dh_exch.c 15 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511
  1. /*
  2. * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. /*
  10. * DH low level APIs are deprecated for public use, but still ok for
  11. * internal use.
  12. */
  13. #include "internal/deprecated.h"
  14. #include <string.h>
  15. #include <openssl/crypto.h>
  16. #include <openssl/core_dispatch.h>
  17. #include <openssl/core_names.h>
  18. #include <openssl/dh.h>
  19. #include <openssl/err.h>
  20. #include <openssl/proverr.h>
  21. #include <openssl/params.h>
  22. #include "prov/providercommon.h"
  23. #include "prov/implementations.h"
  24. #include "prov/provider_ctx.h"
  25. #include "prov/securitycheck.h"
  26. #include "crypto/dh.h"
  27. static OSSL_FUNC_keyexch_newctx_fn dh_newctx;
  28. static OSSL_FUNC_keyexch_init_fn dh_init;
  29. static OSSL_FUNC_keyexch_set_peer_fn dh_set_peer;
  30. static OSSL_FUNC_keyexch_derive_fn dh_derive;
  31. static OSSL_FUNC_keyexch_freectx_fn dh_freectx;
  32. static OSSL_FUNC_keyexch_dupctx_fn dh_dupctx;
  33. static OSSL_FUNC_keyexch_set_ctx_params_fn dh_set_ctx_params;
  34. static OSSL_FUNC_keyexch_settable_ctx_params_fn dh_settable_ctx_params;
  35. static OSSL_FUNC_keyexch_get_ctx_params_fn dh_get_ctx_params;
  36. static OSSL_FUNC_keyexch_gettable_ctx_params_fn dh_gettable_ctx_params;
  37. /*
  38. * This type is only really used to handle some legacy related functionality.
  39. * If you need to use other KDF's (such as SSKDF) just use PROV_DH_KDF_NONE
  40. * here and then create and run a KDF after the key is derived.
  41. * Note that X942 has 2 variants of key derivation:
  42. * (1) DH_KDF_X9_42_ASN1 - which contains an ANS1 encoded object that has
  43. * the counter embedded in it.
  44. * (2) DH_KDF_X941_CONCAT - which is the same as ECDH_X963_KDF (which can be
  45. * done by creating a "X963KDF".
  46. */
  47. enum kdf_type {
  48. PROV_DH_KDF_NONE = 0,
  49. PROV_DH_KDF_X9_42_ASN1
  50. };
  51. /*
  52. * What's passed as an actual key is defined by the KEYMGMT interface.
  53. * We happen to know that our KEYMGMT simply passes DH structures, so
  54. * we use that here too.
  55. */
  56. typedef struct {
  57. OSSL_LIB_CTX *libctx;
  58. DH *dh;
  59. DH *dhpeer;
  60. unsigned int pad : 1;
  61. /* DH KDF */
  62. /* KDF (if any) to use for DH */
  63. enum kdf_type kdf_type;
  64. /* Message digest to use for key derivation */
  65. EVP_MD *kdf_md;
  66. /* User key material */
  67. unsigned char *kdf_ukm;
  68. size_t kdf_ukmlen;
  69. /* KDF output length */
  70. size_t kdf_outlen;
  71. char *kdf_cekalg;
  72. } PROV_DH_CTX;
  73. static void *dh_newctx(void *provctx)
  74. {
  75. PROV_DH_CTX *pdhctx;
  76. if (!ossl_prov_is_running())
  77. return NULL;
  78. pdhctx = OPENSSL_zalloc(sizeof(PROV_DH_CTX));
  79. if (pdhctx == NULL)
  80. return NULL;
  81. pdhctx->libctx = PROV_LIBCTX_OF(provctx);
  82. pdhctx->kdf_type = PROV_DH_KDF_NONE;
  83. return pdhctx;
  84. }
  85. static int dh_init(void *vpdhctx, void *vdh, const OSSL_PARAM params[])
  86. {
  87. PROV_DH_CTX *pdhctx = (PROV_DH_CTX *)vpdhctx;
  88. if (!ossl_prov_is_running()
  89. || pdhctx == NULL
  90. || vdh == NULL
  91. || !DH_up_ref(vdh))
  92. return 0;
  93. DH_free(pdhctx->dh);
  94. pdhctx->dh = vdh;
  95. pdhctx->kdf_type = PROV_DH_KDF_NONE;
  96. return dh_set_ctx_params(pdhctx, params)
  97. && ossl_dh_check_key(pdhctx->libctx, vdh);
  98. }
  99. /* The 2 parties must share the same domain parameters */
  100. static int dh_match_params(DH *priv, DH *peer)
  101. {
  102. int ret;
  103. FFC_PARAMS *dhparams_priv = ossl_dh_get0_params(priv);
  104. FFC_PARAMS *dhparams_peer = ossl_dh_get0_params(peer);
  105. ret = dhparams_priv != NULL
  106. && dhparams_peer != NULL
  107. && ossl_ffc_params_cmp(dhparams_priv, dhparams_peer, 1);
  108. if (!ret)
  109. ERR_raise(ERR_LIB_PROV, PROV_R_MISMATCHING_DOMAIN_PARAMETERS);
  110. return ret;
  111. }
  112. static int dh_set_peer(void *vpdhctx, void *vdh)
  113. {
  114. PROV_DH_CTX *pdhctx = (PROV_DH_CTX *)vpdhctx;
  115. if (!ossl_prov_is_running()
  116. || pdhctx == NULL
  117. || vdh == NULL
  118. || !dh_match_params(vdh, pdhctx->dh)
  119. || !DH_up_ref(vdh))
  120. return 0;
  121. DH_free(pdhctx->dhpeer);
  122. pdhctx->dhpeer = vdh;
  123. return 1;
  124. }
  125. static int dh_plain_derive(void *vpdhctx,
  126. unsigned char *secret, size_t *secretlen,
  127. size_t outlen, unsigned int pad)
  128. {
  129. PROV_DH_CTX *pdhctx = (PROV_DH_CTX *)vpdhctx;
  130. int ret;
  131. size_t dhsize;
  132. const BIGNUM *pub_key = NULL;
  133. if (pdhctx->dh == NULL || pdhctx->dhpeer == NULL) {
  134. ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_KEY);
  135. return 0;
  136. }
  137. dhsize = (size_t)DH_size(pdhctx->dh);
  138. if (secret == NULL) {
  139. *secretlen = dhsize;
  140. return 1;
  141. }
  142. if (outlen < dhsize) {
  143. ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL);
  144. return 0;
  145. }
  146. DH_get0_key(pdhctx->dhpeer, &pub_key, NULL);
  147. if (pad)
  148. ret = DH_compute_key_padded(secret, pub_key, pdhctx->dh);
  149. else
  150. ret = DH_compute_key(secret, pub_key, pdhctx->dh);
  151. if (ret <= 0)
  152. return 0;
  153. *secretlen = ret;
  154. return 1;
  155. }
  156. static int dh_X9_42_kdf_derive(void *vpdhctx, unsigned char *secret,
  157. size_t *secretlen, size_t outlen)
  158. {
  159. PROV_DH_CTX *pdhctx = (PROV_DH_CTX *)vpdhctx;
  160. unsigned char *stmp = NULL;
  161. size_t stmplen;
  162. int ret = 0;
  163. if (secret == NULL) {
  164. *secretlen = pdhctx->kdf_outlen;
  165. return 1;
  166. }
  167. if (pdhctx->kdf_outlen > outlen) {
  168. ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL);
  169. return 0;
  170. }
  171. if (!dh_plain_derive(pdhctx, NULL, &stmplen, 0, 1))
  172. return 0;
  173. if ((stmp = OPENSSL_secure_malloc(stmplen)) == NULL)
  174. return 0;
  175. if (!dh_plain_derive(pdhctx, stmp, &stmplen, stmplen, 1))
  176. goto err;
  177. /* Do KDF stuff */
  178. if (pdhctx->kdf_type == PROV_DH_KDF_X9_42_ASN1) {
  179. if (!ossl_dh_kdf_X9_42_asn1(secret, pdhctx->kdf_outlen,
  180. stmp, stmplen,
  181. pdhctx->kdf_cekalg,
  182. pdhctx->kdf_ukm,
  183. pdhctx->kdf_ukmlen,
  184. pdhctx->kdf_md,
  185. pdhctx->libctx, NULL))
  186. goto err;
  187. }
  188. *secretlen = pdhctx->kdf_outlen;
  189. ret = 1;
  190. err:
  191. OPENSSL_secure_clear_free(stmp, stmplen);
  192. return ret;
  193. }
  194. static int dh_derive(void *vpdhctx, unsigned char *secret,
  195. size_t *psecretlen, size_t outlen)
  196. {
  197. PROV_DH_CTX *pdhctx = (PROV_DH_CTX *)vpdhctx;
  198. if (!ossl_prov_is_running())
  199. return 0;
  200. switch (pdhctx->kdf_type) {
  201. case PROV_DH_KDF_NONE:
  202. return dh_plain_derive(pdhctx, secret, psecretlen, outlen,
  203. pdhctx->pad);
  204. case PROV_DH_KDF_X9_42_ASN1:
  205. return dh_X9_42_kdf_derive(pdhctx, secret, psecretlen, outlen);
  206. default:
  207. break;
  208. }
  209. return 0;
  210. }
  211. static void dh_freectx(void *vpdhctx)
  212. {
  213. PROV_DH_CTX *pdhctx = (PROV_DH_CTX *)vpdhctx;
  214. OPENSSL_free(pdhctx->kdf_cekalg);
  215. DH_free(pdhctx->dh);
  216. DH_free(pdhctx->dhpeer);
  217. EVP_MD_free(pdhctx->kdf_md);
  218. OPENSSL_clear_free(pdhctx->kdf_ukm, pdhctx->kdf_ukmlen);
  219. OPENSSL_free(pdhctx);
  220. }
  221. static void *dh_dupctx(void *vpdhctx)
  222. {
  223. PROV_DH_CTX *srcctx = (PROV_DH_CTX *)vpdhctx;
  224. PROV_DH_CTX *dstctx;
  225. if (!ossl_prov_is_running())
  226. return NULL;
  227. dstctx = OPENSSL_zalloc(sizeof(*srcctx));
  228. if (dstctx == NULL)
  229. return NULL;
  230. *dstctx = *srcctx;
  231. dstctx->dh = NULL;
  232. dstctx->dhpeer = NULL;
  233. dstctx->kdf_md = NULL;
  234. dstctx->kdf_ukm = NULL;
  235. dstctx->kdf_cekalg = NULL;
  236. if (srcctx->dh != NULL && !DH_up_ref(srcctx->dh))
  237. goto err;
  238. else
  239. dstctx->dh = srcctx->dh;
  240. if (srcctx->dhpeer != NULL && !DH_up_ref(srcctx->dhpeer))
  241. goto err;
  242. else
  243. dstctx->dhpeer = srcctx->dhpeer;
  244. if (srcctx->kdf_md != NULL && !EVP_MD_up_ref(srcctx->kdf_md))
  245. goto err;
  246. else
  247. dstctx->kdf_md = srcctx->kdf_md;
  248. /* Duplicate UKM data if present */
  249. if (srcctx->kdf_ukm != NULL && srcctx->kdf_ukmlen > 0) {
  250. dstctx->kdf_ukm = OPENSSL_memdup(srcctx->kdf_ukm,
  251. srcctx->kdf_ukmlen);
  252. if (dstctx->kdf_ukm == NULL)
  253. goto err;
  254. }
  255. if (srcctx->kdf_cekalg != NULL) {
  256. dstctx->kdf_cekalg = OPENSSL_strdup(srcctx->kdf_cekalg);
  257. if (dstctx->kdf_cekalg == NULL)
  258. goto err;
  259. }
  260. return dstctx;
  261. err:
  262. dh_freectx(dstctx);
  263. return NULL;
  264. }
  265. static int dh_set_ctx_params(void *vpdhctx, const OSSL_PARAM params[])
  266. {
  267. PROV_DH_CTX *pdhctx = (PROV_DH_CTX *)vpdhctx;
  268. const OSSL_PARAM *p;
  269. unsigned int pad;
  270. char name[80] = { '\0' }; /* should be big enough */
  271. char *str = NULL;
  272. if (pdhctx == NULL)
  273. return 0;
  274. if (params == NULL)
  275. return 1;
  276. p = OSSL_PARAM_locate_const(params, OSSL_EXCHANGE_PARAM_KDF_TYPE);
  277. if (p != NULL) {
  278. str = name;
  279. if (!OSSL_PARAM_get_utf8_string(p, &str, sizeof(name)))
  280. return 0;
  281. if (name[0] == '\0')
  282. pdhctx->kdf_type = PROV_DH_KDF_NONE;
  283. else if (strcmp(name, OSSL_KDF_NAME_X942KDF_ASN1) == 0)
  284. pdhctx->kdf_type = PROV_DH_KDF_X9_42_ASN1;
  285. else
  286. return 0;
  287. }
  288. p = OSSL_PARAM_locate_const(params, OSSL_EXCHANGE_PARAM_KDF_DIGEST);
  289. if (p != NULL) {
  290. char mdprops[80] = { '\0' }; /* should be big enough */
  291. str = name;
  292. if (!OSSL_PARAM_get_utf8_string(p, &str, sizeof(name)))
  293. return 0;
  294. str = mdprops;
  295. p = OSSL_PARAM_locate_const(params,
  296. OSSL_EXCHANGE_PARAM_KDF_DIGEST_PROPS);
  297. if (p != NULL) {
  298. if (!OSSL_PARAM_get_utf8_string(p, &str, sizeof(mdprops)))
  299. return 0;
  300. }
  301. EVP_MD_free(pdhctx->kdf_md);
  302. pdhctx->kdf_md = EVP_MD_fetch(pdhctx->libctx, name, mdprops);
  303. if (pdhctx->kdf_md == NULL)
  304. return 0;
  305. if (!ossl_digest_is_allowed(pdhctx->libctx, pdhctx->kdf_md)) {
  306. EVP_MD_free(pdhctx->kdf_md);
  307. pdhctx->kdf_md = NULL;
  308. return 0;
  309. }
  310. }
  311. p = OSSL_PARAM_locate_const(params, OSSL_EXCHANGE_PARAM_KDF_OUTLEN);
  312. if (p != NULL) {
  313. size_t outlen;
  314. if (!OSSL_PARAM_get_size_t(p, &outlen))
  315. return 0;
  316. pdhctx->kdf_outlen = outlen;
  317. }
  318. p = OSSL_PARAM_locate_const(params, OSSL_EXCHANGE_PARAM_KDF_UKM);
  319. if (p != NULL) {
  320. void *tmp_ukm = NULL;
  321. size_t tmp_ukmlen;
  322. OPENSSL_free(pdhctx->kdf_ukm);
  323. pdhctx->kdf_ukm = NULL;
  324. pdhctx->kdf_ukmlen = 0;
  325. /* ukm is an optional field so it can be NULL */
  326. if (p->data != NULL && p->data_size != 0) {
  327. if (!OSSL_PARAM_get_octet_string(p, &tmp_ukm, 0, &tmp_ukmlen))
  328. return 0;
  329. pdhctx->kdf_ukm = tmp_ukm;
  330. pdhctx->kdf_ukmlen = tmp_ukmlen;
  331. }
  332. }
  333. p = OSSL_PARAM_locate_const(params, OSSL_EXCHANGE_PARAM_PAD);
  334. if (p != NULL) {
  335. if (!OSSL_PARAM_get_uint(p, &pad))
  336. return 0;
  337. pdhctx->pad = pad ? 1 : 0;
  338. }
  339. p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_CEK_ALG);
  340. if (p != NULL) {
  341. str = name;
  342. OPENSSL_free(pdhctx->kdf_cekalg);
  343. pdhctx->kdf_cekalg = NULL;
  344. if (p->data != NULL && p->data_size != 0) {
  345. if (!OSSL_PARAM_get_utf8_string(p, &str, sizeof(name)))
  346. return 0;
  347. pdhctx->kdf_cekalg = OPENSSL_strdup(name);
  348. if (pdhctx->kdf_cekalg == NULL)
  349. return 0;
  350. }
  351. }
  352. return 1;
  353. }
  354. static const OSSL_PARAM known_settable_ctx_params[] = {
  355. OSSL_PARAM_int(OSSL_EXCHANGE_PARAM_PAD, NULL),
  356. OSSL_PARAM_utf8_string(OSSL_EXCHANGE_PARAM_KDF_TYPE, NULL, 0),
  357. OSSL_PARAM_utf8_string(OSSL_EXCHANGE_PARAM_KDF_DIGEST, NULL, 0),
  358. OSSL_PARAM_utf8_string(OSSL_EXCHANGE_PARAM_KDF_DIGEST_PROPS, NULL, 0),
  359. OSSL_PARAM_size_t(OSSL_EXCHANGE_PARAM_KDF_OUTLEN, NULL),
  360. OSSL_PARAM_octet_string(OSSL_EXCHANGE_PARAM_KDF_UKM, NULL, 0),
  361. OSSL_PARAM_utf8_string(OSSL_KDF_PARAM_CEK_ALG, NULL, 0),
  362. OSSL_PARAM_END
  363. };
  364. static const OSSL_PARAM *dh_settable_ctx_params(ossl_unused void *vpdhctx,
  365. ossl_unused void *provctx)
  366. {
  367. return known_settable_ctx_params;
  368. }
  369. static const OSSL_PARAM known_gettable_ctx_params[] = {
  370. OSSL_PARAM_utf8_string(OSSL_EXCHANGE_PARAM_KDF_TYPE, NULL, 0),
  371. OSSL_PARAM_utf8_string(OSSL_EXCHANGE_PARAM_KDF_DIGEST, NULL, 0),
  372. OSSL_PARAM_size_t(OSSL_EXCHANGE_PARAM_KDF_OUTLEN, NULL),
  373. OSSL_PARAM_DEFN(OSSL_EXCHANGE_PARAM_KDF_UKM, OSSL_PARAM_OCTET_PTR,
  374. NULL, 0),
  375. OSSL_PARAM_utf8_string(OSSL_KDF_PARAM_CEK_ALG, NULL, 0),
  376. OSSL_PARAM_END
  377. };
  378. static const OSSL_PARAM *dh_gettable_ctx_params(ossl_unused void *vpdhctx,
  379. ossl_unused void *provctx)
  380. {
  381. return known_gettable_ctx_params;
  382. }
  383. static int dh_get_ctx_params(void *vpdhctx, OSSL_PARAM params[])
  384. {
  385. PROV_DH_CTX *pdhctx = (PROV_DH_CTX *)vpdhctx;
  386. OSSL_PARAM *p;
  387. if (pdhctx == NULL)
  388. return 0;
  389. p = OSSL_PARAM_locate(params, OSSL_EXCHANGE_PARAM_KDF_TYPE);
  390. if (p != NULL) {
  391. const char *kdf_type = NULL;
  392. switch (pdhctx->kdf_type) {
  393. case PROV_DH_KDF_NONE:
  394. kdf_type = "";
  395. break;
  396. case PROV_DH_KDF_X9_42_ASN1:
  397. kdf_type = OSSL_KDF_NAME_X942KDF_ASN1;
  398. break;
  399. default:
  400. return 0;
  401. }
  402. if (!OSSL_PARAM_set_utf8_string(p, kdf_type))
  403. return 0;
  404. }
  405. p = OSSL_PARAM_locate(params, OSSL_EXCHANGE_PARAM_KDF_DIGEST);
  406. if (p != NULL
  407. && !OSSL_PARAM_set_utf8_string(p, pdhctx->kdf_md == NULL
  408. ? ""
  409. : EVP_MD_get0_name(pdhctx->kdf_md))) {
  410. return 0;
  411. }
  412. p = OSSL_PARAM_locate(params, OSSL_EXCHANGE_PARAM_KDF_OUTLEN);
  413. if (p != NULL && !OSSL_PARAM_set_size_t(p, pdhctx->kdf_outlen))
  414. return 0;
  415. p = OSSL_PARAM_locate(params, OSSL_EXCHANGE_PARAM_KDF_UKM);
  416. if (p != NULL
  417. && !OSSL_PARAM_set_octet_ptr(p, pdhctx->kdf_ukm, pdhctx->kdf_ukmlen))
  418. return 0;
  419. p = OSSL_PARAM_locate(params, OSSL_KDF_PARAM_CEK_ALG);
  420. if (p != NULL
  421. && !OSSL_PARAM_set_utf8_string(p, pdhctx->kdf_cekalg == NULL
  422. ? "" : pdhctx->kdf_cekalg))
  423. return 0;
  424. return 1;
  425. }
  426. const OSSL_DISPATCH ossl_dh_keyexch_functions[] = {
  427. { OSSL_FUNC_KEYEXCH_NEWCTX, (void (*)(void))dh_newctx },
  428. { OSSL_FUNC_KEYEXCH_INIT, (void (*)(void))dh_init },
  429. { OSSL_FUNC_KEYEXCH_DERIVE, (void (*)(void))dh_derive },
  430. { OSSL_FUNC_KEYEXCH_SET_PEER, (void (*)(void))dh_set_peer },
  431. { OSSL_FUNC_KEYEXCH_FREECTX, (void (*)(void))dh_freectx },
  432. { OSSL_FUNC_KEYEXCH_DUPCTX, (void (*)(void))dh_dupctx },
  433. { OSSL_FUNC_KEYEXCH_SET_CTX_PARAMS, (void (*)(void))dh_set_ctx_params },
  434. { OSSL_FUNC_KEYEXCH_SETTABLE_CTX_PARAMS,
  435. (void (*)(void))dh_settable_ctx_params },
  436. { OSSL_FUNC_KEYEXCH_GET_CTX_PARAMS, (void (*)(void))dh_get_ctx_params },
  437. { OSSL_FUNC_KEYEXCH_GETTABLE_CTX_PARAMS,
  438. (void (*)(void))dh_gettable_ctx_params },
  439. OSSL_DISPATCH_END
  440. };