Coverage Report

Created: 2024-11-21 07:03

/src/nss-nspr/nss/lib/freebl/ecl/ecp_25519.c
Line
Count
Source (jump to first uncovered line)
1
/* This Source Code Form is subject to the terms of the Mozilla Public
2
 * License, v. 2.0. If a copy of the MPL was not distributed with this
3
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
4
5
/* curve 25519 https://www.rfc-editor.org/rfc/rfc7748.txt */
6
7
#ifdef FREEBL_NO_DEPEND
8
#include "../stubs.h"
9
#endif
10
11
#include "ecl-priv.h"
12
#include "secitem.h"
13
#include "secerr.h"
14
#include "secport.h"
15
#include <stdlib.h>
16
#include <stdio.h>
17
18
/*
19
 * point validation is not necessary in general. But this checks a point (px)
20
 * against some known bad values.
21
 */
22
SECStatus
23
ec_Curve25519_pt_validate(const SECItem *px)
24
0
{
25
0
    PRUint8 *p;
26
0
    PRUint64 i;
27
0
    PRUint8 forbiddenValues[12][32] = {
28
0
        { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
29
0
          0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
30
0
          0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
31
0
          0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
32
0
        { 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
33
0
          0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
34
0
          0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
35
0
          0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
36
0
        { 0xe0, 0xeb, 0x7a, 0x7c, 0x3b, 0x41, 0xb8, 0xae,
37
0
          0x16, 0x56, 0xe3, 0xfa, 0xf1, 0x9f, 0xc4, 0x6a,
38
0
          0xda, 0x09, 0x8d, 0xeb, 0x9c, 0x32, 0xb1, 0xfd,
39
0
          0x86, 0x62, 0x05, 0x16, 0x5f, 0x49, 0xb8, 0x00 },
40
0
        { 0x5f, 0x9c, 0x95, 0xbc, 0xa3, 0x50, 0x8c, 0x24,
41
0
          0xb1, 0xd0, 0xb1, 0x55, 0x9c, 0x83, 0xef, 0x5b,
42
0
          0x04, 0x44, 0x5c, 0xc4, 0x58, 0x1c, 0x8e, 0x86,
43
0
          0xd8, 0x22, 0x4e, 0xdd, 0xd0, 0x9f, 0x11, 0x57 },
44
0
        { 0xec, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
45
0
          0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
46
0
          0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
47
0
          0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
48
0
        { 0xed, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
49
0
          0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
50
0
          0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
51
0
          0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
52
0
        { 0xee, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
53
0
          0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
54
0
          0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
55
0
          0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
56
0
        { 0xcd, 0xeb, 0x7a, 0x7c, 0x3b, 0x41, 0xb8, 0xae,
57
0
          0x16, 0x56, 0xe3, 0xfa, 0xf1, 0x9f, 0xc4, 0x6a,
58
0
          0xda, 0x09, 0x8d, 0xeb, 0x9c, 0x32, 0xb1, 0xfd,
59
0
          0x86, 0x62, 0x05, 0x16, 0x5f, 0x49, 0xb8, 0x80 },
60
0
        { 0x4c, 0x9c, 0x95, 0xbc, 0xa3, 0x50, 0x8c, 0x24,
61
0
          0xb1, 0xd0, 0xb1, 0x55, 0x9c, 0x83, 0xef, 0x5b,
62
0
          0x04, 0x44, 0x5c, 0xc4, 0x58, 0x1c, 0x8e, 0x86,
63
0
          0xd8, 0x22, 0x4e, 0xdd, 0xd0, 0x9f, 0x11, 0xd7 },
64
0
        { 0xd9, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
65
0
          0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
66
0
          0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
67
0
          0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
68
0
        { 0xda, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
69
0
          0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
70
0
          0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
71
0
          0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
72
0
        { 0xdb, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
73
0
          0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
74
0
          0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
75
0
          0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
76
0
    };
77
78
0
    if (px->len == 32) {
79
0
        p = px->data;
80
0
    } else {
81
0
        return SECFailure;
82
0
    }
83
84
0
    for (i = 0; i < PR_ARRAY_SIZE(forbiddenValues); ++i) {
85
0
        if (NSS_SecureMemcmp(p, forbiddenValues[i], px->len) == 0) {
86
0
            return SECFailure;
87
0
        }
88
0
    }
89
90
0
    return SECSuccess;
91
0
}
92
93
/*
94
 * scalar validation is not necessary.
95
 */
96
SECStatus
97
ec_Curve25519_scalar_validate(const SECItem *scalar)
98
0
{
99
0
    if (!scalar || !scalar->data) {
100
0
        PORT_SetError(SEC_ERROR_INVALID_ARGS);
101
0
        return SECFailure;
102
0
    }
103
104
0
    if (scalar->len != 32) {
105
0
        PORT_SetError(SEC_ERROR_BAD_KEY);
106
0
        return SECFailure;
107
0
    }
108
0
    return SECSuccess;
109
0
}
110
111
/*
112
 * Scalar multiplication for Curve25519.
113
 * If P == NULL, the base point is used.
114
 * Returns X = k*P
115
 */
116
SECStatus
117
ec_Curve25519_pt_mul(SECItem *X, SECItem *k, SECItem *P)
118
0
{
119
0
    PRUint8 *px;
120
0
    PRUint8 basePoint[32] = { 9 };
121
122
0
    if (!P) {
123
0
        px = basePoint;
124
0
    } else {
125
0
        PORT_Assert(P->len == 32);
126
0
        if (P->len != 32) {
127
0
            return SECFailure;
128
0
        }
129
0
        px = P->data;
130
0
    }
131
0
    if (k->len != 32) {
132
0
        return SECFailure;
133
0
    }
134
135
0
    SECStatus rv = ec_Curve25519_mul(X->data, k->data, px);
136
0
    if (NSS_SecureMemcmpZero(X->data, X->len) == 0) {
137
0
        return SECFailure;
138
0
    }
139
0
    return rv;
140
0
}