pkcs8.c 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436
  1. /* pkcs8.c */
  2. /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  3. * project 1999-2004.
  4. */
  5. /* ====================================================================
  6. * Copyright (c) 1999 The OpenSSL Project. All rights reserved.
  7. *
  8. * Redistribution and use in source and binary forms, with or without
  9. * modification, are permitted provided that the following conditions
  10. * are met:
  11. *
  12. * 1. Redistributions of source code must retain the above copyright
  13. * notice, this list of conditions and the following disclaimer.
  14. *
  15. * 2. Redistributions in binary form must reproduce the above copyright
  16. * notice, this list of conditions and the following disclaimer in
  17. * the documentation and/or other materials provided with the
  18. * distribution.
  19. *
  20. * 3. All advertising materials mentioning features or use of this
  21. * software must display the following acknowledgment:
  22. * "This product includes software developed by the OpenSSL Project
  23. * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
  24. *
  25. * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  26. * endorse or promote products derived from this software without
  27. * prior written permission. For written permission, please contact
  28. * licensing@OpenSSL.org.
  29. *
  30. * 5. Products derived from this software may not be called "OpenSSL"
  31. * nor may "OpenSSL" appear in their names without prior written
  32. * permission of the OpenSSL Project.
  33. *
  34. * 6. Redistributions of any form whatsoever must retain the following
  35. * acknowledgment:
  36. * "This product includes software developed by the OpenSSL Project
  37. * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
  38. *
  39. * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  40. * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  41. * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  42. * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
  43. * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  44. * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  45. * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  46. * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  47. * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  48. * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  49. * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
  50. * OF THE POSSIBILITY OF SUCH DAMAGE.
  51. * ====================================================================
  52. *
  53. * This product includes cryptographic software written by Eric Young
  54. * (eay@cryptsoft.com). This product includes software written by Tim
  55. * Hudson (tjh@cryptsoft.com).
  56. *
  57. */
  58. #include <stdio.h>
  59. #include <string.h>
  60. #include "apps.h"
  61. #include <openssl/pem.h>
  62. #include <openssl/err.h>
  63. #include <openssl/evp.h>
  64. #include <openssl/pkcs12.h>
  65. #define PROG pkcs8_main
  66. int MAIN(int, char **);
  67. int MAIN(int argc, char **argv)
  68. {
  69. ENGINE *e = NULL;
  70. char **args, *infile = NULL, *outfile = NULL;
  71. char *passargin = NULL, *passargout = NULL;
  72. BIO *in = NULL, *out = NULL;
  73. int topk8 = 0;
  74. int pbe_nid = -1;
  75. const EVP_CIPHER *cipher = NULL;
  76. int iter = PKCS12_DEFAULT_ITER;
  77. int informat, outformat;
  78. int p8_broken = PKCS8_OK;
  79. int nocrypt = 0;
  80. X509_SIG *p8 = NULL;
  81. PKCS8_PRIV_KEY_INFO *p8inf = NULL;
  82. EVP_PKEY *pkey=NULL;
  83. char pass[50], *passin = NULL, *passout = NULL, *p8pass = NULL;
  84. int badarg = 0;
  85. int ret = 1;
  86. #ifndef OPENSSL_NO_ENGINE
  87. char *engine=NULL;
  88. #endif
  89. if (bio_err == NULL) bio_err = BIO_new_fp (stderr, BIO_NOCLOSE);
  90. if (!load_config(bio_err, NULL))
  91. goto end;
  92. informat=FORMAT_PEM;
  93. outformat=FORMAT_PEM;
  94. ERR_load_crypto_strings();
  95. OpenSSL_add_all_algorithms();
  96. args = argv + 1;
  97. while (!badarg && *args && *args[0] == '-')
  98. {
  99. if (!strcmp(*args,"-v2"))
  100. {
  101. if (args[1])
  102. {
  103. args++;
