1*e7be843bSPierre Pronchery /*
2*e7be843bSPierre Pronchery * Copyright 2023-2024 The OpenSSL Project Authors. All Rights Reserved.
3*e7be843bSPierre Pronchery *
4*e7be843bSPierre Pronchery * Licensed under the Apache License 2.0 (the "License"). You may not use
5*e7be843bSPierre Pronchery * this file except in compliance with the License. You can obtain a copy
6*e7be843bSPierre Pronchery * in the file LICENSE in the source distribution or at
7*e7be843bSPierre Pronchery * https://www.openssl.org/source/license.html
8*e7be843bSPierre Pronchery */
9*e7be843bSPierre Pronchery
10*e7be843bSPierre Pronchery #include <stdio.h>
11*e7be843bSPierre Pronchery #include <string.h>
12*e7be843bSPierre Pronchery #include <openssl/core_names.h>
13*e7be843bSPierre Pronchery #include <openssl/evp.h>
14*e7be843bSPierre Pronchery #include <openssl/err.h>
15*e7be843bSPierre Pronchery
16*e7be843bSPierre Pronchery /*
17*e7be843bSPierre Pronchery * This is a demonstration of key exchange using ECDH.
18*e7be843bSPierre Pronchery *
19*e7be843bSPierre Pronchery * EC key exchange requires 2 parties (peers) to first agree on shared group
20*e7be843bSPierre Pronchery * parameters (the EC curve name). Each peer then generates a public/private
21*e7be843bSPierre Pronchery * key pair using the shared curve name. Each peer then gives their public key
22*e7be843bSPierre Pronchery * to the other peer. A peer can then derive the same shared secret using their
23*e7be843bSPierre Pronchery * private key and the other peers public key.
24*e7be843bSPierre Pronchery */
25*e7be843bSPierre Pronchery
26*e7be843bSPierre Pronchery /* Object used to store information for a single Peer */
27*e7be843bSPierre Pronchery typedef struct peer_data_st {
28*e7be843bSPierre Pronchery const char *name; /* name of peer */
29*e7be843bSPierre Pronchery const char *curvename; /* The shared curve name */
30*e7be843bSPierre Pronchery EVP_PKEY *priv; /* private keypair */
31*e7be843bSPierre Pronchery EVP_PKEY *pub; /* public key to send to other peer */
32*e7be843bSPierre Pronchery unsigned char *secret; /* allocated shared secret buffer */
33*e7be843bSPierre Pronchery size_t secretlen;
34*e7be843bSPierre Pronchery } PEER_DATA;
35*e7be843bSPierre Pronchery
36*e7be843bSPierre Pronchery /*
37*e7be843bSPierre Pronchery * The public key needs to be given to the other peer
38*e7be843bSPierre Pronchery * The following code extracts the public key data from the private key
39*e7be843bSPierre Pronchery * and then builds an EVP_KEY public key.
40*e7be843bSPierre Pronchery */
get_peer_public_key(PEER_DATA * peer,OSSL_LIB_CTX * libctx)41*e7be843bSPierre Pronchery static int get_peer_public_key(PEER_DATA *peer, OSSL_LIB_CTX *libctx)
42*e7be843bSPierre Pronchery {
43*e7be843bSPierre Pronchery int ret = 0;
44*e7be843bSPierre Pronchery EVP_PKEY_CTX *ctx;
45*e7be843bSPierre Pronchery OSSL_PARAM params[3];
46*e7be843bSPierre Pronchery unsigned char pubkeydata[256];
47*e7be843bSPierre Pronchery size_t pubkeylen;
48*e7be843bSPierre Pronchery
49*e7be843bSPierre Pronchery /* Get the EC encoded public key data from the peers private key */
50*e7be843bSPierre Pronchery if (!EVP_PKEY_get_octet_string_param(peer->priv, OSSL_PKEY_PARAM_PUB_KEY,
51*e7be843bSPierre Pronchery pubkeydata, sizeof(pubkeydata),
52*e7be843bSPierre Pronchery &pubkeylen))
53*e7be843bSPierre Pronchery return 0;
54*e7be843bSPierre Pronchery
55*e7be843bSPierre Pronchery /* Create a EC public key from the public key data */
56*e7be843bSPierre Pronchery ctx = EVP_PKEY_CTX_new_from_name(libctx, "EC", NULL);
57*e7be843bSPierre Pronchery if (ctx == NULL)
58*e7be843bSPierre Pronchery return 0;
59*e7be843bSPierre Pronchery params[0] = OSSL_PARAM_construct_utf8_string(OSSL_PKEY_PARAM_GROUP_NAME,
60*e7be843bSPierre Pronchery (char *)peer->curvename, 0);
61*e7be843bSPierre Pronchery params[1] = OSSL_PARAM_construct_octet_string(OSSL_PKEY_PARAM_PUB_KEY,
62*e7be843bSPierre Pronchery pubkeydata, pubkeylen);
63*e7be843bSPierre Pronchery params[2] = OSSL_PARAM_construct_end();
64*e7be843bSPierre Pronchery ret = EVP_PKEY_fromdata_init(ctx) > 0
65*e7be843bSPierre Pronchery && (EVP_PKEY_fromdata(ctx, &peer->pub, EVP_PKEY_PUBLIC_KEY,
66*e7be843bSPierre Pronchery params) > 0);
67*e7be843bSPierre Pronchery EVP_PKEY_CTX_free(ctx);
68*e7be843bSPierre Pronchery return ret;
69*e7be843bSPierre Pronchery }
70*e7be843bSPierre Pronchery
create_peer(PEER_DATA * peer,OSSL_LIB_CTX * libctx)71*e7be843bSPierre Pronchery static int create_peer(PEER_DATA *peer, OSSL_LIB_CTX *libctx)
72*e7be843bSPierre Pronchery {
73*e7be843bSPierre Pronchery int ret = 0;
74*e7be843bSPierre Pronchery EVP_PKEY_CTX *ctx = NULL;
75*e7be843bSPierre Pronchery OSSL_PARAM params[2];
76*e7be843bSPierre Pronchery
77*e7be843bSPierre Pronchery params[0] = OSSL_PARAM_construct_utf8_string(OSSL_PKEY_PARAM_GROUP_NAME,
78*e7be843bSPierre Pronchery (char *)peer->curvename, 0);
79*e7be843bSPierre Pronchery params[1] = OSSL_PARAM_construct_end();
80*e7be843bSPierre Pronchery
81*e7be843bSPierre Pronchery ctx = EVP_PKEY_CTX_new_from_name(libctx, "EC", NULL);
82*e7be843bSPierre Pronchery if (ctx == NULL)
83*e7be843bSPierre Pronchery return 0;
84*e7be843bSPierre Pronchery
85*e7be843bSPierre Pronchery if (EVP_PKEY_keygen_init(ctx) <= 0
86*e7be843bSPierre Pronchery || !EVP_PKEY_CTX_set_params(ctx, params)
87*e7be843bSPierre Pronchery || EVP_PKEY_generate(ctx, &peer->priv) <= 0
88*e7be843bSPierre Pronchery || !get_peer_public_key(peer, libctx)) {
89*e7be843bSPierre Pronchery EVP_PKEY_free(peer->priv);
90*e7be843bSPierre Pronchery peer->priv = NULL;
91*e7be843bSPierre Pronchery goto err;
92*e7be843bSPierre Pronchery }
93*e7be843bSPierre Pronchery ret = 1;
94*e7be843bSPierre Pronchery err:
95*e7be843bSPierre Pronchery EVP_PKEY_CTX_free(ctx);
96*e7be843bSPierre Pronchery return ret;
97*e7be843bSPierre Pronchery }
98*e7be843bSPierre Pronchery
destroy_peer(PEER_DATA * peer)99*e7be843bSPierre Pronchery static void destroy_peer(PEER_DATA *peer)
100*e7be843bSPierre Pronchery {
101*e7be843bSPierre Pronchery EVP_PKEY_free(peer->priv);
102*e7be843bSPierre Pronchery EVP_PKEY_free(peer->pub);
103*e7be843bSPierre Pronchery }
104*e7be843bSPierre Pronchery
generate_secret(PEER_DATA * peerA,EVP_PKEY * peerBpub,OSSL_LIB_CTX * libctx)105*e7be843bSPierre Pronchery static int generate_secret(PEER_DATA *peerA, EVP_PKEY *peerBpub,
106*e7be843bSPierre Pronchery OSSL_LIB_CTX *libctx)
107*e7be843bSPierre Pronchery {
108*e7be843bSPierre Pronchery unsigned char *secret = NULL;
109*e7be843bSPierre Pronchery size_t secretlen = 0;
110*e7be843bSPierre Pronchery EVP_PKEY_CTX *derivectx;
111*e7be843bSPierre Pronchery
112*e7be843bSPierre Pronchery /* Create an EVP_PKEY_CTX that contains peerA's private key */
113*e7be843bSPierre Pronchery derivectx = EVP_PKEY_CTX_new_from_pkey(libctx, peerA->priv, NULL);
114*e7be843bSPierre Pronchery if (derivectx == NULL)
115*e7be843bSPierre Pronchery return 0;
116*e7be843bSPierre Pronchery
117*e7be843bSPierre Pronchery if (EVP_PKEY_derive_init(derivectx) <= 0)
118*e7be843bSPierre Pronchery goto cleanup;
119*e7be843bSPierre Pronchery /* Set up peerB's public key */
120*e7be843bSPierre Pronchery if (EVP_PKEY_derive_set_peer(derivectx, peerBpub) <= 0)
121*e7be843bSPierre Pronchery goto cleanup;
122*e7be843bSPierre Pronchery
123*e7be843bSPierre Pronchery /*
124*e7be843bSPierre Pronchery * For backwards compatibility purposes the OpenSSL ECDH provider supports
125*e7be843bSPierre Pronchery * optionally using a X963KDF to expand the secret data. This can be done
126*e7be843bSPierre Pronchery * with code similar to the following.
127*e7be843bSPierre Pronchery *
128*e7be843bSPierre Pronchery * OSSL_PARAM params[5];
129*e7be843bSPierre Pronchery * size_t outlen = 128;
130*e7be843bSPierre Pronchery * unsigned char ukm[] = { 1, 2, 3, 4 };
131*e7be843bSPierre Pronchery * params[0] = OSSL_PARAM_construct_utf8_string(OSSL_EXCHANGE_PARAM_KDF_TYPE,
132*e7be843bSPierre Pronchery * "X963KDF", 0);
133*e7be843bSPierre Pronchery * params[1] = OSSL_PARAM_construct_utf8_string(OSSL_EXCHANGE_PARAM_KDF_DIGEST,
134*e7be843bSPierre Pronchery * "SHA256", 0);
135*e7be843bSPierre Pronchery * params[2] = OSSL_PARAM_construct_size_t(OSSL_EXCHANGE_PARAM_KDF_OUTLEN,
136*e7be843bSPierre Pronchery * &outlen);
137*e7be843bSPierre Pronchery * params[3] = OSSL_PARAM_construct_octet_string(OSSL_EXCHANGE_PARAM_KDF_UKM,
138*e7be843bSPierre Pronchery * ukm, sizeof(ukm));
139*e7be843bSPierre Pronchery * params[4] = OSSL_PARAM_construct_end();
140*e7be843bSPierre Pronchery * if (!EVP_PKEY_CTX_set_params(derivectx, params))
141*e7be843bSPierre Pronchery * goto cleanup;
142*e7be843bSPierre Pronchery *
143*e7be843bSPierre Pronchery * Note: After the secret is generated below, the peer could alternatively
144*e7be843bSPierre Pronchery * pass the secret to a KDF to derive additional key data from the secret.
145*e7be843bSPierre Pronchery * See demos/kdf/hkdf.c for an example (where ikm is the secret key)
146*e7be843bSPierre Pronchery */
147*e7be843bSPierre Pronchery
148*e7be843bSPierre Pronchery /* Calculate the size of the secret and allocate space */
149*e7be843bSPierre Pronchery if (EVP_PKEY_derive(derivectx, NULL, &secretlen) <= 0)
150*e7be843bSPierre Pronchery goto cleanup;
151*e7be843bSPierre Pronchery secret = (unsigned char *)OPENSSL_malloc(secretlen);
152*e7be843bSPierre Pronchery if (secret == NULL)
153*e7be843bSPierre Pronchery goto cleanup;
154*e7be843bSPierre Pronchery
155*e7be843bSPierre Pronchery /*
156*e7be843bSPierre Pronchery * Derive the shared secret. In this example 32 bytes are generated.
157*e7be843bSPierre Pronchery * For EC curves the secret size is related to the degree of the curve
158*e7be843bSPierre Pronchery * which is 256 bits for P-256.
159*e7be843bSPierre Pronchery */
160*e7be843bSPierre Pronchery if (EVP_PKEY_derive(derivectx, secret, &secretlen) <= 0)
161*e7be843bSPierre Pronchery goto cleanup;
162*e7be843bSPierre Pronchery peerA->secret = secret;
163*e7be843bSPierre Pronchery peerA->secretlen = secretlen;
164*e7be843bSPierre Pronchery
165*e7be843bSPierre Pronchery printf("Shared secret (%s):\n", peerA->name);
166*e7be843bSPierre Pronchery BIO_dump_indent_fp(stdout, peerA->secret, peerA->secretlen, 2);
167*e7be843bSPierre Pronchery putchar('\n');
168*e7be843bSPierre Pronchery
169*e7be843bSPierre Pronchery return 1;
170*e7be843bSPierre Pronchery cleanup:
171*e7be843bSPierre Pronchery OPENSSL_free(secret);
172*e7be843bSPierre Pronchery EVP_PKEY_CTX_free(derivectx);
173*e7be843bSPierre Pronchery return 0;
174*e7be843bSPierre Pronchery }
175*e7be843bSPierre Pronchery
main(void)176*e7be843bSPierre Pronchery int main(void)
177*e7be843bSPierre Pronchery {
178*e7be843bSPierre Pronchery int ret = EXIT_FAILURE;
179*e7be843bSPierre Pronchery /* Initialise the 2 peers that will share a secret */
180*e7be843bSPierre Pronchery PEER_DATA peer1 = {"peer 1", "P-256"};
181*e7be843bSPierre Pronchery PEER_DATA peer2 = {"peer 2", "P-256"};
182*e7be843bSPierre Pronchery /*
183*e7be843bSPierre Pronchery * Setting libctx to NULL uses the default library context
184*e7be843bSPierre Pronchery * Use OSSL_LIB_CTX_new() to create a non default library context
185*e7be843bSPierre Pronchery */
186*e7be843bSPierre Pronchery OSSL_LIB_CTX *libctx = NULL;
187*e7be843bSPierre Pronchery
188*e7be843bSPierre Pronchery /* Each peer creates a (Ephemeral) keypair */
189*e7be843bSPierre Pronchery if (!create_peer(&peer1, libctx)
190*e7be843bSPierre Pronchery || !create_peer(&peer2, libctx)) {
191*e7be843bSPierre Pronchery fprintf(stderr, "Create peer failed\n");
192*e7be843bSPierre Pronchery goto cleanup;
193*e7be843bSPierre Pronchery }
194*e7be843bSPierre Pronchery
195*e7be843bSPierre Pronchery /*
196*e7be843bSPierre Pronchery * Each peer uses its private key and the other peers public key to
197*e7be843bSPierre Pronchery * derive a shared secret
198*e7be843bSPierre Pronchery */
199*e7be843bSPierre Pronchery if (!generate_secret(&peer1, peer2.pub, libctx)
200*e7be843bSPierre Pronchery || !generate_secret(&peer2, peer1.pub, libctx)) {
201*e7be843bSPierre Pronchery fprintf(stderr, "Generate secrets failed\n");
202*e7be843bSPierre Pronchery goto cleanup;
203*e7be843bSPierre Pronchery }
204*e7be843bSPierre Pronchery
205*e7be843bSPierre Pronchery /* For illustrative purposes demonstrate that the derived secrets are equal */
206*e7be843bSPierre Pronchery if (peer1.secretlen != peer2.secretlen
207*e7be843bSPierre Pronchery || CRYPTO_memcmp(peer1.secret, peer2.secret, peer1.secretlen) != 0) {
208*e7be843bSPierre Pronchery fprintf(stderr, "Derived secrets do not match\n");
209*e7be843bSPierre Pronchery goto cleanup;
210*e7be843bSPierre Pronchery } else {
211*e7be843bSPierre Pronchery fprintf(stdout, "Derived secrets match\n");
212*e7be843bSPierre Pronchery }
213*e7be843bSPierre Pronchery
214*e7be843bSPierre Pronchery ret = EXIT_SUCCESS;
215*e7be843bSPierre Pronchery cleanup:
216*e7be843bSPierre Pronchery if (ret != EXIT_SUCCESS)
217*e7be843bSPierre Pronchery ERR_print_errors_fp(stderr);
218*e7be843bSPierre Pronchery destroy_peer(&peer2);
219*e7be843bSPierre Pronchery destroy_peer(&peer1);
220*e7be843bSPierre Pronchery return ret;
221*e7be843bSPierre Pronchery }
222