1 /* 2 * Wrapper functions for OpenSSL libcrypto 3 * Copyright (c) 2004-2015, Jouni Malinen <j@w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #include "includes.h" 10 #include <openssl/opensslv.h> 11 #include <openssl/err.h> 12 #include <openssl/des.h> 13 #include <openssl/aes.h> 14 #include <openssl/bn.h> 15 #include <openssl/evp.h> 16 #include <openssl/dh.h> 17 #include <openssl/hmac.h> 18 #include <openssl/rand.h> 19 #ifdef CONFIG_OPENSSL_CMAC 20 #include <openssl/cmac.h> 21 #endif /* CONFIG_OPENSSL_CMAC */ 22 #ifdef CONFIG_ECC 23 #include <openssl/ec.h> 24 #endif /* CONFIG_ECC */ 25 26 #include "common.h" 27 #include "wpabuf.h" 28 #include "dh_group5.h" 29 #include "sha1.h" 30 #include "sha256.h" 31 #include "sha384.h" 32 #include "crypto.h" 33 34 static BIGNUM * get_group5_prime(void) 35 { 36 #ifdef OPENSSL_IS_BORINGSSL 37 static const unsigned char RFC3526_PRIME_1536[] = { 38 0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xC9,0x0F,0xDA,0xA2, 39 0x21,0x68,0xC2,0x34,0xC4,0xC6,0x62,0x8B,0x80,0xDC,0x1C,0xD1, 40 0x29,0x02,0x4E,0x08,0x8A,0x67,0xCC,0x74,0x02,0x0B,0xBE,0xA6, 41 0x3B,0x13,0x9B,0x22,0x51,0x4A,0x08,0x79,0x8E,0x34,0x04,0xDD, 42 0xEF,0x95,0x19,0xB3,0xCD,0x3A,0x43,0x1B,0x30,0x2B,0x0A,0x6D, 43 0xF2,0x5F,0x14,0x37,0x4F,0xE1,0x35,0x6D,0x6D,0x51,0xC2,0x45, 44 0xE4,0x85,0xB5,0x76,0x62,0x5E,0x7E,0xC6,0xF4,0x4C,0x42,0xE9, 45 0xA6,0x37,0xED,0x6B,0x0B,0xFF,0x5C,0xB6,0xF4,0x06,0xB7,0xED, 46 0xEE,0x38,0x6B,0xFB,0x5A,0x89,0x9F,0xA5,0xAE,0x9F,0x24,0x11, 47 0x7C,0x4B,0x1F,0xE6,0x49,0x28,0x66,0x51,0xEC,0xE4,0x5B,0x3D, 48 0xC2,0x00,0x7C,0xB8,0xA1,0x63,0xBF,0x05,0x98,0xDA,0x48,0x36, 49 0x1C,0x55,0xD3,0x9A,0x69,0x16,0x3F,0xA8,0xFD,0x24,0xCF,0x5F, 50 0x83,0x65,0x5D,0x23,0xDC,0xA3,0xAD,0x96,0x1C,0x62,0xF3,0x56, 51 0x20,0x85,0x52,0xBB,0x9E,0xD5,0x29,0x07,0x70,0x96,0x96,0x6D, 52 0x67,0x0C,0x35,0x4E,0x4A,0xBC,0x98,0x04,0xF1,0x74,0x6C,0x08, 53 0xCA,0x23,0x73,0x27,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF, 54 }; 55 return BN_bin2bn(RFC3526_PRIME_1536, sizeof(RFC3526_PRIME_1536), NULL); 56 #else /* OPENSSL_IS_BORINGSSL */ 57 return get_rfc3526_prime_1536(NULL); 58 #endif /* OPENSSL_IS_BORINGSSL */ 59 } 60 61 #ifdef OPENSSL_NO_SHA256 62 #define NO_SHA256_WRAPPER 63 #endif 64 65 static int openssl_digest_vector(const EVP_MD *type, size_t num_elem, 66 const u8 *addr[], const size_t *len, u8 *mac) 67 { 68 EVP_MD_CTX ctx; 69 size_t i; 70 unsigned int mac_len; 71 72 EVP_MD_CTX_init(&ctx); 73 if (!EVP_DigestInit_ex(&ctx, type, NULL)) { 74 wpa_printf(MSG_ERROR, "OpenSSL: EVP_DigestInit_ex failed: %s", 75 ERR_error_string(ERR_get_error(), NULL)); 76 return -1; 77 } 78 for (i = 0; i < num_elem; i++) { 79 if (!EVP_DigestUpdate(&ctx, addr[i], len[i])) { 80 wpa_printf(MSG_ERROR, "OpenSSL: EVP_DigestUpdate " 81 "failed: %s", 82 ERR_error_string(ERR_get_error(), NULL)); 83 return -1; 84 } 85 } 86 if (!EVP_DigestFinal(&ctx, mac, &mac_len)) { 87 wpa_printf(MSG_ERROR, "OpenSSL: EVP_DigestFinal failed: %s", 88 ERR_error_string(ERR_get_error(), NULL)); 89 return -1; 90 } 91 92 return 0; 93 } 94 95 96 int md4_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac) 97 { 98 return openssl_digest_vector(EVP_md4(), num_elem, addr, len, mac); 99 } 100 101 102 void des_encrypt(const u8 *clear, const u8 *key, u8 *cypher) 103 { 104 u8 pkey[8], next, tmp; 105 int i; 106 DES_key_schedule ks; 107 108 /* Add parity bits to the key */ 109 next = 0; 110 for (i = 0; i < 7; i++) { 111 tmp = key[i]; 112 pkey[i] = (tmp >> i) | next | 1; 113 next = tmp << (7 - i); 114 } 115 pkey[i] = next | 1; 116 117 DES_set_key((DES_cblock *) &pkey, &ks); 118 DES_ecb_encrypt((DES_cblock *) clear, (DES_cblock *) cypher, &ks, 119 DES_ENCRYPT); 120 } 121 122 123 int rc4_skip(const u8 *key, size_t keylen, size_t skip, 124 u8 *data, size_t data_len) 125 { 126 #ifdef OPENSSL_NO_RC4 127 return -1; 128 #else /* OPENSSL_NO_RC4 */ 129 EVP_CIPHER_CTX ctx; 130 int outl; 131 int res = -1; 132 unsigned char skip_buf[16]; 133 134 EVP_CIPHER_CTX_init(&ctx); 135 if (!EVP_CIPHER_CTX_set_padding(&ctx, 0) || 136 !EVP_CipherInit_ex(&ctx, EVP_rc4(), NULL, NULL, NULL, 1) || 137 !EVP_CIPHER_CTX_set_key_length(&ctx, keylen) || 138 !EVP_CipherInit_ex(&ctx, NULL, NULL, key, NULL, 1)) 139 goto out; 140 141 while (skip >= sizeof(skip_buf)) { 142 size_t len = skip; 143 if (len > sizeof(skip_buf)) 144 len = sizeof(skip_buf); 145 if (!EVP_CipherUpdate(&ctx, skip_buf, &outl, skip_buf, len)) 146 goto out; 147 skip -= len; 148 } 149 150 if (EVP_CipherUpdate(&ctx, data, &outl, data, data_len)) 151 res = 0; 152 153 out: 154 EVP_CIPHER_CTX_cleanup(&ctx); 155 return res; 156 #endif /* OPENSSL_NO_RC4 */ 157 } 158 159 160 int md5_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac) 161 { 162 return openssl_digest_vector(EVP_md5(), num_elem, addr, len, mac); 163 } 164 165 166 int sha1_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac) 167 { 168 return openssl_digest_vector(EVP_sha1(), num_elem, addr, len, mac); 169 } 170 171 172 #ifndef NO_SHA256_WRAPPER 173 int sha256_vector(size_t num_elem, const u8 *addr[], const size_t *len, 174 u8 *mac) 175 { 176 return openssl_digest_vector(EVP_sha256(), num_elem, addr, len, mac); 177 } 178 #endif /* NO_SHA256_WRAPPER */ 179 180 181 static const EVP_CIPHER * aes_get_evp_cipher(size_t keylen) 182 { 183 switch (keylen) { 184 case 16: 185 return EVP_aes_128_ecb(); 186 #ifndef OPENSSL_IS_BORINGSSL 187 case 24: 188 return EVP_aes_192_ecb(); 189 #endif /* OPENSSL_IS_BORINGSSL */ 190 case 32: 191 return EVP_aes_256_ecb(); 192 } 193 194 return NULL; 195 } 196 197 198 void * aes_encrypt_init(const u8 *key, size_t len) 199 { 200 EVP_CIPHER_CTX *ctx; 201 const EVP_CIPHER *type; 202 203 type = aes_get_evp_cipher(len); 204 if (type == NULL) 205 return NULL; 206 207 ctx = os_malloc(sizeof(*ctx)); 208 if (ctx == NULL) 209 return NULL; 210 EVP_CIPHER_CTX_init(ctx); 211 if (EVP_EncryptInit_ex(ctx, type, NULL, key, NULL) != 1) { 212 os_free(ctx); 213 return NULL; 214 } 215 EVP_CIPHER_CTX_set_padding(ctx, 0); 216 return ctx; 217 } 218 219 220 void aes_encrypt(void *ctx, const u8 *plain, u8 *crypt) 221 { 222 EVP_CIPHER_CTX *c = ctx; 223 int clen = 16; 224 if (EVP_EncryptUpdate(c, crypt, &clen, plain, 16) != 1) { 225 wpa_printf(MSG_ERROR, "OpenSSL: EVP_EncryptUpdate failed: %s", 226 ERR_error_string(ERR_get_error(), NULL)); 227 } 228 } 229 230 231 void aes_encrypt_deinit(void *ctx) 232 { 233 EVP_CIPHER_CTX *c = ctx; 234 u8 buf[16]; 235 int len = sizeof(buf); 236 if (EVP_EncryptFinal_ex(c, buf, &len) != 1) { 237 wpa_printf(MSG_ERROR, "OpenSSL: EVP_EncryptFinal_ex failed: " 238 "%s", ERR_error_string(ERR_get_error(), NULL)); 239 } 240 if (len != 0) { 241 wpa_printf(MSG_ERROR, "OpenSSL: Unexpected padding length %d " 242 "in AES encrypt", len); 243 } 244 EVP_CIPHER_CTX_cleanup(c); 245 bin_clear_free(c, sizeof(*c)); 246 } 247 248 249 void * aes_decrypt_init(const u8 *key, size_t len) 250 { 251 EVP_CIPHER_CTX *ctx; 252 const EVP_CIPHER *type; 253 254 type = aes_get_evp_cipher(len); 255 if (type == NULL) 256 return NULL; 257 258 ctx = os_malloc(sizeof(*ctx)); 259 if (ctx == NULL) 260 return NULL; 261 EVP_CIPHER_CTX_init(ctx); 262 if (EVP_DecryptInit_ex(ctx, type, NULL, key, NULL) != 1) { 263 os_free(ctx); 264 return NULL; 265 } 266 EVP_CIPHER_CTX_set_padding(ctx, 0); 267 return ctx; 268 } 269 270 271 void aes_decrypt(void *ctx, const u8 *crypt, u8 *plain) 272 { 273 EVP_CIPHER_CTX *c = ctx; 274 int plen = 16; 275 if (EVP_DecryptUpdate(c, plain, &plen, crypt, 16) != 1) { 276 wpa_printf(MSG_ERROR, "OpenSSL: EVP_DecryptUpdate failed: %s", 277 ERR_error_string(ERR_get_error(), NULL)); 278 } 279 } 280 281 282 void aes_decrypt_deinit(void *ctx) 283 { 284 EVP_CIPHER_CTX *c = ctx; 285 u8 buf[16]; 286 int len = sizeof(buf); 287 if (EVP_DecryptFinal_ex(c, buf, &len) != 1) { 288 wpa_printf(MSG_ERROR, "OpenSSL: EVP_DecryptFinal_ex failed: " 289 "%s", ERR_error_string(ERR_get_error(), NULL)); 290 } 291 if (len != 0) { 292 wpa_printf(MSG_ERROR, "OpenSSL: Unexpected padding length %d " 293 "in AES decrypt", len); 294 } 295 EVP_CIPHER_CTX_cleanup(c); 296 bin_clear_free(c, sizeof(*c)); 297 } 298 299 300 int aes_wrap(const u8 *kek, size_t kek_len, int n, const u8 *plain, u8 *cipher) 301 { 302 AES_KEY actx; 303 int res; 304 305 if (AES_set_encrypt_key(kek, kek_len << 3, &actx)) 306 return -1; 307 res = AES_wrap_key(&actx, NULL, cipher, plain, n * 8); 308 OPENSSL_cleanse(&actx, sizeof(actx)); 309 return res <= 0 ? -1 : 0; 310 } 311 312 313 int aes_unwrap(const u8 *kek, size_t kek_len, int n, const u8 *cipher, 314 u8 *plain) 315 { 316 AES_KEY actx; 317 int res; 318 319 if (AES_set_decrypt_key(kek, kek_len << 3, &actx)) 320 return -1; 321 res = AES_unwrap_key(&actx, NULL, plain, cipher, (n + 1) * 8); 322 OPENSSL_cleanse(&actx, sizeof(actx)); 323 return res <= 0 ? -1 : 0; 324 } 325 326 327 int crypto_mod_exp(const u8 *base, size_t base_len, 328 const u8 *power, size_t power_len, 329 const u8 *modulus, size_t modulus_len, 330 u8 *result, size_t *result_len) 331 { 332 BIGNUM *bn_base, *bn_exp, *bn_modulus, *bn_result; 333 int ret = -1; 334 BN_CTX *ctx; 335 336 ctx = BN_CTX_new(); 337 if (ctx == NULL) 338 return -1; 339 340 bn_base = BN_bin2bn(base, base_len, NULL); 341 bn_exp = BN_bin2bn(power, power_len, NULL); 342 bn_modulus = BN_bin2bn(modulus, modulus_len, NULL); 343 bn_result = BN_new(); 344 345 if (bn_base == NULL || bn_exp == NULL || bn_modulus == NULL || 346 bn_result == NULL) 347 goto error; 348 349 if (BN_mod_exp(bn_result, bn_base, bn_exp, bn_modulus, ctx) != 1) 350 goto error; 351 352 *result_len = BN_bn2bin(bn_result, result); 353 ret = 0; 354 355 error: 356 BN_clear_free(bn_base); 357 BN_clear_free(bn_exp); 358 BN_clear_free(bn_modulus); 359 BN_clear_free(bn_result); 360 BN_CTX_free(ctx); 361 return ret; 362 } 363 364 365 struct crypto_cipher { 366 EVP_CIPHER_CTX enc; 367 EVP_CIPHER_CTX dec; 368 }; 369 370 371 struct crypto_cipher * crypto_cipher_init(enum crypto_cipher_alg alg, 372 const u8 *iv, const u8 *key, 373 size_t key_len) 374 { 375 struct crypto_cipher *ctx; 376 const EVP_CIPHER *cipher; 377 378 ctx = os_zalloc(sizeof(*ctx)); 379 if (ctx == NULL) 380 return NULL; 381 382 switch (alg) { 383 #ifndef OPENSSL_NO_RC4 384 case CRYPTO_CIPHER_ALG_RC4: 385 cipher = EVP_rc4(); 386 break; 387 #endif /* OPENSSL_NO_RC4 */ 388 #ifndef OPENSSL_NO_AES 389 case CRYPTO_CIPHER_ALG_AES: 390 switch (key_len) { 391 case 16: 392 cipher = EVP_aes_128_cbc(); 393 break; 394 #ifndef OPENSSL_IS_BORINGSSL 395 case 24: 396 cipher = EVP_aes_192_cbc(); 397 break; 398 #endif /* OPENSSL_IS_BORINGSSL */ 399 case 32: 400 cipher = EVP_aes_256_cbc(); 401 break; 402 default: 403 os_free(ctx); 404 return NULL; 405 } 406 break; 407 #endif /* OPENSSL_NO_AES */ 408 #ifndef OPENSSL_NO_DES 409 case CRYPTO_CIPHER_ALG_3DES: 410 cipher = EVP_des_ede3_cbc(); 411 break; 412 case CRYPTO_CIPHER_ALG_DES: 413 cipher = EVP_des_cbc(); 414 break; 415 #endif /* OPENSSL_NO_DES */ 416 #ifndef OPENSSL_NO_RC2 417 case CRYPTO_CIPHER_ALG_RC2: 418 cipher = EVP_rc2_ecb(); 419 break; 420 #endif /* OPENSSL_NO_RC2 */ 421 default: 422 os_free(ctx); 423 return NULL; 424 } 425 426 EVP_CIPHER_CTX_init(&ctx->enc); 427 EVP_CIPHER_CTX_set_padding(&ctx->enc, 0); 428 if (!EVP_EncryptInit_ex(&ctx->enc, cipher, NULL, NULL, NULL) || 429 !EVP_CIPHER_CTX_set_key_length(&ctx->enc, key_len) || 430 !EVP_EncryptInit_ex(&ctx->enc, NULL, NULL, key, iv)) { 431 EVP_CIPHER_CTX_cleanup(&ctx->enc); 432 os_free(ctx); 433 return NULL; 434 } 435 436 EVP_CIPHER_CTX_init(&ctx->dec); 437 EVP_CIPHER_CTX_set_padding(&ctx->dec, 0); 438 if (!EVP_DecryptInit_ex(&ctx->dec, cipher, NULL, NULL, NULL) || 439 !EVP_CIPHER_CTX_set_key_length(&ctx->dec, key_len) || 