ssl/ssl_key_share.cc - boringssl - Git at Google

 /* Copyright (c) 2015, Google Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */

 #include <openssl/ssl.h>

 #include <assert.h>
 #include <string.h>

 #include <utility>

 #include <openssl/bn.h>
 #include <openssl/bytestring.h>
 #include <openssl/curve25519.h>
 #include <openssl/ec.h>
 #include <openssl/err.h>
 #include <openssl/mem.h>
 #include <openssl/nid.h>

 #include "internal.h"
 #include "../crypto/internal.h"


 BSSL_NAMESPACE_BEGIN

 namespace {

 class ECKeyShare : public SSLKeyShare {
  public:
   ECKeyShare(int nid, uint16_t group_id) : nid_(nid), group_id_(group_id) {}
   ~ECKeyShare() override {}

   uint16_t GroupID() const override { return group_id_; }

   bool Offer(CBB *out) override {
     assert(!private_key_);
     // Set up a shared |BN_CTX| for all operations.
     UniquePtr<BN_CTX> bn_ctx(BN_CTX_new());
     if (!bn_ctx) {
       return false;
     }
     BN_CTXScope scope(bn_ctx.get());

     // Generate a private key.
     UniquePtr<EC_GROUP> group(EC_GROUP_new_by_curve_name(nid_));
     private_key_.reset(BN_new());
     if (!group || !private_key_ ||
         !BN_rand_range_ex(private_key_.get(), 1,
                           EC_GROUP_get0_order(group.get()))) {
       return false;
     }

     // Compute the corresponding public key and serialize it.
     UniquePtr<EC_POINT> public_key(EC_POINT_new(group.get()));
     if (!public_key ||
         !EC_POINT_mul(group.get(), public_key.get(), private_key_.get(), NULL,
                       NULL, bn_ctx.get()) ||
         !EC_POINT_point2cbb(out, group.get(), public_key.get(),
                             POINT_CONVERSION_UNCOMPRESSED, bn_ctx.get())) {
       return false;
     }

     return true;
   }

   bool Finish(Array<uint8_t> *out_secret, uint8_t *out_alert,
               Span<const uint8_t> peer_key) override {
     assert(private_key_);
     *out_alert = SSL_AD_INTERNAL_ERROR;

     // Set up a shared |BN_CTX| for all operations.
     UniquePtr<BN_CTX> bn_ctx(BN_CTX_new());
     if (!bn_ctx) {
       return false;
     }
     BN_CTXScope scope(bn_ctx.get());

     UniquePtr<EC_GROUP> group(EC_GROUP_new_by_curve_name(nid_));
     if (!group) {
       return false;
     }

     UniquePtr<EC_POINT> peer_point(EC_POINT_new(group.get()));
     UniquePtr<EC_POINT> result(EC_POINT_new(group.get()));
     BIGNUM *x = BN_CTX_get(bn_ctx.get());
     if (!peer_point || !result || !x) {
       return false;
     }

     if (peer_key.empty() || peer_key[0] != POINT_CONVERSION_UNCOMPRESSED ||
         !EC_POINT_oct2point(group.get(), peer_point.get(), peer_key.data(),
                             peer_key.size(), bn_ctx.get())) {
       OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_ECPOINT);
       *out_alert = SSL_AD_DECODE_ERROR;
       return false;
     }

     // Compute the x-coordinate of |peer_key| * |private_key_|.
     if (!EC_POINT_mul(group.get(), result.get(), NULL, peer_point.get(),
                       private_key_.get(), bn_ctx.get()) ||
         !EC_POINT_get_affine_coordinates_GFp(group.get(), result.get(), x, NULL,
                                              bn_ctx.get())) {
       return false;
     }

     // Encode the x-coordinate left-padded with zeros.
     Array<uint8_t> secret;
     if (!secret.Init((EC_GROUP_get_degree(group.get()) + 7) / 8) ||
         !BN_bn2bin_padded(secret.data(), secret.size(), x)) {
       return false;
     }

     *out_secret = std::move(secret);
     return true;
   }

   bool Serialize(CBB *out) override {
     assert(private_key_);
     CBB cbb;
     UniquePtr<EC_GROUP> group(EC_GROUP_new_by_curve_name(nid_));
     // Padding is added to avoid leaking the length.
     size_t len = BN_num_bytes(EC_GROUP_get0_order(group.get()));
     if (!CBB_add_asn1_uint64(out, group_id_) ||
         !CBB_add_asn1(out, &cbb, CBS_ASN1_OCTETSTRING) ||
         !BN_bn2cbb_padded(&cbb, len, private_key_.get()) ||
         !CBB_flush(out)) {
       return false;
     }
     return true;
   }

   bool Deserialize(CBS *in) override {
     assert(!private_key_);
     CBS private_key;
     if (!CBS_get_asn1(in, &private_key, CBS_ASN1_OCTETSTRING)) {
       return false;
     }
     private_key_.reset(BN_bin2bn(CBS_data(&private_key),
                                  CBS_len(&private_key), nullptr));
     return private_key_ != nullptr;
   }

  private:
   UniquePtr<BIGNUM> private_key_;
   int nid_;
   uint16_t group_id_;
 };

 class X25519KeyShare : public SSLKeyShare {
  public:
   X25519KeyShare() {}
   ~X25519KeyShare() override {
     OPENSSL_cleanse(private_key_, sizeof(private_key_));
   }

   uint16_t GroupID() const override { return SSL_CURVE_X25519; }

   bool Offer(CBB *out) override {
     uint8_t public_key[32];
     X25519_keypair(public_key, private_key_);
     return !!CBB_add_bytes(out, public_key, sizeof(public_key));
   }

   bool Finish(Array<uint8_t> *out_secret, uint8_t *out_alert,
               Span<const uint8_t> peer_key) override {
     *out_alert = SSL_AD_INTERNAL_ERROR;

     Array<uint8_t> secret;
     if (!secret.Init(32)) {
       OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
       return false;
     }

     if (peer_key.size() != 32 ||
         !X25519(secret.data(), private_key_, peer_key.data())) {
       *out_alert = SSL_AD_DECODE_ERROR;
       OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_ECPOINT);
       return false;
     }

     *out_secret = std::move(secret);
     return true;
   }

   bool Serialize(CBB *out) override {
     return (CBB_add_asn1_uint64(out, GroupID()) &&
             CBB_add_asn1_octet_string(out, private_key_, sizeof(private_key_)));
   }

   bool Deserialize(CBS *in) override {
     CBS key;
     if (!CBS_get_asn1(in, &key, CBS_ASN1_OCTETSTRING) ||
         CBS_len(&key) != sizeof(private_key_) ||
         !CBS_copy_bytes(&key, private_key_, sizeof(private_key_))) {
       return false;
     }
     return true;
   }

  private:
   uint8_t private_key_[32];
 };

 CONSTEXPR_ARRAY struct {
   int nid;
   uint16_t group_id;
   const char name[8], alias[11];
 } kNamedGroups[] = {
     {NID_secp224r1, SSL_CURVE_SECP224R1, "P-224", "secp224r1"},
     {NID_X9_62_prime256v1, SSL_CURVE_SECP256R1, "P-256", "prime256v1"},
     {NID_secp384r1, SSL_CURVE_SECP384R1, "P-384", "secp384r1"},
     {NID_secp521r1, SSL_CURVE_SECP521R1, "P-521", "secp521r1"},
     {NID_X25519, SSL_CURVE_X25519, "X25519", "x25519"},
 };

 }  // namespace

 UniquePtr<SSLKeyShare> SSLKeyShare::Create(uint16_t group_id) {
   switch (group_id) {
     case SSL_CURVE_SECP224R1:
       return UniquePtr<SSLKeyShare>(
           New<ECKeyShare>(NID_secp224r1, SSL_CURVE_SECP224R1));
     case SSL_CURVE_SECP256R1:
       return UniquePtr<SSLKeyShare>(
           New<ECKeyShare>(NID_X9_62_prime256v1, SSL_CURVE_SECP256R1));
     case SSL_CURVE_SECP384R1:
       return UniquePtr<SSLKeyShare>(
           New<ECKeyShare>(NID_secp384r1, SSL_CURVE_SECP384R1));
     case SSL_CURVE_SECP521R1:
       return UniquePtr<SSLKeyShare>(
           New<ECKeyShare>(NID_secp521r1, SSL_CURVE_SECP521R1));
     case SSL_CURVE_X25519:
       return UniquePtr<SSLKeyShare>(New<X25519KeyShare>());
     default:
       return nullptr;
   }
 }

 UniquePtr<SSLKeyShare> SSLKeyShare::Create(CBS *in) {
   uint64_t group;
   if (!CBS_get_asn1_uint64(in, &group) || group > 0xffff) {
     return nullptr;
   }
   UniquePtr<SSLKeyShare> key_share = Create(static_cast<uint16_t>(group));
   if (!key_share || !key_share->Deserialize(in)) {
     return nullptr;
   }
   return key_share;
 }


 bool SSLKeyShare::Accept(CBB *out_public_key, Array<uint8_t> *out_secret,
                          uint8_t *out_alert, Span<const uint8_t> peer_key) {
   *out_alert = SSL_AD_INTERNAL_ERROR;
   return Offer(out_public_key) &&
          Finish(out_secret, out_alert, peer_key);
 }

 bool ssl_nid_to_group_id(uint16_t *out_group_id, int nid) {
   for (const auto &group : kNamedGroups) {
     if (group.nid == nid) {
       *out_group_id = group.group_id;
       return true;
     }
   }
   return false;
 }

 bool ssl_name_to_group_id(uint16_t *out_group_id, const char *name, size_t len) {
   for (const auto &group : kNamedGroups) {
     if (len == strlen(group.name) &&
         !strncmp(group.name, name, len)) {
       *out_group_id = group.group_id;
       return true;
     }
     if (len == strlen(group.alias) &&
         !strncmp(group.alias, name, len)) {
       *out_group_id = group.group_id;
       return true;
     }
   }
   return false;
 }

 BSSL_NAMESPACE_END

 using namespace bssl;

 const char* SSL_get_curve_name(uint16_t group_id) {
   for (const auto &group : kNamedGroups) {
     if (group.group_id == group_id) {
       return group.name;
     }
   }
   return nullptr;
 }
	/* Copyright (c) 2015, Google Inc.
	*
	* Permission to use, copy, modify, and/or distribute this software for any
	* purpose with or without fee is hereby granted, provided that the above
	* copyright notice and this permission notice appear in all copies.
	*
	* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
	* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
	* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
	* SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
	* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
	* OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
	* CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */

	#include <openssl/ssl.h>

	#include <assert.h>
	#include <string.h>

	#include <utility>

	#include <openssl/bn.h>
	#include <openssl/bytestring.h>
	#include <openssl/curve25519.h>
	#include <openssl/ec.h>
	#include <openssl/err.h>
	#include <openssl/mem.h>
	#include <openssl/nid.h>

	#include "internal.h"
	#include "../crypto/internal.h"


	BSSL_NAMESPACE_BEGIN

	namespace {

	class ECKeyShare : public SSLKeyShare {
	public:
	ECKeyShare(int nid, uint16_t group_id) : nid_(nid), group_id_(group_id) {}
	~ECKeyShare() override {}

	uint16_t GroupID() const override { return group_id_; }

	bool Offer(CBB *out) override {
	assert(!private_key_);
	// Set up a shared \|BN_CTX\| for all operations.
	UniquePtr<BN_CTX> bn_ctx(BN_CTX_new());
	if (!bn_ctx) {
	return false;
	}
	BN_CTXScope scope(bn_ctx.get());

	// Generate a private key.
	UniquePtr<EC_GROUP> group(EC_GROUP_new_by_curve_name(nid_));
	private_key_.reset(BN_new());
	if (!group \|\| !private_key_ \|\|
	!BN_rand_range_ex(private_key_.get(), 1,
	EC_GROUP_get0_order(group.get()))) {
	return false;
	}

	// Compute the corresponding public key and serialize it.
	UniquePtr<EC_POINT> public_key(EC_POINT_new(group.get()));
	if (!public_key \|\|
	!EC_POINT_mul(group.get(), public_key.get(), private_key_.get(), NULL,
	NULL, bn_ctx.get()) \|\|
	!EC_POINT_point2cbb(out, group.get(), public_key.get(),
	POINT_CONVERSION_UNCOMPRESSED, bn_ctx.get())) {
	return false;
	}

	return true;
	}

	bool Finish(Array<uint8_t> out_secret, uint8_t out_alert,
	Span<const uint8_t> peer_key) override {
	assert(private_key_);
	*out_alert = SSL_AD_INTERNAL_ERROR;

