1 // Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 //     https://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14 
15 #include <openssl/evp.h>
16 
17 #include <openssl/bn.h>
18 #include <openssl/bytestring.h>
19 #include <openssl/ec.h>
20 #include <openssl/ec_key.h>
21 #include <openssl/ecdsa.h>
22 #include <openssl/err.h>
23 #include <openssl/nid.h>
24 
25 #include "internal.h"
26 
27 
eckey_pub_encode(CBB * out,const EVP_PKEY * key)28 static int eckey_pub_encode(CBB *out, const EVP_PKEY *key) {
29   const EC_KEY *ec_key = reinterpret_cast<const EC_KEY *>(key->pkey);
30   const EC_GROUP *group = EC_KEY_get0_group(ec_key);
31   const EC_POINT *public_key = EC_KEY_get0_public_key(ec_key);
32 
33   // See RFC 5480, section 2.
34   CBB spki, algorithm, key_bitstring;
35   if (!CBB_add_asn1(out, &spki, CBS_ASN1_SEQUENCE) ||
36       !CBB_add_asn1(&spki, &algorithm, CBS_ASN1_SEQUENCE) ||
37       !CBB_add_asn1_element(&algorithm, CBS_ASN1_OBJECT, ec_asn1_meth.oid,
38                             ec_asn1_meth.oid_len) ||
39       !EC_KEY_marshal_curve_name(&algorithm, group) ||
40       !CBB_add_asn1(&spki, &key_bitstring, CBS_ASN1_BITSTRING) ||
41       !CBB_add_u8(&key_bitstring, 0 /* padding */) ||
42       !EC_POINT_point2cbb(&key_bitstring, group, public_key,
43                           POINT_CONVERSION_UNCOMPRESSED, NULL) ||
44       !CBB_flush(out)) {
45     OPENSSL_PUT_ERROR(EVP, EVP_R_ENCODE_ERROR);
46     return 0;
47   }
48 
49   return 1;
50 }
51 
eckey_pub_decode(EVP_PKEY * out,CBS * params,CBS * key)52 static int eckey_pub_decode(EVP_PKEY *out, CBS *params, CBS *key) {
53   // See RFC 5480, section 2.
54 
55   // The parameters are a named curve.
56   const EC_GROUP *group = EC_KEY_parse_curve_name(params);
57   if (group == NULL || CBS_len(params) != 0) {
58     OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR);
59     return 0;
60   }
61 
62   bssl::UniquePtr<EC_KEY> eckey(EC_KEY_new());
63   if (eckey == nullptr ||  //
64       !EC_KEY_set_group(eckey.get(), group) ||
65       !EC_KEY_oct2key(eckey.get(), CBS_data(key), CBS_len(key), nullptr)) {
66     return 0;
67   }
68 
69   EVP_PKEY_assign_EC_KEY(out, eckey.release());
70   return 1;
71 }
72 
eckey_pub_cmp(const EVP_PKEY * a,const EVP_PKEY * b)73 static int eckey_pub_cmp(const EVP_PKEY *a, const EVP_PKEY *b) {
74   const EC_KEY *a_ec = reinterpret_cast<const EC_KEY *>(a->pkey);
75   const EC_KEY *b_ec = reinterpret_cast<const EC_KEY *>(b->pkey);
76   const EC_GROUP *group = EC_KEY_get0_group(b_ec);
77   const EC_POINT *pa = EC_KEY_get0_public_key(a_ec),
78                  *pb = EC_KEY_get0_public_key(b_ec);
79   int r = EC_POINT_cmp(group, pa, pb, NULL);
80   if (r == 0) {
81     return 1;
82   } else if (r == 1) {
83     return 0;
84   } else {
85     return -2;
86   }
87 }
88 
eckey_priv_decode(EVP_PKEY * out,CBS * params,CBS * key)89 static int eckey_priv_decode(EVP_PKEY *out, CBS *params, CBS *key) {
90   // See RFC 5915.
91   const EC_GROUP *group = EC_KEY_parse_parameters(params);
92   if (group == NULL || CBS_len(params) != 0) {
93     OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR);
94     return 0;
95   }
96 
97   EC_KEY *ec_key = EC_KEY_parse_private_key(key, group);
98   if (ec_key == NULL || CBS_len(key) != 0) {
99     OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR);
100     EC_KEY_free(ec_key);
101     return 0;
102   }
103 
104   EVP_PKEY_assign_EC_KEY(out, ec_key);
105   return 1;
106 }
107 
eckey_priv_encode(CBB * out,const EVP_PKEY * key)108 static int eckey_priv_encode(CBB *out, const EVP_PKEY *key) {
109   const EC_KEY *ec_key = reinterpret_cast<const EC_KEY *>(key->pkey);
110 
111   // Omit the redundant copy of the curve name. This contradicts RFC 5915 but
112   // aligns with PKCS #11. SEC 1 only says they may be omitted if known by other
113   // means. Both OpenSSL and NSS omit the redundant parameters, so we omit them
114   // as well.
