1 | /* |
2 | * PKCS#12 Personal Information Exchange Syntax |
3 | * |
4 | * Copyright The Mbed TLS Contributors |
5 | * SPDX-License-Identifier: Apache-2.0 |
6 | * |
7 | * Licensed under the Apache License, Version 2.0 (the "License"); you may |
8 | * not use this file except in compliance with the License. |
9 | * You may obtain a copy of the License at |
10 | * |
11 | * http://www.apache.org/licenses/LICENSE-2.0 |
12 | * |
13 | * Unless required by applicable law or agreed to in writing, software |
14 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT |
15 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
16 | * See the License for the specific language governing permissions and |
17 | * limitations under the License. |
18 | */ |
19 | /* |
20 | * The PKCS #12 Personal Information Exchange Syntax Standard v1.1 |
21 | * |
22 | * http://www.rsa.com/rsalabs/pkcs/files/h11301-wp-pkcs-12v1-1-personal-information-exchange-syntax.pdf |
23 | * ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-12/pkcs-12v1-1.asn |
24 | */ |
25 | |
26 | #include "common.h" |
27 | |
28 | #if defined(MBEDTLS_PKCS12_C) |
29 | |
30 | #include "mbedtls/pkcs12.h" |
31 | #include "mbedtls/asn1.h" |
32 | #include "mbedtls/cipher.h" |
33 | #include "mbedtls/platform_util.h" |
34 | #include "mbedtls/error.h" |
35 | |
36 | #include <string.h> |
37 | |
38 | #if defined(MBEDTLS_ARC4_C) |
39 | #include "mbedtls/arc4.h" |
40 | #endif |
41 | |
42 | #if defined(MBEDTLS_DES_C) |
43 | #include "mbedtls/des.h" |
44 | #endif |
45 | |
46 | #if defined(MBEDTLS_ASN1_PARSE_C) |
47 | |
48 | static int pkcs12_parse_pbe_params(mbedtls_asn1_buf *params, |
49 | mbedtls_asn1_buf *salt, int *iterations) |
50 | { |
51 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
52 | unsigned char **p = ¶ms->p; |
53 | const unsigned char *end = params->p + params->len; |
54 | |
55 | /* |
56 | * pkcs-12PbeParams ::= SEQUENCE { |
57 | * salt OCTET STRING, |
58 | * iterations INTEGER |
59 | * } |
60 | * |
61 | */ |
62 | if (params->tag != (MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) { |
63 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PKCS12_PBE_INVALID_FORMAT, |
64 | MBEDTLS_ERR_ASN1_UNEXPECTED_TAG); |
65 | } |
66 | |
67 | if ((ret = mbedtls_asn1_get_tag(p, end, &salt->len, MBEDTLS_ASN1_OCTET_STRING)) != 0) { |
68 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PKCS12_PBE_INVALID_FORMAT, ret); |
69 | } |
70 | |
71 | salt->p = *p; |
72 | *p += salt->len; |
73 | |
74 | if ((ret = mbedtls_asn1_get_int(p, end, iterations)) != 0) { |
75 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PKCS12_PBE_INVALID_FORMAT, ret); |
76 | } |
77 | |
78 | if (*p != end) { |
79 | return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PKCS12_PBE_INVALID_FORMAT, |
80 | MBEDTLS_ERR_ASN1_LENGTH_MISMATCH); |
81 | } |
82 | |
83 | return 0; |
84 | } |
85 | |
86 | #define PKCS12_MAX_PWDLEN 128 |
87 | |
88 | static int pkcs12_pbe_derive_key_iv(mbedtls_asn1_buf *pbe_params, mbedtls_md_type_t md_type, |
89 | const unsigned char *pwd, size_t pwdlen, |
90 | unsigned char *key, size_t keylen, |
91 | unsigned char *iv, size_t ivlen) |
92 | { |
93 | int ret, iterations = 0; |
94 | mbedtls_asn1_buf salt; |
95 | size_t i; |
96 | unsigned char unipwd[PKCS12_MAX_PWDLEN * 2 + 2]; |
97 | |
98 | if (pwdlen > PKCS12_MAX_PWDLEN) { |
99 | return MBEDTLS_ERR_PKCS12_BAD_INPUT_DATA; |
100 | } |
101 | |
102 | memset(&salt, 0, sizeof(mbedtls_asn1_buf)); |
103 | memset(&unipwd, 0, sizeof(unipwd)); |
104 | |
105 | if ((ret = pkcs12_parse_pbe_params(pbe_params, &salt, |
106 | &iterations)) != 0) { |
107 | return ret; |
108 | } |
109 | |
110 | for (i = 0; i < pwdlen; i++) { |
111 | unipwd[i * 2 + 1] = pwd[i]; |
112 | } |
113 | |
114 | if ((ret = mbedtls_pkcs12_derivation(key, keylen, unipwd, pwdlen * 2 + 2, |
115 | salt.p, salt.len, md_type, |
116 | MBEDTLS_PKCS12_DERIVE_KEY, iterations)) != 0) { |
117 | return ret; |
118 | } |
119 | |
120 | if (iv == NULL || ivlen == 0) { |
121 | return 0; |
122 | } |
123 | |
124 | if ((ret = mbedtls_pkcs12_derivation(iv, ivlen, unipwd, pwdlen * 2 + 2, |
125 | salt.p, salt.len, md_type, |
126 | MBEDTLS_PKCS12_DERIVE_IV, iterations)) != 0) { |
127 | return ret; |
128 | } |
129 | return 0; |
130 | } |
131 | |
132 | #undef PKCS12_MAX_PWDLEN |
133 | |
134 | int mbedtls_pkcs12_pbe_sha1_rc4_128(mbedtls_asn1_buf *pbe_params, int mode, |
135 | const unsigned char *pwd, size_t pwdlen, |
136 | const unsigned char *data, size_t len, |
137 | unsigned char *output) |
138 | { |
139 | #if !defined(MBEDTLS_ARC4_C) |
140 | ((void) pbe_params); |
141 | ((void) mode); |
142 | ((void) pwd); |
143 | ((void) pwdlen); |
144 | ((void) data); |
145 | ((void) len); |
146 | ((void) output); |
147 | return MBEDTLS_ERR_PKCS12_FEATURE_UNAVAILABLE; |
148 | #else |
149 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
150 | unsigned char key[16]; |
151 | mbedtls_arc4_context ctx; |
152 | ((void) mode); |
153 | |
154 | mbedtls_arc4_init(&ctx); |
155 | |
156 | if ((ret = pkcs12_pbe_derive_key_iv(pbe_params, MBEDTLS_MD_SHA1, |
157 | pwd, pwdlen, |
158 | key, 16, NULL, 0)) != 0) { |
159 | return ret; |
160 | } |
161 | |
162 | mbedtls_arc4_setup(&ctx, key, 16); |
163 | if ((ret = mbedtls_arc4_crypt(&ctx, len, data, output)) != 0) { |
164 | goto exit; |
165 | } |
166 | |
167 | exit: |
168 | mbedtls_platform_zeroize(key, sizeof(key)); |
169 | mbedtls_arc4_free(&ctx); |
170 | |
171 | return ret; |
172 | #endif /* MBEDTLS_ARC4_C */ |
173 | } |
174 | |
175 | int mbedtls_pkcs12_pbe(mbedtls_asn1_buf *pbe_params, int mode, |
176 | mbedtls_cipher_type_t cipher_type, mbedtls_md_type_t md_type, |
177 | const unsigned char *pwd, size_t pwdlen, |
178 | const unsigned char *data, size_t len, |
179 | unsigned char *output) |
180 | { |
181 | int ret, keylen = 0; |
182 | unsigned char key[32]; |
183 | unsigned char iv[16]; |
184 | const mbedtls_cipher_info_t *cipher_info; |
185 | mbedtls_cipher_context_t cipher_ctx; |
186 | size_t olen = 0; |
187 | |
188 | if (pwd == NULL && pwdlen != 0) { |
189 | return MBEDTLS_ERR_PKCS12_BAD_INPUT_DATA; |
190 | } |
191 | |
192 | cipher_info = mbedtls_cipher_info_from_type(cipher_type); |
193 | if (cipher_info == NULL) { |
194 | return MBEDTLS_ERR_PKCS12_FEATURE_UNAVAILABLE; |
195 | } |
196 | |
197 | keylen = cipher_info->key_bitlen / 8; |
198 | |
199 | if ((ret = pkcs12_pbe_derive_key_iv(pbe_params, md_type, pwd, pwdlen, |
200 | key, keylen, |
201 | iv, cipher_info->iv_size)) != 0) { |
202 | return ret; |
203 | } |
204 | |
205 | mbedtls_cipher_init(&cipher_ctx); |
206 | |
207 | if ((ret = mbedtls_cipher_setup(&cipher_ctx, cipher_info)) != 0) { |
208 | goto exit; |
209 | } |
210 | |
211 | if ((ret = |
212 | mbedtls_cipher_setkey(&cipher_ctx, key, 8 * keylen, |
213 | (mbedtls_operation_t) mode)) != 0) { |
214 | goto exit; |
215 | } |
216 | |
217 | if ((ret = mbedtls_cipher_set_iv(&cipher_ctx, iv, cipher_info->iv_size)) != 0) { |
218 | goto exit; |
219 | } |
220 | |
221 | if ((ret = mbedtls_cipher_reset(&cipher_ctx)) != 0) { |
222 | goto exit; |
223 | } |
224 | |
225 | if ((ret = mbedtls_cipher_update(&cipher_ctx, data, len, |
226 | output, &olen)) != 0) { |
227 | goto exit; |
228 | } |
229 | |
230 | if ((ret = mbedtls_cipher_finish(&cipher_ctx, output + olen, &olen)) != 0) { |
231 | ret = MBEDTLS_ERR_PKCS12_PASSWORD_MISMATCH; |
232 | } |
233 | |
234 | exit: |
235 | mbedtls_platform_zeroize(key, sizeof(key)); |
236 | mbedtls_platform_zeroize(iv, sizeof(iv)); |
237 | mbedtls_cipher_free(&cipher_ctx); |
238 | |
239 | return ret; |
240 | } |
241 | |
242 | #endif /* MBEDTLS_ASN1_PARSE_C */ |
243 | |
244 | static void pkcs12_fill_buffer(unsigned char *data, size_t data_len, |
245 | const unsigned char *filler, size_t fill_len) |
246 | { |
247 | unsigned char *p = data; |
248 | size_t use_len; |
249 | |
250 | if (filler != NULL && fill_len != 0) { |
251 | while (data_len > 0) { |
252 | use_len = (data_len > fill_len) ? fill_len : data_len; |
253 | memcpy(p, filler, use_len); |
254 | p += use_len; |
255 | data_len -= use_len; |
256 | } |
257 | } else { |
258 | /* If either of the above are not true then clearly there is nothing |
259 | * that this function can do. The function should *not* be called |
260 | * under either of those circumstances, as you could end up with an |
261 | * incorrect output but for safety's sake, leaving the check in as |
262 | * otherwise we could end up with memory corruption.*/ |
263 | } |
264 | } |
265 | |
266 | int mbedtls_pkcs12_derivation(unsigned char *data, size_t datalen, |
267 | const unsigned char *pwd, size_t pwdlen, |
268 | const unsigned char *salt, size_t saltlen, |
269 | mbedtls_md_type_t md_type, int id, int iterations) |
270 | { |
271 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
272 | unsigned int j; |
273 | |
274 | unsigned char diversifier[128]; |
275 | unsigned char salt_block[128], pwd_block[128], hash_block[128]; |
276 | unsigned char hash_output[MBEDTLS_MD_MAX_SIZE]; |
277 | unsigned char *p; |
278 | unsigned char c; |
279 | int use_password = 0; |
280 | int use_salt = 0; |
281 | |
282 | size_t hlen, use_len, v, i; |
283 | |
284 | const mbedtls_md_info_t *md_info; |
285 | mbedtls_md_context_t md_ctx; |
286 | |
287 | // This version only allows max of 64 bytes of password or salt |
288 | if (datalen > 128 || pwdlen > 64 || saltlen > 64) { |
289 | return MBEDTLS_ERR_PKCS12_BAD_INPUT_DATA; |
290 | } |
291 | |
292 | if (pwd == NULL && pwdlen != 0) { |
293 | return MBEDTLS_ERR_PKCS12_BAD_INPUT_DATA; |
294 | } |
295 | |
296 | if (salt == NULL && saltlen != 0) { |
297 | return MBEDTLS_ERR_PKCS12_BAD_INPUT_DATA; |
298 | } |
299 | |
300 | use_password = (pwd && pwdlen != 0); |
