1 /* ssl/tls_srp.c */ 2 /* Written by Christophe Renou (christophe.renou@edelweb.fr) with 3 * the precious help of Peter Sylvester (peter.sylvester@edelweb.fr) 4 * for the EdelKey project and contributed to the OpenSSL project 2004. 5 */ 6 /* ==================================================================== 7 * Copyright (c) 2004 The OpenSSL Project. All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 16 * 2. Redistributions in binary form must reproduce the above copyright 17 * notice, this list of conditions and the following disclaimer in 18 * the documentation and/or other materials provided with the 19 * distribution. 20 * 21 * 3. All advertising materials mentioning features or use of this 22 * software must display the following acknowledgment: 23 * "This product includes software developed by the OpenSSL Project 24 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" 25 * 26 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 27 * endorse or promote products derived from this software without 28 * prior written permission. For written permission, please contact 29 * licensing@OpenSSL.org. 30 * 31 * 5. Products derived from this software may not be called "OpenSSL" 32 * nor may "OpenSSL" appear in their names without prior written 33 * permission of the OpenSSL Project. 34 * 35 * 6. Redistributions of any form whatsoever must retain the following 36 * acknowledgment: 37 * "This product includes software developed by the OpenSSL Project 38 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" 39 * 40 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 41 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 42 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 43 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 44 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 45 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 46 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 47 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 49 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 50 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 51 * OF THE POSSIBILITY OF SUCH DAMAGE. 52 * ==================================================================== 53 * 54 * This product includes cryptographic software written by Eric Young 55 * (eay@cryptsoft.com). This product includes software written by Tim 56 * Hudson (tjh@cryptsoft.com). 