blob: 0590f2b050153ab1c34bdf09ba6b71a6f1bf91c9 [file] [log] [blame]
Paul Bakker1a7550a2013-09-15 13:01:22 +02001/*
2 * Public Key layer for parsing key files and structures
3 *
Bence Szépkúti1e148272020-08-07 13:07:28 +02004 * Copyright The Mbed TLS Contributors
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +02005 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
Paul Bakker1a7550a2013-09-15 13:01:22 +020018 */
19
Gilles Peskinedb09ef62020-06-03 01:43:33 +020020#include "common.h"
Paul Bakker1a7550a2013-09-15 13:01:22 +020021
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020022#if defined(MBEDTLS_PK_PARSE_C)
Paul Bakker1a7550a2013-09-15 13:01:22 +020023
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000024#include "mbedtls/pk.h"
25#include "mbedtls/asn1.h"
26#include "mbedtls/oid.h"
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050027#include "mbedtls/platform_util.h"
Janos Follath24eed8d2019-11-22 13:21:35 +000028#include "mbedtls/error.h"
Paul Bakker1a7550a2013-09-15 13:01:22 +020029
Rich Evans00ab4702015-02-06 13:43:58 +000030#include <string.h>
31
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020032#if defined(MBEDTLS_RSA_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000033#include "mbedtls/rsa.h"
Paul Bakker1a7550a2013-09-15 13:01:22 +020034#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020035#if defined(MBEDTLS_ECP_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000036#include "mbedtls/ecp.h"
Paul Bakker1a7550a2013-09-15 13:01:22 +020037#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020038#if defined(MBEDTLS_ECDSA_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000039#include "mbedtls/ecdsa.h"
Paul Bakker1a7550a2013-09-15 13:01:22 +020040#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020041#if defined(MBEDTLS_PEM_PARSE_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000042#include "mbedtls/pem.h"
Paul Bakker1a7550a2013-09-15 13:01:22 +020043#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020044#if defined(MBEDTLS_PKCS5_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000045#include "mbedtls/pkcs5.h"
Paul Bakker1a7550a2013-09-15 13:01:22 +020046#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020047#if defined(MBEDTLS_PKCS12_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000048#include "mbedtls/pkcs12.h"
Paul Bakker1a7550a2013-09-15 13:01:22 +020049#endif
50
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020051#if defined(MBEDTLS_PLATFORM_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000052#include "mbedtls/platform.h"
Paul Bakker1a7550a2013-09-15 13:01:22 +020053#else
54#include <stdlib.h>
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +020055#define mbedtls_calloc calloc
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020056#define mbedtls_free free
Paul Bakker1a7550a2013-09-15 13:01:22 +020057#endif
58
Andrzej Kurekc470b6b2019-01-31 08:20:20 -050059/* Parameter validation macros based on platform_util.h */
60#define PK_VALIDATE_RET( cond ) \
61 MBEDTLS_INTERNAL_VALIDATE_RET( cond, MBEDTLS_ERR_PK_BAD_INPUT_DATA )
62#define PK_VALIDATE( cond ) \
63 MBEDTLS_INTERNAL_VALIDATE( cond )
64
Gilles Peskine832f3492017-11-30 11:42:12 +010065#if defined(MBEDTLS_FS_IO)
Paul Bakker1a7550a2013-09-15 13:01:22 +020066/*
67 * Load all data from a file into a given buffer.
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +020068 *
69 * The file is expected to contain either PEM or DER encoded data.
70 * A terminating null byte is always appended. It is included in the announced
71 * length only if the data looks like it is PEM encoded.
Paul Bakker1a7550a2013-09-15 13:01:22 +020072 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020073int mbedtls_pk_load_file( const char *path, unsigned char **buf, size_t *n )
Paul Bakker1a7550a2013-09-15 13:01:22 +020074{
75 FILE *f;
76 long size;
77
Andrzej Kurekc470b6b2019-01-31 08:20:20 -050078 PK_VALIDATE_RET( path != NULL );
79 PK_VALIDATE_RET( buf != NULL );
80 PK_VALIDATE_RET( n != NULL );
81
Paul Bakker1a7550a2013-09-15 13:01:22 +020082 if( ( f = fopen( path, "rb" ) ) == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020083 return( MBEDTLS_ERR_PK_FILE_IO_ERROR );
Paul Bakker1a7550a2013-09-15 13:01:22 +020084
85 fseek( f, 0, SEEK_END );
86 if( ( size = ftell( f ) ) == -1 )
87 {
88 fclose( f );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020089 return( MBEDTLS_ERR_PK_FILE_IO_ERROR );
Paul Bakker1a7550a2013-09-15 13:01:22 +020090 }
91 fseek( f, 0, SEEK_SET );
92
93 *n = (size_t) size;
94
95 if( *n + 1 == 0 ||
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +020096 ( *buf = mbedtls_calloc( 1, *n + 1 ) ) == NULL )
Paul Bakker1a7550a2013-09-15 13:01:22 +020097 {
98 fclose( f );
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +020099 return( MBEDTLS_ERR_PK_ALLOC_FAILED );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200100 }
101
102 if( fread( *buf, 1, *n, f ) != *n )
103 {
104 fclose( f );
Andres Amaya Garcia1f2666f2017-06-26 10:36:20 +0100105
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500106 mbedtls_platform_zeroize( *buf, *n );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200107 mbedtls_free( *buf );
Andres Amaya Garcia1f2666f2017-06-26 10:36:20 +0100108
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200109 return( MBEDTLS_ERR_PK_FILE_IO_ERROR );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200110 }
111
112 fclose( f );
113
114 (*buf)[*n] = '\0';
115
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +0200116 if( strstr( (const char *) *buf, "-----BEGIN " ) != NULL )
117 ++*n;
118
Paul Bakker1a7550a2013-09-15 13:01:22 +0200119 return( 0 );
120}
121
122/*
123 * Load and parse a private key
124 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200125int mbedtls_pk_parse_keyfile( mbedtls_pk_context *ctx,
Paul Bakker1a7550a2013-09-15 13:01:22 +0200126 const char *path, const char *pwd )
127{
Janos Follath24eed8d2019-11-22 13:21:35 +0000128 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200129 size_t n;
130 unsigned char *buf;
131
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500132 PK_VALIDATE_RET( ctx != NULL );
133 PK_VALIDATE_RET( path != NULL );
134
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200135 if( ( ret = mbedtls_pk_load_file( path, &buf, &n ) ) != 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200136 return( ret );
137
138 if( pwd == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200139 ret = mbedtls_pk_parse_key( ctx, buf, n, NULL, 0 );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200140 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200141 ret = mbedtls_pk_parse_key( ctx, buf, n,
Paul Bakker1a7550a2013-09-15 13:01:22 +0200142 (const unsigned char *) pwd, strlen( pwd ) );
143
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500144 mbedtls_platform_zeroize( buf, n );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200145 mbedtls_free( buf );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200146
147 return( ret );
148}
149
150/*
151 * Load and parse a public key
152 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200153int mbedtls_pk_parse_public_keyfile( mbedtls_pk_context *ctx, const char *path )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200154{
Janos Follath24eed8d2019-11-22 13:21:35 +0000155 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200156 size_t n;
157 unsigned char *buf;
158
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500159 PK_VALIDATE_RET( ctx != NULL );
160 PK_VALIDATE_RET( path != NULL );
161
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200162 if( ( ret = mbedtls_pk_load_file( path, &buf, &n ) ) != 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200163 return( ret );
164
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200165 ret = mbedtls_pk_parse_public_key( ctx, buf, n );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200166
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500167 mbedtls_platform_zeroize( buf, n );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200168 mbedtls_free( buf );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200169
170 return( ret );
171}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200172#endif /* MBEDTLS_FS_IO */
Paul Bakker1a7550a2013-09-15 13:01:22 +0200173
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200174#if defined(MBEDTLS_ECP_C)
175/* Minimally parse an ECParameters buffer to and mbedtls_asn1_buf
Paul Bakker1a7550a2013-09-15 13:01:22 +0200176 *
177 * ECParameters ::= CHOICE {
178 * namedCurve OBJECT IDENTIFIER
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100179 * specifiedCurve SpecifiedECDomain -- = SEQUENCE { ... }
Paul Bakker1a7550a2013-09-15 13:01:22 +0200180 * -- implicitCurve NULL
Paul Bakker1a7550a2013-09-15 13:01:22 +0200181 * }
182 */
183static int pk_get_ecparams( unsigned char **p, const unsigned char *end,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200184 mbedtls_asn1_buf *params )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200185{
Janos Follath24eed8d2019-11-22 13:21:35 +0000186 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200187
Sanne Woudab2b29d52017-08-21 15:58:12 +0100188 if ( end - *p < 1 )
Sanne Wouda7b2e85d2017-08-30 21:10:42 +0100189 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT +
190 MBEDTLS_ERR_ASN1_OUT_OF_DATA );
Sanne Woudab2b29d52017-08-21 15:58:12 +0100191
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100192 /* Tag may be either OID or SEQUENCE */
Paul Bakker1a7550a2013-09-15 13:01:22 +0200193 params->tag = **p;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200194 if( params->tag != MBEDTLS_ASN1_OID
195#if defined(MBEDTLS_PK_PARSE_EC_EXTENDED)
196 && params->tag != ( MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE )
Manuel Pégourié-Gonnard6fac3512014-03-19 16:39:52 +0100197#endif
198 )
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100199 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200200 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT +
201 MBEDTLS_ERR_ASN1_UNEXPECTED_TAG );
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100202 }
Paul Bakker1a7550a2013-09-15 13:01:22 +0200203
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200204 if( ( ret = mbedtls_asn1_get_tag( p, end, &params->len, params->tag ) ) != 0 )
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100205 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200206 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100207 }
Paul Bakker1a7550a2013-09-15 13:01:22 +0200208
209 params->p = *p;
210 *p += params->len;
211
212 if( *p != end )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200213 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT +
214 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200215
216 return( 0 );
217}
218
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200219#if defined(MBEDTLS_PK_PARSE_EC_EXTENDED)
Paul Bakker1a7550a2013-09-15 13:01:22 +0200220/*
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100221 * Parse a SpecifiedECDomain (SEC 1 C.2) and (mostly) fill the group with it.
222 * WARNING: the resulting group should only be used with
223 * pk_group_id_from_specified(), since its base point may not be set correctly
224 * if it was encoded compressed.
225 *
226 * SpecifiedECDomain ::= SEQUENCE {
227 * version SpecifiedECDomainVersion(ecdpVer1 | ecdpVer2 | ecdpVer3, ...),
228 * fieldID FieldID {{FieldTypes}},
229 * curve Curve,
230 * base ECPoint,
231 * order INTEGER,
232 * cofactor INTEGER OPTIONAL,
233 * hash HashAlgorithm OPTIONAL,
234 * ...
235 * }
236 *
237 * We only support prime-field as field type, and ignore hash and cofactor.
238 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200239static int pk_group_from_specified( const mbedtls_asn1_buf *params, mbedtls_ecp_group *grp )
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100240{
Janos Follath24eed8d2019-11-22 13:21:35 +0000241 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100242 unsigned char *p = params->p;
243 const unsigned char * const end = params->p + params->len;
244 const unsigned char *end_field, *end_curve;
245 size_t len;
246 int ver;
247
248 /* SpecifiedECDomainVersion ::= INTEGER { 1, 2, 3 } */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200249 if( ( ret = mbedtls_asn1_get_int( &p, end, &ver ) ) != 0 )
250 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100251
252 if( ver < 1 || ver > 3 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200253 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT );
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100254
255 /*
256 * FieldID { FIELD-ID:IOSet } ::= SEQUENCE { -- Finite field
257 * fieldType FIELD-ID.&id({IOSet}),
258 * parameters FIELD-ID.&Type({IOSet}{@fieldType})
259 * }
260 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200261 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
262 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100263 return( ret );
264
265 end_field = p + len;
266
267 /*
268 * FIELD-ID ::= TYPE-IDENTIFIER
269 * FieldTypes FIELD-ID ::= {
270 * { Prime-p IDENTIFIED BY prime-field } |
271 * { Characteristic-two IDENTIFIED BY characteristic-two-field }
272 * }
273 * prime-field OBJECT IDENTIFIER ::= { id-fieldType 1 }
274 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200275 if( ( ret = mbedtls_asn1_get_tag( &p, end_field, &len, MBEDTLS_ASN1_OID ) ) != 0 )
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100276 return( ret );
277
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200278 if( len != MBEDTLS_OID_SIZE( MBEDTLS_OID_ANSI_X9_62_PRIME_FIELD ) ||
279 memcmp( p, MBEDTLS_OID_ANSI_X9_62_PRIME_FIELD, len ) != 0 )
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100280 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200281 return( MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100282 }
283
284 p += len;
285
286 /* Prime-p ::= INTEGER -- Field of size p. */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200287 if( ( ret = mbedtls_asn1_get_mpi( &p, end_field, &grp->P ) ) != 0 )
288 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100289
Manuel Pégourié-Gonnardc0696c22015-06-18 16:47:17 +0200290 grp->pbits = mbedtls_mpi_bitlen( &grp->P );
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100291
292 if( p != end_field )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200293 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT +
294 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100295
296 /*
297 * Curve ::= SEQUENCE {
298 * a FieldElement,
299 * b FieldElement,
300 * seed BIT STRING OPTIONAL
301 * -- Shall be present if used in SpecifiedECDomain
302 * -- with version equal to ecdpVer2 or ecdpVer3
303 * }
304 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200305 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
306 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100307 return( ret );
308
309 end_curve = p + len;
310
311 /*
312 * FieldElement ::= OCTET STRING
313 * containing an integer in the case of a prime field
314 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200315 if( ( ret = mbedtls_asn1_get_tag( &p, end_curve, &len, MBEDTLS_ASN1_OCTET_STRING ) ) != 0 ||
316 ( ret = mbedtls_mpi_read_binary( &grp->A, p, len ) ) != 0 )
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100317 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200318 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100319 }
320
321 p += len;
322
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200323 if( ( ret = mbedtls_asn1_get_tag( &p, end_curve, &len, MBEDTLS_ASN1_OCTET_STRING ) ) != 0 ||
324 ( ret = mbedtls_mpi_read_binary( &grp->B, p, len ) ) != 0 )
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100325 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200326 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100327 }
328
329 p += len;
330
331 /* Ignore seed BIT STRING OPTIONAL */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200332 if( ( ret = mbedtls_asn1_get_tag( &p, end_curve, &len, MBEDTLS_ASN1_BIT_STRING ) ) == 0 )
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100333 p += len;
334
335 if( p != end_curve )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200336 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT +
337 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100338
339 /*
340 * ECPoint ::= OCTET STRING
341 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200342 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len, MBEDTLS_ASN1_OCTET_STRING ) ) != 0 )
343 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100344
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200345 if( ( ret = mbedtls_ecp_point_read_binary( grp, &grp->G,
Manuel Pégourié-Gonnard5246ee52014-03-19 16:18:38 +0100346 ( const unsigned char *) p, len ) ) != 0 )
347 {
348 /*
349 * If we can't read the point because it's compressed, cheat by
350 * reading only the X coordinate and the parity bit of Y.
351 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200352 if( ret != MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE ||
Manuel Pégourié-Gonnard5246ee52014-03-19 16:18:38 +0100353 ( p[0] != 0x02 && p[0] != 0x03 ) ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200354 len != mbedtls_mpi_size( &grp->P ) + 1 ||
355 mbedtls_mpi_read_binary( &grp->G.X, p + 1, len - 1 ) != 0 ||
356 mbedtls_mpi_lset( &grp->G.Y, p[0] - 2 ) != 0 ||
357 mbedtls_mpi_lset( &grp->G.Z, 1 ) != 0 )
Manuel Pégourié-Gonnard5246ee52014-03-19 16:18:38 +0100358 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200359 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT );
Manuel Pégourié-Gonnard5246ee52014-03-19 16:18:38 +0100360 }
361 }
362
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100363 p += len;
364
365 /*
366 * order INTEGER
367 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200368 if( ( ret = mbedtls_asn1_get_mpi( &p, end, &grp->N ) ) != 0 )
369 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100370
Manuel Pégourié-Gonnardc0696c22015-06-18 16:47:17 +0200371 grp->nbits = mbedtls_mpi_bitlen( &grp->N );
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100372
373 /*
374 * Allow optional elements by purposefully not enforcing p == end here.
375 */
376
377 return( 0 );
378}
379
380/*
381 * Find the group id associated with an (almost filled) group as generated by
382 * pk_group_from_specified(), or return an error if unknown.
