| /* Copyright (c) 2015, Google Inc. |
| * |
| * Permission to use, copy, modify, and/or distribute this software for any |
| * purpose with or without fee is hereby granted, provided that the above |
| * copyright notice and this permission notice appear in all copies. |
| * |
| * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES |
| * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF |
| * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY |
| * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES |
| * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION |
| * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN |
| * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ |
| |
| #include <openssl/ssl.h> |
| |
| #include <assert.h> |
| #include <string.h> |
| |
| #include <openssl/bn.h> |
| #include <openssl/bytestring.h> |
| #include <openssl/curve25519.h> |
| #include <openssl/ec.h> |
| #include <openssl/err.h> |
| #include <openssl/mem.h> |
| #include <openssl/newhope.h> |
| #include <openssl/nid.h> |
| |
| #include "internal.h" |
| |
| |
| /* |EC_POINT| implementation. */ |
| |
| static void ssl_ec_point_cleanup(SSL_ECDH_CTX *ctx) { |
| BIGNUM *private_key = (BIGNUM *)ctx->data; |
| BN_clear_free(private_key); |
| } |
| |
| static int ssl_ec_point_offer(SSL_ECDH_CTX *ctx, CBB *out) { |
| assert(ctx->data == NULL); |
| BIGNUM *private_key = BN_new(); |
| if (private_key == NULL) { |
| return 0; |
| } |
| ctx->data = private_key; |
| |
| /* Set up a shared |BN_CTX| for all operations. */ |
| BN_CTX *bn_ctx = BN_CTX_new(); |
| if (bn_ctx == NULL) { |
| return 0; |
| } |
| BN_CTX_start(bn_ctx); |
| |
| int ret = 0; |
| EC_POINT *public_key = NULL; |
| EC_GROUP *group = EC_GROUP_new_by_curve_name(ctx->method->nid); |
| if (group == NULL) { |
| goto err; |
| } |
| |
| /* Generate a private key. */ |
| const BIGNUM *order = EC_GROUP_get0_order(group); |
| do { |
| if (!BN_rand_range(private_key, order)) { |
| goto err; |
| } |
| } while (BN_is_zero(private_key)); |
| |
| /* Compute the corresponding public key and serialize it. */ |
| public_key = EC_POINT_new(group); |
| if (public_key == NULL || |
| !EC_POINT_mul(group, public_key, private_key, NULL, NULL, bn_ctx) || |
| !EC_POINT_point2cbb(out, group, public_key, POINT_CONVERSION_UNCOMPRESSED, |
| bn_ctx)) { |
| goto err; |
| } |
| |
| ret = 1; |
| |
| err: |
| EC_GROUP_free(group); |
| EC_POINT_free(public_key); |
| BN_CTX_end(bn_ctx); |
| BN_CTX_free(bn_ctx); |
| return ret; |
| } |
| |
| static int ssl_ec_point_finish(SSL_ECDH_CTX *ctx, uint8_t **out_secret, |
| size_t *out_secret_len, uint8_t *out_alert, |
| const uint8_t *peer_key, size_t peer_key_len) { |
| BIGNUM *private_key = (BIGNUM *)ctx->data; |
| assert(private_key != NULL); |
| *out_alert = SSL_AD_INTERNAL_ERROR; |
| |
| /* Set up a shared |BN_CTX| for all operations. */ |
