/*
* Copyright (C) 2001-2016 Free Software Foundation, Inc.
* Copyright (C) 2015-2016 Red Hat, Inc.
*
* Author: Nikos Mavrogiannopoulos
*
* This file is part of GnuTLS.
*
* The GnuTLS is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public License
* as published by the Free Software Foundation; either version 2.1 of
* the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public License
* along with this program. If not, see <https://www.gnu.org/licenses/>
*
*/
#include "gnutls_int.h"
#include "errors.h"
#include <auth/srp_kx.h>
#include <state.h>
#ifdef ENABLE_SRP
#include "srp.h"
#include <auth/srp_passwd.h>
#include <mpi.h>
#include <num.h>
#include <file.h>
#include <algorithms.h>
#include <random.h>
#include "debug.h"
/* Here functions for SRP (like g^x mod n) are defined
*/
static int
_gnutls_srp_gx(uint8_t * text, size_t textsize, uint8_t ** result,
bigint_t g, bigint_t prime)
{
bigint_t x, e = NULL;
size_t result_size;
int ret;
if (_gnutls_mpi_init_scan_nz(&x, text, textsize)) {
gnutls_assert();
return GNUTLS_E_MPI_SCAN_FAILED;
}
ret = _gnutls_mpi_init(&e);
if (ret < 0)
goto cleanup;
/* e = g^x mod prime (n) */
ret = _gnutls_mpi_powm(e, g, x, prime);
if (ret < 0)
goto cleanup;
ret = _gnutls_mpi_print(e, NULL, &result_size);
if (ret == GNUTLS_E_SHORT_MEMORY_BUFFER) {
*result = gnutls_malloc(result_size);
if ((*result) == NULL) {
ret = GNUTLS_E_MEMORY_ERROR;
goto cleanup;
}
ret = _gnutls_mpi_print(e, *result, &result_size);
if (ret < 0)
goto cleanup;
ret = result_size;
} else {
gnutls_assert();
ret = GNUTLS_E_MPI_PRINT_FAILED;
}
cleanup:
_gnutls_mpi_release(&e);
_gnutls_mpi_release(&x);
return ret;
}
/****************
* Choose a random value b and calculate B = (k* v + g^b) % N.
* where k == SHA1(N|g)
* Return: B and if ret_b is not NULL b.
*/
bigint_t
_gnutls_calc_srp_B(bigint_t * ret_b, bigint_t g, bigint_t n, bigint_t v)
{
bigint_t tmpB = NULL, tmpV = NULL;
bigint_t b = NULL, B = NULL, k = NULL;
int ret;
/* calculate: B = (k*v + g^b) % N
*/
ret = _gnutls_mpi_init_multi(&tmpV, &tmpB, &B, &b, NULL);
if (ret < 0)
return NULL;
_gnutls_mpi_random_modp(b, n, GNUTLS_RND_RANDOM);
k = _gnutls_calc_srp_u(n, g, n);
if (k == NULL) {
gnutls_assert();
goto error;
}
ret = _gnutls_mpi_mulm(tmpV, k, v, n);
if (ret < 0) {
gnutls_assert();
goto error;
}
ret = _gnutls_mpi_powm(tmpB, g, b, n);
if (ret < 0) {
gnutls_assert();
goto error;
}
ret = _gnutls_mpi_addm(B, tmpV, tmpB, n);
if (ret < 0) {
gnutls_assert();
goto error;
}
_gnutls_mpi_release(&k);
_gnutls_mpi_release(&tmpB);
_gnutls_mpi_release(&tmpV);
if (ret_b)
*ret_b = b;
else
_gnutls_mpi_release(&b);
return B;
error:
_gnutls_mpi_release(&b);
_gnutls_mpi_release(&B);
_gnutls_mpi_release(&k);
_gnutls_mpi_release(&tmpB);
_gnutls_mpi_release(&tmpV);
return NULL;
}
/* This calculates the SHA1(A | B)
* A and B will be left-padded with zeros to fill n_size.
