crypto/external/bsd/openssh/dist/jpake.c

   1 /*      $NetBSD: jpake.c,v 1.1.1.2 2009/12/27 01:06:55 christos Exp $   */
   2 /* $OpenBSD: jpake.c,v 1.2 2009/03/05 07:18:19 djm Exp $ */
   3 /*
   4  * Copyright (c) 2008 Damien Miller.  All rights reserved.
   5  *
   6  * Permission to use, copy, modify, and distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  */
  18
  19 /*
  20  * Shared components of zero-knowledge password auth using J-PAKE protocol
  21  * as described in:
  22  *
  23  * F. Hao, P. Ryan, "Password Authenticated Key Exchange by Juggling",
  24  * 16th Workshop on Security Protocols, Cambridge, April 2008
  25  *
  26  * http://grouper.ieee.org/groups/1363/Research/contributions/hao-ryan-2008.pdf
  27  */
  28
  29 #include <sys/types.h>
  30
  31 #include <stdio.h>
  32 #include <string.h>
  33 #include <stdarg.h>
  34
  35 #include <openssl/bn.h>
  36 #include <openssl/evp.h>
  37
  38 #include "xmalloc.h"
  39 #include "ssh2.h"
  40 #include "key.h"
  41 #include "hostfile.h"
  42 #include "auth.h"
  43 #include "buffer.h"
  44 #include "packet.h"
  45 #include "dispatch.h"
  46 #include "log.h"
  47
  48 #include "jpake.h"
  49 #include "schnorr.h"
  50
  51 #ifdef JPAKE
  52
  53 /* RFC3526 group 5, 1536 bits */
  54 #define JPAKE_GROUP_G "2"
  55 #define JPAKE_GROUP_P \
  56         "FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74" \
  57         "020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F1437" \
  58         "4FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7ED" \
  59         "EE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF05" \
  60         "98DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB" \
  61         "9ED529077096966D670C354E4ABC9804F1746C08CA237327FFFFFFFFFFFFFFFF"
  62
  63 struct modp_group *
  64 jpake_default_group(void)
  65 {
  66         return modp_group_from_g_and_safe_p(JPAKE_GROUP_G, JPAKE_GROUP_P);
  67 }
  68
  69 struct jpake_ctx *
  70 jpake_new(void)
  71 {
  72         struct jpake_ctx *ret;
  73
  74         ret = xcalloc(1, sizeof(*ret));
  75
  76         ret->grp = jpake_default_group();
  77
  78         ret->s = ret->k = NULL;
  79         ret->x1 = ret->x2 = ret->x3 = ret->x4 = NULL;
  80         ret->g_x1 = ret->g_x2 = ret->g_x3 = ret->g_x4 = NULL;
  81         ret->a = ret->b = NULL;
  82
  83         ret->client_id = ret->server_id = NULL;
  84         ret->h_k_cid_sessid = ret->h_k_sid_sessid = NULL;
  85
  86         debug3("%s: alloc %p", __func__, ret);
  87
  88         return ret;
  89 }
  90
  91 void
  92 jpake_free(struct jpake_ctx *pctx)
  93 {
  94         debug3("%s: free %p", __func__, pctx);
  95
  96 #define JPAKE_BN_CLEAR_FREE(v)                  \
  97         do {                                    \
  98                 if ((v) != NULL) {              \
  99                         BN_clear_free(v);       \
 100                         (v) = NULL;             \
 101                 }                               \
 102         } while (0)
 103 #define JPAKE_BUF_CLEAR_FREE(v, l)              \
 104         do {                                    \
 105                 if ((v) != NULL) {              \
 106                         bzero((v), (l));        \
 107                         xfree(v);               \
 108                         (v) = NULL;             \
 109                         (l) = 0;                \
 110                 }                               \
 111         } while (0)
 112
 113         JPAKE_BN_CLEAR_FREE(pctx->s);
 114         JPAKE_BN_CLEAR_FREE(pctx->k);
 115         JPAKE_BN_CLEAR_FREE(pctx->x1);
 116         JPAKE_BN_CLEAR_FREE(pctx->x2);
 117         JPAKE_BN_CLEAR_FREE(pctx->x3);
 118         JPAKE_BN_CLEAR_FREE(pctx->x4);
 119         JPAKE_BN_CLEAR_FREE(pctx->g_x1);
 120         JPAKE_BN_CLEAR_FREE(pctx->g_x2);
 121         JPAKE_BN_CLEAR_FREE(pctx->g_x3);
 122         JPAKE_BN_CLEAR_FREE(pctx->g_x4);
 123         JPAKE_BN_CLEAR_FREE(pctx->a);
 124         JPAKE_BN_CLEAR_FREE(pctx->b);
 125
 126         JPAKE_BUF_CLEAR_FREE(pctx->client_id, pctx->client_id_len);
 127         JPAKE_BUF_CLEAR_FREE(pctx->server_id, pctx->server_id_len);
 128         JPAKE_BUF_CLEAR_FREE(pctx->h_k_cid_sessid, pctx->h_k_cid_sessid_len);
 129         JPAKE_BUF_CLEAR_FREE(pctx->h_k_sid_sessid, pctx->h_k_sid_sessid_len);
 130
 131 #undef JPAKE_BN_CLEAR_FREE
 132 #undef JPAKE_BUF_CLEAR_FREE
 133
 134         bzero(pctx, sizeof(pctx));
 135         xfree(pctx);
 136 }
 137
 138 /* dump entire jpake_ctx. NB. includes private values! */
 139 void
 140 jpake_dump(struct jpake_ctx *pctx, const char *fmt, ...)
