A local copy of OpenSSL from GitHub
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

501 lines
12 KiB

  1. /*
  2. * Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the OpenSSL license (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #include <stdio.h>
  10. #include "internal/cryptlib.h"
  11. #include <openssl/asn1t.h>
  12. #include <openssl/x509.h>
  13. #include <openssl/evp.h>
  14. #include "dh_locl.h"
  15. #include <openssl/bn.h>
  16. #include <openssl/dsa.h>
  17. #include <openssl/objects.h>
  18. #include "internal/evp_int.h"
  19. /* DH pkey context structure */
  20. typedef struct {
  21. /* Parameter gen parameters */
  22. int prime_len;
  23. int generator;
  24. int use_dsa;
  25. int subprime_len;
  26. /* message digest used for parameter generation */
  27. const EVP_MD *md;
  28. int rfc5114_param;
  29. /* Keygen callback info */
  30. int gentmp[2];
  31. /* KDF (if any) to use for DH */
  32. char kdf_type;
  33. /* OID to use for KDF */
  34. ASN1_OBJECT *kdf_oid;
  35. /* Message digest to use for key derivation */
  36. const EVP_MD *kdf_md;
  37. /* User key material */
  38. unsigned char *kdf_ukm;
  39. size_t kdf_ukmlen;
  40. /* KDF output length */
  41. size_t kdf_outlen;
  42. } DH_PKEY_CTX;
  43. static int pkey_dh_init(EVP_PKEY_CTX *ctx)
  44. {
  45. DH_PKEY_CTX *dctx;
  46. dctx = OPENSSL_zalloc(sizeof(*dctx));
  47. if (dctx == NULL)
  48. return 0;
  49. dctx->prime_len = 1024;
  50. dctx->subprime_len = -1;
  51. dctx->generator = 2;
  52. dctx->kdf_type = EVP_PKEY_DH_KDF_NONE;
  53. ctx->data = dctx;
  54. ctx->keygen_info = dctx->gentmp;
  55. ctx->keygen_info_count = 2;
  56. return 1;
  57. }
  58. static void pkey_dh_cleanup(EVP_PKEY_CTX *ctx)
  59. {
  60. DH_PKEY_CTX *dctx = ctx->data;
  61. if (dctx != NULL) {
  62. OPENSSL_free(dctx->kdf_ukm);
  63. ASN1_OBJECT_free(dctx->kdf_oid);
  64. OPENSSL_free(dctx);
  65. }
  66. }
  67. static int pkey_dh_copy(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src)
  68. {
  69. DH_PKEY_CTX *dctx, *sctx;
  70. if (!pkey_dh_init(dst))
  71. return 0;
  72. sctx = src->data;
  73. dctx = dst->data;
  74. dctx->prime_len = sctx->prime_len;
  75. dctx->subprime_len = sctx->subprime_len;
  76. dctx->generator = sctx->generator;
  77. dctx->use_dsa = sctx->use_dsa;
  78. dctx->md = sctx->md;
  79. dctx->rfc5114_param = sctx->rfc5114_param;
  80. dctx->kdf_type = sctx->kdf_type;
  81. dctx->kdf_oid = OBJ_dup(sctx->kdf_oid);
  82. if (dctx->kdf_oid == NULL)
  83. return 0;
  84. dctx->kdf_md = sctx->kdf_md;
  85. if (sctx->kdf_ukm != NULL) {
  86. dctx->kdf_ukm = OPENSSL_memdup(sctx->kdf_ukm, sctx->kdf_ukmlen);
  87. if (dctx->kdf_ukm == NULL)
  88. return 0;
  89. dctx->kdf_ukmlen = sctx->kdf_ukmlen;
  90. }
  91. dctx->kdf_outlen = sctx->kdf_outlen;
  92. return 1;
  93. }
  94. static int pkey_dh_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2)
  95. {
  96. DH_PKEY_CTX *dctx = ctx->data;
  97. switch (type) {
  98. case EVP_PKEY_CTRL_DH_PARAMGEN_PRIME_LEN:
