1 /* 2 * Wrapper functions for OpenSSL libcrypto 3 * Copyright (c) 2004-2015, Jouni Malinen <j@w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #include "includes.h" 10 #include <openssl/opensslv.h> 11 #include <openssl/err.h> 12 #include <openssl/des.h> 13 #include <openssl/aes.h> 14 #include <openssl/bn.h> 15 #include <openssl/evp.h> 16 #include <openssl/dh.h> 17 #include <openssl/hmac.h> 18 #include <openssl/rand.h> 19 #ifdef CONFIG_OPENSSL_CMAC 20 #include <openssl/cmac.h> 21 #endif /* CONFIG_OPENSSL_CMAC */ 22 #ifdef CONFIG_ECC 23 #include <openssl/ec.h> 24 #endif /* CONFIG_ECC */ 25 26 #include "common.h" 27 #include "wpabuf.h" 28 #include "dh_group5.h" 29 #include "sha1.h" 30 #include "sha256.h" 31 #include "sha384.h" 32 #include "md5.h" 33 #include "aes_wrap.h" 34 #include "crypto.h" 35 36 #if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER) 37 /* Compatibility wrappers for older versions. */ 38 39 static HMAC_CTX * HMAC_CTX_new(void) 40 { 41 HMAC_CTX *ctx; 42 43 ctx = os_zalloc(sizeof(*ctx)); 44 if (ctx) 45 HMAC_CTX_init(ctx); 46 return ctx; 47 } 48 49 50 static void HMAC_CTX_free(HMAC_CTX *ctx) 51 { 52 if (!ctx) 53 return; 54 HMAC_CTX_cleanup(ctx); 55 bin_clear_free(ctx, sizeof(*ctx)); 56 } 57 58 59 static EVP_MD_CTX * EVP_MD_CTX_new(void) 60 { 61 EVP_MD_CTX *ctx; 62 63 ctx = os_zalloc(sizeof(*ctx)); 64 if (ctx) 65 EVP_MD_CTX_init(ctx); 66 return ctx; 67 } 68 69 70 static void EVP_MD_CTX_free(EVP_MD_CTX *ctx) 71 { 72 if (!ctx) 73 return; 74 EVP_MD_CTX_cleanup(ctx); 75 bin_clear_free(ctx, sizeof(*ctx)); 76 } 77 78 #endif /* OpenSSL version < 1.1.0 */ 79 80 static BIGNUM * get_group5_prime(void) 81 { 82 #if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER) 83 return BN_get_rfc3526_prime_1536(NULL); 84 #elif !defined(OPENSSL_IS_BORINGSSL) 85 return get_rfc3526_prime_1536(NULL); 86 #else 87 static const unsigned char RFC3526_PRIME_1536[] = { 88 0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xC9,0x0F,0xDA,0xA2, 89 0x21,0x68,0xC2,0x34,0xC4,0xC6,0x62,0x8B,0x80,0xDC,0x1C,0xD1, 90 0x29,0x02,0x4E,0x08,0x8A,0x67,0xCC,0x74,0x02,0x0B,0xBE,0xA6, 91 0x3B,0x13,0x9B,0x22,0x51,0x4A,0x08,0x79,0x8E,0x34,0x04,0xDD, 92 0xEF,0x95,0x19,0xB3,0xCD,0x3A,0x43,0x1B,0x30,0x2B,0x0A,0x6D, 93 0xF2,0x5F,0x14,0x37,0x4F,0xE1,0x35,0x6D,0x6D,0x51,0xC2,0x45, 94 0xE4,0x85,0xB5,0x76,0x62,0x5E,0x7E,0xC6,0xF4,0x4C,0x42,0xE9, 95 0xA6,0x37,0xED,0x6B,0x0B,0xFF,0x5C,0xB6,0xF4,0x06,0xB7,0xED, 96 0xEE,0x38,0x6B,0xFB,0x5A,0x89,0x9F,0xA5,0xAE,0x9F,0x24,0x11, 97 0x7C,0x4B,0x1F,0xE6,0x49,0x28,0x66,0x51,0xEC,0xE4,0x5B,0x3D, 98 0xC2,0x00,0x7C,0xB8,0xA1,0x63,0xBF,0x05,0x98,0xDA,0x48,0x36, 99 0x1C,0x55,0xD3,0x9A,0x69,0x16,0x3F,0xA8,0xFD,0x24,0xCF,0x5F, 100 0x83,0x65,0x5D,0x23,0xDC,0xA3,0xAD,0x96,0x1C,0x62,0xF3,0x56, 101 0x20,0x85,0x52,0xBB,0x9E,0xD5,0x29,0x07,0x70,0x96,0x96,0x6D, 102 0x67,0x0C,0x35,0x4E,0x4A,0xBC,0x98,0x04,0xF1,0x74,0x6C,0x08, 103 0xCA,0x23,0x73,0x27,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF, 104 }; 105 return BN_bin2bn(RFC3526_PRIME_1536, sizeof(RFC3526_PRIME_1536), NULL); 106 #endif 107 } 108 109 #ifdef OPENSSL_NO_SHA256 110 #define NO_SHA256_WRAPPER 111 #endif 112 113 static int openssl_digest_vector(const EVP_MD *type, size_t num_elem, 114 const u8 *addr[], const size_t *len, u8 *mac) 115 { 116 EVP_MD_CTX *ctx; 117 size_t i; 118 unsigned int mac_len; 119 120 if (TEST_FAIL()) 121 return -1; 122 123 ctx = EVP_MD_CTX_new(); 124 if (!ctx) 125 return -1; 126 if (!EVP_DigestInit_ex(ctx, type, NULL)) { 127 wpa_printf(MSG_ERROR, "OpenSSL: EVP_DigestInit_ex failed: %s", 128 ERR_error_string(ERR_get_error(), NULL)); 129 EVP_MD_CTX_free(ctx); 130 return -1; 131 } 132 for (i = 0; i < num_elem; i++) { 133 if (!EVP_DigestUpdate(ctx, addr[i], len[i])) { 134 wpa_printf(MSG_ERROR, "OpenSSL: EVP_DigestUpdate " 135 "failed: %s", 136 ERR_error_string(ERR_get_error(), NULL)); 137 EVP_MD_CTX_free(ctx); 138 return -1; 139 } 140 } 141 if (!EVP_DigestFinal(ctx, mac, &mac_len)) { 142 wpa_printf(MSG_ERROR, "OpenSSL: EVP_DigestFinal failed: %s", 143 ERR_error_string(ERR_get_error(), NULL)); 144 EVP_MD_CTX_free(ctx); 145 return -1; 146 } 147 EVP_MD_CTX_free(ctx); 148 149 return 0; 150 } 151 152 153 #ifndef CONFIG_FIPS 154 int md4_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac) 155 { 156 return openssl_digest_vector(EVP_md4(), num_elem, addr, len, mac); 157 } 158 #endif /* CONFIG_FIPS */ 159 160 161 void des_encrypt(const u8 *clear, const u8 *key, u8 *cypher) 162 { 163 u8 pkey[8], next, tmp; 164 int i; 165 DES_key_schedule ks; 166 167 /* Add parity bits to the key */ 168 next = 0; 169 for (i = 0; i < 7; i++) { 170 tmp = key[i]; 171 pkey[i] = (tmp >> i) | next | 1; 172 next = tmp << (7 - i); 173 } 174 pkey[i] = next | 1; 175 176 DES_set_key((DES_cblock *) &pkey, &ks); 177 DES_ecb_encrypt((DES_cblock *) clear, (DES_cblock *) cypher, &ks, 178 DES_ENCRYPT); 179 } 180 181 182 #ifndef CONFIG_NO_RC4 183 int rc4_skip(const u8 *key, size_t keylen, size_t skip, 184 u8 *data, size_t data_len) 185 { 186 #ifdef OPENSSL_NO_RC4 187 return -1; 188 #else /* OPENSSL_NO_RC4 */ 189 EVP_CIPHER_CTX *ctx; 190 int outl; 191 int res = -1; 192 unsigned char skip_buf[16]; 193 194 ctx = EVP_CIPHER_CTX_new(); 195 if (!ctx || 196 !EVP_CIPHER_CTX_set_padding(ctx, 0) || 197 !EVP_CipherInit_ex(ctx, EVP_rc4(), NULL, NULL, NULL, 1) || 198 !EVP_CIPHER_CTX_set_key_length(ctx, keylen) || 199 !EVP_CipherInit_ex(ctx, NULL, NULL, key, NULL, 1)) 200 goto out; 201 202 while (skip >= sizeof(skip_buf)) { 203 size_t len = skip; 204 if (len > sizeof(skip_buf)) 205 len = sizeof(skip_buf); 206 if (!EVP_CipherUpdate(ctx, skip_buf, &outl, skip_buf, len)) 207 goto out; 208 skip -= len; 209 } 210 211 if (EVP_CipherUpdate(ctx, data, &outl, data, data_len)) 212 res = 0; 213 214 out: 215 if (ctx) 216 EVP_CIPHER_CTX_free(ctx); 217 return res; 218 #endif /* OPENSSL_NO_RC4 */ 219 } 220 #endif /* CONFIG_NO_RC4 */ 221 222 223 #ifndef CONFIG_FIPS 224 int md5_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac) 225 { 226 return openssl_digest_vector(EVP_md5(), num_elem, addr, len, mac); 227 } 228 #endif /* CONFIG_FIPS */ 229 230 231 int sha1_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac) 232 { 233 return openssl_digest_vector(EVP_sha1(), num_elem, addr, len, mac); 234 } 235 236 237 #ifndef NO_SHA256_WRAPPER 238 int sha256_vector(size_t num_elem, const u8 *addr[], const size_t *len, 239 u8 *mac) 240 { 241 return openssl_digest_vector(EVP_sha256(), num_elem, addr, len, mac); 242 } 243 #endif /* NO_SHA256_WRAPPER */ 244 245 246 static const EVP_CIPHER * aes_get_evp_cipher(size_t keylen) 247 { 248 switch (keylen) { 249 case 16: 250 return EVP_aes_128_ecb(); 251 #ifndef OPENSSL_IS_BORINGSSL 252 case 24: 253 return EVP_aes_192_ecb(); 254 #endif /* OPENSSL_IS_BORINGSSL */ 255 case 32: 256 return EVP_aes_256_ecb(); 257 } 258 259 return NULL; 260 } 261 262 263 void * aes_encrypt_init(const u8 *key, size_t len) 264 { 265 EVP_CIPHER_CTX *ctx; 266 const EVP_CIPHER *type; 267 268 if (TEST_FAIL()) 269 return NULL; 270 271 type = aes_get_evp_cipher(len); 272 if (type == NULL) 273 return NULL; 274 275 ctx = EVP_CIPHER_CTX_new(); 276 if (ctx == NULL) 277 return NULL; 278 if (EVP_EncryptInit_ex(ctx, type, NULL, key, NULL) != 1) { 279 os_free(ctx); 280 return NULL; 281 } 282 EVP_CIPHER_CTX_set_padding(ctx, 0); 283 return ctx; 284 } 285 286 287 void aes_encrypt(void *ctx, const u8 *plain, u8 *crypt) 288 { 289 EVP_CIPHER_CTX *c = ctx; 290 int clen = 16; 291 if (EVP_EncryptUpdate(c, crypt, &clen, plain, 16) != 1) { 292 wpa_printf(MSG_ERROR, "OpenSSL: EVP_EncryptUpdate failed: %s", 293 ERR_error_string(ERR_get_error(), NULL)); 294 } 295 } 296 297 298 void aes_encrypt_deinit(void *ctx) 299 { 300 EVP_CIPHER_CTX *c = ctx; 301 u8 buf[16]; 302 int len = sizeof(buf); 303 if (EVP_EncryptFinal_ex(c, buf, &len) != 1) { 304 wpa_printf(MSG_ERROR, "OpenSSL: EVP_EncryptFinal_ex failed: " 305 "%s", ERR_error_string(ERR_get_error(), NULL)); 306 } 307 if (len != 0) { 308 wpa_printf(MSG_ERROR, "OpenSSL: Unexpected padding length %d " 309 "in AES encrypt", len); 310 } 311 EVP_CIPHER_CTX_free(c); 312 } 313 314 315 void * aes_decrypt_init(const u8 *key, size_t len) 316 { 317 EVP_CIPHER_CTX *ctx; 318 const EVP_CIPHER *type; 319 320 if (TEST_FAIL()) 321 return NULL; 322 323 type = aes_get_evp_cipher(len); 324 if (type == NULL) 325 return NULL; 326 327 ctx = EVP_CIPHER_CTX_new(); 328 if (ctx == NULL) 329 return NULL; 330 if (EVP_DecryptInit_ex(ctx, type, NULL, key, NULL) != 1) { 331 EVP_CIPHER_CTX_free(ctx); 332 return NULL; 333 } 334 EVP_CIPHER_CTX_set_padding(ctx, 0); 335 return ctx; 336 } 337 338 339 void aes_decrypt(void *ctx, const u8 *crypt, u8 *plain) 340 { 341 EVP_CIPHER_CTX *c = ctx; 342 int plen = 16; 343 if (EVP_DecryptUpdate(c, plain, &plen, crypt, 16) != 1) { 344 wpa_printf(MSG_ERROR, "OpenSSL: EVP_DecryptUpdate failed: %s", 345 ERR_error_string(ERR_get_error(), NULL)); 346 } 347 } 348 349 350 void aes_decrypt_deinit(void *ctx) 351 { 352 EVP_CIPHER_CTX *c = ctx; 353 u8 buf[16]; 354 int len = sizeof(buf); 355 if (EVP_DecryptFinal_ex(c, buf, &len) != 1) { 356 wpa_printf(MSG_ERROR, "OpenSSL: EVP_DecryptFinal_ex failed: " 357 "%s", ERR_error_string(ERR_get_error(), NULL)); 358 } 359 if (len != 0) { 360 wpa_printf(MSG_ERROR, "OpenSSL: Unexpected padding length %d " 361 "in AES decrypt", len); 362 } 363 EVP_CIPHER_CTX_free(c); 364 } 365 366 367 #ifndef CONFIG_FIPS 368 #ifndef CONFIG_OPENSSL_INTERNAL_AES_WRAP 369 370 int aes_wrap(const u8 *kek, size_t kek_len, int n, const u8 *plain, u8 *cipher) 371 { 372 AES_KEY actx; 373 int res; 374 375 if (AES_set_encrypt_key(kek, kek_len << 3, &actx)) 376 return -1; 377 res = AES_wrap_key(&actx, NULL, cipher, plain, n * 8); 378 OPENSSL_cleanse(&actx, sizeof(actx)); 379 return res <= 0 ? -1 : 0; 380 } 381 382 383 int aes_unwrap(const u8 *kek, size_t kek_len, int n, const u8 *cipher, 384 u8 *plain) 385 { 386 AES_KEY actx; 387 int res; 388 389 if (AES_set_decrypt_key(kek, kek_len << 3, &actx)) 390 return -1; 391 res = AES_unwrap_key(&actx, NULL, plain, cipher, (n + 1) * 8); 392 OPENSSL_cleanse(&actx, sizeof(actx)); 393 return res <= 0 ? -1 : 0; 394 } 395 396 #endif /* CONFIG_OPENSSL_INTERNAL_AES_WRAP */ 397 #endif /* CONFIG_FIPS */ 398 399 400 int aes_128_cbc_encrypt(const u8 *key, const u8 *iv, u8 *data, size_t data_len) 401 { 402 EVP_CIPHER_CTX *ctx; 403 int clen, len; 404 u8 buf[16]; 405 int res = -1; 406 407 if (TEST_FAIL()) 408 return -1; 409 410 ctx = EVP_CIPHER_CTX_new(); 411 if (!ctx) 412 return -1; 413 clen = data_len; 414 len = sizeof(buf); 415 if (EVP_EncryptInit_ex(ctx, EVP_aes_128_cbc(), NULL, key, iv) == 1 && 416 EVP_CIPHER_CTX_set_padding(ctx, 0) == 1 && 417 EVP_EncryptUpdate(ctx, data, &clen, data, data_len) == 1 && 418 clen == (int) data_len && 419 EVP_EncryptFinal_ex(ctx, buf, &len) == 1 && len == 0) 420 res = 0; 421 EVP_CIPHER_CTX_free(ctx); 422 423 return res; 424 } 425 426 427 int aes_128_cbc_decrypt(const u8 *key, const u8 *iv, u8 *data, size_t data_len) 428 { 429 EVP_CIPHER_CTX *ctx; 430 int plen, len; 431 u8 buf[16]; 432 int res = -1; 433 434 if (TEST_FAIL()) 435 return -1; 436 437 ctx = EVP_CIPHER_CTX_new(); 438 if (!ctx) 439 return -1; 440 plen = data_len; 441 len = sizeof(buf); 442 if (EVP_DecryptInit_ex(ctx, EVP_aes_128_cbc(), NULL, key, iv) == 1 && 443 EVP_CIPHER_CTX_set_padding(ctx, 0) == 1 && 444 EVP_DecryptUpdate(ctx, data, &plen, data, data_len) == 1 && 445 plen == (int) data_len && 446 EVP_DecryptFinal_ex(ctx, buf, &len) == 1 && len == 0) 447 res = 0; 448 EVP_CIPHER_CTX_free(ctx); 449 450 return res; 451 452 } 453 454 455 int crypto_mod_exp(const u8 *base, size_t base_len, 456 const u8 *power, size_t power_len, 457 const u8 *modulus, size_t modulus_len, 458 u8 *result, size_t *result_len) 459 { 460 BIGNUM *bn_base, *bn_exp, *bn_modulus, *bn_result; 461 int ret = -1; 462 BN_CTX *ctx; 463 464 ctx = BN_CTX_new(); 465 if (ctx == NULL) 466 return -1; 467 468 bn_base = BN_bin2bn(base, base_len, NULL); 469 bn_exp = BN_bin2bn(power, power_len, NULL); 470 bn_modulus = BN_bin2bn(modulus, modulus_len, NULL); 471 bn_result = BN_new(); 472 473 if (bn_base == NULL || bn_exp == NULL || bn_modulus == NULL || 474 bn_result == NULL) 475 goto error; 476 477 if (BN_mod_exp(bn_result, bn_base, bn_exp, bn_modulus, ctx) != 1) 478 goto error; 479 480 *result_len = BN_bn2bin(bn_result, result); 481 ret = 0; 482 483 error: 484 BN_clear_free(bn_base); 485 BN_clear_free(bn_exp); 486 BN_clear_free(bn_modulus); 487 BN_clear_free(bn_result); 488 BN_CTX_free(ctx); 489 return ret; 490 } 491 492 493 struct crypto_cipher { 494 EVP_CIPHER_CTX *enc; 495 EVP_CIPHER_CTX *dec; 496 }; 497 498 499 struct crypto_cipher * crypto_cipher_init(enum crypto_cipher_alg alg, 500 const u8 *iv, const u8 *key, 501 size_t key_len) 502 { 503 struct crypto_cipher *ctx; 504 const EVP_CIPHER *cipher; 505 506 ctx = os_zalloc(sizeof(*ctx)); 507 if (ctx == NULL) 508 return NULL; 509 510 switch (alg) { 511 #ifndef CONFIG_NO_RC4 512 #ifndef OPENSSL_NO_RC4 513 case CRYPTO_CIPHER_ALG_RC4: 514 cipher = EVP_rc4(); 515 break; 516 #endif /* OPENSSL_NO_RC4 */ 517 #endif /* CONFIG_NO_RC4 */ 518 #ifndef OPENSSL_NO_AES 519 case CRYPTO_CIPHER_ALG_AES: 520 switch (key_len) { 521 case 16: 522 cipher = EVP_aes_128_cbc(); 523 break; 524 #ifndef OPENSSL_IS_BORINGSSL 525 case 24: 526 cipher = EVP_aes_192_cbc(); 527 break; 528 #endif /* OPENSSL_IS_BORINGSSL */ 529 case 32: 530 cipher = EVP_aes_256_cbc(); 531 break; 532 default: 533 os_free(ctx); 534 return NULL; 535 } 536 break; 537 #endif /* OPENSSL_NO_AES */ 538 #ifndef OPENSSL_NO_DES 539 case CRYPTO_CIPHER_ALG_3DES: 540 cipher = EVP_des_ede3_cbc(); 541 break; 542 case CRYPTO_CIPHER_ALG_DES: 543 cipher = EVP_des_cbc(); 544 break; 545 #endif /* OPENSSL_NO_DES */ 546 #ifndef OPENSSL_NO_RC2 547 case CRYPTO_CIPHER_ALG_RC2: 548 cipher = EVP_rc2_ecb(); 549 break; 550 #endif /* OPENSSL_NO_RC2 */ 551 default: 552 os_free(ctx); 553 return NULL; 554 } 555 556 if (!(ctx->enc = EVP_CIPHER_CTX_new()) || 557 !EVP_CIPHER_CTX_set_padding(ctx->enc, 0) || 558 !EVP_EncryptInit_ex(ctx->enc, cipher, NULL, NULL, NULL) || 559 !EVP_CIPHER_CTX_set_key_length(ctx->enc, key_len) || 560 !EVP_EncryptInit_ex(ctx->enc, NULL, NULL, key, iv)) { 561 if (ctx->enc) 562 EVP_CIPHER_CTX_free(ctx->enc); 563 os_free(ctx); 564 return NULL; 565 } 566 567 if (!(ctx->dec = EVP_CIPHER_CTX_new()) || 568 !EVP_CIPHER_CTX_set_padding(ctx->dec, 0) || 569 !EVP_DecryptInit_ex(ctx->dec, cipher, NULL, NULL, NULL) || 570 !EVP_CIPHER_CTX_set_key_length(ctx->dec, key_len) || 571 !EVP_DecryptInit_ex(ctx->dec, NULL, NULL, key, iv)) { 572 EVP_CIPHER_CTX_free(ctx->enc); 573 if (ctx->dec) 574 EVP_CIPHER_CTX_free(ctx->dec); 575 os_free(ctx); 576 return NULL; 577 } 578 579 return ctx; 580 } 581 582 583 int crypto_cipher_encrypt(struct crypto_cipher *ctx, const u8 *plain, 584 u8 *crypt, size_t len) 585 { 586 int outl; 587 if (!EVP_EncryptUpdate(ctx->enc, crypt, &outl, plain, len)) 588 return -1; 589 return 0; 590 } 591 592 593 int crypto_cipher_decrypt(struct crypto_cipher *ctx, const u8 *crypt, 594 u8 *plain, size_t len) 595 { 596 int outl; 597 outl = len; 598 if (!EVP_DecryptUpdate(ctx->dec, plain, &outl, crypt, len)) 599 return -1; 600 return 0; 601 } 602 603 604 void crypto_cipher_deinit(struct crypto_cipher *ctx) 605 { 606 EVP_CIPHER_CTX_free(ctx->enc); 607 EVP_CIPHER_CTX_free(ctx->dec); 608 os_free(ctx); 609 } 610 611 612 void * dh5_init(struct wpabuf **priv, struct wpabuf **publ) 613 { 614 #if OPENSSL_VERSION_NUMBER < 0x10100000L 615 DH *dh; 616 struct wpabuf *pubkey = NULL, *privkey = NULL; 617 size_t publen, privlen; 618 619 *priv = NULL; 620 wpabuf_free(*publ); 621 *publ = NULL; 622 623 dh = DH_new(); 624 if (dh == NULL) 625 return NULL; 626 627 dh->g = BN_new(); 628 if (dh->g == NULL || BN_set_word(dh->g, 2) != 1) 629 goto err; 630 631 dh->p = get_group5_prime(); 632 if (dh->p == NULL) 633 goto err; 634 635 if (DH_generate_key(dh) != 1) 636 goto err; 637 638 publen = BN_num_bytes(dh->pub_key); 639 pubkey = wpabuf_alloc(publen); 640 if (pubkey == NULL) 641 goto err; 642 privlen = BN_num_bytes(dh->priv_key); 643 privkey = wpabuf_alloc(privlen); 644 if (privkey == NULL) 645 goto err; 646 647 BN_bn2bin(dh->pub_key, wpabuf_put(pubkey, publen)); 648 BN_bn2bin(dh->priv_key, wpabuf_put(privkey, privlen)); 649 650 *priv = privkey; 651 *publ = pubkey; 652 return dh; 653 654 err: 655 wpabuf_clear_free(pubkey); 656 wpabuf_clear_free(privkey); 657 DH_free(dh); 658 return NULL; 659 #else 660 DH *dh; 661 struct wpabuf *pubkey = NULL, *privkey = NULL; 662 size_t publen, privlen; 663 BIGNUM *p = NULL, *g; 664 const BIGNUM *priv_key = NULL, *pub_key = NULL; 665 666 *priv = NULL; 667 wpabuf_free(*publ); 668 *publ = NULL; 669 670 dh = DH_new(); 671 if (dh == NULL) 672 return NULL; 673 674 g = BN_new(); 675 p = get_group5_prime(); 676 if (!g || BN_set_word(g, 2) != 1 || !p || 677 DH_set0_pqg(dh, p, NULL, g) != 1) 678 goto err; 679 p = NULL; 680 g = NULL; 681 682 if (DH_generate_key(dh) != 1) 683 goto err; 684 685 DH_get0_key(dh, &pub_key, &priv_key); 686 publen = BN_num_bytes(pub_key); 687 pubkey = wpabuf_alloc(publen); 688 if (!pubkey) 689 goto err; 690 privlen = BN_num_bytes(priv_key); 691 privkey = wpabuf_alloc(privlen); 692 if (!privkey) 693 goto err; 694 695 BN_bn2bin(pub_key, wpabuf_put(pubkey, publen)); 696 BN_bn2bin(priv_key, wpabuf_put(privkey, privlen)); 697 698 *priv = privkey; 699 *publ = pubkey; 700 return dh; 701 702 err: 703 BN_free(p); 704 BN_free(g); 705 wpabuf_clear_free(pubkey); 706 wpabuf_clear_free(privkey); 707 DH_free(dh); 708 return NULL; 709 #endif 710 } 711 712 713 void * dh5_init_fixed(const struct wpabuf *priv, const struct wpabuf *publ) 714 { 715 #if OPENSSL_VERSION_NUMBER < 0x10100000L 716 DH *dh; 717 718 dh = DH_new(); 719 if (dh == NULL) 720 return NULL; 721 722 dh->g = BN_new(); 723 if (dh->g == NULL || BN_set_word(dh->g, 2) != 1) 724 goto err; 725 726 dh->p = get_group5_prime(); 727 if (dh->p == NULL) 728 goto err; 729 730 dh->priv_key = BN_bin2bn(wpabuf_head(priv), wpabuf_len(priv), NULL); 731 if (dh->priv_key == NULL) 732 goto err; 733 734 dh->pub_key = BN_bin2bn(wpabuf_head(publ), wpabuf_len(publ), NULL); 735 if (dh->pub_key == NULL) 736 goto err; 737 738 if (DH_generate_key(dh) != 1) 739 goto err; 740 741 return dh; 742 743 err: 744 DH_free(dh); 745 return NULL; 746 #else 747 DH *dh; 748 BIGNUM *p = NULL, *g, *priv_key = NULL, *pub_key = NULL; 749 750 dh = DH_new(); 751 if (dh == NULL) 752 return NULL; 753 754 g = BN_new(); 755 p = get_group5_prime(); 756 if (!g || BN_set_word(g, 2) != 1 || !p || 757 DH_set0_pqg(dh, p, NULL, g) != 1) 758 goto err; 759 p = NULL; 760 g = NULL; 761 762 priv_key = BN_bin2bn(wpabuf_head(priv), wpabuf_len(priv), NULL); 763 pub_key = BN_bin2bn(wpabuf_head(publ), wpabuf_len(publ), NULL); 764 if (!priv_key || !pub_key || DH_set0_key(dh, pub_key, priv_key) != 1) 765 goto err; 766 pub_key = NULL; 767 priv_key = NULL; 768 769 if (DH_generate_key(dh) != 1) 770 goto err; 771 772 return dh; 773 774 err: 775 BN_free(p); 776 BN_free(g); 777 BN_free(pub_key); 778 BN_clear_free(priv_key); 779 DH_free(dh); 780 return NULL; 781 #endif 782 } 783 784 785 struct wpabuf * dh5_derive_shared(void *ctx, const struct wpabuf *peer_public, 786 const struct wpabuf *own_private) 787 { 788 BIGNUM *pub_key; 789 struct wpabuf *res = NULL; 790 size_t rlen; 791 DH *dh = ctx; 792 int keylen; 793 794 if (ctx == NULL) 795 return NULL; 796 797 pub_key = BN_bin2bn(wpabuf_head(peer_public), wpabuf_len(peer_public), 798 NULL); 799 if (pub_key == NULL) 800 return NULL; 801 802 rlen = DH_size(dh); 803 res = wpabuf_alloc(rlen); 804 if (res == NULL) 805 goto err; 806 807 keylen = DH_compute_key(wpabuf_mhead(res), pub_key, dh); 808 if (keylen < 0) 809 goto err; 810 wpabuf_put(res, keylen); 811 BN_clear_free(pub_key); 812 813 return res; 814 815 err: 816 BN_clear_free(pub_key); 817 wpabuf_clear_free(res); 818 return NULL; 819 } 820 821 822 void dh5_free(void *ctx) 823 { 824 DH *dh; 825 if (ctx == NULL) 826 return; 827 dh = ctx; 828 DH_free(dh); 829 } 830 831 832 struct crypto_hash { 833 HMAC_CTX *ctx; 834 }; 835 836 837 struct crypto_hash * crypto_hash_init(enum crypto_hash_alg alg, const u8 *key, 838 size_t key_len) 839 { 840 struct crypto_hash *ctx; 841 const EVP_MD *md; 842 843 switch (alg) { 844 #ifndef OPENSSL_NO_MD5 845 case CRYPTO_HASH_ALG_HMAC_MD5: 846 md = EVP_md5(); 847 break; 848 #endif /* OPENSSL_NO_MD5 */ 849 #ifndef OPENSSL_NO_SHA 850 case CRYPTO_HASH_ALG_HMAC_SHA1: 851 md = EVP_sha1(); 852 break; 853 #endif /* OPENSSL_NO_SHA */ 854 #ifndef OPENSSL_NO_SHA256 855 #ifdef CONFIG_SHA256 856 case CRYPTO_HASH_ALG_HMAC_SHA256: 857 md = EVP_sha256(); 858 break; 859 #endif /* CONFIG_SHA256 */ 860 #endif /* OPENSSL_NO_SHA256 */ 861 default: 862 return NULL; 863 } 864 865 ctx = os_zalloc(sizeof(*ctx)); 866 if (ctx == NULL) 867 return NULL; 868 ctx->ctx = HMAC_CTX_new(); 869 if (!ctx->ctx) { 870 os_free(ctx); 871 return NULL; 872 } 873 874 if (HMAC_Init_ex(ctx->ctx, key, key_len, md, NULL) != 1) { 875 HMAC_CTX_free(ctx->ctx); 876 bin_clear_free(ctx, sizeof(*ctx)); 877 return NULL; 878 } 879 880 return ctx; 881 } 882 883 884 void crypto_hash_update(struct crypto_hash *ctx, const u8 *data, size_t len) 885 { 886 if (ctx == NULL) 887 return; 888 HMAC_Update(ctx->ctx, data, len); 889 } 890 891 892 int crypto_hash_finish(struct crypto_hash *ctx, u8 *mac, size_t *len) 893 { 894 unsigned int mdlen; 895 int res; 896 897 if (ctx == NULL) 898 return -2; 899 900 if (mac == NULL || len == NULL) { 901 HMAC_CTX_free(ctx->ctx); 902 bin_clear_free(ctx, sizeof(*ctx)); 903 return 0; 904 } 905 906 mdlen = *len; 907 res = HMAC_Final(ctx->ctx, mac, &mdlen); 908 HMAC_CTX_free(ctx->ctx); 909 bin_clear_free(ctx, sizeof(*ctx)); 910 911 if (res == 1) { 912 *len = mdlen; 913 return 0; 914 } 915 916 return -1; 917 } 918 919 920 static int openssl_hmac_vector(const EVP_MD *type, const u8 *key, 921 size_t key_len, size_t num_elem, 922 const u8 *addr[], const size_t *len, u8 *mac, 923 unsigned int mdlen) 924 { 925 HMAC_CTX *ctx; 926 size_t i; 927 int res; 928 929 if (TEST_FAIL()) 930 return -1; 931 932 ctx = HMAC_CTX_new(); 933 if (!ctx) 934 return -1; 935 res = HMAC_Init_ex(ctx, key, key_len, type, NULL); 936 if (res != 1) 937 goto done; 938 939 for (i = 0; i < num_elem; i++) 940 HMAC_Update(ctx, addr[i], len[i]); 941 942 res = HMAC_Final(ctx, mac, &mdlen); 943 done: 944 HMAC_CTX_free(ctx); 945 946 return res == 1 ? 0 : -1; 947 } 948 949 950 #ifndef CONFIG_FIPS 951 952 int hmac_md5_vector(const u8 *key, size_t key_len, size_t num_elem, 953 const u8 *addr[], const size_t *len, u8 *mac) 954 { 955 return openssl_hmac_vector(EVP_md5(), key ,key_len, num_elem, addr, len, 956 mac, 16); 957 } 958 959 960 int hmac_md5(const u8 *key, size_t key_len, const u8 *data, size_t data_len, 961 u8 *mac) 962 { 963 return hmac_md5_vector(key, key_len, 1, &data, &data_len, mac); 964 } 965 966 #endif /* CONFIG_FIPS */ 967 968 969 int pbkdf2_sha1(const char *passphrase, const u8 *ssid, size_t ssid_len, 970 int iterations, u8 *buf, size_t buflen) 971 { 972 if (PKCS5_PBKDF2_HMAC_SHA1(passphrase, os_strlen(passphrase), ssid, 973 ssid_len, iterations, buflen, buf) != 1) 974 return -1; 975 return 0; 976 } 977 978 979 int hmac_sha1_vector(const u8 *key, size_t key_len, size_t num_elem, 980 const u8 *addr[], const size_t *len, u8 *mac) 981 { 982 return openssl_hmac_vector(EVP_sha1(), key, key_len, num_elem, addr, 983 len, mac, 20); 984 } 985 986 987 int hmac_sha1(const u8 *key, size_t key_len, const u8 *data, size_t data_len, 988 u8 *mac) 989 { 990 return hmac_sha1_vector(key, key_len, 1, &data, &data_len, mac); 991 } 992 993 994 #ifdef CONFIG_SHA256 995 996 int hmac_sha256_vector(const u8 *key, size_t key_len, size_t num_elem, 997 const u8 *addr[], const size_t *len, u8 *mac) 998 { 999 return openssl_hmac_vector(EVP_sha256(), key, key_len, num_elem, addr, 1000 len, mac, 32); 1001 } 1002 1003 1004 int hmac_sha256(const u8 *key, size_t key_len, const u8 *data, 1005 size_t data_len, u8 *mac) 1006 { 1007 return hmac_sha256_vector(key, key_len, 1, &data, &data_len, mac); 1008 } 1009 1010 #endif /* CONFIG_SHA256 */ 1011 1012 1013 #ifdef CONFIG_SHA384 1014 1015 int hmac_sha384_vector(const u8 *key, size_t key_len, size_t num_elem, 1016 const u8 *addr[], const size_t *len, u8 *mac) 1017 { 1018 return openssl_hmac_vector(EVP_sha384(), key, key_len, num_elem, addr, 1019 len, mac, 32); 1020 } 1021 1022 1023 int hmac_sha384(const u8 *key, size_t key_len, const u8 *data, 1024 size_t data_len, u8 *mac) 1025 { 1026 return hmac_sha384_vector(key, key_len, 1, &data, &data_len, mac); 1027 } 1028 1029 #endif /* CONFIG_SHA384 */ 1030 1031 1032 int crypto_get_random(void *buf, size_t len) 1033 { 1034 if (RAND_bytes(buf, len) != 1) 1035 return -1; 1036 return 0; 1037 } 1038 1039 1040 #ifdef CONFIG_OPENSSL_CMAC 1041 int omac1_aes_vector(const u8 *key, size_t key_len, size_t num_elem, 1042 const u8 *addr[], const size_t *len, u8 *mac) 1043 { 1044 CMAC_CTX *ctx; 1045 int ret = -1; 1046 size_t outlen, i; 1047 1048 if (TEST_FAIL()) 1049 return -1; 1050 1051 ctx = CMAC_CTX_new(); 1052 if (ctx == NULL) 1053 return -1; 1054 1055 if (key_len == 32) { 1056 if (!CMAC_Init(ctx, key, 32, EVP_aes_256_cbc(), NULL)) 1057 goto fail; 1058 } else if (key_len == 16) { 1059 if (!CMAC_Init(ctx, key, 16, EVP_aes_128_cbc(), NULL)) 1060 goto fail; 1061 } else { 1062 goto fail; 1063 } 1064 for (i = 0; i < num_elem; i++) { 1065 if (!CMAC_Update(ctx, addr[i], len[i])) 1066 goto fail; 1067 } 1068 if (!CMAC_Final(ctx, mac, &outlen) || outlen != 16) 1069 goto fail; 1070 1071 ret = 0; 1072 fail: 1073 CMAC_CTX_free(ctx); 1074 return ret; 1075 } 1076 1077 1078 int omac1_aes_128_vector(const u8 *key, size_t num_elem, 1079 const u8 *addr[], const size_t *len, u8 *mac) 1080 { 1081 return omac1_aes_vector(key, 16, num_elem, addr, len, mac); 1082 } 1083 1084 1085 int omac1_aes_128(const u8 *key, const u8 *data, size_t data_len, u8 *mac) 1086 { 1087 return omac1_aes_128_vector(key, 1, &data, &data_len, mac); 1088 } 1089 1090 1091 int omac1_aes_256(const u8 *key, const u8 *data, size_t data_len, u8 *mac) 1092 { 1093 return omac1_aes_vector(key, 32, 1, &data, &data_len, mac); 1094 } 1095 #endif /* CONFIG_OPENSSL_CMAC */ 1096 1097 1098 struct crypto_bignum * crypto_bignum_init(void) 1099 { 1100 if (TEST_FAIL()) 1101 return NULL; 1102 return (struct crypto_bignum *) BN_new(); 1103 } 1104 1105 1106 struct crypto_bignum * crypto_bignum_init_set(const u8 *buf, size_t len) 1107 { 1108 BIGNUM *bn; 1109 1110 if (TEST_FAIL()) 1111 return NULL; 1112 1113 bn = BN_bin2bn(buf, len, NULL); 1114 return (struct crypto_bignum *) bn; 1115 } 1116 1117 1118 void crypto_bignum_deinit(struct crypto_bignum *n, int clear) 1119 { 1120 if (clear) 1121 BN_clear_free((BIGNUM *) n); 1122 else 1123 BN_free((BIGNUM *) n); 1124 } 1125 1126 1127 int crypto_bignum_to_bin(const struct crypto_bignum *a, 1128 u8 *buf, size_t buflen, size_t padlen) 1129 { 1130 int num_bytes, offset; 1131 1132 if (TEST_FAIL()) 1133 return -1; 1134 1135 if (padlen > buflen) 1136 return -1; 1137 1138 num_bytes = BN_num_bytes((const BIGNUM *) a); 1139 if ((size_t) num_bytes > buflen) 1140 return -1; 1141 if (padlen > (size_t) num_bytes) 1142 offset = padlen - num_bytes; 1143 else 1144 offset = 0; 1145 1146 os_memset(buf, 0, offset); 1147 BN_bn2bin((const BIGNUM *) a, buf + offset); 1148 1149 return num_bytes + offset; 1150 } 1151 1152 1153 int crypto_bignum_add(const struct crypto_bignum *a, 1154 const struct crypto_bignum *b, 1155 struct crypto_bignum *c) 1156 { 1157 return BN_add((BIGNUM *) c, (const BIGNUM *) a, (const BIGNUM *) b) ? 1158 0 : -1; 1159 } 1160 1161 1162 int crypto_bignum_mod(const struct crypto_bignum *a, 1163 const struct crypto_bignum *b, 1164 struct crypto_bignum *c) 1165 { 1166 int res; 1167 BN_CTX *bnctx; 1168 1169 bnctx = BN_CTX_new(); 1170 if (bnctx == NULL) 1171 return -1; 1172 res = BN_mod((BIGNUM *) c, (const BIGNUM *) a, (const BIGNUM *) b, 1173 bnctx); 1174 BN_CTX_free(bnctx); 1175 1176 return res ? 0 : -1; 1177 } 1178 1179 1180 int crypto_bignum_exptmod(const struct crypto_bignum *a, 1181 const struct crypto_bignum *b, 1182 const struct crypto_bignum *c, 1183 struct crypto_bignum *d) 1184 { 1185 int res; 1186 BN_CTX *bnctx; 1187 1188 if (TEST_FAIL()) 1189 return -1; 1190 1191 bnctx = BN_CTX_new(); 1192 if (bnctx == NULL) 1193 return -1; 1194 res = BN_mod_exp((BIGNUM *) d, (const BIGNUM *) a, (const BIGNUM *) b, 1195 (const BIGNUM *) c, bnctx); 1196 BN_CTX_free(bnctx); 1197 1198 return res ? 0 : -1; 1199 } 1200 1201 1202 int crypto_bignum_inverse(const struct crypto_bignum *a, 1203 const struct crypto_bignum *b, 1204 struct crypto_bignum *c) 1205 { 1206 BIGNUM *res; 1207 BN_CTX *bnctx; 1208 1209 if (TEST_FAIL()) 1210 return -1; 1211 bnctx = BN_CTX_new(); 1212 if (bnctx == NULL) 1213 return -1; 1214 res = BN_mod_inverse((BIGNUM *) c, (const BIGNUM *) a, 1215 (const BIGNUM *) b, bnctx); 1216 BN_CTX_free(bnctx); 1217 1218 return res ? 0 : -1; 1219 } 1220 1221 1222 int crypto_bignum_sub(const struct crypto_bignum *a, 1223 const struct crypto_bignum *b, 1224 struct crypto_bignum *c) 1225 { 1226 if (TEST_FAIL()) 1227 return -1; 1228 return BN_sub((BIGNUM *) c, (const BIGNUM *) a, (const BIGNUM *) b) ? 1229 0 : -1; 1230 } 1231 1232 1233 int crypto_bignum_div(const struct crypto_bignum *a, 1234 const struct crypto_bignum *b, 1235 struct crypto_bignum *c) 1236 { 1237 int res; 1238 1239 BN_CTX *bnctx; 1240 1241 if (TEST_FAIL()) 1242 return -1; 1243 1244 bnctx = BN_CTX_new(); 1245 if (bnctx == NULL) 1246 return -1; 1247 res = BN_div((BIGNUM *) c, NULL, (const BIGNUM *) a, 1248 (const BIGNUM *) b, bnctx); 1249 BN_CTX_free(bnctx); 1250 1251 return res ? 0 : -1; 1252 } 1253 1254 1255 int crypto_bignum_mulmod(const struct crypto_bignum *a, 1256 const struct crypto_bignum *b, 1257 const struct crypto_bignum *c, 1258 struct crypto_bignum *d) 1259 { 1260 int res; 1261 1262 BN_CTX *bnctx; 1263 1264 if (TEST_FAIL()) 1265 return -1; 1266 1267 bnctx = BN_CTX_new(); 1268 if (bnctx == NULL) 1269 return -1; 1270 res = BN_mod_mul((BIGNUM *) d, (const BIGNUM *) a, (const BIGNUM *) b, 1271 (const BIGNUM *) c, bnctx); 1272 BN_CTX_free(bnctx); 1273 1274 return res ? 0 : -1; 1275 } 1276 1277 1278 int crypto_bignum_cmp(const struct crypto_bignum *a, 1279 const struct crypto_bignum *b) 1280 { 1281 return BN_cmp((const BIGNUM *) a, (const BIGNUM *) b); 1282 } 1283 1284 1285 int crypto_bignum_bits(const struct crypto_bignum *a) 1286 { 1287 return BN_num_bits((const BIGNUM *) a); 1288 } 1289 1290 1291 int crypto_bignum_is_zero(const struct crypto_bignum *a) 1292 { 1293 return BN_is_zero((const BIGNUM *) a); 1294 } 1295 1296 1297 int crypto_bignum_is_one(const struct crypto_bignum *a) 1298 { 1299 return BN_is_one((const BIGNUM *) a); 1300 } 1301 1302 1303 int crypto_bignum_legendre(const struct crypto_bignum *a, 1304 const struct crypto_bignum *p) 1305 { 1306 BN_CTX *bnctx; 1307 BIGNUM *exp = NULL, *tmp = NULL; 1308 int res = -2; 1309 1310 if (TEST_FAIL()) 1311 return -2; 1312 1313 bnctx = BN_CTX_new(); 1314 if (bnctx == NULL) 1315 return -2; 1316 1317 exp = BN_new(); 1318 tmp = BN_new(); 1319 if (!exp || !tmp || 1320 /* exp = (p-1) / 2 */ 1321 !BN_sub(exp, (const BIGNUM *) p, BN_value_one()) || 1322 !BN_rshift1(exp, exp) || 1323 !BN_mod_exp(tmp, (const BIGNUM *) a, exp, (const BIGNUM *) p, 1324 bnctx)) 1325 goto fail; 1326 1327 if (BN_is_word(tmp, 1)) 1328 res = 1; 1329 else if (BN_is_zero(tmp)) 1330 res = 0; 1331 else 1332 res = -1; 1333 1334 fail: 1335 BN_clear_free(tmp); 1336 BN_clear_free(exp); 1337 BN_CTX_free(bnctx); 1338 return res; 1339 } 1340 1341 1342 #ifdef CONFIG_ECC 1343 1344 struct crypto_ec { 1345 EC_GROUP *group; 1346 BN_CTX *bnctx; 1347 BIGNUM *prime; 1348 BIGNUM *order; 1349 BIGNUM *a; 1350 BIGNUM *b; 1351 }; 1352 1353 struct crypto_ec * crypto_ec_init(int group) 1354 { 1355 struct crypto_ec *e; 1356 int nid; 1357 1358 /* Map from IANA registry for IKE D-H groups to OpenSSL NID */ 1359 switch (group) { 1360 case 19: 1361 nid = NID_X9_62_prime256v1; 1362 break; 1363 case 20: 1364 nid = NID_secp384r1; 1365 break; 1366 case 21: 1367 nid = NID_secp521r1; 1368 break; 1369 case 25: 1370 nid = NID_X9_62_prime192v1; 1371 break; 1372 case 26: 1373 nid = NID_secp224r1; 1374 break; 1375 #ifdef NID_brainpoolP224r1 1376 case 27: 1377 nid = NID_brainpoolP224r1; 1378 break; 1379 #endif /* NID_brainpoolP224r1 */ 1380 #ifdef NID_brainpoolP256r1 1381 case 28: 1382 nid = NID_brainpoolP256r1; 1383 break; 1384 #endif /* NID_brainpoolP256r1 */ 1385 #ifdef NID_brainpoolP384r1 1386 case 29: 1387 nid = NID_brainpoolP384r1; 1388 break; 1389 #endif /* NID_brainpoolP384r1 */ 1390 #ifdef NID_brainpoolP512r1 1391 case 30: 1392 nid = NID_brainpoolP512r1; 1393 break; 1394 #endif /* NID_brainpoolP512r1 */ 1395 default: 1396 return NULL; 1397 } 1398 1399 e = os_zalloc(sizeof(*e)); 1400 if (e == NULL) 1401 return NULL; 1402 1403 e->bnctx = BN_CTX_new(); 1404 e->group = EC_GROUP_new_by_curve_name(nid); 1405 e->prime = BN_new(); 1406 e->order = BN_new(); 1407 e->a = BN_new(); 1408 e->b = BN_new(); 1409 if (e->group == NULL || e->bnctx == NULL || e->prime == NULL || 1410 e->order == NULL || e->a == NULL || e->b == NULL || 1411 !EC_GROUP_get_curve_GFp(e->group, e->prime, e->a, e->b, e->bnctx) || 1412 !EC_GROUP_get_order(e->group, e->order, e->bnctx)) { 1413 crypto_ec_deinit(e); 1414 e = NULL; 1415 } 1416 1417 return e; 1418 } 1419 1420 1421 void crypto_ec_deinit(struct crypto_ec *e) 1422 { 1423 if (e == NULL) 1424 return; 1425 BN_clear_free(e->b); 1426 BN_clear_free(e->a); 1427 BN_clear_free(e->order); 1428 BN_clear_free(e->prime); 1429 EC_GROUP_free(e->group); 1430 BN_CTX_free(e->bnctx); 1431 os_free(e); 1432 } 1433 1434 1435 struct crypto_ec_point * crypto_ec_point_init(struct crypto_ec *e) 1436 { 1437 if (TEST_FAIL()) 1438 return NULL; 1439 if (e == NULL) 1440 return NULL; 1441 return (struct crypto_ec_point *) EC_POINT_new(e->group); 1442 } 1443 1444 1445 size_t crypto_ec_prime_len(struct crypto_ec *e) 1446 { 1447 return BN_num_bytes(e->prime); 1448 } 1449 1450 1451 size_t crypto_ec_prime_len_bits(struct crypto_ec *e) 1452 { 1453 return BN_num_bits(e->prime); 1454 } 1455 1456 1457 const struct crypto_bignum * crypto_ec_get_prime(struct crypto_ec *e) 1458 { 1459 return (const struct crypto_bignum *) e->prime; 1460 } 1461 1462 1463 const struct crypto_bignum * crypto_ec_get_order(struct crypto_ec *e) 1464 { 1465 return (const struct crypto_bignum *) e->order; 1466 } 1467 1468 1469 void crypto_ec_point_deinit(struct crypto_ec_point *p, int clear) 1470 { 1471 if (clear) 1472 EC_POINT_clear_free((EC_POINT *) p); 1473 else 1474 EC_POINT_free((EC_POINT *) p); 1475 } 1476 1477 1478 int crypto_ec_point_to_bin(struct crypto_ec *e, 1479 const struct crypto_ec_point *point, u8 *x, u8 *y) 1480 { 1481 BIGNUM *x_bn, *y_bn; 1482 int ret = -1; 1483 int len = BN_num_bytes(e->prime); 1484 1485 if (TEST_FAIL()) 1486 return -1; 1487 1488 x_bn = BN_new(); 1489 y_bn = BN_new(); 1490 1491 if (x_bn && y_bn && 1492 EC_POINT_get_affine_coordinates_GFp(e->group, (EC_POINT *) point, 1493 x_bn, y_bn, e->bnctx)) { 1494 if (x) { 1495 crypto_bignum_to_bin((struct crypto_bignum *) x_bn, 1496 x, len, len); 1497 } 1498 if (y) { 1499 crypto_bignum_to_bin((struct crypto_bignum *) y_bn, 1500 y, len, len); 1501 } 1502 ret = 0; 1503 } 1504 1505 BN_clear_free(x_bn); 1506 BN_clear_free(y_bn); 1507 return ret; 1508 } 1509 1510 1511 struct crypto_ec_point * crypto_ec_point_from_bin(struct crypto_ec *e, 1512 const u8 *val) 1513 { 1514 BIGNUM *x, *y; 1515 EC_POINT *elem; 1516 int len = BN_num_bytes(e->prime); 1517 1518 if (TEST_FAIL()) 1519 return NULL; 1520 1521 x = BN_bin2bn(val, len, NULL); 1522 y = BN_bin2bn(val + len, len, NULL); 1523 elem = EC_POINT_new(e->group); 1524 if (x == NULL || y == NULL || elem == NULL) { 1525 BN_clear_free(x); 1526 BN_clear_free(y); 1527 EC_POINT_clear_free(elem); 1528 return NULL; 1529 } 1530 1531 if (!EC_POINT_set_affine_coordinates_GFp(e->group, elem, x, y, 1532 e->bnctx)) { 1533 EC_POINT_clear_free(elem); 1534 elem = NULL; 1535 } 1536 1537 BN_clear_free(x); 1538 BN_clear_free(y); 1539 1540 return (struct crypto_ec_point *) elem; 1541 } 1542 1543 1544 int crypto_ec_point_add(struct crypto_ec *e, const struct crypto_ec_point *a, 1545 const struct crypto_ec_point *b, 1546 struct crypto_ec_point *c) 1547 { 1548 if (TEST_FAIL()) 1549 return -1; 1550 return EC_POINT_add(e->group, (EC_POINT *) c, (const EC_POINT *) a, 1551 (const EC_POINT *) b, e->bnctx) ? 0 : -1; 1552 } 1553 1554 1555 int crypto_ec_point_mul(struct crypto_ec *e, const struct crypto_ec_point *p, 1556 const struct crypto_bignum *b, 1557 struct crypto_ec_point *res) 1558 { 1559 if (TEST_FAIL()) 1560 return -1; 1561 return EC_POINT_mul(e->group, (EC_POINT *) res, NULL, 1562 (const EC_POINT *) p, (const BIGNUM *) b, e->bnctx) 1563 ? 0 : -1; 1564 } 1565 1566 1567 int crypto_ec_point_invert(struct crypto_ec *e, struct crypto_ec_point *p) 1568 { 1569 if (TEST_FAIL()) 1570 return -1; 1571 return EC_POINT_invert(e->group, (EC_POINT *) p, e->bnctx) ? 0 : -1; 1572 } 1573 1574 1575 int crypto_ec_point_solve_y_coord(struct crypto_ec *e, 1576 struct crypto_ec_point *p, 1577 const struct crypto_bignum *x, int y_bit) 1578 { 1579 if (TEST_FAIL()) 1580 return -1; 1581 if (!EC_POINT_set_compressed_coordinates_GFp(e->group, (EC_POINT *) p, 1582 (const BIGNUM *) x, y_bit, 1583 e->bnctx) || 1584 !EC_POINT_is_on_curve(e->group, (EC_POINT *) p, e->bnctx)) 1585 return -1; 1586 return 0; 1587 } 1588 1589 1590 struct crypto_bignum * 1591 crypto_ec_point_compute_y_sqr(struct crypto_ec *e, 1592 const struct crypto_bignum *x) 1593 { 1594 BIGNUM *tmp, *tmp2, *y_sqr = NULL; 1595 1596 if (TEST_FAIL()) 1597 return NULL; 1598 1599 tmp = BN_new(); 1600 tmp2 = BN_new(); 1601 1602 /* y^2 = x^3 + ax + b */ 1603 if (tmp && tmp2 && 1604 BN_mod_sqr(tmp, (const BIGNUM *) x, e->prime, e->bnctx) && 1605 BN_mod_mul(tmp, tmp, (const BIGNUM *) x, e->prime, e->bnctx) && 1606 BN_mod_mul(tmp2, e->a, (const BIGNUM *) x, e->prime, e->bnctx) && 1607 BN_mod_add_quick(tmp2, tmp2, tmp, e->prime) && 1608 BN_mod_add_quick(tmp2, tmp2, e->b, e->prime)) { 1609 y_sqr = tmp2; 1610 tmp2 = NULL; 1611 } 1612 1613 BN_clear_free(tmp); 1614 BN_clear_free(tmp2); 1615 1616 return (struct crypto_bignum *) y_sqr; 1617 } 1618 1619 1620 int crypto_ec_point_is_at_infinity(struct crypto_ec *e, 1621 const struct crypto_ec_point *p) 1622 { 1623 return EC_POINT_is_at_infinity(e->group, (const EC_POINT *) p); 1624 } 1625 1626 1627 int crypto_ec_point_is_on_curve(struct crypto_ec *e, 1628 const struct crypto_ec_point *p) 1629 { 1630 return EC_POINT_is_on_curve(e->group, (const EC_POINT *) p, 1631 e->bnctx) == 1; 1632 } 1633 1634 1635 int crypto_ec_point_cmp(const struct crypto_ec *e, 1636 const struct crypto_ec_point *a, 1637 const struct crypto_ec_point *b) 1638 { 1639 return EC_POINT_cmp(e->group, (const EC_POINT *) a, 1640 (const EC_POINT *) b, e->bnctx); 1641 } 1642 1643 #endif /* CONFIG_ECC */ 1644