  104. cipher=EVP_get_cipherbyname(*args);
  105. if (!cipher)
  106. {
  107. BIO_printf(bio_err,
  108. "Unknown cipher %s\n", *args);
  109. badarg = 1;
  110. }
  111. }
  112. else
  113. badarg = 1;
  114. }
  115. else if (!strcmp(*args,"-v1"))
  116. {
  117. if (args[1])
  118. {
  119. args++;
  120. pbe_nid=OBJ_txt2nid(*args);
  121. if (pbe_nid == NID_undef)
  122. {
  123. BIO_printf(bio_err,
  124. "Unknown PBE algorithm %s\n", *args);
  125. badarg = 1;
  126. }
  127. }
  128. else
  129. badarg = 1;
  130. }
  131. else if (!strcmp(*args,"-inform"))
  132. {
  133. if (args[1])
  134. {
  135. args++;
  136. informat=str2fmt(*args);
  137. }
  138. else badarg = 1;
  139. }
  140. else if (!strcmp(*args,"-outform"))
  141. {
  142. if (args[1])
  143. {
  144. args++;
  145. outformat=str2fmt(*args);
  146. }
  147. else badarg = 1;
  148. }
  149. else if (!strcmp (*args, "-topk8"))
  150. topk8 = 1;
  151. else if (!strcmp (*args, "-noiter"))
  152. iter = 1;
  153. else if (!strcmp (*args, "-nocrypt"))
  154. nocrypt = 1;
  155. else if (!strcmp (*args, "-nooct"))
  156. p8_broken = PKCS8_NO_OCTET;
  157. else if (!strcmp (*args, "-nsdb"))
  158. p8_broken = PKCS8_NS_DB;
  159. else if (!strcmp (*args, "-embed"))
  160. p8_broken = PKCS8_EMBEDDED_PARAM;
  161. else if (!strcmp(*args,"-passin"))
  162. {
  163. if (!args[1]) goto bad;
  164. passargin= *(++args);
  165. }
  166. else if (!strcmp(*args,"-passout"))
  167. {
  168. if (!args[1]) goto bad;
  169. passargout= *(++args);
  170. }
  171. #ifndef OPENSSL_NO_ENGINE
  172. else if (strcmp(*args,"-engine") == 0)
  173. {
  174. if (!args[1]) goto bad;
  175. engine= *(++args);
  176. }
  177. #endif
  178. else if (!strcmp (*args, "-in"))
  179. {
  180. if (args[1])
  181. {
  182. args++;
  183. infile = *args;
  184. }
  185. else badarg = 1;
  186. }
  187. else if (!strcmp (*args, "-out"))
  188. {
  189. if (args[1])
  190. {
  191. args++;
  192. outfile = *args;
  193. }
  194. else badarg = 1;
  195. }
  196. else badarg = 1;
  197. args++;
  198. }
  199. if (badarg)
  200. {
  201. bad:
  202. BIO_printf(bio_err, "Usage pkcs8 [options]\n");
  203. BIO_printf(bio_err, "where options are\n");
  204. BIO_printf(bio_err, "-in file input file\n");
  205. BIO_printf(bio_err, "-inform X input format (DER or PEM)\n");
  206. BIO_printf(bio_err, "-passin arg input file pass phrase source\n");
  207. BIO_printf(bio_err, "-outform X output format (DER or PEM)\n");
  208. BIO_printf(bio_err, "-out file output file\n");
  209. BIO_printf(bio_err, "-passout arg output file pass phrase source\n");
  210. BIO_printf(bio_err, "-topk8 output PKCS8 file\n");
  211. BIO_printf(bio_err, "-nooct use (nonstandard) no octet format\n");
  212. BIO_printf(bio_err, "-embed use (nonstandard) embedded DSA parameters format\n");
  213. BIO_printf(bio_err, "-nsdb use (nonstandard) DSA Netscape DB format\n");
  214. BIO_printf(bio_err, "-noiter use 1 as iteration count\n");
  215. BIO_printf(bio_err, "-nocrypt use or expect unencrypted private key\n");
  216. BIO_printf(bio_err, "-v2 alg use PKCS#5 v2.0 and cipher \"alg\"\n");
  217. BIO_printf(bio_err, "-v1 obj use PKCS#5 v1.5 and cipher \"alg\"\n");
  218. #ifndef OPENSSL_NO_ENGINE
  219. BIO_printf(bio_err," -engine e use engine e, possibly a hardware device.\n");
  220. #endif
  221. goto end;
  222. }
  223. #ifndef OPENSSL_NO_ENGINE
  224. e = setup_engine(bio_err, engine, 0);
  225. #endif
  226. if (!app_passwd(bio_err, passargin, passargout, &passin, &passout))
  227. {
  228. BIO_printf(bio_err, "Error getting passwords\n");
  229. goto end;
  230. }
  231. if ((pbe_nid == -1) && !cipher)
  232. pbe_nid = NID_pbeWithMD5AndDES_CBC;
  233. if (infile)
  234. {
  235. if (!(in = BIO_new_file(infile, "rb")))
  236. {
  237. BIO_printf(bio_err,
  238. "Can't open input file %s\n", infile);
  239. goto end;
  240. }
  241. }
  242. else
  243. in = BIO_new_fp (stdin, BIO_NOCLOSE);
  244. if (outfile)
  245. {
  246. if (!(out = BIO_new_file (outfile, "wb")))
  247. {
  248. BIO_printf(bio_err,
  249. "Can't open output file %s\n", outfile);
  250. goto end;
  251. }
  252. }
  253. else
  254. {
  255. out = BIO_new_fp (stdout, BIO_NOCLOSE);
