crypto/ec/ec_ameth.c

   1 /*
   2  * Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the OpenSSL license (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include <stdio.h>
  11 #include "internal/cryptlib.h"
  12 #include <openssl/x509.h>
  13 #include <openssl/ec.h>
  14 #include <openssl/bn.h>
  15 #include <openssl/cms.h>
  16 #include <openssl/asn1t.h>
  17 #include "internal/asn1_int.h"
  18 #include "internal/evp_int.h"
  19 #include "ec_lcl.h"
  20
  21 #ifndef OPENSSL_NO_CMS
  22 static int ecdh_cms_decrypt(CMS_RecipientInfo *ri);
  23 static int ecdh_cms_encrypt(CMS_RecipientInfo *ri);
  24 #endif
  25
  26 static int eckey_param2type(int *pptype, void **ppval, EC_KEY *ec_key)
  27 {
  28     const EC_GROUP *group;
  29     int nid;
  30     if (ec_key == NULL || (group = EC_KEY_get0_group(ec_key)) == NULL) {
  31         ECerr(EC_F_ECKEY_PARAM2TYPE, EC_R_MISSING_PARAMETERS);
  32         return 0;
  33     }
  34     if (EC_GROUP_get_asn1_flag(group)
  35         && (nid = EC_GROUP_get_curve_name(group)))
  36         /* we have a 'named curve' => just set the OID */
  37     {
  38         *ppval = OBJ_nid2obj(nid);
  39         *pptype = V_ASN1_OBJECT;
  40     } else {                    /* explicit parameters */
  41
  42         ASN1_STRING *pstr = NULL;
  43         pstr = ASN1_STRING_new();
  44         if (pstr == NULL)
  45             return 0;
  46         pstr->length = i2d_ECParameters(ec_key, &pstr->data);
  47         if (pstr->length <= 0) {
  48             ASN1_STRING_free(pstr);
  49             ECerr(EC_F_ECKEY_PARAM2TYPE, ERR_R_EC_LIB);
  50             return 0;
  51         }
  52         *ppval = pstr;
  53         *pptype = V_ASN1_SEQUENCE;
  54     }
  55     return 1;
  56 }
  57
  58 static int eckey_pub_encode(X509_PUBKEY *pk, const EVP_PKEY *pkey)
  59 {
  60     EC_KEY *ec_key = pkey->pkey.ec;
  61     void *pval = NULL;
  62     int ptype;
  63     unsigned char *penc = NULL, *p;
  64     int penclen;
  65
  66     if (!eckey_param2type(&ptype, &pval, ec_key)) {
  67         ECerr(EC_F_ECKEY_PUB_ENCODE, ERR_R_EC_LIB);
  68         return 0;
  69     }
  70     penclen = i2o_ECPublicKey(ec_key, NULL);
  71     if (penclen <= 0)
  72         goto err;
  73     penc = OPENSSL_malloc(penclen);
  74     if (penc == NULL)
  75         goto err;
  76     p = penc;
  77     penclen = i2o_ECPublicKey(ec_key, &p);
  78     if (penclen <= 0)
  79         goto err;
  80     if (X509_PUBKEY_set0_param(pk, OBJ_nid2obj(EVP_PKEY_EC),
  81                                ptype, pval, penc, penclen))
  82         return 1;
  83  err:
  84     if (ptype == V_ASN1_OBJECT)
  85         ASN1_OBJECT_free(pval);
  86     else
  87         ASN1_STRING_free(pval);
  88     OPENSSL_free(penc);
  89     return 0;
  90 }
  91
  92 static EC_KEY *eckey_type2param(int ptype, void *pval)
  93 {
  94     EC_KEY *eckey = NULL;
  95     if (ptype == V_ASN1_SEQUENCE) {
  96         ASN1_STRING *pstr = pval;
  97         const unsigned char *pm = NULL;
  98         int pmlen;
  99         pm = pstr->data;
 100         pmlen = pstr->length;
 101         if ((eckey = d2i_ECParameters(NULL, &pm, pmlen)) == NULL) {
 102             ECerr(EC_F_ECKEY_TYPE2PARAM, EC_R_DECODE_ERROR);
 103             goto ecerr;
 104         }
 105     } else if (ptype == V_ASN1_OBJECT) {
 106         ASN1_OBJECT *poid = pval;
 107         EC_GROUP *group;
 108
 109         /*
 110          * type == V_ASN1_OBJECT => the parameters are given by an asn1 OID
 111          */
 112         if ((eckey = EC_KEY_new()) == NULL) {
 113             ECerr(EC_F_ECKEY_TYPE2PARAM, ERR_R_MALLOC_FAILURE);
 114             goto ecerr;
 115         }
 116         group = EC_GROUP_new_by_curve_name(OBJ_obj2nid(poid));
 117         if (group == NULL)
 118             goto ecerr;
 119         EC_GROUP_set_asn1_flag(group, OPENSSL_EC_NAMED_CURVE);
 120         if (EC_KEY_set_group(eckey, group) == 0)
 121             goto ecerr;
 122         EC_GROUP_free(group);
 123     } else {
 124         ECerr(EC_F_ECKEY_TYPE2PARAM, EC_R_DECODE_ERROR);
 125         goto ecerr;
 126     }
 127
 128     return eckey;
 129
 130  ecerr:
 131     EC_KEY_free(eckey);
 132     return NULL;
 133 }
 134
 135 static int eckey_pub_decode(EVP_PKEY *pkey, X509_PUBKEY *pubkey)
 136 {
 137     const unsigned char *p = NULL;
 138     void *pval;
 139     int ptype, pklen;
 140     EC_KEY *eckey = NULL;
 141     X509_ALGOR *palg;
 142
 143     if (!X509_PUBKEY_get0_param(NULL, &p, &pklen, &palg, pubkey))
 144         return 0;
 145     X509_ALGOR_get0(NULL, &ptype, &pval, palg);
 146
 147     eckey = eckey_type2param(ptype, pval);
 148
 149     if (!eckey) {
 150         ECerr(EC_F_ECKEY_PUB_DECODE, ERR_R_EC_LIB);
 151         return 0;
 152     }
 153
 154     /* We have parameters now set public key */
 155     if (!o2i_ECPublicKey(&eckey, &p, pklen)) {
 156         ECerr(EC_F_ECKEY_PUB_DECODE, EC_R_DECODE_ERROR);
 157         goto ecerr;
 158     }
 159
 160     EVP_PKEY_assign_EC_KEY(pkey, eckey);
 161     return 1;
 162
 163  ecerr:
 164     EC_KEY_free(eckey);
 165     return 0;
 166 }
 167
 168 static int eckey_pub_cmp(const EVP_PKEY *a, const EVP_PKEY *b)
 169 {
 170     int r;
 171     const EC_GROUP *group = EC_KEY_get0_group(b->pkey.ec);
 172     const EC_POINT *pa = EC_KEY_get0_public_key(a->pkey.ec),
 173         *pb = EC_KEY_get0_public_key(b->pkey.ec);
 174     r = EC_POINT_cmp(group, pa, pb, NULL);
 175     if (r == 0)
 176         return 1;
 177     if (r == 1)
 178         return 0;
 179     return -2;
 180 }
 181
 182 static int eckey_priv_decode(EVP_PKEY *pkey, PKCS8_PRIV_KEY_INFO *p8)
 183 {
 184     const unsigned char *p = NULL;
 185     void *pval;
 186     int ptype, pklen;
 187     EC_KEY *eckey = NULL;
 188     X509_ALGOR *palg;
 189
 190     if (!PKCS8_pkey_get0(NULL, &p, &pklen, &palg, p8))
 191         return 0;
 192     X509_ALGOR_get0(NULL, &ptype, &pval, palg);
 193
 194     eckey = eckey_type2param(ptype, pval);
 195
 196     if (!eckey)
 197         goto ecliberr;
 198
 199     /* We have parameters now set private key */
 200     if (!d2i_ECPrivateKey(&eckey, &p, pklen)) {
 201         ECerr(EC_F_ECKEY_PRIV_DECODE, EC_R_DECODE_ERROR);
 202         goto ecerr;
 203     }
 204
 205     EVP_PKEY_assign_EC_KEY(pkey, eckey);
 206     return 1;
 207
 208  ecliberr:
 209     ECerr(EC_F_ECKEY_PRIV_DECODE, ERR_R_EC_LIB);
 210  ecerr:
 211     EC_KEY_free(eckey);
 212     return 0;
 213 }
 214
 215 static int eckey_priv_encode(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pkey)
 216 {
 217     EC_KEY ec_key = *(pkey->pkey.ec);
 218     unsigned char *ep, *p;
 219     int eplen, ptype;
 220     void *pval;
 221     unsigned int old_flags;
 222
 223     if (!eckey_param2type(&ptype, &pval, &ec_key)) {
 224         ECerr(EC_F_ECKEY_PRIV_ENCODE, EC_R_DECODE_ERROR);
 225         return 0;
 226     }
 227
 228     /* set the private key */
 229
 230     /*
 231      * do not include the parameters in the SEC1 private key see PKCS#11
 232      * 12.11
 233      */
 234     old_flags = EC_KEY_get_enc_flags(&ec_key);
 235     EC_KEY_set_enc_flags(&ec_key, old_flags | EC_PKEY_NO_PARAMETERS);
 236
 237     eplen = i2d_ECPrivateKey(&ec_key, NULL);
 238     if (!eplen) {
 239         ECerr(EC_F_ECKEY_PRIV_ENCODE, ERR_R_EC_LIB);
 240         return 0;
 241     }
 242     ep = OPENSSL_malloc(eplen);
 243     if (ep == NULL) {
 244         ECerr(EC_F_ECKEY_PRIV_ENCODE, ERR_R_MALLOC_FAILURE);
 245         return 0;
 246     }
 247     p = ep;
 248     if (!i2d_ECPrivateKey(&ec_key, &p)) {
 249         OPENSSL_free(ep);
 250         ECerr(EC_F_ECKEY_PRIV_ENCODE, ERR_R_EC_LIB);
 251         return 0;
 252     }
 253
 254     if (!PKCS8_pkey_set0(p8, OBJ_nid2obj(NID_X9_62_id_ecPublicKey), 0,
 255                          ptype, pval, ep, eplen))
 256         return 0;
 257
 258     return 1;
 259 }
 260
 261 static int int_ec_size(const EVP_PKEY *pkey)
 262 {
 263     return ECDSA_size(pkey->pkey.ec);
 264 }
 265
 266 static int ec_bits(const EVP_PKEY *pkey)
 267 {
 268     return EC_GROUP_order_bits(EC_KEY_get0_group(pkey->pkey.ec));
 269 }
 270
 271 static int ec_security_bits(const EVP_PKEY *pkey)
 272 {
 273     int ecbits = ec_bits(pkey);
 274     if (ecbits >= 512)
 275         return 256;
 276     if (ecbits >= 384)
 277         return 192;
 278     if (ecbits >= 256)
 279         return 128;
 280     if (ecbits >= 224)
 281         return 112;
 282     if (ecbits >= 160)
 283         return 80;
 284     return ecbits / 2;
 285 }
 286
 287 static int ec_missing_parameters(const EVP_PKEY *pkey)
 288 {
 289     if (pkey->pkey.ec == NULL || EC_KEY_get0_group(pkey->pkey.ec) == NULL)
 290         return 1;
 291     return 0;
 292 }
 293
 294 static int ec_copy_parameters(EVP_PKEY *to, const EVP_PKEY *from)
 295 {
 296     EC_GROUP *group = EC_GROUP_dup(EC_KEY_get0_group(from->pkey.ec));
 297     if (group == NULL)
 298         return 0;
 299     if (to->pkey.ec == NULL) {
 300         to->pkey.ec = EC_KEY_new();
 301         if (to->pkey.ec == NULL)
 302             return 0;
 303     }
 304     if (EC_KEY_set_group(to->pkey.ec, group) == 0)
 305         return 0;
 306     EC_GROUP_free(group);
 307     return 1;
 308 }
 309
 310 static int ec_cmp_parameters(const EVP_PKEY *a, const EVP_PKEY *b)
 311 {
 312     const EC_GROUP *group_a = EC_KEY_get0_group(a->pkey.ec),
 313         *group_b = EC_KEY_get0_group(b->pkey.ec);
 314     if (EC_GROUP_cmp(group_a, group_b, NULL))
 315         return 0;
 316     else
 317         return 1;
 318 }
 319
 320 static void int_ec_free(EVP_PKEY *pkey)
 321 {
 322     EC_KEY_free(pkey->pkey.ec);
 323 }
 324
 325 typedef enum {
 326     EC_KEY_PRINT_PRIVATE,
 327     EC_KEY_PRINT_PUBLIC,
 328     EC_KEY_PRINT_PARAM
 329 } ec_print_t;
 330
 331 static int do_EC_KEY_print(BIO *bp, const EC_KEY *x, int off, ec_print_t ktype)
 332 {
 333     const char *ecstr;
 334     unsigned char *priv = NULL, *pub = NULL;
 335     size_t privlen = 0, publen = 0;
 336     int ret = 0;
 337     const EC_GROUP *group;
 338
 339     if (x == NULL || (group = EC_KEY_get0_group(x)) == NULL) {
 340         ECerr(EC_F_DO_EC_KEY_PRINT, ERR_R_PASSED_NULL_PARAMETER);
 341         return 0;
 342     }
 343
 344     if (ktype != EC_KEY_PRINT_PARAM) {
 345         publen = EC_KEY_key2buf(x, EC_KEY_get_conv_form(x), &pub, NULL);
 346         if (publen == 0)
 347             goto err;
 348     }
 349
 350     if (ktype == EC_KEY_PRINT_PRIVATE && EC_KEY_get0_private_key(x) != NULL) {
 351         privlen = EC_KEY_priv2buf(x, &priv);
 352         if (privlen == 0)
 353             goto err;
 354     }
 355
 356     if (ktype == EC_KEY_PRINT_PRIVATE)
 357         ecstr = "Private-Key";
 358     else if (ktype == EC_KEY_PRINT_PUBLIC)
 359         ecstr = "Public-Key";
 360     else
 361         ecstr = "ECDSA-Parameters";
 362
 363     if (!BIO_indent(bp, off, 128))
 364         goto err;
 365     if (BIO_printf(bp, "%s: (%d bit)\n", ecstr,
 366                    EC_GROUP_order_bits(group)) <= 0)
 367         goto err;
 368
 369     if (privlen != 0) {
 370         if (BIO_printf(bp, "%*spriv:\n", off, "") <= 0)
 371             goto err;
 372         if (ASN1_buf_print(bp, priv, privlen, off + 4) == 0)
 373             goto err;
 374     }
 375
 376     if (publen != 0) {
 377         if (BIO_printf(bp, "%*spub:\n", off, "") <= 0)
 378             goto err;
 379         if (ASN1_buf_print(bp, pub, publen, off + 4) == 0)
 380             goto err;
 381     }
 382
 383     if (!ECPKParameters_print(bp, group, off))
 384         goto err;
 385     ret = 1;
 386  err:
 387     if (!ret)
 388         ECerr(EC_F_DO_EC_KEY_PRINT, ERR_R_EC_LIB);
 389     OPENSSL_clear_free(priv, privlen);
 390     OPENSSL_free(pub);
 391     return ret;
 392 }
 393
 394 static int eckey_param_decode(EVP_PKEY *pkey,
 395                               const unsigned char **pder, int derlen)
 396 {
 397     EC_KEY *eckey;
 398
 399     if ((eckey = d2i_ECParameters(NULL, pder, derlen)) == NULL) {
 400         ECerr(EC_F_ECKEY_PARAM_DECODE, ERR_R_EC_LIB);
 401         return 0;
 402     }
 403     EVP_PKEY_assign_EC_KEY(pkey, eckey);
 404     return 1;
 405 }
 406
 407 static int eckey_param_encode(const EVP_PKEY *pkey, unsigned char **pder)
 408 {
 409     return i2d_ECParameters(pkey->pkey.ec, pder);
 410 }
 411
 412 static int eckey_param_print(BIO *bp, const EVP_PKEY *pkey, int indent,
 413                              ASN1_PCTX *ctx)
 414 {
 415     return do_EC_KEY_print(bp, pkey->pkey.ec, indent, EC_KEY_PRINT_PARAM);
 416 }
 417
 418 static int eckey_pub_print(BIO *bp, const EVP_PKEY *pkey, int indent,
 419                            ASN1_PCTX *ctx)
 420 {
 421     return do_EC_KEY_print(bp, pkey->pkey.ec, indent, EC_KEY_PRINT_PUBLIC);
 422 }
 423
 424 static int eckey_priv_print(BIO *bp, const EVP_PKEY *pkey, int indent,
 425                             ASN1_PCTX *ctx)
 426 {
 427     return do_EC_KEY_print(bp, pkey->pkey.ec, indent, EC_KEY_PRINT_PRIVATE);
 428 }
 429
 430 static int old_ec_priv_decode(EVP_PKEY *pkey,
 431                               const unsigned char **pder, int derlen)
 432 {
 433     EC_KEY *ec;
 434
 435     if ((ec = d2i_ECPrivateKey(NULL, pder, derlen)) == NULL) {
 436         ECerr(EC_F_OLD_EC_PRIV_DECODE, EC_R_DECODE_ERROR);
 437         return 0;
 438     }
 439     EVP_PKEY_assign_EC_KEY(pkey, ec);
 440     return 1;
 441 }
 442
 443 static int old_ec_priv_encode(const EVP_PKEY *pkey, unsigned char **pder)
 444 {
 445     return i2d_ECPrivateKey(pkey->pkey.ec, pder);
 446 }
 447
 448 static int ec_pkey_ctrl(EVP_PKEY *pkey, int op, long arg1, void *arg2)
 449 {
 450     switch (op) {
 451     case ASN1_PKEY_CTRL_PKCS7_SIGN:
 452         if (arg1 == 0) {
 453             int snid, hnid;
 454             X509_ALGOR *alg1, *alg2;
 455             PKCS7_SIGNER_INFO_get0_algs(arg2, NULL, &alg1, &alg2);
 456             if (alg1 == NULL || alg1->algorithm == NULL)
 457                 return -1;
 458             hnid = OBJ_obj2nid(alg1->algorithm);
 459             if (hnid == NID_undef)
 460                 return -1;
 461             if (!OBJ_find_sigid_by_algs(&snid, hnid, EVP_PKEY_id(pkey)))
 462                 return -1;
 463             X509_ALGOR_set0(alg2, OBJ_nid2obj(snid), V_ASN1_UNDEF, 0);
 464         }
 465         return 1;
 466 #ifndef OPENSSL_NO_CMS
 467     case ASN1_PKEY_CTRL_CMS_SIGN:
 468         if (arg1 == 0) {
 469             int snid, hnid;
 470             X509_ALGOR *alg1, *alg2;
 471             CMS_SignerInfo_get0_algs(arg2, NULL, NULL, &alg1, &alg2);
 472             if (alg1 == NULL || alg1->algorithm == NULL)
 473                 return -1;
 474             hnid = OBJ_obj2nid(alg1->algorithm);
 475             if (hnid == NID_undef)
 476                 return -1;
 477             if (!OBJ_find_sigid_by_algs(&snid, hnid, EVP_PKEY_id(pkey)))
 478                 return -1;
 479             X509_ALGOR_set0(alg2, OBJ_nid2obj(snid), V_ASN1_UNDEF, 0);
 480         }
 481         return 1;
 482
 483     case ASN1_PKEY_CTRL_CMS_ENVELOPE:
 484         if (arg1 == 1)
 485             return ecdh_cms_decrypt(arg2);
 486         else if (arg1 == 0)
 487             return ecdh_cms_encrypt(arg2);
 488         return -2;
 489
 490     case ASN1_PKEY_CTRL_CMS_RI_TYPE:
 491         *(int *)arg2 = CMS_RECIPINFO_AGREE;
 492         return 1;
 493 #endif
 494
 495     case ASN1_PKEY_CTRL_DEFAULT_MD_NID:
 496         *(int *)arg2 = NID_sha256;
 497         return 2;
 498
 499     default:
 500         return -2;
 501
 502     }
 503
 504 }
 505
 506 const EVP_PKEY_ASN1_METHOD eckey_asn1_meth = {
 507     EVP_PKEY_EC,
 508     EVP_PKEY_EC,
 509     0,
 510     "EC",
 511     "OpenSSL EC algorithm",
 512
 513     eckey_pub_decode,
 514     eckey_pub_encode,
 515     eckey_pub_cmp,
 516     eckey_pub_print,
 517
 518     eckey_priv_decode,
 519     eckey_priv_encode,
 520     eckey_priv_print,
 521
 522     int_ec_size,
 523     ec_bits,
 524     ec_security_bits,
 525
 526     eckey_param_decode,
 527     eckey_param_encode,
 528     ec_missing_parameters,
 529     ec_copy_parameters,
 530     ec_cmp_parameters,
 531     eckey_param_print,
 532     0,
 533
 534     int_ec_free,
 535     ec_pkey_ctrl,
 536     old_ec_priv_decode,
 537     old_ec_priv_encode
 538 };
 539
 540 int EC_KEY_print(BIO *bp, const EC_KEY *x, int off)
 541 {
 542     int private = EC_KEY_get0_private_key(x) != NULL;
 543
 544     return do_EC_KEY_print(bp, x, off,
 545                 private ? EC_KEY_PRINT_PRIVATE : EC_KEY_PRINT_PUBLIC);
 546 }
 547
 548 int ECParameters_print(BIO *bp, const EC_KEY *x)
 549 {
 550     return do_EC_KEY_print(bp, x, 4, EC_KEY_PRINT_PARAM);
 551 }
 552
 553 #ifndef OPENSSL_NO_CMS
 554
 555 static int ecdh_cms_set_peerkey(EVP_PKEY_CTX *pctx,
 556                                 X509_ALGOR *alg, ASN1_BIT_STRING *pubkey)
 557 {
 558     ASN1_OBJECT *aoid;
 559     int atype;
 560     void *aval;
 561     int rv = 0;
 562     EVP_PKEY *pkpeer = NULL;
 563     EC_KEY *ecpeer = NULL;
 564     const unsigned char *p;
 565     int plen;
 566     X509_ALGOR_get0(&aoid, &atype, &aval, alg);
 567     if (OBJ_obj2nid(aoid) != NID_X9_62_id_ecPublicKey)
 568         goto err;
 569     /* If absent parameters get group from main key */
 570     if (atype == V_ASN1_UNDEF || atype == V_ASN1_NULL) {
 571         const EC_GROUP *grp;
 572         EVP_PKEY *pk;
 573         pk = EVP_PKEY_CTX_get0_pkey(pctx);
 574         if (!pk)
 575             goto err;
 576         grp = EC_KEY_get0_group(pk->pkey.ec);
 577         ecpeer = EC_KEY_new();
 578         if (ecpeer == NULL)
 579             goto err;
 580         if (!EC_KEY_set_group(ecpeer, grp))
 581             goto err;
 582     } else {
 583         ecpeer = eckey_type2param(atype, aval);
 584         if (!ecpeer)
 585             goto err;
 586     }
 587     /* We have parameters now set public key */
 588     plen = ASN1_STRING_length(pubkey);
 589     p = ASN1_STRING_data(pubkey);
 590     if (!p || !plen)
 591         goto err;
 592     if (!o2i_ECPublicKey(&ecpeer, &p, plen))
 593         goto err;
 594     pkpeer = EVP_PKEY_new();
 595     if (pkpeer == NULL)
 596         goto err;
 597     EVP_PKEY_set1_EC_KEY(pkpeer, ecpeer);
 598     if (EVP_PKEY_derive_set_peer(pctx, pkpeer) > 0)
 599         rv = 1;
 600  err:
 601     EC_KEY_free(ecpeer);
 602     EVP_PKEY_free(pkpeer);
 603     return rv;
 604 }
 605
 606 /* Set KDF parameters based on KDF NID */
 607 static int ecdh_cms_set_kdf_param(EVP_PKEY_CTX *pctx, int eckdf_nid)
 608 {
 609     int kdf_nid, kdfmd_nid, cofactor;
 610     const EVP_MD *kdf_md;
 611     if (eckdf_nid == NID_undef)
 612         return 0;
 613
 614     /* Lookup KDF type, cofactor mode and digest */
 615     if (!OBJ_find_sigid_algs(eckdf_nid, &kdfmd_nid, &kdf_nid))
 616         return 0;
 617
 618     if (kdf_nid == NID_dh_std_kdf)
 619         cofactor = 0;
 620     else if (kdf_nid == NID_dh_cofactor_kdf)
 621         cofactor = 1;
 622     else
 623         return 0;
 624
 625     if (EVP_PKEY_CTX_set_ecdh_cofactor_mode(pctx, cofactor) <= 0)
 626         return 0;
 627
 628     if (EVP_PKEY_CTX_set_ecdh_kdf_type(pctx, EVP_PKEY_ECDH_KDF_X9_62) <= 0)
 629         return 0;
 630
 631     kdf_md = EVP_get_digestbynid(kdfmd_nid);
 632     if (!kdf_md)
 633         return 0;
 634
 635     if (EVP_PKEY_CTX_set_ecdh_kdf_md(pctx, kdf_md) <= 0)
 636         return 0;
 637     return 1;
 638 }
 639
 640 static int ecdh_cms_set_shared_info(EVP_PKEY_CTX *pctx, CMS_RecipientInfo *ri)
 641 {
 642     int rv = 0;
 643
 644     X509_ALGOR *alg, *kekalg = NULL;
 645     ASN1_OCTET_STRING *ukm;
 646     const unsigned char *p;
 647     unsigned char *der = NULL;
 648     int plen, keylen;
 649     const EVP_CIPHER *kekcipher;
 650     EVP_CIPHER_CTX *kekctx;
 651
 652     if (!CMS_RecipientInfo_kari_get0_alg(ri, &alg, &ukm))
 653         return 0;
 654
 655     if (!ecdh_cms_set_kdf_param(pctx, OBJ_obj2nid(alg->algorithm))) {
 656         ECerr(EC_F_ECDH_CMS_SET_SHARED_INFO, EC_R_KDF_PARAMETER_ERROR);
 657         return 0;
 658     }
 659
 660     if (alg->parameter->type != V_ASN1_SEQUENCE)
 661         return 0;
 662
 663     p = alg->parameter->value.sequence->data;
 664     plen = alg->parameter->value.sequence->length;
 665     kekalg = d2i_X509_ALGOR(NULL, &p, plen);
 666     if (!kekalg)
 667         goto err;
 668     kekctx = CMS_RecipientInfo_kari_get0_ctx(ri);
 669     if (!kekctx)
 670         goto err;
 671     kekcipher = EVP_get_cipherbyobj(kekalg->algorithm);
 672     if (!kekcipher || EVP_CIPHER_mode(kekcipher) != EVP_CIPH_WRAP_MODE)
 673         goto err;
 674     if (!EVP_EncryptInit_ex(kekctx, kekcipher, NULL, NULL, NULL))
 675         goto err;
 676     if (EVP_CIPHER_asn1_to_param(kekctx, kekalg->parameter) <= 0)
 677         goto err;
 678
 679     keylen = EVP_CIPHER_CTX_key_length(kekctx);
 680     if (EVP_PKEY_CTX_set_ecdh_kdf_outlen(pctx, keylen) <= 0)
 681         goto err;
 682
 683     plen = CMS_SharedInfo_encode(&der, kekalg, ukm, keylen);
 684
 685     if (!plen)
 686         goto err;
 687
 688     if (EVP_PKEY_CTX_set0_ecdh_kdf_ukm(pctx, der, plen) <= 0)
 689         goto err;
 690     der = NULL;
 691
 692     rv = 1;
 693  err:
 694     X509_ALGOR_free(kekalg);
 695     OPENSSL_free(der);
 696     return rv;
 697 }
 698
 699 static int ecdh_cms_decrypt(CMS_RecipientInfo *ri)
 700 {
 701     EVP_PKEY_CTX *pctx;
 702     pctx = CMS_RecipientInfo_get0_pkey_ctx(ri);
 703     if (!pctx)
 704         return 0;
 705     /* See if we need to set peer key */
 706     if (!EVP_PKEY_CTX_get0_peerkey(pctx)) {
 707         X509_ALGOR *alg;
 708         ASN1_BIT_STRING *pubkey;
 709         if (!CMS_RecipientInfo_kari_get0_orig_id(ri, &alg, &pubkey,
 710                                                  NULL, NULL, NULL))
 711             return 0;
 712         if (!alg || !pubkey)
 713             return 0;
 714         if (!ecdh_cms_set_peerkey(pctx, alg, pubkey)) {
 715             ECerr(EC_F_ECDH_CMS_DECRYPT, EC_R_PEER_KEY_ERROR);
 716             return 0;
 717         }
 718     }
 719     /* Set ECDH derivation parameters and initialise unwrap context */
 720     if (!ecdh_cms_set_shared_info(pctx, ri)) {
 721         ECerr(EC_F_ECDH_CMS_DECRYPT, EC_R_SHARED_INFO_ERROR);
 722         return 0;
 723     }
 724     return 1;
 725 }
 726
 727 static int ecdh_cms_encrypt(CMS_RecipientInfo *ri)
 728 {
 729     EVP_PKEY_CTX *pctx;
 730     EVP_PKEY *pkey;
 731     EVP_CIPHER_CTX *ctx;
 732     int keylen;
 733     X509_ALGOR *talg, *wrap_alg = NULL;
 734     ASN1_OBJECT *aoid;
 735     ASN1_BIT_STRING *pubkey;
 736     ASN1_STRING *wrap_str;
 737     ASN1_OCTET_STRING *ukm;
 738     unsigned char *penc = NULL;
 739     int penclen;
 740     int rv = 0;
 741     int ecdh_nid, kdf_type, kdf_nid, wrap_nid;
 742     const EVP_MD *kdf_md;
 743     pctx = CMS_RecipientInfo_get0_pkey_ctx(ri);
 744     if (!pctx)
 745         return 0;
 746     /* Get ephemeral key */
 747     pkey = EVP_PKEY_CTX_get0_pkey(pctx);
 748     if (!CMS_RecipientInfo_kari_get0_orig_id(ri, &talg, &pubkey,
 749                                              NULL, NULL, NULL))
 750         goto err;
 751     X509_ALGOR_get0(&aoid, NULL, NULL, talg);
 752     /* Is everything uninitialised? */
 753     if (aoid == OBJ_nid2obj(NID_undef)) {
 754
 755         EC_KEY *eckey = pkey->pkey.ec;
 756         /* Set the key */
 757         unsigned char *p;
 758
 759         penclen = i2o_ECPublicKey(eckey, NULL);
 760         if (penclen <= 0)
 761             goto err;
 762         penc = OPENSSL_malloc(penclen);
 763         if (penc == NULL)
 764             goto err;
 765         p = penc;
 766         penclen = i2o_ECPublicKey(eckey, &p);
 767         if (penclen <= 0)
 768             goto err;
 769         ASN1_STRING_set0(pubkey, penc, penclen);
 770         pubkey->flags &= ~(ASN1_STRING_FLAG_BITS_LEFT | 0x07);
 771         pubkey->flags |= ASN1_STRING_FLAG_BITS_LEFT;
 772
 773         penc = NULL;
 774         X509_ALGOR_set0(talg, OBJ_nid2obj(NID_X9_62_id_ecPublicKey),
 775                         V_ASN1_UNDEF, NULL);
 776     }
 777
 778     /* See if custom parameters set */
 779     kdf_type = EVP_PKEY_CTX_get_ecdh_kdf_type(pctx);
 780     if (kdf_type <= 0)
 781         goto err;
 782     if (!EVP_PKEY_CTX_get_ecdh_kdf_md(pctx, &kdf_md))
 783         goto err;
 784     ecdh_nid = EVP_PKEY_CTX_get_ecdh_cofactor_mode(pctx);
 785     if (ecdh_nid < 0)
 786         goto err;
 787     else if (ecdh_nid == 0)
 788         ecdh_nid = NID_dh_std_kdf;
 789     else if (ecdh_nid == 1)
 790         ecdh_nid = NID_dh_cofactor_kdf;
 791
 792     if (kdf_type == EVP_PKEY_ECDH_KDF_NONE) {
 793         kdf_type = EVP_PKEY_ECDH_KDF_X9_62;
 794         if (EVP_PKEY_CTX_set_ecdh_kdf_type(pctx, kdf_type) <= 0)
 795             goto err;
 796     } else
 797         /* Unknown KDF */
 798         goto err;
 799     if (kdf_md == NULL) {
 800         /* Fixme later for better MD */
 801         kdf_md = EVP_sha1();
 802         if (EVP_PKEY_CTX_set_ecdh_kdf_md(pctx, kdf_md) <= 0)
 803             goto err;
 804     }
 805
 806     if (!CMS_RecipientInfo_kari_get0_alg(ri, &talg, &ukm))
 807         goto err;
 808
 809     /* Lookup NID for KDF+cofactor+digest */
 810
 811     if (!OBJ_find_sigid_by_algs(&kdf_nid, EVP_MD_type(kdf_md), ecdh_nid))
 812         goto err;
 813     /* Get wrap NID */
 814     ctx = CMS_RecipientInfo_kari_get0_ctx(ri);
 815     wrap_nid = EVP_CIPHER_CTX_type(ctx);
 816     keylen = EVP_CIPHER_CTX_key_length(ctx);
 817
 818     /* Package wrap algorithm in an AlgorithmIdentifier */
 819
 820     wrap_alg = X509_ALGOR_new();
 821     if (wrap_alg == NULL)
 822         goto err;
 823     wrap_alg->algorithm = OBJ_nid2obj(wrap_nid);
 824     wrap_alg->parameter = ASN1_TYPE_new();
 825     if (wrap_alg->parameter == NULL)
 826         goto err;
 827     if (EVP_CIPHER_param_to_asn1(ctx, wrap_alg->parameter) <= 0)
 828         goto err;
 829     if (ASN1_TYPE_get(wrap_alg->parameter) == NID_undef) {
 830         ASN1_TYPE_free(wrap_alg->parameter);
 831         wrap_alg->parameter = NULL;
 832     }
 833
 834     if (EVP_PKEY_CTX_set_ecdh_kdf_outlen(pctx, keylen) <= 0)
 835         goto err;
 836
 837     penclen = CMS_SharedInfo_encode(&penc, wrap_alg, ukm, keylen);
 838
 839     if (!penclen)
 840         goto err;
 841
 842     if (EVP_PKEY_CTX_set0_ecdh_kdf_ukm(pctx, penc, penclen) <= 0)
 843         goto err;
 844     penc = NULL;
 845
 846     /*
 847      * Now need to wrap encoding of wrap AlgorithmIdentifier into parameter
 848      * of another AlgorithmIdentifier.
 849      */
 850     penclen = i2d_X509_ALGOR(wrap_alg, &penc);
 851     if (!penc || !penclen)
 852         goto err;
 853     wrap_str = ASN1_STRING_new();
 854     if (wrap_str == NULL)
 855         goto err;
 856     ASN1_STRING_set0(wrap_str, penc, penclen);
 857     penc = NULL;
 858     X509_ALGOR_set0(talg, OBJ_nid2obj(kdf_nid), V_ASN1_SEQUENCE, wrap_str);
 859
 860     rv = 1;
 861
 862  err:
 863     OPENSSL_free(penc);
 864     X509_ALGOR_free(wrap_alg);
 865     return rv;
 866 }
 867
 868 #endif