pkix-sign.cpp@ 98103

Last change on this file since 98103 was 98103, checked in by vboxsync, 23 months ago
Copyright year updates by scm.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 11.3 KB

Line
1	/* $Id: pkix-sign.cpp 98103 2023-01-17 14:15:46Z vboxsync $ */
2	/** @file
3	* IPRT - Crypto - Public Key Infrastructure API, Verification.
4	*/
5
6	/*
7	* Copyright (C) 2006-2023 Oracle and/or its affiliates.
8	*
9	* This file is part of VirtualBox base platform packages, as
10	* available from https://www.virtualbox.org.
11	*
12	* This program is free software; you can redistribute it and/or
13	* modify it under the terms of the GNU General Public License
14	* as published by the Free Software Foundation, in version 3 of the
15	* License.
16	*
17	* This program is distributed in the hope that it will be useful, but
18	* WITHOUT ANY WARRANTY; without even the implied warranty of
19	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20	* General Public License for more details.
21	*
22	* You should have received a copy of the GNU General Public License
23	* along with this program; if not, see <https://www.gnu.org/licenses>.
24	*
25	* The contents of this file may alternatively be used under the terms
26	* of the Common Development and Distribution License Version 1.0
27	* (CDDL), a copy of it is provided in the "COPYING.CDDL" file included
28	* in the VirtualBox distribution, in which case the provisions of the
29	* CDDL are applicable instead of those of the GPL.
30	*
31	* You may elect to license modified versions of this file under the
32	* terms and conditions of either the GPL or the CDDL or both.
33	*
34	* SPDX-License-Identifier: GPL-3.0-only OR CDDL-1.0
35	*/
36
37
38	/*********************************************************************************************************************************
39	* Header Files *
40	*********************************************************************************************************************************/
41	#include "internal/iprt.h"
42	#include <iprt/crypto/pkix.h>
43
44	#include <iprt/alloca.h>
45	#include <iprt/err.h>
46	#include <iprt/mem.h>
47	#include <iprt/string.h>
48	#include <iprt/crypto/digest.h>
49	#include <iprt/crypto/key.h>
50
51	#ifdef IPRT_WITH_OPENSSL
52	# include "internal/iprt-openssl.h"
53	# include "internal/openssl-pre.h"
54	# include <openssl/evp.h>
55	# include <openssl/rsa.h>
56	# include "internal/openssl-post.h"
57	# ifndef OPENSSL_VERSION_NUMBER
58	# error "Missing OPENSSL_VERSION_NUMBER!"
59	# endif
60	#endif
61
62
63	#if 0
64	RTDECL(int) RTCrPkixPubKeySignData(PCRTASN1OBJID pAlgorithm, PCRTASN1DYNTYPE pParameters, PCRTASN1BITSTRING pPrivateKey,
65	PCRTASN1BITSTRING pSignatureValue, const void *pvData, size_t cbData, PRTERRINFO pErrInfo)
66	{
67	/*
68	* Validate the digest related inputs.
69	*/
70	AssertPtrReturn(pAlgorithm, VERR_INVALID_POINTER);
71	AssertReturn(RTAsn1ObjId_IsPresent(pAlgorithm), VERR_INVALID_POINTER);
72
73	AssertPtrReturn(pvData, VERR_INVALID_POINTER);
74	AssertReturn(cbData > 0, VERR_INVALID_PARAMETER);
75
76	/*
77	* Digest the data and call the other API.
78	*/
79	RTCRDIGEST hDigest;
80	int rc = RTCrDigestCreateByObjId(&hDigest, pAlgorithm);
81	if (RT_SUCCESS(rcIprt))
82	{
83	rc = RTCrDigestUpdate(hDigest, pvData, cbData);
84	if (RT_SUCCESS(rcIprt))
85	rc = RTCrPkixPubKeySignDigest(pAlgorithm, pParameters, pPrivateKey, pvSignedDigest, cbSignedDigest, hDigest, pErrInfo);
86	else
87	RTErrInfoSet(pErrInfo, rcIprt, "RTCrDigestUpdate failed");
88	RTCrDigestRelease(hDigest);
89	}
90	else
91	RTErrInfoSetF(pErrInfo, rcIprt, "Unknown digest algorithm [IPRT]: %s", pAlgorithm->szObjId);
92	return rc;
93	}
94	#endif
95
96
97	RTDECL(int) RTCrPkixPubKeySignDigest(PCRTASN1OBJID pAlgorithm, RTCRKEY hPrivateKey, PCRTASN1DYNTYPE pParameters,
98	RTCRDIGEST hDigest, uint32_t fFlags,
99	void pvSignature, size_t pcbSignature, PRTERRINFO pErrInfo)
100	{
101	/*
102	* Valid input.
103	*/
104	AssertPtrReturn(pAlgorithm, VERR_INVALID_POINTER);
105	AssertReturn(RTAsn1ObjId_IsPresent(pAlgorithm), VERR_INVALID_POINTER);
106
107	if (pParameters)
108	{
109	AssertPtrReturn(pParameters, VERR_INVALID_POINTER);
110	if (pParameters->enmType == RTASN1TYPE_NULL)
111	pParameters = NULL;
112	}
113
114	AssertPtrReturn(hPrivateKey, VERR_INVALID_POINTER);
115	Assert(RTCrKeyHasPrivatePart(hPrivateKey));
116
117	AssertPtrReturn(pcbSignature, VERR_INVALID_PARAMETER);
118	size_t cbSignature = *pcbSignature;
119	if (cbSignature)
120	AssertPtrReturn(pvSignature, VERR_INVALID_POINTER);
121	else
122	pvSignature = NULL;
123
124	AssertPtrReturn(hDigest, VERR_INVALID_HANDLE);
125
126	AssertReturn(fFlags == 0, VERR_INVALID_FLAGS);
127
128	/*
129	* Parameters are not currently supported (openssl code path).
130	*/
131	if (pParameters)
132	return RTErrInfoSet(pErrInfo, VERR_CR_PKIX_CIPHER_ALGO_PARAMS_NOT_IMPL,
133	"Cipher algorithm parameters are not yet supported.");
134
135	/*
136	* Sign using IPRT.
137	*/
138	RTCRPKIXSIGNATURE hSignature;
139	int rcIprt = RTCrPkixSignatureCreateByObjId(&hSignature, pAlgorithm, hPrivateKey, pParameters, true /fSigning/);
140	if (RT_FAILURE(rcIprt))
141	return RTErrInfoSetF(pErrInfo, VERR_CR_PKIX_CIPHER_ALGO_NOT_KNOWN,
142	"Unknown private key algorithm [IPRT]: %s", pAlgorithm->szObjId);
143
144	rcIprt = RTCrPkixSignatureSign(hSignature, hDigest, pvSignature, pcbSignature);
145	if (RT_FAILURE(rcIprt))
146	RTErrInfoSet(pErrInfo, rcIprt, "RTCrPkixSignatureSign failed");
147
148	RTCrPkixSignatureRelease(hSignature);
149
150	/*
151	* Sign using OpenSSL EVP if we can.
152	*/
153	#if defined(IPRT_WITH_OPENSSL) \
154	&& (OPENSSL_VERSION_NUMBER > 0x10000000L) /* 0.9.8 doesn't seem to have EVP_PKEY_CTX_set_signature_md. */
155
156	/* Make sure the algorithm includes the digest and isn't just RSA. */
157	const char *pszAlgObjId = pAlgorithm->szObjId;
158	if (!strcmp(pszAlgObjId, RTCRX509ALGORITHMIDENTIFIERID_RSA))
159	{
160	pszAlgObjId = RTCrX509AlgorithmIdentifier_CombineEncryptionOidAndDigestOid(pszAlgObjId,
161	RTCrDigestGetAlgorithmOid(hDigest));
162	AssertMsgStmt(pszAlgObjId, ("enc=%s hash=%s\n", pAlgorithm->szObjId, RTCrDigestGetAlgorithmOid(hDigest)),
163	pszAlgObjId = RTCrDigestGetAlgorithmOid(hDigest));
164	}
165
166	/* Create an EVP private key. */
167	EVP_PKEY *pEvpPrivateKey = NULL;
168	const EVP_MD *pEvpMdType = NULL;
169	int rcOssl = rtCrKeyToOpenSslKeyEx(hPrivateKey, false /fNeedPublic/, pszAlgObjId,
170	(void )&pEvpPrivateKey, (const void )&pEvpMdType, pErrInfo);
171	if (RT_SUCCESS(rcOssl))
172	{
173	/* Create an EVP Private key context we can use to validate the digest. */
174	EVP_PKEY_CTX *pEvpPKeyCtx = EVP_PKEY_CTX_new(pEvpPrivateKey, NULL);
175	if (pEvpPKeyCtx)
176	{
177	rcOssl = EVP_PKEY_sign_init(pEvpPKeyCtx);
178	if (rcOssl > 0)
179	{
180	rcOssl = EVP_PKEY_CTX_set_rsa_padding(pEvpPKeyCtx, RSA_PKCS1_PADDING);
181	if (rcOssl > 0)
182	{
183	rcOssl = EVP_PKEY_CTX_set_signature_md(pEvpPKeyCtx, pEvpMdType);
184	if (rcOssl > 0)
185	{
186	/* Allocate a signature buffer. */
187	unsigned char *pbOsslSignature = NULL;
188	void *pvOsslSignatureFree = NULL;
189	size_t cbOsslSignature = cbSignature;
190	if (cbOsslSignature > 0)
191	{
192	if (cbOsslSignature < _1K)
193	pbOsslSignature = (unsigned char *)alloca(cbOsslSignature);
194	else
195	{
196	pbOsslSignature = (unsigned char *)RTMemTmpAlloc(cbOsslSignature);
197	pvOsslSignatureFree = pbOsslSignature;
198	}
199	}
200	if (cbOsslSignature == 0 \|\| pbOsslSignature != NULL)
201	{
202	/* Get the digest from hDigest and sign it. */
203	rcOssl = EVP_PKEY_sign(pEvpPKeyCtx,
204	pbOsslSignature,
205	&cbOsslSignature,
206	(const unsigned char *)RTCrDigestGetHash(hDigest),
207	RTCrDigestGetHashSize(hDigest));
208	if (rcOssl > 0)
209	{
210	/* Compare the result. The memcmp assums no random padding bits. */
211	rcOssl = VINF_SUCCESS;
212	AssertMsgStmt(cbOsslSignature == *pcbSignature,
213	("cbOsslSignature=%#x, iprt %#x\n", cbOsslSignature, *pcbSignature),
214	rcOssl = VERR_CR_PKIX_OSSL_VS_IPRT_SIGNATURE_SIZE);
215	AssertMsgStmt( pbOsslSignature == NULL
216	\|\| rcOssl != VINF_SUCCESS
217	\|\| memcmp(pbOsslSignature, pvSignature, cbOsslSignature) == 0,
218	("OpenSSL: %.*Rhxs\n"
219	"IPRT: %.*Rhxs\n",
220	cbOsslSignature, pbOsslSignature, *pcbSignature, pvSignature),
221	rcOssl = VERR_CR_PKIX_OSSL_VS_IPRT_SIGNATURE);
222	if (!pbOsslSignature && rcOssl == VINF_SUCCESS)
223	rcOssl = VERR_BUFFER_OVERFLOW;
224	}
225	else
226	rcOssl = RTErrInfoSetF(pErrInfo, VERR_CR_PKIX_OSSL_SIGN_FINAL_FAILED,
227	"EVP_PKEY_sign failed (%d)", rcOssl);
228	if (pvOsslSignatureFree)
229	RTMemTmpFree(pvOsslSignatureFree);
230	}
231	else
232	rcOssl = VERR_NO_TMP_MEMORY;
233	}
234	else
235	rcOssl = RTErrInfoSetF(pErrInfo, VERR_CR_PKIX_OSSL_EVP_PKEY_TYPE_ERROR,
236	"EVP_PKEY_CTX_set_signature_md failed (%d)", rcOssl);
237	}
238	else
239	rcOssl = RTErrInfoSetF(pErrInfo, VERR_CR_PKIX_OSSL_EVP_PKEY_RSA_PAD_ERROR,
240	"EVP_PKEY_CTX_set_rsa_padding failed (%d)", rcOssl);
241	}
242	else
243	rcOssl = RTErrInfoSetF(pErrInfo, VERR_CR_PKIX_OSSL_EVP_PKEY_TYPE_ERROR,
244	"EVP_PKEY_verify_init failed (%d)", rcOssl);
245	EVP_PKEY_CTX_free(pEvpPKeyCtx);
246	}
247	else
248	rcOssl = RTErrInfoSet(pErrInfo, VERR_CR_PKIX_OSSL_EVP_PKEY_TYPE_ERROR, "EVP_PKEY_CTX_new failed");
249	EVP_PKEY_free(pEvpPrivateKey);
250	}
251
252	/*
253	* Check the result.
254	*/
255	if ( (RT_SUCCESS(rcIprt) && RT_SUCCESS(rcOssl))
256	\|\| (RT_FAILURE_NP(rcIprt) && RT_FAILURE_NP(rcOssl))
257	\|\| (RT_SUCCESS(rcIprt) && rcOssl == VERR_CR_PKIX_OSSL_CIPHER_ALGO_NOT_KNOWN_EVP) )
258	return rcIprt;
259	AssertMsgFailed(("rcIprt=%Rrc rcOssl=%Rrc\n", rcIprt, rcOssl));
260	if (RT_FAILURE_NP(rcOssl))
261	return rcOssl;
262	#endif /* IPRT_WITH_OPENSSL */
263
264	return rcIprt;
265	}
266

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Runtime/common/crypto/pkix-sign.cpp@ 98103

Download in other formats: