kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Decouple PBE lookup from the OID table.

Browse Source 
BUG=54

Change-Id: Ia792dadcbda4efb22b45ae69a6e425ae2b341f61
Reviewed-on: https://boringssl-review.googlesource.com/14210
Reviewed-by: Steven Valdez <svaldez@google.com>
Commit-Queue: Steven Valdez <svaldez@google.com>
CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
This commit is contained in:
David Benjamin 2017-03-14 00:34:49 -04:00 committed by CQ bot account: commit-bot@chromium.org
parent cfb9d147bb
commit 1d4fa785bc
2 changed files with 45 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
crypto/pkcs8/internal.h
View File

@ -67,6 +67,8 @@ extern "C" {
struct pbe_suite { struct pbe_suite {
int pbe_nid; int pbe_nid;
uint8_t oid[10];
uint8_t oid_len;
const EVP_CIPHER *(*cipher_func)(void); const EVP_CIPHER *(*cipher_func)(void);
const EVP_MD *(*md_func)(void); const EVP_MD *(*md_func)(void);
/* decrypt_init initialize |ctx| for decrypting. The password is specified by /* decrypt_init initialize |ctx| for decrypting. The password is specified by

55
crypto/pkcs8/pkcs8.c
View File

@ -278,25 +278,49 @@ static int pkcs12_pbe_decrypt_init(const struct pbe_suite *suite,
static const struct pbe_suite kBuiltinPBE[] = { static const struct pbe_suite kBuiltinPBE[] = {
{ {
NID_pbe_WithSHA1And40BitRC2_CBC, EVP_rc2_40_cbc, EVP_sha1, NID_pbe_WithSHA1And40BitRC2_CBC,
pkcs12_pbe_decrypt_init, PBE_UCS2_CONVERT_PASSWORD, /* 1.2.840.113549.1.12.1.6 */
{0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x0c, 0x01, 0x06},
10,
EVP_rc2_40_cbc,
EVP_sha1,
pkcs12_pbe_decrypt_init,
PBE_UCS2_CONVERT_PASSWORD,
}, },
{ {
NID_pbe_WithSHA1And128BitRC4, EVP_rc4, EVP_sha1, NID_pbe_WithSHA1And128BitRC4,
pkcs12_pbe_decrypt_init, PBE_UCS2_CONVERT_PASSWORD, /* 1.2.840.113549.1.12.1.1 */
{0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x0c, 0x01, 0x01},
10,
EVP_rc4,
EVP_sha1,
pkcs12_pbe_decrypt_init,
PBE_UCS2_CONVERT_PASSWORD,
}, },
{ {
NID_pbe_WithSHA1And3_Key_TripleDES_CBC, EVP_des_ede3_cbc, EVP_sha1, NID_pbe_WithSHA1And3_Key_TripleDES_CBC,
pkcs12_pbe_decrypt_init, PBE_UCS2_CONVERT_PASSWORD, /* 1.2.840.113549.1.12.1.3 */
{0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x0c, 0x01, 0x03},
10,
EVP_des_ede3_cbc,
EVP_sha1,
pkcs12_pbe_decrypt_init,
PBE_UCS2_CONVERT_PASSWORD,
}, },
{ {
NID_pbes2, NULL, NULL, PKCS5_pbe2_decrypt_init, 0, NID_pbes2,
/* 1.2.840.113549.1.5.13 */
{0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x05, 0x0d},
9,
NULL,
NULL,
PKCS5_pbe2_decrypt_init,
0,
}, },
}; };
static const struct pbe_suite *get_pbe_suite(int pbe_nid) { static const struct pbe_suite *get_pbe_suite(int pbe_nid) {
unsigned i; for (unsigned i = 0; i < OPENSSL_ARRAY_SIZE(kBuiltinPBE); i++) {
for (i = 0; i < OPENSSL_ARRAY_SIZE(kBuiltinPBE); i++) {
if (kBuiltinPBE[i].pbe_nid == pbe_nid) { if (kBuiltinPBE[i].pbe_nid == pbe_nid) {
return &kBuiltinPBE[i]; return &kBuiltinPBE[i];
} }
@ -358,9 +382,10 @@ static int pkcs12_pbe_encrypt_init(CBB *out, EVP_CIPHER_CTX *ctx, int alg,
} }
/* See RFC 2898, appendix A.3. */ /* See RFC 2898, appendix A.3. */
CBB algorithm, param, salt_cbb; CBB algorithm, oid, param, salt_cbb;
if (!CBB_add_asn1(out, &algorithm, CBS_ASN1_SEQUENCE) || if (!CBB_add_asn1(out, &algorithm, CBS_ASN1_SEQUENCE) ||
!OBJ_nid2cbb(&algorithm, alg) || !CBB_add_asn1(&algorithm, &oid, CBS_ASN1_OBJECT) ||
!CBB_add_bytes(&oid, suite->oid, suite->oid_len) ||
!CBB_add_asn1(&algorithm, &param, CBS_ASN1_SEQUENCE) || !CBB_add_asn1(&algorithm, &param, CBS_ASN1_SEQUENCE) ||
!CBB_add_asn1(&param, &salt_cbb, CBS_ASN1_OCTETSTRING) || !CBB_add_asn1(&param, &salt_cbb, CBS_ASN1_OCTETSTRING) ||
!CBB_add_bytes(&salt_cbb, salt, salt_len) || !CBB_add_bytes(&salt_cbb, salt, salt_len) ||
@ -387,7 +412,13 @@ static int pbe_decrypt(uint8_t **out, size_t *out_len, CBS *algorithm,
goto err; goto err;
} }
const struct pbe_suite *suite = get_pbe_suite(OBJ_cbs2nid(&obj)); const struct pbe_suite *suite = NULL;
for (unsigned i = 0; i < OPENSSL_ARRAY_SIZE(kBuiltinPBE); i++) {
if (CBS_mem_equal(&obj, kBuiltinPBE[i].oid, kBuiltinPBE[i].oid_len)) {
suite = &kBuiltinPBE[i];
break;
}
}
if (suite == NULL) { if (suite == NULL) {
OPENSSL_PUT_ERROR(PKCS8, PKCS8_R_UNKNOWN_ALGORITHM); OPENSSL_PUT_ERROR(PKCS8, PKCS8_R_UNKNOWN_ALGORITHM);
goto err; goto err;