crypto/ec/ec_ameth.c

   1 /*
   2  * Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the OpenSSL license (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include <stdio.h>
  11 #include "internal/cryptlib.h"
  12 #include <openssl/x509.h>
  13 #include <openssl/ec.h>
  14 #include <openssl/bn.h>
  15 #include <openssl/cms.h>
  16 #include <openssl/asn1t.h>
  17 #include "internal/asn1_int.h"
  18 #include "internal/evp_int.h"
  19 #include "ec_lcl.h"
  20
  21 #ifndef OPENSSL_NO_CMS
  22 static int ecdh_cms_decrypt(CMS_RecipientInfo *ri);
  23 static int ecdh_cms_encrypt(CMS_RecipientInfo *ri);
  24 #endif
  25
  26 static int eckey_param2type(int *pptype, void **ppval, EC_KEY *ec_key)
  27 {
  28     const EC_GROUP *group;
  29     int nid;
  30     if (ec_key == NULL || (group = EC_KEY_get0_group(ec_key)) == NULL) {
  31         ECerr(EC_F_ECKEY_PARAM2TYPE, EC_R_MISSING_PARAMETERS);
  32         return 0;
  33     }
  34     if (EC_GROUP_get_asn1_flag(group)
  35         && (nid = EC_GROUP_get_curve_name(group)))
  36         /* we have a 'named curve' => just set the OID */
  37     {
  38         *ppval = OBJ_nid2obj(nid);
  39         *pptype = V_ASN1_OBJECT;
  40     } else {                    /* explicit parameters */
  41
  42         ASN1_STRING *pstr = NULL;
  43         pstr = ASN1_STRING_new();
  44         if (pstr == NULL)
  45             return 0;
  46         pstr->length = i2d_ECParameters(ec_key, &pstr->data);
  47         if (pstr->length <= 0) {
  48             ASN1_STRING_free(pstr);
  49             ECerr(EC_F_ECKEY_PARAM2TYPE, ERR_R_EC_LIB);
  50             return 0;
  51         }
  52         *ppval = pstr;
  53         *pptype = V_ASN1_SEQUENCE;
  54     }
  55     return 1;
  56 }
  57
  58 static int eckey_pub_encode(X509_PUBKEY *pk, const EVP_PKEY *pkey)
  59 {
  60     EC_KEY *ec_key = pkey->pkey.ec;
  61     void *pval = NULL;
  62     int ptype;
  63     unsigned char *penc = NULL, *p;
  64     int penclen;
  65
  66     if (!eckey_param2type(&ptype, &pval, ec_key)) {
  67         ECerr(EC_F_ECKEY_PUB_ENCODE, ERR_R_EC_LIB);
  68         return 0;
  69     }
  70     penclen = i2o_ECPublicKey(ec_key, NULL);
  71     if (penclen <= 0)
  72         goto err;
  73     penc = OPENSSL_malloc(penclen);
  74     if (penc == NULL)
  75         goto err;
  76     p = penc;
  77     penclen = i2o_ECPublicKey(ec_key, &p);
  78     if (penclen <= 0)
  79         goto err;
  80     if (X509_PUBKEY_set0_param(pk, OBJ_nid2obj(EVP_PKEY_EC),
  81                                ptype, pval, penc, penclen))
  82         return 1;
  83  err:
  84     if (ptype == V_ASN1_OBJECT)
  85         ASN1_OBJECT_free(pval);
  86     else
  87         ASN1_STRING_free(pval);
  88     OPENSSL_free(penc);
  89     return 0;
  90 }
  91
  92 static EC_KEY *eckey_type2param(int ptype, void *pval)
  93 {
  94     EC_KEY *eckey = NULL;
  95     if (ptype == V_ASN1_SEQUENCE) {
  96         ASN1_STRING *pstr = pval;
  97         const unsigned char *pm = NULL;
  98         int pmlen;
  99         pm = pstr->data;
 100         pmlen = pstr->length;
 101         if ((eckey = d2i_ECParameters(NULL, &pm, pmlen)) == NULL) {
 102             ECerr(EC_F_ECKEY_TYPE2PARAM, EC_R_DECODE_ERROR);
 103             goto ecerr;
 104         }
 105     } else if (ptype == V_ASN1_OBJECT) {
 106         ASN1_OBJECT *poid = pval;
 107         EC_GROUP *group;
 108
 109         /*
 110          * type == V_ASN1_OBJECT => the parameters are given by an asn1 OID
 111          */
 112         if ((eckey = EC_KEY_new()) == NULL) {
 113             ECerr(EC_F_ECKEY_TYPE2PARAM, ERR_R_MALLOC_FAILURE);
 114             goto ecerr;
 115         }
 116         group = EC_GROUP_new_by_curve_name(OBJ_obj2nid(poid));
 117         if (group == NULL)
 118             goto ecerr;
 119         EC_GROUP_set_asn1_flag(group, OPENSSL_EC_NAMED_CURVE);
 120         if (EC_KEY_set_group(eckey, group) == 0)
 121             goto ecerr;
 122         EC_GROUP_free(group);
 123     } else {
 124         ECerr(EC_F_ECKEY_TYPE2PARAM, EC_R_DECODE_ERROR);
 125         goto ecerr;
 126     }
 127
 128     return eckey;
 129
 130  ecerr:
 131     EC_KEY_free(eckey);
 132     return NULL;
 133 }
 134
 135 static int eckey_pub_decode(EVP_PKEY *pkey, X509_PUBKEY *pubkey)
 136 {
 137     const unsigned char *p = NULL;
 138     void *pval;
 139     int ptype, pklen;
 140     EC_KEY *eckey = NULL;
 141     X509_ALGOR *palg;
 142
 143     if (!X509_PUBKEY_get0_param(NULL, &p, &pklen, &palg, pubkey))
 144         return 0;
 145     X509_ALGOR_get0(NULL, &ptype, &pval, palg);
 146
 147     eckey = eckey_type2param(ptype, pval);
 148
 149     if (!eckey) {
 150         ECerr(EC_F_ECKEY_PUB_DECODE, ERR_R_EC_LIB);
 151         return 0;
 152     }
 153
 154     /* We have parameters now set public key */
 155     if (!o2i_ECPublicKey(&eckey, &p, pklen)) {
 156         ECerr(EC_F_ECKEY_PUB_DECODE, EC_R_DECODE_ERROR);
 157         goto ecerr;
 158     }
 159
 160     EVP_PKEY_assign_EC_KEY(pkey, eckey);
 161     return 1;
 162
 163  ecerr:
 164     EC_KEY_free(eckey);
 165     return 0;
 166 }
 167
 168 static int eckey_pub_cmp(const EVP_PKEY *a, const EVP_PKEY *b)
 169 {
 170     int r;
 171     const EC_GROUP *group = EC_KEY_get0_group(b->pkey.ec);
 172     const EC_POINT *pa = EC_KEY_get0_public_key(a->pkey.ec),
 173         *pb = EC_KEY_get0_public_key(b->pkey.ec);
 174     r = EC_POINT_cmp(group, pa, pb, NULL);
 175     if (r == 0)
 176         return 1;
 177     if (r == 1)
 178         return 0;
 179     return -2;
 180 }
 181
 182 static int eckey_priv_decode(EVP_PKEY *pkey, PKCS8_PRIV_KEY_INFO *p8)
 183 {
 184     const unsigned char *p = NULL;
 185     void *pval;
 186     int ptype, pklen;
 187     EC_KEY *eckey = NULL;
 188     X509_ALGOR *palg;
 189
 190     if (!PKCS8_pkey_get0(NULL, &p, &pklen, &palg, p8))
 191         return 0;
 192     X509_ALGOR_get0(NULL, &ptype, &pval, palg);
 193
 194     eckey = eckey_type2param(ptype, pval);
 195
 196     if (!eckey)
 197         goto ecliberr;
 198
 199     /* We have parameters now set private key */
 200     if (!d2i_ECPrivateKey(&eckey, &p, pklen)) {
 201         ECerr(EC_F_ECKEY_PRIV_DECODE, EC_R_DECODE_ERROR);
 202         goto ecerr;
 203     }
 204
 205     EVP_PKEY_assign_EC_KEY(pkey, eckey);
 206     return 1;
 207
 208  ecliberr:
 209     ECerr(EC_F_ECKEY_PRIV_DECODE, ERR_R_EC_LIB);
 210  ecerr:
 211     EC_KEY_free(eckey);
 212     return 0;
 213 }
 214
 215 static int eckey_priv_encode(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pkey)
 216 {
 217     EC_KEY ec_key = *(pkey->pkey.ec);
 218     unsigned char *ep, *p;
 219     int eplen, ptype;
 220     void *pval;
 221     unsigned int old_flags;
 222
 223     if (!eckey_param2type(&ptype, &pval, &ec_key)) {
 224         ECerr(EC_F_ECKEY_PRIV_ENCODE, EC_R_DECODE_ERROR);
 225         return 0;
