Coverage Report

Created: 2024-11-21 07:03

/src/mbedtls/library/ecdh.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
 *  Elliptic curve Diffie-Hellman
3
 *
4
 *  Copyright The Mbed TLS Contributors
5
 *  SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
6
 */
7
8
/*
9
 * References:
10
 *
11
 * SEC1 https://www.secg.org/sec1-v2.pdf
12
 * RFC 4492
13
 */
14
15
#include "common.h"
16
17
#if defined(MBEDTLS_ECDH_C)
18
19
#include "mbedtls/ecdh.h"
20
#include "mbedtls/platform_util.h"
21
#include "mbedtls/error.h"
22
23
#include <string.h>
24
25
#if defined(MBEDTLS_ECDH_LEGACY_CONTEXT)
26
typedef mbedtls_ecdh_context mbedtls_ecdh_context_mbed;
27
#endif
28
29
static mbedtls_ecp_group_id mbedtls_ecdh_grp_id(
30
    const mbedtls_ecdh_context *ctx)
31
0
{
32
#if defined(MBEDTLS_ECDH_LEGACY_CONTEXT)
33
    return ctx->grp.id;
34
#else
35
0
    return ctx->grp_id;
36
0
#endif
37
0
}
38
39
int mbedtls_ecdh_can_do(mbedtls_ecp_group_id gid)
40
0
{
41
    /* At this time, all groups support ECDH. */
42
0
    (void) gid;
43
0
    return 1;
44
0
}
45
46
#if !defined(MBEDTLS_ECDH_GEN_PUBLIC_ALT)
47
/*
48
 * Generate public key (restartable version)
49
 *
50
 * Note: this internal function relies on its caller preserving the value of
51
 * the output parameter 'd' across continuation calls. This would not be
52
 * acceptable for a public function but is OK here as we control call sites.
53
 */
54
static int ecdh_gen_public_restartable(mbedtls_ecp_group *grp,
55
                                       mbedtls_mpi *d, mbedtls_ecp_point *Q,
56
                                       int (*f_rng)(void *, unsigned char *, size_t),
57
                                       void *p_rng,
58
                                       mbedtls_ecp_restart_ctx *rs_ctx)
59
0
{
60
0
    int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
61
62
0
    int restarting = 0;
63
#if defined(MBEDTLS_ECP_RESTARTABLE)
64
    restarting = (rs_ctx != NULL && rs_ctx->rsm != NULL);
65
#endif
66
    /* If multiplication is in progress, we already generated a privkey */
67
0
    if (!restarting) {
68
0
        MBEDTLS_MPI_CHK(mbedtls_ecp_gen_privkey(grp, d, f_rng, p_rng));
69
0
    }
70
71
0
    MBEDTLS_MPI_CHK(mbedtls_ecp_mul_restartable(grp, Q, d, &grp->G,
72
0
                                                f_rng, p_rng, rs_ctx));
73
74
0
cleanup:
75
0
    return ret;
76
0
}
77
78
/*
79
 * Generate public key
80
 */
81
int mbedtls_ecdh_gen_public(mbedtls_ecp_group *grp, mbedtls_mpi *d, mbedtls_ecp_point *Q,
82
                            int (*f_rng)(void *, unsigned char *, size_t),
83
                            void *p_rng)
84
0
{
85
0
    return ecdh_gen_public_restartable(grp, d, Q, f_rng, p_rng, NULL);
86
0
}
87
#endif /* !MBEDTLS_ECDH_GEN_PUBLIC_ALT */
88
89
#if !defined(MBEDTLS_ECDH_COMPUTE_SHARED_ALT)
90
/*
91
 * Compute shared secret (SEC1 3.3.1)
92
 */
93
static int ecdh_compute_shared_restartable(mbedtls_ecp_group *grp,
94
                                           mbedtls_mpi *z,
95
                                           const mbedtls_ecp_point *Q, const mbedtls_mpi *d,
96
                                           int (*f_rng)(void *, unsigned char *, size_t),
97
                                           void *p_rng,
98
                                           mbedtls_ecp_restart_ctx *rs_ctx)
