/src/openssl30/providers/implementations/kdfs/x942kdf.c
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved. |
3 | | * Copyright (c) 2019, Oracle and/or its affiliates. All rights reserved. |
4 | | * |
5 | | * Licensed under the Apache License 2.0 (the "License"). You may not use |
6 | | * this file except in compliance with the License. You can obtain a copy |
7 | | * in the file LICENSE in the source distribution or at |
8 | | * https://www.openssl.org/source/license.html |
9 | | */ |
10 | | |
11 | | #include "e_os.h" |
12 | | #include <openssl/core_names.h> |
13 | | #include <openssl/core_dispatch.h> |
14 | | #include <openssl/err.h> |
15 | | #include <openssl/evp.h> |
16 | | #include <openssl/params.h> |
17 | | #include <openssl/proverr.h> |
18 | | #include "internal/packet.h" |
19 | | #include "internal/der.h" |
20 | | #include "prov/provider_ctx.h" |
21 | | #include "prov/providercommon.h" |
22 | | #include "prov/implementations.h" |
23 | | #include "prov/provider_util.h" |
24 | | #include "prov/der_wrap.h" |
25 | | |
26 | 0 | #define X942KDF_MAX_INLEN (1 << 30) |
27 | | |
28 | | static OSSL_FUNC_kdf_newctx_fn x942kdf_new; |
29 | | static OSSL_FUNC_kdf_freectx_fn x942kdf_free; |
30 | | static OSSL_FUNC_kdf_reset_fn x942kdf_reset; |
31 | | static OSSL_FUNC_kdf_derive_fn x942kdf_derive; |
32 | | static OSSL_FUNC_kdf_settable_ctx_params_fn x942kdf_settable_ctx_params; |
33 | | static OSSL_FUNC_kdf_set_ctx_params_fn x942kdf_set_ctx_params; |
34 | | static OSSL_FUNC_kdf_gettable_ctx_params_fn x942kdf_gettable_ctx_params; |
35 | | static OSSL_FUNC_kdf_get_ctx_params_fn x942kdf_get_ctx_params; |
36 | | |
37 | | typedef struct { |
38 | | void *provctx; |
39 | | PROV_DIGEST digest; |
40 | | unsigned char *secret; |
41 | | size_t secret_len; |
42 | | unsigned char *acvpinfo; |
43 | | size_t acvpinfo_len; |
44 | | unsigned char *partyuinfo, *partyvinfo, *supp_pubinfo, *supp_privinfo; |
45 | | size_t partyuinfo_len, partyvinfo_len, supp_pubinfo_len, supp_privinfo_len; |
46 | | size_t dkm_len; |
47 | | const unsigned char *cek_oid; |
48 | | size_t cek_oid_len; |
49 | | int use_keybits; |
50 | | } KDF_X942; |
51 | | |
52 | | /* |
53 | | * A table of allowed wrapping algorithms, oids and the associated output |
54 | | * lengths. |
55 | | * NOTE: RC2wrap and camellia128_wrap have been removed as there are no |
56 | | * corresponding ciphers for these operations. |
57 | | */ |
58 | | static const struct { |
59 | | const char *name; |
60 | | const unsigned char *oid; |
61 | | size_t oid_len; |
62 | | size_t keklen; /* size in bytes */ |
63 | | } kek_algs[] = { |
64 | | { "AES-128-WRAP", ossl_der_oid_id_aes128_wrap, DER_OID_SZ_id_aes128_wrap, |
65 | | 16 }, |
66 | | { "AES-192-WRAP", ossl_der_oid_id_aes192_wrap, DER_OID_SZ_id_aes192_wrap, |
67 | | 24 }, |
68 | | { "AES-256-WRAP", ossl_der_oid_id_aes256_wrap, DER_OID_SZ_id_aes256_wrap, |
69 | | 32 }, |
70 | | #ifndef FIPS_MODULE |
71 | | { "DES3-WRAP", ossl_der_oid_id_alg_CMS3DESwrap, |
72 | | DER_OID_SZ_id_alg_CMS3DESwrap, 24 }, |
73 | | #endif |
74 | | }; |
