The Tor Browser / file revision

 /* This Source Code Form is subject to the terms of the Mozilla Public

  * License, v. 2.0. If a copy of the MPL was not distributed with this

  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

 #ifdef FREEBL_NO_DEPEND

 #include "stubs.h"

 #endif

 #include "blapi.h"

 #include "secerr.h"

 #include "secitem.h"

 #include "secmpi.h"

 /* Hash an item's length and then its value. Only items smaller than 2^16 bytes

  * are allowed. Lengths are hashed in network byte order. This is designed

  * to match the OpenSSL J-PAKE implementation.

  */

 static mp_err

 hashSECItem(HASHContext * hash, const SECItem * it)

 {

     unsigned char length[2];

     if (it->len > 0xffff)

         return MP_BADARG;

     length[0] = (unsigned char) (it->len >> 8);

     length[1] = (unsigned char) (it->len);

     hash->hashobj->update(hash->hash_context, length, 2);

     hash->hashobj->update(hash->hash_context, it->data, it->len);

     return MP_OKAY;

 }

 /* Hash all public components of the signature, each prefixed with its

    length, and then convert the hash to an mp_int. */

 static mp_err

 hashPublicParams(HASH_HashType hashType, const SECItem * g,

                  const SECItem * gv, const SECItem * gx,

                  const SECItem * signerID, mp_int * h)

 {

     mp_err err;

     unsigned char hBuf[HASH_LENGTH_MAX];

     SECItem hItem;

     HASHContext hash;

     hash.hashobj = HASH_GetRawHashObject(hashType);

     if (hash.hashobj == NULL || hash.hashobj->length > sizeof hBuf) {

         return MP_BADARG;

     }

     hash.hash_context = hash.hashobj->create();

     if (hash.hash_context == NULL) {

         return MP_MEM;

     }

     hItem.data = hBuf;

     hItem.len = hash.hashobj->length;

     hash.hashobj->begin(hash.hash_context);

     CHECK_MPI_OK( hashSECItem(&hash, g) );

     CHECK_MPI_OK( hashSECItem(&hash, gv) );

     CHECK_MPI_OK( hashSECItem(&hash, gx) );

     CHECK_MPI_OK( hashSECItem(&hash, signerID) );

     hash.hashobj->end(hash.hash_context, hItem.data, &hItem.len,

                       sizeof hBuf);

     SECITEM_TO_MPINT(hItem, h);

 cleanup:

     if (hash.hash_context != NULL) {

         hash.hashobj->destroy(hash.hash_context, PR_TRUE);

     }

     return err;

 }

 /* Generate a Schnorr signature for round 1 or round 2 */

 SECStatus

 JPAKE_Sign(PLArenaPool * arena, const PQGParams * pqg, HASH_HashType hashType,

            const SECItem * signerID, const SECItem * x,

            const SECItem * testRandom, const SECItem * gxIn, SECItem * gxOut,

            SECItem * gv, SECItem * r)

 {

     SECStatus rv = SECSuccess;

     mp_err err;

     mp_int p;

     mp_int q;

     mp_int g;

     mp_int X;

     mp_int GX;

     mp_int V;

     mp_int GV;

     mp_int h;

     mp_int tmp;

     mp_int R;

     SECItem v;

     if (!arena    ||

         !pqg      || !pqg->prime.data     || pqg->prime.len == 0 ||

                      !pqg->subPrime.data  || pqg->subPrime.len == 0 ||

                      !pqg->base.data      || pqg->base.len == 0 ||

         !signerID || !signerID->data      || signerID->len == 0 ||

         !x        || !x->data             || x->len == 0 ||

         (testRandom && (!testRandom->data || testRandom->len == 0)) ||

         (gxIn == NULL && (!gxOut || gxOut->data != NULL)) ||

         (gxIn != NULL && (!gxIn->data || gxIn->len == 0 || gxOut != NULL)) ||

         !gv       || gv->data != NULL ||

         !r        || r->data != NULL) {

         PORT_SetError(SEC_ERROR_INVALID_ARGS);

         return SECFailure;

     }

     MP_DIGITS(&p) = 0;

     MP_DIGITS(&q) = 0;

     MP_DIGITS(&g) = 0;

     MP_DIGITS(&X) = 0;

     MP_DIGITS(&GX) = 0;

     MP_DIGITS(&V) = 0;

     MP_DIGITS(&GV) = 0;

     MP_DIGITS(&h) = 0;

     MP_DIGITS(&tmp) = 0;

     MP_DIGITS(&R) = 0;

     CHECK_MPI_OK( mp_init(&p) );

     CHECK_MPI_OK( mp_init(&q) );

     CHECK_MPI_OK( mp_init(&g) );

     CHECK_MPI_OK( mp_init(&X) );

     CHECK_MPI_OK( mp_init(&GX) );

     CHECK_MPI_OK( mp_init(&V) );

     CHECK_MPI_OK( mp_init(&GV) );

     CHECK_MPI_OK( mp_init(&h) );

     CHECK_MPI_OK( mp_init(&tmp) );

     CHECK_MPI_OK( mp_init(&R) );

     SECITEM_TO_MPINT(pqg->prime, &p);

     SECITEM_TO_MPINT(pqg->subPrime, &q);

     SECITEM_TO_MPINT(pqg->base, &g);

     SECITEM_TO_MPINT(*x,  &X);

     /* gx = g^x */

     if (gxIn == NULL) {

         CHECK_MPI_OK( mp_exptmod(&g, &X, &p, &GX) );

         MPINT_TO_SECITEM(&GX, gxOut, arena);

         gxIn = gxOut;

     } else {

         SECITEM_TO_MPINT(*gxIn, &GX);

     }

     /* v is a random value in the q subgroup */

     if (testRandom == NULL) {

         v.data = NULL;

         rv = DSA_NewRandom(arena, &pqg->subPrime, &v);

         if (rv != SECSuccess) {

             goto cleanup;

         }

     } else {

         v.data = testRandom->data;

         v.len = testRandom->len;

     }

     SECITEM_TO_MPINT(v, &V);

     /* gv = g^v (mod q), random v, 1 <= v < q */

     CHECK_MPI_OK( mp_exptmod(&g, &V, &p, &GV) );

     MPINT_TO_SECITEM(&GV, gv, arena);

     /* h = H(g, gv, gx, signerID) */

     CHECK_MPI_OK( hashPublicParams(hashType, &pqg->base, gv, gxIn, signerID,

                                    &h) );

     /* r = v - x*h (mod q) */

     CHECK_MPI_OK( mp_mulmod(&X, &h, &q, &tmp) );

     CHECK_MPI_OK( mp_submod(&V, &tmp, &q, &R) );

     MPINT_TO_SECITEM(&R, r, arena);

 cleanup:

     mp_clear(&p);

     mp_clear(&q);

     mp_clear(&g);

     mp_clear(&X);

     mp_clear(&GX);

     mp_clear(&V);

     mp_clear(&GV);

     mp_clear(&h);

     mp_clear(&tmp);

     mp_clear(&R);

     if (rv == SECSuccess && err != MP_OKAY) {

         MP_TO_SEC_ERROR(err);

         rv = SECFailure;

     }

     return rv;

 }

 /* Verify a Schnorr signature generated by the peer in round 1 or round 2. */

 SECStatus

 JPAKE_Verify(PLArenaPool * arena, const PQGParams * pqg, HASH_HashType hashType,

              const SECItem * signerID, const SECItem * peerID,

              const SECItem * gx, const SECItem * gv, const SECItem * r)

 {

     SECStatus rv = SECSuccess;

     mp_err err;

     mp_int p;

     mp_int q;

     mp_int g;

     mp_int p_minus_1;

     mp_int GX;

     mp_int h;

     mp_int one;

     mp_int R;

     mp_int gr;

     mp_int gxh;

     mp_int gr_gxh;

