1
0

ecdhes.c 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506
  1. /* vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80: */
  2. /*
  3. * Copyright 2016 Red Hat, Inc.
  4. *
  5. * Licensed under the Apache License, Version 2.0 (the "License");
  6. * you may not use this file except in compliance with the License.
  7. * You may obtain a copy of the License at
  8. *
  9. * http://www.apache.org/licenses/LICENSE-2.0
  10. *
  11. * Unless required by applicable law or agreed to in writing, software
  12. * distributed under the License is distributed on an "AS IS" BASIS,
  13. * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14. * See the License for the specific language governing permissions and
  15. * limitations under the License.
  16. */
  17. #define _GNU_SOURCE
  18. #include "misc.h"
  19. #include <jose/b64.h>
  20. #include <jose/jwk.h>
  21. #include "../hooks.h"
  22. #include <jose/openssl.h>
  23. #include <openssl/rand.h>
  24. #include <string.h>
  25. #define NAMES "ECDH-ES", "ECDH-ES+A128KW", "ECDH-ES+A192KW", "ECDH-ES+A256KW"
  26. #include <assert.h>
  27. static uint32_t
  28. h2be32(uint32_t x)
  29. {
  30. union swap {
  31. uint32_t i;
  32. uint8_t b[8];
  33. } y;
  34. y.b[0] = x >> 0x18;
  35. y.b[1] = x >> 0x10;
  36. y.b[2] = x >> 0x08;
  37. y.b[3] = x >> 0x00;
  38. return y.i;
  39. }
  40. static bool
  41. concatkdf(const jose_hook_alg_t *alg, jose_cfg_t *cfg, uint8_t dk[], size_t dkl,
  42. const uint8_t z[], size_t zl, ...)
  43. {
  44. jose_io_auto_t *b = NULL;
  45. uint8_t hsh[alg->hash.size];
  46. size_t hshl = sizeof(hsh);
  47. size_t reps = 0;
  48. size_t left = 0;
  49. reps = dkl / sizeof(hsh);
  50. left = dkl % sizeof(hsh);
  51. b = jose_io_buffer(cfg, &hsh, &hshl);
  52. if (!b)
  53. return false;
  54. for (uint32_t c = 0; c <= reps; c++) {
  55. uint32_t cnt = h2be32(c + 1);
  56. jose_io_auto_t *h = NULL;
  57. va_list ap;
  58. h = alg->hash.hsh(alg, cfg, b);
  59. if (!h)
  60. return false;
  61. if (!h->feed(h, &cnt, sizeof(cnt)))
  62. return false;
  63. if (!h->feed(h, z, zl))
  64. return false;
  65. va_start(ap, zl);
  66. for (void *a = va_arg(ap, void *); a; a = va_arg(ap, void *)) {
  67. size_t l = va_arg(ap, size_t);
  68. uint32_t e = h2be32(l);
  69. if (!h->feed(h, &e, sizeof(e))) {
  70. va_end(ap);
  71. return false;
  72. }
  73. if (!h->feed(h, a, l)) {
  74. va_end(ap);
  75. return false;
  76. }
  77. }
  78. va_end(ap);
  79. if (!h->feed(h, &(uint32_t) { h2be32(dkl * 8) }, 4))
  80. return false;
  81. if (!h->done(h))
  82. return false;
  83. assert(hshl == alg->hash.size);
  84. memcpy(&dk[c * hshl], hsh, c == reps ? left : hshl);
  85. OPENSSL_cleanse(hsh, sizeof(hsh));
  86. hshl = 0;
  87. }
  88. return true;
  89. }
  90. static size_t
  91. encr_alg_keylen(jose_cfg_t *cfg, const char *enc)
  92. {
  93. json_auto_t *tmpl = NULL;
  94. if (!jose_hook_alg_find(JOSE_HOOK_ALG_KIND_ENCR, enc))
  95. return SIZE_MAX;
  96. tmpl = json_pack("{s:s}", "alg", enc);
  97. if (!tmpl)
  98. return SIZE_MAX;
  99. for (const jose_hook_jwk_t *j = jose_hook_jwk_list(); j; j = j->next) {
  100. const char *kty = NULL;
  101. json_int_t len = 0;
  102. if (j->kind != JOSE_HOOK_JWK_KIND_PREP)
  103. continue;
  104. if (!j->prep.handles(cfg, tmpl))
  105. continue;
  106. if (!j->prep.execute(cfg, tmpl))
  107. return SIZE_MAX;
  108. if (json_unpack(tmpl, "{s:s,s:I}", "kty", &kty, "bytes", &len) < 0)
  109. return SIZE_MAX;
  110. if (strcmp(kty, "oct") != 0)
  111. return SIZE_MAX;
  112. return len;
  113. }
  114. return SIZE_MAX;
  115. }
  116. static size_t
  117. decode(const json_t *obj, const char *name, uint8_t *buf, size_t len)
  118. {
  119. const char *tmp = NULL;
  120. size_t tmpl = 0;
  121. size_t dlen = 0;
  122. if (json_unpack((json_t *) obj, "{s?s%}", name, &tmp, &tmpl) < 0)
  123. return SIZE_MAX;
  124. if (!tmp)
  125. return 0;
  126. dlen = jose_b64_dec_buf(tmp, tmpl, NULL, 0);
  127. if (dlen > len)
  128. return dlen;
  129. return jose_b64_dec_buf(tmp, tmpl, buf, len);
  130. }
  131. static json_t *
  132. derive(const jose_hook_alg_t *alg, jose_cfg_t *cfg,
  133. json_t *hdr, json_t *cek, const json_t *key)
  134. {
  135. const jose_hook_alg_t *halg = NULL;
  136. const char *name = alg->name;
  137. uint8_t pu[KEYMAX] = {};
  138. uint8_t pv[KEYMAX] = {};
  139. uint8_t dk[KEYMAX] = {};
  140. uint8_t ky[KEYMAX] = {};
  141. const char *enc = NULL;
  142. json_t *out = NULL;
  143. size_t dkl = 0;
  144. size_t pul = 0;
  145. size_t pvl = 0;
  146. size_t kyl = 0;
  147. halg = jose_hook_alg_find(JOSE_HOOK_ALG_KIND_HASH, "S256");
  148. if (!halg)
  149. goto egress;
  150. if (json_unpack(hdr, "{s?s}", "enc", &enc) < 0)
  151. goto egress;
  152. if (!enc && json_unpack(cek, "{s:s}", "alg", &enc) < 0)
  153. goto egress;
  154. switch (str2enum(alg->name, NAMES, NULL)) {
  155. case 0: dkl = encr_alg_keylen(cfg, enc); name = enc; break;
  156. case 1: dkl = 16; break;
  157. case 2: dkl = 24; break;
  158. case 3: dkl = 32; break;
  159. default:
  160. goto egress;
  161. }
  162. if (dkl < 16 || dkl > sizeof(dk))
  163. goto egress;
  164. pul = decode(hdr, "apu", pu, sizeof(pu));
  165. if (pul > sizeof(pu))
  166. goto egress;
  167. pvl = decode(hdr, "apv", pv, sizeof(pv));
  168. if (pvl > sizeof(pv))
  169. goto egress;
  170. kyl = decode(key, "x", ky, sizeof(ky));
  171. if (kyl > sizeof(ky))
  172. goto egress;
  173. if (!concatkdf(halg, cfg,
  174. dk, dkl,
  175. ky, kyl,
  176. name, strlen(name),
  177. pu, pul,
  178. pv, pvl,
  179. NULL))
  180. goto egress;
  181. out = json_pack("{s:s,s:s,s:o}", "kty", "oct", "alg", enc,
  182. "k", jose_b64_enc(dk, dkl));
  183. egress:
  184. OPENSSL_cleanse(ky, sizeof(ky));
  185. OPENSSL_cleanse(pu, sizeof(pu));
  186. OPENSSL_cleanse(pv, sizeof(pv));
  187. OPENSSL_cleanse(dk, sizeof(dk));
  188. return out;
  189. }
  190. static const char *
  191. alg2crv(const char *alg)
  192. {
  193. switch (str2enum(alg, NAMES, NULL)) {
  194. case 0: return "P-521";
  195. case 1: return "P-256";
  196. case 2: return "P-384";
  197. case 3: return "P-521";
  198. default: return NULL;
  199. }
  200. }
  201. static bool
  202. jwk_prep_handles(jose_cfg_t *cfg, const json_t *jwk)
  203. {
  204. const char *alg = NULL;
  205. if (json_unpack((json_t *) jwk, "{s:s}", "alg", &alg) == -1)
  206. return false;
  207. return alg2crv(alg) != NULL;
  208. }
  209. static bool
  210. jwk_prep_execute(jose_cfg_t *cfg, json_t *jwk)
  211. {
  212. const char *alg = NULL;
  213. const char *crv = NULL;
  214. const char *kty = NULL;
  215. const char *grp = NULL;
  216. if (json_unpack(jwk, "{s:s,s?s,s?s}",
  217. "alg", &alg, "kty", &kty, "crv", &crv) == -1)
  218. return false;
  219. grp = alg2crv(alg);
  220. if (!grp)
  221. return false;
  222. if (kty && strcmp(kty, "EC") != 0)
  223. return false;
  224. if (crv && strcmp(crv, grp) != 0)
  225. return false;
  226. if (json_object_set_new(jwk, "kty", json_string("EC")) < 0)
  227. return false;
  228. if (json_object_set_new(jwk, "crv", json_string(grp)) < 0)
  229. return false;
  230. return true;
  231. }
  232. static const char *
  233. alg_wrap_alg(const jose_hook_alg_t *alg, jose_cfg_t *cfg, const json_t *jwk)
  234. {
  235. const char *name = NULL;
  236. const char *type = NULL;
  237. const char *curv = NULL;
  238. if (json_unpack((json_t *) jwk, "{s?s,s?s,s?s}",
  239. "alg", &name, "kty", &type, "crv", &curv) < 0)
  240. return NULL;
  241. if (name)
  242. return str2enum(name, NAMES, NULL) != SIZE_MAX ? name : NULL;
  243. if (!type || strcmp(type, "EC") != 0)
  244. return NULL;
  245. switch (str2enum(curv, "P-256", "P-384", "P-521", NULL)) {
  246. case 0: return "ECDH-ES+A128KW";
  247. case 1: return "ECDH-ES+A192KW";
  248. case 2: return "ECDH-ES+A256KW";
  249. default: return NULL;
  250. }
  251. }
  252. static const char *
  253. alg_wrap_enc(const jose_hook_alg_t *alg, jose_cfg_t *cfg, const json_t *jwk)
  254. {
  255. const char *crv = NULL;
  256. if (json_unpack((json_t *) jwk, "{s?s}", "crv", &crv) < 0)
  257. return NULL;
  258. switch (str2enum(crv, "P-256", "P-384", "P-521", NULL)) {
  259. case 0: return "A128CBC-HS256";
  260. case 1: return "A192CBC-HS384";
  261. case 2: return "A256CBC-HS512";
  262. default: return NULL;
  263. }
  264. }
  265. static bool
  266. alg_wrap_wrp(const jose_hook_alg_t *alg, jose_cfg_t *cfg, json_t *jwe,
  267. json_t *rcp, const json_t *jwk, json_t *cek)
  268. {
  269. const jose_hook_alg_t *ecdh = NULL;
  270. json_auto_t *exc = NULL;
  271. json_auto_t *hdr = NULL;
  272. json_auto_t *epk = NULL;
  273. json_auto_t *der = NULL;
  274. const char *wrap = NULL;
  275. json_t *h = NULL;
  276. if (json_object_get(cek, "k")) {
  277. if (strcmp(alg->name, "ECDH-ES") == 0)
  278. return false;
  279. } else if (!jose_jwk_gen(cfg, cek)) {
  280. return false;
  281. }
  282. hdr = jose_jwe_hdr(jwe, rcp);
  283. if (!hdr)
  284. return false;
  285. h = json_object_get(rcp, "header");
  286. if (!h && json_object_set_new(rcp, "header", h = json_object()) == -1)
  287. return false;
  288. epk = json_pack("{s:s,s:O}", "kty", "EC", "crv",
  289. json_object_get(jwk, "crv"));
  290. if (!epk)
  291. return false;
  292. if (!jose_jwk_gen(cfg, epk))
  293. return false;
  294. ecdh = jose_hook_alg_find(JOSE_HOOK_ALG_KIND_EXCH, "ECDH");
  295. if (!ecdh)
  296. return false;
  297. exc = ecdh->exch.exc(ecdh, cfg, epk, jwk);
  298. if (!exc)
  299. return false;
  300. if (!jose_jwk_pub(cfg, epk))
  301. return false;
  302. if (json_object_set(h, "epk", epk) == -1)
  303. return false;
  304. der = derive(alg, cfg, hdr, cek, exc);
  305. if (!der)
  306. return false;
  307. wrap = strchr(alg->name, '+');
  308. if (wrap) {
  309. const jose_hook_alg_t *kw = NULL;
  310. kw = jose_hook_alg_find(JOSE_HOOK_ALG_KIND_WRAP, &wrap[1]);
  311. if (!kw)
  312. return false;
  313. return kw->wrap.wrp(kw, cfg, jwe, rcp, der, cek);
  314. }
  315. if (json_object_update(cek, der) < 0)
  316. return false;
  317. return add_entity(jwe, rcp, "recipients", "header", "encrypted_key", NULL);
  318. }
  319. static bool
  320. alg_wrap_unw(const jose_hook_alg_t *alg, jose_cfg_t *cfg, const json_t *jwe,
  321. const json_t *rcp, const json_t *jwk, json_t *cek)
  322. {
  323. const json_t *epk = NULL;
  324. json_auto_t *exc = NULL;
  325. json_auto_t *der = NULL;
  326. json_auto_t *hdr = NULL;
  327. const char *wrap = NULL;
  328. hdr = jose_jwe_hdr(jwe, rcp);
  329. epk = json_object_get(hdr, "epk");
  330. if (!hdr || !epk)
  331. return false;
  332. /* If the JWK has a private key, perform the normal exchange. */
  333. if (json_object_get(jwk, "d")) {
  334. const jose_hook_alg_t *ecdh = NULL;
  335. ecdh = jose_hook_alg_find(JOSE_HOOK_ALG_KIND_EXCH, "ECDH");
  336. if (!ecdh)
  337. return false;
  338. exc = ecdh->exch.exc(ecdh, cfg, jwk, epk);
  339. /* Otherwise, allow external exchanges. */
  340. } else if (json_equal(json_object_get(jwk, "crv"),
  341. json_object_get(epk, "crv"))) {
  342. exc = json_deep_copy(jwk);
  343. }
  344. if (!exc)
  345. return false;
  346. der = derive(alg, cfg, hdr, cek, exc);
  347. if (!der)
  348. return false;
  349. wrap = strchr(alg->name, '+');
  350. if (wrap) {
  351. const jose_hook_alg_t *kw = NULL;
  352. kw = jose_hook_alg_find(JOSE_HOOK_ALG_KIND_WRAP, &wrap[1]);
  353. if (!kw)
  354. return false;
  355. return kw->wrap.unw(kw, cfg, jwe, rcp, der, cek);
  356. }
  357. return json_object_update(cek, der) == 0;
  358. }
  359. static void __attribute__((constructor))
  360. constructor(void)
  361. {
  362. static jose_hook_jwk_t jwk = {
  363. .kind = JOSE_HOOK_JWK_KIND_PREP,
  364. .prep.handles = jwk_prep_handles,
  365. .prep.execute = jwk_prep_execute
  366. };
  367. static jose_hook_alg_t algs[] = {
  368. { .kind = JOSE_HOOK_ALG_KIND_WRAP,
  369. .name = "ECDH-ES",
  370. .wrap.eprm = "wrapKey",
  371. .wrap.dprm = "unwrapKey",
  372. .wrap.alg = alg_wrap_alg,
  373. .wrap.enc = alg_wrap_enc,
  374. .wrap.wrp = alg_wrap_wrp,
  375. .wrap.unw = alg_wrap_unw },
  376. { .kind = JOSE_HOOK_ALG_KIND_WRAP,
  377. .name = "ECDH-ES+A128KW",
  378. .wrap.eprm = "wrapKey",
  379. .wrap.dprm = "unwrapKey",
  380. .wrap.alg = alg_wrap_alg,
  381. .wrap.enc = alg_wrap_enc,
  382. .wrap.wrp = alg_wrap_wrp,
  383. .wrap.unw = alg_wrap_unw },
  384. { .kind = JOSE_HOOK_ALG_KIND_WRAP,
  385. .name = "ECDH-ES+A192KW",
  386. .wrap.eprm = "wrapKey",
  387. .wrap.dprm = "unwrapKey",
  388. .wrap.alg = alg_wrap_alg,
  389. .wrap.enc = alg_wrap_enc,
  390. .wrap.wrp = alg_wrap_wrp,
  391. .wrap.unw = alg_wrap_unw },
  392. { .kind = JOSE_HOOK_ALG_KIND_WRAP,
  393. .name = "ECDH-ES+A256KW",
  394. .wrap.eprm = "wrapKey",
  395. .wrap.dprm = "unwrapKey",
  396. .wrap.alg = alg_wrap_alg,
  397. .wrap.enc = alg_wrap_enc,
  398. .wrap.wrp = alg_wrap_wrp,
  399. .wrap.unw = alg_wrap_unw },
  400. {}
  401. };
  402. jose_hook_jwk_push(&jwk);
  403. for (size_t i = 0; algs[i].name; i++)
  404. jose_hook_alg_push(&algs[i]);
  405. }