1 | /* |
2 | * Copyright 2006-2018 The OpenSSL Project Authors. All Rights Reserved. |
3 | * |
4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at |
7 | * https://www.openssl.org/source/license.html |
8 | */ |
9 | |
10 | #include <stdio.h> |
11 | #include "internal/cryptlib.h" |
12 | #include <openssl/asn1t.h> |
13 | #include <openssl/x509.h> |
14 | #include <openssl/evp.h> |
15 | #include "dh_local.h" |
16 | #include <openssl/bn.h> |
17 | #include <openssl/dsa.h> |
18 | #include <openssl/objects.h> |
19 | #include "crypto/evp.h" |
20 | |
21 | /* DH pkey context structure */ |
22 | |
23 | typedef struct { |
24 | /* Parameter gen parameters */ |
25 | int prime_len; |
26 | int generator; |
27 | int use_dsa; |
28 | int subprime_len; |
29 | int pad; |
30 | /* message digest used for parameter generation */ |
31 | const EVP_MD *md; |
32 | int rfc5114_param; |
33 | int param_nid; |
34 | /* Keygen callback info */ |
35 | int gentmp[2]; |
36 | /* KDF (if any) to use for DH */ |
37 | char kdf_type; |
38 | /* OID to use for KDF */ |
39 | ASN1_OBJECT *kdf_oid; |
40 | /* Message digest to use for key derivation */ |
41 | const EVP_MD *kdf_md; |
42 | /* User key material */ |
43 | unsigned char *kdf_ukm; |
44 | size_t kdf_ukmlen; |
45 | /* KDF output length */ |
46 | size_t kdf_outlen; |
47 | } DH_PKEY_CTX; |
48 | |
49 | static int pkey_dh_init(EVP_PKEY_CTX *ctx) |
50 | { |
51 | DH_PKEY_CTX *dctx; |
52 | |
53 | if ((dctx = OPENSSL_zalloc(sizeof(*dctx))) == NULL) { |
54 | DHerr(DH_F_PKEY_DH_INIT, ERR_R_MALLOC_FAILURE); |
55 | return 0; |
56 | } |
57 | dctx->prime_len = 2048; |
58 | dctx->subprime_len = -1; |
59 | dctx->generator = 2; |
60 | dctx->kdf_type = EVP_PKEY_DH_KDF_NONE; |
61 | |
62 | ctx->data = dctx; |
63 | ctx->keygen_info = dctx->gentmp; |
64 | ctx->keygen_info_count = 2; |
65 | |
66 | return 1; |
67 | } |
68 | |
69 | static void pkey_dh_cleanup(EVP_PKEY_CTX *ctx) |
70 | { |
71 | DH_PKEY_CTX *dctx = ctx->data; |
72 | if (dctx != NULL) { |
73 | OPENSSL_free(dctx->kdf_ukm); |
74 | ASN1_OBJECT_free(dctx->kdf_oid); |
75 | OPENSSL_free(dctx); |
76 | } |
77 | } |
78 | |
79 | |
80 | static int pkey_dh_copy(EVP_PKEY_CTX *dst, const EVP_PKEY_CTX *src) |
81 | { |
82 | DH_PKEY_CTX *dctx, *sctx; |
83 | |
84 | if (!pkey_dh_init(dst)) |
85 | return 0; |
86 | sctx = src->data; |
87 | dctx = dst->data; |
88 | dctx->prime_len = sctx->prime_len; |
89 | dctx->subprime_len = sctx->subprime_len; |
90 | dctx->generator = sctx->generator; |
91 | dctx->use_dsa = sctx->use_dsa; |
92 | dctx->pad = sctx->pad; |
93 | dctx->md = sctx->md; |
94 | dctx->rfc5114_param = sctx->rfc5114_param; |
95 | dctx->param_nid = sctx->param_nid; |
96 | |
97 | dctx->kdf_type = sctx->kdf_type; |
98 | dctx->kdf_oid = OBJ_dup(sctx->kdf_oid); |
99 | if (dctx->kdf_oid == NULL) |
100 | return 0; |
101 | dctx->kdf_md = sctx->kdf_md; |
102 | if (sctx->kdf_ukm != NULL) { |
103 | dctx->kdf_ukm = OPENSSL_memdup(sctx->kdf_ukm, sctx->kdf_ukmlen); |
