MD *digest, |
103 | const uint8_t *msg, | |
104 | size_t msg_len, uint8_t *ciphertext_buf, size_t *ciphertext_len) | |
105 | { | |
44d3845d | 106 | int rc = 0, ciphertext_leni; |
3d328a44 JL |
107 | size_t i; |
108 | BN_CTX *ctx = NULL; | |
109 | BIGNUM *k = NULL; | |
110 | BIGNUM *x1 = NULL; | |
111 | BIGNUM *y1 = NULL; | |
112 | BIGNUM *x2 = NULL; | |
113 | BIGNUM *y2 = NULL; | |
3d328a44 | 114 | EVP_MD_CTX *hash = EVP_MD_CTX_new(); |
3d328a44 JL |
115 | struct SM2_Ciphertext_st ctext_struct; |
116 | const EC_GROUP *group = EC_KEY_get0_group(key); | |
117 | const BIGNUM *order = EC_GROUP_get0_order(group); | |
118 | const EC_POINT *P = EC_KEY_get0_public_key(key); | |
119 | EC_POINT *kG = NULL; | |
120 | EC_POINT *kP = NULL; | |
121 | uint8_t *msg_mask = NULL; | |
3d328a44 JL |
122 | uint8_t *x2y2 = NULL; |
123 | uint8_t *C3 = NULL; | |
2167239a | 124 | const size_t field_size = ec_field_size(group); |
3d328a44 JL |
125 | const size_t C3_size = EVP_MD_size(digest); |
126 | ||
44d3845d MC |
127 | /* NULL these before any "goto done" */ |
128 | ctext_struct.C2 = NULL; | |
129 | ctext_struct.C3 = NULL; | |
130 | ||
131 | if (hash == NULL | |
132 | || group == NULL | |
133 | || order == NULL | |
134 | || P == NULL | |
135 | || field_size == 0 | |
136 | || C3_size == 0) { | |
137 | SM2err(SM2_F_SM2_ENCRYPT, ERR_R_INTERNAL_ERROR); | |
138 | goto done; | |
139 | } | |
3d328a44 JL |
140 | |
141 | kG = EC_POINT_new(group); | |
142 | kP = EC_POINT_new(group); | |
3d328a44 | 143 | ctx = BN_CTX_new(); |
44d3845d MC |
144 | if (kG == NULL || kP == NULL || ctx == NULL) { |
145 | SM2err(SM2_F_SM2_ENCRYPT, ERR_R_MALLOC_FAILURE); | |
146 | goto done; | |
147 | } | |
3d328a44 JL |
148 | |
149 | BN_CTX_start(ctx); | |
150 | k = BN_CTX_get(ctx); | |
151 | x1 = BN_CTX_get(ctx); | |
152 | x2 = BN_CTX_get(ctx); | |
153 | y1 = BN_CTX_get(ctx); | |
154 | y2 = BN_CTX_get(ctx); | |
155 | ||
44d3845d | 156 | if (y2 == NULL) { |
2398404e JL |
157 | SM2err(SM2_F_SM2_ENCRYPT, ERR_R_BN_LIB); |
158 | goto done; | |
44d3845d | 159 | } |
3d328a44 JL |
160 | |
161 | x2y2 = OPENSSL_zalloc(2 * field_size); | |
162 | C3 = OPENSSL_zalloc(C3_size); | |
163 | ||
44d3845d | 164 | if (x2y2 == NULL || C3 == NULL) { |
2398404e JL |
165 | SM2err(SM2_F_SM2_ENCRYPT, ERR_R_MALLOC_FAILURE); |
166 | goto done; | |
44d3845d | 167 | } |
3d328a44 JL |
168 | |
169 | memset(ciphertext_buf, 0, *ciphertext_len); | |
170 | ||
44d3845d MC |
171 | if (!BN_priv_rand_range(k, order)) { |
172 | SM2err(SM2_F_SM2_ENCRYPT, ERR_R_INTERNAL_ERROR); | |
3d328a44 | 173 | goto done; |
44d3845d | 174 | } |
3d328a44 | 175 | |
44d3845d MC |
176 | if (!EC_POINT_mul(group, kG, k, NULL, NULL, ctx) |
177 | || !EC_POINT_get_affine_coordinates_GFp(group, kG, x1, y1, ctx) | |
178 | || !EC_POINT_mul(group, kP, NULL, P, k, ctx) | |
179 | || !EC_POINT_get_affine_coordinates_GFp(group, kP, x2, y2, ctx)) { | |
2398404e | 180 | SM2err(SM2_F_SM2_ENCRYPT, ERR_R_EC_LIB); |
3d328a44 | 181 | goto done; |
44d3845d | 182 | } |
3d328a44 | 183 | |
44d3845d MC |
184 | if (BN_bn2binpad(x2, x2y2, field_size) < 0 |
185 | || BN_bn2binpad(y2, x2y2 + field_size, field_size) < 0) { | |
186 | SM2err(SM2_F_SM2_ENCRYPT, ERR_R_INTERNAL_ERROR); | |
3d328a44 | 187 | goto done; |
44d3845d | 188 | } |
3d328a44 JL |
189 | |
190 | msg_mask = OPENSSL_zalloc(msg_len); | |
44d3845d | 191 | if (msg_mask == NULL) { |
2398404e | 192 | SM2err(SM2_F_SM2_ENCRYPT, ERR_R_MALLOC_FAILURE); |
3d328a44 | 193 | goto done; |
44d3845d | 194 | } |
3d328a44 JL |
195 | |
196 | /* X9.63 with no salt happens to match the KDF used in SM2 */ | |
44d3845d MC |
197 | if (!ECDH_KDF_X9_62(msg_mask, msg_len, x2y2, 2 * field_size, NULL, 0, |
198 | digest)) { | |
199 | SM2err(SM2_F_SM2_ENCRYPT, ERR_R_EVP_LIB); | |
3d328a44 | 200 | goto done; |
44d3845d | 201 | } |
3d328a44 JL |
202 | |
203 | for (i = 0; i != msg_len; ++i) | |
204 | msg_mask[i] ^= msg[i]; | |
205 | ||
44d3845d MC |
206 | if (EVP_DigestInit(hash, digest) == 0 |
207 | || EVP_DigestUpdate(hash, x2y2, field_size) == 0 | |
208 | || EVP_DigestUpdate(hash, msg, msg_len) == 0 | |
209 | || EVP_DigestUpdate(hash, x2y2 + field_size, field_size) == 0 | |
210 | || EVP_DigestFinal(hash, C3, NULL) == 0) { | |
2398404e | 211 | SM2err(SM2_F_SM2_ENCRYPT, ERR_R_EVP_LIB); |
3d328a44 | 212 | goto done; |
44d3845d | 213 | } |
3d328a44 JL |
214 | |
215 | ctext_struct.C1x = x1; | |
216 | ctext_struct.C1y = y1; | |
217 | ctext_struct.C3 = ASN1_OCTET_STRING_new(); | |
3d328a44 | 218 | ctext_struct.C2 = ASN1_OCTET_STRING_new(); |
3d328a44 | 219 | |
44d3845d MC |
220 | if (ctext_struct.C3 == NULL || ctext_struct.C2 == NULL) { |
221 | SM2err(SM2_F_SM2_ENCRYPT, ERR_R_MALLOC_FAILURE); | |
222 | goto done; | |
223 | } | |
224 | if (!ASN1_OCTET_STRING_set(ctext_struct.C3, C3, C3_size) | |
225 | || !ASN1_OCTET_STRING_set(ctext_struct.C2, msg_mask, msg_len)) { | |
226 | SM2err(SM2_F_SM2_ENCRYPT, ERR_R_INTERNAL_ERROR); | |
227 | goto done; | |
228 | } | |
3d328a44 | 229 | |
44d3845d MC |
230 | ciphertext_leni = i2d_SM2_Ciphertext(&ctext_struct, &ciphertext_buf); |
231 | /* Ensure cast to size_t is safe */ | |
232 | if (ciphertext_leni < 0) { | |
233 | SM2err(SM2_F_SM2_ENCRYPT, ERR_R_INTERNAL_ERROR); | |
234 | goto done; | |
235 | } | |
236 | *ciphertext_len = (size_t)ciphertext_leni; | |
3d328a44 JL |
237 | |
238 | rc = 1; | |
239 | ||
240 | done: | |
44d3845d MC |
241 | ASN1_OCTET_STRING_free(ctext_struct.C2); |
242 | ASN1_OCTET_STRING_free(ctext_struct.C3); | |
3d328a44 JL |
243 | OPENSSL_free(msg_mask); |
244 | OPENSSL_free(x2y2); | |
245 | OPENSSL_free(C3); | |
246 | EVP_MD_CTX_free(hash); | |
247 | BN_CTX_free(ctx); | |
248 | EC_POINT_free(kG); | |
249 | EC_POINT_free(kP); | |
250 | return rc; | |
251 | } | |
252 | ||
2167239a | 253 | int sm2_decrypt(const EC_KEY *key, |
3d328a44 JL |
254 | const EVP_MD *digest, |
255 | const uint8_t *ciphertext, | |
256 | size_t ciphertext_len, uint8_t *ptext_buf, size_t *ptext_len) | |
257 | { | |
258 | int rc = 0; | |
259 | int i; | |
3d328a44 JL |
260 | BN_CTX *ctx = NULL; |
261 | const EC_GROUP *group = EC_KEY_get0_group(key); | |
262 | EC_POINT *C1 = NULL; | |
263 | struct SM2_Ciphertext_st *sm2_ctext = NULL; | |
264 | BIGNUM *x2 = NULL; | |
265 | BIGNUM *y2 = NULL; | |
3d328a44 JL |
266 | uint8_t *x2y2 = NULL; |
267 | uint8_t *computed_C3 = NULL; | |
2167239a | 268 | const size_t field_size = ec_field_size(group); |
3d328a44 | 269 | const int hash_size = EVP_MD_size(digest); |
3d328a44 JL |
270 | uint8_t *msg_mask = NULL; |
271 | const uint8_t *C2 = NULL; | |
272 | const uint8_t *C3 = NULL; | |
273 | int msg_len = 0; | |
274 | EVP_MD_CTX *hash = NULL; | |
275 | ||
276 | if (field_size == 0 || hash_size == 0) | |
277 | goto done; | |
278 | ||
279 | memset(ptext_buf, 0xFF, *ptext_len); | |
280 | ||
281 | sm2_ctext = d2i_SM2_Ciphertext(NULL, &ciphertext, ciphertext_len); | |
282 | ||
245be530 | 283 | if (sm2_ctext == NULL) { |
2398404e | 284 | SM2err(SM2_F_SM2_DECRYPT, SM2_R_ASN1_ERROR); |
3d328a44 | 285 | goto done; |
245be530 | 286 | } |
3d328a44 | 287 | |
245be530 | 288 | if (sm2_ctext->C3->length != hash_size) { |
2398404e | 289 | SM2err(SM2_F_SM2_DECRYPT, SM2_R_INVALID_ENCODING); |
3d328a44 | 290 | goto done; |
245be530 | 291 | } |
3d328a44 JL |
292 | |
293 | C2 = sm2_ctext->C2->data; | |
294 | C3 = sm2_ctext->C3->data; | |
295 | msg_len = sm2_ctext->C2->length; | |
296 | ||
297 | ctx = BN_CTX_new(); | |
245be530 | 298 | if (ctx == NULL) { |
2398404e JL |
299 | SM2err(SM2_F_SM2_DECRYPT, ERR_R_MALLOC_FAILURE); |
300 | goto done; | |
245be530 | 301 | } |
3d328a44 JL |
302 | |
303 | BN_CTX_start(ctx); | |
304 | x2 = BN_CTX_get(ctx); | |
305 | y2 = BN_CTX_get(ctx); | |
306 | ||
245be530 | 307 | if (y2 == NULL) { |
2398404e JL |
308 | SM2err(SM2_F_SM2_DECRYPT, ERR_R_BN_LIB); |
309 | goto done; | |
245be530 | 310 | } |
3d328a44 JL |
311 | |
312 | msg_mask = OPENSSL_zalloc(msg_len); | |
313 | x2y2 = OPENSSL_zalloc(2 * field_size); | |
314 | computed_C3 = OPENSSL_zalloc(hash_size); | |
315 | ||
245be530 | 316 | if (msg_mask == NULL || x2y2 == NULL || computed_C3 == NULL) { |
2398404e JL |
317 | SM2err(SM2_F_SM2_DECRYPT, ERR_R_MALLOC_FAILURE); |
318 | goto done; | |
245be530 | 319 | } |
3d328a44 JL |
320 | |
321 | C1 = EC_POINT_new(group); | |
245be530 | 322 | if (C1 == NULL) { |
2398404e | 323 | SM2err(SM2_F_SM2_DECRYPT, ERR_R_MALLOC_FAILURE); |
3d328a44 | 324 | goto done; |
245be530 | 325 | } |
3d328a44 | 326 | |
245be530 MC |
327 | if (!EC_POINT_set_affine_coordinates_GFp(group, C1, sm2_ctext->C1x, |
328 | sm2_ctext->C1y, ctx) | |
329 | || !EC_POINT_mul(group, C1, NULL, C1, EC_KEY_get0_private_key(key), | |
330 | ctx) | |
331 | || !EC_POINT_get_affine_coordinates_GFp(group, C1, x2, y2, ctx)) { | |
2398404e | 332 | SM2err(SM2_F_SM2_DECRYPT, ERR_R_EC_LIB); |
3d328a44 | 333 | goto done; |
245be530 | 334 | } |
3d328a44 | 335 | |
245be530 MC |
336 | if (BN_bn2binpad(x2, x2y2, field_size) < 0 |
337 | || BN_bn2binpad(y2, x2y2 + field_size, field_size) < 0 | |
338 | || !ECDH_KDF_X9_62(msg_mask, msg_len, x2y2, 2 * field_size, NULL, 0, | |
339 | digest)) { | |
340 | SM2err(SM2_F_SM2_DECRYPT, ERR_R_INTERNAL_ERROR); | |
3d328a44 | 341 | goto done; |
245be530 | 342 | } |
3d328a44 JL |
343 | |
344 | for (i = 0; i != msg_len; ++i) | |
345 | ptext_buf[i] = C2[i] ^ msg_mask[i]; | |
346 | ||
347 | hash = EVP_MD_CTX_new(); | |
245be530 | 348 | if (hash == NULL) { |
2398404e JL |
349 | SM2err(SM2_F_SM2_DECRYPT, ERR_R_MALLOC_FAILURE); |
350 | goto done; | |
245be530 | 351 | } |
3d328a44 | 352 | |
245be530 MC |
353 | if (!EVP_DigestInit(hash, digest) |
354 | || !EVP_DigestUpdate(hash, x2y2, field_size) | |
355 | || !EVP_DigestUpdate(hash, ptext_buf, msg_len) | |
356 | || !EVP_DigestUpdate(hash, x2y2 + field_size, field_size) | |
357 | || !EVP_DigestFinal(hash, computed_C3, NULL)) { | |
2398404e | 358 | SM2err(SM2_F_SM2_DECRYPT, ERR_R_EVP_LIB); |
3d328a44 | 359 | goto done; |
245be530 | 360 | } |
3d328a44 | 361 | |
245be530 MC |
362 | if (CRYPTO_memcmp(computed_C3, C3, hash_size) != 0) { |
363 | SM2err(SM2_F_SM2_DECRYPT, SM2_R_INVALID_DIGEST); | |
3d328a44 | 364 | goto done; |
245be530 | 365 | } |
3d328a44 JL |
366 | |
367 | rc = 1; | |
dceb99a5 | 368 | *ptext_len = msg_len; |
3d328a44 JL |
369 | |
370 | done: | |
3d328a44 JL |
371 | if (rc == 0) |
372 | memset(ptext_buf, 0, *ptext_len); | |
373 | ||
374 | OPENSSL_free(msg_mask); | |
375 | OPENSSL_free(x2y2); | |
376 | OPENSSL_free(computed_C3); | |
377 | EC_POINT_free(C1); | |
378 | BN_CTX_free(ctx); | |
379 | SM2_Ciphertext_free(sm2_ctext); | |
380 | EVP_MD_CTX_free(hash); | |
381 | ||
382 | return rc; | |
383 | } |