VirtualBox

source: vbox/trunk/src/VBox/Runtime/common/crypto/key-openssl.cpp@ 100445

Last change on this file since 100445 was 100445, checked in by vboxsync, 23 months ago

IPRT,OpenSSL: Support ECDSA for verficiation purposes when IPRT links with OpenSSL. This required quite a bit of cleanups, so not entirely no-risk. [build fixes] bugref:10479 ticketref:21621
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 11.2 KB
Line 
1/* $Id: key-openssl.cpp 100445 2023-07-08 14:58:50Z vboxsync $ */
2/** @file
3 * IPRT - Crypto - Cryptographic Keys, OpenSSL glue.
4 */
5
6/*
7 * Copyright (C) 2006-2023 Oracle and/or its affiliates.
8 *
9 * This file is part of VirtualBox base platform packages, as
10 * available from https://www.215389.xyz.
11 *
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation, in version 3 of the
15 * License.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20 * General Public License for more details.
21 *
22 * You should have received a copy of the GNU General Public License
23 * along with this program; if not, see <https://www.gnu.org/licenses>.
24 *
25 * The contents of this file may alternatively be used under the terms
26 * of the Common Development and Distribution License Version 1.0
27 * (CDDL), a copy of it is provided in the "COPYING.CDDL" file included
28 * in the VirtualBox distribution, in which case the provisions of the
29 * CDDL are applicable instead of those of the GPL.
30 *
31 * You may elect to license modified versions of this file under the
32 * terms and conditions of either the GPL or the CDDL or both.
33 *
34 * SPDX-License-Identifier: GPL-3.0-only OR CDDL-1.0
35 */
36
37
38/*********************************************************************************************************************************
39* Header Files *
40*********************************************************************************************************************************/
41#define LOG_GROUP RTLOGGROUP_CRYPTO
42#include "internal/iprt.h"
43#include <iprt/crypto/key.h>
44
45#include <iprt/err.h>
46#include <iprt/log.h>
47#include <iprt/mem.h>
48#include <iprt/string.h>
49#include <iprt/crypto/digest.h>
50
51
52#ifdef IPRT_WITH_OPENSSL
53# include "internal/iprt-openssl.h"
54# include "internal/magics.h"
55# include "internal/openssl-pre.h"
56# include <openssl/evp.h>
57# include "internal/openssl-post.h"
58# ifndef OPENSSL_VERSION_NUMBER
59# error "Missing OPENSSL_VERSION_NUMBER!"
60# endif
61
62# include "key-internal.h"
63
64
65/**
66 * Helper that loads key parameters if present.
67 */
68static int rtCrKeyToOpenSslKeyLoadParams(RTCRKEY hKey, int idKeyType, EVP_PKEY **ppEvpNewKey, PRTERRINFO pErrInfo)
69{
70 int rc = VINF_SUCCESS;
71 if ( hKey->enmType == RTCRKEYTYPE_ECDSA_PUBLIC
72 || hKey->enmType == RTCRKEYTYPE_ECDSA_PRIVATE)
73 {
74# if OPENSSL_VERSION_NUMBER >= 0x30000000 && !defined(LIBRESSL_VERSION_NUMBER)
75 void *pvFree = NULL;
76 const uint8_t *pbRaw = NULL;
77 uint32_t cbRaw = 0;
78 if (hKey->enmType == RTCRKEYTYPE_ECDSA_PUBLIC)
79 rc = RTAsn1EncodeQueryRawBits(&hKey->u.EcdsaPublic.NamedCurve.Asn1Core, &pbRaw, &cbRaw, &pvFree, pErrInfo);
80 else
81 AssertFailedStmt(rc = VERR_NOT_IMPLEMENTED);
82 if (RT_SUCCESS(rc))
83 {
84 const unsigned char *puchParams = pbRaw;
85 EVP_PKEY *pRet = d2i_KeyParams(idKeyType, ppEvpNewKey, &puchParams, cbRaw);
86 if (pRet != NULL && pRet == *ppEvpNewKey)
87 rc = VINF_SUCCESS;
88 else
89 rc = RTERRINFO_LOG_SET(pErrInfo, VERR_CR_PKIX_OSSL_D2I_KEY_PARAMS_FAILED, "d2i_KeyParams failed");
90
91 RTMemTmpFree(pvFree);
92 }
93#else
94 /** @todo d2i_KeyParams was introduced with 3.0.0, so ECDSA stuff won't work
95 * with older openssl versions atm. Fortunately we only really needs
96 * it on Windows atm., so no problem. */
97 rc = RTERRINFO_LOG_SET_F(pErrInfo, VERR_NOT_SUPPORTED,
98 "OpenSSL version %#x is too old for IPRTs ECDSA code", OPENSSL_VERSION_NUMBER);
99#endif
100 }
101 return rc;
102}
103
104
105/**
106 * Helper that loads key bits.
107 */
108static int rtCrKeyToOpenSslKeyLoadKeyBits(RTCRKEY hKey, int idKeyType, EVP_PKEY **ppEvpNewKey,
109 bool fNeedPublic, PRTERRINFO pErrInfo)
110{
111 /*
112 * Load the key into the structure.
