/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
/* plugins/preauth/spake/openssl.c - SPAKE implementations using OpenSSL */
/*
* Copyright (C) 2015 by the Massachusetts Institute of Technology.
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* * Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* * Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
* COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
* INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include "k5-int.h"
#include "groups.h"
#include "iana.h"
#ifdef SPAKE_OPENSSL
#include <openssl/bn.h>
#include <openssl/ec.h>
#include <openssl/obj_mac.h>
#include <openssl/evp.h>
/* OpenSSL 1.1 standardizes constructor and destructor names, renaming
* EVP_MD_CTX_create and EVP_MD_CTX_destroy. */
#if OPENSSL_VERSION_NUMBER < 0x10100000L
#define EVP_MD_CTX_new EVP_MD_CTX_create
#define EVP_MD_CTX_free EVP_MD_CTX_destroy
#endif
struct groupdata_st {
const groupdef *gdef;
EC_GROUP *group;
BIGNUM *order;
BN_CTX *ctx;
EC_POINT *M;
EC_POINT *N;
const EVP_MD *md;
};
static void
ossl_fini(groupdata *gd)
{
if (gd == NULL)
return;
EC_GROUP_free(gd->group);
EC_POINT_free(gd->M);
EC_POINT_free(gd->N);
BN_CTX_free(gd->ctx);
BN_free(gd->order);
free(gd);
}
static krb5_error_code
ossl_init(krb5_context context, const groupdef *gdef, groupdata **gdata_out)
{
const spake_iana *reg = gdef->reg;
const EVP_MD *md;
groupdata *gd;
int nid;
switch (reg->id) {
case SPAKE_GROUP_P256:
nid = NID_X9_62_prime256v1;
md = EVP_sha256();
break;
case SPAKE_GROUP_P384:
nid = NID_secp384r1;
md = EVP_sha384();
break;
case SPAKE_GROUP_P521:
nid = NID_secp521r1;
md = EVP_sha512();
break;
default:
return EINVAL;
};
gd = calloc(1, sizeof(*gd));
if (gd == NULL)
return ENOMEM;
gd->gdef = gdef;
gd->group = EC_GROUP_new_by_curve_name(nid);
if (gd->group == NULL)
goto error;
gd->ctx = BN_CTX_new();
if (gd->ctx == NULL)
goto error;
gd->order = BN_new();
if (gd->order == NULL)
goto error;
if (!EC_GROUP_get_order(gd->group, gd->order, gd->ctx))
goto error;
gd->M = EC_POINT_new(gd->group);
if (gd->M == NULL)
goto error;
if (!EC_POINT_oct2point(gd->group, gd->M, reg->m, reg->elem_len, gd->ctx))
goto error;
gd->N = EC_POINT_new(gd->group);
if (gd->N == NULL)
goto error;
if (!EC_POINT_oct2point(gd->group, gd->N, reg->n, reg->elem_len, gd->ctx))
goto error;
gd->md = md;
*gdata_out = gd;
return 0;
error:
ossl_fini(gd);
return ENOMEM;
}
/* Convert pseudo-random bytes into a scalar value in constant time.
* Return NULL on failure. */
static BIGNUM *
unmarshal_w(const groupdata *gdata, const uint8_t *wbytes)
{
const spake_iana *reg = gdata->gdef->reg;
BIGNUM *w = NULL;
w = BN_new();
if (w == NULL)
return NULL;
BN_set_flags(w, BN_FLG_CONSTTIME);
if (BN_bin2bn(wbytes, reg->mult_len, w) &&
BN_div(NULL, w, w, gdata->order, gdata->ctx))
return w;
BN_free(w);
return NULL;
}
static krb5_error_code
ossl_keygen(krb5_context context, groupdata *gdata, const uint8_t *wbytes,
krb5_boolean use_m, uint8_t *priv_out, uint8_t *pub_out)
{
const spake_iana *reg = gdata->gdef->reg;
const EC_POINT *constant = use_m ? gdata->M : gdata->N;
krb5_boolean success = FALSE;
EC_POINT *pub = NULL;
BIGNUM *priv = NULL, *w = NULL;
size_t len;
w = unmarshal_w(gdata, wbytes);
if (w == NULL)
goto cleanup;
pub = EC_POINT_new(gdata->group);
if (pub == NULL)
goto cleanup;
priv = BN_new();
if (priv == NULL)
goto cleanup;
if (!BN_rand_range(priv, gdata->order))
goto cleanup;
/* Compute priv*G + w*constant; EC_POINT_mul() does this in one call. */
if (!EC_POINT_mul(gdata->group, pub, priv, constant, w, gdata->ctx))
goto cleanup;
/* Marshal priv into priv_out. */
memset(priv_out, 0, reg->mult_len);
BN_bn2bin(priv, &priv_out[reg->mult_len - BN_num_bytes(priv)]);
/* Marshal pub into pub_out. */
len = EC_POINT_point2oct(gdata->group, pub, POINT_CONVERSION_COMPRESSED,
pub_out, reg->elem_len, gdata->ctx);
if (len != reg->elem_len)
goto cleanup;
success = TRUE;
cleanup:
EC_POINT_free(pub);
BN_clear_free(priv);
BN_clear_free(w);
return success ? 0 : ENOMEM;
}
static krb5_error_code
ossl_result(krb5_context context, groupdata *gdata, const uint8_t *wbytes,
const uint8_t *ourpriv, const uint8_t *theirpub,
krb5_boolean use_m, uint8_t *elem_out)
{
const spake_iana *reg = gdata->gdef->reg;
const EC_POINT *constant = use_m ? gdata->M : gdata->N;
krb5_boolean success = FALSE, invalid = FALSE;
EC_POINT *result = NULL, *pub = NULL;
BIGNUM *priv = NULL, *w = NULL;
size_t len;
w = unmarshal_w(gdata, wbytes);
if (w == NULL)
goto cleanup;
priv = BN_bin2bn(ourpriv, reg->mult_len, NULL);
if (priv == NULL)
goto cleanup;
pub = EC_POINT_new(gdata->group);
if (pub == NULL)
goto cleanup;
if (!EC_POINT_oct2point(gdata->group, pub, theirpub, reg->elem_len,
gdata->ctx)) {
invalid = TRUE;
goto cleanup;
}
/* Compute result = priv*(pub - w*constant), using result to hold the
* intermediate steps. */
result = EC_POINT_new(gdata->group);
if (result == NULL)
goto cleanup;
if (!EC_POINT_mul(gdata->group, result, NULL, constant, w, gdata->ctx))
goto cleanup;
if (!EC_POINT_invert(gdata->group, result, gdata->ctx))
goto cleanup;
if (!EC_POINT_add(gdata->group, result, pub, result, gdata->ctx))
goto cleanup;
if (!EC_POINT_mul(gdata->group, result, NULL, result, priv, gdata->ctx))
goto cleanup;
/* Marshal result into elem_out. */
len = EC_POINT_point2oct(gdata->group, result, POINT_CONVERSION_COMPRESSED,
elem_out, reg->elem_len, gdata->ctx);
if (len != reg->elem_len)
goto cleanup;
success = TRUE;
cleanup:
BN_clear_free(priv);
BN_clear_free(w);
EC_POINT_free(pub);
EC_POINT_clear_free(result);
return invalid ? EINVAL : (success ? 0 : ENOMEM);
}
static krb5_error_code
ossl_hash(krb5_context context, groupdata *gdata, const krb5_data *dlist,
size_t ndata, uint8_t *result_out)
{
EVP_MD_CTX *ctx;
size_t i;
int ok;
ctx = EVP_MD_CTX_new();
if (ctx == NULL)
return ENOMEM;
ok = EVP_DigestInit_ex(ctx, gdata->md, NULL);
for (i = 0; i < ndata; i++)
ok = ok && EVP_DigestUpdate(ctx, dlist[i].data, dlist[i].length);
ok = ok && EVP_DigestFinal_ex(ctx, result_out, NULL);
EVP_MD_CTX_free(ctx);
return ok ? 0 : ENOMEM;
}
groupdef ossl_P256 = {
.reg = &spake_iana_p256,
.init = ossl_init,
.fini = ossl_fini,
.keygen = ossl_keygen,
.result = ossl_result,
.hash = ossl_hash,
};
groupdef ossl_P384 = {
.reg = &spake_iana_p384,
.init = ossl_init,
.fini = ossl_fini,
.keygen = ossl_keygen,
.result = ossl_result,
.hash = ossl_hash,
};
groupdef ossl_P521 = {
.reg = &spake_iana_p521,
.init = ossl_init,
.fini = ossl_fini,
.keygen = ossl_keygen,
.result = ossl_result,
.hash = ossl_hash,
};
#endif /* SPAKE_OPENSSL */