From 2650515394537ad30110f322e56d3afe710d0886 Mon Sep 17 00:00:00 2001 From: Richard Levitte Date: Fri, 30 Dec 2016 21:57:28 +0100 Subject: Better check of DH parameters in TLS data When the client reads DH parameters from the TLS stream, we only checked that they all are non-zero. This change updates the check to use DH_check_params() DH_check_params() is a new function for light weight checking of the p and g parameters: check that p is odd check that 1 < g < p - 1 Reviewed-by: Viktor Dukhovni --- crypto/dh/dh_check.c | 40 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) (limited to 'crypto/dh') diff --git a/crypto/dh/dh_check.c b/crypto/dh/dh_check.c index b362ccfea1..56894e315b 100644 --- a/crypto/dh/dh_check.c +++ b/crypto/dh/dh_check.c @@ -12,6 +12,46 @@ #include #include "dh_locl.h" +/*- + * Check that p and g are suitable enough + * + * p is odd + * 1 < g < p - 1 + */ + +int DH_check_params(const DH *dh, int *ret) +{ + int ok = 0; + BIGNUM *tmp = NULL; + BN_CTX *ctx = NULL; + + *ret = 0; + ctx = BN_CTX_new(); + if (ctx == NULL) + goto err; + BN_CTX_start(ctx); + tmp = BN_CTX_get(ctx); + if (tmp == NULL) + goto err; + + if (!BN_is_odd(dh->p)) + *ret |= DH_CHECK_P_NOT_PRIME; + if (BN_is_negative(dh->g) || BN_is_zero(dh->g) || BN_is_one(dh->g)) + *ret |= DH_NOT_SUITABLE_GENERATOR; + if (BN_copy(tmp, dh->p) == NULL || !BN_sub_word(tmp, 1)) + goto err; + if (BN_cmp(dh->g, tmp) >= 0) + *ret |= DH_NOT_SUITABLE_GENERATOR; + + ok = 1; + err: + if (ctx != NULL) { + BN_CTX_end(ctx); + BN_CTX_free(ctx); + } + return (ok); +} + /*- * Check that p is a safe prime and * if g is 2, 3 or 5, check that it is a suitable generator -- cgit v1.2.3