OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "crypto/ec_private_key.h" | 5 #include "crypto/ec_private_key.h" |
6 | 6 |
7 #include <openssl/ec.h> | 7 #include <openssl/ec.h> |
8 #include <openssl/evp.h> | 8 #include <openssl/evp.h> |
9 #include <openssl/pkcs12.h> | 9 #include <openssl/pkcs12.h> |
10 #include <openssl/x509.h> | 10 #include <openssl/x509.h> |
| 11 #include <stddef.h> |
| 12 #include <stdint.h> |
11 | 13 |
12 #include "base/logging.h" | 14 #include "base/logging.h" |
13 #include "base/memory/scoped_ptr.h" | 15 #include "base/memory/scoped_ptr.h" |
14 #include "crypto/openssl_util.h" | 16 #include "crypto/openssl_util.h" |
15 #include "crypto/scoped_openssl_types.h" | 17 #include "crypto/scoped_openssl_types.h" |
16 | 18 |
17 namespace crypto { | 19 namespace crypto { |
18 | 20 |
19 namespace { | 21 namespace { |
20 | 22 |
21 // Function pointer definition, for injecting the required key export function | 23 // Function pointer definition, for injecting the required key export function |
22 // into ExportKeyWithBio, below. |bio| is a temporary memory BIO object, and | 24 // into ExportKeyWithBio, below. |bio| is a temporary memory BIO object, and |
23 // |key| is a handle to the input key object. Return 1 on success, 0 otherwise. | 25 // |key| is a handle to the input key object. Return 1 on success, 0 otherwise. |
24 // NOTE: Used with OpenSSL functions, which do not comply with the Chromium | 26 // NOTE: Used with OpenSSL functions, which do not comply with the Chromium |
25 // style guide, hence the unusual parameter placement / types. | 27 // style guide, hence the unusual parameter placement / types. |
26 typedef int (*ExportBioFunction)(BIO* bio, const void* key); | 28 typedef int (*ExportBioFunction)(BIO* bio, const void* key); |
27 | 29 |
28 using ScopedPKCS8_PRIV_KEY_INFO = | 30 using ScopedPKCS8_PRIV_KEY_INFO = |
29 ScopedOpenSSL<PKCS8_PRIV_KEY_INFO, PKCS8_PRIV_KEY_INFO_free>; | 31 ScopedOpenSSL<PKCS8_PRIV_KEY_INFO, PKCS8_PRIV_KEY_INFO_free>; |
30 using ScopedX509_SIG = ScopedOpenSSL<X509_SIG, X509_SIG_free>; | 32 using ScopedX509_SIG = ScopedOpenSSL<X509_SIG, X509_SIG_free>; |
31 | 33 |
32 // Helper to export |key| into |output| via the specified ExportBioFunction. | 34 // Helper to export |key| into |output| via the specified ExportBioFunction. |
33 bool ExportKeyWithBio(const void* key, | 35 bool ExportKeyWithBio(const void* key, |
34 ExportBioFunction export_fn, | 36 ExportBioFunction export_fn, |
35 std::vector<uint8>* output) { | 37 std::vector<uint8_t>* output) { |
36 if (!key) | 38 if (!key) |
37 return false; | 39 return false; |
38 | 40 |
39 ScopedBIO bio(BIO_new(BIO_s_mem())); | 41 ScopedBIO bio(BIO_new(BIO_s_mem())); |
40 if (!bio.get()) | 42 if (!bio.get()) |
41 return false; | 43 return false; |
42 | 44 |
43 if (!export_fn(bio.get(), key)) | 45 if (!export_fn(bio.get(), key)) |
44 return false; | 46 return false; |
45 | 47 |
46 char* data = NULL; | 48 char* data = NULL; |
47 long len = BIO_get_mem_data(bio.get(), &data); | 49 long len = BIO_get_mem_data(bio.get(), &data); |
48 if (!data || len < 0) | 50 if (!data || len < 0) |
49 return false; | 51 return false; |
50 | 52 |
51 output->assign(data, data + len); | 53 output->assign(data, data + len); |
52 return true; | 54 return true; |
