[thirdparty/openssl.git] / crypto / dh / dh_check.c

/*
 * Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

#include <stdio.h>
#include "internal/cryptlib.h"
#include <openssl/bn.h>
#include "dh_locl.h"

# define DH_NUMBER_ITERATIONS_FOR_PRIME 64

/*-
 * Check that p and g are suitable enough
 *
 * p is odd
 * 1 < g < p - 1
 */
int DH_check_params_ex(const DH *dh)
{
    int errflags = 0;

    if (!DH_check_params(dh, &errflags))
        return 0;

    if ((errflags & DH_CHECK_P_NOT_PRIME) != 0)
        DHerr(DH_F_DH_CHECK_PARAMS_EX, DH_R_CHECK_P_NOT_PRIME);
    if ((errflags & DH_NOT_SUITABLE_GENERATOR) != 0)
        DHerr(DH_F_DH_CHECK_PARAMS_EX, DH_R_NOT_SUITABLE_GENERATOR);
    if ((errflags & DH_MODULUS_TOO_SMALL) != 0)
        DHerr(DH_F_DH_CHECK_PARAMS_EX, DH_R_MODULUS_TOO_SMALL);
    if ((errflags & DH_MODULUS_TOO_LARGE) != 0)
        DHerr(DH_F_DH_CHECK_PARAMS_EX, DH_R_MODULUS_TOO_LARGE);

    return errflags == 0;
}

int DH_check_params(const DH *dh, int *ret)
{
    int ok = 0;
    BIGNUM *tmp = NULL;
    BN_CTX *ctx = NULL;

    *ret = 0;
    ctx = BN_CTX_new();
    if (ctx == NULL)
        goto err;
    BN_CTX_start(ctx);
    tmp = BN_CTX_get(ctx);
    if (tmp == NULL)
        goto err;

    if (!BN_is_odd(dh->p))
        *ret |= DH_CHECK_P_NOT_PRIME;
    if (BN_is_negative(dh->g) || BN_is_zero(dh->g) || BN_is_one(dh->g))
        *ret |= DH_NOT_SUITABLE_GENERATOR;
    if (BN_copy(tmp, dh->p) == NULL || !BN_sub_word(tmp, 1))
        goto err;
    if (BN_cmp(dh->g, tmp) >= 0)
        *ret |= DH_NOT_SUITABLE_GENERATOR;
    if (BN_num_bits(dh->p) < DH_MIN_MODULUS_BITS)
        *ret |= DH_MODULUS_TOO_SMALL;
    if (BN_num_bits(dh->p) > OPENSSL_DH_MAX_MODULUS_BITS)
        *ret |= DH_MODULUS_TOO_LARGE;

    ok = 1;
 err:
    BN_CTX_end(ctx);
    BN_CTX_free(ctx);
    return ok;
}

/*-
 * Check that p is a safe prime and
 * g is a suitable generator.
 */
int DH_check_ex(const DH *dh)
{
    int errflags = 0;

    if (!DH_check(dh, &errflags))
        return 0;

    if ((errflags & DH_NOT_SUITABLE_GENERATOR) != 0)
        DHerr(DH_F_DH_CHECK_EX, DH_R_NOT_SUITABLE_GENERATOR);
    if ((errflags & DH_CHECK_Q_NOT_PRIME) != 0)
        DHerr(DH_F_DH_CHECK_EX, DH_R_CHECK_Q_NOT_PRIME);
    if ((errflags & DH_CHECK_INVALID_Q_VALUE) != 0)
        DHerr(DH_F_DH_CHECK_EX, DH_R_CHECK_INVALID_Q_VALUE);
    if ((errflags & DH_CHECK_INVALID_J_VALUE) != 0)
        DHerr(DH_F_DH_CHECK_EX, DH_R_CHECK_INVALID_J_VALUE);
    if ((errflags & DH_UNABLE_TO_CHECK_GENERATOR) != 0)
        DHerr(DH_F_DH_CHECK_EX, DH_R_UNABLE_TO_CHECK_GENERATOR);
    if ((errflags & DH_CHECK_P_NOT_PRIME) != 0)
        DHerr(DH_F_DH_CHECK_EX, DH_R_CHECK_P_NOT_PRIME);
    if ((errflags & DH_CHECK_P_NOT_SAFE_PRIME) != 0)
        DHerr(DH_F_DH_CHECK_EX, DH_R_CHECK_P_NOT_SAFE_PRIME);
    if ((errflags & DH_MODULUS_TOO_SMALL) != 0)
        DHerr(DH_F_DH_CHECK_EX, DH_R_MODULUS_TOO_SMALL);
    if ((errflags & DH_MODULUS_TOO_LARGE) != 0)
        DHerr(DH_F_DH_CHECK_EX, DH_R_MODULUS_TOO_LARGE);

