1*0a6a1f1dSLionel Sambuc /* $NetBSD: dh-ltm.c,v 1.1.1.2 2014/04/24 12:45:30 pettai Exp $ */
2ebfedea0SLionel Sambuc
3ebfedea0SLionel Sambuc /*
4ebfedea0SLionel Sambuc * Copyright (c) 2006 Kungliga Tekniska Högskolan
5ebfedea0SLionel Sambuc * (Royal Institute of Technology, Stockholm, Sweden).
6ebfedea0SLionel Sambuc * All rights reserved.
7ebfedea0SLionel Sambuc *
8ebfedea0SLionel Sambuc * Redistribution and use in source and binary forms, with or without
9ebfedea0SLionel Sambuc * modification, are permitted provided that the following conditions
10ebfedea0SLionel Sambuc * are met:
11ebfedea0SLionel Sambuc *
12ebfedea0SLionel Sambuc * 1. Redistributions of source code must retain the above copyright
13ebfedea0SLionel Sambuc * notice, this list of conditions and the following disclaimer.
14ebfedea0SLionel Sambuc *
15ebfedea0SLionel Sambuc * 2. Redistributions in binary form must reproduce the above copyright
16ebfedea0SLionel Sambuc * notice, this list of conditions and the following disclaimer in the
17ebfedea0SLionel Sambuc * documentation and/or other materials provided with the distribution.
18ebfedea0SLionel Sambuc *
19ebfedea0SLionel Sambuc * 3. Neither the name of the Institute nor the names of its contributors
20ebfedea0SLionel Sambuc * may be used to endorse or promote products derived from this software
21ebfedea0SLionel Sambuc * without specific prior written permission.
22ebfedea0SLionel Sambuc *
23ebfedea0SLionel Sambuc * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
24ebfedea0SLionel Sambuc * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25ebfedea0SLionel Sambuc * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26ebfedea0SLionel Sambuc * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
27ebfedea0SLionel Sambuc * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28ebfedea0SLionel Sambuc * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29ebfedea0SLionel Sambuc * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30ebfedea0SLionel Sambuc * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31ebfedea0SLionel Sambuc * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32ebfedea0SLionel Sambuc * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33ebfedea0SLionel Sambuc * SUCH DAMAGE.
34ebfedea0SLionel Sambuc */
35ebfedea0SLionel Sambuc
36ebfedea0SLionel Sambuc #ifdef HAVE_CONFIG_H
37ebfedea0SLionel Sambuc #include <config.h>
38ebfedea0SLionel Sambuc #endif
39ebfedea0SLionel Sambuc
40ebfedea0SLionel Sambuc #include <stdio.h>
41ebfedea0SLionel Sambuc #include <stdlib.h>
42ebfedea0SLionel Sambuc #include <dh.h>
43ebfedea0SLionel Sambuc
44ebfedea0SLionel Sambuc #include <krb5/roken.h>
45ebfedea0SLionel Sambuc
46ebfedea0SLionel Sambuc #include "tommath.h"
47ebfedea0SLionel Sambuc
48ebfedea0SLionel Sambuc static void
BN2mpz(mp_int * s,const BIGNUM * bn)49ebfedea0SLionel Sambuc BN2mpz(mp_int *s, const BIGNUM *bn)
50ebfedea0SLionel Sambuc {
51ebfedea0SLionel Sambuc size_t len;
52ebfedea0SLionel Sambuc void *p;
53ebfedea0SLionel Sambuc
54ebfedea0SLionel Sambuc len = BN_num_bytes(bn);
55ebfedea0SLionel Sambuc p = malloc(len);
56ebfedea0SLionel Sambuc BN_bn2bin(bn, p);
57ebfedea0SLionel Sambuc mp_read_unsigned_bin(s, p, len);
58ebfedea0SLionel Sambuc free(p);
59ebfedea0SLionel Sambuc }
60ebfedea0SLionel Sambuc
61ebfedea0SLionel Sambuc
62ebfedea0SLionel Sambuc static BIGNUM *
mpz2BN(mp_int * s)63ebfedea0SLionel Sambuc mpz2BN(mp_int *s)
64ebfedea0SLionel Sambuc {
65ebfedea0SLionel Sambuc size_t size;
66ebfedea0SLionel Sambuc BIGNUM *bn;
67ebfedea0SLionel Sambuc void *p;
68ebfedea0SLionel Sambuc
69ebfedea0SLionel Sambuc size = mp_unsigned_bin_size(s);
70ebfedea0SLionel Sambuc p = malloc(size);
71ebfedea0SLionel Sambuc if (p == NULL && size != 0)
72ebfedea0SLionel Sambuc return NULL;
73ebfedea0SLionel Sambuc mp_to_unsigned_bin(s, p);
74ebfedea0SLionel Sambuc
75ebfedea0SLionel Sambuc bn = BN_bin2bn(p, size, NULL);
76ebfedea0SLionel Sambuc free(p);
77ebfedea0SLionel Sambuc return bn;
78ebfedea0SLionel Sambuc }
79ebfedea0SLionel Sambuc
80ebfedea0SLionel Sambuc /*
81ebfedea0SLionel Sambuc *
82ebfedea0SLionel Sambuc */
83ebfedea0SLionel Sambuc
84ebfedea0SLionel Sambuc #define DH_NUM_TRIES 10
85ebfedea0SLionel Sambuc
86ebfedea0SLionel Sambuc static int
ltm_dh_generate_key(DH * dh)87ebfedea0SLionel Sambuc ltm_dh_generate_key(DH *dh)
88ebfedea0SLionel Sambuc {
89ebfedea0SLionel Sambuc mp_int pub, priv_key, g, p;
90ebfedea0SLionel Sambuc int have_private_key = (dh->priv_key != NULL);
91ebfedea0SLionel Sambuc int codes, times = 0;
92ebfedea0SLionel Sambuc int res;
93ebfedea0SLionel Sambuc
94ebfedea0SLionel Sambuc if (dh->p == NULL || dh->g == NULL)
95ebfedea0SLionel Sambuc return 0;
96ebfedea0SLionel Sambuc
97ebfedea0SLionel Sambuc while (times++ < DH_NUM_TRIES) {
98ebfedea0SLionel Sambuc if (!have_private_key) {
99ebfedea0SLionel Sambuc size_t bits = BN_num_bits(dh->p);
100ebfedea0SLionel Sambuc
101ebfedea0SLionel Sambuc if (dh->priv_key)
102ebfedea0SLionel Sambuc BN_free(dh->priv_key);
103ebfedea0SLionel Sambuc
104ebfedea0SLionel Sambuc dh->priv_key = BN_new();
105ebfedea0SLionel Sambuc if (dh->priv_key == NULL)
106ebfedea0SLionel Sambuc return 0;
107ebfedea0SLionel Sambuc if (!BN_rand(dh->priv_key, bits - 1, 0, 0)) {
108ebfedea0SLionel Sambuc BN_clear_free(dh->priv_key);
109ebfedea0SLionel Sambuc dh->priv_key = NULL;
110ebfedea0SLionel Sambuc return 0;
111ebfedea0SLionel Sambuc }
112ebfedea0SLionel Sambuc }
113ebfedea0SLionel Sambuc if (dh->pub_key)
114ebfedea0SLionel Sambuc BN_free(dh->pub_key);
115ebfedea0SLionel Sambuc
116ebfedea0SLionel Sambuc mp_init_multi(&pub, &priv_key, &g, &p, NULL);
117ebfedea0SLionel Sambuc
118ebfedea0SLionel Sambuc BN2mpz(&priv_key, dh->priv_key);
119ebfedea0SLionel Sambuc BN2mpz(&g, dh->g);
120ebfedea0SLionel Sambuc BN2mpz(&p, dh->p);
121ebfedea0SLionel Sambuc
122ebfedea0SLionel Sambuc res = mp_exptmod(&g, &priv_key, &p, &pub);
123ebfedea0SLionel Sambuc
124ebfedea0SLionel Sambuc mp_clear_multi(&priv_key, &g, &p, NULL);
125ebfedea0SLionel Sambuc if (res != 0)
126ebfedea0SLionel Sambuc continue;
127ebfedea0SLionel Sambuc
128ebfedea0SLionel Sambuc dh->pub_key = mpz2BN(&pub);
129ebfedea0SLionel Sambuc mp_clear(&pub);
130ebfedea0SLionel Sambuc if (dh->pub_key == NULL)
131ebfedea0SLionel Sambuc return 0;
132ebfedea0SLionel Sambuc
133ebfedea0SLionel Sambuc if (DH_check_pubkey(dh, dh->pub_key, &codes) && codes == 0)
134ebfedea0SLionel Sambuc break;
135ebfedea0SLionel Sambuc if (have_private_key)
136ebfedea0SLionel Sambuc return 0;
137ebfedea0SLionel Sambuc }
138ebfedea0SLionel Sambuc
139ebfedea0SLionel Sambuc if (times >= DH_NUM_TRIES) {
140ebfedea0SLionel Sambuc if (!have_private_key && dh->priv_key) {
141ebfedea0SLionel Sambuc BN_free(dh->priv_key);
142ebfedea0SLionel Sambuc dh->priv_key = NULL;
143ebfedea0SLionel Sambuc }
144ebfedea0SLionel Sambuc if (dh->pub_key) {
145ebfedea0SLionel Sambuc BN_free(dh->pub_key);
146ebfedea0SLionel Sambuc dh->pub_key = NULL;
147ebfedea0SLionel Sambuc }
148ebfedea0SLionel Sambuc return 0;
149ebfedea0SLionel Sambuc }
150ebfedea0SLionel Sambuc
151ebfedea0SLionel Sambuc return 1;
152ebfedea0SLionel Sambuc }
153ebfedea0SLionel Sambuc
154ebfedea0SLionel Sambuc static int
ltm_dh_compute_key(unsigned char * shared,const BIGNUM * pub,DH * dh)155ebfedea0SLionel Sambuc ltm_dh_compute_key(unsigned char *shared, const BIGNUM * pub, DH *dh)
156ebfedea0SLionel Sambuc {
157ebfedea0SLionel Sambuc mp_int s, priv_key, p, peer_pub;
158ebfedea0SLionel Sambuc int ret;
159ebfedea0SLionel Sambuc
160ebfedea0SLionel Sambuc if (dh->pub_key == NULL || dh->g == NULL || dh->priv_key == NULL)
161ebfedea0SLionel Sambuc return -1;
162ebfedea0SLionel Sambuc
163ebfedea0SLionel Sambuc mp_init_multi(&s, &priv_key, &p, &peer_pub, NULL);
164ebfedea0SLionel Sambuc BN2mpz(&p, dh->p);
165ebfedea0SLionel Sambuc BN2mpz(&peer_pub, pub);
166ebfedea0SLionel Sambuc
167ebfedea0SLionel Sambuc /* check if peers pubkey is reasonable */
168ebfedea0SLionel Sambuc if (mp_isneg(&peer_pub)
169ebfedea0SLionel Sambuc || mp_cmp(&peer_pub, &p) >= 0
170ebfedea0SLionel Sambuc || mp_cmp_d(&peer_pub, 1) <= 0)
171ebfedea0SLionel Sambuc {
172ebfedea0SLionel Sambuc ret = -1;
173ebfedea0SLionel Sambuc goto out;
174ebfedea0SLionel Sambuc }
175ebfedea0SLionel Sambuc
176ebfedea0SLionel Sambuc BN2mpz(&priv_key, dh->priv_key);
177ebfedea0SLionel Sambuc
178ebfedea0SLionel Sambuc ret = mp_exptmod(&peer_pub, &priv_key, &p, &s);
179ebfedea0SLionel Sambuc
180ebfedea0SLionel Sambuc if (ret != 0) {
181ebfedea0SLionel Sambuc ret = -1;
182ebfedea0SLionel Sambuc goto out;
183ebfedea0SLionel Sambuc }
184ebfedea0SLionel Sambuc
185ebfedea0SLionel Sambuc ret = mp_unsigned_bin_size(&s);
186ebfedea0SLionel Sambuc mp_to_unsigned_bin(&s, shared);
187ebfedea0SLionel Sambuc
188ebfedea0SLionel Sambuc out:
189ebfedea0SLionel Sambuc mp_clear_multi(&s, &priv_key, &p, &peer_pub, NULL);
190ebfedea0SLionel Sambuc
191ebfedea0SLionel Sambuc return ret;
192ebfedea0SLionel Sambuc }
193ebfedea0SLionel Sambuc
194ebfedea0SLionel Sambuc static int
ltm_dh_generate_params(DH * dh,int a,int b,BN_GENCB * callback)195ebfedea0SLionel Sambuc ltm_dh_generate_params(DH *dh, int a, int b, BN_GENCB *callback)
196ebfedea0SLionel Sambuc {
197ebfedea0SLionel Sambuc /* groups should already be known, we don't care about this */
198ebfedea0SLionel Sambuc return 0;
199ebfedea0SLionel Sambuc }
200ebfedea0SLionel Sambuc
201ebfedea0SLionel Sambuc static int
ltm_dh_init(DH * dh)202ebfedea0SLionel Sambuc ltm_dh_init(DH *dh)
203ebfedea0SLionel Sambuc {
204ebfedea0SLionel Sambuc return 1;
205ebfedea0SLionel Sambuc }
206ebfedea0SLionel Sambuc
207ebfedea0SLionel Sambuc static int
ltm_dh_finish(DH * dh)208ebfedea0SLionel Sambuc ltm_dh_finish(DH *dh)
209ebfedea0SLionel Sambuc {
210ebfedea0SLionel Sambuc return 1;
211ebfedea0SLionel Sambuc }
212ebfedea0SLionel Sambuc
213ebfedea0SLionel Sambuc
214ebfedea0SLionel Sambuc /*
215ebfedea0SLionel Sambuc *
216ebfedea0SLionel Sambuc */
217ebfedea0SLionel Sambuc
218ebfedea0SLionel Sambuc const DH_METHOD _hc_dh_ltm_method = {
219ebfedea0SLionel Sambuc "hcrypto ltm DH",
220ebfedea0SLionel Sambuc ltm_dh_generate_key,
221ebfedea0SLionel Sambuc ltm_dh_compute_key,
222ebfedea0SLionel Sambuc NULL,
223ebfedea0SLionel Sambuc ltm_dh_init,
224ebfedea0SLionel Sambuc ltm_dh_finish,
225ebfedea0SLionel Sambuc 0,
226ebfedea0SLionel Sambuc NULL,
227ebfedea0SLionel Sambuc ltm_dh_generate_params
228ebfedea0SLionel Sambuc };
229ebfedea0SLionel Sambuc
230ebfedea0SLionel Sambuc /**
231ebfedea0SLionel Sambuc * DH implementation using libtommath.
232ebfedea0SLionel Sambuc *
233ebfedea0SLionel Sambuc * @return the DH_METHOD for the DH implementation using libtommath.
234ebfedea0SLionel Sambuc *
235ebfedea0SLionel Sambuc * @ingroup hcrypto_dh
236ebfedea0SLionel Sambuc */
237ebfedea0SLionel Sambuc
238ebfedea0SLionel Sambuc const DH_METHOD *
DH_ltm_method(void)239ebfedea0SLionel Sambuc DH_ltm_method(void)
240ebfedea0SLionel Sambuc {
241ebfedea0SLionel Sambuc return &_hc_dh_ltm_method;
242ebfedea0SLionel Sambuc }
243