| // Copyright 2021 Google LLC |
| // |
| // Licensed under the Apache License, Version 2.0 (the "License"); |
| // you may not use this file except in compliance with the License. |
| // You may obtain a copy of the License at |
| // |
| // http://www.apache.org/licenses/LICENSE-2.0 |
| // |
| // Unless required by applicable law or agreed to in writing, software |
| // distributed under the License is distributed on an "AS IS" BASIS, |
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| // See the License for the specific language governing permissions and |
| // limitations under the License. |
| // |
| /////////////////////////////////////////////////////////////////////////////// |
| #include "tink/internal/ec_util.h" |
| |
| #include <algorithm> |
| #include <cstdint> |
| #include <cstring> |
| #include <memory> |
| #include <string> |
| #include <utility> |
| #include <vector> |
| |
| #include "absl/memory/memory.h" |
| #include "absl/status/status.h" |
| #include "absl/strings/str_cat.h" |
| #include "absl/strings/string_view.h" |
| #include "absl/types/span.h" |
| #include "openssl/bn.h" |
| #include "openssl/ec.h" |
| #include "openssl/crypto.h" |
| #include "openssl/ecdsa.h" |
| #include "openssl/evp.h" |
| #include "tink/internal/bn_util.h" |
| #include "tink/internal/err_util.h" |
| #include "tink/internal/fips_utils.h" |
| #include "tink/internal/ssl_unique_ptr.h" |
| #include "tink/subtle/common_enums.h" |
| #include "tink/subtle/random.h" |
| #include "tink/subtle/subtle_util.h" |
| #include "tink/util/secret_data.h" |
| #include "tink/util/status.h" |
| #include "tink/util/statusor.h" |
| |
| namespace crypto { |
| namespace tink { |
| namespace internal { |
| namespace { |
| |
| using ::crypto::tink::subtle::EcPointFormat; |
| using ::crypto::tink::subtle::EllipticCurveType; |
| |
| // Encodes the given `point` to string, according to a `conversion_form`. |
| util::StatusOr<std::string> SslEcPointEncode( |
| EC_GROUP *group, const EC_POINT *point, |
| point_conversion_form_t conversion_form) { |
| // Get the buffer size first passing a NULL buffer. |
| size_t buffer_size = |
| EC_POINT_point2oct(group, point, conversion_form, |
| /*buf=*/nullptr, /*len=*/0, /*ctx=*/nullptr); |
| if (buffer_size == 0) { |
| return util::Status(absl::StatusCode::kInternal, |
| "EC_POINT_point2oct failed"); |
| } |
| |
| std::string encoded_point; |
| subtle::ResizeStringUninitialized(&encoded_point, buffer_size); |
| size_t size = |
| EC_POINT_point2oct(group, point, conversion_form, |
| reinterpret_cast<uint8_t *>(&encoded_point[0]), |
| buffer_size, /*ctx=*/nullptr); |
| if (size == 0) { |
| return util::Status(absl::StatusCode::kInternal, |
| "EC_POINT_point2oct failed"); |
| } |
| return encoded_point; |
| } |
| |
| // Returns an EC_POINT from `group`, and encoded (bigendian string |
| // representation of BIGNUMs) point coordinates `pubx`, `puby`. |
| util::StatusOr<SslUniquePtr<EC_POINT>> SslGetEcPointFromCoordinates( |
| const EC_GROUP *group, absl::string_view pubx, absl::string_view puby) { |
| util::StatusOr<SslUniquePtr<BIGNUM>> bn_x = StringToBignum(pubx); |
| if (!bn_x.ok()) { |
| return bn_x.status(); |
| } |
| util::StatusOr<SslUniquePtr<BIGNUM>> bn_y = StringToBignum(puby); |
| if (!bn_y.ok()) { |
| return bn_y.status(); |
| } |
| SslUniquePtr<EC_POINT> pub_key(EC_POINT_new(group)); |
| // In BoringSSL and OpenSSL > 1.1.0 EC_POINT_set_affine_coordinates_GFp |
