]>
Commit | Line | Data |
---|---|---|
1aec7716 | 1 | /* |
fecb3aae | 2 | * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved. |
1aec7716 SL |
3 | * Copyright (c) 2019, Oracle and/or its affiliates. All rights reserved. |
4 | * | |
5 | * Licensed under the Apache License 2.0 (the "License"). You may not use | |
6 | * this file except in compliance with the License. You can obtain a copy | |
7 | * in the file LICENSE in the source distribution or at | |
8 | * https://www.openssl.org/source/license.html | |
9 | */ | |
10 | ||
d5f9166b | 11 | #include "internal/e_os.h" |
e5b2cd58 SL |
12 | #include <openssl/core_names.h> |
13 | #include <openssl/core_dispatch.h> | |
14 | #include <openssl/err.h> | |
15 | #include <openssl/evp.h> | |
16 | #include <openssl/params.h> | |
2741128e | 17 | #include <openssl/proverr.h> |
e5b2cd58 SL |
18 | #include "internal/packet.h" |
19 | #include "internal/der.h" | |
f2a6f838 | 20 | #include "internal/nelem.h" |
e5b2cd58 | 21 | #include "prov/provider_ctx.h" |
2b9e4e95 | 22 | #include "prov/providercommon.h" |
e5b2cd58 SL |
23 | #include "prov/implementations.h" |
24 | #include "prov/provider_util.h" | |
25 | #include "prov/der_wrap.h" | |
26 | ||
27 | #define X942KDF_MAX_INLEN (1 << 30) | |
1aec7716 | 28 | |
363b1e5d | 29 | static OSSL_FUNC_kdf_newctx_fn x942kdf_new; |
769cd465 | 30 | static OSSL_FUNC_kdf_dupctx_fn x942kdf_dup; |
363b1e5d DMSP |
31 | static OSSL_FUNC_kdf_freectx_fn x942kdf_free; |
32 | static OSSL_FUNC_kdf_reset_fn x942kdf_reset; | |
33 | static OSSL_FUNC_kdf_derive_fn x942kdf_derive; | |
34 | static OSSL_FUNC_kdf_settable_ctx_params_fn x942kdf_settable_ctx_params; | |
35 | static OSSL_FUNC_kdf_set_ctx_params_fn x942kdf_set_ctx_params; | |
36 | static OSSL_FUNC_kdf_gettable_ctx_params_fn x942kdf_gettable_ctx_params; | |
37 | static OSSL_FUNC_kdf_get_ctx_params_fn x942kdf_get_ctx_params; | |
e3405a4a P |
38 | |
39 | typedef struct { | |
40 | void *provctx; | |
e97bab69 | 41 | PROV_DIGEST digest; |
1aec7716 SL |
42 | unsigned char *secret; |
43 | size_t secret_len; | |
8a686bdb SL |
44 | unsigned char *acvpinfo; |
45 | size_t acvpinfo_len; | |
89cccbea SL |
46 | unsigned char *partyuinfo, *partyvinfo, *supp_pubinfo, *supp_privinfo; |
47 | size_t partyuinfo_len, partyvinfo_len, supp_pubinfo_len, supp_privinfo_len; | |
1aec7716 | 48 | size_t dkm_len; |
e5b2cd58 SL |
49 | const unsigned char *cek_oid; |
50 | size_t cek_oid_len; | |
89cccbea | 51 | int use_keybits; |
e3405a4a | 52 | } KDF_X942; |
1aec7716 | 53 | |
e5b2cd58 SL |
54 | /* |
55 | * A table of allowed wrapping algorithms, oids and the associated output | |
56 | * lengths. | |
57 | * NOTE: RC2wrap and camellia128_wrap have been removed as there are no | |
58 | * corresponding ciphers for these operations. | |
59 | */ | |
1aec7716 | 60 | static const struct { |
e5b2cd58 SL |
61 | const char *name; |
62 | const unsigned char *oid; | |
63 | size_t oid_len; | |
1aec7716 SL |
64 | size_t keklen; /* size in bytes */ |
65 | } kek_algs[] = { | |
01290306 P |
66 | { "AES-128-WRAP", ossl_der_oid_id_aes128_wrap, DER_OID_SZ_id_aes128_wrap, |
67 | 16 }, | |
68 | { "AES-192-WRAP", ossl_der_oid_id_aes192_wrap, DER_OID_SZ_id_aes192_wrap, | |
e5b2cd58 | 69 | 24 }, |
01290306 P |
70 | { "AES-256-WRAP", ossl_der_oid_id_aes256_wrap, DER_OID_SZ_id_aes256_wrap, |
71 | 32 }, | |
72 | #ifndef FIPS_MODULE | |
73 | { "DES3-WRAP", ossl_der_oid_id_alg_CMS3DESwrap, | |
74 | DER_OID_SZ_id_alg_CMS3DESwrap, 24 }, | |
