]>
Commit | Line | Data |
---|---|---|
1aec7716 | 1 | /* |
a28d06f3 | 2 | * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved. |
1aec7716 SL |
3 | * Copyright (c) 2019, Oracle and/or its affiliates. All rights reserved. |
4 | * | |
5 | * Licensed under the Apache License 2.0 (the "License"). You may not use | |
6 | * this file except in compliance with the License. You can obtain a copy | |
7 | * in the file LICENSE in the source distribution or at | |
8 | * https://www.openssl.org/source/license.html | |
9 | */ | |
10 | ||
d5f9166b | 11 | #include "internal/e_os.h" |
e5b2cd58 SL |
12 | #include <openssl/core_names.h> |
13 | #include <openssl/core_dispatch.h> | |
14 | #include <openssl/err.h> | |
15 | #include <openssl/evp.h> | |
16 | #include <openssl/params.h> | |
2741128e | 17 | #include <openssl/proverr.h> |
e5b2cd58 SL |
18 | #include "internal/packet.h" |
19 | #include "internal/der.h" | |
20 | #include "prov/provider_ctx.h" | |
2b9e4e95 | 21 | #include "prov/providercommon.h" |
e5b2cd58 SL |
22 | #include "prov/implementations.h" |
23 | #include "prov/provider_util.h" | |
24 | #include "prov/der_wrap.h" | |
25 | ||
26 | #define X942KDF_MAX_INLEN (1 << 30) | |
1aec7716 | 27 | |
363b1e5d | 28 | static OSSL_FUNC_kdf_newctx_fn x942kdf_new; |
769cd465 | 29 | static OSSL_FUNC_kdf_dupctx_fn x942kdf_dup; |
363b1e5d DMSP |
30 | static OSSL_FUNC_kdf_freectx_fn x942kdf_free; |
31 | static OSSL_FUNC_kdf_reset_fn x942kdf_reset; | |
32 | static OSSL_FUNC_kdf_derive_fn x942kdf_derive; | |
33 | static OSSL_FUNC_kdf_settable_ctx_params_fn x942kdf_settable_ctx_params; | |
34 | static OSSL_FUNC_kdf_set_ctx_params_fn x942kdf_set_ctx_params; | |
35 | static OSSL_FUNC_kdf_gettable_ctx_params_fn x942kdf_gettable_ctx_params; | |
36 | static OSSL_FUNC_kdf_get_ctx_params_fn x942kdf_get_ctx_params; | |
e3405a4a P |
37 | |
38 | typedef struct { | |
39 | void *provctx; | |
e97bab69 | 40 | PROV_DIGEST digest; |
1aec7716 SL |
41 | unsigned char *secret; |
42 | size_t secret_len; | |
8a686bdb SL |
43 | unsigned char *acvpinfo; |
44 | size_t acvpinfo_len; | |
89cccbea SL |
45 | unsigned char *partyuinfo, *partyvinfo, *supp_pubinfo, *supp_privinfo; |
46 | size_t partyuinfo_len, partyvinfo_len, supp_pubinfo_len, supp_privinfo_len; | |
1aec7716 | 47 | size_t dkm_len; |
e5b2cd58 SL |
48 | const unsigned char *cek_oid; |
49 | size_t cek_oid_len; | |
89cccbea | 50 | int use_keybits; |
e3405a4a | 51 | } KDF_X942; |
1aec7716 | 52 | |
e5b2cd58 SL |
53 | /* |
54 | * A table of allowed wrapping algorithms, oids and the associated output | |
55 | * lengths. | |
56 | * NOTE: RC2wrap and camellia128_wrap have been removed as there are no | |
57 | * corresponding ciphers for these operations. | |
58 | */ | |
1aec7716 | 59 | static const struct { |
e5b2cd58 SL |
60 | const char *name; |
61 | const unsigned char *oid; | |
62 | size_t oid_len; | |
1aec7716 SL |
63 | size_t keklen; /* size in bytes */ |
64 | } kek_algs[] = { | |
01290306 P |
65 | { "AES-128-WRAP", ossl_der_oid_id_aes128_wrap, DER_OID_SZ_id_aes128_wrap, |
66 | 16 }, | |
67 | { "AES-192-WRAP", ossl_der_oid_id_aes192_wrap, DER_OID_SZ_id_aes192_wrap, | |
e5b2cd58 | 68 | 24 }, |
01290306 P |
69 | { "AES-256-WRAP", ossl_der_oid_id_aes256_wrap, DER_OID_SZ_id_aes256_wrap, |
70 | 32 }, | |
71 | #ifndef FIPS_MODULE | |
72 | { "DES3-WRAP", ossl_der_oid_id_alg_CMS3DESwrap, | |
73 | DER_OID_SZ_id_alg_CMS3DESwrap, 24 }, | |
e5b2cd58 | 74 | #endif |
