1 /* 2 * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL project 3 * 2006. 4 */ 5 /* ==================================================================== 6 * Copyright (c) 2006 The OpenSSL Project. All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in 17 * the documentation and/or other materials provided with the 18 * distribution. 19 * 20 * 3. All advertising materials mentioning features or use of this 21 * software must display the following acknowledgment: 22 * "This product includes software developed by the OpenSSL Project 23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" 24 * 25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 26 * endorse or promote products derived from this software without 27 * prior written permission. For written permission, please contact 28 * licensing@OpenSSL.org. 29 * 30 * 5. Products derived from this software may not be called "OpenSSL" 31 * nor may "OpenSSL" appear in their names without prior written 32 * permission of the OpenSSL Project. 33 * 34 * 6. Redistributions of any form whatsoever must retain the following 35 * acknowledgment: 36 * "This product includes software developed by the OpenSSL Project 37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" 38 * 39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 50 * OF THE POSSIBILITY OF SUCH DAMAGE. 51 * ==================================================================== 52 * 53 * This product includes cryptographic software written by Eric Young 54 * (eay@cryptsoft.com). This product includes software written by Tim 55 * Hudson (tjh@cryptsoft.com). 56 * 57 */ 58 59 #include <stdio.h> 60 #include "cryptlib.h" 61 #include <openssl/x509.h> 62 #include <openssl/ec.h> 63 #include <openssl/bn.h> 64 #ifndef OPENSSL_NO_CMS 65 # include <openssl/cms.h> 66 #endif 67 #include <openssl/asn1t.h> 68 #include "asn1_locl.h" 69 #include "ec_lcl.h" 70 71 #ifndef OPENSSL_NO_CMS 72 static int ecdh_cms_decrypt(CMS_RecipientInfo *ri); 73 static int ecdh_cms_encrypt(CMS_RecipientInfo *ri); 74 #endif 75 76 static int eckey_param2type(int *pptype, void **ppval, EC_KEY *ec_key) 77 { 78 const EC_GROUP *group; 79 int nid; 80 if (ec_key == NULL || (group = EC_KEY_get0_group(ec_key)) == NULL) { 81 ECerr(EC_F_ECKEY_PARAM2TYPE, EC_R_MISSING_PARAMETERS); 82 return 0; 83 } 84 if (EC_GROUP_get_asn1_flag(group) 85 && (nid = EC_GROUP_get_curve_name(group))) 86 /* we have a 'named curve' => just set the OID */ 87 { 88 *ppval = OBJ_nid2obj(nid); 89 *pptype = V_ASN1_OBJECT; 90 } else { /* explicit parameters */ 91 92 ASN1_STRING *pstr = NULL; 93 pstr = ASN1_STRING_new(); 94 if (!pstr) 95 return 0; 96 pstr->length = i2d_ECParameters(ec_key, &pstr->data); 97 if (pstr->length <= 0) { 98 ASN1_STRING_free(pstr); 99 ECerr(EC_F_ECKEY_PARAM2TYPE, ERR_R_EC_LIB); 100 return 0; 101 } 102 *ppval = pstr; 103 *pptype = V_ASN1_SEQUENCE; 104 } 105 return 1; 106 } 107 108 static int eckey_pub_encode(X509_PUBKEY *pk, const EVP_PKEY *pkey) 109 { 110 EC_KEY *ec_key = pkey->pkey.ec; 111 void *pval = NULL; 112 int ptype; 113 unsigned char *penc = NULL, *p; 114 int penclen; 115 116 if (!eckey_param2type(&ptype, &pval, ec_key)) { 117 ECerr(EC_F_ECKEY_PUB_ENCODE, ERR_R_EC_LIB); 118 return 0; 119 } 120 penclen = i2o_ECPublicKey(ec_key, NULL); 121 if (penclen <= 0) 122 goto err; 123 penc = OPENSSL_malloc(penclen); 124 if (!penc) 125 goto err; 126 p = penc; 127 penclen = i2o_ECPublicKey(ec_key, &p); 128 if (penclen <= 0) 129 goto err; 130 if (X509_PUBKEY_set0_param(pk, OBJ_nid2obj(EVP_PKEY_EC), 131 ptype, pval, penc, penclen)) 132 return 1; 133 err: 134 if (ptype == V_ASN1_OBJECT) 135 ASN1_OBJECT_free(pval); 136 else 137 ASN1_STRING_free(pval); 138 if (penc) 139 OPENSSL_free(penc); 140 return 0; 141 } 142 143 static EC_KEY *eckey_type2param(int ptype, void *pval) 144 { 145 EC_KEY *eckey = NULL; 146 if (ptype == V_ASN1_SEQUENCE) { 147 ASN1_STRING *pstr = pval; 148 const unsigned char *pm = NULL; 149 int pmlen; 150 pm = pstr->data; 151 pmlen = pstr->length; 152 if (!(eckey = d2i_ECParameters(NULL, &pm, pmlen))) { 153 ECerr(EC_F_ECKEY_TYPE2PARAM, EC_R_DECODE_ERROR); 154 goto ecerr; 155 } 156 } else if (ptype == V_ASN1_OBJECT) { 157 ASN1_OBJECT *poid = pval; 158 EC_GROUP *group; 159 160 /* 161 * type == V_ASN1_OBJECT => the parameters are given by an asn1 OID 162 */ 163 if ((eckey = EC_KEY_new()) == NULL) { 164 ECerr(EC_F_ECKEY_TYPE2PARAM, ERR_R_MALLOC_FAILURE); 165 goto ecerr; 166 } 167 group = EC_GROUP_new_by_curve_name(OBJ_obj2nid(poid)); 168 if (group == NULL) 169 goto ecerr; 170 EC_GROUP_set_asn1_flag(group, OPENSSL_EC_NAMED_CURVE); 171 if (EC_KEY_set_group(eckey, group) == 0) 172 goto ecerr; 173 EC_GROUP_free(group); 174 } else { 175 ECerr(EC_F_ECKEY_TYPE2PARAM, EC_R_DECODE_ERROR); 176 goto ecerr; 177 } 178 179 return eckey; 180 181 ecerr: 182 if (eckey) 183 EC_KEY_free(eckey); 184 return NULL; 185 } 186 187 static int eckey_pub_decode(EVP_PKEY *pkey, X509_PUBKEY *pubkey) 188 { 189 const unsigned char *p = NULL; 190 void *pval; 191 int ptype, pklen; 192 EC_KEY *eckey = NULL; 193 X509_ALGOR *palg; 194 195 if (!X509_PUBKEY_get0_param(NULL, &p, &pklen, &palg, pubkey)) 196 return 0; 197 X509_ALGOR_get0(NULL, &ptype, &pval, palg); 198 199 eckey = eckey_type2param(ptype, pval); 200 201 if (!eckey) { 202 ECerr(EC_F_ECKEY_PUB_DECODE, ERR_R_EC_LIB); 203 return 0; 204 } 205 206 /* We have parameters now set public key */ 207 if (!o2i_ECPublicKey(&eckey, &p, pklen)) { 208 ECerr(EC_F_ECKEY_PUB_DECODE, EC_R_DECODE_ERROR); 209 goto ecerr; 210 } 211 212 EVP_PKEY_assign_EC_KEY(pkey, eckey); 213 return 1; 214 215 ecerr: 216 if (eckey) 217 EC_KEY_free(eckey); 218 return 0; 219 } 220 221 static int eckey_pub_cmp(const EVP_PKEY *a, const EVP_PKEY *b) 222 { 223 int r; 224 const EC_GROUP *group = EC_KEY_get0_group(b->pkey.ec); 225 const EC_POINT *pa = EC_KEY_get0_public_key(a->pkey.ec), 226 *pb = EC_KEY_get0_public_key(b->pkey.ec); 227 if (group == NULL || pa == NULL || pb == NULL) 228 return -2; 229 r = EC_POINT_cmp(group, pa, pb, NULL); 230 if (r == 0) 231 return 1; 232 if (r == 1) 233 return 0; 234 return -2; 235 } 236 237 static int eckey_priv_decode(EVP_PKEY *pkey, PKCS8_PRIV_KEY_INFO *p8) 238 { 239 const unsigned char *p = NULL; 240 