2
0

srp_vfy.c 17 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680
  1. /*
  2. * Copyright 2011-2016 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the OpenSSL license (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #ifndef OPENSSL_NO_SRP
  10. # include "internal/cryptlib.h"
  11. # include <openssl/sha.h>
  12. # include <openssl/srp.h>
  13. # include <openssl/evp.h>
  14. # include <openssl/buffer.h>
  15. # include <openssl/rand.h>
  16. # include <openssl/txt_db.h>
  17. # define SRP_RANDOM_SALT_LEN 20
  18. # define MAX_LEN 2500
  19. static char b64table[] =
  20. "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz./";
  21. /*
  22. * the following two conversion routines have been inspired by code from
  23. * Stanford
  24. */
  25. /*
  26. * Convert a base64 string into raw byte array representation.
  27. */
  28. static int t_fromb64(unsigned char *a, size_t alen, const char *src)
  29. {
  30. char *loc;
  31. int i, j;
  32. int size;
  33. if (alen == 0 || alen > INT_MAX)
  34. return -1;
  35. while (*src && (*src == ' ' || *src == '\t' || *src == '\n'))
  36. ++src;
  37. size = strlen(src);
  38. if (size < 0 || size >= (int)alen)
  39. return -1;
  40. i = 0;
  41. while (i < size) {
  42. loc = strchr(b64table, src[i]);
  43. if (loc == (char *)0)
  44. break;
  45. else
  46. a[i] = loc - b64table;
  47. ++i;
  48. }
  49. /* if nothing valid to process we have a zero length response */
  50. if (i == 0)
  51. return 0;
  52. size = i;
  53. i = size - 1;
  54. j = size;
  55. while (1) {
  56. a[j] = a[i];
  57. if (--i < 0)
  58. break;
  59. a[j] |= (a[i] & 3) << 6;
  60. --j;
  61. a[j] = (unsigned char)((a[i] & 0x3c) >> 2);
  62. if (--i < 0)
  63. break;
  64. a[j] |= (a[i] & 0xf) << 4;
  65. --j;
  66. a[j] = (unsigned char)((a[i] & 0x30) >> 4);
  67. if (--i < 0)
  68. break;
  69. a[j] |= (a[i] << 2);
  70. a[--j] = 0;
  71. if (--i < 0)
  72. break;
  73. }
  74. while (j <= size && a[j] == 0)
  75. ++j;
  76. i = 0;
  77. while (j <= size)
  78. a[i++] = a[j++];
  79. return i;
  80. }
  81. /*
  82. * Convert a raw byte string into a null-terminated base64 ASCII string.
  83. */
  84. static char *t_tob64(char *dst, const unsigned char *src, int size)
  85. {
  86. int c, pos = size % 3;
  87. unsigned char b0 = 0, b1 = 0, b2 = 0, notleading = 0;
  88. char *olddst = dst;
  89. switch (pos) {
  90. case 1:
  91. b2 = src[0];
  92. break;
  93. case 2:
  94. b1 = src[0];
  95. b2 = src[1];
  96. break;
  97. }
  98. while (1) {
  99. c = (b0 & 0xfc) >> 2;
  100. if (notleading || c != 0) {
  101. *dst++ = b64table[c];
  102. notleading = 1;
  103. }
  104. c = ((b0 & 3) << 4) | ((b1 & 0xf0) >> 4);
  105. if (notleading || c != 0) {
  106. *dst++ = b64table[c];
  107. notleading = 1;
  108. }
  109. c = ((b1 & 0xf) << 2) | ((b2 & 0xc0) >> 6);
  110. if (notleading || c != 0) {
  111. *dst++ = b64table[c];
  112. notleading = 1;
  113. }
  114. c = b2 & 0x3f;
  115. if (notleading || c != 0) {
