yuzu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2024-12-23 12:35:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merged support for parsing EC keys that use SpecifiedECDomain

Browse source
This commit is contained in:
Paul Bakker 2014-03-26 11:30:39 +01:00
parent 5a1d687274 86b400f0e0
commit 3f0be61a27
8 changed files with 328 additions and 21 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
ChangeLog
View file

@ -10,6 +10,7 @@ Features
(POLARSSL_ENTROPY_FORCE_SHA256)
* Testing script ssl-opt.sh added for testing 'live' ssl option
interoperability against OpenSSL and PolarSSL
* Support for reading EC keys that use SpecifiedECDomain in some cases.
Changes
* Deprecated the Memory layer

14
include/polarssl/config.h
View file

@ -587,6 +587,20 @@
*/
#define POLARSSL_KEY_EXCHANGE_ECDH_RSA_ENABLED
/**
* \def POLARSSL_PK_PARSE_EC_EXTENDED
*
* Enhance support for reading EC keys using variants of SEC1 not allowed by
* RFC 5915 and RFC 5480.
*
* Currently this means parsing the SpecifiedECDomain choice of EC
* parameters (only known groups are supported, not arbitrary domains, to
* avoid validation issues).
*
* Disable if you only need to support RFC 5915 + 5480 key formats.
*/
#define POLARSSL_PK_PARSE_EC_EXTENDED
/**
* \def POLARSSL_ERROR_STRERROR_BC
*

6
include/polarssl/ecp.h
View file

@ -376,8 +376,10 @@ int ecp_point_write_binary( const ecp_group *grp, const ecp_point *P,
* \param ilen Actual length of input
*
* \return 0 if successful,
* POLARSSL_ERR_ECP_BAD_INPUT_DATA if input is invalid
* POLARSSL_ERR_MPI_MALLOC_FAILED if memory allocation failed
* POLARSSL_ERR_ECP_BAD_INPUT_DATA if input is invalid,
* POLARSSL_ERR_MPI_MALLOC_FAILED if memory allocation failed,
* POLARSSL_ERR_ECP_FEATURE_UNAVAILABLE if the point format
* is not implemented.
*
* \note This function does NOT check that the point actually
* belongs to the given group, see ecp_check_pubkey() for

9
include/polarssl/oid.h
View file

@ -315,6 +315,15 @@
/* brainpoolP512r1 OBJECT IDENTIFIER ::= {versionOne 13} */
#define OID_EC_GRP_BP512R1 OID_EC_BRAINPOOL_V1 "\x0D"
/*
* SEC1 C.1
*
* prime-field OBJECT IDENTIFIER ::= { id-fieldType 1 }
* id-fieldType OBJECT IDENTIFIER ::= { ansi-X9-62 fieldType(1)}
*/
#define OID_ANSI_X9_62_FIELD_TYPE OID_ANSI_X9_62 "\x01"
#define OID_ANSI_X9_62_PRIME_FIELD OID_ANSI_X9_62_FIELD_TYPE "\x01"
/*
* ECDSA signature identifers, from RFC 5480
*/

8
library/ecp.c
View file

@ -478,7 +478,8 @@ cleanup:
* Import a point from unsigned binary data (SEC1 2.3.4)
*/
int ecp_point_read_binary( const ecp_group *grp, ecp_point *pt,
const unsigned char *buf, size_t ilen ) {
const unsigned char *buf, size_t ilen )
{
int ret;
size_t plen;
@ -487,7 +488,10 @@ int ecp_point_read_binary( const ecp_group *grp, ecp_point *pt,
plen = mpi_size( &grp->P );
if( ilen != 2 * plen + 1 || buf[0] != 0x04 )
if( buf[0] != 0x04 )
return( POLARSSL_ERR_ECP_FEATURE_UNAVAILABLE );
if( ilen != 2 * plen + 1 )
return( POLARSSL_ERR_ECP_BAD_INPUT_DATA );
MPI_CHK( mpi_read_binary( &pt->X, buf + 1, plen ) );