e5b2cd58 | 75 | #endif |
1aec7716 SL |
76 | }; |
77 | ||
b4250010 | 78 | static int find_alg_id(OSSL_LIB_CTX *libctx, const char *algname, |
e771249c | 79 | const char *propq, size_t *id) |
1aec7716 | 80 | { |
e5b2cd58 SL |
81 | int ret = 1; |
82 | size_t i; | |
83 | EVP_CIPHER *cipher; | |
1aec7716 | 84 | |
e771249c | 85 | cipher = EVP_CIPHER_fetch(libctx, algname, propq); |
e5b2cd58 SL |
86 | if (cipher != NULL) { |
87 | for (i = 0; i < OSSL_NELEM(kek_algs); i++) { | |
88 | if (EVP_CIPHER_is_a(cipher, kek_algs[i].name)) { | |
89 | *id = i; | |
90 | goto end; | |
91 | } | |
92 | } | |
93 | } | |
94 | ret = 0; | |
95 | ERR_raise(ERR_LIB_PROV, PROV_R_UNSUPPORTED_CEK_ALG); | |
96 | end: | |
97 | EVP_CIPHER_free(cipher); | |
98 | return ret; | |
99 | } | |
100 | ||
101 | static int DER_w_keyinfo(WPACKET *pkt, | |
102 | const unsigned char *der_oid, size_t der_oidlen, | |
103 | unsigned char **pcounter) | |
104 | { | |
a55b00bd | 105 | return ossl_DER_w_begin_sequence(pkt, -1) |
e5b2cd58 | 106 | /* Store the initial value of 1 into the counter */ |
a55b00bd | 107 | && ossl_DER_w_octet_string_uint32(pkt, -1, 1) |
e5b2cd58 SL |
108 | /* Remember where we stored the counter in the buffer */ |
109 | && (pcounter == NULL | |
110 | || (*pcounter = WPACKET_get_curr(pkt)) != NULL) | |
a55b00bd P |
111 | && ossl_DER_w_precompiled(pkt, -1, der_oid, der_oidlen) |
112 | && ossl_DER_w_end_sequence(pkt, -1); | |
e5b2cd58 SL |
113 | } |
114 | ||
115 | static int der_encode_sharedinfo(WPACKET *pkt, unsigned char *buf, size_t buflen, | |
116 | const unsigned char *der_oid, size_t der_oidlen, | |
8a686bdb | 117 | const unsigned char *acvp, size_t acvplen, |
89cccbea SL |
118 | const unsigned char *partyu, size_t partyulen, |
119 | const unsigned char *partyv, size_t partyvlen, | |
120 | const unsigned char *supp_pub, size_t supp_publen, | |
121 | const unsigned char *supp_priv, size_t supp_privlen, | |
e5b2cd58 SL |
122 | uint32_t keylen_bits, unsigned char **pcounter) |
123 | { | |
124 | return (buf != NULL ? WPACKET_init_der(pkt, buf, buflen) : | |
125 | WPACKET_init_null_der(pkt)) | |
a55b00bd | 126 | && ossl_DER_w_begin_sequence(pkt, -1) |
89cccbea SL |
127 | && (supp_priv == NULL |
128 | || ossl_DER_w_octet_string(pkt, 3, supp_priv, supp_privlen)) | |
129 | && (supp_pub == NULL | |
130 | || ossl_DER_w_octet_string(pkt, 2, supp_pub, supp_publen)) | |
131 | && (keylen_bits == 0 | |
132 | || ossl_DER_w_octet_string_uint32(pkt, 2, keylen_bits)) | |
133 | && (partyv == NULL || ossl_DER_w_octet_string(pkt, 1, partyv, partyvlen)) | |
134 | && (partyu == NULL || ossl_DER_w_octet_string(pkt, 0, partyu, partyulen)) | |
8a686bdb | 135 | && (acvp == NULL || ossl_DER_w_precompiled(pkt, -1, acvp, acvplen)) |
e5b2cd58 | 136 | && DER_w_keyinfo(pkt, der_oid, der_oidlen, pcounter) |
a55b00bd | 137 | && ossl_DER_w_end_sequence(pkt, -1) |
e5b2cd58 | 138 | && WPACKET_finish(pkt); |
1aec7716 SL |
139 | } |
140 | ||
141 | /* | |
142 | * Encode the other info structure. | |
143 | * | |
89cccbea | 144 | * The ANS X9.42-2003 standard uses OtherInfo: |
1aec7716 SL |
145 | * |
146 | * OtherInfo ::= SEQUENCE { | |
147 | * keyInfo KeySpecificInfo, | |
89cccbea SL |
148 | * partyUInfo [0] OCTET STRING OPTIONAL, |
149 | * partyVInfo [1] OCTET STRING OPTIONAL, | |
150 | * suppPubInfo [2] OCTET STRING OPTIONAL, | |
151 | * suppPrivInfo [3] OCTET STRING OPTIONAL | |
1aec7716 SL |
152 | * } |
153 | * | |
