oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

ECDH bits, still need negotiation

Browse Source 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@24686 ec53bebd-3082-4978-b11e-865c3cabbd6b
This commit is contained in:
Love Hörnquist Åstrand
2009-02-14 04:16:44 +00:00
parent 28cf0ab673
commit 651fe508c0
1 changed files with 50 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

55
lib/krb5/pkinit.c
View File

@@ -467,6 +467,9 @@ build_auth_pack(krb5_context context,
krb5_abortx(context, "asn1 internal error"); krb5_abortx(context, "asn1 internal error");
} else if (ctx->keyex == USE_ECDH) { } else if (ctx->keyex == USE_ECDH) {
#ifdef HAVE_OPENSSL #ifdef HAVE_OPENSSL
int len;
unsigned char *p;
ret = der_copy_oid(oid_id_ecPublicKey(), ret = der_copy_oid(oid_id_ecPublicKey(),
&a->clientPublicValue->algorithm.algorithm); &a->clientPublicValue->algorithm.algorithm);
if (ret) if (ret)
@@ -480,10 +483,23 @@ build_auth_pack(krb5_context context,
if (ret != 1) if (ret != 1)
return EINVAL; return EINVAL;
/* XXX stuff domain and public key into dhbuf */ /* encode onto dhkey */
dhbuf.data = NULL; len = i2o_ECPublicKey(ctx->u.eckey, NULL);
dhbuf.length = 0; if (len <= 0)
abort();
dhbuf.data = malloc(len);
if (dhbuf.data == NULL)
abort();
dhbuf.length = len;
p = dhbuf.data;
len = i2o_ECPublicKey(ctx->u.eckey, &p);
if (len <= 0)
abort();
/* XXX verify that this is right with RFC3279 */
#else #else
return EINVAL; return EINVAL;
#endif #endif
@@ -1172,7 +1188,8 @@ pk_rd_pa_reply_dh(krb5_context context,
PA_DATA *pa, PA_DATA *pa,
krb5_keyblock **key) krb5_keyblock **key)
{ {
unsigned char *p, *dh_gen_key = NULL; const unsigned char *p;
unsigned char *dh_gen_key = NULL;
struct krb5_pk_cert *host = NULL; struct krb5_pk_cert *host = NULL;
BIGNUM *kdc_dh_pubkey = NULL; BIGNUM *kdc_dh_pubkey = NULL;
KDCDHKeyInfo kdc_dh_info; KDCDHKeyInfo kdc_dh_info;
@@ -1303,7 +1320,35 @@ pk_rd_pa_reply_dh(krb5_context context,
} }
} else { } else {
#ifdef HAVE_OPENSSL #ifdef HAVE_OPENSSL
krb5_abortx(context, "implement ECDH"); const EC_GROUP *group;
EC_KEY *public;
public = o2i_ECPublicKey(NULL, &p, size);
if (public == NULL) {
ret = KRB5KRB_ERR_GENERIC;
krb5_set_error_message(context, ret,
N_("PKINIT: Can't parse ECDH public key", ""));
goto out;
}
group = EC_KEY_get0_group(ctx->u.eckey);
size = (EC_GROUP_get_degree(group) + 7) / 8;
dh_gen_key = malloc(size);
if (dh_gen_key == NULL) {
ret = ENOMEM;
krb5_set_error_message(context, ret,
N_("malloc: out of memory", ""));
goto out;
}
dh_gen_keylen = ECDH_compute_key(dh_gen_key, size,
EC_KEY_get0_public_key(public), ctx->u.eckey, NULL);
if (dh_gen_keylen == -1) {
ret = KRB5KRB_ERR_GENERIC;
krb5_set_error_message(context, ret,
N_("PKINIT: Can't compute ECDH public key", ""));
goto out;
}
#else #else
ret = EINVAL; ret = EINVAL;
#endif #endif