113 */
114 const unsigned char *puchPublicKey = hKey->pbEncoded;
115 EVP_PKEY *pRet;
116 if (fNeedPublic)
117 pRet = d2i_PublicKey(idKeyType, ppEvpNewKey, &puchPublicKey, hKey->cbEncoded);
118 else
119 pRet = d2i_PrivateKey(idKeyType, ppEvpNewKey, &puchPublicKey, hKey->cbEncoded);
120 if (pRet != NULL && pRet == *ppEvpNewKey)
121 return VINF_SUCCESS;
122
123 /* Bail out: */
124 if (fNeedPublic)
125 return RTERRINFO_LOG_SET(pErrInfo, VERR_CR_PKIX_OSSL_D2I_PUBLIC_KEY_FAILED, "d2i_PublicKey failed");
126 return RTERRINFO_LOG_SET(pErrInfo, VERR_CR_PKIX_OSSL_D2I_PRIVATE_KEY_FAILED, "d2i_PrivateKey failed");
127}
128
129
130/**
131 * Creates an OpenSSL key for the given IPRT one, returning the message digest
132 * algorithm if desired.
133 *
134 * @returns IRPT status code.
135 * @param hKey The key to convert to an OpenSSL key.
136 * @param fNeedPublic Set if we need the public side of the key.
137 * @param pszAlgoObjId Alogrithm stuff we currently need.
138 * @param ppEvpKey Where to return the pointer to the key structure.
139 * @param ppEvpMdType Where to optionally return the message digest type.
140 * @param pErrInfo Where to optionally return more error details.
141 */
142DECLHIDDEN(int) rtCrKeyToOpenSslKey(RTCRKEY hKey, bool fNeedPublic, void /*EVP_PKEY*/ **ppEvpKey, PRTERRINFO pErrInfo)
143{
144 *ppEvpKey = NULL;
145 AssertReturn(hKey->u32Magic == RTCRKEYINT_MAGIC, VERR_INVALID_HANDLE);
146 AssertReturn(fNeedPublic == !(hKey->fFlags & RTCRKEYINT_F_PRIVATE), VERR_WRONG_TYPE);
147 AssertReturn(hKey->fFlags & RTCRKEYINT_F_INCLUDE_ENCODED, VERR_WRONG_TYPE); /* build misconfig */
148
149 rtCrOpenSslInit();
150
151 /*
152 * Translate the key type from IPRT to EVP speak.
153 */
154 int idKeyType;
155 switch (hKey->enmType)
156 {
157 case RTCRKEYTYPE_RSA_PRIVATE:
158 case RTCRKEYTYPE_RSA_PUBLIC:
159 idKeyType = EVP_PKEY_RSA;
160 break;
161
162 case RTCRKEYTYPE_ECDSA_PUBLIC:
163 case RTCRKEYTYPE_ECDSA_PRIVATE:
164 idKeyType = EVP_PKEY_EC;
165 break;
166
167 default:
168 return RTErrInfoSetF(pErrInfo, VERR_NOT_SUPPORTED, "Unsupported key type: %d", hKey->enmType);
169 }
170
171 /*
172 * Allocate a new key structure and set its type.
173 */
174 EVP_PKEY *pEvpNewKey = EVP_PKEY_new();
175 if (!pEvpNewKey)
176 return RTErrInfoSetF(pErrInfo, VERR_NO_MEMORY, "EVP_PKEY_new/%d failed", idKeyType);
177
178 /*
179 * Load key parameters and the key into the EVP structure.
180 */
181 int rc = rtCrKeyToOpenSslKeyLoadParams(hKey, idKeyType, &pEvpNewKey, pErrInfo);
182 if (RT_SUCCESS(rc))
183 {
184 rc = rtCrKeyToOpenSslKeyLoadKeyBits(hKey, idKeyType, &pEvpNewKey, fNeedPublic, pErrInfo);
185 if (RT_SUCCESS(rc))
186 {
187 *ppEvpKey = pEvpNewKey;
188 return rc;
189 }
190 }
191 EVP_PKEY_free(pEvpNewKey);
192 return rc;
193}
194
195
196/**
197 * Creates an OpenSSL key for the given IPRT one, returning the message digest
198 * algorithm if desired.
199 *
200 * @returns IRPT status code.
201 * @param hKey The key to convert to an OpenSSL key.
202 * @param fNeedPublic Set if we need the public side of the key.
203 * @param pszAlgoObjId Alogrithm stuff we currently need.
204 * @param ppEvpKey Where to return the pointer to the key structure.
205 * @param ppEvpMdType Where to optionally return the message digest type.
206 * @param pErrInfo Where to optionally return more error details.
