crypto/openssh/ssh-ecdsa.c

   1 /* $OpenBSD: ssh-ecdsa.c,v 1.16 2019/01/21 09:54:11 djm Exp $ */
   2 /*
   3  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
   4  * Copyright (c) 2010 Damien Miller.  All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  * 1. Redistributions of source code must retain the above copyright
  10  *    notice, this list of conditions and the following disclaimer.
  11  * 2. Redistributions in binary form must reproduce the above copyright
  12  *    notice, this list of conditions and the following disclaimer in the
  13  *    documentation and/or other materials provided with the distribution.
  14  *
  15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  16  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  17  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  18  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  19  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  20  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  21  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  22  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  23  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  24  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  25  */
  26
  27 #include "includes.h"
  28
  29 #if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC)
  30
  31 #include <sys/types.h>
  32
  33 #include <openssl/bn.h>
  34 #include <openssl/ec.h>
  35 #include <openssl/ecdsa.h>
  36 #include <openssl/evp.h>
  37
  38 #include <string.h>
  39
  40 #include "sshbuf.h"
  41 #include "ssherr.h"
  42 #include "digest.h"
  43 #define SSHKEY_INTERNAL
  44 #include "sshkey.h"
  45
  46 #include "openbsd-compat/openssl-compat.h"
  47
  48 /* ARGSUSED */
  49 int
  50 ssh_ecdsa_sign(const struct sshkey *key, u_char **sigp, size_t *lenp,
  51     const u_char *data, size_t datalen, u_int compat)
  52 {
  53         ECDSA_SIG *sig = NULL;
  54         const BIGNUM *sig_r, *sig_s;
  55         int hash_alg;
  56         u_char digest[SSH_DIGEST_MAX_LENGTH];
  57         size_t len, dlen;
  58         struct sshbuf *b = NULL, *bb = NULL;
  59         int ret = SSH_ERR_INTERNAL_ERROR;
  60
  61         if (lenp != NULL)
  62                 *lenp = 0;
  63         if (sigp != NULL)
  64                 *sigp = NULL;
  65
  66         if (key == NULL || key->ecdsa == NULL ||
  67             sshkey_type_plain(key->type) != KEY_ECDSA)
  68                 return SSH_ERR_INVALID_ARGUMENT;
  69
  70         if ((hash_alg = sshkey_ec_nid_to_hash_alg(key->ecdsa_nid)) == -1 ||
  71             (dlen = ssh_digest_bytes(hash_alg)) == 0)
  72                 return SSH_ERR_INTERNAL_ERROR;
  73         if ((ret = ssh_digest_memory(hash_alg, data, datalen,
  74             digest, sizeof(digest))) != 0)
  75                 goto out;
  76
  77         if ((sig = ECDSA_do_sign(digest, dlen, key->ecdsa)) == NULL) {
  78                 ret = SSH_ERR_LIBCRYPTO_ERROR;
  79                 goto out;
  80         }
  81
  82         if ((bb = sshbuf_new()) == NULL || (b = sshbuf_new()) == NULL) {
  83                 ret = SSH_ERR_ALLOC_FAIL;
  84                 goto out;
  85         }
  86         ECDSA_SIG_get0(sig, &sig_r, &sig_s);
  87         if ((ret = sshbuf_put_bignum2(bb, sig_r)) != 0 ||
  88             (ret = sshbuf_put_bignum2(bb, sig_s)) != 0)
  89                 goto out;
  90         if ((ret = sshbuf_put_cstring(b, sshkey_ssh_name_plain(key))) != 0 ||
  91             (ret = sshbuf_put_stringb(b, bb)) != 0)
  92                 goto out;
  93         len = sshbuf_len(b);
  94         if (sigp != NULL) {
  95                 if ((*sigp = malloc(len)) == NULL) {
  96                         ret = SSH_ERR_ALLOC_FAIL;
  97                         goto out;
  98                 }
  99                 memcpy(*sigp, sshbuf_ptr(b), len);
 100         }
 101         if (lenp != NULL)
 102                 *lenp = len;
 103         ret = 0;
 104  out:
 105         explicit_bzero(digest, sizeof(digest));
 106         sshbuf_free(b);
 107         sshbuf_free(bb);
 108         ECDSA_SIG_free(sig);
 109         return ret;
 110 }
 111
 112 /* ARGSUSED */
 113 int
 114 ssh_ecdsa_verify(const struct sshkey *key,
 115     const u_char *signature, size_t signaturelen,
 116     const u_char *data, size_t datalen, u_int compat)
 117 {
 118         ECDSA_SIG *sig = NULL;
 119         BIGNUM *sig_r = NULL, *sig_s = NULL;
 120         int hash_alg;
 121         u_char digest[SSH_DIGEST_MAX_LENGTH];
 122         size_t dlen;
 123         int ret = SSH_ERR_INTERNAL_ERROR;
 124         struct sshbuf *b = NULL, *sigbuf = NULL;
 125         char *ktype = NULL;
 126
 127         if (key == NULL || key->ecdsa == NULL ||
 128             sshkey_type_plain(key->type) != KEY_ECDSA ||
 129             signature == NULL || signaturelen == 0)
 130                 return SSH_ERR_INVALID_ARGUMENT;
 131
 132         if ((hash_alg = sshkey_ec_nid_to_hash_alg(key->ecdsa_nid)) == -1 ||
 133             (dlen = ssh_digest_bytes(hash_alg)) == 0)
 134                 return SSH_ERR_INTERNAL_ERROR;
 135
 136         /* fetch signature */
 137         if ((b = sshbuf_from(signature, signaturelen)) == NULL)
 138                 return SSH_ERR_ALLOC_FAIL;
 139         if (sshbuf_get_cstring(b, &ktype, NULL) != 0 ||
 140             sshbuf_froms(b, &sigbuf) != 0) {
 141                 ret = SSH_ERR_INVALID_FORMAT;
 142                 goto out;
 143         }
 144         if (strcmp(sshkey_ssh_name_plain(key), ktype) != 0) {
 145                 ret = SSH_ERR_KEY_TYPE_MISMATCH;
 146                 goto out;
 147         }
 148         if (sshbuf_len(b) != 0) {
 149                 ret = SSH_ERR_UNEXPECTED_TRAILING_DATA;
 150                 goto out;
 151         }
 152
 153         /* parse signature */
 154         if (sshbuf_get_bignum2(sigbuf, &sig_r) != 0 ||
 155             sshbuf_get_bignum2(sigbuf, &sig_s) != 0) {
 156                 ret = SSH_ERR_INVALID_FORMAT;
 157                 goto out;
 158         }
 159         if ((sig = ECDSA_SIG_new()) == NULL) {
 160                 ret = SSH_ERR_ALLOC_FAIL;
 161                 goto out;
 162         }
 163         if (!ECDSA_SIG_set0(sig, sig_r, sig_s)) {
 164                 ret = SSH_ERR_LIBCRYPTO_ERROR;
 165                 goto out;
 166         }
 167         sig_r = sig_s = NULL; /* transferred */
 168
 169         if (sshbuf_len(sigbuf) != 0) {
 170                 ret = SSH_ERR_UNEXPECTED_TRAILING_DATA;
 171                 goto out;
 172         }
 173         if ((ret = ssh_digest_memory(hash_alg, data, datalen,
 174             digest, sizeof(digest))) != 0)
 175                 goto out;
 176
 177         switch (ECDSA_do_verify(digest, dlen, sig, key->ecdsa)) {
 178         case 1:
 179                 ret = 0;
 180                 break;
 181         case 0:
 182                 ret = SSH_ERR_SIGNATURE_INVALID;
 183                 goto out;
 184         default:
 185                 ret = SSH_ERR_LIBCRYPTO_ERROR;
 186                 goto out;
 187         }
 188
 189  out:
 190         explicit_bzero(digest, sizeof(digest));
 191         sshbuf_free(sigbuf);
 192         sshbuf_free(b);
 193         ECDSA_SIG_free(sig);
 194         BN_clear_free(sig_r);
 195         BN_clear_free(sig_s);
 196         free(ktype);
 197         return ret;
 198 }
 199
 200 #endif /* WITH_OPENSSL && OPENSSL_HAS_ECC */