Line data Source code
1 : /* evp_pbe.c */
2 : /*
3 : * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL project
4 : * 1999.
5 : */
6 : /* ====================================================================
7 : * Copyright (c) 1999-2006 The OpenSSL Project. All rights reserved.
8 : *
9 : * Redistribution and use in source and binary forms, with or without
10 : * modification, are permitted provided that the following conditions
11 : * are met:
12 : *
13 : * 1. Redistributions of source code must retain the above copyright
14 : * notice, this list of conditions and the following disclaimer.
15 : *
16 : * 2. Redistributions in binary form must reproduce the above copyright
17 : * notice, this list of conditions and the following disclaimer in
18 : * the documentation and/or other materials provided with the
19 : * distribution.
20 : *
21 : * 3. All advertising materials mentioning features or use of this
22 : * software must display the following acknowledgment:
23 : * "This product includes software developed by the OpenSSL Project
24 : * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
25 : *
26 : * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
27 : * endorse or promote products derived from this software without
28 : * prior written permission. For written permission, please contact
29 : * licensing@OpenSSL.org.
30 : *
31 : * 5. Products derived from this software may not be called "OpenSSL"
32 : * nor may "OpenSSL" appear in their names without prior written
33 : * permission of the OpenSSL Project.
34 : *
35 : * 6. Redistributions of any form whatsoever must retain the following
36 : * acknowledgment:
37 : * "This product includes software developed by the OpenSSL Project
38 : * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
39 : *
40 : * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
41 : * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
42 : * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
43 : * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
44 : * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
45 : * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
46 : * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
47 : * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 : * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
49 : * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
50 : * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
51 : * OF THE POSSIBILITY OF SUCH DAMAGE.
52 : * ====================================================================
53 : *
54 : * This product includes cryptographic software written by Eric Young
55 : * (eay@cryptsoft.com). This product includes software written by Tim
56 : * Hudson (tjh@cryptsoft.com).
57 : *
58 : */
59 :
60 : #include <stdio.h>
61 : #include "cryptlib.h"
62 : #include <openssl/evp.h>
63 : #include <openssl/pkcs12.h>
64 : #include <openssl/x509.h>
65 : #include "evp_locl.h"
66 :
67 : /* Password based encryption (PBE) functions */
68 :
69 : DECLARE_STACK_OF(EVP_PBE_CTL)
70 : static STACK_OF(EVP_PBE_CTL) *pbe_algs;
71 :
72 : /* Setup a cipher context from a PBE algorithm */
73 :
74 : typedef struct {
75 : int pbe_type;
76 : int pbe_nid;
77 : int cipher_nid;
78 : int md_nid;
79 : EVP_PBE_KEYGEN *keygen;
80 : } EVP_PBE_CTL;
81 :
82 : static const EVP_PBE_CTL builtin_pbe[] = {
83 : {EVP_PBE_TYPE_OUTER, NID_pbeWithMD2AndDES_CBC,
84 : NID_des_cbc, NID_md2, PKCS5_PBE_keyivgen},
85 : {EVP_PBE_TYPE_OUTER, NID_pbeWithMD5AndDES_CBC,
86 : NID_des_cbc, NID_md5, PKCS5_PBE_keyivgen},
87 : {EVP_PBE_TYPE_OUTER, NID_pbeWithSHA1AndRC2_CBC,
88 : NID_rc2_64_cbc, NID_sha1, PKCS5_PBE_keyivgen},
89 :
90 : #ifndef OPENSSL_NO_HMAC
91 : {EVP_PBE_TYPE_OUTER, NID_id_pbkdf2, -1, -1, PKCS5_v2_PBKDF2_keyivgen},
92 : #endif
93 :
94 : {EVP_PBE_TYPE_OUTER, NID_pbe_WithSHA1And128BitRC4,
95 : NID_rc4, NID_sha1, PKCS12_PBE_keyivgen},
96 : {EVP_PBE_TYPE_OUTER, NID_pbe_WithSHA1And40BitRC4,
97 : NID_rc4_40, NID_sha1, PKCS12_PBE_keyivgen},
98 : {EVP_PBE_TYPE_OUTER, NID_pbe_WithSHA1And3_Key_TripleDES_CBC,
99 : NID_des_ede3_cbc, NID_sha1, PKCS12_PBE_keyivgen},
100 : {EVP_PBE_TYPE_OUTER, NID_pbe_WithSHA1And2_Key_TripleDES_CBC,
101 : NID_des_ede_cbc, NID_sha1, PKCS12_PBE_keyivgen},
102 : {EVP_PBE_TYPE_OUTER, NID_pbe_WithSHA1And128BitRC2_CBC,
103 : NID_rc2_cbc, NID_sha1, PKCS12_PBE_keyivgen},
104 : {EVP_PBE_TYPE_OUTER, NID_pbe_WithSHA1And40BitRC2_CBC,
105 : NID_rc2_40_cbc, NID_sha1, PKCS12_PBE_keyivgen},
106 :
107 : #ifndef OPENSSL_NO_HMAC
108 : {EVP_PBE_TYPE_OUTER, NID_pbes2, -1, -1, PKCS5_v2_PBE_keyivgen},
109 : #endif
110 : {EVP_PBE_TYPE_OUTER, NID_pbeWithMD2AndRC2_CBC,
111 : NID_rc2_64_cbc, NID_md2, PKCS5_PBE_keyivgen},
112 : {EVP_PBE_TYPE_OUTER, NID_pbeWithMD5AndRC2_CBC,
113 : NID_rc2_64_cbc, NID_md5, PKCS5_PBE_keyivgen},
114 : {EVP_PBE_TYPE_OUTER, NID_pbeWithSHA1AndDES_CBC,
115 : NID_des_cbc, NID_sha1, PKCS5_PBE_keyivgen},
116 :
117 : {EVP_PBE_TYPE_PRF, NID_hmacWithSHA1, -1, NID_sha1, 0},
118 : {EVP_PBE_TYPE_PRF, NID_hmacWithMD5, -1, NID_md5, 0},
119 : {EVP_PBE_TYPE_PRF, NID_hmacWithSHA224, -1, NID_sha224, 0},
120 : {EVP_PBE_TYPE_PRF, NID_hmacWithSHA256, -1, NID_sha256, 0},
121 : {EVP_PBE_TYPE_PRF, NID_hmacWithSHA384, -1, NID_sha384, 0},
122 : {EVP_PBE_TYPE_PRF, NID_hmacWithSHA512, -1, NID_sha512, 0},
123 : {EVP_PBE_TYPE_PRF, NID_id_HMACGostR3411_94, -1, NID_id_GostR3411_94, 0},
124 : };
125 :
126 : #ifdef TEST
127 : int main(int argc, char **argv)
128 : {
129 : int i, nid_md, nid_cipher;
130 : EVP_PBE_CTL *tpbe, *tpbe2;
131 : /*
132 : * OpenSSL_add_all_algorithms();
133 : */
134 :
135 : for (i = 0; i < sizeof(builtin_pbe) / sizeof(EVP_PBE_CTL); i++) {
136 : tpbe = builtin_pbe + i;
137 : fprintf(stderr, "%d %d %s ", tpbe->pbe_type, tpbe->pbe_nid,
138 : OBJ_nid2sn(tpbe->pbe_nid));
139 : if (EVP_PBE_find(tpbe->pbe_type, tpbe->pbe_nid,
140 : &nid_cipher, &nid_md, 0))
141 : fprintf(stderr, "Found %s %s\n",
142 : OBJ_nid2sn(nid_cipher), OBJ_nid2sn(nid_md));
143 : else
144 : fprintf(stderr, "Find ERROR!!\n");
145 : }
146 :
147 : return 0;
148 : }
149 : #endif
150 :
151 0 : int EVP_PBE_CipherInit(ASN1_OBJECT *pbe_obj, const char *pass, int passlen,
152 : ASN1_TYPE *param, EVP_CIPHER_CTX *ctx, int en_de)
153 : {
154 : const EVP_CIPHER *cipher;
155 : const EVP_MD *md;
156 : int cipher_nid, md_nid;
157 : EVP_PBE_KEYGEN *keygen;
158 :
159 0 : if (!EVP_PBE_find(EVP_PBE_TYPE_OUTER, OBJ_obj2nid(pbe_obj),
160 : &cipher_nid, &md_nid, &keygen)) {
161 : char obj_tmp[80];
162 0 : EVPerr(EVP_F_EVP_PBE_CIPHERINIT, EVP_R_UNKNOWN_PBE_ALGORITHM);
163 0 : if (!pbe_obj)
164 0 : BUF_strlcpy(obj_tmp, "NULL", sizeof obj_tmp);
165 : else
166 0 : i2t_ASN1_OBJECT(obj_tmp, sizeof obj_tmp, pbe_obj);
167 0 : ERR_add_error_data(2, "TYPE=", obj_tmp);
168 : return 0;
169 : }
170 :
171 0 : if (!pass)
172 : passlen = 0;
173 0 : else if (passlen == -1)
174 0 : passlen = strlen(pass);
175 :
176 0 : if (cipher_nid == -1)
177 : cipher = NULL;
178 : else {
