Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 609068 - Implement J-PAKE in FreeBL

Browse Source 
patch by bsmith
r = rrelyea


git-svn-id: svn://10.0.0.236/trunk@261623 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
rrelyea%redhat.com
2010-12-04 18:57:16 +00:00
parent d486ee378a
commit 9f397718df
9 changed files with 823 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files

73
mozilla/security/nss/lib/freebl/blapi.h
View File

@@ -37,7 +37,7 @@
* the terms of any one of the MPL, the GPL or the LGPL.
*
* ***** END LICENSE BLOCK ***** */
/* $Id: blapi.h,v 1.39 2010-11-16 19:08:48 rrelyea%redhat.com Exp $ */
/* $Id: blapi.h,v 1.40 2010-12-04 18:57:16 rrelyea%redhat.com Exp $ */
#ifndef _BLAPI_H_
#define _BLAPI_H_
@@ -145,6 +145,11 @@ extern SECStatus RSA_PopulatePrivateKey(RSAPrivateKey *key);
** DSA signing algorithm
*/
/* Generate a new random value within the interval [2, q-1].
*/
extern SECStatus DSA_NewRandom(PLArenaPool * arena, const SECItem * q,
SECItem * random);
/*
** Generate and return a new DSA public and private key pair,
** both of which are encoded into a single DSAPrivateKey struct.
@@ -235,6 +240,72 @@ extern SECStatus KEA_Derive(SECItem *prime,
*/
extern PRBool KEA_Verify(SECItem *Y, SECItem *prime, SECItem *subPrime);
/****************************************
* J-PAKE key transport
*/
/* Given gx == g^x, create a Schnorr zero-knowledge proof for the value x
* using the specified hash algorithm and signer ID. The signature is
* returned in the values gv and r. testRandom must be NULL for a PRNG
* generated random committment to be used in the sigature. When testRandom
* is non-NULL, that value must contain a value in the subgroup q; that
* value will be used instead of a PRNG-generated committment in order to
* facilitate known-answer tests.
*
* If gxIn is non-NULL then it must contain a pre-computed value of g^x that
* will be used by the function; in this case, the gxOut parameter must be NULL.
* If the gxIn parameter is NULL then gxOut must be non-NULL; in this case
* gxOut will contain the value g^x on output.
*
* gx (if not supplied by the caller), gv, and r will be allocated in the arena.
* The arena is *not* optional so do not pass NULL for the arena parameter.
* The arena should be zeroed when it is freed.
*/
SECStatus
JPAKE_Sign(PLArenaPool * arena, const PQGParams * pqg, HASH_HashType hashType,
const SECItem * signerID, const SECItem * x,
const SECItem * testRandom, const SECItem * gxIn, SECItem * gxOut,
SECItem * gv, SECItem * r);
/* Given gx == g^x, verify the Schnorr zero-knowledge proof (gv, r) for the
* value x using the specified hash algorithm and signer ID.
*
* The arena is *not* optional so do not pass NULL for the arena parameter.
*/
SECStatus
JPAKE_Verify(PRArenaPool * arena, const PQGParams * pqg,
HASH_HashType hashType, const SECItem * signerID,
const SECItem * peerID, const SECItem * gx,
const SECItem * gv, const SECItem * r);
/* Call before round 2 with x2, s, and x2s all non-NULL. This will calculate
* base = g^(x1+x3+x4) (mod p) and x2s = x2*s (mod q). The values to send in
* round 2 (A and the proof of knowledge of x2s) can then be calculated with
* JPAKE_Sign using pqg->base = base and x = x2s.
*
* Call after round 2 with x2, s, and x2s all NULL, and passing (gx1, gx2, gx3)
* instead of (gx1, gx3, gx4). This will calculate base = g^(x1+x2+x3). Then call
* JPAKE_Verify with pqg->base = base and then JPAKE_Final.
*
* base and x2s will be allocated in the arena. The arena is *not* optional so
* do not pass NULL for the arena parameter. The arena should be zeroed when it
* is freed.
*/
SECStatus
JPAKE_Round2(PLArenaPool * arena, const SECItem * p, const SECItem *q,
const SECItem * gx1, const SECItem * gx3, const SECItem * gx4,
SECItem * base, const SECItem * x2, const SECItem * s, SECItem * x2s);
/* K = (B/g^(x2*x4*s))^x2 (mod p)
*
* K will be allocated in the arena. The arena is *not* optional so do not pass
* NULL for the arena parameter. The arena should be zeroed when it is freed.
*/
SECStatus
JPAKE_Final(PLArenaPool * arena, const SECItem * p, const SECItem *q,
const SECItem * x2, const SECItem * gx4, const SECItem * x2s,
const SECItem * B, SECItem * K);
/******************************************************
** Elliptic Curve algorithms
*/

