key-openssl.cpp@ 100491

Last change on this file since 100491 was 100491, checked in by vboxsync, 17 months ago
Forward ported r158259 from 6.1: Support ECDSA for pre-3.0.0 OpenSSL versions. bugref:10479 ticketref:21621
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 13.0 KB

Line
1	/* $Id: key-openssl.cpp 100491 2023-07-10 22:05:12Z vboxsync $ */
2	/** @file
3	* IPRT - Crypto - Cryptographic Keys, OpenSSL glue.
4	*/
5
6	/*
7	* Copyright (C) 2006-2023 Oracle and/or its affiliates.
8	*
9	* This file is part of VirtualBox base platform packages, as
10	* available from https://www.virtualbox.org.
11	*
12	* This program is free software; you can redistribute it and/or
13	* modify it under the terms of the GNU General Public License
14	* as published by the Free Software Foundation, in version 3 of the
15	* License.
16	*
17	* This program is distributed in the hope that it will be useful, but
18	* WITHOUT ANY WARRANTY; without even the implied warranty of
19	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20	* General Public License for more details.
21	*
22	* You should have received a copy of the GNU General Public License
23	* along with this program; if not, see <https://www.gnu.org/licenses>.
24	*
25	* The contents of this file may alternatively be used under the terms
26	* of the Common Development and Distribution License Version 1.0
27	* (CDDL), a copy of it is provided in the "COPYING.CDDL" file included
28	* in the VirtualBox distribution, in which case the provisions of the
29	* CDDL are applicable instead of those of the GPL.
30	*
31	* You may elect to license modified versions of this file under the
32	* terms and conditions of either the GPL or the CDDL or both.
33	*
34	* SPDX-License-Identifier: GPL-3.0-only OR CDDL-1.0
35	*/
36
37
38	/*********************************************************************************************************************************
39	* Header Files *
40	*********************************************************************************************************************************/
41	#define LOG_GROUP RTLOGGROUP_CRYPTO
42	#include "internal/iprt.h"
43	#include <iprt/crypto/key.h>
44
45	#include <iprt/err.h>
46	#include <iprt/log.h>
47	#include <iprt/mem.h>
48	#include <iprt/string.h>
49	#include <iprt/crypto/digest.h>
50
51	#ifdef IPRT_WITH_OPENSSL
52	# include "internal/iprt-openssl.h"
53	# include "internal/magics.h"
54	# include "internal/openssl-pre.h"
55	# include <openssl/evp.h>
56	# include "internal/openssl-post.h"
57	# ifndef OPENSSL_VERSION_NUMBER
58	# error "Missing OPENSSL_VERSION_NUMBER!"
59	# endif
60	# if OPENSSL_VERSION_NUMBER < 0x30000000 \|\| defined(LIBRESSL_VERSION_NUMBER)
61	# include "openssl/x509.h"
62	# include <iprt/crypto/x509.h>
63	# endif
64
65	# include "key-internal.h"
66
67
68	/**
69	* Helper that loads key parameters and the actual key bits if present.
70	*/
71	static int rtCrKeyToOpenSslKeyLoad(RTCRKEY hKey, int idKeyType, EVP_PKEY **ppEvpNewKey, bool fNeedPublic, PRTERRINFO pErrInfo)
72	{
73	int rc = VINF_SUCCESS;
74	if ( hKey->enmType == RTCRKEYTYPE_ECDSA_PUBLIC
75	\|\| hKey->enmType == RTCRKEYTYPE_ECDSA_PRIVATE)
76	{
77	# if OPENSSL_VERSION_NUMBER >= 0x30000000 && !defined(LIBRESSL_VERSION_NUMBER)
78	void *pvFree = NULL;
79	const uint8_t *pbRaw = NULL;
80	uint32_t cbRaw = 0;
81	if (hKey->enmType == RTCRKEYTYPE_ECDSA_PUBLIC)
82	rc = RTAsn1EncodeQueryRawBits(&hKey->u.EcdsaPublic.NamedCurve.Asn1Core, &pbRaw, &cbRaw, &pvFree, pErrInfo);
83	else
84	AssertFailedStmt(rc = VERR_NOT_IMPLEMENTED);
85	if (RT_SUCCESS(rc))
86	{
87	const unsigned char *puchParams = pbRaw;
88	EVP_PKEY *pRet = d2i_KeyParams(idKeyType, ppEvpNewKey, &puchParams, cbRaw);
89	if (pRet != NULL && pRet == *ppEvpNewKey)
90	rc = VINF_SUCCESS;
91	else
92	rc = RTERRINFO_LOG_SET(pErrInfo, VERR_CR_PKIX_OSSL_D2I_KEY_PARAMS_FAILED, "d2i_KeyParams failed");
93
94	RTMemTmpFree(pvFree);
95	}
96	#else
97	/*
98	* Cannot find any real suitable alternative to d2i_KeyParams in pre-3.0.x
99	* OpenSSL, so decided to use d2i_PUBKEY instead. This means we need to
100	* encode the stuff a X.509 SubjectPublicKeyInfo ASN.1 sequence first.
