mirror of
https://github.com/rn10950/RetroZilla.git
synced 2024-11-14 19:50:12 +01:00
351 lines
12 KiB
C
351 lines
12 KiB
C
|
/* This Source Code Form is subject to the terms of the Mozilla Public
|
||
|
|
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||
|
|
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
|
||
|
|
|
||
|
|
#include "seccomon.h"
|
||
|
|
#include "secerr.h"
|
||
|
|
#include "blapi.h"
|
||
|
|
#include "pkcs11i.h"
|
||
|
|
#include "softoken.h"
|
||
|
|
|
||
|
|
static CK_RV
|
||
|
|
jpake_mapStatus(SECStatus rv, CK_RV invalidArgsMapping) {
|
||
|
|
int err;
|
||
|
|
if (rv == SECSuccess)
|
||
|
|
return CKR_OK;
|
||
|
|
err = PORT_GetError();
|
||
|
|
switch (err) {
|
||
|
|
/* XXX: SEC_ERROR_INVALID_ARGS might be caused by invalid template
|
||
|
|
parameters. */
|
||
|
|
case SEC_ERROR_INVALID_ARGS: return invalidArgsMapping;
|
||
|
|
case SEC_ERROR_BAD_SIGNATURE: return CKR_SIGNATURE_INVALID;
|
||
|
|
case SEC_ERROR_NO_MEMORY: return CKR_HOST_MEMORY;
|
||
|
|
}
|
||
|
|
return CKR_FUNCTION_FAILED;
|
||
|
|
}
|
||
|
|
|
||
|
|
/* If key is not NULL then the gx value will be stored as an attribute with
|
||
|
|
the type given by the gxAttrType parameter. */
|
||
|
|
static CK_RV
|
||
|
|
jpake_Sign(PLArenaPool * arena, const PQGParams * pqg, HASH_HashType hashType,
|
||
|
|
const SECItem * signerID, const SECItem * x,
|
||
|
|
CK_NSS_JPAKEPublicValue * out)
|
||
|
|
{
|
||
|
|
SECItem gx, gv, r;
|
||
|
|
CK_RV crv;
|
||
|
|
|
||
|
|
PORT_Assert(arena != NULL);
|
||
|
|
|
||
|
|
gx.data = NULL;
|
||
|
|
gv.data = NULL;
|
||
|
|
r.data = NULL;
|
||
|
|
crv = jpake_mapStatus(JPAKE_Sign(arena, pqg, hashType, signerID, x, NULL,
|
||
|
|
NULL, &gx, &gv, &r),
|
||
|
|
CKR_MECHANISM_PARAM_INVALID);
|
||
|
|
if (crv == CKR_OK) {
|
||
|
|
if ((out->pGX != NULL && out->ulGXLen >= gx.len) ||
|
||
|
|
(out->pGV != NULL && out->ulGVLen >= gv.len) ||
|
||
|
|
(out->pR != NULL && out->ulRLen >= r.len)) {
|
||
|
|
PORT_Memcpy(out->pGX, gx.data, gx.len);
|
||
|
|
PORT_Memcpy(out->pGV, gv.data, gv.len);
|
||
|
|
PORT_Memcpy(out->pR, r.data, r.len);
|
||
|
|
out->ulGXLen = gx.len;
|
||
|
|
out->ulGVLen = gv.len;
|
||
|
|
out->ulRLen = r.len;
|
||
|
|
} else {
|
||
|
|
crv = CKR_MECHANISM_PARAM_INVALID;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
return crv;
|
||
|
|
}
|
||
|
|
|
||
|
|
static CK_RV
|
||
|
|
jpake_Verify(PLArenaPool * arena, const PQGParams * pqg,
|
||
|
|
HASH_HashType hashType, const SECItem * signerID,
|
||
|
|
const CK_BYTE * peerIDData, CK_ULONG peerIDLen,
|
||
|
|
const CK_NSS_JPAKEPublicValue * publicValueIn)
|
||
|
|
{
|
||
|
|
SECItem peerID, gx, gv, r;
|
||
|
|
peerID.data = (unsigned char *) peerIDData; peerID.len = peerIDLen;
|
||
|
|
gx.data = publicValueIn->pGX; gx.len = publicValueIn->ulGXLen;
|
||
|
|
gv.data = publicValueIn->pGV; gv.len = publicValueIn->ulGVLen;
|
||
|
|
r.data = publicValueIn->pR; r.len = publicValueIn->ulRLen;
|
||
|
|
return jpake_mapStatus(JPAKE_Verify(arena, pqg, hashType, signerID, &peerID,
|
||
|
|
&gx, &gv, &r),
|
||
|
|
CKR_MECHANISM_PARAM_INVALID);
|
||
|
|
}
|
||
|
|
|
||
|
|
#define NUM_ELEM(x) (sizeof (x) / sizeof (x)[0])
|
||
|
|
|
||
|
|
/* If the template has the key type set, ensure that it was set to the correct
|
||
|
|
* value. If the template did not have the key type set, set it to the
|
||
|
|
* correct value.
|
||
|
|
*/
|
||
|
|
static CK_RV
|
||
|
|
jpake_enforceKeyType(SFTKObject * key, CK_KEY_TYPE keyType) {
|
||
|
|
CK_RV crv;
|
||
|
|
SFTKAttribute * keyTypeAttr = sftk_FindAttribute(key, CKA_KEY_TYPE);
|
||
|
|
if (keyTypeAttr != NULL) {
|
||
|
|
crv = *(CK_KEY_TYPE *)keyTypeAttr->attrib.pValue == keyType
|
||
|
|
? CKR_OK
|
||
|
|
: CKR_TEMPLATE_INCONSISTENT;
|
||
|
|
sftk_FreeAttribute(keyTypeAttr);
|
||
|
|
} else {
|
||
|
|
crv = sftk_forceAttribute(key, CKA_KEY_TYPE, &keyType, sizeof keyType);
|
||
|
|
}
|
||
|
|
return crv;
|
||
|
|
}
|
||
|
|
|
||
|
|
static CK_RV
|
||
|
|
jpake_MultipleSecItem2Attribute(SFTKObject * key, const SFTKItemTemplate * attrs,
|
||
|
|
size_t attrsCount)
|
||
|
|
{
|
||
|
|
size_t i;
|
||
|
|
|
||
|
|
for (i = 0; i < attrsCount; ++i) {
|
||
|
|
CK_RV crv = sftk_forceAttribute(key, attrs[i].type, attrs[i].item->data,
|
||
|
|
attrs[i].item->len);
|
||
|
|
if (crv != CKR_OK)
|
||
|
|
return crv;
|
||
|
|
}
|
||
|
|
return CKR_OK;
|
||
|
|
}
|
||
|
|
|
||
|
|
CK_RV
|
||
|
|
jpake_Round1(HASH_HashType hashType, CK_NSS_JPAKERound1Params * params,
|
||
|
|
SFTKObject * key)
|
||
|
|
{
|
||
|
|
CK_RV crv;
|
||
|
|
PQGParams pqg;
|
||
|
|
PLArenaPool * arena;
|
||
|
|
SECItem signerID;
|
||
|
|
SFTKItemTemplate templateAttrs[] = {
|
||
|
|
{ CKA_PRIME, &pqg.prime },
|
||
|
|
{ CKA_SUBPRIME, &pqg.subPrime },
|
||
|
|
{ CKA_BASE, &pqg.base },
|
||
|
|
{ CKA_NSS_JPAKE_SIGNERID, &signerID }
|
||
|
|
};
|
||
|
|
SECItem x2, gx1, gx2;
|
||
|
|
const SFTKItemTemplate generatedAttrs[] = {
|
||
|
|
{ CKA_NSS_JPAKE_X2, &x2 },
|
||
|
|
{ CKA_NSS_JPAKE_GX1, &gx1 },
|
||
|
|
{ CKA_NSS_JPAKE_GX2, &gx2 },
|
||
|
|
};
|
||
|
|
SECItem x1;
|
||
|
|
|
||
|
|
PORT_Assert(params != NULL);
|
||
|
|
PORT_Assert(key != NULL);
|
||
|
|
|
||
|
|
arena = PORT_NewArena(NSS_SOFTOKEN_DEFAULT_CHUNKSIZE);
|
||
|
|
if (arena == NULL)
|
||
|
|
crv = CKR_HOST_MEMORY;
|
||
|
|
|
||
|
|
crv = sftk_MultipleAttribute2SecItem(arena, key, templateAttrs,
|
||
|
|
NUM_ELEM(templateAttrs));
|
||
|
|
|
||
|
|
if (crv == CKR_OK && (signerID.data == NULL || signerID.len == 0))
|
||
|
|
crv = CKR_TEMPLATE_INCOMPLETE;
|
||
|
|
|
||
|
|
/* generate x1, g^x1 and the proof of knowledge of x1 */
|
||
|
|
if (crv == CKR_OK) {
|
||
|
|
x1.data = NULL;
|
||
|
|
crv = jpake_mapStatus(DSA_NewRandom(arena, &pqg.subPrime, &x1),
|
||
|
|
CKR_TEMPLATE_INCONSISTENT);
|
||
|
|
}
|
||
|
|
if (crv == CKR_OK)
|
||
|
|
crv = jpake_Sign(arena, &pqg, hashType, &signerID, &x1, ¶ms->gx1);
|
||
|
|
|
||
|
|
/* generate x2, g^x2 and the proof of knowledge of x2 */
|
||
|
|
if (crv == CKR_OK) {
|
||
|
|
x2.data = NULL;
|
||
|
|
crv = jpake_mapStatus(DSA_NewRandom(arena, &pqg.subPrime, &x2),
|
||
|
|
CKR_TEMPLATE_INCONSISTENT);
|
||
|
|
}
|
||
|
|
if (crv == CKR_OK)
|
||
|
|
crv = jpake_Sign(arena, &pqg, hashType, &signerID, &x2, ¶ms->gx2);
|
||
|
|
|
||
|
|
/* Save the values needed for round 2 into CKA_VALUE */
|
||
|
|
if (crv == CKR_OK) {
|
||
|
|
gx1.data = params->gx1.pGX;
|
||
|
|
gx1.len = params->gx1.ulGXLen;
|
||
|
|
gx2.data = params->gx2.pGX;
|
||
|
|
gx2.len = params->gx2.ulGXLen;
|
||
|
|
crv = jpake_MultipleSecItem2Attribute(key, generatedAttrs,
|
||
|
|
NUM_ELEM(generatedAttrs));
|
||
|
|
}
|
||
|
|
|
||
|
|
PORT_FreeArena(arena, PR_TRUE);
|
||
|
|
return crv;
|
||
|
|
}
|
||
|
|
|
||
|
|
CK_RV
|
||
|
|
jpake_Round2(HASH_HashType hashType, CK_NSS_JPAKERound2Params * params,
|
||
|
|
SFTKObject * sourceKey, SFTKObject * key)
|
||
|
|
{
|
||
|
|
CK_RV crv;
|
||
|
|
PLArenaPool * arena;
|
||
|
|
PQGParams pqg;
|
||
|
|
SECItem signerID, x2, gx1, gx2;
|
||
|
|
SFTKItemTemplate sourceAttrs[] = {
|
||
|
|
{ CKA_PRIME, &pqg.prime },
|
||
|
|
{ CKA_SUBPRIME, &pqg.subPrime },
|
||
|
|
{ CKA_BASE, &pqg.base },
|
||
|
|
{ CKA_NSS_JPAKE_SIGNERID, &signerID },
|
||
|
|
{ CKA_NSS_JPAKE_X2, &x2 },
|
||
|
|
{ CKA_NSS_JPAKE_GX1, &gx1 },
|
||
|
|
{ CKA_NSS_JPAKE_GX2, &gx2 },
|
||
|
|
};
|
||
|
|
SECItem x2s, gx3, gx4;
|
||
|
|
const SFTKItemTemplate copiedAndGeneratedAttrs[] = {
|
||
|
|
{ CKA_NSS_JPAKE_SIGNERID, &signerID },
|
||
|
|
{ CKA_PRIME, &pqg.prime },
|
||
|
|
{ CKA_SUBPRIME, &pqg.subPrime },
|
||
|
|
{ CKA_NSS_JPAKE_X2, &x2 },
|
||
|
|
{ CKA_NSS_JPAKE_X2S, &x2s },
|
||
|
|
{ CKA_NSS_JPAKE_GX1, &gx1 },
|
||
|
|
{ CKA_NSS_JPAKE_GX2, &gx2 },
|
||
|
|
{ CKA_NSS_JPAKE_GX3, &gx3 },
|
||
|
|
{ CKA_NSS_JPAKE_GX4, &gx4 }
|
||
|
|
};
|
||
|
|
SECItem peerID;
|
||
|
|
|
||
|
|
PORT_Assert(params != NULL);
|
||
|
|
PORT_Assert(sourceKey != NULL);
|
||
|
|
PORT_Assert(key != NULL);
|
||
|
|
|
||
|
|
arena = PORT_NewArena(NSS_SOFTOKEN_DEFAULT_CHUNKSIZE);
|
||
|
|
if (arena == NULL)
|
||
|
|
crv = CKR_HOST_MEMORY;
|
||
|
|
|
||
|
|
/* TODO: check CKK_NSS_JPAKE_ROUND1 */
|
||
|
|
|
||
|
|
crv = sftk_MultipleAttribute2SecItem(arena, sourceKey, sourceAttrs,
|
||
|
|
NUM_ELEM(sourceAttrs));
|
||
|
|
|
||
|
|
/* Get the peer's ID out of the template and sanity-check it. */
|
||
|
|
if (crv == CKR_OK)
|
||
|
|
crv = sftk_Attribute2SecItem(arena, &peerID, key,
|
||
|
|
CKA_NSS_JPAKE_PEERID);
|
||
|
|
if (crv == CKR_OK && (peerID.data == NULL || peerID.len == 0))
|
||
|
|
crv = CKR_TEMPLATE_INCOMPLETE;
|
||
|
|
if (crv == CKR_OK && SECITEM_CompareItem(&signerID, &peerID) == SECEqual)
|
||
|
|
crv = CKR_TEMPLATE_INCONSISTENT;
|
||
|
|
|
||
|
|
/* Verify zero-knowledge proofs for g^x3 and g^x4 */
|
||
|
|
if (crv == CKR_OK)
|
||
|
|
crv = jpake_Verify(arena, &pqg, hashType, &signerID,
|
||
|
|
peerID.data, peerID.len, ¶ms->gx3);
|
||
|
|
if (crv == CKR_OK)
|
||
|
|
crv = jpake_Verify(arena, &pqg, hashType, &signerID,
|
||
|
|
peerID.data, peerID.len, ¶ms->gx4);
|
||
|
|
|
||
|
|
/* Calculate the base and x2s for A=base^x2s */
|
||
|
|
if (crv == CKR_OK) {
|
||
|
|
SECItem s;
|
||
|
|
s.data = params->pSharedKey;
|
||
|
|
s.len = params->ulSharedKeyLen;
|
||
|
|
gx3.data = params->gx3.pGX;
|
||
|
|
gx3.len = params->gx3.ulGXLen;
|
||
|
|
gx4.data = params->gx4.pGX;
|
||
|
|
gx4.len = params->gx4.ulGXLen;
|
||
|
|
pqg.base.data = NULL;
|
||
|
|
x2s.data = NULL;
|
||
|
|
crv = jpake_mapStatus(JPAKE_Round2(arena, &pqg.prime, &pqg.subPrime,
|
||
|
|
&gx1, &gx3, &gx4, &pqg.base,
|
||
|
|
&x2, &s, &x2s),
|
||
|
|
CKR_MECHANISM_PARAM_INVALID);
|
||
|
|
}
|
||
|
|
|
||
|
|
/* Generate A=base^x2s and its zero-knowledge proof. */
|
||
|
|
if (crv == CKR_OK)
|
||
|
|
crv = jpake_Sign(arena, &pqg, hashType, &signerID, &x2s, ¶ms->A);
|
||
|
|
|
||
|
|
/* Copy P and Q from the ROUND1 key to the ROUND2 key and save the values
|
||
|
|
needed for the final key material derivation into CKA_VALUE. */
|
||
|
|
if (crv == CKR_OK)
|
||
|
|
crv = sftk_forceAttribute(key, CKA_PRIME, pqg.prime.data,
|
||
|
|
pqg.prime.len);
|
||
|
|
if (crv == CKR_OK)
|
||
|
|
crv = sftk_forceAttribute(key, CKA_SUBPRIME, pqg.subPrime.data,
|
||
|
|
pqg.subPrime.len);
|
||
|
|
if (crv == CKR_OK) {
|
||
|
|
crv = jpake_MultipleSecItem2Attribute(key, copiedAndGeneratedAttrs,
|
||
|
|
NUM_ELEM(copiedAndGeneratedAttrs));
|
||
|
|
}
|
||
|
|
|
||
|
|
if (crv == CKR_OK)
|
||
|
|
crv = jpake_enforceKeyType(key, CKK_NSS_JPAKE_ROUND2);
|
||
|
|
|
||
|
|
PORT_FreeArena(arena, PR_TRUE);
|
||
|
|
return crv;
|
||
|
|
}
|
||
|
|
|
||
|
|
CK_RV
|
||
|
|
jpake_Final(HASH_HashType hashType, const CK_NSS_JPAKEFinalParams * param,
|
||
|
|
SFTKObject * sourceKey, SFTKObject * key)
|
||
|
|
{
|
||
|
|
PLArenaPool * arena;
|
||
|
|
SECItem K;
|
||
|
|
PQGParams pqg;
|
||
|
|
CK_RV crv;
|
||
|
|
SECItem peerID, signerID, x2s, x2, gx1, gx2, gx3, gx4;
|
||
|
|
SFTKItemTemplate sourceAttrs[] = {
|
||
|
|
{ CKA_NSS_JPAKE_PEERID, &peerID },
|
||
|
|
{ CKA_NSS_JPAKE_SIGNERID, &signerID },
|
||
|
|
{ CKA_PRIME, &pqg.prime },
|
||
|
|
{ CKA_SUBPRIME, &pqg.subPrime },
|
||
|
|
{ CKA_NSS_JPAKE_X2, &x2 },
|
||
|
|
{ CKA_NSS_JPAKE_X2S, &x2s },
|
||
|
|
{ CKA_NSS_JPAKE_GX1, &gx1 },
|
||
|
|
{ CKA_NSS_JPAKE_GX2, &gx2 },
|
||
|
|
{ CKA_NSS_JPAKE_GX3, &gx3 },
|
||
|
|
{ CKA_NSS_JPAKE_GX4, &gx4 }
|
||
|
|
};
|
||
|
|
|
||
|
|
PORT_Assert(param != NULL);
|
||
|
|
PORT_Assert(sourceKey != NULL);
|
||
|
|
PORT_Assert(key != NULL);
|
||
|
|
|
||
|
|
arena = PORT_NewArena(NSS_SOFTOKEN_DEFAULT_CHUNKSIZE);
|
||
|
|
if (arena == NULL)
|
||
|
|
crv = CKR_HOST_MEMORY;
|
||
|
|
|
||
|
|
/* TODO: verify key type CKK_NSS_JPAKE_ROUND2 */
|
||
|
|
|
||
|
|
crv = sftk_MultipleAttribute2SecItem(arena, sourceKey, sourceAttrs,
|
||
|
|
NUM_ELEM(sourceAttrs));
|
||
|
|
|
||
|
|
/* Calculate base for B=base^x4s */
|
||
|
|
if (crv == CKR_OK) {
|
||
|
|
pqg.base.data = NULL;
|
||
|
|
crv = jpake_mapStatus(JPAKE_Round2(arena, &pqg.prime, &pqg.subPrime,
|
||
|
|
&gx1, &gx2, &gx3, &pqg.base,
|
||
|
|
NULL, NULL, NULL),
|
||
|
|
CKR_MECHANISM_PARAM_INVALID);
|
||
|
|
}
|
||
|
|
|
||
|
|
/* Verify zero-knowledge proof for B */
|
||
|
|
if (crv == CKR_OK)
|
||
|
|
crv = jpake_Verify(arena, &pqg, hashType, &signerID,
|
||
|
|
peerID.data, peerID.len, ¶m->B);
|
||
|
|
if (crv == CKR_OK) {
|
||
|
|
SECItem B;
|
||
|
|
B.data = param->B.pGX;
|
||
|
|
B.len = param->B.ulGXLen;
|
||
|
|
K.data = NULL;
|
||
|
|
crv = jpake_mapStatus(JPAKE_Final(arena, &pqg.prime, &pqg.subPrime,
|
||
|
|
&x2, &gx4, &x2s, &B, &K),
|
||
|
|
CKR_MECHANISM_PARAM_INVALID);
|
||
|
|
}
|
||
|
|
|
||
|
|
/* Save key material into CKA_VALUE. */
|
||
|
|
if (crv == CKR_OK)
|
||
|
|
crv = sftk_forceAttribute(key, CKA_VALUE, K.data, K.len);
|
||
|
|
|
||
|
|
if (crv == CKR_OK)
|
||
|
|
crv = jpake_enforceKeyType(key, CKK_GENERIC_SECRET);
|
||
|
|
|
||
|
|
PORT_FreeArena(arena, PR_TRUE);
|
||
|
|
return crv;
|
||
|
|
}
|