![](/media/cache/profiles/debfdc81854eac26ec993b55a659c6e1.jpg.50x50_q85.jpg)
mbed client lightswitch demo
Dependencies: mbed Socket lwip-eth lwip-sys lwip
Fork of mbed-client-classic-example-lwip by
mbedtls/source/ecjpake.c@11:cada08fc8a70, 2016-06-09 (annotated)
- Committer:
- mbedAustin
- Date:
- Thu Jun 09 17:08:36 2016 +0000
- Revision:
- 11:cada08fc8a70
Commit for public Consumption
Who changed what in which revision?
User | Revision | Line number | New contents of line |
---|---|---|---|
mbedAustin | 11:cada08fc8a70 | 1 | /* |
mbedAustin | 11:cada08fc8a70 | 2 | * Elliptic curve J-PAKE |
mbedAustin | 11:cada08fc8a70 | 3 | * |
mbedAustin | 11:cada08fc8a70 | 4 | * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved |
mbedAustin | 11:cada08fc8a70 | 5 | * SPDX-License-Identifier: Apache-2.0 |
mbedAustin | 11:cada08fc8a70 | 6 | * |
mbedAustin | 11:cada08fc8a70 | 7 | * Licensed under the Apache License, Version 2.0 (the "License"); you may |
mbedAustin | 11:cada08fc8a70 | 8 | * not use this file except in compliance with the License. |
mbedAustin | 11:cada08fc8a70 | 9 | * You may obtain a copy of the License at |
mbedAustin | 11:cada08fc8a70 | 10 | * |
mbedAustin | 11:cada08fc8a70 | 11 | * http://www.apache.org/licenses/LICENSE-2.0 |
mbedAustin | 11:cada08fc8a70 | 12 | * |
mbedAustin | 11:cada08fc8a70 | 13 | * Unless required by applicable law or agreed to in writing, software |
mbedAustin | 11:cada08fc8a70 | 14 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT |
mbedAustin | 11:cada08fc8a70 | 15 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
mbedAustin | 11:cada08fc8a70 | 16 | * See the License for the specific language governing permissions and |
mbedAustin | 11:cada08fc8a70 | 17 | * limitations under the License. |
mbedAustin | 11:cada08fc8a70 | 18 | * |
mbedAustin | 11:cada08fc8a70 | 19 | * This file is part of mbed TLS (https://tls.mbed.org) |
mbedAustin | 11:cada08fc8a70 | 20 | */ |
mbedAustin | 11:cada08fc8a70 | 21 | |
mbedAustin | 11:cada08fc8a70 | 22 | /* |
mbedAustin | 11:cada08fc8a70 | 23 | * References in the code are to the Thread v1.0 Specification, |
mbedAustin | 11:cada08fc8a70 | 24 | * available to members of the Thread Group http://threadgroup.org/ |
mbedAustin | 11:cada08fc8a70 | 25 | */ |
mbedAustin | 11:cada08fc8a70 | 26 | |
mbedAustin | 11:cada08fc8a70 | 27 | #if !defined(MBEDTLS_CONFIG_FILE) |
mbedAustin | 11:cada08fc8a70 | 28 | #include "mbedtls/config.h" |
mbedAustin | 11:cada08fc8a70 | 29 | #else |
mbedAustin | 11:cada08fc8a70 | 30 | #include MBEDTLS_CONFIG_FILE |
mbedAustin | 11:cada08fc8a70 | 31 | #endif |
mbedAustin | 11:cada08fc8a70 | 32 | |
mbedAustin | 11:cada08fc8a70 | 33 | #if defined(MBEDTLS_ECJPAKE_C) |
mbedAustin | 11:cada08fc8a70 | 34 | |
mbedAustin | 11:cada08fc8a70 | 35 | #include "mbedtls/ecjpake.h" |
mbedAustin | 11:cada08fc8a70 | 36 | |
mbedAustin | 11:cada08fc8a70 | 37 | #include <string.h> |
mbedAustin | 11:cada08fc8a70 | 38 | |
mbedAustin | 11:cada08fc8a70 | 39 | /* |
mbedAustin | 11:cada08fc8a70 | 40 | * Convert a mbedtls_ecjpake_role to identifier string |
mbedAustin | 11:cada08fc8a70 | 41 | */ |
mbedAustin | 11:cada08fc8a70 | 42 | static const char * const ecjpake_id[] = { |
mbedAustin | 11:cada08fc8a70 | 43 | "client", |
mbedAustin | 11:cada08fc8a70 | 44 | "server" |
mbedAustin | 11:cada08fc8a70 | 45 | }; |
mbedAustin | 11:cada08fc8a70 | 46 | |
mbedAustin | 11:cada08fc8a70 | 47 | #define ID_MINE ( ecjpake_id[ ctx->role ] ) |
mbedAustin | 11:cada08fc8a70 | 48 | #define ID_PEER ( ecjpake_id[ 1 - ctx->role ] ) |
mbedAustin | 11:cada08fc8a70 | 49 | |
mbedAustin | 11:cada08fc8a70 | 50 | /* |
mbedAustin | 11:cada08fc8a70 | 51 | * Initialize context |
mbedAustin | 11:cada08fc8a70 | 52 | */ |
mbedAustin | 11:cada08fc8a70 | 53 | void mbedtls_ecjpake_init( mbedtls_ecjpake_context *ctx ) |
mbedAustin | 11:cada08fc8a70 | 54 | { |
mbedAustin | 11:cada08fc8a70 | 55 | if( ctx == NULL ) |
mbedAustin | 11:cada08fc8a70 | 56 | return; |
mbedAustin | 11:cada08fc8a70 | 57 | |
mbedAustin | 11:cada08fc8a70 | 58 | ctx->md_info = NULL; |
mbedAustin | 11:cada08fc8a70 | 59 | mbedtls_ecp_group_init( &ctx->grp ); |
mbedAustin | 11:cada08fc8a70 | 60 | ctx->point_format = MBEDTLS_ECP_PF_UNCOMPRESSED; |
mbedAustin | 11:cada08fc8a70 | 61 | |
mbedAustin | 11:cada08fc8a70 | 62 | mbedtls_ecp_point_init( &ctx->Xm1 ); |
mbedAustin | 11:cada08fc8a70 | 63 | mbedtls_ecp_point_init( &ctx->Xm2 ); |
mbedAustin | 11:cada08fc8a70 | 64 | mbedtls_ecp_point_init( &ctx->Xp1 ); |
mbedAustin | 11:cada08fc8a70 | 65 | mbedtls_ecp_point_init( &ctx->Xp2 ); |
mbedAustin | 11:cada08fc8a70 | 66 | mbedtls_ecp_point_init( &ctx->Xp ); |
mbedAustin | 11:cada08fc8a70 | 67 | |
mbedAustin | 11:cada08fc8a70 | 68 | mbedtls_mpi_init( &ctx->xm1 ); |
mbedAustin | 11:cada08fc8a70 | 69 | mbedtls_mpi_init( &ctx->xm2 ); |
mbedAustin | 11:cada08fc8a70 | 70 | mbedtls_mpi_init( &ctx->s ); |
mbedAustin | 11:cada08fc8a70 | 71 | } |
mbedAustin | 11:cada08fc8a70 | 72 | |
mbedAustin | 11:cada08fc8a70 | 73 | /* |
mbedAustin | 11:cada08fc8a70 | 74 | * Free context |
mbedAustin | 11:cada08fc8a70 | 75 | */ |
mbedAustin | 11:cada08fc8a70 | 76 | void mbedtls_ecjpake_free( mbedtls_ecjpake_context *ctx ) |
mbedAustin | 11:cada08fc8a70 | 77 | { |
mbedAustin | 11:cada08fc8a70 | 78 | if( ctx == NULL ) |
mbedAustin | 11:cada08fc8a70 | 79 | return; |
mbedAustin | 11:cada08fc8a70 | 80 | |
mbedAustin | 11:cada08fc8a70 | 81 | ctx->md_info = NULL; |
mbedAustin | 11:cada08fc8a70 | 82 | mbedtls_ecp_group_free( &ctx->grp ); |
mbedAustin | 11:cada08fc8a70 | 83 | |
mbedAustin | 11:cada08fc8a70 | 84 | mbedtls_ecp_point_free( &ctx->Xm1 ); |
mbedAustin | 11:cada08fc8a70 | 85 | mbedtls_ecp_point_free( &ctx->Xm2 ); |
mbedAustin | 11:cada08fc8a70 | 86 | mbedtls_ecp_point_free( &ctx->Xp1 ); |
mbedAustin | 11:cada08fc8a70 | 87 | mbedtls_ecp_point_free( &ctx->Xp2 ); |
mbedAustin | 11:cada08fc8a70 | 88 | mbedtls_ecp_point_free( &ctx->Xp ); |
mbedAustin | 11:cada08fc8a70 | 89 | |
mbedAustin | 11:cada08fc8a70 | 90 | mbedtls_mpi_free( &ctx->xm1 ); |
mbedAustin | 11:cada08fc8a70 | 91 | mbedtls_mpi_free( &ctx->xm2 ); |
mbedAustin | 11:cada08fc8a70 | 92 | mbedtls_mpi_free( &ctx->s ); |
mbedAustin | 11:cada08fc8a70 | 93 | } |
mbedAustin | 11:cada08fc8a70 | 94 | |
mbedAustin | 11:cada08fc8a70 | 95 | /* |
mbedAustin | 11:cada08fc8a70 | 96 | * Setup context |
mbedAustin | 11:cada08fc8a70 | 97 | */ |
mbedAustin | 11:cada08fc8a70 | 98 | int mbedtls_ecjpake_setup( mbedtls_ecjpake_context *ctx, |
mbedAustin | 11:cada08fc8a70 | 99 | mbedtls_ecjpake_role role, |
mbedAustin | 11:cada08fc8a70 | 100 | mbedtls_md_type_t hash, |
mbedAustin | 11:cada08fc8a70 | 101 | mbedtls_ecp_group_id curve, |
mbedAustin | 11:cada08fc8a70 | 102 | const unsigned char *secret, |
mbedAustin | 11:cada08fc8a70 | 103 | size_t len ) |
mbedAustin | 11:cada08fc8a70 | 104 | { |
mbedAustin | 11:cada08fc8a70 | 105 | int ret; |
mbedAustin | 11:cada08fc8a70 | 106 | |
mbedAustin | 11:cada08fc8a70 | 107 | ctx->role = role; |
mbedAustin | 11:cada08fc8a70 | 108 | |
mbedAustin | 11:cada08fc8a70 | 109 | if( ( ctx->md_info = mbedtls_md_info_from_type( hash ) ) == NULL ) |
mbedAustin | 11:cada08fc8a70 | 110 | return( MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE ); |
mbedAustin | 11:cada08fc8a70 | 111 | |
mbedAustin | 11:cada08fc8a70 | 112 | MBEDTLS_MPI_CHK( mbedtls_ecp_group_load( &ctx->grp, curve ) ); |
mbedAustin | 11:cada08fc8a70 | 113 | |
mbedAustin | 11:cada08fc8a70 | 114 | MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &ctx->s, secret, len ) ); |
mbedAustin | 11:cada08fc8a70 | 115 | |
mbedAustin | 11:cada08fc8a70 | 116 | cleanup: |
mbedAustin | 11:cada08fc8a70 | 117 | if( ret != 0 ) |
mbedAustin | 11:cada08fc8a70 | 118 | mbedtls_ecjpake_free( ctx ); |
mbedAustin | 11:cada08fc8a70 | 119 | |
mbedAustin | 11:cada08fc8a70 | 120 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 121 | } |
mbedAustin | 11:cada08fc8a70 | 122 | |
mbedAustin | 11:cada08fc8a70 | 123 | /* |
mbedAustin | 11:cada08fc8a70 | 124 | * Check if context is ready for use |
mbedAustin | 11:cada08fc8a70 | 125 | */ |
mbedAustin | 11:cada08fc8a70 | 126 | int mbedtls_ecjpake_check( const mbedtls_ecjpake_context *ctx ) |
mbedAustin | 11:cada08fc8a70 | 127 | { |
mbedAustin | 11:cada08fc8a70 | 128 | if( ctx->md_info == NULL || |
mbedAustin | 11:cada08fc8a70 | 129 | ctx->grp.id == MBEDTLS_ECP_DP_NONE || |
mbedAustin | 11:cada08fc8a70 | 130 | ctx->s.p == NULL ) |
mbedAustin | 11:cada08fc8a70 | 131 | { |
mbedAustin | 11:cada08fc8a70 | 132 | return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA ); |
mbedAustin | 11:cada08fc8a70 | 133 | } |
mbedAustin | 11:cada08fc8a70 | 134 | |
mbedAustin | 11:cada08fc8a70 | 135 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 136 | } |
mbedAustin | 11:cada08fc8a70 | 137 | |
mbedAustin | 11:cada08fc8a70 | 138 | /* |
mbedAustin | 11:cada08fc8a70 | 139 | * Write a point plus its length to a buffer |
mbedAustin | 11:cada08fc8a70 | 140 | */ |
mbedAustin | 11:cada08fc8a70 | 141 | static int ecjpake_write_len_point( unsigned char **p, |
mbedAustin | 11:cada08fc8a70 | 142 | const unsigned char *end, |
mbedAustin | 11:cada08fc8a70 | 143 | const mbedtls_ecp_group *grp, |
mbedAustin | 11:cada08fc8a70 | 144 | const int pf, |
mbedAustin | 11:cada08fc8a70 | 145 | const mbedtls_ecp_point *P ) |
mbedAustin | 11:cada08fc8a70 | 146 | { |
mbedAustin | 11:cada08fc8a70 | 147 | int ret; |
mbedAustin | 11:cada08fc8a70 | 148 | size_t len; |
mbedAustin | 11:cada08fc8a70 | 149 | |
mbedAustin | 11:cada08fc8a70 | 150 | /* Need at least 4 for length plus 1 for point */ |
mbedAustin | 11:cada08fc8a70 | 151 | if( end < *p || end - *p < 5 ) |
mbedAustin | 11:cada08fc8a70 | 152 | return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL ); |
mbedAustin | 11:cada08fc8a70 | 153 | |
mbedAustin | 11:cada08fc8a70 | 154 | ret = mbedtls_ecp_point_write_binary( grp, P, pf, |
mbedAustin | 11:cada08fc8a70 | 155 | &len, *p + 4, end - ( *p + 4 ) ); |
mbedAustin | 11:cada08fc8a70 | 156 | if( ret != 0 ) |
mbedAustin | 11:cada08fc8a70 | 157 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 158 | |
mbedAustin | 11:cada08fc8a70 | 159 | (*p)[0] = (unsigned char)( ( len >> 24 ) & 0xFF ); |
mbedAustin | 11:cada08fc8a70 | 160 | (*p)[1] = (unsigned char)( ( len >> 16 ) & 0xFF ); |
mbedAustin | 11:cada08fc8a70 | 161 | (*p)[2] = (unsigned char)( ( len >> 8 ) & 0xFF ); |
mbedAustin | 11:cada08fc8a70 | 162 | (*p)[3] = (unsigned char)( ( len ) & 0xFF ); |
mbedAustin | 11:cada08fc8a70 | 163 | |
mbedAustin | 11:cada08fc8a70 | 164 | *p += 4 + len; |
mbedAustin | 11:cada08fc8a70 | 165 | |
mbedAustin | 11:cada08fc8a70 | 166 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 167 | } |
mbedAustin | 11:cada08fc8a70 | 168 | |
mbedAustin | 11:cada08fc8a70 | 169 | /* |
mbedAustin | 11:cada08fc8a70 | 170 | * Size of the temporary buffer for ecjpake_hash: |
mbedAustin | 11:cada08fc8a70 | 171 | * 3 EC points plus their length, plus ID and its length (4 + 6 bytes) |
mbedAustin | 11:cada08fc8a70 | 172 | */ |
mbedAustin | 11:cada08fc8a70 | 173 | #define ECJPAKE_HASH_BUF_LEN ( 3 * ( 4 + MBEDTLS_ECP_MAX_PT_LEN ) + 4 + 6 ) |
mbedAustin | 11:cada08fc8a70 | 174 | |
mbedAustin | 11:cada08fc8a70 | 175 | /* |
mbedAustin | 11:cada08fc8a70 | 176 | * Compute hash for ZKP (7.4.2.2.2.1) |
mbedAustin | 11:cada08fc8a70 | 177 | */ |
mbedAustin | 11:cada08fc8a70 | 178 | static int ecjpake_hash( const mbedtls_md_info_t *md_info, |
mbedAustin | 11:cada08fc8a70 | 179 | const mbedtls_ecp_group *grp, |
mbedAustin | 11:cada08fc8a70 | 180 | const int pf, |
mbedAustin | 11:cada08fc8a70 | 181 | const mbedtls_ecp_point *G, |
mbedAustin | 11:cada08fc8a70 | 182 | const mbedtls_ecp_point *V, |
mbedAustin | 11:cada08fc8a70 | 183 | const mbedtls_ecp_point *X, |
mbedAustin | 11:cada08fc8a70 | 184 | const char *id, |
mbedAustin | 11:cada08fc8a70 | 185 | mbedtls_mpi *h ) |
mbedAustin | 11:cada08fc8a70 | 186 | { |
mbedAustin | 11:cada08fc8a70 | 187 | int ret; |
mbedAustin | 11:cada08fc8a70 | 188 | unsigned char buf[ECJPAKE_HASH_BUF_LEN]; |
mbedAustin | 11:cada08fc8a70 | 189 | unsigned char *p = buf; |
mbedAustin | 11:cada08fc8a70 | 190 | const unsigned char *end = buf + sizeof( buf ); |
mbedAustin | 11:cada08fc8a70 | 191 | const size_t id_len = strlen( id ); |
mbedAustin | 11:cada08fc8a70 | 192 | unsigned char hash[MBEDTLS_MD_MAX_SIZE]; |
mbedAustin | 11:cada08fc8a70 | 193 | |
mbedAustin | 11:cada08fc8a70 | 194 | /* Write things to temporary buffer */ |
mbedAustin | 11:cada08fc8a70 | 195 | MBEDTLS_MPI_CHK( ecjpake_write_len_point( &p, end, grp, pf, G ) ); |
mbedAustin | 11:cada08fc8a70 | 196 | MBEDTLS_MPI_CHK( ecjpake_write_len_point( &p, end, grp, pf, V ) ); |
mbedAustin | 11:cada08fc8a70 | 197 | MBEDTLS_MPI_CHK( ecjpake_write_len_point( &p, end, grp, pf, X ) ); |
mbedAustin | 11:cada08fc8a70 | 198 | |
mbedAustin | 11:cada08fc8a70 | 199 | if( end - p < 4 ) |
mbedAustin | 11:cada08fc8a70 | 200 | return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL ); |
mbedAustin | 11:cada08fc8a70 | 201 | |
mbedAustin | 11:cada08fc8a70 | 202 | *p++ = (unsigned char)( ( id_len >> 24 ) & 0xFF ); |
mbedAustin | 11:cada08fc8a70 | 203 | *p++ = (unsigned char)( ( id_len >> 16 ) & 0xFF ); |
mbedAustin | 11:cada08fc8a70 | 204 | *p++ = (unsigned char)( ( id_len >> 8 ) & 0xFF ); |
mbedAustin | 11:cada08fc8a70 | 205 | *p++ = (unsigned char)( ( id_len ) & 0xFF ); |
mbedAustin | 11:cada08fc8a70 | 206 | |
mbedAustin | 11:cada08fc8a70 | 207 | if( end < p || (size_t)( end - p ) < id_len ) |
mbedAustin | 11:cada08fc8a70 | 208 | return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL ); |
mbedAustin | 11:cada08fc8a70 | 209 | |
mbedAustin | 11:cada08fc8a70 | 210 | memcpy( p, id, id_len ); |
mbedAustin | 11:cada08fc8a70 | 211 | p += id_len; |
mbedAustin | 11:cada08fc8a70 | 212 | |
mbedAustin | 11:cada08fc8a70 | 213 | /* Compute hash */ |
mbedAustin | 11:cada08fc8a70 | 214 | mbedtls_md( md_info, buf, p - buf, hash ); |
mbedAustin | 11:cada08fc8a70 | 215 | |
mbedAustin | 11:cada08fc8a70 | 216 | /* Turn it into an integer mod n */ |
mbedAustin | 11:cada08fc8a70 | 217 | MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( h, hash, |
mbedAustin | 11:cada08fc8a70 | 218 | mbedtls_md_get_size( md_info ) ) ); |
mbedAustin | 11:cada08fc8a70 | 219 | MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( h, h, &grp->N ) ); |
mbedAustin | 11:cada08fc8a70 | 220 | |
mbedAustin | 11:cada08fc8a70 | 221 | cleanup: |
mbedAustin | 11:cada08fc8a70 | 222 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 223 | } |
mbedAustin | 11:cada08fc8a70 | 224 | |
mbedAustin | 11:cada08fc8a70 | 225 | /* |
mbedAustin | 11:cada08fc8a70 | 226 | * Parse a ECShnorrZKP (7.4.2.2.2) and verify it (7.4.2.3.3) |
mbedAustin | 11:cada08fc8a70 | 227 | */ |
mbedAustin | 11:cada08fc8a70 | 228 | static int ecjpake_zkp_read( const mbedtls_md_info_t *md_info, |
mbedAustin | 11:cada08fc8a70 | 229 | const mbedtls_ecp_group *grp, |
mbedAustin | 11:cada08fc8a70 | 230 | const int pf, |
mbedAustin | 11:cada08fc8a70 | 231 | const mbedtls_ecp_point *G, |
mbedAustin | 11:cada08fc8a70 | 232 | const mbedtls_ecp_point *X, |
mbedAustin | 11:cada08fc8a70 | 233 | const char *id, |
mbedAustin | 11:cada08fc8a70 | 234 | const unsigned char **p, |
mbedAustin | 11:cada08fc8a70 | 235 | const unsigned char *end ) |
mbedAustin | 11:cada08fc8a70 | 236 | { |
mbedAustin | 11:cada08fc8a70 | 237 | int ret; |
mbedAustin | 11:cada08fc8a70 | 238 | mbedtls_ecp_point V, VV; |
mbedAustin | 11:cada08fc8a70 | 239 | mbedtls_mpi r, h; |
mbedAustin | 11:cada08fc8a70 | 240 | size_t r_len; |
mbedAustin | 11:cada08fc8a70 | 241 | |
mbedAustin | 11:cada08fc8a70 | 242 | mbedtls_ecp_point_init( &V ); |
mbedAustin | 11:cada08fc8a70 | 243 | mbedtls_ecp_point_init( &VV ); |
mbedAustin | 11:cada08fc8a70 | 244 | mbedtls_mpi_init( &r ); |
mbedAustin | 11:cada08fc8a70 | 245 | mbedtls_mpi_init( &h ); |
mbedAustin | 11:cada08fc8a70 | 246 | |
mbedAustin | 11:cada08fc8a70 | 247 | /* |
mbedAustin | 11:cada08fc8a70 | 248 | * struct { |
mbedAustin | 11:cada08fc8a70 | 249 | * ECPoint V; |
mbedAustin | 11:cada08fc8a70 | 250 | * opaque r<1..2^8-1>; |
mbedAustin | 11:cada08fc8a70 | 251 | * } ECSchnorrZKP; |
mbedAustin | 11:cada08fc8a70 | 252 | */ |
mbedAustin | 11:cada08fc8a70 | 253 | if( end < *p ) |
mbedAustin | 11:cada08fc8a70 | 254 | return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA ); |
mbedAustin | 11:cada08fc8a70 | 255 | |
mbedAustin | 11:cada08fc8a70 | 256 | MBEDTLS_MPI_CHK( mbedtls_ecp_tls_read_point( grp, &V, p, end - *p ) ); |
mbedAustin | 11:cada08fc8a70 | 257 | |
mbedAustin | 11:cada08fc8a70 | 258 | if( end < *p || (size_t)( end - *p ) < 1 ) |
mbedAustin | 11:cada08fc8a70 | 259 | { |
mbedAustin | 11:cada08fc8a70 | 260 | ret = MBEDTLS_ERR_ECP_BAD_INPUT_DATA; |
mbedAustin | 11:cada08fc8a70 | 261 | goto cleanup; |
mbedAustin | 11:cada08fc8a70 | 262 | } |
mbedAustin | 11:cada08fc8a70 | 263 | |
mbedAustin | 11:cada08fc8a70 | 264 | r_len = *(*p)++; |
mbedAustin | 11:cada08fc8a70 | 265 | |
mbedAustin | 11:cada08fc8a70 | 266 | if( end < *p || (size_t)( end - *p ) < r_len ) |
mbedAustin | 11:cada08fc8a70 | 267 | { |
mbedAustin | 11:cada08fc8a70 | 268 | ret = MBEDTLS_ERR_ECP_BAD_INPUT_DATA; |
mbedAustin | 11:cada08fc8a70 | 269 | goto cleanup; |
mbedAustin | 11:cada08fc8a70 | 270 | } |
mbedAustin | 11:cada08fc8a70 | 271 | |
mbedAustin | 11:cada08fc8a70 | 272 | MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &r, *p, r_len ) ); |
mbedAustin | 11:cada08fc8a70 | 273 | *p += r_len; |
mbedAustin | 11:cada08fc8a70 | 274 | |
mbedAustin | 11:cada08fc8a70 | 275 | /* |
mbedAustin | 11:cada08fc8a70 | 276 | * Verification |
mbedAustin | 11:cada08fc8a70 | 277 | */ |
mbedAustin | 11:cada08fc8a70 | 278 | MBEDTLS_MPI_CHK( ecjpake_hash( md_info, grp, pf, G, &V, X, id, &h ) ); |
mbedAustin | 11:cada08fc8a70 | 279 | MBEDTLS_MPI_CHK( mbedtls_ecp_muladd( (mbedtls_ecp_group *) grp, |
mbedAustin | 11:cada08fc8a70 | 280 | &VV, &h, X, &r, G ) ); |
mbedAustin | 11:cada08fc8a70 | 281 | |
mbedAustin | 11:cada08fc8a70 | 282 | if( mbedtls_ecp_point_cmp( &VV, &V ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 283 | { |
mbedAustin | 11:cada08fc8a70 | 284 | ret = MBEDTLS_ERR_ECP_VERIFY_FAILED; |
mbedAustin | 11:cada08fc8a70 | 285 | goto cleanup; |
mbedAustin | 11:cada08fc8a70 | 286 | } |
mbedAustin | 11:cada08fc8a70 | 287 | |
mbedAustin | 11:cada08fc8a70 | 288 | cleanup: |
mbedAustin | 11:cada08fc8a70 | 289 | mbedtls_ecp_point_free( &V ); |
mbedAustin | 11:cada08fc8a70 | 290 | mbedtls_ecp_point_free( &VV ); |
mbedAustin | 11:cada08fc8a70 | 291 | mbedtls_mpi_free( &r ); |
mbedAustin | 11:cada08fc8a70 | 292 | mbedtls_mpi_free( &h ); |
mbedAustin | 11:cada08fc8a70 | 293 | |
mbedAustin | 11:cada08fc8a70 | 294 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 295 | } |
mbedAustin | 11:cada08fc8a70 | 296 | |
mbedAustin | 11:cada08fc8a70 | 297 | /* |
mbedAustin | 11:cada08fc8a70 | 298 | * Generate ZKP (7.4.2.3.2) and write it as ECSchnorrZKP (7.4.2.2.2) |
mbedAustin | 11:cada08fc8a70 | 299 | */ |
mbedAustin | 11:cada08fc8a70 | 300 | static int ecjpake_zkp_write( const mbedtls_md_info_t *md_info, |
mbedAustin | 11:cada08fc8a70 | 301 | const mbedtls_ecp_group *grp, |
mbedAustin | 11:cada08fc8a70 | 302 | const int pf, |
mbedAustin | 11:cada08fc8a70 | 303 | const mbedtls_ecp_point *G, |
mbedAustin | 11:cada08fc8a70 | 304 | const mbedtls_mpi *x, |
mbedAustin | 11:cada08fc8a70 | 305 | const mbedtls_ecp_point *X, |
mbedAustin | 11:cada08fc8a70 | 306 | const char *id, |
mbedAustin | 11:cada08fc8a70 | 307 | unsigned char **p, |
mbedAustin | 11:cada08fc8a70 | 308 | const unsigned char *end, |
mbedAustin | 11:cada08fc8a70 | 309 | int (*f_rng)(void *, unsigned char *, size_t), |
mbedAustin | 11:cada08fc8a70 | 310 | void *p_rng ) |
mbedAustin | 11:cada08fc8a70 | 311 | { |
mbedAustin | 11:cada08fc8a70 | 312 | int ret; |
mbedAustin | 11:cada08fc8a70 | 313 | mbedtls_ecp_point V; |
mbedAustin | 11:cada08fc8a70 | 314 | mbedtls_mpi v; |
mbedAustin | 11:cada08fc8a70 | 315 | mbedtls_mpi h; /* later recycled to hold r */ |
mbedAustin | 11:cada08fc8a70 | 316 | size_t len; |
mbedAustin | 11:cada08fc8a70 | 317 | |
mbedAustin | 11:cada08fc8a70 | 318 | if( end < *p ) |
mbedAustin | 11:cada08fc8a70 | 319 | return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL ); |
mbedAustin | 11:cada08fc8a70 | 320 | |
mbedAustin | 11:cada08fc8a70 | 321 | mbedtls_ecp_point_init( &V ); |
mbedAustin | 11:cada08fc8a70 | 322 | mbedtls_mpi_init( &v ); |
mbedAustin | 11:cada08fc8a70 | 323 | mbedtls_mpi_init( &h ); |
mbedAustin | 11:cada08fc8a70 | 324 | |
mbedAustin | 11:cada08fc8a70 | 325 | /* Compute signature */ |
mbedAustin | 11:cada08fc8a70 | 326 | MBEDTLS_MPI_CHK( mbedtls_ecp_gen_keypair_base( (mbedtls_ecp_group *) grp, |
mbedAustin | 11:cada08fc8a70 | 327 | G, &v, &V, f_rng, p_rng ) ); |
mbedAustin | 11:cada08fc8a70 | 328 | MBEDTLS_MPI_CHK( ecjpake_hash( md_info, grp, pf, G, &V, X, id, &h ) ); |
mbedAustin | 11:cada08fc8a70 | 329 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &h, &h, x ) ); /* x*h */ |
mbedAustin | 11:cada08fc8a70 | 330 | MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &h, &v, &h ) ); /* v - x*h */ |
mbedAustin | 11:cada08fc8a70 | 331 | MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &h, &h, &grp->N ) ); /* r */ |
mbedAustin | 11:cada08fc8a70 | 332 | |
mbedAustin | 11:cada08fc8a70 | 333 | /* Write it out */ |
mbedAustin | 11:cada08fc8a70 | 334 | MBEDTLS_MPI_CHK( mbedtls_ecp_tls_write_point( grp, &V, |
mbedAustin | 11:cada08fc8a70 | 335 | pf, &len, *p, end - *p ) ); |
mbedAustin | 11:cada08fc8a70 | 336 | *p += len; |
mbedAustin | 11:cada08fc8a70 | 337 | |
mbedAustin | 11:cada08fc8a70 | 338 | len = mbedtls_mpi_size( &h ); /* actually r */ |
mbedAustin | 11:cada08fc8a70 | 339 | if( end < *p || (size_t)( end - *p ) < 1 + len || len > 255 ) |
mbedAustin | 11:cada08fc8a70 | 340 | { |
mbedAustin | 11:cada08fc8a70 | 341 | ret = MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL; |
mbedAustin | 11:cada08fc8a70 | 342 | goto cleanup; |
mbedAustin | 11:cada08fc8a70 | 343 | } |
mbedAustin | 11:cada08fc8a70 | 344 | |
mbedAustin | 11:cada08fc8a70 | 345 | *(*p)++ = (unsigned char)( len & 0xFF ); |
mbedAustin | 11:cada08fc8a70 | 346 | MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &h, *p, len ) ); /* r */ |
mbedAustin | 11:cada08fc8a70 | 347 | *p += len; |
mbedAustin | 11:cada08fc8a70 | 348 | |
mbedAustin | 11:cada08fc8a70 | 349 | cleanup: |
mbedAustin | 11:cada08fc8a70 | 350 | mbedtls_ecp_point_free( &V ); |
mbedAustin | 11:cada08fc8a70 | 351 | mbedtls_mpi_free( &v ); |
mbedAustin | 11:cada08fc8a70 | 352 | mbedtls_mpi_free( &h ); |
mbedAustin | 11:cada08fc8a70 | 353 | |
mbedAustin | 11:cada08fc8a70 | 354 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 355 | } |
mbedAustin | 11:cada08fc8a70 | 356 | |
mbedAustin | 11:cada08fc8a70 | 357 | /* |
mbedAustin | 11:cada08fc8a70 | 358 | * Parse a ECJPAKEKeyKP (7.4.2.2.1) and check proof |
mbedAustin | 11:cada08fc8a70 | 359 | * Output: verified public key X |
mbedAustin | 11:cada08fc8a70 | 360 | */ |
mbedAustin | 11:cada08fc8a70 | 361 | static int ecjpake_kkp_read( const mbedtls_md_info_t *md_info, |
mbedAustin | 11:cada08fc8a70 | 362 | const mbedtls_ecp_group *grp, |
mbedAustin | 11:cada08fc8a70 | 363 | const int pf, |
mbedAustin | 11:cada08fc8a70 | 364 | const mbedtls_ecp_point *G, |
mbedAustin | 11:cada08fc8a70 | 365 | mbedtls_ecp_point *X, |
mbedAustin | 11:cada08fc8a70 | 366 | const char *id, |
mbedAustin | 11:cada08fc8a70 | 367 | const unsigned char **p, |
mbedAustin | 11:cada08fc8a70 | 368 | const unsigned char *end ) |
mbedAustin | 11:cada08fc8a70 | 369 | { |
mbedAustin | 11:cada08fc8a70 | 370 | int ret; |
mbedAustin | 11:cada08fc8a70 | 371 | |
mbedAustin | 11:cada08fc8a70 | 372 | if( end < *p ) |
mbedAustin | 11:cada08fc8a70 | 373 | return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA ); |
mbedAustin | 11:cada08fc8a70 | 374 | |
mbedAustin | 11:cada08fc8a70 | 375 | /* |
mbedAustin | 11:cada08fc8a70 | 376 | * struct { |
mbedAustin | 11:cada08fc8a70 | 377 | * ECPoint X; |
mbedAustin | 11:cada08fc8a70 | 378 | * ECSchnorrZKP zkp; |
mbedAustin | 11:cada08fc8a70 | 379 | * } ECJPAKEKeyKP; |
mbedAustin | 11:cada08fc8a70 | 380 | */ |
mbedAustin | 11:cada08fc8a70 | 381 | MBEDTLS_MPI_CHK( mbedtls_ecp_tls_read_point( grp, X, p, end - *p ) ); |
mbedAustin | 11:cada08fc8a70 | 382 | if( mbedtls_ecp_is_zero( X ) ) |
mbedAustin | 11:cada08fc8a70 | 383 | { |
mbedAustin | 11:cada08fc8a70 | 384 | ret = MBEDTLS_ERR_ECP_INVALID_KEY; |
mbedAustin | 11:cada08fc8a70 | 385 | goto cleanup; |
mbedAustin | 11:cada08fc8a70 | 386 | } |
mbedAustin | 11:cada08fc8a70 | 387 | |
mbedAustin | 11:cada08fc8a70 | 388 | MBEDTLS_MPI_CHK( ecjpake_zkp_read( md_info, grp, pf, G, X, id, p, end ) ); |
mbedAustin | 11:cada08fc8a70 | 389 | |
mbedAustin | 11:cada08fc8a70 | 390 | cleanup: |
mbedAustin | 11:cada08fc8a70 | 391 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 392 | } |
mbedAustin | 11:cada08fc8a70 | 393 | |
mbedAustin | 11:cada08fc8a70 | 394 | /* |
mbedAustin | 11:cada08fc8a70 | 395 | * Generate an ECJPAKEKeyKP |
mbedAustin | 11:cada08fc8a70 | 396 | * Output: the serialized structure, plus private/public key pair |
mbedAustin | 11:cada08fc8a70 | 397 | */ |
mbedAustin | 11:cada08fc8a70 | 398 | static int ecjpake_kkp_write( const mbedtls_md_info_t *md_info, |
mbedAustin | 11:cada08fc8a70 | 399 | const mbedtls_ecp_group *grp, |
mbedAustin | 11:cada08fc8a70 | 400 | const int pf, |
mbedAustin | 11:cada08fc8a70 | 401 | const mbedtls_ecp_point *G, |
mbedAustin | 11:cada08fc8a70 | 402 | mbedtls_mpi *x, |
mbedAustin | 11:cada08fc8a70 | 403 | mbedtls_ecp_point *X, |
mbedAustin | 11:cada08fc8a70 | 404 | const char *id, |
mbedAustin | 11:cada08fc8a70 | 405 | unsigned char **p, |
mbedAustin | 11:cada08fc8a70 | 406 | const unsigned char *end, |
mbedAustin | 11:cada08fc8a70 | 407 | int (*f_rng)(void *, unsigned char *, size_t), |
mbedAustin | 11:cada08fc8a70 | 408 | void *p_rng ) |
mbedAustin | 11:cada08fc8a70 | 409 | { |
mbedAustin | 11:cada08fc8a70 | 410 | int ret; |
mbedAustin | 11:cada08fc8a70 | 411 | size_t len; |
mbedAustin | 11:cada08fc8a70 | 412 | |
mbedAustin | 11:cada08fc8a70 | 413 | if( end < *p ) |
mbedAustin | 11:cada08fc8a70 | 414 | return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL ); |
mbedAustin | 11:cada08fc8a70 | 415 | |
mbedAustin | 11:cada08fc8a70 | 416 | /* Generate key (7.4.2.3.1) and write it out */ |
mbedAustin | 11:cada08fc8a70 | 417 | MBEDTLS_MPI_CHK( mbedtls_ecp_gen_keypair_base( (mbedtls_ecp_group *) grp, G, x, X, |
mbedAustin | 11:cada08fc8a70 | 418 | f_rng, p_rng ) ); |
mbedAustin | 11:cada08fc8a70 | 419 | MBEDTLS_MPI_CHK( mbedtls_ecp_tls_write_point( grp, X, |
mbedAustin | 11:cada08fc8a70 | 420 | pf, &len, *p, end - *p ) ); |
mbedAustin | 11:cada08fc8a70 | 421 | *p += len; |
mbedAustin | 11:cada08fc8a70 | 422 | |
mbedAustin | 11:cada08fc8a70 | 423 | /* Generate and write proof */ |
mbedAustin | 11:cada08fc8a70 | 424 | MBEDTLS_MPI_CHK( ecjpake_zkp_write( md_info, grp, pf, G, x, X, id, |
mbedAustin | 11:cada08fc8a70 | 425 | p, end, f_rng, p_rng ) ); |
mbedAustin | 11:cada08fc8a70 | 426 | |
mbedAustin | 11:cada08fc8a70 | 427 | cleanup: |
mbedAustin | 11:cada08fc8a70 | 428 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 429 | } |
mbedAustin | 11:cada08fc8a70 | 430 | |
mbedAustin | 11:cada08fc8a70 | 431 | /* |
mbedAustin | 11:cada08fc8a70 | 432 | * Read a ECJPAKEKeyKPPairList (7.4.2.3) and check proofs |
mbedAustin | 11:cada08fc8a70 | 433 | * Ouputs: verified peer public keys Xa, Xb |
mbedAustin | 11:cada08fc8a70 | 434 | */ |
mbedAustin | 11:cada08fc8a70 | 435 | static int ecjpake_kkpp_read( const mbedtls_md_info_t *md_info, |
mbedAustin | 11:cada08fc8a70 | 436 | const mbedtls_ecp_group *grp, |
mbedAustin | 11:cada08fc8a70 | 437 | const int pf, |
mbedAustin | 11:cada08fc8a70 | 438 | const mbedtls_ecp_point *G, |
mbedAustin | 11:cada08fc8a70 | 439 | mbedtls_ecp_point *Xa, |
