Nicolas Borla / Mbed OS BBR_1Ebene

BBR 1 Ebene

mbed-os/features/mbedtls/src/ecdh.c@0:fbdae7e6d805, 2018-05-14 (annotated)

Committer:
borlanic
Date:
Mon May 14 11:29:06 2018 +0000
Revision:
0:fbdae7e6d805
BBR

Who changed what in which revision?

UserRevisionLine numberNew contents of line
borlanic 0:fbdae7e6d805 1 /*
borlanic 0:fbdae7e6d805 2 * Elliptic curve Diffie-Hellman
borlanic 0:fbdae7e6d805 3 *
borlanic 0:fbdae7e6d805 4 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
borlanic 0:fbdae7e6d805 5 * SPDX-License-Identifier: Apache-2.0
borlanic 0:fbdae7e6d805 6 *
borlanic 0:fbdae7e6d805 7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
borlanic 0:fbdae7e6d805 8 * not use this file except in compliance with the License.
borlanic 0:fbdae7e6d805 9 * You may obtain a copy of the License at
borlanic 0:fbdae7e6d805 10 *
borlanic 0:fbdae7e6d805 11 * http://www.apache.org/licenses/LICENSE-2.0
borlanic 0:fbdae7e6d805 12 *
borlanic 0:fbdae7e6d805 13 * Unless required by applicable law or agreed to in writing, software
borlanic 0:fbdae7e6d805 14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
borlanic 0:fbdae7e6d805 15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
borlanic 0:fbdae7e6d805 16 * See the License for the specific language governing permissions and
borlanic 0:fbdae7e6d805 17 * limitations under the License.
borlanic 0:fbdae7e6d805 18 *
borlanic 0:fbdae7e6d805 19 * This file is part of mbed TLS (https://tls.mbed.org)
borlanic 0:fbdae7e6d805 20 */
borlanic 0:fbdae7e6d805 21
borlanic 0:fbdae7e6d805 22 /*
borlanic 0:fbdae7e6d805 23 * References:
borlanic 0:fbdae7e6d805 24 *
borlanic 0:fbdae7e6d805 25 * SEC1 http://www.secg.org/index.php?action=secg,docs_secg
borlanic 0:fbdae7e6d805 26 * RFC 4492
borlanic 0:fbdae7e6d805 27 */
borlanic 0:fbdae7e6d805 28
borlanic 0:fbdae7e6d805 29 #if !defined(MBEDTLS_CONFIG_FILE)
borlanic 0:fbdae7e6d805 30 #include "mbedtls/config.h"
borlanic 0:fbdae7e6d805 31 #else
borlanic 0:fbdae7e6d805 32 #include MBEDTLS_CONFIG_FILE
borlanic 0:fbdae7e6d805 33 #endif
borlanic 0:fbdae7e6d805 34
borlanic 0:fbdae7e6d805 35 #if defined(MBEDTLS_ECDH_C)
borlanic 0:fbdae7e6d805 36
borlanic 0:fbdae7e6d805 37 #include "mbedtls/ecdh.h"
borlanic 0:fbdae7e6d805 38
borlanic 0:fbdae7e6d805 39 #include <string.h>
borlanic 0:fbdae7e6d805 40
borlanic 0:fbdae7e6d805 41 #if !defined(MBEDTLS_ECDH_GEN_PUBLIC_ALT)
borlanic 0:fbdae7e6d805 42 /*
borlanic 0:fbdae7e6d805 43 * Generate public key: simple wrapper around mbedtls_ecp_gen_keypair
borlanic 0:fbdae7e6d805 44 */
borlanic 0:fbdae7e6d805 45 int mbedtls_ecdh_gen_public( mbedtls_ecp_group *grp, mbedtls_mpi *d, mbedtls_ecp_point *Q,
borlanic 0:fbdae7e6d805 46 int (*f_rng)(void *, unsigned char *, size_t),
borlanic 0:fbdae7e6d805 47 void *p_rng )
borlanic 0:fbdae7e6d805 48 {
borlanic 0:fbdae7e6d805 49 return mbedtls_ecp_gen_keypair( grp, d, Q, f_rng, p_rng );
borlanic 0:fbdae7e6d805 50 }
borlanic 0:fbdae7e6d805 51 #endif /* MBEDTLS_ECDH_GEN_PUBLIC_ALT */
borlanic 0:fbdae7e6d805 52
borlanic 0:fbdae7e6d805 53 #if !defined(MBEDTLS_ECDH_COMPUTE_SHARED_ALT)
borlanic 0:fbdae7e6d805 54 /*
borlanic 0:fbdae7e6d805 55 * Compute shared secret (SEC1 3.3.1)
borlanic 0:fbdae7e6d805 56 */
borlanic 0:fbdae7e6d805 57 int mbedtls_ecdh_compute_shared( mbedtls_ecp_group *grp, mbedtls_mpi *z,
borlanic 0:fbdae7e6d805 58 const mbedtls_ecp_point *Q, const mbedtls_mpi *d,
borlanic 0:fbdae7e6d805 59 int (*f_rng)(void *, unsigned char *, size_t),
borlanic 0:fbdae7e6d805 60 void *p_rng )
borlanic 0:fbdae7e6d805 61 {
borlanic 0:fbdae7e6d805 62 int ret;
borlanic 0:fbdae7e6d805 63 mbedtls_ecp_point P;
borlanic 0:fbdae7e6d805 64
borlanic 0:fbdae7e6d805 65 mbedtls_ecp_point_init( &P );
borlanic 0:fbdae7e6d805 66
borlanic 0:fbdae7e6d805 67 /*
borlanic 0:fbdae7e6d805 68 * Make sure Q is a valid pubkey before using it
borlanic 0:fbdae7e6d805 69 */
borlanic 0:fbdae7e6d805 70 MBEDTLS_MPI_CHK( mbedtls_ecp_check_pubkey( grp, Q ) );
borlanic 0:fbdae7e6d805 71
borlanic 0:fbdae7e6d805 72 MBEDTLS_MPI_CHK( mbedtls_ecp_mul( grp, &P, d, Q, f_rng, p_rng ) );
borlanic 0:fbdae7e6d805 73
borlanic 0:fbdae7e6d805 74 if( mbedtls_ecp_is_zero( &P ) )
borlanic 0:fbdae7e6d805 75 {
borlanic 0:fbdae7e6d805 76 ret = MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
borlanic 0:fbdae7e6d805 77 goto cleanup;
borlanic 0:fbdae7e6d805 78 }
borlanic 0:fbdae7e6d805 79
borlanic 0:fbdae7e6d805 80 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( z, &P.X ) );
borlanic 0:fbdae7e6d805 81
borlanic 0:fbdae7e6d805 82 cleanup:
borlanic 0:fbdae7e6d805 83 mbedtls_ecp_point_free( &P );
borlanic 0:fbdae7e6d805 84
borlanic 0:fbdae7e6d805 85 return( ret );
borlanic 0:fbdae7e6d805 86 }
borlanic 0:fbdae7e6d805 87 #endif /* MBEDTLS_ECDH_COMPUTE_SHARED_ALT */
borlanic 0:fbdae7e6d805 88
borlanic 0:fbdae7e6d805 89 /*
borlanic 0:fbdae7e6d805 90 * Initialize context
borlanic 0:fbdae7e6d805 91 */
borlanic 0:fbdae7e6d805 92 void mbedtls_ecdh_init( mbedtls_ecdh_context *ctx )
borlanic 0:fbdae7e6d805 93 {
borlanic 0:fbdae7e6d805 94 memset( ctx, 0, sizeof( mbedtls_ecdh_context ) );
borlanic 0:fbdae7e6d805 95 }
borlanic 0:fbdae7e6d805 96
borlanic 0:fbdae7e6d805 97 /*
borlanic 0:fbdae7e6d805 98 * Free context
borlanic 0:fbdae7e6d805 99 */
borlanic 0:fbdae7e6d805 100 void mbedtls_ecdh_free( mbedtls_ecdh_context *ctx )
borlanic 0:fbdae7e6d805 101 {
borlanic 0:fbdae7e6d805 102 if( ctx == NULL )
borlanic 0:fbdae7e6d805 103 return;
borlanic 0:fbdae7e6d805 104
borlanic 0:fbdae7e6d805 105 mbedtls_ecp_group_free( &ctx->grp );
borlanic 0:fbdae7e6d805 106 mbedtls_ecp_point_free( &ctx->Q );
borlanic 0:fbdae7e6d805 107 mbedtls_ecp_point_free( &ctx->Qp );
borlanic 0:fbdae7e6d805 108 mbedtls_ecp_point_free( &ctx->Vi );
borlanic 0:fbdae7e6d805 109 mbedtls_ecp_point_free( &ctx->Vf );
borlanic 0:fbdae7e6d805 110 mbedtls_mpi_free( &ctx->d );
borlanic 0:fbdae7e6d805 111 mbedtls_mpi_free( &ctx->z );
borlanic 0:fbdae7e6d805 112 mbedtls_mpi_free( &ctx->_d );
borlanic 0:fbdae7e6d805 113 }
borlanic 0:fbdae7e6d805 114
borlanic 0:fbdae7e6d805 115 /*
borlanic 0:fbdae7e6d805 116 * Setup and write the ServerKeyExhange parameters (RFC 4492)
borlanic 0:fbdae7e6d805 117 * struct {
borlanic 0:fbdae7e6d805 118 * ECParameters curve_params;
borlanic 0:fbdae7e6d805 119 * ECPoint public;
borlanic 0:fbdae7e6d805 120 * } ServerECDHParams;
borlanic 0:fbdae7e6d805 121 */
borlanic 0:fbdae7e6d805 122 int mbedtls_ecdh_make_params( mbedtls_ecdh_context *ctx, size_t *olen,
borlanic 0:fbdae7e6d805 123 unsigned char *buf, size_t blen,
borlanic 0:fbdae7e6d805 124 int (*f_rng)(void *, unsigned char *, size_t),
borlanic 0:fbdae7e6d805 125 void *p_rng )
borlanic 0:fbdae7e6d805 126 {
borlanic 0:fbdae7e6d805 127 int ret;
borlanic 0:fbdae7e6d805 128 size_t grp_len, pt_len;
borlanic 0:fbdae7e6d805 129
borlanic 0:fbdae7e6d805 130 if( ctx == NULL || ctx->grp.pbits == 0 )
borlanic 0:fbdae7e6d805 131 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
borlanic 0:fbdae7e6d805 132
borlanic 0:fbdae7e6d805 133 if( ( ret = mbedtls_ecdh_gen_public( &ctx->grp, &ctx->d, &ctx->Q, f_rng, p_rng ) )
borlanic 0:fbdae7e6d805 134 != 0 )
borlanic 0:fbdae7e6d805 135 return( ret );
borlanic 0:fbdae7e6d805 136
borlanic 0:fbdae7e6d805 137 if( ( ret = mbedtls_ecp_tls_write_group( &ctx->grp, &grp_len, buf, blen ) )
borlanic 0:fbdae7e6d805 138 != 0 )
borlanic 0:fbdae7e6d805 139 return( ret );
borlanic 0:fbdae7e6d805 140
borlanic 0:fbdae7e6d805 141 buf += grp_len;
borlanic 0:fbdae7e6d805 142 blen -= grp_len;
borlanic 0:fbdae7e6d805 143
borlanic 0:fbdae7e6d805 144 if( ( ret = mbedtls_ecp_tls_write_point( &ctx->grp, &ctx->Q, ctx->point_format,
borlanic 0:fbdae7e6d805 145 &pt_len, buf, blen ) ) != 0 )
borlanic 0:fbdae7e6d805 146 return( ret );
borlanic 0:fbdae7e6d805 147
borlanic 0:fbdae7e6d805 148 *olen = grp_len + pt_len;
borlanic 0:fbdae7e6d805 149 return( 0 );
borlanic 0:fbdae7e6d805 150 }
borlanic 0:fbdae7e6d805 151
borlanic 0:fbdae7e6d805 152 /*
borlanic 0:fbdae7e6d805 153 * Read the ServerKeyExhange parameters (RFC 4492)
borlanic 0:fbdae7e6d805 154 * struct {
borlanic 0:fbdae7e6d805 155 * ECParameters curve_params;
borlanic 0:fbdae7e6d805 156 * ECPoint public;
borlanic 0:fbdae7e6d805 157 * } ServerECDHParams;
borlanic 0:fbdae7e6d805 158 */
borlanic 0:fbdae7e6d805 159 int mbedtls_ecdh_read_params( mbedtls_ecdh_context *ctx,
borlanic 0:fbdae7e6d805 160 const unsigned char **buf, const unsigned char *end )
borlanic 0:fbdae7e6d805 161 {
borlanic 0:fbdae7e6d805 162 int ret;
borlanic 0:fbdae7e6d805 163
borlanic 0:fbdae7e6d805 164 if( ( ret = mbedtls_ecp_tls_read_group( &ctx->grp, buf, end - *buf ) ) != 0 )
borlanic 0:fbdae7e6d805 165 return( ret );
borlanic 0:fbdae7e6d805 166
borlanic 0:fbdae7e6d805 167 if( ( ret = mbedtls_ecp_tls_read_point( &ctx->grp, &ctx->Qp, buf, end - *buf ) )
borlanic 0:fbdae7e6d805 168 != 0 )
borlanic 0:fbdae7e6d805 169 return( ret );
borlanic 0:fbdae7e6d805 170
borlanic 0:fbdae7e6d805 171 return( 0 );
borlanic 0:fbdae7e6d805 172 }
borlanic 0:fbdae7e6d805 173
borlanic 0:fbdae7e6d805 174 /*
borlanic 0:fbdae7e6d805 175 * Get parameters from a keypair
borlanic 0:fbdae7e6d805 176 */
borlanic 0:fbdae7e6d805 177 int mbedtls_ecdh_get_params( mbedtls_ecdh_context *ctx, const mbedtls_ecp_keypair *key,
borlanic 0:fbdae7e6d805 178 mbedtls_ecdh_side side )
borlanic 0:fbdae7e6d805 179 {
borlanic 0:fbdae7e6d805 180 int ret;
borlanic 0:fbdae7e6d805 181
borlanic 0:fbdae7e6d805 182 if( ( ret = mbedtls_ecp_group_copy( &ctx->grp, &key->grp ) ) != 0 )
borlanic 0:fbdae7e6d805 183 return( ret );
borlanic 0:fbdae7e6d805 184
borlanic 0:fbdae7e6d805 185 /* If it's not our key, just import the public part as Qp */
borlanic 0:fbdae7e6d805 186 if( side == MBEDTLS_ECDH_THEIRS )
borlanic 0:fbdae7e6d805 187 return( mbedtls_ecp_copy( &ctx->Qp, &key->Q ) );
borlanic 0:fbdae7e6d805 188
borlanic 0:fbdae7e6d805 189 /* Our key: import public (as Q) and private parts */
borlanic 0:fbdae7e6d805 190 if( side != MBEDTLS_ECDH_OURS )
borlanic 0:fbdae7e6d805 191 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
borlanic 0:fbdae7e6d805 192
borlanic 0:fbdae7e6d805 193 if( ( ret = mbedtls_ecp_copy( &ctx->Q, &key->Q ) ) != 0 ||
borlanic 0:fbdae7e6d805 194 ( ret = mbedtls_mpi_copy( &ctx->d, &key->d ) ) != 0 )
borlanic 0:fbdae7e6d805 195 return( ret );
borlanic 0:fbdae7e6d805 196
borlanic 0:fbdae7e6d805 197 return( 0 );
borlanic 0:fbdae7e6d805 198 }
borlanic 0:fbdae7e6d805 199
borlanic 0:fbdae7e6d805 200 /*
borlanic 0:fbdae7e6d805 201 * Setup and export the client public value
borlanic 0:fbdae7e6d805 202 */
borlanic 0:fbdae7e6d805 203 int mbedtls_ecdh_make_public( mbedtls_ecdh_context *ctx, size_t *olen,
borlanic 0:fbdae7e6d805 204 unsigned char *buf, size_t blen,
borlanic 0:fbdae7e6d805 205 int (*f_rng)(void *, unsigned char *, size_t),
borlanic 0:fbdae7e6d805 206 void *p_rng )
borlanic 0:fbdae7e6d805 207 {
borlanic 0:fbdae7e6d805 208 int ret;
borlanic 0:fbdae7e6d805 209
borlanic 0:fbdae7e6d805 210 if( ctx == NULL || ctx->grp.pbits == 0 )
borlanic 0:fbdae7e6d805 211 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
borlanic 0:fbdae7e6d805 212
borlanic 0:fbdae7e6d805 213 if( ( ret = mbedtls_ecdh_gen_public( &ctx->grp, &ctx->d, &ctx->Q, f_rng, p_rng ) )
borlanic 0:fbdae7e6d805 214 != 0 )
borlanic 0:fbdae7e6d805 215 return( ret );
borlanic 0:fbdae7e6d805 216
borlanic 0:fbdae7e6d805 217 return mbedtls_ecp_tls_write_point( &ctx->grp, &ctx->Q, ctx->point_format,
borlanic 0:fbdae7e6d805 218 olen, buf, blen );
borlanic 0:fbdae7e6d805 219 }
borlanic 0:fbdae7e6d805 220
borlanic 0:fbdae7e6d805 221 /*
borlanic 0:fbdae7e6d805 222 * Parse and import the client's public value
borlanic 0:fbdae7e6d805 223 */
borlanic 0:fbdae7e6d805 224 int mbedtls_ecdh_read_public( mbedtls_ecdh_context *ctx,
borlanic 0:fbdae7e6d805 225 const unsigned char *buf, size_t blen )
borlanic 0:fbdae7e6d805 226 {
borlanic 0:fbdae7e6d805 227 int ret;
borlanic 0:fbdae7e6d805 228 const unsigned char *p = buf;
borlanic 0:fbdae7e6d805 229
borlanic 0:fbdae7e6d805 230 if( ctx == NULL )
borlanic 0:fbdae7e6d805 231 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
borlanic 0:fbdae7e6d805 232
borlanic 0:fbdae7e6d805 233 if( ( ret = mbedtls_ecp_tls_read_point( &ctx->grp, &ctx->Qp, &p, blen ) ) != 0 )
borlanic 0:fbdae7e6d805 234 return( ret );
borlanic 0:fbdae7e6d805 235
borlanic 0:fbdae7e6d805 236 if( (size_t)( p - buf ) != blen )
borlanic 0:fbdae7e6d805 237 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
borlanic 0:fbdae7e6d805 238
borlanic 0:fbdae7e6d805 239 return( 0 );
borlanic 0:fbdae7e6d805 240 }
borlanic 0:fbdae7e6d805 241
borlanic 0:fbdae7e6d805 242 /*
borlanic 0:fbdae7e6d805 243 * Derive and export the shared secret
borlanic 0:fbdae7e6d805 244 */
borlanic 0:fbdae7e6d805 245 int mbedtls_ecdh_calc_secret( mbedtls_ecdh_context *ctx, size_t *olen,
borlanic 0:fbdae7e6d805 246 unsigned char *buf, size_t blen,
borlanic 0:fbdae7e6d805 247 int (*f_rng)(void *, unsigned char *, size_t),
borlanic 0:fbdae7e6d805 248 void *p_rng )
borlanic 0:fbdae7e6d805 249 {
borlanic 0:fbdae7e6d805 250 int ret;
borlanic 0:fbdae7e6d805 251
borlanic 0:fbdae7e6d805 252 if( ctx == NULL )
borlanic 0:fbdae7e6d805 253 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
borlanic 0:fbdae7e6d805 254
borlanic 0:fbdae7e6d805 255 if( ( ret = mbedtls_ecdh_compute_shared( &ctx->grp, &ctx->z, &ctx->Qp, &ctx->d,
borlanic 0:fbdae7e6d805 256 f_rng, p_rng ) ) != 0 )
borlanic 0:fbdae7e6d805 257 {
borlanic 0:fbdae7e6d805 258 return( ret );
borlanic 0:fbdae7e6d805 259 }
borlanic 0:fbdae7e6d805 260
borlanic 0:fbdae7e6d805 261 if( mbedtls_mpi_size( &ctx->z ) > blen )
borlanic 0:fbdae7e6d805 262 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
borlanic 0:fbdae7e6d805 263
borlanic 0:fbdae7e6d805 264 *olen = ctx->grp.pbits / 8 + ( ( ctx->grp.pbits % 8 ) != 0 );
borlanic 0:fbdae7e6d805 265 return mbedtls_mpi_write_binary( &ctx->z, buf, *olen );
borlanic 0:fbdae7e6d805 266 }
borlanic 0:fbdae7e6d805 267
borlanic 0:fbdae7e6d805 268 #endif /* MBEDTLS_ECDH_C */