lib/auth_dh_common.c

   1 /*
   2  * Copyright (C) 2002, 2003, 2004, 2005, 2007, 2009, 2010 Free Software
   3  * Foundation, Inc.
   4  *
   5  * Author: Nikos Mavrogiannopoulos
   6  *
   7  * This file is part of GNUTLS.
   8  *
   9  * The GNUTLS library is free software; you can redistribute it and/or
  10  * modify it under the terms of the GNU Lesser General Public License
  11  * as published by the Free Software Foundation; either version 2.1 of
  12  * the License, or (at your option) any later version.
  13  *
  14  * This library is distributed in the hope that it will be useful, but
  15  * WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  17  * Lesser General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU Lesser General Public
  20  * License along with this library; if not, write to the Free Software
  21  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
  22  * USA
  23  *
  24  */
  25
  26 /* This file contains common stuff in Ephemeral Diffie-Hellman (DHE)
  27  * and Anonymous DH key exchange(DHA). These are used in the handshake
  28  * procedure of the certificate and anoymous authentication.
  29  */
  30
  31 #include "gnutls_int.h"
  32 #include "gnutls_auth.h"
  33 #include "gnutls_errors.h"
  34 #include "gnutls_dh.h"
  35 #include "gnutls_num.h"
  36 #include "gnutls_sig.h"
  37 #include <gnutls_datum.h>
  38 #include <gnutls_x509.h>
  39 #include <gnutls_state.h>
  40 #include <auth_dh_common.h>
  41 #include <gnutls_algorithms.h>
  42 #include <auth_psk.h>
  43
  44 /* Frees the dh_info_st structure.
  45  */
  46 void
  47 _gnutls_free_dh_info (dh_info_st * dh)
  48 {
  49   dh->secret_bits = 0;
  50   _gnutls_free_datum (&dh->prime);
  51   _gnutls_free_datum (&dh->generator);
  52   _gnutls_free_datum (&dh->public_key);
  53 }
  54
  55 int
  56 _gnutls_proc_dh_common_client_kx (gnutls_session_t session,
  57                                   opaque * data, size_t _data_size,
  58                                   bigint_t g, bigint_t p)
  59 {
  60   uint16_t n_Y;
  61   size_t _n_Y;
  62   int ret;
  63   ssize_t data_size = _data_size;
  64
  65
  66   DECR_LEN (data_size, 2);
  67   n_Y = _gnutls_read_uint16 (&data[0]);
  68   _n_Y = n_Y;
  69
  70   DECR_LEN (data_size, n_Y);
  71   if (_gnutls_mpi_scan_nz (&session->key->client_Y, &data[2], _n_Y))
  72     {
  73       gnutls_assert ();
  74       return GNUTLS_E_MPI_SCAN_FAILED;
  75     }
  76
  77   _gnutls_dh_set_peer_public (session, session->key->client_Y);
  78
  79   session->key->KEY =
  80     gnutls_calc_dh_key (session->key->client_Y, session->key->dh_secret, p);
  81
  82   if (session->key->KEY == NULL)
  83     {
  84       gnutls_assert ();
  85       return GNUTLS_E_MEMORY_ERROR;
  86     }
  87
  88   _gnutls_mpi_release (&session->key->client_Y);
  89   _gnutls_mpi_release (&session->key->dh_secret);
  90
  91
  92   if (_gnutls_cipher_suite_get_kx_algo
  93       (&session->security_parameters.current_cipher_suite)
  94       != GNUTLS_KX_DHE_PSK)
  95     {
  96       ret = _gnutls_mpi_dprint (session->key->KEY, &session->key->key);
  97     }
  98   else                          /* In DHE_PSK the key is set differently */
  99     {
 100       gnutls_datum_t tmp_dh_key;
 101       ret = _gnutls_mpi_dprint (session->key->KEY, &tmp_dh_key);
 102       if (ret < 0)
 103         {
 104           gnutls_assert ();
 105           return ret;
 106         }
 107