    return errflags == 0;
}

int DH_check(const DH *dh, int *ret)
{
    int ok = 0, r;
    BN_CTX *ctx = NULL;
    BIGNUM *t1 = NULL, *t2 = NULL;

    if (!DH_check_params(dh, ret))
        return 0;

    ctx = BN_CTX_new();
    if (ctx == NULL)
        goto err;
    BN_CTX_start(ctx);
    t1 = BN_CTX_get(ctx);
    t2 = BN_CTX_get(ctx);
    if (t2 == NULL)
        goto err;

    if (dh->q) {
        if (BN_cmp(dh->g, BN_value_one()) <= 0)
            *ret |= DH_NOT_SUITABLE_GENERATOR;
        else if (BN_cmp(dh->g, dh->p) >= 0)
            *ret |= DH_NOT_SUITABLE_GENERATOR;
        else {
            /* Check g^q == 1 mod p */
            if (!BN_mod_exp(t1, dh->g, dh->q, dh->p, ctx))
                goto err;
            if (!BN_is_one(t1))
                *ret |= DH_NOT_SUITABLE_GENERATOR;
        }
        r = BN_is_prime_ex(dh->q, DH_NUMBER_ITERATIONS_FOR_PRIME, ctx, NULL);
        if (r < 0)
            goto err;
        if (!r)
            *ret |= DH_CHECK_Q_NOT_PRIME;
        /* Check p == 1 mod q  i.e. q divides p - 1 */
        if (!BN_div(t1, t2, dh->p, dh->q, ctx))
            goto err;
        if (!BN_is_one(t2))
            *ret |= DH_CHECK_INVALID_Q_VALUE;
        if (dh->j && BN_cmp(dh->j, t1))
            *ret |= DH_CHECK_INVALID_J_VALUE;
    }

    r = BN_is_prime_ex(dh->p, DH_NUMBER_ITERATIONS_FOR_PRIME, ctx, NULL);
    if (r < 0)
        goto err;
    if (!r)
        *ret |= DH_CHECK_P_NOT_PRIME;
    else if (!dh->q) {
        if (!BN_rshift1(t1, dh->p))
            goto err;
        r = BN_is_prime_ex(t1, DH_NUMBER_ITERATIONS_FOR_PRIME, ctx, NULL);
        if (r < 0)
            goto err;
        if (!r)
            *ret |= DH_CHECK_P_NOT_SAFE_PRIME;
    }
    ok = 1;
 err:
    BN_CTX_end(ctx);
    BN_CTX_free(ctx);
    return ok;
}

int DH_check_pub_key_ex(const DH *dh, const BIGNUM *pub_key)
{
    int errflags = 0;

    if (!DH_check_pub_key(dh, pub_key, &errflags))
        return 0;

    if ((errflags & DH_CHECK_PUBKEY_TOO_SMALL) != 0)
        DHerr(DH_F_DH_CHECK_PUB_KEY_EX, DH_R_CHECK_PUBKEY_TOO_SMALL);
    if ((errflags & DH_CHECK_PUBKEY_TOO_LARGE) != 0)
        DHerr(DH_F_DH_CHECK_PUB_KEY_EX, DH_R_CHECK_PUBKEY_TOO_LARGE);
    if ((errflags & DH_CHECK_PUBKEY_INVALID) != 0)
        DHerr(DH_F_DH_CHECK_PUB_KEY_EX, DH_R_CHECK_PUBKEY_INVALID);

    return errflags == 0;
}

int DH_check_pub_key(const DH *dh, const BIGNUM *pub_key, int *ret)
{
    int ok = 0;
    BIGNUM *tmp = NULL;
    BN_CTX *ctx = NULL;