 226     }
 227
 228     /* set the private key */
 229
 230     /*
 231      * do not include the parameters in the SEC1 private key see PKCS#11
 232      * 12.11
 233      */
 234     old_flags = EC_KEY_get_enc_flags(&ec_key);
 235     EC_KEY_set_enc_flags(&ec_key, old_flags | EC_PKEY_NO_PARAMETERS);
 236
 237     eplen = i2d_ECPrivateKey(&ec_key, NULL);
 238     if (!eplen) {
 239         ECerr(EC_F_ECKEY_PRIV_ENCODE, ERR_R_EC_LIB);
 240         return 0;
 241     }
 242     ep = OPENSSL_malloc(eplen);
 243     if (ep == NULL) {
 244         ECerr(EC_F_ECKEY_PRIV_ENCODE, ERR_R_MALLOC_FAILURE);
 245         return 0;
 246     }
 247     p = ep;
 248     if (!i2d_ECPrivateKey(&ec_key, &p)) {
 249         OPENSSL_free(ep);
 250         ECerr(EC_F_ECKEY_PRIV_ENCODE, ERR_R_EC_LIB);
 251         return 0;
 252     }
 253
 254     if (!PKCS8_pkey_set0(p8, OBJ_nid2obj(NID_X9_62_id_ecPublicKey), 0,
 255                          ptype, pval, ep, eplen))
 256         return 0;
 257
 258     return 1;
 259 }
 260
 261 static int int_ec_size(const EVP_PKEY *pkey)
 262 {
 263     return ECDSA_size(pkey->pkey.ec);
 264 }
 265
 266 static int ec_bits(const EVP_PKEY *pkey)
 267 {
 268     return EC_GROUP_order_bits(EC_KEY_get0_group(pkey->pkey.ec));
 269 }
 270
 271 static int ec_security_bits(const EVP_PKEY *pkey)
 272 {
 273     int ecbits = ec_bits(pkey);
 274     if (ecbits >= 512)
 275         return 256;
 276     if (ecbits >= 384)
 277         return 192;
 278     if (ecbits >= 256)
 279         return 128;
 280     if (ecbits >= 224)
 281         return 112;
 282     if (ecbits >= 160)
 283         return 80;
 284     return ecbits / 2;
 285 }
 286
 287 static int ec_missing_parameters(const EVP_PKEY *pkey)
 288 {
 289     if (pkey->pkey.ec == NULL || EC_KEY_get0_group(pkey->pkey.ec) == NULL)
 290         return 1;
 291     return 0;
 292 }
 293
 294 static int ec_copy_parameters(EVP_PKEY *to, const EVP_PKEY *from)
 295 {
 296     EC_GROUP *group = EC_GROUP_dup(EC_KEY_get0_group(from->pkey.ec));
 297     if (group == NULL)
 298         return 0;
 299     if (to->pkey.ec == NULL) {
 300         to->pkey.ec = EC_KEY_new();
 301         if (to->pkey.ec == NULL)
 302             return 0;
 303     }
 304     if (EC_KEY_set_group(to->pkey.ec, group) == 0)
 305         return 0;
 306     EC_GROUP_free(group);
 307     return 1;
 308 }
 309
 310 static int ec_cmp_parameters(const EVP_PKEY *a, const EVP_PKEY *b)
 311 {
 312     const EC_GROUP *group_a = EC_KEY_get0_group(a->pkey.ec),
 313         *group_b = EC_KEY_get0_group(b->pkey.ec);
 314     if (EC_GROUP_cmp(group_a, group_b, NULL))
 315         return 0;
 316     else
 317         return 1;
 318 }
 319
 320 static void int_ec_free(EVP_PKEY *pkey)
 321 {
 322     EC_KEY_free(pkey->pkey.ec);
 323 }
 324
 325 typedef enum {
 326     EC_KEY_PRINT_PRIVATE,
 327     EC_KEY_PRINT_PUBLIC,
 328     EC_KEY_PRINT_PARAM
 329 } ec_print_t;
 330
 331 static int do_EC_KEY_print(BIO *bp, const EC_KEY *x, int off, ec_print_t ktype)
 332 {
 333     const char *ecstr;
 334     unsigned char *priv = NULL, *pub = NULL;
 335     size_t privlen = 0, publen = 0;
 336     int ret = 0;
 337     const EC_GROUP *group;
 338
 339     if (x == NULL || (group = EC_KEY_get0_group(x)) == NULL) {
 340         ECerr(EC_F_DO_EC_KEY_PRINT, ERR_R_PASSED_NULL_PARAMETER);
 341         return 0;
 342     }
 343
 344     if (ktype != EC_KEY_PRINT_PARAM) {