207 */
208DECLHIDDEN(int) rtCrKeyToOpenSslKeyEx(RTCRKEY hKey, bool fNeedPublic, const char *pszAlgoObjId,
209 void /*EVP_PKEY*/ **ppEvpKey, const void /*EVP_MD*/ **ppEvpMdType, PRTERRINFO pErrInfo)
210{
211 *ppEvpKey = NULL;
212 if (ppEvpMdType)
213 *ppEvpMdType = NULL;
214 AssertReturn(hKey->u32Magic == RTCRKEYINT_MAGIC, VERR_INVALID_HANDLE);
215 AssertReturn(fNeedPublic == !(hKey->fFlags & RTCRKEYINT_F_PRIVATE), VERR_WRONG_TYPE);
216 AssertReturn(hKey->fFlags & RTCRKEYINT_F_INCLUDE_ENCODED, VERR_WRONG_TYPE); /* build misconfig */
217
218 rtCrOpenSslInit();
219
220 /*
221 * Translate algorithm object ID into stuff that OpenSSL wants.
222 */
223 int iAlgoNid = OBJ_txt2nid(pszAlgoObjId);
224 if (iAlgoNid == NID_undef)
225 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_CR_PKIX_OSSL_CIPHER_ALGO_NOT_KNOWN,
226 "Unknown public key algorithm [OpenSSL]: %s", pszAlgoObjId);
227 const char *pszAlgoSn = OBJ_nid2sn(iAlgoNid);
228
229# if OPENSSL_VERSION_NUMBER >= 0x10001000 && !defined(LIBRESSL_VERSION_NUMBER)
230 int idAlgoPkey = 0;
231 int idAlgoMd = 0;
232 if (!OBJ_find_sigid_algs(iAlgoNid, &idAlgoMd, &idAlgoPkey))
233 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_CR_PKIX_OSSL_CIPHER_ALGO_NOT_KNOWN_EVP,
234 "OBJ_find_sigid_algs failed on %u (%s, %s)", iAlgoNid, pszAlgoSn, pszAlgoObjId);
235 if (ppEvpMdType)
236 {
237 const EVP_MD *pEvpMdType = EVP_get_digestbynid(idAlgoMd);
238 if (!pEvpMdType)
239 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_CR_PKIX_OSSL_CIPHER_ALGO_NOT_KNOWN_EVP,
240 "EVP_get_digestbynid failed on %d (%s, %s)", idAlgoMd, pszAlgoSn, pszAlgoObjId);
241 *ppEvpMdType = pEvpMdType;
242 }
243# else
244 const EVP_MD *pEvpMdType = EVP_get_digestbyname(pszAlgoSn);
245 if (!pEvpMdType)
246 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_CR_PKIX_OSSL_CIPHER_ALGO_NOT_KNOWN_EVP,
247 "EVP_get_digestbyname failed on %s (%s)", pszAlgoSn, pszAlgoObjId);
248 if (ppEvpMdType)
249 *ppEvpMdType = pEvpMdType;
250# endif
251
252 /*
253 * Allocate a new key structure and set its type.
254 */
255 EVP_PKEY *pEvpNewKey = EVP_PKEY_new();
256 if (!pEvpNewKey)
257 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_NO_MEMORY, "EVP_PKEY_new(%d) failed", iAlgoNid);
258
259 int rc;
260# if OPENSSL_VERSION_NUMBER >= 0x10001000 && !defined(LIBRESSL_VERSION_NUMBER)
261 if (EVP_PKEY_set_type(pEvpNewKey, idAlgoPkey))
262 {
263 int idKeyType = EVP_PKEY_base_id(pEvpNewKey);
264# else
265 int idKeyType = pEvpNewKey->type = EVP_PKEY_type(pEvpMdType->required_pkey_type[0]);
266# endif
267 if (idKeyType != NID_undef)
268
269 {
270 /*
271 * Load key parameters and the key into the EVP structure.
272 */
273 rc = rtCrKeyToOpenSslKeyLoadParams(hKey, idKeyType, &pEvpNewKey, pErrInfo);
274 if (RT_SUCCESS(rc))
275 {
276 rc = rtCrKeyToOpenSslKeyLoadKeyBits(hKey, idKeyType, &pEvpNewKey, fNeedPublic, pErrInfo);
277 if (RT_SUCCESS(rc))
278 {
279 *ppEvpKey = pEvpNewKey;
280 return rc;
281 }
282 }
283 }
284 else
285# if OPENSSL_VERSION_NUMBER < 0x10001000 || defined(LIBRESSL_VERSION_NUMBER)
286 rc = RTERRINFO_LOG_SET(pErrInfo, VERR_CR_PKIX_OSSL_EVP_PKEY_TYPE_ERROR, "EVP_PKEY_type() failed");
287# else
288 rc = RTERRINFO_LOG_SET(pErrInfo, VERR_CR_PKIX_OSSL_EVP_PKEY_TYPE_ERROR, "EVP_PKEY_base_id() failed");
289 }
290 else
291 rc = RTERRINFO_LOG_SET_F(pErrInfo, VERR_CR_PKIX_OSSL_EVP_PKEY_TYPE_ERROR,
292 "EVP_PKEY_set_type(%u) failed (sig algo %s)", idAlgoPkey, pszAlgoSn);
293# endif
294
295 EVP_PKEY_free(pEvpNewKey);
296 *ppEvpKey = NULL;
297 return rc;
298}
299
300#endif /* IPRT_WITH_OPENSSL */
301
Note: See TracBrowser for help on using the repository browser.

© 2025 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette