Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1 | /* |
| 2 | * Public Key layer for parsing key files and structures |
| 3 | * |
Bence Szépkúti | 1e14827 | 2020-08-07 13:07:28 +0200 | [diff] [blame] | 4 | * Copyright The Mbed TLS Contributors |
Manuel Pégourié-Gonnard | 37ff140 | 2015-09-04 14:21:07 +0200 | [diff] [blame] | 5 | * SPDX-License-Identifier: Apache-2.0 |
| 6 | * |
| 7 | * Licensed under the Apache License, Version 2.0 (the "License"); you may |
| 8 | * not use this file except in compliance with the License. |
| 9 | * You may obtain a copy of the License at |
| 10 | * |
| 11 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 12 | * |
| 13 | * Unless required by applicable law or agreed to in writing, software |
| 14 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT |
| 15 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 16 | * See the License for the specific language governing permissions and |
| 17 | * limitations under the License. |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 18 | */ |
| 19 | |
Gilles Peskine | db09ef6 | 2020-06-03 01:43:33 +0200 | [diff] [blame] | 20 | #include "common.h" |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 21 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 22 | #if defined(MBEDTLS_PK_PARSE_C) |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 23 | |
Manuel Pégourié-Gonnard | 7f80997 | 2015-03-09 17:05:11 +0000 | [diff] [blame] | 24 | #include "mbedtls/pk.h" |
| 25 | #include "mbedtls/asn1.h" |
| 26 | #include "mbedtls/oid.h" |
Andres Amaya Garcia | 1f6301b | 2018-04-17 09:51:09 -0500 | [diff] [blame] | 27 | #include "mbedtls/platform_util.h" |
Manuel Pégourié-Gonnard | 5fcbe4c | 2023-07-06 13:02:51 +0200 | [diff] [blame] | 28 | #include "mbedtls/platform.h" |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 29 | #include "mbedtls/error.h" |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 30 | |
Rich Evans | 00ab470 | 2015-02-06 13:43:58 +0000 | [diff] [blame] | 31 | #include <string.h> |
| 32 | |
Manuel Pégourié-Gonnard | 5fcbe4c | 2023-07-06 13:02:51 +0200 | [diff] [blame] | 33 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 34 | #include "mbedtls/psa_util.h" |
| 35 | #include "psa/crypto.h" |
| 36 | #endif |
| 37 | |
Manuel Pégourié-Gonnard | da88c38 | 2023-07-06 12:31:43 +0200 | [diff] [blame] | 38 | /* Key types */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 39 | #if defined(MBEDTLS_RSA_C) |
Manuel Pégourié-Gonnard | 7f80997 | 2015-03-09 17:05:11 +0000 | [diff] [blame] | 40 | #include "mbedtls/rsa.h" |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 41 | #endif |
Valerio Setti | 81d7512 | 2023-06-14 14:49:33 +0200 | [diff] [blame] | 42 | #if defined(MBEDTLS_PK_HAVE_ECC_KEYS) |
Manuel Pégourié-Gonnard | da88c38 | 2023-07-06 12:31:43 +0200 | [diff] [blame] | 43 | #include "mbedtls/ecp.h" |
Valerio Setti | 4064dbb | 2023-05-17 15:33:07 +0200 | [diff] [blame] | 44 | #include "pk_internal.h" |
| 45 | #endif |
Manuel Pégourié-Gonnard | da88c38 | 2023-07-06 12:31:43 +0200 | [diff] [blame] | 46 | |
| 47 | /* Extended formats */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 48 | #if defined(MBEDTLS_PEM_PARSE_C) |
Manuel Pégourié-Gonnard | 7f80997 | 2015-03-09 17:05:11 +0000 | [diff] [blame] | 49 | #include "mbedtls/pem.h" |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 50 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 51 | #if defined(MBEDTLS_PKCS5_C) |
Manuel Pégourié-Gonnard | 7f80997 | 2015-03-09 17:05:11 +0000 | [diff] [blame] | 52 | #include "mbedtls/pkcs5.h" |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 53 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 54 | #if defined(MBEDTLS_PKCS12_C) |
Manuel Pégourié-Gonnard | 7f80997 | 2015-03-09 17:05:11 +0000 | [diff] [blame] | 55 | #include "mbedtls/pkcs12.h" |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 56 | #endif |
| 57 | |
Valerio Setti | e0e6311 | 2023-05-18 18:48:07 +0200 | [diff] [blame] | 58 | /* Helper for Montgomery curves */ |
Valerio Setti | 81d7512 | 2023-06-14 14:49:33 +0200 | [diff] [blame] | 59 | #if defined(MBEDTLS_PK_HAVE_ECC_KEYS) && defined(MBEDTLS_PK_HAVE_RFC8410_CURVES) |
Valerio Setti | e0e6311 | 2023-05-18 18:48:07 +0200 | [diff] [blame] | 60 | #define MBEDTLS_PK_IS_RFC8410_GROUP_ID(id) \ |
| 61 | ((id == MBEDTLS_ECP_DP_CURVE25519) || (id == MBEDTLS_ECP_DP_CURVE448)) |
Valerio Setti | 81d7512 | 2023-06-14 14:49:33 +0200 | [diff] [blame] | 62 | #endif /* MBEDTLS_PK_HAVE_ECC_KEYS && MBEDTLS_PK_HAVE_RFC8410_CURVES */ |
Valerio Setti | e0e6311 | 2023-05-18 18:48:07 +0200 | [diff] [blame] | 63 | |
Gilles Peskine | 832f349 | 2017-11-30 11:42:12 +0100 | [diff] [blame] | 64 | #if defined(MBEDTLS_FS_IO) |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 65 | /* |
| 66 | * Load all data from a file into a given buffer. |
Manuel Pégourié-Gonnard | 43b37cb | 2015-05-12 11:20:10 +0200 | [diff] [blame] | 67 | * |
| 68 | * The file is expected to contain either PEM or DER encoded data. |
| 69 | * A terminating null byte is always appended. It is included in the announced |
| 70 | * length only if the data looks like it is PEM encoded. |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 71 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 72 | int mbedtls_pk_load_file(const char *path, unsigned char **buf, size_t *n) |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 73 | { |
| 74 | FILE *f; |
| 75 | long size; |
| 76 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 77 | if ((f = fopen(path, "rb")) == NULL) { |
| 78 | return MBEDTLS_ERR_PK_FILE_IO_ERROR; |
| 79 | } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 80 | |
Gilles Peskine | da0913b | 2022-06-30 17:03:40 +0200 | [diff] [blame] | 81 | /* Ensure no stdio buffering of secrets, as such buffers cannot be wiped. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 82 | mbedtls_setbuf(f, NULL); |
Gilles Peskine | da0913b | 2022-06-30 17:03:40 +0200 | [diff] [blame] | 83 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 84 | fseek(f, 0, SEEK_END); |
| 85 | if ((size = ftell(f)) == -1) { |
| 86 | fclose(f); |
| 87 | return MBEDTLS_ERR_PK_FILE_IO_ERROR; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 88 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 89 | fseek(f, 0, SEEK_SET); |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 90 | |
| 91 | *n = (size_t) size; |
| 92 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 93 | if (*n + 1 == 0 || |
| 94 | (*buf = mbedtls_calloc(1, *n + 1)) == NULL) { |
| 95 | fclose(f); |
| 96 | return MBEDTLS_ERR_PK_ALLOC_FAILED; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 97 | } |
| 98 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 99 | if (fread(*buf, 1, *n, f) != *n) { |
| 100 | fclose(f); |
Andres Amaya Garcia | 1f2666f | 2017-06-26 10:36:20 +0100 | [diff] [blame] | 101 | |
Tom Cosgrove | ca8c61b | 2023-07-17 15:17:40 +0100 | [diff] [blame] | 102 | mbedtls_zeroize_and_free(*buf, *n); |
Andres Amaya Garcia | 1f2666f | 2017-06-26 10:36:20 +0100 | [diff] [blame] | 103 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 104 | return MBEDTLS_ERR_PK_FILE_IO_ERROR; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 105 | } |
| 106 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 107 | fclose(f); |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 108 | |
| 109 | (*buf)[*n] = '\0'; |
| 110 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 111 | if (strstr((const char *) *buf, "-----BEGIN ") != NULL) { |
Manuel Pégourié-Gonnard | 43b37cb | 2015-05-12 11:20:10 +0200 | [diff] [blame] | 112 | ++*n; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 113 | } |
Manuel Pégourié-Gonnard | 43b37cb | 2015-05-12 11:20:10 +0200 | [diff] [blame] | 114 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 115 | return 0; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 116 | } |
| 117 | |
| 118 | /* |
| 119 | * Load and parse a private key |
| 120 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 121 | int mbedtls_pk_parse_keyfile(mbedtls_pk_context *ctx, |
| 122 | const char *path, const char *pwd, |
| 123 | int (*f_rng)(void *, unsigned char *, size_t), void *p_rng) |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 124 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 125 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 126 | size_t n; |
| 127 | unsigned char *buf; |
| 128 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 129 | if ((ret = mbedtls_pk_load_file(path, &buf, &n)) != 0) { |
| 130 | return ret; |
| 131 | } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 132 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 133 | if (pwd == NULL) { |
| 134 | ret = mbedtls_pk_parse_key(ctx, buf, n, NULL, 0, f_rng, p_rng); |
| 135 | } else { |
| 136 | ret = mbedtls_pk_parse_key(ctx, buf, n, |
| 137 | (const unsigned char *) pwd, strlen(pwd), f_rng, p_rng); |
| 138 | } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 139 | |
Tom Cosgrove | ca8c61b | 2023-07-17 15:17:40 +0100 | [diff] [blame] | 140 | mbedtls_zeroize_and_free(buf, n); |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 141 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 142 | return ret; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 143 | } |
| 144 | |
| 145 | /* |
| 146 | * Load and parse a public key |
| 147 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 148 | int mbedtls_pk_parse_public_keyfile(mbedtls_pk_context *ctx, const char *path) |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 149 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 150 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 151 | size_t n; |
| 152 | unsigned char *buf; |
| 153 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 154 | if ((ret = mbedtls_pk_load_file(path, &buf, &n)) != 0) { |
| 155 | return ret; |
| 156 | } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 157 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 158 | ret = mbedtls_pk_parse_public_key(ctx, buf, n); |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 159 | |
Tom Cosgrove | ca8c61b | 2023-07-17 15:17:40 +0100 | [diff] [blame] | 160 | mbedtls_zeroize_and_free(buf, n); |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 161 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 162 | return ret; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 163 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 164 | #endif /* MBEDTLS_FS_IO */ |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 165 | |
Valerio Setti | 81d7512 | 2023-06-14 14:49:33 +0200 | [diff] [blame] | 166 | #if defined(MBEDTLS_PK_HAVE_ECC_KEYS) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 167 | /* Minimally parse an ECParameters buffer to and mbedtls_asn1_buf |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 168 | * |
| 169 | * ECParameters ::= CHOICE { |
| 170 | * namedCurve OBJECT IDENTIFIER |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 171 | * specifiedCurve SpecifiedECDomain -- = SEQUENCE { ... } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 172 | * -- implicitCurve NULL |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 173 | * } |
| 174 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 175 | static int pk_get_ecparams(unsigned char **p, const unsigned char *end, |
| 176 | mbedtls_asn1_buf *params) |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 177 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 178 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 179 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 180 | if (end - *p < 1) { |
| 181 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, |
| 182 | MBEDTLS_ERR_ASN1_OUT_OF_DATA); |
| 183 | } |
Sanne Wouda | b2b29d5 | 2017-08-21 15:58:12 +0100 | [diff] [blame] | 184 | |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 185 | /* Tag may be either OID or SEQUENCE */ |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 186 | params->tag = **p; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 187 | if (params->tag != MBEDTLS_ASN1_OID |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 188 | #if defined(MBEDTLS_PK_PARSE_EC_EXTENDED) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 189 | && params->tag != (MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE) |
Manuel Pégourié-Gonnard | 6fac351 | 2014-03-19 16:39:52 +0100 | [diff] [blame] | 190 | #endif |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 191 | ) { |
| 192 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, |
| 193 | MBEDTLS_ERR_ASN1_UNEXPECTED_TAG); |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 194 | } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 195 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 196 | if ((ret = mbedtls_asn1_get_tag(p, end, ¶ms->len, params->tag)) != 0) { |
| 197 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret); |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 198 | } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 199 | |
| 200 | params->p = *p; |
| 201 | *p += params->len; |
| 202 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 203 | if (*p != end) { |
| 204 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, |
| 205 | MBEDTLS_ERR_ASN1_LENGTH_MISMATCH); |
| 206 | } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 207 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 208 | return 0; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 209 | } |
| 210 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 211 | #if defined(MBEDTLS_PK_PARSE_EC_EXTENDED) |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 212 | /* |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 213 | * Parse a SpecifiedECDomain (SEC 1 C.2) and (mostly) fill the group with it. |
| 214 | * WARNING: the resulting group should only be used with |
| 215 | * pk_group_id_from_specified(), since its base point may not be set correctly |
| 216 | * if it was encoded compressed. |
| 217 | * |
| 218 | * SpecifiedECDomain ::= SEQUENCE { |
| 219 | * version SpecifiedECDomainVersion(ecdpVer1 | ecdpVer2 | ecdpVer3, ...), |
| 220 | * fieldID FieldID {{FieldTypes}}, |
| 221 | * curve Curve, |
| 222 | * base ECPoint, |
| 223 | * order INTEGER, |
| 224 | * cofactor INTEGER OPTIONAL, |
| 225 | * hash HashAlgorithm OPTIONAL, |
| 226 | * ... |
| 227 | * } |
| 228 | * |
| 229 | * We only support prime-field as field type, and ignore hash and cofactor. |
| 230 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 231 | static int pk_group_from_specified(const mbedtls_asn1_buf *params, mbedtls_ecp_group *grp) |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 232 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 233 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 234 | unsigned char *p = params->p; |
Jethro Beekman | 0167244 | 2023-04-19 14:08:14 +0200 | [diff] [blame] | 235 | const unsigned char *const end = params->p + params->len; |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 236 | const unsigned char *end_field, *end_curve; |
| 237 | size_t len; |
| 238 | int ver; |
| 239 | |
| 240 | /* SpecifiedECDomainVersion ::= INTEGER { 1, 2, 3 } */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 241 | if ((ret = mbedtls_asn1_get_int(&p, end, &ver)) != 0) { |
| 242 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret); |
| 243 | } |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 244 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 245 | if (ver < 1 || ver > 3) { |
| 246 | return MBEDTLS_ERR_PK_KEY_INVALID_FORMAT; |
| 247 | } |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 248 | |
| 249 | /* |
| 250 | * FieldID { FIELD-ID:IOSet } ::= SEQUENCE { -- Finite field |
| 251 | * fieldType FIELD-ID.&id({IOSet}), |
| 252 | * parameters FIELD-ID.&Type({IOSet}{@fieldType}) |
| 253 | * } |
| 254 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 255 | if ((ret = mbedtls_asn1_get_tag(&p, end, &len, |
| 256 | MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) { |
| 257 | return ret; |
| 258 | } |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 259 | |
| 260 | end_field = p + len; |
| 261 | |
| 262 | /* |
| 263 | * FIELD-ID ::= TYPE-IDENTIFIER |
| 264 | * FieldTypes FIELD-ID ::= { |
| 265 | * { Prime-p IDENTIFIED BY prime-field } | |
| 266 | * { Characteristic-two IDENTIFIED BY characteristic-two-field } |
| 267 | * } |
| 268 | * prime-field OBJECT IDENTIFIER ::= { id-fieldType 1 } |
| 269 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 270 | if ((ret = mbedtls_asn1_get_tag(&p, end_field, &len, MBEDTLS_ASN1_OID)) != 0) { |
| 271 | return ret; |
| 272 | } |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 273 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 274 | if (len != MBEDTLS_OID_SIZE(MBEDTLS_OID_ANSI_X9_62_PRIME_FIELD) || |
| 275 | memcmp(p, MBEDTLS_OID_ANSI_X9_62_PRIME_FIELD, len) != 0) { |
| 276 | return MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE; |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 277 | } |
| 278 | |
| 279 | p += len; |
| 280 | |
| 281 | /* Prime-p ::= INTEGER -- Field of size p. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 282 | if ((ret = mbedtls_asn1_get_mpi(&p, end_field, &grp->P)) != 0) { |
| 283 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret); |
| 284 | } |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 285 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 286 | grp->pbits = mbedtls_mpi_bitlen(&grp->P); |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 287 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 288 | if (p != end_field) { |
| 289 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, |
| 290 | MBEDTLS_ERR_ASN1_LENGTH_MISMATCH); |
| 291 | } |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 292 | |
| 293 | /* |
| 294 | * Curve ::= SEQUENCE { |
| 295 | * a FieldElement, |
| 296 | * b FieldElement, |
| 297 | * seed BIT STRING OPTIONAL |
| 298 | * -- Shall be present if used in SpecifiedECDomain |
| 299 | * -- with version equal to ecdpVer2 or ecdpVer3 |
| 300 | * } |
| 301 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 302 | if ((ret = mbedtls_asn1_get_tag(&p, end, &len, |
| 303 | MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) { |
| 304 | return ret; |
| 305 | } |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 306 | |
| 307 | end_curve = p + len; |
| 308 | |
| 309 | /* |
| 310 | * FieldElement ::= OCTET STRING |
| 311 | * containing an integer in the case of a prime field |
| 312 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 313 | if ((ret = mbedtls_asn1_get_tag(&p, end_curve, &len, MBEDTLS_ASN1_OCTET_STRING)) != 0 || |
| 314 | (ret = mbedtls_mpi_read_binary(&grp->A, p, len)) != 0) { |
| 315 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret); |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 316 | } |
| 317 | |
| 318 | p += len; |
| 319 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 320 | if ((ret = mbedtls_asn1_get_tag(&p, end_curve, &len, MBEDTLS_ASN1_OCTET_STRING)) != 0 || |
| 321 | (ret = mbedtls_mpi_read_binary(&grp->B, p, len)) != 0) { |
| 322 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret); |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 323 | } |
| 324 | |
| 325 | p += len; |
| 326 | |
| 327 | /* Ignore seed BIT STRING OPTIONAL */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 328 | if ((ret = mbedtls_asn1_get_tag(&p, end_curve, &len, MBEDTLS_ASN1_BIT_STRING)) == 0) { |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 329 | p += len; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 330 | } |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 331 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 332 | if (p != end_curve) { |
| 333 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, |
| 334 | MBEDTLS_ERR_ASN1_LENGTH_MISMATCH); |
| 335 | } |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 336 | |
| 337 | /* |
| 338 | * ECPoint ::= OCTET STRING |
| 339 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 340 | if ((ret = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_OCTET_STRING)) != 0) { |
| 341 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret); |
| 342 | } |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 343 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 344 | if ((ret = mbedtls_ecp_point_read_binary(grp, &grp->G, |
| 345 | (const unsigned char *) p, len)) != 0) { |
Manuel Pégourié-Gonnard | 5246ee5 | 2014-03-19 16:18:38 +0100 | [diff] [blame] | 346 | /* |
| 347 | * If we can't read the point because it's compressed, cheat by |
| 348 | * reading only the X coordinate and the parity bit of Y. |
| 349 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 350 | if (ret != MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE || |
| 351 | (p[0] != 0x02 && p[0] != 0x03) || |
| 352 | len != mbedtls_mpi_size(&grp->P) + 1 || |
| 353 | mbedtls_mpi_read_binary(&grp->G.X, p + 1, len - 1) != 0 || |
| 354 | mbedtls_mpi_lset(&grp->G.Y, p[0] - 2) != 0 || |
| 355 | mbedtls_mpi_lset(&grp->G.Z, 1) != 0) { |
| 356 | return MBEDTLS_ERR_PK_KEY_INVALID_FORMAT; |
Manuel Pégourié-Gonnard | 5246ee5 | 2014-03-19 16:18:38 +0100 | [diff] [blame] | 357 | } |
| 358 | } |
| 359 | |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 360 | p += len; |
| 361 | |
| 362 | /* |
| 363 | * order INTEGER |
| 364 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 365 | if ((ret = mbedtls_asn1_get_mpi(&p, end, &grp->N)) != 0) { |
| 366 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret); |
| 367 | } |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 368 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 369 | grp->nbits = mbedtls_mpi_bitlen(&grp->N); |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 370 | |
| 371 | /* |
| 372 | * Allow optional elements by purposefully not enforcing p == end here. |
| 373 | */ |
| 374 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 375 | return 0; |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 376 | } |
| 377 | |
| 378 | /* |
| 379 | * Find the group id associated with an (almost filled) group as generated by |
| 380 | * pk_group_from_specified(), or return an error if unknown. |
| 381 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 382 | static int pk_group_id_from_group(const mbedtls_ecp_group *grp, mbedtls_ecp_group_id *grp_id) |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 383 | { |
Manuel Pégourié-Gonnard | 5b8c409 | 2014-03-27 14:59:42 +0100 | [diff] [blame] | 384 | int ret = 0; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 385 | mbedtls_ecp_group ref; |
| 386 | const mbedtls_ecp_group_id *id; |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 387 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 388 | mbedtls_ecp_group_init(&ref); |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 389 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 390 | for (id = mbedtls_ecp_grp_id_list(); *id != MBEDTLS_ECP_DP_NONE; id++) { |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 391 | /* Load the group associated to that id */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 392 | mbedtls_ecp_group_free(&ref); |
| 393 | MBEDTLS_MPI_CHK(mbedtls_ecp_group_load(&ref, *id)); |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 394 | |
| 395 | /* Compare to the group we were given, starting with easy tests */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 396 | if (grp->pbits == ref.pbits && grp->nbits == ref.nbits && |
| 397 | mbedtls_mpi_cmp_mpi(&grp->P, &ref.P) == 0 && |
| 398 | mbedtls_mpi_cmp_mpi(&grp->A, &ref.A) == 0 && |
| 399 | mbedtls_mpi_cmp_mpi(&grp->B, &ref.B) == 0 && |
| 400 | mbedtls_mpi_cmp_mpi(&grp->N, &ref.N) == 0 && |
| 401 | mbedtls_mpi_cmp_mpi(&grp->G.X, &ref.G.X) == 0 && |
| 402 | mbedtls_mpi_cmp_mpi(&grp->G.Z, &ref.G.Z) == 0 && |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 403 | /* For Y we may only know the parity bit, so compare only that */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 404 | mbedtls_mpi_get_bit(&grp->G.Y, 0) == mbedtls_mpi_get_bit(&ref.G.Y, 0)) { |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 405 | break; |
| 406 | } |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 407 | } |
| 408 | |
| 409 | cleanup: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 410 | mbedtls_ecp_group_free(&ref); |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 411 | |
| 412 | *grp_id = *id; |
| 413 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 414 | if (ret == 0 && *id == MBEDTLS_ECP_DP_NONE) { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 415 | ret = MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 416 | } |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 417 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 418 | return ret; |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 419 | } |
| 420 | |
| 421 | /* |
| 422 | * Parse a SpecifiedECDomain (SEC 1 C.2) and find the associated group ID |
| 423 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 424 | static int pk_group_id_from_specified(const mbedtls_asn1_buf *params, |
| 425 | mbedtls_ecp_group_id *grp_id) |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 426 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 427 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 428 | mbedtls_ecp_group grp; |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 429 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 430 | mbedtls_ecp_group_init(&grp); |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 431 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 432 | if ((ret = pk_group_from_specified(params, &grp)) != 0) { |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 433 | goto cleanup; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 434 | } |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 435 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 436 | ret = pk_group_id_from_group(&grp, grp_id); |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 437 | |
| 438 | cleanup: |
Minos Galanakis | 8692ec8 | 2023-01-20 15:27:32 +0000 | [diff] [blame] | 439 | /* The API respecting lifecycle for mbedtls_ecp_group struct is |
| 440 | * _init(), _load() and _free(). In pk_group_id_from_specified() the |
| 441 | * temporary grp breaks that flow and it's members are populated |
| 442 | * by pk_group_id_from_group(). As such mbedtls_ecp_group_free() |
| 443 | * which is assuming a group populated by _setup() may not clean-up |
| 444 | * properly -> Manually free it's members. |
| 445 | */ |
Minos Galanakis | c8e381a | 2023-01-19 16:08:34 +0000 | [diff] [blame] | 446 | mbedtls_mpi_free(&grp.N); |
| 447 | mbedtls_mpi_free(&grp.P); |
| 448 | mbedtls_mpi_free(&grp.A); |
| 449 | mbedtls_mpi_free(&grp.B); |
| 450 | mbedtls_ecp_point_free(&grp.G); |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 451 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 452 | return ret; |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 453 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 454 | #endif /* MBEDTLS_PK_PARSE_EC_EXTENDED */ |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 455 | |
Manuel Pégourié-Gonnard | 2585852 | 2023-07-24 11:44:55 +0200 | [diff] [blame^] | 456 | /* |
| 457 | * Set the group used by this key. |
| 458 | */ |
| 459 | static int pk_ecc_set_group(mbedtls_pk_context *pk, mbedtls_ecp_group_id grp_id) |
Valerio Setti | 4064dbb | 2023-05-17 15:33:07 +0200 | [diff] [blame] | 460 | { |
Manuel Pégourié-Gonnard | 2585852 | 2023-07-24 11:44:55 +0200 | [diff] [blame^] | 461 | #if defined(MBEDTLS_PK_USE_PSA_EC_DATA) |
| 462 | size_t ec_bits; |
| 463 | psa_ecc_family_t ec_family = mbedtls_ecc_group_to_psa(grp_id, &ec_bits); |
Valerio Setti | 4064dbb | 2023-05-17 15:33:07 +0200 | [diff] [blame] | 464 | |
Manuel Pégourié-Gonnard | 2585852 | 2023-07-24 11:44:55 +0200 | [diff] [blame^] | 465 | /* group may already be initialized; if so, make sure IDs match */ |
| 466 | if ((pk->ec_family != 0 && pk->ec_family != ec_family) || |
| 467 | (pk->ec_bits != 0 && pk->ec_bits != ec_bits)) { |
Valerio Setti | 4064dbb | 2023-05-17 15:33:07 +0200 | [diff] [blame] | 468 | return MBEDTLS_ERR_PK_KEY_INVALID_FORMAT; |
| 469 | } |
| 470 | |
Manuel Pégourié-Gonnard | 2585852 | 2023-07-24 11:44:55 +0200 | [diff] [blame^] | 471 | /* set group */ |
Valerio Setti | 4064dbb | 2023-05-17 15:33:07 +0200 | [diff] [blame] | 472 | pk->ec_family = ec_family; |
Manuel Pégourié-Gonnard | 2585852 | 2023-07-24 11:44:55 +0200 | [diff] [blame^] | 473 | pk->ec_bits = ec_bits; |
Valerio Setti | 4064dbb | 2023-05-17 15:33:07 +0200 | [diff] [blame] | 474 | |
| 475 | return 0; |
Manuel Pégourié-Gonnard | 2585852 | 2023-07-24 11:44:55 +0200 | [diff] [blame^] | 476 | #else /* MBEDTLS_PK_USE_PSA_EC_DATA */ |
| 477 | mbedtls_ecp_keypair *ecp = mbedtls_pk_ec_rw(*pk); |
| 478 | |
| 479 | /* grp may already be initialized; if so, make sure IDs match */ |
| 480 | if (mbedtls_pk_ec_ro(*pk)->grp.id != MBEDTLS_ECP_DP_NONE && |
| 481 | mbedtls_pk_ec_ro(*pk)->grp.id != grp_id) { |
| 482 | return MBEDTLS_ERR_PK_KEY_INVALID_FORMAT; |
| 483 | } |
| 484 | |
| 485 | /* set group */ |
| 486 | return mbedtls_ecp_group_load(&(ecp->grp), grp_id); |
Valerio Setti | 4064dbb | 2023-05-17 15:33:07 +0200 | [diff] [blame] | 487 | #endif /* MBEDTLS_PK_USE_PSA_EC_DATA */ |
Manuel Pégourié-Gonnard | 2585852 | 2023-07-24 11:44:55 +0200 | [diff] [blame^] | 488 | } |
Valerio Setti | 4064dbb | 2023-05-17 15:33:07 +0200 | [diff] [blame] | 489 | |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 490 | /* |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 491 | * Use EC parameters to initialise an EC group |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 492 | * |
| 493 | * ECParameters ::= CHOICE { |
| 494 | * namedCurve OBJECT IDENTIFIER |
| 495 | * specifiedCurve SpecifiedECDomain -- = SEQUENCE { ... } |
| 496 | * -- implicitCurve NULL |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 497 | */ |
Valerio Setti | 4064dbb | 2023-05-17 15:33:07 +0200 | [diff] [blame] | 498 | static int pk_use_ecparams(const mbedtls_asn1_buf *params, mbedtls_pk_context *pk) |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 499 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 500 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 501 | mbedtls_ecp_group_id grp_id; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 502 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 503 | if (params->tag == MBEDTLS_ASN1_OID) { |
| 504 | if (mbedtls_oid_get_ec_grp(params, &grp_id) != 0) { |
| 505 | return MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE; |
| 506 | } |
| 507 | } else { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 508 | #if defined(MBEDTLS_PK_PARSE_EC_EXTENDED) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 509 | if ((ret = pk_group_id_from_specified(params, &grp_id)) != 0) { |
| 510 | return ret; |
| 511 | } |
Manuel Pégourié-Gonnard | 6fac351 | 2014-03-19 16:39:52 +0100 | [diff] [blame] | 512 | #else |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 513 | return MBEDTLS_ERR_PK_KEY_INVALID_FORMAT; |
Manuel Pégourié-Gonnard | 6fac351 | 2014-03-19 16:39:52 +0100 | [diff] [blame] | 514 | #endif |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 515 | } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 516 | |
Manuel Pégourié-Gonnard | 2585852 | 2023-07-24 11:44:55 +0200 | [diff] [blame^] | 517 | return pk_ecc_set_group(pk, grp_id); |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 518 | } |
| 519 | |
Jethro Beekman | 0167244 | 2023-04-19 14:08:14 +0200 | [diff] [blame] | 520 | /* |
| 521 | * Helper function for deriving a public key from its private counterpart. |
| 522 | */ |
Valerio Setti | 4064dbb | 2023-05-17 15:33:07 +0200 | [diff] [blame] | 523 | static int pk_derive_public_key(mbedtls_pk_context *pk, |
Jethro Beekman | 0167244 | 2023-04-19 14:08:14 +0200 | [diff] [blame] | 524 | const unsigned char *d, size_t d_len, |
| 525 | int (*f_rng)(void *, unsigned char *, size_t), void *p_rng) |
| 526 | { |
| 527 | int ret; |
| 528 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
Valerio Setti | 00e8dd1 | 2023-05-18 18:56:59 +0200 | [diff] [blame] | 529 | psa_status_t status; |
| 530 | (void) f_rng; |
| 531 | (void) p_rng; |
| 532 | #if defined(MBEDTLS_PK_USE_PSA_EC_DATA) |
| 533 | (void) d; |
| 534 | (void) d_len; |
| 535 | |
| 536 | status = psa_export_public_key(pk->priv_id, pk->pub_raw, sizeof(pk->pub_raw), |
| 537 | &pk->pub_raw_len); |
| 538 | ret = psa_pk_status_to_mbedtls(status); |
| 539 | #else /* MBEDTLS_PK_USE_PSA_EC_DATA */ |
| 540 | mbedtls_ecp_keypair *eck = (mbedtls_ecp_keypair *) pk->pk_ctx; |
| 541 | unsigned char key_buf[MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH]; |
| 542 | size_t key_len; |
| 543 | mbedtls_svc_key_id_t key_id = MBEDTLS_SVC_KEY_ID_INIT; |
Jethro Beekman | 0167244 | 2023-04-19 14:08:14 +0200 | [diff] [blame] | 544 | psa_key_attributes_t key_attr = PSA_KEY_ATTRIBUTES_INIT; |
| 545 | size_t curve_bits; |
| 546 | psa_ecc_family_t curve = mbedtls_ecc_group_to_psa(eck->grp.id, &curve_bits); |
Valerio Setti | 00e8dd1 | 2023-05-18 18:56:59 +0200 | [diff] [blame] | 547 | psa_status_t destruction_status; |
Jethro Beekman | 0167244 | 2023-04-19 14:08:14 +0200 | [diff] [blame] | 548 | |
| 549 | psa_set_key_type(&key_attr, PSA_KEY_TYPE_ECC_KEY_PAIR(curve)); |
| 550 | psa_set_key_usage_flags(&key_attr, PSA_KEY_USAGE_EXPORT); |
| 551 | |
| 552 | status = psa_import_key(&key_attr, d, d_len, &key_id); |
| 553 | ret = psa_pk_status_to_mbedtls(status); |
| 554 | if (ret != 0) { |
| 555 | return ret; |
| 556 | } |
| 557 | |
Jethro Beekman | 0167244 | 2023-04-19 14:08:14 +0200 | [diff] [blame] | 558 | status = psa_export_public_key(key_id, key_buf, sizeof(key_buf), &key_len); |
| 559 | ret = psa_pk_status_to_mbedtls(status); |
| 560 | destruction_status = psa_destroy_key(key_id); |
| 561 | if (ret != 0) { |
| 562 | return ret; |
| 563 | } else if (destruction_status != PSA_SUCCESS) { |
| 564 | return psa_pk_status_to_mbedtls(destruction_status); |
| 565 | } |
Jethro Beekman | 0167244 | 2023-04-19 14:08:14 +0200 | [diff] [blame] | 566 | ret = mbedtls_ecp_point_read_binary(&eck->grp, &eck->Q, key_buf, key_len); |
Valerio Setti | 00e8dd1 | 2023-05-18 18:56:59 +0200 | [diff] [blame] | 567 | #endif /* MBEDTLS_PK_USE_PSA_EC_DATA */ |
Jethro Beekman | 0167244 | 2023-04-19 14:08:14 +0200 | [diff] [blame] | 568 | #else /* MBEDTLS_USE_PSA_CRYPTO */ |
Valerio Setti | 00e8dd1 | 2023-05-18 18:56:59 +0200 | [diff] [blame] | 569 | mbedtls_ecp_keypair *eck = (mbedtls_ecp_keypair *) pk->pk_ctx; |
Jethro Beekman | 0167244 | 2023-04-19 14:08:14 +0200 | [diff] [blame] | 570 | (void) d; |
| 571 | (void) d_len; |
| 572 | |
| 573 | ret = mbedtls_ecp_mul(&eck->grp, &eck->Q, &eck->d, &eck->grp.G, f_rng, p_rng); |
| 574 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
| 575 | return ret; |
| 576 | } |
| 577 | |
| 578 | #if defined(MBEDTLS_PK_HAVE_RFC8410_CURVES) |
| 579 | |
| 580 | /* |
| 581 | * Load an RFC8410 EC key, which doesn't have any parameters |
| 582 | */ |
| 583 | static int pk_use_ecparams_rfc8410(const mbedtls_asn1_buf *params, |
| 584 | mbedtls_ecp_group_id grp_id, |
Valerio Setti | 4064dbb | 2023-05-17 15:33:07 +0200 | [diff] [blame] | 585 | mbedtls_pk_context *pk) |
Jethro Beekman | 0167244 | 2023-04-19 14:08:14 +0200 | [diff] [blame] | 586 | { |
| 587 | if (params->tag != 0 || params->len != 0) { |
| 588 | return MBEDTLS_ERR_PK_KEY_INVALID_FORMAT; |
| 589 | } |
| 590 | |
Manuel Pégourié-Gonnard | 2585852 | 2023-07-24 11:44:55 +0200 | [diff] [blame^] | 591 | return pk_ecc_set_group(pk, grp_id); |
Jethro Beekman | 0167244 | 2023-04-19 14:08:14 +0200 | [diff] [blame] | 592 | } |
| 593 | |
| 594 | /* |
| 595 | * Parse an RFC 8410 encoded private EC key |
| 596 | * |
| 597 | * CurvePrivateKey ::= OCTET STRING |
| 598 | */ |
Valerio Setti | 4064dbb | 2023-05-17 15:33:07 +0200 | [diff] [blame] | 599 | static int pk_parse_key_rfc8410_der(mbedtls_pk_context *pk, |
Jethro Beekman | 0167244 | 2023-04-19 14:08:14 +0200 | [diff] [blame] | 600 | unsigned char *key, size_t keylen, const unsigned char *end, |
| 601 | int (*f_rng)(void *, unsigned char *, size_t), void *p_rng) |
| 602 | { |
| 603 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
| 604 | size_t len; |
| 605 | |
| 606 | if ((ret = mbedtls_asn1_get_tag(&key, (key + keylen), &len, MBEDTLS_ASN1_OCTET_STRING)) != 0) { |
| 607 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret); |
| 608 | } |
| 609 | |
| 610 | if (key + len != end) { |
| 611 | return MBEDTLS_ERR_PK_KEY_INVALID_FORMAT; |
| 612 | } |
| 613 | |
Valerio Setti | 00e8dd1 | 2023-05-18 18:56:59 +0200 | [diff] [blame] | 614 | #if defined(MBEDTLS_PK_USE_PSA_EC_DATA) |
| 615 | psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; |
| 616 | psa_status_t status; |
| 617 | |
| 618 | psa_set_key_type(&attributes, PSA_KEY_TYPE_ECC_KEY_PAIR(pk->ec_family)); |
Valerio Setti | 51aa52e | 2023-05-24 12:37:50 +0200 | [diff] [blame] | 619 | psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_EXPORT | |
| 620 | PSA_KEY_USAGE_DERIVE); |
| 621 | psa_set_key_algorithm(&attributes, PSA_ALG_ECDH); |
Valerio Setti | 00e8dd1 | 2023-05-18 18:56:59 +0200 | [diff] [blame] | 622 | |
| 623 | status = psa_import_key(&attributes, key, len, &pk->priv_id); |
| 624 | if (status != PSA_SUCCESS) { |
| 625 | ret = psa_pk_status_to_mbedtls(status); |
| 626 | return ret; |
| 627 | } |
| 628 | #else /* MBEDTLS_PK_USE_PSA_EC_DATA */ |
| 629 | mbedtls_ecp_keypair *eck = mbedtls_pk_ec_rw(*pk); |
| 630 | |
Valerio Setti | 805e4a0 | 2023-06-30 17:16:19 +0200 | [diff] [blame] | 631 | if ((ret = mbedtls_ecp_read_key(eck->grp.id, eck, key, len)) != 0) { |
Jethro Beekman | 0167244 | 2023-04-19 14:08:14 +0200 | [diff] [blame] | 632 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret); |
| 633 | } |
Valerio Setti | 00e8dd1 | 2023-05-18 18:56:59 +0200 | [diff] [blame] | 634 | #endif /* MBEDTLS_PK_USE_PSA_EC_DATA */ |
Jethro Beekman | 0167244 | 2023-04-19 14:08:14 +0200 | [diff] [blame] | 635 | |
Valerio Setti | 4064dbb | 2023-05-17 15:33:07 +0200 | [diff] [blame] | 636 | /* pk_parse_key_pkcs8_unencrypted_der() only supports version 1 PKCS8 keys, |
| 637 | * which never contain a public key. As such, derive the public key |
| 638 | * unconditionally. */ |
| 639 | if ((ret = pk_derive_public_key(pk, key, len, f_rng, p_rng)) != 0) { |
Jethro Beekman | 0167244 | 2023-04-19 14:08:14 +0200 | [diff] [blame] | 640 | return ret; |
| 641 | } |
| 642 | |
Jethro Beekman | 0167244 | 2023-04-19 14:08:14 +0200 | [diff] [blame] | 643 | return 0; |
| 644 | } |
| 645 | #endif /* MBEDTLS_PK_HAVE_RFC8410_CURVES */ |
Valerio Setti | 4064dbb | 2023-05-17 15:33:07 +0200 | [diff] [blame] | 646 | |
Valerio Setti | addeee4 | 2023-06-14 10:46:55 +0200 | [diff] [blame] | 647 | #if defined(MBEDTLS_PK_USE_PSA_EC_DATA) && defined(MBEDTLS_PK_PARSE_EC_COMPRESSED) |
Valerio Setti | 4064dbb | 2023-05-17 15:33:07 +0200 | [diff] [blame] | 648 | /* |
| 649 | * Create a temporary ecp_keypair for converting an EC point in compressed |
| 650 | * format to an uncompressed one |
| 651 | */ |
| 652 | static int pk_convert_compressed_ec(mbedtls_pk_context *pk, |
| 653 | const unsigned char *in_start, size_t in_len, |
| 654 | size_t *out_buf_len, unsigned char *out_buf, |
| 655 | size_t out_buf_size) |
| 656 | { |
| 657 | mbedtls_ecp_keypair ecp_key; |
| 658 | mbedtls_ecp_group_id ecp_group_id; |
| 659 | int ret; |
| 660 | |
| 661 | ecp_group_id = mbedtls_ecc_group_of_psa(pk->ec_family, pk->ec_bits, 0); |
| 662 | |
| 663 | mbedtls_ecp_keypair_init(&ecp_key); |
| 664 | ret = mbedtls_ecp_group_load(&(ecp_key.grp), ecp_group_id); |
| 665 | if (ret != 0) { |
| 666 | return ret; |
| 667 | } |
| 668 | ret = mbedtls_ecp_point_read_binary(&(ecp_key.grp), &ecp_key.Q, |
| 669 | in_start, in_len); |
| 670 | if (ret != 0) { |
| 671 | goto exit; |
| 672 | } |
| 673 | ret = mbedtls_ecp_point_write_binary(&(ecp_key.grp), &ecp_key.Q, |
| 674 | MBEDTLS_ECP_PF_UNCOMPRESSED, |
| 675 | out_buf_len, out_buf, out_buf_size); |
| 676 | |
| 677 | exit: |
| 678 | mbedtls_ecp_keypair_free(&ecp_key); |
| 679 | return ret; |
| 680 | } |
Valerio Setti | addeee4 | 2023-06-14 10:46:55 +0200 | [diff] [blame] | 681 | #endif /* MBEDTLS_PK_USE_PSA_EC_DATA && MBEDTLS_PK_PARSE_EC_COMPRESSED */ |
Jethro Beekman | 0167244 | 2023-04-19 14:08:14 +0200 | [diff] [blame] | 682 | |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 683 | /* |
| 684 | * EC public key is an EC point |
Manuel Pégourié-Gonnard | 5246ee5 | 2014-03-19 16:18:38 +0100 | [diff] [blame] | 685 | * |
| 686 | * The caller is responsible for clearing the structure upon failure if |
| 687 | * desired. Take care to pass along the possible ECP_FEATURE_UNAVAILABLE |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 688 | * return code of mbedtls_ecp_point_read_binary() and leave p in a usable state. |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 689 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 690 | static int pk_get_ecpubkey(unsigned char **p, const unsigned char *end, |
Valerio Setti | 4064dbb | 2023-05-17 15:33:07 +0200 | [diff] [blame] | 691 | mbedtls_pk_context *pk) |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 692 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 693 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 694 | |
Valerio Setti | 4064dbb | 2023-05-17 15:33:07 +0200 | [diff] [blame] | 695 | #if defined(MBEDTLS_PK_USE_PSA_EC_DATA) |
| 696 | mbedtls_svc_key_id_t key; |
| 697 | psa_key_attributes_t key_attrs = PSA_KEY_ATTRIBUTES_INIT; |
| 698 | size_t len = (end - *p); |
| 699 | |
| 700 | if (len > PSA_EXPORT_PUBLIC_KEY_MAX_SIZE) { |
| 701 | return MBEDTLS_ERR_PK_BAD_INPUT_DATA; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 702 | } |
| 703 | |
Valerio Setti | 4064dbb | 2023-05-17 15:33:07 +0200 | [diff] [blame] | 704 | /* Compressed point format are not supported yet by PSA crypto. As a |
| 705 | * consequence ecp functions are used to "convert" the point to |
| 706 | * uncompressed format */ |
| 707 | if ((**p == 0x02) || (**p == 0x03)) { |
Valerio Setti | addeee4 | 2023-06-14 10:46:55 +0200 | [diff] [blame] | 708 | #if defined(MBEDTLS_PK_PARSE_EC_COMPRESSED) |
Valerio Setti | 4064dbb | 2023-05-17 15:33:07 +0200 | [diff] [blame] | 709 | ret = pk_convert_compressed_ec(pk, *p, len, |
| 710 | &(pk->pub_raw_len), pk->pub_raw, |
| 711 | PSA_EXPORT_PUBLIC_KEY_MAX_SIZE); |
| 712 | if (ret != 0) { |
| 713 | return ret; |
| 714 | } |
Valerio Setti | addeee4 | 2023-06-14 10:46:55 +0200 | [diff] [blame] | 715 | #else /* MBEDTLS_PK_PARSE_EC_COMPRESSED */ |
| 716 | return MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE; |
| 717 | #endif /* MBEDTLS_PK_PARSE_EC_COMPRESSED */ |
Valerio Setti | 4064dbb | 2023-05-17 15:33:07 +0200 | [diff] [blame] | 718 | } else { |
| 719 | /* Uncompressed format */ |
Dave Rodgman | 38c3228 | 2023-09-22 10:51:37 +0100 | [diff] [blame] | 720 | if ((size_t) (end - *p) > MBEDTLS_PK_MAX_EC_PUBKEY_RAW_LEN) { |
Valerio Setti | 016264b | 2023-05-22 18:40:35 +0200 | [diff] [blame] | 721 | return MBEDTLS_ERR_PK_BUFFER_TOO_SMALL; |
Valerio Setti | 4064dbb | 2023-05-17 15:33:07 +0200 | [diff] [blame] | 722 | } |
| 723 | memcpy(pk->pub_raw, *p, (end - *p)); |
| 724 | pk->pub_raw_len = end - *p; |
| 725 | } |
| 726 | |
| 727 | /* Validate the key by trying to importing it */ |
| 728 | psa_set_key_usage_flags(&key_attrs, 0); |
| 729 | psa_set_key_algorithm(&key_attrs, PSA_ALG_ECDSA_ANY); |
| 730 | psa_set_key_type(&key_attrs, PSA_KEY_TYPE_ECC_PUBLIC_KEY(pk->ec_family)); |
| 731 | psa_set_key_bits(&key_attrs, pk->ec_bits); |
| 732 | |
| 733 | if ((psa_import_key(&key_attrs, pk->pub_raw, pk->pub_raw_len, |
| 734 | &key) != PSA_SUCCESS) || |
| 735 | (psa_destroy_key(key) != PSA_SUCCESS)) { |
| 736 | mbedtls_platform_zeroize(pk->pub_raw, MBEDTLS_PK_MAX_EC_PUBKEY_RAW_LEN); |
| 737 | pk->pub_raw_len = 0; |
| 738 | return MBEDTLS_ERR_PK_BAD_INPUT_DATA; |
| 739 | } |
| 740 | ret = 0; |
| 741 | #else /* MBEDTLS_PK_USE_PSA_EC_DATA */ |
| 742 | mbedtls_ecp_keypair *ec_key = (mbedtls_ecp_keypair *) pk->pk_ctx; |
| 743 | if ((ret = mbedtls_ecp_point_read_binary(&ec_key->grp, &ec_key->Q, |
| 744 | (const unsigned char *) *p, |
| 745 | end - *p)) == 0) { |
| 746 | ret = mbedtls_ecp_check_pubkey(&ec_key->grp, &ec_key->Q); |
| 747 | } |
| 748 | #endif /* MBEDTLS_PK_USE_PSA_EC_DATA */ |
| 749 | |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 750 | /* |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 751 | * We know mbedtls_ecp_point_read_binary consumed all bytes or failed |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 752 | */ |
| 753 | *p = (unsigned char *) end; |
| 754 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 755 | return ret; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 756 | } |
Valerio Setti | 81d7512 | 2023-06-14 14:49:33 +0200 | [diff] [blame] | 757 | #endif /* MBEDTLS_PK_HAVE_ECC_KEYS */ |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 758 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 759 | #if defined(MBEDTLS_RSA_C) |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 760 | /* |
| 761 | * RSAPublicKey ::= SEQUENCE { |
| 762 | * modulus INTEGER, -- n |
| 763 | * publicExponent INTEGER -- e |
| 764 | * } |
| 765 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 766 | static int pk_get_rsapubkey(unsigned char **p, |
| 767 | const unsigned char *end, |
| 768 | mbedtls_rsa_context *rsa) |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 769 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 770 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 771 | size_t len; |
| 772 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 773 | if ((ret = mbedtls_asn1_get_tag(p, end, &len, |
| 774 | MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) { |
| 775 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_INVALID_PUBKEY, ret); |
| 776 | } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 777 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 778 | if (*p + len != end) { |
| 779 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_INVALID_PUBKEY, |
| 780 | MBEDTLS_ERR_ASN1_LENGTH_MISMATCH); |
| 781 | } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 782 | |
Hanno Becker | d58c5b2 | 2017-08-22 14:33:21 +0100 | [diff] [blame] | 783 | /* Import N */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 784 | if ((ret = mbedtls_asn1_get_tag(p, end, &len, MBEDTLS_ASN1_INTEGER)) != 0) { |
| 785 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_INVALID_PUBKEY, ret); |
| 786 | } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 787 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 788 | if ((ret = mbedtls_rsa_import_raw(rsa, *p, len, NULL, 0, NULL, 0, |
| 789 | NULL, 0, NULL, 0)) != 0) { |
| 790 | return MBEDTLS_ERR_PK_INVALID_PUBKEY; |
| 791 | } |
Hanno Becker | d58c5b2 | 2017-08-22 14:33:21 +0100 | [diff] [blame] | 792 | |
| 793 | *p += len; |
| 794 | |
| 795 | /* Import E */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 796 | if ((ret = mbedtls_asn1_get_tag(p, end, &len, MBEDTLS_ASN1_INTEGER)) != 0) { |
| 797 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_INVALID_PUBKEY, ret); |
| 798 | } |
Hanno Becker | d58c5b2 | 2017-08-22 14:33:21 +0100 | [diff] [blame] | 799 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 800 | if ((ret = mbedtls_rsa_import_raw(rsa, NULL, 0, NULL, 0, NULL, 0, |
| 801 | NULL, 0, *p, len)) != 0) { |
| 802 | return MBEDTLS_ERR_PK_INVALID_PUBKEY; |
| 803 | } |
Hanno Becker | d58c5b2 | 2017-08-22 14:33:21 +0100 | [diff] [blame] | 804 | |
| 805 | *p += len; |
| 806 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 807 | if (mbedtls_rsa_complete(rsa) != 0 || |
| 808 | mbedtls_rsa_check_pubkey(rsa) != 0) { |
| 809 | return MBEDTLS_ERR_PK_INVALID_PUBKEY; |
Hanno Becker | 895c5ab | 2018-01-05 08:08:09 +0000 | [diff] [blame] | 810 | } |
Hanno Becker | d58c5b2 | 2017-08-22 14:33:21 +0100 | [diff] [blame] | 811 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 812 | if (*p != end) { |
| 813 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_INVALID_PUBKEY, |
| 814 | MBEDTLS_ERR_ASN1_LENGTH_MISMATCH); |
| 815 | } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 816 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 817 | return 0; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 818 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 819 | #endif /* MBEDTLS_RSA_C */ |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 820 | |
| 821 | /* Get a PK algorithm identifier |
| 822 | * |
| 823 | * AlgorithmIdentifier ::= SEQUENCE { |
| 824 | * algorithm OBJECT IDENTIFIER, |
| 825 | * parameters ANY DEFINED BY algorithm OPTIONAL } |
| 826 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 827 | static int pk_get_pk_alg(unsigned char **p, |
| 828 | const unsigned char *end, |
Jethro Beekman | 0167244 | 2023-04-19 14:08:14 +0200 | [diff] [blame] | 829 | mbedtls_pk_type_t *pk_alg, mbedtls_asn1_buf *params, |
| 830 | mbedtls_ecp_group_id *ec_grp_id) |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 831 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 832 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 833 | mbedtls_asn1_buf alg_oid; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 834 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 835 | memset(params, 0, sizeof(mbedtls_asn1_buf)); |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 836 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 837 | if ((ret = mbedtls_asn1_get_alg(p, end, &alg_oid, params)) != 0) { |
| 838 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_INVALID_ALG, ret); |
| 839 | } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 840 | |
Jethro Beekman | 0167244 | 2023-04-19 14:08:14 +0200 | [diff] [blame] | 841 | ret = mbedtls_oid_get_pk_alg(&alg_oid, pk_alg); |
Valerio Setti | 81d7512 | 2023-06-14 14:49:33 +0200 | [diff] [blame] | 842 | #if defined(MBEDTLS_PK_HAVE_ECC_KEYS) |
Jethro Beekman | 0167244 | 2023-04-19 14:08:14 +0200 | [diff] [blame] | 843 | if (ret == MBEDTLS_ERR_OID_NOT_FOUND) { |
| 844 | ret = mbedtls_oid_get_ec_grp_algid(&alg_oid, ec_grp_id); |
| 845 | if (ret == 0) { |
| 846 | *pk_alg = MBEDTLS_PK_ECKEY; |
| 847 | } |
| 848 | } |
| 849 | #else |
| 850 | (void) ec_grp_id; |
| 851 | #endif |
| 852 | if (ret != 0) { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 853 | return MBEDTLS_ERR_PK_UNKNOWN_PK_ALG; |
| 854 | } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 855 | |
| 856 | /* |
| 857 | * No parameters with RSA (only for EC) |
| 858 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 859 | if (*pk_alg == MBEDTLS_PK_RSA && |
| 860 | ((params->tag != MBEDTLS_ASN1_NULL && params->tag != 0) || |
| 861 | params->len != 0)) { |
| 862 | return MBEDTLS_ERR_PK_INVALID_ALG; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 863 | } |
| 864 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 865 | return 0; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 866 | } |
| 867 | |
| 868 | /* |
| 869 | * SubjectPublicKeyInfo ::= SEQUENCE { |
| 870 | * algorithm AlgorithmIdentifier, |
| 871 | * subjectPublicKey BIT STRING } |
| 872 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 873 | int mbedtls_pk_parse_subpubkey(unsigned char **p, const unsigned char *end, |
| 874 | mbedtls_pk_context *pk) |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 875 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 876 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 877 | size_t len; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 878 | mbedtls_asn1_buf alg_params; |
| 879 | mbedtls_pk_type_t pk_alg = MBEDTLS_PK_NONE; |
Jethro Beekman | 0167244 | 2023-04-19 14:08:14 +0200 | [diff] [blame] | 880 | mbedtls_ecp_group_id ec_grp_id = MBEDTLS_ECP_DP_NONE; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 881 | const mbedtls_pk_info_t *pk_info; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 882 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 883 | if ((ret = mbedtls_asn1_get_tag(p, end, &len, |
| 884 | MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) { |
| 885 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret); |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 886 | } |
| 887 | |
| 888 | end = *p + len; |
| 889 | |
Jethro Beekman | 0167244 | 2023-04-19 14:08:14 +0200 | [diff] [blame] | 890 | if ((ret = pk_get_pk_alg(p, end, &pk_alg, &alg_params, &ec_grp_id)) != 0) { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 891 | return ret; |
| 892 | } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 893 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 894 | if ((ret = mbedtls_asn1_get_bitstring_null(p, end, &len)) != 0) { |
| 895 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_INVALID_PUBKEY, ret); |
| 896 | } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 897 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 898 | if (*p + len != end) { |
| 899 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_INVALID_PUBKEY, |
| 900 | MBEDTLS_ERR_ASN1_LENGTH_MISMATCH); |
| 901 | } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 902 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 903 | if ((pk_info = mbedtls_pk_info_from_type(pk_alg)) == NULL) { |
| 904 | return MBEDTLS_ERR_PK_UNKNOWN_PK_ALG; |
| 905 | } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 906 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 907 | if ((ret = mbedtls_pk_setup(pk, pk_info)) != 0) { |
| 908 | return ret; |
| 909 | } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 910 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 911 | #if defined(MBEDTLS_RSA_C) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 912 | if (pk_alg == MBEDTLS_PK_RSA) { |
| 913 | ret = pk_get_rsapubkey(p, end, mbedtls_pk_rsa(*pk)); |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 914 | } else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 915 | #endif /* MBEDTLS_RSA_C */ |
Valerio Setti | 81d7512 | 2023-06-14 14:49:33 +0200 | [diff] [blame] | 916 | #if defined(MBEDTLS_PK_HAVE_ECC_KEYS) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 917 | if (pk_alg == MBEDTLS_PK_ECKEY_DH || pk_alg == MBEDTLS_PK_ECKEY) { |
Jethro Beekman | 0167244 | 2023-04-19 14:08:14 +0200 | [diff] [blame] | 918 | #if defined(MBEDTLS_PK_HAVE_RFC8410_CURVES) |
Valerio Setti | 00e8dd1 | 2023-05-18 18:56:59 +0200 | [diff] [blame] | 919 | if (MBEDTLS_PK_IS_RFC8410_GROUP_ID(ec_grp_id)) { |
Valerio Setti | 4064dbb | 2023-05-17 15:33:07 +0200 | [diff] [blame] | 920 | ret = pk_use_ecparams_rfc8410(&alg_params, ec_grp_id, pk); |
Jethro Beekman | 0167244 | 2023-04-19 14:08:14 +0200 | [diff] [blame] | 921 | } else |
| 922 | #endif |
| 923 | { |
Valerio Setti | 4064dbb | 2023-05-17 15:33:07 +0200 | [diff] [blame] | 924 | ret = pk_use_ecparams(&alg_params, pk); |
Jethro Beekman | 0167244 | 2023-04-19 14:08:14 +0200 | [diff] [blame] | 925 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 926 | if (ret == 0) { |
Valerio Setti | 4064dbb | 2023-05-17 15:33:07 +0200 | [diff] [blame] | 927 | ret = pk_get_ecpubkey(p, end, pk); |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 928 | } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 929 | } else |
Valerio Setti | 81d7512 | 2023-06-14 14:49:33 +0200 | [diff] [blame] | 930 | #endif /* MBEDTLS_PK_HAVE_ECC_KEYS */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 931 | ret = MBEDTLS_ERR_PK_UNKNOWN_PK_ALG; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 932 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 933 | if (ret == 0 && *p != end) { |
| 934 | ret = MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_INVALID_PUBKEY, |
| 935 | MBEDTLS_ERR_ASN1_LENGTH_MISMATCH); |
| 936 | } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 937 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 938 | if (ret != 0) { |
| 939 | mbedtls_pk_free(pk); |
| 940 | } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 941 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 942 | return ret; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 943 | } |
| 944 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 945 | #if defined(MBEDTLS_RSA_C) |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 946 | /* |
Manuel Pégourié-Gonnard | a04a2c3 | 2020-02-18 10:12:14 +0100 | [diff] [blame] | 947 | * Wrapper around mbedtls_asn1_get_mpi() that rejects zero. |
| 948 | * |
| 949 | * The value zero is: |
| 950 | * - never a valid value for an RSA parameter |
| 951 | * - interpreted as "omitted, please reconstruct" by mbedtls_rsa_complete(). |
| 952 | * |
| 953 | * Since values can't be omitted in PKCS#1, passing a zero value to |
| 954 | * rsa_complete() would be incorrect, so reject zero values early. |
| 955 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 956 | static int asn1_get_nonzero_mpi(unsigned char **p, |
| 957 | const unsigned char *end, |
| 958 | mbedtls_mpi *X) |
Manuel Pégourié-Gonnard | a04a2c3 | 2020-02-18 10:12:14 +0100 | [diff] [blame] | 959 | { |
| 960 | int ret; |
| 961 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 962 | ret = mbedtls_asn1_get_mpi(p, end, X); |
| 963 | if (ret != 0) { |
| 964 | return ret; |
| 965 | } |
Manuel Pégourié-Gonnard | a04a2c3 | 2020-02-18 10:12:14 +0100 | [diff] [blame] | 966 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 967 | if (mbedtls_mpi_cmp_int(X, 0) == 0) { |
| 968 | return MBEDTLS_ERR_PK_KEY_INVALID_FORMAT; |
| 969 | } |
Manuel Pégourié-Gonnard | a04a2c3 | 2020-02-18 10:12:14 +0100 | [diff] [blame] | 970 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 971 | return 0; |
Manuel Pégourié-Gonnard | a04a2c3 | 2020-02-18 10:12:14 +0100 | [diff] [blame] | 972 | } |
| 973 | |
| 974 | /* |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 975 | * Parse a PKCS#1 encoded private RSA key |
| 976 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 977 | static int pk_parse_key_pkcs1_der(mbedtls_rsa_context *rsa, |
| 978 | const unsigned char *key, |
| 979 | size_t keylen) |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 980 | { |
Hanno Becker | d58c5b2 | 2017-08-22 14:33:21 +0100 | [diff] [blame] | 981 | int ret, version; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 982 | size_t len; |
| 983 | unsigned char *p, *end; |
| 984 | |
Hanno Becker | efa14e8 | 2017-10-11 19:45:19 +0100 | [diff] [blame] | 985 | mbedtls_mpi T; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 986 | mbedtls_mpi_init(&T); |
Hanno Becker | d58c5b2 | 2017-08-22 14:33:21 +0100 | [diff] [blame] | 987 | |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 988 | p = (unsigned char *) key; |
| 989 | end = p + keylen; |
| 990 | |
| 991 | /* |
| 992 | * This function parses the RSAPrivateKey (PKCS#1) |
| 993 | * |
| 994 | * RSAPrivateKey ::= SEQUENCE { |
| 995 | * version Version, |
| 996 | * modulus INTEGER, -- n |
| 997 | * publicExponent INTEGER, -- e |
| 998 | * privateExponent INTEGER, -- d |
| 999 | * prime1 INTEGER, -- p |
| 1000 | * prime2 INTEGER, -- q |
| 1001 | * exponent1 INTEGER, -- d mod (p-1) |
| 1002 | * exponent2 INTEGER, -- d mod (q-1) |
| 1003 | * coefficient INTEGER, -- (inverse of q) mod p |
| 1004 | * otherPrimeInfos OtherPrimeInfos OPTIONAL |
| 1005 | * } |
| 1006 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1007 | if ((ret = mbedtls_asn1_get_tag(&p, end, &len, |
| 1008 | MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) { |
| 1009 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret); |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1010 | } |
| 1011 | |
| 1012 | end = p + len; |
| 1013 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1014 | if ((ret = mbedtls_asn1_get_int(&p, end, &version)) != 0) { |
| 1015 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret); |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1016 | } |
| 1017 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1018 | if (version != 0) { |
| 1019 | return MBEDTLS_ERR_PK_KEY_INVALID_VERSION; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1020 | } |
| 1021 | |
Hanno Becker | d58c5b2 | 2017-08-22 14:33:21 +0100 | [diff] [blame] | 1022 | /* Import N */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1023 | if ((ret = asn1_get_nonzero_mpi(&p, end, &T)) != 0 || |
| 1024 | (ret = mbedtls_rsa_import(rsa, &T, NULL, NULL, |
| 1025 | NULL, NULL)) != 0) { |
Hanno Becker | d58c5b2 | 2017-08-22 14:33:21 +0100 | [diff] [blame] | 1026 | goto cleanup; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1027 | } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1028 | |
Hanno Becker | d58c5b2 | 2017-08-22 14:33:21 +0100 | [diff] [blame] | 1029 | /* Import E */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1030 | if ((ret = asn1_get_nonzero_mpi(&p, end, &T)) != 0 || |
| 1031 | (ret = mbedtls_rsa_import(rsa, NULL, NULL, NULL, |
| 1032 | NULL, &T)) != 0) { |
Hanno Becker | d58c5b2 | 2017-08-22 14:33:21 +0100 | [diff] [blame] | 1033 | goto cleanup; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1034 | } |
Hanno Becker | d58c5b2 | 2017-08-22 14:33:21 +0100 | [diff] [blame] | 1035 | |
| 1036 | /* Import D */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1037 | if ((ret = asn1_get_nonzero_mpi(&p, end, &T)) != 0 || |
| 1038 | (ret = mbedtls_rsa_import(rsa, NULL, NULL, NULL, |
| 1039 | &T, NULL)) != 0) { |
Hanno Becker | d58c5b2 | 2017-08-22 14:33:21 +0100 | [diff] [blame] | 1040 | goto cleanup; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1041 | } |
Hanno Becker | d58c5b2 | 2017-08-22 14:33:21 +0100 | [diff] [blame] | 1042 | |
| 1043 | /* Import P */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1044 | if ((ret = asn1_get_nonzero_mpi(&p, end, &T)) != 0 || |
| 1045 | (ret = mbedtls_rsa_import(rsa, NULL, &T, NULL, |
| 1046 | NULL, NULL)) != 0) { |
Hanno Becker | d58c5b2 | 2017-08-22 14:33:21 +0100 | [diff] [blame] | 1047 | goto cleanup; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1048 | } |
Hanno Becker | d58c5b2 | 2017-08-22 14:33:21 +0100 | [diff] [blame] | 1049 | |
| 1050 | /* Import Q */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1051 | if ((ret = asn1_get_nonzero_mpi(&p, end, &T)) != 0 || |
| 1052 | (ret = mbedtls_rsa_import(rsa, NULL, NULL, &T, |
| 1053 | NULL, NULL)) != 0) { |
Hanno Becker | d58c5b2 | 2017-08-22 14:33:21 +0100 | [diff] [blame] | 1054 | goto cleanup; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1055 | } |
Hanno Becker | d58c5b2 | 2017-08-22 14:33:21 +0100 | [diff] [blame] | 1056 | |
Manuel Pégourié-Gonnard | bbb5a0a | 2020-02-18 10:22:54 +0100 | [diff] [blame] | 1057 | #if !defined(MBEDTLS_RSA_NO_CRT) && !defined(MBEDTLS_RSA_ALT) |
Jack Lloyd | 8c2631b | 2020-01-23 17:23:52 -0500 | [diff] [blame] | 1058 | /* |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1059 | * The RSA CRT parameters DP, DQ and QP are nominally redundant, in |
| 1060 | * that they can be easily recomputed from D, P and Q. However by |
| 1061 | * parsing them from the PKCS1 structure it is possible to avoid |
| 1062 | * recalculating them which both reduces the overhead of loading |
| 1063 | * RSA private keys into memory and also avoids side channels which |
| 1064 | * can arise when computing those values, since all of D, P, and Q |
| 1065 | * are secret. See https://eprint.iacr.org/2020/055 for a |
| 1066 | * description of one such attack. |
| 1067 | */ |
Jack Lloyd | 8c2631b | 2020-01-23 17:23:52 -0500 | [diff] [blame] | 1068 | |
Jack Lloyd | 80cc811 | 2020-01-22 17:34:29 -0500 | [diff] [blame] | 1069 | /* Import DP */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1070 | if ((ret = asn1_get_nonzero_mpi(&p, end, &T)) != 0 || |
| 1071 | (ret = mbedtls_mpi_copy(&rsa->DP, &T)) != 0) { |
| 1072 | goto cleanup; |
| 1073 | } |
Jack Lloyd | 80cc811 | 2020-01-22 17:34:29 -0500 | [diff] [blame] | 1074 | |
| 1075 | /* Import DQ */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1076 | if ((ret = asn1_get_nonzero_mpi(&p, end, &T)) != 0 || |
| 1077 | (ret = mbedtls_mpi_copy(&rsa->DQ, &T)) != 0) { |
| 1078 | goto cleanup; |
| 1079 | } |
Jack Lloyd | 80cc811 | 2020-01-22 17:34:29 -0500 | [diff] [blame] | 1080 | |
| 1081 | /* Import QP */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1082 | if ((ret = asn1_get_nonzero_mpi(&p, end, &T)) != 0 || |
| 1083 | (ret = mbedtls_mpi_copy(&rsa->QP, &T)) != 0) { |
| 1084 | goto cleanup; |
| 1085 | } |
Jack Lloyd | 2e9eef4 | 2020-01-28 14:43:52 -0500 | [diff] [blame] | 1086 | |
Jack Lloyd | 6023975 | 2020-01-27 17:53:36 -0500 | [diff] [blame] | 1087 | #else |
Shaun Case | 8b0ecbc | 2021-12-20 21:14:10 -0800 | [diff] [blame] | 1088 | /* Verify existence of the CRT params */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1089 | if ((ret = asn1_get_nonzero_mpi(&p, end, &T)) != 0 || |
| 1090 | (ret = asn1_get_nonzero_mpi(&p, end, &T)) != 0 || |
| 1091 | (ret = asn1_get_nonzero_mpi(&p, end, &T)) != 0) { |
| 1092 | goto cleanup; |
| 1093 | } |
Jack Lloyd | 6023975 | 2020-01-27 17:53:36 -0500 | [diff] [blame] | 1094 | #endif |
Jack Lloyd | 80cc811 | 2020-01-22 17:34:29 -0500 | [diff] [blame] | 1095 | |
Manuel Pégourié-Gonnard | c422679 | 2020-02-14 11:28:47 +0100 | [diff] [blame] | 1096 | /* rsa_complete() doesn't complete anything with the default |
| 1097 | * implementation but is still called: |
| 1098 | * - for the benefit of alternative implementation that may want to |
| 1099 | * pre-compute stuff beyond what's provided (eg Montgomery factors) |
| 1100 | * - as is also sanity-checks the key |
| 1101 | * |
| 1102 | * Furthermore, we also check the public part for consistency with |
| 1103 | * mbedtls_pk_parse_pubkey(), as it includes size minima for example. |
| 1104 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1105 | if ((ret = mbedtls_rsa_complete(rsa)) != 0 || |
| 1106 | (ret = mbedtls_rsa_check_pubkey(rsa)) != 0) { |
Hanno Becker | d58c5b2 | 2017-08-22 14:33:21 +0100 | [diff] [blame] | 1107 | goto cleanup; |
Manuel Pégourié-Gonnard | c422679 | 2020-02-14 11:28:47 +0100 | [diff] [blame] | 1108 | } |
Hanno Becker | d58c5b2 | 2017-08-22 14:33:21 +0100 | [diff] [blame] | 1109 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1110 | if (p != end) { |
| 1111 | ret = MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, |
| 1112 | MBEDTLS_ERR_ASN1_LENGTH_MISMATCH); |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1113 | } |
| 1114 | |
Hanno Becker | d58c5b2 | 2017-08-22 14:33:21 +0100 | [diff] [blame] | 1115 | cleanup: |
| 1116 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1117 | mbedtls_mpi_free(&T); |
Hanno Becker | d58c5b2 | 2017-08-22 14:33:21 +0100 | [diff] [blame] | 1118 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1119 | if (ret != 0) { |
Hanno Becker | efa14e8 | 2017-10-11 19:45:19 +0100 | [diff] [blame] | 1120 | /* Wrap error code if it's coming from a lower level */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1121 | if ((ret & 0xff80) == 0) { |
| 1122 | ret = MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret); |
| 1123 | } else { |
Hanno Becker | d58c5b2 | 2017-08-22 14:33:21 +0100 | [diff] [blame] | 1124 | ret = MBEDTLS_ERR_PK_KEY_INVALID_FORMAT; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1125 | } |
Hanno Becker | d58c5b2 | 2017-08-22 14:33:21 +0100 | [diff] [blame] | 1126 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1127 | mbedtls_rsa_free(rsa); |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1128 | } |
| 1129 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1130 | return ret; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1131 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1132 | #endif /* MBEDTLS_RSA_C */ |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1133 | |
Valerio Setti | 81d7512 | 2023-06-14 14:49:33 +0200 | [diff] [blame] | 1134 | #if defined(MBEDTLS_PK_HAVE_ECC_KEYS) |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1135 | /* |
| 1136 | * Parse a SEC1 encoded private EC key |
| 1137 | */ |
Valerio Setti | 4064dbb | 2023-05-17 15:33:07 +0200 | [diff] [blame] | 1138 | static int pk_parse_key_sec1_der(mbedtls_pk_context *pk, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1139 | const unsigned char *key, size_t keylen, |
| 1140 | int (*f_rng)(void *, unsigned char *, size_t), void *p_rng) |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1141 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 1142 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 1143 | int version, pubkey_done; |
Jethro Beekman | 0167244 | 2023-04-19 14:08:14 +0200 | [diff] [blame] | 1144 | size_t len, d_len; |
Leonid Rozenboim | a3008e7 | 2022-04-21 17:28:18 -0700 | [diff] [blame] | 1145 | mbedtls_asn1_buf params = { 0, 0, NULL }; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1146 | unsigned char *p = (unsigned char *) key; |
Jethro Beekman | 0167244 | 2023-04-19 14:08:14 +0200 | [diff] [blame] | 1147 | unsigned char *d; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1148 | unsigned char *end = p + keylen; |
| 1149 | unsigned char *end2; |
Valerio Setti | 00e8dd1 | 2023-05-18 18:56:59 +0200 | [diff] [blame] | 1150 | #if defined(MBEDTLS_PK_USE_PSA_EC_DATA) |
| 1151 | psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; |
| 1152 | psa_status_t status; |
Valerio Setti | 81d7512 | 2023-06-14 14:49:33 +0200 | [diff] [blame] | 1153 | #else /* MBEDTLS_PK_USE_PSA_EC_DATA */ |
| 1154 | mbedtls_ecp_keypair *eck = mbedtls_pk_ec_rw(*pk); |
Valerio Setti | 00e8dd1 | 2023-05-18 18:56:59 +0200 | [diff] [blame] | 1155 | #endif /* MBEDTLS_PK_USE_PSA_EC_DATA */ |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1156 | |
| 1157 | /* |
| 1158 | * RFC 5915, or SEC1 Appendix C.4 |
| 1159 | * |
| 1160 | * ECPrivateKey ::= SEQUENCE { |
| 1161 | * version INTEGER { ecPrivkeyVer1(1) } (ecPrivkeyVer1), |
| 1162 | * privateKey OCTET STRING, |
| 1163 | * parameters [0] ECParameters {{ NamedCurve }} OPTIONAL, |
| 1164 | * publicKey [1] BIT STRING OPTIONAL |
| 1165 | * } |
| 1166 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1167 | if ((ret = mbedtls_asn1_get_tag(&p, end, &len, |
| 1168 | MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) { |
| 1169 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret); |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1170 | } |
| 1171 | |
| 1172 | end = p + len; |
| 1173 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1174 | if ((ret = mbedtls_asn1_get_int(&p, end, &version)) != 0) { |
| 1175 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret); |
| 1176 | } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1177 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1178 | if (version != 1) { |
| 1179 | return MBEDTLS_ERR_PK_KEY_INVALID_VERSION; |
| 1180 | } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1181 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1182 | if ((ret = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_OCTET_STRING)) != 0) { |
| 1183 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret); |
| 1184 | } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1185 | |
Valerio Setti | 6b062ee | 2023-06-30 17:32:57 +0200 | [diff] [blame] | 1186 | /* Keep a reference to the position fo the private key. It will be used |
| 1187 | * later in this function. */ |
Jethro Beekman | 0167244 | 2023-04-19 14:08:14 +0200 | [diff] [blame] | 1188 | d = p; |
| 1189 | d_len = len; |
Valerio Setti | 00e8dd1 | 2023-05-18 18:56:59 +0200 | [diff] [blame] | 1190 | |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1191 | p += len; |
| 1192 | |
Manuel Pégourié-Gonnard | 924cd10 | 2015-04-14 11:18:04 +0200 | [diff] [blame] | 1193 | pubkey_done = 0; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1194 | if (p != end) { |
Manuel Pégourié-Gonnard | 924cd10 | 2015-04-14 11:18:04 +0200 | [diff] [blame] | 1195 | /* |
| 1196 | * Is 'parameters' present? |
| 1197 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1198 | if ((ret = mbedtls_asn1_get_tag(&p, end, &len, |
| 1199 | MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | |
| 1200 | 0)) == 0) { |
| 1201 | if ((ret = pk_get_ecparams(&p, p + len, ¶ms)) != 0 || |
Valerio Setti | 4064dbb | 2023-05-17 15:33:07 +0200 | [diff] [blame] | 1202 | (ret = pk_use_ecparams(¶ms, pk)) != 0) { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1203 | return ret; |
Manuel Pégourié-Gonnard | 924cd10 | 2015-04-14 11:18:04 +0200 | [diff] [blame] | 1204 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1205 | } else if (ret != MBEDTLS_ERR_ASN1_UNEXPECTED_TAG) { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1206 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret); |
Manuel Pégourié-Gonnard | 5246ee5 | 2014-03-19 16:18:38 +0100 | [diff] [blame] | 1207 | } |
Jethro Beekman | d2df936 | 2018-02-16 13:11:04 -0800 | [diff] [blame] | 1208 | } |
Manuel Pégourié-Gonnard | 924cd10 | 2015-04-14 11:18:04 +0200 | [diff] [blame] | 1209 | |
Valerio Setti | 6b062ee | 2023-06-30 17:32:57 +0200 | [diff] [blame] | 1210 | |
| 1211 | #if !defined(MBEDTLS_PK_USE_PSA_EC_DATA) |
| 1212 | if ((ret = mbedtls_ecp_read_key(eck->grp.id, eck, d, d_len)) != 0) { |
| 1213 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret); |
| 1214 | } |
| 1215 | #endif |
| 1216 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1217 | if (p != end) { |
Manuel Pégourié-Gonnard | 924cd10 | 2015-04-14 11:18:04 +0200 | [diff] [blame] | 1218 | /* |
| 1219 | * Is 'publickey' present? If not, or if we can't read it (eg because it |
| 1220 | * is compressed), create it from the private key. |
| 1221 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1222 | if ((ret = mbedtls_asn1_get_tag(&p, end, &len, |
| 1223 | MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | |
| 1224 | 1)) == 0) { |
Manuel Pégourié-Gonnard | 924cd10 | 2015-04-14 11:18:04 +0200 | [diff] [blame] | 1225 | end2 = p + len; |
| 1226 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1227 | if ((ret = mbedtls_asn1_get_bitstring_null(&p, end2, &len)) != 0) { |
| 1228 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret); |
| 1229 | } |
Manuel Pégourié-Gonnard | 924cd10 | 2015-04-14 11:18:04 +0200 | [diff] [blame] | 1230 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1231 | if (p + len != end2) { |
| 1232 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, |
| 1233 | MBEDTLS_ERR_ASN1_LENGTH_MISMATCH); |
| 1234 | } |
Manuel Pégourié-Gonnard | 924cd10 | 2015-04-14 11:18:04 +0200 | [diff] [blame] | 1235 | |
Valerio Setti | 4064dbb | 2023-05-17 15:33:07 +0200 | [diff] [blame] | 1236 | if ((ret = pk_get_ecpubkey(&p, end2, pk)) == 0) { |
Manuel Pégourié-Gonnard | 924cd10 | 2015-04-14 11:18:04 +0200 | [diff] [blame] | 1237 | pubkey_done = 1; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1238 | } else { |
Manuel Pégourié-Gonnard | 924cd10 | 2015-04-14 11:18:04 +0200 | [diff] [blame] | 1239 | /* |
| 1240 | * The only acceptable failure mode of pk_get_ecpubkey() above |
| 1241 | * is if the point format is not recognized. |
| 1242 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1243 | if (ret != MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE) { |
| 1244 | return MBEDTLS_ERR_PK_KEY_INVALID_FORMAT; |
| 1245 | } |
Manuel Pégourié-Gonnard | 924cd10 | 2015-04-14 11:18:04 +0200 | [diff] [blame] | 1246 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1247 | } else if (ret != MBEDTLS_ERR_ASN1_UNEXPECTED_TAG) { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1248 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret); |
Manuel Pégourié-Gonnard | 924cd10 | 2015-04-14 11:18:04 +0200 | [diff] [blame] | 1249 | } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1250 | } |
Manuel Pégourié-Gonnard | eab20d2 | 2014-03-14 17:58:42 +0100 | [diff] [blame] | 1251 | |
Valerio Setti | 00e8dd1 | 2023-05-18 18:56:59 +0200 | [diff] [blame] | 1252 | #if defined(MBEDTLS_PK_USE_PSA_EC_DATA) |
| 1253 | psa_set_key_type(&attributes, PSA_KEY_TYPE_ECC_KEY_PAIR(pk->ec_family)); |
| 1254 | /* Setting largest masks for usage and key algorithms */ |
| 1255 | psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_HASH | |
| 1256 | PSA_KEY_USAGE_SIGN_MESSAGE | |
Valerio Setti | 51aa52e | 2023-05-24 12:37:50 +0200 | [diff] [blame] | 1257 | PSA_KEY_USAGE_EXPORT | PSA_KEY_USAGE_DERIVE); |
Valerio Setti | 00e8dd1 | 2023-05-18 18:56:59 +0200 | [diff] [blame] | 1258 | #if defined(MBEDTLS_ECDSA_DETERMINISTIC) |
| 1259 | psa_set_key_algorithm(&attributes, |
| 1260 | PSA_ALG_DETERMINISTIC_ECDSA(PSA_ALG_ANY_HASH)); |
| 1261 | #else |
| 1262 | psa_set_key_algorithm(&attributes, PSA_ALG_ECDSA(PSA_ALG_ANY_HASH)); |
| 1263 | #endif |
Valerio Setti | 51aa52e | 2023-05-24 12:37:50 +0200 | [diff] [blame] | 1264 | psa_set_key_enrollment_algorithm(&attributes, PSA_ALG_ECDH); |
Valerio Setti | 00e8dd1 | 2023-05-18 18:56:59 +0200 | [diff] [blame] | 1265 | |
Valerio Setti | a541e01 | 2023-05-24 14:31:21 +0200 | [diff] [blame] | 1266 | status = psa_import_key(&attributes, d, d_len, &pk->priv_id); |
Valerio Setti | 00e8dd1 | 2023-05-18 18:56:59 +0200 | [diff] [blame] | 1267 | if (status != PSA_SUCCESS) { |
| 1268 | ret = psa_pk_status_to_mbedtls(status); |
| 1269 | return ret; |
| 1270 | } |
| 1271 | #endif /* MBEDTLS_PK_USE_PSA_EC_DATA */ |
| 1272 | |
Valerio Setti | 34f6755 | 2023-04-03 15:19:18 +0200 | [diff] [blame] | 1273 | if (!pubkey_done) { |
Valerio Setti | 4064dbb | 2023-05-17 15:33:07 +0200 | [diff] [blame] | 1274 | if ((ret = pk_derive_public_key(pk, d, d_len, f_rng, p_rng)) != 0) { |
Valerio Setti | 520c038 | 2023-04-07 11:38:09 +0200 | [diff] [blame] | 1275 | return ret; |
Valerio Setti | 34f6755 | 2023-04-03 15:19:18 +0200 | [diff] [blame] | 1276 | } |
Manuel Pégourié-Gonnard | ff29f9c | 2013-09-18 16:13:02 +0200 | [diff] [blame] | 1277 | } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1278 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1279 | return 0; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1280 | } |
Valerio Setti | 81d7512 | 2023-06-14 14:49:33 +0200 | [diff] [blame] | 1281 | #endif /* MBEDTLS_PK_HAVE_ECC_KEYS */ |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1282 | |
| 1283 | /* |
| 1284 | * Parse an unencrypted PKCS#8 encoded private key |
Hanno Becker | b427421 | 2017-09-29 19:18:51 +0100 | [diff] [blame] | 1285 | * |
| 1286 | * Notes: |
| 1287 | * |
| 1288 | * - This function does not own the key buffer. It is the |
| 1289 | * responsibility of the caller to take care of zeroizing |
| 1290 | * and freeing it after use. |
| 1291 | * |
| 1292 | * - The function is responsible for freeing the provided |
| 1293 | * PK context on failure. |
| 1294 | * |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1295 | */ |
| 1296 | static int pk_parse_key_pkcs8_unencrypted_der( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1297 | mbedtls_pk_context *pk, |
| 1298 | const unsigned char *key, size_t keylen, |
| 1299 | int (*f_rng)(void *, unsigned char *, size_t), void *p_rng) |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1300 | { |
| 1301 | int ret, version; |
| 1302 | size_t len; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1303 | mbedtls_asn1_buf params; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1304 | unsigned char *p = (unsigned char *) key; |
| 1305 | unsigned char *end = p + keylen; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1306 | mbedtls_pk_type_t pk_alg = MBEDTLS_PK_NONE; |
Jethro Beekman | 0167244 | 2023-04-19 14:08:14 +0200 | [diff] [blame] | 1307 | mbedtls_ecp_group_id ec_grp_id = MBEDTLS_ECP_DP_NONE; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1308 | const mbedtls_pk_info_t *pk_info; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1309 | |
Valerio Setti | 81d7512 | 2023-06-14 14:49:33 +0200 | [diff] [blame] | 1310 | #if !defined(MBEDTLS_PK_HAVE_ECC_KEYS) |
Manuel Pégourié-Gonnard | 609ab64 | 2021-06-16 14:29:11 +0200 | [diff] [blame] | 1311 | (void) f_rng; |
| 1312 | (void) p_rng; |
| 1313 | #endif |
| 1314 | |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1315 | /* |
Hanno Becker | 9c6cb38 | 2017-09-05 10:08:01 +0100 | [diff] [blame] | 1316 | * This function parses the PrivateKeyInfo object (PKCS#8 v1.2 = RFC 5208) |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1317 | * |
| 1318 | * PrivateKeyInfo ::= SEQUENCE { |
| 1319 | * version Version, |
| 1320 | * privateKeyAlgorithm PrivateKeyAlgorithmIdentifier, |
| 1321 | * privateKey PrivateKey, |
| 1322 | * attributes [0] IMPLICIT Attributes OPTIONAL } |
| 1323 | * |
| 1324 | * Version ::= INTEGER |
| 1325 | * PrivateKeyAlgorithmIdentifier ::= AlgorithmIdentifier |
| 1326 | * PrivateKey ::= OCTET STRING |
| 1327 | * |
| 1328 | * The PrivateKey OCTET STRING is a SEC1 ECPrivateKey |
| 1329 | */ |
| 1330 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1331 | if ((ret = mbedtls_asn1_get_tag(&p, end, &len, |
| 1332 | MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) { |
| 1333 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret); |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1334 | } |
| 1335 | |
| 1336 | end = p + len; |
| 1337 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1338 | if ((ret = mbedtls_asn1_get_int(&p, end, &version)) != 0) { |
| 1339 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret); |
Chris Jones | fdb588b | 2021-04-14 18:15:24 +0100 | [diff] [blame] | 1340 | } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1341 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1342 | if (version != 0) { |
| 1343 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_VERSION, ret); |
| 1344 | } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1345 | |
Jethro Beekman | 0167244 | 2023-04-19 14:08:14 +0200 | [diff] [blame] | 1346 | if ((ret = pk_get_pk_alg(&p, end, &pk_alg, ¶ms, &ec_grp_id)) != 0) { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1347 | return ret; |
| 1348 | } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1349 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1350 | if ((ret = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_OCTET_STRING)) != 0) { |
| 1351 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret); |
| 1352 | } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1353 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1354 | if (len < 1) { |
| 1355 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, |
| 1356 | MBEDTLS_ERR_ASN1_OUT_OF_DATA); |
| 1357 | } |
| 1358 | |
| 1359 | if ((pk_info = mbedtls_pk_info_from_type(pk_alg)) == NULL) { |
| 1360 | return MBEDTLS_ERR_PK_UNKNOWN_PK_ALG; |
| 1361 | } |
| 1362 | |
| 1363 | if ((ret = mbedtls_pk_setup(pk, pk_info)) != 0) { |
| 1364 | return ret; |
| 1365 | } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1366 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1367 | #if defined(MBEDTLS_RSA_C) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1368 | if (pk_alg == MBEDTLS_PK_RSA) { |
| 1369 | if ((ret = pk_parse_key_pkcs1_der(mbedtls_pk_rsa(*pk), p, len)) != 0) { |
| 1370 | mbedtls_pk_free(pk); |
| 1371 | return ret; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1372 | } |
| 1373 | } else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1374 | #endif /* MBEDTLS_RSA_C */ |
Valerio Setti | 81d7512 | 2023-06-14 14:49:33 +0200 | [diff] [blame] | 1375 | #if defined(MBEDTLS_PK_HAVE_ECC_KEYS) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1376 | if (pk_alg == MBEDTLS_PK_ECKEY || pk_alg == MBEDTLS_PK_ECKEY_DH) { |
Jethro Beekman | 0167244 | 2023-04-19 14:08:14 +0200 | [diff] [blame] | 1377 | #if defined(MBEDTLS_PK_HAVE_RFC8410_CURVES) |
Valerio Setti | 00e8dd1 | 2023-05-18 18:56:59 +0200 | [diff] [blame] | 1378 | if (MBEDTLS_PK_IS_RFC8410_GROUP_ID(ec_grp_id)) { |
Valerio Setti | 4064dbb | 2023-05-17 15:33:07 +0200 | [diff] [blame] | 1379 | if ((ret = |
| 1380 | pk_use_ecparams_rfc8410(¶ms, ec_grp_id, pk)) != 0 || |
Jethro Beekman | 0167244 | 2023-04-19 14:08:14 +0200 | [diff] [blame] | 1381 | (ret = |
Valerio Setti | 4064dbb | 2023-05-17 15:33:07 +0200 | [diff] [blame] | 1382 | pk_parse_key_rfc8410_der(pk, p, len, end, f_rng, |
Jethro Beekman | 0167244 | 2023-04-19 14:08:14 +0200 | [diff] [blame] | 1383 | p_rng)) != 0) { |
| 1384 | mbedtls_pk_free(pk); |
| 1385 | return ret; |
| 1386 | } |
| 1387 | } else |
| 1388 | #endif |
| 1389 | { |
Valerio Setti | 4064dbb | 2023-05-17 15:33:07 +0200 | [diff] [blame] | 1390 | if ((ret = pk_use_ecparams(¶ms, pk)) != 0 || |
| 1391 | (ret = pk_parse_key_sec1_der(pk, p, len, f_rng, p_rng)) != 0) { |
Jethro Beekman | 0167244 | 2023-04-19 14:08:14 +0200 | [diff] [blame] | 1392 | mbedtls_pk_free(pk); |
| 1393 | return ret; |
| 1394 | } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1395 | } |
| 1396 | } else |
Valerio Setti | 81d7512 | 2023-06-14 14:49:33 +0200 | [diff] [blame] | 1397 | #endif /* MBEDTLS_PK_HAVE_ECC_KEYS */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1398 | return MBEDTLS_ERR_PK_UNKNOWN_PK_ALG; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1399 | |
Waleed Elmelegy | c9f4040 | 2023-08-08 15:28:15 +0100 | [diff] [blame] | 1400 | end = p + len; |
| 1401 | if (end != (key + keylen)) { |
| 1402 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, |
| 1403 | MBEDTLS_ERR_ASN1_LENGTH_MISMATCH); |
| 1404 | } |
Waleed Elmelegy | d527896 | 2023-09-12 14:42:49 +0100 | [diff] [blame] | 1405 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1406 | return 0; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1407 | } |
| 1408 | |
| 1409 | /* |
| 1410 | * Parse an encrypted PKCS#8 encoded private key |
Hanno Becker | b427421 | 2017-09-29 19:18:51 +0100 | [diff] [blame] | 1411 | * |
| 1412 | * To save space, the decryption happens in-place on the given key buffer. |
| 1413 | * Also, while this function may modify the keybuffer, it doesn't own it, |
| 1414 | * and instead it is the responsibility of the caller to zeroize and properly |
| 1415 | * free it after use. |
| 1416 | * |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1417 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1418 | #if defined(MBEDTLS_PKCS12_C) || defined(MBEDTLS_PKCS5_C) |
Waleed Elmelegy | 1db5cda | 2023-09-20 18:00:48 +0100 | [diff] [blame] | 1419 | MBEDTLS_STATIC_TESTABLE int mbedtls_pk_parse_key_pkcs8_encrypted_der( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1420 | mbedtls_pk_context *pk, |
| 1421 | unsigned char *key, size_t keylen, |
| 1422 | const unsigned char *pwd, size_t pwdlen, |
| 1423 | int (*f_rng)(void *, unsigned char *, size_t), void *p_rng) |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1424 | { |
Paul Bakker | f4cf80b | 2014-04-17 17:19:56 +0200 | [diff] [blame] | 1425 | int ret, decrypted = 0; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1426 | size_t len; |
Hanno Becker | fab3569 | 2017-08-25 13:38:26 +0100 | [diff] [blame] | 1427 | unsigned char *buf; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1428 | unsigned char *p, *end; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1429 | mbedtls_asn1_buf pbe_alg_oid, pbe_params; |
| 1430 | #if defined(MBEDTLS_PKCS12_C) |
| 1431 | mbedtls_cipher_type_t cipher_alg; |
| 1432 | mbedtls_md_type_t md_alg; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1433 | #endif |
Waleed Elmelegy | c9f4040 | 2023-08-08 15:28:15 +0100 | [diff] [blame] | 1434 | size_t outlen = 0; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1435 | |
Hanno Becker | 2aa80a7 | 2017-09-07 15:28:45 +0100 | [diff] [blame] | 1436 | p = key; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1437 | end = p + keylen; |
| 1438 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1439 | if (pwdlen == 0) { |
| 1440 | return MBEDTLS_ERR_PK_PASSWORD_REQUIRED; |
| 1441 | } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1442 | |
| 1443 | /* |
Hanno Becker | f04111f | 2017-09-29 19:18:42 +0100 | [diff] [blame] | 1444 | * This function parses the EncryptedPrivateKeyInfo object (PKCS#8) |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1445 | * |
| 1446 | * EncryptedPrivateKeyInfo ::= SEQUENCE { |
| 1447 | * encryptionAlgorithm EncryptionAlgorithmIdentifier, |
| 1448 | * encryptedData EncryptedData |
| 1449 | * } |
| 1450 | * |
| 1451 | * EncryptionAlgorithmIdentifier ::= AlgorithmIdentifier |
| 1452 | * |
| 1453 | * EncryptedData ::= OCTET STRING |
| 1454 | * |
| 1455 | * The EncryptedData OCTET STRING is a PKCS#8 PrivateKeyInfo |
Hanno Becker | b8d1657 | 2017-09-07 15:29:01 +0100 | [diff] [blame] | 1456 | * |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1457 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1458 | if ((ret = mbedtls_asn1_get_tag(&p, end, &len, |
| 1459 | MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) { |
| 1460 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret); |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1461 | } |
| 1462 | |
| 1463 | end = p + len; |
| 1464 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1465 | if ((ret = mbedtls_asn1_get_alg(&p, end, &pbe_alg_oid, &pbe_params)) != 0) { |
| 1466 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret); |
| 1467 | } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1468 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1469 | if ((ret = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_OCTET_STRING)) != 0) { |
| 1470 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret); |
| 1471 | } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1472 | |
Hanno Becker | fab3569 | 2017-08-25 13:38:26 +0100 | [diff] [blame] | 1473 | buf = p; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1474 | |
| 1475 | /* |
Hanno Becker | b8d1657 | 2017-09-07 15:29:01 +0100 | [diff] [blame] | 1476 | * Decrypt EncryptedData with appropriate PBE |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1477 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1478 | #if defined(MBEDTLS_PKCS12_C) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1479 | if (mbedtls_oid_get_pkcs12_pbe_alg(&pbe_alg_oid, &md_alg, &cipher_alg) == 0) { |
Waleed Elmelegy | d527896 | 2023-09-12 14:42:49 +0100 | [diff] [blame] | 1480 | if ((ret = mbedtls_pkcs12_pbe_ext(&pbe_params, MBEDTLS_PKCS12_PBE_DECRYPT, |
Waleed Elmelegy | 5e48cad | 2023-09-12 14:52:48 +0100 | [diff] [blame] | 1481 | cipher_alg, md_alg, |
| 1482 | pwd, pwdlen, p, len, buf, len, &outlen)) != 0) { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1483 | if (ret == MBEDTLS_ERR_PKCS12_PASSWORD_MISMATCH) { |
| 1484 | return MBEDTLS_ERR_PK_PASSWORD_MISMATCH; |
| 1485 | } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1486 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1487 | return ret; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1488 | } |
Waleed Elmelegy | d527896 | 2023-09-12 14:42:49 +0100 | [diff] [blame] | 1489 | |
Paul Bakker | f4cf80b | 2014-04-17 17:19:56 +0200 | [diff] [blame] | 1490 | decrypted = 1; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1491 | } else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1492 | #endif /* MBEDTLS_PKCS12_C */ |
| 1493 | #if defined(MBEDTLS_PKCS5_C) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1494 | if (MBEDTLS_OID_CMP(MBEDTLS_OID_PKCS5_PBES2, &pbe_alg_oid) == 0) { |
Waleed Elmelegy | c9f4040 | 2023-08-08 15:28:15 +0100 | [diff] [blame] | 1495 | if ((ret = mbedtls_pkcs5_pbes2_ext(&pbe_params, MBEDTLS_PKCS5_DECRYPT, pwd, pwdlen, |
| 1496 | p, len, buf, len, &outlen)) != 0) { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1497 | if (ret == MBEDTLS_ERR_PKCS5_PASSWORD_MISMATCH) { |
| 1498 | return MBEDTLS_ERR_PK_PASSWORD_MISMATCH; |
| 1499 | } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1500 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1501 | return ret; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1502 | } |
Paul Bakker | f4cf80b | 2014-04-17 17:19:56 +0200 | [diff] [blame] | 1503 | |
| 1504 | decrypted = 1; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1505 | } else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1506 | #endif /* MBEDTLS_PKCS5_C */ |
Manuel Pégourié-Gonnard | 1032c1d | 2013-09-18 17:18:34 +0200 | [diff] [blame] | 1507 | { |
| 1508 | ((void) pwd); |
Manuel Pégourié-Gonnard | 1032c1d | 2013-09-18 17:18:34 +0200 | [diff] [blame] | 1509 | } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1510 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1511 | if (decrypted == 0) { |
| 1512 | return MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE; |
| 1513 | } |
Waleed Elmelegy | c9f4040 | 2023-08-08 15:28:15 +0100 | [diff] [blame] | 1514 | return pk_parse_key_pkcs8_unencrypted_der(pk, buf, outlen, f_rng, p_rng); |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1515 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1516 | #endif /* MBEDTLS_PKCS12_C || MBEDTLS_PKCS5_C */ |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1517 | |
| 1518 | /* |
| 1519 | * Parse a private key |
| 1520 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1521 | int mbedtls_pk_parse_key(mbedtls_pk_context *pk, |
| 1522 | const unsigned char *key, size_t keylen, |
| 1523 | const unsigned char *pwd, size_t pwdlen, |
| 1524 | int (*f_rng)(void *, unsigned char *, size_t), void *p_rng) |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1525 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 1526 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1527 | const mbedtls_pk_info_t *pk_info; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1528 | #if defined(MBEDTLS_PEM_PARSE_C) |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1529 | size_t len; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1530 | mbedtls_pem_context pem; |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 1531 | #endif |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1532 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1533 | if (keylen == 0) { |
| 1534 | return MBEDTLS_ERR_PK_KEY_INVALID_FORMAT; |
| 1535 | } |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 1536 | |
| 1537 | #if defined(MBEDTLS_PEM_PARSE_C) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1538 | mbedtls_pem_init(&pem); |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1539 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1540 | #if defined(MBEDTLS_RSA_C) |
Manuel Pégourié-Gonnard | 43b37cb | 2015-05-12 11:20:10 +0200 | [diff] [blame] | 1541 | /* Avoid calling mbedtls_pem_read_buffer() on non-null-terminated string */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1542 | if (key[keylen - 1] != '\0') { |
Manuel Pégourié-Gonnard | 43b37cb | 2015-05-12 11:20:10 +0200 | [diff] [blame] | 1543 | ret = MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1544 | } else { |
| 1545 | ret = mbedtls_pem_read_buffer(&pem, |
| 1546 | "-----BEGIN RSA PRIVATE KEY-----", |
| 1547 | "-----END RSA PRIVATE KEY-----", |
| 1548 | key, pwd, pwdlen, &len); |
| 1549 | } |
Manuel Pégourié-Gonnard | 43b37cb | 2015-05-12 11:20:10 +0200 | [diff] [blame] | 1550 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1551 | if (ret == 0) { |
| 1552 | pk_info = mbedtls_pk_info_from_type(MBEDTLS_PK_RSA); |
| 1553 | if ((ret = mbedtls_pk_setup(pk, pk_info)) != 0 || |
| 1554 | (ret = pk_parse_key_pkcs1_der(mbedtls_pk_rsa(*pk), |
| 1555 | pem.buf, pem.buflen)) != 0) { |
| 1556 | mbedtls_pk_free(pk); |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1557 | } |
| 1558 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1559 | mbedtls_pem_free(&pem); |
| 1560 | return ret; |
| 1561 | } else if (ret == MBEDTLS_ERR_PEM_PASSWORD_MISMATCH) { |
| 1562 | return MBEDTLS_ERR_PK_PASSWORD_MISMATCH; |
| 1563 | } else if (ret == MBEDTLS_ERR_PEM_PASSWORD_REQUIRED) { |
| 1564 | return MBEDTLS_ERR_PK_PASSWORD_REQUIRED; |
| 1565 | } else if (ret != MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT) { |
| 1566 | return ret; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1567 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1568 | #endif /* MBEDTLS_RSA_C */ |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1569 | |
Valerio Setti | 81d7512 | 2023-06-14 14:49:33 +0200 | [diff] [blame] | 1570 | #if defined(MBEDTLS_PK_HAVE_ECC_KEYS) |
Manuel Pégourié-Gonnard | 43b37cb | 2015-05-12 11:20:10 +0200 | [diff] [blame] | 1571 | /* Avoid calling mbedtls_pem_read_buffer() on non-null-terminated string */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1572 | if (key[keylen - 1] != '\0') { |
Manuel Pégourié-Gonnard | 43b37cb | 2015-05-12 11:20:10 +0200 | [diff] [blame] | 1573 | ret = MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1574 | } else { |
| 1575 | ret = mbedtls_pem_read_buffer(&pem, |
| 1576 | "-----BEGIN EC PRIVATE KEY-----", |
| 1577 | "-----END EC PRIVATE KEY-----", |
| 1578 | key, pwd, pwdlen, &len); |
| 1579 | } |
| 1580 | if (ret == 0) { |
| 1581 | pk_info = mbedtls_pk_info_from_type(MBEDTLS_PK_ECKEY); |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1582 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1583 | if ((ret = mbedtls_pk_setup(pk, pk_info)) != 0 || |
Valerio Setti | 4064dbb | 2023-05-17 15:33:07 +0200 | [diff] [blame] | 1584 | (ret = pk_parse_key_sec1_der(pk, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1585 | pem.buf, pem.buflen, |
| 1586 | f_rng, p_rng)) != 0) { |
| 1587 | mbedtls_pk_free(pk); |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1588 | } |
| 1589 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1590 | mbedtls_pem_free(&pem); |
| 1591 | return ret; |
| 1592 | } else if (ret == MBEDTLS_ERR_PEM_PASSWORD_MISMATCH) { |
| 1593 | return MBEDTLS_ERR_PK_PASSWORD_MISMATCH; |
| 1594 | } else if (ret == MBEDTLS_ERR_PEM_PASSWORD_REQUIRED) { |
| 1595 | return MBEDTLS_ERR_PK_PASSWORD_REQUIRED; |
| 1596 | } else if (ret != MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT) { |
| 1597 | return ret; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1598 | } |
Valerio Setti | 81d7512 | 2023-06-14 14:49:33 +0200 | [diff] [blame] | 1599 | #endif /* MBEDTLS_PK_HAVE_ECC_KEYS */ |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1600 | |
Manuel Pégourié-Gonnard | 43b37cb | 2015-05-12 11:20:10 +0200 | [diff] [blame] | 1601 | /* Avoid calling mbedtls_pem_read_buffer() on non-null-terminated string */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1602 | if (key[keylen - 1] != '\0') { |
Manuel Pégourié-Gonnard | 43b37cb | 2015-05-12 11:20:10 +0200 | [diff] [blame] | 1603 | ret = MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1604 | } else { |
| 1605 | ret = mbedtls_pem_read_buffer(&pem, |
| 1606 | "-----BEGIN PRIVATE KEY-----", |
| 1607 | "-----END PRIVATE KEY-----", |
| 1608 | key, NULL, 0, &len); |
| 1609 | } |
| 1610 | if (ret == 0) { |
| 1611 | if ((ret = pk_parse_key_pkcs8_unencrypted_der(pk, |
| 1612 | pem.buf, pem.buflen, f_rng, p_rng)) != 0) { |
| 1613 | mbedtls_pk_free(pk); |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1614 | } |
| 1615 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1616 | mbedtls_pem_free(&pem); |
| 1617 | return ret; |
| 1618 | } else if (ret != MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT) { |
| 1619 | return ret; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1620 | } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1621 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1622 | #if defined(MBEDTLS_PKCS12_C) || defined(MBEDTLS_PKCS5_C) |
Manuel Pégourié-Gonnard | 43b37cb | 2015-05-12 11:20:10 +0200 | [diff] [blame] | 1623 | /* Avoid calling mbedtls_pem_read_buffer() on non-null-terminated string */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1624 | if (key[keylen - 1] != '\0') { |
Manuel Pégourié-Gonnard | 43b37cb | 2015-05-12 11:20:10 +0200 | [diff] [blame] | 1625 | ret = MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1626 | } else { |
| 1627 | ret = mbedtls_pem_read_buffer(&pem, |
| 1628 | "-----BEGIN ENCRYPTED PRIVATE KEY-----", |
| 1629 | "-----END ENCRYPTED PRIVATE KEY-----", |
| 1630 | key, NULL, 0, &len); |
| 1631 | } |
| 1632 | if (ret == 0) { |
Waleed Elmelegy | 1db5cda | 2023-09-20 18:00:48 +0100 | [diff] [blame] | 1633 | if ((ret = mbedtls_pk_parse_key_pkcs8_encrypted_der(pk, pem.buf, pem.buflen, |
| 1634 | pwd, pwdlen, f_rng, p_rng)) != 0) { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1635 | mbedtls_pk_free(pk); |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1636 | } |
| 1637 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1638 | mbedtls_pem_free(&pem); |
| 1639 | return ret; |
| 1640 | } else if (ret != MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT) { |
| 1641 | return ret; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1642 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1643 | #endif /* MBEDTLS_PKCS12_C || MBEDTLS_PKCS5_C */ |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1644 | #else |
| 1645 | ((void) pwd); |
| 1646 | ((void) pwdlen); |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1647 | #endif /* MBEDTLS_PEM_PARSE_C */ |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1648 | |
| 1649 | /* |
Brian J Murray | 2adecba | 2016-11-06 04:45:15 -0800 | [diff] [blame] | 1650 | * At this point we only know it's not a PEM formatted key. Could be any |
| 1651 | * of the known DER encoded private key formats |
| 1652 | * |
| 1653 | * We try the different DER format parsers to see if one passes without |
| 1654 | * error |
| 1655 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1656 | #if defined(MBEDTLS_PKCS12_C) || defined(MBEDTLS_PKCS5_C) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1657 | if (pwdlen != 0) { |
Hanno Becker | fab3569 | 2017-08-25 13:38:26 +0100 | [diff] [blame] | 1658 | unsigned char *key_copy; |
| 1659 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1660 | if ((key_copy = mbedtls_calloc(1, keylen)) == NULL) { |
| 1661 | return MBEDTLS_ERR_PK_ALLOC_FAILED; |
| 1662 | } |
Hanno Becker | fab3569 | 2017-08-25 13:38:26 +0100 | [diff] [blame] | 1663 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1664 | memcpy(key_copy, key, keylen); |
Hanno Becker | fab3569 | 2017-08-25 13:38:26 +0100 | [diff] [blame] | 1665 | |
Waleed Elmelegy | 1db5cda | 2023-09-20 18:00:48 +0100 | [diff] [blame] | 1666 | ret = mbedtls_pk_parse_key_pkcs8_encrypted_der(pk, key_copy, keylen, |
| 1667 | pwd, pwdlen, f_rng, p_rng); |
Hanno Becker | fab3569 | 2017-08-25 13:38:26 +0100 | [diff] [blame] | 1668 | |
Tom Cosgrove | ca8c61b | 2023-07-17 15:17:40 +0100 | [diff] [blame] | 1669 | mbedtls_zeroize_and_free(key_copy, keylen); |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1670 | } |
| 1671 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1672 | if (ret == 0) { |
| 1673 | return 0; |
| 1674 | } |
Hanno Becker | fab3569 | 2017-08-25 13:38:26 +0100 | [diff] [blame] | 1675 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1676 | mbedtls_pk_free(pk); |
| 1677 | mbedtls_pk_init(pk); |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1678 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1679 | if (ret == MBEDTLS_ERR_PK_PASSWORD_MISMATCH) { |
| 1680 | return ret; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1681 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1682 | #endif /* MBEDTLS_PKCS12_C || MBEDTLS_PKCS5_C */ |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1683 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1684 | ret = pk_parse_key_pkcs8_unencrypted_der(pk, key, keylen, f_rng, p_rng); |
| 1685 | if (ret == 0) { |
| 1686 | return 0; |
Manuel Pégourié-Gonnard | 84dea01 | 2021-06-15 11:29:26 +0200 | [diff] [blame] | 1687 | } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1688 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1689 | mbedtls_pk_free(pk); |
| 1690 | mbedtls_pk_init(pk); |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1691 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1692 | #if defined(MBEDTLS_RSA_C) |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1693 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1694 | pk_info = mbedtls_pk_info_from_type(MBEDTLS_PK_RSA); |
| 1695 | if (mbedtls_pk_setup(pk, pk_info) == 0 && |
| 1696 | pk_parse_key_pkcs1_der(mbedtls_pk_rsa(*pk), key, keylen) == 0) { |
| 1697 | return 0; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1698 | } |
| 1699 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1700 | mbedtls_pk_free(pk); |
| 1701 | mbedtls_pk_init(pk); |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1702 | #endif /* MBEDTLS_RSA_C */ |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1703 | |
Valerio Setti | 81d7512 | 2023-06-14 14:49:33 +0200 | [diff] [blame] | 1704 | #if defined(MBEDTLS_PK_HAVE_ECC_KEYS) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1705 | pk_info = mbedtls_pk_info_from_type(MBEDTLS_PK_ECKEY); |
| 1706 | if (mbedtls_pk_setup(pk, pk_info) == 0 && |
Valerio Setti | 4064dbb | 2023-05-17 15:33:07 +0200 | [diff] [blame] | 1707 | pk_parse_key_sec1_der(pk, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1708 | key, keylen, f_rng, p_rng) == 0) { |
| 1709 | return 0; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1710 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1711 | mbedtls_pk_free(pk); |
Valerio Setti | 81d7512 | 2023-06-14 14:49:33 +0200 | [diff] [blame] | 1712 | #endif /* MBEDTLS_PK_HAVE_ECC_KEYS */ |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1713 | |
Valerio Setti | 81d7512 | 2023-06-14 14:49:33 +0200 | [diff] [blame] | 1714 | /* If MBEDTLS_RSA_C is defined but MBEDTLS_PK_HAVE_ECC_KEYS isn't, |
Hanno Becker | 780f0a4 | 2018-10-10 11:23:33 +0100 | [diff] [blame] | 1715 | * it is ok to leave the PK context initialized but not |
| 1716 | * freed: It is the caller's responsibility to call pk_init() |
| 1717 | * before calling this function, and to call pk_free() |
Valerio Setti | 81d7512 | 2023-06-14 14:49:33 +0200 | [diff] [blame] | 1718 | * when it fails. If MBEDTLS_PK_HAVE_ECC_KEYS is defined but MBEDTLS_RSA_C |
Hanno Becker | 780f0a4 | 2018-10-10 11:23:33 +0100 | [diff] [blame] | 1719 | * isn't, this leads to mbedtls_pk_free() being called |
| 1720 | * twice, once here and once by the caller, but this is |
| 1721 | * also ok and in line with the mbedtls_pk_free() calls |
| 1722 | * on failed PEM parsing attempts. */ |
| 1723 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1724 | return MBEDTLS_ERR_PK_KEY_INVALID_FORMAT; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1725 | } |
| 1726 | |
| 1727 | /* |
| 1728 | * Parse a public key |
| 1729 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1730 | int mbedtls_pk_parse_public_key(mbedtls_pk_context *ctx, |
| 1731 | const unsigned char *key, size_t keylen) |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1732 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 1733 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1734 | unsigned char *p; |
Ron Eldor | 5472d43 | 2017-10-17 09:49:00 +0300 | [diff] [blame] | 1735 | #if defined(MBEDTLS_RSA_C) |
| 1736 | const mbedtls_pk_info_t *pk_info; |
| 1737 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1738 | #if defined(MBEDTLS_PEM_PARSE_C) |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1739 | size_t len; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1740 | mbedtls_pem_context pem; |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 1741 | #endif |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1742 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1743 | if (keylen == 0) { |
| 1744 | return MBEDTLS_ERR_PK_KEY_INVALID_FORMAT; |
| 1745 | } |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 1746 | |
| 1747 | #if defined(MBEDTLS_PEM_PARSE_C) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1748 | mbedtls_pem_init(&pem); |
Ron Eldor | d0c56de | 2017-10-10 17:03:08 +0300 | [diff] [blame] | 1749 | #if defined(MBEDTLS_RSA_C) |
Manuel Pégourié-Gonnard | 43b37cb | 2015-05-12 11:20:10 +0200 | [diff] [blame] | 1750 | /* Avoid calling mbedtls_pem_read_buffer() on non-null-terminated string */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1751 | if (key[keylen - 1] != '\0') { |
Manuel Pégourié-Gonnard | 43b37cb | 2015-05-12 11:20:10 +0200 | [diff] [blame] | 1752 | ret = MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1753 | } else { |
| 1754 | ret = mbedtls_pem_read_buffer(&pem, |
| 1755 | "-----BEGIN RSA PUBLIC KEY-----", |
| 1756 | "-----END RSA PUBLIC KEY-----", |
| 1757 | key, NULL, 0, &len); |
Ron Eldor | d0c56de | 2017-10-10 17:03:08 +0300 | [diff] [blame] | 1758 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1759 | |
| 1760 | if (ret == 0) { |
| 1761 | p = pem.buf; |
| 1762 | if ((pk_info = mbedtls_pk_info_from_type(MBEDTLS_PK_RSA)) == NULL) { |
| 1763 | mbedtls_pem_free(&pem); |
| 1764 | return MBEDTLS_ERR_PK_UNKNOWN_PK_ALG; |
| 1765 | } |
| 1766 | |
| 1767 | if ((ret = mbedtls_pk_setup(ctx, pk_info)) != 0) { |
| 1768 | mbedtls_pem_free(&pem); |
| 1769 | return ret; |
| 1770 | } |
| 1771 | |
| 1772 | if ((ret = pk_get_rsapubkey(&p, p + pem.buflen, mbedtls_pk_rsa(*ctx))) != 0) { |
| 1773 | mbedtls_pk_free(ctx); |
| 1774 | } |
| 1775 | |
| 1776 | mbedtls_pem_free(&pem); |
| 1777 | return ret; |
| 1778 | } else if (ret != MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT) { |
| 1779 | mbedtls_pem_free(&pem); |
| 1780 | return ret; |
Ron Eldor | d0c56de | 2017-10-10 17:03:08 +0300 | [diff] [blame] | 1781 | } |
| 1782 | #endif /* MBEDTLS_RSA_C */ |
Manuel Pégourié-Gonnard | 43b37cb | 2015-05-12 11:20:10 +0200 | [diff] [blame] | 1783 | |
| 1784 | /* Avoid calling mbedtls_pem_read_buffer() on non-null-terminated string */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1785 | if (key[keylen - 1] != '\0') { |
Manuel Pégourié-Gonnard | 43b37cb | 2015-05-12 11:20:10 +0200 | [diff] [blame] | 1786 | ret = MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1787 | } else { |
| 1788 | ret = mbedtls_pem_read_buffer(&pem, |
| 1789 | "-----BEGIN PUBLIC KEY-----", |
| 1790 | "-----END PUBLIC KEY-----", |
| 1791 | key, NULL, 0, &len); |
| 1792 | } |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1793 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1794 | if (ret == 0) { |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1795 | /* |
| 1796 | * Was PEM encoded |
| 1797 | */ |
Ron Eldor | 40b14a8 | 2017-10-16 19:30:00 +0300 | [diff] [blame] | 1798 | p = pem.buf; |
| 1799 | |
Jethro Beekman | 0167244 | 2023-04-19 14:08:14 +0200 | [diff] [blame] | 1800 | ret = mbedtls_pk_parse_subpubkey(&p, p + pem.buflen, ctx); |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1801 | mbedtls_pem_free(&pem); |
| 1802 | return ret; |
| 1803 | } else if (ret != MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT) { |
| 1804 | mbedtls_pem_free(&pem); |
| 1805 | return ret; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1806 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1807 | mbedtls_pem_free(&pem); |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1808 | #endif /* MBEDTLS_PEM_PARSE_C */ |
Ron Eldor | 40b14a8 | 2017-10-16 19:30:00 +0300 | [diff] [blame] | 1809 | |
| 1810 | #if defined(MBEDTLS_RSA_C) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1811 | if ((pk_info = mbedtls_pk_info_from_type(MBEDTLS_PK_RSA)) == NULL) { |
| 1812 | return MBEDTLS_ERR_PK_UNKNOWN_PK_ALG; |
Ron Eldor | 40b14a8 | 2017-10-16 19:30:00 +0300 | [diff] [blame] | 1813 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1814 | |
| 1815 | if ((ret = mbedtls_pk_setup(ctx, pk_info)) != 0) { |
| 1816 | return ret; |
| 1817 | } |
| 1818 | |
| 1819 | p = (unsigned char *) key; |
| 1820 | ret = pk_get_rsapubkey(&p, p + keylen, mbedtls_pk_rsa(*ctx)); |
| 1821 | if (ret == 0) { |
| 1822 | return ret; |
| 1823 | } |
| 1824 | mbedtls_pk_free(ctx); |
| 1825 | if (ret != (MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_INVALID_PUBKEY, |
| 1826 | MBEDTLS_ERR_ASN1_UNEXPECTED_TAG))) { |
| 1827 | return ret; |
Ron Eldor | 40b14a8 | 2017-10-16 19:30:00 +0300 | [diff] [blame] | 1828 | } |
| 1829 | #endif /* MBEDTLS_RSA_C */ |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1830 | p = (unsigned char *) key; |
| 1831 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1832 | ret = mbedtls_pk_parse_subpubkey(&p, p + keylen, ctx); |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1833 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1834 | return ret; |
Paul Bakker | 1a7550a | 2013-09-15 13:01:22 +0200 | [diff] [blame] | 1835 | } |
| 1836 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1837 | #endif /* MBEDTLS_PK_PARSE_C */ |