1 #include "includes.h"
2 #include "ecc.h"
3 #include "dbutil.h"
4 #include "bignum.h"
5
6 #if DROPBEAR_ECC
7
8 /* .dp members are filled out by dropbear_ecc_fill_dp() at startup */
9 #if DROPBEAR_ECC_256
10 struct dropbear_ecc_curve ecc_curve_nistp256 = {
11 32, /* .ltc_size */
12 NULL, /* .dp */
13 &sha256_desc, /* .hash_desc */
14 "nistp256" /* .name */
15 };
16 #endif
17 #if DROPBEAR_ECC_384
18 struct dropbear_ecc_curve ecc_curve_nistp384 = {
19 48, /* .ltc_size */
20 NULL, /* .dp */
21 &sha384_desc, /* .hash_desc */
22 "nistp384" /* .name */
23 };
24 #endif
25 #if DROPBEAR_ECC_521
26 struct dropbear_ecc_curve ecc_curve_nistp521 = {
27 66, /* .ltc_size */
28 NULL, /* .dp */
29 &sha512_desc, /* .hash_desc */
30 "nistp521" /* .name */
31 };
32 #endif
33
34 struct dropbear_ecc_curve *dropbear_ecc_curves[] = {
35 #if DROPBEAR_ECC_256
36 &ecc_curve_nistp256,
37 #endif
38 #if DROPBEAR_ECC_384
39 &ecc_curve_nistp384,
40 #endif
41 #if DROPBEAR_ECC_521
42 &ecc_curve_nistp521,
43 #endif
44 NULL
45 };
46
dropbear_ecc_fill_dp()47 void dropbear_ecc_fill_dp() {
48 struct dropbear_ecc_curve **curve;
49 /* libtomcrypt guarantees they're ordered by size */
50 const ltc_ecc_set_type *dp = ltc_ecc_sets;
51 for (curve = dropbear_ecc_curves; *curve; curve++) {
52 for (;dp->size > 0; dp++) {
53 if (dp->size == (*curve)->ltc_size) {
54 (*curve)->dp = dp;
55 break;
56 }
57 }
58 if (!(*curve)->dp) {
59 dropbear_exit("Missing ECC params %s", (*curve)->name);
60 }
61 }
62 }
63
curve_for_dp(const ltc_ecc_set_type * dp)64 struct dropbear_ecc_curve* curve_for_dp(const ltc_ecc_set_type *dp) {
65 struct dropbear_ecc_curve **curve = NULL;
66 for (curve = dropbear_ecc_curves; *curve; curve++) {
67 if ((*curve)->dp == dp) {
68 break;
69 }
70 }
71 assert(*curve);
72 return *curve;
73 }
74
new_ecc_key(void)75 ecc_key * new_ecc_key(void) {
76 ecc_key *key = m_malloc(sizeof(*key));
77 m_mp_alloc_init_multi((mp_int**)&key->pubkey.x, (mp_int**)&key->pubkey.y,
78 (mp_int**)&key->pubkey.z, (mp_int**)&key->k, NULL);
79 return key;
80 }
81
82 /* Copied from libtomcrypt ecc_import.c (version there is static), modified
83 for different mp_int pointer without LTC_SOURCE */
ecc_is_point(const ecc_key * key)84 static int ecc_is_point(const ecc_key *key)
85 {
86 mp_int *prime, *b, *t1, *t2;
87 int err;
88
89 m_mp_alloc_init_multi(&prime, &b, &t1, &t2, NULL);
90
91 /* load prime and b */
92 if ((err = mp_read_radix(prime, key->dp->prime, 16)) != CRYPT_OK) { goto error; }
93 if ((err = mp_read_radix(b, key->dp->B, 16)) != CRYPT_OK) { goto error; }
94
95 /* compute y^2 */
96 if ((err = mp_sqr(key->pubkey.y, t1)) != CRYPT_OK) { goto error; }
97
98 /* compute x^3 */
99 if ((err = mp_sqr(key->pubkey.x, t2)) != CRYPT_OK) { goto error; }
100 if ((err = mp_mod(t2, prime, t2)) != CRYPT_OK) { goto error; }
101 if ((err = mp_mul(key->pubkey.x, t2, t2)) != CRYPT_OK) { goto error; }
102
103 /* compute y^2 - x^3 */
104 if ((err = mp_sub(t1, t2, t1)) != CRYPT_OK) { goto error; }
105
106 /* compute y^2 - x^3 + 3x */
107 if ((err = mp_add(t1, key->pubkey.x, t1)) != CRYPT_OK) { goto error; }
108 if ((err = mp_add(t1, key->pubkey.x, t1)) != CRYPT_OK) { goto error; }
109 if ((err = mp_add(t1, key->pubkey.x, t1)) != CRYPT_OK) { goto error; }
110 if ((err = mp_mod(t1, prime, t1)) != CRYPT_OK) { goto error; }
111 while (mp_cmp_d(t1, 0) == LTC_MP_LT) {
112 if ((err = mp_add(t1, prime, t1)) != CRYPT_OK) { goto error; }
113 }
114 while (mp_cmp(t1, prime) != LTC_MP_LT) {
115 if ((err = mp_sub(t1, prime, t1)) != CRYPT_OK) { goto error; }
116 }
117
118 /* compare to b */
119 if (mp_cmp(t1, b) != LTC_MP_EQ) {
120 err = CRYPT_INVALID_PACKET;
121 } else {
