Add FFC param/key validation
Embed libctx in dsa and dh objects and cleanup internal methods to not pass libctx (This makes it consistent with the rsa changes) Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10910)master
Shane Lontis
3 years ago
parent
98ad3fe82b
commit
8083fd3a18
@ -0,0 +1,85 @@
|
||||
/*
|
||||
* Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include "internal/cryptlib.h"
|
||||
#include <openssl/bn.h>
|
||||
#include "dsa_local.h"
|
||||
#include "crypto/dsa.h"
|
||||
|
||||
int dsa_check_params(const DSA *dsa, int *ret)
|
||||
{
|
||||
int nid;
|
||||
/*
|
||||
* (2b) FFC domain params conform to FIPS-186-4 explicit domain param
|
||||
* validity tests.
|
||||
*/
|
||||
return ffc_params_FIPS186_4_validate(&dsa->params, FFC_PARAM_TYPE_DSA, NULL,
|
||||
FFC_PARAMS_VALIDATE_ALL, ret, NULL);
|
||||
}
|
||||
|
||||
/*
|
||||
* See SP800-56Ar3 Section 5.6.2.3.1 : FFC Full public key validation.
|
||||
*/
|
||||
int dsa_check_pub_key(const DSA *dsa, const BIGNUM *pub_key, int *ret)
|
||||
{
|
||||
return ffc_validate_public_key(&dsa->params, pub_key, ret);
|
||||
}
|
||||
|
||||
/*
|
||||
* See SP800-56Ar3 Section 5.6.2.3.1 : FFC Partial public key validation.
|
||||
* To only be used with ephemeral FFC public keys generated using the approved
|
||||
* safe-prime groups.
|
||||
*/
|
||||
int dsa_check_pub_key_partial(const DSA *dsa, const BIGNUM *pub_key, int *ret)
|
||||
{
|
||||
return ffc_validate_public_key_partial(&dsa->params, pub_key, ret);
|
||||
}
|
||||
|
||||
int dsa_check_priv_key(const DSA *dsa, const BIGNUM *priv_key, int *ret)
|
||||
{
|
||||
*ret = 0;
|
||||
|
||||
return (dsa->params.q != NULL
|
||||
&& ffc_validate_private_key(dsa->params.q, priv_key, ret));
|
||||
}
|
||||
|
||||
/*
|
||||
* FFC pairwise check from SP800-56A R3.
|
||||
* Section 5.6.2.1.4 Owner Assurance of Pair-wise Consistency
|
||||
*/
|
||||
int dsa_check_pairwise(const DSA *dsa)
|
||||
{
|
||||
int ret = 0;
|
||||
BN_CTX *ctx = NULL;
|
||||
BIGNUM *pub_key = NULL;
|
||||
|
||||
if (dsa->params.p == NULL
|
||||
|| dsa->params.g == NULL
|
||||
|| dsa->priv_key == NULL
|
||||
|| dsa->pub_key == NULL)
|
||||
return 0;
|
||||
|
||||
ctx = BN_CTX_new_ex(dsa->libctx);
|
||||
if (ctx == NULL)
|
||||
goto err;
|
||||
pub_key = BN_new();
|
||||
if (pub_key == NULL)
|
||||
goto err;
|
||||
|
||||
/* recalculate the public key = (g ^ priv) mod p */
|
||||
if (!dsa_generate_public_key(ctx, dsa, dsa->priv_key, pub_key))
|
||||
goto err;
|
||||
/* check it matches the existing pubic_key */
|
||||
ret = BN_cmp(pub_key, dsa->pub_key) == 0;
|
||||
err:
|
||||
BN_free(pub_key);
|
||||
BN_CTX_free(ctx);
|
||||
return ret;
|
||||
}
|
||||
@ -1,6 +1,7 @@
|
||||
LIBS=../../libcrypto
|
||||
|
||||
$COMMON=ffc_params.c ffc_params_generate.c ffc_key_generate.c
|
||||
$COMMON=ffc_params.c ffc_params_generate.c ffc_key_generate.c\
|
||||
ffc_params_validate.c ffc_key_validate.c
|
||||
|
||||
SOURCE[../../libcrypto]=$COMMON
|
||||
SOURCE[../../providers/libfips.a]=$COMMON
|
||||
|
||||
@ -0,0 +1,120 @@
|
||||
/*
|
||||
* Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
#include "internal/ffc.h"
|
||||
|
||||
/*
|
||||
* See SP800-56Ar3 Section 5.6.2.3.1 : FFC Partial public key validation.
|
||||
* To only be used with ephemeral FFC public keys generated using the approved
|
||||
* safe-prime groups. (Checks that the public key is in the range [2, p - 1]
|
||||
*
|
||||
* ret contains 0 on success, or error flags (see FFC_ERROR_PUBKEY_TOO_SMALL)
|
||||
*/
|
||||
int ffc_validate_public_key_partial(const FFC_PARAMS *params,
|
||||
const BIGNUM *pub_key, int *ret)
|
||||
{
|
||||
int ok = 0;
|
||||
BIGNUM *tmp = NULL;
|
||||
BN_CTX *ctx = NULL;
|
||||
|
||||
*ret = 0;
|
||||
ctx = BN_CTX_new_ex(NULL);
|
||||
if (ctx == NULL)
|
||||
goto err;
|
||||
|
||||
BN_CTX_start(ctx);
|
||||
tmp = BN_CTX_get(ctx);
|
||||
/* Step(1): Verify pub_key >= 2 */
|
||||
if (tmp == NULL
|
||||
|| !BN_set_word(tmp, 1))
|
||||
goto err;
|
||||
if (BN_cmp(pub_key, tmp) <= 0) {
|
||||
*ret |= FFC_ERROR_PUBKEY_TOO_SMALL;
|
||||
goto err;
|
||||
}
|
||||
/* Step(1): Verify pub_key <= p-2 */
|
||||
if (BN_copy(tmp, params->p) == NULL
|
||||
|| !BN_sub_word(tmp, 1))
|
||||
goto err;
|
||||
if (BN_cmp(pub_key, tmp) >= 0) {
|
||||
*ret |= FFC_ERROR_PUBKEY_TOO_LARGE;
|
||||
goto err;
|
||||
}
|
||||
ok = 1;
|
||||
err:
|
||||
if (ctx != NULL) {
|
||||
BN_CTX_end(ctx);
|
||||
BN_CTX_free(ctx);
|
||||
}
|
||||
return ok;
|
||||
}
|
||||
|
||||
/*
|
||||
* See SP800-56Ar3 Section 5.6.2.3.1 : FFC Full public key validation.
|
||||
*/
|
||||
int ffc_validate_public_key(const FFC_PARAMS *params, const BIGNUM *pub_key,
|
||||
int *ret)
|
||||
{
|
||||
int ok = 0;
|
||||
BIGNUM *tmp = NULL;
|
||||
BN_CTX *ctx = NULL;
|
||||
|
||||
if (!ffc_validate_public_key_partial(params, pub_key, ret))
|
||||
return 0;
|
||||
|
||||
if (params->q != NULL) {
|
||||
ctx = BN_CTX_new_ex(NULL);
|
||||
if (ctx == NULL)
|
||||
goto err;
|
||||
BN_CTX_start(ctx);
|
||||
tmp = BN_CTX_get(ctx);
|
||||
|
||||
/* Check pub_key^q == 1 mod p */
|
||||
if (tmp == NULL
|
||||
|| !BN_mod_exp(tmp, pub_key, params->q, params->p, ctx))
|
||||
goto err;
|
||||
if (!BN_is_one(tmp)) {
|
||||
*ret |= FFC_ERROR_PUBKEY_INVALID;
|
||||
goto err;
|
||||
}
|
||||
}
|
||||
|
||||
ok = 1;
|
||||
err:
|
||||
if (ctx != NULL) {
|
||||
BN_CTX_end(ctx);
|
||||
BN_CTX_free(ctx);
|
||||
}
|
||||
return ok;
|
||||
}
|
||||
|
||||
/*
|
||||
* See SP800-56Ar3 Section 5.6.2.1.2: Owner assurance of Private key validity.
|
||||
* Verifies priv_key is in the range [1..upper-1]. The passed in value of upper
|
||||
* is normally params->q but can be 2^N for approved safe prime groups.
|
||||
* Note: This assumes that the domain parameters are valid.
|
||||
*/
|
||||
int ffc_validate_private_key(const BIGNUM *upper, const BIGNUM *priv, int *ret)
|
||||
{
|
||||
int ok = 0;
|
||||
|
||||
*ret = 0;
|
||||
|
||||
if (BN_cmp(priv, BN_value_one()) < 0) {
|
||||
*ret |= FFC_ERROR_PRIVKEY_TOO_SMALL;
|
||||
goto err;
|
||||
}
|
||||
if (BN_cmp(priv, upper) >= 0) {
|
||||
*ret |= FFC_ERROR_PRIVKEY_TOO_LARGE;
|
||||
goto err;
|
||||
}
|
||||
ok = 1;
|
||||
err:
|
||||
return ok;
|
||||
}
|
||||
@ -0,0 +1,80 @@
|
||||
/*
|
||||
* Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
/*
|
||||
* Finite Field cryptography (FFC) is used for DSA and DH.
|
||||
* This file contains methods for validation of FFC parameters.
|
||||
* It calls the same functions as the generation as the code is very similar.
|
||||
*/
|
||||
|
||||
#include "internal/ffc.h"
|
||||
|
||||
/* FIPS186-4 A.2.2 Unverifiable partial validation of Generator g */
|
||||
int ffc_params_validate_unverifiable_g(BN_CTX *ctx, BN_MONT_CTX *mont,
|
||||
const BIGNUM *p, const BIGNUM *q,
|
||||
const BIGNUM *g, BIGNUM *tmp, int *ret)
|
||||
{
|
||||
/*
|
||||
* A.2.2 Step (1) AND
|
||||
* A.2.4 Step (2)
|
||||
* Verify that 2 <= g <= (p - 1)
|
||||
*/
|
||||
if (BN_cmp(g, BN_value_one()) <= 0 || BN_cmp(g, p) >= 0) {
|
||||
*ret |= FFC_ERROR_NOT_SUITABLE_GENERATOR;
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*
|
||||
* A.2.2 Step (2) AND
|
||||
* A.2.4 Step (3)
|
||||
* Check g^q mod p = 1
|
||||
*/
|
||||
if (!BN_mod_exp_mont(tmp, g, q, p, ctx, mont))
|
||||
return 0;
|
||||
if (BN_cmp(tmp, BN_value_one()) != 0) {
|
||||
*ret |= FFC_ERROR_NOT_SUITABLE_GENERATOR;
|
||||
return 0;
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
int ffc_params_FIPS186_4_validate(const FFC_PARAMS *params, int type,
|
||||
const EVP_MD *evpmd, int validate_flags,
|
||||
int *res, BN_GENCB *cb)
|
||||
{
|
||||
size_t L, N;
|
||||
|
||||
if (params == NULL || params->p == NULL || params->q == NULL)
|
||||
return FFC_PARAMS_RET_STATUS_FAILED;
|
||||
|
||||
/* A.1.1.3 Step (1..2) : L = len(p), N = len(q) */
|
||||
L = BN_num_bits(params->p);
|
||||
N = BN_num_bits(params->q);
|
||||
return ffc_params_FIPS186_4_gen_verify(NULL, (FFC_PARAMS *)params, type, L, N,
|
||||
evpmd, validate_flags, res, cb);
|
||||
}
|
||||
|
||||
/* This may be used in FIPS mode to validate deprecated FIPS-186-2 Params */
|
||||
int ffc_params_FIPS186_2_validate(const FFC_PARAMS *params, int type,
|
||||
const EVP_MD *evpmd, int validate_flags,
|
||||
int *res, BN_GENCB *cb)
|
||||
{
|
||||
size_t L, N;
|
||||
|
||||
if (params->p == NULL || params->q == NULL) {
|
||||
*res = FFC_CHECK_INVALID_PQ;
|
||||
return FFC_PARAMS_RET_STATUS_FAILED;
|
||||
}
|
||||
|
||||
/* A.1.1.3 Step (1..2) : L = len(p), N = len(q) */
|
||||
L = BN_num_bits(params->p);
|
||||
N = BN_num_bits(params->q);
|
||||
return ffc_params_FIPS186_2_gen_verify(NULL, (FFC_PARAMS *)params, type, L, N,
|
||||
evpmd, validate_flags, res, cb);
|
||||
}
|
||||