Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(3)

Issues Search
    My Issues | Starred     Open | Closed | All

Unified Diff: nss/lib/freebl/jpake.c

Issue 2078763002: Delete bundled copy of NSS and replace with README. (Closed) Base URL: https://chromium.googlesource.com/chromium/deps/nss@master
Patch Set: Delete bundled copy of NSS and replace with README. Created 4 years, 6 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « nss/lib/freebl/intel-gcm-x86-masm.asm ('k') | nss/lib/freebl/md2.c » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: nss/lib/freebl/jpake.c
diff --git a/nss/lib/freebl/jpake.c b/nss/lib/freebl/jpake.c
deleted file mode 100644
index 88cdc6edd9153086dcacd47df28e1f51fb18f5d3..0000000000000000000000000000000000000000
--- a/nss/lib/freebl/jpake.c
+++ /dev/null
@@ -1,495 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifdef FREEBL_NO_DEPEND
-#include "stubs.h"
-#endif
-
-#include "blapi.h"
-#include "secerr.h"
-#include "secitem.h"
-#include "secmpi.h"
-
-/* Hash an item's length and then its value. Only items smaller than 2^16 bytes
- * are allowed. Lengths are hashed in network byte order. This is designed
- * to match the OpenSSL J-PAKE implementation.
- */
-static mp_err
-hashSECItem(HASHContext * hash, const SECItem * it)
-{
- unsigned char length[2];
-
- if (it->len > 0xffff)
- return MP_BADARG;
-
- length[0] = (unsigned char) (it->len >> 8);
- length[1] = (unsigned char) (it->len);
- hash->hashobj->update(hash->hash_context, length, 2);
- hash->hashobj->update(hash->hash_context, it->data, it->len);
- return MP_OKAY;
-}
-
-/* Hash all public components of the signature, each prefixed with its
- length, and then convert the hash to an mp_int. */
-static mp_err
-hashPublicParams(HASH_HashType hashType, const SECItem * g,
- const SECItem * gv, const SECItem * gx,
- const SECItem * signerID, mp_int * h)
-{
- mp_err err;
- unsigned char hBuf[HASH_LENGTH_MAX];
- SECItem hItem;
- HASHContext hash;
-
- hash.hashobj = HASH_GetRawHashObject(hashType);
- if (hash.hashobj == NULL || hash.hashobj->length > sizeof hBuf) {
- return MP_BADARG;
- }
- hash.hash_context = hash.hashobj->create();
- if (hash.hash_context == NULL) {
- return MP_MEM;
- }
-
- hItem.data = hBuf;
- hItem.len = hash.hashobj->length;
-
- hash.hashobj->begin(hash.hash_context);
- CHECK_MPI_OK( hashSECItem(&hash, g) );
- CHECK_MPI_OK( hashSECItem(&hash, gv) );
- CHECK_MPI_OK( hashSECItem(&hash, gx) );
- CHECK_MPI_OK( hashSECItem(&hash, signerID) );
- hash.hashobj->end(hash.hash_context, hItem.data, &hItem.len,
- sizeof hBuf);
- SECITEM_TO_MPINT(hItem, h);
-
-cleanup:
- if (hash.hash_context != NULL) {
