key.cpp@ 105589

Last change on this file since 105589 was 100442, checked in by vboxsync, 17 months ago
IPRT,OpenSSL: Support ECDSA for verficiation purposes when IPRT links with OpenSSL. This required quite a bit of cleanups, so not entirely no-risk. bugref:10479 ticketref:21621
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 21.0 KB

Line
1	/* $Id: key.cpp 100442 2023-07-08 11:10:51Z vboxsync $ */
2	/** @file
3	* IPRT - Crypto - Cryptographic Keys.
4	*/
5
6	/*
7	* Copyright (C) 2006-2023 Oracle and/or its affiliates.
8	*
9	* This file is part of VirtualBox base platform packages, as
10	* available from https://www.virtualbox.org.
11	*
12	* This program is free software; you can redistribute it and/or
13	* modify it under the terms of the GNU General Public License
14	* as published by the Free Software Foundation, in version 3 of the
15	* License.
16	*
17	* This program is distributed in the hope that it will be useful, but
18	* WITHOUT ANY WARRANTY; without even the implied warranty of
19	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20	* General Public License for more details.
21	*
22	* You should have received a copy of the GNU General Public License
23	* along with this program; if not, see <https://www.gnu.org/licenses>.
24	*
25	* The contents of this file may alternatively be used under the terms
26	* of the Common Development and Distribution License Version 1.0
27	* (CDDL), a copy of it is provided in the "COPYING.CDDL" file included
28	* in the VirtualBox distribution, in which case the provisions of the
29	* CDDL are applicable instead of those of the GPL.
30	*
31	* You may elect to license modified versions of this file under the
32	* terms and conditions of either the GPL or the CDDL or both.
33	*
34	* SPDX-License-Identifier: GPL-3.0-only OR CDDL-1.0
35	*/
36
37
38	/*********************************************************************************************************************************
39	* Header Files *
40	*********************************************************************************************************************************/
41	#define LOG_GROUP RTLOGGROUP_CRYPTO
42	#include "internal/iprt.h"
43	#include <iprt/crypto/key.h>
44
45	#include <iprt/asm.h>
46	#include <iprt/assert.h>
47	#include <iprt/err.h>
48	#include <iprt/log.h>
49	#include <iprt/mem.h>
50	#include <iprt/memsafer.h>
51	#include <iprt/string.h>
52	#include <iprt/crypto/rsa.h>
53	#include <iprt/crypto/pkix.h>
54
55	#include "internal/magics.h"
56	#include "key-internal.h"
57
58
59	/**
60	* Internal crypto key instance creator.
61	*
62	* This does most of the common work, caller does the 'u' and cBits jobs.
63	*
64	* @returns IPRT status code.
65	* @param ppThis Where to return the key instance.
66	* @param enmType The key type.
67	* @param fFlags The key flags.
68	* @param pvEncoded The encoded key bits.
69	* @param cbEncoded The size of the encoded key bits (in bytes).
70	*/
71	DECLHIDDEN(int) rtCrKeyCreateWorker(PRTCRKEYINT *ppThis, RTCRKEYTYPE enmType, uint32_t fFlags,
72	void const *pvEncoded, uint32_t cbEncoded)
73	{
74	PRTCRKEYINT pThis = (PRTCRKEYINT)RTMemAllocZ(sizeof(*pThis) + (fFlags & RTCRKEYINT_F_SENSITIVE ? 0 : cbEncoded));
75	if (pThis)
76	{
77	pThis->enmType = enmType;
78	pThis->fFlags = fFlags;
79	#if defined(IPRT_WITH_OPENSSL)
80	pThis->fFlags \|= RTCRKEYINT_F_INCLUDE_ENCODED;
81	pThis->cbEncoded = cbEncoded;
82	if (!(fFlags & RTCRKEYINT_F_SENSITIVE))
83	pThis->pbEncoded = (uint8_t *)(pThis + 1);
84	else
85	{
86	pThis->pbEncoded = (uint8_t *)RTMemSaferAllocZ(cbEncoded);
87	if (!pThis->pbEncoded)
88	{
89	RTMemFree(pThis);
90	return VERR_NO_MEMORY;
91	}
92	}
93	memcpy(pThis->pbEncoded, pvEncoded, cbEncoded);
94	#else
95	RT_NOREF(pvEncoded, cbEncoded);
96	#endif
97	pThis->cRefs = 1;
98	pThis->u32Magic = RTCRKEYINT_MAGIC;
99	*ppThis = pThis;
100	return VINF_SUCCESS;
101	}
102	return VERR_NO_MEMORY;
103	}
104
105
106	/**
107	* Creates an RSA public key from a DER encoded RTCRRSAPUBLICKEY blob.
