1 /* Copyright (c) 2014, Google Inc.
2 *
3 * Permission to use, copy, modify, and/or distribute this software for any
4 * purpose with or without fee is hereby granted, provided that the above
5 * copyright notice and this permission notice appear in all copies.
6 *
7 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
8 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
10 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
12 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
13 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
14
15 #include <stdio.h>
16 #include <string.h>
17
18 #include <vector>
19
20 #include <openssl/crypto.h>
21 #include <openssl/ec_key.h>
22 #include <openssl/err.h>
23 #include <openssl/mem.h>
24
25 #include "../test/scoped_types.h"
26
27
28 // kECKeyWithoutPublic is an ECPrivateKey with the optional publicKey field
29 // omitted.
30 static const uint8_t kECKeyWithoutPublic[] = {
31 0x30, 0x31, 0x02, 0x01, 0x01, 0x04, 0x20, 0xc6, 0xc1, 0xaa, 0xda, 0x15, 0xb0,
32 0x76, 0x61, 0xf8, 0x14, 0x2c, 0x6c, 0xaf, 0x0f, 0xdb, 0x24, 0x1a, 0xff, 0x2e,
33 0xfe, 0x46, 0xc0, 0x93, 0x8b, 0x74, 0xf2, 0xbc, 0xc5, 0x30, 0x52, 0xb0, 0x77,
34 0xa0, 0x0a, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07,
35 };
36
37 // kECKeyMissingZeros is an ECPrivateKey containing a degenerate P-256 key where
38 // the private key is one. The private key is incorrectly encoded without zero
39 // padding.
40 static const uint8_t kECKeyMissingZeros[] = {
41 0x30, 0x58, 0x02, 0x01, 0x01, 0x04, 0x01, 0x01, 0xa0, 0x0a, 0x06, 0x08, 0x2a,
42 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07, 0xa1, 0x44, 0x03, 0x42, 0x00, 0x04,
43 0x6b, 0x17, 0xd1, 0xf2, 0xe1, 0x2c, 0x42, 0x47, 0xf8, 0xbc, 0xe6, 0xe5, 0x63,
44 0xa4, 0x40, 0xf2, 0x77, 0x03, 0x7d, 0x81, 0x2d, 0xeb, 0x33, 0xa0, 0xf4, 0xa1,
45 0x39, 0x45, 0xd8, 0x98, 0xc2, 0x96, 0x4f, 0xe3, 0x42, 0xe2, 0xfe, 0x1a, 0x7f,
46 0x9b, 0x8e, 0xe7, 0xeb, 0x4a, 0x7c, 0x0f, 0x9e, 0x16, 0x2b, 0xce, 0x33, 0x57,
47 0x6b, 0x31, 0x5e, 0xce, 0xcb, 0xb6, 0x40, 0x68, 0x37, 0xbf, 0x51, 0xf5,
48 };
49
50 // kECKeyMissingZeros is an ECPrivateKey containing a degenerate P-256 key where
51 // the private key is one. The private key is encoded with the required zero
52 // padding.
53 static const uint8_t kECKeyWithZeros[] = {
54 0x30, 0x77, 0x02, 0x01, 0x01, 0x04, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
55 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
56 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
57 0xa0, 0x0a, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07, 0xa1,
58 0x44, 0x03, 0x42, 0x00, 0x04, 0x6b, 0x17, 0xd1, 0xf2, 0xe1, 0x2c, 0x42, 0x47,
59 0xf8, 0xbc, 0xe6, 0xe5, 0x63, 0xa4, 0x40, 0xf2, 0x77, 0x03, 0x7d, 0x81, 0x2d,
60 0xeb, 0x33, 0xa0, 0xf4, 0xa1, 0x39, 0x45, 0xd8, 0x98, 0xc2, 0x96, 0x4f, 0xe3,
61 0x42, 0xe2, 0xfe, 0x1a, 0x7f, 0x9b, 0x8e, 0xe7, 0xeb, 0x4a, 0x7c, 0x0f, 0x9e,
62 0x16, 0x2b, 0xce, 0x33, 0x57, 0x6b, 0x31, 0x5e, 0xce, 0xcb, 0xb6, 0x40, 0x68,
63 0x37, 0xbf, 0x51, 0xf5,
64 };
65
66 // DecodeECPrivateKey decodes |in| as an ECPrivateKey structure and returns the
67 // result or nullptr on error.
