]>
Commit | Line | Data |
---|---|---|
2124e869 BL |
1 | #include "jpake.h" |
2 | ||
3 | #include <openssl/crypto.h> | |
4 | #include <openssl/sha.h> | |
5 | #include <openssl/err.h> | |
6 | #include <memory.h> | |
7 | #include <assert.h> | |
8 | ||
9 | /* | |
10 | * In the definition, (xa, xb, xc, xd) are Alice's (x1, x2, x3, x4) or | |
11 | * Bob's (x3, x4, x1, x2). If you see what I mean. | |
12 | */ | |
13 | ||
40720ce3 MC |
14 | typedef struct { |
15 | char *name; /* Must be unique */ | |
2124e869 BL |
16 | char *peer_name; |
17 | BIGNUM *p; | |
18 | BIGNUM *g; | |
19 | BIGNUM *q; | |
40720ce3 MC |
20 | BIGNUM *gxc; /* Alice's g^{x3} or Bob's g^{x1} */ |
21 | BIGNUM *gxd; /* Alice's g^{x4} or Bob's g^{x2} */ | |
22 | } JPAKE_CTX_PUBLIC; | |
2124e869 | 23 | |
40720ce3 | 24 | struct JPAKE_CTX { |
2124e869 | 25 | JPAKE_CTX_PUBLIC p; |
40720ce3 | 26 | BIGNUM *secret; /* The shared secret */ |
2124e869 | 27 | BN_CTX *ctx; |
40720ce3 MC |
28 | BIGNUM *xa; /* Alice's x1 or Bob's x3 */ |
29 | BIGNUM *xb; /* Alice's x2 or Bob's x4 */ | |
30 | BIGNUM *key; /* The calculated (shared) key */ | |
31 | }; | |
2124e869 BL |
32 | |
33 | static void JPAKE_ZKP_init(JPAKE_ZKP *zkp) | |
40720ce3 | 34 | { |
2124e869 BL |
35 | zkp->gr = BN_new(); |
36 | zkp->b = BN_new(); | |
40720ce3 | 37 | } |
2124e869 BL |
38 | |
39 | static void JPAKE_ZKP_release(JPAKE_ZKP *zkp) | |
40720ce3 | 40 | { |
2124e869 BL |
41 | BN_free(zkp->b); |
42 | BN_free(zkp->gr); | |
40720ce3 | 43 | } |
2124e869 | 44 | |
c10f53a8 | 45 | /* Two birds with one stone - make the global name as expected */ |
40720ce3 MC |
46 | #define JPAKE_STEP_PART_init JPAKE_STEP2_init |
47 | #define JPAKE_STEP_PART_release JPAKE_STEP2_release | |
2124e869 BL |
48 | |
49 | void JPAKE_STEP_PART_init(JPAKE_STEP_PART *p) | |
40720ce3 | 50 | { |
2124e869 BL |
51 | p->gx = BN_new(); |
52 | JPAKE_ZKP_init(&p->zkpx); | |
40720ce3 | 53 | } |
2124e869 BL |
54 | |
55 | void JPAKE_STEP_PART_release(JPAKE_STEP_PART *p) | |
40720ce3 | 56 | { |
2124e869 BL |
57 | JPAKE_ZKP_release(&p->zkpx); |
58 | BN_free(p->gx); | |
40720ce3 | 59 | } |
2124e869 BL |
60 | |
61 | void JPAKE_STEP1_init(JPAKE_STEP1 *s1) | |
40720ce3 | 62 | { |
2124e869 BL |
63 | JPAKE_STEP_PART_init(&s1->p1); |
64 | JPAKE_STEP_PART_init(&s1->p2); | |
40720ce3 | 65 | } |
2124e869 BL |
66 | |
67 | void JPAKE_STEP1_release(JPAKE_STEP1 *s1) | |
40720ce3 | 68 | { |
2124e869 BL |
69 | JPAKE_STEP_PART_release(&s1->p2); |
70 | JPAKE_STEP_PART_release(&s1->p1); | |
40720ce3 | 71 | } |
2124e869 BL |
72 | |
73 | static void JPAKE_CTX_init(JPAKE_CTX *ctx, const char *name, | |
