pkparse.c 41 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391
  1. /*
  2. * Public Key layer for parsing key files and structures
  3. *
  4. * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
  5. * SPDX-License-Identifier: Apache-2.0
  6. *
  7. * Licensed under the Apache License, Version 2.0 (the "License"); you may
  8. * not use this file except in compliance with the License.
  9. * You may obtain a copy of the License at
  10. *
  11. * http://www.apache.org/licenses/LICENSE-2.0
  12. *
  13. * Unless required by applicable law or agreed to in writing, software
  14. * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  15. * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16. * See the License for the specific language governing permissions and
  17. * limitations under the License.
  18. *
  19. * This file is part of mbed TLS (https://tls.mbed.org)
  20. */
  21. #if !defined(MBEDTLS_CONFIG_FILE)
  22. #include "mbedtls/config.h"
  23. #else
  24. #include MBEDTLS_CONFIG_FILE
  25. #endif
  26. #if defined(MBEDTLS_PK_PARSE_C)
  27. #include "mbedtls/pk.h"
  28. #include "mbedtls/asn1.h"
  29. #include "mbedtls/oid.h"
  30. #include <string.h>
  31. #if defined(MBEDTLS_RSA_C)
  32. #include "mbedtls/rsa.h"
  33. #endif
  34. #if defined(MBEDTLS_ECP_C)
  35. #include "mbedtls/ecp.h"
  36. #endif
  37. #if defined(MBEDTLS_ECDSA_C)
  38. #include "mbedtls/ecdsa.h"
  39. #endif
  40. #if defined(MBEDTLS_PEM_PARSE_C)
  41. #include "mbedtls/pem.h"
  42. #endif
  43. #if defined(MBEDTLS_PKCS5_C)
  44. #include "mbedtls/pkcs5.h"
  45. #endif
  46. #if defined(MBEDTLS_PKCS12_C)
  47. #include "mbedtls/pkcs12.h"
  48. #endif
  49. #if defined(MBEDTLS_PLATFORM_C)
  50. #include "mbedtls/platform.h"
  51. #else
  52. #include <stdlib.h>
  53. #define mbedtls_calloc calloc
  54. #define mbedtls_free free
  55. #endif
  56. #if defined(MBEDTLS_FS_IO) || \
  57. defined(MBEDTLS_PKCS12_C) || defined(MBEDTLS_PKCS5_C)
  58. /* Implementation that should never be optimized out by the compiler */
  59. static void mbedtls_zeroize( void *v, size_t n ) {
  60. volatile unsigned char *p = v; while( n-- ) *p++ = 0;
  61. }
  62. #endif
  63. #if defined(MBEDTLS_FS_IO)
  64. /*
  65. * Load all data from a file into a given buffer.
  66. *
  67. * The file is expected to contain either PEM or DER encoded data.
  68. * A terminating null byte is always appended. It is included in the announced
  69. * length only if the data looks like it is PEM encoded.
  70. */
  71. int mbedtls_pk_load_file( const char *path, unsigned char **buf, size_t *n )
  72. {
  73. FILE *f;
  74. long size;
  75. if( ( f = fopen( path, "rb" ) ) == NULL )
  76. return( MBEDTLS_ERR_PK_FILE_IO_ERROR );
  77. fseek( f, 0, SEEK_END );
  78. if( ( size = ftell( f ) ) == -1 )
  79. {
  80. fclose( f );
  81. return( MBEDTLS_ERR_PK_FILE_IO_ERROR );
  82. }
  83. fseek( f, 0, SEEK_SET );
  84. *n = (size_t) size;
  85. if( *n + 1 == 0 ||
  86. ( *buf = mbedtls_calloc( 1, *n + 1 ) ) == NULL )
  87. {
  88. fclose( f );
  89. return( MBEDTLS_ERR_PK_ALLOC_FAILED );
  90. }
  91. if( fread( *buf, 1, *n, f ) != *n )
  92. {
  93. fclose( f );
  94. mbedtls_zeroize( *buf, *n );
  95. mbedtls_free( *buf );
  96. return( MBEDTLS_ERR_PK_FILE_IO_ERROR );
  97. }
  98. fclose( f );
  99. (*buf)[*n] = '\0';
  100. if( strstr( (const char *) *buf, "-----BEGIN " ) != NULL )
  101. ++*n;
  102. return( 0 );
  103. }
  104. /*
  105. * Load and parse a private key
  106. */
  107. int mbedtls_pk_parse_keyfile( mbedtls_pk_context *ctx,
  108. const char *path, const char *pwd )
  109. {
  110. int ret;
  111. size_t n;
  112. unsigned char *buf;
  113. if( ( ret = mbedtls_pk_load_file( path, &buf, &n ) ) != 0 )
  114. return( ret );
  115. if( pwd == NULL )
  116. ret = mbedtls_pk_parse_key( ctx, buf, n, NULL, 0 );
  117. else
  118. ret = mbedtls_pk_parse_key( ctx, buf, n,
  119. (const unsigned char *) pwd, strlen( pwd ) );
  120. mbedtls_zeroize( buf, n );
  121. mbedtls_free( buf );
  122. return( ret );
  123. }
  124. /*
  125. * Load and parse a public key
  126. */
  127. int mbedtls_pk_parse_public_keyfile( mbedtls_pk_context *ctx, const char *path )
  128. {
  129. int ret;
  130. size_t n;
  131. unsigned char *buf;
  132. if( ( ret = mbedtls_pk_load_file( path, &buf, &n ) ) != 0 )
  133. return( ret );
  134. ret = mbedtls_pk_parse_public_key( ctx, buf, n );
  135. mbedtls_zeroize( buf, n );
  136. mbedtls_free( buf );
  137. return( ret );
  138. }
  139. #endif /* MBEDTLS_FS_IO */
  140. #if defined(MBEDTLS_ECP_C)
  141. /* Minimally parse an ECParameters buffer to and mbedtls_asn1_buf
  142. *
  143. * ECParameters ::= CHOICE {
  144. * namedCurve OBJECT IDENTIFIER
  145. * specifiedCurve SpecifiedECDomain -- = SEQUENCE { ... }
  146. * -- implicitCurve NULL
  147. * }
  148. */
  149. static int pk_get_ecparams( unsigned char **p, const unsigned char *end,
  150. mbedtls_asn1_buf *params )
  151. {
  152. int ret;
  153. /* Tag may be either OID or SEQUENCE */
  154. params->tag = **p;
  155. if( params->tag != MBEDTLS_ASN1_OID
  156. #if defined(MBEDTLS_PK_PARSE_EC_EXTENDED)
  157. && params->tag != ( MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE )
  158. #endif
  159. )
  160. {
  161. return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT +
  162. MBEDTLS_ERR_ASN1_UNEXPECTED_TAG );
  163. }
  164. if( ( ret = mbedtls_asn1_get_tag( p, end, &params->len, params->tag ) ) != 0 )
  165. {
  166. return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
  167. }
  168. params->p = *p;
  169. *p += params->len;
  170. if( *p != end )
  171. return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT +
  172. MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
  173. return( 0 );
  174. }
  175. #if defined(MBEDTLS_PK_PARSE_EC_EXTENDED)
  176. /*
  177. * Parse a SpecifiedECDomain (SEC 1 C.2) and (mostly) fill the group with it.
  178. * WARNING: the resulting group should only be used with
  179. * pk_group_id_from_specified(), since its base point may not be set correctly
  180. * if it was encoded compressed.
  181. *
  182. * SpecifiedECDomain ::= SEQUENCE {
  183. * version SpecifiedECDomainVersion(ecdpVer1 | ecdpVer2 | ecdpVer3, ...),
  184. * fieldID FieldID {{FieldTypes}},
  185. * curve Curve,
  186. * base ECPoint,
  187. * order INTEGER,
  188. * cofactor INTEGER OPTIONAL,
  189. * hash HashAlgorithm OPTIONAL,
  190. * ...
  191. * }
  192. *
  193. * We only support prime-field as field type, and ignore hash and cofactor.
  194. */
  195. static int pk_group_from_specified( const mbedtls_asn1_buf *params, mbedtls_ecp_group *grp )
  196. {
  197. int ret;
  198. unsigned char *p = params->p;
  199. const unsigned char * const end = params->p + params->len;
  200. const unsigned char *end_field, *end_curve;
  201. size_t len;
  202. int ver;
  203. /* SpecifiedECDomainVersion ::= INTEGER { 1, 2, 3 } */
  204. if( ( ret = mbedtls_asn1_get_int( &p, end, &ver ) ) != 0 )
  205. return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
  206. if( ver < 1 || ver > 3 )
  207. return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT );
  208. /*
  209. * FieldID { FIELD-ID:IOSet } ::= SEQUENCE { -- Finite field
  210. * fieldType FIELD-ID.&id({IOSet}),
  211. * parameters FIELD-ID.&Type({IOSet}{@fieldType})
  212. * }
  213. */
  214. if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
  215. MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
  216. return( ret );
  217. end_field = p + len;
  218. /*
  219. * FIELD-ID ::= TYPE-IDENTIFIER
  220. * FieldTypes FIELD-ID ::= {
  221. * { Prime-p IDENTIFIED BY prime-field } |
  222. * { Characteristic-two IDENTIFIED BY characteristic-two-field }
  223. * }
  224. * prime-field OBJECT IDENTIFIER ::= { id-fieldType 1 }
  225. */
  226. if( ( ret = mbedtls_asn1_get_tag( &p, end_field, &len, MBEDTLS_ASN1_OID ) ) != 0 )
  227. return( ret );
  228. if( len != MBEDTLS_OID_SIZE( MBEDTLS_OID_ANSI_X9_62_PRIME_FIELD ) ||
  229. memcmp( p, MBEDTLS_OID_ANSI_X9_62_PRIME_FIELD, len ) != 0 )
  230. {
  231. return( MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE );
  232. }
  233. p += len;
  234. /* Prime-p ::= INTEGER -- Field of size p. */
  235. if( ( ret = mbedtls_asn1_get_mpi( &p, end_field, &grp->P ) ) != 0 )
  236. return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
  237. grp->pbits = mbedtls_mpi_bitlen( &grp->P );
  238. if( p != end_field )
  239. return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT +
  240. MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
  241. /*
  242. * Curve ::= SEQUENCE {
  243. * a FieldElement,
  244. * b FieldElement,
  245. * seed BIT STRING OPTIONAL
  246. * -- Shall be present if used in SpecifiedECDomain
  247. * -- with version equal to ecdpVer2 or ecdpVer3
  248. * }
  249. */
  250. if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
  251. MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
  252. return( ret );
  253. end_curve = p + len;
  254. /*
  255. * FieldElement ::= OCTET STRING
  256. * containing an integer in the case of a prime field
  257. */
  258. if( ( ret = mbedtls_asn1_get_tag( &p, end_curve, &len, MBEDTLS_ASN1_OCTET_STRING ) ) != 0 ||
  259. ( ret = mbedtls_mpi_read_binary( &grp->A, p, len ) ) != 0 )
  260. {
  261. return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
  262. }
  263. p += len;
  264. if( ( ret = mbedtls_asn1_get_tag( &p, end_curve, &len, MBEDTLS_ASN1_OCTET_STRING ) ) != 0 ||
  265. ( ret = mbedtls_mpi_read_binary( &grp->B, p, len ) ) != 0 )
  266. {
  267. return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
  268. }
  269. p += len;
  270. /* Ignore seed BIT STRING OPTIONAL */
  271. if( ( ret = mbedtls_asn1_get_tag( &p, end_curve, &len, MBEDTLS_ASN1_BIT_STRING ) ) == 0 )
  272. p += len;
  273. if( p != end_curve )
  274. return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT +
  275. MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
  276. /*
  277. * ECPoint ::= OCTET STRING
  278. */
  279. if( ( ret = mbedtls_asn1_get_tag( &p, end, &len, MBEDTLS_ASN1_OCTET_STRING ) ) != 0 )
  280. return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
  281. if( ( ret = mbedtls_ecp_point_read_binary( grp, &grp->G,
  282. ( const unsigned char *) p, len ) ) != 0 )
  283. {
  284. /*
  285. * If we can't read the point because it's compressed, cheat by
  286. * reading only the X coordinate and the parity bit of Y.
  287. */
  288. if( ret != MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE ||
  289. ( p[0] != 0x02 && p[0] != 0x03 ) ||
  290. len != mbedtls_mpi_size( &grp->P ) + 1 ||
  291. mbedtls_mpi_read_binary( &grp->G.X, p + 1, len - 1 ) != 0 ||
  292. mbedtls_mpi_lset( &grp->G.Y, p[0] - 2 ) != 0 ||
  293. mbedtls_mpi_lset( &grp->G.Z, 1 ) != 0 )
  294. {
  295. return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT );
  296. }
  297. }
  298. p += len;
  299. /*
  300. * order INTEGER
  301. */
  302. if( ( ret = mbedtls_asn1_get_mpi( &p, end, &grp->N ) ) != 0 )
  303. return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
  304. grp->nbits = mbedtls_mpi_bitlen( &grp->N );
  305. /*
  306. * Allow optional elements by purposefully not enforcing p == end here.
