tls_srp.c 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456
  1. /*
  2. * Copyright 2004-2018 The OpenSSL Project Authors. All Rights Reserved.
  3. * Copyright (c) 2004, EdelKey Project. All Rights Reserved.
  4. *
  5. * Licensed under the OpenSSL license (the "License"). You may not use
  6. * this file except in compliance with the License. You can obtain a copy
  7. * in the file LICENSE in the source distribution or at
  8. * https://www.openssl.org/source/license.html
  9. *
  10. * Originally written by Christophe Renou and Peter Sylvester,
  11. * for the EdelKey project.
  12. */
  13. #include <openssl/crypto.h>
  14. #include <openssl/rand.h>
  15. #include <openssl/err.h>
  16. #include "ssl_locl.h"
  17. #ifndef OPENSSL_NO_SRP
  18. # include <openssl/srp.h>
  19. int SSL_CTX_SRP_CTX_free(struct ssl_ctx_st *ctx)
  20. {
  21. if (ctx == NULL)
  22. return 0;
  23. OPENSSL_free(ctx->srp_ctx.login);
  24. OPENSSL_free(ctx->srp_ctx.info);
  25. BN_free(ctx->srp_ctx.N);
  26. BN_free(ctx->srp_ctx.g);
  27. BN_free(ctx->srp_ctx.s);
  28. BN_free(ctx->srp_ctx.B);
  29. BN_free(ctx->srp_ctx.A);
  30. BN_free(ctx->srp_ctx.a);
  31. BN_free(ctx->srp_ctx.b);
  32. BN_free(ctx->srp_ctx.v);
  33. memset(&ctx->srp_ctx, 0, sizeof(ctx->srp_ctx));
  34. ctx->srp_ctx.strength = SRP_MINIMAL_N;
  35. return 1;
  36. }
  37. int SSL_SRP_CTX_free(struct ssl_st *s)
  38. {
  39. if (s == NULL)
  40. return 0;
  41. OPENSSL_free(s->srp_ctx.login);
  42. OPENSSL_free(s->srp_ctx.info);
  43. BN_free(s->srp_ctx.N);
  44. BN_free(s->srp_ctx.g);
  45. BN_free(s->srp_ctx.s);
  46. BN_free(s->srp_ctx.B);
  47. BN_free(s->srp_ctx.A);
  48. BN_free(s->srp_ctx.a);
  49. BN_free(s->srp_ctx.b);
  50. BN_free(s->srp_ctx.v);
  51. memset(&s->srp_ctx, 0, sizeof(s->srp_ctx));
  52. s->srp_ctx.strength = SRP_MINIMAL_N;
  53. return 1;
  54. }
  55. int SSL_SRP_CTX_init(struct ssl_st *s)
  56. {
  57. SSL_CTX *ctx;
  58. if ((s == NULL) || ((ctx = s->ctx) == NULL))
  59. return 0;
  60. memset(&s->srp_ctx, 0, sizeof(s->srp_ctx));
  61. s->srp_ctx.SRP_cb_arg = ctx->srp_ctx.SRP_cb_arg;
  62. /* set client Hello login callback */
  63. s->srp_ctx.TLS_ext_srp_username_callback =
  64. ctx->srp_ctx.TLS_ext_srp_username_callback;
  65. /* set SRP N/g param callback for verification */
  66. s->srp_ctx.SRP_verify_param_callback =
  67. ctx->srp_ctx.SRP_verify_param_callback;
  68. /* set SRP client passwd callback */
  69. s->srp_ctx.SRP_give_srp_client_pwd_callback =
  70. ctx->srp_ctx.SRP_give_srp_client_pwd_callback;
  71. s->srp_ctx.strength = ctx->srp_ctx.strength;
  72. if (((ctx->srp_ctx.N != NULL) &&
  73. ((s->srp_ctx.N = BN_dup(ctx->srp_ctx.N)) == NULL)) ||
  74. ((ctx->srp_ctx.g != NULL) &&
  75. ((s->srp_ctx.g = BN_dup(ctx->srp_ctx.g)) == NULL)) ||
  76. ((ctx->srp_ctx.s != NULL) &&
  77. ((s->srp_ctx.s = BN_dup(ctx->srp_ctx.s)) == NULL)) ||
  78. ((ctx->srp_ctx.B != NULL) &&
  79. ((s->srp_ctx.B = BN_dup(ctx->srp_ctx.B)) == NULL)) ||
  80. ((ctx->srp_ctx.A != NULL) &&
  81. ((s->srp_ctx.A = BN_dup(ctx->srp_ctx.A)) == NULL)) ||
  82. ((ctx->srp_ctx.a != NULL) &&
  83. ((s->srp_ctx.a = BN_dup(ctx->srp_ctx.a)) == NULL)) ||
  84. ((ctx->srp_ctx.v != NULL) &&
  85. ((s->srp_ctx.v = BN_dup(ctx->srp_ctx.v)) == NULL)) ||
  86. ((ctx->srp_ctx.b != NULL) &&
  87. ((s->srp_ctx.b = BN_dup(ctx->srp_ctx.b)) == NULL))) {
  88. SSLerr(SSL_F_SSL_SRP_CTX_INIT, ERR_R_BN_LIB);
  89. goto err;
  90. }
  91. if ((ctx->srp_ctx.login != NULL) &&
  92. ((s->srp_ctx.login = OPENSSL_strdup(ctx->srp_ctx.login)) == NULL)) {
  93. SSLerr(SSL_F_SSL_SRP_CTX_INIT, ERR_R_INTERNAL_ERROR);
  94. goto err;
  95. }
  96. if ((ctx->srp_ctx.info != NULL) &&
  97. ((s->srp_ctx.info = BUF_strdup(ctx->srp_ctx.info)) == NULL)) {
  98. SSLerr(SSL_F_SSL_SRP_CTX_INIT, ERR_R_INTERNAL_ERROR);
  99. goto err;
  100. }
  101. s->srp_ctx.srp_Mask = ctx->srp_ctx.srp_Mask;
  102. return 1;
  103. err:
  104. OPENSSL_free(s->srp_ctx.login);
  105. OPENSSL_free(s->srp_ctx.info);
  106. BN_free(s->srp_ctx.N);
  107. BN_free(s->srp_ctx.g);
  108. BN_free(s->srp_ctx.s);
  109. BN_free(s->srp_ctx.B);
  110. BN_free(s->srp_ctx.A);
  111. BN_free(s->srp_ctx.a);
  112. BN_free(s->srp_ctx.b);
  113. BN_free(s->srp_ctx.v);
  114. memset(&s->srp_ctx, 0, sizeof(s->srp_ctx));
  115. return 0;
  116. }
  117. int SSL_CTX_SRP_CTX_init(struct ssl_ctx_st *ctx)
  118. {
  119. if (ctx == NULL)
  120. return 0;
  121. memset(&ctx->srp_ctx, 0, sizeof(ctx->srp_ctx));
  122. ctx->srp_ctx.strength = SRP_MINIMAL_N;
  123. return 1;
  124. }
  125. /* server side */
  126. int SSL_srp_server_param_with_username(SSL *s, int *ad)
  127. {
  128. unsigned char b[SSL_MAX_MASTER_KEY_LENGTH];
  129. int al;
  130. *ad = SSL_AD_UNKNOWN_PSK_IDENTITY;
  131. if ((s->srp_ctx.TLS_ext_srp_username_callback != NULL) &&
  132. ((al =
  133. s->srp_ctx.TLS_ext_srp_username_callback(s, ad,
  134. s->srp_ctx.SRP_cb_arg)) !=
  135. SSL_ERROR_NONE))
  136. return al;
  137. *ad = SSL_AD_INTERNAL_ERROR;
  138. if ((s->srp_ctx.N == NULL) ||
  139. (s->srp_ctx.g == NULL) ||
  140. (s->srp_ctx.s == NULL) || (s->srp_ctx.v == NULL))
  141. return SSL3_AL_FATAL;
  142. if (RAND_priv_bytes(b, sizeof(b)) <= 0)
  143. return SSL3_AL_FATAL;
  144. s->srp_ctx.b = BN_bin2bn(b, sizeof(b), NULL);
  145. OPENSSL_cleanse(b, sizeof(b));
  146. /* Calculate: B = (kv + g^b) % N */
  147. return ((s->srp_ctx.B =
  148. SRP_Calc_B(s->srp_ctx.b, s->srp_ctx.N, s->srp_ctx.g,
  149. s->srp_ctx.v)) !=
  150. NULL) ? SSL_ERROR_NONE : SSL3_AL_FATAL;
  151. }
  152. /*
