blob: 56713600894df9e68753eac2ef46ee9289ab30c0 [file] [log] [blame]
Manuel Pégourié-Gonnard0bad5c22013-01-26 15:30:46 +01001/*
2 * Elliptic curve Diffie-Hellman
3 *
Bence Szépkúti1e148272020-08-07 13:07:28 +02004 * Copyright The Mbed TLS Contributors
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +02005 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
Manuel Pégourié-Gonnard0bad5c22013-01-26 15:30:46 +010018 */
19
20/*
21 * References:
22 *
23 * SEC1 http://www.secg.org/index.php?action=secg,docs_secg
Manuel Pégourié-Gonnard63533e42013-02-10 14:21:04 +010024 * RFC 4492
Manuel Pégourié-Gonnard0bad5c22013-01-26 15:30:46 +010025 */
26
Gilles Peskinedb09ef62020-06-03 01:43:33 +020027#include "common.h"
Manuel Pégourié-Gonnard0bad5c22013-01-26 15:30:46 +010028
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020029#if defined(MBEDTLS_ECDH_C)
Manuel Pégourié-Gonnard0bad5c22013-01-26 15:30:46 +010030
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000031#include "mbedtls/ecdh.h"
Hanno Becker91796d72018-12-17 18:10:51 +000032#include "mbedtls/platform_util.h"
Janos Follath24eed8d2019-11-22 13:21:35 +000033#include "mbedtls/error.h"
Jerry Yubdc71882021-09-14 19:30:36 +080034
Rich Evans00ab4702015-02-06 13:43:58 +000035#include <string.h>
36
Hanno Becker91796d72018-12-17 18:10:51 +000037/* Parameter validation macros based on platform_util.h */
38#define ECDH_VALIDATE_RET( cond ) \
39 MBEDTLS_INTERNAL_VALIDATE_RET( cond, MBEDTLS_ERR_ECP_BAD_INPUT_DATA )
40#define ECDH_VALIDATE( cond ) \
41 MBEDTLS_INTERNAL_VALIDATE( cond )
42
Janos Follath5a3e1bf2018-08-13 15:54:22 +010043#if defined(MBEDTLS_ECDH_LEGACY_CONTEXT)
44typedef mbedtls_ecdh_context mbedtls_ecdh_context_mbed;
45#endif
46
Gilles Peskine30816292019-02-22 12:31:25 +010047static mbedtls_ecp_group_id mbedtls_ecdh_grp_id(
48 const mbedtls_ecdh_context *ctx )
49{
50#if defined(MBEDTLS_ECDH_LEGACY_CONTEXT)
51 return( ctx->grp.id );
52#else
53 return( ctx->grp_id );
54#endif
55}
56
Gilles Peskine20b3ef32019-02-11 18:41:27 +010057int mbedtls_ecdh_can_do( mbedtls_ecp_group_id gid )
58{
59 /* At this time, all groups support ECDH. */
60 (void) gid;
Christoph M. Wintersteigerc25df682019-04-16 12:54:56 +010061 return( 1 );
Gilles Peskine20b3ef32019-02-11 18:41:27 +010062}
63
Ron Eldora84c1cb2017-10-10 19:04:27 +030064#if !defined(MBEDTLS_ECDH_GEN_PUBLIC_ALT)
Manuel Pégourié-Gonnard6545ca72013-01-26 16:05:22 +010065/*
Manuel Pégourié-Gonnard66ba48a2017-04-27 11:38:26 +020066 * Generate public key (restartable version)
Manuel Pégourié-Gonnardc0edc962018-10-16 10:38:19 +020067 *
68 * Note: this internal function relies on its caller preserving the value of
Manuel Pégourié-Gonnardca29fdf2018-10-22 09:56:53 +020069 * the output parameter 'd' across continuation calls. This would not be
Manuel Pégourié-Gonnardc0edc962018-10-16 10:38:19 +020070 * acceptable for a public function but is OK here as we control call sites.
