crypto/cms/cms_dh.c

   1 /*
   2  * Copyright 2006-2020 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include <assert.h>
  11 #include <openssl/cms.h>
  12 #include <openssl/dh.h>
  13 #include <openssl/err.h>
  14 #include <openssl/core_names.h>
  15 #include "cms_local.h"
  16
  17 static int dh_cms_set_peerkey(EVP_PKEY_CTX *pctx,
  18                               X509_ALGOR *alg, ASN1_BIT_STRING *pubkey)
  19 {
  20     const ASN1_OBJECT *aoid;
  21     int atype;
  22     const void *aval;
  23     ASN1_INTEGER *public_key = NULL;
  24     int rv = 0;
  25     EVP_PKEY *pkpeer = NULL, *pk = NULL;
  26     const unsigned char *p;
  27     int plen;
  28
  29     X509_ALGOR_get0(&aoid, &atype, &aval, alg);
  30     if (OBJ_obj2nid(aoid) != NID_dhpublicnumber)
  31         goto err;
  32     /* Only absent parameters allowed in RFC XXXX */
  33     if (atype != V_ASN1_UNDEF && atype == V_ASN1_NULL)
  34         goto err;
  35
  36     pk = EVP_PKEY_CTX_get0_pkey(pctx);
  37     if (pk == NULL || !EVP_PKEY_is_a(pk, "DHX"))
  38         goto err;
  39
  40     /* Get public key */
  41     plen = ASN1_STRING_length(pubkey);
  42     p = ASN1_STRING_get0_data(pubkey);
  43     if (p == NULL || plen == 0)
  44         goto err;
  45
  46     pkpeer = EVP_PKEY_new();
  47     if (pkpeer == NULL
  48             || !EVP_PKEY_copy_parameters(pkpeer, pk)
  49             || !EVP_PKEY_set1_encoded_public_key(pkpeer, p, plen))
  50         goto err;
  51
  52     if (EVP_PKEY_derive_set_peer(pctx, pkpeer) > 0)
  53         rv = 1;
  54  err:
  55     ASN1_INTEGER_free(public_key);
  56     EVP_PKEY_free(pkpeer);
  57     return rv;
  58 }
  59
  60 static int dh_cms_set_shared_info(EVP_PKEY_CTX *pctx, CMS_RecipientInfo *ri)
  61 {
  62     int rv = 0;
  63     X509_ALGOR *alg, *kekalg = NULL;
  64     ASN1_OCTET_STRING *ukm;
  65     const unsigned char *p;
  66     unsigned char *dukm = NULL;
  67     size_t dukmlen = 0;
  68     int keylen, plen;
  69     const EVP_CIPHER *kekcipher;
  70     EVP_CIPHER_CTX *kekctx;
  71
  72     if (!CMS_RecipientInfo_kari_get0_alg(ri, &alg, &ukm))
  73         goto err;
  74
  75     /*
  76      * For DH we only have one OID permissible. If ever any more get defined
  77      * we will need something cleverer.
  78      */
  79     if (OBJ_obj2nid(alg->algorithm) != NID_id_smime_alg_ESDH) {
  80         CMSerr(0, CMS_R_KDF_PARAMETER_ERROR);
  81         goto err;
  82     }
  83
  84     if (EVP_PKEY_CTX_set_dh_kdf_type(pctx, EVP_PKEY_DH_KDF_X9_42) <= 0
  85             || EVP_PKEY_CTX_set_dh_kdf_md(pctx, EVP_sha1()) <= 0)
  86         goto err;
  87
  88     if (alg->parameter->type != V_ASN1_SEQUENCE)
  89         goto err;
  90
  91     p = alg->parameter->value.sequence->data;
  92     plen = alg->parameter->value.sequence->length;
  93     kekalg = d2i_X509_ALGOR(NULL, &p, plen);
  94     if (kekalg == NULL)
  95         goto err;
  96     kekctx = CMS_RecipientInfo_kari_get0_ctx(ri);
  97     if (kekctx == NULL)
  98         goto err;
  99     kekcipher = EVP_get_cipherbyobj(kekalg->algorithm);
 100     if (kekcipher == NULL || EVP_CIPHER_mode(kekcipher) != EVP_CIPH_WRAP_MODE)
 101         goto err;
 102     if (!EVP_EncryptInit_ex(kekctx, kekcipher, NULL, NULL, NULL))
 103         goto err;
 104     if (EVP_CIPHER_asn1_to_param(kekctx, kekalg->parameter) <= 0)
 105         goto err;
 106
 107     keylen = EVP_CIPHER_CTX_key_length(kekctx);
 108     if (EVP_PKEY_CTX_set_dh_kdf_outlen(pctx, keylen) <= 0)
 109         goto err;
 110     /* Use OBJ_nid2obj to ensure we use built in OID that isn't freed */
 111     if (EVP_PKEY_CTX_set0_dh_kdf_oid(pctx,
 112                                      OBJ_nid2obj(EVP_CIPHER_type(kekcipher)))
 113         <= 0)
 114         goto err;
 115
 116     if (ukm != NULL) {
 117         dukmlen = ASN1_STRING_length(ukm);
 118         dukm = OPENSSL_memdup(ASN1_STRING_get0_data(ukm), dukmlen);
 119         if (dukm == NULL)
 120             goto err;
 121     }
 122
 123     if (EVP_PKEY_CTX_set0_dh_kdf_ukm(pctx, dukm, dukmlen) <= 0)
 124         goto err;
 125     dukm = NULL;
 126
 127     rv = 1;
 128  err:
 129     X509_ALGOR_free(kekalg);
 130     OPENSSL_free(dukm);
 131     return rv;
 132 }
 133
 134 static int dh_cms_decrypt(CMS_RecipientInfo *ri)
 135 {
 136     EVP_PKEY_CTX *pctx = CMS_RecipientInfo_get0_pkey_ctx(ri);
 137
 138     if (pctx == NULL)
 139         return 0;
 140     /* See if we need to set peer key */
 141     if (!EVP_PKEY_CTX_get0_peerkey(pctx)) {
 142         X509_ALGOR *alg;
 143         ASN1_BIT_STRING *pubkey;
 144
 145         if (!CMS_RecipientInfo_kari_get0_orig_id(ri, &alg, &pubkey,
 146                                                  NULL, NULL, NULL))
 147             return 0;
 148         if (alg ==  NULL || pubkey == NULL)
 149             return 0;
 150         if (!dh_cms_set_peerkey(pctx, alg, pubkey)) {
 151             DHerr(DH_F_DH_CMS_DECRYPT, DH_R_PEER_KEY_ERROR);
 152             return 0;
 153         }
 154     }
 155     /* Set DH derivation parameters and initialise unwrap context */
 156     if (!dh_cms_set_shared_info(pctx, ri)) {
 157         DHerr(DH_F_DH_CMS_DECRYPT, DH_R_SHARED_INFO_ERROR);
 158         return 0;
 159     }
 160     return 1;
 161 }
 162
 163 static int dh_cms_encrypt(CMS_RecipientInfo *ri)
 164 {
 165     EVP_PKEY_CTX *pctx;
 166     EVP_PKEY *pkey;
 167     EVP_CIPHER_CTX *ctx;
 168     int keylen;
 169     X509_ALGOR *talg, *wrap_alg = NULL;
 170     const ASN1_OBJECT *aoid;
 171     ASN1_BIT_STRING *pubkey;
 172     ASN1_STRING *wrap_str;
 173     ASN1_OCTET_STRING *ukm;
 174     unsigned char *penc = NULL, *dukm = NULL;
 175     int penclen;
 176     size_t dukmlen = 0;
 177     int rv = 0;
 178     int kdf_type, wrap_nid;
 179     const EVP_MD *kdf_md;
 180
 181     pctx = CMS_RecipientInfo_get0_pkey_ctx(ri);
 182     if (pctx == NULL)
 183         return 0;
 184     /* Get ephemeral key */
 185     pkey = EVP_PKEY_CTX_get0_pkey(pctx);
 186     if (!CMS_RecipientInfo_kari_get0_orig_id(ri, &talg, &pubkey,
 187                                              NULL, NULL, NULL))
 188         goto err;
 189
 190     /* Is everything uninitialised? */
 191     X509_ALGOR_get0(&aoid, NULL, NULL, talg);
 192     if (aoid == OBJ_nid2obj(NID_undef)) {
 193         BIGNUM *bn_pub_key = NULL;
 194         ASN1_INTEGER *pubk;
 195
 196         if (!EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_PUB_KEY, &bn_pub_key))
 197             goto err;
 198
 199         pubk = BN_to_ASN1_INTEGER(bn_pub_key, NULL);
 200         BN_free(bn_pub_key);
 201         if (pubk == NULL)
 202             goto err;
 203
 204         /* Set the key */
 205         penclen = i2d_ASN1_INTEGER(pubk, &penc);
 206         ASN1_INTEGER_free(pubk);
 207         if (penclen <= 0)
 208             goto err;
 209         ASN1_STRING_set0(pubkey, penc, penclen);
 210         pubkey->flags &= ~(ASN1_STRING_FLAG_BITS_LEFT | 0x07);
 211         pubkey->flags |= ASN1_STRING_FLAG_BITS_LEFT;
 212
 213         penc = NULL;
 214         X509_ALGOR_set0(talg, OBJ_nid2obj(NID_dhpublicnumber),
 215                         V_ASN1_UNDEF, NULL);
 216     }
 217
 218     /* See if custom parameters set */
 219     kdf_type = EVP_PKEY_CTX_get_dh_kdf_type(pctx);
 220     if (kdf_type <= 0 || !EVP_PKEY_CTX_get_dh_kdf_md(pctx, &kdf_md))
 221         goto err;
 222
 223     if (kdf_type == EVP_PKEY_DH_KDF_NONE) {
 224         kdf_type = EVP_PKEY_DH_KDF_X9_42;
 225         if (EVP_PKEY_CTX_set_dh_kdf_type(pctx, kdf_type) <= 0)
 226             goto err;
 227     } else if (kdf_type != EVP_PKEY_DH_KDF_X9_42)
 228         /* Unknown KDF */
 229         goto err;
 230     if (kdf_md == NULL) {
 231         /* Only SHA1 supported */
 232         kdf_md = EVP_sha1();
 233         if (EVP_PKEY_CTX_set_dh_kdf_md(pctx, kdf_md) <= 0)
 234             goto err;
 235     } else if (EVP_MD_type(kdf_md) != NID_sha1)
 236         /* Unsupported digest */
 237         goto err;
 238
 239     if (!CMS_RecipientInfo_kari_get0_alg(ri, &talg, &ukm))
 240         goto err;
 241
 242     /* Get wrap NID */
 243     ctx = CMS_RecipientInfo_kari_get0_ctx(ri);
 244     wrap_nid = EVP_CIPHER_CTX_type(ctx);
 245     if (EVP_PKEY_CTX_set0_dh_kdf_oid(pctx, OBJ_nid2obj(wrap_nid)) <= 0)
 246         goto err;
 247     keylen = EVP_CIPHER_CTX_key_length(ctx);
 248
 249     /* Package wrap algorithm in an AlgorithmIdentifier */
 250
 251     wrap_alg = X509_ALGOR_new();
 252     if (wrap_alg == NULL)
 253         goto err;
 254     wrap_alg->algorithm = OBJ_nid2obj(wrap_nid);
 255     wrap_alg->parameter = ASN1_TYPE_new();
 256     if (wrap_alg->parameter == NULL)
 257         goto err;
 258     if (EVP_CIPHER_param_to_asn1(ctx, wrap_alg->parameter) <= 0)
 259         goto err;
 260     if (ASN1_TYPE_get(wrap_alg->parameter) == NID_undef) {
 261         ASN1_TYPE_free(wrap_alg->parameter);
 262         wrap_alg->parameter = NULL;
 263     }
 264
 265     if (EVP_PKEY_CTX_set_dh_kdf_outlen(pctx, keylen) <= 0)
 266         goto err;
 267
 268     if (ukm != NULL) {
 269         dukmlen = ASN1_STRING_length(ukm);
 270         dukm = OPENSSL_memdup(ASN1_STRING_get0_data(ukm), dukmlen);
 271         if (dukm == NULL)
 272             goto err;
 273     }
 274
 275     if (EVP_PKEY_CTX_set0_dh_kdf_ukm(pctx, dukm, dukmlen) <= 0)
 276         goto err;
 277     dukm = NULL;
 278
 279     /*
 280      * Now need to wrap encoding of wrap AlgorithmIdentifier into parameter
 281      * of another AlgorithmIdentifier.
 282      */
 283     penc = NULL;
 284     penclen = i2d_X509_ALGOR(wrap_alg, &penc);
 285     if (penc == NULL || penclen == 0)
 286         goto err;
 287     wrap_str = ASN1_STRING_new();
 288     if (wrap_str == NULL)
 289         goto err;
 290     ASN1_STRING_set0(wrap_str, penc, penclen);
 291     penc = NULL;
 292     X509_ALGOR_set0(talg, OBJ_nid2obj(NID_id_smime_alg_ESDH),
 293                     V_ASN1_SEQUENCE, wrap_str);
 294
 295     rv = 1;
 296
 297  err:
 298     OPENSSL_free(penc);
 299     X509_ALGOR_free(wrap_alg);
 300     OPENSSL_free(dukm);
 301     return rv;
 302 }
 303
 304 int cms_dh_envelope(CMS_RecipientInfo *ri, int decrypt)
 305 {
 306     assert(decrypt == 0 || decrypt == 1);
 307
 308     if (decrypt == 1)
 309         return dh_cms_decrypt(ri);
 310
 311     if (decrypt == 0)
 312         return dh_cms_encrypt(ri);
 313
 314     CMSerr(0, CMS_R_NOT_SUPPORTED_FOR_THIS_KEY_TYPE);
 315     return 0;
 316 }