mbedtls_dh.c 3.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109
  1. /* Copyright (C) 2017 Fortanix, Inc.
  2. This file is part of Graphene Library OS.
  3. Graphene Library OS is free software: you can redistribute it and/or
  4. modify it under the terms of the GNU Lesser General Public License
  5. as published by the Free Software Foundation, either version 3 of the
  6. License, or (at your option) any later version.
  7. Graphene Library OS is distributed in the hope that it will be useful,
  8. but WITHOUT ANY WARRANTY; without even the implied warranty of
  9. MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  10. GNU Lesser General Public License for more details.
  11. You should have received a copy of the GNU Lesser General Public License
  12. along with this program. If not, see <http://www.gnu.org/licenses/>. */
  13. #include <errno.h>
  14. #include <limits.h>
  15. #include "pal.h"
  16. #include "pal_error.h"
  17. #include "pal_crypto.h"
  18. #include "pal_debug.h"
  19. #include "assert.h"
  20. #define BITS_PER_BYTE 8
  21. /* This is declared in pal_internal.h, but that can't be included here. */
  22. int _DkRandomBitsRead(void *buffer, int size);
  23. /* Wrapper to provide mbedtls the RNG interface it expects. It passes an
  24. * extra context parameter, and expects a return value of 0 for success
  25. * and nonzero for failure. */
  26. static int RandomWrapper(void *private, unsigned char *data, size_t size)
  27. {
  28. return _DkRandomBitsRead(data, size) != size;
  29. }
  30. int lib_DhInit(LIB_DH_CONTEXT *context)
  31. {
  32. int ret;
  33. mbedtls_dhm_init(context);
  34. /* Configure parameters. Note that custom Diffie-Hellman parameters
  35. * are considered more secure, but require more data be exchanged
  36. * between the two parties to establish the parameters, so we haven't
  37. * implemented that yet. */
  38. ret = mbedtls_mpi_read_string(&context->P, 16 /* radix */,
  39. MBEDTLS_DHM_RFC3526_MODP_2048_P);
  40. if (ret != 0) {
  41. pal_printf("D-H initialization failed: %d\n", ret);
  42. return ret;
  43. }
  44. ret = mbedtls_mpi_read_string(&context->G, 16 /* radix */,
  45. MBEDTLS_DHM_RFC3526_MODP_2048_G);
  46. if (ret != 0) {
  47. pal_printf("D-H initialization failed: %d\n", ret);
  48. return ret;
  49. }
  50. context->len = mbedtls_mpi_size(&context->P);
  51. return 0;
  52. }
  53. int lib_DhCreatePublic(LIB_DH_CONTEXT *context, uint8_t *public,
  54. uint64_t *public_size)
  55. {
  56. int ret;
  57. if (*public_size != DH_SIZE)
  58. return -PAL_ERROR_INVAL;
  59. /* The RNG here is used to generate secret exponent X. */
  60. ret = mbedtls_dhm_make_public(context, context->len, public, *public_size,
  61. RandomWrapper, NULL);
  62. if (ret != 0)
  63. return ret;
  64. /* mbedtls writes leading zeros in the big-endian output to pad to
  65. * public_size, so leave caller's public_size unchanged */
  66. return 0;
  67. }
  68. int lib_DhCalcSecret(LIB_DH_CONTEXT *context, uint8_t *peer, uint64_t peer_size,
  69. uint8_t *secret, uint64_t *secret_size)
  70. {
  71. int ret;
  72. if (*secret_size != DH_SIZE)
  73. return -PAL_ERROR_INVAL;
  74. ret = mbedtls_dhm_read_public(context, peer, peer_size);
  75. if (ret != 0)
  76. return ret;
  77. /* The RNG here is used for blinding against timing attacks if X is
  78. * reused and not used otherwise. mbedtls recommends always passing
  79. * in an RNG. */
  80. return mbedtls_dhm_calc_secret(context, secret, *secret_size, secret_size,
  81. RandomWrapper, NULL);
  82. }
  83. void lib_DhFinal(LIB_DH_CONTEXT *context)
  84. {
  85. /* This call zeros out context for us. */
  86. mbedtls_dhm_free(context);
  87. }