2 * Copyright 2008-2023 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
10 #include "internal/cryptlib.h"
11 #include <openssl/asn1t.h>
12 #include <openssl/pem.h>
13 #include <openssl/x509v3.h>
14 #include <openssl/err.h>
15 #include <openssl/cms.h>
16 #include <openssl/evp.h>
17 #include "internal/sizes.h"
18 #include "crypto/asn1.h"
19 #include "crypto/evp.h"
20 #include "crypto/x509.h"
21 #include "cms_local.h"
23 /* CMS EnvelopedData Utilities */
24 static void cms_env_set_version(CMS_EnvelopedData *env);
26 #define CMS_ENVELOPED_STANDARD 1
27 #define CMS_ENVELOPED_AUTH 2
29 static int cms_get_enveloped_type_simple(const CMS_ContentInfo *cms)
31 int nid = OBJ_obj2nid(cms->contentType);
34 case NID_pkcs7_enveloped:
35 return CMS_ENVELOPED_STANDARD;
37 case NID_id_smime_ct_authEnvelopedData:
38 return CMS_ENVELOPED_AUTH;
45 static int cms_get_enveloped_type(const CMS_ContentInfo *cms)
47 int ret = cms_get_enveloped_type_simple(cms);
50 ERR_raise(ERR_LIB_CMS, CMS_R_CONTENT_TYPE_NOT_ENVELOPED_DATA);
54 void ossl_cms_env_enc_content_free(const CMS_ContentInfo *cinf)
56 if (cms_get_enveloped_type_simple(cinf) != 0) {
57 CMS_EncryptedContentInfo *ec = ossl_cms_get0_env_enc_content(cinf);
59 OPENSSL_clear_free(ec->key, ec->keylen);
63 CMS_EnvelopedData *ossl_cms_get0_enveloped(CMS_ContentInfo *cms)
65 if (OBJ_obj2nid(cms->contentType) != NID_pkcs7_enveloped) {
66 ERR_raise(ERR_LIB_CMS, CMS_R_CONTENT_TYPE_NOT_ENVELOPED_DATA);
69 return cms->d.envelopedData;
72 CMS_AuthEnvelopedData *ossl_cms_get0_auth_enveloped(CMS_ContentInfo *cms)
74 if (OBJ_obj2nid(cms->contentType) != NID_id_smime_ct_authEnvelopedData) {
75 ERR_raise(ERR_LIB_CMS, CMS_R_CONTENT_TYPE_NOT_ENVELOPED_DATA);
78 return cms->d.authEnvelopedData;
81 static CMS_EnvelopedData *cms_enveloped_data_init(CMS_ContentInfo *cms)
83 if (cms->d.other == NULL) {
84 cms->d.envelopedData = M_ASN1_new_of(CMS_EnvelopedData);
85 if (cms->d.envelopedData == NULL) {
86 ERR_raise(ERR_LIB_CMS, ERR_R_ASN1_LIB);
89 cms->d.envelopedData->version = 0;
90 cms->d.envelopedData->encryptedContentInfo->contentType =
91 OBJ_nid2obj(NID_pkcs7_data);
92 ASN1_OBJECT_free(cms->contentType);
93 cms->contentType = OBJ_nid2obj(NID_pkcs7_enveloped);
94 return cms->d.envelopedData;
96 return ossl_cms_get0_enveloped(cms);
99 static CMS_AuthEnvelopedData *
100 cms_auth_enveloped_data_init(CMS_ContentInfo *cms)
102 if (cms->d.other == NULL) {
103 cms->d.authEnvelopedData = M_ASN1_new_of(CMS_AuthEnvelopedData);
104 if (cms->d.authEnvelopedData == NULL) {
105 ERR_raise(ERR_LIB_CMS, ERR_R_ASN1_LIB);
108 /* Defined in RFC 5083 - Section 2.1. "AuthEnvelopedData Type" */
109 cms->d.authEnvelopedData->version = 0;
110 cms->d.authEnvelopedData->authEncryptedContentInfo->contentType =
111 OBJ_nid2obj(NID_pkcs7_data);
112 ASN1_OBJECT_free(cms->contentType);
113 cms->contentType = OBJ_nid2obj(NID_id_smime_ct_authEnvelopedData);
114 return cms->d.authEnvelopedData;
116 return ossl_cms_get0_auth_enveloped(cms);
119 int ossl_cms_env_asn1_ctrl(CMS_RecipientInfo *ri, int cmd)
123 if (ri->type == CMS_RECIPINFO_TRANS)
124 pkey = ri->d.ktri->pkey;
125 else if (ri->type == CMS_RECIPINFO_AGREE) {
126 EVP_PKEY_CTX *pctx = ri->d.kari->pctx;
130 pkey = EVP_PKEY_CTX_get0_pkey(pctx);
136 if (EVP_PKEY_is_a(pkey, "DHX") || EVP_PKEY_is_a(pkey, "DH"))
137 return ossl_cms_dh_envelope(ri, cmd);
138 else if (EVP_PKEY_is_a(pkey, "EC"))
139 return ossl_cms_ecdh_envelope(ri, cmd);
140 else if (EVP_PKEY_is_a(pkey, "RSA"))
141 return ossl_cms_rsa_envelope(ri, cmd);
143 /* Something else? We'll give engines etc a chance to handle this */