99
0
{
100
0
    int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
101
0
    mbedtls_ecp_point P;
102
103
0
    mbedtls_ecp_point_init(&P);
104
105
0
    MBEDTLS_MPI_CHK(mbedtls_ecp_mul_restartable(grp, &P, d, Q,
106
0
                                                f_rng, p_rng, rs_ctx));
107
108
0
    if (mbedtls_ecp_is_zero(&P)) {
109
0
        ret = MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
110
0
        goto cleanup;
111
0
    }
112
113
0
    MBEDTLS_MPI_CHK(mbedtls_mpi_copy(z, &P.X));
114
115
0
cleanup:
116
0
    mbedtls_ecp_point_free(&P);
117
118
0
    return ret;
119
0
}
120
121
/*
122
 * Compute shared secret (SEC1 3.3.1)
123
 */
124
int mbedtls_ecdh_compute_shared(mbedtls_ecp_group *grp, mbedtls_mpi *z,
125
                                const mbedtls_ecp_point *Q, const mbedtls_mpi *d,
126
                                int (*f_rng)(void *, unsigned char *, size_t),
127
                                void *p_rng)
128
0
{
129
0
    return ecdh_compute_shared_restartable(grp, z, Q, d,
130
0
                                           f_rng, p_rng, NULL);
131
0
}
132
#endif /* !MBEDTLS_ECDH_COMPUTE_SHARED_ALT */
133
134
static void ecdh_init_internal(mbedtls_ecdh_context_mbed *ctx)
135
0
{
136
0
    mbedtls_ecp_group_init(&ctx->grp);
137
0
    mbedtls_mpi_init(&ctx->d);
138
0
    mbedtls_ecp_point_init(&ctx->Q);
139
0
    mbedtls_ecp_point_init(&ctx->Qp);
140
0
    mbedtls_mpi_init(&ctx->z);
141
142
#if defined(MBEDTLS_ECP_RESTARTABLE)
143
    mbedtls_ecp_restart_init(&ctx->rs);
144
#endif
145
0
}
146
147
mbedtls_ecp_group_id mbedtls_ecdh_get_grp_id(mbedtls_ecdh_context *ctx)
148
0
{
149
#if defined(MBEDTLS_ECDH_LEGACY_CONTEXT)
150
    return ctx->MBEDTLS_PRIVATE(grp).id;
151
#else
152
0
    return ctx->MBEDTLS_PRIVATE(grp_id);
153
0
#endif
154
0
}
155
156
/*
157
 * Initialize context
158
 */
159
void mbedtls_ecdh_init(mbedtls_ecdh_context *ctx)
160
0
{
161
#if defined(MBEDTLS_ECDH_LEGACY_CONTEXT)
162
    ecdh_init_internal(ctx);
163
    mbedtls_ecp_point_init(&ctx->Vi);
164
    mbedtls_ecp_point_init(&ctx->Vf);
165
    mbedtls_mpi_init(&ctx->_d);
166
#else
167
0
    memset(ctx, 0, sizeof(mbedtls_ecdh_context));
168
169
0
    ctx->var = MBEDTLS_ECDH_VARIANT_NONE;
170
0
#endif
171
0
    ctx->point_format = MBEDTLS_ECP_PF_UNCOMPRESSED;
172
#if defined(MBEDTLS_ECP_RESTARTABLE)
173
    ctx->restart_enabled = 0;
174
#endif
175
0
}
176
177
static int ecdh_setup_internal(mbedtls_ecdh_context_mbed *ctx,
178
                               mbedtls_ecp_group_id grp_id)
179
0
{
180
0
    int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
181
182
0
    ret = mbedtls_ecp_group_load(&ctx->grp, grp_id);
183
0
    if (ret != 0) {
184
0
        return MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE;
185
0
    }
186
187
0
    return 0;
188
0
}
189
190
/*
191
 * Setup context
192
 */
193
int mbedtls_ecdh_setup(mbedtls_ecdh_context *ctx, mbedtls_ecp_group_id grp_id)
194
0
{
195
#if defined(MBEDTLS_ECDH_LEGACY_CONTEXT)
196
    return ecdh_setup_internal(ctx, grp_id);
197
#else
198
0
    switch (grp_id) {
199
#if defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED)
200
        case MBEDTLS_ECP_DP_CURVE25519:
201
            ctx->point_format = MBEDTLS_ECP_PF_COMPRESSED;
202
            ctx->var = MBEDTLS_ECDH_VARIANT_EVEREST;
203
            ctx->grp_id = grp_id;
204
            return mbedtls_everest_setup(&ctx->ctx.everest_ecdh, grp_id);
205
#endif
206
0
        default:
207
0
            ctx->point_format = MBEDTLS_ECP_PF_UNCOMPRESSED;
208
0
            ctx->var = MBEDTLS_ECDH_VARIANT_MBEDTLS_2_0;
209
0
            ctx->grp_id = grp_id;
210
0
            ecdh_init_internal(&ctx->ctx.mbed_ecdh);
211
0
            return ecdh_setup_internal(&ctx->ctx.mbed_ecdh, grp_id);
212
0
    }
213
0
#endif
214
0
}
215
216
static void ecdh_free_internal(mbedtls_ecdh_context_mbed *ctx)
217
0
{
218
0
    mbedtls_ecp_group_free(&ctx->grp);
219
0
    mbedtls_mpi_free(&ctx->d);
220
0
    mbedtls_ecp_point_free(&ctx->Q);
221
0
    mbedtls_ecp_point_free(&ctx->Qp);
222
0
    mbedtls_mpi_free(&ctx->z);
223
224
#if defined(MBEDTLS_ECP_RESTARTABLE)
225
    mbedtls_ecp_restart_free(&ctx->rs);
226
#endif
227
0
}
228
229
#if defined(MBEDTLS_ECP_RESTARTABLE)
230
/*
231
 * Enable restartable operations for context
232
 */
233
void mbedtls_ecdh_enable_restart(mbedtls_ecdh_context *ctx)
234
{
235
    ctx->restart_enabled = 1;
236
}
237
#endif
238
239
/*
240
 * Free context
241
 */
242
void mbedtls_ecdh_free(mbedtls_ecdh_context *ctx)
243
0
{
244
0
    if (ctx == NULL) {
245
0
        return;
246
0
    }
247
248
#if defined(MBEDTLS_ECDH_LEGACY_CONTEXT)
249
    mbedtls_ecp_point_free(&ctx->Vi);
250
    mbedtls_ecp_point_free(&ctx->Vf);
251
    mbedtls_mpi_free(&ctx->_d);
252
    ecdh_free_internal(ctx);
253
#else
254
0
    switch (ctx->var) {
255
#if defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED)
256
        case MBEDTLS_ECDH_VARIANT_EVEREST:
257
            mbedtls_everest_free(&ctx->ctx.everest_ecdh);
258
            break;
259
#endif
260
0
        case MBEDTLS_ECDH_VARIANT_MBEDTLS_2_0:
261
0
            ecdh_free_internal(&ctx->ctx.mbed_ecdh);
262
0
            break;
263
0
        default:
264
0
            break;
265
0
    }
266
267
0
    ctx->point_format = MBEDTLS_ECP_PF_UNCOMPRESSED;
268
0
    ctx->var = MBEDTLS_ECDH_VARIANT_NONE;
269
0
    ctx->grp_id = MBEDTLS_ECP_DP_NONE;
270
0
#endif
271
0
}
272
273
static int ecdh_make_params_internal(mbedtls_ecdh_context_mbed *ctx,
274
                                     size_t *olen, int point_format,
275
                                     unsigned char *buf, size_t blen,
276
                                     int (*f_rng)(void *,
277
                                                  unsigned char *,
278
                                                  size_t),
279
                                     void *p_rng,
280
                                     int restart_enabled)
281
0
{
282
0
    int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
283
0
    size_t grp_len, pt_len;
284
#if defined(MBEDTLS_ECP_RESTARTABLE)
285
    mbedtls_ecp_restart_ctx *rs_ctx = NULL;
286
#endif
287
288
0
    if (ctx->grp.pbits == 0) {
289
0
        return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
290
0
    }
291
292
#if defined(MBEDTLS_ECP_RESTARTABLE)
293
    if (restart_enabled) {
294
        rs_ctx = &ctx->rs;
295
    }
296
#else
297
0
    (void) restart_enabled;
298
0
#endif
299
300
301
#if defined(MBEDTLS_ECP_RESTARTABLE)
302
    if ((ret = ecdh_gen_public_restartable(&ctx->grp, &ctx->d, &ctx->Q,
303
                                           f_rng, p_rng, rs_ctx)) != 0) {
304
        return ret;
305
    }
306
#else
307
0
    if ((ret = mbedtls_ecdh_gen_public(&ctx->grp, &ctx->d, &ctx->Q,
308
0
                                       f_rng, p_rng)) != 0) {
309
0
        return ret;
310
0
    }
311
0
#endif /* MBEDTLS_ECP_RESTARTABLE */
312
313
0
    if ((ret = mbedtls_ecp_tls_write_group(&ctx->grp, &grp_len, buf,
314
0
                                           blen)) != 0) {
315
0
        return ret;
316
0
    }
317
318
0
    buf += grp_len;
319
0
    blen -= grp_len;
320
321
0
    if ((ret = mbedtls_ecp_tls_write_point(&ctx->grp, &ctx->Q, point_format,
322
0
                                           &pt_len, buf, blen)) != 0) {
323
0
        return ret;
324
0
    }
325
326
0
    *olen = grp_len + pt_len;
327
0
    return 0;
328
0
}
329
330
/*
331
 * Setup and write the ServerKeyExchange parameters (RFC 4492)
332
 *      struct {
333
 *          ECParameters    curve_params;
334
 *          ECPoint         public;
335
 *      } ServerECDHParams;
336
 */
337
int mbedtls_ecdh_make_params(mbedtls_ecdh_context *ctx, size_t *olen,
338
                             unsigned char *buf, size_t blen,
339
                             int (*f_rng)(void *, unsigned char *, size_t),
340
                             void *p_rng)
341
0
{
342
0
    int restart_enabled = 0;
343
#if defined(MBEDTLS_ECP_RESTARTABLE)
344
    restart_enabled = ctx->restart_enabled;
345
#else
346
0
    (void) restart_enabled;
347
0
#endif
348
349
#if defined(MBEDTLS_ECDH_LEGACY_CONTEXT)
350
    return ecdh_make_params_internal(ctx, olen, ctx->point_format, buf, blen,
351
                                     f_rng, p_rng, restart_enabled);
352
#else
353
0
    switch (ctx->var) {
354
#if defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED)
355
        case MBEDTLS_ECDH_VARIANT_EVEREST:
356
            return mbedtls_everest_make_params(&ctx->ctx.everest_ecdh, olen,
357
                                               buf, blen, f_rng, p_rng);
358
#endif
359
0
        case MBEDTLS_ECDH_VARIANT_MBEDTLS_2_0:
360
0
            return ecdh_make_params_internal(&ctx->ctx.mbed_ecdh, olen,
361
0
                                             ctx->point_format, buf, blen,
362
0
                                             f_rng, p_rng,
363
0
                                             restart_enabled);
364
0
        default:
365
0
            return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
366
0
    }
367
0
#endif
368
0
}
369
370
static int ecdh_read_params_internal(mbedtls_ecdh_context_mbed *ctx,
371
                                     const unsigned char **buf,
372
                                     const unsigned char *end)
373
0
{
374
0
    return mbedtls_ecp_tls_read_point(&ctx->grp, &ctx->Qp, buf,
375
0
                                      (size_t) (end - *buf));
376
0
}
377
378
/*
379
 * Read the ServerKeyExchange parameters (RFC 4492)
380
 *      struct {
381
 *          ECParameters    curve_params;
382
 *          ECPoint         public;
383
 *      } ServerECDHParams;
384
 */
385
int mbedtls_ecdh_read_params(mbedtls_ecdh_context *ctx,
386
                             const unsigned char **buf,
387
                             const unsigned char *end)
388
0
{
389
0
    int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
390
0
    mbedtls_ecp_group_id grp_id;
391
0
    if ((ret = mbedtls_ecp_tls_read_group_id(&grp_id, buf, (size_t) (end - *buf)))
392
0
        != 0) {
393
0
        return ret;
394
0
    }
395
396
0
    if ((ret = mbedtls_ecdh_setup(ctx, grp_id)) != 0) {
397
0
        return ret;
398
0
    }
399
400
#if defined(MBEDTLS_ECDH_LEGACY_CONTEXT)
401
    return ecdh_read_params_internal(ctx, buf, end);
402
#else
403
0
    switch (ctx->var) {
404
#if defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED)
405
        case MBEDTLS_ECDH_VARIANT_EVEREST:
406
            return mbedtls_everest_read_params(&ctx->ctx.everest_ecdh,
407
                                               buf, end);
408
#endif
409
0
        case MBEDTLS_ECDH_VARIANT_MBEDTLS_2_0:
410
0
            return ecdh_read_params_internal(&ctx->ctx.mbed_ecdh,
411
0
                                             buf, end);
412
0
        default:
413
0
            return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
414
0
    }
415
0
#endif
416
0
}
417
418
static int ecdh_get_params_internal(mbedtls_ecdh_context_mbed *ctx,
419
                                    const mbedtls_ecp_keypair *key,
420
                                    mbedtls_ecdh_side side)
421
0
{
422
0
    int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
423
424
    /* If it's not our key, just import the public part as Qp */
425
0
    if (side == MBEDTLS_ECDH_THEIRS) {
426
0
        return mbedtls_ecp_copy(&ctx->Qp, &key->Q);
427
0
    }
428
429
    /* Our key: import public (as Q) and private parts */
430
0
    if (side != MBEDTLS_ECDH_OURS) {
431
0
        return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
432
0
    }
433
434
0
    if ((ret = mbedtls_ecp_copy(&ctx->Q, &key->Q)) != 0 ||
435
0
        (ret = mbedtls_mpi_copy(&ctx->d, &key->d)) != 0) {
436
0
        return ret;
437
0
    }
438
439
0
    return 0;
440
0
}
441
442
/*
443
 * Get parameters from a keypair
444
 */
445
int mbedtls_ecdh_get_params(mbedtls_ecdh_context *ctx,
446
                            const mbedtls_ecp_keypair *key,
447
                            mbedtls_ecdh_side side)
448
0
{
449
0
    int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
450
0
    if (side != MBEDTLS_ECDH_OURS && side != MBEDTLS_ECDH_THEIRS) {
451
0
        return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
452
0
    }
453
454
0
    if (mbedtls_ecdh_grp_id(ctx) == MBEDTLS_ECP_DP_NONE) {
455
        /* This is the first call to get_params(). Set up the context
456
         * for use with the group. */
457
0
        if ((ret = mbedtls_ecdh_setup(ctx, key->grp.id)) != 0) {
458
0
            return ret;
459
0
        }
460
0
    } else {
461
        /* This is not the first call to get_params(). Check that the
462
         * current key's group is the same as the context's, which was set
463
         * from the first key's group. */
464
0
        if (mbedtls_ecdh_grp_id(ctx) != key->grp.id) {
465
0
            return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
466
0
        }
467
0
    }
468
469
#if defined(MBEDTLS_ECDH_LEGACY_CONTEXT)
470
    return ecdh_get_params_internal(ctx, key, side);
471
#else
472
0
    switch (ctx->var) {
473
#if defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED)
474
        case MBEDTLS_ECDH_VARIANT_EVEREST:
475
        {
476
            mbedtls_everest_ecdh_side s = side == MBEDTLS_ECDH_OURS ?
477
                                          MBEDTLS_EVEREST_ECDH_OURS :
478
                                          MBEDTLS_EVEREST_ECDH_THEIRS;
479
            return mbedtls_everest_get_params(&ctx->ctx.everest_ecdh,
480
                                              key, s);
481
        }
482
#endif
483
0
        case MBEDTLS_ECDH_VARIANT_MBEDTLS_2_0:
484
0
            return ecdh_get_params_internal(&ctx->ctx.mbed_ecdh,
485
0
                                            key, side);
486
0
        default:
487
0
            return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
488
0
    }
489
0
#endif
490
0
}
491
492
static int ecdh_make_public_internal(mbedtls_ecdh_context_mbed *ctx,
493
                                     size_t *olen, int point_format,
494
                                     unsigned char *buf, size_t blen,
495
                                     int (*f_rng)(void *,
496
                                                  unsigned char *,
497
                                                  size_t),
498
                                     void *p_rng,
499
                                     int restart_enabled)
500
0
{
501
0
    int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
502
#if defined(MBEDTLS_ECP_RESTARTABLE)
503
    mbedtls_ecp_restart_ctx *rs_ctx = NULL;
504
#endif
505
506
0
    if (ctx->grp.pbits == 0) {
507
0
        return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
508
0
    }
509
510
#if defined(MBEDTLS_ECP_RESTARTABLE)
511
    if (restart_enabled) {
512
        rs_ctx = &ctx->rs;
513
    }
514
#else
515
0
    (void) restart_enabled;
516
0
#endif
517
518
#if defined(MBEDTLS_ECP_RESTARTABLE)
519
    if ((ret = ecdh_gen_public_restartable(&ctx->grp, &ctx->d, &ctx->Q,
520
                                           f_rng, p_rng, rs_ctx)) != 0) {
521
        return ret;
522
    }
523
#else
524
0
    if ((ret = mbedtls_ecdh_gen_public(&ctx->grp, &ctx->d, &ctx->Q,
525
0
                                       f_rng, p_rng)) != 0) {
526
0
        return ret;
527
0
    }
528
0
#endif /* MBEDTLS_ECP_RESTARTABLE */
529
530
0
    return mbedtls_ecp_tls_write_point(&ctx->grp, &ctx->Q, point_format, olen,
531
0
                                       buf, blen);
532
0
}
533
534
/*
535
 * Setup and export the client public value
536
 */
537
int mbedtls_ecdh_make_public(mbedtls_ecdh_context *ctx, size_t *olen,
538
                             unsigned char *buf, size_t blen,
539
                             int (*f_rng)(void *, unsigned char *, size_t),
540
                             void *p_rng)
541
0
{
542
0
    int restart_enabled = 0;
543
#if defined(MBEDTLS_ECP_RESTARTABLE)
544
    restart_enabled = ctx->restart_enabled;
545
#endif
546
547
#if defined(MBEDTLS_ECDH_LEGACY_CONTEXT)
548
    return ecdh_make_public_internal(ctx, olen, ctx->point_format, buf, blen,
549
                                     f_rng, p_rng, restart_enabled);
550
#else
551
0
    switch (ctx->var) {
552
#if defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED)
553
        case MBEDTLS_ECDH_VARIANT_EVEREST:
554
            return mbedtls_everest_make_public(&ctx->ctx.everest_ecdh, olen,
555
                                               buf, blen, f_rng, p_rng);
556
#endif
557
0
        case MBEDTLS_ECDH_VARIANT_MBEDTLS_2_0:
558
0
            return ecdh_make_public_internal(&ctx->ctx.mbed_ecdh, olen,
559
0
                                             ctx->point_format, buf, blen,
560
0
                                             f_rng, p_rng,
561
0
                                             restart_enabled);
562
0
        default:
563
0
            return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
564
0
    }
565
0
#endif
566
0
}
567
568
static int ecdh_read_public_internal(mbedtls_ecdh_context_mbed *ctx,
569
                                     const unsigned char *buf, size_t blen)
570
0
{
571
0
    int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
572
0
    const unsigned char *p = buf;
573
574
0
    if ((ret = mbedtls_ecp_tls_read_point(&ctx->grp, &ctx->Qp, &p,
575
0
                                          blen)) != 0) {
576
0
        return ret;
577
0
    }
578
579
0
    if ((size_t) (p - buf) != blen) {
580
0
        return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
581
0
    }
582
583
0
    return 0;
584
0
}
585
586
/*
587
 * Parse and import the client's public value
588
 */
589
int mbedtls_ecdh_read_public(mbedtls_ecdh_context *ctx,
590
                             const unsigned char *buf, size_t blen)
591
0
{
592
#if defined(MBEDTLS_ECDH_LEGACY_CONTEXT)
593
    return ecdh_read_public_internal(ctx, buf, blen);
594
#else
595
0
    switch (ctx->var) {
596
#if defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED)
597
        case MBEDTLS_ECDH_VARIANT_EVEREST:
598
            return mbedtls_everest_read_public(&ctx->ctx.everest_ecdh,
599
                                               buf, blen);
600
#endif
601
0
        case MBEDTLS_ECDH_VARIANT_MBEDTLS_2_0:
602
0
            return ecdh_read_public_internal(&ctx->ctx.mbed_ecdh,
603
0
                                             buf, blen);
604
0
        default:
605
0
            return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
606
0
    }
607
0
#endif
608
0
}
609
610
static int ecdh_calc_secret_internal(mbedtls_ecdh_context_mbed *ctx,
611
                                     size_t *olen, unsigned char *buf,
612
                                     size_t blen,
613
                                     int (*f_rng)(void *,
614
                                                  unsigned char *,
615
                                                  size_t),
616
                                     void *p_rng,
617
                                     int restart_enabled)
618
0
{
619
0
    int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
620
#if defined(MBEDTLS_ECP_RESTARTABLE)
621
    mbedtls_ecp_restart_ctx *rs_ctx = NULL;
622
#endif
623
624
0
    if (ctx == NULL || ctx->grp.pbits == 0) {
625
0
        return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
626
0
    }
627
628
#if defined(MBEDTLS_ECP_RESTARTABLE)
629
    if (restart_enabled) {
630
        rs_ctx = &ctx->rs;
631
    }
632
#else
633
0
    (void) restart_enabled;
634
0
#endif
635
636
#if defined(MBEDTLS_ECP_RESTARTABLE)
637
    if ((ret = ecdh_compute_shared_restartable(&ctx->grp, &ctx->z, &ctx->Qp,
638
                                               &ctx->d, f_rng, p_rng,
639
                                               rs_ctx)) != 0) {
640
        return ret;
641
    }
642
#else
643
0
    if ((ret = mbedtls_ecdh_compute_shared(&ctx->grp, &ctx->z, &ctx->Qp,
644
0
                                           &ctx->d, f_rng, p_rng)) != 0) {
645
0
        return ret;
646
0
    }
647
0
#endif /* MBEDTLS_ECP_RESTARTABLE */
648
649
0
    if (mbedtls_mpi_size(&ctx->z) > blen) {
650
0
        return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
651
0
    }
652
653
0
    *olen = ctx->grp.pbits / 8 + ((ctx->grp.pbits % 8) != 0);
654
655
0
    if (mbedtls_ecp_get_type(&ctx->grp) == MBEDTLS_ECP_TYPE_MONTGOMERY) {
656
0
        return mbedtls_mpi_write_binary_le(&ctx->z, buf, *olen);
657
0
    }
658
659
0
    return mbedtls_mpi_write_binary(&ctx->z, buf, *olen);
660
0
}
661
662
/*
663
 * Derive and export the shared secret
664
 */
665
int mbedtls_ecdh_calc_secret(mbedtls_ecdh_context *ctx, size_t *olen,
666
                             unsigned char *buf, size_t blen,
667
                             int (*f_rng)(void *, unsigned char *, size_t),
668
                             void *p_rng)
669
0
{
670
0
    int restart_enabled = 0;
671
#if defined(MBEDTLS_ECP_RESTARTABLE)
672
    restart_enabled = ctx->restart_enabled;
673
#endif
674
675
#if defined(MBEDTLS_ECDH_LEGACY_CONTEXT)
676
    return ecdh_calc_secret_internal(ctx, olen, buf, blen, f_rng, p_rng,
677
                                     restart_enabled);
678
#else
679
0
    switch (ctx->var) {
680
#if defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED)
681
        case MBEDTLS_ECDH_VARIANT_EVEREST:
682
            return mbedtls_everest_calc_secret(&ctx->ctx.everest_ecdh, olen,
683
                                               buf, blen, f_rng, p_rng);
684
#endif
685
0
        case MBEDTLS_ECDH_VARIANT_MBEDTLS_2_0:
686
0
            return ecdh_calc_secret_internal(&ctx->ctx.mbed_ecdh, olen, buf,
687
0
                                             blen, f_rng, p_rng,
688
0
                                             restart_enabled);
689
0
        default:
690
0
            return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
691
0
    }
692
0
#endif
693
0
}
694
#endif /* MBEDTLS_ECDH_C */