void *pval; 241 int ptype, pklen; 242 EC_KEY *eckey = NULL; 243 X509_ALGOR *palg; 244 245 if (!PKCS8_pkey_get0(NULL, &p, &pklen, &palg, p8)) 246 return 0; 247 X509_ALGOR_get0(NULL, &ptype, &pval, palg); 248 249 eckey = eckey_type2param(ptype, pval); 250 251 if (!eckey) 252 goto ecliberr; 253 254 /* We have parameters now set private key */ 255 if (!d2i_ECPrivateKey(&eckey, &p, pklen)) { 256 ECerr(EC_F_ECKEY_PRIV_DECODE, EC_R_DECODE_ERROR); 257 goto ecerr; 258 } 259 260 /* calculate public key (if necessary) */ 261 if (EC_KEY_get0_public_key(eckey) == NULL) { 262 const BIGNUM *priv_key; 263 const EC_GROUP *group; 264 EC_POINT *pub_key; 265 /* 266 * the public key was not included in the SEC1 private key => 267 * calculate the public key 268 */ 269 group = EC_KEY_get0_group(eckey); 270 pub_key = EC_POINT_new(group); 271 if (pub_key == NULL) { 272 ECerr(EC_F_ECKEY_PRIV_DECODE, ERR_R_EC_LIB); 273 goto ecliberr; 274 } 275 if (!EC_POINT_copy(pub_key, EC_GROUP_get0_generator(group))) { 276 EC_POINT_free(pub_key); 277 ECerr(EC_F_ECKEY_PRIV_DECODE, ERR_R_EC_LIB); 278 goto ecliberr; 279 } 280 priv_key = EC_KEY_get0_private_key(eckey); 281 if (!EC_POINT_mul(group, pub_key, priv_key, NULL, NULL, NULL)) { 282 EC_POINT_free(pub_key); 283 ECerr(EC_F_ECKEY_PRIV_DECODE, ERR_R_EC_LIB); 284 goto ecliberr; 285 } 286 if (EC_KEY_set_public_key(eckey, pub_key) == 0) { 287 EC_POINT_free(pub_key); 288 ECerr(EC_F_ECKEY_PRIV_DECODE, ERR_R_EC_LIB); 289 goto ecliberr; 290 } 291 EC_POINT_free(pub_key); 292 } 293 294 EVP_PKEY_assign_EC_KEY(pkey, eckey); 295 return 1; 296 297 ecliberr: 298 ECerr(EC_F_ECKEY_PRIV_DECODE, ERR_R_EC_LIB); 299 ecerr: 300 if (eckey) 301 EC_KEY_free(eckey); 302 return 0; 303 } 304 305 static int eckey_priv_encode(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pkey) 306 { 307 EC_KEY ec_key = *(pkey->pkey.ec); 308 unsigned char *ep, *p; 309 int eplen, ptype; 310 void *pval; 311 unsigned int old_flags; 312 313 if (!eckey_param2type(&ptype, &pval, &ec_key)) { 314 ECerr(EC_F_ECKEY_PRIV_ENCODE, EC_R_DECODE_ERROR); 315 return 0; 316 } 317 318 /* set the private key */ 319 320 /* 321 * do not include the parameters in the SEC1 private key see PKCS#11 322 * 12.11 323 */ 324 old_flags = EC_KEY_get_enc_flags(&ec_key); 325 EC_KEY_set_enc_flags(&ec_key, old_flags | EC_PKEY_NO_PARAMETERS); 326 327 eplen = i2d_ECPrivateKey(&ec_key, NULL); 328 if (!eplen) { 329 ECerr(EC_F_ECKEY_PRIV_ENCODE, ERR_R_EC_LIB); 330 return 0; 331 } 332 ep = (unsigned char *)OPENSSL_malloc(eplen); 333 if (!ep) { 334 ECerr(EC_F_ECKEY_PRIV_ENCODE, ERR_R_MALLOC_FAILURE); 335 return 0; 336 } 337 p = ep; 338 if (!i2d_ECPrivateKey(&ec_key, &p)) { 339 OPENSSL_free(ep); 340 ECerr(EC_F_ECKEY_PRIV_ENCODE, ERR_R_EC_LIB); 341 return 0; 342 } 343 344 if (!PKCS8_pkey_set0(p8, OBJ_nid2obj(NID_X9_62_id_ecPublicKey), 0, 345 ptype, pval, ep, eplen)) 346 return 0; 347 348 return 1; 349 } 350 351 static int int_ec_size(const EVP_PKEY *pkey) 352 { 353 return ECDSA_size(pkey->pkey.ec); 354 } 355 356 static int ec_bits(const EVP_PKEY *pkey) 357 { 358 BIGNUM *order = BN_new(); 359 const EC_GROUP *group; 360 int ret; 361 362 if (!order) { 363 ERR_clear_error(); 364 return 0; 365 } 366 group = EC_KEY_get0_group(pkey->pkey.ec); 367 if (!EC_GROUP_get_order(group, order, NULL)) { 368 ERR_clear_error(); 369 return 0; 370 } 371 372 ret = BN_num_bits(order); 373 BN_free(order); 374 return ret; 375 } 376 377 static int ec_missing_parameters(const EVP_PKEY *pkey) 378 { 379 if (pkey->pkey.ec == NULL || EC_KEY_get0_group(pkey->pkey.ec) == NULL) 380 return 1; 381 return 0; 382 } 383 384 static int ec_copy_parameters(EVP_PKEY *to, const EVP_PKEY *from) 385 { 386 EC_GROUP *group = EC_GROUP_dup(EC_KEY_get0_group(from->pkey.ec)); 387 if (group == NULL) 388 return 0; 389 if (EC_KEY_set_group(to->pkey.ec, group) == 0) 390 return 0; 391 EC_GROUP_free(group); 392 return 1; 393 } 394 395 static int ec_cmp_parameters(const EVP_PKEY *a, const EVP_PKEY *b) 396 { 397 const EC_GROUP *group_a = EC_KEY_get0_group(a->pkey.ec), 398 *group_b = EC_KEY_get0_group(b->pkey.ec); 399 if (group_a == NULL || group_b == NULL) 400 return -2; 401 if (EC_GROUP_cmp(group_a, group_b, NULL)) 402 return 0; 403 else 404 return 1; 405 } 406 407 static void int_ec_free(EVP_PKEY *pkey) 408 { 409 EC_KEY_free(pkey->pkey.ec); 410 } 411 412 static int do_EC_KEY_print(BIO *bp, const EC_KEY *x, int off, int ktype) 413 { 414 unsigned char *buffer = NULL; 415 const char *ecstr; 416 size_t buf_len = 0, i; 417 int ret = 0, reason = ERR_R_BIO_LIB; 418 BIGNUM *pub_key = NULL, *order = NULL; 419 BN_CTX *ctx = NULL; 420 const EC_GROUP *group; 421 const EC_POINT *public_key; 422 const BIGNUM *priv_key; 423 424 if (x == NULL || (group = EC_KEY_get0_group(x)) == NULL) { 425 reason = ERR_R_PASSED_NULL_PARAMETER; 426 goto err; 427 } 428 429 ctx = BN_CTX_new(); 430 if (ctx == NULL) { 431 reason = ERR_R_MALLOC_FAILURE; 432 goto err; 433 } 434 435 if (ktype > 0) { 436 public_key = EC_KEY_get0_public_key(x); 437 if (public_key != NULL) { 438 if ((pub_key = EC_POINT_point2bn(group, public_key, 439 EC_KEY_get_conv_form(x), NULL, 440 ctx)) == NULL) { 441 reason = ERR_R_EC_LIB; 442 goto err; 443 } 444 buf_len = (size_t)BN_num_bytes(pub_key); 445 } 446 } 447 448 if (ktype == 2) { 449 priv_key = EC_KEY_get0_private_key(x); 450 if (priv_key && (i = (size_t)BN_num_bytes(priv_key)) > buf_len) 451 buf_len = i; 452 } else 453 priv_key = NULL; 454 455 if (ktype > 0) { 456 buf_len += 10; 457 if ((buffer = OPENSSL_malloc(buf_len)) == NULL) { 458 reason = ERR_R_MALLOC_FAILURE; 459 goto err; 460 } 461 } 462 if (ktype == 2) 463 ecstr = "Private-Key"; 464 else if (ktype == 1) 465 ecstr = "Public-Key"; 466 else 467 ecstr = "ECDSA-Parameters"; 468 469 if (!BIO_indent(bp, off, 128)) 470 goto err; 471 if ((order = BN_new()) == NULL) 472 goto err; 473 if (!EC_GROUP_get_order(group, order, NULL)) 474 goto err; 475 if (BIO_printf(bp, "%s: (%d bit)\n", ecstr, BN_num_bits(order)) <= 0) 476 goto err; 477 478 if ((priv_key != NULL) && !ASN1_bn_print(bp, "priv:", priv_key, 479 buffer, off)) 480 goto err; 481 if ((pub_key != NULL) && !ASN1_bn_print(bp, "pub: ", pub_key, 482 buffer, off)) 483 goto err; 484 if (!ECPKParameters_print(bp, group, off)) 485 goto err; 486 ret = 1; 487 err: 488 if (!ret) 489 ECerr(EC_F_DO_EC_KEY_PRINT, reason); 490 if (pub_key) 491 BN_free(pub_key); 492 if (order) 493 BN_free(order); 494 if (ctx) 495 BN_CTX_free(ctx); 496 if (buffer != NULL) 497 OPENSSL_free(buffer); 498 return (ret); 499 } 500 501 static int eckey_param_decode(EVP_PKEY *pkey, 502 const unsigned char **pder, int derlen) 503 { 504 EC_KEY *eckey; 505 if (!(eckey = d2i_ECParameters(NULL, pder, derlen))) { 506 ECerr(EC_F_ECKEY_PARAM_DECODE, ERR_R_EC_LIB); 507 return 0; 508 } 509 EVP_PKEY_assign_EC_KEY(pkey, eckey); 510 return 1; 511 } 512 513 static int eckey_param_encode(const EVP_PKEY *pkey, unsigned char **pder) 514 { 515 return i2d_ECParameters(pkey->pkey.ec, pder); 516 } 517 518 static int eckey_param_print(BIO *bp, const EVP_PKEY *pkey, int indent, 519 ASN1_PCTX *ctx) 520 { 521 return do_EC_KEY_print(bp, pkey->pkey.ec, indent, 0); 522 } 523 524 static int eckey_pub_print(BIO *bp, const EVP_PKEY *pkey, int indent, 525 ASN1_PCTX *ctx) 526 { 527 return do_EC_KEY_print(bp, pkey->pkey.ec, indent, 1); 528 } 529 530 static int eckey_priv_print(BIO *bp, const EVP_PKEY *pkey, int indent, 531 ASN1_PCTX *ctx) 532 { 533 return do_EC_KEY_print(bp, pkey->pkey.ec, indent, 2); 534 } 535 536 static int old_ec_priv_decode(EVP_PKEY *pkey, 537 const unsigned char **pder, int derlen) 538 { 539 EC_KEY *ec; 540 if (!(ec = d2i_ECPrivateKey(NULL, pder, derlen))) { 541 ECerr(EC_F_OLD_EC_PRIV_DECODE, EC_R_DECODE_ERROR); 542 return 0; 543 } 544 EVP_PKEY_assign_EC_KEY(pkey, ec); 545 return 1; 546 } 547 548 static int old_ec_priv_encode(const EVP_PKEY *pkey, unsigned char **pder) 549 { 550 return i2d_ECPrivateKey(pkey->pkey.ec, pder); 551 } 552 553 static int ec_pkey_ctrl(EVP_PKEY *pkey, int op, long arg1, void *arg2) 554 { 555 switch (op) { 556 case ASN1_PKEY_CTRL_PKCS7_SIGN: 557 if (arg1 == 0) { 558 int snid, hnid; 559 X509_ALGOR *alg1, *alg2; 560 PKCS7_SIGNER_INFO_get0_algs(arg2, NULL, &alg1, &alg2); 561 if (alg1 == NULL || alg1->algorithm == NULL) 562 return -1; 563 hnid = OBJ_obj2nid(alg1->algorithm); 564 if (hnid == NID_undef) 565 return -1; 566 if (!OBJ_find_sigid_by_algs(&snid, hnid, EVP_PKEY_id(pkey))) 567 return -1; 568 X509_ALGOR_set0(alg2, OBJ_nid2obj(snid), V_ASN1_UNDEF, 0); 569 } 570 return 1; 571 #ifndef OPENSSL_NO_CMS 572 case ASN1_PKEY_CTRL_CMS_SIGN: 573 if (arg1 == 0) { 574 int snid, hnid; 575 X509_ALGOR *alg1, *alg2; 576 CMS_SignerInfo_get0_algs(arg2, NULL, NULL, &alg1, &alg2); 577 if (alg1 == NULL || alg1->algorithm == NULL) 578 return -1; 579 hnid = OBJ_obj2nid(alg1->algorithm); 580 if (hnid == NID_undef) 581 return -1; 582 if (!OBJ_find_sigid_by_algs(&snid, hnid, EVP_PKEY_id(pkey))) 583 return -1; 584 X509_ALGOR_set0(alg2, OBJ_nid2obj(snid), V_ASN1_UNDEF, 0); 585 } 586 return 1; 587 588 case ASN1_PKEY_CTRL_CMS_ENVELOPE: 589 if (arg1 == 1) 590 return ecdh_cms_decrypt(arg2); 591 else if (arg1 == 0) 592 return ecdh_cms_encrypt(arg2); 593 return -2; 594 595 case ASN1_PKEY_CTRL_CMS_RI_TYPE: 596 *(int *)arg2 = CMS_RECIPINFO_AGREE; 597 return 1; 598 #endif 599 600 case ASN1_PKEY_CTRL_DEFAULT_MD_NID: 601 *(int *)arg2 = NID_sha256; 602 return 2; 603 604 default: 605 return -2; 606 607 } 608 609 } 610 611 const EVP_PKEY_ASN1_METHOD eckey_asn1_meth = { 612 EVP_PKEY_EC, 613 EVP_PKEY_EC, 614 0, 615 "EC", 616 "OpenSSL EC algorithm", 617 618 eckey_pub_decode, 619 eckey_pub_encode, 620 eckey_pub_cmp, 621 eckey_pub_print, 622 623 eckey_priv_decode, 624 eckey_priv_encode, 625 eckey_priv_print, 626 627 int_ec_size, 628 ec_bits, 629 630 eckey_param_decode, 631 eckey_param_encode, 632 ec_missing_parameters, 633 ec_copy_parameters, 634 ec_cmp_parameters, 635 eckey_param_print, 636 0, 637 638 int_ec_free, 639 ec_pkey_ctrl, 640 old_ec_priv_decode, 641 old_ec_priv_encode 642 }; 643 644 #ifndef OPENSSL_NO_CMS 645 646 static int ecdh_cms_set_peerkey(EVP_PKEY_CTX *pctx, 647 X509_ALGOR *alg, ASN1_BIT_STRING *pubkey) 648 { 649 ASN1_OBJECT *aoid; 650 int atype; 651 void *aval; 652 int rv = 0; 653 EVP_PKEY *pkpeer = NULL; 654 EC_KEY *ecpeer = NULL; 655 const unsigned char *p; 656 int plen; 657 X509_ALGOR_get0(&aoid, &atype, &aval, alg); 658 if (OBJ_obj2nid(aoid) != NID_X9_62_id_ecPublicKey) 659 goto err; 660 /* If absent parameters get group from main key */ 661 if (atype == V_ASN1_UNDEF || atype == V_ASN1_NULL) { 662 const EC_GROUP *grp; 663 EVP_PKEY *pk; 664 pk = EVP_PKEY_CTX_get0_pkey(pctx); 665 if (!pk) 666 goto err; 667 grp = EC_KEY_get0_group(pk->pkey.ec); 668 ecpeer = EC_KEY_new(); 669 if (!ecpeer) 670 goto err; 671 if (!EC_KEY_set_group(ecpeer, grp)) 672 goto err; 673 } else { 674 ecpeer = eckey_type2param(atype, aval); 675 if (!ecpeer) 676 goto err; 677 } 678 /* We have parameters now set public key */ 679 plen = ASN1_STRING_length(pubkey); 680 p = ASN1_STRING_data(pubkey); 681 if (!p || !plen) 682 goto err; 683 if (!o2i_ECPublicKey(&ecpeer, &p, plen)) 684 goto err; 685 pkpeer = EVP_PKEY_new(); 686 if (!pkpeer) 687 goto err; 688 EVP_PKEY_set1_EC_KEY(pkpeer, ecpeer); 689 if (EVP_PKEY_derive_set_peer(pctx, pkpeer) > 0) 690 rv = 1; 691 err: 692 if (ecpeer) 693 EC_KEY_free(ecpeer); 694 if (pkpeer) 695 EVP_PKEY_free(pkpeer); 696 return rv; 697 } 698 699 /* Set KDF parameters based on KDF NID */ 700 static int ecdh_cms_set_kdf_param(EVP_PKEY_CTX *pctx, int eckdf_nid) 701 { 702 int kdf_nid, kdfmd_nid, cofactor; 703 const EVP_MD *kdf_md; 704 if (eckdf_nid == NID_undef) 705 return 0; 706 707 /* Lookup KDF type, cofactor mode and digest */ 708 if (!OBJ_find_sigid_algs(eckdf_nid, &kdfmd_nid, &kdf_nid)) 709 return 0; 710 711 if (kdf_nid == NID_dh_std_kdf) 712 cofactor = 0; 713 else if (kdf_nid == NID_dh_cofactor_kdf) 714 cofactor = 1; 715 else 716 return 0; 717 718 if (EVP_PKEY_CTX_set_ecdh_cofactor_mode(pctx, cofactor) <= 0) 719 return 0; 720 721 if (EVP_PKEY_CTX_set_ecdh_kdf_type(pctx, EVP_PKEY_ECDH_KDF_X9_62) <= 0) 722 return 0; 723 724 kdf_md = EVP_get_digestbynid(kdfmd_nid); 725 if (!kdf_md) 726 return 0; 727 728 if (EVP_PKEY_CTX_set_ecdh_kdf_md(pctx, kdf_md) <= 0) 729 return 0; 730 return 1; 731 } 732 733 static int ecdh_cms_set_shared_info(EVP_PKEY_CTX *pctx, CMS_RecipientInfo *ri) 734 { 735 int rv = 0; 736 737 X509_ALGOR *alg, *kekalg = NULL; 738 ASN1_OCTET_STRING *ukm; 739 const unsigned char *p; 740 unsigned char *der = NULL; 741 int plen, keylen; 742 const EVP_CIPHER *kekcipher; 743 EVP_CIPHER_CTX *kekctx; 744 745 if (!CMS_RecipientInfo_kari_get0_alg(ri, &alg, &ukm)) 746 return 0; 747 748 if (!ecdh_cms_set_kdf_param(pctx, OBJ_obj2nid(alg->algorithm))) { 749 ECerr(EC_F_ECDH_CMS_SET_SHARED_INFO, EC_R_KDF_PARAMETER_ERROR); 750 return 0; 751 } 752 753 if (alg->parameter->type != V_ASN1_SEQUENCE) 754 return 0; 755 756 p = alg->parameter->value.sequence->data; 757 plen = alg->parameter->value.sequence->length; 758 kekalg = d2i_X509_ALGOR(NULL, &p, plen); 759 if (!kekalg) 760 goto err; 761 kekctx = CMS_RecipientInfo_kari_get0_ctx(ri); 762 if (!kekctx) 763 goto err; 764 kekcipher = EVP_get_cipherbyobj(kekalg->algorithm); 765 if (!kekcipher || EVP_CIPHER_mode(kekcipher) != EVP_CIPH_WRAP_MODE) 766 goto err; 767 if (!EVP_EncryptInit_ex(kekctx, kekcipher, NULL, NULL, NULL)) 768 goto err; 769 if (EVP_CIPHER_asn1_to_param(kekctx, kekalg->parameter) <= 0) 770 goto err; 771 772 keylen = EVP_CIPHER_CTX_key_length(kekctx); 773 if (EVP_PKEY_CTX_set_ecdh_kdf_outlen(pctx, keylen) <= 0) 774 goto err; 775 776 plen = CMS_SharedInfo_encode(&der, kekalg, ukm, keylen); 777 778 if (!plen) 779 goto err; 780 781 if (EVP_PKEY_CTX_set0_ecdh_kdf_ukm(pctx, der, plen) <= 0) 782 goto err; 783 der = NULL; 784 785 rv = 1; 786 err: 787 if (kekalg) 788 X509_ALGOR_free(kekalg); 789 if (der) 790 OPENSSL_free(der); 791 return rv; 792 } 793 794 static int ecdh_cms_decrypt(CMS_RecipientInfo *ri) 795 { 796 EVP_PKEY_CTX *pctx; 797 pctx = CMS_RecipientInfo_get0_pkey_ctx(ri); 798 if (!pctx) 799 return 0; 800 /* See if we need to set peer key */ 801 if (!EVP_PKEY_CTX_get0_peerkey(pctx)) { 802 X509_ALGOR *alg; 803 ASN1_BIT_STRING *pubkey; 804 if (!CMS_RecipientInfo_kari_get0_orig_id(ri, &alg, &pubkey, 805 NULL, NULL, NULL)) 806 return 0; 807 if (!alg || !pubkey) 808 return 0; 809 if (!ecdh_cms_set_peerkey(pctx, alg, pubkey)) { 810 ECerr(EC_F_ECDH_CMS_DECRYPT, EC_R_PEER_KEY_ERROR); 811 return 0; 812 } 813 } 814 /* Set ECDH derivation parameters and initialise unwrap context */ 815 if (!ecdh_cms_set_shared_info(pctx, ri)) { 816 ECerr(EC_F_ECDH_CMS_DECRYPT, EC_R_SHARED_INFO_ERROR); 817 return 0; 818 } 819 return 1; 820 } 821 822 static int ecdh_cms_encrypt(CMS_RecipientInfo *ri) 823 { 824 EVP_PKEY_CTX *pctx; 825 EVP_PKEY *pkey; 826 EVP_CIPHER_CTX *ctx; 827 int keylen; 828 X509_ALGOR *talg, *wrap_alg = NULL; 829 ASN1_OBJECT *aoid; 830 ASN1_BIT_STRING *pubkey; 831 ASN1_STRING *wrap_str; 832 ASN1_OCTET_STRING *ukm; 833 unsigned char *penc = NULL; 834 int penclen; 835 int rv = 0; 836 int ecdh_nid, kdf_type, kdf_nid, wrap_nid; 837 const EVP_MD *kdf_md; 838 pctx = CMS_RecipientInfo_get0_pkey_ctx(ri); 839 if (!pctx) 840 return 0; 841 /* Get ephemeral key */ 842 pkey = EVP_PKEY_CTX_get0_pkey(pctx); 843 if (!CMS_RecipientInfo_kari_get0_orig_id(ri, &talg, &pubkey, 844 NULL, NULL, NULL)) 845 goto err; 846 X509_ALGOR_get0(&aoid, NULL, NULL, talg); 847 /* Is everything uninitialised? */ 848 if (aoid == OBJ_nid2obj(NID_undef)) { 849 850 EC_KEY *eckey = pkey->pkey.ec; 851 /* Set the key */ 852 unsigned char *p; 853 854 penclen = i2o_ECPublicKey(eckey, NULL); 855 if (penclen <= 0) 856 goto err; 857 penc = OPENSSL_malloc(penclen); 858 if (!penc) 859 goto err; 860 p = penc; 861 penclen = i2o_ECPublicKey(eckey, &p); 862 if (penclen <= 0) 863 goto err; 864 ASN1_STRING_set0(pubkey, penc, penclen); 865 pubkey->flags &= ~(ASN1_STRING_FLAG_BITS_LEFT | 0x07); 866 pubkey->flags |= ASN1_STRING_FLAG_BITS_LEFT; 867 868 penc = NULL; 869 X509_ALGOR_set0(talg, OBJ_nid2obj(NID_X9_62_id_ecPublicKey), 870 V_ASN1_UNDEF, NULL); 871 } 872 873 /* See if custom paraneters set */ 874 kdf_type = EVP_PKEY_CTX_get_ecdh_kdf_type(pctx); 875 if (kdf_type <= 0) 876 goto err; 877 if (!EVP_PKEY_CTX_get_ecdh_kdf_md(pctx, &kdf_md)) 878 goto err; 879 ecdh_nid = EVP_PKEY_CTX_get_ecdh_cofactor_mode(pctx); 880 if (ecdh_nid < 0) 881 goto err; 882 else if (ecdh_nid == 0) 883 ecdh_nid = NID_dh_std_kdf; 884 else if (ecdh_nid == 1) 885 ecdh_nid = NID_dh_cofactor_kdf; 886 887 if (kdf_type == EVP_PKEY_ECDH_KDF_NONE) { 888 kdf_type = EVP_PKEY_ECDH_KDF_X9_62; 889 if (EVP_PKEY_CTX_set_ecdh_kdf_type(pctx, kdf_type) <= 0) 890 goto err; 891 } else 892 /* Uknown KDF */ 893 goto err; 894 if (kdf_md == NULL) { 895 /* Fixme later for better MD */ 896 kdf_md = EVP_sha1(); 897 if (EVP_PKEY_CTX_set_ecdh_kdf_md(pctx, kdf_md) <= 0) 898 goto err; 899 } 900 901 if (!CMS_RecipientInfo_kari_get0_alg(ri, &talg, &ukm)) 902 goto err; 903 904 /* Lookup NID for KDF+cofactor+digest */ 905 906 if (!OBJ_find_sigid_by_algs(&kdf_nid, EVP_MD_type(kdf_md), ecdh_nid)) 907 goto err; 908 /* Get wrap NID */ 909 ctx = CMS_RecipientInfo_kari_get0_ctx(ri); 910 wrap_nid = EVP_CIPHER_CTX_type(ctx); 911 keylen = EVP_CIPHER_CTX_key_length(ctx); 912 913 /* Package wrap algorithm in an AlgorithmIdentifier */ 914 915 wrap_alg = X509_ALGOR_new(); 916 if (!wrap_alg) 917 goto err; 918 wrap_alg->algorithm = OBJ_nid2obj(wrap_nid); 919 wrap_alg->parameter = ASN1_TYPE_new(); 920 if (!wrap_alg->parameter) 921 goto err; 922 if (EVP_CIPHER_param_to_asn1(ctx, wrap_alg->parameter) <= 0) 923 goto err; 924 if (ASN1_TYPE_get(wrap_alg->parameter) == NID_undef) { 925 ASN1_TYPE_free(wrap_alg->parameter); 926 wrap_alg->parameter = NULL; 927 } 928 929 if (EVP_PKEY_CTX_set_ecdh_kdf_outlen(pctx, keylen) <= 0) 930 goto err; 931 932 penclen = CMS_SharedInfo_encode(&penc, wrap_alg, ukm, keylen); 933 934 if (!penclen) 935 goto err; 936 937 if (EVP_PKEY_CTX_set0_ecdh_kdf_ukm(pctx, penc, penclen) <= 0) 938 goto err; 939 penc = NULL; 940 941 /* 942 * Now need to wrap encoding of wrap AlgorithmIdentifier into parameter 943 * of another AlgorithmIdentifier. 944 */ 945 penclen = i2d_X509_ALGOR(wrap_alg, &penc); 946 if (!penc || !penclen) 947 goto err; 948 wrap_str = ASN1_STRING_new(); 949 if (!wrap_str) 950 goto err; 951 ASN1_STRING_set0(wrap_str, penc, penclen); 952 penc = NULL; 953 X509_ALGOR_set0(talg, OBJ_nid2obj(kdf_nid), V_ASN1_SEQUENCE, wrap_str); 954 955 rv = 1; 956 957 err: 958 if (penc) 959 OPENSSL_free(penc); 960 if (wrap_alg) 961 X509_ALGOR_free(wrap_alg); 962 return rv; 963 } 964 965 #endif 966