2 * Copyright 2004-2016 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the OpenSSL license (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
10 #include <openssl/crypto.h>
11 #include <openssl/rand.h>
12 #include <openssl/err.h>
15 #ifndef OPENSSL_NO_SRP
16 # include <openssl/srp.h>
18 int SSL_CTX_SRP_CTX_free(struct ssl_ctx_st
*ctx
)
22 OPENSSL_free(ctx
->srp_ctx
.login
);
23 OPENSSL_free(ctx
->srp_ctx
.info
);
24 BN_free(ctx
->srp_ctx
.N
);
25 BN_free(ctx
->srp_ctx
.g
);
26 BN_free(ctx
->srp_ctx
.s
);
27 BN_free(ctx
->srp_ctx
.B
);
28 BN_free(ctx
->srp_ctx
.A
);
29 BN_free(ctx
->srp_ctx
.a
);
30 BN_free(ctx
->srp_ctx
.b
);
31 BN_free(ctx
->srp_ctx
.v
);
32 ctx
->srp_ctx
.TLS_ext_srp_username_callback
= NULL
;
33 ctx
->srp_ctx
.SRP_cb_arg
= NULL
;
34 ctx
->srp_ctx
.SRP_verify_param_callback
= NULL
;
35 ctx
->srp_ctx
.SRP_give_srp_client_pwd_callback
= NULL
;
36 ctx
->srp_ctx
.N
= NULL
;
37 ctx
->srp_ctx
.g
= NULL
;
38 ctx
->srp_ctx
.s
= NULL
;
39 ctx
->srp_ctx
.B
= NULL
;
40 ctx
->srp_ctx
.A
= NULL
;
41 ctx
->srp_ctx
.a
= NULL
;
42 ctx
->srp_ctx
.b
= NULL
;
43 ctx
->srp_ctx
.v
= NULL
;
44 ctx
->srp_ctx
.login
= NULL
;
45 ctx
->srp_ctx
.info
= NULL
;
46 ctx
->srp_ctx
.strength
= SRP_MINIMAL_N
;
47 ctx
->srp_ctx
.srp_Mask
= 0;
51 int SSL_SRP_CTX_free(struct ssl_st
*s
)
55 OPENSSL_free(s
->srp_ctx
.login
);
56 OPENSSL_free(s
->srp_ctx
.info
);
57 BN_free(s
->srp_ctx
.N
);
58 BN_free(s
->srp_ctx
.g
);
59 BN_free(s
->srp_ctx
.s
);
60 BN_free(s
->srp_ctx
.B
);
61 BN_free(s
->srp_ctx
.A
);
62 BN_free(s
->srp_ctx
.a
);
63 BN_free(s
->srp_ctx
.b
);
64 BN_free(s
->srp_ctx
.v
);
65 s
->srp_ctx
.TLS_ext_srp_username_callback
= NULL
;
66 s
->srp_ctx
.SRP_cb_arg
= NULL
;
67 s
->srp_ctx
.SRP_verify_param_callback
= NULL
;
68 s
->srp_ctx
.SRP_give_srp_client_pwd_callback
= NULL
;
77 s
->srp_ctx
.login
= NULL
;
78 s
->srp_ctx
.info
= NULL
;
79 s
->srp_ctx
.strength
= SRP_MINIMAL_N
;
80 s
->srp_ctx
.srp_Mask
= 0;
84 int SSL_SRP_CTX_init(struct ssl_st
*s
)
88 if ((s
== NULL
) || ((ctx
= s
->ctx
) == NULL
))
90 s
->srp_ctx
.SRP_cb_arg
= ctx
->srp_ctx
.SRP_cb_arg
;
91 /* set client Hello login callback */
92 s
->srp_ctx
.TLS_ext_srp_username_callback
=
93 ctx
->srp_ctx
.TLS_ext_srp_username_callback
;
94 /* set SRP N/g param callback for verification */
95 s
->srp_ctx
.SRP_verify_param_callback
=
96 ctx
->srp_ctx
.SRP_verify_param_callback
;
97 /* set SRP client passwd callback */
98 s
->srp_ctx
.SRP_give_srp_client_pwd_callback
=
99 ctx
->srp_ctx
.SRP_give_srp_client_pwd_callback
;
109 s
->srp_ctx
.login
= NULL
;
110 s
->srp_ctx
.info
= NULL
;
111 s
->srp_ctx
.strength
= ctx
->srp_ctx
.strength
;
113 if (((ctx
->srp_ctx
.N
!= NULL
) &&
114 ((s
->srp_ctx
.N
= BN_dup(ctx
->srp_ctx
.N
)) == NULL
)) ||
115 ((ctx
->srp_ctx
.g
!= NULL
) &&
116 ((s
->srp_ctx
.g
= BN_dup(ctx
->srp_ctx
.g
)) == NULL
)) ||
117 ((ctx
->srp_ctx
.s
!= NULL
) &&
118 ((s
->srp_ctx
.s
= BN_dup(ctx
->srp_ctx
.s
)) == NULL
)) ||
119 ((ctx
->srp_ctx
.B
!= NULL
) &&
120 ((s
->srp_ctx
.B
= BN_dup(ctx
->srp_ctx
.B
)) == NULL
)) ||
121 ((ctx
->srp_ctx
.A
!= NULL
) &&
122 ((s
->srp_ctx
.A
= BN_dup(ctx
->srp_ctx
.A
)) == NULL
)) ||
123 ((ctx
->srp_ctx
.a
!= NULL
) &&
124 ((s
->srp_ctx
.a
= BN_dup(ctx
->srp_ctx
.a
)) == NULL
)) ||
125 ((ctx
->srp_ctx
.v
!= NULL
) &&
126 ((s
->srp_ctx
.v
= BN_dup(ctx
->srp_ctx
.v
)) == NULL
)) ||
127 ((ctx
->srp_ctx
.b
!= NULL
) &&
128 ((s
->srp_ctx
.b
= BN_dup(ctx
->srp_ctx
.b
)) == NULL
))) {
129 SSLerr(SSL_F_SSL_SRP_CTX_INIT
, ERR_R_BN_LIB
);
132 if ((ctx
->srp_ctx
.login
!= NULL
) &&
133 ((s
->srp_ctx
.login
= OPENSSL_strdup(ctx
->srp_ctx
.login
)) == NULL
)) {
134 SSLerr(SSL_F_SSL_SRP_CTX_INIT
, ERR_R_INTERNAL_ERROR
);
137 if ((ctx
->srp_ctx
.info
!= NULL
) &&
138 ((s
->srp_ctx
.info
= BUF_strdup(ctx
->srp_ctx
.info
)) == NULL
)) {
139 SSLerr(SSL_F_SSL_SRP_CTX_INIT
, ERR_R_INTERNAL_ERROR
);
142 s
->srp_ctx
.srp_Mask
= ctx
->srp_ctx
.srp_Mask
;
146 OPENSSL_free(s
->srp_ctx
.login
);
147 OPENSSL_free(s
->srp_ctx
.info
);
148 BN_free(s
->srp_ctx
.N
);
149 BN_free(s
->srp_ctx
.g
);
150 BN_free(s
->srp_ctx
.s
);
151 BN_free(s
->srp_ctx
.B
);
152 BN_free(s
->srp_ctx
.A
);
153 BN_free(s
->srp_ctx
.a
);
154 BN_free(s
->srp_ctx
.b
);
155 BN_free(s
->srp_ctx
.v
);
159 int SSL_CTX_SRP_CTX_init(struct ssl_ctx_st
*ctx
)
164 ctx
->srp_ctx
.SRP_cb_arg
= NULL
;
165 /* set client Hello login callback */
166 ctx
->srp_ctx
.TLS_ext_srp_username_callback
= NULL
;
167 /* set SRP N/g param callback for verification */
168 ctx
->srp_ctx
.SRP_verify_param_callback
= NULL
;
169 /* set SRP client passwd callback */
170 ctx
->srp_ctx
.SRP_give_srp_client_pwd_callback
= NULL
;
172 ctx
->srp_ctx
.N
= NULL
;
173 ctx
->srp_ctx
.g
= NULL
;
174 ctx
->srp_ctx
.s
= NULL
;
175 ctx
->srp_ctx
.B
= NULL
;
176 ctx
->srp_ctx
.A
= NULL
;
177 ctx
->srp_ctx
.a
= NULL
;
178 ctx
->srp_ctx
.b
= NULL
;
179 ctx
->srp_ctx
.v
= NULL
;
180 ctx
->srp_ctx
.login
= NULL
;
181 ctx
->srp_ctx
.srp_Mask
= 0;
182 ctx
->srp_ctx
.info
= NULL
;
183 ctx
->srp_ctx
.strength
= SRP_MINIMAL_N
;
189 int SSL_srp_server_param_with_username(SSL
*s
, int *ad
)
191 unsigned char b
[SSL_MAX_MASTER_KEY_LENGTH
];
194 *ad
= SSL_AD_UNKNOWN_PSK_IDENTITY
;
195 if ((s
->srp_ctx
.TLS_ext_srp_username_callback
!= NULL
) &&
197 s
->srp_ctx
.TLS_ext_srp_username_callback(s
, ad
,
198 s
->srp_ctx
.SRP_cb_arg
)) !=
202 *ad
= SSL_AD_INTERNAL_ERROR
;
203 if ((s
->srp_ctx
.N
== NULL
) ||
204 (s
->srp_ctx
.g
== NULL
) ||
205 (s
->srp_ctx
.s
== NULL
) || (s
->srp_ctx
.v
== NULL
))
206 return SSL3_AL_FATAL
;
208 if (RAND_bytes(b
, sizeof(b
)) <= 0)
209 return SSL3_AL_FATAL
;
210 s
->srp_ctx
.b
= BN_bin2bn(b
, sizeof(b
), NULL
);
211 OPENSSL_cleanse(b
, sizeof(b
));
213 /* Calculate: B = (kv + g^b) % N */
215 return ((s
->srp_ctx
.B
=
216 SRP_Calc_B(s
->srp_ctx
.b
, s
->srp_ctx
.N
, s
->srp_ctx
.g
,
218 NULL
) ? SSL_ERROR_NONE
: SSL3_AL_FATAL
;
222 * If the server just has the raw password, make up a verifier entry on the
225 int SSL_set_srp_server_param_pw(SSL
*s
, const char *user
, const char *pass
,
228 SRP_gN
*GN
= SRP_get_default_gN(grp
);
231 s
->srp_ctx
.N
= BN_dup(GN
->N
);
232 s
->srp_ctx
.g
= BN_dup(GN
->g
);
233 BN_clear_free(s
->srp_ctx
.v
);
235 BN_clear_free(s
->srp_ctx
.s
);
237 if (!SRP_create_verifier_BN
238 (user
, pass
, &s
->srp_ctx
.s
, &s
->srp_ctx
.v
, GN
->N
, GN
->g
))
244 int SSL_set_srp_server_param(SSL
*s
, const BIGNUM
*N
, const BIGNUM
*g
,
245 BIGNUM
*sa
, BIGNUM
*v
, char *info
)
248 if (s
->srp_ctx
.N
!= NULL
) {
249 if (!BN_copy(s
->srp_ctx
.N
, N
)) {
250 BN_free(s
->srp_ctx
.N
);
254 s
->srp_ctx
.N
= BN_dup(N
);
257 if (s
->srp_ctx
.g
!= NULL
) {
258 if (!BN_copy(s
->srp_ctx
.g
, g
)) {
259 BN_free(s
->srp_ctx
.g
);
263 s
->srp_ctx
.g
= BN_dup(g
);
266 if (s
->srp_ctx
.s
!= NULL
) {
267 if (!BN_copy(s
->srp_ctx
.s
, sa
)) {
