2 * Copyright 2008-2020 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
10 #include "internal/cryptlib.h"
11 #include <openssl/asn1t.h>
12 #include <openssl/pem.h>
13 #include <openssl/x509v3.h>
14 #include <openssl/err.h>
15 #include <openssl/cms.h>
16 #include <openssl/evp.h>
17 #include "crypto/asn1.h"
18 #include "crypto/evp.h"
19 #include "crypto/x509.h"
20 #include "cms_local.h"
22 /* CMS EnvelopedData Utilities */
23 static void cms_env_set_version(CMS_EnvelopedData
*env
);
25 #define CMS_ENVELOPED_STANDARD 1
26 #define CMS_ENVELOPED_AUTH 2
28 static int cms_get_enveloped_type(const CMS_ContentInfo
*cms
)
30 int nid
= OBJ_obj2nid(cms
->contentType
);
33 case NID_pkcs7_enveloped
:
34 return CMS_ENVELOPED_STANDARD
;
36 case NID_id_smime_ct_authEnvelopedData
:
37 return CMS_ENVELOPED_AUTH
;
40 CMSerr(0, CMS_R_CONTENT_TYPE_NOT_ENVELOPED_DATA
);
45 CMS_EnvelopedData
*cms_get0_enveloped(CMS_ContentInfo
*cms
)
47 if (OBJ_obj2nid(cms
->contentType
) != NID_pkcs7_enveloped
) {
48 CMSerr(CMS_F_CMS_GET0_ENVELOPED
,
49 CMS_R_CONTENT_TYPE_NOT_ENVELOPED_DATA
);
52 return cms
->d
.envelopedData
;
55 CMS_AuthEnvelopedData
*cms_get0_auth_enveloped(CMS_ContentInfo
*cms
)
57 if (OBJ_obj2nid(cms
->contentType
) != NID_id_smime_ct_authEnvelopedData
) {
58 CMSerr(0, CMS_R_CONTENT_TYPE_NOT_ENVELOPED_DATA
);
61 return cms
->d
.authEnvelopedData
;
64 static CMS_EnvelopedData
*cms_enveloped_data_init(CMS_ContentInfo
*cms
)
66 if (cms
->d
.other
== NULL
) {
67 cms
->d
.envelopedData
= M_ASN1_new_of(CMS_EnvelopedData
);
68 if (cms
->d
.envelopedData
== NULL
) {
69 CMSerr(CMS_F_CMS_ENVELOPED_DATA_INIT
, ERR_R_MALLOC_FAILURE
);
72 cms
->d
.envelopedData
->version
= 0;
73 cms
->d
.envelopedData
->encryptedContentInfo
->contentType
=
74 OBJ_nid2obj(NID_pkcs7_data
);
75 ASN1_OBJECT_free(cms
->contentType
);
76 cms
->contentType
= OBJ_nid2obj(NID_pkcs7_enveloped
);
77 return cms
->d
.envelopedData
;
79 return cms_get0_enveloped(cms
);
82 static CMS_AuthEnvelopedData
*
83 cms_auth_enveloped_data_init(CMS_ContentInfo
*cms
)
85 if (cms
->d
.other
== NULL
) {
86 cms
->d
.authEnvelopedData
= M_ASN1_new_of(CMS_AuthEnvelopedData
);
87 if (cms
->d
.authEnvelopedData
== NULL
) {
88 CMSerr(0, ERR_R_MALLOC_FAILURE
);
91 /* Defined in RFC 5083 - Section 2.1. "AuthEnvelopedData Type" */
92 cms
->d
.authEnvelopedData
->version
= 0;
93 cms
->d
.authEnvelopedData
->authEncryptedContentInfo
->contentType
=
94 OBJ_nid2obj(NID_pkcs7_data
);
95 ASN1_OBJECT_free(cms
->contentType
);
96 cms
->contentType
= OBJ_nid2obj(NID_id_smime_ct_authEnvelopedData
);
97 return cms
->d
.authEnvelopedData
;
99 return cms_get0_auth_enveloped(cms
);
102 int cms_env_asn1_ctrl(CMS_RecipientInfo
*ri
, int cmd
)
106 if (ri
->type
== CMS_RECIPINFO_TRANS
)
107 pkey
= ri
->d
.ktri
->pkey
;
108 else if (ri
->type
== CMS_RECIPINFO_AGREE
) {
109 EVP_PKEY_CTX
*pctx
= ri
->d
.kari
->pctx
;
113 pkey
= EVP_PKEY_CTX_get0_pkey(pctx
);
119 #ifndef OPENSSL_NO_DH
120 if (EVP_PKEY_is_a(pkey
, "DHX"))
121 return cms_dh_envelope(ri
, cmd
);
124 #ifndef OPENSSL_NO_EC
125 if (EVP_PKEY_is_a(pkey
, "EC"))
126 return cms_ecdh_envelope(ri
, cmd
);
129 if (EVP_PKEY_is_a(pkey
, "RSA"))
130 return cms_rsa_envelope(ri
, cmd
);
132 /* Something else? We'll give engines etc a chance to handle this */
133 if (pkey
->ameth
== NULL
|| pkey
->ameth
->pkey_ctrl
== NULL
)
135 i
= pkey
->ameth
->pkey_ctrl(pkey
, ASN1_PKEY_CTRL_CMS_ENVELOPE
, cmd
, ri
);
137 CMSerr(CMS_F_CMS_ENV_ASN1_CTRL
,
138 CMS_R_NOT_SUPPORTED_FOR_THIS_KEY_TYPE
);
142 CMSerr(CMS_F_CMS_ENV_ASN1_CTRL
, CMS_R_CTRL_FAILURE
);
148 CMS_EncryptedContentInfo
* cms_get0_env_enc_content(const CMS_ContentInfo
*cms
)
150 switch (cms_get_enveloped_type(cms
)) {
151 case CMS_ENVELOPED_STANDARD
:
152 return cms
->d
.envelopedData
->encryptedContentInfo
;
154 case CMS_ENVELOPED_AUTH
:
155 return cms
->d
.authEnvelopedData
->authEncryptedContentInfo
;
162 STACK_OF(CMS_RecipientInfo
) *CMS_get0_RecipientInfos(CMS_ContentInfo
*cms
)
164 switch (cms_get_enveloped_type(cms
)) {
165 case CMS_ENVELOPED_STANDARD
:
166 return cms
->d
.envelopedData
->recipientInfos
;
168 case CMS_ENVELOPED_AUTH
:
169 return cms
->d
.authEnvelopedData
->recipientInfos
;
176 void cms_RecipientInfos_set_cmsctx(CMS_ContentInfo
*cms
)
179 CMS_RecipientInfo
*ri
;
180 const CMS_CTX
*ctx
= cms_get0_cmsctx(cms
);
181 STACK_OF(CMS_RecipientInfo
) *rinfos
= CMS_get0_RecipientInfos(cms
);
183 for (i
= 0; i
< sk_CMS_RecipientInfo_num(rinfos
); i
++) {
184 ri
= sk_CMS_RecipientInfo_value(rinfos
, i
);
187 case CMS_RECIPINFO_AGREE
:
188 ri
->d
.kari
->cms_ctx
= ctx
;
190 case CMS_RECIPINFO_TRANS
:
191 ri
->d
.ktri
->cms_ctx
= ctx
;
192 x509_set0_libctx(ri
->d
.ktri
->recip
, ctx
->libctx
, ctx
->propq
);
194 case CMS_RECIPINFO_KEK
:
195 ri
->d
.kekri
->cms_ctx
= ctx
;
197 case CMS_RECIPINFO_PASS
:
198 ri
->d
.pwri
->cms_ctx
= ctx
;
207 int CMS_RecipientInfo_type(CMS_RecipientInfo
*ri
)
212 EVP_PKEY_CTX
*CMS_RecipientInfo_get0_pkey_ctx(CMS_RecipientInfo
*ri
)
214 if (ri
->type
== CMS_RECIPINFO_TRANS
)
215 return ri
->d
.ktri
->pctx
;
216 else if (ri
->type
== CMS_RECIPINFO_AGREE
)
217 return ri
->d
.kari
->pctx
;
221 CMS_ContentInfo
*CMS_EnvelopedData_create_ex(const EVP_CIPHER
*cipher
,
222 OSSL_LIB_CTX
*libctx
,
225 CMS_ContentInfo
*cms
;
226 CMS_EnvelopedData
*env
;
228 cms
= CMS_ContentInfo_new_ex(libctx
, propq
);
231 env
= cms_enveloped_data_init(cms
);
235 if (!cms_EncryptedContent_init(env
->encryptedContentInfo
, cipher
, NULL
, 0,
236 cms_get0_cmsctx(cms
)))
240 CMS_ContentInfo_free(cms
);
241 CMSerr(0, ERR_R_MALLOC_FAILURE
);
245 CMS_ContentInfo
*CMS_EnvelopedData_create(const EVP_CIPHER
*cipher
)
247 return CMS_EnvelopedData_create_ex(cipher
, NULL
, NULL
);
251 CMS_AuthEnvelopedData_create_ex(const EVP_CIPHER
*cipher
, OSSL_LIB_CTX
*libctx
,
254 CMS_ContentInfo
*cms
;
255 CMS_AuthEnvelopedData
*aenv
;
257 cms
= CMS_ContentInfo_new_ex(libctx
, propq
);
260 aenv
= cms_auth_enveloped_data_init(cms
);
263 if (!cms_EncryptedContent_init(aenv
->authEncryptedContentInfo
,
264 cipher
, NULL
, 0, cms_get0_cmsctx(cms
)))
268 CMS_ContentInfo_free(cms
);
269 CMSerr(0, ERR_R_MALLOC_FAILURE
);
274 CMS_ContentInfo
*CMS_AuthEnvelopedData_create(const EVP_CIPHER
*cipher
)
276 return CMS_AuthEnvelopedData_create_ex(cipher
, NULL
, NULL
);
279 /* Key Transport Recipient Info (KTRI) routines */
281 /* Initialise a ktri based on passed certificate and key */
283 static int cms_RecipientInfo_ktri_init(CMS_RecipientInfo
*ri
, X509
*recip
,
284 EVP_PKEY
*pk
, unsigned int flags
,
287 CMS_KeyTransRecipientInfo
*ktri
;
290 ri
->d
.ktri
= M_ASN1_new_of(CMS_KeyTransRecipientInfo
);
293 ri
->type
= CMS_RECIPINFO_TRANS
;
298 if (flags
& CMS_USE_KEYID
) {
300 idtype
= CMS_RECIPINFO_KEYIDENTIFIER
;
303 idtype
= CMS_RECIPINFO_ISSUER_SERIAL
;
307 * Not a typo: RecipientIdentifier and SignerIdentifier are the same
311 if (!cms_set1_SignerIdentifier(ktri
->rid
, recip
, idtype
, ctx
))
320 if (flags
& CMS_KEY_PARAM
) {
321 ktri
->pctx
= EVP_PKEY_CTX_new_from_pkey(ctx
->libctx
, ktri
->pkey
,
323 if (ktri
->pctx
== NULL
)
325 if (EVP_PKEY_encrypt_init(ktri
->pctx
) <= 0)
327 } else if (!cms_env_asn1_ctrl(ri
, 0))
333 * Add a recipient certificate using appropriate type of RecipientInfo
336 CMS_RecipientInfo
*CMS_add1_recipient(CMS_ContentInfo
*cms
, X509
*recip
,
337 EVP_PKEY
*originatorPrivKey
,
338 X509
*originator
, unsigned int flags
)
340 CMS_RecipientInfo
*ri
= NULL
;
341 STACK_OF(CMS_RecipientInfo
) *ris
;
343 const CMS_CTX
*ctx
= cms_get0_cmsctx(cms
);
345 ris
= CMS_get0_RecipientInfos(cms
);
349 /* Initialize recipient info */
350 ri
= M_ASN1_new_of(CMS_RecipientInfo
);
354 pk
= X509_get0_pubkey(recip
);
356 CMSerr(CMS_F_CMS_ADD1_RECIPIENT
, CMS_R_ERROR_GETTING_PUBLIC_KEY
);
360 switch (cms_pkey_get_ri_type(pk
)) {
362 case CMS_RECIPINFO_TRANS
:
363 if (!cms_RecipientInfo_ktri_init(ri
, recip
, pk
, flags
, ctx
))
367 case CMS_RECIPINFO_AGREE
:
368 if (!cms_RecipientInfo_kari_init(ri
, recip
, pk
, originator
,
369 originatorPrivKey
, flags
, ctx
))
374 CMSerr(CMS_F_CMS_ADD1_RECIPIENT
,
375 CMS_R_NOT_SUPPORTED_FOR_THIS_KEY_TYPE
);
380 if (!sk_CMS_RecipientInfo_push(ris
, ri
))
386 CMSerr(CMS_F_CMS_ADD1_RECIPIENT
, ERR_R_MALLOC_FAILURE
);
388 M_ASN1_free_of(ri
, CMS_RecipientInfo
);
393 CMS_RecipientInfo
*CMS_add1_recipient_cert(CMS_ContentInfo
*cms
, X509
*recip
,
396 return CMS_add1_recipient(cms
, recip
, NULL
, NULL
, flags
);
399 int CMS_RecipientInfo_ktri_get0_algs(CMS_RecipientInfo
*ri
,
400 EVP_PKEY
**pk
, X509
**recip
,
403 CMS_KeyTransRecipientInfo
*ktri
;
404 if (ri
->type
!= CMS_RECIPINFO_TRANS
) {
405 CMSerr(CMS_F_CMS_RECIPIENTINFO_KTRI_GET0_ALGS
,
406 CMS_R_NOT_KEY_TRANSPORT
);
415 *recip
= ktri
->recip
;
417 *palg
= ktri
->keyEncryptionAlgorithm
;
421 int CMS_RecipientInfo_ktri_get0_signer_id(CMS_RecipientInfo
*ri
,
422 ASN1_OCTET_STRING
**keyid
,
426 CMS_KeyTransRecipientInfo
*ktri
;
427 if (ri
->type
!= CMS_RECIPINFO_TRANS
) {
428 CMSerr(CMS_F_CMS_RECIPIENTINFO_KTRI_GET0_SIGNER_ID
,
429 CMS_R_NOT_KEY_TRANSPORT
);
434 return cms_SignerIdentifier_get0_signer_id(ktri
->rid
, keyid
, issuer
, sno
);
437 int CMS_RecipientInfo_ktri_cert_cmp(CMS_RecipientInfo
*ri
, X509
*cert
)
439 if (ri
->type
!= CMS_RECIPINFO_TRANS
) {
440 CMSerr(CMS_F_CMS_RECIPIENTINFO_KTRI_CERT_CMP
,
441 CMS_R_NOT_KEY_TRANSPORT
);
444 return cms_SignerIdentifier_cert_cmp(ri
->d
.ktri
->rid
, cert
);
447 int CMS_RecipientInfo_set0_pkey(CMS_RecipientInfo
*ri
, EVP_PKEY
*pkey
)
449 if (ri
->type
!= CMS_RECIPINFO_TRANS
) {
450 CMSerr(CMS_F_CMS_RECIPIENTINFO_SET0_PKEY
, CMS_R_NOT_KEY_TRANSPORT
);
453 EVP_PKEY_free(ri
->d
.ktri
->pkey
);
454 ri
->d
.ktri
->pkey
= pkey
;
458 /* Encrypt content key in key transport recipient info */
460 static int cms_RecipientInfo_ktri_encrypt(const CMS_ContentInfo
*cms
,
461 CMS_RecipientInfo
*ri
)
463 CMS_KeyTransRecipientInfo
*ktri
;
464 CMS_EncryptedContentInfo
*ec
;
466 unsigned char *ek
= NULL
;
468 const CMS_CTX
*ctx
= cms_get0_cmsctx(cms
);
472 if (ri
->type
!= CMS_RECIPINFO_TRANS
) {
473 CMSerr(CMS_F_CMS_RECIPIENTINFO_KTRI_ENCRYPT
, CMS_R_NOT_KEY_TRANSPORT
);
477 ec
= cms_get0_env_enc_content(cms
);
482 if (!cms_env_asn1_ctrl(ri
, 0))
485 pctx
= EVP_PKEY_CTX_new_from_pkey(ctx
->libctx
, ktri
->pkey
, ctx
->propq
);
489 if (EVP_PKEY_encrypt_init(pctx
) <= 0)
493 if (EVP_PKEY_CTX_ctrl(pctx
, -1, EVP_PKEY_OP_ENCRYPT
,
494 EVP_PKEY_CTRL_CMS_ENCRYPT
, 0, ri
) <= 0) {
495 CMSerr(CMS_F_CMS_RECIPIENTINFO_KTRI_ENCRYPT
, CMS_R_CTRL_ERROR
);
499 if (EVP_PKEY_encrypt(pctx
, NULL
, &eklen
, ec
->key
, ec
->keylen
) <= 0)
502 ek
= OPENSSL_malloc(eklen
);
505 CMSerr(CMS_F_CMS_RECIPIENTINFO_KTRI_ENCRYPT
, ERR_R_MALLOC_FAILURE
);
509 if (EVP_PKEY_encrypt(pctx
, ek
, &eklen
, ec
->key
, ec
->keylen
) <= 0)
512 ASN1_STRING_set0(ktri
->encryptedKey
, ek
, eklen
);
518 EVP_PKEY_CTX_free(pctx
);
524 /* Decrypt content key from KTRI */
526 static int cms_RecipientInfo_ktri_decrypt(CMS_ContentInfo
*cms
,
527 CMS_RecipientInfo
*ri
)
529 CMS_KeyTransRecipientInfo
*ktri
= ri
->d
.ktri
;
530 EVP_PKEY
*pkey
= ktri
->pkey
;
531 unsigned char *ek
= NULL
;
535 const EVP_CIPHER
*cipher
= NULL
;
536 EVP_CIPHER
*fetched_cipher
= NULL
;
537 CMS_EncryptedContentInfo
*ec
;
538 const CMS_CTX
*ctx
= cms_get0_cmsctx(cms
);
540 ec
= cms_get0_env_enc_content(cms
);
542 if (ktri
->pkey
== NULL
) {
543 CMSerr(CMS_F_CMS_RECIPIENTINFO_KTRI_DECRYPT
, CMS_R_NO_PRIVATE_KEY
);
547 if (cms
->d
.envelopedData
->encryptedContentInfo
->havenocert
548 && !cms
->d
.envelopedData
->encryptedContentInfo
->debug
) {
549 X509_ALGOR
*calg
= ec
->contentEncryptionAlgorithm
;
550 const char *name
= OBJ_nid2sn(OBJ_obj2nid(calg
->algorithm
));
552 (void)ERR_set_mark();
553 fetched_cipher
= EVP_CIPHER_fetch(ctx
->libctx
, name
, ctx
->propq
);
555 if (fetched_cipher
!= NULL
)
556 cipher
= fetched_cipher
;
558 cipher
= EVP_get_cipherbyobj(calg
->algorithm
);
559 if (cipher
== NULL
) {
560 (void)ERR_clear_last_mark();
561 CMSerr(CMS_F_CMS_RECIPIENTINFO_KTRI_DECRYPT
, CMS_R_UNKNOWN_CIPHER
);
564 (void)ERR_pop_to_mark();
566 fixlen
= EVP_CIPHER_key_length(cipher
);
567 EVP_CIPHER_free(fetched_cipher
);
570 ktri
->pctx
= EVP_PKEY_CTX_new_from_pkey(ctx
->libctx
, pkey
, ctx
->propq
);
571 if (ktri
->pctx
== NULL
)
574 if (EVP_PKEY_decrypt_init(ktri
->pctx
) <= 0)
577 if (!cms_env_asn1_ctrl(ri
, 1))
580 if (EVP_PKEY_CTX_ctrl(ktri
->pctx
, -1, EVP_PKEY_OP_DECRYPT
,
581 EVP_PKEY_CTRL_CMS_DECRYPT
, 0, ri
) <= 0) {
582 CMSerr(CMS_F_CMS_RECIPIENTINFO_KTRI_DECRYPT
, CMS_R_CTRL_ERROR
);
586 if (EVP_PKEY_decrypt(ktri
->pctx
, NULL
, &eklen
,
587 ktri
->encryptedKey
->data
,
588 ktri
->encryptedKey
->length
) <= 0)
591 ek
= OPENSSL_malloc(eklen
);
593 CMSerr(CMS_F_CMS_RECIPIENTINFO_KTRI_DECRYPT
, ERR_R_MALLOC_FAILURE
);
597 if (EVP_PKEY_decrypt(ktri
->pctx
, ek
, &eklen
,
598 ktri
->encryptedKey
->data
,
599 ktri
->encryptedKey
->length
) <= 0
601 || (fixlen
!= 0 && eklen
!= fixlen
)) {
602 CMSerr(CMS_F_CMS_RECIPIENTINFO_KTRI_DECRYPT
, CMS_R_CMS_LIB
);
608 OPENSSL_clear_free(ec
->key
, ec
->keylen
);
613 EVP_PKEY_CTX_free(ktri
->pctx
);
621 /* Key Encrypted Key (KEK) RecipientInfo routines */
623 int CMS_RecipientInfo_kekri_id_cmp(CMS_RecipientInfo
*ri
,
624 const unsigned char *id
, size_t idlen
)
626 ASN1_OCTET_STRING tmp_os
;
627 CMS_KEKRecipientInfo
*kekri
;
628 if (ri
->type
!= CMS_RECIPINFO_KEK
) {
629 CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_ID_CMP
, CMS_R_NOT_KEK
);
633 tmp_os
.type
= V_ASN1_OCTET_STRING
;
635 tmp_os
.data
= (unsigned char *)id
;
636 tmp_os
.length
= (int)idlen
;
637 return ASN1_OCTET_STRING_cmp(&tmp_os
, kekri
->kekid
->keyIdentifier
);
640 /* For now hard code AES key wrap info */
642 static size_t aes_wrap_keylen(int nid
)
645 case NID_id_aes128_wrap
:
648 case NID_id_aes192_wrap
:
651 case NID_id_aes256_wrap
:
659 CMS_RecipientInfo
*CMS_add0_recipient_key(CMS_ContentInfo
*cms
, int nid
,
660 unsigned char *key
, size_t keylen
,
661 unsigned char *id
, size_t idlen
,
662 ASN1_GENERALIZEDTIME
*date
,
663 ASN1_OBJECT
*otherTypeId
,
664 ASN1_TYPE
*otherType
)
666 CMS_RecipientInfo
*ri
= NULL
;
667 CMS_KEKRecipientInfo
*kekri
;
668 STACK_OF(CMS_RecipientInfo
) *ris
= CMS_get0_RecipientInfos(cms
);
673 if (nid
== NID_undef
) {
676 nid
= NID_id_aes128_wrap
;
680 nid
= NID_id_aes192_wrap
;
684 nid
= NID_id_aes256_wrap
;
688 CMSerr(CMS_F_CMS_ADD0_RECIPIENT_KEY
, CMS_R_INVALID_KEY_LENGTH
);
694 size_t exp_keylen
= aes_wrap_keylen(nid
);
697 CMSerr(CMS_F_CMS_ADD0_RECIPIENT_KEY
,
698 CMS_R_UNSUPPORTED_KEK_ALGORITHM
);
702 if (keylen
!= exp_keylen
) {
703 CMSerr(CMS_F_CMS_ADD0_RECIPIENT_KEY
, CMS_R_INVALID_KEY_LENGTH
);
709 /* Initialize recipient info */
710 ri
= M_ASN1_new_of(CMS_RecipientInfo
);
714 ri
->d
.kekri
= M_ASN1_new_of(CMS_KEKRecipientInfo
);
717 ri
->type
= CMS_RECIPINFO_KEK
;
722 kekri
->kekid
->other
= M_ASN1_new_of(CMS_OtherKeyAttribute
);
723 if (kekri
->kekid
->other
== NULL
)
727 if (!sk_CMS_RecipientInfo_push(ris
, ri
))
730 /* After this point no calls can fail */
735 kekri
->keylen
= keylen
;
737 ASN1_STRING_set0(kekri
->kekid
->keyIdentifier
, id
, idlen
);
739 kekri
->kekid
->date
= date
;
741 if (kekri
->kekid
->other
) {
742 kekri
->kekid
->other
->keyAttrId
= otherTypeId
;
743 kekri
->kekid
->other
->keyAttr
= otherType
;
746 X509_ALGOR_set0(kekri
->keyEncryptionAlgorithm
,
747 OBJ_nid2obj(nid
), V_ASN1_UNDEF
, NULL
);
752 CMSerr(CMS_F_CMS_ADD0_RECIPIENT_KEY
, ERR_R_MALLOC_FAILURE
);
754 M_ASN1_free_of(ri
, CMS_RecipientInfo
);
758 int CMS_RecipientInfo_kekri_get0_id(CMS_RecipientInfo
*ri
,
760 ASN1_OCTET_STRING
**pid
,
761 ASN1_GENERALIZEDTIME
**pdate
,
762 ASN1_OBJECT
**potherid
,
763 ASN1_TYPE
**pothertype
)
765 CMS_KEKIdentifier
*rkid
;
766 if (ri
->type
!= CMS_RECIPINFO_KEK
) {
767 CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_GET0_ID
, CMS_R_NOT_KEK
);
770 rkid
= ri
->d
.kekri
->kekid
;
772 *palg
= ri
->d
.kekri
->keyEncryptionAlgorithm
;
774 *pid
= rkid
->keyIdentifier
;
779 *potherid
= rkid
->other
->keyAttrId
;
785 *pothertype
= rkid
->other
->keyAttr
;
792 int CMS_RecipientInfo_set0_key(CMS_RecipientInfo
*ri
,
793 unsigned char *key
, size_t keylen
)
795 CMS_KEKRecipientInfo
*kekri
;
796 if (ri
->type
!= CMS_RECIPINFO_KEK
) {
797 CMSerr(CMS_F_CMS_RECIPIENTINFO_SET0_KEY
, CMS_R_NOT_KEK
);
803 kekri
->keylen
= keylen
;
807 static EVP_CIPHER
*cms_get_key_wrap_cipher(size_t keylen
, const CMS_CTX
*ctx
)
809 const char *alg
= NULL
;
813 alg
= "AES-128-WRAP";
816 alg
= "AES-192-WRAP";
819 alg
= "AES-256-WRAP";
824 return EVP_CIPHER_fetch(ctx
->libctx
, alg
, ctx
->propq
);
828 /* Encrypt content key in KEK recipient info */
830 static int cms_RecipientInfo_kekri_encrypt(const CMS_ContentInfo
*cms
,
831 CMS_RecipientInfo
*ri
)
833 CMS_EncryptedContentInfo
*ec
;
834 CMS_KEKRecipientInfo
*kekri
;
835 unsigned char *wkey
= NULL
;
838 EVP_CIPHER
*cipher
= NULL
;
840 EVP_CIPHER_CTX
*ctx
= NULL
;
841 const CMS_CTX
*cms_ctx
= cms_get0_cmsctx(cms
);
843 ec
= cms_get0_env_enc_content(cms
);
849 if (kekri
->key
== NULL
) {
850 CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_ENCRYPT
, CMS_R_NO_KEY
);
854 cipher
= cms_get_key_wrap_cipher(kekri
->keylen
, cms_ctx
);
855 if (cipher
== NULL
) {
856 CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_ENCRYPT
, CMS_R_INVALID_KEY_LENGTH
);
860 /* 8 byte prefix for AES wrap ciphers */
861 wkey
= OPENSSL_malloc(ec
->keylen
+ 8);
863 CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_ENCRYPT
, ERR_R_MALLOC_FAILURE
);
867 ctx
= EVP_CIPHER_CTX_new();
869 CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_ENCRYPT
, ERR_R_MALLOC_FAILURE
);
873 EVP_CIPHER_CTX_set_flags(ctx
, EVP_CIPHER_CTX_FLAG_WRAP_ALLOW
);
874 if (!EVP_EncryptInit_ex(ctx
, cipher
, NULL
, kekri
->key
, NULL
)
875 || !EVP_EncryptUpdate(ctx
, wkey
, &wkeylen
, ec
->key
, ec
->keylen
)
876 || !EVP_EncryptFinal_ex(ctx
, wkey
+ wkeylen
, &outlen
)) {
877 CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_ENCRYPT
, CMS_R_WRAP_ERROR
);
881 if (!ossl_assert((size_t)wkeylen
== ec
->keylen
+ 8)) {
882 CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_ENCRYPT
, CMS_R_WRAP_ERROR
);
886 ASN1_STRING_set0(kekri
->encryptedKey
, wkey
, wkeylen
);
891 EVP_CIPHER_free(cipher
);
894 EVP_CIPHER_CTX_free(ctx
);
899 /* Decrypt content key in KEK recipient info */
901 static int cms_RecipientInfo_kekri_decrypt(CMS_ContentInfo
*cms
,
902 CMS_RecipientInfo
*ri
)
904 CMS_EncryptedContentInfo
*ec
;
905 CMS_KEKRecipientInfo
*kekri
;
906 unsigned char *ukey
= NULL
;
909 EVP_CIPHER
*cipher
= NULL
;
911 EVP_CIPHER_CTX
*ctx
= NULL
;
912 const CMS_CTX
*cms_ctx
= cms_get0_cmsctx(cms
);
914 ec
= cms_get0_env_enc_content(cms
);
921 CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_DECRYPT
, CMS_R_NO_KEY
);
925 wrap_nid
= OBJ_obj2nid(kekri
->keyEncryptionAlgorithm
->algorithm
);
926 if (aes_wrap_keylen(wrap_nid
) != kekri
->keylen
) {
927 CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_DECRYPT
,
928 CMS_R_INVALID_KEY_LENGTH
);
932 /* If encrypted key length is invalid don't bother */
934 if (kekri
->encryptedKey
->length
< 16) {
935 CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_DECRYPT
,
936 CMS_R_INVALID_ENCRYPTED_KEY_LENGTH
);
940 cipher
= cms_get_key_wrap_cipher(kekri
->keylen
, cms_ctx
);
941 if (cipher
== NULL
) {
942 CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_DECRYPT
, CMS_R_INVALID_KEY_LENGTH
);
946 ukey
= OPENSSL_malloc(kekri
->encryptedKey
->length
- 8);
948 CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_DECRYPT
, ERR_R_MALLOC_FAILURE
);
952 ctx
= EVP_CIPHER_CTX_new();
954 CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_DECRYPT
, ERR_R_MALLOC_FAILURE
);
958 if (!EVP_DecryptInit_ex(ctx
, cipher
, NULL
, kekri
->key
, NULL
)
959 || !EVP_DecryptUpdate(ctx
, ukey
, &ukeylen
,
960 kekri
->encryptedKey
->data
,
961 kekri
->encryptedKey
->length
)
962 || !EVP_DecryptFinal_ex(ctx
, ukey
+ ukeylen
, &outlen
)) {
963 CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_DECRYPT
, CMS_R_UNWRAP_ERROR
);
969 ec
->keylen
= ukeylen
;
974 EVP_CIPHER_free(cipher
);
977 EVP_CIPHER_CTX_free(ctx
);
982 int CMS_RecipientInfo_decrypt(CMS_ContentInfo
*cms
, CMS_RecipientInfo
*ri
)
985 case CMS_RECIPINFO_TRANS
:
986 return cms_RecipientInfo_ktri_decrypt(cms
, ri
);
988 case CMS_RECIPINFO_KEK
:
989 return cms_RecipientInfo_kekri_decrypt(cms
, ri
);
991 case CMS_RECIPINFO_PASS
:
992 return cms_RecipientInfo_pwri_crypt(cms
, ri
, 0);
995 CMSerr(CMS_F_CMS_RECIPIENTINFO_DECRYPT
,
996 CMS_R_UNSUPPORTED_RECIPIENTINFO_TYPE
);
1001 int CMS_RecipientInfo_encrypt(const CMS_ContentInfo
*cms
, CMS_RecipientInfo
*ri
)
1004 case CMS_RECIPINFO_TRANS
:
1005 return cms_RecipientInfo_ktri_encrypt(cms
, ri
);
1007 case CMS_RECIPINFO_AGREE
:
1008 return cms_RecipientInfo_kari_encrypt(cms
, ri
);
1010 case CMS_RECIPINFO_KEK
:
1011 return cms_RecipientInfo_kekri_encrypt(cms
, ri
);
1013 case CMS_RECIPINFO_PASS
:
1014 return cms_RecipientInfo_pwri_crypt(cms
, ri
, 1);
1017 CMSerr(CMS_F_CMS_RECIPIENTINFO_ENCRYPT
,
1018 CMS_R_UNSUPPORTED_RECIPIENT_TYPE
);
1023 /* Check structures and fixup version numbers (if necessary) */
1025 static void cms_env_set_originfo_version(CMS_EnvelopedData
*env
)
1027 CMS_OriginatorInfo
*org
= env
->originatorInfo
;
1031 for (i
= 0; i
< sk_CMS_CertificateChoices_num(org
->certificates
); i
++) {
1032 CMS_CertificateChoices
*cch
;
1033 cch
= sk_CMS_CertificateChoices_value(org
->certificates
, i
);
1034 if (cch
->type
== CMS_CERTCHOICE_OTHER
) {
1037 } else if (cch
->type
== CMS_CERTCHOICE_V2ACERT
) {
1038 if (env
->version
< 3)
1043 for (i
= 0; i
< sk_CMS_RevocationInfoChoice_num(org
->crls
); i
++) {
1044 CMS_RevocationInfoChoice
*rch
;
1045 rch
= sk_CMS_RevocationInfoChoice_value(org
->crls
, i
);
1046 if (rch
->type
== CMS_REVCHOICE_OTHER
) {
1053 static void cms_env_set_version(CMS_EnvelopedData
*env
)
1056 CMS_RecipientInfo
*ri
;
1059 * Can't set version higher than 4 so if 4 or more already nothing to do.
