srp_vfy.c 21 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775
  1. /*
  2. * Copyright 2004-2023 The OpenSSL Project Authors. All Rights Reserved.
  3. * Copyright (c) 2004, EdelKey Project. All Rights Reserved.
  4. *
  5. * Licensed under the Apache License 2.0 (the "License"). You may not use
  6. * this file except in compliance with the License. You can obtain a copy
  7. * in the file LICENSE in the source distribution or at
  8. * https://www.openssl.org/source/license.html
  9. *
  10. * Originally written by Christophe Renou and Peter Sylvester,
  11. * for the EdelKey project.
  12. */
  13. /* All the SRP APIs in this file are deprecated */
  14. #define OPENSSL_SUPPRESS_DEPRECATED
  15. #ifndef OPENSSL_NO_SRP
  16. # include "internal/cryptlib.h"
  17. # include "crypto/evp.h"
  18. # include <openssl/sha.h>
  19. # include <openssl/srp.h>
  20. # include <openssl/evp.h>
  21. # include <openssl/buffer.h>
  22. # include <openssl/rand.h>
  23. # include <openssl/txt_db.h>
  24. # include <openssl/err.h>
  25. # define SRP_RANDOM_SALT_LEN 20
  26. # define MAX_LEN 2500
  27. /*
  28. * Note that SRP uses its own variant of base 64 encoding. A different base64
  29. * alphabet is used and no padding '=' characters are added. Instead we pad to
  30. * the front with 0 bytes and subsequently strip off leading encoded padding.
  31. * This variant is used for compatibility with other SRP implementations -
  32. * notably libsrp, but also others. It is also required for backwards
  33. * compatibility in order to load verifier files from other OpenSSL versions.
  34. */
  35. /*
  36. * Convert a base64 string into raw byte array representation.
  37. * Returns the length of the decoded data, or -1 on error.
  38. */
  39. static int t_fromb64(unsigned char *a, size_t alen, const char *src)
  40. {
  41. EVP_ENCODE_CTX *ctx;
  42. int outl = 0, outl2 = 0;
  43. size_t size, padsize;
  44. const unsigned char *pad = (const unsigned char *)"00";
  45. while (*src == ' ' || *src == '\t' || *src == '\n')
  46. ++src;
  47. size = strlen(src);
  48. padsize = 4 - (size & 3);
  49. padsize &= 3;
  50. /* Four bytes in src become three bytes output. */
  51. if (size > INT_MAX || ((size + padsize) / 4) * 3 > alen)
  52. return -1;
  53. ctx = EVP_ENCODE_CTX_new();
  54. if (ctx == NULL)
  55. return -1;
  56. /*
  57. * This should never occur because 1 byte of data always requires 2 bytes of
  58. * encoding, i.e.
  59. * 0 bytes unencoded = 0 bytes encoded
  60. * 1 byte unencoded = 2 bytes encoded
  61. * 2 bytes unencoded = 3 bytes encoded
  62. * 3 bytes unencoded = 4 bytes encoded
  63. * 4 bytes unencoded = 6 bytes encoded
  64. * etc
  65. */
  66. if (padsize == 3) {
  67. outl = -1;
  68. goto err;
  69. }
  70. /* Valid padsize values are now 0, 1 or 2 */
  71. EVP_DecodeInit(ctx);
  72. evp_encode_ctx_set_flags(ctx, EVP_ENCODE_CTX_USE_SRP_ALPHABET);
  73. /* Add any encoded padding that is required */
  74. if (padsize != 0
  75. && EVP_DecodeUpdate(ctx, a, &outl, pad, padsize) < 0) {
  76. outl = -1;
  77. goto err;
  78. }
  79. if (EVP_DecodeUpdate(ctx, a, &outl2, (const unsigned char *)src, size) < 0) {
  80. outl = -1;
  81. goto err;
  82. }
  83. outl += outl2;
  84. EVP_DecodeFinal(ctx, a + outl, &outl2);
  85. outl += outl2;
  86. /* Strip off the leading padding */
  87. if (padsize != 0) {
  88. if ((int)padsize >= outl) {
  89. outl = -1;
  90. goto err;
  91. }
  92. /*
  93. * If we added 1 byte of padding prior to encoding then we have 2 bytes
  94. * of "real" data which gets spread across 4 encoded bytes like this:
  95. * (6 bits pad)(2 bits pad | 4 bits data)(6 bits data)(6 bits data)
  96. * So 1 byte of pre-encoding padding results in 1 full byte of encoded
  97. * padding.
  98. * If we added 2 bytes of padding prior to encoding this gets encoded
  99. * as:
  100. * (6 bits pad)(6 bits pad)(4 bits pad | 2 bits data)(6 bits data)
  101. * So 2 bytes of pre-encoding padding results in 2 full bytes of encoded
  102. * padding, i.e. we have to strip the same number of bytes of padding
  103. * from the encoded data as we added to the pre-encoded data.
  104. */
  105. memmove(a, a + padsize, outl - padsize);
  106. outl -= padsize;
  107. }
  108. err:
  109. EVP_ENCODE_CTX_free(ctx);
  110. return outl;
  111. }
  112. /*
  113. * Convert a raw byte string into a null-terminated base64 ASCII string.
  114. * Returns 1 on success or 0 on error.
  115. */
  116. static int t_tob64(char *dst, const unsigned char *src, int size)
  117. {
  118. EVP_ENCODE_CTX *ctx = EVP_ENCODE_CTX_new();
  119. int outl = 0, outl2 = 0;
  120. unsigned char pad[2] = {0, 0};
  121. size_t leadz = 0;
  122. if (ctx == NULL)
  123. return 0;
  124. EVP_EncodeInit(ctx);
  125. evp_encode_ctx_set_flags(ctx, EVP_ENCODE_CTX_NO_NEWLINES
  126. | EVP_ENCODE_CTX_USE_SRP_ALPHABET);
  127. /*
  128. * We pad at the front with zero bytes until the length is a multiple of 3
  129. * so that EVP_EncodeUpdate/EVP_EncodeFinal does not add any of its own "="
  130. * padding
  131. */
  132. leadz = 3 - (size % 3);
  133. if (leadz != 3
  134. && !EVP_EncodeUpdate(ctx, (unsigned char *)dst, &outl, pad,
  135. leadz)) {
  136. EVP_ENCODE_CTX_free(ctx);
  137. return 0;
  138. }
  139. if (!EVP_EncodeUpdate(ctx, (unsigned char *)dst + outl, &outl2, src,
  140. size)) {
  141. EVP_ENCODE_CTX_free(ctx);
  142. return 0;
  143. }
  144. outl += outl2;
  145. EVP_EncodeFinal(ctx, (unsigned char *)dst + outl, &outl2);
  146. outl += outl2;
  147. /* Strip the encoded padding at the front */
  148. if (leadz != 3) {
  149. memmove(dst, dst + leadz, outl - leadz);
  150. dst[outl - leadz] = '\0';
  151. }
  152. EVP_ENCODE_CTX_free(ctx);
  153. return 1;
  154. }
  155. void SRP_user_pwd_free(SRP_user_pwd *user_pwd)
  156. {
  157. if (user_pwd == NULL)
  158. return;
  159. BN_free(user_pwd->s);
  160. BN_clear_free(user_pwd->v);
  161. OPENSSL_free(user_pwd->id);
  162. OPENSSL_free(user_pwd->info);
  163. OPENSSL_free(user_pwd);
  164. }
  165. SRP_user_pwd *SRP_user_pwd_new(void)
  166. {
  167. SRP_user_pwd *ret;
  168. if ((ret = OPENSSL_malloc(sizeof(*ret))) == NULL)
  169. return NULL;
  170. ret->N = NULL;
  171. ret->g = NULL;
  172. ret->s = NULL;
  173. ret->v = NULL;
  174. ret->id = NULL;
  175. ret->info = NULL;
  176. return ret;
  177. }
  178. void SRP_user_pwd_set_gN(SRP_user_pwd *vinfo, const BIGNUM *g,
  179. const BIGNUM *N)
  180. {
  181. vinfo->N = N;
  182. vinfo->g = g;
  183. }
  184. int SRP_user_pwd_set1_ids(SRP_user_pwd *vinfo, const char *id,
  185. const char *info)
  186. {
  187. OPENSSL_free(vinfo->id);
  188. OPENSSL_free(vinfo->info);
  189. if (id != NULL && NULL == (vinfo->id = OPENSSL_strdup(id)))
  190. return 0;
  191. return (info == NULL || NULL != (vinfo->info = OPENSSL_strdup(info)));
  192. }
  193. static int SRP_user_pwd_set_sv(SRP_user_pwd *vinfo, const char *s,
  194. const char *v)
  195. {
  196. unsigned char tmp[MAX_LEN];
  197. int len;
  198. vinfo->v = NULL;
  199. vinfo->s = NULL;
  200. len = t_fromb64(tmp, sizeof(tmp), v);
  201. if (len < 0)
  202. return 0;
  203. if (NULL == (vinfo->v = BN_bin2bn(tmp, len, NULL)))
  204. return 0;
  205. len = t_fromb64(tmp, sizeof(tmp), s);
  206. if (len < 0)
  207. goto err;
  208. vinfo->s = BN_bin2bn(tmp, len, NULL);
  209. if (vinfo->s == NULL)
  210. goto err;
  211. return 1;
  212. err:
  213. BN_free(vinfo->v);
  214. vinfo->v = NULL;
  215. return 0;
  216. }
  217. int SRP_user_pwd_set0_sv(SRP_user_pwd *vinfo, BIGNUM *s, BIGNUM *v)
  218. {
  219. BN_free(vinfo->s);
  220. BN_clear_free(vinfo->v);
  221. vinfo->v = v;
  222. vinfo->s = s;
  223. return (vinfo->s != NULL && vinfo->v != NULL);
  224. }
  225. static SRP_user_pwd *srp_user_pwd_dup(SRP_user_pwd *src)
  226. {
  227. SRP_user_pwd *ret;
  228. if (src == NULL)
  229. return NULL;
  230. if ((ret = SRP_user_pwd_new()) == NULL)
  231. return NULL;
  232. SRP_user_pwd_set_gN(ret, src->g, src->N);
  233. if (!SRP_user_pwd_set1_ids(ret, src->id, src->info)
  234. || !SRP_user_pwd_set0_sv(ret, BN_dup(src->s), BN_dup(src->v))) {
  235. SRP_user_pwd_free(ret);
  236. return NULL;
  237. }
  238. return ret;
  239. }
  240. SRP_VBASE *SRP_VBASE_new(char *seed_key)
  241. {
  242. SRP_VBASE *vb = OPENSSL_malloc(sizeof(*vb));
  243. if (vb == NULL)
  244. return NULL;
  245. if ((vb->users_pwd = sk_SRP_user_pwd_new_null()) == NULL
  246. || (vb->gN_cache = sk_SRP_gN_cache_new_null()) == NULL) {
  247. sk_SRP_user_pwd_free(vb->users_pwd);
  248. OPENSSL_free(vb);
  249. return NULL;
  250. }
  251. vb->default_g = NULL;
  252. vb->default_N = NULL;
  253. vb->seed_key = NULL;
  254. if ((seed_key != NULL) && (vb->seed_key = OPENSSL_strdup(seed_key)) == NULL) {
  255. sk_SRP_user_pwd_free(vb->users_pwd);
  256. sk_SRP_gN_cache_free(vb->gN_cache);
  257. OPENSSL_free(vb);
  258. return NULL;
  259. }
  260. return vb;
  261. }
  262. void SRP_VBASE_free(SRP_VBASE *vb)
  263. {
  264. if (!vb)
  265. return;
  266. sk_SRP_user_pwd_pop_free(vb->users_pwd, SRP_user_pwd_free);
  267. sk_SRP_gN_cache_free(vb->gN_cache);
  268. OPENSSL_free(vb->seed_key);
  269. OPENSSL_free(vb);
  270. }
  271. static SRP_gN_cache *SRP_gN_new_init(const char *ch)
  272. {
  273. unsigned char tmp[MAX_LEN];
  274. int len;
  275. SRP_gN_cache *newgN = OPENSSL_malloc(sizeof(*newgN));
  276. if (newgN == NULL)
  277. return NULL;
  278. len = t_fromb64(tmp, sizeof(tmp), ch);
  279. if (len < 0)
  280. goto err;
  281. if ((newgN->b64_bn = OPENSSL_strdup(ch)) == NULL)
  282. goto err;
  283. if ((newgN->bn = BN_bin2bn(tmp, len, NULL)))
  284. return newgN;
  285. OPENSSL_free(newgN->b64_bn);
  286. err:
  287. OPENSSL_free(newgN);
  288. return NULL;
  289. }
  290. static void SRP_gN_free(SRP_gN_cache *gN_cache)
  291. {
  292. if (gN_cache == NULL)
  293. return;
  294. OPENSSL_free(gN_cache->b64_bn);
  295. BN_free(gN_cache->bn);
  296. OPENSSL_free(gN_cache);
  297. }
  298. static SRP_gN *SRP_get_gN_by_id(const char *id, STACK_OF(SRP_gN) *gN_tab)
  299. {
  300. int i;
  301. SRP_gN *gN;
  302. if (gN_tab != NULL) {
  303. for (i = 0; i < sk_SRP_gN_num(gN_tab); i++) {
  304. gN = sk_SRP_gN_value(gN_tab, i);
  305. if (gN && (id == NULL || strcmp(gN->id, id) == 0))
  306. return gN;
  307. }
  308. }
  309. return SRP_get_default_gN(id);
  310. }
  311. static BIGNUM *SRP_gN_place_bn(STACK_OF(SRP_gN_cache) *gN_cache, char *ch)
  312. {
  313. int i;
  314. if (gN_cache == NULL)
  315. return NULL;
  316. /* search if we have already one... */
  317. for (i = 0; i < sk_SRP_gN_cache_num(gN_cache); i++) {
  318. SRP_gN_cache *cache = sk_SRP_gN_cache_value(gN_cache, i);
  319. if (strcmp(cache->b64_bn, ch) == 0)
  320. return cache->bn;
  321. }
  322. { /* it is the first time that we find it */
  323. SRP_gN_cache *newgN = SRP_gN_new_init(ch);
  324. if (newgN) {
  325. if (sk_SRP_gN_cache_insert(gN_cache, newgN, 0) > 0)
  326. return newgN->bn;
  327. SRP_gN_free(newgN);
  328. }
  329. }
  330. return NULL;
  331. }
  332. /*
  333. * This function parses the verifier file generated by the srp app.
  334. * The format for each entry is:
  335. * V base64(verifier) base64(salt) username gNid userinfo(optional)
  336. * or
  337. * I base64(N) base64(g)
  338. * Note that base64 is the SRP variant of base64 encoding described
  339. * in t_fromb64().
  340. */
  341. int SRP_VBASE_init(SRP_VBASE *vb, char *verifier_file)
  342. {
  343. int error_code = SRP_ERR_MEMORY;
  344. STACK_OF(SRP_gN) *SRP_gN_tab = sk_SRP_gN_new_null();
  345. char *last_index = NULL;
  346. int i;
  347. char **pp;
  348. SRP_gN *gN = NULL;
  349. SRP_user_pwd *user_pwd = NULL;
  350. TXT_DB *tmpdb = NULL;
  351. BIO *in = BIO_new(BIO_s_file());
  352. if (SRP_gN_tab == NULL)
  353. goto err;
  354. error_code = SRP_ERR_OPEN_FILE;
  355. if (in == NULL || BIO_read_filename(in, verifier_file) <= 0)
  356. goto err;
  357. error_code = SRP_ERR_VBASE_INCOMPLETE_FILE;
  358. if ((tmpdb = TXT_DB_read(in, DB_NUMBER)) == NULL)
  359. goto err;
  360. error_code = SRP_ERR_MEMORY;
  361. if (vb->seed_key) {
  362. last_index = SRP_get_default_gN(NULL)->id;
  363. }
  364. for (i = 0; i < sk_OPENSSL_PSTRING_num(tmpdb->data); i++) {
  365. pp = sk_OPENSSL_PSTRING_value(tmpdb->data, i);
  366. if (pp[DB_srptype][0] == DB_SRP_INDEX) {
  367. /*
  368. * we add this couple in the internal Stack
  369. */
  370. if ((gN = OPENSSL_malloc(sizeof(*gN))) == NULL)
  371. goto err;
  372. if ((gN->id = OPENSSL_strdup(pp[DB_srpid])) == NULL
  373. || (gN->N = SRP_gN_place_bn(vb->gN_cache, pp[DB_srpverifier]))
