]>
Commit | Line | Data |
---|---|---|
0f113f3e | 1 | /* |
a28d06f3 | 2 | * Copyright 2006-2021 The OpenSSL Project Authors. All Rights Reserved. |
f5cda4cb | 3 | * |
4a8b0c55 | 4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
62867571 RS |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
f5cda4cb DSH |
8 | */ |
9 | ||
10 | #include <stdio.h> | |
11 | #include <stdlib.h> | |
62924755 RL |
12 | #include <openssl/core.h> |
13 | #include <openssl/core_names.h> | |
b39fc560 | 14 | #include "internal/cryptlib.h" |
62924755 | 15 | #include "internal/core.h" |
c20276e4 | 16 | #include <openssl/objects.h> |
f5cda4cb | 17 | #include <openssl/evp.h> |
25f2138b DMSP |
18 | #include "crypto/bn.h" |
19 | #include "crypto/asn1.h" | |
20 | #include "crypto/evp.h" | |
46e2dd05 RL |
21 | #include "evp_local.h" |
22 | ||
62924755 | 23 | static int gen_init(EVP_PKEY_CTX *ctx, int operation) |
0f113f3e | 24 | { |
62924755 RL |
25 | int ret = 0; |
26 | ||
27 | if (ctx == NULL) | |
28 | goto not_supported; | |
29 | ||
30 | evp_pkey_ctx_free_old_ops(ctx); | |
31 | ctx->operation = operation; | |
32 | ||
4b9e90f4 | 33 | if (ctx->keymgmt == NULL || ctx->keymgmt->gen_init == NULL) |
62924755 RL |
34 | goto legacy; |
35 | ||
62924755 RL |
36 | switch (operation) { |
37 | case EVP_PKEY_OP_PARAMGEN: | |
38 | ctx->op.keymgmt.genctx = | |
39 | evp_keymgmt_gen_init(ctx->keymgmt, | |
1be63b3e | 40 | OSSL_KEYMGMT_SELECT_ALL_PARAMETERS, NULL); |
62924755 RL |
41 | break; |
42 | case EVP_PKEY_OP_KEYGEN: | |
43 | ctx->op.keymgmt.genctx = | |
1be63b3e P |
44 | evp_keymgmt_gen_init(ctx->keymgmt, OSSL_KEYMGMT_SELECT_KEYPAIR, |
45 | NULL); | |
62924755 RL |
46 | break; |
47 | } | |
48 | ||
49 | if (ctx->op.keymgmt.genctx == NULL) | |
50 | ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR); | |
51 | else | |
52 | ret = 1; | |
53 | goto end; | |
54 | ||
55 | legacy: | |
f844f9eb | 56 | #ifdef FIPS_MODULE |
62924755 RL |
57 | goto not_supported; |
58 | #else | |
59 | if (ctx->pmeth == NULL | |
60 | || (operation == EVP_PKEY_OP_PARAMGEN | |
61 | && ctx->pmeth->paramgen == NULL) | |
62 | || (operation == EVP_PKEY_OP_KEYGEN | |
63 | && ctx->pmeth->keygen == NULL)) | |
64 | goto not_supported; | |
65 | ||
66 | ret = 1; | |
67 | switch (operation) { | |
68 | case EVP_PKEY_OP_PARAMGEN: | |
69 | if (ctx->pmeth->paramgen_init != NULL) | |
70 | ret = ctx->pmeth->paramgen_init(ctx); | |
71 | break; | |
72 | case EVP_PKEY_OP_KEYGEN: | |
73 | if (ctx->pmeth->keygen_init != NULL) | |
74 | ret = ctx->pmeth->keygen_init(ctx); | |
75 | break; | |
0f113f3e | 76 | } |
62924755 RL |
77 | #endif |
78 | ||
79 | end: | |
c7fa9297 RL |
80 | if (ret <= 0 && ctx != NULL) { |
81 | evp_pkey_ctx_free_old_ops(ctx); | |
0f113f3e | 82 | ctx->operation = EVP_PKEY_OP_UNDEFINED; |
c7fa9297 | 83 | } |
0f113f3e | 84 | return ret; |
62924755 RL |
85 | |
86 | not_supported: | |
87 | ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE); | |
88 | ret = -2; | |
89 | goto end; | |
0f113f3e | 90 | } |
f5cda4cb | 91 | |
62924755 | 92 | int EVP_PKEY_paramgen_init(EVP_PKEY_CTX *ctx) |
0f113f3e | 93 | { |
62924755 RL |
94 | return gen_init(ctx, EVP_PKEY_OP_PARAMGEN); |
95 | } | |
0f113f3e | 96 | |
62924755 RL |
97 | int EVP_PKEY_keygen_init(EVP_PKEY_CTX *ctx) |
98 | { | |
99 | return gen_init(ctx, EVP_PKEY_OP_KEYGEN); | |
100 | } | |
101 | ||
102 | static int ossl_callback_to_pkey_gencb(const OSSL_PARAM params[], void *arg) | |
103 | { | |
104 | EVP_PKEY_CTX *ctx = arg; | |
105 | const OSSL_PARAM *param = NULL; | |
106 | int p = -1, n = -1; | |
107 | ||
108 | if (ctx->pkey_gencb == NULL) | |
109 | return 1; /* No callback? That's fine */ | |
110 | ||
111 | if ((param = OSSL_PARAM_locate_const(params, OSSL_GEN_PARAM_POTENTIAL)) | |
112 | == NULL | |
113 | || !OSSL_PARAM_get_int(param, &p)) | |
114 | return 0; | |
115 | if ((param = OSSL_PARAM_locate_const(params, OSSL_GEN_PARAM_ITERATION)) | |
116 | == NULL | |
117 | || !OSSL_PARAM_get_int(param, &n)) | |
118 | return 0; | |
119 | ||
120 | ctx->keygen_info[0] = p; | |
121 | ctx->keygen_info[1] = n; | |
122 | ||
123 | return ctx->pkey_gencb(ctx); | |
124 | } | |
125 | ||
126 | int EVP_PKEY_gen(EVP_PKEY_CTX *ctx, EVP_PKEY **ppkey) | |
127 | { | |
128 | int ret = 0; | |
129 | OSSL_CALLBACK cb; | |
130 | EVP_PKEY *allocated_pkey = NULL; | |
4ec1463d RL |
131 | /* Legacy compatible keygen callback info, only used with provider impls */ |
132 | int gentmp[2]; | |
0f113f3e | 133 | |
e34c66c6 | 134 | if (ppkey == NULL) |
0f113f3e MC |
135 | return -1; |
136 | ||
62924755 RL |
137 | if (ctx == NULL) |
138 | goto not_supported; | |
139 | ||
140 | if ((ctx->operation & EVP_PKEY_OP_TYPE_GEN) == 0) | |
141 | goto not_initialized; | |
142 | ||
e34c66c6 | 143 | if (*ppkey == NULL) |
62924755 | 144 | *ppkey = allocated_pkey = EVP_PKEY_new(); |
0f113f3e | 145 | |
e34c66c6 | 146 | if (*ppkey == NULL) { |
62924755 | 147 | ERR_raise(ERR_LIB_EVP, ERR_R_MALLOC_FAILURE); |
e34c66c6 EK |
148 | return -1; |
149 | } | |
150 | ||
813d3171 | 151 | if (ctx->op.keymgmt.genctx == NULL) |
62924755 RL |
152 | goto legacy; |
153 | ||
4ec1463d RL |
154 | /* |
155 | * Asssigning gentmp to ctx->keygen_info is something our legacy | |
156 | * implementations do. Because the provider implementations aren't | |
157 | * allowed to reach into our EVP_PKEY_CTX, we need to provide similar | |
158 | * space for backward compatibility. It's ok that we attach a local | |
159 | * variable, as it should only be useful in the calls down from here. | |
160 | * This is cleared as soon as it isn't useful any more, i.e. directly | |
161 | * after the evp_keymgmt_util_gen() call. | |
162 | */ | |
163 | ctx->keygen_info = gentmp; | |
164 | ctx->keygen_info_count = 2; | |
165 | ||
62924755 RL |
166 | ret = 1; |
167 | if (ctx->pkey != NULL) { | |
168 | EVP_KEYMGMT *tmp_keymgmt = ctx->keymgmt; | |
169 | void *keydata = | |
170 | evp_pkey_export_to_provider(ctx->pkey, ctx->libctx, | |
171 | &tmp_keymgmt, ctx->propquery); | |
172 | ||
d0ddf9b4 | 173 | if (tmp_keymgmt == NULL) |
62924755 | 174 | goto not_supported; |
d0ddf9b4 RL |
175 | /* |
176 | * It's ok if keydata is NULL here. The backend is expected to deal | |
177 | * with that as it sees fit. | |
178 | */ | |
62924755 RL |
179 | ret = evp_keymgmt_gen_set_template(ctx->keymgmt, |
180 | ctx->op.keymgmt.genctx, keydata); | |
181 | } | |
182 | ||
183 | /* | |
184 | * the returned value from evp_keymgmt_util_gen() is cached in *ppkey, | |
d1ca3911 | 185 | * so we do not need to save it, just check it. |
62924755 RL |
186 | */ |
187 | ret = ret | |
188 | && (evp_keymgmt_util_gen(*ppkey, ctx->keymgmt, ctx->op.keymgmt.genctx, | |
189 | ossl_callback_to_pkey_gencb, ctx) | |
190 | != NULL); | |
191 | ||
4ec1463d RL |
192 | ctx->keygen_info = NULL; |
193 | ||
f844f9eb | 194 | #ifndef FIPS_MODULE |
62924755 RL |
195 | /* In case |*ppkey| was originally a legacy key */ |
196 | if (ret) | |
197 | evp_pkey_free_legacy(*ppkey); | |
198 | #endif | |
199 | ||
50914496 | 200 | /* |
b574c6a9 | 201 | * Because we still have legacy keys |
50914496 RL |
202 | * TODO remove this #legacy internal keys are gone |
203 | */ | |
204 | (*ppkey)->type = ctx->legacy_keytype; | |
205 | ||
62924755 RL |
206 | goto end; |
207 | ||
208 | legacy: | |
f844f9eb | 209 | #ifdef FIPS_MODULE |
62924755 RL |
210 | goto not_supported; |
211 | #else | |
b574c6a9 MC |
212 | /* |
213 | * If we get here then we're using legacy paramgen/keygen. In that case | |
214 | * the pkey in ctx (if there is one) had better not be provided (because the | |
215 | * legacy methods may not know how to handle it). However we can only get | |
216 | * here if ctx->op.keymgmt.genctx == NULL, but that should never be the case | |
217 | * if ctx->pkey is provided because we don't allow this when we initialise | |
218 | * the ctx. | |
219 | */ | |
220 | if (ctx->pkey != NULL && !ossl_assert(!evp_pkey_is_provided(ctx->pkey))) | |
acb90ba8 | 221 | goto not_accessible; |
b574c6a9 | 222 | |
62924755 RL |
223 | switch (ctx->operation) { |
224 | case EVP_PKEY_OP_PARAMGEN: | |
225 | ret = ctx->pmeth->paramgen(ctx, *ppkey); | |
226 | break; | |
227 | case EVP_PKEY_OP_KEYGEN: | |
228 | ret = ctx->pmeth->keygen(ctx, *ppkey); | |
229 | break; | |
230 | default: | |
231 | goto not_supported; | |
232 | } | |
233 | #endif | |
234 | ||
235 | end: | |
0f113f3e | 236 | if (ret <= 0) { |
62924755 RL |
237 | if (allocated_pkey != NULL) |
238 | *ppkey = NULL; | |
239 | EVP_PKEY_free(allocated_pkey); | |
0f113f3e MC |
240 | } |
241 | return ret; | |
62924755 RL |
242 | |
243 | not_supported: | |
244 | ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE); | |
245 | ret = -2; | |
246 | goto end; | |
247 | not_initialized: | |
bf23b9a1 | 248 | ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_INITIALIZED); |
62924755 RL |
249 | ret = -1; |
250 | goto end; | |
f844f9eb | 251 | #ifndef FIPS_MODULE |
acb90ba8 RL |
252 | not_accessible: |
253 | ERR_raise(ERR_LIB_EVP, EVP_R_INACCESSIBLE_DOMAIN_PARAMETERS); | |
254 | ret = -1; | |
255 | goto end; | |
256 | #endif | |
0f113f3e | 257 | } |
f5cda4cb | 258 | |
62924755 | 259 | int EVP_PKEY_paramgen(EVP_PKEY_CTX *ctx, EVP_PKEY **ppkey) |
0f113f3e | 260 | { |
62924755 | 261 | if (ctx->operation != EVP_PKEY_OP_PARAMGEN) { |
bf23b9a1 | 262 | ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_INITIALIZED); |
62924755 | 263 | return -1; |
0f113f3e | 264 | } |
62924755 | 265 | return EVP_PKEY_gen(ctx, ppkey); |
0f113f3e | 266 | } |
f5cda4cb DSH |
267 | |
268 | int EVP_PKEY_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY **ppkey) | |
0f113f3e | 269 | { |
0f113f3e | 270 | if (ctx->operation != EVP_PKEY_OP_KEYGEN) { |
bf23b9a1 | 271 | ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_INITIALIZED); |
0f113f3e MC |
272 | return -1; |
273 | } | |
62924755 | 274 | return EVP_PKEY_gen(ctx, ppkey); |
0f113f3e | 275 | } |
f5cda4cb DSH |
276 | |
277 | void EVP_PKEY_CTX_set_cb(EVP_PKEY_CTX *ctx, EVP_PKEY_gen_cb *cb) | |
0f113f3e MC |
278 | { |
279 | ctx->pkey_gencb = cb; | |
280 | } | |
f5cda4cb | 281 | |
b28dea4e | 282 | EVP_PKEY_gen_cb *EVP_PKEY_CTX_get_cb(EVP_PKEY_CTX *ctx) |
0f113f3e MC |
283 | { |
284 | return ctx->pkey_gencb; | |
285 | } | |
b28dea4e | 286 | |
0f113f3e MC |
287 | /* |
288 | * "translation callback" to call EVP_PKEY_CTX callbacks using BN_GENCB style | |
289 | * callbacks. | |
f5cda4cb DSH |
290 | */ |
291 | ||
292 | static int trans_cb(int a, int b, BN_GENCB *gcb) | |
0f113f3e MC |
293 | { |
294 | EVP_PKEY_CTX *ctx = BN_GENCB_get_arg(gcb); | |
295 | ctx->keygen_info[0] = a; | |
296 | ctx->keygen_info[1] = b; | |
297 | return ctx->pkey_gencb(ctx); | |
298 | } | |
f5cda4cb DSH |
299 | |
300 | void evp_pkey_set_cb_translate(BN_GENCB *cb, EVP_PKEY_CTX *ctx) | |
0f113f3e MC |
301 | { |
302 | BN_GENCB_set(cb, trans_cb, ctx); | |
303 | } | |
f5cda4cb DSH |
304 | |
305 | int EVP_PKEY_CTX_get_keygen_info(EVP_PKEY_CTX *ctx, int idx) | |
0f113f3e MC |
306 | { |
307 | if (idx == -1) | |
308 | return ctx->keygen_info_count; | |
309 | if (idx < 0 || idx > ctx->keygen_info_count) | |
310 | return 0; | |
311 | return ctx->keygen_info[idx]; | |
312 | } | |
2022cfe0 | 313 | |
f844f9eb | 314 | #ifndef FIPS_MODULE |
62924755 | 315 | |
2022cfe0 | 316 | EVP_PKEY *EVP_PKEY_new_mac_key(int type, ENGINE *e, |
0f113f3e MC |
317 | const unsigned char *key, int keylen) |
318 | { | |
319 | EVP_PKEY_CTX *mac_ctx = NULL; | |
320 | EVP_PKEY *mac_key = NULL; | |
321 | mac_ctx = EVP_PKEY_CTX_new_id(type, e); | |
322 | if (!mac_ctx) | |
323 | return NULL; | |
324 | if (EVP_PKEY_keygen_init(mac_ctx) <= 0) | |
325 | goto merr; | |
eff1a4d2 | 326 | if (EVP_PKEY_CTX_set_mac_key(mac_ctx, key, keylen) <= 0) |
0f113f3e MC |
327 | goto merr; |
328 | if (EVP_PKEY_keygen(mac_ctx, &mac_key) <= 0) | |
329 | goto merr; | |
330 | merr: | |
c5ba2d99 | 331 | EVP_PKEY_CTX_free(mac_ctx); |
0f113f3e MC |
332 | return mac_key; |
333 | } | |
2aee35d3 | 334 | |
f844f9eb | 335 | #endif /* FIPS_MODULE */ |
e683582b | 336 | |
f844f9eb | 337 | /*- All methods below can also be used in FIPS_MODULE */ |
e683582b SL |
338 | |
339 | static int fromdata_init(EVP_PKEY_CTX *ctx, int operation) | |
340 | { | |
341 | if (ctx == NULL || ctx->keytype == NULL) | |
342 | goto not_supported; | |
343 | ||
344 | evp_pkey_ctx_free_old_ops(ctx); | |
e683582b SL |
345 | if (ctx->keymgmt == NULL) |
346 | goto not_supported; | |
347 | ||
4b9e90f4 | 348 | ctx->operation = operation; |
e683582b SL |
349 | return 1; |
350 | ||
351 | not_supported: | |
10ead938 SL |
352 | if (ctx != NULL) |
353 | ctx->operation = EVP_PKEY_OP_UNDEFINED; | |
e683582b SL |
354 | ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE); |
355 | return -2; | |
356 | } | |
357 | ||
2db985b7 | 358 | int EVP_PKEY_fromdata_init(EVP_PKEY_CTX *ctx) |
e683582b | 359 | { |
2db985b7 | 360 | return fromdata_init(ctx, EVP_PKEY_OP_FROMDATA); |
e683582b SL |
361 | } |
362 | ||
2db985b7 SL |
363 | int EVP_PKEY_fromdata(EVP_PKEY_CTX *ctx, EVP_PKEY **ppkey, int selection, |
364 | OSSL_PARAM params[]) | |
e683582b | 365 | { |
b305452f | 366 | void *keydata = NULL; |
e683582b | 367 | |
2db985b7 | 368 | if (ctx == NULL || (ctx->operation & EVP_PKEY_OP_FROMDATA) == 0) { |
e683582b SL |
369 | ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE); |
370 | return -2; | |
371 | } | |
372 | ||
373 | if (ppkey == NULL) | |
374 | return -1; | |
375 | ||
376 | if (*ppkey == NULL) | |
377 | *ppkey = EVP_PKEY_new(); | |
378 | ||
379 | if (*ppkey == NULL) { | |
380 | ERR_raise(ERR_LIB_EVP, ERR_R_MALLOC_FAILURE); | |
381 | return -1; | |
382 | } | |
383 | ||
2db985b7 | 384 | keydata = evp_keymgmt_util_fromdata(*ppkey, ctx->keymgmt, selection, params); |
b305452f | 385 | if (keydata == NULL) |
e683582b | 386 | return 0; |
b305452f | 387 | /* keydata is cached in *ppkey, so we need not bother with it further */ |
e683582b SL |
388 | return 1; |
389 | } | |
390 | ||
2db985b7 | 391 | const OSSL_PARAM *EVP_PKEY_fromdata_settable(EVP_PKEY_CTX *ctx, int selection) |
e683582b SL |
392 | { |
393 | /* We call fromdata_init to get ctx->keymgmt populated */ | |
2db985b7 SL |
394 | if (fromdata_init(ctx, EVP_PKEY_OP_UNDEFINED) == 1) |
395 | return evp_keymgmt_import_types(ctx->keymgmt, selection); | |
e683582b SL |
396 | return NULL; |
397 | } | |
a732a4c3 SL |
398 | |
399 | static OSSL_CALLBACK ossl_pkey_todata_cb; | |
400 | ||
401 | static int ossl_pkey_todata_cb(const OSSL_PARAM params[], void *arg) | |
402 | { | |
403 | OSSL_PARAM **ret = arg; | |
404 | ||
405 | *ret = OSSL_PARAM_dup(params); | |
406 | return 1; | |
407 | } | |
408 | ||
409 | int EVP_PKEY_todata(const EVP_PKEY *pkey, int selection, OSSL_PARAM **params) | |
410 | { | |
411 | if (params == NULL) | |
412 | return 0; | |
413 | return EVP_PKEY_export(pkey, selection, ossl_pkey_todata_cb, params); | |
414 | } | |
415 | ||
416 | int EVP_PKEY_export(const EVP_PKEY *pkey, int selection, | |
417 | OSSL_CALLBACK *export_cb, void *export_cbarg) | |
418 | { | |
419 | return evp_keymgmt_util_export(pkey, selection, export_cb, export_cbarg); | |
420 | } |