/src/openssl/crypto/pkcs12/p12_mutl.c

Source
/*
 * Copyright 1999-2024 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

/*
 * HMAC low level APIs are deprecated for public use, but still ok for internal
 * use.
 */
#include "internal/deprecated.h"

#include <stdio.h>
#include "internal/cryptlib.h"
#include "crypto/evp.h"
#include <openssl/crypto.h>
#include <openssl/hmac.h>
#include <openssl/rand.h>
#include <openssl/pkcs12.h>
#include "p12_local.h"

static int pkcs12_pbmac1_pbkdf2_key_gen(const char *pass, int passlen,
                                        unsigned char *salt, int saltlen,
                                        int id, int iter, int keylen,
                                        unsigned char *out,
                                        const EVP_MD *md_type,
                                        OSSL_LIB_CTX *libctx, const char *propq);

int PKCS12_mac_present(const PKCS12 *p12)
{
    return p12->mac ? 1 : 0;
}

void PKCS12_get0_mac(const ASN1_OCTET_STRING **pmac,
                     const X509_ALGOR **pmacalg,
                     const ASN1_OCTET_STRING **psalt,
                     const ASN1_INTEGER **piter,
                     const PKCS12 *p12)
{
    if (p12->mac) {
        X509_SIG_get0(p12->mac->dinfo, pmacalg, pmac);
        if (psalt)
            *psalt = p12->mac->salt;
        if (piter)
            *piter = p12->mac->iter;
    } else {
        if (pmac)
            *pmac = NULL;
        if (pmacalg)
            *pmacalg = NULL;
        if (psalt)
            *psalt = NULL;
        if (piter)
            *piter = NULL;
    }
}

#define TK26_MAC_KEY_LEN 32

static int pkcs12_gen_gost_mac_key(const char *pass, int passlen,
                                   const unsigned char *salt, int saltlen,
                                   int iter, int keylen, unsigned char *key,
                                   const EVP_MD *digest)
{
    unsigned char out[96];

    if (keylen != TK26_MAC_KEY_LEN) {
        return 0;
    }

    if (!PKCS5_PBKDF2_HMAC(pass, passlen, salt, saltlen, iter,
                           digest, sizeof(out), out)) {
        return 0;
    }
    memcpy(key, out + sizeof(out) - TK26_MAC_KEY_LEN, TK26_MAC_KEY_LEN);
    OPENSSL_cleanse(out, sizeof(out));
    return 1;
}

PBKDF2PARAM *PBMAC1_get1_pbkdf2_param(const X509_ALGOR *macalg)
{
    PBMAC1PARAM *param = NULL;
    PBKDF2PARAM *pbkdf2_param = NULL;
    const ASN1_OBJECT *kdf_oid;

    param = ASN1_TYPE_unpack_sequence(ASN1_ITEM_rptr(PBMAC1PARAM), macalg->parameter);
    if (param == NULL) {
        ERR_raise(ERR_LIB_PKCS12, ERR_R_PASSED_INVALID_ARGUMENT);
        return NULL;
    }

    X509_ALGOR_get0(&kdf_oid, NULL, NULL, param->keyDerivationFunc);
    if (OBJ_obj2nid(kdf_oid) != NID_id_pbkdf2) {
        ERR_raise(ERR_LIB_PKCS12, ERR_R_PASSED_INVALID_ARGUMENT);
        PBMAC1PARAM_free(param);
        return NULL;
    }

    pbkdf2_param = ASN1_TYPE_unpack_sequence(ASN1_ITEM_rptr(PBKDF2PARAM),
                                             param->keyDerivationFunc->parameter);
    PBMAC1PARAM_free(param);

    return pbkdf2_param;
}

static int PBMAC1_PBKDF2_HMAC(OSSL_LIB_CTX *ctx, const char *propq,
                              const char *pass, int passlen,
                              const X509_ALGOR *macalg, unsigned char *key)
{
    PBKDF2PARAM *pbkdf2_param = NULL;
    const ASN1_OBJECT *kdf_hmac_oid;
    int kdf_hmac_nid;
    int ret = -1;
    int keylen = 0;
    EVP_MD *kdf_md = NULL;
    const ASN1_OCTET_STRING *pbkdf2_salt = NULL;

    pbkdf2_param = PBMAC1_get1_pbkdf2_param(macalg);
    if (pbkdf2_param == NULL) {
        ERR_raise(ERR_LIB_PKCS12, ERR_R_UNSUPPORTED);
        goto err;
    }
    keylen = ASN1_INTEGER_get(pbkdf2_param->keylength);
    pbkdf2_salt = pbkdf2_param->salt->value.octet_string;

    if (pbkdf2_param->prf == NULL) {
        kdf_hmac_nid = NID_hmacWithSHA1;
    } else {
        X509_ALGOR_get0(&kdf_hmac_oid, NULL, NULL, pbkdf2_param->prf);
        kdf_hmac_nid = OBJ_obj2nid(kdf_hmac_oid);
    }

    kdf_md = EVP_MD_fetch(ctx, OBJ_nid2sn(ossl_hmac2mdnid(kdf_hmac_nid)), propq);
    if (kdf_md == NULL) {
        ERR_raise(ERR_LIB_PKCS12, ERR_R_FETCH_FAILED);
        goto err;
    }

    if (PKCS5_PBKDF2_HMAC(pass, passlen, pbkdf2_salt->data, pbkdf2_salt->length,
                          ASN1_INTEGER_get(pbkdf2_param->iter), kdf_md, keylen, key) <= 0) {
        ERR_raise(ERR_LIB_PKCS12, ERR_R_INTERNAL_ERROR);
        goto err;
    }
    ret = keylen;

 err:
    EVP_MD_free(kdf_md);
    PBKDF2PARAM_free(pbkdf2_param);

