wolf SSL / wolfSSL

wolfSSL SSL/TLS library, support up to TLS1.3

Dependents:   CyaSSL-Twitter-OAuth4Tw Example-client-tls-cert TwitterReader TweetTest ... more

wolfcrypt/src/srp.c@15:117db924cf7c, 2018-08-18 (annotated)

Committer:
wolfSSL
Date:
Sat Aug 18 22:20:43 2018 +0000
Revision:
15:117db924cf7c
Child:
16:8e0d178b1d1e
wolfSSL 3.15.3

Who changed what in which revision?

UserRevisionLine numberNew contents of line
wolfSSL 15:117db924cf7c 1 /* srp.c
wolfSSL 15:117db924cf7c 2 *
wolfSSL 15:117db924cf7c 3 * Copyright (C) 2006-2017 wolfSSL Inc.
wolfSSL 15:117db924cf7c 4 *
wolfSSL 15:117db924cf7c 5 * This file is part of wolfSSL.
wolfSSL 15:117db924cf7c 6 *
wolfSSL 15:117db924cf7c 7 * wolfSSL is free software; you can redistribute it and/or modify
wolfSSL 15:117db924cf7c 8 * it under the terms of the GNU General Public License as published by
wolfSSL 15:117db924cf7c 9 * the Free Software Foundation; either version 2 of the License, or
wolfSSL 15:117db924cf7c 10 * (at your option) any later version.
wolfSSL 15:117db924cf7c 11 *
wolfSSL 15:117db924cf7c 12 * wolfSSL is distributed in the hope that it will be useful,
wolfSSL 15:117db924cf7c 13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
wolfSSL 15:117db924cf7c 14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
wolfSSL 15:117db924cf7c 15 * GNU General Public License for more details.
wolfSSL 15:117db924cf7c 16 *
wolfSSL 15:117db924cf7c 17 * You should have received a copy of the GNU General Public License
wolfSSL 15:117db924cf7c 18 * along with this program; if not, write to the Free Software
wolfSSL 15:117db924cf7c 19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
wolfSSL 15:117db924cf7c 20 */
wolfSSL 15:117db924cf7c 21
wolfSSL 15:117db924cf7c 22
wolfSSL 15:117db924cf7c 23 #ifdef HAVE_CONFIG_H
wolfSSL 15:117db924cf7c 24 #include <config.h>
wolfSSL 15:117db924cf7c 25 #endif
wolfSSL 15:117db924cf7c 26
wolfSSL 15:117db924cf7c 27 #include <wolfssl/wolfcrypt/settings.h>
wolfSSL 15:117db924cf7c 28
wolfSSL 15:117db924cf7c 29 #ifdef WOLFCRYPT_HAVE_SRP
wolfSSL 15:117db924cf7c 30
wolfSSL 15:117db924cf7c 31 #include <wolfssl/wolfcrypt/srp.h>
wolfSSL 15:117db924cf7c 32 #include <wolfssl/wolfcrypt/random.h>
wolfSSL 15:117db924cf7c 33 #include <wolfssl/wolfcrypt/error-crypt.h>
wolfSSL 15:117db924cf7c 34
wolfSSL 15:117db924cf7c 35 #ifdef NO_INLINE
wolfSSL 15:117db924cf7c 36 #include <wolfssl/wolfcrypt/misc.h>
wolfSSL 15:117db924cf7c 37 #else
wolfSSL 15:117db924cf7c 38 #define WOLFSSL_MISC_INCLUDED
wolfSSL 15:117db924cf7c 39 #include <wolfcrypt/src/misc.c>
wolfSSL 15:117db924cf7c 40 #endif
wolfSSL 15:117db924cf7c 41
wolfSSL 15:117db924cf7c 42 /** Computes the session key using the Mask Generation Function 1. */
wolfSSL 15:117db924cf7c 43 static int wc_SrpSetKey(Srp* srp, byte* secret, word32 size);
wolfSSL 15:117db924cf7c 44
wolfSSL 15:117db924cf7c 45 static int SrpHashInit(SrpHash* hash, SrpType type)
wolfSSL 15:117db924cf7c 46 {
wolfSSL 15:117db924cf7c 47 hash->type = type;
wolfSSL 15:117db924cf7c 48
wolfSSL 15:117db924cf7c 49 switch (type) {
wolfSSL 15:117db924cf7c 50 case SRP_TYPE_SHA:
wolfSSL 15:117db924cf7c 51 #ifndef NO_SHA
wolfSSL 15:117db924cf7c 52 return wc_InitSha(&hash->data.sha);
wolfSSL 15:117db924cf7c 53 #else
wolfSSL 15:117db924cf7c 54 return BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 55 #endif
wolfSSL 15:117db924cf7c 56
wolfSSL 15:117db924cf7c 57 case SRP_TYPE_SHA256:
wolfSSL 15:117db924cf7c 58 #ifndef NO_SHA256
wolfSSL 15:117db924cf7c 59 return wc_InitSha256(&hash->data.sha256);
wolfSSL 15:117db924cf7c 60 #else
wolfSSL 15:117db924cf7c 61 return BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 62 #endif
wolfSSL 15:117db924cf7c 63
wolfSSL 15:117db924cf7c 64 case SRP_TYPE_SHA384:
wolfSSL 15:117db924cf7c 65 #ifdef WOLFSSL_SHA384
wolfSSL 15:117db924cf7c 66 return wc_InitSha384(&hash->data.sha384);
wolfSSL 15:117db924cf7c 67 #else
wolfSSL 15:117db924cf7c 68 return BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 69 #endif
wolfSSL 15:117db924cf7c 70
wolfSSL 15:117db924cf7c 71 case SRP_TYPE_SHA512:
wolfSSL 15:117db924cf7c 72 #ifdef WOLFSSL_SHA512
wolfSSL 15:117db924cf7c 73 return wc_InitSha512(&hash->data.sha512);
wolfSSL 15:117db924cf7c 74 #else
wolfSSL 15:117db924cf7c 75 return BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 76 #endif
wolfSSL 15:117db924cf7c 77
wolfSSL 15:117db924cf7c 78 default:
wolfSSL 15:117db924cf7c 79 return BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 80 }
wolfSSL 15:117db924cf7c 81 }
wolfSSL 15:117db924cf7c 82
wolfSSL 15:117db924cf7c 83 static int SrpHashUpdate(SrpHash* hash, const byte* data, word32 size)
wolfSSL 15:117db924cf7c 84 {
wolfSSL 15:117db924cf7c 85 switch (hash->type) {
wolfSSL 15:117db924cf7c 86 case SRP_TYPE_SHA:
wolfSSL 15:117db924cf7c 87 #ifndef NO_SHA
wolfSSL 15:117db924cf7c 88 return wc_ShaUpdate(&hash->data.sha, data, size);
