static int s2n_set_p_g_Ys_dh_params(struct s2n_dh_params *dh_params, struct s2n_blob *p, struct s2n_blob *g, struct s2n_blob *Ys)
{
BIGNUM *bn_p = BN_bin2bn((const unsigned char *)p->data, p->size, NULL);
BIGNUM *bn_g = BN_bin2bn((const unsigned char *)g->data, g->size, NULL);
BIGNUM *bn_Ys = BN_bin2bn((const unsigned char *)Ys->data, Ys->size, NULL);
#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined LIBRESSL_VERSION_NUMBER
dh_params->dh->p = bn_p;
dh_params->dh->g = bn_g;
dh_params->dh->pub_key = bn_Ys;
#else
if (DH_set0_pqg(dh_params->dh, bn_p, NULL, bn_g) == 0) {
/* Per https://www.openssl.org/docs/man1.1.0/crypto/DH_get0_pqg.html:
* values that have been passed in should not be freed directly after this function has been called
*/
S2N_ERROR(S2N_ERR_DH_PARAMS_CREATE);
}
if (DH_set0_key(dh_params->dh, bn_Ys, NULL) == 0) {
/* Same as DH_set0_pqg */
S2N_ERROR(S2N_ERR_DH_PARAMS_CREATE);
}
#endif
return 0;
}
static VALUE
ossl_dh_initialize_copy(VALUE self, VALUE other)
{
EVP_PKEY *pkey;
DH *dh, *dh_other;
const BIGNUM *pub, *priv;
GetPKey(self, pkey);
if (EVP_PKEY_base_id(pkey) != EVP_PKEY_NONE)
ossl_raise(eDHError, "DH already initialized");
GetDH(other, dh_other);
dh = DHparams_dup(dh_other);
if (!dh)
ossl_raise(eDHError, "DHparams_dup");
EVP_PKEY_assign_DH(pkey, dh);
DH_get0_key(dh_other, &pub, &priv);
if (pub) {
BIGNUM *pub2 = BN_dup(pub);
BIGNUM *priv2 = BN_dup(priv);
if (!pub2 || priv && !priv2) {
BN_clear_free(pub2);
BN_clear_free(priv2);
ossl_raise(eDHError, "BN_dup");
}
DH_set0_key(dh, pub2, priv2);
}
return self;
}
bool diffie_hellman::compute_shared_key( const char* buf, uint32_t s ) {
ssl_dh dh = DH_new();
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
auto bn_p = BN_bin2bn( (unsigned char*)&p.front(), p.size(), NULL );
auto bn_pub_key = BN_bin2bn( (unsigned char*)&pub_key.front(), pub_key.size(), NULL );
auto bn_priv_key = BN_bin2bn( (unsigned char*)&priv_key.front(), priv_key.size(), NULL );
auto bn_g = BN_bin2bn( (unsigned char*)&g, 1, NULL );
DH_set0_pqg(dh.obj, bn_p, NULL, bn_g);
DH_set0_key(dh.obj, bn_pub_key, bn_priv_key);
#else
dh->p = BN_bin2bn( (unsigned char*)&p.front(), p.size(), NULL );
dh->pub_key = BN_bin2bn( (unsigned char*)&pub_key.front(), pub_key.size(), NULL );
dh->priv_key = BN_bin2bn( (unsigned char*)&priv_key.front(), priv_key.size(), NULL );
dh->g = BN_bin2bn( (unsigned char*)&g, 1, NULL );
#endif
int check;
DH_check(dh,&check);
if( !fc::validate( dh, valid ) )
{
return false;
}
ssl_bignum pk;
BN_bin2bn( (unsigned char*)buf, s, pk );
shared_key.resize( DH_size(dh) );
