X-Git-Url: https://asedeno.scripts.mit.edu/gitweb/?a=blobdiff_plain;f=sshecc.c;h=541dd63cdb885b9b645be8aa41c9d4ac6dcfbcc8;hb=af1460d6e5044a3344aaacd15c91cfdcb58578e7;hp=6da0fe260ca3e1b227e64a434a6e6316039d6a3f;hpb=8dab2c24404b6f14ffb9472799d7621077a73bd6;p=PuTTY.git

diff --git a/sshecc.c b/sshecc.c
index 6da0fe26..541dd63c 100644
--- a/sshecc.c
+++ b/sshecc.c
@@ -24,6 +24,10 @@
  * Handbook of elliptic and hyperelliptic curve cryptography, Chapter 13
  *   http://cs.ucsb.edu/~koc/ccs130h/2013/EllipticHyperelliptic-CohenFrey.pdf
  *
+ * Curve25519 spec from libssh (with reference to other things in the
+ * libssh code):
+ *   https://git.libssh.org/users/aris/libssh.git/tree/doc/curve25519-sha256@libssh.org.txt
+ *
  * Edwards DSA:
  *   http://ed25519.cr.yp.to/ed25519-20110926.pdf
  */
@@ -38,10 +42,10 @@
  */
 
 static void initialise_wcurve(struct ec_curve *curve, int bits,
-                              unsigned char *p,
-                              unsigned char *a, unsigned char *b,
-                              unsigned char *n, unsigned char *Gx,
-                              unsigned char *Gy)
+                              const unsigned char *p,
+                              const unsigned char *a, const unsigned char *b,
+                              const unsigned char *n, const unsigned char *Gx,
+                              const unsigned char *Gy)
 {
     int length = bits / 8;
     if (bits % 8) ++length;
@@ -64,9 +68,9 @@ static void initialise_wcurve(struct ec_curve *curve, int bits,
 }
 
 static void initialise_mcurve(struct ec_curve *curve, int bits,
-                              unsigned char *p,
-                              unsigned char *a, unsigned char *b,
-                              unsigned char *Gx)
+                              const unsigned char *p,
+                              const unsigned char *a, const unsigned char *b,
+                              const unsigned char *Gx)
 {
     int length = bits / 8;
     if (bits % 8) ++length;
@@ -89,9 +93,9 @@ static void initialise_mcurve(struct ec_curve *curve, int bits,
 }
 
 static void initialise_ecurve(struct ec_curve *curve, int bits,
-                              unsigned char *p,
-                              unsigned char *l, unsigned char *d,
-                              unsigned char *Bx, unsigned char *By)
+                              const unsigned char *p,
+                              const unsigned char *l, const unsigned char *d,
+                              const unsigned char *Bx, const unsigned char *By)
 {
     int length = bits / 8;
     if (bits % 8) ++length;
@@ -119,37 +123,37 @@ static struct ec_curve *ec_p256(void)
 
     if (!initialised)
     {
-        unsigned char p[] = {
+        static const unsigned char p[] = {
             0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01,
             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
             0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff,
             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
         };
-        unsigned char a[] = {
+        static const unsigned char a[] = {
             0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01,
             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
             0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff,
             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfc
         };
-        unsigned char b[] = {
+        static const unsigned char b[] = {
             0x5a, 0xc6, 0x35, 0xd8, 0xaa, 0x3a, 0x93, 0xe7,
             0xb3, 0xeb, 0xbd, 0x55, 0x76, 0x98, 0x86, 0xbc,
             0x65, 0x1d, 0x06, 0xb0, 0xcc, 0x53, 0xb0, 0xf6,
             0x3b, 0xce, 0x3c, 0x3e, 0x27, 0xd2, 0x60, 0x4b
         };
-        unsigned char n[] = {
+        static const unsigned char n[] = {
             0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00,
             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
             0xbc, 0xe6, 0xfa, 0xad, 0xa7, 0x17, 0x9e, 0x84,
             0xf3, 0xb9, 0xca, 0xc2, 0xfc, 0x63, 0x25, 0x51
         };
-        unsigned char Gx[] = {
+        static const unsigned char Gx[] = {
             0x6b, 0x17, 0xd1, 0xf2, 0xe1, 0x2c, 0x42, 0x47,
             0xf8, 0xbc, 0xe6, 0xe5, 0x63, 0xa4, 0x40, 0xf2,
             0x77, 0x03, 0x7d, 0x81, 0x2d, 0xeb, 0x33, 0xa0,
             0xf4, 0xa1, 0x39, 0x45, 0xd8, 0x98, 0xc2, 0x96
         };
-        unsigned char Gy[] = {
+        static const unsigned char Gy[] = {
             0x4f, 0xe3, 0x42, 0xe2, 0xfe, 0x1a, 0x7f, 0x9b,
             0x8e, 0xe7, 0xeb, 0x4a, 0x7c, 0x0f, 0x9e, 0x16,
             0x2b, 0xce, 0x33, 0x57, 0x6b, 0x31, 0x5e, 0xce,
@@ -157,7 +161,7 @@ static struct ec_curve *ec_p256(void)
         };
 
