Update INSTALL.md

[openssl-gost/engine.git] / gost_ec_keyx.c

diff --git a/gost_ec_keyx.c b/gost_ec_keyx.c
index 6efa3e870b06d54d22dd8e8c3c26255f9966a615..96803938b178dbefb65ca4872d3d045ad9e17b89 100644 (file)
--- a/gost_ec_keyx.c
+++ b/gost_ec_keyx.c
@@ -18,22 +18,22 @@
 #include "gost_lcl.h"
 
 /* Implementation of CryptoPro VKO 34.10-2001/2012 algorithm */
-static int VKO_compute_key(unsigned char *shared_key,
-                           const EC_POINT *pub_key, const EC_KEY *priv_key,
-                           const unsigned char *ukm, const size_t ukm_size,
-                           const int vko_dgst_nid)
+int VKO_compute_key(unsigned char *shared_key,
+                    const EC_POINT *pub_key, const EC_KEY *priv_key,
+                    const unsigned char *ukm, const size_t ukm_size,
+                    const int vko_dgst_nid)
 {
     unsigned char *databuf = NULL;
-    BIGNUM *UKM = NULL, *p = NULL, *order = NULL, *X = NULL, *Y = NULL;
-    const BIGNUM *key = EC_KEY_get0_private_key(priv_key);
-    EC_POINT *pnt = EC_POINT_new(EC_KEY_get0_group(priv_key));
-    BN_CTX *ctx = BN_CTX_new();
+    BIGNUM *scalar = NULL, *order = NULL, *X = NULL, *Y = NULL;
+    const EC_GROUP *grp = NULL;
+    EC_POINT *pnt = NULL;
+    BN_CTX *ctx = NULL;
     EVP_MD_CTX *mdctx = NULL;
     const EVP_MD *md = NULL;
     int buf_len, half_len;
     int ret = 0;
 
-    if (!ctx) {
+    if ((ctx = BN_CTX_secure_new()) == NULL) {
         GOSTerr(GOST_F_VKO_COMPUTE_KEY, ERR_R_MALLOC_FAILURE);
         return 0;
     }
@@ -45,24 +45,40 @@ static int VKO_compute_key(unsigned char *shared_key,
         goto err;
     }
 
-    UKM = hashsum2bn(ukm, ukm_size);
-    p = BN_CTX_get(ctx);
-    order = BN_CTX_get(ctx);
+    grp = EC_KEY_get0_group(priv_key);
+    scalar = BN_CTX_get(ctx);
+    order  = BN_CTX_get(ctx);
     X = BN_CTX_get(ctx);
-    Y = BN_CTX_get(ctx);
-    EC_GROUP_get_order(EC_KEY_get0_group(priv_key), order, ctx);
-    BN_mod_mul(p, key, UKM, order, ctx);
-    if (!EC_POINT_mul(EC_KEY_get0_group(priv_key), pnt, NULL, pub_key, p, ctx)) {
+
+    if ((Y = BN_CTX_get(ctx)) == NULL
+        || (pnt = EC_POINT_new(grp)) == NULL
+        || BN_lebin2bn(ukm, ukm_size, scalar) == NULL
+        || !BN_mod_mul(scalar, scalar, EC_KEY_get0_private_key(priv_key),
+                       EC_GROUP_get0_order(grp), ctx))
+        goto err;
+
+    /* these two curves have cofactor 4; the rest have cofactor 1 */
+    switch (EC_GROUP_get_curve_name(grp)) {
+        case NID_id_tc26_gost_3410_2012_256_paramSetA:
+        case NID_id_tc26_gost_3410_2012_512_paramSetC:
+            if (!BN_lshift(scalar, scalar, 2))
+                goto err;
+            break;
+    }
+
+    if (!gost_ec_point_mul(grp, pnt, NULL, pub_key, scalar, ctx)) {
         GOSTerr(GOST_F_VKO_COMPUTE_KEY, GOST_R_ERROR_POINT_MUL);
         goto err;
     }
-    EC_POINT_get_affine_coordinates(EC_KEY_get0_group(priv_key),
-                                        pnt, X, Y, ctx);
+    if (!EC_POINT_get_affine_coordinates(grp, pnt, X, Y, ctx) ||
+                       !EC_GROUP_get_order(grp, order, ctx)) {
+        GOSTerr(GOST_F_VKO_COMPUTE_KEY, ERR_R_EC_LIB);
+        goto err;
+    }
 
     half_len = BN_num_bytes(order);
     buf_len = 2 * half_len;
-    databuf = OPENSSL_zalloc(buf_len);
-    if (!databuf) {
+    if ((databuf = OPENSSL_malloc(buf_len)) == NULL) {
         GOSTerr(GOST_F_VKO_COMPUTE_KEY, ERR_R_MALLOC_FAILURE);
         goto err;
     }
@@ -70,13 +86,11 @@ static int VKO_compute_key(unsigned char *shared_key,
     /*
      * Serialize elliptic curve point same way as we do it when saving key
      */
-    store_bignum(Y, databuf, half_len);
-    store_bignum(X, databuf + half_len, half_len);
-    /* And reverse byte order of whole buffer */
-    BUF_reverse(databuf, NULL, buf_len);
+    if (BN_bn2lebinpad(X, databuf, half_len) != half_len
+        || BN_bn2lebinpad(Y, databuf + half_len, half_len) != half_len)
+        goto err;
 
-    mdctx = EVP_MD_CTX_new();
-    if (!mdctx) {
+    if ((mdctx = EVP_MD_CTX_new()) == NULL) {
         GOSTerr(GOST_F_VKO_COMPUTE_KEY, ERR_R_MALLOC_FAILURE);
         goto err;
     }
@@ -87,14 +101,10 @@ static int VKO_compute_key(unsigned char *shared_key,
     ret = (EVP_MD_size(md) > 0) ? EVP_MD_size(md) : 0;
 
  err:
-    BN_free(UKM);
     BN_CTX_end(ctx);
     BN_CTX_free(ctx);
-
     EC_POINT_free(pnt);
-
     EVP_MD_CTX_free(mdctx);
-
     OPENSSL_free(databuf);
 
     return ret;
@@ -146,7 +156,6 @@ static int gost_keg(const unsigned char *ukm_source, int pkey_nid,
 
             OPENSSL_cleanse(tmpkey, 32);
             return (keylen) ? keylen : 0;
-            break;
         }
     default:
         return 0;
@@ -239,7 +248,7 @@ static int pkey_GOST_ECcp_encrypt(EVP_PKEY_CTX *pctx, unsigned char *out,
     EVP_PKEY *pubk = EVP_PKEY_CTX_get0_pkey(pctx);
     struct gost_pmeth_data *data = EVP_PKEY_CTX_get_data(pctx);
     int pkey_nid = EVP_PKEY_base_id(pubk);
-    ASN1_OBJECT *crypt_params_obj = (pkey_nid == NID_id_GostR3410_2001) ?
+    ASN1_OBJECT *crypt_params_obj = (pkey_nid == NID_id_GostR3410_2001 || pkey_nid == NID_id_GostR3410_2001DH) ?
         OBJ_nid2obj(NID_id_Gost28147_89_CryptoPro_A_ParamSet) :
         OBJ_nid2obj(NID_id_tc26_gost_28147_param_Z);
     const struct gost_cipher_info *param =
@@ -257,6 +266,8 @@ static int pkey_GOST_ECcp_encrypt(EVP_PKEY_CTX *pctx, unsigned char *out,
             return 0;
         }
     }
+    if (!param)
+        goto err;
     /* Check for private key in the peer_key of context */
     if (sec_key) {
         key_is_ephemeral = 0;
@@ -278,10 +289,6 @@ static int pkey_GOST_ECcp_encrypt(EVP_PKEY_CTX *pctx, unsigned char *out,
             }
         }
     }
-    if (!get_gost_engine_param(GOST_PARAM_CRYPT_PARAMS)
-        && param == gost_cipher_list) {
-        param = gost_cipher_list;
-    }
     if (out) {
         int dgst_nid = NID_undef;
         EVP_PKEY_get_default_digest_nid(pubk, &dgst_nid);
@@ -334,9 +341,11 @@ static int pkey_GOST_ECcp_encrypt(EVP_PKEY_CTX *pctx, unsigned char *out,
     }
     if ((*out_len = i2d_GOST_KEY_TRANSPORT(gkt, out ? &out : NULL)) > 0)
         ret = 1;
+    OPENSSL_cleanse(shared_key, sizeof(shared_key));
     GOST_KEY_TRANSPORT_free(gkt);
     return ret;
  err:
+    OPENSSL_cleanse(shared_key, sizeof(shared_key));
     if (key_is_ephemeral)
         EVP_PKEY_free(sec_key);
     GOST_KEY_TRANSPORT_free(gkt);
@@ -440,6 +449,7 @@ static int pkey_gost2018_encrypt(EVP_PKEY_CTX *pctx, unsigned char *out,
     if ((*out_len = i2d_PSKeyTransport_gost(pst, out ? &out : NULL)) > 0)
         ret = 1;
  err:
+    OPENSSL_cleanse(expkeys, sizeof(expkeys));
     if (key_is_ephemeral)
       EVP_PKEY_free(sec_key);
 
@@ -546,6 +556,7 @@ static int pkey_GOST_ECcp_decrypt(EVP_PKEY_CTX *pctx, unsigned char *key,
 
     ret = 1;
  err:
+    OPENSSL_cleanse(sharedKey, sizeof(sharedKey));
     EVP_PKEY_free(eph_key);
     GOST_KEY_TRANSPORT_free(gkt);
     return ret;
@@ -626,6 +637,7 @@ static int pkey_gost2018_decrypt(EVP_PKEY_CTX *pctx, unsigned char *key,
 
     ret = 1;
  err:
+    OPENSSL_cleanse(expkeys, sizeof(expkeys));
     EVP_PKEY_free(eph_key);
     PSKeyTransport_gost_free(pst);
     return ret;