Manuel Pégourié-Gonnard66ba48a2017-04-27 11:38:26 +020071 */
72static int ecdh_gen_public_restartable( mbedtls_ecp_group *grp,
73 mbedtls_mpi *d, mbedtls_ecp_point *Q,
74 int (*f_rng)(void *, unsigned char *, size_t),
75 void *p_rng,
76 mbedtls_ecp_restart_ctx *rs_ctx )
77{
Janos Follath24eed8d2019-11-22 13:21:35 +000078 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard66ba48a2017-04-27 11:38:26 +020079
80 /* If multiplication is in progress, we already generated a privkey */
81#if defined(MBEDTLS_ECP_RESTARTABLE)
82 if( rs_ctx == NULL || rs_ctx->rsm == NULL )
83#endif
84 MBEDTLS_MPI_CHK( mbedtls_ecp_gen_privkey( grp, d, f_rng, p_rng ) );
85
86 MBEDTLS_MPI_CHK( mbedtls_ecp_mul_restartable( grp, Q, d, &grp->G,
87 f_rng, p_rng, rs_ctx ) );
88
89cleanup:
90 return( ret );
91}
92
93/*
94 * Generate public key
Manuel Pégourié-Gonnard6545ca72013-01-26 16:05:22 +010095 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020096int mbedtls_ecdh_gen_public( mbedtls_ecp_group *grp, mbedtls_mpi *d, mbedtls_ecp_point *Q,
Manuel Pégourié-Gonnard6545ca72013-01-26 16:05:22 +010097 int (*f_rng)(void *, unsigned char *, size_t),
98 void *p_rng )
99{
Manuel Pégourié-Gonnard66ba48a2017-04-27 11:38:26 +0200100 return( ecdh_gen_public_restartable( grp, d, Q, f_rng, p_rng, NULL ) );
Manuel Pégourié-Gonnard6545ca72013-01-26 16:05:22 +0100101}
Ron Eldor936d2842018-11-01 13:05:52 +0200102#endif /* !MBEDTLS_ECDH_GEN_PUBLIC_ALT */
Manuel Pégourié-Gonnard6545ca72013-01-26 16:05:22 +0100103
Ron Eldora84c1cb2017-10-10 19:04:27 +0300104#if !defined(MBEDTLS_ECDH_COMPUTE_SHARED_ALT)
Manuel Pégourié-Gonnard6545ca72013-01-26 16:05:22 +0100105/*
106 * Compute shared secret (SEC1 3.3.1)
107 */
Manuel Pégourié-Gonnard66ba48a2017-04-27 11:38:26 +0200108static int ecdh_compute_shared_restartable( mbedtls_ecp_group *grp,
109 mbedtls_mpi *z,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200110 const mbedtls_ecp_point *Q, const mbedtls_mpi *d,
Manuel Pégourié-Gonnarde09d2f82013-09-02 14:29:09 +0200111 int (*f_rng)(void *, unsigned char *, size_t),
Manuel Pégourié-Gonnard66ba48a2017-04-27 11:38:26 +0200112 void *p_rng,
113 mbedtls_ecp_restart_ctx *rs_ctx )
Manuel Pégourié-Gonnard6545ca72013-01-26 16:05:22 +0100114{
Janos Follath24eed8d2019-11-22 13:21:35 +0000115 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200116 mbedtls_ecp_point P;
Manuel Pégourié-Gonnard6545ca72013-01-26 16:05:22 +0100117
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200118 mbedtls_ecp_point_init( &P );
Manuel Pégourié-Gonnard6545ca72013-01-26 16:05:22 +0100119
Manuel Pégourié-Gonnard66ba48a2017-04-27 11:38:26 +0200120 MBEDTLS_MPI_CHK( mbedtls_ecp_mul_restartable( grp, &P, d, Q,
121 f_rng, p_rng, rs_ctx ) );
Manuel Pégourié-Gonnard6545ca72013-01-26 16:05:22 +0100122
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200123 if( mbedtls_ecp_is_zero( &P ) )
Paul Bakkerb548d772013-07-26 14:21:34 +0200124 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200125 ret = MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
Paul Bakkerb548d772013-07-26 14:21:34 +0200126 goto cleanup;
127 }
Manuel Pégourié-Gonnard6545ca72013-01-26 16:05:22 +0100128
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200129 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( z, &P.X ) );
Manuel Pégourié-Gonnard6545ca72013-01-26 16:05:22 +0100130
131cleanup:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200132 mbedtls_ecp_point_free( &P );
Manuel Pégourié-Gonnard6545ca72013-01-26 16:05:22 +0100133
134 return( ret );
135}
136
Manuel Pégourié-Gonnard63533e42013-02-10 14:21:04 +0100137/*
Manuel Pégourié-Gonnard66ba48a2017-04-27 11:38:26 +0200138 * Compute shared secret (SEC1 3.3.1)
139 */
140int mbedtls_ecdh_compute_shared( mbedtls_ecp_group *grp, mbedtls_mpi *z,
141 const mbedtls_ecp_point *Q, const mbedtls_mpi *d,
142 int (*f_rng)(void *, unsigned char *, size_t),
143 void *p_rng )
144{
145 return( ecdh_compute_shared_restartable( grp, z, Q, d,
146 f_rng, p_rng, NULL ) );
147}
Ron Eldor936d2842018-11-01 13:05:52 +0200148#endif /* !MBEDTLS_ECDH_COMPUTE_SHARED_ALT */
Manuel Pégourié-Gonnard66ba48a2017-04-27 11:38:26 +0200149
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100150static void ecdh_init_internal( mbedtls_ecdh_context_mbed *ctx )
Manuel Pégourié-Gonnard63533e42013-02-10 14:21:04 +0100151{
Manuel Pégourié-Gonnard5bd38b12017-08-23 16:55:59 +0200152 mbedtls_ecp_group_init( &ctx->grp );
153 mbedtls_mpi_init( &ctx->d );
154 mbedtls_ecp_point_init( &ctx->Q );
155 mbedtls_ecp_point_init( &ctx->Qp );
156 mbedtls_mpi_init( &ctx->z );
Manuel Pégourié-Gonnard66ba48a2017-04-27 11:38:26 +0200157
158#if defined(MBEDTLS_ECP_RESTARTABLE)
159 mbedtls_ecp_restart_init( &ctx->rs );
160#endif
Manuel Pégourié-Gonnard63533e42013-02-10 14:21:04 +0100161}
162
Manuel Pégourié-Gonnard63533e42013-02-10 14:21:04 +0100163/*
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100164 * Initialize context
Janos Follathf61e4862018-10-30 11:53:25 +0000165 */
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100166void mbedtls_ecdh_init( mbedtls_ecdh_context *ctx )
167{
168#if defined(MBEDTLS_ECDH_LEGACY_CONTEXT)
169 ecdh_init_internal( ctx );
170 mbedtls_ecp_point_init( &ctx->Vi );
171 mbedtls_ecp_point_init( &ctx->Vf );
172 mbedtls_mpi_init( &ctx->_d );
173#else
Christoph M. Wintersteigerd8c45d52019-02-20 17:16:53 +0000174 memset( ctx, 0, sizeof( mbedtls_ecdh_context ) );
175
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100176 ctx->var = MBEDTLS_ECDH_VARIANT_NONE;
177#endif
178 ctx->point_format = MBEDTLS_ECP_PF_UNCOMPRESSED;
179#if defined(MBEDTLS_ECP_RESTARTABLE)
180 ctx->restart_enabled = 0;
181#endif
182}
183
184static int ecdh_setup_internal( mbedtls_ecdh_context_mbed *ctx,
185 mbedtls_ecp_group_id grp_id )
Janos Follathf61e4862018-10-30 11:53:25 +0000186{
Janos Follath24eed8d2019-11-22 13:21:35 +0000187 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Janos Follathf61e4862018-10-30 11:53:25 +0000188
189 ret = mbedtls_ecp_group_load( &ctx->grp, grp_id );
190 if( ret != 0 )
191 {
Janos Follathf61e4862018-10-30 11:53:25 +0000192 return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE );
193 }
194
195 return( 0 );
196}
197
198/*
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100199 * Setup context
Manuel Pégourié-Gonnard63533e42013-02-10 14:21:04 +0100200 */
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100201int mbedtls_ecdh_setup( mbedtls_ecdh_context *ctx, mbedtls_ecp_group_id grp_id )
Manuel Pégourié-Gonnard63533e42013-02-10 14:21:04 +0100202{
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100203#if defined(MBEDTLS_ECDH_LEGACY_CONTEXT)
204 return( ecdh_setup_internal( ctx, grp_id ) );
205#else
206 switch( grp_id )
207 {
Christoph M. Wintersteigerc9f737b2018-10-25 13:03:05 +0100208#if defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED)
Christoph M. Wintersteiger3ff60bc2019-02-15 12:59:59 +0000209 case MBEDTLS_ECP_DP_CURVE25519:
210 ctx->point_format = MBEDTLS_ECP_PF_COMPRESSED;
211 ctx->var = MBEDTLS_ECDH_VARIANT_EVEREST;
212 ctx->grp_id = grp_id;
213 return( mbedtls_everest_setup( &ctx->ctx.everest_ecdh, grp_id ) );
Christoph M. Wintersteiger78c9c462018-12-06 17:16:32 +0000214#endif
Christoph M. Wintersteiger3ff60bc2019-02-15 12:59:59 +0000215 default:
216 ctx->point_format = MBEDTLS_ECP_PF_UNCOMPRESSED;
217 ctx->var = MBEDTLS_ECDH_VARIANT_MBEDTLS_2_0;
218 ctx->grp_id = grp_id;
219 ecdh_init_internal( &ctx->ctx.mbed_ecdh );
220 return( ecdh_setup_internal( &ctx->ctx.mbed_ecdh, grp_id ) );
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100221 }
222#endif
223}
224
225static void ecdh_free_internal( mbedtls_ecdh_context_mbed *ctx )
226{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200227 mbedtls_ecp_group_free( &ctx->grp );
Manuel Pégourié-Gonnard5bd38b12017-08-23 16:55:59 +0200228 mbedtls_mpi_free( &ctx->d );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200229 mbedtls_ecp_point_free( &ctx->Q );
230 mbedtls_ecp_point_free( &ctx->Qp );
Manuel Pégourié-Gonnard5bd38b12017-08-23 16:55:59 +0200231 mbedtls_mpi_free( &ctx->z );
Manuel Pégourié-Gonnard66ba48a2017-04-27 11:38:26 +0200232
233#if defined(MBEDTLS_ECP_RESTARTABLE)
234 mbedtls_ecp_restart_free( &ctx->rs );
235#endif
Manuel Pégourié-Gonnard63533e42013-02-10 14:21:04 +0100236}
237
Manuel Pégourié-Gonnard23e41622017-05-18 12:35:37 +0200238#if defined(MBEDTLS_ECP_RESTARTABLE)
239/*
240 * Enable restartable operations for context
241 */
242void mbedtls_ecdh_enable_restart( mbedtls_ecdh_context *ctx )
243{
244 ctx->restart_enabled = 1;
245}
246#endif
247
Manuel Pégourié-Gonnard13724762013-02-10 15:01:54 +0100248/*
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100249 * Free context