 141 {
 142         char *out;
 143         va_list args;
 144
 145         out = NULL;
 146         va_start(args, fmt);
 147         vasprintf(&out, fmt, args);
 148         va_end(args);
 149         if (out == NULL)
 150                 fatal("%s: vasprintf failed", __func__);
 151
 152         debug3("%s: %s (ctx at %p)", __func__, out, pctx);
 153         if (pctx == NULL) {
 154                 free(out);
 155                 return;
 156         }
 157
 158 #define JPAKE_DUMP_BN(a)        do { \
 159                 if ((a) != NULL) \
 160                         JPAKE_DEBUG_BN(((a), "%s = ", #a)); \
 161         } while (0)
 162 #define JPAKE_DUMP_BUF(a, b)    do { \
 163                 if ((a) != NULL) \
 164                         JPAKE_DEBUG_BUF((a, b, "%s", #a)); \
 165         } while (0)
 166
 167         JPAKE_DUMP_BN(pctx->s);
 168         JPAKE_DUMP_BN(pctx->k);
 169         JPAKE_DUMP_BN(pctx->x1);
 170         JPAKE_DUMP_BN(pctx->x2);
 171         JPAKE_DUMP_BN(pctx->x3);
 172         JPAKE_DUMP_BN(pctx->x4);
 173         JPAKE_DUMP_BN(pctx->g_x1);
 174         JPAKE_DUMP_BN(pctx->g_x2);
 175         JPAKE_DUMP_BN(pctx->g_x3);
 176         JPAKE_DUMP_BN(pctx->g_x4);
 177         JPAKE_DUMP_BN(pctx->a);
 178         JPAKE_DUMP_BN(pctx->b);
 179
 180         JPAKE_DUMP_BUF(pctx->client_id, pctx->client_id_len);
 181         JPAKE_DUMP_BUF(pctx->server_id, pctx->server_id_len);
 182         JPAKE_DUMP_BUF(pctx->h_k_cid_sessid, pctx->h_k_cid_sessid_len);
 183         JPAKE_DUMP_BUF(pctx->h_k_sid_sessid, pctx->h_k_sid_sessid_len);
 184
 185         debug3("%s: %s done", __func__, out);
 186         free(out);
 187 }
 188
 189 /* Shared parts of step 1 exchange calculation */
 190 void
 191 jpake_step1(struct modp_group *grp,
 192     u_char **id, u_int *id_len,
 193     BIGNUM **priv1, BIGNUM **priv2, BIGNUM **g_priv1, BIGNUM **g_priv2,
 194     u_char **priv1_proof, u_int *priv1_proof_len,
 195     u_char **priv2_proof, u_int *priv2_proof_len)
 196 {
 197         BN_CTX *bn_ctx;
 198
 199         if ((bn_ctx = BN_CTX_new()) == NULL)
 200                 fatal("%s: BN_CTX_new", __func__);
 201
 202         /* Random nonce to prevent replay */
 203         *id = xmalloc(KZP_ID_LEN);
 204         *id_len = KZP_ID_LEN;
 205         arc4random_buf(*id, *id_len);
 206
 207         /*
 208          * x1/x3 is a random element of Zq
 209          * x2/x4 is a random element of Z*q
 210          * We also exclude [1] from x1/x3 candidates and [0, 1] from
 211          * x2/x4 candiates to avoid possible degeneracy (i.e. g^0, g^1).
 212          */
 213         if ((*priv1 = bn_rand_range_gt_one(grp->q)) == NULL ||
 214             (*priv2 = bn_rand_range_gt_one(grp->q)) == NULL)
 215                 fatal("%s: bn_rand_range_gt_one", __func__);
 216
 217         /*
 218          * client: g_x1 = g^x1 mod p / server: g_x3 = g^x3 mod p
 219          * client: g_x2 = g^x2 mod p / server: g_x4 = g^x4 mod p
 220          */
 221         if ((*g_priv1 = BN_new()) == NULL ||
 222             (*g_priv2 = BN_new()) == NULL)
 223                 fatal("%s: BN_new", __func__);
 224         if (BN_mod_exp(*g_priv1, grp->g, *priv1, grp->p, bn_ctx) == -1)
 225                 fatal("%s: BN_mod_exp", __func__);
 226         if (BN_mod_exp(*g_priv2, grp->g, *priv2, grp->p, bn_ctx) == -1)
 227                 fatal("%s: BN_mod_exp", __func__);
 228
 229         /* Generate proofs for holding x1/x3 and x2/x4 */
 230         if (schnorr_sign_buf(grp->p, grp->q, grp->g,
 231             *priv1, *g_priv1, *id, *id_len,
 232             priv1_proof, priv1_proof_len) != 0)
 233                 fatal("%s: schnorr_sign", __func__);
 234         if (schnorr_sign_buf(grp->p, grp->q, grp->g,
 235             *priv2, *g_priv2, *id, *id_len,
 236             priv2_proof, priv2_proof_len) != 0)
 237                 fatal("%s: schnorr_sign", __func__);
 238
 239         BN_CTX_free(bn_ctx);
 240 }
 241
 242 /* Shared parts of step 2 exchange calculation */
 243 void
 244 jpake_step2(struct modp_group *grp, BIGNUM *s,
 245     BIGNUM *mypub1, BIGNUM *theirpub1, BIGNUM *theirpub2, BIGNUM *mypriv2,
 246     const u_char *theirid, u_int theirid_len,
 247     const u_char *myid, u_int myid_len,
 248     const u_char *theirpub1_proof, u_int theirpub1_proof_len,
 249     const u_char *theirpub2_proof, u_int theirpub2_proof_len,
 250     BIGNUM **newpub,
 251     u_char **newpub_exponent_proof, u_int *newpub_exponent_proof_len)
 252 {
 253         BN_CTX *bn_ctx;
 254         BIGNUM *tmp, *exponent;
 255
 256         /* Validate peer's step 1 values */
 257         if (BN_cmp(theirpub1, BN_value_one()) <= 0)
 258                 fatal("%s: theirpub1 <= 1", __func__);
 259         if (BN_cmp(theirpub2, BN_value_one()) <= 0)
 260                 fatal("%s: theirpub2 <= 1", __func__);
 261
 262         if (schnorr_verify_buf(grp->p, grp->q, grp->g, theirpub1,
 263             theirid, theirid_len, theirpub1_proof, theirpub1_proof_len) != 1)
 264                 fatal("%s: schnorr_verify theirpub1 failed", __func__);
 265         if (schnorr_verify_buf(grp->p, grp->q, grp->g, theirpub2,
 266             theirid, theirid_len, theirpub2_proof, theirpub2_proof_len) != 1)
 267                 fatal("%s: schnorr_verify theirpub2 failed", __func__);
 268
 269         if ((bn_ctx = BN_CTX_new()) == NULL)
 270                 fatal("%s: BN_CTX_new", __func__);
 271
 272         if ((*newpub = BN_new()) == NULL ||
 273             (tmp = BN_new()) == NULL ||
 274             (exponent = BN_new()) == NULL)
 275                 fatal("%s: BN_new", __func__);
 276
 277         /*
 278          * client: exponent = x2 * s mod p
 279          * server: exponent = x4 * s mod p
 280          */
 281         if (BN_mod_mul(exponent, mypriv2, s, grp->q, bn_ctx) != 1)
 282                 fatal("%s: BN_mod_mul (exponent = mypriv2 * s mod p)",
 283                     __func__);
 284
 285         /*
 286          * client: tmp = g^(x1 + x3 + x4) mod p
 287          * server: tmp = g^(x1 + x2 + x3) mod p
 288          */
