dh_ameth.c 24 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983
  1. /*
  2. * Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #include <stdio.h>
  10. #include "internal/cryptlib.h"
  11. #include <openssl/x509.h>
  12. #include <openssl/asn1.h>
  13. #include "dh_local.h"
  14. #include <openssl/bn.h>
  15. #include "crypto/asn1.h"
  16. #include "crypto/evp.h"
  17. #include <openssl/cms.h>
  18. #include <openssl/core_names.h>
  19. #include "internal/param_build.h"
  20. /*
  21. * i2d/d2i like DH parameter functions which use the appropriate routine for
  22. * PKCS#3 DH or X9.42 DH.
  23. */
  24. static DH *d2i_dhp(const EVP_PKEY *pkey, const unsigned char **pp,
  25. long length)
  26. {
  27. if (pkey->ameth == &dhx_asn1_meth)
  28. return d2i_DHxparams(NULL, pp, length);
  29. return d2i_DHparams(NULL, pp, length);
  30. }
  31. static int i2d_dhp(const EVP_PKEY *pkey, const DH *a, unsigned char **pp)
  32. {
  33. if (pkey->ameth == &dhx_asn1_meth)
  34. return i2d_DHxparams(a, pp);
  35. return i2d_DHparams(a, pp);
  36. }
  37. static void int_dh_free(EVP_PKEY *pkey)
  38. {
  39. DH_free(pkey->pkey.dh);
  40. }
  41. static int dh_pub_decode(EVP_PKEY *pkey, X509_PUBKEY *pubkey)
  42. {
  43. const unsigned char *p, *pm;
  44. int pklen, pmlen;
  45. int ptype;
  46. const void *pval;
  47. const ASN1_STRING *pstr;
  48. X509_ALGOR *palg;
  49. ASN1_INTEGER *public_key = NULL;
  50. DH *dh = NULL;
  51. if (!X509_PUBKEY_get0_param(NULL, &p, &pklen, &palg, pubkey))
  52. return 0;
  53. X509_ALGOR_get0(NULL, &ptype, &pval, palg);
  54. if (ptype != V_ASN1_SEQUENCE) {
  55. DHerr(DH_F_DH_PUB_DECODE, DH_R_PARAMETER_ENCODING_ERROR);
  56. goto err;
  57. }
  58. pstr = pval;
  59. pm = pstr->data;
  60. pmlen = pstr->length;
  61. if ((dh = d2i_dhp(pkey, &pm, pmlen)) == NULL) {
  62. DHerr(DH_F_DH_PUB_DECODE, DH_R_DECODE_ERROR);
  63. goto err;
  64. }
  65. if ((public_key = d2i_ASN1_INTEGER(NULL, &p, pklen)) == NULL) {
  66. DHerr(DH_F_DH_PUB_DECODE, DH_R_DECODE_ERROR);
  67. goto err;
  68. }
  69. /* We have parameters now set public key */
  70. if ((dh->pub_key = ASN1_INTEGER_to_BN(public_key, NULL)) == NULL) {
  71. DHerr(DH_F_DH_PUB_DECODE, DH_R_BN_DECODE_ERROR);
  72. goto err;
  73. }
  74. ASN1_INTEGER_free(public_key);
  75. EVP_PKEY_assign(pkey, pkey->ameth->pkey_id, dh);
  76. return 1;
  77. err:
  78. ASN1_INTEGER_free(public_key);
  79. DH_free(dh);
  80. return 0;
  81. }
  82. static int dh_pub_encode(X509_PUBKEY *pk, const EVP_PKEY *pkey)
  83. {
  84. DH *dh;
  85. int ptype;
  86. unsigned char *penc = NULL;
  87. int penclen;
  88. ASN1_STRING *str;
  89. ASN1_INTEGER *pub_key = NULL;
  90. dh = pkey->pkey.dh;
  91. str = ASN1_STRING_new();
  92. if (str == NULL) {
  93. DHerr(DH_F_DH_PUB_ENCODE, ERR_R_MALLOC_FAILURE);
  94. goto err;
  95. }
  96. str->length = i2d_dhp(pkey, dh, &str->data);
  97. if (str->length <= 0) {
  98. DHerr(DH_F_DH_PUB_ENCODE, ERR_R_MALLOC_FAILURE);
  99. goto err;
  100. }
  101. ptype = V_ASN1_SEQUENCE;
  102. pub_key = BN_to_ASN1_INTEGER(dh->pub_key, NULL);
  103. if (pub_key == NULL)
  104. goto err;
  105. penclen = i2d_ASN1_INTEGER(pub_key, &penc);
  106. ASN1_INTEGER_free(pub_key);
  107. if (penclen <= 0) {
  108. DHerr(DH_F_DH_PUB_ENCODE, ERR_R_MALLOC_FAILURE);
  109. goto err;
  110. }
  111. if (X509_PUBKEY_set0_param(pk, OBJ_nid2obj(pkey->ameth->pkey_id),
  112. ptype, str, penc, penclen))
  113. return 1;
  114. err:
  115. OPENSSL_free(penc);
  116. ASN1_STRING_free(str);
  117. return 0;
  118. }
  119. /*
  120. * PKCS#8 DH is defined in PKCS#11 of all places. It is similar to DH in that
  121. * the AlgorithmIdentifier contains the parameters, the private key is
  122. * explicitly included and the pubkey must be recalculated.
  123. */
  124. static int dh_priv_decode(EVP_PKEY *pkey, const PKCS8_PRIV_KEY_INFO *p8)
  125. {
  126. const unsigned char *p, *pm;
  127. int pklen, pmlen;
  128. int ptype;
  129. const void *pval;
  130. const ASN1_STRING *pstr;
  131. const X509_ALGOR *palg;
  132. ASN1_INTEGER *privkey = NULL;
  133. DH *dh = NULL;
  134. if (!PKCS8_pkey_get0(NULL, &p, &pklen, &palg, p8))
  135. return 0;
  136. X509_ALGOR_get0(NULL, &ptype, &pval, palg);
  137. if (ptype != V_ASN1_SEQUENCE)
  138. goto decerr;
  139. if ((privkey = d2i_ASN1_INTEGER(NULL, &p, pklen)) == NULL)
  140. goto decerr;
  141. pstr = pval;
  142. pm = pstr->data;
  143. pmlen = pstr->length;
  144. if ((dh = d2i_dhp(pkey, &pm, pmlen)) == NULL)
  145. goto decerr;
  146. /* We have parameters now set private key */
  147. if ((dh->priv_key = BN_secure_new()) == NULL
  148. || !ASN1_INTEGER_to_BN(privkey, dh->priv_key)) {
  149. DHerr(DH_F_DH_PRIV_DECODE, DH_R_BN_ERROR);
  150. goto dherr;
  151. }
  152. /* Calculate public key, increments dirty_cnt */
  153. if (!DH_generate_key(dh))
  154. goto dherr;
  155. EVP_PKEY_assign(pkey, pkey->ameth->pkey_id, dh);
  156. ASN1_STRING_clear_free(privkey);
  157. return 1;
  158. decerr:
  159. DHerr(DH_F_DH_PRIV_DECODE, EVP_R_DECODE_ERROR);
  160. dherr:
  161. DH_free(dh);
  162. ASN1_STRING_clear_free(privkey);
  163. return 0;
  164. }
  165. static int dh_priv_encode(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pkey)
  166. {
  167. ASN1_STRING *params = NULL;
  168. ASN1_INTEGER *prkey = NULL;
  169. unsigned char *dp = NULL;
  170. int dplen;
  171. params = ASN1_STRING_new();
  172. if (params == NULL) {
  173. DHerr(DH_F_DH_PRIV_ENCODE, ERR_R_MALLOC_FAILURE);
  174. goto err;
  175. }
  176. params->length = i2d_dhp(pkey, pkey->pkey.dh, &params->data);
  177. if (params->length <= 0) {
  178. DHerr(DH_F_DH_PRIV_ENCODE, ERR_R_MALLOC_FAILURE);
  179. goto err;
  180. }
  181. params->type = V_ASN1_SEQUENCE;
  182. /* Get private key into integer */
  183. prkey = BN_to_ASN1_INTEGER(pkey->pkey.dh->priv_key, NULL);
  184. if (prkey == NULL) {
  185. DHerr(DH_F_DH_PRIV_ENCODE, DH_R_BN_ERROR);
  186. goto err;
  187. }
  188. dplen = i2d_ASN1_INTEGER(prkey, &dp);
  189. ASN1_STRING_clear_free(prkey);
  190. prkey = NULL;
  191. if (!PKCS8_pkey_set0(p8, OBJ_nid2obj(pkey->ameth->pkey_id), 0,
  192. V_ASN1_SEQUENCE, params, dp, dplen))
  193. goto err;
  194. return 1;
  195. err:
  196. OPENSSL_free(dp);
  197. ASN1_STRING_free(params);
  198. ASN1_STRING_clear_free(prkey);
  199. return 0;
  200. }
  201. static int dh_param_decode(EVP_PKEY *pkey,
  202. const unsigned char **pder, int derlen)
  203. {
  204. DH *dh;
  205. if ((dh = d2i_dhp(pkey, pder, derlen)) == NULL) {
  206. DHerr(DH_F_DH_PARAM_DECODE, ERR_R_DH_LIB);
  207. return 0;
  208. }
  209. dh->dirty_cnt++;
  210. EVP_PKEY_assign(pkey, pkey->ameth->pkey_id, dh);
  211. return 1;
  212. }
  213. static int dh_param_encode(const EVP_PKEY *pkey, unsigned char **pder)
  214. {
  215. return i2d_dhp(pkey, pkey->pkey.dh, pder);
  216. }
