| /* |
| * Copyright 2006-2021 The OpenSSL Project Authors. All Rights Reserved. |
| * |
| * Licensed under the Apache License 2.0 (the "License"). You may not use |
| * this file except in compliance with the License. You can obtain a copy |
| * in the file LICENSE in the source distribution or at |
| * https://www.openssl.org/source/license.html |
| */ |
| |
| /* |
| * ECDH and ECDSA low level APIs are deprecated for public use, but still ok |
| * for internal use. |
| */ |
| #include "internal/deprecated.h" |
| |
| #include <stdio.h> |
| #include "internal/cryptlib.h" |
| #include <openssl/asn1t.h> |
| #include <openssl/x509.h> |
| #include <openssl/ec.h> |
| #include "ec_local.h" |
| #include <openssl/evp.h> |
| #include "crypto/evp.h" |
| |
| /* EC pkey context structure */ |
| |
| typedef struct { |
| /* Key and paramgen group */ |
| EC_GROUP *gen_group; |
| /* message digest */ |
| const EVP_MD *md; |
| /* Duplicate key if custom cofactor needed */ |
| EC_KEY *co_key; |
| /* Cofactor mode */ |
| signed char cofactor_mode; |
| /* KDF (if any) to use for ECDH */ |
| char kdf_type; |
| /* Message digest to use for key derivation */ |
| const EVP_MD *kdf_md; |
| /* User key material */ |
| unsigned char *kdf_ukm; |
| size_t kdf_ukmlen; |
| /* KDF output length */ |
| size_t kdf_outlen; |
| } EC_PKEY_CTX; |
| |
| static int pkey_ec_init(EVP_PKEY_CTX *ctx) |
| { |
| EC_PKEY_CTX *dctx; |
| |
| if ((dctx = OPENSSL_zalloc(sizeof(*dctx))) == NULL) { |
| ERR_raise(ERR_LIB_EC, ERR_R_MALLOC_FAILURE); |
| return 0; |
| } |
| |
| dctx->cofactor_mode = -1; |
| dctx->kdf_type = EVP_PKEY_ECDH_KDF_NONE; |
| ctx->data = dctx; |
| return 1; |
| } |
| |
| static int pkey_ec_copy(EVP_PKEY_CTX *dst, const EVP_PKEY_CTX *src) |
| { |
| EC_PKEY_CTX *dctx, *sctx; |
| if (!pkey_ec_init(dst)) |
| return 0; |
| sctx = src->data; |
| dctx = dst->data; |
| if (sctx->gen_group) { |
| dctx->gen_group = EC_GROUP_dup(sctx->gen_group); |
| if (!dctx->gen_group) |
| return 0; |
| } |
| dctx->md = sctx->md; |
| |
| if (sctx->co_key) { |
| dctx->co_key = EC_KEY_dup(sctx->co_key); |
| if (!dctx->co_key) |
| return 0; |
| } |
| dctx->kdf_type = sctx->kdf_type; |
| dctx->kdf_md = sctx->kdf_md; |
| dctx->kdf_outlen = sctx->kdf_outlen; |
| if (sctx->kdf_ukm) { |
| dctx->kdf_ukm = OPENSSL_memdup(sctx->kdf_ukm, sctx->kdf_ukmlen); |
| if (!dctx->kdf_ukm) |
| return 0; |
| } else |
| dctx->kdf_ukm = NULL; |
| dctx->kdf_ukmlen = sctx->kdf_ukmlen; |
| return 1; |
| } |
| |
| static void pkey_ec_cleanup(EVP_PKEY_CTX *ctx) |
| { |
| EC_PKEY_CTX *dctx = ctx->data; |
| if (dctx != NULL) { |
| EC_GROUP_free(dctx->gen_group); |
| EC_KEY_free(dctx->co_key); |
| OPENSSL_free(dctx->kdf_ukm); |