268 BN_free(s
->srp_ctx
.s
);
272 s
->srp_ctx
.s
= BN_dup(sa
);
275 if (s
->srp_ctx
.v
!= NULL
) {
276 if (!BN_copy(s
->srp_ctx
.v
, v
)) {
277 BN_free(s
->srp_ctx
.v
);
281 s
->srp_ctx
.v
= BN_dup(v
);
285 OPENSSL_free(s
->srp_ctx
.info
);
286 if ((s
->srp_ctx
.info
= BUF_strdup(info
)) == NULL
)
290 if (!(s
->srp_ctx
.N
) ||
291 !(s
->srp_ctx
.g
) || !(s
->srp_ctx
.s
) || !(s
->srp_ctx
.v
))
297 int srp_generate_server_master_secret(SSL
*s
)
299 BIGNUM
*K
= NULL
, *u
= NULL
;
300 int ret
= -1, tmp_len
= 0;
301 unsigned char *tmp
= NULL
;
303 if (!SRP_Verify_A_mod_N(s
->srp_ctx
.A
, s
->srp_ctx
.N
))
305 if ((u
= SRP_Calc_u(s
->srp_ctx
.A
, s
->srp_ctx
.B
, s
->srp_ctx
.N
)) == NULL
)
307 if ((K
= SRP_Calc_server_key(s
->srp_ctx
.A
, s
->srp_ctx
.v
, u
, s
->srp_ctx
.b
,
308 s
->srp_ctx
.N
)) == NULL
)
311 tmp_len
= BN_num_bytes(K
);
312 if ((tmp
= OPENSSL_malloc(tmp_len
)) == NULL
)
315 ret
= ssl_generate_master_secret(s
, tmp
, tmp_len
, 1);
323 int srp_generate_client_master_secret(SSL
*s
)
325 BIGNUM
*x
= NULL
, *u
= NULL
, *K
= NULL
;
326 int ret
= -1, tmp_len
= 0;
328 unsigned char *tmp
= NULL
;
331 * Checks if b % n == 0
333 if (SRP_Verify_B_mod_N(s
->srp_ctx
.B
, s
->srp_ctx
.N
) == 0)
335 if ((u
= SRP_Calc_u(s
->srp_ctx
.A
, s
->srp_ctx
.B
, s
->srp_ctx
.N
)) == NULL
)
337 if (s
->srp_ctx
.SRP_give_srp_client_pwd_callback
== NULL
)
341 s
->srp_ctx
.SRP_give_srp_client_pwd_callback(s
, s
->srp_ctx
.SRP_cb_arg
)))
343 if ((x
= SRP_Calc_x(s
->srp_ctx
.s
, s
->srp_ctx
.login
, passwd
)) == NULL
)
345 if ((K
= SRP_Calc_client_key(s
->srp_ctx
.N
, s
->srp_ctx
.B
, s
->srp_ctx
.g
, x
,
346 s
->srp_ctx
.a
, u
)) == NULL
)
349 tmp_len
= BN_num_bytes(K
);
350 if ((tmp
= OPENSSL_malloc(tmp_len
)) == NULL
)
353 ret
= ssl_generate_master_secret(s
, tmp
, tmp_len
, 1);
358 OPENSSL_clear_free(passwd
, strlen(passwd
));
363 int srp_verify_server_param(SSL
*s
, int *al
)
365 SRP_CTX
*srp
= &s
->srp_ctx
;
367 * Sanity check parameters: we can quickly check B % N == 0 by checking B
370 if (BN_ucmp(srp
->g
, srp
->N
) >= 0 || BN_ucmp(srp
->B
, srp
->N
) >= 0
371 || BN_is_zero(srp
->B
)) {
372 *al
= SSL3_AD_ILLEGAL_PARAMETER
;
376 if (BN_num_bits(srp
->N
) < srp
->strength
) {
377 *al
= TLS1_AD_INSUFFICIENT_SECURITY
;
381 if (srp