1aec7716 SL |
75 | }; |
76 | ||
b4250010 | 77 | static int find_alg_id(OSSL_LIB_CTX *libctx, const char *algname, |
e771249c | 78 | const char *propq, size_t *id) |
1aec7716 | 79 | { |
e5b2cd58 SL |
80 | int ret = 1; |
81 | size_t i; | |
82 | EVP_CIPHER *cipher; | |
1aec7716 | 83 | |
e771249c | 84 | cipher = EVP_CIPHER_fetch(libctx, algname, propq); |
e5b2cd58 SL |
85 | if (cipher != NULL) { |
86 | for (i = 0; i < OSSL_NELEM(kek_algs); i++) { | |
87 | if (EVP_CIPHER_is_a(cipher, kek_algs[i].name)) { | |
88 | *id = i; | |
89 | goto end; | |
90 | } | |
91 | } | |
92 | } | |
93 | ret = 0; | |
94 | ERR_raise(ERR_LIB_PROV, PROV_R_UNSUPPORTED_CEK_ALG); | |
95 | end: | |
96 | EVP_CIPHER_free(cipher); | |
97 | return ret; | |
98 | } | |
99 | ||
100 | static int DER_w_keyinfo(WPACKET *pkt, | |
101 | const unsigned char *der_oid, size_t der_oidlen, | |
102 | unsigned char **pcounter) | |
103 | { | |
a55b00bd | 104 | return ossl_DER_w_begin_sequence(pkt, -1) |
e5b2cd58 | 105 | /* Store the initial value of 1 into the counter */ |
a55b00bd | 106 | && ossl_DER_w_octet_string_uint32(pkt, -1, 1) |
e5b2cd58 SL |
107 | /* Remember where we stored the counter in the buffer */ |
108 | && (pcounter == NULL | |
109 | || (*pcounter = WPACKET_get_curr(pkt)) != NULL) | |
a55b00bd P |
110 | && ossl_DER_w_precompiled(pkt, -1, der_oid, der_oidlen) |
111 | && ossl_DER_w_end_sequence(pkt, -1); | |
e5b2cd58 SL |
112 | } |
113 | ||
114 | static int der_encode_sharedinfo(WPACKET *pkt, unsigned char *buf, size_t buflen, | |
115 | const unsigned char *der_oid, size_t der_oidlen, | |
8a686bdb | 116 | const unsigned char *acvp, size_t acvplen, |
89cccbea SL |
117 | const unsigned char *partyu, size_t partyulen, |
118 | const unsigned char *partyv, size_t partyvlen, | |
119 | const unsigned char *supp_pub, size_t supp_publen, | |
120 | const unsigned char *supp_priv, size_t supp_privlen, | |
e5b2cd58 SL |
121 | uint32_t keylen_bits, unsigned char **pcounter) |
122 | { | |
123 | return (buf != NULL ? WPACKET_init_der(pkt, buf, buflen) : | |
124 | WPACKET_init_null_der(pkt)) | |
a55b00bd | 125 | && ossl_DER_w_begin_sequence(pkt, -1) |
89cccbea SL |
126 | && (supp_priv == NULL |
127 | || ossl_DER_w_octet_string(pkt, 3, supp_priv, supp_privlen)) | |
128 | && (supp_pub == NULL | |
129 | || ossl_DER_w_octet_string(pkt, 2, supp_pub, supp_publen)) | |
130 | && (keylen_bits == 0 | |
131 | || ossl_DER_w_octet_string_uint32(pkt, 2, keylen_bits)) | |
132 | && (partyv == NULL || ossl_DER_w_octet_string(pkt, 1, partyv, partyvlen)) | |
133 | && (partyu == NULL || ossl_DER_w_octet_string(pkt, 0, partyu, partyulen)) | |
8a686bdb | 134 | && (acvp == NULL || ossl_DER_w_precompiled(pkt, -1, acvp, acvplen)) |
e5b2cd58 | 135 | && DER_w_keyinfo(pkt, der_oid, der_oidlen, pcounter) |
a55b00bd | 136 | && ossl_DER_w_end_sequence(pkt, -1) |
e5b2cd58 | 137 | && WPACKET_finish(pkt); |
1aec7716 SL |
138 | } |
139 | ||
140 | /* | |
141 | * Encode the other info structure. | |
142 | * | |
89cccbea | 143 | * The ANS X9.42-2003 standard uses OtherInfo: |
1aec7716 SL |
144 | * |
145 | * OtherInfo ::= SEQUENCE { | |
146 | * keyInfo KeySpecificInfo, | |
89cccbea SL |
147 | * partyUInfo [0] OCTET STRING OPTIONAL, |
148 | * partyVInfo [1] OCTET STRING OPTIONAL, | |
149 | * suppPubInfo [2] OCTET STRING OPTIONAL, | |
150 | * suppPrivInfo [3] OCTET STRING OPTIONAL | |
1aec7716 SL |
151 | * } |
152 | * | |
153 | * KeySpecificInfo ::= SEQUENCE { | |
