Implement EC-JPAKE

CMakeLists.txt

@@ -4044,6 +4044,18 @@ if(WOLFSSL_SRP)
         )
 endif()
 
+add_option("WOLFSSL_ECJPAKE"
+    "Enable EC-JPAKE (default: disabled)"
+    "no" "yes;no")
+if(WOLFSSL_ECJPAKE)
+    if(NOT WOLFSSL_ECC)
+        message(FATAL_ERROR "WOLFSSL_ECJPAKE requires ECC.")
+    endif()
+    list(APPEND WOLFSSL_DEFINITIONS
+        "-DWOLFCRYPT_HAVE_ECJPAKE"
+        )
+endif()
+
 add_option("WOLFSSL_MOSQUITTO"
     "Enable Mosquitto support (default: disabled)"
     "no" "yes;no")
@@ -5226,6 +5238,7 @@ if(WOLFSSL_EXAMPLES)
         tests/api/test_cmac.c
         tests/api/test_siphash.c
         tests/api/test_srp.c
+        tests/api/test_ecjpake.c
         tests/api/test_eccsi.c
         tests/api/test_sakke.c
         tests/api/test_hpke.c

cmake/functions.cmake

@@ -396,6 +396,9 @@ function(generate_build_flags)
     if(WOLFSSL_SRP OR WOLFSSL_USER_SETTINGS)
         set(BUILD_SRP "yes" PARENT_SCOPE)
     endif()
+    if(WOLFSSL_ECJPAKE OR WOLFSSL_USER_SETTINGS)
+        set(BUILD_ECJPAKE "yes" PARENT_SCOPE)
+    endif()
     if(WOLFSSL_RNG_BANK OR WOLFSSL_USER_SETTINGS)
         set(BUILD_RNG_BANK "yes" PARENT_SCOPE)
     endif()
@@ -1383,6 +1386,10 @@ function(generate_lib_src_list LIB_SOURCES)
             list(APPEND LIB_SOURCES wolfcrypt/src/srp.c)
         endif()
 
+        if(BUILD_ECJPAKE)
+            list(APPEND LIB_SOURCES wolfcrypt/src/ecjpake.c)
+        endif()
+
         # WOLFSSL_RNG_BANK defined WC_RNG_BANK_SUPPORT without ever adding
         # the file that implements it, so the option only linked once
         # something else pulled rng_bank.c in. Matches BUILD_RNG_BANK in

cmake/options.h.in

@@ -581,6 +581,8 @@ extern "C" {
 #cmakedefine WOLFSSL_TEST_CERT
 #undef WOLFCRYPT_HAVE_SRP
 #cmakedefine WOLFCRYPT_HAVE_SRP
+#undef WOLFCRYPT_HAVE_ECJPAKE
+#cmakedefine WOLFCRYPT_HAVE_ECJPAKE
 #undef HAVE_MOSQUITTO
 #cmakedefine HAVE_MOSQUITTO
 #undef HAVE_WEBSERVER

configure.ac

@@ -10297,6 +10297,27 @@ then
 fi
 
 
+# EC-JPAKE password authenticated key exchange
+AC_ARG_ENABLE([ecjpake],
+    [AS_HELP_STRING([--enable-ecjpake],[Enable EC-JPAKE (default: disabled)])],
+    [ ENABLED_ECJPAKE=$enableval ],
+    [ ENABLED_ECJPAKE=no ]
+    )
+
+if test "x$ENABLED_ECJPAKE" = "xyes"
+then
+    if test "$ENABLED_ECC" = "no" || test "$ENABLED_SHA256" = "no"
+    then
+        AC_MSG_ERROR([--enable-ecjpake requires ECC and SHA-256.])
+    fi
+    if test "$ENABLED_SP_MATH" = "yes"
+    then
+        AC_MSG_ERROR([--enable-ecjpake is not supported with --enable-sp-math.])
+    fi
+    AM_CFLAGS="$AM_CFLAGS -DWOLFCRYPT_HAVE_ECJPAKE"
+fi
+
+
 # Indefinite length encoded BER message support
 AC_ARG_ENABLE([indef],
     [AS_HELP_STRING([--enable-indef],[Enable parsing of indefinite length encoded msgs (default: disabled)])],
@@ -14669,6 +14690,7 @@ AM_CONDITIONAL([BUILD_OCSP_STAPLING_V2],[test "x$ENABLED_CERTIFICATE_STATUS_REQU
 AM_CONDITIONAL([BUILD_CRL],[test "x$ENABLED_CRL" != "xno" || test "x$ENABLED_USERSETTINGS" = "xyes"])
 AM_CONDITIONAL([BUILD_CRL_MONITOR],[test "x$ENABLED_CRL_MONITOR" = "xyes"])
 AM_CONDITIONAL([BUILD_SRP],[test "x$ENABLED_SRP" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
+AM_CONDITIONAL([BUILD_ECJPAKE],[test "x$ENABLED_ECJPAKE" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
 AM_CONDITIONAL([USE_VALGRIND],[test "x$ENABLED_VALGRIND" = "xyes"])
 AM_CONDITIONAL([BUILD_MD4],[test "x$ENABLED_MD4" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
 AM_CONDITIONAL([BUILD_PWDBASED],[test "x$ENABLED_PWDBASED" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
@@ -15311,6 +15333,7 @@ echo "   * wolfTPM:                    $ENABLED_WOLFTPM"
 echo "   * wolfCLU:                    $ENABLED_WOLFCLU"
 echo "   * wolfSCEP:                   $ENABLED_WOLFSCEP"
 echo "   * Secure Remote Password:     $ENABLED_SRP"
+echo "   * EC-JPAKE:                   $ENABLED_ECJPAKE"
 echo "   * Small Stack:                $ENABLED_SMALL_STACK"
 echo "   * Linux Kernel Module:        $ENABLED_LINUXKM"
 

src/include.am

@@ -2402,6 +2402,10 @@ if BUILD_SRP
 src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/srp.c
 endif
 
+if BUILD_ECJPAKE
+src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/ecjpake.c
+endif
+
 if BUILD_AFALG
 src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/port/af_alg/wc_afalg.c
 endif