DH_compute_key( (unsigned char*)&shared_key.front(), pk, dh );
return true;
}
// Create the OpenSSL representation of the key
void OSSLDHPublicKey::createOSSLKey()
{
if (dh != NULL) return;
dh = DH_new();
if (dh == NULL)
{
ERROR_MSG("Could not create DH object");
return;
}
// Use the OpenSSL implementation and not any engine
#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
#ifdef WITH_FIPS
if (FIPS_mode())
DH_set_method(dh, FIPS_dh_openssl());
else
DH_set_method(dh, DH_OpenSSL());
#else
DH_set_method(dh, DH_OpenSSL());
#endif
#else
DH_set_method(dh, DH_OpenSSL());
#endif
BIGNUM* bn_p = OSSL::byteString2bn(p);
BIGNUM* bn_g = OSSL::byteString2bn(g);
BIGNUM* bn_pub_key = OSSL::byteString2bn(y);
DH_set0_pqg(dh, bn_p, NULL, bn_g);
DH_set0_key(dh, bn_pub_key, NULL);
}
ERL_NIF_TERM dh_compute_key_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
{/* (OthersPublicKey, MyPrivateKey, DHParams=[P,G]) */
BIGNUM *other_pub_key = NULL,
*dh_p = NULL,
*dh_g = NULL;
DH *dh_priv = DH_new();
/* Check the arguments and get
my private key (dh_priv),
the peer's public key (other_pub_key),
the parameters p & q
*/
{
BIGNUM *dummy_pub_key = NULL,
*priv_key = NULL;
ERL_NIF_TERM head, tail;
if (!get_bn_from_bin(env, argv[0], &other_pub_key)
|| !get_bn_from_bin(env, argv[1], &priv_key)
|| !enif_get_list_cell(env, argv[2], &head, &tail)
|| !get_bn_from_bin(env, head, &dh_p)
|| !enif_get_list_cell(env, tail, &head, &tail)
|| !get_bn_from_bin(env, head, &dh_g)
|| !enif_is_empty_list(env, tail)
/* Note: DH_set0_key() does not allow setting only the
* private key, although DH_compute_key() does not use the
* public key. Work around this limitation by setting
* the public key to a copy of the private key.
*/
|| !(dummy_pub_key = BN_dup(priv_key))
|| !DH_set0_key(dh_priv, dummy_pub_key, priv_key)
|| !DH_set0_pqg(dh_priv, dh_p, NULL, dh_g)
) {
if (dh_p) BN_free(dh_p);
if (dh_g) BN_free(dh_g);
if (other_pub_key) BN_free(other_pub_key);
if (dummy_pub_key) BN_free(dummy_pub_key);
if (priv_key) BN_free(priv_key);
return enif_make_badarg(env);
}
}
{
ErlNifBinary ret_bin;
int size;
enif_alloc_binary(DH_size(dh_priv), &ret_bin);
size = DH_compute_key(ret_bin.data, other_pub_key, dh_priv);
BN_free(other_pub_key);
DH_free(dh_priv);
if (size<=0) {
enif_release_binary(&ret_bin);
return atom_error;
}
if (size != ret_bin.size) enif_realloc_binary(&ret_bin, size);
return enif_make_binary(env, &ret_bin);
}
}
DH *DSA_dup_DH(const DSA *r)
{
/*
* DSA has p, q, g, optional pub_key, optional priv_key. DH has p,
* optional length, g, optional pub_key, optional priv_key, optional q.
*/
DH *ret = NULL;
BIGNUM *p = NULL, *q = NULL, *g = NULL, *pub_key = NULL, *priv_key = NULL;
if (r == NULL)
goto err;
ret = DH_new();
if (ret == NULL)
goto err;
if (r->p != NULL || r->g != NULL || r->q != NULL) {
if (r->p == NULL || r->g == NULL || r->q == NULL) {
/* Shouldn't happen */
goto err;
}
p = BN_dup(r->p);
g = BN_dup(r->g);
q = BN_dup(r->q);
if (p == NULL || g == NULL || q == NULL || !DH_set0_pqg(ret, p, q, g))
goto err;
p = g = q = NULL;
}
if (r->pub_key != NULL) {
pub_key = BN_dup(r->pub_key);
if (pub_key == NULL)
goto err;
if (r->priv_key != NULL) {
priv_key = BN_dup(r->priv_key);
if (priv_key == NULL)
goto err;
}
if (!DH_set0_key(ret, pub_key, priv_key))
goto err;
} else if (r->priv_key != NULL) {
/* Shouldn't happen */
goto err;
}
return ret;
err:
BN_free(p);
BN_free(g);
BN_free(q);
BN_free(pub_key);
BN_free(priv_key);
DH_free(ret);
return NULL;
}
int
EVP_PKEY_set_keys(EVP_PKEY *evp_pkey,
const unsigned char *privkey, size_t privkey_len,
const unsigned char *pubkey, size_t pubkey_len,
BN_CTX *bn_ctx)
{
EC_KEY *ec_key = NULL;
DH *dh = NULL;
EC_POINT *ec_point = NULL;
BIGNUM *bn = NULL, *dh_pub_key, *dh_priv_key;
int ok = 0;
const EC_GROUP *group;
check(evp_pkey, "Invalid arguments");
switch (EVP_PKEY_base_id(evp_pkey)) {
case EVP_PKEY_EC:
ec_key = EVP_PKEY_get1_EC_KEY(evp_pkey);
if (!ec_key)
goto err;
group = EC_KEY_get0_group(ec_key);
if (pubkey) {
ec_point = EC_POINT_new(group);
if (!ec_point
|| !EC_POINT_oct2point(group, ec_point, pubkey,
pubkey_len, bn_ctx)
|| !EC_KEY_set_public_key(ec_key, ec_point))
goto err;
}
if (privkey) {
bn = BN_bin2bn(privkey, privkey_len, bn);
if (!bn || !EC_KEY_set_private_key(ec_key, bn))
goto err;
}
if (!EVP_PKEY_set1_EC_KEY(evp_pkey, ec_key))
goto err;
break;
case EVP_PKEY_DH:
dh = EVP_PKEY_get1_DH(evp_pkey);
if (!dh)
goto err;
if (pubkey) {
dh_pub_key = BN_bin2bn(pubkey, pubkey_len, NULL);
if (!dh_pub_key || !DH_set0_key(dh, dh_pub_key, NULL))
goto err;
}
if (privkey) {
dh_priv_key = BN_bin2bn(privkey, privkey_len, NULL);
if (!dh_priv_key || !DH_set0_key(dh, NULL, dh_priv_key))
goto err;
}
if (!EVP_PKEY_set1_DH(evp_pkey, dh))
goto err;
break;
default:
log_err("Unknown type of key");
goto err;
break;
}
ok = 1;
err:
if (bn)
BN_clear_free(bn);
if (ec_key)
EC_KEY_free(ec_key);
if (dh)
DH_free(dh);
if (ec_point)
EC_POINT_clear_free(ec_point);
return ok;
}
static int run_rfc5114_tests(void)
{
int i;
DH *dhA = NULL;
DH *dhB = NULL;
unsigned char *Z1 = NULL;
unsigned char *Z2 = NULL;
const rfc5114_td *td = NULL;
BIGNUM *bady = NULL, *priv_key = NULL, *pub_key = NULL;
for (i = 0; i < (int)OSSL_NELEM(rfctd); i++) {
td = rfctd + i;
/* Set up DH structures setting key components */
dhA = td->get_param();
dhB = td->get_param();
if ((dhA == NULL) || (dhB == NULL))
goto bad_err;
priv_key = BN_bin2bn(td->xA, td->xA_len, NULL);
pub_key = BN_bin2bn(td->yA, td->yA_len, NULL);
if (priv_key == NULL || pub_key == NULL
|| !DH_set0_key(dhA, pub_key, priv_key))
goto bad_err;
priv_key = BN_bin2bn(td->xB, td->xB_len, NULL);
pub_key = BN_bin2bn(td->yB, td->yB_len, NULL);
if (priv_key == NULL || pub_key == NULL
|| !DH_set0_key(dhB, pub_key, priv_key))
goto bad_err;
priv_key = pub_key = NULL;
if ((td->Z_len != (size_t)DH_size(dhA))
|| (td->Z_len != (size_t)DH_size(dhB)))
goto err;
Z1 = OPENSSL_malloc(DH_size(dhA));
Z2 = OPENSSL_malloc(DH_size(dhB));
if ((Z1 == NULL) || (Z2 == NULL))
goto bad_err;
/*
* Work out shared secrets using both sides and compare with expected
* values.