144 if (pkey->ameth == NULL || pkey->ameth->pkey_ctrl == NULL)
146 i = pkey->ameth->pkey_ctrl(pkey, ASN1_PKEY_CTRL_CMS_ENVELOPE, cmd, ri);
148 ERR_raise(ERR_LIB_CMS, CMS_R_NOT_SUPPORTED_FOR_THIS_KEY_TYPE);
152 ERR_raise(ERR_LIB_CMS, CMS_R_CTRL_FAILURE);
158 CMS_EncryptedContentInfo *ossl_cms_get0_env_enc_content(const CMS_ContentInfo *cms)
160 switch (cms_get_enveloped_type(cms)) {
161 case CMS_ENVELOPED_STANDARD:
162 return cms->d.envelopedData == NULL ? NULL
163 : cms->d.envelopedData->encryptedContentInfo;
165 case CMS_ENVELOPED_AUTH:
166 return cms->d.authEnvelopedData == NULL ? NULL
167 : cms->d.authEnvelopedData->authEncryptedContentInfo;
174 STACK_OF(CMS_RecipientInfo) *CMS_get0_RecipientInfos(CMS_ContentInfo *cms)
176 switch (cms_get_enveloped_type(cms)) {
177 case CMS_ENVELOPED_STANDARD:
178 return cms->d.envelopedData->recipientInfos;
180 case CMS_ENVELOPED_AUTH:
181 return cms->d.authEnvelopedData->recipientInfos;
188 void ossl_cms_RecipientInfos_set_cmsctx(CMS_ContentInfo *cms)
191 CMS_RecipientInfo *ri;
192 const CMS_CTX *ctx = ossl_cms_get0_cmsctx(cms);
193 STACK_OF(CMS_RecipientInfo) *rinfos = CMS_get0_RecipientInfos(cms);
195 for (i = 0; i < sk_CMS_RecipientInfo_num(rinfos); i++) {
196 ri = sk_CMS_RecipientInfo_value(rinfos, i);
199 case CMS_RECIPINFO_AGREE:
200 ri->d.kari->cms_ctx = ctx;
202 case CMS_RECIPINFO_TRANS:
203 ri->d.ktri->cms_ctx = ctx;
204 ossl_x509_set0_libctx(ri->d.ktri->recip,
205 ossl_cms_ctx_get0_libctx(ctx),
206 ossl_cms_ctx_get0_propq(ctx));
208 case CMS_RECIPINFO_KEK:
209 ri->d.kekri->cms_ctx = ctx;
211 case CMS_RECIPINFO_PASS:
212 ri->d.pwri->cms_ctx = ctx;
221 int CMS_RecipientInfo_type(CMS_RecipientInfo *ri)
226 EVP_PKEY_CTX *CMS_RecipientInfo_get0_pkey_ctx(CMS_RecipientInfo *ri)
228 if (ri->type == CMS_RECIPINFO_TRANS)
229 return ri->d.ktri->pctx;
230 else if (ri->type == CMS_RECIPINFO_AGREE)
231 return ri->d.kari->pctx;
235 CMS_ContentInfo *CMS_EnvelopedData_create_ex(const EVP_CIPHER *cipher,
236 OSSL_LIB_CTX *libctx,
239 CMS_ContentInfo *cms;
240 CMS_EnvelopedData *env;
242 cms = CMS_ContentInfo_new_ex(libctx, propq);
245 env = cms_enveloped_data_init(cms);
249 if (!ossl_cms_EncryptedContent_init(env->encryptedContentInfo, cipher, NULL,
250 0, ossl_cms_get0_cmsctx(cms)))
254 CMS_ContentInfo_free(cms);
255 ERR_raise(ERR_LIB_CMS, ERR_R_CMS_LIB);
259 CMS_ContentInfo *CMS_EnvelopedData_create(const EVP_CIPHER *cipher)
261 return CMS_EnvelopedData_create_ex(cipher, NULL, NULL);
264 BIO *CMS_EnvelopedData_decrypt(CMS_EnvelopedData *env, BIO *detached_data,
265 EVP_PKEY *pkey, X509 *cert,
266 ASN1_OCTET_STRING *secret, unsigned int flags,
267 OSSL_LIB_CTX *libctx, const char *propq)
274 ERR_raise(ERR_LIB_CMS, ERR_R_PASSED_NULL_PARAMETER);
278 if ((ci = CMS_ContentInfo_new_ex(libctx, propq)) == NULL
279 || (bio = BIO_new(BIO_s_mem())) == NULL)
281 ci->contentType = OBJ_nid2obj(NID_pkcs7_enveloped);
282 ci->d.envelopedData = env;
284 && CMS_decrypt_set1_password(ci, (unsigned char *)
285 ASN1_STRING_get0_data(secret),
286 ASN1_STRING_length(secret)) != 1)
288 res = CMS_decrypt(ci, secret == NULL ? pkey : NULL,
289 secret == NULL ? cert : NULL, detached_data, bio, flags);
293 ci->d.envelopedData = NULL; /* do not indirectly free |env| */
294 CMS_ContentInfo_free(ci);
303 CMS_AuthEnvelopedData_create_ex(const EVP_CIPHER *cipher, OSSL_LIB_CTX *libctx,
306 CMS_ContentInfo *cms;
307 CMS_AuthEnvelopedData *aenv;
309 cms = CMS_ContentInfo_new_ex(libctx, propq);
312 aenv = cms_auth_enveloped_data_init(cms);
315 if (!ossl_cms_EncryptedContent_init(aenv->authEncryptedContentInfo,
317 ossl_cms_get0_cmsctx(cms)))
321 CMS_ContentInfo_free(cms);
322 ERR_raise(ERR_LIB_CMS, ERR_R_CMS_LIB);
327 CMS_ContentInfo *CMS_AuthEnvelopedData_create(const EVP_CIPHER *cipher)
329 return CMS_AuthEnvelopedData_create_ex(cipher, NULL, NULL);
332 /* Key Transport Recipient Info (KTRI) routines */
334 /* Initialise a ktri based on passed certificate and key */
336 static int cms_RecipientInfo_ktri_init(CMS_RecipientInfo *ri, X509 *recip,
337 EVP_PKEY *pk, unsigned int flags,
340 CMS_KeyTransRecipientInfo *ktri;
343 ri->d.ktri = M_ASN1_new_of(CMS_KeyTransRecipientInfo);
346 ri->type = CMS_RECIPINFO_TRANS;
351 if (flags & CMS_USE_KEYID) {
353 idtype = CMS_RECIPINFO_KEYIDENTIFIER;
356 idtype = CMS_RECIPINFO_ISSUER_SERIAL;
360 * Not a typo: RecipientIdentifier and SignerIdentifier are the same
364 if (!ossl_cms_set1_SignerIdentifier(ktri->rid, recip, idtype, ctx))
373 if (flags & CMS_KEY_PARAM) {
374 ktri->pctx = EVP_PKEY_CTX_new_from_pkey(ossl_cms_ctx_get0_libctx(ctx),
376 ossl_cms_ctx_get0_propq(ctx));
377 if (ktri->pctx == NULL)
379 if (EVP_PKEY_encrypt_init(ktri->pctx) <= 0)
381 } else if (!ossl_cms_env_asn1_ctrl(ri, 0))
387 * Add a recipient certificate using appropriate type of RecipientInfo
390 CMS_RecipientInfo *CMS_add1_recipient(CMS_ContentInfo *cms, X509 *recip,
391 EVP_PKEY *originatorPrivKey,
392 X509 *originator, unsigned int flags)
394 CMS_RecipientInfo *ri = NULL;
395 STACK_OF(CMS_RecipientInfo) *ris;
397 const CMS_CTX *ctx = ossl_cms_get0_cmsctx(cms);
399 ris = CMS_get0_RecipientInfos(cms);
403 /* Initialize recipient info */
404 ri = M_ASN1_new_of(CMS_RecipientInfo);
406 ERR_raise(ERR_LIB_CMS, ERR_R_ASN1_LIB);
410 pk = X509_get0_pubkey(recip);
412 ERR_raise(ERR_LIB_CMS, CMS_R_ERROR_GETTING_PUBLIC_KEY);
416 switch (ossl_cms_pkey_get_ri_type(pk)) {
418 case CMS_RECIPINFO_TRANS:
419 if (!cms_RecipientInfo_ktri_init(ri, recip, pk, flags, ctx))
423 case CMS_RECIPINFO_AGREE:
424 if (!ossl_cms_RecipientInfo_kari_init(ri, recip, pk, originator,
425 originatorPrivKey, flags, ctx))
430 ERR_raise(ERR_LIB_CMS, CMS_R_NOT_SUPPORTED_FOR_THIS_KEY_TYPE);
435 if (!sk_CMS_RecipientInfo_push(ris, ri)) {
436 ERR_raise(ERR_LIB_CMS, ERR_R_CRYPTO_LIB);
443 M_ASN1_free_of(ri, CMS_RecipientInfo);
448 CMS_RecipientInfo *CMS_add1_recipient_cert(CMS_ContentInfo *cms, X509 *recip,
451 return CMS_add1_recipient(cms, recip, NULL, NULL, flags);
454 int CMS_RecipientInfo_ktri_get0_algs(CMS_RecipientInfo *ri,
455 EVP_PKEY **pk, X509 **recip,
458 CMS_KeyTransRecipientInfo *ktri;
459 if (ri->type != CMS_RECIPINFO_TRANS) {
460 ERR_raise(ERR_LIB_CMS, CMS_R_NOT_KEY_TRANSPORT);
469 *recip = ktri->recip;
471 *palg = ktri->keyEncryptionAlgorithm;
475 int CMS_RecipientInfo_ktri_get0_signer_id(CMS_RecipientInfo *ri,
476 ASN1_OCTET_STRING **keyid,
480 CMS_KeyTransRecipientInfo *ktri;
481 if (ri->type != CMS_RECIPINFO_TRANS) {
482 ERR_raise(ERR_LIB_CMS, CMS_R_NOT_KEY_TRANSPORT);
487 return ossl_cms_SignerIdentifier_get0_signer_id(ktri->rid, keyid, issuer,
491 int CMS_RecipientInfo_ktri_cert_cmp(CMS_RecipientInfo *ri, X509 *cert)
493 if (ri->type != CMS_RECIPINFO_TRANS) {
494 ERR_raise(ERR_LIB_CMS, CMS_R_NOT_KEY_TRANSPORT);
497 return ossl_cms_SignerIdentifier_cert_cmp(ri->d.ktri->rid, cert);
500 int CMS_RecipientInfo_set0_pkey(CMS_RecipientInfo *ri, EVP_PKEY *pkey)
502 if (ri->type != CMS_RECIPINFO_TRANS) {
503 ERR_raise(ERR_LIB_CMS, CMS_R_NOT_KEY_TRANSPORT);
506 EVP_PKEY_free(ri->d.ktri->pkey);
507 ri->d.ktri->pkey = pkey;
511 /* Encrypt content key in key transport recipient info */
513 static int cms_RecipientInfo_ktri_encrypt(const CMS_ContentInfo *cms,
514 CMS_RecipientInfo *ri)
516 CMS_KeyTransRecipientInfo *ktri;
517 CMS_EncryptedContentInfo *ec;
519 unsigned char *ek = NULL;
521 const CMS_CTX *ctx = ossl_cms_get0_cmsctx(cms);
525 if (ri->type != CMS_RECIPINFO_TRANS) {
526 ERR_raise(ERR_LIB_CMS, CMS_R_NOT_KEY_TRANSPORT);
530 ec = ossl_cms_get0_env_enc_content(cms);
535 if (!ossl_cms_env_asn1_ctrl(ri, 0))
538 pctx = EVP_PKEY_CTX_new_from_pkey(ossl_cms_ctx_get0_libctx(ctx),
540 ossl_cms_ctx_get0_propq(ctx));
544 if (EVP_PKEY_encrypt_init(pctx) <= 0)
548 if (EVP_PKEY_encrypt(pctx, NULL, &eklen, ec->key, ec->keylen) <= 0)
551 ek = OPENSSL_malloc(eklen);
555 if (EVP_PKEY_encrypt(pctx, ek, &eklen, ec->key, ec->keylen) <= 0)
558 ASN1_STRING_set0(ktri->encryptedKey, ek, eklen);
564 EVP_PKEY_CTX_free(pctx);
570 /* Decrypt content key from KTRI */
572 static int cms_RecipientInfo_ktri_decrypt(CMS_ContentInfo *cms,
573 CMS_RecipientInfo *ri)
575 CMS_KeyTransRecipientInfo *ktri = ri->d.ktri;
576 EVP_PKEY *pkey = ktri->pkey;
577 unsigned char *ek = NULL;
581 const EVP_CIPHER *cipher = NULL;
582 EVP_CIPHER *fetched_cipher = NULL;
583 CMS_EncryptedContentInfo *ec;
584 const CMS_CTX *ctx = ossl_cms_get0_cmsctx(cms);
585 OSSL_LIB_CTX *libctx = ossl_cms_ctx_get0_libctx(ctx);
586 const char *propq = ossl_cms_ctx_get0_propq(ctx);
588 ec = ossl_cms_get0_env_enc_content(cms);
590 if (ktri->pkey == NULL) {
591 ERR_raise(ERR_LIB_CMS, CMS_R_NO_PRIVATE_KEY);
595 if (cms->d.envelopedData->encryptedContentInfo->havenocert
596 && !cms->d.envelopedData->encryptedContentInfo->debug) {
597 X509_ALGOR *calg = ec->contentEncryptionAlgorithm;
598 char name[OSSL_MAX_NAME_SIZE];
600 OBJ_obj2txt(name, sizeof(name), calg->algorithm, 0);
602 (void)ERR_set_mark();
603 fetched_cipher = EVP_CIPHER_fetch(libctx, name, propq);
605 if (fetched_cipher != NULL)
606 cipher = fetched_cipher;
608 cipher = EVP_get_cipherbyobj(calg->algorithm);
609 if (cipher == NULL) {
610 (void)ERR_clear_last_mark();
611 ERR_raise(ERR_LIB_CMS, CMS_R_UNKNOWN_CIPHER);
614 (void)ERR_pop_to_mark();
616 fixlen = EVP_CIPHER_get_key_length(cipher);
617 EVP_CIPHER_free(fetched_cipher);
620 ktri->pctx = EVP_PKEY_CTX_new_from_pkey(libctx, pkey, propq);
621 if (ktri->pctx == NULL)
624 if (EVP_PKEY_decrypt_init(ktri->pctx) <= 0)
627 if (!ossl_cms_env_asn1_ctrl(ri, 1))
630 if (EVP_PKEY_is_a(pkey, "RSA"))
631 /* upper layer CMS code incorrectly assumes that a successful RSA
632 * decryption means that the key matches ciphertext (which never
633 * was the case, implicit rejection or not), so to make it work
634 * disable implicit rejection for RSA keys */
635 EVP_PKEY_CTX_ctrl_str(ktri->pctx, "rsa_pkcs1_implicit_rejection", "0");
637 if (evp_pkey_decrypt_alloc(ktri->pctx, &ek, &eklen, fixlen,
638 ktri->encryptedKey->data,
639 ktri->encryptedKey->length) <= 0)
644 OPENSSL_clear_free(ec->key, ec->keylen);
649 EVP_PKEY_CTX_free(ktri->pctx);
657 /* Key Encrypted Key (KEK) RecipientInfo routines */
659 int CMS_RecipientInfo_kekri_id_cmp(CMS_RecipientInfo *ri,
660 const unsigned char *id, size_t idlen)
662 ASN1_OCTET_STRING tmp_os;
663 CMS_KEKRecipientInfo *kekri;
664 if (ri->type != CMS_RECIPINFO_KEK) {
665 ERR_raise(ERR_LIB_CMS, CMS_R_NOT_KEK);
669 tmp_os.type = V_ASN1_OCTET_STRING;
671 tmp_os.data = (unsigned char *)id;
672 tmp_os.length = (int)idlen;
673 return ASN1_OCTET_STRING_cmp(&tmp_os, kekri->kekid->keyIdentifier);
676 /* For now hard code AES key wrap info */
678 static size_t aes_wrap_keylen(int nid)
681 case NID_id_aes128_wrap:
684 case NID_id_aes192_wrap:
687 case NID_id_aes256_wrap:
695 CMS_RecipientInfo *CMS_add0_recipient_key(CMS_ContentInfo *cms, int nid,
696 unsigned char *key, size_t keylen,
697 unsigned char *id, size_t idlen,
698 ASN1_GENERALIZEDTIME *date,
699 ASN1_OBJECT *otherTypeId,
700 ASN1_TYPE *otherType)
702 CMS_RecipientInfo *ri = NULL;
703 CMS_KEKRecipientInfo *kekri;
704 STACK_OF(CMS_RecipientInfo) *ris = CMS_get0_RecipientInfos(cms);
709 if (nid == NID_undef) {
712 nid = NID_id_aes128_wrap;
716 nid = NID_id_aes192_wrap;
720 nid = NID_id_aes256_wrap;
724 ERR_raise(ERR_LIB_CMS, CMS_R_INVALID_KEY_LENGTH);
730 size_t exp_keylen = aes_wrap_keylen(nid);
733 ERR_raise(ERR_LIB_CMS, CMS_R_UNSUPPORTED_KEK_ALGORITHM);
737 if (keylen != exp_keylen) {
738 ERR_raise(ERR_LIB_CMS, CMS_R_INVALID_KEY_LENGTH);
744 /* Initialize recipient info */
745 ri = M_ASN1_new_of(CMS_RecipientInfo);
747 ERR_raise(ERR_LIB_CMS, ERR_R_ASN1_LIB);
751 ri->d.kekri = M_ASN1_new_of(CMS_KEKRecipientInfo);
753 ERR_raise(ERR_LIB_CMS, ERR_R_ASN1_LIB);
756 ri->type = CMS_RECIPINFO_KEK;
761 kekri->kekid->other = M_ASN1_new_of(CMS_OtherKeyAttribute);
762 if (kekri->kekid->other == NULL) {
763 ERR_raise(ERR_LIB_CMS, ERR_R_ASN1_LIB);
768 if (!sk_CMS_RecipientInfo_push(ris, ri)) {
769 ERR_raise(ERR_LIB_CMS, ERR_R_CRYPTO_LIB);
773 /* After this point no calls can fail */
778 kekri->keylen = keylen;
780 ASN1_STRING_set0(kekri->kekid->keyIdentifier, id, idlen);
782 kekri->kekid->date = date;
784 if (kekri->kekid->other) {
785 kekri->kekid->other->keyAttrId = otherTypeId;
786 kekri->kekid->other->keyAttr = otherType;
789 (void)X509_ALGOR_set0(kekri->keyEncryptionAlgorithm, OBJ_nid2obj(nid),
790 V_ASN1_UNDEF, NULL); /* cannot fail */
795 M_ASN1_free_of(ri, CMS_RecipientInfo);
799 int CMS_RecipientInfo_kekri_get0_id(CMS_RecipientInfo *ri,
801 ASN1_OCTET_STRING **pid,
802 ASN1_GENERALIZEDTIME **pdate,
803 ASN1_OBJECT **potherid,
804 ASN1_TYPE **pothertype)
806 CMS_KEKIdentifier *rkid;
807 if (ri->type != CMS_RECIPINFO_KEK) {
808 ERR_raise(ERR_LIB_CMS, CMS_R_NOT_KEK);
811 rkid = ri->d.kekri->kekid;
813 *palg = ri->d.kekri->keyEncryptionAlgorithm;
815 *pid = rkid->keyIdentifier;
820 *potherid = rkid->other->keyAttrId;
826 *pothertype = rkid->other->keyAttr;
833 int CMS_RecipientInfo_set0_key(CMS_RecipientInfo *ri,
834 unsigned char *key, size_t keylen)
836 CMS_KEKRecipientInfo *kekri;
837 if (ri->type != CMS_RECIPINFO_KEK) {
838 ERR_raise(ERR_LIB_CMS, CMS_R_NOT_KEK);
844 kekri->keylen = keylen;
848 static EVP_CIPHER *cms_get_key_wrap_cipher(size_t keylen, const CMS_CTX *ctx)
850 const char *alg = NULL;
854 alg = "AES-128-WRAP";
857 alg = "AES-192-WRAP";
860 alg = "AES-256-WRAP";
865 return EVP_CIPHER_fetch(ossl_cms_ctx_get0_libctx(ctx), alg,
866 ossl_cms_ctx_get0_propq(ctx));
870 /* Encrypt content key in KEK recipient info */
872 static int cms_RecipientInfo_kekri_encrypt(const CMS_ContentInfo *cms,
873 CMS_RecipientInfo *ri)
875 CMS_EncryptedContentInfo *ec;
876 CMS_KEKRecipientInfo *kekri;
877 unsigned char *wkey = NULL;
880 EVP_CIPHER *cipher = NULL;
882 EVP_CIPHER_CTX *ctx = NULL;
883 const CMS_CTX *cms_ctx = ossl_cms_get0_cmsctx(cms);
885 ec = ossl_cms_get0_env_enc_content(cms);
891 if (kekri->key == NULL) {
892 ERR_raise(ERR_LIB_CMS, CMS_R_NO_KEY);
896 cipher = cms_get_key_wrap_cipher(kekri->keylen, cms_ctx);
897 if (cipher == NULL) {
898 ERR_raise(ERR_LIB_CMS, CMS_R_INVALID_KEY_LENGTH);
902 /* 8 byte prefix for AES wrap ciphers */
903 wkey = OPENSSL_malloc(ec->keylen + 8);
907 ctx = EVP_CIPHER_CTX_new();
909 ERR_raise(ERR_LIB_CMS, ERR_R_EVP_LIB);
913 EVP_CIPHER_CTX_set_flags(ctx, EVP_CIPHER_CTX_FLAG_WRAP_ALLOW);
914 if (!EVP_EncryptInit_ex(ctx, cipher, NULL, kekri->key, NULL)
915 || !EVP_EncryptUpdate(ctx, wkey, &wkeylen, ec->key, ec->keylen)
916 || !EVP_EncryptFinal_ex(ctx, wkey + wkeylen, &outlen)) {
917 ERR_raise(ERR_LIB_CMS, CMS_R_WRAP_ERROR);
921 if (!ossl_assert((size_t)wkeylen == ec->keylen + 8)) {
922 ERR_raise(ERR_LIB_CMS, CMS_R_WRAP_ERROR);
926 ASN1_STRING_set0(kekri->encryptedKey, wkey, wkeylen);
931 EVP_CIPHER_free(cipher);
934 EVP_CIPHER_CTX_free(ctx);
939 /* Decrypt content key in KEK recipient info */
941 static int cms_RecipientInfo_kekri_decrypt(CMS_ContentInfo *cms,
942 CMS_RecipientInfo *ri)
944 CMS_EncryptedContentInfo *ec;
945 CMS_KEKRecipientInfo *kekri;
946 unsigned char *ukey = NULL;
949 EVP_CIPHER *cipher = NULL;
951 EVP_CIPHER_CTX *ctx = NULL;
952 const CMS_CTX *cms_ctx = ossl_cms_get0_cmsctx(cms);
954 ec = ossl_cms_get0_env_enc_content(cms);
961 ERR_raise(ERR_LIB_CMS, CMS_R_NO_KEY);
965 wrap_nid = OBJ_obj2nid(kekri->keyEncryptionAlgorithm->algorithm);
966 if (aes_wrap_keylen(wrap_nid) != kekri->keylen) {
967 ERR_raise(ERR_LIB_CMS, CMS_R_INVALID_KEY_LENGTH);
971 /* If encrypted key length is invalid don't bother */
973 if (kekri->encryptedKey->length < 16) {
974 ERR_raise(ERR_LIB_CMS, CMS_R_INVALID_ENCRYPTED_KEY_LENGTH);
978 cipher = cms_get_key_wrap_cipher(kekri->keylen, cms_ctx);
979 if (cipher == NULL) {
980 ERR_raise(ERR_LIB_CMS, CMS_R_INVALID_KEY_LENGTH);
984 ukey = OPENSSL_malloc(kekri->encryptedKey->length - 8);
988 ctx = EVP_CIPHER_CTX_new();
990 ERR_raise(ERR_LIB_CMS, ERR_R_EVP_LIB);
994 if (!EVP_DecryptInit_ex(ctx, cipher, NULL, kekri->key, NULL)
995 || !EVP_DecryptUpdate(ctx, ukey, &ukeylen,
996 kekri->encryptedKey->data,
997 kekri->encryptedKey->length)
998 || !EVP_DecryptFinal_ex(ctx, ukey + ukeylen, &outlen)) {
999 ERR_raise(ERR_LIB_CMS, CMS_R_UNWRAP_ERROR);
1004 OPENSSL_clear_free(ec->key, ec->keylen);
1006 ec->keylen = ukeylen;
1011 EVP_CIPHER_free(cipher);
1014 EVP_CIPHER_CTX_free(ctx);
1019 int CMS_RecipientInfo_decrypt(CMS_ContentInfo *cms, CMS_RecipientInfo *ri)
1022 case CMS_RECIPINFO_TRANS:
1023 return cms_RecipientInfo_ktri_decrypt(cms, ri);
1025 case CMS_RECIPINFO_KEK:
1026 return cms_RecipientInfo_kekri_decrypt(cms, ri);
1028 case CMS_RECIPINFO_PASS:
1029 return ossl_cms_RecipientInfo_pwri_crypt(cms, ri, 0);
1032 ERR_raise(ERR_LIB_CMS, CMS_R_UNSUPPORTED_RECIPIENTINFO_TYPE);
1037 int CMS_RecipientInfo_encrypt(const CMS_ContentInfo *cms, CMS_RecipientInfo *ri)
1040 case CMS_RECIPINFO_TRANS:
1041 return cms_RecipientInfo_ktri_encrypt(cms, ri);
1043 case CMS_RECIPINFO_AGREE:
1044 return ossl_cms_RecipientInfo_kari_encrypt(cms, ri);
1046 case CMS_RECIPINFO_KEK:
1047 return cms_RecipientInfo_kekri_encrypt(cms, ri);
1049 case CMS_RECIPINFO_PASS:
1050 return ossl_cms_RecipientInfo_pwri_crypt(cms, ri, 1);
1053 ERR_raise(ERR_LIB_CMS, CMS_R_UNSUPPORTED_RECIPIENT_TYPE);
1058 /* Check structures and fixup version numbers (if necessary) */
1060 static void cms_env_set_originfo_version(CMS_EnvelopedData *env)
1062 CMS_OriginatorInfo *org = env->originatorInfo;
1066 for (i = 0; i < sk_CMS_CertificateChoices_num(org->certificates); i++) {
1067 CMS_CertificateChoices *cch;
1068 cch = sk_CMS_CertificateChoices_value(org->certificates, i);
1069 if (cch->type == CMS_CERTCHOICE_OTHER) {
1072 } else if (cch->type == CMS_CERTCHOICE_V2ACERT) {
1073 if (env->version < 3)
1078 for (i = 0; i < sk_CMS_RevocationInfoChoice_num(org->crls); i++) {
1079 CMS_RevocationInfoChoice *rch;
1080 rch = sk_CMS_RevocationInfoChoice_value(org->crls, i);
1081 if (rch->type == CMS_REVCHOICE_OTHER) {
1088 static void cms_env_set_version(CMS_EnvelopedData *env)
1091 CMS_RecipientInfo *ri;
1094 * Can't set version higher than 4 so if 4 or more already nothing to do.
1096 if (env->version >= 4)
1099 cms_env_set_originfo_version(env);
1101 if (env->version >= 3)
1104 for (i = 0; i < sk_CMS_RecipientInfo_num(env->recipientInfos); i++) {
1105 ri = sk_CMS_RecipientInfo_value(env->recipientInfos, i);
1106 if (ri->type == CMS_RECIPINFO_PASS || ri->type == CMS_RECIPINFO_OTHER) {
1109 } else if (ri->type != CMS_RECIPINFO_TRANS
1110 || ri->d.ktri->version != 0) {
1114 if (env->originatorInfo || env->unprotectedAttrs)
1116 if (env->version == 2)
1121 static int cms_env_encrypt_content_key(const CMS_ContentInfo *cms,
1122 STACK_OF(CMS_RecipientInfo) *ris)
1125 CMS_RecipientInfo *ri;
1127 for (i = 0; i < sk_CMS_RecipientInfo_num(ris); i++) {
1128 ri = sk_CMS_RecipientInfo_value(ris, i);
1129 if (CMS_RecipientInfo_encrypt(cms, ri) <= 0)
1135 static void cms_env_clear_ec(CMS_EncryptedContentInfo *ec)
1138 OPENSSL_clear_free(ec->key, ec->keylen);
1143 static BIO *cms_EnvelopedData_Decryption_init_bio(CMS_ContentInfo *cms)
1145 CMS_EncryptedContentInfo *ec = cms->d.envelopedData->encryptedContentInfo;
1146 BIO *contentBio = ossl_cms_EncryptedContent_init_bio(ec,
1147 ossl_cms_get0_cmsctx(cms));
1148 EVP_CIPHER_CTX *ctx = NULL;
1150 if (contentBio == NULL)
1153 BIO_get_cipher_ctx(contentBio, &ctx);
1155 BIO_free(contentBio);
1159 * If the selected cipher supports unprotected attributes,
1160 * deal with it using special ctrl function
1162 if ((EVP_CIPHER_get_flags(EVP_CIPHER_CTX_get0_cipher(ctx))
1163 & EVP_CIPH_FLAG_CIPHER_WITH_MAC) != 0
1164 && EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_PROCESS_UNPROTECTED, 0,
1165 cms->d.envelopedData->unprotectedAttrs) <= 0) {
1166 BIO_free(contentBio);
1172 static BIO *cms_EnvelopedData_Encryption_init_bio(CMS_ContentInfo *cms)
1174 CMS_EncryptedContentInfo *ec;
1175 STACK_OF(CMS_RecipientInfo) *rinfos;
1178 CMS_EnvelopedData *env = cms->d.envelopedData;
1180 /* Get BIO first to set up key */
1182 ec = env->encryptedContentInfo;
1183 ret = ossl_cms_EncryptedContent_init_bio(ec, ossl_cms_get0_cmsctx(cms));
1185 /* If error end of processing */
1189 /* Now encrypt content key according to each RecipientInfo type */
1190 rinfos = env->recipientInfos;
1191 if (cms_env_encrypt_content_key(cms, rinfos) < 0) {
1192 ERR_raise(ERR_LIB_CMS, CMS_R_ERROR_SETTING_RECIPIENTINFO);
1196 /* And finally set the version */
1197 cms_env_set_version(env);
1202 cms_env_clear_ec(ec);
1209 BIO *ossl_cms_EnvelopedData_init_bio(CMS_ContentInfo *cms)
1211 if (cms->d.envelopedData->encryptedContentInfo->cipher != NULL) {
1212 /* If cipher is set it's encryption */
1213 return cms_EnvelopedData_Encryption_init_bio(cms);
1216 /* If cipher is not set it's decryption */
1217 return cms_EnvelopedData_Decryption_init_bio(cms);
1220 BIO *ossl_cms_AuthEnvelopedData_init_bio(CMS_ContentInfo *cms)
1222 CMS_EncryptedContentInfo *ec;
1223 STACK_OF(CMS_RecipientInfo) *rinfos;
1226 CMS_AuthEnvelopedData *aenv = cms->d.authEnvelopedData;
1228 /* Get BIO first to set up key */
1229 ec = aenv->authEncryptedContentInfo;
1230 /* Set tag for decryption */
1231 if (ec->cipher == NULL) {
1232 ec->tag = aenv->mac->data;
1233 ec->taglen = aenv->mac->length;
1235 ret = ossl_cms_EncryptedContent_init_bio(ec, ossl_cms_get0_cmsctx(cms));