wolfSSL 15:117db924cf7c 89 #else
wolfSSL 15:117db924cf7c 90 return BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 91 #endif
wolfSSL 15:117db924cf7c 92
wolfSSL 15:117db924cf7c 93 case SRP_TYPE_SHA256:
wolfSSL 15:117db924cf7c 94 #ifndef NO_SHA256
wolfSSL 15:117db924cf7c 95 return wc_Sha256Update(&hash->data.sha256, data, size);
wolfSSL 15:117db924cf7c 96 #else
wolfSSL 15:117db924cf7c 97 return BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 98 #endif
wolfSSL 15:117db924cf7c 99
wolfSSL 15:117db924cf7c 100 case SRP_TYPE_SHA384:
wolfSSL 15:117db924cf7c 101 #ifdef WOLFSSL_SHA384
wolfSSL 15:117db924cf7c 102 return wc_Sha384Update(&hash->data.sha384, data, size);
wolfSSL 15:117db924cf7c 103 #else
wolfSSL 15:117db924cf7c 104 return BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 105 #endif
wolfSSL 15:117db924cf7c 106
wolfSSL 15:117db924cf7c 107 case SRP_TYPE_SHA512:
wolfSSL 15:117db924cf7c 108 #ifdef WOLFSSL_SHA512
wolfSSL 15:117db924cf7c 109 return wc_Sha512Update(&hash->data.sha512, data, size);
wolfSSL 15:117db924cf7c 110 #else
wolfSSL 15:117db924cf7c 111 return BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 112 #endif
wolfSSL 15:117db924cf7c 113
wolfSSL 15:117db924cf7c 114 default:
wolfSSL 15:117db924cf7c 115 return BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 116 }
wolfSSL 15:117db924cf7c 117 }
wolfSSL 15:117db924cf7c 118
wolfSSL 15:117db924cf7c 119 static int SrpHashFinal(SrpHash* hash, byte* digest)
wolfSSL 15:117db924cf7c 120 {
wolfSSL 15:117db924cf7c 121 switch (hash->type) {
wolfSSL 15:117db924cf7c 122 case SRP_TYPE_SHA:
wolfSSL 15:117db924cf7c 123 #ifndef NO_SHA
wolfSSL 15:117db924cf7c 124 return wc_ShaFinal(&hash->data.sha, digest);
wolfSSL 15:117db924cf7c 125 #else
wolfSSL 15:117db924cf7c 126 return BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 127 #endif
wolfSSL 15:117db924cf7c 128
wolfSSL 15:117db924cf7c 129 case SRP_TYPE_SHA256:
wolfSSL 15:117db924cf7c 130 #ifndef NO_SHA256
wolfSSL 15:117db924cf7c 131 return wc_Sha256Final(&hash->data.sha256, digest);
wolfSSL 15:117db924cf7c 132 #else
wolfSSL 15:117db924cf7c 133 return BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 134 #endif
wolfSSL 15:117db924cf7c 135
wolfSSL 15:117db924cf7c 136 case SRP_TYPE_SHA384:
wolfSSL 15:117db924cf7c 137 #ifdef WOLFSSL_SHA384
wolfSSL 15:117db924cf7c 138 return wc_Sha384Final(&hash->data.sha384, digest);
wolfSSL 15:117db924cf7c 139 #else
wolfSSL 15:117db924cf7c 140 return BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 141 #endif
wolfSSL 15:117db924cf7c 142
wolfSSL 15:117db924cf7c 143 case SRP_TYPE_SHA512:
wolfSSL 15:117db924cf7c 144 #ifdef WOLFSSL_SHA512
wolfSSL 15:117db924cf7c 145 return wc_Sha512Final(&hash->data.sha512, digest);
wolfSSL 15:117db924cf7c 146 #else
wolfSSL 15:117db924cf7c 147 return BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 148 #endif
wolfSSL 15:117db924cf7c 149
wolfSSL 15:117db924cf7c 150 default:
wolfSSL 15:117db924cf7c 151 return BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 152 }
wolfSSL 15:117db924cf7c 153 }
wolfSSL 15:117db924cf7c 154
wolfSSL 15:117db924cf7c 155 static word32 SrpHashSize(SrpType type)
wolfSSL 15:117db924cf7c 156 {
wolfSSL 15:117db924cf7c 157 switch (type) {
wolfSSL 15:117db924cf7c 158 case SRP_TYPE_SHA:
wolfSSL 15:117db924cf7c 159 #ifndef NO_SHA
wolfSSL 15:117db924cf7c 160 return WC_SHA_DIGEST_SIZE;
wolfSSL 15:117db924cf7c 161 #else
wolfSSL 15:117db924cf7c 162 return 0;
wolfSSL 15:117db924cf7c 163 #endif
wolfSSL 15:117db924cf7c 164
wolfSSL 15:117db924cf7c 165 case SRP_TYPE_SHA256:
wolfSSL 15:117db924cf7c 166 #ifndef NO_SHA256
wolfSSL 15:117db924cf7c 167 return WC_SHA256_DIGEST_SIZE;
wolfSSL 15:117db924cf7c 168 #else
wolfSSL 15:117db924cf7c 169 return 0;
wolfSSL 15:117db924cf7c 170 #endif
wolfSSL 15:117db924cf7c 171
wolfSSL 15:117db924cf7c 172 case SRP_TYPE_SHA384:
wolfSSL 15:117db924cf7c 173 #ifdef WOLFSSL_SHA384
wolfSSL 15:117db924cf7c 174 return WC_SHA384_DIGEST_SIZE;
wolfSSL 15:117db924cf7c 175 #else
wolfSSL 15:117db924cf7c 176 return 0;
wolfSSL 15:117db924cf7c 177 #endif
wolfSSL 15:117db924cf7c 178
wolfSSL 15:117db924cf7c 179 case SRP_TYPE_SHA512:
wolfSSL 15:117db924cf7c 180 #ifdef WOLFSSL_SHA512
wolfSSL 15:117db924cf7c 181 return WC_SHA512_DIGEST_SIZE;
wolfSSL 15:117db924cf7c 182 #else
wolfSSL 15:117db924cf7c 183 return 0;
wolfSSL 15:117db924cf7c 184 #endif
wolfSSL 15:117db924cf7c 185
wolfSSL 15:117db924cf7c 186 default:
wolfSSL 15:117db924cf7c 187 return 0;
wolfSSL 15:117db924cf7c 188 }
wolfSSL 15:117db924cf7c 189 }
wolfSSL 15:117db924cf7c 190
wolfSSL 15:117db924cf7c 191 int wc_SrpInit(Srp* srp, SrpType type, SrpSide side)
wolfSSL 15:117db924cf7c 192 {
wolfSSL 15:117db924cf7c 193 int r;
wolfSSL 15:117db924cf7c 194
wolfSSL 15:117db924cf7c 195 /* validating params */
wolfSSL 15:117db924cf7c 196
wolfSSL 15:117db924cf7c 197 if (!srp)
wolfSSL 15:117db924cf7c 198 return BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 199