    *ret = 0;
    ctx = BN_CTX_new();
    if (ctx == NULL)
        goto err;
    BN_CTX_start(ctx);
    tmp = BN_CTX_get(ctx);
    if (tmp == NULL || !BN_set_word(tmp, 1))
        goto err;
    if (BN_cmp(pub_key, tmp) <= 0)
        *ret |= DH_CHECK_PUBKEY_TOO_SMALL;
    if (BN_copy(tmp, dh->p) == NULL || !BN_sub_word(tmp, 1))
        goto err;
    if (BN_cmp(pub_key, tmp) >= 0)
        *ret |= DH_CHECK_PUBKEY_TOO_LARGE;

    if (dh->q != NULL) {
        /* Check pub_key^q == 1 mod p */
        if (!BN_mod_exp(tmp, pub_key, dh->q, dh->p, ctx))
            goto err;
        if (!BN_is_one(tmp))
            *ret |= DH_CHECK_PUBKEY_INVALID;
    }

    ok = 1;
 err:
    BN_CTX_end(ctx);
    BN_CTX_free(ctx);
    return ok;
}
Commit	Line	Data
aa6bb135	1	/*
a38c878c	2	* Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved.
d02b48c6	3	*
e38873f5	4	* Licensed under the Apache License 2.0 (the "License"). You may not use
aa6bb135 RS	5	* this file except in compliance with the License. You can obtain a copy
	6	* in the file LICENSE in the source distribution or at
	7	* https://www.openssl.org/source/license.html
d02b48c6 RE	8	*/
	9
	10	#include <stdio.h>
b39fc560	11	#include "internal/cryptlib.h"
ec577822	12	#include <openssl/bn.h>
0aeddcfa	13	#include "dh_locl.h"
d02b48c6	14
2500c093 JM	15	# define DH_NUMBER_ITERATIONS_FOR_PRIME 64
2500c093 JM	16
26505153 RL	17	/*-
	18	* Check that p and g are suitable enough
	19	*
	20	* p is odd
	21	* 1 < g < p - 1
	22	*/
b0004708 PY	23	int DH_check_params_ex(const DH *dh)
	24	{
	25	int errflags = 0;
	26
a38c878c BE	27	if (!DH_check_params(dh, &errflags))
a38c878c BE	28	return 0;
b0004708 PY	29
	30	if ((errflags & DH_CHECK_P_NOT_PRIME) != 0)
	31	DHerr(DH_F_DH_CHECK_PARAMS_EX, DH_R_CHECK_P_NOT_PRIME);
	32	if ((errflags & DH_NOT_SUITABLE_GENERATOR) != 0)
	33	DHerr(DH_F_DH_CHECK_PARAMS_EX, DH_R_NOT_SUITABLE_GENERATOR);
feeb7ecd BE	34	if ((errflags & DH_MODULUS_TOO_SMALL) != 0)
	35	DHerr(DH_F_DH_CHECK_PARAMS_EX, DH_R_MODULUS_TOO_SMALL);
	36	if ((errflags & DH_MODULUS_TOO_LARGE) != 0)
	37	DHerr(DH_F_DH_CHECK_PARAMS_EX, DH_R_MODULUS_TOO_LARGE);
b0004708 PY	38
	39	return errflags == 0;
	40	}
26505153 RL	41
	42	int DH_check_params(const DH dh, int ret)
	43	{
	44	int ok = 0;
	45	BIGNUM *tmp = NULL;
	46	BN_CTX *ctx = NULL;
	47
	48	*ret = 0;
	49	ctx = BN_CTX_new();
	50	if (ctx == NULL)
	51	goto err;
	52	BN_CTX_start(ctx);
	53	tmp = BN_CTX_get(ctx);
	54	if (tmp == NULL)
	55	goto err;
	56
	57	if (!BN_is_odd(dh->p))
	58	*ret \|= DH_CHECK_P_NOT_PRIME;
	59	if (BN_is_negative(dh->g) \|\| BN_is_zero(dh->g) \|\| BN_is_one(dh->g))
	60	*ret \|= DH_NOT_SUITABLE_GENERATOR;
	61	if (BN_copy(tmp, dh->p) == NULL \|\| !BN_sub_word(tmp, 1))
	62	goto err;
