1 /* $OpenBSD: ec_key.c,v 1.32 2023/03/27 10:25:02 tb Exp $ */ 2 /* 3 * Written by Nils Larsch for the OpenSSL project. 4 */ 5 /* ==================================================================== 6 * Copyright (c) 1998-2005 The OpenSSL Project. All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in 17 * the documentation and/or other materials provided with the 18 * distribution. 19 * 20 * 3. All advertising materials mentioning features or use of this 21 * software must display the following acknowledgment: 22 * "This product includes software developed by the OpenSSL Project 23 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" 24 * 25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 26 * endorse or promote products derived from this software without 27 * prior written permission. For written permission, please contact 28 * openssl-core@openssl.org. 29 * 30 * 5. Products derived from this software may not be called "OpenSSL" 31 * nor may "OpenSSL" appear in their names without prior written 32 * permission of the OpenSSL Project. 33 * 34 * 6. Redistributions of any form whatsoever must retain the following 35 * acknowledgment: 36 * "This product includes software developed by the OpenSSL Project 37 * for use in the OpenSSL Toolkit (http://www.openssl.org/)" 38 * 39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 50 * OF THE POSSIBILITY OF SUCH DAMAGE. 51 * ==================================================================== 52 * 53 * This product includes cryptographic software written by Eric Young 54 * (eay@cryptsoft.com). This product includes software written by Tim 55 * Hudson (tjh@cryptsoft.com). 56 * 57 */ 58 /* ==================================================================== 59 * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED. 60 * Portions originally developed by SUN MICROSYSTEMS, INC., and 61 * contributed to the OpenSSL project. 62 */ 63 64 #include <string.h> 65 66 #include <openssl/opensslconf.h> 67 68 #ifndef OPENSSL_NO_ENGINE 69 #include <openssl/engine.h> 70 #endif 71 #include <openssl/err.h> 72 73 #include "bn_local.h" 74 #include "ec_local.h" 75 76 EC_KEY * 77 EC_KEY_new(void) 78 { 79 return EC_KEY_new_method(NULL); 80 } 81 82 EC_KEY * 83 EC_KEY_new_by_curve_name(int nid) 84 { 85 EC_KEY *ret = EC_KEY_new(); 86 if (ret == NULL) 87 return NULL; 88 ret->group = EC_GROUP_new_by_curve_name(nid); 89 if (ret->group == NULL) { 90 EC_KEY_free(ret); 91 return NULL; 92 } 93 if (ret->meth->set_group != NULL && 94 ret->meth->set_group(ret, ret->group) == 0) { 95 EC_KEY_free(ret); 96 return NULL; 97 } 98 return ret; 99 } 100 101 void 102 EC_KEY_free(EC_KEY *r) 103 { 104 int i; 105 106 if (r == NULL) 107 return; 108 109 i = CRYPTO_add(&r->references, -1, CRYPTO_LOCK_EC); 110 if (i > 0) 111 return; 112 113 if (r->meth != NULL && r->meth->finish != NULL) 114 r->meth->finish(r); 115 116 #ifndef OPENSSL_NO_ENGINE 117 ENGINE_finish(r->engine); 118 #endif 119 CRYPTO_free_ex_data(CRYPTO_EX_INDEX_EC_KEY, r, &r->ex_data); 120 121 EC_GROUP_free(r->group); 122 EC_POINT_free(r->pub_key); 123 BN_free(r->priv_key); 124 125 EC_EX_DATA_free_all_data(&r->method_data); 126 127 freezero(r, sizeof(EC_KEY)); 128 } 129 130 EC_KEY * 131 EC_KEY_copy(EC_KEY *dest, const EC_KEY *src) 132 { 133 EC_EXTRA_DATA *d; 134 135 if (dest == NULL || src == NULL) { 136 ECerror(ERR_R_PASSED_NULL_PARAMETER); 137 return NULL; 138 } 139 if (src->meth != dest->meth) { 140 if (dest->meth != NULL && dest->meth->finish != NULL) 141 dest->meth->finish(dest); 142 #ifndef OPENSSL_NO_ENGINE 143 if (ENGINE_finish(dest->engine) == 0) 144 return 0; 145 dest->engine = NULL; 146 #endif 147 } 148 /* copy the parameters */ 149 if (src->group) { 150 const EC_METHOD *meth = EC_GROUP_method_of(src->group); 151 /* clear the old group */ 152 EC_GROUP_free(dest->group); 153 dest->group = EC_GROUP_new(meth); 154 if (dest->group == NULL) 155 return NULL; 156 if (!EC_GROUP_copy(dest->group, src->group)) 157 return NULL; 158 } 159 /* copy the public key */ 160 if (src->pub_key && src->group) { 161 EC_POINT_free(dest->pub_key); 162 dest->pub_key = EC_POINT_new(src->group); 163 if (dest->pub_key == NULL) 164 return NULL; 165 if (!EC_POINT_copy(dest->pub_key, src->pub_key)) 166 return NULL; 167 } 168 /* copy the private key */ 169 if (src->priv_key) { 170 if (dest->priv_key == NULL) { 171 dest->priv_key = BN_new(); 172 if (dest->priv_key == NULL) 173 return NULL; 174 } 175 if (!bn_copy(dest->priv_key, src->priv_key)) 176 return NULL; 177 } 178 /* copy method/extra data */ 179 EC_EX_DATA_free_all_data(&dest->method_data); 180 181 for (d = src->method_data; d != NULL; d = d->next) { 182 void *t = d->dup_func(d->data); 183 184 if (t == NULL) 185 return 0; 186 if (!EC_EX_DATA_set_data(&dest->method_data, t, d->dup_func, 187 d->free_func, d->clear_free_func)) 188 return 0; 189 } 190 191 /* copy the rest */ 192 dest->enc_flag = src->enc_flag; 193 dest->conv_form = src->conv_form; 194 dest->version = src->version; 195 dest->flags = src->flags; 196 197 if (!CRYPTO_dup_ex_data(CRYPTO_EX_INDEX_EC_KEY, &dest->ex_data, 198 &((EC_KEY *)src)->ex_data)) /* XXX const */ 199 return NULL; 200 201 if (src->meth != dest->meth) { 202 #ifndef OPENSSL_NO_ENGINE 203 if (src->engine != NULL && ENGINE_init(src->engine) == 0) 204 return 0; 205 dest->engine = src->engine; 206 #endif 207 dest->meth = src->meth; 208 } 209 210 if (src->meth != NULL && src->meth->copy != NULL && 211 src->meth->copy(dest, src) == 0) 212 return 0; 213 214 return dest; 215 } 216 217 EC_KEY * 218 EC_KEY_dup(const EC_KEY *ec_key) 219 { 220 EC_KEY *ret; 221 222 if ((ret = EC_KEY_new_method(ec_key->engine)) == NULL) 223 return NULL; 224 if (EC_KEY_copy(ret, ec_key) == NULL) { 225 EC_KEY_free(ret); 226 return NULL; 227 } 228 return ret; 229 } 230 231 int 232 EC_KEY_up_ref(EC_KEY *r) 233 { 234 int i = CRYPTO_add(&r->references, 1, CRYPTO_LOCK_EC); 235 return ((i > 1) ? 1 : 0); 236 } 237 238 int 239 EC_KEY_set_ex_data(EC_KEY *r, int idx, void *arg) 240 { 241 return CRYPTO_set_ex_data(&r->ex_data, idx, arg); 242 } 243 244 void * 245 EC_KEY_get_ex_data(const EC_KEY *r, int idx) 246 { 247 return CRYPTO_get_ex_data(&r->ex_data, idx); 248 } 249 250 int 251 EC_KEY_generate_key(EC_KEY *eckey) 252 { 253 if (eckey->meth->keygen != NULL) 254 return eckey->meth->keygen(eckey); 255 ECerror(EC_R_NOT_IMPLEMENTED); 256 return 0; 257 } 258 259 int 260 ossl_ec_key_gen(EC_KEY *eckey) 261 { 262 BN_CTX *ctx = NULL; 263 BIGNUM *priv_key = NULL; 264 EC_POINT *pub_key = NULL; 265 BIGNUM *order; 266 int ret = 0; 267 268 if (eckey == NULL || eckey->group == NULL) { 269 ECerror(ERR_R_PASSED_NULL_PARAMETER); 270 goto err; 271 } 272 273 if ((priv_key = BN_new()) == NULL) 274 goto err; 275 if ((pub_key = EC_POINT_new(eckey->group)) == NULL) 276 goto err; 277 278 if ((ctx = BN_CTX_new()) == NULL) 279 goto err; 280 281 BN_CTX_start(ctx); 282 283 if ((order = BN_CTX_get(ctx)) == NULL) 284 goto err; 285 286 if (!EC_GROUP_get_order(eckey->group, order, ctx)) 