1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
5 // This code implements SPAKE2, a variant of EKE:
6 // http://www.di.ens.fr/~pointche/pub.php?reference=AbPo04
8 #include <crypto/p224_spake.h>
12 #include <base/logging.h>
13 #include <crypto/p224.h>
14 #include <crypto/random.h>
15 #include <crypto/secure_util.h>
19 // The following two points (M and N in the protocol) are verifiable random
20 // points on the curve and can be generated with the following code:
22 // #include <stdint.h>
24 // #include <string.h>
26 // #include <openssl/ec.h>
27 // #include <openssl/obj_mac.h>
28 // #include <openssl/sha.h>
30 // static const char kSeed1[] = "P224 point generation seed (M)";
31 // static const char kSeed2[] = "P224 point generation seed (N)";
33 // void find_seed(const char* seed) {
35 // uint8_t digest[SHA256_DIGEST_LENGTH];
37 // SHA256_Init(&sha256);
38 // SHA256_Update(&sha256, seed, strlen(seed));
39 // SHA256_Final(digest, &sha256);
42 // EC_GROUP* p224 = EC_GROUP_new_by_curve_name(NID_secp224r1);
43 // EC_POINT* p = EC_POINT_new(p224);
45 // for (unsigned i = 0;; i++) {
47 // BN_bin2bn(digest, 28, &x);
49 // if (EC_POINT_set_compressed_coordinates_GFp(
50 // p224, p, &x, digest[28] & 1, NULL)) {
52 // EC_POINT_get_affine_coordinates_GFp(p224, p, &x, &y, NULL);
53 // char* x_str = BN_bn2hex(&x);
54 // char* y_str = BN_bn2hex(&y);
55 // printf("Found after %u iterations:\n%s\n%s\n", i, x_str, y_str);
56 // OPENSSL_free(x_str);
57 // OPENSSL_free(y_str);
63 // SHA256_Init(&sha256);
64 // SHA256_Update(&sha256, digest, sizeof(digest));
65 // SHA256_Final(digest, &sha256);
71 // EC_GROUP_free(p224);
80 const crypto::p224::Point kM
= {
81 {174237515, 77186811, 235213682, 33849492,
82 33188520, 48266885, 177021753, 81038478},
83 {104523827, 245682244, 266509668, 236196369,
84 28372046, 145351378, 198520366, 113345994},
85 {1, 0, 0, 0, 0, 0, 0, 0},
88 const crypto::p224::Point kN
= {
89 {136176322, 263523628, 251628795, 229292285,
90 5034302, 185981975, 171998428, 11653062},
91 {197567436, 51226044, 60372156, 175772188,
92 42075930, 8083165, 160827401, 65097570},
93 {1, 0, 0, 0, 0, 0, 0, 0},
96 } // anonymous namespace
100 P224EncryptedKeyExchange::P224EncryptedKeyExchange(
101 PeerType peer_type
, const base::StringPiece
& password
)
102 : state_(kStateInitial
),
103 is_server_(peer_type
== kPeerTypeServer
) {
104 memset(&x_
, 0, sizeof(x_
));
105 memset(&expected_authenticator_
, 0, sizeof(expected_authenticator_
));
107 // x_ is a random scalar.
108 RandBytes(x_
, sizeof(x_
));
110 // Calculate |password| hash to get SPAKE password value.
111 SHA256HashString(std::string(password
.data(), password
.length()),
117 void P224EncryptedKeyExchange::Init() {
120 p224::ScalarBaseMult(x_
, &X
);
122 // The client masks the Diffie-Hellman value, X, by adding M**pw and the
123 // server uses N**pw.
125 p224::ScalarMult(is_server_
? kN
: kM
, pw_
, &MNpw
);
127 // X* = X + (N|M)**pw
129 p224::Add(X
, MNpw
, &Xstar
);
131 next_message_
= Xstar
.ToString();
134 const std::string
& P224EncryptedKeyExchange::GetMessage() {
135 if (state_
== kStateInitial
) {
136 state_
= kStateRecvDH
;
137 return next_message_
;
138 } else if (state_
== kStateSendHash
) {
139 state_
= kStateRecvHash
;
140 return next_message_
;
143 LOG(FATAL
) << "P224EncryptedKeyExchange::GetMessage called in"
144 " bad state " << state_
;
146 return next_message_
;
149 P224EncryptedKeyExchange::Result
P224EncryptedKeyExchange::ProcessMessage(
150 const base::StringPiece
& message
) {
151 if (state_
== kStateRecvHash
) {
152 // This is the final state of the protocol: we are reading the peer's
153 // authentication hash and checking that it matches the one that we expect.
