2 * Copyright 2008-2020 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
10 #include "internal/cryptlib.h"
11 #include <openssl/asn1t.h>
12 #include <openssl/pem.h>
13 #include <openssl/x509v3.h>
14 #include <openssl/err.h>
15 #include <openssl/cms.h>
16 #include <openssl/evp.h>
17 #include "crypto/asn1.h"
18 #include "crypto/evp.h"
19 #include "crypto/x509.h"
20 #include "cms_local.h"
22 /* CMS EnvelopedData Utilities */
23 static void cms_env_set_version(CMS_EnvelopedData
*env
);
25 #define CMS_ENVELOPED_STANDARD 1
26 #define CMS_ENVELOPED_AUTH 2
28 static int cms_get_enveloped_type(const CMS_ContentInfo
*cms
)
30 int nid
= OBJ_obj2nid(cms
->contentType
);
33 case NID_pkcs7_enveloped
:
34 return CMS_ENVELOPED_STANDARD
;
36 case NID_id_smime_ct_authEnvelopedData
:
37 return CMS_ENVELOPED_AUTH
;
40 CMSerr(0, CMS_R_CONTENT_TYPE_NOT_ENVELOPED_DATA
);
45 CMS_EnvelopedData
*cms_get0_enveloped(CMS_ContentInfo
*cms
)
47 if (OBJ_obj2nid(cms
->contentType
) != NID_pkcs7_enveloped
) {
48 CMSerr(CMS_F_CMS_GET0_ENVELOPED
,
49 CMS_R_CONTENT_TYPE_NOT_ENVELOPED_DATA
);
52 return cms
->d
.envelopedData
;
55 CMS_AuthEnvelopedData
*cms_get0_auth_enveloped(CMS_ContentInfo
*cms
)
57 if (OBJ_obj2nid(cms
->contentType
) != NID_id_smime_ct_authEnvelopedData
) {
58 CMSerr(0, CMS_R_CONTENT_TYPE_NOT_ENVELOPED_DATA
);
61 return cms
->d
.authEnvelopedData
;
64 static CMS_EnvelopedData
*cms_enveloped_data_init(CMS_ContentInfo
*cms
)
66 if (cms
->d
.other
== NULL
) {
67 cms
->d
.envelopedData
= M_ASN1_new_of(CMS_EnvelopedData
);
68 if (cms
->d
.envelopedData
== NULL
) {
69 CMSerr(CMS_F_CMS_ENVELOPED_DATA_INIT
, ERR_R_MALLOC_FAILURE
);
72 cms
->d
.envelopedData
->version
= 0;
73 cms
->d
.envelopedData
->encryptedContentInfo
->contentType
=
74 OBJ_nid2obj(NID_pkcs7_data
);
75 ASN1_OBJECT_free(cms
->contentType
);
76 cms
->contentType
= OBJ_nid2obj(NID_pkcs7_enveloped
);
77 return cms
->d
.envelopedData
;
79 return cms_get0_enveloped(cms
);
82 static CMS_AuthEnvelopedData
*
83 cms_auth_enveloped_data_init(CMS_ContentInfo
*cms
)
85 if (cms
->d
.other
== NULL
) {
86 cms
->d
.authEnvelopedData
= M_ASN1_new_of(CMS_AuthEnvelopedData
);
87 if (cms
->d
.authEnvelopedData
== NULL
) {
88 CMSerr(0, ERR_R_MALLOC_FAILURE
);
91 /* Defined in RFC 5083 - Section 2.1. "AuthEnvelopedData Type" */
92 cms
->d
.authEnvelopedData
->version
= 0;
93 cms
->d
.authEnvelopedData
->authEncryptedContentInfo
->contentType
=
94 OBJ_nid2obj(NID_pkcs7_data
);
95 ASN1_OBJECT_free(cms
->contentType
);
96 cms
->contentType
= OBJ_nid2obj(NID_id_smime_ct_authEnvelopedData
);
97 return cms
->d
.authEnvelopedData
;
99 return cms_get0_auth_enveloped(cms
);
102 int cms_env_asn1_ctrl(CMS_RecipientInfo
*ri
, int cmd
)
106 if (ri
->type
== CMS_RECIPINFO_TRANS
)
107 pkey
= ri
->d
.ktri
->pkey
;
108 else if (ri
->type
== CMS_RECIPINFO_AGREE
) {
109 EVP_PKEY_CTX
*pctx
= ri
->d
.kari
->pctx
;
113 pkey
= EVP_PKEY_CTX_get0_pkey(pctx
);
119 if (EVP_PKEY_is_a(pkey
, "DHX"))
120 return cms_dh_envelope(ri
, cmd
);
121 else if (EVP_PKEY_is_a(pkey
, "EC"))
122 return cms_ecdh_envelope(ri
, cmd
);
123 else if (EVP_PKEY_is_a(pkey
, "RSA"))
124 return cms_rsa_envelope(ri
, cmd
);
126 /* Something else? We'll give engines etc a chance to handle this */
127 if (pkey
->ameth
== NULL
|| pkey
->ameth
->pkey_ctrl
== NULL
)
129 i
= pkey
->ameth
->pkey_ctrl(pkey
, ASN1_PKEY_CTRL_CMS_ENVELOPE
, cmd
, ri
);
131 CMSerr(CMS_F_CMS_ENV_ASN1_CTRL
,
132 CMS_R_NOT_SUPPORTED_FOR_THIS_KEY_TYPE
);
