pem.c 14 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492
  1. /*
  2. * Privacy Enhanced Mail (PEM) decoding
  3. *
  4. * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
  5. * SPDX-License-Identifier: Apache-2.0
  6. *
  7. * Licensed under the Apache License, Version 2.0 (the "License"); you may
  8. * not use this file except in compliance with the License.
  9. * You may obtain a copy of the License at
  10. *
  11. * http://www.apache.org/licenses/LICENSE-2.0
  12. *
  13. * Unless required by applicable law or agreed to in writing, software
  14. * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  15. * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16. * See the License for the specific language governing permissions and
  17. * limitations under the License.
  18. *
  19. * This file is part of mbed TLS (https://tls.mbed.org)
  20. */
  21. #if !defined(MBEDTLS_CONFIG_FILE)
  22. #include "mbedtls/config.h"
  23. #else
  24. #include MBEDTLS_CONFIG_FILE
  25. #endif
  26. #if defined(MBEDTLS_PEM_PARSE_C) || defined(MBEDTLS_PEM_WRITE_C)
  27. #include "mbedtls/pem.h"
  28. #include "mbedtls/base64.h"
  29. #include "mbedtls/des.h"
  30. #include "mbedtls/aes.h"
  31. #include "mbedtls/md5.h"
  32. #include "mbedtls/cipher.h"
  33. #include <string.h>
  34. #if defined(MBEDTLS_PLATFORM_C)
  35. #include "mbedtls/platform.h"
  36. #else
  37. #include <stdlib.h>
  38. #define mbedtls_calloc calloc
  39. #define mbedtls_free free
  40. #endif
  41. #if defined(MBEDTLS_PEM_PARSE_C)
  42. /* Implementation that should never be optimized out by the compiler */
  43. static void mbedtls_zeroize( void *v, size_t n ) {
  44. volatile unsigned char *p = v; while( n-- ) *p++ = 0;
  45. }
  46. void mbedtls_pem_init( mbedtls_pem_context *ctx )
  47. {
  48. memset( ctx, 0, sizeof( mbedtls_pem_context ) );
  49. }
  50. #if defined(MBEDTLS_MD5_C) && defined(MBEDTLS_CIPHER_MODE_CBC) && \
  51. ( defined(MBEDTLS_DES_C) || defined(MBEDTLS_AES_C) )
  52. /*
  53. * Read a 16-byte hex string and convert it to binary
  54. */
  55. static int pem_get_iv( const unsigned char *s, unsigned char *iv,
  56. size_t iv_len )
  57. {
  58. size_t i, j, k;
  59. memset( iv, 0, iv_len );
  60. for( i = 0; i < iv_len * 2; i++, s++ )
  61. {
  62. if( *s >= '0' && *s <= '9' ) j = *s - '0'; else
  63. if( *s >= 'A' && *s <= 'F' ) j = *s - '7'; else
  64. if( *s >= 'a' && *s <= 'f' ) j = *s - 'W'; else
  65. return( MBEDTLS_ERR_PEM_INVALID_ENC_IV );
  66. k = ( ( i & 1 ) != 0 ) ? j : j << 4;
  67. iv[i >> 1] = (unsigned char)( iv[i >> 1] | k );
  68. }
  69. return( 0 );
  70. }
  71. static int pem_pbkdf1( unsigned char *key, size_t keylen,
  72. unsigned char *iv,
  73. const unsigned char *pwd, size_t pwdlen )
  74. {
  75. mbedtls_md5_context md5_ctx;
  76. unsigned char md5sum[16];
  77. size_t use_len;
  78. int ret;
  79. mbedtls_md5_init( &md5_ctx );
  80. /*
  81. * key[ 0..15] = MD5(pwd || IV)
  82. */
  83. if( ( ret = mbedtls_md5_starts_ret( &md5_ctx ) ) != 0 )
  84. goto exit;
  85. if( ( ret = mbedtls_md5_update_ret( &md5_ctx, pwd, pwdlen ) ) != 0 )