40720ce3 MC |
74 | const char *peer_name, const BIGNUM *p, |
75 | const BIGNUM *g, const BIGNUM *q, | |
76 | const BIGNUM *secret) | |
77 | { | |
2124e869 BL |
78 | ctx->p.name = OPENSSL_strdup(name); |
79 | ctx->p.peer_name = OPENSSL_strdup(peer_name); | |
80 | ctx->p.p = BN_dup(p); | |
81 | ctx->p.g = BN_dup(g); | |
82 | ctx->p.q = BN_dup(q); | |
83 | ctx->secret = BN_dup(secret); | |
84 | ||
85 | ctx->p.gxc = BN_new(); | |
86 | ctx->p.gxd = BN_new(); | |
87 | ||
88 | ctx->xa = BN_new(); | |
89 | ctx->xb = BN_new(); | |
90 | ctx->key = BN_new(); | |
91 | ctx->ctx = BN_CTX_new(); | |
40720ce3 MC |
92 | } |
93 | ||
2124e869 | 94 | static void JPAKE_CTX_release(JPAKE_CTX *ctx) |
40720ce3 | 95 | { |
2124e869 BL |
96 | BN_CTX_free(ctx->ctx); |
97 | BN_clear_free(ctx->key); | |
98 | BN_clear_free(ctx->xb); | |
99 | BN_clear_free(ctx->xa); | |
100 | ||
101 | BN_free(ctx->p.gxd); | |
102 | BN_free(ctx->p.gxc); | |
103 | ||
104 | BN_clear_free(ctx->secret); | |
105 | BN_free(ctx->p.q); | |
106 | BN_free(ctx->p.g); | |
107 | BN_free(ctx->p.p); | |
108 | OPENSSL_free(ctx->p.peer_name); | |
109 | OPENSSL_free(ctx->p.name); | |
110 | ||
111 | memset(ctx, '\0', sizeof *ctx); | |
40720ce3 MC |
112 | } |
113 | ||
2124e869 | 114 | JPAKE_CTX *JPAKE_CTX_new(const char *name, const char *peer_name, |
40720ce3 MC |
115 | const BIGNUM *p, const BIGNUM *g, const BIGNUM *q, |
116 | const BIGNUM *secret) | |
117 | { | |
2124e869 BL |
118 | JPAKE_CTX *ctx = OPENSSL_malloc(sizeof *ctx); |
119 | ||
120 | JPAKE_CTX_init(ctx, name, peer_name, p, g, q, secret); | |
121 | ||
122 | return ctx; | |
40720ce3 | 123 | } |
2124e869 BL |
124 | |
125 | void JPAKE_CTX_free(JPAKE_CTX *ctx) | |
40720ce3 | 126 | { |
2124e869 BL |
127 | JPAKE_CTX_release(ctx); |
128 | OPENSSL_free(ctx); | |
40720ce3 | 129 | } |
2124e869 BL |
130 | |
131 | static void hashlength(SHA_CTX *sha, size_t l) | |
40720ce3 | 132 | { |
2124e869 BL |
133 | unsigned char b[2]; |
134 | ||
135 | assert(l <= 0xffff); | |
136 | b[0] = l >> 8; | |
40720ce3 | 137 | b[1] = l & 0xff; |
2124e869 | 138 | SHA1_Update(sha, b, 2); |
40720ce3 | 139 | } |
2124e869 BL |
140 | |
141 | static void hashstring(SHA_CTX *sha, const char *string) | |
40720ce3 | 142 | { |
2124e869 BL |
143 | size_t l = strlen(string); |
144 | ||
145 | hashlength(sha, l); | |
146 | SHA1_Update(sha, string, l); | |
40720ce3 | 147 | } |
2124e869 BL |
148 | |
149 | static void hashbn(SHA_CTX *sha, const BIGNUM *bn) | |
40720ce3 | 150 | { |
2124e869 | 151 | size_t l = BN_num_bytes(bn); |
9af68029 | 152 | unsigned char *bin = OPENSSL_malloc(l); |
2124e869 BL |
153 | |
154 | hashlength(sha, l); | |
155 | BN_bn2bin(bn, bin); | |
156 | SHA1_Update(sha, bin, l); | |
9af68029 | 157 | OPENSSL_free(bin); |
40720ce3 | 158 | } |
2124e869 | 159 | |
c10f53a8 | 160 | /* h=hash(g, g^r, g^x, name) */ |
2124e869 | 161 | static void zkp_hash(BIGNUM *h, const BIGNUM *zkpg, const JPAKE_STEP_PART *p, |
40720ce3 MC |
162 | const char *proof_name) |
163 | { | |
2124e869 BL |
164 | unsigned char md[SHA_DIGEST_LENGTH]; |
165 | SHA_CTX sha; | |
166 | ||
40720ce3 MC |
167 | /* |
168 | * XXX: hash should not allow moving of the boundaries - Java code | |
169 | * is flawed in this respect. Length encoding seems simplest. | |
170 | */ | |
2124e869 BL |
171 | SHA1_Init(&sha); |
172 | hashbn(&sha, zkpg); | |
173 | assert(!BN_is_zero(p->zkpx.gr)); | |
174 | hashbn(&sha, p->zkpx.gr); | |
175 | hashbn(&sha, p->gx); | |
176 | hashstring(&sha, proof_name); | |
177 | SHA1_Final(md, &sha); | |
178 | BN_bin2bn(md, SHA_DIGEST_LENGTH, h); | |
40720ce3 | 179 | } |
2124e869 | 180 | |
c10f53a8 DSH |
181 | /* |
182 | * Prove knowledge of x | |
183 | * Note that p->gx has already been calculated | |
184 | */ | |
2124e869 | 185 | static void generate_zkp(JPAKE_STEP_PART *p, const BIGNUM *x, |
40720ce3 MC |
186 | const BIGNUM *zkpg, JPAKE_CTX *ctx) |
187 | { | |
2124e869 BL |
188 | BIGNUM *r = BN_new(); |
189 | BIGNUM *h = BN_new(); | |
190 | BIGNUM *t = BN_new(); | |
191 | ||
3e8042c3 | 192 | /*- |
c10f53a8 DSH |
193 | * r in [0,q) |
194 | * XXX: Java chooses r in [0, 2^160) - i.e. distribution not uniform | |
195 | */ | |
2124e869 | 196 | BN_rand_range(r, ctx->p.q); |
40720ce3 | 197 | /* g^r */ |
2124e869 BL |
198 | BN_mod_exp(p->zkpx.gr, zkpg, r, ctx->p.p, ctx->ctx); |
199 | ||
40720ce3 | 200 | /* h=hash... */ |
2124e869 BL |
201 | zkp_hash(h, zkpg, p, ctx->p.name); |
202 | ||
40720ce3 | 203 | /* b = r - x*h */ |
2124e869 BL |
204 | BN_mod_mul(t, x, h, ctx->p.q, ctx->ctx); |
205 | BN_mod_sub(p->zkpx.b, r, t, ctx->p.q, ctx->ctx); | |
206 | ||
40720ce3 | 207 | /* cleanup */ |
2124e869 BL |
208 | BN_free(t); |
209 | BN_free(h); | |
210 | BN_free(r); | |
40720ce3 | 211 | } |
2124e869 BL |
212 | |
213 | static int verify_zkp(const JPAKE_STEP_PART *p, const BIGNUM *zkpg, | |
40720ce3 MC |
214 | JPAKE_CTX *ctx) |
215 | { | |
2124e869 BL |
216 | BIGNUM *h = BN_new(); |
217 | BIGNUM *t1 = BN_new(); | |
218 | BIGNUM *t2 = BN_new(); | |
219 | BIGNUM *t3 = BN_new(); | |
220 | int ret = 0; | |
221 | ||
222 | zkp_hash(h, zkpg, p, ctx->p.peer_name); | |
223 | ||