    return ret;
}

/* Generate a MAC, also used for verification */
static int pkcs12_gen_mac(PKCS12 *p12, const char *pass, int passlen,
                          unsigned char *mac, unsigned int *maclen,
                          int pbmac1_md_nid, int pbmac1_kdf_nid,
                          int (*pkcs12_key_gen)(const char *pass, int passlen,
                                                unsigned char *salt, int slen,
                                                int id, int iter, int n,
                                                unsigned char *out,
                                                const EVP_MD *md_type,
                                                OSSL_LIB_CTX *libctx,
                                                const char *propq))
{
    int ret = 0;
    const EVP_MD *md;
    EVP_MD *md_fetch;
    HMAC_CTX *hmac = NULL;
    unsigned char key[EVP_MAX_MD_SIZE], *salt;
    int saltlen, iter;
    char md_name[80];
    int keylen = 0;
    int md_nid = NID_undef;
    const X509_ALGOR *macalg;
    const ASN1_OBJECT *macoid;
    OSSL_LIB_CTX *libctx;
    const char *propq;

    if (!PKCS7_type_is_data(p12->authsafes)) {
        ERR_raise(ERR_LIB_PKCS12, PKCS12_R_CONTENT_TYPE_NOT_DATA);
        return 0;
    }

    if (p12->authsafes->d.data == NULL) {
        ERR_raise(ERR_LIB_PKCS12, PKCS12_R_DECODE_ERROR);
        return 0;
    }

    libctx = p12->authsafes->ctx.libctx;
    propq = p12->authsafes->ctx.propq;
    salt = p12->mac->salt->data;
    saltlen = p12->mac->salt->length;
    if (p12->mac->iter == NULL)
        iter = 1;
    else
        iter = ASN1_INTEGER_get(p12->mac->iter);
    X509_SIG_get0(p12->mac->dinfo, &macalg, NULL);
    X509_ALGOR_get0(&macoid, NULL, NULL, macalg);
    if (OBJ_obj2nid(macoid) == NID_pbmac1) {
        if (OBJ_obj2txt(md_name, sizeof(md_name), OBJ_nid2obj(pbmac1_md_nid), 0) < 0)
            return 0;
    } else {
        if (OBJ_obj2txt(md_name, sizeof(md_name), macoid, 0) < 0)
            return 0;
    }
    (void)ERR_set_mark();
    md = md_fetch = EVP_MD_fetch(libctx, md_name, propq);
    if (md == NULL)
        md = EVP_get_digestbynid(OBJ_obj2nid(macoid));

    if (md == NULL) {
        (void)ERR_clear_last_mark();
        ERR_raise(ERR_LIB_PKCS12, PKCS12_R_UNKNOWN_DIGEST_ALGORITHM);
        return 0;
    }
    (void)ERR_pop_to_mark();

    keylen = EVP_MD_get_size(md);
    md_nid = EVP_MD_get_type(md);
    if (keylen <= 0)
        goto err;

    /* For PBMAC1 we use a special keygen callback if not provided (e.g. on verification) */
    if (pbmac1_md_nid != NID_undef && pkcs12_key_gen == NULL) {
        keylen = PBMAC1_PBKDF2_HMAC(libctx, propq, pass, passlen, macalg, key);
        if (keylen < 0)
            goto err;
    } else if ((md_nid == NID_id_GostR3411_94
                || md_nid == NID_id_GostR3411_2012_256
                || md_nid == NID_id_GostR3411_2012_512)
               && ossl_safe_getenv("LEGACY_GOST_PKCS12") == NULL) {
        keylen = TK26_MAC_KEY_LEN;
        if (!pkcs12_gen_gost_mac_key(pass, passlen, salt, saltlen, iter,
                                     keylen, key, md)) {
            ERR_raise(ERR_LIB_PKCS12, PKCS12_R_KEY_GEN_ERROR);
            goto err;
        }
    } else {
        EVP_MD *hmac_md = (EVP_MD *)md;
        int fetched = 0;

        if (pbmac1_kdf_nid != NID_undef) {
            char hmac_md_name[128];

            if (OBJ_obj2txt(hmac_md_name, sizeof(hmac_md_name), OBJ_nid2obj(pbmac1_kdf_nid), 0) < 0)
                goto err;
            hmac_md = EVP_MD_fetch(libctx, hmac_md_name, propq);
            if (hmac_md == NULL)
                goto err;
            fetched = 1;
        }
        if (pkcs12_key_gen != NULL) {
            int res = (*pkcs12_key_gen)(pass, passlen, salt, saltlen, PKCS12_MAC_ID,
                                        iter, keylen, key, hmac_md, libctx, propq);

            if (fetched)
                EVP_MD_free(hmac_md);
            if (res != 1) {
                ERR_raise(ERR_LIB_PKCS12, PKCS12_R_KEY_GEN_ERROR);
                goto err;
            }
        } else {
            if (fetched)
                EVP_MD_free(hmac_md);
            /* Default to UTF-8 password */
            if (!PKCS12_key_gen_utf8_ex(pass, passlen, salt, saltlen, PKCS12_MAC_ID,
                                        iter, keylen, key, md, libctx, propq)) {
                ERR_raise(ERR_LIB_PKCS12, PKCS12_R_KEY_GEN_ERROR);
                goto err;
            }
        }
    }
    if ((hmac = HMAC_CTX_new()) == NULL
        || !HMAC_Init_ex(hmac, key, keylen, md, NULL)
        || !HMAC_Update(hmac, p12->authsafes->d.data->data,
                        p12->authsafes->d.data->length)
        || !HMAC_Final(hmac, mac, maclen)) {
        goto err;
    }
    ret = 1;

err:
    OPENSSL_cleanse(key, sizeof(key));
    HMAC_CTX_free(hmac);
    EVP_MD_free(md_fetch);
    return ret;
}

int PKCS12_gen_mac(PKCS12 *p12, const char *pass, int passlen,
                   unsigned char *mac, unsigned int *maclen)
{
    return pkcs12_gen_mac(p12, pass, passlen, mac, maclen, NID_undef, NID_undef, NULL);
}

/* Verify the mac */
int PKCS12_verify_mac(PKCS12 *p12, const char *pass, int passlen)
{
    unsigned char mac[EVP_MAX_MD_SIZE];
    unsigned int maclen;
    const ASN1_OCTET_STRING *macoct;
    const X509_ALGOR *macalg;
    const ASN1_OBJECT *macoid;

    if (p12->mac == NULL) {
        ERR_raise(ERR_LIB_PKCS12, PKCS12_R_MAC_ABSENT);
        return 0;
    }

    X509_SIG_get0(p12->mac->dinfo, &macalg, NULL);
    X509_ALGOR_get0(&macoid, NULL, NULL, macalg);
    if (OBJ_obj2nid(macoid) == NID_pbmac1) {
        PBMAC1PARAM *param = NULL;
        const ASN1_OBJECT *hmac_oid;
        int md_nid = NID_undef;

        param = ASN1_TYPE_unpack_sequence(ASN1_ITEM_rptr(PBMAC1PARAM), macalg->parameter);
        if (param == NULL) {
            ERR_raise(ERR_LIB_PKCS12, ERR_R_UNSUPPORTED);
            return 0;
        }
        X509_ALGOR_get0(&hmac_oid, NULL, NULL, param->messageAuthScheme);
        md_nid = ossl_hmac2mdnid(OBJ_obj2nid(hmac_oid));

        if (!pkcs12_gen_mac(p12, pass, passlen, mac, &maclen, md_nid, NID_undef, NULL)) {
            ERR_raise(ERR_LIB_PKCS12, PKCS12_R_MAC_GENERATION_ERROR);
            PBMAC1PARAM_free(param);
            return 0;
        }
        PBMAC1PARAM_free(param);
    } else {
        if (!pkcs12_gen_mac(p12, pass, passlen, mac, &maclen, NID_undef, NID_undef, NULL)) {
            ERR_raise(ERR_LIB_PKCS12, PKCS12_R_MAC_GENERATION_ERROR);
            return 0;
        }
    }
    X509_SIG_get0(p12->mac->dinfo, NULL, &macoct);
    if ((maclen != (unsigned int)ASN1_STRING_length(macoct))
        || CRYPTO_memcmp(mac, ASN1_STRING_get0_data(macoct), maclen) != 0)
        return 0;

    return 1;
}

/* Set a mac */
int PKCS12_set_mac(PKCS12 *p12, const char *pass, int passlen,
                   unsigned char *salt, int saltlen, int iter,
                   const EVP_MD *md_type)
{
    unsigned char mac[EVP_MAX_MD_SIZE];
    unsigned int maclen;
    ASN1_OCTET_STRING *macoct;

    if (md_type == NULL)
        /* No need to do a fetch as the md_type is used only to get a NID */
        md_type = EVP_sha256();
    if (!iter)
        iter = PKCS12_DEFAULT_ITER;
    if (PKCS12_setup_mac(p12, iter, salt, saltlen, md_type) == PKCS12_ERROR) {
        ERR_raise(ERR_LIB_PKCS12, PKCS12_R_MAC_SETUP_ERROR);
        return 0;
    }
    /*
     * Note that output mac is forced to UTF-8...
     */
    if (!pkcs12_gen_mac(p12, pass, passlen, mac, &maclen, NID_undef, NID_undef, NULL)) {
        ERR_raise(ERR_LIB_PKCS12, PKCS12_R_MAC_GENERATION_ERROR);
        return 0;
    }
    X509_SIG_getm(p12->mac->dinfo, NULL, &macoct);
    if (!ASN1_OCTET_STRING_set(macoct, mac, maclen)) {
        ERR_raise(ERR_LIB_PKCS12, PKCS12_R_MAC_STRING_SET_ERROR);
        return 0;
    }
    return 1;
}

static int pkcs12_pbmac1_pbkdf2_key_gen(const char *pass, int passlen,
                                        unsigned char *salt, int saltlen,
                                        int id, int iter, int keylen,
                                        unsigned char *out,
                                        const EVP_MD *md_type,
                                        OSSL_LIB_CTX *libctx, const char *propq)
{
    return ossl_pkcs5_pbkdf2_hmac_ex(pass, passlen, salt, saltlen, iter, md_type,
                                     keylen, out, libctx, propq);
}

static int pkcs12_setup_mac(PKCS12 *p12, int iter, unsigned char *salt, int saltlen,
                            int nid)
{
    X509_ALGOR *macalg;

    PKCS12_MAC_DATA_free(p12->mac);
    p12->mac = NULL;

    if ((p12->mac = PKCS12_MAC_DATA_new()) == NULL)
        return PKCS12_ERROR;
    if (iter > 1) {
        if ((p12->mac->iter = ASN1_INTEGER_new()) == NULL) {
            ERR_raise(ERR_LIB_PKCS12, ERR_R_ASN1_LIB);
            return 0;
        }
        if (!ASN1_INTEGER_set(p12->mac->iter, iter)) {
            ERR_raise(ERR_LIB_PKCS12, ERR_R_ASN1_LIB);
            return 0;
        }
    }
    if (saltlen == 0)
        saltlen = PKCS12_SALT_LEN;
    else if (saltlen < 0)
        return 0;
    if ((p12->mac->salt->data = OPENSSL_malloc(saltlen)) == NULL)
        return 0;
    p12->mac->salt->length = saltlen;
    if (salt == NULL) {
        if (RAND_bytes_ex(p12->authsafes->ctx.libctx, p12->mac->salt->data,
                          (size_t)saltlen, 0) <= 0)
            return 0;
    } else {
        memcpy(p12->mac->salt->data, salt, saltlen);
    }
    X509_SIG_getm(p12->mac->dinfo, &macalg, NULL);
    if (!X509_ALGOR_set0(macalg, OBJ_nid2obj(nid), V_ASN1_NULL, NULL)) {
        ERR_raise(ERR_LIB_PKCS12, ERR_R_ASN1_LIB);
        return 0;
    }

    return 1;
}

/* Set up a mac structure */
int PKCS12_setup_mac(PKCS12 *p12, int iter, unsigned char *salt, int saltlen,
                     const EVP_MD *md_type)
{
    return pkcs12_setup_mac(p12, iter, salt, saltlen, EVP_MD_get_type(md_type));
}

int PKCS12_set_pbmac1_pbkdf2(PKCS12 *p12, const char *pass, int passlen,
                             unsigned char *salt, int saltlen, int iter,
                             const EVP_MD *md_type, const char *prf_md_name)
{
    unsigned char mac[EVP_MAX_MD_SIZE];
    unsigned int maclen;
    ASN1_OCTET_STRING *macoct;
    X509_ALGOR *alg = NULL;
    int ret = 0;
    int prf_md_nid = NID_undef, prf_nid = NID_undef, hmac_nid;
    unsigned char *known_salt = NULL;
    int keylen = 0;
    PBMAC1PARAM *param = NULL;
    X509_ALGOR  *hmac_alg = NULL, *macalg = NULL;
    OSSL_LIB_CTX *libctx = p12->authsafes->ctx.libctx;

    if (md_type == NULL)
        /* No need to do a fetch as the md_type is used only to get a NID */
        md_type = EVP_sha256();

    if (prf_md_name == NULL)
        prf_md_nid = EVP_MD_get_type(md_type);
    else
        prf_md_nid = OBJ_txt2nid(prf_md_name);

    if (iter == 0)
        iter = PKCS12_DEFAULT_ITER;

    keylen = EVP_MD_get_size(md_type);

    prf_nid  = ossl_md2hmacnid(prf_md_nid);
    hmac_nid = ossl_md2hmacnid(EVP_MD_get_type(md_type));

    if (prf_nid == NID_undef || hmac_nid == NID_undef) {
        ERR_raise(ERR_LIB_PKCS12, PKCS12_R_UNKNOWN_DIGEST_ALGORITHM);
        goto err;
    }

    if (salt == NULL) {
        if (saltlen < 0) {
            ERR_raise(ERR_LIB_PKCS12, PKCS12_R_INVALID_SALT_LENGTH);
            goto err;
        }
        if (saltlen > 0) {
            known_salt = OPENSSL_malloc(saltlen);
            if (known_salt == NULL)
                goto err;

            if (RAND_bytes_ex(libctx, known_salt, saltlen, 0) <= 0) {
                ERR_raise(ERR_LIB_PKCS12, ERR_R_RAND_LIB);
                goto err;
            }
        }
    }

    param = PBMAC1PARAM_new();
    hmac_alg = X509_ALGOR_new();
    alg = PKCS5_pbkdf2_set_ex(iter, salt ? salt : known_salt, saltlen,
                              prf_nid, keylen, libctx);
    if (param == NULL || hmac_alg == NULL || alg == NULL)
        goto err;

    if (pkcs12_setup_mac(p12, iter, salt ? salt : known_salt, saltlen,
                         NID_pbmac1) == PKCS12_ERROR) {
        ERR_raise(ERR_LIB_PKCS12, PKCS12_R_MAC_SETUP_ERROR);
        goto err;
    }

    if (!X509_ALGOR_set0(hmac_alg, OBJ_nid2obj(hmac_nid), V_ASN1_NULL, NULL)) {
        ERR_raise(ERR_LIB_PKCS12, PKCS12_R_MAC_SETUP_ERROR);
        goto err;
    }

    X509_ALGOR_free(param->keyDerivationFunc);
    X509_ALGOR_free(param->messageAuthScheme);
    param->keyDerivationFunc = alg;
    param->messageAuthScheme = hmac_alg;

    X509_SIG_getm(p12->mac->dinfo, &macalg, &macoct);
    if (!ASN1_TYPE_pack_sequence(ASN1_ITEM_rptr(PBMAC1PARAM), param, &macalg->parameter))
        goto err;

    /*
     * Note that output mac is forced to UTF-8...
     */
    if (!pkcs12_gen_mac(p12, pass, passlen, mac, &maclen,
                        EVP_MD_get_type(md_type), prf_md_nid,
                        pkcs12_pbmac1_pbkdf2_key_gen)) {
        ERR_raise(ERR_LIB_PKCS12, PKCS12_R_MAC_GENERATION_ERROR);
        goto err;
    }
    if (!ASN1_OCTET_STRING_set(macoct, mac, maclen)) {
        ERR_raise(ERR_LIB_PKCS12, PKCS12_R_MAC_STRING_SET_ERROR);
        goto err;
    }
    ret = 1;

 err:
    PBMAC1PARAM_free(param);
    OPENSSL_free(known_salt);
    return ret;
}

Coverage Report

Created: 2025-11-07 06:36

Line	Count	Source
1		/*
2		* Copyright 1999-2024 The OpenSSL Project Authors. All Rights Reserved.
3		*
4		* Licensed under the Apache License 2.0 (the "License"). You may not use
5		* this file except in compliance with the License. You can obtain a copy
6		* in the file LICENSE in the source distribution or at
7		* https://www.openssl.org/source/license.html
8		*/
9
10		/*
11		* HMAC low level APIs are deprecated for public use, but still ok for internal
12		* use.
13		*/
14		#include "internal/deprecated.h"
15
16		#include <stdio.h>
17		#include "internal/cryptlib.h"
18		#include "crypto/evp.h"
19		#include <openssl/crypto.h>
20		#include <openssl/hmac.h>
21		#include <openssl/rand.h>
22		#include <openssl/pkcs12.h>
23		#include "p12_local.h"
24
25		static int pkcs12_pbmac1_pbkdf2_key_gen(const char *pass, int passlen,
26		unsigned char *salt, int saltlen,
27		int id, int iter, int keylen,
28		unsigned char *out,
29		const EVP_MD *md_type,
30		OSSL_LIB_CTX libctx, const char propq);
31
32		int PKCS12_mac_present(const PKCS12 *p12)
33	0	{
34	0	return p12->mac ? 1 : 0;
35	0	}
36
37		void PKCS12_get0_mac(const ASN1_OCTET_STRING **pmac,
38		const X509_ALGOR **pmacalg,
39		const ASN1_OCTET_STRING **psalt,
40		const ASN1_INTEGER **piter,
41		const PKCS12 *p12)
42	0	{
43	0	if (p12->mac) {
44	0	X509_SIG_get0(p12->mac->dinfo, pmacalg, pmac);
45	0	if (psalt)
46	0	*psalt = p12->mac->salt;
47	0	if (piter)
48	0	*piter = p12->mac->iter;
49	0	} else {
50	0	if (pmac)
51	0	*pmac = NULL;
52	0	if (pmacalg)
53	0	*pmacalg = NULL;
54	0	if (psalt)
55	0	*psalt = NULL;
56	0	if (piter)
57	0	*piter = NULL;
58	0	}
59	0	}
60
61	0	#define TK26_MAC_KEY_LEN 32
62
63		static int pkcs12_gen_gost_mac_key(const char *pass, int passlen,
64		const unsigned char *salt, int saltlen,
65		int iter, int keylen, unsigned char *key,
66		const EVP_MD *digest)
67	0	{
68	0	unsigned char out[96];
69
70	0	if (keylen != TK26_MAC_KEY_LEN) {
71	0	return 0;
72	0	}
73
74	0	if (!PKCS5_PBKDF2_HMAC(pass, passlen, salt, saltlen, iter,
75	0	digest, sizeof(out), out)) {
76	0	return 0;
77	0	}
78	0	memcpy(key, out + sizeof(out) - TK26_MAC_KEY_LEN, TK26_MAC_KEY_LEN);
79	0	OPENSSL_cleanse(out, sizeof(out));
80	0	return 1;
81	0	}
82
83		PBKDF2PARAM PBMAC1_get1_pbkdf2_param(const X509_ALGOR macalg)
84	0	{
85	0	PBMAC1PARAM *param = NULL;
86	0	PBKDF2PARAM *pbkdf2_param = NULL;
87	0	const ASN1_OBJECT *kdf_oid;
88
89	0	param = ASN1_TYPE_unpack_sequence(ASN1_ITEM_rptr(PBMAC1PARAM), macalg->parameter);
90	0	if (param == NULL) {
91	0	ERR_raise(ERR_LIB_PKCS12, ERR_R_PASSED_INVALID_ARGUMENT);
92	0	return NULL;
93	0	}
94
95	0	X509_ALGOR_get0(&kdf_oid, NULL, NULL, param->keyDerivationFunc);
96	0	if (OBJ_obj2nid(kdf_oid) != NID_id_pbkdf2) {
97	0	ERR_raise(ERR_LIB_PKCS12, ERR_R_PASSED_INVALID_ARGUMENT);
98	0	PBMAC1PARAM_free(param);
99	0	return NULL;
100	0	}
101
102	0	pbkdf2_param = ASN1_TYPE_unpack_sequence(ASN1_ITEM_rptr(PBKDF2PARAM),
103	0	param->keyDerivationFunc->parameter);
104	0	PBMAC1PARAM_free(param);
105
106	0	return pbkdf2_param;
107	0	}
108
109		static int PBMAC1_PBKDF2_HMAC(OSSL_LIB_CTX ctx, const char propq,
110		const char *pass, int passlen,
111		const X509_ALGOR macalg, unsigned char key)
112	0	{
113	0	PBKDF2PARAM *pbkdf2_param = NULL;
114	0	const ASN1_OBJECT *kdf_hmac_oid;
115	0	int kdf_hmac_nid;
116	0	int ret = -1;
117	0	int keylen = 0;
118	0	EVP_MD *kdf_md = NULL;
119	0	const ASN1_OCTET_STRING *pbkdf2_salt = NULL;
120
121	0	pbkdf2_param = PBMAC1_get1_pbkdf2_param(macalg);
122	0	if (pbkdf2_param == NULL) {
123	0	ERR_raise(ERR_LIB_PKCS12, ERR_R_UNSUPPORTED);
124	0	goto err;
125	0	}
126	0	keylen = ASN1_INTEGER_get(pbkdf2_param->keylength);
127	0	pbkdf2_salt = pbkdf2_param->salt->value.octet_string;
128
129	0	if (pbkdf2_param->prf == NULL) {
130	0	kdf_hmac_nid = NID_hmacWithSHA1;
131	0	} else {
132	0	X509_ALGOR_get0(&kdf_hmac_oid, NULL, NULL, pbkdf2_param->prf);
133	0	kdf_hmac_nid = OBJ_obj2nid(kdf_hmac_oid);
134	0	}
135
136	0	kdf_md = EVP_MD_fetch(ctx, OBJ_nid2sn(ossl_hmac2mdnid(kdf_hmac_nid)), propq);
137	0	if (kdf_md == NULL) {
138	0	ERR_raise(ERR_LIB_PKCS12, ERR_R_FETCH_FAILED);
139	0	goto err;
140	0	}
141
142	0	if (PKCS5_PBKDF2_HMAC(pass, passlen, pbkdf2_salt->data, pbkdf2_salt->length,
143	0	ASN1_INTEGER_get(pbkdf2_param->iter), kdf_md, keylen, key) <= 0) {
144	0	ERR_raise(ERR_LIB_PKCS12, ERR_R_INTERNAL_ERROR);
145	0	goto err;
146	0	}
147	0	ret = keylen;
148
149	0	err:
150	0	EVP_MD_free(kdf_md);
151	0	PBKDF2PARAM_free(pbkdf2_param);
152
153	0	return ret;
154	0	}
155
156		/* Generate a MAC, also used for verification */
157		static int pkcs12_gen_mac(PKCS12 p12, const char pass, int passlen,
158		unsigned char mac, unsigned int maclen,
159		int pbmac1_md_nid, int pbmac1_kdf_nid,
160		int (pkcs12_key_gen)(const char pass, int passlen,
161		unsigned char *salt, int slen,
162		int id, int iter, int n,
163		unsigned char *out,
164		const EVP_MD *md_type,
165		OSSL_LIB_CTX *libctx,
166		const char *propq))
167	0	{
168	0	int ret = 0;
169	0	const EVP_MD *md;
170	0	EVP_MD *md_fetch;
171	0	HMAC_CTX *hmac = NULL;
172	0	unsigned char key[EVP_MAX_MD_SIZE], *salt;
173	0	int saltlen, iter;
174	0	char md_name[80];
175	0	int keylen = 0;
176	0	int md_nid = NID_undef;
177	0	const X509_ALGOR *macalg;
178	0	const ASN1_OBJECT *macoid;
179	0	OSSL_LIB_CTX *libctx;
180	0	const char *propq;
181
182	0	if (!PKCS7_type_is_data(p12->authsafes)) {
183	0	ERR_raise(ERR_LIB_PKCS12, PKCS12_R_CONTENT_TYPE_NOT_DATA);
184	0	return 0;
185	0	}
186
187	0	if (p12->authsafes->d.data == NULL) {
188	0	ERR_raise(ERR_LIB_PKCS12, PKCS12_R_DECODE_ERROR);
189	0	return 0;
190	0	}
191
192	0	libctx = p12->authsafes->ctx.libctx;
193	0	propq = p12->authsafes->ctx.propq;
194	0	salt = p12->mac->salt->data;
195	0	saltlen = p12->mac->salt->length;
196	0	if (p12->mac->iter == NULL)
197	0	iter = 1;
198	0	else
199	0	iter = ASN1_INTEGER_get(p12->mac->iter);
200	0	X509_SIG_get0(p12->mac->dinfo, &macalg, NULL);
201	0	X509_ALGOR_get0(&macoid, NULL, NULL, macalg);
202	0	if (OBJ_obj2nid(macoid) == NID_pbmac1) {
203	0	if (OBJ_obj2txt(md_name, sizeof(md_name), OBJ_nid2obj(pbmac1_md_nid), 0) < 0)
204	0	return 0;
205	0	} else {
206	0	if (OBJ_obj2txt(md_name, sizeof(md_name), macoid, 0) < 0)
207	0	return 0;
208	0	}
209	0	(void)ERR_set_mark();
210	0	md = md_fetch = EVP_MD_fetch(libctx, md_name, propq);
211	0	if (md == NULL)
212	0	md = EVP_get_digestbynid(OBJ_obj2nid(macoid));
213
214	0	if (md == NULL) {
215	0	(void)ERR_clear_last_mark();
216	0	ERR_raise(ERR_LIB_PKCS12, PKCS12_R_UNKNOWN_DIGEST_ALGORITHM);
217	0	return 0;
218	0	}
219	0	(void)ERR_pop_to_mark();
220
221	0	keylen = EVP_MD_get_size(md);
222	0	md_nid = EVP_MD_get_type(md);
223	0	if (keylen <= 0)
224	0	goto err;
225
226		/* For PBMAC1 we use a special keygen callback if not provided (e.g. on verification) */
227	0	if (pbmac1_md_nid != NID_undef && pkcs12_key_gen == NULL) {
228	0	keylen = PBMAC1_PBKDF2_HMAC(libctx, propq, pass, passlen, macalg, key);
229	0	if (keylen < 0)
230	0	goto err;
231	0	} else if ((md_nid == NID_id_GostR3411_94
232	0	\|\| md_nid == NID_id_GostR3411_2012_256
233	0	\|\| md_nid == NID_id_GostR3411_2012_512)
234	0	&& ossl_safe_getenv("LEGACY_GOST_PKCS12") == NULL) {
235	0	keylen = TK26_MAC_KEY_LEN;
236	0	if (!pkcs12_gen_gost_mac_key(pass, passlen, salt, saltlen, iter,
237	0	keylen, key, md)) {
238	0	ERR_raise(ERR_LIB_PKCS12, PKCS12_R_KEY_GEN_ERROR);
239	0	goto err;
240	0	}
241	0	} else {
242	0	EVP_MD hmac_md = (EVP_MD )md;
243	0	int fetched = 0;
244
245	0	if (pbmac1_kdf_nid != NID_undef) {
246	0	char hmac_md_name[128];
247
248	0	if (OBJ_obj2txt(hmac_md_name, sizeof(hmac_md_name), OBJ_nid2obj(pbmac1_kdf_nid), 0) < 0)
249	0	goto err;
250	0	hmac_md = EVP_MD_fetch(libctx, hmac_md_name, propq);
251	0	if (hmac_md == NULL)
252	0	goto err;
253	0	fetched = 1;
254	0	}
255	0	if (pkcs12_key_gen != NULL) {
256	0	int res = (*pkcs12_key_gen)(pass, passlen, salt, saltlen, PKCS12_MAC_ID,
257	0	iter, keylen, key, hmac_md, libctx, propq);
258
259	0	if (fetched)
260	0	EVP_MD_free(hmac_md);
261	0	if (res != 1) {
262	0	ERR_raise(ERR_LIB_PKCS12, PKCS12_R_KEY_GEN_ERROR);
263	0	goto err;
264	0	}
265	0	} else {
266	0	if (fetched)
267	0	EVP_MD_free(hmac_md);
268		/* Default to UTF-8 password */
269	0	if (!PKCS12_key_gen_utf8_ex(pass, passlen, salt, saltlen, PKCS12_MAC_ID,
270	0	iter, keylen, key, md, libctx, propq)) {
271	0	ERR_raise(ERR_LIB_PKCS12, PKCS12_R_KEY_GEN_ERROR);
272	0	goto err;
273	0	}
274	0	}
275	0	}
276	0	if ((hmac = HMAC_CTX_new()) == NULL
277	0	\|\| !HMAC_Init_ex(hmac, key, keylen, md, NULL)
278	0	\|\| !HMAC_Update(hmac, p12->authsafes->d.data->data,
279	0	p12->authsafes->d.data->length)
280	0	\|\| !HMAC_Final(hmac, mac, maclen)) {
281	0	goto err;
282	0	}
283	0	ret = 1;
284
285	0	err:
286	0	OPENSSL_cleanse(key, sizeof(key));
287	0	HMAC_CTX_free(hmac);
288	0	EVP_MD_free(md_fetch);
289	0	return ret;
290	0	}
291
292		int PKCS12_gen_mac(PKCS12 p12, const char pass, int passlen,
293		unsigned char mac, unsigned int maclen)
294	0	{
295	0	return pkcs12_gen_mac(p12, pass, passlen, mac, maclen, NID_undef, NID_undef, NULL);
296	0	}
297
298		/* Verify the mac */
299		int PKCS12_verify_mac(PKCS12 p12, const char pass, int passlen)
300	0	{
301	0	unsigned char mac[EVP_MAX_MD_SIZE];
302	0	unsigned int maclen;
303	0	const ASN1_OCTET_STRING *macoct;
304	0	const X509_ALGOR *macalg;
305	0	const ASN1_OBJECT *macoid;
306
307	0	if (p12->mac == NULL) {
308	0	ERR_raise(ERR_LIB_PKCS12, PKCS12_R_MAC_ABSENT);
309	0	return 0;
310	0	}
311
312	0	X509_SIG_get0(p12->mac->dinfo, &macalg, NULL);
313	0	X509_ALGOR_get0(&macoid, NULL, NULL, macalg);
314	0	if (OBJ_obj2nid(macoid) == NID_pbmac1) {
315	0	PBMAC1PARAM *param = NULL;
316	0	const ASN1_OBJECT *hmac_oid;
317	0	int md_nid = NID_undef;
318
319	0	param = ASN1_TYPE_unpack_sequence(ASN1_ITEM_rptr(PBMAC1PARAM), macalg->parameter);
320	0	if (param == NULL) {
321	0	ERR_raise(ERR_LIB_PKCS12, ERR_R_UNSUPPORTED);
322	0	return 0;
323	0	}
324	0	X509_ALGOR_get0(&hmac_oid, NULL, NULL, param->messageAuthScheme);
325	0	md_nid = ossl_hmac2mdnid(OBJ_obj2nid(hmac_oid));
326
327	0	if (!pkcs12_gen_mac(p12, pass, passlen, mac, &maclen, md_nid, NID_undef, NULL)) {
328	0	ERR_raise(ERR_LIB_PKCS12, PKCS12_R_MAC_GENERATION_ERROR);
329	0	PBMAC1PARAM_free(param);
330	0	return 0;
331	0	}
332	0	PBMAC1PARAM_free(param);
333	0	} else {
334	0	if (!pkcs12_gen_mac(p12, pass, passlen, mac, &maclen, NID_undef, NID_undef, NULL)) {
335	0	ERR_raise(ERR_LIB_PKCS12, PKCS12_R_MAC_GENERATION_ERROR);
336	0	return 0;
337	0	}
338	0	}
339	0	X509_SIG_get0(p12->mac->dinfo, NULL, &macoct);
340	0	if ((maclen != (unsigned int)ASN1_STRING_length(macoct))
341	0	\|\| CRYPTO_memcmp(mac, ASN1_STRING_get0_data(macoct), maclen) != 0)
342	0	return 0;
343
344	0	return 1;
345	0	}
346
347		/* Set a mac */
348		int PKCS12_set_mac(PKCS12 p12, const char pass, int passlen,
349		unsigned char *salt, int saltlen, int iter,
350		const EVP_MD *md_type)
351	0	{
352	0	unsigned char mac[EVP_MAX_MD_SIZE];
353	0	unsigned int maclen;
354	0	ASN1_OCTET_STRING *macoct;
355
356	0	if (md_type == NULL)
357		/* No need to do a fetch as the md_type is used only to get a NID */
358	0	md_type = EVP_sha256();
359	0	if (!iter)
360	0	iter = PKCS12_DEFAULT_ITER;
361	0	if (PKCS12_setup_mac(p12, iter, salt, saltlen, md_type) == PKCS12_ERROR) {
362	0	ERR_raise(ERR_LIB_PKCS12, PKCS12_R_MAC_SETUP_ERROR);
363	0	return 0;
364	0	}
365		/*
366		* Note that output mac is forced to UTF-8...
367		*/
368	0	if (!pkcs12_gen_mac(p12, pass, passlen, mac, &maclen, NID_undef, NID_undef, NULL)) {
369	0	ERR_raise(ERR_LIB_PKCS12, PKCS12_R_MAC_GENERATION_ERROR);
370	0	return 0;
371	0	}
372	0	X509_SIG_getm(p12->mac->dinfo, NULL, &macoct);
373	0	if (!ASN1_OCTET_STRING_set(macoct, mac, maclen)) {
374	0	ERR_raise(ERR_LIB_PKCS12, PKCS12_R_MAC_STRING_SET_ERROR);
375	0	return 0;
376	0	}
377	0	return 1;
378	0	}
379
380		static int pkcs12_pbmac1_pbkdf2_key_gen(const char *pass, int passlen,
381		unsigned char *salt, int saltlen,
382		int id, int iter, int keylen,
383		unsigned char *out,
384		const EVP_MD *md_type,
385		OSSL_LIB_CTX libctx, const char propq)
386	0	{
387	0	return ossl_pkcs5_pbkdf2_hmac_ex(pass, passlen, salt, saltlen, iter, md_type,
388	0	keylen, out, libctx, propq);
389	0	}
390
391		static int pkcs12_setup_mac(PKCS12 p12, int iter, unsigned char salt, int saltlen,
392		int nid)
393	0	{
394	0	X509_ALGOR *macalg;
395
396	0	PKCS12_MAC_DATA_free(p12->mac);
397	0	p12->mac = NULL;
398
399	0	if ((p12->mac = PKCS12_MAC_DATA_new()) == NULL)
400	0	return PKCS12_ERROR;
401	0	if (iter > 1) {
402	0	if ((p12->mac->iter = ASN1_INTEGER_new()) == NULL) {
403	0	ERR_raise(ERR_LIB_PKCS12, ERR_R_ASN1_LIB);
404	0	return 0;
405	0	}
406	0	if (!ASN1_INTEGER_set(p12->mac->iter, iter)) {
407	0	ERR_raise(ERR_LIB_PKCS12, ERR_R_ASN1_LIB);
408	0	return 0;
409	0	}
410	0	}
411	0	if (saltlen == 0)
412	0	saltlen = PKCS12_SALT_LEN;
413	0	else if (saltlen < 0)
414	0	return 0;
415	0	if ((p12->mac->salt->data = OPENSSL_malloc(saltlen)) == NULL)
416	0	return 0;
417	0	p12->mac->salt->length = saltlen;
418	0	if (salt == NULL) {
419	0	if (RAND_bytes_ex(p12->authsafes->ctx.libctx, p12->mac->salt->data,
420	0	(size_t)saltlen, 0) <= 0)
421	0	return 0;
422	0	} else {
423	0	memcpy(p12->mac->salt->data, salt, saltlen);
424	0	}
425	0	X509_SIG_getm(p12->mac->dinfo, &macalg, NULL);
426	0	if (!X509_ALGOR_set0(macalg, OBJ_nid2obj(nid), V_ASN1_NULL, NULL)) {
427	0	ERR_raise(ERR_LIB_PKCS12, ERR_R_ASN1_LIB);
428	0	return 0;
429	0	}
430
431	0	return 1;
432	0	}
433
434		/* Set up a mac structure */
435		int PKCS12_setup_mac(PKCS12 p12, int iter, unsigned char salt, int saltlen,
436		const EVP_MD *md_type)
437	0	{
438	0	return pkcs12_setup_mac(p12, iter, salt, saltlen, EVP_MD_get_type(md_type));
439	0	}
440
441		int PKCS12_set_pbmac1_pbkdf2(PKCS12 p12, const char pass, int passlen,
442		unsigned char *salt, int saltlen, int iter,
443		const EVP_MD md_type, const char prf_md_name)
444	0	{
445	0	unsigned char mac[EVP_MAX_MD_SIZE];
446	0	unsigned int maclen;
447	0	ASN1_OCTET_STRING *macoct;
448	0	X509_ALGOR *alg = NULL;
449	0	int ret = 0;
450	0	int prf_md_nid = NID_undef, prf_nid = NID_undef, hmac_nid;
451	0	unsigned char *known_salt = NULL;
452	0	int keylen = 0;
453	0	PBMAC1PARAM *param = NULL;
454	0	X509_ALGOR hmac_alg = NULL, macalg = NULL;
455	0	OSSL_LIB_CTX *libctx = p12->authsafes->ctx.libctx;
456
457	0	if (md_type == NULL)
458		/* No need to do a fetch as the md_type is used only to get a NID */
459	0	md_type = EVP_sha256();
460
461	0	if (prf_md_name == NULL)
462	0	prf_md_nid = EVP_MD_get_type(md_type);
463	0	else
464	0	prf_md_nid = OBJ_txt2nid(prf_md_name);
465
466	0	if (iter == 0)
467	0	iter = PKCS12_DEFAULT_ITER;
468
469	0	keylen = EVP_MD_get_size(md_type);
470
471	0	prf_nid = ossl_md2hmacnid(prf_md_nid);
472	0	hmac_nid = ossl_md2hmacnid(EVP_MD_get_type(md_type));
473
474	0	if (prf_nid == NID_undef \|\| hmac_nid == NID_undef) {
475	0	ERR_raise(ERR_LIB_PKCS12, PKCS12_R_UNKNOWN_DIGEST_ALGORITHM);
476	0	goto err;
477	0	}
478
479	0	if (salt == NULL) {
480	0	if (saltlen < 0) {
481	0	ERR_raise(ERR_LIB_PKCS12, PKCS12_R_INVALID_SALT_LENGTH);
482	0	goto err;
483	0	}
484	0	if (saltlen > 0) {
485	0	known_salt = OPENSSL_malloc(saltlen);
486	0	if (known_salt == NULL)
487	0	goto err;
488
489	0	if (RAND_bytes_ex(libctx, known_salt, saltlen, 0) <= 0) {
490	0	ERR_raise(ERR_LIB_PKCS12, ERR_R_RAND_LIB);
491	0	goto err;
492	0	}
493	0	}
494	0	}
495
496	0	param = PBMAC1PARAM_new();
497	0	hmac_alg = X509_ALGOR_new();
498	0	alg = PKCS5_pbkdf2_set_ex(iter, salt ? salt : known_salt, saltlen,
499	0	prf_nid, keylen, libctx);
500	0	if (param == NULL \|\| hmac_alg == NULL \|\| alg == NULL)
501	0	goto err;
502
503	0	if (pkcs12_setup_mac(p12, iter, salt ? salt : known_salt, saltlen,
504	0	NID_pbmac1) == PKCS12_ERROR) {
505	0	ERR_raise(ERR_LIB_PKCS12, PKCS12_R_MAC_SETUP_ERROR);
506	0	goto err;
507	0	}
508
509	0	if (!X509_ALGOR_set0(hmac_alg, OBJ_nid2obj(hmac_nid), V_ASN1_NULL, NULL)) {
510	0	ERR_raise(ERR_LIB_PKCS12, PKCS12_R_MAC_SETUP_ERROR);
511	0	goto err;
512	0	}
513
514	0	X509_ALGOR_free(param->keyDerivationFunc);
515	0	X509_ALGOR_free(param->messageAuthScheme);
516	0	param->keyDerivationFunc = alg;
517	0	param->messageAuthScheme = hmac_alg;
518
519	0	X509_SIG_getm(p12->mac->dinfo, &macalg, &macoct);
520	0	if (!ASN1_TYPE_pack_sequence(ASN1_ITEM_rptr(PBMAC1PARAM), param, &macalg->parameter))
521	0	goto err;
522
523		/*
524		* Note that output mac is forced to UTF-8...
525		*/
526	0	if (!pkcs12_gen_mac(p12, pass, passlen, mac, &maclen,
527	0	EVP_MD_get_type(md_type), prf_md_nid,
528	0	pkcs12_pbmac1_pbkdf2_key_gen)) {
529	0	ERR_raise(ERR_LIB_PKCS12, PKCS12_R_MAC_GENERATION_ERROR);
530	0	goto err;
531	0	}
532	0	if (!ASN1_OCTET_STRING_set(macoct, mac, maclen)) {
533	0	ERR_raise(ERR_LIB_PKCS12, PKCS12_R_MAC_STRING_SET_ERROR);
534	0	goto err;
535	0	}
536	0	ret = 1;
537
538	0	err:
539	0	PBMAC1PARAM_free(param);
540	0	OPENSSL_free(known_salt);
541	0	return ret;
542	0	}