| // already checkes if the point is on the curve. |
| if (EC_POINT_set_affine_coordinates_GFp(group, pub_key.get(), bn_x->get(), |
| bn_y->get(), nullptr) != 1) { |
| return util::Status(absl::StatusCode::kInternal, |
| "EC_POINT_set_affine_coordinates_GFp failed"); |
| } |
| return std::move(pub_key); |
| } |
| |
| // Returns an EC_POINT from an `encoded` point with format `format` and curve |
| // type `curve`. `format` is either COMPRESSED or UNCOMPRESSED. |
| util::StatusOr<SslUniquePtr<EC_POINT>> SslGetEcPointFromEncoded( |
| EllipticCurveType curve, EcPointFormat format, absl::string_view encoded) { |
| if (format != EcPointFormat::UNCOMPRESSED && |
| format != EcPointFormat::COMPRESSED) { |
| return util::Status( |
| absl::StatusCode::kInvalidArgument, |
| absl::StrCat("Invalid format ", subtle::EnumToString(format))); |
| } |
| util::StatusOr<SslUniquePtr<EC_GROUP>> group = EcGroupFromCurveType(curve); |
| if (!group.ok()) { |
| return group.status(); |
| } |
| |
| util::StatusOr<int32_t> encoding_size = |
| EcPointEncodingSizeInBytes(curve, format); |
| if (!encoding_size.ok()) { |
| return encoding_size.status(); |
| } |
| if (encoded.size() != *encoding_size) { |
| return util::Status(absl::StatusCode::kInternal, |
| absl::StrCat("Encoded point's size is ", encoded.size(), |
| " bytes; expected ", *encoding_size)); |
| } |
| |
| // Check starting byte. |
| if (format == EcPointFormat::UNCOMPRESSED && |
| static_cast<int>(encoded[0]) != 0x04) { |
| return util::Status( |
| absl::StatusCode::kInternal, |
| "Uncompressed point should start with 0x04, but input doesn't"); |
| } else if (format == EcPointFormat::COMPRESSED && |
| static_cast<int>(encoded[0]) != 0x03 && |
| static_cast<int>(encoded[0]) != 0x02) { |
| return util::Status(absl::StatusCode::kInternal, |
| "Compressed point should start with either 0x02 or " |
| "0x03, but input doesn't"); |
| } |
| |
| SslUniquePtr<EC_POINT> point(EC_POINT_new(group->get())); |
| if (EC_POINT_oct2point(group->get(), point.get(), |
| reinterpret_cast<const uint8_t *>(encoded.data()), |
| encoded.size(), nullptr) != 1) { |
| return util::Status(absl::StatusCode::kInternal, |
| "EC_POINT_toc2point failed"); |
| } |
| // Check that point is on curve. |
| if (EC_POINT_is_on_curve(group->get(), point.get(), nullptr) != 1) { |
| return util::Status(absl::StatusCode::kInternal, "Point is not on curve"); |
| } |
| |
| return std::move(point); |
| } |
| |
| // OpenSSL/BoringSSL's EC_POINT as a pair of BIGNUMs. |
| struct EcPointCoordinates { |
| SslUniquePtr<BIGNUM> x; |
| SslUniquePtr<BIGNUM> y; |
| }; |
| |
| // Returns a given `point` as a pair of BIGNUMs. Precondition: `group` and |
| // `point` are not null. |
| util::StatusOr<EcPointCoordinates> SslGetEcPointCoordinates( |
| const EC_GROUP *group, const EC_POINT *point) { |
| EcPointCoordinates coordinates = { |
| SslUniquePtr<BIGNUM>(BN_new()), |
| SslUniquePtr<BIGNUM>(BN_new()), |
| }; |
| if (coordinates.x == nullptr || coordinates.y == nullptr) { |
| return util::Status(absl::StatusCode::kInternal, |
| "Unable to allocate memory for the point coordinates"); |
| } |
| if (EC_POINT_get_affine_coordinates_GFp(group, point, coordinates.x.get(), |
| coordinates.y.get(), nullptr) != 1) { |
| return util::Status(absl::StatusCode::kInternal, |
| "EC_POINT_get_affine_coordinates_GFp failed"); |
| } |
| return std::move(coordinates); |
| } |
| |
| size_t ScalarSizeInBytes(const EC_GROUP *group) { |