154 | * algorithm OBJECT IDENTIFIER, | |
155 | * counter OCTET STRING SIZE (4..4) | |
156 | * } | |
89cccbea SL |
157 | * |
158 | * RFC2631 Section 2.1.2 Contains the following definition for OtherInfo | |
159 | * | |
160 | * OtherInfo ::= SEQUENCE { | |
161 | * keyInfo KeySpecificInfo, | |
162 | * partyAInfo [0] OCTET STRING OPTIONAL, | |
163 | * suppPubInfo [2] OCTET STRING | |
164 | * } | |
165 | * Where suppPubInfo is the key length (in bits) (stored into 4 bytes) | |
166 | * | |
1aec7716 | 167 | * |keylen| is the length (in bytes) of the generated KEK. It is stored into |
8a686bdb | 168 | * suppPubInfo (in bits). It is ignored if the value is 0. |
e5b2cd58 SL |
169 | * |cek_oid| The oid of the key wrapping algorithm. |
170 | * |cek_oidlen| The length (in bytes) of the key wrapping algorithm oid, | |
8a686bdb SL |
171 | * |acvp| is the optional blob of DER data representing one or more of the |
172 | * OtherInfo fields related to |partyu|, |partyv|, |supp_pub| and |supp_priv|. | |
1ab8b7cd | 173 | * This field should normally be NULL. If |acvp| is non NULL then |partyu|, |
8a686bdb SL |
174 | * |partyv|, |supp_pub| and |supp_priv| should all be NULL. |
175 | * |acvp_len| is the |acvp| length (in bytes). | |
176 | * |partyu| is the optional public info contributed by the initiator. | |
177 | * It can be NULL. (It is also used as the ukm by CMS). | |
89cccbea | 178 | * |partyu_len| is the |partyu| length (in bytes). |
8a686bdb SL |
179 | * |partyv| is the optional public info contributed by the responder. |
180 | * It can be NULL. | |
89cccbea | 181 | * |partyv_len| is the |partyv| length (in bytes). |
8a686bdb SL |
182 | * |supp_pub| is the optional additional, mutually-known public information. |
183 | * It can be NULL. |keylen| should be 0 if this is not NULL. | |
89cccbea | 184 | * |supp_pub_len| is the |supp_pub| length (in bytes). |
8a686bdb SL |
185 | * |supp_priv| is the optional additional, mutually-known private information. |
186 | * It can be NULL. | |
89cccbea | 187 | * |supp_priv_len| is the |supp_priv| length (in bytes). |
1aec7716 SL |
188 | * |der| is the returned encoded data. It must be freed by the caller. |
189 | * |der_len| is the returned size of the encoded data. | |
190 | * |out_ctr| returns a pointer to the counter data which is embedded inside the | |
8a686bdb SL |
191 | * encoded data. This allows the counter bytes to be updated without |
192 | * re-encoding. | |
1aec7716 SL |
193 | * |
194 | * Returns: 1 if successfully encoded, or 0 otherwise. | |
195 | * Assumptions: |der|, |der_len| & |out_ctr| are not NULL. | |
196 | */ | |
89cccbea SL |
197 | static int |
198 | x942_encode_otherinfo(size_t keylen, | |
8a686bdb SL |
199 | const unsigned char *cek_oid, size_t cek_oid_len, |
200 | const unsigned char *acvp, size_t acvp_len, | |
89cccbea SL |
201 | const unsigned char *partyu, size_t partyu_len, |
202 | const unsigned char *partyv, size_t partyv_len, | |
203 | const unsigned char *supp_pub, size_t supp_pub_len, | |
204 | const unsigned char *supp_priv, size_t supp_priv_len, | |
205 | unsigned char **der, size_t *der_len, | |
206 | unsigned char **out_ctr) | |
1aec7716 | 207 | { |
e5b2cd58 SL |
208 | int ret = 0; |
209 | unsigned char *pcounter = NULL, *der_buf = NULL; | |
210 | size_t der_buflen = 0; | |
211 | WPACKET pkt; | |
212 | uint32_t keylen_bits; | |
213 | ||
214 | /* keylenbits must fit into 4 bytes */ | |
215 | if (keylen > 0xFFFFFF) | |
61d61c5f | 216 | return 0; |
e5b2cd58 SL |
217 | keylen_bits = 8 * keylen; |
218 | ||
219 | /* Calculate the size of the buffer */ | |
8a686bdb SL |
220 | if (!der_encode_sharedinfo(&pkt, NULL, 0, cek_oid, cek_oid_len, |
221 | acvp, acvp_len, | |
89cccbea SL |
222 | partyu, partyu_len, partyv, partyv_len, |
223 | supp_pub, supp_pub_len, supp_priv, supp_priv_len, | |
e5b2cd58 SL |
224 | keylen_bits, NULL) |
225 | || !WPACKET_get_total_written(&pkt, &der_buflen)) | |
226 | goto err; | |
227 | WPACKET_cleanup(&pkt); | |
228 | /* Alloc the buffer */ | |
229 | der_buf = OPENSSL_zalloc(der_buflen); | |
230 | if (der_buf == NULL) | |
231 | goto err; | |
232 | /* Encode into the buffer */ | |
8a686bdb SL |
233 | if (!der_encode_sharedinfo(&pkt, der_buf, der_buflen, cek_oid, cek_oid_len, |
234 | acvp, acvp_len, | |
89cccbea SL |
235 | partyu, partyu_len, partyv, partyv_len, |
236 | supp_pub, supp_pub_len, supp_priv, supp_priv_len, | |
237 | keylen_bits, &pcounter)) | |
e5b2cd58 SL |
238 | goto err; |
239 | /* | |
240 | * Since we allocated the exact size required, the buffer should point to the | |
241 | * start of the alllocated buffer at this point. | |
242 | */ | |
243 | if (WPACKET_get_curr(&pkt) != der_buf) | |
1aec7716 SL |
244 | goto err; |
245 | ||
e5b2cd58 SL |
246 | /* |
247 | * The data for the DER encoded octet string of a 32 bit counter = 1 | |
248 | * should be 04 04 00 00 00 01 | |
249 | * So just check the header is correct and skip over it. | |
250 | * This counter will be incremented in the kdf update loop. | |
251 | */ | |
252 | if (pcounter == NULL | |
253 | || pcounter[0] != 0x04 | |
254 | || pcounter[1] != 0x04) | |
255 | goto err; | |
256 | *out_ctr = (pcounter + 2); | |
257 | *der = der_buf; | |
258 | *der_len = der_buflen; | |
259 | ret = 1; | |
1aec7716 | 260 | err: |
e5b2cd58 | 261 | WPACKET_cleanup(&pkt); |
1aec7716 SL |
262 | return ret; |
263 | } | |
264 | ||
265 | static int x942kdf_hash_kdm(const EVP_MD *kdf_md, | |
266 | const unsigned char *z, size_t z_len, | |
267 | const unsigned char *other, size_t other_len, | |
268 | unsigned char *ctr, | |
269 | unsigned char *derived_key, size_t derived_key_len) | |
270 | { | |
271 | int ret = 0, hlen; | |
272 | size_t counter, out_len, len = derived_key_len; | |
273 | unsigned char mac[EVP_MAX_MD_SIZE]; | |
274 | unsigned char *out = derived_key; | |
275 | EVP_MD_CTX *ctx = NULL, *ctx_init = NULL; | |
276 | ||
8a686bdb SL |
277 | if (z_len > X942KDF_MAX_INLEN |
278 | || other_len > X942KDF_MAX_INLEN | |
279 | || derived_key_len > X942KDF_MAX_INLEN | |
280 | || derived_key_len == 0) { | |
e3405a4a | 281 | ERR_raise(ERR_LIB_PROV, PROV_R_BAD_LENGTH); |
1aec7716 SL |
282 | return 0; |
283 | } | |
284 | ||
ed576acd | 285 | hlen = EVP_MD_get_size(kdf_md); |
1aec7716 SL |
286 | if (hlen <= 0) |
287 | return 0; | |
288 | out_len = (size_t)hlen; | |
289 | ||
290 | ctx = EVP_MD_CTX_create(); | |
291 | ctx_init = EVP_MD_CTX_create(); | |
292 | if (ctx == NULL || ctx_init == NULL) | |
293 | goto end; | |
294 | ||
295 | if (!EVP_DigestInit(ctx_init, kdf_md)) | |
296 | goto end; | |
297 | ||
298 | for (counter = 1;; counter++) { | |
299 | /* updating the ctr modifies 4 bytes in the 'other' buffer */ | |
300 | ctr[0] = (unsigned char)((counter >> 24) & 0xff); | |
301 | ctr[1] = (unsigned char)((counter >> 16) & 0xff); | |
302 | ctr[2] = (unsigned char)((counter >> 8) & 0xff); | |
303 | ctr[3] = (unsigned char)(counter & 0xff); | |
304 | ||
305 | if (!EVP_MD_CTX_copy_ex(ctx, ctx_init) | |
306 | || !EVP_DigestUpdate(ctx, z, z_len) | |
307 | || !EVP_DigestUpdate(ctx, other, other_len)) | |
308 | goto end; | |
309 | if (len >= out_len) { | |
310 | if (!EVP_DigestFinal_ex(ctx, out, NULL)) | |
311 | goto end; | |
312 | out += out_len; | |
313 | len -= out_len; | |
314 | if (len == 0) | |
315 | break; | |
316 | } else { | |
317 | if (!EVP_DigestFinal_ex(ctx, mac, NULL)) | |
318 | goto end; | |
319 | memcpy(out, mac, len); | |
320 | break; | |
321 | } | |
322 | } | |
323 | ret = 1; | |
324 | end: | |
325 | EVP_MD_CTX_free(ctx); | |
326 | EVP_MD_CTX_free(ctx_init); | |
327 | OPENSSL_cleanse(mac, sizeof(mac)); | |
328 | return ret; | |
329 | } | |
330 | ||
e3405a4a | 331 | static void *x942kdf_new(void *provctx) |
1aec7716 | 332 | { |
e3405a4a | 333 | KDF_X942 *ctx; |
1aec7716 | 334 | |
2b9e4e95 P |
335 | if (!ossl_prov_is_running()) |
336 | return 0; | |
337 | ||
e3405a4a P |
338 | if ((ctx = OPENSSL_zalloc(sizeof(*ctx))) == NULL) |
339 | ERR_raise(ERR_LIB_PROV, ERR_R_MALLOC_FAILURE); | |
340 | ctx->provctx = provctx; | |
89cccbea | 341 | ctx->use_keybits = 1; |
e3405a4a | 342 | return ctx; |
1aec7716 SL |
343 | } |
344 | ||
e3405a4a | 345 | static void x942kdf_reset(void *vctx) |
1aec7716 | 346 | { |
e3405a4a | 347 | KDF_X942 *ctx = (KDF_X942 *)vctx; |
0577959c | 348 | void *provctx = ctx->provctx; |
1aec7716 | 349 | |
e97bab69 | 350 | ossl_prov_digest_reset(&ctx->digest); |
e3405a4a | 351 | OPENSSL_clear_free(ctx->secret, ctx->secret_len); |
8a686bdb | 352 | OPENSSL_clear_free(ctx->acvpinfo, ctx->acvpinfo_len); |
89cccbea SL |
353 | OPENSSL_clear_free(ctx->partyuinfo, ctx->partyuinfo_len); |
354 | OPENSSL_clear_free(ctx->partyvinfo, ctx->partyvinfo_len); | |
355 | OPENSSL_clear_free(ctx->supp_pubinfo, ctx->supp_pubinfo_len); | |
356 | OPENSSL_clear_free(ctx->supp_privinfo, ctx->supp_privinfo_len); | |
e3405a4a | 357 | memset(ctx, 0, sizeof(*ctx)); |
0577959c | 358 | ctx->provctx = provctx; |
89cccbea | 359 | ctx->use_keybits = 1; |
1aec7716 SL |
360 | } |
361 | ||
e3405a4a | 362 | static void x942kdf_free(void *vctx) |
1aec7716 | 363 | { |
e3405a4a | 364 | KDF_X942 *ctx = (KDF_X942 *)vctx; |
1aec7716 | 365 | |
3c659415 P |
366 | if (ctx != NULL) { |
367 | x942kdf_reset(ctx); | |
368 | OPENSSL_free(ctx); | |
369 | } | |
1aec7716 SL |
370 | } |
371 | ||
769cd465 P |
372 | static void *x942kdf_dup(void *vctx) |
373 | { | |
374 | const KDF_X942 *src = (const KDF_X942 *)vctx; | |
375 | KDF_X942 *dest; | |
376 | ||
377 | dest = x942kdf_new(src->provctx); | |
378 | if (dest != NULL) { | |
379 | if (!ossl_prov_memdup(src->secret, src->secret_len, | |
380 | &dest->secret , &dest->secret_len) | |
381 | || !ossl_prov_memdup(src->acvpinfo, src->acvpinfo_len, | |
382 | &dest->acvpinfo , &dest->acvpinfo_len) | |
383 | || !ossl_prov_memdup(src->partyuinfo, src->partyuinfo_len, | |
384 | &dest->partyuinfo , &dest->partyuinfo_len) | |
385 | || !ossl_prov_memdup(src->partyvinfo, src->partyvinfo_len, | |
386 | &dest->partyvinfo , &dest->partyvinfo_len) | |
387 | || !ossl_prov_memdup(src->supp_pubinfo, src->supp_pubinfo_len, | |
388 | &dest->supp_pubinfo, | |
389 | &dest->supp_pubinfo_len) | |
390 | || !ossl_prov_memdup(src->supp_privinfo, src->supp_privinfo_len, | |
391 | &dest->supp_privinfo, | |
392 | &dest->supp_privinfo_len) | |
393 | || !ossl_prov_digest_copy(&dest->digest, &src->digest)) | |
