sm2_crypt.c 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404
  1. /*
  2. * Copyright 2017-2021 The OpenSSL Project Authors. All Rights Reserved.
  3. * Copyright 2017 Ribose Inc. All Rights Reserved.
  4. * Ported from Ribose contributions from Botan.
  5. *
  6. * Licensed under the Apache License 2.0 (the "License"). You may not use
  7. * this file except in compliance with the License. You can obtain a copy
  8. * in the file LICENSE in the source distribution or at
  9. * https://www.openssl.org/source/license.html
  10. */
  11. /*
  12. * ECDSA low level APIs are deprecated for public use, but still ok for
  13. * internal use.
  14. */
  15. #include "internal/deprecated.h"
  16. #include "crypto/sm2.h"
  17. #include "crypto/sm2err.h"
  18. #include "crypto/ec.h" /* ossl_ecdh_kdf_X9_63() */
  19. #include <openssl/err.h>
  20. #include <openssl/evp.h>
  21. #include <openssl/bn.h>
  22. #include <openssl/asn1.h>
  23. #include <openssl/asn1t.h>
  24. #include <string.h>
  25. typedef struct SM2_Ciphertext_st SM2_Ciphertext;
  26. DECLARE_ASN1_FUNCTIONS(SM2_Ciphertext)
  27. struct SM2_Ciphertext_st {
  28. BIGNUM *C1x;
  29. BIGNUM *C1y;
  30. ASN1_OCTET_STRING *C3;
  31. ASN1_OCTET_STRING *C2;
  32. };
  33. ASN1_SEQUENCE(SM2_Ciphertext) = {
  34. ASN1_SIMPLE(SM2_Ciphertext, C1x, BIGNUM),
  35. ASN1_SIMPLE(SM2_Ciphertext, C1y, BIGNUM),
  36. ASN1_SIMPLE(SM2_Ciphertext, C3, ASN1_OCTET_STRING),
  37. ASN1_SIMPLE(SM2_Ciphertext, C2, ASN1_OCTET_STRING),
  38. } ASN1_SEQUENCE_END(SM2_Ciphertext)
  39. IMPLEMENT_ASN1_FUNCTIONS(SM2_Ciphertext)
  40. static size_t ec_field_size(const EC_GROUP *group)
  41. {
  42. /* Is there some simpler way to do this? */
  43. BIGNUM *p = BN_new();
  44. BIGNUM *a = BN_new();
  45. BIGNUM *b = BN_new();
  46. size_t field_size = 0;
  47. if (p == NULL || a == NULL || b == NULL)
  48. goto done;
  49. if (!EC_GROUP_get_curve(group, p, a, b, NULL))
  50. goto done;
  51. field_size = (BN_num_bits(p) + 7) / 8;
  52. done:
  53. BN_free(p);
  54. BN_free(a);
  55. BN_free(b);
  56. return field_size;
  57. }
  58. int ossl_sm2_plaintext_size(const unsigned char *ct, size_t ct_size,
  59. size_t *pt_size)
  60. {
  61. struct SM2_Ciphertext_st *sm2_ctext = NULL;
  62. sm2_ctext = d2i_SM2_Ciphertext(NULL, &ct, ct_size);
  63. if (sm2_ctext == NULL) {
  64. ERR_raise(ERR_LIB_SM2, SM2_R_INVALID_ENCODING);
  65. return 0;
  66. }
  67. *pt_size = sm2_ctext->C2->length;
  68. SM2_Ciphertext_free(sm2_ctext);
  69. return 1;
  70. }
  71. int ossl_sm2_ciphertext_size(const EC_KEY *key, const EVP_MD *digest,
  72. size_t msg_len, size_t *ct_size)
  73. {
  74. const size_t field_size = ec_field_size(EC_KEY_get0_group(key));
  75. const int md_size = EVP_MD_get_size(digest);
  76. size_t sz;
  77. if (field_size == 0 || md_size < 0)
  78. return 0;
  79. /* Integer and string are simple type; set constructed = 0, means primitive and definite length encoding. */
  80. sz = 2 * ASN1_object_size(0, field_size + 1, V_ASN1_INTEGER)
  81. + ASN1_object_size(0, md_size, V_ASN1_OCTET_STRING)
  82. + ASN1_object_size(0, msg_len, V_ASN1_OCTET_STRING);
  83. /* Sequence is structured type; set constructed = 1, means constructed and definite length encoding. */
  84. *ct_size = ASN1_object_size(1, sz, V_ASN1_SEQUENCE);
  85. return 1;
  86. }
  87. int ossl_sm2_encrypt(const EC_KEY *key,
  88. const EVP_MD *digest,
  89. const uint8_t *msg, size_t msg_len,
  90. uint8_t *ciphertext_buf, size_t *ciphertext_len)
  91. {
  92. int rc = 0, ciphertext_leni;
  93. size_t i;
  94. BN_CTX *ctx = NULL;
  95. BIGNUM *k = NULL;
  96. BIGNUM *x1 = NULL;
  97. BIGNUM *y1 = NULL;
  98. BIGNUM *x2 = NULL;
  99. BIGNUM *y2 = NULL;
  100. EVP_MD_CTX *hash = EVP_MD_CTX_new();
  101. struct SM2_Ciphertext_st ctext_struct;
  102. const EC_GROUP *group = EC_KEY_get0_group(key);
  103. const BIGNUM *order = EC_GROUP_get0_order(group);
  104. const EC_POINT *P = EC_KEY_get0_public_key(key);
  105. EC_POINT *kG = NULL;
  106. EC_POINT *kP = NULL;
  107. uint8_t *msg_mask = NULL;
  108. uint8_t *x2y2 = NULL;
  109. uint8_t *C3 = NULL;
  110. size_t field_size;
  111. const int C3_size = EVP_MD_get_size(digest);
  112. EVP_MD *fetched_digest = NULL;
  113. OSSL_LIB_CTX *libctx = ossl_ec_key_get_libctx(key);
  114. const char *propq = ossl_ec_key_get0_propq(key);
  115. /* NULL these before any "goto done" */
  116. ctext_struct.C2 = NULL;
  117. ctext_struct.C3 = NULL;
  118. if (hash == NULL || C3_size <= 0) {
  119. ERR_raise(ERR_LIB_SM2, ERR_R_INTERNAL_ERROR);
  120. goto done;
  121. }
  122. field_size = ec_field_size(group);
  123. if (field_size == 0) {
  124. ERR_raise(ERR_LIB_SM2, ERR_R_INTERNAL_ERROR);
  125. goto done;
  126. }
  127. kG = EC_POINT_new(group);
  128. kP = EC_POINT_new(group);
  129. if (kG == NULL || kP == NULL) {
  130. ERR_raise(ERR_LIB_SM2, ERR_R_EC_LIB);
  131. goto done;
  132. }
  133. ctx = BN_CTX_new_ex(libctx);
  134. if (ctx == NULL) {
  135. ERR_raise(ERR_LIB_SM2, ERR_R_BN_LIB);
  136. goto done;
  137. }
  138. BN_CTX_start(ctx);
  139. k = BN_CTX_get(ctx);
  140. x1 = BN_CTX_get(ctx);
  141. x2 = BN_CTX_get(ctx);
  142. y1 = BN_CTX_get(ctx);
  143. y2 = BN_CTX_get(ctx);
  144. if (y2 == NULL) {
  145. ERR_raise(ERR_LIB_SM2, ERR_R_BN_LIB);
  146. goto done;
  147. }
  148. x2y2 = OPENSSL_zalloc(2 * field_size);
  149. C3 = OPENSSL_zalloc(C3_size);
  150. if (x2y2 == NULL || C3 == NULL)
  151. goto done;
  152. memset(ciphertext_buf, 0, *ciphertext_len);
  153. if (!BN_priv_rand_range_ex(k, order, 0, ctx)) {
  154. ERR_raise(ERR_LIB_SM2, ERR_R_INTERNAL_ERROR);
  155. goto done;
  156. }
  157. if (!EC_POINT_mul(group, kG, k, NULL, NULL, ctx)
  158. || !EC_POINT_get_affine_coordinates(group, kG, x1, y1, ctx)
  159. || !EC_POINT_mul(group, kP, NULL, P, k, ctx)
  160. || !EC_POINT_get_affine_coordinates(group, kP, x2, y2, ctx)) {
  161. ERR_raise(ERR_LIB_SM2, ERR_R_EC_LIB);
  162. goto done;
  163. }
  164. if (BN_bn2binpad(x2, x2y2, field_size) < 0
  165. || BN_bn2binpad(y2, x2y2 + field_size, field_size) < 0) {
  166. ERR_raise(ERR_LIB_SM2, ERR_R_INTERNAL_ERROR);
  167. goto done;
  168. }
  169. msg_mask = OPENSSL_zalloc(msg_len);
  170. if (msg_mask == NULL)
  171. goto done;
  172. /* X9.63 with no salt happens to match the KDF used in SM2 */
  173. if (!ossl_ecdh_kdf_X9_63(msg_mask, msg_len, x2y2, 2 * field_size, NULL, 0,
  174. digest, libctx, propq)) {
  175. ERR_raise(ERR_LIB_SM2, ERR_R_EVP_LIB);
  176. goto done;
  177. }
  178. for (i = 0; i != msg_len; ++i)
  179. msg_mask[i] ^= msg[i];
  180. fetched_digest = EVP_MD_fetch(libctx, EVP_MD_get0_name(digest), propq);
  181. if (fetched_digest == NULL) {
  182. ERR_raise(ERR_LIB_SM2, ERR_R_INTERNAL_ERROR);
  183. goto done;
  184. }
  185. if (EVP_DigestInit(hash, fetched_digest) == 0
  186. || EVP_DigestUpdate(hash, x2y2, field_size) == 0
  187. || EVP_DigestUpdate(hash, msg, msg_len) == 0
  188. || EVP_DigestUpdate(hash, x2y2 + field_size, field_size) == 0
  189. || EVP_DigestFinal(hash, C3, NULL) == 0) {
  190. ERR_raise(ERR_LIB_SM2, ERR_R_EVP_LIB);
  191. goto done;
  192. }
  193. ctext_struct.C1x = x1;
  194. ctext_struct.C1y = y1;
  195. ctext_struct.C3 = ASN1_OCTET_STRING_new();
  196. ctext_struct.C2 = ASN1_OCTET_STRING_new();
  197. if (ctext_struct.C3 == NULL || ctext_struct.C2 == NULL) {
  198. ERR_raise(ERR_LIB_SM2, ERR_R_ASN1_LIB);
  199. goto done;
  200. }
  201. if (!ASN1_OCTET_STRING_set(ctext_struct.C3, C3, C3_size)
  202. || !ASN1_OCTET_STRING_set(ctext_struct.C2, msg_mask, msg_len)) {
  203. ERR_raise(ERR_LIB_SM2, ERR_R_INTERNAL_ERROR);
  204. goto done;
  205. }
  206. ciphertext_leni = i2d_SM2_Ciphertext(&ctext_struct, &ciphertext_buf);
  207. /* Ensure cast to size_t is safe */
  208. if (ciphertext_leni < 0) {
  209. ERR_raise(ERR_LIB_SM2, ERR_R_INTERNAL_ERROR);
  210. goto done;
  211. }
  212. *ciphertext_len = (size_t)ciphertext_leni;
  213. rc = 1;
  214. done:
  215. EVP_MD_free(fetched_digest);
  216. ASN1_OCTET_STRING_free(ctext_struct.C2);
  217. ASN1_OCTET_STRING_free(ctext_struct.C3);
  218. OPENSSL_free(msg_mask);
  219. OPENSSL_free(x2y2);
  220. OPENSSL_free(C3);
  221. EVP_MD_CTX_free(hash);
  222. BN_CTX_free(ctx);
  223. EC_POINT_free(kG);
  224. EC_POINT_free(kP);
  225. return rc;
  226. }
  227. int ossl_sm2_decrypt(const EC_KEY *key,
  228. const EVP_MD *digest,
  229. const uint8_t *ciphertext, size_t ciphertext_len,
  230. uint8_t *ptext_buf, size_t *ptext_len)
  231. {
  232. int rc = 0;
  233. int i;
  234. BN_CTX *ctx = NULL;
  235. const EC_GROUP *group = EC_KEY_get0_group(key);
  236. EC_POINT *C1 = NULL;
  237. struct SM2_Ciphertext_st *sm2_ctext = NULL;
  238. BIGNUM *x2 = NULL;
  239. BIGNUM *y2 = NULL;
  240. uint8_t *x2y2 = NULL;
  241. uint8_t *computed_C3 = NULL;
  242. const size_t field_size = ec_field_size(group);
  243. const int hash_size = EVP_MD_get_size(digest);
  244. uint8_t *msg_mask = NULL;
  245. const uint8_t *C2 = NULL;
  246. const uint8_t *C3 = NULL;
  247. int msg_len = 0;
  248. EVP_MD_CTX *hash = NULL;
  249. OSSL_LIB_CTX *libctx = ossl_ec_key_get_libctx(key);
  250. const char *propq = ossl_ec_key_get0_propq(key);
  251. if (field_size == 0 || hash_size <= 0)
  252. goto done;
  253. memset(ptext_buf, 0xFF, *ptext_len);
  254. sm2_ctext = d2i_SM2_Ciphertext(NULL, &ciphertext, ciphertext_len);
  255. if (sm2_ctext == NULL) {
  256. ERR_raise(ERR_LIB_SM2, SM2_R_ASN1_ERROR);
  257. goto done;
  258. }
  259. if (sm2_ctext->C3->length != hash_size) {
  260. ERR_raise(ERR_LIB_SM2, SM2_R_INVALID_ENCODING);
  261. goto done;
  262. }
  263. C2 = sm2_ctext->C2->data;
  264. C3 = sm2_ctext->C3->data;
  265. msg_len = sm2_ctext->C2->length;
  266. if (*ptext_len < (size_t)msg_len) {
  267. ERR_raise(ERR_LIB_SM2, SM2_R_BUFFER_TOO_SMALL);
  268. goto done;
  269. }
  270. ctx = BN_CTX_new_ex(libctx);
  271. if (ctx == NULL) {
  272. ERR_raise(ERR_LIB_SM2, ERR_R_BN_LIB);
  273. goto done;
  274. }
  275. BN_CTX_start(ctx);
  276. x2 = BN_CTX_get(ctx);
  277. y2 = BN_CTX_get(ctx);
  278. if (y2 == NULL) {
  279. ERR_raise(ERR_LIB_SM2, ERR_R_BN_LIB);
  280. goto done;
  281. }
  282. msg_mask = OPENSSL_zalloc(msg_len);
  283. x2y2 = OPENSSL_zalloc(2 * field_size);
  284. computed_C3 = OPENSSL_zalloc(hash_size);
  285. if (msg_mask == NULL || x2y2 == NULL || computed_C3 == NULL)
  286. goto done;
  287. C1 = EC_POINT_new(group);
  288. if (C1 == NULL) {
  289. ERR_raise(ERR_LIB_SM2, ERR_R_EC_LIB);
  290. goto done;
  291. }
  292. if (!EC_POINT_set_affine_coordinates(group, C1, sm2_ctext->C1x,
  293. sm2_ctext->C1y, ctx)
  294. || !EC_POINT_mul(group, C1, NULL, C1, EC_KEY_get0_private_key(key),
  295. ctx)
  296. || !EC_POINT_get_affine_coordinates(group, C1, x2, y2, ctx)) {
  297. ERR_raise(ERR_LIB_SM2, ERR_R_EC_LIB);
  298. goto done;
  299. }
  300. if (BN_bn2binpad(x2, x2y2, field_size) < 0
  301. || BN_bn2binpad(y2, x2y2 + field_size, field_size) < 0
  302. || !ossl_ecdh_kdf_X9_63(msg_mask, msg_len, x2y2, 2 * field_size,
  303. NULL, 0, digest, libctx, propq)) {
  304. ERR_raise(ERR_LIB_SM2, ERR_R_INTERNAL_ERROR);
  305. goto done;
  306. }
  307. for (i = 0; i != msg_len; ++i)
  308. ptext_buf[i] = C2[i] ^ msg_mask[i];
  309. hash = EVP_MD_CTX_new();
  310. if (hash == NULL) {
  311. ERR_raise(ERR_LIB_SM2, ERR_R_EVP_LIB);
  312. goto done;
  313. }
  314. if (!EVP_DigestInit(hash, digest)
  315. || !EVP_DigestUpdate(hash, x2y2, field_size)
  316. || !EVP_DigestUpdate(hash, ptext_buf, msg_len)
  317. || !EVP_DigestUpdate(hash, x2y2 + field_size, field_size)
  318. || !EVP_DigestFinal(hash, computed_C3, NULL)) {
  319. ERR_raise(ERR_LIB_SM2, ERR_R_EVP_LIB);
  320. goto done;
  321. }
  322. if (CRYPTO_memcmp(computed_C3, C3, hash_size) != 0) {
  323. ERR_raise(ERR_LIB_SM2, SM2_R_INVALID_DIGEST);
  324. goto done;
  325. }
  326. rc = 1;
  327. *ptext_len = msg_len;
  328. done:
  329. if (rc == 0)
  330. memset(ptext_buf, 0, *ptext_len);
  331. OPENSSL_free(msg_mask);
  332. OPENSSL_free(x2y2);
  333. OPENSSL_free(computed_C3);
  334. EC_POINT_free(C1);
  335. BN_CTX_free(ctx);
  336. SM2_Ciphertext_free(sm2_ctext);
  337. EVP_MD_CTX_free(hash);
  338. return rc;
  339. }