         initialise_wcurve(&curve, 256, p, a, b, n, Gx, Gy);
-        curve.name = "nistp256";
+        curve.textname = curve.name = "nistp256";
 
         /* Now initialised, no need to do it again */
         initialised = 1;
@@ -173,7 +177,7 @@ static struct ec_curve *ec_p384(void)
 
     if (!initialised)
     {
-        unsigned char p[] = {
+        static const unsigned char p[] = {
             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
@@ -181,7 +185,7 @@ static struct ec_curve *ec_p384(void)
             0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00,
             0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff
         };
-        unsigned char a[] = {
+        static const unsigned char a[] = {
             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
@@ -189,7 +193,7 @@ static struct ec_curve *ec_p384(void)
             0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00,
             0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xfc
         };
-        unsigned char b[] = {
+        static const unsigned char b[] = {
             0xb3, 0x31, 0x2f, 0xa7, 0xe2, 0x3e, 0xe7, 0xe4,
             0x98, 0x8e, 0x05, 0x6b, 0xe3, 0xf8, 0x2d, 0x19,
             0x18, 0x1d, 0x9c, 0x6e, 0xfe, 0x81, 0x41, 0x12,
@@ -197,7 +201,7 @@ static struct ec_curve *ec_p384(void)
             0xc6, 0x56, 0x39, 0x8d, 0x8a, 0x2e, 0xd1, 0x9d,
             0x2a, 0x85, 0xc8, 0xed, 0xd3, 0xec, 0x2a, 0xef
         };
-        unsigned char n[] = {
+        static const unsigned char n[] = {
             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
@@ -205,7 +209,7 @@ static struct ec_curve *ec_p384(void)
             0x58, 0x1a, 0x0d, 0xb2, 0x48, 0xb0, 0xa7, 0x7a,
             0xec, 0xec, 0x19, 0x6a, 0xcc, 0xc5, 0x29, 0x73
         };
-        unsigned char Gx[] = {
+        static const unsigned char Gx[] = {
             0xaa, 0x87, 0xca, 0x22, 0xbe, 0x8b, 0x05, 0x37,
             0x8e, 0xb1, 0xc7, 0x1e, 0xf3, 0x20, 0xad, 0x74,
             0x6e, 0x1d, 0x3b, 0x62, 0x8b, 0xa7, 0x9b, 0x98,
@@ -213,7 +217,7 @@ static struct ec_curve *ec_p384(void)
             0x55, 0x02, 0xf2, 0x5d, 0xbf, 0x55, 0x29, 0x6c,
             0x3a, 0x54, 0x5e, 0x38, 0x72, 0x76, 0x0a, 0xb7
         };
-        unsigned char Gy[] = {
+        static const unsigned char Gy[] = {
             0x36, 0x17, 0xde, 0x4a, 0x96, 0x26, 0x2c, 0x6f,
             0x5d, 0x9e, 0x98, 0xbf, 0x92, 0x92, 0xdc, 0x29,
             0xf8, 0xf4, 0x1d, 0xbd, 0x28, 0x9a, 0x14, 0x7c,
@@ -223,7 +227,7 @@ static struct ec_curve *ec_p384(void)
         };
 
         initialise_wcurve(&curve, 384, p, a, b, n, Gx, Gy);
-        curve.name = "nistp384";
+        curve.textname = curve.name = "nistp384";
 
