crypto/cms/cms_ec.c

   1 /*
   2  * Copyright 2006-2022 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include <assert.h>
  11 #include <openssl/cms.h>
  12 #include <openssl/err.h>
  13 #include <openssl/decoder.h>
  14 #include "internal/sizes.h"
  15 #include "crypto/evp.h"
  16 #include "cms_local.h"
  17
  18 static EVP_PKEY *pkey_type2param(int ptype, const void *pval,
  19                                  OSSL_LIB_CTX *libctx, const char *propq)
  20 {
  21     EVP_PKEY *pkey = NULL;
  22     EVP_PKEY_CTX *pctx = NULL;
  23     OSSL_DECODER_CTX *ctx = NULL;
  24
  25     if (ptype == V_ASN1_SEQUENCE) {
  26         const ASN1_STRING *pstr = pval;
  27         const unsigned char *pm = pstr->data;
  28         size_t pmlen = (size_t)pstr->length;
  29         int selection = OSSL_KEYMGMT_SELECT_ALL_PARAMETERS;
  30
  31         ctx = OSSL_DECODER_CTX_new_for_pkey(&pkey, "DER", NULL, "EC",
  32                                             selection, libctx, propq);
  33         if (ctx == NULL)
  34             goto err;
  35
  36         if (!OSSL_DECODER_from_data(ctx, &pm, &pmlen)) {
  37             ERR_raise(ERR_LIB_CMS, CMS_R_DECODE_ERROR);
  38             goto err;
  39         }
  40         OSSL_DECODER_CTX_free(ctx);
  41         return pkey;
  42     } else if (ptype == V_ASN1_OBJECT) {
  43         const ASN1_OBJECT *poid = pval;
  44         char groupname[OSSL_MAX_NAME_SIZE];
  45
  46         /* type == V_ASN1_OBJECT => the parameters are given by an asn1 OID */
  47         pctx = EVP_PKEY_CTX_new_from_name(libctx, "EC", propq);
  48         if (pctx == NULL || EVP_PKEY_paramgen_init(pctx) <= 0)
  49             goto err;
  50         if (OBJ_obj2txt(groupname, sizeof(groupname), poid, 0) <= 0
  51                 || !EVP_PKEY_CTX_set_group_name(pctx, groupname)) {
  52             ERR_raise(ERR_LIB_CMS, CMS_R_DECODE_ERROR);
  53             goto err;
  54         }
  55         if (EVP_PKEY_paramgen(pctx, &pkey) <= 0)
  56             goto err;
  57         EVP_PKEY_CTX_free(pctx);
  58         return pkey;
  59     }
  60
  61     ERR_raise(ERR_LIB_CMS, CMS_R_DECODE_ERROR);
  62     return NULL;
  63
  64  err:
  65     EVP_PKEY_free(pkey);
  66     EVP_PKEY_CTX_free(pctx);
  67     OSSL_DECODER_CTX_free(ctx);
  68     return NULL;
  69 }
  70
  71 static int ecdh_cms_set_peerkey(EVP_PKEY_CTX *pctx,
  72                                 X509_ALGOR *alg, ASN1_BIT_STRING *pubkey)
  73 {
  74     const ASN1_OBJECT *aoid;
  75     int atype;
  76     const void *aval;
  77     int rv = 0;
  78     EVP_PKEY *pkpeer = NULL;
  79     const unsigned char *p;
  80     int plen;
  81
  82     X509_ALGOR_get0(&aoid, &atype, &aval, alg);
  83     if (OBJ_obj2nid(aoid) != NID_X9_62_id_ecPublicKey)
  84         goto err;
  85
  86     /* If absent parameters get group from main key */
  87     if (atype == V_ASN1_UNDEF || atype == V_ASN1_NULL) {
  88         EVP_PKEY *pk;
  89
  90         pk = EVP_PKEY_CTX_get0_pkey(pctx);
  91         if (pk == NULL)
  92             goto err;
  93
  94         pkpeer = EVP_PKEY_new();
  95         if (pkpeer == NULL)
  96             goto err;
  97         if (!EVP_PKEY_copy_parameters(pkpeer, pk))
  98             goto err;
  99     } else {
