They're not called externally. Unexporting these will make it easier to rewrite the PKCS{5,8,12} code to use CBS/CBB rather than X509_ALGOR. Getting rid of those callers in Chromium probably won't happen for a while since it's in our on-disk formats. (And a unit test for some NSS client cert glue uses it.) BUG=54 Change-Id: Id4148a2ad567484782a6e0322b68dde0619159fc Reviewed-on: https://boringssl-review.googlesource.com/13062 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <alangley@gmail.com>kris/onging/CECPQ3_patch15
@@ -66,6 +66,27 @@ extern "C" { | |||||
#define PKCS5_DEFAULT_ITERATIONS 2048 | #define PKCS5_DEFAULT_ITERATIONS 2048 | ||||
#define PKCS5_SALT_LEN 8 | #define PKCS5_SALT_LEN 8 | ||||
typedef struct { | |||||
ASN1_OCTET_STRING *salt; | |||||
ASN1_INTEGER *iter; | |||||
} PBEPARAM; | |||||
typedef struct { | |||||
X509_ALGOR *keyfunc; | |||||
X509_ALGOR *encryption; | |||||
} PBE2PARAM; | |||||
typedef struct { | |||||
ASN1_TYPE *salt; /* Usually OCTET STRING but could be anything */ | |||||
ASN1_INTEGER *iter; | |||||
ASN1_INTEGER *keylength; | |||||
X509_ALGOR *prf; | |||||
} PBKDF2PARAM; | |||||
DECLARE_ASN1_FUNCTIONS(PBEPARAM) | |||||
DECLARE_ASN1_FUNCTIONS(PBE2PARAM) | |||||
DECLARE_ASN1_FUNCTIONS(PBKDF2PARAM) | |||||
/* PKCS5_v2_PBE_keyivgen intializes the supplied |ctx| for PBKDF v2, which must | /* PKCS5_v2_PBE_keyivgen intializes the supplied |ctx| for PBKDF v2, which must | ||||
* be specified by |param|. The password is specified by |pass_raw| and | * be specified by |param|. The password is specified by |pass_raw| and | ||||
* |pass_raw_len|. |cipher| and |md| are ignored. | * |pass_raw_len|. |cipher| and |md| are ignored. | ||||
@@ -75,6 +96,11 @@ int PKCS5_v2_PBE_keyivgen(EVP_CIPHER_CTX *ctx, const uint8_t *pass_raw, | |||||
size_t pass_raw_len, ASN1_TYPE *param, | size_t pass_raw_len, ASN1_TYPE *param, | ||||
const EVP_CIPHER *cipher, const EVP_MD *md, int enc); | const EVP_CIPHER *cipher, const EVP_MD *md, int enc); | ||||
X509_ALGOR *PKCS5_pbe_set(int alg, int iter, const unsigned char *salt, | |||||
int saltlen); | |||||
X509_ALGOR *PKCS5_pbe2_set(const EVP_CIPHER *cipher, int iter, | |||||
unsigned char *salt, int saltlen); | |||||
#if defined(__cplusplus) | #if defined(__cplusplus) | ||||
} /* extern C */ | } /* extern C */ | ||||
@@ -78,7 +78,7 @@ IMPLEMENT_ASN1_FUNCTIONS(PBEPARAM) | |||||
/* Set an algorithm identifier for a PKCS#5 PBE algorithm */ | /* Set an algorithm identifier for a PKCS#5 PBE algorithm */ | ||||
int PKCS5_pbe_set0_algor(X509_ALGOR *algor, int alg, int iter, | |||||
static int PKCS5_pbe_set0_algor(X509_ALGOR *algor, int alg, int iter, | |||||
const unsigned char *salt, int saltlen) | const unsigned char *salt, int saltlen) | ||||
{ | { | ||||
PBEPARAM *pbe=NULL; | PBEPARAM *pbe=NULL; | ||||
@@ -110,14 +110,95 @@ static int param_to_asn1(EVP_CIPHER_CTX *c, ASN1_TYPE *type) | |||||
return ASN1_TYPE_set_octetstring(type, c->oiv, iv_len); | return ASN1_TYPE_set_octetstring(type, c->oiv, iv_len); | ||||
} | } | ||||
static X509_ALGOR *PKCS5_pbkdf2_set(int iter, unsigned char *salt, int saltlen, | |||||
int prf_nid, int keylen) | |||||
{ | |||||
X509_ALGOR *keyfunc = NULL; | |||||
PBKDF2PARAM *kdf = NULL; | |||||
ASN1_OCTET_STRING *osalt = NULL; | |||||
if(!(kdf = PBKDF2PARAM_new())) | |||||
goto merr; | |||||
if(!(osalt = M_ASN1_OCTET_STRING_new())) | |||||
goto merr; | |||||
kdf->salt->value.octet_string = osalt; | |||||
kdf->salt->type = V_ASN1_OCTET_STRING; | |||||
if (!saltlen) | |||||
saltlen = PKCS5_SALT_LEN; | |||||
if (!(osalt->data = OPENSSL_malloc (saltlen))) | |||||
goto merr; | |||||
osalt->length = saltlen; | |||||
if (salt) | |||||
OPENSSL_memcpy (osalt->data, salt, saltlen); | |||||
else if (!RAND_bytes(osalt->data, saltlen)) | |||||
goto merr; | |||||
if(iter <= 0) | |||||
iter = PKCS5_DEFAULT_ITERATIONS; | |||||
if(!ASN1_INTEGER_set(kdf->iter, iter)) | |||||
goto merr; | |||||
/* If have a key len set it up */ | |||||
if(keylen > 0) | |||||
{ | |||||
if(!(kdf->keylength = M_ASN1_INTEGER_new())) | |||||
goto merr; | |||||
if(!ASN1_INTEGER_set (kdf->keylength, keylen)) | |||||
goto merr; | |||||
} | |||||
/* prf can stay NULL if we are using hmacWithSHA1 */ | |||||
if (prf_nid > 0 && prf_nid != NID_hmacWithSHA1) | |||||
{ | |||||
kdf->prf = X509_ALGOR_new(); | |||||
if (!kdf->prf) | |||||
goto merr; | |||||
X509_ALGOR_set0(kdf->prf, OBJ_nid2obj(prf_nid), | |||||
V_ASN1_NULL, NULL); | |||||
} | |||||
/* Finally setup the keyfunc structure */ | |||||
keyfunc = X509_ALGOR_new(); | |||||
if (!keyfunc) | |||||
goto merr; | |||||
keyfunc->algorithm = (ASN1_OBJECT*) OBJ_nid2obj(NID_id_pbkdf2); | |||||
/* Encode PBKDF2PARAM into parameter of pbe2 */ | |||||
if(!(keyfunc->parameter = ASN1_TYPE_new())) | |||||
goto merr; | |||||
if(!ASN1_item_pack(kdf, ASN1_ITEM_rptr(PBKDF2PARAM), | |||||
&keyfunc->parameter->value.sequence)) | |||||
goto merr; | |||||
keyfunc->parameter->type = V_ASN1_SEQUENCE; | |||||
PBKDF2PARAM_free(kdf); | |||||
return keyfunc; | |||||
merr: | |||||
OPENSSL_PUT_ERROR(PKCS8, ERR_R_MALLOC_FAILURE); | |||||
PBKDF2PARAM_free(kdf); | |||||
X509_ALGOR_free(keyfunc); | |||||
return NULL; | |||||
} | |||||
/* Return an algorithm identifier for a PKCS#5 v2.0 PBE algorithm: | /* Return an algorithm identifier for a PKCS#5 v2.0 PBE algorithm: | ||||
* yes I know this is horrible! | * yes I know this is horrible! | ||||
* | * | ||||
* Extended version to allow application supplied PRF NID and IV. */ | * Extended version to allow application supplied PRF NID and IV. */ | ||||
X509_ALGOR *PKCS5_pbe2_set_iv(const EVP_CIPHER *cipher, int iter, | |||||
unsigned char *salt, int saltlen, | |||||
unsigned char *aiv, int prf_nid) | |||||
static X509_ALGOR *PKCS5_pbe2_set_iv(const EVP_CIPHER *cipher, int iter, | |||||
unsigned char *salt, int saltlen, | |||||
unsigned char *aiv, int prf_nid) | |||||
{ | { | ||||
X509_ALGOR *scheme = NULL, *kalg = NULL, *ret = NULL; | X509_ALGOR *scheme = NULL, *kalg = NULL, *ret = NULL; | ||||
int alg_nid, keylen; | int alg_nid, keylen; | ||||
@@ -224,87 +305,6 @@ X509_ALGOR *PKCS5_pbe2_set(const EVP_CIPHER *cipher, int iter, | |||||
return PKCS5_pbe2_set_iv(cipher, iter, salt, saltlen, NULL, -1); | return PKCS5_pbe2_set_iv(cipher, iter, salt, saltlen, NULL, -1); | ||||
} | } | ||||
X509_ALGOR *PKCS5_pbkdf2_set(int iter, unsigned char *salt, int saltlen, | |||||
int prf_nid, int keylen) | |||||
{ | |||||
X509_ALGOR *keyfunc = NULL; | |||||
PBKDF2PARAM *kdf = NULL; | |||||
ASN1_OCTET_STRING *osalt = NULL; | |||||
if(!(kdf = PBKDF2PARAM_new())) | |||||
goto merr; | |||||
if(!(osalt = M_ASN1_OCTET_STRING_new())) | |||||
goto merr; | |||||
kdf->salt->value.octet_string = osalt; | |||||
kdf->salt->type = V_ASN1_OCTET_STRING; | |||||
if (!saltlen) | |||||
saltlen = PKCS5_SALT_LEN; | |||||
if (!(osalt->data = OPENSSL_malloc (saltlen))) | |||||
goto merr; | |||||
osalt->length = saltlen; | |||||
if (salt) | |||||
OPENSSL_memcpy (osalt->data, salt, saltlen); | |||||
else if (!RAND_bytes(osalt->data, saltlen)) | |||||
goto merr; | |||||
if(iter <= 0) | |||||
iter = PKCS5_DEFAULT_ITERATIONS; | |||||
if(!ASN1_INTEGER_set(kdf->iter, iter)) | |||||
goto merr; | |||||
/* If have a key len set it up */ | |||||
if(keylen > 0) | |||||
{ | |||||
if(!(kdf->keylength = M_ASN1_INTEGER_new())) | |||||
goto merr; | |||||
if(!ASN1_INTEGER_set (kdf->keylength, keylen)) | |||||
goto merr; | |||||
} | |||||
/* prf can stay NULL if we are using hmacWithSHA1 */ | |||||
if (prf_nid > 0 && prf_nid != NID_hmacWithSHA1) | |||||
{ | |||||
kdf->prf = X509_ALGOR_new(); | |||||
if (!kdf->prf) | |||||
goto merr; | |||||
X509_ALGOR_set0(kdf->prf, OBJ_nid2obj(prf_nid), | |||||
V_ASN1_NULL, NULL); | |||||
} | |||||
/* Finally setup the keyfunc structure */ | |||||
keyfunc = X509_ALGOR_new(); | |||||
if (!keyfunc) | |||||
goto merr; | |||||
keyfunc->algorithm = (ASN1_OBJECT*) OBJ_nid2obj(NID_id_pbkdf2); | |||||
/* Encode PBKDF2PARAM into parameter of pbe2 */ | |||||
if(!(keyfunc->parameter = ASN1_TYPE_new())) | |||||
goto merr; | |||||
if(!ASN1_item_pack(kdf, ASN1_ITEM_rptr(PBKDF2PARAM), | |||||
&keyfunc->parameter->value.sequence)) | |||||
goto merr; | |||||
keyfunc->parameter->type = V_ASN1_SEQUENCE; | |||||
PBKDF2PARAM_free(kdf); | |||||
return keyfunc; | |||||
merr: | |||||
OPENSSL_PUT_ERROR(PKCS8, ERR_R_MALLOC_FAILURE); | |||||
PBKDF2PARAM_free(kdf); | |||||
X509_ALGOR_free(keyfunc); | |||||
return NULL; | |||||
} | |||||
static int PKCS5_v2_PBKDF2_keyivgen(EVP_CIPHER_CTX *ctx, | static int PKCS5_v2_PBKDF2_keyivgen(EVP_CIPHER_CTX *ctx, | ||||
const uint8_t *pass_raw, | const uint8_t *pass_raw, | ||||
size_t pass_raw_len, const ASN1_TYPE *param, | size_t pass_raw_len, const ASN1_TYPE *param, | ||||
@@ -229,9 +229,6 @@ typedef struct NAME_CONSTRAINTS_st NAME_CONSTRAINTS; | |||||
typedef struct Netscape_certificate_sequence NETSCAPE_CERT_SEQUENCE; | typedef struct Netscape_certificate_sequence NETSCAPE_CERT_SEQUENCE; | ||||
typedef struct Netscape_spkac_st NETSCAPE_SPKAC; | typedef struct Netscape_spkac_st NETSCAPE_SPKAC; | ||||
typedef struct Netscape_spki_st NETSCAPE_SPKI; | typedef struct Netscape_spki_st NETSCAPE_SPKI; | ||||
typedef struct PBE2PARAM_st PBE2PARAM; | |||||
typedef struct PBEPARAM_st PBEPARAM; | |||||
typedef struct PBKDF2PARAM_st PBKDF2PARAM; | |||||
typedef struct RIPEMD160state_st RIPEMD160_CTX; | typedef struct RIPEMD160state_st RIPEMD160_CTX; | ||||
typedef struct X509_POLICY_CACHE_st X509_POLICY_CACHE; | typedef struct X509_POLICY_CACHE_st X509_POLICY_CACHE; | ||||
typedef struct X509_POLICY_LEVEL_st X509_POLICY_LEVEL; | typedef struct X509_POLICY_LEVEL_st X509_POLICY_LEVEL; | ||||
@@ -509,28 +509,6 @@ typedef struct CBCParameter_st | |||||
} CBC_PARAM; | } CBC_PARAM; | ||||
*/ | */ | ||||
/* Password based encryption structure */ | |||||
struct PBEPARAM_st { | |||||
ASN1_OCTET_STRING *salt; | |||||
ASN1_INTEGER *iter; | |||||
} /* PBEPARAM */; | |||||
/* Password based encryption V2 structures */ | |||||
struct PBE2PARAM_st { | |||||
X509_ALGOR *keyfunc; | |||||
X509_ALGOR *encryption; | |||||
} /* PBE2PARAM */; | |||||
struct PBKDF2PARAM_st { | |||||
ASN1_TYPE *salt; /* Usually OCTET STRING but could be anything */ | |||||
ASN1_INTEGER *iter; | |||||
ASN1_INTEGER *keylength; | |||||
X509_ALGOR *prf; | |||||
} /* PBKDF2PARAM */; | |||||
/* PKCS#8 private key info structure */ | /* PKCS#8 private key info structure */ | ||||
struct pkcs8_priv_key_info_st | struct pkcs8_priv_key_info_st | ||||
@@ -1090,24 +1068,6 @@ OPENSSL_EXPORT X509 *X509_find_by_issuer_and_serial(STACK_OF(X509) *sk,X509_NAME | |||||
ASN1_INTEGER *serial); | ASN1_INTEGER *serial); | ||||
OPENSSL_EXPORT X509 *X509_find_by_subject(STACK_OF(X509) *sk,X509_NAME *name); | OPENSSL_EXPORT X509 *X509_find_by_subject(STACK_OF(X509) *sk,X509_NAME *name); | ||||
DECLARE_ASN1_FUNCTIONS(PBEPARAM) | |||||
DECLARE_ASN1_FUNCTIONS(PBE2PARAM) | |||||
DECLARE_ASN1_FUNCTIONS(PBKDF2PARAM) | |||||
OPENSSL_EXPORT int PKCS5_pbe_set0_algor(X509_ALGOR *algor, int alg, int iter, | |||||
const unsigned char *salt, int saltlen); | |||||
OPENSSL_EXPORT X509_ALGOR *PKCS5_pbe_set(int alg, int iter, | |||||
const unsigned char *salt, int saltlen); | |||||
OPENSSL_EXPORT X509_ALGOR *PKCS5_pbe2_set(const EVP_CIPHER *cipher, int iter, | |||||
unsigned char *salt, int saltlen); | |||||
OPENSSL_EXPORT X509_ALGOR *PKCS5_pbe2_set_iv(const EVP_CIPHER *cipher, int iter, | |||||
unsigned char *salt, int saltlen, | |||||
unsigned char *aiv, int prf_nid); | |||||
OPENSSL_EXPORT X509_ALGOR *PKCS5_pbkdf2_set(int iter, unsigned char *salt, int saltlen, | |||||
int prf_nid, int keylen); | |||||
/* PKCS#8 utilities */ | /* PKCS#8 utilities */ | ||||
DECLARE_ASN1_FUNCTIONS(PKCS8_PRIV_KEY_INFO) | DECLARE_ASN1_FUNCTIONS(PKCS8_PRIV_KEY_INFO) | ||||