DecodeECPrivateKey(const uint8_t * in,size_t in_len)68 static ScopedEC_KEY DecodeECPrivateKey(const uint8_t *in, size_t in_len) {
69 const uint8_t *inp = in;
70 ScopedEC_KEY ret(d2i_ECPrivateKey(NULL, &inp, in_len));
71 if (!ret || inp != in + in_len) {
72 return nullptr;
73 }
74 return ret;
75 }
76
77 // EncodeECPrivateKey encodes |key| as an ECPrivateKey structure into |*out|. It
78 // returns true on success or false on error.
EncodeECPrivateKey(std::vector<uint8_t> * out,EC_KEY * key)79 static bool EncodeECPrivateKey(std::vector<uint8_t> *out, EC_KEY *key) {
80 int len = i2d_ECPrivateKey(key, NULL);
81 out->resize(len);
82 uint8_t *outp = out->data();
83 return i2d_ECPrivateKey(key, &outp) == len;
84 }
85
Testd2i_ECPrivateKey()86 bool Testd2i_ECPrivateKey() {
87 ScopedEC_KEY key = DecodeECPrivateKey(kECKeyWithoutPublic,
88 sizeof(kECKeyWithoutPublic));
89 if (!key) {
90 fprintf(stderr, "Failed to parse private key.\n");
91 ERR_print_errors_fp(stderr);
92 return false;
93 }
94
95 std::vector<uint8_t> out;
96 if (!EncodeECPrivateKey(&out, key.get())) {
97 fprintf(stderr, "Failed to serialize private key.\n");
98 ERR_print_errors_fp(stderr);
99 return false;
100 }
101
102 if (std::vector<uint8_t>(kECKeyWithoutPublic,
103 kECKeyWithoutPublic + sizeof(kECKeyWithoutPublic)) !=
104 out) {
105 fprintf(stderr, "Serialisation of key doesn't match original.\n");
106 return false;
107 }
108
109 const EC_POINT *pub_key = EC_KEY_get0_public_key(key.get());
110 if (pub_key == NULL) {
111 fprintf(stderr, "Public key missing.\n");
112 return false;
113 }
114
115 ScopedBIGNUM x(BN_new());
116 ScopedBIGNUM y(BN_new());
117 if (!x || !y) {
118 return false;
119 }
120 if (!EC_POINT_get_affine_coordinates_GFp(EC_KEY_get0_group(key.get()),
121 pub_key, x.get(), y.get(), NULL)) {
122 fprintf(stderr, "Failed to get public key in affine coordinates.\n");
123 return false;
124 }
125 ScopedOpenSSLString x_hex(BN_bn2hex(x.get()));
126 ScopedOpenSSLString y_hex(BN_bn2hex(y.get()));
127 if (!x_hex || !y_hex) {
128 return false;
129 }
130 if (0 != strcmp(
131 x_hex.get(),
132 "c81561ecf2e54edefe6617db1c7a34a70744ddb261f269b83dacfcd2ade5a681") ||
133 0 != strcmp(
134 y_hex.get(),
135 "e0e2afa3f9b6abe4c698ef6495f1be49a3196c5056acb3763fe4507eec596e88")) {
136 fprintf(stderr, "Incorrect public key: %s %s\n", x_hex.get(), y_hex.get());
137 return false;
138 }
139
140 return true;
141 }
142
TestZeroPadding()143 static bool TestZeroPadding() {
144 // Check that the correct encoding round-trips.
145 ScopedEC_KEY key = DecodeECPrivateKey(kECKeyWithZeros,
146 sizeof(kECKeyWithZeros));
147 std::vector<uint8_t> out;
148 if (!key || !EncodeECPrivateKey(&out, key.get())) {
149 ERR_print_errors_fp(stderr);
150 return false;
151 }
152
153 if (std::vector<uint8_t>(kECKeyWithZeros,
154 kECKeyWithZeros + sizeof(kECKeyWithZeros)) != out) {
155 fprintf(stderr, "Serialisation of key was incorrect.\n");
156 return false;
157 }
158
159 // Keys without leading zeros also parse, but they encode correctly.
160 key = DecodeECPrivateKey(kECKeyMissingZeros, sizeof(kECKeyMissingZeros));
161 if (!key || !EncodeECPrivateKey(&out, key.get())) {
162 ERR_print_errors_fp(stderr);
163 return false;
164 }
165
166 if (std::vector<uint8_t>(kECKeyWithZeros,
167 kECKeyWithZeros + sizeof(kECKeyWithZeros)) != out) {
168 fprintf(stderr, "Serialisation of key was incorrect.\n");
169 return false;
170 }
171
172 return true;
173 }
174
TestSetAffine(const int nid)175 bool TestSetAffine(const int nid) {
176 ScopedEC_KEY key(EC_KEY_new_by_curve_name(nid));
177 if (!key) {
178 return false;
179 }
180
181 const EC_GROUP *const group = EC_KEY_get0_group(key.get());
182
183 if (!EC_KEY_generate_key(key.get())) {
184 fprintf(stderr, "EC_KEY_generate_key failed with nid %d\n", nid);
185 ERR_print_errors_fp(stderr);
186 return false;
187 }
188
189 if (!EC_POINT_is_on_curve(group, EC_KEY_get0_public_key(key.get()),
190 nullptr)) {
191 fprintf(stderr, "generated point is not on curve with nid %d", nid);
192 ERR_print_errors_fp(stderr);
193 return false;
194 }
195
196 ScopedBIGNUM x(BN_new());
197 ScopedBIGNUM y(BN_new());
198 if (!EC_POINT_get_affine_coordinates_GFp(group,
199 EC_KEY_get0_public_key(key.get()),
200 x.get(), y.get(), nullptr)) {
201 fprintf(stderr, "EC_POINT_get_affine_coordinates_GFp failed with nid %d\n",
202 nid);
203 ERR_print_errors_fp(stderr);
204 return false;
205 }
206
207 ScopedEC_POINT point(EC_POINT_new(group));
208 if (!point) {
209 return false;
210 }
211
212 if (!EC_POINT_set_affine_coordinates_GFp(group, point.get(), x.get(), y.get(),
213 nullptr)) {
214 fprintf(stderr, "EC_POINT_set_affine_coordinates_GFp failed with nid %d\n",
215 nid);
216 ERR_print_errors_fp(stderr);
217 return false;
218 }
219
220 // Subtract one from |y| to make the point no longer on the curve.
221 if (!BN_sub(y.get(), y.get(), BN_value_one())) {
222 return false;
223 }
224
225 ScopedEC_POINT invalid_point(EC_POINT_new(group));
226 if (!invalid_point) {
227 return false;
228 }
229
230 if (EC_POINT_set_affine_coordinates_GFp(group, invalid_point.get(), x.get(),
231 y.get(), nullptr)) {
232 fprintf(stderr,
233 "EC_POINT_set_affine_coordinates_GFp succeeded with invalid "
234 "coordinates with nid %d\n",
235 nid);
236 ERR_print_errors_fp(stderr);
237 return false;
238 }
239
240 return true;
241 }
242
main(void)243 int main(void) {
244 CRYPTO_library_init();
245 ERR_load_crypto_strings();
246
247 if (!Testd2i_ECPrivateKey() ||
248 !TestZeroPadding() ||
249 !TestSetAffine(NID_secp224r1) ||
250 !TestSetAffine(NID_X9_62_prime256v1) ||
251 !TestSetAffine(NID_secp384r1) ||
252 !TestSetAffine(NID_secp521r1)) {
253 fprintf(stderr, "failed\n");
254 return 1;
255 }
256
257 printf("PASS\n");
258 return 0;
259 }
260