108	*
109	* @returns IPRT status code.
110	* @param phKey Where to return the key handle.
111	* @param pvKeyBits The DER encoded RTCRRSAPUBLICKEY blob.
112	* @param cbKeyBits The size of the blob.
113	* @param pErrInfo Where to supply addition error details. Optional.
114	* @param pszErrorTag Error tag. Optional.
115	*/
116	DECLHIDDEN(int) rtCrKeyCreateRsaPublic(PRTCRKEY phKey, const void *pvKeyBits, uint32_t cbKeyBits,
117	PRTERRINFO pErrInfo, const char *pszErrorTag)
118	{
119	/*
120	* Decode the key data first since that's what's most likely to fail here.
121	*/
122	RTASN1CURSORPRIMARY PrimaryCursor;
123	RTAsn1CursorInitPrimary(&PrimaryCursor, pvKeyBits, cbKeyBits, pErrInfo, &g_RTAsn1DefaultAllocator,
124	RTASN1CURSOR_FLAGS_DER, pszErrorTag ? pszErrorTag : "rsa");
125	RTCRRSAPUBLICKEY PublicKey;
126	RT_ZERO(PublicKey);
127	int rc = RTCrRsaPublicKey_DecodeAsn1(&PrimaryCursor.Cursor, 0, &PublicKey, pszErrorTag ? pszErrorTag : "PublicKey");
128	if (RT_SUCCESS(rc))
129	{
130	/*
131	* Create a key instance for it.
132	*/
133	PRTCRKEYINT pThis;
134	rc = rtCrKeyCreateWorker(&pThis, RTCRKEYTYPE_RSA_PUBLIC, RTCRKEYINT_F_PUBLIC, pvKeyBits, cbKeyBits);
135	if (RT_SUCCESS(rc))
136	{
137	rc = RTAsn1Integer_ToBigNum(&PublicKey.Modulus, &pThis->u.RsaPublic.Modulus, 0);
138	if (RT_SUCCESS(rc))
139	{
140	pThis->cBits = RTBigNumBitWidth(&pThis->u.RsaPublic.Modulus);
141	rc = RTAsn1Integer_ToBigNum(&PublicKey.PublicExponent, &pThis->u.RsaPublic.Exponent, 0);
142	if (RT_SUCCESS(rc))
143	{
144
145	/* Done. */
146	RTAsn1VtDelete(&PublicKey.SeqCore.Asn1Core);
147	*phKey = pThis;
148	return VINF_SUCCESS;
149	}
150	}
151	RTCrKeyRelease(pThis);
152	}
153	RTAsn1VtDelete(&PublicKey.SeqCore.Asn1Core);
154	}
155	*phKey = NIL_RTCRKEY;
156	return rc;
157	}
158
159
160	/**
161	* Creates an EC (ECDSA) public key from a DER encoded RTCRX50-PUBLICKEY blob.
162	*
163	* @returns IPRT status code.
164	* @param phKey Where to return the key handle.
165	* @param pParameters The algorithm parameters, typically namedCurve OID.
166	* @param pvKeyBits The DER encoded RTCRRSAPUBLICKEY blob.
167	* @param cbKeyBits The size of the blob.
168	* @param pErrInfo Where to supply addition error details. Optional.
169	* @param pszErrorTag Error tag. Optional.
