1 /*
2  * Copyright (c) 2006 Kungliga Tekniska Högskolan
3  * (Royal Institute of Technology, Stockholm, Sweden).
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  *
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  *
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * 3. Neither the name of the Institute nor the names of its contributors
18  *    may be used to endorse or promote products derived from this software
19  *    without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  */
33 
34 #ifdef HAVE_CONFIG_H
35 #include <config.h>
36 #endif
37 
38 #include <stdio.h>
39 #include <stdlib.h>
40 #include <dh.h>
41 
42 #include <roken.h>
43 
44 #include "tommath.h"
45 
46 static void
BN2mpz(mp_int * s,const BIGNUM * bn)47 BN2mpz(mp_int *s, const BIGNUM *bn)
48 {
49     size_t len;
50     void *p;
51 
52     len = BN_num_bytes(bn);
53     p = malloc(len);
54     BN_bn2bin(bn, p);
55     mp_read_unsigned_bin(s, p, len);
56     free(p);
57 }
58 
59 
60 static BIGNUM *
mpz2BN(mp_int * s)61 mpz2BN(mp_int *s)
62 {
63     size_t size;
64     BIGNUM *bn;
65     void *p;
66 
67     size = mp_unsigned_bin_size(s);
68     p = malloc(size);
69     if (p == NULL && size != 0)
70 	return NULL;
71     mp_to_unsigned_bin(s, p);
72 
73     bn = BN_bin2bn(p, size, NULL);
74     free(p);
75     return bn;
76 }
77 
78 /*
79  *
80  */
81 
82 #define DH_NUM_TRIES 10
83 
84 static int
ltm_dh_generate_key(DH * dh)85 ltm_dh_generate_key(DH *dh)
86 {
87     mp_int pub, priv_key, g, p;
88     int have_private_key = (dh->priv_key != NULL);
89     int codes, times = 0;
90     int res;
91 
92     if (dh->p == NULL || dh->g == NULL)
93 	return 0;
94 
95     while (times++ < DH_NUM_TRIES) {
96 	if (!have_private_key) {
97 	    size_t bits = BN_num_bits(dh->p);
98 
99 	    if (dh->priv_key)
100 		BN_free(dh->priv_key);
101 
102 	    dh->priv_key = BN_new();
103 	    if (dh->priv_key == NULL)
104 		return 0;
105 	    if (!BN_rand(dh->priv_key, bits - 1, 0, 0)) {
106 		BN_clear_free(dh->priv_key);
107 		dh->priv_key = NULL;
108 		return 0;
109 	    }
110 	}
111 	if (dh->pub_key) {
112 	    BN_free(dh->pub_key);
113 	    dh->pub_key = NULL;
114 	}
115 
116 	mp_init_multi(&pub, &priv_key, &g, &p, NULL);
117 
118 	BN2mpz(&priv_key, dh->priv_key);
119 	BN2mpz(&g, dh->g);
120 	BN2mpz(&p, dh->p);
121 
122 	res = mp_exptmod(&g, &priv_key, &p, &pub);
123 
124 	mp_clear_multi(&priv_key, &g, &p, NULL);
125 	if (res != 0)
126 	    continue;
127 
128 	dh->pub_key = mpz2BN(&pub);
129 	mp_clear(&pub);
130 	if (dh->pub_key == NULL)
131 	    return 0;
132 
133 	if (DH_check_pubkey(dh, dh->pub_key, &codes) && codes == 0)
134 	    break;
135 	if (have_private_key)
136 	    return 0;
137     }
138 
139     if (times >= DH_NUM_TRIES) {
140 	if (!have_private_key && dh->priv_key) {
141 	    BN_free(dh->priv_key);
142 	    dh->priv_key = NULL;
143 	}
144 	if (dh->pub_key) {
145 	    BN_free(dh->pub_key);
146 	    dh->pub_key = NULL;
147 	}
148 	return 0;
149     }
150 
151     return 1;
152 }
153 
154 static int
ltm_dh_compute_key(unsigned char * shared,const BIGNUM * pub,DH * dh)155 ltm_dh_compute_key(unsigned char *shared, const BIGNUM * pub, DH *dh)
156 {
157     mp_int s, priv_key, p, peer_pub;
158     int ret;
159 
160     if (dh->pub_key == NULL || dh->g == NULL || dh->priv_key == NULL)
161 	return -1;
162 
163     mp_init_multi(&s, &priv_key, &p, &peer_pub, NULL);
164     BN2mpz(&p, dh->p);
165     BN2mpz(&peer_pub, pub);
166 
167     /* check if peers pubkey is reasonable */
168     if (mp_isneg(&peer_pub)
169 	|| mp_cmp(&peer_pub, &p) >= 0
170 	|| mp_cmp_d(&peer_pub, 1) <= 0)
171     {
172 	ret = -1;
173 	goto out;
174     }
175 
176     BN2mpz(&priv_key, dh->priv_key);
177 
178     ret = mp_exptmod(&peer_pub, &priv_key, &p, &s);
179 
180     if (ret != 0) {
181 	ret = -1;
182 	goto out;
183     }
184 
185     ret = mp_unsigned_bin_size(&s);
186     mp_to_unsigned_bin(&s, shared);
187 
188  out:
189     mp_clear_multi(&s, &priv_key, &p, &peer_pub, NULL);
190 
191     return ret;
192 }
193 
194 static int
ltm_dh_generate_params(DH * dh,int a,int b,BN_GENCB * callback)195 ltm_dh_generate_params(DH *dh, int a, int b, BN_GENCB *callback)
196 {
197     /* groups should already be known, we don't care about this */
198     return 0;
199 }
200 
201 static int
ltm_dh_init(DH * dh)202 ltm_dh_init(DH *dh)
203 {
204     return 1;
205 }
206 
207 static int
ltm_dh_finish(DH * dh)208 ltm_dh_finish(DH *dh)
209 {
210     return 1;
211 }
212 
213 
214 /*
215  *
216  */
217 
218 const DH_METHOD _hc_dh_ltm_method = {
219     "hcrypto ltm DH",
220     ltm_dh_generate_key,
221     ltm_dh_compute_key,
222     NULL,
223     ltm_dh_init,
224     ltm_dh_finish,
225     0,
226     NULL,
227     ltm_dh_generate_params
228 };
229 
230 /**
231  * DH implementation using libtommath.
232  *
233  * @return the DH_METHOD for the DH implementation using libtommath.
234  *
235  * @ingroup hcrypto_dh
236  */
237 
238 const DH_METHOD *
DH_ltm_method(void)239 DH_ltm_method(void)
240 {
241     return &_hc_dh_ltm_method;
242 }
243