| /* |
| * Diffie-Hellman-Merkle key exchange |
| * |
| * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved |
| * SPDX-License-Identifier: Apache-2.0 |
| * |
| * Licensed under the Apache License, Version 2.0 (the "License"); you may |
| * not use this file except in compliance with the License. |
| * You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT |
| * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| * |
| * This file is part of mbed TLS (https://tls.mbed.org) |
| */ |
| /* |
| * The following sources were referenced in the design of this implementation |
| * of the Diffie-Hellman-Merkle algorithm: |
| * |
| * [1] Handbook of Applied Cryptography - 1997, Chapter 12 |
| * Menezes, van Oorschot and Vanstone |
| * |
| */ |
| |
| #if !defined(MBEDTLS_CONFIG_FILE) |
| #include "mbedtls/config.h" |
| #else |
| #include MBEDTLS_CONFIG_FILE |
| #endif |
| |
| #if defined(MBEDTLS_DHM_C) |
| |
| #include "mbedtls/dhm.h" |
| |
| #include <string.h> |
| |
| #if defined(MBEDTLS_PEM_PARSE_C) |
| #include "mbedtls/pem.h" |
| #endif |
| |
| #if defined(MBEDTLS_ASN1_PARSE_C) |
| #include "mbedtls/asn1.h" |
| #endif |
| |
| #if defined(MBEDTLS_PLATFORM_C) |
| #include "mbedtls/platform.h" |
| #else |
| #include <stdlib.h> |
| #include <stdio.h> |
| #define mbedtls_printf printf |
| #define mbedtls_calloc calloc |
| #define mbedtls_free free |
| #endif |
| |
| /* |
| * Diffie-Hellman groups from RFC 5114 |
| * |
| * \warning The origin of the primes in RFC 5114 is not documented and |
| * their use therefore constitutes a security risk! |
| * |
| * \deprecated The primes from RFC 5114 are superseded by the primes |
| * from RFC 3526 and RFC 7919 and should no longer be used. |
| * They will be removed in the next major version. |
| */ |
| |
| const char * const mbedtls_dhm_rfc5114_modp_2048_p = |
| "AD107E1E9123A9D0D660FAA79559C51FA20D64E5683B9FD1" |
| "B54B1597B61D0A75E6FA141DF95A56DBAF9A3C407BA1DF15" |
| "EB3D688A309C180E1DE6B85A1274A0A66D3F8152AD6AC212" |
| "9037C9EDEFDA4DF8D91E8FEF55B7394B7AD5B7D0B6C12207" |
| "C9F98D11ED34DBF6C6BA0B2C8BBC27BE6A00E0A0B9C49708" |
| "B3BF8A317091883681286130BC8985DB1602E714415D9330" |
| "278273C7DE31EFDC7310F7121FD5A07415987D9ADC0A486D" |
| "CDF93ACC44328387315D75E198C641A480CD86A1B9E587E8" |
| "BE60E69CC928B2B9C52172E413042E9B23F10B0E16E79763" |
| "C9B53DCF4BA80A29E3FB73C16B8E75B97EF363E2FFA31F71" |
| "CF9DE5384E71B81C0AC4DFFE0C10E64F"; |
| const char * const mbedtls_dhm_rfc5114_modp_2048_g = |
| "AC4032EF4F2D9AE39DF30B5C8FFDAC506CDEBE7B89998CAF" |
| "74866A08CFE4FFE3A6824A4E10B9A6F0DD921F01A70C4AFA" |
| "AB739D7700C29F52C57DB17C620A8652BE5E9001A8D66AD7" |
| "C17669101999024AF4D027275AC1348BB8A762D0521BC98A" |
| "E247150422EA1ED409939D54DA7460CDB5F6C6B250717CBE" |
| "F180EB34118E98D119529A45D6F834566E3025E316A330EF" |
| "BB77A86F0C1AB15B051AE3D428C8F8ACB70A8137150B8EEB" |
| "10E183EDD19963DDD9E263E4770589EF6AA21E7F5F2FF381" |
| "B539CCE3409D13CD566AFBB48D6C019181E1BCFE94B30269" |
| "EDFE72FE9B6AA4BD7B5A0F1C71CFFF4C19C418E1F6EC0179" |
| "81BC087F2A7065B384B890D3191F2BFA"; |
| |
| /* |
| * Diffie-Hellman groups from RFC 3526 |
| */ |
| |
| const char * const mbedtls_dhm_rfc3526_modp_2048_p = |
| "FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD1" |
| "29024E088A67CC74020BBEA63B139B22514A08798E3404DD" |
| "EF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245" |
| "E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7ED" |
| "EE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3D" |
| "C2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F" |
| "83655D23DCA3AD961C62F356208552BB9ED529077096966D" |
| "670C354E4ABC9804F1746C08CA18217C32905E462E36CE3B" |
| "E39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9" |
| "DE2BCBF6955817183995497CEA956AE515D2261898FA0510" |
| "15728E5A8AACAA68FFFFFFFFFFFFFFFF"; |
| const char * const mbedtls_dhm_rfc3526_modp_2048_g = "02"; |
| |
| const char * const mbedtls_dhm_rfc3526_modp_3072_p = |
| "FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD1" |
| "29024E088A67CC74020BBEA63B139B22514A08798E3404DD" |
| "EF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245" |
| "E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7ED" |
| "EE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3D" |
| "C2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F" |
| "83655D23DCA3AD961C62F356208552BB9ED529077096966D" |
| "670C354E4ABC9804F1746C08CA18217C32905E462E36CE3B" |
| "E39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9" |
| "DE2BCBF6955817183995497CEA956AE515D2261898FA0510" |
| "15728E5A8AAAC42DAD33170D04507A33A85521ABDF1CBA64" |
| "ECFB850458DBEF0A8AEA71575D060C7DB3970F85A6E1E4C7" |
| "ABF5AE8CDB0933D71E8C94E04A25619DCEE3D2261AD2EE6B" |
| "F12FFA06D98A0864D87602733EC86A64521F2B18177B200C" |
| "BBE117577A615D6C770988C0BAD946E208E24FA074E5AB31" |
| "43DB5BFCE0FD108E4B82D120A93AD2CAFFFFFFFFFFFFFFFF"; |
| const char * const mbedtls_dhm_rfc3526_modp_3072_g = "02"; |
| |
| const char * const mbedtls_dhm_rfc3526_modp_4096_p = |
| "FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD1" |
| "29024E088A67CC74020BBEA63B139B22514A08798E3404DD" |
| "EF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245" |
| "E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7ED" |
| "EE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3D" |
| "C2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F" |
| "83655D23DCA3AD961C62F356208552BB9ED529077096966D" |
| "670C354E4ABC9804F1746C08CA18217C32905E462E36CE3B" |
| "E39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9" |
| "DE2BCBF6955817183995497CEA956AE515D2261898FA0510" |
| "15728E5A8AAAC42DAD33170D04507A33A85521ABDF1CBA64" |
| "ECFB850458DBEF0A8AEA71575D060C7DB3970F85A6E1E4C7" |
| "ABF5AE8CDB0933D71E8C94E04A25619DCEE3D2261AD2EE6B" |
| "F12FFA06D98A0864D87602733EC86A64521F2B18177B200C" |
| "BBE117577A615D6C770988C0BAD946E208E24FA074E5AB31" |
| "43DB5BFCE0FD108E4B82D120A92108011A723C12A787E6D7" |
| "88719A10BDBA5B2699C327186AF4E23C1A946834B6150BDA" |
| "2583E9CA2AD44CE8DBBBC2DB04DE8EF92E8EFC141FBECAA6" |
| "287C59474E6BC05D99B2964FA090C3A2233BA186515BE7ED" |
| "1F612970CEE2D7AFB81BDD762170481CD0069127D5B05AA9" |
| "93B4EA988D8FDDC186FFB7DC90A6C08F4DF435C934063199" |
| "FFFFFFFFFFFFFFFF"; |
| const char * const mbedtls_dhm_rfc3526_modp_4096_g = "02"; |
| |
| /* |
| * Diffie-Hellman groups from RFC 7919 |
| */ |
| |
| const char * const mbedtls_dhm_rfc7919_ffdhe2048_p = |
| "FFFFFFFFFFFFFFFFADF85458A2BB4A9AAFDC5620273D3CF1" |
| "D8B9C583CE2D3695A9E13641146433FBCC939DCE249B3EF9" |
| "7D2FE363630C75D8F681B202AEC4617AD3DF1ED5D5FD6561" |
| "2433F51F5F066ED0856365553DED1AF3B557135E7F57C935" |
| "984F0C70E0E68B77E2A689DAF3EFE8721DF158A136ADE735" |
| "30ACCA4F483A797ABC0AB182B324FB61D108A94BB2C8E3FB" |
| "B96ADAB760D7F4681D4F42A3DE394DF4AE56EDE76372BB19" |
| "0B07A7C8EE0A6D709E02FCE1CDF7E2ECC03404CD28342F61" |
| "9172FE9CE98583FF8E4F1232EEF28183C3FE3B1B4C6FAD73" |
| "3BB5FCBC2EC22005C58EF1837D1683B2C6F34A26C1B2EFFA" |
| "886B423861285C97FFFFFFFFFFFFFFFF"; |
| const char * const mbedtls_dhm_rfc7919_ffdhe2048_g = "02"; |
| |
| const char * const mbedtls_dhm_rfc7919_ffdhe3072_p = |
| "FFFFFFFFFFFFFFFFADF85458A2BB4A9AAFDC5620273D3CF1" |
| "D8B9C583CE2D3695A9E13641146433FBCC939DCE249B3EF9" |
| "7D2FE363630C75D8F681B202AEC4617AD3DF1ED5D5FD6561" |
| "2433F51F5F066ED0856365553DED1AF3B557135E7F57C935" |
| "984F0C70E0E68B77E2A689DAF3EFE8721DF158A136ADE735" |
| "30ACCA4F483A797ABC0AB182B324FB61D108A94BB2C8E3FB" |
| "B96ADAB760D7F4681D4F42A3DE394DF4AE56EDE76372BB19" |
| "0B07A7C8EE0A6D709E02FCE1CDF7E2ECC03404CD28342F61" |
| "9172FE9CE98583FF8E4F1232EEF28183C3FE3B1B4C6FAD73" |
| "3BB5FCBC2EC22005C58EF1837D1683B2C6F34A26C1B2EFFA" |
| "886B4238611FCFDCDE355B3B6519035BBC34F4DEF99C0238" |
| "61B46FC9D6E6C9077AD91D2691F7F7EE598CB0FAC186D91C" |
| "AEFE130985139270B4130C93BC437944F4FD4452E2D74DD3" |
| "64F2E21E71F54BFF5CAE82AB9C9DF69EE86D2BC522363A0D" |
| "ABC521979B0DEADA1DBF9A42D5C4484E0ABCD06BFA53DDEF" |
| "3C1B20EE3FD59D7C25E41D2B66C62E37FFFFFFFFFFFFFFFF"; |
| const char * const mbedtls_dhm_rfc7919_ffdhe3072_g = "02"; |
| |
| const char * const mbedtls_dhm_rfc7919_ffdhe4096_p = |
| "FFFFFFFFFFFFFFFFADF85458A2BB4A9AAFDC5620273D3CF1" |
| "D8B9C583CE2D3695A9E13641146433FBCC939DCE249B3EF9" |
| "7D2FE363630C75D8F681B202AEC4617AD3DF1ED5D5FD6561" |
| "2433F51F5F066ED0856365553DED1AF3B557135E7F57C935" |
| "984F0C70E0E68B77E2A689DAF3EFE8721DF158A136ADE735" |
| "30ACCA4F483A797ABC0AB182B324FB61D108A94BB2C8E3FB" |
| "B96ADAB760D7F4681D4F42A3DE394DF4AE56EDE76372BB19" |
| "0B07A7C8EE0A6D709E02FCE1CDF7E2ECC03404CD28342F61" |
| "9172FE9CE98583FF8E4F1232EEF28183C3FE3B1B4C6FAD73" |
| "3BB5FCBC2EC22005C58EF1837D1683B2C6F34A26C1B2EFFA" |
| "886B4238611FCFDCDE355B3B6519035BBC34F4DEF99C0238" |
| "61B46FC9D6E6C9077AD91D2691F7F7EE598CB0FAC186D91C" |
| "AEFE130985139270B4130C93BC437944F4FD4452E2D74DD3" |
| "64F2E21E71F54BFF5CAE82AB9C9DF69EE86D2BC522363A0D" |
| "ABC521979B0DEADA1DBF9A42D5C4484E0ABCD06BFA53DDEF" |
| "3C1B20EE3FD59D7C25E41D2B669E1EF16E6F52C3164DF4FB" |
| "7930E9E4E58857B6AC7D5F42D69F6D187763CF1D55034004" |
| "87F55BA57E31CC7A7135C886EFB4318AED6A1E012D9E6832" |
| "A907600A918130C46DC778F971AD0038092999A333CB8B7A" |
| "1A1DB93D7140003C2A4ECEA9F98D0ACC0A8291CDCEC97DCF" |
| "8EC9B55A7F88A46B4DB5A851F44182E1C68A007E5E655F6A" |
| "FFFFFFFFFFFFFFFF"; |
| const char * const mbedtls_dhm_rfc7919_ffdhe4096_g = "02"; |
| |
| const char * const mbedtls_dhm_rfc7919_ffdhe6144_p = |
| "FFFFFFFFFFFFFFFFADF85458A2BB4A9AAFDC5620273D3CF1" |
| "D8B9C583CE2D3695A9E13641146433FBCC939DCE249B3EF9" |
| "7D2FE363630C75D8F681B202AEC4617AD3DF1ED5D5FD6561" |
| "2433F51F5F066ED0856365553DED1AF3B557135E7F57C935" |
| "984F0C70E0E68B77E2A689DAF3EFE8721DF158A136ADE735" |
| "30ACCA4F483A797ABC0AB182B324FB61D108A94BB2C8E3FB" |
| "B96ADAB760D7F4681D4F42A3DE394DF4AE56EDE76372BB19" |
| "0B07A7C8EE0A6D709E02FCE1CDF7E2ECC03404CD28342F61" |
| "9172FE9CE98583FF8E4F1232EEF28183C3FE3B1B4C6FAD73" |
| "3BB5FCBC2EC22005C58EF1837D1683B2C6F34A26C1B2EFFA" |
| "886B4238611FCFDCDE355B3B6519035BBC34F4DEF99C0238" |
| "61B46FC9D6E6C9077AD91D2691F7F7EE598CB0FAC186D91C" |
| "AEFE130985139270B4130C93BC437944F4FD4452E2D74DD3" |
| "64F2E21E71F54BFF5CAE82AB9C9DF69EE86D2BC522363A0D" |
| "ABC521979B0DEADA1DBF9A42D5C4484E0ABCD06BFA53DDEF" |
| "3C1B20EE3FD59D7C25E41D2B669E1EF16E6F52C3164DF4FB" |
| "7930E9E4E58857B6AC7D5F42D69F6D187763CF1D55034004" |
| "87F55BA57E31CC7A7135C886EFB4318AED6A1E012D9E6832" |
| "A907600A918130C46DC778F971AD0038092999A333CB8B7A" |
| "1A1DB93D7140003C2A4ECEA9F98D0ACC0A8291CDCEC97DCF" |
| "8EC9B55A7F88A46B4DB5A851F44182E1C68A007E5E0DD902" |
| "0BFD64B645036C7A4E677D2C38532A3A23BA4442CAF53EA6" |
| "3BB454329B7624C8917BDD64B1C0FD4CB38E8C334C701C3A" |
| "CDAD0657FCCFEC719B1F5C3E4E46041F388147FB4CFDB477" |
| "A52471F7A9A96910B855322EDB6340D8A00EF092350511E3" |
| "0ABEC1FFF9E3A26E7FB29F8C183023C3587E38DA0077D9B4" |
| "763E4E4B94B2BBC194C6651E77CAF992EEAAC0232A281BF6" |
| "B3A739C1226116820AE8DB5847A67CBEF9C9091B462D538C" |
| "D72B03746AE77F5E62292C311562A846505DC82DB854338A" |
| "E49F5235C95B91178CCF2DD5CACEF403EC9D1810C6272B04" |
| "5B3B71F9DC6B80D63FDD4A8E9ADB1E6962A69526D43161C1" |
| "A41D570D7938DAD4A40E329CD0E40E65FFFFFFFFFFFFFFFF"; |
| const char * const mbedtls_dhm_rfc7919_ffdhe6144_g = "02"; |
| |
| const char * const mbedtls_dhm_rfc7919_ffdhe8192_p = |
| "FFFFFFFFFFFFFFFFADF85458A2BB4A9AAFDC5620273D3CF1" |
| "D8B9C583CE2D3695A9E13641146433FBCC939DCE249B3EF9" |
| "7D2FE363630C75D8F681B202AEC4617AD3DF1ED5D5FD6561" |
| "2433F51F5F066ED0856365553DED1AF3B557135E7F57C935" |
| "984F0C70E0E68B77E2A689DAF3EFE8721DF158A136ADE735" |
| "30ACCA4F483A797ABC0AB182B324FB61D108A94BB2C8E3FB" |
| "B96ADAB760D7F4681D4F42A3DE394DF4AE56EDE76372BB19" |
| "0B07A7C8EE0A6D709E02FCE1CDF7E2ECC03404CD28342F61" |
| "9172FE9CE98583FF8E4F1232EEF28183C3FE3B1B4C6FAD73" |
| "3BB5FCBC2EC22005C58EF1837D1683B2C6F34A26C1B2EFFA" |
| "886B4238611FCFDCDE355B3B6519035BBC34F4DEF99C0238" |
| "61B46FC9D6E6C9077AD91D2691F7F7EE598CB0FAC186D91C" |
| "AEFE130985139270B4130C93BC437944F4FD4452E2D74DD3" |
| "64F2E21E71F54BFF5CAE82AB9C9DF69EE86D2BC522363A0D" |
| "ABC521979B0DEADA1DBF9A42D5C4484E0ABCD06BFA53DDEF" |
| "3C1B20EE3FD59D7C25E41D2B669E1EF16E6F52C3164DF4FB" |
| "7930E9E4E58857B6AC7D5F42D69F6D187763CF1D55034004" |
| "87F55BA57E31CC7A7135C886EFB4318AED6A1E012D9E6832" |
| "A907600A918130C46DC778F971AD0038092999A333CB8B7A" |
| "1A1DB93D7140003C2A4ECEA9F98D0ACC0A8291CDCEC97DCF" |
| "8EC9B55A7F88A46B4DB5A851F44182E1C68A007E5E0DD902" |
| "0BFD64B645036C7A4E677D2C38532A3A23BA4442CAF53EA6" |
| "3BB454329B7624C8917BDD64B1C0FD4CB38E8C334C701C3A" |
| "CDAD0657FCCFEC719B1F5C3E4E46041F388147FB4CFDB477" |
| "A52471F7A9A96910B855322EDB6340D8A00EF092350511E3" |
| "0ABEC1FFF9E3A26E7FB29F8C183023C3587E38DA0077D9B4" |
| "763E4E4B94B2BBC194C6651E77CAF992EEAAC0232A281BF6" |
| "B3A739C1226116820AE8DB5847A67CBEF9C9091B462D538C" |
| "D72B03746AE77F5E62292C311562A846505DC82DB854338A" |
| "E49F5235C95B91178CCF2DD5CACEF403EC9D1810C6272B04" |
| "5B3B71F9DC6B80D63FDD4A8E9ADB1E6962A69526D43161C1" |
| "A41D570D7938DAD4A40E329CCFF46AAA36AD004CF600C838" |
| "1E425A31D951AE64FDB23FCEC9509D43687FEB69EDD1CC5E" |
| "0B8CC3BDF64B10EF86B63142A3AB8829555B2F747C932665" |
| "CB2C0F1CC01BD70229388839D2AF05E454504AC78B758282" |
| "2846C0BA35C35F5C59160CC046FD8251541FC68C9C86B022" |
| "BB7099876A460E7451A8A93109703FEE1C217E6C3826E52C" |
| "51AA691E0E423CFC99E9E31650C1217B624816CDAD9A95F9" |
| "D5B8019488D9C0A0A1FE3075A577E23183F81D4A3F2FA457" |
| "1EFC8CE0BA8A4FE8B6855DFE72B0A66EDED2FBABFBE58A30" |
| "FAFABE1C5D71A87E2F741EF8C1FE86FEA6BBFDE530677F0D" |
| "97D11D49F7A8443D0822E506A9F4614E011E2A94838FF88C" |
| "D68C8BB7C5C6424CFFFFFFFF" |
| "FFFFFFFF"; |
| const char * const mbedtls_dhm_rfc7919_ffdhe8192_g = "02"; |
| |
| |
| /* Implementation that should never be optimized out by the compiler */ |
| static void mbedtls_zeroize( void *v, size_t n ) { |
| volatile unsigned char *p = v; while( n-- ) *p++ = 0; |
| } |
| |
| /* |
| * helper to validate the mbedtls_mpi size and import it |
| */ |
| static int dhm_read_bignum( mbedtls_mpi *X, |
| unsigned char **p, |
| const unsigned char *end ) |
| { |
| int ret, n; |
| |
| if( end - *p < 2 ) |
| return( MBEDTLS_ERR_DHM_BAD_INPUT_DATA ); |
| |
| n = ( (*p)[0] << 8 ) | (*p)[1]; |
| (*p) += 2; |
| |
| if( (int)( end - *p ) < n ) |
| return( MBEDTLS_ERR_DHM_BAD_INPUT_DATA ); |
| |
| if( ( ret = mbedtls_mpi_read_binary( X, *p, n ) ) != 0 ) |
| return( MBEDTLS_ERR_DHM_READ_PARAMS_FAILED + ret ); |
| |
| (*p) += n; |
| |
| return( 0 ); |
| } |
| |
| /* |
| * Verify sanity of parameter with regards to P |
| * |
| * Parameter should be: 2 <= public_param <= P - 2 |
| * |
| * For more information on the attack, see: |
| * http://www.cl.cam.ac.uk/~rja14/Papers/psandqs.pdf |
| * http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-2643 |
| */ |
| static int dhm_check_range( const mbedtls_mpi *param, const mbedtls_mpi *P ) |
| { |
| mbedtls_mpi L, U; |
| int ret = MBEDTLS_ERR_DHM_BAD_INPUT_DATA; |
| |
| mbedtls_mpi_init( &L ); mbedtls_mpi_init( &U ); |
| |
| MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &L, 2 ) ); |
| MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &U, P, 2 ) ); |
| |
| if( mbedtls_mpi_cmp_mpi( param, &L ) >= 0 && |
| mbedtls_mpi_cmp_mpi( param, &U ) <= 0 ) |
| { |
| ret = 0; |
| } |
| |
| cleanup: |
| mbedtls_mpi_free( &L ); mbedtls_mpi_free( &U ); |
| return( ret ); |
| } |
| |
| void mbedtls_dhm_init( mbedtls_dhm_context *ctx ) |
| { |
| memset( ctx, 0, sizeof( mbedtls_dhm_context ) ); |
| } |
| |
| /* |
| * Parse the ServerKeyExchange parameters |
| */ |
| int mbedtls_dhm_read_params( mbedtls_dhm_context *ctx, |
| unsigned char **p, |
| const unsigned char *end ) |
| { |
| int ret; |
| |
| if( ( ret = dhm_read_bignum( &ctx->P, p, end ) ) != 0 || |
| ( ret = dhm_read_bignum( &ctx->G, p, end ) ) != 0 || |
| ( ret = dhm_read_bignum( &ctx->GY, p, end ) ) != 0 ) |
| return( ret ); |
| |
| if( ( ret = dhm_check_range( &ctx->GY, &ctx->P ) ) != 0 ) |
| return( ret ); |
| |
| ctx->len = mbedtls_mpi_size( &ctx->P ); |
| |
| return( 0 ); |
| } |
| |
| /* |
| * Setup and write the ServerKeyExchange parameters |
| */ |
| int mbedtls_dhm_make_params( mbedtls_dhm_context *ctx, int x_size, |
| unsigned char *output, size_t *olen, |
| int (*f_rng)(void *, unsigned char *, size_t), |
| void *p_rng ) |
| { |
| int ret, count = 0; |
| size_t n1, n2, n3; |
| unsigned char *p; |
| |
| if( mbedtls_mpi_cmp_int( &ctx->P, 0 ) == 0 ) |
| return( MBEDTLS_ERR_DHM_BAD_INPUT_DATA ); |
| |
| /* |
| * Generate X as large as possible ( < P ) |
| */ |
| do |
| { |
| MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &ctx->X, x_size, f_rng, p_rng ) ); |
| |
| while( mbedtls_mpi_cmp_mpi( &ctx->X, &ctx->P ) >= 0 ) |
| MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &ctx->X, 1 ) ); |
| |
| if( count++ > 10 ) |
| return( MBEDTLS_ERR_DHM_MAKE_PARAMS_FAILED ); |
| } |
| while( dhm_check_range( &ctx->X, &ctx->P ) != 0 ); |
| |
| /* |
| * Calculate GX = G^X mod P |
| */ |
| MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &ctx->GX, &ctx->G, &ctx->X, |
| &ctx->P , &ctx->RP ) ); |
| |
| if( ( ret = dhm_check_range( &ctx->GX, &ctx->P ) ) != 0 ) |
| return( ret ); |
| |
| /* |
| * export P, G, GX |
| */ |
| #define DHM_MPI_EXPORT( X, n ) \ |
| do { \ |
| MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( ( X ), \ |
| p + 2, \ |
| ( n ) ) ); \ |
| *p++ = (unsigned char)( ( n ) >> 8 ); \ |
| *p++ = (unsigned char)( ( n ) ); \ |
| p += ( n ); \ |
| } while( 0 ) |
| |
| n1 = mbedtls_mpi_size( &ctx->P ); |
| n2 = mbedtls_mpi_size( &ctx->G ); |
| n3 = mbedtls_mpi_size( &ctx->GX ); |
| |
| p = output; |
| DHM_MPI_EXPORT( &ctx->P , n1 ); |
| DHM_MPI_EXPORT( &ctx->G , n2 ); |
| DHM_MPI_EXPORT( &ctx->GX, n3 ); |
| |
| *olen = p - output; |
| |
| ctx->len = n1; |
| |
| cleanup: |
| |
| if( ret != 0 ) |
| return( MBEDTLS_ERR_DHM_MAKE_PARAMS_FAILED + ret ); |
| |
| return( 0 ); |
| } |
| |
| /* |
| * Import the peer's public value G^Y |
| */ |
| int mbedtls_dhm_read_public( mbedtls_dhm_context *ctx, |
| const unsigned char *input, size_t ilen ) |
| { |
| int ret; |
| |
| if( ctx == NULL || ilen < 1 || ilen > ctx->len ) |
| return( MBEDTLS_ERR_DHM_BAD_INPUT_DATA ); |
| |
| if( ( ret = mbedtls_mpi_read_binary( &ctx->GY, input, ilen ) ) != 0 ) |
| return( MBEDTLS_ERR_DHM_READ_PUBLIC_FAILED + ret ); |
| |
| return( 0 ); |
| } |
| |
| /* |
| * Create own private value X and export G^X |
| */ |
| int mbedtls_dhm_make_public( mbedtls_dhm_context *ctx, int x_size, |
| unsigned char *output, size_t olen, |
| int (*f_rng)(void *, unsigned char *, size_t), |
| void *p_rng ) |
| { |
| int ret, count = 0; |
| |
| if( ctx == NULL || olen < 1 || olen > ctx->len ) |
| return( MBEDTLS_ERR_DHM_BAD_INPUT_DATA ); |
| |
| if( mbedtls_mpi_cmp_int( &ctx->P, 0 ) == 0 ) |
| return( MBEDTLS_ERR_DHM_BAD_INPUT_DATA ); |
| |
| /* |
| * generate X and calculate GX = G^X mod P |
| */ |
| do |
| { |
| MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &ctx->X, x_size, f_rng, p_rng ) ); |
| |
| while( mbedtls_mpi_cmp_mpi( &ctx->X, &ctx->P ) >= 0 ) |
| MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &ctx->X, 1 ) ); |
| |
| if( count++ > 10 ) |
| return( MBEDTLS_ERR_DHM_MAKE_PUBLIC_FAILED ); |
| } |
| while( dhm_check_range( &ctx->X, &ctx->P ) != 0 ); |
| |
| MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &ctx->GX, &ctx->G, &ctx->X, |
| &ctx->P , &ctx->RP ) ); |
| |
| if( ( ret = dhm_check_range( &ctx->GX, &ctx->P ) ) != 0 ) |
| return( ret ); |
| |
| MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &ctx->GX, output, olen ) ); |
| |
| cleanup: |
| |
| if( ret != 0 ) |
| return( MBEDTLS_ERR_DHM_MAKE_PUBLIC_FAILED + ret ); |
| |
| return( 0 ); |
| } |
| |
| /* |
| * Use the blinding method and optimisation suggested in section 10 of: |
| * KOCHER, Paul C. Timing attacks on implementations of Diffie-Hellman, RSA, |
| * DSS, and other systems. In : Advances in Cryptology-CRYPTO'96. Springer |
| * Berlin Heidelberg, 1996. p. 104-113. |
| */ |
| static int dhm_update_blinding( mbedtls_dhm_context *ctx, |
| int (*f_rng)(void *, unsigned char *, size_t), void *p_rng ) |
| { |
| int ret, count; |
| |
| /* |
| * Don't use any blinding the first time a particular X is used, |
| * but remember it to use blinding next time. |
| */ |
| if( mbedtls_mpi_cmp_mpi( &ctx->X, &ctx->pX ) != 0 ) |
| { |
| MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &ctx->pX, &ctx->X ) ); |
| MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &ctx->Vi, 1 ) ); |
| MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &ctx->Vf, 1 ) ); |
| |
| return( 0 ); |
| } |
| |
| /* |
| * Ok, we need blinding. Can we re-use existing values? |
| * If yes, just update them by squaring them. |
| */ |
| if( mbedtls_mpi_cmp_int( &ctx->Vi, 1 ) != 0 ) |
| { |
| MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ctx->Vi, &ctx->Vi, &ctx->Vi ) ); |
| MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &ctx->Vi, &ctx->Vi, &ctx->P ) ); |
| |
| MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ctx->Vf, &ctx->Vf, &ctx->Vf ) ); |
| MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &ctx->Vf, &ctx->Vf, &ctx->P ) ); |
| |
| return( 0 ); |
| } |
| |
| /* |
| * We need to generate blinding values from scratch |
| */ |
| |
| /* Vi = random( 2, P-1 ) */ |
| count = 0; |
| do |
| { |
| MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &ctx->Vi, mbedtls_mpi_size( &ctx->P ), f_rng, p_rng ) ); |
| |
| while( mbedtls_mpi_cmp_mpi( &ctx->Vi, &ctx->P ) >= 0 ) |
| MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &ctx->Vi, 1 ) ); |
| |
| if( count++ > 10 ) |
| return( MBEDTLS_ERR_MPI_NOT_ACCEPTABLE ); |
| } |
| while( mbedtls_mpi_cmp_int( &ctx->Vi, 1 ) <= 0 ); |
| |
| /* Vf = Vi^-X mod P */ |
| MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( &ctx->Vf, &ctx->Vi, &ctx->P ) ); |
| MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &ctx->Vf, &ctx->Vf, &ctx->X, &ctx->P, &ctx->RP ) ); |
| |
| cleanup: |
| return( ret ); |
| } |
| |
| /* |
| * Derive and export the shared secret (G^Y)^X mod P |
| */ |
| int mbedtls_dhm_calc_secret( mbedtls_dhm_context *ctx, |
| unsigned char *output, size_t output_size, size_t *olen, |
| int (*f_rng)(void *, unsigned char *, size_t), |
| void *p_rng ) |
| { |
| int ret; |
| mbedtls_mpi GYb; |
| |
| if( ctx == NULL || output_size < ctx->len ) |
| return( MBEDTLS_ERR_DHM_BAD_INPUT_DATA ); |
| |
| if( ( ret = dhm_check_range( &ctx->GY, &ctx->P ) ) != 0 ) |
| return( ret ); |
| |
| mbedtls_mpi_init( &GYb ); |
| |
| /* Blind peer's value */ |
| if( f_rng != NULL ) |
| { |
| MBEDTLS_MPI_CHK( dhm_update_blinding( ctx, f_rng, p_rng ) ); |
| MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &GYb, &ctx->GY, &ctx->Vi ) ); |
| MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &GYb, &GYb, &ctx->P ) ); |
| } |
| else |
| MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &GYb, &ctx->GY ) ); |
| |
| /* Do modular exponentiation */ |
| MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &ctx->K, &GYb, &ctx->X, |
| &ctx->P, &ctx->RP ) ); |
| |
| /* Unblind secret value */ |
| if( f_rng != NULL ) |
| { |
| MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ctx->K, &ctx->K, &ctx->Vf ) ); |
| MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &ctx->K, &ctx->K, &ctx->P ) ); |
| } |
| |
| *olen = mbedtls_mpi_size( &ctx->K ); |
| |
| MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &ctx->K, output, *olen ) ); |
| |
| cleanup: |
| mbedtls_mpi_free( &GYb ); |
| |
| if( ret != 0 ) |
| return( MBEDTLS_ERR_DHM_CALC_SECRET_FAILED + ret ); |
| |
| return( 0 ); |
| } |
| |
| /* |
| * Free the components of a DHM key |
| */ |
| void mbedtls_dhm_free( mbedtls_dhm_context *ctx ) |
| { |
| mbedtls_mpi_free( &ctx->pX ); mbedtls_mpi_free( &ctx->Vf ); |
| mbedtls_mpi_free( &ctx->Vi ); mbedtls_mpi_free( &ctx->RP ); |
| mbedtls_mpi_free( &ctx->K ); mbedtls_mpi_free( &ctx->GY ); |
| mbedtls_mpi_free( &ctx->GX ); mbedtls_mpi_free( &ctx->X ); |
| mbedtls_mpi_free( &ctx->G ); mbedtls_mpi_free( &ctx->P ); |
| |
| mbedtls_zeroize( ctx, sizeof( mbedtls_dhm_context ) ); |
| } |
| |
| #if defined(MBEDTLS_ASN1_PARSE_C) |
| /* |
| * Parse DHM parameters |
| */ |
| int mbedtls_dhm_parse_dhm( mbedtls_dhm_context *dhm, const unsigned char *dhmin, |
| size_t dhminlen ) |
| { |
| int ret; |
| size_t len; |
| unsigned char *p, *end; |
| #if defined(MBEDTLS_PEM_PARSE_C) |
| mbedtls_pem_context pem; |
| |
| mbedtls_pem_init( &pem ); |
| |
| /* Avoid calling mbedtls_pem_read_buffer() on non-null-terminated string */ |
| if( dhminlen == 0 || dhmin[dhminlen - 1] != '\0' ) |
| ret = MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT; |
| else |
| ret = mbedtls_pem_read_buffer( &pem, |
| "-----BEGIN DH PARAMETERS-----", |
| "-----END DH PARAMETERS-----", |
| dhmin, NULL, 0, &dhminlen ); |
| |
| if( ret == 0 ) |
| { |
| /* |
| * Was PEM encoded |
| */ |
| dhminlen = pem.buflen; |
| } |
| else if( ret != MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT ) |
| goto exit; |
| |
| p = ( ret == 0 ) ? pem.buf : (unsigned char *) dhmin; |
| #else |
| p = (unsigned char *) dhmin; |
| #endif /* MBEDTLS_PEM_PARSE_C */ |
| end = p + dhminlen; |
| |
| /* |
| * DHParams ::= SEQUENCE { |
| * prime INTEGER, -- P |
| * generator INTEGER, -- g |
| * privateValueLength INTEGER OPTIONAL |
| * } |
| */ |
| if( ( ret = mbedtls_asn1_get_tag( &p, end, &len, |
| MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 ) |
| { |
| ret = MBEDTLS_ERR_DHM_INVALID_FORMAT + ret; |
| goto exit; |
| } |
| |
| end = p + len; |
| |
| if( ( ret = mbedtls_asn1_get_mpi( &p, end, &dhm->P ) ) != 0 || |
| ( ret = mbedtls_asn1_get_mpi( &p, end, &dhm->G ) ) != 0 ) |
| { |
| ret = MBEDTLS_ERR_DHM_INVALID_FORMAT + ret; |
| goto exit; |
| } |
| |
| if( p != end ) |
| { |
| /* This might be the optional privateValueLength. |
| * If so, we can cleanly discard it */ |
| mbedtls_mpi rec; |
| mbedtls_mpi_init( &rec ); |
| ret = mbedtls_asn1_get_mpi( &p, end, &rec ); |
| mbedtls_mpi_free( &rec ); |
| if ( ret != 0 ) |
| { |
| ret = MBEDTLS_ERR_DHM_INVALID_FORMAT + ret; |
| goto exit; |
| } |
| if ( p != end ) |
| { |
| ret = MBEDTLS_ERR_DHM_INVALID_FORMAT + |
| MBEDTLS_ERR_ASN1_LENGTH_MISMATCH; |
| goto exit; |
| } |
| } |
| |
| ret = 0; |
| |
| dhm->len = mbedtls_mpi_size( &dhm->P ); |
| |
| exit: |
| #if defined(MBEDTLS_PEM_PARSE_C) |
| mbedtls_pem_free( &pem ); |
| #endif |
| if( ret != 0 ) |
| mbedtls_dhm_free( dhm ); |
| |
| return( ret ); |
| } |
| |
| #if defined(MBEDTLS_FS_IO) |
| /* |
| * Load all data from a file into a given buffer. |
| * |
| * The file is expected to contain either PEM or DER encoded data. |
| * A terminating null byte is always appended. It is included in the announced |
| * length only if the data looks like it is PEM encoded. |
| */ |
| static int load_file( const char *path, unsigned char **buf, size_t *n ) |
| { |
| FILE *f; |
| long size; |
| |
| if( ( f = fopen( path, "rb" ) ) == NULL ) |
| return( MBEDTLS_ERR_DHM_FILE_IO_ERROR ); |
| |
| fseek( f, 0, SEEK_END ); |
| if( ( size = ftell( f ) ) == -1 ) |
| { |
| fclose( f ); |
| return( MBEDTLS_ERR_DHM_FILE_IO_ERROR ); |
| } |
| fseek( f, 0, SEEK_SET ); |
| |
| *n = (size_t) size; |
| |
| if( *n + 1 == 0 || |
| ( *buf = mbedtls_calloc( 1, *n + 1 ) ) == NULL ) |
| { |
| fclose( f ); |
| return( MBEDTLS_ERR_DHM_ALLOC_FAILED ); |
| } |
| |
| if( fread( *buf, 1, *n, f ) != *n ) |
| { |
| fclose( f ); |
| mbedtls_free( *buf ); |
| return( MBEDTLS_ERR_DHM_FILE_IO_ERROR ); |
| } |
| |
| fclose( f ); |
| |
| (*buf)[*n] = '\0'; |
| |
| if( strstr( (const char *) *buf, "-----BEGIN " ) != NULL ) |
| ++*n; |
| |
| return( 0 ); |
| } |
| |
| /* |
| * Load and parse DHM parameters |
| */ |
| int mbedtls_dhm_parse_dhmfile( mbedtls_dhm_context *dhm, const char *path ) |
| { |
| int ret; |
| size_t n; |
| unsigned char *buf; |
| |
| if( ( ret = load_file( path, &buf, &n ) ) != 0 ) |
| return( ret ); |
| |
| ret = mbedtls_dhm_parse_dhm( dhm, buf, n ); |
| |
| mbedtls_zeroize( buf, n ); |
| mbedtls_free( buf ); |
| |
| return( ret ); |
| } |
| #endif /* MBEDTLS_FS_IO */ |
| #endif /* MBEDTLS_ASN1_PARSE_C */ |
| |
| #if defined(MBEDTLS_SELF_TEST) |
| |
| static const char mbedtls_test_dhm_params[] = |
| "-----BEGIN DH PARAMETERS-----\r\n" |
| "MIGHAoGBAJ419DBEOgmQTzo5qXl5fQcN9TN455wkOL7052HzxxRVMyhYmwQcgJvh\r\n" |
| "1sa18fyfR9OiVEMYglOpkqVoGLN7qd5aQNNi5W7/C+VBdHTBJcGZJyyP5B3qcz32\r\n" |
| "9mLJKudlVudV0Qxk5qUJaPZ/xupz0NyoVpviuiBOI1gNi8ovSXWzAgEC\r\n" |
| "-----END DH PARAMETERS-----\r\n"; |
| |
| static const size_t mbedtls_test_dhm_params_len = sizeof( mbedtls_test_dhm_params ); |
| |
| /* |
| * Checkup routine |
| */ |
| int mbedtls_dhm_self_test( int verbose ) |
| { |
| int ret; |
| mbedtls_dhm_context dhm; |
| |
| mbedtls_dhm_init( &dhm ); |
| |
| if( verbose != 0 ) |
| mbedtls_printf( " DHM parameter load: " ); |
| |
| if( ( ret = mbedtls_dhm_parse_dhm( &dhm, |
| (const unsigned char *) mbedtls_test_dhm_params, |
| mbedtls_test_dhm_params_len ) ) != 0 ) |
| { |
| if( verbose != 0 ) |
| mbedtls_printf( "failed\n" ); |
| |
| ret = 1; |
| goto exit; |
| } |
| |
| if( verbose != 0 ) |
| mbedtls_printf( "passed\n\n" ); |
| |
| exit: |
| mbedtls_dhm_free( &dhm ); |
| |
| return( ret ); |
| } |
| |
| #endif /* MBEDTLS_SELF_TEST */ |
| |
| #endif /* MBEDTLS_DHM_C */ |