1 /** 2 * \file ecdh.h 3 * 4 * \brief The Elliptic Curve Diffie-Hellman (ECDH) protocol APIs. 5 * 6 * ECDH is an anonymous key agreement protocol allowing two parties to 7 * establish a shared secret over an insecure channel. Each party must have an 8 * elliptic-curve public–private key pair. 9 * 10 * For more information, see <em>NIST SP 800-56A Rev. 2: Recommendation for 11 * Pair-Wise Key Establishment Schemes Using Discrete Logarithm 12 * Cryptography</em>. 13 */ 14 /* 15 * Copyright (C) 2006-2018, Arm Limited (or its affiliates), All Rights Reserved 16 * SPDX-License-Identifier: GPL-2.0 17 * 18 * This program is free software; you can redistribute it and/or modify 19 * it under the terms of the GNU General Public License as published by 20 * the Free Software Foundation; either version 2 of the License, or 21 * (at your option) any later version. 22 * 23 * This program is distributed in the hope that it will be useful, 24 * but WITHOUT ANY WARRANTY; without even the implied warranty of 25 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 26 * GNU General Public License for more details. 27 * 28 * You should have received a copy of the GNU General Public License along 29 * with this program; if not, write to the Free Software Foundation, Inc., 30 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. 31 * 32 * This file is part of Mbed TLS (https://tls.mbed.org) 33 */ 34 35 #ifndef MBEDTLS_ECDH_H 36 #define MBEDTLS_ECDH_H 37 38 #include "ecp.h" 39 40 #ifdef __cplusplus 41 extern "C" { 42 #endif 43 44 /** 45 * Defines the source of the imported EC key: 46 * <ul><li>Our key.</li> 47 * <li>The key of the peer.</li></ul> 48 */ 49 typedef enum 50 { 51 MBEDTLS_ECDH_OURS, 52 MBEDTLS_ECDH_THEIRS, 53 } mbedtls_ecdh_side; 54 55 /** 56 * \brief The ECDH context structure. 57 */ 58 typedef struct 59 { 60 mbedtls_ecp_group grp; /*!< The elliptic curve used. */ 61 mbedtls_mpi d; /*!< The private key. */ 62 mbedtls_ecp_point Q; /*!< The public key. */ 63 mbedtls_ecp_point Qp; /*!< The value of the public key of the peer. */ 64 mbedtls_mpi z; /*!< The shared secret. */ 65 int point_format; /*!< The format of point export in TLS messages. */ 66 mbedtls_ecp_point Vi; /*!< The blinding value. */ 67 mbedtls_ecp_point Vf; /*!< The unblinding value. */ 68 mbedtls_mpi _d; /*!< The previous \p d. */ 69 } 70 mbedtls_ecdh_context; 71 72 /** 73 * \brief This function generates an ECDH keypair on an elliptic 74 * curve. 75 * 76 * This function performs the first of two core computations 77 * implemented during the ECDH key exchange. The second core 78 * computation is performed by mbedtls_ecdh_compute_shared(). 79 * 80 * \param grp The ECP group. 81 * \param d The destination MPI (private key). 82 * \param Q The destination point (public key). 83 * \param f_rng The RNG function. 84 * \param p_rng The RNG parameter. 85 * 86 * \return \c 0 on success, or an \c MBEDTLS_ERR_ECP_XXX or 87 * \c MBEDTLS_MPI_XXX error code on failure. 88 * 89 * \see ecp.h 90 */ 91 int mbedtls_ecdh_gen_public( mbedtls_ecp_group *grp, mbedtls_mpi *d, mbedtls_ecp_point *Q, 92 int (*f_rng)(void *, unsigned char *, size_t), 93 void *p_rng ); 94 95 /** 96 * \brief This function computes the shared secret. 97 * 98 * This function performs the second of two core computations 99 * implemented during the ECDH key exchange. The first core 100 * computation is performed by mbedtls_ecdh_gen_public(). 101 * 102 * \param grp The ECP group. 103 * \param z The destination MPI (shared secret). 104 * \param Q The public key from another party. 105 * \param d Our secret exponent (private key). 106 * \param f_rng The RNG function. 107 * \param p_rng The RNG parameter. 108 * 109 * \return \c 0 on success, or an \c MBEDTLS_ERR_ECP_XXX or 110 * \c MBEDTLS_MPI_XXX error code on failure. 111 * 112 * \see ecp.h 113 * 114 * \note If \p f_rng is not NULL, it is used to implement 115 * countermeasures against potential elaborate timing 116 * attacks. For more information, see mbedtls_ecp_mul(). 117 */ 118 int mbedtls_ecdh_compute_shared( mbedtls_ecp_group *grp, mbedtls_mpi *z, 119 const mbedtls_ecp_point *Q, const mbedtls_mpi *d, 120 int (*f_rng)(void *, unsigned char *, size_t), 121 void *p_rng ); 122 123 /** 124 * \brief This function initializes an ECDH context. 125 * 126 * \param ctx The ECDH context to initialize. 127 */ 128 void mbedtls_ecdh_init( mbedtls_ecdh_context *ctx ); 129 130 /** 131 * \brief This function frees a context. 132 * 133 * \param ctx The context to free. 134 */ 135 void mbedtls_ecdh_free( mbedtls_ecdh_context *ctx ); 136 137 /** 138 * \brief This function generates a public key and a TLS 139 * ServerKeyExchange payload. 140 * 141 * This is the first function used by a TLS server for ECDHE 142 * ciphersuites. 143 * 144 * \param ctx The ECDH context. 145 * \param olen The number of characters written. 146 * \param buf The destination buffer. 147 * \param blen The length of the destination buffer. 148 * \param f_rng The RNG function. 149 * \param p_rng The RNG parameter. 150 * 151 * \note This function assumes that the ECP group (grp) of the 152 * \p ctx context has already been properly set, 153 * for example, using mbedtls_ecp_group_load(). 154 * 155 * \return \c 0 on success, or an \c MBEDTLS_ERR_ECP_XXX error code 156 * on failure. 157 * 158 * \see ecp.h 159 */ 160 int mbedtls_ecdh_make_params( mbedtls_ecdh_context *ctx, size_t *olen, 161 unsigned char *buf, size_t blen, 162 int (*f_rng)(void *, unsigned char *, size_t), 163 void *p_rng ); 164 165 /** 166 * \brief This function parses and processes a TLS ServerKeyExhange 167 * payload. 168 * 169 * This is the first function used by a TLS client for ECDHE 170 * ciphersuites. 171 * 172 * \param ctx The ECDH context. 173 * \param buf The pointer to the start of the input buffer. 174 * \param end The address for one Byte past the end of the buffer. 175 * 176 * \return \c 0 on success, or an \c MBEDTLS_ERR_ECP_XXX error code 177 * on failure. 178 * 179 * \see ecp.h 180 */ 181 int mbedtls_ecdh_read_params( mbedtls_ecdh_context *ctx, 182 const unsigned char **buf, const unsigned char *end ); 183 184 /** 185 * \brief This function sets up an ECDH context from an EC key. 186 * 187 * It is used by clients and servers in place of the 188 * ServerKeyEchange for static ECDH, and imports ECDH 189 * parameters from the EC key information of a certificate. 190 * 191 * \param ctx The ECDH context to set up. 192 * \param key The EC key to use. 193 * \param side Defines the source of the key: 194 * <ul><li>1: Our key.</li> 195 <li>0: The key of the peer.</li></ul> 196 * 197 * \return \c 0 on success, or an \c MBEDTLS_ERR_ECP_XXX error code 198 * on failure. 199 * 200 * \see ecp.h 201 */ 202 int mbedtls_ecdh_get_params( mbedtls_ecdh_context *ctx, const mbedtls_ecp_keypair *key, 203 mbedtls_ecdh_side side ); 204 205 /** 206 * \brief This function generates a public key and a TLS 207 * ClientKeyExchange payload. 208 * 209 * This is the second function used by a TLS client for ECDH(E) 210 * ciphersuites. 211 * 212 * \param ctx The ECDH context. 213 * \param olen The number of Bytes written. 214 * \param buf The destination buffer. 215 * \param blen The size of the destination buffer. 216 * \param f_rng The RNG function. 217 * \param p_rng The RNG parameter. 218 * 219 * \return \c 0 on success, or an \c MBEDTLS_ERR_ECP_XXX error code 220 * on failure. 221 * 222 * \see ecp.h 223 */ 224 int mbedtls_ecdh_make_public( mbedtls_ecdh_context *ctx, size_t *olen, 225 unsigned char *buf, size_t blen, 226 int (*f_rng)(void *, unsigned char *, size_t), 227 void *p_rng ); 228 229 /** 230 * \brief This function parses and processes a TLS ClientKeyExchange 231 * payload. 232 * 233 * This is the second function used by a TLS server for ECDH(E) 234 * ciphersuites. 235 * 236 * \param ctx The ECDH context. 237 * \param buf The start of the input buffer. 238 * \param blen The length of the input buffer. 239 * 240 * \return \c 0 on success, or an \c MBEDTLS_ERR_ECP_XXX error code 241 * on failure. 242 * 243 * \see ecp.h 244 */ 245 int mbedtls_ecdh_read_public( mbedtls_ecdh_context *ctx, 246 const unsigned char *buf, size_t blen ); 247 248 /** 249 * \brief This function derives and exports the shared secret. 250 * 251 * This is the last function used by both TLS client 252 * and servers. 253 * 254 * \param ctx The ECDH context. 255 * \param olen The number of Bytes written. 256 * \param buf The destination buffer. 257 * \param blen The length of the destination buffer. 258 * \param f_rng The RNG function. 259 * \param p_rng The RNG parameter. 260 * 261 * \return \c 0 on success, or an \c MBEDTLS_ERR_ECP_XXX error code 262 * on failure. 263 * 264 * \see ecp.h 265 * 266 * \note If \p f_rng is not NULL, it is used to implement 267 * countermeasures against potential elaborate timing 268 * attacks. For more information, see mbedtls_ecp_mul(). 269 */ 270 int mbedtls_ecdh_calc_secret( mbedtls_ecdh_context *ctx, size_t *olen, 271 unsigned char *buf, size_t blen, 272 int (*f_rng)(void *, unsigned char *, size_t), 273 void *p_rng ); 274 275 #ifdef __cplusplus 276 } 277 #endif 278 279 #endif /* ecdh.h */ 280