| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "crypto/ec_private_key.h" | 5 #include "crypto/ec_private_key.h" |
| 6 | 6 |
| 7 #include <openssl/ec.h> | 7 #include <openssl/ec.h> |
| 8 #include <openssl/evp.h> | 8 #include <openssl/evp.h> |
| 9 #include <openssl/pkcs12.h> | 9 #include <openssl/pkcs12.h> |
| 10 #include <openssl/x509.h> | 10 #include <openssl/x509.h> |
| 11 #include <stddef.h> |
| 12 #include <stdint.h> |
| 11 | 13 |
| 12 #include "base/logging.h" | 14 #include "base/logging.h" |
| 13 #include "base/memory/scoped_ptr.h" | 15 #include "base/memory/scoped_ptr.h" |
| 14 #include "crypto/openssl_util.h" | 16 #include "crypto/openssl_util.h" |
| 15 #include "crypto/scoped_openssl_types.h" | 17 #include "crypto/scoped_openssl_types.h" |
| 16 | 18 |
| 17 namespace crypto { | 19 namespace crypto { |
| 18 | 20 |
| 19 namespace { | 21 namespace { |
| 20 | 22 |
| 21 // Function pointer definition, for injecting the required key export function | 23 // Function pointer definition, for injecting the required key export function |
| 22 // into ExportKeyWithBio, below. |bio| is a temporary memory BIO object, and | 24 // into ExportKeyWithBio, below. |bio| is a temporary memory BIO object, and |
| 23 // |key| is a handle to the input key object. Return 1 on success, 0 otherwise. | 25 // |key| is a handle to the input key object. Return 1 on success, 0 otherwise. |
| 24 // NOTE: Used with OpenSSL functions, which do not comply with the Chromium | 26 // NOTE: Used with OpenSSL functions, which do not comply with the Chromium |
| 25 // style guide, hence the unusual parameter placement / types. | 27 // style guide, hence the unusual parameter placement / types. |
| 26 typedef int (*ExportBioFunction)(BIO* bio, const void* key); | 28 typedef int (*ExportBioFunction)(BIO* bio, const void* key); |
| 27 | 29 |
| 28 using ScopedPKCS8_PRIV_KEY_INFO = | 30 using ScopedPKCS8_PRIV_KEY_INFO = |
| 29 ScopedOpenSSL<PKCS8_PRIV_KEY_INFO, PKCS8_PRIV_KEY_INFO_free>; | 31 ScopedOpenSSL<PKCS8_PRIV_KEY_INFO, PKCS8_PRIV_KEY_INFO_free>; |
| 30 using ScopedX509_SIG = ScopedOpenSSL<X509_SIG, X509_SIG_free>; | 32 using ScopedX509_SIG = ScopedOpenSSL<X509_SIG, X509_SIG_free>; |
| 31 | 33 |
| 32 // Helper to export |key| into |output| via the specified ExportBioFunction. | 34 // Helper to export |key| into |output| via the specified ExportBioFunction. |
| 33 bool ExportKeyWithBio(const void* key, | 35 bool ExportKeyWithBio(const void* key, |
| 34 ExportBioFunction export_fn, | 36 ExportBioFunction export_fn, |
| 35 std::vector<uint8>* output) { | 37 std::vector<uint8_t>* output) { |
| 36 if (!key) | 38 if (!key) |
| 37 return false; | 39 return false; |
| 38 | 40 |
| 39 ScopedBIO bio(BIO_new(BIO_s_mem())); | 41 ScopedBIO bio(BIO_new(BIO_s_mem())); |
| 40 if (!bio.get()) | 42 if (!bio.get()) |
| 41 return false; | 43 return false; |
| 42 | 44 |
| 43 if (!export_fn(bio.get(), key)) | 45 if (!export_fn(bio.get(), key)) |
| 44 return false; | 46 return false; |
| 45 | 47 |
| 46 char* data = NULL; | 48 char* data = NULL; |
| 47 long len = BIO_get_mem_data(bio.get(), &data); | 49 long len = BIO_get_mem_data(bio.get(), &data); |
| 48 if (!data || len < 0) | 50 if (!data || len < 0) |
| 49 return false; | 51 return false; |
| 50 | 52 |
| 51 output->assign(data, data + len); | 53 output->assign(data, data + len); |
| 52 return true; | 54 return true; |
