1 /* $NetBSD: dh-ltm.c,v 1.1.1.2 2014/04/24 12:45:30 pettai Exp $ */
2
3 /*
4 * Copyright (c) 2006 Kungliga Tekniska Högskolan
5 * (Royal Institute of Technology, Stockholm, Sweden).
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 *
19 * 3. Neither the name of the Institute nor the names of its contributors
20 * may be used to endorse or promote products derived from this software
21 * without specific prior written permission.
22 *
23 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33 * SUCH DAMAGE.
34 */
35
36 #ifdef HAVE_CONFIG_H
37 #include <config.h>
38 #endif
39
40 #include <stdio.h>
41 #include <stdlib.h>
42 #include <dh.h>
43
44 #include <krb5/roken.h>
45
46 #include "tommath.h"
47
48 static void
BN2mpz(mp_int * s,const BIGNUM * bn)49 BN2mpz(mp_int *s, const BIGNUM *bn)
50 {
51 size_t len;
52 void *p;
53
54 len = BN_num_bytes(bn);
55 p = malloc(len);
56 BN_bn2bin(bn, p);
57 mp_read_unsigned_bin(s, p, len);
58 free(p);
59 }
60
61
62 static BIGNUM *
mpz2BN(mp_int * s)63 mpz2BN(mp_int *s)
64 {
65 size_t size;
66 BIGNUM *bn;
67 void *p;
68
69 size = mp_unsigned_bin_size(s);
70 p = malloc(size);
71 if (p == NULL && size != 0)
72 return NULL;
73 mp_to_unsigned_bin(s, p);
74
75 bn = BN_bin2bn(p, size, NULL);
76 free(p);
77 return bn;
78 }
79
80 /*
81 *
82 */
83
84 #define DH_NUM_TRIES 10
85
86 static int
ltm_dh_generate_key(DH * dh)87 ltm_dh_generate_key(DH *dh)
88 {
89 mp_int pub, priv_key, g, p;
90 int have_private_key = (dh->priv_key != NULL);
91 int codes, times = 0;
92 int res;
93
94 if (dh->p == NULL || dh->g == NULL)
95 return 0;
96
97 while (times++ < DH_NUM_TRIES) {
98 if (!have_private_key) {
99 size_t bits = BN_num_bits(dh->p);
100
101 if (dh->priv_key)
102 BN_free(dh->priv_key);
103
104 dh->priv_key = BN_new();
105 if (dh->priv_key == NULL)
106 return 0;
107 if (!BN_rand(dh->priv_key, bits - 1, 0, 0)) {
108 BN_clear_free(dh->priv_key);
109 dh->priv_key = NULL;
110 return 0;
111 }
112 }
113 if (dh->pub_key)
114 BN_free(dh->pub_key);
115
116 mp_init_multi(&pub, &priv_key, &g, &p, NULL);
117
118 BN2mpz(&priv_key, dh->priv_key);
119 BN2mpz(&g, dh->g);
120 BN2mpz(&p, dh->p);
121
122 res = mp_exptmod(&g, &priv_key, &p, &pub);
123
124 mp_clear_multi(&priv_key, &g, &p, NULL);
125 if (res != 0)
126 continue;
127
128 dh->pub_key = mpz2BN(&pub);
129 mp_clear(&pub);
130 if (dh->pub_key == NULL)
131 return 0;
132
133 if (DH_check_pubkey(dh, dh->pub_key, &codes) && codes == 0)
134 break;
135 if (have_private_key)
136 return 0;
137 }
138
139 if (times >= DH_NUM_TRIES) {
140 if (!have_private_key && dh->priv_key) {
141 BN_free(dh->priv_key);
142 dh->priv_key = NULL;
143 }
144 if (dh->pub_key) {
145 BN_free(dh->pub_key);
146 dh->pub_key = NULL;
147 }
148 return 0;
149 }
150
151 return 1;
152 }
153
154 static int
ltm_dh_compute_key(unsigned char * shared,const BIGNUM * pub,DH * dh)155 ltm_dh_compute_key(unsigned char *shared, const BIGNUM * pub, DH *dh)
156 {
157 mp_int s, priv_key, p, peer_pub;
158 int ret;
159
160 if (dh->pub_key == NULL || dh->g == NULL || dh->priv_key == NULL)
161 return -1;
162
163 mp_init_multi(&s, &priv_key, &p, &peer_pub, NULL);
164 BN2mpz(&p, dh->p);
165 BN2mpz(&peer_pub, pub);
166
167 /* check if peers pubkey is reasonable */
168 if (mp_isneg(&peer_pub)
169 || mp_cmp(&peer_pub, &p) >= 0
170 || mp_cmp_d(&peer_pub, 1) <= 0)
171 {
172 ret = -1;
173 goto out;
174 }
175
176 BN2mpz(&priv_key, dh->priv_key);
177
178 ret = mp_exptmod(&peer_pub, &priv_key, &p, &s);
179
180 if (ret != 0) {
181 ret = -1;
182 goto out;
183 }
184
185 ret = mp_unsigned_bin_size(&s);
186 mp_to_unsigned_bin(&s, shared);
187
188 out:
189 mp_clear_multi(&s, &priv_key, &p, &peer_pub, NULL);
190
191 return ret;
192 }
193
194 static int
ltm_dh_generate_params(DH * dh,int a,int b,BN_GENCB * callback)195 ltm_dh_generate_params(DH *dh, int a, int b, BN_GENCB *callback)
196 {
197 /* groups should already be known, we don't care about this */
198 return 0;
199 }
200
201 static int
ltm_dh_init(DH * dh)202 ltm_dh_init(DH *dh)
203 {
204 return 1;
205 }
206
207 static int
ltm_dh_finish(DH * dh)208 ltm_dh_finish(DH *dh)
209 {
210 return 1;
211 }
212
213
214 /*
215 *
216 */
217
218 const DH_METHOD _hc_dh_ltm_method = {
219 "hcrypto ltm DH",
220 ltm_dh_generate_key,
221 ltm_dh_compute_key,
222 NULL,
223 ltm_dh_init,
224 ltm_dh_finish,
225 0,
226 NULL,
227 ltm_dh_generate_params
228 };
229
230 /**
231 * DH implementation using libtommath.
232 *
233 * @return the DH_METHOD for the DH implementation using libtommath.
234 *
235 * @ingroup hcrypto_dh
236 */
237
238 const DH_METHOD *
DH_ltm_method(void)239 DH_ltm_method(void)
240 {
241 return &_hc_dh_ltm_method;
242 }
243