  153. * If the server just has the raw password, make up a verifier entry on the
  154. * fly
  155. */
  156. int SSL_set_srp_server_param_pw(SSL *s, const char *user, const char *pass,
  157. const char *grp)
  158. {
  159. SRP_gN *GN = SRP_get_default_gN(grp);
  160. if (GN == NULL)
  161. return -1;
  162. s->srp_ctx.N = BN_dup(GN->N);
  163. s->srp_ctx.g = BN_dup(GN->g);
  164. BN_clear_free(s->srp_ctx.v);
  165. s->srp_ctx.v = NULL;
  166. BN_clear_free(s->srp_ctx.s);
  167. s->srp_ctx.s = NULL;
  168. if (!SRP_create_verifier_BN
  169. (user, pass, &s->srp_ctx.s, &s->srp_ctx.v, GN->N, GN->g))
  170. return -1;
  171. return 1;
  172. }
  173. int SSL_set_srp_server_param(SSL *s, const BIGNUM *N, const BIGNUM *g,
  174. BIGNUM *sa, BIGNUM *v, char *info)
  175. {
  176. if (N != NULL) {
  177. if (s->srp_ctx.N != NULL) {
  178. if (!BN_copy(s->srp_ctx.N, N)) {
  179. BN_free(s->srp_ctx.N);
  180. s->srp_ctx.N = NULL;
  181. }
  182. } else
  183. s->srp_ctx.N = BN_dup(N);
  184. }
  185. if (g != NULL) {
  186. if (s->srp_ctx.g != NULL) {
  187. if (!BN_copy(s->srp_ctx.g, g)) {
  188. BN_free(s->srp_ctx.g);
  189. s->srp_ctx.g = NULL;
  190. }
  191. } else
  192. s->srp_ctx.g = BN_dup(g);
  193. }
  194. if (sa != NULL) {
  195. if (s->srp_ctx.s != NULL) {
  196. if (!BN_copy(s->srp_ctx.s, sa)) {
  197. BN_free(s->srp_ctx.s);
  198. s->srp_ctx.s = NULL;
  199. }
  200. } else
  201. s->srp_ctx.s = BN_dup(sa);
  202. }
  203. if (v != NULL) {
  204. if (s->srp_ctx.v != NULL) {
  205. if (!BN_copy(s->srp_ctx.v, v)) {
  206. BN_free(s->srp_ctx.v);
  207. s->srp_ctx.v = NULL;
  208. }
  209. } else
  210. s->srp_ctx.v = BN_dup(v);
  211. }
  212. if (info != NULL) {
  213. if (s->srp_ctx.info)
  214. OPENSSL_free(s->srp_ctx.info);
  215. if ((s->srp_ctx.info = BUF_strdup(info)) == NULL)
  216. return -1;
  217. }
  218. if (!(s->srp_ctx.N) ||
  219. !(s->srp_ctx.g) || !(s->srp_ctx.s) || !(s->srp_ctx.v))
  220. return -1;
  221. return 1;
  222. }
  223. int srp_generate_server_master_secret(SSL *s)
  224. {
  225. BIGNUM *K = NULL, *u = NULL;
  226. int ret = -1, tmp_len = 0;
  227. unsigned char *tmp = NULL;
  228. if (!SRP_Verify_A_mod_N(s->srp_ctx.A, s->srp_ctx.N))
  229. goto err;
  230. if ((u = SRP_Calc_u(s->srp_ctx.A, s->srp_ctx.B, s->srp_ctx.N)) == NULL)
  231. goto err;
  232. if ((K = SRP_Calc_server_key(s->srp_ctx.A, s->srp_ctx.v, u, s->srp_ctx.b,
  233. s->srp_ctx.N)) == NULL)
  234. goto err;
  235. tmp_len = BN_num_bytes(K);
  236. if ((tmp = OPENSSL_malloc(tmp_len)) == NULL) {
  237. SSLfatal(s, SSL_AD_INTERNAL_ERROR,
  238. SSL_F_SRP_GENERATE_SERVER_MASTER_SECRET, ERR_R_MALLOC_FAILURE);
  239. goto err;
  240. }
  241. BN_bn2bin(K, tmp);
  242. /* Calls SSLfatal() as required */
  243. ret = ssl_generate_master_secret(s, tmp, tmp_len, 1);
  244. err:
  245. BN_clear_free(K);
  246. BN_clear_free(u);
  247. return ret;
  248. }
  249. /* client side */
  250. int srp_generate_client_master_secret(SSL *s)
  251. {
  252. BIGNUM *x = NULL, *u = NULL, *K = NULL;
  253. int ret = -1, tmp_len = 0;
  254. char *passwd = NULL;
  255. unsigned char *tmp = NULL;
  256. /*
  257. * Checks if b % n == 0
  258. */
  259. if (SRP_Verify_B_mod_N(s->srp_ctx.B, s->srp_ctx.N) == 0
  260. || (u = SRP_Calc_u(s->srp_ctx.A, s->srp_ctx.B, s->srp_ctx.N))
  261. == NULL
  262. || s->srp_ctx.SRP_give_srp_client_pwd_callback == NULL) {
  263. SSLfatal(s, SSL_AD_INTERNAL_ERROR,
  264. SSL_F_SRP_GENERATE_CLIENT_MASTER_SECRET, ERR_R_INTERNAL_ERROR);
  265. goto err;
  266. }
  267. if ((passwd = s->srp_ctx.SRP_give_srp_client_pwd_callback(s,
  268. s->srp_ctx.SRP_cb_arg))
  269. == NULL) {
  270. SSLfatal(s, SSL_AD_INTERNAL_ERROR,
  271. SSL_F_SRP_GENERATE_CLIENT_MASTER_SECRET,
  272. SSL_R_CALLBACK_FAILED);
  273. goto err;
  274. }
  275. if ((x = SRP_Calc_x(s->srp_ctx.s, s->srp_ctx.login, passwd)) == NULL
  276. || (K = SRP_Calc_client_key(s->srp_ctx.N, s->srp_ctx.B,
  277. s->srp_ctx.g, x,
  278. s->srp_ctx.a, u)) == NULL) {
  279. SSLfatal(s, SSL_AD_INTERNAL_ERROR,
  280. SSL_F_SRP_GENERATE_CLIENT_MASTER_SECRET, ERR_R_INTERNAL_ERROR);
  281. goto err;
  282. }
  283. tmp_len = BN_num_bytes(K);
  284. if ((tmp = OPENSSL_malloc(tmp_len)) == NULL) {
  285. SSLfatal(s, SSL_AD_INTERNAL_ERROR,
  286. SSL_F_SRP_GENERATE_CLIENT_MASTER_SECRET, ERR_R_MALLOC_FAILURE);
  287. goto err;
  288. }
  289. BN_bn2bin(K, tmp);
  290. /* Calls SSLfatal() as required */
  291. ret = ssl_generate_master_secret(s, tmp, tmp_len, 1);
  292. err:
  293. BN_clear_free(K);
  294. BN_clear_free(x);
  295. if (passwd != NULL)
  296. OPENSSL_clear_free(passwd, strlen(passwd));
  297. BN_clear_free(u);
  298. return ret;
  299. }
  300. int srp_verify_server_param(SSL *s)
  301. {
  302. SRP_CTX *srp = &s->srp_ctx;
  303. /*
  304. * Sanity check parameters: we can quickly check B % N == 0 by checking B
  305. * != 0 since B < N
  306. */
  307. if (BN_ucmp(srp->g, srp->N) >= 0 || BN_ucmp(srp->B, srp->N) >= 0
  308. || BN_is_zero(srp->B)) {
  309. SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_SRP_VERIFY_SERVER_PARAM,
  310. SSL_R_BAD_DATA);
  311. return 0;
  312. }
  313. if (BN_num_bits(srp->N) < srp->strength) {
  314. SSLfatal(s, SSL_AD_INSUFFICIENT_SECURITY, SSL_F_SRP_VERIFY_SERVER_PARAM,
  315. SSL_R_INSUFFICIENT_SECURITY);
  316. return 0;
  317. }
  318. if (srp->SRP_verify_param_callback) {
  319. if (srp->SRP_verify_param_callback(s, srp->SRP_cb_arg) <= 0) {
  320. SSLfatal(s, SSL_AD_INSUFFICIENT_SECURITY,
  321. SSL_F_SRP_VERIFY_SERVER_PARAM,
  322. SSL_R_CALLBACK_FAILED);
  323. return 0;
  324. }
  325. } else if (!SRP_check_known_gN_param(srp->g, srp->N)) {
  326. SSLfatal(s, SSL_AD_INSUFFICIENT_SECURITY, SSL_F_SRP_VERIFY_SERVER_PARAM,
  327. SSL_R_INSUFFICIENT_SECURITY);
  328. return 0;
  329. }
  330. return 1;
  331. }
  332. int SRP_Calc_A_param(SSL *s)
  333. {
  334. unsigned char rnd[SSL_MAX_MASTER_KEY_LENGTH];
  335. if (RAND_priv_bytes(rnd, sizeof(rnd)) <= 0)
  336. return 0;
  337. s->srp_ctx.a = BN_bin2bn(rnd, sizeof(rnd), s->srp_ctx.a);
  338. OPENSSL_cleanse(rnd, sizeof(rnd));
  339. if (!(s->srp_ctx.A = SRP_Calc_A(s->srp_ctx.a, s->srp_ctx.N, s->srp_ctx.g)))
  340. return 0;
  341. return 1;
  342. }
  343. BIGNUM *SSL_get_srp_g(SSL *s)
  344. {
  345. if (s->srp_ctx.g != NULL)
  346. return s->srp_ctx.g;
  347. return s->ctx->srp_ctx.g;
  348. }
  349. BIGNUM *SSL_get_srp_N(SSL *s)
  350. {
  351. if (s->srp_ctx.N != NULL)
  352. return s->srp_ctx.N;
  353. return s->ctx->srp_ctx.N;
  354. }
  355. char *SSL_get_srp_username(SSL *s)
  356. {
  357. if (s->srp_ctx.login != NULL)
  358. return s->srp_ctx.login;
  359. return s->ctx->srp_ctx.login;
  360. }
  361. char *SSL_get_srp_userinfo(SSL *s)
  362. {
  363. if (s->srp_ctx.info != NULL)
  364. return s->srp_ctx.info;
  365. return s->ctx->srp_ctx.info;
  366. }
  367. # define tls1_ctx_ctrl ssl3_ctx_ctrl
  368. # define tls1_ctx_callback_ctrl ssl3_ctx_callback_ctrl
  369. int SSL_CTX_set_srp_username(SSL_CTX *ctx, char *name)
  370. {
  371. return tls1_ctx_ctrl(ctx, SSL_CTRL_SET_TLS_EXT_SRP_USERNAME, 0, name);
  372. }
  373. int SSL_CTX_set_srp_password(SSL_CTX *ctx, char *password)
  374. {
  375. return tls1_ctx_ctrl(ctx, SSL_CTRL_SET_TLS_EXT_SRP_PASSWORD, 0, password);
  376. }
  377. int SSL_CTX_set_srp_strength(SSL_CTX *ctx, int strength)
  378. {
  379. return tls1_ctx_ctrl(ctx, SSL_CTRL_SET_TLS_EXT_SRP_STRENGTH, strength,
  380. NULL);
  381. }
  382. int SSL_CTX_set_srp_verify_param_callback(SSL_CTX *ctx,
  383. int (*cb) (SSL *, void *))
  384. {
  385. return tls1_ctx_callback_ctrl(ctx, SSL_CTRL_SET_SRP_VERIFY_PARAM_CB,
  386. (void (*)(void))cb);
  387. }
  388. int SSL_CTX_set_srp_cb_arg(SSL_CTX *ctx, void *arg)
  389. {
  390. return tls1_ctx_ctrl(ctx, SSL_CTRL_SET_SRP_ARG, 0, arg);
  391. }
  392. int SSL_CTX_set_srp_username_callback(SSL_CTX *ctx,
  393. int (*cb) (SSL *, int *, void *))
  394. {
  395. return tls1_ctx_callback_ctrl(ctx, SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB,
  396. (void (*)(void))cb);
  397. }
  398. int SSL_CTX_set_srp_client_pwd_callback(SSL_CTX *ctx,
  399. char *(*cb) (SSL *, void *))
  400. {
  401. return tls1_ctx_callback_ctrl(ctx, SSL_CTRL_SET_SRP_GIVE_CLIENT_PWD_CB,
  402. (void (*)(void))cb);
  403. }
  404. #endif