154 | * KeySpecificInfo ::= SEQUENCE { | |
155 | * algorithm OBJECT IDENTIFIER, | |
156 | * counter OCTET STRING SIZE (4..4) | |
157 | * } | |
89cccbea SL |
158 | * |
159 | * RFC2631 Section 2.1.2 Contains the following definition for OtherInfo | |
160 | * | |
161 | * OtherInfo ::= SEQUENCE { | |
162 | * keyInfo KeySpecificInfo, | |
163 | * partyAInfo [0] OCTET STRING OPTIONAL, | |
164 | * suppPubInfo [2] OCTET STRING | |
165 | * } | |
166 | * Where suppPubInfo is the key length (in bits) (stored into 4 bytes) | |
167 | * | |
1aec7716 | 168 | * |keylen| is the length (in bytes) of the generated KEK. It is stored into |
8a686bdb | 169 | * suppPubInfo (in bits). It is ignored if the value is 0. |
e5b2cd58 SL |
170 | * |cek_oid| The oid of the key wrapping algorithm. |
171 | * |cek_oidlen| The length (in bytes) of the key wrapping algorithm oid, | |
8a686bdb SL |
172 | * |acvp| is the optional blob of DER data representing one or more of the |
173 | * OtherInfo fields related to |partyu|, |partyv|, |supp_pub| and |supp_priv|. | |
1ab8b7cd | 174 | * This field should normally be NULL. If |acvp| is non NULL then |partyu|, |
8a686bdb SL |
175 | * |partyv|, |supp_pub| and |supp_priv| should all be NULL. |
176 | * |acvp_len| is the |acvp| length (in bytes). | |
177 | * |partyu| is the optional public info contributed by the initiator. | |
178 | * It can be NULL. (It is also used as the ukm by CMS). | |
89cccbea | 179 | * |partyu_len| is the |partyu| length (in bytes). |
8a686bdb SL |
180 | * |partyv| is the optional public info contributed by the responder. |
181 | * It can be NULL. | |
89cccbea | 182 | * |partyv_len| is the |partyv| length (in bytes). |
8a686bdb SL |
183 | * |supp_pub| is the optional additional, mutually-known public information. |
184 | * It can be NULL. |keylen| should be 0 if this is not NULL. | |
89cccbea | 185 | * |supp_pub_len| is the |supp_pub| length (in bytes). |
8a686bdb SL |
186 | * |supp_priv| is the optional additional, mutually-known private information. |
187 | * It can be NULL. | |
89cccbea | 188 | * |supp_priv_len| is the |supp_priv| length (in bytes). |
1aec7716 SL |
189 | * |der| is the returned encoded data. It must be freed by the caller. |
190 | * |der_len| is the returned size of the encoded data. | |
191 | * |out_ctr| returns a pointer to the counter data which is embedded inside the | |
8a686bdb SL |
192 | * encoded data. This allows the counter bytes to be updated without |
193 | * re-encoding. | |
1aec7716 SL |
194 | * |
195 | * Returns: 1 if successfully encoded, or 0 otherwise. | |
196 | * Assumptions: |der|, |der_len| & |out_ctr| are not NULL. | |
197 | */ | |
89cccbea SL |
198 | static int |
199 | x942_encode_otherinfo(size_t keylen, | |
8a686bdb SL |
200 | const unsigned char *cek_oid, size_t cek_oid_len, |
201 | const unsigned char *acvp, size_t acvp_len, | |
89cccbea SL |
202 | const unsigned char *partyu, size_t partyu_len, |
203 | const unsigned char *partyv, size_t partyv_len, | |
204 | const unsigned char *supp_pub, size_t supp_pub_len, | |
205 | const unsigned char *supp_priv, size_t supp_priv_len, | |
206 | unsigned char **der, size_t *der_len, | |
207 | unsigned char **out_ctr) | |
1aec7716 | 208 | { |
e5b2cd58 SL |
209 | int ret = 0; |
210 | unsigned char *pcounter = NULL, *der_buf = NULL; | |
211 | size_t der_buflen = 0; | |
212 | WPACKET pkt; | |
213 | uint32_t keylen_bits; | |
214 | ||
215 | /* keylenbits must fit into 4 bytes */ | |
216 | if (keylen > 0xFFFFFF) | |
61d61c5f | 217 | return 0; |
e5b2cd58 SL |
218 | keylen_bits = 8 * keylen; |
219 | ||
220 | /* Calculate the size of the buffer */ | |
8a686bdb SL |
221 | if (!der_encode_sharedinfo(&pkt, NULL, 0, cek_oid, cek_oid_len, |
222 | acvp, acvp_len, | |
89cccbea SL |
223 | partyu, partyu_len, partyv, partyv_len, |
224 | supp_pub, supp_pub_len, supp_priv, supp_priv_len, | |
e5b2cd58 SL |
225 | keylen_bits, NULL) |
226 | || !WPACKET_get_total_written(&pkt, &der_buflen)) | |
227 | goto err; | |
228 | WPACKET_cleanup(&pkt); | |
229 | /* Alloc the buffer */ | |
230 | der_buf = OPENSSL_zalloc(der_buflen); | |
231 | if (der_buf == NULL) | |
232 | goto err; | |
233 | /* Encode into the buffer */ | |
8a686bdb SL |
234 | if (!der_encode_sharedinfo(&pkt, der_buf, der_buflen, cek_oid, cek_oid_len, |
235 | acvp, acvp_len, | |
89cccbea SL |
236 | partyu, partyu_len, partyv, partyv_len, |
237 | supp_pub, supp_pub_len, supp_priv, supp_priv_len, | |
238 | keylen_bits, &pcounter)) | |
e5b2cd58 SL |
239 | goto err; |
240 | /* | |
241 | * Since we allocated the exact size required, the buffer should point to the | |
91b968bc | 242 | * start of the allocated buffer at this point. |
e5b2cd58 SL |
243 | */ |
244 | if (WPACKET_get_curr(&pkt) != der_buf) | |
1aec7716 SL |
245 | goto err; |
246 | ||
e5b2cd58 SL |
247 | /* |
248 | * The data for the DER encoded octet string of a 32 bit counter = 1 | |
249 | * should be 04 04 00 00 00 01 | |
250 | * So just check the header is correct and skip over it. | |
251 | * This counter will be incremented in the kdf update loop. | |
252 | */ | |
253 | if (pcounter == NULL | |
254 | || pcounter[0] != 0x04 | |
255 | || pcounter[1] != 0x04) | |
256 | goto err; | |
257 | *out_ctr = (pcounter + 2); | |
258 | *der = der_buf; | |
259 | *der_len = der_buflen; | |
260 | ret = 1; | |
1aec7716 | 261 | err: |
e5b2cd58 | 262 | WPACKET_cleanup(&pkt); |
1aec7716 SL |
263 | return ret; |
264 | } | |
265 | ||
266 | static int x942kdf_hash_kdm(const EVP_MD *kdf_md, | |
267 | const unsigned char *z, size_t z_len, | |
268 | const unsigned char *other, size_t other_len, | |
269 | unsigned char *ctr, | |
270 | unsigned char *derived_key, size_t derived_key_len) | |
271 | { | |
272 | int ret = 0, hlen; | |
273 | size_t counter, out_len, len = derived_key_len; | |
274 | unsigned char mac[EVP_MAX_MD_SIZE]; | |
275 | unsigned char *out = derived_key; | |
276 | EVP_MD_CTX *ctx = NULL, *ctx_init = NULL; | |
277 | ||
8a686bdb SL |
278 | if (z_len > X942KDF_MAX_INLEN |
279 | || other_len > X942KDF_MAX_INLEN | |
280 | || derived_key_len > X942KDF_MAX_INLEN | |
281 | || derived_key_len == 0) { | |
e3405a4a | 282 | ERR_raise(ERR_LIB_PROV, PROV_R_BAD_LENGTH); |
1aec7716 SL |
283 | return 0; |
284 | } | |
285 | ||
ed576acd | 286 | hlen = EVP_MD_get_size(kdf_md); |
1aec7716 SL |
287 | if (hlen <= 0) |
288 | return 0; | |
289 | out_len = (size_t)hlen; | |
290 | ||
291 | ctx = EVP_MD_CTX_create(); | |
292 | ctx_init = EVP_MD_CTX_create(); | |
293 | if (ctx == NULL || ctx_init == NULL) | |
294 | goto end; | |
295 | ||
296 | if (!EVP_DigestInit(ctx_init, kdf_md)) | |
297 | goto end; | |
298 | ||
299 | for (counter = 1;; counter++) { | |
300 | /* updating the ctr modifies 4 bytes in the 'other' buffer */ | |
301 | ctr[0] = (unsigned char)((counter >> 24) & 0xff); | |
302 | ctr[1] = (unsigned char)((counter >> 16) & 0xff); | |
303 | ctr[2] = (unsigned char)((counter >> 8) & 0xff); | |
