1
0

ecdsa.c 8.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332
  1. /* vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80: */
  2. /*
  3. * Copyright 2016 Red Hat, Inc.
  4. *
  5. * Licensed under the Apache License, Version 2.0 (the "License");
  6. * you may not use this file except in compliance with the License.
  7. * You may obtain a copy of the License at
  8. *
  9. * http://www.apache.org/licenses/LICENSE-2.0
  10. *
  11. * Unless required by applicable law or agreed to in writing, software
  12. * distributed under the License is distributed on an "AS IS" BASIS,
  13. * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14. * See the License for the specific language governing permissions and
  15. * limitations under the License.
  16. */
  17. #include "misc.h"
  18. #include <jose/b64.h>
  19. #include "../hooks.h"
  20. #include <jose/openssl.h>
  21. #include <string.h>
  22. #define NAMES "ES256", "ES384", "ES512", "ES256K"
  23. typedef struct {
  24. jose_io_t io;
  25. jose_io_t *h;
  26. jose_io_t *b;
  27. EC_KEY *key;
  28. json_t *obj;
  29. json_t *sig;
  30. size_t hshl;
  31. void *hsh;
  32. } io_t;
  33. declare_cleanup(ECDSA_SIG)
  34. static void
  35. io_free(jose_io_t *io)
  36. {
  37. io_t *i = containerof(io, io_t, io);
  38. if (i->h)
  39. i->h->free(i->h);
  40. if (i->b)
  41. i->b->free(i->b);
  42. EC_KEY_free(i->key);
  43. json_decref(i->obj);
  44. json_decref(i->sig);
  45. free(i);
  46. }
  47. static bool
  48. io_feed(jose_io_t *io, const void *in, size_t len)
  49. {
  50. io_t *i = containerof(io, io_t, io);
  51. return i->h->feed(i->h, in, len);
  52. }
  53. static bool
  54. sig_done(jose_io_t *io)
  55. {
  56. io_t *i = containerof(io, io_t, io);
  57. uint8_t buf[(EC_GROUP_get_degree(EC_KEY_get0_group(i->key)) + 7) / 8 * 2];
  58. openssl_auto(ECDSA_SIG) *ecdsa = NULL;
  59. const BIGNUM *r = NULL;
  60. const BIGNUM *s = NULL;
  61. if (!i->h->done(i->h))
  62. return false;
  63. ecdsa = ECDSA_do_sign(i->hsh, i->hshl, i->key);
  64. if (!ecdsa)
  65. return false;
  66. ECDSA_SIG_get0(ecdsa, &r, &s);
  67. if (!bn_encode(r, buf, sizeof(buf) / 2))
  68. return false;
  69. if (!bn_encode(s, &buf[sizeof(buf) / 2], sizeof(buf) / 2))
  70. return false;
  71. if (json_object_set_new(i->sig, "signature",
  72. jose_b64_enc(buf, sizeof(buf))) < 0)
  73. return false;
  74. return add_entity(i->obj, i->sig,
  75. "signatures", "signature", "protected", "header", NULL);
  76. }
  77. static bool
  78. ver_done(jose_io_t *io)
  79. {
  80. io_t *i = containerof(io, io_t, io);
  81. uint8_t buf[(EC_GROUP_get_degree(EC_KEY_get0_group(i->key)) + 7) / 8 * 2];
  82. openssl_auto(ECDSA_SIG) *ecdsa = NULL;
  83. const json_t *sig = NULL;
  84. BIGNUM *r = NULL;
  85. BIGNUM *s = NULL;
  86. sig = json_object_get(i->sig, "signature");
  87. if (!sig)
  88. return false;
  89. if (jose_b64_dec(sig, NULL, 0) != sizeof(buf))
  90. return false;
  91. if (jose_b64_dec(sig, buf, sizeof(buf)) != sizeof(buf))
  92. return false;
  93. ecdsa = ECDSA_SIG_new();
  94. if (!ecdsa)
  95. return false;
  96. r = bn_decode(buf, sizeof(buf) / 2);
  97. s = bn_decode(&buf[sizeof(buf) / 2], sizeof(buf) / 2);
  98. if (ECDSA_SIG_set0(ecdsa, r, s) <= 0) {
  99. BN_free(r);
  100. BN_free(s);
  101. return false;
  102. }
  103. if (!i->h->done(i->h))
  104. return false;
  105. return ECDSA_do_verify(i->hsh, i->hshl, ecdsa, i->key) == 1;
  106. }
  107. static const char *
  108. alg2crv(const char *alg)
  109. {
  110. switch (str2enum(alg, NAMES, NULL)) {
  111. case 0: return "P-256";
  112. case 1: return "P-384";
  113. case 2: return "P-521";
  114. case 3: return "secp256k1";
  115. default: return NULL;
  116. }
  117. }
  118. static const char *
  119. alg2hash(const char *alg)
  120. {
  121. switch (str2enum(alg, NAMES, NULL)) {
  122. case 0: return "S256";
  123. case 1: return "S384";
  124. case 2: return "S512";
  125. case 3: return "S256";
  126. default: return NULL;
  127. }
  128. }
  129. static bool
  130. jwk_prep_handles(jose_cfg_t *cfg, const json_t *jwk)
  131. {
  132. const char *alg = NULL;
  133. if (json_unpack((json_t *) jwk, "{s:s}", "alg", &alg) == -1)
  134. return false;
  135. return alg2crv(alg) != NULL;
  136. }
  137. static bool
  138. jwk_prep_execute(jose_cfg_t *cfg, json_t *jwk)
  139. {
  140. const char *alg = NULL;
  141. const char *crv = NULL;
  142. const char *kty = NULL;
  143. const char *grp = NULL;
  144. if (json_unpack(jwk, "{s:s,s?s,s?s}",
  145. "alg", &alg, "kty", &kty, "crv", &crv) == -1)
  146. return false;
  147. grp = alg2crv(alg);
  148. if (!grp)
  149. return false;
  150. if (kty && strcmp(kty, "EC") != 0)
  151. return false;
  152. if (crv && strcmp(crv, grp) != 0)
  153. return false;
  154. if (json_object_set_new(jwk, "kty", json_string("EC")) < 0)
  155. return false;
  156. if (json_object_set_new(jwk, "crv", json_string(grp)) < 0)
  157. return false;
  158. return true;
  159. }
  160. static const char *
  161. alg_sign_sug(const jose_hook_alg_t *alg, jose_cfg_t *cfg, const json_t *jwk)
  162. {
  163. const char *name = NULL;
  164. const char *type = NULL;
  165. const char *curv = NULL;
  166. if (json_unpack((json_t *) jwk, "{s?s,s?s,s?s}",
  167. "alg", &name, "kty", &type, "crv", &curv) < 0)
  168. return NULL;
  169. if (name)
  170. return str2enum(name, NAMES, NULL) != SIZE_MAX ? name : NULL;
  171. if (!type || strcmp(type, "EC") != 0)
  172. return NULL;
  173. switch (str2enum(curv, "P-256", "P-384", "P-521", "secp256k1", NULL)) {
  174. case 0: return "ES256";
  175. case 1: return "ES384";
  176. case 2: return "ES512";
  177. case 3: return "ES256K";
  178. default: return NULL;
  179. }
  180. }
  181. static jose_io_t *
  182. alg_sign_sig(const jose_hook_alg_t *alg, jose_cfg_t *cfg, json_t *jws,
  183. json_t *sig, const json_t *jwk)
  184. {
  185. const jose_hook_alg_t *halg = NULL;
  186. jose_io_auto_t *io = NULL;
  187. io_t *i = NULL;
  188. halg = jose_hook_alg_find(JOSE_HOOK_ALG_KIND_HASH, alg2hash(alg->name));
  189. if (!halg)
  190. return NULL;
  191. i = calloc(1, sizeof(*i));
  192. if (!i)
  193. return NULL;
  194. io = jose_io_incref(&i->io);
  195. io->feed = io_feed;
  196. io->done = sig_done;
  197. io->free = io_free;
  198. i->b = jose_io_malloc(cfg, &i->hsh, &i->hshl);
  199. i->h = halg->hash.hsh(halg, cfg, i->b);
  200. i->obj = json_incref(jws);
  201. i->sig = json_incref(sig);
  202. i->key = jose_openssl_jwk_to_EC_KEY(cfg, jwk);
  203. if (!i->b || !i->h || !i->obj || !i->sig || !i->key)
  204. return NULL;
  205. return jose_io_incref(io);
  206. }
  207. static jose_io_t *
  208. alg_sign_ver(const jose_hook_alg_t *alg, jose_cfg_t *cfg, const json_t *jws,
  209. const json_t *sig, const json_t *jwk)
  210. {
  211. const jose_hook_alg_t *halg = NULL;
  212. jose_io_auto_t *io = NULL;
  213. io_t *i = NULL;
  214. halg = jose_hook_alg_find(JOSE_HOOK_ALG_KIND_HASH, alg2hash(alg->name));
  215. if (!halg)
  216. return NULL;
  217. i = calloc(1, sizeof(*i));
  218. if (!i)
  219. return NULL;
  220. io = jose_io_incref(&i->io);
  221. io->feed = io_feed;
  222. io->done = ver_done;
  223. io->free = io_free;
  224. i->b = jose_io_malloc(cfg, &i->hsh, &i->hshl);
  225. i->h = halg->hash.hsh(halg, cfg, i->b);
  226. i->sig = json_incref((json_t *) sig);
  227. i->key = jose_openssl_jwk_to_EC_KEY(cfg, jwk);
  228. if (!i->b || !i->h || !i->sig || !i->key)
  229. return NULL;
  230. return jose_io_incref(io);
  231. }
  232. static void __attribute__((constructor))
  233. constructor(void)
  234. {
  235. static jose_hook_jwk_t jwk = {
  236. .kind = JOSE_HOOK_JWK_KIND_PREP,
  237. .prep.handles = jwk_prep_handles,
  238. .prep.execute = jwk_prep_execute,
  239. };
  240. static jose_hook_alg_t algs[] = {
  241. { .kind = JOSE_HOOK_ALG_KIND_SIGN,
  242. .name = "ES256",
  243. .sign.sprm = "sign",
  244. .sign.vprm = "verify",
  245. .sign.sug = alg_sign_sug,
  246. .sign.sig = alg_sign_sig,
  247. .sign.ver = alg_sign_ver },
  248. { .kind = JOSE_HOOK_ALG_KIND_SIGN,
  249. .name = "ES384",
  250. .sign.sprm = "sign",
  251. .sign.vprm = "verify",
  252. .sign.sug = alg_sign_sug,
  253. .sign.sig = alg_sign_sig,
  254. .sign.ver = alg_sign_ver },
  255. { .kind = JOSE_HOOK_ALG_KIND_SIGN,
  256. .name = "ES512",
  257. .sign.sprm = "sign",
  258. .sign.vprm = "verify",
  259. .sign.sug = alg_sign_sug,
  260. .sign.sig = alg_sign_sig,
  261. .sign.ver = alg_sign_ver },
  262. { .kind = JOSE_HOOK_ALG_KIND_SIGN,
  263. .name = "ES256K",
  264. .sign.sprm = "sign",
  265. .sign.vprm = "verify",
  266. .sign.sug = alg_sign_sug,
  267. .sign.sig = alg_sign_sig,
  268. .sign.ver = alg_sign_ver },
  269. {}
  270. };
  271. jose_hook_jwk_push(&jwk);
  272. for (size_t i = 0; algs[i].name; i++)
  273. jose_hook_alg_push(&algs[i]);
  274. }