Line data    Source code

       1             : /*
       2             :  * Copyright (c) 2006 Kungliga Tekniska Högskolan
       3             :  * (Royal Institute of Technology, Stockholm, Sweden).
       4             :  * All rights reserved.
       5             :  *
       6             :  * Redistribution and use in source and binary forms, with or without
       7             :  * modification, are permitted provided that the following conditions
       8             :  * are met:
       9             :  *
      10             :  * 1. Redistributions of source code must retain the above copyright
      11             :  *    notice, this list of conditions and the following disclaimer.
      12             :  *
      13             :  * 2. Redistributions in binary form must reproduce the above copyright
      14             :  *    notice, this list of conditions and the following disclaimer in the
      15             :  *    documentation and/or other materials provided with the distribution.
      16             :  *
      17             :  * 3. Neither the name of the Institute nor the names of its contributors
      18             :  *    may be used to endorse or promote products derived from this software
      19             :  *    without specific prior written permission.
      20             :  *
      21             :  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
      22             :  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
      23             :  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
      24             :  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
      25             :  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
      26             :  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
      27             :  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
      28             :  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
      29             :  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
      30             :  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
      31             :  * SUCH DAMAGE.
      32             :  */
      33             : 
      34             : #ifdef HAVE_CONFIG_H
      35             : #include <config.h>
      36             : #endif
      37             : #include <roken.h>
      38             : 
      39             : #include <dh.h>
      40             : 
      41             : #include "tommath.h"
      42             : 
      43             : static int
      44         555 : BN2mpz(mp_int *s, const BIGNUM *bn)
      45             : {
      46           0 :     size_t len;
      47           0 :     void *p;
      48             : 
      49         555 :     len = BN_num_bytes(bn);
      50         555 :     p = malloc(len);
      51         555 :     BN_bn2bin(bn, p);
      52         555 :     if (mp_from_ubin(s, p, len) != MP_OKAY) {
      53           0 :         free(p);
      54           0 :         return -1;
      55             :     }
      56         555 :     free(p);
      57         555 :     return 0;
      58             : }
      59             : 
      60             : 
      61             : static BIGNUM *
      62         148 : mpz2BN(mp_int *s)
      63             : {
      64           0 :     size_t size;
      65           0 :     BIGNUM *bn;
      66           0 :     void *p;
      67             : 
      68         148 :     size = mp_ubin_size(s);
      69         148 :     p = malloc(size);
      70         148 :     if (p == NULL)
      71           0 :         return NULL;
      72         148 :     if (mp_to_ubin(s, p, SIZE_MAX, NULL) != MP_OKAY) {
      73           0 :         free(p);
      74           0 :         return NULL;
      75           0 :     };
      76             : 
      77         148 :     bn = BN_bin2bn(p, size, NULL);
      78         148 :     free(p);
      79         148 :     return bn;
      80             : }
      81             : 
      82             : /*
      83             :  *
      84             :  */
      85             : 
      86             : #define DH_NUM_TRIES 10
      87             : 
      88             : static int
      89         148 : ltm_dh_generate_key(DH *dh)
      90             : {
      91           0 :     mp_int pub, priv_key, g, p;
      92         148 :     int have_private_key = (dh->priv_key != NULL);
      93         148 :     int codes, times = 0;
      94           0 :     int res;
      95             : 
      96         148 :     if (dh->p == NULL || dh->g == NULL)
      97           0 :         return 0;
      98             : 
      99         148 :     while (times++ < DH_NUM_TRIES) {
     100         148 :         if (!have_private_key) {
     101         148 :             size_t bits = BN_num_bits(dh->p);
     102             : 
     103         148 :             if (dh->priv_key)
     104           0 :                 BN_free(dh->priv_key);
     105             : 
     106         148 :             dh->priv_key = BN_new();
     107         148 :             if (dh->priv_key == NULL)
     108           0 :                 return 0;
     109         148 :             if (!BN_rand(dh->priv_key, bits - 1, 0, 0)) {
     110           0 :                 BN_clear_free(dh->priv_key);
     111           0 :                 dh->priv_key = NULL;
     112           0 :                 return 0;
     113             :             }
     114             :         }
     115         148 :         if (dh->pub_key) {
     116           0 :             BN_free(dh->pub_key);
     117           0 :             dh->pub_key = NULL;
     118             :         }
     119             : 
     120         148 :         if (mp_init_multi(&pub, &priv_key, &g, &p, NULL) != MP_OKAY)
     121           0 :             continue;
     122             : 
     123         148 :         if (BN2mpz(&priv_key, dh->priv_key) != 0)
     124           0 :             continue;
     125             : 
     126         148 :         if (BN2mpz(&g, dh->g) != 0)
     127           0 :             continue;
     128             : 
     129         148 :         if (BN2mpz(&p, dh->p) != 0)
     130           0 :             continue;
     131             : 
     132         148 :         res = mp_exptmod(&g, &priv_key, &p, &pub);
     133             : 
     134         148 :         mp_clear_multi(&priv_key, &g, &p, NULL);
     135         148 :         if (res != 0)
     136           0 :             continue;
     137             : 
     138         148 :         dh->pub_key = mpz2BN(&pub);
     139         148 :         mp_clear(&pub);
     140         148 :         if (dh->pub_key == NULL)
     141           0 :             return 0;
     142             : 
     143         148 :         if (DH_check_pubkey(dh, dh->pub_key, &codes) && codes == 0)
     144         148 :             break;
     145           0 :         if (have_private_key)
     146           0 :             return 0;
     147             :     }
     148             : 
     149         148 :     if (times >= DH_NUM_TRIES) {
     150           0 :         if (!have_private_key && dh->priv_key) {
     151           0 :             BN_free(dh->priv_key);
     152           0 :             dh->priv_key = NULL;
     153             :         }
     154           0 :         if (dh->pub_key) {
     155           0 :             BN_free(dh->pub_key);
     156           0 :             dh->pub_key = NULL;
     157             :         }
     158           0 :         return 0;
     159             :     }
     160             : 
     161         148 :     return 1;
     162             : }
     163             : 
     164             : static int
     165          37 : ltm_dh_compute_key(unsigned char *shared, const BIGNUM * pub, DH *dh)
     166             : {
     167           0 :     mp_int s, priv_key, p, peer_pub;
     168           0 :     int ret;
     169             : 
     170          37 :     if (dh->pub_key == NULL || dh->g == NULL || dh->priv_key == NULL)
     171           0 :         return -1;
     172             : 
     173          37 :     if (mp_init_multi(&s, &priv_key, &p, &peer_pub, NULL) != MP_OKAY)
     174           0 :         return -1;
     175             : 
     176          37 :     if (BN2mpz(&p, dh->p) != 0) {
     177           0 :         ret = -1;
     178           0 :         goto out;
     179             :     }
     180             : 
     181          37 :     if (BN2mpz(&peer_pub, pub) != 0) {
     182           0 :         ret = 1;
     183           0 :         goto out;
     184             :     }
     185             : 
     186             :     /* check if peers pubkey is reasonable */
     187          37 :     if (mp_isneg(&peer_pub)
     188          37 :         || mp_cmp(&peer_pub, &p) >= 0
     189          37 :         || mp_cmp_d(&peer_pub, 1) <= 0)
     190             :     {
     191           0 :         ret = -1;
     192           0 :         goto out;
     193             :     }
     194             : 
     195          37 :     if (BN2mpz(&priv_key, dh->priv_key) != 0) {
     196           0 :         ret = -1;
     197           0 :         goto out;
     198             :     }
     199             : 
     200          37 :     ret = mp_exptmod(&peer_pub, &priv_key, &p, &s);
     201          37 :     if (ret != 0) {
     202           0 :         ret = -1;
     203           0 :         goto out;
     204             :     }
     205             : 
     206          37 :     ret = mp_ubin_size(&s);
     207          37 :     if (mp_to_ubin(&s, shared, SIZE_MAX, NULL) != MP_OKAY)
     208           0 :         ret = -1;
     209             : 
     210          37 :  out:
     211          37 :     mp_clear_multi(&s, &priv_key, &p, &peer_pub, NULL);
     212             : 
     213          37 :     return ret;
     214             : }
     215             : 
     216             : static int
     217           0 : ltm_dh_generate_params(DH *dh, int a, int b, BN_GENCB *callback)
     218             : {
     219             :     /* groups should already be known, we don't care about this */
     220           0 :     return 0;
     221             : }
     222             : 
     223             : static int
     224         156 : ltm_dh_init(DH *dh)
     225             : {
     226         156 :     return 1;
     227             : }
     228             : 
     229             : static int
     230         156 : ltm_dh_finish(DH *dh)
     231             : {
     232         156 :     return 1;
     233             : }
     234             : 
     235             : 
     236             : /*
     237             :  *
     238             :  */
     239             : 
     240             : const DH_METHOD _hc_dh_ltm_method = {
     241             :     "hcrypto ltm DH",
     242             :     ltm_dh_generate_key,
     243             :     ltm_dh_compute_key,
     244             :     NULL,
     245             :     ltm_dh_init,
     246             :     ltm_dh_finish,
     247             :     0,
     248             :     NULL,
     249             :     ltm_dh_generate_params
     250             : };
     251             : 
     252             : /**
     253             :  * DH implementation using libtommath.
     254             :  *
     255             :  * @return the DH_METHOD for the DH implementation using libtommath.
     256             :  *
     257             :  * @ingroup hcrypto_dh
     258             :  */
     259             : 
     260             : const DH_METHOD *
     261           0 : DH_ltm_method(void)
     262             : {
     263           0 :     return &_hc_dh_ltm_method;
     264             : }