301 | use_salt = (salt && saltlen != 0); |
302 | |
303 | md_info = mbedtls_md_info_from_type(md_type); |
304 | if (md_info == NULL) { |
305 | return MBEDTLS_ERR_PKCS12_FEATURE_UNAVAILABLE; |
306 | } |
307 | |
308 | mbedtls_md_init(&md_ctx); |
309 | |
310 | if ((ret = mbedtls_md_setup(&md_ctx, md_info, 0)) != 0) { |
311 | return ret; |
312 | } |
313 | hlen = mbedtls_md_get_size(md_info); |
314 | |
315 | if (hlen <= 32) { |
316 | v = 64; |
317 | } else { |
318 | v = 128; |
319 | } |
320 | |
321 | memset(diversifier, (unsigned char) id, v); |
322 | |
323 | if (use_salt != 0) { |
324 | pkcs12_fill_buffer(salt_block, v, salt, saltlen); |
325 | } |
326 | |
327 | if (use_password != 0) { |
328 | pkcs12_fill_buffer(pwd_block, v, pwd, pwdlen); |
329 | } |
330 | |
331 | p = data; |
332 | while (datalen > 0) { |
333 | // Calculate hash( diversifier || salt_block || pwd_block ) |
334 | if ((ret = mbedtls_md_starts(&md_ctx)) != 0) { |
335 | goto exit; |
336 | } |
337 | |
338 | if ((ret = mbedtls_md_update(&md_ctx, diversifier, v)) != 0) { |
339 | goto exit; |
340 | } |
341 | |
342 | if (use_salt != 0) { |
343 | if ((ret = mbedtls_md_update(&md_ctx, salt_block, v)) != 0) { |
344 | goto exit; |
345 | } |
346 | } |
347 | |
348 | if (use_password != 0) { |
349 | if ((ret = mbedtls_md_update(&md_ctx, pwd_block, v)) != 0) { |
350 | goto exit; |
351 | } |
352 | } |
353 | |
354 | if ((ret = mbedtls_md_finish(&md_ctx, hash_output)) != 0) { |
355 | goto exit; |
356 | } |
357 | |
358 | // Perform remaining ( iterations - 1 ) recursive hash calculations |
359 | for (i = 1; i < (size_t) iterations; i++) { |
360 | if ((ret = mbedtls_md(md_info, hash_output, hlen, hash_output)) != 0) { |
361 | goto exit; |
362 | } |
363 | } |
364 | |
365 | use_len = (datalen > hlen) ? hlen : datalen; |
366 | memcpy(p, hash_output, use_len); |
367 | datalen -= use_len; |
368 | p += use_len; |
369 | |
370 | if (datalen == 0) { |
371 | break; |
372 | } |
373 | |
374 | // Concatenating copies of hash_output into hash_block (B) |
375 | pkcs12_fill_buffer(hash_block, v, hash_output, hlen); |
376 | |
377 | // B += 1 |
378 | for (i = v; i > 0; i--) { |
379 | if (++hash_block[i - 1] != 0) { |
380 | break; |
381 | } |
382 | } |
383 | |
384 | if (use_salt != 0) { |
385 | // salt_block += B |
386 | c = 0; |
387 | for (i = v; i > 0; i--) { |
388 | j = salt_block[i - 1] + hash_block[i - 1] + c; |
389 | c = MBEDTLS_BYTE_1(j); |
390 | salt_block[i - 1] = MBEDTLS_BYTE_0(j); |
391 | } |
392 | } |
393 | |
394 | if (use_password != 0) { |
395 | // pwd_block += B |
396 | c = 0; |
397 | for (i = v; i > 0; i--) { |
398 | j = pwd_block[i - 1] + hash_block[i - 1] + c; |
399 | c = MBEDTLS_BYTE_1(j); |
400 | pwd_block[i - 1] = MBEDTLS_BYTE_0(j); |
401 | } |
402 | } |
403 | } |
404 | |
405 | ret = 0; |
406 | |
407 | exit: |
408 | mbedtls_platform_zeroize(salt_block, sizeof(salt_block)); |
409 | mbedtls_platform_zeroize(pwd_block, sizeof(pwd_block)); |
410 | mbedtls_platform_zeroize(hash_block, sizeof(hash_block)); |
411 | mbedtls_platform_zeroize(hash_output, sizeof(hash_output)); |
412 | |
413 | mbedtls_md_free(&md_ctx); |
414 | |
415 | return ret; |
416 | } |
417 | |
418 | #endif /* MBEDTLS_PKCS12_C */ |
419 | |