/src/gnutls/lib/auth/ecdhe.c

Source
/*
 * Copyright (C) 2011-2012 Free Software Foundation, Inc.
 * Copyright (C) 2017 Red Hat, Inc.
 *
 * Author: Nikos Mavrogiannopoulos
 *
 * This file is part of GnuTLS.
 *
 * The GnuTLS is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public License
 * as published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>
 *
 */

/* This file contains common stuff in Ephemeral Diffie-Hellman (DHE)
 * and Anonymous DH key exchange(DHA). These are used in the handshake
 * procedure of the certificate and anonymous authentication.
 */

#include "gnutls_int.h"
#include "auth.h"
#include "errors.h"
#include "dh.h"
#include "num.h"
#include "tls-sig.h"
#include "state.h"
#include "datum.h"
#include "x509.h"
#include "auth/ecdhe.h"
#include "ecc.h"
#include "ext/supported_groups.h"
#include "algorithms.h"
#include "auth/psk.h"
#include "auth/cert.h"
#include "pk.h"

static int gen_ecdhe_server_kx(gnutls_session_t, gnutls_buffer_st *);
static int proc_ecdhe_server_kx(gnutls_session_t session, uint8_t *data,
        size_t data_size);
static int proc_ecdhe_client_kx(gnutls_session_t session, uint8_t *data,
        size_t data_size);

#if defined(ENABLE_ECDHE)
const mod_auth_st ecdhe_ecdsa_auth_struct = {
  "ECDHE_ECDSA",
  _gnutls_gen_cert_server_crt,
  _gnutls_gen_cert_client_crt,
  gen_ecdhe_server_kx,
  _gnutls_gen_ecdh_common_client_kx, /* This is the only difference */
  _gnutls_gen_cert_client_crt_vrfy,
  _gnutls_gen_cert_server_cert_req,

  _gnutls_proc_crt,
  _gnutls_proc_crt,
  proc_ecdhe_server_kx,
  proc_ecdhe_client_kx,
  _gnutls_proc_cert_client_crt_vrfy,
  _gnutls_proc_cert_cert_req
};

const mod_auth_st ecdhe_rsa_auth_struct = {
  "ECDHE_RSA",
  _gnutls_gen_cert_server_crt,
  _gnutls_gen_cert_client_crt,
  gen_ecdhe_server_kx,
  _gnutls_gen_ecdh_common_client_kx, /* This is the only difference */
  _gnutls_gen_cert_client_crt_vrfy,
  _gnutls_gen_cert_server_cert_req,

  _gnutls_proc_crt,
  _gnutls_proc_crt,
  proc_ecdhe_server_kx,
  proc_ecdhe_client_kx,
  _gnutls_proc_cert_client_crt_vrfy,
  _gnutls_proc_cert_cert_req
};

static int calc_ecdh_key(gnutls_session_t session, gnutls_datum_t *psk_key,
       const gnutls_ecc_curve_entry_st *ecurve)
{
  gnutls_pk_params_st pub;
  int ret;
  gnutls_datum_t tmp_dh_key;

  gnutls_pk_params_init(&pub);
  pub.params[ECC_X] = session->key.proto.tls12.ecdh.x;
  pub.params[ECC_Y] = session->key.proto.tls12.ecdh.y;
  pub.raw_pub.data = session->key.proto.tls12.ecdh.raw.data;
  pub.raw_pub.size = session->key.proto.tls12.ecdh.raw.size;
  pub.curve = ecurve->id;

  ret = _gnutls_pk_derive(ecurve->pk, &tmp_dh_key,
        &session->key.proto.tls12.ecdh.params, &pub);
  if (ret < 0) {
    ret = gnutls_assert_val(ret);
    goto cleanup;
  }

  if (psk_key == NULL) {
    memcpy(&session->key.key, &tmp_dh_key, sizeof(gnutls_datum_t));
    tmp_dh_key.data = NULL; /* no longer needed */
  } else {
    ret = _gnutls_set_psk_session_key(session, psk_key,
              &tmp_dh_key);
    _gnutls_free_key_datum(&tmp_dh_key);

    if (ret < 0) {
      ret = gnutls_assert_val(ret);
      goto cleanup;
    }
  }

  ret = 0;

cleanup:
  /* no longer needed */
  _gnutls_mpi_release(&session->key.proto.tls12.ecdh.x);
  _gnutls_mpi_release(&session->key.proto.tls12.ecdh.y);
  _gnutls_free_datum(&session->key.proto.tls12.ecdh.raw);
  gnutls_pk_params_release(&session->key.proto.tls12.ecdh.params);
  return ret;
}

int _gnutls_proc_ecdh_common_client_kx(
  gnutls_session_t session, uint8_t *data, size_t data_size,
  const struct gnutls_group_entry_st *group, gnutls_datum_t *psk_key)
{
  int ret, i = 0;
  unsigned point_size;
  const gnutls_ecc_curve_entry_st *ecurve;

  if (group == NULL)
    return gnutls_assert_val(GNUTLS_E_ECC_NO_SUPPORTED_CURVES);

  ecurve = _gnutls_ecc_curve_get_params(group->curve);
  if (ecurve == NULL)
    return gnutls_assert_val(GNUTLS_E_ECC_NO_SUPPORTED_CURVES);

