123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213 |
- /*
- * Copyright 2008-2018 The OpenSSL Project Authors. All Rights Reserved.
- *
- * Licensed under the Apache License 2.0 (the "License"). You may not use
- * this file except in compliance with the License. You can obtain a copy
- * in the file LICENSE in the source distribution or at
- * https://www.openssl.org/source/license.html
- */
- #include "internal/cryptlib.h"
- #include <openssl/asn1t.h>
- #include <openssl/pem.h>
- #include <openssl/x509v3.h>
- #include <openssl/err.h>
- #include <openssl/cms.h>
- #include <openssl/rand.h>
- #include "cms_lcl.h"
- /* CMS EncryptedData Utilities */
- /* Return BIO based on EncryptedContentInfo and key */
- BIO *cms_EncryptedContent_init_bio(CMS_EncryptedContentInfo *ec)
- {
- BIO *b;
- EVP_CIPHER_CTX *ctx;
- const EVP_CIPHER *ciph;
- X509_ALGOR *calg = ec->contentEncryptionAlgorithm;
- unsigned char iv[EVP_MAX_IV_LENGTH], *piv = NULL;
- unsigned char *tkey = NULL;
- size_t tkeylen = 0;
- int ok = 0;
- int enc, keep_key = 0;
- enc = ec->cipher ? 1 : 0;
- b = BIO_new(BIO_f_cipher());
- if (b == NULL) {
- CMSerr(CMS_F_CMS_ENCRYPTEDCONTENT_INIT_BIO, ERR_R_MALLOC_FAILURE);
- return NULL;
- }
- BIO_get_cipher_ctx(b, &ctx);
- if (enc) {
- ciph = ec->cipher;
- /*
- * If not keeping key set cipher to NULL so subsequent calls decrypt.
- */
- if (ec->key)
- ec->cipher = NULL;
- } else {
- ciph = EVP_get_cipherbyobj(calg->algorithm);
- if (!ciph) {
- CMSerr(CMS_F_CMS_ENCRYPTEDCONTENT_INIT_BIO, CMS_R_UNKNOWN_CIPHER);
- goto err;
- }
- }
- if (EVP_CipherInit_ex(ctx, ciph, NULL, NULL, NULL, enc) <= 0) {
- CMSerr(CMS_F_CMS_ENCRYPTEDCONTENT_INIT_BIO,
- CMS_R_CIPHER_INITIALISATION_ERROR);
- goto err;
- }
- if (enc) {
- int ivlen;
- calg->algorithm = OBJ_nid2obj(EVP_CIPHER_CTX_type(ctx));
- /* Generate a random IV if we need one */
- ivlen = EVP_CIPHER_CTX_iv_length(ctx);
- if (ivlen > 0) {
- if (RAND_bytes(iv, ivlen) <= 0)
- goto err;
- piv = iv;
- }
- } else if (EVP_CIPHER_asn1_to_param(ctx, calg->parameter) <= 0) {
- CMSerr(CMS_F_CMS_ENCRYPTEDCONTENT_INIT_BIO,
- CMS_R_CIPHER_PARAMETER_INITIALISATION_ERROR);
- goto err;
- }
- tkeylen = EVP_CIPHER_CTX_key_length(ctx);
- /* Generate random session key */
- if (!enc || !ec->key) {
- tkey = OPENSSL_malloc(tkeylen);
- if (tkey == NULL) {
- CMSerr(CMS_F_CMS_ENCRYPTEDCONTENT_INIT_BIO, ERR_R_MALLOC_FAILURE);
- goto err;
- }
- if (EVP_CIPHER_CTX_rand_key(ctx, tkey) <= 0)
- goto err;
- }
- if (!ec->key) {
- ec->key = tkey;
- ec->keylen = tkeylen;
- tkey = NULL;
- if (enc)
- keep_key = 1;
- else
- ERR_clear_error();
- }
- if (ec->keylen != tkeylen) {
- /* If necessary set key length */
- if (EVP_CIPHER_CTX_set_key_length(ctx, ec->keylen) <= 0) {
- /*
- * Only reveal failure if debugging so we don't leak information
- * which may be useful in MMA.
- */
- if (enc || ec->debug) {
- CMSerr(CMS_F_CMS_ENCRYPTEDCONTENT_INIT_BIO,
- CMS_R_INVALID_KEY_LENGTH);
- goto err;
- } else {
- /* Use random key */
- OPENSSL_clear_free(ec->key, ec->keylen);
- ec->key = tkey;
- ec->keylen = tkeylen;
- tkey = NULL;
- ERR_clear_error();
- }
- }
- }
- if (EVP_CipherInit_ex(ctx, NULL, NULL, ec->key, piv, enc) <= 0) {
- CMSerr(CMS_F_CMS_ENCRYPTEDCONTENT_INIT_BIO,
- CMS_R_CIPHER_INITIALISATION_ERROR);
- goto err;
- }
- if (enc) {
- calg->parameter = ASN1_TYPE_new();
- if (calg->parameter == NULL) {
- CMSerr(CMS_F_CMS_ENCRYPTEDCONTENT_INIT_BIO, ERR_R_MALLOC_FAILURE);
- goto err;
- }
- if (EVP_CIPHER_param_to_asn1(ctx, calg->parameter) <= 0) {
- CMSerr(CMS_F_CMS_ENCRYPTEDCONTENT_INIT_BIO,
- CMS_R_CIPHER_PARAMETER_INITIALISATION_ERROR);
- goto err;
- }
- /* If parameter type not set omit parameter */
- if (calg->parameter->type == V_ASN1_UNDEF) {
- ASN1_TYPE_free(calg->parameter);
- calg->parameter = NULL;
- }
- }
- ok = 1;
- err:
- if (!keep_key || !ok) {
- OPENSSL_clear_free(ec->key, ec->keylen);
- ec->key = NULL;
- }
- OPENSSL_clear_free(tkey, tkeylen);
- if (ok)
- return b;
- BIO_free(b);
- return NULL;
- }
- int cms_EncryptedContent_init(CMS_EncryptedContentInfo *ec,
- const EVP_CIPHER *cipher,
- const unsigned char *key, size_t keylen)
- {
- ec->cipher = cipher;
- if (key) {
- if ((ec->key = OPENSSL_malloc(keylen)) == NULL) {
- CMSerr(CMS_F_CMS_ENCRYPTEDCONTENT_INIT, ERR_R_MALLOC_FAILURE);
- return 0;
- }
- memcpy(ec->key, key, keylen);
- }
- ec->keylen = keylen;
- if (cipher)
- ec->contentType = OBJ_nid2obj(NID_pkcs7_data);
- return 1;
- }
- int CMS_EncryptedData_set1_key(CMS_ContentInfo *cms, const EVP_CIPHER *ciph,
- const unsigned char *key, size_t keylen)
- {
- CMS_EncryptedContentInfo *ec;
- if (!key || !keylen) {
- CMSerr(CMS_F_CMS_ENCRYPTEDDATA_SET1_KEY, CMS_R_NO_KEY);
- return 0;
- }
- if (ciph) {
- cms->d.encryptedData = M_ASN1_new_of(CMS_EncryptedData);
- if (!cms->d.encryptedData) {
- CMSerr(CMS_F_CMS_ENCRYPTEDDATA_SET1_KEY, ERR_R_MALLOC_FAILURE);
- return 0;
- }
- cms->contentType = OBJ_nid2obj(NID_pkcs7_encrypted);
- cms->d.encryptedData->version = 0;
- } else if (OBJ_obj2nid(cms->contentType) != NID_pkcs7_encrypted) {
- CMSerr(CMS_F_CMS_ENCRYPTEDDATA_SET1_KEY, CMS_R_NOT_ENCRYPTED_DATA);
- return 0;
- }
- ec = cms->d.encryptedData->encryptedContentInfo;
- return cms_EncryptedContent_init(ec, ciph, key, keylen);
- }
- BIO *cms_EncryptedData_init_bio(CMS_ContentInfo *cms)
- {
- CMS_EncryptedData *enc = cms->d.encryptedData;
- if (enc->encryptedContentInfo->cipher && enc->unprotectedAttrs)
- enc->version = 2;
- return cms_EncryptedContent_init_bio(enc->encryptedContentInfo);
- }
|