#include <x509.h>
#include <dn.h>
#include <pkcs5.h>
+#include <pkcs12.h>
#include <privkey.h>
#include <extensions.h>
#include <mpi.h>
#include <gnutls_random.h>
#include <gnutls_num.h>
+typedef enum schema_id {
+ PBES2, /* the stuff in PKCS #5 */
+ PKCS12_3DES_SHA1 /* the fucking stuff in PKCS #12 */
+} schema_id;
+
#define PBES2_OID "1.2.840.113549.1.5.13"
#define PBKDF2_OID "1.2.840.113549.1.5.12"
#define DES_EDE3_CBC_OID "1.2.840.113549.3.7"
};
struct pbe_enc_params {
+ gnutls_cipher_algorithm cipher;
opaque iv[8];
int iv_size;
};
-static int generate_key( const char* password, unsigned int flags, struct pbkdf2_params* kdf_params,
- struct pbe_enc_params* enc_params, gnutls_datum * key);
-static int read_pbkdf2_params( ASN1_TYPE pbes2_asn, const gnutls_datum* der,
- struct pbkdf2_params* params);
-static int read_pbe_enc_params( ASN1_TYPE pbes2_asn, const gnutls_datum* der,
- struct pbe_enc_params* params);
-static int decrypt_data( ASN1_TYPE pkcs8_asn, const char* password,
- const struct pbkdf2_params* kdf_params, const struct pbe_enc_params *enc_params,
- gnutls_datum* decrypted_data);
-static ASN1_TYPE decode_private_key_info( const gnutls_datum* der, gnutls_x509_privkey pkey);
-static int write_pbe2_params( ASN1_TYPE pkcs8_asn, const struct pbkdf2_params* kdf_params,
- const struct pbe_enc_params* enc_params);
-static int encrypt_data( const gnutls_datum* plain,
- const struct pbe_enc_params *enc_params,
- gnutls_datum* key, gnutls_datum* encrypted);
+static int generate_key(const char *password, unsigned int flags,
+ struct pbkdf2_params *kdf_params,
+ struct pbe_enc_params *enc_params,
+ gnutls_datum * key);
+static int read_pbkdf2_params(ASN1_TYPE pbes2_asn,
+ const gnutls_datum * der,
+ struct pbkdf2_params *params);
+static int read_pbe_enc_params(ASN1_TYPE pbes2_asn,
+ const gnutls_datum * der,
+ struct pbe_enc_params *params);
+static int decrypt_data(schema_id, ASN1_TYPE pkcs8_asn, const char *root,
+ const char *password,
+ const struct pbkdf2_params *kdf_params,
+ const struct pbe_enc_params *enc_params,
+ gnutls_datum * decrypted_data);
+static ASN1_TYPE decode_private_key_info(const gnutls_datum * der,
+ gnutls_x509_privkey pkey);
+static int write_pbe2_params(ASN1_TYPE pkcs8_asn,
+ const struct pbkdf2_params *kdf_params,
+ const struct pbe_enc_params *enc_params);
+static int encrypt_data(const gnutls_datum * plain,
+ const struct pbe_enc_params *enc_params,
+ gnutls_datum * key, gnutls_datum * encrypted);
+
+static int read_pkcs12_kdf_params(ASN1_TYPE pbes2_asn,
+ struct pbkdf2_params *params);
#define PEM_PKCS8 "ENCRYPTED PRIVATE KEY"
#define PEM_UNENCRYPTED_PKCS8 "PRIVATE KEY"
+/* Returns a negative error code if the encryption schema in
+ * the OID is not supported. The schema ID is returned.
+ */
+inline static int check_schema(const char *oid)
+{
+
+ if (strcmp(oid, PBES2_OID) == 0)
+ return PBES2;
+
+ if (strcmp(oid, PBE_3DES_SHA1_OID) == 0)
+ return PKCS12_3DES_SHA1;
+
+ _gnutls_x509_log("PKCS encryption schema OID '%s' is unsupported.\n", oid);
+
+ return GNUTLS_E_UNKNOWN_CIPHER_TYPE;
+}
/*
* Encodes a PKCS #1 private key to a PKCS #8 private key
* info. The output will be allocated and stored into der. Also
* the ASN1_TYPE of private key info will be returned.
*/
-static int encode_to_private_key_info( gnutls_x509_privkey pkey, gnutls_datum* der,
- ASN1_TYPE *pkey_info)
+static int encode_to_private_key_info(gnutls_x509_privkey pkey,
+ gnutls_datum * der,
+ ASN1_TYPE * pkey_info)
{
int result, size;
opaque *data = NULL;
if ((result =
asn1_create_element(_gnutls_get_pkix(),
- "PKIX1.pkcs-8-PrivateKeyInfo", pkey_info
- )) != ASN1_SUCCESS) {
+ "PKIX1.pkcs-8-PrivateKeyInfo",
+ pkey_info)) != ASN1_SUCCESS) {
gnutls_assert();
result = _gnutls_asn2err(result);
goto error;
/* Write the version.
*/
- result = asn1_write_value( *pkey_info, "version", &null, 1);
+ result = asn1_write_value(*pkey_info, "version", &null, 1);
if (result != ASN1_SUCCESS) {
gnutls_assert();
result = _gnutls_asn2err(result);
/* write the privateKeyAlgorithm
* fields. (OID+NULL data)
*/
- result = asn1_write_value( *pkey_info, "privateKeyAlgorithm.algorithm", PKIX1_RSA_OID, 1);
+ result =
+ asn1_write_value(*pkey_info, "privateKeyAlgorithm.algorithm",
+ PKIX1_RSA_OID, 1);
if (result != ASN1_SUCCESS) {
gnutls_assert();
result = _gnutls_asn2err(result);
goto error;
}
- result = asn1_write_value( *pkey_info, "privateKeyAlgorithm.parameters", NULL, 0);
+ result =
+ asn1_write_value(*pkey_info, "privateKeyAlgorithm.parameters",
+ NULL, 0);
if (result != ASN1_SUCCESS) {
gnutls_assert();
result = _gnutls_asn2err(result);
/* Write the raw private key
*/
- result = gnutls_x509_privkey_export( pkey, GNUTLS_X509_FMT_DER, NULL, &size);
+ result =
+ gnutls_x509_privkey_export(pkey, GNUTLS_X509_FMT_DER, NULL,
+ &size);
if (result != GNUTLS_E_SHORT_MEMORY_BUFFER) {
gnutls_assert();
goto error;
}
- data = gnutls_alloca( size);
+ data = gnutls_alloca(size);
if (data == NULL) {
gnutls_assert();
result = GNUTLS_E_MEMORY_ERROR;
goto error;
}
-
- result = gnutls_x509_privkey_export( pkey, GNUTLS_X509_FMT_DER, data, &size);
+
+ result =
+ gnutls_x509_privkey_export(pkey, GNUTLS_X509_FMT_DER, data,
+ &size);
if (result < 0) {
gnutls_assert();
goto error;
}
- result = asn1_write_value( *pkey_info, "privateKey", data, size);
-
- gnutls_afree( data);
+ result = asn1_write_value(*pkey_info, "privateKey", data, size);
+
+ gnutls_afree(data);
data = NULL;
if (result != ASN1_SUCCESS) {
/* Append an empty Attributes field.
*/
- result = asn1_write_value( *pkey_info, "attributes", NULL, 0);
+ result = asn1_write_value(*pkey_info, "attributes", NULL, 0);
if (result != ASN1_SUCCESS) {
gnutls_assert();
result = _gnutls_asn2err(result);
/* DER Encode the generated private key info.
*/
size = 0;
- result = asn1_der_coding( *pkey_info, "", NULL, &size, NULL);
+ result = asn1_der_coding(*pkey_info, "", NULL, &size, NULL);
if (result != ASN1_MEM_ERROR) {
gnutls_assert();
result = _gnutls_asn2err(result);
/* allocate data for the der
*/
der->size = size;
- der->data = gnutls_malloc( size);
+ der->data = gnutls_malloc(size);
if (der->data == NULL) {
gnutls_assert();
return GNUTLS_E_MEMORY_ERROR;
}
- result = asn1_der_coding( *pkey_info, "", der->data, &size, NULL);
+ result = asn1_der_coding(*pkey_info, "", der->data, &size, NULL);
if (result != ASN1_SUCCESS) {
gnutls_assert();
result = _gnutls_asn2err(result);
return 0;
- error:
- asn1_delete_structure( pkey_info);
- if (data != NULL) { gnutls_afree(data); }
- return result;
+ error:
+ asn1_delete_structure(pkey_info);
+ if (data != NULL) {
+ gnutls_afree(data);
+ }
+ return result;
}
/* Converts a PKCS #8 private key info to
* a PKCS #8 EncryptedPrivateKeyInfo.
*/
-static ASN1_TYPE encode_to_pkcs8_key( const gnutls_datum *raw_key,
- const char* password, unsigned int flags)
+static ASN1_TYPE encode_to_pkcs8_key(const gnutls_datum * raw_key,
+ const char *password,
+ unsigned int flags)
{
int result;
- gnutls_datum key = {NULL, 0};
- gnutls_datum tmp = {NULL, 0};
+ gnutls_datum key = { NULL, 0 };
+ gnutls_datum tmp = { NULL, 0 };
ASN1_TYPE pkcs8_asn = ASN1_TYPE_EMPTY;
struct pbkdf2_params kdf_params;
struct pbe_enc_params enc_params;
if ((result =
asn1_create_element(_gnutls_get_pkix(),
- "PKIX1.pkcs-8-EncryptedPrivateKeyInfo", &pkcs8_asn
- )) != ASN1_SUCCESS) {
+ "PKIX1.pkcs-8-EncryptedPrivateKeyInfo",
+ &pkcs8_asn)) != ASN1_SUCCESS) {
gnutls_assert();
goto error;
}
/* Write the encryption schema OID
*/
- result = asn1_write_value( pkcs8_asn, "encryptionAlgorithm.algorithm", PBES2_OID, 1);
+ result =
+ asn1_write_value(pkcs8_asn, "encryptionAlgorithm.algorithm",
+ PBES2_OID, 1);
if (result != ASN1_SUCCESS) {
gnutls_assert();
goto error;
/* Generate a symmetric key.
*/
- result = generate_key( password, flags, &kdf_params, &enc_params, &key);
+ result =
+ generate_key(password, flags, &kdf_params, &enc_params, &key);
if (result < 0) {
gnutls_assert();
goto error;
}
- result = write_pbe2_params( pkcs8_asn, &kdf_params, &enc_params);
+ result = write_pbe2_params(pkcs8_asn, &kdf_params, &enc_params);
if (result < 0) {
gnutls_assert();
goto error;
}
- /* Parameters have been decoded. Now
- * decrypt the EncryptedData.
+ /* Parameters have been encoded. Now
+ * encrypt the Data.
*/
- result = encrypt_data( raw_key, &enc_params, &key, &tmp);
+ result = encrypt_data(raw_key, &enc_params, &key, &tmp);
if (result < 0) {
gnutls_assert();
goto error;
/* write the encrypted data.
*/
- result = asn1_write_value( pkcs8_asn, "encryptedData", tmp.data, tmp.size);
+ result =
+ asn1_write_value(pkcs8_asn, "encryptedData", tmp.data,
+ tmp.size);
if (result != ASN1_SUCCESS) {
gnutls_assert();
goto error;
}
-
- _gnutls_free_datum( &tmp);
- _gnutls_free_datum( &key);
+
+ _gnutls_free_datum(&tmp);
+ _gnutls_free_datum(&key);
return pkcs8_asn;
- error:
- _gnutls_free_datum( &key);
- _gnutls_free_datum( &tmp);
- asn1_delete_structure(&pkcs8_asn);
- return NULL;
+ error:
+ _gnutls_free_datum(&key);
+ _gnutls_free_datum(&tmp);
+ asn1_delete_structure(&pkcs8_asn);
+ return NULL;
}
* 0 on success.
*
**/
-int gnutls_x509_privkey_export_pkcs8( gnutls_x509_privkey key,
- gnutls_x509_crt_fmt format, const char* password, unsigned int flags,
- unsigned char* output_data, int* output_data_size)
+int gnutls_x509_privkey_export_pkcs8(gnutls_x509_privkey key,
+ gnutls_x509_crt_fmt format,
+ const char *password,
+ unsigned int flags,
+ unsigned char *output_data,
+ int *output_data_size)
{
-ASN1_TYPE pkcs8_asn, pkey_info;
-int ret;
-gnutls_datum tmp;
+ ASN1_TYPE pkcs8_asn, pkey_info;
+ int ret;
+ gnutls_datum tmp;
/* Get the private key info
*/
- ret = encode_to_private_key_info( key, &tmp, &pkey_info);
- if ( ret < 0) {
+ ret = encode_to_private_key_info(key, &tmp, &pkey_info);
+ if (ret < 0) {
gnutls_assert();
return ret;
}
if (!(flags & GNUTLS_PKCS8_PLAIN) || password == NULL) {
- asn1_delete_structure( &pkey_info); /* we don't need it */
+ asn1_delete_structure(&pkey_info); /* we don't need it */
- pkcs8_asn = encode_to_pkcs8_key( &tmp, password, flags);
- _gnutls_free_datum( &tmp);
+ pkcs8_asn = encode_to_pkcs8_key(&tmp, password, flags);
+ _gnutls_free_datum(&tmp);
if (pkcs8_asn == NULL) {
gnutls_assert();
return GNUTLS_E_ASN1_GENERIC_ERROR;
}
-
- ret = _gnutls_x509_export_int( pkcs8_asn, format, PEM_PKCS8, *output_data_size,
- output_data, output_data_size);
- asn1_delete_structure( &pkcs8_asn);
+ ret =
+ _gnutls_x509_export_int(pkcs8_asn, format, PEM_PKCS8,
+ *output_data_size, output_data,
+ output_data_size);
+
+ asn1_delete_structure(&pkcs8_asn);
} else {
- _gnutls_free_datum( &tmp);
+ _gnutls_free_datum(&tmp);
- ret = _gnutls_x509_export_int( pkey_info, format, PEM_UNENCRYPTED_PKCS8,
- *output_data_size, output_data, output_data_size);
-
- asn1_delete_structure( &pkey_info);
+ ret =
+ _gnutls_x509_export_int(pkey_info, format,
+ PEM_UNENCRYPTED_PKCS8,
+ *output_data_size, output_data,
+ output_data_size);
+
+ asn1_delete_structure(&pkey_info);
}
return ret;
}
+/* Read the parameters cipher, IV, salt etc using the given
+ * schema ID.
+ */
+static
+int read_pkcs_schema_params(schema_id schema, const char* password,
+ const opaque * data, int data_size,
+ struct pbkdf2_params *kdf_params,
+ struct pbe_enc_params *enc_params)
+{
+ ASN1_TYPE pbes2_asn = ASN1_TYPE_EMPTY;
+ int result;
+ gnutls_datum tmp;
+
+ switch (schema) {
+
+ case PBES2:
+
+ /* Now check the key derivation and the encryption
+ * functions.
