/src/gnutls/lib/auth/ecdhe.c

Source (jump to first uncovered line)
/*
 * Copyright (C) 2011-2012 Free Software Foundation, Inc.
 * Copyright (C) 2017 Red Hat, Inc.
 *
 * Author: Nikos Mavrogiannopoulos
 *
 * This file is part of GnuTLS.
 *
 * The GnuTLS is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public License
 * as published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>
 *
 */

/* This file contains common stuff in Ephemeral Diffie-Hellman (DHE)
 * and Anonymous DH key exchange(DHA). These are used in the handshake
 * procedure of the certificate and anonymous authentication.
 */

#include "gnutls_int.h"
#include "auth.h"
#include "errors.h"
#include "dh.h"
#include "num.h"
#include "tls-sig.h"
#include "state.h"
#include "datum.h"
#include "x509.h"
#include "auth/ecdhe.h"
#include "ecc.h"
#include "ext/supported_groups.h"
#include "algorithms.h"
#include "auth/psk.h"
#include "auth/cert.h"
#include "pk.h"

static int gen_ecdhe_server_kx(gnutls_session_t, gnutls_buffer_st *);
static int proc_ecdhe_server_kx(gnutls_session_t session, uint8_t *data,
        size_t _data_size);
static int proc_ecdhe_client_kx(gnutls_session_t session, uint8_t *data,
        size_t _data_size);

#if defined(ENABLE_ECDHE)
const mod_auth_st ecdhe_ecdsa_auth_struct = {
  "ECDHE_ECDSA",
  _gnutls_gen_cert_server_crt,
  _gnutls_gen_cert_client_crt,
  gen_ecdhe_server_kx,
  _gnutls_gen_ecdh_common_client_kx, /* This is the only difference */
  _gnutls_gen_cert_client_crt_vrfy,
  _gnutls_gen_cert_server_cert_req,

  _gnutls_proc_crt,
  _gnutls_proc_crt,
  proc_ecdhe_server_kx,
  proc_ecdhe_client_kx,
  _gnutls_proc_cert_client_crt_vrfy,
  _gnutls_proc_cert_cert_req
};

const mod_auth_st ecdhe_rsa_auth_struct = {
  "ECDHE_RSA",
  _gnutls_gen_cert_server_crt,
  _gnutls_gen_cert_client_crt,
  gen_ecdhe_server_kx,
  _gnutls_gen_ecdh_common_client_kx, /* This is the only difference */
  _gnutls_gen_cert_client_crt_vrfy,
  _gnutls_gen_cert_server_cert_req,

  _gnutls_proc_crt,
  _gnutls_proc_crt,
  proc_ecdhe_server_kx,
  proc_ecdhe_client_kx,
  _gnutls_proc_cert_client_crt_vrfy,
  _gnutls_proc_cert_cert_req
};

static int calc_ecdh_key(gnutls_session_t session, gnutls_datum_t *psk_key,
       const gnutls_ecc_curve_entry_st *ecurve)
{
  gnutls_pk_params_st pub;
  int ret;
  gnutls_datum_t tmp_dh_key;

  gnutls_pk_params_init(&pub);
  pub.params[ECC_X] = session->key.proto.tls12.ecdh.x;
  pub.params[ECC_Y] = session->key.proto.tls12.ecdh.y;
  pub.raw_pub.data = session->key.proto.tls12.ecdh.raw.data;
  pub.raw_pub.size = session->key.proto.tls12.ecdh.raw.size;
  pub.curve = ecurve->id;

  ret = _gnutls_pk_derive(ecurve->pk, &tmp_dh_key,
        &session->key.proto.tls12.ecdh.params, &pub);
  if (ret < 0) {
    ret = gnutls_assert_val(ret);
    goto cleanup;
  }

  if (psk_key == NULL) {
    memcpy(&session->key.key, &tmp_dh_key, sizeof(gnutls_datum_t));
    tmp_dh_key.data = NULL; /* no longer needed */
  } else {
    ret = _gnutls_set_psk_session_key(session, psk_key,
              &tmp_dh_key);
    _gnutls_free_temp_key_datum(&tmp_dh_key);

    if (ret < 0) {
      ret = gnutls_assert_val(ret);
      goto cleanup;
    }
  }

  ret = 0;

cleanup:
  /* no longer needed */
  _gnutls_mpi_release(&session->key.proto.tls12.ecdh.x);
  _gnutls_mpi_release(&session->key.proto.tls12.ecdh.y);
  _gnutls_free_datum(&session->key.proto.tls12.ecdh.raw);
  gnutls_pk_params_release(&session->key.proto.tls12.ecdh.params);
  return ret;
}

int _gnutls_proc_ecdh_common_client_kx(
  gnutls_session_t session, uint8_t *data, size_t _data_size,
  const struct gnutls_group_entry_st *group, gnutls_datum_t *psk_key)
{
  ssize_t data_size = _data_size;
  int ret, i = 0;
  unsigned point_size;
  const gnutls_ecc_curve_entry_st *ecurve;

  if (group == NULL)
    return gnutls_assert_val(GNUTLS_E_ECC_NO_SUPPORTED_CURVES);

  ecurve = _gnutls_ecc_curve_get_params(group->curve);
  if (ecurve == NULL)
    return gnutls_assert_val(GNUTLS_E_ECC_NO_SUPPORTED_CURVES);

  DECR_LEN(data_size, 1);
  point_size = data[i];
  i += 1;

  if (point_size == 0) {
    ret = gnutls_assert_val(GNUTLS_E_UNEXPECTED_PACKET_LENGTH);
    goto cleanup;
  }

  DECR_LEN(data_size, point_size);

  if (ecurve->pk == GNUTLS_PK_EC) {
    ret = _gnutls_ecc_ansi_x962_import(
      &data[i], point_size, &session->key.proto.tls12.ecdh.x,
      &session->key.proto.tls12.ecdh.y);
    if (ret < 0) {
      gnutls_assert();
      goto cleanup;
    }
  } else if (ecurve->pk == GNUTLS_PK_ECDH_X25519 ||
       ecurve->pk == GNUTLS_PK_ECDH_X448) {
    if (ecurve->size != point_size)
      return gnutls_assert_val(
        GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);

    ret = _gnutls_set_datum(&session->key.proto.tls12.ecdh.raw,
          &data[i], point_size);
    if (ret < 0) {
      gnutls_assert();
      goto cleanup;
    }

    /* RFC7748 requires to mask the MSB in the final byte
     * for X25519 (not X448) */
    if (ecurve->id == GNUTLS_ECC_CURVE_X25519) {
      session->key.proto.tls12.ecdh.raw.data[point_size - 1] &=
        0x7f;
    }
  } else {
    return gnutls_assert_val(GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);
  }

  if (data_size != 0) {
    ret = gnutls_assert_val(GNUTLS_E_UNEXPECTED_PACKET_LENGTH);
    goto cleanup;
  }

  /* generate pre-shared key */
  ret = calc_ecdh_key(session, psk_key, ecurve);
  if (ret < 0) {
    gnutls_assert();
    goto cleanup;
  }
cleanup:
  _gnutls_mpi_release(&session->key.proto.tls12.ecdh.x);
  _gnutls_mpi_release(&session->key.proto.tls12.ecdh.y);
  _gnutls_free_datum(&session->key.proto.tls12.ecdh.raw);
  gnutls_pk_params_clear(&session->key.proto.tls12.ecdh.params);
  return ret;
}

static int proc_ecdhe_client_kx(gnutls_session_t session, uint8_t *data,
        size_t _data_size)
{
  gnutls_certificate_credentials_t cred;

  cred = (gnutls_certificate_credentials_t)_gnutls_get_cred(
    session, GNUTLS_CRD_CERTIFICATE);
  if (cred == NULL) {
    gnutls_assert();
    return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
  }

  return _gnutls_proc_ecdh_common_client_kx(session, data, _data_size,
              get_group(session), NULL);
}

int _gnutls_gen_ecdh_common_client_kx(gnutls_session_t session,
              gnutls_buffer_st *data)
{
  return _gnutls_gen_ecdh_common_client_kx_int(session, data, NULL);
}

int _gnutls_gen_ecdh_common_client_kx_int(gnutls_session_t session,
            gnutls_buffer_st *data,
            gnutls_datum_t *psk_key)
{
  int ret;
  gnutls_datum_t out;
  const gnutls_group_entry_st *group = get_group(session);
  const gnutls_ecc_curve_entry_st *ecurve;
  int pk;
  unsigned init_pos = data->length;

  if (group == NULL)
    return gnutls_assert_val(GNUTLS_E_ECC_NO_SUPPORTED_CURVES);

  ecurve = _gnutls_ecc_curve_get_params(group->curve);
  if (ecurve == NULL)
    return gnutls_assert_val(GNUTLS_E_ECC_NO_SUPPORTED_CURVES);

  pk = ecurve->pk;

  /* generate temporal key */
  ret = _gnutls_pk_generate_keys(
    pk, ecurve->id, &session->key.proto.tls12.ecdh.params, 1);
  if (ret < 0)
    return gnutls_assert_val(ret);

  if (pk == GNUTLS_PK_EC) {
    ret = _gnutls_ecc_ansi_x962_export(
      ecurve->id,
      session->key.proto.tls12.ecdh.params
        .params[ECC_X] /* x */,
      session->key.proto.tls12.ecdh.params
        .params[ECC_Y] /* y */,
      &out);

    if (ret < 0) {
      gnutls_assert();
      goto cleanup;
    }

    ret = _gnutls_buffer_append_data_prefix(data, 8, out.data,
              out.size);

    _gnutls_free_datum(&out);

    if (ret < 0) {
      gnutls_assert();
      goto cleanup;
    }
  } else if (pk == GNUTLS_PK_ECDH_X25519 || pk == GNUTLS_PK_ECDH_X448) {
    ret = _gnutls_buffer_append_data_prefix(
      data, 8,
      session->key.proto.tls12.ecdh.params.raw_pub.data,
      session->key.proto.tls12.ecdh.params.raw_pub.size);
    if (ret < 0) {
      gnutls_assert();
      goto cleanup;
    }
  }

  /* generate pre-shared key */
  ret = calc_ecdh_key(session, psk_key, ecurve);
  if (ret < 0) {
    gnutls_assert();
    goto cleanup;
  }

  ret = data->length - init_pos;
cleanup:
  gnutls_pk_params_clear(&session->key.proto.tls12.ecdh.params);
  return ret;
}

static int proc_ecdhe_server_kx(gnutls_session_t session, uint8_t *data,
        size_t _data_size)
{
  int ret;
  gnutls_datum_t vparams;

  ret = _gnutls_proc_ecdh_common_server_kx(session, data, _data_size);
  if (ret < 0)
    return gnutls_assert_val(ret);

  vparams.data = data;
  vparams.size = ret;

  return _gnutls_proc_dhe_signature(session, data + ret, _data_size - ret,
            &vparams);
}

int _gnutls_proc_ecdh_common_server_kx(gnutls_session_t session, uint8_t *data,
               size_t _data_size)
{
  int i, ret;
  unsigned point_size;
  const gnutls_group_entry_st *group;
  ssize_t data_size = _data_size;
  const gnutls_ecc_curve_entry_st *ecurve;

  /* just in case we are resuming a session */
  gnutls_pk_params_release(&session->key.proto.tls12.ecdh.params);

  gnutls_pk_params_init(&session->key.proto.tls12.ecdh.params);

  i = 0;
  DECR_LEN(data_size, 1);
  if (data[i++] != 3)
    return gnutls_assert_val(GNUTLS_E_ECC_NO_SUPPORTED_CURVES);

  DECR_LEN(data_size, 2);

  group = _gnutls_tls_id_to_group(_gnutls_read_uint16(&data[i]));
  if (group == NULL || group->curve == 0) {
    _gnutls_debug_log("received unknown curve %u.%u\n",
          (unsigned)data[i], (unsigned)data[i + 1]);
    return gnutls_assert_val(GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);
  } else {
    _gnutls_debug_log("received curve %s\n", group->name);
  }

  i += 2;

  ret = _gnutls_session_supports_group(session, group->id);
  if (ret < 0)
    return gnutls_assert_val(ret);

  ecurve = _gnutls_ecc_curve_get_params(group->curve);
  if (ecurve == NULL) {
    return gnutls_assert_val(GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);
  }

  _gnutls_session_group_set(session, group);

  DECR_LEN(data_size, 1);
  point_size = data[i];
  i++;

  DECR_LEN(data_size, point_size);

  if (ecurve->pk == GNUTLS_PK_EC) {
    ret = _gnutls_ecc_ansi_x962_import(
      &data[i], point_size, &session->key.proto.tls12.ecdh.x,
      &session->key.proto.tls12.ecdh.y);
    if (ret < 0)
      return gnutls_assert_val(ret);

  } else if (ecurve->pk == GNUTLS_PK_ECDH_X25519 ||
       ecurve->pk == GNUTLS_PK_ECDH_X448) {
    if (ecurve->size != point_size)
      return gnutls_assert_val(
        GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);

    ret = _gnutls_set_datum(&session->key.proto.tls12.ecdh.raw,
          &data[i], point_size);
    if (ret < 0)
      return gnutls_assert_val(ret);

    /* RFC7748 requires to mask the MSB in the final byte
     * for X25519 (not X448) */
    if (ecurve->id == GNUTLS_ECC_CURVE_X25519) {
      session->key.proto.tls12.ecdh.raw.data[point_size - 1] &=
        0x7f;
    }
  } else {
    return gnutls_assert_val(GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);
  }

  i += point_size;

  return i;
}

/* If the psk flag is set, then an empty psk_identity_hint will
 * be inserted */
int _gnutls_ecdh_common_print_server_kx(gnutls_session_t session,
          gnutls_buffer_st *data,
          const gnutls_group_entry_st *group)
{
  uint8_t p;
  int ret;
  gnutls_datum_t out;
  unsigned init_pos = data->length;

  if (group == NULL || group->curve == 0)
    return gnutls_assert_val(GNUTLS_E_ECC_NO_SUPPORTED_CURVES);

  /* just in case we are resuming a session */
  gnutls_pk_params_release(&session->key.proto.tls12.ecdh.params);

  gnutls_pk_params_init(&session->key.proto.tls12.ecdh.params);

  /* curve type */
  p = 3;

  ret = _gnutls_buffer_append_data(data, &p, 1);
  if (ret < 0)
    return gnutls_assert_val(ret);

  ret = _gnutls_buffer_append_prefix(data, 16, group->tls_id);
  if (ret < 0)
    return gnutls_assert_val(ret);

  /* generate temporal key */
  ret = _gnutls_pk_generate_keys(group->pk, group->curve,
               &session->key.proto.tls12.ecdh.params,
               1);
  if (ret < 0)
    return gnutls_assert_val(ret);

  if (group->pk == GNUTLS_PK_EC) {
    ret = _gnutls_ecc_ansi_x962_export(
      group->curve,
      session->key.proto.tls12.ecdh.params
        .params[ECC_X] /* x */,
      session->key.proto.tls12.ecdh.params
        .params[ECC_Y] /* y */,
      &out);
    if (ret < 0)
      return gnutls_assert_val(ret);

    ret = _gnutls_buffer_append_data_prefix(data, 8, out.data,
              out.size);

    _gnutls_free_datum(&out);

    if (ret < 0)
      return gnutls_assert_val(ret);

  } else if (group->pk == GNUTLS_PK_ECDH_X25519 ||
       group->pk == GNUTLS_PK_ECDH_X448) {
    ret = _gnutls_buffer_append_data_prefix(
      data, 8,
      session->key.proto.tls12.ecdh.params.raw_pub.data,
      session->key.proto.tls12.ecdh.params.raw_pub.size);
    if (ret < 0)
      return gnutls_assert_val(ret);
  } else {
    return gnutls_assert_val(GNUTLS_E_ECC_NO_SUPPORTED_CURVES);
  }

  return data->length - init_pos;
}

static int gen_ecdhe_server_kx(gnutls_session_t session, gnutls_buffer_st *data)
{
  int ret = 0;
  gnutls_certificate_credentials_t cred;
  unsigned sig_pos;

  cred = (gnutls_certificate_credentials_t)_gnutls_get_cred(
    session, GNUTLS_CRD_CERTIFICATE);
  if (cred == NULL) {
    gnutls_assert();
    return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
  }

  if ((ret = _gnutls_auth_info_init(session, GNUTLS_CRD_CERTIFICATE,
            sizeof(cert_auth_info_st), 1)) < 0) {
    gnutls_assert();
    return ret;
  }

  sig_pos = data->length;

  ret = _gnutls_ecdh_common_print_server_kx(session, data,
              get_group(session));
  if (ret < 0) {
    gnutls_assert();
    return ret;
  }

  /* Generate the signature. */
  return _gnutls_gen_dhe_signature(session, data, &data->data[sig_pos],
           data->length - sig_pos);
}

#endif

Coverage Report

Created: 2024-06-20 06:28

Line	Count	Source (jump to first uncovered line)
1		/*
2		* Copyright (C) 2011-2012 Free Software Foundation, Inc.
3		* Copyright (C) 2017 Red Hat, Inc.
4		*
5		* Author: Nikos Mavrogiannopoulos
6		*
7		* This file is part of GnuTLS.
8		*
9		* The GnuTLS is free software; you can redistribute it and/or
10		* modify it under the terms of the GNU Lesser General Public License
11		* as published by the Free Software Foundation; either version 2.1 of
12		* the License, or (at your option) any later version.
13		*
14		* This library is distributed in the hope that it will be useful, but
15		* WITHOUT ANY WARRANTY; without even the implied warranty of
16		* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
17		* Lesser General Public License for more details.
18		*
19		* You should have received a copy of the GNU Lesser General Public License
20		* along with this program. If not, see <https://www.gnu.org/licenses/>
21		*
22		*/
23
24		/* This file contains common stuff in Ephemeral Diffie-Hellman (DHE)
25		* and Anonymous DH key exchange(DHA). These are used in the handshake
26		* procedure of the certificate and anonymous authentication.
27		*/
28
29		#include "gnutls_int.h"
30		#include "auth.h"
31		#include "errors.h"
32		#include "dh.h"
33		#include "num.h"
34		#include "tls-sig.h"
35		#include "state.h"
36		#include "datum.h"
37		#include "x509.h"
38		#include "auth/ecdhe.h"
39		#include "ecc.h"
40		#include "ext/supported_groups.h"
41		#include "algorithms.h"
42		#include "auth/psk.h"
43		#include "auth/cert.h"
44		#include "pk.h"
45
46		static int gen_ecdhe_server_kx(gnutls_session_t, gnutls_buffer_st *);
47		static int proc_ecdhe_server_kx(gnutls_session_t session, uint8_t *data,
48		size_t _data_size);
49		static int proc_ecdhe_client_kx(gnutls_session_t session, uint8_t *data,
50		size_t _data_size);
51
52		#if defined(ENABLE_ECDHE)
53		const mod_auth_st ecdhe_ecdsa_auth_struct = {
54		"ECDHE_ECDSA",
55		_gnutls_gen_cert_server_crt,
56		_gnutls_gen_cert_client_crt,
57		gen_ecdhe_server_kx,
58		_gnutls_gen_ecdh_common_client_kx, /* This is the only difference */
59		_gnutls_gen_cert_client_crt_vrfy,
60		_gnutls_gen_cert_server_cert_req,
61
62		_gnutls_proc_crt,
63		_gnutls_proc_crt,
64		proc_ecdhe_server_kx,
65		proc_ecdhe_client_kx,
66		_gnutls_proc_cert_client_crt_vrfy,
67		_gnutls_proc_cert_cert_req
68		};
69
70		const mod_auth_st ecdhe_rsa_auth_struct = {
71		"ECDHE_RSA",
72		_gnutls_gen_cert_server_crt,
73		_gnutls_gen_cert_client_crt,
74		gen_ecdhe_server_kx,
75		_gnutls_gen_ecdh_common_client_kx, /* This is the only difference */
76		_gnutls_gen_cert_client_crt_vrfy,
77		_gnutls_gen_cert_server_cert_req,
78
79		_gnutls_proc_crt,
80		_gnutls_proc_crt,
81		proc_ecdhe_server_kx,
82		proc_ecdhe_client_kx,
83		_gnutls_proc_cert_client_crt_vrfy,
84		_gnutls_proc_cert_cert_req
85		};
86
87		static int calc_ecdh_key(gnutls_session_t session, gnutls_datum_t *psk_key,
88		const gnutls_ecc_curve_entry_st *ecurve)
89	0	{
90	0	gnutls_pk_params_st pub;
91	0	int ret;
92	0	gnutls_datum_t tmp_dh_key;
93
94	0	gnutls_pk_params_init(&pub);
95	0	pub.params[ECC_X] = session->key.proto.tls12.ecdh.x;
96	0	pub.params[ECC_Y] = session->key.proto.tls12.ecdh.y;
97	0	pub.raw_pub.data = session->key.proto.tls12.ecdh.raw.data;
98	0	pub.raw_pub.size = session->key.proto.tls12.ecdh.raw.size;
99	0	pub.curve = ecurve->id;
100
101	0	ret = _gnutls_pk_derive(ecurve->pk, &tmp_dh_key,
102	0	&session->key.proto.tls12.ecdh.params, &pub);
103	0	if (ret < 0) {
104	0	ret = gnutls_assert_val(ret);
105	0	goto cleanup;
106	0	}
107
108	0	if (psk_key == NULL) {
109	0	memcpy(&session->key.key, &tmp_dh_key, sizeof(gnutls_datum_t));
110	0	tmp_dh_key.data = NULL; /* no longer needed */
111	0	} else {
112	0	ret = _gnutls_set_psk_session_key(session, psk_key,
113	0	&tmp_dh_key);
114	0	_gnutls_free_temp_key_datum(&tmp_dh_key);
115
116	0	if (ret < 0) {
117	0	ret = gnutls_assert_val(ret);
118	0	goto cleanup;
119	0	}
120	0	}
121
122	0	ret = 0;
123
124	0	cleanup:
125		/* no longer needed */
126	0	_gnutls_mpi_release(&session->key.proto.tls12.ecdh.x);
127	0	_gnutls_mpi_release(&session->key.proto.tls12.ecdh.y);
128	0	_gnutls_free_datum(&session->key.proto.tls12.ecdh.raw);
129	0	gnutls_pk_params_release(&session->key.proto.tls12.ecdh.params);
130	0	return ret;
131	0	}
132
133		int _gnutls_proc_ecdh_common_client_kx(
134		gnutls_session_t session, uint8_t *data, size_t _data_size,
135		const struct gnutls_group_entry_st group, gnutls_datum_t psk_key)
136	0	{
137	0	ssize_t data_size = _data_size;
138	0	int ret, i = 0;
139	0	unsigned point_size;
140	0	const gnutls_ecc_curve_entry_st *ecurve;
141
142	0	if (group == NULL)
143	0	return gnutls_assert_val(GNUTLS_E_ECC_NO_SUPPORTED_CURVES);
144
145	0	ecurve = _gnutls_ecc_curve_get_params(group->curve);
146	0	if (ecurve == NULL)
147	0	return gnutls_assert_val(GNUTLS_E_ECC_NO_SUPPORTED_CURVES);
148
149	0	DECR_LEN(data_size, 1);
150	0	point_size = data[i];
151	0	i += 1;
152
153	0	if (point_size == 0) {
154	0	ret = gnutls_assert_val(GNUTLS_E_UNEXPECTED_PACKET_LENGTH);
155	0	goto cleanup;
156	0	}
157
158	0	DECR_LEN(data_size, point_size);
159
160	0	if (ecurve->pk == GNUTLS_PK_EC) {
161	0	ret = _gnutls_ecc_ansi_x962_import(
162	0	&data[i], point_size, &session->key.proto.tls12.ecdh.x,
163	0	&session->key.proto.tls12.ecdh.y);
164	0	if (ret < 0) {
165	0	gnutls_assert();
166	0	goto cleanup;
167	0	}
168	0	} else if (ecurve->pk == GNUTLS_PK_ECDH_X25519 \|\|
169	0	ecurve->pk == GNUTLS_PK_ECDH_X448) {
170	0	if (ecurve->size != point_size)
171	0	return gnutls_assert_val(
172	0	GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);
173
174	0	ret = _gnutls_set_datum(&session->key.proto.tls12.ecdh.raw,
175	0	&data[i], point_size);
176	0	if (ret < 0) {
177	0	gnutls_assert();
178	0	goto cleanup;
179	0	}
180
181		/* RFC7748 requires to mask the MSB in the final byte
182		* for X25519 (not X448) */
183	0	if (ecurve->id == GNUTLS_ECC_CURVE_X25519) {
184	0	session->key.proto.tls12.ecdh.raw.data[point_size - 1] &=
185	0	0x7f;
186	0	}
187	0	} else {
188	0	return gnutls_assert_val(GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);
189	0	}
190
191	0	if (data_size != 0) {
192	0	ret = gnutls_assert_val(GNUTLS_E_UNEXPECTED_PACKET_LENGTH);
193	0	goto cleanup;
194	0	}
195
196		/* generate pre-shared key */
197	0	ret = calc_ecdh_key(session, psk_key, ecurve);
198	0	if (ret < 0) {
199	0	gnutls_assert();
200	0	goto cleanup;
201	0	}
202	0	cleanup:
203	0	_gnutls_mpi_release(&session->key.proto.tls12.ecdh.x);
204	0	_gnutls_mpi_release(&session->key.proto.tls12.ecdh.y);
205	0	_gnutls_free_datum(&session->key.proto.tls12.ecdh.raw);
206	0	gnutls_pk_params_clear(&session->key.proto.tls12.ecdh.params);
207	0	return ret;
208	0	}
209
210		static int proc_ecdhe_client_kx(gnutls_session_t session, uint8_t *data,
211		size_t _data_size)
212	0	{
213	0	gnutls_certificate_credentials_t cred;
214
215	0	cred = (gnutls_certificate_credentials_t)_gnutls_get_cred(
216	0	session, GNUTLS_CRD_CERTIFICATE);
217	0	if (cred == NULL) {
218	0	gnutls_assert();
219	0	return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
220	0	}
221
222	0	return _gnutls_proc_ecdh_common_client_kx(session, data, _data_size,
223	0	get_group(session), NULL);
224	0	}
225
226		int _gnutls_gen_ecdh_common_client_kx(gnutls_session_t session,
227		gnutls_buffer_st *data)
228	0	{
229	0	return _gnutls_gen_ecdh_common_client_kx_int(session, data, NULL);
230	0	}
231
232		int _gnutls_gen_ecdh_common_client_kx_int(gnutls_session_t session,
233		gnutls_buffer_st *data,
234		gnutls_datum_t *psk_key)
235	0	{
236	0	int ret;
237	0	gnutls_datum_t out;
238	0	const gnutls_group_entry_st *group = get_group(session);
239	0	const gnutls_ecc_curve_entry_st *ecurve;
240	0	int pk;
241	0	unsigned init_pos = data->length;
242
243	0	if (group == NULL)
244	0	return gnutls_assert_val(GNUTLS_E_ECC_NO_SUPPORTED_CURVES);
245
246	0	ecurve = _gnutls_ecc_curve_get_params(group->curve);
247	0	if (ecurve == NULL)
248	0	return gnutls_assert_val(GNUTLS_E_ECC_NO_SUPPORTED_CURVES);
249
250	0	pk = ecurve->pk;
251
252		/* generate temporal key */
253	0	ret = _gnutls_pk_generate_keys(
254	0	pk, ecurve->id, &session->key.proto.tls12.ecdh.params, 1);
255	0	if (ret < 0)
256	0	return gnutls_assert_val(ret);
257
258	0	if (pk == GNUTLS_PK_EC) {
259	0	ret = _gnutls_ecc_ansi_x962_export(
260	0	ecurve->id,
261	0	session->key.proto.tls12.ecdh.params
262	0	.params[ECC_X] /* x */,
263	0	session->key.proto.tls12.ecdh.params
264	0	.params[ECC_Y] /* y */,
265	0	&out);
266
267	0	if (ret < 0) {
268	0	gnutls_assert();
269	0	goto cleanup;
270	0	}
271
272	0	ret = _gnutls_buffer_append_data_prefix(data, 8, out.data,
273	0	out.size);
274
275	0	_gnutls_free_datum(&out);
276
277	0	if (ret < 0) {
278	0	gnutls_assert();
279	0	goto cleanup;
280	0	}
281	0	} else if (pk == GNUTLS_PK_ECDH_X25519 \|\| pk == GNUTLS_PK_ECDH_X448) {
282	0	ret = _gnutls_buffer_append_data_prefix(
283	0	data, 8,
284	0	session->key.proto.tls12.ecdh.params.raw_pub.data,
285	0	session->key.proto.tls12.ecdh.params.raw_pub.size);
286	0	if (ret < 0) {
287	0	gnutls_assert();
288	0	goto cleanup;
289	0	}
290	0	}
291
292		/* generate pre-shared key */
293	0	ret = calc_ecdh_key(session, psk_key, ecurve);
294	0	if (ret < 0) {
295	0	gnutls_assert();
296	0	goto cleanup;
297	0	}
298
299	0	ret = data->length - init_pos;
300	0	cleanup:
301	0	gnutls_pk_params_clear(&session->key.proto.tls12.ecdh.params);
302	0	return ret;
303	0	}
304
305		static int proc_ecdhe_server_kx(gnutls_session_t session, uint8_t *data,
306		size_t _data_size)
307	0	{
308	0	int ret;
309	0	gnutls_datum_t vparams;
310
311	0	ret = _gnutls_proc_ecdh_common_server_kx(session, data, _data_size);
312	0	if (ret < 0)
313	0	return gnutls_assert_val(ret);
314
315	0	vparams.data = data;
316	0	vparams.size = ret;
317
318	0	return _gnutls_proc_dhe_signature(session, data + ret, _data_size - ret,
319	0	&vparams);
320	0	}
321
322		int _gnutls_proc_ecdh_common_server_kx(gnutls_session_t session, uint8_t *data,
323		size_t _data_size)
324	0	{
325	0	int i, ret;
326	0	unsigned point_size;
327	0	const gnutls_group_entry_st *group;
328	0	ssize_t data_size = _data_size;
329	0	const gnutls_ecc_curve_entry_st *ecurve;
330
331		/* just in case we are resuming a session */
332	0	gnutls_pk_params_release(&session->key.proto.tls12.ecdh.params);
333
334	0	gnutls_pk_params_init(&session->key.proto.tls12.ecdh.params);
335
336	0	i = 0;
337	0	DECR_LEN(data_size, 1);
338	0	if (data[i++] != 3)
339	0	return gnutls_assert_val(GNUTLS_E_ECC_NO_SUPPORTED_CURVES);
340
341	0	DECR_LEN(data_size, 2);
342
343	0	group = _gnutls_tls_id_to_group(_gnutls_read_uint16(&data[i]));
344	0	if (group == NULL \|\| group->curve == 0) {
345	0	_gnutls_debug_log("received unknown curve %u.%u\n",
346	0	(unsigned)data[i], (unsigned)data[i + 1]);
347	0	return gnutls_assert_val(GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);
348	0	} else {
349	0	_gnutls_debug_log("received curve %s\n", group->name);
350	0	}
351
352	0	i += 2;
353
354	0	ret = _gnutls_session_supports_group(session, group->id);
355	0	if (ret < 0)
356	0	return gnutls_assert_val(ret);
357
358	0	ecurve = _gnutls_ecc_curve_get_params(group->curve);
359	0	if (ecurve == NULL) {
360	0	return gnutls_assert_val(GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);
361	0	}
362
363	0	_gnutls_session_group_set(session, group);
364
365	0	DECR_LEN(data_size, 1);
366	0	point_size = data[i];
367	0	i++;
368
369	0	DECR_LEN(data_size, point_size);
370
371	0	if (ecurve->pk == GNUTLS_PK_EC) {
372	0	ret = _gnutls_ecc_ansi_x962_import(
373	0	&data[i], point_size, &session->key.proto.tls12.ecdh.x,
374	0	&session->key.proto.tls12.ecdh.y);
375	0	if (ret < 0)
376	0	return gnutls_assert_val(ret);
377
378	0	} else if (ecurve->pk == GNUTLS_PK_ECDH_X25519 \|\|
379	0	ecurve->pk == GNUTLS_PK_ECDH_X448) {
380	0	if (ecurve->size != point_size)
381	0	return gnutls_assert_val(
382	0	GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);
383
384	0	ret = _gnutls_set_datum(&session->key.proto.tls12.ecdh.raw,
385	0	&data[i], point_size);
386	0	if (ret < 0)
387	0	return gnutls_assert_val(ret);
388
389		/* RFC7748 requires to mask the MSB in the final byte
390		* for X25519 (not X448) */
391	0	if (ecurve->id == GNUTLS_ECC_CURVE_X25519) {
392	0	session->key.proto.tls12.ecdh.raw.data[point_size - 1] &=
393	0	0x7f;
394	0	}
395	0	} else {
396	0	return gnutls_assert_val(GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);
397	0	}
398
399	0	i += point_size;
400
401	0	return i;
402	0	}
403
404		/* If the psk flag is set, then an empty psk_identity_hint will
405		* be inserted */
406		int _gnutls_ecdh_common_print_server_kx(gnutls_session_t session,
407		gnutls_buffer_st *data,
408		const gnutls_group_entry_st *group)
409	0	{
410	0	uint8_t p;
411	0	int ret;
412	0	gnutls_datum_t out;
413	0	unsigned init_pos = data->length;
414
415	0	if (group == NULL \|\| group->curve == 0)
416	0	return gnutls_assert_val(GNUTLS_E_ECC_NO_SUPPORTED_CURVES);
417
418		/* just in case we are resuming a session */
419	0	gnutls_pk_params_release(&session->key.proto.tls12.ecdh.params);
420
421	0	gnutls_pk_params_init(&session->key.proto.tls12.ecdh.params);
422
423		/* curve type */
424	0	p = 3;
425
426	0	ret = _gnutls_buffer_append_data(data, &p, 1);
427	0	if (ret < 0)
428	0	return gnutls_assert_val(ret);
429
430	0	ret = _gnutls_buffer_append_prefix(data, 16, group->tls_id);
431	0	if (ret < 0)
432	0	return gnutls_assert_val(ret);
433
434		/* generate temporal key */
435	0	ret = _gnutls_pk_generate_keys(group->pk, group->curve,
436	0	&session->key.proto.tls12.ecdh.params,
437	0	1);
438	0	if (ret < 0)
439	0	return gnutls_assert_val(ret);
440
441	0	if (group->pk == GNUTLS_PK_EC) {
442	0	ret = _gnutls_ecc_ansi_x962_export(
443	0	group->curve,
444	0	session->key.proto.tls12.ecdh.params
445	0	.params[ECC_X] /* x */,
446	0	session->key.proto.tls12.ecdh.params
447	0	.params[ECC_Y] /* y */,
448	0	&out);
449	0	if (ret < 0)
450	0	return gnutls_assert_val(ret);
451
452	0	ret = _gnutls_buffer_append_data_prefix(data, 8, out.data,
453	0	out.size);
454
455	0	_gnutls_free_datum(&out);
456
457	0	if (ret < 0)
458	0	return gnutls_assert_val(ret);
459
460	0	} else if (group->pk == GNUTLS_PK_ECDH_X25519 \|\|
461	0	group->pk == GNUTLS_PK_ECDH_X448) {
462	0	ret = _gnutls_buffer_append_data_prefix(
463	0	data, 8,
464	0	session->key.proto.tls12.ecdh.params.raw_pub.data,
465	0	session->key.proto.tls12.ecdh.params.raw_pub.size);
466	0	if (ret < 0)
467	0	return gnutls_assert_val(ret);
468	0	} else {
469	0	return gnutls_assert_val(GNUTLS_E_ECC_NO_SUPPORTED_CURVES);
470	0	}
471
472	0	return data->length - init_pos;
473	0	}
474
475		static int gen_ecdhe_server_kx(gnutls_session_t session, gnutls_buffer_st *data)
476	0	{
477	0	int ret = 0;
478	0	gnutls_certificate_credentials_t cred;
479	0	unsigned sig_pos;
480
481	0	cred = (gnutls_certificate_credentials_t)_gnutls_get_cred(
482	0	session, GNUTLS_CRD_CERTIFICATE);
483	0	if (cred == NULL) {
484	0	gnutls_assert();
485	0	return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
486	0	}
487
488	0	if ((ret = _gnutls_auth_info_init(session, GNUTLS_CRD_CERTIFICATE,
489	0	sizeof(cert_auth_info_st), 1)) < 0) {
490	0	gnutls_assert();
491	0	return ret;
492	0	}
493
494	0	sig_pos = data->length;
495
496	0	ret = _gnutls_ecdh_common_print_server_kx(session, data,
497	0	get_group(session));
498	0	if (ret < 0) {
499	0	gnutls_assert();
500	0	return ret;
501	0	}
502
503		/* Generate the signature. */
504	0	return _gnutls_gen_dhe_signature(session, data, &data->data[sig_pos],
505	0	data->length - sig_pos);
506	0	}
507
508		#endif