blob: b9b3a50d8ad6f97e47a55b401f4b0e36097d5b7f [file] [log] [blame]
Paul Bakker5121ce52009-01-03 21:22:43 +00001/*
2 * Diffie-Hellman-Merkle key exchange (server side)
3 *
Manuel Pégourié-Gonnarda658a402015-01-23 09:45:19 +00004 * Copyright (C) 2006-2011, ARM Limited, All Rights Reserved
Paul Bakkerb96f1542010-07-18 20:36:00 +00005 *
Manuel Pégourié-Gonnard085ab042015-01-23 11:06:27 +00006 * This file is part of mbed TLS (https://www.polarssl.org)
Paul Bakkerb96f1542010-07-18 20:36:00 +00007 *
Paul Bakker5121ce52009-01-03 21:22:43 +00008 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License along
19 * with this program; if not, write to the Free Software Foundation, Inc.,
20 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
21 */
22
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020023#if !defined(POLARSSL_CONFIG_FILE)
Manuel Pégourié-Gonnardabd6e022013-09-20 13:30:43 +020024#include "polarssl/config.h"
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020025#else
26#include POLARSSL_CONFIG_FILE
27#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000028
Rich Evansf90016a2015-01-19 14:26:37 +000029#if defined(POLARSSL_PLATFORM_C)
30#include "polarssl/platform.h"
31#else
32#define polarssl_printf printf
33#define polarssl_fprintf fprintf
34#define polarssl_malloc malloc
35#define polarssl_free free
36#endif
37
Paul Bakker5121ce52009-01-03 21:22:43 +000038#include <string.h>
39#include <stdio.h>
40
Paul Bakker40e46942009-01-03 21:51:57 +000041#include "polarssl/net.h"
42#include "polarssl/aes.h"
43#include "polarssl/dhm.h"
44#include "polarssl/rsa.h"
45#include "polarssl/sha1.h"
Paul Bakker508ad5a2011-12-04 17:09:26 +000046#include "polarssl/entropy.h"
47#include "polarssl/ctr_drbg.h"
Paul Bakker5121ce52009-01-03 21:22:43 +000048
49#define SERVER_PORT 11999
50#define PLAINTEXT "==Hello there!=="
51
Paul Bakker5690efc2011-05-26 13:16:06 +000052#if !defined(POLARSSL_AES_C) || !defined(POLARSSL_DHM_C) || \
Paul Bakker508ad5a2011-12-04 17:09:26 +000053 !defined(POLARSSL_ENTROPY_C) || !defined(POLARSSL_NET_C) || \
Paul Bakker5690efc2011-05-26 13:16:06 +000054 !defined(POLARSSL_RSA_C) || !defined(POLARSSL_SHA1_C) || \
Paul Bakker508ad5a2011-12-04 17:09:26 +000055 !defined(POLARSSL_FS_IO) || !defined(POLARSSL_CTR_DRBG_C)
Paul Bakkercce9d772011-11-18 14:26:47 +000056int main( int argc, char *argv[] )
Paul Bakker5690efc2011-05-26 13:16:06 +000057{
Paul Bakkercce9d772011-11-18 14:26:47 +000058 ((void) argc);
59 ((void) argv);
60
Rich Evansf90016a2015-01-19 14:26:37 +000061 polarssl_printf("POLARSSL_AES_C and/or POLARSSL_DHM_C and/or POLARSSL_ENTROPY_C "
Paul Bakker5690efc2011-05-26 13:16:06 +000062 "and/or POLARSSL_NET_C and/or POLARSSL_RSA_C and/or "
Paul Bakker508ad5a2011-12-04 17:09:26 +000063 "POLARSSL_SHA1_C and/or POLARSSL_FS_IO and/or "
64 "POLARSSL_CTR_DBRG_C not defined.\n");
Paul Bakker5690efc2011-05-26 13:16:06 +000065 return( 0 );
66}
67#else
Paul Bakkercce9d772011-11-18 14:26:47 +000068int main( int argc, char *argv[] )
Paul Bakker5121ce52009-01-03 21:22:43 +000069{
70 FILE *f;
71
Paul Bakker23986e52011-04-24 08:57:21 +000072 int ret;
73 size_t n, buflen;
Paul Bakker5121ce52009-01-03 21:22:43 +000074 int listen_fd = -1;
75 int client_fd = -1;
76
Paul Bakker520ea912012-10-24 14:17:01 +000077 unsigned char buf[2048];
Paul Bakker5121ce52009-01-03 21:22:43 +000078 unsigned char hash[20];
79 unsigned char buf2[2];
Paul Bakkeref3f8c72013-06-24 13:01:08 +020080 const char *pers = "dh_server";
Paul Bakker5121ce52009-01-03 21:22:43 +000081
Paul Bakker508ad5a2011-12-04 17:09:26 +000082 entropy_context entropy;
83 ctr_drbg_context ctr_drbg;
Paul Bakker5121ce52009-01-03 21:22:43 +000084 rsa_context rsa;
85 dhm_context dhm;
86 aes_context aes;
87
Paul Bakkercce9d772011-11-18 14:26:47 +000088 ((void) argc);
89 ((void) argv);
90
Paul Bakker5121ce52009-01-03 21:22:43 +000091 memset( &rsa, 0, sizeof( rsa ) );
Paul Bakkera317a982014-06-18 16:44:11 +020092 dhm_init( &dhm );
Paul Bakker8cfd9d82014-06-18 11:16:11 +020093 aes_init( &aes );
Paul Bakker5121ce52009-01-03 21:22:43 +000094
95 /*
96 * 1. Setup the RNG
97 */
Rich Evansf90016a2015-01-19 14:26:37 +000098 polarssl_printf( "\n . Seeding the random number generator" );
Paul Bakker5121ce52009-01-03 21:22:43 +000099 fflush( stdout );
100
Paul Bakker508ad5a2011-12-04 17:09:26 +0000101 entropy_init( &entropy );
102 if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy,
Paul Bakkeref3f8c72013-06-24 13:01:08 +0200103 (const unsigned char *) pers,
104 strlen( pers ) ) ) != 0 )
Paul Bakker508ad5a2011-12-04 17:09:26 +0000105 {
Rich Evansf90016a2015-01-19 14:26:37 +0000106 polarssl_printf( " failed\n ! ctr_drbg_init returned %d\n", ret );
Paul Bakker508ad5a2011-12-04 17:09:26 +0000107 goto exit;
108 }
Paul Bakker5121ce52009-01-03 21:22:43 +0000109
110 /*
111 * 2a. Read the server's private RSA key
112 */
Rich Evansf90016a2015-01-19 14:26:37 +0000113 polarssl_printf( "\n . Reading private key from rsa_priv.txt" );
Paul Bakker5121ce52009-01-03 21:22:43 +0000114 fflush( stdout );
115
116 if( ( f = fopen( "rsa_priv.txt", "rb" ) ) == NULL )
117 {
118 ret = 1;
Rich Evansf90016a2015-01-19 14:26:37 +0000119 polarssl_printf( " failed\n ! Could not open rsa_priv.txt\n" \
Paul Bakker5121ce52009-01-03 21:22:43 +0000120 " ! Please run rsa_genkey first\n\n" );
121 goto exit;
122 }
123
Paul Bakkera802e1a2010-08-16 11:56:45 +0000124 rsa_init( &rsa, RSA_PKCS_V15, 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +0000125
126 if( ( ret = mpi_read_file( &rsa.N , 16, f ) ) != 0 ||
127 ( ret = mpi_read_file( &rsa.E , 16, f ) ) != 0 ||
128 ( ret = mpi_read_file( &rsa.D , 16, f ) ) != 0 ||
129 ( ret = mpi_read_file( &rsa.P , 16, f ) ) != 0 ||
130 ( ret = mpi_read_file( &rsa.Q , 16, f ) ) != 0 ||
131 ( ret = mpi_read_file( &rsa.DP, 16, f ) ) != 0 ||
132 ( ret = mpi_read_file( &rsa.DQ, 16, f ) ) != 0 ||
133 ( ret = mpi_read_file( &rsa.QP, 16, f ) ) != 0 )
134 {
Rich Evansf90016a2015-01-19 14:26:37 +0000135 polarssl_printf( " failed\n ! mpi_read_file returned %d\n\n", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +0000136 goto exit;
137 }
138
139 rsa.len = ( mpi_msb( &rsa.N ) + 7 ) >> 3;
140
141 fclose( f );
142
143 /*
144 * 2b. Get the DHM modulus and generator
145 */
Rich Evansf90016a2015-01-19 14:26:37 +0000146 polarssl_printf( "\n . Reading DH parameters from dh_prime.txt" );
Paul Bakker5121ce52009-01-03 21:22:43 +0000147 fflush( stdout );
148
149 if( ( f = fopen( "dh_prime.txt", "rb" ) ) == NULL )
150 {
151 ret = 1;
Rich Evansf90016a2015-01-19 14:26:37 +0000152 polarssl_printf( " failed\n ! Could not open dh_prime.txt\n" \