  116. *dst++ = b64table[c];
  117. notleading = 1;
  118. }
  119. if (pos >= size)
  120. break;
  121. else {
  122. b0 = src[pos++];
  123. b1 = src[pos++];
  124. b2 = src[pos++];
  125. }
  126. }
  127. *dst++ = '\0';
  128. return olddst;
  129. }
  130. void SRP_user_pwd_free(SRP_user_pwd *user_pwd)
  131. {
  132. if (user_pwd == NULL)
  133. return;
  134. BN_free(user_pwd->s);
  135. BN_clear_free(user_pwd->v);
  136. OPENSSL_free(user_pwd->id);
  137. OPENSSL_free(user_pwd->info);
  138. OPENSSL_free(user_pwd);
  139. }
  140. static SRP_user_pwd *SRP_user_pwd_new(void)
  141. {
  142. SRP_user_pwd *ret = OPENSSL_malloc(sizeof(*ret));
  143. if (ret == NULL)
  144. return NULL;
  145. ret->N = NULL;
  146. ret->g = NULL;
  147. ret->s = NULL;
  148. ret->v = NULL;
  149. ret->id = NULL;
  150. ret->info = NULL;
  151. return ret;
  152. }
  153. static void SRP_user_pwd_set_gN(SRP_user_pwd *vinfo, const BIGNUM *g,
  154. const BIGNUM *N)
  155. {
  156. vinfo->N = N;
  157. vinfo->g = g;
  158. }
  159. static int SRP_user_pwd_set_ids(SRP_user_pwd *vinfo, const char *id,
  160. const char *info)
  161. {
  162. if (id != NULL && NULL == (vinfo->id = OPENSSL_strdup(id)))
  163. return 0;
  164. return (info == NULL || NULL != (vinfo->info = OPENSSL_strdup(info)));
  165. }
  166. static int SRP_user_pwd_set_sv(SRP_user_pwd *vinfo, const char *s,
  167. const char *v)
  168. {
  169. unsigned char tmp[MAX_LEN];
  170. int len;
  171. vinfo->v = NULL;
  172. vinfo->s = NULL;
  173. len = t_fromb64(tmp, sizeof(tmp), v);
  174. if (len < 0)
  175. return 0;
  176. if (NULL == (vinfo->v = BN_bin2bn(tmp, len, NULL)))
  177. return 0;
  178. len = t_fromb64(tmp, sizeof(tmp), s);
  179. if (len < 0)
  180. goto err;
  181. vinfo->s = BN_bin2bn(tmp, len, NULL);
  182. if (vinfo->s == NULL)
  183. goto err;
  184. return 1;
  185. err:
  186. BN_free(vinfo->v);
  187. vinfo->v = NULL;
  188. return 0;
  189. }
  190. static int SRP_user_pwd_set_sv_BN(SRP_user_pwd *vinfo, BIGNUM *s, BIGNUM *v)
  191. {
  192. vinfo->v = v;
  193. vinfo->s = s;
  194. return (vinfo->s != NULL && vinfo->v != NULL);
  195. }
  196. static SRP_user_pwd *srp_user_pwd_dup(SRP_user_pwd *src)
  197. {
  198. SRP_user_pwd *ret;
  199. if (src == NULL)
  200. return NULL;
  201. if ((ret = SRP_user_pwd_new()) == NULL)
  202. return NULL;
  203. SRP_user_pwd_set_gN(ret, src->g, src->N);
  204. if (!SRP_user_pwd_set_ids(ret, src->id, src->info)
  205. || !SRP_user_pwd_set_sv_BN(ret, BN_dup(src->s), BN_dup(src->v))) {
  206. SRP_user_pwd_free(ret);
  207. return NULL;
  208. }
  209. return ret;
  210. }
  211. SRP_VBASE *SRP_VBASE_new(char *seed_key)
  212. {
  213. SRP_VBASE *vb = OPENSSL_malloc(sizeof(*vb));
  214. if (vb == NULL)
  215. return NULL;
  216. if ((vb->users_pwd = sk_SRP_user_pwd_new_null()) == NULL
  217. || (vb->gN_cache = sk_SRP_gN_cache_new_null()) == NULL) {
  218. OPENSSL_free(vb);
  219. return NULL;
  220. }
  221. vb->default_g = NULL;
  222. vb->default_N = NULL;
  223. vb->seed_key = NULL;
  224. if ((seed_key != NULL) && (vb->seed_key = OPENSSL_strdup(seed_key)) == NULL) {
  225. sk_SRP_user_pwd_free(vb->users_pwd);
  226. sk_SRP_gN_cache_free(vb->gN_cache);
  227. OPENSSL_free(vb);
  228. return NULL;
  229. }
  230. return vb;
  231. }
  232. void SRP_VBASE_free(SRP_VBASE *vb)
  233. {
  234. if (!vb)
  235. return;
  236. sk_SRP_user_pwd_pop_free(vb->users_pwd, SRP_user_pwd_free);
  237. sk_SRP_gN_cache_free(vb->gN_cache);
  238. OPENSSL_free(vb->seed_key);
  239. OPENSSL_free(vb);
  240. }
  241. static SRP_gN_cache *SRP_gN_new_init(const char *ch)
  242. {
  243. unsigned char tmp[MAX_LEN];
  244. int len;
  245. SRP_gN_cache *newgN = OPENSSL_malloc(sizeof(*newgN));
  246. if (newgN == NULL)
  247. return NULL;
  248. len = t_fromb64(tmp, sizeof(tmp), ch);
  249. if (len < 0)
  250. goto err;
  251. if ((newgN->b64_bn = OPENSSL_strdup(ch)) == NULL)
  252. goto err;
  253. if ((newgN->bn = BN_bin2bn(tmp, len, NULL)))
  254. return newgN;
  255. OPENSSL_free(newgN->b64_bn);
  256. err:
  257. OPENSSL_free(newgN);
  258. return NULL;
  259. }
  260. static void SRP_gN_free(SRP_gN_cache *gN_cache)
  261. {
  262. if (gN_cache == NULL)
  263. return;
  264. OPENSSL_free(gN_cache->b64_bn);
  265. BN_free(gN_cache->bn);
  266. OPENSSL_free(gN_cache);
  267. }
  268. static SRP_gN *SRP_get_gN_by_id(const char *id, STACK_OF(SRP_gN) *gN_tab)
  269. {
  270. int i;
  271. SRP_gN *gN;
  272. if (gN_tab != NULL)
  273. for (i = 0; i < sk_SRP_gN_num(gN_tab); i++) {
  274. gN = sk_SRP_gN_value(gN_tab, i);
  275. if (gN && (id == NULL || strcmp(gN->id, id) == 0))
  276. return gN;
  277. }
  278. return SRP_get_default_gN(id);
  279. }
  280. static BIGNUM *SRP_gN_place_bn(STACK_OF(SRP_gN_cache) *gN_cache, char *ch)
  281. {
  282. int i;
  283. if (gN_cache == NULL)
  284. return NULL;
  285. /* search if we have already one... */
  286. for (i = 0; i < sk_SRP_gN_cache_num(gN_cache); i++) {
  287. SRP_gN_cache *cache = sk_SRP_gN_cache_value(gN_cache, i);
  288. if (strcmp(cache->b64_bn, ch) == 0)
  289. return cache->bn;
  290. }
  291. { /* it is the first time that we find it */
  292. SRP_gN_cache *newgN = SRP_gN_new_init(ch);
  293. if (newgN) {
  294. if (sk_SRP_gN_cache_insert(gN_cache, newgN, 0) > 0)
  295. return newgN->bn;
  296. SRP_gN_free(newgN);
  297. }
  298. }
  299. return NULL;
  300. }
  301. /*
  302. * this function parses verifier file. Format is:
  303. * string(index):base64(N):base64(g):0
  304. * string(username):base64(v):base64(salt):int(index)
  305. */
  306. int SRP_VBASE_init(SRP_VBASE *vb, char *verifier_file)
  307. {
  308. int error_code;
  309. STACK_OF(SRP_gN) *SRP_gN_tab = sk_SRP_gN_new_null();
  310. char *last_index = NULL;
  311. int i;
  312. char **pp;
  313. SRP_gN *gN = NULL;
  314. SRP_user_pwd *user_pwd = NULL;
  315. TXT_DB *tmpdb = NULL;
  316. BIO *in = BIO_new(BIO_s_file());
  317. error_code = SRP_ERR_OPEN_FILE;