Manuel Pégourié-Gonnard13724762013-02-10 15:01:54 +0100250 */
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100251void mbedtls_ecdh_free( mbedtls_ecdh_context *ctx )
252{
253 if( ctx == NULL )
254 return;
255
256#if defined(MBEDTLS_ECDH_LEGACY_CONTEXT)
257 mbedtls_ecp_point_free( &ctx->Vi );
258 mbedtls_ecp_point_free( &ctx->Vf );
259 mbedtls_mpi_free( &ctx->_d );
260 ecdh_free_internal( ctx );
261#else
262 switch( ctx->var )
263 {
Christoph M. Wintersteigerc9f737b2018-10-25 13:03:05 +0100264#if defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED)
265 case MBEDTLS_ECDH_VARIANT_EVEREST:
Christoph M. Wintersteiger4936beb2018-12-12 17:26:41 +0000266 mbedtls_everest_free( &ctx->ctx.everest_ecdh );
Christoph M. Wintersteigerc9f737b2018-10-25 13:03:05 +0100267 break;
268#endif
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100269 case MBEDTLS_ECDH_VARIANT_MBEDTLS_2_0:
270 ecdh_free_internal( &ctx->ctx.mbed_ecdh );
271 break;
272 default:
273 break;
274 }
275
276 ctx->point_format = MBEDTLS_ECP_PF_UNCOMPRESSED;
277 ctx->var = MBEDTLS_ECDH_VARIANT_NONE;
278 ctx->grp_id = MBEDTLS_ECP_DP_NONE;
279#endif
280}
281
282static int ecdh_make_params_internal( mbedtls_ecdh_context_mbed *ctx,
283 size_t *olen, int point_format,
284 unsigned char *buf, size_t blen,
285 int (*f_rng)(void *,
286 unsigned char *,
287 size_t),
288 void *p_rng,
289 int restart_enabled )
Manuel Pégourié-Gonnard13724762013-02-10 15:01:54 +0100290{
Janos Follath24eed8d2019-11-22 13:21:35 +0000291 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard13724762013-02-10 15:01:54 +0100292 size_t grp_len, pt_len;
Ron Eldor2981d8f2018-11-05 18:07:10 +0200293#if defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnard66ba48a2017-04-27 11:38:26 +0200294 mbedtls_ecp_restart_ctx *rs_ctx = NULL;
Ron Eldor936d2842018-11-01 13:05:52 +0200295#endif
Manuel Pégourié-Gonnard13724762013-02-10 15:01:54 +0100296
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100297 if( ctx->grp.pbits == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200298 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardf35b7392013-02-11 22:12:39 +0100299
Ron Eldor19779c42018-11-05 16:58:13 +0200300#if defined(MBEDTLS_ECP_RESTARTABLE)
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100301 if( restart_enabled )
Manuel Pégourié-Gonnard23e41622017-05-18 12:35:37 +0200302 rs_ctx = &ctx->rs;
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100303#else
304 (void) restart_enabled;
Manuel Pégourié-Gonnard66ba48a2017-04-27 11:38:26 +0200305#endif
306
Ron Eldor8493f802018-11-01 11:32:15 +0200307
Ron Eldor2981d8f2018-11-05 18:07:10 +0200308#if defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnard66ba48a2017-04-27 11:38:26 +0200309 if( ( ret = ecdh_gen_public_restartable( &ctx->grp, &ctx->d, &ctx->Q,
Manuel Pégourié-Gonnardee68cff2018-10-15 15:27:49 +0200310 f_rng, p_rng, rs_ctx ) ) != 0 )
Manuel Pégourié-Gonnard13724762013-02-10 15:01:54 +0100311 return( ret );
Ron Eldor2981d8f2018-11-05 18:07:10 +0200312#else
313 if( ( ret = mbedtls_ecdh_gen_public( &ctx->grp, &ctx->d, &ctx->Q,
314 f_rng, p_rng ) ) != 0 )
315 return( ret );
316#endif /* MBEDTLS_ECP_RESTARTABLE */
Manuel Pégourié-Gonnard13724762013-02-10 15:01:54 +0100317
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100318 if( ( ret = mbedtls_ecp_tls_write_group( &ctx->grp, &grp_len, buf,
319 blen ) ) != 0 )
Manuel Pégourié-Gonnard13724762013-02-10 15:01:54 +0100320 return( ret );
321
322 buf += grp_len;
323 blen -= grp_len;
324
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100325 if( ( ret = mbedtls_ecp_tls_write_point( &ctx->grp, &ctx->Q, point_format,
Manuel Pégourié-Gonnardee68cff2018-10-15 15:27:49 +0200326 &pt_len, buf, blen ) ) != 0 )
Manuel Pégourié-Gonnard13724762013-02-10 15:01:54 +0100327 return( ret );
328
329 *olen = grp_len + pt_len;
Paul Bakkerd8bb8262014-06-17 14:06:49 +0200330 return( 0 );
Manuel Pégourié-Gonnard13724762013-02-10 15:01:54 +0100331}
332
Manuel Pégourié-Gonnard854fbd72013-02-11 20:28:55 +0100333/*
Christoph M. Wintersteigerc9f737b2018-10-25 13:03:05 +0100334 * Setup and write the ServerKeyExchange parameters (RFC 4492)
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100335 * struct {
336 * ECParameters curve_params;
337 * ECPoint public;
338 * } ServerECDHParams;
339 */
340int mbedtls_ecdh_make_params( mbedtls_ecdh_context *ctx, size_t *olen,
