123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650 |
- /* Copyright (c) 2001, Matej Pfajfar.
- * Copyright (c) 2001-2004, Roger Dingledine.
- * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
- * Copyright (c) 2007-2018, The Tor Project, Inc. */
- /* See LICENSE for licensing information */
- /**
- * \file crypto_rsa.c
- * \brief Block of functions related with RSA utilities and operations.
- **/
- #include "lib/crypt_ops/crypto_cipher.h"
- #include "lib/crypt_ops/crypto_curve25519.h"
- #include "lib/crypt_ops/crypto_digest.h"
- #include "lib/crypt_ops/crypto_format.h"
- #include "lib/crypt_ops/compat_openssl.h"
- #include "lib/crypt_ops/crypto_rand.h"
- #include "lib/crypt_ops/crypto_rsa.h"
- #include "lib/crypt_ops/crypto_util.h"
- #include "lib/ctime/di_ops.h"
- #include "lib/log/util_bug.h"
- #include "lib/fs/files.h"
- #include "lib/log/log.h"
- #include "lib/encoding/binascii.h"
- #include "lib/encoding/pem.h"
- #include <string.h>
- #ifdef HAVE_SYS_STAT_H
- #include <sys/stat.h>
- #endif
- /** Return the number of bytes added by padding method <b>padding</b>.
- */
- int
- crypto_get_rsa_padding_overhead(int padding)
- {
- switch (padding)
- {
- case PK_PKCS1_OAEP_PADDING: return PKCS1_OAEP_PADDING_OVERHEAD;
- default: tor_assert(0); return -1; // LCOV_EXCL_LINE
- }
- }
- #ifdef ENABLE_OPENSSL
- /** Given a padding method <b>padding</b>, return the correct OpenSSL constant.
- */
- int
- crypto_get_rsa_padding(int padding)
- {
- switch (padding)
- {
- case PK_PKCS1_OAEP_PADDING: return RSA_PKCS1_OAEP_PADDING;
- default: tor_assert(0); return -1; // LCOV_EXCL_LINE
- }
- }
- #endif
- /** Compare the public-key components of a and b. Return non-zero iff
- * a==b. A NULL key is considered to be distinct from all non-NULL
- * keys, and equal to itself.
- *
- * Note that this may leak information about the keys through timing.
- */
- int
- crypto_pk_eq_keys(const crypto_pk_t *a, const crypto_pk_t *b)
- {
- return (crypto_pk_cmp_keys(a, b) == 0);
- }
- /** Perform a hybrid (public/secret) encryption on <b>fromlen</b>
- * bytes of data from <b>from</b>, with padding type 'padding',
- * storing the results on <b>to</b>.
- *
- * Returns the number of bytes written on success, -1 on failure.
- *
- * The encrypted data consists of:
- * - The source data, padded and encrypted with the public key, if the
- * padded source data is no longer than the public key, and <b>force</b>
- * is false, OR
- * - The beginning of the source data prefixed with a 16-byte symmetric key,
- * padded and encrypted with the public key; followed by the rest of
- * the source data encrypted in AES-CTR mode with the symmetric key.
- *
- * NOTE that this format does not authenticate the symmetrically encrypted
- * part of the data, and SHOULD NOT BE USED for new protocols.
- */
- int
- crypto_pk_obsolete_public_hybrid_encrypt(crypto_pk_t *env,
- char *to, size_t tolen,
- const char *from,
- size_t fromlen,
- int padding, int force)
- {
- int overhead, outlen, r;
- size_t pkeylen, symlen;
- crypto_cipher_t *cipher = NULL;
- char *buf = NULL;
- tor_assert(env);
- tor_assert(from);
- tor_assert(to);
- tor_assert(fromlen < SIZE_T_CEILING);
- overhead = crypto_get_rsa_padding_overhead(padding);
- pkeylen = crypto_pk_keysize(env);
- if (!force && fromlen+overhead <= pkeylen) {
- /* It all fits in a single encrypt. */
- return crypto_pk_public_encrypt(env,to,
- tolen,
- from,fromlen,padding);
- }
- tor_assert(tolen >= fromlen + overhead + CIPHER_KEY_LEN);
- tor_assert(tolen >= pkeylen);
- char key[CIPHER_KEY_LEN];
- crypto_rand(key, sizeof(key)); /* generate a new key. */
- cipher = crypto_cipher_new(key);
- buf = tor_malloc(pkeylen+1);
- memcpy(buf, key, CIPHER_KEY_LEN);
- memcpy(buf+CIPHER_KEY_LEN, from, pkeylen-overhead-CIPHER_KEY_LEN);
- /* Length of symmetrically encrypted data. */
- symlen = fromlen-(pkeylen-overhead-CIPHER_KEY_LEN);
- outlen = crypto_pk_public_encrypt(env,to,tolen,buf,pkeylen-overhead,padding);
- if (outlen!=(int)pkeylen) {
- goto err;
- }
- r = crypto_cipher_encrypt(cipher, to+outlen,
- from+pkeylen-overhead-CIPHER_KEY_LEN, symlen);
- if (r<0) goto err;
- memwipe(buf, 0, pkeylen);
- memwipe(key, 0, sizeof(key));
- tor_free(buf);
- crypto_cipher_free(cipher);
- tor_assert(outlen+symlen < INT_MAX);
- return (int)(outlen + symlen);
- err:
- memwipe(buf, 0, pkeylen);
- memwipe(key, 0, sizeof(key));
- tor_free(buf);
- crypto_cipher_free(cipher);
- return -1;
- }
- /** Invert crypto_pk_obsolete_public_hybrid_encrypt. Returns the number of
- * bytes written on success, -1 on failure.
- *
- * NOTE that this format does not authenticate the symmetrically encrypted
- * part of the data, and SHOULD NOT BE USED for new protocols.
- */
- int
- crypto_pk_obsolete_private_hybrid_decrypt(crypto_pk_t *env,
- char *to,
- size_t tolen,
- const char *from,
- size_t fromlen,
- int padding, int warnOnFailure)
- {
- int outlen, r;
- size_t pkeylen;
- crypto_cipher_t *cipher = NULL;
- char *buf = NULL;
- tor_assert(fromlen < SIZE_T_CEILING);
- pkeylen = crypto_pk_keysize(env);
- if (fromlen <= pkeylen) {
- return crypto_pk_private_decrypt(env,to,tolen,from,fromlen,padding,
- warnOnFailure);
- }
- buf = tor_malloc(pkeylen);
- outlen = crypto_pk_private_decrypt(env,buf,pkeylen,from,pkeylen,padding,
- warnOnFailure);
- if (outlen<0) {
- log_fn(warnOnFailure?LOG_WARN:LOG_DEBUG, LD_CRYPTO,
- "Error decrypting public-key data");
- goto err;
- }
- if (outlen < CIPHER_KEY_LEN) {
- log_fn(warnOnFailure?LOG_WARN:LOG_INFO, LD_CRYPTO,
- "No room for a symmetric key");
- goto err;
- }
- cipher = crypto_cipher_new(buf);
- if (!cipher) {
- goto err;
- }
- memcpy(to,buf+CIPHER_KEY_LEN,outlen-CIPHER_KEY_LEN);
- outlen -= CIPHER_KEY_LEN;
- tor_assert(tolen - outlen >= fromlen - pkeylen);
- r = crypto_cipher_decrypt(cipher, to+outlen, from+pkeylen, fromlen-pkeylen);
- if (r<0)
- goto err;
- memwipe(buf,0,pkeylen);
- tor_free(buf);
- crypto_cipher_free(cipher);
- tor_assert(outlen + fromlen < INT_MAX);
- return (int)(outlen + (fromlen-pkeylen));
- err:
- memwipe(buf,0,pkeylen);
- tor_free(buf);
- crypto_cipher_free(cipher);
- return -1;
- }
- /** Given a private or public key <b>pk</b>, put a fingerprint of the
- * public key into <b>fp_out</b> (must have at least FINGERPRINT_LEN+1 bytes of
- * space). Return 0 on success, -1 on failure.
- *
- * Fingerprints are computed as the SHA1 digest of the ASN.1 encoding
- * of the public key, converted to hexadecimal, in upper case, with a
- * space after every four digits.
- *
- * If <b>add_space</b> is false, omit the spaces.
- */
- int
- crypto_pk_get_fingerprint(crypto_pk_t *pk, char *fp_out, int add_space)
- {
- char digest[DIGEST_LEN];
- char hexdigest[HEX_DIGEST_LEN+1];
- if (crypto_pk_get_digest(pk, digest)) {
- return -1;
- }
- base16_encode(hexdigest,sizeof(hexdigest),digest,DIGEST_LEN);
- if (add_space) {
- crypto_add_spaces_to_fp(fp_out, FINGERPRINT_LEN+1, hexdigest);
- } else {
- strncpy(fp_out, hexdigest, HEX_DIGEST_LEN+1);
- }
- return 0;
- }
- /** Given a private or public key <b>pk</b>, put a hashed fingerprint of
- * the public key into <b>fp_out</b> (must have at least FINGERPRINT_LEN+1
- * bytes of space). Return 0 on success, -1 on failure.
