engines/ccgost/gost2001_keyx.c

   1 /**********************************************************************
   2  *                          gost_keyx.c                               *
   3  *             Copyright (c) 2005-2006 Cryptocom LTD                  *
   4  *         This file is distributed under the same license as OpenSSL *
   5  *                                                                    *
   6  *   VK0 34.10-2001 key exchange and GOST R 34.10-2001                *
   7  *   based PKCS7/SMIME support                                        *
   8  *          Requires OpenSSL 0.9.9 for compilation                    *
   9  **********************************************************************/
  10 #include <openssl/evp.h>
  11 #include <openssl/rand.h>
  12 #include <string.h>
  13 #include <openssl/objects.h>
  14 #include "gost89.h"
  15 #include "gosthash.h"
  16 #include "gost_asn1.h"
  17 #include "e_gost_err.h"
  18 #include "keywrap.h"
  19 #include "crypt.h"
  20 #include "sign.h"
  21 #include "pmeth.h"
  22 #include "tools.h"
  23 #include "gostkeyx.h"
  24
  25 /* Transform ECDH shared key into little endian as required by Cryptocom
  26  * key exchange */
  27 static void *make_key_le(const void *in, size_t inlen, void *out, size_t *outlen) {
  28         const char* inbuf= in;
  29         char* outbuf= out;
  30         int i;
  31         if (*outlen < inlen) {
  32                         return NULL;
  33         }
  34         for (i=0;i<inlen;i++) {
  35                 outbuf[inlen-1-i]=inbuf[i];
  36         }
  37         *outlen = inlen;
  38         return out;
  39 }
  40
  41 /* Create gost 2001 ephemeral key with same parameters as peer key */
  42 static EC_KEY *make_ec_ephemeral_key(EC_KEY *peer_key,BIGNUM *seckey) {
  43         EC_KEY *out = EC_KEY_new();
  44         EC_KEY_copy(out,peer_key);
  45         EC_KEY_set_private_key(out,seckey);
  46         gost2001_compute_public(out);
  47         return out;
  48 }
  49 /* Packs GOST elliptic curve key into EVP_PKEY setting same parameters
  50  * as in passed pubkey
  51  */
  52 static EVP_PKEY *ec_ephemeral_key_to_EVP(EVP_PKEY *pubk,int type,EC_KEY *ephemeral)
  53 {
  54         EVP_PKEY *newkey;
  55         newkey = EVP_PKEY_new();
  56         EVP_PKEY_assign(newkey,type,ephemeral);
  57         return newkey;
  58 }
  59
  60 /*
  61  * EVP_PKEY_METHOD callback encrypt
  62  * Implementation of GOST2001 key transport, cryptocom variation
  63  */
  64
  65 int pkey_GOST01cc_encrypt (EVP_PKEY_CTX *pctx,unsigned char *out,
  66         size_t *out_len, const unsigned char *key,size_t key_len)
  67 {
  68         EVP_PKEY *pubk = EVP_PKEY_CTX_get0_pkey(pctx);
  69         struct gost_pmeth_data *data = EVP_PKEY_CTX_get_data(pctx);
  70         GOST_KEY_TRANSPORT *gkt = NULL;
  71         int ret=0;
  72         gost_ctx ctx;
  73         EC_KEY *ephemeral=NULL;
  74         const EC_POINT *pub_key_point=NULL;
  75         unsigned char shared_key[32],encrypted_key[32],hmac[4],
  76                                   iv[8]={0,0,0,0,0,0,0,0};
  77         ephemeral = make_ec_ephemeral_key(EVP_PKEY_get0(pubk), gost_get_priv_key(data->eph_seckey));
  78         if (!ephemeral) goto err;
  79         /* compute shared key */
  80         pub_key_point=EC_KEY_get0_public_key(EVP_PKEY_get0(pubk));