 100         pkpeer = pkey_type2param(atype, aval,
 101                                  EVP_PKEY_CTX_get0_libctx(pctx),
 102                                  EVP_PKEY_CTX_get0_propq(pctx));
 103         if (pkpeer == NULL)
 104             goto err;
 105     }
 106     /* We have parameters now set public key */
 107     plen = ASN1_STRING_length(pubkey);
 108     p = ASN1_STRING_get0_data(pubkey);
 109     if (p == NULL || plen == 0)
 110         goto err;
 111
 112     if (!EVP_PKEY_set1_encoded_public_key(pkpeer, p, plen))
 113         goto err;
 114
 115     if (EVP_PKEY_derive_set_peer(pctx, pkpeer) > 0)
 116         rv = 1;
 117  err:
 118     EVP_PKEY_free(pkpeer);
 119     return rv;
 120 }
 121
 122 /* Set KDF parameters based on KDF NID */
 123 static int ecdh_cms_set_kdf_param(EVP_PKEY_CTX *pctx, int eckdf_nid)
 124 {
 125     int kdf_nid, kdfmd_nid, cofactor;
 126     const EVP_MD *kdf_md;
 127
 128     if (eckdf_nid == NID_undef)
 129         return 0;
 130
 131     /* Lookup KDF type, cofactor mode and digest */
 132     if (!OBJ_find_sigid_algs(eckdf_nid, &kdfmd_nid, &kdf_nid))
 133         return 0;
 134
 135     if (kdf_nid == NID_dh_std_kdf)
 136         cofactor = 0;
 137     else if (kdf_nid == NID_dh_cofactor_kdf)
 138         cofactor = 1;
 139     else
 140         return 0;
 141
 142     if (EVP_PKEY_CTX_set_ecdh_cofactor_mode(pctx, cofactor) <= 0)
 143         return 0;
 144
 145     if (EVP_PKEY_CTX_set_ecdh_kdf_type(pctx, EVP_PKEY_ECDH_KDF_X9_63) <= 0)
 146         return 0;
 147
 148     kdf_md = EVP_get_digestbynid(kdfmd_nid);
 149     if (!kdf_md)
 150         return 0;
 151
 152     if (EVP_PKEY_CTX_set_ecdh_kdf_md(pctx, kdf_md) <= 0)
 153         return 0;
 154     return 1;
 155 }
 156
 157 static int ecdh_cms_set_shared_info(EVP_PKEY_CTX *pctx, CMS_RecipientInfo *ri)
 158 {
 159     int rv = 0;
 160     X509_ALGOR *alg, *kekalg = NULL;
 161     ASN1_OCTET_STRING *ukm;
 162     const unsigned char *p;
 163     unsigned char *der = NULL;
 164     int plen, keylen;
 165     EVP_CIPHER *kekcipher = NULL;
 166     EVP_CIPHER_CTX *kekctx;
 167     char name[OSSL_MAX_NAME_SIZE];
 168
 169     if (!CMS_RecipientInfo_kari_get0_alg(ri, &alg, &ukm))
 170         return 0;
 171
 172     if (!ecdh_cms_set_kdf_param(pctx, OBJ_obj2nid(alg->algorithm))) {
 173         ERR_raise(ERR_LIB_CMS, CMS_R_KDF_PARAMETER_ERROR);
 174         return 0;
 175     }
 176
 177     if (alg->parameter->type != V_ASN1_SEQUENCE)
 178         return 0;
 179
 180     p = alg->parameter->value.sequence->data;
 181     plen = alg->parameter->value.sequence->length;
 182     kekalg = d2i_X509_ALGOR(NULL, &p, plen);
 183     if (kekalg == NULL)
 184         goto err;
 185     kekctx = CMS_RecipientInfo_kari_get0_ctx(ri);
 186     if (kekctx == NULL)
 187         goto err;
 188     OBJ_obj2txt(name, sizeof(name), kekalg->algorithm, 0);
 189     kekcipher = EVP_CIPHER_fetch(pctx->libctx, name, pctx->propquery);
 190     if (kekcipher == NULL || EVP_CIPHER_get_mode(kekcipher) != EVP_CIPH_WRAP_MODE)
 191         goto err;
 192     if (!EVP_EncryptInit_ex(kekctx, kekcipher, NULL, NULL, NULL))
 193         goto err;
 194     if (EVP_CIPHER_asn1_to_param(kekctx, kekalg->parameter) <= 0)
 195         goto err;
 196
 197     keylen = EVP_CIPHER_CTX_get_key_length(kekctx);
 198     if (EVP_PKEY_CTX_set_ecdh_kdf_outlen(pctx, keylen) <= 0)
 199         goto err;
 200
 201     plen = CMS_SharedInfo_encode(&der, kekalg, ukm, keylen);
 202
 203     if (plen <= 0)
 204         goto err;
 205
 206     if (EVP_PKEY_CTX_set0_ecdh_kdf_ukm(pctx, der, plen) <= 0)
 207         goto err;
 208     der = NULL;
 209
 210     rv = 1;
 211  err:
 212     EVP_CIPHER_free(kekcipher);
 213     X509_ALGOR_free(kekalg);
 214     OPENSSL_free(der);
 215     return rv;
 216 }
 217
 218 static int ecdh_cms_decrypt(CMS_RecipientInfo *ri)
 219 {
 220     EVP_PKEY_CTX *pctx;
 221
 222     pctx = CMS_RecipientInfo_get0_pkey_ctx(ri);
 223     if (pctx == NULL)
 224         return 0;
 225     /* See if we need to set peer key */
 226     if (!EVP_PKEY_CTX_get0_peerkey(pctx)) {
 227         X509_ALGOR *alg;
 228         ASN1_BIT_STRING *pubkey;
 229
 230         if (!CMS_RecipientInfo_kari_get0_orig_id(ri, &alg, &pubkey,
 231                                                  NULL, NULL, NULL))
 232             return 0;
 233         if (alg == NULL || pubkey == NULL)
 234             return 0;
 235         if (!ecdh_cms_set_peerkey(pctx, alg, pubkey)) {
 236             ERR_raise(ERR_LIB_CMS, CMS_R_PEER_KEY_ERROR);
 237             return 0;
 238         }
 239     }
 240     /* Set ECDH derivation parameters and initialise unwrap context */
 241     if (!ecdh_cms_set_shared_info(pctx, ri)) {
 242         ERR_raise(ERR_LIB_CMS, CMS_R_SHARED_INFO_ERROR);
 243         return 0;
 244     }
 245     return 1;
 246 }
 247
 248 static int ecdh_cms_encrypt(CMS_RecipientInfo *ri)
 249 {
 250     EVP_PKEY_CTX *pctx;
 251     EVP_PKEY *pkey;
 252     EVP_CIPHER_CTX *ctx;
 253     int keylen;
 254     X509_ALGOR *talg, *wrap_alg = NULL;
 255     const ASN1_OBJECT *aoid;
 256     ASN1_BIT_STRING *pubkey;
 257     ASN1_STRING *wrap_str;
 258     ASN1_OCTET_STRING *ukm;
 259     unsigned char *penc = NULL;
 260     size_t penclen;
 261     int rv = 0;
 262     int ecdh_nid, kdf_type, kdf_nid, wrap_nid;
 263     const EVP_MD *kdf_md;
 264
 265     pctx = CMS_RecipientInfo_get0_pkey_ctx(ri);
 266     if (pctx == NULL)
 267         return 0;
 268     /* Get ephemeral key */
 269     pkey = EVP_PKEY_CTX_get0_pkey(pctx);
 270     if (!CMS_RecipientInfo_kari_get0_orig_id(ri, &talg, &pubkey,
 271                                              NULL, NULL, NULL))
 272         goto err;
 273     X509_ALGOR_get0(&aoid, NULL, NULL, talg);
 274     /* Is everything uninitialised? */
 275     if (aoid == OBJ_nid2obj(NID_undef)) {
 276         /* Set the key */
 277
 278         penclen = EVP_PKEY_get1_encoded_public_key(pkey, &penc);
 279         ASN1_STRING_set0(pubkey, penc, penclen);
 280         pubkey->flags &= ~(ASN1_STRING_FLAG_BITS_LEFT | 0x07);
 281         pubkey->flags |= ASN1_STRING_FLAG_BITS_LEFT;
 282
 283         penc = NULL;
 284         (void)X509_ALGOR_set0(talg, OBJ_nid2obj(NID_X9_62_id_ecPublicKey),
 285                               V_ASN1_UNDEF, NULL); /* cannot fail */
 286     }
 287
 288     /* See if custom parameters set */
 289     kdf_type = EVP_PKEY_CTX_get_ecdh_kdf_type(pctx);
 290     if (kdf_type <= 0)
 291         goto err;
 292     if (!EVP_PKEY_CTX_get_ecdh_kdf_md(pctx, &kdf_md))
 293         goto err;
 294     ecdh_nid = EVP_PKEY_CTX_get_ecdh_cofactor_mode(pctx);
 295     if (ecdh_nid < 0)
 296         goto err;
 297     else if (ecdh_nid == 0)
 298         ecdh_nid = NID_dh_std_kdf;
 299     else if (ecdh_nid == 1)
 300         ecdh_nid = NID_dh_cofactor_kdf;
 301
 302     if (kdf_type == EVP_PKEY_ECDH_KDF_NONE) {
 303         kdf_type = EVP_PKEY_ECDH_KDF_X9_63;
 304         if (EVP_PKEY_CTX_set_ecdh_kdf_type(pctx, kdf_type) <= 0)
 305             goto err;
 306     } else
 307         /* Unknown KDF */
 308         goto err;
 309     if (kdf_md == NULL) {
 310         /* Fixme later for better MD */
 311         kdf_md = EVP_sha1();
 312         if (EVP_PKEY_CTX_set_ecdh_kdf_md(pctx, kdf_md) <= 0)
 313             goto err;
 314     }
 315
 316     if (!CMS_RecipientInfo_kari_get0_alg(ri, &talg, &ukm))
 317         goto err;
 318
 319     /* Lookup NID for KDF+cofactor+digest */
 320
 321     if (!OBJ_find_sigid_by_algs(&kdf_nid, EVP_MD_get_type(kdf_md), ecdh_nid))
 322         goto err;
 323     /* Get wrap NID */
 324     ctx = CMS_RecipientInfo_kari_get0_ctx(ri);
 325     wrap_nid = EVP_CIPHER_CTX_get_type(ctx);
 326     keylen = EVP_CIPHER_CTX_get_key_length(ctx);
 327
 328     /* Package wrap algorithm in an AlgorithmIdentifier */
 329
 330     wrap_alg = X509_ALGOR_new();
 331     if (wrap_alg == NULL)
 332         goto err;
 333     wrap_alg->algorithm = OBJ_nid2obj(wrap_nid);
 334     wrap_alg->parameter = ASN1_TYPE_new();
 335     if (wrap_alg->parameter == NULL)
 336         goto err;
 337     if (EVP_CIPHER_param_to_asn1(ctx, wrap_alg->parameter) <= 0)
 338         goto err;
 339     if (ASN1_TYPE_get(wrap_alg->parameter) == NID_undef) {
 340         ASN1_TYPE_free(wrap_alg->parameter);
 341         wrap_alg->parameter = NULL;
 342     }
 343
 344     if (EVP_PKEY_CTX_set_ecdh_kdf_outlen(pctx, keylen) <= 0)
 345         goto err;
 346
 347     penclen = CMS_SharedInfo_encode(&penc, wrap_alg, ukm, keylen);
 348
 349     if (penclen == 0)
 350         goto err;
 351
 352     if (EVP_PKEY_CTX_set0_ecdh_kdf_ukm(pctx, penc, penclen) <= 0)
 353         goto err;
 354     penc = NULL;
 355
 356     /*
 357      * Now need to wrap encoding of wrap AlgorithmIdentifier into parameter
 358      * of another AlgorithmIdentifier.
 359      */
 360     penclen = i2d_X509_ALGOR(wrap_alg, &penc);
 361     if (penc == NULL || penclen == 0)
 362         goto err;
 363     wrap_str = ASN1_STRING_new();
 364     if (wrap_str == NULL)
 365         goto err;
 366     ASN1_STRING_set0(wrap_str, penc, penclen);
 367     penc = NULL;
 368     rv = X509_ALGOR_set0(talg, OBJ_nid2obj(kdf_nid), V_ASN1_SEQUENCE, wrap_str);
 369     if (!rv)
 370         ASN1_STRING_free(wrap_str);
 371
 372  err:
 373     OPENSSL_free(penc);
 374     X509_ALGOR_free(wrap_alg);
 375     return rv;
 376 }
 377
 378 int ossl_cms_ecdh_envelope(CMS_RecipientInfo *ri, int decrypt)
 379 {
 380     assert(decrypt == 0 || decrypt == 1);
 381
 382     if (decrypt == 1)
 383         return ecdh_cms_decrypt(ri);
 384
 385     if (decrypt == 0)
 386         return ecdh_cms_encrypt(ri);
 387
 388     ERR_raise(ERR_LIB_CMS, CMS_R_NOT_SUPPORTED_FOR_THIS_KEY_TYPE);
 389     return 0;
 390 }