| OPENSSL_free(dctx); |
| ctx->data = NULL; |
| } |
| } |
| |
| static int pkey_ec_sign(EVP_PKEY_CTX *ctx, unsigned char *sig, size_t *siglen, |
| const unsigned char *tbs, size_t tbslen) |
| { |
| int ret, type; |
| unsigned int sltmp; |
| EC_PKEY_CTX *dctx = ctx->data; |
| /* |
| * Discard const. Its marked as const because this may be a cached copy of |
| * the "real" key. These calls don't make any modifications that need to |
| * be reflected back in the "original" key. |
| */ |
| EC_KEY *ec = (EC_KEY *)EVP_PKEY_get0_EC_KEY(ctx->pkey); |
| const int sig_sz = ECDSA_size(ec); |
| |
| /* ensure cast to size_t is safe */ |
| if (!ossl_assert(sig_sz > 0)) |
| return 0; |
| |
| if (sig == NULL) { |
| *siglen = (size_t)sig_sz; |
| return 1; |
| } |
| |
| if (*siglen < (size_t)sig_sz) { |
| ERR_raise(ERR_LIB_EC, EC_R_BUFFER_TOO_SMALL); |
| return 0; |
| } |
| |
| type = (dctx->md != NULL) ? EVP_MD_get_type(dctx->md) : NID_sha1; |
| |
| ret = ECDSA_sign(type, tbs, tbslen, sig, &sltmp, ec); |
| |
| if (ret <= 0) |
| return ret; |
| *siglen = (size_t)sltmp; |
| return 1; |
| } |
| |
| static int pkey_ec_verify(EVP_PKEY_CTX *ctx, |
| const unsigned char *sig, size_t siglen, |
| const unsigned char *tbs, size_t tbslen) |
| { |
| int ret, type; |
| EC_PKEY_CTX *dctx = ctx->data; |
| /* |
| * Discard const. Its marked as const because this may be a cached copy of |
| * the "real" key. These calls don't make any modifications that need to |
| * be reflected back in the "original" key. |
| */ |
| EC_KEY *ec = (EC_KEY *)EVP_PKEY_get0_EC_KEY(ctx->pkey); |
| |
| if (dctx->md) |
| type = EVP_MD_get_type(dctx->md); |
| else |
| type = NID_sha1; |
| |
| ret = ECDSA_verify(type, tbs, tbslen, sig, siglen, ec); |
| |
| return ret; |
| } |
| |
| #ifndef OPENSSL_NO_EC |
| static int pkey_ec_derive(EVP_PKEY_CTX *ctx, unsigned char *key, size_t *keylen) |
| { |
| int ret; |
| size_t outlen; |
| const EC_POINT *pubkey = NULL; |
| EC_KEY *eckey; |
| const EC_KEY *eckeypub; |
| EC_PKEY_CTX *dctx = ctx->data; |
| |
| if (ctx->pkey == NULL || ctx->peerkey == NULL) { |
| ERR_raise(ERR_LIB_EC, EC_R_KEYS_NOT_SET); |
| return 0; |
| } |
| eckeypub = EVP_PKEY_get0_EC_KEY(ctx->peerkey); |
| if (eckeypub == NULL) { |
| ERR_raise(ERR_LIB_EC, EC_R_KEYS_NOT_SET); |
| return 0; |
| } |
| |
| eckey = dctx->co_key ? dctx->co_key |
| : (EC_KEY *)EVP_PKEY_get0_EC_KEY(ctx->pkey); |
| |
| if (!key) { |
| const EC_GROUP *group; |
| group = EC_KEY_get0_group(eckey); |
| |
| if (group == NULL) |
| return 0; |
| *keylen = (EC_GROUP_get_degree(group) + 7) / 8; |
| return 1; |
| } |
| pubkey = EC_KEY_get0_public_key(eckeypub); |
| |
| /* |
| * NB: unlike PKCS#3 DH, if *outlen is less than maximum size this is not |
| * an error, the result is truncated. |
| */ |
| |
| outlen = *keylen; |
| |
| ret = ECDH_compute_key(key, outlen, pubkey, eckey, 0); |
| if (ret <= 0) |
| return 0; |
| *keylen = ret; |
| return 1; |
| } |
| |
| static int pkey_ec_kdf_derive(EVP_PKEY_CTX *ctx, |
| unsigned char *key, size_t *keylen) |
| { |
| EC_PKEY_CTX *dctx = ctx->data; |
| unsigned char *ktmp = NULL; |
| size_t ktmplen; |
| int rv = 0; |
| if (dctx->kdf_type == EVP_PKEY_ECDH_KDF_NONE) |
| return pkey_ec_derive(ctx, key, keylen); |
| if (!key) { |
| *keylen = dctx->kdf_outlen; |
| return 1; |
| } |
| if (*keylen != dctx->kdf_outlen) |
| return 0; |
| if (!pkey_ec_derive(ctx, NULL, &ktmplen)) |
| return 0; |
| if ((ktmp = OPENSSL_malloc(ktmplen)) == NULL) { |
| ERR_raise(ERR_LIB_EC, ERR_R_MALLOC_FAILURE); |
| return 0; |
| } |
| if (!pkey_ec_derive(ctx, ktmp, &ktmplen)) |
| goto err; |
| /* Do KDF stuff */ |
| if (!ossl_ecdh_kdf_X9_63(key, *keylen, ktmp, ktmplen, |
| dctx->kdf_ukm, dctx->kdf_ukmlen, dctx->kdf_md, |
| ctx->libctx, ctx->propquery)) |
| goto err; |
| rv = 1; |
| |
| err: |
| OPENSSL_clear_free(ktmp, ktmplen); |
| return rv; |
| } |
| #endif |
| |
| static int pkey_ec_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2) |
| { |
| EC_PKEY_CTX *dctx = ctx->data; |
| EC_GROUP *group; |
| switch (type) { |
| case EVP_PKEY_CTRL_EC_PARAMGEN_CURVE_NID: |
| group = EC_GROUP_new_by_curve_name(p1); |
| if (group == NULL) { |
| ERR_raise(ERR_LIB_EC, EC_R_INVALID_CURVE); |
| return 0; |
| } |
| EC_GROUP_free(dctx->gen_group); |
| dctx->gen_group = group; |
| return 1; |
| |
| case EVP_PKEY_CTRL_EC_PARAM_ENC: |
| if (!dctx->gen_group) { |
| ERR_raise(ERR_LIB_EC, EC_R_NO_PARAMETERS_SET); |
| return 0; |
| } |
| EC_GROUP_set_asn1_flag(dctx->gen_group, p1); |
| return 1; |
| |
| #ifndef OPENSSL_NO_EC |
| case EVP_PKEY_CTRL_EC_ECDH_COFACTOR: |
| if (p1 == -2) { |
| if (dctx->cofactor_mode != -1) |
| return dctx->cofactor_mode; |
| else { |
| const EC_KEY *ec_key = EVP_PKEY_get0_EC_KEY(ctx->pkey); |
| return EC_KEY_get_flags(ec_key) & EC_FLAG_COFACTOR_ECDH ? 1 : 0; |
| } |
| } else if (p1 < -1 || p1 > 1) |
| return -2; |
| dctx->cofactor_mode = p1; |
| if (p1 != -1) { |
| EC_KEY *ec_key = (EC_KEY *)EVP_PKEY_get0_EC_KEY(ctx->pkey); |
| |
| /* |
| * We discarded the "const" above. This will only work if the key is |
| * a "real" legacy key, and not a cached copy of a provided key |
| */ |
| if (evp_pkey_is_provided(ctx->pkey)) { |
| ERR_raise(ERR_LIB_EC, ERR_R_UNSUPPORTED); |
| return 0; |
| } |
| if (!ec_key->group) |
| return -2; |
| /* If cofactor is 1 cofactor mode does nothing */ |
| if (BN_is_one(ec_key->group->cofactor)) |
| return 1; |
| if (!dctx->co_key) { |
| dctx->co_key = EC_KEY_dup(ec_key); |
| if (!dctx->co_key) |
| return 0; |
| } |
| if (p1) |
| EC_KEY_set_flags(dctx->co_key, EC_FLAG_COFACTOR_ECDH); |
| else |
| EC_KEY_clear_flags(dctx->co_key, EC_FLAG_COFACTOR_ECDH); |
| } else { |
| EC_KEY_free(dctx->co_key); |
| dctx->co_key = NULL; |
| } |
| return 1; |
| #endif |
| |
| case EVP_PKEY_CTRL_EC_KDF_TYPE: |
| if (p1 == -2) |
| return dctx->kdf_type; |
| if (p1 != EVP_PKEY_ECDH_KDF_NONE && p1 != EVP_PKEY_ECDH_KDF_X9_63) |
| return -2; |
| dctx->kdf_type = p1; |
| return 1; |
| |
| case EVP_PKEY_CTRL_EC_KDF_MD: |
| dctx->kdf_md = p2; |
| return 1; |
| |
| case EVP_PKEY_CTRL_GET_EC_KDF_MD: |
| *(const EVP_MD **)p2 = dctx->kdf_md; |
| return 1; |
| |
| case EVP_PKEY_CTRL_EC_KDF_OUTLEN: |
| if (p1 <= 0) |
| return -2; |
| dctx->kdf_outlen = (size_t)p1; |
| return 1; |
| |
| case EVP_PKEY_CTRL_GET_EC_KDF_OUTLEN: |
| *(int *)p2 = dctx->kdf_outlen; |
| return 1; |
| |
| case EVP_PKEY_CTRL_EC_KDF_UKM: |
| OPENSSL_free(dctx->kdf_ukm); |
| dctx->kdf_ukm = p2; |
| if (p2) |
| dctx->kdf_ukmlen = p1; |
| else |
| dctx->kdf_ukmlen = 0; |
| return 1; |
| |
| case EVP_PKEY_CTRL_GET_EC_KDF_UKM: |
| *(unsigned char **)p2 = dctx->kdf_ukm; |
| return dctx->kdf_ukmlen; |
| |
| case EVP_PKEY_CTRL_MD: |
| if (EVP_MD_get_type((const EVP_MD *)p2) != NID_sha1 && |
| EVP_MD_get_type((const EVP_MD *)p2) != NID_ecdsa_with_SHA1 && |
| EVP_MD_get_type((const EVP_MD *)p2) != NID_sha224 && |
| EVP_MD_get_type((const EVP_MD *)p2) != NID_sha256 && |
| EVP_MD_get_type((const EVP_MD *)p2) != NID_sha384 && |
| EVP_MD_get_type((const EVP_MD *)p2) != NID_sha512 && |
| EVP_MD_get_type((const EVP_MD *)p2) != NID_sha3_224 && |
| EVP_MD_get_type((const EVP_MD *)p2) != NID_sha3_256 && |
| EVP_MD_get_type((const EVP_MD *)p2) != NID_sha3_384 && |
| EVP_MD_get_type((const EVP_MD *)p2) != NID_sha3_512 && |
| EVP_MD_get_type((const EVP_MD *)p2) != NID_sm3) { |
| ERR_raise(ERR_LIB_EC, EC_R_INVALID_DIGEST_TYPE); |
| return 0; |
| } |
| dctx->md = p2; |
| return 1; |
| |
| case EVP_PKEY_CTRL_GET_MD: |
| *(const EVP_MD **)p2 = dctx->md; |
| return 1; |
| |
| case EVP_PKEY_CTRL_PEER_KEY: |
| /* Default behaviour is OK */ |
| case EVP_PKEY_CTRL_DIGESTINIT: |
| case EVP_PKEY_CTRL_PKCS7_SIGN: |
| case EVP_PKEY_CTRL_CMS_SIGN: |
| return 1; |
| |
| default: |
| return -2; |
| |
| } |
| } |
| |
| static int pkey_ec_ctrl_str(EVP_PKEY_CTX *ctx, |
| const char *type, const char *value) |
| { |
| if (strcmp(type, "ec_paramgen_curve") == 0) { |
| int nid; |
| nid = EC_curve_nist2nid(value); |
| if (nid == NID_undef) |
| nid = OBJ_sn2nid(value); |
| if (nid == NID_undef) |
| nid = OBJ_ln2nid(value); |
| if (nid == NID_undef) { |
| ERR_raise(ERR_LIB_EC, EC_R_INVALID_CURVE); |
| return 0; |
| } |
| return EVP_PKEY_CTX_set_ec_paramgen_curve_nid(ctx, nid); |
| } else if (strcmp(type, "ec_param_enc") == 0) { |
| int param_enc; |
| if (strcmp(value, "explicit") == 0) |
| param_enc = 0; |
| else if (strcmp(value, "named_curve") == 0) |
| param_enc = OPENSSL_EC_NAMED_CURVE; |
| else |
| return -2; |
| return EVP_PKEY_CTX_set_ec_param_enc(ctx, param_enc); |
| } else if (strcmp(type, "ecdh_kdf_md") == 0) { |
| const EVP_MD *md; |
| if ((md = EVP_get_digestbyname(value)) == NULL) { |
| ERR_raise(ERR_LIB_EC, EC_R_INVALID_DIGEST); |
| return 0; |
| } |
| return EVP_PKEY_CTX_set_ecdh_kdf_md(ctx, md); |
| } else if (strcmp(type, "ecdh_cofactor_mode") == 0) { |
| int co_mode; |
| co_mode = atoi(value); |
| return EVP_PKEY_CTX_set_ecdh_cofactor_mode(ctx, co_mode); |
| } |
| |
| return -2; |
| } |
| |
| static int pkey_ec_paramgen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey) |
| { |
| EC_KEY *ec = NULL; |
| EC_PKEY_CTX *dctx = ctx->data; |
| int ret; |
| |
| if (dctx->gen_group == NULL) { |
| ERR_raise(ERR_LIB_EC, EC_R_NO_PARAMETERS_SET); |
| return 0; |
| } |
| ec = EC_KEY_new(); |
| if (ec == NULL) |
| return 0; |
| if (!(ret = EC_KEY_set_group(ec, dctx->gen_group)) |
| || !ossl_assert(ret = EVP_PKEY_assign_EC_KEY(pkey, ec))) |
| EC_KEY_free(ec); |
| return ret; |
| } |
| |
| static int pkey_ec_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey) |
| { |
| EC_KEY *ec = NULL; |
| EC_PKEY_CTX *dctx = ctx->data; |
| int ret; |
| |
| if (ctx->pkey == NULL && dctx->gen_group == NULL) { |
| ERR_raise(ERR_LIB_EC, EC_R_NO_PARAMETERS_SET); |
| return 0; |
| } |
| ec = EC_KEY_new(); |
| if (ec == NULL) |
| return 0; |
| if (!ossl_assert(EVP_PKEY_assign_EC_KEY(pkey, ec))) { |
| EC_KEY_free(ec); |
| return 0; |
| } |
| /* Note: if error is returned, we count on caller to free pkey->pkey.ec */ |
| if (ctx->pkey != NULL) |
| ret = EVP_PKEY_copy_parameters(pkey, ctx->pkey); |
| else |
| ret = EC_KEY_set_group(ec, dctx->gen_group); |
| |
| return ret ? EC_KEY_generate_key(ec) : 0; |
| } |
| |
| static const EVP_PKEY_METHOD ec_pkey_meth = { |
| EVP_PKEY_EC, |
| 0, |
| pkey_ec_init, |
| pkey_ec_copy, |
| pkey_ec_cleanup, |
| |
| 0, |
| pkey_ec_paramgen, |
| |
| 0, |
| pkey_ec_keygen, |
| |
| 0, |
| pkey_ec_sign, |
| |
| 0, |
| pkey_ec_verify, |
| |
| 0, 0, |
| |
| 0, 0, 0, 0, |
| |
| 0, |
| 0, |
| |
| 0, |
| 0, |
| |
| 0, |
| #ifndef OPENSSL_NO_EC |
| pkey_ec_kdf_derive, |
| #else |
| 0, |
| #endif |
| pkey_ec_ctrl, |
| pkey_ec_ctrl_str |
| }; |
| |
| const EVP_PKEY_METHOD *ossl_ec_pkey_method(void) |
| { |
| return &ec_pkey_meth; |
| } |