- hash.hashobj->destroy(hash.hash_context, PR_TRUE);
- }
-
- return err;
-}
-
-/* Generate a Schnorr signature for round 1 or round 2 */
-SECStatus
-JPAKE_Sign(PLArenaPool * arena, const PQGParams * pqg, HASH_HashType hashType,
- const SECItem * signerID, const SECItem * x,
- const SECItem * testRandom, const SECItem * gxIn, SECItem * gxOut,
- SECItem * gv, SECItem * r)
-{
- SECStatus rv = SECSuccess;
- mp_err err;
- mp_int p;
- mp_int q;
- mp_int g;
- mp_int X;
- mp_int GX;
- mp_int V;
- mp_int GV;
- mp_int h;
- mp_int tmp;
- mp_int R;
- SECItem v;
-
- if (!arena ||
- !pqg || !pqg->prime.data || pqg->prime.len == 0 ||
- !pqg->subPrime.data || pqg->subPrime.len == 0 ||
- !pqg->base.data || pqg->base.len == 0 ||
- !signerID || !signerID->data || signerID->len == 0 ||
- !x || !x->data || x->len == 0 ||
- (testRandom && (!testRandom->data || testRandom->len == 0)) ||
- (gxIn == NULL && (!gxOut || gxOut->data != NULL)) ||
- (gxIn != NULL && (!gxIn->data || gxIn->len == 0 || gxOut != NULL)) ||
- !gv || gv->data != NULL ||
- !r || r->data != NULL) {
- PORT_SetError(SEC_ERROR_INVALID_ARGS);
- return SECFailure;
- }
-
-
- MP_DIGITS(&p) = 0;
- MP_DIGITS(&q) = 0;
- MP_DIGITS(&g) = 0;
- MP_DIGITS(&X) = 0;
- MP_DIGITS(&GX) = 0;
- MP_DIGITS(&V) = 0;
- MP_DIGITS(&GV) = 0;
- MP_DIGITS(&h) = 0;
- MP_DIGITS(&tmp) = 0;
- MP_DIGITS(&R) = 0;
-
- CHECK_MPI_OK( mp_init(&p) );
- CHECK_MPI_OK( mp_init(&q) );
- CHECK_MPI_OK( mp_init(&g) );
- CHECK_MPI_OK( mp_init(&X) );
- CHECK_MPI_OK( mp_init(&GX) );
- CHECK_MPI_OK( mp_init(&V) );
- CHECK_MPI_OK( mp_init(&GV) );
- CHECK_MPI_OK( mp_init(&h) );
- CHECK_MPI_OK( mp_init(&tmp) );
- CHECK_MPI_OK( mp_init(&R) );
-
- SECITEM_TO_MPINT(pqg->prime, &p);
- SECITEM_TO_MPINT(pqg->subPrime, &q);
- SECITEM_TO_MPINT(pqg->base, &g);
- SECITEM_TO_MPINT(*x, &X);
-
- /* gx = g^x */
- if (gxIn == NULL) {
- CHECK_MPI_OK( mp_exptmod(&g, &X, &p, &GX) );
- MPINT_TO_SECITEM(&GX, gxOut, arena);
- gxIn = gxOut;
- } else {
- SECITEM_TO_MPINT(*gxIn, &GX);
- }
-
- /* v is a random value in the q subgroup */
- if (testRandom == NULL) {
- v.data = NULL;
- rv = DSA_NewRandom(arena, &pqg->subPrime, &v);
- if (rv != SECSuccess) {
- goto cleanup;
- }
- } else {
- v.data = testRandom->data;
- v.len = testRandom->len;
- }
- SECITEM_TO_MPINT(v, &V);
-
- /* gv = g^v (mod q), random v, 1 <= v < q */
- CHECK_MPI_OK( mp_exptmod(&g, &V, &p, &GV) );
- MPINT_TO_SECITEM(&GV, gv, arena);
-
- /* h = H(g, gv, gx, signerID) */
- CHECK_MPI_OK( hashPublicParams(hashType, &pqg->base, gv, gxIn, signerID,
- &h) );
-
- /* r = v - x*h (mod q) */
- CHECK_MPI_OK( mp_mulmod(&X, &h, &q, &tmp) );
- CHECK_MPI_OK( mp_submod(&V, &tmp, &q, &R) );
- MPINT_TO_SECITEM(&R, r, arena);
-
-cleanup:
- mp_clear(&p);
- mp_clear(&q);
- mp_clear(&g);
- mp_clear(&X);
- mp_clear(&GX);
- mp_clear(&V);
- mp_clear(&GV);
- mp_clear(&h);
- mp_clear(&tmp);
- mp_clear(&R);
-
- if (rv == SECSuccess && err != MP_OKAY) {
- MP_TO_SEC_ERROR(err);
- rv = SECFailure;
- }
- return rv;
-}
-
-/* Verify a Schnorr signature generated by the peer in round 1 or round 2. */
-SECStatus
-JPAKE_Verify(PLArenaPool * arena, const PQGParams * pqg, HASH_HashType hashType,
- const SECItem * signerID, const SECItem * peerID,
- const SECItem * gx, const SECItem * gv, const SECItem * r)
-{
- SECStatus rv = SECSuccess;
- mp_err err;
- mp_int p;
- mp_int q;
- mp_int g;
- mp_int p_minus_1;
- mp_int GX;
- mp_int h;
- mp_int one;
- mp_int R;
- mp_int gr;
- mp_int gxh;
- mp_int gr_gxh;
- SECItem calculated;
-
- if (!arena ||
- !pqg || !pqg->prime.data || pqg->prime.len == 0 ||
- !pqg->subPrime.data || pqg->subPrime.len == 0 ||
- !pqg->base.data || pqg->base.len == 0 ||
- !signerID || !signerID->data || signerID->len == 0 ||
- !peerID || !peerID->data || peerID->len == 0 ||
- !gx || !gx->data || gx->len == 0 ||
- !gv || !gv->data || gv->len == 0 ||
- !r || !r->data || r->len == 0 ||
- SECITEM_CompareItem(signerID, peerID) == SECEqual) {
- PORT_SetError(SEC_ERROR_INVALID_ARGS);
- return SECFailure;
- }
-
- MP_DIGITS(&p) = 0;
- MP_DIGITS(&q) = 0;
- MP_DIGITS(&g) = 0;
- MP_DIGITS(&p_minus_1) = 0;
- MP_DIGITS(&GX) = 0;
- MP_DIGITS(&h) = 0;
- MP_DIGITS(&one) = 0;
- MP_DIGITS(&R) = 0;
- MP_DIGITS(&gr) = 0;
- MP_DIGITS(&gxh) = 0;
- MP_DIGITS(&gr_gxh) = 0;
- calculated.data = NULL;
-
- CHECK_MPI_OK( mp_init(&p) );
- CHECK_MPI_OK( mp_init(&q) );
- CHECK_MPI_OK( mp_init(&g) );
- CHECK_MPI_OK( mp_init(&p_minus_1) );
- CHECK_MPI_OK( mp_init(&GX) );
- CHECK_MPI_OK( mp_init(&h) );
- CHECK_MPI_OK( mp_init(&one) );
- CHECK_MPI_OK( mp_init(&R) );
- CHECK_MPI_OK( mp_init(&gr) );
- CHECK_MPI_OK( mp_init(&gxh) );
- CHECK_MPI_OK( mp_init(&gr_gxh) );
-
- SECITEM_TO_MPINT(pqg->prime, &p);
- SECITEM_TO_MPINT(pqg->subPrime, &q);
- SECITEM_TO_MPINT(pqg->base, &g);
- SECITEM_TO_MPINT(*gx, &GX);
- SECITEM_TO_MPINT(*r, &R);
-
- CHECK_MPI_OK( mp_sub_d(&p, 1, &p_minus_1) );
- CHECK_MPI_OK( mp_exptmod(&GX, &q, &p, &one) );
- /* Check g^x is in [1, p-2], R is in [0, q-1], and (g^x)^q mod p == 1 */
- if (!(mp_cmp_z(&GX) > 0 &&
- mp_cmp(&GX, &p_minus_1) < 0 &&
- mp_cmp(&R, &q) < 0 &&
- mp_cmp_d(&one, 1) == 0)) {
- goto badSig;
- }
-
- CHECK_MPI_OK( hashPublicParams(hashType, &pqg->base, gv, gx, peerID,
- &h) );
-
- /* Calculate g^v = g^r * g^x^h */
- CHECK_MPI_OK( mp_exptmod(&g, &R, &p, &gr) );
- CHECK_MPI_OK( mp_exptmod(&GX, &h, &p, &gxh) );
- CHECK_MPI_OK( mp_mulmod(&gr, &gxh, &p, &gr_gxh) );
-
- /* Compare calculated g^v to given g^v */
- MPINT_TO_SECITEM(&gr_gxh, &calculated, arena);
- if (calculated.len == gv->len &&
- NSS_SecureMemcmp(calculated.data, gv->data, calculated.len) == 0) {
- rv = SECSuccess;
- } else {
-badSig: PORT_SetError(SEC_ERROR_BAD_SIGNATURE);
- rv = SECFailure;
- }
-
-cleanup:
- mp_clear(&p);
- mp_clear(&q);
- mp_clear(&g);
- mp_clear(&p_minus_1);
- mp_clear(&GX);
- mp_clear(&h);
- mp_clear(&one);
- mp_clear(&R);
- mp_clear(&gr);
- mp_clear(&gxh);
- mp_clear(&gr_gxh);
-
- if (rv == SECSuccess && err != MP_OKAY) {
- MP_TO_SEC_ERROR(err);
- rv = SECFailure;
- }
- return rv;
-}
-
-/* Calculate base = gx1*gx3*gx4 (mod p), i.e. g^(x1+x3+x4) (mod p) */
-static mp_err
-jpake_Round2Base(const SECItem * gx1, const SECItem * gx3,
- const SECItem * gx4, const mp_int * p, mp_int * base)
-{
- mp_err err;
- mp_int GX1;
- mp_int GX3;
- mp_int GX4;
- mp_int tmp;
-
- MP_DIGITS(&GX1) = 0;
- MP_DIGITS(&GX3) = 0;
- MP_DIGITS(&GX4) = 0;
- MP_DIGITS(&tmp) = 0;
-
- CHECK_MPI_OK( mp_init(&GX1) );
- CHECK_MPI_OK( mp_init(&GX3) );
- CHECK_MPI_OK( mp_init(&GX4) );
- CHECK_MPI_OK( mp_init(&tmp) );
-
- SECITEM_TO_MPINT(*gx1, &GX1);
- SECITEM_TO_MPINT(*gx3, &GX3);
- SECITEM_TO_MPINT(*gx4, &GX4);
-
- /* In round 2, the peer/attacker sends us g^x3 and g^x4 and the protocol
- requires that these values are distinct. */
- if (mp_cmp(&GX3, &GX4) == 0) {
- return MP_BADARG;
- }
-
- CHECK_MPI_OK( mp_mul(&GX1, &GX3, &tmp) );
- CHECK_MPI_OK( mp_mul(&tmp, &GX4, &tmp) );
- CHECK_MPI_OK( mp_mod(&tmp, p, base) );
-
-cleanup:
- mp_clear(&GX1);
- mp_clear(&GX3);
- mp_clear(&GX4);
- mp_clear(&tmp);
- return err;
-}
-
-SECStatus
-JPAKE_Round2(PLArenaPool * arena,
- const SECItem * p, const SECItem *q, const SECItem * gx1,
- const SECItem * gx3, const SECItem * gx4, SECItem * base,
- const SECItem * x2, const SECItem * s, SECItem * x2s)
-{
- mp_err err;
- mp_int P;
- mp_int Q;
- mp_int X2;
- mp_int S;
- mp_int result;
-
- if (!arena ||
- !p || !p->data || p->len == 0 ||
- !q || !q->data || q->len == 0 ||
- !gx1 || !gx1->data || gx1->len == 0 ||
- !gx3 || !gx3->data || gx3->len == 0 ||
- !gx4 || !gx4->data || gx4->len == 0 ||
- !base || base->data != NULL ||
- (x2s != NULL && (x2s->data != NULL ||
- !x2 || !x2->data || x2->len == 0 ||
- !s || !s->data || s->len == 0))) {
- PORT_SetError(SEC_ERROR_INVALID_ARGS);
- return SECFailure;
- }
-
- MP_DIGITS(&P) = 0;
- MP_DIGITS(&Q) = 0;
- MP_DIGITS(&X2) = 0;
- MP_DIGITS(&S) = 0;
- MP_DIGITS(&result) = 0;
-
- CHECK_MPI_OK( mp_init(&P) );
- CHECK_MPI_OK( mp_init(&Q) );
- CHECK_MPI_OK( mp_init(&result) );
-
- if (x2s != NULL) {
- CHECK_MPI_OK( mp_init(&X2) );
- CHECK_MPI_OK( mp_init(&S) );
-
- SECITEM_TO_MPINT(*q, &Q);
- SECITEM_TO_MPINT(*x2, &X2);
-
- SECITEM_TO_MPINT(*s, &S);
- /* S must be in [1, Q-1] */
- if (mp_cmp_z(&S) <= 0 || mp_cmp(&S, &Q) >= 0) {
- err = MP_BADARG;
- goto cleanup;
- }
-
- CHECK_MPI_OK( mp_mulmod(&X2, &S, &Q, &result) );
- MPINT_TO_SECITEM(&result, x2s, arena);
- }
-
- SECITEM_TO_MPINT(*p, &P);
- CHECK_MPI_OK( jpake_Round2Base(gx1, gx3, gx4, &P, &result) );
- MPINT_TO_SECITEM(&result, base, arena);
-
-cleanup:
- mp_clear(&P);
- mp_clear(&Q);
- mp_clear(&X2);
- mp_clear(&S);
- mp_clear(&result);
-
- if (err != MP_OKAY) {
- MP_TO_SEC_ERROR(err);
- return SECFailure;
- }
- return SECSuccess;
-}
-
-SECStatus
-JPAKE_Final(PLArenaPool * arena, const SECItem * p, const SECItem * q,
- const SECItem * x2, const SECItem * gx4, const SECItem * x2s,
- const SECItem * B, SECItem * K)
-{
- mp_err err;
- mp_int P;
- mp_int Q;
- mp_int tmp;
- mp_int exponent;
- mp_int divisor;
- mp_int base;
-
- if (!arena ||
- !p || !p->data || p->len == 0 ||
- !q || !q->data || q->len == 0 ||
- !x2 || !x2->data || x2->len == 0 ||
- !gx4 || !gx4->data || gx4->len == 0 ||
- !x2s || !x2s->data || x2s->len == 0 ||
- !B || !B->data || B->len == 0 ||
- !K || K->data != NULL) {
- PORT_SetError(SEC_ERROR_INVALID_ARGS);
- return SECFailure;
- }
-
- MP_DIGITS(&P) = 0;
- MP_DIGITS(&Q) = 0;
- MP_DIGITS(&tmp) = 0;
- MP_DIGITS(&exponent) = 0;
- MP_DIGITS(&divisor) = 0;
- MP_DIGITS(&base) = 0;
-
- CHECK_MPI_OK( mp_init(&P) );
- CHECK_MPI_OK( mp_init(&Q) );
- CHECK_MPI_OK( mp_init(&tmp) );
- CHECK_MPI_OK( mp_init(&exponent) );
- CHECK_MPI_OK( mp_init(&divisor) );
- CHECK_MPI_OK( mp_init(&base) );
-
- /* exponent = -x2s (mod q) */
- SECITEM_TO_MPINT(*q, &Q);
- SECITEM_TO_MPINT(*x2s, &tmp);
- /* q == 0 (mod q), so q - x2s == -x2s (mod q) */
- CHECK_MPI_OK( mp_sub(&Q, &tmp, &exponent) );
-
- /* divisor = gx4^-x2s = 1/(gx4^x2s) (mod p) */
- SECITEM_TO_MPINT(*p, &P);
- SECITEM_TO_MPINT(*gx4, &tmp);
- CHECK_MPI_OK( mp_exptmod(&tmp, &exponent, &P, &divisor) );
-
- /* base = B*divisor = B/(gx4^x2s) (mod p) */
- SECITEM_TO_MPINT(*B, &tmp);
- CHECK_MPI_OK( mp_mulmod(&divisor, &tmp, &P, &base) );
-
- /* tmp = base^x2 (mod p) */
- SECITEM_TO_MPINT(*x2, &exponent);
- CHECK_MPI_OK( mp_exptmod(&base, &exponent, &P, &tmp) );
-
- MPINT_TO_SECITEM(&tmp, K, arena);
-
-cleanup:
- mp_clear(&P);
- mp_clear(&Q);
- mp_clear(&tmp);
- mp_clear(&exponent);
- mp_clear(&divisor);
- mp_clear(&base);
-
- if (err != MP_OKAY) {
- MP_TO_SEC_ERROR(err);
- return SECFailure;
- }
- return SECSuccess;
-}
« no previous file with comments | « nss/lib/freebl/intel-gcm-x86-masm.asm ('k') | nss/lib/freebl/md2.c » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698