| /* Copyright (c) 2015, Google Inc. |
| * |
| * Permission to use, copy, modify, and/or distribute this software for any |
| * purpose with or without fee is hereby granted, provided that the above |
| * copyright notice and this permission notice appear in all copies. |
| * |
| * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES |
| * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF |
| * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY |
| * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES |
| * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION |
| * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN |
| * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ |
| |
| #include <openssl/ssl.h> |
| |
| #include <assert.h> |
| #include <string.h> |
| |
| #include <utility> |
| |
| #include <openssl/bn.h> |
| #include <openssl/bytestring.h> |
| #include <openssl/curve25519.h> |
| #include <openssl/ec.h> |
| #include <openssl/err.h> |
| #include <openssl/mem.h> |
| #include <openssl/nid.h> |
| |
| #include "internal.h" |
| #include "../crypto/internal.h" |
| |
| |
| namespace bssl { |
| |
| namespace { |
| |
| class ECKeyShare : public SSLKeyShare { |
| public: |
| ECKeyShare(int nid, uint16_t group_id) : nid_(nid), group_id_(group_id) {} |
| ~ECKeyShare() override {} |
| |
| uint16_t GroupID() const override { return group_id_; } |
| |
| bool Offer(CBB *out) override { |
| assert(!private_key_); |
| // Set up a shared |BN_CTX| for all operations. |
| UniquePtr<BN_CTX> bn_ctx(BN_CTX_new()); |
| if (!bn_ctx) { |
| return false; |
| } |
| BN_CTXScope scope(bn_ctx.get()); |
| |
| // Generate a private key. |
| UniquePtr<EC_GROUP> group(EC_GROUP_new_by_curve_name(nid_)); |
| private_key_.reset(BN_new()); |
| if (!group || !private_key_ || |
| !BN_rand_range_ex(private_key_.get(), 1, |
| EC_GROUP_get0_order(group.get()))) { |
| return false; |
| } |
| |
| // Compute the corresponding public key and serialize it. |
| UniquePtr<EC_POINT> public_key(EC_POINT_new(group.get())); |
| if (!public_key || |
| !EC_POINT_mul(group.get(), public_key.get(), private_key_.get(), NULL, |
| NULL, bn_ctx.get()) || |
| !EC_POINT_point2cbb(out, group.get(), public_key.get(), |
| POINT_CONVERSION_UNCOMPRESSED, bn_ctx.get())) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| bool Finish(Array<uint8_t> *out_secret, uint8_t *out_alert, |
| Span<const uint8_t> peer_key) override { |
| assert(private_key_); |
| *out_alert = SSL_AD_INTERNAL_ERROR; |
| |
| // Set up a shared |BN_CTX| for all operations. |
| UniquePtr<BN_CTX> bn_ctx(BN_CTX_new()); |
| if (!bn_ctx) { |
| return false; |
| } |
| BN_CTXScope scope(bn_ctx.get()); |
| |
| UniquePtr<EC_GROUP> group(EC_GROUP_new_by_curve_name(nid_)); |
| if (!group) { |
| return false; |
| } |
| |
| UniquePtr<EC_POINT> peer_point(EC_POINT_new(group.get())); |
| UniquePtr<EC_POINT> result(EC_POINT_new(group.get())); |
| BIGNUM *x = BN_CTX_get(bn_ctx.get()); |
| if (!peer_point || !result || !x) { |
| return false; |
| } |
| |
| if (peer_key.empty() || peer_key[0] != POINT_CONVERSION_UNCOMPRESSED || |
| !EC_POINT_oct2point(group.get(), peer_point.get(), peer_key.data(), |
| peer_key.size(), bn_ctx.get())) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_ECPOINT); |
| *out_alert = SSL_AD_DECODE_ERROR; |
| return false; |
| } |
| |
| // Compute the x-coordinate of |peer_key| * |private_key_|. |
| if (!EC_POINT_mul(group.get(), result.get(), NULL, peer_point.get(), |
| private_key_.get(), bn_ctx.get()) || |
| !EC_POINT_get_affine_coordinates_GFp(group.get(), result.get(), x, NULL, |
| bn_ctx.get())) { |
| return false; |
| } |
| |
| // Encode the x-coordinate left-padded with zeros. |
| Array<uint8_t> secret; |
| if (!secret.Init((EC_GROUP_get_degree(group.get()) + 7) / 8) || |
| !BN_bn2bin_padded(secret.data(), secret.size(), x)) { |
| return false; |
| } |
| |
| *out_secret = std::move(secret); |
| return true; |
| } |
| |
| bool Serialize(CBB *out) override { |
| assert(private_key_); |
| CBB cbb; |
| UniquePtr<EC_GROUP> group(EC_GROUP_new_by_curve_name(nid_)); |
| // Padding is added to avoid leaking the length. |
| size_t len = BN_num_bytes(EC_GROUP_get0_order(group.get())); |
| if (!CBB_add_asn1_uint64(out, group_id_) || |
| !CBB_add_asn1(out, &cbb, CBS_ASN1_OCTETSTRING) || |
| !BN_bn2cbb_padded(&cbb, len, private_key_.get()) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| return true; |
| } |
| |
| bool Deserialize(CBS *in) override { |
| assert(!private_key_); |
| CBS private_key; |
| if (!CBS_get_asn1(in, &private_key, CBS_ASN1_OCTETSTRING)) { |
| return false; |
| } |
| private_key_.reset(BN_bin2bn(CBS_data(&private_key), |
| CBS_len(&private_key), nullptr)); |
| return private_key_ != nullptr; |
| } |
| |
| private: |
| UniquePtr<BIGNUM> private_key_; |
| int nid_; |
| uint16_t group_id_; |
| }; |
| |
| class X25519KeyShare : public SSLKeyShare { |
| public: |
| X25519KeyShare() {} |
| ~X25519KeyShare() override { |
| OPENSSL_cleanse(private_key_, sizeof(private_key_)); |
| } |
| |
| uint16_t GroupID() const override { return SSL_CURVE_X25519; } |
| |
| bool Offer(CBB *out) override { |
| uint8_t public_key[32]; |
| X25519_keypair(public_key, private_key_); |
| return !!CBB_add_bytes(out, public_key, sizeof(public_key)); |
| } |
| |
| bool Finish(Array<uint8_t> *out_secret, uint8_t *out_alert, |
| Span<const uint8_t> peer_key) override { |
| *out_alert = SSL_AD_INTERNAL_ERROR; |
| |
| Array<uint8_t> secret; |
| if (!secret.Init(32)) { |
| OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE); |
| return false; |
| } |
| |
| if (peer_key.size() != 32 || |
| !X25519(secret.data(), private_key_, peer_key.data())) { |
| *out_alert = SSL_AD_DECODE_ERROR; |
| OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_ECPOINT); |
| return false; |
| } |
| |
| *out_secret = std::move(secret); |
| return true; |
| } |
| |
| bool Serialize(CBB *out) override { |
| return (CBB_add_asn1_uint64(out, GroupID()) && |
| CBB_add_asn1_octet_string(out, private_key_, sizeof(private_key_))); |
| } |
| |
| bool Deserialize(CBS *in) override { |
| CBS key; |
| if (!CBS_get_asn1(in, &key, CBS_ASN1_OCTETSTRING) || |
| CBS_len(&key) != sizeof(private_key_) || |
| !CBS_copy_bytes(&key, private_key_, sizeof(private_key_))) { |
| return false; |
| } |
| return true; |
| } |
| |
| private: |
| uint8_t private_key_[32]; |
| }; |
| |
| CONSTEXPR_ARRAY struct { |
| int nid; |
| uint16_t group_id; |
| const char name[8], alias[11]; |
| } kNamedGroups[] = { |
| {NID_secp224r1, SSL_CURVE_SECP224R1, "P-224", "secp224r1"}, |
| {NID_X9_62_prime256v1, SSL_CURVE_SECP256R1, "P-256", "prime256v1"}, |
| {NID_secp384r1, SSL_CURVE_SECP384R1, "P-384", "secp384r1"}, |
| {NID_secp521r1, SSL_CURVE_SECP521R1, "P-521", "secp521r1"}, |
| {NID_X25519, SSL_CURVE_X25519, "X25519", "x25519"}, |
| }; |
| |
| } // namespace |
| |
| UniquePtr<SSLKeyShare> SSLKeyShare::Create(uint16_t group_id) { |
| switch (group_id) { |
| case SSL_CURVE_SECP224R1: |
| return UniquePtr<SSLKeyShare>( |
| New<ECKeyShare>(NID_secp224r1, SSL_CURVE_SECP224R1)); |
| case SSL_CURVE_SECP256R1: |
| return UniquePtr<SSLKeyShare>( |
| New<ECKeyShare>(NID_X9_62_prime256v1, SSL_CURVE_SECP256R1)); |
| case SSL_CURVE_SECP384R1: |
| return UniquePtr<SSLKeyShare>( |
| New<ECKeyShare>(NID_secp384r1, SSL_CURVE_SECP384R1)); |
| case SSL_CURVE_SECP521R1: |
| return UniquePtr<SSLKeyShare>( |
| New<ECKeyShare>(NID_secp521r1, SSL_CURVE_SECP521R1)); |
| case SSL_CURVE_X25519: |
| return UniquePtr<SSLKeyShare>(New<X25519KeyShare>()); |
| default: |
| return nullptr; |
| } |
| } |
| |
| UniquePtr<SSLKeyShare> SSLKeyShare::Create(CBS *in) { |
| uint64_t group; |
| if (!CBS_get_asn1_uint64(in, &group)) { |
| return nullptr; |
| } |
| UniquePtr<SSLKeyShare> key_share = Create(static_cast<uint64_t>(group)); |
| if (!key_share->Deserialize(in)) { |
| return nullptr; |
| } |
| return key_share; |
| } |
| |
| |
| bool SSLKeyShare::Accept(CBB *out_public_key, Array<uint8_t> *out_secret, |
| uint8_t *out_alert, Span<const uint8_t> peer_key) { |
| *out_alert = SSL_AD_INTERNAL_ERROR; |
| return Offer(out_public_key) && |
| Finish(out_secret, out_alert, peer_key); |
| } |
| |
| int ssl_nid_to_group_id(uint16_t *out_group_id, int nid) { |
| for (const auto &group : kNamedGroups) { |
| if (group.nid == nid) { |
| *out_group_id = group.group_id; |
| return 1; |
| } |
| } |
| return 0; |
| } |
| |
| int ssl_name_to_group_id(uint16_t *out_group_id, const char *name, size_t len) { |
| for (const auto &group : kNamedGroups) { |
| if (len == strlen(group.name) && |
| !strncmp(group.name, name, len)) { |
| *out_group_id = group.group_id; |
| return 1; |
| } |
| if (len == strlen(group.alias) && |
| !strncmp(group.alias, name, len)) { |
| *out_group_id = group.group_id; |
| return 1; |
| } |
| } |
| return 0; |
| } |
| |
| } // namespace bssl |
| |
| using namespace bssl; |
| |
| const char* SSL_get_curve_name(uint16_t group_id) { |
| for (const auto &group : kNamedGroups) { |
| if (group.group_id == group_id) { |
| return group.name; |
| } |
| } |
| return nullptr; |
| } |