| return BN_num_bytes(EC_GROUP_get0_order(group)); |
| } |
| |
| size_t SslEcFieldSizeInBytes(const EC_GROUP *group) { |
| unsigned degree_bits = EC_GROUP_get_degree(group); |
| return (degree_bits + 7) / 8; |
| } |
| |
| // Given an OpenSSL/BoringSSL key EC_KEY `key` and curve type `curve` return an |
| // EcKey. |
| util::StatusOr<EcKey> EcKeyFromSslEcKey(EllipticCurveType curve, |
| const EC_KEY &key) { |
| util::StatusOr<SslUniquePtr<EC_GROUP>> group = EcGroupFromCurveType(curve); |
| if (!group.ok()) { |
| return group.status(); |
| } |
| const BIGNUM *priv_key = EC_KEY_get0_private_key(&key); |
| const EC_POINT *pub_key = EC_KEY_get0_public_key(&key); |
| |
| util::StatusOr<EcPointCoordinates> pub_key_bns = |
| SslGetEcPointCoordinates(group->get(), pub_key); |
| if (!pub_key_bns.ok()) { |
| return pub_key_bns.status(); |
| } |
| |
| const int kFieldElementSizeInBytes = SslEcFieldSizeInBytes(group->get()); |
| |
| util::StatusOr<std::string> pub_x_str = |
| BignumToString(pub_key_bns->x.get(), kFieldElementSizeInBytes); |
| if (!pub_x_str.ok()) { |
| return pub_x_str.status(); |
| } |
| util::StatusOr<std::string> pub_y_str = |
| BignumToString(pub_key_bns->y.get(), kFieldElementSizeInBytes); |
| if (!pub_y_str.ok()) { |
| return pub_y_str.status(); |
| } |
| util::StatusOr<util::SecretData> priv_key_data = |
| BignumToSecretData(priv_key, ScalarSizeInBytes(group->get())); |
| if (!priv_key_data.ok()) { |
| return priv_key_data.status(); |
| } |
| EcKey ec_key = { |
| /*curve=*/curve, |
| /*pub_x=*/*std::move(pub_x_str), |
| /*pub_y=*/*std::move(pub_y_str), |
| /*priv=*/*std::move(priv_key_data), |
| }; |
| return ec_key; |
| } |
| |
| enum SslEvpPkeyType { |
| kX25519Key = EVP_PKEY_X25519, |
| kEd25519Key = EVP_PKEY_ED25519 |
| }; |
| |
| // Returns a new EVP_PKEY key from the given `key_type`. |
| util::StatusOr<SslUniquePtr<EVP_PKEY>> SslNewEvpKey(SslEvpPkeyType key_type) { |
| EVP_PKEY *private_key = nullptr; |
| SslUniquePtr<EVP_PKEY_CTX> pctx(EVP_PKEY_CTX_new_id(key_type, /*e=*/nullptr)); |
| if (pctx == nullptr) { |
| return util::Status( |
| absl::StatusCode::kInternal, |
| absl::StrCat("EVP_PKEY_CTX_new_id failed for id ", key_type)); |
| } |
| |
| if (EVP_PKEY_keygen_init(pctx.get()) != 1) { |
| return util::Status(absl::StatusCode::kInternal, |
| "EVP_PKEY_keygen_init failed"); |
| } |
| if (EVP_PKEY_keygen(pctx.get(), &private_key) != 1) { |
| return util::Status(absl::StatusCode::kInternal, "EVP_PKEY_keygen failed"); |
| } |
| return {SslUniquePtr<EVP_PKEY>(private_key)}; |
| } |
| |
| // Given a private EVP_PKEY `evp_key` of key type `key_type` fills `priv_key` |
| // and `pub_key` with raw private and public keys, respectively. |
| util::Status SslNewKeyPairFromEcKey(SslEvpPkeyType key_type, |
| const EVP_PKEY &evp_key, |
| absl::Span<uint8_t> priv_key, |
| absl::Span<uint8_t> pub_key) { |
| size_t len = priv_key.size(); |
| if (EVP_PKEY_get_raw_private_key(&evp_key, priv_key.data(), &len) != 1) { |
| return util::Status(absl::StatusCode::kInternal, |
| "EVP_PKEY_get_raw_private_key failed"); |
| } |
| if (len != priv_key.size()) { |
| return util::Status(absl::StatusCode::kInternal, |
| absl::StrCat("Invalid private key size; expected ", |
| priv_key.size(), " got ", len)); |
| } |
| |
| len = pub_key.size(); |
| if (EVP_PKEY_get_raw_public_key(&evp_key, pub_key.data(), &len) != 1) { |
| return util::Status(absl::StatusCode::kInternal, |
| "EVP_PKEY_get_raw_public_key failed"); |
| } |
| if (len != pub_key.size()) { |
| return util::Status(absl::StatusCode::kInternal, |
| absl::StrCat("Invalid public key size; expected ", |
| pub_key.size(), " got ", len)); |
| } |
| |
| return util::OkStatus(); |
| } |
| |
| util::StatusOr<std::string> SslEcdsaSignatureToBytes( |
| const ECDSA_SIG *ecdsa_signature) { |
| if (ecdsa_signature == nullptr) { |
| return util::Status(absl::StatusCode::kInvalidArgument, |
| "ECDSA signature is null"); |
| } |
| uint8_t *der = nullptr; |
| int der_len = i2d_ECDSA_SIG(ecdsa_signature, &der); |
| if (der_len <= 0) { |
| return util::Status(absl::StatusCode::kInternal, "i2d_ECDSA_SIG failed"); |
| } |
| auto result = std::string(reinterpret_cast<char *>(der), der_len); |
| OPENSSL_free(der); |
| return result; |
| } |
| |
| } // namespace |
| |
| util::StatusOr<int32_t> EcFieldSizeInBytes(EllipticCurveType curve_type) { |
| if (curve_type == EllipticCurveType::CURVE25519) { |
| return 32; |
| } |
| util::StatusOr<SslUniquePtr<EC_GROUP>> ec_group = |
| EcGroupFromCurveType(curve_type); |
| if (!ec_group.ok()) { |
| return ec_group.status(); |
| } |
| return SslEcFieldSizeInBytes(ec_group->get()); |
| } |
| |
| util::StatusOr<int32_t> EcPointEncodingSizeInBytes(EllipticCurveType curve_type, |
| EcPointFormat point_format) { |
| util::StatusOr<int32_t> coordinate_size = EcFieldSizeInBytes(curve_type); |
| if (!coordinate_size.ok()) { |
| return coordinate_size.status(); |
| } |
| if (curve_type == EllipticCurveType::CURVE25519) { |
| return coordinate_size; |
| } |
| if (*coordinate_size == 0) { |
| return util::Status(absl::StatusCode::kInvalidArgument, |
| absl::StrCat("Unsupported elliptic curve type: ", |
| EnumToString(curve_type))); |
| } |
| switch (point_format) { |
| case EcPointFormat::UNCOMPRESSED: |
| return 2 * (*coordinate_size) + 1; |
| case EcPointFormat::COMPRESSED: |
| return (*coordinate_size) + 1; |
| case EcPointFormat::DO_NOT_USE_CRUNCHY_UNCOMPRESSED: |
| return 2 * (*coordinate_size); |
| default: |
| return util::Status( |
| absl::StatusCode::kInvalidArgument, |
| absl::StrCat("Unsupported elliptic curve point format: ", |
| EnumToString(point_format))); |
| } |
| } |
| |
| util::StatusOr<EcKey> NewEcKey(EllipticCurveType curve_type) { |
| if (curve_type == EllipticCurveType::CURVE25519) { |
| util::StatusOr<std::unique_ptr<X25519Key>> key = NewX25519Key(); |
| if (!key.ok()) { |
| return key.status(); |
| } |
| return EcKeyFromX25519Key(key->get()); |
| } |
| util::StatusOr<SslUniquePtr<EC_GROUP>> group = |
| EcGroupFromCurveType(curve_type); |
| if (!group.ok()) { |
| return group.status(); |
| } |
| SslUniquePtr<EC_KEY> key(EC_KEY_new()); |
| |
| if (key.get() == nullptr) { |
| return util::Status(absl::StatusCode::kInternal, "EC_KEY_new failed"); |
| } |
| EC_KEY_set_group(key.get(), group->get()); |
| EC_KEY_generate_key(key.get()); |
| return EcKeyFromSslEcKey(curve_type, *key); |
| } |
| |
| util::StatusOr<EcKey> NewEcKey(EllipticCurveType curve_type, |
| const util::SecretData &secret_seed) { |
| // EC_KEY_derive_from_secret() is neither defined in the version of BoringSSL |
| // used when FIPS-only mode is enabled at compile time, nor currently |
| // implemented for OpenSSL. |
| #if defined(TINK_USE_ONLY_FIPS) |
| return util::Status( |
| absl::StatusCode::kUnimplemented, |
| "Deriving EC keys from a secret seed is not allowed in FIPS mode"); |
