]>
Commit | Line | Data |
---|---|---|
1aec7716 | 1 | /* |
a28d06f3 | 2 | * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved. |
1aec7716 SL |
3 | * Copyright (c) 2019, Oracle and/or its affiliates. All rights reserved. |
4 | * | |
5 | * Licensed under the Apache License 2.0 (the "License"). You may not use | |
6 | * this file except in compliance with the License. You can obtain a copy | |
7 | * in the file LICENSE in the source distribution or at | |
8 | * https://www.openssl.org/source/license.html | |
9 | */ | |
10 | ||
11 | #include "e_os.h" | |
e5b2cd58 SL |
12 | #include <openssl/core_names.h> |
13 | #include <openssl/core_dispatch.h> | |
14 | #include <openssl/err.h> | |
15 | #include <openssl/evp.h> | |
16 | #include <openssl/params.h> | |
2741128e | 17 | #include <openssl/proverr.h> |
e5b2cd58 SL |
18 | #include "internal/packet.h" |
19 | #include "internal/der.h" | |
20 | #include "prov/provider_ctx.h" | |
2b9e4e95 | 21 | #include "prov/providercommon.h" |
e5b2cd58 SL |
22 | #include "prov/implementations.h" |
23 | #include "prov/provider_util.h" | |
24 | #include "prov/der_wrap.h" | |
25 | ||
26 | #define X942KDF_MAX_INLEN (1 << 30) | |
1aec7716 | 27 | |
363b1e5d DMSP |
28 | static OSSL_FUNC_kdf_newctx_fn x942kdf_new; |
29 | static OSSL_FUNC_kdf_freectx_fn x942kdf_free; | |
30 | static OSSL_FUNC_kdf_reset_fn x942kdf_reset; | |
31 | static OSSL_FUNC_kdf_derive_fn x942kdf_derive; | |
32 | static OSSL_FUNC_kdf_settable_ctx_params_fn x942kdf_settable_ctx_params; | |
33 | static OSSL_FUNC_kdf_set_ctx_params_fn x942kdf_set_ctx_params; | |
34 | static OSSL_FUNC_kdf_gettable_ctx_params_fn x942kdf_gettable_ctx_params; | |
35 | static OSSL_FUNC_kdf_get_ctx_params_fn x942kdf_get_ctx_params; | |
e3405a4a P |
36 | |
37 | typedef struct { | |
38 | void *provctx; | |
e97bab69 | 39 | PROV_DIGEST digest; |
1aec7716 SL |
40 | unsigned char *secret; |
41 | size_t secret_len; | |
8a686bdb SL |
42 | unsigned char *acvpinfo; |
43 | size_t acvpinfo_len; | |
89cccbea SL |
44 | unsigned char *partyuinfo, *partyvinfo, *supp_pubinfo, *supp_privinfo; |
45 | size_t partyuinfo_len, partyvinfo_len, supp_pubinfo_len, supp_privinfo_len; | |
1aec7716 | 46 | size_t dkm_len; |
e5b2cd58 SL |
47 | const unsigned char *cek_oid; |
48 | size_t cek_oid_len; | |
89cccbea | 49 | int use_keybits; |
e3405a4a | 50 | } KDF_X942; |
1aec7716 | 51 | |
e5b2cd58 SL |
52 | /* |
53 | * A table of allowed wrapping algorithms, oids and the associated output | |
54 | * lengths. | |
55 | * NOTE: RC2wrap and camellia128_wrap have been removed as there are no | |
56 | * corresponding ciphers for these operations. | |
57 | */ | |
1aec7716 | 58 | static const struct { |
e5b2cd58 SL |
59 | const char *name; |
60 | const unsigned char *oid; | |
61 | size_t oid_len; | |
1aec7716 SL |
62 | size_t keklen; /* size in bytes */ |
63 | } kek_algs[] = { | |
01290306 P |
64 | { "AES-128-WRAP", ossl_der_oid_id_aes128_wrap, DER_OID_SZ_id_aes128_wrap, |
65 | 16 }, | |
66 | { "AES-192-WRAP", ossl_der_oid_id_aes192_wrap, DER_OID_SZ_id_aes192_wrap, | |
e5b2cd58 | 67 | 24 }, |
01290306 P |
68 | { "AES-256-WRAP", ossl_der_oid_id_aes256_wrap, DER_OID_SZ_id_aes256_wrap, |
69 | 32 }, | |
70 | #ifndef FIPS_MODULE | |
71 | { "DES3-WRAP", ossl_der_oid_id_alg_CMS3DESwrap, | |
72 | DER_OID_SZ_id_alg_CMS3DESwrap, 24 }, | |
e5b2cd58 | 73 | #endif |
1aec7716 SL |
74 | }; |
75 | ||
b4250010 | 76 | static int find_alg_id(OSSL_LIB_CTX *libctx, const char *algname, |
e771249c | 77 | const char *propq, size_t *id) |
1aec7716 | 78 | { |
e5b2cd58 SL |
79 | int ret = 1; |
80 | size_t i; | |
81 | EVP_CIPHER *cipher; | |
1aec7716 | 82 | |
e771249c | 83 | cipher = EVP_CIPHER_fetch(libctx, algname, propq); |
e5b2cd58 SL |
84 | if (cipher != NULL) { |
85 | for (i = 0; i < OSSL_NELEM(kek_algs); i++) { | |
86 | if (EVP_CIPHER_is_a(cipher, kek_algs[i].name)) { | |
87 | *id = i; | |
88 | goto end; | |
89 | } | |
90 | } | |
91 | } | |
92 | ret = 0; | |
93 | ERR_raise(ERR_LIB_PROV, PROV_R_UNSUPPORTED_CEK_ALG); | |
94 | end: | |
95 | EVP_CIPHER_free(cipher); | |
96 | return ret; | |
97 | } | |
98 | ||
99 | static int DER_w_keyinfo(WPACKET *pkt, | |
100 | const unsigned char *der_oid, size_t der_oidlen, | |
101 | unsigned char **pcounter) | |
102 | { | |
a55b00bd | 103 | return ossl_DER_w_begin_sequence(pkt, -1) |
e5b2cd58 | 104 | /* Store the initial value of 1 into the counter */ |
a55b00bd | 105 | && ossl_DER_w_octet_string_uint32(pkt, -1, 1) |
e5b2cd58 SL |
106 | /* Remember where we stored the counter in the buffer */ |
107 | && (pcounter == NULL | |
108 | || (*pcounter = WPACKET_get_curr(pkt)) != NULL) | |
a55b00bd P |
109 | && ossl_DER_w_precompiled(pkt, -1, der_oid, der_oidlen) |
110 | && ossl_DER_w_end_sequence(pkt, -1); | |
e5b2cd58 SL |
111 | } |
112 | ||
113 | static int der_encode_sharedinfo(WPACKET *pkt, unsigned char *buf, size_t buflen, | |
114 | const unsigned char *der_oid, size_t der_oidlen, | |
8a686bdb | 115 | const unsigned char *acvp, size_t acvplen, |
89cccbea SL |
116 | const unsigned char *partyu, size_t partyulen, |
117 | const unsigned char *partyv, size_t partyvlen, | |
118 | const unsigned char *supp_pub, size_t supp_publen, | |
119 | const unsigned char *supp_priv, size_t supp_privlen, | |
e5b2cd58 SL |
120 | uint32_t keylen_bits, unsigned char **pcounter) |
121 | { | |
122 | return (buf != NULL ? WPACKET_init_der(pkt, buf, buflen) : | |
123 | WPACKET_init_null_der(pkt)) | |
a55b00bd | 124 | && ossl_DER_w_begin_sequence(pkt, -1) |
89cccbea SL |
125 | && (supp_priv == NULL |
126 | || ossl_DER_w_octet_string(pkt, 3, supp_priv, supp_privlen)) | |
127 | && (supp_pub == NULL | |
128 | || ossl_DER_w_octet_string(pkt, 2, supp_pub, supp_publen)) | |
129 | && (keylen_bits == 0 | |
130 | || ossl_DER_w_octet_string_uint32(pkt, 2, keylen_bits)) | |
131 | && (partyv == NULL || ossl_DER_w_octet_string(pkt, 1, partyv, partyvlen)) | |
132 | && (partyu == NULL || ossl_DER_w_octet_string(pkt, 0, partyu, partyulen)) | |
8a686bdb | 133 | && (acvp == NULL || ossl_DER_w_precompiled(pkt, -1, acvp, acvplen)) |
e5b2cd58 | 134 | && DER_w_keyinfo(pkt, der_oid, der_oidlen, pcounter) |
a55b00bd | 135 | && ossl_DER_w_end_sequence(pkt, -1) |
e5b2cd58 | 136 | && WPACKET_finish(pkt); |
1aec7716 SL |
137 | } |
138 | ||
139 | /* | |
140 | * Encode the other info structure. | |
141 | * | |
89cccbea | 142 | * The ANS X9.42-2003 standard uses OtherInfo: |
1aec7716 SL |
143 | * |
144 | * OtherInfo ::= SEQUENCE { | |
145 | * keyInfo KeySpecificInfo, | |
89cccbea SL |
146 | * partyUInfo [0] OCTET STRING OPTIONAL, |
147 | * partyVInfo [1] OCTET STRING OPTIONAL, | |
148 | * suppPubInfo [2] OCTET STRING OPTIONAL, | |
149 | * suppPrivInfo [3] OCTET STRING OPTIONAL | |
1aec7716 SL |
150 | * } |
151 | * | |
152 | * KeySpecificInfo ::= SEQUENCE { | |
153 | * algorithm OBJECT IDENTIFIER, | |
154 | * counter OCTET STRING SIZE (4..4) | |
155 | * } | |
89cccbea SL |
156 | * |
157 | * RFC2631 Section 2.1.2 Contains the following definition for OtherInfo | |
158 | * | |
159 | * OtherInfo ::= SEQUENCE { | |
160 | * keyInfo KeySpecificInfo, | |
161 | * partyAInfo [0] OCTET STRING OPTIONAL, | |
162 | * suppPubInfo [2] OCTET STRING | |
163 | * } | |
164 | * Where suppPubInfo is the key length (in bits) (stored into 4 bytes) | |
165 | * | |
1aec7716 | 166 | * |keylen| is the length (in bytes) of the generated KEK. It is stored into |
8a686bdb | 167 | * suppPubInfo (in bits). It is ignored if the value is 0. |
e5b2cd58 SL |
168 | * |cek_oid| The oid of the key wrapping algorithm. |
169 | * |cek_oidlen| The length (in bytes) of the key wrapping algorithm oid, | |
8a686bdb SL |
170 | * |acvp| is the optional blob of DER data representing one or more of the |
171 | * OtherInfo fields related to |partyu|, |partyv|, |supp_pub| and |supp_priv|. | |
172 | * This field should noramlly be NULL. If |acvp| is non NULL then |partyu|, | |
173 | * |partyv|, |supp_pub| and |supp_priv| should all be NULL. | |
174 | * |acvp_len| is the |acvp| length (in bytes). | |
175 | * |partyu| is the optional public info contributed by the initiator. | |
176 | * It can be NULL. (It is also used as the ukm by CMS). | |
89cccbea | 177 | * |partyu_len| is the |partyu| length (in bytes). |
8a686bdb SL |
178 | * |partyv| is the optional public info contributed by the responder. |
179 | * It can be NULL. | |
89cccbea | 180 | * |partyv_len| is the |partyv| length (in bytes). |
8a686bdb SL |
181 | * |supp_pub| is the optional additional, mutually-known public information. |
182 | * It can be NULL. |keylen| should be 0 if this is not NULL. | |
89cccbea | 183 | * |supp_pub_len| is the |supp_pub| length (in bytes). |
8a686bdb SL |
184 | * |supp_priv| is the optional additional, mutually-known private information. |
185 | * It can be NULL. | |
89cccbea | 186 | * |supp_priv_len| is the |supp_priv| length (in bytes). |
1aec7716 SL |
187 | * |der| is the returned encoded data. It must be freed by the caller. |
188 | * |der_len| is the returned size of the encoded data. | |
189 | * |out_ctr| returns a pointer to the counter data which is embedded inside the | |
8a686bdb SL |
190 | * encoded data. This allows the counter bytes to be updated without |
191 | * re-encoding. | |
1aec7716 SL |
192 | * |
193 | * Returns: 1 if successfully encoded, or 0 otherwise. | |
194 | * Assumptions: |der|, |der_len| & |out_ctr| are not NULL. | |
195 | */ | |
89cccbea SL |
196 | static int |
197 | x942_encode_otherinfo(size_t keylen, | |
8a686bdb SL |
198 | const unsigned char *cek_oid, size_t cek_oid_len, |
199 | const unsigned char *acvp, size_t acvp_len, | |
89cccbea SL |
200 | const unsigned char *partyu, size_t partyu_len, |
201 | const unsigned char *partyv, size_t partyv_len, | |
202 | const unsigned char *supp_pub, size_t supp_pub_len, | |
203 | const unsigned char *supp_priv, size_t supp_priv_len, | |
204 | unsigned char **der, size_t *der_len, | |
205 | unsigned char **out_ctr) | |
1aec7716 | 206 | { |
e5b2cd58 SL |
207 | int ret = 0; |
208 | unsigned char *pcounter = NULL, *der_buf = NULL; | |
209 | size_t der_buflen = 0; | |
210 | WPACKET pkt; | |
211 | uint32_t keylen_bits; | |
212 | ||
213 | /* keylenbits must fit into 4 bytes */ | |
214 | if (keylen > 0xFFFFFF) | |
61d61c5f | 215 | return 0; |
e5b2cd58 SL |
216 | keylen_bits = 8 * keylen; |
217 | ||
218 | /* Calculate the size of the buffer */ | |
8a686bdb SL |
219 | if (!der_encode_sharedinfo(&pkt, NULL, 0, cek_oid, cek_oid_len, |
220 | acvp, acvp_len, | |
89cccbea SL |
221 | partyu, partyu_len, partyv, partyv_len, |
222 | supp_pub, supp_pub_len, supp_priv, supp_priv_len, | |
e5b2cd58 SL |
223 | keylen_bits, NULL) |
224 | || !WPACKET_get_total_written(&pkt, &der_buflen)) | |
225 | goto err; | |
226 | WPACKET_cleanup(&pkt); | |
227 | /* Alloc the buffer */ | |
228 | der_buf = OPENSSL_zalloc(der_buflen); | |
229 | if (der_buf == NULL) | |
230 | goto err; | |
231 | /* Encode into the buffer */ | |
8a686bdb SL |
232 | if (!der_encode_sharedinfo(&pkt, der_buf, der_buflen, cek_oid, cek_oid_len, |
233 | acvp, acvp_len, | |
89cccbea SL |
234 | partyu, partyu_len, partyv, partyv_len, |
235 | supp_pub, supp_pub_len, supp_priv, supp_priv_len, | |
236 | keylen_bits, &pcounter)) | |
e5b2cd58 SL |
237 | goto err; |
238 | /* | |
239 | * Since we allocated the exact size required, the buffer should point to the | |
240 | * start of the alllocated buffer at this point. | |
241 | */ | |
242 | if (WPACKET_get_curr(&pkt) != der_buf) | |
1aec7716 SL |
243 | goto err; |
244 | ||
e5b2cd58 SL |
245 | /* |
246 | * The data for the DER encoded octet string of a 32 bit counter = 1 | |
247 | * should be 04 04 00 00 00 01 | |
248 | * So just check the header is correct and skip over it. | |
249 | * This counter will be incremented in the kdf update loop. | |
250 | */ | |
251 | if (pcounter == NULL | |
252 | || pcounter[0] != 0x04 | |
253 | || pcounter[1] != 0x04) | |
254 | goto err; | |
255 | *out_ctr = (pcounter + 2); | |
256 | *der = der_buf; | |
257 | *der_len = der_buflen; | |
258 | ret = 1; | |
1aec7716 | 259 | err: |
e5b2cd58 | 260 | WPACKET_cleanup(&pkt); |
1aec7716 SL |
261 | return ret; |
262 | } | |
263 | ||
264 | static int x942kdf_hash_kdm(const EVP_MD *kdf_md, | |
265 | const unsigned char *z, size_t z_len, | |
266 | const unsigned char *other, size_t other_len, | |
267 | unsigned char *ctr, | |
268 | unsigned char *derived_key, size_t derived_key_len) | |
269 | { | |
270 | int ret = 0, hlen; | |
271 | size_t counter, out_len, len = derived_key_len; | |
272 | unsigned char mac[EVP_MAX_MD_SIZE]; | |
273 | unsigned char *out = derived_key; | |
274 | EVP_MD_CTX *ctx = NULL, *ctx_init = NULL; | |
275 | ||
8a686bdb SL |
276 | if (z_len > X942KDF_MAX_INLEN |
277 | || other_len > X942KDF_MAX_INLEN | |
278 | || derived_key_len > X942KDF_MAX_INLEN | |
279 | || derived_key_len == 0) { | |
e3405a4a | 280 | ERR_raise(ERR_LIB_PROV, PROV_R_BAD_LENGTH); |
1aec7716 SL |
281 | return 0; |
282 | } | |
283 | ||
284 | hlen = EVP_MD_size(kdf_md); | |
285 | if (hlen <= 0) | |
286 | return 0; | |
287 | out_len = (size_t)hlen; | |
288 | ||
289 | ctx = EVP_MD_CTX_create(); | |
290 | ctx_init = EVP_MD_CTX_create(); | |
291 | if (ctx == NULL || ctx_init == NULL) | |
292 | goto end; | |
293 | ||
294 | if (!EVP_DigestInit(ctx_init, kdf_md)) | |
295 | goto end; | |
296 | ||
297 | for (counter = 1;; counter++) { | |
298 | /* updating the ctr modifies 4 bytes in the 'other' buffer */ | |
299 | ctr[0] = (unsigned char)((counter >> 24) & 0xff); | |
300 | ctr[1] = (unsigned char)((counter >> 16) & 0xff); | |
301 | ctr[2] = (unsigned char)((counter >> 8) & 0xff); | |
302 | ctr[3] = (unsigned char)(counter & 0xff); | |
303 | ||
304 | if (!EVP_MD_CTX_copy_ex(ctx, ctx_init) | |
305 | || !EVP_DigestUpdate(ctx, z, z_len) | |
306 | || !EVP_DigestUpdate(ctx, other, other_len)) | |
307 | goto end; | |
308 | if (len >= out_len) { | |
309 | if (!EVP_DigestFinal_ex(ctx, out, NULL)) | |
310 | goto end; | |
311 | out += out_len; | |
312 | len -= out_len; | |
313 | if (len == 0) | |
314 | break; | |
315 | } else { | |
316 | if (!EVP_DigestFinal_ex(ctx, mac, NULL)) | |
317 | goto end; | |
318 | memcpy(out, mac, len); | |
319 | break; | |
320 | } | |
321 | } | |
322 | ret = 1; | |
323 | end: | |
324 | EVP_MD_CTX_free(ctx); | |
325 | EVP_MD_CTX_free(ctx_init); | |
326 | OPENSSL_cleanse(mac, sizeof(mac)); | |
327 | return ret; | |
328 | } | |
329 | ||
e3405a4a | 330 | static void *x942kdf_new(void *provctx) |
1aec7716 | 331 | { |
e3405a4a | 332 | KDF_X942 *ctx; |
1aec7716 | 333 | |
2b9e4e95 P |
334 | if (!ossl_prov_is_running()) |
335 | return 0; | |
336 | ||
e3405a4a P |
337 | if ((ctx = OPENSSL_zalloc(sizeof(*ctx))) == NULL) |
338 | ERR_raise(ERR_LIB_PROV, ERR_R_MALLOC_FAILURE); | |
339 | ctx->provctx = provctx; | |
89cccbea | 340 | ctx->use_keybits = 1; |
e3405a4a | 341 | return ctx; |
1aec7716 SL |
342 | } |
343 | ||
e3405a4a | 344 | static void x942kdf_reset(void *vctx) |
1aec7716 | 345 | { |
e3405a4a | 346 | KDF_X942 *ctx = (KDF_X942 *)vctx; |
0577959c | 347 | void *provctx = ctx->provctx; |
1aec7716 | 348 | |
e97bab69 | 349 | ossl_prov_digest_reset(&ctx->digest); |
e3405a4a | 350 | OPENSSL_clear_free(ctx->secret, ctx->secret_len); |
8a686bdb | 351 | OPENSSL_clear_free(ctx->acvpinfo, ctx->acvpinfo_len); |
89cccbea SL |
352 | OPENSSL_clear_free(ctx->partyuinfo, ctx->partyuinfo_len); |
353 | OPENSSL_clear_free(ctx->partyvinfo, ctx->partyvinfo_len); | |
354 | OPENSSL_clear_free(ctx->supp_pubinfo, ctx->supp_pubinfo_len); | |
355 | OPENSSL_clear_free(ctx->supp_privinfo, ctx->supp_privinfo_len); | |
e3405a4a | 356 | memset(ctx, 0, sizeof(*ctx)); |
0577959c | 357 | ctx->provctx = provctx; |
89cccbea | 358 | ctx->use_keybits = 1; |
1aec7716 SL |
359 | } |
360 | ||
e3405a4a | 361 | static void x942kdf_free(void *vctx) |
1aec7716 | 362 | { |
e3405a4a | 363 | KDF_X942 *ctx = (KDF_X942 *)vctx; |
1aec7716 | 364 | |
3c659415 P |
365 | if (ctx != NULL) { |
366 | x942kdf_reset(ctx); | |
367 | OPENSSL_free(ctx); | |
368 | } | |
1aec7716 SL |
369 | } |
370 | ||
e3405a4a P |
371 | static int x942kdf_set_buffer(unsigned char **out, size_t *out_len, |
372 | const OSSL_PARAM *p) | |
1aec7716 | 373 | { |
e3405a4a | 374 | if (p->data_size == 0 || p->data == NULL) |
1aec7716 SL |
375 | return 1; |
376 | ||
e3405a4a P |
377 | OPENSSL_free(*out); |
378 | *out = NULL; | |
379 | return OSSL_PARAM_get_octet_string(p, (void **)out, 0, out_len); | |
1aec7716 SL |
380 | } |
381 | ||
e3405a4a | 382 | static size_t x942kdf_size(KDF_X942 *ctx) |
1aec7716 SL |
383 | { |
384 | int len; | |
e97bab69 | 385 | const EVP_MD *md = ossl_prov_digest_md(&ctx->digest); |
1aec7716 | 386 | |
e97bab69 | 387 | if (md == NULL) { |
e3405a4a | 388 | ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_MESSAGE_DIGEST); |
1aec7716 SL |
389 | return 0; |
390 | } | |
e97bab69 | 391 | len = EVP_MD_size(md); |
1aec7716 SL |
392 | return (len <= 0) ? 0 : (size_t)len; |
393 | } | |
394 | ||
3469b388 P |
395 | static int x942kdf_derive(void *vctx, unsigned char *key, size_t keylen, |
396 | const OSSL_PARAM params[]) | |
1aec7716 | 397 | { |
e3405a4a | 398 | KDF_X942 *ctx = (KDF_X942 *)vctx; |
2b9e4e95 | 399 | const EVP_MD *md; |
1aec7716 SL |
400 | int ret = 0; |
401 | unsigned char *ctr; | |
402 | unsigned char *der = NULL; | |
403 | size_t der_len = 0; | |
404 | ||
3469b388 | 405 | if (!ossl_prov_is_running() || !x942kdf_set_ctx_params(ctx, params)) |
2b9e4e95 P |
406 | return 0; |
407 | ||
89cccbea SL |
408 | /* |
409 | * These 2 options encode to the same field so only one of them should be | |
410 | * active at once. | |
411 | */ | |
412 | if (ctx->use_keybits && ctx->supp_pubinfo != NULL) { | |
413 | ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_PUBINFO); | |
414 | return 0; | |
415 | } | |
8a686bdb SL |
416 | /* |
417 | * If the blob of acvp data is used then the individual info fields that it | |
418 | * replaces should not also be defined. | |
419 | */ | |
420 | if (ctx->acvpinfo != NULL | |
421 | && (ctx->partyuinfo != NULL | |
422 | || ctx->partyvinfo != NULL | |
423 | || ctx->supp_pubinfo != NULL | |
424 | || ctx->supp_privinfo != NULL)) { | |
425 | ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_DATA); | |
426 | return 0; | |
427 | } | |
e3405a4a P |
428 | if (ctx->secret == NULL) { |
429 | ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_SECRET); | |
1aec7716 SL |
430 | return 0; |
431 | } | |
2b9e4e95 | 432 | md = ossl_prov_digest_md(&ctx->digest); |
e97bab69 | 433 | if (md == NULL) { |
e3405a4a | 434 | ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_MESSAGE_DIGEST); |
1aec7716 SL |
435 | return 0; |
436 | } | |
e5b2cd58 | 437 | if (ctx->cek_oid == NULL || ctx->cek_oid_len == 0) { |
e3405a4a | 438 | ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_CEK_ALG); |
1aec7716 SL |
439 | return 0; |
440 | } | |
89cccbea | 441 | if (ctx->partyuinfo != NULL && ctx->partyuinfo_len >= X942KDF_MAX_INLEN) { |
1aec7716 | 442 | /* |
89cccbea | 443 | * Note the ukm length MUST be 512 bits if it is used. |
1aec7716 SL |
444 | * For backwards compatibility the old check is being done. |
445 | */ | |
89cccbea | 446 | ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_UKM_LENGTH); |
1aec7716 SL |
447 | return 0; |
448 | } | |
1aec7716 | 449 | /* generate the otherinfo der */ |
89cccbea | 450 | if (!x942_encode_otherinfo(ctx->use_keybits ? ctx->dkm_len : 0, |
e5b2cd58 | 451 | ctx->cek_oid, ctx->cek_oid_len, |
8a686bdb | 452 | ctx->acvpinfo, ctx->acvpinfo_len, |
89cccbea SL |
453 | ctx->partyuinfo, ctx->partyuinfo_len, |
454 | ctx->partyvinfo, ctx->partyvinfo_len, | |
455 | ctx->supp_pubinfo, ctx->supp_pubinfo_len, | |
456 | ctx->supp_privinfo, ctx->supp_privinfo_len, | |
1aec7716 | 457 | &der, &der_len, &ctr)) { |
e3405a4a | 458 | ERR_raise(ERR_LIB_PROV, PROV_R_BAD_ENCODING); |
1aec7716 SL |
459 | return 0; |
460 | } | |
e97bab69 | 461 | ret = x942kdf_hash_kdm(md, ctx->secret, ctx->secret_len, |
1aec7716 SL |
462 | der, der_len, ctr, key, keylen); |
463 | OPENSSL_free(der); | |
464 | return ret; | |
465 | } | |
466 | ||
e3405a4a P |
467 | static int x942kdf_set_ctx_params(void *vctx, const OSSL_PARAM params[]) |
468 | { | |
e771249c | 469 | const OSSL_PARAM *p, *pq; |
e3405a4a | 470 | KDF_X942 *ctx = vctx; |
a829b735 | 471 | OSSL_LIB_CTX *provctx = PROV_LIBCTX_OF(ctx->provctx); |
e771249c | 472 | const char *propq = NULL; |
e5b2cd58 | 473 | size_t id; |
e3405a4a | 474 | |
c983a0e5 P |
475 | if (params == NULL) |
476 | return 1; | |
e97bab69 P |
477 | if (!ossl_prov_digest_load_from_params(&ctx->digest, params, provctx)) |
478 | return 0; | |
e3405a4a | 479 | |
89cccbea SL |
480 | p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_SECRET); |
481 | if (p == NULL) | |
482 | p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_KEY); | |
483 | if (p != NULL && !x942kdf_set_buffer(&ctx->secret, &ctx->secret_len, p)) | |
484 | return 0; | |
485 | ||
8a686bdb SL |
486 | p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_X942_ACVPINFO); |
487 | if (p != NULL | |
488 | && !x942kdf_set_buffer(&ctx->acvpinfo, &ctx->acvpinfo_len, p)) | |
489 | return 0; | |
490 | ||
89cccbea SL |
491 | p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_X942_PARTYUINFO); |
492 | if (p == NULL) | |
493 | p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_UKM); | |
494 | if (p != NULL | |
495 | && !x942kdf_set_buffer(&ctx->partyuinfo, &ctx->partyuinfo_len, p)) | |
496 | return 0; | |
e3405a4a | 497 | |
89cccbea SL |
498 | p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_X942_PARTYVINFO); |
499 | if (p != NULL | |
500 | && !x942kdf_set_buffer(&ctx->partyvinfo, &ctx->partyvinfo_len, p)) | |
501 | return 0; | |
502 | ||
503 | p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_X942_USE_KEYBITS); | |
504 | if (p != NULL && !OSSL_PARAM_get_int(p, &ctx->use_keybits)) | |
505 | return 0; | |
506 | ||
507 | p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_X942_SUPP_PUBINFO); | |
508 | if (p != NULL) { | |
509 | if (!x942kdf_set_buffer(&ctx->supp_pubinfo, &ctx->supp_pubinfo_len, p)) | |
e3405a4a | 510 | return 0; |
89cccbea SL |
511 | ctx->use_keybits = 0; |
512 | } | |
513 | ||
514 | p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_X942_SUPP_PRIVINFO); | |
515 | if (p != NULL | |
516 | && !x942kdf_set_buffer(&ctx->supp_privinfo, &ctx->supp_privinfo_len, p)) | |
517 | return 0; | |
e3405a4a | 518 | |
89cccbea SL |
519 | p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_CEK_ALG); |
520 | if (p != NULL) { | |
e3405a4a P |
521 | if (p->data_type != OSSL_PARAM_UTF8_STRING) |
522 | return 0; | |
e771249c SL |
523 | pq = OSSL_PARAM_locate_const(params, OSSL_ALG_PARAM_PROPERTIES); |
524 | /* | |
525 | * We already grab the properties during ossl_prov_digest_load_from_params() | |
526 | * so there is no need to check the validity again.. | |
527 | */ | |
528 | if (pq != NULL) | |
529 | propq = p->data; | |
530 | if (find_alg_id(provctx, p->data, propq, &id) == 0) | |
e5b2cd58 SL |
531 | return 0; |
532 | ctx->cek_oid = kek_algs[id].oid; | |
533 | ctx->cek_oid_len = kek_algs[id].oid_len; | |
534 | ctx->dkm_len = kek_algs[id].keklen; | |
e3405a4a P |
535 | } |
536 | return 1; | |
537 | } | |
538 | ||
1e8e5c60 P |
539 | static const OSSL_PARAM *x942kdf_settable_ctx_params(ossl_unused void *ctx, |
540 | ossl_unused void *provctx) | |
e3405a4a P |
541 | { |
542 | static const OSSL_PARAM known_settable_ctx_params[] = { | |
543 | OSSL_PARAM_utf8_string(OSSL_KDF_PARAM_PROPERTIES, NULL, 0), | |
544 | OSSL_PARAM_utf8_string(OSSL_KDF_PARAM_DIGEST, NULL, 0), | |
545 | OSSL_PARAM_octet_string(OSSL_KDF_PARAM_SECRET, NULL, 0), | |
546 | OSSL_PARAM_octet_string(OSSL_KDF_PARAM_KEY, NULL, 0), | |
547 | OSSL_PARAM_octet_string(OSSL_KDF_PARAM_UKM, NULL, 0), | |
8a686bdb | 548 | OSSL_PARAM_octet_string(OSSL_KDF_PARAM_X942_ACVPINFO, NULL, 0), |
89cccbea SL |
549 | OSSL_PARAM_octet_string(OSSL_KDF_PARAM_X942_PARTYUINFO, NULL, 0), |
550 | OSSL_PARAM_octet_string(OSSL_KDF_PARAM_X942_PARTYVINFO, NULL, 0), | |
551 | OSSL_PARAM_octet_string(OSSL_KDF_PARAM_X942_SUPP_PUBINFO, NULL, 0), | |
552 | OSSL_PARAM_octet_string(OSSL_KDF_PARAM_X942_SUPP_PRIVINFO, NULL, 0), | |
553 | OSSL_PARAM_int(OSSL_KDF_PARAM_X942_USE_KEYBITS, NULL), | |
e3405a4a P |
554 | OSSL_PARAM_utf8_string(OSSL_KDF_PARAM_CEK_ALG, NULL, 0), |
555 | OSSL_PARAM_END | |
556 | }; | |
557 | return known_settable_ctx_params; | |
558 | } | |
559 | ||
560 | static int x942kdf_get_ctx_params(void *vctx, OSSL_PARAM params[]) | |
561 | { | |
562 | KDF_X942 *ctx = (KDF_X942 *)vctx; | |
563 | OSSL_PARAM *p; | |
564 | ||
565 | if ((p = OSSL_PARAM_locate(params, OSSL_KDF_PARAM_SIZE)) != NULL) | |
566 | return OSSL_PARAM_set_size_t(p, x942kdf_size(ctx)); | |
567 | return -2; | |
568 | } | |
569 | ||
1e8e5c60 P |
570 | static const OSSL_PARAM *x942kdf_gettable_ctx_params(ossl_unused void *ctx, |
571 | ossl_unused void *provctx) | |
e3405a4a P |
572 | { |
573 | static const OSSL_PARAM known_gettable_ctx_params[] = { | |
574 | OSSL_PARAM_size_t(OSSL_KDF_PARAM_SIZE, NULL), | |
575 | OSSL_PARAM_END | |
576 | }; | |
577 | return known_gettable_ctx_params; | |
578 | } | |
579 | ||
1be63951 | 580 | const OSSL_DISPATCH ossl_kdf_x942_kdf_functions[] = { |
e3405a4a P |
581 | { OSSL_FUNC_KDF_NEWCTX, (void(*)(void))x942kdf_new }, |
582 | { OSSL_FUNC_KDF_FREECTX, (void(*)(void))x942kdf_free }, | |
583 | { OSSL_FUNC_KDF_RESET, (void(*)(void))x942kdf_reset }, | |
584 | { OSSL_FUNC_KDF_DERIVE, (void(*)(void))x942kdf_derive }, | |
585 | { OSSL_FUNC_KDF_SETTABLE_CTX_PARAMS, | |
586 | (void(*)(void))x942kdf_settable_ctx_params }, | |
587 | { OSSL_FUNC_KDF_SET_CTX_PARAMS, (void(*)(void))x942kdf_set_ctx_params }, | |
588 | { OSSL_FUNC_KDF_GETTABLE_CTX_PARAMS, | |
589 | (void(*)(void))x942kdf_gettable_ctx_params }, | |
590 | { OSSL_FUNC_KDF_GET_CTX_PARAMS, (void(*)(void))x942kdf_get_ctx_params }, | |
591 | { 0, NULL } | |
1aec7716 | 592 | }; |