blob: d09618586812e431748d03424c0203e26201e678 [file] [log] [blame]
Paul Bakker5121ce52009-01-03 21:22:43 +00001/*
2 * Diffie-Hellman-Merkle key exchange
3 *
Paul Bakkere0ccd0a2009-01-04 16:27:10 +00004 * Based on XySSL: Copyright (C) 2006-2008 Christophe Devine
5 *
Paul Bakker785a9ee2009-01-25 14:15:10 +00006 * Copyright (C) 2009 Paul Bakker <polarssl_maintainer at polarssl dot org>
Paul Bakker5121ce52009-01-03 21:22:43 +00007 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License along
19 * with this program; if not, write to the Free Software Foundation, Inc.,
20 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
21 */
22/*
23 * Reference:
24 *
25 * http://www.cacr.math.uwaterloo.ca/hac/ (chapter 12)
26 */
27
Paul Bakker40e46942009-01-03 21:51:57 +000028#include "polarssl/config.h"
Paul Bakker5121ce52009-01-03 21:22:43 +000029
Paul Bakker40e46942009-01-03 21:51:57 +000030#if defined(POLARSSL_DHM_C)
Paul Bakker5121ce52009-01-03 21:22:43 +000031
Paul Bakker40e46942009-01-03 21:51:57 +000032#include "polarssl/dhm.h"
Paul Bakker5121ce52009-01-03 21:22:43 +000033
34#include <string.h>
35
36/*
37 * helper to validate the mpi size and import it
38 */
39static int dhm_read_bignum( mpi *X,
40 unsigned char **p,
41 unsigned char *end )
42{
43 int ret, n;
44
45 if( end - *p < 2 )
Paul Bakker40e46942009-01-03 21:51:57 +000046 return( POLARSSL_ERR_DHM_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +000047
48 n = ( (*p)[0] << 8 ) | (*p)[1];
49 (*p) += 2;
50
51 if( (int)( end - *p ) < n )
Paul Bakker40e46942009-01-03 21:51:57 +000052 return( POLARSSL_ERR_DHM_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +000053
54 if( ( ret = mpi_read_binary( X, *p, n ) ) != 0 )
Paul Bakker40e46942009-01-03 21:51:57 +000055 return( POLARSSL_ERR_DHM_READ_PARAMS_FAILED | ret );
Paul Bakker5121ce52009-01-03 21:22:43 +000056
57 (*p) += n;
58
59 return( 0 );
60}
61
62/*
63 * Parse the ServerKeyExchange parameters
64 */
65int dhm_read_params( dhm_context *ctx,
66 unsigned char **p,
67 unsigned char *end )
68{
69 int ret, n;
70
71 memset( ctx, 0, sizeof( dhm_context ) );
72
73 if( ( ret = dhm_read_bignum( &ctx->P, p, end ) ) != 0 ||
74 ( ret = dhm_read_bignum( &ctx->G, p, end ) ) != 0 ||
75 ( ret = dhm_read_bignum( &ctx->GY, p, end ) ) != 0 )
76 return( ret );
77
78 ctx->len = mpi_size( &ctx->P );
79
80 if( end - *p < 2 )
Paul Bakker40e46942009-01-03 21:51:57 +000081 return( POLARSSL_ERR_DHM_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +000082
83 n = ( (*p)[0] << 8 ) | (*p)[1];
84 (*p) += 2;
85
86 if( end != *p + n )
Paul Bakker40e46942009-01-03 21:51:57 +000087 return( POLARSSL_ERR_DHM_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +000088
89 return( 0 );
90}
91
92/*
93 * Setup and write the ServerKeyExchange parameters
94 */
95int dhm_make_params( dhm_context *ctx, int x_size,
96 unsigned char *output, int *olen,
97 int (*f_rng)(void *), void *p_rng )
98{
99 int i, ret, n, n1, n2, n3;
100 unsigned char *p;
101
102 /*
103 * generate X and calculate GX = G^X mod P
104 */
105 n = x_size / sizeof( t_int );
106 MPI_CHK( mpi_grow( &ctx->X, n ) );
107 MPI_CHK( mpi_lset( &ctx->X, 0 ) );
108
Paul Bakker2a1fadf2009-07-27 21:05:24 +0000109 n = x_size - 1;
Paul Bakker5121ce52009-01-03 21:22:43 +0000110 p = (unsigned char *) ctx->X.p;
111 for( i = 0; i < n; i++ )
112 *p++ = (unsigned char) f_rng( p_rng );
113
114 while( mpi_cmp_mpi( &ctx->X, &ctx->P ) >= 0 )
115 mpi_shift_r( &ctx->X, 1 );
116
117 MPI_CHK( mpi_exp_mod( &ctx->GX, &ctx->G, &ctx->X,
118 &ctx->P , &ctx->RP ) );
119
120 /*
121 * export P, G, GX
122 */
123#define DHM_MPI_EXPORT(X,n) \
124 MPI_CHK( mpi_write_binary( X, p + 2, n ) ); \
125 *p++ = (unsigned char)( n >> 8 ); \
126 *p++ = (unsigned char)( n ); p += n;
127
128 n1 = mpi_size( &ctx->P );
129 n2 = mpi_size( &ctx->G );
130 n3 = mpi_size( &ctx->GX );
131
132 p = output;
133 DHM_MPI_EXPORT( &ctx->P , n1 );
134 DHM_MPI_EXPORT( &ctx->G , n2 );
135 DHM_MPI_EXPORT( &ctx->GX, n3 );
136
137 *olen = p - output;
138
139 ctx->len = n1;
140
141cleanup:
142
143 if( ret != 0 )
Paul Bakker40e46942009-01-03 21:51:57 +0000144 return( ret | POLARSSL_ERR_DHM_MAKE_PARAMS_FAILED );
Paul Bakker5121ce52009-01-03 21:22:43 +0000145
146 return( 0 );
147}
148
149/*
150 * Import the peer's public value G^Y
151 */
152int dhm_read_public( dhm_context *ctx,
153 unsigned char *input, int ilen )
154{
155 int ret;
156
157 if( ctx == NULL || ilen < 1 || ilen > ctx->len )
Paul Bakker40e46942009-01-03 21:51:57 +0000158 return( POLARSSL_ERR_DHM_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +0000159
160 if( ( ret = mpi_read_binary( &ctx->GY, input, ilen ) ) != 0 )
Paul Bakker40e46942009-01-03 21:51:57 +0000161 return( POLARSSL_ERR_DHM_READ_PUBLIC_FAILED | ret );
Paul Bakker5121ce52009-01-03 21:22:43 +0000162
163 return( 0 );
164}
165
166/*
167 * Create own private value X and export G^X
168 */
169int dhm_make_public( dhm_context *ctx, int x_size,
170 unsigned char *output, int olen,
171 int (*f_rng)(void *), void *p_rng )
172{
173 int ret, i, n;
174 unsigned char *p;
175
176 if( ctx == NULL || olen < 1 || olen > ctx->len )
Paul Bakker40e46942009-01-03 21:51:57 +0000177 return( POLARSSL_ERR_DHM_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +0000178
179 /*
180 * generate X and calculate GX = G^X mod P
181 */
182 n = x_size / sizeof( t_int );
183 MPI_CHK( mpi_grow( &ctx->X, n ) );
184 MPI_CHK( mpi_lset( &ctx->X, 0 ) );
185
Paul Bakker2a1fadf2009-07-27 21:05:24 +0000186 n = x_size - 1;
Paul Bakker5121ce52009-01-03 21:22:43 +0000187 p = (unsigned char *) ctx->X.p;
188 for( i = 0; i < n; i++ )
189 *p++ = (unsigned char) f_rng( p_rng );
190
191 while( mpi_cmp_mpi( &ctx->X, &ctx->P ) >= 0 )
192 mpi_shift_r( &ctx->X, 1 );
193
194 MPI_CHK( mpi_exp_mod( &ctx->GX, &ctx->G, &ctx->X,
195 &ctx->P , &ctx->RP ) );
196
197 MPI_CHK( mpi_write_binary( &ctx->GX, output, olen ) );
198
199cleanup:
200
201 if( ret != 0 )
Paul Bakker40e46942009-01-03 21:51:57 +0000202 return( POLARSSL_ERR_DHM_MAKE_PUBLIC_FAILED | ret );
Paul Bakker5121ce52009-01-03 21:22:43 +0000203
204 return( 0 );
205}
206
207/*
208 * Derive and export the shared secret (G^Y)^X mod P
209 */
210int dhm_calc_secret( dhm_context *ctx,
211 unsigned char *output, int *olen )
212{
213 int ret;
214
215 if( ctx == NULL || *olen < ctx->len )
Paul Bakker40e46942009-01-03 21:51:57 +0000216 return( POLARSSL_ERR_DHM_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +0000217
218 MPI_CHK( mpi_exp_mod( &ctx->K, &ctx->GY, &ctx->X,
219 &ctx->P, &ctx->RP ) );
220
221 *olen = mpi_size( &ctx->K );
222
223 MPI_CHK( mpi_write_binary( &ctx->K, output, *olen ) );
224
225cleanup:
226
227 if( ret != 0 )
Paul Bakker40e46942009-01-03 21:51:57 +0000228 return( POLARSSL_ERR_DHM_CALC_SECRET_FAILED | ret );
Paul Bakker5121ce52009-01-03 21:22:43 +0000229
230 return( 0 );
231}
232
233/*
234 * Free the components of a DHM key
235 */
236void dhm_free( dhm_context *ctx )
237{
238 mpi_free( &ctx->RP, &ctx->K, &ctx->GY,
239 &ctx->GX, &ctx->X, &ctx->G,
240 &ctx->P, NULL );
241}
242
Paul Bakker40e46942009-01-03 21:51:57 +0000243#if defined(POLARSSL_SELF_TEST)
Paul Bakker5121ce52009-01-03 21:22:43 +0000244
245/*
246 * Checkup routine
247 */
248int dhm_self_test( int verbose )
249{
250 return( verbose++ );
251}
252
253#endif
254
255#endif