2048-bit Montgomery modular exponentiation for DH-group14. More...

#include "network_drivers/presentation/ssh/crypto/ssh_bignum.h"
#include "network_drivers/presentation/ssh/transport/ssh_keymat.h"
#include <string.h>
#include <mbedtls/bignum.h>

Functions
void	bn_from_bytes (SshBigNum out, const uint8_t bytes, size_t len)
	Read a big-endian byte array of `len` bytes into a SshBigNum.

void	bn_to_bytes (uint8_t bytes[256], const SshBigNum *in)
	Write a SshBigNum as a 256-byte big-endian array.

int	bn_cmp (const SshBigNum a, const SshBigNum b)
	Compare two SshBigNum values.

int	bn_is_zero (const SshBigNum *a)
	Return non-zero if `a` is zero (all limbs zero).

int	bn_dh_validate (const SshBigNum *v)
	Validate a received DH public value.

void	bn_expmod_group14 (SshBigNum out, const SshBigNum base, const SshBigNum *exp)
	Compute out = base^exp mod group14_p.

Variables
uint8_t	crypto_work [SSH_CRYPTO_WORK_SIZE]
	Global scratch buffer for big-number temporaries.

const SshBigNum	group14_p
	The RFC 3526 MODP group-14 prime (2048-bit).

const SshBigNum	group14_g
	Generator for group-14: g = 2.

Detailed Description

2048-bit Montgomery modular exponentiation for DH-group14.

─── Montgomery parameter for group-14 ─────────────────────────────────── The group-14 prime p ends in ...FFFFFFFF FFFFFFFF (little-endian d[0]=d[1]= 0xFFFFFFFF). The Montgomery parameter:

p_inv = (-(p mod 2^32))^(-1) mod 2^32

p mod 2^32 = 0xFFFFFFFF -(0xFFFFFFFF) mod 2^32 = 0x00000001 0x00000001^(-1) mod 2^32 = 1

So p_inv = 1 for the group-14 prime. In the SOS reduction pass: m_i = t[i] * p_inv mod 2^32 = t[i].

─── R² mod p ──────────────────────────────────────────────────────────── R = 2^2048. R² mod p = 2^4096 mod p. It is computed once at startup by bn_init() via 4096 doublings mod p, and stored in the static s_g14.r2 constant. ─────────────────────────────────────────────────────────────────────────

Definition in file ssh_bignum.cpp.

Function Documentation

◆ bn_from_bytes()

void bn_from_bytes	(	SshBigNum *	out,
		const uint8_t *	bytes,
		size_t	len
	)

Read a big-endian byte array of len bytes into a SshBigNum.

If len < 256 the most-significant limbs are zeroed. If len > 256 only the least-significant 256 bytes are read.

Parameters

out	Destination bignum.
bytes	Big-endian source bytes.
len	Number of source bytes (typically 256 for 2048-bit).

Definition at line 210 of file ssh_bignum.cpp.

References SshBigNum::d.

Referenced by bn_expmod_group14(), and ssh_kexdh_handle().

◆ bn_to_bytes()

void bn_to_bytes	(	uint8_t	bytes[256],
		const SshBigNum *	in
	)

Write a SshBigNum as a 256-byte big-endian array.

Parameters

bytes	Destination buffer (exactly 256 bytes).
in	Source bignum.

Definition at line 222 of file ssh_bignum.cpp.

References SshBigNum::d, and SSH_BN_LIMBS.

Referenced by bn_expmod_group14(), and ssh_kexdh_handle().

◆ bn_cmp()

int bn_cmp	(	const SshBigNum *	a,
		const SshBigNum *	b
	)

Compare two SshBigNum values.

Returns: -1 if a < b, 0 if a == b, 1 if a > b.

Definition at line 234 of file ssh_bignum.cpp.

References SshBigNum::d, and SSH_BN_LIMBS.

Referenced by bn_dh_validate().

◆ bn_is_zero()

int bn_is_zero ( const SshBigNum * a )

Return non-zero if a is zero (all limbs zero).

Definition at line 239 of file ssh_bignum.cpp.

References SshBigNum::d, and SSH_BN_LIMBS.

◆ bn_dh_validate()

int bn_dh_validate ( const SshBigNum * v )

Validate a received DH public value.

RFC 4253 §8: the received value e (or f) must satisfy 1 < e < p-1. Returns 0 if the value is valid, -1 otherwise.

Parameters

v	Received public DH value.

Definition at line 247 of file ssh_bignum.cpp.

References bn_cmp(), SshBigNum::d, group14_p, and SSH_BN_LIMBS.

Referenced by ssh_kexdh_handle().

◆ bn_expmod_group14()

void bn_expmod_group14	(	SshBigNum *	out,
		const SshBigNum *	base,
		const SshBigNum *	exp
	)

Compute out = base^exp mod group14_p.

Uses Montgomery modular exponentiation with left-to-right binary scan. Uses crypto_work[] for all temporaries; zeros crypto_work[] on exit.

On Arduino the computation is delegated to mbedtls_mpi_exp_mod() which uses hardware multiplication and blinding.

Parameters

out	Result (base^exp mod p, 2048-bit).
base	Base value; must satisfy 1 < base < p-1.
exp	Exponent (e.g. the 2048-bit private DH scalar y).

Definition at line 276 of file ssh_bignum.cpp.

References bn_from_bytes(), bn_to_bytes(), and group14_p.

Referenced by ssh_dh_generate(), and ssh_kexdh_handle().

Variable Documentation

◆ crypto_work

uint8_t crypto_work[SSH_CRYPTO_WORK_SIZE]

Global scratch buffer for big-number temporaries.

Only one SSH KEX or RSA-sign operation runs at a time (single Arduino loop task, synchronous handshake). Zeroed after every use via ssh_wipe().

See the layout comment in the file header for the exact field map.

Definition at line 36 of file ssh_bignum.cpp.

◆ group14_p

const SshBigNum group14_p

Initial value:

= {{
    
    0xFFFFFFFFu, 0xFFFFFFFFu, 0x8AACaa68u, 0x15728E5Au, 0x98FA0510u, 0x15D22618u, 0xEA956AE5u, 0x3995497Cu,
    0x95581718u, 0xDE2BCBF6u, 0x6F4C52C9u, 0xB5C55DF0u, 0xEC07A28Fu, 0x9B2783A2u, 0x180E8603u, 0xE39E772Cu,
    0x2E36CE3Bu, 0x32905E46u, 0xCA18217Cu, 0xF1746C08u, 0x4ABC9804u, 0x670C354Eu, 0x7096966Du, 0x9ED52907u,
    0x208552BBu, 0x1C62F356u, 0xDCA3AD96u, 0x83655D23u, 0xFD24CF5Fu, 0x69163FA8u, 0x1C55D39Au, 0x98DA4836u,
    0xA163BF05u, 0xC2007CB8u, 0xECE45B3Du, 0x49286651u, 0x7C4B1FE6u, 0xAE9F2411u, 0x5A899FA5u, 0xEE386BFBu,
    0xF406B7EDu, 0x0BFF5CB6u, 0xA637ED6Bu, 0xF44C42E9u, 0x625E7EC6u, 0xE485B576u, 0x6D51C245u, 0x4FE1356Du,
    0xF25F1437u, 0x302B0A6Du, 0xCD3A431Bu, 0xEF9519B3u, 0x8E3404DDu, 0x514A0879u, 0x3B139B22u, 0x020BBEa6u,
    0x8A67CC74u, 0x29024E08u, 0x80DC1CD1u, 0xC4C6628Bu, 0x2168C234u, 0xC90FDAA2u, 0xFFFFFFFFu, 0xFFFFFFFFu,
}}

The RFC 3526 MODP group-14 prime (2048-bit).

Definition at line 43 of file ssh_bignum.cpp.

Referenced by bn_dh_validate(), and bn_expmod_group14().

◆ group14_g

const SshBigNum group14_g

Initial value:

= {{
    2u, 0u, 0u, 0u, 0u, 0u, 0u, 0u, 0u, 0u, 0u, 0u, 0u, 0u, 0u, 0u, 0u, 0u, 0u, 0u, 0u, 0u,
    0u, 0u, 0u, 0u, 0u, 0u, 0u, 0u, 0u, 0u, 0u, 0u, 0u, 0u, 0u, 0u, 0u, 0u, 0u, 0u, 0u, 0u,
    0u, 0u, 0u, 0u, 0u, 0u, 0u, 0u, 0u, 0u, 0u, 0u, 0u, 0u, 0u, 0u, 0u, 0u, 0u, 0u,
}}

Generator for group-14: g = 2.

Definition at line 55 of file ssh_bignum.cpp.

Referenced by ssh_dh_generate().

Functions

Variables

Detailed Description

Function Documentation

◆ bn_from_bytes()

◆ bn_to_bytes()

◆ bn_cmp()

◆ bn_is_zero()

◆ bn_dh_validate()

◆ bn_expmod_group14()

Variable Documentation

◆ crypto_work

◆ group14_p

◆ group14_g