Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * Copyright (c) 2018 Yubico AB. All rights reserved. |
3 | | * Use of this source code is governed by a BSD-style |
4 | | * license that can be found in the LICENSE file. |
5 | | */ |
6 | | |
7 | | #include <openssl/bn.h> |
8 | | #include <openssl/obj_mac.h> |
9 | | |
10 | | #include "fido.h" |
11 | | #include "fido/es256.h" |
12 | | |
13 | | static int |
14 | | decode_coord(const cbor_item_t *item, void *xy, size_t xy_len) |
15 | 10.1k | { |
16 | 10.1k | if (cbor_isa_bytestring(item) == false || |
17 | 10.1k | cbor_bytestring_is_definite(item) == false || |
18 | 10.1k | cbor_bytestring_length(item) != xy_len) { |
19 | 123 | fido_log_debug("%s: cbor type", __func__); |
20 | 123 | return (-1); |
21 | 123 | } |
22 | 10.0k | |
23 | 10.0k | memcpy(xy, cbor_bytestring_handle(item), xy_len); |
24 | 10.0k | |
25 | 10.0k | return (0); |
26 | 10.0k | } |
27 | | |
28 | | static int |
29 | | decode_pubkey_point(const cbor_item_t *key, const cbor_item_t *val, void *arg) |
30 | 26.1k | { |
31 | 26.1k | es256_pk_t *k = arg; |
32 | 26.1k | |
33 | 26.1k | if (cbor_isa_negint(key) == false || |
34 | 26.1k | cbor_int_get_width(key) != CBOR_INT_8) |
35 | 13.1k | return (0); /* ignore */ |
36 | 13.0k | |
37 | 13.0k | switch (cbor_get_uint8(key)) { |
38 | 5.21k | case 1: /* x coordinate */ |
39 | 5.21k | return (decode_coord(val, &k->x, sizeof(k->x))); |
40 | 4.98k | case 2: /* y coordinate */ |
41 | 4.98k | return (decode_coord(val, &k->y, sizeof(k->y))); |
42 | 2.83k | } |
43 | 2.83k | |
44 | 2.83k | return (0); /* ignore */ |
45 | 2.83k | } |
46 | | |
47 | | int |
48 | | es256_pk_decode(const cbor_item_t *item, es256_pk_t *k) |
49 | 5.31k | { |
50 | 5.31k | if (cbor_isa_map(item) == false || |
51 | 5.31k | cbor_map_is_definite(item) == false || |
52 | 5.31k | cbor_map_iter(item, k, decode_pubkey_point) < 0) { |
53 | 197 | fido_log_debug("%s: cbor type", __func__); |
54 | 197 | return (-1); |
55 | 197 | } |
56 | 5.12k | |
57 | 5.12k | return (0); |
58 | 5.12k | } |
59 | | |
60 | | cbor_item_t * |
61 | | es256_pk_encode(const es256_pk_t *pk, int ecdh) |
62 | 3.23k | { |
63 | 3.23k | cbor_item_t *item = NULL; |
64 | 3.23k | struct cbor_pair argv[5]; |
65 | 3.23k | int alg; |
66 | 3.23k | int ok = -1; |
67 | 3.23k | |
68 | 3.23k | memset(argv, 0, sizeof(argv)); |
69 | 3.23k | |
70 | 3.23k | if ((item = cbor_new_definite_map(5)) == NULL) |
71 | 3.23k | goto fail; |
72 | 3.21k | |
73 | 3.21k | /* kty */ |
74 | 3.21k | if ((argv[0].key = cbor_build_uint8(1)) == NULL || |
75 | 3.21k | (argv[0].value = cbor_build_uint8(2)) == NULL || |
76 | 3.21k | !cbor_map_add(item, argv[0])) |
77 | 46 | goto fail; |
78 | 3.17k | |
79 | 3.17k | /* |
80 | 3.17k | * "The COSEAlgorithmIdentifier used is -25 (ECDH-ES + |
81 | 3.17k | * HKDF-256) although this is NOT the algorithm actually |
82 | 3.17k | * used. Setting this to a different value may result in |
83 | 3.17k | * compatibility issues." |
84 | 3.17k | */ |
85 | 3.17k | if (ecdh) |
86 | 3.12k | alg = COSE_ECDH_ES256; |
87 | 3.17k | else |
88 | 3.17k | alg = COSE_ES256; |
89 | 3.17k | |
90 | 3.17k | /* alg */ |
91 | 3.17k | if ((argv[1].key = cbor_build_uint8(3)) == NULL || |
92 | 3.17k | (argv[1].value = cbor_build_negint8((uint8_t)(-alg - 1))) == NULL || |
93 | 3.17k | !cbor_map_add(item, argv[1])) |
94 | 41 | goto fail; |
95 | 3.13k | |
96 | 3.13k | /* crv */ |
97 | 3.13k | if ((argv[2].key = cbor_build_negint8(0)) == NULL || |
98 | 3.13k | (argv[2].value = cbor_build_uint8(1)) == NULL || |
99 | 3.13k | !cbor_map_add(item, argv[2])) |
100 | 37 | goto fail; |
101 | 3.09k | |
102 | 3.09k | /* x */ |
103 | 3.09k | if ((argv[3].key = cbor_build_negint8(1)) == NULL || |
104 | 3.09k | (argv[3].value = cbor_build_bytestring(pk->x, |
105 | 3.07k | sizeof(pk->x))) == NULL || !cbor_map_add(item, argv[3])) |
106 | 35 | goto fail; |
107 | 3.05k | |
108 | 3.05k | /* y */ |
109 | 3.05k | if ((argv[4].key = cbor_build_negint8(2)) == NULL || |
110 | 3.05k | (argv[4].value = cbor_build_bytestring(pk->y, |
111 | 3.03k | sizeof(pk->y))) == NULL || !cbor_map_add(item, argv[4])) |
112 | 47 | goto fail; |
113 | 3.01k | |
114 | 3.01k | ok = 0; |
115 | 3.23k | fail: |
116 | 3.23k | if (ok < 0) { |
117 | 221 | if (item != NULL) { |
118 | 206 | cbor_decref(&item); |
119 | 206 | item = NULL; |
120 | 206 | } |
121 | 221 | } |
122 | 3.23k | |
123 | 19.3k | for (size_t i = 0; i < 5; i++) { |
124 | 16.1k | if (argv[i].key) |
125 | 15.5k | cbor_decref(&argv[i].key); |
126 | 16.1k | if (argv[i].value) |
127 | 15.5k | cbor_decref(&argv[i].value); |
128 | 16.1k | } |
129 | 3.23k | |
130 | 3.23k | return (item); |
131 | 3.01k | } |
132 | | |
133 | | es256_sk_t * |
134 | | es256_sk_new(void) |
135 | 7.26k | { |
136 | 7.26k | return (calloc(1, sizeof(es256_sk_t))); |
137 | 7.26k | } |
138 | | |
139 | | void |
140 | | es256_sk_free(es256_sk_t **skp) |
141 | 7.26k | { |
142 | 7.26k | es256_sk_t *sk; |
143 | 7.26k | |
144 | 7.26k | if (skp == NULL || (sk = *skp) == NULL) |
145 | 7.26k | return; |
146 | 7.24k | |
147 | 7.24k | freezero(sk, sizeof(*sk)); |
148 | 7.24k | *skp = NULL; |
149 | 7.24k | } |
150 | | |
151 | | es256_pk_t * |
152 | | es256_pk_new(void) |
