crypto/cms/cms_ec.c

   1 /*
   2  * Copyright 2006-2023 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include <assert.h>
  11 #include <limits.h>
  12 #include <openssl/cms.h>
  13 #include <openssl/err.h>
  14 #include <openssl/decoder.h>
  15 #include "internal/sizes.h"
  16 #include "crypto/asn1.h"
  17 #include "crypto/evp.h"
  18 #include "cms_local.h"
  19
  20 static EVP_PKEY *pkey_type2param(int ptype, const void *pval,
  21                                  OSSL_LIB_CTX *libctx, const char *propq)
  22 {
  23     EVP_PKEY *pkey = NULL;
  24     EVP_PKEY_CTX *pctx = NULL;
  25     OSSL_DECODER_CTX *ctx = NULL;
  26
  27     if (ptype == V_ASN1_SEQUENCE) {
  28         const ASN1_STRING *pstr = pval;
  29         const unsigned char *pm = pstr->data;
  30         size_t pmlen = (size_t)pstr->length;
  31         int selection = OSSL_KEYMGMT_SELECT_ALL_PARAMETERS;
  32
  33         ctx = OSSL_DECODER_CTX_new_for_pkey(&pkey, "DER", NULL, "EC",
  34                                             selection, libctx, propq);
  35         if (ctx == NULL)
  36             goto err;
  37
  38         if (!OSSL_DECODER_from_data(ctx, &pm, &pmlen)) {
  39             ERR_raise(ERR_LIB_CMS, CMS_R_DECODE_ERROR);
  40             goto err;
  41         }
  42         OSSL_DECODER_CTX_free(ctx);
  43         return pkey;
  44     } else if (ptype == V_ASN1_OBJECT) {
  45         const ASN1_OBJECT *poid = pval;
  46         char groupname[OSSL_MAX_NAME_SIZE];
  47
  48         /* type == V_ASN1_OBJECT => the parameters are given by an asn1 OID */
  49         pctx = EVP_PKEY_CTX_new_from_name(libctx, "EC", propq);
  50         if (pctx == NULL || EVP_PKEY_paramgen_init(pctx) <= 0)
  51             goto err;
  52         if (OBJ_obj2txt(groupname, sizeof(groupname), poid, 0) <= 0
  53                 || EVP_PKEY_CTX_set_group_name(pctx, groupname) <= 0) {
  54             ERR_raise(ERR_LIB_CMS, CMS_R_DECODE_ERROR);
  55             goto err;
  56         }
  57         if (EVP_PKEY_paramgen(pctx, &pkey) <= 0)
  58             goto err;
  59         EVP_PKEY_CTX_free(pctx);
  60         return pkey;
  61     }
  62
  63     ERR_raise(ERR_LIB_CMS, CMS_R_DECODE_ERROR);
  64     return NULL;
  65
  66  err:
  67     EVP_PKEY_free(pkey);
  68     EVP_PKEY_CTX_free(pctx);
  69     OSSL_DECODER_CTX_free(ctx);
  70     return NULL;
  71 }
  72
  73 static int ecdh_cms_set_peerkey(EVP_PKEY_CTX *pctx,
  74                                 X509_ALGOR *alg, ASN1_BIT_STRING *pubkey)
  75 {
  76     const ASN1_OBJECT *aoid;
  77     int atype;
  78     const void *aval;
  79     int rv = 0;
  80     EVP_PKEY *pkpeer = NULL;
  81     const unsigned char *p;
  82     int plen;
  83
  84     X509_ALGOR_get0(&aoid, &atype, &aval, alg);
  85     if (OBJ_obj2nid(aoid) != NID_X9_62_id_ecPublicKey)
  86         goto err;
  87
  88     /* If absent parameters get group from main key */
  89     if (atype == V_ASN1_UNDEF || atype == V_ASN1_NULL) {
  90         EVP_PKEY *pk;
  91
  92         pk = EVP_PKEY_CTX_get0_pkey(pctx);
  93         if (pk == NULL)
  94             goto err;
  95
  96         pkpeer = EVP_PKEY_new();
  97         if (pkpeer == NULL)
  98             goto err;
  99         if (!EVP_PKEY_copy_parameters(pkpeer, pk))
 100             goto err;
 101     } else {
 102         pkpeer = pkey_type2param(atype, aval,
 103                                  EVP_PKEY_CTX_get0_libctx(pctx),
 104                                  EVP_PKEY_CTX_get0_propq(pctx));
 105         if (pkpeer == NULL)
 106             goto err;
 107     }
 108     /* We have parameters now set public key */
 109     plen = ASN1_STRING_length(pubkey);
 110     p = ASN1_STRING_get0_data(pubkey);
 111     if (p == NULL || plen == 0)
 112         goto err;
 113
 114     if (!EVP_PKEY_set1_encoded_public_key(pkpeer, p, plen))
 115         goto err;
 116
 117     if (EVP_PKEY_derive_set_peer(pctx, pkpeer) > 0)
 118         rv = 1;
 119  err:
 120     EVP_PKEY_free(pkpeer);
 121     return rv;
 122 }
 123
 124 /* Set KDF parameters based on KDF NID */
 125 static int ecdh_cms_set_kdf_param(EVP_PKEY_CTX *pctx, int eckdf_nid)
 126 {
 127     int kdf_nid, kdfmd_nid, cofactor;
 128     const EVP_MD *kdf_md;
 129
 130     if (eckdf_nid == NID_undef)
 131         return 0;
 132
 133     /* Lookup KDF type, cofactor mode and digest */
 134     if (!OBJ_find_sigid_algs(eckdf_nid, &kdfmd_nid, &kdf_nid))
 135         return 0;
 136
 137     if (kdf_nid == NID_dh_std_kdf)
 138         cofactor = 0;
 139     else if (kdf_nid == NID_dh_cofactor_kdf)
 140         cofactor = 1;
 141     else
 142         return 0;
 143
 144     if (EVP_PKEY_CTX_set_ecdh_cofactor_mode(pctx, cofactor) <= 0)
 145         return 0;
 146
 147     if (EVP_PKEY_CTX_set_ecdh_kdf_type(pctx, EVP_PKEY_ECDH_KDF_X9_63) <= 0)
 148         return 0;
 149
 150     kdf_md = EVP_get_digestbynid(kdfmd_nid);
 151     if (!kdf_md)
 152         return 0;
 153
 154     if (EVP_PKEY_CTX_set_ecdh_kdf_md(pctx, kdf_md) <= 0)
 155         return 0;
 156     return 1;
 157 }
 158
 159 static int ecdh_cms_set_shared_info(EVP_PKEY_CTX *pctx, CMS_RecipientInfo *ri)
 160 {
 161     int rv = 0;
 162     X509_ALGOR *alg, *kekalg = NULL;
 163     ASN1_OCTET_STRING *ukm;
 164     const unsigned char *p;
 165     unsigned char *der = NULL;
 166     int plen, keylen;
 167     EVP_CIPHER *kekcipher = NULL;
 168     EVP_CIPHER_CTX *kekctx;
 169     char name[OSSL_MAX_NAME_SIZE];
 170
 171     if (!CMS_RecipientInfo_kari_get0_alg(ri, &alg, &ukm))
 172         return 0;
 173
 174     if (!ecdh_cms_set_kdf_param(pctx, OBJ_obj2nid(alg->algorithm))) {
 175         ERR_raise(ERR_LIB_CMS, CMS_R_KDF_PARAMETER_ERROR);
 176         return 0;
 177     }
 178
 179     if (alg->parameter->type != V_ASN1_SEQUENCE)
 180         return 0;
 181
 182     p = alg->parameter->value.sequence->data;
 183     plen = alg->parameter->value.sequence->length;
 184     kekalg = d2i_X509_ALGOR(NULL, &p, plen);
 185     if (kekalg == NULL)
 186         goto err;
 187     kekctx = CMS_RecipientInfo_kari_get0_ctx(ri);
 188     if (kekctx == NULL)
 189         goto err;
 190     OBJ_obj2txt(name, sizeof(name), kekalg->algorithm, 0);
 191     kekcipher = EVP_CIPHER_fetch(pctx->libctx, name, pctx->propquery);
 192     if (kekcipher == NULL || EVP_CIPHER_get_mode(kekcipher) != EVP_CIPH_WRAP_MODE)
 193         goto err;
 194     if (!EVP_EncryptInit_ex(kekctx, kekcipher, NULL, NULL, NULL))
 195         goto err;
 196     if (EVP_CIPHER_asn1_to_param(kekctx, kekalg->parameter) <= 0)
 197         goto err;
 198
 199     keylen = EVP_CIPHER_CTX_get_key_length(kekctx);
 200     if (EVP_PKEY_CTX_set_ecdh_kdf_outlen(pctx, keylen) <= 0)
 201         goto err;
 202
 203     plen = CMS_SharedInfo_encode(&der, kekalg, ukm, keylen);
 204
 205     if (plen <= 0)
 206         goto err;
 207
 208     if (EVP_PKEY_CTX_set0_ecdh_kdf_ukm(pctx, der, plen) <= 0)
 209         goto err;
 210     der = NULL;
 211
 212     rv = 1;
 213  err:
 214     EVP_CIPHER_free(kekcipher);
 215     X509_ALGOR_free(kekalg);
 216     OPENSSL_free(der);
 217     return rv;
 218 }
 219
 220 static int ecdh_cms_decrypt(CMS_RecipientInfo *ri)
 221 {
 222     EVP_PKEY_CTX *pctx;
 223
 224     pctx = CMS_RecipientInfo_get0_pkey_ctx(ri);
 225     if (pctx == NULL)
 226         return 0;
 227     /* See if we need to set peer key */
 228     if (!EVP_PKEY_CTX_get0_peerkey(pctx)) {
 229         X509_ALGOR *alg;
 230         ASN1_BIT_STRING *pubkey;
 231
 232         if (!CMS_RecipientInfo_kari_get0_orig_id(ri, &alg, &pubkey,
 233                                                  NULL, NULL, NULL))
 234             return 0;
 235         if (alg == NULL || pubkey == NULL)
 236             return 0;
 237         if (!ecdh_cms_set_peerkey(pctx, alg, pubkey)) {
 238             ERR_raise(ERR_LIB_CMS, CMS_R_PEER_KEY_ERROR);
 239             return 0;
 240         }
 241     }
 242     /* Set ECDH derivation parameters and initialise unwrap context */
 243     if (!ecdh_cms_set_shared_info(pctx, ri)) {
 244         ERR_raise(ERR_LIB_CMS, CMS_R_SHARED_INFO_ERROR);
 245         return 0;
 246     }
 247     return 1;
 248 }
 249
 250 static int ecdh_cms_encrypt(CMS_RecipientInfo *ri)
 251 {
 252     EVP_PKEY_CTX *pctx;
 253     EVP_PKEY *pkey;
 254     EVP_CIPHER_CTX *ctx;
 255     int keylen;
 256     X509_ALGOR *talg, *wrap_alg = NULL;
 257     const ASN1_OBJECT *aoid;
 258     ASN1_BIT_STRING *pubkey;
 259     ASN1_STRING *wrap_str;
 260     ASN1_OCTET_STRING *ukm;
 261     unsigned char *penc = NULL;
 262     int penclen;
 263     int rv = 0;
 264     int ecdh_nid, kdf_type, kdf_nid, wrap_nid;
 265     const EVP_MD *kdf_md;
 266
 267     pctx = CMS_RecipientInfo_get0_pkey_ctx(ri);
 268     if (pctx == NULL)
 269         return 0;
 270     /* Get ephemeral key */
 271     pkey = EVP_PKEY_CTX_get0_pkey(pctx);
 272     if (!CMS_RecipientInfo_kari_get0_orig_id(ri, &talg, &pubkey,
 273                                              NULL, NULL, NULL))
 274         goto err;
 275     X509_ALGOR_get0(&aoid, NULL, NULL, talg);
 276     /* Is everything uninitialised? */
 277     if (aoid == OBJ_nid2obj(NID_undef)) {
 278         /* Set the key */
 279         size_t enckeylen;
 280
 281         enckeylen = EVP_PKEY_get1_encoded_public_key(pkey, &penc);
 282         if (enckeylen > INT_MAX || enckeylen == 0)
 283             goto err;
 284         ASN1_STRING_set0(pubkey, penc, (int)enckeylen);
 285         ossl_asn1_string_set_bits_left(pubkey, 0);
 286
 287         penc = NULL;
 288         (void)X509_ALGOR_set0(talg, OBJ_nid2obj(NID_X9_62_id_ecPublicKey),
 289                               V_ASN1_UNDEF, NULL); /* cannot fail */
 290     }
 291
 292     /* See if custom parameters set */
 293     kdf_type = EVP_PKEY_CTX_get_ecdh_kdf_type(pctx);
 294     if (kdf_type <= 0)
 295         goto err;
 296     if (EVP_PKEY_CTX_get_ecdh_kdf_md(pctx, &kdf_md) <= 0)
 297         goto err;
 298     ecdh_nid = EVP_PKEY_CTX_get_ecdh_cofactor_mode(pctx);
 299     if (ecdh_nid < 0)
 300         goto err;
 301     else if (ecdh_nid == 0)
 302         ecdh_nid = NID_dh_std_kdf;
 303     else if (ecdh_nid == 1)
 304         ecdh_nid = NID_dh_cofactor_kdf;
 305
 306     if (kdf_type == EVP_PKEY_ECDH_KDF_NONE) {
 307         kdf_type = EVP_PKEY_ECDH_KDF_X9_63;
 308         if (EVP_PKEY_CTX_set_ecdh_kdf_type(pctx, kdf_type) <= 0)
 309             goto err;
 310     } else
 311         /* Unknown KDF */
 312         goto err;
 313     if (kdf_md == NULL) {
 314         /* Fixme later for better MD */
 315         kdf_md = EVP_sha1();
 316         if (EVP_PKEY_CTX_set_ecdh_kdf_md(pctx, kdf_md) <= 0)
 317             goto err;
 318     }
 319
 320     if (!CMS_RecipientInfo_kari_get0_alg(ri, &talg, &ukm))
 321         goto err;
 322
 323     /* Lookup NID for KDF+cofactor+digest */
 324
 325     if (!OBJ_find_sigid_by_algs(&kdf_nid, EVP_MD_get_type(kdf_md), ecdh_nid))
 326         goto err;
 327     /* Get wrap NID */
 328     ctx = CMS_RecipientInfo_kari_get0_ctx(ri);
 329     wrap_nid = EVP_CIPHER_CTX_get_type(ctx);
 330     keylen = EVP_CIPHER_CTX_get_key_length(ctx);
 331
 332     /* Package wrap algorithm in an AlgorithmIdentifier */
 333
 334     wrap_alg = X509_ALGOR_new();
 335     if (wrap_alg == NULL)
 336         goto err;
 337     wrap_alg->algorithm = OBJ_nid2obj(wrap_nid);
 338     wrap_alg->parameter = ASN1_TYPE_new();
 339     if (wrap_alg->parameter == NULL)
 340         goto err;
 341     if (EVP_CIPHER_param_to_asn1(ctx, wrap_alg->parameter) <= 0)
 342         goto err;
 343     if (ASN1_TYPE_get(wrap_alg->parameter) == NID_undef) {
 344         ASN1_TYPE_free(wrap_alg->parameter);
 345         wrap_alg->parameter = NULL;
 346     }
 347
 348     if (EVP_PKEY_CTX_set_ecdh_kdf_outlen(pctx, keylen) <= 0)
 349         goto err;
 350
 351     penclen = CMS_SharedInfo_encode(&penc, wrap_alg, ukm, keylen);
 352
 353     if (penclen <= 0)
 354         goto err;
 355
 356     if (EVP_PKEY_CTX_set0_ecdh_kdf_ukm(pctx, penc, penclen) <= 0)
 357         goto err;
 358     penc = NULL;
 359
 360     /*
 361      * Now need to wrap encoding of wrap AlgorithmIdentifier into parameter
 362      * of another AlgorithmIdentifier.
 363      */
 364     penclen = i2d_X509_ALGOR(wrap_alg, &penc);
 365     if (penclen <= 0)
 366         goto err;
 367     wrap_str = ASN1_STRING_new();
 368     if (wrap_str == NULL)
 369         goto err;
 370     ASN1_STRING_set0(wrap_str, penc, penclen);
 371     penc = NULL;
 372     rv = X509_ALGOR_set0(talg, OBJ_nid2obj(kdf_nid), V_ASN1_SEQUENCE, wrap_str);
 373     if (!rv)
 374         ASN1_STRING_free(wrap_str);
 375
 376  err:
 377     OPENSSL_free(penc);
 378     X509_ALGOR_free(wrap_alg);
 379     return rv;
 380 }
 381
 382 int ossl_cms_ecdh_envelope(CMS_RecipientInfo *ri, int decrypt)
 383 {
 384     assert(decrypt == 0 || decrypt == 1);
 385
 386     if (decrypt == 1)
 387         return ecdh_cms_decrypt(ri);
 388
 389     if (decrypt == 0)
 390         return ecdh_cms_encrypt(ri);
 391
 392     ERR_raise(ERR_LIB_CMS, CMS_R_NOT_SUPPORTED_FOR_THIS_KEY_TYPE);
 393     return 0;
 394 }