57 * 58 */ 59 #include "ssl_locl.h" 60 #ifndef OPENSSL_NO_SRP 61 62 #include <openssl/rand.h> 63 #include <openssl/srp.h> 64 #include <openssl/err.h> 65 66 int SSL_CTX_SRP_CTX_free(struct ssl_ctx_st *ctx) 67 { 68 if (ctx == NULL) 69 return 0; 70 OPENSSL_free(ctx->srp_ctx.login); 71 BN_free(ctx->srp_ctx.N); 72 BN_free(ctx->srp_ctx.g); 73 BN_free(ctx->srp_ctx.s); 74 BN_free(ctx->srp_ctx.B); 75 BN_free(ctx->srp_ctx.A); 76 BN_free(ctx->srp_ctx.a); 77 BN_free(ctx->srp_ctx.b); 78 BN_free(ctx->srp_ctx.v); 79 ctx->srp_ctx.TLS_ext_srp_username_callback = NULL; 80 ctx->srp_ctx.SRP_cb_arg = NULL; 81 ctx->srp_ctx.SRP_verify_param_callback = NULL; 82 ctx->srp_ctx.SRP_give_srp_client_pwd_callback = NULL; 83 ctx->srp_ctx.SRP_TLS_ext_missing_srp_client_username_callback = NULL; 84 ctx->srp_ctx.N = NULL; 85 ctx->srp_ctx.g = NULL; 86 ctx->srp_ctx.s = NULL; 87 ctx->srp_ctx.B = NULL; 88 ctx->srp_ctx.A = NULL; 89 ctx->srp_ctx.a = NULL; 90 ctx->srp_ctx.b = NULL; 91 ctx->srp_ctx.v = NULL; 92 ctx->srp_ctx.login = NULL; 93 ctx->srp_ctx.info = NULL; 94 ctx->srp_ctx.strength = SRP_MINIMAL_N; 95 ctx->srp_ctx.srp_Mask = 0; 96 return (1); 97 } 98 99 int SSL_SRP_CTX_free(struct ssl_st *s) 100 { 101 if (s == NULL) 102 return 0; 103 OPENSSL_free(s->srp_ctx.login); 104 BN_free(s->srp_ctx.N); 105 BN_free(s->srp_ctx.g); 106 BN_free(s->srp_ctx.s); 107 BN_free(s->srp_ctx.B); 108 BN_free(s->srp_ctx.A); 109 BN_free(s->srp_ctx.a); 110 BN_free(s->srp_ctx.b); 111 BN_free(s->srp_ctx.v); 112 s->srp_ctx.TLS_ext_srp_username_callback = NULL; 113 s->srp_ctx.SRP_cb_arg = NULL; 114 s->srp_ctx.SRP_verify_param_callback = NULL; 115 s->srp_ctx.SRP_give_srp_client_pwd_callback = NULL; 116 s->srp_ctx.SRP_TLS_ext_missing_srp_client_username_callback = NULL; 117 s->srp_ctx.N = NULL; 118 s->srp_ctx.g = NULL; 119 s->srp_ctx.s = NULL; 120 s->srp_ctx.B = NULL; 121 s->srp_ctx.A = NULL; 122 s->srp_ctx.a = NULL; 123 s->srp_ctx.b = NULL; 124 s->srp_ctx.v = NULL; 125 s->srp_ctx.login = NULL; 126 s->srp_ctx.info = NULL; 127 s->srp_ctx.strength = SRP_MINIMAL_N; 128 s->srp_ctx.srp_Mask = 0; 129 return (1); 130 } 131 132 int SSL_SRP_CTX_init(struct ssl_st *s) 133 { 134 SSL_CTX *ctx; 135 136 if ((s == NULL) || ((ctx = s->ctx) == NULL)) 137 return 0; 138 s->srp_ctx.SRP_cb_arg = ctx->srp_ctx.SRP_cb_arg; 139 /* set client Hello login callback */ 140 s->srp_ctx.TLS_ext_srp_username_callback = ctx->srp_ctx.TLS_ext_srp_username_callback; 141 /* set SRP N/g param callback for verification */ 142 s->srp_ctx.SRP_verify_param_callback = ctx->srp_ctx.SRP_verify_param_callback; 143 /* set SRP client passwd callback */ 144 s->srp_ctx.SRP_give_srp_client_pwd_callback = ctx->srp_ctx.SRP_give_srp_client_pwd_callback; 145 s->srp_ctx.SRP_TLS_ext_missing_srp_client_username_callback = ctx->srp_ctx.SRP_TLS_ext_missing_srp_client_username_callback; 146 147 s->srp_ctx.N = NULL; 148 s->srp_ctx.g = NULL; 149 s->srp_ctx.s = NULL; 150 s->srp_ctx.B = NULL; 151 s->srp_ctx.A = NULL; 152 s->srp_ctx.a = NULL; 153 s->srp_ctx.b = NULL; 154 s->srp_ctx.v = NULL; 155 s->srp_ctx.login = NULL; 156 s->srp_ctx.info = ctx->srp_ctx.info; 157 s->srp_ctx.strength = ctx->srp_ctx.strength; 158 159 if (((ctx->srp_ctx.N != NULL) && 160 ((s->srp_ctx.N = BN_dup(ctx->srp_ctx.N)) == NULL)) || 161 ((ctx->srp_ctx.g != NULL) && 162 ((s->srp_ctx.g = BN_dup(ctx->srp_ctx.g)) == NULL)) || 163 ((ctx->srp_ctx.s != NULL) && 164 ((s->srp_ctx.s = BN_dup(ctx->srp_ctx.s)) == NULL)) || 165 ((ctx->srp_ctx.B != NULL) && 166 ((s->srp_ctx.B = BN_dup(ctx->srp_ctx.B)) == NULL)) || 167 ((ctx->srp_ctx.A != NULL) && 168 ((s->srp_ctx.A = BN_dup(ctx->srp_ctx.A)) == NULL)) || 169 ((ctx->srp_ctx.a != NULL) && 170 ((s->srp_ctx.a = BN_dup(ctx->srp_ctx.a)) == NULL)) || 171 ((ctx->srp_ctx.v != NULL) && 172 ((s->srp_ctx.v = BN_dup(ctx->srp_ctx.v)) == NULL)) || 173 ((ctx->srp_ctx.b != NULL) && 174 ((s->srp_ctx.b = BN_dup(ctx->srp_ctx.b)) == NULL))) 175 { 176 SSLerr(SSL_F_SSL_SRP_CTX_INIT,ERR_R_BN_LIB); 177 goto err; 178 } 179 if ((ctx->srp_ctx.login != NULL) && 180 ((s->srp_ctx.login = BUF_strdup(ctx->srp_ctx.login)) == NULL)) 181 { 182 SSLerr(SSL_F_SSL_SRP_CTX_INIT,ERR_R_INTERNAL_ERROR); 183 goto err; 184 } 185 s->srp_ctx.srp_Mask = ctx->srp_ctx.srp_Mask; 186 187 return (1); 188 err: 189 OPENSSL_free(s->srp_ctx.login); 190 BN_free(s->srp_ctx.N); 191 BN_free(s->srp_ctx.g); 192 BN_free(s->srp_ctx.s); 193 BN_free(s->srp_ctx.B); 194 BN_free(s->srp_ctx.A); 195 BN_free(s->srp_ctx.a); 196 BN_free(s->srp_ctx.b); 197 BN_free(s->srp_ctx.v); 198 return (0); 199 } 200 201 int SSL_CTX_SRP_CTX_init(struct ssl_ctx_st *ctx) 202 { 203 if (ctx == NULL) 204 return 0; 205 206 ctx->srp_ctx.SRP_cb_arg = NULL; 207 /* set client Hello login callback */ 208 ctx->srp_ctx.TLS_ext_srp_username_callback = NULL; 209 /* set SRP N/g param callback for verification */ 210 ctx->srp_ctx.SRP_verify_param_callback = NULL; 211 /* set SRP client passwd callback */ 212 ctx->srp_ctx.SRP_give_srp_client_pwd_callback = NULL; 213 ctx->srp_ctx.SRP_TLS_ext_missing_srp_client_username_callback = NULL; 214 215 ctx->srp_ctx.N = NULL; 216 ctx->srp_ctx.g = NULL; 217 ctx->srp_ctx.s = NULL; 218 ctx->srp_ctx.B = NULL; 219 ctx->srp_ctx.A = NULL; 220 ctx->srp_ctx.a = NULL; 221 ctx->srp_ctx.b = NULL; 222 ctx->srp_ctx.v = NULL; 223 ctx->srp_ctx.login = NULL; 224 ctx->srp_ctx.srp_Mask = 0; 225 ctx->srp_ctx.info = NULL; 226 ctx->srp_ctx.strength = SRP_MINIMAL_N; 227 228 return (1); 229 } 230 231 /* server side */ 232 int SSL_srp_server_param_with_username(SSL *s, int *ad) 233 { 234 unsigned char b[SSL_MAX_MASTER_KEY_LENGTH]; 235 int al; 236 237 *ad = SSL_AD_UNKNOWN_SRP_USERNAME; 238 if ((s->srp_ctx.TLS_ext_srp_username_callback !=NULL) && 239 ((al = s->srp_ctx.TLS_ext_srp_username_callback(s, ad, s->srp_ctx.SRP_cb_arg))!=SSL_ERROR_NONE)) 240 return al; 241 242 *ad = SSL_AD_INTERNAL_ERROR; 243 if ((s->srp_ctx.N == NULL) || 244 (s->srp_ctx.g == NULL) || 245 (s->srp_ctx.s == NULL) || 246 (s->srp_ctx.v == NULL)) 247 return SSL3_AL_FATAL; 248 249 RAND_bytes(b, sizeof(b)); 250 s->srp_ctx.b = BN_bin2bn(b,sizeof(b),NULL); 251 OPENSSL_cleanse(b,sizeof(b)); 252 253 /* Calculate: B = (kv + g^b) % N */ 254 255 return ((s->srp_ctx.B = SRP_Calc_B(s->srp_ctx.b, s->srp_ctx.N, s->srp_ctx.g, s->srp_ctx.v)) != NULL)? 256 SSL_ERROR_NONE:SSL3_AL_FATAL; 257 } 258 259 /* If the server just has the raw password, make up a verifier entry on the fly */ 260 int SSL_set_srp_server_param_pw(SSL *s, const char *user, const char *pass, const char *grp) 261 { 262 SRP_gN *GN = SRP_get_default_gN(grp); 263 if(GN == NULL) return -1; 264 s->srp_ctx.N = BN_dup(GN->N); 265 s->srp_ctx.g = BN_dup(GN->g); 266 if(s->srp_ctx.v != NULL) 267 { 268 BN_clear_free(s->srp_ctx.v); 269 s->srp_ctx.v = NULL; 270 } 271 if(s->srp_ctx.s != NULL) 272 { 273 BN_clear_free(s->srp_ctx.s); 274 s->srp_ctx.s = NULL; 275 } 276 if(!SRP_create_verifier_BN(user, pass, &s->srp_ctx.s, &s->srp_ctx.v, GN->N, GN->g)) return -1; 277 278 return 1; 279 } 280 281 int SSL_set_srp_server_param(SSL *s, const BIGNUM *N, const BIGNUM *g, 282 BIGNUM *sa, BIGNUM *v, char *info) 283 { 284 if (N!= NULL) 285 { 286 if (s->srp_ctx.N != NULL) 287 { 288 if (!BN_copy(s->srp_ctx.N,N)) 289 { 290 BN_free(s->srp_ctx.N); 291 s->srp_ctx.N = NULL; 292 } 293 } 294 else 295 s->srp_ctx.N = BN_dup(N); 296 } 297 if (g!= NULL) 298 { 299 if (s->srp_ctx.g != NULL) 300 { 301 if (!BN_copy(s->srp_ctx.g,g)) 302 { 303 BN_free(s->srp_ctx.g); 304 s->srp_ctx.g = NULL; 305 } 306 } 307 else 308 s->srp_ctx.g = BN_dup(g); 309 } 310 if (sa!= NULL) 311 { 312 if (s->srp_ctx.s != NULL) 313 { 314 if (!BN_copy(s->srp_ctx.s,sa)) 315 { 316 BN_free(s->srp_ctx.s); 317 s->srp_ctx.s = NULL; 318 } 319 } 320 else 321 s->srp_ctx.s = BN_dup(sa); 322 } 323 if (v!= NULL) 324 { 325 if (s->srp_ctx.v != NULL) 326 { 327 if (!BN_copy(s->srp_ctx.v,v)) 328 { 329 BN_free(s->srp_ctx.v); 330 s->srp_ctx.v = NULL; 331 } 332 } 333 else 334 s->srp_ctx.v = BN_dup(v); 335 } 336 s->srp_ctx.info = info; 337 338 if (!(s->srp_ctx.N) || 339 !(s->srp_ctx.g) || 340 !(s->srp_ctx.s) || 341 !