blob: 392ed0c150eb105ba39fc90fb31e254d76ef64fa [file] [log] [blame]
Paul Bakker5121ce52009-01-03 21:22:43 +00001/*
2 * Diffie-Hellman-Merkle key exchange
3 *
Manuel Pégourié-Gonnard6fb81872015-07-27 11:11:48 +02004 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +02005 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
Paul Bakkerb96f1542010-07-18 20:36:00 +000018 *
Manuel Pégourié-Gonnardfe446432015-03-06 13:17:10 +000019 * This file is part of mbed TLS (https://tls.mbed.org)
Paul Bakker5121ce52009-01-03 21:22:43 +000020 */
21/*
Simon Butcherbdae02c2016-01-20 00:44:42 +000022 * The following sources were referenced in the design of this implementation
23 * of the Diffie-Hellman-Merkle algorithm:
Paul Bakker5121ce52009-01-03 21:22:43 +000024 *
Simon Butcherbdae02c2016-01-20 00:44:42 +000025 * [1] Handbook of Applied Cryptography - 1997, Chapter 12
26 * Menezes, van Oorschot and Vanstone
27 *
Paul Bakker5121ce52009-01-03 21:22:43 +000028 */
29
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020030#if !defined(MBEDTLS_CONFIG_FILE)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000031#include "mbedtls/config.h"
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020032#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020033#include MBEDTLS_CONFIG_FILE
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020034#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000035
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020036#if defined(MBEDTLS_DHM_C)
Paul Bakker5121ce52009-01-03 21:22:43 +000037
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000038#include "mbedtls/dhm.h"
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050039#include "mbedtls/platform_util.h"
Janos Follath24eed8d2019-11-22 13:21:35 +000040#include "mbedtls/error.h"
Paul Bakker5121ce52009-01-03 21:22:43 +000041
Rich Evans00ab4702015-02-06 13:43:58 +000042#include <string.h>
43
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020044#if defined(MBEDTLS_PEM_PARSE_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000045#include "mbedtls/pem.h"
Paul Bakker40ce79f2013-09-15 17:43:54 +020046#endif
47
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020048#if defined(MBEDTLS_ASN1_PARSE_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000049#include "mbedtls/asn1.h"
Paul Bakker40ce79f2013-09-15 17:43:54 +020050#endif
51
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020052#if defined(MBEDTLS_PLATFORM_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000053#include "mbedtls/platform.h"
Paul Bakker40ce79f2013-09-15 17:43:54 +020054#else
55#include <stdlib.h>
Manuel Pégourié-Gonnard981732b2015-02-17 15:46:45 +000056#include <stdio.h>
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020057#define mbedtls_printf printf
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +020058#define mbedtls_calloc calloc
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020059#define mbedtls_free free
Paul Bakker40ce79f2013-09-15 17:43:54 +020060#endif
61
Reuven Levin1f35ca92017-12-07 10:09:32 +000062#if !defined(MBEDTLS_DHM_ALT)
Paul Bakker34617722014-06-13 17:20:13 +020063
Andrzej Kurekc470b6b2019-01-31 08:20:20 -050064#define DHM_VALIDATE_RET( cond ) \
65 MBEDTLS_INTERNAL_VALIDATE_RET( cond, MBEDTLS_ERR_DHM_BAD_INPUT_DATA )
66#define DHM_VALIDATE( cond ) \
67 MBEDTLS_INTERNAL_VALIDATE( cond )
68
Paul Bakker5121ce52009-01-03 21:22:43 +000069/*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020070 * helper to validate the mbedtls_mpi size and import it
Paul Bakker5121ce52009-01-03 21:22:43 +000071 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020072static int dhm_read_bignum( mbedtls_mpi *X,
Paul Bakker5121ce52009-01-03 21:22:43 +000073 unsigned char **p,
Paul Bakkerff60ee62010-03-16 21:09:09 +000074 const unsigned char *end )
Paul Bakker5121ce52009-01-03 21:22:43 +000075{
76 int ret, n;
77
78 if( end - *p < 2 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020079 return( MBEDTLS_ERR_DHM_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +000080
81 n = ( (*p)[0] << 8 ) | (*p)[1];
82 (*p) += 2;
83
84 if( (int)( end - *p ) < n )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020085 return( MBEDTLS_ERR_DHM_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +000086
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020087 if( ( ret = mbedtls_mpi_read_binary( X, *p, n ) ) != 0 )
88 return( MBEDTLS_ERR_DHM_READ_PARAMS_FAILED + ret );
Paul Bakker5121ce52009-01-03 21:22:43 +000089
90 (*p) += n;
91
92 return( 0 );
93}
94
95/*
Paul Bakkeraec37cb2012-04-26 18:59:59 +000096 * Verify sanity of parameter with regards to P
