crypto/dist/heimdal/lib/hcrypto/dh-imath.c

   1 /*
   2  * Copyright (c) 2006 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #ifdef HAVE_CONFIG_H
  35 #include <config.h>
  36 #endif
  37
  38 #include <stdio.h>
  39 #include <stdlib.h>
  40 #include <dh.h>
  41
  42 #include <roken.h>
  43
  44 #include "imath/imath.h"
  45
  46 __RCSID("$Heimdal: dh-imath.c 22368 2007-12-28 15:27:52Z lha $"
  47         "$NetBSD$");
  48
  49 static void
  50 BN2mpz(mpz_t *s, const BIGNUM *bn)
  51 {
  52     size_t len;
  53     void *p;
  54
  55     len = BN_num_bytes(bn);
  56     p = malloc(len);
  57     BN_bn2bin(bn, p);
  58     mp_int_read_unsigned(s, p, len);
  59     free(p);
  60 }
  61
  62
  63 static BIGNUM *
  64 mpz2BN(mpz_t *s)
  65 {
  66     size_t size;
  67     BIGNUM *bn;
  68     void *p;
  69
  70     size = mp_int_unsigned_len(s);
  71     p = malloc(size);
  72     if (p == NULL && size != 0)
  73         return NULL;
  74     mp_int_to_unsigned(s, p, size);
  75
  76     bn = BN_bin2bn(p, size, NULL);
  77     free(p);
  78     return bn;
  79 }
  80
  81 /*
  82  *
  83  */
  84
  85 #define DH_NUM_TRIES 10
  86
  87 static int
  88 dh_generate_key(DH *dh)
  89 {
  90     mpz_t pub, priv_key, g, p;
  91     int have_private_key = (dh->priv_key != NULL);
  92     int codes, times = 0;
  93     mp_result res;
  94
  95     if (dh->p == NULL || dh->g == NULL)
  96         return 0;
  97
  98     while (times++ < DH_NUM_TRIES) {
  99         if (!have_private_key) {
 100             size_t bits = BN_num_bits(dh->p);
 101
 102             if (dh->priv_key)
 103                 BN_free(dh->priv_key);
 104
 105             dh->priv_key = BN_new();
 106             if (dh->priv_key == NULL)
 107                 return 0;
 108             if (!BN_rand(dh->priv_key, bits - 1, 0, 0)) {
 109                 BN_clear_free(dh->priv_key);
 110                 dh->priv_key = NULL;
 111                 return 0;
 112             }
 113         }
 114         if (dh->pub_key)
 115             BN_free(dh->pub_key);
 116
 117         mp_int_init(&pub);
 118         mp_int_init(&priv_key);
 119         mp_int_init(&g);
 120         mp_int_init(&p);
 121
 122         BN2mpz(&priv_key, dh->priv_key);
 123         BN2mpz(&g, dh->g);
 124         BN2mpz(&p, dh->p);
 125
 126         res = mp_int_exptmod(&g, &priv_key, &p, &pub);
 127
 128         mp_int_clear(&priv_key);
 129         mp_int_clear(&g);
 130         mp_int_clear(&p);
 131         if (res != MP_OK)
 132             continue;
 133
 134         dh->pub_key = mpz2BN(&pub);
 135         mp_int_clear(&pub);
 136         if (dh->pub_key == NULL)
 137             return 0;
 138
 139         if (DH_check_pubkey(dh, dh->pub_key, &codes) && codes == 0)
 140             break;
 141         if (have_private_key)
 142             return 0;
 143     }
 144
 145     if (times >= DH_NUM_TRIES) {
 146         if (!have_private_key && dh->priv_key) {
 147             BN_free(dh->priv_key);
 148             dh->priv_key = NULL;
 149         }
 150         if (dh->pub_key) {
 151             BN_free(dh->pub_key);
 152             dh->pub_key = NULL;
 153         }
 154         return 0;
 155     }
 156
 157     return 1;
 158 }
 159
 160 static int
 161 dh_compute_key(unsigned char *shared, const BIGNUM * pub, DH *dh)
 162 {
 163     mpz_t s, priv_key, p, peer_pub;
 164     size_t size = 0;
 165     mp_result res;
 166
 167     if (dh->pub_key == NULL || dh->g == NULL || dh->priv_key == NULL)
 168         return -1;
 169
 170     mp_int_init(&p);
 171     BN2mpz(&p, dh->p);
 172
 173     mp_int_init(&peer_pub);
 174     BN2mpz(&peer_pub, pub);
 175
 176     /* check if peers pubkey is reasonable */
 177     if (MP_SIGN(&peer_pub) == MP_NEG
 178         || mp_int_compare(&peer_pub, &p) >= 0
 179         || mp_int_compare_value(&peer_pub, 1) <= 0)
 180     {
 181         mp_int_clear(&p);
 182         mp_int_clear(&peer_pub);
 183         return -1;
 184     }
 185
 186     mp_int_init(&priv_key);
 187     BN2mpz(&priv_key, dh->priv_key);
 188
 189     mp_int_init(&s);
 190
 191     mp_int_exptmod(&peer_pub, &priv_key, &p, &s);
 192
 193     mp_int_clear(&p);
 194     mp_int_clear(&peer_pub);
 195     mp_int_clear(&priv_key);
 196
 197     size = mp_int_unsigned_len(&s);
 198     res = mp_int_to_unsigned(&s, shared, size);
 199     mp_int_clear(&s);
 200
 201     return (res == MP_OK) ? size : -1;
 202 }
 203
 204 static int
 205 dh_generate_params(DH *dh, int a, int b, BN_GENCB *callback)
 206 {
 207     /* groups should already be known, we don't care about this */
 208     return 0;
 209 }
 210
 211 static int
 212 dh_init(DH *dh)
 213 {
 214     return 1;
 215 }
 216
 217 static int
 218 dh_finish(DH *dh)
 219 {
 220     return 1;
 221 }
 222
 223
 224 /*
 225  *
 226  */
 227
 228 const DH_METHOD _hc_dh_imath_method = {
 229     "hcrypto imath DH",
 230     dh_generate_key,
 231     dh_compute_key,
 232     NULL,
 233     dh_init,
 234     dh_finish,
 235     0,
 236     NULL,
 237     dh_generate_params
 238 };
 239
 240 /**
 241  * DH implementation using libimath.
 242  *
 243  * @return the DH_METHOD for the DH implementation using libimath.
 244  *
 245  * @ingroup hcrypto_dh
 246  */
 247
 248 const DH_METHOD *
 249 DH_imath_method(void)
 250 {
 251     return &_hc_dh_imath_method;
 252 }