[apple/security.git] / libsecurity_apple_csp / lib / deriveKey.cpp

/*
 * Copyright (c) 2000-2001 Apple Computer, Inc. All Rights Reserved.
 * 
 * The contents of this file constitute Original Code as defined in and are
 * subject to the Apple Public Source License Version 1.2 (the 'License').
 * You may not use this file except in compliance with the License. Please obtain
 * a copy of the License at http://www.apple.com/publicsource and read it before
 * using this file.
 * 
 * This Original Code and all software distributed under the License are
 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS
 * OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, INCLUDING WITHOUT
 * LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
 * PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. Please see the License for the
 * specific language governing rights and limitations under the License.
 */


/*
 	File:		deriveKey.cpp
	
 	Contains:	CSSM_DeriveKey functions

 	Copyright:	(C) 2000 by Apple Computer, Inc., all rights reserved

 	Written by:	Doug Mitchell <dmitch@apple.com>	
*/

#include <HMACSHA1.h>
#include <pbkdf2.h>
#include <pbkdDigest.h>
#include <pkcs12Derive.h>
#include "AppleCSPSession.h"
#include "AppleCSPUtils.h"
#include "AppleCSPContext.h"
#include "cspdebugging.h"
#include <security_cdsa_utilities/context.h>
#include <DH_exchange.h>
#include "FEEAsymmetricContext.h"

/* minimum legal values */
#define PBKDF2_MIN_SALT			8		/* bytes */
#define PBKDF2_MIN_ITER_CNT		1000	/* iteration count */

#define ALLOW_ZERO_PASSWORD		1 

void AppleCSPSession::DeriveKey_PBKDF2(
	const Context &context,
	const CssmData &Param,
	CSSM_DATA *keyData)
{
	/* validate algorithm-specific arguments */

	/* Param must point to a CSSM_PKCS5_PBKDF2_PARAMS */
	if(Param.Length != sizeof(CSSM_PKCS5_PBKDF2_PARAMS)) {
		errorLog0("DeriveKey_PBKDF2: Param wrong size\n");
		CssmError::throwMe(CSSMERR_CSP_INVALID_INPUT_POINTER);
	}
	const CSSM_PKCS5_PBKDF2_PARAMS *pbkdf2Params = 
		reinterpret_cast<const CSSM_PKCS5_PBKDF2_PARAMS *>(Param.Data);
	if(pbkdf2Params == NULL) {
		errorLog0("DeriveKey_PBKDF2: null Param.Data\n");
		CssmError::throwMe(CSSMERR_CSP_INVALID_DATA);
	}
	
	/* Get passphrase from either baseKey or from CSSM_PKCS5_PBKDF2_PARAMS */
	CssmKey *passKey = context.get<CssmKey>(CSSM_ATTRIBUTE_KEY);
	CSSM_SIZE	passphraseLen = 0;
	uint8 	*passphrase = NULL;
	if(passKey != NULL) {
		AppleCSPContext::symmetricKeyBits(context, *this,
			CSSM_ALGID_SECURE_PASSPHRASE, CSSM_KEYUSE_DERIVE, 
			passphrase, passphraseLen);
	}
	else {
		passphraseLen = pbkdf2Params->Passphrase.Length;
		passphrase = pbkdf2Params->Passphrase.Data;
	}
	
	#if 	!ALLOW_ZERO_PASSWORD
	/* passphrase required */
	if(passphrase == NULL) {
		errorLog0("DeriveKey_PBKDF2: null Passphrase\n");
		CssmError::throwMe(CSSMERR_CSP_INVALID_DATA);
	}
	if(passphraseLen == 0) {		
		/* FIXME - enforce minimum length? */
		errorLog0("DeriveKey_PBKDF2: zero length passphrase\n");
		CssmError::throwMe(CSSMERR_CSP_INVALID_INPUT_POINTER);
	}
	#endif	/* ALLOW_ZERO_PASSWORD */
	
	if(pbkdf2Params->PseudoRandomFunction != 
			CSSM_PKCS5_PBKDF2_PRF_HMAC_SHA1) {
		errorLog0("DeriveKey_PBKDF2: invalid PRF\n");
		CssmError::throwMe(CSSMERR_CSP_INVALID_ALGORITHM);
	}
	
	/* salt, from context, required */
	CssmData salt = context.get<CssmData>(CSSM_ATTRIBUTE_SALT,
		CSSMERR_CSP_MISSING_ATTR_SALT);
	if((salt.Data == NULL) || (salt.Length < PBKDF2_MIN_SALT)){
		CssmError::throwMe(CSSMERR_CSP_INVALID_ATTR_SALT);
	}
	
	/* iteration count, from context, required */
	uint32 iterCount = context.getInt(CSSM_ATTRIBUTE_ITERATION_COUNT,
		CSSMERR_CSP_MISSING_ATTR_ITERATION_COUNT);
	if(iterCount < PBKDF2_MIN_ITER_CNT) {
		CssmError::throwMe(CSSMERR_CSP_INVALID_ATTR_ITERATION_COUNT);
	}
	
	/* 
	 * allocate a temp buffer, length 
	 *    = MAX (hLen, saltLen + 4) + 2 * hLen
	 *    = MAX (kSHA1DigestSize, saltLen + 4) + 2 * kSHA1DigestSize
	 */
	size_t tempLen = salt.Length + 4;
	if(tempLen < kSHA1DigestSize) {
		tempLen = kSHA1DigestSize;
	}
	tempLen += (2 * kSHA1DigestSize);
	CSSM_DATA tempData = {0, NULL};
	setUpData(tempData, tempLen, privAllocator);
	
	/* go */
	pbkdf2 (hmacsha1, 
		kSHA1DigestSize,
		passphrase, (uint32)passphraseLen,
		salt.Data, (uint32)salt.Length,
		iterCount,
		keyData->Data, (uint32)keyData->Length,
		tempData.Data);
	freeData(&tempData, privAllocator, false);
}

/*
 * PKCS5 v1.5 key derivation. Also used for traditional openssl key 
 * derivation, which is mighty similar to PKCS5 v1.5, with the addition
 * of the ability to generate more than (keysize + ivsize) bytes. 
 */
void AppleCSPSession::DeriveKey_PKCS5_V1_5(
	const Context &context,
	CSSM_ALGORITHMS algId,
	const CssmData &Param,			// IV optional, mallocd by app to indicate
									//   size 
	CSSM_DATA *keyData)				// mallocd by caller to indicate size
{
	CSSM_DATA pwd = {0, NULL};
	
	/* password from either Seed.Param or from base key */
	CssmCryptoData *cryptData = 
		context.get<CssmCryptoData>(CSSM_ATTRIBUTE_SEED);
	if((cryptData != NULL) && (cryptData->Param.Length != 0)) {
		pwd = cryptData->Param;
	}
	else {
		/* Get secure passphrase from base key */
		CssmKey *passKey = context.get<CssmKey>(CSSM_ATTRIBUTE_KEY);
		if (passKey != NULL) {
			AppleCSPContext::symmetricKeyBits(context, *this,
				CSSM_ALGID_SECURE_PASSPHRASE, CSSM_KEYUSE_DERIVE, 
				pwd.Data, pwd.Length);
		}
	}

	if(pwd.Data == NULL) {
		errorLog0("DeriveKey_PKCS5_V1_5: null Passphrase\n");
		CssmError::throwMe(CSSMERR_CSP_INVALID_DATA);
	}
	if(pwd.Length == 0) {		
		errorLog0("DeriveKey_PKCS5_V1_5: zero length passphrase\n");
		CssmError::throwMe(CSSMERR_CSP_INVALID_INPUT_POINTER);
	}

	CSSM_ALGORITHMS hashAlg;
	unsigned digestLen;
	bool opensslAlg = false;
	switch(algId) {
		case CSSM_ALGID_PKCS5_PBKDF1_MD5:
			hashAlg = CSSM_ALGID_MD5;
			digestLen = kMD5DigestSize;
			break;
		case CSSM_ALGID_PKCS5_PBKDF1_MD2:
			hashAlg = CSSM_ALGID_MD2;
			digestLen = kMD2DigestSize;
			break;
		case CSSM_ALGID_PKCS5_PBKDF1_SHA1:
			hashAlg = CSSM_ALGID_SHA1;
			digestLen = kSHA1DigestSize;
			break;
		case CSSM_ALGID_PBE_OPENSSL_MD5:
			hashAlg = CSSM_ALGID_MD5;
			digestLen = kMD5DigestSize;
			opensslAlg = true;
			break;			
		default:
			/* should not have been called */
			assert(0);
			CssmError::throwMe(CSSMERR_CSP_INVALID_ALGORITHM);
	}

	/* IV optional */
	CSSM_DATA iv = Param;
	
	/* total requested length can't exceed digest size for struct PKCS5 v1.5*/
	if(!opensslAlg && ((keyData->Length + iv.Length) > digestLen)) {
		errorLog0("DeriveKey_PKCS5_V1_5: requested length larger than digest\n");
		CssmError::throwMe(CSSMERR_CSP_INVALID_ATTR_KEY_LENGTH);
	}
	
	/* salt, from context, required */
	CssmData salt = context.get<CssmData>(CSSM_ATTRIBUTE_SALT,
		CSSMERR_CSP_MISSING_ATTR_SALT);
	if(salt.Data == NULL) {
		CssmError::throwMe(CSSMERR_CSP_INVALID_ATTR_SALT);
	}
	
	/* iteration count, from context, required */
	uint32 iterCount = context.getInt(CSSM_ATTRIBUTE_ITERATION_COUNT,
		CSSMERR_CSP_MISSING_ATTR_ITERATION_COUNT);
		
	/* 
	 * Apply the underlying hash function Hash for c iterations to
	 *  the concatenation of the password P and the salt S, then 
	 * extract the first dkLen octets to produce a derived key DK:
	 *
	 *		T1 = Hash (P || S) ,
	 *		T2 = Hash (T1) ,
	 *		...
	 *		Tc = Hash (Tc-1) ,
	 *		DK = Tc<0..dkLen-1> .
	 */
	DigestCtx ctx;
	uint8 *keyDataP		= keyData->Data;
	size_t keyBytesToGo = keyData->Length;
	uint8 *ivDataP		= iv.Data;
	size_t ivBytesToGo  = iv.Length;
	bool looping		= false;		// true for additional bytes for openssl
	unsigned char digestOut[kMaxDigestSize];
	
	for(;;) {
		/* this loop guaranteed to only run once if !opensslAlg */
		DigestCtxInit(&ctx, hashAlg);
		
		if(looping) {
			/* openssl addition: re-digest the digest here */
			DigestCtxUpdate(&ctx, digestOut, digestLen);
		}
		
		/* digest password then salt */
		DigestCtxUpdate(&ctx, pwd.Data, (uint32)pwd.Length);
		DigestCtxUpdate(&ctx, salt.Data, (uint32)salt.Length);

		DigestCtxFinal(&ctx, digestOut);
		
		/* now iterCount-1 more iterations */
		for(unsigned dex=1; dex<iterCount; dex++) {
			DigestCtxInit(&ctx, hashAlg);
			DigestCtxUpdate(&ctx, digestOut, digestLen);
			DigestCtxFinal(&ctx, digestOut);
		}
		
		/* first n bytes to the key */
		uint32 bytesAvail = digestLen;
		size_t toMove = (keyBytesToGo > bytesAvail) ? bytesAvail : keyBytesToGo;
		memmove(keyDataP, digestOut, toMove);
		uint8 *remainder = digestOut + toMove;
		bytesAvail   -= toMove;
		keyDataP     += toMove;
		keyBytesToGo -= toMove;
		
		/* then optionally some to IV */
		if(ivBytesToGo && bytesAvail) {
			toMove = (ivBytesToGo > bytesAvail) ? bytesAvail : ivBytesToGo;
			memmove(ivDataP, remainder, toMove);
			ivDataP     += toMove;
			ivBytesToGo -= toMove;
		}
		if((keyBytesToGo == 0) && (ivBytesToGo == 0)) {
			/* guaranteed true for PKCS5 v1.5 */
			break;
		}
		
		assert(opensslAlg == true);
		looping = true;
	}
	DigestCtxFree(&ctx);
}

/*
 * Member function initially declared for CSPAbstractPluginSession;
 * we're overriding the null version in CSPFullPluginSession.
 *
 * We'll generate any type of key (for now). 
 */
void AppleCSPSession::DeriveKey(
	CSSM_CC_HANDLE CCHandle,
	const Context &context,
	CssmData &Param,
	uint32 KeyUsage,
	uint32 KeyAttr,
	const CssmData *KeyLabel,
	const CSSM_RESOURCE_CONTROL_CONTEXT *CredAndAclEntry,
	CssmKey &DerivedKey)
{
	/* validate input args, common to all algorithms */
	switch(context.algorithm()) {
		case CSSM_ALGID_PKCS5_PBKDF2:
		case CSSM_ALGID_DH:
		case CSSM_ALGID_PKCS12_PBE_ENCR:
		case CSSM_ALGID_PKCS12_PBE_MAC:
		case CSSM_ALGID_PKCS5_PBKDF1_MD5:
		case CSSM_ALGID_PKCS5_PBKDF1_MD2:
		case CSSM_ALGID_PKCS5_PBKDF1_SHA1:
		case CSSM_ALGID_PBE_OPENSSL_MD5:
		case CSSM_ALGID_OPENSSH1:
		#if CRYPTKIT_CSP_ENABLE
		case CSSM_ALGID_ECDH:
		case CSSM_ALGID_ECDH_X963_KDF:
		#endif
			break;
		/* maybe more here, later */
		default:
			CssmError::throwMe(CSSMERR_CSP_INVALID_ALGORITHM);
	}
	DerivedKey.KeyData.Data = NULL;
	DerivedKey.KeyData.Length = 0;
	cspKeyStorage keyStorage = cspParseKeyAttr(CKT_Session, KeyAttr);
	cspValidateKeyUsageBits(CKT_Session, KeyUsage);
	
	/* outgoing key type, required (though any algorithm is OK) */
	uint32 keyType = context.getInt(CSSM_ATTRIBUTE_KEY_TYPE,
		CSSMERR_CSP_MISSING_ATTR_KEY_TYPE);

	/* outgoing key size, required - any nonzero value is OK */
	uint32 reqKeySize = context.getInt(
		CSSM_ATTRIBUTE_KEY_LENGTH, 
		CSSMERR_CSP_MISSING_ATTR_KEY_LENGTH);

	/* cook up a place to put the key data */
	uint32 keySizeInBytes = (reqKeySize + 7) / 8;
	SymmetricBinaryKey *binKey = NULL;
	CSSM_DATA_PTR keyData = NULL;
	
	switch(keyStorage) {
		case CKS_None:
			/* no way */
			CssmError::throwMe(CSSMERR_CSP_INVALID_KEYATTR_MASK);
		case CKS_Ref:
			/* cook up a symmetric binary key */
			binKey = new SymmetricBinaryKey(reqKeySize);
			keyData = &binKey->mKeyData;
			break;
		case CKS_Data:
			/* key bytes --> caller's cssmKey */
			keyData = &DerivedKey.KeyData;
			setUpData(*keyData, keySizeInBytes, 
				normAllocator);
			break;
	}

	/* break off to algorithm-specific code, whose job it is
	 * to fill in keyData->Data with keyData->Length bytes */
	switch(context.algorithm()) {
		case CSSM_ALGID_PKCS5_PBKDF2:
			DeriveKey_PBKDF2(context,
				Param,
				keyData);
			break;
		case CSSM_ALGID_DH:
			DeriveKey_DH(context,
				Param,
				keyData,
				*this);
			break;
		case CSSM_ALGID_PKCS12_PBE_ENCR:
		case CSSM_ALGID_PKCS12_PBE_MAC:
			DeriveKey_PKCS12(context,
				*this,
				Param,
				keyData);
			break;
		case CSSM_ALGID_PKCS5_PBKDF1_MD5:
		case CSSM_ALGID_PKCS5_PBKDF1_MD2:
		case CSSM_ALGID_PKCS5_PBKDF1_SHA1:
		case CSSM_ALGID_PBE_OPENSSL_MD5:
			DeriveKey_PKCS5_V1_5(context,
				context.algorithm(),
				Param,
				keyData);
			break;
		case CSSM_ALGID_OPENSSH1:
			DeriveKey_OpenSSH1(context,
				context.algorithm(),
				Param,
				keyData);
			break;
		#if CRYPTKIT_CSP_ENABLE
		case CSSM_ALGID_ECDH:
		case CSSM_ALGID_ECDH_X963_KDF:
			CryptKit::DeriveKey_ECDH(context,
				context.algorithm(),
				Param,
				keyData,
				*this);
			break;
		#endif
		/* maybe more here, later */
		default:
			assert(0);
	}
	
	/* set up outgoing header */
	KeyAttr &= ~KEY_ATTR_RETURN_MASK;
	CSSM_KEYHEADER &hdr = DerivedKey.KeyHeader;
	setKeyHeader(hdr,
		plugin.myGuid(),
		keyType,
		CSSM_KEYCLASS_SESSION_KEY, 
		KeyAttr, 
		KeyUsage);
	/* handle derived size < requested size, legal for Diffie-Hellman */
	hdr.LogicalKeySizeInBits = (uint32)(keyData->Length * 8);
	