104 | if (dctx->kdf_ukm == NULL) |
105 | return 0; |
106 | dctx->kdf_ukmlen = sctx->kdf_ukmlen; |
107 | } |
108 | dctx->kdf_outlen = sctx->kdf_outlen; |
109 | return 1; |
110 | } |
111 | |
112 | static int pkey_dh_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2) |
113 | { |
114 | DH_PKEY_CTX *dctx = ctx->data; |
115 | switch (type) { |
116 | case EVP_PKEY_CTRL_DH_PARAMGEN_PRIME_LEN: |
117 | if (p1 < 256) |
118 | return -2; |
119 | dctx->prime_len = p1; |
120 | return 1; |
121 | |
122 | case EVP_PKEY_CTRL_DH_PARAMGEN_SUBPRIME_LEN: |
123 | if (dctx->use_dsa == 0) |
124 | return -2; |
125 | dctx->subprime_len = p1; |
126 | return 1; |
127 | |
128 | case EVP_PKEY_CTRL_DH_PAD: |
129 | dctx->pad = p1; |
130 | return 1; |
131 | |
132 | case EVP_PKEY_CTRL_DH_PARAMGEN_GENERATOR: |
133 | if (dctx->use_dsa) |
134 | return -2; |
135 | dctx->generator = p1; |
136 | return 1; |
137 | |
138 | case EVP_PKEY_CTRL_DH_PARAMGEN_TYPE: |
139 | #ifdef OPENSSL_NO_DSA |
140 | if (p1 != 0) |
141 | return -2; |
142 | #else |
143 | if (p1 < 0 || p1 > 2) |
144 | return -2; |
145 | #endif |
146 | dctx->use_dsa = p1; |
147 | return 1; |
148 | |
149 | case EVP_PKEY_CTRL_DH_RFC5114: |
150 | if (p1 < 1 || p1 > 3 || dctx->param_nid != NID_undef) |
151 | return -2; |
152 | dctx->rfc5114_param = p1; |
153 | return 1; |
154 | |
155 | case EVP_PKEY_CTRL_DH_NID: |
156 | if (p1 <= 0 || dctx->rfc5114_param != 0) |
157 | return -2; |
158 | dctx->param_nid = p1; |
159 | return 1; |
160 | |
161 | case EVP_PKEY_CTRL_PEER_KEY: |
162 | /* Default behaviour is OK */ |
163 | return 1; |
164 | |
165 | case EVP_PKEY_CTRL_DH_KDF_TYPE: |
166 | if (p1 == -2) |
167 | return dctx->kdf_type; |
168 | #ifdef OPENSSL_NO_CMS |
169 | if (p1 != EVP_PKEY_DH_KDF_NONE) |
170 | #else |
171 | if (p1 != EVP_PKEY_DH_KDF_NONE && p1 != EVP_PKEY_DH_KDF_X9_42) |
172 | #endif |
173 | return -2; |
174 | dctx->kdf_type = p1; |
175 | return 1; |
176 | |
177 | case EVP_PKEY_CTRL_DH_KDF_MD: |
178 | dctx->kdf_md = p2; |
179 | return 1; |
180 | |
181 | case EVP_PKEY_CTRL_GET_DH_KDF_MD: |
182 | *(const EVP_MD **)p2 = dctx->kdf_md; |
183 | return 1; |
184 | |
185 | case EVP_PKEY_CTRL_DH_KDF_OUTLEN: |
186 | if (p1 <= 0) |
187 | return -2; |
188 | dctx->kdf_outlen = (size_t)p1; |
189 | return 1; |
190 | |
191 | case EVP_PKEY_CTRL_GET_DH_KDF_OUTLEN: |
192 | *(int *)p2 = dctx->kdf_outlen; |
193 | return 1; |
194 | |
195 | case EVP_PKEY_CTRL_DH_KDF_UKM: |
196 | OPENSSL_free(dctx->kdf_ukm); |
197 | dctx->kdf_ukm = p2; |
198 | if (p2) |
199 | dctx->kdf_ukmlen = p1; |
200 | else |
201 | dctx->kdf_ukmlen = 0; |
202 | return 1; |
203 | |
204 | case EVP_PKEY_CTRL_GET_DH_KDF_UKM: |
205 | *(unsigned char **)p2 = dctx->kdf_ukm; |
206 | return dctx->kdf_ukmlen; |
207 | |
208 | case EVP_PKEY_CTRL_DH_KDF_OID: |
209 | ASN1_OBJECT_free(dctx->kdf_oid); |
210 | dctx->kdf_oid = p2; |
211 | return 1; |
212 | |
213 | case EVP_PKEY_CTRL_GET_DH_KDF_OID: |
214 | *(ASN1_OBJECT **)p2 = dctx->kdf_oid; |
215 | return 1; |
216 | |
217 | default: |
218 | return -2; |
219 | |
220 | } |
221 | } |
222 | |
223 | static int pkey_dh_ctrl_str(EVP_PKEY_CTX *ctx, |
224 | const char *type, const char *value) |
225 | { |
226 | if (strcmp(type, "dh_paramgen_prime_len" ) == 0) { |
227 | int len; |
228 | len = atoi(value); |
229 | return EVP_PKEY_CTX_set_dh_paramgen_prime_len(ctx, len); |
230 | } |
231 | if (strcmp(type, "dh_rfc5114" ) == 0) { |
232 | DH_PKEY_CTX *dctx = ctx->data; |
233 | int len; |
234 | len = atoi(value); |
235 | if (len < 0 || len > 3) |
236 | return -2; |
237 | dctx->rfc5114_param = len; |
238 | return 1; |
239 | } |
240 | if (strcmp(type, "dh_param" ) == 0) { |
241 | DH_PKEY_CTX *dctx = ctx->data; |
242 | int nid = OBJ_sn2nid(value); |
243 | |
244 | if (nid == NID_undef) { |
245 | DHerr(DH_F_PKEY_DH_CTRL_STR, DH_R_INVALID_PARAMETER_NAME); |
246 | return -2; |
247 | } |
248 | dctx->param_nid = nid; |
249 | return 1; |
250 | } |
251 | if (strcmp(type, "dh_paramgen_generator" ) == 0) { |
252 | int len; |
253 | len = atoi(value); |
254 | return EVP_PKEY_CTX_set_dh_paramgen_generator(ctx, len); |
255 | } |
256 | if (strcmp(type, "dh_paramgen_subprime_len" ) == 0) { |
257 | int len; |
258 | len = atoi(value); |
259 | return EVP_PKEY_CTX_set_dh_paramgen_subprime_len(ctx, len); |
260 | } |
261 | if (strcmp(type, "dh_paramgen_type" ) == 0) { |
262 | int typ; |
263 | typ = atoi(value); |
264 | return EVP_PKEY_CTX_set_dh_paramgen_type(ctx, typ); |
265 | } |
266 | if (strcmp(type, "dh_pad" ) == 0) { |
267 | int pad; |
268 | pad = atoi(value); |
269 | return EVP_PKEY_CTX_set_dh_pad(ctx, pad); |
270 | } |
271 | return -2; |
272 | } |
273 | |
274 | #ifndef OPENSSL_NO_DSA |
275 | |
276 | extern int dsa_builtin_paramgen(DSA *ret, size_t bits, size_t qbits, |
277 | const EVP_MD *evpmd, |
278 | const unsigned char *seed_in, size_t seed_len, |
279 | unsigned char *seed_out, int *counter_ret, |
280 | unsigned long *h_ret, BN_GENCB *cb); |
281 | |
282 | extern int dsa_builtin_paramgen2(DSA *ret, size_t L, size_t N, |
283 | const EVP_MD *evpmd, |
284 | const unsigned char *seed_in, |
285 | size_t seed_len, int idx, |
286 | unsigned char *seed_out, int *counter_ret, |
287 | unsigned long *h_ret, BN_GENCB *cb); |
288 | |
289 | static DSA *dsa_dh_generate(DH_PKEY_CTX *dctx, BN_GENCB *pcb) |
290 | { |
291 | DSA *ret; |
292 | int rv = 0; |
293 | int prime_len = dctx->prime_len; |
294 | int subprime_len = dctx->subprime_len; |
295 | const EVP_MD *md = dctx->md; |
296 | if (dctx->use_dsa > 2) |
297 | return NULL; |
298 | ret = DSA_new(); |
299 | if (ret == NULL) |
300 | return NULL; |
301 | if (subprime_len == -1) { |
302 | if (prime_len >= 2048) |
303 | subprime_len = 256; |
304 | else |
305 | subprime_len = 160; |
306 | } |
307 | if (md == NULL) { |
308 | if (prime_len >= 2048) |
309 | md = EVP_sha256(); |
310 | else |
311 | md = EVP_sha1(); |
312 | } |
313 | if (dctx->use_dsa == 1) |
314 | rv = dsa_builtin_paramgen(ret, prime_len, subprime_len, md, |
315 | NULL, 0, NULL, NULL, NULL, pcb); |
316 | else if (dctx->use_dsa == 2) |
317 | rv = dsa_builtin_paramgen2(ret, prime_len, subprime_len, md, |
318 | NULL, 0, -1, NULL, NULL, NULL, pcb); |
319 | if (rv <= 0) { |
320 | DSA_free(ret); |
321 | return NULL; |
322 | } |
323 | return ret; |
324 | } |
325 | |
326 | #endif |
327 | |
328 | static int pkey_dh_paramgen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey) |
329 | { |
330 | DH *dh = NULL; |
331 | DH_PKEY_CTX *dctx = ctx->data; |
332 | BN_GENCB *pcb; |
333 | int ret; |
334 | if (dctx->rfc5114_param) { |
335 | switch (dctx->rfc5114_param) { |
336 | case 1: |
337 | dh = DH_get_1024_160(); |
338 | break; |
339 | |
340 | case 2: |
341 | dh = DH_get_2048_224(); |
342 | break; |
343 | |
344 | case 3: |
345 | dh = DH_get_2048_256(); |
346 | break; |
347 | |
348 | default: |
349 | return -2; |
350 | } |
351 | EVP_PKEY_assign(pkey, EVP_PKEY_DHX, dh); |
352 | return 1; |
353 | } |
354 | |
355 | if (dctx->param_nid != 0) { |
356 | if ((dh = DH_new_by_nid(dctx->param_nid)) == NULL) |
357 | return 0; |
358 | EVP_PKEY_assign(pkey, EVP_PKEY_DH, dh); |
359 | return 1; |
360 | } |
361 | |
362 | if (ctx->pkey_gencb) { |
363 | pcb = BN_GENCB_new(); |
364 | if (pcb == NULL) |
365 | return 0; |
366 | evp_pkey_set_cb_translate(pcb, ctx); |
367 | } else |
368 | pcb = NULL; |
369 | #ifndef OPENSSL_NO_DSA |
370 | if (dctx->use_dsa) { |
371 | DSA *dsa_dh; |
372 | dsa_dh = dsa_dh_generate(dctx, pcb); |
373 | BN_GENCB_free(pcb); |
374 | if (dsa_dh == NULL) |
375 | return 0; |
376 | dh = DSA_dup_DH(dsa_dh); |
377 | DSA_free(dsa_dh); |
378 | if (!dh) |
379 | return 0; |
380 | EVP_PKEY_assign(pkey, EVP_PKEY_DHX, dh); |
381 | return 1; |
382 | } |
383 | #endif |
384 | dh = DH_new(); |
385 | if (dh == NULL) { |
386 | BN_GENCB_free(pcb); |
387 | return 0; |
388 | } |
389 | ret = DH_generate_parameters_ex(dh, |
390 | dctx->prime_len, dctx->generator, pcb); |
391 | BN_GENCB_free(pcb); |
392 | if (ret) |
393 | EVP_PKEY_assign_DH(pkey, dh); |
394 | else |
395 | DH_free(dh); |
396 | return ret; |
397 | } |
398 | |
399 | static int pkey_dh_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey) |
400 | { |
401 | DH_PKEY_CTX *dctx = ctx->data; |
402 | DH *dh = NULL; |
403 | |
404 | if (ctx->pkey == NULL && dctx->param_nid == 0) { |
405 | DHerr(DH_F_PKEY_DH_KEYGEN, DH_R_NO_PARAMETERS_SET); |
406 | return 0; |
407 | } |
408 | if (dctx->param_nid != 0) |
409 | dh = DH_new_by_nid(dctx->param_nid); |
410 | else |
411 | dh = DH_new(); |
412 | if (dh == NULL) |
413 | return 0; |
414 | EVP_PKEY_assign(pkey, ctx->pmeth->pkey_id, dh); |
415 | /* Note: if error return, pkey is freed by parent routine */ |
416 | if (ctx->pkey != NULL && !EVP_PKEY_copy_parameters(pkey, ctx->pkey)) |
417 | return 0; |
418 | return DH_generate_key(pkey->pkey.dh); |
419 | } |
420 | |