Paul Bakker345a6fe2011-02-28 21:20:02 +000097 *
Paul Bakkeraec37cb2012-04-26 18:59:59 +000098 * Parameter should be: 2 <= public_param <= P - 2
Paul Bakker345a6fe2011-02-28 21:20:02 +000099 *
Janos Follathaa325d72017-09-20 15:33:24 +0100100 * This means that we need to return an error if
Janos Follath1ad1c6d2017-09-21 09:02:11 +0100101 * public_param < 2 or public_param > P-2
Janos Follathaa325d72017-09-20 15:33:24 +0100102 *
Paul Bakker345a6fe2011-02-28 21:20:02 +0000103 * For more information on the attack, see:
104 * http://www.cl.cam.ac.uk/~rja14/Papers/psandqs.pdf
105 * http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-2643
Paul Bakkerc47840e2011-02-20 16:37:30 +0000106 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200107static int dhm_check_range( const mbedtls_mpi *param, const mbedtls_mpi *P )
Paul Bakkerc47840e2011-02-20 16:37:30 +0000108{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200109 mbedtls_mpi L, U;
Janos Follathaa325d72017-09-20 15:33:24 +0100110 int ret = 0;
Paul Bakkerc47840e2011-02-20 16:37:30 +0000111
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200112 mbedtls_mpi_init( &L ); mbedtls_mpi_init( &U );
Paul Bakker3d8fb632014-04-17 12:42:41 +0200113
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200114 MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &L, 2 ) );
115 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &U, P, 2 ) );
Paul Bakkerc47840e2011-02-20 16:37:30 +0000116
Janos Follathaa325d72017-09-20 15:33:24 +0100117 if( mbedtls_mpi_cmp_mpi( param, &L ) < 0 ||
118 mbedtls_mpi_cmp_mpi( param, &U ) > 0 )
Paul Bakkerc47840e2011-02-20 16:37:30 +0000119 {
Janos Follathaa325d72017-09-20 15:33:24 +0100120 ret = MBEDTLS_ERR_DHM_BAD_INPUT_DATA;
Paul Bakkerc47840e2011-02-20 16:37:30 +0000121 }
122
Paul Bakker3d8fb632014-04-17 12:42:41 +0200123cleanup:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200124 mbedtls_mpi_free( &L ); mbedtls_mpi_free( &U );
Paul Bakker345a6fe2011-02-28 21:20:02 +0000125 return( ret );
Paul Bakkerc47840e2011-02-20 16:37:30 +0000126}
127
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200128void mbedtls_dhm_init( mbedtls_dhm_context *ctx )
Paul Bakker8f870b02014-06-20 13:32:38 +0200129{
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500130 DHM_VALIDATE( ctx != NULL );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200131 memset( ctx, 0, sizeof( mbedtls_dhm_context ) );
Paul Bakker8f870b02014-06-20 13:32:38 +0200132}
133
Paul Bakkerc47840e2011-02-20 16:37:30 +0000134/*
Paul Bakker5121ce52009-01-03 21:22:43 +0000135 * Parse the ServerKeyExchange parameters
136 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200137int mbedtls_dhm_read_params( mbedtls_dhm_context *ctx,
Paul Bakker5121ce52009-01-03 21:22:43 +0000138 unsigned char **p,
Paul Bakkerff60ee62010-03-16 21:09:09 +0000139 const unsigned char *end )
Paul Bakker5121ce52009-01-03 21:22:43 +0000140{
Janos Follath24eed8d2019-11-22 13:21:35 +0000141 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500142 DHM_VALIDATE_RET( ctx != NULL );
143 DHM_VALIDATE_RET( p != NULL && *p != NULL );
144 DHM_VALIDATE_RET( end != NULL );
Paul Bakker5121ce52009-01-03 21:22:43 +0000145
Paul Bakker5121ce52009-01-03 21:22:43 +0000146 if( ( ret = dhm_read_bignum( &ctx->P, p, end ) ) != 0 ||
147 ( ret = dhm_read_bignum( &ctx->G, p, end ) ) != 0 ||
148 ( ret = dhm_read_bignum( &ctx->GY, p, end ) ) != 0 )
149 return( ret );
150
Paul Bakker345a6fe2011-02-28 21:20:02 +0000151 if( ( ret = dhm_check_range( &ctx->GY, &ctx->P ) ) != 0 )
152 return( ret );
153
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200154 ctx->len = mbedtls_mpi_size( &ctx->P );
Paul Bakker5121ce52009-01-03 21:22:43 +0000155
Paul Bakker5121ce52009-01-03 21:22:43 +0000156 return( 0 );
157}
158
159/*
160 * Setup and write the ServerKeyExchange parameters
161 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200162int mbedtls_dhm_make_params( mbedtls_dhm_context *ctx, int x_size,
Paul Bakker23986e52011-04-24 08:57:21 +0000163 unsigned char *output, size_t *olen,
Paul Bakkera3d195c2011-11-27 21:07:34 +0000164 int (*f_rng)(void *, unsigned char *, size_t),
165 void *p_rng )
Paul Bakker5121ce52009-01-03 21:22:43 +0000166{
Paul Bakkeraec37cb2012-04-26 18:59:59 +0000167 int ret, count = 0;
Paul Bakker23986e52011-04-24 08:57:21 +0000168 size_t n1, n2, n3;
Paul Bakker5121ce52009-01-03 21:22:43 +0000169 unsigned char *p;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500170 DHM_VALIDATE_RET( ctx != NULL );
171 DHM_VALIDATE_RET( output != NULL );
172 DHM_VALIDATE_RET( olen != NULL );
173 DHM_VALIDATE_RET( f_rng != NULL );
