1 /* 2 * Copyright 2004-2023 The OpenSSL Project Authors. All Rights Reserved. 3 * Copyright (c) 2004, EdelKey Project. All Rights Reserved. 4 * 5 * Licensed under the Apache License 2.0 (the "License"). You may not use 6 * this file except in compliance with the License. You can obtain a copy 7 * in the file LICENSE in the source distribution or at 8 * https://www.openssl.org/source/license.html 9 * 10 * Originally written by Christophe Renou and Peter Sylvester, 11 * for the EdelKey project. 12 */ 13 14 /* All the SRP APIs in this file are deprecated */ 15 #define OPENSSL_SUPPRESS_DEPRECATED 16 17 #ifndef OPENSSL_NO_SRP 18 # include "internal/cryptlib.h" 19 # include "crypto/evp.h" 20 # include <openssl/sha.h> 21 # include <openssl/srp.h> 22 # include <openssl/evp.h> 23 # include <openssl/buffer.h> 24 # include <openssl/rand.h> 25 # include <openssl/txt_db.h> 26 # include <openssl/err.h> 27 28 # define SRP_RANDOM_SALT_LEN 20 29 # define MAX_LEN 2500 30 31 /* 32 * Note that SRP uses its own variant of base 64 encoding. A different base64 33 * alphabet is used and no padding '=' characters are added. Instead we pad to 34 * the front with 0 bytes and subsequently strip off leading encoded padding. 35 * This variant is used for compatibility with other SRP implementations - 36 * notably libsrp, but also others. It is also required for backwards 37 * compatibility in order to load verifier files from other OpenSSL versions. 38 */ 39 40 /* 41 * Convert a base64 string into raw byte array representation. 42 * Returns the length of the decoded data, or -1 on error. 43 */ 44 static int t_fromb64(unsigned char *a, size_t alen, const char *src) 45 { 46 EVP_ENCODE_CTX *ctx; 47 int outl = 0, outl2 = 0; 48 size_t size, padsize; 49 const unsigned char *pad = (const unsigned char *)"00"; 50 51 while (*src == ' ' || *src == '\t' || *src == '\n') 52 ++src; 53 size = strlen(src); 54 padsize = 4 - (size & 3); 55 padsize &= 3; 56 57 /* Four bytes in src become three bytes output. */ 58 if (size > INT_MAX || ((size + padsize) / 4) * 3 > alen) 59 return -1; 60 61 ctx = EVP_ENCODE_CTX_new(); 62 if (ctx == NULL) 63 return -1; 64 65 /* 66 * This should never occur because 1 byte of data always requires 2 bytes of 67 * encoding, i.e. 68 * 0 bytes unencoded = 0 bytes encoded 69 * 1 byte unencoded = 2 bytes encoded 70 * 2 bytes unencoded = 3 bytes encoded 71 * 3 bytes unencoded = 4 bytes encoded 72 * 4 bytes unencoded = 6 bytes encoded 73 * etc 74 */ 75 if (padsize == 3) { 76 outl = -1; 77 goto err; 78 } 79 80 /* Valid padsize values are now 0, 1 or 2 */ 81 82 EVP_DecodeInit(ctx); 83 evp_encode_ctx_set_flags(ctx, EVP_ENCODE_CTX_USE_SRP_ALPHABET); 84 85 /* Add any encoded padding that is required */ 86 if (padsize != 0 87 && EVP_DecodeUpdate(ctx, a, &outl, pad, padsize) < 0) { 88 outl = -1; 89 goto err; 90 } 91 if (EVP_DecodeUpdate(ctx, a, &outl2, (const unsigned char *)src, size) < 0) { 92 outl = -1; 93 goto err; 94 } 95 outl += outl2; 96 EVP_DecodeFinal(ctx, a + outl, &outl2); 97 outl += outl2; 98 99 /* Strip off the leading padding */ 100 if (padsize != 0) { 101 if ((int)padsize >= outl) { 102 outl = -1; 103 goto err; 104 } 105 106 /* 107 * If we added 1 byte of padding prior to encoding then we have 2 bytes 108 * of "real" data which gets spread across 4 encoded bytes like this: 109 * (6 bits pad)(2 bits pad | 4 bits data)(6 bits data)(6 bits data) 110 * So 1 byte of pre-encoding padding results in 1 full byte of encoded 111 * padding. 112 * If we added 2 bytes of padding prior to encoding this gets encoded 113 * as: 114 * (6 bits pad)(6 bits pad)(4 bits pad | 2 bits data)(6 bits data) 115 * So 2 bytes of pre-encoding padding results in 2 full bytes of encoded 116 * padding, i.e. we have to strip the same number of bytes of padding 117 * from the encoded data as we added to the pre-encoded data. 118 */ 119 memmove(a, a + padsize, outl - padsize); 120 outl -= padsize; 121 } 122 123 err: 124 EVP_ENCODE_CTX_free(ctx); 125 126 return outl; 127 } 128 129 /* 130 * Convert a raw byte string into a null-terminated base64 ASCII string. 131 * Returns 1 on success or 0 on error. 132 */ 133 static int t_tob64(char *dst, const unsigned char *src, int size) 134 { 135 EVP_ENCODE_CTX *ctx = EVP_ENCODE_CTX_new(); 136 int outl = 0, outl2 = 0; 137 unsigned char pad[2] = {0, 0}; 138 size_t leadz = 0; 139 140 if (ctx == NULL) 141 return 0; 142 143 EVP_EncodeInit(ctx); 144 evp_encode_ctx_set_flags(ctx, EVP_ENCODE_CTX_NO_NEWLINES 145 | EVP_ENCODE_CTX_USE_SRP_ALPHABET); 146 147 /* 148 * We pad at the front with zero bytes until the length is a multiple of 3 149 * so that EVP_EncodeUpdate/EVP_EncodeFinal does not add any of its own "=" 150 * padding 151 */ 152 leadz = 3 - (size % 3); 153 if (leadz != 3 154 && !EVP_EncodeUpdate(ctx, (unsigned char *)dst, &outl, pad, 155 leadz)) { 156 EVP_ENCODE_CTX_free(ctx); 157 return 0; 158 } 159 160 if (!EVP_EncodeUpdate(ctx, (unsigned char *)dst + outl, &outl2, src, 161 size)) { 162 EVP_ENCODE_CTX_free(ctx); 163 return 0; 164 } 165 outl += outl2; 166 EVP_EncodeFinal(ctx, (unsigned char *)dst + outl, &outl2); 167 outl += outl2; 168 169 /* Strip the encoded padding at the front */ 170 if (leadz != 3) { 171 memmove(dst, dst + leadz, outl - leadz); 172 dst[outl - leadz] = '\0'; 173 } 174 175 EVP_ENCODE_CTX_free(ctx); 176 return 1; 177 } 178 179 void SRP_user_pwd_free(SRP_user_pwd *user_pwd) 180 { 181 if (user_pwd == NULL) 182 return; 183 BN_free(user_pwd->s); 184 BN_clear_free(user_pwd->v); 185 OPENSSL_free(user_pwd->id); 186 OPENSSL_free(user_pwd->info); 187 OPENSSL_free(user_pwd); 188 } 189 190 SRP_user_pwd *SRP_user_pwd_new(void) 191 { 192 SRP_user_pwd *ret; 193 194 if ((ret = OPENSSL_malloc(sizeof(*ret))) == NULL) { 195 /* ERR_raise(ERR_LIB_SRP, ERR_R_MALLOC_FAILURE); */ /*ckerr_ignore*/ 196 return NULL; 197 } 198 ret->N = NULL; 199 ret->g = NULL; 200 ret->s = NULL; 201 ret->v = NULL; 202 ret->id = NULL; 203 ret->info = NULL; 204 return ret; 205 } 206 207 void SRP_user_pwd_set_gN(SRP_user_pwd *vinfo, const BIGNUM *g, 208 const BIGNUM *N) 209 { 210 vinfo->N = N; 211 vinfo->g = g; 212 } 213 214 int SRP_user_pwd_set1_ids(SRP_user_pwd *vinfo, const char *id, 215 const char *info) 216 { 217 OPENSSL_free(vinfo->id); 218 OPENSSL_free(vinfo->info); 219 if (id != NULL && NULL == (vinfo->id = OPENSSL_strdup(id))) 220 return 0; 221 return (info == NULL || NULL != (vinfo->info = OPENSSL_strdup(info))); 222 } 223 224 static int SRP_user_pwd_set_sv(SRP_user_pwd *vinfo, const char *s, 225 const char *v) 226 { 227 unsigned char tmp[MAX_LEN]; 228 int len; 229 230 vinfo->v = NULL; 231 vinfo->s = NULL; 232 233 len = t_fromb64(tmp, sizeof(tmp), v); 234 if (len < 0) 235 return 0; 236 if (NULL == (vinfo->v = BN_bin2bn(tmp, len, NULL))) 237 return 0; 238 len = t_fromb64(tmp, sizeof(tmp), s); 239 if (len < 0) 240 goto err; 241 vinfo->s = BN_bin2bn(tmp, len, NULL); 242 if (vinfo->s == NULL) 243 goto err; 244 return 1; 245 err: 246 BN_free(vinfo->v); 247 vinfo->v = NULL; 248 return 0; 249 } 250 251 int SRP_user_pwd_set0_sv(SRP_user_pwd *vinfo, BIGNUM *s, BIGNUM *v) 252 { 253 BN_free(vinfo->s); 254 BN_clear_free(vinfo->v); 255 vinfo->v = v; 256 vinfo->s = s; 257 return (vinfo->s != NULL && vinfo->v != NULL); 258 } 259 260 static SRP_user_pwd *srp_user_pwd_dup(SRP_user_pwd *src) 261 { 262 SRP_user_pwd *ret; 263 264 if (src == NULL) 265 return NULL; 266 if ((ret = SRP_user_pwd_new()) == NULL) 267 return NULL; 268 269 SRP_user_pwd_set_gN(ret, src->g, src->N); 270 if (!SRP_user_pwd_set1_ids(ret, src->id, src->info) 271 || !SRP_user_pwd_set0_sv(ret, BN_dup(src->s), BN_dup(src->v))) { 272 SRP_user_pwd_free(ret); 273 return NULL; 274 } 275 return ret; 276 } 277 278 SRP_VBASE *SRP_VBASE_new(char *seed_key) 279 { 280 SRP_VBASE *vb = OPENSSL_malloc(sizeof(*vb)); 281 282 if (vb == NULL) 283 return NULL; 284 if ((vb->users_pwd = sk_SRP_user_pwd_new_null()) == NULL 285 || (vb->gN_cache = sk_SRP_gN_cache_new_null()) == NULL) { 286 sk_SRP_user_pwd_free(vb->users_pwd); 287 OPENSSL_free(vb); 288 return NULL; 289 } 290 vb->default_g = NULL; 291 vb->default_N = NULL; 292 vb->seed_key = NULL; 293 if ((seed_key != NULL) && (vb->seed_key = OPENSSL_strdup(seed_key)) == NULL) { 294 sk_SRP_user_pwd_free(vb->users_pwd); 295 sk_SRP_gN_cache_free(vb->gN_cache); 296 OPENSSL_free(vb); 297 return NULL; 298 } 299 return vb; 300 } 301 302 void SRP_VBASE_free(SRP_VBASE *vb) 303 { 304 if (!vb) 305 return; 306 sk_SRP_user_pwd_pop_free(vb->users_pwd, SRP_user_pwd_free); 307 sk_SRP_gN_cache_free(vb->gN_cache); 308 OPENSSL_free(vb->seed_key); 309 OPENSSL_free(vb); 310 } 311 312 static SRP_gN_cache *SRP_gN_new_init(const char *ch) 313 { 314 unsigned char tmp[MAX_LEN]; 315 int len; 316 SRP_gN_cache *newgN = OPENSSL_malloc(sizeof(*newgN)); 317 318 if (newgN == NULL) 319 return NULL; 320 321 len = t_fromb64(tmp, sizeof(tmp), ch); 322 if (len < 0) 323 goto err; 324 325 if ((newgN->b64_bn = OPENSSL_strdup(ch)) == NULL) 326 goto err; 327 328 if ((newgN->bn = BN_bin2bn(tmp, len, NULL))) 329 return newgN; 330 331 OPENSSL_free(newgN->b64_bn); 332 err: 333 OPENSSL_free(newgN); 334 return NULL; 335 } 336 337 static void SRP_gN_free(SRP_gN_cache *gN_cache) 338 { 339 if (gN_cache == NULL) 340 return; 341 OPENSSL_free(gN_cache->b64_bn); 342 BN_free(gN_cache->bn); 343 OPENSSL_free(gN_cache); 344 } 345 346 static SRP_gN *SRP_get_gN_by_id(const char *id, STACK_OF(SRP_gN) *gN_tab) 347 { 348 int i; 349 350 SRP_gN *gN; 351 if (gN_tab != NULL) { 352 for (i = 0; i < sk_SRP_gN_num(gN_tab); i++) { 353 gN = sk_SRP_gN_value(gN_tab, i); 354 if (gN && (id == NULL || strcmp(gN->id, id) == 0)) 355 return gN; 356 } 357 } 358 359 return SRP_get_default_gN(id); 360 } 361 362 static BIGNUM *SRP_gN_place_bn(STACK_OF(SRP_gN_cache) *gN_cache, char *ch) 363 { 364 int i; 365 if (gN_cache == NULL) 366 return NULL; 367 368 /* search if we have already one... */ 369 for (i = 0; i < sk_SRP_gN_cache_num(gN_cache); i++) { 370 SRP_gN_cache *cache = sk_SRP_gN_cache_value(gN_cache, i); 371 if (strcmp(cache->b64_bn, ch) == 0) 372 return cache->bn; 373 } 374 { /* it is the first time that we find it */ 375 SRP_gN_cache *newgN = SRP_gN_new_init(ch); 376 if (newgN) { 377 if (sk_SRP_gN_cache_insert(gN_cache, newgN, 0) > 0) 378 return newgN->bn; 379 SRP_gN_free(newgN); 380 } 381 } 382 return NULL; 383 } 384 385 /* 386 * This function parses the verifier file generated by the srp app. 387 * The format for each entry is: 388 * V base64(verifier) base64(salt) username gNid userinfo(optional) 389 * or 390 * I base64(N) base64(g) 391 * Note that base64 is the SRP variant of base64 encoding described 392 * in t_fromb64(). 393 */ 394 395 int SRP_VBASE_init(SRP_VBASE *vb, char *verifier_file) 396 { 397 int error_code; 398 STACK_OF(SRP_gN) *SRP_gN_tab = sk_SRP_gN_new_null(); 399 char *last_index = NULL; 400 int i; 401 char **pp; 402 403 SRP_gN *gN = NULL; 404 SRP_user_pwd *user_pwd = NULL; 405 406 TXT_DB *tmpdb = NULL; 407 BIO *in = BIO_new(BIO_s_file()); 408 409 error_code = SRP_ERR_OPEN_FILE; 410 411 if (in == NULL || BIO_read_filename(in, verifier_file) <= 0) 412 goto err; 413 414 error_code = SRP_ERR_VBASE_INCOMPLETE_FILE; 415 416 if ((tmpdb = TXT_DB_read(in, DB_NUMBER)) == NULL) 417 goto err; 418 419 error_code = SRP_ERR_MEMORY; 420 421 if (vb->seed_key) { 422 last_index = SRP_get_default_gN(NULL)->id; 423 } 424 for (i = 0; i < sk_OPENSSL_PSTRING_num(tmpdb->data); i++) { 425 pp = sk_OPENSSL_PSTRING_value(tmpdb->data, i); 426 if (pp[DB_srptype][0] == DB_SRP_INDEX) { 427 /* 428 * we add this couple in the internal Stack 429 */ 430 431 if ((gN = OPENSSL_malloc(sizeof(*gN))) == NULL) 432 goto err; 433 434 if ((gN->id = OPENSSL_strdup(pp[DB_srpid])) == NULL 435 || (gN->N = SRP_gN_place_bn(vb->gN_cache, pp[DB_srpverifier])) 436 == NULL 437 || (gN->g = SRP_gN_place_bn(vb->gN_cache, pp[DB_srpsalt])) 438 == NULL 439 || sk_SRP_gN_insert(SRP_gN_tab, gN, 0) == 0) 440 goto err; 441 442 gN = NULL; 443 444 if (vb->seed_key != NULL) { 445 last_index = pp[DB_srpid]; 446 } 447 } else if (pp[DB_srptype][0] == DB_SRP_VALID) { 448 /* it is a user .... */ 449 const SRP_gN *lgN; 450 451 if ((lgN = SRP_get_gN_by_id(pp[DB_srpgN], SRP_gN_tab)) != NULL) { 452 error_code = SRP_ERR_MEMORY; 453 if ((user_pwd = SRP_user_pwd_new()) == NULL) 454 goto err; 455 456 SRP_user_pwd_set_gN(user_pwd, lgN->g, lgN->N); 457 if (!SRP_user_pwd_set1_ids 458 (user_pwd, pp[DB_srpid], pp[DB_srpinfo])) 459 goto err; 460 461 error_code = SRP_ERR_VBASE_BN_LIB; 462 if (!SRP_user_pwd_set_sv 463 (user_pwd, pp[DB_srpsalt], pp[DB_srpverifier])) 464 goto err; 465 466 if (sk_SRP_user_pwd_insert(vb->users_pwd, user_pwd, 0) == 0) 467 goto err; 468 user_pwd = NULL; /* abandon responsibility */ 469 } 470 } 471 } 472 473 if (last_index != NULL) { 474 /* this means that we want to simulate a default user */ 475 476 if (((gN = SRP_get_gN_by_id(last_index, SRP_gN_tab)) == NULL)) { 477 error_code = SRP_ERR_VBASE_BN_LIB; 478 goto err; 479 } 480 vb->default_g = gN->g; 481 vb->default_N = gN->N; 482 gN = NULL; 483 } 484 error_code = SRP_NO_ERROR; 485 486 err: 487 /* 488 * there may be still some leaks to fix, if this fails, the application 489 * terminates most likely 490 */ 491 492 if (gN != NULL) { 493 OPENSSL_free(gN->id); 494 OPENSSL_free(gN); 495 } 496 497 SRP_user_pwd_free(user_pwd); 498 499 TXT_DB_free(tmpdb); 500 BIO_free_all(in); 501 502 sk_SRP_gN_free(SRP_gN_tab); 503 504 return error_code; 505 506 } 507 508 static SRP_user_pwd *find_user(SRP_VBASE *vb, char *username) 509 { 510 int i; 511 SRP_user_pwd *user; 512 513 if (vb == NULL) 514 return NULL; 515 516 for (i = 0; i < sk_SRP_user_pwd_num(vb->users_pwd); i++) { 517 user = sk_SRP_user_pwd_value(vb->users_pwd, i); 518 if (strcmp(user->id, username) == 0) 519 return user; 520 } 521 522 return NULL; 523 } 524 525 int SRP_VBASE_add0_user(SRP_VBASE *vb, SRP_user_pwd *user_pwd) 526 { 527 if (sk_SRP_user_pwd_push(vb->users_pwd, user_pwd) <= 0) 528 return 0; 529 return 1; 530 } 531 532 # ifndef OPENSSL_NO_DEPRECATED_1_1_0 533 /* 534 * DEPRECATED: use SRP_VBASE_get1_by_user instead. 535 * This method ignores the configured seed and fails for an unknown user. 536 * Ownership of the returned pointer is not released to the caller. 537 * In other words, caller must not free the result. 538 */ 539 SRP_user_pwd *SRP_VBASE_get_by_user(SRP_VBASE *vb, char *username) 540 { 541 return find_user(vb, username); 542 } 543 # endif 544 545 /* 546 * Ownership of the returned pointer is released to the caller. 547 * In other words, caller must free the result once done. 548 */ 549 SRP_user_pwd *SRP_VBASE_get1_by_user(SRP_VBASE *vb, char *username) 550 { 551 SRP_user_pwd *user; 552 unsigned char digv[SHA_DIGEST_LENGTH]; 553 unsigned char digs[SHA_DIGEST_LENGTH]; 554 EVP_MD_CTX *ctxt = NULL; 555 EVP_MD *md = NULL; 556 557 if (vb == NULL) 558 return NULL; 559 560 if ((user = find_user(vb, username)) != NULL) 561 return srp_user_pwd_dup(user); 562 563 if ((vb->seed_key == NULL) || 564 (vb->default_g == NULL) || (vb->default_N == NULL)) 565 return NULL; 566 567 /* if the user is unknown we set parameters as well if we have a seed_key */ 568 569 if ((user = SRP_user_pwd_new()) == NULL) 570 return NULL; 571 572 SRP_user_pwd_set_gN(user, vb->default_g, vb->default_N); 573 574 if (!SRP_user_pwd_set1_ids(user, username, NULL)) 575 goto err; 576 577 if (RAND_priv_bytes(digv, SHA_DIGEST_LENGTH) <= 0) 578 goto err; 579 md = EVP_MD_fetch(NULL, SN_sha1, NULL); 580 if (md == NULL) 581 goto err; 582 ctxt = EVP_MD_CTX_new(); 583 if (ctxt == NULL 584 || !EVP_DigestInit_ex(ctxt, md, NULL) 585 || !EVP_DigestUpdate(ctxt, vb->seed_key, strlen(vb->seed_key)) 586 || !EVP_DigestUpdate(ctxt, username, strlen(username)) 587 || !EVP_DigestFinal_ex(ctxt, digs, NULL)) 588 goto err; 589 EVP_MD_CTX_free(ctxt); 590 ctxt = NULL; 591 EVP_MD_free(md); 592 md = NULL; 593 if (SRP_user_pwd_set0_sv(user, 594 BN_bin2bn(digs, SHA_DIGEST_LENGTH, NULL), 595 BN_bin2bn(digv, SHA_DIGEST_LENGTH, NULL))) 596 return user; 597 598 err: 599 EVP_MD_free(md); 600 EVP_MD_CTX_free(ctxt); 601 SRP_user_pwd_free(user); 602 return NULL; 603 } 604 605 /* 606 * create a verifier (*salt,*verifier,g and N are in base64) 607 */ 608 char *SRP_create_verifier_ex(const char *user, const char *pass, char **salt, 609 char **verifier, const char *N, const char *g, 610 OSSL_LIB_CTX *libctx, const char *propq) 611 { 612 int len; 613 char *result = NULL, *vf = NULL; 614 const BIGNUM *N_bn = NULL, *g_bn = NULL; 615 BIGNUM *N_bn_alloc = NULL, *g_bn_alloc = NULL, *s = NULL, *v = NULL; 616 unsigned char tmp[MAX_LEN]; 617 unsigned char tmp2[MAX_LEN]; 618 char *defgNid = NULL; 619 int vfsize = 0; 620 621 if ((user == NULL) || 622 (pass == NULL) || (salt == NULL) || (verifier == NULL)) 623 goto err; 624 625 if (N) { 626 if ((len = t_fromb64(tmp, sizeof(tmp), N)) <= 0) 627 goto err; 628 N_bn_alloc = BN_bin2bn(tmp, len, NULL); 629 if (N_bn_alloc == NULL) 630 goto err; 631 N_bn = N_bn_alloc; 632 if ((len = t_fromb64(tmp, sizeof(tmp) ,g)) <= 0) 633 goto err; 634 g_bn_alloc = BN_bin2bn(tmp, len, NULL); 635 if (g_bn_alloc == NULL) 636 goto err; 637 g_bn = g_bn_alloc; 638 defgNid = "*"; 639 } else { 640 SRP_gN *gN = SRP_get_default_gN(g); 641 if (gN == NULL) 642 goto err; 643 N_bn = gN->N; 644 g_bn = gN->g; 645 defgNid = gN->id; 646 } 647 648 if (*salt == NULL) { 649 if (RAND_bytes_ex(libctx, tmp2, SRP_RANDOM_SALT_LEN, 0) <= 0) 650 goto err; 651 652 s = BN_bin2bn(tmp2, SRP_RANDOM_SALT_LEN, NULL); 653 } else { 654 if ((len = t_fromb64(tmp2, sizeof(tmp2), *salt)) <= 0) 655 goto err; 656 s = BN_bin2bn(tmp2, len, NULL); 657 } 658 if (s == NULL) 659 goto err; 660 661 if (!SRP_create_verifier_BN_ex(user, pass, &s, &v, N_bn, g_bn, libctx, 662 propq)) 663 goto err; 664 665 if (BN_bn2bin(v, tmp) < 0) 666 goto err; 667 vfsize = BN_num_bytes(v) * 2; 668 if (((vf = OPENSSL_malloc(vfsize)) == NULL)) 669 goto err; 670 if (!t_tob64(vf, tmp, BN_num_bytes(v))) 671 goto err; 672 673 if (*salt == NULL) { 674 char *tmp_salt; 675 676 if ((tmp_salt = OPENSSL_malloc(SRP_RANDOM_SALT_LEN * 2)) == NULL) { 677 goto err; 678 } 679 if (!t_tob64(tmp_salt, tmp2, SRP_RANDOM_SALT_LEN)) { 680 OPENSSL_free(tmp_salt); 681 goto err; 682 } 683 *salt = tmp_salt; 684 } 685 686 *verifier = vf; 687 vf = NULL; 688 result = defgNid; 689 690 err: 691 BN_free(N_bn_alloc); 692 BN_free(g_bn_alloc); 693 OPENSSL_clear_free(vf, vfsize); 694 BN_clear_free(s); 695 BN_clear_free(v); 696 return result; 697 } 698 699 char *SRP_create_verifier(const char *user, const char *pass, char **salt, 700 char **verifier, const char *N, const char *g) 701 { 702 return SRP_create_verifier_ex(user, pass, salt, verifier, N, g, NULL, NULL); 703 } 704 705 /* 706 * create a verifier (*salt,*verifier,g and N are BIGNUMs). If *salt != NULL 707 * then the provided salt will be used. On successful exit *verifier will point 708 * to a newly allocated BIGNUM containing the verifier and (if a salt was not 709 * provided) *salt will be populated with a newly allocated BIGNUM containing a 710 * random salt. 711 * The caller is responsible for freeing the allocated *salt and *verifier 712 * BIGNUMS. 713 */ 714 int SRP_create_verifier_BN_ex(const char *user, const char *pass, BIGNUM **salt, 715 BIGNUM **verifier, const BIGNUM *N, 716 const BIGNUM *g, OSSL_LIB_CTX *libctx, 717 const char *propq) 718 { 719 int result = 0; 720 BIGNUM *x = NULL; 721 BN_CTX *bn_ctx = BN_CTX_new_ex(libctx); 722 unsigned char tmp2[MAX_LEN]; 723 BIGNUM *salttmp = NULL, *verif; 724 725 if ((user == NULL) || 726 (pass == NULL) || 727 (salt == NULL) || 728 (verifier == NULL) || (N == NULL) || (g == NULL) || (bn_ctx == NULL)) 729 goto err; 730 731 if (*salt == NULL) { 732 if (RAND_bytes_ex(libctx, tmp2, SRP_RANDOM_SALT_LEN, 0) <= 0) 733 goto err; 734 735 salttmp = BN_bin2bn(tmp2, SRP_RANDOM_SALT_LEN, NULL); 736 if (salttmp == NULL) 737 goto err; 738 } else { 739 salttmp = *salt; 740 } 741 742 x = SRP_Calc_x_ex(salttmp, user, pass, libctx, propq); 743 if (x == NULL) 744 goto err; 745 746 verif = BN_new(); 747 if (verif == NULL) 748 goto err; 749 750 if (!BN_mod_exp(verif, g, x, N, bn_ctx)) { 751 BN_clear_free(verif); 752 goto err; 753 } 754 755 result = 1; 756 *salt = salttmp; 757 *verifier = verif; 758 759 err: 760 if (salt != NULL && *salt != salttmp) 761 BN_clear_free(salttmp); 762 BN_clear_free(x); 763 BN_CTX_free(bn_ctx); 764 return result; 765 } 766 767 int SRP_create_verifier_BN(const char *user, const char *pass, BIGNUM **salt, 768 BIGNUM **verifier, const BIGNUM *N, 769 const BIGNUM *g) 770 { 771 return SRP_create_verifier_BN_ex(user, pass, salt, verifier, N, g, NULL, 772 NULL); 773 } 774 #endif 775