  86. goto exit;
  87. if( ( ret = mbedtls_md5_update_ret( &md5_ctx, iv, 8 ) ) != 0 )
  88. goto exit;
  89. if( ( ret = mbedtls_md5_finish_ret( &md5_ctx, md5sum ) ) != 0 )
  90. goto exit;
  91. if( keylen <= 16 )
  92. {
  93. memcpy( key, md5sum, keylen );
  94. goto exit;
  95. }
  96. memcpy( key, md5sum, 16 );
  97. /*
  98. * key[16..23] = MD5(key[ 0..15] || pwd || IV])
  99. */
  100. if( ( ret = mbedtls_md5_starts_ret( &md5_ctx ) ) != 0 )
  101. goto exit;
  102. if( ( ret = mbedtls_md5_update_ret( &md5_ctx, md5sum, 16 ) ) != 0 )
  103. goto exit;
  104. if( ( ret = mbedtls_md5_update_ret( &md5_ctx, pwd, pwdlen ) ) != 0 )
  105. goto exit;
  106. if( ( ret = mbedtls_md5_update_ret( &md5_ctx, iv, 8 ) ) != 0 )
  107. goto exit;
  108. if( ( ret = mbedtls_md5_finish_ret( &md5_ctx, md5sum ) ) != 0 )
  109. goto exit;
  110. use_len = 16;
  111. if( keylen < 32 )
  112. use_len = keylen - 16;
  113. memcpy( key + 16, md5sum, use_len );
  114. exit:
  115. mbedtls_md5_free( &md5_ctx );
  116. mbedtls_zeroize( md5sum, 16 );
  117. return( ret );
  118. }
  119. #if defined(MBEDTLS_DES_C)
  120. /*
  121. * Decrypt with DES-CBC, using PBKDF1 for key derivation
  122. */
  123. static int pem_des_decrypt( unsigned char des_iv[8],
  124. unsigned char *buf, size_t buflen,
  125. const unsigned char *pwd, size_t pwdlen )
  126. {
  127. mbedtls_des_context des_ctx;
  128. unsigned char des_key[8];
  129. int ret;
  130. mbedtls_des_init( &des_ctx );
  131. if( ( ret = pem_pbkdf1( des_key, 8, des_iv, pwd, pwdlen ) ) != 0 )
  132. goto exit;
  133. if( ( ret = mbedtls_des_setkey_dec( &des_ctx, des_key ) ) != 0 )
  134. goto exit;
  135. ret = mbedtls_des_crypt_cbc( &des_ctx, MBEDTLS_DES_DECRYPT, buflen,
  136. des_iv, buf, buf );
  137. exit:
  138. mbedtls_des_free( &des_ctx );
  139. mbedtls_zeroize( des_key, 8 );
  140. return( ret );
  141. }
  142. /*
  143. * Decrypt with 3DES-CBC, using PBKDF1 for key derivation
  144. */
  145. static int pem_des3_decrypt( unsigned char des3_iv[8],
  146. unsigned char *buf, size_t buflen,
  147. const unsigned char *pwd, size_t pwdlen )
  148. {
  149. mbedtls_des3_context des3_ctx;
  150. unsigned char des3_key[24];
  151. int ret;
  152. mbedtls_des3_init( &des3_ctx );
  153. if( ( ret = pem_pbkdf1( des3_key, 24, des3_iv, pwd, pwdlen ) ) != 0 )
  154. goto exit;
  155. if( ( ret = mbedtls_des3_set3key_dec( &des3_ctx, des3_key ) ) != 0 )
  156. goto exit;
  157. ret = mbedtls_des3_crypt_cbc( &des3_ctx, MBEDTLS_DES_DECRYPT, buflen,
  158. des3_iv, buf, buf );
  159. exit:
  160. mbedtls_des3_free( &des3_ctx );
  161. mbedtls_zeroize( des3_key, 24 );
  162. return( ret );
  163. }
  164. #endif /* MBEDTLS_DES_C */
  165. #if defined(MBEDTLS_AES_C)
  166. /*
  167. * Decrypt with AES-XXX-CBC, using PBKDF1 for key derivation
  168. */
  169. static int pem_aes_decrypt( unsigned char aes_iv[16], unsigned int keylen,
  170. unsigned char *buf, size_t buflen,
  171. const unsigned char *pwd, size_t pwdlen )
  172. {
  173. mbedtls_aes_context aes_ctx;
  174. unsigned char aes_key[32];
