1 // Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // https://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14
15 #include <openssl/evp.h>
16
17 #include <openssl/bn.h>
18 #include <openssl/bytestring.h>
19 #include <openssl/ec.h>
20 #include <openssl/ec_key.h>
21 #include <openssl/ecdsa.h>
22 #include <openssl/err.h>
23 #include <openssl/nid.h>
24
25 #include "internal.h"
26
27
eckey_pub_encode(CBB * out,const EVP_PKEY * key)28 static int eckey_pub_encode(CBB *out, const EVP_PKEY *key) {
29 const EC_KEY *ec_key = reinterpret_cast<const EC_KEY *>(key->pkey);
30 const EC_GROUP *group = EC_KEY_get0_group(ec_key);
31 const EC_POINT *public_key = EC_KEY_get0_public_key(ec_key);
32
33 // See RFC 5480, section 2.
34 CBB spki, algorithm, key_bitstring;
35 if (!CBB_add_asn1(out, &spki, CBS_ASN1_SEQUENCE) ||
36 !CBB_add_asn1(&spki, &algorithm, CBS_ASN1_SEQUENCE) ||
37 !CBB_add_asn1_element(&algorithm, CBS_ASN1_OBJECT, ec_asn1_meth.oid,
38 ec_asn1_meth.oid_len) ||
39 !EC_KEY_marshal_curve_name(&algorithm, group) ||
40 !CBB_add_asn1(&spki, &key_bitstring, CBS_ASN1_BITSTRING) ||
41 !CBB_add_u8(&key_bitstring, 0 /* padding */) ||
42 !EC_POINT_point2cbb(&key_bitstring, group, public_key,
43 POINT_CONVERSION_UNCOMPRESSED, NULL) ||
44 !CBB_flush(out)) {
45 OPENSSL_PUT_ERROR(EVP, EVP_R_ENCODE_ERROR);
46 return 0;
47 }
48
49 return 1;
50 }
51
eckey_pub_decode(EVP_PKEY * out,CBS * params,CBS * key)52 static int eckey_pub_decode(EVP_PKEY *out, CBS *params, CBS *key) {
53 // See RFC 5480, section 2.
54
55 // The parameters are a named curve.
56 const EC_GROUP *group = EC_KEY_parse_curve_name(params);
57 if (group == NULL || CBS_len(params) != 0) {
58 OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR);
59 return 0;
60 }
61
62 bssl::UniquePtr<EC_KEY> eckey(EC_KEY_new());
63 if (eckey == nullptr || //
64 !EC_KEY_set_group(eckey.get(), group) ||
65 !EC_KEY_oct2key(eckey.get(), CBS_data(key), CBS_len(key), nullptr)) {
66 return 0;
67 }
68
69 EVP_PKEY_assign_EC_KEY(out, eckey.release());
70 return 1;
71 }
72
eckey_pub_cmp(const EVP_PKEY * a,const EVP_PKEY * b)73 static int eckey_pub_cmp(const EVP_PKEY *a, const EVP_PKEY *b) {
74 const EC_KEY *a_ec = reinterpret_cast<const EC_KEY *>(a->pkey);
75 const EC_KEY *b_ec = reinterpret_cast<const EC_KEY *>(b->pkey);
76 const EC_GROUP *group = EC_KEY_get0_group(b_ec);
77 const EC_POINT *pa = EC_KEY_get0_public_key(a_ec),
78 *pb = EC_KEY_get0_public_key(b_ec);
79 int r = EC_POINT_cmp(group, pa, pb, NULL);
80 if (r == 0) {
81 return 1;
82 } else if (r == 1) {
83 return 0;
84 } else {
85 return -2;
86 }
87 }
88
eckey_priv_decode(EVP_PKEY * out,CBS * params,CBS * key)89 static int eckey_priv_decode(EVP_PKEY *out, CBS *params, CBS *key) {
90 // See RFC 5915.
91 const EC_GROUP *group = EC_KEY_parse_parameters(params);
92 if (group == NULL || CBS_len(params) != 0) {
93 OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR);
94 return 0;
95 }
96
97 EC_KEY *ec_key = EC_KEY_parse_private_key(key, group);
98 if (ec_key == NULL || CBS_len(key) != 0) {
99 OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR);
100 EC_KEY_free(ec_key);
101 return 0;
102 }
103
104 EVP_PKEY_assign_EC_KEY(out, ec_key);
105 return 1;
106 }
107
eckey_priv_encode(CBB * out,const EVP_PKEY * key)108 static int eckey_priv_encode(CBB *out, const EVP_PKEY *key) {
109 const EC_KEY *ec_key = reinterpret_cast<const EC_KEY *>(key->pkey);
110
111 // Omit the redundant copy of the curve name. This contradicts RFC 5915 but
112 // aligns with PKCS #11. SEC 1 only says they may be omitted if known by other
113 // means. Both OpenSSL and NSS omit the redundant parameters, so we omit them
114 // as well.