| BN_CTX *bn_ctx = BN_CTX_new(); |
| if (bn_ctx == NULL) { |
| return 0; |
| } |
| BN_CTX_start(bn_ctx); |
| |
| int ret = 0; |
| EC_GROUP *group = EC_GROUP_new_by_curve_name(ctx->method->nid); |
| EC_POINT *peer_point = NULL, *result = NULL; |
| uint8_t *secret = NULL; |
| if (group == NULL) { |
| goto err; |
| } |
| |
| /* Compute the x-coordinate of |peer_key| * |private_key|. */ |
| peer_point = EC_POINT_new(group); |
| result = EC_POINT_new(group); |
| if (peer_point == NULL || result == NULL) { |
| goto err; |
| } |
| BIGNUM *x = BN_CTX_get(bn_ctx); |
| if (x == NULL) { |
| goto err; |
| } |
| if (!EC_POINT_oct2point(group, peer_point, peer_key, peer_key_len, bn_ctx)) { |
| *out_alert = SSL_AD_DECODE_ERROR; |
| goto err; |
| } |
| if (!EC_POINT_mul(group, result, NULL, peer_point, private_key, bn_ctx) || |
| !EC_POINT_get_affine_coordinates_GFp(group, result, x, NULL, bn_ctx)) { |
| goto err; |
| } |
| |
| /* Encode the x-coordinate left-padded with zeros. */ |
| size_t secret_len = (EC_GROUP_get_degree(group) + 7) / 8; |
| secret = OPENSSL_malloc(secret_len); |
| if (secret == NULL || !BN_bn2bin_padded(secret, secret_len, x)) { |
| goto err; |
| } |
| |
| *out_secret = secret; |
| *out_secret_len = secret_len; |
| secret = NULL; |
| ret = 1; |
| |
| err: |
| EC_GROUP_free(group); |
| EC_POINT_free(peer_point); |
| EC_POINT_free(result); |
| BN_CTX_end(bn_ctx); |
| BN_CTX_free(bn_ctx); |
| OPENSSL_free(secret); |
| return ret; |
| } |
| |
| static int ssl_ec_point_accept(SSL_ECDH_CTX *ctx, CBB *out_public_key, |
| uint8_t **out_secret, size_t *out_secret_len, |
| uint8_t *out_alert, const uint8_t *peer_key, |
| size_t peer_key_len) { |
| *out_alert = SSL_AD_INTERNAL_ERROR; |
| if (!ssl_ec_point_offer(ctx, out_public_key) || |
| !ssl_ec_point_finish(ctx, out_secret, out_secret_len, out_alert, peer_key, |
| peer_key_len)) { |
| return 0; |
| } |
| return 1; |
| } |
| |
| /* X25119 implementation. */ |
| |
| static void ssl_x25519_cleanup(SSL_ECDH_CTX *ctx) { |
| if (ctx->data == NULL) { |
| return; |
| } |
| OPENSSL_cleanse(ctx->data, 32); |
| OPENSSL_free(ctx->data); |
| } |
| |
| static int ssl_x25519_offer(SSL_ECDH_CTX *ctx, CBB *out) { |
| assert(ctx->data == NULL); |
| |
| ctx->data = OPENSSL_malloc(32); |
| if (ctx->data == NULL) { |
| OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE); |
| return 0; |
| } |
| uint8_t public_key[32]; |
| X25519_keypair(public_key, (uint8_t *)ctx->data); |
| return CBB_add_bytes(out, public_key, sizeof(public_key)); |
| } |
| |
| static int ssl_x25519_finish(SSL_ECDH_CTX *ctx, uint8_t **out_secret, |
| size_t *out_secret_len, uint8_t *out_alert, |
| const uint8_t *peer_key, size_t peer_key_len) { |
| assert(ctx->data != NULL); |
| *out_alert = SSL_AD_INTERNAL_ERROR; |
| |
| uint8_t *secret = OPENSSL_malloc(32); |
| if (secret == NULL) { |
| return 0; |
| } |
| |
| if (peer_key_len != 32 || |
| !X25519(secret, (uint8_t *)ctx->data, peer_key)) { |
| OPENSSL_free(secret); |
| *out_alert = SSL_AD_DECODE_ERROR; |
| OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_ECPOINT); |
| return 0; |
| } |
| |
| *out_secret = secret; |
| *out_secret_len = 32; |
| return 1; |
| } |
| |
| static int ssl_x25519_accept(SSL_ECDH_CTX *ctx, CBB *out_public_key, |
| uint8_t **out_secret, size_t *out_secret_len, |
| uint8_t *out_alert, const uint8_t *peer_key, |
| size_t peer_key_len) { |
| *out_alert = SSL_AD_INTERNAL_ERROR; |
| if (!ssl_x25519_offer(ctx, out_public_key) || |
| !ssl_x25519_finish(ctx, out_secret, out_secret_len, out_alert, peer_key, |
| peer_key_len)) { |
| return 0; |
| } |
| return 1; |
| } |
| |
| |
| /* Combined X25119 + New Hope (post-quantum) implementation. */ |
| |
| typedef struct { |
| uint8_t x25519_key[32]; |
| NEWHOPE_POLY *newhope_sk; |
| } cecpq1_data; |
| |
| #define CECPQ1_OFFERMSG_LENGTH (32 + NEWHOPE_OFFERMSG_LENGTH) |
| #define CECPQ1_ACCEPTMSG_LENGTH (32 + NEWHOPE_ACCEPTMSG_LENGTH) |
| #define CECPQ1_SECRET_LENGTH (32 + SHA256_DIGEST_LENGTH) |
| |
| static void ssl_cecpq1_cleanup(SSL_ECDH_CTX *ctx) { |
| if (ctx->data == NULL) { |
| return; |
| } |
| cecpq1_data *data = ctx->data; |
| NEWHOPE_POLY_free(data->newhope_sk); |
| OPENSSL_cleanse(data, sizeof(cecpq1_data)); |
| OPENSSL_free(data); |
| } |
| |
| static int ssl_cecpq1_offer(SSL_ECDH_CTX *ctx, CBB *out) { |
| assert(ctx->data == NULL); |
| cecpq1_data *data = OPENSSL_malloc(sizeof(cecpq1_data)); |
| if (data == NULL) { |
| OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE); |
| return 0; |
| } |
| ctx->data = data; |
| data->newhope_sk = NEWHOPE_POLY_new(); |
| if (data->newhope_sk == NULL) { |
| OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE); |
| return 0; |
| } |
| |
| uint8_t x25519_public_key[32]; |
| X25519_keypair(x25519_public_key, data->x25519_key); |
| |
| uint8_t newhope_offermsg[NEWHOPE_OFFERMSG_LENGTH]; |
| NEWHOPE_offer(newhope_offermsg, data->newhope_sk); |
| |
| if (!CBB_add_bytes(out, x25519_public_key, sizeof(x25519_public_key)) || |
| !CBB_add_bytes(out, newhope_offermsg, sizeof(newhope_offermsg))) { |
| return 0; |
| } |
| return 1; |
| } |
| |
| static int ssl_cecpq1_accept(SSL_ECDH_CTX *ctx, CBB *cbb, uint8_t **out_secret, |
| size_t *out_secret_len, uint8_t *out_alert, |
| const uint8_t *peer_key, size_t peer_key_len) { |
| if (peer_key_len != CECPQ1_OFFERMSG_LENGTH) { |
| *out_alert = SSL_AD_DECODE_ERROR; |
| return 0; |
| } |
| |
| *out_alert = SSL_AD_INTERNAL_ERROR; |
| |
| assert(ctx->data == NULL); |
| cecpq1_data *data = OPENSSL_malloc(sizeof(cecpq1_data)); |
| if (data == NULL) { |
| OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE); |
| return 0; |
| } |
| data->newhope_sk = NULL; |