         /* Now initialised, no need to do it again */
         initialised = 1;
@@ -239,7 +243,7 @@ static struct ec_curve *ec_p521(void)
 
     if (!initialised)
     {
-        unsigned char p[] = {
+        static const unsigned char p[] = {
             0x01, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
@@ -250,7 +254,7 @@ static struct ec_curve *ec_p521(void)
             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
             0xff, 0xff
         };
-        unsigned char a[] = {
+        static const unsigned char a[] = {
             0x01, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
@@ -261,7 +265,7 @@ static struct ec_curve *ec_p521(void)
             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
             0xff, 0xfc
         };
-        unsigned char b[] = {
+        static const unsigned char b[] = {
             0x00, 0x51, 0x95, 0x3e, 0xb9, 0x61, 0x8e, 0x1c,
             0x9a, 0x1f, 0x92, 0x9a, 0x21, 0xa0, 0xb6, 0x85,
             0x40, 0xee, 0xa2, 0xda, 0x72, 0x5b, 0x99, 0xb3,
@@ -272,7 +276,7 @@ static struct ec_curve *ec_p521(void)
             0x34, 0xf1, 0xef, 0x45, 0x1f, 0xd4, 0x6b, 0x50,
             0x3f, 0x00
         };
-        unsigned char n[] = {
+        static const unsigned char n[] = {
             0x01, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
@@ -283,7 +287,7 @@ static struct ec_curve *ec_p521(void)
             0x47, 0xae, 0xbb, 0x6f, 0xb7, 0x1e, 0x91, 0x38,
             0x64, 0x09
         };
-        unsigned char Gx[] = {
+        static const unsigned char Gx[] = {
             0x00, 0xc6, 0x85, 0x8e, 0x06, 0xb7, 0x04, 0x04,
             0xe9, 0xcd, 0x9e, 0x3e, 0xcb, 0x66, 0x23, 0x95,
             0xb4, 0x42, 0x9c, 0x64, 0x81, 0x39, 0x05, 0x3f,
@@ -294,7 +298,7 @@ static struct ec_curve *ec_p521(void)
             0x42, 0x9b, 0xf9, 0x7e, 0x7e, 0x31, 0xc2, 0xe5,
             0xbd, 0x66
         };
-        unsigned char Gy[] = {
+        static const unsigned char Gy[] = {
             0x01, 0x18, 0x39, 0x29, 0x6a, 0x78, 0x9a, 0x3b,
             0xc0, 0x04, 0x5c, 0x8a, 0x5f, 0xb4, 0x2c, 0x7d,
             0x1b, 0xd9, 0x98, 0xf5, 0x44, 0x49, 0x57, 0x9b,
@@ -307,7 +311,7 @@ static struct ec_curve *ec_p521(void)
         };
 
         initialise_wcurve(&curve, 521, p, a, b, n, Gx, Gy);
-        curve.name = "nistp521";
+        curve.textname = curve.name = "nistp521";
 
         /* Now initialised, no need to do it again */
         initialised = 1;
@@ -323,25 +327,25 @@ static struct ec_curve *ec_curve25519(void)
 
     if (!initialised)
     {
-        unsigned char p[] = {
+        static const unsigned char p[] = {
             0x7f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xed
         };
-        unsigned char a[] = {
+        static const unsigned char a[] = {
             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
             0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0x6d, 0x06
         };
-        unsigned char b[] = {
+        static const unsigned char b[] = {
             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01
         };
-        unsigned char gx[32] = {
+        static const unsigned char gx[32] = {
             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
@@ -352,6 +356,7 @@ static struct ec_curve *ec_curve25519(void)
         /* This curve doesn't need a name, because it's never used in
          * any format that embeds the curve name */
         curve.name = NULL;
+        curve.textname = "Curve25519";
 
         /* Now initialised, no need to do it again */
         initialised = 1;
@@ -367,31 +372,31 @@ static struct ec_curve *ec_ed25519(void)
 
     if (!initialised)
     {
-        unsigned char q[] = {
+        static const unsigned char q[] = {
             0x7f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xed
         };
-        unsigned char l[32] = {
+        static const unsigned char l[32] = {
             0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
             0x14, 0xde, 0xf9, 0xde, 0xa2, 0xf7, 0x9c, 0xd6,
             0x58, 0x12, 0x63, 0x1a, 0x5c, 0xf5, 0xd3, 0xed
         };
-        unsigned char d[32] = {
+        static const unsigned char d[32] = {
             0x52, 0x03, 0x6c, 0xee, 0x2b, 0x6f, 0xfe, 0x73,
             0x8c, 0xc7, 0x40, 0x79, 0x77, 0x79, 0xe8, 0x98,
             0x00, 0x70, 0x0a, 0x4d, 0x41, 0x41, 0xd8, 0xab,
             0x75, 0xeb, 0x4d, 0xca, 0x13, 0x59, 0x78, 0xa3
         };
-        unsigned char Bx[32] = {
+        static const unsigned char Bx[32] = {
             0x21, 0x69, 0x36, 0xd3, 0xcd, 0x6e, 0x53, 0xfe,
             0xc0, 0xa4, 0xe2, 0x31, 0xfd, 0xd6, 0xdc, 0x5c,
             0x69, 0x2c, 0xc7, 0x60, 0x95, 0x25, 0xa7, 0xb2,
             0xc9, 0x56, 0x2d, 0x60, 0x8f, 0x25, 0xd5, 0x1a
         };
-        unsigned char By[32] = {
+        static const unsigned char By[32] = {
             0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66,
             0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66,
             0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66,
@@ -403,6 +408,7 @@ static struct ec_curve *ec_ed25519(void)
         curve.name = NULL;
 
         initialise_ecurve(&curve, 256, q, l, d, Bx, By);
+        curve.textname = "Ed25519";
 
         /* Now initialised, no need to do it again */
         initialised = 1;
@@ -1642,6 +1648,7 @@ static int decodepoint_ed(const char *p, int length, struct ec_point *point)
     /* Read x bit and then reset it */
     negative = bignum_bit(point->y, point->curve->fieldBits - 1);
     bignum_set_bit(point->y, point->curve->fieldBits - 1, 0);
+    bn_restore_invariant(point->y);
 
     /* Get the x from the y */
     point->x = ecp_edx(point->curve, point->y);
@@ -1764,6 +1771,7 @@ static void *ecdsa_newkey(const struct ssh_signkey *self,
     /* Curve name is duplicated for Weierstrass form */
     if (curve->type == EC_WEIERSTRASS) {
         getstring(&data, &len, &p, &slen);
+	if (!p) return NULL;
         if (!match_ssh_id(slen, p, curve->name)) return NULL;
     }
 
@@ -1775,11 +1783,11 @@ static void *ecdsa_newkey(const struct ssh_signkey *self,
     ec->publicKey.x = NULL;
     ec->publicKey.y = NULL;
     ec->publicKey.z = NULL;
+    ec->privateKey = NULL;
     if (!getmppoint(&data, &len, &ec->publicKey)) {
         ecdsa_freekey(ec);
         return NULL;
     }
-    ec->privateKey = NULL;
 
     if (!ec->publicKey.x || !ec->publicKey.y ||
         bignum_cmp(ec->publicKey.x, curve->p) >= 0 ||
@@ -2688,15 +2696,30 @@ static Bignum ecdh_calculate(const Bignum private,
     p->x = NULL;
 
     if (p->curve->type == EC_MONTGOMERY) {
-        /* Do conversion in network byte order */
+        /*
+         * Endianness-swap. The Curve25519 algorithm definition
+         * assumes you were doing your computation in arrays of 32
+         * little-endian bytes, and now specifies that you take your
+         * final one of those and convert it into a bignum in
+         * _network_ byte order, i.e. big-endian.
+         *
+         * In particular, the spec says, you convert the _whole_ 32
+         * bytes into a bignum. That is, on the rare occasions that
+         * p->x has come out with the most significant 8 bits zero, we
+         * have to imagine that being represented by a 32-byte string
+         * with the last byte being zero, so that has to be converted
+         * into an SSH-2 bignum with the _low_ byte zero, i.e. a
+         * multiple of 256.
+         */
         int i;
-        int bytes = (bignum_bitcount(ret)+7) / 8;
+        int bytes = (p->curve->fieldBits+7) / 8;
         unsigned char *byteorder = snewn(bytes, unsigned char);
         for (i = 0; i < bytes; ++i) {
             byteorder[i] = bignum_byte(ret, i);
         }
         freebn(ret);
         ret = bignum_from_bytes(byteorder, bytes);
+        smemclr(byteorder, bytes);
         sfree(byteorder);
     }
 
@@ -2704,6 +2727,13 @@ static Bignum ecdh_calculate(const Bignum private,
     return ret;
 }
 
+const char *ssh_ecdhkex_curve_textname(const struct ssh_kex *kex)
+{
+    const struct eckex_extra *extra = (const struct eckex_extra *)kex->extra;
+    struct ec_curve *curve = extra->curve();
+    return curve->textname;
+}
+
 void *ssh_ecdhkex_newkey(const struct ssh_kex *kex)
 {
     const struct eckex_extra *extra = (const struct eckex_extra *)kex->extra;