341 unsigned char *buf, size_t blen,
342 int (*f_rng)(void *, unsigned char *, size_t),
343 void *p_rng )
344{
345 int restart_enabled = 0;
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100346#if defined(MBEDTLS_ECP_RESTARTABLE)
347 restart_enabled = ctx->restart_enabled;
348#else
349 (void) restart_enabled;
350#endif
351
352#if defined(MBEDTLS_ECDH_LEGACY_CONTEXT)
353 return( ecdh_make_params_internal( ctx, olen, ctx->point_format, buf, blen,
354 f_rng, p_rng, restart_enabled ) );
355#else
356 switch( ctx->var )
357 {
Christoph M. Wintersteigerc9f737b2018-10-25 13:03:05 +0100358#if defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED)
359 case MBEDTLS_ECDH_VARIANT_EVEREST:
Christoph M. Wintersteiger4936beb2018-12-12 17:26:41 +0000360 return( mbedtls_everest_make_params( &ctx->ctx.everest_ecdh, olen,
361 buf, blen, f_rng, p_rng ) );
Christoph M. Wintersteigerc9f737b2018-10-25 13:03:05 +0100362#endif
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100363 case MBEDTLS_ECDH_VARIANT_MBEDTLS_2_0:
364 return( ecdh_make_params_internal( &ctx->ctx.mbed_ecdh, olen,
365 ctx->point_format, buf, blen,
366 f_rng, p_rng,
367 restart_enabled ) );
368 default:
369 return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
370 }
371#endif
372}
373
374static int ecdh_read_params_internal( mbedtls_ecdh_context_mbed *ctx,
375 const unsigned char **buf,
376 const unsigned char *end )
377{
378 return( mbedtls_ecp_tls_read_point( &ctx->grp, &ctx->Qp, buf,
379 end - *buf ) );
380}
381
382/*
bootstrap-prime6dbbf442022-05-17 19:30:44 -0400383 * Read the ServerKeyExchange parameters (RFC 4492)
Manuel Pégourié-Gonnard854fbd72013-02-11 20:28:55 +0100384 * struct {
385 * ECParameters curve_params;
386 * ECPoint public;
387 * } ServerECDHParams;
388 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200389int mbedtls_ecdh_read_params( mbedtls_ecdh_context *ctx,
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100390 const unsigned char **buf,
391 const unsigned char *end )
Manuel Pégourié-Gonnard854fbd72013-02-11 20:28:55 +0100392{
Janos Follath24eed8d2019-11-22 13:21:35 +0000393 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Janos Follathf61e4862018-10-30 11:53:25 +0000394 mbedtls_ecp_group_id grp_id;
Janos Follathf61e4862018-10-30 11:53:25 +0000395 if( ( ret = mbedtls_ecp_tls_read_group_id( &grp_id, buf, end - *buf ) )
396 != 0 )
Manuel Pégourié-Gonnard854fbd72013-02-11 20:28:55 +0100397 return( ret );
398
Janos Follathf61e4862018-10-30 11:53:25 +0000399 if( ( ret = mbedtls_ecdh_setup( ctx, grp_id ) ) != 0 )
400 return( ret );
401
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100402#if defined(MBEDTLS_ECDH_LEGACY_CONTEXT)
403 return( ecdh_read_params_internal( ctx, buf, end ) );
404#else
405 switch( ctx->var )
406 {
Christoph M. Wintersteigerc9f737b2018-10-25 13:03:05 +0100407#if defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED)
408 case MBEDTLS_ECDH_VARIANT_EVEREST:
Christoph M. Wintersteiger4936beb2018-12-12 17:26:41 +0000409 return( mbedtls_everest_read_params( &ctx->ctx.everest_ecdh,
410 buf, end) );
Christoph M. Wintersteigerc9f737b2018-10-25 13:03:05 +0100411#endif
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100412 case MBEDTLS_ECDH_VARIANT_MBEDTLS_2_0:
413 return( ecdh_read_params_internal( &ctx->ctx.mbed_ecdh,
414 buf, end ) );
415 default:
416 return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
417 }
418#endif
Manuel Pégourié-Gonnard854fbd72013-02-11 20:28:55 +0100419}
Manuel Pégourié-Gonnard0bad5c22013-01-26 15:30:46 +0100420
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100421static int ecdh_get_params_internal( mbedtls_ecdh_context_mbed *ctx,
422 const mbedtls_ecp_keypair *key,
423 mbedtls_ecdh_side side )
Manuel Pégourié-Gonnardcdff3cf2013-12-12 09:55:52 +0100424{
Janos Follath24eed8d2019-11-22 13:21:35 +0000425 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnardcdff3cf2013-12-12 09:55:52 +0100426
Manuel Pégourié-Gonnardcdff3cf2013-12-12 09:55:52 +0100427 /* If it's not our key, just import the public part as Qp */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200428 if( side == MBEDTLS_ECDH_THEIRS )
429 return( mbedtls_ecp_copy( &ctx->Qp, &key->Q ) );
Manuel Pégourié-Gonnardcdff3cf2013-12-12 09:55:52 +0100430
