1 /* crypto/cms/cms_pwri.c */
2 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
5 /* ====================================================================
6 * Copyright (c) 2009 The OpenSSL Project. All rights reserved.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
34 * 6. Redistributions of any form whatsoever must retain the following
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
55 #include <openssl/asn1t.h>
56 #include <openssl/pem.h>
57 #include <openssl/x509v3.h>
58 #include <openssl/err.h>
59 #include <openssl/cms.h>
60 #include <openssl/rand.h>
61 #include <openssl/aes.h>
63 #include "asn1_locl.h"
65 int CMS_RecipientInfo_set0_password(CMS_RecipientInfo *ri,
66 unsigned char *pass, ssize_t passlen)
68 CMS_PasswordRecipientInfo *pwri;
69 if (ri->type != CMS_RECIPINFO_PASS)
71 CMSerr(CMS_F_CMS_RECIPIENTINFO_SET0_PASSWORD, CMS_R_NOT_PWRI);
77 if (pass && passlen < 0)
78 passlen = strlen((char *)pass);
79 pwri->passlen = passlen;
83 CMS_RecipientInfo *CMS_add0_recipient_password(CMS_ContentInfo *cms,
84 int iter, int wrap_nid, int pbe_nid,
85 unsigned char *pass, ssize_t passlen,
86 const EVP_CIPHER *kekciph)
88 CMS_RecipientInfo *ri = NULL;
89 CMS_EnvelopedData *env;
90 CMS_PasswordRecipientInfo *pwri;
92 X509_ALGOR *encalg = NULL;
93 unsigned char iv[EVP_MAX_IV_LENGTH];
95 env = cms_get0_enveloped(cms);
100 wrap_nid = NID_id_alg_PWRI_KEK;
103 pbe_nid = NID_id_pbkdf2;
105 /* Get from enveloped data */
107 kekciph = env->encryptedContentInfo->cipher;
111 CMSerr(CMS_F_CMS_ADD0_RECIPIENT_PASSWORD, CMS_R_NO_CIPHER);
114 if (wrap_nid != NID_id_alg_PWRI_KEK)
116 CMSerr(CMS_F_CMS_ADD0_RECIPIENT_PASSWORD,
117 CMS_R_UNSUPPORTED_KEY_ENCRYPTION_ALGORITHM);
121 /* Setup algorithm identifier for cipher */
122 encalg = X509_ALGOR_new();
123 EVP_CIPHER_CTX_init(&ctx);
125 if (EVP_EncryptInit_ex(&ctx, kekciph, NULL, NULL, NULL) <= 0)
127 CMSerr(CMS_F_CMS_ADD0_RECIPIENT_PASSWORD, ERR_R_EVP_LIB);
131 ivlen = EVP_CIPHER_CTX_iv_length(&ctx);
135 if (RAND_pseudo_bytes(iv, ivlen) <= 0)
137 if (EVP_EncryptInit_ex(&ctx, NULL, NULL, NULL, iv) <= 0)
139 CMSerr(CMS_F_CMS_ADD0_RECIPIENT_PASSWORD,
143 encalg->parameter = ASN1_TYPE_new();
144 if (!encalg->parameter)
146 CMSerr(CMS_F_CMS_ADD0_RECIPIENT_PASSWORD,
147 ERR_R_MALLOC_FAILURE);
150 if (EVP_CIPHER_param_to_asn1(&ctx, encalg->parameter) <= 0)
152 CMSerr(CMS_F_CMS_ADD0_RECIPIENT_PASSWORD,
153 CMS_R_CIPHER_PARAMETER_INITIALISATION_ERROR);
159 encalg->algorithm = OBJ_nid2obj(EVP_CIPHER_CTX_type(&ctx));
161 EVP_CIPHER_CTX_cleanup(&ctx);
163 /* Initialize recipient info */
164 ri = M_ASN1_new_of(CMS_RecipientInfo);
168 ri->d.pwri = M_ASN1_new_of(CMS_PasswordRecipientInfo);
171 ri->type = CMS_RECIPINFO_PASS;
174 /* Since this is overwritten, free up empty structure already there */
175 X509_ALGOR_free(pwri->keyEncryptionAlgorithm);
176 pwri->keyEncryptionAlgorithm = X509_ALGOR_new();
177 if (!pwri->keyEncryptionAlgorithm)
179 pwri->keyEncryptionAlgorithm->algorithm = OBJ_nid2obj(wrap_nid);
180 pwri->keyEncryptionAlgorithm->parameter = ASN1_TYPE_new();
181 if (!pwri->keyEncryptionAlgorithm->parameter)
184 if(!ASN1_item_pack(encalg, ASN1_ITEM_rptr(X509_ALGOR),
185 &pwri->keyEncryptionAlgorithm->parameter->value.sequence))
187 pwri->keyEncryptionAlgorithm->parameter->type = V_ASN1_SEQUENCE;
189 X509_ALGOR_free(encalg);
192 /* Setup PBE algorithm */
194 pwri->keyDerivationAlgorithm = PKCS5_pbkdf2_set(iter, NULL, 0, -1, -1);
196 if (!pwri->keyDerivationAlgorithm)
199 CMS_RecipientInfo_set0_password(ri, pass, passlen);
202 if (!sk_CMS_RecipientInfo_push(env->recipientInfos, ri))
208 CMSerr(CMS_F_CMS_ADD0_RECIPIENT_PASSWORD, ERR_R_MALLOC_FAILURE);
210 EVP_CIPHER_CTX_cleanup(&ctx);
212 M_ASN1_free_of(ri, CMS_RecipientInfo);
214 X509_ALGOR_free(encalg);
219 /* This is an implementation of the key wrapping mechanism in RFC3211,
220 * at some point this should go into EVP.
223 static int kek_unwrap_key(unsigned char *out, size_t *outlen,
224 const unsigned char *in, size_t inlen, EVP_CIPHER_CTX *ctx)
226 size_t blocklen = EVP_CIPHER_CTX_block_size(ctx);
229 if (inlen < 2 * blocklen)
234 if (inlen % blocklen)
239 tmp = OPENSSL_malloc(inlen);
240 /* setup IV by decrypting last two blocks */
241 EVP_DecryptUpdate(ctx, tmp + inlen - 2 * blocklen, &outl,
242 in + inlen - 2 * blocklen, blocklen * 2);
243 /* Do a decrypt of last decrypted block to set IV to correct value
244 * output it to start of buffer so we don't corrupt decrypted block
245 * this works because buffer is at least two block lengths long.
247 EVP_DecryptUpdate(ctx, tmp, &outl,
248 tmp + inlen - blocklen, blocklen);
249 /* Can now decrypt first n - 1 blocks */
250 EVP_DecryptUpdate(ctx, tmp, &outl, in, inlen - blocklen);
252 /* Reset IV to original value */
253 EVP_DecryptInit_ex(ctx, NULL, NULL, NULL, NULL);
255 EVP_DecryptUpdate(ctx, tmp, &outl, tmp, inlen);
256 /* Check check bytes */
257 if (((tmp[1] ^ tmp[4]) & (tmp[2] ^ tmp[5]) & (tmp[3] ^ tmp[6])) != 0xff)
259 /* Check byte failure */
262 if (inlen < (size_t)(tmp[0] - 4 ))
264 /* Invalid length value */
267 *outlen = (size_t)tmp[0];
268 memcpy(out, tmp + 4, *outlen);
271 OPENSSL_cleanse(tmp, inlen);
277 static int kek_wrap_key(unsigned char *out, size_t *outlen,
278 const unsigned char *in, size_t inlen, EVP_CIPHER_CTX *ctx)
280 size_t blocklen = EVP_CIPHER_CTX_block_size(ctx);
283 /* First decide length of output buffer: need header and round up to
284 * multiple of block length.
286 olen = (inlen + 4 + blocklen - 1)/blocklen;
288 if (olen < 2 * blocklen)
301 out[0] = (unsigned char)inlen;
302 out[1] = in[0] ^ 0xFF;
303 out[2] = in[1] ^ 0xFF;
304 out[3] = in[2] ^ 0xFF;
305 memcpy(out + 4, in, inlen);
306 /* Add random padding to end */
307 if (olen > inlen + 4)
308 RAND_pseudo_bytes(out + 4 + inlen, olen - 4 - inlen);
310 EVP_EncryptUpdate(ctx, out, &dummy, out, olen);
311 EVP_EncryptUpdate(ctx, out, &dummy, out, olen);
319 /* Encrypt/Decrypt content key in PWRI recipient info */
321 int cms_RecipientInfo_pwri_crypt(CMS_ContentInfo *cms, CMS_RecipientInfo *ri,
324 CMS_EncryptedContentInfo *ec;
325 CMS_PasswordRecipientInfo *pwri;
326 const unsigned char *p = NULL;
329 X509_ALGOR *algtmp, *kekalg = NULL;
330 EVP_CIPHER_CTX kekctx;
331 const EVP_CIPHER *kekcipher;
332 unsigned char *key = NULL;
335 ec = cms->d.envelopedData->encryptedContentInfo;
338 EVP_CIPHER_CTX_init(&kekctx);
342 CMSerr(CMS_F_CMS_RECIPIENTINFO_PWRI_CRYPT, CMS_R_NO_PASSWORD);
345 algtmp = pwri->keyEncryptionAlgorithm;
347 if (!algtmp || OBJ_obj2nid(algtmp->algorithm) != NID_id_alg_PWRI_KEK)
349 CMSerr(CMS_F_CMS_RECIPIENTINFO_PWRI_CRYPT,
350 CMS_R_UNSUPPORTED_KEY_ENCRYPTION_ALGORITHM);
354 if (algtmp->parameter->type == V_ASN1_SEQUENCE)
356 p = algtmp->parameter->value.sequence->data;
357 plen = algtmp->parameter->value.sequence->length;
358 kekalg = d2i_X509_ALGOR(NULL, &p, plen);
362 CMSerr(CMS_F_CMS_RECIPIENTINFO_PWRI_CRYPT,
363 CMS_R_INVALID_KEY_ENCRYPTION_PARAMETER);
367 kekcipher = EVP_get_cipherbyobj(kekalg->algorithm);
371 CMSerr(CMS_F_CMS_RECIPIENTINFO_PWRI_CRYPT,
372 CMS_R_UNKNOWN_CIPHER);
376 /* Fixup cipher based on AlgorithmIdentifier to set IV etc */
377 if (!EVP_CipherInit_ex(&kekctx, kekcipher, NULL, NULL, NULL, en_de))
379 EVP_CIPHER_CTX_set_padding(&kekctx, 0);
380 if(EVP_CIPHER_asn1_to_param(&kekctx, kekalg->parameter) < 0)
382 CMSerr(CMS_F_CMS_RECIPIENTINFO_PWRI_CRYPT,
383 CMS_R_CIPHER_PARAMETER_INITIALISATION_ERROR);
387 algtmp = pwri->keyDerivationAlgorithm;
389 /* Finish password based key derivation to setup key in "ctx" */
391 if (EVP_PBE_CipherInit(algtmp->algorithm,
392 (char *)pwri->pass, pwri->passlen,
393 algtmp->parameter, &kekctx, en_de) < 0)
395 CMSerr(CMS_F_CMS_RECIPIENTINFO_PWRI_CRYPT, ERR_R_EVP_LIB);
399 /* Finally wrap/unwrap the key */
404 if (!kek_wrap_key(NULL, &keylen, ec->key, ec->keylen, &kekctx))
407 key = OPENSSL_malloc(keylen);
412 if (!kek_wrap_key(key, &keylen, ec->key, ec->keylen, &kekctx))
414 pwri->encryptedKey->data = key;
415 pwri->encryptedKey->length = keylen;
419 key = OPENSSL_malloc(pwri->encryptedKey->length);
423 CMSerr(CMS_F_CMS_RECIPIENTINFO_PWRI_CRYPT,
424 ERR_R_MALLOC_FAILURE);
427 if (!kek_unwrap_key(key, &keylen,
428 pwri->encryptedKey->data,
429 pwri->encryptedKey->length, &kekctx))
431 CMSerr(CMS_F_CMS_RECIPIENTINFO_PWRI_CRYPT,
432 CMS_R_UNWRAP_FAILURE);
445 EVP_CIPHER_CTX_cleanup(&kekctx);
449 X509_ALGOR_free(kekalg);