Paul Bakker5121ce52009-01-03 21:22:43 +0000174
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200175 if( mbedtls_mpi_cmp_int( &ctx->P, 0 ) == 0 )
176 return( MBEDTLS_ERR_DHM_BAD_INPUT_DATA );
Paul Bakkerb5b20f12012-09-16 15:07:49 +0000177
Paul Bakker5121ce52009-01-03 21:22:43 +0000178 /*
Paul Bakkerff7fe672010-07-18 09:45:05 +0000179 * Generate X as large as possible ( < P )
Paul Bakker5121ce52009-01-03 21:22:43 +0000180 */
Paul Bakkeraec37cb2012-04-26 18:59:59 +0000181 do
182 {
Ron Eldor7269fee2017-01-12 14:50:50 +0200183 MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &ctx->X, x_size, f_rng, p_rng ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000184
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200185 while( mbedtls_mpi_cmp_mpi( &ctx->X, &ctx->P ) >= 0 )
186 MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &ctx->X, 1 ) );
Paul Bakkeraec37cb2012-04-26 18:59:59 +0000187
188 if( count++ > 10 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200189 return( MBEDTLS_ERR_DHM_MAKE_PARAMS_FAILED );
Paul Bakkeraec37cb2012-04-26 18:59:59 +0000190 }
191 while( dhm_check_range( &ctx->X, &ctx->P ) != 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +0000192
Paul Bakkerff7fe672010-07-18 09:45:05 +0000193 /*
194 * Calculate GX = G^X mod P
195 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200196 MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &ctx->GX, &ctx->G, &ctx->X,
Paul Bakker5121ce52009-01-03 21:22:43 +0000197 &ctx->P , &ctx->RP ) );
198
Paul Bakker345a6fe2011-02-28 21:20:02 +0000199 if( ( ret = dhm_check_range( &ctx->GX, &ctx->P ) ) != 0 )
Paul Bakkerc47840e2011-02-20 16:37:30 +0000200 return( ret );
201
Paul Bakker5121ce52009-01-03 21:22:43 +0000202 /*
203 * export P, G, GX
204 */
Hanno Beckerde6c1642017-10-02 15:03:15 +0100205#define DHM_MPI_EXPORT( X, n ) \
Hanno Beckere71ad122017-09-28 10:32:25 +0100206 do { \
Hanno Beckerde6c1642017-10-02 15:03:15 +0100207 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( ( X ), \
208 p + 2, \
209 ( n ) ) ); \
210 *p++ = (unsigned char)( ( n ) >> 8 ); \
211 *p++ = (unsigned char)( ( n ) ); \
212 p += ( n ); \
Hanno Beckere71ad122017-09-28 10:32:25 +0100213 } while( 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +0000214
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200215 n1 = mbedtls_mpi_size( &ctx->P );
216 n2 = mbedtls_mpi_size( &ctx->G );
217 n3 = mbedtls_mpi_size( &ctx->GX );
Paul Bakker5121ce52009-01-03 21:22:43 +0000218
219 p = output;
220 DHM_MPI_EXPORT( &ctx->P , n1 );
221 DHM_MPI_EXPORT( &ctx->G , n2 );
222 DHM_MPI_EXPORT( &ctx->GX, n3 );
223
Hanno Beckere71ad122017-09-28 10:32:25 +0100224 *olen = p - output;
Paul Bakker5121ce52009-01-03 21:22:43 +0000225
226 ctx->len = n1;
227
228cleanup:
229
230 if( ret != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200231 return( MBEDTLS_ERR_DHM_MAKE_PARAMS_FAILED + ret );
Paul Bakker5121ce52009-01-03 21:22:43 +0000232
233 return( 0 );
234}
235
236/*
Hanno Becker8880e752017-10-04 13:15:08 +0100237 * Set prime modulus and generator
238 */
239int mbedtls_dhm_set_group( mbedtls_dhm_context *ctx,
240 const mbedtls_mpi *P,
241 const mbedtls_mpi *G )
242{
Janos Follath24eed8d2019-11-22 13:21:35 +0000243 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500244 DHM_VALIDATE_RET( ctx != NULL );
245 DHM_VALIDATE_RET( P != NULL );
246 DHM_VALIDATE_RET( G != NULL );
Hanno Becker8880e752017-10-04 13:15:08 +0100247
248 if( ( ret = mbedtls_mpi_copy( &ctx->P, P ) ) != 0 ||
249 ( ret = mbedtls_mpi_copy( &ctx->G, G ) ) != 0 )
250 {
251 return( MBEDTLS_ERR_DHM_SET_GROUP_FAILED + ret );
252 }
253
254 ctx->len = mbedtls_mpi_size( &ctx->P );
255 return( 0 );
256}
257
258/*
Paul Bakker5121ce52009-01-03 21:22:43 +0000259 * Import the peer's public value G^Y
260 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200261int mbedtls_dhm_read_public( mbedtls_dhm_context *ctx,
Paul Bakker23986e52011-04-24 08:57:21 +0000262 const unsigned char *input, size_t ilen )
Paul Bakker5121ce52009-01-03 21:22:43 +0000263{
Janos Follath24eed8d2019-11-22 13:21:35 +0000264 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500265 DHM_VALIDATE_RET( ctx != NULL );
266 DHM_VALIDATE_RET( input != NULL );
Paul Bakker5121ce52009-01-03 21:22:43 +0000267
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500268 if( ilen < 1 || ilen > ctx->len )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200269 return( MBEDTLS_ERR_DHM_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +0000270
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200271 if( ( ret = mbedtls_mpi_read_binary( &ctx->GY, input, ilen ) ) != 0 )
272 return( MBEDTLS_ERR_DHM_READ_PUBLIC_FAILED + ret );
