123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482 |
- /* Copyright (c) 2015, Google Inc.
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
- #include <openssl/ssl.h>
- #include <assert.h>
- #include <string.h>
- #include <utility>
- #include <openssl/bn.h>
- #include <openssl/bytestring.h>
- #include <openssl/curve25519.h>
- #include <openssl/ec.h>
- #include <openssl/err.h>
- #include <openssl/hrss.h>
- #include <openssl/mem.h>
- #include <openssl/nid.h>
- #include <openssl/rand.h>
- #include "internal.h"
- #include "../crypto/internal.h"
- #include "../third_party/sike/sike.h"
- BSSL_NAMESPACE_BEGIN
- namespace {
- class ECKeyShare : public SSLKeyShare {
- public:
- ECKeyShare(int nid, uint16_t group_id) : nid_(nid), group_id_(group_id) {}
- uint16_t GroupID() const override { return group_id_; }
- bool Offer(CBB *out) override {
- assert(!private_key_);
- // Set up a shared |BN_CTX| for all operations.
- UniquePtr<BN_CTX> bn_ctx(BN_CTX_new());
- if (!bn_ctx) {
- return false;
- }
- BN_CTXScope scope(bn_ctx.get());
- // Generate a private key.
- UniquePtr<EC_GROUP> group(EC_GROUP_new_by_curve_name(nid_));
- private_key_.reset(BN_new());
- if (!group || !private_key_ ||
- !BN_rand_range_ex(private_key_.get(), 1,
- EC_GROUP_get0_order(group.get()))) {
- return false;
- }
- // Compute the corresponding public key and serialize it.
- UniquePtr<EC_POINT> public_key(EC_POINT_new(group.get()));
- if (!public_key ||
- !EC_POINT_mul(group.get(), public_key.get(), private_key_.get(), NULL,
- NULL, bn_ctx.get()) ||
- !EC_POINT_point2cbb(out, group.get(), public_key.get(),
- POINT_CONVERSION_UNCOMPRESSED, bn_ctx.get())) {
- return false;
- }
- return true;
- }
- bool Finish(Array<uint8_t> *out_secret, uint8_t *out_alert,
- Span<const uint8_t> peer_key) override {
- assert(private_key_);
- *out_alert = SSL_AD_INTERNAL_ERROR;
- // Set up a shared |BN_CTX| for all operations.
- UniquePtr<BN_CTX> bn_ctx(BN_CTX_new());
- if (!bn_ctx) {
- return false;
- }
- BN_CTXScope scope(bn_ctx.get());
- UniquePtr<EC_GROUP> group(EC_GROUP_new_by_curve_name(nid_));
- if (!group) {
- return false;
- }
- UniquePtr<EC_POINT> peer_point(EC_POINT_new(group.get()));
- UniquePtr<EC_POINT> result(EC_POINT_new(group.get()));
- BIGNUM *x = BN_CTX_get(bn_ctx.get());
- if (!peer_point || !result || !x) {
- return false;
- }
- if (peer_key.empty() || peer_key[0] != POINT_CONVERSION_UNCOMPRESSED ||
- !EC_POINT_oct2point(group.get(), peer_point.get(), peer_key.data(),
- peer_key.size(), bn_ctx.get())) {
- OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_ECPOINT);
- *out_alert = SSL_AD_DECODE_ERROR;
- return false;
- }
- // Compute the x-coordinate of |peer_key| * |private_key_|.
- if (!EC_POINT_mul(group.get(), result.get(), NULL, peer_point.get(),
- private_key_.get(), bn_ctx.get()) ||
- !EC_POINT_get_affine_coordinates_GFp(group.get(), result.get(), x, NULL,
- bn_ctx.get())) {
- return false;
- }
- // Encode the x-coordinate left-padded with zeros.
- Array<uint8_t> secret;
- if (!secret.Init((EC_GROUP_get_degree(group.get()) + 7) / 8) ||
- !BN_bn2bin_padded(secret.data(), secret.size(), x)) {
- return false;
- }
- *out_secret = std::move(secret);
- return true;
- }
- bool Serialize(CBB *out) override {
- assert(private_key_);
- CBB cbb;
- UniquePtr<EC_GROUP> group(EC_GROUP_new_by_curve_name(nid_));
- // Padding is added to avoid leaking the length.
- size_t len = BN_num_bytes(EC_GROUP_get0_order(group.get()));
- if (!CBB_add_asn1_uint64(out, group_id_) ||
- !CBB_add_asn1(out, &cbb, CBS_ASN1_OCTETSTRING) ||
- !BN_bn2cbb_padded(&cbb, len, private_key_.get()) ||
- !CBB_flush(out)) {
- return false;
- }
- return true;
- }
- bool Deserialize(CBS *in) override {
- assert(!private_key_);
- CBS private_key;
- if (!CBS_get_asn1(in, &private_key, CBS_ASN1_OCTETSTRING)) {
- return false;
- }
- private_key_.reset(BN_bin2bn(CBS_data(&private_key),
- CBS_len(&private_key), nullptr));
- return private_key_ != nullptr;
- }
- private:
- UniquePtr<BIGNUM> private_key_;
- int nid_;
- uint16_t group_id_;
- };
- class X25519KeyShare : public SSLKeyShare {
- public:
- X25519KeyShare() {}
- uint16_t GroupID() const override { return SSL_CURVE_X25519; }
- bool Offer(CBB *out) override {
- uint8_t public_key[32];
- X25519_keypair(public_key, private_key_);
- return !!CBB_add_bytes(out, public_key, sizeof(public_key));
- }
- bool Finish(Array<uint8_t> *out_secret, uint8_t *out_alert,
- Span<const uint8_t> peer_key) override {
- *out_alert = SSL_AD_INTERNAL_ERROR;
- Array<uint8_t> secret;
- if (!secret.Init(32)) {
- OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
- return false;
- }
- if (peer_key.size() != 32 ||
- !X25519(secret.data(), private_key_, peer_key.data())) {
- *out_alert = SSL_AD_DECODE_ERROR;
- OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_ECPOINT);
- return false;
- }
- *out_secret = std::move(secret);
- return true;
- }
- bool Serialize(CBB *out) override {
- return (CBB_add_asn1_uint64(out, GroupID()) &&
- CBB_add_asn1_octet_string(out, private_key_, sizeof(private_key_)));
- }
- bool Deserialize(CBS *in) override {
- CBS key;
- if (!CBS_get_asn1(in, &key, CBS_ASN1_OCTETSTRING) ||
- CBS_len(&key) != sizeof(private_key_) ||
- !CBS_copy_bytes(&key, private_key_, sizeof(private_key_))) {
- return false;
- }
- return true;
- }
- private:
- uint8_t private_key_[32];
- };
- class CECPQ2KeyShare : public SSLKeyShare {
- public:
- CECPQ2KeyShare() {}
- uint16_t GroupID() const override { return SSL_CURVE_CECPQ2; }
- bool Offer(CBB *out) override {
- uint8_t x25519_public_key[32];
- X25519_keypair(x25519_public_key, x25519_private_key_);
- uint8_t hrss_entropy[HRSS_GENERATE_KEY_BYTES];
- HRSS_public_key hrss_public_key;
- RAND_bytes(hrss_entropy, sizeof(hrss_entropy));
- HRSS_generate_key(&hrss_public_key, &hrss_private_key_, hrss_entropy);
- uint8_t hrss_public_key_bytes[HRSS_PUBLIC_KEY_BYTES];
- HRSS_marshal_public_key(hrss_public_key_bytes, &hrss_public_key);
- if (!CBB_add_bytes(out, x25519_public_key, sizeof(x25519_public_key)) ||
- !CBB_add_bytes(out, hrss_public_key_bytes,
- sizeof(hrss_public_key_bytes))) {
- return false;
- }
- return true;
- }
- bool Accept(CBB *out_public_key, Array<uint8_t> *out_secret,
- uint8_t *out_alert, Span<const uint8_t> peer_key) override {
- Array<uint8_t> secret;
- if (!secret.Init(32 + HRSS_KEY_BYTES)) {
- OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
- return false;
- }
- uint8_t x25519_public_key[32];
- X25519_keypair(x25519_public_key, x25519_private_key_);
- HRSS_public_key peer_public_key;
- if (peer_key.size() != 32 + HRSS_PUBLIC_KEY_BYTES ||
- !HRSS_parse_public_key(&peer_public_key, peer_key.data() + 32) ||
- !X25519(secret.data(), x25519_private_key_, peer_key.data())) {
- *out_alert = SSL_AD_DECODE_ERROR;
- OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_ECPOINT);
- return false;
- }
- uint8_t ciphertext[HRSS_CIPHERTEXT_BYTES];
- uint8_t entropy[HRSS_ENCAP_BYTES];
- RAND_bytes(entropy, sizeof(entropy));
- HRSS_encap(ciphertext, secret.data() + 32, &peer_public_key, entropy);
- if (!CBB_add_bytes(out_public_key, x25519_public_key,
- sizeof(x25519_public_key)) ||
- !CBB_add_bytes(out_public_key, ciphertext, sizeof(ciphertext))) {
- return false;
- }
- *out_secret = std::move(secret);
- return true;
- }
- bool Finish(Array<uint8_t> *out_secret, uint8_t *out_alert,
- Span<const uint8_t> peer_key) override {
- *out_alert = SSL_AD_INTERNAL_ERROR;
- Array<uint8_t> secret;
- if (!secret.Init(32 + HRSS_KEY_BYTES)) {
- OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
- return false;
- }
- if (peer_key.size() != 32 + HRSS_CIPHERTEXT_BYTES ||
- !X25519(secret.data(), x25519_private_key_, peer_key.data())) {
- *out_alert = SSL_AD_DECODE_ERROR;
- OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_ECPOINT);
- return false;
- }
- HRSS_decap(secret.data() + 32, &hrss_private_key_, peer_key.data() + 32,
- peer_key.size() - 32);
- *out_secret = std::move(secret);
- return true;
- }
- private:
- uint8_t x25519_private_key_[32];
- HRSS_private_key hrss_private_key_;
- };
- class CECPQ2bKeyShare : public SSLKeyShare {
- public:
- uint16_t GroupID() const override { return SSL_CURVE_CECPQ2b; }
- bool Offer(CBB *out) override {
- uint8_t public_x25519[32] = {0};
- X25519_keypair(public_x25519, private_x25519_);
- if (!SIKE_keypair(private_sike_, public_sike_)) {
- return false;
- }
- return CBB_add_bytes(out, public_x25519, sizeof(public_x25519)) &&
- CBB_add_bytes(out, public_sike_, sizeof(public_sike_));
- }
- bool Accept(CBB *out_public_key, Array<uint8_t> *out_secret,
- uint8_t *out_alert, Span<const uint8_t> peer_key) override {
- uint8_t public_x25519[32];
- uint8_t private_x25519[32];
- uint8_t sike_ciphertext[SIKE_CT_BYTESZ] = {0};
- *out_alert = SSL_AD_INTERNAL_ERROR;
- if (peer_key.size() != sizeof(public_x25519) + SIKE_PUB_BYTESZ) {
- *out_alert = SSL_AD_DECODE_ERROR;
- OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_ECPOINT);
- return false;
- }
- Array<uint8_t> secret;
- if (!secret.Init(sizeof(private_x25519_) + SIKE_SS_BYTESZ)) {
- OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
- return false;
- }
- X25519_keypair(public_x25519, private_x25519);
- if (!X25519(secret.data(), private_x25519, peer_key.data())) {
- *out_alert = SSL_AD_DECODE_ERROR;
- OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_ECPOINT);
- return false;
- }
- SIKE_encaps(secret.data() + sizeof(private_x25519_), sike_ciphertext,
- peer_key.data() + sizeof(public_x25519));
- *out_secret = std::move(secret);
- return CBB_add_bytes(out_public_key, public_x25519,
- sizeof(public_x25519)) &&
- CBB_add_bytes(out_public_key, sike_ciphertext,
- sizeof(sike_ciphertext));
- }
- bool Finish(Array<uint8_t> *out_secret, uint8_t *out_alert,
- Span<const uint8_t> peer_key) override {
- *out_alert = SSL_AD_INTERNAL_ERROR;
- Array<uint8_t> secret;
- if (!secret.Init(sizeof(private_x25519_) + SIKE_SS_BYTESZ)) {
- OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
- return false;
- }
- if (peer_key.size() != 32 + SIKE_CT_BYTESZ ||
- !X25519(secret.data(), private_x25519_, peer_key.data())) {
- *out_alert = SSL_AD_DECODE_ERROR;
- OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_ECPOINT);
- return false;
- }
- SIKE_decaps(secret.data() + sizeof(private_x25519_), peer_key.data() + 32,
- public_sike_, private_sike_);
- *out_secret = std::move(secret);
- return true;
- }
- private:
- uint8_t private_x25519_[32];
- uint8_t private_sike_[SIKE_PRV_BYTESZ];
- uint8_t public_sike_[SIKE_PUB_BYTESZ];
- };
- CONSTEXPR_ARRAY NamedGroup kNamedGroups[] = {
- {NID_secp224r1, SSL_CURVE_SECP224R1, "P-224", "secp224r1"},
- {NID_X9_62_prime256v1, SSL_CURVE_SECP256R1, "P-256", "prime256v1"},
- {NID_secp384r1, SSL_CURVE_SECP384R1, "P-384", "secp384r1"},
- {NID_secp521r1, SSL_CURVE_SECP521R1, "P-521", "secp521r1"},
- {NID_X25519, SSL_CURVE_X25519, "X25519", "x25519"},
- {NID_CECPQ2, SSL_CURVE_CECPQ2, "CECPQ2", "CECPQ2"},
- {NID_CECPQ2b, SSL_CURVE_CECPQ2b, "CECPQ2b", "CECPQ2b"},
- };
- } // namespace
- Span<const NamedGroup> NamedGroups() {
- return MakeConstSpan(kNamedGroups, OPENSSL_ARRAY_SIZE(kNamedGroups));
- }
- UniquePtr<SSLKeyShare> SSLKeyShare::Create(uint16_t group_id) {
- switch (group_id) {
- case SSL_CURVE_SECP224R1:
- return UniquePtr<SSLKeyShare>(
- New<ECKeyShare>(NID_secp224r1, SSL_CURVE_SECP224R1));
- case SSL_CURVE_SECP256R1:
- return UniquePtr<SSLKeyShare>(
- New<ECKeyShare>(NID_X9_62_prime256v1, SSL_CURVE_SECP256R1));
- case SSL_CURVE_SECP384R1:
- return UniquePtr<SSLKeyShare>(
- New<ECKeyShare>(NID_secp384r1, SSL_CURVE_SECP384R1));
- case SSL_CURVE_SECP521R1:
- return UniquePtr<SSLKeyShare>(
- New<ECKeyShare>(NID_secp521r1, SSL_CURVE_SECP521R1));
- case SSL_CURVE_X25519:
- return UniquePtr<SSLKeyShare>(New<X25519KeyShare>());
- case SSL_CURVE_CECPQ2:
- return UniquePtr<SSLKeyShare>(New<CECPQ2KeyShare>());
- case SSL_CURVE_CECPQ2b:
- return UniquePtr<SSLKeyShare>(New<CECPQ2bKeyShare>());
- default:
- return nullptr;
- }
- }
- UniquePtr<SSLKeyShare> SSLKeyShare::Create(CBS *in) {
- uint64_t group;
- if (!CBS_get_asn1_uint64(in, &group) || group > 0xffff) {
- return nullptr;
- }
- UniquePtr<SSLKeyShare> key_share = Create(static_cast<uint16_t>(group));
- if (!key_share || !key_share->Deserialize(in)) {
- return nullptr;
- }
- return key_share;
- }
- bool SSLKeyShare::Accept(CBB *out_public_key, Array<uint8_t> *out_secret,
- uint8_t *out_alert, Span<const uint8_t> peer_key) {
- *out_alert = SSL_AD_INTERNAL_ERROR;
- return Offer(out_public_key) &&
- Finish(out_secret, out_alert, peer_key);
- }
- bool ssl_nid_to_group_id(uint16_t *out_group_id, int nid) {
- for (const auto &group : kNamedGroups) {
- if (group.nid == nid) {
- *out_group_id = group.group_id;
- return true;
- }
- }
- return false;
- }
- bool ssl_name_to_group_id(uint16_t *out_group_id, const char *name, size_t len) {
- for (const auto &group : kNamedGroups) {
- if (len == strlen(group.name) &&
- !strncmp(group.name, name, len)) {
- *out_group_id = group.group_id;
- return true;
- }
- if (len == strlen(group.alias) &&
- !strncmp(group.alias, name, len)) {
- *out_group_id = group.group_id;
- return true;
- }
- }
- return false;
- }
- BSSL_NAMESPACE_END
- using namespace bssl;
- const char* SSL_get_curve_name(uint16_t group_id) {
- for (const auto &group : kNamedGroups) {
- if (group.group_id == group_id) {
- return group.name;
- }
- }
- return nullptr;
- }
|