diff options
| author | Nikos Mavrogiannopoulos <nmav@gnutls.org> | 2011-05-16 22:20:17 +0200 |
|---|---|---|
| committer | Nikos Mavrogiannopoulos <nmav@gnutls.org> | 2011-05-20 12:30:42 +0200 |
| commit | a8e8ba0f5cea4f2356c539e48d17b1e662b49141 (patch) | |
| tree | 36e81a209054f87f404a5a768ef3253f614e2f02 | |
| parent | f90470a7b4c672a916c4513cecf4b9a6bce0eb67 (diff) | |
| download | gnutls-ecc.tar.gz | |
Initial ecc support. Adds support for anonymous ECDH ciphersuites.ecc
46 files changed, 2655 insertions, 17 deletions
diff --git a/lib/Makefile.am b/lib/Makefile.am index bb5975cd6f..17a1b8732b 100644 --- a/lib/Makefile.am +++ b/lib/Makefile.am @@ -68,7 +68,7 @@ COBJECTS = gnutls_record.c gnutls_compress.c debug.c gnutls_cipher.c \ gnutls_datum.c gnutls_session_pack.c gnutls_mpi.c \ gnutls_pk.c gnutls_cert.c gnutls_global.c gnutls_constate.c \ gnutls_anon_cred.c pkix_asn1_tab.c gnutls_asn1_tab.c \ - gnutls_mem.c gnutls_ui.c gnutls_sig.c \ + gnutls_mem.c gnutls_ui.c gnutls_sig.c gnutls_ecc.c \ gnutls_dh_primes.c gnutls_alert.c system.c \ gnutls_str.c gnutls_state.c gnutls_x509.c gnutls_rsa_export.c \ gnutls_helper.c gnutls_supplemental.c crypto.c random.c \ diff --git a/lib/auth/Makefile.am b/lib/auth/Makefile.am index c459ffe25a..92519def81 100644 --- a/lib/auth/Makefile.am +++ b/lib/auth/Makefile.am @@ -38,4 +38,5 @@ noinst_LTLIBRARIES = libgnutls_auth.la libgnutls_auth_la_SOURCES = anon.c cert.c dh_common.c dhe.c \ dhe_psk.c psk.c psk_passwd.c rsa.c rsa_export.c srp.c \ srp_passwd.c srp_rsa.c srp_sb64.c anon.h cert.h dh_common.h \ - psk.h psk_passwd.h srp.h srp_passwd.h + psk.h psk_passwd.h srp.h srp_passwd.h anon_ecdh.c \ + ecdh_common.c diff --git a/lib/auth/anon.h b/lib/auth/anon.h index ab5063d5a0..b2616df247 100644 --- a/lib/auth/anon.h +++ b/lib/auth/anon.h @@ -44,6 +44,7 @@ typedef struct gnutls_anon_client_credentials_st typedef struct anon_auth_info_st { dh_info_st dh; + ecc_curve_t curve; } *anon_auth_info_t; typedef struct anon_auth_info_st anon_auth_info_st; diff --git a/lib/auth/anon_ecdh.c b/lib/auth/anon_ecdh.c new file mode 100644 index 0000000000..5e9932faa3 --- /dev/null +++ b/lib/auth/anon_ecdh.c @@ -0,0 +1,151 @@ +/* + * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005, 2009, 2010 Free + * Software Foundation, Inc. + * + * Author: Nikos Mavrogiannopoulos + * + * This file is part of GnuTLS. + * + * The GnuTLS is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public License + * as published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, + * USA + * + */ + +/* This file contains the Anonymous Diffie-Hellman key exchange part of + * the anonymous authentication. The functions here are used in the + * handshake. + */ + +#include <gnutls_int.h> + +#ifdef ENABLE_ANON + +#include "gnutls_auth.h" +#include "gnutls_errors.h" +#include "gnutls_dh.h" +#include "auth/anon.h" +#include "gnutls_num.h" +#include "gnutls_mpi.h" +#include <gnutls_state.h> +#include <auth/ecdh_common.h> +#include <ext/ecc.h> + +static int gen_anon_ecdh_server_kx (gnutls_session_t, gnutls_buffer_st*); +static int proc_anon_ecdh_client_kx (gnutls_session_t, opaque *, size_t); +static int proc_anon_ecdh_server_kx (gnutls_session_t, opaque *, size_t); + +const mod_auth_st anon_ecdh_auth_struct = { + "ANON ECDH", + NULL, + NULL, + gen_anon_ecdh_server_kx, + _gnutls_gen_ecdh_common_client_kx, /* this can be shared */ + NULL, + NULL, + + NULL, + NULL, /* certificate */ + proc_anon_ecdh_server_kx, + proc_anon_ecdh_client_kx, + NULL, + NULL +}; + +static int +gen_anon_ecdh_server_kx (gnutls_session_t session, gnutls_buffer_st* data) +{ + ecc_curve_t curve; + int ret; + gnutls_anon_server_credentials_t cred; + + cred = (gnutls_anon_server_credentials_t) + _gnutls_get_cred (session->key, GNUTLS_CRD_ANON, NULL); + if (cred == NULL) + { + gnutls_assert (); + return GNUTLS_E_INSUFFICIENT_CREDENTIALS; + } + + curve = _gnutls_session_ecc_curve_get(session); + if (curve == GNUTLS_ECC_CURVE_INVALID) + return gnutls_assert_val(GNUTLS_E_ECC_NO_SUPPORTED_CURVES); + + if ((ret = + _gnutls_auth_info_set (session, GNUTLS_CRD_ANON, + sizeof (anon_auth_info_st), 1)) < 0) + { + gnutls_assert (); + return ret; + } + + ret = _gnutls_ecdh_common_print_server_kx (session, data, curve); + if (ret < 0) + { + gnutls_assert (); + } + + return ret; +} + + +static int +proc_anon_ecdh_client_kx (gnutls_session_t session, opaque * data, + size_t _data_size) +{ + gnutls_anon_server_credentials_t cred; + ecc_curve_t curve; + + cred = (gnutls_anon_server_credentials_t) + _gnutls_get_cred (session->key, GNUTLS_CRD_ANON, NULL); + if (cred == NULL) + { + gnutls_assert (); + return GNUTLS_E_INSUFFICIENT_CREDENTIALS; + } + + curve = _gnutls_session_ecc_curve_get(session); + if (curve == GNUTLS_ECC_CURVE_INVALID) + return gnutls_assert_val(GNUTLS_E_ECC_NO_SUPPORTED_CURVES); + + return _gnutls_proc_ecdh_common_client_kx (session, data, _data_size, curve); +} + +int +proc_anon_ecdh_server_kx (gnutls_session_t session, opaque * data, + size_t _data_size) +{ + + int ret; + + /* set auth_info */ + if ((ret = + _gnutls_auth_info_set (session, GNUTLS_CRD_ANON, + sizeof (anon_auth_info_st), 1)) < 0) + { + gnutls_assert (); + return ret; + } + + ret = _gnutls_proc_ecdh_common_server_kx (session, data, _data_size); + if (ret < 0) + { + gnutls_assert (); + return ret; + } + + return 0; +} + +#endif /* ENABLE_ANON */ diff --git a/lib/auth/ecdh_common.c b/lib/auth/ecdh_common.c new file mode 100644 index 0000000000..e3d247e8c1 --- /dev/null +++ b/lib/auth/ecdh_common.c @@ -0,0 +1,203 @@ +/* + * Copyright (C) 2011 Free Software Foundation, Inc. + * + * Author: Nikos Mavrogiannopoulos + * + * This file is part of GnuTLS. + * + * The GnuTLS is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public License + * as published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, + * USA + * + */ + +/* This file contains common stuff in Ephemeral Diffie-Hellman (DHE) + * and Anonymous DH key exchange(DHA). These are used in the handshake + * procedure of the certificate and anoymous authentication. + */ + +#include "gnutls_int.h" +#include "gnutls_auth.h" +#include "gnutls_errors.h" +#include "gnutls_dh.h" +#include "gnutls_num.h" +#include "gnutls_sig.h" +#include <gnutls_datum.h> +#include <gnutls_x509.h> +#include <gnutls_state.h> +#include <auth/ecdh_common.h> +#include <gnutls_ecc.h> +#include <ext/ecc.h> +#include <gnutls_algorithms.h> +#include <auth/psk.h> +#include <gnutls_pk.h> + +static int calc_ecdh_key( gnutls_session_t session) +{ +gnutls_pk_params_st pub; +int ret; + + pub.params[0] = session->key->ecdh_params.params[0]; + pub.params[1] = session->key->ecdh_params.params[1]; + pub.params[2] = session->key->ecdh_params.params[2]; + pub.params[3] = session->key->ecdh_params.params[3]; + pub.params[4] = session->key->ecdh_x; + pub.params[5] = session->key->ecdh_y; + pub.params[6] = _gnutls_mpi_new(1); + if (pub.params[6] == NULL) + return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR); + + _gnutls_mpi_set_ui(pub.params[6], 1); + + ret = _gnutls_pk_derive(GNUTLS_PK_ECDH, &session->key->key, &session->key->ecdh_params, &pub); + + _gnutls_mpi_release(&pub.params[6]); + + if (ret < 0) + return gnutls_assert_val(ret); + + return 0; +} + + +int +_gnutls_proc_ecdh_common_client_kx (gnutls_session_t session, + opaque * data, size_t _data_size, + ecc_curve_t curve) +{ + ssize_t data_size = _data_size; + int ret, i = 0; + int point_size; + + DECR_LEN (data_size, 1); + point_size = data[i]; + i+=1; + + DECR_LEN (data_size, point_size); + ret = _gnutls_ecc_ansi_x963_import(curve, &data[i], point_size, &session->key->ecdh_x, &session->key->ecdh_y); + if (ret < 0) + return gnutls_assert_val(ret); + + /* generate pre-shared key */ + ret = calc_ecdh_key(session); + if (ret < 0) + return gnutls_assert_val(ret); + + return 0; +} + +int +_gnutls_gen_ecdh_common_client_kx (gnutls_session_t session, gnutls_buffer_st* data) +{ + int ret; + gnutls_datum_t out; + int curve = _gnutls_session_ecc_curve_get(session); + + /* generate temporal key */ + ret = _gnutls_pk_generate(GNUTLS_PK_ECDH, curve, &session->key->ecdh_params); + if (ret < 0) + return gnutls_assert_val(ret); + + ret = _gnutls_ecc_ansi_x963_export(curve, session->key->ecdh_params.params[4] /* x */, + session->key->ecdh_params.params[5] /* y */, &out); + if (ret < 0) + return gnutls_assert_val(ret); + + ret = _gnutls_buffer_append_data_prefix(data, 8, out.data, out.size); + + _gnutls_free_datum(&out); + + if (ret < 0) + return gnutls_assert_val(ret); + + /* generate pre-shared key */ + ret = calc_ecdh_key(session); + if (ret < 0) + return gnutls_assert_val(ret); + + return data->length; +} + +int +_gnutls_proc_ecdh_common_server_kx (gnutls_session_t session, + opaque * data, size_t _data_size) +{ + int i, ret, point_size; + ecc_curve_t curve; + ssize_t data_size = _data_size; + + i = 0; + DECR_LEN (data_size, 1); + if (data[i++] != 3) + return gnutls_assert_val(GNUTLS_E_ECC_NO_SUPPORTED_CURVES); + + DECR_LEN (data_size, 2); + curve = _gnutls_num_to_ecc(_gnutls_read_uint16 (&data[i])); + i += 2; + + ret = _gnutls_session_supports_ecc_curve(session, curve); + if (ret < 0) + return gnutls_assert_val(ret); + + DECR_LEN (data_size, 1); + point_size = data[i]; + i+=1; + + DECR_LEN (data_size, point_size); + ret = _gnutls_ecc_ansi_x963_import(curve, &data[i], point_size, &session->key->ecdh_x, &session->key->ecdh_y); + if (ret < 0) + return gnutls_assert_val(ret); + + return ret; +} + +/* If the psk flag is set, then an empty psk_identity_hint will + * be inserted */ +int _gnutls_ecdh_common_print_server_kx (gnutls_session_t session, gnutls_buffer_st* data, + ecc_curve_t curve) +{ + opaque p; + int ret; + gnutls_datum_t out; + + /* curve type */ + p = 3; + + ret = _gnutls_buffer_append_data(data, &p, 1); + if (ret < 0) + return gnutls_assert_val(ret); + + ret = _gnutls_buffer_append_prefix(data, 16, _gnutls_ecc_to_num(curve)); + if (ret < 0) + return gnutls_assert_val(ret); + + /* generate temporal key */ + ret = _gnutls_pk_generate(GNUTLS_PK_ECDH, curve, &session->key->ecdh_params); + if (ret < 0) + return gnutls_assert_val(ret); + + ret = _gnutls_ecc_ansi_x963_export(curve, session->key->ecdh_params.params[4] /* x */, + session->key->ecdh_params.params[5] /* y */, &out); + if (ret < 0) + return gnutls_assert_val(ret); + + ret = _gnutls_buffer_append_data_prefix(data, 8, out.data, out.size); + + _gnutls_free_datum(&out); + + if (ret < 0) + return gnutls_assert_val(ret); + + return data->length; +} diff --git a/lib/auth/ecdh_common.h b/lib/auth/ecdh_common.h new file mode 100644 index 0000000000..1fa6eba39a --- /dev/null +++ b/lib/auth/ecdh_common.h @@ -0,0 +1,41 @@ +/* + * Copyright (C) 2011 Free Software Foundation, Inc. + * + * Author: Nikos Mavrogiannopoulos + * + * This file is part of GnuTLS. + * + * The GnuTLS is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public License + * as published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, + * USA + * + */ + +#ifndef AUTH_ECDH_COMMON +#define AUTH_ECDH_COMMON + +#include <gnutls_auth.h> + +int _gnutls_gen_ecdh_common_client_kx (gnutls_session_t, gnutls_buffer_st*); +int _gnutls_proc_ecdh_common_client_kx (gnutls_session_t session, + opaque * data, size_t _data_size, + ecc_curve_t curve); +int _gnutls_ecdh_common_print_server_kx (gnutls_session_t, gnutls_buffer_st* data, + ecc_curve_t curve); +int _gnutls_proc_ecdh_common_server_kx (gnutls_session_t session, opaque * data, + size_t _data_size); + + + +#endif diff --git a/lib/ext/Makefile.am b/lib/ext/Makefile.am index a949912125..90dcb072ab 100644 --- a/lib/ext/Makefile.am +++ b/lib/ext/Makefile.am @@ -39,4 +39,4 @@ libgnutls_ext_la_SOURCES = max_record.c cert_type.c \ server_name.c signature.c safe_renegotiation.c \ max_record.h cert_type.h server_name.h srp.h \ session_ticket.h signature.h safe_renegotiation.h \ - session_ticket.c srp.c + session_ticket.c srp.c ecc.c diff --git a/lib/ext/ecc.c b/lib/ext/ecc.c new file mode 100644 index 0000000000..11c00716e4 --- /dev/null +++ b/lib/ext/ecc.c @@ -0,0 +1,302 @@ +/* + * Copyright (C) 2002, 2003, 2004, 2005, 2010 Free Software Foundation, + * Inc. + * + * Author: Nikos Mavrogiannopoulos + * + * This file is part of GnuTLS. + * + * The GnuTLS is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public License + * as published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, + * USA + * + */ + +/* This file contains the code the Certificate Type TLS extension. + * This extension is currently gnutls specific. + */ + +#include "gnutls_int.h" +#include "gnutls_errors.h" +#include "gnutls_num.h" +#include <ext/ecc.h> +#include <gnutls_state.h> +#include <gnutls_num.h> + +/* Maps record size to numbers according to the + * extensions draft. + */ + +static int _gnutls_supported_ecc_recv_params (gnutls_session_t session, + const opaque * data, + size_t data_size); +static int _gnutls_supported_ecc_send_params (gnutls_session_t session, + gnutls_buffer_st * extdata); + +static int _gnutls_supported_ecc_pf_recv_params (gnutls_session_t session, + const opaque * data, + size_t data_size); +static int _gnutls_supported_ecc_pf_send_params (gnutls_session_t session, + gnutls_buffer_st * extdata); + +extension_entry_st ext_mod_supported_ecc = { + .name = "SUPPORTED ECC", + .type = GNUTLS_EXTENSION_SUPPORTED_ECC, + .parse_type = GNUTLS_EXT_TLS, + + .recv_func = _gnutls_supported_ecc_recv_params, + .send_func = _gnutls_supported_ecc_send_params, + .pack_func = NULL, + .unpack_func = NULL, + .deinit_func = NULL +}; + +extension_entry_st ext_mod_supported_ecc_pf = { + .name = "SUPPORTED ECC POINT FORMATS", + .type = GNUTLS_EXTENSION_SUPPORTED_ECC_PF, + .parse_type = GNUTLS_EXT_TLS, + + .recv_func = _gnutls_supported_ecc_pf_recv_params, + .send_func = _gnutls_supported_ecc_pf_send_params, + .pack_func = NULL, + .unpack_func = NULL, + .deinit_func = NULL +}; + +/* + * In case of a server: if a SUPPORTED_ECC extension type is received then it stores + * into the session security parameters the new value. The server may use gnutls_session_certificate_type_get(), + * to access it. + * + * In case of a client: If a supported_eccs have been specified then we send the extension. + * + */ +static int +_gnutls_supported_ecc_recv_params (gnutls_session_t session, + const opaque * data, size_t _data_size) +{ + int new_type = -1, ret, i; + ssize_t data_size = _data_size; + uint16_t len; + const opaque* p = data; + + if (session->security_parameters.entity == GNUTLS_CLIENT) + { + /* A client shouldn't receive this extension */ + return gnutls_assert_val(GNUTLS_E_RECEIVED_ILLEGAL_EXTENSION); + } + else + { /* SERVER SIDE - we must check if the sent supported ecc type is the right one + */ + if (data_size < 2) + return gnutls_assert_val(GNUTLS_E_RECEIVED_ILLEGAL_EXTENSION); + + DECR_LEN (data_size, 2); + len = _gnutls_read_uint16(p); + p += 2; + + DECR_LEN (data_size, len); + + for (i = 0; i < len; i+=2) + { + new_type = _gnutls_num_to_ecc (_gnutls_read_uint16(&p[i])); + if (new_type < 0) + continue; + + /* Check if we support this supported_ecc */ + if ((ret = + _gnutls_session_supports_ecc_curve (session, new_type)) < 0) + { + gnutls_assert (); + continue; + } + else + break; + /* new_type is ok */ + } + + if (new_type < 0) + { + gnutls_assert (); + return GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER; + } + + if ((ret = + _gnutls_session_supports_ecc_curve (session, new_type)) < 0) + { + /* The peer has requested unsupported ecc + * types. Instead of failing, procceed normally. + * (the ciphersuite selection would fail, or a + * non certificate ciphersuite will be selected). + */ + return gnutls_assert_val(0); + } + + _gnutls_session_ecc_curve_set (session, new_type); + } + + return 0; +} + + +/* returns data_size or a negative number on failure + */ +static int +_gnutls_supported_ecc_send_params (gnutls_session_t session, gnutls_buffer_st* extdata) +{ + unsigned len, i; + int ret; + uint16_t p; + + /* this extension is only being sent on client side */ + if (session->security_parameters.entity == GNUTLS_CLIENT) + { + + if (session->internals.priorities.supported_ecc.algorithms > 0) + { + + len = session->internals.priorities.supported_ecc.algorithms; + + /* this is a vector! + */ + ret = _gnutls_buffer_append_prefix(extdata, 16, len*2); + if (ret < 0) + return gnutls_assert_val(ret); + + for (i = 0; i < len; i++) + { + p = + _gnutls_ecc_to_num (session->internals.priorities. + supported_ecc.priority[i]); + ret = _gnutls_buffer_append_prefix(extdata, 16, p); + if (ret < 0) + return gnutls_assert_val(ret); + } + return (len + 1)*2; + } + + } + + return 0; +} + +/* + * In case of a server: if a SUPPORTED_ECC extension type is received then it stores + * into the session security parameters the new value. The server may use gnutls_session_certificate_type_get(), + * to access it. + * + * In case of a client: If a supported_eccs have been specified then we send the extension. + * + */ +static int +_gnutls_supported_ecc_pf_recv_params (gnutls_session_t session, + const opaque * data, size_t _data_size) +{ +int len, i; +int uncompressed = 0; +int data_size = _data_size; + + if (session->security_parameters.entity == GNUTLS_CLIENT) + { + if (data_size < 1) + return gnutls_assert_val(GNUTLS_E_RECEIVED_ILLEGAL_EXTENSION); + + len = data[0]; + DECR_LEN (data_size, len+1); + + for (i=0;i<len;i++) + if (data[1+i] == 0) /* uncompressed */ + uncompressed = 1; + + if (uncompressed == 0) + return gnutls_assert_val(GNUTLS_E_UNKNOWN_PK_ALGORITHM); + } + else + { + /* only sanity check here. We only support uncompressed points + * and a client must support it thus nothing to check. + */ + if (_data_size < 1) + return gnutls_assert_val(GNUTLS_E_RECEIVED_ILLEGAL_EXTENSION); + } + + return 0; +} + +/* returns data_size or a negative number on failure + */ +static int +_gnutls_supported_ecc_pf_send_params (gnutls_session_t session, gnutls_buffer_st* extdata) +{ + const opaque p[2] = {0x01, 0x00}; /* only support uncompressed point format */ + + /* this extension is only being sent on client and server side */ + _gnutls_buffer_append_data(extdata, p, 2); + return 2; +} + +/* Maps numbers to record sizes according to the + * extensions draft. + */ +int +_gnutls_num_to_ecc (int num) +{ + switch (num) + { + case 23: + /* sec256r1 */ + return GNUTLS_ECC_CURVE_SECP256R1; + case 24: + return GNUTLS_ECC_CURVE_SECP384R1; + default: + return GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER; + } +} + +/* Maps record size to numbers according to the + * extensions draft. + */ +int +_gnutls_ecc_to_num (ecc_curve_t supported_ecc) +{ + switch (supported_ecc) + { + case GNUTLS_ECC_CURVE_SECP256R1: + return 23; + case GNUTLS_ECC_CURVE_SECP384R1: + return 24; + default: + return GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER; + } +} + +/* Returns 0 if the given ECC curve is allowed in the current + * session. A negative error value is returned otherwise. + */ +int +_gnutls_session_supports_ecc_curve (gnutls_session_t session, int ecc_type) +{ + unsigned i; + + if (session->internals.priorities.supported_ecc.algorithms > 0) + { + for (i = 0; i < session->internals.priorities.supported_ecc.algorithms; i++) + { + if (session->internals.priorities.supported_ecc.priority[i] == ecc_type) + return 0; + } + } + + return GNUTLS_E_ECC_NO_SUPPORTED_CURVES; +} diff --git a/lib/ext/ecc.h b/lib/ext/ecc.h new file mode 100644 index 0000000000..745a000815 --- /dev/null +++ b/lib/ext/ecc.h @@ -0,0 +1,37 @@ +/* + * Copyright (C) 2011 Free Software Foundation, Inc. + * + * Author: Nikos Mavrogiannopoulos + * + * This file is part of GnuTLS. + * + * The GnuTLS is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public License + * as published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, + * USA + * + */ +#ifndef EXT_ECC_H +#define EXT_ECC_H + +#include <gnutls_extensions.h> + +extern extension_entry_st ext_mod_supported_ecc; +extern extension_entry_st ext_mod_supported_ecc_pf; + +int _gnutls_num_to_ecc (int num); +int _gnutls_ecc_to_num (ecc_curve_t); +int +_gnutls_session_supports_ecc_curve (gnutls_session_t session, int ecc_type); + +#endif diff --git a/lib/gnutls_algorithms.c b/lib/gnutls_algorithms.c index b54e5cd9e4..295bb87e26 100644 --- a/lib/gnutls_algorithms.c +++ b/lib/gnutls_algorithms.c @@ -70,6 +70,7 @@ typedef struct static const gnutls_cred_map cred_mappings[] = { {GNUTLS_KX_ANON_DH, GNUTLS_CRD_ANON, GNUTLS_CRD_ANON}, + {GNUTLS_KX_ANON_ECDH, GNUTLS_CRD_ANON, GNUTLS_CRD_ANON}, {GNUTLS_KX_RSA, GNUTLS_CRD_CERTIFICATE, GNUTLS_CRD_CERTIFICATE}, {GNUTLS_KX_RSA_EXPORT, GNUTLS_CRD_CERTIFICATE, GNUTLS_CRD_CERTIFICATE}, {GNUTLS_KX_DHE_DSS, GNUTLS_CRD_CERTIFICATE, GNUTLS_CRD_CERTIFICATE}, @@ -260,6 +261,7 @@ extern mod_auth_st rsa_export_auth_struct; extern mod_auth_st dhe_rsa_auth_struct; extern mod_auth_st dhe_dss_auth_struct; extern mod_auth_st anon_auth_struct; +extern mod_auth_st anon_ecdh_auth_struct; extern mod_auth_st srp_auth_struct; extern mod_auth_st psk_auth_struct; extern mod_auth_st dhe_psk_auth_struct; @@ -279,6 +281,7 @@ typedef struct gnutls_kx_algo_entry gnutls_kx_algo_entry; static const gnutls_kx_algo_entry _gnutls_kx_algorithms[] = { #ifdef ENABLE_ANON {"ANON-DH", GNUTLS_KX_ANON_DH, &anon_auth_struct, 1, 0}, + {"ANON-ECDH", GNUTLS_KX_ANON_ECDH, &anon_ecdh_auth_struct, 0, 0}, #endif {"RSA", GNUTLS_KX_RSA, &rsa_auth_struct, 0, 0}, {"RSA-EXPORT", GNUTLS_KX_RSA_EXPORT, &rsa_export_auth_struct, 0, @@ -463,7 +466,11 @@ typedef struct #define GNUTLS_PSK_NULL_SHA256 { 0x00, 0xB0 } #define GNUTLS_DHE_PSK_NULL_SHA256 { 0x00, 0xB4 } -/* Safe renegotiation */ +/* ECC */ +#define GNUTLS_ECDH_ANON_3DES_EDE_CBC_SHA { 0xC0, 0x17 } +#define GNUTLS_ECDH_ANON_AES_128_CBC_SHA { 0xC0, 0x18 } +#define GNUTLS_ECDH_ANON_AES_256_CBC_SHA { 0xC0, 0x19 } + #define CIPHER_SUITES_COUNT sizeof(cs_algorithms)/sizeof(gnutls_cipher_suite_entry)-1 @@ -761,6 +768,19 @@ static const gnutls_cipher_suite_entry cs_algorithms[] = { GNUTLS_CIPHER_AES_128_GCM, GNUTLS_KX_ANON_DH, GNUTLS_MAC_AEAD, GNUTLS_TLS1_2, GNUTLS_VERSION_MAX, 1), +/* ECC-ANON */ + GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_ECDH_ANON_3DES_EDE_CBC_SHA, + GNUTLS_CIPHER_3DES_CBC, GNUTLS_KX_ANON_ECDH, + GNUTLS_MAC_SHA1, GNUTLS_TLS1_0, + GNUTLS_VERSION_MAX, 1), + GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_ECDH_ANON_AES_128_CBC_SHA, + GNUTLS_CIPHER_AES_128_CBC, GNUTLS_KX_ANON_ECDH, + GNUTLS_MAC_SHA1, GNUTLS_TLS1_0, + GNUTLS_VERSION_MAX, 1), + GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_ECDH_ANON_AES_256_CBC_SHA, + GNUTLS_CIPHER_AES_256_CBC, GNUTLS_KX_ANON_ECDH, + GNUTLS_MAC_SHA1, GNUTLS_TLS1_0, + GNUTLS_VERSION_MAX, 1), {0, {{0, 0}}, 0, 0, 0, 0, 0, 0} }; @@ -2174,6 +2194,109 @@ _gnutls_sign_to_tls_aid (gnutls_sign_algorithm_t sign) return ret; } +/* ECC curves; + */ + +static const gnutls_ecc_curve_entry_st ecc_curves[] = { + { + .name = "SECP256R1", + .id = GNUTLS_ECC_CURVE_SECP256R1, + .size = 32, + .prime = "FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF", + .B = "5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B", + .order = "FFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551", + .Gx = "6B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C296", + .Gy = "4FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5", + }, + { + .name = "SECP384R1", + .id = GNUTLS_ECC_CURVE_SECP384R1, + .size = 48, + .prime = "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFF0000000000000000FFFFFFFF", + .B = "B3312FA7E23EE7E4988E056BE3F82D19181D9C6EFE8141120314088F5013875AC656398D8A2ED19D2A85C8EDD3EC2AEF", + .order = "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC7634D81F4372DDF581A0DB248B0A77AECEC196ACCC52973", + .Gx = "AA87CA22BE8B05378EB1C71EF320AD746E1D3B628BA79B9859F741E082542A385502F25DBF55296C3A545E3872760AB7", + .Gy = "3617DE4A96262C6F5D9E98BF9292DC29F8F41DBD289A147CE9DA3113B5F0B8C00A60B1CE1D7E819D7A431D7C90EA0E5F" + }, + {0, 0, 0} +}; + +#define GNUTLS_ECC_CURVE_LOOP(b) \ + { const gnutls_ecc_curve_entry_st *p; \ + for(p = ecc_curves; p->name != NULL; p++) { b ; } } + +/*- + * _gnutls_ecc_curve_get_name: + * @curve: is an ECC curve + * + * Convert a #ecc_curve_t value to a string. + * + * Returns: a string that contains the name of the specified + * curve or %NULL. + -*/ +const char * +_gnutls_ecc_curve_get_name (ecc_curve_t curve) +{ + const char *ret = NULL; + + GNUTLS_ECC_CURVE_LOOP( + if (p->id == curve) + { + ret = p->name; + break; + } + ); + + return ret; +} + +/*- + * _gnutls_ecc_curve_get_params: + * @curve: is an ECC curve + * + * Returns the information on a curve. + * + * Returns: a pointer to #gnutls_ecc_curve_entry_st or %NULL. + -*/ +const gnutls_ecc_curve_entry_st * +_gnutls_ecc_curve_get_params (ecc_curve_t curve) +{ + const gnutls_ecc_curve_entry_st *ret = NULL; + + GNUTLS_ECC_CURVE_LOOP( + if (p->id == curve) + { + ret = p; + break; + } + ); + + return ret; +} + +/*- + * _gnutls_ecc_curve_get_size: + * @curve: is an ECC curve + * + * Returns the size in bytes of the curve. + * + * Returns: a the size or zero. + -*/ +int _gnutls_ecc_curve_get_size (ecc_curve_t curve) +{ + int ret = 0; + + GNUTLS_ECC_CURVE_LOOP( + if (p->id == curve) + { + ret = p->size; + break; + } + ); + + return ret; +} + /* pk algorithms; @@ -2197,6 +2320,7 @@ static const gnutls_pk_entry pk_algorithms[] = { {"DSA", PK_DSA_OID, GNUTLS_PK_DSA}, {"GOST R 34.10-2001", PK_GOST_R3410_2001_OID, GNUTLS_PK_UNKNOWN}, {"GOST R 34.10-94", PK_GOST_R3410_94_OID, GNUTLS_PK_UNKNOWN}, + {"ECDH", "1.2.840.10045.2.1", GNUTLS_PK_ECDH}, {0, 0, 0} }; diff --git a/lib/gnutls_algorithms.h b/lib/gnutls_algorithms.h index 5c867b8dc6..049c1e218a 100644 --- a/lib/gnutls_algorithms.h +++ b/lib/gnutls_algorithms.h @@ -125,4 +125,28 @@ int _gnutls_kx_priority (gnutls_session_t session, unsigned int _gnutls_pk_bits_to_subgroup_bits (unsigned int pk_bits); +/* ECC */ +struct gnutls_ecc_curve_entry_st +{ + const char *name; + ecc_curve_t id; + int size; /* the size in bytes */ + + /** The prime that defines the field the curve is in (encoded in hex) */ + const char *prime; + /** The fields B param (hex) */ + const char *B; + /** The order of the curve (hex) */ + const char *order; + /** The x co-ordinate of the base point on the curve (hex) */ + const char *Gx; + /** The y co-ordinate of the base point on the curve (hex) */ + const char *Gy; +}; +typedef struct gnutls_ecc_curve_entry_st gnutls_ecc_curve_entry_st; + +const char * _gnutls_ecc_curve_get_name (ecc_curve_t curve); +const gnutls_ecc_curve_entry_st * _gnutls_ecc_curve_get_params (ecc_curve_t curve); +int _gnutls_ecc_curve_get_size (ecc_curve_t curve); + #endif diff --git a/lib/gnutls_dh.c b/lib/gnutls_dh.c index 2c6a6c32a2..0badeece14 100644 --- a/lib/gnutls_dh.c +++ b/lib/gnutls_dh.c @@ -147,3 +147,4 @@ _gnutls_get_dh_params (gnutls_dh_params_t dh_params, return session->internals.params.dh_params; } + diff --git a/lib/gnutls_ecc.c b/lib/gnutls_ecc.c new file mode 100644 index 0000000000..c15600836c --- /dev/null +++ b/lib/gnutls_ecc.c @@ -0,0 +1,101 @@ +/* + * Copyright (C) 2011 Free Software Foundation, Inc. + * + * Author: Nikos Mavrogiannopoulos + * + * This file is part of GnuTLS. + * + * The GnuTLS is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public License + * as published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, + * USA + * + */ + +/* Helper functions for ECC handling + * based on public domain code by Tom St. Dennis. + */ +#include <gnutls_int.h> +#include <gnutls_mpi.h> +#include <gnutls_ecc.h> +#include <gnutls_algorithms.h> +#include <gnutls_errors.h> + +int _gnutls_ecc_ansi_x963_export(ecc_curve_t curve, bigint_t x, bigint_t y, gnutls_datum_t * out) +{ + int numlen = _gnutls_ecc_curve_get_size(curve); + int byte_size, ret; + size_t size; + + if (numlen == 0) + return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST); + + out->size = 1 + 2*numlen; + + out->data = gnutls_malloc(out->size); + if (out->data == NULL) + return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR); + + memset(out->data, 0, out->size); + + /* store byte 0x04 */ + out->data[0] = 0x04; + + /* pad and store x */ + byte_size = (_gnutls_mpi_get_nbits(x)+7)/8; + size = out->size - (1+(numlen-byte_size)); + ret = _gnutls_mpi_print(x, &out->data[1+(numlen-byte_size)], &size); + if (ret < 0) + return gnutls_assert_val(ret); + + byte_size = (_gnutls_mpi_get_nbits(y)+7)/8; + size = out->size - (1+(numlen+numlen-byte_size)); + ret = _gnutls_mpi_print(y, &out->data[1+numlen+numlen-byte_size], &size); + if (ret < 0) + return gnutls_assert_val(ret); + + /* pad and store y */ + return 0; +} + + +int _gnutls_ecc_ansi_x963_import(ecc_curve_t curve, const opaque *in, unsigned long inlen, bigint_t* x, bigint_t* y) +{ + int ret; + int numlen = _gnutls_ecc_curve_get_size(curve); + + /* must be odd */ + if ((inlen & 1) == 0 || numlen == 0) + { + return GNUTLS_E_INVALID_REQUEST; + } + + /* check for 4, 6 or 7 */ + if (in[0] != 4 && in[0] != 6 && in[0] != 7) { + return gnutls_assert_val(GNUTLS_E_PARSING_ERROR); + } + + /* read data */ + ret = _gnutls_mpi_scan(x, in+1, (inlen-1)>>1); + if (ret < 0) + return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR); + + ret = _gnutls_mpi_scan(y, in+1+((inlen-1)>>1), (inlen-1)>>1); + if (ret < 0) + { + _gnutls_mpi_release(x); + return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR); + } + + return 0; +} diff --git a/lib/gnutls_ecc.h b/lib/gnutls_ecc.h new file mode 100644 index 0000000000..5f91ac5800 --- /dev/null +++ b/lib/gnutls_ecc.h @@ -0,0 +1,2 @@ +int _gnutls_ecc_ansi_x963_import(ecc_curve_t curve, const opaque *in, unsigned long inlen, bigint_t* x, bigint_t* y); +int _gnutls_ecc_ansi_x963_export(ecc_curve_t curve, bigint_t x, bigint_t y, gnutls_datum_t * out); diff --git a/lib/gnutls_errors.c b/lib/gnutls_errors.c index c5405694d1..9f700b7e08 100644 --- a/lib/gnutls_errors.c +++ b/lib/gnutls_errors.c @@ -328,6 +328,8 @@ static const gnutls_error_entry error_algorithms[] = { GNUTLS_E_TIMEDOUT, 1), ERROR_ENTRY (N_("The operation was cancelled due to user error"), GNUTLS_E_USER_ERROR, 1), + ERROR_ENTRY (N_("No supported ECC curves were found"), + GNUTLS_E_ECC_NO_SUPPORTED_CURVES, 1), {NULL, NULL, 0, 0} }; diff --git a/lib/gnutls_extensions.c b/lib/gnutls_extensions.c index 5f2116729a..215685154b 100644 --- a/lib/gnutls_extensions.c +++ b/lib/gnutls_extensions.c @@ -39,6 +39,7 @@ #include <ext/safe_renegotiation.h> #include <ext/signature.h> #include <ext/safe_renegotiation.h> +#include <ext/ecc.h> #include <gnutls_num.h> @@ -334,6 +335,14 @@ _gnutls_ext_init (void) if (ret != GNUTLS_E_SUCCESS) return ret; + ret = _gnutls_ext_register (&ext_mod_supported_ecc); + if (ret != GNUTLS_E_SUCCESS) + return ret; + + ret = _gnutls_ext_register (&ext_mod_supported_ecc_pf); + if (ret != GNUTLS_E_SUCCESS) + return ret; + ret = _gnutls_ext_register (&ext_mod_sig); if (ret != GNUTLS_E_SUCCESS) return ret; diff --git a/lib/gnutls_global.c b/lib/gnutls_global.c index c69adcf74d..0499002b68 100644 --- a/lib/gnutls_global.c +++ b/lib/gnutls_global.c @@ -186,6 +186,7 @@ static int _gnutls_init = 0; * Returns: On success, %GNUTLS_E_SUCCESS (zero) is returned, * otherwise an error code is returned. **/ +int ecc_test(void); int gnutls_global_init (void) { @@ -194,6 +195,10 @@ gnutls_global_init (void) if (_gnutls_init++) goto out; + + res = ecc_test(); + if (res != 0) + exit(1); if (gl_sockets_startup (SOCKETS_1_1)) return GNUTLS_E_LIBRARY_VERSION_MISMATCH; diff --git a/lib/gnutls_int.h b/lib/gnutls_int.h index ab9776ec92..d67bddb0b3 100644 --- a/lib/gnutls_int.h +++ b/lib/gnutls_int.h @@ -217,6 +217,8 @@ typedef enum extensions_t GNUTLS_EXTENSION_SERVER_NAME = 0, GNUTLS_EXTENSION_MAX_RECORD_SIZE = 1, GNUTLS_EXTENSION_CERT_TYPE = 9, + GNUTLS_EXTENSION_SUPPORTED_ECC = 10, + GNUTLS_EXTENSION_SUPPORTED_ECC_PF = 11, GNUTLS_EXTENSION_SRP = 12, GNUTLS_EXTENSION_SIGNATURE_ALGORITHMS = 13, GNUTLS_EXTENSION_SESSION_TICKET = 35, @@ -224,6 +226,13 @@ typedef enum extensions_t } extensions_t; typedef enum +{ + GNUTLS_ECC_CURVE_INVALID=0, + GNUTLS_ECC_CURVE_SECP256R1, + GNUTLS_ECC_CURVE_SECP384R1, +} ecc_curve_t; + +typedef enum { CIPHER_STREAM, CIPHER_BLOCK } cipher_type_t; #define RESUME_TRUE 0 @@ -339,6 +348,11 @@ typedef struct auth_cred_st struct gnutls_key_st { + /* For ECDH KX */ + gnutls_pk_params_st ecdh_params; + bigint_t ecdh_x; + bigint_t ecdh_y; + /* For DH KX */ gnutls_datum_t key; bigint_t KEY; @@ -470,6 +484,7 @@ typedef struct uint16_t max_record_recv_size; /* holds the negotiated certificate type */ gnutls_certificate_type_t cert_type; + ecc_curve_t ecc_curve; /* holds the first supported ECC curve requested by client */ gnutls_protocol_t version; /* moved here */ /* FIXME: The following are not saved in the session storage @@ -543,6 +558,7 @@ struct gnutls_priority_st priority_st protocol; priority_st cert_type; priority_st sign_algo; + priority_st supported_ecc; /* to disable record padding */ int no_padding:1; diff --git a/lib/gnutls_pk.c b/lib/gnutls_pk.c index f6284fd1c4..5fc3aa216f 100644 --- a/lib/gnutls_pk.c +++ b/lib/gnutls_pk.c @@ -531,7 +531,7 @@ _generate_params (int algo, bigint_t * resarr, unsigned int *resarr_len, int ret; unsigned int i; - ret = _gnutls_pk_ops.generate (algo, bits, ¶ms); + ret = _gnutls_pk_generate (algo, bits, ¶ms); if (ret < 0) { diff --git a/lib/gnutls_pk.h b/lib/gnutls_pk.h index f9b5174d56..07a1acd7e9 100644 --- a/lib/gnutls_pk.h +++ b/lib/gnutls_pk.h @@ -33,6 +33,8 @@ extern gnutls_crypto_pk_st _gnutls_pk_ops; #define _gnutls_pk_decrypt( algo, ciphertext, plaintext, params) _gnutls_pk_ops.decrypt( algo, ciphertext, plaintext, params) #define _gnutls_pk_sign( algo, sig, data, params) _gnutls_pk_ops.sign( algo, sig, data, params) #define _gnutls_pk_verify( algo, data, sig, params) _gnutls_pk_ops.verify( algo, data, sig, params) +#define _gnutls_pk_derive( algo, out, pub, priv) _gnutls_pk_ops.derive( algo, out, pub, priv) +#define _gnutls_pk_generate( algo, bits, priv) _gnutls_pk_ops.generate( algo, bits, priv) inline static int _gnutls_pk_fixup (gnutls_pk_algorithm_t algo, gnutls_direction_t direction, diff --git a/lib/gnutls_priority.c b/lib/gnutls_priority.c index ec3dee3a4c..c06a22dc28 100644 --- a/lib/gnutls_priority.c +++ b/lib/gnutls_priority.c @@ -215,6 +215,12 @@ gnutls_certificate_type_set_priority (gnutls_session_t session, #endif } +static const int supported_ecc_default[] = { + GNUTLS_ECC_CURVE_SECP256R1, + GNUTLS_ECC_CURVE_SECP384R1, + 0 +}; + static const int protocol_priority[] = { GNUTLS_TLS1_2, GNUTLS_TLS1_1, @@ -570,10 +576,12 @@ gnutls_priority_init (gnutls_priority_t * priority_cache, _set_priority (&(*priority_cache)->compression, comp_priority); _set_priority (&(*priority_cache)->cert_type, cert_type_priority); _set_priority (&(*priority_cache)->sign_algo, sign_priority_default); + _set_priority (&(*priority_cache)->supported_ecc, supported_ecc_default); i = 0; } else { + _set_priority (&(*priority_cache)->supported_ecc, supported_ecc_default); i = 1; } diff --git a/lib/gnutls_state.c b/lib/gnutls_state.c index a8111ba7a7..ab4d9d0793 100644 --- a/lib/gnutls_state.c +++ b/lib/gnutls_state.c @@ -65,6 +65,14 @@ _gnutls_session_cert_type_set (gnutls_session_t session, session->security_parameters.cert_type = ct; } +void +_gnutls_session_ecc_curve_set (gnutls_session_t session, + ecc_curve_t c) +{ + _gnutls_handshake_log("HSK[%p]: Selected ECC curve (%d)\n", session, c); + session->security_parameters.ecc_curve = c; +} + /** * gnutls_cipher_get: * @session: is a #gnutls_session_t structure. @@ -443,6 +451,10 @@ gnutls_deinit (gnutls_session_t session) if (session->key != NULL) { + gnutls_pk_params_release(&session->key->ecdh_params); + _gnutls_mpi_release (&session->key->ecdh_x); + _gnutls_mpi_release (&session->key->ecdh_y); + _gnutls_mpi_release (&session->key->KEY); _gnutls_mpi_release (&session->key->client_Y); _gnutls_mpi_release (&session->key->client_p); diff --git a/lib/gnutls_state.h b/lib/gnutls_state.h index 8132a2ffcd..edd4b0dab1 100644 --- a/lib/gnutls_state.h +++ b/lib/gnutls_state.h @@ -30,6 +30,16 @@ void _gnutls_session_cert_type_set (gnutls_session_t session, gnutls_certificate_type_t); + +inline static ecc_curve_t _gnutls_session_ecc_curve_get(gnutls_session_t session) +{ + return session->security_parameters.ecc_curve; +} + +void +_gnutls_session_ecc_curve_set (gnutls_session_t session, + ecc_curve_t c); + void _gnutls_record_set_default_version (gnutls_session_t session, unsigned char major, unsigned char minor); diff --git a/lib/includes/gnutls/crypto.h b/lib/includes/gnutls/crypto.h index a1cf4b5ba8..0f37a6def0 100644 --- a/lib/includes/gnutls/crypto.h +++ b/lib/includes/gnutls/crypto.h @@ -278,6 +278,16 @@ extern "C" * [2] is g * [3] is y (public key) * [4] is x (private key only) + * + * ECDH: + * [0] is prime + * [1] is order + * [2] is Gx + * [3] is Gy + * [4] is x + * [5] is y + * [6] is z + * [7] is k (private key) */ /** @@ -311,7 +321,6 @@ extern "C" int (*verify) (gnutls_pk_algorithm_t, const gnutls_datum_t * data, const gnutls_datum_t * signature, const gnutls_pk_params_st * pub); - int (*generate) (gnutls_pk_algorithm_t, unsigned int nbits, gnutls_pk_params_st *); /* this function should convert params to ones suitable @@ -319,6 +328,10 @@ extern "C" */ int (*pk_fixup_private_params) (gnutls_pk_algorithm_t, gnutls_direction_t, gnutls_pk_params_st *); + int (*derive) (gnutls_pk_algorithm_t, gnutls_datum_t * out, + const gnutls_pk_params_st * priv, + const gnutls_pk_params_st * pub); + } gnutls_crypto_pk_st; diff --git a/lib/includes/gnutls/gnutls.h.in b/lib/includes/gnutls/gnutls.h.in index f85b6b397b..053970f3b4 100644 --- a/lib/includes/gnutls/gnutls.h.in +++ b/lib/includes/gnutls/gnutls.h.in @@ -129,6 +129,7 @@ extern "C" * @GNUTLS_KX_DHE_DSS: DHE-DSS key-exchange algorithm. * @GNUTLS_KX_DHE_RSA: DHE-RSA key-exchange algorithm. * @GNUTLS_KX_ANON_DH: Anon-DH key-exchange algorithm. + * @GNUTLS_KX_ANON_ECDH: Anon-ECDH key-exchange algorithm. * @GNUTLS_KX_SRP: SRP key-exchange algorithm. * @GNUTLS_KX_RSA_EXPORT: RSA-EXPORT key-exchange algorithm. * @GNUTLS_KX_SRP_RSA: SRP-RSA key-exchange algorithm. @@ -150,7 +151,8 @@ extern "C" GNUTLS_KX_SRP_RSA = 7, GNUTLS_KX_SRP_DSS = 8, GNUTLS_KX_PSK = 9, - GNUTLS_KX_DHE_PSK = 10 + GNUTLS_KX_DHE_PSK = 10, + GNUTLS_KX_ANON_ECDH = 11, } gnutls_kx_algorithm_t; /** @@ -163,7 +165,8 @@ extern "C" typedef enum { GNUTLS_PARAMS_RSA_EXPORT = 1, - GNUTLS_PARAMS_DH = 2 + GNUTLS_PARAMS_DH = 2, + GNUTLS_PARAMS_ECDH = 3, } gnutls_params_type_t; /** @@ -554,6 +557,7 @@ extern "C" * @GNUTLS_PK_RSA: RSA public-key algorithm. * @GNUTLS_PK_DSA: DSA public-key algorithm. * @GNUTLS_PK_DH: Diffie-Hellman algorithm. Used to generate parameters. + * @GNUTLS_PK_ECDH: Elliptic curve Diffie-Hellman algorithm. Used to generate parameters. * * Enumeration of different public-key algorithms. */ @@ -562,7 +566,8 @@ extern "C" GNUTLS_PK_UNKNOWN = 0, GNUTLS_PK_RSA = 1, GNUTLS_PK_DSA = 2, - GNUTLS_PK_DH = 3 + GNUTLS_PK_DH = 3, + GNUTLS_PK_ECDH = 4, } gnutls_pk_algorithm_t; const char *gnutls_pk_algorithm_get_name (gnutls_pk_algorithm_t algorithm); @@ -647,6 +652,9 @@ extern "C" struct gnutls_dh_params_int; typedef struct gnutls_dh_params_int *gnutls_dh_params_t; + struct gnutls_ecdh_params_int; + typedef struct gnutls_ecdh_params_int *gnutls_ecdh_params_t; + /* XXX ugly. */ struct gnutls_x509_privkey_int; typedef struct gnutls_x509_privkey_int *gnutls_rsa_params_t; @@ -667,6 +675,7 @@ extern "C" union params { gnutls_dh_params_t dh; + gnutls_ecdh_params_t ecdh; gnutls_rsa_params_t rsa_export; } params; int deinit; @@ -1750,6 +1759,7 @@ extern "C" #define GNUTLS_E_CRYPTO_INIT_FAILED -318 #define GNUTLS_E_TIMEDOUT -319 #define GNUTLS_E_USER_ERROR -320 +#define GNUTLS_E_ECC_NO_SUPPORTED_CURVES -321 #define GNUTLS_E_UNIMPLEMENTED_FEATURE -1250 diff --git a/lib/nettle/Makefile.am b/lib/nettle/Makefile.am index e902e774d5..0516800762 100644 --- a/lib/nettle/Makefile.am +++ b/lib/nettle/Makefile.am @@ -34,4 +34,9 @@ endif noinst_LTLIBRARIES = libcrypto.la -libcrypto_la_SOURCES = pk.c mpi.c mac.c cipher.c rnd.c init.c egd.c egd.h +libcrypto_la_SOURCES = pk.c mpi.c mac.c cipher.c rnd.c init.c egd.c egd.h \ + multi.c ecc_free.c ecc.h ecc_make_key.c ecc_shared_secret.c \ + ecc_test.c ltc_ecc_map.c \ + ltc_ecc_mulmod.c ltc_ecc_points.c \ + ltc_ecc_projective_add_point.c ltc_ecc_projective_dbl_point.c \ + mp_unsigned_bin.c ecc_sign_hash.c ecc_verify_hash.c diff --git a/lib/nettle/ecc.h b/lib/nettle/ecc.h new file mode 100644 index 0000000000..0ba3b0b08c --- /dev/null +++ b/lib/nettle/ecc.h @@ -0,0 +1,123 @@ +#include <gmp.h> +#include <nettle/nettle-types.h> +#include <nettle/dsa.h> +#include <stdlib.h> +#include <stdint.h> +#include <string.h> +#include <assert.h> + +#define LTC_MECC +#define ECC256 + +#define PK_PRIVATE 1 +#define PK_PUBLIC 2 + +/* ---- ECC Routines ---- */ +/* size of our temp buffers for exported keys */ +#define ECC_BUF_SIZE 512 + +/* max private key size */ +#define ECC_MAXSIZE 66 + +/** Structure defines a NIST GF(p) curve */ +typedef struct { + /** The size of the curve in octets */ + int size; + + /** name of curve */ + const char *name; + + /** The prime that defines the field the curve is in (encoded in hex) */ + const char *prime; + + /** The fields B param (hex) */ + const char *B; + + /** The order of the curve (hex) */ + const char *order; + + /** The x co-ordinate of the base point on the curve (hex) */ + const char *Gx; + + /** The y co-ordinate of the base point on the curve (hex) */ + const char *Gy; +} ltc_ecc_set_type; + +/** A point on a ECC curve, stored in Jacbobian format such that (x,y,z) => (x/z^2, y/z^3, 1) when interpretted as affine */ +typedef struct { + /** The x co-ordinate */ + mpz_t x; + + /** The y co-ordinate */ + mpz_t y; + + /** The z co-ordinate */ + mpz_t z; +} ecc_point; + +/** An ECC key */ +typedef struct { + /** Type of key, PK_PRIVATE or PK_PUBLIC */ + int type; + + mpz_t prime; + mpz_t order; + mpz_t Gx; + mpz_t Gy; + + /** The public key */ + ecc_point pubkey; + + /** The private key */ + mpz_t k; +} ecc_key; + +/** the ECC params provided */ +extern const ltc_ecc_set_type ltc_ecc_sets[]; + +int ecc_test(void); +void ecc_sizes(int *low, int *high); +int ecc_get_size(ecc_key *key); + +int ecc_make_key(void *random_ctx, nettle_random_func random, ecc_key *key, const ltc_ecc_set_type *dp); +int ecc_make_key_ex(void *random_ctx, nettle_random_func random, ecc_key *key, mpz_t prime, mpz_t order, mpz_t Gx, mpz_t Gy); +void ecc_free(ecc_key *key); + +int ecc_shared_secret(ecc_key *private_key, ecc_key *public_key, + unsigned char *out, unsigned long *outlen); + +int ecc_sign_hash(const unsigned char *in, unsigned long inlen, + struct dsa_signature *signature, + void *random_ctx, nettle_random_func random, ecc_key *key); + +int ecc_verify_hash(struct dsa_signature * signature, + const unsigned char *hash, unsigned long hashlen, + int *stat, ecc_key *key); + +/* low level functions */ +ecc_point *ltc_ecc_new_point(void); +void ltc_ecc_del_point(ecc_point *p); +int ltc_ecc_is_valid_idx(int n); + +/* point ops (mp == montgomery digit) */ +/* R = 2P */ +int ltc_ecc_projective_dbl_point(ecc_point *P, ecc_point *R, mpz_t modulus); + +/* R = P + Q */ +int ltc_ecc_projective_add_point(ecc_point *P, ecc_point *Q, ecc_point *R, mpz_t modulus); + +/* R = kG */ +int ltc_ecc_mulmod(mpz_t k, ecc_point *G, ecc_point *R, mpz_t modulus, int map); + +/* map P to affine from projective */ +int ltc_ecc_map(ecc_point *P, mpz_t modulus); + +/* helper functions */ +int mp_init_multi(mpz_t *a, ...); +void mp_clear_multi(mpz_t *a, ...); +unsigned long mp_unsigned_bin_size(mpz_t a); +int mp_to_unsigned_bin(mpz_t a, unsigned char *b); +int mp_read_unsigned_bin(mpz_t a, unsigned char *b, unsigned long len); +#define mp_isodd(a) (mpz_size(a) > 0 ? (mpz_getlimbn(a, 0) & 1 ? 1 : 0) : 0) + +#define MP_DIGIT_BIT (sizeof(mp_limb_t) * 8 - GMP_NAIL_BITS) diff --git a/lib/nettle/ecc_free.c b/lib/nettle/ecc_free.c new file mode 100644 index 0000000000..7cc9774db2 --- /dev/null +++ b/lib/nettle/ecc_free.c @@ -0,0 +1,40 @@ +/* LibTomCrypt, modular cryptographic library -- Tom St Denis + * + * LibTomCrypt is a library that provides various cryptographic + * algorithms in a highly modular and flexible manner. + * + * The library is free for all purposes without any express + * guarantee it works. + * + * Tom St Denis, tomstdenis@gmail.com, http://libtom.org + */ + +/* Implements ECC over Z/pZ for curve y^2 = x^3 - 3x + b + * + * All curves taken from NIST recommendation paper of July 1999 + * Available at http://csrc.nist.gov/cryptval/dss.htm + */ +#include "ecc.h" + +/** + @file ecc_free.c + ECC Crypto, Tom St Denis +*/ + +#ifdef LTC_MECC + +/** + Free an ECC key from memory + @param key The key you wish to free +*/ +void ecc_free(ecc_key *key) +{ + assert(key != NULL); + mp_clear_multi(&key->pubkey.x, &key->pubkey.y, &key->pubkey.z, &key->k, &key->prime, &key->order, &key->Gx, &key->Gy, NULL); +} + +#endif +/* $Source: /cvs/libtom/libtomcrypt/src/pk/ecc/ecc_free.c,v $ */ +/* $Revision: 1.6 $ */ +/* $Date: 2007/05/12 14:32:35 $ */ + diff --git a/lib/nettle/ecc_make_key.c b/lib/nettle/ecc_make_key.c new file mode 100644 index 0000000000..3ca757115a --- /dev/null +++ b/lib/nettle/ecc_make_key.c @@ -0,0 +1,125 @@ +/* LibTomCrypt, modular cryptographic library -- Tom St Denis + * + * LibTomCrypt is a library that provides various cryptographic + * algorithms in a highly modular and flexible manner. + * + * The library is free for all purposes without any express + * guarantee it works. + * + * Tom St Denis, tomstdenis@gmail.com, http://libtom.org + */ + +/* Implements ECC over Z/pZ for curve y^2 = x^3 - 3x + b + * + * All curves taken from NIST recommendation paper of July 1999 + * Available at http://csrc.nist.gov/cryptval/dss.htm + */ +#include "ecc.h" + +/** + @file ecc_make_key.c + ECC Crypto, Tom St Denis +*/ + +#ifdef LTC_MECC + +/** + Make a new ECC key + @param prng An active PRNG state + @param wprng The index of the PRNG you wish to use + @param keysize The keysize for the new key (in octets from 20 to 65 bytes) + @param key [out] Destination of the newly created key + @return 0 if successful, upon error all allocated memory will be freed +*/ + +int ecc_make_key_ex(void *random_ctx, nettle_random_func random, ecc_key *key, mpz_t prime, mpz_t order, mpz_t Gx, mpz_t Gy) +{ + int err; + ecc_point *base; + unsigned char *buf; + int keysize; + + assert(key != NULL); + assert(random != NULL); + + keysize = mp_unsigned_bin_size(order); + + /* allocate ram */ + base = NULL; + buf = malloc(keysize); + if (buf == NULL) { + return -1; + } + + /* make up random string */ + random(random_ctx, keysize, buf); + + /* setup the key variables */ + if ((err = mp_init_multi(&key->pubkey.x, &key->pubkey.y, &key->pubkey.z, &key->k, &key->prime, &key->order, &key->Gx, &key->Gy, NULL)) != 0) { + goto ERR_BUF; + } + base = ltc_ecc_new_point(); + if (base == NULL) { + err = -1; + goto errkey; + } + + /* read in the specs for this key */ + mpz_set(key->prime, prime); + mpz_set(key->order, order); + mpz_set(key->Gx, Gx); + mpz_set(key->Gy, Gy); + + mpz_set(base->x, key->Gx); + mpz_set(base->y, key->Gy); + mpz_set_ui(base->z, 1); + if ((err = mp_read_unsigned_bin(key->k, (unsigned char *)buf, keysize)) != 0) { goto errkey; } + + /* the key should be smaller than the order of base point */ + if (mpz_cmp(key->k, key->order) >= 0) { + mpz_mod(key->k, key->k, key->order); + } + /* make the public key */ + if ((err = ltc_ecc_mulmod(key->k, base, &key->pubkey, key->prime, 1)) != 0) { goto errkey; } + key->type = PK_PRIVATE; + + /* free up ram */ + err = 0; + goto cleanup; +errkey: + mp_clear_multi(&key->pubkey.x, &key->pubkey.y, &key->pubkey.z, &key->k, &key->order, &key->prime, &key->Gx, &key->Gy, NULL); +cleanup: + ltc_ecc_del_point(base); +ERR_BUF: + free(buf); + return err; +} + +int ecc_make_key(void *random_ctx, nettle_random_func random, ecc_key *key, const ltc_ecc_set_type *dp) +{ + mpz_t prime, order, Gx, Gy; + int err; + + /* setup the key variables */ + if ((err = mp_init_multi(&prime, &order, &Gx, &Gy, NULL)) != 0) { + goto cleanup; + } + + /* read in the specs for this key */ + mpz_set_str(prime, (char *)dp->prime, 16); + mpz_set_str(order, (char *)dp->order, 16); + mpz_set_str(Gx, (char *)dp->Gx, 16); + mpz_set_str(Gy, (char *)dp->Gy, 16); + + err = ecc_make_key_ex(random_ctx, random, key, prime, order, Gx, Gy); + + mp_clear_multi(&prime, &order, &Gx, &Gy, NULL); +cleanup: + return err; +} + +#endif +/* $Source: /cvs/libtom/libtomcrypt/src/pk/ecc/ecc_make_key.c,v $ */ +/* $Revision: 1.13 $ */ +/* $Date: 2007/05/12 14:32:35 $ */ + diff --git a/lib/nettle/ecc_shared_secret.c b/lib/nettle/ecc_shared_secret.c new file mode 100644 index 0000000000..a3eb46a868 --- /dev/null +++ b/lib/nettle/ecc_shared_secret.c @@ -0,0 +1,80 @@ +/* LibTomCrypt, modular cryptographic library -- Tom St Denis + * + * LibTomCrypt is a library that provides various cryptographic + * algorithms in a highly modular and flexible manner. + * + * The library is free for all purposes without any express + * guarantee it works. + * + * Tom St Denis, tomstdenis@gmail.com, http://libtom.org + */ + +/* Implements ECC over Z/pZ for curve y^2 = x^3 - 3x + b + * + * All curves taken from NIST recommendation paper of July 1999 + * Available at http://csrc.nist.gov/cryptval/dss.htm + */ +#include "ecc.h" +#include <string.h> + +/** + @file ecc_shared_secret.c + ECC Crypto, Tom St Denis +*/ + +#ifdef LTC_MECC + +/** + Create an ECC shared secret between two keys + @param private_key The private ECC key + @param public_key The public key + @param out [out] Destination of the shared secret (Conforms to EC-DH from ANSI X9.63) + @param outlen [in/out] The max size and resulting size of the shared secret + @return 0 if successful +*/ +int ecc_shared_secret(ecc_key *private_key, ecc_key *public_key, + unsigned char *out, unsigned long *outlen) +{ + unsigned long x; + ecc_point *result; + int err; + + assert(private_key != NULL); + assert(public_key != NULL); + assert(out != NULL); + assert(outlen != NULL); + + /* type valid? */ + if (private_key->type != PK_PRIVATE) { + return -1; + } + + /* make new point */ + result = ltc_ecc_new_point(); + if (result == NULL) { + return -1; + } + + if ((err = ltc_ecc_mulmod(private_key->k, &public_key->pubkey, result, private_key->prime, 1)) != 0) { goto done; } + + x = (unsigned long)mp_unsigned_bin_size(private_key->prime); + if (*outlen < x) { + *outlen = x; + err = -1; + goto done; + } + memset(out, 0, x); + if ((err = mp_to_unsigned_bin(result->x, out + (x - mp_unsigned_bin_size(result->x)))) != 0) { goto done; } + + err = 0; + *outlen = x; +done: + ltc_ecc_del_point(result); + return err; +} + +#endif +/* $Source: /cvs/libtom/libtomcrypt/src/pk/ecc/ecc_shared_secret.c,v $ */ +/* $Revision: 1.10 $ */ +/* $Date: 2007/05/12 14:32:35 $ */ + diff --git a/lib/nettle/ecc_sign_hash.c b/lib/nettle/ecc_sign_hash.c new file mode 100644 index 0000000000..b2da7f22c6 --- /dev/null +++ b/lib/nettle/ecc_sign_hash.c @@ -0,0 +1,103 @@ +/* LibTomCrypt, modular cryptographic library -- Tom St Denis + * + * LibTomCrypt is a library that provides various cryptographic + * algorithms in a highly modular and flexible manner. + * + * The library is free for all purposes without any express + * guarantee it works. + * + * Tom St Denis, tomstdenis@gmail.com, http://libtom.org + */ + +/* Implements ECC over Z/pZ for curve y^2 = x^3 - 3x + b + * + * All curves taken from NIST recommendation paper of July 1999 + * Available at http://csrc.nist.gov/cryptval/dss.htm + */ +#include "ecc.h" +#include <nettle/dsa.h> + +/** + @file ecc_sign_hash.c + ECC Crypto, Tom St Denis +*/ + +#ifdef LTC_MECC + +/** + Sign a message digest + @param in The message digest to sign + @param inlen The length of the digest + @param signature The destination for the signature + @param prng An active PRNG state + @param wprng The index of the PRNG you wish to use + @param key A private ECC key + @return 0 if successful +*/ +int ecc_sign_hash(const unsigned char *in, unsigned long inlen, + struct dsa_signature *signature, + void *random_ctx, nettle_random_func random, ecc_key *key) +{ + ecc_key pubkey; + mpz_t r, s, e; + int err; + + assert(in != NULL); + assert(signature != NULL); + assert(key != NULL); + + /* is this a private key? */ + if (key->type != PK_PRIVATE) { + return -1; + } + + /* get the hash and load it as a bignum into 'e' */ + /* init the bignums */ + if ((err = mp_init_multi(&r, &s, &e, NULL)) != 0) { + return err; + } + if ((err = mp_read_unsigned_bin(e, (unsigned char *)in, (int)inlen)) != 0) { goto errnokey; } + + /* make up a key and export the public copy */ + for (;;) { + if ((err = ecc_make_key_ex(random_ctx, random, &pubkey, key->prime, key->order, key->Gx, key->Gy)) != 0) { + goto errnokey; + } + + /* find r = x1 mod n */ + mpz_mod(r, pubkey.pubkey.x, pubkey.order); + + if (mpz_cmp_ui(r, 0) == 0) { + ecc_free(&pubkey); + } else { + /* find s = (e + xr)/k */ + mpz_invert(pubkey.k, pubkey.k, pubkey.order); + + /* mulmod */ + mpz_mul(s, key->k, r); + mpz_mod(s, s, pubkey.order); + mpz_add(s, e, s); + mpz_mod(s, s, pubkey.order); + + mpz_mul(s, s, pubkey.k); + mpz_mod(s, s, pubkey.order); + ecc_free(&pubkey); + if (mpz_cmp_ui(s,0) != 0) { + break; + } + } + } + + memcpy(&signature->r, &r, sizeof(signature->r)); + memcpy(&signature->s, &s, sizeof(signature->s)); + +errnokey: + mp_clear_multi(&e, NULL); + return err; +} + +#endif +/* $Source: /cvs/libtom/libtomcrypt/src/pk/ecc/ecc_sign_hash.c,v $ */ +/* $Revision: 1.11 $ */ +/* $Date: 2007/05/12 14:32:35 $ */ + diff --git a/lib/nettle/ecc_test.c b/lib/nettle/ecc_test.c new file mode 100644 index 0000000000..4c74a9f7a6 --- /dev/null +++ b/lib/nettle/ecc_test.c @@ -0,0 +1,125 @@ +/* LibTomCrypt, modular cryptographic library -- Tom St Denis + * + * LibTomCrypt is a library that provides various cryptographic + * algorithms in a highly modular and flexible manner. + * + * The library is free for all purposes without any express + * guarantee it works. + * + * Tom St Denis, tomstdenis@gmail.com, http://libtom.org + */ + +/* Implements ECC over Z/pZ for curve y^2 = x^3 - 3x + b + * + * All curves taken from NIST recommendation paper of July 1999 + * Available at http://csrc.nist.gov/cryptval/dss.htm + */ +#include "ecc.h" +#include "gnettle.h" +#include <gnutls_int.h> +#include <gnutls_algorithms.h> + +/** + @file ecc_test.c + ECC Crypto, Tom St Denis +*/ + +#ifdef LTC_MECC + +/** + Perform on the ECC system + @return 0 if successful +*/ +int ecc_test(void) +{ + mpz_t modulus, order; + ecc_point *G, *GG; + int i, err; + + if ((err = mp_init_multi(&modulus, &order, NULL)) != 0) { + return err; + } + + G = ltc_ecc_new_point(); + GG = ltc_ecc_new_point(); + if (G == NULL || GG == NULL) { + mp_clear_multi(&modulus,&order, NULL); + ltc_ecc_del_point(G); + ltc_ecc_del_point(GG); + return -1; + } + + for (i = 1; i<=2; i++) { + const gnutls_ecc_curve_entry_st *st = _gnutls_ecc_curve_get_params (i); + + printf("Testing %s (%d)\n", _gnutls_ecc_curve_get_name(i), i); + + if (mpz_set_str(modulus, (char *)st->prime, 16) != 0) { +fprintf(stderr, "XXX %d\n", __LINE__); + err = -1; + goto done; + } + + if (mpz_set_str(order, (char *)st->order, 16) != 0) { +fprintf(stderr, "XXX %d\n", __LINE__); + err = -1; + goto done; + } + + /* is prime actually prime? */ + if ((err = mpz_probab_prime_p(modulus, PRIME_CHECK_PARAM)) <= 0) { +fprintf(stderr, "XXX %d\n", __LINE__); + err = -1; + goto done; + } + + if ((err = mpz_probab_prime_p(order, PRIME_CHECK_PARAM)) <= 0) { +fprintf(stderr, "XXX %d\n", __LINE__); + err = -1; + goto done; + } + + if (mpz_set_str(G->x, (char *)st->Gx, 16) != 0) { +fprintf(stderr, "XXX %d\n", __LINE__); + err = -1; + goto done; + } + + if (mpz_set_str(G->y, (char *)st->Gy, 16) != 0) { +fprintf(stderr, "XXX %d\n", __LINE__); + err = -1; + goto done; + } + mpz_set_ui(G->z, 1); + + /* then we should have G == (order + 1)G */ + mpz_add_ui(order, order, 1); + if ((err = ltc_ecc_mulmod(order, G, GG, modulus, 1)) != 0) { goto done; } + + if (mpz_cmp(G->y, GG->y) != 0) { +fprintf(stderr, "XXX %d\n", __LINE__); + err = -1; + goto done; + } + + if (mpz_cmp(G->x, GG->x) != 0) { +fprintf(stderr, "XXX %d\n", __LINE__); + err = -1; + goto done; + } + + } + err = 0; +done: + ltc_ecc_del_point(GG); + ltc_ecc_del_point(G); + mp_clear_multi(&order, &modulus, NULL); + return err; +} + +#endif + +/* $Source: /cvs/libtom/libtomcrypt/src/pk/ecc/ecc_test.c,v $ */ +/* $Revision: 1.12 $ */ +/* $Date: 2007/05/12 14:32:35 $ */ + diff --git a/lib/nettle/ecc_verify_hash.c b/lib/nettle/ecc_verify_hash.c new file mode 100644 index 0000000000..71315f3795 --- /dev/null +++ b/lib/nettle/ecc_verify_hash.c @@ -0,0 +1,135 @@ +/* LibTomCrypt, modular cryptographic library -- Tom St Denis + * + * LibTomCrypt is a library that provides various cryptographic + * algorithms in a highly modular and flexible manner. + * + * The library is free for all purposes without any express + * guarantee it works. + * + * Tom St Denis, tomstdenis@gmail.com, http://libtom.org + */ + +/* Implements ECC over Z/pZ for curve y^2 = x^3 - 3x + b + * + * All curves taken from NIST recommendation paper of July 1999 + * Available at http://csrc.nist.gov/cryptval/dss.htm + */ +#include "ecc.h" + +/** + @file ecc_verify_hash.c + ECC Crypto, Tom St Denis +*/ + +#ifdef LTC_MECC + +/* verify + * + * w = s^-1 mod n + * u1 = xw + * u2 = rw + * X = u1*G + u2*Q + * v = X_x1 mod n + * accept if v == r + */ + +/** + Verify an ECC signature + @param signature The signature to verify + @param hash The hash (message digest) that was signed + @param hashlen The length of the hash (octets) + @param stat Result of signature, 1==valid, 0==invalid + @param key The corresponding public ECC key + @return 0 if successful (even if the signature is not valid) +*/ +int ecc_verify_hash(struct dsa_signature * signature, + const unsigned char *hash, unsigned long hashlen, + int *stat, ecc_key *key) +{ + ecc_point *mG, *mQ; + mpz_t v, w, u1, u2, e; + int err; + + assert(signature != NULL); + assert(hash != NULL); + assert(stat != NULL); + assert(key != NULL); + + /* default to invalid signature */ + *stat = 0; + + /* allocate ints */ + if ((err = mp_init_multi(&v, &w, &u1, &u2, &e, NULL)) != 0) { + return -1; + } + + /* allocate points */ + mG = ltc_ecc_new_point(); + mQ = ltc_ecc_new_point(); + if (mQ == NULL || mG == NULL) { + err = -1; + goto error; + } + + /* check for zero */ + if (mpz_cmp_ui(signature->r,0) == 0 || mpz_cmp_ui(signature->s,0) == 0 || + mpz_cmp(signature->r, key->order) >= 0 || mpz_cmp(signature->s, key->order) >= 0) { + err = -1; + goto error; + } + + /* read hash */ + if ((err = mp_read_unsigned_bin(e, (unsigned char *)hash, (int)hashlen)) != 0) { goto error; } + + /* w = s^-1 mod n */ + mpz_invert(w, signature->s, key->order); + + /* u1 = ew */ + mpz_mul(u1, e, w); + mpz_mod(u1, u1, key->order); + + /* u2 = rw */ + mpz_mul(u2, signature->r, w); + mpz_mod(u2, u2, key->order); + + /* find mG and mQ */ + mpz_set(mG->x, key->Gx); + mpz_set(mG->y, key->Gy); + mpz_set_ui(mG->z, 1); + + mpz_set(mQ->x, key->pubkey.x); + mpz_set(mQ->y, key->pubkey.y); + mpz_set(mQ->z, key->pubkey.z); + + /* compute u1*mG + u2*mQ = mG */ + if ((err = ltc_ecc_mulmod(u1, mG, mG, key->prime, 0)) != 0) { goto error; } + if ((err = ltc_ecc_mulmod(u2, mQ, mQ, key->prime, 0)) != 0) { goto error; } + + /* add them */ + if ((err = ltc_ecc_projective_add_point(mQ, mG, mG, key->prime)) != 0) { goto error; } + + /* reduce */ + if ((err = ltc_ecc_map(mG, key->prime)) != 0) { goto error; } + + /* v = X_x1 mod n */ + mpz_mod(v, mG->x, key->order); + + /* does v == r */ + if (mpz_cmp(v, signature->r) == 0) { + *stat = 1; + } + + /* clear up and return */ + err = 0; +error: + ltc_ecc_del_point(mG); + ltc_ecc_del_point(mQ); + mp_clear_multi(&v, &w, &u1, &u2, &e, NULL); + return err; +} + +#endif +/* $Source: /cvs/libtom/libtomcrypt/src/pk/ecc/ecc_verify_hash.c,v $ */ +/* $Revision: 1.14 $ */ +/* $Date: 2007/05/12 14:32:35 $ */ + diff --git a/lib/nettle/gnettle.h b/lib/nettle/gnettle.h new file mode 100644 index 0000000000..768590c73d --- /dev/null +++ b/lib/nettle/gnettle.h @@ -0,0 +1,2 @@ +#define PRIME_CHECK_PARAM 8 + diff --git a/lib/nettle/ltc_ecc_map.c b/lib/nettle/ltc_ecc_map.c new file mode 100644 index 0000000000..f22426009d --- /dev/null +++ b/lib/nettle/ltc_ecc_map.c @@ -0,0 +1,73 @@ +/* LibTomCrypt, modular cryptographic library -- Tom St Denis + * + * LibTomCrypt is a library that provides various cryptographic + * algorithms in a highly modular and flexible manner. + * + * The library is free for all purposes without any express + * guarantee it works. + * + * Tom St Denis, tomstdenis@gmail.com, http://libtom.org + */ + +/* Implements ECC over Z/pZ for curve y^2 = x^3 - 3x + b + * + * All curves taken from NIST recommendation paper of July 1999 + * Available at http://csrc.nist.gov/cryptval/dss.htm + */ +#include "ecc.h" + +/** + @file ltc_ecc_map.c + ECC Crypto, Tom St Denis +*/ + +#ifdef LTC_MECC + +/** + Map a projective jacbobian point back to affine space + @param P [in/out] The point to map + @param modulus The modulus of the field the ECC curve is in + @param mp The "b" value from montgomery_setup() + @return 0 on success +*/ +int ltc_ecc_map(ecc_point *P, mpz_t modulus) +{ + mpz_t t1, t2; + int err; + + assert(P != NULL); + + if ((err = mp_init_multi(&t1, &t2, NULL)) != 0) { + return -1; + } + + mpz_mod(P->z, P->z, modulus); + + /* get 1/z */ + mpz_invert(t1, P->z, modulus); + + /* get 1/z^2 and 1/z^3 */ + mpz_mul(t2, t1, t1); + mpz_mod(t2, t2, modulus); + mpz_mul(t1, t1, t2); + mpz_mod(t1, t1, modulus); + + /* multiply against x/y */ + mpz_mul(P->x, P->x, t2); + mpz_mod(P->x, P->x, modulus); + mpz_mul(P->y, P->y, t1); + mpz_mod(P->y, P->y, modulus); + mpz_set_ui(P->z, 1); + + err = 0; + + mp_clear_multi(&t1, &t2, NULL); + return err; +} + +#endif + +/* $Source: /cvs/libtom/libtomcrypt/src/pk/ecc/ltc_ecc_map.c,v $ */ +/* $Revision: 1.7 $ */ +/* $Date: 2007/05/12 14:32:35 $ */ + diff --git a/lib/nettle/ltc_ecc_mulmod.c b/lib/nettle/ltc_ecc_mulmod.c new file mode 100644 index 0000000000..ab845ce014 --- /dev/null +++ b/lib/nettle/ltc_ecc_mulmod.c @@ -0,0 +1,141 @@ +/* LibTomCrypt, modular cryptographic library -- Tom St Denis + * + * LibTomCrypt is a library that provides various cryptographic + * algorithms in a highly modular and flexible manner. + * + * The library is free for all purposes without any express + * guarantee it works. + * + * Tom St Denis, tomstdenis@gmail.com, http://libtom.org + */ + +/* Implements ECC over Z/pZ for curve y^2 = x^3 - 3x + b + * + * All curves taken from NIST recommendation paper of July 1999 + * Available at http://csrc.nist.gov/cryptval/dss.htm + */ +#include "ecc.h" + +/** + @file ltc_ecc_mulmod_timing.c + ECC Crypto, Tom St Denis +*/ + +#ifdef LTC_MECC + +/** + Perform a point multiplication (timing resistant) + @param k The scalar to multiply by + @param G The base point + @param R [out] Destination for kG + @param modulus The modulus of the field the ECC curve is in + @param map Boolean whether to map back to affine or not (1==map, 0 == leave in projective) + @return 0 on success +*/ +int ltc_ecc_mulmod(mpz_t k, ecc_point *G, ecc_point *R, mpz_t modulus, int map) +{ + ecc_point *tG, *M[3]; + int i, j, err; + unsigned long buf; + int first, bitbuf, bitcpy, bitcnt, mode, digidx; + + assert(k != NULL); + assert(G != NULL); + assert(R != NULL); + assert(modulus != NULL); + + /* alloc ram for window temps */ + for (i = 0; i < 3; i++) { + M[i] = ltc_ecc_new_point(); + if (M[i] == NULL) { + for (j = 0; j < i; j++) { + ltc_ecc_del_point(M[j]); + } + return -1; + } + } + + /* make a copy of G incase R==G */ + tG = ltc_ecc_new_point(); + if (tG == NULL) { err = -1; goto done; } + + /* tG = G and convert to montgomery */ + mpz_set(tG->x, G->x); + mpz_set(tG->y, G->y); + mpz_set(tG->z, G->z); + + /* calc the M tab */ + /* M[0] == G */ + mpz_set(M[0]->x, tG->x); + mpz_set(M[0]->y, tG->y); + mpz_set(M[0]->z, tG->z); + /* M[1] == 2G */ + if ((err = ltc_ecc_projective_dbl_point(tG, M[1], modulus)) != 0) { goto done; } + + /* setup sliding window */ + mode = 0; + bitcnt = 1; + buf = 0; + digidx = mpz_size(k) - 1; + bitcpy = bitbuf = 0; + first = 1; + + /* perform ops */ + for (;;) { + /* grab next digit as required */ + if (--bitcnt == 0) { + if (digidx == -1) { + break; + } + buf = mpz_getlimbn(k, digidx); + bitcnt = (int) MP_DIGIT_BIT; + --digidx; + } + + /* grab the next msb from the ltiplicand */ + i = (buf >> (MP_DIGIT_BIT - 1)) & 1; + buf <<= 1; + + if (mode == 0 && i == 0) { + /* dummy operations */ + if ((err = ltc_ecc_projective_add_point(M[0], M[1], M[2], modulus)) != 0) { goto done; } + if ((err = ltc_ecc_projective_dbl_point(M[1], M[2], modulus)) != 0) { goto done; } + continue; + } + + if (mode == 0 && i == 1) { + mode = 1; + /* dummy operations */ + if ((err = ltc_ecc_projective_add_point(M[0], M[1], M[2], modulus)) != 0) { goto done; } + if ((err = ltc_ecc_projective_dbl_point(M[1], M[2], modulus)) != 0) { goto done; } + continue; + } + + if ((err = ltc_ecc_projective_add_point(M[0], M[1], M[i^1], modulus)) != 0) { goto done; } + if ((err = ltc_ecc_projective_dbl_point(M[i], M[i], modulus)) != 0) { goto done; } + } + + /* copy result out */ + mpz_set(R->x, M[0]->x); + mpz_set(R->y, M[0]->y); + mpz_set(R->z, M[0]->z); + + /* map R back from projective space */ + if (map) { + err = ltc_ecc_map(R, modulus); + } else { + err = 0; + } +done: + ltc_ecc_del_point(tG); + for (i = 0; i < 3; i++) { + ltc_ecc_del_point(M[i]); + } + return err; +} + +#endif +/* $Source: /cvs/libtom/libtomcrypt/src/pk/ecc/ltc_ecc_mulmod_timing.c,v $ */ +/* $Revision: 1.13 $ */ +/* $Date: 2007/05/12 14:32:35 $ */ + diff --git a/lib/nettle/ltc_ecc_points.c b/lib/nettle/ltc_ecc_points.c new file mode 100644 index 0000000000..93ad85d403 --- /dev/null +++ b/lib/nettle/ltc_ecc_points.c @@ -0,0 +1,60 @@ +/* LibTomCrypt, modular cryptographic library -- Tom St Denis + * + * LibTomCrypt is a library that provides various cryptographic + * algorithms in a highly modular and flexible manner. + * + * The library is free for all purposes without any express + * guarantee it works. + * + * Tom St Denis, tomstdenis@gmail.com, http://libtom.org + */ + +/* Implements ECC over Z/pZ for curve y^2 = x^3 - 3x + b + * + * All curves taken from NIST recommendation paper of July 1999 + * Available at http://csrc.nist.gov/cryptval/dss.htm + */ +#include "ecc.h" + +/** + @file ltc_ecc_points.c + ECC Crypto, Tom St Denis +*/ + +#ifdef LTC_MECC + +/** + Allocate a new ECC point + @return A newly allocated point or NULL on error +*/ +ecc_point *ltc_ecc_new_point(void) +{ + ecc_point *p; + p = calloc(1, sizeof(*p)); + if (p == NULL) { + return NULL; + } + if (mp_init_multi(&p->x, &p->y, &p->z, NULL) != 0) { + free(p); + return NULL; + } + return p; +} + +/** Free an ECC point from memory + @param p The point to free +*/ +void ltc_ecc_del_point(ecc_point *p) +{ + /* prevents free'ing null arguments */ + if (p != NULL) { + mp_clear_multi(&p->x, &p->y, &p->z, NULL); /* note: p->z may be NULL but that's ok with this function anyways */ + free(p); + } +} + +#endif +/* $Source: /cvs/libtom/libtomcrypt/src/pk/ecc/ltc_ecc_points.c,v $ */ +/* $Revision: 1.7 $ */ +/* $Date: 2007/05/12 14:32:35 $ */ + diff --git a/lib/nettle/ltc_ecc_projective_add_point.c b/lib/nettle/ltc_ecc_projective_add_point.c new file mode 100644 index 0000000000..2b008367c6 --- /dev/null +++ b/lib/nettle/ltc_ecc_projective_add_point.c @@ -0,0 +1,195 @@ +/* LibTomCrypt, modular cryptographic library -- Tom St Denis + * + * LibTomCrypt is a library that provides various cryptographic + * algorithms in a highly modular and flexible manner. + * + * The library is free for all purposes without any express + * guarantee it works. + * + * Tom St Denis, tomstdenis@gmail.com, http://libtom.org + */ + +/* Implements ECC over Z/pZ for curve y^2 = x^3 - 3x + b + * + * All curves taken from NIST recommendation paper of July 1999 + * Available at http://csrc.nist.gov/cryptval/dss.htm + */ +#include "ecc.h" + +/** + @file ltc_ecc_projective_add_point.c + ECC Crypto, Tom St Denis +*/ + +#if defined(LTC_MECC) && (!defined(LTC_MECC_ACCEL) || defined(LTM_LTC_DESC)) + +/** + Add two ECC points + @param P The point to add + @param Q The point to add + @param R [out] The destination of the double + @param modulus The modulus of the field the ECC curve is in + @param mp The "b" value from montgomery_setup() + @return 0 on success +*/ +int ltc_ecc_projective_add_point(ecc_point *P, ecc_point *Q, ecc_point *R, mpz_t modulus) +{ + mpz_t t1, t2, x, y, z; + int err; + + assert(P != NULL); + assert(Q != NULL); + assert(R != NULL); + assert(modulus != NULL); + + if ((err = mp_init_multi(&t1, &t2, &x, &y, &z, NULL)) != 0) { + return err; + } + + /* should we dbl instead? */ + mpz_sub(t1, modulus, Q->y); + + if ( (mpz_cmp(P->x, Q->x) == 0) && + (Q->z != NULL && mpz_cmp(P->z, Q->z) == 0) && + (mpz_cmp(P->y, Q->y) == 0 || mpz_cmp(P->y, t1) == 0)) { + mp_clear_multi(&t1, &t2, &x, &y, &z, NULL); + return ltc_ecc_projective_dbl_point(P, R, modulus); + } + + mpz_set(x, P->x); + mpz_set(y, P->y); + mpz_set(z, P->z); + + /* if Z is one then these are no-operations */ + if (mpz_cmp_ui(Q->z, 1) != 0) { + /* T1 = Z' * Z' */ + mpz_mul(t1, Q->z, Q->z); + mpz_mod(t1, t1, modulus); + /* X = X * T1 */ + mpz_mul(x, x, t1); + mpz_mod(x, x, modulus); + /* T1 = Z' * T1 */ + mpz_mul(t1, t1, Q->z); + mpz_mod(t1, t1, modulus); + /* Y = Y * T1 */ + mpz_mul(y, y, t1); + mpz_mod(y, y, modulus); + } + + /* T1 = Z*Z */ + mpz_mul(t1, z, z); + mpz_mod(t1, t1, modulus); + /* T2 = X' * T1 */ + mpz_mul(t2, t1, Q->x); + mpz_mod(t2, t2, modulus); + /* T1 = Z * T1 */ + mpz_mul(t1, t1, z); + mpz_mod(t1, t1, modulus); + /* T1 = Y' * T1 */ + mpz_mul(t1, t1, Q->y); + mpz_mod(t1, t1, modulus); + + /* Y = Y - T1 */ + mpz_sub(y, y, t1); + if (mpz_cmp_ui(y, 0) < 0) { + mpz_add(y, y, modulus); + } + /* T1 = 2T1 */ + mpz_add(t1, t1, t1); + if (mpz_cmp(t1, modulus) >= 0) { + mpz_sub(t1, t1, modulus); + } + /* T1 = Y + T1 */ + mpz_add(t1, t1, y); + if (mpz_cmp(t1, modulus) >= 0) { + mpz_sub(t1, t1, modulus); + } + /* X = X - T2 */ + mpz_sub(x, x, t2); + if (mpz_cmp_ui(x, 0) < 0) { + mpz_add(x, x, modulus); + } + /* T2 = 2T2 */ + mpz_add(t2, t2, t2); + if (mpz_cmp(t2, modulus) >= 0) { + mpz_sub(t2, t2, modulus); + } + /* T2 = X + T2 */ + mpz_add(t2, t2, x); + if (mpz_cmp(t2, modulus) >= 0) { + mpz_sub(t2, t2, modulus); + } + + /* if Z' != 1 */ + if (mpz_cmp_ui(Q->z, 1) != 0) { + /* Z = Z * Z' */ + mpz_mul(z, z, Q->z); + mpz_mod(z, z, modulus); + } + + /* Z = Z * X */ + mpz_mul(z, z, x); + mpz_mod(z, z, modulus); + + /* T1 = T1 * X */ + mpz_mul(t1, t1, x); + mpz_mod(t1, t1, modulus); + /* X = X * X */ + mpz_mul(x, x, x); + mpz_mod(x, x, modulus); + /* T2 = T2 * x */ + mpz_mul(t2, t2, x); + mpz_mod(t2, t2, modulus); + /* T1 = T1 * X */ + mpz_mul(t1, t1, x); + mpz_mod(t1, t1, modulus); + + /* X = Y*Y */ + mpz_mul(x, y, y); + mpz_mod(x, x, modulus); + /* X = X - T2 */ + mpz_sub(x, x, t2); + if (mpz_cmp_ui(x, 0) < 0) { + mpz_add(x, x, modulus); + } + + /* T2 = T2 - X */ + mpz_sub(t2, t2, x); + if (mpz_cmp_ui(t2, 0) < 0) { + mpz_add(t2, t2, modulus); + } + /* T2 = T2 - X */ + mpz_sub(t2, t2, x); + if (mpz_cmp_ui(t2, 0) < 0) { + mpz_add(t2, t2, modulus); + } + /* T2 = T2 * Y */ + mpz_mul(t2, t2, y); + mpz_mod(t2, t2, modulus); + /* Y = T2 - T1 */ + mpz_sub(y, t2, t1); + if (mpz_cmp_ui(y, 0) < 0) { + mpz_add(y, y, modulus); + } + /* Y = Y/2 */ + if (mp_isodd(y)) { + mpz_add(y, y, modulus); + } + mpz_divexact_ui(y, y, 2); + + mpz_set(R->x, x); + mpz_set(R->y, y); + mpz_set(R->z, z); + + err = 0; + + mp_clear_multi(&t1, &t2, &x, &y, &z, NULL); + return err; +} + +#endif + +/* $Source: /cvs/libtom/libtomcrypt/src/pk/ecc/ltc_ecc_projective_add_point.c,v $ */ +/* $Revision: 1.16 $ */ +/* $Date: 2007/05/12 14:32:35 $ */ + diff --git a/lib/nettle/ltc_ecc_projective_dbl_point.c b/lib/nettle/ltc_ecc_projective_dbl_point.c new file mode 100644 index 0000000000..d9b7ec6e6c --- /dev/null +++ b/lib/nettle/ltc_ecc_projective_dbl_point.c @@ -0,0 +1,146 @@ +/* LibTomCrypt, modular cryptographic library -- Tom St Denis + * + * LibTomCrypt is a library that provides various cryptographic + * algorithms in a highly modular and flexible manner. + * + * The library is free for all purposes without any express + * guarantee it works. + * + * Tom St Denis, tomstdenis@gmail.com, http://libtom.org + */ + +/* Implements ECC over Z/pZ for curve y^2 = x^3 - 3x + b + * + * All curves taken from NIST recommendation paper of July 1999 + * Available at http://csrc.nist.gov/cryptval/dss.htm + */ +#include "ecc.h" + +/** + @file ltc_ecc_projective_dbl_point.c + ECC Crypto, Tom St Denis +*/ + +#if defined(LTC_MECC) && (!defined(LTC_MECC_ACCEL) || defined(LTM_LTC_DESC)) + +/** + Double an ECC point + @param P The point to double + @param R [out] The destination of the double + @param modulus The modulus of the field the ECC curve is in + @param mp The "b" value from montgomery_setup() + @return 0 on success +*/ +int ltc_ecc_projective_dbl_point(ecc_point *P, ecc_point *R, mpz_t modulus) +{ + mpz_t t1, t2; + int err; + + assert(P != NULL); + assert(R != NULL); + assert(modulus != NULL); + + if ((err = mp_init_multi(&t1, &t2, NULL)) != 0) { + return err; + } + + if (P != R) { + mpz_set(R->x, P->x); + mpz_set(R->y, P->y); + mpz_set(R->z, P->z); + } + + /* t1 = Z * Z */ + mpz_mul(t1, R->z, R->z); + mpz_mod(t1, t1, modulus); + /* Z = Y * Z */ + mpz_mul(R->z, R->y, R->z); + mpz_mod(R->z, R->z, modulus); + /* Z = 2Z */ + mpz_add(R->z, R->z, R->z); + if (mpz_cmp(R->z, modulus) >= 0) { + mpz_sub(R->z, R->z, modulus); + } + + /* T2 = X - T1 */ + mpz_sub(t2, R->x, t1); + if (mpz_cmp_ui(t2, 0) < 0) { + mpz_add(t2, t2, modulus); + } + /* T1 = X + T1 */ + mpz_add(t1, t1, R->x); + if (mpz_cmp(t1, modulus) >= 0) { + mpz_sub(t1, t1, modulus); + } + /* T2 = T1 * T2 */ + mpz_mul(t2, t1, t2); + mpz_mod(t2, t2, modulus); + /* T1 = 2T2 */ + mpz_add(t1, t2, t2); + if (mpz_cmp(t1, modulus) >= 0) { + mpz_sub(t1, t1, modulus); + } + /* T1 = T1 + T2 */ + mpz_add(t1, t1, t2); + if (mpz_cmp(t1, modulus) >= 0) { + mpz_sub(t1, t1, modulus); + } + + /* Y = 2Y */ + mpz_add(R->y, R->y, R->y); + if (mpz_cmp(R->y, modulus) >= 0) { + mpz_sub(R->y, R->y, modulus); + } + /* Y = Y * Y */ + mpz_mul(R->y, R->y, R->y); + mpz_mod(R->y, R->y, modulus); + /* T2 = Y * Y */ + mpz_mul(t2, R->y, R->y); + mpz_mod(t2, t2, modulus); + /* T2 = T2/2 */ + if (mp_isodd(t2)) { + mpz_add(t2, t2, modulus); + } + mpz_divexact_ui(t2, t2, 2); + /* Y = Y * X */ + mpz_mul(R->y, R->y, R->x); + mpz_mod(R->y, R->y, modulus); + + /* X = T1 * T1 */ + mpz_mul(R->x, t1, t1); + mpz_mod(R->x, R->x, modulus); + /* X = X - Y */ + mpz_sub(R->x, R->x, R->y); + if (mpz_cmp_ui(R->x, 0) < 0) { + mpz_add(R->x, R->x, modulus); + } + /* X = X - Y */ + mpz_sub(R->x, R->x, R->y); + if (mpz_cmp_ui(R->x, 0) < 0) { + mpz_add(R->x, R->x, modulus); + } + + /* Y = Y - X */ + mpz_sub(R->y, R->y, R->x); + if (mpz_cmp_ui(R->y, 0) < 0) { + mpz_add(R->y, R->y, modulus); + } + /* Y = Y * T1 */ + mpz_mul(R->y, R->y, t1); + mpz_mod(R->y, R->y, modulus); + /* Y = Y - T2 */ + mpz_sub(R->y, R->y, t2); + if (mpz_cmp_ui(R->y, 0) < 0) { + mpz_add( R->y, R->y, modulus); + } + + err = 0; + + mp_clear_multi(&t1, &t2, NULL); + return err; +} +#endif +/* $Source: /cvs/libtom/libtomcrypt/src/pk/ecc/ltc_ecc_projective_dbl_point.c,v $ */ +/* $Revision: 1.11 $ */ +/* $Date: 2007/05/12 14:32:35 $ */ + diff --git a/lib/nettle/mp_unsigned_bin.c b/lib/nettle/mp_unsigned_bin.c new file mode 100644 index 0000000000..0da8bba32e --- /dev/null +++ b/lib/nettle/mp_unsigned_bin.c @@ -0,0 +1,28 @@ +#include "ecc.h" + +unsigned long mp_unsigned_bin_size(mpz_t a) +{ + unsigned long t; + assert(a != NULL); + + t = mpz_sizeinbase(a, 2); + if (mpz_cmp_ui((a), 0) == 0) return 0; + return (t>>3) + ((t&7)?1:0); +} + +int mp_to_unsigned_bin(mpz_t a, unsigned char *b) +{ + assert(a != NULL); + assert(b != NULL); + mpz_export(b, NULL, 1, 1, 1, 0, a); + + return 0; +} + +int mp_read_unsigned_bin(mpz_t a, unsigned char *b, unsigned long len) +{ + assert(a != NULL); + assert(b != NULL); + mpz_import(a, len, 1, 1, 1, 0, b); + return 0; +} diff --git a/lib/nettle/mpi.c b/lib/nettle/mpi.c index c76705c18f..eef8a2cc36 100644 --- a/lib/nettle/mpi.c +++ b/lib/nettle/mpi.c @@ -33,6 +33,7 @@ #include <gnutls_mpi.h> #include <gmp.h> #include <nettle/bignum.h> +#include <gnettle.h> #include <random.h> #define TOMPZ(x) (*((mpz_t*)(x))) @@ -390,7 +391,6 @@ wrap_nettle_mpi_mul_ui (bigint_t w, const bigint_t a, unsigned long b) } -#define PRIME_CHECK_PARAM 8 static int wrap_nettle_prime_check (bigint_t pp) { diff --git a/lib/nettle/multi.c b/lib/nettle/multi.c new file mode 100644 index 0000000000..788c8e9a00 --- /dev/null +++ b/lib/nettle/multi.c @@ -0,0 +1,46 @@ +/* LibTomCrypt, modular cryptographic library -- Tom St Denis + * + * LibTomCrypt is a library that provides various cryptographic + * algorithms in a highly modular and flexible manner. + * + * The library is free for all purposes without any express + * guarantee it works. + * + * Tom St Denis, tomstdenis@gmail.com, http://libtom.org + */ +#include <gmp.h> +#include <stdarg.h> +#include <ecc.h> + +int mp_init_multi(mpz_t *a, ...) +{ + mpz_t *cur = a; + int np = 0; + va_list args; + + va_start(args, a); + while (cur != NULL) { + mpz_init(*cur); + ++np; + cur = va_arg(args, mpz_t*); + } + va_end(args); + return 0; +} + +void mp_clear_multi(mpz_t *a, ...) +{ + mpz_t *cur = a; + va_list args; + + va_start(args, a); + while (cur != NULL) { + mpz_clear(*cur); + cur = va_arg(args, mpz_t*); + } + va_end(args); +} + +/* $Source$ */ +/* $Revision$ */ +/* $Date$ */ diff --git a/lib/nettle/pk.c b/lib/nettle/pk.c index 5ee9769d0d..f1722bede7 100644 --- a/lib/nettle/pk.c +++ b/lib/nettle/pk.c @@ -1,6 +1,5 @@ /* - * Copyright (C) 2010 - * Free Software Foundation, Inc. + * Copyright (C) 2010 Free Software Foundation, Inc. * * Author: Nikos Mavrogiannopoulos * @@ -42,9 +41,13 @@ #include <nettle/rsa.h> #include <random.h> #include <gnutls/crypto.h> +#include "rnd.h" +#include "ecc.h" #define TOMPZ(x) (*((mpz_t*)(x))) +static inline int is_supported_curve(int curve); + static void rnd_func (void *_ctx, unsigned length, uint8_t * data) { @@ -81,6 +84,69 @@ _rsa_params_to_privkey (const gnutls_pk_params_st * pk_params, } +static int _wrap_nettle_pk_derive(gnutls_pk_algorithm_t algo, gnutls_datum_t * out, + const gnutls_pk_params_st * priv, + const gnutls_pk_params_st * pub) +{ + int ret; + + switch (algo) + { + case GNUTLS_PK_ECDH: + { + ecc_key ecc_pub, ecc_priv; + int curve = priv->flags; + unsigned long sz; + + if (is_supported_curve(curve) == 0) + return gnutls_assert_val(GNUTLS_E_ECC_NO_SUPPORTED_CURVES); + + ecc_pub.type = PK_PUBLIC; + memcpy(&ecc_pub.prime, pub->params[0], sizeof(mpz_t)); + memcpy(&ecc_pub.order, pub->params[1], sizeof(mpz_t)); + memcpy(&ecc_pub.Gx, pub->params[2], sizeof(mpz_t)); + memcpy(&ecc_pub.Gy, pub->params[3], sizeof(mpz_t)); + memcpy(&ecc_pub.pubkey.x, pub->params[4], sizeof(mpz_t)); + memcpy(&ecc_pub.pubkey.y, pub->params[5], sizeof(mpz_t)); + memcpy(&ecc_pub.pubkey.z, pub->params[6], sizeof(mpz_t)); + + ecc_priv.type = PK_PRIVATE; + memcpy(&ecc_priv.prime, priv->params[0], sizeof(mpz_t)); + memcpy(&ecc_priv.order, priv->params[1], sizeof(mpz_t)); + memcpy(&ecc_priv.Gx, priv->params[2], sizeof(mpz_t)); + memcpy(&ecc_priv.Gy, priv->params[3], sizeof(mpz_t)); + memcpy(&ecc_priv.pubkey.x, priv->params[4], sizeof(mpz_t)); + memcpy(&ecc_priv.pubkey.y, priv->params[5], sizeof(mpz_t)); + memcpy(&ecc_priv.pubkey.z, priv->params[6], sizeof(mpz_t)); + memcpy(&ecc_priv.k, priv->params[7], sizeof(mpz_t)); + + sz = ECC_BUF_SIZE; + out->data = gnutls_malloc(sz); + if (out->data == NULL) + return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR); + + ret = ecc_shared_secret(&ecc_priv, &ecc_pub, out->data, &sz); + if (ret != 0) + { + gnutls_free(out->data); + return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR); + } + out->size = sz; + break; + } + default: + gnutls_assert (); + ret = GNUTLS_E_INTERNAL_ERROR; + goto cleanup; + } + + ret = 0; + +cleanup: + + return ret; +} + static int _wrap_nettle_pk_encrypt (gnutls_pk_algorithm_t algo, gnutls_datum_t * ciphertext, @@ -89,7 +155,6 @@ _wrap_nettle_pk_encrypt (gnutls_pk_algorithm_t algo, { int ret; - /* make a sexp from pkey */ switch (algo) { case GNUTLS_PK_RSA: @@ -486,6 +551,15 @@ cleanup: return ret; } +static inline int is_supported_curve(int curve) +{ + if (_gnutls_ecc_curve_get_name(curve) != NULL) + return 1; + else + return 0; +} + + static int wrap_nettle_pk_generate_params (gnutls_pk_algorithm_t algo, unsigned int level /*bits */ , @@ -605,6 +679,56 @@ rsa_fail: break; } + case GNUTLS_PK_ECDH: + { + ecc_key key; + ltc_ecc_set_type tls_ecc_set; + const gnutls_ecc_curve_entry_st *st; + + st = _gnutls_ecc_curve_get_params(level); + if (st == NULL) + return gnutls_assert_val(GNUTLS_E_ECC_NO_SUPPORTED_CURVES); + + tls_ecc_set.size = st->size; + tls_ecc_set.prime = st->prime; + tls_ecc_set.order = st->order; + tls_ecc_set.Gx = st->Gx; + tls_ecc_set.Gy = st->Gy; + + ret = ecc_make_key(NULL, _int_random_func, &key, &tls_ecc_set); + if (ret != 0) + return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR); + + params->params_nr = 0; + for (i = 0; i < ECDH_PRIVATE_PARAMS; i++) + { + params->params[i] = _gnutls_mpi_alloc_like(&key.prime); + if (params->params[i] == NULL) + { + ret = GNUTLS_E_MEMORY_ERROR; + goto ecc_fail; + } + params->params_nr++; + } + params->flags = level; + + mpz_set(TOMPZ(params->params[0]), key.prime); + mpz_set(TOMPZ(params->params[1]), key.order); + mpz_set(TOMPZ(params->params[2]), key.Gx); + mpz_set(TOMPZ(params->params[3]), key.Gy); + mpz_set(TOMPZ(params->params[4]), key.pubkey.x); + mpz_set(TOMPZ(params->params[5]), key.pubkey.y); + mpz_set(TOMPZ(params->params[6]), key.pubkey.z); + mpz_set(TOMPZ(params->params[7]), key.k); + +ecc_fail: + ecc_free(&key); + + if (ret < 0) + goto fail; + + break; + } default: gnutls_assert (); return GNUTLS_E_INVALID_REQUEST; @@ -666,4 +790,5 @@ gnutls_crypto_pk_st _gnutls_pk_ops = { .verify = _wrap_nettle_pk_verify, .generate = wrap_nettle_pk_generate_params, .pk_fixup_private_params = wrap_nettle_pk_fixup, + .derive = _wrap_nettle_pk_derive, }; diff --git a/lib/nettle/rnd.c b/lib/nettle/rnd.c index 8af0adde57..b503e10e1d 100644 --- a/lib/nettle/rnd.c +++ b/lib/nettle/rnd.c @@ -33,6 +33,7 @@ #include <gnutls_errors.h> #include <gnutls_num.h> #include <nettle/yarrow.h> +#include "rnd.h" #define SOURCES 2 @@ -440,7 +441,6 @@ wrap_nettle_rnd_init (void **ctx) } - static int wrap_nettle_rnd (void *_ctx, int level, void *data, size_t datasize) { @@ -467,6 +467,14 @@ wrap_nettle_rnd (void *_ctx, int level, void *data, size_t datasize) return 0; } +/* internal function to provide to nettle functions that + * require a nettle_random_func(). + */ +void _int_random_func(void *ctx, unsigned length, uint8_t *dst) +{ + wrap_nettle_rnd(ctx, 0, dst, length); +} + int crypto_rnd_prio = INT_MAX; gnutls_crypto_rnd_st _gnutls_rnd_ops = { diff --git a/lib/nettle/rnd.h b/lib/nettle/rnd.h new file mode 100644 index 0000000000..5deefd392c --- /dev/null +++ b/lib/nettle/rnd.h @@ -0,0 +1,2 @@ +void _int_random_func(void *ctx, + unsigned length, uint8_t *dst); diff --git a/lib/x509/x509_int.h b/lib/x509/x509_int.h index bde3aefa76..b35ecd2d00 100644 --- a/lib/x509/x509_int.h +++ b/lib/x509/x509_int.h @@ -78,14 +78,15 @@ typedef struct gnutls_pkcs7_int /* parameters should not be larger than this limit */ #define DSA_PUBLIC_PARAMS 4 #define RSA_PUBLIC_PARAMS 2 +#define ECDH_PUBLIC_PARAMS 7 + #define MAX_PRIV_PARAMS_SIZE GNUTLS_MAX_PK_PARAMS /* ok for RSA and DSA */ /* parameters should not be larger than this limit */ #define DSA_PRIVATE_PARAMS 5 -#define DSA_PUBLIC_PARAMS 4 #define RSA_PRIVATE_PARAMS 8 -#define RSA_PUBLIC_PARAMS 2 +#define ECDH_PRIVATE_PARAMS 8 #if MAX_PRIV_PARAMS_SIZE - RSA_PRIVATE_PARAMS < 0 #error INCREASE MAX_PRIV_PARAMS |