	63	if (BN_cmp(dh->g, tmp) >= 0)
	64	*ret \|= DH_NOT_SUITABLE_GENERATOR;
feeb7ecd BE	65	if (BN_num_bits(dh->p) < DH_MIN_MODULUS_BITS)
	66	*ret \|= DH_MODULUS_TOO_SMALL;
	67	if (BN_num_bits(dh->p) > OPENSSL_DH_MAX_MODULUS_BITS)
	68	*ret \|= DH_MODULUS_TOO_LARGE;
26505153 RL	69
	70	ok = 1;
	71	err:
ce1415ed SL	72	BN_CTX_end(ctx);
ce1415ed SL	73	BN_CTX_free(ctx);
26a7d938	74	return ok;
26505153 RL	75	}
26505153 RL	76
1d97c843 TH	77	/*-
1d97c843 TH	78	* Check that p is a safe prime and
a38c878c	79	* g is a suitable generator.
d02b48c6	80	*/
b0004708 PY	81	int DH_check_ex(const DH *dh)
	82	{
	83	int errflags = 0;
	84
a38c878c BE	85	if (!DH_check(dh, &errflags))
a38c878c BE	86	return 0;
b0004708 PY	87
	88	if ((errflags & DH_NOT_SUITABLE_GENERATOR) != 0)
	89	DHerr(DH_F_DH_CHECK_EX, DH_R_NOT_SUITABLE_GENERATOR);
	90	if ((errflags & DH_CHECK_Q_NOT_PRIME) != 0)
	91	DHerr(DH_F_DH_CHECK_EX, DH_R_CHECK_Q_NOT_PRIME);
	92	if ((errflags & DH_CHECK_INVALID_Q_VALUE) != 0)
	93	DHerr(DH_F_DH_CHECK_EX, DH_R_CHECK_INVALID_Q_VALUE);
	94	if ((errflags & DH_CHECK_INVALID_J_VALUE) != 0)
	95	DHerr(DH_F_DH_CHECK_EX, DH_R_CHECK_INVALID_J_VALUE);
	96	if ((errflags & DH_UNABLE_TO_CHECK_GENERATOR) != 0)
	97	DHerr(DH_F_DH_CHECK_EX, DH_R_UNABLE_TO_CHECK_GENERATOR);
	98	if ((errflags & DH_CHECK_P_NOT_PRIME) != 0)
	99	DHerr(DH_F_DH_CHECK_EX, DH_R_CHECK_P_NOT_PRIME);
	100	if ((errflags & DH_CHECK_P_NOT_SAFE_PRIME) != 0)
	101	DHerr(DH_F_DH_CHECK_EX, DH_R_CHECK_P_NOT_SAFE_PRIME);
feeb7ecd BE	102	if ((errflags & DH_MODULUS_TOO_SMALL) != 0)
	103	DHerr(DH_F_DH_CHECK_EX, DH_R_MODULUS_TOO_SMALL);
	104	if ((errflags & DH_MODULUS_TOO_LARGE) != 0)
	105	DHerr(DH_F_DH_CHECK_EX, DH_R_MODULUS_TOO_LARGE);
b0004708 PY	106
	107	return errflags == 0;
	108	}
d02b48c6	109
f971ccb2	110	int DH_check(const DH dh, int ret)
0f113f3e	111	{
748e8530	112	int ok = 0, r;
0f113f3e	113	BN_CTX *ctx = NULL;
0f113f3e MC	114	BIGNUM t1 = NULL, t2 = NULL;
0f113f3e MC	115
a38c878c BE	116	if (!DH_check_params(dh, ret))
	117	return 0;
	118
0f113f3e MC	119	ctx = BN_CTX_new();
	120	if (ctx == NULL)
	121	goto err;
	122	BN_CTX_start(ctx);
	123	t1 = BN_CTX_get(ctx);
0f113f3e MC	124	t2 = BN_CTX_get(ctx);
	125	if (t2 == NULL)
	126	goto err;
d02b48c6	127
0f113f3e MC	128	if (dh->q) {
	129	if (BN_cmp(dh->g, BN_value_one()) <= 0)
	130	*ret \|= DH_NOT_SUITABLE_GENERATOR;
	131	else if (BN_cmp(dh->g, dh->p) >= 0)
	132	*ret \|= DH_NOT_SUITABLE_GENERATOR;
	133	else {
	134	/* Check g^q == 1 mod p */
	135	if (!BN_mod_exp(t1, dh->g, dh->q, dh->p, ctx))
	136	goto err;
	137	if (!BN_is_one(t1))
	138	*ret \|= DH_NOT_SUITABLE_GENERATOR;
	139	}
2500c093	140	r = BN_is_prime_ex(dh->q, DH_NUMBER_ITERATIONS_FOR_PRIME, ctx, NULL);
748e8530 DB	141	if (r < 0)
	142	goto err;
	143	if (!r)
