diff --git a/include/mbedtls/ecjpake.h b/include/mbedtls/ecjpake.h index 1ffdf60f6..6cad35fc5 100644 --- a/include/mbedtls/ecjpake.h +++ b/include/mbedtls/ecjpake.h @@ -39,6 +39,7 @@ typedef struct mbedtls_ecp_point X2; /**< Public key two */ mbedtls_ecp_point X3; /**< Public key three */ mbedtls_ecp_point X4; /**< Public key four */ + mbedtls_ecp_point Xp; /**< Peer's public key (Xs or Xc) */ mbedtls_mpi xa; /**< Our first secret (x1 or x3) */ mbedtls_mpi xb; /**< Our second secret (x2 or x4) */ @@ -126,6 +127,7 @@ int mbedtls_ecjpake_tls_write_server_ext( mbedtls_ecjpake_context *ctx, unsigned char *buf, size_t len, size_t *olen, int (*f_rng)(void *, unsigned char *, size_t), void *p_rng ); + /* * \brief Read and process contents of the ServerHello extension * (excluding extension type and length bytes) @@ -141,6 +143,40 @@ int mbedtls_ecjpake_tls_read_server_ext( mbedtls_ecjpake_context *ctx, const unsigned char *buf, size_t len ); +/* + * \brief Generate and write ServerECJPAKEParams + * (the contents for the ServerKeyExchange) + * + * \param ctx Context to use + * \param buf Buffer to write the contents to + * \param len Buffer size + * \param olen Will be updated with the number of bytes written + * \param f_rng RNG function + * \param p_rng RNG parameter + * + * \return 0 if successfull, + * a negative error code otherwise + */ +int mbedtls_ecjpake_tls_write_server_params( mbedtls_ecjpake_context *ctx, + unsigned char *buf, size_t len, size_t *olen, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +/* + * \brief Read and process ServerECJPAKEParams + * (the contents for the ServerKeyExchange) + * + * \param ctx Context to use + * \param buf Pointer to the message + * \param len Message length + * + * \return 0 if successfull, + * a negative error code otherwise + */ +int mbedtls_ecjpake_tls_read_server_params( mbedtls_ecjpake_context *ctx, + const unsigned char *buf, + size_t len ); + /* * \brief Free a context's content * diff --git a/library/ecjpake.c b/library/ecjpake.c index 47779fc09..b80ca1a06 100644 --- a/library/ecjpake.c +++ b/library/ecjpake.c @@ -51,6 +51,7 @@ void mbedtls_ecjpake_init( mbedtls_ecjpake_context *ctx ) mbedtls_ecp_point_init( &ctx->X2 ); mbedtls_ecp_point_init( &ctx->X3 ); mbedtls_ecp_point_init( &ctx->X4 ); + mbedtls_ecp_point_init( &ctx->Xp ); mbedtls_mpi_init( &ctx->xa ); mbedtls_mpi_init( &ctx->xb ); @@ -72,6 +73,7 @@ void mbedtls_ecjpake_free( mbedtls_ecjpake_context *ctx ) mbedtls_ecp_point_free( &ctx->X2 ); mbedtls_ecp_point_free( &ctx->X3 ); mbedtls_ecp_point_free( &ctx->X4 ); + mbedtls_ecp_point_free( &ctx->Xp ); mbedtls_mpi_free( &ctx->xa ); mbedtls_mpi_free( &ctx->xb ); @@ -497,6 +499,67 @@ int mbedtls_ecjpake_tls_write_server_ext( mbedtls_ecjpake_context *ctx, "server", buf, len, olen, f_rng, p_rng ) ); } +/* + * Read and process ServerECJPAKEParams (7.4.2.5) + */ +int mbedtls_ecjpake_tls_read_server_params( mbedtls_ecjpake_context *ctx, + const unsigned char *buf, + size_t len ) +{ + int ret; + const unsigned char *p = buf; + const unsigned char *end = buf + len; + mbedtls_ecp_group grp; + mbedtls_ecp_point GB; + mbedtls_mpi one; + + mbedtls_ecp_group_init( &grp ); + mbedtls_ecp_point_init( &GB ); + mbedtls_mpi_init( &one ); + + /* + * We need that before parsing in order to check Xs as we read it + * GB = X1 + X2 + X3 (7.4.2.5.1) + */ + MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &one, 1 ) ); + MBEDTLS_MPI_CHK( mbedtls_ecp_muladd( &ctx->grp, &GB, &one, &ctx->X1, + &one, &ctx->X2 ) ); + MBEDTLS_MPI_CHK( mbedtls_ecp_muladd( &ctx->grp, &GB, &one, &GB, + &one, &ctx->X3 ) ); + + /* + * struct { + * ECParameters curve_params; + * ECJPAKEKeyKP ecjpake_key_kp; + * } ServerECJPAKEParams; + */ + MBEDTLS_MPI_CHK( mbedtls_ecp_tls_read_group( &grp, &p, len ) ); + MBEDTLS_MPI_CHK( ecjpake_kkp_read( ctx->md_info, &ctx->grp, + &GB, &ctx->Xp, "server", &p, end ) ); + + if( p != end ) + { + ret = MBEDTLS_ERR_ECP_BAD_INPUT_DATA; + goto cleanup; + } + + /* + * Xs already checked, only thing left to check is the group + */ + if( grp.id != ctx->grp.id ) + { + ret = MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE; + goto cleanup; + } + +cleanup: + mbedtls_ecp_group_free( &grp ); + mbedtls_ecp_point_free( &GB ); + mbedtls_mpi_free( &one ); + + return( ret ); +} + #if defined(MBEDTLS_SELF_TEST) #if defined(MBEDTLS_PLATFORM_C) @@ -515,7 +578,7 @@ int mbedtls_ecjpake_self_test( int verbose ) } #else -static const unsigned char ecjpake_test_kkpp[] = { +static const unsigned char ecjpake_test_cli_ext[] = { 0x41, 0x04, 0xac, 0xcf, 0x01, 0x06, 0xef, 0x85, 0x8f, 0xa2, 0xd9, 0x19, 0x33, 0x13, 0x46, 0x80, 0x5a, 0x78, 0xb5, 0x8b, 0xba, 0xd0, 0xb8, 0x44, 0xe5, 0xc7, 0x89, 0x28, 0x79, 0x14, 0x61, 0x87, 0xdd, 0x26, 0x66, 0xad, @@ -546,6 +609,55 @@ static const unsigned char ecjpake_test_kkpp[] = { 0x8b, 0x01, 0x0e, 0x44, 0x3e, 0xf0 }; +static const unsigned char ecjpake_test_srv_ext[] = { + 0x41, 0x04, 0x7e, 0xa6, 0xe3, 0xa4, 0x48, 0x70, 0x37, 0xa9, 0xe0, 0xdb, + 0xd7, 0x92, 0x62, 0xb2, 0xcc, 0x27, 0x3e, 0x77, 0x99, 0x30, 0xfc, 0x18, + 0x40, 0x9a, 0xc5, 0x36, 0x1c, 0x5f, 0xe6, 0x69, 0xd7, 0x02, 0xe1, 0x47, + 0x79, 0x0a, 0xeb, 0x4c, 0xe7, 0xfd, 0x65, 0x75, 0xab, 0x0f, 0x6c, 0x7f, + 0xd1, 0xc3, 0x35, 0x93, 0x9a, 0xa8, 0x63, 0xba, 0x37, 0xec, 0x91, 0xb7, + 0xe3, 0x2b, 0xb0, 0x13, 0xbb, 0x2b, 0x41, 0x04, 0x09, 0xf8, 0x5b, 0x3d, + 0x20, 0xeb, 0xd7, 0x88, 0x5c, 0xe4, 0x64, 0xc0, 0x8d, 0x05, 0x6d, 0x64, + 0x28, 0xfe, 0x4d, 0xd9, 0x28, 0x7a, 0xa3, 0x65, 0xf1, 0x31, 0xf4, 0x36, + 0x0f, 0xf3, 0x86, 0xd8, 0x46, 0x89, 0x8b, 0xc4, 0xb4, 0x15, 0x83, 0xc2, + 0xa5, 0x19, 0x7f, 0x65, 0xd7, 0x87, 0x42, 0x74, 0x6c, 0x12, 0xa5, 0xec, + 0x0a, 0x4f, 0xfe, 0x2f, 0x27, 0x0a, 0x75, 0x0a, 0x1d, 0x8f, 0xb5, 0x16, + 0x20, 0x93, 0x4d, 0x74, 0xeb, 0x43, 0xe5, 0x4d, 0xf4, 0x24, 0xfd, 0x96, + 0x30, 0x6c, 0x01, 0x17, 0xbf, 0x13, 0x1a, 0xfa, 0xbf, 0x90, 0xa9, 0xd3, + 0x3d, 0x11, 0x98, 0xd9, 0x05, 0x19, 0x37, 0x35, 0x14, 0x41, 0x04, 0x19, + 0x0a, 0x07, 0x70, 0x0f, 0xfa, 0x4b, 0xe6, 0xae, 0x1d, 0x79, 0xee, 0x0f, + 0x06, 0xae, 0xb5, 0x44, 0xcd, 0x5a, 0xdd, 0xaa, 0xbe, 0xdf, 0x70, 0xf8, + 0x62, 0x33, 0x21, 0x33, 0x2c, 0x54, 0xf3, 0x55, 0xf0, 0xfb, 0xfe, 0xc7, + 0x83, 0xed, 0x35, 0x9e, 0x5d, 0x0b, 0xf7, 0x37, 0x7a, 0x0f, 0xc4, 0xea, + 0x7a, 0xce, 0x47, 0x3c, 0x9c, 0x11, 0x2b, 0x41, 0xcc, 0xd4, 0x1a, 0xc5, + 0x6a, 0x56, 0x12, 0x41, 0x04, 0x36, 0x0a, 0x1c, 0xea, 0x33, 0xfc, 0xe6, + 0x41, 0x15, 0x64, 0x58, 0xe0, 0xa4, 0xea, 0xc2, 0x19, 0xe9, 0x68, 0x31, + 0xe6, 0xae, 0xbc, 0x88, 0xb3, 0xf3, 0x75, 0x2f, 0x93, 0xa0, 0x28, 0x1d, + 0x1b, 0xf1, 0xfb, 0x10, 0x60, 0x51, 0xdb, 0x96, 0x94, 0xa8, 0xd6, 0xe8, + 0x62, 0xa5, 0xef, 0x13, 0x24, 0xa3, 0xd9, 0xe2, 0x78, 0x94, 0xf1, 0xee, + 0x4f, 0x7c, 0x59, 0x19, 0x99, 0x65, 0xa8, 0xdd, 0x4a, 0x20, 0x91, 0x84, + 0x7d, 0x2d, 0x22, 0xdf, 0x3e, 0xe5, 0x5f, 0xaa, 0x2a, 0x3f, 0xb3, 0x3f, + 0xd2, 0xd1, 0xe0, 0x55, 0xa0, 0x7a, 0x7c, 0x61, 0xec, 0xfb, 0x8d, 0x80, + 0xec, 0x00, 0xc2, 0xc9, 0xeb, 0x12 +}; + +static const unsigned char ecjpake_test_srv_kx[] = { + 0x03, 0x00, 0x17, 0x41, 0x04, 0x0f, 0xb2, 0x2b, 0x1d, 0x5d, 0x11, 0x23, + 0xe0, 0xef, 0x9f, 0xeb, 0x9d, 0x8a, 0x2e, 0x59, 0x0a, 0x1f, 0x4d, 0x7c, + 0xed, 0x2c, 0x2b, 0x06, 0x58, 0x6e, 0x8f, 0x2a, 0x16, 0xd4, 0xeb, 0x2f, + 0xda, 0x43, 0x28, 0xa2, 0x0b, 0x07, 0xd8, 0xfd, 0x66, 0x76, 0x54, 0xca, + 0x18, 0xc5, 0x4e, 0x32, 0xa3, 0x33, 0xa0, 0x84, 0x54, 0x51, 0xe9, 0x26, + 0xee, 0x88, 0x04, 0xfd, 0x7a, 0xf0, 0xaa, 0xa7, 0xa6, 0x41, 0x04, 0x55, + 0x16, 0xea, 0x3e, 0x54, 0xa0, 0xd5, 0xd8, 0xb2, 0xce, 0x78, 0x6b, 0x38, + 0xd3, 0x83, 0x37, 0x00, 0x29, 0xa5, 0xdb, 0xe4, 0x45, 0x9c, 