crypto/cms/cms_ec.c

   1 /*
   2  * Copyright 2006-2020 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include <assert.h>
  11 #include <openssl/cms.h>
  12 #include <openssl/err.h>
  13 #include <openssl/decoder.h>
  14 #include "cms_local.h"
  15 #include "crypto/evp.h"
  16
  17 #ifndef OPENSSL_NO_EC
  18 static EVP_PKEY *pkey_type2param(int ptype, const void *pval,
  19                                  OPENSSL_CTX *libctx, const char *propq)
  20 {
  21     EVP_PKEY *pkey = NULL;
  22     EVP_PKEY_CTX *pctx = NULL;
  23
  24     if (ptype == V_ASN1_SEQUENCE) {
  25         const ASN1_STRING *pstr = pval;
  26         const unsigned char *pm = pstr->data;
  27         int pmlen = pstr->length;
  28         OSSL_DECODER_CTX *ctx = NULL;
  29         BIO *membio = NULL;
  30
  31         /* TODO(3.0): Need to be able to specify here that only params will do */
  32         ctx = OSSL_DECODER_CTX_new_by_EVP_PKEY(&pkey, "DER", "EC", libctx,
  33                                                propq);
  34         if (ctx == NULL)
  35             goto err;
  36
  37         membio = BIO_new_mem_buf(pm, pmlen);
  38         if (membio == NULL) {
  39             OSSL_DECODER_CTX_free(ctx);
  40             goto err;
  41         }
  42         OSSL_DECODER_from_bio(ctx, membio);
  43         BIO_free(membio);
  44         OSSL_DECODER_CTX_free(ctx);
  45     } else if (ptype == V_ASN1_OBJECT) {
  46         const ASN1_OBJECT *poid = pval;
  47         const char *groupname;
  48
  49         /* type == V_ASN1_OBJECT => the parameters are given by an asn1 OID */
  50         pctx = EVP_PKEY_CTX_new_from_name(libctx, "EC", propq);
  51         if (pctx == NULL || EVP_PKEY_paramgen_init(pctx) <= 0)
  52             goto err;
  53         groupname = OBJ_nid2sn(OBJ_obj2nid(poid));
  54         if (groupname == NULL
  55                 || !EVP_PKEY_CTX_set_group_name(pctx, groupname)) {
  56             CMSerr(0, CMS_R_DECODE_ERROR);
  57             goto err;
  58         }
  59         if (EVP_PKEY_paramgen(pctx, &pkey) <= 0)
  60             goto err;
  61     } else {
  62         CMSerr(0, CMS_R_DECODE_ERROR);
  63         goto err;
  64     }
  65
  66     return pkey;
  67
  68  err:
  69     EVP_PKEY_free(pkey);
  70     EVP_PKEY_CTX_free(pctx);
  71     return NULL;
  72 }
  73
  74 static int ecdh_cms_set_peerkey(EVP_PKEY_CTX *pctx,
  75                                 X509_ALGOR *alg, ASN1_BIT_STRING *pubkey)
  76 {
  77     const ASN1_OBJECT *aoid;
  78     int atype;
  79     const void *aval;
  80     int rv = 0;
  81     EVP_PKEY *pkpeer = NULL;
  82     const unsigned char *p;
  83     int plen;
  84
  85     X509_ALGOR_get0(&aoid, &atype, &aval, alg);
  86     if (OBJ_obj2nid(aoid) != NID_X9_62_id_ecPublicKey)
  87         goto err;
  88
  89     /* If absent parameters get group from main key */
  90     if (atype == V_ASN1_UNDEF || atype == V_ASN1_NULL) {
  91         EVP_PKEY *pk;
  92
  93         pk = EVP_PKEY_CTX_get0_pkey(pctx);
  94         if (pk == NULL)
  95             goto err;
  96
  97         pkpeer = EVP_PKEY_new();
  98         if (pkpeer == NULL)
  99             goto err;
 100         if (!EVP_PKEY_copy_parameters(pkpeer, pk))
 101             goto err;
 102     } else {
 103         /* TODO(3.0): Should the get0_libctx/propq calls actually be public API? */
 104         pkpeer = pkey_type2param(atype, aval,
 105                                  evp_pkey_ctx_get0_libctx(pctx),