115   unsigned enc_flags = EC_KEY_get_enc_flags(ec_key) | EC_PKEY_NO_PARAMETERS;
116 
117   // See RFC 5915.
118   CBB pkcs8, algorithm, private_key;
119   if (!CBB_add_asn1(out, &pkcs8, CBS_ASN1_SEQUENCE) ||
120       !CBB_add_asn1_uint64(&pkcs8, 0 /* version */) ||
121       !CBB_add_asn1(&pkcs8, &algorithm, CBS_ASN1_SEQUENCE) ||
122       !CBB_add_asn1_element(&algorithm, CBS_ASN1_OBJECT, ec_asn1_meth.oid,
123                             ec_asn1_meth.oid_len) ||
124       !EC_KEY_marshal_curve_name(&algorithm, EC_KEY_get0_group(ec_key)) ||
125       !CBB_add_asn1(&pkcs8, &private_key, CBS_ASN1_OCTETSTRING) ||
126       !EC_KEY_marshal_private_key(&private_key, ec_key, enc_flags) ||
127       !CBB_flush(out)) {
128     OPENSSL_PUT_ERROR(EVP, EVP_R_ENCODE_ERROR);
129     return 0;
130   }
131 
132   return 1;
133 }
134 
eckey_set1_tls_encodedpoint(EVP_PKEY * pkey,const uint8_t * in,size_t len)135 static int eckey_set1_tls_encodedpoint(EVP_PKEY *pkey, const uint8_t *in,
136                                        size_t len) {
137   EC_KEY *ec_key = reinterpret_cast<EC_KEY *>(pkey->pkey);
138   if (ec_key == NULL) {
139     OPENSSL_PUT_ERROR(EVP, EVP_R_NO_KEY_SET);
140     return 0;
141   }
142 
143   return EC_KEY_oct2key(ec_key, in, len, NULL);
144 }
145 
eckey_get1_tls_encodedpoint(const EVP_PKEY * pkey,uint8_t ** out_ptr)146 static size_t eckey_get1_tls_encodedpoint(const EVP_PKEY *pkey,
147                                           uint8_t **out_ptr) {
148   const EC_KEY *ec_key = reinterpret_cast<const EC_KEY *>(pkey->pkey);
149   if (ec_key == NULL) {
150     OPENSSL_PUT_ERROR(EVP, EVP_R_NO_KEY_SET);
151     return 0;
152   }
153 
154   return EC_KEY_key2buf(ec_key, POINT_CONVERSION_UNCOMPRESSED, out_ptr, NULL);
155 }
156 
int_ec_size(const EVP_PKEY * pkey)157 static int int_ec_size(const EVP_PKEY *pkey) {
158   const EC_KEY *ec_key = reinterpret_cast<const EC_KEY *>(pkey->pkey);
159   return ECDSA_size(ec_key);
160 }
161 
ec_bits(const EVP_PKEY * pkey)162 static int ec_bits(const EVP_PKEY *pkey) {
163   const EC_KEY *ec_key = reinterpret_cast<const EC_KEY *>(pkey->pkey);
164   const EC_GROUP *group = EC_KEY_get0_group(ec_key);
165   if (group == NULL) {
166     ERR_clear_error();
167     return 0;
168   }
169   return EC_GROUP_order_bits(group);
170 }
171 
ec_missing_parameters(const EVP_PKEY * pkey)172 static int ec_missing_parameters(const EVP_PKEY *pkey) {
173   const EC_KEY *ec_key = reinterpret_cast<const EC_KEY *>(pkey->pkey);
174   return ec_key == NULL || EC_KEY_get0_group(ec_key) == NULL;
175 }
176 
ec_copy_parameters(EVP_PKEY * to,const EVP_PKEY * from)177 static int ec_copy_parameters(EVP_PKEY *to, const EVP_PKEY *from) {
178   const EC_KEY *from_key = reinterpret_cast<const EC_KEY *>(from->pkey);
179   if (from_key == NULL) {
180     OPENSSL_PUT_ERROR(EVP, EVP_R_NO_KEY_SET);
181     return 0;
182   }
183   const EC_GROUP *group = EC_KEY_get0_group(from_key);
184   if (group == NULL) {
185     OPENSSL_PUT_ERROR(EVP, EVP_R_MISSING_PARAMETERS);
186     return 0;
187   }
188   if (to->pkey == NULL) {
189     to->pkey = EC_KEY_new();
190     if (to->pkey == NULL) {
191       return 0;
192     }
193   }
194   return EC_KEY_set_group(reinterpret_cast<EC_KEY *>(to->pkey), group);
195 }
196 
ec_cmp_parameters(const EVP_PKEY * a,const EVP_PKEY * b)197 static int ec_cmp_parameters(const EVP_PKEY *a, const EVP_PKEY *b) {
198   const EC_KEY *a_ec = reinterpret_cast<const EC_KEY *>(a->pkey);
199   const EC_KEY *b_ec = reinterpret_cast<const EC_KEY *>(b->pkey);
200   if (a_ec == NULL || b_ec == NULL) {
201     return -2;
202   }
203   const EC_GROUP *group_a = EC_KEY_get0_group(a_ec),
204                  *group_b = EC_KEY_get0_group(b_ec);
205   if (group_a == NULL || group_b == NULL) {
206     return -2;
207   }
208   if (EC_GROUP_cmp(group_a, group_b, NULL) != 0) {
209     // mismatch
210     return 0;
211   }
212   return 1;
213 }
214 
int_ec_free(EVP_PKEY * pkey)215 static void int_ec_free(EVP_PKEY *pkey) {
216   EC_KEY_free(reinterpret_cast<EC_KEY *>(pkey->pkey));
217   pkey->pkey = NULL;
218 }
219 
eckey_opaque(const EVP_PKEY * pkey)220 static int eckey_opaque(const EVP_PKEY *pkey) {
221   const EC_KEY *ec_key = reinterpret_cast<const EC_KEY *>(pkey->pkey);
222   return EC_KEY_is_opaque(ec_key);
223 }
224 
225 const EVP_PKEY_ASN1_METHOD ec_asn1_meth = {
226     EVP_PKEY_EC,
227     // 1.2.840.10045.2.1
228     {0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01},
229     7,
230 
231     &ec_pkey_meth,
232 
233     eckey_pub_decode,
234     eckey_pub_encode,
235     eckey_pub_cmp,
236 
237     eckey_priv_decode,
238     eckey_priv_encode,
239 
240     /*set_priv_raw=*/NULL,
241     /*set_pub_raw=*/NULL,
242     /*get_priv_raw=*/NULL,
243     /*get_pub_raw=*/NULL,
244     eckey_set1_tls_encodedpoint,
245     eckey_get1_tls_encodedpoint,
246 
247     eckey_opaque,
248 
249     int_ec_size,
250     ec_bits,
251 
252     ec_missing_parameters,
253     ec_copy_parameters,
254     ec_cmp_parameters,
255 
256     int_ec_free,
257 };
258 
EVP_PKEY_set1_EC_KEY(EVP_PKEY * pkey,EC_KEY * key)259 int EVP_PKEY_set1_EC_KEY(EVP_PKEY *pkey, EC_KEY *key) {
260   if (EVP_PKEY_assign_EC_KEY(pkey, key)) {
261     EC_KEY_up_ref(key);
262     return 1;
263   }
264   return 0;
265 }
266 
EVP_PKEY_assign_EC_KEY(EVP_PKEY * pkey,EC_KEY * key)267 int EVP_PKEY_assign_EC_KEY(EVP_PKEY *pkey, EC_KEY *key) {
268   evp_pkey_set_method(pkey, &ec_asn1_meth);
269   pkey->pkey = key;
270   return key != NULL;
271 }
272 
EVP_PKEY_get0_EC_KEY(const EVP_PKEY * pkey)273 EC_KEY *EVP_PKEY_get0_EC_KEY(const EVP_PKEY *pkey) {
274   if (EVP_PKEY_id(pkey) != EVP_PKEY_EC) {
275     OPENSSL_PUT_ERROR(EVP, EVP_R_EXPECTING_A_EC_KEY);
276     return NULL;
277   }
278   return reinterpret_cast<EC_KEY *>(pkey->pkey);
279 }
280 
EVP_PKEY_get1_EC_KEY(const EVP_PKEY * pkey)281 EC_KEY *EVP_PKEY_get1_EC_KEY(const EVP_PKEY *pkey) {
282   EC_KEY *ec_key = EVP_PKEY_get0_EC_KEY(pkey);
283   if (ec_key != NULL) {
284     EC_KEY_up_ref(ec_key);
285   }
286   return ec_key;
287 }
288 
EVP_PKEY_get_ec_curve_nid(const EVP_PKEY * pkey)289 int EVP_PKEY_get_ec_curve_nid(const EVP_PKEY *pkey) {
290   const EC_KEY *ec_key = EVP_PKEY_get0_EC_KEY(pkey);
291   if (ec_key == nullptr) {
292     return NID_undef;
293   }
294   const EC_GROUP *group = EC_KEY_get0_group(ec_key);
295   if (group == nullptr) {
296     return NID_undef;
297   }
298   return EC_GROUP_get_curve_name(group);
299 }
300 
EVP_PKEY_get_ec_point_conv_form(const EVP_PKEY * pkey)301 int EVP_PKEY_get_ec_point_conv_form(const EVP_PKEY *pkey) {
302   const EC_KEY *ec_key = EVP_PKEY_get0_EC_KEY(pkey);
303   if (ec_key == nullptr) {
304     return 0;
305   }
306   return EC_KEY_get_conv_form(ec_key);
307 }
308