75 | | |
76 | | static int find_alg_id(OSSL_LIB_CTX *libctx, const char *algname, |
77 | | const char *propq, size_t *id) |
78 | 26 | { |
79 | 26 | int ret = 1; |
80 | 26 | size_t i; |
81 | 26 | EVP_CIPHER *cipher; |
82 | | |
83 | 26 | cipher = EVP_CIPHER_fetch(libctx, algname, propq); |
84 | 26 | if (cipher != NULL) { |
85 | 5 | for (i = 0; i < OSSL_NELEM(kek_algs); i++) { |
86 | 4 | if (EVP_CIPHER_is_a(cipher, kek_algs[i].name)) { |
87 | 0 | *id = i; |
88 | 0 | goto end; |
89 | 0 | } |
90 | 4 | } |
91 | 1 | } |
92 | 26 | ret = 0; |
93 | 26 | ERR_raise(ERR_LIB_PROV, PROV_R_UNSUPPORTED_CEK_ALG); |
94 | 26 | end: |
95 | 26 | EVP_CIPHER_free(cipher); |
96 | 26 | return ret; |
97 | 26 | } |
98 | | |
99 | | static int DER_w_keyinfo(WPACKET *pkt, |
100 | | const unsigned char *der_oid, size_t der_oidlen, |
101 | | unsigned char **pcounter) |
102 | 0 | { |
103 | 0 | return ossl_DER_w_begin_sequence(pkt, -1) |
104 | | /* Store the initial value of 1 into the counter */ |
105 | 0 | && ossl_DER_w_octet_string_uint32(pkt, -1, 1) |
106 | | /* Remember where we stored the counter in the buffer */ |
107 | 0 | && (pcounter == NULL |
108 | 0 | || (*pcounter = WPACKET_get_curr(pkt)) != NULL) |
109 | 0 | && ossl_DER_w_precompiled(pkt, -1, der_oid, der_oidlen) |
110 | 0 | && ossl_DER_w_end_sequence(pkt, -1); |
111 | 0 | } |
112 | | |
113 | | static int der_encode_sharedinfo(WPACKET *pkt, unsigned char *buf, size_t buflen, |
114 | | const unsigned char *der_oid, size_t der_oidlen, |
115 | | const unsigned char *acvp, size_t acvplen, |
116 | | const unsigned char *partyu, size_t partyulen, |
117 | | const unsigned char *partyv, size_t partyvlen, |
118 | | const unsigned char *supp_pub, size_t supp_publen, |
119 | | const unsigned char *supp_priv, size_t supp_privlen, |
120 | | uint32_t keylen_bits, unsigned char **pcounter) |
121 | 0 | { |
122 | 0 | return (buf != NULL ? WPACKET_init_der(pkt, buf, buflen) : |
123 | 0 | WPACKET_init_null_der(pkt)) |
124 | 0 | && ossl_DER_w_begin_sequence(pkt, -1) |
125 | 0 | && (supp_priv == NULL |
126 | 0 | || ossl_DER_w_octet_string(pkt, 3, supp_priv, supp_privlen)) |
127 | 0 | && (supp_pub == NULL |
128 | 0 | || ossl_DER_w_octet_string(pkt, 2, supp_pub, supp_publen)) |
129 | 0 | && (keylen_bits == 0 |
130 | 0 | || ossl_DER_w_octet_string_uint32(pkt, 2, keylen_bits)) |
131 | 0 | && (partyv == NULL || ossl_DER_w_octet_string(pkt, 1, partyv, partyvlen)) |
132 | 0 | && (partyu == NULL || ossl_DER_w_octet_string(pkt, 0, partyu, partyulen)) |
133 | 0 | && (acvp == NULL || ossl_DER_w_precompiled(pkt, -1, acvp, acvplen)) |
134 | 0 | && DER_w_keyinfo(pkt, der_oid, der_oidlen, pcounter) |
135 | 0 | && ossl_DER_w_end_sequence(pkt, -1) |
136 | 0 | && WPACKET_finish(pkt); |
137 | 0 | } |
138 | | |
139 | | /* |
140 | | * Encode the other info structure. |
141 | | * |
142 | | * The ANS X9.42-2003 standard uses OtherInfo: |
143 | | * |
144 | | * OtherInfo ::= SEQUENCE { |
145 | | * keyInfo KeySpecificInfo, |
146 | | * partyUInfo [0] OCTET STRING OPTIONAL, |
147 | | * partyVInfo [1] OCTET STRING OPTIONAL, |
