1 | /* |
2 | * Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved. |
3 | * |
4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at |
7 | * https://www.openssl.org/source/license.html |
8 | */ |
9 | |
10 | #include <stdio.h> |
11 | #include "internal/cryptlib.h" |
12 | #include "dh_local.h" |
13 | #include "crypto/bn.h" |
14 | |
15 | static int generate_key(DH *dh); |
16 | static int compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh); |
17 | static int dh_bn_mod_exp(const DH *dh, BIGNUM *r, |
18 | const BIGNUM *a, const BIGNUM *p, |
19 | const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx); |
20 | static int dh_init(DH *dh); |
21 | static int dh_finish(DH *dh); |
22 | |
23 | int DH_generate_key(DH *dh) |
24 | { |
25 | return dh->meth->generate_key(dh); |
26 | } |
27 | |
28 | int DH_compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh) |
29 | { |
30 | return dh->meth->compute_key(key, pub_key, dh); |
31 | } |
32 | |
33 | int DH_compute_key_padded(unsigned char *key, const BIGNUM *pub_key, DH *dh) |
34 | { |
35 | int rv, pad; |
36 | rv = dh->meth->compute_key(key, pub_key, dh); |
37 | if (rv <= 0) |
38 | return rv; |
39 | pad = BN_num_bytes(dh->p) - rv; |
40 | if (pad > 0) { |
41 | memmove(key + pad, key, rv); |
42 | memset(key, 0, pad); |
43 | } |
44 | return rv + pad; |
45 | } |
46 | |
47 | static DH_METHOD dh_ossl = { |
48 | "OpenSSL DH Method" , |
49 | generate_key, |
50 | compute_key, |
51 | dh_bn_mod_exp, |
52 | dh_init, |
53 | dh_finish, |
54 | DH_FLAG_FIPS_METHOD, |
55 | NULL, |
56 | NULL |
57 | }; |
58 | |
59 | static const DH_METHOD *default_DH_method = &dh_ossl; |
60 | |
61 | const DH_METHOD *DH_OpenSSL(void) |
62 | { |
63 | return &dh_ossl; |
64 | } |
65 | |
66 | void DH_set_default_method(const DH_METHOD *meth) |
67 | { |
68 | default_DH_method = meth; |
69 | } |
70 | |
71 | const DH_METHOD *DH_get_default_method(void) |
72 | { |
73 | return default_DH_method; |
74 | } |
75 | |
76 | static int generate_key(DH *dh) |
77 | { |
78 | int ok = 0; |
79 | int generate_new_key = 0; |
80 | unsigned l; |
81 | BN_CTX *ctx = NULL; |
82 | BN_MONT_CTX *mont = NULL; |
83 | BIGNUM *pub_key = NULL, *priv_key = NULL; |
84 | |
85 | if (BN_num_bits(dh->p) > OPENSSL_DH_MAX_MODULUS_BITS) { |
86 | DHerr(DH_F_GENERATE_KEY, DH_R_MODULUS_TOO_LARGE); |
87 | return 0; |
88 | } |
89 | |
90 | if (BN_num_bits(dh->p) < DH_MIN_MODULUS_BITS) { |
91 | DHerr(DH_F_GENERATE_KEY, DH_R_MODULUS_TOO_SMALL); |
92 | return 0; |
93 | } |
94 | |
95 | ctx = BN_CTX_new(); |
96 | if (ctx == NULL) |
97 | goto err; |
98 | |
99 | if (dh->priv_key == NULL) { |
100 | priv_key = BN_secure_new(); |
101 | if (priv_key == NULL) |
102 | goto err; |
103 | generate_new_key = 1; |
104 | } else |
105 | priv_key = dh->priv_key; |
106 | |
107 | if (dh->pub_key == NULL) { |
108 | pub_key = BN_new(); |
109 | if (pub_key == NULL) |
110 | goto err; |