  81         if (!ECDH_compute_key(shared_key,32,pub_key_point,ephemeral,make_key_le))
  82         {
  83                 GOSTerr(GOST_F_PKEY_GOST01CC_ENCRYPT,GOST_R_ERROR_COMPUTING_SHARED_KEY);
  84                 goto err;
  85         }
  86         /* encrypt session key */
  87         gost_init(&ctx, &GostR3411_94_CryptoProParamSet);
  88         gost_key(&ctx,shared_key);
  89         encrypt_cryptocom_key(key,key_len,encrypted_key,&ctx);
  90         /* compute hmac of session key */
  91         if (!gost_mac(&ctx,32,key,32,hmac))
  92         {
  93                 GOSTerr(GOST_F_PKEY_GOST01CC_ENCRYPT,GOST_R_ERROR_COMPUTING_MAC);
  94                 return -1;
  95     }
  96         gkt = GOST_KEY_TRANSPORT_new();
  97         if (!gkt)
  98         {
  99                 GOSTerr(GOST_F_PKEY_GOST01CC_ENCRYPT,GOST_R_NO_MEMORY);
 100                 return -1;
 101         }
 102         /* Store IV which is always zero in our case */
 103         if (!ASN1_OCTET_STRING_set(gkt->key_agreement_info->eph_iv,iv,8))
 104         {
 105                 GOSTerr(GOST_F_PKEY_GOST01CC_ENCRYPT,GOST_R_ERROR_STORING_IV);
 106                 goto err;
 107         }
 108         if (!ASN1_OCTET_STRING_set(gkt->key_info->imit,hmac,4))
 109         {
 110                 GOSTerr(GOST_F_PKEY_GOST01CC_ENCRYPT,GOST_R_ERROR_STORING_MAC);
 111                 goto err;
 112         }
 113         if (!ASN1_OCTET_STRING_set(gkt->key_info->encrypted_key,encrypted_key,32))
 114         {
 115                 GOSTerr(GOST_F_PKEY_GOST01CC_ENCRYPT,GOST_R_ERROR_STORING_ENCRYPTED_KEY);
 116                 goto err;
 117         }
 118
 119         if (!X509_PUBKEY_set(&gkt->key_agreement_info->ephem_key,data->eph_seckey)) {
 120                 GOSTerr(GOST_F_PKEY_GOST01CC_ENCRYPT,GOST_R_CANNOT_PACK_EPHEMERAL_KEY);
 121                 goto err;
 122         }
 123         ASN1_OBJECT_free(gkt->key_agreement_info->cipher);
 124         gkt->key_agreement_info->cipher = OBJ_nid2obj(NID_id_Gost28147_89_cc);
 125         if ((*out_len = i2d_GOST_KEY_TRANSPORT(gkt,&out))>0) ret = 1;
 126         ;
 127 err:
 128         if (gkt) GOST_KEY_TRANSPORT_free(gkt);
 129         return ret;
 130 }
 131 /*
 132  * EVP_PKEY_METHOD callback decrypt
 133  * Implementation of GOST2001 key transport, cryptocom variation
 134  */
 135 int pkey_GOST01cc_decrypt (EVP_PKEY_CTX *pctx, unsigned char *key, size_t *key_len, const unsigned char *in, size_t in_len) {
 136         /* Form DH params from compute shared key */
 137         EVP_PKEY *priv=EVP_PKEY_CTX_get0_pkey(pctx);
 138         GOST_KEY_TRANSPORT *gkt = NULL;
 139         const unsigned char *p=in;
 140         unsigned char shared_key[32];
 141         unsigned char hmac[4],hmac_comp[4];
 142         unsigned char iv[8];
 143         int i;
 144         gost_ctx ctx;
 145         const EC_POINT *pub_key_point;
 146         EVP_PKEY *eph_key;
 147
 148         if (!key) {
 149                 *key_len = 32;
 150                 return 1;
 151         }
 152         /* Parse passed octet string and find out public key, iv and HMAC*/
 153         gkt = d2i_GOST_KEY_TRANSPORT(NULL,(const unsigned char **)&p,
 154                         in_len);
 155         if (!gkt) {
 156                 GOSTerr(GOST_F_PKEY_GOST01CC_DECRYPT,GOST_R_ERROR_PARSING_KEY_TRANSPORT_INFO);
 157                 return 0;
 158         }
