423 lines
7.9 KiB
C
423 lines
7.9 KiB
C
/* $OpenBSD: ssl_kex.c,v 1.12 2023/07/28 16:02:34 tb Exp $ */
|
|
/*
|
|
* Copyright (c) 2020, 2021 Joel Sing <jsing@openbsd.org>
|
|
*
|
|
* Permission to use, copy, modify, and distribute this software for any
|
|
* purpose with or without fee is hereby granted, provided that the above
|
|
* copyright notice and this permission notice appear in all copies.
|
|
*
|
|
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
|
|
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
|
|
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
|
|
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
|
|
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
|
|
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
|
|
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
|
*/
|
|
|
|
#include <stdlib.h>
|
|
|
|
#include <openssl/bn.h>
|
|
#include <openssl/dh.h>
|
|
#include <openssl/ec.h>
|
|
#include <openssl/evp.h>
|
|
#include <openssl/objects.h>
|
|
|
|
#include "bytestring.h"
|
|
|
|
#define DHE_MINIMUM_BITS 1024
|
|
|
|
int
|
|
ssl_kex_generate_dhe(DH *dh, DH *dh_params)
|
|
{
|
|
BIGNUM *p = NULL, *g = NULL;
|
|
int ret = 0;
|
|
|
|
if ((p = BN_dup(DH_get0_p(dh_params))) == NULL)
|
|
goto err;
|
|
if ((g = BN_dup(DH_get0_g(dh_params))) == NULL)
|
|
goto err;
|
|
|
|
if (!DH_set0_pqg(dh, p, NULL, g))
|
|
goto err;
|
|
p = NULL;
|
|
g = NULL;
|
|
|
|
if (!DH_generate_key(dh))
|
|
goto err;
|
|
|
|
ret = 1;
|
|
|
|
err:
|
|
BN_free(p);
|
|
BN_free(g);
|
|
|
|
return ret;
|
|
}
|
|
|
|
int
|
|
ssl_kex_generate_dhe_params_auto(DH *dh, size_t key_bits)
|
|
{
|
|
BIGNUM *p = NULL, *g = NULL;
|
|
int ret = 0;
|
|
|
|
if (key_bits >= 8192)
|
|
p = BN_get_rfc3526_prime_8192(NULL);
|
|
else if (key_bits >= 4096)
|
|
p = BN_get_rfc3526_prime_4096(NULL);
|
|
else if (key_bits >= 3072)
|
|
p = BN_get_rfc3526_prime_3072(NULL);
|
|
else if (key_bits >= 2048)
|
|
p = BN_get_rfc3526_prime_2048(NULL);
|
|
else if (key_bits >= 1536)
|
|
p = BN_get_rfc3526_prime_1536(NULL);
|
|
else
|
|
p = BN_get_rfc2409_prime_1024(NULL);
|
|
|
|
if (p == NULL)
|
|
goto err;
|
|
|
|
if ((g = BN_new()) == NULL)
|
|
goto err;
|
|
if (!BN_set_word(g, 2))
|
|
goto err;
|
|
|
|
if (!DH_set0_pqg(dh, p, NULL, g))
|
|
goto err;
|
|
p = NULL;
|
|
g = NULL;
|
|
|
|
if (!DH_generate_key(dh))
|
|
goto err;
|
|
|
|
ret = 1;
|
|
|
|
err:
|
|
BN_free(p);
|
|
BN_free(g);
|
|
|
|
return ret;
|
|
}
|
|
|
|
int
|
|
ssl_kex_params_dhe(DH *dh, CBB *cbb)
|
|
{
|
|
int dh_p_len, dh_g_len;
|
|
CBB dh_p, dh_g;
|
|
uint8_t *data;
|
|
|
|
if ((dh_p_len = BN_num_bytes(DH_get0_p(dh))) <= 0)
|
|
return 0;
|
|
if ((dh_g_len = BN_num_bytes(DH_get0_g(dh))) <= 0)
|
|
return 0;
|
|
|
|
if (!CBB_add_u16_length_prefixed(cbb, &dh_p))
|
|
return 0;
|
|
if (!CBB_add_space(&dh_p, &data, dh_p_len))
|
|
return 0;
|
|
if (BN_bn2bin(DH_get0_p(dh), data) != dh_p_len)
|
|
return 0;
|
|
|
|
if (!CBB_add_u16_length_prefixed(cbb, &dh_g))
|
|
return 0;
|
|
if (!CBB_add_space(&dh_g, &data, dh_g_len))
|
|
return 0;
|
|
if (BN_bn2bin(DH_get0_g(dh), data) != dh_g_len)
|
|
return 0;
|
|
|
|
if (!CBB_flush(cbb))
|
|
return 0;
|
|
|
|
return 1;
|
|
}
|
|
|
|
int
|
|
ssl_kex_public_dhe(DH *dh, CBB *cbb)
|
|
{
|
|
uint8_t *data;
|
|
int dh_y_len;
|
|
CBB dh_y;
|
|
|
|
if ((dh_y_len = BN_num_bytes(DH_get0_pub_key(dh))) <= 0)
|
|
return 0;
|
|
|
|
if (!CBB_add_u16_length_prefixed(cbb, &dh_y))
|
|
return 0;
|
|
if (!CBB_add_space(&dh_y, &data, dh_y_len))
|
|
return 0;
|
|
if (BN_bn2bin(DH_get0_pub_key(dh), data) != dh_y_len)
|
|
return 0;
|
|
|
|
if (!CBB_flush(cbb))
|
|
return 0;
|
|
|
|
return 1;
|
|
}
|
|
|
|
int
|
|
ssl_kex_peer_params_dhe(DH *dh, CBS *cbs, int *decode_error,
|
|
int *invalid_params)
|
|
{
|
|
BIGNUM *p = NULL, *g = NULL;
|
|
CBS dh_p, dh_g;
|
|
int ret = 0;
|
|
|
|
*decode_error = 0;
|
|
*invalid_params = 0;
|
|
|
|
if (!CBS_get_u16_length_prefixed(cbs, &dh_p)) {
|
|
*decode_error = 1;
|
|
goto err;
|
|
}
|
|
if (!CBS_get_u16_length_prefixed(cbs, &dh_g)) {
|
|
*decode_error = 1;
|
|
goto err;
|
|
}
|
|
|
|
if ((p = BN_bin2bn(CBS_data(&dh_p), CBS_len(&dh_p), NULL)) == NULL)
|
|
goto err;
|
|
if ((g = BN_bin2bn(CBS_data(&dh_g), CBS_len(&dh_g), NULL)) == NULL)
|
|
goto err;
|
|
|
|
if (!DH_set0_pqg(dh, p, NULL, g))
|
|
goto err;
|
|
p = NULL;
|
|
g = NULL;
|
|
|
|
/* XXX - consider calling DH_check(). */
|
|
|
|
if (DH_bits(dh) < DHE_MINIMUM_BITS)
|
|
*invalid_params = 1;
|
|
|
|
ret = 1;
|
|
|
|
err:
|
|
BN_free(p);
|
|
BN_free(g);
|
|
|
|
return ret;
|
|
}
|
|
|
|
int
|
|
ssl_kex_peer_public_dhe(DH *dh, CBS *cbs, int *decode_error,
|
|
int *invalid_key)
|
|
{
|
|
BIGNUM *pub_key = NULL;
|
|
int check_flags;
|
|
CBS dh_y;
|
|
int ret = 0;
|
|
|
|
*decode_error = 0;
|
|
*invalid_key = 0;
|
|
|
|
if (!CBS_get_u16_length_prefixed(cbs, &dh_y)) {
|
|
*decode_error = 1;
|
|
goto err;
|
|
}
|
|
|
|
if ((pub_key = BN_bin2bn(CBS_data(&dh_y), CBS_len(&dh_y),
|
|
NULL)) == NULL)
|
|
goto err;
|
|
|
|
if (!DH_set0_key(dh, pub_key, NULL))
|
|
goto err;
|
|
pub_key = NULL;
|
|
|
|
if (!DH_check_pub_key(dh, DH_get0_pub_key(dh), &check_flags))
|
|
goto err;
|
|
if (check_flags != 0)
|
|
*invalid_key = 1;
|
|
|
|
ret = 1;
|
|
|
|
err:
|
|
BN_free(pub_key);
|
|
|
|
return ret;
|
|
}
|
|
|
|
int
|
|
ssl_kex_derive_dhe(DH *dh, DH *dh_peer,
|
|
uint8_t **shared_key, size_t *shared_key_len)
|
|
{
|
|
uint8_t *key = NULL;
|
|
int key_len = 0;
|
|
int ret = 0;
|
|
|
|
if ((key_len = DH_size(dh)) <= 0)
|
|
goto err;
|
|
if ((key = calloc(1, key_len)) == NULL)
|
|
goto err;
|
|
|
|
if ((key_len = DH_compute_key(key, DH_get0_pub_key(dh_peer), dh)) <= 0)
|
|
goto err;
|
|
|
|
*shared_key = key;
|
|
*shared_key_len = key_len;
|
|
key = NULL;
|
|
|
|
ret = 1;
|
|
|
|
err:
|
|
freezero(key, key_len);
|
|
|
|
return ret;
|
|
}
|
|
|
|
int
|
|
ssl_kex_dummy_ecdhe_x25519(EVP_PKEY *pkey)
|
|
{
|
|
EC_GROUP *group = NULL;
|
|
EC_POINT *point = NULL;
|
|
EC_KEY *ec_key = NULL;
|
|
BIGNUM *order = NULL;
|
|
int ret = 0;
|
|
|
|
/* Fudge up an EC_KEY that looks like X25519... */
|
|
if ((group = EC_GROUP_new_by_curve_name(NID_X9_62_prime256v1)) == NULL)
|
|
goto err;
|
|
if ((point = EC_POINT_new(group)) == NULL)
|
|
goto err;
|
|
if ((order = BN_new()) == NULL)
|
|
goto err;
|
|
if (!BN_set_bit(order, 252))
|
|
goto err;
|
|
if (!EC_GROUP_set_generator(group, point, order, NULL))
|
|
goto err;
|
|
EC_GROUP_set_curve_name(group, NID_X25519);
|
|
if ((ec_key = EC_KEY_new()) == NULL)
|
|
goto err;
|
|
if (!EC_KEY_set_group(ec_key, group))
|
|
goto err;
|
|
if (!EVP_PKEY_set1_EC_KEY(pkey, ec_key))
|
|
goto err;
|
|
|
|
ret = 1;
|
|
|
|
err:
|
|
EC_GROUP_free(group);
|
|
EC_POINT_free(point);
|
|
EC_KEY_free(ec_key);
|
|
BN_free(order);
|
|
|
|
return ret;
|
|
}
|
|
|
|
int
|
|
ssl_kex_generate_ecdhe_ecp(EC_KEY *ecdh, int nid)
|
|
{
|
|
EC_GROUP *group;
|
|
int ret = 0;
|
|
|
|
if ((group = EC_GROUP_new_by_curve_name(nid)) == NULL)
|
|
goto err;
|
|
|
|
if (!EC_KEY_set_group(ecdh, group))
|
|
goto err;
|
|
if (!EC_KEY_generate_key(ecdh))
|
|
goto err;
|
|
|
|
ret = 1;
|
|
|
|
err:
|
|
EC_GROUP_free(group);
|
|
|
|
return ret;
|
|
}
|
|
|
|
int
|
|
ssl_kex_public_ecdhe_ecp(EC_KEY *ecdh, CBB *cbb)
|
|
{
|
|
const EC_GROUP *group;
|
|
const EC_POINT *point;
|
|
uint8_t *ecp;
|
|
size_t ecp_len;
|
|
int ret = 0;
|
|
|
|
if ((group = EC_KEY_get0_group(ecdh)) == NULL)
|
|
goto err;
|
|
if ((point = EC_KEY_get0_public_key(ecdh)) == NULL)
|
|
goto err;
|
|
|
|
if ((ecp_len = EC_POINT_point2oct(group, point,
|
|
POINT_CONVERSION_UNCOMPRESSED, NULL, 0, NULL)) == 0)
|
|
goto err;
|
|
if (!CBB_add_space(cbb, &ecp, ecp_len))
|
|
goto err;
|
|
if ((EC_POINT_point2oct(group, point, POINT_CONVERSION_UNCOMPRESSED,
|
|
ecp, ecp_len, NULL)) == 0)
|
|
goto err;
|
|
|
|
ret = 1;
|
|
|
|
err:
|
|
return ret;
|
|
}
|
|
|
|
int
|
|
ssl_kex_peer_public_ecdhe_ecp(EC_KEY *ecdh, int nid, CBS *cbs)
|
|
{
|
|
EC_GROUP *group = NULL;
|
|
EC_POINT *point = NULL;
|
|
int ret = 0;
|
|
|
|
if ((group = EC_GROUP_new_by_curve_name(nid)) == NULL)
|
|
goto err;
|
|
|
|
if (!EC_KEY_set_group(ecdh, group))
|
|
goto err;
|
|
|
|
if ((point = EC_POINT_new(group)) == NULL)
|
|
goto err;
|
|
if (EC_POINT_oct2point(group, point, CBS_data(cbs), CBS_len(cbs),
|
|
NULL) == 0)
|
|
goto err;
|
|
if (!EC_KEY_set_public_key(ecdh, point))
|
|
goto err;
|
|
|
|
ret = 1;
|
|
|
|
err:
|
|
EC_GROUP_free(group);
|
|
EC_POINT_free(point);
|
|
|
|
return ret;
|
|
}
|
|
|
|
int
|
|
ssl_kex_derive_ecdhe_ecp(EC_KEY *ecdh, EC_KEY *ecdh_peer,
|
|
uint8_t **shared_key, size_t *shared_key_len)
|
|
{
|
|
const EC_POINT *point;
|
|
uint8_t *key = NULL;
|
|
int key_len = 0;
|
|
int ret = 0;
|
|
|
|
if (!EC_GROUP_check(EC_KEY_get0_group(ecdh), NULL))
|
|
goto err;
|
|
if (!EC_GROUP_check(EC_KEY_get0_group(ecdh_peer), NULL))
|
|
goto err;
|
|
|
|
if ((point = EC_KEY_get0_public_key(ecdh_peer)) == NULL)
|
|
goto err;
|
|
|
|
if ((key_len = ECDH_size(ecdh)) <= 0)
|
|
goto err;
|
|
if ((key = calloc(1, key_len)) == NULL)
|
|
goto err;
|
|
|
|
if (ECDH_compute_key(key, key_len, point, ecdh, NULL) <= 0)
|
|
goto err;
|
|
|
|
*shared_key = key;
|
|
*shared_key_len = key_len;
|
|
key = NULL;
|
|
|
|
ret = 1;
|
|
|
|
err:
|
|
freezero(key, key_len);
|
|
|
|
return ret;
|
|
}
|