0f113f3e MC	144	*ret \|= DH_CHECK_Q_NOT_PRIME;
	145	/* Check p == 1 mod q i.e. q divides p - 1 */
	146	if (!BN_div(t1, t2, dh->p, dh->q, ctx))
	147	goto err;
	148	if (!BN_is_one(t2))
	149	*ret \|= DH_CHECK_INVALID_Q_VALUE;
	150	if (dh->j && BN_cmp(dh->j, t1))
	151	*ret \|= DH_CHECK_INVALID_J_VALUE;
a38c878c	152	}
d02b48c6	153
2500c093	154	r = BN_is_prime_ex(dh->p, DH_NUMBER_ITERATIONS_FOR_PRIME, ctx, NULL);
748e8530 DB	155	if (r < 0)
	156	goto err;
	157	if (!r)
0f113f3e MC	158	*ret \|= DH_CHECK_P_NOT_PRIME;
	159	else if (!dh->q) {
	160	if (!BN_rshift1(t1, dh->p))
	161	goto err;
2500c093	162	r = BN_is_prime_ex(t1, DH_NUMBER_ITERATIONS_FOR_PRIME, ctx, NULL);
748e8530 DB	163	if (r < 0)
748e8530 DB	164	goto err;
e705fcf1	165	if (!r)
0f113f3e MC	166	*ret \|= DH_CHECK_P_NOT_SAFE_PRIME;
	167	}
	168	ok = 1;
	169	err:
ce1415ed SL	170	BN_CTX_end(ctx);
ce1415ed SL	171	BN_CTX_free(ctx);
26a7d938	172	return ok;
0f113f3e	173	}
bf3d6c0c	174
b0004708 PY	175	int DH_check_pub_key_ex(const DH dh, const BIGNUM pub_key)
	176	{
	177	int errflags = 0;
	178
2b95e8ef BE	179	if (!DH_check_pub_key(dh, pub_key, &errflags))
2b95e8ef BE	180	return 0;
b0004708 PY	181
	182	if ((errflags & DH_CHECK_PUBKEY_TOO_SMALL) != 0)
	183	DHerr(DH_F_DH_CHECK_PUB_KEY_EX, DH_R_CHECK_PUBKEY_TOO_SMALL);
	184	if ((errflags & DH_CHECK_PUBKEY_TOO_LARGE) != 0)
	185	DHerr(DH_F_DH_CHECK_PUB_KEY_EX, DH_R_CHECK_PUBKEY_TOO_LARGE);
	186	if ((errflags & DH_CHECK_PUBKEY_INVALID) != 0)
	187	DHerr(DH_F_DH_CHECK_PUB_KEY_EX, DH_R_CHECK_PUBKEY_INVALID);
	188
	189	return errflags == 0;
	190	}
	191
bf3d6c0c	192	int DH_check_pub_key(const DH dh, const BIGNUM pub_key, int *ret)
0f113f3e MC	193	{
0f113f3e MC	194	int ok = 0;
b128abc3 MC	195	BIGNUM *tmp = NULL;
b128abc3 MC	196	BN_CTX *ctx = NULL;
bf3d6c0c	197
0f113f3e	198	*ret = 0;
b128abc3 MC	199	ctx = BN_CTX_new();
b128abc3 MC	200	if (ctx == NULL)
0f113f3e	201	goto err;
b128abc3 MC	202	BN_CTX_start(ctx);
b128abc3 MC	203	tmp = BN_CTX_get(ctx);
f5a12207	204	if (tmp == NULL \|\| !BN_set_word(tmp, 1))
b128abc3	205	goto err;
b128abc3	206	if (BN_cmp(pub_key, tmp) <= 0)
0f113f3e	207	*ret \|= DH_CHECK_PUBKEY_TOO_SMALL;
f5a12207 MC	208	if (BN_copy(tmp, dh->p) == NULL \|\| !BN_sub_word(tmp, 1))
f5a12207 MC	209	goto err;
b128abc3	210	if (BN_cmp(pub_key, tmp) >= 0)
0f113f3e	211	*ret \|= DH_CHECK_PUBKEY_TOO_LARGE;
bf3d6c0c	212
b128abc3 MC	213	if (dh->q != NULL) {
	214	/* Check pub_key^q == 1 mod p */
	215	if (!BN_mod_exp(tmp, pub_key, dh->q, dh->p, ctx))
	216	goto err;
	217	if (!BN_is_one(tmp))
	218	*ret \|= DH_CHECK_PUBKEY_INVALID;
	219	}
	220
0f113f3e MC	221	ok = 1;
0f113f3e MC	222	err:
ce1415ed SL	223	BN_CTX_end(ctx);
ce1415ed SL	224	BN_CTX_free(ctx);
26a7d938	225	return ok;
0f113f3e	226	}