101	*/
102	if (hKey->enmType == RTCRKEYTYPE_ECDSA_PUBLIC)
103	{
104	RTCRX509SUBJECTPUBLICKEYINFO PubKeyInfo;
105	rc = RTCrX509SubjectPublicKeyInfo_Init(&PubKeyInfo, &g_RTAsn1DefaultAllocator);
106	AssertRCReturn(rc, rc);
107
108	rc = RTAsn1ObjId_SetFromString(&PubKeyInfo.Algorithm.Algorithm, RTCRX509ALGORITHMIDENTIFIERID_ECDSA,
109	&g_RTAsn1DefaultAllocator);
110	if (RT_SUCCESS(rc))
111	rc = RTAsn1DynType_SetToObjId(&PubKeyInfo.Algorithm.Parameters, &hKey->u.EcdsaPublic.NamedCurve,
112	&g_RTAsn1DefaultAllocator);
113	if (RT_SUCCESS(rc))
114	{
115	RTAsn1BitString_Delete(&PubKeyInfo.SubjectPublicKey);
116	rc = RTAsn1BitString_InitWithData(&PubKeyInfo.SubjectPublicKey, hKey->pbEncoded, hKey->cbEncoded * 8,
117	&g_RTAsn1DefaultAllocator);
118	if (RT_SUCCESS(rc))
119	{
120	/* Encode the whole shebang. */
121	void *pvFree = NULL;
122	const uint8_t *pbRaw = NULL;
123	uint32_t cbRaw = 0;
124	rc = RTAsn1EncodeQueryRawBits(&PubKeyInfo.SeqCore.Asn1Core, &pbRaw, &cbRaw, &pvFree, pErrInfo);
125	if (RT_SUCCESS(rc))
126	{
127
128	const unsigned char *puchPubKey = pbRaw;
129	EVP_PKEY *pRet = d2i_PUBKEY(ppEvpNewKey, &puchPubKey, cbRaw);
130	if (pRet != NULL && pRet == *ppEvpNewKey)
131	rc = VINF_SUCCESS;
132	else
133	rc = RTERRINFO_LOG_SET(pErrInfo, VERR_CR_PKIX_OSSL_D2I_KEY_PARAMS_FAILED, "d2i_KeyParams failed");
134	RTMemTmpFree(pvFree);
135	}
136	}
137	}
138	AssertRC(rc);
139	RTCrX509SubjectPublicKeyInfo_Delete(&PubKeyInfo);
140	return rc;
141	}
142	rc = RTERRINFO_LOG_SET_F(pErrInfo, VERR_CR_OPENSSL_VERSION_TOO_OLD,
143	"OpenSSL version %#x is too old for IPRTs ECDSA code", OPENSSL_VERSION_NUMBER);
144	RT_NOREF(idKeyType, ppEvpNewKey);
145	#endif
146	}
147
148	if (RT_SUCCESS(rc))
149	{
150	/*
151	* Load the key into the structure.
152	*/
153	const unsigned char *puchPublicKey = hKey->pbEncoded;
154	EVP_PKEY *pRet;
155	if (fNeedPublic)
156	pRet = d2i_PublicKey(idKeyType, ppEvpNewKey, &puchPublicKey, hKey->cbEncoded);
157	else
158	pRet = d2i_PrivateKey(idKeyType, ppEvpNewKey, &puchPublicKey, hKey->cbEncoded);
159	if (pRet != NULL && pRet == *ppEvpNewKey)
160	return VINF_SUCCESS;
161
162	/* Bail out: */
163	if (fNeedPublic)
164	rc = RTERRINFO_LOG_SET(pErrInfo, VERR_CR_PKIX_OSSL_D2I_PUBLIC_KEY_FAILED, "d2i_PublicKey failed");
165	else
166	rc = RTERRINFO_LOG_SET(pErrInfo, VERR_CR_PKIX_OSSL_D2I_PRIVATE_KEY_FAILED, "d2i_PrivateKey failed");
167	}
168	return rc;
169	}
170
171
172	/**
173	* Creates an OpenSSL key for the given IPRT one, returning the message digest
174	* algorithm if desired.
175	*
176	* @returns IRPT status code.
177	* @param hKey The key to convert to an OpenSSL key.
178	* @param fNeedPublic Set if we need the public side of the key.
179	* @param pszAlgoObjId Alogrithm stuff we currently need.
180	* @param ppEvpKey Where to return the pointer to the key structure.
181	* @param ppEvpMdType Where to optionally return the message digest type.
182	* @param pErrInfo Where to optionally return more error details.
183	*/
184	DECLHIDDEN(int) rtCrKeyToOpenSslKey(RTCRKEY hKey, bool fNeedPublic, void /EVP_PKEY/ **ppEvpKey, PRTERRINFO pErrInfo)
185	{
186	*ppEvpKey = NULL;
187	AssertReturn(hKey->u32Magic == RTCRKEYINT_MAGIC, VERR_INVALID_HANDLE);
188	AssertReturn(fNeedPublic == !(hKey->fFlags & RTCRKEYINT_F_PRIVATE), VERR_WRONG_TYPE);
189	AssertReturn(hKey->fFlags & RTCRKEYINT_F_INCLUDE_ENCODED, VERR_WRONG_TYPE); /* build misconfig */
190
191	rtCrOpenSslInit();
192
193	/*
194	* Translate the key type from IPRT to EVP speak.
195	*/
196	int idKeyType;
197	switch (hKey->enmType)
198	{
199	case RTCRKEYTYPE_RSA_PRIVATE:
200	case RTCRKEYTYPE_RSA_PUBLIC:
201	idKeyType = EVP_PKEY_RSA;
202	break;
203
204	case RTCRKEYTYPE_ECDSA_PUBLIC:
205	case RTCRKEYTYPE_ECDSA_PRIVATE:
206	idKeyType = EVP_PKEY_EC;
207	break;
208
209	default:
210	return RTErrInfoSetF(pErrInfo, VERR_NOT_SUPPORTED, "Unsupported key type: %d", hKey->enmType);
211	}
212
213	/*
214	* Allocate a new key structure and set its type.
215	*/
216	EVP_PKEY *pEvpNewKey = EVP_PKEY_new();
217	if (!pEvpNewKey)
218	return RTErrInfoSetF(pErrInfo, VERR_NO_MEMORY, "EVP_PKEY_new/%d failed", idKeyType);
219
220	/*
221	* Load key parameters and the key into the EVP structure.
222	*/
223	int rc = rtCrKeyToOpenSslKeyLoad(hKey, idKeyType, &pEvpNewKey, fNeedPublic, pErrInfo);
224	if (RT_SUCCESS(rc))
225	{
226	*ppEvpKey = pEvpNewKey;
227	return rc;
228	}
229	EVP_PKEY_free(pEvpNewKey);
230	return rc;
231	}
232
233
234	/**
235	* Creates an OpenSSL key for the given IPRT one, returning the message digest
236	* algorithm if desired.
237	*
238	* @returns IRPT status code.
239	* @param hKey The key to convert to an OpenSSL key.
240	* @param fNeedPublic Set if we need the public side of the key.
241	* @param pszAlgoObjId Alogrithm stuff we currently need.
242	* @param ppEvpKey Where to return the pointer to the key structure.
243	* @param ppEvpMdType Where to optionally return the message digest type.
244	* @param pErrInfo Where to optionally return more error details.
245	*/
246	DECLHIDDEN(int) rtCrKeyToOpenSslKeyEx(RTCRKEY hKey, bool fNeedPublic, const char *pszAlgoObjId,
247	void /EVP_PKEY/ *ppEvpKey, const void /EVP_MD/ *ppEvpMdType, PRTERRINFO pErrInfo)
248	{
249	*ppEvpKey = NULL;
250	if (ppEvpMdType)
251	*ppEvpMdType = NULL;
252	AssertReturn(hKey->u32Magic == RTCRKEYINT_MAGIC, VERR_INVALID_HANDLE);
253	AssertReturn(fNeedPublic == !(hKey->fFlags & RTCRKEYINT_F_PRIVATE), VERR_WRONG_TYPE);
254	AssertReturn(hKey->fFlags & RTCRKEYINT_F_INCLUDE_ENCODED, VERR_WRONG_TYPE); /* build misconfig */
255
256	rtCrOpenSslInit();
257
258	/*
259	* Translate algorithm object ID into stuff that OpenSSL wants.
260	*/
261	int iAlgoNid = OBJ_txt2nid(pszAlgoObjId);
262	if (iAlgoNid == NID_undef)
263	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_CR_PKIX_OSSL_CIPHER_ALGO_NOT_KNOWN,
264	"Unknown public key algorithm [OpenSSL]: %s", pszAlgoObjId);
265	const char *pszAlgoSn = OBJ_nid2sn(iAlgoNid);
266
267	# if OPENSSL_VERSION_NUMBER >= 0x10001000 && !defined(LIBRESSL_VERSION_NUMBER)
268	int idAlgoPkey = 0;
269	int idAlgoMd = 0;
270	if (!OBJ_find_sigid_algs(iAlgoNid, &idAlgoMd, &idAlgoPkey))
271	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_CR_PKIX_OSSL_CIPHER_ALGO_NOT_KNOWN_EVP,
272	"OBJ_find_sigid_algs failed on %u (%s, %s)", iAlgoNid, pszAlgoSn, pszAlgoObjId);
273	if (ppEvpMdType)
274	{
275	const EVP_MD *pEvpMdType = EVP_get_digestbynid(idAlgoMd);
276	if (!pEvpMdType)
277	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_CR_PKIX_OSSL_CIPHER_ALGO_NOT_KNOWN_EVP,
278	"EVP_get_digestbynid failed on %d (%s, %s)", idAlgoMd, pszAlgoSn, pszAlgoObjId);
279	*ppEvpMdType = pEvpMdType;
280	}
281	# else
282	const EVP_MD *pEvpMdType = EVP_get_digestbyname(pszAlgoSn);
283	if (!pEvpMdType)
284	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_CR_PKIX_OSSL_CIPHER_ALGO_NOT_KNOWN_EVP,
285	"EVP_get_digestbyname failed on %s (%s)", pszAlgoSn, pszAlgoObjId);
286	if (ppEvpMdType)
287	*ppEvpMdType = pEvpMdType;
288	# endif
289
290	/*
291	* Allocate a new key structure and set its type.
292	*/
293	EVP_PKEY *pEvpNewKey = EVP_PKEY_new();
294	if (!pEvpNewKey)
295	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_NO_MEMORY, "EVP_PKEY_new(%d) failed", iAlgoNid);
296
297	int rc;
298	# if OPENSSL_VERSION_NUMBER >= 0x10001000 && !defined(LIBRESSL_VERSION_NUMBER)
299	if (EVP_PKEY_set_type(pEvpNewKey, idAlgoPkey))
300	{
301	int idKeyType = EVP_PKEY_base_id(pEvpNewKey);
302	# else
303	int idKeyType = pEvpNewKey->type = EVP_PKEY_type(pEvpMdType->required_pkey_type[0]);
304	# endif
305	if (idKeyType != NID_undef)
306
307	{
308	/*
309	* Load key parameters and the key into the EVP structure.
310	*/
311	rc = rtCrKeyToOpenSslKeyLoad(hKey, idKeyType, &pEvpNewKey, fNeedPublic, pErrInfo);
312	if (RT_SUCCESS(rc))
313	{
314	*ppEvpKey = pEvpNewKey;
315	return rc;
316	}
317	}
318	else
319	# if OPENSSL_VERSION_NUMBER < 0x10001000 \|\| defined(LIBRESSL_VERSION_NUMBER)
320	rc = RTERRINFO_LOG_SET(pErrInfo, VERR_CR_PKIX_OSSL_EVP_PKEY_TYPE_ERROR, "EVP_PKEY_type() failed");
321	# else
322	rc = RTERRINFO_LOG_SET(pErrInfo, VERR_CR_PKIX_OSSL_EVP_PKEY_TYPE_ERROR, "EVP_PKEY_base_id() failed");
323	}
324	else
325	rc = RTERRINFO_LOG_SET_F(pErrInfo, VERR_CR_PKIX_OSSL_EVP_PKEY_TYPE_ERROR,
326	"EVP_PKEY_set_type(%u) failed (sig algo %s)", idAlgoPkey, pszAlgoSn);
327	# endif
328
329	EVP_PKEY_free(pEvpNewKey);
330	*ppEvpKey = NULL;
331	return rc;
332	}
333
334	#endif /* IPRT_WITH_OPENSSL */
335

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Runtime/common/crypto/key-openssl.cpp@ 100491

Download in other formats: