srp_lib.c 7.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280
  1. /*
  2. * Copyright 2011-2016 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the OpenSSL license (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #ifndef OPENSSL_NO_SRP
  10. # include "internal/cryptlib.h"
  11. # include <openssl/sha.h>
  12. # include <openssl/srp.h>
  13. # include <openssl/evp.h>
  14. # include "internal/bn_srp.h"
  15. /* calculate = SHA1(PAD(x) || PAD(y)) */
  16. static BIGNUM *srp_Calc_xy(const BIGNUM *x, const BIGNUM *y, const BIGNUM *N)
  17. {
  18. unsigned char digest[SHA_DIGEST_LENGTH];
  19. unsigned char *tmp = NULL;
  20. int numN = BN_num_bytes(N);
  21. BIGNUM *res = NULL;
  22. if (x != N && BN_ucmp(x, N) >= 0)
  23. return NULL;
  24. if (y != N && BN_ucmp(y, N) >= 0)
  25. return NULL;
  26. if ((tmp = OPENSSL_malloc(numN * 2)) == NULL)
  27. goto err;
  28. if (BN_bn2binpad(x, tmp, numN) < 0
  29. || BN_bn2binpad(y, tmp + numN, numN) < 0
  30. || !EVP_Digest(tmp, numN * 2, digest, NULL, EVP_sha1(), NULL))
  31. goto err;
  32. res = BN_bin2bn(digest, sizeof(digest), NULL);
  33. err:
  34. OPENSSL_free(tmp);
  35. return res;
  36. }
  37. static BIGNUM *srp_Calc_k(const BIGNUM *N, const BIGNUM *g)
  38. {
  39. /* k = SHA1(N | PAD(g)) -- tls-srp draft 8 */
  40. return srp_Calc_xy(N, g, N);
  41. }
  42. BIGNUM *SRP_Calc_u(const BIGNUM *A, const BIGNUM *B, const BIGNUM *N)
  43. {
  44. /* k = SHA1(PAD(A) || PAD(B) ) -- tls-srp draft 8 */
  45. return srp_Calc_xy(A, B, N);
  46. }
  47. BIGNUM *SRP_Calc_server_key(const BIGNUM *A, const BIGNUM *v, const BIGNUM *u,
  48. const BIGNUM *b, const BIGNUM *N)
  49. {
  50. BIGNUM *tmp = NULL, *S = NULL;
  51. BN_CTX *bn_ctx;
  52. if (u == NULL || A == NULL || v == NULL || b == NULL || N == NULL)
  53. return NULL;
  54. if ((bn_ctx = BN_CTX_new()) == NULL || (tmp = BN_new()) == NULL)
  55. goto err;
  56. /* S = (A*v**u) ** b */
  57. if (!BN_mod_exp(tmp, v, u, N, bn_ctx))
  58. goto err;
  59. if (!BN_mod_mul(tmp, A, tmp, N, bn_ctx))
  60. goto err;
  61. S = BN_new();
  62. if (S != NULL && !BN_mod_exp(S, tmp, b, N, bn_ctx)) {
  63. BN_free(S);
  64. S = NULL;
  65. }
  66. err:
  67. BN_CTX_free(bn_ctx);
  68. BN_clear_free(tmp);
  69. return S;
  70. }
  71. BIGNUM *SRP_Calc_B(const BIGNUM *b, const BIGNUM *N, const BIGNUM *g,
  72. const BIGNUM *v)
  73. {
  74. BIGNUM *kv = NULL, *gb = NULL;
  75. BIGNUM *B = NULL, *k = NULL;
  76. BN_CTX *bn_ctx;
  77. if (b == NULL || N == NULL || g == NULL || v == NULL ||
  78. (bn_ctx = BN_CTX_new()) == NULL)
  79. return NULL;
  80. if ((kv = BN_new()) == NULL ||
  81. (gb = BN_new()) == NULL || (B = BN_new()) == NULL)
  82. goto err;
  83. /* B = g**b + k*v */
  84. if (!BN_mod_exp(gb, g, b, N, bn_ctx)
  85. || (k = srp_Calc_k(N, g)) == NULL
  86. || !BN_mod_mul(kv, v, k, N, bn_ctx)
  87. || !BN_mod_add(B, gb, kv, N, bn_ctx)) {
  88. BN_free(B);
  89. B = NULL;
  90. }
  91. err:
  92. BN_CTX_free(bn_ctx);
  93. BN_clear_free(kv);
  94. BN_clear_free(gb);
  95. BN_free(k);
  96. return B;
  97. }
  98. BIGNUM *SRP_Calc_x(const BIGNUM *s, const char *user, const char *pass)
  99. {
  100. unsigned char dig[SHA_DIGEST_LENGTH];
  101. EVP_MD_CTX *ctxt;
  102. unsigned char *cs = NULL;
  103. BIGNUM *res = NULL;
  104. if ((s == NULL) || (user == NULL) || (pass == NULL))
  105. return NULL;
  106. ctxt = EVP_MD_CTX_new();
  107. if (ctxt == NULL)
  108. return NULL;
  109. if ((cs = OPENSSL_malloc(BN_num_bytes(s))) == NULL)
  110. goto err;
  111. if (!EVP_DigestInit_ex(ctxt, EVP_sha1(), NULL)
  112. || !EVP_DigestUpdate(ctxt, user, strlen(user))
  113. || !EVP_DigestUpdate(ctxt, ":", 1)
  114. || !EVP_DigestUpdate(ctxt, pass, strlen(pass))
  115. || !EVP_DigestFinal_ex(ctxt, dig, NULL)
  116. || !EVP_DigestInit_ex(ctxt, EVP_sha1(), NULL))
  117. goto err;
  118. BN_bn2bin(s, cs);
  119. if (!EVP_DigestUpdate(ctxt, cs, BN_num_bytes(s)))
  120. goto err;
  121. if (!EVP_DigestUpdate(ctxt, dig, sizeof(dig))
  122. || !EVP_DigestFinal_ex(ctxt, dig, NULL))
  123. goto err;
  124. res = BN_bin2bn(dig, sizeof(dig), NULL);
  125. err:
  126. OPENSSL_free(cs);
  127. EVP_MD_CTX_free(ctxt);
  128. return res;
  129. }
  130. BIGNUM *SRP_Calc_A(const BIGNUM *a, const BIGNUM *N, const BIGNUM *g)
  131. {
  132. BN_CTX *bn_ctx;
  133. BIGNUM *A = NULL;
  134. if (a == NULL || N == NULL || g == NULL || (bn_ctx = BN_CTX_new()) == NULL)
  135. return NULL;
  136. if ((A = BN_new()) != NULL && !BN_mod_exp(A, g, a, N, bn_ctx)) {
  137. BN_free(A);
  138. A = NULL;
  139. }
  140. BN_CTX_free(bn_ctx);
  141. return A;
  142. }
  143. BIGNUM *SRP_Calc_client_key(const BIGNUM *N, const BIGNUM *B, const BIGNUM *g,
  144. const BIGNUM *x, const BIGNUM *a, const BIGNUM *u)
  145. {
  146. BIGNUM *tmp = NULL, *tmp2 = NULL, *tmp3 = NULL, *k = NULL, *K = NULL;
  147. BN_CTX *bn_ctx;
  148. if (u == NULL || B == NULL || N == NULL || g == NULL || x == NULL
  149. || a == NULL || (bn_ctx = BN_CTX_new()) == NULL)
  150. return NULL;
  151. if ((tmp = BN_new()) == NULL ||
  152. (tmp2 = BN_new()) == NULL ||
  153. (tmp3 = BN_new()) == NULL)
  154. goto err;
  155. if (!BN_mod_exp(tmp, g, x, N, bn_ctx))
  156. goto err;
  157. if ((k = srp_Calc_k(N, g)) == NULL)
  158. goto err;
  159. if (!BN_mod_mul(tmp2, tmp, k, N, bn_ctx))
  160. goto err;
  161. if (!BN_mod_sub(tmp, B, tmp2, N, bn_ctx))
  162. goto err;
  163. if (!BN_mul(tmp3, u, x, bn_ctx))
  164. goto err;
  165. if (!BN_add(tmp2, a, tmp3))
  166. goto err;
  167. K = BN_new();
  168. if (K != NULL && !BN_mod_exp(K, tmp, tmp2, N, bn_ctx)) {
  169. BN_free(K);
  170. K = NULL;
  171. }
  172. err:
  173. BN_CTX_free(bn_ctx);
  174. BN_clear_free(tmp);
  175. BN_clear_free(tmp2);
  176. BN_clear_free(tmp3);
  177. BN_free(k);
  178. return K;
  179. }
  180. int SRP_Verify_B_mod_N(const BIGNUM *B, const BIGNUM *N)
  181. {
  182. BIGNUM *r;
  183. BN_CTX *bn_ctx;
  184. int ret = 0;
  185. if (B == NULL || N == NULL || (bn_ctx = BN_CTX_new()) == NULL)
  186. return 0;
  187. if ((r = BN_new()) == NULL)
  188. goto err;
  189. /* Checks if B % N == 0 */
  190. if (!BN_nnmod(r, B, N, bn_ctx))
  191. goto err;
  192. ret = !BN_is_zero(r);
  193. err:
  194. BN_CTX_free(bn_ctx);
  195. BN_free(r);
  196. return ret;
  197. }
  198. int SRP_Verify_A_mod_N(const BIGNUM *A, const BIGNUM *N)
  199. {
  200. /* Checks if A % N == 0 */
  201. return SRP_Verify_B_mod_N(A, N);
  202. }
  203. static SRP_gN knowngN[] = {
  204. {"8192", &bn_generator_19, &bn_group_8192},
  205. {"6144", &bn_generator_5, &bn_group_6144},
  206. {"4096", &bn_generator_5, &bn_group_4096},
  207. {"3072", &bn_generator_5, &bn_group_3072},
  208. {"2048", &bn_generator_2, &bn_group_2048},
  209. {"1536", &bn_generator_2, &bn_group_1536},
  210. {"1024", &bn_generator_2, &bn_group_1024},
  211. };
  212. # define KNOWN_GN_NUMBER sizeof(knowngN) / sizeof(SRP_gN)
  213. /*
  214. * Check if G and N are known parameters. The values have been generated
  215. * from the ietf-tls-srp draft version 8
  216. */
  217. char *SRP_check_known_gN_param(const BIGNUM *g, const BIGNUM *N)
  218. {
  219. size_t i;
  220. if ((g == NULL) || (N == NULL))
  221. return 0;
  222. for (i = 0; i < KNOWN_GN_NUMBER; i++) {
  223. if (BN_cmp(knowngN[i].g, g) == 0 && BN_cmp(knowngN[i].N, N) == 0)
  224. return knowngN[i].id;
  225. }
  226. return NULL;
  227. }
  228. SRP_gN *SRP_get_default_gN(const char *id)
  229. {
  230. size_t i;
  231. if (id == NULL)
  232. return knowngN;
  233. for (i = 0; i < KNOWN_GN_NUMBER; i++) {
  234. if (strcmp(knowngN[i].id, id) == 0)
  235. return knowngN + i;
  236. }
  237. return NULL;
  238. }
  239. #endif