wolfSSL 15:117db924cf7c 200 if (side != SRP_CLIENT_SIDE && side != SRP_SERVER_SIDE)
wolfSSL 15:117db924cf7c 201 return BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 202
wolfSSL 15:117db924cf7c 203 switch (type) {
wolfSSL 15:117db924cf7c 204 case SRP_TYPE_SHA:
wolfSSL 15:117db924cf7c 205 #ifdef NO_SHA
wolfSSL 15:117db924cf7c 206 return NOT_COMPILED_IN;
wolfSSL 15:117db924cf7c 207 #else
wolfSSL 15:117db924cf7c 208 break; /* OK */
wolfSSL 15:117db924cf7c 209 #endif
wolfSSL 15:117db924cf7c 210
wolfSSL 15:117db924cf7c 211 case SRP_TYPE_SHA256:
wolfSSL 15:117db924cf7c 212 #ifdef NO_SHA256
wolfSSL 15:117db924cf7c 213 return NOT_COMPILED_IN;
wolfSSL 15:117db924cf7c 214 #else
wolfSSL 15:117db924cf7c 215 break; /* OK */
wolfSSL 15:117db924cf7c 216 #endif
wolfSSL 15:117db924cf7c 217
wolfSSL 15:117db924cf7c 218 case SRP_TYPE_SHA384:
wolfSSL 15:117db924cf7c 219 #ifndef WOLFSSL_SHA384
wolfSSL 15:117db924cf7c 220 return NOT_COMPILED_IN;
wolfSSL 15:117db924cf7c 221 #else
wolfSSL 15:117db924cf7c 222 break; /* OK */
wolfSSL 15:117db924cf7c 223 #endif
wolfSSL 15:117db924cf7c 224
wolfSSL 15:117db924cf7c 225 case SRP_TYPE_SHA512:
wolfSSL 15:117db924cf7c 226 #ifndef WOLFSSL_SHA512
wolfSSL 15:117db924cf7c 227 return NOT_COMPILED_IN;
wolfSSL 15:117db924cf7c 228 #else
wolfSSL 15:117db924cf7c 229 break; /* OK */
wolfSSL 15:117db924cf7c 230 #endif
wolfSSL 15:117db924cf7c 231
wolfSSL 15:117db924cf7c 232 default:
wolfSSL 15:117db924cf7c 233 return BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 234 }
wolfSSL 15:117db924cf7c 235
wolfSSL 15:117db924cf7c 236 /* initializing variables */
wolfSSL 15:117db924cf7c 237
wolfSSL 15:117db924cf7c 238 XMEMSET(srp, 0, sizeof(Srp));
wolfSSL 15:117db924cf7c 239
wolfSSL 15:117db924cf7c 240 if ((r = SrpHashInit(&srp->client_proof, type)) != 0)
wolfSSL 15:117db924cf7c 241 return r;
wolfSSL 15:117db924cf7c 242
wolfSSL 15:117db924cf7c 243 if ((r = SrpHashInit(&srp->server_proof, type)) != 0)
wolfSSL 15:117db924cf7c 244 return r;
wolfSSL 15:117db924cf7c 245
wolfSSL 15:117db924cf7c 246 if ((r = mp_init_multi(&srp->N, &srp->g, &srp->auth,
wolfSSL 15:117db924cf7c 247 &srp->priv, 0, 0)) != 0)
wolfSSL 15:117db924cf7c 248 return r;
wolfSSL 15:117db924cf7c 249
wolfSSL 15:117db924cf7c 250 srp->side = side; srp->type = type;
wolfSSL 15:117db924cf7c 251 srp->salt = NULL; srp->saltSz = 0;
wolfSSL 15:117db924cf7c 252 srp->user = NULL; srp->userSz = 0;
wolfSSL 15:117db924cf7c 253 srp->key = NULL; srp->keySz = 0;
wolfSSL 15:117db924cf7c 254
wolfSSL 15:117db924cf7c 255 srp->keyGenFunc_cb = wc_SrpSetKey;
wolfSSL 15:117db924cf7c 256
wolfSSL 15:117db924cf7c 257 /* default heap hint to NULL or test value */
wolfSSL 15:117db924cf7c 258 #ifdef WOLFSSL_HEAP_TEST
wolfSSL 15:117db924cf7c 259 srp->heap = (void*)WOLFSSL_HEAP_TEST;
wolfSSL 15:117db924cf7c 260 #else
wolfSSL 15:117db924cf7c 261 srp->heap = NULL;
wolfSSL 15:117db924cf7c 262 #endif
wolfSSL 15:117db924cf7c 263
wolfSSL 15:117db924cf7c 264 return 0;
wolfSSL 15:117db924cf7c 265 }
wolfSSL 15:117db924cf7c 266
wolfSSL 15:117db924cf7c 267 void wc_SrpTerm(Srp* srp)
wolfSSL 15:117db924cf7c 268 {
wolfSSL 15:117db924cf7c 269 if (srp) {
wolfSSL 15:117db924cf7c 270 mp_clear(&srp->N); mp_clear(&srp->g);
wolfSSL 15:117db924cf7c 271 mp_clear(&srp->auth); mp_clear(&srp->priv);
wolfSSL 15:117db924cf7c 272 if (srp->salt) {
wolfSSL 15:117db924cf7c 273 ForceZero(srp->salt, srp->saltSz);
wolfSSL 15:117db924cf7c 274 XFREE(srp->salt, srp->heap, DYNAMIC_TYPE_SRP);
wolfSSL 15:117db924cf7c 275 }
wolfSSL 15:117db924cf7c 276 if (srp->user) {
wolfSSL 15:117db924cf7c 277 ForceZero(srp->user, srp->userSz);
wolfSSL 15:117db924cf7c 278 XFREE(srp->user, srp->heap, DYNAMIC_TYPE_SRP);
wolfSSL 15:117db924cf7c 279 }
wolfSSL 15:117db924cf7c 280 if (srp->key) {
wolfSSL 15:117db924cf7c 281 ForceZero(srp->key, srp->keySz);
wolfSSL 15:117db924cf7c 282 XFREE(srp->key, srp->heap, DYNAMIC_TYPE_SRP);
wolfSSL 15:117db924cf7c 283 }
wolfSSL 15:117db924cf7c 284
wolfSSL 15:117db924cf7c 285 ForceZero(srp, sizeof(Srp));
wolfSSL 15:117db924cf7c 286 }
wolfSSL 15:117db924cf7c 287 }
wolfSSL 15:117db924cf7c 288
wolfSSL 15:117db924cf7c 289 int wc_SrpSetUsername(Srp* srp, const byte* username, word32 size)
wolfSSL 15:117db924cf7c 290 {
wolfSSL 15:117db924cf7c 291 if (!srp || !username)
wolfSSL 15:117db924cf7c 292 return BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 293
wolfSSL 15:117db924cf7c 294 srp->user = (byte*)XMALLOC(size, srp->heap, DYNAMIC_TYPE_SRP);
wolfSSL 15:117db924cf7c 295 if (srp->user == NULL)
wolfSSL 15:117db924cf7c 296 return MEMORY_E;
wolfSSL 15:117db924cf7c 297
wolfSSL 15:117db924cf7c 298 srp->userSz = size;
wolfSSL 15:117db924cf7c 299 XMEMCPY(srp->user, username, srp->userSz);
wolfSSL 15:117db924cf7c 300
wolfSSL 15:117db924cf7c 301 return 0;
wolfSSL 15:117db924cf7c 302 }
wolfSSL 15:117db924cf7c 303
wolfSSL 15:117db924cf7c 304 int wc_SrpSetParams(Srp* srp, const byte* N, word32 nSz,
wolfSSL 15:117db924cf7c 305 const byte* g, word32 gSz,
wolfSSL 15:117db924cf7c 306 const byte* salt, word32 saltSz)
wolfSSL 15:117db924cf7c 307 {
wolfSSL 15:117db924cf7c 308 SrpHash hash;
wolfSSL 15:117db924cf7c 309 byte digest1[SRP_MAX_DIGEST_SIZE];
wolfSSL 15:117db924cf7c 310 byte digest2[SRP_MAX_DIGEST_SIZE];
wolfSSL 15:117db924cf7c 311 byte pad = 0;
wolfSSL 15:117db924cf7c 312 int i, r;
wolfSSL 15:117db924cf7c 313 int j = 0;
wolfSSL 15:117db924cf7c 314
wolfSSL 15:117db924cf7c 315 if (!srp || !N || !g || !salt || nSz < gSz)
wolfSSL 15:117db924cf7c 316 return BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 317
wolfSSL 15:117db924cf7c 318 if (!srp->user)
wolfSSL 15:117db924cf7c 319 return SRP_CALL_ORDER_E;
wolfSSL 15:117db924cf7c 320
wolfSSL 15:117db924cf7c 321 /* Set N */
wolfSSL 15:117db924cf7c 322 if (mp_read_unsigned_bin(&srp->N, N, nSz) != MP_OKAY)
wolfSSL 15:117db924cf7c 323 return MP_READ_E;
wolfSSL 15:117db924cf7c 324
wolfSSL 15:117db924cf7c 325 if (mp_count_bits(&srp->N) < SRP_MODULUS_MIN_BITS)
wolfSSL 15:117db924cf7c 326 return BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 327
wolfSSL 15:117db924cf7c 328 /* Set g */
wolfSSL 15:117db924cf7c 329 if (mp_read_unsigned_bin(&srp->g, g, gSz) != MP_OKAY)
wolfSSL 15:117db924cf7c 330 return MP_READ_E;
wolfSSL 15:117db924cf7c 331
wolfSSL 15:117db924cf7c 332 if (mp_cmp(&srp->N, &srp->g) != MP_GT)
wolfSSL 15:117db924cf7c 333 return BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 334
wolfSSL 15:117db924cf7c 335 /* Set salt */
wolfSSL 15:117db924cf7c 336 if (srp->salt) {
wolfSSL 15:117db924cf7c 337 ForceZero(srp->salt, srp->saltSz);
wolfSSL 15:117db924cf7c 338 XFREE(srp->salt, srp->heap, DYNAMIC_TYPE_SRP);
wolfSSL 15:117db924cf7c 339 }
wolfSSL 15:117db924cf7c 340
wolfSSL 15:117db924cf7c 341 srp->salt = (byte*)XMALLOC(saltSz, srp->heap, DYNAMIC_TYPE_SRP);
wolfSSL 15:117db924cf7c 342 if (srp->salt == NULL)
wolfSSL 15:117db924cf7c 343 return MEMORY_E;
wolfSSL 15:117db924cf7c 344
wolfSSL 15:117db924cf7c 345 XMEMCPY(srp->salt, salt, saltSz);
wolfSSL 15:117db924cf7c 346 srp->saltSz = saltSz;
wolfSSL 15:117db924cf7c 347
wolfSSL 15:117db924cf7c 348 /* Set k = H(N, g) */
wolfSSL 15:117db924cf7c 349 r = SrpHashInit(&hash, srp->type);
wolfSSL 15:117db924cf7c 350 if (!r) r = SrpHashUpdate(&hash, (byte*) N, nSz);
wolfSSL 15:117db924cf7c 351 for (i = 0; (word32)i < nSz - gSz; i++) {
wolfSSL 15:117db924cf7c 352 if (!r) r = SrpHashUpdate(&hash, &pad, 1);
wolfSSL 15:117db924cf7c 353 }
wolfSSL 15:117db924cf7c 354 if (!r) r = SrpHashUpdate(&hash, (byte*) g, gSz);
wolfSSL 15:117db924cf7c 355 if (!r) r = SrpHashFinal(&hash, srp->k);
wolfSSL 15:117db924cf7c 356
wolfSSL 15:117db924cf7c 357 /* update client proof */
wolfSSL 15:117db924cf7c 358
wolfSSL 15:117db924cf7c 359 /* digest1 = H(N) */
wolfSSL 15:117db924cf7c 360 if (!r) r = SrpHashInit(&hash, srp->type);
wolfSSL 15:117db924cf7c 361 if (!r) r = SrpHashUpdate(&hash, (byte*) N, nSz);
wolfSSL 15:117db924cf7c 362 if (!r) r = SrpHashFinal(&hash, digest1);
wolfSSL 15:117db924cf7c 363
wolfSSL 15:117db924cf7c 364 /* digest2 = H(g) */
wolfSSL 15:117db924cf7c 365 if (!r) r = SrpHashInit(&hash, srp->type);
wolfSSL 15:117db924cf7c 366 if (!r) r = SrpHashUpdate(&hash, (byte*) g, gSz);
wolfSSL 15:117db924cf7c 367 if (!r) r = SrpHashFinal(&hash, digest2);
wolfSSL 15:117db924cf7c 368
wolfSSL 15:117db924cf7c 369 /* digest1 = H(N) ^ H(g) */
wolfSSL 15:117db924cf7c 370 if (r == 0) {
wolfSSL 15:117db924cf7c 371 for (i = 0, j = SrpHashSize(srp->type); i < j; i++)
wolfSSL 15:117db924cf7c 372 digest1[i] ^= digest2[i];
wolfSSL 15:117db924cf7c 373 }
wolfSSL 15:117db924cf7c 374
wolfSSL 15:117db924cf7c 375 /* digest2 = H(user) */
wolfSSL 15:117db924cf7c 376 if (!r) r = SrpHashInit(&hash, srp->type);
wolfSSL 15:117db924cf7c 377 if (!r) r = SrpHashUpdate(&hash, srp->user, srp->userSz);
wolfSSL 15:117db924cf7c 378 if (!r) r = SrpHashFinal(&hash, digest2);
wolfSSL 15:117db924cf7c 379
wolfSSL 15:117db924cf7c 380 /* client proof = H( H(N) ^ H(g) | H(user) | salt) */
wolfSSL 15:117db924cf7c 381 if (!r) r = SrpHashUpdate(&srp->client_proof, digest1, j);
wolfSSL 15:117db924cf7c 382 if (!r) r = SrpHashUpdate(&srp->client_proof, digest2, j);
wolfSSL 15:117db924cf7c 383 if (!r) r = SrpHashUpdate(&srp->client_proof, salt, saltSz);
wolfSSL 15:117db924cf7c 384
wolfSSL 15:117db924cf7c 385 return r;
wolfSSL 15:117db924cf7c 386 }
wolfSSL 15:117db924cf7c 387
wolfSSL 15:117db924cf7c 388 int wc_SrpSetPassword(Srp* srp, const byte* password, word32 size)
wolfSSL 15:117db924cf7c 389 {
wolfSSL 15:117db924cf7c 390 SrpHash hash;
wolfSSL 15:117db924cf7c 391 byte digest[SRP_MAX_DIGEST_SIZE];
wolfSSL 15:117db924cf7c 392 word32 digestSz;
wolfSSL 15:117db924cf7c 393 int r;
wolfSSL 15:117db924cf7c 394
wolfSSL 15:117db924cf7c 395 if (!srp || !password || srp->side != SRP_CLIENT_SIDE)
wolfSSL 15:117db924cf7c 396 return BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 397
wolfSSL 15:117db924cf7c 398 if (!srp->salt)
wolfSSL 15:117db924cf7c 399 return SRP_CALL_ORDER_E;
wolfSSL 15:117db924cf7c 400
wolfSSL 15:117db924cf7c 401 digestSz = SrpHashSize(srp->type);
wolfSSL 15:117db924cf7c 402
wolfSSL 15:117db924cf7c 403 /* digest = H(username | ':' | password) */
wolfSSL 15:117db924cf7c 404 r = SrpHashInit(&hash, srp->type);
wolfSSL 15:117db924cf7c 405 if (!r) r = SrpHashUpdate(&hash, srp->user, srp->userSz);
wolfSSL 15:117db924cf7c 406 if (!r) r = SrpHashUpdate(&hash, (const byte*) ":", 1);
wolfSSL 15:117db924cf7c 407 if (!r) r = SrpHashUpdate(&hash, password, size);
wolfSSL 15:117db924cf7c 408 if (!r) r = SrpHashFinal(&hash, digest);
wolfSSL 15:117db924cf7c 409
wolfSSL 15:117db924cf7c 410 /* digest = H(salt | H(username | ':' | password)) */
wolfSSL 15:117db924cf7c 411 if (!r) r = SrpHashInit(&hash, srp->type);
wolfSSL 15:117db924cf7c 412 if (!r) r = SrpHashUpdate(&hash, srp->salt, srp->saltSz);
wolfSSL 15:117db924cf7c 413 if (!r) r = SrpHashUpdate(&hash, digest, digestSz);
wolfSSL 15:117db924cf7c 414 if (!r) r = SrpHashFinal(&hash, digest);
wolfSSL 15:117db924cf7c 415
wolfSSL 15:117db924cf7c 416 /* Set x (private key) */
wolfSSL 15:117db924cf7c 417 if (!r) r = mp_read_unsigned_bin(&srp->auth, digest, digestSz);
wolfSSL 15:117db924cf7c 418
wolfSSL 15:117db924cf7c 419 ForceZero(digest, SRP_MAX_DIGEST_SIZE);
wolfSSL 15:117db924cf7c 420
wolfSSL 15:117db924cf7c 421 return r;
wolfSSL 15:117db924cf7c 422 }
wolfSSL 15:117db924cf7c 423
wolfSSL 15:117db924cf7c 424 int wc_SrpGetVerifier(Srp* srp, byte* verifier, word32* size)
wolfSSL 15:117db924cf7c 425 {
wolfSSL 15:117db924cf7c 426 mp_int v;
wolfSSL 15:117db924cf7c 427 int r;
wolfSSL 15:117db924cf7c 428
wolfSSL 15:117db924cf7c 429 if (!srp || !verifier || !size || srp->side != SRP_CLIENT_SIDE)
wolfSSL 15:117db924cf7c 430 return BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 431
wolfSSL 15:117db924cf7c 432 if (mp_iszero(&srp->auth) == MP_YES)
wolfSSL 15:117db924cf7c 433 return SRP_CALL_ORDER_E;
wolfSSL 15:117db924cf7c 434
wolfSSL 15:117db924cf7c 435 r = mp_init(&v);
wolfSSL 15:117db924cf7c 436 if (r != MP_OKAY)
wolfSSL 15:117db924cf7c 437 return MP_INIT_E;
wolfSSL 15:117db924cf7c 438
wolfSSL 15:117db924cf7c 439 /* v = g ^ x % N */
wolfSSL 15:117db924cf7c 440 if (!r) r = mp_exptmod(&srp->g, &srp->auth, &srp->N, &v);
wolfSSL 15:117db924cf7c 441 if (!r) r = *size < (word32)mp_unsigned_bin_size(&v) ? BUFFER_E : MP_OKAY;
wolfSSL 15:117db924cf7c 442 if (!r) r = mp_to_unsigned_bin(&v, verifier);
wolfSSL 15:117db924cf7c 443 if (!r) *size = mp_unsigned_bin_size(&v);
wolfSSL 15:117db924cf7c 444
wolfSSL 15:117db924cf7c 445 mp_clear(&v);
wolfSSL 15:117db924cf7c 446
wolfSSL 15:117db924cf7c 447 return r;
wolfSSL 15:117db924cf7c 448 }
wolfSSL 15:117db924cf7c 449
wolfSSL 15:117db924cf7c 450 int wc_SrpSetVerifier(Srp* srp, const byte* verifier, word32 size)
wolfSSL 15:117db924cf7c 451 {
wolfSSL 15:117db924cf7c 452 if (!srp || !verifier || srp->side != SRP_SERVER_SIDE)
wolfSSL 15:117db924cf7c 453 return BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 454
wolfSSL 15:117db924cf7c 455 return mp_read_unsigned_bin(&srp->auth, verifier, size);
wolfSSL 15:117db924cf7c 456 }
wolfSSL 15:117db924cf7c 457
wolfSSL 15:117db924cf7c 458 int wc_SrpSetPrivate(Srp* srp, const byte* priv, word32 size)
wolfSSL 15:117db924cf7c 459 {
wolfSSL 15:117db924cf7c 460 mp_int p;
wolfSSL 15:117db924cf7c 461 int r;
wolfSSL 15:117db924cf7c 462
wolfSSL 15:117db924cf7c 463 if (!srp || !priv || !size)
wolfSSL 15:117db924cf7c 464 return BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 465
wolfSSL 15:117db924cf7c 466 if (mp_iszero(&srp->auth) == MP_YES)
wolfSSL 15:117db924cf7c 467 return SRP_CALL_ORDER_E;
wolfSSL 15:117db924cf7c 468
wolfSSL 15:117db924cf7c 469 r = mp_init(&p);
wolfSSL 15:117db924cf7c 470 if (r != MP_OKAY)
wolfSSL 15:117db924cf7c 471 return MP_INIT_E;
wolfSSL 15:117db924cf7c 472 if (!r) r = mp_read_unsigned_bin(&p, priv, size);
wolfSSL 15:117db924cf7c 473 if (!r) r = mp_mod(&p, &srp->N, &srp->priv);
wolfSSL 15:117db924cf7c 474 if (!r) r = mp_iszero(&srp->priv) == MP_YES ? SRP_BAD_KEY_E : 0;
wolfSSL 15:117db924cf7c 475
wolfSSL 15:117db924cf7c 476 mp_clear(&p);
wolfSSL 15:117db924cf7c 477
wolfSSL 15:117db924cf7c 478 return r;
wolfSSL 15:117db924cf7c 479 }
wolfSSL 15:117db924cf7c 480
wolfSSL 15:117db924cf7c 481 /** Generates random data using wolfcrypt RNG. */
wolfSSL 15:117db924cf7c 482 static int wc_SrpGenPrivate(Srp* srp, byte* priv, word32 size)
wolfSSL 15:117db924cf7c 483 {
wolfSSL 15:117db924cf7c 484 WC_RNG rng;
wolfSSL 15:117db924cf7c 485 int r = wc_InitRng(&rng);
wolfSSL 15:117db924cf7c 486
wolfSSL 15:117db924cf7c 487 if (!r) r = wc_RNG_GenerateBlock(&rng, priv, size);
wolfSSL 15:117db924cf7c 488 if (!r) r = wc_SrpSetPrivate(srp, priv, size);
wolfSSL 15:117db924cf7c 489 if (!r) wc_FreeRng(&rng);
wolfSSL 15:117db924cf7c 490
wolfSSL 15:117db924cf7c 491 return r;
wolfSSL 15:117db924cf7c 492 }
wolfSSL 15:117db924cf7c 493
wolfSSL 15:117db924cf7c 494 int wc_SrpGetPublic(Srp* srp, byte* pub, word32* size)
wolfSSL 15:117db924cf7c 495 {
wolfSSL 15:117db924cf7c 496 mp_int pubkey;
wolfSSL 15:117db924cf7c 497 word32 modulusSz;
wolfSSL 15:117db924cf7c 498 int r;
wolfSSL 15:117db924cf7c 499
wolfSSL 15:117db924cf7c 500 if (!srp || !pub || !size)
wolfSSL 15:117db924cf7c 501 return BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 502
wolfSSL 15:117db924cf7c 503 if (mp_iszero(&srp->auth) == MP_YES)
wolfSSL 15:117db924cf7c 504 return SRP_CALL_ORDER_E;
wolfSSL 15:117db924cf7c 505
wolfSSL 15:117db924cf7c 506 modulusSz = mp_unsigned_bin_size(&srp->N);
wolfSSL 15:117db924cf7c 507 if (*size < modulusSz)
wolfSSL 15:117db924cf7c 508 return BUFFER_E;
wolfSSL 15:117db924cf7c 509
wolfSSL 15:117db924cf7c 510 r = mp_init(&pubkey);
wolfSSL 15:117db924cf7c 511 if (r != MP_OKAY)
wolfSSL 15:117db924cf7c 512 return MP_INIT_E;
wolfSSL 15:117db924cf7c 513
wolfSSL 15:117db924cf7c 514 /* priv = random() */
wolfSSL 15:117db924cf7c 515 if (mp_iszero(&srp->priv) == MP_YES)
wolfSSL 15:117db924cf7c 516 r = wc_SrpGenPrivate(srp, pub, SRP_PRIVATE_KEY_MIN_BITS / 8);
wolfSSL 15:117db924cf7c 517
wolfSSL 15:117db924cf7c 518 /* client side: A = g ^ a % N */
wolfSSL 15:117db924cf7c 519 if (srp->side == SRP_CLIENT_SIDE) {
wolfSSL 15:117db924cf7c 520 if (!r) r = mp_exptmod(&srp->g, &srp->priv, &srp->N, &pubkey);
wolfSSL 15:117db924cf7c 521
wolfSSL 15:117db924cf7c 522 /* server side: B = (k * v + (g ^ b % N)) % N */
wolfSSL 15:117db924cf7c 523 } else {
wolfSSL 15:117db924cf7c 524 mp_int i, j;
wolfSSL 15:117db924cf7c 525
wolfSSL 15:117db924cf7c 526 if (mp_init_multi(&i, &j, 0, 0, 0, 0) == MP_OKAY) {
wolfSSL 15:117db924cf7c 527 if (!r) r = mp_read_unsigned_bin(&i, srp->k,SrpHashSize(srp->type));
wolfSSL 15:117db924cf7c 528 if (!r) r = mp_iszero(&i) == MP_YES ? SRP_BAD_KEY_E : 0;
wolfSSL 15:117db924cf7c 529 if (!r) r = mp_exptmod(&srp->g, &srp->priv, &srp->N, &pubkey);
wolfSSL 15:117db924cf7c 530 if (!r) r = mp_mulmod(&i, &srp->auth, &srp->N, &j);
wolfSSL 15:117db924cf7c 531 if (!r) r = mp_add(&j, &pubkey, &i);
wolfSSL 15:117db924cf7c 532 if (!r) r = mp_mod(&i, &srp->N, &pubkey);
wolfSSL 15:117db924cf7c 533
wolfSSL 15:117db924cf7c 534 mp_clear(&i); mp_clear(&j);
wolfSSL 15:117db924cf7c 535 }
wolfSSL 15:117db924cf7c 536 }
wolfSSL 15:117db924cf7c 537
wolfSSL 15:117db924cf7c 538 /* extract public key to buffer */
wolfSSL 15:117db924cf7c 539 XMEMSET(pub, 0, modulusSz);
wolfSSL 15:117db924cf7c 540 if (!r) r = mp_to_unsigned_bin(&pubkey, pub);
wolfSSL 15:117db924cf7c 541 if (!r) *size = mp_unsigned_bin_size(&pubkey);
wolfSSL 15:117db924cf7c 542 mp_clear(&pubkey);
wolfSSL 15:117db924cf7c 543
wolfSSL 15:117db924cf7c 544 return r;
wolfSSL 15:117db924cf7c 545 }
wolfSSL 15:117db924cf7c 546
wolfSSL 15:117db924cf7c 547 static int wc_SrpSetKey(Srp* srp, byte* secret, word32 size)
wolfSSL 15:117db924cf7c 548 {
wolfSSL 15:117db924cf7c 549 SrpHash hash;
wolfSSL 15:117db924cf7c 550 byte digest[SRP_MAX_DIGEST_SIZE];
wolfSSL 15:117db924cf7c 551 word32 i, j, digestSz = SrpHashSize(srp->type);
wolfSSL 15:117db924cf7c 552 byte counter[4];
wolfSSL 15:117db924cf7c 553 int r = BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 554
wolfSSL 15:117db924cf7c 555 XMEMSET(digest, 0, SRP_MAX_DIGEST_SIZE);
wolfSSL 15:117db924cf7c 556
wolfSSL 15:117db924cf7c 557 srp->key = (byte*)XMALLOC(2 * digestSz, srp->heap, DYNAMIC_TYPE_SRP);
wolfSSL 15:117db924cf7c 558 if (srp->key == NULL)
wolfSSL 15:117db924cf7c 559 return MEMORY_E;
wolfSSL 15:117db924cf7c 560
wolfSSL 15:117db924cf7c 561 srp->keySz = 2 * digestSz;
wolfSSL 15:117db924cf7c 562
wolfSSL 15:117db924cf7c 563 for (i = j = 0; j < srp->keySz; i++) {
wolfSSL 15:117db924cf7c 564 counter[0] = (i >> 24) & 0xFF;
wolfSSL 15:117db924cf7c 565 counter[1] = (i >> 16) & 0xFF;
wolfSSL 15:117db924cf7c 566 counter[2] = (i >> 8) & 0xFF;
wolfSSL 15:117db924cf7c 567 counter[3] = i & 0xFF;
wolfSSL 15:117db924cf7c 568
wolfSSL 15:117db924cf7c 569 r = SrpHashInit(&hash, srp->type);
wolfSSL 15:117db924cf7c 570 if (!r) r = SrpHashUpdate(&hash, secret, size);
wolfSSL 15:117db924cf7c 571 if (!r) r = SrpHashUpdate(&hash, counter, 4);
wolfSSL 15:117db924cf7c 572
wolfSSL 15:117db924cf7c 573 if (j + digestSz > srp->keySz) {
wolfSSL 15:117db924cf7c 574 if (!r) r = SrpHashFinal(&hash, digest);
wolfSSL 15:117db924cf7c 575 XMEMCPY(srp->key + j, digest, srp->keySz - j);
wolfSSL 15:117db924cf7c 576 j = srp->keySz;
wolfSSL 15:117db924cf7c 577 }
wolfSSL 15:117db924cf7c 578 else {
wolfSSL 15:117db924cf7c 579 if (!r) r = SrpHashFinal(&hash, srp->key + j);
wolfSSL 15:117db924cf7c 580 j += digestSz;
wolfSSL 15:117db924cf7c 581 }
wolfSSL 15:117db924cf7c 582 }
wolfSSL 15:117db924cf7c 583
wolfSSL 15:117db924cf7c 584 ForceZero(digest, sizeof(digest));
wolfSSL 15:117db924cf7c 585 ForceZero(&hash, sizeof(SrpHash));
wolfSSL 15:117db924cf7c 586
wolfSSL 15:117db924cf7c 587 return r;
wolfSSL 15:117db924cf7c 588 }
wolfSSL 15:117db924cf7c 589
wolfSSL 15:117db924cf7c 590 int wc_SrpComputeKey(Srp* srp, byte* clientPubKey, word32 clientPubKeySz,
wolfSSL 15:117db924cf7c 591 byte* serverPubKey, word32 serverPubKeySz)
wolfSSL 15:117db924cf7c 592 {
wolfSSL 15:117db924cf7c 593 SrpHash hash;
wolfSSL 15:117db924cf7c 594 byte *secret;
wolfSSL 15:117db924cf7c 595 byte digest[SRP_MAX_DIGEST_SIZE];
wolfSSL 15:117db924cf7c 596 word32 i, secretSz, digestSz;
wolfSSL 15:117db924cf7c 597 mp_int u, s, temp1, temp2;
wolfSSL 15:117db924cf7c 598 byte pad = 0;
wolfSSL 15:117db924cf7c 599 int r;
wolfSSL 15:117db924cf7c 600
wolfSSL 15:117db924cf7c 601 /* validating params */
wolfSSL 15:117db924cf7c 602
wolfSSL 15:117db924cf7c 603 if (!srp || !clientPubKey || clientPubKeySz == 0
wolfSSL 15:117db924cf7c 604 || !serverPubKey || serverPubKeySz == 0)
wolfSSL 15:117db924cf7c 605 return BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 606
wolfSSL 15:117db924cf7c 607 if (mp_iszero(&srp->priv) == MP_YES)
wolfSSL 15:117db924cf7c 608 return SRP_CALL_ORDER_E;
wolfSSL 15:117db924cf7c 609
wolfSSL 15:117db924cf7c 610 /* initializing variables */
wolfSSL 15:117db924cf7c 611
wolfSSL 15:117db924cf7c 612 if ((r = SrpHashInit(&hash, srp->type)) != 0)
wolfSSL 15:117db924cf7c 613 return r;
wolfSSL 15:117db924cf7c 614
wolfSSL 15:117db924cf7c 615 digestSz = SrpHashSize(srp->type);
wolfSSL 15:117db924cf7c 616 secretSz = mp_unsigned_bin_size(&srp->N);
wolfSSL 15:117db924cf7c 617
wolfSSL 15:117db924cf7c 618 if ((secret = (byte*)XMALLOC(secretSz, srp->heap, DYNAMIC_TYPE_SRP)) ==NULL)
wolfSSL 15:117db924cf7c 619 return MEMORY_E;
wolfSSL 15:117db924cf7c 620
wolfSSL 15:117db924cf7c 621 if ((r = mp_init_multi(&u, &s, &temp1, &temp2, 0, 0)) != MP_OKAY) {
wolfSSL 15:117db924cf7c 622 XFREE(secret, srp->heap, DYNAMIC_TYPE_SRP);
wolfSSL 15:117db924cf7c 623 return r;
wolfSSL 15:117db924cf7c 624 }
wolfSSL 15:117db924cf7c 625
wolfSSL 15:117db924cf7c 626 /* building u (random scrambling parameter) */
wolfSSL 15:117db924cf7c 627
wolfSSL 15:117db924cf7c 628 /* H(A) */
wolfSSL 15:117db924cf7c 629 for (i = 0; !r && i < secretSz - clientPubKeySz; i++)
wolfSSL 15:117db924cf7c 630 r = SrpHashUpdate(&hash, &pad, 1);
wolfSSL 15:117db924cf7c 631 if (!r) r = SrpHashUpdate(&hash, clientPubKey, clientPubKeySz);
wolfSSL 15:117db924cf7c 632
wolfSSL 15:117db924cf7c 633 /* H(A | B) */
wolfSSL 15:117db924cf7c 634 for (i = 0; !r && i < secretSz - serverPubKeySz; i++)
wolfSSL 15:117db924cf7c 635 r = SrpHashUpdate(&hash, &pad, 1);
wolfSSL 15:117db924cf7c 636 if (!r) r = SrpHashUpdate(&hash, serverPubKey, serverPubKeySz);
wolfSSL 15:117db924cf7c 637
wolfSSL 15:117db924cf7c 638 /* set u */
wolfSSL 15:117db924cf7c 639 if (!r) r = SrpHashFinal(&hash, digest);
wolfSSL 15:117db924cf7c 640 if (!r) r = mp_read_unsigned_bin(&u, digest, SrpHashSize(srp->type));
wolfSSL 15:117db924cf7c 641
wolfSSL 15:117db924cf7c 642 /* building s (secret) */
wolfSSL 15:117db924cf7c 643
wolfSSL 15:117db924cf7c 644 if (!r && srp->side == SRP_CLIENT_SIDE) {
wolfSSL 15:117db924cf7c 645
wolfSSL 15:117db924cf7c 646 /* temp1 = B - k * v; rejects k == 0, B == 0 and B >= N. */
wolfSSL 15:117db924cf7c 647 r = mp_read_unsigned_bin(&temp1, srp->k, digestSz);
wolfSSL 15:117db924cf7c 648 if (!r) r = mp_iszero(&temp1) == MP_YES ? SRP_BAD_KEY_E : 0;
wolfSSL 15:117db924cf7c 649 if (!r) r = mp_exptmod(&srp->g, &srp->auth, &srp->N, &temp2);
wolfSSL 15:117db924cf7c 650 if (!r) r = mp_mulmod(&temp1, &temp2, &srp->N, &s);
wolfSSL 15:117db924cf7c 651 if (!r) r = mp_read_unsigned_bin(&temp2, serverPubKey, serverPubKeySz);
wolfSSL 15:117db924cf7c 652 if (!r) r = mp_iszero(&temp2) == MP_YES ? SRP_BAD_KEY_E : 0;
wolfSSL 15:117db924cf7c 653 if (!r) r = mp_cmp(&temp2, &srp->N) != MP_LT ? SRP_BAD_KEY_E : 0;
wolfSSL 15:117db924cf7c 654 if (!r) r = mp_sub(&temp2, &s, &temp1);
wolfSSL 15:117db924cf7c 655
wolfSSL 15:117db924cf7c 656 /* temp2 = a + u * x */
wolfSSL 15:117db924cf7c 657 if (!r) r = mp_mulmod(&u, &srp->auth, &srp->N, &s);
wolfSSL 15:117db924cf7c 658 if (!r) r = mp_add(&srp->priv, &s, &temp2);
wolfSSL 15:117db924cf7c 659
wolfSSL 15:117db924cf7c 660 /* secret = temp1 ^ temp2 % N */
wolfSSL 15:117db924cf7c 661 if (!r) r = mp_exptmod(&temp1, &temp2, &srp->N, &s);
wolfSSL 15:117db924cf7c 662
wolfSSL 15:117db924cf7c 663 } else if (!r && srp->side == SRP_SERVER_SIDE) {
wolfSSL 15:117db924cf7c 664 /* temp1 = v ^ u % N */
wolfSSL 15:117db924cf7c 665 r = mp_exptmod(&srp->auth, &u, &srp->N, &temp1);
wolfSSL 15:117db924cf7c 666
wolfSSL 15:117db924cf7c 667 /* temp2 = A * temp1 % N; rejects A == 0, A >= N */
wolfSSL 15:117db924cf7c 668 if (!r) r = mp_read_unsigned_bin(&s, clientPubKey, clientPubKeySz);
wolfSSL 15:117db924cf7c 669 if (!r) r = mp_iszero(&s) == MP_YES ? SRP_BAD_KEY_E : 0;
wolfSSL 15:117db924cf7c 670 if (!r) r = mp_cmp(&s, &srp->N) != MP_LT ? SRP_BAD_KEY_E : 0;
wolfSSL 15:117db924cf7c 671 if (!r) r = mp_mulmod(&s, &temp1, &srp->N, &temp2);
wolfSSL 15:117db924cf7c 672
wolfSSL 15:117db924cf7c 673 /* rejects A * v ^ u % N >= 1, A * v ^ u % N == -1 % N */
wolfSSL 15:117db924cf7c 674 if (!r) r = mp_read_unsigned_bin(&temp1, (const byte*)"\001", 1);
wolfSSL 15:117db924cf7c 675 if (!r) r = mp_cmp(&temp2, &temp1) != MP_GT ? SRP_BAD_KEY_E : 0;
wolfSSL 15:117db924cf7c 676 if (!r) r = mp_sub(&srp->N, &temp1, &s);
wolfSSL 15:117db924cf7c 677 if (!r) r = mp_cmp(&temp2, &s) == MP_EQ ? SRP_BAD_KEY_E : 0;
wolfSSL 15:117db924cf7c 678
wolfSSL 15:117db924cf7c 679 /* secret = temp2 * b % N */
wolfSSL 15:117db924cf7c 680 if (!r) r = mp_exptmod(&temp2, &srp->priv, &srp->N, &s);
wolfSSL 15:117db924cf7c 681 }
wolfSSL 15:117db924cf7c 682
wolfSSL 15:117db924cf7c 683 /* building session key from secret */
wolfSSL 15:117db924cf7c 684
wolfSSL 15:117db924cf7c 685 if (!r) r = mp_to_unsigned_bin(&s, secret);
wolfSSL 15:117db924cf7c 686 if (!r) r = srp->keyGenFunc_cb(srp, secret, mp_unsigned_bin_size(&s));
wolfSSL 15:117db924cf7c 687
wolfSSL 15:117db924cf7c 688 /* updating client proof = H( H(N) ^ H(g) | H(user) | salt | A | B | K) */
wolfSSL 15:117db924cf7c 689
wolfSSL 15:117db924cf7c 690 if (!r) r = SrpHashUpdate(&srp->client_proof, clientPubKey, clientPubKeySz);
wolfSSL 15:117db924cf7c 691 if (!r) r = SrpHashUpdate(&srp->client_proof, serverPubKey, serverPubKeySz);
wolfSSL 15:117db924cf7c 692 if (!r) r = SrpHashUpdate(&srp->client_proof, srp->key, srp->keySz);
wolfSSL 15:117db924cf7c 693
wolfSSL 15:117db924cf7c 694 /* updating server proof = H(A) */
wolfSSL 15:117db924cf7c 695
wolfSSL 15:117db924cf7c 696 if (!r) r = SrpHashUpdate(&srp->server_proof, clientPubKey, clientPubKeySz);
wolfSSL 15:117db924cf7c 697
wolfSSL 15:117db924cf7c 698 XFREE(secret, srp->heap, DYNAMIC_TYPE_SRP);
wolfSSL 15:117db924cf7c 699 mp_clear(&u); mp_clear(&s); mp_clear(&temp1); mp_clear(&temp2);
wolfSSL 15:117db924cf7c 700
wolfSSL 15:117db924cf7c 701 return r;
wolfSSL 15:117db924cf7c 702 }
wolfSSL 15:117db924cf7c 703
wolfSSL 15:117db924cf7c 704 int wc_SrpGetProof(Srp* srp, byte* proof, word32* size)
wolfSSL 15:117db924cf7c 705 {
wolfSSL 15:117db924cf7c 706 int r;
wolfSSL 15:117db924cf7c 707
wolfSSL 15:117db924cf7c 708 if (!srp || !proof || !size)
wolfSSL 15:117db924cf7c 709 return BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 710
wolfSSL 15:117db924cf7c 711 if (*size < SrpHashSize(srp->type))
wolfSSL 15:117db924cf7c 712 return BUFFER_E;
wolfSSL 15:117db924cf7c 713
wolfSSL 15:117db924cf7c 714 if ((r = SrpHashFinal(srp->side == SRP_CLIENT_SIDE
wolfSSL 15:117db924cf7c 715 ? &srp->client_proof
wolfSSL 15:117db924cf7c 716 : &srp->server_proof, proof)) != 0)
wolfSSL 15:117db924cf7c 717 return r;
wolfSSL 15:117db924cf7c 718
wolfSSL 15:117db924cf7c 719 *size = SrpHashSize(srp->type);
wolfSSL 15:117db924cf7c 720
wolfSSL 15:117db924cf7c 721 if (srp->side == SRP_CLIENT_SIDE) {
wolfSSL 15:117db924cf7c 722 /* server proof = H( A | client proof | K) */
wolfSSL 15:117db924cf7c 723 if (!r) r = SrpHashUpdate(&srp->server_proof, proof, *size);
wolfSSL 15:117db924cf7c 724 if (!r) r = SrpHashUpdate(&srp->server_proof, srp->key, srp->keySz);
wolfSSL 15:117db924cf7c 725 }
wolfSSL 15:117db924cf7c 726
wolfSSL 15:117db924cf7c 727 return r;
wolfSSL 15:117db924cf7c 728 }
wolfSSL 15:117db924cf7c 729
wolfSSL 15:117db924cf7c 730 int wc_SrpVerifyPeersProof(Srp* srp, byte* proof, word32 size)
wolfSSL 15:117db924cf7c 731 {
wolfSSL 15:117db924cf7c 732 byte digest[SRP_MAX_DIGEST_SIZE];
wolfSSL 15:117db924cf7c 733 int r;
wolfSSL 15:117db924cf7c 734
wolfSSL 15:117db924cf7c 735 if (!srp || !proof)
wolfSSL 15:117db924cf7c 736 return BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 737
wolfSSL 15:117db924cf7c 738 if (size != SrpHashSize(srp->type))
wolfSSL 15:117db924cf7c 739 return BUFFER_E;
wolfSSL 15:117db924cf7c 740
wolfSSL 15:117db924cf7c 741 r = SrpHashFinal(srp->side == SRP_CLIENT_SIDE ? &srp->server_proof
wolfSSL 15:117db924cf7c 742 : &srp->client_proof, digest);
wolfSSL 15:117db924cf7c 743
wolfSSL 15:117db924cf7c 744 if (srp->side == SRP_SERVER_SIDE) {
wolfSSL 15:117db924cf7c 745 /* server proof = H( A | client proof | K) */
wolfSSL 15:117db924cf7c 746 if (!r) r = SrpHashUpdate(&srp->server_proof, proof, size);
wolfSSL 15:117db924cf7c 747 if (!r) r = SrpHashUpdate(&srp->server_proof, srp->key, srp->keySz);
wolfSSL 15:117db924cf7c 748 }
wolfSSL 15:117db924cf7c 749
wolfSSL 15:117db924cf7c 750 if (!r && XMEMCMP(proof, digest, size) != 0)
wolfSSL 15:117db924cf7c 751 r = SRP_VERIFY_E;
wolfSSL 15:117db924cf7c 752
wolfSSL 15:117db924cf7c 753 return r;
wolfSSL 15:117db924cf7c 754 }
wolfSSL 15:117db924cf7c 755
wolfSSL 15:117db924cf7c 756 #endif /* WOLFCRYPT_HAVE_SRP */
wolfSSL 15:117db924cf7c 757