  307. */
  308. return( 0 );
  309. }
  310. /*
  311. * Find the group id associated with an (almost filled) group as generated by
  312. * pk_group_from_specified(), or return an error if unknown.
  313. */
  314. static int pk_group_id_from_group( const mbedtls_ecp_group *grp, mbedtls_ecp_group_id *grp_id )
  315. {
  316. int ret = 0;
  317. mbedtls_ecp_group ref;
  318. const mbedtls_ecp_group_id *id;
  319. mbedtls_ecp_group_init( &ref );
  320. for( id = mbedtls_ecp_grp_id_list(); *id != MBEDTLS_ECP_DP_NONE; id++ )
  321. {
  322. /* Load the group associated to that id */
  323. mbedtls_ecp_group_free( &ref );
  324. MBEDTLS_MPI_CHK( mbedtls_ecp_group_load( &ref, *id ) );
  325. /* Compare to the group we were given, starting with easy tests */
  326. if( grp->pbits == ref.pbits && grp->nbits == ref.nbits &&
  327. mbedtls_mpi_cmp_mpi( &grp->P, &ref.P ) == 0 &&
  328. mbedtls_mpi_cmp_mpi( &grp->A, &ref.A ) == 0 &&
  329. mbedtls_mpi_cmp_mpi( &grp->B, &ref.B ) == 0 &&
  330. mbedtls_mpi_cmp_mpi( &grp->N, &ref.N ) == 0 &&
  331. mbedtls_mpi_cmp_mpi( &grp->G.X, &ref.G.X ) == 0 &&
  332. mbedtls_mpi_cmp_mpi( &grp->G.Z, &ref.G.Z ) == 0 &&
  333. /* For Y we may only know the parity bit, so compare only that */
  334. mbedtls_mpi_get_bit( &grp->G.Y, 0 ) == mbedtls_mpi_get_bit( &ref.G.Y, 0 ) )
  335. {
  336. break;
  337. }
  338. }
  339. cleanup:
  340. mbedtls_ecp_group_free( &ref );
  341. *grp_id = *id;
  342. if( ret == 0 && *id == MBEDTLS_ECP_DP_NONE )
  343. ret = MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE;
  344. return( ret );
  345. }
  346. /*
  347. * Parse a SpecifiedECDomain (SEC 1 C.2) and find the associated group ID
  348. */
  349. static int pk_group_id_from_specified( const mbedtls_asn1_buf *params,
  350. mbedtls_ecp_group_id *grp_id )
  351. {
  352. int ret;
  353. mbedtls_ecp_group grp;
  354. mbedtls_ecp_group_init( &grp );
  355. if( ( ret = pk_group_from_specified( params, &grp ) ) != 0 )
  356. goto cleanup;
  357. ret = pk_group_id_from_group( &grp, grp_id );
  358. cleanup:
  359. mbedtls_ecp_group_free( &grp );
  360. return( ret );
  361. }
  362. #endif /* MBEDTLS_PK_PARSE_EC_EXTENDED */
  363. /*
  364. * Use EC parameters to initialise an EC group
  365. *
  366. * ECParameters ::= CHOICE {
  367. * namedCurve OBJECT IDENTIFIER
  368. * specifiedCurve SpecifiedECDomain -- = SEQUENCE { ... }
  369. * -- implicitCurve NULL
  370. */
  371. static int pk_use_ecparams( const mbedtls_asn1_buf *params, mbedtls_ecp_group *grp )
  372. {
  373. int ret;
  374. mbedtls_ecp_group_id grp_id;
  375. if( params->tag == MBEDTLS_ASN1_OID )
  376. {
  377. if( mbedtls_oid_get_ec_grp( params, &grp_id ) != 0 )
  378. return( MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE );
  379. }
  380. else
  381. {
  382. #if defined(MBEDTLS_PK_PARSE_EC_EXTENDED)
  383. if( ( ret = pk_group_id_from_specified( params, &grp_id ) ) != 0 )
  384. return( ret );
  385. #else
  386. return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT );
  387. #endif
  388. }
  389. /*
  390. * grp may already be initilialized; if so, make sure IDs match
  391. */
  392. if( grp->id != MBEDTLS_ECP_DP_NONE && grp->id != grp_id )
  393. return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT );
  394. if( ( ret = mbedtls_ecp_group_load( grp, grp_id ) ) != 0 )
  395. return( ret );
  396. return( 0 );
  397. }
  398. /*
  399. * EC public key is an EC point
  400. *
  401. * The caller is responsible for clearing the structure upon failure if
  402. * desired. Take care to pass along the possible ECP_FEATURE_UNAVAILABLE
  403. * return code of mbedtls_ecp_point_read_binary() and leave p in a usable state.
  404. */
  405. static int pk_get_ecpubkey( unsigned char **p, const unsigned char *end,
  406. mbedtls_ecp_keypair *key )
  407. {
  408. int ret;
  409. if( ( ret = mbedtls_ecp_point_read_binary( &key->grp, &key->Q,
  410. (const unsigned char *) *p, end - *p ) ) == 0 )
  411. {
  412. ret = mbedtls_ecp_check_pubkey( &key->grp, &key->Q );
  413. }
  414. /*
  415. * We know mbedtls_ecp_point_read_binary consumed all bytes or failed
  416. */
  417. *p = (unsigned char *) end;
  418. return( ret );
  419. }
  420. #endif /* MBEDTLS_ECP_C */
  421. #if defined(MBEDTLS_RSA_C)
  422. /*
  423. * RSAPublicKey ::= SEQUENCE {
  424. * modulus INTEGER, -- n
  425. * publicExponent INTEGER -- e
  426. * }
  427. */
  428. static int pk_get_rsapubkey( unsigned char **p,
  429. const unsigned char *end,
  430. mbedtls_rsa_context *rsa )
  431. {
  432. int ret;
  433. size_t len;
  434. if( ( ret = mbedtls_asn1_get_tag( p, end, &len,
  435. MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
  436. return( MBEDTLS_ERR_PK_INVALID_PUBKEY + ret );
  437. if( *p + len != end )
  438. return( MBEDTLS_ERR_PK_INVALID_PUBKEY +
  439. MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
  440. /* Import N */
  441. if( ( ret = mbedtls_asn1_get_tag( p, end, &len, MBEDTLS_ASN1_INTEGER ) ) != 0 )
  442. return( MBEDTLS_ERR_PK_INVALID_PUBKEY + ret );
  443. if( ( ret = mbedtls_rsa_import_raw( rsa, *p, len, NULL, 0, NULL, 0,
  444. NULL, 0, NULL, 0 ) ) != 0 )
  445. return( MBEDTLS_ERR_PK_INVALID_PUBKEY );
  446. *p += len;
  447. /* Import E */
  448. if( ( ret = mbedtls_asn1_get_tag( p, end, &len, MBEDTLS_ASN1_INTEGER ) ) != 0 )
  449. return( MBEDTLS_ERR_PK_INVALID_PUBKEY + ret );
  450. if( ( ret = mbedtls_rsa_import_raw( rsa, NULL, 0, NULL, 0, NULL, 0,
  451. NULL, 0, *p, len ) ) != 0 )
  452. return( MBEDTLS_ERR_PK_INVALID_PUBKEY );
  453. *p += len;
  454. if( mbedtls_rsa_complete( rsa ) != 0 ||
  455. mbedtls_rsa_check_pubkey( rsa ) != 0 )
  456. {
  457. return( MBEDTLS_ERR_PK_INVALID_PUBKEY );
  458. }
  459. if( *p != end )
  460. return( MBEDTLS_ERR_PK_INVALID_PUBKEY +
  461. MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
  462. return( 0 );
  463. }
  464. #endif /* MBEDTLS_RSA_C */
  465. /* Get a PK algorithm identifier
  466. *
  467. * AlgorithmIdentifier ::= SEQUENCE {
  468. * algorithm OBJECT IDENTIFIER,
  469. * parameters ANY DEFINED BY algorithm OPTIONAL }
  470. */
  471. static int pk_get_pk_alg( unsigned char **p,
  472. const unsigned char *end,
  473. mbedtls_pk_type_t *pk_alg, mbedtls_asn1_buf *params )
  474. {
  475. int ret;
  476. mbedtls_asn1_buf alg_oid;
  477. memset( params, 0, sizeof(mbedtls_asn1_buf) );
  478. if( ( ret = mbedtls_asn1_get_alg( p, end, &alg_oid, params ) ) != 0 )
  479. return( MBEDTLS_ERR_PK_INVALID_ALG + ret );
  480. if( mbedtls_oid_get_pk_alg( &alg_oid, pk_alg ) != 0 )
  481. return( MBEDTLS_ERR_PK_UNKNOWN_PK_ALG );
  482. /*
  483. * No parameters with RSA (only for EC)
  484. */
  485. if( *pk_alg == MBEDTLS_PK_RSA &&
  486. ( ( params->tag != MBEDTLS_ASN1_NULL && params->tag != 0 ) ||
  487. params->len != 0 ) )
  488. {
  489. return( MBEDTLS_ERR_PK_INVALID_ALG );
  490. }
  491. return( 0 );
  492. }
  493. /*
  494. * SubjectPublicKeyInfo ::= SEQUENCE {
  495. * algorithm AlgorithmIdentifier,
  496. * subjectPublicKey BIT STRING }
  497. */
  498. int mbedtls_pk_parse_subpubkey( unsigned char **p, const unsigned char *end,
  499. mbedtls_pk_context *pk )
  500. {
  501. int ret;
  502. size_t len;
  503. mbedtls_asn1_buf alg_params;
  504. mbedtls_pk_type_t pk_alg = MBEDTLS_PK_NONE;
  505. const mbedtls_pk_info_t *pk_info;
  506. if( ( ret = mbedtls_asn1_get_tag( p, end, &len,
  507. MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
  508. {
  509. return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
  510. }
  511. end = *p + len;
  512. if( ( ret = pk_get_pk_alg( p, end, &pk_alg, &alg_params ) ) != 0 )
  513. return( ret );
  514. if( ( ret = mbedtls_asn1_get_bitstring_null( p, end, &len ) ) != 0 )
  515. return( MBEDTLS_ERR_PK_INVALID_PUBKEY + ret );
  516. if( *p + len != end )
  517. return( MBEDTLS_ERR_PK_INVALID_PUBKEY +
  518. MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
  519. if( ( pk_info = mbedtls_pk_info_from_type( pk_alg ) ) == NULL )
  520. return( MBEDTLS_ERR_PK_UNKNOWN_PK_ALG );
  521. if( ( ret = mbedtls_pk_setup( pk, pk_info ) ) != 0 )
  522. return( ret );
  523. #if defined(MBEDTLS_RSA_C)
  524. if( pk_alg == MBEDTLS_PK_RSA )
  525. {
  526. ret = pk_get_rsapubkey( p, end, mbedtls_pk_rsa( *pk ) );
  527. } else
  528. #endif /* MBEDTLS_RSA_C */
  529. #if defined(MBEDTLS_ECP_C)
  530. if( pk_alg == MBEDTLS_PK_ECKEY_DH || pk_alg == MBEDTLS_PK_ECKEY )
  531. {
  532. ret = pk_use_ecparams( &alg_params, &mbedtls_pk_ec( *pk )->grp );
  533. if( ret == 0 )
  534. ret = pk_get_ecpubkey( p, end, mbedtls_pk_ec( *pk ) );
  535. } else
  536. #endif /* MBEDTLS_ECP_C */
  537. ret = MBEDTLS_ERR_PK_UNKNOWN_PK_ALG;
  538. if( ret == 0 && *p != end )
  539. ret = MBEDTLS_ERR_PK_INVALID_PUBKEY
  540. MBEDTLS_ERR_ASN1_LENGTH_MISMATCH;
  541. if( ret != 0 )
  542. mbedtls_pk_free( pk );
  543. return( ret );
  544. }
  545. #if defined(MBEDTLS_RSA_C)
  546. /*
  547. * Parse a PKCS#1 encoded private RSA key
  548. */
  549. static int pk_parse_key_pkcs1_der( mbedtls_rsa_context *rsa,
  550. const unsigned char *key,
  551. size_t keylen )
  552. {
  553. int ret, version;
  554. size_t len;
  555. unsigned char *p, *end;
  556. mbedtls_mpi T;
  557. mbedtls_mpi_init( &T );
  558. p = (unsigned char *) key;
  559. end = p + keylen;
  560. /*
  561. * This function parses the RSAPrivateKey (PKCS#1)
  562. *
  563. * RSAPrivateKey ::= SEQUENCE {
  564. * version Version,
  565. * modulus INTEGER, -- n
  566. * publicExponent INTEGER, -- e
  567. * privateExponent INTEGER, -- d
  568. * prime1 INTEGER, -- p
  569. * prime2 INTEGER, -- q
  570. * exponent1 INTEGER, -- d mod (p-1)
  571. * exponent2 INTEGER, -- d mod (q-1)
  572. * coefficient INTEGER, -- (inverse of q) mod p
  573. * otherPrimeInfos OtherPrimeInfos OPTIONAL
  574. * }
  575. */
  576. if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
  577. MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
  578. {
  579. return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
  580. }
  581. end = p + len;
  582. if( ( ret = mbedtls_asn1_get_int( &p, end, &version ) ) != 0 )
  583. {
  584. return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
  585. }
  586. if( version != 0 )
  587. {
  588. return( MBEDTLS_ERR_PK_KEY_INVALID_VERSION );
  589. }
  590. /* Import N */
  591. if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
  592. MBEDTLS_ASN1_INTEGER ) ) != 0 ||
  593. ( ret = mbedtls_rsa_import_raw( rsa, p, len, NULL, 0, NULL, 0,
  594. NULL, 0, NULL, 0 ) ) != 0 )
  595. goto cleanup;
  596. p += len;
  597. /* Import E */
  598. if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
  599. MBEDTLS_ASN1_INTEGER ) ) != 0 ||
  600. ( ret = mbedtls_rsa_import_raw( rsa, NULL, 0, NULL, 0, NULL, 0,
  601. NULL, 0, p, len ) ) != 0 )
  602. goto cleanup;
  603. p += len;
  604. /* Import D */
  605. if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
  606. MBEDTLS_ASN1_INTEGER ) ) != 0 ||
  607. ( ret = mbedtls_rsa_import_raw( rsa, NULL, 0, NULL, 0, NULL, 0,
  608. p, len, NULL, 0 ) ) != 0 )
  609. goto cleanup;
  610. p += len;
  611. /* Import P */
  612. if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
  613. MBEDTLS_ASN1_INTEGER ) ) != 0 ||
  614. ( ret = mbedtls_rsa_import_raw( rsa, NULL, 0, p, len, NULL, 0,
  615. NULL, 0, NULL, 0 ) ) != 0 )
  616. goto cleanup;
  617. p += len;
  618. /* Import Q */
  619. if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
  620. MBEDTLS_ASN1_INTEGER ) ) != 0 ||
  621. ( ret = mbedtls_rsa_import_raw( rsa, NULL, 0, NULL, 0, p, len,
  622. NULL, 0, NULL, 0 ) ) != 0 )
  623. goto cleanup;
  624. p += len;
  625. /* Complete the RSA private key */
  626. if( ( ret = mbedtls_rsa_complete( rsa ) ) != 0 )
  627. goto cleanup;
  628. /* Check optional parameters */
  629. if( ( ret = mbedtls_asn1_get_mpi( &p, end, &T ) ) != 0 ||
  630. ( ret = mbedtls_asn1_get_mpi( &p, end, &T ) ) != 0 ||
  631. ( ret = mbedtls_asn1_get_mpi( &p, end, &T ) ) != 0 )
  632. goto cleanup;
  633. if( p != end )
  634. {
  635. ret = MBEDTLS_ERR_PK_KEY_INVALID_FORMAT +
  636. MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ;
  637. }
  638. cleanup:
  639. mbedtls_mpi_free( &T );
  640. if( ret != 0 )
  641. {
  642. /* Wrap error code if it's coming from a lower level */
  643. if( ( ret & 0xff80 ) == 0 )
  644. ret = MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret;
  645. else
  646. ret = MBEDTLS_ERR_PK_KEY_INVALID_FORMAT;
  647. mbedtls_rsa_free( rsa );
  648. }
  649. return( ret );
  650. }
  651. #endif /* MBEDTLS_RSA_C */
  652. #if defined(MBEDTLS_ECP_C)
  653. /*
  654. * Parse a SEC1 encoded private EC key
  655. */
  656. static int pk_parse_key_sec1_der( mbedtls_ecp_keypair *eck,
  657. const unsigned char *key,
  658. size_t keylen )
  659. {
  660. int ret;
  661. int version, pubkey_done;
  662. size_t len;
  663. mbedtls_asn1_buf params;
  664. unsigned char *p = (unsigned char *) key;
  665. unsigned char *end = p + keylen;
  666. unsigned char *end2;
  667. /*
  668. * RFC 5915, or SEC1 Appendix C.4
  669. *
  670. * ECPrivateKey ::= SEQUENCE {
  671. * version INTEGER { ecPrivkeyVer1(1) } (ecPrivkeyVer1),
  672. * privateKey OCTET STRING,
  673. * parameters [0] ECParameters {{ NamedCurve }} OPTIONAL,
  674. * publicKey [1] BIT STRING OPTIONAL
  675. * }
  676. */
  677. if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
  678. MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
  679. {
  680. return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
  681. }
  682. end = p + len;
  683. if( ( ret = mbedtls_asn1_get_int( &p, end, &version ) ) != 0 )
  684. return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
  685. if( version != 1 )
  686. return( MBEDTLS_ERR_PK_KEY_INVALID_VERSION );
  687. if( ( ret = mbedtls_asn1_get_tag( &p, end, &len, MBEDTLS_ASN1_OCTET_STRING ) ) != 0 )
  688. return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
  689. if( ( ret = mbedtls_mpi_read_binary( &eck->d, p, len ) ) != 0 )
  690. {
  691. mbedtls_ecp_keypair_free( eck );
  692. return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
  693. }
  694. p += len;
  695. pubkey_done = 0;
  696. if( p != end )
  697. {
  698. /*
  699. * Is 'parameters' present?
  700. */
  701. if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
  702. MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | 0 ) ) == 0 )
  703. {
  704. if( ( ret = pk_get_ecparams( &p, p + len, &params) ) != 0 ||
  705. ( ret = pk_use_ecparams( &params, &eck->grp ) ) != 0 )
  706. {
  707. mbedtls_ecp_keypair_free( eck );
  708. return( ret );
  709. }
  710. }
  711. else if( ret != MBEDTLS_ERR_ASN1_UNEXPECTED_TAG )
  712. {
  713. mbedtls_ecp_keypair_free( eck );
  714. return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
  715. }
  716. /*
  717. * Is 'publickey' present? If not, or if we can't read it (eg because it
  718. * is compressed), create it from the private key.
  719. */
  720. if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
  721. MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | 1 ) ) == 0 )
  722. {
  723. end2 = p + len;
  724. if( ( ret = mbedtls_asn1_get_bitstring_null( &p, end2, &len ) ) != 0 )
  725. return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
  726. if( p + len != end2 )
  727. return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT +
  728. MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
  729. if( ( ret = pk_get_ecpubkey( &p, end2, eck ) ) == 0 )
  730. pubkey_done = 1;
  731. else
  732. {
  733. /*
  734. * The only acceptable failure mode of pk_get_ecpubkey() above
  735. * is if the point format is not recognized.
