/src/openssl30/crypto/dh/dh_key.c
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved. |
3 | | * |
4 | | * Licensed under the Apache License 2.0 (the "License"). You may not use |
5 | | * this file except in compliance with the License. You can obtain a copy |
6 | | * in the file LICENSE in the source distribution or at |
7 | | * https://www.openssl.org/source/license.html |
8 | | */ |
9 | | |
10 | | /* |
11 | | * DH low level APIs are deprecated for public use, but still ok for |
12 | | * internal use. |
13 | | */ |
14 | | #include "internal/deprecated.h" |
15 | | |
16 | | #include <stdio.h> |
17 | | #include "internal/cryptlib.h" |
18 | | #include "dh_local.h" |
19 | | #include "crypto/bn.h" |
20 | | #include "crypto/dh.h" |
21 | | #include "crypto/security_bits.h" |
22 | | |
23 | | #ifdef FIPS_MODULE |
24 | | # define MIN_STRENGTH 112 |
25 | | #else |
26 | 0 | # define MIN_STRENGTH 80 |
27 | | #endif |
28 | | |
29 | | static int generate_key(DH *dh); |
30 | | static int dh_bn_mod_exp(const DH *dh, BIGNUM *r, |
31 | | const BIGNUM *a, const BIGNUM *p, |
32 | | const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx); |
33 | | static int dh_init(DH *dh); |
34 | | static int dh_finish(DH *dh); |
35 | | |
36 | | /* |
37 | | * See SP800-56Ar3 Section 5.7.1.1 |
38 | | * Finite Field Cryptography Diffie-Hellman (FFC DH) Primitive |
39 | | */ |
40 | | int ossl_dh_compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh) |
41 | 0 | { |
42 | 0 | BN_CTX *ctx = NULL; |
43 | 0 | BN_MONT_CTX *mont = NULL; |
44 | 0 | BIGNUM *z = NULL, *pminus1; |
45 | 0 | int ret = -1; |
46 | |
|
47 | 0 | if (BN_num_bits(dh->params.p) > OPENSSL_DH_MAX_MODULUS_BITS) { |
48 | 0 | ERR_raise(ERR_LIB_DH, DH_R_MODULUS_TOO_LARGE); |
49 | 0 | goto err; |
50 | 0 | } |
51 | | |
52 | 0 | if (BN_num_bits(dh->params.p) < DH_MIN_MODULUS_BITS) { |
53 | 0 | ERR_raise(ERR_LIB_DH, DH_R_MODULUS_TOO_SMALL); |
54 | 0 | return 0; |
55 | 0 | } |
56 | | |
57 | 0 | ctx = BN_CTX_new_ex(dh->libctx); |
58 | 0 | if (ctx == NULL) |
59 | 0 | goto err; |
60 | 0 | BN_CTX_start(ctx); |
61 | 0 | pminus1 = BN_CTX_get(ctx); |
62 | 0 | z = BN_CTX_get(ctx); |
63 | 0 | if (z == NULL) |
64 | 0 | goto err; |
65 | | |
66 | 0 | if (dh->priv_key == NULL) { |
67 | 0 | ERR_raise(ERR_LIB_DH, DH_R_NO_PRIVATE_VALUE); |
68 | 0 | goto err; |
69 | 0 | } |
70 | | |
71 | 0 | if (dh->flags & DH_FLAG_CACHE_MONT_P) { |
72 | 0 | mont = BN_MONT_CTX_set_locked(&dh->method_mont_p, |
73 | 0 | dh->lock, dh->params.p, ctx); |
74 | 0 | BN_set_flags(dh->priv_key, BN_FLG_CONSTTIME); |
75 | 0 | if (!mont) |
76 | 0 | goto err; |
77 | 0 | } |
78 | | |
79 | | /* (Step 1) Z = pub_key^priv_key mod p */ |
80 | 0 | if (!dh->meth->bn_mod_exp(dh, z, pub_key, dh->priv_key, dh->params.p, ctx, |
81 | 0 | mont)) { |
82 | 0 | ERR_raise(ERR_LIB_DH, ERR_R_BN_LIB); |
83 | 0 | goto err; |
84 | 0 | } |
85 | | |
86 | | /* (Step 2) Error if z <= 1 or z = p - 1 */ |
87 | 0 | if (BN_copy(pminus1, dh->params.p) == NULL |
88 | 0 | || !BN_sub_word(pminus1, 1) |
89 | 0 | || BN_cmp(z, BN_value_one()) <= 0 |
90 | 0 | || BN_cmp(z, pminus1) == 0) { |
91 | 0 | ERR_raise(ERR_LIB_DH, DH_R_INVALID_SECRET); |
92 | 0 | goto err; |
93 | 0 | } |
94 | | |
95 | | /* return the padded key, i.e. same number of bytes as the modulus */ |
96 | 0 | ret = BN_bn2binpad(z, key, BN_num_bytes(dh->params.p)); |
97 | 0 | err: |
98 | 0 | BN_clear(z); /* (Step 2) destroy intermediate values */ |
99 | 0 | BN_CTX_end(ctx); |
100 | 0 | BN_CTX_free(ctx); |
101 | 0 | return ret; |
102 | 0 | } |
103 | | |
104 | | /*- |
105 | | * NB: This function is inherently not constant time due to the |
106 | | * RFC 5246 (8.1.2) padding style that strips leading zero bytes. |
107 | | */ |
108 | | int DH_compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh) |
109 | 0 | { |
110 | 0 | int ret = 0, i; |
111 | 0 | volatile size_t npad = 0, mask = 1; |
112 | | |
113 | | /* compute the key; ret is constant unless compute_key is external */ |
114 | | #ifdef FIPS_MODULE |
115 | | ret = ossl_dh_compute_key(key, pub_key, dh); |
116 | | #else |
117 | 0 | ret = dh->meth->compute_key(key, pub_key, dh); |
118 | 0 | #endif |
119 | 0 | if (ret <= 0) |
120 | 0 | return ret; |
121 | | |
122 | | /* count leading zero bytes, yet still touch all bytes */ |
123 | 0 | for (i = 0; i < ret; i++) { |
124 | 0 | mask &= !key[i]; |
125 | 0 | npad += mask; |
126 | 0 | } |
127 | | |
128 | | /* unpad key */ |
129 | 0 | ret -= npad; |
130 | | /* key-dependent memory access, potentially leaking npad / ret */ |
131 | 0 | memmove(key, key + npad, ret); |
132 | | /* key-dependent memory access, potentially leaking npad / ret */ |
133 | 0 | memset(key + ret, 0, npad); |
134 | |
|
135 | 0 | return ret; |
136 | 0 | } |
137 | | |
138 | | int DH_compute_key_padded(unsigned char *key, const BIGNUM *pub_key, DH *dh) |
139 | 0 | { |
140 | 0 | int rv, pad; |
141 | | |
142 | | /* rv is constant unless compute_key is external */ |
143 | | #ifdef FIPS_MODULE |
144 | | rv = ossl_dh_compute_key(key, pub_key, dh); |
145 | | #else |
146 | 0 | rv = dh->meth->compute_key(key, pub_key, dh); |
147 | 0 | #endif |
148 | 0 | if (rv <= 0) |
149 | 0 | return rv; |
150 | 0 | pad = BN_num_bytes(dh->params.p) - rv; |
151 | | /* pad is constant (zero) unless compute_key is external */ |
152 | 0 | if (pad > 0) { |
153 | 0 | memmove(key + pad, key, rv); |
154 | 0 | memset(key, 0, pad); |
155 | 0 | } |
156 | 0 | return rv + pad; |
157 | 0 | } |
158 | | |
159 | | static DH_METHOD dh_ossl = { |
160 | | "OpenSSL DH Method", |
161 | | generate_key, |
162 | | ossl_dh_compute_key, |
163 | | dh_bn_mod_exp, |
164 | | dh_init, |
165 | | dh_finish, |
166 | | DH_FLAG_FIPS_METHOD, |
167 | | NULL, |
168 | | NULL |
169 | | }; |
170 | | |
171 | | static const DH_METHOD *default_DH_method = &dh_ossl; |
172 | | |
173 | | const DH_METHOD *DH_OpenSSL(void) |
