blob: 3697d4ddfcf7d0ea6dcf23b0ddbcd7f9619ce40b [file] [log] [blame]
/*
* Copyright (c) 2016 DeNA Co., Ltd., Kazuho Oku
*
* Permission is hereby granted, free of charge, to any person obtaining a copy
* of this software and associated documentation files (the "Software"), to
* deal in the Software without restriction, including without limitation the
* rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
* sell copies of the Software, and to permit persons to whom the Software is
* furnished to do so, subject to the following conditions:
*
* The above copyright notice and this permission notice shall be included in
* all copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
* FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
* IN THE SOFTWARE.
*/
#include <stdlib.h>
#include "curve25519.h"
#include "picotls.h"
#include "picotls/minicrypto.h"
#define X25519_KEY_SIZE 32
struct st_x25519_key_exchange_t {
ptls_key_exchange_context_t super;
uint8_t priv[X25519_KEY_SIZE];
uint8_t pub[X25519_KEY_SIZE];
};
static void x25519_create_keypair(uint8_t *priv, uint8_t *pub)
{
ptls_minicrypto_random_bytes(priv, X25519_KEY_SIZE);
cf_curve25519_mul_base(pub, priv);
}
static int x25519_derive_secret(ptls_iovec_t *secret, const uint8_t *clientpriv, const uint8_t *clientpub,
const uint8_t *serverpriv, const uint8_t *serverpub)
{
if ((secret->base = malloc(X25519_KEY_SIZE)) == NULL)
return PTLS_ERROR_NO_MEMORY;
cf_curve25519_mul(secret->base, clientpriv != NULL ? clientpriv : serverpriv, clientpriv != NULL ? serverpub : clientpub);
static const uint8_t zeros[X25519_KEY_SIZE] = {0};
if (ptls_mem_equal(secret->base, zeros, sizeof(zeros))) {
free(secret->base);
return PTLS_ERROR_INCOMPATIBLE_KEY;
}
secret->len = X25519_KEY_SIZE;
return 0;
}
static int x25519_on_exchange(ptls_key_exchange_context_t **_ctx, int release, ptls_iovec_t *secret, ptls_iovec_t peerkey)
{
struct st_x25519_key_exchange_t *ctx = (struct st_x25519_key_exchange_t *)*_ctx;
int ret;
if (secret == NULL) {
ret = 0;
goto Exit;
}
if (peerkey.len != X25519_KEY_SIZE) {
ret = PTLS_ALERT_DECRYPT_ERROR;
goto Exit;
}
ret = x25519_derive_secret(secret, ctx->priv, ctx->pub, NULL, peerkey.base);
Exit:
if (release) {
ptls_clear_memory(ctx->priv, sizeof(ctx->priv));
free(ctx);
*_ctx = NULL;
}
return ret;
}
static int x25519_create_key_exchange(ptls_key_exchange_algorithm_t *algo, ptls_key_exchange_context_t **_ctx)
{
struct st_x25519_key_exchange_t *ctx;
if ((ctx = (struct st_x25519_key_exchange_t *)malloc(sizeof(*ctx))) == NULL)
return PTLS_ERROR_NO_MEMORY;
ctx->super = (ptls_key_exchange_context_t){algo, ptls_iovec_init(ctx->pub, sizeof(ctx->pub)), x25519_on_exchange};
x25519_create_keypair(ctx->priv, ctx->pub);
*_ctx = &ctx->super;
return 0;
}
static int x25519_key_exchange(ptls_key_exchange_algorithm_t *algo, ptls_iovec_t *pubkey, ptls_iovec_t *secret,
ptls_iovec_t peerkey)
{
uint8_t priv[X25519_KEY_SIZE], *pub = NULL;
int ret;
if (peerkey.len != X25519_KEY_SIZE) {
ret = PTLS_ALERT_DECRYPT_ERROR;
goto Exit;
}
if ((pub = malloc(X25519_KEY_SIZE)) == NULL) {
ret = PTLS_ERROR_NO_MEMORY;
goto Exit;
}
x25519_create_keypair(priv, pub);
if ((ret = x25519_derive_secret(secret, NULL, peerkey.base, priv, pub)) != 0)
goto Exit;
*pubkey = ptls_iovec_init(pub, X25519_KEY_SIZE);
ret = 0;
Exit:
ptls_clear_memory(priv, sizeof(priv));
if (pub != NULL && ret != 0) {
ptls_clear_memory(pub, X25519_KEY_SIZE);
free(pub);
}
return ret;
}
ptls_key_exchange_algorithm_t ptls_minicrypto_x25519 = {
.id = PTLS_GROUP_X25519, .name = PTLS_GROUP_NAME_X25519, .create = x25519_create_key_exchange, .exchange = x25519_key_exchange};