  217. static int do_dh_print(BIO *bp, const DH *x, int indent, int ptype)
  218. {
  219. int reason = ERR_R_BUF_LIB;
  220. const char *ktype = NULL;
  221. BIGNUM *priv_key, *pub_key;
  222. if (ptype == 2)
  223. priv_key = x->priv_key;
  224. else
  225. priv_key = NULL;
  226. if (ptype > 0)
  227. pub_key = x->pub_key;
  228. else
  229. pub_key = NULL;
  230. if (x->p == NULL || (ptype == 2 && priv_key == NULL)
  231. || (ptype > 0 && pub_key == NULL)) {
  232. reason = ERR_R_PASSED_NULL_PARAMETER;
  233. goto err;
  234. }
  235. if (ptype == 2)
  236. ktype = "DH Private-Key";
  237. else if (ptype == 1)
  238. ktype = "DH Public-Key";
  239. else
  240. ktype = "DH Parameters";
  241. BIO_indent(bp, indent, 128);
  242. if (BIO_printf(bp, "%s: (%d bit)\n", ktype, BN_num_bits(x->p)) <= 0)
  243. goto err;
  244. indent += 4;
  245. if (!ASN1_bn_print(bp, "private-key:", priv_key, NULL, indent))
  246. goto err;
  247. if (!ASN1_bn_print(bp, "public-key:", pub_key, NULL, indent))
  248. goto err;
  249. if (!ASN1_bn_print(bp, "prime:", x->p, NULL, indent))
  250. goto err;
  251. if (!ASN1_bn_print(bp, "generator:", x->g, NULL, indent))
  252. goto err;
  253. if (x->q && !ASN1_bn_print(bp, "subgroup order:", x->q, NULL, indent))
  254. goto err;
  255. if (x->j && !ASN1_bn_print(bp, "subgroup factor:", x->j, NULL, indent))
  256. goto err;
  257. if (x->seed) {
  258. int i;
  259. BIO_indent(bp, indent, 128);
  260. BIO_puts(bp, "seed:");
  261. for (i = 0; i < x->seedlen; i++) {
  262. if ((i % 15) == 0) {
  263. if (BIO_puts(bp, "\n") <= 0
  264. || !BIO_indent(bp, indent + 4, 128))
  265. goto err;
  266. }
  267. if (BIO_printf(bp, "%02x%s", x->seed[i],
  268. ((i + 1) == x->seedlen) ? "" : ":") <= 0)
  269. goto err;
  270. }
  271. if (BIO_write(bp, "\n", 1) <= 0)
  272. return 0;
  273. }
  274. if (x->counter && !ASN1_bn_print(bp, "counter:", x->counter, NULL, indent))
  275. goto err;
  276. if (x->length != 0) {
  277. BIO_indent(bp, indent, 128);
  278. if (BIO_printf(bp, "recommended-private-length: %d bits\n",
  279. (int)x->length) <= 0)
  280. goto err;
  281. }
  282. return 1;
  283. err:
  284. DHerr(DH_F_DO_DH_PRINT, reason);
  285. return 0;
  286. }
  287. static int int_dh_size(const EVP_PKEY *pkey)
  288. {
  289. return DH_size(pkey->pkey.dh);
  290. }
  291. static int dh_bits(const EVP_PKEY *pkey)
  292. {
  293. return BN_num_bits(pkey->pkey.dh->p);
  294. }
  295. static int dh_security_bits(const EVP_PKEY *pkey)
  296. {
  297. return DH_security_bits(pkey->pkey.dh);
  298. }
  299. static int dh_cmp_parameters(const EVP_PKEY *a, const EVP_PKEY *b)
  300. {
  301. if (BN_cmp(a->pkey.dh->p, b->pkey.dh->p) ||
  302. BN_cmp(a->pkey.dh->g, b->pkey.dh->g))
  303. return 0;
  304. else if (a->ameth == &dhx_asn1_meth) {
  305. if (BN_cmp(a->pkey.dh->q, b->pkey.dh->q))
  306. return 0;
  307. }
  308. return 1;
  309. }
  310. static int int_dh_bn_cpy(BIGNUM **dst, const BIGNUM *src)
  311. {
  312. BIGNUM *a;
  313. /*
  314. * If source is read only just copy the pointer, so
  315. * we don't have to reallocate it.
  316. */
  317. if (src == NULL)
  318. a = NULL;
  319. else if (BN_get_flags(src, BN_FLG_STATIC_DATA)
  320. && !BN_get_flags(src, BN_FLG_MALLOCED))
  321. a = (BIGNUM *)src;
  322. else if ((a = BN_dup(src)) == NULL)
  323. return 0;
  324. BN_clear_free(*dst);
  325. *dst = a;
  326. return 1;
  327. }
  328. static int int_dh_param_copy(DH *to, const DH *from, int is_x942)
  329. {
  330. if (is_x942 == -1)
  331. is_x942 = ! !from->q;
  332. if (!int_dh_bn_cpy(&to->p, from->p))
  333. return 0;
  334. if (!int_dh_bn_cpy(&to->g, from->g))
  335. return 0;
  336. if (is_x942) {
  337. if (!int_dh_bn_cpy(&to->q, from->q))
  338. return 0;
  339. if (!int_dh_bn_cpy(&to->j, from->j))
  340. return 0;
  341. OPENSSL_free(to->seed);
  342. to->seed = NULL;
  343. to->seedlen = 0;
  344. if (from->seed) {
  345. to->seed = OPENSSL_memdup(from->seed, from->seedlen);
  346. if (!to->seed)
  347. return 0;
  348. to->seedlen = from->seedlen;
  349. }
  350. } else
  351. to->length = from->length;
  352. to->dirty_cnt++;
  353. return 1;
  354. }
  355. DH *DHparams_dup(const DH *dh)
  356. {
  357. DH *ret;
  358. ret = DH_new();
  359. if (ret == NULL)
  360. return NULL;
  361. if (!int_dh_param_copy(ret, dh, -1)) {
  362. DH_free(ret);
  363. return NULL;
  364. }
  365. return ret;
  366. }
  367. static int dh_copy_parameters(EVP_PKEY *to, const EVP_PKEY *from)
  368. {
  369. if (to->pkey.dh == NULL) {
  370. to->pkey.dh = DH_new();
  371. if (to->pkey.dh == NULL)
  372. return 0;
  373. }
  374. return int_dh_param_copy(to->pkey.dh, from->pkey.dh,
  375. from->ameth == &dhx_asn1_meth);
  376. }
  377. static int dh_missing_parameters(const EVP_PKEY *a)
  378. {
  379. if (a->pkey.dh == NULL || a->pkey.dh->p == NULL || a->pkey.dh->g == NULL)
  380. return 1;
  381. return 0;
  382. }
  383. static int dh_pub_cmp(const EVP_PKEY *a, const EVP_PKEY *b)
  384. {
  385. if (dh_cmp_parameters(a, b) == 0)
  386. return 0;
  387. if (BN_cmp(b->pkey.dh->pub_key, a->pkey.dh->pub_key) != 0)
  388. return 0;
  389. else
  390. return 1;
  391. }
  392. static int dh_param_print(BIO *bp, const EVP_PKEY *pkey, int indent,
  393. ASN1_PCTX *ctx)
  394. {
  395. return do_dh_print(bp, pkey->pkey.dh, indent, 0);
  396. }
  397. static int dh_public_print(BIO *bp, const EVP_PKEY *pkey, int indent,
  398. ASN1_PCTX *ctx)
  399. {
  400. return do_dh_print(bp, pkey->pkey.dh, indent, 1);
  401. }
  402. static int dh_private_print(BIO *bp, const EVP_PKEY *pkey, int indent,
  403. ASN1_PCTX *ctx)
  404. {
  405. return do_dh_print(bp, pkey->pkey.dh, indent, 2);
  406. }
  407. int DHparams_print(BIO *bp, const DH *x)
  408. {
  409. return do_dh_print(bp, x, 4, 0);
  410. }
  411. #ifndef OPENSSL_NO_CMS
  412. static int dh_cms_decrypt(CMS_RecipientInfo *ri);
  413. static int dh_cms_encrypt(CMS_RecipientInfo *ri);
  414. #endif
  415. static int dh_pkey_ctrl(EVP_PKEY *pkey, int op, long arg1, void *arg2)
  416. {
  417. switch (op) {
  418. case ASN1_PKEY_CTRL_SET1_TLS_ENCPT:
  419. return dh_buf2key(EVP_PKEY_get0_DH(pkey), arg2, arg1);
  420. case ASN1_PKEY_CTRL_GET1_TLS_ENCPT:
  421. return dh_key2buf(EVP_PKEY_get0_DH(pkey), arg2);
  422. default:
  423. return -2;
  424. }
  425. }
  426. static int dhx_pkey_ctrl(EVP_PKEY *pkey, int op, long arg1, void *arg2)
  427. {
  428. switch (op) {
  429. #ifndef OPENSSL_NO_CMS
  430. case ASN1_PKEY_CTRL_CMS_ENVELOPE:
  431. if (arg1 == 1)
  432. return dh_cms_decrypt(arg2);
  433. else if (arg1 == 0)
  434. return dh_cms_encrypt(arg2);
  435. return -2;
  436. case ASN1_PKEY_CTRL_CMS_RI_TYPE:
  437. *(int *)arg2 = CMS_RECIPINFO_AGREE;
  438. return 1;
  439. #endif
  440. default:
  441. return -2;
  442. }
  443. }
  444. static int dh_pkey_public_check(const EVP_PKEY *pkey)
  445. {
  446. DH *dh = pkey->pkey.dh;
  447. if (dh->pub_key == NULL) {
  448. DHerr(DH_F_DH_PKEY_PUBLIC_CHECK, DH_R_MISSING_PUBKEY);
  449. return 0;
  450. }
  451. return DH_check_pub_key_ex(dh, dh->pub_key);
  452. }
  453. static int dh_pkey_param_check(const EVP_PKEY *pkey)
  454. {
  455. DH *dh = pkey->pkey.dh;
  456. return DH_check_ex(dh);
  457. }
  458. static size_t dh_pkey_dirty_cnt(const EVP_PKEY *pkey)
  459. {
  460. return pkey->pkey.dh->dirty_cnt;
  461. }
  462. static void *dh_pkey_export_to(const EVP_PKEY *pk, EVP_KEYMGMT *keymgmt)
  463. {
  464. DH *dh = pk->pkey.dh;
  465. OSSL_PARAM_BLD tmpl;
  466. const BIGNUM *p = DH_get0_p(dh), *g = DH_get0_g(dh), *q = DH_get0_q(dh);
  467. const BIGNUM *pub_key = DH_get0_pub_key(dh);
  468. const BIGNUM *priv_key = DH_get0_priv_key(dh);
  469. OSSL_PARAM *params;
  470. void *provkey = NULL;
  471. if (p == NULL || g == NULL)
  472. return NULL;
  473. ossl_param_bld_init(&tmpl);
  474. if (!ossl_param_bld_push_BN(&tmpl, OSSL_PKEY_PARAM_FFC_P, p)
  475. || !ossl_param_bld_push_BN(&tmpl, OSSL_PKEY_PARAM_FFC_G, g))
  476. return NULL;
  477. if (q != NULL) {
  478. if (!ossl_param_bld_push_BN(&tmpl, OSSL_PKEY_PARAM_FFC_Q, q))
  479. return NULL;
  480. }
  481. /*
  482. * This may be used to pass domain parameters only without any key data -
  483. * so "pub_key" is optional. We can never have a "priv_key" without a
  484. * corresponding "pub_key" though.
  485. */
  486. if (pub_key != NULL) {
  487. if (!ossl_param_bld_push_BN(&tmpl, OSSL_PKEY_PARAM_DH_PUB_KEY, pub_key))
  488. return NULL;
  489. if (priv_key != NULL) {
  490. if (!ossl_param_bld_push_BN(&tmpl, OSSL_PKEY_PARAM_DH_PRIV_KEY,
  491. priv_key))
  492. return NULL;
  493. }
  494. }
  495. params = ossl_param_bld_to_param(&tmpl);
  496. /* We export, the provider imports */
  497. provkey = evp_keymgmt_importkey(keymgmt, params);
  498. ossl_param_bld_free(params);
  499. return provkey;
  500. }
  501. const EVP_PKEY_ASN1_METHOD dh_asn1_meth = {
  502. EVP_PKEY_DH,
  503. EVP_PKEY_DH,
  504. 0,
  505. "DH",
  506. "OpenSSL PKCS#3 DH method",
  507. dh_pub_decode,
  508. dh_pub_encode,
  509. dh_pub_cmp,
  510. dh_public_print,
  511. dh_priv_decode,
  512. dh_priv_encode,
  513. dh_private_print,
  514. int_dh_size,
  515. dh_bits,
  516. dh_security_bits,
  517. dh_param_decode,
  518. dh_param_encode,
  519. dh_missing_parameters,
  520. dh_copy_parameters,
  521. dh_cmp_parameters,
  522. dh_param_print,
  523. 0,
  524. int_dh_free,
  525. dh_pkey_ctrl,
  526. 0, 0, 0, 0, 0,
  527. 0,
  528. dh_pkey_public_check,
  529. dh_pkey_param_check,
  530. 0, 0, 0, 0,
  531. dh_pkey_dirty_cnt,
  532. dh_pkey_export_to,
  533. };
  534. const EVP_PKEY_ASN1_METHOD dhx_asn1_meth = {
  535. EVP_PKEY_DHX,
  536. EVP_PKEY_DHX,
  537. 0,
  538. "X9.42 DH",
  539. "OpenSSL X9.42 DH method",
  540. dh_pub_decode,
  541. dh_pub_encode,
  542. dh_pub_cmp,
  543. dh_public_print,
  544. dh_priv_decode,
  545. dh_priv_encode,
  546. dh_private_print,
  547. int_dh_size,
  548. dh_bits,
  549. dh_security_bits,
  550. dh_param_decode,
  551. dh_param_encode,
  552. dh_missing_parameters,
  553. dh_copy_parameters,
  554. dh_cmp_parameters,
  555. dh_param_print,
  556. 0,
  557. int_dh_free,
  558. dhx_pkey_ctrl,
  559. 0, 0, 0, 0, 0,
  560. 0,
  561. dh_pkey_public_check,
  562. dh_pkey_param_check
  563. };
  564. #ifndef OPENSSL_NO_CMS
  565. static int dh_cms_set_peerkey(EVP_PKEY_CTX *pctx,
  566. X509_ALGOR *alg, ASN1_BIT_STRING *pubkey)
  567. {
  568. const ASN1_OBJECT *aoid;
  569. int atype;
  570. const void *aval;
  571. ASN1_INTEGER *public_key = NULL;
  572. int rv = 0;
  573. EVP_PKEY *pkpeer = NULL, *pk = NULL;
  574. DH *dhpeer = NULL;
  575. const unsigned char *p;
  576. int plen;
  577. X509_ALGOR_get0(&aoid, &atype, &aval, alg);
  578. if (OBJ_obj2nid(aoid) != NID_dhpublicnumber)
  579. goto err;
  580. /* Only absent parameters allowed in RFC XXXX */
  581. if (atype != V_ASN1_UNDEF && atype == V_ASN1_NULL)
  582. goto err;
  583. pk = EVP_PKEY_CTX_get0_pkey(pctx);
  584. if (pk == NULL)
  585. goto err;
  586. if (pk->type != EVP_PKEY_DHX)
  587. goto err;
  588. /* Get parameters from parent key */
  589. dhpeer = DHparams_dup(pk->pkey.dh);
  590. /* We have parameters now set public key */
  591. plen = ASN1_STRING_length(pubkey);
  592. p = ASN1_STRING_get0_data(pubkey);
  593. if (p == NULL || plen == 0)
  594. goto err;
  595. if ((public_key = d2i_ASN1_INTEGER(NULL, &p, plen)) == NULL) {
  596. DHerr(DH_F_DH_CMS_SET_PEERKEY, DH_R_DECODE_ERROR);
  597. goto err;
  598. }
  599. /* We have parameters now set public key */
  600. if ((dhpeer->pub_key = ASN1_INTEGER_to_BN(public_key, NULL)) == NULL) {
  601. DHerr(DH_F_DH_CMS_SET_PEERKEY, DH_R_BN_DECODE_ERROR);
  602. goto err;
  603. }
  604. pkpeer = EVP_PKEY_new();
  605. if (pkpeer == NULL)
  606. goto err;
  607. EVP_PKEY_assign(pkpeer, pk->ameth->pkey_id, dhpeer);
  608. dhpeer = NULL;
  609. if (EVP_PKEY_derive_set_peer(pctx, pkpeer) > 0)
  610. rv = 1;
  611. err:
  612. ASN1_INTEGER_free(public_key);
  613. EVP_PKEY_free(pkpeer);
  614. DH_free(dhpeer);
  615. return rv;
  616. }
  617. static int dh_cms_set_shared_info(EVP_PKEY_CTX *pctx, CMS_RecipientInfo *ri)
  618. {
  619. int rv = 0;
  620. X509_ALGOR *alg, *kekalg = NULL;
  621. ASN1_OCTET_STRING *ukm;
  622. const unsigned char *p;
  623. unsigned char *dukm = NULL;
  624. size_t dukmlen = 0;
  625. int keylen, plen;
  626. const EVP_CIPHER *kekcipher;
  627. EVP_CIPHER_CTX *kekctx;
  628. if (!CMS_RecipientInfo_kari_get0_alg(ri, &alg, &ukm))
  629. goto err;
  630. /*
  631. * For DH we only have one OID permissible. If ever any more get defined
  632. * we will need something cleverer.
  633. */
  634. if (OBJ_obj2nid(alg->algorithm) != NID_id_smime_alg_ESDH) {
  635. DHerr(DH_F_DH_CMS_SET_SHARED_INFO, DH_R_KDF_PARAMETER_ERROR);
  636. goto err;
  637. }
  638. if (EVP_PKEY_CTX_set_dh_kdf_type(pctx, EVP_PKEY_DH_KDF_X9_42) <= 0)
  639. goto err;
  640. if (EVP_PKEY_CTX_set_dh_kdf_md(pctx, EVP_sha1()) <= 0)
  641. goto err;
  642. if (alg->parameter->type != V_ASN1_SEQUENCE)
  643. goto err;
  644. p = alg->parameter->value.sequence->data;
  645. plen = alg->parameter->value.sequence->length;
  646. kekalg = d2i_X509_ALGOR(NULL, &p, plen);
  647. if (!kekalg)
  648. goto err;
  649. kekctx = CMS_RecipientInfo_kari_get0_ctx(ri);
  650. if (!kekctx)
  651. goto err;
  652. kekcipher = EVP_get_cipherbyobj(kekalg->algorithm);
  653. if (!kekcipher || EVP_CIPHER_mode(kekcipher) != EVP_CIPH_WRAP_MODE)
  654. goto err;
  655. if (!EVP_EncryptInit_ex(kekctx, kekcipher, NULL, NULL, NULL))
  656. goto err;
  657. if (EVP_CIPHER_asn1_to_param(kekctx, kekalg->parameter) <= 0)
  658. goto err;
  659. keylen = EVP_CIPHER_CTX_key_length(kekctx);
  660. if (EVP_PKEY_CTX_set_dh_kdf_outlen(pctx, keylen) <= 0)
  661. goto err;
  662. /* Use OBJ_nid2obj to ensure we use built in OID that isn't freed */
  663. if (EVP_PKEY_CTX_set0_dh_kdf_oid(pctx,
  664. OBJ_nid2obj(EVP_CIPHER_type(kekcipher)))
  665. <= 0)
  666. goto err;
  667. if (ukm) {
  668. dukmlen = ASN1_STRING_length(ukm);
  669. dukm = OPENSSL_memdup(ASN1_STRING_get0_data(ukm), dukmlen);
  670. if (!dukm)
  671. goto err;
  672. }
  673. if (EVP_PKEY_CTX_set0_dh_kdf_ukm(pctx, dukm, dukmlen) <= 0)
  674. goto err;
  675. dukm = NULL;
  676. rv = 1;
  677. err:
  678. X509_ALGOR_free(kekalg);
  679. OPENSSL_free(dukm);
  680. return rv;
  681. }
  682. static int dh_cms_decrypt(CMS_RecipientInfo *ri)
  683. {
  684. EVP_PKEY_CTX *pctx;
  685. pctx = CMS_RecipientInfo_get0_pkey_ctx(ri);
  686. if (pctx == NULL)
  687. return 0;
  688. /* See if we need to set peer key */
  689. if (!EVP_PKEY_CTX_get0_peerkey(pctx)) {
  690. X509_ALGOR *alg;
  691. ASN1_BIT_STRING *pubkey;
  692. if (!CMS_RecipientInfo_kari_get0_orig_id(ri, &alg, &pubkey,
  693. NULL, NULL, NULL))
  694. return 0;
  695. if (!alg || !pubkey)
  696. return 0;
  697. if (!dh_cms_set_peerkey(pctx, alg, pubkey)) {
  698. DHerr(DH_F_DH_CMS_DECRYPT, DH_R_PEER_KEY_ERROR);
  699. return 0;
  700. }
  701. }
  702. /* Set DH derivation parameters and initialise unwrap context */
  703. if (!dh_cms_set_shared_info(pctx, ri)) {
  704. DHerr(DH_F_DH_CMS_DECRYPT, DH_R_SHARED_INFO_ERROR);
  705. return 0;
  706. }
  707. return 1;
  708. }
  709. static int dh_cms_encrypt(CMS_RecipientInfo *ri)
  710. {
  711. EVP_PKEY_CTX *pctx;
  712. EVP_PKEY *pkey;
  713. EVP_CIPHER_CTX *ctx;
  714. int keylen;
  715. X509_ALGOR *talg, *wrap_alg = NULL;
  716. const ASN1_OBJECT *aoid;
  717. ASN1_BIT_STRING *pubkey;
  718. ASN1_STRING *wrap_str;
  719. ASN1_OCTET_STRING *ukm;
  720. unsigned char *penc = NULL, *dukm = NULL;
  721. int penclen;
  722. size_t dukmlen = 0;
  723. int rv = 0;
  724. int kdf_type, wrap_nid;
  725. const EVP_MD *kdf_md;
  726. pctx = CMS_RecipientInfo_get0_pkey_ctx(ri);
  727. if (pctx == NULL)
  728. return 0;
  729. /* Get ephemeral key */
  730. pkey = EVP_PKEY_CTX_get0_pkey(pctx);
  731. if (!CMS_RecipientInfo_kari_get0_orig_id(ri, &talg, &pubkey,
  732. NULL, NULL, NULL))
  733. goto err;
  734. X509_ALGOR_get0(&aoid, NULL, NULL, talg);
  735. /* Is everything uninitialised? */
  736. if (aoid == OBJ_nid2obj(NID_undef)) {
  737. ASN1_INTEGER *pubk = BN_to_ASN1_INTEGER(pkey->pkey.dh->pub_key, NULL);
  738. if (pubk == NULL)
  739. goto err;
  740. /* Set the key */
  741. penclen = i2d_ASN1_INTEGER(pubk, &penc);
  742. ASN1_INTEGER_free(pubk);
  743. if (penclen <= 0)
  744. goto err;
  745. ASN1_STRING_set0(pubkey, penc, penclen);
  746. pubkey->flags &= ~(ASN1_STRING_FLAG_BITS_LEFT | 0x07);
  747. pubkey->flags |= ASN1_STRING_FLAG_BITS_LEFT;
  748. penc = NULL;
  749. X509_ALGOR_set0(talg, OBJ_nid2obj(NID_dhpublicnumber),
  750. V_ASN1_UNDEF, NULL);
  751. }
  752. /* See if custom parameters set */
  753. kdf_type = EVP_PKEY_CTX_get_dh_kdf_type(pctx);
  754. if (kdf_type <= 0)
  755. goto err;
  756. if (!EVP_PKEY_CTX_get_dh_kdf_md(pctx, &kdf_md))
  757. goto err;
  758. if (kdf_type == EVP_PKEY_DH_KDF_NONE) {
  759. kdf_type = EVP_PKEY_DH_KDF_X9_42;
  760. if (EVP_PKEY_CTX_set_dh_kdf_type(pctx, kdf_type) <= 0)
  761. goto err;
  762. } else if (kdf_type != EVP_PKEY_DH_KDF_X9_42)
  763. /* Unknown KDF */
  764. goto err;
  765. if (kdf_md == NULL) {
  766. /* Only SHA1 supported */
  767. kdf_md = EVP_sha1();
  768. if (EVP_PKEY_CTX_set_dh_kdf_md(pctx, kdf_md) <= 0)
  769. goto err;
  770. } else if (EVP_MD_type(kdf_md) != NID_sha1)
  771. /* Unsupported digest */
  772. goto err;
  773. if (!CMS_RecipientInfo_kari_get0_alg(ri, &talg, &ukm))
  774. goto err;
  775. /* Get wrap NID */
  776. ctx = CMS_RecipientInfo_kari_get0_ctx(ri);
  777. wrap_nid = EVP_CIPHER_CTX_type(ctx);
  778. if (EVP_PKEY_CTX_set0_dh_kdf_oid(pctx, OBJ_nid2obj(wrap_nid)) <= 0)
  779. goto err;
  780. keylen = EVP_CIPHER_CTX_key_length(ctx);
  781. /* Package wrap algorithm in an AlgorithmIdentifier */
  782. wrap_alg = X509_ALGOR_new();
  783. if (wrap_alg == NULL)
  784. goto err;
  785. wrap_alg->algorithm = OBJ_nid2obj(wrap_nid);
  786. wrap_alg->parameter = ASN1_TYPE_new();
  787. if (wrap_alg->parameter == NULL)
  788. goto err;
  789. if (EVP_CIPHER_param_to_asn1(ctx, wrap_alg->parameter) <= 0)
  790. goto err;
  791. if (ASN1_TYPE_get(wrap_alg->parameter) == NID_undef) {
  792. ASN1_TYPE_free(wrap_alg->parameter);
  793. wrap_alg->parameter = NULL;
  794. }
  795. if (EVP_PKEY_CTX_set_dh_kdf_outlen(pctx, keylen) <= 0)
  796. goto err;
  797. if (ukm) {
  798. dukmlen = ASN1_STRING_length(ukm);
  799. dukm = OPENSSL_memdup(ASN1_STRING_get0_data(ukm), dukmlen);
  800. if (!dukm)
  801. goto err;
  802. }
  803. if (EVP_PKEY_CTX_set0_dh_kdf_ukm(pctx, dukm, dukmlen) <= 0)
  804. goto err;
  805. dukm = NULL;
  806. /*
  807. * Now need to wrap encoding of wrap AlgorithmIdentifier into parameter
  808. * of another AlgorithmIdentifier.
  809. */
  810. penc = NULL;
  811. penclen = i2d_X509_ALGOR(wrap_alg, &penc);
  812. if (penc == NULL || penclen == 0)
  813. goto err;
  814. wrap_str = ASN1_STRING_new();
  815. if (wrap_str == NULL)
  816. goto err;
  817. ASN1_STRING_set0(wrap_str, penc, penclen);
  818. penc = NULL;
  819. X509_ALGOR_set0(talg, OBJ_nid2obj(NID_id_smime_alg_ESDH),
  820. V_ASN1_SEQUENCE, wrap_str);
  821. rv = 1;
  822. err:
  823. OPENSSL_free(penc);
  824. X509_ALGOR_free(wrap_alg);
  825. return rv;
  826. }
  827. #endif