| ctx->data = data; |
| |
| uint8_t *secret = OPENSSL_malloc(CECPQ1_SECRET_LENGTH); |
| if (secret == NULL) { |
| OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE); |
| return 0; |
| } |
| |
| /* Generate message to server, and secret key, at once. */ |
| |
| uint8_t x25519_public_key[32]; |
| X25519_keypair(x25519_public_key, data->x25519_key); |
| if (!X25519(secret, data->x25519_key, peer_key)) { |
| *out_alert = SSL_AD_DECODE_ERROR; |
| OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_ECPOINT); |
| goto err; |
| } |
| |
| uint8_t newhope_acceptmsg[NEWHOPE_ACCEPTMSG_LENGTH]; |
| if (!NEWHOPE_accept(secret + 32, newhope_acceptmsg, peer_key + 32, |
| NEWHOPE_OFFERMSG_LENGTH)) { |
| *out_alert = SSL_AD_DECODE_ERROR; |
| goto err; |
| } |
| |
| if (!CBB_add_bytes(cbb, x25519_public_key, sizeof(x25519_public_key)) || |
| !CBB_add_bytes(cbb, newhope_acceptmsg, sizeof(newhope_acceptmsg))) { |
| goto err; |
| } |
| |
| *out_secret = secret; |
| *out_secret_len = CECPQ1_SECRET_LENGTH; |
| return 1; |
| |
| err: |
| OPENSSL_cleanse(secret, CECPQ1_SECRET_LENGTH); |
| OPENSSL_free(secret); |
| return 0; |
| } |
| |
| static int ssl_cecpq1_finish(SSL_ECDH_CTX *ctx, uint8_t **out_secret, |
| size_t *out_secret_len, uint8_t *out_alert, |
| const uint8_t *peer_key, size_t peer_key_len) { |
| if (peer_key_len != CECPQ1_ACCEPTMSG_LENGTH) { |
| *out_alert = SSL_AD_DECODE_ERROR; |
| return 0; |
| } |
| |
| *out_alert = SSL_AD_INTERNAL_ERROR; |
| |
| assert(ctx->data != NULL); |
| cecpq1_data *data = ctx->data; |
| |
| uint8_t *secret = OPENSSL_malloc(CECPQ1_SECRET_LENGTH); |
| if (secret == NULL) { |
| OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE); |
| return 0; |
| } |
| |
| if (!X25519(secret, data->x25519_key, peer_key)) { |
| *out_alert = SSL_AD_DECODE_ERROR; |
| OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_ECPOINT); |
| goto err; |
| } |
| |
| if (!NEWHOPE_finish(secret + 32, data->newhope_sk, peer_key + 32, |
| NEWHOPE_ACCEPTMSG_LENGTH)) { |
| *out_alert = SSL_AD_DECODE_ERROR; |
| goto err; |
| } |
| |
| *out_secret = secret; |
| *out_secret_len = CECPQ1_SECRET_LENGTH; |
| return 1; |
| |
| err: |
| OPENSSL_cleanse(secret, CECPQ1_SECRET_LENGTH); |
| OPENSSL_free(secret); |
| return 0; |
| } |
| |
| |
| /* Legacy DHE-based implementation. */ |
| |
| static void ssl_dhe_cleanup(SSL_ECDH_CTX *ctx) { |
| DH_free((DH *)ctx->data); |
| } |
| |
| static int ssl_dhe_offer(SSL_ECDH_CTX *ctx, CBB *out) { |
| DH *dh = (DH *)ctx->data; |
| /* The group must have been initialized already, but not the key. */ |
| assert(dh != NULL); |
| assert(dh->priv_key == NULL); |
| |
| /* Due to a bug in yaSSL, the public key must be zero padded to the size of |
| * the prime. */ |
| return DH_generate_key(dh) && |
| BN_bn2cbb_padded(out, BN_num_bytes(dh->p), dh->pub_key); |
| } |
| |
| static int ssl_dhe_finish(SSL_ECDH_CTX *ctx, uint8_t **out_secret, |
| size_t *out_secret_len, uint8_t *out_alert, |
| const uint8_t *peer_key, size_t peer_key_len) { |
| DH *dh = (DH *)ctx->data; |
| assert(dh != NULL); |
| assert(dh->priv_key != NULL); |
| *out_alert = SSL_AD_INTERNAL_ERROR; |
| |
| int secret_len = 0; |
| uint8_t *secret = NULL; |
| BIGNUM *peer_point = BN_bin2bn(peer_key, peer_key_len, NULL); |
| if (peer_point == NULL) { |
| goto err; |
| } |
| |
| secret = OPENSSL_malloc(DH_size(dh)); |
| if (secret == NULL) { |
| goto err; |
| } |
| secret_len = DH_compute_key(secret, peer_point, dh); |
| if (secret_len <= 0) { |
| goto err; |
| } |
| |
| *out_secret = secret; |
| *out_secret_len = (size_t)secret_len; |
| BN_free(peer_point); |
| return 1; |
| |
| err: |
| if (secret_len > 0) { |
| OPENSSL_cleanse(secret, (size_t)secret_len); |
| } |
| OPENSSL_free(secret); |
| BN_free(peer_point); |
| return 0; |
| } |
| |
| static int ssl_dhe_accept(SSL_ECDH_CTX *ctx, CBB *out_public_key, |
| uint8_t **out_secret, size_t *out_secret_len, |
| uint8_t *out_alert, const uint8_t *peer_key, |
| size_t peer_key_len) { |
| *out_alert = SSL_AD_INTERNAL_ERROR; |
| if (!ssl_dhe_offer(ctx, out_public_key) || |
| !ssl_dhe_finish(ctx, out_secret, out_secret_len, out_alert, peer_key, |
| peer_key_len)) { |
| return 0; |
| } |
| return 1; |
| } |
| |
| static const SSL_ECDH_METHOD kDHEMethod = { |
| NID_undef, 0, "", |
| ssl_dhe_cleanup, |
| ssl_dhe_offer, |
| ssl_dhe_accept, |
| ssl_dhe_finish, |
| CBS_get_u16_length_prefixed, |
| CBB_add_u16_length_prefixed, |
| }; |
| |
| static const SSL_ECDH_METHOD kCECPQ1Method = { |
| NID_undef, 0, "", |
| ssl_cecpq1_cleanup, |
| ssl_cecpq1_offer, |
| ssl_cecpq1_accept, |
| ssl_cecpq1_finish, |
| CBS_get_u16_length_prefixed, |
| CBB_add_u16_length_prefixed, |
| }; |
| |
| static const SSL_ECDH_METHOD kMethods[] = { |
| { |
| NID_X9_62_prime256v1, |
| SSL_CURVE_SECP256R1, |
| "P-256", |
| ssl_ec_point_cleanup, |
| ssl_ec_point_offer, |
| ssl_ec_point_accept, |
| ssl_ec_point_finish, |
| CBS_get_u8_length_prefixed, |
| CBB_add_u8_length_prefixed, |
| }, |
| { |
| NID_secp384r1, |
| SSL_CURVE_SECP384R1, |
| "P-384", |
| ssl_ec_point_cleanup, |
| ssl_ec_point_offer, |
| ssl_ec_point_accept, |
| ssl_ec_point_finish, |
| CBS_get_u8_length_prefixed, |
| CBB_add_u8_length_prefixed, |
| }, |
| { |
| NID_secp521r1, |
| SSL_CURVE_SECP521R1, |
| "P-521", |
| ssl_ec_point_cleanup, |
| ssl_ec_point_offer, |
| ssl_ec_point_accept, |
| ssl_ec_point_finish, |
| CBS_get_u8_length_prefixed, |
| CBB_add_u8_length_prefixed, |
| }, |
| { |
| NID_X25519, |
| SSL_CURVE_X25519, |
| "X25519", |
| ssl_x25519_cleanup, |
| ssl_x25519_offer, |
| ssl_x25519_accept, |
| ssl_x25519_finish, |
| CBS_get_u8_length_prefixed, |
| CBB_add_u8_length_prefixed, |
| }, |
| }; |
| |
