A local copy of OpenSSL from GitHub
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

596 lines
16 KiB

This is a first-cut at improving the callback mechanisms used in key-generation and prime-checking functions. Rather than explicitly passing callback functions and caller-defined context data for the callbacks, a new structure BN_GENCB is defined that encapsulates this; a pointer to the structure is passed to all such functions instead. This wrapper structure allows the encapsulation of "old" and "new" style callbacks - "new" callbacks return a boolean result on the understanding that returning FALSE should terminate keygen/primality processing. The BN_GENCB abstraction will allow future callback modifications without needing to break binary compatibility nor change the API function prototypes. The new API functions have been given names ending in "_ex" and the old functions are implemented as wrappers to the new ones. The OPENSSL_NO_DEPRECATED symbol has been introduced so that, if defined, declaration of the older functions will be skipped. NB: Some openssl-internal code will stick with the older callbacks for now, so appropriate "#undef" logic will be put in place - this is in case the user is *building* openssl (rather than *including* its headers) with this symbol defined. There is another change in the new _ex functions; the key-generation functions do not return key structures but operate on structures passed by the caller, the return value is a boolean. This will allow for a smoother transition to having key-generation as "virtual function" in the various ***_METHOD tables.
20 years ago
  1. /*
  2. * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the OpenSSL license (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. /*
  10. * Parameter generation follows the updated Appendix 2.2 for FIPS PUB 186,
  11. * also Appendix 2.2 of FIPS PUB 186-1 (i.e. use SHA as defined in FIPS PUB
  12. * 180-1)
  13. */
  14. #define xxxHASH EVP_sha1()
  15. #include <openssl/opensslconf.h>
  16. #include <stdio.h>
  17. #include "internal/cryptlib.h"
  18. #include <openssl/evp.h>
  19. #include <openssl/bn.h>
  20. #include <openssl/rand.h>
  21. #include <openssl/sha.h>
  22. #include "dsa_locl.h"
  23. int DSA_generate_parameters_ex(DSA *ret, int bits,
  24. const unsigned char *seed_in, int seed_len,
  25. int *counter_ret, unsigned long *h_ret,
  26. BN_GENCB *cb)
  27. {
  28. if (ret->meth->dsa_paramgen)
  29. return ret->meth->dsa_paramgen(ret, bits, seed_in, seed_len,
  30. counter_ret, h_ret, cb);
  31. else {
  32. const EVP_MD *evpmd = bits >= 2048 ? EVP_sha256() : EVP_sha1();
  33. size_t qbits = EVP_MD_size(evpmd) * 8;
  34. return dsa_builtin_paramgen(ret, bits, qbits, evpmd,
  35. seed_in, seed_len, NULL, counter_ret,
  36. h_ret, cb);
  37. }
  38. }
  39. int dsa_builtin_paramgen(DSA *ret, size_t bits, size_t qbits,
  40. const EVP_MD *evpmd, const unsigned char *seed_in,
  41. size_t seed_len, unsigned char *seed_out,
  42. int *counter_ret, unsigned long *h_ret, BN_GENCB *cb)
  43. {
  44. int ok = 0;
  45. unsigned char seed[SHA256_DIGEST_LENGTH];
  46. unsigned char md[SHA256_DIGEST_LENGTH];
  47. unsigned char buf[SHA256_DIGEST_LENGTH], buf2[SHA256_DIGEST_LENGTH];
  48. BIGNUM *r0, *W, *X, *c, *test;
  49. BIGNUM *g = NULL, *q = NULL, *p = NULL;
  50. BN_MONT_CTX *mont = NULL;
  51. int i, k, n = 0, m = 0, qsize = qbits >> 3;
  52. int counter = 0;
  53. int r = 0;
  54. BN_CTX *ctx = NULL;
  55. unsigned int h = 2;
  56. if (qsize != SHA_DIGEST_LENGTH && qsize != SHA224_DIGEST_LENGTH &&
  57. qsize != SHA256_DIGEST_LENGTH)
  58. /* invalid q size */
  59. return 0;
  60. if (evpmd == NULL)
  61. /* use SHA1 as default */
  62. evpmd = EVP_sha1();
  63. if (bits < 512)
  64. bits = 512;
  65. bits = (bits + 63) / 64 * 64;
  66. if (seed_in != NULL) {
  67. if (seed_len < (size_t)qsize)
  68. return 0;
  69. if (seed_len > (size_t)qsize) {
  70. /* Only consume as much seed as is expected. */
  71. seed_len = qsize;
  72. }
  73. memcpy(seed, seed_in, seed_len);
  74. }
  75. if ((mont = BN_MONT_CTX_new()) == NULL)
  76. goto err;
  77. if ((ctx = BN_CTX_new()) == NULL)
  78. goto err;
  79. BN_CTX_start(ctx);
  80. r0 = BN_CTX_get(ctx);
  81. g = BN_CTX_get(ctx);
  82. W = BN_CTX_get(ctx);
  83. q = BN_CTX_get(ctx);
  84. X = BN_CTX_get(ctx);
  85. c = BN_CTX_get(ctx);
  86. p = BN_CTX_get(ctx);
  87. test = BN_CTX_get(ctx);
  88. if (!BN_lshift(test, BN_value_one(), bits - 1))
  89. goto err;
  90. for (;;) {
  91. for (;;) { /* find q */
  92. int use_random_seed = (seed_in == NULL);
  93. /* step 1 */
  94. if (!BN_GENCB_call(cb, 0, m++))
  95. goto err;
  96. if (use_random_seed) {
  97. if (RAND_bytes(seed, qsize) <= 0)
  98. goto err;
  99. } else {
  100. /* If we come back through, use random seed next time. */
  101. seed_in = NULL;
  102. }
  103. memcpy(buf, seed, qsize);
  104. memcpy(buf2, seed, qsize);
  105. /* precompute "SEED + 1" for step 7: */
  106. for (i = qsize - 1; i >= 0; i--) {
  107. buf[i]++;
  108. if (buf[i] != 0)
  109. break;
  110. }
  111. /* step 2 */
  112. if (!EVP_Digest(seed, qsize, md, NULL, evpmd, NULL))
  113. goto err;
  114. if (!EVP_Digest(buf, qsize, buf2, NULL, evpmd, NULL))
  115. goto err;
  116. for (i = 0; i < qsize; i++)
  117. md[i] ^= buf2[i];
  118. /* step 3 */
  119. md[0] |= 0x80;
  120. md[qsize - 1] |= 0x01;
  121. if (!BN_bin2bn(md, qsize, q))
  122. goto err;
  123. /* step 4 */
  124. r = BN_is_prime_fasttest_ex(q, DSS_prime_checks, ctx,
  125. use_random_seed, cb);
  126. if (r > 0)
  127. break;
  128. if (r != 0)
  129. goto err;
  130. /* do a callback call */
  131. /* step 5 */
  132. }
  133. if (!BN_GENCB_call(cb, 2, 0))
  134. goto err;
  135. if (!BN_GENCB_call(cb, 3, 0))
  136. goto err;
  137. /* step 6 */
  138. counter = 0;
  139. /* "offset = 2" */
  140. n = (bits - 1) / 160;
  141. for (;;) {
  142. if ((counter != 0) && !BN_GENCB_call(cb, 0, counter))
  143. goto err;
  144. /* step 7 */
  145. BN_zero(W);
  146. /* now 'buf' contains "SEED + offset - 1" */
  147. for (k = 0; k <= n; k++) {
  148. /*
  149. * obtain "SEED + offset + k" by incrementing:
  150. */
  151. for (i = qsize - 1; i >= 0; i--) {
  152. buf[i]++;
  153. if (buf[i] != 0)
  154. break;
  155. }
  156. if (!EVP_Digest(buf, qsize, md, NULL, evpmd, NULL))
  157. goto err;
  158. /* step 8 */
  159. if (!BN_bin2bn(md, qsize, r0))
  160. goto err;
  161. if (!BN_lshift(r0, r0, (qsize << 3) * k))
  162. goto err;
  163. if (!BN_add(W, W, r0))
  164. goto err;
  165. }
  166. /* more of step 8 */
  167. if (!BN_mask_bits(W, bits - 1))
  168. goto err;
  169. if (!BN_copy(X, W))
  170. goto err;
  171. if (!BN_add(X, X, test))
  172. goto err;
  173. /* step 9 */
  174. if (!BN_lshift1(r0, q))
  175. goto err;
  176. if (!BN_mod(c, X, r0, ctx))
  177. goto err;
  178. if (!BN_sub(r0, c, BN_value_one()))
  179. goto err;
  180. if (!BN_sub(p, X, r0))
  181. goto err;
  182. /* step 10 */
  183. if (BN_cmp(p, test) >= 0) {
  184. /* step 11 */
  185. r = BN_is_prime_fasttest_ex(p, DSS_prime_checks, ctx, 1, cb);
  186. if (r > 0)
  187. goto end; /* found it */
  188. if (r != 0)
  189. goto err;
  190. }
  191. /* step 13 */
  192. counter++;
  193. /* "offset = offset + n + 1" */
  194. /* step 14 */
  195. if (counter >= 4096)
  196. break;
  197. }
  198. }
  199. end:
  200. if (!BN_GENCB_call(cb, 2, 1))
  201. goto err;
  202. /* We now need to generate g */
  203. /* Set r0=(p-1)/q */
  204. if (!BN_sub(test, p, BN_value_one()))
  205. goto err;
  206. if (!BN_div(r0, NULL, test, q, ctx))
  207. goto err;
  208. if (!BN_set_word(test, h))
  209. goto err;
  210. if (!BN_MONT_CTX_set(mont, p, ctx))
  211. goto err;
  212. for (;;) {
  213. /* g=test^r0%p */
  214. if (!BN_mod_exp_mont(g, test, r0, p, ctx, mont))
  215. goto err;
  216. if (!BN_is_one(g))
  217. break;
  218. if (!BN_add(test, test, BN_value_one()))
  219. goto err;
  220. h++;
  221. }
  222. if (!BN_GENCB_call(cb, 3, 1))
  223. goto err;
  224. ok = 1;
  225. err:
  226. if (ok) {
  227. BN_free(ret->p);
  228. BN_free(ret->q);
  229. BN_free(ret->g);
  230. ret->p = BN_dup(p);
  231. ret->q = BN_dup(q);
  232. ret->g = BN_dup(g);
  233. if (ret->p == NULL || ret->q == NULL || ret->g == NULL) {
  234. ok = 0;
  235. goto err;
  236. }
  237. if (counter_ret != NULL)
  238. *counter_ret = counter;
  239. if (h_ret != NULL)
  240. *h_ret = h;
  241. if (seed_out)
  242. memcpy(seed_out, seed, qsize);
  243. }
  244. if (ctx)
  245. BN_CTX_end(ctx);
  246. BN_CTX_free(ctx);
  247. BN_MONT_CTX_free(mont);
  248. return ok;
  249. }
  250. /*
  251. * This is a parameter generation algorithm for the DSA2 algorithm as
  252. * described in FIPS 186-3.
  253. */
  254. int dsa_builtin_paramgen2(DSA *ret, size_t L, size_t N,
  255. const EVP_MD *evpmd, const unsigned char *seed_in,
  256. size_t seed_len, int idx, unsigned char *seed_out,
  257. int *counter_ret, unsigned long *h_ret,
  258. BN_GENCB *cb)
  259. {
  260. int ok = -1;
  261. unsigned char *seed = NULL, *seed_tmp = NULL;
  262. unsigned char md[EVP_MAX_MD_SIZE];
  263. int mdsize;
  264. BIGNUM *r0, *W, *X, *c, *test;
  265. BIGNUM *g = NULL, *q = NULL, *p = NULL;
  266. BN_MONT_CTX *mont = NULL;
  267. int i, k, n = 0, m = 0, qsize = N >> 3;
  268. int counter = 0;
  269. int r = 0;
  270. BN_CTX *ctx = NULL;
  271. EVP_MD_CTX *mctx = EVP_MD_CTX_new();
  272. unsigned int h = 2;
  273. if (mctx == NULL)
  274. goto err;
  275. if (evpmd == NULL) {
  276. if (N == 160)
  277. evpmd = EVP_sha1();
  278. else if (N == 224)
  279. evpmd = EVP_sha224();
  280. else
  281. evpmd = EVP_sha256();
  282. }
  283. mdsize = EVP_MD_size(evpmd);
  284. /* If unverifiable g generation only don't need seed */
  285. if (!ret->p || !ret->q || idx >= 0) {
  286. if (seed_len == 0)
  287. seed_len = mdsize;
  288. seed = OPENSSL_malloc(seed_len);
  289. if (seed_out)
  290. seed_tmp = seed_out;
  291. else
  292. seed_tmp = OPENSSL_malloc(seed_len);
  293. if (seed == NULL || seed_tmp == NULL)
  294. goto err;
  295. if (seed_in)
  296. memcpy(seed, seed_in, seed_len);
  297. }
  298. if ((ctx = BN_CTX_new()) == NULL)
  299. goto err;
  300. if ((mont = BN_MONT_CTX_new()) == NULL)
  301. goto err;
  302. BN_CTX_start(ctx);
  303. r0 = BN_CTX_get(ctx);
  304. g = BN_CTX_get(ctx);
  305. W = BN_CTX_get(ctx);
  306. X = BN_CTX_get(ctx);
  307. c = BN_CTX_get(ctx);
  308. test = BN_CTX_get(ctx);
  309. if (test == NULL)
  310. goto err;
  311. /* if p, q already supplied generate g only */
  312. if (ret->p && ret->q) {
  313. p = ret->p;
  314. q = ret->q;
  315. if (idx >= 0)
  316. memcpy(seed_tmp, seed, seed_len);
  317. goto g_only;
  318. } else {
  319. p = BN_CTX_get(ctx);
  320. q = BN_CTX_get(ctx);
  321. }
  322. if (!BN_lshift(test, BN_value_one(), L - 1))
  323. goto err;
  324. for (;;) {
  325. for (;;) { /* find q */
  326. unsigned char *pmd;
  327. /* step 1 */
  328. if (!BN_GENCB_call(cb, 0, m++))
  329. goto err;
  330. if (!seed_in) {
  331. if (RAND_bytes(seed, seed_len) <= 0)
  332. goto err;
  333. }
  334. /* step 2 */
  335. if (!EVP_Digest(seed, seed_len, md, NULL, evpmd, NULL))
  336. goto err;
  337. /* Take least significant bits of md */
  338. if (mdsize > qsize)
  339. pmd = md + mdsize - qsize;
  340. else
  341. pmd = md;
  342. if (mdsize < qsize)
  343. memset(md + mdsize, 0, qsize - mdsize);
  344. /* step 3 */
  345. pmd[0] |= 0x80;
  346. pmd[qsize - 1] |= 0x01;
  347. if (!BN_bin2bn(pmd, qsize, q))
  348. goto err;
  349. /* step 4 */
  350. r = BN_is_prime_fasttest_ex(q, DSS_prime_checks, ctx,
  351. seed_in ? 1 : 0, cb);
  352. if (r > 0)
  353. break;
  354. if (r != 0)
  355. goto err;
  356. /* Provided seed didn't produce a prime: error */
  357. if (seed_in) {
  358. ok = 0;
  359. DSAerr(DSA_F_DSA_BUILTIN_PARAMGEN2, DSA_R_Q_NOT_PRIME);
  360. goto err;
  361. }
  362. /* do a callback call */
  363. /* step 5 */
  364. }
  365. /* Copy seed to seed_out before we mess with it */
  366. if (seed_out)
  367. memcpy(seed_out, seed, seed_len);
  368. if (!BN_GENCB_call(cb, 2, 0))
  369. goto err;
  370. if (!BN_GENCB_call(cb, 3, 0))
  371. goto err;
  372. /* step 6 */
  373. counter = 0;
  374. /* "offset = 1" */
  375. n = (L - 1) / (mdsize << 3);
  376. for (;;) {
  377. if ((counter != 0) && !BN_GENCB_call(cb, 0, counter))
  378. goto err;
  379. /* step 7 */
  380. BN_zero(W);
  381. /* now 'buf' contains "SEED + offset - 1" */
  382. for (k = 0; k <= n; k++) {
  383. /*
  384. * obtain "SEED + offset + k" by incrementing:
  385. */
  386. for (i = seed_len - 1; i >= 0; i--) {
  387. seed[i]++;
  388. if (seed[i] != 0)
  389. break;
  390. }
  391. if (!EVP_Digest(seed, seed_len, md, NULL, evpmd, NULL))
  392. goto err;
  393. /* step 8 */
  394. if (!BN_bin2bn(md, mdsize, r0))
  395. goto err;
  396. if (!BN_lshift(r0, r0, (mdsize << 3) * k))
  397. goto err;
  398. if (!BN_add(W, W, r0))
  399. goto err;
  400. }
  401. /* more of step 8 */
  402. if (!BN_mask_bits(W, L - 1))
  403. goto err;
  404. if (!BN_copy(X, W))
  405. goto err;
  406. if (!BN_add(X, X, test))
  407. goto err;
  408. /* step 9 */
  409. if (!BN_lshift1(r0, q))
  410. goto err;
  411. if (!BN_mod(c, X, r0, ctx))
  412. goto err;
  413. if (!BN_sub(r0, c, BN_value_one()))
  414. goto err;
  415. if (!BN_sub(p, X, r0))
  416. goto err;
  417. /* step 10 */
  418. if (BN_cmp(p, test) >= 0) {
  419. /* step 11 */
  420. r = BN_is_prime_fasttest_ex(p, DSS_prime_checks, ctx, 1, cb);
  421. if (r > 0)
  422. goto end; /* found it */
  423. if (r != 0)
  424. goto err;
  425. }
  426. /* step 13 */
  427. counter++;
  428. /* "offset = offset + n + 1" */
  429. /* step 14 */
  430. if (counter >= (int)(4 * L))
  431. break;
  432. }
  433. if (seed_in) {
  434. ok = 0;
  435. DSAerr(DSA_F_DSA_BUILTIN_PARAMGEN2, DSA_R_INVALID_PARAMETERS);
  436. goto err;
  437. }
  438. }
  439. end:
  440. if (!BN_GENCB_call(cb, 2, 1))
  441. goto err;
  442. g_only:
  443. /* We now need to generate g */
  444. /* Set r0=(p-1)/q */
  445. if (!BN_sub(test, p, BN_value_one()))
  446. goto err;
  447. if (!BN_div(r0, NULL, test, q, ctx))
  448. goto err;
  449. if (idx < 0) {
  450. if (!BN_set_word(test, h))
  451. goto err;
  452. } else
  453. h = 1;
  454. if (!BN_MONT_CTX_set(mont, p, ctx))
  455. goto err;
  456. for (;;) {
  457. static const unsigned char ggen[4] = { 0x67, 0x67, 0x65, 0x6e };
  458. if (idx >= 0) {
  459. md[0] = idx & 0xff;
  460. md[1] = (h >> 8) & 0xff;
  461. md[2] = h & 0xff;
  462. if (!EVP_DigestInit_ex(mctx, evpmd, NULL))
  463. goto err;
  464. if (!EVP_DigestUpdate(mctx, seed_tmp, seed_len))
  465. goto err;
  466. if (!EVP_DigestUpdate(mctx, ggen, sizeof(ggen)))
  467. goto err;
  468. if (!EVP_DigestUpdate(mctx, md, 3))
  469. goto err;
  470. if (!EVP_DigestFinal_ex(mctx, md, NULL))
  471. goto err;
  472. if (!BN_bin2bn(md, mdsize, test))
  473. goto err;
  474. }
  475. /* g=test^r0%p */
  476. if (!BN_mod_exp_mont(g, test, r0, p, ctx, mont))
  477. goto err;
  478. if (!BN_is_one(g))
  479. break;
  480. if (idx < 0 && !BN_add(test, test, BN_value_one()))
  481. goto err;
  482. h++;
  483. if (idx >= 0 && h > 0xffff)
  484. goto err;
  485. }
  486. if (!BN_GENCB_call(cb, 3, 1))
  487. goto err;
  488. ok = 1;
  489. err:
  490. if (ok == 1) {
  491. if (p != ret->p) {
  492. BN_free(ret->p);
  493. ret->p = BN_dup(p);
  494. }
  495. if (q != ret->q) {
  496. BN_free(ret->q);
  497. ret->q = BN_dup(q);
  498. }
  499. BN_free(ret->g);
  500. ret->g = BN_dup(g);
  501. if (ret->p == NULL || ret->q == NULL || ret->g == NULL) {
  502. ok = -1;
  503. goto err;
  504. }
  505. if (counter_ret != NULL)
  506. *counter_ret = counter;
  507. if (h_ret != NULL)
  508. *h_ret = h;
  509. }
  510. OPENSSL_free(seed);
  511. if (seed_out != seed_tmp)
  512. OPENSSL_free(seed_tmp);
  513. if (ctx)
  514. BN_CTX_end(ctx);
  515. BN_CTX_free(ctx);
  516. BN_MONT_CTX_free(mont);
  517. EVP_MD_CTX_free(mctx);
  518. return ok;
  519. }