 289         if (BN_mod_mul(tmp, mypub1, theirpub1, grp->p, bn_ctx) != 1)
 290                 fatal("%s: BN_mod_mul (tmp = mypub1 * theirpub1 mod p)",
 291                     __func__);
 292         if (BN_mod_mul(tmp, tmp, theirpub2, grp->p, bn_ctx) != 1)
 293                 fatal("%s: BN_mod_mul (tmp = tmp * theirpub2 mod p)", __func__);
 294
 295         /*
 296          * client: a = tmp^exponent = g^((x1+x3+x4) * x2 * s) mod p
 297          * server: b = tmp^exponent = g^((x1+x2+x3) * x4 * s) mod p
 298          */
 299         if (BN_mod_exp(*newpub, tmp, exponent, grp->p, bn_ctx) != 1)
 300                 fatal("%s: BN_mod_mul (newpub = tmp^exponent mod p)", __func__);
 301
 302         JPAKE_DEBUG_BN((tmp, "%s: tmp = ", __func__));
 303         JPAKE_DEBUG_BN((exponent, "%s: exponent = ", __func__));
 304
 305         /* Note the generator here is 'tmp', not g */
 306         if (schnorr_sign_buf(grp->p, grp->q, tmp, exponent, *newpub,
 307             myid, myid_len,
 308             newpub_exponent_proof, newpub_exponent_proof_len) != 0)
 309                 fatal("%s: schnorr_sign newpub", __func__);
 310
 311         BN_clear_free(tmp); /* XXX stash for later use? */
 312         BN_clear_free(exponent); /* XXX stash for later use? (yes, in conf) */
 313
 314         BN_CTX_free(bn_ctx);
 315 }
 316
 317 /* Confirmation hash calculation */
 318 void
 319 jpake_confirm_hash(const BIGNUM *k,
 320     const u_char *endpoint_id, u_int endpoint_id_len,
 321     const u_char *sess_id, u_int sess_id_len,
 322     u_char **confirm_hash, u_int *confirm_hash_len)
 323 {
 324         Buffer b;
 325
 326         /*
 327          * Calculate confirmation proof:
 328          *     client: H(k || client_id || session_id)
 329          *     server: H(k || server_id || session_id)
 330          */
 331         buffer_init(&b);
 332         buffer_put_bignum2(&b, k);
 333         buffer_put_string(&b, endpoint_id, endpoint_id_len);
 334         buffer_put_string(&b, sess_id, sess_id_len);
 335         if (hash_buffer(buffer_ptr(&b), buffer_len(&b), EVP_sha256(),
 336             confirm_hash, confirm_hash_len) != 0)
 337                 fatal("%s: hash_buffer", __func__);
 338         buffer_free(&b);
 339 }
 340
 341 /* Shared parts of key derivation and confirmation calculation */
 342 void
 343 jpake_key_confirm(struct modp_group *grp, BIGNUM *s, BIGNUM *step2_val,
 344     BIGNUM *mypriv2, BIGNUM *mypub1, BIGNUM *mypub2,
 345     BIGNUM *theirpub1, BIGNUM *theirpub2,
 346     const u_char *my_id, u_int my_id_len,
 347     const u_char *their_id, u_int their_id_len,
 348     const u_char *sess_id, u_int sess_id_len,
 349     const u_char *theirpriv2_s_proof, u_int theirpriv2_s_proof_len,
 350     BIGNUM **k,
 351     u_char **confirm_hash, u_int *confirm_hash_len)
 352 {
 353         BN_CTX *bn_ctx;
 354         BIGNUM *tmp;
 355
 356         if ((bn_ctx = BN_CTX_new()) == NULL)
 357                 fatal("%s: BN_CTX_new", __func__);
 358         if ((tmp = BN_new()) == NULL ||
 359             (*k = BN_new()) == NULL)
 360                 fatal("%s: BN_new", __func__);
 361
 362         /* Validate step 2 values */
 363         if (BN_cmp(step2_val, BN_value_one()) <= 0)
 364                 fatal("%s: step2_val <= 1", __func__);
 365
 366         /*
 367          * theirpriv2_s_proof is calculated with a different generator:
 368          * tmp = g^(mypriv1+mypriv2+theirpub1) = g^mypub1*g^mypub2*g^theirpub1
 369          * Calculate it here so we can check the signature.