  175. int ret;
  176. mbedtls_aes_init( &aes_ctx );
  177. if( ( ret = pem_pbkdf1( aes_key, keylen, aes_iv, pwd, pwdlen ) ) != 0 )
  178. goto exit;
  179. if( ( ret = mbedtls_aes_setkey_dec( &aes_ctx, aes_key, keylen * 8 ) ) != 0 )
  180. goto exit;
  181. ret = mbedtls_aes_crypt_cbc( &aes_ctx, MBEDTLS_AES_DECRYPT, buflen,
  182. aes_iv, buf, buf );
  183. exit:
  184. mbedtls_aes_free( &aes_ctx );
  185. mbedtls_zeroize( aes_key, keylen );
  186. return( ret );
  187. }
  188. #endif /* MBEDTLS_AES_C */
  189. #endif /* MBEDTLS_MD5_C && MBEDTLS_CIPHER_MODE_CBC &&
  190. ( MBEDTLS_AES_C || MBEDTLS_DES_C ) */
  191. int mbedtls_pem_read_buffer( mbedtls_pem_context *ctx, const char *header, const char *footer,
  192. const unsigned char *data, const unsigned char *pwd,
  193. size_t pwdlen, size_t *use_len )
  194. {
  195. int ret, enc;
  196. size_t len;
  197. unsigned char *buf;
  198. const unsigned char *s1, *s2, *end;
  199. #if defined(MBEDTLS_MD5_C) && defined(MBEDTLS_CIPHER_MODE_CBC) && \
  200. ( defined(MBEDTLS_DES_C) || defined(MBEDTLS_AES_C) )
  201. unsigned char pem_iv[16];
  202. mbedtls_cipher_type_t enc_alg = MBEDTLS_CIPHER_NONE;
  203. #else
  204. ((void) pwd);
  205. ((void) pwdlen);
  206. #endif /* MBEDTLS_MD5_C && MBEDTLS_CIPHER_MODE_CBC &&
  207. ( MBEDTLS_AES_C || MBEDTLS_DES_C ) */
  208. if( ctx == NULL )
  209. return( MBEDTLS_ERR_PEM_BAD_INPUT_DATA );
  210. s1 = (unsigned char *) strstr( (const char *) data, header );
  211. if( s1 == NULL )
  212. return( MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT );
  213. s2 = (unsigned char *) strstr( (const char *) data, footer );
  214. if( s2 == NULL || s2 <= s1 )
  215. return( MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT );
  216. s1 += strlen( header );
  217. if( *s1 == ' ' ) s1++;
  218. if( *s1 == '\r' ) s1++;
  219. if( *s1 == '\n' ) s1++;
  220. else return( MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT );
  221. end = s2;
  222. end += strlen( footer );
  223. if( *end == ' ' ) end++;
  224. if( *end == '\r' ) end++;
  225. if( *end == '\n' ) end++;
  226. *use_len = end - data;
  227. enc = 0;
  228. if( s2 - s1 >= 22 && memcmp( s1, "Proc-Type: 4,ENCRYPTED", 22 ) == 0 )
  229. {
  230. #if defined(MBEDTLS_MD5_C) && defined(MBEDTLS_CIPHER_MODE_CBC) && \
  231. ( defined(MBEDTLS_DES_C) || defined(MBEDTLS_AES_C) )
  232. enc++;
  233. s1 += 22;
  234. if( *s1 == '\r' ) s1++;
  235. if( *s1 == '\n' ) s1++;
  236. else return( MBEDTLS_ERR_PEM_INVALID_DATA );
  237. #if defined(MBEDTLS_DES_C)
  238. if( s2 - s1 >= 23 && memcmp( s1, "DEK-Info: DES-EDE3-CBC,", 23 ) == 0 )
  239. {
  240. enc_alg = MBEDTLS_CIPHER_DES_EDE3_CBC;
  241. s1 += 23;
  242. if( s2 - s1 < 16 || pem_get_iv( s1, pem_iv, 8 ) != 0 )
  243. return( MBEDTLS_ERR_PEM_INVALID_ENC_IV );
  244. s1 += 16;
  245. }
  246. else if( s2 - s1 >= 18 && memcmp( s1, "DEK-Info: DES-CBC,", 18 ) == 0 )
  247. {
  248. enc_alg = MBEDTLS_CIPHER_DES_CBC;
  249. s1 += 18;
  250. if( s2 - s1 < 16 || pem_get_iv( s1, pem_iv, 8) != 0 )
  251. return( MBEDTLS_ERR_PEM_INVALID_ENC_IV );