- *
- * Hashed fingerprints are computed as the SHA1 digest of the SHA1 digest
- * of the ASN.1 encoding of the public key, converted to hexadecimal, in
- * upper case.
- */
- int
- crypto_pk_get_hashed_fingerprint(crypto_pk_t *pk, char *fp_out)
- {
- char digest[DIGEST_LEN], hashed_digest[DIGEST_LEN];
- if (crypto_pk_get_digest(pk, digest)) {
- return -1;
- }
- if (crypto_digest(hashed_digest, digest, DIGEST_LEN) < 0) {
- return -1;
- }
- base16_encode(fp_out, FINGERPRINT_LEN + 1, hashed_digest, DIGEST_LEN);
- return 0;
- }
- /** Copy <b>in</b> to the <b>outlen</b>-byte buffer <b>out</b>, adding spaces
- * every four characters. */
- void
- crypto_add_spaces_to_fp(char *out, size_t outlen, const char *in)
- {
- int n = 0;
- char *end = out+outlen;
- tor_assert(outlen < SIZE_T_CEILING);
- while (*in && out<end) {
- *out++ = *in++;
- if (++n == 4 && *in && out<end) {
- n = 0;
- *out++ = ' ';
- }
- }
- tor_assert(out<end);
- *out = '\0';
- }
- /** Check a siglen-byte long signature at <b>sig</b> against
- * <b>datalen</b> bytes of data at <b>data</b>, using the public key
- * in <b>env</b>. Return 0 if <b>sig</b> is a correct signature for
- * SHA1(data). Else return -1.
- */
- MOCK_IMPL(int,
- crypto_pk_public_checksig_digest,(crypto_pk_t *env, const char *data,
- size_t datalen, const char *sig,
- size_t siglen))
- {
- char digest[DIGEST_LEN];
- char *buf;
- size_t buflen;
- int r;
- tor_assert(env);
- tor_assert(data);
- tor_assert(sig);
- tor_assert(datalen < SIZE_T_CEILING);
- tor_assert(siglen < SIZE_T_CEILING);
- if (crypto_digest(digest,data,datalen)<0) {
- log_warn(LD_BUG, "couldn't compute digest");
- return -1;
- }
- buflen = crypto_pk_keysize(env);
- buf = tor_malloc(buflen);
- r = crypto_pk_public_checksig(env,buf,buflen,sig,siglen);
- if (r != DIGEST_LEN) {
- log_warn(LD_CRYPTO, "Invalid signature");
- tor_free(buf);
- return -1;
- }
- if (tor_memneq(buf, digest, DIGEST_LEN)) {
- log_warn(LD_CRYPTO, "Signature mismatched with digest.");
- tor_free(buf);
- return -1;
- }
- tor_free(buf);
- return 0;
- }
- /** Compute a SHA1 digest of <b>fromlen</b> bytes of data stored at
- * <b>from</b>; sign the data with the private key in <b>env</b>, and
- * store it in <b>to</b>. Return the number of bytes written on
- * success, and -1 on failure.
- *
- * <b>tolen</b> is the number of writable bytes in <b>to</b>, and must be
- * at least the length of the modulus of <b>env</b>.
- */
- int
- crypto_pk_private_sign_digest(crypto_pk_t *env, char *to, size_t tolen,
- const char *from, size_t fromlen)
- {
- int r;
- char digest[DIGEST_LEN];
- if (crypto_digest(digest,from,fromlen)<0)
- return -1;
- r = crypto_pk_private_sign(env,to,tolen,digest,DIGEST_LEN);
- memwipe(digest, 0, sizeof(digest));
- return r;
- }
- /** Given a private or public key <b>pk</b>, put a SHA1 hash of the
- * public key into <b>digest_out</b> (must have DIGEST_LEN bytes of space).
- * Return 0 on success, -1 on failure.