  99. if (p1 < 256)
  100. return -2;
  101. dctx->prime_len = p1;
  102. return 1;
  103. case EVP_PKEY_CTRL_DH_PARAMGEN_SUBPRIME_LEN:
  104. if (dctx->use_dsa == 0)
  105. return -2;
  106. dctx->subprime_len = p1;
  107. return 1;
  108. case EVP_PKEY_CTRL_DH_PARAMGEN_GENERATOR:
  109. if (dctx->use_dsa)
  110. return -2;
  111. dctx->generator = p1;
  112. return 1;
  113. case EVP_PKEY_CTRL_DH_PARAMGEN_TYPE:
  114. #ifdef OPENSSL_NO_DSA
  115. if (p1 != 0)
  116. return -2;
  117. #else
  118. if (p1 < 0 || p1 > 2)
  119. return -2;
  120. #endif
  121. dctx->use_dsa = p1;
  122. return 1;
  123. case EVP_PKEY_CTRL_DH_RFC5114:
  124. if (p1 < 1 || p1 > 3)
  125. return -2;
  126. dctx->rfc5114_param = p1;
  127. return 1;
  128. case EVP_PKEY_CTRL_PEER_KEY:
  129. /* Default behaviour is OK */
  130. return 1;
  131. case EVP_PKEY_CTRL_DH_KDF_TYPE:
  132. if (p1 == -2)
  133. return dctx->kdf_type;
  134. #ifdef OPENSSL_NO_CMS
  135. if (p1 != EVP_PKEY_DH_KDF_NONE)
  136. #else
  137. if (p1 != EVP_PKEY_DH_KDF_NONE && p1 != EVP_PKEY_DH_KDF_X9_42)
  138. #endif
  139. return -2;
  140. dctx->kdf_type = p1;
  141. return 1;
  142. case EVP_PKEY_CTRL_DH_KDF_MD:
  143. dctx->kdf_md = p2;
  144. return 1;
  145. case EVP_PKEY_CTRL_GET_DH_KDF_MD:
  146. *(const EVP_MD **)p2 = dctx->kdf_md;
  147. return 1;
  148. case EVP_PKEY_CTRL_DH_KDF_OUTLEN:
  149. if (p1 <= 0)
  150. return -2;
  151. dctx->kdf_outlen = (size_t)p1;
  152. return 1;
  153. case EVP_PKEY_CTRL_GET_DH_KDF_OUTLEN:
  154. *(int *)p2 = dctx->kdf_outlen;
  155. return 1;
  156. case EVP_PKEY_CTRL_DH_KDF_UKM:
  157. OPENSSL_free(dctx->kdf_ukm);
  158. dctx->kdf_ukm = p2;
  159. if (p2)
  160. dctx->kdf_ukmlen = p1;
  161. else
  162. dctx->kdf_ukmlen = 0;
  163. return 1;
  164. case EVP_PKEY_CTRL_GET_DH_KDF_UKM:
  165. *(unsigned char **)p2 = dctx->kdf_ukm;
  166. return dctx->kdf_ukmlen;
  167. case EVP_PKEY_CTRL_DH_KDF_OID:
  168. ASN1_OBJECT_free(dctx->kdf_oid);
  169. dctx->kdf_oid = p2;
  170. return 1;
  171. case EVP_PKEY_CTRL_GET_DH_KDF_OID:
  172. *(ASN1_OBJECT **)p2 = dctx->kdf_oid;
  173. return 1;
  174. default:
  175. return -2;
  176. }
  177. }
  178. static int pkey_dh_ctrl_str(EVP_PKEY_CTX *ctx,
  179. const char *type, const char *value)
  180. {
  181. if (strcmp(type, "dh_paramgen_prime_len") == 0) {
  182. int len;
  183. len = atoi(value);
  184. return EVP_PKEY_CTX_set_dh_paramgen_prime_len(ctx, len);
  185. }
  186. if (strcmp(type, "dh_rfc5114") == 0) {
  187. DH_PKEY_CTX *dctx = ctx->data;
  188. int len;
  189. len = atoi(value);
  190. if (len < 0 || len > 3)
  191. return -2;
  192. dctx->rfc5114_param = len;
  193. return 1;
  194. }
  195. if (strcmp(type, "dh_paramgen_generator") == 0) {
  196. int len;
  197. len = atoi(value);
  198. return EVP_PKEY_CTX_set_dh_paramgen_generator(ctx, len);
  199. }
  200. if (strcmp(type, "dh_paramgen_subprime_len") == 0) {
  201. int len;
  202. len = atoi(value);
  203. return EVP_PKEY_CTX_set_dh_paramgen_subprime_len(ctx, len);
  204. }
  205. if (strcmp(type, "dh_paramgen_type") == 0) {
  206. int typ;
  207. typ = atoi(value);
  208. return EVP_PKEY_CTX_set_dh_paramgen_type(ctx, typ);
  209. }
  210. return -2;
  211. }
  212. #ifndef OPENSSL_NO_DSA
  213. extern int dsa_builtin_paramgen(DSA *ret, size_t bits, size_t qbits,
  214. const EVP_MD *evpmd,
  215. const unsigned char *seed_in, size_t seed_len,
  216. unsigned char *seed_out, int *counter_ret,
  217. unsigned long *h_ret, BN_GENCB *cb);
  218. extern int dsa_builtin_paramgen2(DSA *ret, size_t L, size_t N,
  219. const EVP_MD *evpmd,
  220. const unsigned char *seed_in,
  221. size_t seed_len, int idx,
  222. unsigned char *seed_out, int *counter_ret,
  223. unsigned long *h_ret, BN_GENCB *cb);
  224. static DSA *dsa_dh_generate(DH_PKEY_CTX *dctx, BN_GENCB *pcb)
  225. {
  226. DSA *ret;
  227. int rv = 0;
  228. int prime_len = dctx->prime_len;
  229. int subprime_len = dctx->subprime_len;
  230. const EVP_MD *md = dctx->md;
  231. if (dctx->use_dsa > 2)
  232. return NULL;
  233. ret = DSA_new();
  234. if (ret == NULL)
  235. return NULL;
  236. if (subprime_len == -1) {
  237. if (prime_len >= 2048)
  238. subprime_len = 256;
  239. else
  240. subprime_len = 160;
  241. }
  242. if (md == NULL) {
  243. if (prime_len >= 2048)
  244. md = EVP_sha256();
  245. else
  246. md = EVP_sha1();
  247. }
  248. if (dctx->use_dsa == 1)
  249. rv = dsa_builtin_paramgen(ret, prime_len, subprime_len, md,
  250. NULL, 0, NULL, NULL, NULL, pcb);
  251. else if (dctx->use_dsa == 2)
  252. rv = dsa_builtin_paramgen2(ret, prime_len, subprime_len, md,
  253. NULL, 0, -1, NULL, NULL, NULL, pcb);
  254. if (rv <= 0) {
  255. DSA_free(ret);
  256. return NULL;
  257. }
  258. return ret;
  259. }
  260. #endif
  261. static int pkey_dh_paramgen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)
  262. {
  263. DH *dh = NULL;
  264. DH_PKEY_CTX *dctx = ctx->data;
  265. BN_GENCB *pcb;
  266. int ret;
  267. if (dctx->rfc5114_param) {
  268. switch (dctx->rfc5114_param) {
  269. case 1:
  270. dh = DH_get_1024_160();
  271. break;
  272. case 2:
  273. dh = DH_get_2048_224();
  274. break;
  275. case 3:
  276. dh = DH_get_2048_256();
  277. break;
  278. default:
  279. return -2;
  280. }
  281. EVP_PKEY_assign(pkey, EVP_PKEY_DHX, dh);
  282. return 1;
  283. }
  284. if (ctx->pkey_gencb) {
  285. pcb = BN_GENCB_new();
  286. if (pcb == NULL)
  287. return 0;
  288. evp_pkey_set_cb_translate(pcb, ctx);
  289. } else
  290. pcb = NULL;
  291. #ifndef OPENSSL_NO_DSA
  292. if (dctx->use_dsa) {
  293. DSA *dsa_dh;
  294. dsa_dh = dsa_dh_generate(dctx, pcb);
  295. BN_GENCB_free(pcb);
  296. if (dsa_dh == NULL)
  297. return 0;
  298. dh = DSA_dup_DH(dsa_dh);
  299. DSA_free(dsa_dh);
  300. if (!dh)
  301. return 0;
  302. EVP_PKEY_assign(pkey, EVP_PKEY_DHX, dh);
  303. return 1;
  304. }
  305. #endif
  306. dh = DH_new();
  307. if (dh == NULL) {
  308. BN_GENCB_free(pcb);
  309. return 0;
  310. }
  311. ret = DH_generate_parameters_ex(dh,
  312. dctx->prime_len, dctx->generator, pcb);
  313. BN_GENCB_free(pcb);
  314. if (ret)
  315. EVP_PKEY_assign_DH(pkey, dh);
  316. else
  317. DH_free(dh);
  318. return ret;
  319. }
  320. static int pkey_dh_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)
  321. {
  322. DH *dh = NULL;
  323. if (ctx->pkey == NULL) {
  324. DHerr(DH_F_PKEY_DH_KEYGEN, DH_R_NO_PARAMETERS_SET);
  325. return 0;
  326. }
  327. dh = DH_new();
  328. if (dh == NULL)
  329. return 0;
  330. EVP_PKEY_assign(pkey, ctx->pmeth->pkey_id, dh);
  331. /* Note: if error return, pkey is freed by parent routine */
  332. if (!EVP_PKEY_copy_parameters(pkey, ctx->pkey))
  333. return 0;
  334. return DH_generate_key(pkey->pkey.dh);
  335. }
  336. static int pkey_dh_derive(EVP_PKEY_CTX *ctx, unsigned char *key,
  337. size_t *keylen)
  338. {
  339. int ret;
  340. DH *dh;
  341. DH_PKEY_CTX *dctx = ctx->data;
  342. BIGNUM *dhpub;
  343. if (!ctx->pkey || !ctx->peerkey) {
  344. DHerr(DH_F_PKEY_DH_DERIVE, DH_R_KEYS_NOT_SET);
  345. return 0;
  346. }
  347. dh = ctx->pkey->pkey.dh;
  348. dhpub = ctx->peerkey->pkey.dh->pub_key;
  349. if (dctx->kdf_type == EVP_PKEY_DH_KDF_NONE) {
  350. if (key == NULL) {
  351. *keylen = DH_size(dh);
  352. return 1;
  353. }
  354. ret = DH_compute_key(key, dhpub, dh);
  355. if (ret < 0)
  356. return ret;
  357. *keylen = ret;
  358. return 1;
  359. }
  360. #ifndef OPENSSL_NO_CMS
  361. else if (dctx->kdf_type == EVP_PKEY_DH_KDF_X9_42) {
  362. unsigned char *Z = NULL;
  363. size_t Zlen = 0;
  364. if (!dctx->kdf_outlen || !dctx->kdf_oid)
  365. return 0;
  366. if (key == NULL) {
  367. *keylen = dctx->kdf_outlen;
  368. return 1;
  369. }
  370. if (*keylen != dctx->kdf_outlen)
  371. return 0;
  372. ret = 0;
  373. Zlen = DH_size(dh);
  374. Z = OPENSSL_malloc(Zlen);
  375. if (Z == NULL) {
  376. goto err;
  377. }
  378. if (DH_compute_key_padded(Z, dhpub, dh) <= 0)
  379. goto err;
  380. if (!DH_KDF_X9_42(key, *keylen, Z, Zlen, dctx->kdf_oid,
  381. dctx->kdf_ukm, dctx->kdf_ukmlen, dctx->kdf_md))
  382. goto err;
  383. *keylen = dctx->kdf_outlen;
  384. ret = 1;
  385. err:
  386. OPENSSL_clear_free(Z, Zlen);
  387. return ret;
  388. }
  389. #endif
  390. return 0;
  391. }
  392. const EVP_PKEY_METHOD dh_pkey_meth = {
  393. EVP_PKEY_DH,
  394. 0,
  395. pkey_dh_init,
  396. pkey_dh_copy,
  397. pkey_dh_cleanup,
  398. 0,
  399. pkey_dh_paramgen,
  400. 0,
  401. pkey_dh_keygen,
  402. 0,
  403. 0,
  404. 0,
  405. 0,
  406. 0, 0,
  407. 0, 0, 0, 0,
  408. 0, 0,
  409. 0, 0,
  410. 0,
  411. pkey_dh_derive,
  412. pkey_dh_ctrl,
  413. pkey_dh_ctrl_str
  414. };
  415. const EVP_PKEY_METHOD dhx_pkey_meth = {
  416. EVP_PKEY_DHX,
  417. 0,
  418. pkey_dh_init,
  419. pkey_dh_copy,
  420. pkey_dh_cleanup,
  421. 0,
  422. pkey_dh_paramgen,
  423. 0,
  424. pkey_dh_keygen,
  425. 0,
  426. 0,
  427. 0,
  428. 0,
  429. 0, 0,
  430. 0, 0, 0, 0,
  431. 0, 0,
  432. 0, 0,
  433. 0,
  434. pkey_dh_derive,
  435. pkey_dh_ctrl,
  436. pkey_dh_ctrl_str
  437. };