2
0

pkey.c 10.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330
  1. /*
  2. * Copyright 2006-2022 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #include <stdio.h>
  10. #include <string.h>
  11. #include "apps.h"
  12. #include "progs.h"
  13. #include "ec_common.h"
  14. #include <openssl/pem.h>
  15. #include <openssl/err.h>
  16. #include <openssl/evp.h>
  17. #include <openssl/core_names.h>
  18. typedef enum OPTION_choice {
  19. OPT_COMMON,
  20. OPT_INFORM, OPT_OUTFORM, OPT_PASSIN, OPT_PASSOUT, OPT_ENGINE,
  21. OPT_IN, OPT_OUT, OPT_PUBIN, OPT_PUBOUT, OPT_TEXT_PUB,
  22. OPT_TEXT, OPT_NOOUT, OPT_CIPHER, OPT_TRADITIONAL, OPT_CHECK, OPT_PUB_CHECK,
  23. OPT_EC_PARAM_ENC, OPT_EC_CONV_FORM,
  24. OPT_PROV_ENUM
  25. } OPTION_CHOICE;
  26. const OPTIONS pkey_options[] = {
  27. OPT_SECTION("General"),
  28. {"help", OPT_HELP, '-', "Display this summary"},
  29. #ifndef OPENSSL_NO_ENGINE
  30. {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
  31. #endif
  32. OPT_PROV_OPTIONS,
  33. {"check", OPT_CHECK, '-', "Check key consistency"},
  34. {"pubcheck", OPT_PUB_CHECK, '-', "Check public key consistency"},
  35. OPT_SECTION("Input"),
  36. {"in", OPT_IN, 's', "Input key"},
  37. {"inform", OPT_INFORM, 'f',
  38. "Key input format (ENGINE, other values ignored)"},
  39. {"passin", OPT_PASSIN, 's', "Key input pass phrase source"},
  40. {"pubin", OPT_PUBIN, '-',
  41. "Read only public components from key input"},
  42. OPT_SECTION("Output"),
  43. {"out", OPT_OUT, '>', "Output file for encoded and/or text output"},
  44. {"outform", OPT_OUTFORM, 'F', "Output encoding format (DER or PEM)"},
  45. {"", OPT_CIPHER, '-', "Any supported cipher to be used for encryption"},
  46. {"passout", OPT_PASSOUT, 's', "Output PEM file pass phrase source"},
  47. {"traditional", OPT_TRADITIONAL, '-',
  48. "Use traditional format for private key PEM output"},
  49. {"pubout", OPT_PUBOUT, '-', "Restrict encoded output to public components"},
  50. {"noout", OPT_NOOUT, '-', "Do not output the key in encoded form"},
  51. {"text", OPT_TEXT, '-', "Output key components in plaintext"},
  52. {"text_pub", OPT_TEXT_PUB, '-',
  53. "Output only public key components in text form"},
  54. {"ec_conv_form", OPT_EC_CONV_FORM, 's',
  55. "Specifies the EC point conversion form in the encoding"},
  56. {"ec_param_enc", OPT_EC_PARAM_ENC, 's',
  57. "Specifies the way the EC parameters are encoded"},
  58. {NULL}
  59. };
  60. int pkey_main(int argc, char **argv)
  61. {
  62. BIO *out = NULL;
  63. ENGINE *e = NULL;
  64. EVP_PKEY *pkey = NULL;
  65. EVP_PKEY_CTX *ctx = NULL;
  66. EVP_CIPHER *cipher = NULL;
  67. char *infile = NULL, *outfile = NULL, *passin = NULL, *passout = NULL;
  68. char *passinarg = NULL, *passoutarg = NULL, *ciphername = NULL, *prog;
  69. OPTION_CHOICE o;
  70. int informat = FORMAT_UNDEF, outformat = FORMAT_PEM;
  71. int pubin = 0, pubout = 0, text_pub = 0, text = 0, noout = 0, ret = 1;
  72. int private = 0, traditional = 0, check = 0, pub_check = 0;
  73. #ifndef OPENSSL_NO_EC
  74. char *asn1_encoding = NULL;
  75. char *point_format = NULL;
  76. #endif
  77. opt_set_unknown_name("cipher");
  78. prog = opt_init(argc, argv, pkey_options);
  79. while ((o = opt_next()) != OPT_EOF) {
  80. switch (o) {
  81. case OPT_EOF:
  82. case OPT_ERR:
  83. opthelp:
  84. BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
  85. goto end;
  86. case OPT_HELP:
  87. opt_help(pkey_options);
  88. ret = 0;
  89. goto end;
  90. case OPT_INFORM:
  91. if (!opt_format(opt_arg(), OPT_FMT_ANY, &informat))
  92. goto opthelp;
  93. break;
  94. case OPT_OUTFORM:
  95. if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &outformat))
  96. goto opthelp;
  97. break;
  98. case OPT_PASSIN:
  99. passinarg = opt_arg();
  100. break;
  101. case OPT_PASSOUT:
  102. passoutarg = opt_arg();
  103. break;
  104. case OPT_ENGINE:
  105. e = setup_engine(opt_arg(), 0);
  106. break;
  107. case OPT_IN:
  108. infile = opt_arg();
  109. break;
  110. case OPT_OUT:
  111. outfile = opt_arg();
  112. break;
  113. case OPT_PUBIN:
  114. pubin = pubout = 1;
  115. break;
  116. case OPT_PUBOUT:
  117. pubout = 1;
  118. break;
  119. case OPT_TEXT_PUB:
  120. text_pub = 1;
  121. break;
  122. case OPT_TEXT:
  123. text = 1;
  124. break;
  125. case OPT_NOOUT:
  126. noout = 1;
  127. break;
  128. case OPT_TRADITIONAL:
  129. traditional = 1;
  130. break;
  131. case OPT_CHECK:
  132. check = 1;
  133. break;
  134. case OPT_PUB_CHECK:
  135. pub_check = 1;
  136. break;
  137. case OPT_CIPHER:
  138. ciphername = opt_unknown();
  139. break;
  140. case OPT_EC_CONV_FORM:
  141. #ifdef OPENSSL_NO_EC
  142. goto opthelp;
  143. #else
  144. point_format = opt_arg();
  145. if (!opt_string(point_format, point_format_options))
  146. goto opthelp;
  147. break;
  148. #endif
  149. case OPT_EC_PARAM_ENC:
  150. #ifdef OPENSSL_NO_EC
  151. goto opthelp;
  152. #else
  153. asn1_encoding = opt_arg();
  154. if (!opt_string(asn1_encoding, asn1_encoding_options))
  155. goto opthelp;
  156. break;
  157. #endif
  158. case OPT_PROV_CASES:
  159. if (!opt_provider(o))
  160. goto end;
  161. break;
  162. }
  163. }
  164. /* No extra arguments. */
  165. if (!opt_check_rest_arg(NULL))
  166. goto opthelp;
  167. if (text && text_pub)
  168. BIO_printf(bio_err,
  169. "Warning: The -text option is ignored with -text_pub\n");
  170. if (traditional && (noout || outformat != FORMAT_PEM))
  171. BIO_printf(bio_err,
  172. "Warning: The -traditional is ignored since there is no PEM output\n");
  173. /* -pubout and -text is the same as -text_pub */
  174. if (!text_pub && pubout && text) {
  175. text = 0;
  176. text_pub = 1;
  177. }
  178. private = (!noout && !pubout) || (text && !text_pub);
  179. if (!opt_cipher(ciphername, &cipher))
  180. goto opthelp;
  181. if (cipher == NULL) {
  182. if (passoutarg != NULL)
  183. BIO_printf(bio_err,
  184. "Warning: The -passout option is ignored without a cipher option\n");
  185. } else {
  186. if (noout || outformat != FORMAT_PEM) {
  187. BIO_printf(bio_err,
  188. "Error: Cipher options are supported only for PEM output\n");
  189. goto end;
  190. }
  191. }
  192. if (!app_passwd(passinarg, passoutarg, &passin, &passout)) {
  193. BIO_printf(bio_err, "Error getting passwords\n");
  194. goto end;
  195. }
  196. out = bio_open_owner(outfile, outformat, private);
  197. if (out == NULL)
  198. goto end;
  199. if (pubin)
  200. pkey = load_pubkey(infile, informat, 1, passin, e, "Public Key");
  201. else
  202. pkey = load_key(infile, informat, 1, passin, e, "key");
  203. if (pkey == NULL)
  204. goto end;
  205. #ifndef OPENSSL_NO_EC
  206. if (asn1_encoding != NULL || point_format != NULL) {
  207. OSSL_PARAM params[3], *p = params;
  208. if (!EVP_PKEY_is_a(pkey, "EC"))
  209. goto end;
  210. if (asn1_encoding != NULL)
  211. *p++ = OSSL_PARAM_construct_utf8_string(OSSL_PKEY_PARAM_EC_ENCODING,
  212. asn1_encoding, 0);
  213. if (point_format != NULL)
  214. *p++ = OSSL_PARAM_construct_utf8_string(
  215. OSSL_PKEY_PARAM_EC_POINT_CONVERSION_FORMAT,
  216. point_format, 0);
  217. *p = OSSL_PARAM_construct_end();
  218. if (EVP_PKEY_set_params(pkey, params) <= 0)
  219. goto end;
  220. }
  221. #endif
  222. if (check || pub_check) {
  223. int r;
  224. ctx = EVP_PKEY_CTX_new(pkey, e);
  225. if (ctx == NULL) {
  226. ERR_print_errors(bio_err);
  227. goto end;
  228. }
  229. if (check)
  230. r = EVP_PKEY_check(ctx);
  231. else
  232. r = EVP_PKEY_public_check(ctx);
  233. if (r == 1) {
  234. BIO_printf(out, "Key is valid\n");
  235. } else {
  236. /*
  237. * Note: at least for RSA keys if this function returns
  238. * -1, there will be no error reasons.
  239. */
  240. BIO_printf(bio_err, "Key is invalid\n");
  241. ERR_print_errors(bio_err);
  242. goto end;
  243. }
  244. }
  245. if (!noout) {
  246. if (outformat == FORMAT_PEM) {
  247. if (pubout) {
  248. if (!PEM_write_bio_PUBKEY(out, pkey))
  249. goto end;
  250. } else {
  251. assert(private);
  252. if (traditional) {
  253. if (!PEM_write_bio_PrivateKey_traditional(out, pkey, cipher,
  254. NULL, 0, NULL,
  255. passout))
  256. goto end;
  257. } else {
  258. if (!PEM_write_bio_PrivateKey(out, pkey, cipher,
  259. NULL, 0, NULL, passout))
  260. goto end;
  261. }
  262. }
  263. } else if (outformat == FORMAT_ASN1) {
  264. if (text || text_pub) {
  265. BIO_printf(bio_err,
  266. "Error: Text output cannot be combined with DER output\n");
  267. goto end;
  268. }
  269. if (pubout) {
  270. if (!i2d_PUBKEY_bio(out, pkey))
  271. goto end;
  272. } else {
  273. assert(private);
  274. if (!i2d_PrivateKey_bio(out, pkey))
  275. goto end;
  276. }
  277. } else {
  278. BIO_printf(bio_err, "Bad format specified for key\n");
  279. goto end;
  280. }
  281. }
  282. if (text_pub) {
  283. if (EVP_PKEY_print_public(out, pkey, 0, NULL) <= 0)
  284. goto end;
  285. } else if (text) {
  286. assert(private);
  287. if (EVP_PKEY_print_private(out, pkey, 0, NULL) <= 0)
  288. goto end;
  289. }
  290. ret = 0;
  291. end:
  292. if (ret != 0)
  293. ERR_print_errors(bio_err);
  294. EVP_PKEY_CTX_free(ctx);
  295. EVP_PKEY_free(pkey);
  296. EVP_CIPHER_free(cipher);
  297. release_engine(e);
  298. BIO_free_all(out);
  299. OPENSSL_free(passin);
  300. OPENSSL_free(passout);
  301. return ret;
  302. }