122 err = CRYPT_OK;
123 }
124
125 error:
126 mp_clear_multi(prime, b, t1, t2, NULL);
127 m_free(prime);
128 m_free(b);
129 m_free(t1);
130 m_free(t2);
131 return err;
132 }
133
134 /* For the "ephemeral public key octet string" in ECDH (rfc5656 section 4) */
buf_put_ecc_raw_pubkey_string(buffer * buf,ecc_key * key)135 void buf_put_ecc_raw_pubkey_string(buffer *buf, ecc_key *key) {
136 unsigned long len = key->dp->size*2 + 1;
137 int err;
138 buf_putint(buf, len);
139 err = ecc_ansi_x963_export(key, buf_getwriteptr(buf, len), &len);
140 if (err != CRYPT_OK) {
141 dropbear_exit("ECC error");
142 }
143 buf_incrwritepos(buf, len);
144 }
145
146 /* For the "ephemeral public key octet string" in ECDH (rfc5656 section 4) */
buf_get_ecc_raw_pubkey(buffer * buf,const struct dropbear_ecc_curve * curve)147 ecc_key * buf_get_ecc_raw_pubkey(buffer *buf, const struct dropbear_ecc_curve *curve) {
148 ecc_key *key = NULL;
149 int ret = DROPBEAR_FAILURE;
150 const unsigned int size = curve->dp->size;
151 unsigned char first;
152
153 TRACE(("enter buf_get_ecc_raw_pubkey"))
154
155 buf_setpos(buf, 0);
156 first = buf_getbyte(buf);
157 if (first == 2 || first == 3) {
158 dropbear_log(LOG_WARNING, "Dropbear doesn't support ECC point compression");
159 return NULL;
160 }
161 if (first != 4 || buf->len != 1+2*size) {
162 TRACE(("leave, wrong size"))
163 return NULL;
164 }
165
166 key = new_ecc_key();
167 key->dp = curve->dp;
168
169 if (mp_from_ubin(key->pubkey.x, buf_getptr(buf, size), size) != MP_OKAY) {
170 TRACE(("failed to read x"))
171 goto out;
172 }
173 buf_incrpos(buf, size);
174
175 if (mp_from_ubin(key->pubkey.y, buf_getptr(buf, size), size) != MP_OKAY) {
176 TRACE(("failed to read y"))
177 goto out;
178 }
179 buf_incrpos(buf, size);
180
181 mp_set(key->pubkey.z, 1);
182
183 if (ecc_is_point(key) != CRYPT_OK) {
184 TRACE(("failed, not a point"))
185 goto out;
186 }
187
188 /* SEC1 3.2.3.1 Check that Q != 0 */
189 if (mp_cmp_d(key->pubkey.x, 0) == LTC_MP_EQ) {
190 TRACE(("failed, x == 0"))
191 goto out;
192 }
193 if (mp_cmp_d(key->pubkey.y, 0) == LTC_MP_EQ) {
194 TRACE(("failed, y == 0"))
195 goto out;
196 }
197
198 ret = DROPBEAR_SUCCESS;
199
200 out:
201 if (ret == DROPBEAR_FAILURE) {
202 if (key) {
203 ecc_free(key);
204 m_free(key);
205 key = NULL;
206 }
207 }
208
209 return key;
210
211 }
212
213 /* a modified version of libtomcrypt's "ecc_shared_secret" to output
214 a mp_int instead. */
dropbear_ecc_shared_secret(ecc_key * public_key,const ecc_key * private_key)215 mp_int * dropbear_ecc_shared_secret(ecc_key *public_key, const ecc_key *private_key)
216 {
217 ecc_point *result = NULL;
218 mp_int *prime = NULL, *shared_secret = NULL;
219 int err = DROPBEAR_FAILURE;
220
221 /* type valid? */
222 if (private_key->type != PK_PRIVATE) {
223 goto out;
224 }
225
226 if (private_key->dp != public_key->dp) {
227 goto out;
228 }
229
230 /* make new point */
231 result = ltc_ecc_new_point();
232 if (result == NULL) {
233 goto out;
234 }
235
236 prime = m_malloc(sizeof(*prime));
237 m_mp_init(prime);
238
239 if (mp_read_radix(prime, (char *)private_key->dp->prime, 16) != CRYPT_OK) {
240 goto out;
241 }
242 if (ltc_mp.ecc_ptmul(private_key->k, &public_key->pubkey, result, prime, 1) != CRYPT_OK) {
243 goto out;
244 }
245
246 shared_secret = m_malloc(sizeof(*shared_secret));
247 m_mp_init(shared_secret);
248 if (mp_copy(result->x, shared_secret) != CRYPT_OK) {
249 goto out;
250 }
251
252 mp_clear(prime);
253 m_free(prime);
254 ltc_ecc_del_point(result);
255
256 err = DROPBEAR_SUCCESS;
257 out:
258 if (err == DROPBEAR_FAILURE) {
259 dropbear_exit("ECC error");
260 }
261 return shared_secret;
262 }
263
264 #endif
265