 108       ret = _gnutls_set_psk_session_key (session, &tmp_dh_key);
 109       _gnutls_free_datum (&tmp_dh_key);
 110
 111     }
 112
 113   _gnutls_mpi_release (&session->key->KEY);
 114
 115   if (ret < 0)
 116     {
 117       return ret;
 118     }
 119
 120   return 0;
 121 }
 122
 123 int
 124 _gnutls_gen_dh_common_client_kx (gnutls_session_t session, opaque ** data)
 125 {
 126   bigint_t x = NULL, X = NULL;
 127   size_t n_X;
 128   int ret;
 129
 130   *data = NULL;
 131
 132   X = gnutls_calc_dh_secret (&x, session->key->client_g,
 133                              session->key->client_p);
 134   if (X == NULL || x == NULL)
 135     {
 136       gnutls_assert ();
 137       ret = GNUTLS_E_MEMORY_ERROR;
 138       goto error;
 139     }
 140
 141   _gnutls_dh_set_secret_bits (session, _gnutls_mpi_get_nbits (x));
 142
 143   _gnutls_mpi_print (X, NULL, &n_X);
 144   (*data) = gnutls_malloc (n_X + 2);
 145   if (*data == NULL)
 146     {
 147       ret = GNUTLS_E_MEMORY_ERROR;
 148       goto error;
 149     }
 150
 151   _gnutls_mpi_print (X, &(*data)[2], &n_X);
 152   _gnutls_mpi_release (&X);
 153
 154   _gnutls_write_uint16 (n_X, &(*data)[0]);
 155
 156   /* calculate the key after calculating the message */
 157   session->key->KEY =
 158     gnutls_calc_dh_key (session->key->client_Y, x, session->key->client_p);
 159
 160   _gnutls_mpi_release (&x);
 161   if (session->key->KEY == NULL)
 162     {
 163       gnutls_assert ();
 164       ret = GNUTLS_E_MEMORY_ERROR;
 165       goto error;
 166     }
 167
 168   /* THESE SHOULD BE DISCARDED */
 169   _gnutls_mpi_release (&session->key->client_Y);
 170   _gnutls_mpi_release (&session->key->client_p);
 171   _gnutls_mpi_release (&session->key->client_g);
 172
 173   if (_gnutls_cipher_suite_get_kx_algo
 174       (&session->security_parameters.current_cipher_suite)
 175       != GNUTLS_KX_DHE_PSK)
 176     {
 177       ret = _gnutls_mpi_dprint (session->key->KEY, &session->key->key);
 178     }
 179   else                          /* In DHE_PSK the key is set differently */
 180     {
 181       gnutls_datum_t tmp_dh_key;
 182       ret = _gnutls_mpi_dprint (session->key->KEY, &tmp_dh_key);
 183       if (ret < 0)
 184         {
 185           gnutls_assert ();
 186           goto error;
 187         }
 188
 189       ret = _gnutls_set_psk_session_key (session, &tmp_dh_key);
 190       _gnutls_free_datum (&tmp_dh_key);
 191
 192     }
 193
 194   _gnutls_mpi_release (&session->key->KEY);
 195
 196   if (ret < 0)
 197     {
 198       gnutls_assert ();
 199       goto error;
 200     }
 201
 202   return n_X + 2;
 203
 204 error:
 205   _gnutls_mpi_release (&x);
 206   _gnutls_mpi_release (&X);
 207   gnutls_free (*data);
 208   *data = NULL;
 209   return ret;
 210 }
 211
 212 int
 213 _gnutls_proc_dh_common_server_kx (gnutls_session_t session,
 214                                   opaque * data, size_t _data_size, int psk)
 215 {
 216   uint16_t n_Y, n_g, n_p;
 217   size_t _n_Y, _n_g, _n_p;
 218   uint8_t *data_p;
 219   uint8_t *data_g;
 220   uint8_t *data_Y;
 221   int i, bits, psk_size, ret;
 222   ssize_t data_size = _data_size;
 223
 224   i = 0;
 225
 226   if (psk != 0)
 227     {
 228       DECR_LEN (data_size, 2);
 229       psk_size = _gnutls_read_uint16 (&data[i]);
 230       DECR_LEN (data_size, psk_size);
 231       i += 2 + psk_size;
 232     }
 233
 234   DECR_LEN (data_size, 2);
 235   n_p = _gnutls_read_uint16 (&data[i]);
 236   i += 2;
 237