53 } | 55 } |
54 | 56 |
55 // Function pointer definition, for injecting the required key export function | 57 // Function pointer definition, for injecting the required key export function |
56 // into ExportKey below. |key| is a pointer to the input key object, | 58 // into ExportKey below. |key| is a pointer to the input key object, |
57 // and |data| is either NULL, or the address of an 'unsigned char*' pointer | 59 // and |data| is either NULL, or the address of an 'unsigned char*' pointer |
58 // that points to the start of the output buffer. The function must return | 60 // that points to the start of the output buffer. The function must return |
59 // the number of bytes required to export the data, or -1 in case of error. | 61 // the number of bytes required to export the data, or -1 in case of error. |
60 typedef int (*ExportDataFunction)(const void* key, unsigned char** data); | 62 typedef int (*ExportDataFunction)(const void* key, unsigned char** data); |
61 | 63 |
62 // Helper to export |key| into |output| via the specified export function. | 64 // Helper to export |key| into |output| via the specified export function. |
63 bool ExportKey(const void* key, | 65 bool ExportKey(const void* key, |
64 ExportDataFunction export_fn, | 66 ExportDataFunction export_fn, |
65 std::vector<uint8>* output) { | 67 std::vector<uint8_t>* output) { |
66 if (!key) | 68 if (!key) |
67 return false; | 69 return false; |
68 | 70 |
69 int data_len = export_fn(key, NULL); | 71 int data_len = export_fn(key, NULL); |
70 if (data_len < 0) | 72 if (data_len < 0) |
71 return false; | 73 return false; |
72 | 74 |
73 output->resize(static_cast<size_t>(data_len)); | 75 output->resize(static_cast<size_t>(data_len)); |
74 unsigned char* data = &(*output)[0]; | 76 unsigned char* data = &(*output)[0]; |
75 if (export_fn(key, &data) < 0) | 77 if (export_fn(key, &data) < 0) |
(...skipping 29 matching lines...) Expand all Loading... |
105 if (!result->key_ || !EVP_PKEY_set1_EC_KEY(result->key_, ec_key.get())) | 107 if (!result->key_ || !EVP_PKEY_set1_EC_KEY(result->key_, ec_key.get())) |
106 return NULL; | 108 return NULL; |
107 | 109 |
108 CHECK_EQ(EVP_PKEY_EC, EVP_PKEY_type(result->key_->type)); | 110 CHECK_EQ(EVP_PKEY_EC, EVP_PKEY_type(result->key_->type)); |
109 return result.release(); | 111 return result.release(); |
110 } | 112 } |
111 | 113 |
112 // static | 114 // static |
113 ECPrivateKey* ECPrivateKey::CreateFromEncryptedPrivateKeyInfo( | 115 ECPrivateKey* ECPrivateKey::CreateFromEncryptedPrivateKeyInfo( |
114 const std::string& password, | 116 const std::string& password, |
115 const std::vector<uint8>& encrypted_private_key_info, | 117 const std::vector<uint8_t>& encrypted_private_key_info, |
116 const std::vector<uint8>& subject_public_key_info) { | 118 const std::vector<uint8_t>& subject_public_key_info) { |
117 // NOTE: The |subject_public_key_info| can be ignored here, it is only | 119 // NOTE: The |subject_public_key_info| can be ignored here, it is only |
118 // useful for the NSS implementation (which uses the public key's SHA1 | 120 // useful for the NSS implementation (which uses the public key's SHA1 |
119 // as a lookup key when storing the private one in its store). | 121 // as a lookup key when storing the private one in its store). |
120 if (encrypted_private_key_info.empty()) | 122 if (encrypted_private_key_info.empty()) |
121 return NULL; | 123 return NULL; |
122 | 124 |
123 OpenSSLErrStackTracer err_tracer(FROM_HERE); | 125 OpenSSLErrStackTracer err_tracer(FROM_HERE); |
124 | 126 |
125 const uint8_t* data = &encrypted_private_key_info[0]; | 127 const uint8_t* data = &encrypted_private_key_info[0]; |
126 const uint8_t* ptr = data; | 128 const uint8_t* ptr = data; |
(...skipping 23 matching lines...) Expand all Loading... |
150 | 152 |
151 // Create a new EVP_PKEY for it. | 153 // Create a new EVP_PKEY for it. |
152 scoped_ptr<ECPrivateKey> result(new ECPrivateKey); | 154 scoped_ptr<ECPrivateKey> result(new ECPrivateKey); |
153 result->key_ = EVP_PKCS82PKEY(p8_decrypted.get()); | 155 result->key_ = EVP_PKCS82PKEY(p8_decrypted.get()); |
154 if (!result->key_ || EVP_PKEY_type(result->key_->type) != EVP_PKEY_EC) | 156 if (!result->key_ || EVP_PKEY_type(result->key_->type) != EVP_PKEY_EC) |
155 return NULL; | 157 return NULL; |
156 | 158 |
157 return result.release(); | 159 return result.release(); |
158 } | 160 } |
159 | 161 |
160 bool ECPrivateKey::ExportEncryptedPrivateKey( | 162 bool ECPrivateKey::ExportEncryptedPrivateKey(const std::string& password, |
161 const std::string& password, | 163 int iterations, |
162 int iterations, | 164 std::vector<uint8_t>* output) { |
163 std::vector<uint8>* output) { | |
164 OpenSSLErrStackTracer err_tracer(FROM_HERE); | 165 OpenSSLErrStackTracer err_tracer(FROM_HERE); |
165 // Convert into a PKCS#8 object. | 166 // Convert into a PKCS#8 object. |
166 ScopedPKCS8_PRIV_KEY_INFO pkcs8(EVP_PKEY2PKCS8(key_)); | 167 ScopedPKCS8_PRIV_KEY_INFO pkcs8(EVP_PKEY2PKCS8(key_)); |
167 if (!pkcs8.get()) | 168 if (!pkcs8.get()) |
168 return false; | 169 return false; |
169 | 170 |
170 // Encrypt the object. | 171 // Encrypt the object. |
171 // NOTE: NSS uses SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_3KEY_TRIPLE_DES_CBC | 172 // NOTE: NSS uses SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_3KEY_TRIPLE_DES_CBC |
172 // so use NID_pbe_WithSHA1And3_Key_TripleDES_CBC which should be the OpenSSL | 173 // so use NID_pbe_WithSHA1And3_Key_TripleDES_CBC which should be the OpenSSL |
173 // equivalent. | 174 // equivalent. |
174 ScopedX509_SIG encrypted(PKCS8_encrypt_pbe( | 175 ScopedX509_SIG encrypted(PKCS8_encrypt_pbe( |
175 NID_pbe_WithSHA1And3_Key_TripleDES_CBC, | 176 NID_pbe_WithSHA1And3_Key_TripleDES_CBC, |
176 nullptr, | 177 nullptr, |
177 reinterpret_cast<const uint8_t*>(password.data()), | 178 reinterpret_cast<const uint8_t*>(password.data()), |
178 password.size(), | 179 password.size(), |
179 nullptr, | 180 nullptr, |
180 0, | 181 0, |
181 iterations, | 182 iterations, |
182 pkcs8.get())); | 183 pkcs8.get())); |
183 if (!encrypted.get()) | 184 if (!encrypted.get()) |
184 return false; | 185 return false; |
185 | 186 |
186 // Write it into |*output| | 187 // Write it into |*output| |
187 return ExportKeyWithBio(encrypted.get(), | 188 return ExportKeyWithBio(encrypted.get(), |
188 reinterpret_cast<ExportBioFunction>(i2d_PKCS8_bio), | 189 reinterpret_cast<ExportBioFunction>(i2d_PKCS8_bio), |
189 output); | 190 output); |
190 } | 191 } |
191 | 192 |
