1 /* $OpenBSD: dh_ameth.c,v 1.40 2024/01/04 17:01:26 tb Exp $ */ 2 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL 3 * project 2006. 4 */ 5 /* ==================================================================== 6 * Copyright (c) 2006 The OpenSSL Project. All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in 17 * the documentation and/or other materials provided with the 18 * distribution. 19 * 20 * 3. All advertising materials mentioning features or use of this 21 * software must display the following acknowledgment: 22 * "This product includes software developed by the OpenSSL Project 23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" 24 * 25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 26 * endorse or promote products derived from this software without 27 * prior written permission. For written permission, please contact 28 * licensing@OpenSSL.org. 29 * 30 * 5. Products derived from this software may not be called "OpenSSL" 31 * nor may "OpenSSL" appear in their names without prior written 32 * permission of the OpenSSL Project. 33 * 34 * 6. Redistributions of any form whatsoever must retain the following 35 * acknowledgment: 36 * "This product includes software developed by the OpenSSL Project 37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" 38 * 39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 50 * OF THE POSSIBILITY OF SUCH DAMAGE. 51 * ==================================================================== 52 * 53 * This product includes cryptographic software written by Eric Young 54 * (eay@cryptsoft.com). This product includes software written by Tim 55 * Hudson (tjh@cryptsoft.com). 56 * 57 */ 58 59 #include <stdio.h> 60 61 #include <openssl/asn1.h> 62 #include <openssl/bn.h> 63 #include <openssl/dh.h> 64 #include <openssl/err.h> 65 #include <openssl/x509.h> 66 67 #include "asn1_local.h" 68 #include "bn_local.h" 69 #include "dh_local.h" 70 #include "evp_local.h" 71 72 static void 73 dh_free(EVP_PKEY *pkey) 74 { 75 DH_free(pkey->pkey.dh); 76 } 77 78 static int 79 dh_pub_decode(EVP_PKEY *pkey, X509_PUBKEY *pubkey) 80 { 81 X509_ALGOR *algor; 82 int ptype; 83 const void *pval; 84 const ASN1_STRING *astr; 85 const unsigned char *key, *params, *p; 86 int key_len, params_len; 87 ASN1_INTEGER *aint = NULL; 88 DH *dh = NULL; 89 int ret = 0; 90 91 if (!X509_PUBKEY_get0_param(NULL, &key, &key_len, &algor, pubkey)) 92 goto err; 93 X509_ALGOR_get0(NULL, &ptype, &pval, algor); 94 95 if (ptype != V_ASN1_SEQUENCE) { 96 DHerror(DH_R_PARAMETER_ENCODING_ERROR); 97 goto err; 98 } 99 100 astr = pval; 101 params = astr->data; 102 params_len = astr->length; 103 104 p = params; 105 if ((dh = d2i_DHparams(NULL, &p, params_len)) == NULL) { 106 DHerror(DH_R_DECODE_ERROR); 107 goto err; 108 } 109 p = key; 110 if ((aint = d2i_ASN1_INTEGER(NULL, &p, key_len)) == NULL) { 111 DHerror(DH_R_DECODE_ERROR); 112 goto err; 113 } 114 BN_free(dh->pub_key); 115 if ((dh->pub_key = ASN1_INTEGER_to_BN(aint, NULL)) == NULL) { 116 DHerror(DH_R_BN_DECODE_ERROR); 117 goto err; 118 } 119 120 if (!EVP_PKEY_assign_DH(pkey, dh)) 121 goto err; 122 dh = NULL; 123 124 ret = 1; 125 126 err: 127 ASN1_INTEGER_free(aint); 128 DH_free(dh); 129 130 return ret; 131 } 132 133 static int 134 dh_pub_encode(X509_PUBKEY *pk, const EVP_PKEY *pkey) 135 { 136 const DH *dh = pkey->pkey.dh; 137 ASN1_STRING *astr = NULL; 138 int ptype = V_ASN1_SEQUENCE; 139 ASN1_INTEGER *aint = NULL; 140 ASN1_OBJECT *aobj; 141 unsigned char *params = NULL, *key = NULL; 142 int params_len = 0, key_len = 0; 143 int ret = 0; 144 145 if ((params_len = i2d_DHparams(dh, ¶ms)) <= 0) { 146 DHerror(ERR_R_MALLOC_FAILURE); 147 params_len = 0; 148 goto err; 149 } 150 if ((astr = ASN1_STRING_new()) == NULL) { 151 DHerror(ERR_R_MALLOC_FAILURE); 152 goto err; 153 } 154 ASN1_STRING_set0(astr, params, params_len); 155 params = NULL; 156 params_len = 0; 157 158 if ((aint = BN_to_ASN1_INTEGER(dh->pub_key, NULL)) == NULL) 159 goto err; 160 if ((key_len = i2d_ASN1_INTEGER(aint, &key)) <= 0) { 161 DHerror(ERR_R_MALLOC_FAILURE); 162 key_len = 0; 163 goto err; 164 } 165 166 if ((aobj = OBJ_nid2obj(EVP_PKEY_DH)) == NULL) 167 goto err; 168 if (!X509_PUBKEY_set0_param(pk, aobj, ptype, astr, key, key_len)) 169 goto err; 170 astr = NULL; 171 key = NULL; 172 key_len = 0; 173 174 ret = 1; 175 176 err: 177 ASN1_STRING_free(astr); 178 ASN1_INTEGER_free(aint); 179 freezero(params, params_len); 180 freezero(key, key_len); 181 182 return ret; 183 } 184 185 /* 186 * PKCS#8 DH is defined in PKCS#11 of all places. It is similar to DH in 187 * that the AlgorithmIdentifier contains the parameters, the private key 188 * is explcitly included and the pubkey must be recalculated. 189 */ 190 191 static int 192 dh_priv_decode(EVP_PKEY *pkey, const PKCS8_PRIV_KEY_INFO *p8) 193 { 194 const X509_ALGOR *algor; 195 int ptype; 196 const void *pval; 197 const ASN1_STRING *astr; 198 const unsigned char *key, *params, *p; 199 int key_len, params_len; 200 ASN1_INTEGER *aint = NULL; 201 DH *dh = NULL; 202 int ret = 0; 203 204 if (!PKCS8_pkey_get0(NULL, &key, &key_len, &algor, p8)) 205 goto err; 206 X509_ALGOR_get0(NULL, &ptype, &pval, algor); 207 208 if (ptype != V_ASN1_SEQUENCE) { 209 DHerror(DH_R_PARAMETER_ENCODING_ERROR); 210 goto err; 211 } 212 213 astr = pval; 214 params = astr->data; 215 params_len = astr->length; 216 217 p = params; 218 if ((dh = d2i_DHparams(NULL, &p, params_len)) == NULL) { 219 DHerror(DH_R_DECODE_ERROR); 220 goto err; 221 } 222 p = key; 223 if ((aint = d2i_ASN1_INTEGER(NULL, &p, key_len)) == NULL) { 224 DHerror(DH_R_DECODE_ERROR); 225 goto err; 226 } 227 BN_free(dh->priv_key); 228 if ((dh->priv_key = ASN1_INTEGER_to_BN(aint, NULL)) == NULL) { 229 DHerror(DH_R_BN_DECODE_ERROR); 230 goto err; 231 } 232 if (!DH_generate_key(dh)) 233 goto err; 234 235 if (!EVP_PKEY_assign_DH(pkey, dh)) 236 goto err; 237 dh = NULL; 238 239 ret = 1; 240 241 err: 242 ASN1_INTEGER_free(aint); 243 DH_free(dh); 244 245 return ret; 246 } 247 248 static int 249 dh_priv_encode(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pkey) 250 { 251 const DH *dh = pkey->pkey.dh; 252 ASN1_STRING *astr = NULL; 253 int ptype = V_ASN1_SEQUENCE; 254 ASN1_INTEGER *aint = NULL; 255 ASN1_OBJECT *aobj; 256 unsigned char *params = NULL, *key = NULL; 257 int params_len = 0, key_len = 0; 258 int ret = 0; 259 260 if ((params_len = i2d_DHparams(dh, ¶ms)) <= 0) { 261 DHerror(ERR_R_MALLOC_FAILURE); 262 params_len = 0; 263 goto err; 264 } 265 if ((astr = ASN1_STRING_type_new(V_ASN1_SEQUENCE)) == NULL) { 266 DHerror(ERR_R_MALLOC_FAILURE); 267 goto err; 268 } 269 ASN1_STRING_set0(astr, params, params_len); 270 params = NULL; 271 params_len = 0; 272 273 if ((aint = BN_to_ASN1_INTEGER(dh->priv_key, NULL)) == NULL) { 274 DHerror(DH_R_BN_ERROR); 275 goto err; 276 } 277 if ((key_len = i2d_ASN1_INTEGER(aint, &key)) <= 0) { 278 DHerror(ERR_R_MALLOC_FAILURE); 279 key_len = 0; 280 goto err; 281 } 282 283 if ((aobj = OBJ_nid2obj(NID_dhKeyAgreement)) == NULL) 284 goto err; 285 if (!PKCS8_pkey_set0(p8, aobj, 0, ptype, astr, key, key_len)) 286 goto err; 287 astr = NULL; 288 key = NULL; 289 key_len = 0; 290 291 ret = 1; 292 293 err: 294 ASN1_STRING_free(astr); 295 ASN1_INTEGER_free(aint); 296 freezero(params, params_len); 297 freezero(key, key_len); 298 299 return ret; 300 } 301 302 static int 303 dh_param_decode(EVP_PKEY *pkey, const unsigned char **params, int params_len) 304 { 305 DH *dh = NULL; 306 int ret = 0; 307 308 if ((dh = d2i_DHparams(NULL, params, params_len)) == NULL) { 309 DHerror(ERR_R_DH_LIB); 310 goto err; 311 } 312 if (!EVP_PKEY_assign_DH(pkey, dh)) 313 goto err; 314 dh = NULL; 315 316 ret = 1; 317 318 err: 319 DH_free(dh); 320 321 return ret; 322 } 323 324 static int 325 dh_param_encode(const EVP_PKEY *pkey, unsigned char **params) 326 { 327 return i2d_DHparams(pkey->pkey.dh, params); 328 } 329 330 static int 331 do_dh_print(BIO *bp, const DH *x, int indent, ASN1_PCTX *ctx, int ptype) 332 { 333 int reason = ERR_R_BUF_LIB, ret = 0; 334 const char *ktype = NULL; 335 BIGNUM *priv_key, *pub_key; 336 337 if (ptype == 2) 338 priv_key = x->priv_key; 339 else 340 priv_key = NULL; 341 342 if (ptype > 0) 343 pub_key = x->pub_key; 344 else 345 pub_key = NULL; 346 347 if (ptype == 2) 348 ktype = "PKCS#3 DH Private-Key"; 349 else if (ptype == 1) 350 ktype = "PKCS#3 DH Public-Key"; 351 else 352 ktype = "PKCS#3 DH Parameters"; 353 354 if (x->p == NULL) { 355 reason = ERR_R_PASSED_NULL_PARAMETER; 356 goto err; 357 } 358 359 if (!BIO_indent(bp, indent, 128)) 360 goto err; 361 if (BIO_printf(bp, "%s: (%d bit)\n", ktype, BN_num_bits(x->p)) <= 0) 362 goto err; 363 indent += 4; 364 365 if (!bn_printf(bp, priv_key, indent, "private-key:")) 366 goto err; 367 if (!bn_printf(bp, pub_key, indent, "public-key:")) 368 goto err; 369 370 if (!bn_printf(bp, x->p, indent, "prime:")) 371 goto err; 372 if (!bn_printf(bp, x->g, indent, "generator:")) 373 goto err; 374 if (x->length != 0) { 375 if (!BIO_indent(bp, indent, 128)) 376 goto err; 377 if (BIO_printf(bp, "recommended-private-length: %d bits\n", 378 (int)x->length) <= 0) 379 goto err; 380 } 381 382 ret = 1; 383 if (0) { 384 err: 385 DHerror(reason); 386 } 387 return(ret); 388 } 389 390 static int 391 dh_size(const EVP_PKEY *pkey) 392 { 393 return DH_size(pkey->pkey.dh); 394 } 395 396 static int 397 dh_bits(const EVP_PKEY *pkey) 398 { 399 return BN_num_bits(pkey->pkey.dh->p); 400 } 401 402 static int 403 dh_security_bits(const EVP_PKEY *pkey) 404 { 405 return DH_security_bits(pkey->pkey.dh); 406 } 407 408 static int 409 dh_cmp_parameters(const EVP_PKEY *a, const EVP_PKEY *b) 410 { 411 if (BN_cmp(a->pkey.dh->p, b->pkey.dh->p) || 412 BN_cmp(a->pkey.dh->g, b->pkey.dh->g)) 413 return 0; 414 else 415 return 1; 416 } 417 418 static int 419 dh_copy_parameters(EVP_PKEY *to, const EVP_PKEY *from) 420 { 421 BIGNUM *a; 422 423 if ((a = BN_dup(from->pkey.dh->p)) == NULL) 424 return 0; 425 BN_free(to->pkey.dh->p); 426 to->pkey.dh->p = a; 427 428 if ((a = BN_dup(from->pkey.dh->g)) == NULL) 429 return 0; 430 BN_free(to->pkey.dh->g); 431 to->pkey.dh->g = a; 432 433 return 1; 434 } 435 436 static int 437 dh_missing_parameters(const EVP_PKEY *pkey) 438 { 439 const DH *dh = pkey->pkey.dh; 440 441 return dh->p == NULL || dh->g == NULL; 442 } 443 444 static int 445 dh_pub_cmp(const EVP_PKEY *a, const EVP_PKEY *b) 446 { 447 if (dh_cmp_parameters(a, b) == 0) 448 return 0; 449 if (BN_cmp(b->pkey.dh->pub_key, a->pkey.dh->pub_key) != 0) 450 return 0; 451 else 452 return 1; 453 } 454 455 static int 456 dh_param_print(BIO *bp, const EVP_PKEY *pkey, int indent, ASN1_PCTX *ctx) 457 { 458 return do_dh_print(bp, pkey->pkey.dh, indent, ctx, 0); 459 } 460 461 static int 462 dh_public_print(BIO *bp, const EVP_PKEY *pkey, int indent, ASN1_PCTX *ctx) 463 { 464 return do_dh_print(bp, pkey->pkey.dh, indent, ctx, 1); 465 } 466 467 static int 468 dh_private_print(BIO *bp, const EVP_PKEY *pkey, int indent, ASN1_PCTX *ctx) 469 { 470 return do_dh_print(bp, pkey->pkey.dh, indent, ctx, 2); 471 } 472 473 int 474 DHparams_print(BIO *bp, const DH *x) 475 { 476 return do_dh_print(bp, x, 4, NULL, 0); 477 } 478 LCRYPTO_ALIAS(DHparams_print); 479 480 int 481 DHparams_print_fp(FILE *fp, const DH *x) 482 { 483 BIO *b; 484 int ret; 485 486 if ((b = BIO_new(BIO_s_file())) == NULL) { 487 DHerror(ERR_R_BUF_LIB); 488 return 0; 489 } 490 491 BIO_set_fp(b, fp, BIO_NOCLOSE); 492 ret = DHparams_print(b, x); 493 BIO_free(b); 494 495 return ret; 496 } 497 LCRYPTO_ALIAS(DHparams_print_fp); 498 499 static int 500 dh_pkey_public_check(const EVP_PKEY *pkey) 501 { 502 DH *dh = pkey->pkey.dh; 503 504 if (dh->pub_key == NULL) { 505 DHerror(DH_R_MISSING_PUBKEY); 506 return 0; 507 } 508 509 return DH_check_pub_key_ex(dh, dh->pub_key); 510 } 511 512 static int 513 dh_pkey_param_check(const EVP_PKEY *pkey) 514 { 515 DH *dh = pkey->pkey.dh; 516 517 /* 518 * It would have made more sense to support EVP_PKEY_check() for DH 519 * keys and call DH_check_ex() there and keeping this as a wrapper 520 * for DH_param_check_ex(). We follow OpenSSL's choice. 521 */ 522 return DH_check_ex(dh); 523 } 524 525 const EVP_PKEY_ASN1_METHOD dh_asn1_meth = { 526 .base_method = &dh_asn1_meth, 527 .pkey_id = EVP_PKEY_DH, 528 529 .pem_str = "DH", 530 .info = "OpenSSL PKCS#3 DH method", 531 532 .pub_decode = dh_pub_decode, 533 .pub_encode = dh_pub_encode, 534 .pub_cmp = dh_pub_cmp, 535 .pub_print = dh_public_print, 536 537 .priv_decode = dh_priv_decode, 538 .priv_encode = dh_priv_encode, 539 .priv_print = dh_private_print, 540 541 .pkey_size = dh_size, 542 .pkey_bits = dh_bits, 543 .pkey_security_bits = dh_security_bits, 544 545 .param_decode = dh_param_decode, 546 .param_encode = dh_param_encode, 547 .param_missing = dh_missing_parameters, 548 .param_copy = dh_copy_parameters, 549 .param_cmp = dh_cmp_parameters, 550 .param_print = dh_param_print, 551 552 .pkey_free = dh_free, 553 554 .pkey_check = NULL, 555 .pkey_public_check = dh_pkey_public_check, 556 .pkey_param_check = dh_pkey_param_check, 557 }; 558