path: root/lib/gnutls_dh.c

/*
 *      Copyright (C) 2000 Nikos Mavroyanopoulos
 *
 * This file is part of GNUTLS.
 *           someday was part of gsti
 *
 * GNUTLS is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * GNUTLS is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA
 */

#include <defines.h>
#include <gnutls_int.h>
#include <gnutls_errors.h>
#include <gnutls_gcry.h>

#define DH_G_1024 2
#define DH_G_4096 5
#define DH_G_2048 5
#define DH_G_3072 13

static const uint8 diffie_hellman_group1_prime[130] = { 0x04, 0x00,
	0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xC9, 0x0F, 0xDA, 0xA2,
	0x21, 0x68, 0xC2, 0x34, 0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1,
	0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74, 0x02, 0x0B, 0xBE, 0xA6,
	0x3B, 0x13, 0x9B, 0x22, 0x51, 0x4A, 0x08, 0x79, 0x8E, 0x34, 0x04, 0xDD,
	0xEF, 0x95, 0x19, 0xB3, 0xCD, 0x3A, 0x43, 0x1B, 0x30, 0x2B, 0x0A, 0x6D,
	0xF2, 0x5F, 0x14, 0x37, 0x4F, 0xE1, 0x35, 0x6D, 0x6D, 0x51, 0xC2, 0x45,
	0xE4, 0x85, 0xB5, 0x76, 0x62, 0x5E, 0x7E, 0xC6, 0xF4, 0x4C, 0x42, 0xE9,
	0xA6, 0x37, 0xED, 0x6B, 0x0B, 0xFF, 0x5C, 0xB6, 0xF4, 0x06, 0xB7, 0xED,
	0xEE, 0x38, 0x6B, 0xFB, 0x5A, 0x89, 0x9F, 0xA5, 0xAE, 0x9F, 0x24, 0x11,
	0x7C, 0x4B, 0x1F, 0xE6, 0x49, 0x28, 0x66, 0x51, 0xEC, 0xE6, 0x53, 0x81,
	0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
};

/* prime - 4096 bits */
const uint8 diffie_hellman_prime_4096[512] = { 
	0x98, 0xb7, 0x3d, 0x66, 0xf1, 0x18, 0x61, 
	0xa9, 0x36, 0xd9, 0xf1, 0xbf, 0x65, 0xbb, 
	0x7c, 0x06, 0x10, 0x15, 0xe5, 0x24, 0x47, 
	0xb5, 0x45, 0x7e, 0xbb, 0xdf, 0x59, 0xf4, 
	0xf2, 0x59, 0x7d, 0xea, 0xe0, 0x0f, 0x06, 
	0x42, 0xd8, 0xb1, 0x9b, 0x62, 0xf9, 0x81, 
	0x05, 0xd7, 0xd5, 0x74, 0x7c, 0x39, 0x3b, 
	0x6d, 0x57, 0xb7, 0xe9, 0x51, 0x0d, 0xb6, 
	0xe5, 0x03, 0xf7, 0xf3, 0xac, 0x1b, 0x66, 
	0x96, 0xb3, 0xf8, 0xa1, 0xe1, 0xc7, 0x9c, 
	0xc7, 0x52, 0x19, 0x2a, 0x90, 0xe6, 0x1d, 
	0xba, 0xf5, 0x15, 0xcb, 0x8b, 0x52, 0x88, 
	0xcd, 0xf5, 0x50, 0x33, 0x04, 0xb8, 0x2f, 
	0x2c, 0x01, 0x57, 0x82, 0x7c, 0x8a, 0xf0, 
	0xa3, 0x73, 0x7e, 0x0c, 0x2d, 0x69, 0xd4, 
	0x17, 0xf6, 0xd0, 0x6a, 0x32, 0x95, 0x6a, 
	0x69, 0x40, 0xb0, 0x55, 0x4f, 0xf0, 0x1d, 
	0xae, 0x3d, 0x5f, 0x01, 0x92, 0x14, 0x3a, 
	0x73, 0x69, 0x5a, 0x8e, 0xea, 0x22, 0x52, 
	0x44, 0xc2, 0xb8, 0x66, 0x1e, 0x26, 0x1a, 
	0x5d, 0x8f, 0x46, 0x6b, 0x8d, 0x3c, 0x71, 
	0xcf, 0x1d, 0x72, 0x8d, 0x2f, 0x03, 0x54, 
	0xdb, 0xe9, 0x82, 0x60, 0xe5, 0xf6, 0x40, 
	0x4b, 0x6b, 0xae, 0x0a, 0xb2, 0x30, 0xba, 
	0x1c, 0x45, 0x7e, 0x3f, 0xfd, 0xf7, 0xdc, 
	0xa6, 0xbb, 0x98, 0xc4, 0xca, 0xfc, 0x66, 
	0xf3, 0x48, 0x47, 0xbf, 0xdb, 0xd7, 0xdc, 
	0xff, 0x1d, 0xeb, 0xa0, 0x4e, 0xb6, 0xff, 
	0x75, 0xdc, 0x0c, 0x1d, 0x93, 0x9e, 0xd5, 
	0xb3, 0x68, 0xe7, 0x07, 0x29, 0x91, 0xf1, 
	0xae, 0xfc, 0x7e, 0x3a, 0xea, 0xec, 0x40, 
	0xfc, 0x70, 0x7f, 0xf3, 0x36, 0x81, 0xec, 
	0x97, 0xa7, 0x0d, 0x71, 0x2c, 0x5c, 0x4f, 
	0xd9, 0x00, 0xcf, 0x62, 0x56, 0xfb, 0x09, 
	0x2d, 0x1b, 0x04, 0x3c, 0x00, 0xc8, 0x17, 
	0xd7, 0x7d, 0x16, 0x20, 0x1e, 0x62, 0x9b, 
	0xf4, 0x4f, 0xee, 0xa4, 0xbf, 0x0b, 0xde, 
	0x51, 0x7c, 0x01, 0x76, 0x79, 0x73, 0x7d, 
	0x7b, 0xec, 0xee, 0x14, 0xec, 0x83, 0xc3, 
	0xb4, 0x42, 0x66, 0x19, 0x52, 0x19, 0x04, 
	0x02, 0x71, 0x61, 0x5c, 0x78, 0xee, 0x5f, 
	0x58, 0x1e, 0x5b, 0x2d, 0xf3, 0x0c, 0x6e, 
	0x00, 0x0f, 0xd8, 0xf0, 0x86, 0xa1, 0x11, 
	0xfd, 0x04, 0x07, 0xa6, 0xf7, 0x31, 0xb9, 
	0xf6, 0x76, 0xfc, 0xea, 0xf0, 0x16, 0x98, 
	0x37, 0x48, 0x1b, 0x0c, 0x32, 0x3f, 0x7e, 
	0xfa, 0x02, 0x04, 0x2a, 0x48, 0x70, 0xb4, 
	0xe3, 0xe0, 0xc1, 0x7f, 0x65, 0x70, 0xd0, 
	0x71, 0x74, 0x86, 0xb7, 0x5d, 0xd4, 0x84, 
	0xd5, 0x9d, 0x77, 0xf6, 0x72, 0x82, 0x4b, 
	0x98, 0x8b, 0x49, 0x3a, 0x0b, 0x1e, 0x94, 
	0x42, 0xf7, 0x0b, 0x3f, 0xec, 0xc2, 0x2b, 
	0x7f, 0x55, 0xe2, 0x94, 0x48, 0xac, 0x04, 
	0xb9, 0xb2, 0xb6, 0xca, 0xb4, 0x09, 0xe3, 
	0xba, 0x6a, 0x55, 0x28, 0xf7, 0x8a, 0x73, 
	0x4d, 0x21, 0xe1, 0xf4, 0xcd, 0x22, 0x15, 
	0x9c, 0xe6, 0xcc, 0x1d, 0x9f, 0x81, 0x88, 
	0x4c, 0x5a, 0x17, 0x9f, 0xe5, 0x8c, 0x85, 
	0xf1, 0xa3, 0xcf, 0x6c, 0xa1, 0xbf, 0x5e, 
	0x02, 0x61, 0xa8, 0x67, 0x6f, 0xb8, 0x20, 
	0x1a, 0x4e, 0xf2, 0x05, 0xd7, 0xb4, 0x4b, 
	0x3e, 0xca, 0x87, 0x49, 0x10, 0x16, 0xcc, 
	0xc9, 0xe0, 0x1c, 0xc1, 0x83, 0xc7, 0xa0, 
	0x54, 0x3d, 0x36, 0x17, 0x84, 0xc3, 0x84, 
	0x2e, 0x5a, 0xe0, 0x75, 0x45, 0x01, 0xe6, 
	0xf0, 0x3d, 0xf9, 0x33, 0x0a, 0xd9, 0x1e, 
	0x66, 0x99, 0xb4, 0x21, 0xed, 0x6e, 0xda, 
	0x6f, 0x37, 0x33, 0xdd, 0x8f, 0x25, 0x35, 
	0x5e, 0x6c, 0x1e, 0x33, 0xc2, 0x41, 0x3f, 
	0x58, 0x40, 0xbb, 0xe7, 0x2b, 0x54, 0xdb, 
	0xd8, 0xcf, 0x3a, 0xba, 0x0c, 0xf1, 0x19, 
	0xec, 0x9d, 0x50, 0xf6, 0x63, 0x22, 0x55, 
	0x5e, 0x79, 0xd1, 0x3f, 0x46, 0x0f, 0xf3, 
	0x7f
};

/* prime - 3072 bits */
const uint8 diffie_hellman_prime_3072[384] = { 
	0xd5, 0x6e, 0xc8, 0x1f, 0xe9, 0x80, 0x9e, 
	0x56, 0x35, 0x6d, 0x6d, 0xdb, 0xfa, 0x47, 
	0x75, 0xcd, 0xfa, 0x32, 0x52, 0x1a, 0xc8, 
	0xad, 0xee, 0xb0, 0xdb, 0xb7, 0x07, 0x58, 
	0xa6, 0x42, 0xfe, 0x59, 0xfb, 0xce, 0xe8, 
	0x12, 0x63, 0x09, 0x9f, 0x5d, 0x15, 0x25, 
	0x49, 0xf2, 0x61, 0x83, 0xd8, 0x5c, 0x81, 
	0xdd, 0x4c, 0x26, 0xe6, 0x24, 0xce, 0x6a, 
	0xa5, 0x07, 0x80, 0x1c, 0x3d, 0x94, 0xd1, 
	0x5d, 0x73, 0xbd, 0x26, 0x48, 0x22, 0x25, 
	0xdd, 0x2f, 0x64, 0xe5, 0xed, 0xb3, 0xa9, 
	0x94, 0xb3, 0x96, 0x88, 0x5d, 0x06, 0x41, 
	0x80, 0xf8, 0xe1, 0x3c, 0x8f, 0xa9, 0x5b, 
	0x44, 0x7e, 0x32, 0xbd, 0x62, 0x37, 0xe1, 
	0xde, 0x18, 0xe8, 0x12, 0x7d, 0x28, 0x7d, 
	0x5c, 0xcf, 0xa9, 0x16, 0x0f, 0xdc, 0xc1, 
	0x92, 0xe0, 0x43, 0xac, 0xd0, 0x25, 0x37, 
	0x8e, 0x5d, 0x4d, 0x26, 0x46, 0xbc, 0xc5, 
	0x22, 0x05, 0x29, 0x41, 0x53, 0x2f, 0x7a, 
	0x95, 0xa8, 0x36, 0xed, 0x85, 0xac, 0xf3, 
	0xde, 0x0c, 0xbe, 0xa9, 0xfa, 0xc4, 0xa6, 
	0x0b, 0x23, 0xfc, 0x7c, 0x77, 0xdc, 0x7c, 
	0x94, 0x9b, 0x7c, 0xe0, 0x3b, 0xa1, 0x66, 
	0x78, 0x85, 0x99, 0x5a, 0xba, 0x26, 0xa3, 
	0xac, 0x97, 0xd4, 0x3a, 0x33, 0xee, 0xa3, 
	0x96, 0xe0, 0x16, 0xdf, 0x61, 0xe7, 0x1f, 
	0x35, 0xa5, 0x47, 0x54, 0x51, 0xce, 0x93, 
	0x40, 0x6f, 0x40, 0x86, 0x3b, 0x17, 0x12, 
	0xd3, 0x4d, 0x2e, 0xb3, 0x04, 0xf8, 0x8b, 
	0x30, 0xb1, 0x27, 0xd7, 0xeb, 0xde, 0xd7, 
	0xa9, 0x06, 0xfe, 0x6b, 0x59, 0x8c, 0x5d, 
	0x9f, 0x93, 0x1f, 0x12, 0x65, 0xe6, 0xa6, 
	0xeb, 0x5d, 0x4b, 0x9a, 0x16, 0x85, 0xce, 
	0x18, 0x16, 0x5a, 0x5c, 0x3c, 0xeb, 0xc0, 
	0xe1, 0x58, 0x64, 0x06, 0x38, 0x1c, 0x66, 
	0x90, 0x4a, 0x30, 0xbe, 0x82, 0xe9, 0x9b, 
	0x40, 0x2e, 0x6a, 0x91, 0x4f, 0x48, 0xc2, 
	0x82, 0x40, 0xe9, 0xcd, 0x87, 0x77, 0x24, 
	0xa7, 0xdc, 0x26, 0x05, 0x18, 0x9c, 0x8b, 
	0x0e, 0x84, 0x29, 0x57, 0x76, 0x66, 0x7d, 
	0x1e, 0x39, 0xc2, 0xf6, 0x2f, 0xbb, 0xeb, 
	0x6e, 0x58, 0x3b, 0x11, 0x70, 0x75, 0xdb, 
	0xe9, 0xf8, 0xcb, 0xd4, 0x4c, 0x84, 0xb3, 
	0xcb, 0x66, 0x81, 0x4e, 0x93, 0xd9, 0x2f, 
	0xc5, 0x60, 0x53, 0x69, 0x6e, 0xf3, 0x8e, 
	0xa5, 0x6a, 0xa0, 0x96, 0xae, 0x31, 0xb6, 
	0x12, 0x91, 0x0e, 0xc4, 0xc9, 0xd0, 0x50, 
	0xf7, 0xbc, 0xe7, 0x78, 0xc9, 0x97, 0x02, 
	0x26, 0x6a, 0xe3, 0x9a, 0x16, 0x63, 0xa2, 
	0x5e, 0x1d, 0x4e, 0x71, 0x52, 0xb4, 0x73, 
	0x31, 0x27, 0x6c, 0x46, 0xe4, 0x67, 0x02, 
	0xde, 0x34, 0x7e, 0x24, 0x3b, 0xb9, 0xfe, 
	0x08, 0x7e, 0xe9, 0x0a, 0xdc, 0xe7, 0xc2, 
	0xa6, 0xa6, 0xb3, 0x7d, 0xe0, 0xa2, 0xe7, 
	0x6d, 0x2e, 0x33, 0xed, 0x47, 0xf7
};

/* prime - 2048 bits */
const uint8 diffie_hellman_prime_2048[256] = { 
	0xf0, 0x49, 0x65, 0x6d, 0x24, 0x61, 0xe6, 
	0x86, 0x8e, 0x57, 0x2b, 0x9b, 0x1c, 0x53, 
	0x2e, 0xef, 0xd2, 0x6e, 0xe5, 0x6c, 0xc4, 
	0x0c, 0x77, 0x1d, 0xce, 0xc7, 0xe0, 0x92, 
	0x78, 0x8b, 0x2b, 0x80, 0x9f, 0xc4, 0x59, 
	0xb5, 0x2e, 0xeb, 0x81, 0x8b, 0xfa, 0x08, 
	0x9f, 0x02, 0x5e, 0x94, 0x85, 0xab, 0xab, 
	0x08, 0x8a, 0x71, 0xb5, 0x0c, 0x26, 0x63, 
	0x2f, 0x34, 0x10, 0xdf, 0x32, 0x9a, 0xa1, 
	0xd5, 0xb5, 0xd7, 0xa1, 0x46, 0x24, 0x9a, 
	0xe3, 0x2a, 0xf1, 0x3a, 0x52, 0xc4, 0xa4, 
	0xe6, 0xa2, 0x29, 0x5e, 0x49, 0x0e, 0x2a, 
	0x4d, 0xad, 0xcd, 0x92, 0xb6, 0xa5, 0x25, 
	0xe5, 0x09, 0xae, 0x76, 0xe4, 0x19, 0xec, 
	0x29, 0x9b, 0x9b, 0xdb, 0x0c, 0xc8, 0x28, 
	0x1c, 0x49, 0x11, 0x45, 0x30, 0x51, 0x73, 
	0x31, 0x18, 0x9e, 0xa5, 0x89, 0x7d, 0x17, 
	0x22, 0xd5, 0x49, 0xaf, 0xf6, 0xe5, 0x00, 
	0x55, 0x7f, 0x2b, 0x33, 0x2d, 0x2f, 0x89, 
	0x73, 0x0b, 0x4d, 0x44, 0x72, 0xb1, 0x2e, 
	0xa3, 0x68, 0xbe, 0x52, 0x4e, 0x5a, 0x66, 
	0x36, 0xf9, 0x2c, 0xe7, 0xce, 0x92, 0x4d, 
	0x0c, 0xa3, 0xc7, 0x85, 0x7e, 0xe6, 0x97, 
	0x02, 0x8b, 0x0c, 0xcb, 0xf3, 0x6f, 0x2e, 
	0x04, 0xed, 0x6e, 0x75, 0xcf, 0xd1, 0xd4, 
	0x9f, 0xd3, 0x44, 0x3e, 0x5f, 0x81, 0xaa, 
	0xc1, 0xb8, 0xe2, 0xab, 0xed, 0x3b, 0xfc, 
	0xeb, 0x47, 0x48, 0xee, 0xe5, 0xfd, 0xc2, 
	0x79, 0x7a, 0x01, 0xe9, 0xab, 0xc6, 0x34, 
	0x65, 0x6a, 0x0a, 0x6c, 0xe8, 0x89, 0xa6, 
	0x96, 0xd2, 0x1e, 0xe5, 0xbe, 0x58, 0xf2, 
	0xcf, 0x17, 0xb8, 0x75, 0x43, 0xec, 0x0b, 
	0xb2, 0x91, 0x50, 0x93, 0x4c, 0xd2, 0xa3, 
	0xa4, 0x8a, 0x67, 0x23, 0x7f, 0x86, 0xac, 
	0xe3, 0x56, 0x9b, 0x18, 0x03, 0x03, 0x70, 
	0x50, 0x7b, 0x1a, 0x02, 0x22, 0x0b, 0x93, 
	0xc8, 0x9b, 0xa8, 0x8f
};


