blob: 3222ca20fb068d0daae3fbf636e839f3651ce707 [file] [log] [blame]
Paul Bakker1a7550a2013-09-15 13:01:22 +02001/*
2 * Public Key layer for parsing key files and structures
3 *
Bence Szépkúti1e148272020-08-07 13:07:28 +02004 * Copyright The Mbed TLS Contributors
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +02005 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
Paul Bakker1a7550a2013-09-15 13:01:22 +020018 */
19
Gilles Peskinedb09ef62020-06-03 01:43:33 +020020#include "common.h"
Paul Bakker1a7550a2013-09-15 13:01:22 +020021
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020022#if defined(MBEDTLS_PK_PARSE_C)
Paul Bakker1a7550a2013-09-15 13:01:22 +020023
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000024#include "mbedtls/pk.h"
25#include "mbedtls/asn1.h"
26#include "mbedtls/oid.h"
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050027#include "mbedtls/platform_util.h"
Janos Follath24eed8d2019-11-22 13:21:35 +000028#include "mbedtls/error.h"
Paul Bakker1a7550a2013-09-15 13:01:22 +020029
Rich Evans00ab4702015-02-06 13:43:58 +000030#include <string.h>
31
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020032#if defined(MBEDTLS_RSA_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000033#include "mbedtls/rsa.h"
Paul Bakker1a7550a2013-09-15 13:01:22 +020034#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020035#if defined(MBEDTLS_ECP_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000036#include "mbedtls/ecp.h"
Paul Bakker1a7550a2013-09-15 13:01:22 +020037#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020038#if defined(MBEDTLS_ECDSA_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000039#include "mbedtls/ecdsa.h"
Paul Bakker1a7550a2013-09-15 13:01:22 +020040#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020041#if defined(MBEDTLS_PEM_PARSE_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000042#include "mbedtls/pem.h"
Paul Bakker1a7550a2013-09-15 13:01:22 +020043#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020044#if defined(MBEDTLS_PKCS5_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000045#include "mbedtls/pkcs5.h"
Paul Bakker1a7550a2013-09-15 13:01:22 +020046#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020047#if defined(MBEDTLS_PKCS12_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000048#include "mbedtls/pkcs12.h"
Paul Bakker1a7550a2013-09-15 13:01:22 +020049#endif
50
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020051#if defined(MBEDTLS_PLATFORM_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000052#include "mbedtls/platform.h"
Paul Bakker1a7550a2013-09-15 13:01:22 +020053#else
54#include <stdlib.h>
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +020055#define mbedtls_calloc calloc
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020056#define mbedtls_free free
Paul Bakker1a7550a2013-09-15 13:01:22 +020057#endif
58
Andrzej Kurekc470b6b2019-01-31 08:20:20 -050059/* Parameter validation macros based on platform_util.h */
60#define PK_VALIDATE_RET( cond ) \
61 MBEDTLS_INTERNAL_VALIDATE_RET( cond, MBEDTLS_ERR_PK_BAD_INPUT_DATA )
62#define PK_VALIDATE( cond ) \
63 MBEDTLS_INTERNAL_VALIDATE( cond )
64
Gilles Peskine832f3492017-11-30 11:42:12 +010065#if defined(MBEDTLS_FS_IO)
Paul Bakker1a7550a2013-09-15 13:01:22 +020066/*
67 * Load all data from a file into a given buffer.
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +020068 *
69 * The file is expected to contain either PEM or DER encoded data.
70 * A terminating null byte is always appended. It is included in the announced
71 * length only if the data looks like it is PEM encoded.
Paul Bakker1a7550a2013-09-15 13:01:22 +020072 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020073int mbedtls_pk_load_file( const char *path, unsigned char **buf, size_t *n )
Paul Bakker1a7550a2013-09-15 13:01:22 +020074{
75 FILE *f;
76 long size;
77
Andrzej Kurekc470b6b2019-01-31 08:20:20 -050078 PK_VALIDATE_RET( path != NULL );
79 PK_VALIDATE_RET( buf != NULL );
80 PK_VALIDATE_RET( n != NULL );
81
Paul Bakker1a7550a2013-09-15 13:01:22 +020082 if( ( f = fopen( path, "rb" ) ) == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020083 return( MBEDTLS_ERR_PK_FILE_IO_ERROR );
Paul Bakker1a7550a2013-09-15 13:01:22 +020084
85 fseek( f, 0, SEEK_END );
86 if( ( size = ftell( f ) ) == -1 )
87 {
88 fclose( f );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020089 return( MBEDTLS_ERR_PK_FILE_IO_ERROR );
Paul Bakker1a7550a2013-09-15 13:01:22 +020090 }
91 fseek( f, 0, SEEK_SET );
92
93 *n = (size_t) size;
94
95 if( *n + 1 == 0 ||
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +020096 ( *buf = mbedtls_calloc( 1, *n + 1 ) ) == NULL )
Paul Bakker1a7550a2013-09-15 13:01:22 +020097 {
98 fclose( f );
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +020099 return( MBEDTLS_ERR_PK_ALLOC_FAILED );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200100 }
101
102 if( fread( *buf, 1, *n, f ) != *n )
103 {
104 fclose( f );
Andres Amaya Garcia1f2666f2017-06-26 10:36:20 +0100105
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500106 mbedtls_platform_zeroize( *buf, *n );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200107 mbedtls_free( *buf );
Andres Amaya Garcia1f2666f2017-06-26 10:36:20 +0100108
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200109 return( MBEDTLS_ERR_PK_FILE_IO_ERROR );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200110 }
111
112 fclose( f );
113
114 (*buf)[*n] = '\0';
115
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +0200116 if( strstr( (const char *) *buf, "-----BEGIN " ) != NULL )
117 ++*n;
118
Paul Bakker1a7550a2013-09-15 13:01:22 +0200119 return( 0 );
120}
121
122/*
123 * Load and parse a private key
124 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200125int mbedtls_pk_parse_keyfile( mbedtls_pk_context *ctx,
Paul Bakker1a7550a2013-09-15 13:01:22 +0200126 const char *path, const char *pwd )
127{
Janos Follath24eed8d2019-11-22 13:21:35 +0000128 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200129 size_t n;
130 unsigned char *buf;
131
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500132 PK_VALIDATE_RET( ctx != NULL );
133 PK_VALIDATE_RET( path != NULL );
134
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200135 if( ( ret = mbedtls_pk_load_file( path, &buf, &n ) ) != 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200136 return( ret );
137
138 if( pwd == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200139 ret = mbedtls_pk_parse_key( ctx, buf, n, NULL, 0 );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200140 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200141 ret = mbedtls_pk_parse_key( ctx, buf, n,
Paul Bakker1a7550a2013-09-15 13:01:22 +0200142 (const unsigned char *) pwd, strlen( pwd ) );
143
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500144 mbedtls_platform_zeroize( buf, n );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200145 mbedtls_free( buf );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200146
147 return( ret );
148}
149
150/*
151 * Load and parse a public key
152 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200153int mbedtls_pk_parse_public_keyfile( mbedtls_pk_context *ctx, const char *path )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200154{
Janos Follath24eed8d2019-11-22 13:21:35 +0000155 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200156 size_t n;
157 unsigned char *buf;
158
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500159 PK_VALIDATE_RET( ctx != NULL );
160 PK_VALIDATE_RET( path != NULL );
161
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200162 if( ( ret = mbedtls_pk_load_file( path, &buf, &n ) ) != 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200163 return( ret );
164
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200165 ret = mbedtls_pk_parse_public_key( ctx, buf, n );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200166
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500167 mbedtls_platform_zeroize( buf, n );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200168 mbedtls_free( buf );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200169
170 return( ret );
171}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200172#endif /* MBEDTLS_FS_IO */
Paul Bakker1a7550a2013-09-15 13:01:22 +0200173
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200174#if defined(MBEDTLS_ECP_C)
175/* Minimally parse an ECParameters buffer to and mbedtls_asn1_buf
Paul Bakker1a7550a2013-09-15 13:01:22 +0200176 *
177 * ECParameters ::= CHOICE {
178 * namedCurve OBJECT IDENTIFIER
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100179 * specifiedCurve SpecifiedECDomain -- = SEQUENCE { ... }
Paul Bakker1a7550a2013-09-15 13:01:22 +0200180 * -- implicitCurve NULL
Paul Bakker1a7550a2013-09-15 13:01:22 +0200181 * }
182 */
183static int pk_get_ecparams( unsigned char **p, const unsigned char *end,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200184 mbedtls_asn1_buf *params )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200185{
Janos Follath24eed8d2019-11-22 13:21:35 +0000186 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200187
Sanne Woudab2b29d52017-08-21 15:58:12 +0100188 if ( end - *p < 1 )
Chris Jones9f7a6932021-04-14 12:12:09 +0100189 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT,
190 MBEDTLS_ERR_ASN1_OUT_OF_DATA ) );
Sanne Woudab2b29d52017-08-21 15:58:12 +0100191
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100192 /* Tag may be either OID or SEQUENCE */
Paul Bakker1a7550a2013-09-15 13:01:22 +0200193 params->tag = **p;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200194 if( params->tag != MBEDTLS_ASN1_OID
195#if defined(MBEDTLS_PK_PARSE_EC_EXTENDED)
196 && params->tag != ( MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE )
Manuel Pégourié-Gonnard6fac3512014-03-19 16:39:52 +0100197#endif
198 )
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100199 {
Chris Jones9f7a6932021-04-14 12:12:09 +0100200 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT,
201 MBEDTLS_ERR_ASN1_UNEXPECTED_TAG ) );
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100202 }
Paul Bakker1a7550a2013-09-15 13:01:22 +0200203
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200204 if( ( ret = mbedtls_asn1_get_tag( p, end, &params->len, params->tag ) ) != 0 )
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100205 {
Chris Jones9f7a6932021-04-14 12:12:09 +0100206 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100207 }
Paul Bakker1a7550a2013-09-15 13:01:22 +0200208
209 params->p = *p;
210 *p += params->len;
211
212 if( *p != end )
Chris Jones9f7a6932021-04-14 12:12:09 +0100213 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT,
214 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ) );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200215
216 return( 0 );
217}
218
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200219#if defined(MBEDTLS_PK_PARSE_EC_EXTENDED)
Paul Bakker1a7550a2013-09-15 13:01:22 +0200220/*
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100221 * Parse a SpecifiedECDomain (SEC 1 C.2) and (mostly) fill the group with it.
