diff options
author | Richard Levitte <levitte@openssl.org> | 2016-12-30 21:57:28 +0100 |
---|---|---|
committer | Matt Caswell <matt@openssl.org> | 2017-01-26 10:54:36 +0000 |
commit | a39aa18644d3338087a827c6555b18bc857346fe (patch) | |
tree | 76de6f9b8fa690fb4fcfd6d023236ac57ced30b8 /crypto | |
parent | 00d965474b22b54e4275232bc71ee0c699c5cd21 (diff) |
Better check of DH parameters in TLS data
When the client reads DH parameters from the TLS stream, we only
checked that they all are non-zero. This change updates the check to
use DH_check_params()
DH_check_params() is a new function for light weight checking of the p
and g parameters:
check that p is odd
check that 1 < g < p - 1
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Diffstat (limited to 'crypto')
-rw-r--r-- | crypto/dh/dh_check.c | 40 |
1 files changed, 40 insertions, 0 deletions
diff --git a/crypto/dh/dh_check.c b/crypto/dh/dh_check.c index fcc1d99ad7..3b0fa5903e 100644 --- a/crypto/dh/dh_check.c +++ b/crypto/dh/dh_check.c @@ -13,6 +13,46 @@ #include "dh_locl.h" /*- + * Check that p and g are suitable enough + * + * p is odd + * 1 < g < p - 1 + */ + +int DH_check_params(const DH *dh, int *ret) +{ + int ok = 0; + BIGNUM *tmp = NULL; + BN_CTX *ctx = NULL; + + *ret = 0; + ctx = BN_CTX_new(); + if (ctx == NULL) + goto err; + BN_CTX_start(ctx); + tmp = BN_CTX_get(ctx); + if (tmp == NULL) + goto err; + + if (!BN_is_odd(dh->p)) + *ret |= DH_CHECK_P_NOT_PRIME; + if (BN_is_negative(dh->g) || BN_is_zero(dh->g) || BN_is_one(dh->g)) + *ret |= DH_NOT_SUITABLE_GENERATOR; + if (BN_copy(tmp, dh->p) == NULL || !BN_sub_word(tmp, 1)) + goto err; + if (BN_cmp(dh->g, tmp) >= 0) + *ret |= DH_NOT_SUITABLE_GENERATOR; + + ok = 1; + err: + if (ctx != NULL) { + BN_CTX_end(ctx); + BN_CTX_free(ctx); + } + return (ok); +} + +/*- * Check that p is a safe prime and * if g is 2, 3 or 5, check that it is a suitable generator * where |