*/
bigint_t _gnutls_calc_srp_u(bigint_t A, bigint_t B, bigint_t n)
{
size_t b_size, a_size;
uint8_t *holder, hd[MAX_HASH_SIZE];
size_t holder_size, hash_size, n_size;
int ret;
bigint_t res;
/* get the size of n in bytes */
_gnutls_mpi_print(n, NULL, &n_size);
_gnutls_mpi_print(A, NULL, &a_size);
_gnutls_mpi_print(B, NULL, &b_size);
if (a_size > n_size || b_size > n_size) {
gnutls_assert();
return NULL; /* internal error */
}
holder_size = n_size + n_size;
holder = gnutls_calloc(1, holder_size);
if (holder == NULL)
return NULL;
_gnutls_mpi_print(A, &holder[n_size - a_size], &a_size);
_gnutls_mpi_print(B, &holder[n_size + n_size - b_size], &b_size);
ret = _gnutls_hash_fast(GNUTLS_DIG_SHA1, holder, holder_size, hd);
if (ret < 0) {
gnutls_free(holder);
gnutls_assert();
return NULL;
}
/* convert the bytes of hd to integer
*/
hash_size = 20; /* SHA */
ret = _gnutls_mpi_init_scan_nz(&res, hd, hash_size);
gnutls_free(holder);
if (ret < 0) {
gnutls_assert();
return NULL;
}
return res;
}
/* S = (A * v^u) ^ b % N
* this is our shared key (server premaster secret)
*/
bigint_t
_gnutls_calc_srp_S1(bigint_t A, bigint_t b, bigint_t u, bigint_t v,
bigint_t n)
{
bigint_t tmp1 = NULL, tmp2 = NULL;
bigint_t S = NULL;
int ret;
ret = _gnutls_mpi_init_multi(&S, &tmp1, &tmp2, NULL);
if (ret < 0)
return NULL;
ret = _gnutls_mpi_powm(tmp1, v, u, n);
if (ret < 0) {
gnutls_assert();
goto error;
}
ret = _gnutls_mpi_mulm(tmp2, A, tmp1, n);
if (ret < 0) {
gnutls_assert();
goto error;
}
_gnutls_mpi_powm(S, tmp2, b, n);
_gnutls_mpi_release(&tmp1);
_gnutls_mpi_release(&tmp2);
return S;
error:
_gnutls_mpi_release(&S);
_gnutls_mpi_release(&tmp1);
_gnutls_mpi_release(&tmp2);
return NULL;
}
/* A = g^a % N
* returns A and a (which is random)
*/
bigint_t _gnutls_calc_srp_A(bigint_t * a, bigint_t g, bigint_t n)
{
bigint_t tmpa;
bigint_t A;
int ret;
ret = _gnutls_mpi_init_multi(&A, &tmpa, NULL);
if (ret < 0) {
gnutls_assert();
return NULL;
}
_gnutls_mpi_random_modp(tmpa, n, GNUTLS_RND_RANDOM);
ret = _gnutls_mpi_powm(A, g, tmpa, n);
if (ret < 0)
goto error;
if (a != NULL)
*a = tmpa;
else
_gnutls_mpi_release(&tmpa);
return A;
error:
_gnutls_mpi_release(&tmpa);
_gnutls_mpi_release(&A);
return NULL;
}
/* generate x = SHA(s | SHA(U | ":" | p))
* The output is exactly 20 bytes
*/
static int
_gnutls_calc_srp_sha(const char *username, const char *_password,
uint8_t * salt, int salt_size, size_t * size,
void *digest, unsigned allow_invalid_pass)
{
digest_hd_st td;
uint8_t res[MAX_HASH_SIZE];
int ret;
const mac_entry_st *me = mac_to_entry(GNUTLS_MAC_SHA1);
char *password;
gnutls_datum_t pout;
*size = 20;
ret = _gnutls_utf8_password_normalize(_password, strlen(_password), &pout, allow_invalid_pass);
if (ret < 0)
return gnutls_assert_val(ret);
password = (char*)pout.data;
ret = _gnutls_hash_init(&td, me);
if (ret < 0) {
ret = GNUTLS_E_MEMORY_ERROR;
goto cleanup;
}
_gnutls_hash(&td, username, strlen(username));
_gnutls_hash(&td, ":", 1);
_gnutls_hash(&td, password, strlen(password));
_gnutls_hash_deinit(&td, res);
ret = _gnutls_hash_init(&td, me);
if (ret < 0) {
ret = GNUTLS_E_MEMORY_ERROR;
goto cleanup;
}
_gnutls_hash(&td, salt, salt_size);
_gnutls_hash(&td, res, 20); /* 20 bytes is the output of sha1 */
_gnutls_hash_deinit(&td, digest);
ret = 0;
cleanup:
gnutls_free(password);
return ret;
}
int
_gnutls_calc_srp_x(char *username, char *password, uint8_t * salt,
size_t salt_size, size_t * size, void *digest)
{
return _gnutls_calc_srp_sha(username, password, salt,
salt_size, size, digest, 1);
}
/* S = (B - k*g^x) ^ (a + u * x) % N
* this is our shared key (client premaster secret)
*/
bigint_t
_gnutls_calc_srp_S2(bigint_t B, bigint_t g, bigint_t x, bigint_t a,
bigint_t u, bigint_t n)
{
bigint_t S = NULL, tmp1 = NULL, tmp2 = NULL;
bigint_t tmp4 = NULL, tmp3 = NULL, k = NULL;
int ret;
ret = _gnutls_mpi_init_multi(&S, &tmp1, &tmp2, &tmp3, &tmp4, NULL);
if (ret < 0)
return NULL;
k = _gnutls_calc_srp_u(n, g, n);
if (k == NULL) {
gnutls_assert();
goto freeall;
}
ret = _gnutls_mpi_powm(tmp1, g, x, n); /* g^x */
if (ret < 0) {
gnutls_assert();
goto freeall;
}
ret = _gnutls_mpi_mulm(tmp3, tmp1, k, n); /* k*g^x mod n */
if (ret < 0) {
gnutls_assert();
goto freeall;
}
ret = _gnutls_mpi_subm(tmp2, B, tmp3, n);
if (ret < 0) {
gnutls_assert();
goto freeall;
}
ret = _gnutls_mpi_mul(tmp1, u, x);
if (ret < 0) {
gnutls_assert();
goto freeall;
}
ret = _gnutls_mpi_add(tmp4, a, tmp1);
if (ret < 0) {
gnutls_assert();
goto freeall;
}
ret = _gnutls_mpi_powm(S, tmp2, tmp4, n);
if (ret < 0) {
gnutls_assert();
goto freeall;
}
_gnutls_mpi_release(&tmp1);
_gnutls_mpi_release(&tmp2);
_gnutls_mpi_release(&tmp3);
_gnutls_mpi_release(&tmp4);
_gnutls_mpi_release(&k);
return S;
freeall:
_gnutls_mpi_release(&k);
_gnutls_mpi_release(&tmp1);
_gnutls_mpi_release(&tmp2);
_gnutls_mpi_release(&tmp3);
_gnutls_mpi_release(&tmp4);
_gnutls_mpi_release(&S);
return NULL;
}
/**
* gnutls_srp_free_client_credentials:
* @sc: is a #gnutls_srp_client_credentials_t type.
*
* Free a gnutls_srp_client_credentials_t structure.
**/
void gnutls_srp_free_client_credentials(gnutls_srp_client_credentials_t sc)
{
gnutls_free(sc->username);
gnutls_free(sc->password);
gnutls_free(sc);
}
/**
* gnutls_srp_allocate_client_credentials:
* @sc: is a pointer to a #gnutls_srp_server_credentials_t type.
*
* Allocate a gnutls_srp_client_credentials_t structure.
*
* Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, or an
* error code.
**/
int
gnutls_srp_allocate_client_credentials(gnutls_srp_client_credentials_t *
sc)
{
*sc = gnutls_calloc(1, sizeof(srp_client_credentials_st));
if (*sc == NULL)
return GNUTLS_E_MEMORY_ERROR;
return 0;
}
/**
* gnutls_srp_set_client_credentials:
* @res: is a #gnutls_srp_client_credentials_t type.
* @username: is the user's userid
* @password: is the user's password
*
* This function sets the username and password, in a
* #gnutls_srp_client_credentials_t type. Those will be used in
* SRP authentication. @username should be an ASCII string or UTF-8
* string. In case of a UTF-8 string it is recommended to be following
* the PRECIS framework for usernames (rfc8265). The password can
* be in ASCII format, or normalized using gnutls_utf8_password_normalize().
* Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, or an
* error code.
**/
int
gnutls_srp_set_client_credentials(gnutls_srp_client_credentials_t res,
const char *username,
const char *password)
{
if (username == NULL || password == NULL) {
gnutls_assert();
return GNUTLS_E_INVALID_REQUEST;
}
res->username = gnutls_strdup(username);
if (res->username == NULL)
return GNUTLS_E_MEMORY_ERROR;
res->password = gnutls_strdup(password);
if (res->password == NULL) {
gnutls_free(res->username);
return GNUTLS_E_MEMORY_ERROR;
}
return 0;
}
/**
* gnutls_srp_free_server_credentials:
* @sc: is a #gnutls_srp_server_credentials_t type.
*
* Free a gnutls_srp_server_credentials_t structure.
**/
void gnutls_srp_free_server_credentials(gnutls_srp_server_credentials_t sc)
{
gnutls_free(sc->password_file);
gnutls_free(sc->password_conf_file);
gnutls_free(sc);
}
/* Size of the default (random) seed if
* gnutls_srp_set_server_fake_salt_seed() is not called to set
* a seed.
*/
#define DEFAULT_FAKE_SALT_SEED_SIZE 20
/* Size of the fake salts generated if
* gnutls_srp_set_server_fake_salt_seed() is not called to set
* another size.
*/
#define DEFAULT_FAKE_SALT_SIZE 16
/**
* gnutls_srp_allocate_server_credentials:
* @sc: is a pointer to a #gnutls_srp_server_credentials_t type.
*
* Allocate a gnutls_srp_server_credentials_t structure.
*
* Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, or an
* error code.
**/
int
gnutls_srp_allocate_server_credentials(gnutls_srp_server_credentials_t *
sc)
{
int ret;
*sc = gnutls_calloc(1, sizeof(srp_server_cred_st));
if (*sc == NULL)
return GNUTLS_E_MEMORY_ERROR;
(*sc)->fake_salt_seed_size = DEFAULT_FAKE_SALT_SEED_SIZE;
ret = gnutls_rnd(GNUTLS_RND_RANDOM, (*sc)->fake_salt_seed,
DEFAULT_FAKE_SALT_SEED_SIZE);
if (ret < 0) {
gnutls_assert();
goto cleanup;
}
(*sc)->fake_salt_length = DEFAULT_FAKE_SALT_SIZE;
return 0;
cleanup:
gnutls_free(*sc);
return ret;
}
/**
* gnutls_srp_set_server_credentials_file:
* @res: is a #gnutls_srp_server_credentials_t type.
* @password_file: is the SRP password file (tpasswd)
* @password_conf_file: is the SRP password conf file (tpasswd.conf)
*
* This function sets the password files, in a
* #gnutls_srp_server_credentials_t type. Those password files
* hold usernames and verifiers and will be used for SRP
* authentication.
*
* Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, or an
* error code.
**/
int
gnutls_srp_set_server_credentials_file(gnutls_srp_server_credentials_t res,
const char *password_file,
const char *password_conf_file)
{
if (password_file == NULL || password_conf_file == NULL) {
gnutls_assert();
return GNUTLS_E_INVALID_REQUEST;
}
/* Check if the files can be opened */
if (_gnutls_file_exists(password_file) != 0) {
gnutls_assert();
return GNUTLS_E_FILE_ERROR;
}
if (_gnutls_file_exists(password_conf_file) != 0) {
gnutls_assert();
return GNUTLS_E_FILE_ERROR;
}
res->password_file = gnutls_strdup(password_file);
if (res->password_file == NULL) {
gnutls_assert();
return GNUTLS_E_MEMORY_ERROR;
}
res->password_conf_file = gnutls_strdup(password_conf_file);
if (res->password_conf_file == NULL) {
gnutls_assert();
gnutls_free(res->password_file);
return GNUTLS_E_MEMORY_ERROR;
}
return 0;
}
/**
* gnutls_srp_set_server_credentials_function:
* @cred: is a #gnutls_srp_server_credentials_t type.