 345         publen = EC_KEY_key2buf(x, EC_KEY_get_conv_form(x), &pub, NULL);
 346         if (publen == 0)
 347             goto err;
 348     }
 349
 350     if (ktype == EC_KEY_PRINT_PRIVATE && EC_KEY_get0_private_key(x) != NULL) {
 351         privlen = EC_KEY_priv2buf(x, &priv);
 352         if (privlen == 0)
 353             goto err;
 354     }
 355
 356     if (ktype == EC_KEY_PRINT_PRIVATE)
 357         ecstr = "Private-Key";
 358     else if (ktype == EC_KEY_PRINT_PUBLIC)
 359         ecstr = "Public-Key";
 360     else
 361         ecstr = "ECDSA-Parameters";
 362
 363     if (!BIO_indent(bp, off, 128))
 364         goto err;
 365     if (BIO_printf(bp, "%s: (%d bit)\n", ecstr,
 366                    EC_GROUP_order_bits(group)) <= 0)
 367         goto err;
 368
 369     if (privlen != 0) {
 370         if (BIO_printf(bp, "%*spriv:\n", off, "") <= 0)
 371             goto err;
 372         if (ASN1_buf_print(bp, priv, privlen, off + 4) == 0)
 373             goto err;
 374     }
 375
 376     if (publen != 0) {
 377         if (BIO_printf(bp, "%*spub:\n", off, "") <= 0)
 378             goto err;
 379         if (ASN1_buf_print(bp, pub, publen, off + 4) == 0)
 380             goto err;
 381     }
 382
 383     if (!ECPKParameters_print(bp, group, off))
 384         goto err;
 385     ret = 1;
 386  err:
 387     if (!ret)
 388         ECerr(EC_F_DO_EC_KEY_PRINT, ERR_R_EC_LIB);
 389     OPENSSL_clear_free(priv, privlen);
 390     OPENSSL_free(pub);
 391     return ret;
 392 }
 393
 394 static int eckey_param_decode(EVP_PKEY *pkey,
 395                               const unsigned char **pder, int derlen)
 396 {
 397     EC_KEY *eckey;
 398
 399     if ((eckey = d2i_ECParameters(NULL, pder, derlen)) == NULL) {
 400         ECerr(EC_F_ECKEY_PARAM_DECODE, ERR_R_EC_LIB);
 401         return 0;
 402     }
 403     EVP_PKEY_assign_EC_KEY(pkey, eckey);
 404     return 1;
 405 }
 406
 407 static int eckey_param_encode(const EVP_PKEY *pkey, unsigned char **pder)
 408 {
 409     return i2d_ECParameters(pkey->pkey.ec, pder);
 410 }
 411
 412 static int eckey_param_print(BIO *bp, const EVP_PKEY *pkey, int indent,
 413                              ASN1_PCTX *ctx)
 414 {
 415     return do_EC_KEY_print(bp, pkey->pkey.ec, indent, EC_KEY_PRINT_PARAM);
 416 }
 417
 418 static int eckey_pub_print(BIO *bp, const EVP_PKEY *pkey, int indent,
 419                            ASN1_PCTX *ctx)
 420 {
 421     return do_EC_KEY_print(bp, pkey->pkey.ec, indent, EC_KEY_PRINT_PUBLIC);
 422 }
 423
 424 static int eckey_priv_print(BIO *bp, const EVP_PKEY *pkey, int indent,
 425                             ASN1_PCTX *ctx)
 426 {
 427     return do_EC_KEY_print(bp, pkey->pkey.ec, indent, EC_KEY_PRINT_PRIVATE);
 428 }
 429
 430 static int old_ec_priv_decode(EVP_PKEY *pkey,
 431                               const unsigned char **pder, int derlen)
 432 {
 433     EC_KEY *ec;
 434
 435     if ((ec = d2i_ECPrivateKey(NULL, pder, derlen)) == NULL) {
 436         ECerr(EC_F_OLD_EC_PRIV_DECODE, EC_R_DECODE_ERROR);
 437         return 0;
 438     }
 439     EVP_PKEY_assign_EC_KEY(pkey, ec);
 440     return 1;
 441 }
 442
 443 static int old_ec_priv_encode(const EVP_PKEY *pkey, unsigned char **pder)
 444 {
 445     return i2d_ECPrivateKey(pkey->pkey.ec, pder);
 446 }
 447
 448 static int ec_pkey_ctrl(EVP_PKEY *pkey, int op, long arg1, void *arg2)
 449 {
 450     switch (op) {
 451     case ASN1_PKEY_CTRL_PKCS7_SIGN:
 452         if (arg1 == 0) {
 453             int snid, hnid;
 454             X509_ALGOR *alg1, *alg2;
 455             PKCS7_SIGNER_INFO_get0_algs(arg2, NULL, &alg1, &alg2);
 456             if (alg1 == NULL || alg1->algorithm == NULL)
 457                 return -1;
 458             hnid = OBJ_obj2nid(alg1->algorithm);
 459             if (hnid == NID_undef)
 460                 return -1;
 461             if (!OBJ_find_sigid_by_algs(&snid, hnid, EVP_PKEY_id(pkey)))
 462                 return -1;
 463             X509_ALGOR_set0(alg2, OBJ_nid2obj(snid), V_ASN1_UNDEF, 0);
 464         }
 465         return 1;
 466 #ifndef OPENSSL_NO_CMS
 467     case ASN1_PKEY_CTRL_CMS_SIGN:
 468         if (arg1 == 0) {
 469             int snid, hnid;
 470             X509_ALGOR *alg1, *alg2;
 471             CMS_SignerInfo_get0_algs(arg2, NULL, NULL, &alg1, &alg2);
 472             if (alg1 == NULL || alg1->algorithm == NULL)
 473                 return -1;
 474             hnid = OBJ_obj2nid(alg1->algorithm);
 475             if (hnid == NID_undef)
 476                 return -1;
 477             if (!OBJ_find_sigid_by_algs(&snid, hnid, EVP_PKEY_id(pkey)))
 478                 return -1;
 479             X509_ALGOR_set0(alg2, OBJ_nid2obj(snid), V_ASN1_UNDEF, 0);
 480         }
 481         return 1;
 482
 483     case ASN1_PKEY_CTRL_CMS_ENVELOPE:
 484         if (arg1 == 1)
 485             return ecdh_cms_decrypt(arg2);
 486         else if (arg1 == 0)
 487             return ecdh_cms_encrypt(arg2);
 488         return -2;
 489
 490     case ASN1_PKEY_CTRL_CMS_RI_TYPE:
 491         *(int *)arg2 = CMS_RECIPINFO_AGREE;
 492         return 1;
 493 #endif
 494
 495     case ASN1_PKEY_CTRL_DEFAULT_MD_NID:
 496         *(int *)arg2 = NID_sha256;
 497         return 2;
 498
 499     case ASN1_PKEY_CTRL_SET1_TLS_ENCPT:
 500         return EC_KEY_oct2key(EVP_PKEY_get0_EC_KEY(pkey), arg2, arg1, NULL);
 501
 502     case ASN1_PKEY_CTRL_GET1_TLS_ENCPT:
 503         return EC_KEY_key2buf(EVP_PKEY_get0_EC_KEY(pkey),
 504                               POINT_CONVERSION_UNCOMPRESSED, arg2, NULL);
 505
 506     default:
 507         return -2;
 508
 509     }
 510
 511 }
 512
 513 const EVP_PKEY_ASN1_METHOD eckey_asn1_meth = {
 514     EVP_PKEY_EC,
 515     EVP_PKEY_EC,
 516     0,
 517     "EC",
 518     "OpenSSL EC algorithm",
 519
 520     eckey_pub_decode,
 521     eckey_pub_encode,
 522     eckey_pub_cmp,
 523     eckey_pub_print,
 524
 525     eckey_priv_decode,
 526     eckey_priv_encode,
 527     eckey_priv_print,
 528
 529     int_ec_size,
 530     ec_bits,
 531     ec_security_bits,
 532
 533     eckey_param_decode,
 534     eckey_param_encode,
 535     ec_missing_parameters,
 536     ec_copy_parameters,
 537     ec_cmp_parameters,
 538     eckey_param_print,
 539     0,
 540
 541     int_ec_free,
 542     ec_pkey_ctrl,
 543     old_ec_priv_decode,
 544     old_ec_priv_encode
 545 };
 546
 547 int EC_KEY_print(BIO *bp, const EC_KEY *x, int off)
 548 {
 549     int private = EC_KEY_get0_private_key(x) != NULL;
 550
 551     return do_EC_KEY_print(bp, x, off,
 552                 private ? EC_KEY_PRINT_PRIVATE : EC_KEY_PRINT_PUBLIC);
 553 }
 554
 555 int ECParameters_print(BIO *bp, const EC_KEY *x)
 556 {
 557     return do_EC_KEY_print(bp, x, 4, EC_KEY_PRINT_PARAM);
 558 }
 559
 560 #ifndef OPENSSL_NO_CMS
 561
 562 static int ecdh_cms_set_peerkey(EVP_PKEY_CTX *pctx,
 563                                 X509_ALGOR *alg, ASN1_BIT_STRING *pubkey)
 564 {
 565     ASN1_OBJECT *aoid;
 566     int atype;
 567     void *aval;
 568     int rv = 0;
 569     EVP_PKEY *pkpeer = NULL;
 570     EC_KEY *ecpeer = NULL;
 571     const unsigned char *p;
 572     int plen;
 573     X509_ALGOR_get0(&aoid, &atype, &aval, alg);
 574     if (OBJ_obj2nid(aoid) != NID_X9_62_id_ecPublicKey)
 575         goto err;
 576     /* If absent parameters get group from main key */
 577     if (atype == V_ASN1_UNDEF || atype == V_ASN1_NULL) {
 578         const EC_GROUP *grp;
 579         EVP_PKEY *pk;
 580         pk = EVP_PKEY_CTX_get0_pkey(pctx);
 581         if (!pk)
 582             goto err;
 583         grp = EC_KEY_get0_group(pk->pkey.ec);
 584         ecpeer = EC_KEY_new();
 585         if (ecpeer == NULL)
 586             goto err;
 587         if (!EC_KEY_set_group(ecpeer, grp))
 588             goto err;
 589     } else {
 590         ecpeer = eckey_type2param(atype, aval);
 591         if (!ecpeer)
 592             goto err;
 593     }
 594     /* We have parameters now set public key */
 595     plen = ASN1_STRING_length(pubkey);
 596     p = ASN1_STRING_data(pubkey);
 597     if (!p || !plen)
 598         goto err;
 599     if (!o2i_ECPublicKey(&ecpeer, &p, plen))
 600         goto err;
 601     pkpeer = EVP_PKEY_new();
 602     if (pkpeer == NULL)
 603         goto err;
 604     EVP_PKEY_set1_EC_KEY(pkpeer, ecpeer);
 605     if (EVP_PKEY_derive_set_peer(pctx, pkpeer) > 0)
 606         rv = 1;
 607  err:
 608     EC_KEY_free(ecpeer);
 609     EVP_PKEY_free(pkpeer);
 610     return rv;
 611 }
 612
 613 /* Set KDF parameters based on KDF NID */
 614 static int ecdh_cms_set_kdf_param(EVP_PKEY_CTX *pctx, int eckdf_nid)
 615 {
 616     int kdf_nid, kdfmd_nid, cofactor;
 617     const EVP_MD *kdf_md;
 618     if (eckdf_nid == NID_undef)
 619         return 0;
 620
 621     /* Lookup KDF type, cofactor mode and digest */
 622     if (!OBJ_find_sigid_algs(eckdf_nid, &kdfmd_nid, &kdf_nid))
 623         return 0;
 624
 625     if (kdf_nid == NID_dh_std_kdf)
 626         cofactor = 0;
 627     else if (kdf_nid == NID_dh_cofactor_kdf)
 628         cofactor = 1;
 629     else
 630         return 0;
 631
 632     if (EVP_PKEY_CTX_set_ecdh_cofactor_mode(pctx, cofactor) <= 0)
 633         return 0;
 634
 635     if (EVP_PKEY_CTX_set_ecdh_kdf_type(pctx, EVP_PKEY_ECDH_KDF_X9_62) <= 0)
 636         return 0;
 637
 638     kdf_md = EVP_get_digestbynid(kdfmd_nid);
 639     if (!kdf_md)
 640         return 0;
 641
 642     if (EVP_PKEY_CTX_set_ecdh_kdf_md(pctx, kdf_md) <= 0)
 643         return 0;
 644     return 1;
 645 }
 646
 647 static int ecdh_cms_set_shared_info(EVP_PKEY_CTX *pctx, CMS_RecipientInfo *ri)
 648 {
 649     int rv = 0;
 650
 651     X509_ALGOR *alg, *kekalg = NULL;
 652     ASN1_OCTET_STRING *ukm;
 653     const unsigned char *p;
 654     unsigned char *der = NULL;
 655     int plen, keylen;
 656     const EVP_CIPHER *kekcipher;
 657     EVP_CIPHER_CTX *kekctx;
 658
 659     if (!CMS_RecipientInfo_kari_get0_alg(ri, &alg, &ukm))
 660         return 0;
 661
 662     if (!ecdh_cms_set_kdf_param(pctx, OBJ_obj2nid(alg->algorithm))) {
 663         ECerr(EC_F_ECDH_CMS_SET_SHARED_INFO, EC_R_KDF_PARAMETER_ERROR);
 664         return 0;
 665     }
 666
 667     if (alg->parameter->type != V_ASN1_SEQUENCE)
 668         return 0;
 669
 670     p = alg->parameter->value.sequence->data;
 671     plen = alg->parameter->value.sequence->length;
 672     kekalg = d2i_X509_ALGOR(NULL, &p, plen);
 673     if (!kekalg)
 674         goto err;
 675     kekctx = CMS_RecipientInfo_kari_get0_ctx(ri);
 676     if (!kekctx)
 677         goto err;
 678     kekcipher = EVP_get_cipherbyobj(kekalg->algorithm);
 679     if (!kekcipher || EVP_CIPHER_mode(kekcipher) != EVP_CIPH_WRAP_MODE)
 680         goto err;
 681     if (!EVP_EncryptInit_ex(kekctx, kekcipher, NULL, NULL, NULL))
 682         goto err;
 683     if (EVP_CIPHER_asn1_to_param(kekctx, kekalg->parameter) <= 0)
 684         goto err;
 685
 686     keylen = EVP_CIPHER_CTX_key_length(kekctx);
 687     if (EVP_PKEY_CTX_set_ecdh_kdf_outlen(pctx, keylen) <= 0)
 688         goto err;
 689
 690     plen = CMS_SharedInfo_encode(&der, kekalg, ukm, keylen);
 691
 692     if (!plen)
 693         goto err;
 694
 695     if (EVP_PKEY_CTX_set0_ecdh_kdf_ukm(pctx, der, plen) <= 0)
 696         goto err;
 697     der = NULL;
 698
 699     rv = 1;
 700  err:
 701     X509_ALGOR_free(kekalg);
 702     OPENSSL_free(der);
 703     return rv;
 704 }
 705
 706 static int ecdh_cms_decrypt(CMS_RecipientInfo *ri)
 707 {
 708     EVP_PKEY_CTX *pctx;
 709     pctx = CMS_RecipientInfo_get0_pkey_ctx(ri);
 710     if (!pctx)
 711         return 0;
 712     /* See if we need to set peer key */
 713     if (!EVP_PKEY_CTX_get0_peerkey(pctx)) {
 714         X509_ALGOR *alg;
 715         ASN1_BIT_STRING *pubkey;
 716         if (!CMS_RecipientInfo_kari_get0_orig_id(ri, &alg, &pubkey,
 717                                                  NULL, NULL, NULL))
 718             return 0;
 719         if (!alg || !pubkey)
 720             return 0;
 721         if (!ecdh_cms_set_peerkey(pctx, alg, pubkey)) {
 722             ECerr(EC_F_ECDH_CMS_DECRYPT, EC_R_PEER_KEY_ERROR);
 723             return 0;
 724         }
 725     }
 726     /* Set ECDH derivation parameters and initialise unwrap context */
 727     if (!ecdh_cms_set_shared_info(pctx, ri)) {
 728         ECerr(EC_F_ECDH_CMS_DECRYPT, EC_R_SHARED_INFO_ERROR);
 729         return 0;
 730     }
 731     return 1;
 732 }
 733
 734 static int ecdh_cms_encrypt(CMS_RecipientInfo *ri)
 735 {
 736     EVP_PKEY_CTX *pctx;
 737     EVP_PKEY *pkey;
 738     EVP_CIPHER_CTX *ctx;
 739     int keylen;
 740     X509_ALGOR *talg, *wrap_alg = NULL;
 741     ASN1_OBJECT *aoid;
 742     ASN1_BIT_STRING *pubkey;
 743     ASN1_STRING *wrap_str;
 744     ASN1_OCTET_STRING *ukm;
 745     unsigned char *penc = NULL;
 746     int penclen;
 747     int rv = 0;
 748     int ecdh_nid, kdf_type, kdf_nid, wrap_nid;
 749     const EVP_MD *kdf_md;
 750     pctx = CMS_RecipientInfo_get0_pkey_ctx(ri);
 751     if (!pctx)
 752         return 0;
 753     /* Get ephemeral key */
 754     pkey = EVP_PKEY_CTX_get0_pkey(pctx);
 755     if (!CMS_RecipientInfo_kari_get0_orig_id(ri, &talg, &pubkey,
 756                                              NULL, NULL, NULL))
 757         goto err;
 758     X509_ALGOR_get0(&aoid, NULL, NULL, talg);
 759     /* Is everything uninitialised? */
 760     if (aoid == OBJ_nid2obj(NID_undef)) {
 761
 762         EC_KEY *eckey = pkey->pkey.ec;
 763         /* Set the key */
 764         unsigned char *p;
 765
 766         penclen = i2o_ECPublicKey(eckey, NULL);
 767         if (penclen <= 0)
 768             goto err;
 769         penc = OPENSSL_malloc(penclen);
 770         if (penc == NULL)
 771             goto err;
 772         p = penc;
 773         penclen = i2o_ECPublicKey(eckey, &p);
 774         if (penclen <= 0)
 775             goto err;
 776         ASN1_STRING_set0(pubkey, penc, penclen);
 777         pubkey->flags &= ~(ASN1_STRING_FLAG_BITS_LEFT | 0x07);
 778         pubkey->flags |= ASN1_STRING_FLAG_BITS_LEFT;
 779
 780         penc = NULL;
 781         X509_ALGOR_set0(talg, OBJ_nid2obj(NID_X9_62_id_ecPublicKey),
 782                         V_ASN1_UNDEF, NULL);
 783     }
 784
 785     /* See if custom parameters set */
 786     kdf_type = EVP_PKEY_CTX_get_ecdh_kdf_type(pctx);
 787     if (kdf_type <= 0)
 788         goto err;
 789     if (!EVP_PKEY_CTX_get_ecdh_kdf_md(pctx, &kdf_md))
 790         goto err;
 791     ecdh_nid = EVP_PKEY_CTX_get_ecdh_cofactor_mode(pctx);
 792     if (ecdh_nid < 0)
 793         goto err;
 794     else if (ecdh_nid == 0)
 795         ecdh_nid = NID_dh_std_kdf;
 796     else if (ecdh_nid == 1)
 797         ecdh_nid = NID_dh_cofactor_kdf;
 798
 799     if (kdf_type == EVP_PKEY_ECDH_KDF_NONE) {
 800         kdf_type = EVP_PKEY_ECDH_KDF_X9_62;
 801         if (EVP_PKEY_CTX_set_ecdh_kdf_type(pctx, kdf_type) <= 0)
 802             goto err;
 803     } else
 804         /* Unknown KDF */
 805         goto err;
 806     if (kdf_md == NULL) {
 807         /* Fixme later for better MD */
 808         kdf_md = EVP_sha1();
 809         if (EVP_PKEY_CTX_set_ecdh_kdf_md(pctx, kdf_md) <= 0)
 810             goto err;
 811     }
 812
 813     if (!CMS_RecipientInfo_kari_get0_alg(ri, &talg, &ukm))
 814         goto err;
 815
 816     /* Lookup NID for KDF+cofactor+digest */
 817
 818     if (!OBJ_find_sigid_by_algs(&kdf_nid, EVP_MD_type(kdf_md), ecdh_nid))
 819         goto err;
 820     /* Get wrap NID */
 821     ctx = CMS_RecipientInfo_kari_get0_ctx(ri);
 822     wrap_nid = EVP_CIPHER_CTX_type(ctx);
 823     keylen = EVP_CIPHER_CTX_key_length(ctx);
 824
 825     /* Package wrap algorithm in an AlgorithmIdentifier */
 826
 827     wrap_alg = X509_ALGOR_new();
 828     if (wrap_alg == NULL)
 829         goto err;
 830     wrap_alg->algorithm = OBJ_nid2obj(wrap_nid);
 831     wrap_alg->parameter = ASN1_TYPE_new();
 832     if (wrap_alg->parameter == NULL)
 833         goto err;
 834     if (EVP_CIPHER_param_to_asn1(ctx, wrap_alg->parameter) <= 0)
 835         goto err;
 836     if (ASN1_TYPE_get(wrap_alg->parameter) == NID_undef) {
 837         ASN1_TYPE_free(wrap_alg->parameter);
 838         wrap_alg->parameter = NULL;
 839     }
 840
 841     if (EVP_PKEY_CTX_set_ecdh_kdf_outlen(pctx, keylen) <= 0)
 842         goto err;
 843
 844     penclen = CMS_SharedInfo_encode(&penc, wrap_alg, ukm, keylen);
 845
 846     if (!penclen)
 847         goto err;
 848
 849     if (EVP_PKEY_CTX_set0_ecdh_kdf_ukm(pctx, penc, penclen) <= 0)
 850         goto err;
 851     penc = NULL;
 852
 853     /*
 854      * Now need to wrap encoding of wrap AlgorithmIdentifier into parameter
 855      * of another AlgorithmIdentifier.
 856      */
 857     penclen = i2d_X509_ALGOR(wrap_alg, &penc);
 858     if (!penc || !penclen)
 859         goto err;
 860     wrap_str = ASN1_STRING_new();
 861     if (wrap_str == NULL)
 862         goto err;
 863     ASN1_STRING_set0(wrap_str, penc, penclen);
 864     penc = NULL;
 865     X509_ALGOR_set0(talg, OBJ_nid2obj(kdf_nid), V_ASN1_SEQUENCE, wrap_str);
 866
 867     rv = 1;
 868
 869  err:
 870     OPENSSL_free(penc);
 871     X509_ALGOR_free(wrap_alg);
 872     return rv;
 873 }
 874
 875 #endif