1
0

pbes2.c 8.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334
  1. /* vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80: */
  2. /*
  3. * Copyright 2016 Red Hat, Inc.
  4. *
  5. * Licensed under the Apache License, Version 2.0 (the "License");
  6. * you may not use this file except in compliance with the License.
  7. * You may obtain a copy of the License at
  8. *
  9. * http://www.apache.org/licenses/LICENSE-2.0
  10. *
  11. * Unless required by applicable law or agreed to in writing, software
  12. * distributed under the License is distributed on an "AS IS" BASIS,
  13. * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14. * See the License for the specific language governing permissions and
  15. * limitations under the License.
  16. */
  17. #include "misc.h"
  18. #include <jose/b64.h>
  19. #include <jose/jwk.h>
  20. #include "../hooks.h"
  21. #include <openssl/rand.h>
  22. #include <string.h>
  23. #define NAMES "PBES2-HS256+A128KW", "PBES2-HS384+A192KW", "PBES2-HS512+A256KW"
  24. #define P2C_MIN_ITERATIONS 1000
  25. #define P2C_MAX_ITERATIONS 32768
  26. static json_t *
  27. pbkdf2(const char *alg, jose_cfg_t *cfg, const json_t *jwk, int iter,
  28. uint8_t st[], size_t stl)
  29. {
  30. const EVP_MD *md = NULL;
  31. json_auto_t *key = NULL;
  32. json_t *cek = NULL;
  33. size_t kyl = 0;
  34. size_t dkl = 0;
  35. if (json_is_string(jwk)) {
  36. jwk = key = json_pack("{s:s,s:o}", "kty", "oct", "k",
  37. jose_b64_enc(json_string_value(jwk),
  38. json_string_length(jwk)));
  39. if (!jwk)
  40. return NULL;
  41. }
  42. switch (str2enum(alg, NAMES, NULL)) {
  43. case 0: md = EVP_sha256(); dkl = 16; break;
  44. case 1: md = EVP_sha384(); dkl = 24; break;
  45. case 2: md = EVP_sha512(); dkl = 32; break;
  46. default: return NULL;
  47. }
  48. const size_t pfx = strlen(alg) + 1;
  49. uint8_t slt[pfx + stl];
  50. uint8_t dk[dkl];
  51. char ky[KEYMAX];
  52. memcpy(slt, alg, pfx);
  53. memcpy(&slt[pfx], st, stl);
  54. kyl = jose_b64_dec(json_object_get(jwk, "k"), NULL, 0);
  55. if (kyl > sizeof(ky))
  56. return NULL;
  57. if (jose_b64_dec(json_object_get(jwk, "k"), ky, sizeof(ky)) != kyl) {
  58. OPENSSL_cleanse(ky, sizeof(ky));
  59. return NULL;
  60. }
  61. if (PKCS5_PBKDF2_HMAC(ky, kyl, slt, sizeof(slt), iter, md, dkl, dk) > 0)
  62. cek = json_pack("{s:s,s:o}", "kty", "oct", "k", jose_b64_enc(dk, dkl));
  63. OPENSSL_cleanse(ky, sizeof(ky));
  64. OPENSSL_cleanse(dk, sizeof(dk));
  65. return cek;
  66. }
  67. static json_int_t
  68. alg2len(const char *alg)
  69. {
  70. switch (str2enum(alg, NAMES, NULL)) {
  71. case 0: return 16;
  72. case 1: return 24;
  73. case 2: return 32;
  74. default: return 0;
  75. }
  76. }
  77. static bool
  78. jwk_prep_handles(jose_cfg_t *cfg, const json_t *jwk)
  79. {
  80. const char *alg = NULL;
  81. if (json_unpack((json_t *) jwk, "{s:s}", "alg", &alg) < 0)
  82. return false;
  83. return alg2len(alg) != 0;
  84. }
  85. static bool
  86. jwk_prep_execute(jose_cfg_t *cfg, json_t *jwk)
  87. {
  88. const char *alg = NULL;
  89. const char *kty = NULL;
  90. json_int_t byt = 0;
  91. json_int_t len = 0;
  92. if (json_unpack(jwk, "{s:s,s?s,s?I}",
  93. "alg", &alg, "kty", &kty, "bytes", &byt) < 0)
  94. return false;
  95. len = alg2len(alg);
  96. if (len == 0)
  97. return false;
  98. if (byt != 0 && byt != len)
  99. return false;
  100. if (kty && strcmp(kty, "oct") != 0)
  101. return false;
  102. if (json_object_set_new(jwk, "kty", json_string("oct")) < 0)
  103. return false;
  104. if (json_object_set_new(jwk, "bytes", json_integer(len)) < 0)
  105. return false;
  106. return true;
  107. }
  108. static const char *
  109. alg_wrap_alg(const jose_hook_alg_t *alg, jose_cfg_t *cfg, const json_t *jwk)
  110. {
  111. size_t len = 0;
  112. if (json_is_object(jwk)) {
  113. const char *name = NULL;
  114. const char *type = NULL;
  115. if (json_unpack((json_t *) jwk, "{s?s,s?s}",
  116. "alg", &name, "kty", &type) < 0)
  117. return NULL;
  118. if (name)
  119. return str2enum(name, NAMES, NULL) != SIZE_MAX ? name : NULL;
  120. if (!type || strcmp(type, "oct") != 0)
  121. return NULL;
  122. len = jose_b64_dec(json_object_get(jwk, "k"), NULL, 0);
  123. if (len == SIZE_MAX)
  124. return NULL;
  125. /* Defer to other algorithms if defined... */
  126. for (const jose_hook_alg_t *a = alg->next; a; a = a->next) {
  127. if (a->kind != JOSE_HOOK_ALG_KIND_WRAP)
  128. continue;
  129. if (a->wrap.alg == alg_wrap_alg)
  130. continue;
  131. if (a->wrap.alg(alg, cfg, jwk))
  132. return NULL;
  133. }
  134. } else if (json_is_string(jwk)) {
  135. len = json_string_length(jwk);
  136. if (len > 36)
  137. return "PBES2-HS512+A256KW";
  138. else if (len > 27)
  139. return "PBES2-HS384+A192KW";
  140. else
  141. return "PBES2-HS256+A128KW";
  142. }
  143. return NULL;
  144. }
  145. static const char *
  146. alg_wrap_enc(const jose_hook_alg_t *alg, jose_cfg_t *cfg, const json_t *jwk)
  147. {
  148. switch (str2enum (alg->name, NAMES, NULL)) {
  149. case 0: return "A128CBC-HS256";
  150. case 1: return "A192CBC-HS384";
  151. case 2: return "A256CBC-HS512";
  152. default: return NULL;
  153. }
  154. }
  155. static bool
  156. alg_wrap_wrp(const jose_hook_alg_t *alg, jose_cfg_t *cfg, json_t *jwe,
  157. json_t *rcp, const json_t *jwk, json_t *cek)
  158. {
  159. json_auto_t *key = NULL;
  160. json_auto_t *hdr = NULL;
  161. const char *aes = NULL;
  162. json_t *h = NULL;
  163. int p2c = P2C_MAX_ITERATIONS;
  164. size_t stl = 0;
  165. if (!json_object_get(cek, "k") && !jose_jwk_gen(cfg, cek))
  166. return false;
  167. switch (str2enum(alg->name, NAMES, NULL)) {
  168. case 0: aes = "A128KW"; stl = 16; break;
  169. case 1: aes = "A192KW"; stl = 24; break;
  170. case 2: aes = "A256KW"; stl = 32; break;
  171. default: return false;
  172. }
  173. uint8_t st[stl];
  174. if (RAND_bytes(st, stl) <= 0)
  175. return false;
  176. h = json_object_get(rcp, "header");
  177. if (!h && json_object_set_new(rcp, "header", h = json_object()) == -1)
  178. return false;
  179. hdr = jose_jwe_hdr(jwe, rcp);
  180. if (!hdr)
  181. return false;
  182. if (json_unpack(hdr, "{s?i}", "p2c", &p2c) < 0)
  183. return false;
  184. if (!json_object_get(hdr, "p2c") &&
  185. json_object_set_new(h, "p2c", json_integer(p2c)) < 0)
  186. return false;
  187. if (p2c < P2C_MIN_ITERATIONS || p2c > P2C_MAX_ITERATIONS)
  188. return false;
  189. if (json_object_set_new(h, "p2s", jose_b64_enc(st, stl)) == -1)
  190. return false;
  191. key = pbkdf2(alg->name, cfg, jwk, p2c, st, stl);
  192. if (!key)
  193. return false;
  194. alg = jose_hook_alg_find(JOSE_HOOK_ALG_KIND_WRAP, aes);
  195. if (!alg)
  196. return false;
  197. return alg->wrap.wrp(alg, cfg, jwe, rcp, key, cek);
  198. }
  199. static bool
  200. alg_wrap_unw(const jose_hook_alg_t *alg, jose_cfg_t *cfg, const json_t *jwe,
  201. const json_t *rcp, const json_t *jwk, json_t *cek)
  202. {
  203. json_auto_t *key = NULL;
  204. json_auto_t *hdr = NULL;
  205. uint8_t st[KEYMAX] = {};
  206. const char *aes = NULL;
  207. json_int_t p2c = -1;
  208. size_t stl = 0;
  209. switch (str2enum(alg->name, NAMES, NULL)) {
  210. case 0: aes = "A128KW"; break;
  211. case 1: aes = "A192KW"; break;
  212. case 2: aes = "A256KW"; break;
  213. default: return false;
  214. }
  215. hdr = jose_jwe_hdr(jwe, rcp);
  216. if (!hdr)
  217. return false;
  218. if (json_unpack(hdr, "{s:I}", "p2c", &p2c) == -1)
  219. return false;
  220. if (p2c > P2C_MAX_ITERATIONS)
  221. return false;
  222. stl = jose_b64_dec(json_object_get(hdr, "p2s"), NULL, 0);
  223. if (stl < 8 || stl > sizeof(st))
  224. return false;
  225. if (jose_b64_dec(json_object_get(hdr, "p2s"), st, sizeof(st)) != stl)
  226. return false;
  227. key = pbkdf2(alg->name, cfg, jwk, p2c, st, stl);
  228. if (!key)
  229. return false;
  230. alg = jose_hook_alg_find(JOSE_HOOK_ALG_KIND_WRAP, aes);
  231. if (!alg)
  232. return false;
  233. return alg->wrap.unw(alg, cfg, jwe, rcp, key, cek);
  234. }
  235. static void __attribute__((constructor))
  236. constructor(void)
  237. {
  238. static jose_hook_jwk_t jwk = {
  239. .kind = JOSE_HOOK_JWK_KIND_PREP,
  240. .prep.handles = jwk_prep_handles,
  241. .prep.execute = jwk_prep_execute,
  242. };
  243. static jose_hook_alg_t algs[] = {
  244. { .kind = JOSE_HOOK_ALG_KIND_WRAP,
  245. .name = "PBES2-HS256+A128KW",
  246. .wrap.eprm = "wrapKey",
  247. .wrap.dprm = "unwrapKey",
  248. .wrap.alg = alg_wrap_alg,
  249. .wrap.enc = alg_wrap_enc,
  250. .wrap.wrp = alg_wrap_wrp,
  251. .wrap.unw = alg_wrap_unw },
  252. { .kind = JOSE_HOOK_ALG_KIND_WRAP,
  253. .name = "PBES2-HS384+A192KW",
  254. .wrap.eprm = "wrapKey",
  255. .wrap.dprm = "unwrapKey",
  256. .wrap.alg = alg_wrap_alg,
  257. .wrap.enc = alg_wrap_enc,
  258. .wrap.wrp = alg_wrap_wrp,
  259. .wrap.unw = alg_wrap_unw },
  260. { .kind = JOSE_HOOK_ALG_KIND_WRAP,
  261. .name = "PBES2-HS512+A256KW",
  262. .wrap.eprm = "wrapKey",
  263. .wrap.dprm = "unwrapKey",
  264. .wrap.alg = alg_wrap_alg,
  265. .wrap.enc = alg_wrap_enc,
  266. .wrap.wrp = alg_wrap_wrp,
  267. .wrap.unw = alg_wrap_unw },
  268. {}
  269. };
  270. jose_hook_jwk_push(&jwk);
  271. for (size_t i = 0; algs[i].name; i++)
  272. jose_hook_alg_push(&algs[i]);
  273. }