192 bool ECPrivateKey::ExportPublicKey(std::vector<uint8>* output) { | 193 bool ECPrivateKey::ExportPublicKey(std::vector<uint8_t>* output) { |
193 OpenSSLErrStackTracer err_tracer(FROM_HERE); | 194 OpenSSLErrStackTracer err_tracer(FROM_HERE); |
194 return ExportKeyWithBio( | 195 return ExportKeyWithBio( |
195 key_, reinterpret_cast<ExportBioFunction>(i2d_PUBKEY_bio), output); | 196 key_, reinterpret_cast<ExportBioFunction>(i2d_PUBKEY_bio), output); |
196 } | 197 } |
197 | 198 |
198 bool ECPrivateKey::ExportRawPublicKey(std::string* output) { | 199 bool ECPrivateKey::ExportRawPublicKey(std::string* output) { |
199 // i2d_PublicKey will produce an ANSI X9.62 public key which, for a P-256 | 200 // i2d_PublicKey will produce an ANSI X9.62 public key which, for a P-256 |
200 // key, is 0x04 (meaning uncompressed) followed by the x and y field | 201 // key, is 0x04 (meaning uncompressed) followed by the x and y field |
201 // elements as 32-byte, big-endian numbers. | 202 // elements as 32-byte, big-endian numbers. |
202 static const int kExpectedKeyLength = 65; | 203 static const int kExpectedKeyLength = 65; |
203 | 204 |
204 int len = i2d_PublicKey(key_, NULL); | 205 int len = i2d_PublicKey(key_, NULL); |
205 if (len != kExpectedKeyLength) | 206 if (len != kExpectedKeyLength) |
206 return false; | 207 return false; |
207 | 208 |
208 uint8 buf[kExpectedKeyLength]; | 209 uint8_t buf[kExpectedKeyLength]; |
209 uint8* derp = buf; | 210 uint8_t* derp = buf; |
210 len = i2d_PublicKey(key_, &derp); | 211 len = i2d_PublicKey(key_, &derp); |
211 if (len != kExpectedKeyLength) | 212 if (len != kExpectedKeyLength) |
212 return false; | 213 return false; |
213 | 214 |
214 output->assign(reinterpret_cast<char*>(buf + 1), kExpectedKeyLength - 1); | 215 output->assign(reinterpret_cast<char*>(buf + 1), kExpectedKeyLength - 1); |
215 return true; | 216 return true; |
216 } | 217 } |
217 | 218 |
218 bool ECPrivateKey::ExportValue(std::vector<uint8>* output) { | 219 bool ECPrivateKey::ExportValue(std::vector<uint8_t>* output) { |
219 OpenSSLErrStackTracer err_tracer(FROM_HERE); | 220 OpenSSLErrStackTracer err_tracer(FROM_HERE); |
220 ScopedEC_KEY ec_key(EVP_PKEY_get1_EC_KEY(key_)); | 221 ScopedEC_KEY ec_key(EVP_PKEY_get1_EC_KEY(key_)); |
221 return ExportKey(ec_key.get(), | 222 return ExportKey(ec_key.get(), |
222 reinterpret_cast<ExportDataFunction>(i2d_ECPrivateKey), | 223 reinterpret_cast<ExportDataFunction>(i2d_ECPrivateKey), |
223 output); | 224 output); |
224 } | 225 } |
225 | 226 |
226 bool ECPrivateKey::ExportECParams(std::vector<uint8>* output) { | 227 bool ECPrivateKey::ExportECParams(std::vector<uint8_t>* output) { |
227 OpenSSLErrStackTracer err_tracer(FROM_HERE); | 228 OpenSSLErrStackTracer err_tracer(FROM_HERE); |
228 ScopedEC_KEY ec_key(EVP_PKEY_get1_EC_KEY(key_)); | 229 ScopedEC_KEY ec_key(EVP_PKEY_get1_EC_KEY(key_)); |
229 return ExportKey(ec_key.get(), | 230 return ExportKey(ec_key.get(), |
230 reinterpret_cast<ExportDataFunction>(i2d_ECParameters), | 231 reinterpret_cast<ExportDataFunction>(i2d_ECParameters), |
231 output); | 232 output); |
232 } | 233 } |
233 | 234 |
234 ECPrivateKey::ECPrivateKey() : key_(NULL) {} | 235 ECPrivateKey::ECPrivateKey() : key_(NULL) {} |
235 | 236 |
236 } // namespace crypto | 237 } // namespace crypto |
OLD | NEW |