307
library/pkparse.c
View file

@ -148,12 +148,12 @@ int pk_parse_public_keyfile( pk_context *ctx, const char *path )
#endif /* POLARSSL_FS_IO */
#if defined(POLARSSL_ECP_C)
/* Get an EC group id from an ECParameters buffer
/* Minimally parse an ECParameters buffer to and asn1_buf
*
* ECParameters ::= CHOICE {
* namedCurve OBJECT IDENTIFIER
* specifiedCurve SpecifiedECDomain -- = SEQUENCE { ... }
* -- implicitCurve NULL
* -- specifiedCurve SpecifiedECDomain
* }
*/
static int pk_get_ecparams( unsigned char **p, const unsigned char *end,
@ -161,10 +161,22 @@ static int pk_get_ecparams( unsigned char **p, const unsigned char *end,
{
int ret;
/* Tag may be either OID or SEQUENCE */
params->tag = **p;
if( params->tag != ASN1_OID
#if defined(POLARSSL_PK_PARSE_EC_EXTENDED)
&& params->tag != ( ASN1_CONSTRUCTED | ASN1_SEQUENCE )
#endif
)
{
return( POLARSSL_ERR_PK_KEY_INVALID_FORMAT +
POLARSSL_ERR_ASN1_UNEXPECTED_TAG );
}
if( ( ret = asn1_get_tag( p, end, &params->len, ASN1_OID ) ) != 0 )
if( ( ret = asn1_get_tag( p, end, &params->len, params->tag ) ) != 0 )
{
return( POLARSSL_ERR_PK_KEY_INVALID_FORMAT + ret );
}
params->p = *p;
*p += params->len;
@ -176,16 +188,262 @@ static int pk_get_ecparams( unsigned char **p, const unsigned char *end,
return( 0 );
}
#if defined(POLARSSL_PK_PARSE_EC_EXTENDED)
/*
* Parse a SpecifiedECDomain (SEC 1 C.2) and (mostly) fill the group with it.
* WARNING: the resulting group should only be used with
* pk_group_id_from_specified(), since its base point may not be set correctly
* if it was encoded compressed.
*
* SpecifiedECDomain ::= SEQUENCE {
* version SpecifiedECDomainVersion(ecdpVer1 | ecdpVer2 | ecdpVer3, ...),
* fieldID FieldID {{FieldTypes}},
* curve Curve,
* base ECPoint,
* order INTEGER,
* cofactor INTEGER OPTIONAL,
* hash HashAlgorithm OPTIONAL,
* ...
* }
*
* We only support prime-field as field type, and ignore hash and cofactor.
*/
static int pk_group_from_specified( const asn1_buf *params, ecp_group *grp )
{
int ret;
unsigned char *p = params->p;
const unsigned char * const end = params->p + params->len;
const unsigned char *end_field, *end_curve;
size_t len;
int ver;
/* SpecifiedECDomainVersion ::= INTEGER { 1, 2, 3 } */
if( ( ret = asn1_get_int( &p, end, &ver ) ) != 0 )
return( POLARSSL_ERR_PK_KEY_INVALID_FORMAT + ret );
if( ver < 1 || ver > 3 )
return( POLARSSL_ERR_PK_KEY_INVALID_FORMAT );
/*
* FieldID { FIELD-ID:IOSet } ::= SEQUENCE { -- Finite field
* fieldType FIELD-ID.&id({IOSet}),
* parameters FIELD-ID.&Type({IOSet}{@fieldType})
* }
*/
if( ( ret = asn1_get_tag( &p, end, &len,
ASN1_CONSTRUCTED | ASN1_SEQUENCE ) ) != 0 )
return( ret );
end_field = p + len;
/*
* FIELD-ID ::= TYPE-IDENTIFIER
* FieldTypes FIELD-ID ::= {
* { Prime-p IDENTIFIED BY prime-field } |
* { Characteristic-two IDENTIFIED BY characteristic-two-field }
* }
* prime-field OBJECT IDENTIFIER ::= { id-fieldType 1 }
*/
if( ( ret = asn1_get_tag( &p, end_field, &len, ASN1_OID ) ) != 0 )
return( ret );
if( len != OID_SIZE( OID_ANSI_X9_62_PRIME_FIELD ) ||
memcmp( p, OID_ANSI_X9_62_PRIME_FIELD, len ) != 0 )
{
return( POLARSSL_ERR_PK_FEATURE_UNAVAILABLE );
}
p += len;
/* Prime-p ::= INTEGER -- Field of size p. */
if( ( ret = asn1_get_mpi( &p, end_field, &grp->P ) ) != 0 )
return( POLARSSL_ERR_PK_KEY_INVALID_FORMAT + ret );
grp->pbits = mpi_msb( &grp->P );
if( p != end_field )
return( POLARSSL_ERR_PK_KEY_INVALID_FORMAT +
POLARSSL_ERR_ASN1_LENGTH_MISMATCH );
/*
* Curve ::= SEQUENCE {
* a FieldElement,
* b FieldElement,
* seed BIT STRING OPTIONAL
* -- Shall be present if used in SpecifiedECDomain
* -- with version equal to ecdpVer2 or ecdpVer3
* }
*/
if( ( ret = asn1_get_tag( &p, end, &len,
ASN1_CONSTRUCTED | ASN1_SEQUENCE ) ) != 0 )
return( ret );
end_curve = p + len;
/*
* FieldElement ::= OCTET STRING
* containing an integer in the case of a prime field
*/
if( ( ret = asn1_get_tag( &p, end_curve, &len, ASN1_OCTET_STRING ) ) != 0 ||
( ret = mpi_read_binary( &grp->A, p, len ) ) != 0 )
{
return( POLARSSL_ERR_PK_KEY_INVALID_FORMAT + ret );
}
p += len;
if( ( ret = asn1_get_tag( &p, end_curve, &len, ASN1_OCTET_STRING ) ) != 0 ||
( ret = mpi_read_binary( &grp->B, p, len ) ) != 0 )
{
return( POLARSSL_ERR_PK_KEY_INVALID_FORMAT + ret );
}
p += len;
/* Ignore seed BIT STRING OPTIONAL */
if( ( ret = asn1_get_tag( &p, end_curve, &len, ASN1_BIT_STRING ) ) == 0 )
p += len;
if( p != end_curve )
return( POLARSSL_ERR_PK_KEY_INVALID_FORMAT +
POLARSSL_ERR_ASN1_LENGTH_MISMATCH );
/*
* ECPoint ::= OCTET STRING
*/
if( ( ret = asn1_get_tag( &p, end, &len, ASN1_OCTET_STRING ) ) != 0 )
return( POLARSSL_ERR_PK_KEY_INVALID_FORMAT + ret );
if( ( ret = ecp_point_read_binary( grp, &grp->G,
( const unsigned char *) p, len ) ) != 0 )
{
/*
* If we can't read the point because it's compressed, cheat by
* reading only the X coordinate and the parity bit of Y.
*/
if( ret != POLARSSL_ERR_ECP_FEATURE_UNAVAILABLE ||
( p[0] != 0x02 && p[0] != 0x03 ) ||
len != mpi_size( &grp->P ) + 1 ||
mpi_read_binary( &grp->G.X, p + 1, len - 1 ) != 0 ||
mpi_lset( &grp->G.Y, p[0] - 2 ) != 0 ||
mpi_lset( &grp->G.Z, 1 ) != 0 )
{
return( POLARSSL_ERR_PK_KEY_INVALID_FORMAT );
}
}
p += len;
/*
* order INTEGER
*/
if( ( ret = asn1_get_mpi( &p, end, &grp->N ) ) )
return( POLARSSL_ERR_PK_KEY_INVALID_FORMAT + ret );
grp->nbits = mpi_msb( &grp->N );
/*
* Allow optional elements by purposefully not enforcing p == end here.
*/
return( 0 );
}
/*
* Find the group id associated with an (almost filled) group as generated by
* pk_group_from_specified(), or return an error if unknown.
*/
static int pk_group_id_from_group( const ecp_group *grp, ecp_group_id *grp_id )
{
int ret;
ecp_group ref;
const ecp_group_id *id;
ecp_group_init( &ref );
for( id = ecp_grp_id_list(); *id != POLARSSL_ECP_DP_NONE; id++ )
{
/* Load the group associated to that id */
ecp_group_free( &ref );
MPI_CHK( ecp_use_known_dp( &ref, *id ) );
/* Compare to the group we were given, starting with easy tests */
if( grp->pbits == ref.pbits && grp->nbits == ref.nbits &&
mpi_cmp_mpi( &grp->P, &ref.P ) == 0 &&
mpi_cmp_mpi( &grp->A, &ref.A ) == 0 &&
mpi_cmp_mpi( &grp->B, &ref.B ) == 0 &&
mpi_cmp_mpi( &grp->N, &ref.N ) == 0 &&
mpi_cmp_mpi( &grp->G.X, &ref.G.X ) == 0 &&
mpi_cmp_mpi( &grp->G.Z, &ref.G.Z ) == 0 &&
/* For Y we may only know the parity bit, so compare only that */
mpi_get_bit( &grp->G.Y, 0 ) == mpi_get_bit( &ref.G.Y, 0 ) )
{
break;
}
}
cleanup:
ecp_group_free( &ref );
*grp_id = *id;
if( ret == 0 && *id == POLARSSL_ECP_DP_NONE )
ret = POLARSSL_ERR_ECP_FEATURE_UNAVAILABLE;
return( ret );
}
/*
* Parse a SpecifiedECDomain (SEC 1 C.2) and find the associated group ID
*/
static int pk_group_id_from_specified( const asn1_buf *params,
ecp_group_id *grp_id )
{
int ret;
ecp_group grp;
ecp_group_init( &grp );
if( ( ret = pk_group_from_specified( params, &grp ) ) != 0 )
goto cleanup;
ret = pk_group_id_from_group( &grp, grp_id );
cleanup:
ecp_group_free( &grp );
return( ret );
}
#endif /* POLARSSL_PK_PARSE_EC_EXTENDED */
/*
* Use EC parameters to initialise an EC group
*
* ECParameters ::= CHOICE {
* namedCurve OBJECT IDENTIFIER
* specifiedCurve SpecifiedECDomain -- = SEQUENCE { ... }
* -- implicitCurve NULL
*/
static int pk_use_ecparams( const asn1_buf *params, ecp_group *grp )
{
int ret;
ecp_group_id grp_id;
if( oid_get_ec_grp( params, &grp_id ) != 0 )
return( POLARSSL_ERR_PK_UNKNOWN_NAMED_CURVE );
if( params->tag == ASN1_OID )
{
if( oid_get_ec_grp( params, &grp_id ) != 0 )
return( POLARSSL_ERR_PK_UNKNOWN_NAMED_CURVE );
}
else
{
#if defined(POLARSSL_PK_PARSE_EC_EXTENDED)
if( ( ret = pk_group_id_from_specified( params, &grp_id ) ) != 0 )
return( ret );
#else
return( POLARSSL_ERR_PK_KEY_INVALID_FORMAT );
#endif
}
/*
* grp may already be initilialized; if so, make sure IDs match
@ -201,6 +459,10 @@ static int pk_use_ecparams( const asn1_buf *params, ecp_group *grp )
/*
* EC public key is an EC point
*
* The caller is responsible for clearing the structure upon failure if
* desired. Take care to pass along the possible ECP_FEATURE_UNAVAILABLE
* return code of ecp_point_read_binary() and leave p in a usable state.
*/
static int pk_get_ecpubkey( unsigned char **p, const unsigned char *end,
ecp_keypair *key )
@ -208,19 +470,17 @@ static int pk_get_ecpubkey( unsigned char **p, const unsigned char *end,
int ret;
if( ( ret = ecp_point_read_binary( &key->grp, &key->Q,
(const unsigned char *) *p, end - *p ) ) != 0 ||
( ret = ecp_check_pubkey( &key->grp, &key->Q ) ) != 0 )
(const unsigned char *) *p, end - *p ) ) == 0 )
{
ecp_keypair_free( key );
return( POLARSSL_ERR_PK_INVALID_PUBKEY );
ret = ecp_check_pubkey( &key->grp, &key->Q );
}
/*
* We know ecp_point_read_binary consumed all bytes
* We know ecp_point_read_binary consumed all bytes or failed
*/
*p = (unsigned char *) end;
return( 0 );
return( ret );
}
#endif /* POLARSSL_ECP_C */
@ -451,7 +711,7 @@ static int pk_parse_key_sec1_der( ecp_keypair *eck,
size_t keylen )
{
int ret;
int version;
int version, pubkey_done;
size_t len;
asn1_buf params;
unsigned char *p = (unsigned char *) key;
@ -513,8 +773,10 @@ static int pk_parse_key_sec1_der( ecp_keypair *eck,
}
/*
* Is 'publickey' present? If not, create it from the private key.
* Is 'publickey' present? If not, or if we can't read it (eg because it
* is compressed), create it from the private key.
*/
pubkey_done = 0;
if( ( ret = asn1_get_tag( &p, end, &len,
ASN1_CONTEXT_SPECIFIC | ASN1_CONSTRUCTED | 1 ) ) == 0 )
{
@ -527,16 +789,27 @@ static int pk_parse_key_sec1_der( ecp_keypair *eck,
return( POLARSSL_ERR_PK_KEY_INVALID_FORMAT +
POLARSSL_ERR_ASN1_LENGTH_MISMATCH );
if( ( ret = pk_get_ecpubkey( &p, end2, eck ) ) != 0 )
return( ret );
if( ( ret = pk_get_ecpubkey( &p, end2, eck ) ) == 0 )
pubkey_done = 1;
else
{
/*
* The only acceptable failure mode of pk_get_ecpubkey() above
* is if the point format is not recognized.
*/
if( ret != POLARSSL_ERR_ECP_FEATURE_UNAVAILABLE )
return( POLARSSL_ERR_PK_KEY_INVALID_FORMAT );
}
}
else if ( ret != POLARSSL_ERR_ASN1_UNEXPECTED_TAG )
{
ecp_keypair_free( eck );
return( POLARSSL_ERR_PK_KEY_INVALID_FORMAT + ret );
}
else if( ( ret = ecp_mul( &eck->grp, &eck->Q, &eck->d, &eck->grp.G,
NULL, NULL ) ) != 0 )
if( ! pubkey_done &&
( ret = ecp_mul( &eck->grp, &eck->Q, &eck->d, &eck->grp.G,
NULL, NULL ) ) != 0 )
{
ecp_keypair_free( eck );
return( POLARSSL_ERR_PK_KEY_INVALID_FORMAT + ret );

BIN
tests/data_files/ec_prv.specdom.der Normal file
View file

Binary file not shown.

4
tests/suites/test_suite_pkparse.data
View file

@ -198,6 +198,10 @@ Parse EC Key #14 (SEC1 PEM, bp512r1)
depends_on:POLARSSL_PEM_PARSE_C:POLARSSL_ECP_C:POLARSSL_ECP_DP_BP512R1_ENABLED
pk_parse_keyfile_ec:"data_files/ec_bp512_prv.pem":"NULL":0
Parse EC Key #15 (SEC1 DER, secp256k1, SpecifiedECDomain)
depends_on:POLARSSL_PEM_PARSE_C:POLARSSL_ECP_C:POLARSSL_ECP_DP_SECP256K1_ENABLED:POLARSSL_PK_PARSE_EC_EXTENDED
pk_parse_keyfile_ec:"data_files/ec_prv.specdom.der":"NULL":0
Key ASN1 (Incorrect first tag)
pk_parse_key_rsa:"":"":POLARSSL_ERR_PK_KEY_INVALID_FORMAT