diff options
author | Dr. Stephen Henson <steve@openssl.org> | 2008-03-17 18:11:27 +0000 |
---|---|---|
committer | Dr. Stephen Henson <steve@openssl.org> | 2008-03-17 18:11:27 +0000 |
commit | c36e936b60abcc426b74135b9ce4fd2950725c68 (patch) | |
tree | 10b1c18be78bed6635a1d87d9f6038b999a8a435 /crypto/cms | |
parent | 761ffa729f396dc4b8607a64ad522f6104eaa7bd (diff) |
Partial support for KEKRecipientInfo type.
Diffstat (limited to 'crypto/cms')
-rw-r--r-- | crypto/cms/cms.h | 4 | ||||
-rw-r--r-- | crypto/cms/cms_env.c | 133 | ||||
-rw-r--r-- | crypto/cms/cms_err.c | 4 |
3 files changed, 141 insertions, 0 deletions
diff --git a/crypto/cms/cms.h b/crypto/cms/cms.h index d316db5743..b6c9792305 100644 --- a/crypto/cms/cms.h +++ b/crypto/cms/cms.h @@ -273,6 +273,7 @@ void ERR_load_CMS_strings(void); /* Function codes. */ #define CMS_F_CHECK_CONTENT 151 +#define CMS_F_CMS_ADD0_RECIPIENT_KEY 157 #define CMS_F_CMS_ADD1_RECIPIENT_CERT 99 #define CMS_F_CMS_ADD1_SIGNER 100 #define CMS_F_CMS_ADD1_SIGNINGTIME 101 @@ -314,6 +315,7 @@ void ERR_load_CMS_strings(void); #define CMS_F_CMS_GET0_REVOCATION_CHOICES 120 #define CMS_F_CMS_GET0_SIGNED 121 #define CMS_F_CMS_RECIPIENTINFO_DECRYPT 150 +#define CMS_F_CMS_RECIPIENTINFO_KEKRI_GET0_ID 158 #define CMS_F_CMS_RECIPIENTINFO_KTRI_CERT_CMP 122 #define CMS_F_CMS_RECIPIENTINFO_KTRI_ENCRYPT 155 #define CMS_F_CMS_RECIPIENTINFO_KTRI_GET0_ALGS 123 @@ -353,6 +355,7 @@ void ERR_load_CMS_strings(void); #define CMS_R_MESSAGEDIGEST_ATTRIBUTE_WRONG_LENGTH 112 #define CMS_R_MESSAGEDIGEST_WRONG_LENGTH 113 #define CMS_R_NOT_ENCRYPTED_DATA 143 +#define CMS_R_NOT_KEK 152 #define CMS_R_NOT_KEY_TRANSPORT 114 #define CMS_R_NOT_SUPPORTED_FOR_THIS_KEY_TYPE 115 #define CMS_R_NO_CIPHER 144 @@ -382,6 +385,7 @@ void ERR_load_CMS_strings(void); #define CMS_R_UNKNOWN_ID 133 #define CMS_R_UNSUPPORTED_COMPRESSION_ALGORITHM 134 #define CMS_R_UNSUPPORTED_CONTENT_TYPE 135 +#define CMS_R_UNSUPPORTED_KEK_ALGORITHM 153 #define CMS_R_UNSUPPORTED_RECIPIENT_TYPE 151 #define CMS_R_UNSUPPORTED_TYPE 136 #define CMS_R_VERIFICATION_FAILURE 137 diff --git a/crypto/cms/cms_env.c b/crypto/cms/cms_env.c index c2cf669718..5ac3e125dc 100644 --- a/crypto/cms/cms_env.c +++ b/crypto/cms/cms_env.c @@ -66,6 +66,8 @@ DECLARE_ASN1_ITEM(CMS_EnvelopedData) DECLARE_ASN1_ITEM(CMS_RecipientInfo) DECLARE_ASN1_ITEM(CMS_KeyTransRecipientInfo) +DECLARE_ASN1_ITEM(CMS_KEKRecipientInfo) +DECLARE_ASN1_ITEM(CMS_OtherKeyAttribute) DECLARE_STACK_OF(CMS_RecipientInfo) @@ -227,6 +229,137 @@ CMS_RecipientInfo *CMS_add1_recipient_cert(CMS_ContentInfo *cms, } +int CMS_RecipientInfo_kekri_get0_id(CMS_RecipientInfo *ri, + X509_ALGOR **palg, + ASN1_OCTET_STRING **pid, + ASN1_GENERALIZEDTIME **pdate, + ASN1_OBJECT **potherid, + ASN1_TYPE **pothertype) + { + CMS_KEKIdentifier *rkid; + if (ri->type != CMS_RECIPINFO_KEK) + { + CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_GET0_ID, CMS_R_NOT_KEK); + return 0; + } + rkid = ri->d.kekri->kekid; + if (palg) + *palg = ri->d.kekri->keyEncryptionAlgorithm; + if (pid) + *pid = rkid->keyIdentifier; + if (pdate) + *pdate = rkid->date; + if (potherid) + { + if (rkid->other) + *potherid = rkid->other->keyAttrId; + else + *potherid = NULL; + } + if (pothertype) + { + if (rkid->other) + *pothertype = rkid->other->keyAttr; + else + *pothertype = NULL; + } + return 1; + } + + +CMS_RecipientInfo *CMS_add0_recipient_key(CMS_ContentInfo *cms, int nid, + unsigned char *key, size_t keylen, + unsigned char *id, size_t idlen, + ASN1_GENERALIZEDTIME *date, + ASN1_OBJECT *otherTypeId, + ASN1_TYPE *otherType) + { + CMS_RecipientInfo *ri = NULL; + CMS_EnvelopedData *env; + CMS_KEKRecipientInfo *kekri; + size_t exp_keylen = 0; + env = cms_get0_enveloped(cms); + if (!env) + goto err; + + /* For now hard code checks on nids */ + switch (nid) + { + case NID_id_aes128_wrap: + exp_keylen = 16; + break; + + case NID_id_aes192_wrap: + exp_keylen = 24; + break; + + case NID_id_aes256_wrap: + exp_keylen = 32; + break; + + default: + CMSerr(CMS_F_CMS_ADD0_RECIPIENT_KEY, + CMS_R_UNSUPPORTED_KEK_ALGORITHM); + goto err; + } + + if (exp_keylen && (keylen != exp_keylen)) + { + CMSerr(CMS_F_CMS_ADD0_RECIPIENT_KEY, + CMS_R_INVALID_KEY_LENGTH); + goto err; + } + + /* Initialize recipient info */ + ri = M_ASN1_new_of(CMS_RecipientInfo); + if (!ri) + goto merr; + + ri->d.kekri = M_ASN1_new_of(CMS_KEKRecipientInfo); + if (!ri->d.kekri) + goto merr; + ri->type = CMS_RECIPINFO_KEK; + + kekri = ri->d.kekri; + + if (otherTypeId) + { + kekri->kekid->other = M_ASN1_new_of(CMS_OtherKeyAttribute); + if (kekri->kekid->other == NULL) + goto merr; + } + + if (!sk_CMS_RecipientInfo_push(env->recipientInfos, ri)) + goto merr; + + /* After this point no calls can fail */ + + kekri->version = 4; + + kekri->key = key; + kekri->keylen = keylen; + + ASN1_STRING_set0(kekri->kekid->keyIdentifier, id, idlen); + + kekri->kekid->date = date; + + kekri->kekid->other->keyAttrId = otherTypeId; + kekri->kekid->other->keyAttr = otherType; + + X509_ALGOR_set0(kekri->keyEncryptionAlgorithm, + OBJ_nid2obj(nid), V_ASN1_UNDEF, NULL); + + return