| static const SSL_ECDH_METHOD *method_from_group_id(uint16_t group_id) { |
| size_t i; |
| for (i = 0; i < sizeof(kMethods) / sizeof(kMethods[0]); i++) { |
| if (kMethods[i].group_id == group_id) { |
| return &kMethods[i]; |
| } |
| } |
| return NULL; |
| } |
| |
| static const SSL_ECDH_METHOD *method_from_nid(int nid) { |
| size_t i; |
| for (i = 0; i < sizeof(kMethods) / sizeof(kMethods[0]); i++) { |
| if (kMethods[i].nid == nid) { |
| return &kMethods[i]; |
| } |
| } |
| return NULL; |
| } |
| |
| const char* SSL_get_curve_name(uint16_t group_id) { |
| const SSL_ECDH_METHOD *method = method_from_group_id(group_id); |
| if (method == NULL) { |
| return NULL; |
| } |
| return method->name; |
| } |
| |
| int ssl_nid_to_group_id(uint16_t *out_group_id, int nid) { |
| const SSL_ECDH_METHOD *method = method_from_nid(nid); |
| if (method == NULL) { |
| return 0; |
| } |
| *out_group_id = method->group_id; |
| return 1; |
| } |
| |
| int SSL_ECDH_CTX_init(SSL_ECDH_CTX *ctx, uint16_t group_id) { |
| SSL_ECDH_CTX_cleanup(ctx); |
| |
| const SSL_ECDH_METHOD *method = method_from_group_id(group_id); |
| if (method == NULL) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_UNSUPPORTED_ELLIPTIC_CURVE); |
| return 0; |
| } |
| ctx->method = method; |
| return 1; |
| } |
| |
| void SSL_ECDH_CTX_init_for_dhe(SSL_ECDH_CTX *ctx, DH *params) { |
| SSL_ECDH_CTX_cleanup(ctx); |
| |
| ctx->method = &kDHEMethod; |
| ctx->data = params; |
| } |
| |
| void SSL_ECDH_CTX_init_for_cecpq1(SSL_ECDH_CTX *ctx) { |
| SSL_ECDH_CTX_cleanup(ctx); |
| |
| ctx->method = &kCECPQ1Method; |
| } |
| |
| int SSL_ECDH_CTX_get_key(SSL_ECDH_CTX *ctx, CBS *cbs, CBS *out) { |
| if (ctx->method == NULL) { |
| return 0; |
| } |
| return ctx->method->get_key(cbs, out); |
| } |
| |
| int SSL_ECDH_CTX_add_key(SSL_ECDH_CTX *ctx, CBB *cbb, CBB *out_contents) { |
| if (ctx->method == NULL) { |
| return 0; |
| } |
| return ctx->method->add_key(cbb, out_contents); |
| } |
| |
| void SSL_ECDH_CTX_cleanup(SSL_ECDH_CTX *ctx) { |
| if (ctx->method == NULL) { |
| return; |
| } |
| ctx->method->cleanup(ctx); |
| ctx->method = NULL; |
| ctx->data = NULL; |
| } |
| |
| int SSL_ECDH_CTX_offer(SSL_ECDH_CTX *ctx, CBB *out_public_key) { |
| return ctx->method->offer(ctx, out_public_key); |
| } |
| |
| int SSL_ECDH_CTX_accept(SSL_ECDH_CTX *ctx, CBB *out_public_key, |
| uint8_t **out_secret, size_t *out_secret_len, |
| uint8_t *out_alert, const uint8_t *peer_key, |
| size_t peer_key_len) { |
| return ctx->method->accept(ctx, out_public_key, out_secret, out_secret_len, |
| out_alert, peer_key, peer_key_len); |
| } |
| |
| int SSL_ECDH_CTX_finish(SSL_ECDH_CTX *ctx, uint8_t **out_secret, |
| size_t *out_secret_len, uint8_t *out_alert, |
| const uint8_t *peer_key, size_t peer_key_len) { |
| return ctx->method->finish(ctx, out_secret, out_secret_len, out_alert, |
| peer_key, peer_key_len); |
| } |