1237 /* If error or no cipher end of processing */
1238 if (ret == NULL || ec->cipher == NULL)
1241 /* Now encrypt content key according to each RecipientInfo type */
1242 rinfos = aenv->recipientInfos;
1243 if (cms_env_encrypt_content_key(cms, rinfos) < 0) {
1244 ERR_raise(ERR_LIB_CMS, CMS_R_ERROR_SETTING_RECIPIENTINFO);
1248 /* And finally set the version */
1254 cms_env_clear_ec(ec);
1261 int ossl_cms_EnvelopedData_final(CMS_ContentInfo *cms, BIO *chain)
1263 CMS_EnvelopedData *env = NULL;
1264 EVP_CIPHER_CTX *ctx = NULL;
1265 BIO *mbio = BIO_find_type(chain, BIO_TYPE_CIPHER);
1267 env = ossl_cms_get0_enveloped(cms);
1272 ERR_raise(ERR_LIB_CMS, CMS_R_CONTENT_NOT_FOUND);
1276 BIO_get_cipher_ctx(mbio, &ctx);
1279 * If the selected cipher supports unprotected attributes,
1280 * deal with it using special ctrl function
1282 if ((EVP_CIPHER_get_flags(EVP_CIPHER_CTX_get0_cipher(ctx))
1283 & EVP_CIPH_FLAG_CIPHER_WITH_MAC) != 0) {
1284 if (env->unprotectedAttrs == NULL)
1285 env->unprotectedAttrs = sk_X509_ATTRIBUTE_new_null();
1287 if (env->unprotectedAttrs == NULL) {
1288 ERR_raise(ERR_LIB_CMS, ERR_R_CRYPTO_LIB);
1292 if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_PROCESS_UNPROTECTED,
1293 1, env->unprotectedAttrs) <= 0) {
1294 ERR_raise(ERR_LIB_CMS, CMS_R_CTRL_FAILURE);
1299 cms_env_set_version(cms->d.envelopedData);
1303 int ossl_cms_AuthEnvelopedData_final(CMS_ContentInfo *cms, BIO *cmsbio)
1305 EVP_CIPHER_CTX *ctx;
1306 unsigned char *tag = NULL;
1309 BIO_get_cipher_ctx(cmsbio, &ctx);
1312 * The tag is set only for encryption. There is nothing to do for
1315 if (!EVP_CIPHER_CTX_is_encrypting(ctx))
1318 taglen = EVP_CIPHER_CTX_get_tag_length(ctx);
1320 || (tag = OPENSSL_malloc(taglen)) == NULL
1321 || EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, taglen,
1323 ERR_raise(ERR_LIB_CMS, CMS_R_CIPHER_GET_TAG);
1327 if (!ASN1_OCTET_STRING_set(cms->d.authEnvelopedData->mac, tag, taglen))
1337 * Get RecipientInfo type (if any) supported by a key (public or private). To
1338 * retain compatibility with previous behaviour if the ctrl value isn't
1339 * supported we assume key transport.
1341 int ossl_cms_pkey_get_ri_type(EVP_PKEY *pk)
1343 /* Check types that we know about */
1344 if (EVP_PKEY_is_a(pk, "DH"))
1345 return CMS_RECIPINFO_AGREE;
1346 else if (EVP_PKEY_is_a(pk, "DHX"))
1347 return CMS_RECIPINFO_AGREE;
1348 else if (EVP_PKEY_is_a(pk, "DSA"))
1349 return CMS_RECIPINFO_NONE;
1350 else if (EVP_PKEY_is_a(pk, "EC"))
1351 return CMS_RECIPINFO_AGREE;
1352 else if (EVP_PKEY_is_a(pk, "RSA"))
1353 return CMS_RECIPINFO_TRANS;
1356 * Otherwise this might ben an engine implementation, so see if we can get
1357 * the type from the ameth.
1359 if (pk->ameth && pk->ameth->pkey_ctrl) {
1361 i = pk->ameth->pkey_ctrl(pk, ASN1_PKEY_CTRL_CMS_RI_TYPE, 0, &r);
1365 return CMS_RECIPINFO_TRANS;
1368 int ossl_cms_pkey_is_ri_type_supported(EVP_PKEY *pk, int ri_type)
1370 int supportedRiType;
1372 if (pk->ameth != NULL && pk->ameth->pkey_ctrl != NULL) {
1375 i = pk->ameth->pkey_ctrl(pk, ASN1_PKEY_CTRL_CMS_IS_RI_TYPE_SUPPORTED,
1381 supportedRiType = ossl_cms_pkey_get_ri_type(pk);
1382 if (supportedRiType < 0)
1385 return (supportedRiType == ri_type);