ecdh_ossl.c 4.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147
  1. /*
  2. * Copyright 2002-2021 The OpenSSL Project Authors. All Rights Reserved.
  3. * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
  4. *
  5. * Licensed under the Apache License 2.0 (the "License"). You may not use
  6. * this file except in compliance with the License. You can obtain a copy
  7. * in the file LICENSE in the source distribution or at
  8. * https://www.openssl.org/source/license.html
  9. */
  10. /*
  11. * ECDH low level APIs are deprecated for public use, but still ok for
  12. * internal use.
  13. */
  14. #include "internal/deprecated.h"
  15. #include <string.h>
  16. #include <limits.h>
  17. #include "internal/cryptlib.h"
  18. #include <openssl/err.h>
  19. #include <openssl/bn.h>
  20. #include <openssl/objects.h>
  21. #include <openssl/ec.h>
  22. #include "ec_local.h"
  23. int ossl_ecdh_compute_key(unsigned char **psec, size_t *pseclen,
  24. const EC_POINT *pub_key, const EC_KEY *ecdh)
  25. {
  26. if (ecdh->group->meth->ecdh_compute_key == NULL) {
  27. ERR_raise(ERR_LIB_EC, EC_R_CURVE_DOES_NOT_SUPPORT_ECDH);
  28. return 0;
  29. }
  30. return ecdh->group->meth->ecdh_compute_key(psec, pseclen, pub_key, ecdh);
  31. }
  32. /*-
  33. * This implementation is based on the following primitives in the
  34. * IEEE 1363 standard:
  35. * - ECKAS-DH1
  36. * - ECSVDP-DH
  37. *
  38. * It also conforms to SP800-56A r3
  39. * See Section 5.7.1.2 "Elliptic Curve Cryptography Cofactor Diffie-Hellman
  40. * (ECC CDH) Primitive:". The steps listed below refer to SP800-56A.
  41. */
  42. int ossl_ecdh_simple_compute_key(unsigned char **pout, size_t *poutlen,
  43. const EC_POINT *pub_key, const EC_KEY *ecdh)
  44. {
  45. BN_CTX *ctx;
  46. EC_POINT *tmp = NULL;
  47. BIGNUM *x = NULL;
  48. const BIGNUM *priv_key;
  49. const EC_GROUP *group;
  50. int ret = 0;
  51. size_t buflen, len;
  52. unsigned char *buf = NULL;
  53. if ((ctx = BN_CTX_new_ex(ecdh->libctx)) == NULL)
  54. goto err;
  55. BN_CTX_start(ctx);
  56. x = BN_CTX_get(ctx);
  57. if (x == NULL) {
  58. ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB);
  59. goto err;
  60. }
  61. priv_key = EC_KEY_get0_private_key(ecdh);
  62. if (priv_key == NULL) {
  63. ERR_raise(ERR_LIB_EC, EC_R_MISSING_PRIVATE_KEY);
  64. goto err;
  65. }
  66. group = EC_KEY_get0_group(ecdh);
  67. /*
  68. * Step(1) - Compute the point tmp = cofactor * owners_private_key
  69. * * peer_public_key.
  70. */
  71. if (EC_KEY_get_flags(ecdh) & EC_FLAG_COFACTOR_ECDH) {
  72. if (!EC_GROUP_get_cofactor(group, x, NULL)) {
  73. ERR_raise(ERR_LIB_EC, ERR_R_EC_LIB);
  74. goto err;
  75. }
  76. if (!BN_mul(x, x, priv_key, ctx)) {
  77. ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB);
  78. goto err;
  79. }
  80. priv_key = x;
  81. }
  82. if ((tmp = EC_POINT_new(group)) == NULL) {
  83. ERR_raise(ERR_LIB_EC, ERR_R_EC_LIB);
  84. goto err;
  85. }
  86. if (!EC_POINT_mul(group, tmp, NULL, pub_key, priv_key, ctx)) {
  87. ERR_raise(ERR_LIB_EC, EC_R_POINT_ARITHMETIC_FAILURE);
  88. goto err;
  89. }
  90. /*
  91. * Step(2) : If point tmp is at infinity then clear intermediate values and
  92. * exit. Note: getting affine coordinates returns 0 if point is at infinity.
  93. * Step(3a) : Get x-coordinate of point x = tmp.x
  94. */
  95. if (!EC_POINT_get_affine_coordinates(group, tmp, x, NULL, ctx)) {
  96. ERR_raise(ERR_LIB_EC, EC_R_POINT_ARITHMETIC_FAILURE);
  97. goto err;
  98. }
  99. /*
  100. * Step(3b) : convert x to a byte string, using the field-element-to-byte
  101. * string conversion routine defined in Appendix C.2
  102. */
  103. buflen = (EC_GROUP_get_degree(group) + 7) / 8;
  104. len = BN_num_bytes(x);
  105. if (len > buflen) {
  106. ERR_raise(ERR_LIB_EC, ERR_R_INTERNAL_ERROR);
  107. goto err;
  108. }
  109. if ((buf = OPENSSL_malloc(buflen)) == NULL)
  110. goto err;
  111. memset(buf, 0, buflen - len);
  112. if (len != (size_t)BN_bn2bin(x, buf + buflen - len)) {
  113. ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB);
  114. goto err;
  115. }
  116. *pout = buf;
  117. *poutlen = buflen;
  118. buf = NULL;
  119. ret = 1;
  120. err:
  121. /* Step(4) : Destroy all intermediate calculations */
  122. BN_clear(x);
  123. EC_POINT_clear_free(tmp);
  124. BN_CTX_end(ctx);
  125. BN_CTX_free(ctx);
  126. OPENSSL_free(buf);
  127. return ret;
  128. }