(s->srp_ctx.v)) 342 return -1; 343 344 return 1; 345 } 346 347 int SRP_generate_server_master_secret(SSL *s,unsigned char *master_key) 348 { 349 BIGNUM *K = NULL, *u = NULL; 350 int ret = -1, tmp_len; 351 unsigned char *tmp = NULL; 352 353 if (!SRP_Verify_A_mod_N(s->srp_ctx.A,s->srp_ctx.N)) 354 goto err; 355 if (!(u = SRP_Calc_u(s->srp_ctx.A,s->srp_ctx.B,s->srp_ctx.N))) 356 goto err; 357 if (!(K = SRP_Calc_server_key(s->srp_ctx.A, s->srp_ctx.v, u, s->srp_ctx.b, s->srp_ctx.N))) 358 goto err; 359 360 tmp_len = BN_num_bytes(K); 361 if ((tmp = OPENSSL_malloc(tmp_len)) == NULL) 362 goto err; 363 BN_bn2bin(K, tmp); 364 ret = s->method->ssl3_enc->generate_master_secret(s,master_key,tmp,tmp_len); 365 err: 366 if (tmp) 367 { 368 OPENSSL_cleanse(tmp,tmp_len) ; 369 OPENSSL_free(tmp); 370 } 371 BN_clear_free(K); 372 BN_clear_free(u); 373 return ret; 374 } 375 376 /* client side */ 377 int SRP_generate_client_master_secret(SSL *s,unsigned char *master_key) 378 { 379 BIGNUM *x = NULL, *u = NULL, *K = NULL; 380 int ret = -1, tmp_len; 381 char *passwd = NULL; 382 unsigned char *tmp = NULL; 383 384 /* Checks if b % n == 0 385 */ 386 if (SRP_Verify_B_mod_N(s->srp_ctx.B,s->srp_ctx.N)==0) goto err; 387 if (!(u = SRP_Calc_u(s->srp_ctx.A,s->srp_ctx.B,s->srp_ctx.N))) goto err; 388 if (s->srp_ctx.SRP_give_srp_client_pwd_callback == NULL) goto err; 389 if (!(passwd = s->srp_ctx.SRP_give_srp_client_pwd_callback(s, s->srp_ctx.SRP_cb_arg))) goto err; 390 if (!(x = SRP_Calc_x(s->srp_ctx.s,s->srp_ctx.login,passwd))) goto err; 391 if (!(K = SRP_Calc_client_key(s->srp_ctx.N, s->srp_ctx.B, s->srp_ctx.g, x, s->srp_ctx.a, u))) goto err; 392 393 tmp_len = BN_num_bytes(K); 394 if ((tmp = OPENSSL_malloc(tmp_len)) == NULL) goto err; 395 BN_bn2bin(K, tmp); 396 ret = s->method->ssl3_enc->generate_master_secret(s,master_key,tmp,tmp_len); 397 err: 398 if (tmp) 399 { 400 OPENSSL_cleanse(tmp,tmp_len) ; 401 OPENSSL_free(tmp); 402 } 403 BN_clear_free(K); 404 BN_clear_free(x); 405 if (passwd) 406 { 407 OPENSSL_cleanse(passwd,strlen(passwd)) ; 408 OPENSSL_free(passwd); 409 } 410 BN_clear_free(u); 411 return ret; 412 } 413 414 int SRP_Calc_A_param(SSL *s) 415 { 416 unsigned char rnd[SSL_MAX_MASTER_KEY_LENGTH]; 417 418 if (BN_num_bits(s->srp_ctx.N) < s->srp_ctx.strength) 419 return -1; 420 421 if (s->srp_ctx.SRP_verify_param_callback ==NULL && 422 !SRP_check_known_gN_param(s->srp_ctx.g,s->srp_ctx.N)) 423 return -1 ; 424 425 RAND_bytes(rnd, sizeof(rnd)); 426 s->srp_ctx.a = BN_bin2bn(rnd, sizeof(rnd), s->srp_ctx.a); 427 OPENSSL_cleanse(rnd, sizeof(rnd)); 428 429 if (!(s->srp_ctx.A = SRP_Calc_A(s->srp_ctx.a,s->srp_ctx.N,s->srp_ctx.g))) 430 return -1; 431 432 /* We can have a callback to verify SRP param!! */ 433 if (s->srp_ctx.SRP_verify_param_callback !=NULL) 434 return s->srp_ctx.SRP_verify_param_callback(s,s->srp_ctx.SRP_cb_arg); 435 436 return 1; 437 } 438 439 int SRP_have_to_put_srp_username(SSL *s) 440 { 441 if (s->srp_ctx.SRP_TLS_ext_missing_srp_client_username_callback == NULL) 442 return 0; 443 if ((s->srp_ctx.login = s->srp_ctx.SRP_TLS_ext_missing_srp_client_username_callback(s,s->srp_ctx.SRP_cb_arg)) == NULL) 444 return 0; 445 s->srp_ctx.srp_Mask|=SSL_kSRP; 446 return 1; 447 } 448 449 BIGNUM *SSL_get_srp_g(SSL *s) 450 { 451 if (s->srp_ctx.g != NULL) 452 return s->srp_ctx.g; 453 return s->ctx->srp_ctx.g; 454 } 455 456 BIGNUM *SSL_get_srp_N(SSL *s) 457 { 458 if (s->srp_ctx.N != NULL) 459 return s->srp_ctx.N; 460 return s->ctx->srp_ctx.N; 461 } 462 463 char *SSL_get_srp_username(SSL *s) 464 { 465 if (s->srp_ctx.login != NULL) 466 return s->srp_ctx.login; 467 return s->ctx->srp_ctx.login; 468 } 469 470 char *SSL_get_srp_userinfo(SSL *s) 471 { 472 if (s->srp_ctx.info != NULL) 473 return s->srp_ctx.info; 474 return s->ctx->srp_ctx.info; 475 } 476 477 #define tls1_ctx_ctrl ssl3_ctx_ctrl 478 #define tls1_ctx_callback_ctrl ssl3_ctx_callback_ctrl 479 480 int SSL_CTX_set_srp_username(SSL_CTX *ctx,char *name) 481 { 482 return tls1_ctx_ctrl(ctx,SSL_CTRL_SET_TLS_EXT_SRP_USERNAME,0,name); 483 } 484 485 int SSL_CTX_set_srp_password(SSL_CTX *ctx,char *password) 486 { 487 return tls1_ctx_ctrl(ctx,SSL_CTRL_SET_TLS_EXT_SRP_PASSWORD,0,password); 488 } 489 490 int SSL_CTX_set_srp_strength(SSL_CTX *ctx, int strength) 491 { 492 return tls1_ctx_ctrl(ctx, SSL_CTRL_SET_TLS_EXT_SRP_STRENGTH, strength, 493 NULL); 494 } 495 496 int SSL_CTX_set_srp_verify_param_callback(SSL_CTX *ctx, int (*cb)(SSL *,void *)) 497 { 498 return tls1_ctx_callback_ctrl(ctx,SSL_CTRL_SET_SRP_VERIFY_PARAM_CB, 499 (void (*)(void))cb); 500 } 501 502 int SSL_CTX_set_srp_cb_arg(SSL_CTX *ctx, void *arg) 503 { 504 return tls1_ctx_ctrl(ctx,SSL_CTRL_SET_SRP_ARG,0,arg); 505 } 506 507 int SSL_CTX_set_srp_username_callback(SSL_CTX *ctx, 508 int (*cb)(SSL *,int *,void *)) 509 { 510 return tls1_ctx_callback_ctrl(ctx,SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB, 511 (void (*)(void))cb); 512 } 513 514 int SSL_CTX_set_srp_client_pwd_callback(SSL_CTX *ctx, char *(*cb)(SSL *,void *)) 515 { 516 return tls1_ctx_callback_ctrl(ctx,SSL_CTRL_SET_SRP_GIVE_CLIENT_PWD_CB, 517 (void (*)(void))cb); 518 } 519 520 int SSL_CTX_set_srp_missing_srp_username_callback(SSL_CTX *ctx, 521 char *(*cb)(SSL *,void *)) 522 { 523 return tls1_ctx_callback_ctrl(ctx, 524 SSL_CTRL_SET_TLS_EXT_SRP_MISSING_CLIENT_USERNAME_CB, 525 (void (*)(void))cb); 526 } 527 #endif 528