*/
DH_get0_key(dhB, &pub_key, NULL);
if (DH_compute_key(Z1, pub_key, dhA) == -1) {
pub_key = NULL;
goto bad_err;
}
DH_get0_key(dhA, &pub_key, NULL);
if (DH_compute_key(Z2, pub_key, dhB) == -1) {
pub_key = NULL;
goto bad_err;
}
pub_key = NULL;
if (memcmp(Z1, td->Z, td->Z_len))
goto err;
if (memcmp(Z2, td->Z, td->Z_len))
goto err;
printf("RFC5114 parameter test %d OK\n", i + 1);
DH_free(dhA);
DH_free(dhB);
OPENSSL_free(Z1);
OPENSSL_free(Z2);
dhA = NULL;
dhB = NULL;
Z1 = NULL;
Z2 = NULL;
}
/* Now i == OSSL_NELEM(rfctd) */
/* RFC5114 uses unsafe primes, so now test an invalid y value */
dhA = DH_get_2048_224();
if (dhA == NULL)
goto bad_err;
Z1 = OPENSSL_malloc(DH_size(dhA));
if (Z1 == NULL)
goto bad_err;
bady = BN_bin2bn(dhtest_rfc5114_2048_224_bad_y,
sizeof(dhtest_rfc5114_2048_224_bad_y), NULL);
if (bady == NULL)
goto bad_err;
if (!DH_generate_key(dhA))
goto bad_err;
if (DH_compute_key(Z1, bady, dhA) != -1) {
/*
* DH_compute_key should fail with -1. If we get here we unexpectedly
* allowed an invalid y value
*/
goto err;
}
/* We'll have a stale error on the queue from the above test so clear it */
ERR_clear_error();
printf("RFC5114 parameter test %d OK\n", i + 1);
BN_free(bady);
DH_free(dhA);
OPENSSL_free(Z1);
return 1;
bad_err:
BN_free(bady);
DH_free(dhA);
DH_free(dhB);
BN_free(pub_key);
BN_free(priv_key);
OPENSSL_free(Z1);
OPENSSL_free(Z2);
fprintf(stderr, "Initialisation error RFC5114 set %d\n", i + 1);
ERR_print_errors_fp(stderr);
return 0;
err:
BN_free(bady);
DH_free(dhA);
DH_free(dhB);
OPENSSL_free(Z1);
OPENSSL_free(Z2);
fprintf(stderr, "Test failed RFC5114 set %d\n", i + 1);
return 0;
}
ERL_NIF_TERM dh_generate_key_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
{/* (PrivKey|undefined, DHParams=[P,G], Mpint, Len|0) */
DH *dh_params = NULL;
int mpint; /* 0 or 4 */
{
ERL_NIF_TERM head, tail;
BIGNUM
*dh_p = NULL,
*dh_g = NULL,
*priv_key_in = NULL;
unsigned long
len = 0;
if (!(get_bn_from_bin(env, argv[0], &priv_key_in)
|| argv[0] == atom_undefined)
|| !enif_get_list_cell(env, argv[1], &head, &tail)
|| !get_bn_from_bin(env, head, &dh_p)
|| !enif_get_list_cell(env, tail, &head, &tail)
|| !get_bn_from_bin(env, head, &dh_g)
|| !enif_is_empty_list(env, tail)
|| !enif_get_int(env, argv[2], &mpint) || (mpint & ~4)
|| !enif_get_ulong(env, argv[3], &len)
/* Load dh_params with values to use by the generator.
Mem mgmnt transfered from dh_p etc to dh_params */
|| !(dh_params = DH_new())
|| (priv_key_in && !DH_set0_key(dh_params, NULL, priv_key_in))
|| !DH_set0_pqg(dh_params, dh_p, NULL, dh_g)
) {
if (priv_key_in) BN_free(priv_key_in);
if (dh_p) BN_free(dh_p);
if (dh_g) BN_free(dh_g);
if (dh_params) DH_free(dh_params);
return enif_make_badarg(env);
}
if (len) {
if (len < BN_num_bits(dh_p))
DH_set_length(dh_params, len);
else {
if (priv_key_in) BN_free(priv_key_in);
if (dh_p) BN_free(dh_p);
if (dh_g) BN_free(dh_g);
if (dh_params) DH_free(dh_params);
return enif_make_badarg(env);
}
}
}
#ifdef HAS_EVP_PKEY_CTX
{
EVP_PKEY_CTX *ctx;
EVP_PKEY *dhkey, *params;
int success;
params = EVP_PKEY_new();
success = EVP_PKEY_set1_DH(params, dh_params); /* set the key referenced by params to dh_params... */
DH_free(dh_params); /* ...dh_params (and params) must be freed */
if (!success) return atom_error;
ctx = EVP_PKEY_CTX_new(params, NULL);
EVP_PKEY_free(params);
if (!ctx) {
return atom_error;
}
if (!EVP_PKEY_keygen_init(ctx)) {
/* EVP_PKEY_CTX_free(ctx); */
return atom_error;
}
dhkey = EVP_PKEY_new();
if (!EVP_PKEY_keygen(ctx, &dhkey)) { /* "performs a key generation operation, the ... */
/*... generated key is written to ppkey." (=last arg) */
/* EVP_PKEY_CTX_free(ctx); */
/* EVP_PKEY_free(dhkey); */
return atom_error;
}
dh_params = EVP_PKEY_get1_DH(dhkey); /* return the referenced key. dh_params and dhkey must be freed */
EVP_PKEY_free(dhkey);
if (!dh_params) {
/* EVP_PKEY_CTX_free(ctx); */
return atom_error;
}
EVP_PKEY_CTX_free(ctx);
}
#else
if (!DH_generate_key(dh_params)) return atom_error;
#endif
{
unsigned char *pub_ptr, *prv_ptr;
int pub_len, prv_len;
ERL_NIF_TERM ret_pub, ret_prv;
const BIGNUM *pub_key_gen, *priv_key_gen;
DH_get0_key(dh_params,
&pub_key_gen, &priv_key_gen); /* Get pub_key_gen and priv_key_gen.
"The values point to the internal representation of
the public key and private key values. This memory
should not be freed directly." says man */
pub_len = BN_num_bytes(pub_key_gen);
prv_len = BN_num_bytes(priv_key_gen);
pub_ptr = enif_make_new_binary(env, pub_len+mpint, &ret_pub);
prv_ptr = enif_make_new_binary(env, prv_len+mpint, &ret_prv);
if (mpint) {
put_int32(pub_ptr, pub_len); pub_ptr += 4;
put_int32(prv_ptr, prv_len); prv_ptr += 4;
}
BN_bn2bin(pub_key_gen, pub_ptr);
BN_bn2bin(priv_key_gen, prv_ptr);
ERL_VALGRIND_MAKE_MEM_DEFINED(pub_ptr, pub_len);
ERL_VALGRIND_MAKE_MEM_DEFINED(prv_ptr, prv_len);
DH_free(dh_params);
return enif_make_tuple2(env, ret_pub, ret_prv);
}
}