 106                                  evp_pkey_ctx_get0_propq(pctx));
 107         if (pkpeer == NULL)
 108             goto err;
 109     }
 110     /* We have parameters now set public key */
 111     plen = ASN1_STRING_length(pubkey);
 112     p = ASN1_STRING_get0_data(pubkey);
 113     if (p == NULL || plen == 0)
 114         goto err;
 115
 116     /* TODO(3.0): Terrible name. We need a non-tls specific name */
 117     if (!EVP_PKEY_set1_tls_encodedpoint(pkpeer, p, plen))
 118         goto err;
 119
 120     if (EVP_PKEY_derive_set_peer(pctx, pkpeer) > 0)
 121         rv = 1;
 122  err:
 123     EVP_PKEY_free(pkpeer);
 124     return rv;
 125 }
 126
 127 /* Set KDF parameters based on KDF NID */
 128 static int ecdh_cms_set_kdf_param(EVP_PKEY_CTX *pctx, int eckdf_nid)
 129 {
 130     int kdf_nid, kdfmd_nid, cofactor;
 131     const EVP_MD *kdf_md;
 132
 133     if (eckdf_nid == NID_undef)
 134         return 0;
 135
 136     /* Lookup KDF type, cofactor mode and digest */
 137     if (!OBJ_find_sigid_algs(eckdf_nid, &kdfmd_nid, &kdf_nid))
 138         return 0;
 139
 140     if (kdf_nid == NID_dh_std_kdf)
 141         cofactor = 0;
 142     else if (kdf_nid == NID_dh_cofactor_kdf)
 143         cofactor = 1;
 144     else
 145         return 0;
 146
 147     if (EVP_PKEY_CTX_set_ecdh_cofactor_mode(pctx, cofactor) <= 0)
 148         return 0;
 149
 150     if (EVP_PKEY_CTX_set_ecdh_kdf_type(pctx, EVP_PKEY_ECDH_KDF_X9_63) <= 0)
 151         return 0;
 152
 153     kdf_md = EVP_get_digestbynid(kdfmd_nid);
 154     if (!kdf_md)
 155         return 0;
 156
 157     if (EVP_PKEY_CTX_set_ecdh_kdf_md(pctx, kdf_md) <= 0)
 158         return 0;
 159     return 1;
 160 }
 161
 162 static int ecdh_cms_set_shared_info(EVP_PKEY_CTX *pctx, CMS_RecipientInfo *ri)
 163 {
 164     int rv = 0;
 165     X509_ALGOR *alg, *kekalg = NULL;
 166     ASN1_OCTET_STRING *ukm;
 167     const unsigned char *p;
 168     unsigned char *der = NULL;
 169     int plen, keylen;
 170     EVP_CIPHER *kekcipher = NULL;
 171     EVP_CIPHER_CTX *kekctx;
 172     const char *name;
 173
 174     if (!CMS_RecipientInfo_kari_get0_alg(ri, &alg, &ukm))
 175         return 0;
 176
 177     if (!ecdh_cms_set_kdf_param(pctx, OBJ_obj2nid(alg->algorithm))) {
 178         CMSerr(0, CMS_R_KDF_PARAMETER_ERROR);
 179         return 0;
 180     }
 181
 182     if (alg->parameter->type != V_ASN1_SEQUENCE)
 183         return 0;
 184
 185     p = alg->parameter->value.sequence->data;
 186     plen = alg->parameter->value.sequence->length;
 187     kekalg = d2i_X509_ALGOR(NULL, &p, plen);
 188     if (kekalg == NULL)
 189         goto err;
 190     kekctx = CMS_RecipientInfo_kari_get0_ctx(ri);
 191     if (kekctx == NULL)
 192         goto err;
 193     name = OBJ_nid2sn(OBJ_obj2nid(kekalg->algorithm));
 194     kekcipher = EVP_CIPHER_fetch(pctx->libctx, name, pctx->propquery);
 195     if (kekcipher == NULL || EVP_CIPHER_mode(kekcipher) != EVP_CIPH_WRAP_MODE)
 196         goto err;
 197     if (!EVP_EncryptInit_ex(kekctx, kekcipher, NULL, NULL, NULL))
 198         goto err;
 199     if (EVP_CIPHER_asn1_to_param(kekctx, kekalg->parameter) <= 0)
 200         goto err;
 201
 202     keylen = EVP_CIPHER_CTX_key_length(kekctx);
 203     if (EVP_PKEY_CTX_set_ecdh_kdf_outlen(pctx, keylen) <= 0)
 204         goto err;
 205
 206     plen = CMS_SharedInfo_encode(&der, kekalg, ukm, keylen);
 207
 208     if (plen <= 0)
 209         goto err;
 210
 211     if (EVP_PKEY_CTX_set0_ecdh_kdf_ukm(pctx, der, plen) <= 0)
