EIC code displayed by LXR |
|
|
|
|||
File indexing completed on 2025-08-27 09:37:31
0001 /** 0002 * \file ecdh.h 0003 * 0004 * \brief This file contains ECDH definitions and functions. 0005 * 0006 * The Elliptic Curve Diffie-Hellman (ECDH) protocol is an anonymous 0007 * key agreement protocol allowing two parties to establish a shared 0008 * secret over an insecure channel. Each party must have an 0009 * elliptic-curve public–private key pair. 0010 * 0011 * For more information, see <em>NIST SP 800-56A Rev. 2: Recommendation for 0012 * Pair-Wise Key Establishment Schemes Using Discrete Logarithm 0013 * Cryptography</em>. 0014 */ 0015 /* 0016 * Copyright The Mbed TLS Contributors 0017 * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later 0018 */ 0019 0020 #ifndef MBEDTLS_ECDH_H 0021 #define MBEDTLS_ECDH_H 0022 #include "mbedtls/private_access.h" 0023 0024 #include "mbedtls/build_info.h" 0025 0026 #include "mbedtls/ecp.h" 0027 0028 /* 0029 * Mbed TLS supports two formats for ECDH contexts (#mbedtls_ecdh_context 0030 * defined in `ecdh.h`). For most applications, the choice of format makes 0031 * no difference, since all library functions can work with either format, 0032 * except that the new format is incompatible with MBEDTLS_ECP_RESTARTABLE. 0033 0034 * The new format used when this option is disabled is smaller 0035 * (56 bytes on a 32-bit platform). In future versions of the library, it 0036 * will support alternative implementations of ECDH operations. 0037 * The new format is incompatible with applications that access 0038 * context fields directly and with restartable ECP operations. 0039 */ 0040 0041 #if defined(MBEDTLS_ECP_RESTARTABLE) 0042 #define MBEDTLS_ECDH_LEGACY_CONTEXT 0043 #else 0044 #undef MBEDTLS_ECDH_LEGACY_CONTEXT 0045 #endif 0046 0047 #if defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED) 0048 #undef MBEDTLS_ECDH_LEGACY_CONTEXT 0049 #include "everest/everest.h" 0050 #endif 0051 0052 #ifdef __cplusplus 0053 extern "C" { 0054 #endif 0055 0056 /** 0057 * Defines the source of the imported EC key. 0058 */ 0059 typedef enum { 0060 MBEDTLS_ECDH_OURS, /**< Our key. */ 0061 MBEDTLS_ECDH_THEIRS, /**< The key of the peer. */ 0062 } mbedtls_ecdh_side; 0063 0064 #if !defined(MBEDTLS_ECDH_LEGACY_CONTEXT) 0065 /** 0066 * Defines the ECDH implementation used. 0067 * 0068 * Later versions of the library may add new variants, therefore users should 0069 * not make any assumptions about them. 0070 */ 0071 typedef enum { 0072 MBEDTLS_ECDH_VARIANT_NONE = 0, /*!< Implementation not defined. */ 0073 MBEDTLS_ECDH_VARIANT_MBEDTLS_2_0,/*!< The default Mbed TLS implementation */ 0074 #if defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED) 0075 MBEDTLS_ECDH_VARIANT_EVEREST /*!< Everest implementation */ 0076 #endif 0077 } mbedtls_ecdh_variant; 0078 0079 /** 0080 * The context used by the default ECDH implementation. 0081 * 0082 * Later versions might change the structure of this context, therefore users 0083 * should not make any assumptions about the structure of 0084 * mbedtls_ecdh_context_mbed. 0085 */ 0086 typedef struct mbedtls_ecdh_context_mbed { 0087 mbedtls_ecp_group MBEDTLS_PRIVATE(grp); /*!< The elliptic curve used. */ 0088 mbedtls_mpi MBEDTLS_PRIVATE(d); /*!< The private key. */ 0089 mbedtls_ecp_point MBEDTLS_PRIVATE(Q); /*!< The public key. */ 0090 mbedtls_ecp_point MBEDTLS_PRIVATE(Qp); /*!< The value of the public key of the peer. */ 0091 mbedtls_mpi MBEDTLS_PRIVATE(z); /*!< The shared secret. */ 0092 #if defined(MBEDTLS_ECP_RESTARTABLE) 0093 mbedtls_ecp_restart_ctx MBEDTLS_PRIVATE(rs); /*!< The restart context for EC computations. */ 0094 #endif 0095 } mbedtls_ecdh_context_mbed; 0096 #endif 0097 0098 /** 0099 * 0100 * \warning Performing multiple operations concurrently on the same 0101 * ECDSA context is not supported; objects of this type 0102 * should not be shared between multiple threads. 0103 * \brief The ECDH context structure. 0104 */ 0105 typedef struct mbedtls_ecdh_context { 0106 #if defined(MBEDTLS_ECDH_LEGACY_CONTEXT) 0107 mbedtls_ecp_group MBEDTLS_PRIVATE(grp); /*!< The elliptic curve used. */ 0108 mbedtls_mpi MBEDTLS_PRIVATE(d); /*!< The private key. */ 0109 mbedtls_ecp_point MBEDTLS_PRIVATE(Q); /*!< The public key. */ 0110 mbedtls_ecp_point MBEDTLS_PRIVATE(Qp); /*!< The value of the public key of the peer. */ 0111 mbedtls_mpi MBEDTLS_PRIVATE(z); /*!< The shared secret. */ 0112 int MBEDTLS_PRIVATE(point_format); /*!< The format of point export in TLS messages. */ 0113 mbedtls_ecp_point MBEDTLS_PRIVATE(Vi); /*!< The blinding value. */ 0114 mbedtls_ecp_point MBEDTLS_PRIVATE(Vf); /*!< The unblinding value. */ 0115 mbedtls_mpi MBEDTLS_PRIVATE(_d); /*!< The previous \p d. */ 0116 #if defined(MBEDTLS_ECP_RESTARTABLE) 0117 int MBEDTLS_PRIVATE(restart_enabled); /*!< The flag for restartable mode. */ 0118 mbedtls_ecp_restart_ctx MBEDTLS_PRIVATE(rs); /*!< The restart context for EC computations. */ 0119 #endif /* MBEDTLS_ECP_RESTARTABLE */ 0120 #else 0121 uint8_t MBEDTLS_PRIVATE(point_format); /*!< The format of point export in TLS messages 0122 as defined in RFC 4492. */ 0123 mbedtls_ecp_group_id MBEDTLS_PRIVATE(grp_id);/*!< The elliptic curve used. */ 0124 mbedtls_ecdh_variant MBEDTLS_PRIVATE(var); /*!< The ECDH implementation/structure used. */ 0125 union { 0126 mbedtls_ecdh_context_mbed MBEDTLS_PRIVATE(mbed_ecdh); 0127 #if defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED) 0128 mbedtls_ecdh_context_everest MBEDTLS_PRIVATE(everest_ecdh); 0129 #endif 0130 } MBEDTLS_PRIVATE(ctx); /*!< Implementation-specific context. The 0131 context in use is specified by the \c var 0132 field. */ 0133 #if defined(MBEDTLS_ECP_RESTARTABLE) 0134 uint8_t MBEDTLS_PRIVATE(restart_enabled); /*!< The flag for restartable mode. Functions of 0135 an alternative implementation not supporting 0136 restartable mode must return 0137 MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED error 0138 if this flag is set. */ 0139 #endif /* MBEDTLS_ECP_RESTARTABLE */ 0140 #endif /* MBEDTLS_ECDH_LEGACY_CONTEXT */ 0141 } 0142 mbedtls_ecdh_context; 0143 0144 /** 0145 * \brief Return the ECP group for provided context. 0146 * 0147 * \note To access group specific fields, users should use 0148 * `mbedtls_ecp_curve_info_from_grp_id` or 0149 * `mbedtls_ecp_group_load` on the extracted `group_id`. 0150 * 0151 * \param ctx The ECDH context to parse. This must not be \c NULL. 0152 * 0153 * \return The \c mbedtls_ecp_group_id of the context. 0154 */ 0155 mbedtls_ecp_group_id mbedtls_ecdh_get_grp_id(mbedtls_ecdh_context *ctx); 0156 0157 /** 0158 * \brief Check whether a given group can be used for ECDH. 0159 * 0160 * \param gid The ECP group ID to check. 0161 * 0162 * \return \c 1 if the group can be used, \c 0 otherwise 0163 */ 0164 int mbedtls_ecdh_can_do(mbedtls_ecp_group_id gid); 0165 0166 /** 0167 * \brief This function generates an ECDH keypair on an elliptic 0168 * curve. 0169 * 0170 * This function performs the first of two core computations 0171 * implemented during the ECDH key exchange. The second core 0172 * computation is performed by mbedtls_ecdh_compute_shared(). 0173 * 0174 * \see ecp.h 0175 * 0176 * \param grp The ECP group to use. This must be initialized and have 0177 * domain parameters loaded, for example through 0178 * mbedtls_ecp_load() or mbedtls_ecp_tls_read_group(). 0179 * \param d The destination MPI (private key). 0180 * This must be initialized. 0181 * \param Q The destination point (public key). 0182 * This must be initialized. 0183 * \param f_rng The RNG function to use. This must not be \c NULL. 0184 * \param p_rng The RNG context to be passed to \p f_rng. This may be 0185 * \c NULL in case \p f_rng doesn't need a context argument. 0186 * 0187 * \return \c 0 on success. 0188 * \return Another \c MBEDTLS_ERR_ECP_XXX or 0189 * \c MBEDTLS_MPI_XXX error code on failure. 0190 */ 0191 int mbedtls_ecdh_gen_public(mbedtls_ecp_group *grp, mbedtls_mpi *d, mbedtls_ecp_point *Q, 0192 int (*f_rng)(void *, unsigned char *, size_t), 0193 void *p_rng); 0194 0195 /** 0196 * \brief This function computes the shared secret. 0197 * 0198 * This function performs the second of two core computations 0199 * implemented during the ECDH key exchange. The first core 0200 * computation is performed by mbedtls_ecdh_gen_public(). 0201 * 0202 * \see ecp.h 0203 * 0204 * \note If \p f_rng is not NULL, it is used to implement 0205 * countermeasures against side-channel attacks. 0206 * For more information, see mbedtls_ecp_mul(). 0207 * 0208 * \param grp The ECP group to use. This must be initialized and have 0209 * domain parameters loaded, for example through 0210 * mbedtls_ecp_load() or mbedtls_ecp_tls_read_group(). 0211 * \param z The destination MPI (shared secret). 0212 * This must be initialized. 0213 * \param Q The public key from another party. 0214 * This must be initialized. 0215 * \param d Our secret exponent (private key). 0216 * This must be initialized. 0217 * \param f_rng The RNG function to use. This must not be \c NULL. 0218 * \param p_rng The RNG context to be passed to \p f_rng. This may be 0219 * \c NULL if \p f_rng is \c NULL or doesn't need a 0220 * context argument. 0221 * 0222 * \return \c 0 on success. 0223 * \return Another \c MBEDTLS_ERR_ECP_XXX or 0224 * \c MBEDTLS_MPI_XXX error code on failure. 0225 */ 0226 int mbedtls_ecdh_compute_shared(mbedtls_ecp_group *grp, mbedtls_mpi *z, 0227 const mbedtls_ecp_point *Q, const mbedtls_mpi *d, 0228 int (*f_rng)(void *, unsigned char *, size_t), 0229 void *p_rng); 0230 0231 /** 0232 * \brief This function initializes an ECDH context. 0233 * 0234 * \param ctx The ECDH context to initialize. This must not be \c NULL. 0235 */ 0236 void mbedtls_ecdh_init(mbedtls_ecdh_context *ctx); 0237 0238 /** 0239 * \brief This function sets up the ECDH context with the information 0240 * given. 0241 * 0242 * This function should be called after mbedtls_ecdh_init() but 0243 * before mbedtls_ecdh_make_params(). There is no need to call 0244 * this function before mbedtls_ecdh_read_params(). 0245 * 0246 * This is the first function used by a TLS server for ECDHE 0247 * ciphersuites. 0248 * 0249 * \param ctx The ECDH context to set up. This must be initialized. 0250 * \param grp_id The group id of the group to set up the context for. 0251 * 0252 * \return \c 0 on success. 0253 */ 0254 int mbedtls_ecdh_setup(mbedtls_ecdh_context *ctx, 0255 mbedtls_ecp_group_id grp_id); 0256 0257 /** 0258 * \brief This function frees a context. 0259 * 0260 * \param ctx The context to free. This may be \c NULL, in which 0261 * case this function does nothing. If it is not \c NULL, 0262 * it must point to an initialized ECDH context. 0263 */ 0264 void mbedtls_ecdh_free(mbedtls_ecdh_context *ctx); 0265 0266 /** 0267 * \brief This function generates an EC key pair and exports its 0268 * in the format used in a TLS ServerKeyExchange handshake 0269 * message. 0270 * 0271 * This is the second function used by a TLS server for ECDHE 0272 * ciphersuites. (It is called after mbedtls_ecdh_setup().) 0273 * 0274 * \see ecp.h 0275 * 0276 * \param ctx The ECDH context to use. This must be initialized 0277 * and bound to a group, for example via mbedtls_ecdh_setup(). 0278 * \param olen The address at which to store the number of Bytes written. 0279 * \param buf The destination buffer. This must be a writable buffer of 0280 * length \p blen Bytes. 0281 * \param blen The length of the destination buffer \p buf in Bytes. 0282 * \param f_rng The RNG function to use. This must not be \c NULL. 0283 * \param p_rng The RNG context to be passed to \p f_rng. This may be 0284 * \c NULL in case \p f_rng doesn't need a context argument. 0285 * 0286 * \return \c 0 on success. 0287 * \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of 0288 * operations was reached: see \c mbedtls_ecp_set_max_ops(). 0289 * \return Another \c MBEDTLS_ERR_ECP_XXX error code on failure. 0290 */ 0291 int mbedtls_ecdh_make_params(mbedtls_ecdh_context *ctx, size_t *olen, 0292 unsigned char *buf, size_t blen, 0293 int (*f_rng)(void *, unsigned char *, size_t), 0294 void *p_rng); 0295 0296 /** 0297 * \brief This function parses the ECDHE parameters in a 0298 * TLS ServerKeyExchange handshake message. 0299 * 0300 * \note In a TLS handshake, this is the how the client 0301 * sets up its ECDHE context from the server's public 0302 * ECDHE key material. 0303 * 0304 * \see ecp.h 0305 * 0306 * \param ctx The ECDHE context to use. This must be initialized. 0307 * \param buf On input, \c *buf must be the start of the input buffer. 0308 * On output, \c *buf is updated to point to the end of the 0309 * data that has been read. On success, this is the first byte 0310 * past the end of the ServerKeyExchange parameters. 0311 * On error, this is the point at which an error has been 0312 * detected, which is usually not useful except to debug 0313 * failures. 0314 * \param end The end of the input buffer. 0315 * 0316 * \return \c 0 on success. 0317 * \return An \c MBEDTLS_ERR_ECP_XXX error code on failure. 0318 * 0319 */ 0320 int mbedtls_ecdh_read_params(mbedtls_ecdh_context *ctx, 0321 const unsigned char **buf, 0322 const unsigned char *end); 0323 0324 /** 0325 * \brief This function sets up an ECDH context from an EC key. 0326 * 0327 * It is used by clients and servers in place of the 0328 * ServerKeyExchange for static ECDH, and imports ECDH 0329 * parameters from the EC key information of a certificate. 0330 * 0331 * \see ecp.h 0332 * 0333 * \param ctx The ECDH context to set up. This must be initialized. 0334 * \param key The EC key to use. This must be initialized. 0335 * \param side Defines the source of the key. Possible values are: 0336 * - #MBEDTLS_ECDH_OURS: The key is ours. 0337 * - #MBEDTLS_ECDH_THEIRS: The key is that of the peer. 0338 * 0339 * \return \c 0 on success. 0340 * \return Another \c MBEDTLS_ERR_ECP_XXX error code on failure. 0341 * 0342 */ 0343 int mbedtls_ecdh_get_params(mbedtls_ecdh_context *ctx, 0344 const mbedtls_ecp_keypair *key, 0345 mbedtls_ecdh_side side); 0346 0347 /** 0348 * \brief This function generates a public key and exports it 0349 * as a TLS ClientKeyExchange payload. 0350 * 0351 * This is the second function used by a TLS client for ECDH(E) 0352 * ciphersuites. 0353 * 0354 * \see ecp.h 0355 * 0356 * \param ctx The ECDH context to use. This must be initialized 0357 * and bound to a group, the latter usually by 0358 * mbedtls_ecdh_read_params(). 0359 * \param olen The address at which to store the number of Bytes written. 0360 * This must not be \c NULL. 0361 * \param buf The destination buffer. This must be a writable buffer 0362 * of length \p blen Bytes. 0363 * \param blen The size of the destination buffer \p buf in Bytes. 0364 * \param f_rng The RNG function to use. This must not be \c NULL. 0365 * \param p_rng The RNG context to be passed to \p f_rng. This may be 0366 * \c NULL in case \p f_rng doesn't need a context argument. 0367 * 0368 * \return \c 0 on success. 0369 * \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of 0370 * operations was reached: see \c mbedtls_ecp_set_max_ops(). 0371 * \return Another \c MBEDTLS_ERR_ECP_XXX error code on failure. 0372 */ 0373 int mbedtls_ecdh_make_public(mbedtls_ecdh_context *ctx, size_t *olen, 0374 unsigned char *buf, size_t blen, 0375 int (*f_rng)(void *, unsigned char *, size_t), 0376 void *p_rng); 0377 0378 /** 0379 * \brief This function parses and processes the ECDHE payload of a 0380 * TLS ClientKeyExchange message. 0381 * 0382 * This is the third function used by a TLS server for ECDH(E) 0383 * ciphersuites. (It is called after mbedtls_ecdh_setup() and 0384 * mbedtls_ecdh_make_params().) 0385 * 0386 * \see ecp.h 0387 * 0388 * \param ctx The ECDH context to use. This must be initialized 0389 * and bound to a group, for example via mbedtls_ecdh_setup(). 0390 * \param buf The pointer to the ClientKeyExchange payload. This must 0391 * be a readable buffer of length \p blen Bytes. 0392 * \param blen The length of the input buffer \p buf in Bytes. 0393 * 0394 * \return \c 0 on success. 0395 * \return An \c MBEDTLS_ERR_ECP_XXX error code on failure. 0396 */ 0397 int mbedtls_ecdh_read_public(mbedtls_ecdh_context *ctx, 0398 const unsigned char *buf, size_t blen); 0399 0400 /** 0401 * \brief This function derives and exports the shared secret. 0402 * 0403 * This is the last function used by both TLS client 0404 * and servers. 0405 * 0406 * \note If \p f_rng is not NULL, it is used to implement 0407 * countermeasures against side-channel attacks. 0408 * For more information, see mbedtls_ecp_mul(). 0409 * 0410 * \see ecp.h 0411 0412 * \param ctx The ECDH context to use. This must be initialized 0413 * and have its own private key generated and the peer's 0414 * public key imported. 0415 * \param olen The address at which to store the total number of 0416 * Bytes written on success. This must not be \c NULL. 0417 * \param buf The buffer to write the generated shared key to. This 0418 * must be a writable buffer of size \p blen Bytes. 0419 * \param blen The length of the destination buffer \p buf in Bytes. 0420 * \param f_rng The RNG function to use. This must not be \c NULL. 0421 * \param p_rng The RNG context. This may be \c NULL if \p f_rng 0422 * doesn't need a context argument. 0423 * 0424 * \return \c 0 on success. 0425 * \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of 0426 * operations was reached: see \c mbedtls_ecp_set_max_ops(). 0427 * \return Another \c MBEDTLS_ERR_ECP_XXX error code on failure. 0428 */ 0429 int mbedtls_ecdh_calc_secret(mbedtls_ecdh_context *ctx, size_t *olen, 0430 unsigned char *buf, size_t blen, 0431 int (*f_rng)(void *, unsigned char *, size_t), 0432 void *p_rng); 0433 0434 #if defined(MBEDTLS_ECP_RESTARTABLE) 0435 /** 0436 * \brief This function enables restartable EC computations for this 0437 * context. (Default: disabled.) 0438 * 0439 * \see \c mbedtls_ecp_set_max_ops() 0440 * 0441 * \note It is not possible to safely disable restartable 0442 * computations once enabled, except by free-ing the context, 0443 * which cancels possible in-progress operations. 0444 * 0445 * \param ctx The ECDH context to use. This must be initialized. 0446 */ 0447 void mbedtls_ecdh_enable_restart(mbedtls_ecdh_context *ctx); 0448 #endif /* MBEDTLS_ECP_RESTARTABLE */ 0449 0450 #ifdef __cplusplus 0451 } 0452 #endif 0453 0454 #endif /* ecdh.h */
| [ Source navigation ] | [ Diff markup ] | [ Identifier search ] | [ general search ] |
|
This page was automatically generated by the 2.3.7 LXR engine. The LXR team |
|