Paul Bakker5121ce52009-01-03 21:22:43 +0000153 " ! Please run dh_genprime first\n\n" );
154 goto exit;
155 }
156
157 if( mpi_read_file( &dhm.P, 16, f ) != 0 ||
158 mpi_read_file( &dhm.G, 16, f ) != 0 )
159 {
Rich Evansf90016a2015-01-19 14:26:37 +0000160 polarssl_printf( " failed\n ! Invalid DH parameter file\n\n" );
Paul Bakker5121ce52009-01-03 21:22:43 +0000161 goto exit;
162 }
163
164 fclose( f );
165
166 /*
167 * 3. Wait for a client to connect
168 */
Rich Evansf90016a2015-01-19 14:26:37 +0000169 polarssl_printf( "\n . Waiting for a remote connection" );
Paul Bakker5121ce52009-01-03 21:22:43 +0000170 fflush( stdout );
171
172 if( ( ret = net_bind( &listen_fd, NULL, SERVER_PORT ) ) != 0 )
173 {
Rich Evansf90016a2015-01-19 14:26:37 +0000174 polarssl_printf( " failed\n ! net_bind returned %d\n\n", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +0000175 goto exit;
176 }
177
178 if( ( ret = net_accept( listen_fd, &client_fd, NULL ) ) != 0 )
179 {
Rich Evansf90016a2015-01-19 14:26:37 +0000180 polarssl_printf( " failed\n ! net_accept returned %d\n\n", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +0000181 goto exit;
182 }
183
184 /*
185 * 4. Setup the DH parameters (P,G,Ys)
186 */
Rich Evansf90016a2015-01-19 14:26:37 +0000187 polarssl_printf( "\n . Sending the server's DH parameters" );
Paul Bakker5121ce52009-01-03 21:22:43 +0000188 fflush( stdout );
189
190 memset( buf, 0, sizeof( buf ) );
191
Paul Bakker840ab202013-11-30 15:14:38 +0100192 if( ( ret = dhm_make_params( &dhm, (int) mpi_size( &dhm.P ), buf, &n,
Paul Bakker508ad5a2011-12-04 17:09:26 +0000193 ctr_drbg_random, &ctr_drbg ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +0000194 {
Rich Evansf90016a2015-01-19 14:26:37 +0000195 polarssl_printf( " failed\n ! dhm_make_params returned %d\n\n", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +0000196 goto exit;
197 }
198
199 /*
200 * 5. Sign the parameters and send them
201 */
202 sha1( buf, n, hash );
203
204 buf[n ] = (unsigned char)( rsa.len >> 8 );
205 buf[n + 1] = (unsigned char)( rsa.len );
206
Paul Bakkerc70b9822013-04-07 22:00:46 +0200207 if( ( ret = rsa_pkcs1_sign( &rsa, NULL, NULL, RSA_PRIVATE, POLARSSL_MD_SHA1,
Paul Bakker5121ce52009-01-03 21:22:43 +0000208 0, hash, buf + n + 2 ) ) != 0 )
209 {
Rich Evansf90016a2015-01-19 14:26:37 +0000210 polarssl_printf( " failed\n ! rsa_pkcs1_sign returned %d\n\n", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +0000211 goto exit;
212 }
213
214 buflen = n + 2 + rsa.len;
215 buf2[0] = (unsigned char)( buflen >> 8 );
216 buf2[1] = (unsigned char)( buflen );
217
218 if( ( ret = net_send( &client_fd, buf2, 2 ) ) != 2 ||
Paul Bakker23986e52011-04-24 08:57:21 +0000219 ( ret = net_send( &client_fd, buf, buflen ) ) != (int) buflen )
Paul Bakker5121ce52009-01-03 21:22:43 +0000220 {
Rich Evansf90016a2015-01-19 14:26:37 +0000221 polarssl_printf( " failed\n ! net_send returned %d\n\n", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +0000222 goto exit;
223 }
224
225 /*
226 * 6. Get the client's public value: Yc = G ^ Xc mod P
227 */
Rich Evansf90016a2015-01-19 14:26:37 +0000228 polarssl_printf( "\n . Receiving the client's public value" );
Paul Bakker5121ce52009-01-03 21:22:43 +0000229 fflush( stdout );
230
231 memset( buf, 0, sizeof( buf ) );
232 n = dhm.len;
233
Paul Bakker23986e52011-04-24 08:57:21 +0000234 if( ( ret = net_recv( &client_fd, buf, n ) ) != (int) n )
Paul Bakker5121ce52009-01-03 21:22:43 +0000235 {
Rich Evansf90016a2015-01-19 14:26:37 +0000236 polarssl_printf( " failed\n ! net_recv returned %d\n\n", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +0000237 goto exit;
238 }
239
240 if( ( ret = dhm_read_public( &dhm, buf, dhm.len ) ) != 0 )
241 {
Rich Evansf90016a2015-01-19 14:26:37 +0000242 polarssl_printf( " failed\n ! dhm_read_public returned %d\n\n", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +0000243 goto exit;
244 }
245
246 /*
247 * 7. Derive the shared secret: K = Ys ^ Xc mod P
248 */
Rich Evansf90016a2015-01-19 14:26:37 +0000249 polarssl_printf( "\n . Shared secret: " );
Paul Bakker5121ce52009-01-03 21:22:43 +0000250 fflush( stdout );
251
Manuel Pégourié-Gonnard15d5de12013-09-17 11:34:11 +0200252 if( ( ret = dhm_calc_secret( &dhm, buf, &n,
253 ctr_drbg_random, &ctr_drbg ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +0000254 {
Rich Evansf90016a2015-01-19 14:26:37 +0000255 polarssl_printf( " failed\n ! dhm_calc_secret returned %d\n\n", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +0000256 goto exit;
257 }
258
259 for( n = 0; n < 16; n++ )
Rich Evansf90016a2015-01-19 14:26:37 +0000260 polarssl_printf( "%02x", buf[n] );
Paul Bakker5121ce52009-01-03 21:22:43 +0000261
262 /*
263 * 8. Setup the AES-256 encryption key
264 *
265 * This is an overly simplified example; best practice is
266 * to hash the shared secret with a random value to derive
267 * the keying material for the encryption/decryption keys
268 * and MACs.
269 */
Rich Evansf90016a2015-01-19 14:26:37 +0000270 polarssl_printf( "...\n . Encrypting and sending the ciphertext" );
Paul Bakker5121ce52009-01-03 21:22:43 +0000271 fflush( stdout );
272
273 aes_setkey_enc( &aes, buf, 256 );
274 memcpy( buf, PLAINTEXT, 16 );
275 aes_crypt_ecb( &aes, AES_ENCRYPT, buf, buf );
276
277 if( ( ret = net_send( &client_fd, buf, 16 ) ) != 16 )
278 {
Rich Evansf90016a2015-01-19 14:26:37 +0000279 polarssl_printf( " failed\n ! net_send returned %d\n\n", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +0000280 goto exit;
281 }
282
Rich Evansf90016a2015-01-19 14:26:37 +0000283 polarssl_printf( "\n\n" );
Paul Bakker5121ce52009-01-03 21:22:43 +0000284
285exit:
286
Paul Bakker0c226102014-04-17 16:02:36 +0200287 if( client_fd != -1 )
288 net_close( client_fd );
289
Paul Bakker8cfd9d82014-06-18 11:16:11 +0200290 aes_free( &aes );
Paul Bakker5121ce52009-01-03 21:22:43 +0000291 rsa_free( &rsa );
292 dhm_free( &dhm );
Paul Bakkera317a982014-06-18 16:44:11 +0200293 ctr_drbg_free( &ctr_drbg );
Paul Bakker1ffefac2013-09-28 15:23:03 +0200294 entropy_free( &entropy );
Paul Bakker5121ce52009-01-03 21:22:43 +0000295
Paul Bakkercce9d772011-11-18 14:26:47 +0000296#if defined(_WIN32)
Rich Evansf90016a2015-01-19 14:26:37 +0000297 polarssl_printf( " + Press Enter to exit this program.\n" );
Paul Bakker5121ce52009-01-03 21:22:43 +0000298 fflush( stdout ); getchar();
299#endif
300
301 return( ret );
302}
Paul Bakker508ad5a2011-12-04 17:09:26 +0000303#endif /* POLARSSL_AES_C && POLARSSL_DHM_C && POLARSSL_ENTROPY_C &&
Paul Bakker5690efc2011-05-26 13:16:06 +0000304 POLARSSL_NET_C && POLARSSL_RSA_C && POLARSSL_SHA1_C &&
Paul Bakker508ad5a2011-12-04 17:09:26 +0000305 POLARSSL_FS_IO && POLARSSL_CTR_DRBG_C */