222 * WARNING: the resulting group should only be used with
223 * pk_group_id_from_specified(), since its base point may not be set correctly
224 * if it was encoded compressed.
225 *
226 * SpecifiedECDomain ::= SEQUENCE {
227 * version SpecifiedECDomainVersion(ecdpVer1 | ecdpVer2 | ecdpVer3, ...),
228 * fieldID FieldID {{FieldTypes}},
229 * curve Curve,
230 * base ECPoint,
231 * order INTEGER,
232 * cofactor INTEGER OPTIONAL,
233 * hash HashAlgorithm OPTIONAL,
234 * ...
235 * }
236 *
237 * We only support prime-field as field type, and ignore hash and cofactor.
238 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200239static int pk_group_from_specified( const mbedtls_asn1_buf *params, mbedtls_ecp_group *grp )
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100240{
Janos Follath24eed8d2019-11-22 13:21:35 +0000241 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100242 unsigned char *p = params->p;
243 const unsigned char * const end = params->p + params->len;
244 const unsigned char *end_field, *end_curve;
245 size_t len;
246 int ver;
247
248 /* SpecifiedECDomainVersion ::= INTEGER { 1, 2, 3 } */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200249 if( ( ret = mbedtls_asn1_get_int( &p, end, &ver ) ) != 0 )
Chris Jones9f7a6932021-04-14 12:12:09 +0100250 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100251
252 if( ver < 1 || ver > 3 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200253 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT );
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100254
255 /*
256 * FieldID { FIELD-ID:IOSet } ::= SEQUENCE { -- Finite field
257 * fieldType FIELD-ID.&id({IOSet}),
258 * parameters FIELD-ID.&Type({IOSet}{@fieldType})
259 * }
260 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200261 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
262 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100263 return( ret );
264
265 end_field = p + len;
266
267 /*
268 * FIELD-ID ::= TYPE-IDENTIFIER
269 * FieldTypes FIELD-ID ::= {
270 * { Prime-p IDENTIFIED BY prime-field } |
271 * { Characteristic-two IDENTIFIED BY characteristic-two-field }
272 * }
273 * prime-field OBJECT IDENTIFIER ::= { id-fieldType 1 }
274 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200275 if( ( ret = mbedtls_asn1_get_tag( &p, end_field, &len, MBEDTLS_ASN1_OID ) ) != 0 )
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100276 return( ret );
277
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200278 if( len != MBEDTLS_OID_SIZE( MBEDTLS_OID_ANSI_X9_62_PRIME_FIELD ) ||
279 memcmp( p, MBEDTLS_OID_ANSI_X9_62_PRIME_FIELD, len ) != 0 )
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100280 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200281 return( MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100282 }
283
284 p += len;
285
286 /* Prime-p ::= INTEGER -- Field of size p. */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200287 if( ( ret = mbedtls_asn1_get_mpi( &p, end_field, &grp->P ) ) != 0 )
Chris Jones9f7a6932021-04-14 12:12:09 +0100288 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100289
Manuel Pégourié-Gonnardc0696c22015-06-18 16:47:17 +0200290 grp->pbits = mbedtls_mpi_bitlen( &grp->P );
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100291
292 if( p != end_field )
Chris Jones9f7a6932021-04-14 12:12:09 +0100293 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT,
294 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ) );
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100295
296 /*
297 * Curve ::= SEQUENCE {
298 * a FieldElement,
299 * b FieldElement,
300 * seed BIT STRING OPTIONAL
301 * -- Shall be present if used in SpecifiedECDomain
302 * -- with version equal to ecdpVer2 or ecdpVer3
303 * }
304 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200305 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
306 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100307 return( ret );
308
309 end_curve = p + len;
310
311 /*
312 * FieldElement ::= OCTET STRING
313 * containing an integer in the case of a prime field
314 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200315 if( ( ret = mbedtls_asn1_get_tag( &p, end_curve, &len, MBEDTLS_ASN1_OCTET_STRING ) ) != 0 ||
316 ( ret = mbedtls_mpi_read_binary( &grp->A, p, len ) ) != 0 )
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100317 {
Chris Jones9f7a6932021-04-14 12:12:09 +0100318 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100319 }
320
321 p += len;
322
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200323 if( ( ret = mbedtls_asn1_get_tag( &p, end_curve, &len, MBEDTLS_ASN1_OCTET_STRING ) ) != 0 ||
324 ( ret = mbedtls_mpi_read_binary( &grp->B, p, len ) ) != 0 )
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100325 {
Chris Jones9f7a6932021-04-14 12:12:09 +0100326 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100327 }
328
329 p += len;
330
331 /* Ignore seed BIT STRING OPTIONAL */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200332 if( ( ret = mbedtls_asn1_get_tag( &p, end_curve, &len, MBEDTLS_ASN1_BIT_STRING ) ) == 0 )
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100333 p += len;
334
335 if( p != end_curve )
Chris Jones9f7a6932021-04-14 12:12:09 +0100336 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT,
337 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ) );
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100338
339 /*
340 * ECPoint ::= OCTET STRING
341 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200342 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len, MBEDTLS_ASN1_OCTET_STRING ) ) != 0 )
Chris Jones9f7a6932021-04-14 12:12:09 +0100343 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100344
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200345 if( ( ret = mbedtls_ecp_point_read_binary( grp, &grp->G,
Manuel Pégourié-Gonnard5246ee52014-03-19 16:18:38 +0100346 ( const unsigned char *) p, len ) ) != 0 )
347 {
348 /*
349 * If we can't read the point because it's compressed, cheat by
350 * reading only the X coordinate and the parity bit of Y.
351 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200352 if( ret != MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE ||
Manuel Pégourié-Gonnard5246ee52014-03-19 16:18:38 +0100353 ( p[0] != 0x02 && p[0] != 0x03 ) ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200354 len != mbedtls_mpi_size( &grp->P ) + 1 ||
355 mbedtls_mpi_read_binary( &grp->G.X, p + 1, len - 1 ) != 0 ||
356 mbedtls_mpi_lset( &grp->G.Y, p[0] - 2 ) != 0 ||
357 mbedtls_mpi_lset( &grp->G.Z, 1 ) != 0 )
Manuel Pégourié-Gonnard5246ee52014-03-19 16:18:38 +0100358 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200359 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT );
Manuel Pégourié-Gonnard5246ee52014-03-19 16:18:38 +0100360 }
361 }
362
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100363 p += len;
364
365 /*
366 * order INTEGER
367 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200368 if( ( ret = mbedtls_asn1_get_mpi( &p, end, &grp->N ) ) != 0 )
Chris Jones9f7a6932021-04-14 12:12:09 +0100369 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100370
Manuel Pégourié-Gonnardc0696c22015-06-18 16:47:17 +0200371 grp->nbits = mbedtls_mpi_bitlen( &grp->N );
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100372
373 /*
374 * Allow optional elements by purposefully not enforcing p == end here.
375 */
376
377 return( 0 );
378}
379
380/*
381 * Find the group id associated with an (almost filled) group as generated by
382 * pk_group_from_specified(), or return an error if unknown.
383 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200384static int pk_group_id_from_group( const mbedtls_ecp_group *grp, mbedtls_ecp_group_id *grp_id )
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100385{
Manuel Pégourié-Gonnard5b8c4092014-03-27 14:59:42 +0100386 int ret = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200387 mbedtls_ecp_group ref;
388 const mbedtls_ecp_group_id *id;
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100389
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200390 mbedtls_ecp_group_init( &ref );
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100391
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200392 for( id = mbedtls_ecp_grp_id_list(); *id != MBEDTLS_ECP_DP_NONE; id++ )
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100393 {
394 /* Load the group associated to that id */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200395 mbedtls_ecp_group_free( &ref );
Manuel Pégourié-Gonnarde3a062b2015-05-11 18:46:47 +0200396 MBEDTLS_MPI_CHK( mbedtls_ecp_group_load( &ref, *id ) );
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100397
398 /* Compare to the group we were given, starting with easy tests */
399 if( grp->pbits == ref.pbits && grp->nbits == ref.nbits &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200400 mbedtls_mpi_cmp_mpi( &grp->P, &ref.P ) == 0 &&
401 mbedtls_mpi_cmp_mpi( &grp->A, &ref.A ) == 0 &&
402 mbedtls_mpi_cmp_mpi( &grp->B, &ref.B ) == 0 &&
403 mbedtls_mpi_cmp_mpi( &grp->N, &ref.N ) == 0 &&
404 mbedtls_mpi_cmp_mpi( &grp->G.X, &ref.G.X ) == 0 &&
405 mbedtls_mpi_cmp_mpi( &grp->G.Z, &ref.G.Z ) == 0 &&
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100406 /* For Y we may only know the parity bit, so compare only that */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200407 mbedtls_mpi_get_bit( &grp->G.Y, 0 ) == mbedtls_mpi_get_bit( &ref.G.Y, 0 ) )
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100408 {
409 break;
410 }
411
412 }
413
414cleanup:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200415 mbedtls_ecp_group_free( &ref );
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100416
417 *grp_id = *id;
418
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200419 if( ret == 0 && *id == MBEDTLS_ECP_DP_NONE )
420 ret = MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE;
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100421
422 return( ret );
423}
424
425/*
426 * Parse a SpecifiedECDomain (SEC 1 C.2) and find the associated group ID
427 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200428static int pk_group_id_from_specified( const mbedtls_asn1_buf *params,
429 mbedtls_ecp_group_id *grp_id )
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100430{
Janos Follath24eed8d2019-11-22 13:21:35 +0000431 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200432 mbedtls_ecp_group grp;
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100433
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200434 mbedtls_ecp_group_init( &grp );
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100435
436 if( ( ret = pk_group_from_specified( params, &grp ) ) != 0 )
437 goto cleanup;
438
439 ret = pk_group_id_from_group( &grp, grp_id );
440
441cleanup:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200442 mbedtls_ecp_group_free( &grp );
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100443
444 return( ret );
445}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200446#endif /* MBEDTLS_PK_PARSE_EC_EXTENDED */
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100447
448/*
Paul Bakker1a7550a2013-09-15 13:01:22 +0200449 * Use EC parameters to initialise an EC group
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100450 *
451 * ECParameters ::= CHOICE {
452 * namedCurve OBJECT IDENTIFIER
453 * specifiedCurve SpecifiedECDomain -- = SEQUENCE { ... }
454 * -- implicitCurve NULL
Paul Bakker1a7550a2013-09-15 13:01:22 +0200455 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200456static int pk_use_ecparams( const mbedtls_asn1_buf *params, mbedtls_ecp_group *grp )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200457{
Janos Follath24eed8d2019-11-22 13:21:35 +0000458 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200459 mbedtls_ecp_group_id grp_id;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200460
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200461 if( params->tag == MBEDTLS_ASN1_OID )
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100462 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200463 if( mbedtls_oid_get_ec_grp( params, &grp_id ) != 0 )
464 return( MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE );
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100465 }
466 else
467 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200468#if defined(MBEDTLS_PK_PARSE_EC_EXTENDED)
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100469 if( ( ret = pk_group_id_from_specified( params, &grp_id ) ) != 0 )
470 return( ret );
Manuel Pégourié-Gonnard6fac3512014-03-19 16:39:52 +0100471#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200472 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT );
Manuel Pégourié-Gonnard6fac3512014-03-19 16:39:52 +0100473#endif
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100474 }
Paul Bakker1a7550a2013-09-15 13:01:22 +0200475
476 /*
477 * grp may already be initilialized; if so, make sure IDs match
478 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200479 if( grp->id != MBEDTLS_ECP_DP_NONE && grp->id != grp_id )
480 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200481
Manuel Pégourié-Gonnarde3a062b2015-05-11 18:46:47 +0200482 if( ( ret = mbedtls_ecp_group_load( grp, grp_id ) ) != 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200483 return( ret );
484
485 return( 0 );
486}
487
488/*
489 * EC public key is an EC point
Manuel Pégourié-Gonnard5246ee52014-03-19 16:18:38 +0100490 *
491 * The caller is responsible for clearing the structure upon failure if
492 * desired. Take care to pass along the possible ECP_FEATURE_UNAVAILABLE
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200493 * return code of mbedtls_ecp_point_read_binary() and leave p in a usable state.
Paul Bakker1a7550a2013-09-15 13:01:22 +0200494 */
495static int pk_get_ecpubkey( unsigned char **p, const unsigned char *end,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200496 mbedtls_ecp_keypair *key )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200497{
Janos Follath24eed8d2019-11-22 13:21:35 +0000498 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200499
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200500 if( ( ret = mbedtls_ecp_point_read_binary( &key->grp, &key->Q,
Manuel Pégourié-Gonnard5246ee52014-03-19 16:18:38 +0100501 (const unsigned char *) *p, end - *p ) ) == 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200502 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200503 ret = mbedtls_ecp_check_pubkey( &key->grp, &key->Q );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200504 }
505
506 /*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200507 * We know mbedtls_ecp_point_read_binary consumed all bytes or failed
Paul Bakker1a7550a2013-09-15 13:01:22 +0200508 */
509 *p = (unsigned char *) end;
510
Manuel Pégourié-Gonnard5246ee52014-03-19 16:18:38 +0100511 return( ret );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200512}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200513#endif /* MBEDTLS_ECP_C */
Paul Bakker1a7550a2013-09-15 13:01:22 +0200514
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200515#if defined(MBEDTLS_RSA_C)
Paul Bakker1a7550a2013-09-15 13:01:22 +0200516/*
517 * RSAPublicKey ::= SEQUENCE {
518 * modulus INTEGER, -- n
519 * publicExponent INTEGER -- e
520 * }
521 */
522static int pk_get_rsapubkey( unsigned char **p,
523 const unsigned char *end,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200524 mbedtls_rsa_context *rsa )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200525{
Janos Follath24eed8d2019-11-22 13:21:35 +0000526 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200527 size_t len;
528
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200529 if( ( ret = mbedtls_asn1_get_tag( p, end, &len,
530 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
Chris Jones9f7a6932021-04-14 12:12:09 +0100531 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_INVALID_PUBKEY, ret ) );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200532
533 if( *p + len != end )
Chris Jones9f7a6932021-04-14 12:12:09 +0100534 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_INVALID_PUBKEY,
535 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ) );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200536
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100537 /* Import N */
538 if( ( ret = mbedtls_asn1_get_tag( p, end, &len, MBEDTLS_ASN1_INTEGER ) ) != 0 )
Chris Jones9f7a6932021-04-14 12:12:09 +0100539 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_INVALID_PUBKEY, ret ) );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200540
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100541 if( ( ret = mbedtls_rsa_import_raw( rsa, *p, len, NULL, 0, NULL, 0,
542 NULL, 0, NULL, 0 ) ) != 0 )
543 return( MBEDTLS_ERR_PK_INVALID_PUBKEY );
544
545 *p += len;
546
547 /* Import E */
548 if( ( ret = mbedtls_asn1_get_tag( p, end, &len, MBEDTLS_ASN1_INTEGER ) ) != 0 )
Chris Jones9f7a6932021-04-14 12:12:09 +0100549 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_INVALID_PUBKEY, ret ) );
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100550
551 if( ( ret = mbedtls_rsa_import_raw( rsa, NULL, 0, NULL, 0, NULL, 0,
552 NULL, 0, *p, len ) ) != 0 )
553 return( MBEDTLS_ERR_PK_INVALID_PUBKEY );
554
555 *p += len;
556
Hanno Becker895c5ab2018-01-05 08:08:09 +0000557 if( mbedtls_rsa_complete( rsa ) != 0 ||
558 mbedtls_rsa_check_pubkey( rsa ) != 0 )
559 {
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100560 return( MBEDTLS_ERR_PK_INVALID_PUBKEY );
Hanno Becker895c5ab2018-01-05 08:08:09 +0000561 }
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100562
Paul Bakker1a7550a2013-09-15 13:01:22 +0200563 if( *p != end )
Chris Jones9f7a6932021-04-14 12:12:09 +0100564 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_INVALID_PUBKEY,
565 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ) );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200566
Paul Bakker1a7550a2013-09-15 13:01:22 +0200567 return( 0 );
568}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200569#endif /* MBEDTLS_RSA_C */
Paul Bakker1a7550a2013-09-15 13:01:22 +0200570
571/* Get a PK algorithm identifier
572 *
573 * AlgorithmIdentifier ::= SEQUENCE {
574 * algorithm OBJECT IDENTIFIER,
575 * parameters ANY DEFINED BY algorithm OPTIONAL }
576 */
577static int pk_get_pk_alg( unsigned char **p,
578 const unsigned char *end,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200579 mbedtls_pk_type_t *pk_alg, mbedtls_asn1_buf *params )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200580{
Janos Follath24eed8d2019-11-22 13:21:35 +0000581 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200582 mbedtls_asn1_buf alg_oid;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200583
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200584 memset( params, 0, sizeof(mbedtls_asn1_buf) );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200585
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200586 if( ( ret = mbedtls_asn1_get_alg( p, end, &alg_oid, params ) ) != 0 )
Chris Jones9f7a6932021-04-14 12:12:09 +0100587 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_INVALID_ALG, ret ) );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200588
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200589 if( mbedtls_oid_get_pk_alg( &alg_oid, pk_alg ) != 0 )
590 return( MBEDTLS_ERR_PK_UNKNOWN_PK_ALG );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200591
592 /*
593 * No parameters with RSA (only for EC)
594 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200595 if( *pk_alg == MBEDTLS_PK_RSA &&
596 ( ( params->tag != MBEDTLS_ASN1_NULL && params->tag != 0 ) ||
Paul Bakker1a7550a2013-09-15 13:01:22 +0200597 params->len != 0 ) )
598 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200599 return( MBEDTLS_ERR_PK_INVALID_ALG );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200600 }
601
602 return( 0 );
603}
604
605/*
606 * SubjectPublicKeyInfo ::= SEQUENCE {
607 * algorithm AlgorithmIdentifier,
608 * subjectPublicKey BIT STRING }
609 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200610int mbedtls_pk_parse_subpubkey( unsigned char **p, const unsigned char *end,
611 mbedtls_pk_context *pk )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200612{
Janos Follath24eed8d2019-11-22 13:21:35 +0000613 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200614 size_t len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200615 mbedtls_asn1_buf alg_params;
616 mbedtls_pk_type_t pk_alg = MBEDTLS_PK_NONE;
617 const mbedtls_pk_info_t *pk_info;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200618
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500619 PK_VALIDATE_RET( p != NULL );
620 PK_VALIDATE_RET( *p != NULL );
621 PK_VALIDATE_RET( end != NULL );
622 PK_VALIDATE_RET( pk != NULL );
623
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200624 if( ( ret = mbedtls_asn1_get_tag( p, end, &len,
625 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200626 {
Chris Jones9f7a6932021-04-14 12:12:09 +0100627 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200628 }
629
630 end = *p + len;
631
632 if( ( ret = pk_get_pk_alg( p, end, &pk_alg, &alg_params ) ) != 0 )
633 return( ret );
634
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200635 if( ( ret = mbedtls_asn1_get_bitstring_null( p, end, &len ) ) != 0 )
Chris Jones9f7a6932021-04-14 12:12:09 +0100636 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_INVALID_PUBKEY, ret ) );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200637
638 if( *p + len != end )
Chris Jones9f7a6932021-04-14 12:12:09 +0100639 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_INVALID_PUBKEY,
640 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ) );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200641
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200642 if( ( pk_info = mbedtls_pk_info_from_type( pk_alg ) ) == NULL )
643 return( MBEDTLS_ERR_PK_UNKNOWN_PK_ALG );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200644
Manuel Pégourié-Gonnardd9e6a3a2015-05-14 19:41:36 +0200645 if( ( ret = mbedtls_pk_setup( pk, pk_info ) ) != 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200646 return( ret );
647
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200648#if defined(MBEDTLS_RSA_C)
649 if( pk_alg == MBEDTLS_PK_RSA )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200650 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200651 ret = pk_get_rsapubkey( p, end, mbedtls_pk_rsa( *pk ) );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200652 } else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200653#endif /* MBEDTLS_RSA_C */
654#if defined(MBEDTLS_ECP_C)
655 if( pk_alg == MBEDTLS_PK_ECKEY_DH || pk_alg == MBEDTLS_PK_ECKEY )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200656 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200657 ret = pk_use_ecparams( &alg_params, &mbedtls_pk_ec( *pk )->grp );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200658 if( ret == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200659 ret = pk_get_ecpubkey( p, end, mbedtls_pk_ec( *pk ) );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200660 } else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200661#endif /* MBEDTLS_ECP_C */
662 ret = MBEDTLS_ERR_PK_UNKNOWN_PK_ALG;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200663
664 if( ret == 0 && *p != end )
Chris Jones9f7a6932021-04-14 12:12:09 +0100665 ret = MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_INVALID_PUBKEY,
666 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200667
668 if( ret != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200669 mbedtls_pk_free( pk );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200670
671 return( ret );
672}
673
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200674#if defined(MBEDTLS_RSA_C)
Paul Bakker1a7550a2013-09-15 13:01:22 +0200675/*
Manuel Pégourié-Gonnarda04a2c32020-02-18 10:12:14 +0100676 * Wrapper around mbedtls_asn1_get_mpi() that rejects zero.
677 *
678 * The value zero is:
679 * - never a valid value for an RSA parameter
680 * - interpreted as "omitted, please reconstruct" by mbedtls_rsa_complete().
681 *
682 * Since values can't be omitted in PKCS#1, passing a zero value to
683 * rsa_complete() would be incorrect, so reject zero values early.
684 */
685static int asn1_get_nonzero_mpi( unsigned char **p,
686 const unsigned char *end,
687 mbedtls_mpi *X )
688{
689 int ret;
690
691 ret = mbedtls_asn1_get_mpi( p, end, X );
692 if( ret != 0 )
693 return( ret );
694
695 if( mbedtls_mpi_cmp_int( X, 0 ) == 0 )
696 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT );
697
698 return( 0 );
699}
700
701/*
Paul Bakker1a7550a2013-09-15 13:01:22 +0200702 * Parse a PKCS#1 encoded private RSA key
703 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200704static int pk_parse_key_pkcs1_der( mbedtls_rsa_context *rsa,
Paul Bakker1a7550a2013-09-15 13:01:22 +0200705 const unsigned char *key,
706 size_t keylen )
707{
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100708 int ret, version;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200709 size_t len;
710 unsigned char *p, *end;
711
Hanno Beckerefa14e82017-10-11 19:45:19 +0100712 mbedtls_mpi T;
713 mbedtls_mpi_init( &T );
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100714
Paul Bakker1a7550a2013-09-15 13:01:22 +0200715 p = (unsigned char *) key;
716 end = p + keylen;
717
718 /*
719 * This function parses the RSAPrivateKey (PKCS#1)
720 *
721 * RSAPrivateKey ::= SEQUENCE {
722 * version Version,
723 * modulus INTEGER, -- n
724 * publicExponent INTEGER, -- e
725 * privateExponent INTEGER, -- d
726 * prime1 INTEGER, -- p
727 * prime2 INTEGER, -- q
728 * exponent1 INTEGER, -- d mod (p-1)
729 * exponent2 INTEGER, -- d mod (q-1)
730 * coefficient INTEGER, -- (inverse of q) mod p
731 * otherPrimeInfos OtherPrimeInfos OPTIONAL
732 * }
733 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200734 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
735 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200736 {
Chris Jones9f7a6932021-04-14 12:12:09 +0100737 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200738 }
739
740 end = p + len;
741
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100742 if( ( ret = mbedtls_asn1_get_int( &p, end, &version ) ) != 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200743 {
Chris Jones9f7a6932021-04-14 12:12:09 +0100744 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200745 }
746
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100747 if( version != 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200748 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200749 return( MBEDTLS_ERR_PK_KEY_INVALID_VERSION );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200750 }
751
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100752 /* Import N */
Manuel Pégourié-Gonnarda04a2c32020-02-18 10:12:14 +0100753 if( ( ret = asn1_get_nonzero_mpi( &p, end, &T ) ) != 0 ||
754 ( ret = mbedtls_rsa_import( rsa, &T, NULL, NULL,
755 NULL, NULL ) ) != 0 )
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100756 goto cleanup;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200757
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100758 /* Import E */
Manuel Pégourié-Gonnarda04a2c32020-02-18 10:12:14 +0100759 if( ( ret = asn1_get_nonzero_mpi( &p, end, &T ) ) != 0 ||
760 ( ret = mbedtls_rsa_import( rsa, NULL, NULL, NULL,
761 NULL, &T ) ) != 0 )
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100762 goto cleanup;
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100763
764 /* Import D */
Manuel Pégourié-Gonnarda04a2c32020-02-18 10:12:14 +0100765 if( ( ret = asn1_get_nonzero_mpi( &p, end, &T ) ) != 0 ||
766 ( ret = mbedtls_rsa_import( rsa, NULL, NULL, NULL,
767 &T, NULL ) ) != 0 )
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100768 goto cleanup;
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100769
770 /* Import P */
Manuel Pégourié-Gonnarda04a2c32020-02-18 10:12:14 +0100771 if( ( ret = asn1_get_nonzero_mpi( &p, end, &T ) ) != 0 ||
772 ( ret = mbedtls_rsa_import( rsa, NULL, &T, NULL,
773 NULL, NULL ) ) != 0 )
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100774 goto cleanup;
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100775
776 /* Import Q */
Manuel Pégourié-Gonnarda04a2c32020-02-18 10:12:14 +0100777 if( ( ret = asn1_get_nonzero_mpi( &p, end, &T ) ) != 0 ||
778 ( ret = mbedtls_rsa_import( rsa, NULL, NULL, &T,
779 NULL, NULL ) ) != 0 )
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100780 goto cleanup;
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100781
Manuel Pégourié-Gonnardbbb5a0a2020-02-18 10:22:54 +0100782#if !defined(MBEDTLS_RSA_NO_CRT) && !defined(MBEDTLS_RSA_ALT)
Jack Lloyd8c2631b2020-01-23 17:23:52 -0500783 /*
784 * The RSA CRT parameters DP, DQ and QP are nominally redundant, in
785 * that they can be easily recomputed from D, P and Q. However by
786 * parsing them from the PKCS1 structure it is possible to avoid
787 * recalculating them which both reduces the overhead of loading
788 * RSA private keys into memory and also avoids side channels which
789 * can arise when computing those values, since all of D, P, and Q
790 * are secret. See https://eprint.iacr.org/2020/055 for a
791 * description of one such attack.
792 */
793
Jack Lloyd80cc8112020-01-22 17:34:29 -0500794 /* Import DP */
Manuel Pégourié-Gonnarda04a2c32020-02-18 10:12:14 +0100795 if( ( ret = asn1_get_nonzero_mpi( &p, end, &T ) ) != 0 ||
796 ( ret = mbedtls_mpi_copy( &rsa->DP, &T ) ) != 0 )
Jack Lloyd2e9eef42020-01-28 14:43:52 -0500797 goto cleanup;
Jack Lloyd80cc8112020-01-22 17:34:29 -0500798
799 /* Import DQ */
Manuel Pégourié-Gonnarda04a2c32020-02-18 10:12:14 +0100800 if( ( ret = asn1_get_nonzero_mpi( &p, end, &T ) ) != 0 ||
801 ( ret = mbedtls_mpi_copy( &rsa->DQ, &T ) ) != 0 )
Jack Lloyd2e9eef42020-01-28 14:43:52 -0500802 goto cleanup;
Jack Lloyd80cc8112020-01-22 17:34:29 -0500803
804 /* Import QP */
Manuel Pégourié-Gonnarda04a2c32020-02-18 10:12:14 +0100805 if( ( ret = asn1_get_nonzero_mpi( &p, end, &T ) ) != 0 ||
806 ( ret = mbedtls_mpi_copy( &rsa->QP, &T ) ) != 0 )
Jack Lloyd2e9eef42020-01-28 14:43:52 -0500807 goto cleanup;
808
Jack Lloyd60239752020-01-27 17:53:36 -0500809#else
810 /* Verify existance of the CRT params */
Manuel Pégourié-Gonnarda04a2c32020-02-18 10:12:14 +0100811 if( ( ret = asn1_get_nonzero_mpi( &p, end, &T ) ) != 0 ||
812 ( ret = asn1_get_nonzero_mpi( &p, end, &T ) ) != 0 ||
813 ( ret = asn1_get_nonzero_mpi( &p, end, &T ) ) != 0 )
Jack Lloyd60239752020-01-27 17:53:36 -0500814 goto cleanup;
815#endif
Jack Lloyd80cc8112020-01-22 17:34:29 -0500816
Manuel Pégourié-Gonnardc4226792020-02-14 11:28:47 +0100817 /* rsa_complete() doesn't complete anything with the default
818 * implementation but is still called:
819 * - for the benefit of alternative implementation that may want to
820 * pre-compute stuff beyond what's provided (eg Montgomery factors)
821 * - as is also sanity-checks the key
822 *
823 * Furthermore, we also check the public part for consistency with
824 * mbedtls_pk_parse_pubkey(), as it includes size minima for example.
825 */
826 if( ( ret = mbedtls_rsa_complete( rsa ) ) != 0 ||
827 ( ret = mbedtls_rsa_check_pubkey( rsa ) ) != 0 )
828 {
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100829 goto cleanup;
Manuel Pégourié-Gonnardc4226792020-02-14 11:28:47 +0100830 }
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100831
Paul Bakker1a7550a2013-09-15 13:01:22 +0200832 if( p != end )
833 {
Chris Jones9f7a6932021-04-14 12:12:09 +0100834 ret = MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT,
835 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200836 }
837
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100838cleanup:
839
Hanno Beckerefa14e82017-10-11 19:45:19 +0100840 mbedtls_mpi_free( &T );
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100841
842 if( ret != 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200843 {
Hanno Beckerefa14e82017-10-11 19:45:19 +0100844 /* Wrap error code if it's coming from a lower level */
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100845 if( ( ret & 0xff80 ) == 0 )
Chris Jones9f7a6932021-04-14 12:12:09 +0100846 ret = MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret );
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100847 else
848 ret = MBEDTLS_ERR_PK_KEY_INVALID_FORMAT;
849
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200850 mbedtls_rsa_free( rsa );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200851 }
852
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100853 return( ret );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200854}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200855#endif /* MBEDTLS_RSA_C */
Paul Bakker1a7550a2013-09-15 13:01:22 +0200856
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200857#if defined(MBEDTLS_ECP_C)
Paul Bakker1a7550a2013-09-15 13:01:22 +0200858/*
859 * Parse a SEC1 encoded private EC key
860 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200861static int pk_parse_key_sec1_der( mbedtls_ecp_keypair *eck,
Paul Bakker1a7550a2013-09-15 13:01:22 +0200862 const unsigned char *key,
863 size_t keylen )
864{
Janos Follath24eed8d2019-11-22 13:21:35 +0000865 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100866 int version, pubkey_done;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200867 size_t len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200868 mbedtls_asn1_buf params;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200869 unsigned char *p = (unsigned char *) key;
870 unsigned char *end = p + keylen;
871 unsigned char *end2;
872
873 /*
874 * RFC 5915, or SEC1 Appendix C.4
875 *
876 * ECPrivateKey ::= SEQUENCE {
877 * version INTEGER { ecPrivkeyVer1(1) } (ecPrivkeyVer1),
878 * privateKey OCTET STRING,
879 * parameters [0] ECParameters {{ NamedCurve }} OPTIONAL,
880 * publicKey [1] BIT STRING OPTIONAL
881 * }
882 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200883 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
884 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200885 {
Chris Jones9f7a6932021-04-14 12:12:09 +0100886 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200887 }
888
889 end = p + len;
890
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200891 if( ( ret = mbedtls_asn1_get_int( &p, end, &version ) ) != 0 )
Chris Jones9f7a6932021-04-14 12:12:09 +0100892 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200893
894 if( version != 1 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200895 return( MBEDTLS_ERR_PK_KEY_INVALID_VERSION );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200896
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200897 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len, MBEDTLS_ASN1_OCTET_STRING ) ) != 0 )
Chris Jones9f7a6932021-04-14 12:12:09 +0100898 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200899
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200900 if( ( ret = mbedtls_mpi_read_binary( &eck->d, p, len ) ) != 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200901 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200902 mbedtls_ecp_keypair_free( eck );
Chris Jones9f7a6932021-04-14 12:12:09 +0100903 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200904 }
905
906 p += len;
907
Manuel Pégourié-Gonnard924cd102015-04-14 11:18:04 +0200908 pubkey_done = 0;
909 if( p != end )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200910 {
Manuel Pégourié-Gonnard924cd102015-04-14 11:18:04 +0200911 /*
912 * Is 'parameters' present?
913 */
Manuel Pégourié-Gonnarde1e58712015-04-15 10:50:34 +0200914 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
915 MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | 0 ) ) == 0 )
Manuel Pégourié-Gonnard924cd102015-04-14 11:18:04 +0200916 {
917 if( ( ret = pk_get_ecparams( &p, p + len, &params) ) != 0 ||
918 ( ret = pk_use_ecparams( &params, &eck->grp ) ) != 0 )
919 {
Manuel Pégourié-Gonnarde1e58712015-04-15 10:50:34 +0200920 mbedtls_ecp_keypair_free( eck );
Manuel Pégourié-Gonnard924cd102015-04-14 11:18:04 +0200921 return( ret );
922 }
923 }
Manuel Pégourié-Gonnarde1e58712015-04-15 10:50:34 +0200924 else if( ret != MBEDTLS_ERR_ASN1_UNEXPECTED_TAG )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200925 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200926 mbedtls_ecp_keypair_free( eck );
Chris Jones9f7a6932021-04-14 12:12:09 +0100927 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
Manuel Pégourié-Gonnard5246ee52014-03-19 16:18:38 +0100928 }
Jethro Beekmand2df9362018-02-16 13:11:04 -0800929 }
Manuel Pégourié-Gonnard924cd102015-04-14 11:18:04 +0200930
Jethro Beekmand2df9362018-02-16 13:11:04 -0800931 if( p != end )
932 {
Manuel Pégourié-Gonnard924cd102015-04-14 11:18:04 +0200933 /*
934 * Is 'publickey' present? If not, or if we can't read it (eg because it
935 * is compressed), create it from the private key.
936 */
Manuel Pégourié-Gonnarde1e58712015-04-15 10:50:34 +0200937 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
938 MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | 1 ) ) == 0 )
Manuel Pégourié-Gonnard924cd102015-04-14 11:18:04 +0200939 {
940 end2 = p + len;
941
Manuel Pégourié-Gonnarde1e58712015-04-15 10:50:34 +0200942 if( ( ret = mbedtls_asn1_get_bitstring_null( &p, end2, &len ) ) != 0 )
Chris Jones9f7a6932021-04-14 12:12:09 +0100943 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
Manuel Pégourié-Gonnard924cd102015-04-14 11:18:04 +0200944
945 if( p + len != end2 )
Chris Jones9f7a6932021-04-14 12:12:09 +0100946 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT,
947 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ) );
Manuel Pégourié-Gonnard924cd102015-04-14 11:18:04 +0200948
949 if( ( ret = pk_get_ecpubkey( &p, end2, eck ) ) == 0 )
950 pubkey_done = 1;
951 else
952 {
953 /*
954 * The only acceptable failure mode of pk_get_ecpubkey() above
955 * is if the point format is not recognized.
956 */
Manuel Pégourié-Gonnarde1e58712015-04-15 10:50:34 +0200957 if( ret != MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE )
958 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT );
Manuel Pégourié-Gonnard924cd102015-04-14 11:18:04 +0200959 }
960 }
Manuel Pégourié-Gonnarde1e58712015-04-15 10:50:34 +0200961 else if( ret != MBEDTLS_ERR_ASN1_UNEXPECTED_TAG )
Manuel Pégourié-Gonnard924cd102015-04-14 11:18:04 +0200962 {
Manuel Pégourié-Gonnarde1e58712015-04-15 10:50:34 +0200963 mbedtls_ecp_keypair_free( eck );
Chris Jones9f7a6932021-04-14 12:12:09 +0100964 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
Manuel Pégourié-Gonnard924cd102015-04-14 11:18:04 +0200965 }
Paul Bakker1a7550a2013-09-15 13:01:22 +0200966 }
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100967
968 if( ! pubkey_done &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200969 ( ret = mbedtls_ecp_mul( &eck->grp, &eck->Q, &eck->d, &eck->grp.G,
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100970 NULL, NULL ) ) != 0 )
Manuel Pégourié-Gonnardff29f9c2013-09-18 16:13:02 +0200971 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200972 mbedtls_ecp_keypair_free( eck );
Chris Jones9f7a6932021-04-14 12:12:09 +0100973 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
Manuel Pégourié-Gonnardff29f9c2013-09-18 16:13:02 +0200974 }
Paul Bakker1a7550a2013-09-15 13:01:22 +0200975
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200976 if( ( ret = mbedtls_ecp_check_privkey( &eck->grp, &eck->d ) ) != 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +0200977 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200978 mbedtls_ecp_keypair_free( eck );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200979 return( ret );
980 }
981
Paul Bakkerd8bb8262014-06-17 14:06:49 +0200982 return( 0 );
Paul Bakker1a7550a2013-09-15 13:01:22 +0200983}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200984#endif /* MBEDTLS_ECP_C */
Paul Bakker1a7550a2013-09-15 13:01:22 +0200985
986/*
987 * Parse an unencrypted PKCS#8 encoded private key
Hanno Beckerb4274212017-09-29 19:18:51 +0100988 *
989 * Notes:
990 *
991 * - This function does not own the key buffer. It is the
992 * responsibility of the caller to take care of zeroizing
993 * and freeing it after use.
994 *
995 * - The function is responsible for freeing the provided
996 * PK context on failure.