421 | static int pkey_dh_derive(EVP_PKEY_CTX *ctx, unsigned char *key, |
422 | size_t *keylen) |
423 | { |
424 | int ret; |
425 | DH *dh; |
426 | DH_PKEY_CTX *dctx = ctx->data; |
427 | BIGNUM *dhpub; |
428 | if (!ctx->pkey || !ctx->peerkey) { |
429 | DHerr(DH_F_PKEY_DH_DERIVE, DH_R_KEYS_NOT_SET); |
430 | return 0; |
431 | } |
432 | dh = ctx->pkey->pkey.dh; |
433 | dhpub = ctx->peerkey->pkey.dh->pub_key; |
434 | if (dctx->kdf_type == EVP_PKEY_DH_KDF_NONE) { |
435 | if (key == NULL) { |
436 | *keylen = DH_size(dh); |
437 | return 1; |
438 | } |
439 | if (dctx->pad) |
440 | ret = DH_compute_key_padded(key, dhpub, dh); |
441 | else |
442 | ret = DH_compute_key(key, dhpub, dh); |
443 | if (ret < 0) |
444 | return ret; |
445 | *keylen = ret; |
446 | return 1; |
447 | } |
448 | #ifndef OPENSSL_NO_CMS |
449 | else if (dctx->kdf_type == EVP_PKEY_DH_KDF_X9_42) { |
450 | |
451 | unsigned char *Z = NULL; |
452 | size_t Zlen = 0; |
453 | if (!dctx->kdf_outlen || !dctx->kdf_oid) |
454 | return 0; |
455 | if (key == NULL) { |
456 | *keylen = dctx->kdf_outlen; |
457 | return 1; |
458 | } |
459 | if (*keylen != dctx->kdf_outlen) |
460 | return 0; |
461 | ret = 0; |
462 | Zlen = DH_size(dh); |
463 | Z = OPENSSL_malloc(Zlen); |
464 | if (Z == NULL) { |
465 | goto err; |
466 | } |
467 | if (DH_compute_key_padded(Z, dhpub, dh) <= 0) |
468 | goto err; |
469 | if (!DH_KDF_X9_42(key, *keylen, Z, Zlen, dctx->kdf_oid, |
470 | dctx->kdf_ukm, dctx->kdf_ukmlen, dctx->kdf_md)) |
471 | goto err; |
472 | *keylen = dctx->kdf_outlen; |
473 | ret = 1; |
474 | err: |
475 | OPENSSL_clear_free(Z, Zlen); |
476 | return ret; |
477 | } |
478 | #endif |
479 | return 0; |
480 | } |
481 | |
482 | static const EVP_PKEY_METHOD dh_pkey_meth = { |
483 | EVP_PKEY_DH, |
484 | 0, |
485 | pkey_dh_init, |
486 | pkey_dh_copy, |
487 | pkey_dh_cleanup, |
488 | |
489 | 0, |
490 | pkey_dh_paramgen, |
491 | |
492 | 0, |
493 | pkey_dh_keygen, |
494 | |
495 | 0, |
496 | 0, |
497 | |
498 | 0, |
499 | 0, |
500 | |
501 | 0, 0, |
502 | |
503 | 0, 0, 0, 0, |
504 | |
505 | 0, 0, |
506 | |
507 | 0, 0, |
508 | |
509 | 0, |
510 | pkey_dh_derive, |
511 | |
512 | pkey_dh_ctrl, |
513 | pkey_dh_ctrl_str |
514 | }; |
515 | |
516 | const EVP_PKEY_METHOD *dh_pkey_method(void) |
517 | { |
518 | return &dh_pkey_meth; |
519 | } |
520 | |
521 | static const EVP_PKEY_METHOD dhx_pkey_meth = { |
522 | EVP_PKEY_DHX, |
523 | 0, |
524 | pkey_dh_init, |
525 | pkey_dh_copy, |
526 | pkey_dh_cleanup, |
527 | |
528 | 0, |
529 | pkey_dh_paramgen, |
530 | |
531 | 0, |
532 | pkey_dh_keygen, |
533 | |
534 | 0, |
535 | 0, |
536 | |
537 | 0, |
538 | 0, |
539 | |
540 | 0, 0, |
541 | |
542 | 0, 0, 0, 0, |
543 | |
544 | 0, 0, |
545 | |
546 | 0, 0, |
547 | |
548 | 0, |
549 | pkey_dh_derive, |
550 | |
551 | pkey_dh_ctrl, |
552 | pkey_dh_ctrl_str |
553 | }; |
554 | |
555 | const EVP_PKEY_METHOD *dhx_pkey_method(void) |
556 | { |
557 | return &dhx_pkey_meth; |
558 | } |
559 | |