154 if (message
.size() != sizeof(expected_authenticator_
)) {
155 error_
= "peer's hash had an incorrect size";
156 return kResultFailed
;
158 if (!SecureMemEqual(message
.data(), expected_authenticator_
,
160 error_
= "peer's hash had incorrect value";
161 return kResultFailed
;
164 return kResultSuccess
;
167 if (state_
!= kStateRecvDH
) {
168 LOG(FATAL
) << "P224EncryptedKeyExchange::ProcessMessage called in"
169 " bad state " << state_
;
170 error_
= "internal error";
171 return kResultFailed
;
174 // Y* is the other party's masked, Diffie-Hellman value.
176 if (!Ystar
.SetFromString(message
)) {
177 error_
= "failed to parse peer's masked Diffie-Hellman value";
178 return kResultFailed
;
181 // We calculate the mask value: (N|M)**pw
182 p224::Point MNpw
, minus_MNpw
, Y
, k
;
183 p224::ScalarMult(is_server_
? kM
: kN
, pw_
, &MNpw
);
184 p224::Negate(MNpw
, &minus_MNpw
);
186 // Y = Y* - (N|M)**pw
187 p224::Add(Ystar
, minus_MNpw
, &Y
);
190 p224::ScalarMult(Y
, x_
, &k
);
192 // If everything worked out, then K is the same for both parties.
195 std::string client_masked_dh
, server_masked_dh
;
197 client_masked_dh
= message
.as_string();
198 server_masked_dh
= next_message_
;
200 client_masked_dh
= next_message_
;
201 server_masked_dh
= message
.as_string();
204 // Now we calculate the hashes that each side will use to prove to the other
205 // that they derived the correct value for K.
206 uint8 client_hash
[kSHA256Length
], server_hash
[kSHA256Length
];
207 CalculateHash(kPeerTypeClient
, client_masked_dh
, server_masked_dh
, key_
,
209 CalculateHash(kPeerTypeServer
, client_masked_dh
, server_masked_dh
, key_
,
212 const uint8
* my_hash
= is_server_
? server_hash
: client_hash
;
213 const uint8
* their_hash
= is_server_
? client_hash
: server_hash
;
216 std::string(reinterpret_cast<const char*>(my_hash
), kSHA256Length
);
217 memcpy(expected_authenticator_
, their_hash
, kSHA256Length
);
218 state_
= kStateSendHash
;
219 return kResultPending
;
222 void P224EncryptedKeyExchange::CalculateHash(
224 const std::string
& client_masked_dh
,
225 const std::string
& server_masked_dh
,
226 const std::string
& k
,
228 std::string hash_contents
;
230 if (peer_type
== kPeerTypeServer
) {
231 hash_contents
= "server";
233 hash_contents
= "client";
236 hash_contents
+= client_masked_dh
;
237 hash_contents
+= server_masked_dh
;
239 std::string(reinterpret_cast<const char *>(pw_
), sizeof(pw_
));
242 SHA256HashString(hash_contents
, out_digest
, kSHA256Length
);
245 const std::string
& P224EncryptedKeyExchange::error() const {
249 const std::string
& P224EncryptedKeyExchange::GetKey() const {
250 DCHECK_EQ(state_
, kStateDone
);
251 return GetUnverifiedKey();
254 const std::string
& P224EncryptedKeyExchange::GetUnverifiedKey() const {
255 // Key is already final when state is kStateSendHash. Subsequent states are
256 // used only for verification of the key. Some users may combine verification
257 // with sending verifiable data instead of |expected_authenticator_|.
258 DCHECK_GE(state_
, kStateSendHash
);
262 void P224EncryptedKeyExchange::SetXForTesting(const std::string
& x
) {
263 memset(&x_
, 0, sizeof(x_
));
264 memcpy(&x_
, x
.data(), std::min(x
.size(), sizeof(x_
)));
268 } // namespace crypto