	if(keyStorage == CKS_Ref) {
		/* store and convert to ref key */
		addRefKey(*binKey, DerivedKey);
	}
	else {
		/* Raw data */
		hdr.BlobType = CSSM_KEYBLOB_RAW;
		hdr.Format = CSSM_KEYBLOB_RAW_FORMAT_OCTET_STRING; 
	}
}
Commit	Line	Data
b1ab9ed8 A	1	/*
	2	* Copyright (c) 2000-2001 Apple Computer, Inc. All Rights Reserved.
	3	*
	4	* The contents of this file constitute Original Code as defined in and are
	5	* subject to the Apple Public Source License Version 1.2 (the 'License').
	6	* You may not use this file except in compliance with the License. Please obtain
	7	* a copy of the License at http://www.apple.com/publicsource and read it before
	8	* using this file.
	9	*
	10	* This Original Code and all software distributed under the License are
	11	* distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS
	12	* OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, INCLUDING WITHOUT
	13	* LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
	14	* PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. Please see the License for the
	15	* specific language governing rights and limitations under the License.
	16	*/
	17
	18
	19	/*
	20	File: deriveKey.cpp
	21
	22	Contains: CSSM_DeriveKey functions
	23
	24	Copyright: (C) 2000 by Apple Computer, Inc., all rights reserved
	25
	26	Written by: Doug Mitchell <dmitch@apple.com>
	27	*/
	28
	29	#include <HMACSHA1.h>
	30	#include <pbkdf2.h>
	31	#include <pbkdDigest.h>
	32	#include <pkcs12Derive.h>
	33	#include "AppleCSPSession.h"
	34	#include "AppleCSPUtils.h"
	35	#include "AppleCSPContext.h"
	36	#include "cspdebugging.h"
	37	#include <security_cdsa_utilities/context.h>
	38	#include <DH_exchange.h>
	39	#include "FEEAsymmetricContext.h"
	40
	41	/* minimum legal values */
	42	#define PBKDF2_MIN_SALT 8 /* bytes */
	43	#define PBKDF2_MIN_ITER_CNT 1000 /* iteration count */
	44
	45	#define ALLOW_ZERO_PASSWORD 1
	46
	47	void AppleCSPSession::DeriveKey_PBKDF2(
	48	const Context &context,
	49	const CssmData &Param,
	50	CSSM_DATA *keyData)
	51	{
	52	/* validate algorithm-specific arguments */
	53
	54	/* Param must point to a CSSM_PKCS5_PBKDF2_PARAMS */
	55	if(Param.Length != sizeof(CSSM_PKCS5_PBKDF2_PARAMS)) {
	56	errorLog0("DeriveKey_PBKDF2: Param wrong size\n");
	57	CssmError::throwMe(CSSMERR_CSP_INVALID_INPUT_POINTER);
	58	}
	59	const CSSM_PKCS5_PBKDF2_PARAMS *pbkdf2Params =
	60	reinterpret_cast<const CSSM_PKCS5_PBKDF2_PARAMS *>(Param.Data);
	61	if(pbkdf2Params == NULL) {
	62	errorLog0("DeriveKey_PBKDF2: null Param.Data\n");
	63	CssmError::throwMe(CSSMERR_CSP_INVALID_DATA);
	64	}
65
66	/* Get passphrase from either baseKey or from CSSM_PKCS5_PBKDF2_PARAMS */
67	CssmKey *passKey = context.get<CssmKey>(CSSM_ATTRIBUTE_KEY);
68	CSSM_SIZE passphraseLen = 0;
69	uint8 *passphrase = NULL;
70	if(passKey != NULL) {
71	AppleCSPContext::symmetricKeyBits(context, *this,
72	CSSM_ALGID_SECURE_PASSPHRASE, CSSM_KEYUSE_DERIVE,
73	passphrase, passphraseLen);
74	}
75	else {
76	passphraseLen = pbkdf2Params->Passphrase.Length;
77	passphrase = pbkdf2Params->Passphrase.Data;
78	}
79
80	#if !ALLOW_ZERO_PASSWORD
81	/* passphrase required */
82	if(passphrase == NULL) {
83	errorLog0("DeriveKey_PBKDF2: null Passphrase\n");
84	CssmError::throwMe(CSSMERR_CSP_INVALID_DATA);
85	}
86	if(passphraseLen == 0) {
87	/* FIXME - enforce minimum length? */
88	errorLog0("DeriveKey_PBKDF2: zero length passphrase\n");
89	CssmError::throwMe(CSSMERR_CSP_INVALID_INPUT_POINTER);
90	}
91	#endif /* ALLOW_ZERO_PASSWORD */
92
93	if(pbkdf2Params->PseudoRandomFunction !=
94	CSSM_PKCS5_PBKDF2_PRF_HMAC_SHA1) {
95	errorLog0("DeriveKey_PBKDF2: invalid PRF\n");
96	CssmError::throwMe(CSSMERR_CSP_INVALID_ALGORITHM);
97	}
98
99	/* salt, from context, required */
100	CssmData salt = context.get<CssmData>(CSSM_ATTRIBUTE_SALT,
101	CSSMERR_CSP_MISSING_ATTR_SALT);
102	if((salt.Data == NULL) \|\| (salt.Length < PBKDF2_MIN_SALT)){
103	CssmError::throwMe(CSSMERR_CSP_INVALID_ATTR_SALT);
104	}
105
106	/* iteration count, from context, required */
107	uint32 iterCount = context.getInt(CSSM_ATTRIBUTE_ITERATION_COUNT,
108	CSSMERR_CSP_MISSING_ATTR_ITERATION_COUNT);
109	if(iterCount < PBKDF2_MIN_ITER_CNT) {
110	CssmError::throwMe(CSSMERR_CSP_INVALID_ATTR_ITERATION_COUNT);
111	}
112
113	/*
114	* allocate a temp buffer, length
115	* = MAX (hLen, saltLen + 4) + 2 * hLen
116	* = MAX (kSHA1DigestSize, saltLen + 4) + 2 * kSHA1DigestSize
117	*/
427c49bc	118	size_t tempLen = salt.Length + 4;
b1ab9ed8 A	119	if(tempLen < kSHA1DigestSize) {
	120	tempLen = kSHA1DigestSize;
	121	}
	122	tempLen += (2 * kSHA1DigestSize);
	123	CSSM_DATA tempData = {0, NULL};
	124	setUpData(tempData, tempLen, privAllocator);
	125
	126	/* go */
	127	pbkdf2 (hmacsha1,
	128	kSHA1DigestSize,
427c49bc A	129	passphrase, (uint32)passphraseLen,
427c49bc A	130	salt.Data, (uint32)salt.Length,
b1ab9ed8	131	iterCount,
427c49bc	132	keyData->Data, (uint32)keyData->Length,
b1ab9ed8 A	133	tempData.Data);
	134	freeData(&tempData, privAllocator, false);
	135	}
	136
	137	/*
	138	* PKCS5 v1.5 key derivation. Also used for traditional openssl key
	139	* derivation, which is mighty similar to PKCS5 v1.5, with the addition
	140	* of the ability to generate more than (keysize + ivsize) bytes.
	141	*/
	142	void AppleCSPSession::DeriveKey_PKCS5_V1_5(
	143	const Context &context,
	144	CSSM_ALGORITHMS algId,
	145	const CssmData &Param, // IV optional, mallocd by app to indicate
	146	// size
	147	CSSM_DATA *keyData) // mallocd by caller to indicate size
	148	{
	149	CSSM_DATA pwd = {0, NULL};
	150
	151	/* password from either Seed.Param or from base key */
	152	CssmCryptoData *cryptData =
	153	context.get<CssmCryptoData>(CSSM_ATTRIBUTE_SEED);
	154	if((cryptData != NULL) && (cryptData->Param.Length != 0)) {
	155	pwd = cryptData->Param;
	156	}
	157	else {
	158	/* Get secure passphrase from base key */
	159	CssmKey *passKey = context.get<CssmKey>(CSSM_ATTRIBUTE_KEY);
	160	if (passKey != NULL) {
	161	AppleCSPContext::symmetricKeyBits(context, *this,
	162	CSSM_ALGID_SECURE_PASSPHRASE, CSSM_KEYUSE_DERIVE,
	163	pwd.Data, pwd.Length);
	164	}
	165	}
	166
	167	if(pwd.Data == NULL) {
	168	errorLog0("DeriveKey_PKCS5_V1_5: null Passphrase\n");
	169	CssmError::throwMe(CSSMERR_CSP_INVALID_DATA);
	170	}
	171	if(pwd.Length == 0) {
	172	errorLog0("DeriveKey_PKCS5_V1_5: zero length passphrase\n");
	173	CssmError::throwMe(CSSMERR_CSP_INVALID_INPUT_POINTER);
	174	}
	175
	176	CSSM_ALGORITHMS hashAlg;
	177	unsigned digestLen;
	178	bool opensslAlg = false;
	179	switch(algId) {
	180	case CSSM_ALGID_PKCS5_PBKDF1_MD5:
	181	hashAlg = CSSM_ALGID_MD5;
	182	digestLen = kMD5DigestSize;
	183	break;
	184	case CSSM_ALGID_PKCS5_PBKDF1_MD2:
	185	hashAlg = CSSM_ALGID_MD2;
	186	digestLen = kMD2DigestSize;
	187	break;
	188	case CSSM_ALGID_PKCS5_PBKDF1_SHA1:
	189	hashAlg = CSSM_ALGID_SHA1;
	190	digestLen = kSHA1DigestSize;
	191	break;
	192	case CSSM_ALGID_PBE_OPENSSL_MD5:
	193	hashAlg = CSSM_ALGID_MD5;
	194	digestLen = kMD5DigestSize;
	195	opensslAlg = true;
	196	break;
197	default:
198	/* should not have been called */
199	assert(0);
200	CssmError::throwMe(CSSMERR_CSP_INVALID_ALGORITHM);
201	}
202
203	/* IV optional */
204	CSSM_DATA iv = Param;
205
206	/* total requested length can't exceed digest size for struct PKCS5 v1.5*/
207	if(!opensslAlg && ((keyData->Length + iv.Length) > digestLen)) {
208	errorLog0("DeriveKey_PKCS5_V1_5: requested length larger than digest\n");
209	CssmError::throwMe(CSSMERR_CSP_INVALID_ATTR_KEY_LENGTH);
210	}
211
212	/* salt, from context, required */
213	CssmData salt = context.get<CssmData>(CSSM_ATTRIBUTE_SALT,
214	CSSMERR_CSP_MISSING_ATTR_SALT);
215	if(salt.Data == NULL) {
216	CssmError::throwMe(CSSMERR_CSP_INVALID_ATTR_SALT);
217	}
218
219	/* iteration count, from context, required */
220	uint32 iterCount = context.getInt(CSSM_ATTRIBUTE_ITERATION_COUNT,
221	CSSMERR_CSP_MISSING_ATTR_ITERATION_COUNT);
222
223	/*
224	* Apply the underlying hash function Hash for c iterations to
225	* the concatenation of the password P and the salt S, then
226	* extract the first dkLen octets to produce a derived key DK:
227	*
228	* T1 = Hash (P \|\| S) ,
229	* T2 = Hash (T1) ,
230	* ...
231	* Tc = Hash (Tc-1) ,
232	* DK = Tc<0..dkLen-1> .
233	*/
234	DigestCtx ctx;
235	uint8 *keyDataP = keyData->Data;
427c49bc	236	size_t keyBytesToGo = keyData->Length;
b1ab9ed8	237	uint8 *ivDataP = iv.Data;
427c49bc	238	size_t ivBytesToGo = iv.Length;
b1ab9ed8 A	239	bool looping = false; // true for additional bytes for openssl
	240	unsigned char digestOut[kMaxDigestSize];
	241
	242	for(;;) {
	243	/* this loop guaranteed to only run once if !opensslAlg */
	244	DigestCtxInit(&ctx, hashAlg);
	245
	246	if(looping) {
	247	/* openssl addition: re-digest the digest here */
	248	DigestCtxUpdate(&ctx, digestOut, digestLen);
	249	}
	250
	251	/* digest password then salt */
427c49bc A	252	DigestCtxUpdate(&ctx, pwd.Data, (uint32)pwd.Length);
427c49bc A	253	DigestCtxUpdate(&ctx, salt.Data, (uint32)salt.Length);
b1ab9ed8 A	254
	255	DigestCtxFinal(&ctx, digestOut);
	256
	257	/* now iterCount-1 more iterations */
	258	for(unsigned dex=1; dex<iterCount; dex++) {
	259	DigestCtxInit(&ctx, hashAlg);
	260	DigestCtxUpdate(&ctx, digestOut, digestLen);
	261	DigestCtxFinal(&ctx, digestOut);
	262	}
	263
	264	/* first n bytes to the key */
	265	uint32 bytesAvail = digestLen;
427c49bc	266	size_t toMove = (keyBytesToGo > bytesAvail) ? bytesAvail : keyBytesToGo;
b1ab9ed8 A	267	memmove(keyDataP, digestOut, toMove);
	268	uint8 *remainder = digestOut + toMove;
	269	bytesAvail -= toMove;
	270	keyDataP += toMove;
	271	keyBytesToGo -= toMove;
	272
	273	/* then optionally some to IV */
	274	if(ivBytesToGo && bytesAvail) {
	275	toMove = (ivBytesToGo > bytesAvail) ? bytesAvail : ivBytesToGo;
	276	memmove(ivDataP, remainder, toMove);
	277	ivDataP += toMove;
	278	ivBytesToGo -= toMove;
	279	}
	280	if((keyBytesToGo == 0) && (ivBytesToGo == 0)) {
	281	/* guaranteed true for PKCS5 v1.5 */
	282	break;
	283	}
	284
	285	assert(opensslAlg == true);
	286	looping = true;
	287	}
	288	DigestCtxFree(&ctx);
	289	}
	290
	291	/*
	292	* Member function initially declared for CSPAbstractPluginSession;
	293	* we're overriding the null version in CSPFullPluginSession.
	294	*
	295	* We'll generate any type of key (for now).
	296	*/
	297	void AppleCSPSession::DeriveKey(
	298	CSSM_CC_HANDLE CCHandle,
	299	const Context &context,
	300	CssmData &Param,
	301	uint32 KeyUsage,
	302	uint32 KeyAttr,
	303	const CssmData *KeyLabel,
	304	const CSSM_RESOURCE_CONTROL_CONTEXT *CredAndAclEntry,
	305	CssmKey &DerivedKey)
	306	{
	307	/* validate input args, common to all algorithms */
	308	switch(context.algorithm()) {