 159         eph_key = X509_PUBKEY_get(gkt->key_agreement_info->ephem_key);
 160         /* Initialization vector is really ignored here */
 161         OPENSSL_assert(gkt->key_agreement_info->eph_iv->length==8);
 162         memcpy(iv,gkt->key_agreement_info->eph_iv->data,8);
 163         /* HMAC should be computed and checked */
 164         OPENSSL_assert(gkt->key_info->imit->length==4);
 165         memcpy(hmac,gkt->key_info->imit->data,4);
 166         /* Compute shared key */
 167         pub_key_point=EC_KEY_get0_public_key(EVP_PKEY_get0(eph_key));
 168         i=ECDH_compute_key(shared_key,32,pub_key_point,EVP_PKEY_get0(priv),make_key_le);
 169         EVP_PKEY_free(eph_key);
 170         if (!i)
 171         {
 172                 GOSTerr(GOST_F_PKEY_GOST01CC_DECRYPT,GOST_R_ERROR_COMPUTING_SHARED_KEY);
 173                 GOST_KEY_TRANSPORT_free(gkt);
 174                 return 0;
 175         }
 176         /* Decrypt session key */
 177         gost_init(&ctx, &GostR3411_94_CryptoProParamSet);
 178         gost_key(&ctx,shared_key);
 179
 180         if (!decrypt_cryptocom_key(key,*key_len,gkt->key_info->encrypted_key->data,
 181                         gkt->key_info->encrypted_key->length, &ctx))
 182         {
 183                 GOST_KEY_TRANSPORT_free(gkt);
 184                 return 0;
 185         }
 186         GOST_KEY_TRANSPORT_free(gkt);
 187         /* check HMAC of session key*/
 188         if (!gost_mac(&ctx,32,key,32,hmac_comp)) {
 189                 GOSTerr(GOST_F_PKEY_GOST01CC_DECRYPT,GOST_R_ERROR_COMPUTING_MAC);
 190                 return 0;
 191     }
 192                 /* HMAC of session key is not correct */
 193     if (memcmp(hmac,hmac_comp,4)!=0) {
 194                 GOSTerr(GOST_F_PKEY_GOST01CC_DECRYPT,GOST_R_SESSION_KEY_MAC_DOES_NOT_MATCH);
 195                 return 0;
 196         }
 197         return 1;
 198 }
 199
 200 /* Implementation of CryptoPro VKO 34.10-2001 algorithm */
 201 static int VKO_compute_key(unsigned char *shared_key,size_t shared_key_size,const EC_POINT *pub_key,EC_KEY *priv_key,const unsigned char *ukm) {
 202         unsigned char ukm_be[8],databuf[64],hashbuf[64];
 203         BIGNUM *UKM=NULL,*p=NULL,*order=NULL,*X=NULL,*Y=NULL;
 204         const BIGNUM* key=EC_KEY_get0_private_key(priv_key);
 205         EC_POINT *pnt=EC_POINT_new(EC_KEY_get0_group(priv_key));
 206         int i;
 207         gost_hash_ctx hash_ctx;
 208         BN_CTX *ctx = BN_CTX_new();
 209
 210         for (i=0;i<8;i++) {
 211                 ukm_be[7-i]=ukm[i];
 212         }
 213         BN_CTX_start(ctx);
 214         UKM=getbnfrombuf(ukm_be,8);
 215         p=BN_CTX_get(ctx);
 216         order = BN_CTX_get(ctx);
 217         X=BN_CTX_get(ctx);
 218         Y=BN_CTX_get(ctx);
 219         EC_GROUP_get_order(EC_KEY_get0_group(priv_key),order,ctx);
 220         BN_mod_mul(p,key,UKM,order,ctx);
 221         EC_POINT_mul(EC_KEY_get0_group(priv_key),pnt,NULL,pub_key,p,ctx);
 222         EC_POINT_get_affine_coordinates_GFp(EC_KEY_get0_group(priv_key),
 223                         pnt,X,Y,ctx);
 224         /*Serialize elliptic curve point same way as we do it when saving
 225          * key */
 226         store_bignum(Y,databuf,32);
 227         store_bignum(X,databuf+32,32);
 228         /* And reverse byte order of whole buffer */
 229         for (i=0;i<64;i++) {
 230                 hashbuf[63-i]=databuf[i];
 231         }
 232         init_gost_hash_ctx(&hash_ctx,&GostR3411_94_CryptoProParamSet);
 233         start_hash(&hash_ctx);
 234         hash_block(&hash_ctx,hashbuf,64);
 235         finish_hash(&hash_ctx,shared_key);
 236         done_gost_hash_ctx(&hash_ctx);
 237         BN_free(UKM);
 238         BN_CTX_end(ctx);
 239         BN_CTX_free(ctx);
 240         EC_POINT_free(pnt);
 241         return 32;
 242 }
 243
 244 /* Generates ephemeral key based on pubk algorithm
 245  * computes shared key using VKO and returns filled up
 246  * GOST_KEY_TRANSPORT structure
 247  */
 248 /* Public, because it would be needed in SSL implementation */
 249 GOST_KEY_TRANSPORT *make_rfc4490_keytransport_2001(EVP_PKEY *pubk,BIGNUM *eph_key,
 250                 const unsigned char *key,size_t keylen, unsigned char *ukm,
 251                 size_t ukm_len)
 252 {
 253
 254         const struct gost_cipher_info *param=get_encryption_params(NULL);
 255         EC_KEY *ephemeral = NULL;
 256         GOST_KEY_TRANSPORT *gkt=NULL;
 257         const EC_POINT *pub_key_point = EC_KEY_get0_public_key(EVP_PKEY_get0(pubk));
 258         unsigned char shared_key[32],crypted_key[44];
 259         gost_ctx ctx;
 260         EVP_PKEY *newkey=NULL;
 261
 262         /* Do not use vizir cipher parameters with cryptopro */
 263         if (!getenv("CRYPT_PARAMS") && param ==  gost_cipher_list) {
 264                 param= gost_cipher_list+1;
 265         }
 266         ephemeral = make_ec_ephemeral_key(EVP_PKEY_get0(pubk),eph_key);
 267     VKO_compute_key(shared_key,32,pub_key_point,ephemeral,ukm);
 268         gost_init(&ctx,param->sblock);
 269         keyWrapCryptoPro(&ctx,shared_key,ukm,key,crypted_key);
 270         gkt = GOST_KEY_TRANSPORT_new();
 271         if (!gkt) {
 272                 goto memerr;
 273         }
 274         if(!ASN1_OCTET_STRING_set(gkt->key_agreement_info->eph_iv,
 275                                                 ukm,8)) {
 276                 goto memerr;
 277         }
 278         if (!ASN1_OCTET_STRING_set(gkt->key_info->imit,crypted_key+40,4)) {
 279                 goto memerr;
 280         }
 281         if (!ASN1_OCTET_STRING_set(gkt->key_info->encrypted_key,crypted_key+8,32)) {
 282                 goto memerr;
 283         }
 284         newkey = ec_ephemeral_key_to_EVP(pubk,NID_id_GostR3410_2001,ephemeral);
 285         if (!X509_PUBKEY_set(&gkt->key_agreement_info->ephem_key,newkey)) {
 286                 GOSTerr(GOST_F_MAKE_RFC4490_KEYTRANSPORT_2001,GOST_R_CANNOT_PACK_EPHEMERAL_KEY);
 287                 goto err;
 288         }
 289         ASN1_OBJECT_free(gkt->key_agreement_info->cipher);
 290         gkt->key_agreement_info->cipher = OBJ_nid2obj(param->nid);
 291         EVP_PKEY_free(newkey);
 292         return gkt;
 293 memerr:
 294                 GOSTerr(GOST_F_MAKE_RFC4490_KEYTRANSPORT_2001,
 295                                 GOST_R_MALLOC_FAILURE);
 296 err:
 297                 GOST_KEY_TRANSPORT_free(gkt);
 298                 return NULL;
 299 }
 300
 301 /*
 302  * EVP_PKEY_METHOD callback encrypt
 303  * Implementation of GOST2001 key transport, cryptopo variation
 304  */
 305
 306 int pkey_GOST01cp_encrypt (EVP_PKEY_CTX *pctx, unsigned char *out, size_t *out_len, const unsigned char *key,size_t key_len)
 307 {
 308         GOST_KEY_TRANSPORT *gkt=NULL;