0x9d, 0xd6, + 0x01, 0xb4, 0x08, 0xa2, 0x4a, 0xe6, 0x46, 0x5c, 0x8a, 0xc9, 0x05, 0xb9, + 0xeb, 0x03, 0xb5, 0xd3, 0x69, 0x1c, 0x13, 0x9e, 0xf8, 0x3f, 0x1c, 0xd4, + 0x20, 0x0f, 0x6c, 0x9c, 0xd4, 0xec, 0x39, 0x22, 0x18, 0xa5, 0x9e, 0xd2, + 0x43, 0xd3, 0xc8, 0x20, 0xff, 0x72, 0x4a, 0x9a, 0x70, 0xb8, 0x8c, 0xb8, + 0x6f, 0x20, 0xb4, 0x34, 0xc6, 0x86, 0x5a, 0xa1, 0xcd, 0x79, 0x06, 0xdd, + 0x7c, 0x9b, 0xce, 0x35, 0x25, 0xf5, 0x08, 0x27, 0x6f, 0x26, 0x83, 0x6c +}; + +#if 0 /* For tests we don't need a secure RNG; * use the LGC from Numerical Recipes for simplicity */ static int ecjpake_lgc( void *p, unsigned char *out, size_t len ) @@ -564,6 +676,7 @@ static int ecjpake_lgc( void *p, unsigned char *out, size_t len ) return( 0 ); } +#endif #define TEST_ASSERT( x ) \ do { \ @@ -583,8 +696,6 @@ int mbedtls_ecjpake_self_test( int verbose ) { int ret; mbedtls_ecjpake_context ctx; - unsigned char buf[1000]; - size_t len; char secret[] = "test passphrase"; mbedtls_ecjpake_init( &ctx ); @@ -596,30 +707,23 @@ int mbedtls_ecjpake_self_test( int verbose ) sizeof( secret ) - 1 ) == 0 ); if( verbose != 0 ) - mbedtls_printf( " ECJPAKE test #1 (client ext read): " ); + mbedtls_printf( " ECJPAKE test #1 (read in sequence): " ); + + /* This is not realistic because it uses the same context for client and + * server, but it ensures the context has all of X1 to X4 when reading the + * key exchange message, so this is convenient for a quick test */ TEST_ASSERT( mbedtls_ecjpake_tls_read_client_ext( &ctx, - ecjpake_test_kkpp, - sizeof( ecjpake_test_kkpp ) ) == 0 ); + ecjpake_test_cli_ext, + sizeof( ecjpake_test_cli_ext ) ) == 0 ); - /* Corrupt message */ - memcpy( buf, ecjpake_test_kkpp, sizeof( ecjpake_test_kkpp ) ); - buf[sizeof( ecjpake_test_kkpp ) - 1]--; - TEST_ASSERT( mbedtls_ecjpake_tls_read_client_ext( &ctx, - buf, sizeof( ecjpake_test_kkpp ) ) - == MBEDTLS_ERR_ECP_VERIFY_FAILED ); + TEST_ASSERT( mbedtls_ecjpake_tls_read_server_ext( &ctx, + ecjpake_test_srv_ext, + sizeof( ecjpake_test_srv_ext ) ) == 0 ); - if( verbose != 0 ) - mbedtls_printf( "passed\n" ); - - if( verbose != 0 ) - mbedtls_printf( " ECJPAKE test #2 (client ext write/read): " ); - - TEST_ASSERT( mbedtls_ecjpake_tls_write_client_ext( &ctx, - buf, sizeof( buf ), &len, - ecjpake_lgc, NULL ) == 0 ); - - TEST_ASSERT( mbedtls_ecjpake_tls_read_client_ext( &ctx, buf, len ) == 0 ); + TEST_ASSERT( mbedtls_ecjpake_tls_read_server_params( &ctx, + ecjpake_test_srv_kx, + sizeof( ecjpake_test_srv_kx ) ) == 0 ); if( verbose != 0 ) mbedtls_printf( "passed\n" );