40720ce3 | 224 | /* t1 = g^b */ |
2124e869 | 225 | BN_mod_exp(t1, zkpg, p->zkpx.b, ctx->p.p, ctx->ctx); |
40720ce3 | 226 | /* t2 = (g^x)^h = g^{hx} */ |
2124e869 | 227 | BN_mod_exp(t2, p->gx, h, ctx->p.p, ctx->ctx); |
40720ce3 | 228 | /* t3 = t1 * t2 = g^{hx} * g^b = g^{hx+b} = g^r (allegedly) */ |
2124e869 BL |
229 | BN_mod_mul(t3, t1, t2, ctx->p.p, ctx->ctx); |
230 | ||
40720ce3 MC |
231 | /* verify t3 == g^r */ |
232 | if (BN_cmp(t3, p->zkpx.gr) == 0) | |
233 | ret = 1; | |
2124e869 | 234 | else |
40720ce3 | 235 | JPAKEerr(JPAKE_F_VERIFY_ZKP, JPAKE_R_ZKP_VERIFY_FAILED); |
2124e869 | 236 | |
40720ce3 | 237 | /* cleanup */ |
2124e869 BL |
238 | BN_free(t3); |
239 | BN_free(t2); | |
240 | BN_free(t1); | |
241 | BN_free(h); | |
242 | ||
243 | return ret; | |
40720ce3 | 244 | } |
2124e869 BL |
245 | |
246 | static void generate_step_part(JPAKE_STEP_PART *p, const BIGNUM *x, | |
40720ce3 MC |
247 | const BIGNUM *g, JPAKE_CTX *ctx) |
248 | { | |
2124e869 BL |
249 | BN_mod_exp(p->gx, g, x, ctx->p.p, ctx->ctx); |
250 | generate_zkp(p, x, g, ctx); | |
40720ce3 | 251 | } |
2124e869 | 252 | |
c10f53a8 | 253 | /* Generate each party's random numbers. xa is in [0, q), xb is in [1, q). */ |
2124e869 | 254 | static void genrand(JPAKE_CTX *ctx) |
40720ce3 | 255 | { |
2124e869 BL |
256 | BIGNUM *qm1; |
257 | ||
40720ce3 | 258 | /* xa in [0, q) */ |
2124e869 BL |
259 | BN_rand_range(ctx->xa, ctx->p.q); |
260 | ||
40720ce3 | 261 | /* q-1 */ |
2124e869 BL |
262 | qm1 = BN_new(); |
263 | BN_copy(qm1, ctx->p.q); | |
264 | BN_sub_word(qm1, 1); | |
265 | ||
40720ce3 | 266 | /* ... and xb in [0, q-1) */ |
2124e869 | 267 | BN_rand_range(ctx->xb, qm1); |
40720ce3 | 268 | /* [1, q) */ |
2124e869 BL |
269 | BN_add_word(ctx->xb, 1); |
270 | ||
40720ce3 | 271 | /* cleanup */ |
2124e869 | 272 | BN_free(qm1); |
40720ce3 | 273 | } |
2124e869 BL |
274 | |
275 | int JPAKE_STEP1_generate(JPAKE_STEP1 *send, JPAKE_CTX *ctx) | |
40720ce3 | 276 | { |
2124e869 BL |
277 | genrand(ctx); |
278 | generate_step_part(&send->p1, ctx->xa, ctx->p.g, ctx); | |
279 | generate_step_part(&send->p2, ctx->xb, ctx->p.g, ctx); | |
280 | ||
281 | return 1; | |
40720ce3 | 282 | } |
2124e869 | 283 | |
efed63d7 BL |
284 | /* g^x is a legal value */ |
285 | static int is_legal(const BIGNUM *gx, const JPAKE_CTX *ctx) | |
40720ce3 | 286 | { |
efed63d7 BL |
287 | BIGNUM *t; |
288 | int res; | |
40720ce3 MC |
289 | |
290 | if (BN_is_negative(gx) || BN_is_zero(gx) || BN_cmp(gx, ctx->p.p) >= 0) | |
291 | return 0; | |
efed63d7 BL |
292 | |
293 | t = BN_new(); | |
294 | BN_mod_exp(t, gx, ctx->p.q, ctx->p.p, ctx->ctx); | |
295 | res = BN_is_one(t); | |
296 | BN_free(t); | |
297 | ||
298 | return res; | |
40720ce3 | 299 | } |
efed63d7 | 300 | |
2124e869 | 301 | int JPAKE_STEP1_process(JPAKE_CTX *ctx, const JPAKE_STEP1 *received) |
40720ce3 MC |
302 | { |
303 | if (!is_legal(received->p1.gx, ctx)) { | |
304 | JPAKEerr(JPAKE_F_JPAKE_STEP1_PROCESS, | |
305 | JPAKE_R_G_TO_THE_X3_IS_NOT_LEGAL); | |
306 | return 0; | |
307 | } | |
efed63d7 | 308 | |
40720ce3 MC |
309 | if (!is_legal(received->p2.gx, ctx)) { |
310 | JPAKEerr(JPAKE_F_JPAKE_STEP1_PROCESS, | |
311 | JPAKE_R_G_TO_THE_X4_IS_NOT_LEGAL); | |
312 | return 0; | |
313 | } | |
efed63d7 BL |
314 | |
315 | /* verify their ZKP(xc) */ | |
40720ce3 MC |
316 | if (!verify_zkp(&received->p1, ctx->p.g, ctx)) { |
317 | JPAKEerr(JPAKE_F_JPAKE_STEP1_PROCESS, JPAKE_R_VERIFY_X3_FAILED); | |
318 | return 0; | |
319 | } | |
2124e869 | 320 | |
efed63d7 | 321 | /* verify their ZKP(xd) */ |
40720ce3 MC |
322 | if (!verify_zkp(&received->p2, ctx->p.g, ctx)) { |
323 | JPAKEerr(JPAKE_F_JPAKE_STEP1_PROCESS, JPAKE_R_VERIFY_X4_FAILED); | |
324 | return 0; | |
325 | } | |
2124e869 | 326 | |
efed63d7 | 327 | /* g^xd != 1 */ |
40720ce3 MC |
328 | if (BN_is_one(received->p2.gx)) { |
329 | JPAKEerr(JPAKE_F_JPAKE_STEP1_PROCESS, JPAKE_R_G_TO_THE_X4_IS_ONE); | |
330 | return 0; | |
331 | } | |
2124e869 | 332 | |
40720ce3 | 333 | /* Save the bits we need for later */ |
2124e869 BL |
334 | BN_copy(ctx->p.gxc, received->p1.gx); |
335 | BN_copy(ctx->p.gxd, received->p2.gx); | |
336 | ||
337 | return 1; | |
40720ce3 | 338 | } |
2124e869 BL |
339 | |
340 | int JPAKE_STEP2_generate(JPAKE_STEP2 *send, JPAKE_CTX *ctx) | |
40720ce3 | 341 | { |
2124e869 BL |
342 | BIGNUM *t1 = BN_new(); |
343 | BIGNUM *t2 = BN_new(); | |
344 | ||
b558c8d5 | 345 | /*- |
c10f53a8 DSH |
346 | * X = g^{(xa + xc + xd) * xb * s} |
347 | * t1 = g^xa | |
348 | */ | |
2124e869 | 349 | BN_mod_exp(t1, ctx->p.g, ctx->xa, ctx->p.p, ctx->ctx); |
40720ce3 | 350 | /* t2 = t1 * g^{xc} = g^{xa} * g^{xc} = g^{xa + xc} */ |
2124e869 | 351 | BN_mod_mul(t2, t1, ctx->p.gxc, ctx->p.p, ctx->ctx); |
40720ce3 | 352 | /* t1 = t2 * g^{xd} = g^{xa + xc + xd} */ |
2124e869 | 353 | BN_mod_mul(t1, t2, ctx->p.gxd, ctx->p.p, ctx->ctx); |
40720ce3 | 354 | /* t2 = xb * s */ |
2124e869 BL |
355 | BN_mod_mul(t2, ctx->xb, ctx->secret, ctx->p.q, ctx->ctx); |
356 | ||
b558c8d5 | 357 | /*- |
c10f53a8 DSH |
358 | * ZKP(xb * s) |
359 | * XXX: this is kinda funky, because we're using | |
360 | * | |
361 | * g' = g^{xa + xc + xd} | |
362 | * | |
363 | * as the generator, which means X is g'^{xb * s} | |
364 | * X = t1^{t2} = t1^{xb * s} = g^{(xa + xc + xd) * xb * s} | |
365 | */ | |
2124e869 BL |
366 | generate_step_part(send, t2, t1, ctx); |
367 | ||
40720ce3 | 368 | /* cleanup */ |
2124e869 BL |
369 | BN_free(t1); |
370 | BN_free(t2); | |
371 | ||
372 | return 1; | |
40720ce3 | 373 | } |
2124e869 | 374 | |
c10f53a8 | 375 | /* gx = g^{xc + xa + xb} * xd * s */ |
2124e869 | 376 | static int compute_key(JPAKE_CTX *ctx, const BIGNUM *gx) |
40720ce3 | 377 | { |
2124e869 BL |
378 | BIGNUM *t1 = BN_new(); |
379 | BIGNUM *t2 = BN_new(); | |
380 | BIGNUM *t3 = BN_new(); | |
381 | ||
b558c8d5 | 382 | /*- |
c10f53a8 DSH |
383 | * K = (gx/g^{xb * xd * s})^{xb} |
384 | * = (g^{(xc + xa + xb) * xd * s - xb * xd *s})^{xb} | |
385 | * = (g^{(xa + xc) * xd * s})^{xb} | |
386 | * = g^{(xa + xc) * xb * xd * s} | |
387 | * [which is the same regardless of who calculates it] | |
388 | */ | |
2124e869 | 389 | |
40720ce3 | 390 | /* t1 = (g^{xd})^{xb} = g^{xb * xd} */ |
2124e869 | 391 | BN_mod_exp(t1, ctx->p.gxd, ctx->xb, ctx->p.p, ctx->ctx); |
40720ce3 | 392 | /* t2 = -s = q-s */ |
2124e869 | 393 | BN_sub(t2, ctx->p.q, ctx->secret); |
40720ce3 | 394 | /* t3 = t1^t2 = g^{-xb * xd * s} */ |
2124e869 | 395 | BN_mod_exp(t3, t1, t2, ctx->p.p, ctx->ctx); |
40720ce3 | 396 | /* t1 = gx * t3 = X/g^{xb * xd * s} */ |
2124e869 | 397 | BN_mod_mul(t1, gx, t3, ctx->p.p, ctx->ctx); |
40720ce3 | 398 | /* K = t1^{xb} */ |
2124e869 BL |
399 | BN_mod_exp(ctx->key, t1, ctx->xb, ctx->p.p, ctx->ctx); |
400 | ||
40720ce3 | 401 | /* cleanup */ |
2124e869 BL |
402 | BN_free(t3); |
403 | BN_free(t2); | |
404 | BN_free(t1); | |
405 | ||
406 | return 1; | |
40720ce3 | 407 | } |
2124e869 BL |
408 | |
409 | int JPAKE_STEP2_process(JPAKE_CTX *ctx, const JPAKE_STEP2 *received) | |
40720ce3 | 410 | { |
2124e869 BL |
411 | BIGNUM *t1 = BN_new(); |
412 | BIGNUM *t2 = BN_new(); | |
413 | int ret = 0; | |
414 | ||
b558c8d5 | 415 | /*- |
c10f53a8 DSH |
416 | * g' = g^{xc + xa + xb} [from our POV] |
417 | * t1 = xa + xb | |
418 | */ | |
2124e869 | 419 | BN_mod_add(t1, ctx->xa, ctx->xb, ctx->p.q, ctx->ctx); |
40720ce3 | 420 | /* t2 = g^{t1} = g^{xa+xb} */ |
2124e869 | 421 | BN_mod_exp(t2, ctx->p.g, t1, ctx->p.p, ctx->ctx); |
40720ce3 | 422 | /* t1 = g^{xc} * t2 = g^{xc + xa + xb} */ |
2124e869 BL |
423 | BN_mod_mul(t1, ctx->p.gxc, t2, ctx->p.p, ctx->ctx); |
424 | ||
40720ce3 MC |
425 | if (verify_zkp(received, t1, ctx)) |
426 | ret = 1; | |
2124e869 | 427 | else |
40720ce3 | 428 | JPAKEerr(JPAKE_F_JPAKE_STEP2_PROCESS, JPAKE_R_VERIFY_B_FAILED); |
2124e869 BL |
429 | |
430 | compute_key(ctx, received->gx); | |
431 | ||
40720ce3 | 432 | /* cleanup */ |
2124e869 BL |
433 | BN_free(t2); |
434 | BN_free(t1); | |
435 | ||
436 | return ret; | |
40720ce3 | 437 | } |
2124e869 BL |
438 | |
439 | static void quickhashbn(unsigned char *md, const BIGNUM *bn) | |
40720ce3 | 440 | { |
2124e869 BL |
441 | SHA_CTX sha; |
442 | ||
443 | SHA1_Init(&sha); | |
444 | hashbn(&sha, bn); | |
445 | SHA1_Final(md, &sha); | |
40720ce3 | 446 | } |
2124e869 BL |
447 | |
448 | void JPAKE_STEP3A_init(JPAKE_STEP3A *s3a) | |
40720ce3 MC |
449 | { |
450 | } | |
2124e869 BL |
451 | |
452 | int JPAKE_STEP3A_generate(JPAKE_STEP3A *send, JPAKE_CTX *ctx) | |
40720ce3 | 453 | { |
2124e869 BL |
454 | quickhashbn(send->hhk, ctx->key); |
455 | SHA1(send->hhk, sizeof send->hhk, send->hhk); | |
456 | ||
457 | return 1; | |
40720ce3 | 458 | } |
2124e869 BL |
459 | |
460 | int JPAKE_STEP3A_process(JPAKE_CTX *ctx, const JPAKE_STEP3A *received) | |
40720ce3 | 461 | { |
2124e869 BL |
462 | unsigned char hhk[SHA_DIGEST_LENGTH]; |
463 | ||
464 | quickhashbn(hhk, ctx->key); | |
465 | SHA1(hhk, sizeof hhk, hhk); | |
40720ce3 MC |
466 | if (memcmp(hhk, received->hhk, sizeof hhk)) { |
467 | JPAKEerr(JPAKE_F_JPAKE_STEP3A_PROCESS, | |
468 | JPAKE_R_HASH_OF_HASH_OF_KEY_MISMATCH); | |
469 | return 0; | |
2124e869 | 470 | } |
40720ce3 MC |
471 | return 1; |
472 | } | |
2124e869 BL |
473 | |
474 | void JPAKE_STEP3A_release(JPAKE_STEP3A *s3a) | |
40720ce3 MC |
475 | { |
476 | } | |
2124e869 BL |
477 | |
478 | void JPAKE_STEP3B_init(JPAKE_STEP3B *s3b) | |
40720ce3 MC |
479 | { |
480 | } | |
2124e869 BL |
481 | |
482 | int JPAKE_STEP3B_generate(JPAKE_STEP3B *send, JPAKE_CTX *ctx) | |
40720ce3 | 483 | { |
2124e869 BL |
484 | quickhashbn(send->hk, ctx->key); |
485 | ||
486 | return 1; | |
40720ce3 | 487 | } |
2124e869 BL |
488 | |
489 | int JPAKE_STEP3B_process(JPAKE_CTX *ctx, const JPAKE_STEP3B *received) | |
40720ce3 | 490 | { |
2124e869 BL |
491 | unsigned char hk[SHA_DIGEST_LENGTH]; |
492 | ||
493 | quickhashbn(hk, ctx->key); | |
40720ce3 MC |
494 | if (memcmp(hk, received->hk, sizeof hk)) { |
495 | JPAKEerr(JPAKE_F_JPAKE_STEP3B_PROCESS, JPAKE_R_HASH_OF_KEY_MISMATCH); | |
496 | return 0; | |
2124e869 | 497 | } |
40720ce3 MC |
498 | return 1; |
499 | } | |
2124e869 BL |
500 | |
501 | void JPAKE_STEP3B_release(JPAKE_STEP3B *s3b) | |
40720ce3 MC |
502 | { |
503 | } | |
2124e869 BL |
504 | |
505 | const BIGNUM *JPAKE_get_shared_key(JPAKE_CTX *ctx) | |
40720ce3 | 506 | { |
2124e869 | 507 | return ctx->key; |
40720ce3 | 508 | } |