191
mozilla/security/nss/lib/freebl/dsa.c
View File

@@ -35,7 +35,7 @@
* the terms of any one of the MPL, the GPL or the LGPL.
*
* ***** END LICENSE BLOCK ***** */
/* $Id: dsa.c,v 1.20 2009-03-29 16:51:58 wtc%google.com Exp $ */
/* $Id: dsa.c,v 1.21 2010-12-04 18:57:16 rrelyea%redhat.com Exp $ */
#ifdef FREEBL_NO_DEPEND
#include "stubs.h"
@@ -56,21 +56,17 @@
/* XXX to be replaced by define in blapit.h */
#define NSS_FREEBL_DSA_DEFAULT_CHUNKSIZE 2048
#define FIPS_DSA_Q 160
#define QSIZE (FIPS_DSA_Q / PR_BITS_PER_BYTE)
/*
* FIPS 186-2 requires result from random output to be reduced mod q when
* generating random numbers for DSA.
*
* Input: w, 2*QSIZE bytes
* q, DSA_SUBPRIME_LEN bytes
* Output: xj, DSA_SUBPRIME_LEN bytes
* Input: w, 2*qLen bytes
* q, qLen bytes
* Output: xj, qLen bytes
*/
SECStatus
FIPS186Change_ReduceModQForDSA(const PRUint8 *w,
const PRUint8 *q,
PRUint8 *xj)
static SECStatus
fips186Change_ReduceModQForDSA(const PRUint8 *w, const PRUint8 *q,
unsigned int qLen, PRUint8 * xj)
{
mp_int W, Q, Xj;
mp_err err;
@@ -86,15 +82,16 @@ FIPS186Change_ReduceModQForDSA(const PRUint8 *w,
/*
* Convert input arguments into MPI integers.
*/
CHECK_MPI_OK( mp_read_unsigned_octets(&W, w, 2*QSIZE) );
CHECK_MPI_OK( mp_read_unsigned_octets(&Q, q, DSA_SUBPRIME_LEN) );
CHECK_MPI_OK( mp_read_unsigned_octets(&W, w, 2*qLen) );
CHECK_MPI_OK( mp_read_unsigned_octets(&Q, q, qLen) );
/*
* Algorithm 1 of FIPS 186-2 Change Notice 1, Step 3.3
*
* xj = (w0 || w1) mod q
*/
CHECK_MPI_OK( mp_mod(&W, &Q, &Xj) );
CHECK_MPI_OK( mp_to_fixlen_octets(&Xj, xj, DSA_SUBPRIME_LEN) );
CHECK_MPI_OK( mp_to_fixlen_octets(&Xj, xj, qLen) );
cleanup:
mp_clear(&W);
mp_clear(&Q);
@@ -106,6 +103,17 @@ cleanup:
return rv;
}
/*
* FIPS 186-2 requires result from random output to be reduced mod q when
* generating random numbers for DSA.
*/
SECStatus
FIPS186Change_ReduceModQForDSA(const unsigned char *w,
const unsigned char *q,
unsigned char *xj) {
return fips186Change_ReduceModQForDSA(w, q, DSA_SUBPRIME_LEN, xj);
}
/*
* The core of Algorithm 1 of FIPS 186-2 Change Notice 1.
*
@@ -137,24 +145,36 @@ FIPS186Change_GenerateX(PRUint8 *XKEY, const PRUint8 *XSEEDj,
** object. In DSA mode, so there is a q.
*/
static SECStatus
dsa_GenerateGlobalRandomBytes(void *dest, size_t len, const PRUint8 *q)
dsa_GenerateGlobalRandomBytes(const SECItem * qItem, PRUint8 * dest,
unsigned int * destLen, unsigned int maxDestLen)
{
SECStatus rv;
PRUint8 w[2*QSIZE];
SECItem w;
const PRUint8 * q = qItem->data;
unsigned int qLen = qItem->len;
PORT_Assert(q && len == DSA_SUBPRIME_LEN);
if (len != DSA_SUBPRIME_LEN) {
PORT_SetError(SEC_ERROR_OUTPUT_LEN);
return SECFailure;
}
if (*q == 0) {
++q;
--qLen;
}
rv = RNG_GenerateGlobalRandomBytes(w, 2*QSIZE);
if (rv != SECSuccess) {
return rv;
if (maxDestLen < qLen) {
/* This condition can occur when DSA_SignDigest is passed a group
with a subprime that is larger than DSA_SUBPRIME_LEN. */
PORT_SetError(SEC_ERROR_INVALID_ARGS);
return SECFailure;
}
FIPS186Change_ReduceModQForDSA(w, q, (PRUint8 *)dest);
w.data = NULL; /* otherwise SECITEM_AllocItem asserts */
if (!SECITEM_AllocItem(NULL, &w, 2*qLen)) {
return SECFailure;
}
*destLen = qLen;
rv = RNG_GenerateGlobalRandomBytes(w.data, w.len);
if (rv == SECSuccess) {
rv = fips186Change_ReduceModQForDSA(w.data, q, qLen, dest);
}
SECITEM_FreeItem(&w, PR_FALSE);
return rv;
}
@@ -163,9 +183,9 @@ static void translate_mpi_error(mp_err err)
MP_TO_SEC_ERROR(err);
}
SECStatus
dsa_NewKey(const PQGParams *params, DSAPrivateKey **privKey,
const unsigned char *xb)
static SECStatus
dsa_NewKeyExtended(const PQGParams *params, const SECItem * seed,
DSAPrivateKey **privKey)
{
mp_int p, g;
mp_int x, y;
@@ -173,7 +193,7 @@ dsa_NewKey(const PQGParams *params, DSAPrivateKey **privKey,
PRArenaPool *arena;
DSAPrivateKey *key;
/* Check args. */
if (!params || !privKey) {
if (!params || !privKey || !seed || !seed->data) {
PORT_SetError(SEC_ERROR_INVALID_ARGS);
return SECFailure;
}
@@ -208,10 +228,10 @@ dsa_NewKey(const PQGParams *params, DSAPrivateKey **privKey,
/* Convert stored p, g, and received x into MPI integers. */
SECITEM_TO_MPINT(params->prime, &p);
SECITEM_TO_MPINT(params->base, &g);
OCTETS_TO_MPINT(xb, &x, DSA_SUBPRIME_LEN);
OCTETS_TO_MPINT(seed->data, &x, seed->len);
/* Store x in private key */
SECITEM_AllocItem(arena, &key->privateValue, DSA_SUBPRIME_LEN);
memcpy(key->privateValue.data, xb, DSA_SUBPRIME_LEN);
SECITEM_AllocItem(arena, &key->privateValue, seed->len);
PORT_Memcpy(key->privateValue.data, seed->data, seed->len);
/* Compute public key y = g**x mod p */
CHECK_MPI_OK( mp_exptmod(&g, &x, &p, &y) );
/* Store y in public key */
@@ -232,6 +252,53 @@ cleanup:
return SECSuccess;
}
SECStatus
DSA_NewRandom(PLArenaPool * arena, const SECItem * q, SECItem * seed)
{
int retries = 10;
unsigned int i;
PRBool good;
if (q == NULL || q->data == NULL || q->len == 0 ||
(q->data[0] == 0 && q->len == 1)) {
PORT_SetError(SEC_ERROR_INVALID_ARGS);
return SECFailure;
}
if (!SECITEM_AllocItem(arena, seed, q->len)) {
return SECFailure;
}
do {
/* Generate seed bytes for x according to FIPS 186-1 appendix 3 */
if (dsa_GenerateGlobalRandomBytes(q, seed->data, &seed->len,
seed->len)) {
goto loser;
}
/* Disallow values of 0 and 1 for x. */
good = PR_FALSE;
for (i = 0; i < seed->len-1; i++) {
if (seed->data[i] != 0) {
good = PR_TRUE;
break;
}
}
if (!good && seed->data[i] > 1) {
good = PR_TRUE;
}
} while (!good && --retries > 0);
if (!good) {
PORT_SetError(SEC_ERROR_NEED_RANDOM);
loser: if (arena != NULL) {
SECITEM_FreeItem(seed, PR_FALSE);
}
return SECFailure;
}
return SECSuccess;
}
/*
** Generate and return a new DSA public and private key pair,
** both of which are encoded into a single DSAPrivateKey struct.
@@ -241,37 +308,21 @@ cleanup:
SECStatus
DSA_NewKey(const PQGParams *params, DSAPrivateKey **privKey)
{
SECItem seed;
SECStatus rv;
unsigned char seed[DSA_SUBPRIME_LEN];
int retries = 10;
int i;
PRBool good;
do {
/* Generate seed bytes for x according to FIPS 186-1 appendix 3 */
if (dsa_GenerateGlobalRandomBytes(seed, DSA_SUBPRIME_LEN,
params->subPrime.data))
return SECFailure;
/* Disallow values of 0 and 1 for x. */
good = PR_FALSE;
for (i = 0; i < DSA_SUBPRIME_LEN-1; i++) {
if (seed[i] != 0) {
good = PR_TRUE;
break;
}
}
if (!good && seed[i] > 1) {
good = PR_TRUE;
}
} while (!good && --retries > 0);
seed.data = NULL;
if (!good) {
PORT_SetError(SEC_ERROR_NEED_RANDOM);
return SECFailure;
rv = DSA_NewRandom(NULL, &params->subPrime, &seed);
if (rv == SECSuccess) {
if (seed.len != DSA_SUBPRIME_LEN) {
PORT_SetError(SEC_ERROR_INVALID_ARGS);
rv = SECFailure;
} else {
rv = dsa_NewKeyExtended(params, &seed, privKey);
}
}
/* Generate a new DSA key using random seed. */
rv = dsa_NewKey(params, privKey, seed);
SECITEM_FreeItem(&seed, PR_FALSE);
return rv;
}
@@ -281,9 +332,11 @@ DSA_NewKeyFromSeed(const PQGParams *params,
const unsigned char *seed,
DSAPrivateKey **privKey)
{
SECStatus rv;
rv = dsa_NewKey(params, privKey, seed);
return rv;
/* TODO: check Q size */
SECItem seedItem;
seedItem.data = (unsigned char*) seed;
seedItem.len = DSA_SUBPRIME_LEN;
return dsa_NewKeyExtended(params, &seedItem, privKey);
}
static SECStatus
@@ -393,18 +446,24 @@ DSA_SignDigest(DSAPrivateKey *key, SECItem *signature, const SECItem *digest)
SECStatus rv;
int retries = 10;
unsigned char kSeed[DSA_SUBPRIME_LEN];
int i;
unsigned int kSeedLen = 0;
unsigned int i;
PRBool good;
PORT_SetError(0);
do {
rv = dsa_GenerateGlobalRandomBytes(kSeed, DSA_SUBPRIME_LEN,
key->params.subPrime.data);
rv = dsa_GenerateGlobalRandomBytes(&key->params.subPrime,
kSeed, &kSeedLen, sizeof kSeed);
if (rv != SECSuccess)
break;
if (kSeedLen != DSA_SUBPRIME_LEN) {
PORT_SetError(SEC_ERROR_INVALID_ARGS);
rv = SECFailure;
break;
}
/* Disallow a value of 0 for k. */
good = PR_FALSE;
for (i = 0; i < DSA_SUBPRIME_LEN; i++) {
for (i = 0; i < kSeedLen; i++) {
if (kSeed[i] != 0) {
good = PR_TRUE;
break;

