From df7ec31766cd08eb1e01d59afc79198f5411517e Mon Sep 17 00:00:00 2001
From: Michael Brown <mcb30@ipxe.org>
Date: Tue, 21 Jan 2025 15:13:20 +0000
Subject: [crypto] Generalise elliptic curve key exchange to ecdhe_key()

Split out the portion of tls_send_client_key_exchange_ecdhe() that
actually performs the elliptic curve key exchange into a separate
function ecdhe_key().

Signed-off-by: Michael Brown <mcb30@ipxe.org>
---
 src/crypto/ecdhe.c       | 66 ++++++++++++++++++++++++++++++++++++++++++++++++
 src/include/ipxe/ecdhe.h | 17 +++++++++++++
 src/net/tls.c            | 13 +++-------
 3 files changed, 87 insertions(+), 9 deletions(-)
 create mode 100644 src/crypto/ecdhe.c
 create mode 100644 src/include/ipxe/ecdhe.h

diff --git a/src/crypto/ecdhe.c b/src/crypto/ecdhe.c
new file mode 100644
index 000000000..5481b02eb
--- /dev/null
+++ b/src/crypto/ecdhe.c
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2025 Michael Brown <mbrown@fensystems.co.uk>.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ *
+ * You can also choose to distribute this program under the terms of
+ * the Unmodified Binary Distribution Licence (as given in the file
+ * COPYING.UBDL), provided that you have satisfied its requirements.
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+
+/** @file
+ *
+ * Elliptic Curve Ephemeral Diffie-Hellman (ECDHE) key exchange
+ *
+ */
+
+#include <string.h>
+#include <ipxe/ecdhe.h>
+
+/**
+ * Calculate ECDHE key
+ *
+ * @v curve		Elliptic curve
+ * @v partner		Partner public curve point
+ * @v private		Private key
+ * @v public		Public curve point to fill in (may overlap partner key)
+ * @v shared		Shared secret curve point to fill in
+ * @ret rc		Return status code
+ */
+int ecdhe_key ( struct elliptic_curve *curve, const void *partner,
+		const void *private, void *public, void *shared ) {
+	int rc;
+
+	/* Construct shared key */
+	if ( ( rc = elliptic_multiply ( curve, partner, private,
+					shared ) ) != 0 ) {
+		DBGC ( curve, "CURVE %s could not generate shared key: %s\n",
+		       curve->name, strerror ( rc ) );
+		return rc;
+	}
+
+	/* Construct public key */
+	if ( ( rc = elliptic_multiply ( curve, NULL, private,
+					public ) ) != 0 ) {
+		DBGC ( curve, "CURVE %s could not generate public key: %s\n",
+		       curve->name, strerror ( rc ) );
+		return rc;
+	}
+
+	return 0;
+}
diff --git a/src/include/ipxe/ecdhe.h b/src/include/ipxe/ecdhe.h
new file mode 100644
index 000000000..36fc0a1ee
--- /dev/null
+++ b/src/include/ipxe/ecdhe.h
@@ -0,0 +1,17 @@
+#ifndef _IPXE_ECDHE_H
+#define _IPXE_ECDHE_H
+
+/** @file
+ *
+ * Elliptic Curve Ephemeral Diffie-Hellman (ECDHE) key exchange
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+
+#include <ipxe/crypto.h>
+
+extern int ecdhe_key ( struct elliptic_curve *curve, const void *partner,
+		       const void *private, void *public, void *shared );
+
+#endif /* _IPXE_ECDHE_H */
diff --git a/src/net/tls.c b/src/net/tls.c
index ded100d0e..286d2cc9f 100644
--- a/src/net/tls.c
+++ b/src/net/tls.c
@@ -50,6 +50,7 @@ FILE_LICENCE ( GPL2_OR_LATER );
 #include <ipxe/validator.h>
 #include <ipxe/job.h>
 #include <ipxe/dhe.h>
+#include <ipxe/ecdhe.h>
 #include <ipxe/tls.h>
 #include <config/crypto.h>
 
@@ -1733,9 +1734,9 @@ static int tls_send_client_key_exchange_ecdhe ( struct tls_connection *tls ) {
 		}
 
 		/* Calculate pre-master secret */
-		if ( ( rc = elliptic_multiply ( curve->curve,
-						ecdh->public, private,
-						pre_master_secret ) ) != 0 ) {
+		if ( ( rc = ecdhe_key ( curve->curve, ecdh->public,
+					private, key_xchg.public,
+					pre_master_secret ) ) != 0 ) {
 			DBGC ( tls, "TLS %p could not exchange ECDHE key: %s\n",
 			       tls, strerror ( rc ) );
 			return rc;
@@ -1750,12 +1751,6 @@ static int tls_send_client_key_exchange_ecdhe ( struct tls_connection *tls ) {
 			  htonl ( sizeof ( key_xchg ) -
 				  sizeof ( key_xchg.type_length ) ) );
 		key_xchg.public_len = len;
-		if ( ( rc = elliptic_multiply ( curve->curve, NULL, private,
-						key_xchg.public ) ) != 0 ) {
-			DBGC ( tls, "TLS %p could not generate ECDHE key: %s\n",
-			       tls, strerror ( rc ) );
-			return rc;
-		}
 
 		/* Transmit Client Key Exchange record */
 		if ( ( rc = tls_send_handshake ( tls, &key_xchg,
-- 
cgit