* @func: is the callback function
*
* This function can be used to set a callback to retrieve the user's
* SRP credentials. The callback's function form is:
*
* int (*callback)(gnutls_session_t, const char* username,
* gnutls_datum_t *salt, gnutls_datum_t *verifier, gnutls_datum_t *generator,
* gnutls_datum_t *prime);
*
* @username contains the actual username.
* The @salt, @verifier, @generator and @prime must be filled
* in using the gnutls_malloc(). For convenience @prime and @generator
* may also be one of the static parameters defined in gnutls.h.
*
* Initially, the data field is NULL in every #gnutls_datum_t
* structure that the callback has to fill in. When the
* callback is done GnuTLS deallocates all of those buffers
* which are non-NULL, regardless of the return value.
*
* In order to prevent attackers from guessing valid usernames,
* if a user does not exist, g and n values should be filled in
* using a random user's parameters. In that case the callback must
* return the special value (1).
* See #gnutls_srp_set_server_fake_salt_seed too.
* If this is not required for your application, return a negative
* number from the callback to abort the handshake.
*
* The callback function will only be called once per handshake.
* The callback function should return 0 on success, while
* -1 indicates an error.
**/
void
gnutls_srp_set_server_credentials_function(gnutls_srp_server_credentials_t
cred,
gnutls_srp_server_credentials_function
*func)
{
cred->pwd_callback = func;
}
/**
* gnutls_srp_set_client_credentials_function:
* @cred: is a #gnutls_srp_server_credentials_t type.
* @func: is the callback function
*
* This function can be used to set a callback to retrieve the
* username and password for client SRP authentication. The
* callback's function form is:
*
* int (*callback)(gnutls_session_t, char** username, char**password);
*
* The @username and @password must be allocated using
* gnutls_malloc().
*
* The @username should be an ASCII string or UTF-8
* string. In case of a UTF-8 string it is recommended to be following
* the PRECIS framework for usernames (rfc8265). The password can
* be in ASCII format, or normalized using gnutls_utf8_password_normalize().
*
* The callback function will be called once per handshake before the
* initial hello message is sent.
*
* The callback should not return a negative error code the second
* time called, since the handshake procedure will be aborted.
*
* The callback function should return 0 on success.
* -1 indicates an error.
**/
void
gnutls_srp_set_client_credentials_function(gnutls_srp_client_credentials_t
cred,
gnutls_srp_client_credentials_function
* func)
{
cred->get_function = func;
}
/**
* gnutls_srp_server_get_username:
* @session: is a gnutls session
*
* This function will return the username of the peer. This should
* only be called in case of SRP authentication and in case of a
* server. Returns NULL in case of an error.
*
* Returns: SRP username of the peer, or NULL in case of error.
**/
const char *gnutls_srp_server_get_username(gnutls_session_t session)
{
srp_server_auth_info_t info;
CHECK_AUTH_TYPE(GNUTLS_CRD_SRP, NULL);
info = _gnutls_get_auth_info(session, GNUTLS_CRD_SRP);
if (info == NULL)
return NULL;
return info->username;
}
/**
* gnutls_srp_verifier:
* @username: is the user's name
* @password: is the user's password
* @salt: should be some randomly generated bytes
* @generator: is the generator of the group
* @prime: is the group's prime
* @res: where the verifier will be stored.
*
* This function will create an SRP verifier, as specified in
* RFC2945. The @prime and @generator should be one of the static
* parameters defined in gnutls/gnutls.h or may be generated.