| 53 } | 55 } |
| 54 | 56 |
| 55 // Function pointer definition, for injecting the required key export function | 57 // Function pointer definition, for injecting the required key export function |
| 56 // into ExportKey below. |key| is a pointer to the input key object, | 58 // into ExportKey below. |key| is a pointer to the input key object, |
| 57 // and |data| is either NULL, or the address of an 'unsigned char*' pointer | 59 // and |data| is either NULL, or the address of an 'unsigned char*' pointer |
| 58 // that points to the start of the output buffer. The function must return | 60 // that points to the start of the output buffer. The function must return |
| 59 // the number of bytes required to export the data, or -1 in case of error. | 61 // the number of bytes required to export the data, or -1 in case of error. |
| 60 typedef int (*ExportDataFunction)(const void* key, unsigned char** data); | 62 typedef int (*ExportDataFunction)(const void* key, unsigned char** data); |
| 61 | 63 |
| 62 // Helper to export |key| into |output| via the specified export function. | 64 // Helper to export |key| into |output| via the specified export function. |
| 63 bool ExportKey(const void* key, | 65 bool ExportKey(const void* key, |
| 64 ExportDataFunction export_fn, | 66 ExportDataFunction export_fn, |
| 65 std::vector<uint8>* output) { | 67 std::vector<uint8_t>* output) { |
| 66 if (!key) | 68 if (!key) |
| 67 return false; | 69 return false; |
| 68 | 70 |
| 69 int data_len = export_fn(key, NULL); | 71 int data_len = export_fn(key, NULL); |
| 70 if (data_len < 0) | 72 if (data_len < 0) |
| 71 return false; | 73 return false; |
| 72 | 74 |
| 73 output->resize(static_cast<size_t>(data_len)); | 75 output->resize(static_cast<size_t>(data_len)); |
| 74 unsigned char* data = &(*output)[0]; | 76 unsigned char* data = &(*output)[0]; |
| 75 if (export_fn(key, &data) < 0) | 77 if (export_fn(key, &data) < 0) |
| (...skipping 29 matching lines...) Expand all Loading... |
| 105 if (!result->key_ || !EVP_PKEY_set1_EC_KEY(result->key_, ec_key.get())) | 107 if (!result->key_ || !EVP_PKEY_set1_EC_KEY(result->key_, ec_key.get())) |
| 106 return NULL; | 108 return NULL; |
| 107 | 109 |
| 108 CHECK_EQ(EVP_PKEY_EC, EVP_PKEY_type(result->key_->type)); | 110 CHECK_EQ(EVP_PKEY_EC, EVP_PKEY_type(result->key_->type)); |
| 109 return result.release(); | 111 return result.release(); |
| 110 } | 112 } |
| 111 | 113 |
| 112 // static | 114 // static |
| 113 ECPrivateKey* ECPrivateKey::CreateFromEncryptedPrivateKeyInfo( | 115 ECPrivateKey* ECPrivateKey::CreateFromEncryptedPrivateKeyInfo( |
| 114 const std::string& password, | 116 const std::string& password, |
| 115 const std::vector<uint8>& encrypted_private_key_info, | 117 const std::vector<uint8_t>& encrypted_private_key_info, |
| 116 const std::vector<uint8>& subject_public_key_info) { | 118 const std::vector<uint8_t>& subject_public_key_info) { |
| 117 // NOTE: The |subject_public_key_info| can be ignored here, it is only | 119 // NOTE: The |subject_public_key_info| can be ignored here, it is only |
| 118 // useful for the NSS implementation (which uses the public key's SHA1 | 120 // useful for the NSS implementation (which uses the public key's SHA1 |
| 119 // as a lookup key when storing the private one in its store). | 121 // as a lookup key when storing the private one in its store). |
| 120 if (encrypted_private_key_info.empty()) | 122 if (encrypted_private_key_info.empty()) |
| 121 return NULL; | 123 return NULL; |
| 122 | 124 |
| 123 OpenSSLErrStackTracer err_tracer(FROM_HERE); | 125 OpenSSLErrStackTracer err_tracer(FROM_HERE); |
| 124 | 126 |
| 125 const uint8_t* data = &encrypted_private_key_info[0]; | 127 const uint8_t* data = &encrypted_private_key_info[0]; |
| 126 const uint8_t* ptr = data; | 128 const uint8_t* ptr = data; |
| (...skipping 23 matching lines...) Expand all Loading... |
| 150 | 152 |
| 151 // Create a new EVP_PKEY for it. | 153 // Create a new EVP_PKEY for it. |
| 152 scoped_ptr<ECPrivateKey> result(new ECPrivateKey); | 154 scoped_ptr<ECPrivateKey> result(new ECPrivateKey); |
| 153 result->key_ = EVP_PKCS82PKEY(p8_decrypted.get()); | 155 result->key_ = EVP_PKCS82PKEY(p8_decrypted.get()); |
| 154 if (!result->key_ || EVP_PKEY_type(result->key_->type) != EVP_PKEY_EC) | 156 if (!result->key_ || EVP_PKEY_type(result->key_->type) != EVP_PKEY_EC) |
| 155 return NULL; | 157 return NULL; |
| 156 | 158 |
| 157 return result.release(); | 159 return result.release(); |
| 158 } | 160 } |
| 159 | 161 |
| 160 bool ECPrivateKey::ExportEncryptedPrivateKey( | 162 bool ECPrivateKey::ExportEncryptedPrivateKey(const std::string& password, |
| 161 const std::string& password, | 163 int iterations, |
| 162 int iterations, | 164 std::vector<uint8_t>* output) { |
| 163 std::vector<uint8>* output) { | |
| 164 OpenSSLErrStackTracer err_tracer(FROM_HERE); | 165 OpenSSLErrStackTracer err_tracer(FROM_HERE); |
| 165 // Convert into a PKCS#8 object. | 166 // Convert into a PKCS#8 object. |
| 166 ScopedPKCS8_PRIV_KEY_INFO pkcs8(EVP_PKEY2PKCS8(key_)); | 167 ScopedPKCS8_PRIV_KEY_INFO pkcs8(EVP_PKEY2PKCS8(key_)); |
| 167 if (!pkcs8.get()) | 168 if (!pkcs8.get()) |
| 168 return false; | 169 return false; |
| 169 | 170 |
| 170 // Encrypt the object. | 171 // Encrypt the object. |
| 171 // NOTE: NSS uses SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_3KEY_TRIPLE_DES_CBC | 172 // NOTE: NSS uses SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_3KEY_TRIPLE_DES_CBC |
| 172 // so use NID_pbe_WithSHA1And3_Key_TripleDES_CBC which should be the OpenSSL | 173 // so use NID_pbe_WithSHA1And3_Key_TripleDES_CBC which should be the OpenSSL |
| 173 // equivalent. | 174 // equivalent. |
| 174 ScopedX509_SIG encrypted(PKCS8_encrypt_pbe( | 175 ScopedX509_SIG encrypted(PKCS8_encrypt_pbe( |
| 175 NID_pbe_WithSHA1And3_Key_TripleDES_CBC, | 176 NID_pbe_WithSHA1And3_Key_TripleDES_CBC, |
| 176 nullptr, | 177 nullptr, |
| 177 reinterpret_cast<const uint8_t*>(password.data()), | 178 reinterpret_cast<const uint8_t*>(password.data()), |
| 178 password.size(), | 179 password.size(), |
| 179 nullptr, | 180 nullptr, |
| 180 0, | 181 0, |
| 181 iterations, | 182 iterations, |
| 182 pkcs8.get())); | 183 pkcs8.get())); |
| 183 if (!encrypted.get()) | 184 if (!encrypted.get()) |
| 184 return false; | 185 return false; |
| 185 | 186 |
| 186 // Write it into |*output| | 187 // Write it into |*output| |
| 187 return ExportKeyWithBio(encrypted.get(), | 188 return ExportKeyWithBio(encrypted.get(), |
| 188 reinterpret_cast<ExportBioFunction>(i2d_PKCS8_bio), | 189 reinterpret_cast<ExportBioFunction>(i2d_PKCS8_bio), |
| 189 output); | 190 output); |
| 190 } | 191 } |
| 191 | 192 |
| 192 bool ECPrivateKey::ExportPublicKey(std::vector<uint8>* output) { | 193 bool ECPrivateKey::ExportPublicKey(std::vector<uint8_t>* output) { |
| 193 OpenSSLErrStackTracer err_tracer(FROM_HERE); | 194 OpenSSLErrStackTracer err_tracer(FROM_HERE); |
| 194 return ExportKeyWithBio( | 195 return ExportKeyWithBio( |
| 195 key_, reinterpret_cast<ExportBioFunction>(i2d_PUBKEY_bio), output); | 196 key_, reinterpret_cast<ExportBioFunction>(i2d_PUBKEY_bio), output); |
| 196 } | 197 } |
| 197 | 198 |
| 198 bool ECPrivateKey::ExportRawPublicKey(std::string* output) { | 199 bool ECPrivateKey::ExportRawPublicKey(std::string* output) { |
| 199 // i2d_PublicKey will produce an ANSI X9.62 public key which, for a P-256 | 200 // i2d_PublicKey will produce an ANSI X9.62 public key which, for a P-256 |
| 200 // key, is 0x04 (meaning uncompressed) followed by the x and y field | 201 // key, is 0x04 (meaning uncompressed) followed by the x and y field |
| 201 // elements as 32-byte, big-endian numbers. | 202 // elements as 32-byte, big-endian numbers. |
| 202 static const int kExpectedKeyLength = 65; | 203 static const int kExpectedKeyLength = 65; |
| 203 | 204 |
| 204 int len = i2d_PublicKey(key_, NULL); | 205 int len = i2d_PublicKey(key_, NULL); |
| 205 if (len != kExpectedKeyLength) | 206 if (len != kExpectedKeyLength) |
| 206 return false; | 207 return false; |
| 207 | 208 |
| 208 uint8 buf[kExpectedKeyLength]; | 209 uint8_t buf[kExpectedKeyLength]; |
| 209 uint8* derp = buf; | 210 uint8_t* derp = buf; |
| 210 len = i2d_PublicKey(key_, &derp); | 211 len = i2d_PublicKey(key_, &derp); |
| 211 if (len != kExpectedKeyLength) | 212 if (len != kExpectedKeyLength) |
| 212 return false; | 213 return false; |
| 213 | 214 |
| 214 output->assign(reinterpret_cast<char*>(buf + 1), kExpectedKeyLength - 1); | 215 output->assign(reinterpret_cast<char*>(buf + 1), kExpectedKeyLength - 1); |
| 215 return true; | 216 return true; |
| 216 } | 217 } |
| 217 | 218 |
| 218 bool ECPrivateKey::ExportValue(std::vector<uint8>* output) { | 219 bool ECPrivateKey::ExportValue(std::vector<uint8_t>* output) { |
| 219 OpenSSLErrStackTracer err_tracer(FROM_HERE); | 220 OpenSSLErrStackTracer err_tracer(FROM_HERE); |
| 220 ScopedEC_KEY ec_key(EVP_PKEY_get1_EC_KEY(key_)); | 221 ScopedEC_KEY ec_key(EVP_PKEY_get1_EC_KEY(key_)); |
| 221 return ExportKey(ec_key.get(), | 222 return ExportKey(ec_key.get(), |
| 222 reinterpret_cast<ExportDataFunction>(i2d_ECPrivateKey), | 223 reinterpret_cast<ExportDataFunction>(i2d_ECPrivateKey), |
| 223 output); | 224 output); |
| 224 } | 225 } |
| 225 | 226 |
| 226 bool ECPrivateKey::ExportECParams(std::vector<uint8>* output) { | 227 bool ECPrivateKey::ExportECParams(std::vector<uint8_t>* output) { |
| 227 OpenSSLErrStackTracer err_tracer(FROM_HERE); | 228 OpenSSLErrStackTracer err_tracer(FROM_HERE); |
| 228 ScopedEC_KEY ec_key(EVP_PKEY_get1_EC_KEY(key_)); | 229 ScopedEC_KEY ec_key(EVP_PKEY_get1_EC_KEY(key_)); |
| 229 return ExportKey(ec_key.get(), | 230 return ExportKey(ec_key.get(), |
| 230 reinterpret_cast<ExportDataFunction>(i2d_ECParameters), | 231 reinterpret_cast<ExportDataFunction>(i2d_ECParameters), |
| 231 output); | 232 output); |
| 232 } | 233 } |
| 233 | 234 |
| 234 ECPrivateKey::ECPrivateKey() : key_(NULL) {} | 235 ECPrivateKey::ECPrivateKey() : key_(NULL) {} |
| 235 | 236 |
| 236 } // namespace crypto | 237 } // namespace crypto |
| OLD | NEW |