1 /* Originally written by Bodo Moeller for the OpenSSL project. 2 * ==================================================================== 3 * Copyright (c) 1998-2005 The OpenSSL Project. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in 14 * the documentation and/or other materials provided with the 15 * distribution. 16 * 17 * 3. All advertising materials mentioning features or use of this 18 * software must display the following acknowledgment: 19 * "This product includes software developed by the OpenSSL Project 20 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" 21 * 22 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 23 * endorse or promote products derived from this software without 24 * prior written permission. For written permission, please contact 25 * openssl-core (at) openssl.org. 26 * 27 * 5. Products derived from this software may not be called "OpenSSL" 28 * nor may "OpenSSL" appear in their names without prior written 29 * permission of the OpenSSL Project. 30 * 31 * 6. Redistributions of any form whatsoever must retain the following 32 * acknowledgment: 33 * "This product includes software developed by the OpenSSL Project 34 * for use in the OpenSSL Toolkit (http://www.openssl.org/)" 35 * 36 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 37 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 38 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 39 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 40 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 41 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 42 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 43 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 44 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 45 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 46 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 47 * OF THE POSSIBILITY OF SUCH DAMAGE. 48 * ==================================================================== 49 * 50 * This product includes cryptographic software written by Eric Young 51 * (eay (at) cryptsoft.com). This product includes software written by Tim 52 * Hudson (tjh (at) cryptsoft.com). 53 * 54 */ 55 /* ==================================================================== 56 * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED. 57 * 58 * Portions of the attached software ("Contribution") are developed by 59 * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project. 60 * 61 * The Contribution is licensed pursuant to the OpenSSL open source 62 * license provided above. 63 * 64 * The elliptic curve binary polynomial software is originally written by 65 * Sheueling Chang Shantz and Douglas Stebila of Sun Microsystems 66 * Laboratories. */ 67 68 #include <openssl/ec_key.h> 69 70 #include <string.h> 71 72 #include <openssl/ec.h> 73 #include <openssl/ecdsa.h> 74 #include <openssl/engine.h> 75 #include <openssl/err.h> 76 #include <openssl/ex_data.h> 77 #include <openssl/mem.h> 78 #include <openssl/thread.h> 79 80 #include "internal.h" 81 #include "../delocate.h" 82 #include "../../internal.h" 83 84 85 DEFINE_STATIC_EX_DATA_CLASS(g_ec_ex_data_class); 86 87 EC_KEY *EC_KEY_new(void) { return EC_KEY_new_method(NULL); } 88 89 EC_KEY *EC_KEY_new_method(const ENGINE *engine) { 90 EC_KEY *ret = OPENSSL_malloc(sizeof(EC_KEY)); 91 if (ret == NULL) { 92 OPENSSL_PUT_ERROR(EC, ERR_R_MALLOC_FAILURE); 93 return NULL; 94 } 95 96 OPENSSL_memset(ret, 0, sizeof(EC_KEY)); 97 98 if (engine) { 99 ret->ecdsa_meth = ENGINE_get_ECDSA_method(engine); 100 } 101 if (ret->ecdsa_meth) { 102 METHOD_ref(ret->ecdsa_meth); 103 } 104 105 ret->conv_form = POINT_CONVERSION_UNCOMPRESSED; 106 ret->references = 1; 107 108 CRYPTO_new_ex_data(&ret->ex_data); 109 110 if (ret->ecdsa_meth && ret->ecdsa_meth->init && !ret->ecdsa_meth->init(ret)) { 111 CRYPTO_free_ex_data(g_ec_ex_data_class_bss_get(), ret, &ret->ex_data); 112 if (ret->ecdsa_meth) { 113 METHOD_unref(ret->ecdsa_meth); 114 } 115 OPENSSL_free(ret); 116 return NULL; 117 } 118 119 return ret; 120 } 121 122 EC_KEY *EC_KEY_new_by_curve_name(int nid) { 123 EC_KEY *ret = EC_KEY_new(); 124 if (ret == NULL) { 125 OPENSSL_PUT_ERROR(EC, ERR_R_MALLOC_FAILURE); 126 return NULL; 127 } 128 ret->group = EC_GROUP_new_by_curve_name(nid); 129 if (ret->group == NULL) { 130 EC_KEY_free(ret); 131 return NULL; 132 } 133 return ret; 134 } 135 136 void EC_KEY_free(EC_KEY *r) { 137 if (r == NULL) { 138 return; 139 } 140 141 if (!CRYPTO_refcount_dec_and_test_zero(&r->references)) { 142 return; 143 } 144 145 if (r->ecdsa_meth) { 146 if (r->ecdsa_meth->finish) { 147 r->ecdsa_meth->finish(r); 148 } 149 METHOD_unref(r->ecdsa_meth); 150 } 151 152 EC_GROUP_free(r->group); 153 EC_POINT_free(r->pub_key); 154 BN_clear_free(r->priv_key); 155 BN_free(r->fixed_k); 156 157 CRYPTO_free_ex_data(g_ec_ex_data_class_bss_get(), r, &r->ex_data); 158 159 OPENSSL_cleanse((void *)r, sizeof(EC_KEY)); 160 OPENSSL_free(r); 161 } 162 163 EC_KEY *EC_KEY_copy(EC_KEY *dest, const EC_KEY *src) { 164 if (dest == NULL || src == NULL) { 165 OPENSSL_PUT_ERROR(EC, ERR_R_PASSED_NULL_PARAMETER); 166 return NULL; 167 } 168 /* Copy the parameters. */ 169 if (src->group) { 170 /* TODO(fork): duplicating the group seems wasteful. */ 171 EC_GROUP_free(dest->group); 172 dest->group = EC_GROUP_dup(src->group); 173 if (dest->group == NULL) { 174 return NULL; 175 } 176 } 177 178 /* Copy the public key. */ 179 if (src->pub_key && src->group) { 180 EC_POINT_free(dest->pub_key); 181 dest->pub_key = EC_POINT_dup(src->pub_key, src->group); 182 if (dest->pub_key == NULL) { 183 return NULL; 184 } 185 } 186 187 /* copy the private key */ 188 if (src->priv_key) { 189 if (dest->priv_key == NULL) { 190 dest->priv_key = BN_new(); 191 if (dest->priv_key == NULL) { 192 return NULL; 193 } 194 } 195 if (!BN_copy(dest->priv_key, src->priv_key)) { 196 return NULL; 197 } 198 } 199 /* copy method/extra data */ 200 if (src->ecdsa_meth) { 201 METHOD_unref(dest->ecdsa_meth); 202 dest->ecdsa_meth = src->ecdsa_meth; 203 METHOD_ref(dest->ecdsa_meth); 204 } 205 206 /* copy the rest */ 207 dest->enc_flag = src->enc_flag; 208 dest->conv_form = src->conv_form; 209 210 return dest; 211 } 212 213 EC_KEY *EC_KEY_dup(const EC_KEY *ec_key) { 214 EC_KEY *ret = EC_KEY_new(); 215 if (ret == NULL) { 216 return NULL; 217 } 218 if (EC_KEY_copy(ret, ec_key) == NULL) { 219 EC_KEY_free(ret); 220 return NULL; 221 } 222 return ret; 223 } 224 225 int EC_KEY_up_ref(EC_KEY *r) { 226 CRYPTO_refcount_inc(&r->references); 227 return 1; 228 } 229 230 int EC_KEY_is_opaque(const EC_KEY *key) { 231 return key->ecdsa_meth && (key->ecdsa_meth->flags & ECDSA_FLAG_OPAQUE); 232 } 233 234 const EC_GROUP *EC_KEY_get0_group(const EC_KEY *key) { return key->group; } 235 236 int EC_KEY_set_group(EC_KEY *key, const EC_GROUP *group) { 237 EC_GROUP_free(key->group); 238 /* TODO(fork): duplicating the group seems wasteful but see 239 * |EC_KEY_set_conv_form|. */ 240 key->group = EC_GROUP_dup(group); 241 if (key->group == NULL) { 242 return 0; 243 } 244 /* XXX: |BN_cmp| is not constant time. */ 245 if (key->priv_key != NULL && 246 BN_cmp(key->priv_key, EC_GROUP_get0_order(group)) >= 0) { 247 return 0; 248 } 249 return 1; 250 } 251 252 const BIGNUM *EC_KEY_get0_private_key(const EC_KEY *key) { 253 return key->priv_key; 254 } 255 256 int EC_KEY_set_private_key(EC_KEY *key, const BIGNUM *priv_key) { 257 /* XXX: |BN_cmp| is not constant time. */ 258 if (key->group != NULL && 259 BN_cmp(priv_key, EC_GROUP_get0_order(key->group)) >= 0) { 260 OPENSSL_PUT_ERROR(EC, EC_R_WRONG_ORDER); 261 return 0; 262 } 263 BN_clear_free(key->priv_key); 264 key->priv_key = BN_dup(priv_key); 265 return (key->priv_key == NULL) ? 0 : 1; 266 } 267 268 const EC_POINT *EC_KEY_get0_public_key(const EC_KEY *key) { 269 return key->pub_key; 270 } 271 272 int EC_KEY_set_public_key(EC_KEY *key, const EC_POINT *pub_key) { 273 EC_POINT_free(key->pub_key); 274 key->pub_key = EC_POINT_dup(pub_key, key->group); 275 return (key->pub_key == NULL) ? 0 : 1; 276 } 277 278 unsigned int EC_KEY_get_enc_flags(const EC_KEY *key) { return key->enc_flag; } 279 280 void EC_KEY_set_enc_flags(EC_KEY *key, unsigned int flags) { 281 key->enc_flag = flags; 282 } 283 284 point_conversion_form_t EC_KEY_get_conv_form(const EC_KEY *key) { 285 return key->conv_form; 286 } 287 288 void EC_KEY_set_conv_form(EC_KEY *key, point_conversion_form_t cform) { 289 key->conv_form = cform; 290 } 291 292 int EC_KEY_check_key(const EC_KEY *eckey) { 293 int ok = 0; 294 BN_CTX *ctx = NULL; 295 EC_POINT *point = NULL; 296 297 if (!eckey || !eckey->group || !eckey->pub_key) { 298 OPENSSL_PUT_ERROR(EC, ERR_R_PASSED_NULL_PARAMETER); 299 return 0; 300 } 301 302 if (EC_POINT_is_at_infinity(eckey->group, eckey->pub_key)) { 303 OPENSSL_PUT_ERROR(EC, EC_R_POINT_AT_INFINITY); 304 goto err; 305 } 306 307 ctx = BN_CTX_new(); 308 309 if (ctx == NULL) { 310 goto err; 311 } 312 313 /* testing whether the pub_key is on the elliptic curve */ 314 if (!EC_POINT_is_on_curve(eckey->group, eckey->pub_key, ctx)) { 315 OPENSSL_PUT_ERROR(EC, EC_R_POINT_IS_NOT_ON_CURVE); 316 goto err; 317 } 318 /* in case the priv_key is present : 319 * check if generator * priv_key == pub_key 320 */ 321 if (eckey->priv_key) { 322 /* XXX: |BN_cmp| is not constant time. */ 323 if (BN_cmp(eckey->priv_key, EC_GROUP_get0_order(eckey->group)) >= 0) { 324 OPENSSL_PUT_ERROR(EC, EC_R_WRONG_ORDER); 325 goto err; 326 } 327 point = EC_POINT_new(eckey->group); 328 if (point == NULL || 329 !EC_POINT_mul(eckey->group, point, eckey->priv_key, NULL, NULL, ctx)) { 330 OPENSSL_PUT_ERROR(EC, ERR_R_EC_LIB); 331 goto err; 332 } 333 if (EC_POINT_cmp(eckey->group, point, eckey->pub_key, ctx) != 0) { 334 OPENSSL_PUT_ERROR(EC, EC_R_INVALID_PRIVATE_KEY); 335 goto err; 336 } 337 } 338 ok = 1; 339 340 err: 341 BN_CTX_free(ctx); 342 EC_POINT_free(point); 343 return ok; 344 } 345 346 int EC_KEY_check_fips(const EC_KEY *key) { 347 if (EC_KEY_is_opaque(key)) { 348 /* Opaque keys can't be checked. */ 349 OPENSSL_PUT_ERROR(EC, EC_R_PUBLIC_KEY_VALIDATION_FAILED); 350 return 0; 351 } 352 353 if (!EC_KEY_check_key(key)) { 354 return 0; 355 } 356 357 if (key->priv_key) { 358 uint8_t data[16] = {0}; 359 ECDSA_SIG *sig = ECDSA_do_sign(data, sizeof(data), key); 360 #if defined(BORINGSSL_FIPS_BREAK_ECDSA_PWCT) 361 data[0] = ~data[0]; 362 #endif 363 int ok = sig != NULL && 364 ECDSA_do_verify(data, sizeof(data), sig, key); 365 ECDSA_SIG_free(sig); 366 if (!ok) { 367 OPENSSL_PUT_ERROR(EC, EC_R_PUBLIC_KEY_VALIDATION_FAILED); 368 return 0; 369 } 370 } 371 372 return 1; 373 } 374 375 int EC_KEY_set_public_key_affine_coordinates(EC_KEY *key, BIGNUM *x, 376 BIGNUM *y) { 377 BN_CTX *ctx = NULL; 378 BIGNUM *tx, *ty; 379 EC_POINT *point = NULL; 380 int ok = 0; 381 382 if (!key || !key->group || !x || !y) { 383 OPENSSL_PUT_ERROR(EC, ERR_R_PASSED_NULL_PARAMETER); 384 return 0; 385 } 386 ctx = BN_CTX_new(); 387 388 if (ctx == NULL) { 389 return 0; 390 } 391 392 BN_CTX_start(ctx); 393 point = EC_POINT_new(key->group); 394 395 if (point == NULL) { 396 goto err; 397 } 398 399 tx = BN_CTX_get(ctx); 400 ty = BN_CTX_get(ctx); 401 if (tx == NULL || 402 ty == NULL) { 403 goto err; 404 } 405 406 if (!EC_POINT_set_affine_coordinates_GFp(key->group, point, x, y, ctx) || 407 !EC_POINT_get_affine_coordinates_GFp(key->group, point, tx, ty, ctx)) { 408 goto err; 409 } 410 411 /* Check if retrieved coordinates match originals: if not values 412 * are out of range. */ 413 if (BN_cmp(x, tx) || BN_cmp(y, ty)) { 414 OPENSSL_PUT_ERROR(EC, EC_R_COORDINATES_OUT_OF_RANGE); 415 goto err; 416 } 417 418 if (!EC_KEY_set_public_key(key, point)) { 419 goto err; 420 } 421 422 if (EC_KEY_check_key(key) == 0) { 423 goto err; 424 } 425 426 ok = 1; 427 428 err: 429 BN_CTX_end(ctx); 430 BN_CTX_free(ctx); 431 EC_POINT_free(point); 432 return ok; 433 } 434 435 int EC_KEY_generate_key(EC_KEY *eckey) { 436 int ok = 0; 437 BIGNUM *priv_key = NULL; 438 EC_POINT *pub_key = NULL; 439 440 if (!eckey || !eckey->group) { 441 OPENSSL_PUT_ERROR(EC, ERR_R_PASSED_NULL_PARAMETER); 442 return 0; 443 } 444 445 if (eckey->priv_key == NULL) { 446 priv_key = BN_new(); 447 if (priv_key == NULL) { 448 goto err; 449 } 450 } else { 451 priv_key = eckey->priv_key; 452 } 453 454 const BIGNUM *order = EC_GROUP_get0_order(eckey->group); 455 456 /* Check that the size of the group order is FIPS compliant (FIPS 186-4 457 * B.4.2). */ 458 if (BN_num_bits(order) < 160) { 459 OPENSSL_PUT_ERROR(EC, EC_R_INVALID_GROUP_ORDER); 460 goto err; 461 } 462 463 /* Generate the private key by testing candidates (FIPS 186-4 B.4.2). */ 464 if (!BN_rand_range_ex(priv_key, 1, order)) { 465 goto err; 466 } 467 468 if (eckey->pub_key == NULL) { 469 pub_key = EC_POINT_new(eckey->group); 470 if (pub_key == NULL) { 471 goto err; 472 } 473 } else { 474 pub_key = eckey->pub_key; 475 } 476 477 if (!EC_POINT_mul(eckey->group, pub_key, priv_key, NULL, NULL, NULL)) { 478 goto err; 479 } 480 481 eckey->priv_key = priv_key; 482 eckey->pub_key = pub_key; 483 484 ok = 1; 485 486 err: 487 if (eckey->pub_key == NULL) { 488 EC_POINT_free(pub_key); 489 } 490 if (eckey->priv_key == NULL) { 491 BN_free(priv_key); 492 } 493 return ok; 494 } 495 496 int EC_KEY_generate_key_fips(EC_KEY *eckey) { 497 return EC_KEY_generate_key(eckey) && EC_KEY_check_fips(eckey); 498 } 499 500 int EC_KEY_get_ex_new_index(long argl, void *argp, CRYPTO_EX_unused *unused, 501 CRYPTO_EX_dup *dup_unused, 502 CRYPTO_EX_free *free_func) { 503 int index; 504 if (!CRYPTO_get_ex_new_index(g_ec_ex_data_class_bss_get(), &index, argl, argp, 505 free_func)) { 506 return -1; 507 } 508 return index; 509 } 510 511 int EC_KEY_set_ex_data(EC_KEY *d, int idx, void *arg) { 512 return CRYPTO_set_ex_data(&d->ex_data, idx, arg); 513 } 514 515 void *EC_KEY_get_ex_data(const EC_KEY *d, int idx) { 516 return CRYPTO_get_ex_data(&d->ex_data, idx); 517 } 518 519 void EC_KEY_set_asn1_flag(EC_KEY *key, int flag) {} 520