1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 // This code implements SPAKE2, a variant of EKE: 6 // http://www.di.ens.fr/~pointche/pub.php?reference=AbPo04 7 8 #include "crypto/p224_spake.h" 9 10 #include <algorithm> 11 12 #include "base/logging.h" 13 #include "crypto/p224.h" 14 #include "crypto/random.h" 15 #include "crypto/secure_util.h" 16 17 namespace { 18 19 // The following two points (M and N in the protocol) are verifiable random 20 // points on the curve and can be generated with the following code: 21 22 // #include <stdint.h> 23 // #include <stdio.h> 24 // #include <string.h> 25 // 26 // #include <openssl/ec.h> 27 // #include <openssl/obj_mac.h> 28 // #include <openssl/sha.h> 29 // 30 // // Silence a presubmit. 31 // #define PRINTF printf 32 // 33 // static const char kSeed1[] = "P224 point generation seed (M)"; 34 // static const char kSeed2[] = "P224 point generation seed (N)"; 35 // 36 // void find_seed(const char* seed) { 37 // SHA256_CTX sha256; 38 // uint8_t digest[SHA256_DIGEST_LENGTH]; 39 // 40 // SHA256_Init(&sha256); 41 // SHA256_Update(&sha256, seed, strlen(seed)); 42 // SHA256_Final(digest, &sha256); 43 // 44 // BIGNUM x, y; 45 // EC_GROUP* p224 = EC_GROUP_new_by_curve_name(NID_secp224r1); 46 // EC_POINT* p = EC_POINT_new(p224); 47 // 48 // for (unsigned i = 0;; i++) { 49 // BN_init(&x); 50 // BN_bin2bn(digest, 28, &x); 51 // 52 // if (EC_POINT_set_compressed_coordinates_GFp( 53 // p224, p, &x, digest[28] & 1, NULL)) { 54 // BN_init(&y); 55 // EC_POINT_get_affine_coordinates_GFp(p224, p, &x, &y, NULL); 56 // char* x_str = BN_bn2hex(&x); 57 // char* y_str = BN_bn2hex(&y); 58 // PRINTF("Found after %u iterations:\n%s\n%s\n", i, x_str, y_str); 59 // OPENSSL_free(x_str); 60 // OPENSSL_free(y_str); 61 // BN_free(&x); 62 // BN_free(&y); 63 // break; 64 // } 65 // 66 // SHA256_Init(&sha256); 67 // SHA256_Update(&sha256, digest, sizeof(digest)); 68 // SHA256_Final(digest, &sha256); 69 // 70 // BN_free(&x); 71 // } 72 // 73 // EC_POINT_free(p); 74 // EC_GROUP_free(p224); 75 // } 76 // 77 // int main() { 78 // find_seed(kSeed1); 79 // find_seed(kSeed2); 80 // return 0; 81 // } 82 83 const crypto::p224::Point kM = { 84 {174237515, 77186811, 235213682, 33849492, 85 33188520, 48266885, 177021753, 81038478}, 86 {104523827, 245682244, 266509668, 236196369, 87 28372046, 145351378, 198520366, 113345994}, 88 {1, 0, 0, 0, 0, 0, 0, 0}, 89 }; 90 91 const crypto::p224::Point kN = { 92 {136176322, 263523628, 251628795, 229292285, 93 5034302, 185981975, 171998428, 11653062}, 94 {197567436, 51226044, 60372156, 175772188, 95 42075930, 8083165, 160827401, 65097570}, 96 {1, 0, 0, 0, 0, 0, 0, 0}, 97 }; 98 99 } // anonymous namespace 100 101 namespace crypto { 102 103 P224EncryptedKeyExchange::P224EncryptedKeyExchange( 104 PeerType peer_type, const base::StringPiece& password) 105 : state_(kStateInitial), 106 is_server_(peer_type == kPeerTypeServer) { 107 memset(&x_, 0, sizeof(x_)); 108 memset(&expected_authenticator_, 0, sizeof(expected_authenticator_)); 109 110 // x_ is a random scalar. 111 RandBytes(x_, sizeof(x_)); 112 113 // Calculate |password| hash to get SPAKE password value. 114 SHA256HashString(std::string(password.data(), password.length()), 115 pw_, sizeof(pw_)); 116 117 Init(); 118 } 119 120 void P224EncryptedKeyExchange::Init() { 121 // X = g**x_ 122 p224::Point X; 123 p224::ScalarBaseMult(x_, &X); 124 125 // The client masks the Diffie-Hellman value, X, by adding M**pw and the 126 // server uses N**pw. 127 p224::Point MNpw; 128 p224::ScalarMult(is_server_ ? kN : kM, pw_, &MNpw); 129 130 // X* = X + (N|M)**pw 131 p224::Point Xstar; 132 p224::Add(X, MNpw, &Xstar); 133 134 next_message_ = Xstar.ToString(); 135 } 136 137 const std::string& P224EncryptedKeyExchange::GetNextMessage() { 138 if (state_ == kStateInitial) { 139 state_ = kStateRecvDH; 140 return next_message_; 141 } else if (state_ == kStateSendHash) { 142 state_ = kStateRecvHash; 143 return next_message_; 144 } 145 146 LOG(FATAL) << "P224EncryptedKeyExchange::GetNextMessage called in" 147 " bad state " << state_; 148 next_message_ = ""; 149 return next_message_; 150 } 151 152 P224EncryptedKeyExchange::Result P224EncryptedKeyExchange::ProcessMessage( 153 const base::StringPiece& message) { 154 if (state_ == kStateRecvHash) { 155 // This is the final state of the protocol: we are reading the peer's 156 // authentication hash and checking that it matches the one that we expect. 157 if (message.size() != sizeof(expected_authenticator_)) { 158 error_ = "peer's hash had an incorrect size"; 159 return kResultFailed; 160 } 161 if (!SecureMemEqual(message.data(), expected_authenticator_, 162 message.size())) { 163 error_ = "peer's hash had incorrect value"; 164 return kResultFailed; 165 } 166 state_ = kStateDone; 167 return kResultSuccess; 168 } 169 170 if (state_ != kStateRecvDH) { 171 LOG(FATAL) << "P224EncryptedKeyExchange::ProcessMessage called in" 172 " bad state " << state_; 173 error_ = "internal error"; 174 return kResultFailed; 175 } 176 177 // Y* is the other party's masked, Diffie-Hellman value. 178 p224::Point Ystar; 179 if (!Ystar.SetFromString(message)) { 180 error_ = "failed to parse peer's masked Diffie-Hellman value"; 181 return kResultFailed; 182 } 183 184 // We calculate the mask value: (N|M)**pw 185 p224::Point MNpw, minus_MNpw, Y, k; 186 p224::ScalarMult(is_server_ ? kM : kN, pw_, &MNpw); 187 p224::Negate(MNpw, &minus_MNpw); 188 189 // Y = Y* - (N|M)**pw 190 p224::Add(Ystar, minus_MNpw, &Y); 191 192 // K = Y**x_ 193 p224::ScalarMult(Y, x_, &k); 194 195 // If everything worked out, then K is the same for both parties. 196 key_ = k.ToString(); 197 198 std::string client_masked_dh, server_masked_dh; 199 if (is_server_) { 200 client_masked_dh = message.as_string(); 201 server_masked_dh = next_message_; 202 } else { 203 client_masked_dh = next_message_; 204 server_masked_dh = message.as_string(); 205 } 206 207 // Now we calculate the hashes that each side will use to prove to the other 208 // that they derived the correct value for K. 209 uint8_t client_hash[kSHA256Length], server_hash[kSHA256Length]; 210 CalculateHash(kPeerTypeClient, client_masked_dh, server_masked_dh, key_, 211 client_hash); 212 CalculateHash(kPeerTypeServer, client_masked_dh, server_masked_dh, key_, 213 server_hash); 214 215 const uint8_t* my_hash = is_server_ ? server_hash : client_hash; 216 const uint8_t* their_hash = is_server_ ? client_hash : server_hash; 217 218 next_message_ = 219 std::string(reinterpret_cast<const char*>(my_hash), kSHA256Length); 220 memcpy(expected_authenticator_, their_hash, kSHA256Length); 221 state_ = kStateSendHash; 222 return kResultPending; 223 } 224 225 void P224EncryptedKeyExchange::CalculateHash( 226 PeerType peer_type, 227 const std::string& client_masked_dh, 228 const std::string& server_masked_dh, 229 const std::string& k, 230 uint8_t* out_digest) { 231 std::string hash_contents; 232 233 if (peer_type == kPeerTypeServer) { 234 hash_contents = "server"; 235 } else { 236 hash_contents = "client"; 237 } 238 239 hash_contents += client_masked_dh; 240 hash_contents += server_masked_dh; 241 hash_contents += 242 std::string(reinterpret_cast<const char *>(pw_), sizeof(pw_)); 243 hash_contents += k; 244 245 SHA256HashString(hash_contents, out_digest, kSHA256Length); 246 } 247 248 const std::string& P224EncryptedKeyExchange::error() const { 249 return error_; 250 } 251 252 const std::string& P224EncryptedKeyExchange::GetKey() const { 253 DCHECK_EQ(state_, kStateDone); 254 return GetUnverifiedKey(); 255 } 256 257 const std::string& P224EncryptedKeyExchange::GetUnverifiedKey() const { 258 // Key is already final when state is kStateSendHash. Subsequent states are 259 // used only for verification of the key. Some users may combine verification 260 // with sending verifiable data instead of |expected_authenticator_|. 261 DCHECK_GE(state_, kStateSendHash); 262 return key_; 263 } 264 265 void P224EncryptedKeyExchange::SetXForTesting(const std::string& x) { 266 memset(&x_, 0, sizeof(x_)); 267 memcpy(&x_, x.data(), std::min(x.size(), sizeof(x_))); 268 Init(); 269 } 270 271 } // namespace crypto 272