/* 
	--Example-- 
	you: X = g ^ x mod p;
	peer:Y = g ^ y mod p;

	your_key = Y ^ x mod p;
	his_key  = X ^ y mod p;

//      generate our secret and the public value for it
	X = gnutls_calc_dh_secret(&x, g, p);
//      now we can calculate the shared secret
	key = gnutls_calc_dh_key(Y, x, g, p);
	_gnutls_mpi_release(x);
	_gnutls_mpi_release(g);
*/


/* This function should return a resonable size for X
 * (DH secret key). The input is the number of bits of 
 * the modulus.
 * FIXME: This function is not correct
 */
static int get_x_size( int bits) {
	if (bits <= 2048) return 512;
	if (bits <= 4096) return 768;
	return 1024;
}

MPI gnutls_calc_dh_secret(MPI * ret_x, MPI g, MPI prime)
{
	MPI e, x;
	int x_size = get_x_size( gcry_mpi_get_nbits(prime));
	
	x = gcry_mpi_new(x_size);	/* FIXME: allocate in secure memory */
	gcry_mpi_randomize(x, x_size, GCRY_STRONG_RANDOM);
	/* fixme: set high bit of x and select a larger one */

	e = gcry_mpi_alloc_like(prime);
	gcry_mpi_powm(e, g, x, prime);

	if (ret_x)
		*ret_x = x;
	else
		_gnutls_mpi_release(&x);
	return e;
}

/* returns g and p, depends on the requested bits.
 * We only support limited key sizes.
 */
MPI gnutls_get_dh_params(MPI * ret_p, int bits)
{
	MPI g, prime;
	size_t n;
	
	if (bits >= 4096) bits = 4096;
	else if (bits<=1024) bits=1024;
	else if (bits<=2048) bits=2048;
	else if (bits<=3072) bits=3072;
	else if (bits<=4096) bits=4096;
	
	switch (bits) {
	case 1024:
		n = sizeof diffie_hellman_group1_prime;

		if (gcry_mpi_scan(&prime, GCRYMPI_FMT_USG,
			  diffie_hellman_group1_prime, &n)) {
			gnutls_assert();
			abort();
		}

		g = gcry_mpi_set_ui(NULL, DH_G_1024);

		if (ret_p)
			*ret_p = prime;
		else
			_gnutls_mpi_release(&prime);
		return g;
	case 2048:
		n = sizeof diffie_hellman_prime_2048;

		if (gcry_mpi_scan(&prime, GCRYMPI_FMT_USG,
			  diffie_hellman_prime_2048, &n)) {
			gnutls_assert();
			abort();
		}

		g = gcry_mpi_set_ui(NULL, DH_G_2048);

		if (ret_p)
			*ret_p = prime;
		else
			_gnutls_mpi_release(&prime);
		return g;
	case 3072:
		n = sizeof diffie_hellman_prime_3072;

		if (gcry_mpi_scan(&prime, GCRYMPI_FMT_USG,
			  diffie_hellman_prime_3072, &n)) {
			gnutls_assert();
			abort();
		}

		g = gcry_mpi_set_ui(NULL, DH_G_3072);

		if (ret_p)
			*ret_p = prime;
		else
			_gnutls_mpi_release(&prime);
		return g;
	case 4096:
		n = sizeof diffie_hellman_prime_4096;

		if (gcry_mpi_scan(&prime, GCRYMPI_FMT_USG,
			  diffie_hellman_prime_4096, &n)) {
			gnutls_assert();
			abort();
		}

		g = gcry_mpi_set_ui(NULL, DH_G_4096);

		if (ret_p)
			*ret_p = prime;
		else
			_gnutls_mpi_release(&prime);
		return g;
	default:
		gnutls_assert();
		abort();
	}
}


MPI gnutls_calc_dh_key(MPI f, MPI x, MPI prime)
{
	MPI k;

	k = gcry_mpi_alloc_like(prime);
	gcry_mpi_powm(k, f, x, prime);
	return k;
}