1 /* $OpenBSD: dh_lib.c,v 1.45 2024/03/27 01:26:30 tb Exp $ */
2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59 #include <limits.h>
60 #include <stdio.h>
61
62 #include <openssl/opensslconf.h>
63
64 #include <openssl/bn.h>
65 #include <openssl/dh.h>
66 #include <openssl/err.h>
67
68 #include "dh_local.h"
69
70 static const DH_METHOD *default_DH_method = NULL;
71
72 void
DH_set_default_method(const DH_METHOD * meth)73 DH_set_default_method(const DH_METHOD *meth)
74 {
75 default_DH_method = meth;
76 }
77 LCRYPTO_ALIAS(DH_set_default_method);
78
79 const DH_METHOD *
DH_get_default_method(void)80 DH_get_default_method(void)
81 {
82 if (!default_DH_method)
83 default_DH_method = DH_OpenSSL();
84 return default_DH_method;
85 }
86 LCRYPTO_ALIAS(DH_get_default_method);
87
88 int
DH_set_method(DH * dh,const DH_METHOD * meth)89 DH_set_method(DH *dh, const DH_METHOD *meth)
90 {
91 /*
92 * NB: The caller is specifically setting a method, so it's not up to us
93 * to deal with which ENGINE it comes from.
94 */
95 const DH_METHOD *mtmp;
96
97 mtmp = dh->meth;
98 if (mtmp->finish)
99 mtmp->finish(dh);
100 dh->meth = meth;
101 if (meth->init)
102 meth->init(dh);
103 return 1;
104 }
105 LCRYPTO_ALIAS(DH_set_method);
106
107 DH *
DH_new(void)108 DH_new(void)
109 {
110 return DH_new_method(NULL);
111 }
112 LCRYPTO_ALIAS(DH_new);
113
114 DH *
DH_new_method(ENGINE * engine)115 DH_new_method(ENGINE *engine)
116 {
117 DH *dh;
118
119 if ((dh = calloc(1, sizeof(*dh))) == NULL) {
120 DHerror(ERR_R_MALLOC_FAILURE);
121 goto err;
122 }
123
124 dh->meth = DH_get_default_method();
125 dh->flags = dh->meth->flags & ~DH_FLAG_NON_FIPS_ALLOW;
126 dh->references = 1;
127
128 if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_DH, dh, &dh->ex_data))
129 goto err;
130 if (dh->meth->init != NULL && !dh->meth->init(dh))
131 goto err;
132
133 return dh;
134
135 err:
136 DH_free(dh);
137
138 return NULL;
139 }
140 LCRYPTO_ALIAS(DH_new_method);
141
142 void
DH_free(DH * dh)143 DH_free(DH *dh)
144 {
145 if (dh == NULL)
146 return;
147
148 if (CRYPTO_add(&dh->references, -1, CRYPTO_LOCK_DH) > 0)
149 return;
150
151 if (dh->meth != NULL && dh->meth->finish != NULL)
152 dh->meth->finish(dh);
153
154 CRYPTO_free_ex_data(CRYPTO_EX_INDEX_DH, dh, &dh->ex_data);
155
156 BN_free(dh->p);
157 BN_free(dh->g);
158 BN_free(dh->q);
159 BN_free(dh->j);
160 free(dh->seed);
161 BN_free(dh->counter);
162 BN_free(dh->pub_key);
163 BN_free(dh->priv_key);
164 free(dh);
165 }
166 LCRYPTO_ALIAS(DH_free);
167
168 int
DH_up_ref(DH * dh)169 DH_up_ref(DH *dh)
170 {
171 return CRYPTO_add(&dh->references, 1, CRYPTO_LOCK_DH) > 1;
172 }
173 LCRYPTO_ALIAS(DH_up_ref);
174
175 int
DH_get_ex_new_index(long argl,void * argp,CRYPTO_EX_new * new_func,CRYPTO_EX_dup * dup_func,CRYPTO_EX_free * free_func)176 DH_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
177 CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func)
178 {
179 return CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_DH, argl, argp, new_func,
180 dup_func, free_func);
181 }
182 LCRYPTO_ALIAS(DH_get_ex_new_index);
183
184 int
DH_set_ex_data(DH * dh,int idx,void * arg)185 DH_set_ex_data(DH *dh, int idx, void *arg)
186 {
187 return CRYPTO_set_ex_data(&dh->ex_data, idx, arg);
188 }
189 LCRYPTO_ALIAS(DH_set_ex_data);
190
191 void *
DH_get_ex_data(DH * dh,int idx)192 DH_get_ex_data(DH *dh, int idx)
193 {
194 return CRYPTO_get_ex_data(&dh->ex_data, idx);
195 }
196 LCRYPTO_ALIAS(DH_get_ex_data);
197
198 int
DH_size(const DH * dh)199 DH_size(const DH *dh)
200 {
201 return BN_num_bytes(dh->p);
202 }
203 LCRYPTO_ALIAS(DH_size);
204
205 int
DH_bits(const DH * dh)206 DH_bits(const DH *dh)
207 {
208 return BN_num_bits(dh->p);
209 }
210 LCRYPTO_ALIAS(DH_bits);
211
212 int
DH_security_bits(const DH * dh)213 DH_security_bits(const DH *dh)
214 {
215 int N = -1;
216
217 if (dh->q != NULL)
218 N = BN_num_bits(dh->q);
219 else if (dh->length > 0)
220 N = dh->length;
221
222 return BN_security_bits(BN_num_bits(dh->p), N);
223 }
224 LCRYPTO_ALIAS(DH_security_bits);
225
226 ENGINE *
DH_get0_engine(DH * dh)227 DH_get0_engine(DH *dh)
228 {
229 return NULL;
230 }
231 LCRYPTO_ALIAS(DH_get0_engine);
232
233 void
DH_get0_pqg(const DH * dh,const BIGNUM ** p,const BIGNUM ** q,const BIGNUM ** g)234 DH_get0_pqg(const DH *dh, const BIGNUM **p, const BIGNUM **q, const BIGNUM **g)
235 {
236 if (p != NULL)
237 *p = dh->p;
238 if (q != NULL)
239 *q = dh->q;
240 if (g != NULL)
241 *g = dh->g;
242 }
243 LCRYPTO_ALIAS(DH_get0_pqg);
244
245 int
DH_set0_pqg(DH * dh,BIGNUM * p,BIGNUM * q,BIGNUM * g)246 DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g)
247 {
248 if ((dh->p == NULL && p == NULL) || (dh->g == NULL && g == NULL))
249 return 0;
250
251 if (p != NULL) {
252 BN_free(dh->p);
253 dh->p = p;
254 }
255 if (q != NULL) {
256 BN_free(dh->q);
257 dh->q = q;
258 dh->length = BN_num_bits(dh->q);
259 }
260 if (g != NULL) {
261 BN_free(dh->g);
262 dh->g = g;
263 }
264
265 return 1;
266 }
267 LCRYPTO_ALIAS(DH_set0_pqg);
268
269 void
DH_get0_key(const DH * dh,const BIGNUM ** pub_key,const BIGNUM ** priv_key)270 DH_get0_key(const DH *dh, const BIGNUM **pub_key, const BIGNUM **priv_key)
271 {
272 if (pub_key != NULL)
273 *pub_key = dh->pub_key;
274 if (priv_key != NULL)
275 *priv_key = dh->priv_key;
276 }
277 LCRYPTO_ALIAS(DH_get0_key);
278
279 int
DH_set0_key(DH * dh,BIGNUM * pub_key,BIGNUM * priv_key)280 DH_set0_key(DH *dh, BIGNUM *pub_key, BIGNUM *priv_key)
281 {
282 if (pub_key != NULL) {
283 BN_free(dh->pub_key);
284 dh->pub_key = pub_key;
285 }
286 if (priv_key != NULL) {
287 BN_free(dh->priv_key);
288 dh->priv_key = priv_key;
289 }
290
291 return 1;
292 }
293 LCRYPTO_ALIAS(DH_set0_key);
294
295 const BIGNUM *
DH_get0_p(const DH * dh)296 DH_get0_p(const DH *dh)
297 {
298 return dh->p;
299 }
300 LCRYPTO_ALIAS(DH_get0_p);
301
302 const BIGNUM *
DH_get0_q(const DH * dh)303 DH_get0_q(const DH *dh)
304 {
305 return dh->q;
306 }
307 LCRYPTO_ALIAS(DH_get0_q);
308
309 const BIGNUM *
DH_get0_g(const DH * dh)310 DH_get0_g(const DH *dh)
311 {
312 return dh->g;
313 }
314 LCRYPTO_ALIAS(DH_get0_g);
315
316 const BIGNUM *
DH_get0_priv_key(const DH * dh)317 DH_get0_priv_key(const DH *dh)
318 {
319 return dh->priv_key;
320 }
321 LCRYPTO_ALIAS(DH_get0_priv_key);
322
323 const BIGNUM *
DH_get0_pub_key(const DH * dh)324 DH_get0_pub_key(const DH *dh)
325 {
326 return dh->pub_key;
327 }
328 LCRYPTO_ALIAS(DH_get0_pub_key);
329
330 void
DH_clear_flags(DH * dh,int flags)331 DH_clear_flags(DH *dh, int flags)
332 {
333 dh->flags &= ~flags;
334 }
335 LCRYPTO_ALIAS(DH_clear_flags);
336
337 int
DH_test_flags(const DH * dh,int flags)338 DH_test_flags(const DH *dh, int flags)
339 {
340 return dh->flags & flags;
341 }
342 LCRYPTO_ALIAS(DH_test_flags);
343
344 void
DH_set_flags(DH * dh,int flags)345 DH_set_flags(DH *dh, int flags)
346 {
347 dh->flags |= flags;
348 }
349 LCRYPTO_ALIAS(DH_set_flags);
350
351 long
DH_get_length(const DH * dh)352 DH_get_length(const DH *dh)
353 {
354 return dh->length;
355 }
356 LCRYPTO_ALIAS(DH_get_length);
357
358 int
DH_set_length(DH * dh,long length)359 DH_set_length(DH *dh, long length)
360 {
361 if (length < 0 || length > INT_MAX)
362 return 0;
363
364 dh->length = length;
365 return 1;
366 }
367 LCRYPTO_ALIAS(DH_set_length);
368