X-Git-Url: http://wagner.pp.ru/gitweb/?a=blobdiff_plain;f=gost_ec_keyx.c;h=850479a9d0f24da5475c941417c055c410dc4317;hb=30860f940321eb4762d6449ffef48fc93ad2d2e8;hp=ac5b3d2c9cc8094afde9a51d021f3a7701636a9d;hpb=c719289105537c5df301ccad0e6b7e94b6f7843d;p=openssl-gost%2Fengine.git

diff --git a/gost_ec_keyx.c b/gost_ec_keyx.c
index ac5b3d2..850479a 100644
--- a/gost_ec_keyx.c
+++ b/gost_ec_keyx.c
@@ -1,9 +1,15 @@
 /**********************************************************************
  *                        gost_ec_keyx.c                              *
+ *                                                                    *
  *             Copyright (c) 2005-2013 Cryptocom LTD                  *
+ *   Copyright (c) 2018,2020 Dmitry Belyavskiy <beldmit@gmail.com>    *
+ *   Copyright (c) 2020 Billy Brumley <bbrumley@gmail.com>            *
+ *                                                                    *
  *         This file is distributed under the same license as OpenSSL *
  *                                                                    *
- *   VK0 34.10-2001 key exchange and GOST R 34.10-2001                *
+ *   VK0 R 50.1.113-2016 / RFC 7836                                   *
+ *   KEG R 1323565.1.020-2018                                         *
+ *   VK0 34.10-2001 key exchange and GOST R 34.10-2001 (RFC 4357)     *
  *   based PKCS7/SMIME support                                        *
  *          Requires OpenSSL 0.9.9 for compilation                    *
  **********************************************************************/
@@ -24,16 +30,16 @@ int VKO_compute_key(unsigned char *shared_key,
                     const int vko_dgst_nid)
 {
     unsigned char *databuf = NULL;
-    BIGNUM *UKM = NULL, *p = NULL, *order = NULL, *X = NULL, *Y = NULL, *cofactor = NULL;
-    const BIGNUM *key = EC_KEY_get0_private_key(priv_key);
-    EC_POINT *pnt = EC_POINT_new(EC_KEY_get0_group(priv_key));
-    BN_CTX *ctx = BN_CTX_secure_new();
+    BIGNUM *scalar = NULL, *X = NULL, *Y = NULL;
+    const EC_GROUP *grp = NULL;
+    EC_POINT *pnt = NULL;
+    BN_CTX *ctx = NULL;
     EVP_MD_CTX *mdctx = NULL;
     const EVP_MD *md = NULL;
     int buf_len, half_len;
     int ret = 0;
 
-    if (!ctx) {
+    if ((ctx = BN_CTX_secure_new()) == NULL) {
         GOSTerr(GOST_F_VKO_COMPUTE_KEY, ERR_R_MALLOC_FAILURE);
         return 0;
     }
@@ -45,30 +51,38 @@ int VKO_compute_key(unsigned char *shared_key,
         goto err;
     }
 
-    UKM = BN_lebin2bn(ukm, ukm_size, NULL);
-    p = BN_CTX_get(ctx);
-    order = BN_CTX_get(ctx);
-    cofactor = BN_CTX_get(ctx);
+    grp = EC_KEY_get0_group(priv_key);
+    scalar = BN_CTX_get(ctx);
     X = BN_CTX_get(ctx);
-    Y = BN_CTX_get(ctx);
-    EC_GROUP_get_order(EC_KEY_get0_group(priv_key), order, ctx);
-    EC_GROUP_get_cofactor(EC_KEY_get0_group(priv_key), cofactor, ctx);
-    BN_mod_mul(UKM, UKM, cofactor, order, ctx);
-    BN_mod_mul(p, key, UKM, order, ctx);
-    if (!EC_POINT_mul(EC_KEY_get0_group(priv_key), pnt, NULL, pub_key, p, ctx)) {
+
+    if ((Y = BN_CTX_get(ctx)) == NULL
+        || (pnt = EC_POINT_new(grp)) == NULL
+        || BN_lebin2bn(ukm, ukm_size, scalar) == NULL
+        || !BN_mod_mul(scalar, scalar, EC_KEY_get0_private_key(priv_key),
+                       EC_GROUP_get0_order(grp), ctx))
+        goto err;
+
+    /* these two curves have cofactor 4; the rest have cofactor 1 */
+    switch (EC_GROUP_get_curve_name(grp)) {
+        case NID_id_tc26_gost_3410_2012_256_paramSetA:
+        case NID_id_tc26_gost_3410_2012_512_paramSetC:
+            if (!BN_lshift(scalar, scalar, 2))
+                goto err;
+            break;
+    }
+
+    if (!EC_POINT_mul(grp, pnt, NULL, pub_key, scalar, ctx)) {
         GOSTerr(GOST_F_VKO_COMPUTE_KEY, GOST_R_ERROR_POINT_MUL);
         goto err;
     }
-    if (!EC_POINT_get_affine_coordinates(EC_KEY_get0_group(priv_key),
-                                        pnt, X, Y, ctx)) {
+    if (!EC_POINT_get_affine_coordinates(grp, pnt, X, Y, ctx)) {
         GOSTerr(GOST_F_VKO_COMPUTE_KEY, ERR_R_EC_LIB);
         goto err;
     }
 
-    half_len = BN_num_bytes(order);
+    half_len = BN_num_bytes(EC_GROUP_get0_field(grp));
     buf_len = 2 * half_len;
-    databuf = OPENSSL_zalloc(buf_len);
-    if (!databuf) {
+    if ((databuf = OPENSSL_malloc(buf_len)) == NULL) {
         GOSTerr(GOST_F_VKO_COMPUTE_KEY, ERR_R_MALLOC_FAILURE);
         goto err;
     }
@@ -76,13 +90,11 @@ int VKO_compute_key(unsigned char *shared_key,
     /*
      * Serialize elliptic curve point same way as we do it when saving key
      */
-    store_bignum(Y, databuf, half_len);
-    store_bignum(X, databuf + half_len, half_len);
-    /* And reverse byte order of whole buffer */
-    BUF_reverse(databuf, NULL, buf_len);
+    if (BN_bn2lebinpad(X, databuf, half_len) != half_len
+        || BN_bn2lebinpad(Y, databuf + half_len, half_len) != half_len)
+        goto err;
 
-    mdctx = EVP_MD_CTX_new();
-    if (!mdctx) {
+    if ((mdctx = EVP_MD_CTX_new()) == NULL) {
         GOSTerr(GOST_F_VKO_COMPUTE_KEY, ERR_R_MALLOC_FAILURE);
         goto err;
     }
@@ -98,14 +110,10 @@ int VKO_compute_key(unsigned char *shared_key,
     ret = (EVP_MD_size(md) > 0) ? EVP_MD_size(md) : 0;
 
  err:
-    BN_free(UKM);
     BN_CTX_end(ctx);
     BN_CTX_free(ctx);
-
     EC_POINT_free(pnt);
-
     EVP_MD_CTX_free(mdctx);
-
     OPENSSL_free(databuf);
 
     return ret;