 212         goto err;
 213     der = NULL;
 214
 215     rv = 1;
 216  err:
 217     EVP_CIPHER_free(kekcipher);
 218     X509_ALGOR_free(kekalg);
 219     OPENSSL_free(der);
 220     return rv;
 221 }
 222
 223 static int ecdh_cms_decrypt(CMS_RecipientInfo *ri)
 224 {
 225     EVP_PKEY_CTX *pctx;
 226
 227     pctx = CMS_RecipientInfo_get0_pkey_ctx(ri);
 228     if (pctx == NULL)
 229         return 0;
 230     /* See if we need to set peer key */
 231     if (!EVP_PKEY_CTX_get0_peerkey(pctx)) {
 232         X509_ALGOR *alg;
 233         ASN1_BIT_STRING *pubkey;
 234
 235         if (!CMS_RecipientInfo_kari_get0_orig_id(ri, &alg, &pubkey,
 236                                                  NULL, NULL, NULL))
 237             return 0;
 238         if (alg == NULL || pubkey == NULL)
 239             return 0;
 240         if (!ecdh_cms_set_peerkey(pctx, alg, pubkey)) {
 241             CMSerr(0, CMS_R_PEER_KEY_ERROR);
 242             return 0;
 243         }
 244     }
 245     /* Set ECDH derivation parameters and initialise unwrap context */
 246     if (!ecdh_cms_set_shared_info(pctx, ri)) {
 247         CMSerr(0, CMS_R_SHARED_INFO_ERROR);
 248         return 0;
 249     }
 250     return 1;
 251 }
 252
 253 static int ecdh_cms_encrypt(CMS_RecipientInfo *ri)
 254 {
 255     EVP_PKEY_CTX *pctx;
 256     EVP_PKEY *pkey;
 257     EVP_CIPHER_CTX *ctx;
 258     int keylen;
 259     X509_ALGOR *talg, *wrap_alg = NULL;
 260     const ASN1_OBJECT *aoid;
 261     ASN1_BIT_STRING *pubkey;
 262     ASN1_STRING *wrap_str;
 263     ASN1_OCTET_STRING *ukm;
 264     unsigned char *penc = NULL;
 265     size_t penclen;
 266     int rv = 0;
 267     int ecdh_nid, kdf_type, kdf_nid, wrap_nid;
 268     const EVP_MD *kdf_md;
 269
 270     pctx = CMS_RecipientInfo_get0_pkey_ctx(ri);
 271     if (pctx == NULL)
 272         return 0;
 273     /* Get ephemeral key */
 274     pkey = EVP_PKEY_CTX_get0_pkey(pctx);
 275     if (!CMS_RecipientInfo_kari_get0_orig_id(ri, &talg, &pubkey,
 276                                              NULL, NULL, NULL))
 277         goto err;
 278     X509_ALGOR_get0(&aoid, NULL, NULL, talg);
 279     /* Is everything uninitialised? */
 280     if (aoid == OBJ_nid2obj(NID_undef)) {
 281         /* Set the key */
 282
 283         /* TODO(3.0): Terrible name. Needs a non TLS specific name */
 284         penclen = EVP_PKEY_get1_tls_encodedpoint(pkey, &penc);
 285         ASN1_STRING_set0(pubkey, penc, penclen);
 286         pubkey->flags &= ~(ASN1_STRING_FLAG_BITS_LEFT | 0x07);
 287         pubkey->flags |= ASN1_STRING_FLAG_BITS_LEFT;
 288
 289         penc = NULL;
 290         X509_ALGOR_set0(talg, OBJ_nid2obj(NID_X9_62_id_ecPublicKey),
 291                         V_ASN1_UNDEF, NULL);
 292     }
 293
 294     /* See if custom parameters set */
 295     kdf_type = EVP_PKEY_CTX_get_ecdh_kdf_type(pctx);
 296     if (kdf_type <= 0)
 297         goto err;
 298     if (!EVP_PKEY_CTX_get_ecdh_kdf_md(pctx, &kdf_md))
 299         goto err;
 300     ecdh_nid = EVP_PKEY_CTX_get_ecdh_cofactor_mode(pctx);
 301     if (ecdh_nid < 0)
 302         goto err;
 303     else if (ecdh_nid == 0)
 304         ecdh_nid = NID_dh_std_kdf;
 305     else if (ecdh_nid == 1)
 306         ecdh_nid = NID_dh_cofactor_kdf;
 307
 308     if (kdf_type == EVP_PKEY_ECDH_KDF_NONE) {
 309         kdf_type = EVP_PKEY_ECDH_KDF_X9_63;
 310         if (EVP_PKEY_CTX_set_ecdh_kdf_type(pctx, kdf_type) <= 0)
 311             goto err;
 312     } else
 313         /* Unknown KDF */
 314         goto err;
 315     if (kdf_md == NULL) {
 316         /* Fixme later for better MD */
 317         kdf_md = EVP_sha1();
 318         if (EVP_PKEY_CTX_set_ecdh_kdf_md(pctx, kdf_md) <= 0)
 319             goto err;
 320     }
 321
 322     if (!CMS_RecipientInfo_kari_get0_alg(ri, &talg, &ukm))
 323         goto err;
 324
 325     /* Lookup NID for KDF+cofactor+digest */
 326
 327     if (!OBJ_find_sigid_by_algs(&kdf_nid, EVP_MD_type(kdf_md), ecdh_nid))
 328         goto err;
 329     /* Get wrap NID */
 330     ctx = CMS_RecipientInfo_kari_get0_ctx(ri);
 331     wrap_nid = EVP_CIPHER_CTX_type(ctx);
 332     keylen = EVP_CIPHER_CTX_key_length(ctx);
 333
 334     /* Package wrap algorithm in an AlgorithmIdentifier */
 335
 336     wrap_alg = X509_ALGOR_new();
 337     if (wrap_alg == NULL)
 338         goto err;
 339     wrap_alg->algorithm = OBJ_nid2obj(wrap_nid);
 340     wrap_alg->parameter = ASN1_TYPE_new();
 341     if (wrap_alg->parameter == NULL)
 342         goto err;
 343     if (EVP_CIPHER_param_to_asn1(ctx, wrap_alg->parameter) <= 0)
 344         goto err;
 345     if (ASN1_TYPE_get(wrap_alg->parameter) == NID_undef) {
 346         ASN1_TYPE_free(wrap_alg->parameter);
 347         wrap_alg->parameter = NULL;
 348     }
 349
 350     if (EVP_PKEY_CTX_set_ecdh_kdf_outlen(pctx, keylen) <= 0)
 351         goto err;
 352
 353     penclen = CMS_SharedInfo_encode(&penc, wrap_alg, ukm, keylen);
 354
 355     if (penclen == 0)
 356         goto err;
 357
 358     if (EVP_PKEY_CTX_set0_ecdh_kdf_ukm(pctx, penc, penclen) <= 0)
 359         goto err;
 360     penc = NULL;
 361
 362     /*
 363      * Now need to wrap encoding of wrap AlgorithmIdentifier into parameter
 364      * of another AlgorithmIdentifier.
 365      */
 366     penclen = i2d_X509_ALGOR(wrap_alg, &penc);
 367     if (penc == NULL || penclen == 0)
 368         goto err;
 369     wrap_str = ASN1_STRING_new();
 370     if (wrap_str == NULL)
 371         goto err;
 372     ASN1_STRING_set0(wrap_str, penc, penclen);
 373     penc = NULL;
 374     X509_ALGOR_set0(talg, OBJ_nid2obj(kdf_nid), V_ASN1_SEQUENCE, wrap_str);
 375
 376     rv = 1;
 377
 378  err:
 379     OPENSSL_free(penc);
 380     X509_ALGOR_free(wrap_alg);
 381     return rv;
 382 }
 383
 384 int cms_ecdh_envelope(CMS_RecipientInfo *ri, int decrypt)
 385 {
 386     assert(decrypt == 0 || decrypt == 1);
 387
 388     if (decrypt == 1)
 389         return ecdh_cms_decrypt(ri);
 390
 391     if (decrypt == 0)
 392         return ecdh_cms_encrypt(ri);
 393
 394     CMSerr(0, CMS_R_NOT_SUPPORTED_FOR_THIS_KEY_TYPE);
 395     return 0;
 396 }
 397 #endif
 398
 399 /* ECDSA and DSA implementation is the same */
 400 int cms_ecdsa_dsa_sign(CMS_SignerInfo *si, int verify)
 401 {
 402     assert(verify == 0 || verify == 1);
 403
 404     if (verify == 0) {
 405         int snid, hnid;
 406         X509_ALGOR *alg1, *alg2;
 407         EVP_PKEY *pkey = si->pkey;
 408
 409         CMS_SignerInfo_get0_algs(si, NULL, NULL, &alg1, &alg2);
 410         if (alg1 == NULL || alg1->algorithm == NULL)
 411             return -1;
 412         hnid = OBJ_obj2nid(alg1->algorithm);
 413         if (hnid == NID_undef)
 414             return -1;
 415         if (!OBJ_find_sigid_by_algs(&snid, hnid, EVP_PKEY_id(pkey)))
 416             return -1;
 417         X509_ALGOR_set0(alg2, OBJ_nid2obj(snid), V_ASN1_UNDEF, 0);
 418     }
 419     return 1;
 420 }