crypto/cms/cms_pwri.c

   1 /*
   2  * Copyright 2009-2021 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include "internal/cryptlib.h"
  11 #include <openssl/asn1t.h>
  12 #include <openssl/pem.h>
  13 #include <openssl/x509v3.h>
  14 #include <openssl/err.h>
  15 #include <openssl/cms.h>
  16 #include <openssl/rand.h>
  17 #include <openssl/aes.h>
  18 #include "cms_local.h"
  19 #include "crypto/asn1.h"
  20
  21 int CMS_RecipientInfo_set0_password(CMS_RecipientInfo *ri,
  22                                     unsigned char *pass, ossl_ssize_t passlen)
  23 {
  24     CMS_PasswordRecipientInfo *pwri;
  25     if (ri->type != CMS_RECIPINFO_PASS) {
  26         ERR_raise(ERR_LIB_CMS, CMS_R_NOT_PWRI);
  27         return 0;
  28     }
  29
  30     pwri = ri->d.pwri;
  31     pwri->pass = pass;
  32     if (pass && passlen < 0)
  33         passlen = strlen((char *)pass);
  34     pwri->passlen = passlen;
  35     return 1;
  36 }
  37
  38 CMS_RecipientInfo *CMS_add0_recipient_password(CMS_ContentInfo *cms,
  39                                                int iter, int wrap_nid,
  40                                                int pbe_nid,
  41                                                unsigned char *pass,
  42                                                ossl_ssize_t passlen,
  43                                                const EVP_CIPHER *kekciph)
  44 {
  45     STACK_OF(CMS_RecipientInfo) *ris;
  46     CMS_RecipientInfo *ri = NULL;
  47     CMS_EncryptedContentInfo *ec;
  48     CMS_PasswordRecipientInfo *pwri;
  49     EVP_CIPHER_CTX *ctx = NULL;
  50     X509_ALGOR *encalg = NULL;
  51     unsigned char iv[EVP_MAX_IV_LENGTH];
  52     int ivlen;
  53     const CMS_CTX *cms_ctx = ossl_cms_get0_cmsctx(cms);
  54
  55     ec = ossl_cms_get0_env_enc_content(cms);
  56     if (ec == NULL)
  57         return NULL;
  58     ris = CMS_get0_RecipientInfos(cms);
  59     if (ris == NULL)
  60         return NULL;
  61
  62     if (wrap_nid <= 0)
  63         wrap_nid = NID_id_alg_PWRI_KEK;
  64
  65     if (pbe_nid <= 0)
  66         pbe_nid = NID_id_pbkdf2;
  67
  68     /* Get from enveloped data */
  69     if (kekciph == NULL)
  70         kekciph = ec->cipher;
  71
  72     if (kekciph == NULL) {
  73         ERR_raise(ERR_LIB_CMS, CMS_R_NO_CIPHER);
  74         return NULL;
  75     }
  76     if (wrap_nid != NID_id_alg_PWRI_KEK) {
  77         ERR_raise(ERR_LIB_CMS, CMS_R_UNSUPPORTED_KEY_ENCRYPTION_ALGORITHM);
  78         return NULL;
  79     }
  80
  81     /* Setup algorithm identifier for cipher */
  82     encalg = X509_ALGOR_new();
  83     if (encalg == NULL) {
  84         goto merr;
  85     }
  86     ctx = EVP_CIPHER_CTX_new();
  87
  88     if (EVP_EncryptInit_ex(ctx, kekciph, NULL, NULL, NULL) <= 0) {
  89         ERR_raise(ERR_LIB_CMS, ERR_R_EVP_LIB);
  90         goto err;
  91     }
  92
  93     ivlen = EVP_CIPHER_CTX_iv_length(ctx);
  94
  95     if (ivlen > 0) {
  96         if (RAND_bytes_ex(ossl_cms_ctx_get0_libctx(cms_ctx), iv, ivlen) <= 0)
  97             goto err;
  98         if (EVP_EncryptInit_ex(ctx, NULL, NULL, NULL, iv) <= 0) {
  99             ERR_raise(ERR_LIB_CMS, ERR_R_EVP_LIB);
 100             goto err;
 101         }
 102         encalg->parameter = ASN1_TYPE_new();
 103         if (!encalg->parameter) {
 104             ERR_raise(ERR_LIB_CMS, ERR_R_MALLOC_FAILURE);
 105             goto err;
 106         }
 107         if (EVP_CIPHER_param_to_asn1(ctx, encalg->parameter) <= 0) {
 108             ERR_raise(ERR_LIB_CMS, CMS_R_CIPHER_PARAMETER_INITIALISATION_ERROR);
 109             goto err;
 110         }
 111     }
 112
 113     encalg->algorithm = OBJ_nid2obj(EVP_CIPHER_CTX_type(ctx));
 114
 115     EVP_CIPHER_CTX_free(ctx);
 116     ctx = NULL;
 117
 118     /* Initialize recipient info */
 119     ri = M_ASN1_new_of(CMS_RecipientInfo);
 120     if (ri == NULL)
 121         goto merr;
 122
 123     ri->d.pwri = M_ASN1_new_of(CMS_PasswordRecipientInfo);
 124     if (ri->d.pwri == NULL)
 125         goto merr;
 126     ri->type = CMS_RECIPINFO_PASS;
 127
 128     pwri = ri->d.pwri;
 129     pwri->cms_ctx = cms_ctx;
 130     /* Since this is overwritten, free up empty structure already there */
 131     X509_ALGOR_free(pwri->keyEncryptionAlgorithm);
 132     pwri->keyEncryptionAlgorithm = X509_ALGOR_new();
 133     if (pwri->keyEncryptionAlgorithm == NULL)
 134         goto merr;
 135     pwri->keyEncryptionAlgorithm->algorithm = OBJ_nid2obj(wrap_nid);
 136     pwri->keyEncryptionAlgorithm->parameter = ASN1_TYPE_new();
 137     if (pwri->keyEncryptionAlgorithm->parameter == NULL)
 138         goto merr;
 139
 140     if (!ASN1_item_pack(encalg, ASN1_ITEM_rptr(X509_ALGOR),
 141                         &pwri->keyEncryptionAlgorithm->parameter->
 142                         value.sequence))
 143          goto merr;
 144     pwri->keyEncryptionAlgorithm->parameter->type = V_ASN1_SEQUENCE;
 145
 146     X509_ALGOR_free(encalg);
 147     encalg = NULL;
 148
 149     /* Setup PBE algorithm */
 150
 151     pwri->keyDerivationAlgorithm = PKCS5_pbkdf2_set(iter, NULL, 0, -1, -1);
 152
 153     if (pwri->keyDerivationAlgorithm == NULL)
 154         goto err;
 155
 156     CMS_RecipientInfo_set0_password(ri, pass, passlen);
 157     pwri->version = 0;
 158
 159     if (!sk_CMS_RecipientInfo_push(ris, ri))
 160         goto merr;
 161
 162     return ri;
 163
 164  merr:
 165     ERR_raise(ERR_LIB_CMS, ERR_R_MALLOC_FAILURE);
 166  err:
 167     EVP_CIPHER_CTX_free(ctx);
 168     if (ri)
 169         M_ASN1_free_of(ri, CMS_RecipientInfo);
 170     X509_ALGOR_free(encalg);
 171     return NULL;
 172
 173 }
 174
 175 /*
 176  * This is an implementation of the key wrapping mechanism in RFC3211, at
 177  * some point this should go into EVP.
 178  */
 179
 180 static int kek_unwrap_key(unsigned char *out, size_t *outlen,
 181                           const unsigned char *in, size_t inlen,
 182                           EVP_CIPHER_CTX *ctx)
 183 {
 184     size_t blocklen = EVP_CIPHER_CTX_block_size(ctx);
 185     unsigned char *tmp;
 186     int outl, rv = 0;
 187     if (inlen < 2 * blocklen) {
 188         /* too small */
 189         return 0;
 190     }
 191     if (inlen % blocklen) {
 192         /* Invalid size */
 193         return 0;
 194     }
 195     if ((tmp = OPENSSL_malloc(inlen)) == NULL) {
 196         ERR_raise(ERR_LIB_CMS, ERR_R_MALLOC_FAILURE);
 197         return 0;
 198     }
 199     /* setup IV by decrypting last two blocks */
 200     if (!EVP_DecryptUpdate(ctx, tmp + inlen - 2 * blocklen, &outl,
 201                            in + inlen - 2 * blocklen, blocklen * 2)
 202         /*
 203          * Do a decrypt of last decrypted block to set IV to correct value
 204          * output it to start of buffer so we don't corrupt decrypted block
 205          * this works because buffer is at least two block lengths long.
