1 /* Copyright (c) 2015, Google Inc.
2  *
3  * Permission to use, copy, modify, and/or distribute this software for any
4  * purpose with or without fee is hereby granted, provided that the above
5  * copyright notice and this permission notice appear in all copies.
6  *
7  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
8  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
10  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
12  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
13  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
14 
15 #include <openssl/ssl.h>
16 
17 #include <assert.h>
18 #include <string.h>
19 
20 #include <utility>
21 
22 #include <openssl/bn.h>
23 #include <openssl/bytestring.h>
24 #include <openssl/curve25519.h>
25 #include <openssl/ec.h>
26 #include <openssl/err.h>
27 #include <openssl/hrss.h>
28 #include <openssl/mem.h>
29 #include <openssl/nid.h>
30 #include <openssl/rand.h>
31 
32 #include "internal.h"
33 #include "../crypto/internal.h"
34 
35 BSSL_NAMESPACE_BEGIN
36 
37 namespace {
38 
39 class ECKeyShare : public SSLKeyShare {
40  public:
ECKeyShare(int nid,uint16_t group_id)41   ECKeyShare(int nid, uint16_t group_id) : nid_(nid), group_id_(group_id) {}
42 
GroupID() const43   uint16_t GroupID() const override { return group_id_; }
44 
Offer(CBB * out)45   bool Offer(CBB *out) override {
46     assert(!private_key_);
47     // Set up a shared |BN_CTX| for all operations.
48     UniquePtr<BN_CTX> bn_ctx(BN_CTX_new());
49     if (!bn_ctx) {
50       return false;
51     }
52     BN_CTXScope scope(bn_ctx.get());
53 
54     // Generate a private key.
55     UniquePtr<EC_GROUP> group(EC_GROUP_new_by_curve_name(nid_));
56     private_key_.reset(BN_new());
57     if (!group || !private_key_ ||
58         !BN_rand_range_ex(private_key_.get(), 1,
59                           EC_GROUP_get0_order(group.get()))) {
60       return false;
61     }
62 
63     // Compute the corresponding public key and serialize it.
64     UniquePtr<EC_POINT> public_key(EC_POINT_new(group.get()));
65     if (!public_key ||
66         !EC_POINT_mul(group.get(), public_key.get(), private_key_.get(), NULL,
67                       NULL, bn_ctx.get()) ||
68         !EC_POINT_point2cbb(out, group.get(), public_key.get(),
69                             POINT_CONVERSION_UNCOMPRESSED, bn_ctx.get())) {
70       return false;
71     }
72 
73     return true;
74   }
75 
Finish(Array<uint8_t> * out_secret,uint8_t * out_alert,Span<const uint8_t> peer_key)76   bool Finish(Array<uint8_t> *out_secret, uint8_t *out_alert,
77               Span<const uint8_t> peer_key) override {
78     assert(private_key_);
79     *out_alert = SSL_AD_INTERNAL_ERROR;
80 
81     // Set up a shared |BN_CTX| for all operations.
82     UniquePtr<BN_CTX> bn_ctx(BN_CTX_new());
83     if (!bn_ctx) {
84       return false;
85     }
86     BN_CTXScope scope(bn_ctx.get());
87 
88     UniquePtr<EC_GROUP> group(EC_GROUP_new_by_curve_name(nid_));
89     if (!group) {
90       return false;
91     }
92 
93     UniquePtr<EC_POINT> peer_point(EC_POINT_new(group.get()));
94     UniquePtr<EC_POINT> result(EC_POINT_new(group.get()));
95     BIGNUM *x = BN_CTX_get(bn_ctx.get());
96     if (!peer_point || !result || !x) {
97       return false;
98     }
99 
100     if (peer_key.empty() || peer_key[0] != POINT_CONVERSION_UNCOMPRESSED ||
101         !EC_POINT_oct2point(group.get(), peer_point.get(), peer_key.data(),
102                             peer_key.size(), bn_ctx.get())) {
103       OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_ECPOINT);
104       *out_alert = SSL_AD_DECODE_ERROR;
105       return false;
106     }
107 
108     // Compute the x-coordinate of |peer_key| * |private_key_|.
109     if (!EC_POINT_mul(group.get(), result.get(), NULL, peer_point.get(),
110                       private_key_.get(), bn_ctx.get()) ||
111         !EC_POINT_get_affine_coordinates_GFp(group.get(), result.get(), x, NULL,
112                                              bn_ctx.get())) {
113       return false;
114     }
115 
116     // Encode the x-coordinate left-padded with zeros.
117     Array<uint8_t> secret;
118     if (!secret.Init((EC_GROUP_get_degree(group.get()) + 7) / 8) ||
119         !BN_bn2bin_padded(secret.data(), secret.size(), x)) {
120       return false;
121     }
122 
123     *out_secret = std::move(secret);
124     return true;
125   }
126 
Serialize(CBB * out)127   bool Serialize(CBB *out) override {
128     assert(private_key_);
129     CBB cbb;
130     UniquePtr<EC_GROUP> group(EC_GROUP_new_by_curve_name(nid_));
131     // Padding is added to avoid leaking the length.
132     size_t len = BN_num_bytes(EC_GROUP_get0_order(group.get()));
133     if (!CBB_add_asn1_uint64(out, group_id_) ||
134         !CBB_add_asn1(out, &cbb, CBS_ASN1_OCTETSTRING) ||
135         !BN_bn2cbb_padded(&cbb, len, private_key_.get()) ||
136         !CBB_flush(out)) {
137       return false;
138     }
139     return true;
140   }
141 
Deserialize(CBS * in)142   bool Deserialize(CBS *in) override {
143     assert(!private_key_);
144     CBS private_key;
145     if (!CBS_get_asn1(in, &private_key, CBS_ASN1_OCTETSTRING)) {
146       return false;
147     }
148     private_key_.reset(BN_bin2bn(CBS_data(&private_key),
149                                  CBS_len(&private_key), nullptr));
150     return private_key_ != nullptr;
151   }
152 
153  private:
154   UniquePtr<BIGNUM> private_key_;
155   int nid_;
156   uint16_t group_id_;
157 };
158 
159 class X25519KeyShare : public SSLKeyShare {
160  public:
X25519KeyShare()161   X25519KeyShare() {}
162 
GroupID() const163   uint16_t GroupID() const override { return SSL_CURVE_X25519; }
164 
Offer(CBB * out)165   bool Offer(CBB *out) override {
166     uint8_t public_key[32];
167     X25519_keypair(public_key, private_key_);
168     return !!CBB_add_bytes(out, public_key, sizeof(public_key));
169   }
170 
Finish(Array<uint8_t> * out_secret,uint8_t * out_alert,Span<const uint8_t> peer_key)171   bool Finish(Array<uint8_t> *out_secret, uint8_t *out_alert,
172               Span<const uint8_t> peer_key) override {
173     *out_alert = SSL_AD_INTERNAL_ERROR;
174 
175     Array<uint8_t> secret;
176     if (!secret.Init(32)) {
177       OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
178       return false;
179     }
180 
181     if (peer_key.size() != 32 ||
182         !X25519(secret.data(), private_key_, peer_key.data())) {
183       *out_alert = SSL_AD_DECODE_ERROR;
184       OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_ECPOINT);
185       return false;
186     }
187 
188     *out_secret = std::move(secret);
189     return true;
190   }
191 
Serialize(CBB * out)192   bool Serialize(CBB *out) override {
193     return (CBB_add_asn1_uint64(out, GroupID()) &&
194             CBB_add_asn1_octet_string(out, private_key_, sizeof(private_key_)));
195   }
196 
Deserialize(CBS * in)197   bool Deserialize(CBS *in) override {
198     CBS key;
199     if (!CBS_get_asn1(in, &key, CBS_ASN1_OCTETSTRING) ||
200         CBS_len(&key) != sizeof(private_key_) ||
201         !CBS_copy_bytes(&key, private_key_, sizeof(private_key_))) {
202       return false;
203     }
204     return true;
205   }
206 
207  private:
208   uint8_t private_key_[32];
209 };
210 
211 class CECPQ2KeyShare : public SSLKeyShare {
212  public:
CECPQ2KeyShare()213   CECPQ2KeyShare() {}
214 
GroupID() const215   uint16_t GroupID() const override { return SSL_CURVE_CECPQ2; }
216 
Offer(CBB * out)217   bool Offer(CBB *out) override {
218     uint8_t x25519_public_key[32];
219     X25519_keypair(x25519_public_key, x25519_private_key_);
220 
221     uint8_t hrss_entropy[HRSS_GENERATE_KEY_BYTES];
222     HRSS_public_key hrss_public_key;
223     RAND_bytes(hrss_entropy, sizeof(hrss_entropy));
224     HRSS_generate_key(&hrss_public_key, &hrss_private_key_, hrss_entropy);
225 
226     uint8_t hrss_public_key_bytes[HRSS_PUBLIC_KEY_BYTES];
227     HRSS_marshal_public_key(hrss_public_key_bytes, &hrss_public_key);
228 
229     if (!CBB_add_bytes(out, x25519_public_key, sizeof(x25519_public_key)) ||
230         !CBB_add_bytes(out, hrss_public_key_bytes,
231                        sizeof(hrss_public_key_bytes))) {
232       return false;
233     }
234 
235     return true;
236   }
237 
Accept(CBB * out_public_key,Array<uint8_t> * out_secret,uint8_t * out_alert,Span<const uint8_t> peer_key)238   bool Accept(CBB *out_public_key, Array<uint8_t> *out_secret,
239               uint8_t *out_alert, Span<const uint8_t> peer_key) override {
240     Array<uint8_t> secret;
241     if (!secret.Init(32 + HRSS_KEY_BYTES)) {
242       OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
243       return false;
244     }
245 
246     uint8_t x25519_public_key[32];
247     X25519_keypair(x25519_public_key, x25519_private_key_);
248 
249     HRSS_public_key peer_public_key;
250     if (peer_key.size() != 32 + HRSS_PUBLIC_KEY_BYTES ||
251         !HRSS_parse_public_key(&peer_public_key, peer_key.data() + 32) ||
252         !X25519(secret.data(), x25519_private_key_, peer_key.data())) {
253       *out_alert = SSL_AD_DECODE_ERROR;
254       OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_ECPOINT);
255       return false;
256     }
257 
258     uint8_t ciphertext[HRSS_CIPHERTEXT_BYTES];
259     uint8_t entropy[HRSS_ENCAP_BYTES];
260     RAND_bytes(entropy, sizeof(entropy));
261     HRSS_encap(ciphertext, secret.data() + 32, &peer_public_key, entropy);
262 
263     if (!CBB_add_bytes(out_public_key, x25519_public_key,
264                        sizeof(x25519_public_key)) ||
265         !CBB_add_bytes(out_public_key, ciphertext, sizeof(ciphertext))) {
266       return false;
267     }
268 
269     *out_secret = std::move(secret);
270     return true;
271   }
272 
Finish(Array<uint8_t> * out_secret,uint8_t * out_alert,Span<const uint8_t> peer_key)273   bool Finish(Array<uint8_t> *out_secret, uint8_t *out_alert,
274               Span<const uint8_t> peer_key) override {
275     *out_alert = SSL_AD_INTERNAL_ERROR;
276 
277     Array<uint8_t> secret;
278     if (!secret.Init(32 + HRSS_KEY_BYTES)) {
279       OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
280       return false;
281     }
282 
283     if (peer_key.size() != 32 + HRSS_CIPHERTEXT_BYTES ||
284         !X25519(secret.data(), x25519_private_key_, peer_key.data())) {
285       *out_alert = SSL_AD_DECODE_ERROR;
286       OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_ECPOINT);
287       return false;
288     }
289 
290     HRSS_decap(secret.data() + 32, &hrss_private_key_, peer_key.data() + 32,
291                peer_key.size() - 32);
292 
293     *out_secret = std::move(secret);
294     return true;
295   }
296 
297  private:
298   uint8_t x25519_private_key_[32];
299   HRSS_private_key hrss_private_key_;
300 };
301 
302 CONSTEXPR_ARRAY NamedGroup kNamedGroups[] = {
303     {NID_secp224r1, SSL_CURVE_SECP224R1, "P-224", "secp224r1"},
304     {NID_X9_62_prime256v1, SSL_CURVE_SECP256R1, "P-256", "prime256v1"},
305     {NID_secp384r1, SSL_CURVE_SECP384R1, "P-384", "secp384r1"},
306     {NID_secp521r1, SSL_CURVE_SECP521R1, "P-521", "secp521r1"},
307     {NID_X25519, SSL_CURVE_X25519, "X25519", "x25519"},
308     {NID_CECPQ2, SSL_CURVE_CECPQ2, "CECPQ2", "CECPQ2"},
309 };
310 
311 }  // namespace
312 
NamedGroups()313 Span<const NamedGroup> NamedGroups() {
314   return MakeConstSpan(kNamedGroups, OPENSSL_ARRAY_SIZE(kNamedGroups));
315 }
316 
Create(uint16_t group_id)317 UniquePtr<SSLKeyShare> SSLKeyShare::Create(uint16_t group_id) {
318   switch (group_id) {
319     case SSL_CURVE_SECP224R1:
320       return UniquePtr<SSLKeyShare>(
321           New<ECKeyShare>(NID_secp224r1, SSL_CURVE_SECP224R1));
322     case SSL_CURVE_SECP256R1:
323       return UniquePtr<SSLKeyShare>(
324           New<ECKeyShare>(NID_X9_62_prime256v1, SSL_CURVE_SECP256R1));
325     case SSL_CURVE_SECP384R1:
326       return UniquePtr<SSLKeyShare>(
327           New<ECKeyShare>(NID_secp384r1, SSL_CURVE_SECP384R1));
328     case SSL_CURVE_SECP521R1:
329       return UniquePtr<SSLKeyShare>(
330           New<ECKeyShare>(NID_secp521r1, SSL_CURVE_SECP521R1));
331     case SSL_CURVE_X25519:
332       return UniquePtr<SSLKeyShare>(New<X25519KeyShare>());
333     case SSL_CURVE_CECPQ2:
334       return UniquePtr<SSLKeyShare>(New<CECPQ2KeyShare>());
335     default:
336       return nullptr;
337   }
338 }
339 
Create(CBS * in)340 UniquePtr<SSLKeyShare> SSLKeyShare::Create(CBS *in) {
341   uint64_t group;
342   if (!CBS_get_asn1_uint64(in, &group) || group > 0xffff) {
343     return nullptr;
344   }
345   UniquePtr<SSLKeyShare> key_share = Create(static_cast<uint16_t>(group));
346   if (!key_share || !key_share->Deserialize(in)) {
347     return nullptr;
348   }
349   return key_share;
350 }
351 
352 
Accept(CBB * out_public_key,Array<uint8_t> * out_secret,uint8_t * out_alert,Span<const uint8_t> peer_key)353 bool SSLKeyShare::Accept(CBB *out_public_key, Array<uint8_t> *out_secret,
354                          uint8_t *out_alert, Span<const uint8_t> peer_key) {
355   *out_alert = SSL_AD_INTERNAL_ERROR;
356   return Offer(out_public_key) &&
357          Finish(out_secret, out_alert, peer_key);
358 }
359 
ssl_nid_to_group_id(uint16_t * out_group_id,int nid)360 bool ssl_nid_to_group_id(uint16_t *out_group_id, int nid) {
361   for (const auto &group : kNamedGroups) {
362     if (group.nid == nid) {
363       *out_group_id = group.group_id;
364       return true;
365     }
366   }
367   return false;
368 }
369 
ssl_name_to_group_id(uint16_t * out_group_id,const char * name,size_t len)370 bool ssl_name_to_group_id(uint16_t *out_group_id, const char *name, size_t len) {
371   for (const auto &group : kNamedGroups) {
372     if (len == strlen(group.name) &&
373         !strncmp(group.name, name, len)) {
374       *out_group_id = group.group_id;
375       return true;
376     }
377     if (len == strlen(group.alias) &&
378         !strncmp(group.alias, name, len)) {
379       *out_group_id = group.group_id;
380       return true;
381     }
382   }
383   return false;
384 }
385 
386 BSSL_NAMESPACE_END
387 
388 using namespace bssl;
389 
SSL_get_curve_name(uint16_t group_id)390 const char* SSL_get_curve_name(uint16_t group_id) {
391   for (const auto &group : kNamedGroups) {
392     if (group.group_id == group_id) {
393       return group.name;
394     }
395   }
396   return nullptr;
397 }
398