  736. */
  737. if( ret != MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE )
  738. return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT );
  739. }
  740. }
  741. else if( ret != MBEDTLS_ERR_ASN1_UNEXPECTED_TAG )
  742. {
  743. mbedtls_ecp_keypair_free( eck );
  744. return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
  745. }
  746. }
  747. if( ! pubkey_done &&
  748. ( ret = mbedtls_ecp_mul( &eck->grp, &eck->Q, &eck->d, &eck->grp.G,
  749. NULL, NULL ) ) != 0 )
  750. {
  751. mbedtls_ecp_keypair_free( eck );
  752. return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
  753. }
  754. if( ( ret = mbedtls_ecp_check_privkey( &eck->grp, &eck->d ) ) != 0 )
  755. {
  756. mbedtls_ecp_keypair_free( eck );
  757. return( ret );
  758. }
  759. return( 0 );
  760. }
  761. #endif /* MBEDTLS_ECP_C */
  762. /*
  763. * Parse an unencrypted PKCS#8 encoded private key
  764. *
  765. * Notes:
  766. *
  767. * - This function does not own the key buffer. It is the
  768. * responsibility of the caller to take care of zeroizing
  769. * and freeing it after use.
  770. *
  771. * - The function is responsible for freeing the provided
  772. * PK context on failure.
  773. *
  774. */
  775. static int pk_parse_key_pkcs8_unencrypted_der(
  776. mbedtls_pk_context *pk,
  777. const unsigned char* key,
  778. size_t keylen )
  779. {
  780. int ret, version;
  781. size_t len;
  782. mbedtls_asn1_buf params;
  783. unsigned char *p = (unsigned char *) key;
  784. unsigned char *end = p + keylen;
  785. mbedtls_pk_type_t pk_alg = MBEDTLS_PK_NONE;
  786. const mbedtls_pk_info_t *pk_info;
  787. /*
  788. * This function parses the PrivateKeyInfo object (PKCS#8 v1.2 = RFC 5208)
  789. *
  790. * PrivateKeyInfo ::= SEQUENCE {
  791. * version Version,
  792. * privateKeyAlgorithm PrivateKeyAlgorithmIdentifier,
  793. * privateKey PrivateKey,
  794. * attributes [0] IMPLICIT Attributes OPTIONAL }
  795. *
  796. * Version ::= INTEGER
  797. * PrivateKeyAlgorithmIdentifier ::= AlgorithmIdentifier
  798. * PrivateKey ::= OCTET STRING
  799. *
  800. * The PrivateKey OCTET STRING is a SEC1 ECPrivateKey
  801. */
  802. if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
  803. MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
  804. {
  805. return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
  806. }
  807. end = p + len;
  808. if( ( ret = mbedtls_asn1_get_int( &p, end, &version ) ) != 0 )
  809. return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
  810. if( version != 0 )
  811. return( MBEDTLS_ERR_PK_KEY_INVALID_VERSION + ret );
  812. if( ( ret = pk_get_pk_alg( &p, end, &pk_alg, &params ) ) != 0 )
  813. return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
  814. if( ( ret = mbedtls_asn1_get_tag( &p, end, &len, MBEDTLS_ASN1_OCTET_STRING ) ) != 0 )
  815. return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
  816. if( len < 1 )
  817. return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT +
  818. MBEDTLS_ERR_ASN1_OUT_OF_DATA );
  819. if( ( pk_info = mbedtls_pk_info_from_type( pk_alg ) ) == NULL )
  820. return( MBEDTLS_ERR_PK_UNKNOWN_PK_ALG );
  821. if( ( ret = mbedtls_pk_setup( pk, pk_info ) ) != 0 )
  822. return( ret );
  823. #if defined(MBEDTLS_RSA_C)
  824. if( pk_alg == MBEDTLS_PK_RSA )
  825. {
  826. if( ( ret = pk_parse_key_pkcs1_der( mbedtls_pk_rsa( *pk ), p, len ) ) != 0 )
  827. {
  828. mbedtls_pk_free( pk );
  829. return( ret );
  830. }
  831. } else
  832. #endif /* MBEDTLS_RSA_C */
  833. #if defined(MBEDTLS_ECP_C)
  834. if( pk_alg == MBEDTLS_PK_ECKEY || pk_alg == MBEDTLS_PK_ECKEY_DH )
  835. {
  836. if( ( ret = pk_use_ecparams( &params, &mbedtls_pk_ec( *pk )->grp ) ) != 0 ||
  837. ( ret = pk_parse_key_sec1_der( mbedtls_pk_ec( *pk ), p, len ) ) != 0 )
  838. {
  839. mbedtls_pk_free( pk );
  840. return( ret );
  841. }
  842. } else
  843. #endif /* MBEDTLS_ECP_C */
  844. return( MBEDTLS_ERR_PK_UNKNOWN_PK_ALG );
  845. return( 0 );
  846. }
  847. /*
  848. * Parse an encrypted PKCS#8 encoded private key
  849. *
  850. * To save space, the decryption happens in-place on the given key buffer.
  851. * Also, while this function may modify the keybuffer, it doesn't own it,
  852. * and instead it is the responsibility of the caller to zeroize and properly
  853. * free it after use.
  854. *
  855. */
  856. #if defined(MBEDTLS_PKCS12_C) || defined(MBEDTLS_PKCS5_C)
  857. static int pk_parse_key_pkcs8_encrypted_der(
  858. mbedtls_pk_context *pk,
  859. unsigned char *key, size_t keylen,
  860. const unsigned char *pwd, size_t pwdlen )
  861. {
  862. int ret, decrypted = 0;
  863. size_t len;
  864. unsigned char *buf;
  865. unsigned char *p, *end;
  866. mbedtls_asn1_buf pbe_alg_oid, pbe_params;
  867. #if defined(MBEDTLS_PKCS12_C)
  868. mbedtls_cipher_type_t cipher_alg;
  869. mbedtls_md_type_t md_alg;
  870. #endif
  871. p = key;
  872. end = p + keylen;
  873. if( pwdlen == 0 )
  874. return( MBEDTLS_ERR_PK_PASSWORD_REQUIRED );
  875. /*
  876. * This function parses the EncryptedPrivateKeyInfo object (PKCS#8)
  877. *
  878. * EncryptedPrivateKeyInfo ::= SEQUENCE {
  879. * encryptionAlgorithm EncryptionAlgorithmIdentifier,
  880. * encryptedData EncryptedData
  881. * }
  882. *
  883. * EncryptionAlgorithmIdentifier ::= AlgorithmIdentifier
  884. *
  885. * EncryptedData ::= OCTET STRING
  886. *
  887. * The EncryptedData OCTET STRING is a PKCS#8 PrivateKeyInfo
  888. *
  889. */
  890. if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
  891. MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
  892. {
  893. return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
  894. }
  895. end = p + len;
  896. if( ( ret = mbedtls_asn1_get_alg( &p, end, &pbe_alg_oid, &pbe_params ) ) != 0 )
  897. return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
  898. if( ( ret = mbedtls_asn1_get_tag( &p, end, &len, MBEDTLS_ASN1_OCTET_STRING ) ) != 0 )
  899. return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
  900. buf = p;
  901. /*
  902. * Decrypt EncryptedData with appropriate PBE
  903. */
  904. #if defined(MBEDTLS_PKCS12_C)
  905. if( mbedtls_oid_get_pkcs12_pbe_alg( &pbe_alg_oid, &md_alg, &cipher_alg ) == 0 )
  906. {
  907. if( ( ret = mbedtls_pkcs12_pbe( &pbe_params, MBEDTLS_PKCS12_PBE_DECRYPT,
  908. cipher_alg, md_alg,
  909. pwd, pwdlen, p, len, buf ) ) != 0 )
  910. {
  911. if( ret == MBEDTLS_ERR_PKCS12_PASSWORD_MISMATCH )
  912. return( MBEDTLS_ERR_PK_PASSWORD_MISMATCH );
  913. return( ret );
  914. }
  915. decrypted = 1;
  916. }
  917. else if( MBEDTLS_OID_CMP( MBEDTLS_OID_PKCS12_PBE_SHA1_RC4_128, &pbe_alg_oid ) == 0 )
  918. {
  919. if( ( ret = mbedtls_pkcs12_pbe_sha1_rc4_128( &pbe_params,
  920. MBEDTLS_PKCS12_PBE_DECRYPT,
  921. pwd, pwdlen,
  922. p, len, buf ) ) != 0 )
  923. {
  924. return( ret );
  925. }
  926. // Best guess for password mismatch when using RC4. If first tag is
  927. // not MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE
  928. //
  929. if( *buf != ( MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) )
  930. return( MBEDTLS_ERR_PK_PASSWORD_MISMATCH );
  931. decrypted = 1;
  932. }
  933. else
  934. #endif /* MBEDTLS_PKCS12_C */
  935. #if defined(MBEDTLS_PKCS5_C)
  936. if( MBEDTLS_OID_CMP( MBEDTLS_OID_PKCS5_PBES2, &pbe_alg_oid ) == 0 )
  937. {
  938. if( ( ret = mbedtls_pkcs5_pbes2( &pbe_params, MBEDTLS_PKCS5_DECRYPT, pwd, pwdlen,
  939. p, len, buf ) ) != 0 )
  940. {
  941. if( ret == MBEDTLS_ERR_PKCS5_PASSWORD_MISMATCH )
  942. return( MBEDTLS_ERR_PK_PASSWORD_MISMATCH );
  943. return( ret );
  944. }
  945. decrypted = 1;
  946. }
  947. else
  948. #endif /* MBEDTLS_PKCS5_C */
  949. {
  950. ((void) pwd);
  951. }
  952. if( decrypted == 0 )
  953. return( MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE );
  954. return( pk_parse_key_pkcs8_unencrypted_der( pk, buf, len ) );
  955. }
  956. #endif /* MBEDTLS_PKCS12_C || MBEDTLS_PKCS5_C */
  957. /*
  958. * Parse a private key
  959. */
  960. int mbedtls_pk_parse_key( mbedtls_pk_context *pk,
  961. const unsigned char *key, size_t keylen,
  962. const unsigned char *pwd, size_t pwdlen )
  963. {
  964. int ret;
  965. const mbedtls_pk_info_t *pk_info;
  966. #if defined(MBEDTLS_PEM_PARSE_C)
  967. size_t len;
  968. mbedtls_pem_context pem;
  969. mbedtls_pem_init( &pem );
  970. #if defined(MBEDTLS_RSA_C)
  971. /* Avoid calling mbedtls_pem_read_buffer() on non-null-terminated string */
  972. if( keylen == 0 || key[keylen - 1] != '\0' )
  973. ret = MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT;
  974. else
  975. ret = mbedtls_pem_read_buffer( &pem,
  976. "-----BEGIN RSA PRIVATE KEY-----",
  977. "-----END RSA PRIVATE KEY-----",
  978. key, pwd, pwdlen, &len );
  979. if( ret == 0 )
  980. {
  981. pk_info = mbedtls_pk_info_from_type( MBEDTLS_PK_RSA );
  982. if( ( ret = mbedtls_pk_setup( pk, pk_info ) ) != 0 ||
  983. ( ret = pk_parse_key_pkcs1_der( mbedtls_pk_rsa( *pk ),
  984. pem.buf, pem.buflen ) ) != 0 )
  985. {
  986. mbedtls_pk_free( pk );
  987. }
  988. mbedtls_pem_free( &pem );
  989. return( ret );
  990. }
  991. else if( ret == MBEDTLS_ERR_PEM_PASSWORD_MISMATCH )
  992. return( MBEDTLS_ERR_PK_PASSWORD_MISMATCH );
  993. else if( ret == MBEDTLS_ERR_PEM_PASSWORD_REQUIRED )
  994. return( MBEDTLS_ERR_PK_PASSWORD_REQUIRED );
  995. else if( ret != MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT )
  996. return( ret );
  997. #endif /* MBEDTLS_RSA_C */
  998. #if defined(MBEDTLS_ECP_C)
  999. /* Avoid calling mbedtls_pem_read_buffer() on non-null-terminated string */
  1000. if( keylen == 0 || key[keylen - 1] != '\0' )
  1001. ret = MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT;
  1002. else
  1003. ret = mbedtls_pem_read_buffer( &pem,
  1004. "-----BEGIN EC PRIVATE KEY-----",
  1005. "-----END EC PRIVATE KEY-----",
  1006. key, pwd, pwdlen, &len );
  1007. if( ret == 0 )
  1008. {
  1009. pk_info = mbedtls_pk_info_from_type( MBEDTLS_PK_ECKEY );
  1010. if( ( ret = mbedtls_pk_setup( pk, pk_info ) ) != 0 ||
  1011. ( ret = pk_parse_key_sec1_der( mbedtls_pk_ec( *pk ),
  1012. pem.buf, pem.buflen ) ) != 0 )
  1013. {
  1014. mbedtls_pk_free( pk );
  1015. }
  1016. mbedtls_pem_free( &pem );
  1017. return( ret );
  1018. }
  1019. else if( ret == MBEDTLS_ERR_PEM_PASSWORD_MISMATCH )
  1020. return( MBEDTLS_ERR_PK_PASSWORD_MISMATCH );
  1021. else if( ret == MBEDTLS_ERR_PEM_PASSWORD_REQUIRED )
  1022. return( MBEDTLS_ERR_PK_PASSWORD_REQUIRED );
  1023. else if( ret != MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT )
  1024. return( ret );
  1025. #endif /* MBEDTLS_ECP_C */
  1026. /* Avoid calling mbedtls_pem_read_buffer() on non-null-terminated string */
  1027. if( keylen == 0 || key[keylen - 1] != '\0' )
  1028. ret = MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT;
  1029. else
  1030. ret = mbedtls_pem_read_buffer( &pem,
  1031. "-----BEGIN PRIVATE KEY-----",
  1032. "-----END PRIVATE KEY-----",
  1033. key, NULL, 0, &len );
  1034. if( ret == 0 )
  1035. {
  1036. if( ( ret = pk_parse_key_pkcs8_unencrypted_der( pk,
  1037. pem.buf, pem.buflen ) ) != 0 )
  1038. {
  1039. mbedtls_pk_free( pk );
  1040. }
  1041. mbedtls_pem_free( &pem );
  1042. return( ret );
  1043. }
  1044. else if( ret != MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT )
  1045. return( ret );
  1046. #if defined(MBEDTLS_PKCS12_C) || defined(MBEDTLS_PKCS5_C)
  1047. /* Avoid calling mbedtls_pem_read_buffer() on non-null-terminated string */
  1048. if( keylen == 0 || key[keylen - 1] != '\0' )
  1049. ret = MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT;
  1050. else
  1051. ret = mbedtls_pem_read_buffer( &pem,
  1052. "-----BEGIN ENCRYPTED PRIVATE KEY-----",
  1053. "-----END ENCRYPTED PRIVATE KEY-----",
  1054. key, NULL, 0, &len );
  1055. if( ret == 0 )
  1056. {
  1057. if( ( ret = pk_parse_key_pkcs8_encrypted_der( pk,
  1058. pem.buf, pem.buflen,
  1059. pwd, pwdlen ) ) != 0 )
  1060. {
  1061. mbedtls_pk_free( pk );
  1062. }
  1063. mbedtls_pem_free( &pem );
  1064. return( ret );
  1065. }
  1066. else if( ret != MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT )
  1067. return( ret );
  1068. #endif /* MBEDTLS_PKCS12_C || MBEDTLS_PKCS5_C */
  1069. #else
  1070. ((void) ret);
  1071. ((void) pwd);
  1072. ((void) pwdlen);
  1073. #endif /* MBEDTLS_PEM_PARSE_C */
  1074. /*
  1075. * At this point we only know it's not a PEM formatted key. Could be any
  1076. * of the known DER encoded private key formats
  1077. *
  1078. * We try the different DER format parsers to see if one passes without
  1079. * error
  1080. */
  1081. #if defined(MBEDTLS_PKCS12_C) || defined(MBEDTLS_PKCS5_C)
  1082. {
  1083. unsigned char *key_copy;
  1084. if( ( key_copy = mbedtls_calloc( 1, keylen ) ) == NULL )
  1085. return( MBEDTLS_ERR_PK_ALLOC_FAILED );
  1086. memcpy( key_copy, key, keylen );
  1087. ret = pk_parse_key_pkcs8_encrypted_der( pk, key_copy, keylen,
  1088. pwd, pwdlen );
  1089. mbedtls_zeroize( key_copy, keylen );
  1090. mbedtls_free( key_copy );
  1091. }
  1092. if( ret == 0 )
  1093. return( 0 );
  1094. mbedtls_pk_free( pk );
  1095. if( ret == MBEDTLS_ERR_PK_PASSWORD_MISMATCH )
  1096. {
  1097. return( ret );
  1098. }
  1099. #endif /* MBEDTLS_PKCS12_C || MBEDTLS_PKCS5_C */
  1100. if( ( ret = pk_parse_key_pkcs8_unencrypted_der( pk, key, keylen ) ) == 0 )
  1101. return( 0 );
  1102. mbedtls_pk_free( pk );
  1103. #if defined(MBEDTLS_RSA_C)
  1104. pk_info = mbedtls_pk_info_from_type( MBEDTLS_PK_RSA );
  1105. if( ( ret = mbedtls_pk_setup( pk, pk_info ) ) != 0 ||
  1106. ( ret = pk_parse_key_pkcs1_der( mbedtls_pk_rsa( *pk ),
  1107. key, keylen ) ) != 0 )
  1108. {
  1109. mbedtls_pk_free( pk );
  1110. }
  1111. else
  1112. {
  1113. return( 0 );
  1114. }
  1115. #endif /* MBEDTLS_RSA_C */
  1116. #if defined(MBEDTLS_ECP_C)
  1117. pk_info = mbedtls_pk_info_from_type( MBEDTLS_PK_ECKEY );
  1118. if( ( ret = mbedtls_pk_setup( pk, pk_info ) ) != 0 ||
  1119. ( ret = pk_parse_key_sec1_der( mbedtls_pk_ec( *pk ),
  1120. key, keylen ) ) != 0 )
  1121. {
  1122. mbedtls_pk_free( pk );
  1123. }
  1124. else
  1125. {
  1126. return( 0 );
  1127. }
  1128. #endif /* MBEDTLS_ECP_C */
  1129. return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT );
  1130. }
  1131. /*
  1132. * Parse a public key
  1133. */
  1134. int mbedtls_pk_parse_public_key( mbedtls_pk_context *ctx,
  1135. const unsigned char *key, size_t keylen )
  1136. {
  1137. int ret;
  1138. unsigned char *p;
  1139. #if defined(MBEDTLS_PEM_PARSE_C)
  1140. size_t len;
  1141. mbedtls_pem_context pem;
  1142. mbedtls_pem_init( &pem );
  1143. /* Avoid calling mbedtls_pem_read_buffer() on non-null-terminated string */
  1144. if( keylen == 0 || key[keylen - 1] != '\0' )
  1145. ret = MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT;
  1146. else
  1147. ret = mbedtls_pem_read_buffer( &pem,
  1148. "-----BEGIN PUBLIC KEY-----",
  1149. "-----END PUBLIC KEY-----",
  1150. key, NULL, 0, &len );
  1151. if( ret == 0 )
  1152. {
  1153. /*
  1154. * Was PEM encoded
  1155. */
  1156. key = pem.buf;
  1157. keylen = pem.buflen;
  1158. }
  1159. else if( ret != MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT )
  1160. {
  1161. mbedtls_pem_free( &pem );
  1162. return( ret );
  1163. }
  1164. #endif /* MBEDTLS_PEM_PARSE_C */
  1165. p = (unsigned char *) key;
  1166. ret = mbedtls_pk_parse_subpubkey( &p, p + keylen, ctx );
  1167. #if defined(MBEDTLS_PEM_PARSE_C)
  1168. mbedtls_pem_free( &pem );
  1169. #endif
  1170. return( ret );
  1171. }
  1172. #endif /* MBEDTLS_PK_PARSE_C */