/src/openssl36/crypto/pkcs12/p12_mutl.c

Source
/*
 * Copyright 1999-2026 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

/*
 * HMAC low level APIs are deprecated for public use, but still ok for internal
 * use.
 */
#include "internal/deprecated.h"

#include <stdio.h>
#include "internal/cryptlib.h"
#include "crypto/evp.h"
#include <openssl/crypto.h>
#include <openssl/hmac.h>
#include <openssl/rand.h>
#include <openssl/pkcs12.h>
#include "p12_local.h"

static int pkcs12_pbmac1_pbkdf2_key_gen(const char *pass, int passlen,
    unsigned char *salt, int saltlen,
    int id, int iter, int keylen,
    unsigned char *out,
    const EVP_MD *md_type);

int PKCS12_mac_present(const PKCS12 *p12)
{
    return p12->mac ? 1 : 0;
}

void PKCS12_get0_mac(const ASN1_OCTET_STRING **pmac,
    const X509_ALGOR **pmacalg,
    const ASN1_OCTET_STRING **psalt,
    const ASN1_INTEGER **piter,
    const PKCS12 *p12)
{
    if (p12->mac) {
        X509_SIG_get0(p12->mac->dinfo, pmacalg, pmac);
        if (psalt)
            *psalt = p12->mac->salt;
        if (piter)
            *piter = p12->mac->iter;
    } else {
        if (pmac)
            *pmac = NULL;
        if (pmacalg)
            *pmacalg = NULL;
        if (psalt)
            *psalt = NULL;
        if (piter)
            *piter = NULL;
    }
}

#define TK26_MAC_KEY_LEN 32

static int pkcs12_gen_gost_mac_key(const char *pass, int passlen,
    const unsigned char *salt, int saltlen,
    int iter, int keylen, unsigned char *key,
    const EVP_MD *digest)
{
    unsigned char out[96];

    if (keylen != TK26_MAC_KEY_LEN) {
        return 0;
    }

    if (!PKCS5_PBKDF2_HMAC(pass, passlen, salt, saltlen, iter,
            digest, sizeof(out), out)) {
        return 0;
    }
    memcpy(key, out + sizeof(out) - TK26_MAC_KEY_LEN, TK26_MAC_KEY_LEN);
    OPENSSL_cleanse(out, sizeof(out));
    return 1;
}

PBKDF2PARAM *PBMAC1_get1_pbkdf2_param(const X509_ALGOR *macalg)
{
    PBMAC1PARAM *param = NULL;
    PBKDF2PARAM *pbkdf2_param = NULL;
    const ASN1_OBJECT *kdf_oid;

    param = ASN1_TYPE_unpack_sequence(ASN1_ITEM_rptr(PBMAC1PARAM), macalg->parameter);
    if (param == NULL) {
        ERR_raise(ERR_LIB_PKCS12, ERR_R_PASSED_INVALID_ARGUMENT);
        return NULL;
    }

    X509_ALGOR_get0(&kdf_oid, NULL, NULL, param->keyDerivationFunc);
    if (OBJ_obj2nid(kdf_oid) != NID_id_pbkdf2) {
        ERR_raise(ERR_LIB_PKCS12, ERR_R_PASSED_INVALID_ARGUMENT);
        PBMAC1PARAM_free(param);
        return NULL;
    }

    pbkdf2_param = ASN1_TYPE_unpack_sequence(ASN1_ITEM_rptr(PBKDF2PARAM),
        param->keyDerivationFunc->parameter);
    PBMAC1PARAM_free(param);

    return pbkdf2_param;
}

static int PBMAC1_PBKDF2_HMAC(OSSL_LIB_CTX *ctx, const char *propq,
    const char *pass, int passlen,
    const X509_ALGOR *macalg, unsigned char *key)
{
    PBKDF2PARAM *pbkdf2_param = NULL;
    const ASN1_OBJECT *kdf_hmac_oid;
    int kdf_hmac_nid;
    int ret = -1;
    int keylen = 0;
    EVP_MD *kdf_md = NULL;
    const ASN1_OCTET_STRING *pbkdf2_salt = NULL;

    pbkdf2_param = PBMAC1_get1_pbkdf2_param(macalg);
    if (pbkdf2_param == NULL) {
        ERR_raise(ERR_LIB_PKCS12, ERR_R_UNSUPPORTED);
        goto err;
    }

    if (pbkdf2_param->prf == NULL) {
        kdf_hmac_nid = NID_hmacWithSHA1;
    } else {
        X509_ALGOR_get0(&kdf_hmac_oid, NULL, NULL, pbkdf2_param->prf);
        kdf_hmac_nid = OBJ_obj2nid(kdf_hmac_oid);
    }

    kdf_md = EVP_MD_fetch(ctx, OBJ_nid2sn(ossl_hmac2mdnid(kdf_hmac_nid)), propq);
    if (kdf_md == NULL) {
        ERR_raise(ERR_LIB_PKCS12, ERR_R_FETCH_FAILED);
        goto err;
    }

    /* Validate salt is an OCTET STRING choice */
    if (pbkdf2_param->salt == NULL
        || pbkdf2_param->salt->type != V_ASN1_OCTET_STRING) {
        ERR_raise(ERR_LIB_PKCS12, PKCS12_R_PARSE_ERROR);
        goto err;
    }
    pbkdf2_salt = pbkdf2_param->salt->value.octet_string;

    /* RFC 9579 specifies missing key length as invalid */
    if (pbkdf2_param->keylength != NULL)
        keylen = ASN1_INTEGER_get(pbkdf2_param->keylength);
    if (keylen <= 0 || keylen > EVP_MAX_MD_SIZE) {
        ERR_raise(ERR_LIB_PKCS12, PKCS12_R_PARSE_ERROR);
        goto err;
    }

    if (PKCS5_PBKDF2_HMAC(pass, passlen, pbkdf2_salt->data, pbkdf2_salt->length,
            ASN1_INTEGER_get(pbkdf2_param->iter), kdf_md, keylen, key)
        <= 0) {
        ERR_raise(ERR_LIB_PKCS12, ERR_R_INTERNAL_ERROR);
        goto err;
    }
    ret = keylen;

err:
    EVP_MD_free(kdf_md);
    PBKDF2PARAM_free(pbkdf2_param);

    return ret;
}

/* Generate a MAC, also used for verification */
static int pkcs12_gen_mac(PKCS12 *p12, const char *pass, int passlen,
    unsigned char *mac, unsigned int *maclen,
    int pbmac1_md_nid, int pbmac1_kdf_nid,
    int (*pkcs12_key_gen)(const char *pass, int passlen,
        unsigned char *salt, int slen,
        int id, int iter, int n,
        unsigned char *out,
        const EVP_MD *md_type))
{
    int ret = 0;
    const EVP_MD *md;
    EVP_MD *md_fetch;
    HMAC_CTX *hmac = NULL;
    unsigned char key[EVP_MAX_MD_SIZE], *salt;
    int saltlen, iter;
    char md_name[80];
    int keylen = 0;
    int md_nid = NID_undef;
    const X509_ALGOR *macalg;
    const ASN1_OBJECT *macoid;

    if (!PKCS7_type_is_data(p12->authsafes)) {
        ERR_raise(ERR_LIB_PKCS12, PKCS12_R_CONTENT_TYPE_NOT_DATA);
        return 0;
    }

    if (p12->authsafes->d.data == NULL) {
        ERR_raise(ERR_LIB_PKCS12, PKCS12_R_DECODE_ERROR);
        return 0;
    }

    salt = p12->mac->salt->data;
    saltlen = p12->mac->salt->length;
    if (p12->mac->iter == NULL)
        iter = 1;
    else
        iter = ASN1_INTEGER_get(p12->mac->iter);
    X509_SIG_get0(p12->mac->dinfo, &macalg, NULL);
    X509_ALGOR_get0(&macoid, NULL, NULL, macalg);
    if (OBJ_obj2nid(macoid) == NID_pbmac1) {
        if (OBJ_obj2txt(md_name, sizeof(md_name), OBJ_nid2obj(pbmac1_md_nid), 0) < 0)
            return 0;
    } else {
        if (OBJ_obj2txt(md_name, sizeof(md_name), macoid, 0) < 0)
            return 0;
    }
    (void)ERR_set_mark();
    md = md_fetch = EVP_MD_fetch(p12->authsafes->ctx.libctx, md_name,
        p12->authsafes->ctx.propq);
    if (md == NULL)
        md = EVP_get_digestbynid(OBJ_obj2nid(macoid));

    if (md == NULL) {
        (void)ERR_clear_last_mark();
        ERR_raise(ERR_LIB_PKCS12, PKCS12_R_UNKNOWN_DIGEST_ALGORITHM);
        return 0;
    }
    (void)ERR_pop_to_mark();

    keylen = EVP_MD_get_size(md);
    md_nid = EVP_MD_get_type(md);
    if (keylen <= 0)
        goto err;

    /* For PBMAC1 we use a special keygen callback if not provided (e.g. on verification) */
    if (pbmac1_md_nid != NID_undef && pkcs12_key_gen == NULL) {
        keylen = PBMAC1_PBKDF2_HMAC(p12->authsafes->ctx.libctx, p12->authsafes->ctx.propq,
            pass, passlen, macalg, key);
        if (keylen < 0)
            goto err;
    } else if ((md_nid == NID_id_GostR3411_94
                   || md_nid == NID_id_GostR3411_2012_256
                   || md_nid == NID_id_GostR3411_2012_512)
        && ossl_safe_getenv("LEGACY_GOST_PKCS12") == NULL) {
        keylen = TK26_MAC_KEY_LEN;
        if (!pkcs12_gen_gost_mac_key(pass, passlen, salt, saltlen, iter,
                keylen, key, md)) {
            ERR_raise(ERR_LIB_PKCS12, PKCS12_R_KEY_GEN_ERROR);
            goto err;
        }
    } else {
        EVP_MD *hmac_md = (EVP_MD *)md;
        int fetched = 0;

        if (pbmac1_kdf_nid != NID_undef) {
            char hmac_md_name[128];

            if (OBJ_obj2txt(hmac_md_name, sizeof(hmac_md_name), OBJ_nid2obj(pbmac1_kdf_nid), 0) < 0)
                goto err;
            hmac_md = EVP_MD_fetch(NULL, hmac_md_name, NULL);
            if (hmac_md == NULL)
                goto err;
            fetched = 1;
        }
        if (pkcs12_key_gen != NULL) {
            int res = (*pkcs12_key_gen)(pass, passlen, salt, saltlen, PKCS12_MAC_ID,
                iter, keylen, key, hmac_md);

            if (fetched)
                EVP_MD_free(hmac_md);
            if (res != 1) {
                ERR_raise(ERR_LIB_PKCS12, PKCS12_R_KEY_GEN_ERROR);
                goto err;
            }
        } else {
            if (fetched)
                EVP_MD_free(hmac_md);
            /* Default to UTF-8 password */
            if (!PKCS12_key_gen_utf8_ex(pass, passlen, salt, saltlen, PKCS12_MAC_ID,
                    iter, keylen, key, md,
                    p12->authsafes->ctx.libctx, p12->authsafes->ctx.propq)) {
                ERR_raise(ERR_LIB_PKCS12, PKCS12_R_KEY_GEN_ERROR);
                goto err;
            }
        }
    }
    if ((hmac = HMAC_CTX_new()) == NULL
        || !HMAC_Init_ex(hmac, key, keylen, md, NULL)
        || !HMAC_Update(hmac, p12->authsafes->d.data->data,
            p12->authsafes->d.data->length)
        || !HMAC_Final(hmac, mac, maclen)) {
        goto err;
    }
    ret = 1;

err:
    OPENSSL_cleanse(key, sizeof(key));
    HMAC_CTX_free(hmac);
    EVP_MD_free(md_fetch);
    return ret;
}

int PKCS12_gen_mac(PKCS12 *p12, const char *pass, int passlen,
    unsigned char *mac, unsigned int *maclen)
{
    return pkcs12_gen_mac(p12, pass, passlen, mac, maclen, NID_undef, NID_undef, NULL);
}

/* Verify the mac */
int PKCS12_verify_mac(PKCS12 *p12, const char *pass, int passlen)
{
    unsigned char mac[EVP_MAX_MD_SIZE];
    unsigned int maclen;
    const ASN1_OCTET_STRING *macoct;
    const X509_ALGOR *macalg;
    const ASN1_OBJECT *macoid;

    if (p12->mac == NULL) {
        ERR_raise(ERR_LIB_PKCS12, PKCS12_R_MAC_ABSENT);
        return 0;
    }

    X509_SIG_get0(p12->mac->dinfo, &macalg, NULL);
    X509_ALGOR_get0(&macoid, NULL, NULL, macalg);
    if (OBJ_obj2nid(macoid) == NID_pbmac1) {
        PBMAC1PARAM *param = NULL;
        const ASN1_OBJECT *hmac_oid;
        int md_nid = NID_undef;

        param = ASN1_TYPE_unpack_sequence(ASN1_ITEM_rptr(PBMAC1PARAM), macalg->parameter);
        if (param == NULL) {
            ERR_raise(ERR_LIB_PKCS12, ERR_R_UNSUPPORTED);
            return 0;
        }
        X509_ALGOR_get0(&hmac_oid, NULL, NULL, param->messageAuthScheme);
        md_nid = ossl_hmac2mdnid(OBJ_obj2nid(hmac_oid));

        if (!pkcs12_gen_mac(p12, pass, passlen, mac, &maclen, md_nid, NID_undef, NULL)) {
            ERR_raise(ERR_LIB_PKCS12, PKCS12_R_MAC_GENERATION_ERROR);
            PBMAC1PARAM_free(param);
            return 0;
        }
        PBMAC1PARAM_free(param);
    } else {
        if (!pkcs12_gen_mac(p12, pass, passlen, mac, &maclen, NID_undef, NID_undef, NULL)) {
            ERR_raise(ERR_LIB_PKCS12, PKCS12_R_MAC_GENERATION_ERROR);
            return 0;
        }
    }
    X509_SIG_get0(p12->mac->dinfo, NULL, &macoct);
    if ((maclen != (unsigned int)ASN1_STRING_length(macoct))
        || CRYPTO_memcmp(mac, ASN1_STRING_get0_data(macoct), maclen) != 0)
        return 0;

    return 1;
}

/* Set a mac */
int PKCS12_set_mac(PKCS12 *p12, const char *pass, int passlen,
    unsigned char *salt, int saltlen, int iter,
    const EVP_MD *md_type)
{
    unsigned char mac[EVP_MAX_MD_SIZE];
    unsigned int maclen;
    ASN1_OCTET_STRING *macoct;

    if (md_type == NULL)
        /* No need to do a fetch as the md_type is used only to get a NID */
        md_type = EVP_sha256();
    if (!iter)
        iter = PKCS12_DEFAULT_ITER;
    if (PKCS12_setup_mac(p12, iter, salt, saltlen, md_type) == PKCS12_ERROR) {
        ERR_raise(ERR_LIB_PKCS12, PKCS12_R_MAC_SETUP_ERROR);
        return 0;
    }
    /*
     * Note that output mac is forced to UTF-8...
     */
    if (!pkcs12_gen_mac(p12, pass, passlen, mac, &maclen, NID_undef, NID_undef, NULL)) {
        ERR_raise(ERR_LIB_PKCS12, PKCS12_R_MAC_GENERATION_ERROR);
        return 0;
    }
    X509_SIG_getm(p12->mac->dinfo, NULL, &macoct);
    if (!ASN1_OCTET_STRING_set(macoct, mac, maclen)) {
        ERR_raise(ERR_LIB_PKCS12, PKCS12_R_MAC_STRING_SET_ERROR);
        return 0;
    }
    return 1;
}

static int pkcs12_pbmac1_pbkdf2_key_gen(const char *pass, int passlen,
    unsigned char *salt, int saltlen,
    int id, int iter, int keylen,
    unsigned char *out,
    const EVP_MD *md_type)
{
    return PKCS5_PBKDF2_HMAC(pass, passlen, salt, saltlen, iter,
        md_type, keylen, out);
}

static int pkcs12_setup_mac(PKCS12 *p12, int iter, unsigned char *salt, int saltlen,
    int nid)
{
    X509_ALGOR *macalg;

    PKCS12_MAC_DATA_free(p12->mac);
    p12->mac = NULL;

    if ((p12->mac = PKCS12_MAC_DATA_new()) == NULL)
        return PKCS12_ERROR;
    if (iter > 1) {
        if ((p12->mac->iter = ASN1_INTEGER_new()) == NULL) {
            ERR_raise(ERR_LIB_PKCS12, ERR_R_ASN1_LIB);
            return 0;
        }
        if (!ASN1_INTEGER_set(p12->mac->iter, iter)) {
            ERR_raise(ERR_LIB_PKCS12, ERR_R_ASN1_LIB);
            return 0;
        }
    }
    if (saltlen == 0)
        saltlen = PKCS12_SALT_LEN;
    else if (saltlen < 0)
        return 0;
    if ((p12->mac->salt->data = OPENSSL_malloc(saltlen)) == NULL)
        return 0;
    p12->mac->salt->length = saltlen;
    if (salt == NULL) {
        if (RAND_bytes_ex(p12->authsafes->ctx.libctx, p12->mac->salt->data,
                (size_t)saltlen, 0)
            <= 0)
            return 0;
    } else {
        memcpy(p12->mac->salt->data, salt, saltlen);
    }
    X509_SIG_getm(p12->mac->dinfo, &macalg, NULL);
    if (!X509_ALGOR_set0(macalg, OBJ_nid2obj(nid), V_ASN1_NULL, NULL)) {
        ERR_raise(ERR_LIB_PKCS12, ERR_R_ASN1_LIB);
        return 0;
    }

    return 1;
}

/* Set up a mac structure */
int PKCS12_setup_mac(PKCS12 *p12, int iter, unsigned char *salt, int saltlen,
    const EVP_MD *md_type)
{
    return pkcs12_setup_mac(p12, iter, salt, saltlen, EVP_MD_get_type(md_type));
}

int PKCS12_set_pbmac1_pbkdf2(PKCS12 *p12, const char *pass, int passlen,
    unsigned char *salt, int saltlen, int iter,
    const EVP_MD *md_type, const char *prf_md_name)
{
    unsigned char mac[EVP_MAX_MD_SIZE];
    unsigned int maclen;
    ASN1_OCTET_STRING *macoct;
    X509_ALGOR *alg = NULL;
    int ret = 0;
    int prf_md_nid = NID_undef, prf_nid = NID_undef, hmac_nid;
    unsigned char *known_salt = NULL;
    int keylen = 0;
    PBMAC1PARAM *param = NULL;
    X509_ALGOR *hmac_alg = NULL, *macalg = NULL;

    if (md_type == NULL)
        /* No need to do a fetch as the md_type is used only to get a NID */
        md_type = EVP_sha256();

    if (prf_md_name == NULL)
        prf_md_nid = EVP_MD_get_type(md_type);
    else
        prf_md_nid = OBJ_txt2nid(prf_md_name);

    if (iter == 0)
        iter = PKCS12_DEFAULT_ITER;

    keylen = EVP_MD_get_size(md_type);

    prf_nid = ossl_md2hmacnid(prf_md_nid);
    hmac_nid = ossl_md2hmacnid(EVP_MD_get_type(md_type));

    if (prf_nid == NID_undef || hmac_nid == NID_undef) {
        ERR_raise(ERR_LIB_PKCS12, PKCS12_R_UNKNOWN_DIGEST_ALGORITHM);
        goto err;
    }

    if (salt == NULL) {
        known_salt = OPENSSL_malloc(saltlen);
        if (known_salt == NULL)
            goto err;

        if (RAND_bytes_ex(NULL, known_salt, saltlen, 0) <= 0) {
            ERR_raise(ERR_LIB_PKCS12, ERR_R_RAND_LIB);
            goto err;
        }
    }

    param = PBMAC1PARAM_new();
    hmac_alg = X509_ALGOR_new();
    alg = PKCS5_pbkdf2_set(iter, salt ? salt : known_salt, saltlen, prf_nid, keylen);
    if (param == NULL || hmac_alg == NULL || alg == NULL)
        goto err;

    if (pkcs12_setup_mac(p12, iter, salt ? salt : known_salt, saltlen,
            NID_pbmac1)
        == PKCS12_ERROR) {
        ERR_raise(ERR_LIB_PKCS12, PKCS12_R_MAC_SETUP_ERROR);
        goto err;
    }

    if (!X509_ALGOR_set0(hmac_alg, OBJ_nid2obj(hmac_nid), V_ASN1_NULL, NULL)) {
        ERR_raise(ERR_LIB_PKCS12, PKCS12_R_MAC_SETUP_ERROR);
        goto err;
    }

    X509_ALGOR_free(param->keyDerivationFunc);
    X509_ALGOR_free(param->messageAuthScheme);
    param->keyDerivationFunc = alg;
    param->messageAuthScheme = hmac_alg;
    alg = NULL;
    hmac_alg = NULL;

    X509_SIG_getm(p12->mac->dinfo, &macalg, &macoct);
    if (!ASN1_TYPE_pack_sequence(ASN1_ITEM_rptr(PBMAC1PARAM), param, &macalg->parameter))
        goto err;

    /*
     * Note that output mac is forced to UTF-8...
     */
    if (!pkcs12_gen_mac(p12, pass, passlen, mac, &maclen,
            EVP_MD_get_type(md_type), prf_md_nid,
            pkcs12_pbmac1_pbkdf2_key_gen)) {
        ERR_raise(ERR_LIB_PKCS12, PKCS12_R_MAC_GENERATION_ERROR);
        goto err;
    }
    if (!ASN1_OCTET_STRING_set(macoct, mac, maclen)) {
        ERR_raise(ERR_LIB_PKCS12, PKCS12_R_MAC_STRING_SET_ERROR);
        goto err;
    }
    ret = 1;

err:
    X509_ALGOR_free(alg);
    X509_ALGOR_free(hmac_alg);
    PBMAC1PARAM_free(param);
    OPENSSL_free(known_salt);
    return ret;
}

Coverage Report

Created: 2026-04-01 06:39

Line	Count	Source
1		/*
2		* Copyright 1999-2026 The OpenSSL Project Authors. All Rights Reserved.
3		*
4		* Licensed under the Apache License 2.0 (the "License"). You may not use
5		* this file except in compliance with the License. You can obtain a copy
6		* in the file LICENSE in the source distribution or at
7		* https://www.openssl.org/source/license.html
8		*/
9
10		/*
11		* HMAC low level APIs are deprecated for public use, but still ok for internal
12		* use.
13		*/
14		#include "internal/deprecated.h"
15
16		#include <stdio.h>
17		#include "internal/cryptlib.h"
18		#include "crypto/evp.h"
19		#include <openssl/crypto.h>
20		#include <openssl/hmac.h>
21		#include <openssl/rand.h>
22		#include <openssl/pkcs12.h>
23		#include "p12_local.h"
24
25		static int pkcs12_pbmac1_pbkdf2_key_gen(const char *pass, int passlen,
26		unsigned char *salt, int saltlen,
27		int id, int iter, int keylen,
28		unsigned char *out,
29		const EVP_MD *md_type);
30
31		int PKCS12_mac_present(const PKCS12 *p12)
32	3.03k	{
33	3.03k	return p12->mac ? 1 : 0;
34	3.03k	}
35
36		void PKCS12_get0_mac(const ASN1_OCTET_STRING **pmac,
37		const X509_ALGOR **pmacalg,
38		const ASN1_OCTET_STRING **psalt,
39		const ASN1_INTEGER **piter,
40		const PKCS12 *p12)
41	0	{
42	0	if (p12->mac) {
43	0	X509_SIG_get0(p12->mac->dinfo, pmacalg, pmac);
44	0	if (psalt)
45	0	*psalt = p12->mac->salt;
46	0	if (piter)
47	0	*piter = p12->mac->iter;
48	0	} else {
49	0	if (pmac)
50	0	*pmac = NULL;
51	0	if (pmacalg)
52	0	*pmacalg = NULL;
53	0	if (psalt)
54	0	*psalt = NULL;
55	0	if (piter)
56	0	*piter = NULL;
57	0	}
58	0	}
59
60	0	#define TK26_MAC_KEY_LEN 32
61
62		static int pkcs12_gen_gost_mac_key(const char *pass, int passlen,
63		const unsigned char *salt, int saltlen,
64		int iter, int keylen, unsigned char *key,
65		const EVP_MD *digest)
66	0	{
67	0	unsigned char out[96];
68
69	0	if (keylen != TK26_MAC_KEY_LEN) {
70	0	return 0;
71	0	}
72
73	0	if (!PKCS5_PBKDF2_HMAC(pass, passlen, salt, saltlen, iter,
74	0	digest, sizeof(out), out)) {
75	0	return 0;
76	0	}
77	0	memcpy(key, out + sizeof(out) - TK26_MAC_KEY_LEN, TK26_MAC_KEY_LEN);
78	0	OPENSSL_cleanse(out, sizeof(out));
79	0	return 1;
80	0	}
81
82		PBKDF2PARAM PBMAC1_get1_pbkdf2_param(const X509_ALGOR macalg)
83	200	{
84	200	PBMAC1PARAM *param = NULL;
85	200	PBKDF2PARAM *pbkdf2_param = NULL;
86	200	const ASN1_OBJECT *kdf_oid;
87
88	200	param = ASN1_TYPE_unpack_sequence(ASN1_ITEM_rptr(PBMAC1PARAM), macalg->parameter);
89	200	if (param == NULL) {
90	0	ERR_raise(ERR_LIB_PKCS12, ERR_R_PASSED_INVALID_ARGUMENT);
91	0	return NULL;
92	0	}
93
94	200	X509_ALGOR_get0(&kdf_oid, NULL, NULL, param->keyDerivationFunc);
95	200	if (OBJ_obj2nid(kdf_oid) != NID_id_pbkdf2) {
96	12	ERR_raise(ERR_LIB_PKCS12, ERR_R_PASSED_INVALID_ARGUMENT);
97	12	PBMAC1PARAM_free(param);
98	12	return NULL;
99	12	}
100
101	188	pbkdf2_param = ASN1_TYPE_unpack_sequence(ASN1_ITEM_rptr(PBKDF2PARAM),
102	188	param->keyDerivationFunc->parameter);
103	188	PBMAC1PARAM_free(param);
104
105	188	return pbkdf2_param;
106	200	}
107
108		static int PBMAC1_PBKDF2_HMAC(OSSL_LIB_CTX ctx, const char propq,
109		const char *pass, int passlen,
110		const X509_ALGOR macalg, unsigned char key)
111	200	{
112	200	PBKDF2PARAM *pbkdf2_param = NULL;
113	200	const ASN1_OBJECT *kdf_hmac_oid;
114	200	int kdf_hmac_nid;
115	200	int ret = -1;
116	200	int keylen = 0;
117	200	EVP_MD *kdf_md = NULL;
118	200	const ASN1_OCTET_STRING *pbkdf2_salt = NULL;
119
120	200	pbkdf2_param = PBMAC1_get1_pbkdf2_param(macalg);
121	200	if (pbkdf2_param == NULL) {
122	24	ERR_raise(ERR_LIB_PKCS12, ERR_R_UNSUPPORTED);
123	24	goto err;
124	24	}
125
126	176	if (pbkdf2_param->prf == NULL) {
127	80	kdf_hmac_nid = NID_hmacWithSHA1;
128	96	} else {
129	96	X509_ALGOR_get0(&kdf_hmac_oid, NULL, NULL, pbkdf2_param->prf);
130	96	kdf_hmac_nid = OBJ_obj2nid(kdf_hmac_oid);
131	96	}
132
133	176	kdf_md = EVP_MD_fetch(ctx, OBJ_nid2sn(ossl_hmac2mdnid(kdf_hmac_nid)), propq);
134	176	if (kdf_md == NULL) {
135	18	ERR_raise(ERR_LIB_PKCS12, ERR_R_FETCH_FAILED);
136	18	goto err;
137	18	}
138
139		/* Validate salt is an OCTET STRING choice */
140	158	if (pbkdf2_param->salt == NULL
141	158	\|\| pbkdf2_param->salt->type != V_ASN1_OCTET_STRING) {
142	18	ERR_raise(ERR_LIB_PKCS12, PKCS12_R_PARSE_ERROR);
143	18	goto err;
144	18	}
145	140	pbkdf2_salt = pbkdf2_param->salt->value.octet_string;
146
147		/* RFC 9579 specifies missing key length as invalid */
148	140	if (pbkdf2_param->keylength != NULL)
149	128	keylen = ASN1_INTEGER_get(pbkdf2_param->keylength);
150	140	if (keylen <= 0 \|\| keylen > EVP_MAX_MD_SIZE) {
151	42	ERR_raise(ERR_LIB_PKCS12, PKCS12_R_PARSE_ERROR);
152	42	goto err;
153	42	}
154
155	98	if (PKCS5_PBKDF2_HMAC(pass, passlen, pbkdf2_salt->data, pbkdf2_salt->length,
156	98	ASN1_INTEGER_get(pbkdf2_param->iter), kdf_md, keylen, key)
157	98	<= 0) {
158	6	ERR_raise(ERR_LIB_PKCS12, ERR_R_INTERNAL_ERROR);
159	6	goto err;
160	6	}
161	92	ret = keylen;
162
163	200	err:
164	200	EVP_MD_free(kdf_md);
165	200	PBKDF2PARAM_free(pbkdf2_param);
166
167	200	return ret;
168	92	}
169
170		/* Generate a MAC, also used for verification */
171		static int pkcs12_gen_mac(PKCS12 p12, const char pass, int passlen,
172		unsigned char mac, unsigned int maclen,
173		int pbmac1_md_nid, int pbmac1_kdf_nid,
174		int (pkcs12_key_gen)(const char pass, int passlen,
175		unsigned char *salt, int slen,
176		int id, int iter, int n,
177		unsigned char *out,
178		const EVP_MD *md_type))
179		{
180		int ret = 0;
181		const EVP_MD *md;
182		EVP_MD *md_fetch;
183		HMAC_CTX *hmac = NULL;
184		unsigned char key[EVP_MAX_MD_SIZE], *salt;
185		int saltlen, iter;
186		char md_name[80];
187		int keylen = 0;
188		int md_nid = NID_undef;
189		const X509_ALGOR *macalg;
190		const ASN1_OBJECT *macoid;
191
192		if (!PKCS7_type_is_data(p12->authsafes)) {
193		ERR_raise(ERR_LIB_PKCS12, PKCS12_R_CONTENT_TYPE_NOT_DATA);
194		return 0;
195		}
196
197		if (p12->authsafes->d.data == NULL) {
198		ERR_raise(ERR_LIB_PKCS12, PKCS12_R_DECODE_ERROR);
199		return 0;
200		}
201
202		salt = p12->mac->salt->data;
203		saltlen = p12->mac->salt->length;
204		if (p12->mac->iter == NULL)
205		iter = 1;
206		else
207		iter = ASN1_INTEGER_get(p12->mac->iter);
208		X509_SIG_get0(p12->mac->dinfo, &macalg, NULL);
209		X509_ALGOR_get0(&macoid, NULL, NULL, macalg);
210		if (OBJ_obj2nid(macoid) == NID_pbmac1) {
211		if (OBJ_obj2txt(md_name, sizeof(md_name), OBJ_nid2obj(pbmac1_md_nid), 0) < 0)
212		return 0;
213		} else {
214		if (OBJ_obj2txt(md_name, sizeof(md_name), macoid, 0) < 0)
215		return 0;
216		}
217		(void)ERR_set_mark();
218		md = md_fetch = EVP_MD_fetch(p12->authsafes->ctx.libctx, md_name,
219		p12->authsafes->ctx.propq);
220		if (md == NULL)
221		md = EVP_get_digestbynid(OBJ_obj2nid(macoid));
222
223		if (md == NULL) {
224		(void)ERR_clear_last_mark();
225		ERR_raise(ERR_LIB_PKCS12, PKCS12_R_UNKNOWN_DIGEST_ALGORITHM);
226		return 0;
227		}
228		(void)ERR_pop_to_mark();
229
230		keylen = EVP_MD_get_size(md);
231		md_nid = EVP_MD_get_type(md);
232		if (keylen <= 0)
233		goto err;
234
235		/* For PBMAC1 we use a special keygen callback if not provided (e.g. on verification) */
236		if (pbmac1_md_nid != NID_undef && pkcs12_key_gen == NULL) {
237		keylen = PBMAC1_PBKDF2_HMAC(p12->authsafes->ctx.libctx, p12->authsafes->ctx.propq,
238		pass, passlen, macalg, key);
239		if (keylen < 0)
240		goto err;
241		} else if ((md_nid == NID_id_GostR3411_94
242		\|\| md_nid == NID_id_GostR3411_2012_256
243		\|\| md_nid == NID_id_GostR3411_2012_512)
244		&& ossl_safe_getenv("LEGACY_GOST_PKCS12") == NULL) {
245		keylen = TK26_MAC_KEY_LEN;
246		if (!pkcs12_gen_gost_mac_key(pass, passlen, salt, saltlen, iter,
247		keylen, key, md)) {
248		ERR_raise(ERR_LIB_PKCS12, PKCS12_R_KEY_GEN_ERROR);
249		goto err;
250		}
251		} else {
252		EVP_MD hmac_md = (EVP_MD )md;
253		int fetched = 0;
254
255		if (pbmac1_kdf_nid != NID_undef) {
256		char hmac_md_name[128];
257
258		if (OBJ_obj2txt(hmac_md_name, sizeof(hmac_md_name), OBJ_nid2obj(pbmac1_kdf_nid), 0) < 0)
259		goto err;
260		hmac_md = EVP_MD_fetch(NULL, hmac_md_name, NULL);
261		if (hmac_md == NULL)
262		goto err;
263		fetched = 1;
264		}
265		if (pkcs12_key_gen != NULL) {
266		int res = (*pkcs12_key_gen)(pass, passlen, salt, saltlen, PKCS12_MAC_ID,
267		iter, keylen, key, hmac_md);
268
269		if (fetched)
270		EVP_MD_free(hmac_md);
271		if (res != 1) {
272		ERR_raise(ERR_LIB_PKCS12, PKCS12_R_KEY_GEN_ERROR);
273		goto err;
274		}
275		} else {
276		if (fetched)
277		EVP_MD_free(hmac_md);
278		/* Default to UTF-8 password */
279		if (!PKCS12_key_gen_utf8_ex(pass, passlen, salt, saltlen, PKCS12_MAC_ID,
280		iter, keylen, key, md,
281		p12->authsafes->ctx.libctx, p12->authsafes->ctx.propq)) {
282		ERR_raise(ERR_LIB_PKCS12, PKCS12_R_KEY_GEN_ERROR);
283		goto err;
284		}
285		}
286		}
287		if ((hmac = HMAC_CTX_new()) == NULL
288		\|\| !HMAC_Init_ex(hmac, key, keylen, md, NULL)
289		\|\| !HMAC_Update(hmac, p12->authsafes->d.data->data,
290		p12->authsafes->d.data->length)
291		\|\| !HMAC_Final(hmac, mac, maclen)) {
292		goto err;
293		}
294		ret = 1;
295
296		err:
297		OPENSSL_cleanse(key, sizeof(key));
298		HMAC_CTX_free(hmac);
299		EVP_MD_free(md_fetch);
300		return ret;
301		}
302
303		int PKCS12_gen_mac(PKCS12 p12, const char pass, int passlen,
304		unsigned char mac, unsigned int maclen)
305	0	{
306	0	return pkcs12_gen_mac(p12, pass, passlen, mac, maclen, NID_undef, NID_undef, NULL);
307	0	}
308
309		/* Verify the mac */
310		int PKCS12_verify_mac(PKCS12 p12, const char pass, int passlen)
311	5.86k	{
312	5.86k	unsigned char mac[EVP_MAX_MD_SIZE];
313	5.86k	unsigned int maclen;
314	5.86k	const ASN1_OCTET_STRING *macoct;
315	5.86k	const X509_ALGOR *macalg;
316	5.86k	const ASN1_OBJECT *macoid;
317
318	5.86k	if (p12->mac == NULL) {
319	1.62k	ERR_raise(ERR_LIB_PKCS12, PKCS12_R_MAC_ABSENT);
320	1.62k	return 0;
321	1.62k	}
322
323	4.24k	X509_SIG_get0(p12->mac->dinfo, &macalg, NULL);
324	4.24k	X509_ALGOR_get0(&macoid, NULL, NULL, macalg);
325	4.24k	if (OBJ_obj2nid(macoid) == NID_pbmac1) {
326	266	PBMAC1PARAM *param = NULL;
327	266	const ASN1_OBJECT *hmac_oid;
328	266	int md_nid = NID_undef;
329
330	266	param = ASN1_TYPE_unpack_sequence(ASN1_ITEM_rptr(PBMAC1PARAM), macalg->parameter);
331	266	if (param == NULL) {
332	42	ERR_raise(ERR_LIB_PKCS12, ERR_R_UNSUPPORTED);
333	42	return 0;
334	42	}
335	224	X509_ALGOR_get0(&hmac_oid, NULL, NULL, param->messageAuthScheme);
336	224	md_nid = ossl_hmac2mdnid(OBJ_obj2nid(hmac_oid));
337
338	224	if (!pkcs12_gen_mac(p12, pass, passlen, mac, &maclen, md_nid, NID_undef, NULL)) {
339	132	ERR_raise(ERR_LIB_PKCS12, PKCS12_R_MAC_GENERATION_ERROR);
340	132	PBMAC1PARAM_free(param);
341	132	return 0;
342	132	}
343	92	PBMAC1PARAM_free(param);
344	3.97k	} else {
345	3.97k	if (!pkcs12_gen_mac(p12, pass, passlen, mac, &maclen, NID_undef, NID_undef, NULL)) {
346	2.79k	ERR_raise(ERR_LIB_PKCS12, PKCS12_R_MAC_GENERATION_ERROR);
347	2.79k	return 0;
348	2.79k	}
349	3.97k	}
350	1.27k	X509_SIG_get0(p12->mac->dinfo, NULL, &macoct);
351	1.27k	if ((maclen != (unsigned int)ASN1_STRING_length(macoct))
352	829	\|\| CRYPTO_memcmp(mac, ASN1_STRING_get0_data(macoct), maclen) != 0)
353	1.23k	return 0;
354
355	32	return 1;
356	1.27k	}
357
358		/* Set a mac */
359		int PKCS12_set_mac(PKCS12 p12, const char pass, int passlen,
360		unsigned char *salt, int saltlen, int iter,
361		const EVP_MD *md_type)
362	0	{
363	0	unsigned char mac[EVP_MAX_MD_SIZE];
364	0	unsigned int maclen;
365	0	ASN1_OCTET_STRING *macoct;
366
367	0	if (md_type == NULL)
368		/* No need to do a fetch as the md_type is used only to get a NID */
369	0	md_type = EVP_sha256();
370	0	if (!iter)
371	0	iter = PKCS12_DEFAULT_ITER;
372	0	if (PKCS12_setup_mac(p12, iter, salt, saltlen, md_type) == PKCS12_ERROR) {
373	0	ERR_raise(ERR_LIB_PKCS12, PKCS12_R_MAC_SETUP_ERROR);
374	0	return 0;
375	0	}
376		/*
377		* Note that output mac is forced to UTF-8...
378		*/
379	0	if (!pkcs12_gen_mac(p12, pass, passlen, mac, &maclen, NID_undef, NID_undef, NULL)) {
380	0	ERR_raise(ERR_LIB_PKCS12, PKCS12_R_MAC_GENERATION_ERROR);
381	0	return 0;
382	0	}
383	0	X509_SIG_getm(p12->mac->dinfo, NULL, &macoct);
384	0	if (!ASN1_OCTET_STRING_set(macoct, mac, maclen)) {
385	0	ERR_raise(ERR_LIB_PKCS12, PKCS12_R_MAC_STRING_SET_ERROR);
386	0	return 0;
387	0	}
388	0	return 1;
389	0	}
390
391		static int pkcs12_pbmac1_pbkdf2_key_gen(const char *pass, int passlen,
392		unsigned char *salt, int saltlen,
393		int id, int iter, int keylen,
394		unsigned char *out,
395		const EVP_MD *md_type)
396	0	{
397	0	return PKCS5_PBKDF2_HMAC(pass, passlen, salt, saltlen, iter,
398	0	md_type, keylen, out);
399	0	}
400
401		static int pkcs12_setup_mac(PKCS12 p12, int iter, unsigned char salt, int saltlen,
402		int nid)
403	0	{
404	0	X509_ALGOR *macalg;
405
406	0	PKCS12_MAC_DATA_free(p12->mac);
407	0	p12->mac = NULL;
408
409	0	if ((p12->mac = PKCS12_MAC_DATA_new()) == NULL)
410	0	return PKCS12_ERROR;
411	0	if (iter > 1) {
412	0	if ((p12->mac->iter = ASN1_INTEGER_new()) == NULL) {
413	0	ERR_raise(ERR_LIB_PKCS12, ERR_R_ASN1_LIB);
414	0	return 0;
415	0	}
416	0	if (!ASN1_INTEGER_set(p12->mac->iter, iter)) {
417	0	ERR_raise(ERR_LIB_PKCS12, ERR_R_ASN1_LIB);
418	0	return 0;
419	0	}
420	0	}
421	0	if (saltlen == 0)
422	0	saltlen = PKCS12_SALT_LEN;
423	0	else if (saltlen < 0)
424	0	return 0;
425	0	if ((p12->mac->salt->data = OPENSSL_malloc(saltlen)) == NULL)
426	0	return 0;
427	0	p12->mac->salt->length = saltlen;
428	0	if (salt == NULL) {
429	0	if (RAND_bytes_ex(p12->authsafes->ctx.libctx, p12->mac->salt->data,
430	0	(size_t)saltlen, 0)
431	0	<= 0)
432	0	return 0;
433	0	} else {
434	0	memcpy(p12->mac->salt->data, salt, saltlen);
435	0	}
436	0	X509_SIG_getm(p12->mac->dinfo, &macalg, NULL);
437	0	if (!X509_ALGOR_set0(macalg, OBJ_nid2obj(nid), V_ASN1_NULL, NULL)) {
438	0	ERR_raise(ERR_LIB_PKCS12, ERR_R_ASN1_LIB);
439	0	return 0;
440	0	}
441
442	0	return 1;
443	0	}
444
445		/* Set up a mac structure */
446		int PKCS12_setup_mac(PKCS12 p12, int iter, unsigned char salt, int saltlen,
447		const EVP_MD *md_type)
448	0	{
449	0	return pkcs12_setup_mac(p12, iter, salt, saltlen, EVP_MD_get_type(md_type));
450	0	}
451
452		int PKCS12_set_pbmac1_pbkdf2(PKCS12 p12, const char pass, int passlen,
453		unsigned char *salt, int saltlen, int iter,
454		const EVP_MD md_type, const char prf_md_name)
455	0	{
456	0	unsigned char mac[EVP_MAX_MD_SIZE];
457	0	unsigned int maclen;
458	0	ASN1_OCTET_STRING *macoct;
459	0	X509_ALGOR *alg = NULL;
460	0	int ret = 0;
461	0	int prf_md_nid = NID_undef, prf_nid = NID_undef, hmac_nid;
462	0	unsigned char *known_salt = NULL;
463	0	int keylen = 0;
464	0	PBMAC1PARAM *param = NULL;
465	0	X509_ALGOR hmac_alg = NULL, macalg = NULL;
466
467	0	if (md_type == NULL)
468		/* No need to do a fetch as the md_type is used only to get a NID */
469	0	md_type = EVP_sha256();
470
471	0	if (prf_md_name == NULL)
472	0	prf_md_nid = EVP_MD_get_type(md_type);
473	0	else
474	0	prf_md_nid = OBJ_txt2nid(prf_md_name);
475
476	0	if (iter == 0)
477	0	iter = PKCS12_DEFAULT_ITER;
478
479	0	keylen = EVP_MD_get_size(md_type);
480
481	0	prf_nid = ossl_md2hmacnid(prf_md_nid);
482	0	hmac_nid = ossl_md2hmacnid(EVP_MD_get_type(md_type));
483
484	0	if (prf_nid == NID_undef \|\| hmac_nid == NID_undef) {
485	0	ERR_raise(ERR_LIB_PKCS12, PKCS12_R_UNKNOWN_DIGEST_ALGORITHM);
486	0	goto err;
487	0	}
488
489	0	if (salt == NULL) {
490	0	known_salt = OPENSSL_malloc(saltlen);
491	0	if (known_salt == NULL)
492	0	goto err;
493
494	0	if (RAND_bytes_ex(NULL, known_salt, saltlen, 0) <= 0) {
495	0	ERR_raise(ERR_LIB_PKCS12, ERR_R_RAND_LIB);
496	0	goto err;
497	0	}
498	0	}
499
500	0	param = PBMAC1PARAM_new();
501	0	hmac_alg = X509_ALGOR_new();
502	0	alg = PKCS5_pbkdf2_set(iter, salt ? salt : known_salt, saltlen, prf_nid, keylen);
503	0	if (param == NULL \|\| hmac_alg == NULL \|\| alg == NULL)
504	0	goto err;
505
506	0	if (pkcs12_setup_mac(p12, iter, salt ? salt : known_salt, saltlen,
507	0	NID_pbmac1)
508	0	== PKCS12_ERROR) {
509	0	ERR_raise(ERR_LIB_PKCS12, PKCS12_R_MAC_SETUP_ERROR);
510	0	goto err;
511	0	}
512
513	0	if (!X509_ALGOR_set0(hmac_alg, OBJ_nid2obj(hmac_nid), V_ASN1_NULL, NULL)) {
514	0	ERR_raise(ERR_LIB_PKCS12, PKCS12_R_MAC_SETUP_ERROR);
515	0	goto err;
516	0	}
517
518	0	X509_ALGOR_free(param->keyDerivationFunc);
519	0	X509_ALGOR_free(param->messageAuthScheme);
520	0	param->keyDerivationFunc = alg;
521	0	param->messageAuthScheme = hmac_alg;
522	0	alg = NULL;
523	0	hmac_alg = NULL;
524
525	0	X509_SIG_getm(p12->mac->dinfo, &macalg, &macoct);
526	0	if (!ASN1_TYPE_pack_sequence(ASN1_ITEM_rptr(PBMAC1PARAM), param, &macalg->parameter))
527	0	goto err;
528
529		/*
530		* Note that output mac is forced to UTF-8...
531		*/
532	0	if (!pkcs12_gen_mac(p12, pass, passlen, mac, &maclen,
533	0	EVP_MD_get_type(md_type), prf_md_nid,
534	0	pkcs12_pbmac1_pbkdf2_key_gen)) {
535	0	ERR_raise(ERR_LIB_PKCS12, PKCS12_R_MAC_GENERATION_ERROR);
536	0	goto err;
537	0	}
538	0	if (!ASN1_OCTET_STRING_set(macoct, mac, maclen)) {
539	0	ERR_raise(ERR_LIB_PKCS12, PKCS12_R_MAC_STRING_SET_ERROR);
540	0	goto err;
541	0	}
542	0	ret = 1;
543
544	0	err:
545	0	X509_ALGOR_free(alg);
546	0	X509_ALGOR_free(hmac_alg);
547	0	PBMAC1PARAM_free(param);
548	0	OPENSSL_free(known_salt);
549	0	return ret;
550	0	}