blob: 4d911de8a2f601d3d5a919c0e11a5f396c51a09d [file] [log] [blame]
Paul Bakker5121ce52009-01-03 21:22:43 +00001/*
2 * Diffie-Hellman-Merkle key exchange
3 *
Manuel Pégourié-Gonnard6fb81872015-07-27 11:11:48 +02004 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
Paul Bakkerb96f1542010-07-18 20:36:00 +00005 *
Manuel Pégourié-Gonnardfe446432015-03-06 13:17:10 +00006 * This file is part of mbed TLS (https://tls.mbed.org)
Paul Bakkerb96f1542010-07-18 20:36:00 +00007 *
Paul Bakker5121ce52009-01-03 21:22:43 +00008 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License along
19 * with this program; if not, write to the Free Software Foundation, Inc.,
20 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
21 */
22/*
23 * Reference:
24 *
25 * http://www.cacr.math.uwaterloo.ca/hac/ (chapter 12)
26 */
27
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020028#if !defined(MBEDTLS_CONFIG_FILE)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000029#include "mbedtls/config.h"
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020030#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020031#include MBEDTLS_CONFIG_FILE
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020032#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000033
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020034#if defined(MBEDTLS_DHM_C)
Paul Bakker5121ce52009-01-03 21:22:43 +000035
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000036#include "mbedtls/dhm.h"
Paul Bakker5121ce52009-01-03 21:22:43 +000037
Rich Evans00ab4702015-02-06 13:43:58 +000038#include <string.h>
39
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020040#if defined(MBEDTLS_PEM_PARSE_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000041#include "mbedtls/pem.h"
Paul Bakker40ce79f2013-09-15 17:43:54 +020042#endif
43
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020044#if defined(MBEDTLS_ASN1_PARSE_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000045#include "mbedtls/asn1.h"
Paul Bakker40ce79f2013-09-15 17:43:54 +020046#endif
47
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020048#if defined(MBEDTLS_PLATFORM_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000049#include "mbedtls/platform.h"
Paul Bakker40ce79f2013-09-15 17:43:54 +020050#else
51#include <stdlib.h>
Manuel Pégourié-Gonnard981732b2015-02-17 15:46:45 +000052#include <stdio.h>
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020053#define mbedtls_printf printf
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +020054#define mbedtls_calloc calloc
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020055#define mbedtls_free free
Paul Bakker40ce79f2013-09-15 17:43:54 +020056#endif
57
Paul Bakker34617722014-06-13 17:20:13 +020058/* Implementation that should never be optimized out by the compiler */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020059static void mbedtls_zeroize( void *v, size_t n ) {
Paul Bakker34617722014-06-13 17:20:13 +020060 volatile unsigned char *p = v; while( n-- ) *p++ = 0;
61}
62
Paul Bakker5121ce52009-01-03 21:22:43 +000063/*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020064 * helper to validate the mbedtls_mpi size and import it
Paul Bakker5121ce52009-01-03 21:22:43 +000065 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020066static int dhm_read_bignum( mbedtls_mpi *X,
Paul Bakker5121ce52009-01-03 21:22:43 +000067 unsigned char **p,
Paul Bakkerff60ee62010-03-16 21:09:09 +000068 const unsigned char *end )
Paul Bakker5121ce52009-01-03 21:22:43 +000069{
70 int ret, n;
71
72 if( end - *p < 2 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020073 return( MBEDTLS_ERR_DHM_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +000074
75 n = ( (*p)[0] << 8 ) | (*p)[1];
76 (*p) += 2;
77
78 if( (int)( end - *p ) < n )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020079 return( MBEDTLS_ERR_DHM_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +000080
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020081 if( ( ret = mbedtls_mpi_read_binary( X, *p, n ) ) != 0 )
82 return( MBEDTLS_ERR_DHM_READ_PARAMS_FAILED + ret );
Paul Bakker5121ce52009-01-03 21:22:43 +000083
84 (*p) += n;
85
86 return( 0 );
87}
88
89/*
Paul Bakkeraec37cb2012-04-26 18:59:59 +000090 * Verify sanity of parameter with regards to P
Paul Bakker345a6fe2011-02-28 21:20:02 +000091 *
Paul Bakkeraec37cb2012-04-26 18:59:59 +000092 * Parameter should be: 2 <= public_param <= P - 2
Paul Bakker345a6fe2011-02-28 21:20:02 +000093 *
94 * For more information on the attack, see:
95 * http://www.cl.cam.ac.uk/~rja14/Papers/psandqs.pdf
96 * http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-2643
Paul Bakkerc47840e2011-02-20 16:37:30 +000097 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020098static int dhm_check_range( const mbedtls_mpi *param, const mbedtls_mpi *P )
Paul Bakkerc47840e2011-02-20 16:37:30 +000099{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200100 mbedtls_mpi L, U;
101 int ret = MBEDTLS_ERR_DHM_BAD_INPUT_DATA;
Paul Bakkerc47840e2011-02-20 16:37:30 +0000102
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200103 mbedtls_mpi_init( &L ); mbedtls_mpi_init( &U );
Paul Bakker3d8fb632014-04-17 12:42:41 +0200104
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200105 MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &L, 2 ) );
106 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &U, P, 2 ) );
Paul Bakkerc47840e2011-02-20 16:37:30 +0000107
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200108 if( mbedtls_mpi_cmp_mpi( param, &L ) >= 0 &&
109 mbedtls_mpi_cmp_mpi( param, &U ) <= 0 )
Paul Bakkerc47840e2011-02-20 16:37:30 +0000110 {
Paul Bakker345a6fe2011-02-28 21:20:02 +0000111 ret = 0;
Paul Bakkerc47840e2011-02-20 16:37:30 +0000112 }
113
Paul Bakker3d8fb632014-04-17 12:42:41 +0200114cleanup:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200115 mbedtls_mpi_free( &L ); mbedtls_mpi_free( &U );
Paul Bakker345a6fe2011-02-28 21:20:02 +0000116 return( ret );
Paul Bakkerc47840e2011-02-20 16:37:30 +0000117}
118
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200119void mbedtls_dhm_init( mbedtls_dhm_context *ctx )
Paul Bakker8f870b02014-06-20 13:32:38 +0200120{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200121 memset( ctx, 0, sizeof( mbedtls_dhm_context ) );
Paul Bakker8f870b02014-06-20 13:32:38 +0200122}
123
Paul Bakkerc47840e2011-02-20 16:37:30 +0000124/*
Paul Bakker5121ce52009-01-03 21:22:43 +0000125 * Parse the ServerKeyExchange parameters
126 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200127int mbedtls_dhm_read_params( mbedtls_dhm_context *ctx,
Paul Bakker5121ce52009-01-03 21:22:43 +0000128 unsigned char **p,
Paul Bakkerff60ee62010-03-16 21:09:09 +0000129 const unsigned char *end )
Paul Bakker5121ce52009-01-03 21:22:43 +0000130{
Paul Bakker13ed9ab2012-04-16 09:43:49 +0000131 int ret;
Paul Bakker5121ce52009-01-03 21:22:43 +0000132
Paul Bakker5121ce52009-01-03 21:22:43 +0000133 if( ( ret = dhm_read_bignum( &ctx->P, p, end ) ) != 0 ||
134 ( ret = dhm_read_bignum( &ctx->G, p, end ) ) != 0 ||
135 ( ret = dhm_read_bignum( &ctx->GY, p, end ) ) != 0 )
136 return( ret );
137
Paul Bakker345a6fe2011-02-28 21:20:02 +0000138 if( ( ret = dhm_check_range( &ctx->GY, &ctx->P ) ) != 0 )
139 return( ret );
140
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200141 ctx->len = mbedtls_mpi_size( &ctx->P );
Paul Bakker5121ce52009-01-03 21:22:43 +0000142
Paul Bakker5121ce52009-01-03 21:22:43 +0000143 return( 0 );
144}
145
146/*
147 * Setup and write the ServerKeyExchange parameters
148 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200149int mbedtls_dhm_make_params( mbedtls_dhm_context *ctx, int x_size,
Paul Bakker23986e52011-04-24 08:57:21 +0000150 unsigned char *output, size_t *olen,
Paul Bakkera3d195c2011-11-27 21:07:34 +0000151 int (*f_rng)(void *, unsigned char *, size_t),
152 void *p_rng )
Paul Bakker5121ce52009-01-03 21:22:43 +0000153{
Paul Bakkeraec37cb2012-04-26 18:59:59 +0000154 int ret, count = 0;
Paul Bakker23986e52011-04-24 08:57:21 +0000155 size_t n1, n2, n3;
Paul Bakker5121ce52009-01-03 21:22:43 +0000156 unsigned char *p;
157
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200158 if( mbedtls_mpi_cmp_int( &ctx->P, 0 ) == 0 )
159 return( MBEDTLS_ERR_DHM_BAD_INPUT_DATA );
Paul Bakkerb5b20f12012-09-16 15:07:49 +0000160
Paul Bakker5121ce52009-01-03 21:22:43 +0000161 /*
Paul Bakkerff7fe672010-07-18 09:45:05 +0000162 * Generate X as large as possible ( < P )
Paul Bakker5121ce52009-01-03 21:22:43 +0000163 */
Paul Bakkeraec37cb2012-04-26 18:59:59 +0000164 do
165 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200166 mbedtls_mpi_fill_random( &ctx->X, x_size, f_rng, p_rng );
Paul Bakker5121ce52009-01-03 21:22:43 +0000167
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200168 while( mbedtls_mpi_cmp_mpi( &ctx->X, &ctx->P ) >= 0 )
169 MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &ctx->X, 1 ) );
Paul Bakkeraec37cb2012-04-26 18:59:59 +0000170
171 if( count++ > 10 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200172 return( MBEDTLS_ERR_DHM_MAKE_PARAMS_FAILED );
Paul Bakkeraec37cb2012-04-26 18:59:59 +0000173 }
174 while( dhm_check_range( &ctx->X, &ctx->P ) != 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +0000175
Paul Bakkerff7fe672010-07-18 09:45:05 +0000176 /*
177 * Calculate GX = G^X mod P
178 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200179 MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &ctx->GX, &ctx->G, &ctx->X,
Paul Bakker5121ce52009-01-03 21:22:43 +0000180 &ctx->P , &ctx->RP ) );
181
Paul Bakker345a6fe2011-02-28 21:20:02 +0000182 if( ( ret = dhm_check_range( &ctx->GX, &ctx->P ) ) != 0 )
Paul Bakkerc47840e2011-02-20 16:37:30 +0000183 return( ret );
184
Paul Bakker5121ce52009-01-03 21:22:43 +0000185 /*
186 * export P, G, GX
187 */
188#define DHM_MPI_EXPORT(X,n) \
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200189 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( X, p + 2, n ) ); \
Paul Bakker5121ce52009-01-03 21:22:43 +0000190 *p++ = (unsigned char)( n >> 8 ); \
191 *p++ = (unsigned char)( n ); p += n;
192
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200193 n1 = mbedtls_mpi_size( &ctx->P );
194 n2 = mbedtls_mpi_size( &ctx->G );
195 n3 = mbedtls_mpi_size( &ctx->GX );
Paul Bakker5121ce52009-01-03 21:22:43 +0000196
197 p = output;
198 DHM_MPI_EXPORT( &ctx->P , n1 );
199 DHM_MPI_EXPORT( &ctx->G , n2 );
200 DHM_MPI_EXPORT( &ctx->GX, n3 );
201
202 *olen = p - output;
203
204 ctx->len = n1;
205
206cleanup:
207
208 if( ret != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200209 return( MBEDTLS_ERR_DHM_MAKE_PARAMS_FAILED + ret );
Paul Bakker5121ce52009-01-03 21:22:43 +0000210
211 return( 0 );
212}
213
214/*
215 * Import the peer's public value G^Y
216 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200217int mbedtls_dhm_read_public( mbedtls_dhm_context *ctx,
Paul Bakker23986e52011-04-24 08:57:21 +0000218 const unsigned char *input, size_t ilen )
Paul Bakker5121ce52009-01-03 21:22:43 +0000219{
220 int ret;
221
222 if( ctx == NULL || ilen < 1 || ilen > ctx->len )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200223 return( MBEDTLS_ERR_DHM_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +0000224
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200225 if( ( ret = mbedtls_mpi_read_binary( &ctx->GY, input, ilen ) ) != 0 )
226 return( MBEDTLS_ERR_DHM_READ_PUBLIC_FAILED + ret );
Paul Bakker5121ce52009-01-03 21:22:43 +0000227
228 return( 0 );
229}
230
231/*
232 * Create own private value X and export G^X
233 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200234int mbedtls_dhm_make_public( mbedtls_dhm_context *ctx, int x_size,
Paul Bakker23986e52011-04-24 08:57:21 +0000235 unsigned char *output, size_t olen,
Paul Bakkera3d195c2011-11-27 21:07:34 +0000236 int (*f_rng)(void *, unsigned char *, size_t),
237 void *p_rng )
Paul Bakker5121ce52009-01-03 21:22:43 +0000238{
Paul Bakkeraec37cb2012-04-26 18:59:59 +0000239 int ret, count = 0;
Paul Bakker5121ce52009-01-03 21:22:43 +0000240
241 if( ctx == NULL || olen < 1 || olen > ctx->len )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200242 return( MBEDTLS_ERR_DHM_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +0000243
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200244 if( mbedtls_mpi_cmp_int( &ctx->P, 0 ) == 0 )
245 return( MBEDTLS_ERR_DHM_BAD_INPUT_DATA );
Paul Bakkerb5b20f12012-09-16 15:07:49 +0000246
Paul Bakker5121ce52009-01-03 21:22:43 +0000247 /*
248 * generate X and calculate GX = G^X mod P
249 */
Paul Bakkeraec37cb2012-04-26 18:59:59 +0000250 do
251 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200252 mbedtls_mpi_fill_random( &ctx->X, x_size, f_rng, p_rng );
Paul Bakker5121ce52009-01-03 21:22:43 +0000253
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200254 while( mbedtls_mpi_cmp_mpi( &ctx->X, &ctx->P ) >= 0 )
255 MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &ctx->X, 1 ) );
Paul Bakkeraec37cb2012-04-26 18:59:59 +0000256
257 if( count++ > 10 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200258 return( MBEDTLS_ERR_DHM_MAKE_PUBLIC_FAILED );
Paul Bakkeraec37cb2012-04-26 18:59:59 +0000259 }
260 while( dhm_check_range( &ctx->X, &ctx->P ) != 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +0000261
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200262 MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &ctx->GX, &ctx->G, &ctx->X,
Paul Bakker5121ce52009-01-03 21:22:43 +0000263 &ctx->P , &ctx->RP ) );
264
Paul Bakker345a6fe2011-02-28 21:20:02 +0000265 if( ( ret = dhm_check_range( &ctx->GX, &ctx->P ) ) != 0 )
266 return( ret );
Paul Bakkerc47840e2011-02-20 16:37:30 +0000267
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200268 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &ctx->GX, output, olen ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000269
270cleanup:
271
272 if( ret != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200273 return( MBEDTLS_ERR_DHM_MAKE_PUBLIC_FAILED + ret );
Paul Bakker5121ce52009-01-03 21:22:43 +0000274
275 return( 0 );
276}
277
278/*
Manuel Pégourié-Gonnard143b5022013-09-04 16:29:59 +0200279 * Use the blinding method and optimisation suggested in section 10 of:
280 * KOCHER, Paul C. Timing attacks on implementations of Diffie-Hellman, RSA,
Manuel Pégourié-Gonnard998930a2015-04-03 13:48:06 +0200281 * DSS, and other systems. In : Advances in Cryptology-CRYPTO'96. Springer
Manuel Pégourié-Gonnard143b5022013-09-04 16:29:59 +0200282 * Berlin Heidelberg, 1996. p. 104-113.
283 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200284static int dhm_update_blinding( mbedtls_dhm_context *ctx,
Manuel Pégourié-Gonnard143b5022013-09-04 16:29:59 +0200285 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
286{
287 int ret, count;
288
289 /*
Manuel Pégourié-Gonnard15d5de12013-09-17 11:34:11 +0200290 * Don't use any blinding the first time a particular X is used,
291 * but remember it to use blinding next time.
Manuel Pégourié-Gonnard143b5022013-09-04 16:29:59 +0200292 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200293 if( mbedtls_mpi_cmp_mpi( &ctx->X, &ctx->pX ) != 0 )
Manuel Pégourié-Gonnarded8a02b2013-09-04 16:39:03 +0200294 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200295 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &ctx->pX, &ctx->X ) );
296 MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &ctx->Vi, 1 ) );
297 MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &ctx->Vf, 1 ) );
Manuel Pégourié-Gonnarded8a02b2013-09-04 16:39:03 +0200298
Manuel Pégourié-Gonnard143b5022013-09-04 16:29:59 +0200299 return( 0 );
300 }
301
302 /*
Manuel Pégourié-Gonnard15d5de12013-09-17 11:34:11 +0200303 * Ok, we need blinding. Can we re-use existing values?
304 * If yes, just update them by squaring them.
Manuel Pégourié-Gonnard143b5022013-09-04 16:29:59 +0200305 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200306 if( mbedtls_mpi_cmp_int( &ctx->Vi, 1 ) != 0 )
Manuel Pégourié-Gonnard15d5de12013-09-17 11:34:11 +0200307 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200308 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ctx->Vi, &ctx->Vi, &ctx->Vi ) );
309 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &ctx->Vi, &ctx->Vi, &ctx->P ) );
Manuel Pégourié-Gonnard15d5de12013-09-17 11:34:11 +0200310
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200311 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ctx->Vf, &ctx->Vf, &ctx->Vf ) );
312 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &ctx->Vf, &ctx->Vf, &ctx->P ) );
Manuel Pégourié-Gonnard15d5de12013-09-17 11:34:11 +0200313
314 return( 0 );
315 }
316
317 /*
318 * We need to generate blinding values from scratch
319 */
320
321 /* Vi = random( 2, P-1 ) */
322 count = 0;
323 do
324 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200325 mbedtls_mpi_fill_random( &ctx->Vi, mbedtls_mpi_size( &ctx->P ), f_rng, p_rng );
Manuel Pégourié-Gonnard15d5de12013-09-17 11:34:11 +0200326
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200327 while( mbedtls_mpi_cmp_mpi( &ctx->Vi, &ctx->P ) >= 0 )
328 MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &ctx->Vi, 1 ) );
Manuel Pégourié-Gonnard15d5de12013-09-17 11:34:11 +0200329
330 if( count++ > 10 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200331 return( MBEDTLS_ERR_MPI_NOT_ACCEPTABLE );
Manuel Pégourié-Gonnard15d5de12013-09-17 11:34:11 +0200332 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200333 while( mbedtls_mpi_cmp_int( &ctx->Vi, 1 ) <= 0 );
Manuel Pégourié-Gonnard143b5022013-09-04 16:29:59 +0200334
Manuel Pégourié-Gonnard143b5022013-09-04 16:29:59 +0200335 /* Vf = Vi^-X mod P */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200336 MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( &ctx->Vf, &ctx->Vi, &ctx->P ) );
337 MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &ctx->Vf, &ctx->Vf, &ctx->X, &ctx->P, &ctx->RP ) );
Manuel Pégourié-Gonnard143b5022013-09-04 16:29:59 +0200338
Manuel Pégourié-Gonnard143b5022013-09-04 16:29:59 +0200339cleanup:
340 return( ret );
341}
342
343/*
Paul Bakker5121ce52009-01-03 21:22:43 +0000344 * Derive and export the shared secret (G^Y)^X mod P
345 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200346int mbedtls_dhm_calc_secret( mbedtls_dhm_context *ctx,
Manuel Pégourié-Gonnard33352052015-06-02 16:17:08 +0100347 unsigned char *output, size_t output_size, size_t *olen,
Manuel Pégourié-Gonnard2d627642013-09-04 14:22:07 +0200348 int (*f_rng)(void *, unsigned char *, size_t),
349 void *p_rng )
Paul Bakker5121ce52009-01-03 21:22:43 +0000350{
351 int ret;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200352 mbedtls_mpi GYb;
Manuel Pégourié-Gonnard2d627642013-09-04 14:22:07 +0200353
Manuel Pégourié-Gonnard33352052015-06-02 16:17:08 +0100354 if( ctx == NULL || output_size < ctx->len )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200355 return( MBEDTLS_ERR_DHM_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +0000356
Paul Bakker345a6fe2011-02-28 21:20:02 +0000357 if( ( ret = dhm_check_range( &ctx->GY, &ctx->P ) ) != 0 )
Paul Bakkerc47840e2011-02-20 16:37:30 +0000358 return( ret );
359
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200360 mbedtls_mpi_init( &GYb );
Manuel Pégourié-Gonnard143b5022013-09-04 16:29:59 +0200361
362 /* Blind peer's value */
Manuel Pégourié-Gonnarded8a02b2013-09-04 16:39:03 +0200363 if( f_rng != NULL )
Manuel Pégourié-Gonnard143b5022013-09-04 16:29:59 +0200364 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200365 MBEDTLS_MPI_CHK( dhm_update_blinding( ctx, f_rng, p_rng ) );
366 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &GYb, &ctx->GY, &ctx->Vi ) );
367 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &GYb, &GYb, &ctx->P ) );
Manuel Pégourié-Gonnard143b5022013-09-04 16:29:59 +0200368 }
369 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200370 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &GYb, &ctx->GY ) );
Manuel Pégourié-Gonnard143b5022013-09-04 16:29:59 +0200371
372 /* Do modular exponentiation */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200373 MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &ctx->K, &GYb, &ctx->X,
Manuel Pégourié-Gonnard143b5022013-09-04 16:29:59 +0200374 &ctx->P, &ctx->RP ) );
375
376 /* Unblind secret value */
Manuel Pégourié-Gonnarded8a02b2013-09-04 16:39:03 +0200377 if( f_rng != NULL )
Manuel Pégourié-Gonnard143b5022013-09-04 16:29:59 +0200378 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200379 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ctx->K, &ctx->K, &ctx->Vf ) );
380 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &ctx->K, &ctx->K, &ctx->P ) );
Manuel Pégourié-Gonnard143b5022013-09-04 16:29:59 +0200381 }
382
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200383 *olen = mbedtls_mpi_size( &ctx->K );
Paul Bakker5121ce52009-01-03 21:22:43 +0000384
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200385 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &ctx->K, output, *olen ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000386
387cleanup:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200388 mbedtls_mpi_free( &GYb );
Paul Bakker5121ce52009-01-03 21:22:43 +0000389
390 if( ret != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200391 return( MBEDTLS_ERR_DHM_CALC_SECRET_FAILED + ret );
Paul Bakker5121ce52009-01-03 21:22:43 +0000392
393 return( 0 );
394}
395
396/*
397 * Free the components of a DHM key
398 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200399void mbedtls_dhm_free( mbedtls_dhm_context *ctx )
Paul Bakker5121ce52009-01-03 21:22:43 +0000400{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200401 mbedtls_mpi_free( &ctx->pX); mbedtls_mpi_free( &ctx->Vf ); mbedtls_mpi_free( &ctx->Vi );
402 mbedtls_mpi_free( &ctx->RP ); mbedtls_mpi_free( &ctx->K ); mbedtls_mpi_free( &ctx->GY );
403 mbedtls_mpi_free( &ctx->GX ); mbedtls_mpi_free( &ctx->X ); mbedtls_mpi_free( &ctx->G );
404 mbedtls_mpi_free( &ctx->P );
Manuel Pégourié-Gonnardb72b4ed2013-09-13 13:55:26 +0200405
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200406 mbedtls_zeroize( ctx, sizeof( mbedtls_dhm_context ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000407}
408
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200409#if defined(MBEDTLS_ASN1_PARSE_C)
Paul Bakker40ce79f2013-09-15 17:43:54 +0200410/*
411 * Parse DHM parameters
412 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200413int mbedtls_dhm_parse_dhm( mbedtls_dhm_context *dhm, const unsigned char *dhmin,
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +0200414 size_t dhminlen )
Paul Bakker40ce79f2013-09-15 17:43:54 +0200415{
416 int ret;
417 size_t len;
418 unsigned char *p, *end;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200419#if defined(MBEDTLS_PEM_PARSE_C)
420 mbedtls_pem_context pem;
Paul Bakker40ce79f2013-09-15 17:43:54 +0200421
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200422 mbedtls_pem_init( &pem );
Paul Bakker40ce79f2013-09-15 17:43:54 +0200423
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +0200424 /* Avoid calling mbedtls_pem_read_buffer() on non-null-terminated string */
Manuel Pégourié-Gonnard0ece0f92015-05-12 12:43:54 +0200425 if( dhminlen == 0 || dhmin[dhminlen - 1] != '\0' )
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +0200426 ret = MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT;
427 else
428 ret = mbedtls_pem_read_buffer( &pem,
429 "-----BEGIN DH PARAMETERS-----",
430 "-----END DH PARAMETERS-----",
431 dhmin, NULL, 0, &dhminlen );
Paul Bakker40ce79f2013-09-15 17:43:54 +0200432
433 if( ret == 0 )
434 {
435 /*
436 * Was PEM encoded
437 */
438 dhminlen = pem.buflen;
439 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200440 else if( ret != MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT )
Paul Bakker40ce79f2013-09-15 17:43:54 +0200441 goto exit;
442
443 p = ( ret == 0 ) ? pem.buf : (unsigned char *) dhmin;
444#else
445 p = (unsigned char *) dhmin;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200446#endif /* MBEDTLS_PEM_PARSE_C */
Paul Bakker40ce79f2013-09-15 17:43:54 +0200447 end = p + dhminlen;
448
449 /*
450 * DHParams ::= SEQUENCE {
Daniel Kahn Gillmor2ed81732015-04-03 13:09:24 -0400451 * prime INTEGER, -- P
452 * generator INTEGER, -- g
453 * privateValueLength INTEGER OPTIONAL
Paul Bakker40ce79f2013-09-15 17:43:54 +0200454 * }
455 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200456 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
457 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
Paul Bakker40ce79f2013-09-15 17:43:54 +0200458 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200459 ret = MBEDTLS_ERR_DHM_INVALID_FORMAT + ret;
Paul Bakker40ce79f2013-09-15 17:43:54 +0200460 goto exit;
461 }
462
463 end = p + len;
464
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200465 if( ( ret = mbedtls_asn1_get_mpi( &p, end, &dhm->P ) ) != 0 ||
466 ( ret = mbedtls_asn1_get_mpi( &p, end, &dhm->G ) ) != 0 )
Paul Bakker40ce79f2013-09-15 17:43:54 +0200467 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200468 ret = MBEDTLS_ERR_DHM_INVALID_FORMAT + ret;
Paul Bakker40ce79f2013-09-15 17:43:54 +0200469 goto exit;
470 }
471
472 if( p != end )
473 {
Manuel Pégourié-Gonnardde9b3632015-04-17 20:06:31 +0200474 /* This might be the optional privateValueLength.
475 * If so, we can cleanly discard it */
476 mbedtls_mpi rec;
477 mbedtls_mpi_init( &rec );
478 ret = mbedtls_asn1_get_mpi( &p, end, &rec );
479 mbedtls_mpi_free( &rec );
Daniel Kahn Gillmor2ed81732015-04-03 13:09:24 -0400480 if ( ret != 0 )
481 {
Manuel Pégourié-Gonnardde9b3632015-04-17 20:06:31 +0200482 ret = MBEDTLS_ERR_DHM_INVALID_FORMAT + ret;
Daniel Kahn Gillmor2ed81732015-04-03 13:09:24 -0400483 goto exit;
484 }
485 if ( p != end )
486 {
Manuel Pégourié-Gonnardde9b3632015-04-17 20:06:31 +0200487 ret = MBEDTLS_ERR_DHM_INVALID_FORMAT +
488 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH;
Daniel Kahn Gillmor2ed81732015-04-03 13:09:24 -0400489 goto exit;
490 }
Paul Bakker40ce79f2013-09-15 17:43:54 +0200491 }
492
493 ret = 0;
494
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200495 dhm->len = mbedtls_mpi_size( &dhm->P );
Manuel Pégourié-Gonnard3fec2202014-03-29 16:42:38 +0100496
Paul Bakker40ce79f2013-09-15 17:43:54 +0200497exit:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200498#if defined(MBEDTLS_PEM_PARSE_C)
499 mbedtls_pem_free( &pem );
Paul Bakker40ce79f2013-09-15 17:43:54 +0200500#endif
501 if( ret != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200502 mbedtls_dhm_free( dhm );
Paul Bakker40ce79f2013-09-15 17:43:54 +0200503
504 return( ret );
505}
506
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200507#if defined(MBEDTLS_FS_IO)
Paul Bakker40ce79f2013-09-15 17:43:54 +0200508/*
509 * Load all data from a file into a given buffer.
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +0200510 *
511 * The file is expected to contain either PEM or DER encoded data.
512 * A terminating null byte is always appended. It is included in the announced
513 * length only if the data looks like it is PEM encoded.
Paul Bakker40ce79f2013-09-15 17:43:54 +0200514 */
515static int load_file( const char *path, unsigned char **buf, size_t *n )
516{
517 FILE *f;
518 long size;
519
520 if( ( f = fopen( path, "rb" ) ) == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200521 return( MBEDTLS_ERR_DHM_FILE_IO_ERROR );
Paul Bakker40ce79f2013-09-15 17:43:54 +0200522
523 fseek( f, 0, SEEK_END );
524 if( ( size = ftell( f ) ) == -1 )
525 {
526 fclose( f );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200527 return( MBEDTLS_ERR_DHM_FILE_IO_ERROR );
Paul Bakker40ce79f2013-09-15 17:43:54 +0200528 }
529 fseek( f, 0, SEEK_SET );
530
531 *n = (size_t) size;
532
533 if( *n + 1 == 0 ||
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200534 ( *buf = mbedtls_calloc( 1, *n + 1 ) ) == NULL )
Paul Bakker40ce79f2013-09-15 17:43:54 +0200535 {
536 fclose( f );
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +0200537 return( MBEDTLS_ERR_DHM_ALLOC_FAILED );
Paul Bakker40ce79f2013-09-15 17:43:54 +0200538 }
539
540 if( fread( *buf, 1, *n, f ) != *n )
541 {
542 fclose( f );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200543 mbedtls_free( *buf );
544 return( MBEDTLS_ERR_DHM_FILE_IO_ERROR );
Paul Bakker40ce79f2013-09-15 17:43:54 +0200545 }
546
547 fclose( f );
548
549 (*buf)[*n] = '\0';
550
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +0200551 if( strstr( (const char *) *buf, "-----BEGIN " ) != NULL )
552 ++*n;
553
Paul Bakker40ce79f2013-09-15 17:43:54 +0200554 return( 0 );
555}
556
557/*
558 * Load and parse DHM parameters
559 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200560int mbedtls_dhm_parse_dhmfile( mbedtls_dhm_context *dhm, const char *path )
Paul Bakker40ce79f2013-09-15 17:43:54 +0200561{
562 int ret;
563 size_t n;
564 unsigned char *buf;
565
Paul Bakker66d5d072014-06-17 16:39:18 +0200566 if( ( ret = load_file( path, &buf, &n ) ) != 0 )
Paul Bakker40ce79f2013-09-15 17:43:54 +0200567 return( ret );
568
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200569 ret = mbedtls_dhm_parse_dhm( dhm, buf, n );
Paul Bakker40ce79f2013-09-15 17:43:54 +0200570
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +0200571 mbedtls_zeroize( buf, n );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200572 mbedtls_free( buf );
Paul Bakker40ce79f2013-09-15 17:43:54 +0200573
574 return( ret );
575}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200576#endif /* MBEDTLS_FS_IO */
577#endif /* MBEDTLS_ASN1_PARSE_C */
Paul Bakker40ce79f2013-09-15 17:43:54 +0200578
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200579#if defined(MBEDTLS_SELF_TEST)
Paul Bakker5121ce52009-01-03 21:22:43 +0000580
Manuel Pégourié-Gonnard53585ee2015-06-25 08:52:25 +0200581static const char mbedtls_test_dhm_params[] =
582"-----BEGIN DH PARAMETERS-----\r\n"
583"MIGHAoGBAJ419DBEOgmQTzo5qXl5fQcN9TN455wkOL7052HzxxRVMyhYmwQcgJvh\r\n"
584"1sa18fyfR9OiVEMYglOpkqVoGLN7qd5aQNNi5W7/C+VBdHTBJcGZJyyP5B3qcz32\r\n"
585"9mLJKudlVudV0Qxk5qUJaPZ/xupz0NyoVpviuiBOI1gNi8ovSXWzAgEC\r\n"
586"-----END DH PARAMETERS-----\r\n";
587
588static const size_t mbedtls_test_dhm_params_len = sizeof( mbedtls_test_dhm_params );
Paul Bakker40ce79f2013-09-15 17:43:54 +0200589
Paul Bakker5121ce52009-01-03 21:22:43 +0000590/*
591 * Checkup routine
592 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200593int mbedtls_dhm_self_test( int verbose )
Paul Bakker5121ce52009-01-03 21:22:43 +0000594{
Paul Bakker40ce79f2013-09-15 17:43:54 +0200595 int ret;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200596 mbedtls_dhm_context dhm;
Paul Bakker40ce79f2013-09-15 17:43:54 +0200597
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200598 mbedtls_dhm_init( &dhm );
Paul Bakker8f870b02014-06-20 13:32:38 +0200599
Paul Bakker40ce79f2013-09-15 17:43:54 +0200600 if( verbose != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200601 mbedtls_printf( " DHM parameter load: " );
Paul Bakker40ce79f2013-09-15 17:43:54 +0200602
Manuel Pégourié-Gonnard53585ee2015-06-25 08:52:25 +0200603 if( ( ret = mbedtls_dhm_parse_dhm( &dhm,
604 (const unsigned char *) mbedtls_test_dhm_params,
605 mbedtls_test_dhm_params_len ) ) != 0 )
Paul Bakker40ce79f2013-09-15 17:43:54 +0200606 {
607 if( verbose != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200608 mbedtls_printf( "failed\n" );
Paul Bakker40ce79f2013-09-15 17:43:54 +0200609
Manuel Pégourié-Gonnardb196fc22014-07-09 16:53:29 +0200610 ret = 1;
Paul Bakker8f870b02014-06-20 13:32:38 +0200611 goto exit;
Paul Bakker40ce79f2013-09-15 17:43:54 +0200612 }
613
614 if( verbose != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200615 mbedtls_printf( "passed\n\n" );
Paul Bakker40ce79f2013-09-15 17:43:54 +0200616
Paul Bakker8f870b02014-06-20 13:32:38 +0200617exit:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200618 mbedtls_dhm_free( &dhm );
Paul Bakker40ce79f2013-09-15 17:43:54 +0200619
Paul Bakker8f870b02014-06-20 13:32:38 +0200620 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +0000621}
622
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200623#endif /* MBEDTLS_SELF_TEST */
Paul Bakker5121ce52009-01-03 21:22:43 +0000624
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200625#endif /* MBEDTLS_DHM_C */