1
0

aesgcm.c 10.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409
  1. /* vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80: */
  2. /*
  3. * Copyright 2016 Red Hat, Inc.
  4. *
  5. * Licensed under the Apache License, Version 2.0 (the "License");
  6. * you may not use this file except in compliance with the License.
  7. * You may obtain a copy of the License at
  8. *
  9. * http://www.apache.org/licenses/LICENSE-2.0
  10. *
  11. * Unless required by applicable law or agreed to in writing, software
  12. * distributed under the License is distributed on an "AS IS" BASIS,
  13. * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14. * See the License for the specific language governing permissions and
  15. * limitations under the License.
  16. */
  17. #include "misc.h"
  18. #include <jose/b64.h>
  19. #include "../hooks.h"
  20. #include "../misc.h"
  21. #include <openssl/rand.h>
  22. #include <string.h>
  23. #define NAMES "A128GCM", "A192GCM", "A256GCM"
  24. typedef struct {
  25. jose_io_t io;
  26. EVP_CIPHER_CTX *cctx;
  27. jose_io_t *next;
  28. json_t *json;
  29. } io_t;
  30. static EVP_CIPHER_CTX *
  31. setup(const EVP_CIPHER *cph, jose_cfg_t *cfg, const json_t *jwe,
  32. const json_t *cek, const uint8_t iv[],
  33. typeof(EVP_EncryptInit_ex) *init, typeof(EVP_EncryptUpdate) *push)
  34. {
  35. uint8_t key[EVP_CIPHER_key_length(cph)];
  36. EVP_CIPHER_CTX *ecc = NULL;
  37. const char *aad = NULL;
  38. const char *prt = NULL;
  39. size_t aadl = 0;
  40. size_t prtl = 0;
  41. int tmp;
  42. if (json_unpack((json_t *) jwe, "{s?s%,s?s%}",
  43. "aad", &aad, &aadl, "protected", &prt, &prtl) < 0)
  44. goto error;
  45. ecc = EVP_CIPHER_CTX_new();
  46. if (!ecc)
  47. return NULL;
  48. if (init(ecc, cph, NULL, NULL, NULL) <= 0)
  49. goto error;
  50. if (jose_b64_dec(json_object_get(cek, "k"), NULL, 0) != sizeof(key))
  51. goto error;
  52. if (jose_b64_dec(json_object_get(cek, "k"), key,
  53. sizeof(key)) != sizeof(key)) {
  54. OPENSSL_cleanse(key, sizeof(key));
  55. goto error;
  56. }
  57. tmp = init(ecc, NULL, NULL, key, iv);
  58. OPENSSL_cleanse(key, sizeof(key));
  59. if (tmp <= 0)
  60. goto error;
  61. if (prt && push(ecc, NULL, &tmp, (uint8_t *) prt, prtl) <= 0)
  62. goto error;
  63. if (aad) {
  64. if (push(ecc, NULL, &tmp, (uint8_t *) ".", 1) <= 0)
  65. goto error;
  66. if (push(ecc, NULL, &tmp, (uint8_t *) aad, prtl) <= 0)
  67. goto error;
  68. }
  69. return ecc;
  70. error:
  71. EVP_CIPHER_CTX_free(ecc);
  72. return NULL;
  73. }
  74. static void
  75. io_free(jose_io_t *io)
  76. {
  77. io_t *i = containerof(io, io_t, io);
  78. EVP_CIPHER_CTX_free(i->cctx);
  79. jose_io_decref(i->next);
  80. json_decref(i->json);
  81. free(i);
  82. }
  83. static bool
  84. enc_feed(jose_io_t *io, const void *in, size_t len)
  85. {
  86. io_t *i = containerof(io, io_t, io);
  87. int l = 0;
  88. uint8_t *pt = NULL;
  89. size_t ptlen = 0;
  90. if (!handle_zip_enc(i->json, in, len, (void**)&pt, &ptlen))
  91. return false;
  92. for (size_t j = 0; j < ptlen; j++) {
  93. uint8_t ct[EVP_CIPHER_CTX_block_size(i->cctx) + 1];
  94. if (EVP_EncryptUpdate(i->cctx, ct, &l, &pt[j], 1) <= 0)
  95. return false;
  96. if (!i->next->feed(i->next, ct, l))
  97. return false;
  98. }
  99. return true;
  100. }
  101. static bool
  102. enc_done(jose_io_t *io)
  103. {
  104. io_t *i = containerof(io, io_t, io);
  105. uint8_t ct[EVP_CIPHER_CTX_block_size(i->cctx) + 1];
  106. uint8_t tg[EVP_GCM_TLS_TAG_LEN] = {};
  107. int l = 0;
  108. if (EVP_EncryptFinal(i->cctx, ct, &l) <= 0)
  109. return false;
  110. if (!i->next->feed(i->next, ct, l) || !i->next->done(i->next))
  111. return false;
  112. if (EVP_CIPHER_CTX_ctrl(i->cctx, EVP_CTRL_GCM_GET_TAG, sizeof(tg), tg) <= 0)
  113. return false;
  114. if (json_object_set_new(i->json, "tag",
  115. jose_b64_enc(tg, sizeof(tg))) < 0)
  116. return false;
  117. return true;
  118. }
  119. static bool
  120. dec_feed(jose_io_t *io, const void *in, size_t len)
  121. {
  122. io_t *i = containerof(io, io_t, io);
  123. uint8_t pt[EVP_CIPHER_CTX_block_size(i->cctx) + 1];
  124. const uint8_t *ct = in;
  125. bool ret = false;
  126. int l = 0;
  127. for (size_t j = 0; j < len; j++) {
  128. if (EVP_DecryptUpdate(i->cctx, pt, &l, &ct[j], 1) <= 0)
  129. goto egress;
  130. if (i->next->feed(i->next, pt, l) != (size_t) l)
  131. goto egress;
  132. }
  133. ret = true;
  134. egress:
  135. OPENSSL_cleanse(pt, sizeof(pt));
  136. return ret;
  137. }
  138. static bool
  139. dec_done(jose_io_t *io)
  140. {
  141. io_t *i = containerof(io, io_t, io);
  142. uint8_t pt[EVP_CIPHER_CTX_block_size(i->cctx) + 1];
  143. uint8_t tg[EVP_GCM_TLS_TAG_LEN] = {};
  144. json_t *tag = NULL;
  145. int l = 0;
  146. tag = json_object_get(i->json, "tag");
  147. if (!tag)
  148. return false;
  149. if (jose_b64_dec(tag, NULL, 0) != sizeof(tg))
  150. return false;
  151. if (jose_b64_dec(tag, tg, sizeof(tg)) != sizeof(tg))
  152. return false;
  153. if (EVP_CIPHER_CTX_ctrl(i->cctx, EVP_CTRL_GCM_SET_TAG,
  154. sizeof(tg), tg) <= 0)
  155. return false;
  156. if (EVP_DecryptFinal(i->cctx, pt, &l) <= 0)
  157. return false;
  158. if (!i->next->feed(i->next, pt, l) || !i->next->done(i->next)) {
  159. OPENSSL_cleanse(pt, sizeof(pt));
  160. return false;
  161. }
  162. OPENSSL_cleanse(pt, sizeof(pt));
  163. return true;
  164. }
  165. static json_int_t
  166. alg2len(const char *alg)
  167. {
  168. switch (str2enum(alg, NAMES, NULL)) {
  169. case 0: return 16;
  170. case 1: return 24;
  171. case 2: return 32;
  172. default: return 0;
  173. }
  174. }
  175. static bool
  176. jwk_prep_handles(jose_cfg_t *cfg, const json_t *jwk)
  177. {
  178. const char *alg = NULL;
  179. if (json_unpack((json_t *) jwk, "{s:s}", "alg", &alg) == -1)
  180. return false;
  181. return alg2len(alg) != 0;
  182. }
  183. static bool
  184. jwk_prep_execute(jose_cfg_t *cfg, json_t *jwk)
  185. {
  186. const char *alg = NULL;
  187. const char *kty = NULL;
  188. json_int_t byt = 0;
  189. json_int_t len = 0;
  190. if (json_unpack(jwk, "{s:s,s?s,s?I}",
  191. "alg", &alg, "kty", &kty, "bytes", &byt) == -1)
  192. return false;
  193. len = alg2len(alg);
  194. if (len == 0)
  195. return false;
  196. if (byt != 0 && len != byt)
  197. return false;
  198. if (kty && strcmp(kty, "oct") != 0)
  199. return false;
  200. if (json_object_set_new(jwk, "kty", json_string("oct")) < 0)
  201. return false;
  202. if (json_object_set_new(jwk, "bytes", json_integer(len)) < 0)
  203. return false;
  204. return true;
  205. }
  206. static const char *
  207. alg_encr_sug(const jose_hook_alg_t *alg, jose_cfg_t *cfg, const json_t *cek)
  208. {
  209. const char *name = NULL;
  210. const char *type = NULL;
  211. if (json_unpack((json_t *) cek, "{s?s,s?s}",
  212. "alg", &name, "kty", &type) < 0)
  213. return NULL;
  214. if (name)
  215. return str2enum(name, NAMES, NULL) != SIZE_MAX ? name : NULL;
  216. if (!type || strcmp(type, "oct") != 0)
  217. return NULL;
  218. switch (jose_b64_dec(json_object_get(cek, "k"), NULL, 0)) {
  219. case 16: return "A128GCM";
  220. case 24: return "A192GCM";
  221. case 32: return "A256GCM";
  222. default: return NULL;
  223. }
  224. }
  225. static jose_io_t *
  226. alg_encr_enc(const jose_hook_alg_t *alg, jose_cfg_t *cfg, json_t *jwe,
  227. const json_t *cek, jose_io_t *next)
  228. {
  229. const EVP_CIPHER *cph = NULL;
  230. jose_io_auto_t *io = NULL;
  231. io_t *i = NULL;
  232. switch (str2enum(alg->name, NAMES, NULL)) {
  233. case 0: cph = EVP_aes_128_gcm(); break;
  234. case 1: cph = EVP_aes_192_gcm(); break;
  235. case 2: cph = EVP_aes_256_gcm(); break;
  236. default: return NULL;
  237. }
  238. uint8_t iv[EVP_CIPHER_iv_length(cph)];
  239. if (RAND_bytes(iv, sizeof(iv)) <= 0)
  240. return NULL;
  241. i = calloc(1, sizeof(*i));
  242. if (!i)
  243. return NULL;
  244. io = jose_io_incref(&i->io);
  245. io->feed = enc_feed;
  246. io->done = enc_done;
  247. io->free = io_free;
  248. i->json = json_incref(jwe);
  249. i->next = jose_io_incref(next);
  250. i->cctx = setup(cph, cfg, jwe, cek, iv,
  251. EVP_EncryptInit_ex, EVP_EncryptUpdate);
  252. if (!i->json || !i->next || !i->cctx)
  253. return NULL;
  254. if (json_object_set_new(jwe, "iv", jose_b64_enc(iv, sizeof(iv))) < 0)
  255. return NULL;
  256. return jose_io_incref(io);
  257. }
  258. static jose_io_t *
  259. alg_encr_dec(const jose_hook_alg_t *alg, jose_cfg_t *cfg, const json_t *jwe,
  260. const json_t *cek, jose_io_t *next)
  261. {
  262. const EVP_CIPHER *cph = NULL;
  263. jose_io_auto_t *io = NULL;
  264. io_t *i = NULL;
  265. switch (str2enum(alg->name, NAMES, NULL)) {
  266. case 0: cph = EVP_aes_128_gcm(); break;
  267. case 1: cph = EVP_aes_192_gcm(); break;
  268. case 2: cph = EVP_aes_256_gcm(); break;
  269. default: return NULL;
  270. }
  271. uint8_t iv[EVP_CIPHER_iv_length(cph)];
  272. if (jose_b64_dec(json_object_get(jwe, "iv"), NULL, 0) != sizeof(iv))
  273. return NULL;
  274. if (jose_b64_dec(json_object_get(jwe, "iv"), iv, sizeof(iv)) != sizeof(iv))
  275. return NULL;
  276. i = calloc(1, sizeof(*i));
  277. if (!i)
  278. return NULL;
  279. io = jose_io_incref(&i->io);
  280. io->feed = dec_feed;
  281. io->done = dec_done;
  282. io->free = io_free;
  283. i->json = json_incref((json_t *) jwe);
  284. i->next = jose_io_incref(next);
  285. i->cctx = setup(cph, cfg, jwe, cek, iv,
  286. EVP_DecryptInit_ex, EVP_DecryptUpdate);
  287. if (!i->json || !i->next || !i->cctx)
  288. return NULL;
  289. return jose_io_incref(io);
  290. }
  291. static void __attribute__((constructor))
  292. constructor(void)
  293. {
  294. static jose_hook_jwk_t jwk = {
  295. .kind = JOSE_HOOK_JWK_KIND_PREP,
  296. .prep.handles = jwk_prep_handles,
  297. .prep.execute = jwk_prep_execute,
  298. };
  299. static jose_hook_alg_t algs[] = {
  300. { .kind = JOSE_HOOK_ALG_KIND_ENCR,
  301. .name = "A128GCM",
  302. .encr.eprm = "encrypt",
  303. .encr.dprm = "decrypt",
  304. .encr.sug = alg_encr_sug,
  305. .encr.enc = alg_encr_enc,
  306. .encr.dec = alg_encr_dec },
  307. { .kind = JOSE_HOOK_ALG_KIND_ENCR,
  308. .name = "A192GCM",
  309. .encr.eprm = "encrypt",
  310. .encr.dprm = "decrypt",
  311. .encr.sug = alg_encr_sug,
  312. .encr.enc = alg_encr_enc,
  313. .encr.dec = alg_encr_dec },
  314. { .kind = JOSE_HOOK_ALG_KIND_ENCR,
  315. .name = "A256GCM",
  316. .encr.eprm = "encrypt",
  317. .encr.dprm = "decrypt",
  318. .encr.sug = alg_encr_sug,
  319. .encr.enc = alg_encr_enc,
  320. .encr.dec = alg_encr_dec },
  321. {}
  322. };
  323. jose_hook_jwk_push(&jwk);
  324. for (size_t i = 0; algs[i].name; i++)
  325. jose_hook_alg_push(&algs[i]);
  326. }