 206          */
 207         || !EVP_DecryptUpdate(ctx, tmp, &outl,
 208                               tmp + inlen - blocklen, blocklen)
 209         /* Can now decrypt first n - 1 blocks */
 210         || !EVP_DecryptUpdate(ctx, tmp, &outl, in, inlen - blocklen)
 211
 212         /* Reset IV to original value */
 213         || !EVP_DecryptInit_ex(ctx, NULL, NULL, NULL, NULL)
 214         /* Decrypt again */
 215         || !EVP_DecryptUpdate(ctx, tmp, &outl, tmp, inlen))
 216         goto err;
 217     /* Check check bytes */
 218     if (((tmp[1] ^ tmp[4]) & (tmp[2] ^ tmp[5]) & (tmp[3] ^ tmp[6])) != 0xff) {
 219         /* Check byte failure */
 220         goto err;
 221     }
 222     if (inlen < (size_t)(tmp[0] - 4)) {
 223         /* Invalid length value */
 224         goto err;
 225     }
 226     *outlen = (size_t)tmp[0];
 227     memcpy(out, tmp + 4, *outlen);
 228     rv = 1;
 229  err:
 230     OPENSSL_clear_free(tmp, inlen);
 231     return rv;
 232
 233 }
 234
 235 static int kek_wrap_key(unsigned char *out, size_t *outlen,
 236                         const unsigned char *in, size_t inlen,
 237                         EVP_CIPHER_CTX *ctx, const CMS_CTX *cms_ctx)
 238 {
 239     size_t blocklen = EVP_CIPHER_CTX_block_size(ctx);
 240     size_t olen;
 241     int dummy;
 242     /*
 243      * First decide length of output buffer: need header and round up to
 244      * multiple of block length.
 245      */
 246     olen = (inlen + 4 + blocklen - 1) / blocklen;
 247     olen *= blocklen;
 248     if (olen < 2 * blocklen) {
 249         /* Key too small */
 250         return 0;
 251     }
 252     if (inlen > 0xFF) {
 253         /* Key too large */
 254         return 0;
 255     }
 256     if (out) {
 257         /* Set header */
 258         out[0] = (unsigned char)inlen;
 259         out[1] = in[0] ^ 0xFF;
 260         out[2] = in[1] ^ 0xFF;
 261         out[3] = in[2] ^ 0xFF;
 262         memcpy(out + 4, in, inlen);
 263         /* Add random padding to end */
 264         if (olen > inlen + 4
 265             && RAND_bytes_ex(ossl_cms_ctx_get0_libctx(cms_ctx), out + 4 + inlen,
 266                              olen - 4 - inlen) <= 0)
 267             return 0;
 268         /* Encrypt twice */
 269         if (!EVP_EncryptUpdate(ctx, out, &dummy, out, olen)
 270             || !EVP_EncryptUpdate(ctx, out, &dummy, out, olen))
 271             return 0;
 272     }
 273
 274     *outlen = olen;
 275
 276     return 1;
 277 }
 278
 279 /* Encrypt/Decrypt content key in PWRI recipient info */
 280
 281 int ossl_cms_RecipientInfo_pwri_crypt(const CMS_ContentInfo *cms,
 282                                       CMS_RecipientInfo *ri, int en_de)
 283 {
 284     CMS_EncryptedContentInfo *ec;
 285     CMS_PasswordRecipientInfo *pwri;
 286     int r = 0;
 287     X509_ALGOR *algtmp, *kekalg = NULL;
 288     EVP_CIPHER_CTX *kekctx = NULL;
 289     const char *name;
 290     EVP_CIPHER *kekcipher;
 291     unsigned char *key = NULL;
 292     size_t keylen;
 293     const CMS_CTX *cms_ctx = ossl_cms_get0_cmsctx(cms);
 294
 295     ec = ossl_cms_get0_env_enc_content(cms);
 296
 297     pwri = ri->d.pwri;
 298
 299     if (pwri->pass == NULL) {
 300         ERR_raise(ERR_LIB_CMS, CMS_R_NO_PASSWORD);
 301         return 0;
 302     }
 303     algtmp = pwri->keyEncryptionAlgorithm;
 304
 305     if (!algtmp || OBJ_obj2nid(algtmp->algorithm) != NID_id_alg_PWRI_KEK) {
 306         ERR_raise(ERR_LIB_CMS, CMS_R_UNSUPPORTED_KEY_ENCRYPTION_ALGORITHM);
 307         return 0;
 308     }
 309
 310     kekalg = ASN1_TYPE_unpack_sequence(ASN1_ITEM_rptr(X509_ALGOR),
 311                                        algtmp->parameter);
 312
 313     if (kekalg == NULL) {
 314         ERR_raise(ERR_LIB_CMS, CMS_R_INVALID_KEY_ENCRYPTION_PARAMETER);
 315         return 0;
 316     }
 317
 318     name = OBJ_nid2sn(OBJ_obj2nid(kekalg->algorithm));
 319     kekcipher = EVP_CIPHER_fetch(ossl_cms_ctx_get0_libctx(cms_ctx), name,
 320                                  ossl_cms_ctx_get0_propq(cms_ctx));
 321
 322     if (kekcipher == NULL) {
 323         ERR_raise(ERR_LIB_CMS, CMS_R_UNKNOWN_CIPHER);
 324         goto err;
 325     }
 326
 327     kekctx = EVP_CIPHER_CTX_new();
 328     if (kekctx == NULL) {
 329         ERR_raise(ERR_LIB_CMS, ERR_R_MALLOC_FAILURE);
 330         goto err;
 331     }
 332     /* Fixup cipher based on AlgorithmIdentifier to set IV etc */
 333     if (!EVP_CipherInit_ex(kekctx, kekcipher, NULL, NULL, NULL, en_de))
 334         goto err;
 335     EVP_CIPHER_CTX_set_padding(kekctx, 0);
 336     if (EVP_CIPHER_asn1_to_param(kekctx, kekalg->parameter) <= 0) {
 337         ERR_raise(ERR_LIB_CMS, CMS_R_CIPHER_PARAMETER_INITIALISATION_ERROR);
 338         goto err;
 339     }
 340
 341     algtmp = pwri->keyDerivationAlgorithm;
 342
 343     /* Finish password based key derivation to setup key in "ctx" */
 344
 345     if (EVP_PBE_CipherInit(algtmp->algorithm,
 346                            (char *)pwri->pass, pwri->passlen,
 347                            algtmp->parameter, kekctx, en_de) < 0) {
 348         ERR_raise(ERR_LIB_CMS, ERR_R_EVP_LIB);
 349         goto err;
 350     }
 351
 352     /* Finally wrap/unwrap the key */
 353
 354     if (en_de) {
 355
 356         if (!kek_wrap_key(NULL, &keylen, ec->key, ec->keylen, kekctx, cms_ctx))
 357             goto err;
 358
 359         key = OPENSSL_malloc(keylen);
 360
 361         if (key == NULL)
 362             goto err;
 363
 364         if (!kek_wrap_key(key, &keylen, ec->key, ec->keylen, kekctx, cms_ctx))
 365             goto err;
 366         pwri->encryptedKey->data = key;
 367         pwri->encryptedKey->length = keylen;
 368     } else {
 369         key = OPENSSL_malloc(pwri->encryptedKey->length);
 370
 371         if (key == NULL) {
 372             ERR_raise(ERR_LIB_CMS, ERR_R_MALLOC_FAILURE);
 373             goto err;
 374         }
 375         if (!kek_unwrap_key(key, &keylen,
 376                             pwri->encryptedKey->data,
 377                             pwri->encryptedKey->length, kekctx)) {
 378             ERR_raise(ERR_LIB_CMS, CMS_R_UNWRAP_FAILURE);
 379             goto err;
 380         }
 381
 382         OPENSSL_clear_free(ec->key, ec->keylen);
 383         ec->key = key;
 384         ec->keylen = keylen;
 385
 386     }
 387
 388     r = 1;
 389
 390  err:
 391     EVP_CIPHER_free(kekcipher);
 392     EVP_CIPHER_CTX_free(kekctx);
 393
 394     if (!r)
 395         OPENSSL_free(key);
 396     X509_ALGOR_free(kekalg);
 397
 398     return r;
 399
 400 }