VirtualBox

source: vbox/trunk/src/VBox/Runtime/common/crypto/pkix-signature-ossl.cpp@ 100447

Last change on this file since 100447 was 100447, checked in by vboxsync, 17 months ago

IPRT,OpenSSL: Support ECDSA for verficiation purposes when IPRT links with OpenSSL. This required quite a bit of cleanups, so not entirely no-risk. [build fix for older OpenSSL] bugref:10479 ticketref:21621
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 10.5 KB
Line 
1/* $Id: pkix-signature-ossl.cpp 100447 2023-07-08 18:50:27Z vboxsync $ */
2/** @file
3 * IPRT - Crypto - Public Key Signature Schema Algorithm, ECDSA Providers.
4 */
5
6/*
7 * Copyright (C) 2006-2023 Oracle and/or its affiliates.
8 *
9 * This file is part of VirtualBox base platform packages, as
10 * available from https://www.virtualbox.org.
11 *
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation, in version 3 of the
15 * License.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20 * General Public License for more details.
21 *
22 * You should have received a copy of the GNU General Public License
23 * along with this program; if not, see <https://www.gnu.org/licenses>.
24 *
25 * The contents of this file may alternatively be used under the terms
26 * of the Common Development and Distribution License Version 1.0
27 * (CDDL), a copy of it is provided in the "COPYING.CDDL" file included
28 * in the VirtualBox distribution, in which case the provisions of the
29 * CDDL are applicable instead of those of the GPL.
30 *
31 * You may elect to license modified versions of this file under the
32 * terms and conditions of either the GPL or the CDDL or both.
33 *
34 * SPDX-License-Identifier: GPL-3.0-only OR CDDL-1.0
35 */
36
37
38/*********************************************************************************************************************************
39* Header Files *
40*********************************************************************************************************************************/
41#ifdef IPRT_WITH_OPENSSL /* whole file */
42# define LOG_GROUP RTLOGGROUP_CRYPTO
43# include "internal/iprt.h"
44# include <iprt/crypto/rsa.h>
45
46# include <iprt/bignum.h>
47# include <iprt/err.h>
48# include <iprt/log.h>
49# include <iprt/mem.h>
50# include <iprt/string.h>
51# include <iprt/crypto/digest.h>
52# include <iprt/crypto/pkix.h>
53
54# include "internal/iprt-openssl.h"
55# include "internal/openssl-pre.h"
56# include <openssl/evp.h>
57# include "internal/openssl-post.h"
58# ifndef OPENSSL_VERSION_NUMBER
59# error "Missing OPENSSL_VERSION_NUMBER!"
60# endif
61
62# include "pkix-signature-builtin.h"
63# include "rsa-internal.h"
64# include "key-internal.h"
65
66
67/*********************************************************************************************************************************
68* Structures and Typedefs *
69*********************************************************************************************************************************/
70/**
71 * OpenSSL EVP signature provider instance.
72 */
73typedef struct RTCRPKIXSIGNATUREOSSLEVP
74{
75 /** Set if we're signing, clear if verifying. */
76 bool fSigning;
77} RTCRPKIXSIGNATUREOSSLEVP;
78/** Pointer to an OpenSSL EVP signature provider instance. */
79typedef RTCRPKIXSIGNATUREOSSLEVP *PRTCRPKIXSIGNATUREOSSLEVP;
80
81
82
83/** @impl_interface_method{RTCRPKIXSIGNATUREDESC,pfnInit} */
84static DECLCALLBACK(int) rtCrPkixSignatureOsslEvp_Init(PCRTCRPKIXSIGNATUREDESC pDesc, void *pvState, void *pvOpaque,
85 bool fSigning, RTCRKEY hKey, PCRTASN1DYNTYPE pParams)
86{
87 RT_NOREF_PV(pvOpaque);
88
89 RTCRKEYTYPE enmKeyType = RTCrKeyGetType(hKey);
90 if (strcmp(pDesc->pszObjId, RTCR_X962_ECDSA_OID) == 0)
91 {
92 if (fSigning)
93 AssertReturn(enmKeyType == RTCRKEYTYPE_ECDSA_PRIVATE, VERR_CR_PKIX_NOT_ECDSA_PRIVATE_KEY);
94 else
95 AssertReturn(enmKeyType == RTCRKEYTYPE_ECDSA_PUBLIC, VERR_CR_PKIX_NOT_ECDSA_PUBLIC_KEY);
96 }
97 else if (strcmp(pDesc->pszObjId, RTCR_PKCS1_RSA_OID) == 0)
98 {
99 if (fSigning)
100 AssertReturn(enmKeyType == RTCRKEYTYPE_RSA_PRIVATE, VERR_CR_PKIX_NOT_RSA_PRIVATE_KEY);
101 else
102 AssertReturn(enmKeyType == RTCRKEYTYPE_RSA_PUBLIC, VERR_CR_PKIX_NOT_RSA_PUBLIC_KEY);
103 }
104 else
105 AssertFailedReturn(VERR_INTERNAL_ERROR_3);
106 int rc = RTCrKeyVerifyParameterCompatibility(hKey, pParams, true /*fForSignature*/, NULL /*pAlgorithm*/, NULL /*pErrInfo*/);
107 if (RT_FAILURE(rc))
108 return rc;
109
110 /*
111 * Locate the EVP_MD for the algorithm.
