dcrypt-openssl.c revision 0eaf77d8c22c542d5bd474bf1460d811876629d7
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen#include "lib.h"
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen#include "buffer.h"
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen#include "str.h"
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen#include "hex-binary.h"
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen#include "safe-memset.h"
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen#include "randgen.h"
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen#include "array.h"
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen#include "module-dir.h"
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen#include "dovecot-openssl-common.h"
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen#include <openssl/evp.h>
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen#include <openssl/sha.h>
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen#include <openssl/err.h>
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen#include <openssl/rsa.h>
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen#include <openssl/ec.h>
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen#include <openssl/bio.h>
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen#include <openssl/pem.h>
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen#include <openssl/x509.h>
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen#include <openssl/engine.h>
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen#include <openssl/hmac.h>
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen#include <openssl/objects.h>
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen#include "dcrypt.h"
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen#include "dcrypt-private.h"
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen/**
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen key format documentation:
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen =========================
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen v1 key
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen ------
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen algo id = openssl NID
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen enctype = 0 = none, 1 = ecdhe, 2 = password
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen key id = sha256(hex encoded public point)
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
45dda77a1e51970a06c82dd1b4c1ee5b0368cfe1Timo Sirainen public key
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen ----------
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen 1<tab>algo id<tab>public point
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen private key
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen -----------
66fbbac231b0385273b11f9b4c43ad252330dea5Timo Sirainen - enctype none
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen 1<tab>algo id<tab>0<tab>private point<tab>key id
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
66fbbac231b0385273b11f9b4c43ad252330dea5Timo Sirainen - enctype ecdh (algorithm AES-256-CTR, key = SHA256(shared secret), IV = \0\0\0...)
66fbbac231b0385273b11f9b4c43ad252330dea5Timo Sirainen 1<tab>algo id<tab>1<tab>private point<tab>ephemeral public key<tab>encryption key id<tab>key id
66fbbac231b0385273b11f9b4c43ad252330dea5Timo Sirainen
66fbbac231b0385273b11f9b4c43ad252330dea5Timo Sirainen - enctype password (algorithm AES-256-CTR, key = PBKDF2(SHA1, 16, password, salt), IV = \0\0\0...)
66fbbac231b0385273b11f9b4c43ad252330dea5Timo Sirainen 1<tab>algo id<tab>2<tab>private point<tab>salt<tab>key id
66fbbac231b0385273b11f9b4c43ad252330dea5Timo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen v2 key
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen ------
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen algo oid = ASN1 OID of key algorithm (RSA or EC curve)
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen enctype = 0 = none, 1 = ecdhe, 2 = password
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen key id = SHA256(i2d_PUBKEY)
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen public key
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen ----------
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen 2<tab>HEX(i2d_PUBKEY)
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen - enctype none
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen 2<tab>key algo oid<tab>0<tab>(RSA = i2d_PrivateKey, EC=Private Point)<tab>key id
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen - enctype ecdh, key,iv = PBKDF2(hash algo, rounds, shared secret, salt)
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen 2<tab>key algo oid<tab>1<tab>symmetric algo name<tab>salt<tab>hash algo<tab>rounds<tab>E(RSA = i2d_PrivateKey, EC=Private Point)<tab>ephemeral public key<tab>encryption key id<tab>key id
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen - enctype password, key,iv = PBKDF2(hash algo, rounds, password, salt)
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen 2<tab>key algo oid<tab>1<tab>symmetric algo name<tab>salt<tab>hash algo<tab>rounds<tab>E(RSA = i2d_PrivateKey, EC=Private Point)<tab>key id
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen**/
a545bcd54312b543ddc46a872ec79d0416032b0fTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen#if SSLEAY_VERSION_NUMBER < 0x1010000fL
a545bcd54312b543ddc46a872ec79d0416032b0fTimo Sirainen#define EVP_PKEY_get0_EC_KEY(x) x->pkey.ec
a545bcd54312b543ddc46a872ec79d0416032b0fTimo Sirainen#define EVP_PKEY_get0_RSA(x) x->pkey.rsa
a545bcd54312b543ddc46a872ec79d0416032b0fTimo Sirainen#endif
a545bcd54312b543ddc46a872ec79d0416032b0fTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenstruct dcrypt_context_symmetric {
a545bcd54312b543ddc46a872ec79d0416032b0fTimo Sirainen pool_t pool;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen const EVP_CIPHER *cipher;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EVP_CIPHER_CTX *ctx;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen unsigned char *key;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen unsigned char *iv;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen unsigned char *aad;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen size_t aad_len;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen unsigned char *tag;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen size_t tag_len;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen int padding;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen int mode;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen};
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenstruct dcrypt_context_hmac {
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen pool_t pool;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen const EVP_MD *md;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen#if SSLEAY_VERSION_NUMBER >= 0x1010000fL
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen HMAC_CTX *ctx;
bc85ab91357eaf47c789179362ee36f4f4f4abd7Timo Sirainen#else
bc85ab91357eaf47c789179362ee36f4f4f4abd7Timo Sirainen HMAC_CTX ctx;
bc85ab91357eaf47c789179362ee36f4f4f4abd7Timo Sirainen#endif
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen unsigned char *key;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen size_t klen;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen};
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenstruct dcrypt_public_key {
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen void *ctx;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen};
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenstruct dcrypt_private_key {
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen void *ctx;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen};
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenstatic
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenbool dcrypt_openssl_public_key_id(struct dcrypt_public_key *key, const char *algorithm, buffer_t *result, const char **error_r);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenstatic
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenbool dcrypt_openssl_public_key_id_old(struct dcrypt_public_key *key, buffer_t *result, const char **error_r);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenstatic
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenbool dcrypt_openssl_private_key_id(struct dcrypt_private_key *key, const char *algorithm, buffer_t *result, const char **error_r);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenstatic
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenbool dcrypt_openssl_private_key_id_old(struct dcrypt_private_key *key, buffer_t *result, const char **error_r);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenstatic
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenvoid dcrypt_openssl_private_to_public_key(struct dcrypt_private_key *priv_key, struct dcrypt_public_key **pub_key_r);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenstatic
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenvoid dcrypt_openssl_free_private_key(struct dcrypt_private_key **key);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenstatic
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenvoid dcrypt_openssl_free_public_key(struct dcrypt_public_key **key);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenstatic
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenbool dcrypt_openssl_rsa_decrypt(struct dcrypt_private_key *key, const unsigned char *data, size_t data_len, buffer_t *result, const char **error_r);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenstatic
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenbool dcrypt_openssl_error(const char **error_r)
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen{
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen if(error_r == NULL) return FALSE; /* caller is not really interested */
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen unsigned long ec = ERR_get_error();
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen *error_r = t_strdup_printf("%s", ERR_error_string(ec, NULL));
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen return FALSE;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen}
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
e5c28185478ecab60d0dbd78f9daaab113d5c060Timo Sirainenstatic
e5c28185478ecab60d0dbd78f9daaab113d5c060Timo Sirainenbool dcrypt_openssl_initialize(const struct dcrypt_settings *set, const char **error_r)
e5c28185478ecab60d0dbd78f9daaab113d5c060Timo Sirainen{
e5c28185478ecab60d0dbd78f9daaab113d5c060Timo Sirainen if (set->crypto_device != NULL && set->crypto_device[0] != '\0') {
e5c28185478ecab60d0dbd78f9daaab113d5c060Timo Sirainen if (dovecot_openssl_common_global_set_engine(set->crypto_device, error_r) <= 0)
e5c28185478ecab60d0dbd78f9daaab113d5c060Timo Sirainen return FALSE;
e5c28185478ecab60d0dbd78f9daaab113d5c060Timo Sirainen }
e5c28185478ecab60d0dbd78f9daaab113d5c060Timo Sirainen return TRUE;
ba8a3fbee3f8fca8e481ba929bce6b78296a7820Timo Sirainen}
ba8a3fbee3f8fca8e481ba929bce6b78296a7820Timo Sirainen
ba8a3fbee3f8fca8e481ba929bce6b78296a7820Timo Sirainen/* legacy function for old formats that generates
ba8a3fbee3f8fca8e481ba929bce6b78296a7820Timo Sirainen hex encoded point from EC public key
ba8a3fbee3f8fca8e481ba929bce6b78296a7820Timo Sirainen */
ba8a3fbee3f8fca8e481ba929bce6b78296a7820Timo Sirainenstatic
ba8a3fbee3f8fca8e481ba929bce6b78296a7820Timo Sirainenchar *ec_key_get_pub_point_hex(const EC_KEY *key)
ba8a3fbee3f8fca8e481ba929bce6b78296a7820Timo Sirainen{
ba8a3fbee3f8fca8e481ba929bce6b78296a7820Timo Sirainen const EC_POINT *p;
ba8a3fbee3f8fca8e481ba929bce6b78296a7820Timo Sirainen const EC_GROUP *g;
ba8a3fbee3f8fca8e481ba929bce6b78296a7820Timo Sirainen
ba8a3fbee3f8fca8e481ba929bce6b78296a7820Timo Sirainen p = EC_KEY_get0_public_key(key);
b780aa272b742a43579cdb523cc79cc8d4521306Timo Sirainen g = EC_KEY_get0_group(key);
b780aa272b742a43579cdb523cc79cc8d4521306Timo Sirainen return EC_POINT_point2hex(g, p, POINT_CONVERSION_COMPRESSED, NULL);
b780aa272b742a43579cdb523cc79cc8d4521306Timo Sirainen}
b780aa272b742a43579cdb523cc79cc8d4521306Timo Sirainen
b780aa272b742a43579cdb523cc79cc8d4521306Timo Sirainenstatic
b780aa272b742a43579cdb523cc79cc8d4521306Timo Sirainenbool dcrypt_openssl_ctx_sym_create(const char *algorithm, enum dcrypt_sym_mode mode, struct dcrypt_context_symmetric **ctx_r, const char **error_r)
b780aa272b742a43579cdb523cc79cc8d4521306Timo Sirainen{
b780aa272b742a43579cdb523cc79cc8d4521306Timo Sirainen struct dcrypt_context_symmetric *ctx;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen pool_t pool;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen const EVP_CIPHER *cipher;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen cipher = EVP_get_cipherbyname(algorithm);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen if (cipher == NULL) {
d461a91e5eb2270e77f4276f0268ba1eede6a08dTimo Sirainen if (error_r != NULL)
d461a91e5eb2270e77f4276f0268ba1eede6a08dTimo Sirainen *error_r = t_strdup_printf("Invalid cipher %s", algorithm);
d461a91e5eb2270e77f4276f0268ba1eede6a08dTimo Sirainen return FALSE;
d461a91e5eb2270e77f4276f0268ba1eede6a08dTimo Sirainen }
d461a91e5eb2270e77f4276f0268ba1eede6a08dTimo Sirainen /* allocate context */
d461a91e5eb2270e77f4276f0268ba1eede6a08dTimo Sirainen pool = pool_alloconly_create("dcrypt openssl", 1024);
d461a91e5eb2270e77f4276f0268ba1eede6a08dTimo Sirainen ctx = p_new(pool, struct dcrypt_context_symmetric, 1);
d461a91e5eb2270e77f4276f0268ba1eede6a08dTimo Sirainen ctx->pool = pool;
d461a91e5eb2270e77f4276f0268ba1eede6a08dTimo Sirainen ctx->cipher = cipher;
d461a91e5eb2270e77f4276f0268ba1eede6a08dTimo Sirainen ctx->padding = 1;
d461a91e5eb2270e77f4276f0268ba1eede6a08dTimo Sirainen ctx->mode =( mode == DCRYPT_MODE_ENCRYPT ? 1 : 0 );
d461a91e5eb2270e77f4276f0268ba1eede6a08dTimo Sirainen *ctx_r = ctx;
d461a91e5eb2270e77f4276f0268ba1eede6a08dTimo Sirainen return TRUE;
d461a91e5eb2270e77f4276f0268ba1eede6a08dTimo Sirainen}
d461a91e5eb2270e77f4276f0268ba1eede6a08dTimo Sirainen
d461a91e5eb2270e77f4276f0268ba1eede6a08dTimo Sirainenstatic
d461a91e5eb2270e77f4276f0268ba1eede6a08dTimo Sirainenvoid dcrypt_openssl_ctx_sym_destroy(struct dcrypt_context_symmetric **ctx)
d461a91e5eb2270e77f4276f0268ba1eede6a08dTimo Sirainen{
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen pool_t pool = (*ctx)->pool;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen if ((*ctx)->ctx != NULL) EVP_CIPHER_CTX_free((*ctx)->ctx);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen pool_unref(&pool);
5fb3f13537dffd15a31e997da133a721c0728af8Timo Sirainen *ctx = NULL;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen}
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenstatic
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenvoid dcrypt_openssl_ctx_sym_set_key(struct dcrypt_context_symmetric *ctx, const unsigned char *key, size_t key_len)
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen{
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen if(ctx->key != NULL) p_free(ctx->pool, ctx->key);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen ctx->key = p_malloc(ctx->pool, EVP_CIPHER_key_length(ctx->cipher));
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen memcpy(ctx->key, key, I_MIN(key_len,(size_t)EVP_CIPHER_key_length(ctx->cipher)));
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen}
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenstatic
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenvoid dcrypt_openssl_ctx_sym_set_iv(struct dcrypt_context_symmetric *ctx, const unsigned char *iv, size_t iv_len)
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen{
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen if(ctx->iv != NULL) p_free(ctx->pool, ctx->iv);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen ctx->iv = p_malloc(ctx->pool, EVP_CIPHER_iv_length(ctx->cipher));
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen memcpy(ctx->iv, iv, I_MIN(iv_len,(size_t)EVP_CIPHER_iv_length(ctx->cipher)));
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen}
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenstatic
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenvoid dcrypt_openssl_ctx_sym_set_key_iv_random(struct dcrypt_context_symmetric *ctx)
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen{
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen if(ctx->key != NULL) p_free(ctx->pool, ctx->key);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen if(ctx->iv != NULL) p_free(ctx->pool, ctx->iv);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen ctx->key = p_malloc(ctx->pool, EVP_CIPHER_key_length(ctx->cipher));
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen random_fill(ctx->key, EVP_CIPHER_key_length(ctx->cipher));
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen ctx->iv = p_malloc(ctx->pool, EVP_CIPHER_iv_length(ctx->cipher));
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen random_fill(ctx->iv, EVP_CIPHER_iv_length(ctx->cipher));
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen}
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenstatic
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenvoid dcrypt_openssl_ctx_sym_set_padding(struct dcrypt_context_symmetric *ctx, bool padding)
358f356749078ed2ae69fc48ced375761c877b61Timo Sirainen{
358f356749078ed2ae69fc48ced375761c877b61Timo Sirainen ctx->padding = (padding?1:0);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen}
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
358f356749078ed2ae69fc48ced375761c877b61Timo Sirainenstatic
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenbool dcrypt_openssl_ctx_sym_get_key(struct dcrypt_context_symmetric *ctx, buffer_t *key)
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen{
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen if(ctx->key == NULL) return FALSE;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen buffer_append(key, ctx->key, EVP_CIPHER_key_length(ctx->cipher));
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen return TRUE;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen}
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenstatic
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenbool dcrypt_openssl_ctx_sym_get_iv(struct dcrypt_context_symmetric *ctx, buffer_t *iv)
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen{
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen if(ctx->iv == NULL) return FALSE;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen buffer_append(iv, ctx->iv, EVP_CIPHER_iv_length(ctx->cipher));
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen return TRUE;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen}
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenstatic
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenvoid dcrypt_openssl_ctx_sym_set_aad(struct dcrypt_context_symmetric *ctx, const unsigned char *aad, size_t aad_len)
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen{
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen if (ctx->aad != NULL) p_free(ctx->pool, ctx->aad);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen /* allow empty aad */
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen ctx->aad = p_malloc(ctx->pool, I_MAX(1,aad_len));
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen memcpy(ctx->aad, aad, aad_len);
358f356749078ed2ae69fc48ced375761c877b61Timo Sirainen ctx->aad_len = aad_len;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen}
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenstatic
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenbool dcrypt_openssl_ctx_sym_get_aad(struct dcrypt_context_symmetric *ctx, buffer_t *aad)
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen{
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen if (ctx->aad == NULL) return FALSE;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen buffer_append(aad, ctx->aad, ctx->aad_len);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen return TRUE;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen}
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenstatic
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenvoid dcrypt_openssl_ctx_sym_set_tag(struct dcrypt_context_symmetric *ctx, const unsigned char *tag, size_t tag_len)
417d2a64eba7d8c395b6c8a18d845f7ff2471637Timo Sirainen{
417d2a64eba7d8c395b6c8a18d845f7ff2471637Timo Sirainen if (ctx->tag != NULL) p_free(ctx->pool, ctx->tag);
8bb360f9e5de1c25e4f875205bb06e8bf15dae14Timo Sirainen /* unlike aad, tag cannot be empty */
417d2a64eba7d8c395b6c8a18d845f7ff2471637Timo Sirainen ctx->tag = p_malloc(ctx->pool, tag_len);
8bb360f9e5de1c25e4f875205bb06e8bf15dae14Timo Sirainen memcpy(ctx->tag, tag, tag_len);
417d2a64eba7d8c395b6c8a18d845f7ff2471637Timo Sirainen ctx->tag_len = tag_len;
417d2a64eba7d8c395b6c8a18d845f7ff2471637Timo Sirainen}
3402c71658e8c440941d50a66aba777849b3b89fTimo Sirainen
3402c71658e8c440941d50a66aba777849b3b89fTimo Sirainenstatic
e7a81e78fb5d8078d32ec05257f75095b28eb9e8Timo Sirainenbool dcrypt_openssl_ctx_sym_get_tag(struct dcrypt_context_symmetric *ctx, buffer_t *tag)
e7a81e78fb5d8078d32ec05257f75095b28eb9e8Timo Sirainen{
8eeced2d681741d4071e6b145fe26232186af34aTimo Sirainen if (ctx->tag == NULL) return FALSE;
e7a81e78fb5d8078d32ec05257f75095b28eb9e8Timo Sirainen buffer_append(tag, ctx->tag, ctx->tag_len);
e7a81e78fb5d8078d32ec05257f75095b28eb9e8Timo Sirainen return TRUE;
3402c71658e8c440941d50a66aba777849b3b89fTimo Sirainen}
3402c71658e8c440941d50a66aba777849b3b89fTimo Sirainen
3402c71658e8c440941d50a66aba777849b3b89fTimo Sirainenstatic
417d2a64eba7d8c395b6c8a18d845f7ff2471637Timo Sirainenunsigned int dcrypt_openssl_ctx_sym_get_key_length(struct dcrypt_context_symmetric *ctx)
417d2a64eba7d8c395b6c8a18d845f7ff2471637Timo Sirainen{
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen return EVP_CIPHER_iv_length(ctx->cipher);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen}
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenstatic
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenunsigned int dcrypt_openssl_ctx_sym_get_iv_length(struct dcrypt_context_symmetric *ctx)
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen{
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen return EVP_CIPHER_iv_length(ctx->cipher);
5ce40a7370a19a98caeca5d2e27b3d6c77c90ea9Timo Sirainen}
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenstatic
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenunsigned int dcrypt_openssl_ctx_sym_get_block_size(struct dcrypt_context_symmetric *ctx)
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen{
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen return EVP_CIPHER_block_size(ctx->cipher);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen}
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenstatic
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenbool dcrypt_openssl_ctx_sym_init(struct dcrypt_context_symmetric *ctx, const char **error_r)
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen{
417d2a64eba7d8c395b6c8a18d845f7ff2471637Timo Sirainen int ec;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen int len;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen i_assert(ctx->key != NULL);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen i_assert(ctx->iv != NULL);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen i_assert(ctx->ctx == NULL);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen if((ctx->ctx = EVP_CIPHER_CTX_new()) == NULL)
9accc087160a4a485df40276daf7f6d1aa23d9b6Timo Sirainen return dcrypt_openssl_error(error_r);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen ec = EVP_CipherInit_ex(ctx->ctx, ctx->cipher, NULL, ctx->key, ctx->iv, ctx->mode);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen if (ec != 1) return dcrypt_openssl_error(error_r);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EVP_CIPHER_CTX_set_padding(ctx->ctx, ctx->padding);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen len = 0;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen if (ctx->aad != NULL) ec = EVP_CipherUpdate(ctx->ctx, NULL, &len, ctx->aad, ctx->aad_len);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen if (ec != 1) return dcrypt_openssl_error(error_r);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen return TRUE;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen}
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenstatic
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenbool dcrypt_openssl_ctx_sym_update(struct dcrypt_context_symmetric *ctx, const unsigned char *data, size_t data_len, buffer_t *result, const char **error_r)
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen{
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen const size_t block_size = (size_t)EVP_CIPHER_block_size(ctx->cipher);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen size_t buf_used = result->used;
358f356749078ed2ae69fc48ced375761c877b61Timo Sirainen unsigned char *buf;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen int outl;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen i_assert(ctx->ctx != NULL);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen /* From `man 3 evp_cipherupdate`:
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EVP_EncryptUpdate() encrypts inl bytes from the buffer in and writes
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen the encrypted version to out. This function can be called multiple
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen times to encrypt successive blocks of data. The amount of data written
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen depends on the block alignment of the encrypted data: as a result the
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen amount of data written may be anything from zero bytes to
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen (inl + cipher_block_size - 1) so out should contain sufficient room.
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen The actual number of bytes written is placed in outl.
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen */
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen buf = buffer_append_space_unsafe(result, data_len + block_size);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen outl = 0;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen if (EVP_CipherUpdate
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen (ctx->ctx, buf, &outl, data, data_len) != 1)
358f356749078ed2ae69fc48ced375761c877b61Timo Sirainen return dcrypt_openssl_error(error_r);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen buffer_set_used_size(result, buf_used + outl);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen return TRUE;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen}
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenstatic
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenbool dcrypt_openssl_ctx_sym_final(struct dcrypt_context_symmetric *ctx, buffer_t *result, const char **error_r)
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen{
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen const size_t block_size = (size_t)EVP_CIPHER_block_size(ctx->cipher);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen size_t buf_used = result->used;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen unsigned char *buf;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen int outl;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen int ec;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen i_assert(ctx->ctx != NULL);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen /* From `man 3 evp_cipherupdate`:
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen If padding is enabled (the default) then EVP_EncryptFinal_ex() encrypts
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen the "final" data, that is any data that remains in a partial block. It
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen uses standard block padding (aka PKCS padding). The encrypted final data
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen is written to out which should have sufficient space for one cipher
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen block. The number of bytes written is placed in outl. After this
a37c2c1ad645b6d8ea73e6d38695efdde4f3f928Timo Sirainen function is called the encryption operation is finished and no further
a37c2c1ad645b6d8ea73e6d38695efdde4f3f928Timo Sirainen calls to EVP_EncryptUpdate() should be made.
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen */
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen buf = buffer_append_space_unsafe(result, block_size);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen outl = 0;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen /* when **DECRYPTING** set expected tag */
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen if (ctx->mode == 0 && ctx->tag != NULL) {
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen ec = EVP_CIPHER_CTX_ctrl(ctx->ctx, EVP_CTRL_GCM_SET_TAG, ctx->tag_len, ctx->tag);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen } else ec = 1;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen if (ec == 1)
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen ec = EVP_CipherFinal_ex(ctx->ctx, buf, &outl);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen if (ec == 1) {
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen buffer_set_used_size(result, buf_used + outl);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen /* when **ENCRYPTING** recover tag */
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen if (ctx->mode == 1 && ctx->aad != NULL) {
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen /* tag should be NULL here */
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen i_assert(ctx->tag == NULL);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen /* openssl claims taglen is always 16, go figure .. */
a37c2c1ad645b6d8ea73e6d38695efdde4f3f928Timo Sirainen ctx->tag = p_malloc(ctx->pool, EVP_GCM_TLS_TAG_LEN);
a37c2c1ad645b6d8ea73e6d38695efdde4f3f928Timo Sirainen ec = EVP_CIPHER_CTX_ctrl(ctx->ctx, EVP_CTRL_GCM_GET_TAG, EVP_GCM_TLS_TAG_LEN, ctx->tag);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen ctx->tag_len = EVP_GCM_TLS_TAG_LEN;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen }
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen }
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen if (ec == 0 && error_r != NULL)
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen *error_r = "data authentication failed";
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen else if (ec < 0) dcrypt_openssl_error(error_r);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EVP_CIPHER_CTX_free(ctx->ctx);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen ctx->ctx = NULL;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen return ec == 1;
a37c2c1ad645b6d8ea73e6d38695efdde4f3f928Timo Sirainen}
a37c2c1ad645b6d8ea73e6d38695efdde4f3f928Timo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenstatic
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenbool dcrypt_openssl_ctx_hmac_create(const char *algorithm, struct dcrypt_context_hmac **ctx_r, const char **error_r)
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen{
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen struct dcrypt_context_hmac *ctx;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen pool_t pool;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen const EVP_MD *md;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen md = EVP_get_digestbyname(algorithm);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen if(md == NULL) {
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen if (error_r != NULL)
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen *error_r = t_strdup_printf("Invalid digest %s", algorithm);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen return FALSE;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen }
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen /* allocate context */
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen pool = pool_alloconly_create("dcrypt openssl", 1024);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen ctx = p_new(pool, struct dcrypt_context_hmac, 1);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen ctx->pool = pool;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen ctx->md = md;
a37c2c1ad645b6d8ea73e6d38695efdde4f3f928Timo Sirainen *ctx_r = ctx;
a37c2c1ad645b6d8ea73e6d38695efdde4f3f928Timo Sirainen return TRUE;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen}
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenstatic
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenvoid dcrypt_openssl_ctx_hmac_destroy(struct dcrypt_context_hmac **ctx)
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen{
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen pool_t pool = (*ctx)->pool;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen#if SSLEAY_VERSION_NUMBER >= 0x1010000fL
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen if ((*ctx)->ctx) HMAC_CTX_free((*ctx)->ctx);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen#else
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen HMAC_cleanup(&((*ctx)->ctx));
5ce40a7370a19a98caeca5d2e27b3d6c77c90ea9Timo Sirainen#endif
6bd263caf006edc75205f446fa0283c6f364941bTimo Sirainen pool_unref(&pool);
5ce40a7370a19a98caeca5d2e27b3d6c77c90ea9Timo Sirainen *ctx = NULL;
5ce40a7370a19a98caeca5d2e27b3d6c77c90ea9Timo Sirainen}
5ce40a7370a19a98caeca5d2e27b3d6c77c90ea9Timo Sirainen
5ce40a7370a19a98caeca5d2e27b3d6c77c90ea9Timo Sirainenstatic
5ce40a7370a19a98caeca5d2e27b3d6c77c90ea9Timo Sirainenvoid dcrypt_openssl_ctx_hmac_set_key(struct dcrypt_context_hmac *ctx, const unsigned char *key, size_t key_len)
5ce40a7370a19a98caeca5d2e27b3d6c77c90ea9Timo Sirainen{
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen if(ctx->key != NULL) p_free(ctx->pool, ctx->key);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen ctx->klen = I_MIN(key_len, HMAC_MAX_MD_CBLOCK);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen ctx->key = p_malloc(ctx->pool, ctx->klen);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen memcpy(ctx->key, key, ctx->klen);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen}
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenstatic
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenbool dcrypt_openssl_ctx_hmac_get_key(struct dcrypt_context_hmac *ctx, buffer_t *key)
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen{
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen if(ctx->key == NULL) return FALSE;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen buffer_append(key, ctx->key, ctx->klen);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen return TRUE;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen}
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenstatic
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenvoid dcrypt_openssl_ctx_hmac_set_key_random(struct dcrypt_context_hmac *ctx)
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen{
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen ctx->klen = HMAC_MAX_MD_CBLOCK;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen ctx->key = p_malloc(ctx->pool, ctx->klen);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen random_fill(ctx->key, ctx->klen);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen}
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenstatic
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenunsigned int dcrypt_openssl_ctx_hmac_get_digest_length(struct dcrypt_context_hmac *ctx)
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen{
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen return EVP_MD_size(ctx->md);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen}
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenstatic
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenbool dcrypt_openssl_ctx_hmac_init(struct dcrypt_context_hmac *ctx, const char **error_r)
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen{
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen int ec;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen i_assert(ctx->md != NULL);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen#if SSLEAY_VERSION_NUMBER >= 0x1010000fL
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen ctx->ctx = HMAC_CTX_new();
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen if (ctx->ctx == NULL) return FALSE;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen ec = HMAC_Init_ex(ctx->ctx, ctx->key, ctx->klen, ctx->md, NULL);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen#else
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen HMAC_CTX_init(&ctx->ctx);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen ec = HMAC_Init_ex(&(ctx->ctx), ctx->key, ctx->klen, ctx->md, NULL);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen#endif
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen if (ec != 1) return dcrypt_openssl_error(error_r);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen return TRUE;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen}
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenstatic
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenbool dcrypt_openssl_ctx_hmac_update(struct dcrypt_context_hmac *ctx, const unsigned char *data, size_t data_len, const char **error_r)
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen{
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen int ec;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen#if SSLEAY_VERSION_NUMBER >= 0x1010000fL
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen ec = HMAC_Update(ctx->ctx, data, data_len);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen#else
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen ec = HMAC_Update(&(ctx->ctx), data, data_len);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen#endif
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen if (ec != 1) return dcrypt_openssl_error(error_r);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen return TRUE;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen}
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenstatic
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenbool dcrypt_openssl_ctx_hmac_final(struct dcrypt_context_hmac *ctx, buffer_t *result, const char **error_r)
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen{
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen int ec;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen unsigned char buf[HMAC_MAX_MD_CBLOCK];
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen unsigned int outl;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen#if SSLEAY_VERSION_NUMBER >= 0x1010000fL
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen ec = HMAC_Final(ctx->ctx, buf, &outl);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen HMAC_CTX_free(ctx->ctx);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen ctx->ctx = NULL;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen#else
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen ec = HMAC_Final(&(ctx->ctx), buf, &outl);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen HMAC_cleanup(&(ctx->ctx));
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen#endif
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen if (ec == 1) {
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen buffer_append(result, buf, outl);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen } else return dcrypt_openssl_error(error_r);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen return TRUE;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen}
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenstatic
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenbool dcrypt_openssl_generate_ec_key(int nid, EVP_PKEY **key, const char **error_r)
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen{
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EVP_PKEY_CTX *pctx;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EVP_PKEY_CTX *ctx;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EVP_PKEY *params = NULL;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen /* generate parameters for EC */
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_EC, NULL);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen if (pctx == NULL ||
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EVP_PKEY_paramgen_init(pctx) < 1 ||
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EVP_PKEY_CTX_set_ec_paramgen_curve_nid(pctx, nid) < 1 ||
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EVP_PKEY_paramgen(pctx, &params) < 1)
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen {
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen dcrypt_openssl_error(error_r);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EVP_PKEY_CTX_free(pctx);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen return FALSE;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen }
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen /* generate key from parameters */
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen ctx = EVP_PKEY_CTX_new(params, NULL);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen if (EVP_PKEY_keygen_init(ctx) < 1 ||
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EVP_PKEY_keygen(ctx, key) < 1)
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen {
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen dcrypt_openssl_error(error_r);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EVP_PKEY_free(params);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EVP_PKEY_CTX_free(pctx);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EVP_PKEY_CTX_free(ctx);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen return FALSE;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen }
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EVP_PKEY_free(params);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EVP_PKEY_CTX_free(pctx);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EVP_PKEY_CTX_free(ctx);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EC_KEY_set_asn1_flag(EVP_PKEY_get0_EC_KEY((*key)), OPENSSL_EC_NAMED_CURVE);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EC_KEY_set_conv_form(EVP_PKEY_get0_EC_KEY((*key)), POINT_CONVERSION_COMPRESSED);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen return TRUE;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen}
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenstatic
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenbool dcrypt_openssl_generate_rsa_key(int bits, EVP_PKEY **key, const char **error_r)
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen{
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen int ec = 0;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EVP_PKEY_CTX *ctx;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen ctx = EVP_PKEY_CTX_new_id(EVP_PKEY_RSA, NULL);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen if (ctx == NULL ||
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EVP_PKEY_keygen_init(ctx) < 1 ||
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EVP_PKEY_CTX_set_rsa_keygen_bits(ctx, bits) < 1 ||
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EVP_PKEY_keygen(ctx, key) < 1) {
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen dcrypt_openssl_error(error_r);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen ec = -1;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen }
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EVP_PKEY_CTX_free(ctx);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen return ec == 0;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen}
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenstatic
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenbool dcrypt_openssl_ecdh_derive_secret_local(struct dcrypt_private_key *local_key, buffer_t *R, buffer_t *S, const char **error_r)
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen{
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EVP_PKEY *local = (EVP_PKEY*)local_key;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen BN_CTX *bn_ctx = BN_CTX_new();
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen const EC_GROUP *grp = EC_KEY_get0_group(EVP_PKEY_get0_EC_KEY(local));
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EC_POINT *pub = EC_POINT_new(grp);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen /* convert ephemeral key data EC point */
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen if (EC_POINT_oct2point(grp, pub, R->data, R->used, bn_ctx) != 1)
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen {
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EC_POINT_free(pub);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen BN_CTX_free(bn_ctx);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen return dcrypt_openssl_error(error_r);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen }
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EC_KEY *ec_key = EC_KEY_new();
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen /* convert point to public key */
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EC_KEY_set_conv_form(ec_key, POINT_CONVERSION_COMPRESSED);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EC_KEY_set_group(ec_key, grp);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EC_KEY_set_public_key(ec_key, pub);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EC_POINT_free(pub);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen BN_CTX_free(bn_ctx);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen /* make sure it looks like a valid key */
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen if (EC_KEY_check_key(ec_key) != 1) {
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EC_KEY_free(ec_key);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen return dcrypt_openssl_error(error_r);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen }
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EVP_PKEY *peer = EVP_PKEY_new();
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EVP_PKEY_set1_EC_KEY(peer, ec_key);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EVP_PKEY_CTX *pctx = EVP_PKEY_CTX_new(local, NULL);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen /* initialize derivation */
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen if (pctx == NULL ||
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EVP_PKEY_derive_init(pctx) != 1 ||
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EVP_PKEY_derive_set_peer(pctx, peer) != 1) {
ec1823d289727d53fc74073e6cdda61d64fc0761Timo Sirainen EVP_PKEY_CTX_free(pctx);
ec1823d289727d53fc74073e6cdda61d64fc0761Timo Sirainen EC_KEY_free(ec_key);
ec1823d289727d53fc74073e6cdda61d64fc0761Timo Sirainen return dcrypt_openssl_error(error_r);
ec1823d289727d53fc74073e6cdda61d64fc0761Timo Sirainen }
ec1823d289727d53fc74073e6cdda61d64fc0761Timo Sirainen
ec1823d289727d53fc74073e6cdda61d64fc0761Timo Sirainen /* have to do it twice to get the data length */
ec1823d289727d53fc74073e6cdda61d64fc0761Timo Sirainen size_t len;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen if (EVP_PKEY_derive(pctx, NULL, &len) != 1) {
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EVP_PKEY_CTX_free(pctx);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EC_KEY_free(ec_key);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen return dcrypt_openssl_error(error_r);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen }
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen unsigned char buf[len];
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen memset(buf,0,len);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen if (EVP_PKEY_derive(pctx, buf, &len) != 1) {
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EVP_PKEY_CTX_free(pctx);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EC_KEY_free(ec_key);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen return dcrypt_openssl_error(error_r);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen }
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EVP_PKEY_CTX_free(pctx);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen buffer_append(S, buf, len);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EC_KEY_free(ec_key);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen EVP_PKEY_free(peer);
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen return TRUE;
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen}
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenstatic
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainenbool dcrypt_openssl_ecdh_derive_secret_peer(struct dcrypt_public_key *peer_key, buffer_t *R, buffer_t *S, const char **error_r)
b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen{
/* ensure peer_key is EC key */
EVP_PKEY *local = NULL;
EVP_PKEY *peer = (EVP_PKEY*)peer_key;
if (EVP_PKEY_base_id(peer) != EVP_PKEY_EC) {
if (error_r != NULL)
*error_r = "Only ECC key can be used";
return FALSE;
}
/* generate another key from same group */
int nid = EC_GROUP_get_curve_name(EC_KEY_get0_group(EVP_PKEY_get0_EC_KEY(peer)));
if (!dcrypt_openssl_generate_ec_key(nid, &local, error_r)) return FALSE;
/* initialize */
EVP_PKEY_CTX *pctx = EVP_PKEY_CTX_new(local, NULL);
if (pctx == NULL ||
EVP_PKEY_derive_init(pctx) != 1 ||
EVP_PKEY_derive_set_peer(pctx, peer) != 1) {
EVP_PKEY_CTX_free(pctx);
return dcrypt_openssl_error(error_r);
}
/* derive */
size_t len;
if (EVP_PKEY_derive(pctx, NULL, &len) != 1) {
EVP_PKEY_CTX_free(pctx);
return dcrypt_openssl_error(error_r);
}
unsigned char buf[len];
if (EVP_PKEY_derive(pctx, buf, &len) != 1) {
EVP_PKEY_CTX_free(pctx);
return dcrypt_openssl_error(error_r);
}
EVP_PKEY_CTX_free(pctx);
buffer_append(S, buf, len);
/* get ephemeral key (=R) */
BN_CTX *bn_ctx = BN_CTX_new();
const EC_POINT *pub = EC_KEY_get0_public_key(EVP_PKEY_get0_EC_KEY(local));
const EC_GROUP *grp = EC_KEY_get0_group(EVP_PKEY_get0_EC_KEY(local));
len = EC_POINT_point2oct(grp, pub, POINT_CONVERSION_COMPRESSED, NULL, 0, bn_ctx);
unsigned char R_buf[len];
EC_POINT_point2oct(grp, pub, POINT_CONVERSION_COMPRESSED, R_buf, len, bn_ctx);
BN_CTX_free(bn_ctx);
buffer_append(R, R_buf, len);
EVP_PKEY_free(local);
return TRUE;
}
static
bool dcrypt_openssl_pbkdf2(const unsigned char *password, size_t password_len, const unsigned char *salt, size_t salt_len,
const char *hash, unsigned int rounds, buffer_t *result, unsigned int result_len, const char **error_r)
{
int ret;
i_assert(rounds > 0);
i_assert(result_len > 0);
i_assert(result != NULL);
/* determine MD */
const EVP_MD* md = EVP_get_digestbyname(hash);
if (md == NULL) {
if (error_r != NULL)
*error_r = t_strdup_printf("Invalid digest %s", hash);
return FALSE;
}
unsigned char buffer[result_len];
if ((ret = PKCS5_PBKDF2_HMAC((const char*)password, password_len, salt, salt_len, rounds,
md, result_len, buffer)) == 1) {
buffer_append(result, buffer, result_len);
}
if (ret != 1) return dcrypt_openssl_error(error_r);
return TRUE;
}
static
bool dcrypt_openssl_generate_keypair(struct dcrypt_keypair *pair_r, enum dcrypt_key_type kind, unsigned int bits, const char *curve, const char **error_r)
{
EVP_PKEY *pkey = NULL;
if (kind == DCRYPT_KEY_RSA) {
if (dcrypt_openssl_generate_rsa_key(bits, &pkey, error_r)) {
pair_r->priv = (struct dcrypt_private_key*)pkey;
dcrypt_openssl_private_to_public_key(pair_r->priv, &(pair_r->pub));
return TRUE;
} else return dcrypt_openssl_error(error_r);
} else if (kind == DCRYPT_KEY_EC) {
int nid = OBJ_sn2nid(curve);
if (nid == NID_undef) {
if (error_r != NULL)
*error_r = t_strdup_printf("Unknown EC curve %s", curve);
return FALSE;
}
if (dcrypt_openssl_generate_ec_key(nid, &pkey, error_r)) {
pair_r->priv = (struct dcrypt_private_key*)pkey;
dcrypt_openssl_private_to_public_key(pair_r->priv, &(pair_r->pub));
return TRUE;
} else return dcrypt_openssl_error(error_r);
}
if (error_r != NULL)
*error_r = "Key type not supported in this build";
return FALSE;
}
static
bool dcrypt_openssl_decrypt_point_v1(buffer_t *data, buffer_t *key, BIGNUM **point_r, const char **error_r)
{
struct dcrypt_context_symmetric *dctx;
buffer_t *tmp = buffer_create_dynamic(pool_datastack_create(), 64);
if (!dcrypt_openssl_ctx_sym_create("aes-256-ctr", DCRYPT_MODE_DECRYPT, &dctx, error_r)) {
return FALSE;
}
/* v1 KEYS have all-zero IV - have to use it ourselves too */
dcrypt_openssl_ctx_sym_set_iv(dctx, (const unsigned char*)"\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0", 16);
dcrypt_openssl_ctx_sym_set_key(dctx, key->data, key->used);
if (!dcrypt_openssl_ctx_sym_init(dctx, error_r) ||
!dcrypt_openssl_ctx_sym_update(dctx, data->data, data->used, tmp, error_r) ||
!dcrypt_openssl_ctx_sym_final(dctx, tmp, error_r)) {
dcrypt_openssl_ctx_sym_destroy(&dctx);
return FALSE;
}
dcrypt_openssl_ctx_sym_destroy(&dctx);
*point_r = BN_bin2bn(tmp->data, tmp->used, NULL);
safe_memset(buffer_get_modifiable_data(tmp, NULL), 0,tmp->used);
buffer_set_used_size(key, 0);
if (*point_r == NULL)
return dcrypt_openssl_error(error_r);
return TRUE;
}
static
bool dcrypt_openssl_decrypt_point_ec_v1(struct dcrypt_private_key *dec_key,
const char *data_hex, const char *peer_key_hex, BIGNUM **point_r, const char **error_r)
{
buffer_t *peer_key, *data, key, *secret;
bool res;
data = buffer_create_dynamic(pool_datastack_create(), 128);
peer_key = buffer_create_dynamic(pool_datastack_create(), 64);
hex_to_binary(data_hex, data);
hex_to_binary(peer_key_hex, peer_key);
secret = buffer_create_dynamic(pool_datastack_create(), 64);
if (!dcrypt_openssl_ecdh_derive_secret_local(dec_key, peer_key, secret, error_r))
return FALSE;
/* run it thru SHA256 once */
unsigned char digest[SHA256_DIGEST_LENGTH];
SHA256(secret->data, secret->used, digest);
safe_memset(buffer_get_modifiable_data(secret, NULL), 0, secret->used);
buffer_set_used_size(secret, 0);
buffer_create_from_const_data(&key, digest, SHA256_DIGEST_LENGTH);
/* then use this as key */
res = dcrypt_openssl_decrypt_point_v1(data, &key, point_r, error_r);
memset(digest, 0, sizeof(digest));
safe_memset(digest, 0, SHA256_DIGEST_LENGTH);
return res;
}
static
bool dcrypt_openssl_decrypt_point_password_v1(const char *data_hex, const char *password_hex,
const char *salt_hex, BIGNUM **point_r, const char **error_r)
{
buffer_t *salt, *data, *password, *key;
struct dcrypt_context_symmetric *dctx;
data = buffer_create_dynamic(pool_datastack_create(), 128);
salt = buffer_create_dynamic(pool_datastack_create(), 16);
password = buffer_create_dynamic(pool_datastack_create(), 32);
key = buffer_create_dynamic(pool_datastack_create(), 32);
hex_to_binary(data_hex, data);
hex_to_binary(salt_hex, salt);
hex_to_binary(password_hex, password);
/* aes-256-ctr uses 32 byte key, and v1 uses all-zero IV */
if (!dcrypt_openssl_pbkdf2(password->data, password->used, salt->data, salt->used,
"sha256", 16, key, 32, error_r)) {
dcrypt_ctx_sym_destroy(&dctx);
return FALSE;
}
return dcrypt_openssl_decrypt_point_v1(data, key, point_r, error_r);
}
static
bool dcrypt_openssl_load_private_key_dovecot_v1(struct dcrypt_private_key **key_r,
int len, const char **input, const char *password, struct dcrypt_private_key *dec_key,
const char **error_r)
{
int nid, ec, enctype;
EC_KEY *eckey = NULL;
BIGNUM *point = NULL;
if (str_to_int(input[1], &nid) != 0) {
if (error_r != NULL)
*error_r = "Corrupted data";
return FALSE;
}
if (str_to_int(input[2], &enctype) != 0) {
if (error_r != NULL)
*error_r = "Corrupted data";
return FALSE;
}
eckey = EC_KEY_new_by_curve_name(nid);
if (eckey == NULL) return dcrypt_openssl_error(error_r);
/* decode and optionally decipher private key value */
if (enctype == DCRYPT_DOVECOT_KEY_ENCRYPT_NONE) {
point = BN_new();
if (BN_hex2bn(&point, input[3]) < 1) {
BN_free(point);
EC_KEY_free(eckey);
return dcrypt_openssl_error(error_r);
}
} else if (enctype == DCRYPT_DOVECOT_KEY_ENCRYPT_PASSWORD) {
/* by password */
const char *enc_priv_pt = input[3];
const char *salt = input[4];
if (!dcrypt_openssl_decrypt_point_password_v1(enc_priv_pt, password, salt, &point, error_r)) {
EC_KEY_free(eckey);
return FALSE;
}
} else if (enctype == DCRYPT_DOVECOT_KEY_ENCRYPT_PK) {
/* by key */
const char *enc_priv_pt = input[3];
const char *peer_key = input[4];
if (!dcrypt_openssl_decrypt_point_ec_v1(dec_key, enc_priv_pt, peer_key, &point, error_r)) {
EC_KEY_free(eckey);
return FALSE;
}
} else {
if (error_r != NULL)
*error_r = "Invalid key data";
EC_KEY_free(eckey);
return FALSE;
}
/* assign private key */
BN_CTX *bnctx = BN_CTX_new();
EC_KEY_set_conv_form(eckey, POINT_CONVERSION_COMPRESSED);
EC_KEY_set_private_key(eckey, point);
EC_KEY_precompute_mult(eckey, bnctx);
EC_KEY_set_asn1_flag(eckey, OPENSSL_EC_NAMED_CURVE);
EC_POINT *pub = EC_POINT_new(EC_KEY_get0_group(eckey));
/* calculate public key */
ec = EC_POINT_mul(EC_KEY_get0_group(eckey), pub, point, NULL, NULL, bnctx);
EC_KEY_set_public_key(eckey, pub);
BN_free(point);
EC_POINT_free(pub);
BN_CTX_free(bnctx);
/* make sure it looks OK and is correct */
if (ec == 1 && EC_KEY_check_key(eckey) == 1) {
unsigned char digest[SHA256_DIGEST_LENGTH];
/* validate that the key was loaded correctly */
char *id = ec_key_get_pub_point_hex(eckey);
SHA256((unsigned char*)id, strlen(id), digest);
OPENSSL_free(id);
const char *digest_hex = binary_to_hex(digest, SHA256_DIGEST_LENGTH);
if (strcmp(digest_hex, input[len-1]) != 0) {
if (error_r != NULL)
*error_r = "Key id mismatch after load";
EC_KEY_free(eckey);
return FALSE;
}
EVP_PKEY *key = EVP_PKEY_new();
EVP_PKEY_set1_EC_KEY(key, eckey);
EC_KEY_free(eckey);
*key_r = (struct dcrypt_private_key *)key;
return TRUE;
}
EC_KEY_free(eckey);
return dcrypt_openssl_error(error_r);
}
/* encrypt/decrypt private keys */
static
bool dcrypt_openssl_cipher_key_dovecot_v2(const char *cipher, enum dcrypt_sym_mode mode,
buffer_t *input, buffer_t *secret, buffer_t *salt, const char *digalgo, unsigned int rounds,
buffer_t *result_r, const char **error_r)
{
struct dcrypt_context_symmetric *dctx;
bool res;
if (!dcrypt_openssl_ctx_sym_create(cipher, mode, &dctx, error_r)) {
return FALSE;
}
/* generate encryption key/iv based on secret/salt */
buffer_t *key_data = buffer_create_dynamic(pool_datastack_create(), 128);
res = dcrypt_openssl_pbkdf2(secret->data, secret->used, salt->data, salt->used,
digalgo, rounds, key_data,
dcrypt_openssl_ctx_sym_get_key_length(dctx)+dcrypt_openssl_ctx_sym_get_iv_length(dctx), error_r);
if (!res) {
dcrypt_openssl_ctx_sym_destroy(&dctx);
return FALSE;
}
buffer_t *tmp = buffer_create_dynamic(pool_datastack_create(), 128);
const unsigned char *kd = buffer_free_without_data(&key_data);
/* perform ciphering */
dcrypt_openssl_ctx_sym_set_key(dctx, kd, dcrypt_openssl_ctx_sym_get_key_length(dctx));
dcrypt_openssl_ctx_sym_set_iv(dctx, kd+dcrypt_openssl_ctx_sym_get_key_length(dctx), dcrypt_openssl_ctx_sym_get_iv_length(dctx));
if (!dcrypt_openssl_ctx_sym_init(dctx, error_r) ||
!dcrypt_openssl_ctx_sym_update(dctx, input->data, input->used, tmp, error_r) ||
!dcrypt_openssl_ctx_sym_final(dctx, tmp, error_r)) {
res = FALSE;
} else {
/* provide result if succeeded */
buffer_append_buf(result_r, tmp, 0, (size_t)-1);
res = TRUE;
}
/* and ensure no data leaks */
safe_memset(buffer_get_modifiable_data(tmp, NULL), 0, tmp->used);
dcrypt_openssl_ctx_sym_destroy(&dctx);
return res;
}
static
bool dcrypt_openssl_load_private_key_dovecot_v2(struct dcrypt_private_key **key_r,
int len, const char **input, const char *password, struct dcrypt_private_key *dec_key,
const char **error_r)
{
int enctype;
buffer_t *key_data = buffer_create_dynamic(pool_datastack_create(), 256);
/* check for encryption type */
if (str_to_int(input[2], &enctype) != 0) {
if (error_r != NULL)
*error_r = "Corrupted data";
return FALSE;
}
if (enctype < 0 || enctype > 2) {
if (error_r != NULL)
*error_r = "Corrupted data";
return FALSE;
}
/* match encryption type to field counts */
if ((enctype == DCRYPT_DOVECOT_KEY_ENCRYPT_NONE && len != 5) ||
(enctype == DCRYPT_DOVECOT_KEY_ENCRYPT_PASSWORD && len != 9) ||
(enctype == DCRYPT_DOVECOT_KEY_ENCRYPT_PK && len != 11)) {
if (error_r != NULL)
*error_r = "Corrupted data";
return FALSE;
}
/* get key type */
int nid = OBJ_txt2nid(input[1]);
if (nid == NID_undef)
return dcrypt_openssl_error(error_r);
/* decode and possibly decipher private key value */
if (enctype == DCRYPT_DOVECOT_KEY_ENCRYPT_NONE) {
if (hex_to_binary(input[3], key_data) != 0) {
if (error_r != NULL)
*error_r = "Corrupted data";
}
} else if (enctype == DCRYPT_DOVECOT_KEY_ENCRYPT_PK) {
unsigned int rounds;
struct dcrypt_public_key *pubkey = NULL;
if (str_to_uint(input[6], &rounds) != 0) {
if (error_r != NULL)
*error_r = "Corrupted data";
return FALSE;
}
buffer_t *data = buffer_create_dynamic(pool_datastack_create(), 128);
/* check that we have correct decryption key */
dcrypt_openssl_private_to_public_key(dec_key, &pubkey);
if (!dcrypt_openssl_public_key_id(pubkey, "sha256", data, error_r)) {
if (pubkey != NULL) dcrypt_openssl_free_public_key(&pubkey);
return FALSE;
}
dcrypt_openssl_free_public_key(&pubkey);
if (strcmp(binary_to_hex(data->data, data->used), input[9]) != 0) {
dcrypt_openssl_free_public_key(&pubkey);
if (error_r != NULL)
*error_r = "No private key available";
return FALSE;
}
buffer_t *salt, *peer_key, *secret;
salt = buffer_create_dynamic(pool_datastack_create(), strlen(input[4])/2);
peer_key = buffer_create_dynamic(pool_datastack_create(), strlen(input[8])/2);
secret = buffer_create_dynamic(pool_datastack_create(), 128);
buffer_set_used_size(data, 0);
hex_to_binary(input[4], salt);
hex_to_binary(input[8], peer_key);
hex_to_binary(input[7], data);
/* get us secret value to use for key/iv generation */
if (EVP_PKEY_base_id((EVP_PKEY*)dec_key) == EVP_PKEY_RSA) {
if (!dcrypt_openssl_rsa_decrypt(dec_key, peer_key->data, peer_key->used, secret, error_r))
return FALSE;
} else {
/* perform ECDH */
if (!dcrypt_openssl_ecdh_derive_secret_local(dec_key, peer_key, secret, error_r))
return FALSE;
}
/* decrypt key */
if (!dcrypt_openssl_cipher_key_dovecot_v2(input[3], DCRYPT_MODE_DECRYPT, data, secret, salt,
input[5], rounds, key_data, error_r)) {
return FALSE;
}
} else if (enctype == DCRYPT_DOVECOT_KEY_ENCRYPT_PASSWORD) {
unsigned int rounds;
if (str_to_uint(input[6], &rounds) != 0) {
if (error_r != NULL)
*error_r = "Corrupted data";
return FALSE;
}
buffer_t *salt, secret, *data;
salt = buffer_create_dynamic(pool_datastack_create(), strlen(input[4])/2);
buffer_create_from_const_data(&secret, password, strlen(password));
data = buffer_create_dynamic(pool_datastack_create(), strlen(input[7])/2);
if (hex_to_binary(input[4], salt) != 0 ||
hex_to_binary(input[7], data) != 0) {
if (error_r != NULL)
*error_r = "Corrupted data";
return FALSE;
}
if (!dcrypt_openssl_cipher_key_dovecot_v2(input[3], DCRYPT_MODE_DECRYPT, data, &secret, salt,
input[5], rounds, key_data, error_r)) {
return FALSE;
}
}
/* decode actual key */
if (EVP_PKEY_type(nid) == EVP_PKEY_RSA) {
RSA *rsa = RSA_new();
const unsigned char *ptr = buffer_get_data(key_data, NULL);
if (d2i_RSAPrivateKey(&rsa, &ptr, key_data->used) == NULL ||
RSA_check_key(rsa) != 1) {
safe_memset(buffer_get_modifiable_data(key_data, NULL), 0, key_data->used);
RSA_free(rsa);
return dcrypt_openssl_error(error_r);
}
safe_memset(buffer_get_modifiable_data(key_data, NULL), 0, key_data->used);
buffer_set_used_size(key_data, 0);
EVP_PKEY *pkey = EVP_PKEY_new();
EVP_PKEY_set1_RSA(pkey, rsa);
*key_r = (struct dcrypt_private_key *)pkey;
} else {
int ec;
BIGNUM *point = BN_new();
if (BN_mpi2bn(key_data->data, key_data->used, point) == NULL) {
safe_memset(buffer_get_modifiable_data(key_data, NULL), 0, key_data->used);
BN_free(point);
return dcrypt_openssl_error(error_r);
}
EC_KEY *eckey = EC_KEY_new_by_curve_name(nid);
safe_memset(buffer_get_modifiable_data(key_data, NULL), 0, key_data->used);
buffer_set_used_size(key_data, 0);
if (eckey == NULL) {
return dcrypt_openssl_error(error_r);
}
BN_CTX *bnctx = BN_CTX_new();
EC_KEY_set_conv_form(eckey, POINT_CONVERSION_COMPRESSED);
EC_KEY_set_private_key(eckey, point);
EC_KEY_precompute_mult(eckey, bnctx);
EC_KEY_set_asn1_flag(eckey, OPENSSL_EC_NAMED_CURVE);
EC_POINT *pub = EC_POINT_new(EC_KEY_get0_group(eckey));
/* calculate public key */
ec = EC_POINT_mul(EC_KEY_get0_group(eckey), pub, point, NULL, NULL, bnctx);
EC_KEY_set_public_key(eckey, pub);
BN_free(point);
EC_POINT_free(pub);
BN_CTX_free(bnctx);
/* make sure the EC key is valid */
if (ec == 1 && EC_KEY_check_key(eckey) == 1) {
EVP_PKEY *key = EVP_PKEY_new();
EVP_PKEY_set1_EC_KEY(key, eckey);
EC_KEY_free(eckey);
*key_r = (struct dcrypt_private_key *)key;
} else {
EC_KEY_free(eckey);
return dcrypt_openssl_error(error_r);
}
}
/* finally compare key to key id */
dcrypt_openssl_private_key_id(*key_r, "sha256", key_data, NULL);
if (strcmp(binary_to_hex(key_data->data, key_data->used), input[len-1]) != 0) {
dcrypt_openssl_free_private_key(key_r);
if (error_r != NULL)
*error_r = "Key id mismatch after load";
return FALSE;
}
return TRUE;
}
static
bool dcrypt_openssl_load_private_key_dovecot(struct dcrypt_private_key **key_r,
const char *data, const char *password, struct dcrypt_private_key *key,
const char **error_r)
{
bool ret;
const char **input = t_strsplit_tab(data);
size_t len = str_array_length(input);
if (len < 4) {
if (error_r != NULL)
*error_r = "Corrupted data";
ret = FALSE;
} else if (*(input[0])== '1')
ret = dcrypt_openssl_load_private_key_dovecot_v1(key_r, len, input, password, key, error_r);
else if (*(input[0])== '2')
ret = dcrypt_openssl_load_private_key_dovecot_v2(key_r, len, input, password, key, error_r);
else {
if (error_r != NULL)
*error_r = "Unsupported key version";
ret = FALSE;
}
return ret;
}
static
int dcrypt_openssl_load_public_key_dovecot_v1(struct dcrypt_public_key **key_r,
int len, const char **input, const char **error_r)
{
int nid;
if (len != 3) {
if (error_r != NULL)
*error_r = "Corrupted data";
return -1;
}
if (str_to_int(input[1], &nid) != 0) {
if (error_r != NULL)
*error_r = "Corrupted data";
return -1;
}
EC_KEY *eckey = EC_KEY_new_by_curve_name(nid);
if (eckey == NULL) {
dcrypt_openssl_error(error_r);
return -1;
}
EC_KEY_set_asn1_flag(eckey, OPENSSL_EC_NAMED_CURVE);
BN_CTX *bnctx = BN_CTX_new();
EC_POINT *point = EC_POINT_new(EC_KEY_get0_group(eckey));
if (EC_POINT_hex2point(EC_KEY_get0_group(eckey),
input[2], point, bnctx) == NULL) {
BN_CTX_free(bnctx);
EC_KEY_free(eckey);
EC_POINT_free(point);
dcrypt_openssl_error(error_r);
return -1;
}
BN_CTX_free(bnctx);
EC_KEY_set_public_key(eckey, point);
EC_KEY_set_asn1_flag(eckey, OPENSSL_EC_NAMED_CURVE);
EC_POINT_free(point);
if (EC_KEY_check_key(eckey) == 1) {
EVP_PKEY *key = EVP_PKEY_new();
EVP_PKEY_set1_EC_KEY(key, eckey);
*key_r = (struct dcrypt_public_key *)key;
return 0;
}
dcrypt_openssl_error(error_r);
return -1;
}
static
int dcrypt_openssl_load_public_key_dovecot_v2(struct dcrypt_public_key **key_r,
int len, const char **input, const char **error_r)
{
if (len != 2 || strlen(input[1]) < 2 || (strlen(input[1])%2) != 0) {
if (error_r != NULL)
*error_r = "Corrupted data";
return -1;
}
buffer_t tmp;
size_t keylen = strlen(input[1])/2;
unsigned char keybuf[keylen];
const unsigned char *ptr;
buffer_create_from_data(&tmp, keybuf, keylen);
hex_to_binary(input[1], &tmp);
ptr = keybuf;
EVP_PKEY *pkey = EVP_PKEY_new();
if (d2i_PUBKEY(&pkey, &ptr, keylen)==NULL) {
EVP_PKEY_free(pkey);
dcrypt_openssl_error(error_r);
return -1;
}
*key_r = (struct dcrypt_public_key *)pkey;
return 0;
}
static
bool dcrypt_openssl_load_public_key_dovecot(struct dcrypt_public_key **key_r,
const char *data, const char **error_r)
{
int ec = 0;
const char **input = t_strsplit_tab(data);
size_t len = str_array_length(input);
if (len < 2) ec = -1;
if (ec == 0 && *(input[0]) == '1') {
ec = dcrypt_openssl_load_public_key_dovecot_v1(key_r, len,
input, error_r);
} else if (ec == 0 && *(input[0]) == '2') {
ec = dcrypt_openssl_load_public_key_dovecot_v2(key_r, len,
input, error_r);
} else {
if (error_r != NULL)
*error_r = "Unsupported key version";
ec = -1;
}
return (ec == 0 ? TRUE : FALSE);
}
static
bool dcrypt_openssl_encrypt_private_key_dovecot(buffer_t *key, int enctype, const char *cipher, const char *password,
struct dcrypt_public_key *enc_key, buffer_t *destination, const char **error_r)
{
bool res;
unsigned char *ptr;
unsigned char salt[8];
buffer_t *peer_key = buffer_create_dynamic(pool_datastack_create(), 128);
buffer_t *secret = buffer_create_dynamic(pool_datastack_create(), 128);
cipher = t_str_lcase(cipher);
str_append(destination, cipher);
str_append_c(destination, '\t');
random_fill(salt, sizeof(salt));
binary_to_hex_append(destination, salt, sizeof(salt));
buffer_t saltbuf;
buffer_create_from_const_data(&saltbuf, salt, sizeof(salt));
/* so we don't have to make new version if we ever upgrade these */
str_append(destination, t_strdup_printf("\t%s\t%d\t",
DCRYPT_DOVECOT_KEY_ENCRYPT_HASH,
DCRYPT_DOVECOT_KEY_ENCRYPT_ROUNDS));
if (enctype == DCRYPT_DOVECOT_KEY_ENCRYPT_PK) {
if (EVP_PKEY_base_id((EVP_PKEY*)enc_key) == EVP_PKEY_RSA) {
size_t used = buffer_get_used_size(secret);
/* peer key, in this case, is encrypted secret, which is 16 bytes of data */
ptr = buffer_append_space_unsafe(secret, 16);
random_fill(ptr, 16);
buffer_set_used_size(secret, used+16);
if (!dcrypt_rsa_encrypt(enc_key, secret->data, secret->used, peer_key, error_r)) {
return FALSE;
}
} else if (EVP_PKEY_base_id((EVP_PKEY*)enc_key) == EVP_PKEY_EC) {
/* generate secret by ECDHE */
if (!dcrypt_openssl_ecdh_derive_secret_peer(enc_key, peer_key, secret, error_r)) {
return FALSE;
}
} else {
/* Loading the key should have failed */
i_unreached();
}
/* add encryption key id, reuse peer_key buffer */
} else if (enctype == DCRYPT_DOVECOT_KEY_ENCRYPT_PASSWORD) {
str_append(secret, password);
}
/* encrypt key using secret and salt */
buffer_t *tmp = buffer_create_dynamic(pool_datastack_create(), 128);
res = dcrypt_openssl_cipher_key_dovecot_v2(cipher, DCRYPT_MODE_ENCRYPT, key, secret, &saltbuf,
DCRYPT_DOVECOT_KEY_ENCRYPT_HASH, DCRYPT_DOVECOT_KEY_ENCRYPT_ROUNDS, tmp, error_r);
safe_memset(buffer_get_modifiable_data(secret, NULL), 0, secret->used);
binary_to_hex_append(destination, tmp->data, tmp->used);
/* some additional fields or private key version */
if (enctype == DCRYPT_DOVECOT_KEY_ENCRYPT_PK) {
str_append_c(destination, '\t');
/* for RSA, this is the actual encrypted secret */
binary_to_hex_append(destination, peer_key->data, peer_key->used);
str_append_c(destination, '\t');
buffer_set_used_size(peer_key, 0);
if (!dcrypt_openssl_public_key_id(enc_key, "sha256", peer_key, error_r))
return FALSE;
binary_to_hex_append(destination, peer_key->data, peer_key->used);
}
return res;
}
static
bool dcrypt_openssl_store_private_key_dovecot(struct dcrypt_private_key *key, const char *cipher, buffer_t *destination,
const char *password, struct dcrypt_public_key *enc_key, const char **error_r)
{
size_t dest_used = buffer_get_used_size(destination);
const char *cipher2 = NULL;
EVP_PKEY *pkey = (EVP_PKEY*)key;
char objtxt[80]; /* openssl manual says this is OK */
ASN1_OBJECT *obj;
if (EVP_PKEY_base_id(pkey) == EVP_PKEY_EC) {
/* because otherwise we get wrong nid */
obj = OBJ_nid2obj(EC_GROUP_get_curve_name(EC_KEY_get0_group(EVP_PKEY_get0_EC_KEY(pkey))));
} else {
obj = OBJ_nid2obj(EVP_PKEY_id(pkey));
}
int enctype = 0;
int ln = OBJ_obj2txt(objtxt, sizeof(objtxt), obj, 1);
if (ln < 1)
return dcrypt_openssl_error(error_r);
if (ln > (int)sizeof(objtxt)) {
if (error_r != NULL)
*error_r = "Object identifier too long";
return FALSE;
}
buffer_t *buf = buffer_create_dynamic(pool_datastack_create(), 256);
/* convert key to private key value */
if (EVP_PKEY_base_id(pkey) == EVP_PKEY_RSA) {
unsigned char *ptr;
RSA *rsa = EVP_PKEY_get0_RSA(pkey);
int ln = i2d_RSAPrivateKey(rsa, &ptr);
if (ln < 1)
return dcrypt_openssl_error(error_r);
buffer_append(buf, ptr, ln);
} else if (EVP_PKEY_base_id(pkey) == EVP_PKEY_EC) {
unsigned char *ptr;
EC_KEY *eckey = EVP_PKEY_get0_EC_KEY(pkey);
const BIGNUM *pk = EC_KEY_get0_private_key(eckey);
/* serialize to MPI which is portable */
int len = BN_bn2mpi(pk, NULL);
ptr = buffer_append_space_unsafe(buf, len);
BN_bn2mpi(pk, ptr);
} else {
/* Loading the key should have failed */
i_unreached();
}
/* see if we want ECDH based or password based encryption */
if (cipher != NULL && strncasecmp(cipher, "ecdh-", 5) == 0) {
i_assert(enc_key != NULL);
i_assert(password == NULL);
enctype = DCRYPT_DOVECOT_KEY_ENCRYPT_PK;
cipher2 = cipher+5;
} else if (cipher != NULL) {
i_assert(enc_key == NULL);
i_assert(password != NULL);
enctype = DCRYPT_DOVECOT_KEY_ENCRYPT_PASSWORD;
cipher2 = cipher;
}
/* put in OID and encryption type */
str_append(destination, t_strdup_printf("2\t%s\t%d\t",
objtxt, enctype));
/* perform encryption if desired */
if (enctype > 0) {
if (!dcrypt_openssl_encrypt_private_key_dovecot(buf, enctype, cipher2, password, enc_key, destination, error_r)) {
buffer_set_used_size(destination, dest_used);
return FALSE;
}
} else {
binary_to_hex_append(destination, buf->data, buf->used);
}
/* append public key id */
str_append_c(destination, '\t');
buffer_set_used_size(buf, 0);
bool res = dcrypt_openssl_private_key_id(key, "sha256", buf, error_r);
binary_to_hex_append(destination, buf->data, buf->used);
if (!res) {
/* well, that didn't end well */
buffer_set_used_size(destination, dest_used);
return FALSE;
}
return TRUE;
}
static
bool dcrypt_openssl_store_public_key_dovecot(struct dcrypt_public_key *key, buffer_t *destination, const char **error_r)
{
EVP_PKEY *pubkey = (EVP_PKEY*)key;
unsigned char *tmp = NULL;
int rv = i2d_PUBKEY(pubkey, &tmp);
if (tmp == NULL)
return dcrypt_openssl_error(error_r);
/* then store it */
str_append_c(destination, '2');
str_append_c(destination, '\t');
binary_to_hex_append(destination, tmp, rv);
OPENSSL_free(tmp);
return TRUE;
}
static
bool dcrypt_openssl_load_private_key(struct dcrypt_private_key **key_r, enum dcrypt_key_format format,
const char *data, const char *password, struct dcrypt_private_key *dec_key,
const char **error_r)
{
EVP_PKEY *key = NULL, *key2;
if (format == DCRYPT_FORMAT_DOVECOT)
return dcrypt_openssl_load_private_key_dovecot(key_r, data, password, dec_key, error_r);
BIO *key_in = BIO_new_mem_buf((void*)data, strlen(data));
key = EVP_PKEY_new();
key2 = PEM_read_bio_PrivateKey(key_in, &key, NULL, (void*)password);
BIO_vfree(key_in);
if (key2 == NULL) {
EVP_PKEY_free(key);
return dcrypt_openssl_error(error_r);
}
if (EVP_PKEY_base_id(key) == EVP_PKEY_EC) {
EC_KEY_set_conv_form(EVP_PKEY_get0_EC_KEY(key), POINT_CONVERSION_COMPRESSED);
}
*key_r = (struct dcrypt_private_key *)key;
return TRUE;
}
static
bool dcrypt_openssl_load_public_key(struct dcrypt_public_key **key_r, enum dcrypt_key_format format,
const char *data, const char **error_r)
{
EVP_PKEY *key = NULL;
if (format == DCRYPT_FORMAT_DOVECOT)
return dcrypt_openssl_load_public_key_dovecot(key_r, data, error_r);
BIO *key_in = BIO_new_mem_buf((void*)data, strlen(data));
key = PEM_read_bio_PUBKEY(key_in, &key, NULL, NULL);
if (BIO_reset(key_in) <= 0) i_unreached();
if (key == NULL) { /* ec keys are bother */
/* read the header */
char buf[27]; /* begin public key */
if (BIO_gets(key_in, buf, sizeof(buf)) != 1) {
BIO_vfree(key_in);
return dcrypt_openssl_error(error_r);
}
if (strcmp(buf, "-----BEGIN PUBLIC KEY-----") != 0) {
if (error_r != NULL)
*error_r = "Missing public key header";
return FALSE;
}
BIO *b64 = BIO_new(BIO_f_base64());
EC_KEY *eckey = d2i_EC_PUBKEY_bio(b64, NULL);
if (eckey != NULL) {
EC_KEY_set_conv_form(eckey, POINT_CONVERSION_COMPRESSED);
EC_KEY_set_asn1_flag(eckey, OPENSSL_EC_NAMED_CURVE);
key = EVP_PKEY_new();
EVP_PKEY_set1_EC_KEY(key, eckey);
}
}
BIO_vfree(key_in);
if (key == NULL)
return dcrypt_openssl_error(error_r);
*key_r = (struct dcrypt_public_key *)key;
return TRUE;
}
static
bool dcrypt_openssl_store_private_key(struct dcrypt_private_key *key, enum dcrypt_key_format format,
const char *cipher, buffer_t *destination, const char *password, struct dcrypt_public_key *enc_key,
const char **error_r)
{
int ec;
if (format == DCRYPT_FORMAT_DOVECOT) {
bool ret;
ret = dcrypt_openssl_store_private_key_dovecot(key, cipher, destination, password, enc_key, error_r);
return ret;
}
EVP_PKEY *pkey = (EVP_PKEY*)key;
BIO *key_out = BIO_new(BIO_s_mem());
const EVP_CIPHER *algo = NULL;
if (cipher != NULL) {
algo = EVP_get_cipherbyname(cipher);
if (algo == NULL) {
if (error_r != NULL)
*error_r = t_strdup_printf("Invalid cipher %s", cipher);
return FALSE;
}
}
ec = PEM_write_bio_PrivateKey(key_out, pkey, algo, NULL, 0, NULL, (void*)password);
if (BIO_flush(key_out) <= 0)
ec = -1;
if (ec != 1) {
BIO_vfree(key_out);
return dcrypt_openssl_error(error_r);
}
long bs;
char *buf;
bs = BIO_get_mem_data(key_out, &buf);
buffer_append(destination, buf, bs);
BIO_vfree(key_out);
return TRUE;
}
static
bool dcrypt_openssl_store_public_key(struct dcrypt_public_key *key, enum dcrypt_key_format format, buffer_t *destination, const char **error_r)
{
int ec;
if (format == DCRYPT_FORMAT_DOVECOT)
return dcrypt_openssl_store_public_key_dovecot(key, destination, error_r);
EVP_PKEY *pkey = (EVP_PKEY*)key;
BIO *key_out = BIO_new(BIO_s_mem());
if (EVP_PKEY_base_id(pkey) == EVP_PKEY_RSA)
ec = PEM_write_bio_PUBKEY(key_out, pkey);
else {
BIO *b64 = BIO_new(BIO_f_base64());
(void)BIO_puts(key_out, "-----BEGIN PUBLIC KEY-----\n");
(void)BIO_push(b64, key_out);
ec = i2d_EC_PUBKEY_bio(b64, EVP_PKEY_get0_EC_KEY(pkey));
if (BIO_flush(b64) <= 0)
ec = -1;
(void)BIO_pop(b64);
BIO_vfree(b64);
if (BIO_puts(key_out, "-----END PUBLIC KEY-----") <= 0)
ec = -1;
}
if (ec != 1) {
BIO_vfree(key_out);
return dcrypt_openssl_error(error_r);
}
long bs;
char *buf;
bs = BIO_get_mem_data(key_out, &buf);
buffer_append(destination, buf, bs);
BIO_vfree(key_out);
return TRUE;
}
static
void dcrypt_openssl_private_to_public_key(struct dcrypt_private_key *priv_key, struct dcrypt_public_key **pub_key_r)
{
EVP_PKEY *pkey = (EVP_PKEY*)priv_key;
EVP_PKEY *pk;
if (*pub_key_r == NULL)
pk = EVP_PKEY_new();
else
pk = (EVP_PKEY*)*pub_key_r;
if (EVP_PKEY_base_id(pkey) == EVP_PKEY_RSA)
{
EVP_PKEY_set1_RSA(pk, RSAPublicKey_dup(EVP_PKEY_get0_RSA(pkey)));
} else if (EVP_PKEY_base_id(pkey) == EVP_PKEY_EC) {
EC_KEY* eck = EVP_PKEY_get1_EC_KEY(pkey);
EC_KEY_set_asn1_flag(eck, OPENSSL_EC_NAMED_CURVE);
EVP_PKEY_set1_EC_KEY(pk, eck);
EC_KEY_free(eck);
} else {
/* Loading the key should have failed */
i_unreached();
}
*pub_key_r = (struct dcrypt_public_key*)pk;
}
static
bool dcrypt_openssl_key_string_get_info(const char *key_data, enum dcrypt_key_format *format_r, enum dcrypt_key_version *version_r,
enum dcrypt_key_kind *kind_r, enum dcrypt_key_encryption_type *encryption_type_r, const char **encryption_key_hash_r,
const char **key_hash_r, const char **error_r)
{
enum dcrypt_key_format format = DCRYPT_FORMAT_PEM;
enum dcrypt_key_version version = DCRYPT_KEY_VERSION_NA;
enum dcrypt_key_encryption_type encryption_type = DCRYPT_KEY_ENCRYPTION_TYPE_NONE;
enum dcrypt_key_kind kind = DCRYPT_KEY_KIND_PUBLIC;
char *encryption_key_hash = NULL;
char *key_hash = NULL;
i_assert(key_data != NULL);
/* is it PEM key */
if (strncmp(key_data, "-----BEGIN ", 11) == 0) {
format = DCRYPT_FORMAT_PEM;
version = DCRYPT_KEY_VERSION_NA;
key_data += 11;
if (strncmp(key_data, "ENCRYPTED ", 10) == 0) {
encryption_type = DCRYPT_KEY_ENCRYPTION_TYPE_PASSWORD;
key_data += 10;
}
if (strncmp(key_data, "PRIVATE KEY-----", 16) == 0)
kind = DCRYPT_KEY_KIND_PRIVATE;
else if (strncmp(key_data, "PUBLIC KEY-----", 15) == 0)
kind = DCRYPT_KEY_KIND_PUBLIC;
else {
if (error_r != NULL)
*error_r = "Unknown/invalid PEM key type";
return FALSE;
}
} else {
const char **fields = t_strsplit_tab(key_data);
int nfields = str_array_length(fields);
if (nfields < 2) {
if (error_r != NULL)
*error_r = "Unknown key format";
return FALSE;
}
format = DCRYPT_FORMAT_DOVECOT;
/* field 1 - version */
if (strcmp(fields[0], "1") == 0) {
version = DCRYPT_KEY_VERSION_1;
if (nfields == 3) {
kind = DCRYPT_KEY_KIND_PUBLIC;
} else if (nfields == 5 && strcmp(fields[2],"0") == 0) {
kind = DCRYPT_KEY_KIND_PRIVATE;
encryption_type = DCRYPT_KEY_ENCRYPTION_TYPE_NONE;
} else if (nfields == 6 && strcmp(fields[2],"2") == 0) {
kind = DCRYPT_KEY_KIND_PRIVATE;
encryption_type = DCRYPT_KEY_ENCRYPTION_TYPE_PASSWORD;
} else if (nfields == 11 && strcmp(fields[2],"1") == 0) {
kind = DCRYPT_KEY_KIND_PRIVATE;
encryption_type = DCRYPT_KEY_ENCRYPTION_TYPE_KEY;
if (encryption_key_hash_r != NULL)
encryption_key_hash = i_strdup(fields[nfields-2]);
} else {
if (error_r != NULL)
*error_r = "Invalid dovecot v1 encoding";
return FALSE;
}
} else if (strcmp(fields[0], "2") == 0) {
version = DCRYPT_KEY_VERSION_1;
if (nfields == 2) {
kind = DCRYPT_KEY_KIND_PUBLIC;
} else if (nfields == 5 && strcmp(fields[2],"0") == 0) {
kind = DCRYPT_KEY_KIND_PRIVATE;
encryption_type = DCRYPT_KEY_ENCRYPTION_TYPE_NONE;
} else if (nfields == 9 && strcmp(fields[2],"2") == 0) {
kind = DCRYPT_KEY_KIND_PRIVATE;
encryption_type = DCRYPT_KEY_ENCRYPTION_TYPE_PASSWORD;
} else if (nfields == 11 && strcmp(fields[2],"1") == 0) {
kind = DCRYPT_KEY_KIND_PRIVATE;
encryption_type = DCRYPT_KEY_ENCRYPTION_TYPE_KEY;
if (encryption_key_hash_r != NULL)
encryption_key_hash = i_strdup(fields[nfields-2]);
} else {
if (error_r != NULL)
*error_r = "Invalid dovecot v2 encoding";
return FALSE;
}
}
/* last field is always key hash */
if (key_hash_r != NULL)
key_hash = i_strdup(fields[nfields-1]);
}
if (format_r != NULL) *format_r = format;
if (version_r != NULL) *version_r = version;
if (encryption_type_r != NULL) *encryption_type_r = encryption_type;
if (encryption_key_hash_r != NULL) {
*encryption_key_hash_r = t_strdup(encryption_key_hash);
i_free(encryption_key_hash);
}
if (kind_r != NULL) *kind_r = kind;
if (key_hash_r != NULL) {
*key_hash_r = t_strdup(key_hash);
i_free(key_hash);
}
return TRUE;
}
static
void dcrypt_openssl_free_public_key(struct dcrypt_public_key **key)
{
EVP_PKEY_free((EVP_PKEY*)*key);
*key = NULL;
}
static
void dcrypt_openssl_free_private_key(struct dcrypt_private_key **key)
{
EVP_PKEY_free((EVP_PKEY*)*key);
*key = NULL;
}
static
void dcrypt_openssl_free_keypair(struct dcrypt_keypair *keypair)
{
dcrypt_openssl_free_public_key(&(keypair->pub));
dcrypt_openssl_free_private_key(&(keypair->priv));
}
static
bool dcrypt_openssl_rsa_encrypt(struct dcrypt_public_key *key, const unsigned char *data, size_t data_len, buffer_t *result, const char **error_r)
{
int ec;
EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new((EVP_PKEY*)key, NULL);
size_t outl = EVP_PKEY_size((EVP_PKEY*)key);
unsigned char buf[outl];
if (ctx == NULL ||
EVP_PKEY_encrypt_init(ctx) < 1 ||
EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_OAEP_PADDING) < 1 ||
EVP_PKEY_encrypt(ctx, buf, &outl, data, data_len) < 1) {
dcrypt_openssl_error(error_r);
ec = -1;
} else {
buffer_append(result, buf, outl);
ec = 0;
}
EVP_PKEY_CTX_free(ctx);
return ec == 0;
}
static
bool dcrypt_openssl_rsa_decrypt(struct dcrypt_private_key *key, const unsigned char *data, size_t data_len, buffer_t *result, const char **error_r)
{
int ec;
EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new((EVP_PKEY*)key, NULL);
size_t outl = EVP_PKEY_size((EVP_PKEY*)key);
unsigned char buf[outl];
if (ctx == NULL ||
EVP_PKEY_decrypt_init(ctx) < 1 ||
EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_OAEP_PADDING) < 1 ||
EVP_PKEY_decrypt(ctx, buf, &outl, data, data_len) < 1) {
dcrypt_openssl_error(error_r);
ec = -1;
} else {
buffer_append(result, buf, outl);
ec = 0;
}
EVP_PKEY_CTX_free(ctx);
return ec == 0;
}
static
const char *dcrypt_openssl_oid2name(const unsigned char *oid, size_t oid_len, const char **error_r)
{
const char *name;
ASN1_OBJECT *obj = d2i_ASN1_OBJECT(NULL, &oid, oid_len);
if (obj == NULL) {
dcrypt_openssl_error(error_r);
return NULL;
}
name = OBJ_nid2sn(OBJ_obj2nid(obj));
ASN1_OBJECT_free(obj);
return name;
}
static
bool dcrypt_openssl_name2oid(const char *name, buffer_t *oid, const char **error_r)
{
ASN1_OBJECT *obj = OBJ_txt2obj(name, 0);
if (obj == NULL)
return dcrypt_openssl_error(error_r);
if (obj->length == 0) {
if (error_r != NULL)
*error_r = "Object has no OID assigned";
return FALSE;
}
unsigned char *bufptr = buffer_append_space_unsafe(oid, obj->length + 2);
i2d_ASN1_OBJECT(obj, &bufptr);
ASN1_OBJECT_free(obj);
if (bufptr != NULL) {
return TRUE;
}
return dcrypt_openssl_error(error_r);
}
static
enum dcrypt_key_type dcrypt_openssl_private_key_type(struct dcrypt_private_key *key)
{
EVP_PKEY *priv = (EVP_PKEY*)key;
i_assert(priv != NULL);
if (EVP_PKEY_base_id(priv) == EVP_PKEY_RSA) return DCRYPT_KEY_RSA;
else if (EVP_PKEY_base_id(priv) == EVP_PKEY_EC) return DCRYPT_KEY_EC;
else i_unreached();
}
static
enum dcrypt_key_type dcrypt_openssl_public_key_type(struct dcrypt_public_key *key)
{
EVP_PKEY *pub = (EVP_PKEY*)key;
i_assert(pub != NULL);
if (EVP_PKEY_base_id(pub) == EVP_PKEY_RSA) return DCRYPT_KEY_RSA;
else if (EVP_PKEY_base_id(pub) == EVP_PKEY_EC) return DCRYPT_KEY_EC;
else i_unreached();
}
/** this is the v1 old legacy way of doing key id's **/
static
bool dcrypt_openssl_public_key_id_old(struct dcrypt_public_key *key, buffer_t *result, const char **error_r)
{
unsigned char buf[SHA256_DIGEST_LENGTH];
EVP_PKEY *pub = (EVP_PKEY*)key;
i_assert(pub != NULL);
if (EVP_PKEY_base_id(pub) != EVP_PKEY_EC) {
if (error_r != NULL)
*error_r = "Only EC key supported";
return FALSE;
}
char *pub_pt_hex = ec_key_get_pub_point_hex(EVP_PKEY_get0_EC_KEY(pub));
/* digest this */
SHA256((const unsigned char*)pub_pt_hex, strlen(pub_pt_hex), buf);
buffer_append(result, buf, SHA256_DIGEST_LENGTH);
OPENSSL_free(pub_pt_hex);
return TRUE;
}
static
bool dcrypt_openssl_private_key_id_old(struct dcrypt_private_key *key, buffer_t *result, const char **error_r)
{
unsigned char buf[SHA256_DIGEST_LENGTH];
EVP_PKEY *priv = (EVP_PKEY*)key;
i_assert(priv != NULL);
if (EVP_PKEY_base_id(priv) != EVP_PKEY_EC) {
if (error_r != NULL)
*error_r = "Only EC key supported";
return FALSE;
}
char *pub_pt_hex = ec_key_get_pub_point_hex(EVP_PKEY_get0_EC_KEY(priv));
/* digest this */
SHA256((const unsigned char*)pub_pt_hex, strlen(pub_pt_hex), buf);
buffer_append(result, buf, SHA256_DIGEST_LENGTH);
OPENSSL_free(pub_pt_hex);
return TRUE;
}
/** this is the new which uses H(der formatted public key) **/
static
bool dcrypt_openssl_public_key_id_evp(EVP_PKEY *key, const EVP_MD *md, buffer_t *result, const char **error_r)
{
bool res = FALSE;
unsigned char buf[EVP_MD_size(md)], *ptr;
if (EVP_PKEY_base_id(key) == EVP_PKEY_EC) {
EC_KEY_set_conv_form(EVP_PKEY_get0_EC_KEY(key), POINT_CONVERSION_COMPRESSED);
}
BIO *b = BIO_new(BIO_s_mem());
if (i2d_PUBKEY_bio(b, key) < 1) {
BIO_vfree(b);
return dcrypt_openssl_error(error_r);
}
long len = BIO_get_mem_data(b, &ptr);
unsigned int hlen = sizeof(buf);
/* then hash it */
#if SSLEAY_VERSION_NUMBER >= 0x1010000fL
EVP_MD_CTX *ctx = EVP_MD_CTX_new();
#else
EVP_MD_CTX *ctx = EVP_MD_CTX_create();
#endif
if (EVP_DigestInit_ex(ctx, md, NULL) < 1 ||
EVP_DigestUpdate(ctx, (const unsigned char*)ptr, len) < 1 ||
EVP_DigestFinal_ex(ctx, buf, &hlen) < 1) {
res = dcrypt_openssl_error(error_r);
} else {
buffer_append(result, buf, hlen);
res = TRUE;
}
#if SSLEAY_VERSION_NUMBER >= 0x1010000fL
EVP_MD_CTX_free(ctx);
#else
EVP_MD_CTX_destroy(ctx);
#endif
BIO_vfree(b);
return res;
}
static
bool dcrypt_openssl_public_key_id(struct dcrypt_public_key *key, const char *algorithm, buffer_t *result, const char **error_r)
{
const EVP_MD *md = EVP_get_digestbyname(algorithm);
EVP_PKEY *pub = (EVP_PKEY*)key;
i_assert(pub != NULL);
if (md == NULL) {
if (error_r != NULL)
*error_r = t_strdup_printf("Unknown cipher %s", algorithm);
return FALSE;
}
return dcrypt_openssl_public_key_id_evp(pub, md, result, error_r);
}
static
bool dcrypt_openssl_private_key_id(struct dcrypt_private_key *key, const char *algorithm, buffer_t *result, const char **error_r)
{
const EVP_MD *md = EVP_get_digestbyname(algorithm);
EVP_PKEY *priv = (EVP_PKEY*)key;
i_assert(priv != NULL);
if (md == NULL) {
if (error_r != NULL)
*error_r = t_strdup_printf("Unknown cipher %s", algorithm);
return FALSE;
}
return dcrypt_openssl_public_key_id_evp(priv, md, result, error_r);
}
static struct dcrypt_vfs dcrypt_openssl_vfs = {
.initialize = dcrypt_openssl_initialize,
.ctx_sym_create = dcrypt_openssl_ctx_sym_create,
.ctx_sym_destroy = dcrypt_openssl_ctx_sym_destroy,
.ctx_sym_set_key = dcrypt_openssl_ctx_sym_set_key,
.ctx_sym_set_iv = dcrypt_openssl_ctx_sym_set_iv,
.ctx_sym_set_key_iv_random = dcrypt_openssl_ctx_sym_set_key_iv_random,
.ctx_sym_set_padding = dcrypt_openssl_ctx_sym_set_padding,
.ctx_sym_get_key = dcrypt_openssl_ctx_sym_get_key,
.ctx_sym_get_iv = dcrypt_openssl_ctx_sym_get_iv,
.ctx_sym_set_aad = dcrypt_openssl_ctx_sym_set_aad,
.ctx_sym_get_aad = dcrypt_openssl_ctx_sym_get_aad,
.ctx_sym_set_tag = dcrypt_openssl_ctx_sym_set_tag,
.ctx_sym_get_tag = dcrypt_openssl_ctx_sym_get_tag,
.ctx_sym_get_key_length = dcrypt_openssl_ctx_sym_get_key_length,
.ctx_sym_get_iv_length = dcrypt_openssl_ctx_sym_get_iv_length,
.ctx_sym_get_block_size = dcrypt_openssl_ctx_sym_get_block_size,
.ctx_sym_init = dcrypt_openssl_ctx_sym_init,
.ctx_sym_update = dcrypt_openssl_ctx_sym_update,
.ctx_sym_final = dcrypt_openssl_ctx_sym_final,
.ctx_hmac_create = dcrypt_openssl_ctx_hmac_create,
.ctx_hmac_destroy = dcrypt_openssl_ctx_hmac_destroy,
.ctx_hmac_set_key = dcrypt_openssl_ctx_hmac_set_key,
.ctx_hmac_set_key_random = dcrypt_openssl_ctx_hmac_set_key_random,
.ctx_hmac_get_digest_length = dcrypt_openssl_ctx_hmac_get_digest_length,
.ctx_hmac_get_key = dcrypt_openssl_ctx_hmac_get_key,
.ctx_hmac_init = dcrypt_openssl_ctx_hmac_init,
.ctx_hmac_update = dcrypt_openssl_ctx_hmac_update,
.ctx_hmac_final = dcrypt_openssl_ctx_hmac_final,
.ecdh_derive_secret_local = dcrypt_openssl_ecdh_derive_secret_local,
.ecdh_derive_secret_peer = dcrypt_openssl_ecdh_derive_secret_peer,
.pbkdf2 = dcrypt_openssl_pbkdf2,
.generate_keypair = dcrypt_openssl_generate_keypair,
.load_private_key = dcrypt_openssl_load_private_key,
.load_public_key = dcrypt_openssl_load_public_key,
.store_private_key = dcrypt_openssl_store_private_key,
.store_public_key = dcrypt_openssl_store_public_key,
.private_to_public_key = dcrypt_openssl_private_to_public_key,
.key_string_get_info = dcrypt_openssl_key_string_get_info,
.free_keypair = dcrypt_openssl_free_keypair,
.free_public_key = dcrypt_openssl_free_public_key,
.free_private_key = dcrypt_openssl_free_private_key,
.rsa_encrypt = dcrypt_openssl_rsa_encrypt,
.rsa_decrypt = dcrypt_openssl_rsa_decrypt,
.oid2name = dcrypt_openssl_oid2name,
.name2oid = dcrypt_openssl_name2oid,
.private_key_type = dcrypt_openssl_private_key_type,
.public_key_type = dcrypt_openssl_public_key_type,
.public_key_id = dcrypt_openssl_public_key_id,
.public_key_id_old = dcrypt_openssl_public_key_id_old,
.private_key_id = dcrypt_openssl_private_key_id,
.private_key_id_old = dcrypt_openssl_private_key_id_old,
};
void dcrypt_openssl_init(struct module *module ATTR_UNUSED)
{
dovecot_openssl_common_global_ref();
dcrypt_set_vfs(&dcrypt_openssl_vfs);
}
void dcrypt_openssl_deinit(void)
{
dovecot_openssl_common_global_unref();
}