304 | ctr[3] = (unsigned char)(counter & 0xff); | |
305 | ||
306 | if (!EVP_MD_CTX_copy_ex(ctx, ctx_init) | |
307 | || !EVP_DigestUpdate(ctx, z, z_len) | |
308 | || !EVP_DigestUpdate(ctx, other, other_len)) | |
309 | goto end; | |
310 | if (len >= out_len) { | |
311 | if (!EVP_DigestFinal_ex(ctx, out, NULL)) | |
312 | goto end; | |
313 | out += out_len; | |
314 | len -= out_len; | |
315 | if (len == 0) | |
316 | break; | |
317 | } else { | |
318 | if (!EVP_DigestFinal_ex(ctx, mac, NULL)) | |
319 | goto end; | |
320 | memcpy(out, mac, len); | |
321 | break; | |
322 | } | |
323 | } | |
324 | ret = 1; | |
325 | end: | |
326 | EVP_MD_CTX_free(ctx); | |
327 | EVP_MD_CTX_free(ctx_init); | |
328 | OPENSSL_cleanse(mac, sizeof(mac)); | |
329 | return ret; | |
330 | } | |
331 | ||
e3405a4a | 332 | static void *x942kdf_new(void *provctx) |
1aec7716 | 333 | { |
e3405a4a | 334 | KDF_X942 *ctx; |
1aec7716 | 335 | |
2b9e4e95 | 336 | if (!ossl_prov_is_running()) |
7260709e | 337 | return NULL; |
2b9e4e95 | 338 | |
e077455e | 339 | if ((ctx = OPENSSL_zalloc(sizeof(*ctx))) == NULL) |
7260709e | 340 | return NULL; |
e3405a4a | 341 | ctx->provctx = provctx; |
89cccbea | 342 | ctx->use_keybits = 1; |
e3405a4a | 343 | return ctx; |
1aec7716 SL |
344 | } |
345 | ||
e3405a4a | 346 | static void x942kdf_reset(void *vctx) |
1aec7716 | 347 | { |
e3405a4a | 348 | KDF_X942 *ctx = (KDF_X942 *)vctx; |
0577959c | 349 | void *provctx = ctx->provctx; |
1aec7716 | 350 | |
e97bab69 | 351 | ossl_prov_digest_reset(&ctx->digest); |
e3405a4a | 352 | OPENSSL_clear_free(ctx->secret, ctx->secret_len); |
8a686bdb | 353 | OPENSSL_clear_free(ctx->acvpinfo, ctx->acvpinfo_len); |
89cccbea SL |
354 | OPENSSL_clear_free(ctx->partyuinfo, ctx->partyuinfo_len); |
355 | OPENSSL_clear_free(ctx->partyvinfo, ctx->partyvinfo_len); | |
356 | OPENSSL_clear_free(ctx->supp_pubinfo, ctx->supp_pubinfo_len); | |
357 | OPENSSL_clear_free(ctx->supp_privinfo, ctx->supp_privinfo_len); | |
e3405a4a | 358 | memset(ctx, 0, sizeof(*ctx)); |
0577959c | 359 | ctx->provctx = provctx; |
89cccbea | 360 | ctx->use_keybits = 1; |
1aec7716 SL |
361 | } |
362 | ||
e3405a4a | 363 | static void x942kdf_free(void *vctx) |
1aec7716 | 364 | { |
e3405a4a | 365 | KDF_X942 *ctx = (KDF_X942 *)vctx; |
1aec7716 | 366 | |
3c659415 P |
367 | if (ctx != NULL) { |
368 | x942kdf_reset(ctx); | |
369 | OPENSSL_free(ctx); | |
370 | } | |
1aec7716 SL |
371 | } |
372 | ||
769cd465 P |
373 | static void *x942kdf_dup(void *vctx) |
374 | { | |
375 | const KDF_X942 *src = (const KDF_X942 *)vctx; | |
376 | KDF_X942 *dest; | |
377 | ||
378 | dest = x942kdf_new(src->provctx); | |
379 | if (dest != NULL) { | |
380 | if (!ossl_prov_memdup(src->secret, src->secret_len, | |
381 | &dest->secret , &dest->secret_len) | |
382 | || !ossl_prov_memdup(src->acvpinfo, src->acvpinfo_len, | |
383 | &dest->acvpinfo , &dest->acvpinfo_len) | |
384 | || !ossl_prov_memdup(src->partyuinfo, src->partyuinfo_len, | |
385 | &dest->partyuinfo , &dest->partyuinfo_len) | |
386 | || !ossl_prov_memdup(src->partyvinfo, src->partyvinfo_len, | |
387 | &dest->partyvinfo , &dest->partyvinfo_len) | |
388 | || !ossl_prov_memdup(src->supp_pubinfo, src->supp_pubinfo_len, | |
389 | &dest->supp_pubinfo, | |
390 | &dest->supp_pubinfo_len) | |
391 | || !ossl_prov_memdup(src->supp_privinfo, src->supp_privinfo_len, | |
392 | &dest->supp_privinfo, | |
393 | &dest->supp_privinfo_len) | |
394 | || !ossl_prov_digest_copy(&dest->digest, &src->digest)) | |
395 | goto err; | |
396 | dest->cek_oid = src->cek_oid; | |
397 | dest->cek_oid_len = src->cek_oid_len; | |
398 | dest->dkm_len = src->dkm_len; | |
399 | dest->use_keybits = src->use_keybits; | |
400 | } | |
401 | return dest; | |
402 | ||
403 | err: | |
404 | x942kdf_free(dest); | |
405 | return NULL; | |
406 | } | |
407 | ||
e3405a4a P |
408 | static int x942kdf_set_buffer(unsigned char **out, size_t *out_len, |
409 | const OSSL_PARAM *p) | |
1aec7716 | 410 | { |
e3405a4a | 411 | if (p->data_size == 0 || p->data == NULL) |
1aec7716 SL |
412 | return 1; |
413 | ||
e3405a4a P |
414 | OPENSSL_free(*out); |
415 | *out = NULL; | |
416 | return OSSL_PARAM_get_octet_string(p, (void **)out, 0, out_len); | |
1aec7716 SL |
417 | } |
418 | ||
e3405a4a | 419 | static size_t x942kdf_size(KDF_X942 *ctx) |
1aec7716 SL |
420 | { |
421 | int len; | |
e97bab69 | 422 | const EVP_MD *md = ossl_prov_digest_md(&ctx->digest); |
1aec7716 | 423 | |
e97bab69 | 424 | if (md == NULL) { |
e3405a4a | 425 | ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_MESSAGE_DIGEST); |
1aec7716 SL |
426 | return 0; |
427 | } | |
ed576acd | 428 | len = EVP_MD_get_size(md); |
1aec7716 SL |
429 | return (len <= 0) ? 0 : (size_t)len; |
430 | } | |
431 | ||
3469b388 P |
432 | static int x942kdf_derive(void *vctx, unsigned char *key, size_t keylen, |
433 | const OSSL_PARAM params[]) | |
1aec7716 | 434 | { |
e3405a4a | 435 | KDF_X942 *ctx = (KDF_X942 *)vctx; |
2b9e4e95 | 436 | const EVP_MD *md; |
1aec7716 SL |
437 | int ret = 0; |
438 | unsigned char *ctr; | |
439 | unsigned char *der = NULL; | |
440 | size_t der_len = 0; | |
441 | ||
3469b388 | 442 | if (!ossl_prov_is_running() || !x942kdf_set_ctx_params(ctx, params)) |
2b9e4e95 P |
443 | return 0; |
444 | ||
89cccbea SL |
445 | /* |
446 | * These 2 options encode to the same field so only one of them should be | |
447 | * active at once. | |
448 | */ | |
449 | if (ctx->use_keybits && ctx->supp_pubinfo != NULL) { | |
450 | ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_PUBINFO); | |
451 | return 0; | |
452 | } | |
8a686bdb SL |
453 | /* |
454 | * If the blob of acvp data is used then the individual info fields that it | |
455 | * replaces should not also be defined. | |
456 | */ | |
457 | if (ctx->acvpinfo != NULL | |
458 | && (ctx->partyuinfo != NULL | |
459 | || ctx->partyvinfo != NULL | |
460 | || ctx->supp_pubinfo != NULL | |
461 | || ctx->supp_privinfo != NULL)) { | |
462 | ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_DATA); | |
463 | return 0; | |
464 | } | |
e3405a4a P |
465 | if (ctx->secret == NULL) { |
466 | ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_SECRET); | |
1aec7716 SL |
467 | return 0; |
468 | } | |
2b9e4e95 | 469 | md = ossl_prov_digest_md(&ctx->digest); |
e97bab69 | 470 | if (md == NULL) { |
e3405a4a | 471 | ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_MESSAGE_DIGEST); |
1aec7716 SL |
472 | return 0; |
473 | } | |
e5b2cd58 | 474 | if (ctx->cek_oid == NULL || ctx->cek_oid_len == 0) { |
e3405a4a | 475 | ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_CEK_ALG); |
1aec7716 SL |
476 | return 0; |
477 | } | |
89cccbea | 478 | if (ctx->partyuinfo != NULL && ctx->partyuinfo_len >= X942KDF_MAX_INLEN) { |
1aec7716 | 479 | /* |
89cccbea | 480 | * Note the ukm length MUST be 512 bits if it is used. |
1aec7716 SL |
481 | * For backwards compatibility the old check is being done. |
482 | */ | |
89cccbea | 483 | ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_UKM_LENGTH); |
1aec7716 SL |
484 | return 0; |
485 | } | |
1aec7716 | 486 | /* generate the otherinfo der */ |
89cccbea | 487 | if (!x942_encode_otherinfo(ctx->use_keybits ? ctx->dkm_len : 0, |
e5b2cd58 | 488 | ctx->cek_oid, ctx->cek_oid_len, |
8a686bdb | 489 | ctx->acvpinfo, ctx->acvpinfo_len, |
89cccbea SL |
490 | ctx->partyuinfo, ctx->partyuinfo_len, |
491 | ctx->partyvinfo, ctx->partyvinfo_len, | |
492 | ctx->supp_pubinfo, ctx->supp_pubinfo_len, | |
493 | ctx->supp_privinfo, ctx->supp_privinfo_len, | |
1aec7716 | 494 | &der, &der_len, &ctr)) { |
e3405a4a | 495 | ERR_raise(ERR_LIB_PROV, PROV_R_BAD_ENCODING); |
1aec7716 SL |
496 | return 0; |
497 | } | |
e97bab69 | 498 | ret = x942kdf_hash_kdm(md, ctx->secret, ctx->secret_len, |
1aec7716 SL |
499 | der, der_len, ctr, key, keylen); |
500 | OPENSSL_free(der); | |
501 | return ret; | |
502 | } | |
503 | ||
e3405a4a P |
504 | static int x942kdf_set_ctx_params(void *vctx, const OSSL_PARAM params[]) |
505 | { | |
e771249c | 506 | const OSSL_PARAM *p, *pq; |
e3405a4a | 507 | KDF_X942 *ctx = vctx; |
a829b735 | 508 | OSSL_LIB_CTX *provctx = PROV_LIBCTX_OF(ctx->provctx); |
e771249c | 509 | const char *propq = NULL; |
e5b2cd58 | 510 | size_t id; |
e3405a4a | 511 | |
c983a0e5 P |
512 | if (params == NULL) |
513 | return 1; | |
e97bab69 P |
514 | if (!ossl_prov_digest_load_from_params(&ctx->digest, params, provctx)) |
515 | return 0; | |
e3405a4a | 516 | |
89cccbea SL |
517 | p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_SECRET); |
518 | if (p == NULL) | |
519 | p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_KEY); | |
520 | if (p != NULL && !x942kdf_set_buffer(&ctx->secret, &ctx->secret_len, p)) | |
521 | return 0; | |
522 | ||
8a686bdb SL |
523 | p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_X942_ACVPINFO); |
524 | if (p != NULL | |
525 | && !x942kdf_set_buffer(&ctx->acvpinfo, &ctx->acvpinfo_len, p)) | |
526 | return 0; | |
527 | ||
89cccbea SL |
528 | p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_X942_PARTYUINFO); |
529 | if (p == NULL) | |
530 | p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_UKM); | |
531 | if (p != NULL | |
532 | && !x942kdf_set_buffer(&ctx->partyuinfo, &ctx->partyuinfo_len, p)) | |
533 | return 0; | |
e3405a4a | 534 | |
89cccbea SL |
535 | p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_X942_PARTYVINFO); |
536 | if (p != NULL | |
537 | && !x942kdf_set_buffer(&ctx->partyvinfo, &ctx->partyvinfo_len, p)) | |
538 | return 0; | |
539 | ||
540 | p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_X942_USE_KEYBITS); | |
541 | if (p != NULL && !OSSL_PARAM_get_int(p, &ctx->use_keybits)) | |
542 | return 0; | |
543 | ||
544 | p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_X942_SUPP_PUBINFO); | |
545 | if (p != NULL) { | |
546 | if (!x942kdf_set_buffer(&ctx->supp_pubinfo, &ctx->supp_pubinfo_len, p)) | |
e3405a4a | 547 | return 0; |
89cccbea SL |
548 | ctx->use_keybits = 0; |
549 | } | |
550 | ||
551 | p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_X942_SUPP_PRIVINFO); | |
552 | if (p != NULL | |
553 | && !x942kdf_set_buffer(&ctx->supp_privinfo, &ctx->supp_privinfo_len, p)) | |
554 | return 0; | |
e3405a4a | 555 | |
89cccbea SL |
556 | p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_CEK_ALG); |
557 | if (p != NULL) { | |
e3405a4a P |