  252. s1 += 16;
  253. }
  254. #endif /* MBEDTLS_DES_C */
  255. #if defined(MBEDTLS_AES_C)
  256. if( s2 - s1 >= 14 && memcmp( s1, "DEK-Info: AES-", 14 ) == 0 )
  257. {
  258. if( s2 - s1 < 22 )
  259. return( MBEDTLS_ERR_PEM_UNKNOWN_ENC_ALG );
  260. else if( memcmp( s1, "DEK-Info: AES-128-CBC,", 22 ) == 0 )
  261. enc_alg = MBEDTLS_CIPHER_AES_128_CBC;
  262. else if( memcmp( s1, "DEK-Info: AES-192-CBC,", 22 ) == 0 )
  263. enc_alg = MBEDTLS_CIPHER_AES_192_CBC;
  264. else if( memcmp( s1, "DEK-Info: AES-256-CBC,", 22 ) == 0 )
  265. enc_alg = MBEDTLS_CIPHER_AES_256_CBC;
  266. else
  267. return( MBEDTLS_ERR_PEM_UNKNOWN_ENC_ALG );
  268. s1 += 22;
  269. if( s2 - s1 < 32 || pem_get_iv( s1, pem_iv, 16 ) != 0 )
  270. return( MBEDTLS_ERR_PEM_INVALID_ENC_IV );
  271. s1 += 32;
  272. }
  273. #endif /* MBEDTLS_AES_C */
  274. if( enc_alg == MBEDTLS_CIPHER_NONE )
  275. return( MBEDTLS_ERR_PEM_UNKNOWN_ENC_ALG );
  276. if( *s1 == '\r' ) s1++;
  277. if( *s1 == '\n' ) s1++;
  278. else return( MBEDTLS_ERR_PEM_INVALID_DATA );
  279. #else
  280. return( MBEDTLS_ERR_PEM_FEATURE_UNAVAILABLE );
  281. #endif /* MBEDTLS_MD5_C && MBEDTLS_CIPHER_MODE_CBC &&
  282. ( MBEDTLS_AES_C || MBEDTLS_DES_C ) */
  283. }
  284. if( s1 >= s2 )
  285. return( MBEDTLS_ERR_PEM_INVALID_DATA );
  286. ret = mbedtls_base64_decode( NULL, 0, &len, s1, s2 - s1 );
  287. if( ret == MBEDTLS_ERR_BASE64_INVALID_CHARACTER )
  288. return( MBEDTLS_ERR_PEM_INVALID_DATA + ret );
  289. if( ( buf = mbedtls_calloc( 1, len ) ) == NULL )
  290. return( MBEDTLS_ERR_PEM_ALLOC_FAILED );
  291. if( ( ret = mbedtls_base64_decode( buf, len, &len, s1, s2 - s1 ) ) != 0 )
  292. {
  293. mbedtls_zeroize( buf, len );
  294. mbedtls_free( buf );
  295. return( MBEDTLS_ERR_PEM_INVALID_DATA + ret );
  296. }
  297. if( enc != 0 )
  298. {
  299. #if defined(MBEDTLS_MD5_C) && defined(MBEDTLS_CIPHER_MODE_CBC) && \
  300. ( defined(MBEDTLS_DES_C) || defined(MBEDTLS_AES_C) )
  301. if( pwd == NULL )
  302. {
  303. mbedtls_zeroize( buf, len );
  304. mbedtls_free( buf );
  305. return( MBEDTLS_ERR_PEM_PASSWORD_REQUIRED );
  306. }
  307. ret = 0;
  308. #if defined(MBEDTLS_DES_C)
  309. if( enc_alg == MBEDTLS_CIPHER_DES_EDE3_CBC )
  310. ret = pem_des3_decrypt( pem_iv, buf, len, pwd, pwdlen );
  311. else if( enc_alg == MBEDTLS_CIPHER_DES_CBC )
  312. ret = pem_des_decrypt( pem_iv, buf, len, pwd, pwdlen );
  313. #endif /* MBEDTLS_DES_C */
  314. #if defined(MBEDTLS_AES_C)
  315. if( enc_alg == MBEDTLS_CIPHER_AES_128_CBC )
  316. ret = pem_aes_decrypt( pem_iv, 16, buf, len, pwd, pwdlen );
  317. else if( enc_alg == MBEDTLS_CIPHER_AES_192_CBC )
  318. ret = pem_aes_decrypt( pem_iv, 24, buf, len, pwd, pwdlen );
  319. else if( enc_alg == MBEDTLS_CIPHER_AES_256_CBC )
  320. ret = pem_aes_decrypt( pem_iv, 32, buf, len, pwd, pwdlen );
  321. #endif /* MBEDTLS_AES_C */
  322. if( ret != 0 )
  323. {
  324. mbedtls_free( buf );
  325. return( ret );
  326. }
  327. /*
  328. * The result will be ASN.1 starting with a SEQUENCE tag, with 1 to 3
  329. * length bytes (allow 4 to be sure) in all known use cases.
  330. *
  331. * Use that as heurisitic to try detecting password mismatchs.
  332. */
  333. if( len <= 2 || buf[0] != 0x30 || buf[1] > 0x83 )
  334. {
  335. mbedtls_zeroize( buf, len );
  336. mbedtls_free( buf );
  337. return( MBEDTLS_ERR_PEM_PASSWORD_MISMATCH );
  338. }
  339. #else
  340. mbedtls_zeroize( buf, len );
  341. mbedtls_free( buf );
  342. return( MBEDTLS_ERR_PEM_FEATURE_UNAVAILABLE );
  343. #endif /* MBEDTLS_MD5_C && MBEDTLS_CIPHER_MODE_CBC &&
  344. ( MBEDTLS_AES_C || MBEDTLS_DES_C ) */
  345. }
  346. ctx->buf = buf;
  347. ctx->buflen = len;
  348. return( 0 );
  349. }
  350. void mbedtls_pem_free( mbedtls_pem_context *ctx )
  351. {
  352. if( ctx->buf != NULL )
  353. mbedtls_zeroize( ctx->buf, ctx->buflen );
  354. mbedtls_free( ctx->buf );
  355. mbedtls_free( ctx->info );
  356. mbedtls_zeroize( ctx, sizeof( mbedtls_pem_context ) );
  357. }
  358. #endif /* MBEDTLS_PEM_PARSE_C */
  359. #if defined(MBEDTLS_PEM_WRITE_C)
  360. int mbedtls_pem_write_buffer( const char *header, const char *footer,
  361. const unsigned char *der_data, size_t der_len,
  362. unsigned char *buf, size_t buf_len, size_t *olen )
  363. {
  364. int ret;
  365. unsigned char *encode_buf = NULL, *c, *p = buf;
  366. size_t len = 0, use_len, add_len = 0;
  367. mbedtls_base64_encode( NULL, 0, &use_len, der_data, der_len );
  368. add_len = strlen( header ) + strlen( footer ) + ( use_len / 64 ) + 1;
  369. if( use_len + add_len > buf_len )
  370. {
  371. *olen = use_len + add_len;
  372. return( MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL );
  373. }
  374. if( use_len != 0 &&
  375. ( ( encode_buf = mbedtls_calloc( 1, use_len ) ) == NULL ) )
  376. return( MBEDTLS_ERR_PEM_ALLOC_FAILED );
  377. if( ( ret = mbedtls_base64_encode( encode_buf, use_len, &use_len, der_data,
  378. der_len ) ) != 0 )
  379. {
  380. mbedtls_free( encode_buf );
  381. return( ret );
  382. }
  383. memcpy( p, header, strlen( header ) );
  384. p += strlen( header );
  385. c = encode_buf;
  386. while( use_len )
  387. {
  388. len = ( use_len > 64 ) ? 64 : use_len;
  389. memcpy( p, c, len );
  390. use_len -= len;
  391. p += len;
  392. c += len;
  393. *p++ = '\n';
  394. }
  395. memcpy( p, footer, strlen( footer ) );
  396. p += strlen( footer );
  397. *p++ = '\0';
  398. *olen = p - buf;
  399. mbedtls_free( encode_buf );
  400. return( 0 );
  401. }
  402. #endif /* MBEDTLS_PEM_WRITE_C */
  403. #endif /* MBEDTLS_PEM_PARSE_C || MBEDTLS_PEM_WRITE_C */