1 /*
2  *  Diffie-Hellman-Merkle key exchange (client side)
3  *
4  *  Copyright The Mbed TLS Contributors
5  *  SPDX-License-Identifier: Apache-2.0
6  *
7  *  Licensed under the Apache License, Version 2.0 (the "License"); you may
8  *  not use this file except in compliance with the License.
9  *  You may obtain a copy of the License at
10  *
11  *  http://www.apache.org/licenses/LICENSE-2.0
12  *
13  *  Unless required by applicable law or agreed to in writing, software
14  *  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15  *  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  *  See the License for the specific language governing permissions and
17  *  limitations under the License.
18  */
19 
20 #include "mbedtls/build_info.h"
21 
22 #include "mbedtls/platform.h"
23 
24 #if defined(MBEDTLS_AES_C) && defined(MBEDTLS_DHM_C) && \
25     defined(MBEDTLS_ENTROPY_C) && defined(MBEDTLS_NET_C) && \
26     defined(MBEDTLS_RSA_C) && defined(MBEDTLS_SHA256_C) && \
27     defined(MBEDTLS_FS_IO) && defined(MBEDTLS_CTR_DRBG_C) && \
28     defined(MBEDTLS_SHA1_C)
29 #include "mbedtls/net_sockets.h"
30 #include "mbedtls/aes.h"
31 #include "mbedtls/dhm.h"
32 #include "mbedtls/rsa.h"
33 #include "mbedtls/sha1.h"
34 #include "mbedtls/entropy.h"
35 #include "mbedtls/ctr_drbg.h"
36 
37 #include <stdio.h>
38 #include <string.h>
39 #endif
40 
41 #define SERVER_NAME "localhost"
42 #define SERVER_PORT "11999"
43 
44 #if !defined(MBEDTLS_AES_C) || !defined(MBEDTLS_DHM_C) ||     \
45     !defined(MBEDTLS_ENTROPY_C) || !defined(MBEDTLS_NET_C) ||  \
46     !defined(MBEDTLS_RSA_C) || !defined(MBEDTLS_SHA256_C) ||    \
47     !defined(MBEDTLS_FS_IO) || !defined(MBEDTLS_CTR_DRBG_C) || \
48     !defined(MBEDTLS_SHA1_C)
main(void)49 int main(void)
50 {
51     mbedtls_printf("MBEDTLS_AES_C and/or MBEDTLS_DHM_C and/or MBEDTLS_ENTROPY_C "
52                    "and/or MBEDTLS_NET_C and/or MBEDTLS_RSA_C and/or "
53                    "MBEDTLS_SHA256_C and/or MBEDTLS_FS_IO and/or "
54                    "MBEDTLS_CTR_DRBG_C not defined.\n");
55     mbedtls_exit(0);
56 }
57 #else
58 
59 
main(void)60 int main(void)
61 {
62     FILE *f;
63 
64     int ret = 1;
65     int exit_code = MBEDTLS_EXIT_FAILURE;
66     size_t n, buflen;
67     mbedtls_net_context server_fd;
68 
69     unsigned char *p, *end;
70     unsigned char buf[2048];
71     unsigned char hash[32];
72     const char *pers = "dh_client";
73 
74     mbedtls_entropy_context entropy;
75     mbedtls_ctr_drbg_context ctr_drbg;
76     mbedtls_rsa_context rsa;
77     mbedtls_dhm_context dhm;
78     mbedtls_aes_context aes;
79 
80     mbedtls_net_init(&server_fd);
81     mbedtls_dhm_init(&dhm);
82     mbedtls_aes_init(&aes);
83     mbedtls_ctr_drbg_init(&ctr_drbg);
84 
85     /*
86      * 1. Setup the RNG
87      */
88     mbedtls_printf("\n  . Seeding the random number generator");
89     fflush(stdout);
90 
91     mbedtls_entropy_init(&entropy);
92     if ((ret = mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func, &entropy,
93                                      (const unsigned char *) pers,
94                                      strlen(pers))) != 0) {