| #elif !defined(OPENSSL_IS_BORINGSSL) |
| return util::Status( |
| absl::StatusCode::kUnimplemented, |
| "Deriving EC keys from a secret seed is not supported with OpenSSL"); |
| #else |
| if (IsFipsModeEnabled()) { |
| return util::Status( |
| absl::StatusCode::kInternal, |
| "Deriving EC keys from a secret seed is not allowed in FIPS mode"); |
| } |
| if (curve_type == EllipticCurveType::CURVE25519) { |
| return util::Status( |
| absl::StatusCode::kInternal, |
| "Creating a X25519 key from a secret seed is not supported"); |
| } |
| util::StatusOr<SslUniquePtr<EC_GROUP>> group = |
| EcGroupFromCurveType(curve_type); |
| if (!group.ok()) { |
| return group.status(); |
| } |
| SslUniquePtr<EC_KEY> key(EC_KEY_derive_from_secret( |
| group->get(), secret_seed.data(), secret_seed.size())); |
| if (key.get() == nullptr) { |
| return util::Status(absl::StatusCode::kInternal, |
| "EC_KEY_derive_from_secret failed"); |
| } |
| return EcKeyFromSslEcKey(curve_type, *key); |
| #endif |
| } |
| |
| util::StatusOr<std::unique_ptr<X25519Key>> NewX25519Key() { |
| util::StatusOr<SslUniquePtr<EVP_PKEY>> private_key = |
| SslNewEvpKey(SslEvpPkeyType::kX25519Key); |
| if (!private_key.ok()) { |
| return private_key.status(); |
| } |
| |
| auto key = absl::make_unique<X25519Key>(); |
| util::Status res = SslNewKeyPairFromEcKey( |
| SslEvpPkeyType::kX25519Key, **private_key, |
| absl::MakeSpan(key->private_key, X25519KeyPrivKeySize()), |
| absl::MakeSpan(key->public_value, X25519KeyPubKeySize())); |
| if (!res.ok()) { |
| return res; |
| } |
| return std::move(key); |
| } |
| |
| EcKey EcKeyFromX25519Key(const X25519Key *x25519_key) { |
| EcKey ec_key; |
| ec_key.curve = subtle::EllipticCurveType::CURVE25519; |
| // Curve25519 public key is x, not (x,y). |
| ec_key.pub_x = |
| std::string(reinterpret_cast<const char *>(x25519_key->public_value), |
| X25519KeyPubKeySize()); |
| ec_key.priv = util::SecretData(std::begin(x25519_key->private_key), |
| std::end(x25519_key->private_key)); |
| return ec_key; |
| } |
| |
| util::StatusOr<std::unique_ptr<Ed25519Key>> NewEd25519Key() { |
| util::SecretData seed = |
| subtle::Random::GetRandomKeyBytes(Ed25519KeyPrivKeySize()); |
| return NewEd25519Key(seed); |
| } |
| |
| util::StatusOr<std::unique_ptr<Ed25519Key>> NewEd25519Key( |
| const util::SecretData &secret_seed) { |
| if (secret_seed.size() != Ed25519KeyPrivKeySize()) { |
| return util::Status( |
| absl::StatusCode::kInvalidArgument, |
| absl::StrCat("Invalid seed of length ", secret_seed.size(), |
| "; expected ", Ed25519KeyPrivKeySize())); |
| } |
| |
| // In BoringSSL this calls ED25519_keypair_from_seed. Accessing the public key |
| // with EVP_PKEY_get_raw_public_key returns the last 32 bytes of the private |
| // key stored by BoringSSL. |
| SslUniquePtr<EVP_PKEY> priv_key(EVP_PKEY_new_raw_private_key( |
| SslEvpPkeyType::kEd25519Key, nullptr, secret_seed.data(), |
| Ed25519KeyPrivKeySize())); |
| if (priv_key == nullptr) { |
| return util::Status(absl::StatusCode::kInternal, |
| "EVP_PKEY_new_raw_private_key failed"); |
| } |
| |
| auto key = absl::make_unique<Ed25519Key>(); |
| subtle::ResizeStringUninitialized(&key->private_key, Ed25519KeyPrivKeySize()); |
| subtle::ResizeStringUninitialized(&key->public_key, Ed25519KeyPubKeySize()); |
| uint8_t *priv_key_ptr = reinterpret_cast<uint8_t *>(&key->private_key[0]); |
| uint8_t *pub_key_ptr = reinterpret_cast<uint8_t *>(&key->public_key[0]); |
| // The EVP_PKEY interface returns only the first 32 bytes of the private key. |
| util::Status res = SslNewKeyPairFromEcKey( |
| SslEvpPkeyType::kEd25519Key, *priv_key, |
| absl::MakeSpan(priv_key_ptr, Ed25519KeyPrivKeySize()), |
| absl::MakeSpan(pub_key_ptr, Ed25519KeyPubKeySize())); |
| if (!res.ok()) { |
| return res; |
| } |
| return std::move(key); |
| } |
| |
| util::StatusOr<std::unique_ptr<X25519Key>> X25519KeyFromEcKey( |
| const EcKey &ec_key) { |
| auto x25519_key = absl::make_unique<X25519Key>(); |
| if (ec_key.curve != subtle::EllipticCurveType::CURVE25519) { |
| return util::Status(absl::StatusCode::kInvalidArgument, |
| "This key is not on curve 25519"); |
| } |
| if (!ec_key.pub_y.empty()) { |
| return util::Status(absl::StatusCode::kInvalidArgument, |
| "Invalid X25519 key. pub_y is unexpectedly set."); |
| } |
| // Curve25519 public key is x, not (x,y). |
| std::copy_n(ec_key.pub_x.begin(), X25519KeyPubKeySize(), |
| std::begin(x25519_key->public_value)); |
| std::copy_n(ec_key.priv.begin(), X25519KeyPrivKeySize(), |
| std::begin(x25519_key->private_key)); |
| return std::move(x25519_key); |
| } |
| |
| util::StatusOr<util::SecretData> ComputeX25519SharedSecret( |
| EVP_PKEY *private_key, EVP_PKEY *peer_public_key) { |
| // Make sure the keys are actually X25519 keys. |
| if (EVP_PKEY_id(private_key) != SslEvpPkeyType::kX25519Key) { |
| return util::Status(absl::StatusCode::kInvalidArgument, |
| "Invalid type for private key"); |
| } |
| if (EVP_PKEY_id(peer_public_key) != SslEvpPkeyType::kX25519Key) { |
| return util::Status(absl::StatusCode::kInvalidArgument, |
| "Invalid type for peer's public key"); |
| } |
| |
| internal::SslUniquePtr<EVP_PKEY_CTX> pctx( |
| EVP_PKEY_CTX_new(private_key, nullptr)); |
| util::SecretData shared_secret(internal::X25519KeySharedKeySize()); |
| size_t out_key_length = shared_secret.size(); |
| if (EVP_PKEY_derive_init(pctx.get()) <= 0 || |
| EVP_PKEY_derive_set_peer(pctx.get(), peer_public_key) <= 0 || |
| EVP_PKEY_derive(pctx.get(), shared_secret.data(), &out_key_length) <= 0) { |
| return util::Status(absl::StatusCode::kInternal, |
| "Secret generation failed"); |
| } |
| return shared_secret; |
| } |
| |
| util::StatusOr<std::unique_ptr<X25519Key>> X25519KeyFromPrivateKey( |
| const util::SecretData &private_key) { |
| if (private_key.size() != X25519KeyPrivKeySize()) { |
| return util::Status(absl::StatusCode::kInvalidArgument, |
| "Invalid length for private key"); |
| } |
| |
| internal::SslUniquePtr<EVP_PKEY> pkey( |
| EVP_PKEY_new_raw_private_key(SslEvpPkeyType::kX25519Key, nullptr, |
| private_key.data(), private_key.size())); |
| auto key = absl::make_unique<X25519Key>(); |
| util::Status res = SslNewKeyPairFromEcKey( |
| SslEvpPkeyType::kX25519Key, *pkey, |
| absl::MakeSpan(key->private_key, X25519KeyPrivKeySize()), |
| absl::MakeSpan(key->public_value, X25519KeyPubKeySize())); |
| if (!res.ok()) { |
| return res; |
| } |
| return std::move(key); |
| } |
| |
| util::StatusOr<std::string> EcPointEncode(EllipticCurveType curve, |
| EcPointFormat format, |
| const EC_POINT *point) { |
| util::StatusOr<SslUniquePtr<EC_GROUP>> group = EcGroupFromCurveType(curve); |
| if (!group.ok()) { |
| return group.status(); |
| } |
| if (EC_POINT_is_on_curve(group->get(), point, nullptr) != 1) { |
| return util::Status(absl::StatusCode::kInternal, "Point is not on curve"); |
| } |
| switch (format) { |
| case EcPointFormat::UNCOMPRESSED: { |
| return SslEcPointEncode(group->get(), point, |
| POINT_CONVERSION_UNCOMPRESSED); |
| } |
| case EcPointFormat::COMPRESSED: { |
| return SslEcPointEncode(group->get(), point, POINT_CONVERSION_COMPRESSED); |
| } |
| case EcPointFormat::DO_NOT_USE_CRUNCHY_UNCOMPRESSED: { |
| util::StatusOr<EcPointCoordinates> ec_point_xy = |
| SslGetEcPointCoordinates(group->get(), point); |
| if (!ec_point_xy.ok()) { |
| return ec_point_xy.status(); |
| } |
| const int kCurveSizeInBytes = SslEcFieldSizeInBytes(group->get()); |
| std::string encoded_point; |
| subtle::ResizeStringUninitialized(&encoded_point, 2 * kCurveSizeInBytes); |
| util::Status res = BignumToBinaryPadded( |
| absl::MakeSpan(&encoded_point[0], kCurveSizeInBytes), |
| ec_point_xy->x.get()); |
| if (!res.ok()) { |
| return util::Status( |
| absl::StatusCode::kInternal, |
| absl::StrCat(res.message(), " serializing the x coordinate")); |
| } |
| |
| res = BignumToBinaryPadded( |
| absl::MakeSpan(&encoded_point[kCurveSizeInBytes], kCurveSizeInBytes), |
| ec_point_xy->y.get()); |
| if (!res.ok()) { |
| return util::Status( |
| absl::StatusCode::kInternal, |
| absl::StrCat(res.message(), " serializing the y coordinate")); |
| } |
| return encoded_point; |
| } |
| default: |
| return util::Status(absl::StatusCode::kInternal, |
| "Unsupported point format"); |
| } |
| } |
| |
| util::StatusOr<SslUniquePtr<EC_POINT>> EcPointDecode( |
| EllipticCurveType curve, EcPointFormat format, absl::string_view encoded) { |
| switch (format) { |
| case EcPointFormat::UNCOMPRESSED: |
| case EcPointFormat::COMPRESSED: |
| return SslGetEcPointFromEncoded(curve, format, encoded); |
| case EcPointFormat::DO_NOT_USE_CRUNCHY_UNCOMPRESSED: { |
| util::StatusOr<SslUniquePtr<EC_GROUP>> group = |
| EcGroupFromCurveType(curve); |
| if (!group.ok()) { |
| return group.status(); |
| } |
| const int kCurveSizeInBytes = SslEcFieldSizeInBytes(group->get()); |
| if (encoded.size() != 2 * kCurveSizeInBytes) { |
| return util::Status( |
| absl::StatusCode::kInternal, |
| absl::StrCat("Encoded point's size is ", encoded.size(), |
| " bytes; expected ", 2 * kCurveSizeInBytes)); |
| } |
| // SslGetEcPoint already checks if the point is on curve so we can return |
| // directly. |
| return SslGetEcPointFromCoordinates(group->get(), |
| encoded.substr(0, kCurveSizeInBytes), |
| encoded.substr(kCurveSizeInBytes)); |
| } |
| default: |
| return util::Status(absl::StatusCode::kInternal, "Unsupported format"); |
| } |
| } |
| |
| util::StatusOr<SslUniquePtr<EC_GROUP>> EcGroupFromCurveType( |
| EllipticCurveType curve_type) { |
| EC_GROUP *ec_group = nullptr; |
| switch (curve_type) { |
| case EllipticCurveType::NIST_P256: { |
| ec_group = EC_GROUP_new_by_curve_name(NID_X9_62_prime256v1); |
| break; |
| } |
| case EllipticCurveType::NIST_P384: { |
| ec_group = EC_GROUP_new_by_curve_name(NID_secp384r1); |
| break; |
| } |
| case EllipticCurveType::NIST_P521: { |
| ec_group = EC_GROUP_new_by_curve_name(NID_secp521r1); |
| break; |
| } |
| default: |
| return util::Status(absl::StatusCode::kUnimplemented, |
| "Unsupported elliptic curve"); |
| } |
| if (ec_group == nullptr) { |
| return util::Status(absl::StatusCode::kInternal, |
| "EC_GROUP_new_by_curve_name failed"); |
| } |
| return {SslUniquePtr<EC_GROUP>(ec_group)}; |
| } |
| |
| util::StatusOr<EllipticCurveType> CurveTypeFromEcGroup(const EC_GROUP *group) { |
| if (group == nullptr) { |
| return util::Status(absl::StatusCode::kInvalidArgument, |
| "Null group provided"); |
| } |
| switch (EC_GROUP_get_curve_name(group)) { |
| case NID_X9_62_prime256v1: |
| return EllipticCurveType::NIST_P256; |
| case NID_secp384r1: |
| return EllipticCurveType::NIST_P384; |
| case NID_secp521r1: |
| return EllipticCurveType::NIST_P521; |
| default: |
| return util::Status(absl::StatusCode::kUnimplemented, |
| "Unsupported elliptic curve"); |
| } |
| } |
| |
| util::StatusOr<SslUniquePtr<EC_POINT>> GetEcPoint(EllipticCurveType curve, |
| absl::string_view pubx, |
| absl::string_view puby) { |
| util::StatusOr<SslUniquePtr<EC_GROUP>> group = EcGroupFromCurveType(curve); |
| if (!group.ok()) { |
| return group.status(); |
| } |
| return SslGetEcPointFromCoordinates(group->get(), pubx, puby); |
| } |
| |
| util::StatusOr<util::SecretData> ComputeEcdhSharedSecret( |
| EllipticCurveType curve, const BIGNUM *priv_key, const EC_POINT *pub_key) { |
| util::StatusOr<internal::SslUniquePtr<EC_GROUP>> priv_group = |
| internal::EcGroupFromCurveType(curve); |
| if (!priv_group.ok()) { |
| return priv_group.status(); |
| } |
| if (EC_POINT_is_on_curve(priv_group->get(), pub_key, /*ctx=*/nullptr) != 1) { |
| return util::Status(absl::StatusCode::kInternal, |
| absl::StrCat("Public key is not on curve ", |
| subtle::EnumToString(curve))); |
| } |
| |
| // Compute the shared point and make sure it is on `curve`. |
| internal::SslUniquePtr<EC_POINT> shared_point( |
| EC_POINT_new(priv_group->get())); |
| if (EC_POINT_mul(priv_group->get(), shared_point.get(), /*n=*/nullptr, |
| pub_key, priv_key, /*ctx=*/nullptr) != 1) { |
| return util::Status(absl::StatusCode::kInternal, |
| "Point multiplication failed"); |
| } |
| if (EC_POINT_is_on_curve(priv_group->get(), shared_point.get(), |
| /*ctx=*/nullptr) != 1) { |
| return util::Status(absl::StatusCode::kInternal, |
| absl::StrCat("Shared point is not on curve ", |
| subtle::EnumToString(curve))); |
| } |
| |
| util::StatusOr<EcPointCoordinates> shared_point_coordinates = |
| SslGetEcPointCoordinates(priv_group->get(), shared_point.get()); |
| if (!shared_point_coordinates.ok()) { |
| return shared_point_coordinates.status(); |
| } |
| |
| // We need only the x coordinate. |
| return internal::BignumToSecretData(shared_point_coordinates->x.get(), |
| SslEcFieldSizeInBytes(priv_group->get())); |
| } |
| |
| util::StatusOr<std::string> EcSignatureIeeeToDer(const EC_GROUP *group, |
| absl::string_view ieee_sig) { |
| const size_t kFieldSizeInBytes = SslEcFieldSizeInBytes(group); |
| if (ieee_sig.size() != kFieldSizeInBytes * 2) { |
| return util::Status(absl::StatusCode::kInvalidArgument, |
| "Signature is not valid."); |
| } |
| util::StatusOr<SslUniquePtr<BIGNUM>> r = |
| internal::StringToBignum(ieee_sig.substr(0, kFieldSizeInBytes)); |
| if (!r.ok()) { |
| return r.status(); |
| } |
| util::StatusOr<SslUniquePtr<BIGNUM>> s = |
| internal::StringToBignum(ieee_sig.substr(kFieldSizeInBytes)); |
| if (!s.ok()) { |
| return s.status(); |
| } |
| internal::SslUniquePtr<ECDSA_SIG> ecdsa(ECDSA_SIG_new()); |
| if (ECDSA_SIG_set0(ecdsa.get(), r->get(), s->get()) != 1) { |
| return util::Status(absl::StatusCode::kInternal, "ECDSA_SIG_set0 failed"); |
| } |
| // ECDSA_SIG_set0 takes ownership of s and r's pointers. |
| r->release(); |
| s->release(); |
| |
| return SslEcdsaSignatureToBytes(ecdsa.get()); |
| } |
| |
| } // namespace internal |
| } // namespace tink |
| } // namespace crypto |