  DECR_LEN(data_size, 1);
  point_size = data[i];
  i += 1;

  if (point_size == 0) {
    ret = gnutls_assert_val(GNUTLS_E_UNEXPECTED_PACKET_LENGTH);
    goto cleanup;
  }

  DECR_LEN(data_size, point_size);

  if (ecurve->pk == GNUTLS_PK_EC) {
    ret = _gnutls_ecc_ansi_x962_import(
      &data[i], point_size, &session->key.proto.tls12.ecdh.x,
      &session->key.proto.tls12.ecdh.y);
    if (ret < 0) {
      gnutls_assert();
      goto cleanup;
    }
  } else if (ecurve->pk == GNUTLS_PK_ECDH_X25519 ||
       ecurve->pk == GNUTLS_PK_ECDH_X448) {
    if (ecurve->size != point_size)
      return gnutls_assert_val(
        GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);

    ret = _gnutls_set_datum(&session->key.proto.tls12.ecdh.raw,
          &data[i], point_size);
    if (ret < 0) {
      gnutls_assert();
      goto cleanup;
    }

    /* RFC7748 requires to mask the MSB in the final byte
     * for X25519 (not X448) */
    if (ecurve->id == GNUTLS_ECC_CURVE_X25519) {
      session->key.proto.tls12.ecdh.raw.data[point_size - 1] &=
        0x7f;
    }
  } else {
    return gnutls_assert_val(GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);
  }

  if (data_size != 0) {
    ret = gnutls_assert_val(GNUTLS_E_UNEXPECTED_PACKET_LENGTH);
    goto cleanup;
  }

  /* generate pre-shared key */
  ret = calc_ecdh_key(session, psk_key, ecurve);
  if (ret < 0) {
    gnutls_assert();
    goto cleanup;
  }
cleanup:
  _gnutls_mpi_release(&session->key.proto.tls12.ecdh.x);
  _gnutls_mpi_release(&session->key.proto.tls12.ecdh.y);
  _gnutls_free_datum(&session->key.proto.tls12.ecdh.raw);
  gnutls_pk_params_clear(&session->key.proto.tls12.ecdh.params);
  return ret;
}

static int proc_ecdhe_client_kx(gnutls_session_t session, uint8_t *data,
        size_t data_size)
{
  gnutls_certificate_credentials_t cred;

  cred = (gnutls_certificate_credentials_t)_gnutls_get_cred(
    session, GNUTLS_CRD_CERTIFICATE);
  if (cred == NULL) {
    gnutls_assert();
    return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
  }

  return _gnutls_proc_ecdh_common_client_kx(session, data, data_size,
              get_group(session), NULL);
}

int _gnutls_gen_ecdh_common_client_kx(gnutls_session_t session,
              gnutls_buffer_st *data)
{
  return _gnutls_gen_ecdh_common_client_kx_int(session, data, NULL);
}

int _gnutls_gen_ecdh_common_client_kx_int(gnutls_session_t session,
            gnutls_buffer_st *data,
            gnutls_datum_t *psk_key)
{
  int ret;
  gnutls_datum_t out;
  const gnutls_group_entry_st *group = get_group(session);
  const gnutls_ecc_curve_entry_st *ecurve;
  int pk;
  unsigned init_pos = data->length;

  if (group == NULL)
    return gnutls_assert_val(GNUTLS_E_ECC_NO_SUPPORTED_CURVES);

  ecurve = _gnutls_ecc_curve_get_params(group->curve);
  if (ecurve == NULL)
    return gnutls_assert_val(GNUTLS_E_ECC_NO_SUPPORTED_CURVES);

  pk = ecurve->pk;

  /* generate temporal key */
  ret = _gnutls_pk_generate_keys(
    pk, ecurve->id, &session->key.proto.tls12.ecdh.params, 1);
  if (ret < 0)
    return gnutls_assert_val(ret);

  if (pk == GNUTLS_PK_EC) {
    ret = _gnutls_ecc_ansi_x962_export(
      ecurve->id,
      session->key.proto.tls12.ecdh.params
        .params[ECC_X] /* x */,
      session->key.proto.tls12.ecdh.params
        .params[ECC_Y] /* y */,
      &out);

    if (ret < 0) {
      gnutls_assert();
      goto cleanup;
    }

    ret = _gnutls_buffer_append_data_prefix8(data, out.data,
               out.size);

    _gnutls_free_datum(&out);

    if (ret < 0) {
      gnutls_assert();
      goto cleanup;
    }
  } else if (pk == GNUTLS_PK_ECDH_X25519 || pk == GNUTLS_PK_ECDH_X448) {
    ret = _gnutls_buffer_append_data_prefix8(
      data, session->key.proto.tls12.ecdh.params.raw_pub.data,
      session->key.proto.tls12.ecdh.params.raw_pub.size);
    if (ret < 0) {
      gnutls_assert();
      goto cleanup;
    }
  }

  /* generate pre-shared key */
  ret = calc_ecdh_key(session, psk_key, ecurve);
  if (ret < 0) {
    gnutls_assert();
    goto cleanup;
  }

  ret = data->length - init_pos;
cleanup:
  gnutls_pk_params_clear(&session->key.proto.tls12.ecdh.params);
  return ret;
}

static int proc_ecdhe_server_kx(gnutls_session_t session, uint8_t *data,
        size_t data_size)
{
  int ret;
  gnutls_datum_t vparams;

  ret = _gnutls_proc_ecdh_common_server_kx(session, data, data_size);
  if (ret < 0)
    return gnutls_assert_val(ret);

  vparams.data = data;
  vparams.size = ret;

  return _gnutls_proc_dhe_signature(session, data + ret, data_size - ret,
            &vparams);
}

int _gnutls_proc_ecdh_common_server_kx(gnutls_session_t session, uint8_t *data,
               size_t data_size)
{
  int i, ret;
  unsigned point_size;
  const gnutls_group_entry_st *group;
  const gnutls_ecc_curve_entry_st *ecurve;

  /* just in case we are resuming a session */
  gnutls_pk_params_release(&session->key.proto.tls12.ecdh.params);

  gnutls_pk_params_init(&session->key.proto.tls12.ecdh.params);

  i = 0;
  DECR_LEN(data_size, 1);
  if (data[i++] != 3)
    return gnutls_assert_val(GNUTLS_E_ECC_NO_SUPPORTED_CURVES);

  DECR_LEN(data_size, 2);

  group = _gnutls_tls_id_to_group(_gnutls_read_uint16(&data[i]));
  if (group == NULL || group->curve == 0) {
    _gnutls_debug_log("received unknown curve %u.%u\n",
          (unsigned)data[i], (unsigned)data[i + 1]);
    return gnutls_assert_val(GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);
  } else {
    _gnutls_debug_log("received curve %s\n", group->name);
  }

  i += 2;

  if (!_gnutls_session_supports_group(session, group))
    return gnutls_assert_val(GNUTLS_E_ECC_UNSUPPORTED_CURVE);

  ecurve = _gnutls_ecc_curve_get_params(group->curve);
  if (ecurve == NULL) {
    return gnutls_assert_val(GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);
  }

  _gnutls_session_group_set(session, group);

  DECR_LEN(data_size, 1);
  point_size = data[i];
  i++;

  DECR_LEN(data_size, point_size);

  if (ecurve->pk == GNUTLS_PK_EC) {
    ret = _gnutls_ecc_ansi_x962_import(
      &data[i], point_size, &session->key.proto.tls12.ecdh.x,
      &session->key.proto.tls12.ecdh.y);
    if (ret < 0)
      return gnutls_assert_val(ret);

  } else if (ecurve->pk == GNUTLS_PK_ECDH_X25519 ||
       ecurve->pk == GNUTLS_PK_ECDH_X448) {
    if (ecurve->size != point_size)
      return gnutls_assert_val(
        GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);

    ret = _gnutls_set_datum(&session->key.proto.tls12.ecdh.raw,
          &data[i], point_size);
    if (ret < 0)
      return gnutls_assert_val(ret);

    /* RFC7748 requires to mask the MSB in the final byte
     * for X25519 (not X448) */
    if (ecurve->id == GNUTLS_ECC_CURVE_X25519) {
      session->key.proto.tls12.ecdh.raw.data[point_size - 1] &=
        0x7f;
    }
  } else {
    return gnutls_assert_val(GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);
  }

  i += point_size;

  return i;
}

/* If the psk flag is set, then an empty psk_identity_hint will
 * be inserted */
int _gnutls_ecdh_common_print_server_kx(gnutls_session_t session,
          gnutls_buffer_st *data,
          const gnutls_group_entry_st *group)
{
  uint8_t p;
  int ret;
  gnutls_datum_t out;
  unsigned init_pos = data->length;

  if (group == NULL || group->curve == 0)
    return gnutls_assert_val(GNUTLS_E_ECC_NO_SUPPORTED_CURVES);

  /* just in case we are resuming a session */
  gnutls_pk_params_release(&session->key.proto.tls12.ecdh.params);

  gnutls_pk_params_init(&session->key.proto.tls12.ecdh.params);

  /* curve type */
  p = 3;

  ret = _gnutls_buffer_append_data(data, &p, 1);
  if (ret < 0)
    return gnutls_assert_val(ret);

  ret = _gnutls_buffer_append_uint16(data, group->tls_id);
  if (ret < 0)
    return gnutls_assert_val(ret);

  /* generate temporal key */
  ret = _gnutls_pk_generate_keys(group->pk, group->curve,
               &session->key.proto.tls12.ecdh.params,
               1);
  if (ret < 0)
    return gnutls_assert_val(ret);

  if (group->pk == GNUTLS_PK_EC) {
    ret = _gnutls_ecc_ansi_x962_export(
      group->curve,
      session->key.proto.tls12.ecdh.params
        .params[ECC_X] /* x */,
      session->key.proto.tls12.ecdh.params
        .params[ECC_Y] /* y */,
      &out);
    if (ret < 0)
      return gnutls_assert_val(ret);

    ret = _gnutls_buffer_append_data_prefix8(data, out.data,
               out.size);

    _gnutls_free_datum(&out);

    if (ret < 0)
      return gnutls_assert_val(ret);

  } else if (group->pk == GNUTLS_PK_ECDH_X25519 ||
       group->pk == GNUTLS_PK_ECDH_X448) {
    ret = _gnutls_buffer_append_data_prefix8(
      data, session->key.proto.tls12.ecdh.params.raw_pub.data,
      session->key.proto.tls12.ecdh.params.raw_pub.size);
    if (ret < 0)
      return gnutls_assert_val(ret);
  } else {
    return gnutls_assert_val(GNUTLS_E_ECC_NO_SUPPORTED_CURVES);
  }

  return data->length - init_pos;
}

static int gen_ecdhe_server_kx(gnutls_session_t session, gnutls_buffer_st *data)
{
  int ret = 0;
  gnutls_certificate_credentials_t cred;
  unsigned sig_pos;

  cred = (gnutls_certificate_credentials_t)_gnutls_get_cred(
    session, GNUTLS_CRD_CERTIFICATE);
  if (cred == NULL) {
    gnutls_assert();
    return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
  }

  if ((ret = _gnutls_auth_info_init(session, GNUTLS_CRD_CERTIFICATE,
            sizeof(cert_auth_info_st), 1)) < 0) {
    gnutls_assert();
    return ret;
  }

  sig_pos = data->length;

  ret = _gnutls_ecdh_common_print_server_kx(session, data,
              get_group(session));
  if (ret < 0) {
    gnutls_assert();
    return ret;
  }

  /* Generate the signature. */
  return _gnutls_gen_dhe_signature(session, data, &data->data[sig_pos],
           data->length - sig_pos);
}

#endif

Coverage Report

Created: 2026-08-14 06:46

Line	Count	Source
1		/*
2		* Copyright (C) 2011-2012 Free Software Foundation, Inc.
3		* Copyright (C) 2017 Red Hat, Inc.
4		*
5		* Author: Nikos Mavrogiannopoulos
6		*
7		* This file is part of GnuTLS.
8		*
9		* The GnuTLS is free software; you can redistribute it and/or
10		* modify it under the terms of the GNU Lesser General Public License
11		* as published by the Free Software Foundation; either version 2.1 of
12		* the License, or (at your option) any later version.
13		*
14		* This library is distributed in the hope that it will be useful, but
15		* WITHOUT ANY WARRANTY; without even the implied warranty of
16		* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
17		* Lesser General Public License for more details.
18		*
19		* You should have received a copy of the GNU Lesser General Public License
20		* along with this program. If not, see <https://www.gnu.org/licenses/>
21		*
22		*/
23
24		/* This file contains common stuff in Ephemeral Diffie-Hellman (DHE)
25		* and Anonymous DH key exchange(DHA). These are used in the handshake
26		* procedure of the certificate and anonymous authentication.
27		*/
28
29		#include "gnutls_int.h"
30		#include "auth.h"
31		#include "errors.h"
32		#include "dh.h"
33		#include "num.h"
34		#include "tls-sig.h"
35		#include "state.h"
36		#include "datum.h"
37		#include "x509.h"
38		#include "auth/ecdhe.h"
39		#include "ecc.h"
40		#include "ext/supported_groups.h"
41		#include "algorithms.h"
42		#include "auth/psk.h"
43		#include "auth/cert.h"
44		#include "pk.h"
45
46		static int gen_ecdhe_server_kx(gnutls_session_t, gnutls_buffer_st *);
47		static int proc_ecdhe_server_kx(gnutls_session_t session, uint8_t *data,
48		size_t data_size);
49		static int proc_ecdhe_client_kx(gnutls_session_t session, uint8_t *data,
50		size_t data_size);
51
52		#if defined(ENABLE_ECDHE)
53		const mod_auth_st ecdhe_ecdsa_auth_struct = {
54		"ECDHE_ECDSA",
55		_gnutls_gen_cert_server_crt,
56		_gnutls_gen_cert_client_crt,
57		gen_ecdhe_server_kx,
58		_gnutls_gen_ecdh_common_client_kx, /* This is the only difference */
59		_gnutls_gen_cert_client_crt_vrfy,
60		_gnutls_gen_cert_server_cert_req,
61
62		_gnutls_proc_crt,
63		_gnutls_proc_crt,
64		proc_ecdhe_server_kx,
65		proc_ecdhe_client_kx,
66		_gnutls_proc_cert_client_crt_vrfy,
67		_gnutls_proc_cert_cert_req
68		};
69
70		const mod_auth_st ecdhe_rsa_auth_struct = {
71		"ECDHE_RSA",
72		_gnutls_gen_cert_server_crt,
73		_gnutls_gen_cert_client_crt,
74		gen_ecdhe_server_kx,
75		_gnutls_gen_ecdh_common_client_kx, /* This is the only difference */
76		_gnutls_gen_cert_client_crt_vrfy,
77		_gnutls_gen_cert_server_cert_req,
78
79		_gnutls_proc_crt,
80		_gnutls_proc_crt,
81		proc_ecdhe_server_kx,
82		proc_ecdhe_client_kx,
83		_gnutls_proc_cert_client_crt_vrfy,
84		_gnutls_proc_cert_cert_req
85		};
86
87		static int calc_ecdh_key(gnutls_session_t session, gnutls_datum_t *psk_key,
88		const gnutls_ecc_curve_entry_st *ecurve)
89	0	{
90	0	gnutls_pk_params_st pub;
91	0	int ret;
92	0	gnutls_datum_t tmp_dh_key;
93
94	0	gnutls_pk_params_init(&pub);
95	0	pub.params[ECC_X] = session->key.proto.tls12.ecdh.x;
96	0	pub.params[ECC_Y] = session->key.proto.tls12.ecdh.y;
97	0	pub.raw_pub.data = session->key.proto.tls12.ecdh.raw.data;
98	0	pub.raw_pub.size = session->key.proto.tls12.ecdh.raw.size;
99	0	pub.curve = ecurve->id;
100
101	0	ret = _gnutls_pk_derive(ecurve->pk, &tmp_dh_key,
102	0	&session->key.proto.tls12.ecdh.params, &pub);
103	0	if (ret < 0) {
104	0	ret = gnutls_assert_val(ret);
105	0	goto cleanup;
106	0	}
107
108	0	if (psk_key == NULL) {
109	0	memcpy(&session->key.key, &tmp_dh_key, sizeof(gnutls_datum_t));
110	0	tmp_dh_key.data = NULL; /* no longer needed */
111	0	} else {
112	0	ret = _gnutls_set_psk_session_key(session, psk_key,
113	0	&tmp_dh_key);
114	0	_gnutls_free_key_datum(&tmp_dh_key);
