Import OpenSSL 1.0.1q.
[dragonfly.git] / crypto / openssl / crypto / cms / cms_pwri.c
CommitLineData
672590bc 1/* crypto/cms/cms_pwri.c */
9eaaad39
SW
2/*
3 * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
672590bc
PA
4 * project.
5 */
6/* ====================================================================
7 * Copyright (c) 2009 The OpenSSL Project. All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 *
13 * 1. Redistributions of source code must retain the above copyright
9eaaad39 14 * notice, this list of conditions and the following disclaimer.
672590bc
PA
15 *
16 * 2. Redistributions in binary form must reproduce the above copyright
17 * notice, this list of conditions and the following disclaimer in
18 * the documentation and/or other materials provided with the
19 * distribution.
20 *
21 * 3. All advertising materials mentioning features or use of this
22 * software must display the following acknowledgment:
23 * "This product includes software developed by the OpenSSL Project
24 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
25 *
26 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
27 * endorse or promote products derived from this software without
28 * prior written permission. For written permission, please contact
29 * licensing@OpenSSL.org.
30 *
31 * 5. Products derived from this software may not be called "OpenSSL"
32 * nor may "OpenSSL" appear in their names without prior written
33 * permission of the OpenSSL Project.
34 *
35 * 6. Redistributions of any form whatsoever must retain the following
36 * acknowledgment:
37 * "This product includes software developed by the OpenSSL Project
38 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
39 *
40 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
41 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
42 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
43 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
44 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
45 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
46 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
47 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
49 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
50 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
51 * OF THE POSSIBILITY OF SUCH DAMAGE.
52 * ====================================================================
53 */
54
55#include "cryptlib.h"
56#include <openssl/asn1t.h>
57#include <openssl/pem.h>
58#include <openssl/x509v3.h>
59#include <openssl/err.h>
60#include <openssl/cms.h>
61#include <openssl/rand.h>
62#include <openssl/aes.h>
63#include "cms_lcl.h"
64#include "asn1_locl.h"
65
9eaaad39
SW
66int CMS_RecipientInfo_set0_password(CMS_RecipientInfo *ri,
67 unsigned char *pass, ossl_ssize_t passlen)
68{
69 CMS_PasswordRecipientInfo *pwri;
70 if (ri->type != CMS_RECIPINFO_PASS) {
71 CMSerr(CMS_F_CMS_RECIPIENTINFO_SET0_PASSWORD, CMS_R_NOT_PWRI);
72 return 0;
73 }
74
75 pwri = ri->d.pwri;
76 pwri->pass = pass;
77 if (pass && passlen < 0)
78 passlen = strlen((char *)pass);
79 pwri->passlen = passlen;
80 return 1;
81}
672590bc
PA
82
83CMS_RecipientInfo *CMS_add0_recipient_password(CMS_ContentInfo *cms,
9eaaad39
SW
84 int iter, int wrap_nid,
85 int pbe_nid,
86 unsigned char *pass,
87 ossl_ssize_t passlen,
88 const EVP_CIPHER *kekciph)
89{
90 CMS_RecipientInfo *ri = NULL;
91 CMS_EnvelopedData *env;
92 CMS_PasswordRecipientInfo *pwri;
93 EVP_CIPHER_CTX ctx;
94 X509_ALGOR *encalg = NULL;
95 unsigned char iv[EVP_MAX_IV_LENGTH];
96 int ivlen;
97
98 env = cms_get0_enveloped(cms);
99 if (!env)
100 return NULL;
101
102 if (wrap_nid <= 0)
103 wrap_nid = NID_id_alg_PWRI_KEK;
104
105 if (pbe_nid <= 0)
106 pbe_nid = NID_id_pbkdf2;
107
108 /* Get from enveloped data */
109 if (kekciph == NULL)
110 kekciph = env->encryptedContentInfo->cipher;
111
112 if (kekciph == NULL) {
113 CMSerr(CMS_F_CMS_ADD0_RECIPIENT_PASSWORD, CMS_R_NO_CIPHER);
114 return NULL;
115 }
116 if (wrap_nid != NID_id_alg_PWRI_KEK) {
117 CMSerr(CMS_F_CMS_ADD0_RECIPIENT_PASSWORD,
118 CMS_R_UNSUPPORTED_KEY_ENCRYPTION_ALGORITHM);
119 return NULL;
120 }
121
122 /* Setup algorithm identifier for cipher */
123 encalg = X509_ALGOR_new();
8be1fb4e
SW
124 if (encalg == NULL) {
125 goto merr;
126 }
9eaaad39
SW
127 EVP_CIPHER_CTX_init(&ctx);
128
129 if (EVP_EncryptInit_ex(&ctx, kekciph, NULL, NULL, NULL) <= 0) {
130 CMSerr(CMS_F_CMS_ADD0_RECIPIENT_PASSWORD, ERR_R_EVP_LIB);
131 goto err;
132 }
133
134 ivlen = EVP_CIPHER_CTX_iv_length(&ctx);
135
136 if (ivlen > 0) {
137 if (RAND_pseudo_bytes(iv, ivlen) <= 0)
138 goto err;
139 if (EVP_EncryptInit_ex(&ctx, NULL, NULL, NULL, iv) <= 0) {
140 CMSerr(CMS_F_CMS_ADD0_RECIPIENT_PASSWORD, ERR_R_EVP_LIB);
141 goto err;
142 }
143 encalg->parameter = ASN1_TYPE_new();
144 if (!encalg->parameter) {
145 CMSerr(CMS_F_CMS_ADD0_RECIPIENT_PASSWORD, ERR_R_MALLOC_FAILURE);
146 goto err;
147 }
148 if (EVP_CIPHER_param_to_asn1(&ctx, encalg->parameter) <= 0) {
149 CMSerr(CMS_F_CMS_ADD0_RECIPIENT_PASSWORD,
150 CMS_R_CIPHER_PARAMETER_INITIALISATION_ERROR);
151 goto err;
152 }
153 }
154
155 encalg->algorithm = OBJ_nid2obj(EVP_CIPHER_CTX_type(&ctx));
156
157 EVP_CIPHER_CTX_cleanup(&ctx);
158
159 /* Initialize recipient info */
160 ri = M_ASN1_new_of(CMS_RecipientInfo);
161 if (!ri)
162 goto merr;
163
164 ri->d.pwri = M_ASN1_new_of(CMS_PasswordRecipientInfo);
165 if (!ri->d.pwri)
166 goto merr;
167 ri->type = CMS_RECIPINFO_PASS;
168
169 pwri = ri->d.pwri;
170 /* Since this is overwritten, free up empty structure already there */
171 X509_ALGOR_free(pwri->keyEncryptionAlgorithm);
172 pwri->keyEncryptionAlgorithm = X509_ALGOR_new();
173 if (!pwri->keyEncryptionAlgorithm)
174 goto merr;
175 pwri->keyEncryptionAlgorithm->algorithm = OBJ_nid2obj(wrap_nid);
176 pwri->keyEncryptionAlgorithm->parameter = ASN1_TYPE_new();
177 if (!pwri->keyEncryptionAlgorithm->parameter)
178 goto merr;
179
180 if (!ASN1_item_pack(encalg, ASN1_ITEM_rptr(X509_ALGOR),
181 &pwri->keyEncryptionAlgorithm->parameter->
182 value.sequence))
183 goto merr;
184 pwri->keyEncryptionAlgorithm->parameter->type = V_ASN1_SEQUENCE;
185
186 X509_ALGOR_free(encalg);
187 encalg = NULL;
188
189 /* Setup PBE algorithm */
190
191 pwri->keyDerivationAlgorithm = PKCS5_pbkdf2_set(iter, NULL, 0, -1, -1);
192
193 if (!pwri->keyDerivationAlgorithm)
194 goto err;
195
196 CMS_RecipientInfo_set0_password(ri, pass, passlen);
197 pwri->version = 0;
198
199 if (!sk_CMS_RecipientInfo_push(env->recipientInfos, ri))
200 goto merr;
201
202 return ri;
203
204 merr:
205 CMSerr(CMS_F_CMS_ADD0_RECIPIENT_PASSWORD, ERR_R_MALLOC_FAILURE);
206 err:
207 EVP_CIPHER_CTX_cleanup(&ctx);
208 if (ri)
209 M_ASN1_free_of(ri, CMS_RecipientInfo);
210 if (encalg)
211 X509_ALGOR_free(encalg);
212 return NULL;
213
214}
215
216/*
217 * This is an implementation of the key wrapping mechanism in RFC3211, at
218 * some point this should go into EVP.
672590bc
PA
219 */
220
221static int kek_unwrap_key(unsigned char *out, size_t *outlen,
9eaaad39
SW
222 const unsigned char *in, size_t inlen,
223 EVP_CIPHER_CTX *ctx)
224{
225 size_t blocklen = EVP_CIPHER_CTX_block_size(ctx);
226 unsigned char *tmp;
227 int outl, rv = 0;
228 if (inlen < 2 * blocklen) {
229 /* too small */
230 return 0;
231 }
232 if (inlen % blocklen) {
233 /* Invalid size */
234 return 0;
235 }
236 tmp = OPENSSL_malloc(inlen);
25952ef9 237 if (!tmp)
9eaaad39
SW
238 return 0;
239 /* setup IV by decrypting last two blocks */
240 EVP_DecryptUpdate(ctx, tmp + inlen - 2 * blocklen, &outl,
241 in + inlen - 2 * blocklen, blocklen * 2);
242 /*
243 * Do a decrypt of last decrypted block to set IV to correct value output
244 * it to start of buffer so we don't corrupt decrypted block this works
245 * because buffer is at least two block lengths long.
246 */
247 EVP_DecryptUpdate(ctx, tmp, &outl, tmp + inlen - blocklen, blocklen);
248 /* Can now decrypt first n - 1 blocks */
249 EVP_DecryptUpdate(ctx, tmp, &outl, in, inlen - blocklen);
250
251 /* Reset IV to original value */
252 EVP_DecryptInit_ex(ctx, NULL, NULL, NULL, NULL);
253 /* Decrypt again */
254 EVP_DecryptUpdate(ctx, tmp, &outl, tmp, inlen);
255 /* Check check bytes */
256 if (((tmp[1] ^ tmp[4]) & (tmp[2] ^ tmp[5]) & (tmp[3] ^ tmp[6])) != 0xff) {
257 /* Check byte failure */
258 goto err;
259 }
260 if (inlen < (size_t)(tmp[0] - 4)) {
261 /* Invalid length value */
262 goto err;
263 }
264 *outlen = (size_t)tmp[0];
265 memcpy(out, tmp + 4, *outlen);
266 rv = 1;
267 err:
268 OPENSSL_cleanse(tmp, inlen);
269 OPENSSL_free(tmp);
270 return rv;
271
272}
672590bc
PA
273
274static int kek_wrap_key(unsigned char *out, size_t *outlen,
9eaaad39
SW
275 const unsigned char *in, size_t inlen,
276 EVP_CIPHER_CTX *ctx)
277{
278 size_t blocklen = EVP_CIPHER_CTX_block_size(ctx);
279 size_t olen;
280 int dummy;
281 /*
282 * First decide length of output buffer: need header and round up to
283 * multiple of block length.
284 */
285 olen = (inlen + 4 + blocklen - 1) / blocklen;
286 olen *= blocklen;
287 if (olen < 2 * blocklen) {
288 /* Key too small */
289 return 0;
290 }
291 if (inlen > 0xFF) {
292 /* Key too large */
293 return 0;
294 }
295 if (out) {
296 /* Set header */
297 out[0] = (unsigned char)inlen;
298 out[1] = in[0] ^ 0xFF;
299 out[2] = in[1] ^ 0xFF;
300 out[3] = in[2] ^ 0xFF;
301 memcpy(out + 4, in, inlen);
302 /* Add random padding to end */
25952ef9
SW
303 if (olen > inlen + 4
304 && RAND_pseudo_bytes(out + 4 + inlen, olen - 4 - inlen) < 0)
305 return 0;
9eaaad39
SW
306 /* Encrypt twice */
307 EVP_EncryptUpdate(ctx, out, &dummy, out, olen);
308 EVP_EncryptUpdate(ctx, out, &dummy, out, olen);
309 }
310
311 *outlen = olen;
312
313 return 1;
314}
672590bc
PA
315
316/* Encrypt/Decrypt content key in PWRI recipient info */
317
318int cms_RecipientInfo_pwri_crypt(CMS_ContentInfo *cms, CMS_RecipientInfo *ri,
9eaaad39
SW
319 int en_de)
320{
321 CMS_EncryptedContentInfo *ec;
322 CMS_PasswordRecipientInfo *pwri;
323 const unsigned char *p = NULL;
324 int plen;
325 int r = 0;
326 X509_ALGOR *algtmp, *kekalg = NULL;
327 EVP_CIPHER_CTX kekctx;
328 const EVP_CIPHER *kekcipher;
329 unsigned char *key = NULL;
330 size_t keylen;
331
332 ec = cms->d.envelopedData->encryptedContentInfo;
333
334 pwri = ri->d.pwri;
335 EVP_CIPHER_CTX_init(&kekctx);
336
337 if (!pwri->pass) {
338 CMSerr(CMS_F_CMS_RECIPIENTINFO_PWRI_CRYPT, CMS_R_NO_PASSWORD);
339 return 0;
340 }
341 algtmp = pwri->keyEncryptionAlgorithm;
342
343 if (!algtmp || OBJ_obj2nid(algtmp->algorithm) != NID_id_alg_PWRI_KEK) {
344 CMSerr(CMS_F_CMS_RECIPIENTINFO_PWRI_CRYPT,
345 CMS_R_UNSUPPORTED_KEY_ENCRYPTION_ALGORITHM);
346 return 0;
347 }
348
349 if (algtmp->parameter->type == V_ASN1_SEQUENCE) {
350 p = algtmp->parameter->value.sequence->data;
351 plen = algtmp->parameter->value.sequence->length;
352 kekalg = d2i_X509_ALGOR(NULL, &p, plen);
353 }
354 if (kekalg == NULL) {
355 CMSerr(CMS_F_CMS_RECIPIENTINFO_PWRI_CRYPT,
356 CMS_R_INVALID_KEY_ENCRYPTION_PARAMETER);
357 return 0;
358 }
359
360 kekcipher = EVP_get_cipherbyobj(kekalg->algorithm);
361
362 if (!kekcipher) {
363 CMSerr(CMS_F_CMS_RECIPIENTINFO_PWRI_CRYPT, CMS_R_UNKNOWN_CIPHER);
364 goto err;
365 }
366
367 /* Fixup cipher based on AlgorithmIdentifier to set IV etc */
368 if (!EVP_CipherInit_ex(&kekctx, kekcipher, NULL, NULL, NULL, en_de))
369 goto err;
370 EVP_CIPHER_CTX_set_padding(&kekctx, 0);
371 if (EVP_CIPHER_asn1_to_param(&kekctx, kekalg->parameter) < 0) {
372 CMSerr(CMS_F_CMS_RECIPIENTINFO_PWRI_CRYPT,
373 CMS_R_CIPHER_PARAMETER_INITIALISATION_ERROR);
374 goto err;
375 }
376
377 algtmp = pwri->keyDerivationAlgorithm;
378
379 /* Finish password based key derivation to setup key in "ctx" */
380
381 if (EVP_PBE_CipherInit(algtmp->algorithm,
382 (char *)pwri->pass, pwri->passlen,
383 algtmp->parameter, &kekctx, en_de) < 0) {
384 CMSerr(CMS_F_CMS_RECIPIENTINFO_PWRI_CRYPT, ERR_R_EVP_LIB);
385 goto err;
386 }
387
388 /* Finally wrap/unwrap the key */
389
390 if (en_de) {
391
392 if (!kek_wrap_key(NULL, &keylen, ec->key, ec->keylen, &kekctx))
393 goto err;
394
395 key = OPENSSL_malloc(keylen);
396
397 if (!key)
398 goto err;
399
400 if (!kek_wrap_key(key, &keylen, ec->key, ec->keylen, &kekctx))
401 goto err;
402 pwri->encryptedKey->data = key;
403 pwri->encryptedKey->length = keylen;
404 } else {
405 key = OPENSSL_malloc(pwri->encryptedKey->length);
406
407 if (!key) {
408 CMSerr(CMS_F_CMS_RECIPIENTINFO_PWRI_CRYPT, ERR_R_MALLOC_FAILURE);
409 goto err;
410 }
411 if (!kek_unwrap_key(key, &keylen,
412 pwri->encryptedKey->data,
413 pwri->encryptedKey->length, &kekctx)) {
414 CMSerr(CMS_F_CMS_RECIPIENTINFO_PWRI_CRYPT, CMS_R_UNWRAP_FAILURE);
415 goto err;
416 }
417
418 ec->key = key;
419 ec->keylen = keylen;
420
421 }
422
423 r = 1;
424
425 err:
426
427 EVP_CIPHER_CTX_cleanup(&kekctx);
428
429 if (!r && key)
430 OPENSSL_free(key);
431 X509_ALGOR_free(kekalg);
432
433 return r;
434
435}