aescbch.c 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471
  1. /* vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80: */
  2. /*
  3. * Copyright 2016 Red Hat, Inc.
  4. *
  5. * Licensed under the Apache License, Version 2.0 (the "License");
  6. * you may not use this file except in compliance with the License.
  7. * You may obtain a copy of the License at
  8. *
  9. * http://www.apache.org/licenses/LICENSE-2.0
  10. *
  11. * Unless required by applicable law or agreed to in writing, software
  12. * distributed under the License is distributed on an "AS IS" BASIS,
  13. * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14. * See the License for the specific language governing permissions and
  15. * limitations under the License.
  16. */
  17. #include "misc.h"
  18. #include <jose/b64.h>
  19. #include "../hooks.h"
  20. #include "../misc.h"
  21. #include <openssl/rand.h>
  22. #include <openssl/sha.h>
  23. #include <string.h>
  24. #define NAMES "A128CBC-HS256", "A192CBC-HS384", "A256CBC-HS512"
  25. typedef struct {
  26. jose_io_t io;
  27. EVP_CIPHER_CTX *cctx;
  28. jose_io_t *next;
  29. HMAC_CTX *hctx;
  30. json_t *json;
  31. uint64_t al;
  32. } io_t;
  33. static uint64_t
  34. h2be64(uint64_t x)
  35. {
  36. union swap {
  37. uint64_t i;
  38. uint8_t b[8];
  39. } y;
  40. y.b[0] = x >> 0x38;
  41. y.b[1] = x >> 0x30;
  42. y.b[2] = x >> 0x28;
  43. y.b[3] = x >> 0x20;
  44. y.b[4] = x >> 0x18;
  45. y.b[5] = x >> 0x10;
  46. y.b[6] = x >> 0x08;
  47. y.b[7] = x >> 0x00;
  48. return y.i;
  49. }
  50. static json_int_t
  51. alg2len(const char *alg)
  52. {
  53. switch (str2enum(alg, NAMES, NULL)) {
  54. case 0: return 32;
  55. case 1: return 48;
  56. case 2: return 64;
  57. default: return 0;
  58. }
  59. }
  60. static bool
  61. jwk_prep_handles(jose_cfg_t *cfg, const json_t *jwk)
  62. {
  63. const char *alg = NULL;
  64. if (json_unpack((json_t *) jwk, "{s:s}", "alg", &alg) == -1)
  65. return false;
  66. return alg2len(alg) != 0;
  67. }
  68. static bool
  69. jwk_prep_execute(jose_cfg_t *cfg, json_t *jwk)
  70. {
  71. const char *alg = NULL;
  72. const char *kty = NULL;
  73. json_int_t byt = 0;
  74. json_int_t len = 0;
  75. if (json_unpack(jwk, "{s:s,s?s,s?I}",
  76. "alg", &alg, "kty", &kty, "bytes", &byt) == -1)
  77. return false;
  78. len = alg2len(alg);
  79. if (len == 0)
  80. return false;
  81. if (byt != 0 && len != byt)
  82. return false;
  83. if (kty && strcmp(kty, "oct") != 0)
  84. return false;
  85. if (json_object_set_new(jwk, "kty", json_string("oct")) < 0)
  86. return false;
  87. if (json_object_set_new(jwk, "bytes", json_integer(len)) < 0)
  88. return false;
  89. return true;
  90. }
  91. static const char *
  92. alg_encr_sug(const jose_hook_alg_t *alg, jose_cfg_t *cfg, const json_t *cek)
  93. {
  94. const char *name = NULL;
  95. const char *type = NULL;
  96. size_t len = 0;
  97. if (json_unpack((json_t *) cek, "{s?s,s?s}",
  98. "alg", &name, "kty", &type) < 0)
  99. return NULL;
  100. if (name)
  101. return str2enum(name, NAMES, NULL) != SIZE_MAX ? name : NULL;
  102. if (!type || strcmp(type, "oct") != 0)
  103. return NULL;
  104. len = jose_b64_dec(json_object_get(cek, "k"), NULL, 0);
  105. if (len >= SHA512_DIGEST_LENGTH)
  106. return "A256CBC-HS512";
  107. else if (len >= SHA384_DIGEST_LENGTH)
  108. return "A192CBC-HS384";
  109. else if (len >= SHA256_DIGEST_LENGTH)
  110. return "A128CBC-HS256";
  111. return NULL;
  112. }
  113. static void
  114. io_free(jose_io_t *io)
  115. {
  116. io_t *i = containerof(io, io_t, io);
  117. EVP_CIPHER_CTX_free(i->cctx);
  118. jose_io_decref(i->next);
  119. HMAC_CTX_free(i->hctx);
  120. json_decref(i->json);
  121. free(i);
  122. }
  123. static bool
  124. enc_feed(jose_io_t *io, const void *in, size_t len)
  125. {
  126. io_t *i = containerof(io, io_t, io);
  127. uint8_t ct[EVP_CIPHER_CTX_block_size(i->cctx) + 1];
  128. uint8_t *pt = NULL;
  129. size_t ptlen = 0;
  130. if (!handle_zip_enc(i->json, in, len, (void**)&pt, &ptlen))
  131. return false;
  132. for (size_t j = 0; j < ptlen; j++) {
  133. int l = 0;
  134. if (EVP_EncryptUpdate(i->cctx, ct, &l, &pt[j], 1) <= 0)
  135. return false;
  136. if (!i->next->feed(i->next, ct, l))
  137. return false;
  138. if (HMAC_Update(i->hctx, ct, l) <= 0)
  139. return false;
  140. }
  141. return true;
  142. }
  143. static bool
  144. enc_done(jose_io_t *io)
  145. {
  146. io_t *i = containerof(io, io_t, io);
  147. uint8_t ct[EVP_CIPHER_CTX_block_size(i->cctx) + 1];
  148. uint8_t tg[EVP_MD_size(HMAC_CTX_get_md(i->hctx))];
  149. int l = 0;
  150. if (EVP_EncryptFinal(i->cctx, ct, &l) <= 0)
  151. return false;
  152. if (!i->next->feed(i->next, ct, l) || !i->next->done(i->next))
  153. return false;
  154. if (HMAC_Update(i->hctx, ct, l) <= 0)
  155. return false;
  156. if (HMAC_Update(i->hctx, (void *) &i->al, sizeof(i->al)) <= 0)
  157. return false;
  158. if (HMAC_Final(i->hctx, tg, NULL) <= 0)
  159. return false;
  160. if (json_object_set_new(i->json, "tag",
  161. jose_b64_enc(tg, sizeof(tg) / 2)) < 0)
  162. return false;
  163. return true;
  164. }
  165. static bool
  166. dec_feed(jose_io_t *io, const void *in, size_t len)
  167. {
  168. io_t *i = containerof(io, io_t, io);
  169. uint8_t pt[EVP_CIPHER_CTX_block_size(i->cctx) + 1];
  170. const uint8_t *ct = in;
  171. bool ret = false;
  172. int l = 0;
  173. if (HMAC_Update(i->hctx, in, len) <= 0)
  174. return false;
  175. for (size_t j = 0; j < len; j++) {
  176. if (EVP_DecryptUpdate(i->cctx, pt, &l, &ct[j], 1) <= 0)
  177. goto egress;
  178. if (!i->next->feed(i->next, pt, l))
  179. goto egress;
  180. }
  181. ret = true;
  182. egress:
  183. OPENSSL_cleanse(pt, sizeof(pt));
  184. return ret;
  185. }
  186. static bool
  187. dec_done(jose_io_t *io)
  188. {
  189. io_t *i = containerof(io, io_t, io);
  190. uint8_t pt[EVP_CIPHER_CTX_block_size(i->cctx) + 1];
  191. uint8_t tg[EVP_MD_size(HMAC_CTX_get_md(i->hctx))];
  192. uint8_t bf[sizeof(tg) / 2];
  193. json_t *tag = NULL;
  194. int l = 0;
  195. tag = json_object_get(i->json, "tag");
  196. if (!tag)
  197. return false;
  198. if (jose_b64_dec(tag, NULL, 0) != sizeof(bf))
  199. return false;
  200. if (jose_b64_dec(tag, bf, sizeof(bf)) != sizeof(bf))
  201. return false;
  202. if (HMAC_Update(i->hctx, (void *) &i->al, sizeof(i->al)) <= 0)
  203. return false;
  204. if (HMAC_Final(i->hctx, tg, NULL) <= 0)
  205. return false;
  206. if (CRYPTO_memcmp(tg, bf, sizeof(bf)) != 0)
  207. return false;
  208. if (EVP_DecryptFinal(i->cctx, pt, &l) <= 0)
  209. return false;
  210. if (!i->next->feed(i->next, pt, l) || !i->next->done(i->next)) {
  211. OPENSSL_cleanse(pt, sizeof(pt));
  212. return false;
  213. }
  214. OPENSSL_cleanse(pt, sizeof(pt));
  215. return true;
  216. }
  217. static bool
  218. setup(const EVP_CIPHER *cph, const EVP_MD *md, jose_cfg_t *cfg,
  219. const json_t *jwe, const json_t *cek, uint8_t *iv,
  220. typeof(EVP_EncryptInit) func, io_t *i)
  221. {
  222. uint8_t key[EVP_CIPHER_key_length(cph) * 2];
  223. const char *aad = NULL;
  224. const char *prt = "";
  225. if (jose_b64_dec(json_object_get(cek, "k"), NULL, 0) != sizeof(key))
  226. return false;
  227. if (json_unpack((json_t *) jwe, "{s?s,s?s}",
  228. "aad", &aad, "protected", &prt) < 0)
  229. return false;
  230. i->cctx = EVP_CIPHER_CTX_new();
  231. if (!i->cctx)
  232. return false;
  233. i->hctx = HMAC_CTX_new();
  234. if (!i->hctx)
  235. return false;
  236. if (jose_b64_dec(json_object_get(cek, "k"), NULL, 0) != sizeof(key))
  237. return false;
  238. if (jose_b64_dec(json_object_get(cek, "k"), key,
  239. sizeof(key)) != sizeof(key)) {
  240. OPENSSL_cleanse(key, sizeof(key));
  241. return false;
  242. }
  243. if (HMAC_Init_ex(i->hctx, key, sizeof(key) / 2, md, NULL) <= 0) {
  244. OPENSSL_cleanse(key, sizeof(key));
  245. return false;
  246. }
  247. if (func(i->cctx, cph, &key[sizeof(key) / 2], iv) <= 0) {
  248. OPENSSL_cleanse(key, sizeof(key));
  249. return false;
  250. }
  251. OPENSSL_cleanse(key, sizeof(key));
  252. i->al += strlen(prt);
  253. if (HMAC_Update(i->hctx, (void *) prt, strlen(prt)) <= 0)
  254. return false;
  255. if (aad) {
  256. i->al += 1;
  257. if (HMAC_Update(i->hctx, (void *) ".", 1) <= 0)
  258. return false;
  259. i->al += strlen(aad);
  260. if (HMAC_Update(i->hctx, (void *) aad, strlen(aad)) <= 0)
  261. return false;
  262. }
  263. i->al = h2be64(i->al * 8);
  264. if (HMAC_Update(i->hctx, iv, EVP_CIPHER_iv_length(cph)) <= 0)
  265. return false;
  266. return true;
  267. }
  268. static jose_io_t *
  269. alg_encr_enc(const jose_hook_alg_t *alg, jose_cfg_t *cfg, json_t *jwe,
  270. const json_t *cek, jose_io_t *next)
  271. {
  272. const EVP_CIPHER *cph = NULL;
  273. jose_io_auto_t *io = NULL;
  274. const EVP_MD *md = NULL;
  275. io_t *i = NULL;
  276. switch (str2enum(alg->name, NAMES, NULL)) {
  277. case 0: cph = EVP_aes_128_cbc(); md = EVP_sha256(); break;
  278. case 1: cph = EVP_aes_192_cbc(); md = EVP_sha384(); break;
  279. case 2: cph = EVP_aes_256_cbc(); md = EVP_sha512(); break;
  280. default: return NULL;
  281. }
  282. uint8_t iv[EVP_CIPHER_iv_length(cph)];
  283. if (RAND_bytes(iv, sizeof(iv)) <= 0)
  284. return NULL;
  285. i = calloc(1, sizeof(*i));
  286. if (!i)
  287. return NULL;
  288. io = jose_io_incref(&i->io);
  289. io->feed = enc_feed;
  290. io->done = enc_done;
  291. io->free = io_free;
  292. i->json = json_incref(jwe);
  293. i->next = jose_io_incref(next);
  294. if (!i->json || !i->next)
  295. return NULL;
  296. if (!setup(cph, md, cfg, jwe, cek, iv, EVP_EncryptInit, i))
  297. return NULL;
  298. if (json_object_set_new(jwe, "iv", jose_b64_enc(iv, sizeof(iv))) < 0)
  299. return NULL;
  300. return jose_io_incref(io);
  301. }
  302. static jose_io_t *
  303. alg_encr_dec(const jose_hook_alg_t *alg, jose_cfg_t *cfg, const json_t *jwe,
  304. const json_t *cek, jose_io_t *next)
  305. {
  306. const EVP_CIPHER *cph = NULL;
  307. jose_io_auto_t *io = NULL;
  308. const EVP_MD *md = NULL;
  309. io_t *i = NULL;
  310. switch (str2enum(alg->name, NAMES, NULL)) {
  311. case 0: cph = EVP_aes_128_cbc(); md = EVP_sha256(); break;
  312. case 1: cph = EVP_aes_192_cbc(); md = EVP_sha384(); break;
  313. case 2: cph = EVP_aes_256_cbc(); md = EVP_sha512(); break;
  314. default: return NULL;
  315. }
  316. uint8_t iv[EVP_CIPHER_iv_length(cph)];
  317. if (jose_b64_dec(json_object_get(jwe, "iv"), NULL, 0) != sizeof(iv))
  318. return NULL;
  319. if (jose_b64_dec(json_object_get(jwe, "iv"), iv, sizeof(iv)) != sizeof(iv))
  320. return NULL;
  321. i = calloc(1, sizeof(*i));
  322. if (!i)
  323. return NULL;
  324. io = jose_io_incref(&i->io);
  325. io->feed = dec_feed;
  326. io->done = dec_done;
  327. io->free = io_free;
  328. i->json = json_incref((json_t *) jwe);
  329. i->next = jose_io_incref(next);
  330. if (!i->json || !i->next)
  331. return NULL;
  332. if (!setup(cph, md, cfg, jwe, cek, iv, EVP_DecryptInit, i))
  333. return NULL;
  334. return jose_io_incref(io);
  335. }
  336. static void __attribute__((constructor))
  337. constructor(void)
  338. {
  339. static jose_hook_jwk_t jwk = {
  340. .kind = JOSE_HOOK_JWK_KIND_PREP,
  341. .prep.handles = jwk_prep_handles,
  342. .prep.execute = jwk_prep_execute,
  343. };
  344. static jose_hook_alg_t algs[] = {
  345. { .kind = JOSE_HOOK_ALG_KIND_ENCR,
  346. .name = "A128CBC-HS256",
  347. .encr.eprm = "encrypt",
  348. .encr.dprm = "decrypt",
  349. .encr.sug = alg_encr_sug,
  350. .encr.enc = alg_encr_enc,
  351. .encr.dec = alg_encr_dec },
  352. { .kind = JOSE_HOOK_ALG_KIND_ENCR,
  353. .name = "A192CBC-HS384",
  354. .encr.eprm = "encrypt",
  355. .encr.dprm = "decrypt",
  356. .encr.sug = alg_encr_sug,
  357. .encr.enc = alg_encr_enc,
  358. .encr.dec = alg_encr_dec },
  359. { .kind = JOSE_HOOK_ALG_KIND_ENCR,
  360. .name = "A256CBC-HS512",
  361. .encr.eprm = "encrypt",
  362. .encr.dprm = "decrypt",
  363. .encr.sug = alg_encr_sug,
  364. .encr.enc = alg_encr_enc,
  365. .encr.dec = alg_encr_dec },
  366. {}
  367. };
  368. jose_hook_jwk_push(&jwk);
  369. for (size_t i = 0; algs[i].name; i++)
  370. jose_hook_alg_push(&algs[i]);
  371. }