denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

wolfssl: Store RNG on object for curve25519

Browse Source 
5.8.2 enables blinding for curve25519 by default, so the RNG set when
making the key is also used later on.
This commit is contained in:
Tobias Brunner
2025-07-19 12:10:25 +02:00
parent 1b62e88980
commit 011c346b00
1 changed files with 12 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/plugins/wolfssl/wolfssl_x_diffie_hellman.c
+12 -7
View File
@@ -84,6 +84,11 @@ struct private_diffie_hellman_t {
* Shared secret * Shared secret
*/ */
chunk_t shared_secret; chunk_t shared_secret;
/**
* RNG used for key generation and blinding with curve25519
*/
WC_RNG rng;
}; };
#ifdef HAVE_CURVE25519 #ifdef HAVE_CURVE25519
@@ -289,6 +294,7 @@ METHOD(key_exchange_t, destroy, void,
#endif #endif
} }
chunk_clear(&this->shared_secret); chunk_clear(&this->shared_secret);
wc_FreeRng(&this->rng);
free(this); free(this);
} }
@@ -298,7 +304,6 @@ METHOD(key_exchange_t, destroy, void,
key_exchange_t *wolfssl_x_diffie_hellman_create(key_exchange_method_t group) key_exchange_t *wolfssl_x_diffie_hellman_create(key_exchange_method_t group)
{ {
private_diffie_hellman_t *this; private_diffie_hellman_t *this;
WC_RNG rng;
int ret = -1; int ret = -1;
INIT(this, INIT(this,
@@ -309,7 +314,7 @@ key_exchange_t *wolfssl_x_diffie_hellman_create(key_exchange_method_t group)
.group = group, .group = group,
); );
if (wc_InitRng(&rng) != 0) if (wc_InitRng(&this->rng) != 0)
{ {
DBG1(DBG_LIB, "initializing a random number generator failed"); DBG1(DBG_LIB, "initializing a random number generator failed");
destroy(this); destroy(this);
@@ -325,7 +330,6 @@ key_exchange_t *wolfssl_x_diffie_hellman_create(key_exchange_method_t group)
#ifdef TESTABLE_KE #ifdef TESTABLE_KE
this->public.set_seed = _set_seed_25519; this->public.set_seed = _set_seed_25519;
#endif #endif
if (wc_curve25519_init(&this->key.key25519) != 0 || if (wc_curve25519_init(&this->key.key25519) != 0 ||
wc_curve25519_init(&this->pub.key25519) != 0) wc_curve25519_init(&this->pub.key25519) != 0)
{ {
@@ -333,7 +337,7 @@ key_exchange_t *wolfssl_x_diffie_hellman_create(key_exchange_method_t group)
destroy(this); destroy(this);
return NULL; return NULL;
} }
ret = wc_curve25519_make_key(&rng, CURVE25519_KEYSIZE, ret = wc_curve25519_make_key(&this->rng, CURVE25519_KEYSIZE,
&this->key.key25519); &this->key.key25519);
#endif #endif
} }
@@ -354,13 +358,14 @@ key_exchange_t *wolfssl_x_diffie_hellman_create(key_exchange_method_t group)
destroy(this); destroy(this);
return NULL; return NULL;
} }
ret = wc_curve448_make_key(&rng, CURVE448_KEY_SIZE, &this->key.key448); ret = wc_curve448_make_key(&this->rng, CURVE448_KEY_SIZE,
&this->key.key448);
#endif #endif
} }
wc_FreeRng(&rng);
if (ret != 0) if (ret != 0)
{ {
DBG1(DBG_LIB, "making a key failed"); DBG1(DBG_LIB, "making %N key failed", key_exchange_method_names,
this->group);
destroy(this); destroy(this);
return NULL; return NULL;
} }