ec_dh.c

//
// ec_dh.c   ECDH function
//
// Copyright (c) Microsoft Corporation. Licensed under the MIT license.
//
//

#include "precomp.h"

SYMCRYPT_ERROR
SYMCRYPT_CALL
SymCryptEcDhSecretAgreement(
    _In_                            PCSYMCRYPT_ECKEY        pkPrivate,
    _In_                            PCSYMCRYPT_ECKEY        pkPublic,
                                    SYMCRYPT_NUMBER_FORMAT  format,
                                    UINT32                  flags,
    _Out_writes_( cbAgreedSecret )  PBYTE                   pbAgreedSecret,
                                    SIZE_T                  cbAgreedSecret )
{
    SYMCRYPT_ERROR scError = SYMCRYPT_NO_ERROR;

    PBYTE   pbScratch = NULL;
    SIZE_T  cbScratch = 0;
    SIZE_T  cbScratchInternal = 0;
    PBYTE   pCurr = NULL;

    PCSYMCRYPT_ECURVE   pCurve = NULL;

    PSYMCRYPT_ECPOINT   poQ = NULL;
    PBYTE               pbX = NULL;

    UINT32              cbQ = 0;
    UINT32              cbX = 0;

    // Make sure that the keys may be used in ECDH
    if ( ((pkPrivate->fAlgorithmInfo & SYMCRYPT_FLAG_ECKEY_ECDH) == 0) ||
         ((pkPublic->fAlgorithmInfo & SYMCRYPT_FLAG_ECKEY_ECDH) == 0) )
    {
        scError = SYMCRYPT_INVALID_ARGUMENT;
        goto cleanup;
    }

    // Make sure we only specify the correct flags and that
    // there is a private key
    if ( (flags != 0) ||
         (!pkPrivate->hasPrivateKey) )
    {
        scError = SYMCRYPT_INVALID_ARGUMENT;
        goto cleanup;
    }

    // Check that the curve is the same for both keys
    if ( SymCryptEcurveIsSame( pkPrivate->pCurve, pkPublic->pCurve ) )
    {
        pCurve = pkPrivate->pCurve;
    }
    else
    {
        scError = SYMCRYPT_INVALID_ARGUMENT;
        goto cleanup;
    }

    // Objects and scratch space size calculation
    cbQ = SymCryptSizeofEcpointFromCurve( pCurve );
    cbX  = SymCryptEcurveSizeofFieldElement( pCurve );

    // Check the output buffer has the correct size
    if (cbAgreedSecret != cbX)
    {
        scError = SYMCRYPT_WRONG_BLOCK_SIZE;
        goto cleanup;
    }

    cbScratchInternal = SYMCRYPT_MAX( SYMCRYPT_SCRATCH_BYTES_FOR_COMMON_ECURVE_OPERATIONS(pCurve),
                        SYMCRYPT_MAX( SYMCRYPT_SCRATCH_BYTES_FOR_SCALAR_ECURVE_OPERATIONS( pCurve ),
                             SYMCRYPT_SCRATCH_BYTES_FOR_GETSET_VALUE_ECURVE_OPERATIONS( pCurve ) ));

    //
    // From symcrypt_internal.h we have:
    //      - sizeof results are upper bounded by 2^19
    //      - SYMCRYPT_SCRATCH_BYTES results are upper bounded by 2^27 (including RSA and ECURVE)
    // Thus the following calculation does not overflow cbScratch.
    //
    cbScratch = cbScratchInternal + cbQ + cbX;

    // Scratch space allocation
    pbScratch = SymCryptCallbackAlloc( cbScratch );
    if ( pbScratch == NULL )
    {
        scError = SYMCRYPT_MEMORY_ALLOCATION_FAILURE;
        goto cleanup;
    }

    // Creating temporaries
    pCurr = pbScratch + cbScratchInternal;
    poQ = SymCryptEcpointCreate( pCurr, cbQ, pCurve );
    pCurr += cbQ;
    pbX = pCurr;

    SYMCRYPT_ASSERT( poQ != NULL);

    // Make sure that the public key is not the zero point
    // No need to check that the point is on the curve; that check is done when the
    // public key is created.
    if (SymCryptEcpointIsZero(pCurve, pkPublic->poPublicKey, pbScratch, cbScratchInternal))
    {
        scError = SYMCRYPT_INVALID_ARGUMENT;
        goto cleanup;
    }

    // Calculate the secret
    // Always do low order clearing by multiplying by the cofactor.
    //  Note:   the internal format of piPrivateKey is "DivH", so we
    //          get the correct result.
    scError = SymCryptEcpointScalarMul(
                pCurve,
                pkPrivate->piPrivateKey,
                pkPublic->poPublicKey,
                SYMCRYPT_FLAG_ECC_LL_COFACTOR_MUL,
                poQ,
                pbScratch,
                cbScratchInternal );
    if ( scError != SYMCRYPT_NO_ERROR )
    {
        goto cleanup;
    }

    // Check if the result is the identity point
    if ( SymCryptEcpointIsZero(
                pCurve,
                poQ,
                pbScratch,
                cbScratchInternal ) )
    {
        scError = SYMCRYPT_INVALID_BLOB;
        goto cleanup;
    }

    // Get the x from poQ
    scError = SymCryptEcpointGetValue( pCurve, poQ, format, SYMCRYPT_ECPOINT_FORMAT_X, pbX, cbX, 0, pbScratch, cbScratchInternal);
    if ( scError != SYMCRYPT_NO_ERROR )
    {
        goto cleanup;
    }

    // Store it in the destination
    memcpy( pbAgreedSecret, pbX, cbX);

cleanup:
    if ( pbScratch != NULL )
    {
        SymCryptWipe( pbScratch, cbScratch );
        SymCryptCallbackFree( pbScratch );
    }

    return scError;
}