mbedAustin | 11:cada08fc8a70 | 440 | mbedtls_ecp_point *Xb, |
mbedAustin | 11:cada08fc8a70 | 441 | const char *id, |
mbedAustin | 11:cada08fc8a70 | 442 | const unsigned char *buf, |
mbedAustin | 11:cada08fc8a70 | 443 | size_t len ) |
mbedAustin | 11:cada08fc8a70 | 444 | { |
mbedAustin | 11:cada08fc8a70 | 445 | int ret; |
mbedAustin | 11:cada08fc8a70 | 446 | const unsigned char *p = buf; |
mbedAustin | 11:cada08fc8a70 | 447 | const unsigned char *end = buf + len; |
mbedAustin | 11:cada08fc8a70 | 448 | |
mbedAustin | 11:cada08fc8a70 | 449 | /* |
mbedAustin | 11:cada08fc8a70 | 450 | * struct { |
mbedAustin | 11:cada08fc8a70 | 451 | * ECJPAKEKeyKP ecjpake_key_kp_pair_list[2]; |
mbedAustin | 11:cada08fc8a70 | 452 | * } ECJPAKEKeyKPPairList; |
mbedAustin | 11:cada08fc8a70 | 453 | */ |
mbedAustin | 11:cada08fc8a70 | 454 | MBEDTLS_MPI_CHK( ecjpake_kkp_read( md_info, grp, pf, G, Xa, id, &p, end ) ); |
mbedAustin | 11:cada08fc8a70 | 455 | MBEDTLS_MPI_CHK( ecjpake_kkp_read( md_info, grp, pf, G, Xb, id, &p, end ) ); |
mbedAustin | 11:cada08fc8a70 | 456 | |
mbedAustin | 11:cada08fc8a70 | 457 | if( p != end ) |
mbedAustin | 11:cada08fc8a70 | 458 | ret = MBEDTLS_ERR_ECP_BAD_INPUT_DATA; |
mbedAustin | 11:cada08fc8a70 | 459 | |
mbedAustin | 11:cada08fc8a70 | 460 | cleanup: |
mbedAustin | 11:cada08fc8a70 | 461 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 462 | } |
mbedAustin | 11:cada08fc8a70 | 463 | |
mbedAustin | 11:cada08fc8a70 | 464 | /* |
mbedAustin | 11:cada08fc8a70 | 465 | * Generate a ECJPAKEKeyKPPairList |
mbedAustin | 11:cada08fc8a70 | 466 | * Outputs: the serialized structure, plus two private/public key pairs |
mbedAustin | 11:cada08fc8a70 | 467 | */ |
mbedAustin | 11:cada08fc8a70 | 468 | static int ecjpake_kkpp_write( const mbedtls_md_info_t *md_info, |
mbedAustin | 11:cada08fc8a70 | 469 | const mbedtls_ecp_group *grp, |
mbedAustin | 11:cada08fc8a70 | 470 | const int pf, |
mbedAustin | 11:cada08fc8a70 | 471 | const mbedtls_ecp_point *G, |
mbedAustin | 11:cada08fc8a70 | 472 | mbedtls_mpi *xm1, |
mbedAustin | 11:cada08fc8a70 | 473 | mbedtls_ecp_point *Xa, |
mbedAustin | 11:cada08fc8a70 | 474 | mbedtls_mpi *xm2, |
mbedAustin | 11:cada08fc8a70 | 475 | mbedtls_ecp_point *Xb, |
mbedAustin | 11:cada08fc8a70 | 476 | const char *id, |
mbedAustin | 11:cada08fc8a70 | 477 | unsigned char *buf, |
mbedAustin | 11:cada08fc8a70 | 478 | size_t len, |
mbedAustin | 11:cada08fc8a70 | 479 | size_t *olen, |
mbedAustin | 11:cada08fc8a70 | 480 | int (*f_rng)(void *, unsigned char *, size_t), |
mbedAustin | 11:cada08fc8a70 | 481 | void *p_rng ) |
mbedAustin | 11:cada08fc8a70 | 482 | { |
mbedAustin | 11:cada08fc8a70 | 483 | int ret; |
mbedAustin | 11:cada08fc8a70 | 484 | unsigned char *p = buf; |
mbedAustin | 11:cada08fc8a70 | 485 | const unsigned char *end = buf + len; |
mbedAustin | 11:cada08fc8a70 | 486 | |
mbedAustin | 11:cada08fc8a70 | 487 | MBEDTLS_MPI_CHK( ecjpake_kkp_write( md_info, grp, pf, G, xm1, Xa, id, |
mbedAustin | 11:cada08fc8a70 | 488 | &p, end, f_rng, p_rng ) ); |
mbedAustin | 11:cada08fc8a70 | 489 | MBEDTLS_MPI_CHK( ecjpake_kkp_write( md_info, grp, pf, G, xm2, Xb, id, |
mbedAustin | 11:cada08fc8a70 | 490 | &p, end, f_rng, p_rng ) ); |
mbedAustin | 11:cada08fc8a70 | 491 | |
mbedAustin | 11:cada08fc8a70 | 492 | *olen = p - buf; |
mbedAustin | 11:cada08fc8a70 | 493 | |
mbedAustin | 11:cada08fc8a70 | 494 | cleanup: |
mbedAustin | 11:cada08fc8a70 | 495 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 496 | } |
mbedAustin | 11:cada08fc8a70 | 497 | |
mbedAustin | 11:cada08fc8a70 | 498 | /* |
mbedAustin | 11:cada08fc8a70 | 499 | * Read and process the first round message |
mbedAustin | 11:cada08fc8a70 | 500 | */ |
mbedAustin | 11:cada08fc8a70 | 501 | int mbedtls_ecjpake_read_round_one( mbedtls_ecjpake_context *ctx, |
mbedAustin | 11:cada08fc8a70 | 502 | const unsigned char *buf, |
mbedAustin | 11:cada08fc8a70 | 503 | size_t len ) |
mbedAustin | 11:cada08fc8a70 | 504 | { |
mbedAustin | 11:cada08fc8a70 | 505 | return( ecjpake_kkpp_read( ctx->md_info, &ctx->grp, ctx->point_format, |
mbedAustin | 11:cada08fc8a70 | 506 | &ctx->grp.G, |
mbedAustin | 11:cada08fc8a70 | 507 | &ctx->Xp1, &ctx->Xp2, ID_PEER, |
mbedAustin | 11:cada08fc8a70 | 508 | buf, len ) ); |
mbedAustin | 11:cada08fc8a70 | 509 | } |
mbedAustin | 11:cada08fc8a70 | 510 | |
mbedAustin | 11:cada08fc8a70 | 511 | /* |
mbedAustin | 11:cada08fc8a70 | 512 | * Generate and write the first round message |
mbedAustin | 11:cada08fc8a70 | 513 | */ |
mbedAustin | 11:cada08fc8a70 | 514 | int mbedtls_ecjpake_write_round_one( mbedtls_ecjpake_context *ctx, |
mbedAustin | 11:cada08fc8a70 | 515 | unsigned char *buf, size_t len, size_t *olen, |
mbedAustin | 11:cada08fc8a70 | 516 | int (*f_rng)(void *, unsigned char *, size_t), |
mbedAustin | 11:cada08fc8a70 | 517 | void *p_rng ) |
mbedAustin | 11:cada08fc8a70 | 518 | { |
mbedAustin | 11:cada08fc8a70 | 519 | return( ecjpake_kkpp_write( ctx->md_info, &ctx->grp, ctx->point_format, |
mbedAustin | 11:cada08fc8a70 | 520 | &ctx->grp.G, |
mbedAustin | 11:cada08fc8a70 | 521 | &ctx->xm1, &ctx->Xm1, &ctx->xm2, &ctx->Xm2, |
mbedAustin | 11:cada08fc8a70 | 522 | ID_MINE, buf, len, olen, f_rng, p_rng ) ); |
mbedAustin | 11:cada08fc8a70 | 523 | } |
mbedAustin | 11:cada08fc8a70 | 524 | |
mbedAustin | 11:cada08fc8a70 | 525 | /* |
mbedAustin | 11:cada08fc8a70 | 526 | * Compute the sum of three points R = A + B + C |
mbedAustin | 11:cada08fc8a70 | 527 | */ |
mbedAustin | 11:cada08fc8a70 | 528 | static int ecjpake_ecp_add3( mbedtls_ecp_group *grp, mbedtls_ecp_point *R, |
mbedAustin | 11:cada08fc8a70 | 529 | const mbedtls_ecp_point *A, |
mbedAustin | 11:cada08fc8a70 | 530 | const mbedtls_ecp_point *B, |
mbedAustin | 11:cada08fc8a70 | 531 | const mbedtls_ecp_point *C ) |
mbedAustin | 11:cada08fc8a70 | 532 | { |
mbedAustin | 11:cada08fc8a70 | 533 | int ret; |
mbedAustin | 11:cada08fc8a70 | 534 | mbedtls_mpi one; |
mbedAustin | 11:cada08fc8a70 | 535 | |
mbedAustin | 11:cada08fc8a70 | 536 | mbedtls_mpi_init( &one ); |
mbedAustin | 11:cada08fc8a70 | 537 | |
mbedAustin | 11:cada08fc8a70 | 538 | MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &one, 1 ) ); |
mbedAustin | 11:cada08fc8a70 | 539 | MBEDTLS_MPI_CHK( mbedtls_ecp_muladd( grp, R, &one, A, &one, B ) ); |
mbedAustin | 11:cada08fc8a70 | 540 | MBEDTLS_MPI_CHK( mbedtls_ecp_muladd( grp, R, &one, R, &one, C ) ); |
mbedAustin | 11:cada08fc8a70 | 541 | |
mbedAustin | 11:cada08fc8a70 | 542 | cleanup: |
mbedAustin | 11:cada08fc8a70 | 543 | mbedtls_mpi_free( &one ); |
mbedAustin | 11:cada08fc8a70 | 544 | |
mbedAustin | 11:cada08fc8a70 | 545 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 546 | } |
mbedAustin | 11:cada08fc8a70 | 547 | |
mbedAustin | 11:cada08fc8a70 | 548 | /* |
mbedAustin | 11:cada08fc8a70 | 549 | * Read and process second round message (C: 7.4.2.5, S: 7.4.2.6) |
mbedAustin | 11:cada08fc8a70 | 550 | */ |
mbedAustin | 11:cada08fc8a70 | 551 | int mbedtls_ecjpake_read_round_two( mbedtls_ecjpake_context *ctx, |
mbedAustin | 11:cada08fc8a70 | 552 | const unsigned char *buf, |
mbedAustin | 11:cada08fc8a70 | 553 | size_t len ) |
mbedAustin | 11:cada08fc8a70 | 554 | { |
mbedAustin | 11:cada08fc8a70 | 555 | int ret; |
mbedAustin | 11:cada08fc8a70 | 556 | const unsigned char *p = buf; |
mbedAustin | 11:cada08fc8a70 | 557 | const unsigned char *end = buf + len; |
mbedAustin | 11:cada08fc8a70 | 558 | mbedtls_ecp_group grp; |
mbedAustin | 11:cada08fc8a70 | 559 | mbedtls_ecp_point G; /* C: GB, S: GA */ |
mbedAustin | 11:cada08fc8a70 | 560 | |
mbedAustin | 11:cada08fc8a70 | 561 | mbedtls_ecp_group_init( &grp ); |
mbedAustin | 11:cada08fc8a70 | 562 | mbedtls_ecp_point_init( &G ); |
mbedAustin | 11:cada08fc8a70 | 563 | |
mbedAustin | 11:cada08fc8a70 | 564 | /* |
mbedAustin | 11:cada08fc8a70 | 565 | * Server: GA = X3 + X4 + X1 (7.4.2.6.1) |
mbedAustin | 11:cada08fc8a70 | 566 | * Client: GB = X1 + X2 + X3 (7.4.2.5.1) |
mbedAustin | 11:cada08fc8a70 | 567 | * Unified: G = Xm1 + Xm2 + Xp1 |
mbedAustin | 11:cada08fc8a70 | 568 | * We need that before parsing in order to check Xp as we read it |
mbedAustin | 11:cada08fc8a70 | 569 | */ |
mbedAustin | 11:cada08fc8a70 | 570 | MBEDTLS_MPI_CHK( ecjpake_ecp_add3( &ctx->grp, &G, |
mbedAustin | 11:cada08fc8a70 | 571 | &ctx->Xm1, &ctx->Xm2, &ctx->Xp1 ) ); |
mbedAustin | 11:cada08fc8a70 | 572 | |
mbedAustin | 11:cada08fc8a70 | 573 | /* |
mbedAustin | 11:cada08fc8a70 | 574 | * struct { |
mbedAustin | 11:cada08fc8a70 | 575 | * ECParameters curve_params; // only client reading server msg |
mbedAustin | 11:cada08fc8a70 | 576 | * ECJPAKEKeyKP ecjpake_key_kp; |
mbedAustin | 11:cada08fc8a70 | 577 | * } Client/ServerECJPAKEParams; |
mbedAustin | 11:cada08fc8a70 | 578 | */ |
mbedAustin | 11:cada08fc8a70 | 579 | if( ctx->role == MBEDTLS_ECJPAKE_CLIENT ) |
mbedAustin | 11:cada08fc8a70 | 580 | { |
mbedAustin | 11:cada08fc8a70 | 581 | MBEDTLS_MPI_CHK( mbedtls_ecp_tls_read_group( &grp, &p, len ) ); |
mbedAustin | 11:cada08fc8a70 | 582 | if( grp.id != ctx->grp.id ) |
mbedAustin | 11:cada08fc8a70 | 583 | { |
mbedAustin | 11:cada08fc8a70 | 584 | ret = MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE; |
mbedAustin | 11:cada08fc8a70 | 585 | goto cleanup; |
mbedAustin | 11:cada08fc8a70 | 586 | } |
mbedAustin | 11:cada08fc8a70 | 587 | } |
mbedAustin | 11:cada08fc8a70 | 588 | |
mbedAustin | 11:cada08fc8a70 | 589 | MBEDTLS_MPI_CHK( ecjpake_kkp_read( ctx->md_info, &ctx->grp, |
mbedAustin | 11:cada08fc8a70 | 590 | ctx->point_format, |
mbedAustin | 11:cada08fc8a70 | 591 | &G, &ctx->Xp, ID_PEER, &p, end ) ); |
mbedAustin | 11:cada08fc8a70 | 592 | |
mbedAustin | 11:cada08fc8a70 | 593 | if( p != end ) |
mbedAustin | 11:cada08fc8a70 | 594 | { |
mbedAustin | 11:cada08fc8a70 | 595 | ret = MBEDTLS_ERR_ECP_BAD_INPUT_DATA; |
mbedAustin | 11:cada08fc8a70 | 596 | goto cleanup; |
mbedAustin | 11:cada08fc8a70 | 597 | } |
mbedAustin | 11:cada08fc8a70 | 598 | |
mbedAustin | 11:cada08fc8a70 | 599 | cleanup: |
mbedAustin | 11:cada08fc8a70 | 600 | mbedtls_ecp_group_free( &grp ); |
mbedAustin | 11:cada08fc8a70 | 601 | mbedtls_ecp_point_free( &G ); |
mbedAustin | 11:cada08fc8a70 | 602 | |
mbedAustin | 11:cada08fc8a70 | 603 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 604 | } |
mbedAustin | 11:cada08fc8a70 | 605 | |
mbedAustin | 11:cada08fc8a70 | 606 | /* |
mbedAustin | 11:cada08fc8a70 | 607 | * Compute R = +/- X * S mod N, taking care not to leak S |
mbedAustin | 11:cada08fc8a70 | 608 | */ |
mbedAustin | 11:cada08fc8a70 | 609 | static int ecjpake_mul_secret( mbedtls_mpi *R, int sign, |
mbedAustin | 11:cada08fc8a70 | 610 | const mbedtls_mpi *X, |
mbedAustin | 11:cada08fc8a70 | 611 | const mbedtls_mpi *S, |
mbedAustin | 11:cada08fc8a70 | 612 | const mbedtls_mpi *N, |
mbedAustin | 11:cada08fc8a70 | 613 | int (*f_rng)(void *, unsigned char *, size_t), |
mbedAustin | 11:cada08fc8a70 | 614 | void *p_rng ) |
mbedAustin | 11:cada08fc8a70 | 615 | { |
mbedAustin | 11:cada08fc8a70 | 616 | int ret; |
mbedAustin | 11:cada08fc8a70 | 617 | mbedtls_mpi b; /* Blinding value, then s + N * blinding */ |
mbedAustin | 11:cada08fc8a70 | 618 | |
mbedAustin | 11:cada08fc8a70 | 619 | mbedtls_mpi_init( &b ); |
mbedAustin | 11:cada08fc8a70 | 620 | |
mbedAustin | 11:cada08fc8a70 | 621 | /* b = s + rnd-128-bit * N */ |
mbedAustin | 11:cada08fc8a70 | 622 | MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &b, 16, f_rng, p_rng ) ); |
mbedAustin | 11:cada08fc8a70 | 623 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &b, &b, N ) ); |
mbedAustin | 11:cada08fc8a70 | 624 | MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &b, &b, S ) ); |
mbedAustin | 11:cada08fc8a70 | 625 | |
mbedAustin | 11:cada08fc8a70 | 626 | /* R = sign * X * b mod N */ |
mbedAustin | 11:cada08fc8a70 | 627 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( R, X, &b ) ); |
mbedAustin | 11:cada08fc8a70 | 628 | R->s *= sign; |
mbedAustin | 11:cada08fc8a70 | 629 | MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( R, R, N ) ); |
mbedAustin | 11:cada08fc8a70 | 630 | |
mbedAustin | 11:cada08fc8a70 | 631 | cleanup: |
mbedAustin | 11:cada08fc8a70 | 632 | mbedtls_mpi_free( &b ); |
mbedAustin | 11:cada08fc8a70 | 633 | |
mbedAustin | 11:cada08fc8a70 | 634 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 635 | } |
mbedAustin | 11:cada08fc8a70 | 636 | |
mbedAustin | 11:cada08fc8a70 | 637 | /* |
mbedAustin | 11:cada08fc8a70 | 638 | * Generate and write the second round message (S: 7.4.2.5, C: 7.4.2.6) |
mbedAustin | 11:cada08fc8a70 | 639 | */ |
mbedAustin | 11:cada08fc8a70 | 640 | int mbedtls_ecjpake_write_round_two( mbedtls_ecjpake_context *ctx, |
mbedAustin | 11:cada08fc8a70 | 641 | unsigned char *buf, size_t len, size_t *olen, |
mbedAustin | 11:cada08fc8a70 | 642 | int (*f_rng)(void *, unsigned char *, size_t), |
mbedAustin | 11:cada08fc8a70 | 643 | void *p_rng ) |
mbedAustin | 11:cada08fc8a70 | 644 | { |
mbedAustin | 11:cada08fc8a70 | 645 | int ret; |
mbedAustin | 11:cada08fc8a70 | 646 | mbedtls_ecp_point G; /* C: GA, S: GB */ |
mbedAustin | 11:cada08fc8a70 | 647 | mbedtls_ecp_point Xm; /* C: Xc, S: Xs */ |
mbedAustin | 11:cada08fc8a70 | 648 | mbedtls_mpi xm; /* C: xc, S: xs */ |
mbedAustin | 11:cada08fc8a70 | 649 | unsigned char *p = buf; |
mbedAustin | 11:cada08fc8a70 | 650 | const unsigned char *end = buf + len; |
mbedAustin | 11:cada08fc8a70 | 651 | size_t ec_len; |
mbedAustin | 11:cada08fc8a70 | 652 | |
mbedAustin | 11:cada08fc8a70 | 653 | mbedtls_ecp_point_init( &G ); |
mbedAustin | 11:cada08fc8a70 | 654 | mbedtls_ecp_point_init( &Xm ); |
mbedAustin | 11:cada08fc8a70 | 655 | mbedtls_mpi_init( &xm ); |
mbedAustin | 11:cada08fc8a70 | 656 | |
mbedAustin | 11:cada08fc8a70 | 657 | /* |
mbedAustin | 11:cada08fc8a70 | 658 | * First generate private/public key pair (S: 7.4.2.5.1, C: 7.4.2.6.1) |
mbedAustin | 11:cada08fc8a70 | 659 | * |
mbedAustin | 11:cada08fc8a70 | 660 | * Client: GA = X1 + X3 + X4 | xs = x2 * s | Xc = xc * GA |
mbedAustin | 11:cada08fc8a70 | 661 | * Server: GB = X3 + X1 + X2 | xs = x4 * s | Xs = xs * GB |
mbedAustin | 11:cada08fc8a70 | 662 | * Unified: G = Xm1 + Xp1 + Xp2 | xm = xm2 * s | Xm = xm * G |
mbedAustin | 11:cada08fc8a70 | 663 | */ |
mbedAustin | 11:cada08fc8a70 | 664 | MBEDTLS_MPI_CHK( ecjpake_ecp_add3( &ctx->grp, &G, |
mbedAustin | 11:cada08fc8a70 | 665 | &ctx->Xp1, &ctx->Xp2, &ctx->Xm1 ) ); |
mbedAustin | 11:cada08fc8a70 | 666 | MBEDTLS_MPI_CHK( ecjpake_mul_secret( &xm, 1, &ctx->xm2, &ctx->s, |
mbedAustin | 11:cada08fc8a70 | 667 | &ctx->grp.N, f_rng, p_rng ) ); |
mbedAustin | 11:cada08fc8a70 | 668 | MBEDTLS_MPI_CHK( mbedtls_ecp_mul( &ctx->grp, &Xm, &xm, &G, f_rng, p_rng ) ); |
mbedAustin | 11:cada08fc8a70 | 669 | |
mbedAustin | 11:cada08fc8a70 | 670 | /* |
mbedAustin | 11:cada08fc8a70 | 671 | * Now write things out |
mbedAustin | 11:cada08fc8a70 | 672 | * |
mbedAustin | 11:cada08fc8a70 | 673 | * struct { |
mbedAustin | 11:cada08fc8a70 | 674 | * ECParameters curve_params; // only server writing its message |
mbedAustin | 11:cada08fc8a70 | 675 | * ECJPAKEKeyKP ecjpake_key_kp; |
mbedAustin | 11:cada08fc8a70 | 676 | * } Client/ServerECJPAKEParams; |
mbedAustin | 11:cada08fc8a70 | 677 | */ |
mbedAustin | 11:cada08fc8a70 | 678 | if( ctx->role == MBEDTLS_ECJPAKE_SERVER ) |
mbedAustin | 11:cada08fc8a70 | 679 | { |
mbedAustin | 11:cada08fc8a70 | 680 | if( end < p ) |
mbedAustin | 11:cada08fc8a70 | 681 | { |
mbedAustin | 11:cada08fc8a70 | 682 | ret = MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL; |
mbedAustin | 11:cada08fc8a70 | 683 | goto cleanup; |
mbedAustin | 11:cada08fc8a70 | 684 | } |
mbedAustin | 11:cada08fc8a70 | 685 | MBEDTLS_MPI_CHK( mbedtls_ecp_tls_write_group( &ctx->grp, &ec_len, |
mbedAustin | 11:cada08fc8a70 | 686 | p, end - p ) ); |
mbedAustin | 11:cada08fc8a70 | 687 | p += ec_len; |
mbedAustin | 11:cada08fc8a70 | 688 | } |
mbedAustin | 11:cada08fc8a70 | 689 | |
mbedAustin | 11:cada08fc8a70 | 690 | if( end < p ) |
mbedAustin | 11:cada08fc8a70 | 691 | { |
mbedAustin | 11:cada08fc8a70 | 692 | ret = MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL; |
mbedAustin | 11:cada08fc8a70 | 693 | goto cleanup; |
mbedAustin | 11:cada08fc8a70 | 694 | } |
mbedAustin | 11:cada08fc8a70 | 695 | MBEDTLS_MPI_CHK( mbedtls_ecp_tls_write_point( &ctx->grp, &Xm, |
mbedAustin | 11:cada08fc8a70 | 696 | ctx->point_format, &ec_len, p, end - p ) ); |
mbedAustin | 11:cada08fc8a70 | 697 | p += ec_len; |
mbedAustin | 11:cada08fc8a70 | 698 | |
mbedAustin | 11:cada08fc8a70 | 699 | MBEDTLS_MPI_CHK( ecjpake_zkp_write( ctx->md_info, &ctx->grp, |
mbedAustin | 11:cada08fc8a70 | 700 | ctx->point_format, |
mbedAustin | 11:cada08fc8a70 | 701 | &G, &xm, &Xm, ID_MINE, |
mbedAustin | 11:cada08fc8a70 | 702 | &p, end, f_rng, p_rng ) ); |
mbedAustin | 11:cada08fc8a70 | 703 | |
mbedAustin | 11:cada08fc8a70 | 704 | *olen = p - buf; |
mbedAustin | 11:cada08fc8a70 | 705 | |
mbedAustin | 11:cada08fc8a70 | 706 | cleanup: |
mbedAustin | 11:cada08fc8a70 | 707 | mbedtls_ecp_point_free( &G ); |
mbedAustin | 11:cada08fc8a70 | 708 | mbedtls_ecp_point_free( &Xm ); |
mbedAustin | 11:cada08fc8a70 | 709 | mbedtls_mpi_free( &xm ); |
mbedAustin | 11:cada08fc8a70 | 710 | |
mbedAustin | 11:cada08fc8a70 | 711 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 712 | } |
mbedAustin | 11:cada08fc8a70 | 713 | |
mbedAustin | 11:cada08fc8a70 | 714 | /* |
mbedAustin | 11:cada08fc8a70 | 715 | * Derive PMS (7.4.2.7 / 7.4.2.8) |
mbedAustin | 11:cada08fc8a70 | 716 | */ |
mbedAustin | 11:cada08fc8a70 | 717 | int mbedtls_ecjpake_derive_secret( mbedtls_ecjpake_context *ctx, |
mbedAustin | 11:cada08fc8a70 | 718 | unsigned char *buf, size_t len, size_t *olen, |
mbedAustin | 11:cada08fc8a70 | 719 | int (*f_rng)(void *, unsigned char *, size_t), |
mbedAustin | 11:cada08fc8a70 | 720 | void *p_rng ) |
mbedAustin | 11:cada08fc8a70 | 721 | { |
mbedAustin | 11:cada08fc8a70 | 722 | int ret; |
mbedAustin | 11:cada08fc8a70 | 723 | mbedtls_ecp_point K; |
mbedAustin | 11:cada08fc8a70 | 724 | mbedtls_mpi m_xm2_s, one; |
mbedAustin | 11:cada08fc8a70 | 725 | unsigned char kx[MBEDTLS_ECP_MAX_BYTES]; |
mbedAustin | 11:cada08fc8a70 | 726 | size_t x_bytes; |
mbedAustin | 11:cada08fc8a70 | 727 | |
mbedAustin | 11:cada08fc8a70 | 728 | *olen = mbedtls_md_get_size( ctx->md_info ); |
mbedAustin | 11:cada08fc8a70 | 729 | if( len < *olen ) |
mbedAustin | 11:cada08fc8a70 | 730 | return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL ); |
mbedAustin | 11:cada08fc8a70 | 731 | |
mbedAustin | 11:cada08fc8a70 | 732 | mbedtls_ecp_point_init( &K ); |
mbedAustin | 11:cada08fc8a70 | 733 | mbedtls_mpi_init( &m_xm2_s ); |
mbedAustin | 11:cada08fc8a70 | 734 | mbedtls_mpi_init( &one ); |
mbedAustin | 11:cada08fc8a70 | 735 | |
mbedAustin | 11:cada08fc8a70 | 736 | MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &one, 1 ) ); |
mbedAustin | 11:cada08fc8a70 | 737 | |
mbedAustin | 11:cada08fc8a70 | 738 | /* |
mbedAustin | 11:cada08fc8a70 | 739 | * Client: K = ( Xs - X4 * x2 * s ) * x2 |
mbedAustin | 11:cada08fc8a70 | 740 | * Server: K = ( Xc - X2 * x4 * s ) * x4 |
mbedAustin | 11:cada08fc8a70 | 741 | * Unified: K = ( Xp - Xp2 * xm2 * s ) * xm2 |
mbedAustin | 11:cada08fc8a70 | 742 | */ |
mbedAustin | 11:cada08fc8a70 | 743 | MBEDTLS_MPI_CHK( ecjpake_mul_secret( &m_xm2_s, -1, &ctx->xm2, &ctx->s, |
mbedAustin | 11:cada08fc8a70 | 744 | &ctx->grp.N, f_rng, p_rng ) ); |
mbedAustin | 11:cada08fc8a70 | 745 | MBEDTLS_MPI_CHK( mbedtls_ecp_muladd( &ctx->grp, &K, |
mbedAustin | 11:cada08fc8a70 | 746 | &one, &ctx->Xp, |
mbedAustin | 11:cada08fc8a70 | 747 | &m_xm2_s, &ctx->Xp2 ) ); |
mbedAustin | 11:cada08fc8a70 | 748 | MBEDTLS_MPI_CHK( mbedtls_ecp_mul( &ctx->grp, &K, &ctx->xm2, &K, |
mbedAustin | 11:cada08fc8a70 | 749 | f_rng, p_rng ) ); |
mbedAustin | 11:cada08fc8a70 | 750 | |
mbedAustin | 11:cada08fc8a70 | 751 | /* PMS = SHA-256( K.X ) */ |
mbedAustin | 11:cada08fc8a70 | 752 | x_bytes = ( ctx->grp.pbits + 7 ) / 8; |
mbedAustin | 11:cada08fc8a70 | 753 | MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &K.X, kx, x_bytes ) ); |
mbedAustin | 11:cada08fc8a70 | 754 | MBEDTLS_MPI_CHK( mbedtls_md( ctx->md_info, kx, x_bytes, buf ) ); |
mbedAustin | 11:cada08fc8a70 | 755 | |
mbedAustin | 11:cada08fc8a70 | 756 | cleanup: |
mbedAustin | 11:cada08fc8a70 | 757 | mbedtls_ecp_point_free( &K ); |
mbedAustin | 11:cada08fc8a70 | 758 | mbedtls_mpi_free( &m_xm2_s ); |
mbedAustin | 11:cada08fc8a70 | 759 | mbedtls_mpi_free( &one ); |
mbedAustin | 11:cada08fc8a70 | 760 | |
mbedAustin | 11:cada08fc8a70 | 761 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 762 | } |
mbedAustin | 11:cada08fc8a70 | 763 | |
mbedAustin | 11:cada08fc8a70 | 764 | #undef ID_MINE |
mbedAustin | 11:cada08fc8a70 | 765 | #undef ID_PEER |
mbedAustin | 11:cada08fc8a70 | 766 | |
mbedAustin | 11:cada08fc8a70 | 767 | |
mbedAustin | 11:cada08fc8a70 | 768 | #if defined(MBEDTLS_SELF_TEST) |
mbedAustin | 11:cada08fc8a70 | 769 | |
mbedAustin | 11:cada08fc8a70 | 770 | #if defined(MBEDTLS_PLATFORM_C) |
mbedAustin | 11:cada08fc8a70 | 771 | #include "mbedtls/platform.h" |
mbedAustin | 11:cada08fc8a70 | 772 | #else |
mbedAustin | 11:cada08fc8a70 | 773 | #include <stdio.h> |
mbedAustin | 11:cada08fc8a70 | 774 | #define mbedtls_printf printf |
mbedAustin | 11:cada08fc8a70 | 775 | #endif |
mbedAustin | 11:cada08fc8a70 | 776 | |
mbedAustin | 11:cada08fc8a70 | 777 | #if !defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) || \ |
mbedAustin | 11:cada08fc8a70 | 778 | !defined(MBEDTLS_SHA256_C) |
mbedAustin | 11:cada08fc8a70 | 779 | int mbedtls_ecjpake_self_test( int verbose ) |
mbedAustin | 11:cada08fc8a70 | 780 | { |
mbedAustin | 11:cada08fc8a70 | 781 | (void) verbose; |
mbedAustin | 11:cada08fc8a70 | 782 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 783 | } |
mbedAustin | 11:cada08fc8a70 | 784 | #else |
mbedAustin | 11:cada08fc8a70 | 785 | |
mbedAustin | 11:cada08fc8a70 | 786 | static const unsigned char ecjpake_test_password[] = { |
mbedAustin | 11:cada08fc8a70 | 787 | 0x74, 0x68, 0x72, 0x65, 0x61, 0x64, 0x6a, 0x70, 0x61, 0x6b, 0x65, 0x74, |
mbedAustin | 11:cada08fc8a70 | 788 | 0x65, 0x73, 0x74 |
mbedAustin | 11:cada08fc8a70 | 789 | }; |
mbedAustin | 11:cada08fc8a70 | 790 | |
mbedAustin | 11:cada08fc8a70 | 791 | static const unsigned char ecjpake_test_x1[] = { |
mbedAustin | 11:cada08fc8a70 | 792 | 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, |
mbedAustin | 11:cada08fc8a70 | 793 | 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, |
mbedAustin | 11:cada08fc8a70 | 794 | 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x21 |
mbedAustin | 11:cada08fc8a70 | 795 | }; |
mbedAustin | 11:cada08fc8a70 | 796 | |
mbedAustin | 11:cada08fc8a70 | 797 | static const unsigned char ecjpake_test_x2[] = { |
mbedAustin | 11:cada08fc8a70 | 798 | 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, |
mbedAustin | 11:cada08fc8a70 | 799 | 0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, |
mbedAustin | 11:cada08fc8a70 | 800 | 0x79, 0x7a, 0x7b, 0x7c, 0x7d, 0x7e, 0x7f, 0x81 |
mbedAustin | 11:cada08fc8a70 | 801 | }; |
mbedAustin | 11:cada08fc8a70 | 802 | |
mbedAustin | 11:cada08fc8a70 | 803 | static const unsigned char ecjpake_test_x3[] = { |
mbedAustin | 11:cada08fc8a70 | 804 | 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, |
mbedAustin | 11:cada08fc8a70 | 805 | 0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, |
mbedAustin | 11:cada08fc8a70 | 806 | 0x79, 0x7a, 0x7b, 0x7c, 0x7d, 0x7e, 0x7f, 0x81 |
mbedAustin | 11:cada08fc8a70 | 807 | }; |
mbedAustin | 11:cada08fc8a70 | 808 | |
mbedAustin | 11:cada08fc8a70 | 809 | static const unsigned char ecjpake_test_x4[] = { |
mbedAustin | 11:cada08fc8a70 | 810 | 0xc1, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7, 0xc8, 0xc9, 0xca, 0xcb, 0xcc, |
mbedAustin | 11:cada08fc8a70 | 811 | 0xcd, 0xce, 0xcf, 0xd0, 0xd1, 0xd2, 0xd3, 0xd4, 0xd5, 0xd6, 0xd7, 0xd8, |
mbedAustin | 11:cada08fc8a70 | 812 | 0xd9, 0xda, 0xdb, 0xdc, 0xdd, 0xde, 0xdf, 0xe1 |
mbedAustin | 11:cada08fc8a70 | 813 | }; |
mbedAustin | 11:cada08fc8a70 | 814 | |
mbedAustin | 11:cada08fc8a70 | 815 | static const unsigned char ecjpake_test_cli_one[] = { |
mbedAustin | 11:cada08fc8a70 | 816 | 0x41, 0x04, 0xac, 0xcf, 0x01, 0x06, 0xef, 0x85, 0x8f, 0xa2, 0xd9, 0x19, |
mbedAustin | 11:cada08fc8a70 | 817 | 0x33, 0x13, 0x46, 0x80, 0x5a, 0x78, 0xb5, 0x8b, 0xba, 0xd0, 0xb8, 0x44, |
mbedAustin | 11:cada08fc8a70 | 818 | 0xe5, 0xc7, 0x89, 0x28, 0x79, 0x14, 0x61, 0x87, 0xdd, 0x26, 0x66, 0xad, |
mbedAustin | 11:cada08fc8a70 | 819 | 0xa7, 0x81, 0xbb, 0x7f, 0x11, 0x13, 0x72, 0x25, 0x1a, 0x89, 0x10, 0x62, |
mbedAustin | 11:cada08fc8a70 | 820 | 0x1f, 0x63, 0x4d, 0xf1, 0x28, 0xac, 0x48, 0xe3, 0x81, 0xfd, 0x6e, 0xf9, |
mbedAustin | 11:cada08fc8a70 | 821 | 0x06, 0x07, 0x31, 0xf6, 0x94, 0xa4, 0x41, 0x04, 0x1d, 0xd0, 0xbd, 0x5d, |
mbedAustin | 11:cada08fc8a70 | 822 | 0x45, 0x66, 0xc9, 0xbe, 0xd9, 0xce, 0x7d, 0xe7, 0x01, 0xb5, 0xe8, 0x2e, |
mbedAustin | 11:cada08fc8a70 | 823 | 0x08, 0xe8, 0x4b, 0x73, 0x04, 0x66, 0x01, 0x8a, 0xb9, 0x03, 0xc7, 0x9e, |
mbedAustin | 11:cada08fc8a70 | 824 | 0xb9, 0x82, 0x17, 0x22, 0x36, 0xc0, 0xc1, 0x72, 0x8a, 0xe4, 0xbf, 0x73, |
mbedAustin | 11:cada08fc8a70 | 825 | 0x61, 0x0d, 0x34, 0xde, 0x44, 0x24, 0x6e, 0xf3, 0xd9, 0xc0, 0x5a, 0x22, |
mbedAustin | 11:cada08fc8a70 | 826 | 0x36, 0xfb, 0x66, 0xa6, 0x58, 0x3d, 0x74, 0x49, 0x30, 0x8b, 0xab, 0xce, |
mbedAustin | 11:cada08fc8a70 | 827 | 0x20, 0x72, 0xfe, 0x16, 0x66, 0x29, 0x92, 0xe9, 0x23, 0x5c, 0x25, 0x00, |
mbedAustin | 11:cada08fc8a70 | 828 | 0x2f, 0x11, 0xb1, 0x50, 0x87, 0xb8, 0x27, 0x38, 0xe0, 0x3c, 0x94, 0x5b, |
mbedAustin | 11:cada08fc8a70 | 829 | 0xf7, 0xa2, 0x99, 0x5d, 0xda, 0x1e, 0x98, 0x34, 0x58, 0x41, 0x04, 0x7e, |
mbedAustin | 11:cada08fc8a70 | 830 | 0xa6, 0xe3, 0xa4, 0x48, 0x70, 0x37, 0xa9, 0xe0, 0xdb, 0xd7, 0x92, 0x62, |
mbedAustin | 11:cada08fc8a70 | 831 | 0xb2, 0xcc, 0x27, 0x3e, 0x77, 0x99, 0x30, 0xfc, 0x18, 0x40, 0x9a, 0xc5, |
mbedAustin | 11:cada08fc8a70 | 832 | 0x36, 0x1c, 0x5f, 0xe6, 0x69, 0xd7, 0x02, 0xe1, 0x47, 0x79, 0x0a, 0xeb, |
mbedAustin | 11:cada08fc8a70 | 833 | 0x4c, 0xe7, 0xfd, 0x65, 0x75, 0xab, 0x0f, 0x6c, 0x7f, 0xd1, 0xc3, 0x35, |
mbedAustin | 11:cada08fc8a70 | 834 | 0x93, 0x9a, 0xa8, 0x63, 0xba, 0x37, 0xec, 0x91, 0xb7, 0xe3, 0x2b, 0xb0, |
mbedAustin | 11:cada08fc8a70 | 835 | 0x13, 0xbb, 0x2b, 0x41, 0x04, 0xa4, 0x95, 0x58, 0xd3, 0x2e, 0xd1, 0xeb, |
mbedAustin | 11:cada08fc8a70 | 836 | 0xfc, 0x18, 0x16, 0xaf, 0x4f, 0xf0, 0x9b, 0x55, 0xfc, 0xb4, 0xca, 0x47, |
mbedAustin | 11:cada08fc8a70 | 837 | 0xb2, 0xa0, 0x2d, 0x1e, 0x7c, 0xaf, 0x11, 0x79, 0xea, 0x3f, 0xe1, 0x39, |
mbedAustin | 11:cada08fc8a70 | 838 | 0x5b, 0x22, 0xb8, 0x61, 0x96, 0x40, 0x16, 0xfa, 0xba, 0xf7, 0x2c, 0x97, |
mbedAustin | 11:cada08fc8a70 | 839 | 0x56, 0x95, 0xd9, 0x3d, 0x4d, 0xf0, 0xe5, 0x19, 0x7f, 0xe9, 0xf0, 0x40, |
mbedAustin | 11:cada08fc8a70 | 840 | 0x63, 0x4e, 0xd5, 0x97, 0x64, 0x93, 0x77, 0x87, 0xbe, 0x20, 0xbc, 0x4d, |
mbedAustin | 11:cada08fc8a70 | 841 | 0xee, 0xbb, 0xf9, 0xb8, 0xd6, 0x0a, 0x33, 0x5f, 0x04, 0x6c, 0xa3, 0xaa, |
mbedAustin | 11:cada08fc8a70 | 842 | 0x94, 0x1e, 0x45, 0x86, 0x4c, 0x7c, 0xad, 0xef, 0x9c, 0xf7, 0x5b, 0x3d, |
mbedAustin | 11:cada08fc8a70 | 843 | 0x8b, 0x01, 0x0e, 0x44, 0x3e, 0xf0 |
mbedAustin | 11:cada08fc8a70 | 844 | }; |
mbedAustin | 11:cada08fc8a70 | 845 | |
mbedAustin | 11:cada08fc8a70 | 846 | static const unsigned char ecjpake_test_srv_one[] = { |
mbedAustin | 11:cada08fc8a70 | 847 | 0x41, 0x04, 0x7e, 0xa6, 0xe3, 0xa4, 0x48, 0x70, 0x37, 0xa9, 0xe0, 0xdb, |
mbedAustin | 11:cada08fc8a70 | 848 | 0xd7, 0x92, 0x62, 0xb2, 0xcc, 0x27, 0x3e, 0x77, 0x99, 0x30, 0xfc, 0x18, |
mbedAustin | 11:cada08fc8a70 | 849 | 0x40, 0x9a, 0xc5, 0x36, 0x1c, 0x5f, 0xe6, 0x69, 0xd7, 0x02, 0xe1, 0x47, |
mbedAustin | 11:cada08fc8a70 | 850 | 0x79, 0x0a, 0xeb, 0x4c, 0xe7, 0xfd, 0x65, 0x75, 0xab, 0x0f, 0x6c, 0x7f, |
mbedAustin | 11:cada08fc8a70 | 851 | 0xd1, 0xc3, 0x35, 0x93, 0x9a, 0xa8, 0x63, 0xba, 0x37, 0xec, 0x91, 0xb7, |
mbedAustin | 11:cada08fc8a70 | 852 | 0xe3, 0x2b, 0xb0, 0x13, 0xbb, 0x2b, 0x41, 0x04, 0x09, 0xf8, 0x5b, 0x3d, |
mbedAustin | 11:cada08fc8a70 | 853 | 0x20, 0xeb, 0xd7, 0x88, 0x5c, 0xe4, 0x64, 0xc0, 0x8d, 0x05, 0x6d, 0x64, |
mbedAustin | 11:cada08fc8a70 | 854 | 0x28, 0xfe, 0x4d, 0xd9, 0x28, 0x7a, 0xa3, 0x65, 0xf1, 0x31, 0xf4, 0x36, |
mbedAustin | 11:cada08fc8a70 | 855 | 0x0f, 0xf3, 0x86, 0xd8, 0x46, 0x89, 0x8b, 0xc4, 0xb4, 0x15, 0x83, 0xc2, |
mbedAustin | 11:cada08fc8a70 | 856 | 0xa5, 0x19, 0x7f, 0x65, 0xd7, 0x87, 0x42, 0x74, 0x6c, 0x12, 0xa5, 0xec, |
mbedAustin | 11:cada08fc8a70 | 857 | 0x0a, 0x4f, 0xfe, 0x2f, 0x27, 0x0a, 0x75, 0x0a, 0x1d, 0x8f, 0xb5, 0x16, |
mbedAustin | 11:cada08fc8a70 | 858 | 0x20, 0x93, 0x4d, 0x74, 0xeb, 0x43, 0xe5, 0x4d, 0xf4, 0x24, 0xfd, 0x96, |
mbedAustin | 11:cada08fc8a70 | 859 | 0x30, 0x6c, 0x01, 0x17, 0xbf, 0x13, 0x1a, 0xfa, 0xbf, 0x90, 0xa9, 0xd3, |
mbedAustin | 11:cada08fc8a70 | 860 | 0x3d, 0x11, 0x98, 0xd9, 0x05, 0x19, 0x37, 0x35, 0x14, 0x41, 0x04, 0x19, |
mbedAustin | 11:cada08fc8a70 | 861 | 0x0a, 0x07, 0x70, 0x0f, 0xfa, 0x4b, 0xe6, 0xae, 0x1d, 0x79, 0xee, 0x0f, |
mbedAustin | 11:cada08fc8a70 | 862 | 0x06, 0xae, 0xb5, 0x44, 0xcd, 0x5a, 0xdd, 0xaa, 0xbe, 0xdf, 0x70, 0xf8, |
mbedAustin | 11:cada08fc8a70 | 863 | 0x62, 0x33, 0x21, 0x33, 0x2c, 0x54, 0xf3, 0x55, 0xf0, 0xfb, 0xfe, 0xc7, |
mbedAustin | 11:cada08fc8a70 | 864 | 0x83, 0xed, 0x35, 0x9e, 0x5d, 0x0b, 0xf7, 0x37, 0x7a, 0x0f, 0xc4, 0xea, |
mbedAustin | 11:cada08fc8a70 | 865 | 0x7a, 0xce, 0x47, 0x3c, 0x9c, 0x11, 0x2b, 0x41, 0xcc, 0xd4, 0x1a, 0xc5, |
mbedAustin | 11:cada08fc8a70 | 866 | 0x6a, 0x56, 0x12, 0x41, 0x04, 0x36, 0x0a, 0x1c, 0xea, 0x33, 0xfc, 0xe6, |
mbedAustin | 11:cada08fc8a70 | 867 | 0x41, 0x15, 0x64, 0x58, 0xe0, 0xa4, 0xea, 0xc2, 0x19, 0xe9, 0x68, 0x31, |
mbedAustin | 11:cada08fc8a70 | 868 | 0xe6, 0xae, 0xbc, 0x88, 0xb3, 0xf3, 0x75, 0x2f, 0x93, 0xa0, 0x28, 0x1d, |
mbedAustin | 11:cada08fc8a70 | 869 | 0x1b, 0xf1, 0xfb, 0x10, 0x60, 0x51, 0xdb, 0x96, 0x94, 0xa8, 0xd6, 0xe8, |
mbedAustin | 11:cada08fc8a70 | 870 | 0x62, 0xa5, 0xef, 0x13, 0x24, 0xa3, 0xd9, 0xe2, 0x78, 0x94, 0xf1, 0xee, |
mbedAustin | 11:cada08fc8a70 | 871 | 0x4f, 0x7c, 0x59, 0x19, 0x99, 0x65, 0xa8, 0xdd, 0x4a, 0x20, 0x91, 0x84, |
mbedAustin | 11:cada08fc8a70 | 872 | 0x7d, 0x2d, 0x22, 0xdf, 0x3e, 0xe5, 0x5f, 0xaa, 0x2a, 0x3f, 0xb3, 0x3f, |
mbedAustin | 11:cada08fc8a70 | 873 | 0xd2, 0xd1, 0xe0, 0x55, 0xa0, 0x7a, 0x7c, 0x61, 0xec, 0xfb, 0x8d, 0x80, |
mbedAustin | 11:cada08fc8a70 | 874 | 0xec, 0x00, 0xc2, 0xc9, 0xeb, 0x12 |
mbedAustin | 11:cada08fc8a70 | 875 | }; |
mbedAustin | 11:cada08fc8a70 | 876 | |
mbedAustin | 11:cada08fc8a70 | 877 | static const unsigned char ecjpake_test_srv_two[] = { |
mbedAustin | 11:cada08fc8a70 | 878 | 0x03, 0x00, 0x17, 0x41, 0x04, 0x0f, 0xb2, 0x2b, 0x1d, 0x5d, 0x11, 0x23, |
mbedAustin | 11:cada08fc8a70 | 879 | 0xe0, 0xef, 0x9f, 0xeb, 0x9d, 0x8a, 0x2e, 0x59, 0x0a, 0x1f, 0x4d, 0x7c, |
mbedAustin | 11:cada08fc8a70 | 880 | 0xed, 0x2c, 0x2b, 0x06, 0x58, 0x6e, 0x8f, 0x2a, 0x16, 0xd4, 0xeb, 0x2f, |
mbedAustin | 11:cada08fc8a70 | 881 | 0xda, 0x43, 0x28, 0xa2, 0x0b, 0x07, 0xd8, 0xfd, 0x66, 0x76, 0x54, 0xca, |
mbedAustin | 11:cada08fc8a70 | 882 | 0x18, 0xc5, 0x4e, 0x32, 0xa3, 0x33, 0xa0, 0x84, 0x54, 0x51, 0xe9, 0x26, |
mbedAustin | 11:cada08fc8a70 | 883 | 0xee, 0x88, 0x04, 0xfd, 0x7a, 0xf0, 0xaa, 0xa7, 0xa6, 0x41, 0x04, 0x55, |
mbedAustin | 11:cada08fc8a70 | 884 | 0x16, 0xea, 0x3e, 0x54, 0xa0, 0xd5, 0xd8, 0xb2, 0xce, 0x78, 0x6b, 0x38, |
mbedAustin | 11:cada08fc8a70 | 885 | 0xd3, 0x83, 0x37, 0x00, 0x29, 0xa5, 0xdb, 0xe4, 0x45, 0x9c, 0x9d, 0xd6, |
mbedAustin | 11:cada08fc8a70 | 886 | 0x01, 0xb4, 0x08, 0xa2, 0x4a, 0xe6, 0x46, 0x5c, 0x8a, 0xc9, 0x05, 0xb9, |
mbedAustin | 11:cada08fc8a70 | 887 | 0xeb, 0x03, 0xb5, 0xd3, 0x69, 0x1c, 0x13, 0x9e, 0xf8, 0x3f, 0x1c, 0xd4, |
mbedAustin | 11:cada08fc8a70 | 888 | 0x20, 0x0f, 0x6c, 0x9c, 0xd4, 0xec, 0x39, 0x22, 0x18, 0xa5, 0x9e, 0xd2, |
mbedAustin | 11:cada08fc8a70 | 889 | 0x43, 0xd3, 0xc8, 0x20, 0xff, 0x72, 0x4a, 0x9a, 0x70, 0xb8, 0x8c, 0xb8, |
mbedAustin | 11:cada08fc8a70 | 890 | 0x6f, 0x20, 0xb4, 0x34, 0xc6, 0x86, 0x5a, 0xa1, 0xcd, 0x79, 0x06, 0xdd, |
mbedAustin | 11:cada08fc8a70 | 891 | 0x7c, 0x9b, 0xce, 0x35, 0x25, 0xf5, 0x08, 0x27, 0x6f, 0x26, 0x83, 0x6c |
mbedAustin | 11:cada08fc8a70 | 892 | }; |
mbedAustin | 11:cada08fc8a70 | 893 | |
mbedAustin | 11:cada08fc8a70 | 894 | static const unsigned char ecjpake_test_cli_two[] = { |
mbedAustin | 11:cada08fc8a70 | 895 | 0x41, 0x04, 0x69, 0xd5, 0x4e, 0xe8, 0x5e, 0x90, 0xce, 0x3f, 0x12, 0x46, |
mbedAustin | 11:cada08fc8a70 | 896 | 0x74, 0x2d, 0xe5, 0x07, 0xe9, 0x39, 0xe8, 0x1d, 0x1d, 0xc1, 0xc5, 0xcb, |
mbedAustin | 11:cada08fc8a70 | 897 | 0x98, 0x8b, 0x58, 0xc3, 0x10, 0xc9, 0xfd, 0xd9, 0x52, 0x4d, 0x93, 0x72, |
mbedAustin | 11:cada08fc8a70 | 898 | 0x0b, 0x45, 0x54, 0x1c, 0x83, 0xee, 0x88, 0x41, 0x19, 0x1d, 0xa7, 0xce, |
mbedAustin | 11:cada08fc8a70 | 899 | 0xd8, 0x6e, 0x33, 0x12, 0xd4, 0x36, 0x23, 0xc1, 0xd6, 0x3e, 0x74, 0x98, |
mbedAustin | 11:cada08fc8a70 | 900 | 0x9a, 0xba, 0x4a, 0xff, 0xd1, 0xee, 0x41, 0x04, 0x07, 0x7e, 0x8c, 0x31, |
mbedAustin | 11:cada08fc8a70 | 901 | 0xe2, 0x0e, 0x6b, 0xed, 0xb7, 0x60, 0xc1, 0x35, 0x93, 0xe6, 0x9f, 0x15, |
mbedAustin | 11:cada08fc8a70 | 902 | 0xbe, 0x85, 0xc2, 0x7d, 0x68, 0xcd, 0x09, 0xcc, 0xb8, 0xc4, 0x18, 0x36, |
mbedAustin | 11:cada08fc8a70 | 903 | 0x08, 0x91, 0x7c, 0x5c, 0x3d, 0x40, 0x9f, 0xac, 0x39, 0xfe, 0xfe, 0xe8, |
mbedAustin | 11:cada08fc8a70 | 904 | 0x2f, 0x72, 0x92, 0xd3, 0x6f, 0x0d, 0x23, 0xe0, 0x55, 0x91, 0x3f, 0x45, |
mbedAustin | 11:cada08fc8a70 | 905 | 0xa5, 0x2b, 0x85, 0xdd, 0x8a, 0x20, 0x52, 0xe9, 0xe1, 0x29, 0xbb, 0x4d, |
mbedAustin | 11:cada08fc8a70 | 906 | 0x20, 0x0f, 0x01, 0x1f, 0x19, 0x48, 0x35, 0x35, 0xa6, 0xe8, 0x9a, 0x58, |
mbedAustin | 11:cada08fc8a70 | 907 | 0x0c, 0x9b, 0x00, 0x03, 0xba, 0xf2, 0x14, 0x62, 0xec, 0xe9, 0x1a, 0x82, |
mbedAustin | 11:cada08fc8a70 | 908 | 0xcc, 0x38, 0xdb, 0xdc, 0xae, 0x60, 0xd9, 0xc5, 0x4c |
mbedAustin | 11:cada08fc8a70 | 909 | }; |
mbedAustin | 11:cada08fc8a70 | 910 | |
mbedAustin | 11:cada08fc8a70 | 911 | static const unsigned char ecjpake_test_pms[] = { |
mbedAustin | 11:cada08fc8a70 | 912 | 0xf3, 0xd4, 0x7f, 0x59, 0x98, 0x44, 0xdb, 0x92, 0xa5, 0x69, 0xbb, 0xe7, |
mbedAustin | 11:cada08fc8a70 | 913 | 0x98, 0x1e, 0x39, 0xd9, 0x31, 0xfd, 0x74, 0x3b, 0xf2, 0x2e, 0x98, 0xf9, |
mbedAustin | 11:cada08fc8a70 | 914 | 0xb4, 0x38, 0xf7, 0x19, 0xd3, 0xc4, 0xf3, 0x51 |
mbedAustin | 11:cada08fc8a70 | 915 | }; |
mbedAustin | 11:cada08fc8a70 | 916 | |
mbedAustin | 11:cada08fc8a70 | 917 | /* Load my private keys and generate the correponding public keys */ |
mbedAustin | 11:cada08fc8a70 | 918 | static int ecjpake_test_load( mbedtls_ecjpake_context *ctx, |
mbedAustin | 11:cada08fc8a70 | 919 | const unsigned char *xm1, size_t len1, |
mbedAustin | 11:cada08fc8a70 | 920 | const unsigned char *xm2, size_t len2 ) |
mbedAustin | 11:cada08fc8a70 | 921 | { |
mbedAustin | 11:cada08fc8a70 | 922 | int ret; |
mbedAustin | 11:cada08fc8a70 | 923 | |
mbedAustin | 11:cada08fc8a70 | 924 | MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &ctx->xm1, xm1, len1 ) ); |
mbedAustin | 11:cada08fc8a70 | 925 | MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &ctx->xm2, xm2, len2 ) ); |
mbedAustin | 11:cada08fc8a70 | 926 | MBEDTLS_MPI_CHK( mbedtls_ecp_mul( &ctx->grp, &ctx->Xm1, &ctx->xm1, |
mbedAustin | 11:cada08fc8a70 | 927 | &ctx->grp.G, NULL, NULL ) ); |
mbedAustin | 11:cada08fc8a70 | 928 | MBEDTLS_MPI_CHK( mbedtls_ecp_mul( &ctx->grp, &ctx->Xm2, &ctx->xm2, |
mbedAustin | 11:cada08fc8a70 | 929 | &ctx->grp.G, NULL, NULL ) ); |
mbedAustin | 11:cada08fc8a70 | 930 | |
mbedAustin | 11:cada08fc8a70 | 931 | cleanup: |
mbedAustin | 11:cada08fc8a70 | 932 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 933 | } |
mbedAustin | 11:cada08fc8a70 | 934 | |
mbedAustin | 11:cada08fc8a70 | 935 | /* For tests we don't need a secure RNG; |
mbedAustin | 11:cada08fc8a70 | 936 | * use the LGC from Numerical Recipes for simplicity */ |
mbedAustin | 11:cada08fc8a70 | 937 | static int ecjpake_lgc( void *p, unsigned char *out, size_t len ) |
mbedAustin | 11:cada08fc8a70 | 938 | { |
mbedAustin | 11:cada08fc8a70 | 939 | static uint32_t x = 42; |
mbedAustin | 11:cada08fc8a70 | 940 | (void) p; |
mbedAustin | 11:cada08fc8a70 | 941 | |
mbedAustin | 11:cada08fc8a70 | 942 | while( len > 0 ) |
mbedAustin | 11:cada08fc8a70 | 943 | { |
mbedAustin | 11:cada08fc8a70 | 944 | size_t use_len = len > 4 ? 4 : len; |
mbedAustin | 11:cada08fc8a70 | 945 | x = 1664525 * x + 1013904223; |
mbedAustin | 11:cada08fc8a70 | 946 | memcpy( out, &x, use_len ); |
mbedAustin | 11:cada08fc8a70 | 947 | out += use_len; |
mbedAustin | 11:cada08fc8a70 | 948 | len -= use_len; |
mbedAustin | 11:cada08fc8a70 | 949 | } |
mbedAustin | 11:cada08fc8a70 | 950 | |
mbedAustin | 11:cada08fc8a70 | 951 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 952 | } |
mbedAustin | 11:cada08fc8a70 | 953 | |
mbedAustin | 11:cada08fc8a70 | 954 | #define TEST_ASSERT( x ) \ |
mbedAustin | 11:cada08fc8a70 | 955 | do { \ |
mbedAustin | 11:cada08fc8a70 | 956 | if( x ) \ |
mbedAustin | 11:cada08fc8a70 | 957 | ret = 0; \ |
mbedAustin | 11:cada08fc8a70 | 958 | else \ |
mbedAustin | 11:cada08fc8a70 | 959 | { \ |
mbedAustin | 11:cada08fc8a70 | 960 | ret = 1; \ |
mbedAustin | 11:cada08fc8a70 | 961 | goto cleanup; \ |
mbedAustin | 11:cada08fc8a70 | 962 | } \ |
mbedAustin | 11:cada08fc8a70 | 963 | } while( 0 ) |
mbedAustin | 11:cada08fc8a70 | 964 | |
mbedAustin | 11:cada08fc8a70 | 965 | /* |
mbedAustin | 11:cada08fc8a70 | 966 | * Checkup routine |
mbedAustin | 11:cada08fc8a70 | 967 | */ |
mbedAustin | 11:cada08fc8a70 | 968 | int mbedtls_ecjpake_self_test( int verbose ) |
mbedAustin | 11:cada08fc8a70 | 969 | { |
mbedAustin | 11:cada08fc8a70 | 970 | int ret; |
mbedAustin | 11:cada08fc8a70 | 971 | mbedtls_ecjpake_context cli; |
mbedAustin | 11:cada08fc8a70 | 972 | mbedtls_ecjpake_context srv; |
mbedAustin | 11:cada08fc8a70 | 973 | unsigned char buf[512], pms[32]; |
mbedAustin | 11:cada08fc8a70 | 974 | size_t len, pmslen; |
mbedAustin | 11:cada08fc8a70 | 975 | |
mbedAustin | 11:cada08fc8a70 | 976 | mbedtls_ecjpake_init( &cli ); |
mbedAustin | 11:cada08fc8a70 | 977 | mbedtls_ecjpake_init( &srv ); |
mbedAustin | 11:cada08fc8a70 | 978 | |
mbedAustin | 11:cada08fc8a70 | 979 | if( verbose != 0 ) |
mbedAustin | 11:cada08fc8a70 | 980 | mbedtls_printf( " ECJPAKE test #0 (setup): " ); |
mbedAustin | 11:cada08fc8a70 | 981 | |
mbedAustin | 11:cada08fc8a70 | 982 | TEST_ASSERT( mbedtls_ecjpake_setup( &cli, MBEDTLS_ECJPAKE_CLIENT, |
mbedAustin | 11:cada08fc8a70 | 983 | MBEDTLS_MD_SHA256, MBEDTLS_ECP_DP_SECP256R1, |
mbedAustin | 11:cada08fc8a70 | 984 | ecjpake_test_password, |
mbedAustin | 11:cada08fc8a70 | 985 | sizeof( ecjpake_test_password ) ) == 0 ); |
mbedAustin | 11:cada08fc8a70 | 986 | |
mbedAustin | 11:cada08fc8a70 | 987 | TEST_ASSERT( mbedtls_ecjpake_setup( &srv, MBEDTLS_ECJPAKE_SERVER, |
mbedAustin | 11:cada08fc8a70 | 988 | MBEDTLS_MD_SHA256, MBEDTLS_ECP_DP_SECP256R1, |
mbedAustin | 11:cada08fc8a70 | 989 | ecjpake_test_password, |
mbedAustin | 11:cada08fc8a70 | 990 | sizeof( ecjpake_test_password ) ) == 0 ); |
mbedAustin | 11:cada08fc8a70 | 991 | |
mbedAustin | 11:cada08fc8a70 | 992 | if( verbose != 0 ) |
mbedAustin | 11:cada08fc8a70 | 993 | mbedtls_printf( "passed\n" ); |
mbedAustin | 11:cada08fc8a70 | 994 | |
mbedAustin | 11:cada08fc8a70 | 995 | if( verbose != 0 ) |
mbedAustin | 11:cada08fc8a70 | 996 | mbedtls_printf( " ECJPAKE test #1 (random handshake): " ); |
mbedAustin | 11:cada08fc8a70 | 997 | |
mbedAustin | 11:cada08fc8a70 | 998 | TEST_ASSERT( mbedtls_ecjpake_write_round_one( &cli, |
mbedAustin | 11:cada08fc8a70 | 999 | buf, sizeof( buf ), &len, ecjpake_lgc, NULL ) == 0 ); |
mbedAustin | 11:cada08fc8a70 | 1000 | |
mbedAustin | 11:cada08fc8a70 | 1001 | TEST_ASSERT( mbedtls_ecjpake_read_round_one( &srv, buf, len ) == 0 ); |
mbedAustin | 11:cada08fc8a70 | 1002 | |
mbedAustin | 11:cada08fc8a70 | 1003 | TEST_ASSERT( mbedtls_ecjpake_write_round_one( &srv, |
mbedAustin | 11:cada08fc8a70 | 1004 | buf, sizeof( buf ), &len, ecjpake_lgc, NULL ) == 0 ); |
mbedAustin | 11:cada08fc8a70 | 1005 | |
mbedAustin | 11:cada08fc8a70 | 1006 | TEST_ASSERT( mbedtls_ecjpake_read_round_one( &cli, buf, len ) == 0 ); |
mbedAustin | 11:cada08fc8a70 | 1007 | |
mbedAustin | 11:cada08fc8a70 | 1008 | TEST_ASSERT( mbedtls_ecjpake_write_round_two( &srv, |
mbedAustin | 11:cada08fc8a70 | 1009 | buf, sizeof( buf ), &len, ecjpake_lgc, NULL ) == 0 ); |
mbedAustin | 11:cada08fc8a70 | 1010 | |
mbedAustin | 11:cada08fc8a70 | 1011 | TEST_ASSERT( mbedtls_ecjpake_read_round_two( &cli, buf, len ) == 0 ); |
mbedAustin | 11:cada08fc8a70 | 1012 | |
mbedAustin | 11:cada08fc8a70 | 1013 | TEST_ASSERT( mbedtls_ecjpake_derive_secret( &cli, |
mbedAustin | 11:cada08fc8a70 | 1014 | pms, sizeof( pms ), &pmslen, ecjpake_lgc, NULL ) == 0 ); |
mbedAustin | 11:cada08fc8a70 | 1015 | |
mbedAustin | 11:cada08fc8a70 | 1016 | TEST_ASSERT( mbedtls_ecjpake_write_round_two( &cli, |
mbedAustin | 11:cada08fc8a70 | 1017 | buf, sizeof( buf ), &len, ecjpake_lgc, NULL ) == 0 ); |
mbedAustin | 11:cada08fc8a70 | 1018 | |
mbedAustin | 11:cada08fc8a70 | 1019 | TEST_ASSERT( mbedtls_ecjpake_read_round_two( &srv, buf, len ) == 0 ); |
mbedAustin | 11:cada08fc8a70 | 1020 | |
mbedAustin | 11:cada08fc8a70 | 1021 | TEST_ASSERT( mbedtls_ecjpake_derive_secret( &srv, |
mbedAustin | 11:cada08fc8a70 | 1022 | buf, sizeof( buf ), &len, ecjpake_lgc, NULL ) == 0 ); |
mbedAustin | 11:cada08fc8a70 | 1023 | |
mbedAustin | 11:cada08fc8a70 | 1024 | TEST_ASSERT( len == pmslen ); |
mbedAustin | 11:cada08fc8a70 | 1025 | TEST_ASSERT( memcmp( buf, pms, len ) == 0 ); |
mbedAustin | 11:cada08fc8a70 | 1026 | |
mbedAustin | 11:cada08fc8a70 | 1027 | if( verbose != 0 ) |
mbedAustin | 11:cada08fc8a70 | 1028 | mbedtls_printf( "passed\n" ); |
mbedAustin | 11:cada08fc8a70 | 1029 | |
mbedAustin | 11:cada08fc8a70 | 1030 | if( verbose != 0 ) |
mbedAustin | 11:cada08fc8a70 | 1031 | mbedtls_printf( " ECJPAKE test #2 (reference handshake): " ); |
mbedAustin | 11:cada08fc8a70 | 1032 | |
mbedAustin | 11:cada08fc8a70 | 1033 | /* Simulate generation of round one */ |
mbedAustin | 11:cada08fc8a70 | 1034 | MBEDTLS_MPI_CHK( ecjpake_test_load( &cli, |
mbedAustin | 11:cada08fc8a70 | 1035 | ecjpake_test_x1, sizeof( ecjpake_test_x1 ), |
mbedAustin | 11:cada08fc8a70 | 1036 | ecjpake_test_x2, sizeof( ecjpake_test_x2 ) ) ); |
mbedAustin | 11:cada08fc8a70 | 1037 | |
mbedAustin | 11:cada08fc8a70 | 1038 | MBEDTLS_MPI_CHK( ecjpake_test_load( &srv, |
mbedAustin | 11:cada08fc8a70 | 1039 | ecjpake_test_x3, sizeof( ecjpake_test_x3 ), |
mbedAustin | 11:cada08fc8a70 | 1040 | ecjpake_test_x4, sizeof( ecjpake_test_x4 ) ) ); |
mbedAustin | 11:cada08fc8a70 | 1041 | |
mbedAustin | 11:cada08fc8a70 | 1042 | /* Read round one */ |
mbedAustin | 11:cada08fc8a70 | 1043 | TEST_ASSERT( mbedtls_ecjpake_read_round_one( &srv, |
mbedAustin | 11:cada08fc8a70 | 1044 | ecjpake_test_cli_one, |
mbedAustin | 11:cada08fc8a70 | 1045 | sizeof( ecjpake_test_cli_one ) ) == 0 ); |
mbedAustin | 11:cada08fc8a70 | 1046 | |
mbedAustin | 11:cada08fc8a70 | 1047 | TEST_ASSERT( mbedtls_ecjpake_read_round_one( &cli, |
mbedAustin | 11:cada08fc8a70 | 1048 | ecjpake_test_srv_one, |
mbedAustin | 11:cada08fc8a70 | 1049 | sizeof( ecjpake_test_srv_one ) ) == 0 ); |
mbedAustin | 11:cada08fc8a70 | 1050 | |
mbedAustin | 11:cada08fc8a70 | 1051 | /* Skip generation of round two, read round two */ |
mbedAustin | 11:cada08fc8a70 | 1052 | TEST_ASSERT( mbedtls_ecjpake_read_round_two( &cli, |
mbedAustin | 11:cada08fc8a70 | 1053 | ecjpake_test_srv_two, |
mbedAustin | 11:cada08fc8a70 | 1054 | sizeof( ecjpake_test_srv_two ) ) == 0 ); |
mbedAustin | 11:cada08fc8a70 | 1055 | |
mbedAustin | 11:cada08fc8a70 | 1056 | TEST_ASSERT( mbedtls_ecjpake_read_round_two( &srv, |
mbedAustin | 11:cada08fc8a70 | 1057 | ecjpake_test_cli_two, |
mbedAustin | 11:cada08fc8a70 | 1058 | sizeof( ecjpake_test_cli_two ) ) == 0 ); |
mbedAustin | 11:cada08fc8a70 | 1059 | |
mbedAustin | 11:cada08fc8a70 | 1060 | /* Server derives PMS */ |
mbedAustin | 11:cada08fc8a70 | 1061 | TEST_ASSERT( mbedtls_ecjpake_derive_secret( &srv, |
mbedAustin | 11:cada08fc8a70 | 1062 | buf, sizeof( buf ), &len, ecjpake_lgc, NULL ) == 0 ); |
mbedAustin | 11:cada08fc8a70 | 1063 | |
mbedAustin | 11:cada08fc8a70 | 1064 | TEST_ASSERT( len == sizeof( ecjpake_test_pms ) ); |
mbedAustin | 11:cada08fc8a70 | 1065 | TEST_ASSERT( memcmp( buf, ecjpake_test_pms, len ) == 0 ); |
mbedAustin | 11:cada08fc8a70 | 1066 | |
mbedAustin | 11:cada08fc8a70 | 1067 | memset( buf, 0, len ); /* Avoid interferences with next step */ |
mbedAustin | 11:cada08fc8a70 | 1068 | |
mbedAustin | 11:cada08fc8a70 | 1069 | /* Client derives PMS */ |
mbedAustin | 11:cada08fc8a70 | 1070 | TEST_ASSERT( mbedtls_ecjpake_derive_secret( &cli, |
mbedAustin | 11:cada08fc8a70 | 1071 | buf, sizeof( buf ), &len, ecjpake_lgc, NULL ) == 0 ); |
mbedAustin | 11:cada08fc8a70 | 1072 | |
mbedAustin | 11:cada08fc8a70 | 1073 | TEST_ASSERT( len == sizeof( ecjpake_test_pms ) ); |
mbedAustin | 11:cada08fc8a70 | 1074 | TEST_ASSERT( memcmp( buf, ecjpake_test_pms, len ) == 0 ); |
mbedAustin | 11:cada08fc8a70 | 1075 | |
mbedAustin | 11:cada08fc8a70 | 1076 | if( verbose != 0 ) |
mbedAustin | 11:cada08fc8a70 | 1077 | mbedtls_printf( "passed\n" ); |
mbedAustin | 11:cada08fc8a70 | 1078 | |
mbedAustin | 11:cada08fc8a70 | 1079 | cleanup: |
mbedAustin | 11:cada08fc8a70 | 1080 | mbedtls_ecjpake_free( &cli ); |
mbedAustin | 11:cada08fc8a70 | 1081 | mbedtls_ecjpake_free( &srv ); |
mbedAustin | 11:cada08fc8a70 | 1082 | |
mbedAustin | 11:cada08fc8a70 | 1083 | if( ret != 0 ) |
mbedAustin | 11:cada08fc8a70 | 1084 | { |
mbedAustin | 11:cada08fc8a70 | 1085 | if( verbose != 0 ) |
mbedAustin | 11:cada08fc8a70 | 1086 | mbedtls_printf( "failed\n" ); |
mbedAustin | 11:cada08fc8a70 | 1087 | |
mbedAustin | 11:cada08fc8a70 | 1088 | ret = 1; |
mbedAustin | 11:cada08fc8a70 | 1089 | } |
mbedAustin | 11:cada08fc8a70 | 1090 | |
mbedAustin | 11:cada08fc8a70 | 1091 | if( verbose != 0 ) |
mbedAustin | 11:cada08fc8a70 | 1092 | mbedtls_printf( "\n" ); |
mbedAustin | 11:cada08fc8a70 | 1093 | |
mbedAustin | 11:cada08fc8a70 | 1094 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 1095 | } |
mbedAustin | 11:cada08fc8a70 | 1096 | |
mbedAustin | 11:cada08fc8a70 | 1097 | #undef TEST_ASSERT |
mbedAustin | 11:cada08fc8a70 | 1098 | |
mbedAustin | 11:cada08fc8a70 | 1099 | #endif /* MBEDTLS_ECP_DP_SECP256R1_ENABLED && MBEDTLS_SHA256_C */ |
mbedAustin | 11:cada08fc8a70 | 1100 | |
mbedAustin | 11:cada08fc8a70 | 1101 | #endif /* MBEDTLS_SELF_TEST */ |
mbedAustin | 11:cada08fc8a70 | 1102 | |
mbedAustin | 11:cada08fc8a70 | 1103 | #endif /* MBEDTLS_ECJPAKE_C */ |