2 * Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved.
3 * Copyright (c) 2019, Oracle and/or its affiliates. All rights reserved.
5 * Licensed under the Apache License 2.0 (the "License"). You may not use
6 * this file except in compliance with the License. You can obtain a copy
7 * in the file LICENSE in the source distribution or at
8 * https://www.openssl.org/source/license.html
12 #include <openssl/core_names.h>
13 #include <openssl/core_dispatch.h>
14 #include <openssl/err.h>
15 #include <openssl/evp.h>
16 #include <openssl/params.h>
17 #include "internal/packet.h"
18 #include "internal/der.h"
19 #include "prov/provider_ctx.h"
20 #include "prov/providercommonerr.h"
21 #include "prov/implementations.h"
22 #include "prov/provider_util.h"
23 #include "prov/der_wrap.h"
25 #define X942KDF_MAX_INLEN (1 << 30)
27 static OSSL_FUNC_kdf_newctx_fn x942kdf_new
;
28 static OSSL_FUNC_kdf_freectx_fn x942kdf_free
;
29 static OSSL_FUNC_kdf_reset_fn x942kdf_reset
;
30 static OSSL_FUNC_kdf_derive_fn x942kdf_derive
;
31 static OSSL_FUNC_kdf_settable_ctx_params_fn x942kdf_settable_ctx_params
;
32 static OSSL_FUNC_kdf_set_ctx_params_fn x942kdf_set_ctx_params
;
33 static OSSL_FUNC_kdf_gettable_ctx_params_fn x942kdf_gettable_ctx_params
;
34 static OSSL_FUNC_kdf_get_ctx_params_fn x942kdf_get_ctx_params
;
39 unsigned char *secret
;
44 const unsigned char *cek_oid
;
49 * A table of allowed wrapping algorithms, oids and the associated output
51 * NOTE: RC2wrap and camellia128_wrap have been removed as there are no
52 * corresponding ciphers for these operations.
56 const unsigned char *oid
;
58 size_t keklen
; /* size in bytes */
60 { "AES-128-WRAP", der_oid_id_aes128_wrap
, DER_OID_SZ_id_aes128_wrap
, 16 },
61 { "AES-192-WRAP", der_oid_id_aes192_wrap
, DER_OID_SZ_id_aes192_wrap
, 24 },
62 { "AES-256-WRAP", der_oid_id_aes256_wrap
, DER_OID_SZ_id_aes256_wrap
, 32 },
64 { "DES3-WRAP", der_oid_id_alg_CMS3DESwrap
, DER_OID_SZ_id_alg_CMS3DESwrap
,
69 static int find_alg_id(OPENSSL_CTX
*libctx
, const char *algname
, size_t *id
)
75 cipher
= EVP_CIPHER_fetch(libctx
, algname
, NULL
);
77 for (i
= 0; i
< OSSL_NELEM(kek_algs
); i
++) {
78 if (EVP_CIPHER_is_a(cipher
, kek_algs
[i
].name
)) {
85 ERR_raise(ERR_LIB_PROV
, PROV_R_UNSUPPORTED_CEK_ALG
);
87 EVP_CIPHER_free(cipher
);
91 static int DER_w_keyinfo(WPACKET
*pkt
,
92 const unsigned char *der_oid
, size_t der_oidlen
,
93 unsigned char **pcounter
)
95 return DER_w_begin_sequence(pkt
, -1)
96 /* Store the initial value of 1 into the counter */
97 && DER_w_octet_string_uint32(pkt
, -1, 1)
98 /* Remember where we stored the counter in the buffer */
100 || (*pcounter
= WPACKET_get_curr(pkt
)) != NULL
)
101 && DER_w_precompiled(pkt
, -1, der_oid
, der_oidlen
)
102 && DER_w_end_sequence(pkt
, -1);
105 static int der_encode_sharedinfo(WPACKET
*pkt
, unsigned char *buf
, size_t buflen
,
106 const unsigned char *der_oid
, size_t der_oidlen
,
107 const unsigned char *ukm
, size_t ukmlen
,
108 uint32_t keylen_bits
, unsigned char **pcounter
)
110 return (buf
!= NULL
? WPACKET_init_der(pkt
, buf
, buflen
) :
111 WPACKET_init_null_der(pkt
))
112 && DER_w_begin_sequence(pkt
, -1)
113 && DER_w_octet_string_uint32(pkt
, 2, keylen_bits
)
114 && (ukm
== NULL
|| DER_w_octet_string(pkt
, 0, ukm
, ukmlen
))
115 && DER_w_keyinfo(pkt
, der_oid
, der_oidlen
, pcounter
)
116 && DER_w_end_sequence(pkt
, -1)
117 && WPACKET_finish(pkt
);
121 * Encode the other info structure.
123 * RFC2631 Section 2.1.2 Contains the following definition for otherinfo
125 * OtherInfo ::= SEQUENCE {
126 * keyInfo KeySpecificInfo,
127 * partyAInfo [0] OCTET STRING OPTIONAL,
128 * suppPubInfo [2] OCTET STRING
130 * Note suppPubInfo is the key length (in bits) (stored into 4 bytes)
133 * KeySpecificInfo ::= SEQUENCE {
134 * algorithm OBJECT IDENTIFIER,
135 * counter OCTET STRING SIZE (4..4)
138 * |keylen| is the length (in bytes) of the generated KEK. It is stored into
139 * suppPubInfo (in bits).
140 * |cek_oid| The oid of the key wrapping algorithm.
141 * |cek_oidlen| The length (in bytes) of the key wrapping algorithm oid,
142 * |ukm| is the optional user keying material that is stored into partyAInfo. It
144 * |ukmlen| is the user keying material length (in bytes).
145 * |der| is the returned encoded data. It must be freed by the caller.
146 * |der_len| is the returned size of the encoded data.
147 * |out_ctr| returns a pointer to the counter data which is embedded inside the
148 * encoded data. This allows the counter bytes to be updated without re-encoding.
150 * Returns: 1 if successfully encoded, or 0 otherwise.
151 * Assumptions: |der|, |der_len| & |out_ctr| are not NULL.
153 static int x942_encode_otherinfo(size_t keylen
,
154 const unsigned char *cek_oid
, size_t cek_oidlen
,
155 const unsigned char *ukm
, size_t ukmlen
,
156 unsigned char **der
, size_t *der_len
,
157 unsigned char **out_ctr
)
160 unsigned char *pcounter
= NULL
, *der_buf
= NULL
;
161 size_t der_buflen
= 0;
163 uint32_t keylen_bits
;
165 /* keylenbits must fit into 4 bytes */
166 if (keylen
> 0xFFFFFF)
168 keylen_bits
= 8 * keylen
;
170 /* Calculate the size of the buffer */
171 if (!der_encode_sharedinfo(&pkt
, NULL
, 0, cek_oid
, cek_oidlen
, ukm
, ukmlen
,
173 || !WPACKET_get_total_written(&pkt
, &der_buflen
))
175 WPACKET_cleanup(&pkt
);
176 /* Alloc the buffer */
177 der_buf
= OPENSSL_zalloc(der_buflen
);
180 /* Encode into the buffer */
181 if (!der_encode_sharedinfo(&pkt
, der_buf
, der_buflen
, cek_oid
, cek_oidlen
,
182 ukm
, ukmlen
, keylen_bits
, &pcounter
))
185 * Since we allocated the exact size required, the buffer should point to the
186 * start of the alllocated buffer at this point.
188 if (WPACKET_get_curr(&pkt
) != der_buf
)
192 * The data for the DER encoded octet string of a 32 bit counter = 1
193 * should be 04 04 00 00 00 01
194 * So just check the header is correct and skip over it.
195 * This counter will be incremented in the kdf update loop.
198 || pcounter
[0] != 0x04
199 || pcounter
[1] != 0x04)
201 *out_ctr
= (pcounter
+ 2);
203 *der_len
= der_buflen
;
206 WPACKET_cleanup(&pkt
);
210 static int x942kdf_hash_kdm(const EVP_MD
*kdf_md
,
211 const unsigned char *z
, size_t z_len
,
212 const unsigned char *other
, size_t other_len
,
214 unsigned char *derived_key
, size_t derived_key_len
)
217 size_t counter
, out_len
, len
= derived_key_len
;
218 unsigned char mac
[EVP_MAX_MD_SIZE
];
219 unsigned char *out
= derived_key
;
220 EVP_MD_CTX
*ctx
= NULL
, *ctx_init
= NULL
;
222 if (z_len
> X942KDF_MAX_INLEN
|| other_len
> X942KDF_MAX_INLEN
223 || derived_key_len
> X942KDF_MAX_INLEN
224 || derived_key_len
== 0) {
225 ERR_raise(ERR_LIB_PROV
, PROV_R_BAD_LENGTH
);
229 hlen
= EVP_MD_size(kdf_md
);
232 out_len
= (size_t)hlen
;
234 ctx
= EVP_MD_CTX_create();
235 ctx_init
= EVP_MD_CTX_create();
236 if (ctx
== NULL
|| ctx_init
== NULL
)
239 if (!EVP_DigestInit(ctx_init
, kdf_md
))
242 for (counter
= 1;; counter
++) {
243 /* updating the ctr modifies 4 bytes in the 'other' buffer */
244 ctr
[0] = (unsigned char)((counter
>> 24) & 0xff);
245 ctr
[1] = (unsigned char)((counter
>> 16) & 0xff);
246 ctr
[2] = (unsigned char)((counter
>> 8) & 0xff);
247 ctr
[3] = (unsigned char)(counter
& 0xff);
249 if (!EVP_MD_CTX_copy_ex(ctx
, ctx_init
)
250 || !EVP_DigestUpdate(ctx
, z
, z_len
)
251 || !EVP_DigestUpdate(ctx
, other
, other_len
))
253 if (len
>= out_len
) {
254 if (!EVP_DigestFinal_ex(ctx
, out
, NULL
))
261 if (!EVP_DigestFinal_ex(ctx
, mac
, NULL
))
263 memcpy(out
, mac
, len
);
269 EVP_MD_CTX_free(ctx
);
270 EVP_MD_CTX_free(ctx_init
);
271 OPENSSL_cleanse(mac
, sizeof(mac
));
275 static void *x942kdf_new(void *provctx
)
279 if ((ctx
= OPENSSL_zalloc(sizeof(*ctx
))) == NULL
)
280 ERR_raise(ERR_LIB_PROV
, ERR_R_MALLOC_FAILURE
);
281 ctx
->provctx
= provctx
;
285 static void x942kdf_reset(void *vctx
)
287 KDF_X942
*ctx
= (KDF_X942
*)vctx
;
288 void *provctx
= ctx
->provctx
;
290 ossl_prov_digest_reset(&ctx
->digest
);
291 OPENSSL_clear_free(ctx
->secret
, ctx
->secret_len
);
292 OPENSSL_clear_free(ctx
->ukm
, ctx
->ukm_len
);
293 memset(ctx
, 0, sizeof(*ctx
));
294 ctx
->provctx
= provctx
;
297 static void x942kdf_free(void *vctx
)
299 KDF_X942
*ctx
= (KDF_X942
*)vctx
;
307 static int x942kdf_set_buffer(unsigned char **out
, size_t *out_len
,
310 if (p
->data_size
== 0 || p
->data
== NULL
)
315 return OSSL_PARAM_get_octet_string(p
, (void **)out
, 0, out_len
);
318 static size_t x942kdf_size(KDF_X942
*ctx
)
321 const EVP_MD
*md
= ossl_prov_digest_md(&ctx
->digest
);
324 ERR_raise(ERR_LIB_PROV
, PROV_R_MISSING_MESSAGE_DIGEST
);
327 len
= EVP_MD_size(md
);
328 return (len
<= 0) ? 0 : (size_t)len
;
331 static int x942kdf_derive(void *vctx
, unsigned char *key
, size_t keylen
)
333 KDF_X942
*ctx
= (KDF_X942
*)vctx
;
334 const EVP_MD
*md
= ossl_prov_digest_md(&ctx
->digest
);
337 unsigned char *der
= NULL
;
340 if (ctx
->secret
== NULL
) {
341 ERR_raise(ERR_LIB_PROV
, PROV_R_MISSING_SECRET
);
345 ERR_raise(ERR_LIB_PROV
, PROV_R_MISSING_MESSAGE_DIGEST
);
348 if (ctx
->cek_oid
== NULL
|| ctx
->cek_oid_len
== 0) {
349 ERR_raise(ERR_LIB_PROV
, PROV_R_MISSING_CEK_ALG
);
352 if (ctx
->ukm
!= NULL
&& ctx
->ukm_len
>= X942KDF_MAX_INLEN
) {
354 * Note the ukm length MUST be 512 bits.
355 * For backwards compatibility the old check is being done.
357 ERR_raise(ERR_LIB_PROV
, PROV_R_INAVLID_UKM_LENGTH
);
360 /* generate the otherinfo der */
361 if (!x942_encode_otherinfo(ctx
->dkm_len
,
362 ctx
->cek_oid
, ctx
->cek_oid_len
,
363 ctx
->ukm
, ctx
->ukm_len
,
364 &der
, &der_len
, &ctr
)) {
365 ERR_raise(ERR_LIB_PROV
, PROV_R_BAD_ENCODING
);
368 ret
= x942kdf_hash_kdm(md
, ctx
->secret
, ctx
->secret_len
,
369 der
, der_len
, ctr
, key
, keylen
);
374 static int x942kdf_set_ctx_params(void *vctx
, const OSSL_PARAM params
[])
377 KDF_X942
*ctx
= vctx
;
378 OPENSSL_CTX
*provctx
= PROV_LIBRARY_CONTEXT_OF(ctx
->provctx
);
381 if (!ossl_prov_digest_load_from_params(&ctx
->digest
, params
, provctx
))
384 if ((p
= OSSL_PARAM_locate_const(params
, OSSL_KDF_PARAM_SECRET
)) != NULL
385 || (p
= OSSL_PARAM_locate_const(params
, OSSL_KDF_PARAM_KEY
)) != NULL
)
386 if (!x942kdf_set_buffer(&ctx
->secret
, &ctx
->secret_len
, p
))
389 if ((p
= OSSL_PARAM_locate_const(params
, OSSL_KDF_PARAM_UKM
)) != NULL
)
390 if (!x942kdf_set_buffer(&ctx
->ukm
, &ctx
->ukm_len
, p
))
393 if ((p
= OSSL_PARAM_locate_const(params
, OSSL_KDF_PARAM_CEK_ALG
)) != NULL
) {
394 if (p
->data_type
!= OSSL_PARAM_UTF8_STRING
)
396 if (find_alg_id(provctx
, p
->data
, &id
) == 0)
398 ctx
->cek_oid
= kek_algs
[id
].oid
;
399 ctx
->cek_oid_len
= kek_algs
[id
].oid_len
;
400 ctx
->dkm_len
= kek_algs
[id
].keklen
;
405 static const OSSL_PARAM
*x942kdf_settable_ctx_params(void)
407 static const OSSL_PARAM known_settable_ctx_params
[] = {
408 OSSL_PARAM_utf8_string(OSSL_KDF_PARAM_PROPERTIES
, NULL
, 0),
409 OSSL_PARAM_utf8_string(OSSL_KDF_PARAM_DIGEST
, NULL
, 0),
410 OSSL_PARAM_octet_string(OSSL_KDF_PARAM_SECRET
, NULL
, 0),
411 OSSL_PARAM_octet_string(OSSL_KDF_PARAM_KEY
, NULL
, 0),
412 OSSL_PARAM_octet_string(OSSL_KDF_PARAM_UKM
, NULL
, 0),
413 OSSL_PARAM_utf8_string(OSSL_KDF_PARAM_CEK_ALG
, NULL
, 0),
416 return known_settable_ctx_params
;
419 static int x942kdf_get_ctx_params(void *vctx
, OSSL_PARAM params
[])
421 KDF_X942
*ctx
= (KDF_X942
*)vctx
;
424 if ((p
= OSSL_PARAM_locate(params
, OSSL_KDF_PARAM_SIZE
)) != NULL
)
425 return OSSL_PARAM_set_size_t(p
, x942kdf_size(ctx
));
429 static const OSSL_PARAM
*x942kdf_gettable_ctx_params(void)
431 static const OSSL_PARAM known_gettable_ctx_params
[] = {
432 OSSL_PARAM_size_t(OSSL_KDF_PARAM_SIZE
, NULL
),
435 return known_gettable_ctx_params
;
438 const OSSL_DISPATCH kdf_x942_kdf_functions
[] = {
439 { OSSL_FUNC_KDF_NEWCTX
, (void(*)(void))x942kdf_new
},
440 { OSSL_FUNC_KDF_FREECTX
, (void(*)(void))x942kdf_free
},
441 { OSSL_FUNC_KDF_RESET
, (void(*)(void))x942kdf_reset
},
442 { OSSL_FUNC_KDF_DERIVE
, (void(*)(void))x942kdf_derive
},
443 { OSSL_FUNC_KDF_SETTABLE_CTX_PARAMS
,
444 (void(*)(void))x942kdf_settable_ctx_params
},
445 { OSSL_FUNC_KDF_SET_CTX_PARAMS
, (void(*)(void))x942kdf_set_ctx_params
},
446 { OSSL_FUNC_KDF_GETTABLE_CTX_PARAMS
,
447 (void(*)(void))x942kdf_gettable_ctx_params
},
448 { OSSL_FUNC_KDF_GET_CTX_PARAMS
, (void(*)(void))x942kdf_get_ctx_params
},