1 /* $OpenBSD: tls_key_share.c,v 1.7 2022/07/02 16:00:12 tb Exp $ */
2 /*
3  * Copyright (c) 2020, 2021 Joel Sing <jsing@openbsd.org>
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 #include <stdlib.h>
19 
20 #include <openssl/curve25519.h>
21 #include <openssl/dh.h>
22 #include <openssl/ec.h>
23 #include <openssl/evp.h>
24 
25 #include "bytestring.h"
26 #include "ssl_locl.h"
27 #include "tls_internal.h"
28 
29 struct tls_key_share {
30 	int nid;
31 	uint16_t group_id;
32 	size_t key_bits;
33 
34 	DH *dhe;
35 	DH *dhe_peer;
36 
37 	EC_KEY *ecdhe;
38 	EC_KEY *ecdhe_peer;
39 
40 	uint8_t *x25519_public;
41 	uint8_t *x25519_private;
42 	uint8_t *x25519_peer_public;
43 };
44 
45 static struct tls_key_share *
tls_key_share_new_internal(int nid,uint16_t group_id)46 tls_key_share_new_internal(int nid, uint16_t group_id)
47 {
48 	struct tls_key_share *ks;
49 
50 	if ((ks = calloc(1, sizeof(struct tls_key_share))) == NULL)
51 		return NULL;
52 
53 	ks->group_id = group_id;
54 	ks->nid = nid;
55 
56 	return ks;
57 }
58 
59 struct tls_key_share *
tls_key_share_new(uint16_t group_id)60 tls_key_share_new(uint16_t group_id)
61 {
62 	int nid;
63 
64 	if (!tls1_ec_group_id2nid(group_id, &nid))
65 		return NULL;
66 
67 	return tls_key_share_new_internal(nid, group_id);
68 }
69 
70 struct tls_key_share *
tls_key_share_new_nid(int nid)71 tls_key_share_new_nid(int nid)
72 {
73 	uint16_t group_id = 0;
74 
75 	if (nid != NID_dhKeyAgreement) {
76 		if (!tls1_ec_nid2group_id(nid, &group_id))
77 			return NULL;
78 	}
79 
80 	return tls_key_share_new_internal(nid, group_id);
81 }
82 
83 void
tls_key_share_free(struct tls_key_share * ks)84 tls_key_share_free(struct tls_key_share *ks)
85 {
86 	if (ks == NULL)
87 		return;
88 
89 	DH_free(ks->dhe);
90 	DH_free(ks->dhe_peer);
91 
92 	EC_KEY_free(ks->ecdhe);
93 	EC_KEY_free(ks->ecdhe_peer);
94 
95 	freezero(ks->x25519_public, X25519_KEY_LENGTH);
96 	freezero(ks->x25519_private, X25519_KEY_LENGTH);
97 	freezero(ks->x25519_peer_public, X25519_KEY_LENGTH);
98 
99 	freezero(ks, sizeof(*ks));
100 }
101 
102 uint16_t
tls_key_share_group(struct tls_key_share * ks)103 tls_key_share_group(struct tls_key_share *ks)
104 {
105 	return ks->group_id;
106 }
107 
108 int
tls_key_share_nid(struct tls_key_share * ks)109 tls_key_share_nid(struct tls_key_share *ks)
110 {
111 	return ks->nid;
112 }
113 
114 void
tls_key_share_set_key_bits(struct tls_key_share * ks,size_t key_bits)115 tls_key_share_set_key_bits(struct tls_key_share *ks, size_t key_bits)
116 {
117 	ks->key_bits = key_bits;
118 }
119 
120 int
tls_key_share_set_dh_params(struct tls_key_share * ks,DH * dh_params)121 tls_key_share_set_dh_params(struct tls_key_share *ks, DH *dh_params)
122 {
123 	if (ks->nid != NID_dhKeyAgreement)
124 		return 0;
125 	if (ks->dhe != NULL || ks->dhe_peer != NULL)
126 		return 0;
127 
128 	if ((ks->dhe = DHparams_dup(dh_params)) == NULL)
129 		return 0;
130 	if ((ks->dhe_peer = DHparams_dup(dh_params)) == NULL)
131 		return 0;
132 
133 	return 1;
134 }
135 
136 int
tls_key_share_peer_pkey(struct tls_key_share * ks,EVP_PKEY * pkey)137 tls_key_share_peer_pkey(struct tls_key_share *ks, EVP_PKEY *pkey)
138 {
139 	if (ks->nid == NID_dhKeyAgreement && ks->dhe_peer != NULL)
140 		return EVP_PKEY_set1_DH(pkey, ks->dhe_peer);
141 
142 	if (ks->nid == NID_X25519 && ks->x25519_peer_public != NULL)
143 		return ssl_kex_dummy_ecdhe_x25519(pkey);
144 
145 	if (ks->ecdhe_peer != NULL)
146 		return EVP_PKEY_set1_EC_KEY(pkey, ks->ecdhe_peer);
147 
148 	return 0;
149 }
150 
151 static int
tls_key_share_generate_dhe(struct tls_key_share * ks)152 tls_key_share_generate_dhe(struct tls_key_share *ks)
153 {
154 	/*
155 	 * If auto params are not being used then we must already have DH
156 	 * parameters set.
157 	 */
158 	if (ks->key_bits == 0) {
159 		if (ks->dhe == NULL)
160 			return 0;
161 
162 		return ssl_kex_generate_dhe(ks->dhe, ks->dhe);
163 	}
164 
165 	if (ks->dhe != NULL || ks->dhe_peer != NULL)
166 		return 0;
167 
168 	if ((ks->dhe = DH_new()) == NULL)
169 		return 0;
170 	if (!ssl_kex_generate_dhe_params_auto(ks->dhe, ks->key_bits))
171 		return 0;
172 	if ((ks->dhe_peer = DHparams_dup(ks->dhe)) == NULL)
173 		return 0;
174 
175 	return 1;
176 }
177 
178 static int
tls_key_share_generate_ecdhe_ecp(struct tls_key_share * ks)179 tls_key_share_generate_ecdhe_ecp(struct tls_key_share *ks)
180 {
181 	EC_KEY *ecdhe = NULL;
182 	int ret = 0;
183 
184 	if (ks->ecdhe != NULL)
185 		goto err;
186 
187 	if ((ecdhe = EC_KEY_new()) == NULL)
188 		goto err;
189 	if (!ssl_kex_generate_ecdhe_ecp(ecdhe, ks->nid))
190 		goto err;
191 
192 	ks->ecdhe = ecdhe;
193 	ecdhe = NULL;
194 
195 	ret = 1;
196 
197  err:
198 	EC_KEY_free(ecdhe);
199 
200 	return ret;
201 }
202 
203 static int
tls_key_share_generate_x25519(struct tls_key_share * ks)204 tls_key_share_generate_x25519(struct tls_key_share *ks)
205 {
206 	uint8_t *public = NULL, *private = NULL;
207 	int ret = 0;
208 
209 	if (ks->x25519_public != NULL || ks->x25519_private != NULL)
210 		goto err;
211 
212 	if ((public = calloc(1, X25519_KEY_LENGTH)) == NULL)
213 		goto err;
214 	if ((private = calloc(1, X25519_KEY_LENGTH)) == NULL)
215 		goto err;
216 
217 	X25519_keypair(public, private);
218 
219 	ks->x25519_public = public;
220 	ks->x25519_private = private;
221 	public = NULL;
222 	private = NULL;
223 
224 	ret = 1;
225 
226  err:
227 	freezero(public, X25519_KEY_LENGTH);
228 	freezero(private, X25519_KEY_LENGTH);
229 
230 	return ret;
231 }
232 
233 int
tls_key_share_generate(struct tls_key_share * ks)234 tls_key_share_generate(struct tls_key_share *ks)
235 {
236 	if (ks->nid == NID_dhKeyAgreement)
237 		return tls_key_share_generate_dhe(ks);
238 
239 	if (ks->nid == NID_X25519)
240 		return tls_key_share_generate_x25519(ks);
241 
242 	return tls_key_share_generate_ecdhe_ecp(ks);
243 }
244 
245 static int
tls_key_share_params_dhe(struct tls_key_share * ks,CBB * cbb)246 tls_key_share_params_dhe(struct tls_key_share *ks, CBB *cbb)
247 {
248 	if (ks->dhe == NULL)
249 		return 0;
250 
251 	return ssl_kex_params_dhe(ks->dhe, cbb);
252 }
253 
254 int
tls_key_share_params(struct tls_key_share * ks,CBB * cbb)255 tls_key_share_params(struct tls_key_share *ks, CBB *cbb)
256 {
257 	if (ks->nid == NID_dhKeyAgreement)
258 		return tls_key_share_params_dhe(ks, cbb);
259 
260 	return 0;
261 }
262 
263 static int
tls_key_share_public_dhe(struct tls_key_share * ks,CBB * cbb)264 tls_key_share_public_dhe(struct tls_key_share *ks, CBB *cbb)
265 {
266 	if (ks->dhe == NULL)
267 		return 0;
268 
269 	return ssl_kex_public_dhe(ks->dhe, cbb);
270 }
271 
272 static int
tls_key_share_public_ecdhe_ecp(struct tls_key_share * ks,CBB * cbb)273 tls_key_share_public_ecdhe_ecp(struct tls_key_share *ks, CBB *cbb)
274 {
275 	if (ks->ecdhe == NULL)
276 		return 0;
277 
278 	return ssl_kex_public_ecdhe_ecp(ks->ecdhe, cbb);
279 }
280 
281 static int
tls_key_share_public_x25519(struct tls_key_share * ks,CBB * cbb)282 tls_key_share_public_x25519(struct tls_key_share *ks, CBB *cbb)
283 {
284 	if (ks->x25519_public == NULL)
285 		return 0;
286 
287 	return CBB_add_bytes(cbb, ks->x25519_public, X25519_KEY_LENGTH);
288 }
289 
290 int
tls_key_share_public(struct tls_key_share * ks,CBB * cbb)291 tls_key_share_public(struct tls_key_share *ks, CBB *cbb)
292 {
293 	if (ks->nid == NID_dhKeyAgreement)
294 		return tls_key_share_public_dhe(ks, cbb);
295 
296 	if (ks->nid == NID_X25519)
297 		return tls_key_share_public_x25519(ks, cbb);
298 
299 	return tls_key_share_public_ecdhe_ecp(ks, cbb);
300 }
301 
302 static int
tls_key_share_peer_params_dhe(struct tls_key_share * ks,CBS * cbs,int * decode_error,int * invalid_params)303 tls_key_share_peer_params_dhe(struct tls_key_share *ks, CBS *cbs,
304     int *decode_error, int *invalid_params)
305 {
306 	if (ks->dhe != NULL || ks->dhe_peer != NULL)
307 		return 0;
308 
309 	if ((ks->dhe_peer = DH_new()) == NULL)
310 		return 0;
311 	if (!ssl_kex_peer_params_dhe(ks->dhe_peer, cbs, decode_error,
312 	    invalid_params))
313 		return 0;
314 	if ((ks->dhe = DHparams_dup(ks->dhe_peer)) == NULL)
315 		return 0;
316 
317 	return 1;
318 }
319 
320 int
tls_key_share_peer_params(struct tls_key_share * ks,CBS * cbs,int * decode_error,int * invalid_params)321 tls_key_share_peer_params(struct tls_key_share *ks, CBS *cbs,
322     int *decode_error, int *invalid_params)
323 {
324 	if (ks->nid != NID_dhKeyAgreement)
325 		return 0;
326 
327 	return tls_key_share_peer_params_dhe(ks, cbs, decode_error,
328 	     invalid_params);
329 }
330 
331 static int
tls_key_share_peer_public_dhe(struct tls_key_share * ks,CBS * cbs,int * decode_error,int * invalid_key)332 tls_key_share_peer_public_dhe(struct tls_key_share *ks, CBS *cbs,
333     int *decode_error, int *invalid_key)
334 {
335 	if (ks->dhe_peer == NULL)
336 		return 0;
337 
338 	return ssl_kex_peer_public_dhe(ks->dhe_peer, cbs, decode_error,
339 	    invalid_key);
340 }
341 
342 static int
tls_key_share_peer_public_ecdhe_ecp(struct tls_key_share * ks,CBS * cbs)343 tls_key_share_peer_public_ecdhe_ecp(struct tls_key_share *ks, CBS *cbs)
344 {
345 	EC_KEY *ecdhe = NULL;
346 	int ret = 0;
347 
348 	if (ks->ecdhe_peer != NULL)
349 		goto err;
350 
351 	if ((ecdhe = EC_KEY_new()) == NULL)
352 		goto err;
353 	if (!ssl_kex_peer_public_ecdhe_ecp(ecdhe, ks->nid, cbs))
354 		goto err;
355 
356 	ks->ecdhe_peer = ecdhe;
357 	ecdhe = NULL;
358 
359 	ret = 1;
360 
361  err:
362 	EC_KEY_free(ecdhe);
363 
364 	return ret;
365 }
366 
367 static int
tls_key_share_peer_public_x25519(struct tls_key_share * ks,CBS * cbs,int * decode_error)368 tls_key_share_peer_public_x25519(struct tls_key_share *ks, CBS *cbs,
369     int *decode_error)
370 {
371 	size_t out_len;
372 
373 	*decode_error = 0;
374 
375 	if (ks->x25519_peer_public != NULL)
376 		return 0;
377 
378 	if (CBS_len(cbs) != X25519_KEY_LENGTH) {
379 		*decode_error = 1;
380 		return 0;
381 	}
382 
383 	return CBS_stow(cbs, &ks->x25519_peer_public, &out_len);
384 }
385 
386 int
tls_key_share_peer_public(struct tls_key_share * ks,CBS * cbs,int * decode_error,int * invalid_key)387 tls_key_share_peer_public(struct tls_key_share *ks, CBS *cbs, int *decode_error,
388     int *invalid_key)
389 {
390 	*decode_error = 0;
391 
392 	if (invalid_key != NULL)
393 		*invalid_key = 0;
394 
395 	if (ks->nid == NID_dhKeyAgreement)
396 		return tls_key_share_peer_public_dhe(ks, cbs, decode_error,
397 		    invalid_key);
398 
399 	if (ks->nid == NID_X25519)
400 		return tls_key_share_peer_public_x25519(ks, cbs, decode_error);
401 
402 	return tls_key_share_peer_public_ecdhe_ecp(ks, cbs);
403 }
404 
405 static int
tls_key_share_derive_dhe(struct tls_key_share * ks,uint8_t ** shared_key,size_t * shared_key_len)406 tls_key_share_derive_dhe(struct tls_key_share *ks,
407     uint8_t **shared_key, size_t *shared_key_len)
408 {
409 	if (ks->dhe == NULL || ks->dhe_peer == NULL)
410 		return 0;
411 
412 	return ssl_kex_derive_dhe(ks->dhe, ks->dhe_peer, shared_key,
413 	    shared_key_len);
414 }
415 
416 static int
tls_key_share_derive_ecdhe_ecp(struct tls_key_share * ks,uint8_t ** shared_key,size_t * shared_key_len)417 tls_key_share_derive_ecdhe_ecp(struct tls_key_share *ks,
418     uint8_t **shared_key, size_t *shared_key_len)
419 {
420 	if (ks->ecdhe == NULL || ks->ecdhe_peer == NULL)
421 		return 0;
422 
423 	return ssl_kex_derive_ecdhe_ecp(ks->ecdhe, ks->ecdhe_peer,
424 	    shared_key, shared_key_len);
425 }
426 
427 static int
tls_key_share_derive_x25519(struct tls_key_share * ks,uint8_t ** shared_key,size_t * shared_key_len)428 tls_key_share_derive_x25519(struct tls_key_share *ks,
429     uint8_t **shared_key, size_t *shared_key_len)
430 {
431 	uint8_t *sk = NULL;
432 	int ret = 0;
433 
434 	if (ks->x25519_private == NULL || ks->x25519_peer_public == NULL)
435 		goto err;
436 
437 	if ((sk = calloc(1, X25519_KEY_LENGTH)) == NULL)
438 		goto err;
439 	if (!X25519(sk, ks->x25519_private, ks->x25519_peer_public))
440 		goto err;
441 
442 	*shared_key = sk;
443 	*shared_key_len = X25519_KEY_LENGTH;
444 	sk = NULL;
445 
446 	ret = 1;
447 
448  err:
449 	freezero(sk, X25519_KEY_LENGTH);
450 
451 	return ret;
452 }
453 
454 int
tls_key_share_derive(struct tls_key_share * ks,uint8_t ** shared_key,size_t * shared_key_len)455 tls_key_share_derive(struct tls_key_share *ks, uint8_t **shared_key,
456     size_t *shared_key_len)
457 {
458 	if (*shared_key != NULL)
459 		return 0;
460 
461 	*shared_key_len = 0;
462 
463 	if (ks->nid == NID_dhKeyAgreement)
464 		return tls_key_share_derive_dhe(ks, shared_key,
465 		    shared_key_len);
466 
467 	if (ks->nid == NID_X25519)
468 		return tls_key_share_derive_x25519(ks, shared_key,
469 		    shared_key_len);
470 
471 	return tls_key_share_derive_ecdhe_ecp(ks, shared_key,
472 	    shared_key_len);
473 }
474 
475 int
tls_key_share_peer_security(const SSL * ssl,struct tls_key_share * ks)476 tls_key_share_peer_security(const SSL *ssl, struct tls_key_share *ks)
477 {
478 	switch (ks->nid) {
479 	case NID_dhKeyAgreement:
480 		return ssl_security_dh(ssl, ks->dhe_peer);
481 	default:
482 		return 0;
483 	}
484 }
485