lib/hcrypto/dh.c

   1 /*
   2  * Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #ifdef HAVE_CONFIG_H
  35 #include <config.h>
  36 #endif
  37
  38 RCSID("$Id$");
  39
  40 #include <stdio.h>
  41 #include <stdlib.h>
  42 #include <dh.h>
  43
  44 #include <roken.h>
  45
  46 /**
  47  * @page page_dh DH - Diffie-Hellman key exchange
  48  *
  49  * Diffie-Hellman key exchange is a protocol that allows two parties
  50  * to establish a shared secret key.
  51  *
  52  * Include and example how to use DH_new() and friends here.
  53  *
  54  * See the library functions here: @ref hcrypto_dh
  55  */
  56
  57 /**
  58  * Create a new DH object using DH_new_method(NULL), see DH_new_method().
  59  *
  60  * @return a newly allocated DH object.
  61  *
  62  * @ingroup hcrypto_dh
  63  */
  64
  65 DH *
  66 DH_new(void)
  67 {
  68     return DH_new_method(NULL);
  69 }
  70
  71 /**
  72  * Create a new DH object from the given engine, if the NULL is used,
  73  * the default engine is used. Free the DH object with DH_free().
  74  *
  75  * @param engine The engine to use to allocate the DH object.
  76  *
  77  * @return a newly allocated DH object.
  78  *
  79  * @ingroup hcrypto_dh
  80  */
  81
  82 DH *
  83 DH_new_method(ENGINE *engine)
  84 {
  85     DH *dh;
  86
  87     dh = calloc(1, sizeof(*dh));
  88     if (dh == NULL)
  89         return NULL;
  90
  91     dh->references = 1;
  92
  93     if (engine) {
  94         ENGINE_up_ref(engine);
  95         dh->engine = engine;
  96     } else {
  97         dh->engine = ENGINE_get_default_DH();
  98     }
  99
 100     if (dh->engine) {
 101         dh->meth = ENGINE_get_DH(dh->engine);
 102         if (dh->meth == NULL) {
 103             ENGINE_finish(engine);
 104             free(dh);
 105             return 0;
 106         }
 107     }
 108
 109     if (dh->meth == NULL)
 110         dh->meth = DH_get_default_method();
 111
 112     (*dh->meth->init)(dh);
 113
 114     return dh;
 115 }
 116
 117 /**
 118  * Free a DH object and release related resources, like ENGINE, that
 119  * the object was using.
 120  *
 121  * @param dh object to be freed.
 122  *
 123  * @ingroup hcrypto_dh
 124  */
 125
 126 void
 127 DH_free(DH *dh)
 128 {
 129     if (dh->references <= 0)
 130         abort();
 131
 132     if (--dh->references > 0)
 133         return;
 134
 135     (*dh->meth->finish)(dh);
 136
 137     if (dh->engine)
 138         ENGINE_finish(dh->engine);
 139
 140 #define free_if(f) if (f) { BN_free(f); }
 141     free_if(dh->p);
 142     free_if(dh->g);
 143     free_if(dh->pub_key);
 144     free_if(dh->priv_key);
 145     free_if(dh->q);
 146     free_if(dh->j);
 147     free_if(dh->counter);
 148 #undef free_if
 149
 150     memset(dh, 0, sizeof(*dh));
 151     free(dh);
 152 }
 153
 154 /**
 155  * Add a reference to the DH object.
 156  *
 157  * @param dh the object to increase the reference count too.
 158  *
 159  * @return the updated reference count
 160  *
 161  * @ingroup hcrypto_dh
 162  */
 163
 164 int
 165 DH_up_ref(DH *dh)
 166 {
 167     return ++dh->references;
 168 }
 169
 170 /**
 171  * The maximum output size of the DH_compute_key() function.
 172  *
 173  * @param dh The DH object to get the size from.
 174  *
 175  * @return the maximum size in bytes of the out data.
 176  *
 177  * @ingroup hcrypto_dh
 178  */
 179
 180 int
 181 DH_size(const DH *dh)
 182 {
 183     return BN_num_bytes(dh->p);
 184 }
 185
 186 int
 187 DH_set_ex_data(DH *dh, int idx, void *data)
 188 {
 189     dh->ex_data.sk = data;
 190     return 1;
 191 }
 192
 193 void *
 194 DH_get_ex_data(DH *dh, int idx)
 195 {
 196     return dh->ex_data.sk;
 197 }
 198
 199 /**
 200  * Generate DH parameters for the DH object give parameters.
 201  *
 202  * @param dh The DH object to generate parameters for.
 203  * @param prime_len length of the prime
 204  * @param generator generator, g
 205  * @param cb Callback parameters to show progress, can be NULL.
 206  *
 207  * @return the maximum size in bytes of the out data.
 208  *
 209  * @ingroup hcrypto_dh
 210  */
 211
 212 int
 213 DH_generate_parameters_ex(DH *dh, int prime_len, int generator, BN_GENCB *cb)
 214 {
 215     if (dh->meth->generate_params)
 216         return dh->meth->generate_params(dh, prime_len, generator, cb);
 217     return 0;
 218 }
 219
 220 /**
 221  * Check that the public key is sane.
 222  *
 223  * @param dh the local peer DH parameters.
 224  * @param pub_key the remote peer public key parameters.
 225  * @param codes return that the failures of the pub_key are.
 226  *
 227  * @return 1 on success, 0 on failure and *codes is set the the
 228  * combined fail check for the public key
 229  *
 230  * @ingroup hcrypto_dh
 231  */
 232
 233 int
 234 DH_check_pubkey(const DH *dh, const BIGNUM *pub_key, int *codes)
 235 {
 236     BIGNUM *bn = NULL, *sum = NULL;
 237     int ret = 0;
 238
 239     *codes = 0;
 240
 241     /**
 242      * Checks that the function performs are:
 243      * - pub_key is not negative
 244      */
 245
 246     if (BN_is_negative(pub_key))
 247         goto out;
 248
 249     /**
 250      * - pub_key > 1    and    pub_key < p - 1,
 251      *    to avoid small subgroups attack.
 252      */
 253
 254     bn = BN_new();
 255     if (bn == NULL)
 256         goto out;
 257
 258     if (!BN_set_word(bn, 1))
 259         goto out;
 260
 261     if (BN_cmp(bn, pub_key) >= 0)
 262         *codes |= DH_CHECK_PUBKEY_TOO_SMALL;
 263
 264     sum = BN_new();
 265     if (sum == NULL)
 266         goto out;
 267
 268     BN_uadd(sum, pub_key, bn);
 269
 270     if (BN_cmp(sum, dh->p) >= 0)
 271         *codes |= DH_CHECK_PUBKEY_TOO_LARGE;
 272
 273     /**
 274      * - if g == 2, pub_key have more then one bit set,
 275      *   if bits set is 1, log_2(pub_key) is trival
 276      */
 277
 278     if (!BN_set_word(bn, 2))
 279         goto out;
 280
 281     if (BN_cmp(bn, pub_key) == 0) {
 282         unsigned i, n = BN_num_bits(pub_key);
 283         unsigned bits = 0;
 284
 285         for (i = 0; i <= n; i++)
 286             if (BN_is_bit_set(pub_key, i))
 287                 bits++;
 288
 289         if (bits > 1) {
 290             *codes |= DH_CHECK_PUBKEY_TOO_SMALL;
 291             goto out;
 292         }
 293     }
 294
 295     ret = 1;
 296 out:
 297     if (bn)
 298         BN_free(bn);
 299     if (sum)
 300         BN_free(sum);
 301
 302     return ret;
 303 }
 304
 305 /**
 306  * Generate a new DH private-public key pair. The dh parameter must be
 307  * allocted first with DH_new().
 308  *
 309  * @param dh dh parameter.
 310  *
 311  * @return 1 on success.
 312  *
 313  * @ingroup hcrypto_dh
 314  */
 315
 316 int
 317 DH_generate_key(DH *dh)
 318 {
 319     return dh->meth->generate_key(dh);
 320 }
 321
 322 /**
 323  * Complute the shared secret key.
 324  *
 325  * @param shared_key the resulting shared key, need to be at least
 326  * DH_size() large.
 327  * @param peer_pub_key the peer's public key.
 328  * @param dh the dh key pair.
 329  *
 330  * @return 1 on success.
 331  *
 332  * @ingroup hcrypto_dh
 333  */
 334
 335 int
 336 DH_compute_key(unsigned char *shared_key,
 337                const BIGNUM *peer_pub_key, DH *dh)
 338 {
 339     int codes;
 340
 341     if (!DH_check_pubkey(dh, peer_pub_key, &codes) || codes != 0)
 342         return -1;
 343
 344     return dh->meth->compute_key(shared_key, peer_pub_key, dh);
 345 }
 346
 347 /**
 348  * Set a new method for the DH keypair.
 349  *
 350  * @param dh dh parameter.
 351  * @param method the new method for the DH parameter.
 352  *
 353  * @return 1 on success.
 354  *
 355  * @ingroup hcrypto_dh
 356  */
 357
 358 int
 359 DH_set_method(DH *dh, const DH_METHOD *method)
 360 {
 361     (*dh->meth->finish)(dh);
 362     if (dh->engine) {
 363         ENGINE_finish(dh->engine);
 364         dh->engine = NULL;
 365     }
 366     dh->meth = method;
 367     (*dh->meth->init)(dh);
 368     return 1;
 369 }
 370
 371 /*
 372  *
 373  */
 374
 375 static int
 376 dh_null_generate_key(DH *dh)
 377 {
 378     return 0;
 379 }
 380
 381 static int
 382 dh_null_compute_key(unsigned char *shared,const BIGNUM *pub, DH *dh)
 383 {
 384     return 0;
 385 }
 386
 387 static int
 388 dh_null_init(DH *dh)
 389 {
 390     return 1;
 391 }
 392
 393 static int
 394 dh_null_finish(DH *dh)
 395 {
 396     return 1;
 397 }
 398
 399 static int
 400 dh_null_generate_params(DH *dh, int prime_num, int len, BN_GENCB *cb)
 401 {
 402     return 0;
 403 }
 404
 405 static const DH_METHOD dh_null_method = {
 406     "hcrypto null DH",
 407     dh_null_generate_key,
 408     dh_null_compute_key,
 409     NULL,
 410     dh_null_init,
 411     dh_null_finish,
 412     0,
 413     NULL,
 414     dh_null_generate_params
 415 };
 416
 417 extern const DH_METHOD hc_dh_imath_method;
 418 static const DH_METHOD *dh_default_method = &hc_dh_imath_method;
 419
 420 /**
 421  * Return the dummy DH implementation.
 422  *
 423  * @return pointer to a DH_METHOD.
 424  *
 425  * @ingroup hcrypto_dh
 426  */
 427
 428 const DH_METHOD *
 429 DH_null_method(void)
 430 {
 431     return &dh_null_method;
 432 }
 433
 434 /**
 435  * Set the default DH implementation.
 436  *
 437  * @param meth pointer to a DH_METHOD.
 438  *
 439  * @ingroup hcrypto_dh
 440  */
 441
 442 void
 443 DH_set_default_method(const DH_METHOD *meth)
 444 {
 445     dh_default_method = meth;
 446 }
 447
 448 /**
 449  * Return the default DH implementation.
 450  *
 451  * @return pointer to a DH_METHOD.
 452  *
 453  * @ingroup hcrypto_dh
 454  */
 455
 456 const DH_METHOD *
 457 DH_get_default_method(void)
 458 {
 459     return dh_default_method;
 460 }
 461