pkix-sign.cpp@ 73665

Last change on this file since 73665 was 73665, checked in by vboxsync, 6 years ago
IPRT,SUP,Main: Working on new crypto key handling and rsa signing. bugref:9152
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 10.8 KB

Line
1	/* $Id: pkix-sign.cpp 73665 2018-08-14 17:49:23Z vboxsync $ */
2	/** @file
3	* IPRT - Crypto - Public Key Infrastructure API, Verification.
4	*/
5
6	/*
7	* Copyright (C) 2006-2017 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* The contents of this file may alternatively be used under the terms
18	* of the Common Development and Distribution License Version 1.0
19	* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20	* VirtualBox OSE distribution, in which case the provisions of the
21	* CDDL are applicable instead of those of the GPL.
22	*
23	* You may elect to license modified versions of this file under the
24	* terms and conditions of either the GPL or the CDDL or both.
25	*/
26
27
28	/*********************************************************************************************************************************
29	* Header Files *
30	*********************************************************************************************************************************/
31	#include "internal/iprt.h"
32	#include <iprt/crypto/pkix.h>
33
34	#include <iprt/err.h>
35	#include <iprt/mem.h>
36	#include <iprt/string.h>
37	#include <iprt/crypto/digest.h>
38	#include <iprt/crypto/key.h>
39
40	#ifdef IPRT_WITH_OPENSSL
41	# include "internal/iprt-openssl.h"
42	# include "openssl/evp.h"
43	# include "openssl/rsa.h"
44	# ifndef OPENSSL_VERSION_NUMBER
45	# error "Missing OPENSSL_VERSION_NUMBER!"
46	# endif
47	#endif
48
49
50	#if 0
51	RTDECL(int) RTCrPkixPubKeySignData(PCRTASN1OBJID pAlgorithm, PCRTASN1DYNTYPE pParameters, PCRTASN1BITSTRING pPrivateKey,
52	PCRTASN1BITSTRING pSignatureValue, const void *pvData, size_t cbData, PRTERRINFO pErrInfo)
53	{
54	/*
55	* Validate the digest related inputs.
56	*/
57	AssertPtrReturn(pAlgorithm, VERR_INVALID_POINTER);
58	AssertReturn(RTAsn1ObjId_IsPresent(pAlgorithm), VERR_INVALID_POINTER);
59
60	AssertPtrReturn(pvData, VERR_INVALID_POINTER);
61	AssertReturn(cbData > 0, VERR_INVALID_PARAMETER);
62
63	/*
64	* Digest the data and call the other API.
65	*/
66	RTCRDIGEST hDigest;
67	int rc = RTCrDigestCreateByObjId(&hDigest, pAlgorithm);
68	if (RT_SUCCESS(rcIprt))
69	{
70	rc = RTCrDigestUpdate(hDigest, pvData, cbData);
71	if (RT_SUCCESS(rcIprt))
72	rc = RTCrPkixPubKeySignDigest(pAlgorithm, pParameters, pPrivateKey, pvSignedDigest, cbSignedDigest, hDigest, pErrInfo);
73	else
74	RTErrInfoSet(pErrInfo, rcIprt, "RTCrDigestUpdate failed");
75	RTCrDigestRelease(hDigest);
76	}
77	else
78	RTErrInfoSetF(pErrInfo, rcIprt, "Unknown digest algorithm [IPRT]: %s", pAlgorithm->szObjId);
79	return rc;
80	}
81	#endif
82
83
84	RTDECL(int) RTCrPkixPubKeySignDigest(PCRTASN1OBJID pAlgorithm, RTCRKEY hPrivateKey, PCRTASN1DYNTYPE pParameters,
85	RTCRDIGEST hDigest, uint32_t fFlags,
86	void pvSignature, size_t pcbSignature, PRTERRINFO pErrInfo)
87	{
88	/*
89	* Valid input.