ri; + + merr: + CMSerr(CMS_F_CMS_ADD0_RECIPIENT_KEY, ERR_R_MALLOC_FAILURE); + err: + if (ri) + M_ASN1_free_of(ri, CMS_RecipientInfo); + return NULL; + + } + int CMS_RecipientInfo_ktri_get0_algs(CMS_RecipientInfo *ri, EVP_PKEY **pk, X509 **recip, X509_ALGOR **palg) diff --git a/crypto/cms/cms_err.c b/crypto/cms/cms_err.c index 0e13f39ff1..acc756adf1 100644 --- a/crypto/cms/cms_err.c +++ b/crypto/cms/cms_err.c @@ -71,6 +71,7 @@ static ERR_STRING_DATA CMS_str_functs[]= { {ERR_FUNC(CMS_F_CHECK_CONTENT), "CHECK_CONTENT"}, +{ERR_FUNC(CMS_F_CMS_ADD0_RECIPIENT_KEY), "CMS_ADD0_RECIPIENT_KEY"}, {ERR_FUNC(CMS_F_CMS_ADD1_RECIPIENT_CERT), "CMS_add1_recipient_cert"}, {ERR_FUNC(CMS_F_CMS_ADD1_SIGNER), "CMS_add1_signer"}, {ERR_FUNC(CMS_F_CMS_ADD1_SIGNINGTIME), "CMS_ADD1_SIGNINGTIME"}, @@ -112,6 +113,7 @@ static ERR_STRING_DATA CMS_str_functs[]= {ERR_FUNC(CMS_F_CMS_GET0_REVOCATION_CHOICES), "CMS_GET0_REVOCATION_CHOICES"}, {ERR_FUNC(CMS_F_CMS_GET0_SIGNED), "CMS_GET0_SIGNED"}, {ERR_FUNC(CMS_F_CMS_RECIPIENTINFO_DECRYPT), "CMS_RecipientInfo_decrypt"}, +{ERR_FUNC(CMS_F_CMS_RECIPIENTINFO_KEKRI_GET0_ID), "CMS_RECIPIENTINFO_KEKRI_GET0_ID"}, {ERR_FUNC(CMS_F_CMS_RECIPIENTINFO_KTRI_CERT_CMP), "CMS_RecipientInfo_ktri_cert_cmp"}, {ERR_FUNC(CMS_F_CMS_RECIPIENTINFO_KTRI_ENCRYPT), "CMS_RECIPIENTINFO_KTRI_ENCRYPT"}, {ERR_FUNC(CMS_F_CMS_RECIPIENTINFO_KTRI_GET0_ALGS), "CMS_RecipientInfo_ktri_get0_algs"}, @@ -154,6 +156,7 @@ static ERR_STRING_DATA CMS_str_reasons[]= {ERR_REASON(CMS_R_MESSAGEDIGEST_ATTRIBUTE_WRONG_LENGTH),"messagedigest attribute wrong length"}, {ERR_REASON(CMS_R_MESSAGEDIGEST_WRONG_LENGTH),"messagedigest wrong length"}, {ERR_REASON(CMS_R_NOT_ENCRYPTED_DATA) ,"not encrypted data"}, +{ERR_REASON(CMS_R_NOT_KEK) ,"not kek"}, {ERR_REASON(CMS_R_NOT_KEY_TRANSPORT) ,"not key transport"}, {ERR_REASON(CMS_R_NOT_SUPPORTED_FOR_THIS_KEY_TYPE),"not supported for this key type"}, {ERR_REASON(CMS_R_NO_CIPHER) ,"no cipher"}, @@ -183,6 +186,7 @@ static ERR_STRING_DATA CMS_str_reasons[]= {ERR_REASON(CMS_R_UNKNOWN_ID) ,"unknown id"}, {ERR_REASON(CMS_R_UNSUPPORTED_COMPRESSION_ALGORITHM),"unsupported compression algorithm"}, {ERR_REASON(CMS_R_UNSUPPORTED_CONTENT_TYPE),"unsupported content type"}, +{ERR_REASON(CMS_R_UNSUPPORTED_KEK_ALGORITHM),"unsupported kek algorithm"}, {ERR_REASON(CMS_R_UNSUPPORTED_RECIPIENT_TYPE),"unsupported recipient type"}, {ERR_REASON(CMS_R_UNSUPPORTED_TYPE) ,"unsupported type"}, {ERR_REASON(CMS_R_VERIFICATION_FAILURE) ,"verification failure"}, |