115
116	0	if (ret < 0) {
117	0	ret = gnutls_assert_val(ret);
118	0	goto cleanup;
119	0	}
120	0	}
121
122	0	ret = 0;
123
124	0	cleanup:
125		/* no longer needed */
126	0	_gnutls_mpi_release(&session->key.proto.tls12.ecdh.x);
127	0	_gnutls_mpi_release(&session->key.proto.tls12.ecdh.y);
128	0	_gnutls_free_datum(&session->key.proto.tls12.ecdh.raw);
129	0	gnutls_pk_params_release(&session->key.proto.tls12.ecdh.params);
130	0	return ret;
131	0	}
132
133		int _gnutls_proc_ecdh_common_client_kx(
134		gnutls_session_t session, uint8_t *data, size_t data_size,
135		const struct gnutls_group_entry_st group, gnutls_datum_t psk_key)
136	0	{
137	0	int ret, i = 0;
138	0	unsigned point_size;
139	0	const gnutls_ecc_curve_entry_st *ecurve;
140
141	0	if (group == NULL)
142	0	return gnutls_assert_val(GNUTLS_E_ECC_NO_SUPPORTED_CURVES);
143
144	0	ecurve = _gnutls_ecc_curve_get_params(group->curve);
145	0	if (ecurve == NULL)
146	0	return gnutls_assert_val(GNUTLS_E_ECC_NO_SUPPORTED_CURVES);
147
148	0	DECR_LEN(data_size, 1);
149	0	point_size = data[i];
150	0	i += 1;
151
152	0	if (point_size == 0) {
153	0	ret = gnutls_assert_val(GNUTLS_E_UNEXPECTED_PACKET_LENGTH);
154	0	goto cleanup;
155	0	}
156
157	0	DECR_LEN(data_size, point_size);
158
159	0	if (ecurve->pk == GNUTLS_PK_EC) {
160	0	ret = _gnutls_ecc_ansi_x962_import(
161	0	&data[i], point_size, &session->key.proto.tls12.ecdh.x,
162	0	&session->key.proto.tls12.ecdh.y);
163	0	if (ret < 0) {
164	0	gnutls_assert();
165	0	goto cleanup;
166	0	}
167	0	} else if (ecurve->pk == GNUTLS_PK_ECDH_X25519 \|\|
168	0	ecurve->pk == GNUTLS_PK_ECDH_X448) {
169	0	if (ecurve->size != point_size)
170	0	return gnutls_assert_val(
171	0	GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);
172
173	0	ret = _gnutls_set_datum(&session->key.proto.tls12.ecdh.raw,
174	0	&data[i], point_size);
175	0	if (ret < 0) {
176	0	gnutls_assert();
177	0	goto cleanup;
178	0	}
179
180		/* RFC7748 requires to mask the MSB in the final byte
181		* for X25519 (not X448) */
182	0	if (ecurve->id == GNUTLS_ECC_CURVE_X25519) {
183	0	session->key.proto.tls12.ecdh.raw.data[point_size - 1] &=
184	0	0x7f;
185	0	}
186	0	} else {
187	0	return gnutls_assert_val(GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);
188	0	}
189
190	0	if (data_size != 0) {
191	0	ret = gnutls_assert_val(GNUTLS_E_UNEXPECTED_PACKET_LENGTH);
192	0	goto cleanup;
193	0	}
194
195		/* generate pre-shared key */
196	0	ret = calc_ecdh_key(session, psk_key, ecurve);
197	0	if (ret < 0) {
198	0	gnutls_assert();
199	0	goto cleanup;
200	0	}
201	0	cleanup:
202	0	_gnutls_mpi_release(&session->key.proto.tls12.ecdh.x);
203	0	_gnutls_mpi_release(&session->key.proto.tls12.ecdh.y);
204	0	_gnutls_free_datum(&session->key.proto.tls12.ecdh.raw);
205	0	gnutls_pk_params_clear(&session->key.proto.tls12.ecdh.params);
206	0	return ret;
207	0	}
208
209		static int proc_ecdhe_client_kx(gnutls_session_t session, uint8_t *data,
210		size_t data_size)
211	0	{
212	0	gnutls_certificate_credentials_t cred;
213
214	0	cred = (gnutls_certificate_credentials_t)_gnutls_get_cred(
215	0	session, GNUTLS_CRD_CERTIFICATE);
216	0	if (cred == NULL) {
217	0	gnutls_assert();
218	0	return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
219	0	}
220
221	0	return _gnutls_proc_ecdh_common_client_kx(session, data, data_size,
222	0	get_group(session), NULL);
223	0	}
224
225		int _gnutls_gen_ecdh_common_client_kx(gnutls_session_t session,
226		gnutls_buffer_st *data)
227	0	{
228	0	return _gnutls_gen_ecdh_common_client_kx_int(session, data, NULL);
229	0	}
230
231		int _gnutls_gen_ecdh_common_client_kx_int(gnutls_session_t session,
232		gnutls_buffer_st *data,
233		gnutls_datum_t *psk_key)
234	0	{
235	0	int ret;
236	0	gnutls_datum_t out;
237	0	const gnutls_group_entry_st *group = get_group(session);
238	0	const gnutls_ecc_curve_entry_st *ecurve;
239	0	int pk;
240	0	unsigned init_pos = data->length;
241
242	0	if (group == NULL)
243	0	return gnutls_assert_val(GNUTLS_E_ECC_NO_SUPPORTED_CURVES);
244
245	0	ecurve = _gnutls_ecc_curve_get_params(group->curve);
246	0	if (ecurve == NULL)
247	0	return gnutls_assert_val(GNUTLS_E_ECC_NO_SUPPORTED_CURVES);
248
249	0	pk = ecurve->pk;
250
251		/* generate temporal key */
252	0	ret = _gnutls_pk_generate_keys(
253	0	pk, ecurve->id, &session->key.proto.tls12.ecdh.params, 1);
254	0	if (ret < 0)
255	0	return gnutls_assert_val(ret);
256
257	0	if (pk == GNUTLS_PK_EC) {
258	0	ret = _gnutls_ecc_ansi_x962_export(
259	0	ecurve->id,
260	0	session->key.proto.tls12.ecdh.params
261	0	.params[ECC_X] /* x */,
262	0	session->key.proto.tls12.ecdh.params
263	0	.params[ECC_Y] /* y */,
264	0	&out);
265
266	0	if (ret < 0) {
267	0	gnutls_assert();
268	0	goto cleanup;
269	0	}
270
271	0	ret = _gnutls_buffer_append_data_prefix8(data, out.data,
272	0	out.size);
273
274	0	_gnutls_free_datum(&out);
275
276	0	if (ret < 0) {
277	0	gnutls_assert();
278	0	goto cleanup;
279	0	}
280	0	} else if (pk == GNUTLS_PK_ECDH_X25519 \|\| pk == GNUTLS_PK_ECDH_X448) {
281	0	ret = _gnutls_buffer_append_data_prefix8(
282	0	data, session->key.proto.tls12.ecdh.params.raw_pub.data,
283	0	session->key.proto.tls12.ecdh.params.raw_pub.size);
284	0	if (ret < 0) {
285	0	gnutls_assert();
286	0	goto cleanup;
287	0	}
288	0	}
289
290		/* generate pre-shared key */
291	0	ret = calc_ecdh_key(session, psk_key, ecurve);
292	0	if (ret < 0) {
293	0	gnutls_assert();
294	0	goto cleanup;
295	0	}
296
297	0	ret = data->length - init_pos;
298	0	cleanup:
299	0	gnutls_pk_params_clear(&session->key.proto.tls12.ecdh.params);
300	0	return ret;
301	0	}
302
303		static int proc_ecdhe_server_kx(gnutls_session_t session, uint8_t *data,
304		size_t data_size)
305	0	{
306	0	int ret;
307	0	gnutls_datum_t vparams;
308
309	0	ret = _gnutls_proc_ecdh_common_server_kx(session, data, data_size);
310	0	if (ret < 0)
311	0	return gnutls_assert_val(ret);
312
313	0	vparams.data = data;
314	0	vparams.size = ret;
315
316	0	return _gnutls_proc_dhe_signature(session, data + ret, data_size - ret,
317	0	&vparams);
318	0	}
319
320		int _gnutls_proc_ecdh_common_server_kx(gnutls_session_t session, uint8_t *data,
321		size_t data_size)
322	0	{
323	0	int i, ret;
324	0	unsigned point_size;
325	0	const gnutls_group_entry_st *group;
326	0	const gnutls_ecc_curve_entry_st *ecurve;
327
328		/* just in case we are resuming a session */
329	0	gnutls_pk_params_release(&session->key.proto.tls12.ecdh.params);
330
331	0	gnutls_pk_params_init(&session->key.proto.tls12.ecdh.params);
332
333	0	i = 0;
334	0	DECR_LEN(data_size, 1);
335	0	if (data[i++] != 3)
336	0	return gnutls_assert_val(GNUTLS_E_ECC_NO_SUPPORTED_CURVES);
337
338	0	DECR_LEN(data_size, 2);
339
340	0	group = _gnutls_tls_id_to_group(_gnutls_read_uint16(&data[i]));
341	0	if (group == NULL \|\| group->curve == 0) {
342	0	_gnutls_debug_log("received unknown curve %u.%u\n",
343	0	(unsigned)data[i], (unsigned)data[i + 1]);
344	0	return gnutls_assert_val(GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);
345	0	} else {
346	0	_gnutls_debug_log("received curve %s\n", group->name);
347	0	}
348
349	0	i += 2;
350
351	0	if (!_gnutls_session_supports_group(session, group))
352	0	return gnutls_assert_val(GNUTLS_E_ECC_UNSUPPORTED_CURVE);
353
354	0	ecurve = _gnutls_ecc_curve_get_params(group->curve);
355	0	if (ecurve == NULL) {
356	0	return gnutls_assert_val(GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);
357	0	}
358
359	0	_gnutls_session_group_set(session, group);
360
361	0	DECR_LEN(data_size, 1);
362	0	point_size = data[i];
363	0	i++;
364
365	0	DECR_LEN(data_size, point_size);
366
367	0	if (ecurve->pk == GNUTLS_PK_EC) {
368	0	ret = _gnutls_ecc_ansi_x962_import(
369	0	&data[i], point_size, &session->key.proto.tls12.ecdh.x,
370	0	&session->key.proto.tls12.ecdh.y);
371	0	if (ret < 0)
372	0	return gnutls_assert_val(ret);
373
374	0	} else if (ecurve->pk == GNUTLS_PK_ECDH_X25519 \|\|
375	0	ecurve->pk == GNUTLS_PK_ECDH_X448) {
376	0	if (ecurve->size != point_size)
377	0	return gnutls_assert_val(
378	0	GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);
379
380	0	ret = _gnutls_set_datum(&session->key.proto.tls12.ecdh.raw,
381	0	&data[i], point_size);
382	0	if (ret < 0)
383	0	return gnutls_assert_val(ret);
384
385		/* RFC7748 requires to mask the MSB in the final byte
386		* for X25519 (not X448) */
387	0	if (ecurve->id == GNUTLS_ECC_CURVE_X25519) {
388	0	session->key.proto.tls12.ecdh.raw.data[point_size - 1] &=
389	0	0x7f;
390	0	}
391	0	} else {
392	0	return gnutls_assert_val(GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);
393	0	}
394
395	0	i += point_size;
396
397	0	return i;
398	0	}
399
400		/* If the psk flag is set, then an empty psk_identity_hint will
401		* be inserted */
402		int _gnutls_ecdh_common_print_server_kx(gnutls_session_t session,
403		gnutls_buffer_st *data,
404		const gnutls_group_entry_st *group)
405	0	{
406	0	uint8_t p;
407	0	int ret;
408	0	gnutls_datum_t out;
409	0	unsigned init_pos = data->length;
410
411	0	if (group == NULL \|\| group->curve == 0)
412	0	return gnutls_assert_val(GNUTLS_E_ECC_NO_SUPPORTED_CURVES);
413
414		/* just in case we are resuming a session */
415	0	gnutls_pk_params_release(&session->key.proto.tls12.ecdh.params);
416
417	0	gnutls_pk_params_init(&session->key.proto.tls12.ecdh.params);
418
419		/* curve type */
420	0	p = 3;
421
422	0	ret = _gnutls_buffer_append_data(data, &p, 1);
423	0	if (ret < 0)
424	0	return gnutls_assert_val(ret);
425
426	0	ret = _gnutls_buffer_append_uint16(data, group->tls_id);
427	0	if (ret < 0)
428	0	return gnutls_assert_val(ret);
429
430		/* generate temporal key */
431	0	ret = _gnutls_pk_generate_keys(group->pk, group->curve,
432	0	&session->key.proto.tls12.ecdh.params,
433	0	1);
434	0	if (ret < 0)
435	0	return gnutls_assert_val(ret);
436
437	0	if (group->pk == GNUTLS_PK_EC) {
438	0	ret = _gnutls_ecc_ansi_x962_export(
439	0	group->curve,
440	0	session->key.proto.tls12.ecdh.params
441	0	.params[ECC_X] /* x */,
442	0	session->key.proto.tls12.ecdh.params
443	0	.params[ECC_Y] /* y */,
444	0	&out);
445	0	if (ret < 0)
446	0	return gnutls_assert_val(ret);
447
448	0	ret = _gnutls_buffer_append_data_prefix8(data, out.data,
449	0	out.size);
450
451	0	_gnutls_free_datum(&out);
452
453	0	if (ret < 0)
454	0	return gnutls_assert_val(ret);
455
456	0	} else if (group->pk == GNUTLS_PK_ECDH_X25519 \|\|
457	0	group->pk == GNUTLS_PK_ECDH_X448) {
458	0	ret = _gnutls_buffer_append_data_prefix8(
459	0	data, session->key.proto.tls12.ecdh.params.raw_pub.data,
460	0	session->key.proto.tls12.ecdh.params.raw_pub.size);
461	0	if (ret < 0)
462	0	return gnutls_assert_val(ret);
463	0	} else {
464	0	return gnutls_assert_val(GNUTLS_E_ECC_NO_SUPPORTED_CURVES);
465	0	}
466
467	0	return data->length - init_pos;
468	0	}
469
470		static int gen_ecdhe_server_kx(gnutls_session_t session, gnutls_buffer_st *data)
471	0	{
472	0	int ret = 0;
473	0	gnutls_certificate_credentials_t cred;
474	0	unsigned sig_pos;
475
476	0	cred = (gnutls_certificate_credentials_t)_gnutls_get_cred(
477	0	session, GNUTLS_CRD_CERTIFICATE);
478	0	if (cred == NULL) {
479	0	gnutls_assert();
480	0	return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
481	0	}
482
483	0	if ((ret = _gnutls_auth_info_init(session, GNUTLS_CRD_CERTIFICATE,
484	0	sizeof(cert_auth_info_st), 1)) < 0) {
485	0	gnutls_assert();
486	0	return ret;
487	0	}
488
489	0	sig_pos = data->length;
490
491	0	ret = _gnutls_ecdh_common_print_server_kx(session, data,
492	0	get_group(session));
493	0	if (ret < 0) {
494	0	gnutls_assert();
495	0	return ret;
496	0	}
497
498		/* Generate the signature. */
499	0	return _gnutls_gen_dhe_signature(session, data, &data->data[sig_pos],
500	0	data->length - sig_pos);
501	0	}
502
503		#endif