  256. #ifdef OPENSSL_SYS_VMS
  257. {
  258. BIO *tmpbio = BIO_new(BIO_f_linebuffer());
  259. out = BIO_push(tmpbio, out);
  260. }
  261. #endif
  262. }
  263. if (topk8)
  264. {
  265. BIO_free(in); /* Not needed in this section */
  266. pkey = load_key(bio_err, infile, informat, 1,
  267. passin, e, "key");
  268. if (!pkey)
  269. goto end;
  270. if (!(p8inf = EVP_PKEY2PKCS8_broken(pkey, p8_broken)))
  271. {
  272. BIO_printf(bio_err, "Error converting key\n");
  273. ERR_print_errors(bio_err);
  274. goto end;
  275. }
  276. if (nocrypt)
  277. {
  278. if (outformat == FORMAT_PEM)
  279. PEM_write_bio_PKCS8_PRIV_KEY_INFO(out, p8inf);
  280. else if (outformat == FORMAT_ASN1)
  281. i2d_PKCS8_PRIV_KEY_INFO_bio(out, p8inf);
  282. else
  283. {
  284. BIO_printf(bio_err, "Bad format specified for key\n");
  285. goto end;
  286. }
  287. }
  288. else
  289. {
  290. if (passout)
  291. p8pass = passout;
  292. else
  293. {
  294. p8pass = pass;
  295. if (EVP_read_pw_string(pass, sizeof pass, "Enter Encryption Password:", 1))
  296. goto end;
  297. }
  298. app_RAND_load_file(NULL, bio_err, 0);
  299. if (!(p8 = PKCS8_encrypt(pbe_nid, cipher,
  300. p8pass, strlen(p8pass),
  301. NULL, 0, iter, p8inf)))
  302. {
  303. BIO_printf(bio_err, "Error encrypting key\n");
  304. ERR_print_errors(bio_err);
  305. goto end;
  306. }
  307. app_RAND_write_file(NULL, bio_err);
  308. if (outformat == FORMAT_PEM)
  309. PEM_write_bio_PKCS8(out, p8);
  310. else if (outformat == FORMAT_ASN1)
  311. i2d_PKCS8_bio(out, p8);
  312. else
  313. {
  314. BIO_printf(bio_err, "Bad format specified for key\n");
  315. goto end;
  316. }
  317. }
  318. ret = 0;
  319. goto end;
  320. }
  321. if (nocrypt)
  322. {
  323. if (informat == FORMAT_PEM)
  324. p8inf = PEM_read_bio_PKCS8_PRIV_KEY_INFO(in,NULL,NULL, NULL);
  325. else if (informat == FORMAT_ASN1)
  326. p8inf = d2i_PKCS8_PRIV_KEY_INFO_bio(in, NULL);
  327. else
  328. {
  329. BIO_printf(bio_err, "Bad format specified for key\n");
  330. goto end;
  331. }
  332. }
  333. else
  334. {
  335. if (informat == FORMAT_PEM)
  336. p8 = PEM_read_bio_PKCS8(in, NULL, NULL, NULL);
  337. else if (informat == FORMAT_ASN1)
  338. p8 = d2i_PKCS8_bio(in, NULL);
  339. else
  340. {
  341. BIO_printf(bio_err, "Bad format specified for key\n");
  342. goto end;
  343. }
  344. if (!p8)
  345. {
  346. BIO_printf (bio_err, "Error reading key\n");
  347. ERR_print_errors(bio_err);
  348. goto end;
  349. }
  350. if (passin)
  351. p8pass = passin;
  352. else
  353. {
  354. p8pass = pass;
  355. EVP_read_pw_string(pass, sizeof pass, "Enter Password:", 0);
  356. }
  357. p8inf = PKCS8_decrypt(p8, p8pass, strlen(p8pass));
  358. }
  359. if (!p8inf)
  360. {
  361. BIO_printf(bio_err, "Error decrypting key\n");
  362. ERR_print_errors(bio_err);
  363. goto end;
  364. }
  365. if (!(pkey = EVP_PKCS82PKEY(p8inf)))
  366. {
  367. BIO_printf(bio_err, "Error converting key\n");
  368. ERR_print_errors(bio_err);
  369. goto end;
  370. }
  371. if (p8inf->broken)
  372. {
  373. BIO_printf(bio_err, "Warning: broken key encoding: ");
  374. switch (p8inf->broken)
  375. {
  376. case PKCS8_NO_OCTET:
  377. BIO_printf(bio_err, "No Octet String in PrivateKey\n");
  378. break;
  379. case PKCS8_EMBEDDED_PARAM:
  380. BIO_printf(bio_err, "DSA parameters included in PrivateKey\n");
  381. break;
  382. case PKCS8_NS_DB:
  383. BIO_printf(bio_err, "DSA public key include in PrivateKey\n");
  384. break;
  385. default:
  386. BIO_printf(bio_err, "Unknown broken type\n");
  387. break;
  388. }
  389. }
  390. if (outformat == FORMAT_PEM)
  391. PEM_write_bio_PrivateKey(out, pkey, NULL, NULL, 0, NULL, passout);
  392. else if (outformat == FORMAT_ASN1)
  393. i2d_PrivateKey_bio(out, pkey);
  394. else
  395. {
  396. BIO_printf(bio_err, "Bad format specified for key\n");
  397. goto end;
  398. }
  399. ret = 0;
  400. end:
  401. X509_SIG_free(p8);
  402. PKCS8_PRIV_KEY_INFO_free(p8inf);
  403. EVP_PKEY_free(pkey);
  404. BIO_free_all(out);
  405. BIO_free(in);
  406. if (passin)
  407. OPENSSL_free(passin);
  408. if (passout)
  409. OPENSSL_free(passout);
  410. return ret;
  411. }