  374. == NULL
  375. || (gN->g = SRP_gN_place_bn(vb->gN_cache, pp[DB_srpsalt]))
  376. == NULL
  377. || sk_SRP_gN_insert(SRP_gN_tab, gN, 0) == 0)
  378. goto err;
  379. gN = NULL;
  380. if (vb->seed_key != NULL) {
  381. last_index = pp[DB_srpid];
  382. }
  383. } else if (pp[DB_srptype][0] == DB_SRP_VALID) {
  384. /* it is a user .... */
  385. const SRP_gN *lgN;
  386. if ((lgN = SRP_get_gN_by_id(pp[DB_srpgN], SRP_gN_tab)) != NULL) {
  387. error_code = SRP_ERR_MEMORY;
  388. if ((user_pwd = SRP_user_pwd_new()) == NULL)
  389. goto err;
  390. SRP_user_pwd_set_gN(user_pwd, lgN->g, lgN->N);
  391. if (!SRP_user_pwd_set1_ids
  392. (user_pwd, pp[DB_srpid], pp[DB_srpinfo]))
  393. goto err;
  394. error_code = SRP_ERR_VBASE_BN_LIB;
  395. if (!SRP_user_pwd_set_sv
  396. (user_pwd, pp[DB_srpsalt], pp[DB_srpverifier]))
  397. goto err;
  398. if (sk_SRP_user_pwd_insert(vb->users_pwd, user_pwd, 0) == 0)
  399. goto err;
  400. user_pwd = NULL; /* abandon responsibility */
  401. }
  402. }
  403. }
  404. if (last_index != NULL) {
  405. /* this means that we want to simulate a default user */
  406. if (((gN = SRP_get_gN_by_id(last_index, SRP_gN_tab)) == NULL)) {
  407. error_code = SRP_ERR_VBASE_BN_LIB;
  408. goto err;
  409. }
  410. vb->default_g = gN->g;
  411. vb->default_N = gN->N;
  412. gN = NULL;
  413. }
  414. error_code = SRP_NO_ERROR;
  415. err:
  416. /*
  417. * there may be still some leaks to fix, if this fails, the application
  418. * terminates most likely
  419. */
  420. if (gN != NULL) {
  421. OPENSSL_free(gN->id);
  422. OPENSSL_free(gN);
  423. }
  424. SRP_user_pwd_free(user_pwd);
  425. TXT_DB_free(tmpdb);
  426. BIO_free_all(in);
  427. sk_SRP_gN_free(SRP_gN_tab);
  428. return error_code;
  429. }
  430. static SRP_user_pwd *find_user(SRP_VBASE *vb, char *username)
  431. {
  432. int i;
  433. SRP_user_pwd *user;
  434. if (vb == NULL)
  435. return NULL;
  436. for (i = 0; i < sk_SRP_user_pwd_num(vb->users_pwd); i++) {
  437. user = sk_SRP_user_pwd_value(vb->users_pwd, i);
  438. if (strcmp(user->id, username) == 0)
  439. return user;
  440. }
  441. return NULL;
  442. }
  443. int SRP_VBASE_add0_user(SRP_VBASE *vb, SRP_user_pwd *user_pwd)
  444. {
  445. if (sk_SRP_user_pwd_push(vb->users_pwd, user_pwd) <= 0)
  446. return 0;
  447. return 1;
  448. }
  449. # ifndef OPENSSL_NO_DEPRECATED_1_1_0
  450. /*
  451. * DEPRECATED: use SRP_VBASE_get1_by_user instead.
  452. * This method ignores the configured seed and fails for an unknown user.
  453. * Ownership of the returned pointer is not released to the caller.
  454. * In other words, caller must not free the result.
  455. */
  456. SRP_user_pwd *SRP_VBASE_get_by_user(SRP_VBASE *vb, char *username)
  457. {
  458. return find_user(vb, username);
  459. }
  460. # endif
  461. /*
  462. * Ownership of the returned pointer is released to the caller.
  463. * In other words, caller must free the result once done.
  464. */
  465. SRP_user_pwd *SRP_VBASE_get1_by_user(SRP_VBASE *vb, char *username)
  466. {
  467. SRP_user_pwd *user;
  468. unsigned char digv[SHA_DIGEST_LENGTH];
  469. unsigned char digs[SHA_DIGEST_LENGTH];
  470. EVP_MD_CTX *ctxt = NULL;
  471. EVP_MD *md = NULL;
  472. if (vb == NULL)
  473. return NULL;
  474. if ((user = find_user(vb, username)) != NULL)
  475. return srp_user_pwd_dup(user);
  476. if ((vb->seed_key == NULL) ||
  477. (vb->default_g == NULL) || (vb->default_N == NULL))
  478. return NULL;
  479. /* if the user is unknown we set parameters as well if we have a seed_key */
  480. if ((user = SRP_user_pwd_new()) == NULL)
  481. return NULL;
  482. SRP_user_pwd_set_gN(user, vb->default_g, vb->default_N);
  483. if (!SRP_user_pwd_set1_ids(user, username, NULL))
  484. goto err;
  485. if (RAND_priv_bytes(digv, SHA_DIGEST_LENGTH) <= 0)
  486. goto err;
  487. md = EVP_MD_fetch(NULL, SN_sha1, NULL);
  488. if (md == NULL)
  489. goto err;
  490. ctxt = EVP_MD_CTX_new();
  491. if (ctxt == NULL
  492. || !EVP_DigestInit_ex(ctxt, md, NULL)
  493. || !EVP_DigestUpdate(ctxt, vb->seed_key, strlen(vb->seed_key))
  494. || !EVP_DigestUpdate(ctxt, username, strlen(username))
  495. || !EVP_DigestFinal_ex(ctxt, digs, NULL))
  496. goto err;
  497. EVP_MD_CTX_free(ctxt);
  498. ctxt = NULL;
  499. EVP_MD_free(md);
  500. md = NULL;
  501. if (SRP_user_pwd_set0_sv(user,
  502. BN_bin2bn(digs, SHA_DIGEST_LENGTH, NULL),
  503. BN_bin2bn(digv, SHA_DIGEST_LENGTH, NULL)))
  504. return user;
  505. err:
  506. EVP_MD_free(md);
  507. EVP_MD_CTX_free(ctxt);
  508. SRP_user_pwd_free(user);
  509. return NULL;
  510. }
  511. /*
  512. * create a verifier (*salt,*verifier,g and N are in base64)
  513. */
  514. char *SRP_create_verifier_ex(const char *user, const char *pass, char **salt,
  515. char **verifier, const char *N, const char *g,
  516. OSSL_LIB_CTX *libctx, const char *propq)
  517. {
  518. int len;
  519. char *result = NULL, *vf = NULL;
  520. const BIGNUM *N_bn = NULL, *g_bn = NULL;
  521. BIGNUM *N_bn_alloc = NULL, *g_bn_alloc = NULL, *s = NULL, *v = NULL;
  522. unsigned char tmp[MAX_LEN];
  523. unsigned char tmp2[MAX_LEN];
  524. char *defgNid = NULL;
  525. int vfsize = 0;
  526. if ((user == NULL) ||
  527. (pass == NULL) || (salt == NULL) || (verifier == NULL))
  528. goto err;
  529. if (N) {
  530. if ((len = t_fromb64(tmp, sizeof(tmp), N)) <= 0)
  531. goto err;
  532. N_bn_alloc = BN_bin2bn(tmp, len, NULL);
  533. if (N_bn_alloc == NULL)
  534. goto err;
  535. N_bn = N_bn_alloc;
  536. if ((len = t_fromb64(tmp, sizeof(tmp), g)) <= 0)
  537. goto err;
  538. g_bn_alloc = BN_bin2bn(tmp, len, NULL);
  539. if (g_bn_alloc == NULL)
  540. goto err;
  541. g_bn = g_bn_alloc;
  542. defgNid = "*";
  543. } else {
  544. SRP_gN *gN = SRP_get_default_gN(g);
  545. if (gN == NULL)
  546. goto err;
  547. N_bn = gN->N;
  548. g_bn = gN->g;
  549. defgNid = gN->id;
  550. }
  551. if (*salt == NULL) {
  552. if (RAND_bytes_ex(libctx, tmp2, SRP_RANDOM_SALT_LEN, 0) <= 0)
  553. goto err;
  554. s = BN_bin2bn(tmp2, SRP_RANDOM_SALT_LEN, NULL);
  555. } else {
  556. if ((len = t_fromb64(tmp2, sizeof(tmp2), *salt)) <= 0)
  557. goto err;
  558. s = BN_bin2bn(tmp2, len, NULL);
  559. }
  560. if (s == NULL)
  561. goto err;
  562. if (!SRP_create_verifier_BN_ex(user, pass, &s, &v, N_bn, g_bn, libctx,
  563. propq))
  564. goto err;
  565. if (BN_bn2bin(v, tmp) < 0)
  566. goto err;
  567. vfsize = BN_num_bytes(v) * 2;
  568. if (((vf = OPENSSL_malloc(vfsize)) == NULL))
  569. goto err;
  570. if (!t_tob64(vf, tmp, BN_num_bytes(v)))
  571. goto err;
  572. if (*salt == NULL) {
  573. char *tmp_salt;
  574. if ((tmp_salt = OPENSSL_malloc(SRP_RANDOM_SALT_LEN * 2)) == NULL) {
  575. goto err;
  576. }
  577. if (!t_tob64(tmp_salt, tmp2, SRP_RANDOM_SALT_LEN)) {
  578. OPENSSL_free(tmp_salt);
  579. goto err;
  580. }
  581. *salt = tmp_salt;
  582. }
  583. *verifier = vf;
  584. vf = NULL;
  585. result = defgNid;
  586. err:
  587. BN_free(N_bn_alloc);
  588. BN_free(g_bn_alloc);
  589. OPENSSL_clear_free(vf, vfsize);
  590. BN_clear_free(s);
  591. BN_clear_free(v);
  592. return result;
  593. }
  594. char *SRP_create_verifier(const char *user, const char *pass, char **salt,
  595. char **verifier, const char *N, const char *g)
  596. {
  597. return SRP_create_verifier_ex(user, pass, salt, verifier, N, g, NULL, NULL);
  598. }
  599. /*
  600. * create a verifier (*salt,*verifier,g and N are BIGNUMs). If *salt != NULL
  601. * then the provided salt will be used. On successful exit *verifier will point
  602. * to a newly allocated BIGNUM containing the verifier and (if a salt was not
  603. * provided) *salt will be populated with a newly allocated BIGNUM containing a
  604. * random salt.
  605. * The caller is responsible for freeing the allocated *salt and *verifier
  606. * BIGNUMS.
  607. */
  608. int SRP_create_verifier_BN_ex(const char *user, const char *pass, BIGNUM **salt,
  609. BIGNUM **verifier, const BIGNUM *N,
  610. const BIGNUM *g, OSSL_LIB_CTX *libctx,
  611. const char *propq)
  612. {
  613. int result = 0;
  614. BIGNUM *x = NULL;
  615. BN_CTX *bn_ctx = BN_CTX_new_ex(libctx);
  616. unsigned char tmp2[MAX_LEN];
  617. BIGNUM *salttmp = NULL, *verif;
  618. if ((user == NULL) ||
  619. (pass == NULL) ||
  620. (salt == NULL) ||
  621. (verifier == NULL) || (N == NULL) || (g == NULL) || (bn_ctx == NULL))
  622. goto err;
  623. if (*salt == NULL) {
  624. if (RAND_bytes_ex(libctx, tmp2, SRP_RANDOM_SALT_LEN, 0) <= 0)
  625. goto err;
  626. salttmp = BN_bin2bn(tmp2, SRP_RANDOM_SALT_LEN, NULL);
  627. if (salttmp == NULL)
  628. goto err;
  629. } else {
  630. salttmp = *salt;
  631. }
  632. x = SRP_Calc_x_ex(salttmp, user, pass, libctx, propq);
  633. if (x == NULL)
  634. goto err;
  635. verif = BN_new();
  636. if (verif == NULL)
  637. goto err;
  638. if (!BN_mod_exp(verif, g, x, N, bn_ctx)) {
  639. BN_clear_free(verif);
  640. goto err;
  641. }
  642. result = 1;
  643. *salt = salttmp;
  644. *verifier = verif;
  645. err:
  646. if (salt != NULL && *salt != salttmp)
  647. BN_clear_free(salttmp);
  648. BN_clear_free(x);
  649. BN_CTX_free(bn_ctx);
  650. return result;
  651. }
  652. int SRP_create_verifier_BN(const char *user, const char *pass, BIGNUM **salt,
  653. BIGNUM **verifier, const BIGNUM *N,
  654. const BIGNUM *g)
  655. {
  656. return SRP_create_verifier_BN_ex(user, pass, salt, verifier, N, g, NULL,
  657. NULL);
  658. }
  659. #endif