2
0

dh_ameth.c 22 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907
  1. /*
  2. * Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the OpenSSL license (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #include <stdio.h>
  10. #include "internal/cryptlib.h"
  11. #include <openssl/x509.h>
  12. #include <openssl/asn1.h>
  13. #include "dh_locl.h"
  14. #include <openssl/bn.h>
  15. #include "internal/asn1_int.h"
  16. #include "internal/evp_int.h"
  17. #include <openssl/cms.h>
  18. /*
  19. * i2d/d2i like DH parameter functions which use the appropriate routine for
  20. * PKCS#3 DH or X9.42 DH.
  21. */
  22. static DH *d2i_dhp(const EVP_PKEY *pkey, const unsigned char **pp,
  23. long length)
  24. {
  25. if (pkey->ameth == &dhx_asn1_meth)
  26. return d2i_DHxparams(NULL, pp, length);
  27. return d2i_DHparams(NULL, pp, length);
  28. }
  29. static int i2d_dhp(const EVP_PKEY *pkey, const DH *a, unsigned char **pp)
  30. {
  31. if (pkey->ameth == &dhx_asn1_meth)
  32. return i2d_DHxparams(a, pp);
  33. return i2d_DHparams(a, pp);
  34. }
  35. static void int_dh_free(EVP_PKEY *pkey)
  36. {
  37. DH_free(pkey->pkey.dh);
  38. }
  39. static int dh_pub_decode(EVP_PKEY *pkey, X509_PUBKEY *pubkey)
  40. {
  41. const unsigned char *p, *pm;
  42. int pklen, pmlen;
  43. int ptype;
  44. const void *pval;
  45. const ASN1_STRING *pstr;
  46. X509_ALGOR *palg;
  47. ASN1_INTEGER *public_key = NULL;
  48. DH *dh = NULL;
  49. if (!X509_PUBKEY_get0_param(NULL, &p, &pklen, &palg, pubkey))
  50. return 0;
  51. X509_ALGOR_get0(NULL, &ptype, &pval, palg);
  52. if (ptype != V_ASN1_SEQUENCE) {
  53. DHerr(DH_F_DH_PUB_DECODE, DH_R_PARAMETER_ENCODING_ERROR);
  54. goto err;
  55. }
  56. pstr = pval;
  57. pm = pstr->data;
  58. pmlen = pstr->length;
  59. if ((dh = d2i_dhp(pkey, &pm, pmlen)) == NULL) {
  60. DHerr(DH_F_DH_PUB_DECODE, DH_R_DECODE_ERROR);
  61. goto err;
  62. }
  63. if ((public_key = d2i_ASN1_INTEGER(NULL, &p, pklen)) == NULL) {
  64. DHerr(DH_F_DH_PUB_DECODE, DH_R_DECODE_ERROR);
  65. goto err;
  66. }
  67. /* We have parameters now set public key */
  68. if ((dh->pub_key = ASN1_INTEGER_to_BN(public_key, NULL)) == NULL) {
  69. DHerr(DH_F_DH_PUB_DECODE, DH_R_BN_DECODE_ERROR);
  70. goto err;
  71. }
  72. ASN1_INTEGER_free(public_key);
  73. EVP_PKEY_assign(pkey, pkey->ameth->pkey_id, dh);
  74. return 1;
  75. err:
  76. ASN1_INTEGER_free(public_key);
  77. DH_free(dh);
  78. return 0;
  79. }
  80. static int dh_pub_encode(X509_PUBKEY *pk, const EVP_PKEY *pkey)
  81. {
  82. DH *dh;
  83. int ptype;
  84. unsigned char *penc = NULL;
  85. int penclen;
  86. ASN1_STRING *str;
  87. ASN1_INTEGER *pub_key = NULL;
  88. dh = pkey->pkey.dh;
  89. str = ASN1_STRING_new();
  90. if (str == NULL) {
  91. DHerr(DH_F_DH_PUB_ENCODE, ERR_R_MALLOC_FAILURE);
  92. goto err;
  93. }
  94. str->length = i2d_dhp(pkey, dh, &str->data);
  95. if (str->length <= 0) {
  96. DHerr(DH_F_DH_PUB_ENCODE, ERR_R_MALLOC_FAILURE);
  97. goto err;
  98. }
  99. ptype = V_ASN1_SEQUENCE;
  100. pub_key = BN_to_ASN1_INTEGER(dh->pub_key, NULL);
  101. if (!pub_key)
  102. goto err;
  103. penclen = i2d_ASN1_INTEGER(pub_key, &penc);
  104. ASN1_INTEGER_free(pub_key);
  105. if (penclen <= 0) {
  106. DHerr(DH_F_DH_PUB_ENCODE, ERR_R_MALLOC_FAILURE);
  107. goto err;
  108. }
  109. if (X509_PUBKEY_set0_param(pk, OBJ_nid2obj(pkey->ameth->pkey_id),
  110. ptype, str, penc, penclen))
  111. return 1;
  112. err:
  113. OPENSSL_free(penc);
  114. ASN1_STRING_free(str);
  115. return 0;
  116. }
  117. /*
  118. * PKCS#8 DH is defined in PKCS#11 of all places. It is similar to DH in that
  119. * the AlgorithmIdentifier contains the parameters, the private key is
  120. * explicitly included and the pubkey must be recalculated.
  121. */
  122. static int dh_priv_decode(EVP_PKEY *pkey, const PKCS8_PRIV_KEY_INFO *p8)
  123. {
  124. const unsigned char *p, *pm;
  125. int pklen, pmlen;
  126. int ptype;
  127. const void *pval;
  128. const ASN1_STRING *pstr;
  129. const X509_ALGOR *palg;
  130. ASN1_INTEGER *privkey = NULL;
  131. DH *dh = NULL;
  132. if (!PKCS8_pkey_get0(NULL, &p, &pklen, &palg, p8))
  133. return 0;
  134. X509_ALGOR_get0(NULL, &ptype, &pval, palg);
  135. if (ptype != V_ASN1_SEQUENCE)
  136. goto decerr;
  137. if ((privkey = d2i_ASN1_INTEGER(NULL, &p, pklen)) == NULL)
  138. goto decerr;
  139. pstr = pval;
  140. pm = pstr->data;
  141. pmlen = pstr->length;
  142. if ((dh = d2i_dhp(pkey, &pm, pmlen)) == NULL)
  143. goto decerr;
  144. /* We have parameters now set private key */
  145. if ((dh->priv_key = BN_secure_new()) == NULL
  146. || !ASN1_INTEGER_to_BN(privkey, dh->priv_key)) {
  147. DHerr(DH_F_DH_PRIV_DECODE, DH_R_BN_ERROR);
  148. goto dherr;
  149. }
  150. /* Calculate public key */
  151. if (!DH_generate_key(dh))
  152. goto dherr;
  153. EVP_PKEY_assign(pkey, pkey->ameth->pkey_id, dh);
  154. ASN1_STRING_clear_free(privkey);
  155. return 1;
  156. decerr:
  157. DHerr(DH_F_DH_PRIV_DECODE, EVP_R_DECODE_ERROR);
  158. dherr:
  159. DH_free(dh);
  160. ASN1_STRING_clear_free(privkey);
  161. return 0;
  162. }
  163. static int dh_priv_encode(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pkey)
  164. {
  165. ASN1_STRING *params = NULL;
  166. ASN1_INTEGER *prkey = NULL;
  167. unsigned char *dp = NULL;
  168. int dplen;
  169. params = ASN1_STRING_new();
  170. if (params == NULL) {
  171. DHerr(DH_F_DH_PRIV_ENCODE, ERR_R_MALLOC_FAILURE);
  172. goto err;
  173. }
  174. params->length = i2d_dhp(pkey, pkey->pkey.dh, &params->data);
  175. if (params->length <= 0) {
  176. DHerr(DH_F_DH_PRIV_ENCODE, ERR_R_MALLOC_FAILURE);
  177. goto err;
  178. }
  179. params->type = V_ASN1_SEQUENCE;
  180. /* Get private key into integer */
  181. prkey = BN_to_ASN1_INTEGER(pkey->pkey.dh->priv_key, NULL);
  182. if (!prkey) {
  183. DHerr(DH_F_DH_PRIV_ENCODE, DH_R_BN_ERROR);
  184. goto err;
  185. }
  186. dplen = i2d_ASN1_INTEGER(prkey, &dp);
  187. ASN1_STRING_clear_free(prkey);
  188. prkey = NULL;
  189. if (!PKCS8_pkey_set0(p8, OBJ_nid2obj(pkey->ameth->pkey_id), 0,
  190. V_ASN1_SEQUENCE, params, dp, dplen))
  191. goto err;
  192. return 1;
  193. err:
  194. OPENSSL_free(dp);
  195. ASN1_STRING_free(params);
  196. ASN1_STRING_clear_free(prkey);
  197. return 0;
  198. }
  199. static int dh_param_decode(EVP_PKEY *pkey,
  200. const unsigned char **pder, int derlen)
  201. {
  202. DH *dh;
  203. if ((dh = d2i_dhp(pkey, pder, derlen)) == NULL) {
  204. DHerr(DH_F_DH_PARAM_DECODE, ERR_R_DH_LIB);
  205. return 0;
  206. }
  207. EVP_PKEY_assign(pkey, pkey->ameth->pkey_id, dh);
  208. return 1;
  209. }
  210. static int dh_param_encode(const EVP_PKEY *pkey, unsigned char **pder)
  211. {
  212. return i2d_dhp(pkey, pkey->pkey.dh, pder);
  213. }
  214. static int do_dh_print(BIO *bp, const DH *x, int indent, int ptype)
  215. {
  216. int reason = ERR_R_BUF_LIB;
  217. const char *ktype = NULL;
  218. BIGNUM *priv_key, *pub_key;
  219. if (ptype == 2)
  220. priv_key = x->priv_key;
  221. else
  222. priv_key = NULL;
  223. if (ptype > 0)
  224. pub_key = x->pub_key;
  225. else
  226. pub_key = NULL;
  227. if (x->p == NULL || (ptype == 2 && priv_key == NULL)
  228. || (ptype > 0 && pub_key == NULL)) {
  229. reason = ERR_R_PASSED_NULL_PARAMETER;
  230. goto err;
  231. }
  232. if (ptype == 2)
  233. ktype = "DH Private-Key";
  234. else if (ptype == 1)
  235. ktype = "DH Public-Key";
  236. else
  237. ktype = "DH Parameters";
  238. BIO_indent(bp, indent, 128);
  239. if (BIO_printf(bp, "%s: (%d bit)\n", ktype, BN_num_bits(x->p)) <= 0)
  240. goto err;
  241. indent += 4;
  242. if (!ASN1_bn_print(bp, "private-key:", priv_key, NULL, indent))
  243. goto err;
  244. if (!ASN1_bn_print(bp, "public-key:", pub_key, NULL, indent))
  245. goto err;
  246. if (!ASN1_bn_print(bp, "prime:", x->p, NULL, indent))
  247. goto err;
  248. if (!ASN1_bn_print(bp, "generator:", x->g, NULL, indent))
  249. goto err;
  250. if (x->q && !ASN1_bn_print(bp, "subgroup order:", x->q, NULL, indent))
  251. goto err;
  252. if (x->j && !ASN1_bn_print(bp, "subgroup factor:", x->j, NULL, indent))
  253. goto err;
  254. if (x->seed) {
  255. int i;
  256. BIO_indent(bp, indent, 128);
  257. BIO_puts(bp, "seed:");
  258. for (i = 0; i < x->seedlen; i++) {
  259. if ((i % 15) == 0) {
  260. if (BIO_puts(bp, "\n") <= 0
  261. || !BIO_indent(bp, indent + 4, 128))
  262. goto err;
  263. }
  264. if (BIO_printf(bp, "%02x%s", x->seed[i],
  265. ((i + 1) == x->seedlen) ? "" : ":") <= 0)
  266. goto err;
  267. }
  268. if (BIO_write(bp, "\n", 1) <= 0)
  269. return 0;
  270. }
  271. if (x->counter && !ASN1_bn_print(bp, "counter:", x->counter, NULL, indent))
  272. goto err;
  273. if (x->length != 0) {
  274. BIO_indent(bp, indent, 128);
  275. if (BIO_printf(bp, "recommended-private-length: %d bits\n",
  276. (int)x->length) <= 0)
  277. goto err;
  278. }
  279. return 1;
  280. err:
  281. DHerr(DH_F_DO_DH_PRINT, reason);
  282. return 0;
  283. }
  284. static int int_dh_size(const EVP_PKEY *pkey)
  285. {
  286. return DH_size(pkey->pkey.dh);
  287. }
  288. static int dh_bits(const EVP_PKEY *pkey)
  289. {
  290. return BN_num_bits(pkey->pkey.dh->p);
  291. }
  292. static int dh_security_bits(const EVP_PKEY *pkey)
  293. {
  294. return DH_security_bits(pkey->pkey.dh);
  295. }
  296. static int dh_cmp_parameters(const EVP_PKEY *a, const EVP_PKEY *b)
  297. {
  298. if (BN_cmp(a->pkey.dh->p, b->pkey.dh->p) ||
  299. BN_cmp(a->pkey.dh->g, b->pkey.dh->g))
  300. return 0;
  301. else if (a->ameth == &dhx_asn1_meth) {
  302. if (BN_cmp(a->pkey.dh->q, b->pkey.dh->q))
  303. return 0;
  304. }
  305. return 1;
  306. }
  307. static int int_dh_bn_cpy(BIGNUM **dst, const BIGNUM *src)
  308. {
  309. BIGNUM *a;
  310. /*
  311. * If source is read only just copy the pointer, so
  312. * we don't have to reallocate it.
  313. */
  314. if (src == NULL)
  315. a = NULL;
  316. else if (BN_get_flags(src, BN_FLG_STATIC_DATA)
  317. && !BN_get_flags(src, BN_FLG_MALLOCED))
  318. a = (BIGNUM *)src;
  319. else if ((a = BN_dup(src)) == NULL)
  320. return 0;
  321. BN_clear_free(*dst);
  322. *dst = a;
  323. return 1;
  324. }
  325. static int int_dh_param_copy(DH *to, const DH *from, int is_x942)
  326. {
  327. if (is_x942 == -1)
  328. is_x942 = ! !from->q;
  329. if (!int_dh_bn_cpy(&to->p, from->p))
  330. return 0;
  331. if (!int_dh_bn_cpy(&to->g, from->g))
  332. return 0;
  333. if (is_x942) {
  334. if (!int_dh_bn_cpy(&to->q, from->q))
  335. return 0;
  336. if (!int_dh_bn_cpy(&to->j, from->j))
  337. return 0;
  338. OPENSSL_free(to->seed);
  339. to->seed = NULL;
  340. to->seedlen = 0;
  341. if (from->seed) {
  342. to->seed = OPENSSL_memdup(from->seed, from->seedlen);
  343. if (!to->seed)
  344. return 0;
  345. to->seedlen = from->seedlen;
  346. }
  347. } else
  348. to->length = from->length;
  349. return 1;
  350. }
  351. DH *DHparams_dup(DH *dh)
  352. {
  353. DH *ret;
  354. ret = DH_new();
  355. if (ret == NULL)
  356. return NULL;
  357. if (!int_dh_param_copy(ret, dh, -1)) {
  358. DH_free(ret);
  359. return NULL;
  360. }
  361. return ret;
  362. }
  363. static int dh_copy_parameters(EVP_PKEY *to, const EVP_PKEY *from)
  364. {
  365. if (to->pkey.dh == NULL) {
  366. to->pkey.dh = DH_new();
  367. if (to->pkey.dh == NULL)
  368. return 0;
  369. }
  370. return int_dh_param_copy(to->pkey.dh, from->pkey.dh,
  371. from->ameth == &dhx_asn1_meth);
  372. }
  373. static int dh_missing_parameters(const EVP_PKEY *a)
  374. {
  375. if (a->pkey.dh == NULL || a->pkey.dh->p == NULL || a->pkey.dh->g == NULL)
  376. return 1;
  377. return 0;
  378. }
  379. static int dh_pub_cmp(const EVP_PKEY *a, const EVP_PKEY *b)
  380. {
  381. if (dh_cmp_parameters(a, b) == 0)
  382. return 0;
  383. if (BN_cmp(b->pkey.dh->pub_key, a->pkey.dh->pub_key) != 0)
  384. return 0;
  385. else
  386. return 1;
  387. }
  388. static int dh_param_print(BIO *bp, const EVP_PKEY *pkey, int indent,
  389. ASN1_PCTX *ctx)
  390. {
  391. return do_dh_print(bp, pkey->pkey.dh, indent, 0);
  392. }
  393. static int dh_public_print(BIO *bp, const EVP_PKEY *pkey, int indent,
  394. ASN1_PCTX *ctx)
  395. {
  396. return do_dh_print(bp, pkey->pkey.dh, indent, 1);
  397. }
  398. static int dh_private_print(BIO *bp, const EVP_PKEY *pkey, int indent,
  399. ASN1_PCTX *ctx)
  400. {
  401. return do_dh_print(bp, pkey->pkey.dh, indent, 2);
  402. }
  403. int DHparams_print(BIO *bp, const DH *x)
  404. {
  405. return do_dh_print(bp, x, 4, 0);
  406. }
  407. #ifndef OPENSSL_NO_CMS
  408. static int dh_cms_decrypt(CMS_RecipientInfo *ri);
  409. static int dh_cms_encrypt(CMS_RecipientInfo *ri);
  410. #endif
  411. static int dh_pkey_ctrl(EVP_PKEY *pkey, int op, long arg1, void *arg2)
  412. {
  413. switch (op) {
  414. #ifndef OPENSSL_NO_CMS
  415. case ASN1_PKEY_CTRL_CMS_ENVELOPE:
  416. if (arg1 == 1)
  417. return dh_cms_decrypt(arg2);
  418. else if (arg1 == 0)
  419. return dh_cms_encrypt(arg2);
  420. return -2;
  421. case ASN1_PKEY_CTRL_CMS_RI_TYPE:
  422. *(int *)arg2 = CMS_RECIPINFO_AGREE;
  423. return 1;
  424. #endif
  425. default:
  426. return -2;
  427. }
  428. }
  429. static int dh_pkey_public_check(const EVP_PKEY *pkey)
  430. {
  431. DH *dh = pkey->pkey.dh;
  432. if (dh->pub_key == NULL) {
  433. DHerr(DH_F_DH_PKEY_PUBLIC_CHECK, DH_R_MISSING_PUBKEY);
  434. return 0;
  435. }
  436. return DH_check_pub_key_ex(dh, dh->pub_key);
  437. }
  438. static int dh_pkey_param_check(const EVP_PKEY *pkey)
  439. {
  440. DH *dh = pkey->pkey.dh;
  441. return DH_check_ex(dh);
  442. }
  443. const EVP_PKEY_ASN1_METHOD dh_asn1_meth = {
  444. EVP_PKEY_DH,
  445. EVP_PKEY_DH,
  446. 0,
  447. "DH",
  448. "OpenSSL PKCS#3 DH method",
  449. dh_pub_decode,
  450. dh_pub_encode,
  451. dh_pub_cmp,
  452. dh_public_print,
  453. dh_priv_decode,
  454. dh_priv_encode,
  455. dh_private_print,
  456. int_dh_size,
  457. dh_bits,
  458. dh_security_bits,
  459. dh_param_decode,
  460. dh_param_encode,
  461. dh_missing_parameters,
  462. dh_copy_parameters,
  463. dh_cmp_parameters,
  464. dh_param_print,
  465. 0,
  466. int_dh_free,
  467. 0,
  468. 0, 0, 0, 0, 0,
  469. 0,
  470. dh_pkey_public_check,
  471. dh_pkey_param_check
  472. };
  473. const EVP_PKEY_ASN1_METHOD dhx_asn1_meth = {
  474. EVP_PKEY_DHX,
  475. EVP_PKEY_DHX,
  476. 0,
  477. "X9.42 DH",
  478. "OpenSSL X9.42 DH method",
  479. dh_pub_decode,
  480. dh_pub_encode,
  481. dh_pub_cmp,
  482. dh_public_print,
  483. dh_priv_decode,
  484. dh_priv_encode,
  485. dh_private_print,
  486. int_dh_size,
  487. dh_bits,
  488. dh_security_bits,
  489. dh_param_decode,
  490. dh_param_encode,
  491. dh_missing_parameters,
  492. dh_copy_parameters,
  493. dh_cmp_parameters,
  494. dh_param_print,
  495. 0,
  496. int_dh_free,
  497. dh_pkey_ctrl,
  498. 0, 0, 0, 0, 0,
  499. 0,
  500. dh_pkey_public_check,
  501. dh_pkey_param_check
  502. };
  503. #ifndef OPENSSL_NO_CMS
  504. static int dh_cms_set_peerkey(EVP_PKEY_CTX *pctx,
  505. X509_ALGOR *alg, ASN1_BIT_STRING *pubkey)
  506. {
  507. const ASN1_OBJECT *aoid;
  508. int atype;
  509. const void *aval;
  510. ASN1_INTEGER *public_key = NULL;
  511. int rv = 0;
  512. EVP_PKEY *pkpeer = NULL, *pk = NULL;
  513. DH *dhpeer = NULL;
  514. const unsigned char *p;
  515. int plen;
  516. X509_ALGOR_get0(&aoid, &atype, &aval, alg);
  517. if (OBJ_obj2nid(aoid) != NID_dhpublicnumber)
  518. goto err;
  519. /* Only absent parameters allowed in RFC XXXX */