111 | } else |
112 | pub_key = dh->pub_key; |
113 | |
114 | if (dh->flags & DH_FLAG_CACHE_MONT_P) { |
115 | mont = BN_MONT_CTX_set_locked(&dh->method_mont_p, |
116 | dh->lock, dh->p, ctx); |
117 | if (!mont) |
118 | goto err; |
119 | } |
120 | |
121 | if (generate_new_key) { |
122 | if (dh->q) { |
123 | do { |
124 | if (!BN_priv_rand_range(priv_key, dh->q)) |
125 | goto err; |
126 | } |
127 | while (BN_is_zero(priv_key) || BN_is_one(priv_key)); |
128 | } else { |
129 | /* secret exponent length */ |
130 | l = dh->length ? dh->length : BN_num_bits(dh->p) - 1; |
131 | if (!BN_priv_rand(priv_key, l, BN_RAND_TOP_ONE, BN_RAND_BOTTOM_ANY)) |
132 | goto err; |
133 | /* |
134 | * We handle just one known case where g is a quadratic non-residue: |
135 | * for g = 2: p % 8 == 3 |
136 | */ |
137 | if (BN_is_word(dh->g, DH_GENERATOR_2) && !BN_is_bit_set(dh->p, 2)) { |
138 | /* clear bit 0, since it won't be a secret anyway */ |
139 | if (!BN_clear_bit(priv_key, 0)) |
140 | goto err; |
141 | } |
142 | } |
143 | } |
144 | |
145 | { |
146 | BIGNUM *prk = BN_new(); |
147 | |
148 | if (prk == NULL) |
149 | goto err; |
150 | BN_with_flags(prk, priv_key, BN_FLG_CONSTTIME); |
151 | |
152 | if (!dh->meth->bn_mod_exp(dh, pub_key, dh->g, prk, dh->p, ctx, mont)) { |
153 | BN_clear_free(prk); |
154 | goto err; |
155 | } |
156 | /* We MUST free prk before any further use of priv_key */ |
157 | BN_clear_free(prk); |
158 | } |
159 | |
160 | dh->pub_key = pub_key; |
161 | dh->priv_key = priv_key; |
162 | dh->dirty_cnt++; |
163 | ok = 1; |
164 | err: |
165 | if (ok != 1) |
166 | DHerr(DH_F_GENERATE_KEY, ERR_R_BN_LIB); |
167 | |
168 | if (pub_key != dh->pub_key) |
169 | BN_free(pub_key); |
170 | if (priv_key != dh->priv_key) |
171 | BN_free(priv_key); |
172 | BN_CTX_free(ctx); |
173 | return ok; |
174 | } |
175 | |
176 | static int compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh) |
177 | { |
178 | BN_CTX *ctx = NULL; |
179 | BN_MONT_CTX *mont = NULL; |
180 | BIGNUM *tmp; |
181 | int ret = -1; |
182 | int check_result; |
183 | |
184 | if (BN_num_bits(dh->p) > OPENSSL_DH_MAX_MODULUS_BITS) { |
185 | DHerr(DH_F_COMPUTE_KEY, DH_R_MODULUS_TOO_LARGE); |
186 | goto err; |
187 | } |
188 | |
189 | if (BN_num_bits(dh->p) < DH_MIN_MODULUS_BITS) { |
190 | DHerr(DH_F_COMPUTE_KEY, DH_R_MODULUS_TOO_SMALL); |
191 | return 0; |
192 | } |
193 | |
194 | ctx = BN_CTX_new(); |
195 | if (ctx == NULL) |
196 | goto err; |
197 | BN_CTX_start(ctx); |
198 | tmp = BN_CTX_get(ctx); |
199 | if (tmp == NULL) |
200 | goto err; |
201 | |
202 | if (dh->priv_key == NULL) { |
203 | DHerr(DH_F_COMPUTE_KEY, DH_R_NO_PRIVATE_VALUE); |
204 | goto err; |
205 | } |
206 | |
207 | if (dh->flags & DH_FLAG_CACHE_MONT_P) { |
208 | mont = BN_MONT_CTX_set_locked(&dh->method_mont_p, |
209 | dh->lock, dh->p, ctx); |
210 | BN_set_flags(dh->priv_key, BN_FLG_CONSTTIME); |
211 | if (!mont) |
212 | goto err; |