112 */
113 rtCrOpenSslInit();
114 int iAlgoNid = OBJ_txt2nid(pDesc->pszObjId);
115 if (iAlgoNid != NID_undef)
116 {
117 PRTCRPKIXSIGNATUREOSSLEVP pThis = (PRTCRPKIXSIGNATUREOSSLEVP)pvState;
118 pThis->fSigning = fSigning;
119 return VINF_SUCCESS;
120 }
121 return VERR_CR_PKIX_OSSL_CIPHER_ALGO_NOT_KNOWN_EVP;
122}
123
124
125/** @impl_interface_method{RTCRPKIXSIGNATUREDESC,pfnReset} */
126static DECLCALLBACK(int) rtCrPkixSignatureOsslEvp_Reset(PCRTCRPKIXSIGNATUREDESC pDesc, void *pvState, bool fSigning)
127{
128 PRTCRPKIXSIGNATUREOSSLEVP pThis = (PRTCRPKIXSIGNATUREOSSLEVP)pvState;
129 RT_NOREF_PV(fSigning); RT_NOREF_PV(pDesc);
130 Assert(pThis->fSigning == fSigning); NOREF(pThis);
131 return VINF_SUCCESS;
132}
133
134
135/** @impl_interface_method{RTCRPKIXSIGNATUREDESC,pfnDelete} */
136static DECLCALLBACK(void) rtCrPkixSignatureOsslEvp_Delete(PCRTCRPKIXSIGNATUREDESC pDesc, void *pvState, bool fSigning)
137{
138 PRTCRPKIXSIGNATUREOSSLEVP pThis = (PRTCRPKIXSIGNATUREOSSLEVP)pvState;
139 RT_NOREF_PV(fSigning); RT_NOREF_PV(pDesc);
140 Assert(pThis->fSigning == fSigning);
141 NOREF(pThis);
142}
143
144
145/** @impl_interface_method{RTCRPKIXSIGNATUREDESC,pfnVerify} */
146static DECLCALLBACK(int) rtCrPkixSignatureOsslEvp_Verify(PCRTCRPKIXSIGNATUREDESC pDesc, void *pvState, RTCRKEY hKey,
147 RTCRDIGEST hDigest, void const *pvSignature, size_t cbSignature)
148{
149 PRTCRPKIXSIGNATUREOSSLEVP pThis = (PRTCRPKIXSIGNATUREOSSLEVP)pvState;
150 Assert(!pThis->fSigning);
151 RT_NOREF_PV(pThis);
152
153#if OPENSSL_VERSION_NUMBER >= 0x30000000 && !defined(LIBRESSL_VERSION_NUMBER)
154 PRTERRINFO const pErrInfo = NULL;
155
156 /*
157 * Get the hash before we do anything that needs cleaning up.
158 */
159 int rc = RTCrDigestFinal(hDigest, NULL, 0);
160 AssertRCReturn(rc, rc);
161 uint8_t const * const pbDigest = RTCrDigestGetHash(hDigest);
162 AssertReturn(pbDigest, VERR_INTERNAL_ERROR_3);
163
164 uint32_t const cbDigest = RTCrDigestGetHashSize(hDigest);
165 AssertReturn(cbDigest > 0 && cbDigest < _16K, VERR_INTERNAL_ERROR_4);
166
167 /*
168 * Combine the encryption and digest algorithms.
169 */
170 const char * const pszDigestOid = RTCrDigestGetAlgorithmOid(hDigest);
171 const char * const pszEncryptedDigestOid
172 = RTCrX509AlgorithmIdentifier_CombineEncryptionOidAndDigestOid(pDesc->pszObjId, pszDigestOid);
173
174 /*
175 * Create an EVP public key from hKey and pszEncryptedDigestOid.
176 */
177 int const iAlgoNid = OBJ_txt2nid(pszEncryptedDigestOid);
178 if (iAlgoNid == NID_undef)
179 return VERR_CR_PKIX_OSSL_CIPHER_ALGO_NOT_KNOWN_EVP;
180
181 /* Create an EVP public key. */
182 EVP_PKEY *pEvpPublicKey = NULL;
183 const EVP_MD *pEvpMdType = NULL;
184 rc = rtCrKeyToOpenSslKeyEx(hKey, true /*fNeedPublic*/, pszEncryptedDigestOid,
185 (void **)&pEvpPublicKey, (const void **)&pEvpMdType, pErrInfo);
186 if (RT_SUCCESS(rc))
187 {
188 EVP_PKEY_CTX * const pEvpPublickKeyCtx = EVP_PKEY_CTX_new_from_pkey(NULL, pEvpPublicKey, NULL);
189 if (pEvpPublickKeyCtx)
190 {
191 rc = EVP_PKEY_verify_init(pEvpPublickKeyCtx);
192 if (rc > 0)
193 {
194 rc = EVP_PKEY_CTX_set_signature_md(pEvpPublickKeyCtx, pEvpMdType);
195 if (rc > 0)
196 {
197 rc = EVP_PKEY_verify(pEvpPublickKeyCtx, (const unsigned char *)pvSignature, cbSignature, pbDigest, cbDigest);
198 if (rc > 0)
199 rc = VINF_SUCCESS;
200 else
201 rc = RTERRINFO_LOG_SET_F(pErrInfo, VERR_CR_PKIX_OSSL_VERIFY_FINAL_FAILED,
202 "EVP_PKEY_verify failed (%d)", rc);
203 }
204 else
205 rc = RTERRINFO_LOG_SET_F(pErrInfo, VERR_CR_PKIX_OSSL_CIPHER_ALOG_INIT_FAILED,
206 "EVP_PKEY_CTX_set_signature_md failed (%d)", rc);
207 }
208 else
209 rc = RTERRINFO_LOG_SET_F(pErrInfo, VERR_CR_PKIX_OSSL_CIPHER_ALOG_INIT_FAILED,
210 "EVP_PKEY_verify_init failed (%d)", rc);
211 EVP_PKEY_CTX_free(pEvpPublickKeyCtx);
212 }
213 else
214 rc = RTERRINFO_LOG_SET_F(pErrInfo, VERR_CR_PKIX_OSSL_CIPHER_ALOG_INIT_FAILED,
215 "EVP_PKEY_CTX_new_from_pkey failed (%d)", rc);
216 EVP_PKEY_free(pEvpPublicKey);
217 }
218 return rc;
219
220#else
221 RT_NOREF(pDesc, pvState, hKey, hDigest, pvSignature, cbSignature);
222 return VERR_CR_OPENSSL_VERSION_TOO_OLD;
223#endif
224}
225
226
227/** @impl_interface_method{RTCRPKIXSIGNATUREDESC,pfnSign} */
228static DECLCALLBACK(int) rtCrPkixSignatureOsslEvp_Sign(PCRTCRPKIXSIGNATUREDESC pDesc, void *pvState, RTCRKEY hKey,
229 RTCRDIGEST hDigest, void *pvSignature, size_t *pcbSignature)
230{
231 PRTCRPKIXSIGNATUREOSSLEVP pThis = (PRTCRPKIXSIGNATUREOSSLEVP)pvState;
232 Assert(pThis->fSigning);
233 RT_NOREF(pThis, pDesc);
234
235#if 0
236 /*
237 * Get the key bits we need.
238 */
239 Assert(RTCrKeyGetType(hKey) == RTCRKEYTYPE_RSA_PRIVATE);
240 PRTBIGNUM pModulus = &hKey->u.RsaPrivate.Modulus;
241 PRTBIGNUM pExponent = &hKey->u.RsaPrivate.PrivateExponent;
242
243 return rc;
244#else
245 RT_NOREF(pDesc, pvState, hKey, hDigest, pvSignature, pcbSignature);
246 return VERR_NOT_IMPLEMENTED;
247#endif
248}
249
250
251/** ECDSA alias ODIs. */
252static const char * const g_apszHashWithEcdsaAliases[] =
253{
254 RTCR_X962_ECDSA_WITH_SHA1_OID,
255 RTCR_X962_ECDSA_WITH_SHA2_OID,
256 RTCR_X962_ECDSA_WITH_SHA224_OID,
257 RTCR_X962_ECDSA_WITH_SHA256_OID,
258 RTCR_X962_ECDSA_WITH_SHA384_OID,
259 RTCR_X962_ECDSA_WITH_SHA512_OID,
260 RTCR_NIST_SHA3_224_WITH_ECDSA_OID,
261 RTCR_NIST_SHA3_256_WITH_ECDSA_OID,
262 RTCR_NIST_SHA3_384_WITH_ECDSA_OID,
263 RTCR_NIST_SHA3_512_WITH_ECDSA_OID,
264 NULL
265};
266
267
268/** ECDSA descriptor. */
269DECL_HIDDEN_CONST(RTCRPKIXSIGNATUREDESC const) g_rtCrPkixSigningHashWithEcdsaDesc =
270{
271 "ECDSA",
272 RTCR_X962_ECDSA_OID,
273 g_apszHashWithEcdsaAliases,
274 sizeof(RTCRPKIXSIGNATUREOSSLEVP),
275 0,
276 0,
277 rtCrPkixSignatureOsslEvp_Init,
278 rtCrPkixSignatureOsslEvp_Reset,
279 rtCrPkixSignatureOsslEvp_Delete,
280 rtCrPkixSignatureOsslEvp_Verify,
281 rtCrPkixSignatureOsslEvp_Sign,
282};
283#endif /* IPRT_WITH_OPENSSL */
284
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette