Skip to content

Commit e5b2cd5

Browse files
slontisslontis
committed
Change the provider implementation of X942kdf to use wpacket to do der encoding of sharedInfo
Added der_writer functions for writing octet string primitives. Generate OID's for key wrapping algorithms used by X942 KDF. Reviewed-by: Matt Caswell <[email protected]> (Merged from openssl#12554)
1 parent 37d898d commit e5b2cd5

File tree

12 files changed

+255
-122
lines changed

12 files changed

+255
-122
lines changed

‎.gitignore

+2
Original file line numberDiff line numberDiff line change
@@ -34,10 +34,12 @@ providers/common/der/der_digests_gen.c
3434
providers/common/der/der_dsa_gen.c
3535
providers/common/der/der_ec_gen.c
3636
providers/common/der/der_rsa_gen.c
37+
providers/common/der/der_wrap_gen.c
3738
providers/common/include/prov/der_dsa.h
3839
providers/common/include/prov/der_ec.h
3940
providers/common/include/prov/der_rsa.h
4041
providers/common/include/prov/der_digests.h
42+
providers/common/include/prov/der_wrap.h
4143

4244
# error code files
4345
/crypto/err/openssl.txt.old

‎crypto/der_writer.c

+23
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,29 @@ int DER_w_boolean(WPACKET *pkt, int tag, int b)
6666
&& int_end_context(pkt, tag);
6767
}
6868

69+
int DER_w_octet_string(WPACKET *pkt, int tag,
70+
const unsigned char *data, size_t data_n)
71+
{
72+
return int_start_context(pkt, tag)
73+
&& WPACKET_start_sub_packet(pkt)
74+
&& WPACKET_memcpy(pkt, data, data_n)
75+
&& WPACKET_close(pkt)
76+
&& WPACKET_put_bytes_u8(pkt, DER_P_OCTET_STRING)
77+
&& int_end_context(pkt, tag);
78+
}
79+
80+
int DER_w_octet_string_uint32(WPACKET *pkt, int tag, uint32_t value)
81+
{
82+
unsigned char tmp[4] = { 0, 0, 0, 0 };
83+
unsigned char *pbuf = tmp + (sizeof(tmp) - 1);
84+
85+
while (value > 0) {
86+
*pbuf-- = (value & 0xFF);
87+
value >>= 8;
88+
}
89+
return DER_w_octet_string(pkt, tag, tmp, sizeof(tmp));
90+
}
91+
6992
static int int_der_w_integer(WPACKET *pkt, int tag,
7093
int (*put_bytes)(WPACKET *pkt, const void *v,
7194
unsigned int *top_byte),

‎doc/internal/man3/DER_w_bn.pod

+11-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,8 @@
22

33
=head1 NAME
44

5-
DER_w_boolean, DER_w_ulong, DER_w_bn, DER_w_null
5+
DER_w_boolean, DER_w_ulong, DER_w_bn, DER_w_null,
6+
DER_w_octet_string, DER_w_octet_string_uint32
67
- internal DER writers for DER primitives
78

89
=head1 SYNOPSIS
@@ -13,6 +14,9 @@ DER_w_boolean, DER_w_ulong, DER_w_bn, DER_w_null
1314
int DER_w_ulong(WPACKET *pkt, int tag, unsigned long v);
1415
int DER_w_bn(WPACKET *pkt, int tag, const BIGNUM *v);
1516
int DER_w_null(WPACKET *pkt, int tag);
17+
int DER_w_octet_string(WPACKET *pkt, int tag,
18+
const unsigned char *data, size_t data_n);
19+
int DER_w_octet_string_uint32(WPACKET *pkt, int tag, uint32_t value);
1620

1721
=head1 DESCRIPTION
1822

@@ -33,6 +37,12 @@ added.
3337

3438
DER_w_null() writes the primitive NULL.
3539

40+
DER_w_octet_string() writes the primitive OCTET STRING using the bytes from
41+
I<data> with a length of I<data_n>.
42+
43+
DER_w_octet_string_uint32() writes the primitive OCTET STRING using a 32 bit
44+
value in I<value>.
45+
3646
=head1 RETURN VALUES
3747

3848
All the functions return 1 on success and 0 on failure. Failure may

‎include/internal/der.h

+3
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,9 @@ int DER_w_boolean(WPACKET *pkt, int tag, int b);
7676
int DER_w_ulong(WPACKET *pkt, int tag, unsigned long v);
7777
int DER_w_bn(WPACKET *pkt, int tag, const BIGNUM *v);
7878
int DER_w_null(WPACKET *pkt, int tag);
79+
int DER_w_octet_string(WPACKET *pkt, int tag,
80+
const unsigned char *data, size_t data_n);
81+
int DER_w_octet_string_uint32(WPACKET *pkt, int tag, uint32_t value);
7982

8083
/*
8184
* All constructors for constructed elements have a begin and a end function

‎providers/common/der/build.info

+14-1
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,17 @@ DEPEND[${DER_EC_GEN/.c/.o}]=$DER_EC_H
5050
GENERATE[$DER_EC_H]=der_ec.h.in
5151
DEPEND[$DER_EC_H]=oids_to_c.pm
5252

53+
#----- KEY WRAP
54+
$DER_WRAP_H=../include/prov/der_wrap.h
55+
$DER_WRAP_GEN=der_wrap_gen.c
56+
57+
GENERATE[$DER_WRAP_GEN]=der_wrap_gen.c.in
58+
DEPEND[$DER_WRAP_GEN]=oids_to_c.pm
59+
60+
DEPEND[${DER_WRAP_GEN/.c/.o}]=$DER_WRAP_H
61+
GENERATE[$DER_WRAP_H]=der_wrap.h.in
62+
DEPEND[$DER_WRAP_H]=oids_to_c.pm
63+
5364
#----- Conclusion
5465

5566
# TODO(3.0) $COMMON should go to libcommon.a, but this currently leads
@@ -59,6 +70,8 @@ $COMMON=\
5970
$DER_RSA_COMMON \
6071
$DER_DSA_GEN $DER_DSA_AUX \
6172
$DER_EC_GEN $DER_EC_AUX \
62-
$DER_DIGESTS_GEN
73+
$DER_DIGESTS_GEN \
74+
$DER_WRAP_GEN
75+
6376
SOURCE[../../libfips.a]=$COMMON $DER_RSA_FIPSABLE
6477
SOURCE[../../libnonfips.a]=$COMMON $DER_RSA_FIPSABLE

‎providers/common/der/der_wrap.h.in

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
/*
2+
* Copyright 2020 The OpenSSL Project Authors. All Rights Reserved.
3+
*
4+
* Licensed under the Apache License 2.0 (the "License"). You may not use
5+
* this file except in compliance with the License. You can obtain a copy
6+
* in the file LICENSE in the source distribution or at
7+
* https://www.openssl.org/source/license.html
8+
*/
9+
10+
#include "internal/der.h"
11+
12+
/* Well known OIDs precompiled */
13+
{-
14+
$OUT = oids_to_c::process_leaves('providers/common/der/wrap.asn1',
15+
{ dir => $config{sourcedir},
16+
filter => \&oids_to_c::filter_to_H });
17+
-}

‎providers/common/der/der_wrap_gen.c.in

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
/*
2+
* Copyright 2020 The OpenSSL Project Authors. All Rights Reserved.
3+
*
4+
* Licensed under the Apache License 2.0 (the "License"). You may not use
5+
* this file except in compliance with the License. You can obtain a copy
6+
* in the file LICENSE in the source distribution or at
7+
* https://www.openssl.org/source/license.html
8+
*/
9+
10+
#include "prov/der_wrap.h"
11+
12+
/* Well known OIDs precompiled */
13+
{-
14+
$OUT = oids_to_c::process_leaves('providers/common/der/wrap.asn1',
15+
{ dir => $config{sourcedir},
16+
filter => \&oids_to_c::filter_to_C });
17+
-}

‎providers/common/der/wrap.asn1

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
-- -------------------------------------------------------------------
2+
-- Taken from RFC 3370, Section 4.3.1 Triple-DES Key Wrap
3+
-- (https://tools.ietf.org/html/rfc3370)
4+
5+
id-alg-CMS3DESwrap OBJECT IDENTIFIER ::= {
6+
iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) alg(3) 6
7+
}
8+
9+
-- -------------------------------------------------------------------
10+
-- Taken from RFC 3394, Section 3. Object Identifiers
11+
-- (https://tools.ietf.org/html/rfc3565)
12+
13+
aes OBJECT IDENTIFIER ::= {
14+
joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3) nistAlgorithm(4) 1
15+
}
16+
17+
id-aes128-wrap OBJECT IDENTIFIER ::= { aes 5 }
18+
id-aes192-wrap OBJECT IDENTIFIER ::= { aes 25 }
19+
id-aes256-wrap OBJECT IDENTIFIER ::= { aes 45 }

‎providers/implementations/exchange/ecdh_exch.c

-2
Original file line numberDiff line numberDiff line change
@@ -521,8 +521,6 @@ int ecdh_derive(void *vpecdhctx, unsigned char *secret,
521521
return 0;
522522
}
523523

524-
525-
526524
const OSSL_DISPATCH ecdh_keyexch_functions[] = {
527525
{ OSSL_FUNC_KEYEXCH_NEWCTX, (void (*)(void))ecdh_newctx },
528526
{ OSSL_FUNC_KEYEXCH_INIT, (void (*)(void))ecdh_init },

‎providers/implementations/kdfs/build.info

+1
Original file line numberDiff line numberDiff line change
@@ -30,3 +30,4 @@ SOURCE[$SSKDF_GOAL]=sskdf.c
3030
SOURCE[$SCRYPT_GOAL]=scrypt.c
3131
SOURCE[$SSHKDF_GOAL]=sshkdf.c
3232
SOURCE[$X942KDF_GOAL]=x942kdf.c
33+
DEPEND[x942kdf.o]=../../common/include/prov/der_wrap.h

0 commit comments

Comments
 (0)