  318. if (in == NULL || BIO_read_filename(in, verifier_file) <= 0)
  319. goto err;
  320. error_code = SRP_ERR_VBASE_INCOMPLETE_FILE;
  321. if ((tmpdb = TXT_DB_read(in, DB_NUMBER)) == NULL)
  322. goto err;
  323. error_code = SRP_ERR_MEMORY;
  324. if (vb->seed_key) {
  325. last_index = SRP_get_default_gN(NULL)->id;
  326. }
  327. for (i = 0; i < sk_OPENSSL_PSTRING_num(tmpdb->data); i++) {
  328. pp = sk_OPENSSL_PSTRING_value(tmpdb->data, i);
  329. if (pp[DB_srptype][0] == DB_SRP_INDEX) {
  330. /*
  331. * we add this couple in the internal Stack
  332. */
  333. if ((gN = OPENSSL_malloc(sizeof(*gN))) == NULL)
  334. goto err;
  335. if ((gN->id = OPENSSL_strdup(pp[DB_srpid])) == NULL
  336. || (gN->N = SRP_gN_place_bn(vb->gN_cache, pp[DB_srpverifier]))
  337. == NULL
  338. || (gN->g = SRP_gN_place_bn(vb->gN_cache, pp[DB_srpsalt]))
  339. == NULL
  340. || sk_SRP_gN_insert(SRP_gN_tab, gN, 0) == 0)
  341. goto err;
  342. gN = NULL;
  343. if (vb->seed_key != NULL) {
  344. last_index = pp[DB_srpid];
  345. }
  346. } else if (pp[DB_srptype][0] == DB_SRP_VALID) {
  347. /* it is a user .... */
  348. const SRP_gN *lgN;
  349. if ((lgN = SRP_get_gN_by_id(pp[DB_srpgN], SRP_gN_tab)) != NULL) {
  350. error_code = SRP_ERR_MEMORY;
  351. if ((user_pwd = SRP_user_pwd_new()) == NULL)
  352. goto err;
  353. SRP_user_pwd_set_gN(user_pwd, lgN->g, lgN->N);
  354. if (!SRP_user_pwd_set_ids
  355. (user_pwd, pp[DB_srpid], pp[DB_srpinfo]))
  356. goto err;
  357. error_code = SRP_ERR_VBASE_BN_LIB;
  358. if (!SRP_user_pwd_set_sv
  359. (user_pwd, pp[DB_srpsalt], pp[DB_srpverifier]))
  360. goto err;
  361. if (sk_SRP_user_pwd_insert(vb->users_pwd, user_pwd, 0) == 0)
  362. goto err;
  363. user_pwd = NULL; /* abandon responsibility */
  364. }
  365. }
  366. }
  367. if (last_index != NULL) {
  368. /* this means that we want to simulate a default user */
  369. if (((gN = SRP_get_gN_by_id(last_index, SRP_gN_tab)) == NULL)) {
  370. error_code = SRP_ERR_VBASE_BN_LIB;
  371. goto err;
  372. }
  373. vb->default_g = gN->g;
  374. vb->default_N = gN->N;
  375. gN = NULL;
  376. }
  377. error_code = SRP_NO_ERROR;
  378. err:
  379. /*
  380. * there may be still some leaks to fix, if this fails, the application
  381. * terminates most likely
  382. */
  383. if (gN != NULL) {
  384. OPENSSL_free(gN->id);
  385. OPENSSL_free(gN);
  386. }
  387. SRP_user_pwd_free(user_pwd);
  388. TXT_DB_free(tmpdb);
  389. BIO_free_all(in);
  390. sk_SRP_gN_free(SRP_gN_tab);
  391. return error_code;
  392. }
  393. static SRP_user_pwd *find_user(SRP_VBASE *vb, char *username)
  394. {
  395. int i;
  396. SRP_user_pwd *user;
  397. if (vb == NULL)
  398. return NULL;
  399. for (i = 0; i < sk_SRP_user_pwd_num(vb->users_pwd); i++) {
  400. user = sk_SRP_user_pwd_value(vb->users_pwd, i);
  401. if (strcmp(user->id, username) == 0)
  402. return user;
  403. }
  404. return NULL;
  405. }
  406. #if OPENSSL_API_COMPAT < 0x10100000L
  407. /*
  408. * DEPRECATED: use SRP_VBASE_get1_by_user instead.
  409. * This method ignores the configured seed and fails for an unknown user.
  410. * Ownership of the returned pointer is not released to the caller.
  411. * In other words, caller must not free the result.
  412. */
  413. SRP_user_pwd *SRP_VBASE_get_by_user(SRP_VBASE *vb, char *username)
  414. {
  415. return find_user(vb, username);
  416. }
  417. #endif
  418. /*
  419. * Ownership of the returned pointer is released to the caller.
  420. * In other words, caller must free the result once done.
  421. */
  422. SRP_user_pwd *SRP_VBASE_get1_by_user(SRP_VBASE *vb, char *username)
  423. {
  424. SRP_user_pwd *user;
  425. unsigned char digv[SHA_DIGEST_LENGTH];
  426. unsigned char digs[SHA_DIGEST_LENGTH];
  427. EVP_MD_CTX *ctxt = NULL;
  428. if (vb == NULL)
  429. return NULL;
  430. if ((user = find_user(vb, username)) != NULL)
  431. return srp_user_pwd_dup(user);
  432. if ((vb->seed_key == NULL) ||
  433. (vb->default_g == NULL) || (vb->default_N == NULL))
  434. return NULL;
  435. /* if the user is unknown we set parameters as well if we have a seed_key */
  436. if ((user = SRP_user_pwd_new()) == NULL)
  437. return NULL;
  438. SRP_user_pwd_set_gN(user, vb->default_g, vb->default_N);
  439. if (!SRP_user_pwd_set_ids(user, username, NULL))
  440. goto err;
  441. if (RAND_bytes(digv, SHA_DIGEST_LENGTH) <= 0)
  442. goto err;
  443. ctxt = EVP_MD_CTX_new();
  444. if (ctxt == NULL
  445. || !EVP_DigestInit_ex(ctxt, EVP_sha1(), NULL)
  446. || !EVP_DigestUpdate(ctxt, vb->seed_key, strlen(vb->seed_key))
  447. || !EVP_DigestUpdate(ctxt, username, strlen(username))
  448. || !EVP_DigestFinal_ex(ctxt, digs, NULL))
  449. goto err;
  450. EVP_MD_CTX_free(ctxt);
  451. ctxt = NULL;
  452. if (SRP_user_pwd_set_sv_BN(user,
  453. BN_bin2bn(digs, SHA_DIGEST_LENGTH, NULL),
  454. BN_bin2bn(digv, SHA_DIGEST_LENGTH, NULL)))
  455. return user;
  456. err:
  457. EVP_MD_CTX_free(ctxt);
  458. SRP_user_pwd_free(user);
  459. return NULL;
  460. }
  461. /*
  462. * create a verifier (*salt,*verifier,g and N are in base64)
  463. */
  464. char *SRP_create_verifier(const char *user, const char *pass, char **salt,
  465. char **verifier, const char *N, const char *g)
  466. {
  467. int len;
  468. char *result = NULL, *vf = NULL;
  469. const BIGNUM *N_bn = NULL, *g_bn = NULL;
  470. BIGNUM *N_bn_alloc = NULL, *g_bn_alloc = NULL, *s = NULL, *v = NULL;
  471. unsigned char tmp[MAX_LEN];
  472. unsigned char tmp2[MAX_LEN];
  473. char *defgNid = NULL;
  474. int vfsize = 0;
  475. if ((user == NULL) ||
  476. (pass == NULL) || (salt == NULL) || (verifier == NULL))
  477. goto err;
  478. if (N) {
  479. if ((len = t_fromb64(tmp, sizeof(tmp), N)) <= 0)
  480. goto err;
  481. N_bn_alloc = BN_bin2bn(tmp, len, NULL);
  482. N_bn = N_bn_alloc;
  483. if ((len = t_fromb64(tmp, sizeof(tmp) ,g)) <= 0)
  484. goto err;
  485. g_bn_alloc = BN_bin2bn(tmp, len, NULL);
  486. g_bn = g_bn_alloc;
  487. defgNid = "*";
  488. } else {
  489. SRP_gN *gN = SRP_get_gN_by_id(g, NULL);
  490. if (gN == NULL)
  491. goto err;
  492. N_bn = gN->N;
  493. g_bn = gN->g;
  494. defgNid = gN->id;
  495. }
  496. if (*salt == NULL) {
  497. if (RAND_bytes(tmp2, SRP_RANDOM_SALT_LEN) <= 0)
  498. goto err;
  499. s = BN_bin2bn(tmp2, SRP_RANDOM_SALT_LEN, NULL);
  500. } else {
  501. if ((len = t_fromb64(tmp2, sizeof(tmp2), *salt)) <= 0)
  502. goto err;
  503. s = BN_bin2bn(tmp2, len, NULL);
  504. }
  505. if (!SRP_create_verifier_BN(user, pass, &s, &v, N_bn, g_bn))
  506. goto err;
  507. BN_bn2bin(v, tmp);
  508. vfsize = BN_num_bytes(v) * 2;
  509. if (((vf = OPENSSL_malloc(vfsize)) == NULL))
  510. goto err;
  511. t_tob64(vf, tmp, BN_num_bytes(v));
  512. if (*salt == NULL) {
  513. char *tmp_salt;
  514. if ((tmp_salt = OPENSSL_malloc(SRP_RANDOM_SALT_LEN * 2)) == NULL) {
  515. goto err;
  516. }
  517. t_tob64(tmp_salt, tmp2, SRP_RANDOM_SALT_LEN);
  518. *salt = tmp_salt;
  519. }
  520. *verifier = vf;
  521. vf = NULL;
  522. result = defgNid;
  523. err:
  524. BN_free(N_bn_alloc);
  525. BN_free(g_bn_alloc);
  526. OPENSSL_clear_free(vf, vfsize);
  527. BN_clear_free(s);
  528. BN_clear_free(v);
  529. return result;
  530. }
  531. /*
  532. * create a verifier (*salt,*verifier,g and N are BIGNUMs). If *salt != NULL
  533. * then the provided salt will be used. On successful exit *verifier will point
  534. * to a newly allocated BIGNUM containing the verifier and (if a salt was not
  535. * provided) *salt will be populated with a newly allocated BIGNUM containing a
  536. * random salt.
  537. * The caller is responsible for freeing the allocated *salt and *verifier
  538. * BIGNUMS.
  539. */
  540. int SRP_create_verifier_BN(const char *user, const char *pass, BIGNUM **salt,
  541. BIGNUM **verifier, const BIGNUM *N,
  542. const BIGNUM *g)
  543. {
  544. int result = 0;
  545. BIGNUM *x = NULL;
  546. BN_CTX *bn_ctx = BN_CTX_new();
  547. unsigned char tmp2[MAX_LEN];
  548. BIGNUM *salttmp = NULL;
  549. if ((user == NULL) ||
  550. (pass == NULL) ||
  551. (salt == NULL) ||
  552. (verifier == NULL) || (N == NULL) || (g == NULL) || (bn_ctx == NULL))
  553. goto err;
  554. if (*salt == NULL) {
  555. if (RAND_bytes(tmp2, SRP_RANDOM_SALT_LEN) <= 0)
  556. goto err;
  557. salttmp = BN_bin2bn(tmp2, SRP_RANDOM_SALT_LEN, NULL);
  558. } else {
  559. salttmp = *salt;
  560. }
  561. x = SRP_Calc_x(salttmp, user, pass);
  562. *verifier = BN_new();
  563. if (*verifier == NULL)
  564. goto err;
  565. if (!BN_mod_exp(*verifier, g, x, N, bn_ctx)) {
  566. BN_clear_free(*verifier);
  567. goto err;
  568. }
  569. result = 1;
  570. *salt = salttmp;
  571. err:
  572. if (salt != NULL && *salt != salttmp)
  573. BN_clear_free(salttmp);
  574. BN_clear_free(x);
  575. BN_CTX_free(bn_ctx);
  576. return result;
  577. }
  578. #endif