394 | goto err; | |
395 | dest->cek_oid = src->cek_oid; | |
396 | dest->cek_oid_len = src->cek_oid_len; | |
397 | dest->dkm_len = src->dkm_len; | |
398 | dest->use_keybits = src->use_keybits; | |
399 | } | |
400 | return dest; | |
401 | ||
402 | err: | |
403 | x942kdf_free(dest); | |
404 | return NULL; | |
405 | } | |
406 | ||
e3405a4a P |
407 | static int x942kdf_set_buffer(unsigned char **out, size_t *out_len, |
408 | const OSSL_PARAM *p) | |
1aec7716 | 409 | { |
e3405a4a | 410 | if (p->data_size == 0 || p->data == NULL) |
1aec7716 SL |
411 | return 1; |
412 | ||
e3405a4a P |
413 | OPENSSL_free(*out); |
414 | *out = NULL; | |
415 | return OSSL_PARAM_get_octet_string(p, (void **)out, 0, out_len); | |
1aec7716 SL |
416 | } |
417 | ||
e3405a4a | 418 | static size_t x942kdf_size(KDF_X942 *ctx) |
1aec7716 SL |
419 | { |
420 | int len; | |
e97bab69 | 421 | const EVP_MD *md = ossl_prov_digest_md(&ctx->digest); |
1aec7716 | 422 | |
e97bab69 | 423 | if (md == NULL) { |
e3405a4a | 424 | ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_MESSAGE_DIGEST); |
1aec7716 SL |
425 | return 0; |
426 | } | |
ed576acd | 427 | len = EVP_MD_get_size(md); |
1aec7716 SL |
428 | return (len <= 0) ? 0 : (size_t)len; |
429 | } | |
430 | ||
3469b388 P |
431 | static int x942kdf_derive(void *vctx, unsigned char *key, size_t keylen, |
432 | const OSSL_PARAM params[]) | |
1aec7716 | 433 | { |
e3405a4a | 434 | KDF_X942 *ctx = (KDF_X942 *)vctx; |
2b9e4e95 | 435 | const EVP_MD *md; |
1aec7716 SL |
436 | int ret = 0; |
437 | unsigned char *ctr; | |
438 | unsigned char *der = NULL; | |
439 | size_t der_len = 0; | |
440 | ||
3469b388 | 441 | if (!ossl_prov_is_running() || !x942kdf_set_ctx_params(ctx, params)) |
2b9e4e95 P |
442 | return 0; |
443 | ||
89cccbea SL |
444 | /* |
445 | * These 2 options encode to the same field so only one of them should be | |
446 | * active at once. | |
447 | */ | |
448 | if (ctx->use_keybits && ctx->supp_pubinfo != NULL) { | |
449 | ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_PUBINFO); | |
450 | return 0; | |
451 | } | |
8a686bdb SL |
452 | /* |
453 | * If the blob of acvp data is used then the individual info fields that it | |
454 | * replaces should not also be defined. | |
455 | */ | |
456 | if (ctx->acvpinfo != NULL | |
457 | && (ctx->partyuinfo != NULL | |
458 | || ctx->partyvinfo != NULL | |
459 | || ctx->supp_pubinfo != NULL | |
460 | || ctx->supp_privinfo != NULL)) { | |
461 | ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_DATA); | |
462 | return 0; | |
463 | } | |
e3405a4a P |
464 | if (ctx->secret == NULL) { |
465 | ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_SECRET); | |
1aec7716 SL |
466 | return 0; |
467 | } | |
2b9e4e95 | 468 | md = ossl_prov_digest_md(&ctx->digest); |
e97bab69 | 469 | if (md == NULL) { |
e3405a4a | 470 | ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_MESSAGE_DIGEST); |
1aec7716 SL |
471 | return 0; |
472 | } | |
e5b2cd58 | 473 | if (ctx->cek_oid == NULL || ctx->cek_oid_len == 0) { |
e3405a4a | 474 | ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_CEK_ALG); |
1aec7716 SL |
475 | return 0; |
476 | } | |
89cccbea | 477 | if (ctx->partyuinfo != NULL && ctx->partyuinfo_len >= X942KDF_MAX_INLEN) { |
1aec7716 | 478 | /* |
89cccbea | 479 | * Note the ukm length MUST be 512 bits if it is used. |
1aec7716 SL |
480 | * For backwards compatibility the old check is being done. |
481 | */ | |
89cccbea | 482 | ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_UKM_LENGTH); |
1aec7716 SL |
483 | return 0; |
484 | } | |
1aec7716 | 485 | /* generate the otherinfo der */ |
89cccbea | 486 | if (!x942_encode_otherinfo(ctx->use_keybits ? ctx->dkm_len : 0, |
e5b2cd58 | 487 | ctx->cek_oid, ctx->cek_oid_len, |
8a686bdb | 488 | ctx->acvpinfo, ctx->acvpinfo_len, |
89cccbea SL |
489 | ctx->partyuinfo, ctx->partyuinfo_len, |
490 | ctx->partyvinfo, ctx->partyvinfo_len, | |
491 | ctx->supp_pubinfo, ctx->supp_pubinfo_len, | |
492 | ctx->supp_privinfo, ctx->supp_privinfo_len, | |
1aec7716 | 493 | &der, &der_len, &ctr)) { |
e3405a4a | 494 | ERR_raise(ERR_LIB_PROV, PROV_R_BAD_ENCODING); |
1aec7716 SL |
495 | return 0; |
496 | } | |
e97bab69 | 497 | ret = x942kdf_hash_kdm(md, ctx->secret, ctx->secret_len, |
1aec7716 SL |
498 | der, der_len, ctr, key, keylen); |
499 | OPENSSL_free(der); | |
500 | return ret; | |
501 | } | |
502 | ||
e3405a4a P |
503 | static int x942kdf_set_ctx_params(void *vctx, const OSSL_PARAM params[]) |
504 | { | |
e771249c | 505 | const OSSL_PARAM *p, *pq; |
e3405a4a | 506 | KDF_X942 *ctx = vctx; |
a829b735 | 507 | OSSL_LIB_CTX *provctx = PROV_LIBCTX_OF(ctx->provctx); |
e771249c | 508 | const char *propq = NULL; |
e5b2cd58 | 509 | size_t id; |
e3405a4a | 510 | |
c983a0e5 P |
511 | if (params == NULL) |
512 | return 1; | |
e97bab69 P |
513 | if (!ossl_prov_digest_load_from_params(&ctx->digest, params, provctx)) |
514 | return 0; | |
e3405a4a | 515 | |
89cccbea SL |
516 | p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_SECRET); |
517 | if (p == NULL) | |
518 | p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_KEY); | |
519 | if (p != NULL && !x942kdf_set_buffer(&ctx->secret, &ctx->secret_len, p)) | |
520 | return 0; | |
521 | ||
8a686bdb SL |
522 | p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_X942_ACVPINFO); |
523 | if (p != NULL | |
524 | && !x942kdf_set_buffer(&ctx->acvpinfo, &ctx->acvpinfo_len, p)) | |
525 | return 0; | |
526 | ||
89cccbea SL |
527 | p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_X942_PARTYUINFO); |
528 | if (p == NULL) | |
529 | p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_UKM); | |
530 | if (p != NULL | |
531 | && !x942kdf_set_buffer(&ctx->partyuinfo, &ctx->partyuinfo_len, p)) | |
532 | return 0; | |
e3405a4a | 533 | |
89cccbea SL |
534 | p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_X942_PARTYVINFO); |
535 | if (p != NULL | |
536 | && !x942kdf_set_buffer(&ctx->partyvinfo, &ctx->partyvinfo_len, p)) | |
537 | return 0; | |
538 | ||
539 | p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_X942_USE_KEYBITS); | |
540 | if (p != NULL && !OSSL_PARAM_get_int(p, &ctx->use_keybits)) | |
541 | return 0; | |
542 | ||
543 | p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_X942_SUPP_PUBINFO); | |
544 | if (p != NULL) { | |
545 | if (!x942kdf_set_buffer(&ctx->supp_pubinfo, &ctx->supp_pubinfo_len, p)) | |
e3405a4a | 546 | return 0; |
89cccbea SL |
547 | ctx->use_keybits = 0; |
548 | } | |
549 | ||
550 | p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_X942_SUPP_PRIVINFO); | |
551 | if (p != NULL | |
552 | && !x942kdf_set_buffer(&ctx->supp_privinfo, &ctx->supp_privinfo_len, p)) | |
553 | return 0; | |
e3405a4a | 554 | |
89cccbea SL |
555 | p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_CEK_ALG); |
556 | if (p != NULL) { | |
e3405a4a P |
557 | if (p->data_type != OSSL_PARAM_UTF8_STRING) |
558 | return 0; | |
e771249c SL |
559 | pq = OSSL_PARAM_locate_const(params, OSSL_ALG_PARAM_PROPERTIES); |
560 | /* | |
561 | * We already grab the properties during ossl_prov_digest_load_from_params() | |
562 | * so there is no need to check the validity again.. | |
563 | */ | |
564 | if (pq != NULL) | |
565 | propq = p->data; | |
566 | if (find_alg_id(provctx, p->data, propq, &id) == 0) | |
e5b2cd58 SL |
567 | return 0; |
568 | ctx->cek_oid = kek_algs[id].oid; | |
569 | ctx->cek_oid_len = kek_algs[id].oid_len; | |
570 | ctx->dkm_len = kek_algs[id].keklen; | |
e3405a4a P |
571 | } |
572 | return 1; | |
573 | } | |
574 | ||
1e8e5c60 P |
575 | static const OSSL_PARAM *x942kdf_settable_ctx_params(ossl_unused void *ctx, |
576 | ossl_unused void *provctx) | |
e3405a4a P |
577 | { |
578 | static const OSSL_PARAM known_settable_ctx_params[] = { | |
579 | OSSL_PARAM_utf8_string(OSSL_KDF_PARAM_PROPERTIES, NULL, 0), | |
580 | OSSL_PARAM_utf8_string(OSSL_KDF_PARAM_DIGEST, NULL, 0), | |
581 | OSSL_PARAM_octet_string(OSSL_KDF_PARAM_SECRET, NULL, 0), | |
582 | OSSL_PARAM_octet_string(OSSL_KDF_PARAM_KEY, NULL, 0), | |
583 | OSSL_PARAM_octet_string(OSSL_KDF_PARAM_UKM, NULL, 0), | |
8a686bdb | 584 | OSSL_PARAM_octet_string(OSSL_KDF_PARAM_X942_ACVPINFO, NULL, 0), |
89cccbea SL |
585 | OSSL_PARAM_octet_string(OSSL_KDF_PARAM_X942_PARTYUINFO, NULL, 0), |
586 | OSSL_PARAM_octet_string(OSSL_KDF_PARAM_X942_PARTYVINFO, NULL, 0), | |
587 | OSSL_PARAM_octet_string(OSSL_KDF_PARAM_X942_SUPP_PUBINFO, NULL, 0), | |
588 | OSSL_PARAM_octet_string(OSSL_KDF_PARAM_X942_SUPP_PRIVINFO, NULL, 0), | |
589 | OSSL_PARAM_int(OSSL_KDF_PARAM_X942_USE_KEYBITS, NULL), | |
e3405a4a P |
590 | OSSL_PARAM_utf8_string(OSSL_KDF_PARAM_CEK_ALG, NULL, 0), |
591 | OSSL_PARAM_END | |
592 | }; | |
593 | return known_settable_ctx_params; | |
594 | } | |
595 | ||
596 | static int x942kdf_get_ctx_params(void *vctx, OSSL_PARAM params[]) | |
597 | { | |
598 | KDF_X942 *ctx = (KDF_X942 *)vctx; | |
599 | OSSL_PARAM *p; | |
600 | ||
601 | if ((p = OSSL_PARAM_locate(params, OSSL_KDF_PARAM_SIZE)) != NULL) | |
602 | return OSSL_PARAM_set_size_t(p, x942kdf_size(ctx)); | |
603 | return -2; | |
604 | } | |
605 | ||
1e8e5c60 P |
606 | static const OSSL_PARAM *x942kdf_gettable_ctx_params(ossl_unused void *ctx, |
607 | ossl_unused void *provctx) | |
e3405a4a P |
608 | { |
609 | static const OSSL_PARAM known_gettable_ctx_params[] = { | |
610 | OSSL_PARAM_size_t(OSSL_KDF_PARAM_SIZE, NULL), | |
611 | OSSL_PARAM_END | |
612 | }; | |
613 | return known_gettable_ctx_params; | |
614 | } | |
615 | ||
1be63951 | 616 | const OSSL_DISPATCH ossl_kdf_x942_kdf_functions[] = { |
e3405a4a | 617 | { OSSL_FUNC_KDF_NEWCTX, (void(*)(void))x942kdf_new }, |
769cd465 | 618 | { OSSL_FUNC_KDF_DUPCTX, (void(*)(void))x942kdf_dup }, |
e3405a4a P |
619 | { OSSL_FUNC_KDF_FREECTX, (void(*)(void))x942kdf_free }, |
620 | { OSSL_FUNC_KDF_RESET, (void(*)(void))x942kdf_reset }, | |
621 | { OSSL_FUNC_KDF_DERIVE, (void(*)(void))x942kdf_derive }, | |
622 | { OSSL_FUNC_KDF_SETTABLE_CTX_PARAMS, | |
623 | (void(*)(void))x942kdf_settable_ctx_params }, | |
624 | { OSSL_FUNC_KDF_SET_CTX_PARAMS, (void(*)(void))x942kdf_set_ctx_params }, | |
625 | { OSSL_FUNC_KDF_GETTABLE_CTX_PARAMS, | |
626 | (void(*)(void))x942kdf_gettable_ctx_params }, | |
627 | { OSSL_FUNC_KDF_GET_CTX_PARAMS, (void(*)(void))x942kdf_get_ctx_params }, | |
628 | { 0, NULL } | |
1aec7716 | 629 | }; |