Paul Bakker5121ce52009-01-03 21:22:43 +0000273
274 return( 0 );
275}
276
277/*
278 * Create own private value X and export G^X
279 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200280int mbedtls_dhm_make_public( mbedtls_dhm_context *ctx, int x_size,
Paul Bakker23986e52011-04-24 08:57:21 +0000281 unsigned char *output, size_t olen,
Paul Bakkera3d195c2011-11-27 21:07:34 +0000282 int (*f_rng)(void *, unsigned char *, size_t),
283 void *p_rng )
Paul Bakker5121ce52009-01-03 21:22:43 +0000284{
Paul Bakkeraec37cb2012-04-26 18:59:59 +0000285 int ret, count = 0;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500286 DHM_VALIDATE_RET( ctx != NULL );
287 DHM_VALIDATE_RET( output != NULL );
288 DHM_VALIDATE_RET( f_rng != NULL );
Paul Bakker5121ce52009-01-03 21:22:43 +0000289
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500290 if( olen < 1 || olen > ctx->len )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200291 return( MBEDTLS_ERR_DHM_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +0000292
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200293 if( mbedtls_mpi_cmp_int( &ctx->P, 0 ) == 0 )
294 return( MBEDTLS_ERR_DHM_BAD_INPUT_DATA );
Paul Bakkerb5b20f12012-09-16 15:07:49 +0000295
Paul Bakker5121ce52009-01-03 21:22:43 +0000296 /*
297 * generate X and calculate GX = G^X mod P
298 */
Paul Bakkeraec37cb2012-04-26 18:59:59 +0000299 do
300 {
Ron Eldor7269fee2017-01-12 14:50:50 +0200301 MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &ctx->X, x_size, f_rng, p_rng ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000302
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200303 while( mbedtls_mpi_cmp_mpi( &ctx->X, &ctx->P ) >= 0 )
304 MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &ctx->X, 1 ) );
Paul Bakkeraec37cb2012-04-26 18:59:59 +0000305
306 if( count++ > 10 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200307 return( MBEDTLS_ERR_DHM_MAKE_PUBLIC_FAILED );
Paul Bakkeraec37cb2012-04-26 18:59:59 +0000308 }
309 while( dhm_check_range( &ctx->X, &ctx->P ) != 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +0000310
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200311 MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &ctx->GX, &ctx->G, &ctx->X,
Paul Bakker5121ce52009-01-03 21:22:43 +0000312 &ctx->P , &ctx->RP ) );
313
Paul Bakker345a6fe2011-02-28 21:20:02 +0000314 if( ( ret = dhm_check_range( &ctx->GX, &ctx->P ) ) != 0 )
315 return( ret );
Paul Bakkerc47840e2011-02-20 16:37:30 +0000316
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200317 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &ctx->GX, output, olen ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000318
319cleanup:
320
321 if( ret != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200322 return( MBEDTLS_ERR_DHM_MAKE_PUBLIC_FAILED + ret );
Paul Bakker5121ce52009-01-03 21:22:43 +0000323
324 return( 0 );
325}
326
327/*
Manuel Pégourié-Gonnard143b5022013-09-04 16:29:59 +0200328 * Use the blinding method and optimisation suggested in section 10 of:
329 * KOCHER, Paul C. Timing attacks on implementations of Diffie-Hellman, RSA,
Manuel Pégourié-Gonnard998930a2015-04-03 13:48:06 +0200330 * DSS, and other systems. In : Advances in Cryptology-CRYPTO'96. Springer
Manuel Pégourié-Gonnard143b5022013-09-04 16:29:59 +0200331 * Berlin Heidelberg, 1996. p. 104-113.
332 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200333static int dhm_update_blinding( mbedtls_dhm_context *ctx,
Manuel Pégourié-Gonnard143b5022013-09-04 16:29:59 +0200334 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
335{
336 int ret, count;
337
338 /*
Manuel Pégourié-Gonnard15d5de12013-09-17 11:34:11 +0200339 * Don't use any blinding the first time a particular X is used,
340 * but remember it to use blinding next time.
Manuel Pégourié-Gonnard143b5022013-09-04 16:29:59 +0200341 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200342 if( mbedtls_mpi_cmp_mpi( &ctx->X, &ctx->pX ) != 0 )
Manuel Pégourié-Gonnarded8a02b2013-09-04 16:39:03 +0200343 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200344 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &ctx->pX, &ctx->X ) );
345 MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &ctx->Vi, 1 ) );
346 MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &ctx->Vf, 1 ) );
Manuel Pégourié-Gonnarded8a02b2013-09-04 16:39:03 +0200347
Manuel Pégourié-Gonnard143b5022013-09-04 16:29:59 +0200348 return( 0 );
349 }
350
351 /*
Manuel Pégourié-Gonnard15d5de12013-09-17 11:34:11 +0200352 * Ok, we need blinding. Can we re-use existing values?
353 * If yes, just update them by squaring them.
Manuel Pégourié-Gonnard143b5022013-09-04 16:29:59 +0200354 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200355 if( mbedtls_mpi_cmp_int( &ctx->Vi, 1 ) != 0 )
Manuel Pégourié-Gonnard15d5de12013-09-17 11:34:11 +0200356 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200357 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ctx->Vi, &ctx->Vi, &ctx->Vi ) );
358 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &ctx->Vi, &ctx->Vi, &ctx->P ) );
Manuel Pégourié-Gonnard15d5de12013-09-17 11:34:11 +0200359
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200360 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ctx->Vf, &ctx->Vf, &ctx->Vf ) );
361 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &ctx->Vf, &ctx->Vf, &ctx->P ) );
Manuel Pégourié-Gonnard15d5de12013-09-17 11:34:11 +0200362
363 return( 0 );
364 }
365
366 /*
367 * We need to generate blinding values from scratch
368 */
369
370 /* Vi = random( 2, P-1 ) */
371 count = 0;
372 do
373 {
Ron Eldor7269fee2017-01-12 14:50:50 +0200374 MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &ctx->Vi, mbedtls_mpi_size( &ctx->P ), f_rng, p_rng ) );
Manuel Pégourié-Gonnard15d5de12013-09-17 11:34:11 +0200375
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200376 while( mbedtls_mpi_cmp_mpi( &ctx->Vi, &ctx->P ) >= 0 )
377 MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &ctx->Vi, 1 ) );
Manuel Pégourié-Gonnard15d5de12013-09-17 11:34:11 +0200378
379 if( count++ > 10 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200380 return( MBEDTLS_ERR_MPI_NOT_ACCEPTABLE );
Manuel Pégourié-Gonnard15d5de12013-09-17 11:34:11 +0200381 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200382 while( mbedtls_mpi_cmp_int( &ctx->Vi, 1 ) <= 0 );
Manuel Pégourié-Gonnard143b5022013-09-04 16:29:59 +0200383
Manuel Pégourié-Gonnard143b5022013-09-04 16:29:59 +0200384 /* Vf = Vi^-X mod P */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200385 MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( &ctx->Vf, &ctx->Vi, &ctx->P ) );
386 MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &ctx->Vf, &ctx->Vf, &ctx->X, &ctx->P, &ctx->RP ) );
Manuel Pégourié-Gonnard143b5022013-09-04 16:29:59 +0200387
Manuel Pégourié-Gonnard143b5022013-09-04 16:29:59 +0200388cleanup:
389 return( ret );
390}
391
392/*
Paul Bakker5121ce52009-01-03 21:22:43 +0000393 * Derive and export the shared secret (G^Y)^X mod P
394 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200395int mbedtls_dhm_calc_secret( mbedtls_dhm_context *ctx,
Manuel Pégourié-Gonnard33352052015-06-02 16:17:08 +0100396 unsigned char *output, size_t output_size, size_t *olen,
Manuel Pégourié-Gonnard2d627642013-09-04 14:22:07 +0200397 int (*f_rng)(void *, unsigned char *, size_t),
398 void *p_rng )
Paul Bakker5121ce52009-01-03 21:22:43 +0000399{
Janos Follath24eed8d2019-11-22 13:21:35 +0000400 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200401 mbedtls_mpi GYb;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500402 DHM_VALIDATE_RET( ctx != NULL );
403 DHM_VALIDATE_RET( output != NULL );
404 DHM_VALIDATE_RET( olen != NULL );
Manuel Pégourié-Gonnard2d627642013-09-04 14:22:07 +0200405
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500406 if( output_size < ctx->len )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200407 return( MBEDTLS_ERR_DHM_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +0000408
Paul Bakker345a6fe2011-02-28 21:20:02 +0000409 if( ( ret = dhm_check_range( &ctx->GY, &ctx->P ) ) != 0 )
Paul Bakkerc47840e2011-02-20 16:37:30 +0000410 return( ret );
411
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200412 mbedtls_mpi_init( &GYb );
Manuel Pégourié-Gonnard143b5022013-09-04 16:29:59 +0200413
414 /* Blind peer's value */
Manuel Pégourié-Gonnarded8a02b2013-09-04 16:39:03 +0200415 if( f_rng != NULL )
Manuel Pégourié-Gonnard143b5022013-09-04 16:29:59 +0200416 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200417 MBEDTLS_MPI_CHK( dhm_update_blinding( ctx, f_rng, p_rng ) );
418 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &GYb, &ctx->GY, &ctx->Vi ) );
419 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &GYb, &GYb, &ctx->P ) );
Manuel Pégourié-Gonnard143b5022013-09-04 16:29:59 +0200420 }
421 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200422 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &GYb, &ctx->GY ) );
Manuel Pégourié-Gonnard143b5022013-09-04 16:29:59 +0200423
424 /* Do modular exponentiation */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200425 MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &ctx->K, &GYb, &ctx->X,
Manuel Pégourié-Gonnard143b5022013-09-04 16:29:59 +0200426 &ctx->P, &ctx->RP ) );
427
428 /* Unblind secret value */
Manuel Pégourié-Gonnarded8a02b2013-09-04 16:39:03 +0200429 if( f_rng != NULL )
Manuel Pégourié-Gonnard143b5022013-09-04 16:29:59 +0200430 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200431 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ctx->K, &ctx->K, &ctx->Vf ) );
432 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &ctx->K, &ctx->K, &ctx->P ) );
Manuel Pégourié-Gonnard143b5022013-09-04 16:29:59 +0200433 }
434
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200435 *olen = mbedtls_mpi_size( &ctx->K );
Paul Bakker5121ce52009-01-03 21:22:43 +0000436
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200437 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &ctx->K, output, *olen ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000438
439cleanup:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200440 mbedtls_mpi_free( &GYb );
Paul Bakker5121ce52009-01-03 21:22:43 +0000441
442 if( ret != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200443 return( MBEDTLS_ERR_DHM_CALC_SECRET_FAILED + ret );
Paul Bakker5121ce52009-01-03 21:22:43 +0000444
445 return( 0 );
446}
447
448/*
449 * Free the components of a DHM key
450 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200451void mbedtls_dhm_free( mbedtls_dhm_context *ctx )
Paul Bakker5121ce52009-01-03 21:22:43 +0000452{
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500453 if( ctx == NULL )
454 return;
455
456 mbedtls_mpi_free( &ctx->pX );
457 mbedtls_mpi_free( &ctx->Vf );
458 mbedtls_mpi_free( &ctx->Vi );
459 mbedtls_mpi_free( &ctx->RP );
460 mbedtls_mpi_free( &ctx->K );
461 mbedtls_mpi_free( &ctx->GY );
462 mbedtls_mpi_free( &ctx->GX );
463 mbedtls_mpi_free( &ctx->X );
464 mbedtls_mpi_free( &ctx->G );
465 mbedtls_mpi_free( &ctx->P );
Manuel Pégourié-Gonnardb72b4ed2013-09-13 13:55:26 +0200466
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500467 mbedtls_platform_zeroize( ctx, sizeof( mbedtls_dhm_context ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000468}
469
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200470#if defined(MBEDTLS_ASN1_PARSE_C)
Paul Bakker40ce79f2013-09-15 17:43:54 +0200471/*
472 * Parse DHM parameters
473 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200474int mbedtls_dhm_parse_dhm( mbedtls_dhm_context *dhm, const unsigned char *dhmin,
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +0200475 size_t dhminlen )
Paul Bakker40ce79f2013-09-15 17:43:54 +0200476{
Janos Follath24eed8d2019-11-22 13:21:35 +0000477 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker40ce79f2013-09-15 17:43:54 +0200478 size_t len;
479 unsigned char *p, *end;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200480#if defined(MBEDTLS_PEM_PARSE_C)
481 mbedtls_pem_context pem;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500482#endif /* MBEDTLS_PEM_PARSE_C */
Paul Bakker40ce79f2013-09-15 17:43:54 +0200483
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500484 DHM_VALIDATE_RET( dhm != NULL );
485 DHM_VALIDATE_RET( dhmin != NULL );
486
487#if defined(MBEDTLS_PEM_PARSE_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200488 mbedtls_pem_init( &pem );
Paul Bakker40ce79f2013-09-15 17:43:54 +0200489
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +0200490 /* Avoid calling mbedtls_pem_read_buffer() on non-null-terminated string */
Manuel Pégourié-Gonnard0ece0f92015-05-12 12:43:54 +0200491 if( dhminlen == 0 || dhmin[dhminlen - 1] != '\0' )
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +0200492 ret = MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT;
493 else
494 ret = mbedtls_pem_read_buffer( &pem,
495 "-----BEGIN DH PARAMETERS-----",
496 "-----END DH PARAMETERS-----",
497 dhmin, NULL, 0, &dhminlen );
Paul Bakker40ce79f2013-09-15 17:43:54 +0200498
499 if( ret == 0 )
500 {
501 /*
502 * Was PEM encoded
503 */
504 dhminlen = pem.buflen;
505 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200506 else if( ret != MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT )
Paul Bakker40ce79f2013-09-15 17:43:54 +0200507 goto exit;
508
509 p = ( ret == 0 ) ? pem.buf : (unsigned char *) dhmin;
510#else
511 p = (unsigned char *) dhmin;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200512#endif /* MBEDTLS_PEM_PARSE_C */
Paul Bakker40ce79f2013-09-15 17:43:54 +0200513 end = p + dhminlen;
514
515 /*
516 * DHParams ::= SEQUENCE {
Daniel Kahn Gillmor2ed81732015-04-03 13:09:24 -0400517 * prime INTEGER, -- P
518 * generator INTEGER, -- g
519 * privateValueLength INTEGER OPTIONAL
Paul Bakker40ce79f2013-09-15 17:43:54 +0200520 * }
521 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200522 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
523 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
Paul Bakker40ce79f2013-09-15 17:43:54 +0200524 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200525 ret = MBEDTLS_ERR_DHM_INVALID_FORMAT + ret;
Paul Bakker40ce79f2013-09-15 17:43:54 +0200526 goto exit;
527 }
528
529 end = p + len;
530
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200531 if( ( ret = mbedtls_asn1_get_mpi( &p, end, &dhm->P ) ) != 0 ||
532 ( ret = mbedtls_asn1_get_mpi( &p, end, &dhm->G ) ) != 0 )
Paul Bakker40ce79f2013-09-15 17:43:54 +0200533 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200534 ret = MBEDTLS_ERR_DHM_INVALID_FORMAT + ret;
Paul Bakker40ce79f2013-09-15 17:43:54 +0200535 goto exit;
536 }
537
538 if( p != end )
539 {
Manuel Pégourié-Gonnardde9b3632015-04-17 20:06:31 +0200540 /* This might be the optional privateValueLength.
541 * If so, we can cleanly discard it */
542 mbedtls_mpi rec;
543 mbedtls_mpi_init( &rec );
544 ret = mbedtls_asn1_get_mpi( &p, end, &rec );
545 mbedtls_mpi_free( &rec );
Daniel Kahn Gillmor2ed81732015-04-03 13:09:24 -0400546 if ( ret != 0 )
547 {
Manuel Pégourié-Gonnardde9b3632015-04-17 20:06:31 +0200548 ret = MBEDTLS_ERR_DHM_INVALID_FORMAT + ret;
Daniel Kahn Gillmor2ed81732015-04-03 13:09:24 -0400549 goto exit;
550 }
551 if ( p != end )
552 {
Manuel Pégourié-Gonnardde9b3632015-04-17 20:06:31 +0200553 ret = MBEDTLS_ERR_DHM_INVALID_FORMAT +
554 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH;
Daniel Kahn Gillmor2ed81732015-04-03 13:09:24 -0400555 goto exit;
556 }
Paul Bakker40ce79f2013-09-15 17:43:54 +0200557 }
558
559 ret = 0;
560
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200561 dhm->len = mbedtls_mpi_size( &dhm->P );
Manuel Pégourié-Gonnard3fec2202014-03-29 16:42:38 +0100562
Paul Bakker40ce79f2013-09-15 17:43:54 +0200563exit:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200564#if defined(MBEDTLS_PEM_PARSE_C)
565 mbedtls_pem_free( &pem );
Paul Bakker40ce79f2013-09-15 17:43:54 +0200566#endif
567 if( ret != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200568 mbedtls_dhm_free( dhm );
Paul Bakker40ce79f2013-09-15 17:43:54 +0200569
570 return( ret );
571}
572
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200573#if defined(MBEDTLS_FS_IO)
Paul Bakker40ce79f2013-09-15 17:43:54 +0200574/*
575 * Load all data from a file into a given buffer.
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +0200576 *
577 * The file is expected to contain either PEM or DER encoded data.
578 * A terminating null byte is always appended. It is included in the announced
579 * length only if the data looks like it is PEM encoded.
Paul Bakker40ce79f2013-09-15 17:43:54 +0200580 */
581static int load_file( const char *path, unsigned char **buf, size_t *n )
582{
583 FILE *f;
584 long size;
585
586 if( ( f = fopen( path, "rb" ) ) == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200587 return( MBEDTLS_ERR_DHM_FILE_IO_ERROR );
Paul Bakker40ce79f2013-09-15 17:43:54 +0200588
589 fseek( f, 0, SEEK_END );
590 if( ( size = ftell( f ) ) == -1 )
591 {
592 fclose( f );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200593 return( MBEDTLS_ERR_DHM_FILE_IO_ERROR );
Paul Bakker40ce79f2013-09-15 17:43:54 +0200594 }
595 fseek( f, 0, SEEK_SET );
596
597 *n = (size_t) size;
598
599 if( *n + 1 == 0 ||
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200600 ( *buf = mbedtls_calloc( 1, *n + 1 ) ) == NULL )
Paul Bakker40ce79f2013-09-15 17:43:54 +0200601 {
602 fclose( f );
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +0200603 return( MBEDTLS_ERR_DHM_ALLOC_FAILED );
Paul Bakker40ce79f2013-09-15 17:43:54 +0200604 }
605
606 if( fread( *buf, 1, *n, f ) != *n )
607 {
608 fclose( f );
Andres Amaya Garciabdbca7b2017-06-23 16:23:21 +0100609
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500610 mbedtls_platform_zeroize( *buf, *n + 1 );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200611 mbedtls_free( *buf );
Andres Amaya Garciabdbca7b2017-06-23 16:23:21 +0100612
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200613 return( MBEDTLS_ERR_DHM_FILE_IO_ERROR );
Paul Bakker40ce79f2013-09-15 17:43:54 +0200614 }
615
616 fclose( f );
617
618 (*buf)[*n] = '\0';
619
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +0200620 if( strstr( (const char *) *buf, "-----BEGIN " ) != NULL )
621 ++*n;
622
Paul Bakker40ce79f2013-09-15 17:43:54 +0200623 return( 0 );
624}
625
626/*
627 * Load and parse DHM parameters
628 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200629int mbedtls_dhm_parse_dhmfile( mbedtls_dhm_context *dhm, const char *path )
Paul Bakker40ce79f2013-09-15 17:43:54 +0200630{
Janos Follath24eed8d2019-11-22 13:21:35 +0000631 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker40ce79f2013-09-15 17:43:54 +0200632 size_t n;
633 unsigned char *buf;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500634 DHM_VALIDATE_RET( dhm != NULL );
635 DHM_VALIDATE_RET( path != NULL );
Paul Bakker40ce79f2013-09-15 17:43:54 +0200636
Paul Bakker66d5d072014-06-17 16:39:18 +0200637 if( ( ret = load_file( path, &buf, &n ) ) != 0 )
Paul Bakker40ce79f2013-09-15 17:43:54 +0200638 return( ret );
639
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200640 ret = mbedtls_dhm_parse_dhm( dhm, buf, n );
