1 | /* dh.c
|
---|
2 | *
|
---|
3 | * Copyright (C) 2006-2015 wolfSSL Inc.
|
---|
4 | *
|
---|
5 | * This file is part of wolfSSL. (formerly known as CyaSSL)
|
---|
6 | *
|
---|
7 | * wolfSSL is free software; you can redistribute it and/or modify
|
---|
8 | * it under the terms of the GNU General Public License as published by
|
---|
9 | * the Free Software Foundation; either version 2 of the License, or
|
---|
10 | * (at your option) any later version.
|
---|
11 | *
|
---|
12 | * wolfSSL is distributed in the hope that it will be useful,
|
---|
13 | * but WITHOUT ANY WARRANTY; without even the implied warranty of
|
---|
14 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
---|
15 | * GNU General Public License for more details.
|
---|
16 | *
|
---|
17 | * You should have received a copy of the GNU General Public License
|
---|
18 | * along with this program; if not, write to the Free Software
|
---|
19 | * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
|
---|
20 | */
|
---|
21 |
|
---|
22 | #ifdef HAVE_CONFIG_H
|
---|
23 | #include <config.h>
|
---|
24 | #endif
|
---|
25 |
|
---|
26 | #include <wolfssl/wolfcrypt/settings.h>
|
---|
27 |
|
---|
28 | #ifndef NO_DH
|
---|
29 |
|
---|
30 | #include <wolfssl/wolfcrypt/dh.h>
|
---|
31 | #include <wolfssl/wolfcrypt/error-crypt.h>
|
---|
32 |
|
---|
33 | #ifndef USER_MATH_LIB
|
---|
34 | #include <math.h>
|
---|
35 | #define XPOW(x,y) pow((x),(y))
|
---|
36 | #define XLOG(x) log((x))
|
---|
37 | #else
|
---|
38 | /* user's own math lib */
|
---|
39 | #endif
|
---|
40 |
|
---|
41 |
|
---|
42 | #ifdef min
|
---|
43 | #define WOLFSSL_HAVE_MIN
|
---|
44 | #endif
|
---|
45 | #ifndef WOLFSSL_HAVE_MIN
|
---|
46 | #define WOLFSSL_HAVE_MIN
|
---|
47 |
|
---|
48 | static INLINE word32 min(word32 a, word32 b)
|
---|
49 | {
|
---|
50 | return a > b ? b : a;
|
---|
51 | }
|
---|
52 |
|
---|
53 | #endif /* WOLFSSL_HAVE_MIN */
|
---|
54 |
|
---|
55 |
|
---|
56 | void wc_InitDhKey(DhKey* key)
|
---|
57 | {
|
---|
58 | (void)key;
|
---|
59 | /* TomsFastMath doesn't use memory allocation */
|
---|
60 | #ifndef USE_FAST_MATH
|
---|
61 | key->p.dp = 0;
|
---|
62 | key->g.dp = 0;
|
---|
63 | #endif
|
---|
64 | }
|
---|
65 |
|
---|
66 |
|
---|
67 | void wc_FreeDhKey(DhKey* key)
|
---|
68 | {
|
---|
69 | (void)key;
|
---|
70 | /* TomsFastMath doesn't use memory allocation */
|
---|
71 | #ifndef USE_FAST_MATH
|
---|
72 | mp_clear(&key->p);
|
---|
73 | mp_clear(&key->g);
|
---|
74 | #endif
|
---|
75 | }
|
---|
76 |
|
---|
77 |
|
---|
78 | static word32 DiscreteLogWorkFactor(word32 n)
|
---|
79 | {
|
---|
80 | /* assuming discrete log takes about the same time as factoring */
|
---|
81 | if (n<5)
|
---|
82 | return 0;
|
---|
83 | else
|
---|
84 | return (word32)(2.4 * XPOW((double)n, 1.0/3.0) *
|
---|
85 | XPOW(XLOG((double)n), 2.0/3.0) - 5);
|
---|
86 | }
|
---|
87 |
|
---|
88 |
|
---|
89 | static int GeneratePrivate(DhKey* key, WC_RNG* rng, byte* priv, word32* privSz)
|
---|
90 | {
|
---|
91 | int ret;
|
---|
92 | word32 sz = mp_unsigned_bin_size(&key->p);
|
---|
93 | sz = min(sz, 2 * DiscreteLogWorkFactor(sz * WOLFSSL_BIT_SIZE) /
|
---|
94 | WOLFSSL_BIT_SIZE + 1);
|
---|
95 |
|
---|
96 | ret = wc_RNG_GenerateBlock(rng, priv, sz);
|
---|
97 | if (ret != 0)
|
---|
98 | return ret;
|
---|
99 |
|
---|
100 | priv[0] |= 0x0C;
|
---|
101 |
|
---|
102 | *privSz = sz;
|
---|
103 |
|
---|
104 | return 0;
|
---|
105 | }
|
---|
106 |
|
---|
107 |
|
---|
108 | static int GeneratePublic(DhKey* key, const byte* priv, word32 privSz,
|
---|
109 | byte* pub, word32* pubSz)
|
---|
110 | {
|
---|
111 | int ret = 0;
|
---|
112 |
|
---|
113 | mp_int x;
|
---|
114 | mp_int y;
|
---|
115 |
|
---|
116 | if (mp_init_multi(&x, &y, 0, 0, 0, 0) != MP_OKAY)
|
---|
117 | return MP_INIT_E;
|
---|
118 |
|
---|
119 | if (mp_read_unsigned_bin(&x, priv, privSz) != MP_OKAY)
|
---|
120 | ret = MP_READ_E;
|
---|
121 |
|
---|
122 | if (ret == 0 && mp_exptmod(&key->g, &x, &key->p, &y) != MP_OKAY)
|
---|
123 | ret = MP_EXPTMOD_E;
|
---|
124 |
|
---|
125 | if (ret == 0 && mp_to_unsigned_bin(&y, pub) != MP_OKAY)
|
---|
126 | ret = MP_TO_E;
|
---|
127 |
|
---|
128 | if (ret == 0)
|
---|
129 | *pubSz = mp_unsigned_bin_size(&y);
|
---|
130 |
|
---|
131 | mp_clear(&y);
|
---|
132 | mp_clear(&x);
|
---|
133 |
|
---|
134 | return ret;
|
---|
135 | }
|
---|
136 |
|
---|
137 |
|
---|
138 | int wc_DhGenerateKeyPair(DhKey* key, WC_RNG* rng, byte* priv, word32* privSz,
|
---|
139 | byte* pub, word32* pubSz)
|
---|
140 | {
|
---|
141 | int ret = GeneratePrivate(key, rng, priv, privSz);
|
---|
142 |
|
---|
143 | return (ret != 0) ? ret : GeneratePublic(key, priv, *privSz, pub, pubSz);
|
---|
144 | }
|
---|
145 |
|
---|
146 | int wc_DhAgree(DhKey* key, byte* agree, word32* agreeSz, const byte* priv,
|
---|
147 | word32 privSz, const byte* otherPub, word32 pubSz)
|
---|
148 | {
|
---|
149 | int ret = 0;
|
---|
150 |
|
---|
151 | mp_int x;
|
---|
152 | mp_int y;
|
---|
153 | mp_int z;
|
---|
154 |
|
---|
155 | if (mp_init_multi(&x, &y, &z, 0, 0, 0) != MP_OKAY)
|
---|
156 | return MP_INIT_E;
|
---|
157 |
|
---|
158 | if (mp_read_unsigned_bin(&x, priv, privSz) != MP_OKAY)
|
---|
159 | ret = MP_READ_E;
|
---|
160 |
|
---|
161 | if (ret == 0 && mp_read_unsigned_bin(&y, otherPub, pubSz) != MP_OKAY)
|
---|
162 | ret = MP_READ_E;
|
---|
163 |
|
---|
164 | if (ret == 0 && mp_exptmod(&y, &x, &key->p, &z) != MP_OKAY)
|
---|
165 | ret = MP_EXPTMOD_E;
|
---|
166 |
|
---|
167 | if (ret == 0 && mp_to_unsigned_bin(&z, agree) != MP_OKAY)
|
---|
168 | ret = MP_TO_E;
|
---|
169 |
|
---|
170 | if (ret == 0)
|
---|
171 | *agreeSz = mp_unsigned_bin_size(&z);
|
---|
172 |
|
---|
173 | mp_clear(&z);
|
---|
174 | mp_clear(&y);
|
---|
175 | mp_clear(&x);
|
---|
176 |
|
---|
177 | return ret;
|
---|
178 | }
|
---|
179 |
|
---|
180 |
|
---|
181 | /* not in asn anymore since no actual asn types used */
|
---|
182 | int wc_DhSetKey(DhKey* key, const byte* p, word32 pSz, const byte* g,
|
---|
183 | word32 gSz)
|
---|
184 | {
|
---|
185 | if (key == NULL || p == NULL || g == NULL || pSz == 0 || gSz == 0)
|
---|
186 | return BAD_FUNC_ARG;
|
---|
187 |
|
---|
188 | /* may have leading 0 */
|
---|
189 | if (p[0] == 0) {
|
---|
190 | pSz--; p++;
|
---|
191 | }
|
---|
192 |
|
---|
193 | if (g[0] == 0) {
|
---|
194 | gSz--; g++;
|
---|
195 | }
|
---|
196 |
|
---|
197 | if (mp_init(&key->p) != MP_OKAY)
|
---|
198 | return MP_INIT_E;
|
---|
199 | if (mp_read_unsigned_bin(&key->p, p, pSz) != 0) {
|
---|
200 | mp_clear(&key->p);
|
---|
201 | return ASN_DH_KEY_E;
|
---|
202 | }
|
---|
203 |
|
---|
204 | if (mp_init(&key->g) != MP_OKAY) {
|
---|
205 | mp_clear(&key->p);
|
---|
206 | return MP_INIT_E;
|
---|
207 | }
|
---|
208 | if (mp_read_unsigned_bin(&key->g, g, gSz) != 0) {
|
---|
209 | mp_clear(&key->g);
|
---|
210 | mp_clear(&key->p);
|
---|
211 | return ASN_DH_KEY_E;
|
---|
212 | }
|
---|
213 |
|
---|
214 | return 0;
|
---|
215 | }
|
---|
216 |
|
---|
217 |
|
---|
218 | #endif /* NO_DH */
|
---|
219 |
|
---|