1
0

ecdsa.c 7.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311
  1. /* vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80: */
  2. /*
  3. * Copyright 2016 Red Hat, Inc.
  4. *
  5. * Licensed under the Apache License, Version 2.0 (the "License");
  6. * you may not use this file except in compliance with the License.
  7. * You may obtain a copy of the License at
  8. *
  9. * http://www.apache.org/licenses/LICENSE-2.0
  10. *
  11. * Unless required by applicable law or agreed to in writing, software
  12. * distributed under the License is distributed on an "AS IS" BASIS,
  13. * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14. * See the License for the specific language governing permissions and
  15. * limitations under the License.
  16. */
  17. #include "misc.h"
  18. #include <jose/b64.h>
  19. #include "../hooks.h"
  20. #include <jose/openssl.h>
  21. #include <string.h>
  22. #define NAMES "ES256", "ES384", "ES512"
  23. typedef struct {
  24. jose_io_t io;
  25. jose_io_t *h;
  26. jose_io_t *b;
  27. EC_KEY *key;
  28. json_t *obj;
  29. json_t *sig;
  30. size_t hshl;
  31. void *hsh;
  32. } io_t;
  33. declare_cleanup(ECDSA_SIG)
  34. static void
  35. io_free(jose_io_t *io)
  36. {
  37. io_t *i = containerof(io, io_t, io);
  38. if (i->h)
  39. i->h->free(i->h);
  40. if (i->b)
  41. i->b->free(i->b);
  42. EC_KEY_free(i->key);
  43. json_decref(i->obj);
  44. json_decref(i->sig);
  45. free(i);
  46. }
  47. static bool
  48. io_feed(jose_io_t *io, const void *in, size_t len)
  49. {
  50. io_t *i = containerof(io, io_t, io);
  51. return i->h->feed(i->h, in, len);
  52. }
  53. static bool
  54. sig_done(jose_io_t *io)
  55. {
  56. io_t *i = containerof(io, io_t, io);
  57. uint8_t buf[(EC_GROUP_get_degree(EC_KEY_get0_group(i->key)) + 7) / 8 * 2];
  58. openssl_auto(ECDSA_SIG) *ecdsa = NULL;
  59. const BIGNUM *r = NULL;
  60. const BIGNUM *s = NULL;
  61. if (!i->h->done(i->h))
  62. return false;
  63. ecdsa = ECDSA_do_sign(i->hsh, i->hshl, i->key);
  64. if (!ecdsa)
  65. return false;
  66. ECDSA_SIG_get0(ecdsa, &r, &s);
  67. if (!bn_encode(r, buf, sizeof(buf) / 2))
  68. return false;
  69. if (!bn_encode(s, &buf[sizeof(buf) / 2], sizeof(buf) / 2))
  70. return false;
  71. if (json_object_set_new(i->sig, "signature",
  72. jose_b64_enc(buf, sizeof(buf))) < 0)
  73. return false;
  74. return add_entity(i->obj, i->sig,
  75. "signatures", "signature", "protected", "header", NULL);
  76. }
  77. static bool
  78. ver_done(jose_io_t *io)
  79. {
  80. io_t *i = containerof(io, io_t, io);
  81. uint8_t buf[(EC_GROUP_get_degree(EC_KEY_get0_group(i->key)) + 7) / 8 * 2];
  82. openssl_auto(ECDSA_SIG) *ecdsa = NULL;
  83. const json_t *sig = NULL;
  84. BIGNUM *r = NULL;
  85. BIGNUM *s = NULL;
  86. sig = json_object_get(i->sig, "signature");
  87. if (!sig)
  88. return false;
  89. if (jose_b64_dec(sig, NULL, 0) != sizeof(buf))
  90. return false;
  91. if (jose_b64_dec(sig, buf, sizeof(buf)) != sizeof(buf))
  92. return false;
  93. ecdsa = ECDSA_SIG_new();
  94. if (!ecdsa)
  95. return false;
  96. r = bn_decode(buf, sizeof(buf) / 2);
  97. s = bn_decode(&buf[sizeof(buf) / 2], sizeof(buf) / 2);
  98. if (ECDSA_SIG_set0(ecdsa, r, s) <= 0) {
  99. BN_free(r);
  100. BN_free(s);
  101. return false;
  102. }
  103. if (!i->h->done(i->h))
  104. return false;
  105. return ECDSA_do_verify(i->hsh, i->hshl, ecdsa, i->key) == 1;
  106. }
  107. static const char *
  108. alg2crv(const char *alg)
  109. {
  110. switch (str2enum(alg, NAMES, NULL)) {
  111. case 0: return "P-256";
  112. case 1: return "P-384";
  113. case 2: return "P-521";
  114. default: return NULL;
  115. }
  116. }
  117. static bool
  118. jwk_prep_handles(jose_cfg_t *cfg, const json_t *jwk)
  119. {
  120. const char *alg = NULL;
  121. if (json_unpack((json_t *) jwk, "{s:s}", "alg", &alg) == -1)
  122. return false;
  123. return alg2crv(alg) != NULL;
  124. }
  125. static bool
  126. jwk_prep_execute(jose_cfg_t *cfg, json_t *jwk)
  127. {
  128. const char *alg = NULL;
  129. const char *crv = NULL;
  130. const char *kty = NULL;
  131. const char *grp = NULL;
  132. if (json_unpack(jwk, "{s:s,s?s,s?s}",
  133. "alg", &alg, "kty", &kty, "crv", &crv) == -1)
  134. return false;
  135. grp = alg2crv(alg);
  136. if (!grp)
  137. return false;
  138. if (kty && strcmp(kty, "EC") != 0)
  139. return false;
  140. if (crv && strcmp(crv, grp) != 0)
  141. return false;
  142. if (json_object_set_new(jwk, "kty", json_string("EC")) < 0)
  143. return false;
  144. if (json_object_set_new(jwk, "crv", json_string(grp)) < 0)
  145. return false;
  146. return true;
  147. }
  148. static const char *
  149. alg_sign_sug(const jose_hook_alg_t *alg, jose_cfg_t *cfg, const json_t *jwk)
  150. {
  151. const char *name = NULL;
  152. const char *type = NULL;
  153. const char *curv = NULL;
  154. if (json_unpack((json_t *) jwk, "{s?s,s?s,s?s}",
  155. "alg", &name, "kty", &type, "crv", &curv) < 0)
  156. return NULL;
  157. if (name)
  158. return str2enum(name, NAMES, NULL) != SIZE_MAX ? name : NULL;
  159. if (!type || strcmp(type, "EC") != 0)
  160. return NULL;
  161. switch (str2enum(curv, "P-256", "P-384", "P-521", NULL)) {
  162. case 0: return "ES256";
  163. case 1: return "ES384";
  164. case 2: return "ES512";
  165. default: return NULL;
  166. }
  167. }
  168. static jose_io_t *
  169. alg_sign_sig(const jose_hook_alg_t *alg, jose_cfg_t *cfg, json_t *jws,
  170. json_t *sig, const json_t *jwk)
  171. {
  172. const jose_hook_alg_t *halg = NULL;
  173. jose_io_auto_t *io = NULL;
  174. io_t *i = NULL;
  175. halg = jose_hook_alg_find(JOSE_HOOK_ALG_KIND_HASH, &alg->name[1]);
  176. if (!halg)
  177. return NULL;
  178. i = calloc(1, sizeof(*i));
  179. if (!i)
  180. return NULL;
  181. io = jose_io_incref(&i->io);
  182. io->feed = io_feed;
  183. io->done = sig_done;
  184. io->free = io_free;
  185. i->b = jose_io_malloc(cfg, &i->hsh, &i->hshl);
  186. i->h = halg->hash.hsh(halg, cfg, i->b);
  187. i->obj = json_incref(jws);
  188. i->sig = json_incref(sig);
  189. i->key = jose_openssl_jwk_to_EC_KEY(cfg, jwk);
  190. if (!i->b || !i->h || !i->obj || !i->sig || !i->key)
  191. return NULL;
  192. return jose_io_incref(io);
  193. }
  194. static jose_io_t *
  195. alg_sign_ver(const jose_hook_alg_t *alg, jose_cfg_t *cfg, const json_t *jws,
  196. const json_t *sig, const json_t *jwk)
  197. {
  198. const jose_hook_alg_t *halg = NULL;
  199. jose_io_auto_t *io = NULL;
  200. io_t *i = NULL;
  201. halg = jose_hook_alg_find(JOSE_HOOK_ALG_KIND_HASH, &alg->name[1]);
  202. if (!halg)
  203. return NULL;
  204. i = calloc(1, sizeof(*i));
  205. if (!i)
  206. return NULL;
  207. io = jose_io_incref(&i->io);
  208. io->feed = io_feed;
  209. io->done = ver_done;
  210. io->free = io_free;
  211. i->b = jose_io_malloc(cfg, &i->hsh, &i->hshl);
  212. i->h = halg->hash.hsh(halg, cfg, i->b);
  213. i->sig = json_incref((json_t *) sig);
  214. i->key = jose_openssl_jwk_to_EC_KEY(cfg, jwk);
  215. if (!i->b || !i->h || !i->sig || !i->key)
  216. return NULL;
  217. return jose_io_incref(io);
  218. }
  219. static void __attribute__((constructor))
  220. constructor(void)
  221. {
  222. static jose_hook_jwk_t jwk = {
  223. .kind = JOSE_HOOK_JWK_KIND_PREP,
  224. .prep.handles = jwk_prep_handles,
  225. .prep.execute = jwk_prep_execute,
  226. };
  227. static jose_hook_alg_t algs[] = {
  228. { .kind = JOSE_HOOK_ALG_KIND_SIGN,
  229. .name = "ES256",
  230. .sign.sprm = "sign",
  231. .sign.vprm = "verify",
  232. .sign.sug = alg_sign_sug,
  233. .sign.sig = alg_sign_sig,
  234. .sign.ver = alg_sign_ver },
  235. { .kind = JOSE_HOOK_ALG_KIND_SIGN,
  236. .name = "ES384",
  237. .sign.sprm = "sign",
  238. .sign.vprm = "verify",
  239. .sign.sug = alg_sign_sug,
  240. .sign.sig = alg_sign_sig,
  241. .sign.ver = alg_sign_ver },
  242. { .kind = JOSE_HOOK_ALG_KIND_SIGN,
  243. .name = "ES512",
  244. .sign.sprm = "sign",
  245. .sign.vprm = "verify",
  246. .sign.sug = alg_sign_sug,
  247. .sign.sig = alg_sign_sig,
  248. .sign.ver = alg_sign_ver },
  249. {}
  250. };
  251. jose_hook_jwk_push(&jwk);
  252. for (size_t i = 0; algs[i].name; i++)
  253. jose_hook_alg_push(&algs[i]);
  254. }