431 /* Our key: import public (as Q) and private parts */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200432 if( side != MBEDTLS_ECDH_OURS )
433 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardcdff3cf2013-12-12 09:55:52 +0100434
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200435 if( ( ret = mbedtls_ecp_copy( &ctx->Q, &key->Q ) ) != 0 ||
436 ( ret = mbedtls_mpi_copy( &ctx->d, &key->d ) ) != 0 )
Manuel Pégourié-Gonnardcdff3cf2013-12-12 09:55:52 +0100437 return( ret );
438
439 return( 0 );
440}
441
442/*
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100443 * Get parameters from a keypair
Manuel Pégourié-Gonnard5cceb412013-02-11 21:51:45 +0100444 */
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100445int mbedtls_ecdh_get_params( mbedtls_ecdh_context *ctx,
446 const mbedtls_ecp_keypair *key,
447 mbedtls_ecdh_side side )
448{
Janos Follath24eed8d2019-11-22 13:21:35 +0000449 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Becker91796d72018-12-17 18:10:51 +0000450 ECDH_VALIDATE_RET( side == MBEDTLS_ECDH_OURS ||
451 side == MBEDTLS_ECDH_THEIRS );
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100452
Gilles Peskine30816292019-02-22 12:31:25 +0100453 if( mbedtls_ecdh_grp_id( ctx ) == MBEDTLS_ECP_DP_NONE )
Gilles Peskine0b1b71d2018-11-07 22:10:59 +0100454 {
455 /* This is the first call to get_params(). Set up the context
456 * for use with the group. */
457 if( ( ret = mbedtls_ecdh_setup( ctx, key->grp.id ) ) != 0 )
458 return( ret );
459 }
460 else
461 {
462 /* This is not the first call to get_params(). Check that the
463 * current key's group is the same as the context's, which was set
464 * from the first key's group. */
Gilles Peskine30816292019-02-22 12:31:25 +0100465 if( mbedtls_ecdh_grp_id( ctx ) != key->grp.id )
Gilles Peskine0b1b71d2018-11-07 22:10:59 +0100466 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
467 }
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100468
469#if defined(MBEDTLS_ECDH_LEGACY_CONTEXT)
470 return( ecdh_get_params_internal( ctx, key, side ) );
471#else
472 switch( ctx->var )
473 {
Christoph M. Wintersteigerc9f737b2018-10-25 13:03:05 +0100474#if defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED)
475 case MBEDTLS_ECDH_VARIANT_EVEREST:
Christoph M. Wintersteiger4936beb2018-12-12 17:26:41 +0000476 {
Christoph M. Wintersteiger2e724a12019-01-07 14:19:41 +0000477 mbedtls_everest_ecdh_side s = side == MBEDTLS_ECDH_OURS ?
Christoph M. Wintersteiger4936beb2018-12-12 17:26:41 +0000478 MBEDTLS_EVEREST_ECDH_OURS :
479 MBEDTLS_EVEREST_ECDH_THEIRS;
480 return( mbedtls_everest_get_params( &ctx->ctx.everest_ecdh,
481 key, s) );
482 }
Christoph M. Wintersteigerc9f737b2018-10-25 13:03:05 +0100483#endif
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100484 case MBEDTLS_ECDH_VARIANT_MBEDTLS_2_0:
485 return( ecdh_get_params_internal( &ctx->ctx.mbed_ecdh,
486 key, side ) );
487 default:
488 return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
489 }
490#endif
491}
492
493static int ecdh_make_public_internal( mbedtls_ecdh_context_mbed *ctx,
494 size_t *olen, int point_format,
495 unsigned char *buf, size_t blen,
496 int (*f_rng)(void *,
497 unsigned char *,
498 size_t),
499 void *p_rng,
500 int restart_enabled )
Manuel Pégourié-Gonnard5cceb412013-02-11 21:51:45 +0100501{
Janos Follath24eed8d2019-11-22 13:21:35 +0000502 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Ron Eldor2981d8f2018-11-05 18:07:10 +0200503#if defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnard66ba48a2017-04-27 11:38:26 +0200504 mbedtls_ecp_restart_ctx *rs_ctx = NULL;
Ron Eldor936d2842018-11-01 13:05:52 +0200505#endif
Manuel Pégourié-Gonnard5cceb412013-02-11 21:51:45 +0100506
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100507 if( ctx->grp.pbits == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200508 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardf35b7392013-02-11 22:12:39 +0100509
Ron Eldorb430d9f2018-11-05 17:18:29 +0200510#if defined(MBEDTLS_ECP_RESTARTABLE)
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100511 if( restart_enabled )
Manuel Pégourié-Gonnard23e41622017-05-18 12:35:37 +0200512 rs_ctx = &ctx->rs;
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100513#else
514 (void) restart_enabled;
Manuel Pégourié-Gonnard66ba48a2017-04-27 11:38:26 +0200515#endif
516
Ron Eldor2981d8f2018-11-05 18:07:10 +0200517#if defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnard66ba48a2017-04-27 11:38:26 +0200518 if( ( ret = ecdh_gen_public_restartable( &ctx->grp, &ctx->d, &ctx->Q,
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100519 f_rng, p_rng, rs_ctx ) ) != 0 )
Manuel Pégourié-Gonnard5cceb412013-02-11 21:51:45 +0100520 return( ret );
Ron Eldor2981d8f2018-11-05 18:07:10 +0200521#else
522 if( ( ret = mbedtls_ecdh_gen_public( &ctx->grp, &ctx->d, &ctx->Q,
523 f_rng, p_rng ) ) != 0 )
524 return( ret );
525#endif /* MBEDTLS_ECP_RESTARTABLE */
Manuel Pégourié-Gonnard5cceb412013-02-11 21:51:45 +0100526
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100527 return mbedtls_ecp_tls_write_point( &ctx->grp, &ctx->Q, point_format, olen,
528 buf, blen );
Manuel Pégourié-Gonnard5cceb412013-02-11 21:51:45 +0100529}
530
531/*
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100532 * Setup and export the client public value
Manuel Pégourié-Gonnard5cceb412013-02-11 21:51:45 +0100533 */
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100534int mbedtls_ecdh_make_public( mbedtls_ecdh_context *ctx, size_t *olen,
535 unsigned char *buf, size_t blen,
536 int (*f_rng)(void *, unsigned char *, size_t),
537 void *p_rng )
Manuel Pégourié-Gonnard5cceb412013-02-11 21:51:45 +0100538{
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100539 int restart_enabled = 0;
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100540#if defined(MBEDTLS_ECP_RESTARTABLE)
541 restart_enabled = ctx->restart_enabled;
542#endif
543
544#if defined(MBEDTLS_ECDH_LEGACY_CONTEXT)
545 return( ecdh_make_public_internal( ctx, olen, ctx->point_format, buf, blen,
546 f_rng, p_rng, restart_enabled ) );
547#else
548 switch( ctx->var )
549 {
Christoph M. Wintersteigerc9f737b2018-10-25 13:03:05 +0100550#if defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED)
551 case MBEDTLS_ECDH_VARIANT_EVEREST:
Christoph M. Wintersteiger4936beb2018-12-12 17:26:41 +0000552 return( mbedtls_everest_make_public( &ctx->ctx.everest_ecdh, olen,
553 buf, blen, f_rng, p_rng ) );
Christoph M. Wintersteigerc9f737b2018-10-25 13:03:05 +0100554#endif
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100555 case MBEDTLS_ECDH_VARIANT_MBEDTLS_2_0:
556 return( ecdh_make_public_internal( &ctx->ctx.mbed_ecdh, olen,
557 ctx->point_format, buf, blen,
558 f_rng, p_rng,
559 restart_enabled ) );
560 default:
561 return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
562 }
563#endif
564}
565
566static int ecdh_read_public_internal( mbedtls_ecdh_context_mbed *ctx,
567 const unsigned char *buf, size_t blen )
568{
Janos Follath24eed8d2019-11-22 13:21:35 +0000569 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100570 const unsigned char *p = buf;
571
572 if( ( ret = mbedtls_ecp_tls_read_point( &ctx->grp, &ctx->Qp, &p,
573 blen ) ) != 0 )
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +0100574 return( ret );
575
576 if( (size_t)( p - buf ) != blen )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200577 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +0100578
579 return( 0 );
Manuel Pégourié-Gonnard5cceb412013-02-11 21:51:45 +0100580}
581
Manuel Pégourié-Gonnard424fda52013-02-11 22:05:42 +0100582/*
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100583 * Parse and import the client's public value
Manuel Pégourié-Gonnard424fda52013-02-11 22:05:42 +0100584 */
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100585int mbedtls_ecdh_read_public( mbedtls_ecdh_context *ctx,
586 const unsigned char *buf, size_t blen )
587{
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100588#if defined(MBEDTLS_ECDH_LEGACY_CONTEXT)
589 return( ecdh_read_public_internal( ctx, buf, blen ) );
590#else
591 switch( ctx->var )
592 {
Christoph M. Wintersteigerc9f737b2018-10-25 13:03:05 +0100593#if defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED)
594 case MBEDTLS_ECDH_VARIANT_EVEREST:
Christoph M. Wintersteiger4936beb2018-12-12 17:26:41 +0000595 return( mbedtls_everest_read_public( &ctx->ctx.everest_ecdh,
596 buf, blen ) );
Christoph M. Wintersteigerc9f737b2018-10-25 13:03:05 +0100597#endif
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100598 case MBEDTLS_ECDH_VARIANT_MBEDTLS_2_0:
599 return( ecdh_read_public_internal( &ctx->ctx.mbed_ecdh,
600 buf, blen ) );
601 default:
602 return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