95         mbedtls_printf(" failed\n  ! mbedtls_ctr_drbg_seed returned %d\n", ret);
96         goto exit;
97     }
98 
99     /*
100      * 2. Read the server's public RSA key
101      */
102     mbedtls_printf("\n  . Reading public key from rsa_pub.txt");
103     fflush(stdout);
104 
105     if ((f = fopen("rsa_pub.txt", "rb")) == NULL) {
106         mbedtls_printf(" failed\n  ! Could not open rsa_pub.txt\n" \
107                        "  ! Please run rsa_genkey first\n\n");
108         goto exit;
109     }
110 
111     mbedtls_rsa_init(&rsa);
112 
113     if ((ret = mbedtls_mpi_read_file(&rsa.MBEDTLS_PRIVATE(N), 16, f)) != 0 ||
114         (ret = mbedtls_mpi_read_file(&rsa.MBEDTLS_PRIVATE(E), 16, f)) != 0) {
115         mbedtls_printf(" failed\n  ! mbedtls_mpi_read_file returned %d\n\n", ret);
116         fclose(f);
117         goto exit;
118     }
119 
120     rsa.MBEDTLS_PRIVATE(len) = (mbedtls_mpi_bitlen(&rsa.MBEDTLS_PRIVATE(N)) + 7) >> 3;
121 
122     fclose(f);
123 
124     /*
125      * 3. Initiate the connection
126      */
127     mbedtls_printf("\n  . Connecting to tcp/%s/%s", SERVER_NAME,
128                    SERVER_PORT);
129     fflush(stdout);
130 
131     if ((ret = mbedtls_net_connect(&server_fd, SERVER_NAME,
132                                    SERVER_PORT, MBEDTLS_NET_PROTO_TCP)) != 0) {
133         mbedtls_printf(" failed\n  ! mbedtls_net_connect returned %d\n\n", ret);
134         goto exit;
135     }
136 
137     /*
138      * 4a. First get the buffer length
139      */
140     mbedtls_printf("\n  . Receiving the server's DH parameters");
141     fflush(stdout);
142 
143     memset(buf, 0, sizeof(buf));
144 
145     if ((ret = mbedtls_net_recv(&server_fd, buf, 2)) != 2) {
146         mbedtls_printf(" failed\n  ! mbedtls_net_recv returned %d\n\n", ret);
147         goto exit;
148     }
149 
150     n = buflen = (buf[0] << 8) | buf[1];
151     if (buflen < 1 || buflen > sizeof(buf)) {
152         mbedtls_printf(" failed\n  ! Got an invalid buffer length\n\n");
153         goto exit;
154     }
155 
156     /*
157      * 4b. Get the DHM parameters: P, G and Ys = G^Xs mod P
158      */
159     memset(buf, 0, sizeof(buf));
160 
161     if ((ret = mbedtls_net_recv(&server_fd, buf, n)) != (int) n) {
162         mbedtls_printf(" failed\n  ! mbedtls_net_recv returned %d\n\n", ret);
163         goto exit;
164     }
165 
166     p = buf, end = buf + buflen;
167 
168     if ((ret = mbedtls_dhm_read_params(&dhm, &p, end)) != 0) {
169         mbedtls_printf(" failed\n  ! mbedtls_dhm_read_params returned %d\n\n", ret);
170         goto exit;
171     }
172 
173     n = mbedtls_dhm_get_len(&dhm);
174     if (n < 64 || n > 512) {
175         mbedtls_printf(" failed\n  ! Invalid DHM modulus size\n\n");
176         goto exit;
177     }
178 
179     /*
180      * 5. Check that the server's RSA signature matches
181      *    the SHA-256 hash of (P,G,Ys)
182      */
183     mbedtls_printf("\n  . Verifying the server's RSA signature");
184     fflush(stdout);
185 
186     p += 2;
187 
188     if ((n = (size_t) (end - p)) != rsa.MBEDTLS_PRIVATE(len)) {
189         mbedtls_printf(" failed\n  ! Invalid RSA signature size\n\n");
190         goto exit;
191     }
192 
193     if ((ret = mbedtls_sha1(buf, (int) (p - 2 - buf), hash)) != 0) {
194         mbedtls_printf(" failed\n  ! mbedtls_sha1 returned %d\n\n", ret);
195         goto exit;
196     }
197 
198     if ((ret = mbedtls_rsa_pkcs1_verify(&rsa, MBEDTLS_MD_SHA256,
199                                         32, hash, p)) != 0) {
200         mbedtls_printf(" failed\n  ! mbedtls_rsa_pkcs1_verify returned %d\n\n", ret);
201         goto exit;
202     }
203 
204     /*
205      * 6. Send our public value: Yc = G ^ Xc mod P
206      */
207     mbedtls_printf("\n  . Sending own public value to server");
208     fflush(stdout);
209 
210     n = mbedtls_dhm_get_len(&dhm);
211     if ((ret = mbedtls_dhm_make_public(&dhm, (int) n, buf, n,
212                                        mbedtls_ctr_drbg_random, &ctr_drbg)) != 0) {
213         mbedtls_printf(" failed\n  ! mbedtls_dhm_make_public returned %d\n\n", ret);
214         goto exit;
215     }
216 
217     if ((ret = mbedtls_net_send(&server_fd, buf, n)) != (int) n) {
218         mbedtls_printf(" failed\n  ! mbedtls_net_send returned %d\n\n", ret);
219         goto exit;
220     }
221 
222     /*
223      * 7. Derive the shared secret: K = Ys ^ Xc mod P
224      */
225     mbedtls_printf("\n  . Shared secret: ");
226     fflush(stdout);
227 
228     if ((ret = mbedtls_dhm_calc_secret(&dhm, buf, sizeof(buf), &n,
229                                        mbedtls_ctr_drbg_random, &ctr_drbg)) != 0) {
230         mbedtls_printf(" failed\n  ! mbedtls_dhm_calc_secret returned %d\n\n", ret);
231         goto exit;
232     }
233 
234     for (n = 0; n < 16; n++) {
235         mbedtls_printf("%02x", buf[n]);
236     }
237 
238     /*
239      * 8. Setup the AES-256 decryption key
240      *
241      * This is an overly simplified example; best practice is
242      * to hash the shared secret with a random value to derive
243      * the keying material for the encryption/decryption keys,
244      * IVs and MACs.
245      */
246     mbedtls_printf("...\n  . Receiving and decrypting the ciphertext");
247     fflush(stdout);
248 
249     ret = mbedtls_aes_setkey_dec(&aes, buf, 256);
250     if (ret != 0) {
251         goto exit;
252     }
253 
254     memset(buf, 0, sizeof(buf));
255 
256     if ((ret = mbedtls_net_recv(&server_fd, buf, 16)) != 16) {
257         mbedtls_printf(" failed\n  ! mbedtls_net_recv returned %d\n\n", ret);
258         goto exit;
259     }
260 
261     ret = mbedtls_aes_crypt_ecb(&aes, MBEDTLS_AES_DECRYPT, buf, buf);
262     if (ret != 0) {
263         goto exit;
264     }
265     buf[16] = '\0';
266     mbedtls_printf("\n  . Plaintext is \"%s\"\n\n", (char *) buf);
267 
268     exit_code = MBEDTLS_EXIT_SUCCESS;
269 
270 exit:
271 
272     mbedtls_net_free(&server_fd);
273 
274     mbedtls_aes_free(&aes);
275     mbedtls_rsa_free(&rsa);
276     mbedtls_dhm_free(&dhm);
277     mbedtls_ctr_drbg_free(&ctr_drbg);
278     mbedtls_entropy_free(&entropy);
279 
280     mbedtls_exit(exit_code);
281 }
282 #endif /* MBEDTLS_AES_C && MBEDTLS_DHM_C && MBEDTLS_ENTROPY_C &&
283           MBEDTLS_NET_C && MBEDTLS_RSA_C && MBEDTLS_SHA256_C &&
284           MBEDTLS_FS_IO && MBEDTLS_CTR_DRBG_C */
285