 309         EVP_PKEY *pubk = EVP_PKEY_CTX_get0_pkey(pctx);
 310         struct gost_pmeth_data *data = EVP_PKEY_CTX_get_data(pctx);
 311         unsigned char ukm[8];
 312         int ret=0;
 313         if (RAND_bytes(ukm,8)<=0) {
 314                 GOSTerr(GOST_F_PKEY_GOST01CP_ENCRYPT,
 315                         GOST_R_RANDOM_GENERATOR_FAILURE);
 316                 return 0;
 317         }
 318
 319         if (!(gkt=make_rfc4490_keytransport_2001(pubk,gost_get_priv_key(data->eph_seckey),key, key_len,ukm,8))) {
 320                 goto err;
 321         }
 322         if ((*out_len = i2d_GOST_KEY_TRANSPORT(gkt,&out))>0) ret =1;
 323         GOST_KEY_TRANSPORT_free(gkt);
 324         return ret;
 325 err:
 326                 GOST_KEY_TRANSPORT_free(gkt);
 327                 return -1;
 328 }
 329 /* Public, because it would be needed in SSL implementation */
 330 int decrypt_rfc4490_shared_key_2001(EVP_PKEY *priv,GOST_KEY_TRANSPORT *gkt,
 331                 unsigned char *key_buf,int key_buf_len)
 332 {
 333         unsigned char wrappedKey[44];
 334         unsigned char sharedKey[32];
 335         gost_ctx ctx;
 336         const struct gost_cipher_info *param=NULL;
 337         EVP_PKEY *eph_key=NULL;
 338
 339         eph_key = X509_PUBKEY_get(gkt->key_agreement_info->ephem_key);
 340         param = get_encryption_params(gkt->key_agreement_info->cipher);
 341         gost_init(&ctx,param->sblock);
 342         OPENSSL_assert(gkt->key_agreement_info->eph_iv->length==8);
 343         memcpy(wrappedKey,gkt->key_agreement_info->eph_iv->data,8);
 344         OPENSSL_assert(gkt->key_info->encrypted_key->length==32);
 345         memcpy(wrappedKey+8,gkt->key_info->encrypted_key->data,32);
 346         OPENSSL_assert(gkt->key_info->imit->length==4);
 347         memcpy(wrappedKey+40,gkt->key_info->imit->data,4);
 348         VKO_compute_key(sharedKey,32,EC_KEY_get0_public_key(EVP_PKEY_get0(eph_key)),
 349                         EVP_PKEY_get0(priv),wrappedKey);
 350         if (!keyUnwrapCryptoPro(&ctx,sharedKey,wrappedKey,key_buf)) {
 351                 GOSTerr(GOST_F_PKCS7_GOST94CP_KEY_TRANSPORT_DECRYPT,
 352                                 GOST_R_ERROR_COMPUTING_SHARED_KEY);
 353                 goto err;
 354         }
 355
 356         EVP_PKEY_free(eph_key);
 357         return 32;
 358 err:
 359         EVP_PKEY_free(eph_key);
 360         return -1;
 361 }
 362 /*
 363  * EVP_PKEY_METHOD callback decrypt
 364  * Implementation of GOST2001 key transport, cryptopo variation
 365  */
 366 int pkey_GOST01cp_decrypt (EVP_PKEY_CTX *pctx, unsigned char *key, size_t * key_len, const unsigned char *in, size_t in_len) {
 367         const unsigned char *p = in;
 368         EVP_PKEY *priv = EVP_PKEY_CTX_get0_pkey(pctx);
 369         GOST_KEY_TRANSPORT *gkt = NULL;
 370         int ret=0;
 371
 372         if (!key) {
 373                 *key_len = 32;
 374                 return 1;
 375         }
 376         gkt = d2i_GOST_KEY_TRANSPORT(NULL,(const unsigned char **)&p,
 377                         in_len);
 378         if (!gkt) {
 379                 GOSTerr(GOST_F_PKCS7_GOST94CP_KEY_TRANSPORT_DECRYPT,GOST_R_ERROR_PARSING_KEY_TRANSPORT_INFO);
 380                 return -1;
 381         }
 382         ret =   decrypt_rfc4490_shared_key_2001(priv,gkt,key,*key_len);
 383         GOST_KEY_TRANSPORT_free(gkt);
 384         return ret;
 385 }