136 CMSerr(CMS_F_CMS_ENV_ASN1_CTRL
, CMS_R_CTRL_FAILURE
);
142 CMS_EncryptedContentInfo
* cms_get0_env_enc_content(const CMS_ContentInfo
*cms
)
144 switch (cms_get_enveloped_type(cms
)) {
145 case CMS_ENVELOPED_STANDARD
:
146 return cms
->d
.envelopedData
->encryptedContentInfo
;
148 case CMS_ENVELOPED_AUTH
:
149 return cms
->d
.authEnvelopedData
->authEncryptedContentInfo
;
156 STACK_OF(CMS_RecipientInfo
) *CMS_get0_RecipientInfos(CMS_ContentInfo
*cms
)
158 switch (cms_get_enveloped_type(cms
)) {
159 case CMS_ENVELOPED_STANDARD
:
160 return cms
->d
.envelopedData
->recipientInfos
;
162 case CMS_ENVELOPED_AUTH
:
163 return cms
->d
.authEnvelopedData
->recipientInfos
;
170 void cms_RecipientInfos_set_cmsctx(CMS_ContentInfo
*cms
)
173 CMS_RecipientInfo
*ri
;
174 const CMS_CTX
*ctx
= cms_get0_cmsctx(cms
);
175 STACK_OF(CMS_RecipientInfo
) *rinfos
= CMS_get0_RecipientInfos(cms
);
177 for (i
= 0; i
< sk_CMS_RecipientInfo_num(rinfos
); i
++) {
178 ri
= sk_CMS_RecipientInfo_value(rinfos
, i
);
181 case CMS_RECIPINFO_AGREE
:
182 ri
->d
.kari
->cms_ctx
= ctx
;
184 case CMS_RECIPINFO_TRANS
:
185 ri
->d
.ktri
->cms_ctx
= ctx
;
186 x509_set0_libctx(ri
->d
.ktri
->recip
, ctx
->libctx
, ctx
->propq
);
188 case CMS_RECIPINFO_KEK
:
189 ri
->d
.kekri
->cms_ctx
= ctx
;
191 case CMS_RECIPINFO_PASS
:
192 ri
->d
.pwri
->cms_ctx
= ctx
;
201 int CMS_RecipientInfo_type(CMS_RecipientInfo
*ri
)
206 EVP_PKEY_CTX
*CMS_RecipientInfo_get0_pkey_ctx(CMS_RecipientInfo
*ri
)
208 if (ri
->type
== CMS_RECIPINFO_TRANS
)
209 return ri
->d
.ktri
->pctx
;
210 else if (ri
->type
== CMS_RECIPINFO_AGREE
)
211 return ri
->d
.kari
->pctx
;
215 CMS_ContentInfo
*CMS_EnvelopedData_create_ex(const EVP_CIPHER
*cipher
,
219 CMS_ContentInfo
*cms
;
220 CMS_EnvelopedData
*env
;
222 cms
= CMS_ContentInfo_new_ex(libctx
, propq
);
225 env
= cms_enveloped_data_init(cms
);
229 if (!cms_EncryptedContent_init(env
->encryptedContentInfo
, cipher
, NULL
, 0,
230 cms_get0_cmsctx(cms
)))
234 CMS_ContentInfo_free(cms
);
235 CMSerr(0, ERR_R_MALLOC_FAILURE
);
239 CMS_ContentInfo
*CMS_EnvelopedData_create(const EVP_CIPHER
*cipher
)
241 return CMS_EnvelopedData_create_ex(cipher
, NULL
, NULL
);
245 CMS_AuthEnvelopedData_create_ex(const EVP_CIPHER
*cipher
, OPENSSL_CTX
*libctx
,
248 CMS_ContentInfo
*cms
;
249 CMS_AuthEnvelopedData
*aenv
;
251 cms
= CMS_ContentInfo_new_ex(libctx
, propq
);
254 aenv
= cms_auth_enveloped_data_init(cms
);
257 if (!cms_EncryptedContent_init(aenv
->authEncryptedContentInfo
,
258 cipher
, NULL
, 0, cms_get0_cmsctx(cms
)))
262 CMS_ContentInfo_free(cms
);
263 CMSerr(0, ERR_R_MALLOC_FAILURE
);
268 CMS_ContentInfo
*CMS_AuthEnvelopedData_create(const EVP_CIPHER
*cipher
)
270 return CMS_AuthEnvelopedData_create_ex(cipher
, NULL
, NULL
);
273 /* Key Transport Recipient Info (KTRI) routines */
275 /* Initialise a ktri based on passed certificate and key */
277 static int cms_RecipientInfo_ktri_init(CMS_RecipientInfo
*ri
, X509
*recip
,
278 EVP_PKEY
*pk
, unsigned int flags
,
281 CMS_KeyTransRecipientInfo
*ktri
;
284 ri
->d
.ktri
= M_ASN1_new_of(CMS_KeyTransRecipientInfo
);
287 ri
->type
= CMS_RECIPINFO_TRANS
;
292 if (flags
& CMS_USE_KEYID
) {
294 idtype
= CMS_RECIPINFO_KEYIDENTIFIER
;
297 idtype
= CMS_RECIPINFO_ISSUER_SERIAL
;
301 * Not a typo: RecipientIdentifier and SignerIdentifier are the same
305 if (!cms_set1_SignerIdentifier(ktri
->rid
, recip
, idtype
, ctx
))
314 if (flags
& CMS_KEY_PARAM
) {
315 ktri
->pctx
= EVP_PKEY_CTX_new_from_pkey(ctx
->libctx
, ktri
->pkey
,
317 if (ktri
->pctx
== NULL
)
319 if (EVP_PKEY_encrypt_init(ktri
->pctx
) <= 0)
321 } else if (!cms_env_asn1_ctrl(ri
, 0))
327 * Add a recipient certificate using appropriate type of RecipientInfo
330 CMS_RecipientInfo
*CMS_add1_recipient(CMS_ContentInfo
*cms
, X509
*recip
,
331 EVP_PKEY
*originatorPrivKey
,
332 X509
*originator
, unsigned int flags
)
334 CMS_RecipientInfo
*ri
= NULL
;
335 STACK_OF(CMS_RecipientInfo
) *ris
;
337 const CMS_CTX
*ctx
= cms_get0_cmsctx(cms
);
339 ris
= CMS_get0_RecipientInfos(cms
);
343 /* Initialize recipient info */
344 ri
= M_ASN1_new_of(CMS_RecipientInfo
);
348 pk
= X509_get0_pubkey(recip
);
350 CMSerr(CMS_F_CMS_ADD1_RECIPIENT
, CMS_R_ERROR_GETTING_PUBLIC_KEY
);
354 switch (cms_pkey_get_ri_type(pk
)) {
356 case CMS_RECIPINFO_TRANS
:
357 if (!cms_RecipientInfo_ktri_init(ri
, recip
, pk
, flags
, ctx
))
361 case CMS_RECIPINFO_AGREE
:
362 if (!cms_RecipientInfo_kari_init(ri
, recip
, pk
, originator
,
363 originatorPrivKey
, flags
, ctx
))
368 CMSerr(CMS_F_CMS_ADD1_RECIPIENT
,
369 CMS_R_NOT_SUPPORTED_FOR_THIS_KEY_TYPE
);
374 if (!sk_CMS_RecipientInfo_push(ris
, ri
))
380 CMSerr(CMS_F_CMS_ADD1_RECIPIENT
, ERR_R_MALLOC_FAILURE
);
382 M_ASN1_free_of(ri
, CMS_RecipientInfo
);
387 CMS_RecipientInfo
*CMS_add1_recipient_cert(CMS_ContentInfo
*cms
, X509
*recip
,
390 return CMS_add1_recipient(cms
, recip
, NULL
, NULL
, flags
);
393 int CMS_RecipientInfo_ktri_get0_algs(CMS_RecipientInfo
*ri
,
394 EVP_PKEY
**pk
, X509
**recip
,
397 CMS_KeyTransRecipientInfo
*ktri
;
398 if (ri
->type
!= CMS_RECIPINFO_TRANS
) {
399 CMSerr(CMS_F_CMS_RECIPIENTINFO_KTRI_GET0_ALGS
,
400 CMS_R_NOT_KEY_TRANSPORT
);
409 *recip
= ktri
->recip
;
411 *palg
= ktri
->keyEncryptionAlgorithm
;
415 int CMS_RecipientInfo_ktri_get0_signer_id(CMS_RecipientInfo
*ri
,
416 ASN1_OCTET_STRING
**keyid
,
420 CMS_KeyTransRecipientInfo
*ktri
;
421 if (ri
->type
!= CMS_RECIPINFO_TRANS
) {
422 CMSerr(CMS_F_CMS_RECIPIENTINFO_KTRI_GET0_SIGNER_ID
,
423 CMS_R_NOT_KEY_TRANSPORT
);
428 return cms_SignerIdentifier_get0_signer_id(ktri
->rid
, keyid
, issuer
, sno
);
431 int CMS_RecipientInfo_ktri_cert_cmp(CMS_RecipientInfo
*ri
, X509
*cert
)
433 if (ri
->type
!= CMS_RECIPINFO_TRANS
) {
434 CMSerr(CMS_F_CMS_RECIPIENTINFO_KTRI_CERT_CMP
,
435 CMS_R_NOT_KEY_TRANSPORT
);
438 return cms_SignerIdentifier_cert_cmp(ri
->d
.ktri
->rid
, cert
);
441 int CMS_RecipientInfo_set0_pkey(CMS_RecipientInfo
*ri
, EVP_PKEY
*pkey
)
443 if (ri
->type
!= CMS_RECIPINFO_TRANS
) {
444 CMSerr(CMS_F_CMS_RECIPIENTINFO_SET0_PKEY
, CMS_R_NOT_KEY_TRANSPORT
);
447 EVP_PKEY_free(ri
->d
.ktri
->pkey
);
448 ri
->d
.ktri
->pkey
= pkey
;
452 /* Encrypt content key in key transport recipient info */
454 static int cms_RecipientInfo_ktri_encrypt(const CMS_ContentInfo
*cms
,
455 CMS_RecipientInfo
*ri
)
457 CMS_KeyTransRecipientInfo
*ktri
;
458 CMS_EncryptedContentInfo
*ec
;
460 unsigned char *ek
= NULL
;
462 const CMS_CTX
*ctx
= cms_get0_cmsctx(cms
);
466 if (ri
->type
!= CMS_RECIPINFO_TRANS
) {
467 CMSerr(CMS_F_CMS_RECIPIENTINFO_KTRI_ENCRYPT
, CMS_R_NOT_KEY_TRANSPORT
);
471 ec
= cms_get0_env_enc_content(cms
);
476 if (!cms_env_asn1_ctrl(ri
, 0))
479 pctx
= EVP_PKEY_CTX_new_from_pkey(ctx
->libctx
, ktri
->pkey
, ctx
->propq
);
483 if (EVP_PKEY_encrypt_init(pctx
) <= 0)
487 if (EVP_PKEY_CTX_ctrl(pctx
, -1, EVP_PKEY_OP_ENCRYPT
,
488 EVP_PKEY_CTRL_CMS_ENCRYPT
, 0, ri
) <= 0) {
489 CMSerr(CMS_F_CMS_RECIPIENTINFO_KTRI_ENCRYPT
, CMS_R_CTRL_ERROR
);
493 if (EVP_PKEY_encrypt(pctx
, NULL
, &eklen
, ec
->key
, ec
->keylen
) <= 0)
496 ek
= OPENSSL_malloc(eklen
);
499 CMSerr(CMS_F_CMS_RECIPIENTINFO_KTRI_ENCRYPT
, ERR_R_MALLOC_FAILURE
);
503 if (EVP_PKEY_encrypt(pctx
, ek
, &eklen
, ec
->key
, ec
->keylen
) <= 0)
506 ASN1_STRING_set0(ktri
->encryptedKey
, ek
, eklen
);
512 EVP_PKEY_CTX_free(pctx
);
518 /* Decrypt content key from KTRI */
520 static int cms_RecipientInfo_ktri_decrypt(CMS_ContentInfo
*cms
,
521 CMS_RecipientInfo
*ri
)
523 CMS_KeyTransRecipientInfo
*ktri
= ri
->d
.ktri
;
524 EVP_PKEY
*pkey
= ktri
->pkey
;
525 unsigned char *ek
= NULL
;
529 const EVP_CIPHER
*cipher
= NULL
;
530 EVP_CIPHER
*fetched_cipher
= NULL
;
531 CMS_EncryptedContentInfo
*ec
;
532 const CMS_CTX
*ctx
= cms_get0_cmsctx(cms
);
534 ec
= cms_get0_env_enc_content(cms
);
536 if (ktri
->pkey
== NULL
) {
537 CMSerr(CMS_F_CMS_RECIPIENTINFO_KTRI_DECRYPT
, CMS_R_NO_PRIVATE_KEY
);
541 if (cms
->d
.envelopedData
->encryptedContentInfo
->havenocert
542 && !cms
->d
.envelopedData
->encryptedContentInfo
->debug
) {
543 X509_ALGOR
*calg
= ec
->contentEncryptionAlgorithm
;
544 const char *name
= OBJ_nid2sn(OBJ_obj2nid(calg
->algorithm
));
546 (void)ERR_set_mark();
547 fetched_cipher
= EVP_CIPHER_fetch(ctx
->libctx
, name
, ctx
->propq
);
549 if (fetched_cipher
!= NULL
)
550 cipher
= fetched_cipher
;
552 cipher
= EVP_get_cipherbyobj(calg
->algorithm
);
553 if (cipher
== NULL
) {
554 (void)ERR_clear_last_mark();
555 CMSerr(CMS_F_CMS_RECIPIENTINFO_KTRI_DECRYPT
, CMS_R_UNKNOWN_CIPHER
);
558 (void)ERR_pop_to_mark();
560 fixlen
= EVP_CIPHER_key_length(cipher
);
561 EVP_CIPHER_free(fetched_cipher
);
564 ktri
->pctx
= EVP_PKEY_CTX_new_from_pkey(ctx
->libctx
, pkey
, ctx
->propq
);
565 if (ktri
->pctx
== NULL
)
568 if (EVP_PKEY_decrypt_init(ktri
->pctx
) <= 0)
571 if (!cms_env_asn1_ctrl(ri
, 1))
574 if (EVP_PKEY_CTX_ctrl(ktri
->pctx
, -1, EVP_PKEY_OP_DECRYPT
,
575 EVP_PKEY_CTRL_CMS_DECRYPT
, 0, ri
) <= 0) {
576 CMSerr(CMS_F_CMS_RECIPIENTINFO_KTRI_DECRYPT
, CMS_R_CTRL_ERROR
);
580 if (EVP_PKEY_decrypt(ktri
->pctx
, NULL
, &eklen
,
581 ktri
->encryptedKey
->data
,
582 ktri
->encryptedKey
->length
) <= 0)
585 ek
= OPENSSL_malloc(eklen
);
587 CMSerr(CMS_F_CMS_RECIPIENTINFO_KTRI_DECRYPT
, ERR_R_MALLOC_FAILURE
);
591 if (EVP_PKEY_decrypt(ktri
->pctx
, ek
, &eklen
,
592 ktri
->encryptedKey
->data
,
593 ktri
->encryptedKey
->length
) <= 0
595 || (fixlen
!= 0 && eklen
!= fixlen
)) {
596 CMSerr(CMS_F_CMS_RECIPIENTINFO_KTRI_DECRYPT
, CMS_R_CMS_LIB
);
602 OPENSSL_clear_free(ec
->key
, ec
->keylen
);
607 EVP_PKEY_CTX_free(ktri
->pctx
);
615 /* Key Encrypted Key (KEK) RecipientInfo routines */
617 int CMS_RecipientInfo_kekri_id_cmp(CMS_RecipientInfo
*ri
,
618 const unsigned char *id
, size_t idlen
)
620 ASN1_OCTET_STRING tmp_os
;
621 CMS_KEKRecipientInfo
*kekri
;
622 if (ri
->type
!= CMS_RECIPINFO_KEK
) {
623 CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_ID_CMP
, CMS_R_NOT_KEK
);
627 tmp_os
.type
= V_ASN1_OCTET_STRING
;
629 tmp_os
.data
= (unsigned char *)id
;
630 tmp_os
.length
= (int)idlen
;
631 return ASN1_OCTET_STRING_cmp(&tmp_os
, kekri
->kekid
->keyIdentifier
);
634 /* For now hard code AES key wrap info */
636 static size_t aes_wrap_keylen(int nid
)
639 case NID_id_aes128_wrap
:
642 case NID_id_aes192_wrap
:
645 case NID_id_aes256_wrap
:
653 CMS_RecipientInfo
*CMS_add0_recipient_key(CMS_ContentInfo
*cms
, int nid
,
654 unsigned char *key
, size_t keylen
,
655 unsigned char *id
, size_t idlen
,
656 ASN1_GENERALIZEDTIME
*date
,
657 ASN1_OBJECT
*otherTypeId
,
658 ASN1_TYPE
*otherType
)
660 CMS_RecipientInfo
*ri
= NULL
;
661 CMS_KEKRecipientInfo
*kekri
;
662 STACK_OF(CMS_RecipientInfo
) *ris
= CMS_get0_RecipientInfos(cms
);
667 if (nid
== NID_undef
) {
670 nid
= NID_id_aes128_wrap
;
674 nid
= NID_id_aes192_wrap
;
678 nid
= NID_id_aes256_wrap
;
682 CMSerr(CMS_F_CMS_ADD0_RECIPIENT_KEY
, CMS_R_INVALID_KEY_LENGTH
);
688 size_t exp_keylen
= aes_wrap_keylen(nid
);
691 CMSerr(CMS_F_CMS_ADD0_RECIPIENT_KEY
,
692 CMS_R_UNSUPPORTED_KEK_ALGORITHM
);
696 if (keylen
!= exp_keylen
) {
697 CMSerr(CMS_F_CMS_ADD0_RECIPIENT_KEY
, CMS_R_INVALID_KEY_LENGTH
);
703 /* Initialize recipient info */
704 ri
= M_ASN1_new_of(CMS_RecipientInfo
);
708 ri
->d
.kekri
= M_ASN1_new_of(CMS_KEKRecipientInfo
);
711 ri
->type
= CMS_RECIPINFO_KEK
;
716 kekri
->kekid
->other
= M_ASN1_new_of(CMS_OtherKeyAttribute
);
717 if (kekri
->kekid
->other
== NULL
)
721 if (!sk_CMS_RecipientInfo_push(ris
, ri
))
724 /* After this point no calls can fail */
729 kekri
->keylen
= keylen
;
731 ASN1_STRING_set0(kekri
->kekid
->keyIdentifier
, id
, idlen
);
733 kekri
->kekid
->date
= date
;
735 if (kekri
->kekid
->other
) {
736 kekri
->kekid
->other
->keyAttrId
= otherTypeId
;
737 kekri
->kekid
->other
->keyAttr
= otherType
;
740 X509_ALGOR_set0(kekri
->keyEncryptionAlgorithm
,
741 OBJ_nid2obj(nid
), V_ASN1_UNDEF
, NULL
);
746 CMSerr(CMS_F_CMS_ADD0_RECIPIENT_KEY
, ERR_R_MALLOC_FAILURE
);
748 M_ASN1_free_of(ri
, CMS_RecipientInfo
);
752 int CMS_RecipientInfo_kekri_get0_id(CMS_RecipientInfo
*ri
,
754 ASN1_OCTET_STRING
**pid
,
755 ASN1_GENERALIZEDTIME
**pdate
,
756 ASN1_OBJECT
**potherid
,
757 ASN1_TYPE
**pothertype
)
759 CMS_KEKIdentifier
*rkid
;
760 if (ri
->type
!= CMS_RECIPINFO_KEK
) {
761 CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_GET0_ID
, CMS_R_NOT_KEK
);
764 rkid
= ri
->d
.kekri
->kekid
;
766 *palg
= ri
->d
.kekri
->keyEncryptionAlgorithm
;
768 *pid
= rkid
->keyIdentifier
;
773 *potherid
= rkid
->other
->keyAttrId
;
779 *pothertype
= rkid
->other
->keyAttr
;
786 int CMS_RecipientInfo_set0_key(CMS_RecipientInfo
*ri
,
787 unsigned char *key
, size_t keylen
)
789 CMS_KEKRecipientInfo
*kekri
;
790 if (ri
->type
!= CMS_RECIPINFO_KEK
) {
791 CMSerr(CMS_F_CMS_RECIPIENTINFO_SET0_KEY
, CMS_R_NOT_KEK
);
797 kekri
->keylen
= keylen
;
801 static EVP_CIPHER
*cms_get_key_wrap_cipher(size_t keylen
, const CMS_CTX
*ctx
)
803 const char *alg
= NULL
;
807 alg
= "AES-128-WRAP";
810 alg
= "AES-192-WRAP";
813 alg
= "AES-256-WRAP";
818 return EVP_CIPHER_fetch(ctx
->libctx
, alg
, ctx
->propq
);
822 /* Encrypt content key in KEK recipient info */
824 static int cms_RecipientInfo_kekri_encrypt(const CMS_ContentInfo
*cms
,
825 CMS_RecipientInfo
*ri
)
827 CMS_EncryptedContentInfo
*ec
;
828 CMS_KEKRecipientInfo
*kekri
;
829 unsigned char *wkey
= NULL
;
832 EVP_CIPHER
*cipher
= NULL
;
834 EVP_CIPHER_CTX
*ctx
= NULL
;
835 const CMS_CTX
*cms_ctx
= cms_get0_cmsctx(cms
);
837 ec
= cms_get0_env_enc_content(cms
);
843 if (kekri
->key
== NULL
) {
844 CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_ENCRYPT
, CMS_R_NO_KEY
);
848 cipher
= cms_get_key_wrap_cipher(kekri
->keylen
, cms_ctx
);
849 if (cipher
== NULL
) {
850 CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_ENCRYPT
, CMS_R_INVALID_KEY_LENGTH
);
854 /* 8 byte prefix for AES wrap ciphers */
855 wkey
= OPENSSL_malloc(ec
->keylen
+ 8);
857 CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_ENCRYPT
, ERR_R_MALLOC_FAILURE
);
861 ctx
= EVP_CIPHER_CTX_new();
863 CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_ENCRYPT
, ERR_R_MALLOC_FAILURE
);
867 EVP_CIPHER_CTX_set_flags(ctx
, EVP_CIPHER_CTX_FLAG_WRAP_ALLOW
);
868 if (!EVP_EncryptInit_ex(ctx
, cipher
, NULL
, kekri
->key
, NULL
)
869 || !EVP_EncryptUpdate(ctx
, wkey
, &wkeylen
, ec
->key
, ec
->keylen
)
870 || !EVP_EncryptFinal_ex(ctx
, wkey
+ wkeylen
, &outlen
)) {
871 CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_ENCRYPT
, CMS_R_WRAP_ERROR
);
875 if (!ossl_assert((size_t)wkeylen
== ec
->keylen
+ 8)) {
876 CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_ENCRYPT
, CMS_R_WRAP_ERROR
);
880 ASN1_STRING_set0(kekri
->encryptedKey
, wkey
, wkeylen
);
885 EVP_CIPHER_free(cipher
);
888 EVP_CIPHER_CTX_free(ctx
);
893 /* Decrypt content key in KEK recipient info */
895 static int cms_RecipientInfo_kekri_decrypt(CMS_ContentInfo
*cms
,
896 CMS_RecipientInfo
*ri
)
898 CMS_EncryptedContentInfo
*ec
;
899 CMS_KEKRecipientInfo
*kekri
;
900 unsigned char *ukey
= NULL
;
903 EVP_CIPHER
*cipher
= NULL
;
905 EVP_CIPHER_CTX
*ctx
= NULL
;
906 const CMS_CTX
*cms_ctx
= cms_get0_cmsctx(cms
);
908 ec
= cms_get0_env_enc_content(cms
);
915 CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_DECRYPT
, CMS_R_NO_KEY
);
919 wrap_nid
= OBJ_obj2nid(kekri
->keyEncryptionAlgorithm
->algorithm
);
920 if (aes_wrap_keylen(wrap_nid
) != kekri
->keylen
) {
921 CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_DECRYPT
,
922 CMS_R_INVALID_KEY_LENGTH
);
926 /* If encrypted key length is invalid don't bother */
928 if (kekri
->encryptedKey
->length
< 16) {
929 CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_DECRYPT
,
930 CMS_R_INVALID_ENCRYPTED_KEY_LENGTH
);
934 cipher
= cms_get_key_wrap_cipher(kekri
->keylen
, cms_ctx
);
935 if (cipher
== NULL
) {
936 CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_DECRYPT
, CMS_R_INVALID_KEY_LENGTH
);
940 ukey
= OPENSSL_malloc(kekri
->encryptedKey
->length
- 8);
942 CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_DECRYPT
, ERR_R_MALLOC_FAILURE
);
946 ctx
= EVP_CIPHER_CTX_new();
948 CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_DECRYPT
, ERR_R_MALLOC_FAILURE
);
952 if (!EVP_DecryptInit_ex(ctx
, cipher
, NULL
, kekri
->key
, NULL
)
953 || !EVP_DecryptUpdate(ctx
, ukey
, &ukeylen
,
954 kekri
->encryptedKey
->data
,
955 kekri
->encryptedKey
->length
)
956 || !EVP_DecryptFinal_ex(ctx
, ukey
+ ukeylen
, &outlen
)) {
957 CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_DECRYPT
, CMS_R_UNWRAP_ERROR
);
963 ec
->keylen
= ukeylen
;
968 EVP_CIPHER_free(cipher
);
971 EVP_CIPHER_CTX_free(ctx
);
976 int CMS_RecipientInfo_decrypt(CMS_ContentInfo
*cms
, CMS_RecipientInfo
*ri
)
979 case CMS_RECIPINFO_TRANS
:
980 return cms_RecipientInfo_ktri_decrypt(cms
, ri
);
982 case CMS_RECIPINFO_KEK
:
983 return cms_RecipientInfo_kekri_decrypt(cms
, ri
);
985 case CMS_RECIPINFO_PASS
:
986 return cms_RecipientInfo_pwri_crypt(cms
, ri
, 0);
989 CMSerr(CMS_F_CMS_RECIPIENTINFO_DECRYPT
,
990 CMS_R_UNSUPPORTED_RECIPIENTINFO_TYPE
);
995 int CMS_RecipientInfo_encrypt(const CMS_ContentInfo
*cms
, CMS_RecipientInfo
*ri
)
998 case CMS_RECIPINFO_TRANS
:
999 return cms_RecipientInfo_ktri_encrypt(cms
, ri
);
1001 case CMS_RECIPINFO_AGREE
:
1002 return cms_RecipientInfo_kari_encrypt(cms
, ri
);
1004 case CMS_RECIPINFO_KEK
:
1005 return cms_RecipientInfo_kekri_encrypt(cms
, ri
);
1007 case CMS_RECIPINFO_PASS
:
1008 return cms_RecipientInfo_pwri_crypt(cms
, ri
, 1);
1011 CMSerr(CMS_F_CMS_RECIPIENTINFO_ENCRYPT
,
1012 CMS_R_UNSUPPORTED_RECIPIENT_TYPE
);
1017 /* Check structures and fixup version numbers (if necessary) */
1019 static void cms_env_set_originfo_version(CMS_EnvelopedData
*env
)
1021 CMS_OriginatorInfo
*org
= env
->originatorInfo
;
1025 for (i
= 0; i
< sk_CMS_CertificateChoices_num(org
->certificates
); i
++) {
1026 CMS_CertificateChoices
*cch
;
1027 cch
= sk_CMS_CertificateChoices_value(org
->certificates
, i
);
1028 if (cch
->type
== CMS_CERTCHOICE_OTHER
) {
1031 } else if (cch
->type
== CMS_CERTCHOICE_V2ACERT
) {
1032 if (env
->version
< 3)
1037 for (i
= 0; i
< sk_CMS_RevocationInfoChoice_num(org
->crls
); i
++) {
1038 CMS_RevocationInfoChoice
*rch
;
1039 rch
= sk_CMS_RevocationInfoChoice_value(org
->crls
, i
);
1040 if (rch
->type
== CMS_REVCHOICE_OTHER
) {
1047 static void cms_env_set_version(CMS_EnvelopedData
*env
)
1050 CMS_RecipientInfo
*ri
;
1053 * Can't set version higher than 4 so if 4 or more already nothing to do.
1055 if (env
->version
>= 4)
1058 cms_env_set_originfo_version(env
);
1060 if (env
->version
>= 3)
1063 for (i
= 0; i
< sk_CMS_RecipientInfo_num(env
->recipientInfos
); i
++) {
1064 ri
= sk_CMS_RecipientInfo_value(env
->recipientInfos
, i
);
1065 if (ri
->type
== CMS_RECIPINFO_PASS
|| ri
->type
== CMS_RECIPINFO_OTHER
) {
1068 } else if (ri
->type
!= CMS_RECIPINFO_TRANS
1069 || ri
->d
.ktri
->version
!= 0) {
1073 if (env
->originatorInfo
|| env
->unprotectedAttrs
)
1075 if (env
->version
== 2)
1080 static int cms_env_encrypt_content_key(const CMS_ContentInfo
*cms
,
1081 STACK_OF(CMS_RecipientInfo
) *ris
)
1084 CMS_RecipientInfo
*ri
;
1086 for (i
= 0; i
< sk_CMS_RecipientInfo_num(ris
); i
++) {
1087 ri
= sk_CMS_RecipientInfo_value(ris
, i
);
1088 if (CMS_RecipientInfo_encrypt(cms
, ri
) <= 0)
1094 static void cms_env_clear_ec(CMS_EncryptedContentInfo
*ec
)
1097 OPENSSL_clear_free(ec
->key
, ec
->keylen
);
1102 static BIO
*cms_EnvelopedData_Decryption_init_bio(CMS_ContentInfo
*cms
)
1104 CMS_EncryptedContentInfo
*ec
= cms
->d
.envelopedData
->encryptedContentInfo
;
1105 BIO
*contentBio
= cms_EncryptedContent_init_bio(ec
, cms_get0_cmsctx(cms
));
1106 EVP_CIPHER_CTX
*ctx
= NULL
;
1108 if (contentBio
== NULL
)
1111 BIO_get_cipher_ctx(contentBio
, &ctx
);
1113 BIO_free(contentBio
);
1117 * If the selected cipher supports unprotected attributes,
1118 * deal with it using special ctrl function
1120 if ((EVP_CIPHER_flags(EVP_CIPHER_CTX_cipher(ctx
)) & EVP_CIPH_FLAG_CIPHER_WITH_MAC
)
1121 && EVP_CIPHER_CTX_ctrl(ctx
, EVP_CTRL_PROCESS_UNPROTECTED
, 0,
1122 cms
->d
.envelopedData
->unprotectedAttrs
) <= 0) {
1123 BIO_free(contentBio
);
1129 static BIO
*cms_EnvelopedData_Encryption_init_bio(CMS_ContentInfo
*cms
)
1131 CMS_EncryptedContentInfo
*ec
;
1132 STACK_OF(CMS_RecipientInfo
) *rinfos
;
1135 CMS_EnvelopedData
*env
= cms
->d
.envelopedData
;
1137 /* Get BIO first to set up key */
1139 ec
= env
->encryptedContentInfo
;
1140 ret
= cms_EncryptedContent_init_bio(ec
, cms_get0_cmsctx(cms
));
1142 /* If error end of processing */
1146 /* Now encrypt content key according to each RecipientInfo type */
1147 rinfos
= env
->recipientInfos
;
1148 if (cms_env_encrypt_content_key(cms
, rinfos
) < 0) {
1149 CMSerr(CMS_F_CMS_ENVELOPEDDATA_ENCRYPTION_INIT_BIO
,
1150 CMS_R_ERROR_SETTING_RECIPIENTINFO
);
1154 /* And finally set the version */
1155 cms_env_set_version(env
);
1160 cms_env_clear_ec(ec
);
1167 BIO
*cms_EnvelopedData_init_bio(CMS_ContentInfo
*cms
)
1169 if (cms
->d
.envelopedData
->encryptedContentInfo
->cipher
!= NULL
) {
1170 /* If cipher is set it's encryption */
1171 return cms_EnvelopedData_Encryption_init_bio(cms
);
1174 /* If cipher is not set it's decryption */
1175 return cms_EnvelopedData_Decryption_init_bio(cms
);
1178 BIO
*cms_AuthEnvelopedData_init_bio(CMS_ContentInfo
*cms
)
1180 CMS_EncryptedContentInfo
*ec
;
1181 STACK_OF(CMS_RecipientInfo
) *rinfos
;
1184 CMS_AuthEnvelopedData
*aenv
= cms
->d
.authEnvelopedData
;
1186 /* Get BIO first to set up key */
1187 ec
= aenv
->authEncryptedContentInfo
;
1188 /* Set tag for decryption */
1189 if (ec
->cipher
== NULL
) {
1190 ec
->tag
= aenv
->mac
->data
;
1191 ec
->taglen
= aenv
->mac
->length
;
1193 ret
= cms_EncryptedContent_init_bio(ec
, cms_get0_cmsctx(cms
));
1195 /* If error or no cipher end of processing */
1196 if (ret
== NULL
|| ec
->cipher
== NULL
)
1199 /* Now encrypt content key according to each RecipientInfo type */
1200 rinfos
= aenv
->recipientInfos
;
1201 if (cms_env_encrypt_content_key(cms
, rinfos
) < 0) {
1202 CMSerr(0, CMS_R_ERROR_SETTING_RECIPIENTINFO
);
1206 /* And finally set the version */
1212 cms_env_clear_ec(ec
);
1219 int cms_EnvelopedData_final(CMS_ContentInfo
*cms
, BIO
*chain
)
1221 CMS_EnvelopedData
*env
= NULL
;
1222 EVP_CIPHER_CTX
*ctx
= NULL
;
1223 BIO
*mbio
= BIO_find_type(chain
, BIO_TYPE_CIPHER
);
1225 env
= cms_get0_enveloped(cms
);
1230 CMSerr(CMS_F_CMS_ENVELOPEDDATA_FINAL
, CMS_R_CONTENT_NOT_FOUND
);
1234 BIO_get_cipher_ctx(mbio
, &ctx
);
1237 * If the selected cipher supports unprotected attributes,
1238 * deal with it using special ctrl function
1240 if (EVP_CIPHER_flags(EVP_CIPHER_CTX_cipher(ctx
)) & EVP_CIPH_FLAG_CIPHER_WITH_MAC
) {
1241 if (env
->unprotectedAttrs
== NULL
)
1242 env
->unprotectedAttrs
= sk_X509_ATTRIBUTE_new_null();
1244 if (env
->unprotectedAttrs
== NULL
) {
1245 CMSerr(CMS_F_CMS_ENVELOPEDDATA_FINAL
, ERR_R_MALLOC_FAILURE
);
1249 if (EVP_CIPHER_CTX_ctrl(ctx
, EVP_CTRL_PROCESS_UNPROTECTED
,
1250 1, env
->unprotectedAttrs
) <= 0) {
1251 CMSerr(CMS_F_CMS_ENVELOPEDDATA_FINAL
, CMS_R_CTRL_FAILURE
);
1256 cms_env_set_version(cms
->d
.envelopedData
);
1260 int cms_AuthEnvelopedData_final(CMS_ContentInfo
*cms
, BIO
*cmsbio
)
1262 EVP_CIPHER_CTX
*ctx
;
1263 unsigned char *tag
= NULL
;
1266 BIO_get_cipher_ctx(cmsbio
, &ctx
);
1269 * The tag is set only for encryption. There is nothing to do for
1272 if (!EVP_CIPHER_CTX_encrypting(ctx
))
1275 taglen
= EVP_CIPHER_CTX_tag_length(ctx
);
1277 || (tag
= OPENSSL_malloc(taglen
)) == NULL
1278 || EVP_CIPHER_CTX_ctrl(ctx
, EVP_CTRL_AEAD_GET_TAG
, taglen
,
1280 CMSerr(0, CMS_R_CIPHER_GET_TAG
);
1284 if (!ASN1_OCTET_STRING_set(cms
->d
.authEnvelopedData
->mac
, tag
, taglen
))
1294 * Get RecipientInfo type (if any) supported by a key (public or private). To
1295 * retain compatibility with previous behaviour if the ctrl value isn't
1296 * supported we assume key transport.
1298 int cms_pkey_get_ri_type(EVP_PKEY
*pk
)
1300 if (pk
->ameth
&& pk
->ameth
->pkey_ctrl
) {
1302 i
= pk
->ameth
->pkey_ctrl(pk
, ASN1_PKEY_CTRL_CMS_RI_TYPE
, 0, &r
);
1306 return CMS_RECIPINFO_TRANS
;
1309 int cms_pkey_is_ri_type_supported(EVP_PKEY
*pk
, int ri_type
)
1311 int supportedRiType
;
1313 if (pk
->ameth
!= NULL
&& pk
->ameth
->pkey_ctrl
!= NULL
) {
1316 i
= pk
->ameth
->pkey_ctrl(pk
, ASN1_PKEY_CTRL_CMS_IS_RI_TYPE_SUPPORTED
,
1322 supportedRiType
= cms_pkey_get_ri_type(pk
);
1323 if (supportedRiType
< 0)
1326 return (supportedRiType
== ri_type
);