  520. if (atype != V_ASN1_UNDEF && atype == V_ASN1_NULL)
  521. goto err;
  522. pk = EVP_PKEY_CTX_get0_pkey(pctx);
  523. if (!pk)
  524. goto err;
  525. if (pk->type != EVP_PKEY_DHX)
  526. goto err;
  527. /* Get parameters from parent key */
  528. dhpeer = DHparams_dup(pk->pkey.dh);
  529. /* We have parameters now set public key */
  530. plen = ASN1_STRING_length(pubkey);
  531. p = ASN1_STRING_get0_data(pubkey);
  532. if (!p || !plen)
  533. goto err;
  534. if ((public_key = d2i_ASN1_INTEGER(NULL, &p, plen)) == NULL) {
  535. DHerr(DH_F_DH_CMS_SET_PEERKEY, DH_R_DECODE_ERROR);
  536. goto err;
  537. }
  538. /* We have parameters now set public key */
  539. if ((dhpeer->pub_key = ASN1_INTEGER_to_BN(public_key, NULL)) == NULL) {
  540. DHerr(DH_F_DH_CMS_SET_PEERKEY, DH_R_BN_DECODE_ERROR);
  541. goto err;
  542. }
  543. pkpeer = EVP_PKEY_new();
  544. if (pkpeer == NULL)
  545. goto err;
  546. EVP_PKEY_assign(pkpeer, pk->ameth->pkey_id, dhpeer);
  547. dhpeer = NULL;
  548. if (EVP_PKEY_derive_set_peer(pctx, pkpeer) > 0)
  549. rv = 1;
  550. err:
  551. ASN1_INTEGER_free(public_key);
  552. EVP_PKEY_free(pkpeer);
  553. DH_free(dhpeer);
  554. return rv;
  555. }
  556. static int dh_cms_set_shared_info(EVP_PKEY_CTX *pctx, CMS_RecipientInfo *ri)
  557. {
  558. int rv = 0;
  559. X509_ALGOR *alg, *kekalg = NULL;
  560. ASN1_OCTET_STRING *ukm;
  561. const unsigned char *p;
  562. unsigned char *dukm = NULL;
  563. size_t dukmlen = 0;
  564. int keylen, plen;
  565. const EVP_CIPHER *kekcipher;
  566. EVP_CIPHER_CTX *kekctx;
  567. if (!CMS_RecipientInfo_kari_get0_alg(ri, &alg, &ukm))
  568. goto err;
  569. /*
  570. * For DH we only have one OID permissible. If ever any more get defined
  571. * we will need something cleverer.
  572. */
  573. if (OBJ_obj2nid(alg->algorithm) != NID_id_smime_alg_ESDH) {
  574. DHerr(DH_F_DH_CMS_SET_SHARED_INFO, DH_R_KDF_PARAMETER_ERROR);
  575. goto err;
  576. }
  577. if (EVP_PKEY_CTX_set_dh_kdf_type(pctx, EVP_PKEY_DH_KDF_X9_42) <= 0)
  578. goto err;
  579. if (EVP_PKEY_CTX_set_dh_kdf_md(pctx, EVP_sha1()) <= 0)
  580. goto err;
  581. if (alg->parameter->type != V_ASN1_SEQUENCE)
  582. goto err;
  583. p = alg->parameter->value.sequence->data;
  584. plen = alg->parameter->value.sequence->length;
  585. kekalg = d2i_X509_ALGOR(NULL, &p, plen);
  586. if (!kekalg)
  587. goto err;
  588. kekctx = CMS_RecipientInfo_kari_get0_ctx(ri);
  589. if (!kekctx)
  590. goto err;
  591. kekcipher = EVP_get_cipherbyobj(kekalg->algorithm);
  592. if (!kekcipher || EVP_CIPHER_mode(kekcipher) != EVP_CIPH_WRAP_MODE)
  593. goto err;
  594. if (!EVP_EncryptInit_ex(kekctx, kekcipher, NULL, NULL, NULL))
  595. goto err;
  596. if (EVP_CIPHER_asn1_to_param(kekctx, kekalg->parameter) <= 0)
  597. goto err;