     SECItem calculated;

     if (!arena    ||

         !pqg      || !pqg->prime.data    || pqg->prime.len == 0 ||

                      !pqg->subPrime.data || pqg->subPrime.len == 0 ||

                      !pqg->base.data     || pqg->base.len == 0 ||

         !signerID || !signerID->data  || signerID->len == 0 ||

         !peerID   || !peerID->data    || peerID->len == 0 ||

         !gx       || !gx->data        || gx->len == 0 ||

         !gv       || !gv->data        || gv->len == 0 ||

         !r        || !r->data         || r->len == 0 ||

         SECITEM_CompareItem(signerID, peerID) == SECEqual) {

         PORT_SetError(SEC_ERROR_INVALID_ARGS);

         return SECFailure;

     }

     MP_DIGITS(&p) = 0;

     MP_DIGITS(&q) = 0;

     MP_DIGITS(&g) = 0;

     MP_DIGITS(&p_minus_1) = 0;

     MP_DIGITS(&GX) = 0;

     MP_DIGITS(&h) = 0;

     MP_DIGITS(&one) = 0;

     MP_DIGITS(&R) = 0;

     MP_DIGITS(&gr) = 0;

     MP_DIGITS(&gxh) = 0;

     MP_DIGITS(&gr_gxh) = 0;

     calculated.data = NULL;

     CHECK_MPI_OK( mp_init(&p) );

     CHECK_MPI_OK( mp_init(&q) );

     CHECK_MPI_OK( mp_init(&g) );

     CHECK_MPI_OK( mp_init(&p_minus_1) );

     CHECK_MPI_OK( mp_init(&GX) );

     CHECK_MPI_OK( mp_init(&h) );

     CHECK_MPI_OK( mp_init(&one) );

     CHECK_MPI_OK( mp_init(&R) );

     CHECK_MPI_OK( mp_init(&gr) );

     CHECK_MPI_OK( mp_init(&gxh) );

     CHECK_MPI_OK( mp_init(&gr_gxh) );

     SECITEM_TO_MPINT(pqg->prime, &p);

     SECITEM_TO_MPINT(pqg->subPrime, &q);

     SECITEM_TO_MPINT(pqg->base, &g);

     SECITEM_TO_MPINT(*gx, &GX);

     SECITEM_TO_MPINT(*r, &R);

     CHECK_MPI_OK( mp_sub_d(&p, 1, &p_minus_1) );

     CHECK_MPI_OK( mp_exptmod(&GX, &q, &p, &one) );

     /* Check g^x is in [1, p-2], R is in [0, q-1], and (g^x)^q mod p == 1 */

     if (!(mp_cmp_z(&GX) > 0 && 

           mp_cmp(&GX, &p_minus_1) < 0 && 

           mp_cmp(&R, &q) < 0 &&

           mp_cmp_d(&one, 1) == 0)) {

         goto badSig;

     }

     CHECK_MPI_OK( hashPublicParams(hashType, &pqg->base, gv, gx, peerID,

                                    &h) );

     /* Calculate g^v = g^r * g^x^h */

     CHECK_MPI_OK( mp_exptmod(&g, &R, &p, &gr) );

     CHECK_MPI_OK( mp_exptmod(&GX, &h, &p, &gxh) );

     CHECK_MPI_OK( mp_mulmod(&gr, &gxh, &p, &gr_gxh) );

     /* Compare calculated g^v to given g^v */

     MPINT_TO_SECITEM(&gr_gxh, &calculated, arena);

     if (calculated.len == gv->len &&

         NSS_SecureMemcmp(calculated.data, gv->data, calculated.len) == 0) {

         rv = SECSuccess;

     } else {

 badSig: PORT_SetError(SEC_ERROR_BAD_SIGNATURE);

         rv = SECFailure;

     }

 cleanup:

     mp_clear(&p);

     mp_clear(&q);

     mp_clear(&g);

     mp_clear(&p_minus_1);

     mp_clear(&GX);

     mp_clear(&h);

     mp_clear(&one);

     mp_clear(&R);

     mp_clear(&gr);

     mp_clear(&gxh);

     mp_clear(&gr_gxh);

     if (rv == SECSuccess && err != MP_OKAY) {

         MP_TO_SEC_ERROR(err);

         rv = SECFailure;

     }

     return rv;

 }

 /* Calculate base = gx1*gx3*gx4 (mod p), i.e. g^(x1+x3+x4) (mod p) */

 static mp_err

 jpake_Round2Base(const SECItem * gx1, const SECItem * gx3,

                  const SECItem * gx4, const mp_int * p, mp_int * base)

 {

     mp_err err;

     mp_int GX1;

     mp_int GX3;

     mp_int GX4;

     mp_int tmp;

     MP_DIGITS(&GX1) = 0;

     MP_DIGITS(&GX3) = 0;

     MP_DIGITS(&GX4) = 0;

     MP_DIGITS(&tmp) = 0;

     CHECK_MPI_OK( mp_init(&GX1) );

     CHECK_MPI_OK( mp_init(&GX3) );

     CHECK_MPI_OK( mp_init(&GX4) );

     CHECK_MPI_OK( mp_init(&tmp) );

     SECITEM_TO_MPINT(*gx1, &GX1);

     SECITEM_TO_MPINT(*gx3, &GX3);

     SECITEM_TO_MPINT(*gx4, &GX4);

     /* In round 2, the peer/attacker sends us g^x3 and g^x4 and the protocol

        requires that these values are distinct. */

     if (mp_cmp(&GX3, &GX4) == 0) {

         return MP_BADARG;

     }

     CHECK_MPI_OK( mp_mul(&GX1, &GX3, &tmp) );

     CHECK_MPI_OK( mp_mul(&tmp, &GX4, &tmp) ); 

     CHECK_MPI_OK( mp_mod(&tmp, p, base) );

 cleanup:

     mp_clear(&GX1);

     mp_clear(&GX3);

     mp_clear(&GX4);

     mp_clear(&tmp);

     return err;

 }

 SECStatus

 JPAKE_Round2(PLArenaPool * arena,

              const SECItem * p, const SECItem  *q, const SECItem * gx1,

              const SECItem * gx3, const SECItem * gx4, SECItem * base,

              const SECItem * x2, const SECItem * s, SECItem * x2s)

 {

     mp_err err;

     mp_int P;

     mp_int Q;

     mp_int X2;

     mp_int S;

     mp_int result;

     if (!arena ||

         !p     || !p->data    || p->len == 0   ||

         !q     || !q->data    || q->len == 0   ||

         !gx1   || !gx1->data  || gx1->len == 0 ||

         !gx3   || !gx3->data  || gx3->len == 0 ||

         !gx4   || !gx4->data  || gx4->len == 0 ||

         !base  || base->data != NULL ||

         (x2s != NULL && (x2s->data != NULL ||

            !x2 || !x2->data   || x2->len == 0 ||

            !s  || !s->data    || s->len == 0))) {

         PORT_SetError(SEC_ERROR_INVALID_ARGS);

         return SECFailure;

     }

     MP_DIGITS(&P) = 0;

     MP_DIGITS(&Q) = 0;

     MP_DIGITS(&X2) = 0;

     MP_DIGITS(&S) = 0;

     MP_DIGITS(&result) = 0;

     CHECK_MPI_OK( mp_init(&P) );

     CHECK_MPI_OK( mp_init(&Q) );

     CHECK_MPI_OK( mp_init(&result) );

     if (x2s != NULL) {

         CHECK_MPI_OK( mp_init(&X2) );

         CHECK_MPI_OK( mp_init(&S) );

         SECITEM_TO_MPINT(*q, &Q);

         SECITEM_TO_MPINT(*x2, &X2);

         SECITEM_TO_MPINT(*s, &S);

         /* S must be in [1, Q-1] */

         if (mp_cmp_z(&S) <= 0 || mp_cmp(&S, &Q) >= 0) {

             err = MP_BADARG;

             goto cleanup;

         }

         CHECK_MPI_OK( mp_mulmod(&X2, &S, &Q, &result) );

         MPINT_TO_SECITEM(&result, x2s, arena);

     }

     SECITEM_TO_MPINT(*p, &P);

     CHECK_MPI_OK( jpake_Round2Base(gx1, gx3, gx4, &P, &result) );

     MPINT_TO_SECITEM(&result, base, arena);

 cleanup:

     mp_clear(&P);

     mp_clear(&Q);

     mp_clear(&X2);

     mp_clear(&S);

     mp_clear(&result);

     if (err != MP_OKAY) {

         MP_TO_SEC_ERROR(err);

         return SECFailure;

     }

     return SECSuccess;

 }

 SECStatus

 JPAKE_Final(PLArenaPool * arena, const SECItem * p, const SECItem * q,

             const SECItem * x2, const SECItem * gx4, const SECItem * x2s,

             const SECItem * B, SECItem * K)

 {

     mp_err err;

     mp_int P;

     mp_int Q;

     mp_int tmp;

     mp_int exponent;

     mp_int divisor;

     mp_int base;

     if (!arena ||

         !p     || !p->data    || p->len == 0   ||

         !q     || !q->data    || q->len == 0   ||

         !x2    || !x2->data   || x2->len == 0  ||

         !gx4   || !gx4->data  || gx4->len == 0 ||

         !x2s   || !x2s->data  || x2s->len == 0 ||

         !B     || !B->data    || B->len == 0 ||

         !K     || K->data != NULL) {

         PORT_SetError(SEC_ERROR_INVALID_ARGS);

         return SECFailure;

     }

     MP_DIGITS(&P) = 0;

     MP_DIGITS(&Q) = 0;

     MP_DIGITS(&tmp) = 0;

     MP_DIGITS(&exponent) = 0;

     MP_DIGITS(&divisor) = 0;

     MP_DIGITS(&base) = 0;

     CHECK_MPI_OK( mp_init(&P) );

     CHECK_MPI_OK( mp_init(&Q) );

     CHECK_MPI_OK( mp_init(&tmp) );

     CHECK_MPI_OK( mp_init(&exponent) );

     CHECK_MPI_OK( mp_init(&divisor) );

     CHECK_MPI_OK( mp_init(&base) );

     /* exponent = -x2s (mod q) */

     SECITEM_TO_MPINT(*q, &Q);

     SECITEM_TO_MPINT(*x2s, &tmp);

     /*  q == 0 (mod q), so q - x2s == -x2s (mod q) */

     CHECK_MPI_OK( mp_sub(&Q, &tmp, &exponent) );

     /* divisor = gx4^-x2s = 1/(gx4^x2s) (mod p) */

     SECITEM_TO_MPINT(*p, &P);

     SECITEM_TO_MPINT(*gx4, &tmp);

     CHECK_MPI_OK( mp_exptmod(&tmp, &exponent, &P, &divisor) );

     /* base = B*divisor = B/(gx4^x2s) (mod p) */

     SECITEM_TO_MPINT(*B, &tmp);

     CHECK_MPI_OK( mp_mulmod(&divisor, &tmp, &P, &base) );

     /* tmp = base^x2 (mod p) */

     SECITEM_TO_MPINT(*x2, &exponent);

     CHECK_MPI_OK( mp_exptmod(&base, &exponent, &P, &tmp) );

     MPINT_TO_SECITEM(&tmp, K, arena);

 cleanup:

     mp_clear(&P);

     mp_clear(&Q);

     mp_clear(&tmp);

     mp_clear(&exponent);

     mp_clear(&divisor);

     mp_clear(&base);

     if (err != MP_OKAY) {

         MP_TO_SEC_ERROR(err);

         return SECFailure;

     }

     return SECSuccess;

 }