148 | | * suppPubInfo [2] OCTET STRING OPTIONAL, |
149 | | * suppPrivInfo [3] OCTET STRING OPTIONAL |
150 | | * } |
151 | | * |
152 | | * KeySpecificInfo ::= SEQUENCE { |
153 | | * algorithm OBJECT IDENTIFIER, |
154 | | * counter OCTET STRING SIZE (4..4) |
155 | | * } |
156 | | * |
157 | | * RFC2631 Section 2.1.2 Contains the following definition for OtherInfo |
158 | | * |
159 | | * OtherInfo ::= SEQUENCE { |
160 | | * keyInfo KeySpecificInfo, |
161 | | * partyAInfo [0] OCTET STRING OPTIONAL, |
162 | | * suppPubInfo [2] OCTET STRING |
163 | | * } |
164 | | * Where suppPubInfo is the key length (in bits) (stored into 4 bytes) |
165 | | * |
166 | | * |keylen| is the length (in bytes) of the generated KEK. It is stored into |
167 | | * suppPubInfo (in bits). It is ignored if the value is 0. |
168 | | * |cek_oid| The oid of the key wrapping algorithm. |
169 | | * |cek_oidlen| The length (in bytes) of the key wrapping algorithm oid, |
170 | | * |acvp| is the optional blob of DER data representing one or more of the |
171 | | * OtherInfo fields related to |partyu|, |partyv|, |supp_pub| and |supp_priv|. |
172 | | * This field should noramlly be NULL. If |acvp| is non NULL then |partyu|, |
173 | | * |partyv|, |supp_pub| and |supp_priv| should all be NULL. |
174 | | * |acvp_len| is the |acvp| length (in bytes). |
175 | | * |partyu| is the optional public info contributed by the initiator. |
176 | | * It can be NULL. (It is also used as the ukm by CMS). |
177 | | * |partyu_len| is the |partyu| length (in bytes). |
178 | | * |partyv| is the optional public info contributed by the responder. |
179 | | * It can be NULL. |
180 | | * |partyv_len| is the |partyv| length (in bytes). |
181 | | * |supp_pub| is the optional additional, mutually-known public information. |
182 | | * It can be NULL. |keylen| should be 0 if this is not NULL. |
183 | | * |supp_pub_len| is the |supp_pub| length (in bytes). |
184 | | * |supp_priv| is the optional additional, mutually-known private information. |
185 | | * It can be NULL. |
186 | | * |supp_priv_len| is the |supp_priv| length (in bytes). |
187 | | * |der| is the returned encoded data. It must be freed by the caller. |
188 | | * |der_len| is the returned size of the encoded data. |
189 | | * |out_ctr| returns a pointer to the counter data which is embedded inside the |
190 | | * encoded data. This allows the counter bytes to be updated without |
191 | | * re-encoding. |
192 | | * |
193 | | * Returns: 1 if successfully encoded, or 0 otherwise. |
194 | | * Assumptions: |der|, |der_len| & |out_ctr| are not NULL. |
195 | | */ |
196 | | static int |
197 | | x942_encode_otherinfo(size_t keylen, |
198 | | const unsigned char *cek_oid, size_t cek_oid_len, |
199 | | const unsigned char *acvp, size_t acvp_len, |
200 | | const unsigned char *partyu, size_t partyu_len, |
201 | | const unsigned char *partyv, size_t partyv_len, |
202 | | const unsigned char *supp_pub, size_t supp_pub_len, |
203 | | const unsigned char *supp_priv, size_t supp_priv_len, |
204 | | unsigned char **der, size_t *der_len, |
205 | | unsigned char **out_ctr) |
206 | 0 | { |
207 | 0 | int ret = 0; |
208 | 0 | unsigned char *pcounter = NULL, *der_buf = NULL; |
209 | 0 | size_t der_buflen = 0; |
210 | 0 | WPACKET pkt; |
211 | 0 | uint32_t keylen_bits; |
212 | | |
213 | | /* keylenbits must fit into 4 bytes */ |
214 | 0 | if (keylen > 0xFFFFFF) |
215 | 0 | return 0; |
216 | 0 | keylen_bits = 8 * keylen; |
217 | | |
218 | | /* Calculate the size of the buffer */ |
219 | 0 | if (!der_encode_sharedinfo(&pkt, NULL, 0, cek_oid, cek_oid_len, |
220 | 0 | acvp, acvp_len, |
221 | 0 | partyu, partyu_len, partyv, partyv_len, |
222 | 0 | supp_pub, supp_pub_len, supp_priv, supp_priv_len, |
223 | 0 | keylen_bits, NULL) |
224 | 0 | || !WPACKET_get_total_written(&pkt, &der_buflen)) |
225 | 0 | goto err; |
226 | 0 | WPACKET_cleanup(&pkt); |
227 | | /* Alloc the buffer */ |
228 | 0 | der_buf = OPENSSL_zalloc(der_buflen); |
229 | 0 | if (der_buf == NULL) |
230 | 0 | goto err; |
231 | | /* Encode into the buffer */ |
232 | 0 | if (!der_encode_sharedinfo(&pkt, der_buf, der_buflen, cek_oid, cek_oid_len, |
233 | 0 | acvp, acvp_len, |
234 | 0 | partyu, partyu_len, partyv, partyv_len, |
235 | 0 | supp_pub, supp_pub_len, supp_priv, supp_priv_len, |
236 | 0 | keylen_bits, &pcounter)) |
237 | 0 | goto err; |
238 | | /* |
239 | | * Since we allocated the exact size required, the buffer should point to the |
240 | | * start of the alllocated buffer at this point. |
241 | | */ |
242 | 0 | if (WPACKET_get_curr(&pkt) != der_buf) |
243 | 0 | goto err; |
244 | | |
245 | | /* |
246 | | * The data for the DER encoded octet string of a 32 bit counter = 1 |
247 | | * should be 04 04 00 00 00 01 |
248 | | * So just check the header is correct and skip over it. |
249 | | * This counter will be incremented in the kdf update loop. |
250 | | */ |
251 | 0 | if (pcounter == NULL |
252 | 0 | || pcounter[0] != 0x04 |
253 | 0 | || pcounter[1] != 0x04) |
254 | 0 | goto err; |
255 | 0 | *out_ctr = (pcounter + 2); |
256 | 0 | *der = der_buf; |
257 | 0 | *der_len = der_buflen; |
258 | 0 | ret = 1; |
259 | 0 | err: |
260 | 0 | WPACKET_cleanup(&pkt); |
261 | 0 | return ret; |
262 | 0 | } |
263 | | |
264 | | static int x942kdf_hash_kdm(const EVP_MD *kdf_md, |
265 | | const unsigned char *z, size_t z_len, |
266 | | const unsigned char *other, size_t other_len, |
267 | | unsigned char *ctr, |
268 | | unsigned char *derived_key, size_t derived_key_len) |
269 | 0 | { |
270 | 0 | int ret = 0, hlen; |
271 | 0 | size_t counter, out_len, len = derived_key_len; |
272 | 0 | unsigned char mac[EVP_MAX_MD_SIZE]; |
273 | 0 | unsigned char *out = derived_key; |
274 | 0 | EVP_MD_CTX *ctx = NULL, *ctx_init = NULL; |
275 | |
|
276 | 0 | if (z_len > X942KDF_MAX_INLEN |
277 | 0 | || other_len > X942KDF_MAX_INLEN |
278 | 0 | || derived_key_len > X942KDF_MAX_INLEN |
279 | 0 | || derived_key_len == 0) { |
280 | 0 | ERR_raise(ERR_LIB_PROV, PROV_R_BAD_LENGTH); |
281 | 0 | return 0; |
282 | 0 | } |
283 | | |
284 | 0 | hlen = EVP_MD_get_size(kdf_md); |
285 | 0 | if (hlen <= 0) |
286 | 0 | return 0; |
287 | 0 | out_len = (size_t)hlen; |
288 | |
|
289 | 0 | ctx = EVP_MD_CTX_create(); |
290 | 0 | ctx_init = EVP_MD_CTX_create(); |
291 | 0 | if (ctx == NULL || ctx_init == NULL) |
292 | 0 | goto end; |
293 | | |
294 | 0 | if (!EVP_DigestInit(ctx_init, kdf_md)) |
295 | 0 | goto end; |
296 | | |
297 | 0 | for (counter = 1;; counter++) { |
298 | | /* updating the ctr modifies 4 bytes in the 'other' buffer */ |
299 | 0 | ctr[0] = (unsigned char)((counter >> 24) & 0xff); |
300 | 0 | ctr[1] = (unsigned char)((counter >> 16) & 0xff); |
301 | 0 | ctr[2] = (unsigned char)((counter >> 8) & 0xff); |
302 | 0 | ctr[3] = (unsigned char)(counter & 0xff); |
303 | |
|
304 | 0 | if (!EVP_MD_CTX_copy_ex(ctx, ctx_init) |
305 | 0 | || !EVP_DigestUpdate(ctx, z, z_len) |
306 | 0 | || !EVP_DigestUpdate(ctx, other, other_len)) |
307 | 0 | goto end; |
308 | 0 | if (len >= out_len) { |
309 | 0 | if (!EVP_DigestFinal_ex(ctx, out, NULL)) |
310 | 0 | goto end; |
311 | 0 | out += out_len; |
312 | 0 | len -= out_len; |
313 | 0 | if (len == 0) |
314 | 0 | break; |
315 | 0 | } else { |
316 | 0 | if (!EVP_DigestFinal_ex(ctx, mac, NULL)) |
317 | 0 | goto end; |
318 | 0 | memcpy(out, mac, len); |
319 | 0 | break; |
320 | 0 | } |
321 | 0 | } |
322 | 0 | ret = 1; |
323 | 0 | end: |
324 | 0 | EVP_MD_CTX_free(ctx); |
325 | 0 | EVP_MD_CTX_free(ctx_init); |
326 | 0 | OPENSSL_cleanse(mac, sizeof(mac)); |
327 | 0 | return ret; |
328 | 0 | } |
329 | | |
330 | | static void *x942kdf_new(void *provctx) |
331 | 34 | { |
332 | 34 | KDF_X942 *ctx; |
333 | | |
334 | 34 | if (!ossl_prov_is_running()) |
335 | 0 | return NULL; |
336 | | |
337 | 34 | if ((ctx = OPENSSL_zalloc(sizeof(*ctx))) == NULL) { |
338 | 0 | ERR_raise(ERR_LIB_PROV, ERR_R_MALLOC_FAILURE); |
339 | 0 | return NULL; |
340 | 0 | } |
341 | 34 | ctx->provctx = provctx; |
342 | 34 | ctx->use_keybits = 1; |
343 | 34 | return ctx; |
344 | 34 | } |
345 | | |
346 | | static void x942kdf_reset(void *vctx) |
347 | 34 | { |
348 | 34 | KDF_X942 *ctx = (KDF_X942 *)vctx; |
349 | 34 | void *provctx = ctx->provctx; |
350 | | |
351 | 34 | ossl_prov_digest_reset(&ctx->digest); |
352 | 34 | OPENSSL_clear_free(ctx->secret, ctx->secret_len); |
353 | 34 | OPENSSL_clear_free(ctx->acvpinfo, ctx->acvpinfo_len); |
354 | 34 | OPENSSL_clear_free(ctx->partyuinfo, ctx->partyuinfo_len); |
355 | 34 | OPENSSL_clear_free(ctx->partyvinfo, ctx->partyvinfo_len); |
356 | 34 | OPENSSL_clear_free(ctx->supp_pubinfo, ctx->supp_pubinfo_len); |
357 | 34 | OPENSSL_clear_free(ctx->supp_privinfo, ctx->supp_privinfo_len); |
358 | 34 | memset(ctx, 0, sizeof(*ctx)); |
359 | 34 | ctx->provctx = provctx; |
360 | 34 | ctx->use_keybits = 1; |
361 | 34 | } |
362 | | |
363 | | static void x942kdf_free(void *vctx) |
364 | 34 | { |
365 | 34 | KDF_X942 *ctx = (KDF_X942 *)vctx; |
366 | | |
367 | 34 | if (ctx != NULL) { |
368 | 34 | x942kdf_reset(ctx); |
369 | 34 | OPENSSL_free(ctx); |
370 | 34 | } |
371 | 34 | } |
372 | | |
373 | | static int x942kdf_set_buffer(unsigned char **out, size_t *out_len, |
374 | | const OSSL_PARAM *p) |
375 | 156 | { |
376 | 156 | if (p->data_size == 0 || p->data == NULL) |
377 | 106 | return 1; |
378 | | |
379 | 50 | OPENSSL_free(*out); |
380 | 50 | *out = NULL; |
381 | 50 | return OSSL_PARAM_get_octet_string(p, (void **)out, 0, out_len); |
382 | 156 | } |
383 | | |
384 | | static size_t x942kdf_size(KDF_X942 *ctx) |
385 | 0 | { |
386 | 0 | int len; |
387 | 0 | const EVP_MD *md = ossl_prov_digest_md(&ctx->digest); |
388 | |
|
389 | 0 | if (md == NULL) { |
390 | 0 | ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_MESSAGE_DIGEST); |
391 | 0 | return 0; |
392 | 0 | } |
393 | 0 | len = EVP_MD_get_size(md); |
394 | 0 | return (len <= 0) ? 0 : (size_t)len; |
395 | 0 | } |
396 | | |
397 | | static int x942kdf_derive(void *vctx, unsigned char *key, size_t keylen, |
398 | | const OSSL_PARAM params[]) |
399 | 0 | { |
400 | 0 | KDF_X942 *ctx = (KDF_X942 *)vctx; |
401 | 0 | const EVP_MD *md; |
402 | 0 | int ret = 0; |
403 | 0 | unsigned char *ctr; |
404 | 0 | unsigned char *der = NULL; |
405 | 0 | size_t der_len = 0; |
406 | |
|
407 | 0 | if (!ossl_prov_is_running() || !x942kdf_set_ctx_params(ctx, params)) |
408 | 0 | return 0; |
409 | | |
410 | | /* |
411 | | * These 2 options encode to the same field so only one of them should be |
412 | | * active at once. |
413 | | */ |
414 | 0 | if (ctx->use_keybits && ctx->supp_pubinfo != NULL) { |
415 | 0 | ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_PUBINFO); |
416 | 0 | return 0; |
417 | 0 | } |
418 | | /* |
419 | | * If the blob of acvp data is used then the individual info fields that it |
420 | | * replaces should not also be defined. |
421 | | */ |
422 | 0 | if (ctx->acvpinfo != NULL |
423 | 0 | && (ctx->partyuinfo != NULL |
424 | 0 | || ctx->partyvinfo != NULL |
425 | 0 | || ctx->supp_pubinfo != NULL |
426 | 0 | || ctx->supp_privinfo != NULL)) { |
427 | 0 | ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_DATA); |
428 | 0 | return 0; |
429 | 0 | } |
430 | 0 | if (ctx->secret == NULL) { |
431 | 0 | ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_SECRET); |
432 | 0 | return 0; |
433 | 0 | } |
434 | 0 | md = ossl_prov_digest_md(&ctx->digest); |
435 | 0 | if (md == NULL) { |
436 | 0 | ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_MESSAGE_DIGEST); |
437 | 0 | return 0; |
438 | 0 | } |
439 | 0 | if (ctx->cek_oid == NULL || ctx->cek_oid_len == 0) { |
440 | 0 | ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_CEK_ALG); |
441 | 0 | return 0; |
442 | 0 | } |
443 | 0 | if (ctx->partyuinfo != NULL && ctx->partyuinfo_len >= X942KDF_MAX_INLEN) { |
444 | | /* |
445 | | * Note the ukm length MUST be 512 bits if it is used. |
446 | | * For backwards compatibility the old check is being done. |
447 | | */ |
448 | 0 | ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_UKM_LENGTH); |
449 | 0 | return 0; |
450 | 0 | } |
451 | | /* generate the otherinfo der */ |
452 | 0 | if (!x942_encode_otherinfo(ctx->use_keybits ? ctx->dkm_len : 0, |
453 | 0 | ctx->cek_oid, ctx->cek_oid_len, |
454 | 0 | ctx->acvpinfo, ctx->acvpinfo_len, |
455 | 0 | ctx->partyuinfo, ctx->partyuinfo_len, |
456 | 0 | ctx->partyvinfo, ctx->partyvinfo_len, |
457 | 0 | ctx->supp_pubinfo, ctx->supp_pubinfo_len, |
458 | 0 | ctx->supp_privinfo, ctx->supp_privinfo_len, |
459 | 0 | &der, &der_len, &ctr)) { |
460 | 0 | ERR_raise(ERR_LIB_PROV, PROV_R_BAD_ENCODING); |
461 | 0 | return 0; |
462 | 0 | } |
463 | 0 | ret = x942kdf_hash_kdm(md, ctx->secret, ctx->secret_len, |
464 | 0 | der, der_len, ctr, key, keylen); |
465 | 0 | OPENSSL_free(der); |
466 | 0 | return ret; |
467 | 0 | } |
468 | | |
469 | | static int x942kdf_set_ctx_params(void *vctx, const OSSL_PARAM params[]) |
470 | | { |
471 | | const OSSL_PARAM *p, *pq; |
472 | | KDF_X942 *ctx = vctx; |
473 | | OSSL_LIB_CTX *provctx = PROV_LIBCTX_OF(ctx->provctx); |
474 | | const char *propq = NULL; |
475 | | size_t id; |
476 | | |
477 | | if (params == NULL) |
478 | | return 1; |
479 | | if (!ossl_prov_digest_load_from_params(&ctx->digest, params, provctx)) |
480 | | return 0; |
481 | | |
482 | | p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_SECRET); |
483 | | if (p == NULL) |
484 | | p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_KEY); |
485 | | if (p != NULL && !x942kdf_set_buffer(&ctx->secret, &ctx->secret_len, p)) |
486 | | return 0; |
487 | | |
488 | | p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_X942_ACVPINFO); |
489 | | if (p != NULL |
490 | | && !x942kdf_set_buffer(&ctx->acvpinfo, &ctx->acvpinfo_len, p)) |
491 | | return 0; |
492 | | |
493 | | p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_X942_PARTYUINFO); |
494 | | if (p == NULL) |
495 | | p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_UKM); |
496 | | if (p != NULL |
497 | | && !x942kdf_set_buffer(&ctx->partyuinfo, &ctx->partyuinfo_len, p)) |
498 | | return 0; |
499 | | |
500 | | p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_X942_PARTYVINFO); |
501 | | if (p != NULL |
502 | | && !x942kdf_set_buffer(&ctx->partyvinfo, &ctx->partyvinfo_len, p)) |
503 | | return 0; |
504 | | |
505 | | p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_X942_USE_KEYBITS); |
506 | | if (p != NULL && !OSSL_PARAM_get_int(p, &ctx->use_keybits)) |
507 | | return 0; |
508 | | |
509 | | p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_X942_SUPP_PUBINFO); |
510 | | if (p != NULL) { |
511 | | if (!x942kdf_set_buffer(&ctx->supp_pubinfo, &ctx->supp_pubinfo_len, p)) |
512 | | return 0; |
513 | | ctx->use_keybits = 0; |
514 | | } |
515 | | |
516 | | p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_X942_SUPP_PRIVINFO); |
517 | | if (p != NULL |
518 | | && !x942kdf_set_buffer(&ctx->supp_privinfo, &ctx->supp_privinfo_len, p)) |
519 | | return 0; |
520 | | |
521 | | p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_CEK_ALG); |
522 | | if (p != NULL) { |
523 | | if (p->data_type != OSSL_PARAM_UTF8_STRING) |
524 | | return 0; |
525 | | pq = OSSL_PARAM_locate_const(params, OSSL_ALG_PARAM_PROPERTIES); |
526 | | /* |
527 | | * We already grab the properties during ossl_prov_digest_load_from_params() |
528 | | * so there is no need to check the validity again.. |
529 | | */ |
530 | | if (pq != NULL) |
531 | | propq = p->data; |
532 | | if (find_alg_id(provctx, p->data, propq, &id) == 0) |
533 | | return 0; |
534 | | ctx->cek_oid = kek_algs[id].oid; |
535 | | ctx->cek_oid_len = kek_algs[id].oid_len; |
536 | | ctx->dkm_len = kek_algs[id].keklen; |
537 | | } |
538 | | return 1; |
539 | | } |
540 | | |
541 | | static const OSSL_PARAM *x942kdf_settable_ctx_params(ossl_unused void *ctx, |
542 | | ossl_unused void *provctx) |
543 | 34 | { |
544 | 34 | static const OSSL_PARAM known_settable_ctx_params[] = { |
545 | 34 | OSSL_PARAM_utf8_string(OSSL_KDF_PARAM_PROPERTIES, NULL, 0), |
546 | 34 | OSSL_PARAM_utf8_string(OSSL_KDF_PARAM_DIGEST, NULL, 0), |
547 | 34 | OSSL_PARAM_octet_string(OSSL_KDF_PARAM_SECRET, NULL, 0), |
548 | 34 | OSSL_PARAM_octet_string(OSSL_KDF_PARAM_KEY, NULL, 0), |
549 | 34 | OSSL_PARAM_octet_string(OSSL_KDF_PARAM_UKM, NULL, 0), |
550 | 34 | OSSL_PARAM_octet_string(OSSL_KDF_PARAM_X942_ACVPINFO, NULL, 0), |
551 | 34 | OSSL_PARAM_octet_string(OSSL_KDF_PARAM_X942_PARTYUINFO, NULL, 0), |
552 | 34 | OSSL_PARAM_octet_string(OSSL_KDF_PARAM_X942_PARTYVINFO, NULL, 0), |
553 | 34 | OSSL_PARAM_octet_string(OSSL_KDF_PARAM_X942_SUPP_PUBINFO, NULL, 0), |
554 | 34 | OSSL_PARAM_octet_string(OSSL_KDF_PARAM_X942_SUPP_PRIVINFO, NULL, 0), |
555 | 34 | OSSL_PARAM_int(OSSL_KDF_PARAM_X942_USE_KEYBITS, NULL), |
556 | 34 | OSSL_PARAM_utf8_string(OSSL_KDF_PARAM_CEK_ALG, NULL, 0), |
557 | 34 | OSSL_PARAM_END |
558 | 34 | }; |
559 | 34 | return known_settable_ctx_params; |
560 | 34 | } |
561 | | |
562 | | static int x942kdf_get_ctx_params(void *vctx, OSSL_PARAM params[]) |
563 | 0 | { |
564 | 0 | KDF_X942 *ctx = (KDF_X942 *)vctx; |
565 | 0 | OSSL_PARAM *p; |
566 | |
|
567 | 0 | if ((p = OSSL_PARAM_locate(params, OSSL_KDF_PARAM_SIZE)) != NULL) |
568 | 0 | return OSSL_PARAM_set_size_t(p, x942kdf_size(ctx)); |
569 | 0 | return -2; |
570 | 0 | } |
571 | | |
572 | | static const OSSL_PARAM *x942kdf_gettable_ctx_params(ossl_unused void *ctx, |
573 | | ossl_unused void *provctx) |
574 | 0 | { |
575 | 0 | static const OSSL_PARAM known_gettable_ctx_params[] = { |
576 | 0 | OSSL_PARAM_size_t(OSSL_KDF_PARAM_SIZE, NULL), |
577 | 0 | OSSL_PARAM_END |
578 | 0 | }; |
579 | 0 | return known_gettable_ctx_params; |
580 | 0 | } |
581 | | |
582 | | const OSSL_DISPATCH ossl_kdf_x942_kdf_functions[] = { |
583 | | { OSSL_FUNC_KDF_NEWCTX, (void(*)(void))x942kdf_new }, |
584 | | { OSSL_FUNC_KDF_FREECTX, (void(*)(void))x942kdf_free }, |
585 | | { OSSL_FUNC_KDF_RESET, (void(*)(void))x942kdf_reset }, |
586 | | { OSSL_FUNC_KDF_DERIVE, (void(*)(void))x942kdf_derive }, |
587 | | { OSSL_FUNC_KDF_SETTABLE_CTX_PARAMS, |
588 | | (void(*)(void))x942kdf_settable_ctx_params }, |
589 | | { OSSL_FUNC_KDF_SET_CTX_PARAMS, (void(*)(void))x942kdf_set_ctx_params }, |
590 | | { OSSL_FUNC_KDF_GETTABLE_CTX_PARAMS, |
591 | | (void(*)(void))x942kdf_gettable_ctx_params }, |
592 | | { OSSL_FUNC_KDF_GET_CTX_PARAMS, (void(*)(void))x942kdf_get_ctx_params }, |
593 | | { 0, NULL } |
594 | | }; |