  598. keylen = EVP_CIPHER_CTX_key_length(kekctx);
  599. if (EVP_PKEY_CTX_set_dh_kdf_outlen(pctx, keylen) <= 0)
  600. goto err;
  601. /* Use OBJ_nid2obj to ensure we use built in OID that isn't freed */
  602. if (EVP_PKEY_CTX_set0_dh_kdf_oid(pctx,
  603. OBJ_nid2obj(EVP_CIPHER_type(kekcipher)))
  604. <= 0)
  605. goto err;
  606. if (ukm) {
  607. dukmlen = ASN1_STRING_length(ukm);
  608. dukm = OPENSSL_memdup(ASN1_STRING_get0_data(ukm), dukmlen);
  609. if (!dukm)
  610. goto err;
  611. }
  612. if (EVP_PKEY_CTX_set0_dh_kdf_ukm(pctx, dukm, dukmlen) <= 0)
  613. goto err;
  614. dukm = NULL;
  615. rv = 1;
  616. err:
  617. X509_ALGOR_free(kekalg);
  618. OPENSSL_free(dukm);
  619. return rv;
  620. }
  621. static int dh_cms_decrypt(CMS_RecipientInfo *ri)
  622. {
  623. EVP_PKEY_CTX *pctx;
  624. pctx = CMS_RecipientInfo_get0_pkey_ctx(ri);
  625. if (!pctx)
  626. return 0;
  627. /* See if we need to set peer key */
  628. if (!EVP_PKEY_CTX_get0_peerkey(pctx)) {
  629. X509_ALGOR *alg;
  630. ASN1_BIT_STRING *pubkey;
  631. if (!CMS_RecipientInfo_kari_get0_orig_id(ri, &alg, &pubkey,
  632. NULL, NULL, NULL))
  633. return 0;
  634. if (!alg || !pubkey)
  635. return 0;
  636. if (!dh_cms_set_peerkey(pctx, alg, pubkey)) {
  637. DHerr(DH_F_DH_CMS_DECRYPT, DH_R_PEER_KEY_ERROR);
  638. return 0;
  639. }
  640. }
  641. /* Set DH derivation parameters and initialise unwrap context */
  642. if (!dh_cms_set_shared_info(pctx, ri)) {
  643. DHerr(DH_F_DH_CMS_DECRYPT, DH_R_SHARED_INFO_ERROR);
  644. return 0;
  645. }
  646. return 1;
  647. }
  648. static int dh_cms_encrypt(CMS_RecipientInfo *ri)
  649. {
  650. EVP_PKEY_CTX *pctx;
  651. EVP_PKEY *pkey;
  652. EVP_CIPHER_CTX *ctx;
  653. int keylen;
  654. X509_ALGOR *talg, *wrap_alg = NULL;
  655. const ASN1_OBJECT *aoid;
  656. ASN1_BIT_STRING *pubkey;
  657. ASN1_STRING *wrap_str;
  658. ASN1_OCTET_STRING *ukm;
  659. unsigned char *penc = NULL, *dukm = NULL;
  660. int penclen;
  661. size_t dukmlen = 0;
  662. int rv = 0;
  663. int kdf_type, wrap_nid;
  664. const EVP_MD *kdf_md;
  665. pctx = CMS_RecipientInfo_get0_pkey_ctx(ri);
  666. if (!pctx)
  667. return 0;
  668. /* Get ephemeral key */
  669. pkey = EVP_PKEY_CTX_get0_pkey(pctx);
  670. if (!CMS_RecipientInfo_kari_get0_orig_id(ri, &talg, &pubkey,
  671. NULL, NULL, NULL))
  672. goto err;
  673. X509_ALGOR_get0(&aoid, NULL, NULL, talg);
  674. /* Is everything uninitialised? */
  675. if (aoid == OBJ_nid2obj(NID_undef)) {
  676. ASN1_INTEGER *pubk = BN_to_ASN1_INTEGER(pkey->pkey.dh->pub_key, NULL);
  677. if (!pubk)
  678. goto err;
  679. /* Set the key */
  680. penclen = i2d_ASN1_INTEGER(pubk, &penc);
  681. ASN1_INTEGER_free(pubk);
  682. if (penclen <= 0)
  683. goto err;
  684. ASN1_STRING_set0(pubkey, penc, penclen);
  685. pubkey->flags &= ~(ASN1_STRING_FLAG_BITS_LEFT | 0x07);
  686. pubkey->flags |= ASN1_STRING_FLAG_BITS_LEFT;
  687. penc = NULL;
  688. X509_ALGOR_set0(talg, OBJ_nid2obj(NID_dhpublicnumber),
  689. V_ASN1_UNDEF, NULL);
  690. }
  691. /* See if custom parameters set */
  692. kdf_type = EVP_PKEY_CTX_get_dh_kdf_type(pctx);
  693. if (kdf_type <= 0)
  694. goto err;
  695. if (!EVP_PKEY_CTX_get_dh_kdf_md(pctx, &kdf_md))
  696. goto err;
  697. if (kdf_type == EVP_PKEY_DH_KDF_NONE) {
  698. kdf_type = EVP_PKEY_DH_KDF_X9_42;
  699. if (EVP_PKEY_CTX_set_dh_kdf_type(pctx, kdf_type) <= 0)
  700. goto err;
  701. } else if (kdf_type != EVP_PKEY_DH_KDF_X9_42)
  702. /* Unknown KDF */
  703. goto err;
  704. if (kdf_md == NULL) {
  705. /* Only SHA1 supported */
  706. kdf_md = EVP_sha1();
  707. if (EVP_PKEY_CTX_set_dh_kdf_md(pctx, kdf_md) <= 0)
  708. goto err;
  709. } else if (EVP_MD_type(kdf_md) != NID_sha1)
  710. /* Unsupported digest */
  711. goto err;
  712. if (!CMS_RecipientInfo_kari_get0_alg(ri, &talg, &ukm))
  713. goto err;
  714. /* Get wrap NID */
  715. ctx = CMS_RecipientInfo_kari_get0_ctx(ri);
  716. wrap_nid = EVP_CIPHER_CTX_type(ctx);
  717. if (EVP_PKEY_CTX_set0_dh_kdf_oid(pctx, OBJ_nid2obj(wrap_nid)) <= 0)
  718. goto err;
  719. keylen = EVP_CIPHER_CTX_key_length(ctx);
  720. /* Package wrap algorithm in an AlgorithmIdentifier */
  721. wrap_alg = X509_ALGOR_new();
  722. if (wrap_alg == NULL)
  723. goto err;
  724. wrap_alg->algorithm = OBJ_nid2obj(wrap_nid);
  725. wrap_alg->parameter = ASN1_TYPE_new();
  726. if (wrap_alg->parameter == NULL)
  727. goto err;
  728. if (EVP_CIPHER_param_to_asn1(ctx, wrap_alg->parameter) <= 0)
  729. goto err;
  730. if (ASN1_TYPE_get(wrap_alg->parameter) == NID_undef) {
  731. ASN1_TYPE_free(wrap_alg->parameter);
  732. wrap_alg->parameter = NULL;
  733. }
  734. if (EVP_PKEY_CTX_set_dh_kdf_outlen(pctx, keylen) <= 0)
  735. goto err;
  736. if (ukm) {
  737. dukmlen = ASN1_STRING_length(ukm);
  738. dukm = OPENSSL_memdup(ASN1_STRING_get0_data(ukm), dukmlen);
  739. if (!dukm)
  740. goto err;
  741. }
  742. if (EVP_PKEY_CTX_set0_dh_kdf_ukm(pctx, dukm, dukmlen) <= 0)
  743. goto err;
  744. dukm = NULL;
  745. /*
  746. * Now need to wrap encoding of wrap AlgorithmIdentifier into parameter
  747. * of another AlgorithmIdentifier.
  748. */
  749. penc = NULL;
  750. penclen = i2d_X509_ALGOR(wrap_alg, &penc);
  751. if (!penc || !penclen)
  752. goto err;
  753. wrap_str = ASN1_STRING_new();
  754. if (wrap_str == NULL)
  755. goto err;
  756. ASN1_STRING_set0(wrap_str, penc, penclen);
  757. penc = NULL;
  758. X509_ALGOR_set0(talg, OBJ_nid2obj(NID_id_smime_alg_ESDH),
  759. V_ASN1_SEQUENCE, wrap_str);
  760. rv = 1;
  761. err:
  762. OPENSSL_free(penc);
  763. X509_ALGOR_free(wrap_alg);
  764. return rv;
  765. }
  766. #endif