- */
- int
- crypto_pk_get_digest(const crypto_pk_t *pk, char *digest_out)
- {
- char *buf;
- size_t buflen;
- int len;
- int rv = -1;
- buflen = crypto_pk_keysize(pk)*2;
- buf = tor_malloc(buflen);
- len = crypto_pk_asn1_encode(pk, buf, buflen);
- if (len < 0)
- goto done;
- if (crypto_digest(digest_out, buf, len) < 0)
- goto done;
- rv = 0;
- done:
- tor_free(buf);
- return rv;
- }
- /** Compute all digests of the DER encoding of <b>pk</b>, and store them
- * in <b>digests_out</b>. Return 0 on success, -1 on failure. */
- int
- crypto_pk_get_common_digests(crypto_pk_t *pk, common_digests_t *digests_out)
- {
- char *buf;
- size_t buflen;
- int len;
- int rv = -1;
- buflen = crypto_pk_keysize(pk)*2;
- buf = tor_malloc(buflen);
- len = crypto_pk_asn1_encode(pk, buf, buflen);
- if (len < 0)
- goto done;
- if (crypto_common_digests(digests_out, (char*)buf, len) < 0)
- goto done;
- rv = 0;
- done:
- tor_free(buf);
- return rv;
- }
- static const char RSA_PUBLIC_TAG[] = "RSA PUBLIC KEY";
- static const char RSA_PRIVATE_TAG[] = "RSA PRIVATE KEY";
- /* These are overestimates for how many extra bytes we might need to encode
- * a key in DER */
- #define PRIVATE_ASN_MAX_OVERHEAD_FACTOR 16
- #define PUBLIC_ASN_MAX_OVERHEAD_FACTOR 3
- /** Helper: PEM-encode <b>env</b> and write it to a newly allocated string.
- * If <b>private_key</b>, write the private part of <b>env</b>; otherwise
- * write only the public portion. On success, set *<b>dest</b> to the new
- * string, *<b>len</b> to the string's length, and return 0. On failure,
- * return -1.
- */
- static int
- crypto_pk_write_to_string_generic(crypto_pk_t *env,
- char **dest, size_t *len,
- bool private_key)
- {
- const int factor =
- private_key ? PRIVATE_ASN_MAX_OVERHEAD_FACTOR
- : PUBLIC_ASN_MAX_OVERHEAD_FACTOR;
- size_t buflen = crypto_pk_keysize(env) * factor;
- const char *tag =
- private_key ? RSA_PRIVATE_TAG : RSA_PUBLIC_TAG;
- char *buf = tor_malloc(buflen);
- char *result = NULL;
- size_t resultlen = 0;
- int rv = -1;
- int n = private_key
- ? crypto_pk_asn1_encode_private(env, buf, buflen)
- : crypto_pk_asn1_encode(env, buf, buflen);
- if (n < 0)
- goto done;
- resultlen = pem_encoded_size(n, tag);
- result = tor_malloc(resultlen);
- if (pem_encode(result, resultlen,
- (const unsigned char *)buf, n, tag) < 0) {
- goto done;
- }
- *dest = result;
- *len = resultlen;
- rv = 0;
- done:
- if (rv < 0 && result) {
- memwipe(result, 0, resultlen);
- tor_free(result);
- }
- memwipe(buf, 0, buflen);
- tor_free(buf);
- return rv;
- }
- /** PEM-encode the public key portion of <b>env</b> and write it to a
- * newly allocated string. On success, set *<b>dest</b> to the new
- * string, *<b>len</b> to the string's length, and return 0. On
- * failure, return -1.
- */
- int
- crypto_pk_write_public_key_to_string(crypto_pk_t *env,
- char **dest, size_t *len)
- {
- return crypto_pk_write_to_string_generic(env, dest, len, false);
- }
- /** PEM-encode the private key portion of <b>env</b> and write it to a
- * newly allocated string. On success, set *<b>dest</b> to the new
- * string, *<b>len</b> to the string's length, and return 0. On
- * failure, return -1.
- */
- int
- crypto_pk_write_private_key_to_string(crypto_pk_t *env,
- char **dest, size_t *len)
- {
- return crypto_pk_write_to_string_generic(env, dest, len, true);
- }
- /**
- * Helper. Read a PEM-encoded RSA from the first <b>len</b> characters of
- * <b>src</b>, and store the result in <b>env</b>. If <b>private_key</b>,
- * expect a private key; otherwise expect a public key. Return 0 on success,
- * -1 on failure. If len is -1, the string is nul-terminated.
- */
- static int
- crypto_pk_read_from_string_generic(crypto_pk_t *env, const char *src,
- size_t len, bool private_key)
- {
- if (len == (size_t)-1) // "-1" indicates "use the length of the string."
- len = strlen(src);
- const char *tag =
- private_key ? RSA_PRIVATE_TAG : RSA_PUBLIC_TAG;
- size_t buflen = len;
- uint8_t *buf = tor_malloc(buflen);
- int rv = -1;
- int n = pem_decode(buf, buflen, src, len, tag);
- if (n < 0)
- goto done;
- crypto_pk_t *pk = private_key
- ? crypto_pk_asn1_decode_private((const char*)buf, n)
- : crypto_pk_asn1_decode((const char*)buf, n);
- if (! pk)
- goto done;
- if (private_key)
- crypto_pk_assign_private(env, pk);
- else
- crypto_pk_assign_public(env, pk);
- crypto_pk_free(pk);
- rv = 0;
- done:
- memwipe(buf, 0, buflen);
- tor_free(buf);
- return rv;
- }
- /** Read a PEM-encoded public key from the first <b>len</b> characters of
- * <b>src</b>, and store the result in <b>env</b>. Return 0 on success, -1 on
- * failure. If len is -1, the string is nul-terminated.
- */
- int
- crypto_pk_read_public_key_from_string(crypto_pk_t *env,
- const char *src, size_t len)
- {
- return crypto_pk_read_from_string_generic(env, src, len, false);
- }
- /** Read a PEM-encoded private key from the <b>len</b>-byte string <b>src</b>
- * into <b>env</b>. Return 0 on success, -1 on failure. If len is -1,
- * the string is nul-terminated.
- */
- int
- crypto_pk_read_private_key_from_string(crypto_pk_t *env,
- const char *src, ssize_t len)
- {
- return crypto_pk_read_from_string_generic(env, src, len, true);
- }
- /** If a file is longer than this, we won't try to decode its private key */
- #define MAX_PRIVKEY_FILE_LEN (16*1024*1024)
- /** Read a PEM-encoded private key from the file named by
- * <b>keyfile</b> into <b>env</b>. Return 0 on success, -1 on failure.
- */
- int
- crypto_pk_read_private_key_from_filename(crypto_pk_t *env,
- const char *keyfile)
- {
- struct stat st;
- char *buf = read_file_to_str(keyfile, 0, &st);
- if (!buf)
- return -1;
- if (st.st_size > MAX_PRIVKEY_FILE_LEN) {
- tor_free(buf);
- return -1;
- }
- int rv = crypto_pk_read_private_key_from_string(env, buf,
- (ssize_t)st.st_size);
- memwipe(buf, 0, (size_t)st.st_size);
- tor_free(buf);
- return rv;
- }
- /** Write the private key from <b>env</b> into the file named by <b>fname</b>,
- * PEM-encoded. Return 0 on success, -1 on failure.
- */
- int
- crypto_pk_write_private_key_to_filename(crypto_pk_t *env,
- const char *fname)
- {
- char *s = NULL;
- size_t n = 0;
- if (crypto_pk_write_private_key_to_string(env, &s, &n) < 0)
- return -1;
- int rv = write_bytes_to_file(fname, s, n, 0);
- memwipe(s, 0, n);
- tor_free(s);
- return rv;
- }
- /** Given a crypto_pk_t <b>pk</b>, allocate a new buffer containing the
- * Base64 encoding of the DER representation of the private key as a NUL
- * terminated string, and return it via <b>priv_out</b>. Return 0 on
- * success, -1 on failure.
- *
- * It is the caller's responsibility to sanitize and free the resulting buffer.
- */
- int
- crypto_pk_base64_encode_private(const crypto_pk_t *pk, char **priv_out)
- {
- size_t buflen = crypto_pk_keysize(pk)*16;
- char *buf = tor_malloc(buflen);
- char *result = NULL;
- size_t reslen = 0;
- bool ok = false;
- int n = crypto_pk_asn1_encode_private(pk, buf, buflen);
- if (n < 0)
- goto done;
- reslen = base64_encode_size(n, 0)+1;
- result = tor_malloc(reslen);
- if (base64_encode(result, reslen, buf, n, 0) < 0)
- goto done;
- ok = true;
- done:
- memwipe(buf, 0, buflen);
- tor_free(buf);
- if (result && ! ok) {
- memwipe(result, 0, reslen);
- tor_free(result);
- }
- *priv_out = result;
- return ok ? 0 : -1;
- }
- /** Given a string containing the Base64 encoded DER representation of the
- * private key <b>str</b>, decode and return the result on success, or NULL
- * on failure.
- */
- crypto_pk_t *
- crypto_pk_base64_decode_private(const char *str, size_t len)
- {
- crypto_pk_t *pk = NULL;
- char *der = tor_malloc_zero(len + 1);
- int der_len = base64_decode(der, len, str, len);
- if (der_len <= 0) {
- log_warn(LD_CRYPTO, "Stored RSA private key seems corrupted (base64).");
- goto out;
- }
- pk = crypto_pk_asn1_decode_private(der, der_len);
- out:
- memwipe(der, 0, len+1);
- tor_free(der);
- return pk;
- }
|