/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
/* plugins/preauth/spake/openssl.c - SPAKE implementations using OpenSSL */
/*
 * Copyright (C) 2015 by the Massachusetts Institute of Technology.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * * Redistributions of source code must retain the above copyright
 *   notice, this list of conditions and the following disclaimer.
 *
 * * Redistributions in binary form must reproduce the above copyright
 *   notice, this list of conditions and the following disclaimer in
 *   the documentation and/or other materials provided with the
 *   distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
 * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 * OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#include "k5-int.h"

#include "groups.h"
#include "iana.h"

#ifdef SPAKE_OPENSSL
#include <openssl/bn.h>
#include <openssl/ec.h>
#include <openssl/obj_mac.h>
#include <openssl/evp.h>

/* OpenSSL 1.1 standardizes constructor and destructor names, renaming
 * EVP_MD_CTX_create and EVP_MD_CTX_destroy. */
#if OPENSSL_VERSION_NUMBER < 0x10100000L
#define EVP_MD_CTX_new EVP_MD_CTX_create
#define EVP_MD_CTX_free EVP_MD_CTX_destroy
#endif

struct groupdata_st {
    const groupdef *gdef;
    EC_GROUP *group;
    BIGNUM *order;
    BN_CTX *ctx;
    EC_POINT *M;
    EC_POINT *N;
    const EVP_MD *md;
};

static void
ossl_fini(groupdata *gd)
{
    if (gd == NULL)
        return;

    EC_GROUP_free(gd->group);
    EC_POINT_free(gd->M);
    EC_POINT_free(gd->N);
    BN_CTX_free(gd->ctx);
    BN_free(gd->order);
    free(gd);
}

static krb5_error_code
ossl_init(krb5_context context, const groupdef *gdef, groupdata **gdata_out)
{
    const spake_iana *reg = gdef->reg;
    const EVP_MD *md;
    groupdata *gd;
    int nid;

    switch (reg->id) {
    case SPAKE_GROUP_P256:
        nid = NID_X9_62_prime256v1;
        md = EVP_sha256();
        break;
    case SPAKE_GROUP_P384:
        nid = NID_secp384r1;
        md = EVP_sha384();
        break;
    case SPAKE_GROUP_P521:
        nid = NID_secp521r1;
        md = EVP_sha512();
        break;
    default:
        return EINVAL;
    };

    gd = calloc(1, sizeof(*gd));
    if (gd == NULL)
        return ENOMEM;
    gd->gdef = gdef;

    gd->group = EC_GROUP_new_by_curve_name(nid);
    if (gd->group == NULL)
        goto error;

    gd->ctx = BN_CTX_new();
    if (gd->ctx == NULL)
        goto error;

    gd->order = BN_new();
    if (gd->order == NULL)
        goto error;
    if (!EC_GROUP_get_order(gd->group, gd->order, gd->ctx))
        goto error;

    gd->M = EC_POINT_new(gd->group);
    if (gd->M == NULL)
        goto error;
    if (!EC_POINT_oct2point(gd->group, gd->M, reg->m, reg->elem_len, gd->ctx))
        goto error;

    gd->N = EC_POINT_new(gd->group);
    if (gd->N == NULL)
        goto error;
    if (!EC_POINT_oct2point(gd->group, gd->N, reg->n, reg->elem_len, gd->ctx))
        goto error;

    gd->md = md;

    *gdata_out = gd;
    return 0;

error:
    ossl_fini(gd);
    return ENOMEM;
}

/* Convert pseudo-random bytes into a scalar value in constant time.
 * Return NULL on failure. */
static BIGNUM *
unmarshal_w(const groupdata *gdata, const uint8_t *wbytes)
{
    const spake_iana *reg = gdata->gdef->reg;
    BIGNUM *w = NULL;

    w = BN_new();
    if (w == NULL)
        return NULL;

    BN_set_flags(w, BN_FLG_CONSTTIME);

    if (BN_bin2bn(wbytes, reg->mult_len, w) &&
        BN_div(NULL, w, w, gdata->order, gdata->ctx))
        return w;

    BN_free(w);
    return NULL;
}

static krb5_error_code
ossl_keygen(krb5_context context, groupdata *gdata, const uint8_t *wbytes,
            krb5_boolean use_m, uint8_t *priv_out, uint8_t *pub_out)
{
    const spake_iana *reg = gdata->gdef->reg;
    const EC_POINT *constant = use_m ? gdata->M : gdata->N;
    krb5_boolean success = FALSE;
    EC_POINT *pub = NULL;
    BIGNUM *priv = NULL, *w = NULL;
    size_t len;

    w = unmarshal_w(gdata, wbytes);
    if (w == NULL)
        goto cleanup;

    pub = EC_POINT_new(gdata->group);
    if (pub == NULL)
        goto cleanup;

    priv = BN_new();
    if (priv == NULL)
        goto cleanup;

    if (!BN_rand_range(priv, gdata->order))
        goto cleanup;

    /* Compute priv*G + w*constant; EC_POINT_mul() does this in one call. */
    if (!EC_POINT_mul(gdata->group, pub, priv, constant, w, gdata->ctx))
        goto cleanup;

    /* Marshal priv into priv_out. */
    memset(priv_out, 0, reg->mult_len);
    BN_bn2bin(priv, &priv_out[reg->mult_len - BN_num_bytes(priv)]);

    /* Marshal pub into pub_out. */
    len = EC_POINT_point2oct(gdata->group, pub, POINT_CONVERSION_COMPRESSED,
                             pub_out, reg->elem_len, gdata->ctx);
    if (len != reg->elem_len)
        goto cleanup;

    success = TRUE;

cleanup:
    EC_POINT_free(pub);
    BN_clear_free(priv);
    BN_clear_free(w);
    return success ? 0 : ENOMEM;
}

static krb5_error_code
ossl_result(krb5_context context, groupdata *gdata, const uint8_t *wbytes,
            const uint8_t *ourpriv, const uint8_t *theirpub,
            krb5_boolean use_m, uint8_t *elem_out)
{
    const spake_iana *reg = gdata->gdef->reg;
    const EC_POINT *constant = use_m ? gdata->M : gdata->N;
    krb5_boolean success = FALSE, invalid = FALSE;
    EC_POINT *result = NULL, *pub = NULL;
    BIGNUM *priv = NULL, *w = NULL;
    size_t len;

    w = unmarshal_w(gdata, wbytes);
    if (w == NULL)
        goto cleanup;

    priv = BN_bin2bn(ourpriv, reg->mult_len, NULL);
    if (priv == NULL)
        goto cleanup;

    pub = EC_POINT_new(gdata->group);
    if (pub == NULL)
        goto cleanup;
    if (!EC_POINT_oct2point(gdata->group, pub, theirpub, reg->elem_len,
                            gdata->ctx)) {
        invalid = TRUE;
        goto cleanup;
    }

    /* Compute result = priv*(pub - w*constant), using result to hold the
     * intermediate steps. */
    result = EC_POINT_new(gdata->group);
    if (result == NULL)
        goto cleanup;
    if (!EC_POINT_mul(gdata->group, result, NULL, constant, w, gdata->ctx))
        goto cleanup;
    if (!EC_POINT_invert(gdata->group, result, gdata->ctx))
        goto cleanup;
    if (!EC_POINT_add(gdata->group, result, pub, result, gdata->ctx))
        goto cleanup;
    if (!EC_POINT_mul(gdata->group, result, NULL, result, priv, gdata->ctx))
        goto cleanup;

    /* Marshal result into elem_out. */
    len = EC_POINT_point2oct(gdata->group, result, POINT_CONVERSION_COMPRESSED,
                             elem_out, reg->elem_len, gdata->ctx);
    if (len != reg->elem_len)
        goto cleanup;

    success = TRUE;

cleanup:
    BN_clear_free(priv);
    BN_clear_free(w);
    EC_POINT_free(pub);
    EC_POINT_clear_free(result);
    return invalid ? EINVAL : (success ? 0 : ENOMEM);
}

static krb5_error_code
ossl_hash(krb5_context context, groupdata *gdata, const krb5_data *dlist,
          size_t ndata, uint8_t *result_out)
{
    EVP_MD_CTX *ctx;
    size_t i;
    int ok;

    ctx = EVP_MD_CTX_new();
    if (ctx == NULL)
        return ENOMEM;
    ok = EVP_DigestInit_ex(ctx, gdata->md, NULL);
    for (i = 0; i < ndata; i++)
        ok = ok && EVP_DigestUpdate(ctx, dlist[i].data, dlist[i].length);
    ok = ok && EVP_DigestFinal_ex(ctx, result_out, NULL);
    EVP_MD_CTX_free(ctx);
    return ok ? 0 : ENOMEM;
}

groupdef ossl_P256 = {
    .reg = &spake_iana_p256,
    .init = ossl_init,
    .fini = ossl_fini,
    .keygen = ossl_keygen,
    .result = ossl_result,
    .hash = ossl_hash,
};

groupdef ossl_P384 = {
    .reg = &spake_iana_p384,
    .init = ossl_init,
    .fini = ossl_fini,
    .keygen = ossl_keygen,
    .result = ossl_result,
    .hash = ossl_hash,
};

groupdef ossl_P521 = {
    .reg = &spake_iana_p521,
    .init = ossl_init,
    .fini = ossl_fini,
    .keygen = ossl_keygen,
    .result = ossl_result,
    .hash = ossl_hash,
};
#endif /* SPAKE_OPENSSL */