/* $OpenBSD: ec_asn1.c,v 1.106 2024/11/08 13:55:45 tb Exp $ */ /* * Written by Nils Larsch for the OpenSSL project. */ /* ==================================================================== * Copyright (c) 2000-2003 The OpenSSL Project. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in * the documentation and/or other materials provided with the * distribution. * * 3. All advertising materials mentioning features or use of this * software must display the following acknowledgment: * "This product includes software developed by the OpenSSL Project * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" * * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to * endorse or promote products derived from this software without * prior written permission. For written permission, please contact * licensing@OpenSSL.org. * * 5. Products derived from this software may not be called "OpenSSL" * nor may "OpenSSL" appear in their names without prior written * permission of the OpenSSL Project. * * 6. Redistributions of any form whatsoever must retain the following * acknowledgment: * "This product includes software developed by the OpenSSL Project * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" * * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED * OF THE POSSIBILITY OF SUCH DAMAGE. * ==================================================================== * * This product includes cryptographic software written by Eric Young * (eay@cryptsoft.com). This product includes software written by Tim * Hudson (tjh@cryptsoft.com). * */ #include #include #include #include #include #include #include #include #include #include #include #include "asn1_local.h" #include "ec_local.h" int EC_GROUP_get_basis_type(const EC_GROUP *group) { return 0; } LCRYPTO_ALIAS(EC_GROUP_get_basis_type); typedef struct x9_62_pentanomial_st { long k1; long k2; long k3; } X9_62_PENTANOMIAL; typedef struct x9_62_characteristic_two_st { long m; ASN1_OBJECT *type; union { char *ptr; /* NID_X9_62_onBasis */ ASN1_NULL *onBasis; /* NID_X9_62_tpBasis */ ASN1_INTEGER *tpBasis; /* NID_X9_62_ppBasis */ X9_62_PENTANOMIAL *ppBasis; /* anything else */ ASN1_TYPE *other; } p; } X9_62_CHARACTERISTIC_TWO; typedef struct x9_62_fieldid_st { ASN1_OBJECT *fieldType; union { char *ptr; /* NID_X9_62_prime_field */ ASN1_INTEGER *prime; /* NID_X9_62_characteristic_two_field */ X9_62_CHARACTERISTIC_TWO *char_two; /* anything else */ ASN1_TYPE *other; } p; } X9_62_FIELDID; typedef struct x9_62_curve_st { ASN1_OCTET_STRING *a; ASN1_OCTET_STRING *b; ASN1_BIT_STRING *seed; } X9_62_CURVE; typedef struct ec_parameters_st { long version; X9_62_FIELDID *fieldID; X9_62_CURVE *curve; ASN1_OCTET_STRING *base; ASN1_INTEGER *order; ASN1_INTEGER *cofactor; } ECPARAMETERS; #define ECPK_PARAM_NAMED_CURVE 0 #define ECPK_PARAM_EXPLICIT 1 #define ECPK_PARAM_IMPLICITLY_CA 2 typedef struct ecpk_parameters_st { int type; union { ASN1_OBJECT *named_curve; ECPARAMETERS *parameters; ASN1_NULL *implicitlyCA; } value; } ECPKPARAMETERS; typedef struct ec_privatekey_st { long version; ASN1_OCTET_STRING *privateKey; ECPKPARAMETERS *parameters; ASN1_BIT_STRING *publicKey; } EC_PRIVATEKEY; static const ASN1_TEMPLATE X9_62_PENTANOMIAL_seq_tt[] = { { .flags = 0, .tag = 0, .offset = offsetof(X9_62_PENTANOMIAL, k1), .field_name = "k1", .item = &LONG_it, }, { .flags = 0, .tag = 0, .offset = offsetof(X9_62_PENTANOMIAL, k2), .field_name = "k2", .item = &LONG_it, }, { .flags = 0, .tag = 0, .offset = offsetof(X9_62_PENTANOMIAL, k3), .field_name = "k3", .item = &LONG_it, }, }; static const ASN1_ITEM X9_62_PENTANOMIAL_it = { .itype = ASN1_ITYPE_SEQUENCE, .utype = V_ASN1_SEQUENCE, .templates = X9_62_PENTANOMIAL_seq_tt, .tcount = sizeof(X9_62_PENTANOMIAL_seq_tt) / sizeof(ASN1_TEMPLATE), .funcs = NULL, .size = sizeof(X9_62_PENTANOMIAL), .sname = "X9_62_PENTANOMIAL", }; static const ASN1_TEMPLATE char_two_def_tt = { .flags = 0, .tag = 0, .offset = offsetof(X9_62_CHARACTERISTIC_TWO, p.other), .field_name = "p.other", .item = &ASN1_ANY_it, }; static const ASN1_ADB_TABLE X9_62_CHARACTERISTIC_TWO_adbtbl[] = { { .value = NID_X9_62_onBasis, .tt = { .flags = 0, .tag = 0, .offset = offsetof(X9_62_CHARACTERISTIC_TWO, p.onBasis), .field_name = "p.onBasis", .item = &ASN1_NULL_it, }, }, { .value = NID_X9_62_tpBasis, .tt = { .flags = 0, .tag = 0, .offset = offsetof(X9_62_CHARACTERISTIC_TWO, p.tpBasis), .field_name = "p.tpBasis", .item = &ASN1_INTEGER_it, }, }, { .value = NID_X9_62_ppBasis, .tt = { .flags = 0, .tag = 0, .offset = offsetof(X9_62_CHARACTERISTIC_TWO, p.ppBasis), .field_name = "p.ppBasis", .item = &X9_62_PENTANOMIAL_it, }, }, }; static const ASN1_ADB X9_62_CHARACTERISTIC_TWO_adb = { .flags = 0, .offset = offsetof(X9_62_CHARACTERISTIC_TWO, type), .tbl = X9_62_CHARACTERISTIC_TWO_adbtbl, .tblcount = sizeof(X9_62_CHARACTERISTIC_TWO_adbtbl) / sizeof(ASN1_ADB_TABLE), .default_tt = &char_two_def_tt, .null_tt = NULL, }; static const ASN1_TEMPLATE X9_62_CHARACTERISTIC_TWO_seq_tt[] = { { .flags = 0, .tag = 0, .offset = offsetof(X9_62_CHARACTERISTIC_TWO, m), .field_name = "m", .item = &LONG_it, }, { .flags = 0, .tag = 0, .offset = offsetof(X9_62_CHARACTERISTIC_TWO, type), .field_name = "type", .item = &ASN1_OBJECT_it, }, { .flags = ASN1_TFLG_ADB_OID, .tag = -1, .offset = 0, .field_name = "X9_62_CHARACTERISTIC_TWO", .item = (const ASN1_ITEM *)&X9_62_CHARACTERISTIC_TWO_adb, }, }; static const ASN1_ITEM X9_62_CHARACTERISTIC_TWO_it = { .itype = ASN1_ITYPE_SEQUENCE, .utype = V_ASN1_SEQUENCE, .templates = X9_62_CHARACTERISTIC_TWO_seq_tt, .tcount = sizeof(X9_62_CHARACTERISTIC_TWO_seq_tt) / sizeof(ASN1_TEMPLATE), .funcs = NULL, .size = sizeof(X9_62_CHARACTERISTIC_TWO), .sname = "X9_62_CHARACTERISTIC_TWO", }; static const ASN1_TEMPLATE fieldID_def_tt = { .flags = 0, .tag = 0, .offset = offsetof(X9_62_FIELDID, p.other), .field_name = "p.other", .item = &ASN1_ANY_it, }; static const ASN1_ADB_TABLE X9_62_FIELDID_adbtbl[] = { { .value = NID_X9_62_prime_field, .tt = { .flags = 0, .tag = 0, .offset = offsetof(X9_62_FIELDID, p.prime), .field_name = "p.prime", .item = &ASN1_INTEGER_it, }, }, { .value = NID_X9_62_characteristic_two_field, .tt = { .flags = 0, .tag = 0, .offset = offsetof(X9_62_FIELDID, p.char_two), .field_name = "p.char_two", .item = &X9_62_CHARACTERISTIC_TWO_it, }, }, }; static const ASN1_ADB X9_62_FIELDID_adb = { .flags = 0, .offset = offsetof(X9_62_FIELDID, fieldType), .tbl = X9_62_FIELDID_adbtbl, .tblcount = sizeof(X9_62_FIELDID_adbtbl) / sizeof(ASN1_ADB_TABLE), .default_tt = &fieldID_def_tt, .null_tt = NULL, }; static const ASN1_TEMPLATE X9_62_FIELDID_seq_tt[] = { { .flags = 0, .tag = 0, .offset = offsetof(X9_62_FIELDID, fieldType), .field_name = "fieldType", .item = &ASN1_OBJECT_it, }, { .flags = ASN1_TFLG_ADB_OID, .tag = -1, .offset = 0, .field_name = "X9_62_FIELDID", .item = (const ASN1_ITEM *)&X9_62_FIELDID_adb, }, }; static const ASN1_ITEM X9_62_FIELDID_it = { .itype = ASN1_ITYPE_SEQUENCE, .utype = V_ASN1_SEQUENCE, .templates = X9_62_FIELDID_seq_tt, .tcount = sizeof(X9_62_FIELDID_seq_tt) / sizeof(ASN1_TEMPLATE), .funcs = NULL, .size = sizeof(X9_62_FIELDID), .sname = "X9_62_FIELDID", }; static const ASN1_TEMPLATE X9_62_CURVE_seq_tt[] = { { .flags = 0, .tag = 0, .offset = offsetof(X9_62_CURVE, a), .field_name = "a", .item = &ASN1_OCTET_STRING_it, }, { .flags = 0, .tag = 0, .offset = offsetof(X9_62_CURVE, b), .field_name = "b", .item = &ASN1_OCTET_STRING_it, }, { .flags = ASN1_TFLG_OPTIONAL, .tag = 0, .offset = offsetof(X9_62_CURVE, seed), .field_name = "seed", .item = &ASN1_BIT_STRING_it, }, }; static const ASN1_ITEM X9_62_CURVE_it = { .itype = ASN1_ITYPE_SEQUENCE, .utype = V_ASN1_SEQUENCE, .templates = X9_62_CURVE_seq_tt, .tcount = sizeof(X9_62_CURVE_seq_tt) / sizeof(ASN1_TEMPLATE), .funcs = NULL, .size = sizeof(X9_62_CURVE), .sname = "X9_62_CURVE", }; static const ASN1_TEMPLATE ECPARAMETERS_seq_tt[] = { { .flags = 0, .tag = 0, .offset = offsetof(ECPARAMETERS, version), .field_name = "version", .item = &LONG_it, }, { .flags = 0, .tag = 0, .offset = offsetof(ECPARAMETERS, fieldID), .field_name = "fieldID", .item = &X9_62_FIELDID_it, }, { .flags = 0, .tag = 0, .offset = offsetof(ECPARAMETERS, curve), .field_name = "curve", .item = &X9_62_CURVE_it, }, { .flags = 0, .tag = 0, .offset = offsetof(ECPARAMETERS, base), .field_name = "base", .item = &ASN1_OCTET_STRING_it, }, { .flags = 0, .tag = 0, .offset = offsetof(ECPARAMETERS, order), .field_name = "order", .item = &ASN1_INTEGER_it, }, { .flags = ASN1_TFLG_OPTIONAL, .tag = 0, .offset = offsetof(ECPARAMETERS, cofactor), .field_name = "cofactor", .item = &ASN1_INTEGER_it, }, }; static const ASN1_ITEM ECPARAMETERS_it = { .itype = ASN1_ITYPE_SEQUENCE, .utype = V_ASN1_SEQUENCE, .templates = ECPARAMETERS_seq_tt, .tcount = sizeof(ECPARAMETERS_seq_tt) / sizeof(ASN1_TEMPLATE), .funcs = NULL, .size = sizeof(ECPARAMETERS), .sname = "ECPARAMETERS", }; static ECPARAMETERS * ECPARAMETERS_new(void) { return (ECPARAMETERS*)ASN1_item_new(&ECPARAMETERS_it); } static void ECPARAMETERS_free(ECPARAMETERS *a) { ASN1_item_free((ASN1_VALUE *)a, &ECPARAMETERS_it); } static const ASN1_TEMPLATE ECPKPARAMETERS_ch_tt[] = { { .flags = 0, .tag = 0, .offset = offsetof(ECPKPARAMETERS, value.named_curve), .field_name = "value.named_curve", .item = &ASN1_OBJECT_it, }, { .flags = 0, .tag = 0, .offset = offsetof(ECPKPARAMETERS, value.parameters), .field_name = "value.parameters", .item = &ECPARAMETERS_it, }, { .flags = 0, .tag = 0, .offset = offsetof(ECPKPARAMETERS, value.implicitlyCA), .field_name = "value.implicitlyCA", .item = &ASN1_NULL_it, }, }; static const ASN1_ITEM ECPKPARAMETERS_it = { .itype = ASN1_ITYPE_CHOICE, .utype = offsetof(ECPKPARAMETERS, type), .templates = ECPKPARAMETERS_ch_tt, .tcount = sizeof(ECPKPARAMETERS_ch_tt) / sizeof(ASN1_TEMPLATE), .funcs = NULL, .size = sizeof(ECPKPARAMETERS), .sname = "ECPKPARAMETERS", }; static ECPKPARAMETERS * d2i_ECPKPARAMETERS(ECPKPARAMETERS **a, const unsigned char **in, long len) { return (ECPKPARAMETERS *)ASN1_item_d2i((ASN1_VALUE **)a, in, len, &ECPKPARAMETERS_it); } static int i2d_ECPKPARAMETERS(const ECPKPARAMETERS *a, unsigned char **out) { return ASN1_item_i2d((ASN1_VALUE *)a, out, &ECPKPARAMETERS_it); } static ECPKPARAMETERS * ECPKPARAMETERS_new(void) { return (ECPKPARAMETERS *)ASN1_item_new(&ECPKPARAMETERS_it); } static void ECPKPARAMETERS_free(ECPKPARAMETERS *a) { ASN1_item_free((ASN1_VALUE *)a, &ECPKPARAMETERS_it); } static const ASN1_TEMPLATE EC_PRIVATEKEY_seq_tt[] = { { .flags = 0, .tag = 0, .offset = offsetof(EC_PRIVATEKEY, version), .field_name = "version", .item = &LONG_it, }, { .flags = 0, .tag = 0, .offset = offsetof(EC_PRIVATEKEY, privateKey), .field_name = "privateKey", .item = &ASN1_OCTET_STRING_it, }, { .flags = ASN1_TFLG_EXPLICIT | ASN1_TFLG_OPTIONAL, .tag = 0, .offset = offsetof(EC_PRIVATEKEY, parameters), .field_name = "parameters", .item = &ECPKPARAMETERS_it, }, { .flags = ASN1_TFLG_EXPLICIT | ASN1_TFLG_OPTIONAL, .tag = 1, .offset = offsetof(EC_PRIVATEKEY, publicKey), .field_name = "publicKey", .item = &ASN1_BIT_STRING_it, }, }; static const ASN1_ITEM EC_PRIVATEKEY_it = { .itype = ASN1_ITYPE_SEQUENCE, .utype = V_ASN1_SEQUENCE, .templates = EC_PRIVATEKEY_seq_tt, .tcount = sizeof(EC_PRIVATEKEY_seq_tt) / sizeof(ASN1_TEMPLATE), .funcs = NULL, .size = sizeof(EC_PRIVATEKEY), .sname = "EC_PRIVATEKEY", }; static EC_PRIVATEKEY * d2i_EC_PRIVATEKEY(EC_PRIVATEKEY **a, const unsigned char **in, long len) { return (EC_PRIVATEKEY *)ASN1_item_d2i((ASN1_VALUE **)a, in, len, &EC_PRIVATEKEY_it); } static int i2d_EC_PRIVATEKEY(const EC_PRIVATEKEY *a, unsigned char **out) { return ASN1_item_i2d((ASN1_VALUE *)a, out, &EC_PRIVATEKEY_it); } static EC_PRIVATEKEY * EC_PRIVATEKEY_new(void) { return (EC_PRIVATEKEY *)ASN1_item_new(&EC_PRIVATEKEY_it); } static void EC_PRIVATEKEY_free(EC_PRIVATEKEY *a) { ASN1_item_free((ASN1_VALUE *)a, &EC_PRIVATEKEY_it); } static int ec_point_from_asn1_string(const EC_GROUP *group, const ASN1_STRING *astr, EC_POINT **out_point, uint8_t *out_form) { return ec_point_from_octets(group, astr->data, astr->length, out_point, out_form, NULL); } static int ec_point_from_asn1_bit_string(const EC_GROUP *group, const ASN1_BIT_STRING *abs, EC_POINT **out_point, uint8_t *out_form) { /* * Per SEC 1, C.3, the bit string representing the public key comes from * an octet string, therefore the unused bits octet must be 0x00. * XXX - move this check to a helper in a_bitstr.c? */ if ((abs->flags & ASN1_STRING_FLAG_BITS_LEFT) != 0 && (abs->flags & 0x07) != 0) return 0; return ec_point_from_asn1_string(group, abs, out_point, out_form); } static int ec_point_from_asn1_octet_string(const EC_GROUP *group, const ASN1_OCTET_STRING *aos, EC_POINT **out_point, uint8_t *out_form) { return ec_point_from_asn1_string(group, aos, out_point, out_form); } static int ec_point_to_asn1_string_type(const EC_GROUP *group, const EC_POINT *point, int form, int type, ASN1_STRING **out_astr) { ASN1_STRING *astr = NULL; unsigned char *buf = NULL; size_t len = 0; int ret = 0; if (*out_astr != NULL && ASN1_STRING_type(*out_astr) != type) goto err; if (!ec_point_to_octets(group, point, form, &buf, &len, NULL)) goto err; if ((astr = *out_astr) == NULL) astr = ASN1_STRING_type_new(type); if (astr == NULL) goto err; ASN1_STRING_set0(astr, buf, len); buf = NULL; len = 0; *out_astr = astr; astr = NULL; ret = 1; err: ASN1_STRING_free(astr); freezero(buf, len); return ret; } static int ec_point_to_asn1_bit_string(const EC_GROUP *group, const EC_POINT *point, int form, ASN1_BIT_STRING **out_abs) { if (!ec_point_to_asn1_string_type(group, point, form, V_ASN1_BIT_STRING, out_abs)) return 0; return asn1_abs_set_unused_bits(*out_abs, 0); } static int ec_point_to_asn1_octet_string(const EC_GROUP *group, const EC_POINT *point, int form, ASN1_OCTET_STRING **out_aos) { return ec_point_to_asn1_string_type(group, point, form, V_ASN1_OCTET_STRING, out_aos); } static int ec_asn1_group2fieldid(const EC_GROUP *group, X9_62_FIELDID *field) { BIGNUM *p = NULL; int nid; int ret = 0; if (group == NULL || field == NULL) goto err; nid = ec_group_get_field_type(group); if (nid == NID_X9_62_characteristic_two_field) { ECerror(EC_R_GF2M_NOT_SUPPORTED); goto err; } if (nid != NID_X9_62_prime_field) { ECerror(EC_R_INVALID_FIELD); goto err; } if ((field->fieldType = OBJ_nid2obj(nid)) == NULL) { ECerror(ERR_R_OBJ_LIB); goto err; } if ((p = BN_new()) == NULL) { ECerror(ERR_R_MALLOC_FAILURE); goto err; } if (!EC_GROUP_get_curve(group, p, NULL, NULL, NULL)) { ECerror(ERR_R_EC_LIB); goto err; } if ((field->p.prime = BN_to_ASN1_INTEGER(p, NULL)) == NULL) { ECerror(ERR_R_ASN1_LIB); goto err; } ret = 1; err: BN_free(p); return ret; } static int ec_asn1_encode_bn(const EC_GROUP *group, const BIGNUM *bn, int len, ASN1_OCTET_STRING *os) { unsigned char *buf; int ret = 0; /* One extra byte for historic NUL termination of ASN1_STRINGs. */ if ((buf = calloc(1, len + 1)) == NULL) goto err; if (BN_bn2binpad(bn, buf, len) != len) goto err; ASN1_STRING_set0(os, buf, len); buf = NULL; len = 0; ret = 1; err: freezero(buf, len); return ret; } static int ec_asn1_encode_field_element(const EC_GROUP *group, const BIGNUM *bn, ASN1_OCTET_STRING *os) { int len; /* Zero-pad field element to byte length of p per SEC 1, 2.3.5. */ len = (EC_GROUP_get_degree(group) + 7) / 8; return ec_asn1_encode_bn(group, bn, len, os); } static int ec_asn1_encode_private_key(const EC_GROUP *group, const BIGNUM *bn, ASN1_OCTET_STRING *os) { const BIGNUM *order; if ((order = EC_GROUP_get0_order(group)) == NULL) { ECerror(EC_R_INVALID_GROUP_ORDER); return 0; } /* Zero-pad private key to byte length of order per SEC 1, C.4. */ return ec_asn1_encode_bn(group, bn, BN_num_bytes(order), os); } static int ec_asn1_group2curve(const EC_GROUP *group, X9_62_CURVE *curve) { BIGNUM *a = NULL, *b = NULL; int ret = 0; if (group == NULL) goto err; if (curve == NULL || curve->a == NULL || curve->b == NULL) goto err; if ((a = BN_new()) == NULL || (b = BN_new()) == NULL) { ECerror(ERR_R_MALLOC_FAILURE); goto err; } if (!EC_GROUP_get_curve(group, NULL, a, b, NULL)) { ECerror(ERR_R_EC_LIB); goto err; } if (!ec_asn1_encode_field_element(group, a, curve->a)) { ECerror(ERR_R_EC_LIB); goto err; } if (!ec_asn1_encode_field_element(group, b, curve->b)) { ECerror(ERR_R_EC_LIB); goto err; } ASN1_BIT_STRING_free(curve->seed); curve->seed = NULL; if (group->seed != NULL) { if ((curve->seed = ASN1_BIT_STRING_new()) == NULL) { ECerror(ERR_R_MALLOC_FAILURE); goto err; } if (!ASN1_BIT_STRING_set(curve->seed, group->seed, group->seed_len)) { ECerror(ERR_R_ASN1_LIB); goto err; } if (!asn1_abs_set_unused_bits(curve->seed, 0)) { ECerror(ERR_R_ASN1_LIB); goto err; } } ret = 1; err: BN_free(a); BN_free(b); return ret; } static ECPARAMETERS * ec_asn1_group2parameters(const EC_GROUP *group) { ECPARAMETERS *parameters = NULL; const EC_POINT *generator = NULL; const BIGNUM *order, *cofactor; uint8_t form; if ((parameters = ECPARAMETERS_new()) == NULL) { ECerror(ERR_R_MALLOC_FAILURE); goto err; } parameters->version = 0x1; if (!ec_asn1_group2fieldid(group, parameters->fieldID)) { ECerror(ERR_R_EC_LIB); goto err; } if (!ec_asn1_group2curve(group, parameters->curve)) { ECerror(ERR_R_EC_LIB); goto err; } if ((generator = EC_GROUP_get0_generator(group)) == NULL) { ECerror(EC_R_UNDEFINED_GENERATOR); goto err; } form = EC_GROUP_get_point_conversion_form(group); if (!ec_point_to_asn1_octet_string(group, generator, form, ¶meters->base)) goto err; if ((order = EC_GROUP_get0_order(group)) == NULL) { ECerror(ERR_R_EC_LIB); goto err; } if (BN_is_zero(order)) { ECerror(ERR_R_EC_LIB); goto err; } ASN1_INTEGER_free(parameters->order); if ((parameters->order = BN_to_ASN1_INTEGER(order, NULL)) == NULL) { ECerror(ERR_R_ASN1_LIB); goto err; } ASN1_INTEGER_free(parameters->cofactor); parameters->cofactor = NULL; if ((cofactor = EC_GROUP_get0_cofactor(group)) == NULL) { ECerror(ERR_R_EC_LIB); goto err; } if (!BN_is_zero(cofactor)) { if ((parameters->cofactor = BN_to_ASN1_INTEGER(cofactor, NULL)) == NULL) { ECerror(ERR_R_ASN1_LIB); goto err; } } return parameters; err: ECPARAMETERS_free(parameters); return NULL; } static ECPKPARAMETERS * ec_asn1_group2pkparameters(const EC_GROUP *group) { ECPKPARAMETERS *pkparameters; ECPARAMETERS *parameters; ASN1_OBJECT *aobj; int nid; if ((pkparameters = ECPKPARAMETERS_new()) == NULL) { ECerror(ERR_R_MALLOC_FAILURE); goto err; } if ((EC_GROUP_get_asn1_flag(group) & OPENSSL_EC_NAMED_CURVE) != 0) { if ((nid = EC_GROUP_get_curve_name(group)) == NID_undef) goto err; if ((aobj = OBJ_nid2obj(nid)) == NULL) goto err; pkparameters->type = ECPK_PARAM_NAMED_CURVE; pkparameters->value.named_curve = aobj; } else { if ((parameters = ec_asn1_group2parameters(group)) == NULL) goto err; pkparameters->type = ECPK_PARAM_EXPLICIT; pkparameters->value.parameters = parameters; parameters = NULL; } return pkparameters; err: ECPKPARAMETERS_free(pkparameters); return NULL; } static int ec_asn1_is_prime_field(const X9_62_FIELDID *fieldid) { int nid; if (fieldid == NULL) { ECerror(EC_R_ASN1_ERROR); return 0; } if ((nid = OBJ_obj2nid(fieldid->fieldType)) == NID_undef) { ECerror(EC_R_INVALID_FIELD); return 0; } if (nid == NID_X9_62_characteristic_two_field) { ECerror(EC_R_GF2M_NOT_SUPPORTED); return 0; } if (nid != NID_X9_62_prime_field) { ECerror(EC_R_UNSUPPORTED_FIELD); return 0; } /* We can't check that this is actually a prime due to DoS risk. */ if (fieldid->p.prime == NULL) { ECerror(EC_R_INVALID_FIELD); return 0; } return 1; } static int ec_asn1_parameters_curve2group(const X9_62_CURVE *curve, const ASN1_INTEGER *prime, EC_GROUP **out_group) { EC_GROUP *group = NULL; BIGNUM *p = NULL, *a = NULL, *b = NULL; int ret = 0; if (*out_group != NULL) goto err; if ((p = ASN1_INTEGER_to_BN(prime, NULL)) == NULL) goto err; if ((a = BN_bin2bn(curve->a->data, curve->a->length, NULL)) == NULL) goto err; if ((b = BN_bin2bn(curve->b->data, curve->b->length, NULL)) == NULL) goto err; /* * XXX - move these checks to ec_GFp_simple_group_set_curve()? * What about checking 0 <= a, b < p? */ if (BN_is_zero(p) || BN_is_negative(p)) { ECerror(EC_R_INVALID_FIELD); goto err; } if (BN_num_bits(p) > OPENSSL_ECC_MAX_FIELD_BITS) { ECerror(EC_R_FIELD_TOO_LARGE); goto err; } if ((group = EC_GROUP_new_curve_GFp(p, a, b, NULL)) == NULL) goto err; *out_group = group; group = NULL; ret = 1; err: BN_free(p); BN_free(a); BN_free(b); EC_GROUP_free(group); return ret; } static int ec_asn1_set_group_parameters(const ECPARAMETERS *params, EC_GROUP *group) { EC_POINT *generator = NULL; BIGNUM *order = NULL, *cofactor = NULL; const ASN1_BIT_STRING *seed; uint8_t form; int ret = 0; if (!ec_point_from_asn1_octet_string(group, params->base, &generator, &form)) goto err; EC_GROUP_set_point_conversion_form(group, form); if ((order = ASN1_INTEGER_to_BN(params->order, NULL)) == NULL) { ECerror(ERR_R_ASN1_LIB); goto err; } if (params->cofactor != NULL) { if ((cofactor = ASN1_INTEGER_to_BN(params->cofactor, NULL)) == NULL) { ECerror(ERR_R_ASN1_LIB); goto err; } } /* Checks the Hasse bound and sets the cofactor if possible or fails. */ if (!EC_GROUP_set_generator(group, generator, order, cofactor)) { ECerror(ERR_R_EC_LIB); goto err; } if ((seed = params->curve->seed) != NULL) { if (EC_GROUP_set_seed(group, seed->data, seed->length) == 0) { ECerror(ERR_R_MALLOC_FAILURE); goto err; } } ret = 1; err: EC_POINT_free(generator); BN_free(order); BN_free(cofactor); return ret; } static int ec_asn1_parameters_extract_prime_group(const ECPARAMETERS *params, EC_GROUP **out_group) { EC_GROUP *group = NULL; int ret = 0; if (*out_group != NULL) goto err; if (!ec_asn1_is_prime_field(params->fieldID)) goto err; if (!ec_asn1_parameters_curve2group(params->curve, params->fieldID->p.prime, &group)) goto err; if (!ec_asn1_set_group_parameters(params, group)) goto err; *out_group = group; group = NULL; ret = 1; err: EC_GROUP_free(group); return ret; } static EC_GROUP * ec_asn1_parameters2group(const ECPARAMETERS *params) { EC_GROUP *group = NULL; if (params == NULL) { ECerror(EC_R_ASN1_ERROR); goto err; } if (!ec_asn1_parameters_extract_prime_group(params, &group)) goto err; if (!ec_group_is_builtin_curve(group)) goto err; return group; err: EC_GROUP_free(group); return NULL; } static EC_GROUP * ec_asn1_pkparameters2group(const ECPKPARAMETERS *params) { EC_GROUP *group; int nid; if (params->type == ECPK_PARAM_NAMED_CURVE) { if ((nid = OBJ_obj2nid(params->value.named_curve)) == NID_undef) { ECerror(EC_R_UNKNOWN_GROUP); return NULL; } if ((group = EC_GROUP_new_by_curve_name(nid)) == NULL) { ECerror(EC_R_EC_GROUP_NEW_BY_NAME_FAILURE); return NULL; } EC_GROUP_set_asn1_flag(group, OPENSSL_EC_NAMED_CURVE); } else if (params->type == ECPK_PARAM_EXPLICIT) { group = ec_asn1_parameters2group(params->value.parameters); if (group == NULL) { ECerror(ERR_R_EC_LIB); return NULL; } EC_GROUP_set_asn1_flag(group, 0); } else if (params->type == ECPK_PARAM_IMPLICITLY_CA) { return NULL; } else { ECerror(EC_R_ASN1_ERROR); return NULL; } return group; } EC_GROUP * d2i_ECPKParameters(EC_GROUP **a, const unsigned char **in, long len) { EC_GROUP *group = NULL; ECPKPARAMETERS *params; if ((params = d2i_ECPKPARAMETERS(NULL, in, len)) == NULL) { ECerror(EC_R_D2I_ECPKPARAMETERS_FAILURE); goto err; } if ((group = ec_asn1_pkparameters2group(params)) == NULL) { ECerror(EC_R_PKPARAMETERS2GROUP_FAILURE); goto err; } if (a != NULL) { EC_GROUP_free(*a); *a = group; } err: ECPKPARAMETERS_free(params); return group; } LCRYPTO_ALIAS(d2i_ECPKParameters); int i2d_ECPKParameters(const EC_GROUP *group, unsigned char **out_der) { ECPKPARAMETERS *parameters; int ret = 0; if ((parameters = ec_asn1_group2pkparameters(group)) == NULL) { ECerror(EC_R_GROUP2PKPARAMETERS_FAILURE); goto err; } if ((ret = i2d_ECPKPARAMETERS(parameters, out_der)) <= 0) { ECerror(EC_R_I2D_ECPKPARAMETERS_FAILURE); goto err; } err: ECPKPARAMETERS_free(parameters); return ret; } LCRYPTO_ALIAS(i2d_ECPKParameters); static int ec_key_set_group_from_parameters(EC_KEY *ec_key, const ECPKPARAMETERS *params) { EC_GROUP *group = NULL; int ret = 0; /* Use group in parameters, if any. Fall back to existing group. */ if (params != NULL) { if ((group = ec_asn1_pkparameters2group(params)) == NULL) goto err; if (!EC_KEY_set_group(ec_key, group)) goto err; } if (ec_key->group == NULL) goto err; ret = 1; err: EC_GROUP_free(group); return ret; } static int ec_key_set_private_key(EC_KEY *ec_key, const ASN1_OCTET_STRING *aos) { BIGNUM *priv_key = NULL; int ret = 0; if (aos == NULL) { ECerror(EC_R_MISSING_PRIVATE_KEY); goto err; } /* * XXX - Sec 1, C.4 requires that this octet string be padded to the * byte length of the group's order. This can't be enforced because * i2d_ECPrivateKey() produces a semi-compatible ad hoc format. */ if ((priv_key = BN_bin2bn(aos->data, aos->length, NULL)) == NULL) goto err; if (!EC_KEY_set_private_key(ec_key, priv_key)) goto err; ret = 1; err: BN_free(priv_key); return ret; } static int ec_key_set_public_key(EC_KEY *ec_key, const ASN1_BIT_STRING *abs) { EC_POINT *pub_key = NULL; uint8_t form; int ret = 0; if (abs == NULL) { ec_key->enc_flag |= EC_PKEY_NO_PUBKEY; return eckey_compute_pubkey(ec_key); } /* XXX - SEC 1, 2.3.4 does not allow hybrid encoding. */ if (!ec_point_from_asn1_bit_string(ec_key->group, abs, &pub_key, &form)) goto err; if (!EC_KEY_set_public_key(ec_key, pub_key)) goto err; EC_KEY_set_conv_form(ec_key, form); ret = 1; err: EC_POINT_free(pub_key); return ret; } EC_KEY * d2i_ECPrivateKey(EC_KEY **out_ec_key, const unsigned char **in, long len) { EC_KEY *ec_key = NULL; EC_PRIVATEKEY *ec_privatekey = NULL; if (out_ec_key == NULL || (ec_key = *out_ec_key) == NULL) ec_key = EC_KEY_new(); if (ec_key == NULL) goto err; if ((ec_privatekey = d2i_EC_PRIVATEKEY(NULL, in, len)) == NULL) { ECerror(ERR_R_EC_LIB); goto err; } ec_key->version = ec_privatekey->version; if (!ec_key_set_group_from_parameters(ec_key, ec_privatekey->parameters)) goto err; if (!ec_key_set_private_key(ec_key, ec_privatekey->privateKey)) goto err; if (!ec_key_set_public_key(ec_key, ec_privatekey->publicKey)) goto err; EC_PRIVATEKEY_free(ec_privatekey); ec_privatekey = NULL; if (out_ec_key != NULL) *out_ec_key = ec_key; return ec_key; err: if (out_ec_key == NULL || *out_ec_key != ec_key) EC_KEY_free(ec_key); EC_PRIVATEKEY_free(ec_privatekey); return NULL; } LCRYPTO_ALIAS(d2i_ECPrivateKey); int i2d_ECPrivateKey(EC_KEY *ec_key, unsigned char **out) { EC_PRIVATEKEY *ec_privatekey = NULL; const EC_GROUP *group; const BIGNUM *private_key; const EC_POINT *public_key = NULL; int ret = 0; if (ec_key == NULL) { ECerror(ERR_R_PASSED_NULL_PARAMETER); goto err; } if ((group = EC_KEY_get0_group(ec_key)) == NULL) { ECerror(EC_R_MISSING_PARAMETERS); goto err; } if ((private_key = EC_KEY_get0_private_key(ec_key)) == NULL) { ECerror(EC_R_KEYS_NOT_SET); goto err; } if ((ec_key->enc_flag & EC_PKEY_NO_PUBKEY) == 0) { if ((public_key = EC_KEY_get0_public_key(ec_key)) == NULL) { ECerror(EC_R_KEYS_NOT_SET); goto err; } } if ((ec_privatekey = EC_PRIVATEKEY_new()) == NULL) { ECerror(ERR_R_MALLOC_FAILURE); goto err; } ec_privatekey->version = ec_key->version; if (!ec_asn1_encode_private_key(group, private_key, ec_privatekey->privateKey)) goto err; if ((ec_key->enc_flag & EC_PKEY_NO_PARAMETERS) == 0) { ECPKPARAMETERS *parameters; if ((parameters = ec_asn1_group2pkparameters(group)) == NULL) { ECerror(ERR_R_EC_LIB); goto err; } ec_privatekey->parameters = parameters; } if (public_key != NULL) { uint8_t form; form = EC_KEY_get_conv_form(ec_key); if (!ec_point_to_asn1_bit_string(group, public_key, form, &ec_privatekey->publicKey)) goto err; } if ((ret = i2d_EC_PRIVATEKEY(ec_privatekey, out)) <= 0) { ECerror(ERR_R_EC_LIB); goto err; } err: EC_PRIVATEKEY_free(ec_privatekey); return ret; } LCRYPTO_ALIAS(i2d_ECPrivateKey); int i2d_ECParameters(EC_KEY *ec_key, unsigned char **out) { if (ec_key == NULL) { ECerror(ERR_R_PASSED_NULL_PARAMETER); return 0; } return i2d_ECPKParameters(ec_key->group, out); } LCRYPTO_ALIAS(i2d_ECParameters); EC_KEY * d2i_ECParameters(EC_KEY **out_ec_key, const unsigned char **in, long len) { EC_KEY *ec_key = NULL; if (in == NULL || *in == NULL) { ECerror(ERR_R_PASSED_NULL_PARAMETER); goto err; } if (out_ec_key == NULL || (ec_key = *out_ec_key) == NULL) ec_key = EC_KEY_new(); if (ec_key == NULL) { ECerror(ERR_R_MALLOC_FAILURE); goto err; } if (!d2i_ECPKParameters(&ec_key->group, in, len)) { ECerror(ERR_R_EC_LIB); goto err; } if (out_ec_key != NULL) *out_ec_key = ec_key; return ec_key; err: if (out_ec_key == NULL || *out_ec_key != ec_key) EC_KEY_free(ec_key); return NULL; } LCRYPTO_ALIAS(d2i_ECParameters); EC_KEY * ECParameters_dup(EC_KEY *key) { const unsigned char *p; unsigned char *der = NULL; EC_KEY *dup = NULL; int len; if (key == NULL) return NULL; if ((len = i2d_ECParameters(key, &der)) <= 0) return NULL; p = der; dup = d2i_ECParameters(NULL, &p, len); freezero(der, len); return dup; } LCRYPTO_ALIAS(ECParameters_dup); EC_KEY * o2i_ECPublicKey(EC_KEY **in_ec_key, const unsigned char **in, long len) { EC_KEY *ec_key = NULL; const EC_GROUP *group; uint8_t form; if (in_ec_key == NULL || (ec_key = *in_ec_key) == NULL) { ECerror(ERR_R_PASSED_NULL_PARAMETER); return NULL; } if ((group = ec_key->group) == NULL) { ECerror(ERR_R_PASSED_NULL_PARAMETER); return NULL; } if (len < 0) { ECerror(EC_R_INVALID_ARGUMENT); return NULL; } if (!ec_point_from_octets(group, *in, len, &ec_key->pub_key, &form, NULL)) return NULL; EC_KEY_set_conv_form(ec_key, form); *in += len; return ec_key; } LCRYPTO_ALIAS(o2i_ECPublicKey); int i2o_ECPublicKey(const EC_KEY *ec_key, unsigned char **out) { unsigned char *buf = NULL; size_t buf_len = 0; int ret = 0; if (ec_key == NULL) { ECerror(ERR_R_PASSED_NULL_PARAMETER); goto err; } if (!ec_point_to_octets(ec_key->group, ec_key->pub_key, ec_key->conv_form, &buf, &buf_len, NULL)) goto err; if (buf_len > INT_MAX) goto err; if (out != NULL && *out != NULL) { /* Muppet's answer to the Jackass show. */ memcpy(*out, buf, buf_len); *out += buf_len; } else if (out != NULL) { *out = buf; buf = NULL; } ret = buf_len; err: freezero(buf, buf_len); return ret; } LCRYPTO_ALIAS(i2o_ECPublicKey);