440 !EVP_DecryptInit_ex(&ctx->dec, NULL, NULL, key, iv)) { 441 EVP_CIPHER_CTX_cleanup(&ctx->enc); 442 EVP_CIPHER_CTX_cleanup(&ctx->dec); 443 os_free(ctx); 444 return NULL; 445 } 446 447 return ctx; 448 } 449 450 451 int crypto_cipher_encrypt(struct crypto_cipher *ctx, const u8 *plain, 452 u8 *crypt, size_t len) 453 { 454 int outl; 455 if (!EVP_EncryptUpdate(&ctx->enc, crypt, &outl, plain, len)) 456 return -1; 457 return 0; 458 } 459 460 461 int crypto_cipher_decrypt(struct crypto_cipher *ctx, const u8 *crypt, 462 u8 *plain, size_t len) 463 { 464 int outl; 465 outl = len; 466 if (!EVP_DecryptUpdate(&ctx->dec, plain, &outl, crypt, len)) 467 return -1; 468 return 0; 469 } 470 471 472 void crypto_cipher_deinit(struct crypto_cipher *ctx) 473 { 474 EVP_CIPHER_CTX_cleanup(&ctx->enc); 475 EVP_CIPHER_CTX_cleanup(&ctx->dec); 476 os_free(ctx); 477 } 478 479 480 void * dh5_init(struct wpabuf **priv, struct wpabuf **publ) 481 { 482 DH *dh; 483 struct wpabuf *pubkey = NULL, *privkey = NULL; 484 size_t publen, privlen; 485 486 *priv = NULL; 487 *publ = NULL; 488 489 dh = DH_new(); 490 if (dh == NULL) 491 return NULL; 492 493 dh->g = BN_new(); 494 if (dh->g == NULL || BN_set_word(dh->g, 2) != 1) 495 goto err; 496 497 dh->p = get_group5_prime(); 498 if (dh->p == NULL) 499 goto err; 500 501 if (DH_generate_key(dh) != 1) 502 goto err; 503 504 publen = BN_num_bytes(dh->pub_key); 505 pubkey = wpabuf_alloc(publen); 506 if (pubkey == NULL) 507 goto err; 508 privlen = BN_num_bytes(dh->priv_key); 509 privkey = wpabuf_alloc(privlen); 510 if (privkey == NULL) 511 goto err; 512 513 BN_bn2bin(dh->pub_key, wpabuf_put(pubkey, publen)); 514 BN_bn2bin(dh->priv_key, wpabuf_put(privkey, privlen)); 515 516 *priv = privkey; 517 *publ = pubkey; 518 return dh; 519 520 err: 521 wpabuf_clear_free(pubkey); 522 wpabuf_clear_free(privkey); 523 DH_free(dh); 524 return NULL; 525 } 526 527 528 void * dh5_init_fixed(const struct wpabuf *priv, const struct wpabuf *publ) 529 { 530 DH *dh; 531 532 dh = DH_new(); 533 if (dh == NULL) 534 return NULL; 535 536 dh->g = BN_new(); 537 if (dh->g == NULL || BN_set_word(dh->g, 2) != 1) 538 goto err; 539 540 dh->p = get_group5_prime(); 541 if (dh->p == NULL) 542 goto err; 543 544 dh->priv_key = BN_bin2bn(wpabuf_head(priv), wpabuf_len(priv), NULL); 545 if (dh->priv_key == NULL) 546 goto err; 547 548 dh->pub_key = BN_bin2bn(wpabuf_head(publ), wpabuf_len(publ), NULL); 549 if (dh->pub_key == NULL) 550 goto err; 551 552 if (DH_generate_key(dh) != 1) 553 goto err; 554 555 return dh; 556 557 err: 558 DH_free(dh); 559 return NULL; 560 } 561 562 563 struct wpabuf * dh5_derive_shared(void *ctx, const struct wpabuf *peer_public, 564 const struct wpabuf *own_private) 565 { 566 BIGNUM *pub_key; 567 struct wpabuf *res = NULL; 568 size_t rlen; 569 DH *dh = ctx; 570 int keylen; 571 572 if (ctx == NULL) 573 return NULL; 574 575 pub_key = BN_bin2bn(wpabuf_head(peer_public), wpabuf_len(peer_public), 576 NULL); 577 if (pub_key == NULL) 578 return NULL; 579 580 rlen = DH_size(dh); 581 res = wpabuf_alloc(rlen); 582 if (res == NULL) 583 goto err; 584 585 keylen = DH_compute_key(wpabuf_mhead(res), pub_key, dh); 586 if (keylen < 0) 587 goto err; 588 wpabuf_put(res, keylen); 589 BN_clear_free(pub_key); 590 591 return res; 592 593 err: 594 BN_clear_free(pub_key); 595 wpabuf_clear_free(res); 596 return NULL; 597 } 598 599 600 void dh5_free(void *ctx) 601 { 602 DH *dh; 603 if (ctx == NULL) 604 return; 605 dh = ctx; 606 DH_free(dh); 607 } 608 609 610 struct crypto_hash { 611 HMAC_CTX ctx; 612 }; 613 614 615 struct crypto_hash * crypto_hash_init(enum crypto_hash_alg alg, const u8 *key, 616 size_t key_len) 617 { 618 struct crypto_hash *ctx; 619 const EVP_MD *md; 620 621 switch (alg) { 622 #ifndef OPENSSL_NO_MD5 623 case CRYPTO_HASH_ALG_HMAC_MD5: 624 md = EVP_md5(); 625 break; 626 #endif /* OPENSSL_NO_MD5 */ 627 #ifndef OPENSSL_NO_SHA 628 