p12_mutl.c revision e45f106cb6b47af1f21efe76e933bdea2f5dd1ca
13aac1f9f308192f3787265830fe86ce8874e7382edisonn@google.com/* p12_mutl.c */ 23aac1f9f308192f3787265830fe86ce8874e7382edisonn@google.com/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL 33aac1f9f308192f3787265830fe86ce8874e7382edisonn@google.com * project 1999. 4571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com */ 5571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com/* ==================================================================== 6571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * Copyright (c) 1999 The OpenSSL Project. All rights reserved. 7571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * 8571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * Redistribution and use in source and binary forms, with or without 9571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * modification, are permitted provided that the following conditions 10571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * are met: 1178b38b130deb8bcfa41611039875ce0162542ac1edisonn@google.com * 12571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * 1. Redistributions of source code must retain the above copyright 13571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * notice, this list of conditions and the following disclaimer. 14571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * 15571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * 2. Redistributions in binary form must reproduce the above copyright 16571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * notice, this list of conditions and the following disclaimer in 17571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * the documentation and/or other materials provided with the 18571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * distribution. 19571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * 20571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * 3. All advertising materials mentioning features or use of this 21571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * software must display the following acknowledgment: 22571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * "This product includes software developed by the OpenSSL Project 23571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" 24571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * 25571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 26571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * endorse or promote products derived from this software without 27571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * prior written permission. For written permission, please contact 28571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * licensing@OpenSSL.org. 29571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * 30571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * 5. Products derived from this software may not be called "OpenSSL" 31571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * nor may "OpenSSL" appear in their names without prior written 32571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * permission of the OpenSSL Project. 33571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * 34571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * 6. Redistributions of any form whatsoever must retain the following 35571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * acknowledgment: 36571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * "This product includes software developed by the OpenSSL Project 37571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" 38571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * 39571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 40571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 41571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 42571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 43571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 44571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 45571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 46571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 47571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 48571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 49571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 50571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * OF THE POSSIBILITY OF SUCH DAMAGE. 51571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * ==================================================================== 52571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * 53571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * This product includes cryptographic software written by Eric Young 54571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * (eay@cryptsoft.com). This product includes software written by Tim 55571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * Hudson (tjh@cryptsoft.com). 56571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com * 57571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com */ 58571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com 59571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com#ifndef OPENSSL_NO_HMAC 60571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com#include <stdio.h> 61571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com#include "cryptlib.h" 62571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com#include <openssl/hmac.h> 634ef4bed00efd247a0ea005b95b7239a9d4c14c68edisonn@google.com#include <openssl/rand.h> 64571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com#include <openssl/pkcs12.h> 654ef4bed00efd247a0ea005b95b7239a9d4c14c68edisonn@google.com 664ef4bed00efd247a0ea005b95b7239a9d4c14c68edisonn@google.com/* Generate a MAC */ 67571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.comint PKCS12_gen_mac(PKCS12 *p12, const char *pass, int passlen, 68571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com unsigned char *mac, unsigned int *maclen) 69571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com{ 70571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com const EVP_MD *md_type; 71571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com HMAC_CTX hmac; 72571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com unsigned char key[EVP_MAX_MD_SIZE], *salt; 73571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com int saltlen, iter; 74571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com 75571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com if (!PKCS7_type_is_data(p12->authsafes)) 76571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com { 77571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com PKCS12err(PKCS12_F_PKCS12_GEN_MAC,PKCS12_R_CONTENT_TYPE_NOT_DATA); 78571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com return 0; 79571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com } 80571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com 81571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com salt = p12->mac->salt->data; 82571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com saltlen = p12->mac->salt->length; 83571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com if (!p12->mac->iter) iter = 1; 84571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com else iter = ASN1_INTEGER_get (p12->mac->iter); 85571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com if(!(md_type = 86a5aaa7998fc18489701660f781d7daa33ffc6f6eedisonn@google.com EVP_get_digestbyobj (p12->mac->dinfo->algor->algorithm))) { 87571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com PKCS12err(PKCS12_F_PKCS12_GEN_MAC,PKCS12_R_UNKNOWN_DIGEST_ALGORITHM); 883aac1f9f308192f3787265830fe86ce8874e7382edisonn@google.com return 0; 89571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com } 90a5aaa7998fc18489701660f781d7daa33ffc6f6eedisonn@google.com if(!PKCS12_key_gen (pass, passlen, salt, saltlen, PKCS12_MAC_ID, iter, 91571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com EVP_MD_size(md_type), key, md_type)) { 92571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com PKCS12err(PKCS12_F_PKCS12_GEN_MAC,PKCS12_R_KEY_GEN_ERROR); 93571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com return 0; 94571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com } 95571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com HMAC_CTX_init(&hmac); 96571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com HMAC_Init_ex(&hmac, key, EVP_MD_size(md_type), md_type, NULL); 97571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com HMAC_Update(&hmac, p12->authsafes->d.data->data, 98571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com p12->authsafes->d.data->length); 99571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com HMAC_Final(&hmac, mac, maclen); 100571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com HMAC_CTX_cleanup(&hmac); 101571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com return 1; 102571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com} 103a5aaa7998fc18489701660f781d7daa33ffc6f6eedisonn@google.com 104571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com/* Verify the mac */ 105571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.comint PKCS12_verify_mac(PKCS12 *p12, const char *pass, int passlen) 106a5aaa7998fc18489701660f781d7daa33ffc6f6eedisonn@google.com{ 1077b328fddf94eea5f05ffa36de02d7d9922f504daedisonn@google.com unsigned char mac[EVP_MAX_MD_SIZE]; 108a5aaa7998fc18489701660f781d7daa33ffc6f6eedisonn@google.com unsigned int maclen; 109a5aaa7998fc18489701660f781d7daa33ffc6f6eedisonn@google.com if(p12->mac == NULL) { 110571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com PKCS12err(PKCS12_F_PKCS12_VERIFY_MAC,PKCS12_R_MAC_ABSENT); 111571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com return 0; 112951d6532de49003cd5a43f57caf91dd6d3efc33eedisonn@google.com } 1132ccc3afa474f9485c39c2e863252ddaa3f35724bedisonn@google.com if (!PKCS12_gen_mac (p12, pass, passlen, mac, &maclen)) { 114571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com PKCS12err(PKCS12_F_PKCS12_VERIFY_MAC,PKCS12_R_MAC_GENERATION_ERROR); 115571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com return 0; 116571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com } 117571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com if ((maclen != (unsigned int)p12->mac->dinfo->digest->length) 118571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com || memcmp (mac, p12->mac->dinfo->digest->data, maclen)) return 0; 119571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com return 1; 120571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com} 121571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com 122571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com/* Set a mac */ 123571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com 124571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.comint PKCS12_set_mac(PKCS12 *p12, const char *pass, int passlen, 125571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com unsigned char *salt, int saltlen, int iter, const EVP_MD *md_type) 126571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com{ 127571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com unsigned char mac[EVP_MAX_MD_SIZE]; 128571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com unsigned int maclen; 129571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com 130571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com if (!md_type) md_type = EVP_sha1(); 131951d6532de49003cd5a43f57caf91dd6d3efc33eedisonn@google.com if (PKCS12_setup_mac (p12, iter, salt, saltlen, md_type) == 1322ccc3afa474f9485c39c2e863252ddaa3f35724bedisonn@google.com PKCS12_ERROR) { 133571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com PKCS12err(PKCS12_F_PKCS12_SET_MAC,PKCS12_R_MAC_SETUP_ERROR); 1343aac1f9f308192f3787265830fe86ce8874e7382edisonn@google.com return 0; 135571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com } 136571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com if (!PKCS12_gen_mac (p12, pass, passlen, mac, &maclen)) { 137571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com PKCS12err(PKCS12_F_PKCS12_SET_MAC,PKCS12_R_MAC_GENERATION_ERROR); 138571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com return 0; 13978b38b130deb8bcfa41611039875ce0162542ac1edisonn@google.com } 140571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com if (!(M_ASN1_OCTET_STRING_set (p12->mac->dinfo->digest, mac, maclen))) { 141571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com PKCS12err(PKCS12_F_PKCS12_SET_MAC,PKCS12_R_MAC_STRING_SET_ERROR); 142951d6532de49003cd5a43f57caf91dd6d3efc33eedisonn@google.com return 0; 143571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com } 144571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com return 1; 145571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com} 1462ccc3afa474f9485c39c2e863252ddaa3f35724bedisonn@google.com 1472ccc3afa474f9485c39c2e863252ddaa3f35724bedisonn@google.com/* Set up a mac structure */ 1482ccc3afa474f9485c39c2e863252ddaa3f35724bedisonn@google.comint PKCS12_setup_mac(PKCS12 *p12, int iter, unsigned char *salt, int saltlen, 149571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com const EVP_MD *md_type) 150571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com{ 151571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com if (!(p12->mac = PKCS12_MAC_DATA_new())) return PKCS12_ERROR; 152571c70b95f56e22b5a7d6f4f288aa6c9a925a64fedisonn@google.com if (iter > 1) { 1533aac1f9f308192f3787265830fe86ce8874e7382edisonn@google.com if(!(p12->mac->iter = M_ASN1_INTEGER_new())) { 1543aac1f9f308192f3787265830fe86ce8874e7382edisonn@google.com PKCS12err(PKCS12_F_PKCS12_SETUP_MAC, ERR_R_MALLOC_FAILURE); 1553aac1f9f308192f3787265830fe86ce8874e7382edisonn@google.com return 0; 156 } 157 if (!ASN1_INTEGER_set(p12->mac->iter, iter)) { 158 PKCS12err(PKCS12_F_PKCS12_SETUP_MAC, ERR_R_MALLOC_FAILURE); 159 return 0; 160 } 161 } 162 if (!saltlen) saltlen = PKCS12_SALT_LEN; 163 p12->mac->salt->length = saltlen; 164 if (!(p12->mac->salt->data = OPENSSL_malloc (saltlen))) { 165 PKCS12err(PKCS12_F_PKCS12_SETUP_MAC, ERR_R_MALLOC_FAILURE); 166 return 0; 167 } 168 if (!salt) { 169 if (RAND_pseudo_bytes (p12->mac->salt->data, saltlen) < 0) 170 return 0; 171 } 172 else memcpy (p12->mac->salt->data, salt, saltlen); 173 p12->mac->dinfo->algor->algorithm = OBJ_nid2obj(EVP_MD_type(md_type)); 174 if (!(p12->mac->dinfo->algor->parameter = ASN1_TYPE_new())) { 175 PKCS12err(PKCS12_F_PKCS12_SETUP_MAC, ERR_R_MALLOC_FAILURE); 176 return 0; 177 } 178 p12->mac->dinfo->algor->parameter->type = V_ASN1_NULL; 179 180 return 1; 181} 182#endif 183