1 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
2  * All rights reserved.
3  *
4  * This package is an SSL implementation written
5  * by Eric Young (eay@cryptsoft.com).
6  * The implementation was written so as to conform with Netscapes SSL.
7  *
8  * This library is free for commercial and non-commercial use as long as
9  * the following conditions are aheared to.  The following conditions
10  * apply to all code found in this distribution, be it the RC4, RSA,
11  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
12  * included with this distribution is covered by the same copyright terms
13  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
14  *
15  * Copyright remains Eric Young's, and as such any Copyright notices in
16  * the code are not to be removed.
17  * If this package is used in a product, Eric Young should be given attribution
18  * as the author of the parts of the library used.
19  * This can be in the form of a textual message at program startup or
20  * in documentation (online or textual) provided with the package.
21  *
22  * Redistribution and use in source and binary forms, with or without
23  * modification, are permitted provided that the following conditions
24  * are met:
25  * 1. Redistributions of source code must retain the copyright
26  *    notice, this list of conditions and the following disclaimer.
27  * 2. Redistributions in binary form must reproduce the above copyright
28  *    notice, this list of conditions and the following disclaimer in the
29  *    documentation and/or other materials provided with the distribution.
30  * 3. All advertising materials mentioning features or use of this software
31  *    must display the following acknowledgement:
32  *    "This product includes cryptographic software written by
33  *     Eric Young (eay@cryptsoft.com)"
34  *    The word 'cryptographic' can be left out if the rouines from the library
35  *    being used are not cryptographic related :-).
36  * 4. If you include any Windows specific code (or a derivative thereof) from
37  *    the apps directory (application code) you must include an acknowledgement:
38  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
39  *
40  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
41  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
42  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
43  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
44  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
45  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
46  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
48  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
49  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
50  * SUCH DAMAGE.
51  *
52  * The licence and distribution terms for any publically available version or
53  * derivative of this code cannot be changed.  i.e. this code cannot simply be
54  * copied and put under another distribution licence
55  * [including the GNU Public Licence.] */
56 
57 #include <openssl/dh.h>
58 
59 #include <openssl/bn.h>
60 
61 #include "internal.h"
62 
63 
DH_check_pub_key(const DH * dh,const BIGNUM * pub_key,int * ret)64 int DH_check_pub_key(const DH *dh, const BIGNUM *pub_key, int *ret) {
65   int ok = 0;
66   BIGNUM q;
67 
68   *ret = 0;
69   BN_init(&q);
70   if (!BN_set_word(&q, 1)) {
71     goto err;
72   }
73 
74   if (BN_cmp(pub_key, &q) <= 0) {
75     *ret |= DH_CHECK_PUBKEY_TOO_SMALL;
76   }
77   if (!BN_copy(&q, dh->p) ||
78       !BN_sub_word(&q, 1)) {
79     goto err;
80   }
81   if (BN_cmp(pub_key, &q) >= 0) {
82     *ret |= DH_CHECK_PUBKEY_TOO_LARGE;
83   }
84 
85   ok = 1;
86 
87 err:
88   BN_free(&q);
89   return ok;
90 }
91 
92 
DH_check(const DH * dh,int * ret)93 int DH_check(const DH *dh, int *ret) {
94   /* Check that p is a safe prime and if g is 2, 3 or 5, check that it is a
95    * suitable generator where:
96    *   for 2, p mod 24 == 11
97    *   for 3, p mod 12 == 5
98    *   for 5, p mod 10 == 3 or 7
99    * should hold.
100    */
101   int ok = 0;
102   BN_CTX *ctx = NULL;
103   BN_ULONG l;
104   BIGNUM *t1 = NULL, *t2 = NULL;
105 
106   *ret = 0;
107   ctx = BN_CTX_new();
108   if (ctx == NULL) {
109     goto err;
110   }
111   BN_CTX_start(ctx);
112   t1 = BN_CTX_get(ctx);
113   if (t1 == NULL) {
114     goto err;
115   }
116   t2 = BN_CTX_get(ctx);
117   if (t2 == NULL) {
118     goto err;
119   }
120 
121   if (dh->q) {
122     if (BN_cmp(dh->g, BN_value_one()) <= 0) {
123       *ret |= DH_CHECK_NOT_SUITABLE_GENERATOR;
124     } else if (BN_cmp(dh->g, dh->p) >= 0) {
125       *ret |= DH_CHECK_NOT_SUITABLE_GENERATOR;
126     } else {
127       /* Check g^q == 1 mod p */
128       if (!BN_mod_exp(t1, dh->g, dh->q, dh->p, ctx)) {
129         goto err;
130       }
131       if (!BN_is_one(t1)) {
132         *ret |= DH_CHECK_NOT_SUITABLE_GENERATOR;
133       }
134     }
135     if (!BN_is_prime_ex(dh->q, BN_prime_checks, ctx, NULL)) {
136       *ret |= DH_CHECK_Q_NOT_PRIME;
137     }
138     /* Check p == 1 mod q  i.e. q divides p - 1 */
139     if (!BN_div(t1, t2, dh->p, dh->q, ctx)) {
140       goto err;
141     }
142     if (!BN_is_one(t2)) {
143       *ret |= DH_CHECK_INVALID_Q_VALUE;
144     }
145     if (dh->j && BN_cmp(dh->j, t1)) {
146       *ret |= DH_CHECK_INVALID_J_VALUE;
147     }
148   } else if (BN_is_word(dh->g, DH_GENERATOR_2)) {
149     l = BN_mod_word(dh->p, 24);
150     if (l != 11) {
151       *ret |= DH_CHECK_NOT_SUITABLE_GENERATOR;
152     }
153   } else if (BN_is_word(dh->g, DH_GENERATOR_5)) {
154     l = BN_mod_word(dh->p, 10);
155     if (l != 3 && l != 7) {
156       *ret |= DH_CHECK_NOT_SUITABLE_GENERATOR;
157     }
158   } else {
159     *ret |= DH_CHECK_UNABLE_TO_CHECK_GENERATOR;
160   }
161 
162   if (!BN_is_prime_ex(dh->p, BN_prime_checks, ctx, NULL)) {
163     *ret |= DH_CHECK_P_NOT_PRIME;
164   } else if (!dh->q) {
165     if (!BN_rshift1(t1, dh->p)) {
166       goto err;
167     }
168     if (!BN_is_prime_ex(t1, BN_prime_checks, ctx, NULL)) {
169       *ret |= DH_CHECK_P_NOT_SAFE_PRIME;
170     }
171   }
172   ok = 1;
173 
174 err:
175   if (ctx != NULL) {
176     BN_CTX_end(ctx);
177     BN_CTX_free(ctx);
178   }
179   return ok;
180 }
181