	// Set up a shared \|BN_CTX\| for all operations.
	UniquePtr<BN_CTX> bn_ctx(BN_CTX_new());
	if (!bn_ctx) {
	return false;
	}
	BN_CTXScope scope(bn_ctx.get());

	UniquePtr<EC_GROUP> group(EC_GROUP_new_by_curve_name(nid_));
	if (!group) {
	return false;
	}

	UniquePtr<EC_POINT> peer_point(EC_POINT_new(group.get()));
	UniquePtr<EC_POINT> result(EC_POINT_new(group.get()));
	BIGNUM *x = BN_CTX_get(bn_ctx.get());
	if (!peer_point \|\| !result \|\| !x) {
	return false;
	}

	if (peer_key.empty() \|\| peer_key[0] != POINT_CONVERSION_UNCOMPRESSED \|\|
	!EC_POINT_oct2point(group.get(), peer_point.get(), peer_key.data(),
	peer_key.size(), bn_ctx.get())) {
	OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_ECPOINT);
	*out_alert = SSL_AD_DECODE_ERROR;
	return false;
	}

	// Compute the x-coordinate of \|peer_key\| * \|private_key_\|.
	if (!EC_POINT_mul(group.get(), result.get(), NULL, peer_point.get(),
	private_key_.get(), bn_ctx.get()) \|\|
	!EC_POINT_get_affine_coordinates_GFp(group.get(), result.get(), x, NULL,
	bn_ctx.get())) {
	return false;
	}

	// Encode the x-coordinate left-padded with zeros.
	Array<uint8_t> secret;
	if (!secret.Init((EC_GROUP_get_degree(group.get()) + 7) / 8) \|\|
	!BN_bn2bin_padded(secret.data(), secret.size(), x)) {
	return false;
	}

	*out_secret = std::move(secret);
	return true;
	}

	bool Serialize(CBB *out) override {
	assert(private_key_);
	CBB cbb;
	UniquePtr<EC_GROUP> group(EC_GROUP_new_by_curve_name(nid_));
	// Padding is added to avoid leaking the length.
	size_t len = BN_num_bytes(EC_GROUP_get0_order(group.get()));
	if (!CBB_add_asn1_uint64(out, group_id_) \|\|
	!CBB_add_asn1(out, &cbb, CBS_ASN1_OCTETSTRING) \|\|
	!BN_bn2cbb_padded(&cbb, len, private_key_.get()) \|\|
	!CBB_flush(out)) {
	return false;
	}
	return true;
	}

	bool Deserialize(CBS *in) override {
	assert(!private_key_);
	CBS private_key;
	if (!CBS_get_asn1(in, &private_key, CBS_ASN1_OCTETSTRING)) {
	return false;
	}
	private_key_.reset(BN_bin2bn(CBS_data(&private_key),
	CBS_len(&private_key), nullptr));
	return private_key_ != nullptr;
	}

	private:
	UniquePtr<BIGNUM> private_key_;
	int nid_;
	uint16_t group_id_;
	};

	class X25519KeyShare : public SSLKeyShare {
	public:
	X25519KeyShare() {}
	~X25519KeyShare() override {
	OPENSSL_cleanse(private_key_, sizeof(private_key_));
	}

	uint16_t GroupID() const override { return SSL_CURVE_X25519; }

	bool Offer(CBB *out) override {
	uint8_t public_key[32];
	X25519_keypair(public_key, private_key_);
	return !!CBB_add_bytes(out, public_key, sizeof(public_key));
	}

	bool Finish(Array<uint8_t> out_secret, uint8_t out_alert,
	Span<const uint8_t> peer_key) override {
	*out_alert = SSL_AD_INTERNAL_ERROR;

	Array<uint8_t> secret;
	if (!secret.Init(32)) {
	OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
	return false;
	}

	if (peer_key.size() != 32 \|\|
	!X25519(secret.data(), private_key_, peer_key.data())) {
	*out_alert = SSL_AD_DECODE_ERROR;
	OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_ECPOINT);
	return false;
	}

	*out_secret = std::move(secret);
	return true;
	}

	bool Serialize(CBB *out) override {
	return (CBB_add_asn1_uint64(out, GroupID()) &&
	CBB_add_asn1_octet_string(out, private_key_, sizeof(private_key_)));
	}

	bool Deserialize(CBS *in) override {
	CBS key;
	if (!CBS_get_asn1(in, &key, CBS_ASN1_OCTETSTRING) \|\|
	CBS_len(&key) != sizeof(private_key_) \|\|
	!CBS_copy_bytes(&key, private_key_, sizeof(private_key_))) {
	return false;
	}
	return true;
	}

	private:
	uint8_t private_key_[32];
	};

	CONSTEXPR_ARRAY struct {
	int nid;
	uint16_t group_id;
	const char name[8], alias[11];
	} kNamedGroups[] = {
	{NID_secp224r1, SSL_CURVE_SECP224R1, "P-224", "secp224r1"},
	{NID_X9_62_prime256v1, SSL_CURVE_SECP256R1, "P-256", "prime256v1"},
	{NID_secp384r1, SSL_CURVE_SECP384R1, "P-384", "secp384r1"},
	{NID_secp521r1, SSL_CURVE_SECP521R1, "P-521", "secp521r1"},
	{NID_X25519, SSL_CURVE_X25519, "X25519", "x25519"},
	};

	} // namespace

	UniquePtr<SSLKeyShare> SSLKeyShare::Create(uint16_t group_id) {
	switch (group_id) {
	case SSL_CURVE_SECP224R1:
	return UniquePtr<SSLKeyShare>(
	New<ECKeyShare>(NID_secp224r1, SSL_CURVE_SECP224R1));
	case SSL_CURVE_SECP256R1:
	return UniquePtr<SSLKeyShare>(
	New<ECKeyShare>(NID_X9_62_prime256v1, SSL_CURVE_SECP256R1));
	case SSL_CURVE_SECP384R1:
	return UniquePtr<SSLKeyShare>(
	New<ECKeyShare>(NID_secp384r1, SSL_CURVE_SECP384R1));
	case SSL_CURVE_SECP521R1:
	return UniquePtr<SSLKeyShare>(
	New<ECKeyShare>(NID_secp521r1, SSL_CURVE_SECP521R1));
	case SSL_CURVE_X25519:
	return UniquePtr<SSLKeyShare>(New<X25519KeyShare>());
	default:
	return nullptr;
	}
	}

	UniquePtr<SSLKeyShare> SSLKeyShare::Create(CBS *in) {
	uint64_t group;
	if (!CBS_get_asn1_uint64(in, &group) \|\| group > 0xffff) {
	return nullptr;
	}
	UniquePtr<SSLKeyShare> key_share = Create(static_cast<uint16_t>(group));
	if (!key_share \|\| !key_share->Deserialize(in)) {
	return nullptr;
	}
	return key_share;
	}


	bool SSLKeyShare::Accept(CBB out_public_key, Array<uint8_t> out_secret,
	uint8_t *out_alert, Span<const uint8_t> peer_key) {
	*out_alert = SSL_AD_INTERNAL_ERROR;
	return Offer(out_public_key) &&
	Finish(out_secret, out_alert, peer_key);
	}

	bool ssl_nid_to_group_id(uint16_t *out_group_id, int nid) {
	for (const auto &group : kNamedGroups) {
	if (group.nid == nid) {
	*out_group_id = group.group_id;
	return true;
	}
	}
	return false;
	}

	bool ssl_name_to_group_id(uint16_t out_group_id, const char name, size_t len) {
	for (const auto &group : kNamedGroups) {
	if (len == strlen(group.name) &&
	!strncmp(group.name, name, len)) {
	*out_group_id = group.group_id;
	return true;
	}
	if (len == strlen(group.alias) &&
	!strncmp(group.alias, name, len)) {
	*out_group_id = group.group_id;
	return true;
	}
	}
	return false;
	}

	BSSL_NAMESPACE_END

	using namespace bssl;

	const char* SSL_get_curve_name(uint16_t group_id) {
	for (const auto &group : kNamedGroups) {
	if (group.group_id == group_id) {
	return group.name;
	}
	}
	return nullptr;
	}