source4/heimdal/lib/hcrypto/dh-tfm.c

   1 /*
   2  * Copyright (c) 2006 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include <config.h>
  35 #include <roken.h>
  36
  37 #include <dh.h>
  38
  39 #ifdef USE_HCRYPTO_TFM
  40
  41 #include "tfm.h"
  42
  43 static void
  44 BN2mpz(fp_int *s, const BIGNUM *bn)
  45 {
  46     size_t len;
  47     void *p;
  48
  49     len = BN_num_bytes(bn);
  50     p = malloc(len);
  51     BN_bn2bin(bn, p);
  52     fp_read_unsigned_bin(s, p, len);
  53     free(p);
  54 }
  55
  56
  57 static BIGNUM *
  58 mpz2BN(fp_int *s)
  59 {
  60     size_t size;
  61     BIGNUM *bn;
  62     void *p;
  63
  64     size = fp_unsigned_bin_size(s);
  65     p = malloc(size);
  66     if (p == NULL && size != 0)
  67         return NULL;
  68     fp_to_unsigned_bin(s, p);
  69
  70     bn = BN_bin2bn(p, size, NULL);
  71     free(p);
  72     return bn;
  73 }
  74
  75 /*
  76  *
  77  */
  78
  79 #define DH_NUM_TRIES 10
  80
  81 static int
  82 tfm_dh_generate_key(DH *dh)
  83 {
  84     fp_int pub, priv_key, g, p;
  85     int have_private_key = (dh->priv_key != NULL);
  86     int codes, times = 0;
  87     int res;
  88
  89     if (dh->p == NULL || dh->g == NULL)
  90         return 0;
  91
  92     while (times++ < DH_NUM_TRIES) {
  93         if (!have_private_key) {
  94             size_t bits = BN_num_bits(dh->p);
  95
  96             if (dh->priv_key)
  97                 BN_free(dh->priv_key);
  98
  99             dh->priv_key = BN_new();
 100             if (dh->priv_key == NULL)
 101                 return 0;
 102             if (!BN_rand(dh->priv_key, bits - 1, 0, 0)) {
 103                 BN_clear_free(dh->priv_key);
 104                 dh->priv_key = NULL;
 105                 return 0;
 106             }
 107         }
 108         if (dh->pub_key)
 109             BN_free(dh->pub_key);
 110
 111         fp_init_multi(&pub, &priv_key, &g, &p, NULL);
 112
 113         BN2mpz(&priv_key, dh->priv_key);
 114         BN2mpz(&g, dh->g);
 115         BN2mpz(&p, dh->p);
 116
 117         res = fp_exptmod(&g, &priv_key, &p, &pub);
 118
 119         fp_zero(&priv_key);
 120         fp_zero(&g);
 121         fp_zero(&p);
 122         if (res != 0)
 123             continue;
 124
 125         dh->pub_key = mpz2BN(&pub);
 126         fp_zero(&pub);
 127         if (dh->pub_key == NULL)
 128             return 0;
 129
 130         if (DH_check_pubkey(dh, dh->pub_key, &codes) && codes == 0)
 131             break;
 132         if (have_private_key)
 133             return 0;
 134     }
 135
 136     if (times >= DH_NUM_TRIES) {
 137         if (!have_private_key && dh->priv_key) {
 138             BN_free(dh->priv_key);
 139             dh->priv_key = NULL;
 140         }
 141         if (dh->pub_key) {
 142             BN_free(dh->pub_key);
 143             dh->pub_key = NULL;
 144         }
 145         return 0;
 146     }
 147
 148     return 1;
 149 }
 150
 151 static int
 152 tfm_dh_compute_key(unsigned char *shared, const BIGNUM * pub, DH *dh)
 153 {
 154     fp_int s, priv_key, p, peer_pub;
 155     size_t size = 0;
 156     int ret;
 157
 158     if (dh->pub_key == NULL || dh->g == NULL || dh->priv_key == NULL)
 159         return -1;
 160
 161     fp_init(&p);
 162     BN2mpz(&p, dh->p);
 163
 164     fp_init(&peer_pub);
 165     BN2mpz(&peer_pub, pub);
 166
 167     /* check if peers pubkey is reasonable */
 168     if (fp_isneg(&peer_pub)
 169         || fp_cmp(&peer_pub, &p) >= 0
 170         || fp_cmp_d(&peer_pub, 1) <= 0)
 171     {
 172         fp_zero(&p);
 173         fp_zero(&peer_pub);
 174         return -1;
 175     }
 176
 177     fp_init(&priv_key);
 178     BN2mpz(&priv_key, dh->priv_key);
 179
 180     fp_init(&s);
 181
 182     ret = fp_exptmod(&peer_pub, &priv_key, &p, &s);
 183
 184     fp_zero(&p);
 185     fp_zero(&peer_pub);
 186     fp_zero(&priv_key);
 187
 188     if (ret != 0)
 189         return -1;
 190
 191     size = fp_unsigned_bin_size(&s);
 192     fp_to_unsigned_bin(&s, shared);
 193     fp_zero(&s);
 194
 195     return size;
 196 }
 197
 198 static int
 199 tfm_dh_generate_params(DH *dh, int a, int b, BN_GENCB *callback)
 200 {
 201     /* groups should already be known, we don't care about this */
 202     return 0;
 203 }
 204
 205 static int
 206 tfm_dh_init(DH *dh)
 207 {
 208     return 1;
 209 }
 210
 211 static int
 212 tfm_dh_finish(DH *dh)
 213 {
 214     return 1;
 215 }
 216
 217
 218 /*
 219  *
 220  */
 221
 222 const DH_METHOD _hc_dh_tfm_method = {
 223     "hcrypto tfm DH",
 224     tfm_dh_generate_key,
 225     tfm_dh_compute_key,
 226     NULL,
 227     tfm_dh_init,
 228     tfm_dh_finish,
 229     0,
 230     NULL,
 231     tfm_dh_generate_params
 232 };
 233
 234 /**
 235  * DH implementation using tfm.
 236  *
 237  * @return the DH_METHOD for the DH implementation using tfm.
 238  *
 239  * @ingroup hcrypto_dh
 240  */
 241
 242 const DH_METHOD *
 243 DH_tfm_method(void)
 244 {
 245     return &_hc_dh_tfm_method;
 246 }
 247
 248 #endif