383 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200384static int pk_group_id_from_group( const mbedtls_ecp_group *grp, mbedtls_ecp_group_id *grp_id )
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100385{
Manuel Pégourié-Gonnard5b8c4092014-03-27 14:59:42 +0100386 int ret = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200387 mbedtls_ecp_group ref;
388 const mbedtls_ecp_group_id *id;
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100389
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200390 mbedtls_ecp_group_init( &ref );
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100391
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200392 for( id = mbedtls_ecp_grp_id_list(); *id != MBEDTLS_ECP_DP_NONE; id++ )
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100393 {
394 /* Load the group associated to that id */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200395 mbedtls_ecp_group_free( &ref );
Manuel Pégourié-Gonnarde3a062b2015-05-11 18:46:47 +0200396 MBEDTLS_MPI_CHK( mbedtls_ecp_group_load( &ref, *id ) );
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100397
398 /* Compare to the group we were given, starting with easy tests */
399 if( grp->pbits == ref.pbits && grp->nbits == ref.nbits &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200400 mbedtls_mpi_cmp_mpi( &grp->P, &ref.P ) == 0 &&
401 mbedtls_mpi_cmp_mpi( &grp->A, &ref.A ) == 0 &&
402 mbedtls_mpi_cmp_mpi( &grp->B, &ref.B ) == 0 &&
403 mbedtls_mpi_cmp_mpi( &grp->N, &ref.N ) == 0 &&
404 mbedtls_mpi_cmp_mpi( &grp->G.X, &ref.G.X ) == 0 &&
405 mbedtls_mpi_cmp_mpi( &grp->G.Z, &ref.G.Z ) == 0 &&
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100406 /* For Y we may only know the parity bit, so compare only that */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200407 mbedtls_mpi_get_bit( &grp->G.Y, 0 ) == mbedtls_mpi_get_bit( &ref.G.Y, 0 ) )
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100408 {
409 break;
410 }
411
412 }
413
414cleanup:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200415 mbedtls_ecp_group_free( &ref );
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100416
417 *grp_id = *id;
418
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200419 if( ret == 0 && *id == MBEDTLS_ECP_DP_NONE )
420 ret = MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE;
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100421
422 return( ret );
423}
424
425/*
426 * Parse a SpecifiedECDomain (SEC 1 C.2) and find the associated group ID
427 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200428static int pk_group_id_from_specified( const mbedtls_asn1_buf *params,
429 mbedtls_ecp_group_id *grp_id )
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100430{
Janos Follath24eed8d2019-11-22 13:21:35 +0000431 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200432 mbedtls_ecp_group grp;
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100433
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200434 mbedtls_ecp_group_init( &grp );
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100435
436 if( ( ret = pk_group_from_specified( params, &grp ) ) != 0 )
437 goto cleanup;
438
439 ret = pk_group_id_from_group( &grp, grp_id );
440
441cleanup:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200442 mbedtls_ecp_group_free( &grp );
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100443
444 return( ret );
445}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200446#endif /* MBEDTLS_PK_PARSE_EC_EXTENDED */
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100447
448/*
Paul Bakker1a7550a2013-09-15 13:01:22 +0200449 * Use EC parameters to initialise an EC group
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100450 *
451 * ECParameters ::= CHOICE {
452 * namedCurve OBJECT IDENTIFIER
453 * specifiedCurve SpecifiedECDomain -- = SEQUENCE { ... }
454 * -- implicitCurve NULL
Paul Bakker1a7550a2013-09-15 13:01:22 +0200455 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200456static int pk_use_ecparams( const mbedtls_asn1_buf *params, mbedtls_ecp_group *grp )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200457{
Janos Follath24eed8d2019-11-22 13:21:35 +0000458 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200459 mbedtls_ecp_group_id grp_id;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200460
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200461 if( params->tag == MBEDTLS_ASN1_OID )
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100462 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200463 if( mbedtls_oid_get_ec_grp( params, &grp_id ) != 0 )
464 return( MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE );
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100465 }
466 else
467 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200468#if defined(MBEDTLS_PK_PARSE_EC_EXTENDED)
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100469 if( ( ret = pk_group_id_from_specified( params, &grp_id ) ) != 0 )
470 return( ret );
Manuel Pégourié-Gonnard6fac3512014-03-19 16:39:52 +0100471#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200472 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT );
Manuel Pégourié-Gonnard6fac3512014-03-19 16:39:52 +0100473#endif
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100474 }
Paul Bakker1a7550a2013-09-15 13:01:22 +0200475
476 /*
477 * grp may already be initilialized; if so, make sure IDs match
478 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200479 if( grp->id != MBEDTLS_ECP_DP_NONE && grp->id != grp_id )
480 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200481
Manuel Pégourié-Gonnarde3a062b2015-05-11 18:46:47 +0200482 if( ( ret = mbedtls_ecp_group_load( grp, grp_id ) ) != 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200483 return( ret );
484
485 return( 0 );
486}
487
488/*
489 * EC public key is an EC point
Manuel Pégourié-Gonnard5246ee52014-03-19 16:18:38 +0100490 *
491 * The caller is responsible for clearing the structure upon failure if
492 * desired. Take care to pass along the possible ECP_FEATURE_UNAVAILABLE
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200493 * return code of mbedtls_ecp_point_read_binary() and leave p in a usable state.
Paul Bakker1a7550a2013-09-15 13:01:22 +0200494 */
495static int pk_get_ecpubkey( unsigned char **p, const unsigned char *end,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200496 mbedtls_ecp_keypair *key )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200497{
Janos Follath24eed8d2019-11-22 13:21:35 +0000498 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200499
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200500 if( ( ret = mbedtls_ecp_point_read_binary( &key->grp, &key->Q,
Manuel Pégourié-Gonnard5246ee52014-03-19 16:18:38 +0100501 (const unsigned char *) *p, end - *p ) ) == 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200502 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200503 ret = mbedtls_ecp_check_pubkey( &key->grp, &key->Q );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200504 }
505
506 /*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200507 * We know mbedtls_ecp_point_read_binary consumed all bytes or failed
Paul Bakker1a7550a2013-09-15 13:01:22 +0200508 */
509 *p = (unsigned char *) end;
510
Manuel Pégourié-Gonnard5246ee52014-03-19 16:18:38 +0100511 return( ret );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200512}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200513#endif /* MBEDTLS_ECP_C */
Paul Bakker1a7550a2013-09-15 13:01:22 +0200514
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200515#if defined(MBEDTLS_RSA_C)
Paul Bakker1a7550a2013-09-15 13:01:22 +0200516/*
517 * RSAPublicKey ::= SEQUENCE {
518 * modulus INTEGER, -- n
519 * publicExponent INTEGER -- e
520 * }
521 */
522static int pk_get_rsapubkey( unsigned char **p,
523 const unsigned char *end,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200524 mbedtls_rsa_context *rsa )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200525{
Janos Follath24eed8d2019-11-22 13:21:35 +0000526 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200527 size_t len;
528
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200529 if( ( ret = mbedtls_asn1_get_tag( p, end, &len,
530 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
531 return( MBEDTLS_ERR_PK_INVALID_PUBKEY + ret );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200532
533 if( *p + len != end )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200534 return( MBEDTLS_ERR_PK_INVALID_PUBKEY +
535 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200536
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100537 /* Import N */
538 if( ( ret = mbedtls_asn1_get_tag( p, end, &len, MBEDTLS_ASN1_INTEGER ) ) != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200539 return( MBEDTLS_ERR_PK_INVALID_PUBKEY + ret );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200540
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100541 if( ( ret = mbedtls_rsa_import_raw( rsa, *p, len, NULL, 0, NULL, 0,
542 NULL, 0, NULL, 0 ) ) != 0 )
543 return( MBEDTLS_ERR_PK_INVALID_PUBKEY );
544
545 *p += len;
546
547 /* Import E */
548 if( ( ret = mbedtls_asn1_get_tag( p, end, &len, MBEDTLS_ASN1_INTEGER ) ) != 0 )
549 return( MBEDTLS_ERR_PK_INVALID_PUBKEY + ret );
550
551 if( ( ret = mbedtls_rsa_import_raw( rsa, NULL, 0, NULL, 0, NULL, 0,
552 NULL, 0, *p, len ) ) != 0 )
553 return( MBEDTLS_ERR_PK_INVALID_PUBKEY );
554
555 *p += len;
556
Hanno Becker895c5ab2018-01-05 08:08:09 +0000557 if( mbedtls_rsa_complete( rsa ) != 0 ||
558 mbedtls_rsa_check_pubkey( rsa ) != 0 )
559 {
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100560 return( MBEDTLS_ERR_PK_INVALID_PUBKEY );
Hanno Becker895c5ab2018-01-05 08:08:09 +0000561 }
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100562
Paul Bakker1a7550a2013-09-15 13:01:22 +0200563 if( *p != end )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200564 return( MBEDTLS_ERR_PK_INVALID_PUBKEY +
565 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200566
Paul Bakker1a7550a2013-09-15 13:01:22 +0200567 return( 0 );
568}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200569#endif /* MBEDTLS_RSA_C */
Paul Bakker1a7550a2013-09-15 13:01:22 +0200570
571/* Get a PK algorithm identifier
572 *
573 * AlgorithmIdentifier ::= SEQUENCE {
574 * algorithm OBJECT IDENTIFIER,
575 * parameters ANY DEFINED BY algorithm OPTIONAL }
576 */
577static int pk_get_pk_alg( unsigned char **p,
578 const unsigned char *end,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200579 mbedtls_pk_type_t *pk_alg, mbedtls_asn1_buf *params )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200580{
Janos Follath24eed8d2019-11-22 13:21:35 +0000581 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200582 mbedtls_asn1_buf alg_oid;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200583
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200584 memset( params, 0, sizeof(mbedtls_asn1_buf) );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200585
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200586 if( ( ret = mbedtls_asn1_get_alg( p, end, &alg_oid, params ) ) != 0 )
587 return( MBEDTLS_ERR_PK_INVALID_ALG + ret );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200588
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200589 if( mbedtls_oid_get_pk_alg( &alg_oid, pk_alg ) != 0 )
590 return( MBEDTLS_ERR_PK_UNKNOWN_PK_ALG );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200591
592 /*
593 * No parameters with RSA (only for EC)
594 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200595 if( *pk_alg == MBEDTLS_PK_RSA &&
596 ( ( params->tag != MBEDTLS_ASN1_NULL && params->tag != 0 ) ||
Paul Bakker1a7550a2013-09-15 13:01:22 +0200597 params->len != 0 ) )
598 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200599 return( MBEDTLS_ERR_PK_INVALID_ALG );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200600 }
601
602 return( 0 );
603}
604
605/*
606 * SubjectPublicKeyInfo ::= SEQUENCE {
607 * algorithm AlgorithmIdentifier,
608 * subjectPublicKey BIT STRING }
609 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200610int mbedtls_pk_parse_subpubkey( unsigned char **p, const unsigned char *end,
611 mbedtls_pk_context *pk )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200612{
Janos Follath24eed8d2019-11-22 13:21:35 +0000613 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200614 size_t len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200615 mbedtls_asn1_buf alg_params;
616 mbedtls_pk_type_t pk_alg = MBEDTLS_PK_NONE;
617 const mbedtls_pk_info_t *pk_info;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200618
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500619 PK_VALIDATE_RET( p != NULL );
620 PK_VALIDATE_RET( *p != NULL );
621 PK_VALIDATE_RET( end != NULL );
622 PK_VALIDATE_RET( pk != NULL );
623
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200624 if( ( ret = mbedtls_asn1_get_tag( p, end, &len,
625 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200626 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200627 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200628 }
629
630 end = *p + len;
631
632 if( ( ret = pk_get_pk_alg( p, end, &pk_alg, &alg_params ) ) != 0 )
633 return( ret );
634
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200635 if( ( ret = mbedtls_asn1_get_bitstring_null( p, end, &len ) ) != 0 )
636 return( MBEDTLS_ERR_PK_INVALID_PUBKEY + ret );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200637
638 if( *p + len != end )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200639 return( MBEDTLS_ERR_PK_INVALID_PUBKEY +
640 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200641
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200642 if( ( pk_info = mbedtls_pk_info_from_type( pk_alg ) ) == NULL )
643 return( MBEDTLS_ERR_PK_UNKNOWN_PK_ALG );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200644
Manuel Pégourié-Gonnardd9e6a3a2015-05-14 19:41:36 +0200645 if( ( ret = mbedtls_pk_setup( pk, pk_info ) ) != 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200646 return( ret );
647
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200648#if defined(MBEDTLS_RSA_C)
649 if( pk_alg == MBEDTLS_PK_RSA )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200650 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200651 ret = pk_get_rsapubkey( p, end, mbedtls_pk_rsa( *pk ) );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200652 } else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200653#endif /* MBEDTLS_RSA_C */
654#if defined(MBEDTLS_ECP_C)
655 if( pk_alg == MBEDTLS_PK_ECKEY_DH || pk_alg == MBEDTLS_PK_ECKEY )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200656 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200657 ret = pk_use_ecparams( &alg_params, &mbedtls_pk_ec( *pk )->grp );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200658 if( ret == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200659 ret = pk_get_ecpubkey( p, end, mbedtls_pk_ec( *pk ) );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200660 } else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200661#endif /* MBEDTLS_ECP_C */
662 ret = MBEDTLS_ERR_PK_UNKNOWN_PK_ALG;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200663
664 if( ret == 0 && *p != end )
Jens Reimann9ad4a332020-09-22 11:57:16 +0200665 ret = MBEDTLS_ERR_PK_INVALID_PUBKEY +
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200666 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200667
668 if( ret != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200669 mbedtls_pk_free( pk );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200670
671 return( ret );
672}
673
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200674#if defined(MBEDTLS_RSA_C)
Paul Bakker1a7550a2013-09-15 13:01:22 +0200675/*
Manuel Pégourié-Gonnarda04a2c32020-02-18 10:12:14 +0100676 * Wrapper around mbedtls_asn1_get_mpi() that rejects zero.
677 *
678 * The value zero is:
679 * - never a valid value for an RSA parameter
680 * - interpreted as "omitted, please reconstruct" by mbedtls_rsa_complete().
681 *
682 * Since values can't be omitted in PKCS#1, passing a zero value to
683 * rsa_complete() would be incorrect, so reject zero values early.
684 */
685static int asn1_get_nonzero_mpi( unsigned char **p,
686 const unsigned char *end,
687 mbedtls_mpi *X )
688{
689 int ret;
690
691 ret = mbedtls_asn1_get_mpi( p, end, X );
692 if( ret != 0 )
693 return( ret );
694
695 if( mbedtls_mpi_cmp_int( X, 0 ) == 0 )
696 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT );
697
698 return( 0 );
699}
700
701/*
Paul Bakker1a7550a2013-09-15 13:01:22 +0200702 * Parse a PKCS#1 encoded private RSA key
703 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200704static int pk_parse_key_pkcs1_der( mbedtls_rsa_context *rsa,
Paul Bakker1a7550a2013-09-15 13:01:22 +0200705 const unsigned char *key,
706 size_t keylen )
707{
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100708 int ret, version;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200709 size_t len;
710 unsigned char *p, *end;
711
Hanno Beckerefa14e82017-10-11 19:45:19 +0100712 mbedtls_mpi T;
713 mbedtls_mpi_init( &T );
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100714
Paul Bakker1a7550a2013-09-15 13:01:22 +0200715 p = (unsigned char *) key;
716 end = p + keylen;
717
718 /*
719 * This function parses the RSAPrivateKey (PKCS#1)
720 *
721 * RSAPrivateKey ::= SEQUENCE {
722 * version Version,
723 * modulus INTEGER, -- n
724 * publicExponent INTEGER, -- e
725 * privateExponent INTEGER, -- d
726 * prime1 INTEGER, -- p
727 * prime2 INTEGER, -- q
728 * exponent1 INTEGER, -- d mod (p-1)
729 * exponent2 INTEGER, -- d mod (q-1)
730 * coefficient INTEGER, -- (inverse of q) mod p
731 * otherPrimeInfos OtherPrimeInfos OPTIONAL
732 * }
733 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200734 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
735 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200736 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200737 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200738 }
739
740 end = p + len;
741
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100742 if( ( ret = mbedtls_asn1_get_int( &p, end, &version ) ) != 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200743 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200744 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200745 }
746
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100747 if( version != 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200748 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200749 return( MBEDTLS_ERR_PK_KEY_INVALID_VERSION );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200750 }
751
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100752 /* Import N */
Manuel Pégourié-Gonnarda04a2c32020-02-18 10:12:14 +0100753 if( ( ret = asn1_get_nonzero_mpi( &p, end, &T ) ) != 0 ||
754 ( ret = mbedtls_rsa_import( rsa, &T, NULL, NULL,
755 NULL, NULL ) ) != 0 )
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100756 goto cleanup;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200757
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100758 /* Import E */
Manuel Pégourié-Gonnarda04a2c32020-02-18 10:12:14 +0100759 if( ( ret = asn1_get_nonzero_mpi( &p, end, &T ) ) != 0 ||
760 ( ret = mbedtls_rsa_import( rsa, NULL, NULL, NULL,
761 NULL, &T ) ) != 0 )
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100762 goto cleanup;
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100763
764 /* Import D */
Manuel Pégourié-Gonnarda04a2c32020-02-18 10:12:14 +0100765 if( ( ret = asn1_get_nonzero_mpi( &p, end, &T ) ) != 0 ||
766 ( ret = mbedtls_rsa_import( rsa, NULL, NULL, NULL,
767 &T, NULL ) ) != 0 )
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100768 goto cleanup;
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100769
770 /* Import P */
Manuel Pégourié-Gonnarda04a2c32020-02-18 10:12:14 +0100771 if( ( ret = asn1_get_nonzero_mpi( &p, end, &T ) ) != 0 ||
772 ( ret = mbedtls_rsa_import( rsa, NULL, &T, NULL,
773 NULL, NULL ) ) != 0 )
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100774 goto cleanup;
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100775
776 /* Import Q */
Manuel Pégourié-Gonnarda04a2c32020-02-18 10:12:14 +0100777 if( ( ret = asn1_get_nonzero_mpi( &p, end, &T ) ) != 0 ||
778 ( ret = mbedtls_rsa_import( rsa, NULL, NULL, &T,
779 NULL, NULL ) ) != 0 )
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100780 goto cleanup;
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100781
Manuel Pégourié-Gonnardbbb5a0a2020-02-18 10:22:54 +0100782#if !defined(MBEDTLS_RSA_NO_CRT) && !defined(MBEDTLS_RSA_ALT)
Jack Lloyd8c2631b2020-01-23 17:23:52 -0500783 /*
784 * The RSA CRT parameters DP, DQ and QP are nominally redundant, in
785 * that they can be easily recomputed from D, P and Q. However by
786 * parsing them from the PKCS1 structure it is possible to avoid
787 * recalculating them which both reduces the overhead of loading
788 * RSA private keys into memory and also avoids side channels which
789 * can arise when computing those values, since all of D, P, and Q
790 * are secret. See https://eprint.iacr.org/2020/055 for a
791 * description of one such attack.
792 */
793
Jack Lloyd80cc8112020-01-22 17:34:29 -0500794 /* Import DP */
Manuel Pégourié-Gonnarda04a2c32020-02-18 10:12:14 +0100795 if( ( ret = asn1_get_nonzero_mpi( &p, end, &T ) ) != 0 ||
796 ( ret = mbedtls_mpi_copy( &rsa->DP, &T ) ) != 0 )
Jack Lloyd2e9eef42020-01-28 14:43:52 -0500797 goto cleanup;
Jack Lloyd80cc8112020-01-22 17:34:29 -0500798
799 /* Import DQ */
Manuel Pégourié-Gonnarda04a2c32020-02-18 10:12:14 +0100800 if( ( ret = asn1_get_nonzero_mpi( &p, end, &T ) ) != 0 ||
801 ( ret = mbedtls_mpi_copy( &rsa->DQ, &T ) ) != 0 )
Jack Lloyd2e9eef42020-01-28 14:43:52 -0500802 goto cleanup;
Jack Lloyd80cc8112020-01-22 17:34:29 -0500803
804 /* Import QP */
Manuel Pégourié-Gonnarda04a2c32020-02-18 10:12:14 +0100805 if( ( ret = asn1_get_nonzero_mpi( &p, end, &T ) ) != 0 ||
806 ( ret = mbedtls_mpi_copy( &rsa->QP, &T ) ) != 0 )
Jack Lloyd2e9eef42020-01-28 14:43:52 -0500807 goto cleanup;
808
Jack Lloyd60239752020-01-27 17:53:36 -0500809#else
810 /* Verify existance of the CRT params */
Manuel Pégourié-Gonnarda04a2c32020-02-18 10:12:14 +0100811 if( ( ret = asn1_get_nonzero_mpi( &p, end, &T ) ) != 0 ||
812 ( ret = asn1_get_nonzero_mpi( &p, end, &T ) ) != 0 ||
813 ( ret = asn1_get_nonzero_mpi( &p, end, &T ) ) != 0 )
Jack Lloyd60239752020-01-27 17:53:36 -0500814 goto cleanup;
815#endif
Jack Lloyd80cc8112020-01-22 17:34:29 -0500816
Manuel Pégourié-Gonnardc4226792020-02-14 11:28:47 +0100817 /* rsa_complete() doesn't complete anything with the default
818 * implementation but is still called:
819 * - for the benefit of alternative implementation that may want to
820 * pre-compute stuff beyond what's provided (eg Montgomery factors)
821 * - as is also sanity-checks the key
822 *
823 * Furthermore, we also check the public part for consistency with
824 * mbedtls_pk_parse_pubkey(), as it includes size minima for example.
825 */
826 if( ( ret = mbedtls_rsa_complete( rsa ) ) != 0 ||
827 ( ret = mbedtls_rsa_check_pubkey( rsa ) ) != 0 )
828 {
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100829 goto cleanup;
Manuel Pégourié-Gonnardc4226792020-02-14 11:28:47 +0100830 }
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100831
Paul Bakker1a7550a2013-09-15 13:01:22 +0200832 if( p != end )
833 {
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100834 ret = MBEDTLS_ERR_PK_KEY_INVALID_FORMAT +
835 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200836 }
837
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100838cleanup:
839
Hanno Beckerefa14e82017-10-11 19:45:19 +0100840 mbedtls_mpi_free( &T );
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100841
842 if( ret != 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200843 {
Hanno Beckerefa14e82017-10-11 19:45:19 +0100844 /* Wrap error code if it's coming from a lower level */
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100845 if( ( ret & 0xff80 ) == 0 )
846 ret = MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret;
847 else
848 ret = MBEDTLS_ERR_PK_KEY_INVALID_FORMAT;
849
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200850 mbedtls_rsa_free( rsa );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200851 }
852
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100853 return( ret );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200854}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200855#endif /* MBEDTLS_RSA_C */
Paul Bakker1a7550a2013-09-15 13:01:22 +0200856
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200857#if defined(MBEDTLS_ECP_C)
Paul Bakker1a7550a2013-09-15 13:01:22 +0200858/*
859 * Parse a SEC1 encoded private EC key
860 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200861static int pk_parse_key_sec1_der( mbedtls_ecp_keypair *eck,
Paul Bakker1a7550a2013-09-15 13:01:22 +0200862 const unsigned char *key,
863 size_t keylen )
864{
Janos Follath24eed8d2019-11-22 13:21:35 +0000865 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100866 int version, pubkey_done;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200867 size_t len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200868 mbedtls_asn1_buf params;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200869 unsigned char *p = (unsigned char *) key;
870 unsigned char *end = p + keylen;
871 unsigned char *end2;
872
873 /*
874 * RFC 5915, or SEC1 Appendix C.4
875 *
876 * ECPrivateKey ::= SEQUENCE {
877 * version INTEGER { ecPrivkeyVer1(1) } (ecPrivkeyVer1),
878 * privateKey OCTET STRING,
879 * parameters [0] ECParameters {{ NamedCurve }} OPTIONAL,
880 * publicKey [1] BIT STRING OPTIONAL
881 * }
882 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200883 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
884 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200885 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200886 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200887 }
888
889 end = p + len;
890
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200891 if( ( ret = mbedtls_asn1_get_int( &p, end, &version ) ) != 0 )
892 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200893
894 if( version != 1 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200895 return( MBEDTLS_ERR_PK_KEY_INVALID_VERSION );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200896
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200897 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len, MBEDTLS_ASN1_OCTET_STRING ) ) != 0 )
898 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200899
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200900 if( ( ret = mbedtls_mpi_read_binary( &eck->d, p, len ) ) != 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200901 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200902 mbedtls_ecp_keypair_free( eck );
903 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200904 }
905
906 p += len;
907
Manuel Pégourié-Gonnard924cd102015-04-14 11:18:04 +0200908 pubkey_done = 0;
909 if( p != end )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200910 {
Manuel Pégourié-Gonnard924cd102015-04-14 11:18:04 +0200911 /*
912 * Is 'parameters' present?
913 */
Manuel Pégourié-Gonnarde1e58712015-04-15 10:50:34 +0200914 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
915 MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | 0 ) ) == 0 )
Manuel Pégourié-Gonnard924cd102015-04-14 11:18:04 +0200916 {
917 if( ( ret = pk_get_ecparams( &p, p + len, &params) ) != 0 ||
918 ( ret = pk_use_ecparams( &params, &eck->grp ) ) != 0 )
919 {
Manuel Pégourié-Gonnarde1e58712015-04-15 10:50:34 +0200920 mbedtls_ecp_keypair_free( eck );
Manuel Pégourié-Gonnard924cd102015-04-14 11:18:04 +0200921 return( ret );
922 }
923 }
Manuel Pégourié-Gonnarde1e58712015-04-15 10:50:34 +0200924 else if( ret != MBEDTLS_ERR_ASN1_UNEXPECTED_TAG )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200925 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200926 mbedtls_ecp_keypair_free( eck );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200927 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
Manuel Pégourié-Gonnard5246ee52014-03-19 16:18:38 +0100928 }
Jethro Beekmand2df9362018-02-16 13:11:04 -0800929 }
Manuel Pégourié-Gonnard924cd102015-04-14 11:18:04 +0200930
Jethro Beekmand2df9362018-02-16 13:11:04 -0800931 if( p != end )
932 {
Manuel Pégourié-Gonnard924cd102015-04-14 11:18:04 +0200933 /*
934 * Is 'publickey' present? If not, or if we can't read it (eg because it
935 * is compressed), create it from the private key.
936 */
Manuel Pégourié-Gonnarde1e58712015-04-15 10:50:34 +0200937 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
938 MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | 1 ) ) == 0 )
Manuel Pégourié-Gonnard924cd102015-04-14 11:18:04 +0200939 {
940 end2 = p + len;
941
Manuel Pégourié-Gonnarde1e58712015-04-15 10:50:34 +0200942 if( ( ret = mbedtls_asn1_get_bitstring_null( &p, end2, &len ) ) != 0 )
943 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
Manuel Pégourié-Gonnard924cd102015-04-14 11:18:04 +0200944
945 if( p + len != end2 )
Manuel Pégourié-Gonnarde1e58712015-04-15 10:50:34 +0200946 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT +
947 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
Manuel Pégourié-Gonnard924cd102015-04-14 11:18:04 +0200948
949 if( ( ret = pk_get_ecpubkey( &p, end2, eck ) ) == 0 )
950 pubkey_done = 1;
951 else
952 {
953 /*
954 * The only acceptable failure mode of pk_get_ecpubkey() above
955 * is if the point format is not recognized.
956 */
Manuel Pégourié-Gonnarde1e58712015-04-15 10:50:34 +0200957 if( ret != MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE )
958 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT );
Manuel Pégourié-Gonnard924cd102015-04-14 11:18:04 +0200959 }
960 }
Manuel Pégourié-Gonnarde1e58712015-04-15 10:50:34 +0200961 else if( ret != MBEDTLS_ERR_ASN1_UNEXPECTED_TAG )
Manuel Pégourié-Gonnard924cd102015-04-14 11:18:04 +0200962 {
Manuel Pégourié-Gonnarde1e58712015-04-15 10:50:34 +0200963 mbedtls_ecp_keypair_free( eck );
964 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
Manuel Pégourié-Gonnard924cd102015-04-14 11:18:04 +0200965 }
Paul Bakker1a7550a2013-09-15 13:01:22 +0200966 }
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100967
968 if( ! pubkey_done &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200969 ( ret = mbedtls_ecp_mul( &eck->grp, &eck->Q, &eck->d, &eck->grp.G,
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100970 NULL, NULL ) ) != 0 )
Manuel Pégourié-Gonnardff29f9c2013-09-18 16:13:02 +0200971 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200972 mbedtls_ecp_keypair_free( eck );
973 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
Manuel Pégourié-Gonnardff29f9c2013-09-18 16:13:02 +0200974 }
Paul Bakker1a7550a2013-09-15 13:01:22 +0200975
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200976 if( ( ret = mbedtls_ecp_check_privkey( &eck->grp, &eck->d ) ) != 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200977 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200978 mbedtls_ecp_keypair_free( eck );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200979 return( ret );
980 }
981
Paul Bakkerd8bb8262014-06-17 14:06:49 +0200982 return( 0 );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200983}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200984#endif /* MBEDTLS_ECP_C */
Paul Bakker1a7550a2013-09-15 13:01:22 +0200985
986/*
987 * Parse an unencrypted PKCS#8 encoded private key
Hanno Beckerb4274212017-09-29 19:18:51 +0100988 *
989 * Notes:
990 *
991 * - This function does not own the key buffer. It is the
992 * responsibility of the caller to take care of zeroizing
993 * and freeing it after use.
994 *
995 * - The function is responsible for freeing the provided
996 * PK context on failure.
997 *
Paul Bakker1a7550a2013-09-15 13:01:22 +0200998 */
999static int pk_parse_key_pkcs8_unencrypted_der(
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001000 mbedtls_pk_context *pk,
Paul Bakker1a7550a2013-09-15 13:01:22 +02001001 const unsigned char* key,
1002 size_t keylen )
1003{
1004 int ret, version;
1005 size_t len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001006 mbedtls_asn1_buf params;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001007 unsigned char *p = (unsigned char *) key;
1008 unsigned char *end = p + keylen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001009 mbedtls_pk_type_t pk_alg = MBEDTLS_PK_NONE;
1010 const mbedtls_pk_info_t *pk_info;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001011
1012 /*
Hanno Becker9c6cb382017-09-05 10:08:01 +01001013 * This function parses the PrivateKeyInfo object (PKCS#8 v1.2 = RFC 5208)
Paul Bakker1a7550a2013-09-15 13:01:22 +02001014 *
1015 * PrivateKeyInfo ::= SEQUENCE {
1016 * version Version,
1017 * privateKeyAlgorithm PrivateKeyAlgorithmIdentifier,
1018 * privateKey PrivateKey,
1019 * attributes [0] IMPLICIT Attributes OPTIONAL }
1020 *
1021 * Version ::= INTEGER
1022 * PrivateKeyAlgorithmIdentifier ::= AlgorithmIdentifier
1023 * PrivateKey ::= OCTET STRING
1024 *
1025 * The PrivateKey OCTET STRING is a SEC1 ECPrivateKey
1026 */
1027
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001028 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
1029 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +02001030 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001031 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001032 }
1033
1034 end = p + len;
1035
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001036 if( ( ret = mbedtls_asn1_get_int( &p, end, &version ) ) != 0 )
1037 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001038
1039 if( version != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001040 return( MBEDTLS_ERR_PK_KEY_INVALID_VERSION + ret );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001041
1042 if( ( ret = pk_get_pk_alg( &p, end, &pk_alg, &params ) ) != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001043 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001044
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001045 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len, MBEDTLS_ASN1_OCTET_STRING ) ) != 0 )
1046 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001047
1048 if( len < 1 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001049 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT +
1050 MBEDTLS_ERR_ASN1_OUT_OF_DATA );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001051
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001052 if( ( pk_info = mbedtls_pk_info_from_type( pk_alg ) ) == NULL )
1053 return( MBEDTLS_ERR_PK_UNKNOWN_PK_ALG );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001054
Manuel Pégourié-Gonnardd9e6a3a2015-05-14 19:41:36 +02001055 if( ( ret = mbedtls_pk_setup( pk, pk_info ) ) != 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +02001056 return( ret );
1057
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001058#if defined(MBEDTLS_RSA_C)
1059 if( pk_alg == MBEDTLS_PK_RSA )
Paul Bakker1a7550a2013-09-15 13:01:22 +02001060 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001061 if( ( ret = pk_parse_key_pkcs1_der( mbedtls_pk_rsa( *pk ), p, len ) ) != 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +02001062 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001063 mbedtls_pk_free( pk );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001064 return( ret );
1065 }
1066 } else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001067#endif /* MBEDTLS_RSA_C */
1068#if defined(MBEDTLS_ECP_C)
1069 if( pk_alg == MBEDTLS_PK_ECKEY || pk_alg == MBEDTLS_PK_ECKEY_DH )
Paul Bakker1a7550a2013-09-15 13:01:22 +02001070 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001071 if( ( ret = pk_use_ecparams( &params, &mbedtls_pk_ec( *pk )->grp ) ) != 0 ||
1072 ( ret = pk_parse_key_sec1_der( mbedtls_pk_ec( *pk ), p, len ) ) != 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +02001073 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001074 mbedtls_pk_free( pk );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001075 return( ret );
1076 }
1077 } else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001078#endif /* MBEDTLS_ECP_C */
1079 return( MBEDTLS_ERR_PK_UNKNOWN_PK_ALG );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001080
Paul Bakkerd8bb8262014-06-17 14:06:49 +02001081 return( 0 );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001082}
1083
1084/*
1085 * Parse an encrypted PKCS#8 encoded private key
Hanno Beckerb4274212017-09-29 19:18:51 +01001086 *
1087 * To save space, the decryption happens in-place on the given key buffer.
1088 * Also, while this function may modify the keybuffer, it doesn't own it,
1089 * and instead it is the responsibility of the caller to zeroize and properly
1090 * free it after use.
1091 *
Paul Bakker1a7550a2013-09-15 13:01:22 +02001092 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001093#if defined(MBEDTLS_PKCS12_C) || defined(MBEDTLS_PKCS5_C)
Paul Bakker1a7550a2013-09-15 13:01:22 +02001094static int pk_parse_key_pkcs8_encrypted_der(
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001095 mbedtls_pk_context *pk,
Hanno Beckerfab35692017-08-25 13:38:26 +01001096 unsigned char *key, size_t keylen,
Paul Bakker1a7550a2013-09-15 13:01:22 +02001097 const unsigned char *pwd, size_t pwdlen )
1098{
Paul Bakkerf4cf80b2014-04-17 17:19:56 +02001099 int ret, decrypted = 0;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001100 size_t len;
Hanno Beckerfab35692017-08-25 13:38:26 +01001101 unsigned char *buf;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001102 unsigned char *p, *end;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001103 mbedtls_asn1_buf pbe_alg_oid, pbe_params;
1104#if defined(MBEDTLS_PKCS12_C)
1105 mbedtls_cipher_type_t cipher_alg;
1106 mbedtls_md_type_t md_alg;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001107#endif
1108
Hanno Becker2aa80a72017-09-07 15:28:45 +01001109 p = key;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001110 end = p + keylen;
1111
1112 if( pwdlen == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001113 return( MBEDTLS_ERR_PK_PASSWORD_REQUIRED );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001114
1115 /*
Hanno Beckerf04111f2017-09-29 19:18:42 +01001116 * This function parses the EncryptedPrivateKeyInfo object (PKCS#8)
Paul Bakker1a7550a2013-09-15 13:01:22 +02001117 *
1118 * EncryptedPrivateKeyInfo ::= SEQUENCE {
1119 * encryptionAlgorithm EncryptionAlgorithmIdentifier,
1120 * encryptedData EncryptedData
1121 * }
1122 *
1123 * EncryptionAlgorithmIdentifier ::= AlgorithmIdentifier
1124 *
1125 * EncryptedData ::= OCTET STRING
1126 *
1127 * The EncryptedData OCTET STRING is a PKCS#8 PrivateKeyInfo
Hanno Beckerb8d16572017-09-07 15:29:01 +01001128 *
Paul Bakker1a7550a2013-09-15 13:01:22 +02001129 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001130 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
1131 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +02001132 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001133 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001134 }
1135
1136 end = p + len;
1137
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001138 if( ( ret = mbedtls_asn1_get_alg( &p, end, &pbe_alg_oid, &pbe_params ) ) != 0 )
1139 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001140
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001141 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len, MBEDTLS_ASN1_OCTET_STRING ) ) != 0 )
1142 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + ret );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001143
Hanno Beckerfab35692017-08-25 13:38:26 +01001144 buf = p;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001145
1146 /*
Hanno Beckerb8d16572017-09-07 15:29:01 +01001147 * Decrypt EncryptedData with appropriate PBE
Paul Bakker1a7550a2013-09-15 13:01:22 +02001148 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001149#if defined(MBEDTLS_PKCS12_C)
1150 if( mbedtls_oid_get_pkcs12_pbe_alg( &pbe_alg_oid, &md_alg, &cipher_alg ) == 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +02001151 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001152 if( ( ret = mbedtls_pkcs12_pbe( &pbe_params, MBEDTLS_PKCS12_PBE_DECRYPT,
Paul Bakker1a7550a2013-09-15 13:01:22 +02001153 cipher_alg, md_alg,
1154 pwd, pwdlen, p, len, buf ) ) != 0 )
1155 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001156 if( ret == MBEDTLS_ERR_PKCS12_PASSWORD_MISMATCH )
1157 return( MBEDTLS_ERR_PK_PASSWORD_MISMATCH );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001158
1159 return( ret );
1160 }
Paul Bakkerf4cf80b2014-04-17 17:19:56 +02001161
1162 decrypted = 1;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001163 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001164 else if( MBEDTLS_OID_CMP( MBEDTLS_OID_PKCS12_PBE_SHA1_RC4_128, &pbe_alg_oid ) == 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +02001165 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001166 if( ( ret = mbedtls_pkcs12_pbe_sha1_rc4_128( &pbe_params,
1167 MBEDTLS_PKCS12_PBE_DECRYPT,
Paul Bakker1a7550a2013-09-15 13:01:22 +02001168 pwd, pwdlen,
1169 p, len, buf ) ) != 0 )
1170 {
1171 return( ret );
1172 }
1173
1174 // Best guess for password mismatch when using RC4. If first tag is
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001175 // not MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE
Paul Bakker1a7550a2013-09-15 13:01:22 +02001176 //
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001177 if( *buf != ( MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) )
1178 return( MBEDTLS_ERR_PK_PASSWORD_MISMATCH );
Paul Bakkerf4cf80b2014-04-17 17:19:56 +02001179
1180 decrypted = 1;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001181 }
1182 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001183#endif /* MBEDTLS_PKCS12_C */
1184#if defined(MBEDTLS_PKCS5_C)
1185 if( MBEDTLS_OID_CMP( MBEDTLS_OID_PKCS5_PBES2, &pbe_alg_oid ) == 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +02001186 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001187 if( ( ret = mbedtls_pkcs5_pbes2( &pbe_params, MBEDTLS_PKCS5_DECRYPT, pwd, pwdlen,
Paul Bakker1a7550a2013-09-15 13:01:22 +02001188 p, len, buf ) ) != 0 )
1189 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001190 if( ret == MBEDTLS_ERR_PKCS5_PASSWORD_MISMATCH )
1191 return( MBEDTLS_ERR_PK_PASSWORD_MISMATCH );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001192
1193 return( ret );
1194 }
Paul Bakkerf4cf80b2014-04-17 17:19:56 +02001195
1196 decrypted = 1;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001197 }
1198 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001199#endif /* MBEDTLS_PKCS5_C */
Manuel Pégourié-Gonnard1032c1d2013-09-18 17:18:34 +02001200 {
1201 ((void) pwd);
Manuel Pégourié-Gonnard1032c1d2013-09-18 17:18:34 +02001202 }
Paul Bakker1a7550a2013-09-15 13:01:22 +02001203
Paul Bakkerf4cf80b2014-04-17 17:19:56 +02001204 if( decrypted == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001205 return( MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE );
Paul Bakkerf4cf80b2014-04-17 17:19:56 +02001206
Paul Bakker1a7550a2013-09-15 13:01:22 +02001207 return( pk_parse_key_pkcs8_unencrypted_der( pk, buf, len ) );
1208}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001209#endif /* MBEDTLS_PKCS12_C || MBEDTLS_PKCS5_C */
Paul Bakker1a7550a2013-09-15 13:01:22 +02001210
1211/*
1212 * Parse a private key
1213 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001214int mbedtls_pk_parse_key( mbedtls_pk_context *pk,
Paul Bakker1a7550a2013-09-15 13:01:22 +02001215 const unsigned char *key, size_t keylen,
1216 const unsigned char *pwd, size_t pwdlen )
1217{
Janos Follath24eed8d2019-11-22 13:21:35 +00001218 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001219 const mbedtls_pk_info_t *pk_info;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001220#if defined(MBEDTLS_PEM_PARSE_C)
Paul Bakker1a7550a2013-09-15 13:01:22 +02001221 size_t len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001222 mbedtls_pem_context pem;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001223#endif
Paul Bakker1a7550a2013-09-15 13:01:22 +02001224
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001225 PK_VALIDATE_RET( pk != NULL );
1226 if( keylen == 0 )
1227 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT );
1228 PK_VALIDATE_RET( key != NULL );
1229
1230#if defined(MBEDTLS_PEM_PARSE_C)
1231 mbedtls_pem_init( &pem );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001232
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001233#if defined(MBEDTLS_RSA_C)
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +02001234 /* Avoid calling mbedtls_pem_read_buffer() on non-null-terminated string */
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001235 if( key[keylen - 1] != '\0' )
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +02001236 ret = MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT;
1237 else
1238 ret = mbedtls_pem_read_buffer( &pem,
1239 "-----BEGIN RSA PRIVATE KEY-----",
1240 "-----END RSA PRIVATE KEY-----",
1241 key, pwd, pwdlen, &len );
1242
Paul Bakker1a7550a2013-09-15 13:01:22 +02001243 if( ret == 0 )
1244 {
Hanno Becker66a0f832017-09-08 12:39:21 +01001245 pk_info = mbedtls_pk_info_from_type( MBEDTLS_PK_RSA );
Hanno Beckerfab35692017-08-25 13:38:26 +01001246 if( ( ret = mbedtls_pk_setup( pk, pk_info ) ) != 0 ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001247 ( ret = pk_parse_key_pkcs1_der( mbedtls_pk_rsa( *pk ),
Paul Bakker1a7550a2013-09-15 13:01:22 +02001248 pem.buf, pem.buflen ) ) != 0 )
1249 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001250 mbedtls_pk_free( pk );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001251 }
1252
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001253 mbedtls_pem_free( &pem );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001254 return( ret );
1255 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001256 else if( ret == MBEDTLS_ERR_PEM_PASSWORD_MISMATCH )
1257 return( MBEDTLS_ERR_PK_PASSWORD_MISMATCH );
1258 else if( ret == MBEDTLS_ERR_PEM_PASSWORD_REQUIRED )
1259 return( MBEDTLS_ERR_PK_PASSWORD_REQUIRED );
1260 else if( ret != MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT )
Paul Bakker1a7550a2013-09-15 13:01:22 +02001261 return( ret );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001262#endif /* MBEDTLS_RSA_C */
Paul Bakker1a7550a2013-09-15 13:01:22 +02001263
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001264#if defined(MBEDTLS_ECP_C)
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +02001265 /* Avoid calling mbedtls_pem_read_buffer() on non-null-terminated string */
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001266 if( key[keylen - 1] != '\0' )
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +02001267 ret = MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT;
1268 else
1269 ret = mbedtls_pem_read_buffer( &pem,
1270 "-----BEGIN EC PRIVATE KEY-----",
1271 "-----END EC PRIVATE KEY-----",
1272 key, pwd, pwdlen, &len );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001273 if( ret == 0 )
1274 {
Hanno Becker66a0f832017-09-08 12:39:21 +01001275 pk_info = mbedtls_pk_info_from_type( MBEDTLS_PK_ECKEY );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001276
Hanno Beckerfab35692017-08-25 13:38:26 +01001277 if( ( ret = mbedtls_pk_setup( pk, pk_info ) ) != 0 ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001278 ( ret = pk_parse_key_sec1_der( mbedtls_pk_ec( *pk ),
Paul Bakker1a7550a2013-09-15 13:01:22 +02001279 pem.buf, pem.buflen ) ) != 0 )
1280 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001281 mbedtls_pk_free( pk );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001282 }
1283
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001284 mbedtls_pem_free( &pem );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001285 return( ret );
1286 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001287 else if( ret == MBEDTLS_ERR_PEM_PASSWORD_MISMATCH )
1288 return( MBEDTLS_ERR_PK_PASSWORD_MISMATCH );
1289 else if( ret == MBEDTLS_ERR_PEM_PASSWORD_REQUIRED )
1290 return( MBEDTLS_ERR_PK_PASSWORD_REQUIRED );
1291 else if( ret != MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT )
Paul Bakker1a7550a2013-09-15 13:01:22 +02001292 return( ret );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001293#endif /* MBEDTLS_ECP_C */
Paul Bakker1a7550a2013-09-15 13:01:22 +02001294
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +02001295 /* Avoid calling mbedtls_pem_read_buffer() on non-null-terminated string */
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001296 if( key[keylen - 1] != '\0' )
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +02001297 ret = MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT;
1298 else
1299 ret = mbedtls_pem_read_buffer( &pem,
1300 "-----BEGIN PRIVATE KEY-----",
1301 "-----END PRIVATE KEY-----",
1302 key, NULL, 0, &len );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001303 if( ret == 0 )
1304 {
1305 if( ( ret = pk_parse_key_pkcs8_unencrypted_der( pk,
1306 pem.buf, pem.buflen ) ) != 0 )
1307 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001308 mbedtls_pk_free( pk );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001309 }
1310
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001311 mbedtls_pem_free( &pem );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001312 return( ret );
1313 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001314 else if( ret != MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT )
Paul Bakker1a7550a2013-09-15 13:01:22 +02001315 return( ret );
1316
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001317#if defined(MBEDTLS_PKCS12_C) || defined(MBEDTLS_PKCS5_C)
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +02001318 /* Avoid calling mbedtls_pem_read_buffer() on non-null-terminated string */
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001319 if( key[keylen - 1] != '\0' )
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +02001320 ret = MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT;
1321 else
1322 ret = mbedtls_pem_read_buffer( &pem,
1323 "-----BEGIN ENCRYPTED PRIVATE KEY-----",
1324 "-----END ENCRYPTED PRIVATE KEY-----",
1325 key, NULL, 0, &len );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001326 if( ret == 0 )
1327 {
1328 if( ( ret = pk_parse_key_pkcs8_encrypted_der( pk,
1329 pem.buf, pem.buflen,
1330 pwd, pwdlen ) ) != 0 )
1331 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001332 mbedtls_pk_free( pk );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001333 }
1334
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001335 mbedtls_pem_free( &pem );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001336 return( ret );
1337 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001338 else if( ret != MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT )
Paul Bakker1a7550a2013-09-15 13:01:22 +02001339 return( ret );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001340#endif /* MBEDTLS_PKCS12_C || MBEDTLS_PKCS5_C */
Paul Bakker1a7550a2013-09-15 13:01:22 +02001341#else
1342 ((void) pwd);
1343 ((void) pwdlen);
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001344#endif /* MBEDTLS_PEM_PARSE_C */
Paul Bakker1a7550a2013-09-15 13:01:22 +02001345
1346 /*
Brian J Murray2adecba2016-11-06 04:45:15 -08001347 * At this point we only know it's not a PEM formatted key. Could be any
1348 * of the known DER encoded private key formats
1349 *
1350 * We try the different DER format parsers to see if one passes without
1351 * error
1352 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001353#if defined(MBEDTLS_PKCS12_C) || defined(MBEDTLS_PKCS5_C)
Paul Bakker1a7550a2013-09-15 13:01:22 +02001354 {
Hanno Beckerfab35692017-08-25 13:38:26 +01001355 unsigned char *key_copy;
1356
1357 if( ( key_copy = mbedtls_calloc( 1, keylen ) ) == NULL )
1358 return( MBEDTLS_ERR_PK_ALLOC_FAILED );
1359
1360 memcpy( key_copy, key, keylen );
1361
1362 ret = pk_parse_key_pkcs8_encrypted_der( pk, key_copy, keylen,
1363 pwd, pwdlen );
1364
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05001365 mbedtls_platform_zeroize( key_copy, keylen );
Hanno Beckerfab35692017-08-25 13:38:26 +01001366 mbedtls_free( key_copy );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001367 }
1368
Hanno Beckerfab35692017-08-25 13:38:26 +01001369 if( ret == 0 )
1370 return( 0 );
1371
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001372 mbedtls_pk_free( pk );
Hanno Becker780f0a42018-10-10 11:23:33 +01001373 mbedtls_pk_init( pk );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001374
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001375 if( ret == MBEDTLS_ERR_PK_PASSWORD_MISMATCH )
Paul Bakker1a7550a2013-09-15 13:01:22 +02001376 {
1377 return( ret );
1378 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001379#endif /* MBEDTLS_PKCS12_C || MBEDTLS_PKCS5_C */
Paul Bakker1a7550a2013-09-15 13:01:22 +02001380
1381 if( ( ret = pk_parse_key_pkcs8_unencrypted_der( pk, key, keylen ) ) == 0 )
1382 return( 0 );
1383
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001384 mbedtls_pk_free( pk );
Hanno Becker780f0a42018-10-10 11:23:33 +01001385 mbedtls_pk_init( pk );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001386
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001387#if defined(MBEDTLS_RSA_C)
Paul Bakker1a7550a2013-09-15 13:01:22 +02001388
Hanno Becker9be19262017-09-08 12:39:44 +01001389 pk_info = mbedtls_pk_info_from_type( MBEDTLS_PK_RSA );
Hanno Becker780f0a42018-10-10 11:23:33 +01001390 if( mbedtls_pk_setup( pk, pk_info ) == 0 &&
1391 pk_parse_key_pkcs1_der( mbedtls_pk_rsa( *pk ), key, keylen ) == 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +02001392 {
1393 return( 0 );
1394 }
1395
Hanno Becker780f0a42018-10-10 11:23:33 +01001396 mbedtls_pk_free( pk );
1397 mbedtls_pk_init( pk );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001398#endif /* MBEDTLS_RSA_C */
Paul Bakker1a7550a2013-09-15 13:01:22 +02001399
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001400#if defined(MBEDTLS_ECP_C)
Hanno Becker9be19262017-09-08 12:39:44 +01001401 pk_info = mbedtls_pk_info_from_type( MBEDTLS_PK_ECKEY );
Hanno Becker780f0a42018-10-10 11:23:33 +01001402 if( mbedtls_pk_setup( pk, pk_info ) == 0 &&
1403 pk_parse_key_sec1_der( mbedtls_pk_ec( *pk ),
1404 key, keylen ) == 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +02001405 {
1406 return( 0 );
1407 }
Hanno Becker780f0a42018-10-10 11:23:33 +01001408 mbedtls_pk_free( pk );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001409#endif /* MBEDTLS_ECP_C */
Paul Bakker1a7550a2013-09-15 13:01:22 +02001410
Hanno Becker780f0a42018-10-10 11:23:33 +01001411 /* If MBEDTLS_RSA_C is defined but MBEDTLS_ECP_C isn't,
1412 * it is ok to leave the PK context initialized but not
1413 * freed: It is the caller's responsibility to call pk_init()
1414 * before calling this function, and to call pk_free()
1415 * when it fails. If MBEDTLS_ECP_C is defined but MBEDTLS_RSA_C
1416 * isn't, this leads to mbedtls_pk_free() being called
1417 * twice, once here and once by the caller, but this is
1418 * also ok and in line with the mbedtls_pk_free() calls
1419 * on failed PEM parsing attempts. */
1420
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001421 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001422}
1423
1424/*
1425 * Parse a public key
1426 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001427int mbedtls_pk_parse_public_key( mbedtls_pk_context *ctx,
Paul Bakker1a7550a2013-09-15 13:01:22 +02001428 const unsigned char *key, size_t keylen )
1429{
Janos Follath24eed8d2019-11-22 13:21:35 +00001430 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001431 unsigned char *p;
Ron Eldor5472d432017-10-17 09:49:00 +03001432#if defined(MBEDTLS_RSA_C)
1433 const mbedtls_pk_info_t *pk_info;
1434#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001435#if defined(MBEDTLS_PEM_PARSE_C)
Paul Bakker1a7550a2013-09-15 13:01:22 +02001436 size_t len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001437 mbedtls_pem_context pem;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001438#endif
Paul Bakker1a7550a2013-09-15 13:01:22 +02001439
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001440 PK_VALIDATE_RET( ctx != NULL );
1441 if( keylen == 0 )
1442 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT );
1443 PK_VALIDATE_RET( key != NULL || keylen == 0 );
1444
1445#if defined(MBEDTLS_PEM_PARSE_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001446 mbedtls_pem_init( &pem );
Ron Eldord0c56de2017-10-10 17:03:08 +03001447#if defined(MBEDTLS_RSA_C)
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +02001448 /* Avoid calling mbedtls_pem_read_buffer() on non-null-terminated string */
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001449 if( key[keylen - 1] != '\0' )
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +02001450 ret = MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT;
1451 else
1452 ret = mbedtls_pem_read_buffer( &pem,
Ron Eldord0c56de2017-10-10 17:03:08 +03001453 "-----BEGIN RSA PUBLIC KEY-----",
1454 "-----END RSA PUBLIC KEY-----",
1455 key, NULL, 0, &len );
1456
1457 if( ret == 0 )
1458 {
Ron Eldor84df1ae2017-10-16 17:11:52 +03001459 p = pem.buf;
1460 if( ( pk_info = mbedtls_pk_info_from_type( MBEDTLS_PK_RSA ) ) == NULL )
1461 return( MBEDTLS_ERR_PK_UNKNOWN_PK_ALG );
Ron Eldord0c56de2017-10-10 17:03:08 +03001462
Ron Eldor84df1ae2017-10-16 17:11:52 +03001463 if( ( ret = mbedtls_pk_setup( ctx, pk_info ) ) != 0 )
1464 return( ret );
Ron Eldord0c56de2017-10-10 17:03:08 +03001465
Ron Eldor84df1ae2017-10-16 17:11:52 +03001466 if ( ( ret = pk_get_rsapubkey( &p, p + pem.buflen, mbedtls_pk_rsa( *ctx ) ) ) != 0 )
1467 mbedtls_pk_free( ctx );
Ron Eldor3f2da842017-10-17 15:50:30 +03001468
Ron Eldord0c56de2017-10-10 17:03:08 +03001469 mbedtls_pem_free( &pem );
1470 return( ret );
1471 }
1472 else if( ret != MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT )
1473 {
1474 mbedtls_pem_free( &pem );
1475 return( ret );
1476 }
1477#endif /* MBEDTLS_RSA_C */
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +02001478
1479 /* Avoid calling mbedtls_pem_read_buffer() on non-null-terminated string */
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001480 if( key[keylen - 1] != '\0' )
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +02001481 ret = MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT;
1482 else
1483 ret = mbedtls_pem_read_buffer( &pem,
1484 "-----BEGIN PUBLIC KEY-----",
1485 "-----END PUBLIC KEY-----",
1486 key, NULL, 0, &len );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001487
1488 if( ret == 0 )
1489 {
1490 /*
1491 * Was PEM encoded
1492 */
Ron Eldor40b14a82017-10-16 19:30:00 +03001493 p = pem.buf;
1494
1495 ret = mbedtls_pk_parse_subpubkey( &p, p + pem.buflen, ctx );
1496 mbedtls_pem_free( &pem );
1497 return( ret );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001498 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001499 else if( ret != MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT )
Paul Bakker1a7550a2013-09-15 13:01:22 +02001500 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001501 mbedtls_pem_free( &pem );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001502 return( ret );
1503 }
Ron Eldor5472d432017-10-17 09:49:00 +03001504 mbedtls_pem_free( &pem );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001505#endif /* MBEDTLS_PEM_PARSE_C */
Ron Eldor40b14a82017-10-16 19:30:00 +03001506
1507#if defined(MBEDTLS_RSA_C)
1508 if( ( pk_info = mbedtls_pk_info_from_type( MBEDTLS_PK_RSA ) ) == NULL )
1509 return( MBEDTLS_ERR_PK_UNKNOWN_PK_ALG );
1510
1511 if( ( ret = mbedtls_pk_setup( ctx, pk_info ) ) != 0 )
1512 return( ret );
1513
Ron Eldor9566ff72018-02-07 18:59:41 +02001514 p = (unsigned char *)key;
Ron Eldor40b14a82017-10-16 19:30:00 +03001515 ret = pk_get_rsapubkey( &p, p + keylen, mbedtls_pk_rsa( *ctx ) );
Ron Eldor9566ff72018-02-07 18:59:41 +02001516 if( ret == 0 )
Ron Eldor40b14a82017-10-16 19:30:00 +03001517 {
Ron Eldor40b14a82017-10-16 19:30:00 +03001518 return( ret );
1519 }
1520 mbedtls_pk_free( ctx );
Ron Eldor9566ff72018-02-07 18:59:41 +02001521 if( ret != ( MBEDTLS_ERR_PK_INVALID_PUBKEY + MBEDTLS_ERR_ASN1_UNEXPECTED_TAG ) )
Ron Eldor40b14a82017-10-16 19:30:00 +03001522 {
Ron Eldor9566ff72018-02-07 18:59:41 +02001523 return( ret );
Ron Eldor40b14a82017-10-16 19:30:00 +03001524 }
1525#endif /* MBEDTLS_RSA_C */
Paul Bakker1a7550a2013-09-15 13:01:22 +02001526 p = (unsigned char *) key;
1527
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001528 ret = mbedtls_pk_parse_subpubkey( &p, p + keylen, ctx );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001529
Paul Bakker1a7550a2013-09-15 13:01:22 +02001530 return( ret );
1531}
1532
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001533#endif /* MBEDTLS_PK_PARSE_C */