 370          */
 371         if (BN_mod_mul(tmp, mypub1, mypub2, grp->p, bn_ctx) != 1)
 372                 fatal("%s: BN_mod_mul (tmp = mypub1 * mypub2 mod p)", __func__);
 373         if (BN_mod_mul(tmp, tmp, theirpub1, grp->p, bn_ctx) != 1)
 374                 fatal("%s: BN_mod_mul (tmp = tmp * theirpub1 mod p)", __func__);
 375
 376         JPAKE_DEBUG_BN((tmp, "%s: tmp = ", __func__));
 377
 378         if (schnorr_verify_buf(grp->p, grp->q, tmp, step2_val,
 379             their_id, their_id_len,
 380             theirpriv2_s_proof, theirpriv2_s_proof_len) != 1)
 381                 fatal("%s: schnorr_verify theirpriv2_s_proof failed", __func__);
 382
 383         /*
 384          * Derive shared key:
 385          *     client: k = (b / g^(x2*x4*s))^x2 = g^((x1+x3)*x2*x4*s)
 386          *     server: k = (a / g^(x2*x4*s))^x4 = g^((x1+x3)*x2*x4*s)
 387          *
 388          * Computed as:
 389          *     client: k = (g_x4^(q - (x2 * s)) * b)^x2 mod p
 390          *     server: k = (g_x2^(q - (x4 * s)) * b)^x4 mod p
 391          */
 392         if (BN_mul(tmp, mypriv2, s, bn_ctx) != 1)
 393                 fatal("%s: BN_mul (tmp = mypriv2 * s)", __func__);
 394         if (BN_mod_sub(tmp, grp->q, tmp, grp->q, bn_ctx) != 1)
 395                 fatal("%s: BN_mod_sub (tmp = q - tmp mod q)", __func__);
 396         if (BN_mod_exp(tmp, theirpub2, tmp, grp->p, bn_ctx) != 1)
 397                 fatal("%s: BN_mod_exp (tmp = theirpub2^tmp) mod p", __func__);
 398         if (BN_mod_mul(tmp, tmp, step2_val, grp->p, bn_ctx) != 1)
 399                 fatal("%s: BN_mod_mul (tmp = tmp * step2_val) mod p", __func__);
 400         if (BN_mod_exp(*k, tmp, mypriv2, grp->p, bn_ctx) != 1)
 401                 fatal("%s: BN_mod_exp (k = tmp^mypriv2) mod p", __func__);
 402
 403         BN_CTX_free(bn_ctx);
 404         BN_clear_free(tmp);
 405
 406         jpake_confirm_hash(*k, my_id, my_id_len, sess_id, sess_id_len,
 407             confirm_hash, confirm_hash_len);
 408 }
 409
 410 /*
 411  * Calculate and check confirmation hash from peer. Returns 1 on success
 412  * 0 on failure/mismatch.
 413  */
 414 int
 415 jpake_check_confirm(const BIGNUM *k,
 416     const u_char *peer_id, u_int peer_id_len,
 417     const u_char *sess_id, u_int sess_id_len,
 418     const u_char *peer_confirm_hash, u_int peer_confirm_hash_len)
 419 {
 420         u_char *expected_confirm_hash;
 421         u_int expected_confirm_hash_len;
 422         int success = 0;
 423
 424         /* Calculate and verify expected confirmation hash */
 425         jpake_confirm_hash(k, peer_id, peer_id_len, sess_id, sess_id_len,
 426             &expected_confirm_hash, &expected_confirm_hash_len);
 427
 428         JPAKE_DEBUG_BUF((expected_confirm_hash, expected_confirm_hash_len,
 429             "%s: expected confirm hash", __func__));
 430         JPAKE_DEBUG_BUF((peer_confirm_hash, peer_confirm_hash_len,
 431             "%s: received confirm hash", __func__));
 432
 433         if (peer_confirm_hash_len != expected_confirm_hash_len)
 434                 error("%s: confirmation length mismatch (my %u them %u)",
 435                     __func__, expected_confirm_hash_len, peer_confirm_hash_len);
 436         else if (memcmp(peer_confirm_hash, expected_confirm_hash,
 437             expected_confirm_hash_len) == 0)
 438                 success = 1;
 439         bzero(expected_confirm_hash, expected_confirm_hash_len);
 440         xfree(expected_confirm_hash);
 441         debug3("%s: success = %d", __func__, success);
 442         return success;
 443 }
 444
 445 /* XXX main() function with tests */
 446
 447 #endif /* JPAKE */
 448