->SRP_verify_param_callback
) {
382 if (srp
->SRP_verify_param_callback(s
, srp
->SRP_cb_arg
) <= 0) {
383 *al
= TLS1_AD_INSUFFICIENT_SECURITY
;
386 } else if (!SRP_check_known_gN_param(srp
->g
, srp
->N
)) {
387 *al
= TLS1_AD_INSUFFICIENT_SECURITY
;
394 int SRP_Calc_A_param(SSL
*s
)
396 unsigned char rnd
[SSL_MAX_MASTER_KEY_LENGTH
];
398 if (RAND_bytes(rnd
, sizeof(rnd
)) <= 0)
400 s
->srp_ctx
.a
= BN_bin2bn(rnd
, sizeof(rnd
), s
->srp_ctx
.a
);
401 OPENSSL_cleanse(rnd
, sizeof(rnd
));
403 if (!(s
->srp_ctx
.A
= SRP_Calc_A(s
->srp_ctx
.a
, s
->srp_ctx
.N
, s
->srp_ctx
.g
)))
409 BIGNUM
*SSL_get_srp_g(SSL
*s
)
411 if (s
->srp_ctx
.g
!= NULL
)
413 return s
->ctx
->srp_ctx
.g
;
416 BIGNUM
*SSL_get_srp_N(SSL
*s
)
418 if (s
->srp_ctx
.N
!= NULL
)
420 return s
->ctx
->srp_ctx
.N
;
423 char *SSL_get_srp_username(SSL
*s
)
425 if (s
->srp_ctx
.login
!= NULL
)
426 return s
->srp_ctx
.login
;
427 return s
->ctx
->srp_ctx
.login
;
430 char *SSL_get_srp_userinfo(SSL
*s
)
432 if (s
->srp_ctx
.info
!= NULL
)
433 return s
->srp_ctx
.info
;
434 return s
->ctx
->srp_ctx
.info
;
437 # define tls1_ctx_ctrl ssl3_ctx_ctrl
438 # define tls1_ctx_callback_ctrl ssl3_ctx_callback_ctrl
440 int SSL_CTX_set_srp_username(SSL_CTX
*ctx
, char *name
)
442 return tls1_ctx_ctrl(ctx
, SSL_CTRL_SET_TLS_EXT_SRP_USERNAME
, 0, name
);
445 int SSL_CTX_set_srp_password(SSL_CTX
*ctx
, char *password
)
447 return tls1_ctx_ctrl(ctx
, SSL_CTRL_SET_TLS_EXT_SRP_PASSWORD
, 0, password
);
450 int SSL_CTX_set_srp_strength(SSL_CTX
*ctx
, int strength
)
452 return tls1_ctx_ctrl(ctx
, SSL_CTRL_SET_TLS_EXT_SRP_STRENGTH
, strength
,
456 int SSL_CTX_set_srp_verify_param_callback(SSL_CTX
*ctx
,
457 int (*cb
) (SSL
*, void *))
459 return tls1_ctx_callback_ctrl(ctx
, SSL_CTRL_SET_SRP_VERIFY_PARAM_CB
,
463 int SSL_CTX_set_srp_cb_arg(SSL_CTX
*ctx
, void *arg
)
465 return tls1_ctx_ctrl(ctx
, SSL_CTRL_SET_SRP_ARG
, 0, arg
);
468 int SSL_CTX_set_srp_username_callback(SSL_CTX
*ctx
,
469 int (*cb
) (SSL
*, int *, void *))
471 return tls1_ctx_callback_ctrl(ctx
, SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB
,
475 int SSL_CTX_set_srp_client_pwd_callback(SSL_CTX
*ctx
,
476 char *(*cb
) (SSL
*, void *))
478 return tls1_ctx_callback_ctrl(ctx
, SSL_CTRL_SET_SRP_GIVE_CLIENT_PWD_CB
,