179 0 : cipher = EVP_get_cipherbynid(cipher_nid);
180 0 : if (!cipher) {
181 0 : EVPerr(EVP_F_EVP_PBE_CIPHERINIT, EVP_R_UNKNOWN_CIPHER);
182 0 : return 0;
183 : }
184 : }
185 :
186 0 : if (md_nid == -1)
187 : md = NULL;
188 : else {
189 0 : md = EVP_get_digestbynid(md_nid);
190 0 : if (!md) {
191 0 : EVPerr(EVP_F_EVP_PBE_CIPHERINIT, EVP_R_UNKNOWN_DIGEST);
192 0 : return 0;
193 : }
194 : }
195 :
196 0 : if (!keygen(ctx, pass, passlen, param, cipher, md, en_de)) {
197 0 : EVPerr(EVP_F_EVP_PBE_CIPHERINIT, EVP_R_KEYGEN_FAILURE);
198 0 : return 0;
199 : }
200 : return 1;
201 : }
202 :
203 : DECLARE_OBJ_BSEARCH_CMP_FN(EVP_PBE_CTL, EVP_PBE_CTL, pbe2);
204 :
205 : static int pbe2_cmp(const EVP_PBE_CTL *pbe1, const EVP_PBE_CTL *pbe2)
206 : {
207 0 : int ret = pbe1->pbe_type - pbe2->pbe_type;
208 0 : if (ret)
209 : return ret;
210 : else
211 0 : return pbe1->pbe_nid - pbe2->pbe_nid;
212 : }
213 :
214 0 : IMPLEMENT_OBJ_BSEARCH_CMP_FN(EVP_PBE_CTL, EVP_PBE_CTL, pbe2);
215 :
216 0 : static int pbe_cmp(const EVP_PBE_CTL *const *a, const EVP_PBE_CTL *const *b)
217 : {
218 0 : int ret = (*a)->pbe_type - (*b)->pbe_type;
219 0 : if (ret)
220 : return ret;
221 : else
222 0 : return (*a)->pbe_nid - (*b)->pbe_nid;
223 : }
224 :
225 : /* Add a PBE algorithm */
226 :
227 0 : int EVP_PBE_alg_add_type(int pbe_type, int pbe_nid, int cipher_nid,
228 : int md_nid, EVP_PBE_KEYGEN *keygen)
229 : {
230 : EVP_PBE_CTL *pbe_tmp;
231 0 : if (!pbe_algs)
232 0 : pbe_algs = sk_EVP_PBE_CTL_new(pbe_cmp);
233 0 : if (!(pbe_tmp = (EVP_PBE_CTL *)OPENSSL_malloc(sizeof(EVP_PBE_CTL)))) {
234 0 : EVPerr(EVP_F_EVP_PBE_ALG_ADD_TYPE, ERR_R_MALLOC_FAILURE);
235 0 : return 0;
236 : }
237 0 : pbe_tmp->pbe_type = pbe_type;
238 0 : pbe_tmp->pbe_nid = pbe_nid;
239 0 : pbe_tmp->cipher_nid = cipher_nid;
240 0 : pbe_tmp->md_nid = md_nid;
241 0 : pbe_tmp->keygen = keygen;
242 :
243 0 : sk_EVP_PBE_CTL_push(pbe_algs, pbe_tmp);
244 0 : return 1;
245 : }
246 :
247 0 : int EVP_PBE_alg_add(int nid, const EVP_CIPHER *cipher, const EVP_MD *md,
248 : EVP_PBE_KEYGEN *keygen)
249 : {
250 : int cipher_nid, md_nid;
251 0 : if (cipher)
252 0 : cipher_nid = EVP_CIPHER_nid(cipher);
253 : else
254 : cipher_nid = -1;
255 0 : if (md)
256 0 : md_nid = EVP_MD_type(md);
257 : else
258 : md_nid = -1;
259 :
260 0 : return EVP_PBE_alg_add_type(EVP_PBE_TYPE_OUTER, nid,
261 : cipher_nid, md_nid, keygen);
262 : }
263 :
264 0 : int EVP_PBE_find(int type, int pbe_nid,
265 : int *pcnid, int *pmnid, EVP_PBE_KEYGEN **pkeygen)
266 : {
267 : EVP_PBE_CTL *pbetmp = NULL, pbelu;
268 : int i;
269 0 : if (pbe_nid == NID_undef)
270 : return 0;
271 :
272 0 : pbelu.pbe_type = type;
273 0 : pbelu.pbe_nid = pbe_nid;
274 :
275 0 : if (pbe_algs) {
276 0 : i = sk_EVP_PBE_CTL_find(pbe_algs, &pbelu);
277 0 : if (i != -1)
278 0 : pbetmp = sk_EVP_PBE_CTL_value(pbe_algs, i);
279 : }
280 0 : if (pbetmp == NULL) {
281 : pbetmp = OBJ_bsearch_pbe2(&pbelu, builtin_pbe,
282 : sizeof(builtin_pbe) / sizeof(EVP_PBE_CTL));
283 : }
284 0 : if (pbetmp == NULL)
285 : return 0;
286 0 : if (pcnid)
287 0 : *pcnid = pbetmp->cipher_nid;
288 0 : if (pmnid)
289 0 : *pmnid = pbetmp->md_nid;
290 0 : if (pkeygen)
291 0 : *pkeygen = pbetmp->keygen;
292 : return 1;
293 : }
294 :
295 0 : static void free_evp_pbe_ctl(EVP_PBE_CTL *pbe)
296 : {
297 0 : OPENSSL_freeFunc(pbe);
298 0 : }
299 :
300 0 : void EVP_PBE_cleanup(void)
301 : {
302 0 : sk_EVP_PBE_CTL_pop_free(pbe_algs, free_evp_pbe_ctl);
303 0 : pbe_algs = NULL;
304 0 : }
|
