1 /* $OpenBSD: kexsntrup761x25519.c,v 1.1 2020/12/29 00:59:15 djm Exp $ */
3 * Copyright (c) 2019 Markus Friedl. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28 #ifdef USE_SNTRUP761X25519
30 #include <sys/types.h>
43 kex_kem_sntrup761x25519_keypair(struct kex *kex)
45 struct sshbuf *buf = NULL;
50 if ((buf = sshbuf_new()) == NULL)
51 return SSH_ERR_ALLOC_FAIL;
52 need = crypto_kem_sntrup761_PUBLICKEYBYTES + CURVE25519_SIZE;
53 if ((r = sshbuf_reserve(buf, need, &cp)) != 0)
55 crypto_kem_sntrup761_keypair(cp, kex->sntrup761_client_key);
57 dump_digest("client public key sntrup761:", cp,
58 crypto_kem_sntrup761_PUBLICKEYBYTES);
60 cp += crypto_kem_sntrup761_PUBLICKEYBYTES;
61 kexc25519_keygen(kex->c25519_client_key, cp);
63 dump_digest("client public key c25519:", cp, CURVE25519_SIZE);
65 kex->client_pub = buf;
73 kex_kem_sntrup761x25519_enc(struct kex *kex,
74 const struct sshbuf *client_blob, struct sshbuf **server_blobp,
75 struct sshbuf **shared_secretp)
77 struct sshbuf *server_blob = NULL;
78 struct sshbuf *buf = NULL;
79 const u_char *client_pub;
80 u_char *kem_key, *ciphertext, *server_pub;
81 u_char server_key[CURVE25519_SIZE];
82 u_char hash[SSH_DIGEST_MAX_LENGTH];
87 *shared_secretp = NULL;
89 /* client_blob contains both KEM and ECDH client pubkeys */
90 need = crypto_kem_sntrup761_PUBLICKEYBYTES + CURVE25519_SIZE;
91 if (sshbuf_len(client_blob) != need) {
92 r = SSH_ERR_SIGNATURE_INVALID;
95 client_pub = sshbuf_ptr(client_blob);
97 dump_digest("client public key sntrup761:", client_pub,
98 crypto_kem_sntrup761_PUBLICKEYBYTES);
99 dump_digest("client public key 25519:",
100 client_pub + crypto_kem_sntrup761_PUBLICKEYBYTES,
103 /* allocate buffer for concatenation of KEM key and ECDH shared key */
104 /* the buffer will be hashed and the result is the shared secret */
105 if ((buf = sshbuf_new()) == NULL) {
106 r = SSH_ERR_ALLOC_FAIL;
109 if ((r = sshbuf_reserve(buf, crypto_kem_sntrup761_BYTES,
112 /* allocate space for encrypted KEM key and ECDH pub key */
113 if ((server_blob = sshbuf_new()) == NULL) {
114 r = SSH_ERR_ALLOC_FAIL;
117 need = crypto_kem_sntrup761_CIPHERTEXTBYTES + CURVE25519_SIZE;
118 if ((r = sshbuf_reserve(server_blob, need, &ciphertext)) != 0)
120 /* generate and encrypt KEM key with client key */
121 crypto_kem_sntrup761_enc(ciphertext, kem_key, client_pub);
122 /* generate ECDH key pair, store server pubkey after ciphertext */
123 server_pub = ciphertext + crypto_kem_sntrup761_CIPHERTEXTBYTES;
124 kexc25519_keygen(server_key, server_pub);
125 /* append ECDH shared key */
126 client_pub += crypto_kem_sntrup761_PUBLICKEYBYTES;
127 if ((r = kexc25519_shared_key_ext(server_key, client_pub, buf, 1)) < 0)
129 if ((r = ssh_digest_buffer(kex->hash_alg, buf, hash, sizeof(hash))) != 0)
132 dump_digest("server public key 25519:", server_pub, CURVE25519_SIZE);
133 dump_digest("server cipher text:", ciphertext,
134 crypto_kem_sntrup761_CIPHERTEXTBYTES);
135 dump_digest("server kem key:", kem_key, sizeof(kem_key));
136 dump_digest("concatenation of KEM key and ECDH shared key:",
137 sshbuf_ptr(buf), sshbuf_len(buf));
139 /* string-encoded hash is resulting shared secret */
141 if ((r = sshbuf_put_string(buf, hash,
142 ssh_digest_bytes(kex->hash_alg))) != 0)
145 dump_digest("encoded shared secret:", sshbuf_ptr(buf), sshbuf_len(buf));
147 *server_blobp = server_blob;
148 *shared_secretp = buf;
152 explicit_bzero(hash, sizeof(hash));
153 explicit_bzero(server_key, sizeof(server_key));
154 sshbuf_free(server_blob);
160 kex_kem_sntrup761x25519_dec(struct kex *kex,
161 const struct sshbuf *server_blob, struct sshbuf **shared_secretp)
163 struct sshbuf *buf = NULL;
164 u_char *kem_key = NULL;
165 const u_char *ciphertext, *server_pub;
166 u_char hash[SSH_DIGEST_MAX_LENGTH];
170 *shared_secretp = NULL;
172 need = crypto_kem_sntrup761_CIPHERTEXTBYTES + CURVE25519_SIZE;
173 if (sshbuf_len(server_blob) != need) {
174 r = SSH_ERR_SIGNATURE_INVALID;
177 ciphertext = sshbuf_ptr(server_blob);
178 server_pub = ciphertext + crypto_kem_sntrup761_CIPHERTEXTBYTES;
180 dump_digest("server cipher text:", ciphertext,
181 crypto_kem_sntrup761_CIPHERTEXTBYTES);
182 dump_digest("server public key c25519:", server_pub, CURVE25519_SIZE);
184 /* hash concatenation of KEM key and ECDH shared key */
185 if ((buf = sshbuf_new()) == NULL) {
186 r = SSH_ERR_ALLOC_FAIL;
189 if ((r = sshbuf_reserve(buf, crypto_kem_sntrup761_BYTES,
192 decoded = crypto_kem_sntrup761_dec(kem_key, ciphertext,
193 kex->sntrup761_client_key);
194 if ((r = kexc25519_shared_key_ext(kex->c25519_client_key, server_pub,
197 if ((r = ssh_digest_buffer(kex->hash_alg, buf, hash, sizeof(hash))) != 0)
200 dump_digest("client kem key:", kem_key, crypto_kem_sntrup761_BYTES);
201 dump_digest("concatenation of KEM key and ECDH shared key:",
202 sshbuf_ptr(buf), sshbuf_len(buf));
205 if ((r = sshbuf_put_string(buf, hash,
206 ssh_digest_bytes(kex->hash_alg))) != 0)
209 dump_digest("encoded shared secret:", sshbuf_ptr(buf), sshbuf_len(buf));
212 r = SSH_ERR_SIGNATURE_INVALID;
215 *shared_secretp = buf;
218 explicit_bzero(hash, sizeof(hash));
232 kex_kem_sntrup761x25519_keypair(struct kex *kex)
234 return SSH_ERR_SIGN_ALG_UNSUPPORTED;
238 kex_kem_sntrup761x25519_enc(struct kex *kex,
239 const struct sshbuf *client_blob, struct sshbuf **server_blobp,
240 struct sshbuf **shared_secretp)
242 return SSH_ERR_SIGN_ALG_UNSUPPORTED;
246 kex_kem_sntrup761x25519_dec(struct kex *kex,
247 const struct sshbuf *server_blob, struct sshbuf **shared_secretp)
249 return SSH_ERR_SIGN_ALG_UNSUPPORTED;
251 #endif /* USE_SNTRUP761X25519 */