1 /*
2  * Copyright 2006-2021 The OpenSSL Project Authors. All Rights Reserved.
3  *
4  * Licensed under the Apache License 2.0 (the "License").  You may not use
5  * this file except in compliance with the License.  You can obtain a copy
6  * in the file LICENSE in the source distribution or at
7  * https://www.openssl.org/source/license.html
8  */
9 
10 #include <assert.h>
11 #include <openssl/cms.h>
12 #include <openssl/err.h>
13 #include <openssl/decoder.h>
14 #include "internal/sizes.h"
15 #include "crypto/evp.h"
16 #include "cms_local.h"
17 
pkey_type2param(int ptype,const void * pval,OSSL_LIB_CTX * libctx,const char * propq)18 static EVP_PKEY *pkey_type2param(int ptype, const void *pval,
19                                  OSSL_LIB_CTX *libctx, const char *propq)
20 {
21     EVP_PKEY *pkey = NULL;
22     EVP_PKEY_CTX *pctx = NULL;
23     OSSL_DECODER_CTX *ctx = NULL;
24 
25     if (ptype == V_ASN1_SEQUENCE) {
26         const ASN1_STRING *pstr = pval;
27         const unsigned char *pm = pstr->data;
28         size_t pmlen = (size_t)pstr->length;
29         int selection = OSSL_KEYMGMT_SELECT_ALL_PARAMETERS;
30 
31         ctx = OSSL_DECODER_CTX_new_for_pkey(&pkey, "DER", NULL, "EC",
32                                             selection, libctx, propq);
33         if (ctx == NULL)
34             goto err;
35 
36         if (!OSSL_DECODER_from_data(ctx, &pm, &pmlen)) {
37             ERR_raise(ERR_LIB_CMS, CMS_R_DECODE_ERROR);
38             goto err;
39         }
40         OSSL_DECODER_CTX_free(ctx);
41         return pkey;
42     } else if (ptype == V_ASN1_OBJECT) {
43         const ASN1_OBJECT *poid = pval;
44         char groupname[OSSL_MAX_NAME_SIZE];
45 
46         /* type == V_ASN1_OBJECT => the parameters are given by an asn1 OID */
47         pctx = EVP_PKEY_CTX_new_from_name(libctx, "EC", propq);
48         if (pctx == NULL || EVP_PKEY_paramgen_init(pctx) <= 0)
49             goto err;
50         if (!OBJ_obj2txt(groupname, sizeof(groupname), poid, 0)
51                 || !EVP_PKEY_CTX_set_group_name(pctx, groupname)) {
52             ERR_raise(ERR_LIB_CMS, CMS_R_DECODE_ERROR);
53             goto err;
54         }
55         if (EVP_PKEY_paramgen(pctx, &pkey) <= 0)
56             goto err;
57         EVP_PKEY_CTX_free(pctx);
58         return pkey;
59     }
60 
61     ERR_raise(ERR_LIB_CMS, CMS_R_DECODE_ERROR);
62     return NULL;
63 
64  err:
65     EVP_PKEY_free(pkey);
66     EVP_PKEY_CTX_free(pctx);
67     OSSL_DECODER_CTX_free(ctx);
68     return NULL;
69 }
70 
ecdh_cms_set_peerkey(EVP_PKEY_CTX * pctx,X509_ALGOR * alg,ASN1_BIT_STRING * pubkey)71 static int ecdh_cms_set_peerkey(EVP_PKEY_CTX *pctx,
72                                 X509_ALGOR *alg, ASN1_BIT_STRING *pubkey)
73 {
74     const ASN1_OBJECT *aoid;
75     int atype;
76     const void *aval;
77     int rv = 0;
78     EVP_PKEY *pkpeer = NULL;
79     const unsigned char *p;
80     int plen;
81 
82     X509_ALGOR_get0(&aoid, &atype, &aval, alg);
83     if (OBJ_obj2nid(aoid) != NID_X9_62_id_ecPublicKey)
84         goto err;
85 
86     /* If absent parameters get group from main key */
87     if (atype == V_ASN1_UNDEF || atype == V_ASN1_NULL) {
88         EVP_PKEY *pk;
89 
90         pk = EVP_PKEY_CTX_get0_pkey(pctx);
91         if (pk == NULL)
92             goto err;
93 
94         pkpeer = EVP_PKEY_new();
95         if (pkpeer == NULL)
96             goto err;
97         if (!EVP_PKEY_copy_parameters(pkpeer, pk))
98             goto err;
99     } else {