	309	case CSSM_ALGID_PKCS5_PBKDF2:
	310	case CSSM_ALGID_DH:
	311	case CSSM_ALGID_PKCS12_PBE_ENCR:
	312	case CSSM_ALGID_PKCS12_PBE_MAC:
	313	case CSSM_ALGID_PKCS5_PBKDF1_MD5:
	314	case CSSM_ALGID_PKCS5_PBKDF1_MD2:
	315	case CSSM_ALGID_PKCS5_PBKDF1_SHA1:
	316	case CSSM_ALGID_PBE_OPENSSL_MD5:
	317	case CSSM_ALGID_OPENSSH1:
	318	#if CRYPTKIT_CSP_ENABLE
	319	case CSSM_ALGID_ECDH:
	320	case CSSM_ALGID_ECDH_X963_KDF:
	321	#endif
	322	break;
	323	/* maybe more here, later */
	324	default:
	325	CssmError::throwMe(CSSMERR_CSP_INVALID_ALGORITHM);
	326	}
	327	DerivedKey.KeyData.Data = NULL;
	328	DerivedKey.KeyData.Length = 0;
	329	cspKeyStorage keyStorage = cspParseKeyAttr(CKT_Session, KeyAttr);
	330	cspValidateKeyUsageBits(CKT_Session, KeyUsage);
331
332	/* outgoing key type, required (though any algorithm is OK) */
333	uint32 keyType = context.getInt(CSSM_ATTRIBUTE_KEY_TYPE,
334	CSSMERR_CSP_MISSING_ATTR_KEY_TYPE);
335
336	/* outgoing key size, required - any nonzero value is OK */
337	uint32 reqKeySize = context.getInt(
338	CSSM_ATTRIBUTE_KEY_LENGTH,
339	CSSMERR_CSP_MISSING_ATTR_KEY_LENGTH);
340
341	/* cook up a place to put the key data */
342	uint32 keySizeInBytes = (reqKeySize + 7) / 8;
343	SymmetricBinaryKey *binKey = NULL;
344	CSSM_DATA_PTR keyData = NULL;
345
346	switch(keyStorage) {
347	case CKS_None:
348	/* no way */
349	CssmError::throwMe(CSSMERR_CSP_INVALID_KEYATTR_MASK);
350	case CKS_Ref:
351	/* cook up a symmetric binary key */
352	binKey = new SymmetricBinaryKey(reqKeySize);
353	keyData = &binKey->mKeyData;
354	break;
355	case CKS_Data:
356	/* key bytes --> caller's cssmKey */
357	keyData = &DerivedKey.KeyData;
358	setUpData(*keyData, keySizeInBytes,
359	normAllocator);
360	break;
361	}
362
363	/* break off to algorithm-specific code, whose job it is
364	* to fill in keyData->Data with keyData->Length bytes */
365	switch(context.algorithm()) {
366	case CSSM_ALGID_PKCS5_PBKDF2:
367	DeriveKey_PBKDF2(context,
368	Param,
369	keyData);
370	break;
371	case CSSM_ALGID_DH:
372	DeriveKey_DH(context,
373	Param,
374	keyData,
375	*this);
376	break;
377	case CSSM_ALGID_PKCS12_PBE_ENCR:
378	case CSSM_ALGID_PKCS12_PBE_MAC:
379	DeriveKey_PKCS12(context,
380	*this,
381	Param,
382	keyData);
383	break;
384	case CSSM_ALGID_PKCS5_PBKDF1_MD5:
385	case CSSM_ALGID_PKCS5_PBKDF1_MD2:
386	case CSSM_ALGID_PKCS5_PBKDF1_SHA1:
387	case CSSM_ALGID_PBE_OPENSSL_MD5:
388	DeriveKey_PKCS5_V1_5(context,
389	context.algorithm(),
390	Param,
391	keyData);
392	break;
393	case CSSM_ALGID_OPENSSH1:
394	DeriveKey_OpenSSH1(context,
395	context.algorithm(),
396	Param,
397	keyData);
398	break;
399	#if CRYPTKIT_CSP_ENABLE
400	case CSSM_ALGID_ECDH:
401	case CSSM_ALGID_ECDH_X963_KDF:
402	CryptKit::DeriveKey_ECDH(context,
403	context.algorithm(),
404	Param,
405	keyData,
406	*this);
407	break;
408	#endif
409	/* maybe more here, later */
410	default:
411	assert(0);
412	}
413
414	/* set up outgoing header */
415	KeyAttr &= ~KEY_ATTR_RETURN_MASK;
416	CSSM_KEYHEADER &hdr = DerivedKey.KeyHeader;
417	setKeyHeader(hdr,
418	plugin.myGuid(),
419	keyType,
420	CSSM_KEYCLASS_SESSION_KEY,
421	KeyAttr,
422	KeyUsage);
423	/* handle derived size < requested size, legal for Diffie-Hellman */
427c49bc	424	hdr.LogicalKeySizeInBits = (uint32)(keyData->Length * 8);
b1ab9ed8 A	425
	426	if(keyStorage == CKS_Ref) {
	427	/* store and convert to ref key */
	428	addRefKey(*binKey, DerivedKey);
	429	}
	430	else {
	431	/* Raw data */
	432	hdr.BlobType = CSSM_KEYBLOB_RAW;
	433	hdr.Format = CSSM_KEYBLOB_RAW_FORMAT_OCTET_STRING;
	434	}
	435	}
	436