*
* The verifier will be allocated with @gnutls_malloc() and will be stored in
* @res using binary format.
*
* Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, or an
* error code.
**/
int
gnutls_srp_verifier(const char *username, const char *password,
const gnutls_datum_t * salt,
const gnutls_datum_t * generator,
const gnutls_datum_t * prime, gnutls_datum_t * res)
{
bigint_t _n, _g;
int ret;
size_t digest_size = 20, size;
uint8_t digest[20];
ret = _gnutls_calc_srp_sha(username, password, salt->data,
salt->size, &digest_size, digest, 0);
if (ret < 0) {
gnutls_assert();
return ret;
}
size = prime->size;
if (_gnutls_mpi_init_scan_nz(&_n, prime->data, size)) {
gnutls_assert();
return GNUTLS_E_MPI_SCAN_FAILED;
}
size = generator->size;
if (_gnutls_mpi_init_scan_nz(&_g, generator->data, size)) {
gnutls_assert();
_gnutls_mpi_release(&_n);
return GNUTLS_E_MPI_SCAN_FAILED;
}
ret = _gnutls_srp_gx(digest, 20, &res->data, _g, _n);
if (ret < 0) {
gnutls_assert();
_gnutls_mpi_release(&_n);
_gnutls_mpi_release(&_g);
return ret;
}
res->size = ret;
_gnutls_mpi_release(&_n);
_gnutls_mpi_release(&_g);
return 0;
}
/**
* gnutls_srp_set_prime_bits:
* @session: is a #gnutls_session_t type.
* @bits: is the number of bits
*
* This function sets the minimum accepted number of bits, for use in
* an SRP key exchange. If zero, the default 2048 bits will be used.
*
* In the client side it sets the minimum accepted number of bits. If
* a server sends a prime with less bits than that
* %GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER will be returned by the
* handshake.
*
* This function has no effect in server side.
*
* Since: 2.6.0
**/
void gnutls_srp_set_prime_bits(gnutls_session_t session, unsigned int bits)
{
session->internals.dh_prime_bits = bits;
}
/**
* gnutls_srp_set_server_fake_salt_seed:
* @cred: is a #gnutls_srp_server_credentials_t type
* @seed: is the seed data, only needs to be valid until the function
* returns; size of the seed must be greater than zero
* @salt_length: is the length of the generated fake salts
*
* This function sets the seed that is used to generate salts for
* invalid (non-existent) usernames.
*
* In order to prevent attackers from guessing valid usernames,
* when a user does not exist gnutls generates a salt and a verifier
* and proceeds with the protocol as usual.
* The authentication will ultimately fail, but the client cannot tell
* whether the username is valid (exists) or invalid.
*
* If an attacker learns the seed, given a salt (which is part of the
* handshake) which was generated when the seed was in use, it can tell
* whether or not the authentication failed because of an unknown username.
* This seed cannot be used to reveal application data or passwords.
*
* @salt_length should represent the salt length your application uses.
* Generating fake salts longer than 20 bytes is not supported.
*
* By default the seed is a random value, different each time a
* #gnutls_srp_server_credentials_t is allocated and fake salts are
* 16 bytes long.
*
* Since: 3.3.0
**/
void
gnutls_srp_set_server_fake_salt_seed(gnutls_srp_server_credentials_t cred,
const gnutls_datum_t * seed,
unsigned int salt_length)
{
unsigned seed_size = seed->size;
const unsigned char *seed_data = seed->data;
if (seed_size > sizeof(cred->fake_salt_seed))
seed_size = sizeof(cred->fake_salt_seed);
memcpy(cred->fake_salt_seed, seed_data, seed_size);
cred->fake_salt_seed_size = seed_size;
/* Cap the salt length at the output size of the MAC algorithm
* we are using to generate the fake salts.
*/
const mac_entry_st * me = mac_to_entry(SRP_FAKE_SALT_MAC);
const size_t mac_len = me->output_size;
cred->fake_salt_length = (salt_length < mac_len ? salt_length : mac_len);
}
#endif /* ENABLE_SRP */