100         pkpeer = pkey_type2param(atype, aval,
101                                  EVP_PKEY_CTX_get0_libctx(pctx),
102                                  EVP_PKEY_CTX_get0_propq(pctx));
103         if (pkpeer == NULL)
104             goto err;
105     }
106     /* We have parameters now set public key */
107     plen = ASN1_STRING_length(pubkey);
108     p = ASN1_STRING_get0_data(pubkey);
109     if (p == NULL || plen == 0)
110         goto err;
111 
112     if (!EVP_PKEY_set1_encoded_public_key(pkpeer, p, plen))
113         goto err;
114 
115     if (EVP_PKEY_derive_set_peer(pctx, pkpeer) > 0)
116         rv = 1;
117  err:
118     EVP_PKEY_free(pkpeer);
119     return rv;
120 }
121 
122 /* Set KDF parameters based on KDF NID */
ecdh_cms_set_kdf_param(EVP_PKEY_CTX * pctx,int eckdf_nid)123 static int ecdh_cms_set_kdf_param(EVP_PKEY_CTX *pctx, int eckdf_nid)
124 {
125     int kdf_nid, kdfmd_nid, cofactor;
126     const EVP_MD *kdf_md;
127 
128     if (eckdf_nid == NID_undef)
129         return 0;
130 
131     /* Lookup KDF type, cofactor mode and digest */
132     if (!OBJ_find_sigid_algs(eckdf_nid, &kdfmd_nid, &kdf_nid))
133         return 0;
134 
135     if (kdf_nid == NID_dh_std_kdf)
136         cofactor = 0;
137     else if (kdf_nid == NID_dh_cofactor_kdf)
138         cofactor = 1;
139     else
140         return 0;
141 
142     if (EVP_PKEY_CTX_set_ecdh_cofactor_mode(pctx, cofactor) <= 0)
143         return 0;
144 
145     if (EVP_PKEY_CTX_set_ecdh_kdf_type(pctx, EVP_PKEY_ECDH_KDF_X9_63) <= 0)
146         return 0;
147 
148     kdf_md = EVP_get_digestbynid(kdfmd_nid);
149     if (!kdf_md)
150         return 0;
151 
152     if (EVP_PKEY_CTX_set_ecdh_kdf_md(pctx, kdf_md) <= 0)
153         return 0;
154     return 1;
155 }
156 
ecdh_cms_set_shared_info(EVP_PKEY_CTX * pctx,CMS_RecipientInfo * ri)157 static int ecdh_cms_set_shared_info(EVP_PKEY_CTX *pctx, CMS_RecipientInfo *ri)
158 {
159     int rv = 0;
160     X509_ALGOR *alg, *kekalg = NULL;
161     ASN1_OCTET_STRING *ukm;
162     const unsigned char *p;
163     unsigned char *der = NULL;
164     int plen, keylen;
165     EVP_CIPHER *kekcipher = NULL;
166     EVP_CIPHER_CTX *kekctx;
167     char name[OSSL_MAX_NAME_SIZE];
168 
169     if (!CMS_RecipientInfo_kari_get0_alg(ri, &alg, &ukm))
170         return 0;
171 
172     if (!ecdh_cms_set_kdf_param(pctx, OBJ_obj2nid(alg->algorithm))) {
173         ERR_raise(ERR_LIB_CMS, CMS_R_KDF_PARAMETER_ERROR);
174         return 0;
175     }
176 
177     if (alg->parameter->type != V_ASN1_SEQUENCE)
178         return 0;
179 
180     p = alg->parameter->value.sequence->data;
181     plen = alg->parameter->value.sequence->length;
182     kekalg = d2i_X509_ALGOR(NULL, &p, plen);
183     if (kekalg == NULL)
184         goto err;
185     kekctx = CMS_RecipientInfo_kari_get0_ctx(ri);
186     if (kekctx == NULL)
187         goto err;
188     OBJ_obj2txt(name, sizeof(name), kekalg->algorithm, 0);
189     kekcipher = EVP_CIPHER_fetch(pctx->libctx, name, pctx->propquery);
190     if (kekcipher == NULL || EVP_CIPHER_get_mode(kekcipher) != EVP_CIPH_WRAP_MODE)
191         goto err;
192     if (!EVP_EncryptInit_ex(kekctx, kekcipher, NULL, NULL, NULL))
193         goto err;
194     if (EVP_CIPHER_asn1_to_param(kekctx, kekalg->parameter) <= 0)
195         goto err;
196 
197     keylen = EVP_CIPHER_CTX_get_key_length(kekctx);
198     if (EVP_PKEY_CTX_set_ecdh_kdf_outlen(pctx, keylen) <= 0)
199         goto err;
200 
201     plen = CMS_SharedInfo_encode(&der, kekalg, ukm, keylen);
202 
203     if (plen <= 0)
204         goto err;
205 
206     if (EVP_PKEY_CTX_set0_ecdh_kdf_ukm(pctx, der, plen) <= 0)
207         goto err;
208     der = NULL;
209 
210     rv = 1;
211  err:
212     EVP_CIPHER_free(kekcipher);
213     X509_ALGOR_free(kekalg);
214     OPENSSL_free(der);
215     return rv;
216 }
217 
ecdh_cms_decrypt(CMS_RecipientInfo * ri)218 static int ecdh_cms_decrypt(CMS_RecipientInfo *ri)
219 {
220     EVP_PKEY_CTX *pctx;
221 
222     pctx = CMS_RecipientInfo_get0_pkey_ctx(ri);
223     if (pctx == NULL)
224         return 0;
225     /* See if we need to set peer key */
226     if (!EVP_PKEY_CTX_get0_peerkey(pctx)) {
227         X509_ALGOR *alg;
228         ASN1_BIT_STRING *pubkey;
229 
230         if (!CMS_RecipientInfo_kari_get0_orig_id(ri, &alg, &pubkey,
231                                                  NULL, NULL, NULL))
232             return 0;
233         if (alg == NULL || pubkey == NULL)
234             return 0;
235         if (!ecdh_cms_set_peerkey(pctx, alg, pubkey)) {
236             ERR_raise(ERR_LIB_CMS, CMS_R_PEER_KEY_ERROR);
237             return 0;
238         }
239     }
240     /* Set ECDH derivation parameters and initialise unwrap context */
241     if (!ecdh_cms_set_shared_info(pctx, ri)) {
242         ERR_raise(ERR_LIB_CMS, CMS_R_SHARED_INFO_ERROR);
243         return 0;
244     }
245     return 1;
246 }
247 
ecdh_cms_encrypt(CMS_RecipientInfo * ri)248 static int ecdh_cms_encrypt(CMS_RecipientInfo *ri)
249 {
250     EVP_PKEY_CTX *pctx;
251     EVP_PKEY *pkey;
252     EVP_CIPHER_CTX *ctx;
253     int keylen;
254     X509_ALGOR *talg, *wrap_alg = NULL;
255     const ASN1_OBJECT *aoid;
256     ASN1_BIT_STRING *pubkey;
257     ASN1_STRING *wrap_str;
258     ASN1_OCTET_STRING *ukm;
259     unsigned char *penc = NULL;
260     size_t penclen;
261     int rv = 0;
262     int ecdh_nid, kdf_type, kdf_nid, wrap_nid;
263     const EVP_MD *kdf_md;
264 
265     pctx = CMS_RecipientInfo_get0_pkey_ctx(ri);
266     if (pctx == NULL)
267         return 0;
268     /* Get ephemeral key */
269     pkey = EVP_PKEY_CTX_get0_pkey(pctx);
270     if (!CMS_RecipientInfo_kari_get0_orig_id(ri, &talg, &pubkey,
271                                              NULL, NULL, NULL))
272         goto err;
273     X509_ALGOR_get0(&aoid, NULL, NULL, talg);
274     /* Is everything uninitialised? */
275     if (aoid == OBJ_nid2obj(NID_undef)) {
276         /* Set the key */
277 
278         penclen = EVP_PKEY_get1_encoded_public_key(pkey, &penc);
279         ASN1_STRING_set0(pubkey, penc, penclen);
280         pubkey->flags &= ~(ASN1_STRING_FLAG_BITS_LEFT | 0x07);
281         pubkey->flags |= ASN1_STRING_FLAG_BITS_LEFT;
282 
283         penc = NULL;
284         X509_ALGOR_set0(talg, OBJ_nid2obj(NID_X9_62_id_ecPublicKey),
285                         V_ASN1_UNDEF, NULL);
286     }
287 
288     /* See if custom parameters set */
289     kdf_type = EVP_PKEY_CTX_get_ecdh_kdf_type(pctx);
290     if (kdf_type <= 0)
291         goto err;
292     if (!EVP_PKEY_CTX_get_ecdh_kdf_md(pctx, &kdf_md))
293         goto err;
294     ecdh_nid = EVP_PKEY_CTX_get_ecdh_cofactor_mode(pctx);
295     if (ecdh_nid < 0)
296         goto err;
297     else if (ecdh_nid == 0)
298         ecdh_nid = NID_dh_std_kdf;
299     else if (ecdh_nid == 1)
300         ecdh_nid = NID_dh_cofactor_kdf;
301 
302     if (kdf_type == EVP_PKEY_ECDH_KDF_NONE) {
303         kdf_type = EVP_PKEY_ECDH_KDF_X9_63;
304         if (EVP_PKEY_CTX_set_ecdh_kdf_type(pctx, kdf_type) <= 0)
305             goto err;
306     } else
307         /* Unknown KDF */
308         goto err;
309     if (kdf_md == NULL) {
310         /* Fixme later for better MD */
311         kdf_md = EVP_sha1();
312         if (EVP_PKEY_CTX_set_ecdh_kdf_md(pctx, kdf_md) <= 0)
313             goto err;
314     }
315 
316     if (!CMS_RecipientInfo_kari_get0_alg(ri, &talg, &ukm))
317         goto err;
318 
319     /* Lookup NID for KDF+cofactor+digest */
320 
321     if (!OBJ_find_sigid_by_algs(&kdf_nid, EVP_MD_get_type(kdf_md), ecdh_nid))
322         goto err;
323     /* Get wrap NID */
324     ctx = CMS_RecipientInfo_kari_get0_ctx(ri);
325     wrap_nid = EVP_CIPHER_CTX_get_type(ctx);
326     keylen = EVP_CIPHER_CTX_get_key_length(ctx);
327 
328     /* Package wrap algorithm in an AlgorithmIdentifier */
329 
330     wrap_alg = X509_ALGOR_new();
331     if (wrap_alg == NULL)
332         goto err;
333     wrap_alg->algorithm = OBJ_nid2obj(wrap_nid);
334     wrap_alg->parameter = ASN1_TYPE_new();
335     if (wrap_alg->parameter == NULL)
336         goto err;
337     if (EVP_CIPHER_param_to_asn1(ctx, wrap_alg->parameter) <= 0)
338         goto err;
339     if (ASN1_TYPE_get(wrap_alg->parameter) == NID_undef) {
340         ASN1_TYPE_free(wrap_alg->parameter);
341         wrap_alg->parameter = NULL;
342     }
343 
344     if (EVP_PKEY_CTX_set_ecdh_kdf_outlen(pctx, keylen) <= 0)
345         goto err;
346 
347     penclen = CMS_SharedInfo_encode(&penc, wrap_alg, ukm, keylen);
348 
349     if (penclen == 0)
350         goto err;
351 
352     if (EVP_PKEY_CTX_set0_ecdh_kdf_ukm(pctx, penc, penclen) <= 0)
353         goto err;
354     penc = NULL;
355 
356     /*
357      * Now need to wrap encoding of wrap AlgorithmIdentifier into parameter
358      * of another AlgorithmIdentifier.
359      */
360     penclen = i2d_X509_ALGOR(wrap_alg, &penc);
361     if (penc == NULL || penclen == 0)
362         goto err;
363     wrap_str = ASN1_STRING_new();
364     if (wrap_str == NULL)
365         goto err;
366     ASN1_STRING_set0(wrap_str, penc, penclen);
367     penc = NULL;
368     X509_ALGOR_set0(talg, OBJ_nid2obj(kdf_nid), V_ASN1_SEQUENCE, wrap_str);
369 
370     rv = 1;
371 
372  err:
373     OPENSSL_free(penc);
374     X509_ALGOR_free(wrap_alg);
375     return rv;
376 }
377 
ossl_cms_ecdh_envelope(CMS_RecipientInfo * ri,int decrypt)378 int ossl_cms_ecdh_envelope(CMS_RecipientInfo *ri, int decrypt)
379 {
380     assert(decrypt == 0 || decrypt == 1);
381 
382     if (decrypt == 1)
383         return ecdh_cms_decrypt(ri);
384 
385     if (decrypt == 0)
386         return ecdh_cms_encrypt(ri);
387 
388     ERR_raise(ERR_LIB_CMS, CMS_R_NOT_SUPPORTED_FOR_THIS_KEY_TYPE);
389     return 0;
390 }
391 
392 /* ECDSA and DSA implementation is the same */
ossl_cms_ecdsa_dsa_sign(CMS_SignerInfo * si,int verify)393 int ossl_cms_ecdsa_dsa_sign(CMS_SignerInfo *si, int verify)
394 {
395     assert(verify == 0 || verify == 1);
396 
397     if (verify == 0) {
398         int snid, hnid;
399         X509_ALGOR *alg1, *alg2;
400         EVP_PKEY *pkey = si->pkey;
401 
402         CMS_SignerInfo_get0_algs(si, NULL, NULL, &alg1, &alg2);
403         if (alg1 == NULL || alg1->algorithm == NULL)
404             return -1;
405         hnid = OBJ_obj2nid(alg1->algorithm);
406         if (hnid == NID_undef)
407             return -1;
408         if (!OBJ_find_sigid_by_algs(&snid, hnid, EVP_PKEY_get_id(pkey)))
409             return -1;
410         X509_ALGOR_set0(alg2, OBJ_nid2obj(snid), V_ASN1_UNDEF, 0);
411     }
412     return 1;
413 }
414