170	*/
171	DECLHIDDEN(int) rtCrKeyCreateEcdsaPublic(PRTCRKEY phKey, PCRTASN1DYNTYPE pParameters, const void *pvKeyBits, uint32_t cbKeyBits,
172	PRTERRINFO pErrInfo, const char *pszErrorTag)
173	{
174	#if 0
175	/*
176	* Decode the key data first since that's what's most likely to fail here.
177	*/
178	RTASN1CURSORPRIMARY PrimaryCursor;
179	RTAsn1CursorInitPrimary(&PrimaryCursor, pvKeyBits, cbKeyBits, pErrInfo, &g_RTAsn1DefaultAllocator,
180	RTASN1CURSOR_FLAGS_DER, pszErrorTag ? pszErrorTag : "rsa");
181	RTCRRSAPUBLICKEY PublicKey;
182	RT_ZERO(PublicKey);
183	int rc = RTCrRsaPublicKey_DecodeAsn1(&PrimaryCursor.Cursor, 0, &PublicKey, pszErrorTag ? pszErrorTag : "PublicKey");
184	#else
185	RT_NOREF(pszErrorTag);
186	int rc = VINF_SUCCESS;
187	#endif
188	if (RT_SUCCESS(rc))
189	{
190	/*
191	* Check the parameter (see RTC-5480, section 2.1.1).
192	*/
193	if ( pParameters
194	&& pParameters->enmType == RTASN1TYPE_OBJID
195	&& RTAsn1ObjId_IsPresent(&pParameters->u.ObjId) /* paranoia */)
196	{
197	/*
198	* Create a key instance for it.
199	*/
200	PRTCRKEYINT pThis;
201	rc = rtCrKeyCreateWorker(&pThis, RTCRKEYTYPE_ECDSA_PUBLIC, RTCRKEYINT_F_PUBLIC, pvKeyBits, cbKeyBits);
202	if (RT_SUCCESS(rc))
203	{
204	rc = RTAsn1ObjId_Clone(&pThis->u.EcdsaPublic.NamedCurve, &pParameters->u.ObjId, &g_RTAsn1DefaultAllocator);
205	if (RT_SUCCESS(rc))
206	{
207	/* Done. */
208	#if 0
209	RTAsn1VtDelete(&PublicKey.SeqCore.Asn1Core);
210	#endif
211	*phKey = pThis;
212	return VINF_SUCCESS;
213	}
214	RTCrKeyRelease(pThis);
215	}
216	}
217	else if (!pParameters \|\| pParameters->enmType == RTASN1TYPE_NOT_PRESENT)
218	rc = RTERRINFO_LOG_SET_F(pErrInfo, VERR_CR_KEY_ALGO_PARAMS_MISSING,
219	"%s: ECDSA public key expected a namedCurve parameter", pszErrorTag);
220	else if (pParameters->enmType == RTASN1TYPE_NULL)
221	rc = RTERRINFO_LOG_SET_F(pErrInfo, VERR_CR_KEY_ALGO_PARAMS_UNKNOWN,
222	"%s: ECDSA public key expected a namedCurve parameter, found implicitCurve (NULL) instead",
223	pszErrorTag);
224	else
225	rc = RTERRINFO_LOG_SET_F(pErrInfo, VERR_CR_KEY_ALGO_PARAMS_UNKNOWN,
226	"%s: ECDSA public key expected namedCurve parameter, found %d",
227	pszErrorTag, pParameters->enmType);
228	#if 0
229	RTAsn1VtDelete(&PublicKey.SeqCore.Asn1Core);
230	#endif
231	}
232	*phKey = NIL_RTCRKEY;
233	return rc;
234	}
235
236
237	RTDECL(int) RTCrKeyCreateFromPublicAlgorithmAndBits(PRTCRKEY phKey, PCRTASN1OBJID pAlgorithm, PCRTASN1DYNTYPE pParameters,
238	PCRTASN1BITSTRING pPublicKey, PRTERRINFO pErrInfo, const char *pszErrorTag)
239	{
240	/*
241	* Validate input.
242	*/
243	AssertPtrReturn(phKey, VERR_INVALID_POINTER);
244	*phKey = NIL_RTCRKEY;
245
246	AssertPtrReturn(pAlgorithm, VERR_INVALID_POINTER);
247	AssertReturn(RTAsn1ObjId_IsPresent(pAlgorithm), VERR_INVALID_PARAMETER);
248
249	AssertPtrReturn(pPublicKey, VERR_INVALID_POINTER);
250	AssertReturn(RTAsn1BitString_IsPresent(pPublicKey), VERR_INVALID_PARAMETER);
251
252	/*
253	* Identify the key type from the algorithm ID
254	*/
255	const char * const pszEncryptionOid = RTCrX509AlgorithmIdentifier_GetEncryptionOidFromOid(pAlgorithm->szObjId,
256	false /fMustIncludeHash/);
257	if (pszEncryptionOid)
258	{
259	if (strcmp(pszEncryptionOid, RTCRX509ALGORITHMIDENTIFIERID_RSA) == 0)
260	return rtCrKeyCreateRsaPublic(phKey,
261	RTASN1BITSTRING_GET_BIT0_PTR(pPublicKey),
262	RTASN1BITSTRING_GET_BYTE_SIZE(pPublicKey),
263	pErrInfo, pszErrorTag);
264	if (strcmp(pszEncryptionOid, RTCRX509ALGORITHMIDENTIFIERID_ECDSA) == 0)
265	return rtCrKeyCreateEcdsaPublic(phKey,
266	pParameters,
267	RTASN1BITSTRING_GET_BIT0_PTR(pPublicKey),
268	RTASN1BITSTRING_GET_BYTE_SIZE(pPublicKey),
269	pErrInfo, pszErrorTag);
270	}
271	Assert(pszEncryptionOid == NULL);
272	return RTErrInfoSetF(pErrInfo, VERR_CR_PKIX_CIPHER_ALGO_NOT_KNOWN, "oid=%s", pAlgorithm->szObjId);
273	}
274
275
276	RTDECL(int) RTCrKeyCreateFromSubjectPublicKeyInfo(PRTCRKEY phKey, struct RTCRX509SUBJECTPUBLICKEYINFO const *pSrc,
277	PRTERRINFO pErrInfo, const char *pszErrorTag)
278	{
279	AssertPtrReturn(pSrc, VERR_INVALID_POINTER);
280	AssertReturn(RTCrX509SubjectPublicKeyInfo_IsPresent(pSrc), VERR_INVALID_PARAMETER);
281	return RTCrKeyCreateFromPublicAlgorithmAndBits(phKey, &pSrc->Algorithm.Algorithm, &pSrc->Algorithm.Parameters,
282	&pSrc->SubjectPublicKey, pErrInfo, pszErrorTag);
283	}
284
285
286	/**
287	* Creates an RSA private key from a DER encoded RTCRRSAPRIVATEKEY blob.
288	*
289	* @returns IPRT status code.
290	* @param phKey Where to return the key handle.
291	* @param pvKeyBits The DER encoded RTCRRSAPRIVATEKEY blob.
292	* @param cbKeyBits The size of the blob.
293	* @param pErrInfo Where to supply addition error details. Optional.
294	* @param pszErrorTag Error tag. Optional.
295	*/
296	DECLHIDDEN(int) rtCrKeyCreateRsaPrivate(PRTCRKEY phKey, const void *pvKeyBits, uint32_t cbKeyBits,
297	PRTERRINFO pErrInfo, const char *pszErrorTag)
298	{
299	/*
300	* Decode the key data first since that's what's most likely to fail here.
301	*/
302	RTASN1CURSORPRIMARY PrimaryCursor;
303	RTAsn1CursorInitPrimary(&PrimaryCursor, pvKeyBits, cbKeyBits, pErrInfo, &g_RTAsn1SaferAllocator,
304	RTASN1CURSOR_FLAGS_DER, pszErrorTag ? pszErrorTag : "rsa");
305	RTCRRSAPRIVATEKEY PrivateKey;
306	RT_ZERO(PrivateKey);
307	int rc = RTCrRsaPrivateKey_DecodeAsn1(&PrimaryCursor.Cursor, 0, &PrivateKey, pszErrorTag ? pszErrorTag : "PrivateKey");
308	if (RT_SUCCESS(rc))
309	{
310	/*
311	* Create a key instance for it.
312	*/
313	PRTCRKEYINT pThis;
314	rc = rtCrKeyCreateWorker(&pThis, RTCRKEYTYPE_RSA_PRIVATE, RTCRKEYINT_F_PRIVATE \| RTCRKEYINT_F_SENSITIVE,
315	pvKeyBits, cbKeyBits);
316	if (RT_SUCCESS(rc))
317	{
318	rc = RTAsn1Integer_ToBigNum(&PrivateKey.Modulus, &pThis->u.RsaPrivate.Modulus, 0);
319	if (RT_SUCCESS(rc))
320	{
321	pThis->cBits = RTBigNumBitWidth(&pThis->u.RsaPrivate.Modulus);
322	rc = RTAsn1Integer_ToBigNum(&PrivateKey.PrivateExponent, &pThis->u.RsaPrivate.PrivateExponent, 0);
323	if (RT_SUCCESS(rc))
324	{
325	rc = RTAsn1Integer_ToBigNum(&PrivateKey.PublicExponent, &pThis->u.RsaPrivate.PublicExponent, 0);
326	if (RT_SUCCESS(rc))
327	{
328	/* Done. */
329	RTAsn1VtDelete(&PrivateKey.SeqCore.Asn1Core);
330	RTMemWipeThoroughly(&PrivateKey, sizeof(PrivateKey), 3);
331	*phKey = pThis;
332	return VINF_SUCCESS;
333	}
334	}
335	}
336	RTCrKeyRelease(pThis);
337	}
338	RTAsn1VtDelete(&PrivateKey.SeqCore.Asn1Core);
339	RTMemWipeThoroughly(&PrivateKey, sizeof(PrivateKey), 3);
340	}
341	*phKey = NIL_RTCRKEY;
342	return rc;
343	}
344
345
346	RTDECL(uint32_t) RTCrKeyRetain(RTCRKEY hKey)
347	{
348	PRTCRKEYINT pThis = hKey;
349	AssertPtrReturn(pThis, UINT32_MAX);
350	AssertReturn(pThis->u32Magic == RTCRKEYINT_MAGIC, UINT32_MAX);
351
352	uint32_t cRefs = ASMAtomicIncU32(&pThis->cRefs);
353	AssertMsg(cRefs > 1 && cRefs < 1024, ("%#x\n", cRefs));
354	return cRefs;
355	}
356
357
358	/**
359	* Destructor.
360	*
361	* @returns 0
362	* @param pThis The key to destroy.
363	*/
364	static int rtCrKeyDestroy(PRTCRKEYINT pThis)
365	{
366	/* Invalidate the object. */
367	pThis->u32Magic = ~RTCRKEYINT_MAGIC;
368
369	/* Type specific cleanup. */
370	switch (pThis->enmType)
371	{
372	case RTCRKEYTYPE_RSA_PUBLIC:
373	RTBigNumDestroy(&pThis->u.RsaPublic.Modulus);
374	RTBigNumDestroy(&pThis->u.RsaPublic.Exponent);
375	break;
376
377	case RTCRKEYTYPE_RSA_PRIVATE:
378	RTBigNumDestroy(&pThis->u.RsaPrivate.Modulus);
379	RTBigNumDestroy(&pThis->u.RsaPrivate.PrivateExponent);
380	RTBigNumDestroy(&pThis->u.RsaPrivate.PublicExponent);
381	break;
382
383	case RTCRKEYTYPE_ECDSA_PUBLIC:
384	RTAsn1ObjId_Delete(&pThis->u.EcdsaPublic.NamedCurve);
385	break;
386
387	case RTCRKEYTYPE_ECDSA_PRIVATE: /* not yet implemented */
388	case RTCRKEYTYPE_INVALID:
389	case RTCRKEYTYPE_END:
390	case RTCRKEYTYPE_32BIT_HACK:
391	AssertFailed();
392	}
393	pThis->enmType = RTCRKEYTYPE_INVALID;
394
395	#if defined(IPRT_WITH_OPENSSL)
396	/* Free the encoded form if sensitive (otherwise it follows pThis). */
397	if (pThis->pbEncoded)
398	{
399	if (pThis->fFlags & RTCRKEYINT_F_SENSITIVE)
400	RTMemSaferFree((uint8_t *)pThis->pbEncoded, pThis->cbEncoded);
401	else
402	Assert(pThis->pbEncoded == (uint8_t *)(pThis + 1));
403	pThis->pbEncoded = NULL;
404	}
405	#endif
406
407	/* Finally, free the key object itself. */
408	RTMemFree(pThis);
409	return 0;
410	}
411
412
413	RTDECL(uint32_t) RTCrKeyRelease(RTCRKEY hKey)
414	{
415	if (hKey == NIL_RTCRKEY)
416	return 0;
417	PRTCRKEYINT pThis = hKey;
418	AssertPtrReturn(pThis, UINT32_MAX);
419	AssertReturn(pThis->u32Magic == RTCRKEYINT_MAGIC, UINT32_MAX);
420
421	uint32_t cRefs = ASMAtomicDecU32(&pThis->cRefs);
422	AssertMsg(cRefs < 1024, ("%#x\n", cRefs));
423	if (cRefs != 0)
424	return cRefs;
425	return rtCrKeyDestroy(pThis);
426	}
427
428
429	RTDECL(RTCRKEYTYPE) RTCrKeyGetType(RTCRKEY hKey)
430	{
431	PRTCRKEYINT pThis = hKey;
432	AssertPtrReturn(pThis, RTCRKEYTYPE_INVALID);
433	AssertReturn(pThis->u32Magic == RTCRKEYINT_MAGIC, RTCRKEYTYPE_INVALID);
434	return pThis->enmType;
435	}
436
437
438	RTDECL(bool) RTCrKeyHasPrivatePart(RTCRKEY hKey)
439	{
440	PRTCRKEYINT pThis = hKey;
441	AssertPtrReturn(pThis, false);
442	AssertReturn(pThis->u32Magic == RTCRKEYINT_MAGIC, false);
443	return RT_BOOL(pThis->fFlags & RTCRKEYINT_F_PRIVATE);
444	}
445
446
447	RTDECL(bool) RTCrKeyHasPublicPart(RTCRKEY hKey)
448	{
449	PRTCRKEYINT pThis = hKey;
450	AssertPtrReturn(pThis, false);
451	AssertReturn(pThis->u32Magic == RTCRKEYINT_MAGIC, false);
452	return RT_BOOL(pThis->fFlags & RTCRKEYINT_F_PUBLIC);
453	}
454
455
456	RTDECL(uint32_t) RTCrKeyGetBitCount(RTCRKEY hKey)
457	{
458	PRTCRKEYINT pThis = hKey;
459	AssertPtrReturn(pThis, 0);
460	AssertReturn(pThis->u32Magic == RTCRKEYINT_MAGIC, 0);
461	return pThis->cBits;
462	}
463
464
465	RTDECL(int) RTCrKeyQueryRsaModulus(RTCRKEY hKey, PRTBIGNUM pModulus)
466	{
467	PRTCRKEYINT pThis = hKey;
468	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
469	AssertReturn(pThis->u32Magic == RTCRKEYINT_MAGIC, VERR_INVALID_HANDLE);
470	AssertReturn(pThis->enmType == RTCRKEYTYPE_RSA_PRIVATE \|\| pThis->enmType == RTCRKEYTYPE_RSA_PUBLIC, VERR_WRONG_TYPE);
471	AssertPtrReturn(pModulus, VERR_INVALID_POINTER);
472
473	if (pThis->enmType == RTCRKEYTYPE_RSA_PRIVATE)
474	return RTBigNumAssign(pModulus, &pThis->u.RsaPrivate.Modulus);
475	return RTBigNumAssign(pModulus, &pThis->u.RsaPublic.Modulus);
476	}
477
478
479	RTDECL(int) RTCrKeyQueryRsaPrivateExponent(RTCRKEY hKey, PRTBIGNUM pPrivateExponent)
480	{
481	PRTCRKEYINT pThis = hKey;
482	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
483	AssertReturn(pThis->u32Magic == RTCRKEYINT_MAGIC, VERR_INVALID_HANDLE);
484	AssertReturn(pThis->enmType == RTCRKEYTYPE_RSA_PRIVATE, VERR_WRONG_TYPE);
485	AssertPtrReturn(pPrivateExponent, VERR_INVALID_POINTER);
486
487	return RTBigNumAssign(pPrivateExponent, &pThis->u.RsaPrivate.PrivateExponent);
488	}
489
490
491	RTDECL(int) RTCrKeyVerifyParameterCompatibility(RTCRKEY hKey, PCRTASN1DYNTYPE pParameters, bool fForSignature,
492	PCRTASN1OBJID pAlgorithm, PRTERRINFO pErrInfo)
493	{
494	PRTCRKEYINT pThis = hKey;
495	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
496	AssertReturn(pThis->u32Magic == RTCRKEYINT_MAGIC, VERR_INVALID_HANDLE);
497	RT_NOREF(pAlgorithm);
498
499	switch (pThis->enmType)
500	{
501	/*
502	* No parameters. Ignore NULL.
503	*/
504	case RTCRKEYTYPE_RSA_PRIVATE:
505	case RTCRKEYTYPE_RSA_PUBLIC:
506	if ( !pParameters
507	\|\| pParameters->enmType == RTASN1TYPE_NOT_PRESENT
508	\|\| pParameters->enmType == RTASN1TYPE_NULL)
509	return VINF_SUCCESS;
510	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_CR_KEY_ALGO_PARAMS_UNEXPECTED,
511	"RSA keys does not generally take parameters (enmType=%d)", pParameters->enmType);
512
513	/*
514	* ECDSA requires a parameter. Currently only the named curve choice is supported.
515	* RFC-3279 section 2.2.3 states that for ecdsa-with-SHA1 the parameter MUST be
516	* omitted. ASSUMING the same applies to the other ecdsa-with-xxxx variants.
517	*/
518	case RTCRKEYTYPE_ECDSA_PUBLIC:
519	if (!fForSignature)
520	{
521	/* Key rules: Parameters required. */
522	if (pParameters)
523	{
524	if (pParameters->enmType == RTASN1TYPE_OBJID)
525	{
526	if (RTAsn1ObjId_Compare(&pParameters->u.ObjId, &pThis->u.EcdsaPublic.NamedCurve) == 0)
527	return VINF_SUCCESS;
528	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_CR_KEY_ALGO_PARAMS_MISMATCH,
529	"ECDSA NamedCurve difference: %s, key uses %s",
530	pParameters->u.ObjId.szObjId, pThis->u.EcdsaPublic.NamedCurve.szObjId);
531	}
532	/* We don't implement the other variants. */
533	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_CR_KEY_ALGO_PARAMS_UNKNOWN,
534	"Unexpected ECDSA parameter: enmType=%d", pParameters->enmType);
535	}
536	return RTERRINFO_LOG_SET(pErrInfo, VERR_CR_KEY_ALGO_PARAMS_MISSING, "ECDSA keys requires parameter(s)");
537	}
538
539	/* Hash+ecdsa parameter rules: No parameters */
540	if ( !pParameters
541	\|\| pParameters->enmType == RTASN1TYPE_NOT_PRESENT
542	\|\| pParameters->enmType == RTASN1TYPE_NULL)
543	return VINF_SUCCESS;
544	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_CR_KEY_ALGO_PARAMS_UNEXPECTED,
545	"ECDSA signature should have no parameters (enmType=%d)", pParameters->enmType);
546
547	case RTCRKEYTYPE_ECDSA_PRIVATE:
548	AssertFailedReturn(VERR_NOT_IMPLEMENTED);
549
550	case RTCRKEYTYPE_INVALID:
551	case RTCRKEYTYPE_END:
552	case RTCRKEYTYPE_32BIT_HACK:
553	break;
554	}
555	AssertFailedReturn(VERR_INTERNAL_ERROR_5);
556	}
557

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Runtime/common/crypto/key.cpp@ 105589

Download in other formats: