1 /* 2 * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the OpenSSL license (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 #include <stdio.h> 11 #include "internal/cryptlib.h" 12 #include "dh_locl.h" 13 #include "internal/bn_int.h" 14 15 static int generate_key(DH *dh); 16 static int compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh); 17 static int dh_bn_mod_exp(const DH *dh, BIGNUM *r, 18 const BIGNUM *a, const BIGNUM *p, 19 const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx); 20 static int dh_init(DH *dh); 21 static int dh_finish(DH *dh); 22 23 int DH_generate_key(DH *dh) 24 { 25 return dh->meth->generate_key(dh); 26 } 27 28 int DH_compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh) 29 { 30 return dh->meth->compute_key(key, pub_key, dh); 31 } 32 33 int DH_compute_key_padded(unsigned char *key, const BIGNUM *pub_key, DH *dh) 34 { 35 int rv, pad; 36 rv = dh->meth->compute_key(key, pub_key, dh); 37 if (rv <= 0) 38 return rv; 39 pad = BN_num_bytes(dh->p) - rv; 40 if (pad > 0) { 41 memmove(key + pad, key, rv); 42 memset(key, 0, pad); 43 } 44 return rv + pad; 45 } 46 47 static DH_METHOD dh_ossl = { 48 "OpenSSL DH Method", 49 generate_key, 50 compute_key, 51 dh_bn_mod_exp, 52 dh_init, 53 dh_finish, 54 DH_FLAG_FIPS_METHOD, 55 NULL, 56 NULL 57 }; 58 59 static const DH_METHOD *default_DH_method = &dh_ossl; 60 61 const DH_METHOD *DH_OpenSSL(void) 62 { 63 return &dh_ossl; 64 } 65 66 void DH_set_default_method(const DH_METHOD *meth) 67 { 68 default_DH_method = meth; 69 } 70 71 const DH_METHOD *DH_get_default_method(void) 72 { 73 return default_DH_method; 74 } 75 76 static int generate_key(DH *dh) 77 { 78 int ok = 0; 79 int generate_new_key = 0; 80 unsigned l; 81 BN_CTX *ctx = NULL; 82 BN_MONT_CTX *mont = NULL; 83 BIGNUM *pub_key = NULL, *priv_key = NULL; 84 85 if (BN_num_bits(dh->p) > OPENSSL_DH_MAX_MODULUS_BITS) { 86 DHerr(DH_F_GENERATE_KEY, DH_R_MODULUS_TOO_LARGE); 87 return 0; 88 } 89 90 ctx = BN_CTX_new(); 91 if (ctx == NULL) 92 goto err; 93 94 if (dh->priv_key == NULL) { 95 priv_key = BN_secure_new(); 96 if (priv_key == NULL) 97 goto err; 98 generate_new_key = 1; 99 } else 100 priv_key = dh->priv_key; 101 102 if (dh->pub_key == NULL) { 103 pub_key = BN_new(); 104 if (pub_key == NULL) 105 goto err; 106 } else 107 pub_key = dh->pub_key; 108 109 if (dh->flags & DH_FLAG_CACHE_MONT_P) { 110 mont = BN_MONT_CTX_set_locked(&dh->method_mont_p, 111 dh->lock, dh->p, ctx); 112 if (!mont) 113 goto err; 114 } 115 116 if (generate_new_key) { 117 if (dh->q) { 118 do { 119 if (!BN_priv_rand_range(priv_key, dh->q)) 120 goto err; 121 } 122 while (BN_is_zero(priv_key) || BN_is_one(priv_key)); 123 } else { 124 /* secret exponent length */ 125 l = dh->length ? dh->length : BN_num_bits(dh->p) - 1; 126 if (!BN_priv_rand(priv_key, l, BN_RAND_TOP_ONE, BN_RAND_BOTTOM_ANY)) 127 goto err; 128 } 129 } 130 131 { 132 BIGNUM *prk = BN_new(); 133 134 if (prk == NULL) 135 goto err; 136 BN_with_flags(prk, priv_key, BN_FLG_CONSTTIME); 137 138 if (!dh->meth->bn_mod_exp(dh, pub_key, dh->g, prk, dh->p, ctx, mont)) { 139 BN_free(prk); 140 goto err; 141 } 142 /* We MUST free prk before any further use of priv_key */ 143 BN_free(prk); 144 } 145 146 dh->pub_key = pub_key; 147 dh->priv_key = priv_key; 148 ok = 1; 149 err: 150 if (ok != 1) 151 DHerr(DH_F_GENERATE_KEY, ERR_R_BN_LIB); 152 153 if (pub_key != dh->pub_key) 154 BN_free(pub_key); 155 if (priv_key != dh->priv_key) 156 BN_free(priv_key); 157 BN_CTX_free(ctx); 158 return ok; 159 } 160 161 static int compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh) 162 { 163 BN_CTX *ctx = NULL; 164 BN_MONT_CTX *mont = NULL; 165 BIGNUM *tmp; 166 int ret = -1; 167 int check_result; 168 169 if (BN_num_bits(dh->p) > OPENSSL_DH_MAX_MODULUS_BITS) { 170 DHerr(DH_F_COMPUTE_KEY, DH_R_MODULUS_TOO_LARGE); 171 goto err; 172 } 173 174 ctx = BN_CTX_new(); 175 if (ctx == NULL) 176 goto err; 177 BN_CTX_start(ctx); 178 tmp = BN_CTX_get(ctx); 179 if (tmp == NULL) 180 goto err; 181 182 if (dh->priv_key == NULL) { 183 DHerr(DH_F_COMPUTE_KEY, DH_R_NO_PRIVATE_VALUE); 184 goto err; 185 } 186 187 if (dh->flags & DH_FLAG_CACHE_MONT_P) { 188 mont = BN_MONT_CTX_set_locked(&dh->method_mont_p, 189 dh->lock, dh->p, ctx); 190 BN_set_flags(dh->priv_key, BN_FLG_CONSTTIME); 191 if (!mont) 192 goto err; 193 } 194 195 if (!DH_check_pub_key(dh, pub_key, &check_result) || check_result) { 196 DHerr(DH_F_COMPUTE_KEY, DH_R_INVALID_PUBKEY); 197 goto err; 198 } 199 200 if (!dh-> 201 meth->bn_mod_exp(dh, tmp, pub_key, dh->priv_key, dh->p, ctx, mont)) { 202 DHerr(DH_F_COMPUTE_KEY, ERR_R_BN_LIB); 203 goto err; 204 } 205 206 ret = BN_bn2bin(tmp, key); 207 err: 208 if (ctx != NULL) { 209 BN_CTX_end(ctx); 210 BN_CTX_free(ctx); 211 } 212 return ret; 213 } 214 215 static int dh_bn_mod_exp(const DH *dh, BIGNUM *r, 216 const BIGNUM *a, const BIGNUM *p, 217 const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx) 218 { 219 return BN_mod_exp_mont(r, a, p, m, ctx, m_ctx); 220 } 221 222 static int dh_init(DH *dh) 223 { 224 dh->flags |= DH_FLAG_CACHE_MONT_P; 225 return 1; 226 } 227 228 static int dh_finish(DH *dh) 229 { 230 BN_MONT_CTX_free(dh->method_mont_p); 231 return 1; 232 } 233