997 *
Paul Bakker1a7550a2013-09-15 13:01:22 +0200998 */
999static int pk_parse_key_pkcs8_unencrypted_der(
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001000 mbedtls_pk_context *pk,
Paul Bakker1a7550a2013-09-15 13:01:22 +02001001 const unsigned char* key,
1002 size_t keylen )
1003{
1004 int ret, version;
1005 size_t len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001006 mbedtls_asn1_buf params;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001007 unsigned char *p = (unsigned char *) key;
1008 unsigned char *end = p + keylen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001009 mbedtls_pk_type_t pk_alg = MBEDTLS_PK_NONE;
1010 const mbedtls_pk_info_t *pk_info;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001011
1012 /*
Hanno Becker9c6cb382017-09-05 10:08:01 +01001013 * This function parses the PrivateKeyInfo object (PKCS#8 v1.2 = RFC 5208)
Paul Bakker1a7550a2013-09-15 13:01:22 +02001014 *
1015 * PrivateKeyInfo ::= SEQUENCE {
1016 * version Version,
1017 * privateKeyAlgorithm PrivateKeyAlgorithmIdentifier,
1018 * privateKey PrivateKey,
1019 * attributes [0] IMPLICIT Attributes OPTIONAL }
1020 *
1021 * Version ::= INTEGER
1022 * PrivateKeyAlgorithmIdentifier ::= AlgorithmIdentifier
1023 * PrivateKey ::= OCTET STRING
1024 *
1025 * The PrivateKey OCTET STRING is a SEC1 ECPrivateKey
1026 */
1027
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001028 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
1029 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +02001030 {
Chris Jones9f7a6932021-04-14 12:12:09 +01001031 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001032 }
1033
1034 end = p + len;
1035
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001036 if( ( ret = mbedtls_asn1_get_int( &p, end, &version ) ) != 0 )
Chris Jones9f7a6932021-04-14 12:12:09 +01001037 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001038
1039 if( version != 0 )
Chris Jones9f7a6932021-04-14 12:12:09 +01001040 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_VERSION, ret ) );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001041
1042 if( ( ret = pk_get_pk_alg( &p, end, &pk_alg, &params ) ) != 0 )
Chris Jonesfdb588b2021-04-14 18:15:24 +01001043 {
Chris Jones4d01c5b2021-04-28 14:12:07 +01001044 return( ret );
Chris Jonesfdb588b2021-04-14 18:15:24 +01001045 }
Paul Bakker1a7550a2013-09-15 13:01:22 +02001046
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001047 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len, MBEDTLS_ASN1_OCTET_STRING ) ) != 0 )
Chris Jones9f7a6932021-04-14 12:12:09 +01001048 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001049
1050 if( len < 1 )
Chris Jones9f7a6932021-04-14 12:12:09 +01001051 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT,
1052 MBEDTLS_ERR_ASN1_OUT_OF_DATA ) );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001053
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001054 if( ( pk_info = mbedtls_pk_info_from_type( pk_alg ) ) == NULL )
1055 return( MBEDTLS_ERR_PK_UNKNOWN_PK_ALG );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001056
Manuel Pégourié-Gonnardd9e6a3a2015-05-14 19:41:36 +02001057 if( ( ret = mbedtls_pk_setup( pk, pk_info ) ) != 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +02001058 return( ret );
1059
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001060#if defined(MBEDTLS_RSA_C)
1061 if( pk_alg == MBEDTLS_PK_RSA )
Paul Bakker1a7550a2013-09-15 13:01:22 +02001062 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001063 if( ( ret = pk_parse_key_pkcs1_der( mbedtls_pk_rsa( *pk ), p, len ) ) != 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +02001064 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001065 mbedtls_pk_free( pk );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001066 return( ret );
1067 }
1068 } else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001069#endif /* MBEDTLS_RSA_C */
1070#if defined(MBEDTLS_ECP_C)
1071 if( pk_alg == MBEDTLS_PK_ECKEY || pk_alg == MBEDTLS_PK_ECKEY_DH )
Paul Bakker1a7550a2013-09-15 13:01:22 +02001072 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001073 if( ( ret = pk_use_ecparams( &params, &mbedtls_pk_ec( *pk )->grp ) ) != 0 ||
1074 ( ret = pk_parse_key_sec1_der( mbedtls_pk_ec( *pk ), p, len ) ) != 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +02001075 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001076 mbedtls_pk_free( pk );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001077 return( ret );
1078 }
1079 } else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001080#endif /* MBEDTLS_ECP_C */
1081 return( MBEDTLS_ERR_PK_UNKNOWN_PK_ALG );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001082
Paul Bakkerd8bb8262014-06-17 14:06:49 +02001083 return( 0 );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001084}
1085
1086/*
1087 * Parse an encrypted PKCS#8 encoded private key
Hanno Beckerb4274212017-09-29 19:18:51 +01001088 *
1089 * To save space, the decryption happens in-place on the given key buffer.
1090 * Also, while this function may modify the keybuffer, it doesn't own it,
1091 * and instead it is the responsibility of the caller to zeroize and properly
1092 * free it after use.
1093 *
Paul Bakker1a7550a2013-09-15 13:01:22 +02001094 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001095#if defined(MBEDTLS_PKCS12_C) || defined(MBEDTLS_PKCS5_C)
Paul Bakker1a7550a2013-09-15 13:01:22 +02001096static int pk_parse_key_pkcs8_encrypted_der(
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001097 mbedtls_pk_context *pk,
Hanno Beckerfab35692017-08-25 13:38:26 +01001098 unsigned char *key, size_t keylen,
Paul Bakker1a7550a2013-09-15 13:01:22 +02001099 const unsigned char *pwd, size_t pwdlen )
1100{
Paul Bakkerf4cf80b2014-04-17 17:19:56 +02001101 int ret, decrypted = 0;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001102 size_t len;
Hanno Beckerfab35692017-08-25 13:38:26 +01001103 unsigned char *buf;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001104 unsigned char *p, *end;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001105 mbedtls_asn1_buf pbe_alg_oid, pbe_params;
1106#if defined(MBEDTLS_PKCS12_C)
1107 mbedtls_cipher_type_t cipher_alg;
1108 mbedtls_md_type_t md_alg;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001109#endif
1110
Hanno Becker2aa80a72017-09-07 15:28:45 +01001111 p = key;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001112 end = p + keylen;
1113
1114 if( pwdlen == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001115 return( MBEDTLS_ERR_PK_PASSWORD_REQUIRED );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001116
1117 /*
Hanno Beckerf04111f2017-09-29 19:18:42 +01001118 * This function parses the EncryptedPrivateKeyInfo object (PKCS#8)
Paul Bakker1a7550a2013-09-15 13:01:22 +02001119 *
1120 * EncryptedPrivateKeyInfo ::= SEQUENCE {
1121 * encryptionAlgorithm EncryptionAlgorithmIdentifier,
1122 * encryptedData EncryptedData
1123 * }
1124 *
1125 * EncryptionAlgorithmIdentifier ::= AlgorithmIdentifier
1126 *
1127 * EncryptedData ::= OCTET STRING
1128 *
1129 * The EncryptedData OCTET STRING is a PKCS#8 PrivateKeyInfo
Hanno Beckerb8d16572017-09-07 15:29:01 +01001130 *
Paul Bakker1a7550a2013-09-15 13:01:22 +02001131 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001132 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
1133 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +02001134 {
Chris Jones9f7a6932021-04-14 12:12:09 +01001135 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001136 }
1137
1138 end = p + len;
1139
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001140 if( ( ret = mbedtls_asn1_get_alg( &p, end, &pbe_alg_oid, &pbe_params ) ) != 0 )
Chris Jones9f7a6932021-04-14 12:12:09 +01001141 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001142
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001143 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len, MBEDTLS_ASN1_OCTET_STRING ) ) != 0 )
Chris Jones9f7a6932021-04-14 12:12:09 +01001144 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001145
Hanno Beckerfab35692017-08-25 13:38:26 +01001146 buf = p;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001147
1148 /*
Hanno Beckerb8d16572017-09-07 15:29:01 +01001149 * Decrypt EncryptedData with appropriate PBE
Paul Bakker1a7550a2013-09-15 13:01:22 +02001150 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001151#if defined(MBEDTLS_PKCS12_C)
1152 if( mbedtls_oid_get_pkcs12_pbe_alg( &pbe_alg_oid, &md_alg, &cipher_alg ) == 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +02001153 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001154 if( ( ret = mbedtls_pkcs12_pbe( &pbe_params, MBEDTLS_PKCS12_PBE_DECRYPT,
Paul Bakker1a7550a2013-09-15 13:01:22 +02001155 cipher_alg, md_alg,
1156 pwd, pwdlen, p, len, buf ) ) != 0 )
1157 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001158 if( ret == MBEDTLS_ERR_PKCS12_PASSWORD_MISMATCH )
1159 return( MBEDTLS_ERR_PK_PASSWORD_MISMATCH );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001160
1161 return( ret );
1162 }
Paul Bakkerf4cf80b2014-04-17 17:19:56 +02001163
1164 decrypted = 1;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001165 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001166 else if( MBEDTLS_OID_CMP( MBEDTLS_OID_PKCS12_PBE_SHA1_RC4_128, &pbe_alg_oid ) == 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +02001167 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001168 if( ( ret = mbedtls_pkcs12_pbe_sha1_rc4_128( &pbe_params,
1169 MBEDTLS_PKCS12_PBE_DECRYPT,
Paul Bakker1a7550a2013-09-15 13:01:22 +02001170 pwd, pwdlen,
1171 p, len, buf ) ) != 0 )
1172 {
1173 return( ret );
1174 }
1175
1176 // Best guess for password mismatch when using RC4. If first tag is
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001177 // not MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE
Paul Bakker1a7550a2013-09-15 13:01:22 +02001178 //
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001179 if( *buf != ( MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) )
1180 return( MBEDTLS_ERR_PK_PASSWORD_MISMATCH );
Paul Bakkerf4cf80b2014-04-17 17:19:56 +02001181
1182 decrypted = 1;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001183 }
1184 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001185#endif /* MBEDTLS_PKCS12_C */
1186#if defined(MBEDTLS_PKCS5_C)
1187 if( MBEDTLS_OID_CMP( MBEDTLS_OID_PKCS5_PBES2, &pbe_alg_oid ) == 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +02001188 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001189 if( ( ret = mbedtls_pkcs5_pbes2( &pbe_params, MBEDTLS_PKCS5_DECRYPT, pwd, pwdlen,
Paul Bakker1a7550a2013-09-15 13:01:22 +02001190 p, len, buf ) ) != 0 )
1191 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001192 if( ret == MBEDTLS_ERR_PKCS5_PASSWORD_MISMATCH )
1193 return( MBEDTLS_ERR_PK_PASSWORD_MISMATCH );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001194
1195 return( ret );
1196 }
Paul Bakkerf4cf80b2014-04-17 17:19:56 +02001197
1198 decrypted = 1;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001199 }
1200 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001201#endif /* MBEDTLS_PKCS5_C */
Manuel Pégourié-Gonnard1032c1d2013-09-18 17:18:34 +02001202 {
1203 ((void) pwd);
Manuel Pégourié-Gonnard1032c1d2013-09-18 17:18:34 +02001204 }
Paul Bakker1a7550a2013-09-15 13:01:22 +02001205
Paul Bakkerf4cf80b2014-04-17 17:19:56 +02001206 if( decrypted == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001207 return( MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE );
Paul Bakkerf4cf80b2014-04-17 17:19:56 +02001208
Paul Bakker1a7550a2013-09-15 13:01:22 +02001209 return( pk_parse_key_pkcs8_unencrypted_der( pk, buf, len ) );
1210}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001211#endif /* MBEDTLS_PKCS12_C || MBEDTLS_PKCS5_C */
Paul Bakker1a7550a2013-09-15 13:01:22 +02001212
1213/*
1214 * Parse a private key
1215 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001216int mbedtls_pk_parse_key( mbedtls_pk_context *pk,
Paul Bakker1a7550a2013-09-15 13:01:22 +02001217 const unsigned char *key, size_t keylen,
1218 const unsigned char *pwd, size_t pwdlen )
1219{
Janos Follath24eed8d2019-11-22 13:21:35 +00001220 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001221 const mbedtls_pk_info_t *pk_info;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001222#if defined(MBEDTLS_PEM_PARSE_C)
Paul Bakker1a7550a2013-09-15 13:01:22 +02001223 size_t len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001224 mbedtls_pem_context pem;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001225#endif
Paul Bakker1a7550a2013-09-15 13:01:22 +02001226
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001227 PK_VALIDATE_RET( pk != NULL );
1228 if( keylen == 0 )
1229 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT );
1230 PK_VALIDATE_RET( key != NULL );
1231
1232#if defined(MBEDTLS_PEM_PARSE_C)
1233 mbedtls_pem_init( &pem );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001234
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001235#if defined(MBEDTLS_RSA_C)
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +02001236 /* Avoid calling mbedtls_pem_read_buffer() on non-null-terminated string */
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001237 if( key[keylen - 1] != '\0' )
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +02001238 ret = MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT;
1239 else
1240 ret = mbedtls_pem_read_buffer( &pem,
1241 "-----BEGIN RSA PRIVATE KEY-----",
1242 "-----END RSA PRIVATE KEY-----",
1243 key, pwd, pwdlen, &len );
1244
Paul Bakker1a7550a2013-09-15 13:01:22 +02001245 if( ret == 0 )
1246 {
Hanno Becker66a0f832017-09-08 12:39:21 +01001247 pk_info = mbedtls_pk_info_from_type( MBEDTLS_PK_RSA );
Hanno Beckerfab35692017-08-25 13:38:26 +01001248 if( ( ret = mbedtls_pk_setup( pk, pk_info ) ) != 0 ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001249 ( ret = pk_parse_key_pkcs1_der( mbedtls_pk_rsa( *pk ),
Paul Bakker1a7550a2013-09-15 13:01:22 +02001250 pem.buf, pem.buflen ) ) != 0 )
1251 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001252 mbedtls_pk_free( pk );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001253 }
1254
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001255 mbedtls_pem_free( &pem );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001256 return( ret );
1257 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001258 else if( ret == MBEDTLS_ERR_PEM_PASSWORD_MISMATCH )
1259 return( MBEDTLS_ERR_PK_PASSWORD_MISMATCH );
1260 else if( ret == MBEDTLS_ERR_PEM_PASSWORD_REQUIRED )
1261 return( MBEDTLS_ERR_PK_PASSWORD_REQUIRED );
1262 else if( ret != MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT )
Paul Bakker1a7550a2013-09-15 13:01:22 +02001263 return( ret );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001264#endif /* MBEDTLS_RSA_C */
Paul Bakker1a7550a2013-09-15 13:01:22 +02001265
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001266#if defined(MBEDTLS_ECP_C)
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +02001267 /* Avoid calling mbedtls_pem_read_buffer() on non-null-terminated string */
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001268 if( key[keylen - 1] != '\0' )
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +02001269 ret = MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT;
1270 else
1271 ret = mbedtls_pem_read_buffer( &pem,
1272 "-----BEGIN EC PRIVATE KEY-----",
1273 "-----END EC PRIVATE KEY-----",
1274 key, pwd, pwdlen, &len );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001275 if( ret == 0 )
1276 {
Hanno Becker66a0f832017-09-08 12:39:21 +01001277 pk_info = mbedtls_pk_info_from_type( MBEDTLS_PK_ECKEY );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001278
Hanno Beckerfab35692017-08-25 13:38:26 +01001279 if( ( ret = mbedtls_pk_setup( pk, pk_info ) ) != 0 ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001280 ( ret = pk_parse_key_sec1_der( mbedtls_pk_ec( *pk ),
Paul Bakker1a7550a2013-09-15 13:01:22 +02001281 pem.buf, pem.buflen ) ) != 0 )
1282 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001283 mbedtls_pk_free( pk );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001284 }
1285
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001286 mbedtls_pem_free( &pem );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001287 return( ret );
1288 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001289 else if( ret == MBEDTLS_ERR_PEM_PASSWORD_MISMATCH )
1290 return( MBEDTLS_ERR_PK_PASSWORD_MISMATCH );
1291 else if( ret == MBEDTLS_ERR_PEM_PASSWORD_REQUIRED )
1292 return( MBEDTLS_ERR_PK_PASSWORD_REQUIRED );
1293 else if( ret != MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT )
Paul Bakker1a7550a2013-09-15 13:01:22 +02001294 return( ret );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001295#endif /* MBEDTLS_ECP_C */
Paul Bakker1a7550a2013-09-15 13:01:22 +02001296
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +02001297 /* Avoid calling mbedtls_pem_read_buffer() on non-null-terminated string */
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001298 if( key[keylen - 1] != '\0' )
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +02001299 ret = MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT;
1300 else
1301 ret = mbedtls_pem_read_buffer( &pem,
1302 "-----BEGIN PRIVATE KEY-----",
1303 "-----END PRIVATE KEY-----",
1304 key, NULL, 0, &len );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001305 if( ret == 0 )
1306 {
1307 if( ( ret = pk_parse_key_pkcs8_unencrypted_der( pk,
1308 pem.buf, pem.buflen ) ) != 0 )
1309 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001310 mbedtls_pk_free( pk );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001311 }
1312
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001313 mbedtls_pem_free( &pem );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001314 return( ret );
1315 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001316 else if( ret != MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT )
Paul Bakker1a7550a2013-09-15 13:01:22 +02001317 return( ret );
1318
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001319#if defined(MBEDTLS_PKCS12_C) || defined(MBEDTLS_PKCS5_C)
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +02001320 /* Avoid calling mbedtls_pem_read_buffer() on non-null-terminated string */
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001321 if( key[keylen - 1] != '\0' )
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +02001322 ret = MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT;
1323 else
1324 ret = mbedtls_pem_read_buffer( &pem,
1325 "-----BEGIN ENCRYPTED PRIVATE KEY-----",
1326 "-----END ENCRYPTED PRIVATE KEY-----",
1327 key, NULL, 0, &len );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001328 if( ret == 0 )
1329 {
1330 if( ( ret = pk_parse_key_pkcs8_encrypted_der( pk,
1331 pem.buf, pem.buflen,
1332 pwd, pwdlen ) ) != 0 )
1333 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001334 mbedtls_pk_free( pk );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001335 }
1336
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001337 mbedtls_pem_free( &pem );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001338 return( ret );
1339 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001340 else if( ret != MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT )
Paul Bakker1a7550a2013-09-15 13:01:22 +02001341 return( ret );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001342#endif /* MBEDTLS_PKCS12_C || MBEDTLS_PKCS5_C */
Paul Bakker1a7550a2013-09-15 13:01:22 +02001343#else
1344 ((void) pwd);
1345 ((void) pwdlen);
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001346#endif /* MBEDTLS_PEM_PARSE_C */
Paul Bakker1a7550a2013-09-15 13:01:22 +02001347
1348 /*
Brian J Murray2adecba2016-11-06 04:45:15 -08001349 * At this point we only know it's not a PEM formatted key. Could be any
1350 * of the known DER encoded private key formats
1351 *
1352 * We try the different DER format parsers to see if one passes without
1353 * error
1354 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001355#if defined(MBEDTLS_PKCS12_C) || defined(MBEDTLS_PKCS5_C)
Paul Bakker1a7550a2013-09-15 13:01:22 +02001356 {
Hanno Beckerfab35692017-08-25 13:38:26 +01001357 unsigned char *key_copy;
1358
1359 if( ( key_copy = mbedtls_calloc( 1, keylen ) ) == NULL )
1360 return( MBEDTLS_ERR_PK_ALLOC_FAILED );
1361
1362 memcpy( key_copy, key, keylen );
1363
1364 ret = pk_parse_key_pkcs8_encrypted_der( pk, key_copy, keylen,
1365 pwd, pwdlen );
1366
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05001367 mbedtls_platform_zeroize( key_copy, keylen );
Hanno Beckerfab35692017-08-25 13:38:26 +01001368 mbedtls_free( key_copy );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001369 }
1370
Hanno Beckerfab35692017-08-25 13:38:26 +01001371 if( ret == 0 )
1372 return( 0 );
1373
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001374 mbedtls_pk_free( pk );
Hanno Becker780f0a42018-10-10 11:23:33 +01001375 mbedtls_pk_init( pk );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001376
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001377 if( ret == MBEDTLS_ERR_PK_PASSWORD_MISMATCH )
Paul Bakker1a7550a2013-09-15 13:01:22 +02001378 {
1379 return( ret );
1380 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001381#endif /* MBEDTLS_PKCS12_C || MBEDTLS_PKCS5_C */
Paul Bakker1a7550a2013-09-15 13:01:22 +02001382
1383 if( ( ret = pk_parse_key_pkcs8_unencrypted_der( pk, key, keylen ) ) == 0 )
1384 return( 0 );
1385
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001386 mbedtls_pk_free( pk );
Hanno Becker780f0a42018-10-10 11:23:33 +01001387 mbedtls_pk_init( pk );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001388
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001389#if defined(MBEDTLS_RSA_C)
Paul Bakker1a7550a2013-09-15 13:01:22 +02001390
Hanno Becker9be19262017-09-08 12:39:44 +01001391 pk_info = mbedtls_pk_info_from_type( MBEDTLS_PK_RSA );
Hanno Becker780f0a42018-10-10 11:23:33 +01001392 if( mbedtls_pk_setup( pk, pk_info ) == 0 &&
1393 pk_parse_key_pkcs1_der( mbedtls_pk_rsa( *pk ), key, keylen ) == 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +02001394 {
1395 return( 0 );
1396 }
1397
Hanno Becker780f0a42018-10-10 11:23:33 +01001398 mbedtls_pk_free( pk );
1399 mbedtls_pk_init( pk );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001400#endif /* MBEDTLS_RSA_C */
Paul Bakker1a7550a2013-09-15 13:01:22 +02001401
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001402#if defined(MBEDTLS_ECP_C)
Hanno Becker9be19262017-09-08 12:39:44 +01001403 pk_info = mbedtls_pk_info_from_type( MBEDTLS_PK_ECKEY );
Hanno Becker780f0a42018-10-10 11:23:33 +01001404 if( mbedtls_pk_setup( pk, pk_info ) == 0 &&
1405 pk_parse_key_sec1_der( mbedtls_pk_ec( *pk ),
1406 key, keylen ) == 0 )
Paul Bakker1a7550a2013-09-15 13:01:22 +02001407 {
1408 return( 0 );
1409 }
Hanno Becker780f0a42018-10-10 11:23:33 +01001410 mbedtls_pk_free( pk );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001411#endif /* MBEDTLS_ECP_C */
Paul Bakker1a7550a2013-09-15 13:01:22 +02001412
Hanno Becker780f0a42018-10-10 11:23:33 +01001413 /* If MBEDTLS_RSA_C is defined but MBEDTLS_ECP_C isn't,
1414 * it is ok to leave the PK context initialized but not
1415 * freed: It is the caller's responsibility to call pk_init()
1416 * before calling this function, and to call pk_free()
1417 * when it fails. If MBEDTLS_ECP_C is defined but MBEDTLS_RSA_C
1418 * isn't, this leads to mbedtls_pk_free() being called
1419 * twice, once here and once by the caller, but this is
1420 * also ok and in line with the mbedtls_pk_free() calls
1421 * on failed PEM parsing attempts. */
1422
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001423 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001424}
1425
1426/*
1427 * Parse a public key
1428 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001429int mbedtls_pk_parse_public_key( mbedtls_pk_context *ctx,
Paul Bakker1a7550a2013-09-15 13:01:22 +02001430 const unsigned char *key, size_t keylen )
1431{
Janos Follath24eed8d2019-11-22 13:21:35 +00001432 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001433 unsigned char *p;
Ron Eldor5472d432017-10-17 09:49:00 +03001434#if defined(MBEDTLS_RSA_C)
1435 const mbedtls_pk_info_t *pk_info;
1436#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001437#if defined(MBEDTLS_PEM_PARSE_C)
Paul Bakker1a7550a2013-09-15 13:01:22 +02001438 size_t len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001439 mbedtls_pem_context pem;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001440#endif
Paul Bakker1a7550a2013-09-15 13:01:22 +02001441
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001442 PK_VALIDATE_RET( ctx != NULL );
1443 if( keylen == 0 )
1444 return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT );
1445 PK_VALIDATE_RET( key != NULL || keylen == 0 );
1446
1447#if defined(MBEDTLS_PEM_PARSE_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001448 mbedtls_pem_init( &pem );
Ron Eldord0c56de2017-10-10 17:03:08 +03001449#if defined(MBEDTLS_RSA_C)
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +02001450 /* Avoid calling mbedtls_pem_read_buffer() on non-null-terminated string */
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001451 if( key[keylen - 1] != '\0' )
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +02001452 ret = MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT;
1453 else
1454 ret = mbedtls_pem_read_buffer( &pem,
Ron Eldord0c56de2017-10-10 17:03:08 +03001455 "-----BEGIN RSA PUBLIC KEY-----",
1456 "-----END RSA PUBLIC KEY-----",
1457 key, NULL, 0, &len );
1458
1459 if( ret == 0 )
1460 {
Ron Eldor84df1ae2017-10-16 17:11:52 +03001461 p = pem.buf;
1462 if( ( pk_info = mbedtls_pk_info_from_type( MBEDTLS_PK_RSA ) ) == NULL )
1463 return( MBEDTLS_ERR_PK_UNKNOWN_PK_ALG );
Ron Eldord0c56de2017-10-10 17:03:08 +03001464
Ron Eldor84df1ae2017-10-16 17:11:52 +03001465 if( ( ret = mbedtls_pk_setup( ctx, pk_info ) ) != 0 )
1466 return( ret );
Ron Eldord0c56de2017-10-10 17:03:08 +03001467
Ron Eldor84df1ae2017-10-16 17:11:52 +03001468 if ( ( ret = pk_get_rsapubkey( &p, p + pem.buflen, mbedtls_pk_rsa( *ctx ) ) ) != 0 )
1469 mbedtls_pk_free( ctx );
Ron Eldor3f2da842017-10-17 15:50:30 +03001470
Ron Eldord0c56de2017-10-10 17:03:08 +03001471 mbedtls_pem_free( &pem );
1472 return( ret );
1473 }
1474 else if( ret != MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT )
1475 {
1476 mbedtls_pem_free( &pem );
1477 return( ret );
1478 }
1479#endif /* MBEDTLS_RSA_C */
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +02001480
1481 /* Avoid calling mbedtls_pem_read_buffer() on non-null-terminated string */
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001482 if( key[keylen - 1] != '\0' )
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +02001483 ret = MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT;
1484 else
1485 ret = mbedtls_pem_read_buffer( &pem,
1486 "-----BEGIN PUBLIC KEY-----",
1487 "-----END PUBLIC KEY-----",
1488 key, NULL, 0, &len );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001489
1490 if( ret == 0 )
1491 {
1492 /*
1493 * Was PEM encoded
1494 */
Ron Eldor40b14a82017-10-16 19:30:00 +03001495 p = pem.buf;
1496
1497 ret = mbedtls_pk_parse_subpubkey( &p, p + pem.buflen, ctx );
1498 mbedtls_pem_free( &pem );
1499 return( ret );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001500 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001501 else if( ret != MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT )
Paul Bakker1a7550a2013-09-15 13:01:22 +02001502 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001503 mbedtls_pem_free( &pem );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001504 return( ret );
1505 }
Ron Eldor5472d432017-10-17 09:49:00 +03001506 mbedtls_pem_free( &pem );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001507#endif /* MBEDTLS_PEM_PARSE_C */
Ron Eldor40b14a82017-10-16 19:30:00 +03001508
1509#if defined(MBEDTLS_RSA_C)
1510 if( ( pk_info = mbedtls_pk_info_from_type( MBEDTLS_PK_RSA ) ) == NULL )
1511 return( MBEDTLS_ERR_PK_UNKNOWN_PK_ALG );
1512
1513 if( ( ret = mbedtls_pk_setup( ctx, pk_info ) ) != 0 )
1514 return( ret );
1515
Ron Eldor9566ff72018-02-07 18:59:41 +02001516 p = (unsigned char *)key;
Ron Eldor40b14a82017-10-16 19:30:00 +03001517 ret = pk_get_rsapubkey( &p, p + keylen, mbedtls_pk_rsa( *ctx ) );
Ron Eldor9566ff72018-02-07 18:59:41 +02001518 if( ret == 0 )
Ron Eldor40b14a82017-10-16 19:30:00 +03001519 {
Ron Eldor40b14a82017-10-16 19:30:00 +03001520 return( ret );
1521 }
1522 mbedtls_pk_free( ctx );
Chris Jones9f7a6932021-04-14 12:12:09 +01001523 if( ret != ( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_INVALID_PUBKEY,
1524 MBEDTLS_ERR_ASN1_UNEXPECTED_TAG ) ) )
Ron Eldor40b14a82017-10-16 19:30:00 +03001525 {
Ron Eldor9566ff72018-02-07 18:59:41 +02001526 return( ret );
Ron Eldor40b14a82017-10-16 19:30:00 +03001527 }
1528#endif /* MBEDTLS_RSA_C */
Paul Bakker1a7550a2013-09-15 13:01:22 +02001529 p = (unsigned char *) key;
1530
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001531 ret = mbedtls_pk_parse_subpubkey( &p, p + keylen, ctx );
Paul Bakker1a7550a2013-09-15 13:01:22 +02001532
Paul Bakker1a7550a2013-09-15 13:01:22 +02001533 return( ret );
1534}
1535
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001536#endif /* MBEDTLS_PK_PARSE_C */