|
Packit |
fd8b60 |
/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
|
|
Packit |
fd8b60 |
/* plugins/preauth/spake/openssl.c - SPAKE implementations using OpenSSL */
|
|
Packit |
fd8b60 |
/*
|
|
Packit |
fd8b60 |
* Copyright (C) 2015 by the Massachusetts Institute of Technology.
|
|
Packit |
fd8b60 |
* All rights reserved.
|
|
Packit |
fd8b60 |
*
|
|
Packit |
fd8b60 |
* Redistribution and use in source and binary forms, with or without
|
|
Packit |
fd8b60 |
* modification, are permitted provided that the following conditions
|
|
Packit |
fd8b60 |
* are met:
|
|
Packit |
fd8b60 |
*
|
|
Packit |
fd8b60 |
* * Redistributions of source code must retain the above copyright
|
|
Packit |
fd8b60 |
* notice, this list of conditions and the following disclaimer.
|
|
Packit |
fd8b60 |
*
|
|
Packit |
fd8b60 |
* * Redistributions in binary form must reproduce the above copyright
|
|
Packit |
fd8b60 |
* notice, this list of conditions and the following disclaimer in
|
|
Packit |
fd8b60 |
* the documentation and/or other materials provided with the
|
|
Packit |
fd8b60 |
* distribution.
|
|
Packit |
fd8b60 |
*
|
|
Packit |
fd8b60 |
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
|
Packit |
fd8b60 |
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
|
Packit |
fd8b60 |
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
|
|
Packit |
fd8b60 |
* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
|
|
Packit |
fd8b60 |
* COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
|
|
Packit |
fd8b60 |
* INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
|
|
Packit |
fd8b60 |
* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
|
|
Packit |
fd8b60 |
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
Packit |
fd8b60 |
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
|
Packit |
fd8b60 |
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
|
Packit |
fd8b60 |
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
|
Packit |
fd8b60 |
* OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
Packit |
fd8b60 |
*/
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
#include "k5-int.h"
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
#include "groups.h"
|
|
Packit |
fd8b60 |
#include "iana.h"
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
#ifdef SPAKE_OPENSSL
|
|
Packit |
fd8b60 |
#include <openssl/bn.h>
|
|
Packit |
fd8b60 |
#include <openssl/ec.h>
|
|
Packit |
fd8b60 |
#include <openssl/obj_mac.h>
|
|
Packit |
fd8b60 |
#include <openssl/evp.h>
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
/* OpenSSL 1.1 standardizes constructor and destructor names, renaming
|
|
Packit |
fd8b60 |
* EVP_MD_CTX_create and EVP_MD_CTX_destroy. */
|
|
Packit |
fd8b60 |
#if OPENSSL_VERSION_NUMBER < 0x10100000L
|
|
Packit |
fd8b60 |
#define EVP_MD_CTX_new EVP_MD_CTX_create
|
|
Packit |
fd8b60 |
#define EVP_MD_CTX_free EVP_MD_CTX_destroy
|
|
Packit |
fd8b60 |
#endif
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
struct groupdata_st {
|
|
Packit |
fd8b60 |
const groupdef *gdef;
|
|
Packit |
fd8b60 |
EC_GROUP *group;
|
|
Packit |
fd8b60 |
BIGNUM *order;
|
|
Packit |
fd8b60 |
BN_CTX *ctx;
|
|
Packit |
fd8b60 |
EC_POINT *M;
|
|
Packit |
fd8b60 |
EC_POINT *N;
|
|
Packit |
fd8b60 |
const EVP_MD *md;
|
|
Packit |
fd8b60 |
};
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
static void
|
|
Packit |
fd8b60 |
ossl_fini(groupdata *gd)
|
|
Packit |
fd8b60 |
{
|
|
Packit |
fd8b60 |
if (gd == NULL)
|
|
Packit |
fd8b60 |
return;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
EC_GROUP_free(gd->group);
|
|
Packit |
fd8b60 |
EC_POINT_free(gd->M);
|
|
Packit |
fd8b60 |
EC_POINT_free(gd->N);
|
|
Packit |
fd8b60 |
BN_CTX_free(gd->ctx);
|
|
Packit |
fd8b60 |
BN_free(gd->order);
|
|
Packit |
fd8b60 |
free(gd);
|
|
Packit |
fd8b60 |
}
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
static krb5_error_code
|
|
Packit |
fd8b60 |
ossl_init(krb5_context context, const groupdef *gdef, groupdata **gdata_out)
|
|
Packit |
fd8b60 |
{
|
|
Packit |
fd8b60 |
const spake_iana *reg = gdef->reg;
|
|
Packit |
fd8b60 |
const EVP_MD *md;
|
|
Packit |
fd8b60 |
groupdata *gd;
|
|
Packit |
fd8b60 |
int nid;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
switch (reg->id) {
|
|
Packit |
fd8b60 |
case SPAKE_GROUP_P256:
|
|
Packit |
fd8b60 |
nid = NID_X9_62_prime256v1;
|
|
Packit |
fd8b60 |
md = EVP_sha256();
|
|
Packit |
fd8b60 |
break;
|
|
Packit |
fd8b60 |
case SPAKE_GROUP_P384:
|
|
Packit |
fd8b60 |
nid = NID_secp384r1;
|
|
Packit |
fd8b60 |
md = EVP_sha384();
|
|
Packit |
fd8b60 |
break;
|
|
Packit |
fd8b60 |
case SPAKE_GROUP_P521:
|
|
Packit |
fd8b60 |
nid = NID_secp521r1;
|
|
Packit |
fd8b60 |
md = EVP_sha512();
|
|
Packit |
fd8b60 |
break;
|
|
Packit |
fd8b60 |
default:
|
|
Packit |
fd8b60 |
return EINVAL;
|
|
Packit |
fd8b60 |
};
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
gd = calloc(1, sizeof(*gd));
|
|
Packit |
fd8b60 |
if (gd == NULL)
|
|
Packit |
fd8b60 |
return ENOMEM;
|
|
Packit |
fd8b60 |
gd->gdef = gdef;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
gd->group = EC_GROUP_new_by_curve_name(nid);
|
|
Packit |
fd8b60 |
if (gd->group == NULL)
|
|
Packit |
fd8b60 |
goto error;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
gd->ctx = BN_CTX_new();
|
|
Packit |
fd8b60 |
if (gd->ctx == NULL)
|
|
Packit |
fd8b60 |
goto error;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
gd->order = BN_new();
|
|
Packit |
fd8b60 |
if (gd->order == NULL)
|
|
Packit |
fd8b60 |
goto error;
|
|
Packit |
fd8b60 |
if (!EC_GROUP_get_order(gd->group, gd->order, gd->ctx))
|
|
Packit |
fd8b60 |
goto error;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
gd->M = EC_POINT_new(gd->group);
|
|
Packit |
fd8b60 |
if (gd->M == NULL)
|
|
Packit |
fd8b60 |
goto error;
|
|
Packit |
fd8b60 |
if (!EC_POINT_oct2point(gd->group, gd->M, reg->m, reg->elem_len, gd->ctx))
|
|
Packit |
fd8b60 |
goto error;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
gd->N = EC_POINT_new(gd->group);
|
|
Packit |
fd8b60 |
if (gd->N == NULL)
|
|
Packit |
fd8b60 |
goto error;
|
|
Packit |
fd8b60 |
if (!EC_POINT_oct2point(gd->group, gd->N, reg->n, reg->elem_len, gd->ctx))
|
|
Packit |
fd8b60 |
goto error;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
gd->md = md;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
*gdata_out = gd;
|
|
Packit |
fd8b60 |
return 0;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
error:
|
|
Packit |
fd8b60 |
ossl_fini(gd);
|
|
Packit |
fd8b60 |
return ENOMEM;
|
|
Packit |
fd8b60 |
}
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
/* Convert pseudo-random bytes into a scalar value in constant time.
|
|
Packit |
fd8b60 |
* Return NULL on failure. */
|
|
Packit |
fd8b60 |
static BIGNUM *
|
|
Packit |
fd8b60 |
unmarshal_w(const groupdata *gdata, const uint8_t *wbytes)
|
|
Packit |
fd8b60 |
{
|
|
Packit |
fd8b60 |
const spake_iana *reg = gdata->gdef->reg;
|
|
Packit |
fd8b60 |
BIGNUM *w = NULL;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
w = BN_new();
|
|
Packit |
fd8b60 |
if (w == NULL)
|
|
Packit |
fd8b60 |
return NULL;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
BN_set_flags(w, BN_FLG_CONSTTIME);
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
if (BN_bin2bn(wbytes, reg->mult_len, w) &&
|
|
Packit |
fd8b60 |
BN_div(NULL, w, w, gdata->order, gdata->ctx))
|
|
Packit |
fd8b60 |
return w;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
BN_free(w);
|
|
Packit |
fd8b60 |
return NULL;
|
|
Packit |
fd8b60 |
}
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
static krb5_error_code
|
|
Packit |
fd8b60 |
ossl_keygen(krb5_context context, groupdata *gdata, const uint8_t *wbytes,
|
|
Packit |
fd8b60 |
krb5_boolean use_m, uint8_t *priv_out, uint8_t *pub_out)
|
|
Packit |
fd8b60 |
{
|
|
Packit |
fd8b60 |
const spake_iana *reg = gdata->gdef->reg;
|
|
Packit |
fd8b60 |
const EC_POINT *constant = use_m ? gdata->M : gdata->N;
|
|
Packit |
fd8b60 |
krb5_boolean success = FALSE;
|
|
Packit |
fd8b60 |
EC_POINT *pub = NULL;
|
|
Packit |
fd8b60 |
BIGNUM *priv = NULL, *w = NULL;
|
|
Packit |
fd8b60 |
size_t len;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
w = unmarshal_w(gdata, wbytes);
|
|
Packit |
fd8b60 |
if (w == NULL)
|
|
Packit |
fd8b60 |
goto cleanup;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
pub = EC_POINT_new(gdata->group);
|
|
Packit |
fd8b60 |
if (pub == NULL)
|
|
Packit |
fd8b60 |
goto cleanup;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
priv = BN_new();
|
|
Packit |
fd8b60 |
if (priv == NULL)
|
|
Packit |
fd8b60 |
goto cleanup;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
if (!BN_rand_range(priv, gdata->order))
|
|
Packit |
fd8b60 |
goto cleanup;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
/* Compute priv*G + w*constant; EC_POINT_mul() does this in one call. */
|
|
Packit |
fd8b60 |
if (!EC_POINT_mul(gdata->group, pub, priv, constant, w, gdata->ctx))
|
|
Packit |
fd8b60 |
goto cleanup;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
/* Marshal priv into priv_out. */
|
|
Packit |
fd8b60 |
memset(priv_out, 0, reg->mult_len);
|
|
Packit |
fd8b60 |
BN_bn2bin(priv, &priv_out[reg->mult_len - BN_num_bytes(priv)]);
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
/* Marshal pub into pub_out. */
|
|
Packit |
fd8b60 |
len = EC_POINT_point2oct(gdata->group, pub, POINT_CONVERSION_COMPRESSED,
|
|
Packit |
fd8b60 |
pub_out, reg->elem_len, gdata->ctx);
|
|
Packit |
fd8b60 |
if (len != reg->elem_len)
|
|
Packit |
fd8b60 |
goto cleanup;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
success = TRUE;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
cleanup:
|
|
Packit |
fd8b60 |
EC_POINT_free(pub);
|
|
Packit |
fd8b60 |
BN_clear_free(priv);
|
|
Packit |
fd8b60 |
BN_clear_free(w);
|
|
Packit |
fd8b60 |
return success ? 0 : ENOMEM;
|
|
Packit |
fd8b60 |
}
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
static krb5_error_code
|
|
Packit |
fd8b60 |
ossl_result(krb5_context context, groupdata *gdata, const uint8_t *wbytes,
|
|
Packit |
fd8b60 |
const uint8_t *ourpriv, const uint8_t *theirpub,
|
|
Packit |
fd8b60 |
krb5_boolean use_m, uint8_t *elem_out)
|
|
Packit |
fd8b60 |
{
|
|
Packit |
fd8b60 |
const spake_iana *reg = gdata->gdef->reg;
|
|
Packit |
fd8b60 |
const EC_POINT *constant = use_m ? gdata->M : gdata->N;
|
|
Packit |
fd8b60 |
krb5_boolean success = FALSE, invalid = FALSE;
|
|
Packit |
fd8b60 |
EC_POINT *result = NULL, *pub = NULL;
|
|
Packit |
fd8b60 |
BIGNUM *priv = NULL, *w = NULL;
|
|
Packit |
fd8b60 |
size_t len;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
w = unmarshal_w(gdata, wbytes);
|
|
Packit |
fd8b60 |
if (w == NULL)
|
|
Packit |
fd8b60 |
goto cleanup;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
priv = BN_bin2bn(ourpriv, reg->mult_len, NULL);
|
|
Packit |
fd8b60 |
if (priv == NULL)
|
|
Packit |
fd8b60 |
goto cleanup;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
pub = EC_POINT_new(gdata->group);
|
|
Packit |
fd8b60 |
if (pub == NULL)
|
|
Packit |
fd8b60 |
goto cleanup;
|
|
Packit |
fd8b60 |
if (!EC_POINT_oct2point(gdata->group, pub, theirpub, reg->elem_len,
|
|
Packit |
fd8b60 |
gdata->ctx)) {
|
|
Packit |
fd8b60 |
invalid = TRUE;
|
|
Packit |
fd8b60 |
goto cleanup;
|
|
Packit |
fd8b60 |
}
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
/* Compute result = priv*(pub - w*constant), using result to hold the
|
|
Packit |
fd8b60 |
* intermediate steps. */
|
|
Packit |
fd8b60 |
result = EC_POINT_new(gdata->group);
|
|
Packit |
fd8b60 |
if (result == NULL)
|
|
Packit |
fd8b60 |
goto cleanup;
|
|
Packit |
fd8b60 |
if (!EC_POINT_mul(gdata->group, result, NULL, constant, w, gdata->ctx))
|
|
Packit |
fd8b60 |
goto cleanup;
|
|
Packit |
fd8b60 |
if (!EC_POINT_invert(gdata->group, result, gdata->ctx))
|
|
Packit |
fd8b60 |
goto cleanup;
|
|
Packit |
fd8b60 |
if (!EC_POINT_add(gdata->group, result, pub, result, gdata->ctx))
|
|
Packit |
fd8b60 |
goto cleanup;
|
|
Packit |
fd8b60 |
if (!EC_POINT_mul(gdata->group, result, NULL, result, priv, gdata->ctx))
|
|
Packit |
fd8b60 |
goto cleanup;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
/* Marshal result into elem_out. */
|
|
Packit |
fd8b60 |
len = EC_POINT_point2oct(gdata->group, result, POINT_CONVERSION_COMPRESSED,
|
|
Packit |
fd8b60 |
elem_out, reg->elem_len, gdata->ctx);
|
|
Packit |
fd8b60 |
if (len != reg->elem_len)
|
|
Packit |
fd8b60 |
goto cleanup;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
success = TRUE;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
cleanup:
|
|
Packit |
fd8b60 |
BN_clear_free(priv);
|
|
Packit |
fd8b60 |
BN_clear_free(w);
|
|
Packit |
fd8b60 |
EC_POINT_free(pub);
|
|
Packit |
fd8b60 |
EC_POINT_clear_free(result);
|
|
Packit |
fd8b60 |
return invalid ? EINVAL : (success ? 0 : ENOMEM);
|
|
Packit |
fd8b60 |
}
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
static krb5_error_code
|
|
Packit |
fd8b60 |
ossl_hash(krb5_context context, groupdata *gdata, const krb5_data *dlist,
|
|
Packit |
fd8b60 |
size_t ndata, uint8_t *result_out)
|
|
Packit |
fd8b60 |
{
|
|
Packit |
fd8b60 |
EVP_MD_CTX *ctx;
|
|
Packit |
fd8b60 |
size_t i;
|
|
Packit |
fd8b60 |
int ok;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
ctx = EVP_MD_CTX_new();
|
|
Packit |
fd8b60 |
if (ctx == NULL)
|
|
Packit |
fd8b60 |
return ENOMEM;
|
|
Packit |
fd8b60 |
ok = EVP_DigestInit_ex(ctx, gdata->md, NULL);
|
|
Packit |
fd8b60 |
for (i = 0; i < ndata; i++)
|
|
Packit |
fd8b60 |
ok = ok && EVP_DigestUpdate(ctx, dlist[i].data, dlist[i].length);
|
|
Packit |
fd8b60 |
ok = ok && EVP_DigestFinal_ex(ctx, result_out, NULL);
|
|
Packit |
fd8b60 |
EVP_MD_CTX_free(ctx);
|
|
Packit |
fd8b60 |
return ok ? 0 : ENOMEM;
|
|
Packit |
fd8b60 |
}
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
groupdef ossl_P256 = {
|
|
Packit |
fd8b60 |
.reg = &spake_iana_p256,
|
|
Packit |
fd8b60 |
.init = ossl_init,
|
|
Packit |
fd8b60 |
.fini = ossl_fini,
|
|
Packit |
fd8b60 |
.keygen = ossl_keygen,
|
|
Packit |
fd8b60 |
.result = ossl_result,
|
|
Packit |
fd8b60 |
.hash = ossl_hash,
|
|
Packit |
fd8b60 |
};
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
groupdef ossl_P384 = {
|
|
Packit |
fd8b60 |
.reg = &spake_iana_p384,
|
|
Packit |
fd8b60 |
.init = ossl_init,
|
|
Packit |
fd8b60 |
.fini = ossl_fini,
|
|
Packit |
fd8b60 |
.keygen = ossl_keygen,
|
|
Packit |
fd8b60 |
.result = ossl_result,
|
|
Packit |
fd8b60 |
.hash = ossl_hash,
|
|
Packit |
fd8b60 |
};
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
groupdef ossl_P521 = {
|
|
Packit |
fd8b60 |
.reg = &spake_iana_p521,
|
|
Packit |
fd8b60 |
.init = ossl_init,
|
|
Packit |
fd8b60 |
.fini = ossl_fini,
|
|
Packit |
fd8b60 |
.keygen = ossl_keygen,
|
|
Packit |
fd8b60 |
.result = ossl_result,
|
|
Packit |
fd8b60 |
.hash = ossl_hash,
|
|
Packit |
fd8b60 |
};
|
|
Packit |
fd8b60 |
#endif /* SPAKE_OPENSSL */
|