174 | 0 | { |
175 | 0 | return &dh_ossl; |
176 | 0 | } |
177 | | |
178 | | const DH_METHOD *DH_get_default_method(void) |
179 | 1.05k | { |
180 | 1.05k | return default_DH_method; |
181 | 1.05k | } |
182 | | |
183 | | static int dh_bn_mod_exp(const DH *dh, BIGNUM *r, |
184 | | const BIGNUM *a, const BIGNUM *p, |
185 | | const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx) |
186 | 0 | { |
187 | 0 | return BN_mod_exp_mont(r, a, p, m, ctx, m_ctx); |
188 | 0 | } |
189 | | |
190 | | static int dh_init(DH *dh) |
191 | 1.05k | { |
192 | 1.05k | dh->flags |= DH_FLAG_CACHE_MONT_P; |
193 | 1.05k | ossl_ffc_params_init(&dh->params); |
194 | 1.05k | dh->dirty_cnt++; |
195 | 1.05k | return 1; |
196 | 1.05k | } |
197 | | |
198 | | static int dh_finish(DH *dh) |
199 | 1.05k | { |
200 | 1.05k | BN_MONT_CTX_free(dh->method_mont_p); |
201 | 1.05k | return 1; |
202 | 1.05k | } |
203 | | |
204 | | #ifndef FIPS_MODULE |
205 | | void DH_set_default_method(const DH_METHOD *meth) |
206 | 0 | { |
207 | 0 | default_DH_method = meth; |
208 | 0 | } |
209 | | #endif /* FIPS_MODULE */ |
210 | | |
211 | | int DH_generate_key(DH *dh) |
212 | 0 | { |
213 | | #ifdef FIPS_MODULE |
214 | | return generate_key(dh); |
215 | | #else |
216 | 0 | return dh->meth->generate_key(dh); |
217 | 0 | #endif |
218 | 0 | } |
219 | | |
220 | | int ossl_dh_generate_public_key(BN_CTX *ctx, const DH *dh, |
221 | | const BIGNUM *priv_key, BIGNUM *pub_key) |
222 | 0 | { |
223 | 0 | int ret = 0; |
224 | 0 | BIGNUM *prk = BN_new(); |
225 | 0 | BN_MONT_CTX *mont = NULL; |
226 | |
|
227 | 0 | if (prk == NULL) |
228 | 0 | return 0; |
229 | | |
230 | 0 | if (dh->flags & DH_FLAG_CACHE_MONT_P) { |
231 | | /* |
232 | | * We take the input DH as const, but we lie, because in some cases we |
233 | | * want to get a hold of its Montgomery context. |
234 | | * |
235 | | * We cast to remove the const qualifier in this case, it should be |
236 | | * fine... |
237 | | */ |
238 | 0 | BN_MONT_CTX **pmont = (BN_MONT_CTX **)&dh->method_mont_p; |
239 | |
|
240 | 0 | mont = BN_MONT_CTX_set_locked(pmont, dh->lock, dh->params.p, ctx); |
241 | 0 | if (mont == NULL) |
242 | 0 | goto err; |
243 | 0 | } |
244 | 0 | BN_with_flags(prk, priv_key, BN_FLG_CONSTTIME); |
245 | | |
246 | | /* pub_key = g^priv_key mod p */ |
247 | 0 | if (!dh->meth->bn_mod_exp(dh, pub_key, dh->params.g, prk, dh->params.p, |
248 | 0 | ctx, mont)) |
249 | 0 | goto err; |
250 | 0 | ret = 1; |
251 | 0 | err: |
252 | 0 | BN_clear_free(prk); |
253 | 0 | return ret; |
254 | 0 | } |
255 | | |
256 | | static int generate_key(DH *dh) |
257 | 0 | { |
258 | 0 | int ok = 0; |
259 | 0 | int generate_new_key = 0; |
260 | 0 | #ifndef FIPS_MODULE |
261 | 0 | unsigned l; |
262 | 0 | #endif |
263 | 0 | BN_CTX *ctx = NULL; |
264 | 0 | BIGNUM *pub_key = NULL, *priv_key = NULL; |
265 | |
|
266 | 0 | if (BN_num_bits(dh->params.p) > OPENSSL_DH_MAX_MODULUS_BITS) { |
267 | 0 | ERR_raise(ERR_LIB_DH, DH_R_MODULUS_TOO_LARGE); |
268 | 0 | return 0; |
269 | 0 | } |
270 | | |
271 | 0 | if (BN_num_bits(dh->params.p) < DH_MIN_MODULUS_BITS) { |
272 | 0 | ERR_raise(ERR_LIB_DH, DH_R_MODULUS_TOO_SMALL); |
273 | 0 | return 0; |
274 | 0 | } |
275 | | |
276 | 0 | ctx = BN_CTX_new_ex(dh->libctx); |
277 | 0 | if (ctx == NULL) |
278 | 0 | goto err; |
279 | | |
280 | 0 | if (dh->priv_key == NULL) { |
281 | 0 | priv_key = BN_secure_new(); |
282 | 0 | if (priv_key == NULL) |
283 | 0 | goto err; |
284 | 0 | generate_new_key = 1; |
285 | 0 | } else { |
286 | 0 | priv_key = dh->priv_key; |
287 | 0 | } |
288 | | |
289 | 0 | if (dh->pub_key == NULL) { |
290 | 0 | pub_key = BN_new(); |
291 | 0 | if (pub_key == NULL) |
292 | 0 | goto err; |
293 | 0 | } else { |
294 | 0 | pub_key = dh->pub_key; |
295 | 0 | } |
296 | 0 | if (generate_new_key) { |
297 | | /* Is it an approved safe prime ?*/ |
298 | 0 | if (DH_get_nid(dh) != NID_undef) { |
299 | 0 | int max_strength = |
300 | 0 | ossl_ifc_ffc_compute_security_bits(BN_num_bits(dh->params.p)); |
301 | |
|
302 | 0 | if (dh->params.q == NULL |
303 | 0 | || dh->length > BN_num_bits(dh->params.q)) |
304 | 0 | goto err; |
305 | | /* dh->length = maximum bit length of generated private key */ |
306 | 0 | if (!ossl_ffc_generate_private_key(ctx, &dh->params, dh->length, |
307 | 0 | max_strength, priv_key)) |
308 | 0 | goto err; |
309 | 0 | } else { |
310 | | #ifdef FIPS_MODULE |
311 | | if (dh->params.q == NULL) |
312 | | goto err; |
313 | | #else |
314 | 0 | if (dh->params.q == NULL) { |
315 | | /* secret exponent length, must satisfy 2^(l-1) <= p */ |
316 | 0 | if (dh->length != 0 |
317 | 0 | && dh->length >= BN_num_bits(dh->params.p)) |
318 | 0 | goto err; |
319 | 0 | l = dh->length ? dh->length : BN_num_bits(dh->params.p) - 1; |
320 | 0 | if (!BN_priv_rand_ex(priv_key, l, BN_RAND_TOP_ONE, |
321 | 0 | BN_RAND_BOTTOM_ANY, 0, ctx)) |
322 | 0 | goto err; |
323 | | /* |
324 | | * We handle just one known case where g is a quadratic non-residue: |
325 | | * for g = 2: p % 8 == 3 |
326 | | */ |
327 | 0 | if (BN_is_word(dh->params.g, DH_GENERATOR_2) |
328 | 0 | && !BN_is_bit_set(dh->params.p, 2)) { |
329 | | /* clear bit 0, since it won't be a secret anyway */ |
330 | 0 | if (!BN_clear_bit(priv_key, 0)) |
331 | 0 | goto err; |
332 | 0 | } |
333 | 0 | } else |
334 | 0 | #endif |
335 | 0 | { |
336 | | /* Do a partial check for invalid p, q, g */ |
337 | 0 | if (!ossl_ffc_params_simple_validate(dh->libctx, &dh->params, |
338 | 0 | FFC_PARAM_TYPE_DH, NULL)) |
339 | 0 | goto err; |
340 | | /* |
341 | | * For FFC FIPS 186-4 keygen |
342 | | * security strength s = 112, |
343 | | * Max Private key size N = len(q) |
344 | | */ |
345 | 0 | if (!ossl_ffc_generate_private_key(ctx, &dh->params, |
346 | 0 | BN_num_bits(dh->params.q), |
347 | 0 | MIN_STRENGTH, |
348 | 0 | priv_key)) |
349 | 0 | goto err; |
350 | 0 | } |
351 | 0 | } |
352 | 0 | } |
353 | | |
354 | 0 | if (!ossl_dh_generate_public_key(ctx, dh, priv_key, pub_key)) |
355 | 0 | goto err; |
356 | | |
357 | 0 | dh->pub_key = pub_key; |
358 | 0 | dh->priv_key = priv_key; |
359 | 0 | dh->dirty_cnt++; |
360 | 0 | ok = 1; |
361 | 0 | err: |
362 | 0 | if (ok != 1) |
363 | 0 | ERR_raise(ERR_LIB_DH, ERR_R_BN_LIB); |
364 | |
|
365 | 0 | if (pub_key != dh->pub_key) |
366 | 0 | BN_free(pub_key); |
367 | 0 | if (priv_key != dh->priv_key) |
368 | 0 | BN_free(priv_key); |
369 | 0 | BN_CTX_free(ctx); |
370 | 0 | return ok; |
371 | 0 | } |
372 | | |
373 | | int ossl_dh_buf2key(DH *dh, const unsigned char *buf, size_t len) |
374 | 0 | { |
375 | 0 | int err_reason = DH_R_BN_ERROR; |
376 | 0 | BIGNUM *pubkey = NULL; |
377 | 0 | const BIGNUM *p; |
378 | 0 | int ret; |
379 | |
|
380 | 0 | if ((pubkey = BN_bin2bn(buf, len, NULL)) == NULL) |
381 | 0 | goto err; |
382 | 0 | DH_get0_pqg(dh, &p, NULL, NULL); |
383 | 0 | if (p == NULL || BN_num_bytes(p) == 0) { |
384 | 0 | err_reason = DH_R_NO_PARAMETERS_SET; |
385 | 0 | goto err; |
386 | 0 | } |
387 | | /* Prevent small subgroup attacks per RFC 8446 Section 4.2.8.1 */ |
388 | 0 | if (!ossl_dh_check_pub_key_partial(dh, pubkey, &ret)) { |
389 | 0 | err_reason = DH_R_INVALID_PUBKEY; |
390 | 0 | goto err; |
391 | 0 | } |
392 | 0 | if (DH_set0_key(dh, pubkey, NULL) != 1) |
393 | 0 | goto err; |
394 | 0 | return 1; |
395 | 0 | err: |
396 | 0 | ERR_raise(ERR_LIB_DH, err_reason); |
397 | 0 | BN_free(pubkey); |
398 | 0 | return 0; |
399 | 0 | } |
400 | | |
401 | | size_t ossl_dh_key2buf(const DH *dh, unsigned char **pbuf_out, size_t size, |
402 | | int alloc) |
403 | 0 | { |
404 | 0 | const BIGNUM *pubkey; |
405 | 0 | unsigned char *pbuf = NULL; |
406 | 0 | const BIGNUM *p; |
407 | 0 | int p_size; |
408 | |
|
409 | 0 | DH_get0_pqg(dh, &p, NULL, NULL); |
410 | 0 | DH_get0_key(dh, &pubkey, NULL); |
411 | 0 | if (p == NULL || pubkey == NULL |
412 | 0 | || (p_size = BN_num_bytes(p)) == 0 |
413 | 0 | || BN_num_bytes(pubkey) == 0) { |
414 | 0 | ERR_raise(ERR_LIB_DH, DH_R_INVALID_PUBKEY); |
415 | 0 | return 0; |
416 | 0 | } |
417 | 0 | if (pbuf_out != NULL && (alloc || *pbuf_out != NULL)) { |
418 | 0 | if (!alloc) { |
419 | 0 | if (size >= (size_t)p_size) |
420 | 0 | pbuf = *pbuf_out; |
421 | 0 | } else { |
422 | 0 | pbuf = OPENSSL_malloc(p_size); |
423 | 0 | } |
424 | |
|
425 | 0 | if (pbuf == NULL) { |
426 | 0 | ERR_raise(ERR_LIB_DH, ERR_R_MALLOC_FAILURE); |
427 | 0 | return 0; |
428 | 0 | } |
429 | | /* |
430 | | * As per Section 4.2.8.1 of RFC 8446 left pad public |
431 | | * key with zeros to the size of p |
432 | | */ |
433 | 0 | if (BN_bn2binpad(pubkey, pbuf, p_size) < 0) { |
434 | 0 | if (alloc) |
435 | 0 | OPENSSL_free(pbuf); |
436 | 0 | ERR_raise(ERR_LIB_DH, DH_R_BN_ERROR); |
437 | 0 | return 0; |
438 | 0 | } |
439 | 0 | *pbuf_out = pbuf; |
440 | 0 | } |
441 | 0 | return p_size; |
442 | 0 | } |