+ */
+ if ((result =
+ asn1_create_element(_gnutls_get_pkix(),
+ "PKIX1.pkcs-5-PBES2-params",
+ &pbes2_asn)) != ASN1_SUCCESS) {
+ gnutls_assert();
+ result = _gnutls_asn2err(result);
+ goto error;
+ }
+
+ /* Decode the parameters.
+ */
+ result =
+ asn1_der_decoding(&pbes2_asn,
+ data, data_size, NULL);
+ if (result != ASN1_SUCCESS) {
+ gnutls_assert();
+ result = _gnutls_asn2err(result);
+ goto error;
+ }
+
+ tmp.data = (opaque*)data;
+ tmp.size = data_size;
+
+ result = read_pbkdf2_params(pbes2_asn, &tmp, kdf_params);
+ if (result < 0) {
+ gnutls_assert();
+ result = _gnutls_asn2err(result);
+ goto error;
+ }
+
+ result = read_pbe_enc_params(pbes2_asn, &tmp, enc_params);
+ if (result < 0) {
+ gnutls_assert();
+ result = _gnutls_asn2err(result);
+ goto error;
+ }
+
+ asn1_delete_structure(&pbes2_asn);
+ return 0;
+ break;
+
+ case PKCS12_3DES_SHA1:
+ if ((result =
+ asn1_create_element(_gnutls_get_pkix(),
+ "PKIX1.pkcs-12-PbeParams",
+ &pbes2_asn)) != ASN1_SUCCESS) {
+ gnutls_assert();
+ result = _gnutls_asn2err(result);
+ goto error;
+ }
+
+ /* Decode the parameters.
+ */
+ result =
+ asn1_der_decoding(&pbes2_asn,
+ data, data_size, NULL);
+ if (result != ASN1_SUCCESS) {
+ gnutls_assert();
+ result = _gnutls_asn2err(result);
+ goto error;
+ }
+
+ result = read_pkcs12_kdf_params(pbes2_asn, kdf_params);
+ if (result < 0) {
+ gnutls_assert();
+ result = _gnutls_asn2err(result);
+ goto error;
+ }
+
+ enc_params->cipher = GNUTLS_CIPHER_3DES_CBC;
+ enc_params->iv_size = 8;
+ _pkcs12_string_to_key( 2/*IV*/, kdf_params->salt, kdf_params->salt_size,
+ kdf_params->iter_count, password, 8, enc_params->iv);
+
+ asn1_delete_structure(&pbes2_asn);
+
+ return 0;
+ break;
+
+ } /* switch */
+
+ return GNUTLS_E_UNKNOWN_CIPHER_TYPE;
+
+ error:
+ asn1_delete_structure(&pbes2_asn);
+ return result;
+}
+
/* Converts a PKCS #8 key to
* an internal structure (gnutls_private_key)
* (normally a PKCS #1 encoded RSA key)
*/
-static ASN1_TYPE decode_pkcs8_key( const gnutls_datum *raw_key,
- const char* password, gnutls_x509_privkey pkey)
+static ASN1_TYPE decode_pkcs8_key(const gnutls_datum * raw_key,
+ const char *password,
+ gnutls_x509_privkey pkey)
{
int result, len;
opaque enc_oid[64];
int params_start, params_end, params_len;
struct pbkdf2_params kdf_params;
struct pbe_enc_params enc_params;
-
+ schema_id schema;
if ((result =
asn1_create_element(_gnutls_get_pkix(),
- "PKIX1.pkcs-8-EncryptedPrivateKeyInfo", &pkcs8_asn
- )) != ASN1_SUCCESS) {
+ "PKIX1.pkcs-8-EncryptedPrivateKeyInfo",
+ &pkcs8_asn)) != ASN1_SUCCESS) {
gnutls_assert();
goto error;
}
- result = asn1_der_decoding(&pkcs8_asn, raw_key->data, raw_key->size, NULL);
+ result =
+ asn1_der_decoding(&pkcs8_asn, raw_key->data, raw_key->size,
+ NULL);
if (result != ASN1_SUCCESS) {
gnutls_assert();
goto error;
/* Check the encryption schema OID
*/
len = sizeof(enc_oid);
- result = asn1_read_value( pkcs8_asn, "encryptionAlgorithm.algorithm", enc_oid, &len);
+ result =
+ asn1_read_value(pkcs8_asn, "encryptionAlgorithm.algorithm",
+ enc_oid, &len);
if (result != ASN1_SUCCESS) {
gnutls_assert();
goto error;
}
- /* we only support PBES2
- */
- if (strcmp( enc_oid, PBES2_OID) != 0) {
+ if ((result = check_schema(enc_oid)) < 0) {
gnutls_assert();
- _gnutls_x509_log( "PKCS #8 encryption schema OID '%s' is unsupported.\n", enc_oid);
goto error;
}
+ schema = result;
+
/* Get the DER encoding of the parameters.
*/
- result = asn1_der_decoding_startEnd( pkcs8_asn, raw_key->data, raw_key->size,
- "encryptionAlgorithm.parameters", ¶ms_start, ¶ms_end);
+ result =
+ asn1_der_decoding_startEnd(pkcs8_asn, raw_key->data,
+ raw_key->size,
+ "encryptionAlgorithm.parameters",
+ ¶ms_start, ¶ms_end);
if (result != ASN1_SUCCESS) {
gnutls_assert();
goto error;
}
params_len = params_end - params_start + 1;
- /* Now check the key derivation and the encryption
- * functions.
- */
- if ((result =
- asn1_create_element(_gnutls_get_pkix(),
- "PKIX1.pkcs-5-PBES2-params", &pbes2_asn
- )) != ASN1_SUCCESS) {
- gnutls_assert();
- return NULL;
- }
-
- /* Decode the parameters.
- */
- result = asn1_der_decoding(&pbes2_asn, &raw_key->data[params_start], params_len, NULL);
- if (result != ASN1_SUCCESS) {
- gnutls_assert();
- goto error;
- }
-
- tmp.data = &raw_key->data[params_start];
- tmp.size = params_len;
-
- result = read_pbkdf2_params( pbes2_asn, &tmp, &kdf_params);
- if (result < 0) {
- gnutls_assert();
- goto error;
- }
-
- result = read_pbe_enc_params( pbes2_asn, &tmp, &enc_params);
- if (result < 0) {
- gnutls_assert();
- goto error;
- }
-
- asn1_delete_structure( &pbes2_asn);
+ result =
+ read_pkcs_schema_params(schema, password,
+ &raw_key->data[params_start],
+ params_len, &kdf_params, &enc_params);
/* Parameters have been decoded. Now
* decrypt the EncryptedData.
*/
- result = decrypt_data( pkcs8_asn, password, &kdf_params, &enc_params, &tmp);
+ result =
+ decrypt_data(schema, pkcs8_asn, "encryptedData", password, &kdf_params,
+ &enc_params, &tmp);
if (result < 0) {
gnutls_assert();
goto error;
asn1_delete_structure(&pkcs8_asn);
- ret_asn = decode_private_key_info( &tmp, pkey);
- _gnutls_free_datum( &tmp);
+ ret_asn = decode_private_key_info(&tmp, pkey);
+ _gnutls_free_datum(&tmp);
return ret_asn;
- error:
- asn1_delete_structure(&pbes2_asn);
- asn1_delete_structure(&pkcs8_asn);
- return NULL;
+ error:
+ asn1_delete_structure(&pbes2_asn);
+ asn1_delete_structure(&pkcs8_asn);
+ return NULL;
}
-static ASN1_TYPE decode_private_key_info( const gnutls_datum* der, gnutls_x509_privkey pkey)
+static ASN1_TYPE decode_private_key_info(const gnutls_datum * der,
+ gnutls_x509_privkey pkey)
{
int result, len;
opaque oid[64], *data = NULL;
if ((result =
asn1_create_element(_gnutls_get_pkix(),
- "PKIX1.pkcs-8-PrivateKeyInfo", &pkcs8_asn
- )) != ASN1_SUCCESS) {
+ "PKIX1.pkcs-8-PrivateKeyInfo",
+ &pkcs8_asn)) != ASN1_SUCCESS) {
gnutls_assert();
goto error;
}
/* Check the private key algorithm OID
*/
len = sizeof(oid);
- result = asn1_read_value( pkcs8_asn, "privateKeyAlgorithm.algorithm", oid, &len);
+ result =
+ asn1_read_value(pkcs8_asn, "privateKeyAlgorithm.algorithm",
+ oid, &len);
if (result != ASN1_SUCCESS) {
gnutls_assert();
goto error;
/* we only support RSA private keys.
*/
- if (strcmp( oid, PKIX1_RSA_OID) != 0) {
+ if (strcmp(oid, PKIX1_RSA_OID) != 0) {
gnutls_assert();
- _gnutls_x509_log( "PKCS #8 private key OID '%s' is unsupported.\n", oid);
+ _gnutls_x509_log
+ ("PKCS #8 private key OID '%s' is unsupported.\n",
+ oid);
goto error;
}
/* Get the DER encoding of the actual private key.
*/
data_size = 0;
- result = asn1_read_value( pkcs8_asn, "privateKey", NULL, &data_size);
+ result =
+ asn1_read_value(pkcs8_asn, "privateKey", NULL, &data_size);
if (result != ASN1_MEM_ERROR) {
gnutls_assert();
result = _gnutls_asn2err(result);
goto error;
}
- data = gnutls_alloca( data_size);
+ data = gnutls_alloca(data_size);
if (data == NULL) {
gnutls_assert();
result = GNUTLS_E_MEMORY_ERROR;
goto error;
}
- result = asn1_read_value( pkcs8_asn, "privateKey", data, &data_size);
+ result =
+ asn1_read_value(pkcs8_asn, "privateKey", data, &data_size);
if (result != ASN1_SUCCESS) {
gnutls_assert();
result = _gnutls_asn2err(result);
goto error;
}
- asn1_delete_structure( &pkcs8_asn);
-
+ asn1_delete_structure(&pkcs8_asn);
+
tmp.data = data;
tmp.size = data_size;
-
+
pkey->pk_algorithm = GNUTLS_PK_RSA;
- ret_asn = _gnutls_privkey_decode_pkcs1_rsa_key( &tmp, pkey);
- if (ret_asn==NULL) {
+ ret_asn = _gnutls_privkey_decode_pkcs1_rsa_key(&tmp, pkey);
+ if (ret_asn == NULL) {
gnutls_assert();
}
-
+
return ret_asn;
- error:
- asn1_delete_structure( &pkcs8_asn);
- if (data != NULL) { gnutls_afree(data); }
- return NULL;
+ error:
+ asn1_delete_structure(&pkcs8_asn);
+ if (data != NULL) {
+ gnutls_afree(data);
+ }
+ return NULL;
}
* Returns 0 on success.
*
**/
-int gnutls_x509_privkey_import_pkcs8(gnutls_x509_privkey key, const gnutls_datum * data,
- gnutls_x509_crt_fmt format, const char * password, unsigned int flags)
+int gnutls_x509_privkey_import_pkcs8(gnutls_x509_privkey key,
+ const gnutls_datum * data,
+ gnutls_x509_crt_fmt format,
+ const char *password,
+ unsigned int flags)
{
int result = 0, need_free = 0;
gnutls_datum _data = { data->data, data->size };
/* Try the first header
*/
- result = _gnutls_fbase64_decode(PEM_UNENCRYPTED_PKCS8, data->data, data->size,
- &out);
+ result =
+ _gnutls_fbase64_decode(PEM_UNENCRYPTED_PKCS8,
+ data->data, data->size, &out);
encrypted = 0;
-
- if (result < 0) { /* Try the encrypted header
- */
- result = _gnutls_fbase64_decode(PEM_PKCS8, data->data, data->size,
- &out);
+
+ if (result < 0) { /* Try the encrypted header
+ */
+ result =
+ _gnutls_fbase64_decode(PEM_PKCS8, data->data,
+ data->size, &out);
if (result <= 0) {
- if (result==0) result = GNUTLS_E_INTERNAL_ERROR;
+ if (result == 0)
+ result = GNUTLS_E_INTERNAL_ERROR;
gnutls_assert();
return result;
}
-
+
encrypted = 1;
}
_data.data = out;
_data.size = result;
-
+
need_free = 1;
}
if (flags & GNUTLS_PKCS8_PLAIN || password == NULL) {
- key->key = decode_private_key_info( &_data, key);
- } else { /* encrypted. */
- key->key = decode_pkcs8_key( &_data, password, key);
+ key->key = decode_private_key_info(&_data, key);
+ } else { /* encrypted. */
+ key->key = decode_pkcs8_key(&_data, password, key);
}
if (key->key == NULL) {
goto cleanup;
}
- if (need_free) _gnutls_free_datum( &_data);
+ if (need_free)
+ _gnutls_free_datum(&_data);
/* The key has now been decoded.
*/
return 0;
cleanup:
- key->pk_algorithm = GNUTLS_PK_UNKNOWN;
- if (need_free) _gnutls_free_datum( &_data);
+ key->pk_algorithm = GNUTLS_PK_UNKNOWN;
+ if (need_free)
+ _gnutls_free_datum(&_data);
return result;
}
/* Reads the PBKDF2 parameters.
*/
-static int read_pbkdf2_params( ASN1_TYPE pbes2_asn, const gnutls_datum* der,
- struct pbkdf2_params* params)
+static int read_pbkdf2_params(ASN1_TYPE pbes2_asn,
+ const gnutls_datum * der,
+ struct pbkdf2_params *params)
{
-int params_start, params_end;
-int params_len, len, result;
-ASN1_TYPE pbkdf2_asn = ASN1_TYPE_EMPTY;
-char oid[64];
+ int params_start, params_end;
+ int params_len, len, result;
+ ASN1_TYPE pbkdf2_asn = ASN1_TYPE_EMPTY;
+ char oid[64];
- memset( params, 0, sizeof(params));
+ memset(params, 0, sizeof(params));
/* Check the key derivation algorithm
*/
len = sizeof(oid);
- result = asn1_read_value( pbes2_asn, "keyDerivationFunc.algorithm", oid, &len);
+ result =
+ asn1_read_value(pbes2_asn, "keyDerivationFunc.algorithm", oid,
+ &len);
if (result != ASN1_SUCCESS) {
gnutls_assert();
return _gnutls_asn2err(result);
}
- _gnutls_hard_log( "keyDerivationFunc.algorithm: %s\n", oid);
-
- if (strcmp( oid, PBKDF2_OID) != 0) {
+ _gnutls_hard_log("keyDerivationFunc.algorithm: %s\n", oid);
+
+ if (strcmp(oid, PBKDF2_OID) != 0) {
gnutls_assert();
- _gnutls_x509_log( "PKCS #8 key derivation OID '%s' is unsupported.\n", oid);
+ _gnutls_x509_log
+ ("PKCS #8 key derivation OID '%s' is unsupported.\n",
+ oid);
return _gnutls_asn2err(result);
}
- result = asn1_der_decoding_startEnd( pbes2_asn, der->data, der->size,
- "keyDerivationFunc.parameters", ¶ms_start, ¶ms_end);
+ result =
+ asn1_der_decoding_startEnd(pbes2_asn, der->data, der->size,
+ "keyDerivationFunc.parameters",
+ ¶ms_start, ¶ms_end);
if (result != ASN1_SUCCESS) {
gnutls_assert();
return _gnutls_asn2err(result);
*/
if ((result =
asn1_create_element(_gnutls_get_pkix(),
- "PKIX1.pkcs-5-PBKDF2-params", &pbkdf2_asn
- )) != ASN1_SUCCESS) {
+ "PKIX1.pkcs-5-PBKDF2-params",
+ &pbkdf2_asn)) != ASN1_SUCCESS) {
gnutls_assert();
return _gnutls_asn2err(result);
}
-
- result = asn1_der_decoding(&pbkdf2_asn, &der->data[params_start], params_len, NULL);
+
+ result =
+ asn1_der_decoding(&pbkdf2_asn, &der->data[params_start],
+ params_len, NULL);
if (result != ASN1_SUCCESS) {
gnutls_assert();
result = _gnutls_asn2err(result);
/* read the salt */
params->salt_size = sizeof(params->salt);
- result = asn1_read_value( pbkdf2_asn, "salt.specified", params->salt, ¶ms->salt_size);
+ result =
+ asn1_read_value(pbkdf2_asn, "salt.specified", params->salt,
+ ¶ms->salt_size);
if (result != ASN1_SUCCESS) {
gnutls_assert();
result = _gnutls_asn2err(result);
goto error;
}
- _gnutls_hard_log( "salt.specified.size: %d\n", params->salt_size);
+ _gnutls_hard_log("salt.specified.size: %d\n", params->salt_size);
/* read the iteration count
*/
len = sizeof(oid);
- result = _gnutls_x509_read_ui( pbkdf2_asn, "iterationCount", oid, len, ¶ms->iter_count);
+ result =
+ _gnutls_x509_read_ui(pbkdf2_asn, "iterationCount", oid, len,
+ ¶ms->iter_count);
if (result != ASN1_SUCCESS) {
gnutls_assert();
goto error;
}
- _gnutls_hard_log( "iterationCount: %d\n", params->iter_count);
+ _gnutls_hard_log("iterationCount: %d\n", params->iter_count);
/* read the keylength, if it is set.
*/
len = sizeof(oid);
- result = _gnutls_x509_read_ui( pbkdf2_asn, "keyLength", oid, len, ¶ms->key_size);
+ result =
+ _gnutls_x509_read_ui(pbkdf2_asn, "keyLength", oid, len,
+ ¶ms->key_size);
if (result < 0) {
params->key_size = 0;
}
- _gnutls_hard_log( "keyLength: %d\n", params->key_size);
-
+ _gnutls_hard_log("keyLength: %d\n", params->key_size);
+
/* We don't read the PRF. We only use the default.
*/
return 0;
- error:
- asn1_delete_structure( &pbkdf2_asn);
- return result;
+ error:
+ asn1_delete_structure(&pbkdf2_asn);
+ return result;
}
-static int read_pbe_enc_params( ASN1_TYPE pbes2_asn, const gnutls_datum* der,
- struct pbe_enc_params* params)
+/* Reads the PBE parameters from PKCS-12 schemas (*&#%*&#% RSA).
+ */
+static int read_pkcs12_kdf_params(ASN1_TYPE pbes2_asn,
+ struct pbkdf2_params *params)
{
-int params_start, params_end;
-int params_len, len, result;
-ASN1_TYPE pbe_asn = ASN1_TYPE_EMPTY;
-char oid[64];
+ int len, result;
+ char oid[64];
+
+ memset(params, 0, sizeof(params));
+
+ /* read the salt */
+ params->salt_size = sizeof(params->salt);
+ result =
+ asn1_read_value(pbes2_asn, "salt", params->salt,
+ ¶ms->salt_size);
+ if (result != ASN1_SUCCESS) {
+ gnutls_assert();
+ result = _gnutls_asn2err(result);
+ goto error;
+ }
+ _gnutls_hard_log("salt.size: %d\n", params->salt_size);
+
+ /* read the iteration count
+ */
+ len = sizeof(oid);
+ result =
+ _gnutls_x509_read_ui(pbes2_asn, "iterations", oid, len,
+ ¶ms->iter_count);
+ if (result != ASN1_SUCCESS) {
+ gnutls_assert();
+ goto error;
+ }
+ _gnutls_hard_log("iterationCount: %d\n", params->iter_count);
- memset( params, 0, sizeof(params));
+ params->key_size = 0;
+
+ return 0;
+
+ error:
+ return result;
+
+}
+
+
+/* Converts an OID to a gnutls cipher type.
+ */
+inline
+ static int oid2cipher(const char *oid, gnutls_cipher_algorithm * algo)
+{
+
+ *algo = 0;
+
+ if (strcmp(oid, DES_EDE3_CBC_OID) == 0) {
+ *algo = GNUTLS_CIPHER_3DES_CBC;
+ return 0;
+ }
+
+ _gnutls_x509_log("PKCS #8 encryption OID '%s' is unsupported.\n",
+ oid);
+ return GNUTLS_E_UNKNOWN_CIPHER_TYPE;
+}
+
+
+static int read_pbe_enc_params(ASN1_TYPE pbes2_asn,
+ const gnutls_datum * der,
+ struct pbe_enc_params *params)
+{
+ int params_start, params_end;
+ int params_len, len, result;
+ ASN1_TYPE pbe_asn = ASN1_TYPE_EMPTY;
+ char oid[64];
+
+ memset(params, 0, sizeof(params));
/* Check the encryption algorithm
*/
len = sizeof(oid);
- result = asn1_read_value( pbes2_asn, "encryptionScheme.algorithm", oid, &len);
+ result =
+ asn1_read_value(pbes2_asn, "encryptionScheme.algorithm", oid,
+ &len);
if (result != ASN1_SUCCESS) {
gnutls_assert();
goto error;
}
- _gnutls_hard_log( "encryptionScheme.algorithm: %s\n", oid);
-
- if (strcmp( oid, DES_EDE3_CBC_OID) != 0) {
+ _gnutls_hard_log("encryptionScheme.algorithm: %s\n", oid);
+
+ if ((result = oid2cipher(oid, ¶ms->cipher)) < 0) {
gnutls_assert();
- _gnutls_x509_log( "PKCS #8 encryption OID '%s' is unsupported.\n", oid);
goto error;
}
- result = asn1_der_decoding_startEnd( pbes2_asn, der->data, der->size,
- "encryptionScheme.parameters", ¶ms_start, ¶ms_end);
+ result =
+ asn1_der_decoding_startEnd(pbes2_asn, der->data, der->size,
+ "encryptionScheme.parameters",
+ ¶ms_start, ¶ms_end);
if (result != ASN1_SUCCESS) {
gnutls_assert();
return _gnutls_asn2err(result);
*/
if ((result =
asn1_create_element(_gnutls_get_pkix(),
- "PKIX1.pkcs-5-des-EDE3-CBC-params", &pbe_asn
- )) != ASN1_SUCCESS) {
+ "PKIX1.pkcs-5-des-EDE3-CBC-params",
+ &pbe_asn)) != ASN1_SUCCESS) {
gnutls_assert();
return _gnutls_asn2err(result);
}
-
- result = asn1_der_decoding(&pbe_asn, &der->data[params_start], params_len, NULL);
+
+ result =
+ asn1_der_decoding(&pbe_asn, &der->data[params_start],
+ params_len, NULL);
if (result != ASN1_SUCCESS) {
gnutls_assert();
result = _gnutls_asn2err(result);
/* read the IV */
params->iv_size = sizeof(params->iv);
- result = asn1_read_value( pbe_asn, "", params->iv, ¶ms->iv_size);
+ result =
+ asn1_read_value(pbe_asn, "", params->iv, ¶ms->iv_size);
if (result != ASN1_SUCCESS) {
gnutls_assert();
result = _gnutls_asn2err(result);
goto error;
}
- _gnutls_hard_log( "IV.size: %d\n", params->iv_size);
+ _gnutls_hard_log("IV.size: %d\n", params->iv_size);
return 0;
- error:
- asn1_delete_structure( &pbe_asn);
- return result;
+ error:
+ asn1_delete_structure(&pbe_asn);
+ return result;
}
-static int decrypt_data( ASN1_TYPE pkcs8_asn, const char* password,
- const struct pbkdf2_params *kdf_params, const struct pbe_enc_params *enc_params,
- gnutls_datum* decrypted_data)
+static int decrypt_data(schema_id schema, ASN1_TYPE pkcs8_asn, const char *root,
+ const char *password,
+ const struct pbkdf2_params *kdf_params,
+ const struct pbe_enc_params *enc_params,
+ gnutls_datum * decrypted_data)
{
-int result;
-int data_size;
-opaque* data=NULL, *key = NULL;
-gnutls_datum dkey, div;
-GNUTLS_CIPHER_HANDLE ch = NULL;
-int key_size;
+ int result;
+ int data_size;
+ opaque *data = NULL, *key = NULL;
+ gnutls_datum dkey, div;
+ GNUTLS_CIPHER_HANDLE ch = NULL;
+ int key_size;
data_size = 0;
- result = asn1_read_value( pkcs8_asn, "encryptedData", NULL, &data_size);
+ result = asn1_read_value(pkcs8_asn, root, NULL, &data_size);
if (result != ASN1_MEM_ERROR) {
gnutls_assert();
return _gnutls_asn2err(result);
}
- data = gnutls_malloc( data_size);
+ data = gnutls_malloc(data_size);
if (data == NULL) {
gnutls_assert();
return GNUTLS_E_MEMORY_ERROR;
}
- result = asn1_read_value( pkcs8_asn, "encryptedData", data, &data_size);
+ result = asn1_read_value(pkcs8_asn, root, data, &data_size);
if (result != ASN1_SUCCESS) {
gnutls_assert();
result = _gnutls_asn2err(result);
}
if (kdf_params->key_size == 0) {
- key_size = gnutls_cipher_get_key_size( GNUTLS_CIPHER_3DES_CBC);
- } else key_size = kdf_params->key_size;
+ key_size = gnutls_cipher_get_key_size(enc_params->cipher);
+ } else
+ key_size = kdf_params->key_size;
- key = gnutls_alloca( key_size);
- if ( key == NULL) {
+ key = gnutls_alloca(key_size);
+ if (key == NULL) {
gnutls_assert();
result = GNUTLS_E_MEMORY_ERROR;
goto error;
/* generate the key
*/
- result = _gnutls_pkcs5_pbkdf2( PKCS5_PRF_SHA1, password, strlen(password),
- kdf_params->salt, kdf_params->salt_size, kdf_params->iter_count,
- key_size, key);
+ if (schema == PBES2) {
+ result =
+ _gnutls_pkcs5_pbkdf2(PKCS5_PRF_SHA1, password,
+ strlen(password), kdf_params->salt,
+ kdf_params->salt_size,
+ kdf_params->iter_count, key_size, key);
- if (result != PKCS5_OK) {
- gnutls_assert();
- result = GNUTLS_E_DECRYPTION_FAILED;
- goto error;
+ if (result != PKCS5_OK) {
+ gnutls_assert();
+ result = GNUTLS_E_DECRYPTION_FAILED;
+ goto error;
+ }
+ } else {
+ result =
+ _pkcs12_string_to_key( 1/*KEY*/, kdf_params->salt, kdf_params->salt_size,
+ kdf_params->iter_count, password, key_size, key);
+
+ if (result < 0) {
+ gnutls_assert();
+ goto error;
+ }
}
/* do the decryption.
*/
dkey.data = key;
dkey.size = key_size;
-
- div.data = (opaque*) enc_params->iv;
+
+ div.data = (opaque *) enc_params->iv;
div.size = enc_params->iv_size;
- ch = _gnutls_cipher_init( GNUTLS_CIPHER_3DES_CBC, &dkey, &div);
+ ch = _gnutls_cipher_init(enc_params->cipher, &dkey, &div);
- gnutls_afree( key);
+ gnutls_afree(key);
key = NULL;
if (ch == NULL) {
result = GNUTLS_E_DECRYPTION_FAILED;
goto error;
}
-
- result = _gnutls_cipher_decrypt( ch, data, data_size);
+
+ result = _gnutls_cipher_decrypt(ch, data, data_size);
if (result < 0) {
gnutls_assert();
goto error;
}
decrypted_data->data = data;
- decrypted_data->size = data_size - data[data_size-1];
+ decrypted_data->size = data_size - data[data_size - 1];
- _gnutls_cipher_deinit( ch);
+ _gnutls_cipher_deinit(ch);
return 0;
- error:
- gnutls_free(data);
- gnutls_afree(key);
- if (ch!=NULL)
- _gnutls_cipher_deinit( ch);
- return result;
+ error:
+ gnutls_free(data);
+ gnutls_afree(key);
+ if (ch != NULL)
+ _gnutls_cipher_deinit(ch);
+ return result;
}
/* Writes the PBKDF2 parameters.
*/
-static int write_pbkdf2_params( ASN1_TYPE pbes2_asn, const struct pbkdf2_params *kdf_params)
+static int write_pbkdf2_params(ASN1_TYPE pbes2_asn,
+ const struct pbkdf2_params *kdf_params)
{
-int result;
-ASN1_TYPE pbkdf2_asn = ASN1_TYPE_EMPTY;
-char tmp[64];
+ int result;
+ ASN1_TYPE pbkdf2_asn = ASN1_TYPE_EMPTY;
+ char tmp[64];
/* Write the key derivation algorithm
*/
- result = asn1_write_value( pbes2_asn, "keyDerivationFunc.algorithm", PBKDF2_OID, 1);
+ result =
+ asn1_write_value(pbes2_asn, "keyDerivationFunc.algorithm",
+ PBKDF2_OID, 1);
if (result != ASN1_SUCCESS) {
gnutls_assert();
return _gnutls_asn2err(result);
}
-
+
/* Now write the key derivation and the encryption
* functions.
*/
if ((result =
asn1_create_element(_gnutls_get_pkix(),
- "PKIX1.pkcs-5-PBKDF2-params", &pbkdf2_asn
- )) != ASN1_SUCCESS) {
+ "PKIX1.pkcs-5-PBKDF2-params",
+ &pbkdf2_asn)) != ASN1_SUCCESS) {
gnutls_assert();
return _gnutls_asn2err(result);
}
- result = asn1_write_value( pbkdf2_asn, "salt", "specified", 1);
+ result = asn1_write_value(pbkdf2_asn, "salt", "specified", 1);
if (result != ASN1_SUCCESS) {
gnutls_assert();
result = _gnutls_asn2err(result);
goto error;
}
-
+
/* write the salt
*/
- result = asn1_write_value( pbkdf2_asn, "salt.specified", kdf_params->salt, kdf_params->salt_size);
+ result =
+ asn1_write_value(pbkdf2_asn, "salt.specified",
+ kdf_params->salt, kdf_params->salt_size);
if (result != ASN1_SUCCESS) {
gnutls_assert();
result = _gnutls_asn2err(result);
goto error;
}
- _gnutls_hard_log( "salt.specified.size: %d\n", kdf_params->salt_size);
+ _gnutls_hard_log("salt.specified.size: %d\n",
+ kdf_params->salt_size);
/* write the iteration count
*/
- _gnutls_write_uint32( kdf_params->iter_count, tmp);
+ _gnutls_write_uint32(kdf_params->iter_count, tmp);
- result = asn1_write_value( pbkdf2_asn, "iterationCount", tmp, 4);
+ result = asn1_write_value(pbkdf2_asn, "iterationCount", tmp, 4);
if (result != ASN1_SUCCESS) {
gnutls_assert();
result = _gnutls_asn2err(result);
goto error;
}
- _gnutls_hard_log( "iterationCount: %d\n", kdf_params->iter_count);
+ _gnutls_hard_log("iterationCount: %d\n", kdf_params->iter_count);
/* write the keylength, if it is set.
*/
- result = asn1_write_value( pbkdf2_asn, "keyLength", NULL, 0);
+ result = asn1_write_value(pbkdf2_asn, "keyLength", NULL, 0);
if (result != ASN1_SUCCESS) {
gnutls_assert();
result = _gnutls_asn2err(result);
goto error;
}
-
+
/* We write an emptry prf.
*/
- result = asn1_write_value( pbkdf2_asn, "prf", NULL, 0);
+ result = asn1_write_value(pbkdf2_asn, "prf", NULL, 0);
if (result != ASN1_SUCCESS) {
gnutls_assert();
result = _gnutls_asn2err(result);
/* now encode them an put the DER output
* in the keyDerivationFunc.parameters
*/
- result = _gnutls_x509_der_encode_and_copy( pbkdf2_asn, "",
- pbes2_asn, "keyDerivationFunc.parameters");
+ result = _gnutls_x509_der_encode_and_copy(pbkdf2_asn, "",
+ pbes2_asn,
+ "keyDerivationFunc.parameters");
if (result < 0) {
gnutls_assert();
goto error;
return 0;
- error:
- asn1_delete_structure( &pbkdf2_asn);
- return result;
+ error:
+ asn1_delete_structure(&pbkdf2_asn);
+ return result;
}
-static int write_pbe_enc_params( ASN1_TYPE pbes2_asn, const struct pbe_enc_params* params)
+static int write_pbe_enc_params(ASN1_TYPE pbes2_asn,
+ const struct pbe_enc_params *params)
{
-int result;
-ASN1_TYPE pbe_asn = ASN1_TYPE_EMPTY;
+ int result;
+ ASN1_TYPE pbe_asn = ASN1_TYPE_EMPTY;
/* Write the encryption algorithm
*/
- result = asn1_write_value( pbes2_asn, "encryptionScheme.algorithm", DES_EDE3_CBC_OID, 1);
+ result =
+ asn1_write_value(pbes2_asn, "encryptionScheme.algorithm",
+ DES_EDE3_CBC_OID, 1);
if (result != ASN1_SUCCESS) {
gnutls_assert();
goto error;
}
- _gnutls_hard_log( "encryptionScheme.algorithm: %s\n", DES_EDE3_CBC_OID);
-
+ _gnutls_hard_log("encryptionScheme.algorithm: %s\n",
+ DES_EDE3_CBC_OID);
+
/* Now check the encryption parameters.
*/
if ((result =
asn1_create_element(_gnutls_get_pkix(),
- "PKIX1.pkcs-5-des-EDE3-CBC-params", &pbe_asn
- )) != ASN1_SUCCESS) {
+ "PKIX1.pkcs-5-des-EDE3-CBC-params",
+ &pbe_asn)) != ASN1_SUCCESS) {
gnutls_assert();
return _gnutls_asn2err(result);
}
-
+
/* read the salt */
- result = asn1_write_value( pbe_asn, "", params->iv, params->iv_size);
+ result =
+ asn1_write_value(pbe_asn, "", params->iv, params->iv_size);
if (result != ASN1_SUCCESS) {
gnutls_assert();
result = _gnutls_asn2err(result);
goto error;
}
- _gnutls_hard_log( "IV.size: %d\n", params->iv_size);
+ _gnutls_hard_log("IV.size: %d\n", params->iv_size);
/* now encode them an put the DER output
* in the encryptionScheme.parameters
*/
- result = _gnutls_x509_der_encode_and_copy( pbe_asn, "",
- pbes2_asn, "encryptionScheme.parameters");
+ result = _gnutls_x509_der_encode_and_copy(pbe_asn, "",
+ pbes2_asn,
+ "encryptionScheme.parameters");
if (result < 0) {
gnutls_assert();
goto error;
return 0;
- error:
- asn1_delete_structure( &pbe_asn);
- return result;
+ error:
+ asn1_delete_structure(&pbe_asn);
+ return result;
}
/* Generates a key and also stores the key parameters.
*/
-static int generate_key( const char* password, unsigned int flags,
- struct pbkdf2_params* kdf_params,
- struct pbe_enc_params* enc_params, gnutls_datum * key)
+static int generate_key(const char *password, unsigned int flags,
+ struct pbkdf2_params *kdf_params,
+ struct pbe_enc_params *enc_params,
+ gnutls_datum * key)
{
-opaque rnd[2];
-int ret;
+ opaque rnd[2];
+ int ret;
/* We should use the flags here to use different
* encryption algorithms etc.
*/
- _gnutls_get_random( rnd, 2, GNUTLS_STRONG_RANDOM);
+ enc_params->cipher = GNUTLS_CIPHER_3DES_CBC; /* The default */
+
+ _gnutls_get_random(rnd, 2, GNUTLS_STRONG_RANDOM);
/* generate salt */
- kdf_params->salt_size = GMIN( sizeof( kdf_params->salt), (uint)(10 + (rnd[1] % 10)));
- _gnutls_get_random( kdf_params->salt, kdf_params->salt_size, GNUTLS_STRONG_RANDOM);
-
+ kdf_params->salt_size =
+ GMIN(sizeof(kdf_params->salt), (uint) (10 + (rnd[1] % 10)));
+ _gnutls_get_random(kdf_params->salt, kdf_params->salt_size,
+ GNUTLS_STRONG_RANDOM);
+
kdf_params->iter_count = 256 + rnd[0];
- key->size = kdf_params->key_size = gnutls_cipher_get_key_size( GNUTLS_CIPHER_3DES_CBC); /* for 3 DES */
+ key->size = kdf_params->key_size =
+ gnutls_cipher_get_key_size(enc_params->cipher);
- enc_params->iv_size = 8; /* ok for 3DES */
- _gnutls_get_random( enc_params->iv, enc_params->iv_size, GNUTLS_WEAK_RANDOM);
+ enc_params->iv_size =
+ _gnutls_cipher_get_iv_size(enc_params->cipher);
+ _gnutls_get_random(enc_params->iv, enc_params->iv_size,
+ GNUTLS_WEAK_RANDOM);
- key->data = gnutls_secure_malloc( key->size);
+ key->data = gnutls_secure_malloc(key->size);
if (key->data == NULL) {
gnutls_assert();
return GNUTLS_E_MEMORY_ERROR;
/* now generate the key.
*/
- ret = _gnutls_pkcs5_pbkdf2 ( PKCS5_PRF_SHA1, password,
- strlen(password), kdf_params->salt, kdf_params->salt_size,
- kdf_params->iter_count, kdf_params->key_size, key->data);
+ ret = _gnutls_pkcs5_pbkdf2(PKCS5_PRF_SHA1, password,
+ strlen(password), kdf_params->salt,
+ kdf_params->salt_size,
+ kdf_params->iter_count,
+ kdf_params->key_size, key->data);
if (ret != PKCS5_OK) {
gnutls_assert();
return GNUTLS_E_ENCRYPTION_FAILED;
}
-
+
return 0;
}
/* Encodes the parameters to be written in the encryptionAlgorithm.parameters
* part.
*/
-static int write_pbe2_params( ASN1_TYPE pkcs8_asn, const struct pbkdf2_params* kdf_params,
- const struct pbe_enc_params* enc_params)
+static int write_pbe2_params(ASN1_TYPE pkcs8_asn,
+ const struct pbkdf2_params *kdf_params,
+ const struct pbe_enc_params *enc_params)
{
-int result;
-ASN1_TYPE pbes2_asn = ASN1_TYPE_EMPTY;
+ int result;
+ ASN1_TYPE pbes2_asn = ASN1_TYPE_EMPTY;
if ((result =
asn1_create_element(_gnutls_get_pkix(),
- "PKIX1.pkcs-5-PBES2-params", &pbes2_asn
- )) != ASN1_SUCCESS) {
+ "PKIX1.pkcs-5-PBES2-params",
+ &pbes2_asn)) != ASN1_SUCCESS) {
gnutls_assert();
return _gnutls_asn2err(result);
}
- result = write_pbkdf2_params( pbes2_asn, kdf_params);
+ result = write_pbkdf2_params(pbes2_asn, kdf_params);
if (result < 0) {
gnutls_assert();
goto error;
}
- result = write_pbe_enc_params( pbes2_asn, enc_params);
+ result = write_pbe_enc_params(pbes2_asn, enc_params);
if (result < 0) {
gnutls_assert();
goto error;
}
- result = _gnutls_x509_der_encode_and_copy( pbes2_asn, "",
- pkcs8_asn, "encryptionAlgorithm.parameters");
+ result = _gnutls_x509_der_encode_and_copy(pbes2_asn, "",
+ pkcs8_asn,
+ "encryptionAlgorithm.parameters");
if (result < 0) {
gnutls_assert();
goto error;
}
- asn1_delete_structure( &pbes2_asn);
-
+ asn1_delete_structure(&pbes2_asn);
+
return 0;
- error:
- asn1_delete_structure( &pbes2_asn);
- return result;
+ error:
+ asn1_delete_structure(&pbes2_asn);
+ return result;
}
-static int encrypt_data( const gnutls_datum* plain,
- const struct pbe_enc_params *enc_params,
- gnutls_datum* key, gnutls_datum* encrypted)
+static int encrypt_data(const gnutls_datum * plain,
+ const struct pbe_enc_params *enc_params,
+ gnutls_datum * key, gnutls_datum * encrypted)
{
-int result;
-int data_size;
-opaque* data=NULL;
-gnutls_datum div;
-GNUTLS_CIPHER_HANDLE ch = NULL;
-opaque pad;
-
- data = gnutls_malloc( plain->size + 8);
+ int result;
+ int data_size;
+ opaque *data = NULL;
+ gnutls_datum div;
+ GNUTLS_CIPHER_HANDLE ch = NULL;
+ opaque pad;
+
+ data = gnutls_malloc(plain->size + 8);
if (data == NULL) {
gnutls_assert();
return GNUTLS_E_MEMORY_ERROR;
}
- memcpy( data, plain->data, plain->size);
- pad = 8 - (plain->size % 8);
- if ( pad == 0) pad = 8;
-
- memset( &data[plain->size], pad, pad);
+ memcpy(data, plain->data, plain->size);
+ pad = 8 - (plain->size % 8);
+ if (pad == 0)
+ pad = 8;
+
+ memset(&data[plain->size], pad, pad);
data_size = plain->size + pad;
- div.data = (opaque*) enc_params->iv;
+ div.data = (opaque *) enc_params->iv;
div.size = enc_params->iv_size;
- ch = _gnutls_cipher_init( GNUTLS_CIPHER_3DES_CBC, key, &div);
+ ch = _gnutls_cipher_init(enc_params->cipher, key, &div);
if (ch == GNUTLS_CIPHER_FAILED) {
gnutls_assert();
goto error;
}
- result = _gnutls_cipher_encrypt( ch, data, data_size);
+ result = _gnutls_cipher_encrypt(ch, data, data_size);
if (result < 0) {
gnutls_assert();
goto error;
encrypted->data = data;
encrypted->size = data_size;
- _gnutls_cipher_deinit( ch);
+ _gnutls_cipher_deinit(ch);
return 0;
- error:
- gnutls_free(data);
- if (ch!=NULL)
- _gnutls_cipher_deinit( ch);
- return result;
+ error:
+ gnutls_free(data);
+ if (ch != NULL)
+ _gnutls_cipher_deinit(ch);
+ return result;
}
+/* Decrypts a PKCS #7 encryptedData. The output is allocated
+ * and stored in dec.
+ */
+int _gnutls_x509_decrypt_pkcs7_encrypted_data(const gnutls_datum * data,
+ const char *password,
+ gnutls_datum * dec)
+{
+ int result, len;
+ opaque enc_oid[64];
+ gnutls_datum tmp;
+ ASN1_TYPE pbes2_asn = ASN1_TYPE_EMPTY, pkcs7_asn = ASN1_TYPE_EMPTY;
+ int params_start, params_end, params_len;
+ struct pbkdf2_params kdf_params;
+ struct pbe_enc_params enc_params;
+ schema_id schema;
+
+ if ((result =
+ asn1_create_element(_gnutls_get_pkix(),
+ "PKIX1.pkcs-7-EncryptedData",
+ &pkcs7_asn)) != ASN1_SUCCESS) {
+ gnutls_assert();
+ result = _gnutls_asn2err(result);
+ goto error;
+ }
+
+ result =
+ asn1_der_decoding(&pkcs7_asn, data->data, data->size, NULL);
+ if (result != ASN1_SUCCESS) {
+ gnutls_assert();
+ result = _gnutls_asn2err(result);
+ goto error;
+ }
+
+ /* Check the encryption schema OID
+ */
+ len = sizeof(enc_oid);
+ result =
+ asn1_read_value(pkcs7_asn,
+ "encryptedContentInfo.contentEncryptionAlgorithm.algorithm",
+ enc_oid, &len);
+ if (result != ASN1_SUCCESS) {
+ gnutls_assert();
+ result = _gnutls_asn2err(result);
+ goto error;
+ }
+
+ /* we only support PBES2
+ */
+ if ((result = check_schema(enc_oid)) < 0) {
+ gnutls_assert();
+ goto error;
+ }
+ schema = result;
+
+ /* Get the DER encoding of the parameters.
+ */
+ result =
+ asn1_der_decoding_startEnd(pkcs7_asn, data->data, data->size,
+ "encryptedContentInfo.contentEncryptionAlgorithm.parameters",
+ ¶ms_start, ¶ms_end);
+ if (result != ASN1_SUCCESS) {
+ gnutls_assert();
+ result = _gnutls_asn2err(result);
+ goto error;
+ }
+ params_len = params_end - params_start + 1;
+
+ result =
+ read_pkcs_schema_params(schema, password,
+ &data->data[params_start],
+ params_len, &kdf_params, &enc_params);
+ if (result < ASN1_SUCCESS) {
+ gnutls_assert();
+ result = _gnutls_asn2err(result);
+ goto error;
+ }
+
+ /* Parameters have been decoded. Now
+ * decrypt the EncryptedData.
+ */
+
+ result =
+ decrypt_data(schema, pkcs7_asn,
+ "encryptedContentInfo.encryptedContent", password,
+ &kdf_params, &enc_params, &tmp);
+ if (result < 0) {
+ gnutls_assert();
+ goto error;
+ }
+
+ asn1_delete_structure(&pkcs7_asn);
+
+ *dec = tmp;
+
+ return 0;
+
+ error:
+ asn1_delete_structure(&pbes2_asn);
+ asn1_delete_structure(&pkcs7_asn);
+ return result;
+}
+
+
#endif
projects / thirdparty / gnutls.git / commitdiff