525
mozilla/security/nss/lib/freebl/jpake.c Normal file
View File

@@ -0,0 +1,525 @@
/* ***** BEGIN LICENSE BLOCK *****
* Version: MPL 1.1/GPL 2.0/LGPL 2.1
*
* The contents of this file are subject to the Mozilla Public License Version
* 1.1 (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
* http://www.mozilla.org/MPL/
*
* Software distributed under the License is distributed on an "AS IS" basis,
* WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
* for the specific language governing rights and limitations under the
* License.
*
* The Original Code is the Netscape security libraries.
*
* The Initial Developer of the Original Code is Mozilla Fonudation.
* Portions created by the Initial Developer are Copyright (C) 2010
* the Initial Developer. All Rights Reserved.
*
* Contributor(s):
*
* Alternatively, the contents of this file may be used under the terms of
* either the GNU General Public License Version 2 or later (the "GPL"), or
* the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
* in which case the provisions of the GPL or the LGPL are applicable instead
* of those above. If you wish to allow use of your version of this file only
* under the terms of either the GPL or the LGPL, and not to allow others to
* use your version of this file under the terms of the MPL, indicate your
* decision by deleting the provisions above and replace them with the notice
* and other provisions required by the GPL or the LGPL. If you do not delete
* the provisions above, a recipient may use your version of this file under
* the terms of any one of the MPL, the GPL or the LGPL.
*
* ***** END LICENSE BLOCK ***** */
#ifdef FREEBL_NO_DEPEND
#include "stubs.h"
#endif
#include "blapi.h"
#include "secerr.h"
#include "secitem.h"
#include "secmpi.h"
/* Hash an item's length and then its value. Only items smaller than 2^16 bytes
* are allowed. Lengths are hashed in network byte order. This is designed
* to match the OpenSSL J-PAKE implementation.
*/
static mp_err
hashSECItem(HASHContext * hash, const SECItem * it)
{
unsigned char length[2];
if (it->len > 0xffff)
return MP_BADARG;
length[0] = (unsigned char) (it->len >> 8);
length[1] = (unsigned char) (it->len);
hash->hashobj->update(hash->hash_context, length, 2);
hash->hashobj->update(hash->hash_context, it->data, it->len);
return MP_OKAY;
}
/* Hash all public components of the signature, each prefixed with its
length, and then convert the hash to an mp_int. */
static mp_err
hashPublicParams(HASH_HashType hashType, const SECItem * g,
const SECItem * gv, const SECItem * gx,
const SECItem * signerID, mp_int * h)
{
mp_err err;
unsigned char hBuf[HASH_LENGTH_MAX];
SECItem hItem;
HASHContext hash;
hash.hashobj = HASH_GetRawHashObject(hashType);
if (hash.hashobj == NULL || hash.hashobj->length > sizeof hBuf) {
return MP_BADARG;
}
hash.hash_context = hash.hashobj->create();
if (hash.hash_context == NULL) {
return MP_MEM;
}
hItem.data = hBuf;
hItem.len = hash.hashobj->length;
hash.hashobj->begin(hash.hash_context);
CHECK_MPI_OK( hashSECItem(&hash, g) );
CHECK_MPI_OK( hashSECItem(&hash, gv) );
CHECK_MPI_OK( hashSECItem(&hash, gx) );
CHECK_MPI_OK( hashSECItem(&hash, signerID) );
hash.hashobj->end(hash.hash_context, hItem.data, &hItem.len,
sizeof hBuf);
SECITEM_TO_MPINT(hItem, h);
cleanup:
if (hash.hash_context != NULL) {
hash.hashobj->destroy(hash.hash_context, PR_TRUE);
}
return err;
}
/* Generate a Schnorr signature for round 1 or round 2 */
SECStatus
JPAKE_Sign(PLArenaPool * arena, const PQGParams * pqg, HASH_HashType hashType,
const SECItem * signerID, const SECItem * x,
const SECItem * testRandom, const SECItem * gxIn, SECItem * gxOut,
SECItem * gv, SECItem * r)
{
SECStatus rv = SECSuccess;
mp_err err;
mp_int p;
mp_int q;
mp_int g;
mp_int X;
mp_int GX;
mp_int V;
mp_int GV;
mp_int h;
mp_int tmp;
mp_int R;
SECItem v;
if (!arena ||
!pqg || !pqg->prime.data || pqg->prime.len == 0 ||
!pqg->subPrime.data || pqg->subPrime.len == 0 ||
!pqg->base.data || pqg->base.len == 0 ||
!signerID || !signerID->data || signerID->len == 0 ||
!x || !x->data || x->len == 0 ||
(testRandom && (!testRandom->data || testRandom->len == 0)) ||
(gxIn == NULL && (!gxOut || gxOut->data != NULL)) ||
(gxIn != NULL && (!gxIn->data || gxIn->len == 0 || gxOut != NULL)) ||
!gv || gv->data != NULL ||
!r || r->data != NULL) {
PORT_SetError(SEC_ERROR_INVALID_ARGS);
return SECFailure;
}
MP_DIGITS(&p) = 0;
MP_DIGITS(&q) = 0;
MP_DIGITS(&g) = 0;
MP_DIGITS(&X) = 0;
MP_DIGITS(&GX) = 0;
MP_DIGITS(&V) = 0;
MP_DIGITS(&GV) = 0;
MP_DIGITS(&h) = 0;
MP_DIGITS(&tmp) = 0;
MP_DIGITS(&R) = 0;
CHECK_MPI_OK( mp_init(&p) );
CHECK_MPI_OK( mp_init(&q) );
CHECK_MPI_OK( mp_init(&g) );
CHECK_MPI_OK( mp_init(&X) );
CHECK_MPI_OK( mp_init(&GX) );
CHECK_MPI_OK( mp_init(&V) );
CHECK_MPI_OK( mp_init(&GV) );
CHECK_MPI_OK( mp_init(&h) );
CHECK_MPI_OK( mp_init(&tmp) );
CHECK_MPI_OK( mp_init(&R) );
SECITEM_TO_MPINT(pqg->prime, &p);
SECITEM_TO_MPINT(pqg->subPrime, &q);
SECITEM_TO_MPINT(pqg->base, &g);
SECITEM_TO_MPINT(*x, &X);
/* gx = g^x */
if (gxIn == NULL) {
CHECK_MPI_OK( mp_exptmod(&g, &X, &p, &GX) );
MPINT_TO_SECITEM(&GX, gxOut, arena);
gxIn = gxOut;
} else {
SECITEM_TO_MPINT(*gxIn, &GX);
}
/* v is a random value in the q subgroup */
if (testRandom == NULL) {
v.data = NULL;
rv = DSA_NewRandom(arena, &pqg->subPrime, &v);
if (rv != SECSuccess) {
goto cleanup;
}
} else {
v.data = testRandom->data;
v.len = testRandom->len;
}
SECITEM_TO_MPINT(v, &V);
/* gv = g^v (mod q), random v, 1 <= v < q */
CHECK_MPI_OK( mp_exptmod(&g, &V, &p, &GV) );
MPINT_TO_SECITEM(&GV, gv, arena);
/* h = H(g, gv, gx, signerID) */
CHECK_MPI_OK( hashPublicParams(hashType, &pqg->base, gv, gxIn, signerID,
&h) );
/* r = v - x*h (mod q) */
CHECK_MPI_OK( mp_mulmod(&X, &h, &q, &tmp) );
CHECK_MPI_OK( mp_submod(&V, &tmp, &q, &R) );
MPINT_TO_SECITEM(&R, r, arena);
cleanup:
mp_clear(&p);
mp_clear(&q);
mp_clear(&g);
mp_clear(&X);
mp_clear(&GX);
mp_clear(&V);
mp_clear(&GV);
mp_clear(&h);
mp_clear(&tmp);
mp_clear(&R);
if (rv == SECSuccess && err != MP_OKAY) {
MP_TO_SEC_ERROR(err);
rv = SECFailure;
}
return rv;
}
/* Verify a Schnorr signature generated by the peer in round 1 or round 2. */
SECStatus
JPAKE_Verify(PRArenaPool * arena, const PQGParams * pqg, HASH_HashType hashType,
const SECItem * signerID, const SECItem * peerID,
const SECItem * gx, const SECItem * gv, const SECItem * r)
{
SECStatus rv = SECSuccess;
mp_err err;
mp_int p;
mp_int q;
mp_int g;
mp_int p_minus_1;
mp_int GX;
mp_int h;
mp_int one;
mp_int R;
mp_int gr;
mp_int gxh;
mp_int gr_gxh;
SECItem calculated;
if (!arena ||
!pqg || !pqg->prime.data || pqg->prime.len == 0 ||
!pqg->subPrime.data || pqg->subPrime.len == 0 ||
!pqg->base.data || pqg->base.len == 0 ||
!signerID || !signerID->data || signerID->len == 0 ||
!peerID || !peerID->data || peerID->len == 0 ||
!gx || !gx->data || gx->len == 0 ||
!gv || !gv->data || gv->len == 0 ||
!r || !r->data || r->len == 0 ||
SECITEM_CompareItem(signerID, peerID) == SECEqual) {
PORT_SetError(SEC_ERROR_INVALID_ARGS);
return SECFailure;
}
MP_DIGITS(&p) = 0;
MP_DIGITS(&q) = 0;
MP_DIGITS(&g) = 0;
MP_DIGITS(&p_minus_1) = 0;
MP_DIGITS(&GX) = 0;
MP_DIGITS(&h) = 0;
MP_DIGITS(&one) = 0;
MP_DIGITS(&R) = 0;
MP_DIGITS(&gr) = 0;
MP_DIGITS(&gxh) = 0;
MP_DIGITS(&gr_gxh) = 0;
calculated.data = NULL;
CHECK_MPI_OK( mp_init(&p) );
CHECK_MPI_OK( mp_init(&q) );
CHECK_MPI_OK( mp_init(&g) );
CHECK_MPI_OK( mp_init(&p_minus_1) );
CHECK_MPI_OK( mp_init(&GX) );
CHECK_MPI_OK( mp_init(&h) );
CHECK_MPI_OK( mp_init(&one) );
CHECK_MPI_OK( mp_init(&R) );
CHECK_MPI_OK( mp_init(&gr) );
CHECK_MPI_OK( mp_init(&gxh) );
CHECK_MPI_OK( mp_init(&gr_gxh) );
SECITEM_TO_MPINT(pqg->prime, &p);
SECITEM_TO_MPINT(pqg->subPrime, &q);
SECITEM_TO_MPINT(pqg->base, &g);
SECITEM_TO_MPINT(*gx, &GX);
SECITEM_TO_MPINT(*r, &R);
CHECK_MPI_OK( mp_sub_d(&p, 1, &p_minus_1) );
CHECK_MPI_OK( mp_exptmod(&GX, &q, &p, &one) );
/* Check g^x is in [1, p-2], R is in [0, q-1], and (g^x)^q mod p == 1 */
if (!(mp_cmp_z(&GX) > 0 &&
mp_cmp(&GX, &p_minus_1) < 0 &&
mp_cmp(&R, &q) < 0 &&
mp_cmp_d(&one, 1) == 0)) {
goto badSig;
}
CHECK_MPI_OK( hashPublicParams(hashType, &pqg->base, gv, gx, peerID,
&h) );
/* Calculate g^v = g^r * g^x^h */
CHECK_MPI_OK( mp_exptmod(&g, &R, &p, &gr) );
CHECK_MPI_OK( mp_exptmod(&GX, &h, &p, &gxh) );
CHECK_MPI_OK( mp_mulmod(&gr, &gxh, &p, &gr_gxh) );
/* Compare calculated g^v to given g^v */
MPINT_TO_SECITEM(&gr_gxh, &calculated, arena);
if (calculated.len == gv->len &&
NSS_SecureMemcmp(calculated.data, gv->data, calculated.len) == 0) {
rv = SECSuccess;
} else {
badSig: PORT_SetError(SEC_ERROR_BAD_SIGNATURE);
rv = SECFailure;
}
cleanup:
mp_clear(&p);
mp_clear(&q);
mp_clear(&g);
mp_clear(&p_minus_1);
mp_clear(&GX);
mp_clear(&h);
mp_clear(&one);
mp_clear(&R);
mp_clear(&gr);
mp_clear(&gxh);
mp_clear(&gr_gxh);
if (rv == SECSuccess && err != MP_OKAY) {
MP_TO_SEC_ERROR(err);
rv = SECFailure;
}
return rv;
}
/* Calculate base = gx1*gx3*gx4 (mod p), i.e. g^(x1+x3+x4) (mod p) */
static mp_err
jpake_Round2Base(const SECItem * gx1, const SECItem * gx3,
const SECItem * gx4, const mp_int * p, mp_int * base)
{
mp_err err;
mp_int GX1;
mp_int GX3;
mp_int GX4;
mp_int tmp;
MP_DIGITS(&GX1) = 0;
MP_DIGITS(&GX3) = 0;
MP_DIGITS(&GX4) = 0;
MP_DIGITS(&tmp) = 0;
CHECK_MPI_OK( mp_init(&GX1) );
CHECK_MPI_OK( mp_init(&GX3) );
CHECK_MPI_OK( mp_init(&GX4) );
CHECK_MPI_OK( mp_init(&tmp) );
SECITEM_TO_MPINT(*gx1, &GX1);
SECITEM_TO_MPINT(*gx3, &GX3);
SECITEM_TO_MPINT(*gx4, &GX4);
/* In round 2, the peer/attacker sends us g^x3 and g^x4 and the protocol
requires that these values are distinct. */
if (mp_cmp(&GX3, &GX4) == 0) {
return MP_BADARG;
}
CHECK_MPI_OK( mp_mul(&GX1, &GX3, &tmp) );
CHECK_MPI_OK( mp_mul(&tmp, &GX4, &tmp) );
CHECK_MPI_OK( mp_mod(&tmp, p, base) );
cleanup:
mp_clear(&GX1);
mp_clear(&GX3);
mp_clear(&GX4);
mp_clear(&tmp);
return err;
}
SECStatus
JPAKE_Round2(PLArenaPool * arena,
const SECItem * p, const SECItem *q, const SECItem * gx1,
const SECItem * gx3, const SECItem * gx4, SECItem * base,
const SECItem * x2, const SECItem * s, SECItem * x2s)
{
mp_err err;
mp_int P;
mp_int Q;
mp_int X2;
mp_int S;
mp_int result;
if (!arena ||
!p || !p->data || p->len == 0 ||
!q || !q->data || q->len == 0 ||
!gx1 || !gx1->data || gx1->len == 0 ||
!gx3 || !gx3->data || gx3->len == 0 ||
!gx4 || !gx4->data || gx4->len == 0 ||
!base || base->data != NULL ||
(x2s != NULL && (x2s->data != NULL ||
!x2 || !x2->data || x2->len == 0 ||
!s || !s->data || s->len == 0))) {
PORT_SetError(SEC_ERROR_INVALID_ARGS);
return SECFailure;
}
MP_DIGITS(&P) = 0;
MP_DIGITS(&Q) = 0;
MP_DIGITS(&X2) = 0;
MP_DIGITS(&S) = 0;
MP_DIGITS(&result) = 0;
CHECK_MPI_OK( mp_init(&P) );
CHECK_MPI_OK( mp_init(&Q) );
CHECK_MPI_OK( mp_init(&result) );
if (x2s != NULL) {
CHECK_MPI_OK( mp_init(&X2) );
CHECK_MPI_OK( mp_init(&S) );
SECITEM_TO_MPINT(*q, &Q);
SECITEM_TO_MPINT(*x2, &X2);
SECITEM_TO_MPINT(*s, &S);
if (mp_cmp(&S, &Q) >= 0) {
err = MP_BADARG;
goto cleanup;
}
CHECK_MPI_OK( mp_mulmod(&X2, &S, &Q, &result) );
MPINT_TO_SECITEM(&result, x2s, arena);
}
SECITEM_TO_MPINT(*p, &P);
CHECK_MPI_OK( jpake_Round2Base(gx1, gx3, gx4, &P, &result) );
MPINT_TO_SECITEM(&result, base, arena);
cleanup:
mp_clear(&P);
mp_clear(&Q);
mp_clear(&X2);
mp_clear(&S);
mp_clear(&result);
if (err != MP_OKAY) {
MP_TO_SEC_ERROR(err);
return SECFailure;
}
return SECSuccess;
}
SECStatus
JPAKE_Final(PLArenaPool * arena, const SECItem * p, const SECItem * q,
const SECItem * x2, const SECItem * gx4, const SECItem * x2s,
const SECItem * B, SECItem * K)
{
mp_err err;
mp_int P;
mp_int Q;
mp_int tmp;
mp_int exponent;
mp_int divisor;
mp_int base;
if (!arena ||
!p || !p->data || p->len == 0 ||
!q || !q->data || q->len == 0 ||
!x2 || !x2->data || x2->len == 0 ||
!gx4 || !gx4->data || gx4->len == 0 ||
!x2s || !x2s->data || x2s->len == 0 ||
!B || !B->data || B->len == 0 ||
!K || K->data != NULL) {
PORT_SetError(SEC_ERROR_INVALID_ARGS);
return SECFailure;
}
MP_DIGITS(&P) = 0;
MP_DIGITS(&Q) = 0;
MP_DIGITS(&tmp) = 0;
MP_DIGITS(&exponent) = 0;
MP_DIGITS(&divisor) = 0;
MP_DIGITS(&base) = 0;
CHECK_MPI_OK( mp_init(&P) );
CHECK_MPI_OK( mp_init(&Q) );
CHECK_MPI_OK( mp_init(&tmp) );
CHECK_MPI_OK( mp_init(&exponent) );
CHECK_MPI_OK( mp_init(&divisor) );
CHECK_MPI_OK( mp_init(&base) );
/* exponent = -x2s (mod q) */
SECITEM_TO_MPINT(*q, &Q);
SECITEM_TO_MPINT(*x2s, &tmp);
/* q == 0 (mod q), so q - x2s == -x2s (mod q) */
CHECK_MPI_OK( mp_sub(&Q, &tmp, &exponent) );
/* divisor = gx4^-x2s = 1/(gx4^x2s) (mod p) */
SECITEM_TO_MPINT(*p, &P);
SECITEM_TO_MPINT(*gx4, &tmp);
CHECK_MPI_OK( mp_exptmod(&tmp, &exponent, &P, &divisor) );
/* base = B*divisor = B/(gx4^x2s) (mod p) */
SECITEM_TO_MPINT(*B, &tmp);
CHECK_MPI_OK( mp_mulmod(&divisor, &tmp, &P, &base) );
/* tmp = base^x2 (mod p) */
SECITEM_TO_MPINT(*x2, &exponent);
CHECK_MPI_OK( mp_exptmod(&base, &exponent, &P, &tmp) );
MPINT_TO_SECITEM(&tmp, K, arena);
cleanup:
mp_clear(&P);
mp_clear(&Q);
mp_clear(&tmp);
mp_clear(&exponent);
mp_clear(&divisor);
mp_clear(&base);
if (err != MP_OKAY) {
MP_TO_SEC_ERROR(err);
return SECFailure;
}
return SECSuccess;
}

10
mozilla/security/nss/lib/freebl/ldvector.c
View File

@@ -37,7 +37,7 @@
* the terms of any one of the MPL, the GPL or the LGPL.
*
* ***** END LICENSE BLOCK ***** */
/* $Id: ldvector.c,v 1.26 2010-11-16 19:08:48 rrelyea%redhat.com Exp $ */
/* $Id: ldvector.c,v 1.27 2010-12-04 18:57:16 rrelyea%redhat.com Exp $ */
#ifdef FREEBL_NO_DEPEND
extern int FREEBL_InitStubs(void);
@@ -263,6 +263,14 @@ static const struct FREEBLVectorStr vector =
/* End of Version 3.011. */
RSA_PopulatePrivateKey,
DSA_NewRandom,
JPAKE_Sign,
JPAKE_Verify,
JPAKE_Round2,
JPAKE_Final,
/* End of Version 3.012 */
MGF1,

55
mozilla/security/nss/lib/freebl/loader.c
View File

@@ -37,7 +37,7 @@
* the terms of any one of the MPL, the GPL or the LGPL.
*
* ***** END LICENSE BLOCK ***** */
/* $Id: loader.c,v 1.50 2010-11-16 19:08:48 rrelyea%redhat.com Exp $ */
/* $Id: loader.c,v 1.51 2010-12-04 18:57:16 rrelyea%redhat.com Exp $ */
#include "loader.h"
#include "prmem.h"
@@ -295,6 +295,14 @@ DSA_SignDigestWithSeed(DSAPrivateKey * key, SECItem * signature,
return (vector->p_DSA_SignDigestWithSeed)( key, signature, digest, seed);
}
SECStatus
DSA_NewRandom(PLArenaPool * arena, const SECItem * q, SECItem * seed)
{
if (!vector && PR_SUCCESS != freebl_RunLoaderOnce())
return SECFailure;
return (vector->p_DSA_NewRandom)(arena, q, seed);
}
SECStatus
DH_GenParam(int primeLen, DHParams ** params)
{
@@ -1705,6 +1713,51 @@ RSA_PopulatePrivateKey(RSAPrivateKey *key)
return (vector->p_RSA_PopulatePrivateKey)(key);
}
SECStatus
JPAKE_Sign(PLArenaPool * arena, const PQGParams * pqg, HASH_HashType hashType,
const SECItem * signerID, const SECItem * x,
const SECItem * testRandom, const SECItem * gxIn, SECItem * gxOut,
SECItem * gv, SECItem * r)
{
if (!vector && PR_SUCCESS != freebl_RunLoaderOnce())
return SECFailure;
return (vector->p_JPAKE_Sign)(arena, pqg, hashType, signerID, x,
testRandom, gxIn, gxOut, gv, r);
}
SECStatus
JPAKE_Verify(PLArenaPool * arena, const PQGParams * pqg,
HASH_HashType hashType, const SECItem * signerID,
const SECItem * peerID, const SECItem * gx,
const SECItem * gv, const SECItem * r)
{
if (!vector && PR_SUCCESS != freebl_RunLoaderOnce())
return SECFailure;
return (vector->p_JPAKE_Verify)(arena, pqg, hashType, signerID, peerID,
gx, gv, r);
}
SECStatus
JPAKE_Round2(PLArenaPool * arena, const SECItem * p, const SECItem *q,
const SECItem * gx1, const SECItem * gx3, const SECItem * gx4,
SECItem * base, const SECItem * x2, const SECItem * s, SECItem * x2s)
{
if (!vector && PR_SUCCESS != freebl_RunLoaderOnce())
return SECFailure;
return (vector->p_JPAKE_Round2)(arena, p, q, gx1, gx3, gx4, base, x2, s, x2s);
}
SECStatus
JPAKE_Final(PLArenaPool * arena, const SECItem * p, const SECItem *q,
const SECItem * x2, const SECItem * gx4, const SECItem * x2s,
const SECItem * B, SECItem * K)
{
if (!vector && PR_SUCCESS != freebl_RunLoaderOnce())
return SECFailure;
return (vector->p_JPAKE_Final)(arena, p, q, x2, gx4, x2s, B, K);
}
SECStatus
MGF1(HASH_HashType hashAlg, unsigned char *mask, unsigned int maskLen,
const unsigned char *mgfSeed, unsigned int mgfSeedLen)

28
mozilla/security/nss/lib/freebl/loader.h
View File

@@ -37,7 +37,7 @@
* the terms of any one of the MPL, the GPL or the LGPL.
*
* ***** END LICENSE BLOCK ***** */
/* $Id: loader.h,v 1.31 2010-11-16 19:08:48 rrelyea%redhat.com Exp $ */
/* $Id: loader.h,v 1.32 2010-12-04 18:57:16 rrelyea%redhat.com Exp $ */
#ifndef _LOADER_H_
#define _LOADER_H_ 1
@@ -542,6 +542,32 @@ struct FREEBLVectorStr {
/* Version 3.011 came to here */
SECStatus (*p_RSA_PopulatePrivateKey)(RSAPrivateKey *key);
SECStatus (*p_DSA_NewRandom)(PLArenaPool * arena, const SECItem * q,
SECItem * seed);
SECStatus (*p_JPAKE_Sign)(PLArenaPool * arena, const PQGParams * pqg,
HASH_HashType hashType, const SECItem * signerID,
const SECItem * x, const SECItem * testRandom,
const SECItem * gxIn, SECItem * gxOut,
SECItem * gv, SECItem * r);
SECStatus (*p_JPAKE_Verify)(PLArenaPool * arena, const PQGParams * pqg,
HASH_HashType hashType, const SECItem * signerID,
const SECItem * peerID, const SECItem * gx,
const SECItem * gv, const SECItem * r);
SECStatus (*p_JPAKE_Round2)(PLArenaPool * arena, const SECItem * p,
const SECItem *q, const SECItem * gx1,
const SECItem * gx3, const SECItem * gx4,
SECItem * base, const SECItem * x2,
const SECItem * s, SECItem * x2s);
SECStatus (*p_JPAKE_Final)(PLArenaPool * arena, const SECItem * p,
const SECItem *q, const SECItem * x2,
const SECItem * gx4, const SECItem * x2s,
const SECItem * B, SECItem * K);
/* Version 3.012 came to here */
SECStatus (* p_MGF1)(HASH_HashType hashAlg,

1
mozilla/security/nss/lib/freebl/manifest.mn
View File

@@ -147,6 +147,7 @@ CSRCS = \
shvfy.c \
tlsprfalg.c \
seed.c \
jpake.c \
$(MPI_SRCS) \
$(MPCPU_SRCS) \
$(ECL_SRCS) \

9
mozilla/security/nss/lib/freebl/stubs.c
View File

@@ -173,6 +173,7 @@ STUB_DECLARE(SECStatus,SECITEM_CopyItem_Util,(PRArenaPool *arena,
SECItem *to,const SECItem *from));
STUB_DECLARE(void,SECITEM_FreeItem_Util,(SECItem *zap, PRBool freeit));
STUB_DECLARE(void,SECITEM_ZfreeItem_Util,(SECItem *zap, PRBool freeit));
STUB_DECLARE(int, NSS_SecureMemcmp,(const void *a, const void *b, size_t n));
#define PORT_ZNew_stub(type) (type*)PORT_ZAlloc_stub(sizeof(type))
@@ -498,6 +499,13 @@ SECITEM_ZfreeItem_stub(SECItem *zap, PRBool freeit)
abort();
}
extern int
NSS_SecureMemcmp_stub(const void *a, const void *b, size_t n)
{
STUB_SAFE_CALL3(NSS_SecureMemcmp, a, b, n);
abort();
}
#ifdef FREEBL_NO_WEAK
static const char *nsprLibName = SHLIB_PREFIX"nspr4."SHLIB_SUFFIX;
@@ -540,6 +548,7 @@ freebl_InitNSSUtil(void *lib)
STUB_FETCH_FUNCTION(SECITEM_CompareItem_Util);
STUB_FETCH_FUNCTION(SECITEM_CopyItem_Util);
STUB_FETCH_FUNCTION(SECITEM_ZfreeItem_Util);
STUB_FETCH_FUNCTION(NSS_SecureMemcmp);
return SECSuccess;
}

1
mozilla/security/nss/lib/freebl/stubs.h
View File

@@ -68,6 +68,7 @@
#define SECITEM_CopyItem SECITEM_CopyItem_stub
#define SECITEM_FreeItem SECITEM_FreeItem_stub
#define SECITEM_ZfreeItem SECITEM_ZfreeItem_stub
#define NSS_SecureMemcmp NSS_SecureMemcmp_stub
#define PR_Assert PR_Assert_stub
#define PR_CallOnce PR_CallOnce_stub