90	*/
91	AssertPtrReturn(pAlgorithm, VERR_INVALID_POINTER);
92	AssertReturn(RTAsn1ObjId_IsPresent(pAlgorithm), VERR_INVALID_POINTER);
93
94	if (pParameters)
95	{
96	AssertPtrReturn(pParameters, VERR_INVALID_POINTER);
97	if (pParameters->enmType == RTASN1TYPE_NULL)
98	pParameters = NULL;
99	}
100
101	AssertPtrReturn(hPrivateKey, VERR_INVALID_POINTER);
102	Assert(RTCrKeyHasPrivatePart(hPrivateKey));
103
104	AssertPtrReturn(pcbSignature, VERR_INVALID_PARAMETER);
105	size_t cbSignature = *pcbSignature;
106	if (cbSignature)
107	AssertPtrReturn(pvSignature, VERR_INVALID_POINTER);
108	else
109	pvSignature = NULL;
110
111	AssertPtrReturn(hDigest, VERR_INVALID_HANDLE);
112
113	AssertReturn(fFlags == 0, VERR_INVALID_FLAGS);
114
115	/*
116	* Parameters are not currently supported (openssl code path).
117	*/
118	if (pParameters)
119	return RTErrInfoSet(pErrInfo, VERR_CR_PKIX_CIPHER_ALGO_PARAMS_NOT_IMPL,
120	"Cipher algorithm parameters are not yet supported.");
121
122	/*
123	* Sign using IPRT.
124	*/
125	RTCRPKIXSIGNATURE hSignature;
126	int rcIprt = RTCrPkixSignatureCreateByObjId(&hSignature, pAlgorithm, hPrivateKey, pParameters, true /fSigning/);
127	if (RT_FAILURE(rcIprt))
128	return RTErrInfoSetF(pErrInfo, VERR_CR_PKIX_CIPHER_ALGO_NOT_KNOWN,
129	"Unknown private key algorithm [IPRT]: %s", pAlgorithm->szObjId);
130
131	rcIprt = RTCrPkixSignatureSign(hSignature, hDigest, pvSignature, pcbSignature);
132	if (RT_FAILURE(rcIprt))
133	RTErrInfoSet(pErrInfo, rcIprt, "RTCrPkixSignatureSign failed");
134
135	RTCrPkixSignatureRelease(hSignature);
136
137	/*
138	* Sign using OpenSSL EVP if we can.
139	*/
140	#if defined(IPRT_WITH_OPENSSL) \
141	&& (OPENSSL_VERSION_NUMBER > 0x10000000L) /* 0.9.8 doesn't seem to have EVP_PKEY_CTX_set_signature_md. */
142
143	/* Make sure the algorithm includes the digest and isn't just RSA. */
144	const char *pszAlgObjId = pAlgorithm->szObjId;
145	if (!strcmp(pszAlgObjId, RTCRX509ALGORITHMIDENTIFIERID_RSA))
146	{
147	pszAlgObjId = RTCrX509AlgorithmIdentifier_CombineEncryptionOidAndDigestOid(pszAlgObjId,
148	RTCrDigestGetAlgorithmOid(hDigest));
149	AssertMsgStmt(pszAlgObjId, ("enc=%s hash=%s\n", pAlgorithm->szObjId, RTCrDigestGetAlgorithmOid(hDigest)),
150	pszAlgObjId = RTCrDigestGetAlgorithmOid(hDigest));
151	}
152
153	/* Create an EVP private key. */
154	EVP_PKEY *pEvpPrivateKey = NULL;
155	const EVP_MD *pEvpMdType = NULL;
156	int rcOssl = rtCrKeyToOpenSslKey(hPrivateKey, false /fNeedPublic/, pszAlgObjId, &pEvpPrivateKey, &pEvpMdType, pErrInfo);
157	if (RT_SUCCESS(rcOssl))
158	{
159	/* Create an EVP Private key context we can use to validate the digest. */
160	EVP_PKEY_CTX *pEvpPKeyCtx = EVP_PKEY_CTX_new(pEvpPrivateKey, NULL);
161	if (pEvpPKeyCtx)
162	{
163	rcOssl = EVP_PKEY_sign_init(pEvpPKeyCtx);
164	if (rcOssl > 0)
165	{
166	rcOssl = EVP_PKEY_CTX_set_rsa_padding(pEvpPKeyCtx, RSA_PKCS1_PADDING);
167	if (rcOssl > 0)
168	{
169	rcOssl = EVP_PKEY_CTX_set_signature_md(pEvpPKeyCtx, pEvpMdType);
170	if (rcOssl > 0)
171	{
172	/* Allocate a signature buffer. */
173	unsigned char *pbOsslSignature = NULL;
174	void *pvOsslSignatureFree = NULL;
175	size_t cbOsslSignature = cbSignature;
176	if (cbOsslSignature > 0)
177	{
178	if (cbOsslSignature < _1K)
179	pbOsslSignature = (unsigned char *)alloca(cbOsslSignature);
180	else
181	{
182	pbOsslSignature = (unsigned char *)RTMemTmpAlloc(cbOsslSignature);
183	pvOsslSignatureFree = pbOsslSignature;
184	}
185	}
186	if (cbOsslSignature == 0 \|\| pbOsslSignature != NULL)
187	{
188	/* Get the digest from hDigest and sign it. */
189	rcOssl = EVP_PKEY_sign(pEvpPKeyCtx,
190	pbOsslSignature,
191	&cbOsslSignature,
192	(const unsigned char *)RTCrDigestGetHash(hDigest),
193	RTCrDigestGetHashSize(hDigest));
194	if (rcOssl > 0)
195	{
196	/* Compare the result. The memcmp assums no random padding bits. */
197	rcOssl = VINF_SUCCESS;
198	AssertMsgStmt(cbOsslSignature == *pcbSignature,
199	("cbOsslSignature=%#x, iprt %#x\n", cbOsslSignature, *pcbSignature),
200	rcOssl = VERR_CR_PKIX_OSSL_VS_IPRT_SIGNATURE_SIZE);
201	AssertMsgStmt( pbOsslSignature == NULL
202	\|\| rcOssl != VINF_SUCCESS
203	\|\| memcmp(pbOsslSignature, pvSignature, cbOsslSignature) == 0,
204	("OpenSSL: %.*Rhxs\n"
205	"IPRT: %.*Rhxs\n",
206	cbOsslSignature, pbOsslSignature, *pcbSignature, pvSignature),
207	rcOssl = VERR_CR_PKIX_OSSL_VS_IPRT_SIGNATURE);
208	if (!pbOsslSignature && rcOssl == VINF_SUCCESS)
209	rcOssl = VERR_BUFFER_OVERFLOW;
210	}
211	else
212	rcOssl = RTErrInfoSetF(pErrInfo, VERR_CR_PKIX_OSSL_SIGN_FINAL_FAILED,
213	"EVP_PKEY_sign failed (%d)", rcOssl);
214	if (pvOsslSignatureFree)
215	RTMemTmpFree(pvOsslSignatureFree);
216	}
217	else
218	rcOssl = VERR_NO_TMP_MEMORY;
219	}
220	else
221	rcOssl = RTErrInfoSetF(pErrInfo, VERR_CR_PKIX_OSSL_EVP_PKEY_TYPE_ERROR,
222	"EVP_PKEY_CTX_set_signature_md failed (%d)", rcOssl);
223	}
224	else
225	rcOssl = RTErrInfoSetF(pErrInfo, VERR_CR_PKIX_OSSL_EVP_PKEY_RSA_PAD_ERROR,
226	"EVP_PKEY_CTX_set_rsa_padding failed (%d)", rcOssl);
227	}
228	else
229	rcOssl = RTErrInfoSetF(pErrInfo, VERR_CR_PKIX_OSSL_EVP_PKEY_TYPE_ERROR,
230	"EVP_PKEY_verify_init failed (%d)", rcOssl);
231	EVP_PKEY_CTX_free(pEvpPKeyCtx);
232	}
233	else
234	rcOssl = RTErrInfoSet(pErrInfo, VERR_CR_PKIX_OSSL_EVP_PKEY_TYPE_ERROR, "EVP_PKEY_CTX_new failed");
235	EVP_PKEY_free(pEvpPrivateKey);
236	}
237
238	/*
239	* Check the result.
240	*/
241	if (RT_SUCCESS(rcIprt) && RT_SUCCESS(rcOssl))
242	return VINF_SUCCESS;
243	if (RT_FAILURE_NP(rcIprt) && RT_FAILURE_NP(rcOssl))
244	return rcIprt;
245	AssertMsgFailed(("rcIprt=%Rrc rcOssl=%Rrc\n", rcIprt, rcOssl));
246	if (RT_FAILURE_NP(rcOssl))
247	return rcOssl;
248	#endif /* IPRT_WITH_OPENSSL */
249
250	return rcIprt;
251	}
252

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Runtime/common/crypto/pkix-sign.cpp@ 73665

Download in other formats: