lib/algorithms/secparams.c

   1 /*
   2  * Copyright (C) 2011-2012 Free Software Foundation, Inc.
   3  *
   4  * Author: Nikos Mavrogiannopoulos
   5  *
   6  * This file is part of GnuTLS.
   7  *
   8  * The GnuTLS is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public License
  10  * as published by the Free Software Foundation; either version 3 of
  11  * the License, or (at your option) any later version.
  12  *
  13  * This library is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * Lesser General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU Lesser General Public License
  19  * along with this program.  If not, see <http://www.gnu.org/licenses/>
  20  *
  21  */
  22
  23 #include <gnutls_int.h>
  24 #include <algorithms.h>
  25 #include <gnutls_errors.h>
  26 #include <x509/common.h>
  27
  28 typedef struct
  29 {
  30   const char *name;
  31   gnutls_sec_param_t sec_param;
  32   unsigned int bits;                     /* security level */
  33   unsigned int pk_bits;                  /* DH, RSA, SRP */
  34   unsigned int dsa_bits;                 /* bits for DSA. Handled differently since
  35                                  * choice of key size in DSA is political.
  36                                  */
  37   unsigned int subgroup_bits;            /* subgroup bits */
  38   unsigned int ecc_bits;                 /* bits for ECC keys */
  39 } gnutls_sec_params_entry;
  40
  41 static const gnutls_sec_params_entry sec_params[] = {
  42   {"Low", GNUTLS_SEC_PARAM_LOW, 80, 1248, 2048, 160, 160},
  43   {"Legacy", GNUTLS_SEC_PARAM_LEGACY, 96, 1776, 2048, 192, 192},
  44   {"Normal", GNUTLS_SEC_PARAM_NORMAL, 112, 2432, 3072, 224, 224},
  45   {"High", GNUTLS_SEC_PARAM_HIGH, 128, 3248, 3072, 256, 256},
  46   {"Ultra", GNUTLS_SEC_PARAM_ULTRA, 256, 15424, 3072, 512, 512},
  47   {NULL, 0, 0, 0, 0, 0}
  48 };
  49
  50 #define GNUTLS_SEC_PARAM_LOOP(b) \
  51         { const gnutls_sec_params_entry *p; \
  52                 for(p = sec_params; p->name != NULL; p++) { b ; } }
  53
  54 /**
  55  * gnutls_sec_param_to_pk_bits:
  56  * @algo: is a public key algorithm
  57  * @param: is a security parameter
  58  *
  59  * When generating private and public key pairs a difficult question
  60  * is which size of "bits" the modulus will be in RSA and the group size
  61  * in DSA. The easy answer is 1024, which is also wrong. This function
  62  * will convert a human understandable security parameter to an
  63  * appropriate size for the specific algorithm.
  64  *
  65  * Returns: The number of bits, or (0).
  66  *
  67  * Since: 2.12.0
  68  **/
  69 unsigned int
  70 gnutls_sec_param_to_pk_bits (gnutls_pk_algorithm_t algo,
  71                              gnutls_sec_param_t param)
  72 {
  73   unsigned int ret = 0;
  74
  75   /* handle DSA differently */
  76   if (algo == GNUTLS_PK_DSA)
  77     {
  78       GNUTLS_SEC_PARAM_LOOP (if (p->sec_param == param)
  79                              {
  80                                ret = p->dsa_bits; break;
  81                              }
  82       );
  83       return ret;
  84     }
  85   else if (algo == GNUTLS_PK_EC)
  86     {
  87       GNUTLS_SEC_PARAM_LOOP (if (p->sec_param == param)
  88                              {
  89                                ret = p->ecc_bits; break;
  90                              }
  91       );
  92       return ret;
  93     }
  94   else
  95     {
  96       GNUTLS_SEC_PARAM_LOOP (if (p->sec_param == param)
  97                          {
  98                            ret = p->pk_bits; break;
  99                          }
 100       );
 101
 102       return ret;
 103     }
 104 }
 105
 106 /* Returns the corresponding size for subgroup bits (q),
 107  * given the group bits (p).
 108  */
 109 unsigned int
 110 _gnutls_pk_bits_to_subgroup_bits (unsigned int pk_bits)
 111 {
 112   unsigned int ret = 0;
 113
 114   GNUTLS_SEC_PARAM_LOOP (if (p->pk_bits >= pk_bits)
 115                          {
 116                            ret = p->subgroup_bits; break;
 117                          }
 118   );
 119
 120   return ret;
 121 }
 122
 123 /**
 124  * gnutls_sec_param_get_name:
 125  * @param: is a security parameter
 126  *
 127  * Convert a #gnutls_sec_param_t value to a string.
 128  *
 129  * Returns: a pointer to a string that contains the name of the
 130  *   specified security level, or %NULL.
 131  *
 132  * Since: 2.12.0
 133  **/
 134 const char *
 135 gnutls_sec_param_get_name (gnutls_sec_param_t param)
 136 {
 137   const char *ret = "Unknown";
 138
 139   GNUTLS_SEC_PARAM_LOOP (if (p->sec_param == param)
 140                          {
 141                            ret = p->name; break;
 142                          }
 143   );
 144
 145   return ret;
 146 }
 147
 148 /**
 149  * gnutls_pk_bits_to_sec_param:
 150  * @algo: is a public key algorithm
 151  * @bits: is the number of bits
 152  *
 153  * This is the inverse of gnutls_sec_param_to_pk_bits(). Given an algorithm
 154  * and the number of bits, it will return the security parameter. This is
 155  * a rough indication.
 156  *
 157  * Returns: The security parameter.
 158  *
 159  * Since: 2.12.0
 160  **/
 161 gnutls_sec_param_t
 162 gnutls_pk_bits_to_sec_param (gnutls_pk_algorithm_t algo, unsigned int bits)
 163 {
 164   gnutls_sec_param_t ret = GNUTLS_SEC_PARAM_LOW;
 165
 166   if (bits == 0)
 167     return GNUTLS_SEC_PARAM_UNKNOWN;
 168
 169   if (algo == GNUTLS_PK_EC)
 170     {
 171       GNUTLS_SEC_PARAM_LOOP (if (p->ecc_bits > bits)
 172                          {
 173                            break;
 174                          }
 175                          ret = p->sec_param;);
 176     }
 177   else
 178     {
 179       GNUTLS_SEC_PARAM_LOOP (if (p->pk_bits > bits)
 180                          {
 181                            break;
 182                          }
 183                          ret = p->sec_param;);
 184     }
 185
 186   return ret;
 187 }