1061 if (env
->version
>= 4)
1064 cms_env_set_originfo_version(env
);
1066 if (env
->version
>= 3)
1069 for (i
= 0; i
< sk_CMS_RecipientInfo_num(env
->recipientInfos
); i
++) {
1070 ri
= sk_CMS_RecipientInfo_value(env
->recipientInfos
, i
);
1071 if (ri
->type
== CMS_RECIPINFO_PASS
|| ri
->type
== CMS_RECIPINFO_OTHER
) {
1074 } else if (ri
->type
!= CMS_RECIPINFO_TRANS
1075 || ri
->d
.ktri
->version
!= 0) {
1079 if (env
->originatorInfo
|| env
->unprotectedAttrs
)
1081 if (env
->version
== 2)
1086 static int cms_env_encrypt_content_key(const CMS_ContentInfo
*cms
,
1087 STACK_OF(CMS_RecipientInfo
) *ris
)
1090 CMS_RecipientInfo
*ri
;
1092 for (i
= 0; i
< sk_CMS_RecipientInfo_num(ris
); i
++) {
1093 ri
= sk_CMS_RecipientInfo_value(ris
, i
);
1094 if (CMS_RecipientInfo_encrypt(cms
, ri
) <= 0)
1100 static void cms_env_clear_ec(CMS_EncryptedContentInfo
*ec
)
1103 OPENSSL_clear_free(ec
->key
, ec
->keylen
);
1108 static BIO
*cms_EnvelopedData_Decryption_init_bio(CMS_ContentInfo
*cms
)
1110 CMS_EncryptedContentInfo
*ec
= cms
->d
.envelopedData
->encryptedContentInfo
;
1111 BIO
*contentBio
= cms_EncryptedContent_init_bio(ec
, cms_get0_cmsctx(cms
));
1112 EVP_CIPHER_CTX
*ctx
= NULL
;
1114 if (contentBio
== NULL
)
1117 BIO_get_cipher_ctx(contentBio
, &ctx
);
1119 BIO_free(contentBio
);
1123 * If the selected cipher supports unprotected attributes,
1124 * deal with it using special ctrl function
1126 if ((EVP_CIPHER_flags(EVP_CIPHER_CTX_cipher(ctx
)) & EVP_CIPH_FLAG_CIPHER_WITH_MAC
)
1127 && EVP_CIPHER_CTX_ctrl(ctx
, EVP_CTRL_PROCESS_UNPROTECTED
, 0,
1128 cms
->d
.envelopedData
->unprotectedAttrs
) <= 0) {
1129 BIO_free(contentBio
);
1135 static BIO
*cms_EnvelopedData_Encryption_init_bio(CMS_ContentInfo
*cms
)
1137 CMS_EncryptedContentInfo
*ec
;
1138 STACK_OF(CMS_RecipientInfo
) *rinfos
;
1141 CMS_EnvelopedData
*env
= cms
->d
.envelopedData
;
1143 /* Get BIO first to set up key */
1145 ec
= env
->encryptedContentInfo
;
1146 ret
= cms_EncryptedContent_init_bio(ec
, cms_get0_cmsctx(cms
));
1148 /* If error end of processing */
1152 /* Now encrypt content key according to each RecipientInfo type */
1153 rinfos
= env
->recipientInfos
;
1154 if (cms_env_encrypt_content_key(cms
, rinfos
) < 0) {
1155 CMSerr(CMS_F_CMS_ENVELOPEDDATA_ENCRYPTION_INIT_BIO
,
1156 CMS_R_ERROR_SETTING_RECIPIENTINFO
);
1160 /* And finally set the version */
1161 cms_env_set_version(env
);
1166 cms_env_clear_ec(ec
);
1173 BIO
*cms_EnvelopedData_init_bio(CMS_ContentInfo
*cms
)
1175 if (cms
->d
.envelopedData
->encryptedContentInfo
->cipher
!= NULL
) {
1176 /* If cipher is set it's encryption */
1177 return cms_EnvelopedData_Encryption_init_bio(cms
);
1180 /* If cipher is not set it's decryption */
1181 return cms_EnvelopedData_Decryption_init_bio(cms
);
1184 BIO
*cms_AuthEnvelopedData_init_bio(CMS_ContentInfo
*cms
)
1186 CMS_EncryptedContentInfo
*ec
;
1187 STACK_OF(CMS_RecipientInfo
) *rinfos
;
1190 CMS_AuthEnvelopedData
*aenv
= cms
->d
.authEnvelopedData
;
1192 /* Get BIO first to set up key */
1193 ec
= aenv
->authEncryptedContentInfo
;
1194 /* Set tag for decryption */
1195 if (ec
->cipher
== NULL
) {
1196 ec
->tag
= aenv
->mac
->data
;
1197 ec
->taglen
= aenv
->mac
->length
;
1199 ret
= cms_EncryptedContent_init_bio(ec
, cms_get0_cmsctx(cms
));
1201 /* If error or no cipher end of processing */
1202 if (ret
== NULL
|| ec
->cipher
== NULL
)
1205 /* Now encrypt content key according to each RecipientInfo type */
1206 rinfos
= aenv
->recipientInfos
;
1207 if (cms_env_encrypt_content_key(cms
, rinfos
) < 0) {
1208 CMSerr(0, CMS_R_ERROR_SETTING_RECIPIENTINFO
);
1212 /* And finally set the version */
1218 cms_env_clear_ec(ec
);
1225 int cms_EnvelopedData_final(CMS_ContentInfo
*cms
, BIO
*chain
)
1227 CMS_EnvelopedData
*env
= NULL
;
1228 EVP_CIPHER_CTX
*ctx
= NULL
;
1229 BIO
*mbio
= BIO_find_type(chain
, BIO_TYPE_CIPHER
);
1231 env
= cms_get0_enveloped(cms
);
1236 CMSerr(CMS_F_CMS_ENVELOPEDDATA_FINAL
, CMS_R_CONTENT_NOT_FOUND
);
1240 BIO_get_cipher_ctx(mbio
, &ctx
);
1243 * If the selected cipher supports unprotected attributes,
1244 * deal with it using special ctrl function
1246 if (EVP_CIPHER_flags(EVP_CIPHER_CTX_cipher(ctx
)) & EVP_CIPH_FLAG_CIPHER_WITH_MAC
) {
1247 if (env
->unprotectedAttrs
== NULL
)
1248 env
->unprotectedAttrs
= sk_X509_ATTRIBUTE_new_null();
1250 if (env
->unprotectedAttrs
== NULL
) {
1251 CMSerr(CMS_F_CMS_ENVELOPEDDATA_FINAL
, ERR_R_MALLOC_FAILURE
);
1255 if (EVP_CIPHER_CTX_ctrl(ctx
, EVP_CTRL_PROCESS_UNPROTECTED
,
1256 1, env
->unprotectedAttrs
) <= 0) {
1257 CMSerr(CMS_F_CMS_ENVELOPEDDATA_FINAL
, CMS_R_CTRL_FAILURE
);
1262 cms_env_set_version(cms
->d
.envelopedData
);
1266 int cms_AuthEnvelopedData_final(CMS_ContentInfo
*cms
, BIO
*cmsbio
)
1268 EVP_CIPHER_CTX
*ctx
;
1269 unsigned char *tag
= NULL
;
1272 BIO_get_cipher_ctx(cmsbio
, &ctx
);
1275 * The tag is set only for encryption. There is nothing to do for
1278 if (!EVP_CIPHER_CTX_encrypting(ctx
))
1281 taglen
= EVP_CIPHER_CTX_tag_length(ctx
);
1283 || (tag
= OPENSSL_malloc(taglen
)) == NULL
1284 || EVP_CIPHER_CTX_ctrl(ctx
, EVP_CTRL_AEAD_GET_TAG
, taglen
,
1286 CMSerr(0, CMS_R_CIPHER_GET_TAG
);
1290 if (!ASN1_OCTET_STRING_set(cms
->d
.authEnvelopedData
->mac
, tag
, taglen
))
1300 * Get RecipientInfo type (if any) supported by a key (public or private). To
1301 * retain compatibility with previous behaviour if the ctrl value isn't
1302 * supported we assume key transport.
1304 int cms_pkey_get_ri_type(EVP_PKEY
*pk
)
1306 /* Check types that we know about */
1307 if (EVP_PKEY_is_a(pk
, "DH"))
1308 return CMS_RECIPINFO_AGREE
;
1309 else if (EVP_PKEY_is_a(pk
, "DSA"))
1310 return CMS_RECIPINFO_NONE
;
1311 else if (EVP_PKEY_is_a(pk
, "EC"))
1312 return CMS_RECIPINFO_AGREE
;
1313 else if (EVP_PKEY_is_a(pk
, "RSA"))
1314 return CMS_RECIPINFO_TRANS
;
1317 * Otherwise this might ben an engine implementation, so see if we can get
1318 * the type from the ameth.
1320 if (pk
->ameth
&& pk
->ameth
->pkey_ctrl
) {
1322 i
= pk
->ameth
->pkey_ctrl(pk
, ASN1_PKEY_CTRL_CMS_RI_TYPE
, 0, &r
);
1326 return CMS_RECIPINFO_TRANS
;
1329 int cms_pkey_is_ri_type_supported(EVP_PKEY
*pk
, int ri_type
)
1331 int supportedRiType
;
1333 if (pk
->ameth
!= NULL
&& pk
->ameth
->pkey_ctrl
!= NULL
) {
1336 i
= pk
->ameth
->pkey_ctrl(pk
, ASN1_PKEY_CTRL_CMS_IS_RI_TYPE_SUPPORTED
,
1342 supportedRiType
= cms_pkey_get_ri_type(pk
);
1343 if (supportedRiType
< 0)
1346 return (supportedRiType
== ri_type
);