213 | } |
214 | |
215 | if (!DH_check_pub_key(dh, pub_key, &check_result) || check_result) { |
216 | DHerr(DH_F_COMPUTE_KEY, DH_R_INVALID_PUBKEY); |
217 | goto err; |
218 | } |
219 | |
220 | if (!dh-> |
221 | meth->bn_mod_exp(dh, tmp, pub_key, dh->priv_key, dh->p, ctx, mont)) { |
222 | DHerr(DH_F_COMPUTE_KEY, ERR_R_BN_LIB); |
223 | goto err; |
224 | } |
225 | |
226 | ret = BN_bn2bin(tmp, key); |
227 | err: |
228 | BN_CTX_end(ctx); |
229 | BN_CTX_free(ctx); |
230 | return ret; |
231 | } |
232 | |
233 | static int dh_bn_mod_exp(const DH *dh, BIGNUM *r, |
234 | const BIGNUM *a, const BIGNUM *p, |
235 | const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx) |
236 | { |
237 | return BN_mod_exp_mont(r, a, p, m, ctx, m_ctx); |
238 | } |
239 | |
240 | static int dh_init(DH *dh) |
241 | { |
242 | dh->flags |= DH_FLAG_CACHE_MONT_P; |
243 | return 1; |
244 | } |
245 | |
246 | static int dh_finish(DH *dh) |
247 | { |
248 | BN_MONT_CTX_free(dh->method_mont_p); |
249 | return 1; |
250 | } |
251 | |
252 | int dh_buf2key(DH *dh, const unsigned char *buf, size_t len) |
253 | { |
254 | int err_reason = DH_R_BN_ERROR; |
255 | BIGNUM *pubkey = NULL; |
256 | const BIGNUM *p; |
257 | size_t p_size; |
258 | |
259 | if ((pubkey = BN_bin2bn(buf, len, NULL)) == NULL) |
260 | goto err; |
261 | DH_get0_pqg(dh, &p, NULL, NULL); |
262 | if (p == NULL || (p_size = BN_num_bytes(p)) == 0) { |
263 | err_reason = DH_R_NO_PARAMETERS_SET; |
264 | goto err; |
265 | } |
266 | /* |
267 | * As per Section 4.2.8.1 of RFC 8446 fail if DHE's |
268 | * public key is of size not equal to size of p |
269 | */ |
270 | if (BN_is_zero(pubkey) || p_size != len) { |
271 | err_reason = DH_R_INVALID_PUBKEY; |
272 | goto err; |
273 | } |
274 | if (DH_set0_key(dh, pubkey, NULL) != 1) |
275 | goto err; |
276 | return 1; |
277 | err: |
278 | DHerr(DH_F_DH_BUF2KEY, err_reason); |
279 | BN_free(pubkey); |
280 | return 0; |
281 | } |
282 | |
283 | size_t dh_key2buf(const DH *dh, unsigned char **pbuf_out) |
284 | { |
285 | const BIGNUM *pubkey; |
286 | unsigned char *pbuf; |
287 | const BIGNUM *p; |
288 | int p_size; |
289 | |
290 | DH_get0_pqg(dh, &p, NULL, NULL); |
291 | DH_get0_key(dh, &pubkey, NULL); |
292 | if (p == NULL || pubkey == NULL |
293 | || (p_size = BN_num_bytes(p)) == 0 |
294 | || BN_num_bytes(pubkey) == 0) { |
295 | DHerr(DH_F_DH_KEY2BUF, DH_R_INVALID_PUBKEY); |
296 | return 0; |
297 | } |
298 | if ((pbuf = OPENSSL_malloc(p_size)) == NULL) { |
299 | DHerr(DH_F_DH_KEY2BUF, ERR_R_MALLOC_FAILURE); |
300 | return 0; |
301 | } |
302 | /* |
303 | * As per Section 4.2.8.1 of RFC 8446 left pad public |
304 | * key with zeros to the size of p |
305 | */ |
306 | if (BN_bn2binpad(pubkey, pbuf, p_size) < 0) { |
307 | OPENSSL_free(pbuf); |
308 | DHerr(DH_F_DH_KEY2BUF, DH_R_BN_ERROR); |
309 | return 0; |
310 | } |
311 | *pbuf_out = pbuf; |
312 | return p_size; |
313 | } |
314 | |