case CRYPTO_HASH_ALG_HMAC_SHA1: 629 md = EVP_sha1(); 630 break; 631 #endif /* OPENSSL_NO_SHA */ 632 #ifndef OPENSSL_NO_SHA256 633 #ifdef CONFIG_SHA256 634 case CRYPTO_HASH_ALG_HMAC_SHA256: 635 md = EVP_sha256(); 636 break; 637 #endif /* CONFIG_SHA256 */ 638 #endif /* OPENSSL_NO_SHA256 */ 639 default: 640 return NULL; 641 } 642 643 ctx = os_zalloc(sizeof(*ctx)); 644 if (ctx == NULL) 645 return NULL; 646 HMAC_CTX_init(&ctx->ctx); 647 648 #if OPENSSL_VERSION_NUMBER < 0x00909000 649 HMAC_Init_ex(&ctx->ctx, key, key_len, md, NULL); 650 #else /* openssl < 0.9.9 */ 651 if (HMAC_Init_ex(&ctx->ctx, key, key_len, md, NULL) != 1) { 652 bin_clear_free(ctx, sizeof(*ctx)); 653 return NULL; 654 } 655 #endif /* openssl < 0.9.9 */ 656 657 return ctx; 658 } 659 660 661 void crypto_hash_update(struct crypto_hash *ctx, const u8 *data, size_t len) 662 { 663 if (ctx == NULL) 664 return; 665 HMAC_Update(&ctx->ctx, data, len); 666 } 667 668 669 int crypto_hash_finish(struct crypto_hash *ctx, u8 *mac, size_t *len) 670 { 671 unsigned int mdlen; 672 int res; 673 674 if (ctx == NULL) 675 return -2; 676 677 if (mac == NULL || len == NULL) { 678 bin_clear_free(ctx, sizeof(*ctx)); 679 return 0; 680 } 681 682 mdlen = *len; 683 #if OPENSSL_VERSION_NUMBER < 0x00909000 684 HMAC_Final(&ctx->ctx, mac, &mdlen); 685 res = 1; 686 #else /* openssl < 0.9.9 */ 687 res = HMAC_Final(&ctx->ctx, mac, &mdlen); 688 #endif /* openssl < 0.9.9 */ 689 HMAC_CTX_cleanup(&ctx->ctx); 690 bin_clear_free(ctx, sizeof(*ctx)); 691 692 if (res == 1) { 693 *len = mdlen; 694 return 0; 695 } 696 697 return -1; 698 } 699 700 701 static int openssl_hmac_vector(const EVP_MD *type, const u8 *key, 702 size_t key_len, size_t num_elem, 703 const u8 *addr[], const size_t *len, u8 *mac, 704 unsigned int mdlen) 705 { 706 HMAC_CTX ctx; 707 size_t i; 708 int res; 709 710 HMAC_CTX_init(&ctx); 711 #if OPENSSL_VERSION_NUMBER < 0x00909000 712 HMAC_Init_ex(&ctx, key, key_len, type, NULL); 713 #else /* openssl < 0.9.9 */ 714 if (HMAC_Init_ex(&ctx, key, key_len, type, NULL) != 1) 715 return -1; 716 #endif /* openssl < 0.9.9 */ 717 718 for (i = 0; i < num_elem; i++) 719 HMAC_Update(&ctx, addr[i], len[i]); 720 721 #if OPENSSL_VERSION_NUMBER < 0x00909000 722 HMAC_Final(&ctx, mac, &mdlen); 723 res = 1; 724 #else /* openssl < 0.9.9 */ 725 res = HMAC_Final(&ctx, mac, &mdlen); 726 #endif /* openssl < 0.9.9 */ 727 HMAC_CTX_cleanup(&ctx); 728 729 return res == 1 ? 0 : -1; 730 } 731 732 733 #ifndef CONFIG_FIPS 734 735 int hmac_md5_vector(const u8 *key, size_t key_len, size_t num_elem, 736 const u8 *addr[], const size_t *len, u8 *mac) 737 { 738 return openssl_hmac_vector(EVP_md5(), key ,key_len, num_elem, addr, len, 739 mac, 16); 740 } 741 742 743 int hmac_md5(const u8 *key, size_t key_len, const u8 *data, size_t data_len, 744 u8 *mac) 745 { 746 return hmac_md5_vector(key, key_len, 1, &data, &data_len, mac); 747 } 748 749 #endif /* CONFIG_FIPS */ 750 751 752 int pbkdf2_sha1(const char *passphrase, const u8 *ssid, size_t ssid_len, 753 int iterations, u8 *buf, size_t buflen) 754 { 755 if (PKCS5_PBKDF2_HMAC_SHA1(passphrase, os_strlen(passphrase), ssid, 756 ssid_len, iterations, buflen, buf) != 1) 757 return -1; 758 return 0; 759 } 760 761 762 int hmac_sha1_vector(const u8 *key, size_t key_len, size_t num_elem, 763 const u8 *addr[], const size_t *len, u8 *mac) 764 { 765 return openssl_hmac_vector(EVP_sha1(), key, key_len, num_elem, addr, 766 len, mac, 20); 767 } 768 769 770 int hmac_sha1(const u8 *key, size_t key_len, const u8 *data, size_t data_len, 771 u8 *mac) 772 { 773 return hmac_sha1_vector(key, key_len, 1, &data, &data_len, mac); 774 } 775 776 777 #ifdef CONFIG_SHA256 778 779 int hmac_sha256_vector(const u8 *key, size_t key_len, size_t num_elem, 780 const u8 *addr[], const size_t *len, u8 *mac) 781 { 782 return openssl_hmac_vector(EVP_sha256(), key, key_len, num_elem, addr, 783 len, mac, 32); 784 } 785 786 787 int hmac_sha256(const u8 *key, size_t key_len, const u8 *data, 788 size_t data_len, u8 *mac) 789 { 790 return hmac_sha256_vector(key, key_len, 1, &data, &data_len, mac); 791 } 792 793 #endif /* CONFIG_SHA256 */ 794 795 796 #ifdef CONFIG_SHA384 797 798 int hmac_sha384_vector(const u8 *key, size_t key_len, size_t num_elem, 799 const u8 *addr[], const size_t *len, u8 *mac) 800 { 801 return openssl_hmac_vector(EVP_sha384(), key, key_len, num_elem, addr, 802 len, mac, 32); 803 } 804 805 806 int hmac_sha384(const u8 *key, size_t key_len, const u8 *data, 807 size_t data_len, u8 *mac) 808 { 809 return hmac_sha384_vector(key, key_len, 1, &data, &data_len, mac); 810 } 811 812 #endif /* CONFIG_SHA384 */ 813 814 815 int crypto_get_random(void *buf, size_t len) 816 { 817 if (RAND_bytes(buf, len) != 1) 818 return -1; 819 return 0; 820 } 821 822 823 #ifdef CONFIG_OPENSSL_CMAC 824 int omac1_aes_vector(const u8 *key, size_t key_len, size_t num_elem, 825 const u8 *addr[], const size_t *len, u8 *mac) 826 { 827 CMAC_CTX *ctx; 828 int ret = -1; 829 size_t outlen, i; 830 831 ctx = CMAC_CTX_new(); 832 if (ctx == NULL) 833 return -1; 834 835 if (key_len == 32) { 836 if (!CMAC_Init(ctx, key, 32, EVP_aes_256_cbc(), NULL)) 837 goto fail; 838 } else if (key_len == 16) { 839 if (!CMAC_Init(ctx, key, 16, EVP_aes_128_cbc(), NULL)) 840 goto fail; 841 } else { 842 goto fail; 843 } 844 for (i = 0; i < num_elem; i++) { 845 if (!CMAC_Update(ctx, addr[i], len[i])) 846 goto fail; 847 } 848 if (!CMAC_Final(ctx, mac, &outlen) || outlen != 16) 849 goto fail; 850 851 ret = 0; 852 fail: 853 CMAC_CTX_free(ctx); 854 return ret; 855 } 856 857 858 int omac1_aes_128_vector(const u8 *key, size_t num_elem, 859 const u8 *addr[], const size_t *len, u8 *mac) 860 { 861 return omac1_aes_vector(key, 16, num_elem, addr, len, mac); 862 } 863 864 865 int omac1_aes_128(const u8 *key, const u8 *data, size_t data_len, u8 *mac) 866 { 867 return omac1_aes_128_vector(key, 1, &data, &data_len, mac); 868 } 869 870 871 int omac1_aes_256(const u8 *key, const u8 *data, size_t data_len, u8 *mac) 872 { 873 return omac1_aes_vector(key, 32, 1, &data, &data_len, mac); 874 } 875 #endif /* CONFIG_OPENSSL_CMAC */ 876 877 878 struct crypto_bignum * crypto_bignum_init(void) 879 { 880 return (struct crypto_bignum *) BN_new(); 881 } 882 883 884 struct crypto_bignum * crypto_bignum_init_set(const u8 *buf, size_t len) 885 { 886 BIGNUM *bn = BN_bin2bn(buf, len, NULL); 887 return (struct crypto_bignum *) bn; 888 } 889 890 891 void crypto_bignum_deinit(struct crypto_bignum *n, int clear) 892 { 893 if (clear) 894 BN_clear_free((BIGNUM *) n); 895 else 896 BN_free((BIGNUM *) n); 897 } 898 899 900 int crypto_bignum_to_bin(const struct crypto_bignum *a, 901 u8 *buf, size_t buflen, size_t padlen) 902 { 903 int num_bytes, offset; 904 905 if (padlen > buflen) 906 return -1; 907 908 num_bytes = BN_num_bytes((const BIGNUM *) a); 909 if ((size_t) num_bytes > buflen) 910 return -1; 911 if (padlen > (size_t) num_bytes) 912 offset = padlen - num_bytes; 913 else 914 offset = 0; 915 916 os_memset(buf, 0, offset); 917 BN_bn2bin((const BIGNUM *) a, buf + offset); 918 919 return num_bytes + offset; 920 } 921 922 923 int crypto_bignum_add(const struct crypto_bignum *a, 924 const struct crypto_bignum *b, 925 struct crypto_bignum *c) 926 { 927 return BN_add((BIGNUM *) c, (const BIGNUM *) a, (const BIGNUM *) b) ? 928 0 : -1; 929 } 930 931 932 int crypto_bignum_mod(const struct crypto_bignum *a, 933 const struct crypto_bignum *b, 934 struct crypto_bignum *c) 935 { 936 int res; 937 BN_CTX *bnctx; 938 939 bnctx = BN_CTX_new(); 940 if (bnctx == NULL) 941 return -1; 942 res = BN_mod((BIGNUM *) c, (const BIGNUM *) a, (const BIGNUM *) b, 943 bnctx); 944 BN_CTX_free(bnctx); 945 946 return res ? 