 238   DECR_LEN (data_size, n_p);
 239   data_p = &data[i];
 240   i += n_p;
 241
 242   DECR_LEN (data_size, 2);
 243   n_g = _gnutls_read_uint16 (&data[i]);
 244   i += 2;
 245
 246   DECR_LEN (data_size, n_g);
 247   data_g = &data[i];
 248   i += n_g;
 249
 250   DECR_LEN (data_size, 2);
 251   n_Y = _gnutls_read_uint16 (&data[i]);
 252   i += 2;
 253
 254   DECR_LEN (data_size, n_Y);
 255   data_Y = &data[i];
 256   i += n_Y;
 257
 258   _n_Y = n_Y;
 259   _n_g = n_g;
 260   _n_p = n_p;
 261
 262   if (_gnutls_mpi_scan_nz (&session->key->client_Y, data_Y, _n_Y) != 0)
 263     {
 264       gnutls_assert ();
 265       return GNUTLS_E_MPI_SCAN_FAILED;
 266     }
 267
 268   if (_gnutls_mpi_scan_nz (&session->key->client_g, data_g, _n_g) != 0)
 269     {
 270       gnutls_assert ();
 271       return GNUTLS_E_MPI_SCAN_FAILED;
 272     }
 273   if (_gnutls_mpi_scan_nz (&session->key->client_p, data_p, _n_p) != 0)
 274     {
 275       gnutls_assert ();
 276       return GNUTLS_E_MPI_SCAN_FAILED;
 277     }
 278
 279   bits = _gnutls_dh_get_allowed_prime_bits (session);
 280   if (bits < 0)
 281     {
 282       gnutls_assert ();
 283       return bits;
 284     }
 285
 286   if (_gnutls_mpi_get_nbits (session->key->client_p) < (size_t) bits)
 287     {
 288       /* the prime used by the peer is not acceptable
 289        */
 290       gnutls_assert ();
 291       return GNUTLS_E_DH_PRIME_UNACCEPTABLE;
 292     }
 293
 294   _gnutls_dh_set_group (session, session->key->client_g,
 295                         session->key->client_p);
 296   _gnutls_dh_set_peer_public (session, session->key->client_Y);
 297
 298   ret = n_Y + n_p + n_g + 6;
 299   if (psk != 0)
 300     ret += 2;
 301
 302   return ret;
 303 }
 304
 305 /* If the psk flag is set, then an empty psk_identity_hint will
 306  * be inserted */
 307 int
 308 _gnutls_dh_common_print_server_kx (gnutls_session_t session,
 309                                    bigint_t g, bigint_t p, opaque ** data,
 310                                    int psk)
 311 {
 312   bigint_t x, X;
 313   size_t n_X, n_g, n_p;
 314   int ret, data_size, pos;
 315   uint8_t *pdata;
 316
 317   X = gnutls_calc_dh_secret (&x, g, p);
 318   if (X == NULL || x == NULL)
 319     {
 320       gnutls_assert ();
 321       return GNUTLS_E_MEMORY_ERROR;
 322     }
 323
 324   session->key->dh_secret = x;
 325   _gnutls_dh_set_secret_bits (session, _gnutls_mpi_get_nbits (x));
 326
 327   _gnutls_mpi_print (g, NULL, &n_g);
 328   _gnutls_mpi_print (p, NULL, &n_p);
 329   _gnutls_mpi_print (X, NULL, &n_X);
 330
 331   data_size = n_g + n_p + n_X + 6;
 332   if (psk != 0)
 333     data_size += 2;
 334
 335   (*data) = gnutls_malloc (data_size);
 336   if (*data == NULL)
 337     {
 338       _gnutls_mpi_release (&X);
 339       return GNUTLS_E_MEMORY_ERROR;
 340     }
 341
 342   pos = 0;
 343   pdata = *data;
 344
 345   if (psk != 0)
 346     {
 347       _gnutls_write_uint16 (0, &pdata[pos]);
 348       pos += 2;
 349     }
 350
 351   _gnutls_mpi_print (p, &pdata[pos + 2], &n_p);
 352   _gnutls_write_uint16 (n_p, &pdata[pos]);
 353
 354   pos += n_p + 2;
 355
 356   _gnutls_mpi_print (g, &pdata[pos + 2], &n_g);
 357   _gnutls_write_uint16 (n_g, &pdata[pos]);
 358
 359   pos += n_g + 2;
 360
 361   _gnutls_mpi_print (X, &pdata[pos + 2], &n_X);
 362   _gnutls_mpi_release (&X);
 363
 364   _gnutls_write_uint16 (n_X, &pdata[pos]);
 365
 366   ret = data_size;
 367
 368   return ret;
 369 }