X-Git-Url: http://wagner.pp.ru/gitweb/?a=blobdiff_plain;f=gost_ec_keyx.c;h=955858c3c41ac000f7c7485357ebe7e2f3315052;hb=cc4de730d8ae76524baa567633f0915d5a490ae0;hp=850479a9d0f24da5475c941417c055c410dc4317;hpb=250f9cd5bb0ae299a7f225d66ff5fcb3bbcb1a70;p=openssl-gost%2Fengine.git

diff --git a/gost_ec_keyx.c b/gost_ec_keyx.c
index 850479a..955858c 100644
--- a/gost_ec_keyx.c
+++ b/gost_ec_keyx.c
@@ -30,7 +30,7 @@ int VKO_compute_key(unsigned char *shared_key,
                     const int vko_dgst_nid)
 {
     unsigned char *databuf = NULL;
-    BIGNUM *scalar = NULL, *X = NULL, *Y = NULL;
+    BIGNUM *scalar = NULL, *X = NULL, *Y = NULL, *order = NULL;
     const EC_GROUP *grp = NULL;
     EC_POINT *pnt = NULL;
     BN_CTX *ctx = NULL;
@@ -51,9 +51,11 @@ int VKO_compute_key(unsigned char *shared_key,
         goto err;
     }
 
+    order = BN_CTX_get(ctx);
     grp = EC_KEY_get0_group(priv_key);
     scalar = BN_CTX_get(ctx);
     X = BN_CTX_get(ctx);
+    EC_GROUP_get_order(grp, order, ctx);
 
     if ((Y = BN_CTX_get(ctx)) == NULL
         || (pnt = EC_POINT_new(grp)) == NULL
@@ -71,7 +73,7 @@ int VKO_compute_key(unsigned char *shared_key,
             break;
     }
 
-    if (!EC_POINT_mul(grp, pnt, NULL, pub_key, scalar, ctx)) {
+    if (!gost_ec_point_mul(grp, pnt, NULL, pub_key, scalar, ctx)) {
         GOSTerr(GOST_F_VKO_COMPUTE_KEY, GOST_R_ERROR_POINT_MUL);
         goto err;
     }
@@ -80,7 +82,7 @@ int VKO_compute_key(unsigned char *shared_key,
         goto err;
     }
 
-    half_len = BN_num_bytes(EC_GROUP_get0_field(grp));
+    half_len = BN_num_bytes(order);
     buf_len = 2 * half_len;
     if ((databuf = OPENSSL_malloc(buf_len)) == NULL) {
         GOSTerr(GOST_F_VKO_COMPUTE_KEY, ERR_R_MALLOC_FAILURE);
@@ -120,6 +122,7 @@ int VKO_compute_key(unsigned char *shared_key,
 }
 
 /*
+ * KEG Algorithm described in R 1323565.1.020-2018 6.4.5.1.
  * keyout expected to be 64 bytes
  * */
 static int gost_keg(const unsigned char *ukm_source, int pkey_nid,
@@ -171,10 +174,145 @@ static int gost_keg(const unsigned char *ukm_source, int pkey_nid,
     }
 }
 
+int pkey_gost_ec_compute_key(void *out, size_t outlen, const EC_POINT *pub_key,
+                             const EC_KEY *eckey)
+{
+    BN_CTX *ctx;
+    EC_POINT *tmp = NULL;
+    BIGNUM *x = NULL;
+    const BIGNUM *priv_key;
+    const EC_GROUP *group;
+    int ret = 0;
+    size_t buflen,len;
+    unsigned char *buf = NULL;
+    int nid;
+
+    if (outlen > INT_MAX) {
+        GOSTerr(GOST_F_PKEY_GOST_EC_COMPUTE_KEY, EC_R_INVALID_OUTPUT_LENGTH);
+        return 0;
+    }
+
+    if ((ctx = BN_CTX_new()) == NULL)
+        goto err;
+    BN_CTX_start(ctx);
+    x = BN_CTX_get(ctx);
+    if (x == NULL) {
+        GOSTerr(GOST_F_PKEY_GOST_EC_COMPUTE_KEY, ERR_R_MALLOC_FAILURE);
+        goto err;
+    }
+
+    priv_key = EC_KEY_get0_private_key(eckey);
+    if (priv_key == NULL) {
+        GOSTerr(GOST_F_PKEY_GOST_EC_COMPUTE_KEY, EC_R_MISSING_PRIVATE_KEY);
+        goto err;
+    }
+
+    group = EC_KEY_get0_group(eckey);
+
+    nid = EC_GROUP_get_curve_name(group);
+    if (nid == NID_id_tc26_gost_3410_2012_256_paramSetA 
+        || nid == NID_id_tc26_gost_3410_2012_512_paramSetC) {
+        if (!EC_GROUP_get_cofactor(group, x, NULL) ||
+            // or use BN_mul(...)
+            !BN_mod_mul(x, x, priv_key, EC_GROUP_get0_order(group), ctx)) {
+            GOSTerr(GOST_F_PKEY_GOST_EC_COMPUTE_KEY, ERR_R_INTERNAL_ERROR);
+            goto err;
+        }
+        priv_key = x;
+    }
+
+    if ((tmp = EC_POINT_new(group)) == NULL) {
+        GOSTerr(GOST_F_PKEY_GOST_EC_COMPUTE_KEY, ERR_R_MALLOC_FAILURE);
+        goto err;
+    }
+
+    if (!gost_ec_point_mul(group, tmp, NULL, pub_key, priv_key, ctx)) {
+        GOSTerr(GOST_F_PKEY_GOST_EC_COMPUTE_KEY, EC_R_POINT_ARITHMETIC_FAILURE);
+        goto err;
+    }
+
+    if (!EC_POINT_get_affine_coordinates(group, tmp, x, NULL, ctx)) {
+        GOSTerr(GOST_F_PKEY_GOST_EC_COMPUTE_KEY, EC_R_POINT_ARITHMETIC_FAILURE);
+        goto err;
+    }
+
+    buflen = (EC_GROUP_get_degree(group) + 7) / 8;
+    len = BN_num_bytes(x);
+    if (len > buflen) {
+        GOSTerr(GOST_F_PKEY_GOST_EC_COMPUTE_KEY, ERR_R_INTERNAL_ERROR);
+        goto err;
+    }
+    if ((buf = OPENSSL_malloc(buflen)) == NULL) {
+        GOSTerr(GOST_F_PKEY_GOST_EC_COMPUTE_KEY, ERR_R_MALLOC_FAILURE);
+        goto err;
+    }
+    
+    if (buflen != BN_bn2lebinpad(x, buf, buflen)) {
+        GOSTerr(GOST_F_PKEY_GOST_EC_COMPUTE_KEY, ERR_R_BN_LIB);
+        goto err;
+    }
+
+    if (outlen > buflen)
+        outlen = buflen;
+    memcpy(out, buf, outlen);
+    OPENSSL_clear_free(buf, buflen);
+
+    ret = outlen;
+
+ err:
+    EC_POINT_clear_free(tmp);
+    BN_CTX_end(ctx);
+    BN_CTX_free(ctx);
+    return ret;
+}
+
+int pkey_gost_ec_2020_derive(EVP_PKEY_CTX *ctx, unsigned char *key, 
+                             size_t *keylen)
+{
+    int ret;
+    size_t outlen;
+    const EC_POINT *pubkey = NULL;
+    EC_KEY *eckey;
+    EVP_PKEY *my_key = EVP_PKEY_CTX_get0_pkey(ctx);
+    EVP_PKEY *peer_key = EVP_PKEY_CTX_get0_peerkey(ctx);
+
+    if (!my_key || !peer_key) {
+        GOSTerr(GOST_F_PKEY_GOST_EC_2020_DERIVE, EC_R_KEYS_NOT_SET);
+        return 0;
+    }
+
+    eckey = EVP_PKEY_get0(my_key);
+
+    if (!key) {
+        const EC_GROUP *group;
+        group = EC_KEY_get0_group(eckey);
+        *keylen = (EC_GROUP_get_degree(group) + 7) / 8;
+        return 1;
+    }
+    pubkey = EC_KEY_get0_public_key(EVP_PKEY_get0(peer_key));
+
+    /*
+     * if *outlen is less than maximum size, the result is truncated. 
+     * (is it error or not?)
+     */
+    
+    outlen = *keylen;
+
+    ret = pkey_gost_ec_compute_key(key, outlen, pubkey, eckey);
+    if (ret <= 0)
+        return 0;
+    *keylen = ret;
+    return 1;
+}
+
 /*
  * EVP_PKEY_METHOD callback derive.
  * Implements VKO R 34.10-2001/2012 algorithms
  */
+/*
+ * Backend for EVP_PKEY_derive()
+ * It have KEG mode (default) and VKO mode (enable by EVP_PKEY_CTRL_SET_VKO).
+ */
 int pkey_gost_ec_derive(EVP_PKEY_CTX *ctx, unsigned char *key, size_t *keylen)
 {
     /*
@@ -188,14 +326,28 @@ int pkey_gost_ec_derive(EVP_PKEY_CTX *ctx, unsigned char *key, size_t *keylen)
     int dgst_nid = NID_undef;
 
     if (!data || data->shared_ukm_size == 0) {
-        GOSTerr(GOST_F_PKEY_GOST_EC_DERIVE, GOST_R_UKM_NOT_SET);
-        return 0;
+        return pkey_gost_ec_2020_derive(ctx, key, keylen);
+    }
+
+    /* VKO */
+    if (data->vko_dgst_nid) {
+        if (!key) {
+            *keylen = data->vko_dgst_nid == NID_id_GostR3411_2012_256? 32 : 64;
+            return 1;
+        }
+        *keylen = VKO_compute_key(key,
+                                  EC_KEY_get0_public_key(EVP_PKEY_get0(peer_key)),
+                                  (EC_KEY *)EVP_PKEY_get0(my_key),
+                                  data->shared_ukm, data->shared_ukm_size,
+                                  data->vko_dgst_nid);
+        return (*keylen) ? 1 : 0;
     }
+
     /*
      * shared_ukm_size = 8 stands for pre-2018 cipher suites
      * It means 32 bytes of key length, 8 byte UKM, 32-bytes hash
      *
-     * shared_ukm_size = 32 stands for pre-2018 cipher suites
+     * shared_ukm_size = 32 stands for post-2018 cipher suites
      * It means 64 bytes of shared_key, 16 bytes of UKM and either
      * 64 bytes of hash or 64 bytes of TLSTREE output
      * */
@@ -207,7 +359,6 @@ int pkey_gost_ec_derive(EVP_PKEY_CTX *ctx, unsigned char *key, size_t *keylen)
                 *keylen = 32;
                 return 1;
             }
-
             EVP_PKEY_get_default_digest_nid(my_key, &dgst_nid);
             if (dgst_nid == NID_id_GostR3411_2012_512)
                 dgst_nid = NID_id_GostR3411_2012_256;
@@ -257,7 +408,7 @@ static int pkey_GOST_ECcp_encrypt(EVP_PKEY_CTX *pctx, unsigned char *out,
     EVP_PKEY *pubk = EVP_PKEY_CTX_get0_pkey(pctx);
     struct gost_pmeth_data *data = EVP_PKEY_CTX_get_data(pctx);
     int pkey_nid = EVP_PKEY_base_id(pubk);
-    ASN1_OBJECT *crypt_params_obj = (pkey_nid == NID_id_GostR3410_2001) ?
+    ASN1_OBJECT *crypt_params_obj = (pkey_nid == NID_id_GostR3410_2001 || pkey_nid == NID_id_GostR3410_2001DH) ?
         OBJ_nid2obj(NID_id_Gost28147_89_CryptoPro_A_ParamSet) :
         OBJ_nid2obj(NID_id_tc26_gost_28147_param_Z);
     const struct gost_cipher_info *param =
@@ -653,6 +804,13 @@ static int pkey_gost2018_decrypt(EVP_PKEY_CTX *pctx, unsigned char *key,
 
    o  q * Q_eph is not equal to zero point.
 */
+    if (eph_key == NULL || priv == NULL || data == NULL) {
+       GOSTerr(GOST_F_PKEY_GOST2018_DECRYPT,
+               GOST_R_ERROR_COMPUTING_EXPORT_KEYS);
+       ret = 0;
+       goto err;
+    }
+  
     if (data->shared_ukm_size == 0 && pst->ukm != NULL) {
         if (EVP_PKEY_CTX_ctrl(pctx, -1, -1, EVP_PKEY_CTRL_SET_IV,
         ASN1_STRING_length(pst->ukm), (void *)ASN1_STRING_get0_data(pst->ukm)) < 0) {
@@ -702,3 +860,4 @@ int pkey_gost_decrypt(EVP_PKEY_CTX *pctx, unsigned char *key,
       return -1;
     }
 }
+/* vim: set expandtab cinoptions=\:0,l1,t0,g0,(0 sw=4 : */