1 /*
2  * Copyright 2015 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #include <keymaster/km_openssl/nist_curve_key_exchange.h>
18 
19 #include <openssl/ec.h>
20 #include <openssl/ecdh.h>
21 #include <openssl/err.h>
22 #include <openssl/evp.h>
23 
24 #include <keymaster/km_openssl/openssl_err.h>
25 
26 namespace keymaster {
27 
NistCurveKeyExchange(EC_KEY * private_key,keymaster_error_t * error)28 NistCurveKeyExchange::NistCurveKeyExchange(EC_KEY* private_key, keymaster_error_t* error)
29     : private_key_(private_key) {
30     if (!private_key_.get() || !EC_KEY_check_key(private_key_.get())) {
31         *error = KM_ERROR_INVALID_ARGUMENT;
32         return;
33     }
34     *error = ExtractPublicKey();
35 }
36 
37 /* static */
GenerateKeyExchange(keymaster_ec_curve_t curve)38 NistCurveKeyExchange* NistCurveKeyExchange::GenerateKeyExchange(keymaster_ec_curve_t curve) {
39     int curve_name;
40     switch (curve) {
41     case KM_EC_CURVE_P_224:
42         curve_name = NID_secp224r1;
43         break;
44     case KM_EC_CURVE_P_256:
45         curve_name = NID_X9_62_prime256v1;
46         break;
47     case KM_EC_CURVE_P_384:
48         curve_name = NID_secp384r1;
49         break;
50     case KM_EC_CURVE_P_521:
51         curve_name = NID_secp521r1;
52         break;
53     default:
54         LOG_E("Not a NIST curve: %d", curve);
55         return nullptr;
56     }
57 
58     UniquePtr<EC_KEY, EC_KEY_Delete> key(EC_KEY_new_by_curve_name(curve_name));
59     if (!key.get() || !EC_KEY_generate_key(key.get())) {
60         return nullptr;
61     }
62     keymaster_error_t error;
63     UniquePtr<NistCurveKeyExchange> key_exchange(new (std::nothrow)
64                                                      NistCurveKeyExchange(key.get(), &error));
65     if (!key_exchange.get()) error = KM_ERROR_MEMORY_ALLOCATION_FAILED;
66     if (error != KM_ERROR_OK) return nullptr;
67     (void)key.release();
68 
69     return key_exchange.release();
70 }
71 
ExtractPublicKey()72 keymaster_error_t NistCurveKeyExchange::ExtractPublicKey() {
73     const EC_GROUP* group = EC_KEY_get0_group(private_key_.get());
74     size_t field_len_bits;
75     keymaster_error_t error = ec_get_group_size(group, &field_len_bits);
76     if (error != KM_ERROR_OK) return error;
77 
78     shared_secret_len_ = (field_len_bits + 7) / 8;
79     public_key_len_ = 1 + 2 * shared_secret_len_;
80     public_key_.reset(new (std::nothrow) uint8_t[public_key_len_]);
81     if (!public_key_.get()) return KM_ERROR_MEMORY_ALLOCATION_FAILED;
82     if (EC_POINT_point2oct(group, EC_KEY_get0_public_key(private_key_.get()),
83                            POINT_CONVERSION_UNCOMPRESSED, public_key_.get(), public_key_len_,
84                            nullptr /* ctx */) != public_key_len_) {
85         return TranslateLastOpenSslError();
86     }
87     return KM_ERROR_OK;
88 }
89 
CalculateSharedKey(const Buffer & peer_public_value,Buffer * out_result) const90 bool NistCurveKeyExchange::CalculateSharedKey(const Buffer& peer_public_value,
91                                               Buffer* out_result) const {
92 
93     return CalculateSharedKey(peer_public_value.peek_read(), peer_public_value.available_read(),
94                               out_result);
95 }
96 
CalculateSharedKey(const uint8_t * peer_public_value,size_t peer_public_value_len,Buffer * out_result) const97 bool NistCurveKeyExchange::CalculateSharedKey(const uint8_t* peer_public_value,
98                                               size_t peer_public_value_len,
99                                               Buffer* out_result) const {
100     const EC_GROUP* group = EC_KEY_get0_group(private_key_.get());
101     UniquePtr<EC_POINT, EC_POINT_Delete> point(EC_POINT_new(group));
102     if (!point.get() ||
103         !EC_POINT_oct2point(/* also test if point is on curve */
104                             group, point.get(), peer_public_value, peer_public_value_len,
105                             nullptr /* ctx */) ||
106         !EC_POINT_is_on_curve(group, point.get(), nullptr /* ctx */)) {
107         LOG_E("Can't convert peer public value to point: %d", TranslateLastOpenSslError());
108         return false;
109     }
110 
111     UniquePtr<uint8_t[]> result(new (std::nothrow) uint8_t[shared_secret_len_]);
112     if (!result.get()) return false;
113     if (ECDH_compute_key(result.get(), shared_secret_len_, point.get(), private_key_.get(),
114                          nullptr /* kdf */) != static_cast<int>(shared_secret_len_)) {
115         LOG_E("Can't compute ECDH shared key: %d", TranslateLastOpenSslError());
116         return false;
117     }
118 
119     out_result->Reinitialize(result.get(), shared_secret_len_);
120     return true;
121 }
122 
public_value(Buffer * public_value) const123 bool NistCurveKeyExchange::public_value(Buffer* public_value) const {
124     if (public_key_.get() != nullptr && public_key_len_ != 0) {
125         return public_value->Reinitialize(public_key_.get(), public_key_len_);
126     }
127     return false;
128 }
129 
130 }  // namespace keymaster
131