558 | if (p->data_type != OSSL_PARAM_UTF8_STRING) |
559 | return 0; | |
e771249c SL |
560 | pq = OSSL_PARAM_locate_const(params, OSSL_ALG_PARAM_PROPERTIES); |
561 | /* | |
562 | * We already grab the properties during ossl_prov_digest_load_from_params() | |
563 | * so there is no need to check the validity again.. | |
564 | */ | |
565 | if (pq != NULL) | |
566 | propq = p->data; | |
567 | if (find_alg_id(provctx, p->data, propq, &id) == 0) | |
e5b2cd58 SL |
568 | return 0; |
569 | ctx->cek_oid = kek_algs[id].oid; | |
570 | ctx->cek_oid_len = kek_algs[id].oid_len; | |
571 | ctx->dkm_len = kek_algs[id].keklen; | |
e3405a4a P |
572 | } |
573 | return 1; | |
574 | } | |
575 | ||
1e8e5c60 P |
576 | static const OSSL_PARAM *x942kdf_settable_ctx_params(ossl_unused void *ctx, |
577 | ossl_unused void *provctx) | |
e3405a4a P |
578 | { |
579 | static const OSSL_PARAM known_settable_ctx_params[] = { | |
580 | OSSL_PARAM_utf8_string(OSSL_KDF_PARAM_PROPERTIES, NULL, 0), | |
581 | OSSL_PARAM_utf8_string(OSSL_KDF_PARAM_DIGEST, NULL, 0), | |
582 | OSSL_PARAM_octet_string(OSSL_KDF_PARAM_SECRET, NULL, 0), | |
583 | OSSL_PARAM_octet_string(OSSL_KDF_PARAM_KEY, NULL, 0), | |
584 | OSSL_PARAM_octet_string(OSSL_KDF_PARAM_UKM, NULL, 0), | |
8a686bdb | 585 | OSSL_PARAM_octet_string(OSSL_KDF_PARAM_X942_ACVPINFO, NULL, 0), |
89cccbea SL |
586 | OSSL_PARAM_octet_string(OSSL_KDF_PARAM_X942_PARTYUINFO, NULL, 0), |
587 | OSSL_PARAM_octet_string(OSSL_KDF_PARAM_X942_PARTYVINFO, NULL, 0), | |
588 | OSSL_PARAM_octet_string(OSSL_KDF_PARAM_X942_SUPP_PUBINFO, NULL, 0), | |
589 | OSSL_PARAM_octet_string(OSSL_KDF_PARAM_X942_SUPP_PRIVINFO, NULL, 0), | |
590 | OSSL_PARAM_int(OSSL_KDF_PARAM_X942_USE_KEYBITS, NULL), | |
e3405a4a P |
591 | OSSL_PARAM_utf8_string(OSSL_KDF_PARAM_CEK_ALG, NULL, 0), |
592 | OSSL_PARAM_END | |
593 | }; | |
594 | return known_settable_ctx_params; | |
595 | } | |
596 | ||
597 | static int x942kdf_get_ctx_params(void *vctx, OSSL_PARAM params[]) | |
598 | { | |
599 | KDF_X942 *ctx = (KDF_X942 *)vctx; | |
600 | OSSL_PARAM *p; | |
601 | ||
602 | if ((p = OSSL_PARAM_locate(params, OSSL_KDF_PARAM_SIZE)) != NULL) | |
603 | return OSSL_PARAM_set_size_t(p, x942kdf_size(ctx)); | |
604 | return -2; | |
605 | } | |
606 | ||
1e8e5c60 P |
607 | static const OSSL_PARAM *x942kdf_gettable_ctx_params(ossl_unused void *ctx, |
608 | ossl_unused void *provctx) | |
e3405a4a P |
609 | { |
610 | static const OSSL_PARAM known_gettable_ctx_params[] = { | |
611 | OSSL_PARAM_size_t(OSSL_KDF_PARAM_SIZE, NULL), | |
612 | OSSL_PARAM_END | |
613 | }; | |
614 | return known_gettable_ctx_params; | |
615 | } | |
616 | ||
1be63951 | 617 | const OSSL_DISPATCH ossl_kdf_x942_kdf_functions[] = { |
e3405a4a | 618 | { OSSL_FUNC_KDF_NEWCTX, (void(*)(void))x942kdf_new }, |
769cd465 | 619 | { OSSL_FUNC_KDF_DUPCTX, (void(*)(void))x942kdf_dup }, |
e3405a4a P |
620 | { OSSL_FUNC_KDF_FREECTX, (void(*)(void))x942kdf_free }, |
621 | { OSSL_FUNC_KDF_RESET, (void(*)(void))x942kdf_reset }, | |
622 | { OSSL_FUNC_KDF_DERIVE, (void(*)(void))x942kdf_derive }, | |
623 | { OSSL_FUNC_KDF_SETTABLE_CTX_PARAMS, | |
624 | (void(*)(void))x942kdf_settable_ctx_params }, | |
625 | { OSSL_FUNC_KDF_SET_CTX_PARAMS, (void(*)(void))x942kdf_set_ctx_params }, | |
626 | { OSSL_FUNC_KDF_GETTABLE_CTX_PARAMS, | |
627 | (void(*)(void))x942kdf_gettable_ctx_params }, | |
628 | { OSSL_FUNC_KDF_GET_CTX_PARAMS, (void(*)(void))x942kdf_get_ctx_params }, | |
629 | { 0, NULL } | |
1aec7716 | 630 | }; |