603 }
604#endif
605}
606
607static int ecdh_calc_secret_internal( mbedtls_ecdh_context_mbed *ctx,
608 size_t *olen, unsigned char *buf,
609 size_t blen,
610 int (*f_rng)(void *,
611 unsigned char *,
612 size_t),
613 void *p_rng,
614 int restart_enabled )
Manuel Pégourié-Gonnard424fda52013-02-11 22:05:42 +0100615{
Janos Follath24eed8d2019-11-22 13:21:35 +0000616 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Ron Eldor2981d8f2018-11-05 18:07:10 +0200617#if defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnard66ba48a2017-04-27 11:38:26 +0200618 mbedtls_ecp_restart_ctx *rs_ctx = NULL;
Ron Eldor936d2842018-11-01 13:05:52 +0200619#endif
Manuel Pégourié-Gonnard424fda52013-02-11 22:05:42 +0100620
Manuel Pégourié-Gonnard66ba48a2017-04-27 11:38:26 +0200621 if( ctx == NULL || ctx->grp.pbits == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200622 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardf35b7392013-02-11 22:12:39 +0100623
Ron Eldorb430d9f2018-11-05 17:18:29 +0200624#if defined(MBEDTLS_ECP_RESTARTABLE)
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100625 if( restart_enabled )
Manuel Pégourié-Gonnard23e41622017-05-18 12:35:37 +0200626 rs_ctx = &ctx->rs;
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100627#else
628 (void) restart_enabled;
Manuel Pégourié-Gonnard66ba48a2017-04-27 11:38:26 +0200629#endif
630
Ron Eldor2981d8f2018-11-05 18:07:10 +0200631#if defined(MBEDTLS_ECP_RESTARTABLE)
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100632 if( ( ret = ecdh_compute_shared_restartable( &ctx->grp, &ctx->z, &ctx->Qp,
633 &ctx->d, f_rng, p_rng,
634 rs_ctx ) ) != 0 )
Manuel Pégourié-Gonnarde09d2f82013-09-02 14:29:09 +0200635 {
Manuel Pégourié-Gonnard424fda52013-02-11 22:05:42 +0100636 return( ret );
Manuel Pégourié-Gonnarde09d2f82013-09-02 14:29:09 +0200637 }
Ron Eldor2981d8f2018-11-05 18:07:10 +0200638#else
639 if( ( ret = mbedtls_ecdh_compute_shared( &ctx->grp, &ctx->z, &ctx->Qp,
640 &ctx->d, f_rng, p_rng ) ) != 0 )
641 {
642 return( ret );
643 }
644#endif /* MBEDTLS_ECP_RESTARTABLE */
Manuel Pégourié-Gonnard424fda52013-02-11 22:05:42 +0100645
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200646 if( mbedtls_mpi_size( &ctx->z ) > blen )
647 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
Paul Bakker41c83d32013-03-20 14:39:14 +0100648
Manuel Pégourié-Gonnard0a56c2c2014-01-17 21:24:04 +0100649 *olen = ctx->grp.pbits / 8 + ( ( ctx->grp.pbits % 8 ) != 0 );
Janos Follathab0f71a2019-02-20 10:48:49 +0000650
Janos Follath52ff8e92019-02-26 13:56:04 +0000651 if( mbedtls_ecp_get_type( &ctx->grp ) == MBEDTLS_ECP_TYPE_MONTGOMERY )
Janos Follathab0f71a2019-02-20 10:48:49 +0000652 return mbedtls_mpi_write_binary_le( &ctx->z, buf, *olen );
653
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200654 return mbedtls_mpi_write_binary( &ctx->z, buf, *olen );
Manuel Pégourié-Gonnard424fda52013-02-11 22:05:42 +0100655}
656
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100657/*
658 * Derive and export the shared secret
659 */
660int mbedtls_ecdh_calc_secret( mbedtls_ecdh_context *ctx, size_t *olen,
661 unsigned char *buf, size_t blen,
662 int (*f_rng)(void *, unsigned char *, size_t),
663 void *p_rng )
664{
665 int restart_enabled = 0;
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100666#if defined(MBEDTLS_ECP_RESTARTABLE)
667 restart_enabled = ctx->restart_enabled;
668#endif
669
670#if defined(MBEDTLS_ECDH_LEGACY_CONTEXT)
671 return( ecdh_calc_secret_internal( ctx, olen, buf, blen, f_rng, p_rng,
672 restart_enabled ) );
673#else
674 switch( ctx->var )
675 {
Christoph M. Wintersteigerc9f737b2018-10-25 13:03:05 +0100676#if defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED)
677 case MBEDTLS_ECDH_VARIANT_EVEREST:
Christoph M. Wintersteiger4936beb2018-12-12 17:26:41 +0000678 return( mbedtls_everest_calc_secret( &ctx->ctx.everest_ecdh, olen,
679 buf, blen, f_rng, p_rng ) );
Christoph M. Wintersteigerc9f737b2018-10-25 13:03:05 +0100680#endif
Janos Follath5a3e1bf2018-08-13 15:54:22 +0100681 case MBEDTLS_ECDH_VARIANT_MBEDTLS_2_0:
682 return( ecdh_calc_secret_internal( &ctx->ctx.mbed_ecdh, olen, buf,
683 blen, f_rng, p_rng,
684 restart_enabled ) );
685 default:
686 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
687 }
688#endif
689}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200690#endif /* MBEDTLS_ECDH_C */