0 : -1; 947 } 948 949 950 int crypto_bignum_exptmod(const struct crypto_bignum *a, 951 const struct crypto_bignum *b, 952 const struct crypto_bignum *c, 953 struct crypto_bignum *d) 954 { 955 int res; 956 BN_CTX *bnctx; 957 958 bnctx = BN_CTX_new(); 959 if (bnctx == NULL) 960 return -1; 961 res = BN_mod_exp((BIGNUM *) d, (const BIGNUM *) a, (const BIGNUM *) b, 962 (const BIGNUM *) c, bnctx); 963 BN_CTX_free(bnctx); 964 965 return res ? 0 : -1; 966 } 967 968 969 int crypto_bignum_inverse(const struct crypto_bignum *a, 970 const struct crypto_bignum *b, 971 struct crypto_bignum *c) 972 { 973 BIGNUM *res; 974 BN_CTX *bnctx; 975 976 bnctx = BN_CTX_new(); 977 if (bnctx == NULL) 978 return -1; 979 res = BN_mod_inverse((BIGNUM *) c, (const BIGNUM *) a, 980 (const BIGNUM *) b, bnctx); 981 BN_CTX_free(bnctx); 982 983 return res ? 0 : -1; 984 } 985 986 987 int crypto_bignum_sub(const struct crypto_bignum *a, 988 const struct crypto_bignum *b, 989 struct crypto_bignum *c) 990 { 991 return BN_sub((BIGNUM *) c, (const BIGNUM *) a, (const BIGNUM *) b) ? 992 0 : -1; 993 } 994 995 996 int crypto_bignum_div(const struct crypto_bignum *a, 997 const struct crypto_bignum *b, 998 struct crypto_bignum *c) 999 { 1000 int res; 1001 1002 BN_CTX *bnctx; 1003 1004 bnctx = BN_CTX_new(); 1005 if (bnctx == NULL) 1006 return -1; 1007 res = BN_div((BIGNUM *) c, NULL, (const BIGNUM *) a, 1008 (const BIGNUM *) b, bnctx); 1009 BN_CTX_free(bnctx); 1010 1011 return res ? 0 : -1; 1012 } 1013 1014 1015 int crypto_bignum_mulmod(const struct crypto_bignum *a, 1016 const struct crypto_bignum *b, 1017 const struct crypto_bignum *c, 1018 struct crypto_bignum *d) 1019 { 1020 int res; 1021 1022 BN_CTX *bnctx; 1023 1024 bnctx = BN_CTX_new(); 1025 if (bnctx == NULL) 1026 return -1; 1027 res = BN_mod_mul((BIGNUM *) d, (const BIGNUM *) a, (const BIGNUM *) b, 1028 (const BIGNUM *) c, bnctx); 1029 BN_CTX_free(bnctx); 1030 1031 return res ? 0 : -1; 1032 } 1033 1034 1035 int crypto_bignum_cmp(const struct crypto_bignum *a, 1036 const struct crypto_bignum *b) 1037 { 1038 return BN_cmp((const BIGNUM *) a, (const BIGNUM *) b); 1039 } 1040 1041 1042 int crypto_bignum_bits(const struct crypto_bignum *a) 1043 { 1044 return BN_num_bits((const BIGNUM *) a); 1045 } 1046 1047 1048 int crypto_bignum_is_zero(const struct crypto_bignum *a) 1049 { 1050 return BN_is_zero((const BIGNUM *) a); 1051 } 1052 1053 1054 int crypto_bignum_is_one(const struct crypto_bignum *a) 1055 { 1056 return BN_is_one((const BIGNUM *) a); 1057 } 1058 1059 1060 #ifdef CONFIG_ECC 1061 1062 struct crypto_ec { 1063 EC_GROUP *group; 1064 BN_CTX *bnctx; 1065 BIGNUM *prime; 1066 BIGNUM *order; 1067 }; 1068 1069 struct crypto_ec * crypto_ec_init(int group) 1070 { 1071 struct crypto_ec *e; 1072 int nid; 1073 1074 /* Map from IANA registry for IKE D-H groups to OpenSSL NID */ 1075 switch (group) { 1076 case 19: 1077 nid = NID_X9_62_prime256v1; 1078 break; 1079 case 20: 1080 nid = NID_secp384r1; 1081 break; 1082 case 21: 1083 nid = NID_secp521r1; 1084 break; 1085 case 25: 1086 nid = NID_X9_62_prime192v1; 1087 break; 1088 case 26: 1089 nid = NID_secp224r1; 1090 break; 1091 default: 1092 return NULL; 1093 } 1094 1095 e = os_zalloc(sizeof(*e)); 1096 if (e == NULL) 1097 return NULL; 1098 1099 e->bnctx = BN_CTX_new(); 1100 e->group = EC_GROUP_new_by_curve_name(nid); 1101 e->prime = BN_new(); 1102 e->order = BN_new(); 1103 if (e->group == NULL || e->bnctx == NULL || e->prime == NULL || 1104 e->order == NULL || 1105 !EC_GROUP_get_curve_GFp(e->group, e->prime, NULL, NULL, e->bnctx) || 1106 !EC_GROUP_get_order(e->group, e->order, e->bnctx)) { 1107 crypto_ec_deinit(e); 1108 e = NULL; 1109 } 1110 1111 return e; 1112 } 1113 1114 1115 void crypto_ec_deinit(struct crypto_ec *e) 1116 { 1117 if (e == NULL) 1118 return; 1119 BN_clear_free(e->order); 1120 BN_clear_free(e->prime); 1121 EC_GROUP_free(e->group); 1122 BN_CTX_free(e->bnctx); 1123 os_free(e); 1124 } 1125 1126 1127 struct crypto_ec_point * crypto_ec_point_init(struct crypto_ec *e) 1128 { 1129 if (e == NULL) 1130 return NULL; 1131 return (struct crypto_ec_point *) EC_POINT_new(e->group); 1132 } 1133 1134 1135 size_t crypto_ec_prime_len(struct crypto_ec *e) 1136 { 1137 return BN_num_bytes(e->prime); 1138 } 1139 1140 1141 size_t crypto_ec_prime_len_bits(struct crypto_ec *e) 1142 { 1143 return BN_num_bits(e->prime); 1144 } 1145 1146 1147 const struct crypto_bignum * crypto_ec_get_prime(struct crypto_ec *e) 1148 { 1149 return (const struct crypto_bignum *) e->prime; 1150 } 1151 1152 1153 const struct crypto_bignum * crypto_ec_get_order(struct crypto_ec *e) 1154 { 1155 return (const struct crypto_bignum *) e->order; 1156 } 1157 1158 1159 void crypto_ec_point_deinit(struct crypto_ec_point *p, int clear) 1160 { 1161 if (clear) 1162 EC_POINT_clear_free((EC_POINT *) p); 1163 else 1164 EC_POINT_free((EC_POINT *) p); 1165 } 1166 1167 1168 int crypto_ec_point_to_bin(struct crypto_ec *e, 1169 const struct crypto_ec_point *point, u8 *x, u8 *y) 1170 { 1171 BIGNUM *x_bn, *y_bn; 1172 int ret = -1; 1173 int len = BN_num_bytes(e->prime); 1174 1175 x_bn = BN_new(); 1176 y_bn = BN_new(); 1177 1178 if (x_bn && y_bn && 1179 EC_POINT_get_affine_coordinates_GFp(e->group, (EC_POINT *) point, 1180 x_bn, y_bn, e->bnctx)) { 1181 if (x) { 1182 crypto_bignum_to_bin((struct crypto_bignum *) x_bn, 1183 x, len, len); 1184 } 1185 if (y) { 1186 crypto_bignum_to_bin((struct crypto_bignum *) y_bn, 1187 y, len, len); 1188 } 1189 ret = 0; 1190 } 1191 1192 BN_clear_free(x_bn); 1193 BN_clear_free(y_bn); 1194 return ret; 1195 } 1196 1197 1198 struct crypto_ec_point * crypto_ec_point_from_bin(struct crypto_ec *e, 1199 const u8 *val) 1200 { 1201 BIGNUM *x, *y; 1202 EC_POINT *elem; 1203 int len = BN_num_bytes(e->prime); 1204 1205 x = BN_bin2bn(val, len, NULL); 1206 y = BN_bin2bn(val + len, len, NULL); 1207 elem = EC_POINT_new(e->group); 1208 if (x == NULL || y == NULL || elem == NULL) { 1209 BN_clear_free(x); 1210 BN_clear_free(y); 1211 EC_POINT_clear_free(elem); 1212 return NULL; 1213 } 1214 1215 if (!EC_POINT_set_affine_coordinates_GFp(e->group, elem, x, y, 1216 e->bnctx)) { 1217 EC_POINT_clear_free(elem); 1218 elem = NULL; 1219 } 1220 1221 BN_clear_free(x); 1222 BN_clear_free(y); 1223 1224 return (struct crypto_ec_point *) elem; 1225 } 1226 1227 1228 int crypto_ec_point_add(struct crypto_ec *e, const struct crypto_ec_point *a, 1229 const struct crypto_ec_point *b, 1230 struct crypto_ec_point *c) 1231 { 1232 return EC_POINT_add(e->group, (EC_POINT *) c, (const EC_POINT *) a, 1233 (const EC_POINT *) b, e->bnctx) ? 0 : -1; 1234 } 1235 1236 1237 int crypto_ec_point_mul(struct crypto_ec *e, const struct crypto_ec_point *p, 1238 const struct crypto_bignum *b, 1239 struct crypto_ec_point *res) 1240 { 1241 return EC_POINT_mul(e->group, (EC_POINT *) res, NULL, 1242 (const EC_POINT *) p, (const BIGNUM *) b, e->bnctx) 1243 ? 0 : -1; 1244 } 1245 1246 1247 int crypto_ec_point_invert(struct crypto_ec *e, struct crypto_ec_point *p) 1248 { 1249 return EC_POINT_invert(e->group, (EC_POINT *) p, e->bnctx) ? 0 : -1; 1250 } 1251 1252 1253 int crypto_ec_point_solve_y_coord(struct crypto_ec *e, 1254 struct crypto_ec_point *p, 1255 const struct crypto_bignum *x, int y_bit) 1256 { 1257 if (!EC_POINT_set_compressed_coordinates_GFp(e->group, (EC_POINT *) p, 1258 (const BIGNUM *) x, y_bit, 1259 e->bnctx) || 1260 !EC_POINT_is_on_curve(e->group, (EC_POINT *) p, e->bnctx)) 1261 return -1; 1262 return 0; 1263 } 1264 1265 1266 int crypto_ec_point_is_at_infinity(struct crypto_ec *e, 1267 const struct crypto_ec_point *p) 1268 { 1269 return EC_POINT_is_at_infinity(e->group, (const EC_POINT *) p); 1270 } 1271 1272 1273 int crypto_ec_point_is_on_curve(struct crypto_ec *e, 1274 const struct crypto_ec_point *p) 1275 { 1276 return EC_POINT_is_on_curve(e->group, (const EC_POINT *) p, e->bnctx); 1277 } 1278 1279 #endif /* CONFIG_ECC */ 1280