kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
d7c5368a0f
boringssl/include/openssl/pkcs8.h

185 lines
8.1 KiB
C
Raw Normal View History

Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
* project 1999.
*/
/* ====================================================================
* Copyright (c) 1999 The OpenSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. All advertising materials mentioning features or use of this
* software must display the following acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
*
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
* endorse or promote products derived from this software without
* prior written permission. For written permission, please contact
* licensing@OpenSSL.org.
*
* 5. Products derived from this software may not be called "OpenSSL"
* nor may "OpenSSL" appear in their names without prior written
* permission of the OpenSSL Project.
*
* 6. Redistributions of any form whatsoever must retain the following
* acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
*
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
* ====================================================================
*
* This product includes cryptographic software written by Eric Young
* (eay@cryptsoft.com). This product includes software written by Tim
* Hudson (tjh@cryptsoft.com). */
#ifndef OPENSSL_HEADER_PKCS8_H
#define OPENSSL_HEADER_PKCS8_H
#include <openssl/base.h>
#include <openssl/x509.h>
#if defined(__cplusplus)
extern "C" {
#endif
Add PKCS8_{decrypt,encrypt}_pbe. The original functions do an ascii_to_ucs2 transformation on the password. Deprecate them in favor of making that encoding the caller's problem. ascii_to_ucs2 doesn't handle, say, UTF-8 anyway. And with the original OpenSSL function, some ciphers would do the transformation, and some wouldn't making the text-string/bytes-string confusion even messier. BUG=399121 Change-Id: I7d1cea20a260f21eec2e8ffb7cd6be239fe92873 Reviewed-on: https://boringssl-review.googlesource.com/1347 Reviewed-by: Adam Langley <agl@google.com>
2014-07-31 18:59:47 +01:00
/* PKCS8_encrypt_pbe serializes and encrypts a PKCS8_PRIV_KEY_INFO with PBES1 as
Add PKCS#12 parser. This is cleaner than the OpenSSL code was, at least, but it's hardly beautiful due to the "standard" that it's trying to implement. (See [1].) The references from the PKCS#8 code to various ciphers have digests have been made into function pointer references rather than NIDs so that the linker will be able to drop RC2 code for binaries that don't call PKCS#8 or #12 functions. A bug that crashed OpenSSL/BoringSSL when parsing a malformed PKCS#8 structure has been fixed too. See https://www.cs.auckland.ac.nz/~pgut001/pubs/pfx.html Change-Id: Iaa1039e04ed7877b90792835e8ce3ebc3b29f89e Reviewed-on: https://boringssl-review.googlesource.com/1592 Reviewed-by: Adam Langley <agl@google.com>
2014-08-21 22:11:39 +01:00
* defined in PKCS #5. Only pbeWithSHAAnd128BitRC4,
* pbeWithSHAAnd3-KeyTripleDES-CBC and pbeWithSHA1And40BitRC2, defined in PKCS
* #12, are supported. The |pass_raw_len| bytes pointed to by |pass_raw| are
* used as the password. Note that any conversions from the password as
* supplied in a text string (such as those specified in B.1 of PKCS #12) must
* be performed by the caller.
Add PKCS8_{decrypt,encrypt}_pbe. The original functions do an ascii_to_ucs2 transformation on the password. Deprecate them in favor of making that encoding the caller's problem. ascii_to_ucs2 doesn't handle, say, UTF-8 anyway. And with the original OpenSSL function, some ciphers would do the transformation, and some wouldn't making the text-string/bytes-string confusion even messier. BUG=399121 Change-Id: I7d1cea20a260f21eec2e8ffb7cd6be239fe92873 Reviewed-on: https://boringssl-review.googlesource.com/1347 Reviewed-by: Adam Langley <agl@google.com>
2014-07-31 18:59:47 +01:00
*
* If |salt| is NULL, a random salt of |salt_len| bytes is generated. If
* |salt_len| is zero, a default salt length is used instead.
*
* The resulting structure is stored in an X509_SIG which must be freed by the
* caller.
*
* TODO(davidben): Really? An X509_SIG? OpenSSL probably did that because it has
* the same structure as EncryptedPrivateKeyInfo. */
OPENSSL_EXPORT X509_SIG *PKCS8_encrypt_pbe(int pbe_nid,
const uint8_t *pass_raw,
size_t pass_raw_len,
uint8_t *salt, size_t salt_len,
int iterations,
PKCS8_PRIV_KEY_INFO *p8inf);
/* PKCS8_decrypt_pbe decrypts and decodes a PKCS8_PRIV_KEY_INFO with PBES1 as
Add PKCS#12 parser. This is cleaner than the OpenSSL code was, at least, but it's hardly beautiful due to the "standard" that it's trying to implement. (See [1].) The references from the PKCS#8 code to various ciphers have digests have been made into function pointer references rather than NIDs so that the linker will be able to drop RC2 code for binaries that don't call PKCS#8 or #12 functions. A bug that crashed OpenSSL/BoringSSL when parsing a malformed PKCS#8 structure has been fixed too. See https://www.cs.auckland.ac.nz/~pgut001/pubs/pfx.html Change-Id: Iaa1039e04ed7877b90792835e8ce3ebc3b29f89e Reviewed-on: https://boringssl-review.googlesource.com/1592 Reviewed-by: Adam Langley <agl@google.com>
2014-08-21 22:11:39 +01:00
* defined in PKCS #5. Only pbeWithSHAAnd128BitRC4,
* pbeWithSHAAnd3-KeyTripleDES-CBC and pbeWithSHA1And40BitRC2, defined in PKCS
* #12, are supported. The |pass_raw_len| bytes pointed to by |pass_raw| are
* used as the password. Note that any conversions from the password as
* supplied in a text string (such as those specified in B.1 of PKCS #12) must
* be performed by the caller.
Add PKCS8_{decrypt,encrypt}_pbe. The original functions do an ascii_to_ucs2 transformation on the password. Deprecate them in favor of making that encoding the caller's problem. ascii_to_ucs2 doesn't handle, say, UTF-8 anyway. And with the original OpenSSL function, some ciphers would do the transformation, and some wouldn't making the text-string/bytes-string confusion even messier. BUG=399121 Change-Id: I7d1cea20a260f21eec2e8ffb7cd6be239fe92873 Reviewed-on: https://boringssl-review.googlesource.com/1347 Reviewed-by: Adam Langley <agl@google.com>
2014-07-31 18:59:47 +01:00
*
* The resulting structure must be freed by the caller. */
OPENSSL_EXPORT PKCS8_PRIV_KEY_INFO *PKCS8_decrypt_pbe(X509_SIG *pkcs8,
const uint8_t *pass_raw,
size_t pass_raw_len);
/* Deprecated functions. */
/* PKCS8_encrypt calls PKCS8_encrypt_pbe after treating |pass| as an ASCII
* string, appending U+0000, and converting to UCS-2. (So the empty password
* encodes as two NUL bytes.) The |cipher| argument is ignored. */
Add visibility rules. This change marks public symbols as dynamically exported. This means that it becomes viable to build a shared library of libcrypto and libssl with -fvisibility=hidden. On Windows, one not only needs to mark functions for export in a component, but also for import when using them from a different component. Because of this we have to build with |BORINGSSL_IMPLEMENTATION| defined when building the code. Other components, when including our headers, won't have that defined and then the |OPENSSL_EXPORT| tag becomes an import tag instead. See the #defines in base.h In the asm code, symbols are now hidden by default and those that need to be exported are wrapped by a C function. In order to support Chromium, a couple of libssl functions were moved to ssl.h from ssl_locl.h: ssl_get_new_session and ssl_update_cache. Change-Id: Ib4b76e2f1983ee066e7806c24721e8626d08a261 Reviewed-on: https://boringssl-review.googlesource.com/1350 Reviewed-by: Adam Langley <agl@google.com>
2014-07-31 00:02:14 +01:00
OPENSSL_EXPORT X509_SIG *PKCS8_encrypt(int pbe_nid, const EVP_CIPHER *cipher,
const char *pass, int pass_len,
uint8_t *salt, size_t salt_len,
int iterations,
PKCS8_PRIV_KEY_INFO *p8inf);
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
Add PKCS8_{decrypt,encrypt}_pbe. The original functions do an ascii_to_ucs2 transformation on the password. Deprecate them in favor of making that encoding the caller's problem. ascii_to_ucs2 doesn't handle, say, UTF-8 anyway. And with the original OpenSSL function, some ciphers would do the transformation, and some wouldn't making the text-string/bytes-string confusion even messier. BUG=399121 Change-Id: I7d1cea20a260f21eec2e8ffb7cd6be239fe92873 Reviewed-on: https://boringssl-review.googlesource.com/1347 Reviewed-by: Adam Langley <agl@google.com>
2014-07-31 18:59:47 +01:00
/* PKCS8_decrypt calls PKCS8_decrypt_pbe after treating |pass| as an ASCII
* string, appending U+0000, and converting to UCS-2. (So the empty password
* encodes as two NUL bytes.) */
Add visibility rules. This change marks public symbols as dynamically exported. This means that it becomes viable to build a shared library of libcrypto and libssl with -fvisibility=hidden. On Windows, one not only needs to mark functions for export in a component, but also for import when using them from a different component. Because of this we have to build with |BORINGSSL_IMPLEMENTATION| defined when building the code. Other components, when including our headers, won't have that defined and then the |OPENSSL_EXPORT| tag becomes an import tag instead. See the #defines in base.h In the asm code, symbols are now hidden by default and those that need to be exported are wrapped by a C function. In order to support Chromium, a couple of libssl functions were moved to ssl.h from ssl_locl.h: ssl_get_new_session and ssl_update_cache. Change-Id: Ib4b76e2f1983ee066e7806c24721e8626d08a261 Reviewed-on: https://boringssl-review.googlesource.com/1350 Reviewed-by: Adam Langley <agl@google.com>
2014-07-31 00:02:14 +01:00
OPENSSL_EXPORT PKCS8_PRIV_KEY_INFO *PKCS8_decrypt(X509_SIG *pkcs8,
const char *pass,
int pass_len);
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
Add PKCS#12 parser. This is cleaner than the OpenSSL code was, at least, but it's hardly beautiful due to the "standard" that it's trying to implement. (See [1].) The references from the PKCS#8 code to various ciphers have digests have been made into function pointer references rather than NIDs so that the linker will be able to drop RC2 code for binaries that don't call PKCS#8 or #12 functions. A bug that crashed OpenSSL/BoringSSL when parsing a malformed PKCS#8 structure has been fixed too. See https://www.cs.auckland.ac.nz/~pgut001/pubs/pfx.html Change-Id: Iaa1039e04ed7877b90792835e8ce3ebc3b29f89e Reviewed-on: https://boringssl-review.googlesource.com/1592 Reviewed-by: Adam Langley <agl@google.com>
2014-08-21 22:11:39 +01:00
/* PKCS12_get_key_and_certs parses a PKCS#12 structure from |in|, authenticates
* and decrypts it using |password|, sets |*out_key| to the included private
* key and appends the included certificates to |out_certs|. It returns one on
* success and zero on error. The caller takes ownership of the outputs. */
OPENSSL_EXPORT int PKCS12_get_key_and_certs(EVP_PKEY **out_key,
STACK_OF(X509) *out_certs,
CBS *in, const char *password);
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
#if defined(__cplusplus)
} /* extern C */
#endif
#define PKCS8_F_PKCS8_encrypt 100
#define PKCS8_F_EVP_PKEY2PKCS8 101
#define PKCS8_F_EVP_PKCS82PKEY 102
#define PKCS8_F_PKCS5_pbe_set0_algor 103
#define PKCS8_F_pbe_crypt 104
#define PKCS8_F_pkcs12_item_decrypt_d2i 105
#define PKCS8_F_PKCS5_pbe_set 106
#define PKCS8_F_pkcs12_key_gen_uni 107
#define PKCS8_F_pkcs12_key_gen_asc 108
#define PKCS8_F_pkcs12_pbe_keyivgen 109
#define PKCS8_F_pbe_cipher_init 110
#define PKCS8_F_pkcs12_item_i2d_encrypt 111
#define PKCS8_F_PKCS5_pbe2_set_iv 112
#define PKCS8_F_PKCS5_pbkdf2_set 113
Add PKCS8_{decrypt,encrypt}_pbe. The original functions do an ascii_to_ucs2 transformation on the password. Deprecate them in favor of making that encoding the caller's problem. ascii_to_ucs2 doesn't handle, say, UTF-8 anyway. And with the original OpenSSL function, some ciphers would do the transformation, and some wouldn't making the text-string/bytes-string confusion even messier. BUG=399121 Change-Id: I7d1cea20a260f21eec2e8ffb7cd6be239fe92873 Reviewed-on: https://boringssl-review.googlesource.com/1347 Reviewed-by: Adam Langley <agl@google.com>
2014-07-31 18:59:47 +01:00
#define PKCS8_F_pkcs12_key_gen_raw 114
#define PKCS8_F_PKCS8_decrypt 115
#define PKCS8_F_PKCS8_encrypt_pbe 116
Add PKCS#12 parser. This is cleaner than the OpenSSL code was, at least, but it's hardly beautiful due to the "standard" that it's trying to implement. (See [1].) The references from the PKCS#8 code to various ciphers have digests have been made into function pointer references rather than NIDs so that the linker will be able to drop RC2 code for binaries that don't call PKCS#8 or #12 functions. A bug that crashed OpenSSL/BoringSSL when parsing a malformed PKCS#8 structure has been fixed too. See https://www.cs.auckland.ac.nz/~pgut001/pubs/pfx.html Change-Id: Iaa1039e04ed7877b90792835e8ce3ebc3b29f89e Reviewed-on: https://boringssl-review.googlesource.com/1592 Reviewed-by: Adam Langley <agl@google.com>
2014-08-21 22:11:39 +01:00
#define PKCS8_F_PKCS12_parse 117
#define PKCS8_F_PKCS12_handle_content_info 118
#define PKCS8_F_PKCS12_handle_content_infos 119
#define PKCS8_F_PKCS12_get_key_and_certs 120
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
#define PKCS8_R_ERROR_SETTING_CIPHER_PARAMS 100
#define PKCS8_R_PRIVATE_KEY_ENCODE_ERROR 101
#define PKCS8_R_UNKNOWN_ALGORITHM 102
#define PKCS8_R_UNKNOWN_CIPHER 103
#define PKCS8_R_UNKNOWN_DIGEST 104
#define PKCS8_R_ENCODE_ERROR 105
#define PKCS8_R_DECODE_ERROR 106
#define PKCS8_R_ENCRYPT_ERROR 107
#define PKCS8_R_UNSUPPORTED_PRIVATE_KEY_ALGORITHM 108
#define PKCS8_R_PRIVATE_KEY_DECODE_ERROR 109
#define PKCS8_R_UNKNOWN_CIPHER_ALGORITHM 110
#define PKCS8_R_KEYGEN_FAILURE 111
#define PKCS8_R_TOO_LONG 112
#define PKCS8_R_CRYPT_ERROR 113
#define PKCS8_R_METHOD_NOT_SUPPORTED 114
#define PKCS8_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER 115
#define PKCS8_R_KEY_GEN_ERROR 116
Add PKCS#12 parser. This is cleaner than the OpenSSL code was, at least, but it's hardly beautiful due to the "standard" that it's trying to implement. (See [1].) The references from the PKCS#8 code to various ciphers have digests have been made into function pointer references rather than NIDs so that the linker will be able to drop RC2 code for binaries that don't call PKCS#8 or #12 functions. A bug that crashed OpenSSL/BoringSSL when parsing a malformed PKCS#8 structure has been fixed too. See https://www.cs.auckland.ac.nz/~pgut001/pubs/pfx.html Change-Id: Iaa1039e04ed7877b90792835e8ce3ebc3b29f89e Reviewed-on: https://boringssl-review.googlesource.com/1592 Reviewed-by: Adam Langley <agl@google.com>
2014-08-21 22:11:39 +01:00
#define PKCS8_R_BAD_PKCS12_DATA 117
#define PKCS8_R_PKCS12_PUBLIC_KEY_INTEGRITY_NOT_SUPPORTED 118
#define PKCS8_R_BAD_PKCS12_VERSION 119
#define PKCS8_R_PKCS12_TOO_DEEPLY_NESTED 120
#define PKCS8_R_MULTIPLE_PRIVATE_KEYS_IN_PKCS12 121
#define PKCS8_R_UNKNOWN_HASH 122
#define PKCS8_R_BAD_MAC 123
#define PKCS8_R_MISSING_MAC 124
#define PKCS8_R_INCORRECT_PASSWORD 125
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
#endif /* OPENSSL_HEADER_PKCS8_H */
Reference in New Issue Copy Permalink