115 unsigned enc_flags = EC_KEY_get_enc_flags(ec_key) | EC_PKEY_NO_PARAMETERS;
116
117 // See RFC 5915.
118 CBB pkcs8, algorithm, private_key;
119 if (!CBB_add_asn1(out, &pkcs8, CBS_ASN1_SEQUENCE) ||
120 !CBB_add_asn1_uint64(&pkcs8, 0 /* version */) ||
121 !CBB_add_asn1(&pkcs8, &algorithm, CBS_ASN1_SEQUENCE) ||
122 !CBB_add_asn1_element(&algorithm, CBS_ASN1_OBJECT, ec_asn1_meth.oid,
123 ec_asn1_meth.oid_len) ||
124 !EC_KEY_marshal_curve_name(&algorithm, EC_KEY_get0_group(ec_key)) ||
125 !CBB_add_asn1(&pkcs8, &private_key, CBS_ASN1_OCTETSTRING) ||
126 !EC_KEY_marshal_private_key(&private_key, ec_key, enc_flags) ||
127 !CBB_flush(out)) {
128 OPENSSL_PUT_ERROR(EVP, EVP_R_ENCODE_ERROR);
129 return 0;
130 }
131
132 return 1;
133 }
134
eckey_set1_tls_encodedpoint(EVP_PKEY * pkey,const uint8_t * in,size_t len)135 static int eckey_set1_tls_encodedpoint(EVP_PKEY *pkey, const uint8_t *in,
136 size_t len) {
137 EC_KEY *ec_key = reinterpret_cast<EC_KEY *>(pkey->pkey);
138 if (ec_key == NULL) {
139 OPENSSL_PUT_ERROR(EVP, EVP_R_NO_KEY_SET);
140 return 0;
141 }
142
143 return EC_KEY_oct2key(ec_key, in, len, NULL);
144 }
145
eckey_get1_tls_encodedpoint(const EVP_PKEY * pkey,uint8_t ** out_ptr)146 static size_t eckey_get1_tls_encodedpoint(const EVP_PKEY *pkey,
147 uint8_t **out_ptr) {
148 const EC_KEY *ec_key = reinterpret_cast<const EC_KEY *>(pkey->pkey);
149 if (ec_key == NULL) {
150 OPENSSL_PUT_ERROR(EVP, EVP_R_NO_KEY_SET);
151 return 0;
152 }
153
154 return EC_KEY_key2buf(ec_key, POINT_CONVERSION_UNCOMPRESSED, out_ptr, NULL);
155 }
156
int_ec_size(const EVP_PKEY * pkey)157 static int int_ec_size(const EVP_PKEY *pkey) {
158 const EC_KEY *ec_key = reinterpret_cast<const EC_KEY *>(pkey->pkey);
159 return ECDSA_size(ec_key);
160 }
161
ec_bits(const EVP_PKEY * pkey)162 static int ec_bits(const EVP_PKEY *pkey) {
163 const EC_KEY *ec_key = reinterpret_cast<const EC_KEY *>(pkey->pkey);
164 const EC_GROUP *group = EC_KEY_get0_group(ec_key);
165 if (group == NULL) {
166 ERR_clear_error();
167 return 0;
168 }
169 return EC_GROUP_order_bits(group);
170 }
171
ec_missing_parameters(const EVP_PKEY * pkey)172 static int ec_missing_parameters(const EVP_PKEY *pkey) {
173 const EC_KEY *ec_key = reinterpret_cast<const EC_KEY *>(pkey->pkey);
174 return ec_key == NULL || EC_KEY_get0_group(ec_key) == NULL;
175 }
176
ec_copy_parameters(EVP_PKEY * to,const EVP_PKEY * from)177 static int ec_copy_parameters(EVP_PKEY *to, const EVP_PKEY *from) {
178 const EC_KEY *from_key = reinterpret_cast<const EC_KEY *>(from->pkey);
179 if (from_key == NULL) {
180 OPENSSL_PUT_ERROR(EVP, EVP_R_NO_KEY_SET);
181 return 0;
182 }
183 const EC_GROUP *group = EC_KEY_get0_group(from_key);
184 if (group == NULL) {
185 OPENSSL_PUT_ERROR(EVP, EVP_R_MISSING_PARAMETERS);
186 return 0;
187 }
188 if (to->pkey == NULL) {
189 to->pkey = EC_KEY_new();
190 if (to->pkey == NULL) {
191 return 0;
192 }
193 }
194 return EC_KEY_set_group(reinterpret_cast<EC_KEY *>(to->pkey), group);
195 }
196
ec_cmp_parameters(const EVP_PKEY * a,const EVP_PKEY * b)197 static int ec_cmp_parameters(const EVP_PKEY *a, const EVP_PKEY *b) {
198 const EC_KEY *a_ec = reinterpret_cast<const EC_KEY *>(a->pkey);
199 const EC_KEY *b_ec = reinterpret_cast<const EC_KEY *>(b->pkey);
200 if (a_ec == NULL || b_ec == NULL) {
201 return -2;
202 }
203 const EC_GROUP *group_a = EC_KEY_get0_group(a_ec),
204 *group_b = EC_KEY_get0_group(b_ec);
205 if (group_a == NULL || group_b == NULL) {
206 return -2;
207 }
208 if (EC_GROUP_cmp(group_a, group_b, NULL) != 0) {
209 // mismatch
210 return 0;
211 }
212 return 1;
213 }
214
int_ec_free(EVP_PKEY * pkey)215 static void int_ec_free(EVP_PKEY *pkey) {
216 EC_KEY_free(reinterpret_cast<EC_KEY *>(pkey->pkey));
217 pkey->pkey = NULL;
218 }
219
eckey_opaque(const EVP_PKEY * pkey)220 static int eckey_opaque(const EVP_PKEY *pkey) {
221 const EC_KEY *ec_key = reinterpret_cast<const EC_KEY *>(pkey->pkey);
222 return EC_KEY_is_opaque(ec_key);
223 }
224
225 const EVP_PKEY_ASN1_METHOD ec_asn1_meth = {
226 EVP_PKEY_EC,
227 // 1.2.840.10045.2.1
228 {0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01},
229 7,
230
231 &ec_pkey_meth,
232
233 eckey_pub_decode,
234 eckey_pub_encode,
235 eckey_pub_cmp,
236
237 eckey_priv_decode,
238 eckey_priv_encode,
239
240 /*set_priv_raw=*/NULL,
241 /*set_pub_raw=*/NULL,
242 /*get_priv_raw=*/NULL,
243 /*get_pub_raw=*/NULL,
244 eckey_set1_tls_encodedpoint,
245 eckey_get1_tls_encodedpoint,
246
247 eckey_opaque,
248
249 int_ec_size,
250 ec_bits,
251
252 ec_missing_parameters,
253 ec_copy_parameters,
254 ec_cmp_parameters,
255
256 int_ec_free,
257 };
258
EVP_PKEY_set1_EC_KEY(EVP_PKEY * pkey,EC_KEY * key)259 int EVP_PKEY_set1_EC_KEY(EVP_PKEY *pkey, EC_KEY *key) {
260 if (EVP_PKEY_assign_EC_KEY(pkey, key)) {
261 EC_KEY_up_ref(key);
262 return 1;
263 }
264 return 0;
265 }
266
EVP_PKEY_assign_EC_KEY(EVP_PKEY * pkey,EC_KEY * key)267 int EVP_PKEY_assign_EC_KEY(EVP_PKEY *pkey, EC_KEY *key) {
268 evp_pkey_set_method(pkey, &ec_asn1_meth);
269 pkey->pkey = key;
270 return key != NULL;
271 }
272
EVP_PKEY_get0_EC_KEY(const EVP_PKEY * pkey)273 EC_KEY *EVP_PKEY_get0_EC_KEY(const EVP_PKEY *pkey) {
274 if (EVP_PKEY_id(pkey) != EVP_PKEY_EC) {
275 OPENSSL_PUT_ERROR(EVP, EVP_R_EXPECTING_A_EC_KEY);
276 return NULL;
277 }
278 return reinterpret_cast<EC_KEY *>(pkey->pkey);
279 }
280
EVP_PKEY_get1_EC_KEY(const EVP_PKEY * pkey)281 EC_KEY *EVP_PKEY_get1_EC_KEY(const EVP_PKEY *pkey) {
282 EC_KEY *ec_key = EVP_PKEY_get0_EC_KEY(pkey);
283 if (ec_key != NULL) {
284 EC_KEY_up_ref(ec_key);
285 }
286 return ec_key;
287 }
288
EVP_PKEY_get_ec_curve_nid(const EVP_PKEY * pkey)289 int EVP_PKEY_get_ec_curve_nid(const EVP_PKEY *pkey) {
290 const EC_KEY *ec_key = EVP_PKEY_get0_EC_KEY(pkey);
291 if (ec_key == nullptr) {
292 return NID_undef;
293 }
294 const EC_GROUP *group = EC_KEY_get0_group(ec_key);
295 if (group == nullptr) {
296 return NID_undef;
297 }
298 return EC_GROUP_get_curve_name(group);
299 }
300
EVP_PKEY_get_ec_point_conv_form(const EVP_PKEY * pkey)301 int EVP_PKEY_get_ec_point_conv_form(const EVP_PKEY *pkey) {
302 const EC_KEY *ec_key = EVP_PKEY_get0_EC_KEY(pkey);
303 if (ec_key == nullptr) {
304 return 0;
305 }
306 return EC_KEY_get_conv_form(ec_key);
307 }
308