OSX/libsecurity_keychain/lib/SecImportExportPkcs8.cpp

   1 /*
   2  * Copyright (c) 2000-2004,2011-2014 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 /*
  25  * SecImportExportPkcs8.cpp - support for generating and parsing/decoding
  26  * private keys in PKCS8 format.
  27  *
  28  * The current version (as of March 12 2004) can parse and decode every
  29  * PKCS8 blob generated by openssl with the exception of those using
  30  * double DES encryption. This has been verified by actually generating
  31  * those blobs with openssl and decoding them here.
  32  *
  33  * PLEASE: don't even *think* about changing a single line of code here
  34  * without verifying the results against the full import/export regression
  35  * test in SecurityTests/clxutils/importExport.
  36  *
  37  */
  38
  39 #include <Security/SecImportExport.h>
  40 #include "SecImportExportPkcs8.h"
  41 #include "SecPkcs8Templates.h"
  42 #include "SecImportExportUtils.h"
  43 #include "SecImportExportCrypto.h"
  44 #include <security_pkcs12/pkcs12Utils.h>
  45 #include <security_pkcs12/pkcs12Crypto.h>
  46 #include <security_asn1/SecNssCoder.h>
  47 #include <Security/keyTemplates.h>
  48 #include <Security/SecAsn1Templates.h>
  49 #include <Security/secasn1t.h>
  50 #include <security_asn1/nssUtils.h>
  51 #include <security_utilities/debugging.h>
  52 #include <Security/oidsalg.h>
  53 #include <Security/SecKeyPriv.h>
  54 #include <security_cdsa_utils/cuCdsaUtils.h>
  55 #include <openssl/pem.h>
  56 #include <security_utilities/simulatecrash_assert.h>
  57 #include <Security/SecBase.h>
  58
  59 #define SecPkcs8Dbg(args...)    secinfo("SecPkcs8", ## args)
  60
  61 #pragma mark --- PKCS5 v1.5 Key Derivation ---
  62
  63 /*
  64  * PKCS5 v1.5. Caller has gleaned everything except salt,
  65  * iterationCount, and IV from the AlgId.algorithm OID.
  66  *
  67  * We get salt and iteration count from the incoming alg params.
  68  * IV is derived along with the unwrapping key from the passphrase.
  69  */
  70 static CSSM_RETURN pkcs5_v15_genKey(
  71         CSSM_CSP_HANDLE                 cspHand,
  72         SecNssCoder                             &coder,
  73         const SecKeyImportExportParameters *keyParams,
  74         const CSSM_DATA                 &paramData,
  75         CSSM_ALGORITHMS                 keyAlg,
  76         CSSM_ALGORITHMS                 pbeHashAlg,
  77         uint32                                  keySizeInBits,
  78         uint32                                  blockSizeInBytes,
  79         impExpKeyUnwrapParams   *unwrapParams)
  80 {
  81         CSSM_KEY                                *passKey = NULL;
  82         CFDataRef                               cfPhrase = NULL;
  83         CSSM_RETURN                             crtn;
  84         OSStatus                                ortn;
  85         CSSM_CRYPTO_DATA                seed;
  86         CSSM_CC_HANDLE                  ccHand = 0;
  87         CSSM_ACCESS_CREDENTIALS creds;
  88
  89
  90         /* passphrase or passkey? */
  91         ortn = impExpPassphraseCommon(keyParams, cspHand, SPF_Data, VP_Import,
  92                 (CFTypeRef *)&cfPhrase, &passKey);
  93         if(ortn) {
  94                 return ortn;
  95         }
  96         /* subsequent errors to errOut: */
  97
  98         memset(&seed, 0, sizeof(seed));
  99         if(cfPhrase != NULL) {
 100                 size_t len = CFDataGetLength(cfPhrase);
 101                 coder.allocItem(seed.Param, len);
 102                 memmove(seed.Param.Data, CFDataGetBytePtr(cfPhrase), len);
 103                 CFRelease(cfPhrase);
 104         }
 105
 106         /* hash algorithm --> PBE alg for CSP */
 107         CSSM_ALGORITHMS         pbeAlg;
 108         switch(pbeHashAlg) {
 109                 case CSSM_ALGID_MD2:
 110                         pbeAlg = CSSM_ALGID_PKCS5_PBKDF1_MD2;
 111                         break;
 112                 case CSSM_ALGID_MD5:
 113                         pbeAlg = CSSM_ALGID_PKCS5_PBKDF1_MD5;
 114                         break;
 115                 case CSSM_ALGID_SHA1:
 116                         pbeAlg = CSSM_ALGID_PKCS5_PBKDF1_SHA1;
 117                         break;
 118                 default:
 119                         /* really shouldn't happen - pbeHashAlg was inferred by
 120                          * pkcsOidToParams() */
 121                         SecPkcs8Dbg("PKCS8: PKCS5 v1/5 bogus hash alg");
 122                         crtn = CSSMERR_CSP_INTERNAL_ERROR;
 123                         goto errOut;
 124         }
 125
 126         /* Salt and iteration count from alg parameters */
 127         impExpPKCS5_PBE_Parameters pbeParams;
 128         memset(&pbeParams, 0, sizeof(pbeParams));
 129         if(coder.decodeItem(paramData, impExpPKCS5_PBE_ParametersTemplate, &pbeParams)) {
 130                 SecPkcs8Dbg("PKCS8: PKCS5 v1.5 pbeParams decode error");
 131                 crtn = errSecUnknownFormat;
 132                 goto errOut;
 133         }
 134         uint32 iterCount;
 135         if(!p12DataToInt(pbeParams.iterations, iterCount)) {
 136                 SecPkcs8Dbg("PKCS8: bad PKCS5 v1.5 iteration count");
 137                 crtn = errSecUnknownFormat;
 138                 goto errOut;
 139         }
 140
 141         /* ask for hard coded 8 bytes of IV */
 142         coder.allocItem(unwrapParams->iv, 8);
 143
 144         memset(&creds, 0, sizeof(CSSM_ACCESS_CREDENTIALS));
 145         crtn = CSSM_CSP_CreateDeriveKeyContext(cspHand,
 146                 pbeAlg,
 147                 keyAlg,
 148                 keySizeInBits,
 149                 &creds,
 150                 passKey,                // BaseKey
 151                 iterCount,
 152                 &pbeParams.salt,
 153                 &seed,
 154                 &ccHand);
 155         if(crtn) {
 156                 SecPkcs8Dbg("PKCS8: PKCS5 v2 CSSM_CSP_CreateDeriveKeyContext failure");
 157                 goto errOut;
 158         }
 159
 160         memset(unwrapParams->unwrappingKey, 0, sizeof(CSSM_KEY));
 161
 162         CSSM_DATA               dummyLabel;
 163         dummyLabel.Data = (uint8 *)"temp unwrap key";
 164         dummyLabel.Length = strlen((char *)dummyLabel.Data);
 165
 166         crtn = CSSM_DeriveKey(ccHand,
 167                 &unwrapParams->iv,              // IV returned in in/out Param
 168                 CSSM_KEYUSE_ANY,
 169                 /* not extractable even for the short time this key lives */
 170                 CSSM_KEYATTR_RETURN_REF | CSSM_KEYATTR_SENSITIVE,
 171                 &dummyLabel,
 172                 NULL,                   // cred and acl
 173                 unwrapParams->unwrappingKey);
 174         if(crtn) {
 175                 SecPkcs8Dbg("PKCS8: PKCS5 v1.5 CSSM_DeriveKey failure");
 176         }
 177 errOut:
 178         if(ccHand != 0) {
 179                 CSSM_DeleteContext(ccHand);
 180         }
 181         if(passKey != NULL) {
 182                 CSSM_FreeKey(cspHand, NULL, passKey, CSSM_FALSE);
 183                 free(passKey);
 184         }
 185         return crtn;
 186 }
 187
 188 #pragma mark --- PKCS5 v2.0 Key Derivation ---
 189
 190 /*
 191  * PKCS5 v2.0 has different means of encoding algorithm parameters,
 192  * depending on the encryption algorithm.
 193  */
 194 /*
 195  * Obtain encryption parameters for PKCS5 v2.0, DES and DES3 variants.
 196  */
 197 static OSStatus pkcs5_DES_params(
 198         const CSSM_DATA                 &paramData,             // encryptionScheme.parameters
 199         CSSM_OID                                *encrOid,
 200         impExpKeyUnwrapParams   *unwrapParams,
 201         CSSM_ALGORITHMS                 *keyAlg,                // RETURNED
 202         uint32                                  *keySizeInBits, // IN/OUT (returned if 0 on entry)
 203         SecNssCoder                             &coder)
 204 {
 205         /* Params is iv as OCTET STRING */
 206         if(coder.decodeItem(paramData, kSecAsn1OctetStringTemplate, &unwrapParams->iv)) {
 207                 SecPkcs8Dbg("PKCS8: PKCS5 v2 DES init vector decode error");
 208                 return errSecUnknownFormat;
 209         }
 210         if(nssCompareCssmData(encrOid, &CSSMOID_PKCS5_DES_EDE3_CBC)) {
 211                 *keyAlg = CSSM_ALGID_3DES_3KEY;
 212                 unwrapParams->encrAlg = CSSM_ALGID_3DES_3KEY_EDE;
 213                 if(*keySizeInBits == 0) {
 214                         *keySizeInBits = 3 * 64;
 215                 }
 216         }
 217         else {
 218                 *keyAlg = CSSM_ALGID_DES;
 219                 unwrapParams->encrAlg = CSSM_ALGID_DES;
 220                 if(*keySizeInBits == 0) {
 221                         *keySizeInBits = 64;
 222                 }
 223         }
 224         unwrapParams->encrPad  = CSSM_PADDING_PKCS7;
 225         unwrapParams->encrMode = CSSM_ALGMODE_CBCPadIV8;
 226         return errSecSuccess;
 227 }
 228
 229 /*
 230  * Obtain encryption parameters for PKCS5 v2.0, RC2 variant.
 231  */
 232 static OSStatus pkcs5_RC2_params(
 233         const CSSM_DATA                 &paramData,             // encryptionScheme.parameters
 234         impExpKeyUnwrapParams   *unwrapParams,
 235         CSSM_ALGORITHMS                 *keyAlg,                // RETURNED
 236         uint32                                  *keySizeInBits, // IN/OUT (returned if 0 on entry)
 237         SecNssCoder                             &coder)
 238 {
 239         /* Params is impExpPKCS5_RC2Params */
 240         impExpPKCS5_RC2Params rc2Params;
 241         memset(&rc2Params, 0, sizeof(rc2Params));
 242         if(coder.decodeItem(paramData, impExpPKCS5_RC2ParamsTemplate, &rc2Params)) {
 243                 SecPkcs8Dbg("PKCS8: PKCS5 v2 RC2 params decode error");
 244                 return errSecUnknownFormat;
 245         }
 246
 247         *keyAlg = CSSM_ALGID_RC2;
 248         unwrapParams->encrAlg  = CSSM_ALGID_RC2;
 249         unwrapParams->encrPad  = CSSM_PADDING_PKCS7;
 250         unwrapParams->encrMode = CSSM_ALGMODE_CBCPadIV8;
 251
 252         /* the version actually maps to effective key size like this */
 253         /* I swear all of this is in the PKCS5 v2.0 spec */
 254         unwrapParams->effectiveKeySizeInBits = 32;              // default
 255         if(rc2Params.version.Data) {
 256                 uint32 v;
 257                 if(!p12DataToInt(rc2Params.version, v)) {
 258                         SecPkcs8Dbg("PKCS8: bad PKCS5 rc2Params.version");
 259                         return errSecUnknownFormat;
 260                 }
 261                 switch(v) {
 262                         case 160:
 263                                 unwrapParams->effectiveKeySizeInBits = 40;
 264                                 break;
 265                         case 120:
 266                                 unwrapParams->effectiveKeySizeInBits = 64;
 267                                 break;
 268                         case 58:
 269                                 unwrapParams->effectiveKeySizeInBits = 128;
 270                                 break;
 271                         default:
 272                                 if(v >= 256) {
 273                                         unwrapParams->effectiveKeySizeInBits = v;
 274                                 }
 275                                 else {
 276                                         /* not in the spec, use as zero */
 277                                 }
 278                                 break;
 279                 }
 280         }
 281         unwrapParams->iv = rc2Params.iv;
 282
 283         /* the PKCS5 spec does not give a default for the RC2 key size */
 284         if(*keySizeInBits == 0) {
 285                 SecPkcs8Dbg("PKCS8: NO RC2 DEFAULT KEYSIZE!");
 286                 return errSecUnknownFormat;
 287         }
 288         return errSecSuccess;
 289 }
 290
 291 /*
 292  * Infer encryption parameters for PKCS5 v2.0, RC5 variant.
 293  * All info contained in encryptionScheme.parameters.
 294  */
 295 static OSStatus pkcs5_RC5_params(
 296         const CSSM_DATA                 &paramData,             // encryptionScheme.parameters
 297         impExpKeyUnwrapParams   *unwrapParams,
 298         CSSM_ALGORITHMS                 *keyAlg,                // RETURNED
 299         uint32                                  *keySizeInBits, // IN/OUT (returned if 0 on entry)
 300         SecNssCoder                             &coder)
 301 {
 302         /* Params is a impExpPKCS5_RC5Params */
 303         impExpPKCS5_RC5Params rc5Params;
 304         memset(&rc5Params, 0, sizeof(rc5Params));
 305         if(coder.decodeItem(paramData, impExpPKCS5_RC5ParamsTemplate, &rc5Params)) {
 306                 SecPkcs8Dbg("PKCS8: PKCS5 v2 RC5 params decode error");
 307                 return errSecUnknownFormat;
 308         }
 309
 310         *keyAlg = CSSM_ALGID_RC5;
 311         unwrapParams->encrAlg  = CSSM_ALGID_RC5;
 312         unwrapParams->encrPad  = CSSM_PADDING_PKCS7;
 313         unwrapParams->encrMode = CSSM_ALGMODE_CBCPadIV8;
 314
 315         if(rc5Params.rounds.Data) {
 316                 if(!p12DataToInt(rc5Params.rounds, unwrapParams->rounds)) {
 317                         SecPkcs8Dbg("PKCS8: bad PKCS5 rc5Params.rounds");
 318                         return errSecUnknownFormat;
 319                 }
 320         }
 321         if(rc5Params.blockSizeInBits.Data) {
 322                 if(!p12DataToInt(rc5Params.blockSizeInBits, unwrapParams->blockSizeInBits)) {
 323                         SecPkcs8Dbg("PKCS8: bad PKCS5 rc5Params.blockSizeInBits");
 324                         return errSecUnknownFormat;
 325                 }
 326         }
 327
 328         /* Spec says default iv is zeroes */
 329         unwrapParams->iv = rc5Params.iv;
 330         if(unwrapParams->iv.Length == 0) {
 331                 uint32 len = unwrapParams->blockSizeInBits / 8;
 332                 coder.allocItem(unwrapParams->iv, len);
 333                 memset(unwrapParams->iv.Data, 0, len);
 334         }
 335
 336         /*
 337          * Spec does not give a default for key RC5 size, and openssl doesn't
 338          * support RC5 for PKCS8.
 339          */
 340         if(*keySizeInBits == 0) {
 341                 SecPkcs8Dbg("PKCS8: NO RC5 DEFAULT KEYSIZE!");
 342                 return errSecUnknownFormat;
 343         }
 344         return errSecSuccess;
 345 }
 346
 347 /*
 348  * Common code to derive a wrap/unwrap key using PBKDF2 (i.e., using PKCS5 v2.0
 349  * key derivation). Caller must CSSM_FreeKey when done.
 350  */
 351 static CSSM_RETURN pbkdf2DeriveKey(
 352         CSSM_CSP_HANDLE         cspHand,
 353         SecNssCoder                     &coder,
 354         CSSM_ALGORITHMS         keyAlg,
 355         uint32                          keySizeInBits,
 356         uint32                          iterationCount,
 357         const CSSM_DATA         &salt,
 358         const SecKeyImportExportParameters      *keyParams,             // required
 359         impExpVerifyPhrase  verifyPhrase,   // for secure passphrase
 360         CSSM_KEY_PTR            symKey)                                                 // RETURNED
 361 {
 362         CSSM_KEY                                        *passKey = NULL;
 363         CFDataRef                                       cfPhrase = NULL;
 364         CSSM_PKCS5_PBKDF2_PARAMS        pbeParams;
 365         CSSM_RETURN                                     crtn;
 366         OSStatus                                        ortn;
 367         CSSM_DATA                                       dummyLabel;
 368         CSSM_DATA                                       pbeData;
 369         uint32                                          keyAttr;
 370         CSSM_CC_HANDLE                          ccHand = 0;
 371         CSSM_ACCESS_CREDENTIALS         creds;
 372
 373         memset(&pbeParams, 0, sizeof(pbeParams));
 374
 375         /* passphrase or passkey? */
 376         ortn = impExpPassphraseCommon(keyParams, cspHand, SPF_Data, verifyPhrase,
 377                 (CFTypeRef *)&cfPhrase, &passKey);
 378         if(ortn) {
 379                 return ortn;
 380         }
 381         /* subsequent errors to errOut: */
 382
 383         if(cfPhrase != NULL) {
 384                 size_t len = CFDataGetLength(cfPhrase);
 385                 coder.allocItem(pbeParams.Passphrase, len);
 386                 memmove(pbeParams.Passphrase.Data,
 387                         CFDataGetBytePtr(cfPhrase), len);
 388                 CFRelease(cfPhrase);
 389         }
 390
 391         memset(&creds, 0, sizeof(CSSM_ACCESS_CREDENTIALS));
 392         crtn = CSSM_CSP_CreateDeriveKeyContext(cspHand,
 393                 CSSM_ALGID_PKCS5_PBKDF2,
 394                 keyAlg,
 395                 keySizeInBits,
 396                 &creds,
 397                 passKey,                // BaseKey
 398                 iterationCount,
 399                 &salt,
 400                 NULL,                   // seed
 401                 &ccHand);
 402         if(crtn) {
 403                 SecPkcs8Dbg("PKCS8: PKCS5 v2 CSSM_CSP_CreateDeriveKeyContext failure");
 404                 goto errOut;
 405         }
 406
 407         memset(symKey, 0, sizeof(CSSM_KEY));
 408
 409         /* not extractable even for the short time this key lives */
 410         keyAttr = CSSM_KEYATTR_RETURN_REF | CSSM_KEYATTR_SENSITIVE;
 411         dummyLabel.Data = (uint8 *)"temp unwrap key";
 412         dummyLabel.Length = strlen((char *)dummyLabel.Data);
 413
 414         pbeParams.PseudoRandomFunction = CSSM_PKCS5_PBKDF2_PRF_HMAC_SHA1;
 415         pbeData.Data = (uint8 *)&pbeParams;
 416         pbeData.Length = sizeof(pbeParams);
 417         crtn = CSSM_DeriveKey(ccHand,
 418                 &pbeData,
 419                 CSSM_KEYUSE_ANY,
 420                 keyAttr,
 421                 &dummyLabel,
 422                 NULL,                   // cred and acl
 423                 symKey);
 424         if(crtn) {
 425                 SecPkcs8Dbg("PKCS8: PKCS5 v2 CSSM_DeriveKey failure");
 426         }
 427 errOut:
 428         if(ccHand != 0) {
 429                 CSSM_DeleteContext(ccHand);
 430         }
 431         if(passKey != NULL) {
 432                 CSSM_FreeKey(cspHand, NULL, passKey, CSSM_FALSE);
 433                 free(passKey);
 434         }
 435         return crtn;
 436 }
 437
 438 /*
 439  * Obtain PKCS5, v.2.0 key derivation and encryption parameters and
 440  * derive the key. This one obtains all of the crypt parameters
 441  * from the top-level AlgId.Params. What a mess.
 442  */
 443 static CSSM_RETURN pkcs5_v2_genKey(
 444         CSSM_CSP_HANDLE                 cspHand,
 445         SecNssCoder                             &coder,
 446         const CSSM_DATA                 &paramData,
 447         const SecKeyImportExportParameters *keyParams,
 448         impExpKeyUnwrapParams   *unwrapParams)
 449 {
 450         SecPkcs8Dbg("PKCS8: generating PKCS5 v2.0 key");
 451
 452         CSSM_ALGORITHMS         keyAlg = CSSM_ALGID_NONE;
 453         uint32                          prf = 0;                // CSSM_PKCS5_PBKDF2_PRF_HMAC_SHA1...
 454
 455         /* caller should check */
 456         assert(keyParams != NULL);
 457
 458         /* AlgId.Params --> impExpPKCS5_PBES2_Params */
 459         if(paramData.Length == 0) {
 460                 SecPkcs8Dbg("PKCS8: empty PKCS5 v2 pbes2Params");
 461                 return errSecUnknownFormat;
 462         }
 463         impExpPKCS5_PBES2_Params pbes2Params;
 464         memset(&pbes2Params, 0, sizeof(pbes2Params));
 465         if(coder.decodeItem(paramData, impExpPKCS5_PBES2_ParamsTemplate, &pbes2Params)) {
 466                 SecPkcs8Dbg("PKCS8: PKCS5 v2 pbes2Params decode error");
 467                 return errSecUnknownFormat;
 468         }
 469
 470         /*
 471          * As far as I know the keyDerivationFunc OID must be id-PBKDF2
 472          */
 473         if(!nssCompareCssmData(&pbes2Params.keyDerivationFunc.algorithm,
 474                         &CSSMOID_PKCS5_PBKDF2)) {
 475                 SecPkcs8Dbg("PKCS8: PKCS5 v2 unexpected keyDerivationFunc alg");
 476                 return errSecUnknownFormat;
 477         }
 478
 479         /*
 480          * The params of the keyDerivationFunc algId are an encoded
 481          * impExpPKCS5_PBKDF2_Params.
 482          */
 483         impExpPKCS5_PBKDF2_Params pbkdf2Params;
 484         memset(&pbkdf2Params, 0, sizeof(pbkdf2Params));
 485         if(coder.decodeItem(pbes2Params.keyDerivationFunc.parameters,
 486                         impExpPKCS5_PBKDF2_ParamsTemplate, &pbkdf2Params)) {
 487                 SecPkcs8Dbg("PKCS8: PKCS5 v2 pbkdf2Params decode error");
 488                 return errSecUnknownFormat;
 489         }
 490
 491         /*
 492          * Salt and iteration count from the impExpPKCS5_PBKDF2_Params (ignoring the
 493          * possible CHOICE for salt source).
 494          */
 495         CSSM_DATA salt = pbkdf2Params.salt;
 496         uint32 iterCount;
 497         if(!p12DataToInt(pbkdf2Params.iterationCount, iterCount)) {
 498                 SecPkcs8Dbg("PKCS8: bad PKCS5 v2 iteration count");
 499                 return errSecUnknownFormat;
 500         }
 501
 502         /*
 503          * Key size optional, use defaults per alg (later) if it's not there
 504          */
 505         uint32 keySizeInBits = 0;
 506         if(pbkdf2Params.keyLengthInBytes.Data) {
 507                 uint32 keyLengthInBytes;
 508                 if(!p12DataToInt(pbkdf2Params.keyLengthInBytes, keyLengthInBytes)) {
 509                         SecPkcs8Dbg("PKCS8: bad PKCS5 v2 key size");
 510                         return errSecUnknownFormat;
 511                 }
 512                 keySizeInBits = keyLengthInBytes * 8;
 513         }
 514         /* else we'll infer key size from the encryption algorithm */
 515
 516         /* prf optional, but if it's there it better be CSSMOID_PKCS5_HMAC_SHA1 */
 517         if(pbkdf2Params.prf.Data) {
 518                 if(!nssCompareCssmData(&pbkdf2Params.prf, &CSSMOID_PKCS5_HMAC_SHA1)) {
 519                         SecPkcs8Dbg("PKCS8: PKCS5 v2 unexpected prf OID");
 520                         return errSecUnknownFormat;
 521                 }
 522         }
 523         prf = CSSM_PKCS5_PBKDF2_PRF_HMAC_SHA1;
 524
 525         /*
 526          * Now process the encryptionScheme, which is even messier - the algParams
 527          * varies per encryption algorithm.
 528          */
 529         CSSM_X509_ALGORITHM_IDENTIFIER &encrScheme = pbes2Params.encryptionScheme;
 530         CSSM_OID *encrOid = &encrScheme.algorithm;
 531         OSStatus ortn;
 532         CSSM_DATA &encrParam = encrScheme.parameters;
 533
 534         if(nssCompareCssmData(encrOid, &CSSMOID_PKCS5_DES_EDE3_CBC) ||
 535            nssCompareCssmData(encrOid, &CSSMOID_DES_CBC)) {
 536                 ortn = pkcs5_DES_params(encrParam, encrOid, unwrapParams, &keyAlg,
 537                         &keySizeInBits, coder);
 538                 if(ortn) {
 539                         return ortn;
 540                 }
 541         }
 542         else if(nssCompareCssmData(encrOid, &CSSMOID_PKCS5_RC2_CBC)) {
 543                 ortn = pkcs5_RC2_params(encrParam, unwrapParams, &keyAlg,
 544                         &keySizeInBits, coder);
 545                 if(ortn) {
 546                         return ortn;
 547                 }
 548         }
 549         else if(nssCompareCssmData(encrOid, &CSSMOID_PKCS5_RC5_CBC)) {
 550                 ortn = pkcs5_RC5_params(encrParam, unwrapParams, &keyAlg,
 551                         &keySizeInBits, coder);
 552                 if(ortn) {
 553                         return ortn;
 554                 }
 555         }
 556         else {
 557                 SecPkcs8Dbg("PKCS8: PKCS5 v2 unknown encrScheme.algorithm");
 558                 return errSecUnknownFormat;
 559         }
 560
 561         /* We should be ready to go */
 562         assert(keyAlg != CSSM_ALGID_NONE);
 563         assert(unwrapParams->encrAlg != CSSM_ALGID_NONE);
 564
 565         /* use all the stuff we just figured out to derive a symmetric decryption key */
 566         return pbkdf2DeriveKey(cspHand, coder,
 567                 keyAlg, keySizeInBits,
 568                 iterCount, salt,
 569                 keyParams,
 570                 VP_Import,
 571                 unwrapParams->unwrappingKey);
 572 }
 573
 574 #pragma mark --- PKCS12 Key Derivation ---
 575
 576 /*
 577  * PKCS12 style key derivation. Caller has gleaned everything except
 578  * salt, iterationCount, and IV from the AlgId.algorithm OID.
 579  *
 580  * We get salt and iteration count from the incoming alg params.
 581  * IV is derived along with the unwrapping key from the passphrase.
 582  */
 583 static CSSM_RETURN pkcs12_genKey(
 584         CSSM_CSP_HANDLE         cspHand,
 585         SecNssCoder                     &coder,
 586         const SecKeyImportExportParameters *keyParams,
 587         const CSSM_DATA         &paramData,                     // from algID
 588         CSSM_ALGORITHMS         keyAlg,                         // valid on entry
 589         CSSM_ALGORITHMS         pbeHashAlg,                     // valid on entry
 590         uint32                          keySizeInBits,          // valid on entry
 591         uint32                          blockSizeInBytes,   // for IV
 592         impExpKeyUnwrapParams  *unwrapParams)
 593 {
 594         SecPkcs8Dbg("PKCS8: generating PKCS12 key");
 595
 596         assert(keyAlg != CSSM_ALGID_NONE);
 597         assert(pbeHashAlg != CSSM_ALGID_NONE);
 598         assert(keySizeInBits != 0);
 599
 600         /* get iteration count, salt from alg params */
 601         NSS_P12_PBE_Params pbeParams;
 602
 603         if(paramData.Length == 0) {
 604                 SecPkcs8Dbg("PKCS8: empty P12 pbeParams");
 605                 return errSecUnknownFormat;
 606         }
 607         memset(&pbeParams, 0, sizeof(pbeParams));
 608         if(coder.decodeItem(paramData, NSS_P12_PBE_ParamsTemplate, &pbeParams)) {
 609                 SecPkcs8Dbg("PKCS8: P12 pbeParams decode error");
 610                 return errSecUnknownFormat;
 611         }
 612
 613         uint32 iterCount = 0;
 614         if(!p12DataToInt(pbeParams.iterations, iterCount)) {
 615                 SecPkcs8Dbg("PKCS8: bad P12 iteration count");
 616                 return errSecUnknownFormat;
 617         }
 618
 619         /* passphrase or passkey? */
 620         CSSM_KEY *passKey = NULL;
 621         CFStringRef phraseStr = NULL;
 622         CSSM_DATA phraseData = {0, NULL};
 623         CSSM_DATA *phraseDataP = NULL;
 624         OSStatus ortn;
 625         CSSM_RETURN crtn;
 626
 627         assert(keyParams != NULL);
 628
 629         ortn = impExpPassphraseCommon(keyParams, cspHand, SPF_String, VP_Import,
 630                 (CFTypeRef *)&phraseStr, &passKey);
 631         if(ortn) {
 632                 return ortn;
 633         }
 634         /* subsequent errors to errOut: */
 635
 636         if(phraseStr != NULL) {
 637                 /* convert to CSSM_DATA for use with p12KeyGen() */
 638                 try {
 639                         p12ImportPassPhrase(phraseStr, coder, phraseData);
 640                 }
 641                 catch(...) {
 642                         SecPkcs8Dbg("PKCS8: p12ImportPassPhrase threw");
 643                         crtn = errSecAllocate;
 644                         goto errOut;
 645                 }
 646                 CFRelease(phraseStr);
 647                 phraseDataP = &phraseData;
 648         }
 649
 650         /* use p12 module to cook up the key and IV */
 651         if(blockSizeInBytes) {
 652                 coder.allocItem(unwrapParams->iv, blockSizeInBytes);
 653         }
 654         crtn = p12KeyGen(cspHand,
 655                 *unwrapParams->unwrappingKey,
 656                 true,           // isForEncr
 657                 keyAlg,
 658                 pbeHashAlg,
 659                 keySizeInBits,
 660                 iterCount,
 661                 pbeParams.salt,
 662                 phraseDataP,
 663                 passKey,
 664                 unwrapParams->iv);
 665         if(crtn) {
 666                 SecPkcs8Dbg("PKCS8: p12KeyGen failed");
 667         }
 668 errOut:
 669         if(passKey != NULL) {
 670                 CSSM_FreeKey(cspHand, NULL, passKey, CSSM_FALSE);
 671                 free(passKey);
 672         }
 673         return crtn;
 674 }
 675
 676 #pragma mark --- Public PKCS8 import function ---
 677
 678 /*
 679  * Called out from SecImportRep::importWrappedKey().
 680  * If cspHand is provided instead of importKeychain, the CSP
 681  * handle MUST be for the CSPDL, not for the raw CSP.
 682  */
 683 OSStatus impExpPkcs8Import(
 684         CFDataRef                                                       inData,
 685         SecKeychainRef                                          importKeychain, // optional
 686         CSSM_CSP_HANDLE                                         cspHand,                // required
 687         SecItemImportExportFlags                        flags,
 688         const SecKeyImportExportParameters      *keyParams,             // REQUIRED for unwrap
 689         CFMutableArrayRef                                       outArray)               // optional, append here
 690 {
 691         CSSM_KEY                        wrappedKey;
 692         CSSM_KEYHEADER          &hdr = wrappedKey.KeyHeader;
 693         CSSM_RETURN                     crtn = CSSM_OK;
 694
 695         /* key derivation and encryption parameters gleaned from alg ID */
 696         impExpKeyUnwrapParams unwrapParams;
 697         memset(&unwrapParams, 0, sizeof(unwrapParams));
 698         CSSM_ALGORITHMS         keyAlg = CSSM_ALGID_NONE;
 699         CSSM_ALGORITHMS         pbeHashAlg = CSSM_ALGID_NONE;   // SHA1 or MD5
 700         uint32                          keySizeInBits;
 701         uint32                          blockSizeInBytes;
 702         PKCS_Which                      pkcs = PW_None;
 703
 704         if( (keyParams == NULL) ||
 705             ( (keyParams->passphrase == NULL) &&
 706                   !(keyParams->flags & kSecKeySecurePassphrase) ) ) {
 707                 /* passphrase mandatory */
 708                 return errSecPassphraseRequired;
 709         }
 710         assert(cspHand != 0);
 711
 712         /*
 713          * Top-level decode
 714          */
 715         SecNssCoder                                     coder;
 716         NSS_EncryptedPrivateKeyInfo encrPrivKeyInfo;
 717
 718         memset(&encrPrivKeyInfo, 0, sizeof(encrPrivKeyInfo));
 719         if(coder.decode(CFDataGetBytePtr(inData),
 720                         CFDataGetLength(inData),
 721                         kSecAsn1EncryptedPrivateKeyInfoTemplate, &encrPrivKeyInfo)) {
 722                 SecImpExpDbg("impExpPkcs8Import: error decoding top-level encrPrivKeyInfo");
 723                 return errSecUnknownFormat;
 724         }
 725
 726         /*
 727          * The algorithm OID of that top-level struct is the key piece of info
 728          * for now...
 729          */
 730         bool found = false;
 731         found = pkcsOidToParams(&encrPrivKeyInfo.algorithm.algorithm,
 732                 keyAlg, unwrapParams.encrAlg, pbeHashAlg, keySizeInBits, blockSizeInBytes,
 733                 unwrapParams.encrPad, unwrapParams.encrMode, pkcs);
 734         if(!found) {
 735                 SecImpExpDbg("impExpPkcs8Import: unknown OID in top-level encrPrivKeyInfo");
 736                 return errSecUnknownFormat;
 737         }
 738
 739         /*
 740          * Each PBE method has its own way of filling in the remaining gaps
 741          * in impExpKeyUnwrapParams and generating a key.
 742          */
 743         CSSM_KEY unwrappingKey;
 744         memset(&unwrappingKey, 0, sizeof(unwrappingKey));
 745         unwrapParams.unwrappingKey = &unwrappingKey;
 746         CSSM_DATA &paramData = encrPrivKeyInfo.algorithm.parameters;
 747
 748         switch(pkcs) {
 749                 case PW_PKCS5_v1_5:
 750                         /* we have everything except iv, iterations, salt */
 751                         crtn = pkcs5_v15_genKey(cspHand, coder, keyParams, paramData,
 752                                 keyAlg, pbeHashAlg, keySizeInBits, blockSizeInBytes,
 753                                 &unwrapParams);
 754                         break;
 755
 756                 case PW_PKCS5_v2:
 757                         /* obtain everything, including iv, from alg params */
 758                         crtn = pkcs5_v2_genKey(cspHand, coder, paramData, keyParams, &unwrapParams);
 759                         break;
 760                 case PW_PKCS12:
 761                         /* we have everything except iv, iterations, salt */
 762                         crtn = pkcs12_genKey(cspHand, coder, keyParams, paramData,
 763                                 keyAlg, pbeHashAlg, keySizeInBits, blockSizeInBytes,
 764                                 &unwrapParams);
 765                         break;
 766                 case PW_None:
 767                         /* satisfy compiler */
 768                         assert(0);
 769                         return errSecUnknownFormat;
 770         }
 771         if(crtn) {
 772                 SecPkcs8Dbg("PKCS8: key derivation failed");
 773                 return crtn;
 774         }
 775
 776         /* we should be ready to rock'n'roll no matter how we got here */
 777         assert(unwrapParams.encrAlg != CSSM_ALGID_NONE);
 778         assert(unwrappingKey.KeyData.Data != NULL);
 779         assert(unwrappingKey.KeyHeader.AlgorithmId != CSSM_ALGID_NONE);
 780
 781         /* set up key to unwrap */
 782         memset(&wrappedKey, 0, sizeof(CSSM_KEY));
 783         hdr.HeaderVersion = CSSM_KEYHEADER_VERSION;
 784         /* CspId : don't care */
 785         hdr.BlobType = CSSM_KEYBLOB_WRAPPED;
 786         hdr.Format = CSSM_KEYBLOB_WRAPPED_FORMAT_PKCS8;
 787         /* AlgorithmId : inferred by CSP */
 788         hdr.AlgorithmId = CSSM_ALGID_NONE;
 789         hdr.KeyClass = CSSM_KEYCLASS_PRIVATE_KEY;
 790         /* LogicalKeySizeInBits : calculated by CSP during unwrap */
 791         hdr.KeyAttr = CSSM_KEYATTR_EXTRACTABLE;
 792         hdr.KeyUsage = CSSM_KEYUSE_ANY;
 793
 794         wrappedKey.KeyData = encrPrivKeyInfo.encryptedData;
 795
 796         crtn = impExpImportKeyCommon(
 797                 &wrappedKey,
 798                 importKeychain,
 799                 cspHand,
 800                 flags,
 801                 keyParams,
 802                 &unwrapParams,
 803                 NULL,                   // default label
 804                 outArray);
 805         CSSM_FreeKey(cspHand, NULL, &unwrappingKey, CSSM_FALSE);
 806         return crtn;
 807 }
 808
 809 #pragma mark --- Public PKCS8 export function ---
 810
 811 #define PKCS5_V2_SALT_LEN               8
 812 #define PKCS5_V2_ITERATIONS             2048
 813 #define PKCS5_V2_DES_IV_SIZE    8
 814
 815 /*
 816  * Unlike impExpPkcs8Import(), which can handle every PBE algorithm in the spec
 817  * and implemented by openssl, this one has a fixed PBE and encryption scheme.
 818  * We do not provide a means at the API for the client to specify these.
 819  *
 820  * We generate blobs with triple DES encryption, with PKCS5 v2.0 key
 821  * derivation.
 822  */
 823 OSStatus impExpPkcs8Export(
 824         SecKeyRef                                                       secKey,
 825         SecItemImportExportFlags                        flags,
 826         const SecKeyImportExportParameters      *keyParams,             // optional
 827         CFMutableDataRef                                        outData,                // output appended here
 828         const char                                                      **pemHeader)
 829 {
 830         SecNssCoder                                             coder;
 831         impExpPKCS5_PBES2_Params                pbes2Params;
 832         CSSM_X509_ALGORITHM_IDENTIFIER  &keyDeriveAlgId = pbes2Params.keyDerivationFunc;
 833         CSSM_ATTRIBUTE_TYPE                             formatAttrType = CSSM_ATTRIBUTE_NONE;
 834         CSSM_KEYBLOB_FORMAT                             blobForm = CSSM_KEYBLOB_RAW_FORMAT_NONE;
 835         const CSSM_KEY                                  *cssmKey;
 836
 837         if(keyParams == NULL) {
 838                 return errSecParam;
 839         }
 840         assert(secKey != NULL);
 841         assert(outData != NULL);
 842
 843         memset(&pbes2Params, 0, sizeof(pbes2Params));
 844
 845         /*
 846          * keyDeriveAlgId
 847          * parameters is an encoded impExpPKCS5_PBKDF2_Params
 848          * We generate random salt
 849          */
 850         keyDeriveAlgId.algorithm = CSSMOID_PKCS5_PBKDF2;
 851         impExpPKCS5_PBKDF2_Params pbkdf2Params;
 852         memset(&pbkdf2Params, 0, sizeof(pbkdf2Params));
 853         coder.allocItem(pbkdf2Params.salt, PKCS5_V2_SALT_LEN);
 854     MacOSError::check(SecRandomCopyBytes(kSecRandomDefault, PKCS5_V2_SALT_LEN, pbkdf2Params.salt.Data));
 855
 856         p12IntToData(PKCS5_V2_ITERATIONS, pbkdf2Params.iterationCount, coder);
 857         /* leave pbkdf2Params.keyLengthInBytes NULL for default */
 858         /* openssl can't handle this, which is the default value:
 859            pbkdf2Params.prf = CSSMOID_PKCS5_HMAC_SHA1;
 860          */
 861
 862         coder.encodeItem(&pbkdf2Params, impExpPKCS5_PBKDF2_ParamsTemplate,
 863                         keyDeriveAlgId.parameters);
 864
 865         /*
 866          * encryptionScheme
 867          * parameters is an encoded OCTET STRING containing the (random) IV
 868          */
 869         CSSM_X509_ALGORITHM_IDENTIFIER &encrScheme = pbes2Params.encryptionScheme;
 870         encrScheme.algorithm = CSSMOID_PKCS5_DES_EDE3_CBC;
 871         CSSM_DATA rawIv = {0, NULL};
 872         coder.allocItem(rawIv, PKCS5_V2_DES_IV_SIZE);
 873     MacOSError::check(SecRandomCopyBytes(kSecRandomDefault, PKCS5_V2_DES_IV_SIZE, rawIv.Data));
 874
 875         coder.encodeItem(&rawIv, kSecAsn1OctetStringTemplate,
 876                         encrScheme.parameters);
 877
 878         /*
 879          * Top level NSS_EncryptedPrivateKeyInfo, whose parameters is the encoded
 880          * impExpPKCS5_PBES2_Params.
 881          */
 882         NSS_EncryptedPrivateKeyInfo encrPrivKeyInfo;
 883         memset(&encrPrivKeyInfo, 0, sizeof(encrPrivKeyInfo));
 884         CSSM_X509_ALGORITHM_IDENTIFIER &topAlgId = encrPrivKeyInfo.algorithm;
 885         topAlgId.algorithm = CSSMOID_PKCS5_PBES2;
 886         coder.encodeItem(&pbes2Params, impExpPKCS5_PBES2_ParamsTemplate,
 887                         topAlgId.parameters);
 888
 889         /*
 890          * Now all we have to do is generate the encrypted key data itself.
 891          * When doing a WrapKey op in PKCS8 form, the CSP gives us the
 892          * NSS_EncryptedPrivateKeyInfo.encryptedData values.
 893          */
 894
 895         /* we need a CSPDL handle - try to get it from the key */
 896         CSSM_CSP_HANDLE cspdlHand = 0;
 897         OSStatus ortn;
 898         bool releaseCspHand = false;
 899         CSSM_DATA encodedKeyInfo = {0, NULL};
 900
 901         ortn = SecKeyGetCSPHandle(secKey, &cspdlHand);
 902         if(ortn) {
 903                 cspdlHand = cuCspStartup(CSSM_FALSE);
 904                 if(cspdlHand == 0) {
 905                         return CSSMERR_CSSM_ADDIN_LOAD_FAILED;
 906                 }
 907                 releaseCspHand = true;
 908         }
 909         /* subsequent errors to errOut: */
 910
 911         /* get wrapping key from parameters we just set up */
 912         CSSM_KEY wrappingKey;
 913         memset(&wrappingKey, 0, sizeof(CSSM_KEY));
 914         CSSM_RETURN crtn = pbkdf2DeriveKey(cspdlHand, coder,
 915                 CSSM_ALGID_3DES_3KEY, 3 * 64,
 916                 PKCS5_V2_ITERATIONS, pbkdf2Params.salt,
 917                 keyParams,
 918                 VP_Export,
 919                 &wrappingKey);
 920         if(crtn) {
 921                 goto errOut;
 922         }
 923
 924         /*
 925          * Special case for DSA, ECDSA: specify that the raw blob, pre-encrypt, is in
 926          * the PKCS8 PrivateKeyInfo format that openssl understands. The
 927          * default is BSAFE.
 928          */
 929         crtn = SecKeyGetCSSMKey(secKey, &cssmKey);
 930         if(crtn) {
 931                 SecImpExpDbg("impExpPkcs8Export SecKeyGetCSSMKey error");
 932                 goto errOut;
 933         }
 934         switch(cssmKey->KeyHeader.AlgorithmId) {
 935                 case CSSM_ALGID_DSA:
 936                 case CSSM_ALGID_ECDSA:
 937                         formatAttrType = CSSM_ATTRIBUTE_PRIVATE_KEY_FORMAT;
 938                         blobForm = CSSM_KEYBLOB_RAW_FORMAT_PKCS8;
 939                         break;
 940                 default:
 941                         break;
 942         }
 943
 944         /* GO */
 945         CSSM_KEY wrappedKey;
 946         memset(&wrappedKey, 0, sizeof(CSSM_KEY));
 947
 948         crtn = impExpExportKeyCommon(cspdlHand, secKey, &wrappingKey, &wrappedKey,
 949                 CSSM_ALGID_3DES_3KEY_EDE, CSSM_ALGMODE_CBCPadIV8, CSSM_PADDING_PKCS7,
 950                 CSSM_KEYBLOB_WRAPPED_FORMAT_PKCS8, formatAttrType, blobForm, NULL, &rawIv);
 951         if(crtn) {
 952                 goto errOut;
 953         }
 954
 955         /*
 956          * OK... *that* wrapped key's data goes into the top-level
 957          * NSS_EncryptedPrivateKeyInfo, which we then encode; the caller
 958          * gets the result of that encoding.
 959          */
 960         encrPrivKeyInfo.encryptedData = wrappedKey.KeyData;
 961         coder.encodeItem(&encrPrivKeyInfo, kSecAsn1EncryptedPrivateKeyInfoTemplate,
 962                         encodedKeyInfo);
 963
 964         CFDataAppendBytes(outData, encodedKeyInfo.Data, encodedKeyInfo.Length);
 965         CSSM_FreeKey(cspdlHand, NULL, &wrappedKey, CSSM_FALSE);
 966
 967         *pemHeader = PEM_STRING_PKCS8;
 968
 969 errOut:
 970         if(wrappingKey.KeyData.Data) {
 971                 CSSM_FreeKey(cspdlHand, NULL, &wrappingKey, CSSM_FALSE);
 972         }
 973         if(releaseCspHand) {
 974                 cuCspDetachUnload(cspdlHand, CSSM_FALSE);
 975         }
 976         return crtn;
 977 }