/* A = g^a % N
* returns A and a (which is random)
*/
mpi_t
_gnutls_calc_srp_A (mpi_t * a, mpi_t g, mpi_t n)
{
mpi_t tmpa;
mpi_t A;
int bits;
bits = _gnutls_mpi_get_nbits (n);
tmpa = _gnutls_mpi_snew (bits);
if (tmpa == NULL)
{
gnutls_assert ();
return NULL;
}
_gnutls_mpi_randomize (tmpa, bits, GCRY_STRONG_RANDOM);
A = _gnutls_mpi_snew (bits);
if (A == NULL)
{
gnutls_assert ();
_gnutls_mpi_release (&tmpa);
return NULL;
}
_gnutls_mpi_powm (A, g, tmpa, n);
if (a != NULL)
*a = tmpa;
else
_gnutls_mpi_release (&tmpa);
return A;
}
/* A = g^a % N
* returns A and a (which is random)
*/
bigint_t
_gnutls_calc_srp_A (bigint_t * a, bigint_t g, bigint_t n)
{
bigint_t tmpa;
bigint_t A;
int bits;
bits = _gnutls_mpi_get_nbits (n);
tmpa = _gnutls_mpi_randomize (NULL, bits, GNUTLS_RND_RANDOM);
A = _gnutls_mpi_new (bits);
if (A == NULL)
{
gnutls_assert ();
_gnutls_mpi_release (&tmpa);
return NULL;
}
_gnutls_mpi_powm (A, g, tmpa, n);
if (a != NULL)
*a = tmpa;
else
_gnutls_mpi_release (&tmpa);
return A;
}
/* returns the public value (X), and the secret (ret_x).
*/
mpi_t
gnutls_calc_dh_secret (mpi_t * ret_x, mpi_t g, mpi_t prime)
{
mpi_t e, x;
int x_size = _gnutls_mpi_get_nbits (prime) - 1;
/* The size of the secret key is less than
* prime/2
*/
if (x_size > MAX_BITS || x_size <= 0)
{
gnutls_assert ();
return NULL;
}
x = _gnutls_mpi_new (x_size);
if (x == NULL)
{
gnutls_assert ();
if (ret_x)
*ret_x = NULL;
return NULL;
}
/* FIXME: (x_size/8)*8 is there to overcome a bug in libgcrypt
* which does not really check the bits given but the bytes.
*/
do
{
_gnutls_mpi_randomize (x, (x_size / 8) * 8, GCRY_STRONG_RANDOM);
/* Check whether x is zero.
*/
}
while (_gnutls_mpi_cmp_ui (x, 0) == 0);
e = _gnutls_mpi_alloc_like (prime);
if (e == NULL)
{
gnutls_assert ();
if (ret_x)
*ret_x = NULL;
_gnutls_mpi_release (&x);
return NULL;
}
_gnutls_mpi_powm (e, g, x, prime);
if (ret_x)
*ret_x = x;
else
_gnutls_mpi_release (&x);
return e;
}
/* returns the blinded c and the inverse of a random
* number r;
*/
static bigint_t
rsa_blind (bigint_t c, bigint_t e, bigint_t n, bigint_t * _ri)
{
bigint_t nc = NULL, r = NULL, ri = NULL;
/* nc = c*(r^e)
* ri = r^(-1)
*/
nc = _gnutls_mpi_alloc_like (n);
if (nc == NULL)
{
gnutls_assert ();
return NULL;
}
ri = _gnutls_mpi_alloc_like (n);
if (nc == NULL)
{
gnutls_assert ();
goto fail;
}
r = _gnutls_mpi_randomize (NULL, _gnutls_mpi_get_nbits (n),
GNUTLS_RND_NONCE);
if (r == NULL)
{
gnutls_assert ();
goto fail;
}
/* invert r */
if (mpz_invert (ri, r, n) == 0)
{
gnutls_assert ();
goto fail;
}
/* r = r^e */
_gnutls_mpi_powm (r, r, e, n);
_gnutls_mpi_mulm (nc, c, r, n);
*_ri = ri;
_gnutls_mpi_release (&r);
return nc;
fail:
_gnutls_mpi_release (&nc);
_gnutls_mpi_release (&r);
return NULL;
}
/*
* Copyright (C) 2007-2012 Free Software Foundation, Inc.
*
* Author: Nikos Mavrogiannopoulos, Simon Josefsson
*
* This file is part of GnuTLS.
*
* GnuTLS is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 3 of the License, or
* (at your option) any later version.
*
* GnuTLS is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with GnuTLS; if not, write to the Free Software Foundation,
* Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
*/
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
#include <stdio.h>
#include "utils.h"
#include "../lib/gnutls_int.h"
#include "../lib/gnutls_mpi.h"
#include "../lib/gnutls_errors.h"
#include "../lib/debug.h"
static void
tls_log_func (int level, const char *str)
{
fprintf (stderr, "|<%d>| %s", level, str);
}
#define RND_BITS 510 /* not multiple of 8 */
void
doit (void)
{
int rc;
bigint_t n1, n2, n3, n4;
gnutls_global_init ();
gnutls_global_set_log_function (tls_log_func);
if (debug)
gnutls_global_set_log_level (99);
n1 = _gnutls_mpi_new (1000);
if (n1 == NULL)
fail ("mpi_new failed\n");
n2 = _gnutls_mpi_set_ui (NULL, 2);
if (n2 == NULL)
fail ("mpi_set_ui failed\n");
n3 = _gnutls_mpi_set_ui (NULL, 5);
if (n3 == NULL)
fail ("mpi_set_ui failed\n");
_gnutls_mpi_randomize (n1, RND_BITS, GNUTLS_RND_NONCE);
_gnutls_mpi_log ("rand:", n1);
rc = _gnutls_mpi_get_nbits (n1);
if (rc > RND_BITS)
fail ("mpi_get_nbits failed... returned %d\n", rc);
n4 = _gnutls_mpi_addm (NULL, n1, n3, n2);
if (n4 == NULL)
fail ("mpi_set_ui failed\n");
if (_gnutls_mpi_cmp_ui (n4, 0) != 0 && _gnutls_mpi_cmp_ui (n4, 1) != 0)
fail ("mpi_cmp_ui failed\n");
_gnutls_mpi_release (&n1);
_gnutls_mpi_release (&n2);
_gnutls_mpi_release (&n3);
_gnutls_mpi_release (&n4);
gnutls_global_deinit ();
if (debug) success ("mpi ops ok\n");
}
/****************
* Choose a random value b and calculate B = (k* v + g^b) % N.
* where k == SHA1(N|g)
* Return: B and if ret_b is not NULL b.
*/
mpi_t
_gnutls_calc_srp_B (mpi_t * ret_b, mpi_t g, mpi_t n, mpi_t v)
{
mpi_t tmpB = NULL, tmpV = NULL;
mpi_t b = NULL, B = NULL, k = NULL;
int bits;
/* calculate: B = (k*v + g^b) % N
*/
bits = _gnutls_mpi_get_nbits (n);
b = _gnutls_mpi_snew (bits);
if (b == NULL)
{
gnutls_assert ();
return NULL;
}
tmpV = _gnutls_mpi_alloc_like (n);
if (tmpV == NULL)
{
gnutls_assert ();
goto error;
}
_gnutls_mpi_randomize (b, bits, GCRY_STRONG_RANDOM);
tmpB = _gnutls_mpi_snew (bits);
if (tmpB == NULL)
{
gnutls_assert ();
goto error;
}
B = _gnutls_mpi_snew (bits);
if (B == NULL)
{
gnutls_assert ();
goto error;
}
k = _gnutls_calc_srp_u (n, g, n);
if (k == NULL)
{
gnutls_assert ();
goto error;
}
_gnutls_mpi_mulm (tmpV, k, v, n);
_gnutls_mpi_powm (tmpB, g, b, n);
_gnutls_mpi_addm (B, tmpV, tmpB, n);
_gnutls_mpi_release (&k);
_gnutls_mpi_release (&tmpB);
_gnutls_mpi_release (&tmpV);
if (ret_b)
*ret_b = b;
else
_gnutls_mpi_release (&b);
return B;
error:
_gnutls_mpi_release (&b);
_gnutls_mpi_release (&B);
_gnutls_mpi_release (&k);
_gnutls_mpi_release (&tmpB);
_gnutls_mpi_release (&tmpV);
return NULL;
}