153 | 14.5k | { |
154 | 14.5k | return (calloc(1, sizeof(es256_pk_t))); |
155 | 14.5k | } |
156 | | |
157 | | void |
158 | | es256_pk_free(es256_pk_t **pkp) |
159 | 25.0k | { |
160 | 25.0k | es256_pk_t *pk; |
161 | 25.0k | |
162 | 25.0k | if (pkp == NULL || (pk = *pkp) == NULL) |
163 | 25.0k | return; |
164 | 14.4k | |
165 | 14.4k | freezero(pk, sizeof(*pk)); |
166 | 14.4k | *pkp = NULL; |
167 | 14.4k | } |
168 | | |
169 | | int |
170 | | es256_pk_from_ptr(es256_pk_t *pk, const void *ptr, size_t len) |
171 | 661 | { |
172 | 661 | const uint8_t *p = ptr; |
173 | 661 | |
174 | 661 | if (len < sizeof(*pk)) |
175 | 624 | return (FIDO_ERR_INVALID_ARGUMENT); |
176 | 37 | |
177 | 37 | if (len == sizeof(*pk) + 1 && *p == 0x04) |
178 | 1 | memcpy(pk, ++p, sizeof(*pk)); /* uncompressed format */ |
179 | 36 | else |
180 | 36 | memcpy(pk, ptr, sizeof(*pk)); /* libfido2 x||y format */ |
181 | 37 | |
182 | 37 | return (FIDO_OK); |
183 | 37 | } |
184 | | |
185 | | int |
186 | | es256_pk_set_x(es256_pk_t *pk, const unsigned char *x) |
187 | 42 | { |
188 | 42 | memcpy(pk->x, x, sizeof(pk->x)); |
189 | 42 | |
190 | 42 | return (0); |
191 | 42 | } |
192 | | |
193 | | int |
194 | | es256_pk_set_y(es256_pk_t *pk, const unsigned char *y) |
195 | 42 | { |
196 | 42 | memcpy(pk->y, y, sizeof(pk->y)); |
197 | 42 | |
198 | 42 | return (0); |
199 | 42 | } |
200 | | |
201 | | int |
202 | | es256_sk_create(es256_sk_t *key) |
203 | 7.21k | { |
204 | 7.21k | EVP_PKEY_CTX *pctx = NULL; |
205 | 7.21k | EVP_PKEY_CTX *kctx = NULL; |
206 | 7.21k | EVP_PKEY *p = NULL; |
207 | 7.21k | EVP_PKEY *k = NULL; |
208 | 7.21k | const EC_KEY *ec; |
209 | 7.21k | const BIGNUM *d; |
210 | 7.21k | const int nid = NID_X9_62_prime256v1; |
211 | 7.21k | int n; |
212 | 7.21k | int ok = -1; |
213 | 7.21k | |
214 | 7.21k | if ((pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_EC, NULL)) == NULL || |
215 | 7.21k | EVP_PKEY_paramgen_init(pctx) <= 0 || |
216 | 7.21k | EVP_PKEY_CTX_set_ec_paramgen_curve_nid(pctx, nid) <= 0 || |
217 | 7.21k | EVP_PKEY_paramgen(pctx, &p) <= 0) { |
218 | 104 | fido_log_debug("%s: EVP_PKEY_paramgen", __func__); |
219 | 104 | goto fail; |
220 | 104 | } |
221 | 7.10k | |
222 | 7.10k | if ((kctx = EVP_PKEY_CTX_new(p, NULL)) == NULL || |
223 | 7.10k | EVP_PKEY_keygen_init(kctx) <= 0 || EVP_PKEY_keygen(kctx, &k) <= 0) { |
224 | 91 | fido_log_debug("%s: EVP_PKEY_keygen", __func__); |
225 | 91 | goto fail; |
226 | 91 | } |
227 | 7.01k | |
228 | 7.01k | if ((ec = EVP_PKEY_get0_EC_KEY(k)) == NULL || |
229 | 7.01k | (d = EC_KEY_get0_private_key(ec)) == NULL || |
230 | 7.01k | (n = BN_num_bytes(d)) < 0 || (size_t)n > sizeof(key->d) || |
231 | 7.01k | (n = BN_bn2bin(d, key->d)) < 0 || (size_t)n > sizeof(key->d)) { |
232 | 86 | fido_log_debug("%s: EC_KEY_get0_private_key", __func__); |
233 | 86 | goto fail; |
234 | 86 | } |
235 | 6.93k | |
236 | 6.93k | ok = 0; |
237 | 7.21k | fail: |
238 | 7.21k | if (p != NULL) |
239 | 7.21k | EVP_PKEY_free(p); |
240 | 7.21k | if (k != NULL) |
241 | 7.21k | EVP_PKEY_free(k); |
242 | 7.21k | if (pctx != NULL) |
243 | 7.21k | EVP_PKEY_CTX_free(pctx); |
244 | 7.21k | if (kctx != NULL) |
245 | 7.21k | EVP_PKEY_CTX_free(kctx); |
246 | 7.21k | |
247 | 7.21k | return (ok); |
248 | 6.93k | } |
249 | | |
250 | | EVP_PKEY * |
251 | | es256_pk_to_EVP_PKEY(const es256_pk_t *k) |
252 | 4.16k | { |
253 | 4.16k | BN_CTX *bnctx = NULL; |
254 | 4.16k | EC_KEY *ec = NULL; |
255 | 4.16k | EC_POINT *q = NULL; |
256 | 4.16k | EVP_PKEY *pkey = NULL; |
257 | 4.16k | BIGNUM *x = NULL; |
258 | 4.16k | BIGNUM *y = NULL; |
259 | 4.16k | const EC_GROUP *g = NULL; |
260 | 4.16k | const int nid = NID_X9_62_prime256v1; |
261 | 4.16k | int ok = -1; |
262 | 4.16k | |
263 | 4.16k | if ((bnctx = BN_CTX_new()) == NULL) |
264 | 4.16k | goto fail; |
265 | 4.14k | |
266 | 4.14k | BN_CTX_start(bnctx); |
267 | 4.14k | |
268 | 4.14k | if ((x = BN_CTX_get(bnctx)) == NULL || |
269 | 4.14k | (y = BN_CTX_get(bnctx)) == NULL) |
270 | 4.14k | goto fail; |
271 | 4.11k | |
272 | 4.11k | if (BN_bin2bn(k->x, sizeof(k->x), x) == NULL || |
273 | 4.11k | BN_bin2bn(k->y, sizeof(k->y), y) == NULL) { |
274 | 37 | fido_log_debug("%s: BN_bin2bn", __func__); |
275 | 37 | goto fail; |
276 | 37 | } |
277 | 4.07k | |
278 | 4.07k | if ((ec = EC_KEY_new_by_curve_name(nid)) == NULL || |
279 | 4.07k | (g = EC_KEY_get0_group(ec)) == NULL) { |
280 | 31 | fido_log_debug("%s: EC_KEY init", __func__); |
281 | 31 | goto fail; |
282 | 31 | } |
283 | 4.04k | |
284 | 4.04k | if ((q = EC_POINT_new(g)) == NULL || |
285 | 4.04k | EC_POINT_set_affine_coordinates_GFp(g, q, x, y, bnctx) == 0 || |
286 | 4.04k | EC_KEY_set_public_key(ec, q) == 0) { |
287 | 220 | fido_log_debug("%s: EC_KEY_set_public_key", __func__); |
288 | 220 | goto fail; |
289 | 220 | } |
290 | 3.82k | |
291 | 3.82k | if ((pkey = EVP_PKEY_new()) == NULL || |
292 | 3.82k | EVP_PKEY_assign_EC_KEY(pkey, ec) == 0) { |
293 | 31 | fido_log_debug("%s: EVP_PKEY_assign_EC_KEY", __func__); |
294 | 31 | goto fail; |
295 | 31 | } |
296 | 3.79k | |
297 | 3.79k | ec = NULL; /* at this point, ec belongs to evp */ |
298 | 3.79k | |
299 | 3.79k | ok = 0; |
300 | 4.16k | fail: |
301 | 4.16k | if (bnctx != NULL) { |
302 | 4.14k | BN_CTX_end(bnctx); |
303 | 4.14k | BN_CTX_free(bnctx); |
304 | 4.14k | } |
305 | 4.16k | |
306 | 4.16k | if (ec != NULL) |
307 | 4.16k | EC_KEY_free(ec); |
308 | 4.16k | if (q != NULL) |
309 | 4.16k | EC_POINT_free(q); |
310 | 4.16k | |
311 | 4.16k | if (ok < 0 && pkey != NULL) { |
312 | 16 | EVP_PKEY_free(pkey); |
313 | 16 | pkey = NULL; |
314 | 16 | } |
315 | 4.16k | |
316 | 4.16k | return (pkey); |
317 | 3.79k | } |
318 | | |
319 | | int |
320 | | es256_pk_from_EC_KEY(es256_pk_t *pk, const EC_KEY *ec) |
321 | 6.79k | { |
322 | 6.79k | BN_CTX *bnctx = NULL; |
323 | 6.79k | BIGNUM *x = NULL; |
324 | 6.79k | BIGNUM *y = NULL; |
325 | 6.79k | const EC_POINT *q = NULL; |
326 | 6.79k | const EC_GROUP *g = NULL; |
327 | 6.79k | int ok = FIDO_ERR_INTERNAL; |
328 | 6.79k | int n; |
329 | 6.79k | |
330 | 6.79k | if ((q = EC_KEY_get0_public_key(ec)) == NULL || |
331 | 6.79k | (g = EC_KEY_get0_group(ec)) == NULL || |
332 | 6.79k | (bnctx = BN_CTX_new()) == NULL) |
333 | 6.79k | goto fail; |
334 | 6.72k | |
335 | 6.72k | BN_CTX_start(bnctx); |
336 | 6.72k | |
337 | 6.72k | if ((x = BN_CTX_get(bnctx)) == NULL || |
338 | 6.72k | (y = BN_CTX_get(bnctx)) == NULL) |
339 | 6.72k | goto fail; |
340 | 6.65k | |
341 | 6.65k | if (EC_POINT_get_affine_coordinates_GFp(g, q, x, y, bnctx) == 0 || |
342 | 6.65k | (n = BN_num_bytes(x)) < 0 || (size_t)n > sizeof(pk->x) || |
343 | 6.65k | (n = BN_num_bytes(y)) < 0 || (size_t)n > sizeof(pk->y)) { |
344 | 33 | fido_log_debug("%s: EC_POINT_get_affine_coordinates_GFp", |
345 | 33 | __func__); |
346 | 33 | goto fail; |
347 | 33 | } |
348 | 6.62k | |
349 | 6.62k | if ((n = BN_bn2bin(x, pk->x)) < 0 || (size_t)n > sizeof(pk->x) || |
350 | 6.62k | (n = BN_bn2bin(y, pk->y)) < 0 || (size_t)n > sizeof(pk->y)) { |
351 | 65 | fido_log_debug("%s: BN_bn2bin", __func__); |
352 | 65 | goto fail; |
353 | 65 | } |
354 | 6.55k | |
355 | 6.55k | ok = FIDO_OK; |
356 | 6.79k | fail: |
357 | 6.79k | if (bnctx != NULL) { |
358 | 6.72k | BN_CTX_end(bnctx); |
359 | 6.72k | BN_CTX_free(bnctx); |
360 | 6.72k | } |
361 | 6.79k | |
362 | 6.79k | return (ok); |
363 | 6.55k | } |
364 | | |
365 | | EVP_PKEY * |
366 | | es256_sk_to_EVP_PKEY(const es256_sk_t *k) |
367 | 3.75k | { |
368 | 3.75k | BN_CTX *bnctx = NULL; |
369 | 3.75k | EC_KEY *ec = NULL; |
370 | 3.75k | EVP_PKEY *pkey = NULL; |
371 | 3.75k | BIGNUM *d = NULL; |
372 | 3.75k | const int nid = NID_X9_62_prime256v1; |
373 | 3.75k | int ok = -1; |
374 | 3.75k | |
375 | 3.75k | if ((bnctx = BN_CTX_new()) == NULL) |
376 | 3.75k | goto fail; |
377 | 3.74k | |
378 | 3.74k | BN_CTX_start(bnctx); |
379 | 3.74k | |
380 | 3.74k | if ((d = BN_CTX_get(bnctx)) == NULL || |
381 | 3.74k | BN_bin2bn(k->d, sizeof(k->d), d) == NULL) { |
382 | 29 | fido_log_debug("%s: BN_bin2bn", __func__); |
383 | 29 | goto fail; |
384 | 29 | } |
385 | 3.71k | |
386 | 3.71k | if ((ec = EC_KEY_new_by_curve_name(nid)) == NULL || |
387 | 3.71k | EC_KEY_set_private_key(ec, d) == 0) { |
388 | 17 | fido_log_debug("%s: EC_KEY_set_private_key", __func__); |
389 | 17 | goto fail; |
390 | 17 | } |
391 | 3.69k | |
392 | 3.69k | if ((pkey = EVP_PKEY_new()) == NULL || |
393 | 3.69k | EVP_PKEY_assign_EC_KEY(pkey, ec) == 0) { |
394 | 28 | fido_log_debug("%s: EVP_PKEY_assign_EC_KEY", __func__); |
395 | 28 | goto fail; |
396 | 28 | } |
397 | 3.66k | |
398 | 3.66k | ec = NULL; /* at this point, ec belongs to evp */ |
399 | 3.66k | |
400 | 3.66k | ok = 0; |
401 | 3.75k | fail: |
402 | 3.75k | if (bnctx != NULL) { |
403 | 3.74k | BN_CTX_end(bnctx); |
404 | 3.74k | BN_CTX_free(bnctx); |
405 | 3.74k | } |
406 | 3.75k | |
407 | 3.75k | if (ec != NULL) |
408 | 3.75k | EC_KEY_free(ec); |
409 | 3.75k | |
410 | 3.75k | if (ok < 0 && pkey != NULL) { |
411 | 13 | EVP_PKEY_free(pkey); |
412 | 13 | pkey = NULL; |
413 | 13 | } |
414 | 3.75k | |
415 | 3.75k | return (pkey); |
416 | 3.66k | } |
417 | | |
418 | | int |
419 | | es256_derive_pk(const es256_sk_t *sk, es256_pk_t *pk) |
420 | 6.93k | { |
421 | 6.93k | BIGNUM *d = NULL; |
422 | 6.93k | EC_KEY *ec = NULL; |
423 | 6.93k | EC_POINT *q = NULL; |
424 | 6.93k | const EC_GROUP *g = NULL; |
425 | 6.93k | const int nid = NID_X9_62_prime256v1; |
426 | 6.93k | int ok = -1; |
427 | 6.93k | |
428 | 6.93k | if ((d = BN_bin2bn(sk->d, (int)sizeof(sk->d), NULL)) == NULL || |
429 | 6.93k | (ec = EC_KEY_new_by_curve_name(nid)) == NULL || |
430 | 6.93k | (g = EC_KEY_get0_group(ec)) == NULL || |
431 | 6.93k | (q = EC_POINT_new(g)) == NULL) { |
432 | 136 | fido_log_debug("%s: get", __func__); |
433 | 136 | goto fail; |
434 | 136 | } |
435 | 6.79k | |
436 | 6.79k | if (EC_POINT_mul(g, q, d, NULL, NULL, NULL) == 0 || |
437 | 6.79k | EC_KEY_set_public_key(ec, q) == 0 || |
438 | 6.79k | es256_pk_from_EC_KEY(pk, ec) != FIDO_OK) { |
439 | 235 | fido_log_debug("%s: set", __func__); |
440 | 235 | goto fail; |
441 | 235 | } |
442 | 6.55k | |
443 | 6.55k | ok = 0; |
444 | 6.93k | fail: |
445 | 6.93k | if (d != NULL) |
446 | 6.93k | BN_clear_free(d); |
447 | 6.93k | if (q != NULL) |
448 | 6.93k | EC_POINT_free(q); |
449 | 6.93k | if (ec != NULL) |
450 | 6.93k | EC_KEY_free(ec); |
451 | 6.93k | |
452 | 6.93k | return (ok); |
453 | 6.55k | } |