287 goto err; 288 if (!bn_rand_interval(priv_key, BN_value_one(), order)) 289 goto err; 290 if (!EC_POINT_mul(eckey->group, pub_key, priv_key, NULL, NULL, ctx)) 291 goto err; 292 293 BN_free(eckey->priv_key); 294 eckey->priv_key = priv_key; 295 priv_key = NULL; 296 297 EC_POINT_free(eckey->pub_key); 298 eckey->pub_key = pub_key; 299 pub_key = NULL; 300 301 ret = 1; 302 303 err: 304 EC_POINT_free(pub_key); 305 BN_free(priv_key); 306 BN_CTX_end(ctx); 307 BN_CTX_free(ctx); 308 309 return ret; 310 } 311 312 int 313 EC_KEY_check_key(const EC_KEY *eckey) 314 { 315 BN_CTX *ctx = NULL; 316 EC_POINT *point = NULL; 317 BIGNUM *order; 318 int ret = 0; 319 320 if (eckey == NULL || eckey->group == NULL || eckey->pub_key == NULL) { 321 ECerror(ERR_R_PASSED_NULL_PARAMETER); 322 goto err; 323 } 324 325 if (EC_POINT_is_at_infinity(eckey->group, eckey->pub_key) > 0) { 326 ECerror(EC_R_POINT_AT_INFINITY); 327 goto err; 328 } 329 330 if ((ctx = BN_CTX_new()) == NULL) 331 goto err; 332 333 BN_CTX_start(ctx); 334 335 if ((order = BN_CTX_get(ctx)) == NULL) 336 goto err; 337 338 if ((point = EC_POINT_new(eckey->group)) == NULL) 339 goto err; 340 341 /* Ensure public key is on the elliptic curve. */ 342 if (EC_POINT_is_on_curve(eckey->group, eckey->pub_key, ctx) <= 0) { 343 ECerror(EC_R_POINT_IS_NOT_ON_CURVE); 344 goto err; 345 } 346 347 /* Ensure public key multiplied by the order is the point at infinity. */ 348 if (!EC_GROUP_get_order(eckey->group, order, ctx)) { 349 ECerror(EC_R_INVALID_GROUP_ORDER); 350 goto err; 351 } 352 if (!EC_POINT_mul(eckey->group, point, NULL, eckey->pub_key, order, ctx)) { 353 ECerror(ERR_R_EC_LIB); 354 goto err; 355 } 356 if (EC_POINT_is_at_infinity(eckey->group, point) <= 0) { 357 ECerror(EC_R_WRONG_ORDER); 358 goto err; 359 } 360 361 /* 362 * If the private key is present, ensure that the private key multiplied 363 * by the generator matches the public key. 364 */ 365 if (eckey->priv_key != NULL) { 366 if (BN_cmp(eckey->priv_key, order) >= 0) { 367 ECerror(EC_R_WRONG_ORDER); 368 goto err; 369 } 370 if (!EC_POINT_mul(eckey->group, point, eckey->priv_key, NULL, 371 NULL, ctx)) { 372 ECerror(ERR_R_EC_LIB); 373 goto err; 374 } 375 if (EC_POINT_cmp(eckey->group, point, eckey->pub_key, 376 ctx) != 0) { 377 ECerror(EC_R_INVALID_PRIVATE_KEY); 378 goto err; 379 } 380 } 381 382 ret = 1; 383 384 err: 385 BN_CTX_end(ctx); 386 BN_CTX_free(ctx); 387 EC_POINT_free(point); 388 389 return ret; 390 } 391 392 int 393 EC_KEY_set_public_key_affine_coordinates(EC_KEY *key, BIGNUM *x, BIGNUM *y) 394 { 395 BN_CTX *ctx = NULL; 396 EC_POINT *point = NULL; 397 BIGNUM *tx, *ty; 398 int ret = 0; 399 400 if (key == NULL || key->group == NULL || x == NULL || y == NULL) { 401 ECerror(ERR_R_PASSED_NULL_PARAMETER); 402 goto err; 403 } 404 405 if ((ctx = BN_CTX_new()) == NULL) 406 goto err; 407 408 BN_CTX_start(ctx); 409 410 if ((tx = BN_CTX_get(ctx)) == NULL) 411 goto err; 412 if ((ty = BN_CTX_get(ctx)) == NULL) 413 goto err; 414 415 if ((point = EC_POINT_new(key->group)) == NULL) 416 goto err; 417 418 if (!EC_POINT_set_affine_coordinates(key->group, point, x, y, ctx)) 419 goto err; 420 if (!EC_POINT_get_affine_coordinates(key->group, point, tx, ty, ctx)) 421 goto err; 422 423 /* 424 * Check if retrieved coordinates match originals: if not values are 425 * out of range. 426 */ 427 if (BN_cmp(x, tx) != 0 || BN_cmp(y, ty) != 0) { 428 ECerror(EC_R_COORDINATES_OUT_OF_RANGE); 429 goto err; 430 } 431 if (!EC_KEY_set_public_key(key, point)) 432 goto err; 433 if (EC_KEY_check_key(key) == 0) 434 goto err; 435 436 ret = 1; 437 438 err: 439 BN_CTX_end(ctx); 440 BN_CTX_free(ctx); 441 EC_POINT_free(point); 442 443 return ret; 444 } 445 446 const EC_GROUP * 447 EC_KEY_get0_group(const EC_KEY *key) 448 { 449 return key->group; 450 } 451 452 int 453 EC_KEY_set_group(EC_KEY *key, const EC_GROUP *group) 454 { 455 if (key->meth->set_group != NULL && 456 key->meth->set_group(key, group) == 0) 457 return 0; 458 EC_GROUP_free(key->group); 459 key->group = EC_GROUP_dup(group); 460 return (key->group == NULL) ? 0 : 1; 461 } 462 463 const BIGNUM * 464 EC_KEY_get0_private_key(const EC_KEY *key) 465 { 466 return key->priv_key; 467 } 468 469 int 470 EC_KEY_set_private_key(EC_KEY *key, const BIGNUM *priv_key) 471 { 472 if (key->meth->set_private != NULL && 473 key->meth->set_private(key, priv_key) == 0) 474 return 0; 475 476 BN_free(key->priv_key); 477 if ((key->priv_key = BN_dup(priv_key)) == NULL) 478 return 0; 479 480 return 1; 481 } 482 483 const EC_POINT * 484 EC_KEY_get0_public_key(const EC_KEY *key) 485 { 486 return key->pub_key; 487 } 488 489 int 490 EC_KEY_set_public_key(EC_KEY *key, const EC_POINT *pub_key) 491 { 492 if (key->meth->set_public != NULL && 493 key->meth->set_public(key, pub_key) == 0) 494 return 0; 495 496 EC_POINT_free(key->pub_key); 497 if ((key->pub_key = EC_POINT_dup(pub_key, key->group)) == NULL) 498 return 0; 499 500 return 1; 501 } 502 503 unsigned int 504 EC_KEY_get_enc_flags(const EC_KEY *key) 505 { 506 return key->enc_flag; 507 } 508 509 void 510 EC_KEY_set_enc_flags(EC_KEY *key, unsigned int flags) 511 { 512 key->enc_flag = flags; 513 } 514 515 point_conversion_form_t 516 EC_KEY_get_conv_form(const EC_KEY *key) 517 { 518 return key->conv_form; 519 } 520 521 void 522 EC_KEY_set_conv_form(EC_KEY *key, point_conversion_form_t cform) 523 { 524 key->conv_form = cform; 525 if (key->group != NULL) 526 EC_GROUP_set_point_conversion_form(key->group, cform); 527 } 528 529 void * 530 EC_KEY_get_key_method_data(EC_KEY *key, 531 void *(*dup_func) (void *), 532 void (*free_func) (void *), 533 void (*clear_free_func) (void *)) 534 { 535 void *ret; 536 537 CRYPTO_r_lock(CRYPTO_LOCK_EC); 538 ret = EC_EX_DATA_get_data(key->method_data, dup_func, free_func, clear_free_func); 539 CRYPTO_r_unlock(CRYPTO_LOCK_EC); 540 541 return ret; 542 } 543 544 void * 545 EC_KEY_insert_key_method_data(EC_KEY *key, void *data, 546 void *(*dup_func) (void *), 547 void (*free_func) (void *), 548 void (*clear_free_func) (void *)) 549 { 550 EC_EXTRA_DATA *ex_data; 551 552 CRYPTO_w_lock(CRYPTO_LOCK_EC); 553 ex_data = EC_EX_DATA_get_data(key->method_data, dup_func, free_func, clear_free_func); 554 if (ex_data == NULL) 555 EC_EX_DATA_set_data(&key->method_data, data, dup_func, free_func, clear_free_func); 556 CRYPTO_w_unlock(CRYPTO_LOCK_EC); 557 558 return ex_data; 559 } 560 561 void 562 EC_KEY_set_asn1_flag(EC_KEY *key, int flag) 563 { 564 if (key->group != NULL) 565 EC_GROUP_set_asn1_flag(key->group, flag); 566 } 567 568 int 569 EC_KEY_precompute_mult(EC_KEY *key, BN_CTX *ctx) 570 { 571 if (key->group == NULL) 572 return 0; 573 return EC_GROUP_precompute_mult(key->group, ctx); 574 } 575 576 int 577 EC_KEY_get_flags(const EC_KEY *key) 578 { 579 return key->flags; 580 } 581 582 void 583 EC_KEY_set_flags(EC_KEY *key, int flags) 584 { 585 key->flags |= flags; 586 } 587 588 void 589 EC_KEY_clear_flags(EC_KEY *key, int flags) 590 { 591 key->flags &= ~flags; 592 } 593