generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Add JPAKE.

Browse Source
This commit is contained in:
Ben Laurie
2008-10-26 18:42:05 +00:00
parent 3b668eedda
commit 2124e869a8
29 changed files with 1416 additions and 214 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
apps/Makefile
View File

@@ -193,17 +193,17 @@ apps.o: ../include/openssl/e_os2.h ../include/openssl/ec.h
apps.o: ../include/openssl/ecdh.h ../include/openssl/ecdsa.h
apps.o: ../include/openssl/engine.h ../include/openssl/err.h
apps.o: ../include/openssl/evp.h ../include/openssl/fips.h
apps.o: ../include/openssl/lhash.h ../include/openssl/obj_mac.h
apps.o: ../include/openssl/objects.h ../include/openssl/ocsp.h
apps.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
apps.o: ../include/openssl/ossl_typ.h ../include/openssl/pem.h
apps.o: ../include/openssl/pem2.h ../include/openssl/pkcs12.h
apps.o: ../include/openssl/pkcs7.h ../include/openssl/rsa.h
apps.o: ../include/openssl/safestack.h ../include/openssl/sha.h
apps.o: ../include/openssl/stack.h ../include/openssl/symhacks.h
apps.o: ../include/openssl/txt_db.h ../include/openssl/ui.h
apps.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h
apps.o: ../include/openssl/x509v3.h apps.c apps.h
apps.o: ../include/openssl/jpake.h ../include/openssl/lhash.h
apps.o: ../include/openssl/obj_mac.h ../include/openssl/objects.h
apps.o: ../include/openssl/ocsp.h ../include/openssl/opensslconf.h
apps.o: ../include/openssl/opensslv.h ../include/openssl/ossl_typ.h
apps.o: ../include/openssl/pem.h ../include/openssl/pem2.h
apps.o: ../include/openssl/pkcs12.h ../include/openssl/pkcs7.h
apps.o: ../include/openssl/rsa.h ../include/openssl/safestack.h
apps.o: ../include/openssl/sha.h ../include/openssl/stack.h
apps.o: ../include/openssl/symhacks.h ../include/openssl/txt_db.h
apps.o: ../include/openssl/ui.h ../include/openssl/x509.h
apps.o: ../include/openssl/x509_vfy.h ../include/openssl/x509v3.h apps.c apps.h
asn1pars.o: ../e_os.h ../include/openssl/asn1.h ../include/openssl/bio.h
asn1pars.o: ../include/openssl/buffer.h ../include/openssl/conf.h
asn1pars.o: ../include/openssl/crypto.h ../include/openssl/e_os2.h

214
apps/apps.c
View File

@@ -115,6 +115,7 @@
#include <sys/types.h>
#include <sys/stat.h>
#include <ctype.h>
#include <assert.h>
#include <openssl/err.h>
#include <openssl/x509.h>
#include <openssl/x509v3.h>
@@ -129,6 +130,7 @@
#include <openssl/rsa.h>
#endif
#include <openssl/bn.h>
#include <openssl/jpake.h>
#define NON_MAIN
#include "apps.h"
@@ -2333,3 +2335,215 @@ void policies_print(BIO *out, X509_STORE_CTX *ctx)
if (free_out)
BIO_free(out);
}
static JPAKE_CTX *jpake_init(const char *us, const char *them,
const char *secret)
{
BIGNUM *p = NULL;
BIGNUM *g = NULL;
BIGNUM *q = NULL;
BIGNUM *bnsecret = BN_new();
JPAKE_CTX *ctx;
// Use a safe prime for p (that we found earlier)
BN_hex2bn(&p, "F9E5B365665EA7A05A9C534502780FEE6F1AB5BD4F49947FD036DBD7E905269AF46EF28B0FC07487EE4F5D20FB3C0AF8E700F3A2FA3414970CBED44FEDFF80CE78D800F184BB82435D137AADA2C6C16523247930A63B85661D1FC817A51ACD96168E95898A1F83A79FFB529368AA7833ABD1B0C3AEDDB14D2E1A2F71D99F763F");
g = BN_new();
BN_set_word(g, 2);
q = BN_new();
BN_rshift1(q, p);
BN_bin2bn(secret, strlen(secret), bnsecret);
ctx = JPAKE_CTX_new(us, them, p, g, q, bnsecret);
BN_free(bnsecret);
BN_free(q);
BN_free(g);
BN_free(p);
return ctx;
}
static void jpake_send_part(BIO *conn, const JPAKE_STEP_PART *p)
{
BN_print(conn, p->gx);
BIO_puts(conn, "\n");
BN_print(conn, p->zkpx.gr);
BIO_puts(conn, "\n");
BN_print(conn, p->zkpx.b);
BIO_puts(conn, "\n");
}
static void jpake_send_step1(BIO *bconn, JPAKE_CTX *ctx)
{
JPAKE_STEP1 s1;
JPAKE_STEP1_init(&s1);
JPAKE_STEP1_generate(&s1, ctx);
jpake_send_part(bconn, &s1.p1);
jpake_send_part(bconn, &s1.p2);
BIO_flush(bconn);
JPAKE_STEP1_release(&s1);
}
static void jpake_send_step2(BIO *bconn, JPAKE_CTX *ctx)
{
JPAKE_STEP2 s2;
JPAKE_STEP2_init(&s2);
JPAKE_STEP2_generate(&s2, ctx);
jpake_send_part(bconn, &s2);
BIO_flush(bconn);
JPAKE_STEP2_release(&s2);
}
static void jpake_send_step3a(BIO *bconn, JPAKE_CTX *ctx)
{
JPAKE_STEP3A s3a;
JPAKE_STEP3A_init(&s3a);
JPAKE_STEP3A_generate(&s3a, ctx);
BIO_write(bconn, s3a.hhk, sizeof s3a.hhk);
BIO_flush(bconn);
JPAKE_STEP3A_release(&s3a);
}
static void jpake_send_step3b(BIO *bconn, JPAKE_CTX *ctx)
{
JPAKE_STEP3B s3b;
JPAKE_STEP3B_init(&s3b);
JPAKE_STEP3B_generate(&s3b, ctx);
BIO_write(bconn, s3b.hk, sizeof s3b.hk);
BIO_flush(bconn);
JPAKE_STEP3B_release(&s3b);
}
static void readbn(BIGNUM **bn, BIO *bconn)
{
char buf[10240];
int l;
l = BIO_gets(bconn, buf, sizeof buf);
assert(l >= 0);
assert(buf[l-1] == '\n');
buf[l-1] = '\0';
BN_hex2bn(bn, buf);
}
static void jpake_receive_part(JPAKE_STEP_PART *p, BIO *bconn)
{
readbn(&p->gx, bconn);
readbn(&p->zkpx.gr, bconn);
readbn(&p->zkpx.b, bconn);
}
static void jpake_receive_step1(JPAKE_CTX *ctx, BIO *bconn)
{
JPAKE_STEP1 s1;
JPAKE_STEP1_init(&s1);
jpake_receive_part(&s1.p1, bconn);
jpake_receive_part(&s1.p2, bconn);
if(!JPAKE_STEP1_process(ctx, &s1))
{
ERR_print_errors(bio_err);
exit(1);
}
JPAKE_STEP1_release(&s1);
}
static void jpake_receive_step2(JPAKE_CTX *ctx, BIO *bconn)
{
JPAKE_STEP2 s2;
JPAKE_STEP2_init(&s2);
jpake_receive_part(&s2, bconn);
if(!JPAKE_STEP2_process(ctx, &s2))
{
ERR_print_errors(bio_err);
exit(1);
}
JPAKE_STEP2_release(&s2);
}
static void jpake_receive_step3a(JPAKE_CTX *ctx, BIO *bconn)
{
JPAKE_STEP3A s3a;
int l;
JPAKE_STEP3A_init(&s3a);
l = BIO_read(bconn, s3a.hhk, sizeof s3a.hhk);
assert(l == sizeof s3a.hhk);
if(!JPAKE_STEP3A_process(ctx, &s3a))
{
ERR_print_errors(bio_err);
exit(1);
}
JPAKE_STEP3A_release(&s3a);
}
static void jpake_receive_step3b(JPAKE_CTX *ctx, BIO *bconn)
{
JPAKE_STEP3B s3b;
int l;
JPAKE_STEP3B_init(&s3b);
l = BIO_read(bconn, s3b.hk, sizeof s3b.hk);
assert(l == sizeof s3b.hk);
if(!JPAKE_STEP3B_process(ctx, &s3b))
{
ERR_print_errors(bio_err);
exit(1);
}
JPAKE_STEP3B_release(&s3b);
}
void jpake_client_auth(BIO *out, BIO *conn, const char *secret)
{
JPAKE_CTX *ctx;
BIO *bconn;
BIO_puts(out, "Authenticating with JPAKE\n");
ctx = jpake_init("client", "server", secret);
bconn = BIO_new(BIO_f_buffer());
BIO_push(bconn, conn);
jpake_send_step1(bconn, ctx);
jpake_receive_step1(ctx, bconn);
jpake_send_step2(bconn, ctx);
jpake_receive_step2(ctx, bconn);
jpake_send_step3a(bconn, ctx);
jpake_receive_step3b(ctx, bconn);
BIO_puts(out, "JPAKE authentication succeeded\n");
BIO_pop(bconn);
BIO_free(bconn);
}
void jpake_server_auth(BIO *out, BIO *conn, const char *secret)
{
JPAKE_CTX *ctx;
BIO *bconn;
BIO_puts(out, "Authenticating with JPAKE\n");
ctx = jpake_init("server", "client", secret);
bconn = BIO_new(BIO_f_buffer());
BIO_push(bconn, conn);
jpake_receive_step1(ctx, bconn);
jpake_send_step1(bconn, ctx);
jpake_receive_step2(ctx, bconn);
jpake_send_step2(bconn, ctx);
jpake_receive_step3a(ctx, bconn);
jpake_send_step3b(bconn, ctx);
BIO_puts(out, "JPAKE authentication succeeded\n");
BIO_pop(bconn);
BIO_free(bconn);
}

2
apps/apps.h
View File

@@ -338,6 +338,8 @@ X509_NAME *parse_name(char *str, long chtype, int multirdn);
int args_verify(char ***pargs, int *pargc,
int *badarg, BIO *err, X509_VERIFY_PARAM **pm);
void policies_print(BIO *out, X509_STORE_CTX *ctx);
void jpake_client_auth(BIO *out, BIO *conn, const char *secret);
void jpake_server_auth(BIO *out, BIO *conn, const char *secret);
#define FORMAT_UNDEF 0
#define FORMAT_ASN1 1

11
apps/s_client.c
View File

@@ -338,6 +338,7 @@ int MAIN(int argc, char **argv)
int peerlen = sizeof(peer);
int enable_timeouts = 0 ;
long mtu = 0;
char *jpake_secret = NULL;
#if !defined(OPENSSL_NO_SSL2) && !defined(OPENSSL_NO_SSL3)
meth=SSLv23_client_method();
@@ -582,6 +583,11 @@ int MAIN(int argc, char **argv)
/* meth=TLSv1_client_method(); */
}
#endif
else if (strcmp(*argv,"-jpake") == 0)
{
if (--argc < 1) goto bad;
jpake_secret = *++argv;
}
else
{
BIO_printf(bio_err,"unknown option %s\n",*argv);
@@ -844,8 +850,6 @@ re_start:
else
sbio=BIO_new_socket(s,BIO_NOCLOSE);
if (nbio_test)
{
BIO *test;
@@ -890,6 +894,9 @@ SSL_set_tlsext_status_ids(con, ids);
}
#endif
if (jpake_secret)
jpake_client_auth(bio_c_out, sbio, jpake_secret);
SSL_set_bio(con,sbio,sbio);
SSL_set_connect_state(con);

13
apps/s_server.c
View File

@@ -742,6 +742,8 @@ BIO_printf(err, "cert_status: received %d ids\n", sk_OCSP_RESPID_num(ids));
#endif
int MAIN(int, char **);
static char *jpake_secret = NULL;
int MAIN(int argc, char *argv[])
{
X509_STORE *store = NULL;
@@ -774,7 +776,6 @@ int MAIN(int argc, char *argv[])
EVP_PKEY *s_key2 = NULL;
X509 *s_cert2 = NULL;
#endif
#ifndef OPENSSL_NO_TLSEXT
tlsextctx tlsextcbp = {NULL, NULL, SSL_TLSEXT_ERR_ALERT_WARNING};
#endif
@@ -1071,7 +1072,13 @@ int MAIN(int argc, char *argv[])
if (--argc < 1) goto bad;
s_key_file2= *(++argv);
}
#endif
else if (strcmp(*argv,"-jpake") == 0)
{
if (--argc < 1) goto bad;
jpake_secret = *(++argv);
}
else
{
BIO_printf(bio_err,"unknown option %s\n",*argv);
@@ -1673,6 +1680,10 @@ static int sv_body(char *hostname, int s, unsigned char *context)
test=BIO_new(BIO_f_nbio_test());
sbio=BIO_push(test,sbio);
}
if(jpake_secret)
jpake_server_auth(bio_s_out, sbio, jpake_secret);
SSL_set_bio(con,sbio,sbio);
SSL_set_accept_state(con);
/* SSL_set_fd(con,s); */