Paul Bakker40ce79f2013-09-15 17:43:54 +0200641
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500642 mbedtls_platform_zeroize( buf, n );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200643 mbedtls_free( buf );
Paul Bakker40ce79f2013-09-15 17:43:54 +0200644
645 return( ret );
646}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200647#endif /* MBEDTLS_FS_IO */
648#endif /* MBEDTLS_ASN1_PARSE_C */
nirekh0149762fa2017-12-25 06:46:48 +0000649#endif /* MBEDTLS_DHM_ALT */
Paul Bakker40ce79f2013-09-15 17:43:54 +0200650
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200651#if defined(MBEDTLS_SELF_TEST)
Paul Bakker5121ce52009-01-03 21:22:43 +0000652
Hanno Becker8b0f9e62019-05-31 17:28:59 +0100653#if defined(MBEDTLS_PEM_PARSE_C)
Manuel Pégourié-Gonnard53585ee2015-06-25 08:52:25 +0200654static const char mbedtls_test_dhm_params[] =
655"-----BEGIN DH PARAMETERS-----\r\n"
656"MIGHAoGBAJ419DBEOgmQTzo5qXl5fQcN9TN455wkOL7052HzxxRVMyhYmwQcgJvh\r\n"
657"1sa18fyfR9OiVEMYglOpkqVoGLN7qd5aQNNi5W7/C+VBdHTBJcGZJyyP5B3qcz32\r\n"
658"9mLJKudlVudV0Qxk5qUJaPZ/xupz0NyoVpviuiBOI1gNi8ovSXWzAgEC\r\n"
659"-----END DH PARAMETERS-----\r\n";
Hanno Becker8b0f9e62019-05-31 17:28:59 +0100660#else /* MBEDTLS_PEM_PARSE_C */
661static const char mbedtls_test_dhm_params[] = {
662 0x30, 0x81, 0x87, 0x02, 0x81, 0x81, 0x00, 0x9e, 0x35, 0xf4, 0x30, 0x44,
663 0x3a, 0x09, 0x90, 0x4f, 0x3a, 0x39, 0xa9, 0x79, 0x79, 0x7d, 0x07, 0x0d,
664 0xf5, 0x33, 0x78, 0xe7, 0x9c, 0x24, 0x38, 0xbe, 0xf4, 0xe7, 0x61, 0xf3,
665 0xc7, 0x14, 0x55, 0x33, 0x28, 0x58, 0x9b, 0x04, 0x1c, 0x80, 0x9b, 0xe1,
666 0xd6, 0xc6, 0xb5, 0xf1, 0xfc, 0x9f, 0x47, 0xd3, 0xa2, 0x54, 0x43, 0x18,
667 0x82, 0x53, 0xa9, 0x92, 0xa5, 0x68, 0x18, 0xb3, 0x7b, 0xa9, 0xde, 0x5a,
668 0x40, 0xd3, 0x62, 0xe5, 0x6e, 0xff, 0x0b, 0xe5, 0x41, 0x74, 0x74, 0xc1,
669 0x25, 0xc1, 0x99, 0x27, 0x2c, 0x8f, 0xe4, 0x1d, 0xea, 0x73, 0x3d, 0xf6,
670 0xf6, 0x62, 0xc9, 0x2a, 0xe7, 0x65, 0x56, 0xe7, 0x55, 0xd1, 0x0c, 0x64,
671 0xe6, 0xa5, 0x09, 0x68, 0xf6, 0x7f, 0xc6, 0xea, 0x73, 0xd0, 0xdc, 0xa8,
672 0x56, 0x9b, 0xe2, 0xba, 0x20, 0x4e, 0x23, 0x58, 0x0d, 0x8b, 0xca, 0x2f,
673 0x49, 0x75, 0xb3, 0x02, 0x01, 0x02 };
674#endif /* MBEDTLS_PEM_PARSE_C */
Manuel Pégourié-Gonnard53585ee2015-06-25 08:52:25 +0200675
676static const size_t mbedtls_test_dhm_params_len = sizeof( mbedtls_test_dhm_params );
Paul Bakker40ce79f2013-09-15 17:43:54 +0200677
Paul Bakker5121ce52009-01-03 21:22:43 +0000678/*
679 * Checkup routine
680 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200681int mbedtls_dhm_self_test( int verbose )
Paul Bakker5121ce52009-01-03 21:22:43 +0000682{
Janos Follath24eed8d2019-11-22 13:21:35 +0000683 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200684 mbedtls_dhm_context dhm;
Paul Bakker40ce79f2013-09-15 17:43:54 +0200685
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200686 mbedtls_dhm_init( &dhm );
Paul Bakker8f870b02014-06-20 13:32:38 +0200687
Paul Bakker40ce79f2013-09-15 17:43:54 +0200688 if( verbose != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200689 mbedtls_printf( " DHM parameter load: " );
Paul Bakker40ce79f2013-09-15 17:43:54 +0200690
Manuel Pégourié-Gonnard53585ee2015-06-25 08:52:25 +0200691 if( ( ret = mbedtls_dhm_parse_dhm( &dhm,
692 (const unsigned char *) mbedtls_test_dhm_params,
693 mbedtls_test_dhm_params_len ) ) != 0 )
Paul Bakker40ce79f2013-09-15 17:43:54 +0200694 {
695 if( verbose != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200696 mbedtls_printf( "failed\n" );
Paul Bakker40ce79f2013-09-15 17:43:54 +0200697
Manuel Pégourié-Gonnardb196fc22014-07-09 16:53:29 +0200698 ret = 1;
Paul Bakker8f870b02014-06-20 13:32:38 +0200699 goto exit;
Paul Bakker40ce79f2013-09-15 17:43:54 +0200700 }
701
702 if( verbose != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200703 mbedtls_printf( "passed\n\n" );
Paul Bakker40ce79f2013-09-15 17:43:54 +0200704
Paul Bakker8f870b02014-06-20 13:32:38 +0200705exit:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200706 mbedtls_dhm_free( &dhm );
Paul Bakker40ce79f2013-09-15 17:43:54 +0200707
Paul Bakker8f870b02014-06-20 13:32:38 +0200708 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +0000709}
710
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200711#endif /* MBEDTLS_SELF_TEST */
Paul Bakker5121ce52009-01-03 21:22:43 +0000712
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200713#endif /* MBEDTLS_DHM_C */