OSX/sec/Security/SecECKey.m

   1 /*
   2  * Copyright (c) 2010-2015 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 /*
  25  * SecECKey.m - CoreFoundation based ECDSA key object
  26  */
  27
  28 #include "SecECKey.h"
  29 #include "SecECKeyPriv.h"
  30
  31 #import <Foundation/Foundation.h>
  32
  33 #include <Security/SecKeyInternal.h>
  34 #include <Security/SecItem.h>
  35 #include <Security/SecBasePriv.h>
  36 #include <AssertMacros.h>
  37 #include <Security/SecureTransport.h> /* For error codes. */
  38 #include <CoreFoundation/CFData.h> /* For error codes. */
  39 #include <CoreFoundation/CFNumber.h>
  40 #include <Security/SecFramework.h>
  41 #include <Security/SecRandom.h>
  42 #include <utilities/debugging.h>
  43 #include <Security/SecItemPriv.h>
  44 #include <Security/SecInternal.h>
  45 #include <utilities/SecCFError.h>
  46 #include <utilities/SecCFWrappers.h>
  47 #include <utilities/array_size.h>
  48 #include <corecrypto/ccec.h>
  49 #include <corecrypto/ccsha1.h>
  50 #include <corecrypto/ccsha2.h>
  51 #include <corecrypto/ccrng.h>
  52 #include <corecrypto/ccder_decode_eckey.h>
  53
  54 #define kMaximumECKeySize 521
  55
  56 static CFIndex SecECKeyGetAlgorithmID(SecKeyRef key) {
  57     return kSecECDSAAlgorithmID;
  58 }
  59
  60
  61 /*
  62  *
  63  * Public Key
  64  *
  65  */
  66
  67 /* Public key static functions. */
  68 static void SecECPublicKeyDestroy(SecKeyRef key) {
  69     /* Zero out the public key */
  70     ccec_pub_ctx_t pubkey = key->key;
  71     if (ccec_ctx_cp(pubkey))
  72         cc_clear(ccec_pub_ctx_size(ccn_sizeof_n(ccec_ctx_n(pubkey))), pubkey);
  73 }
  74
  75 static ccec_const_cp_t getCPForPublicSize(CFIndex encoded_length)
  76 {
  77     size_t keysize = ccec_x963_import_pub_size(encoded_length);
  78     if(ccec_keysize_is_supported(keysize)) {
  79         return ccec_get_cp(keysize);
  80     }
  81     return NULL;
  82 }
  83
  84 static ccec_const_cp_t getCPForPrivateSize(CFIndex encoded_length)
  85 {
  86     size_t keysize = ccec_x963_import_priv_size(encoded_length);
  87     if(ccec_keysize_is_supported(keysize)) {
  88         return ccec_get_cp(keysize);
  89     }
  90     return NULL;
  91 }
  92
  93 static ccoid_t ccoid_secp192r1 = CC_EC_OID_SECP192R1;
  94 static ccoid_t ccoid_secp256r1 = CC_EC_OID_SECP256R1;
  95 static ccoid_t ccoid_secp224r1 = CC_EC_OID_SECP224R1;
  96 static ccoid_t ccoid_secp384r1 = CC_EC_OID_SECP384R1;
  97 static ccoid_t ccoid_secp521r1 = CC_EC_OID_SECP521R1;
  98
  99 // <rdar://problem/66864716> OID_CERTICOM is wrong
 100 static ccoid_t ccoid_libder_secp384r1 = ((unsigned char *)"\x06\x04\x2B\x84\x00\x22");
 101 static ccoid_t ccoid_libder_secp521r1 = ((unsigned char *)"\x06\x04\x2B\x84\x00\x23");
 102
 103 static ccec_const_cp_t ccec_cp_for_oid(const unsigned char *oid)
 104 {
 105     if (oid!=NULL) {
 106         if (ccoid_equal(oid, ccoid_secp192r1)) {
 107             return ccec_cp_192();
 108         } else if (ccoid_equal(oid, ccoid_secp256r1)) {
 109             return ccec_cp_256();
 110         } else if (ccoid_equal(oid, ccoid_secp224r1)) {
 111             return ccec_cp_224();
 112         } else if (ccoid_equal(oid, ccoid_secp384r1) || ccoid_equal(oid, ccoid_libder_secp384r1)) {
 113             return ccec_cp_384();
 114         } else if (ccoid_equal(oid, ccoid_secp521r1) || ccoid_equal(oid, ccoid_libder_secp521r1)) {
 115             return ccec_cp_521();
 116         }
 117     }
 118     return (ccec_const_cp_t){NULL};
 119 }
 120
 121 static OSStatus SecECPublicKeyInit(SecKeyRef key,
 122     const uint8_t *keyData, CFIndex keyDataLength, SecKeyEncoding encoding) {
 123     ccec_pub_ctx_t pubkey = key->key;
 124     OSStatus err = errSecParam;
 125
 126     switch (encoding) {
 127     case kSecDERKeyEncoding:
 128     {
 129         const SecDERKey *derKey = (const SecDERKey *)keyData;
 130         if (keyDataLength != sizeof(SecDERKey)) {
 131             err = errSecDecode;
 132             break;
 133         }
 134
 135         require_action_quiet(derKey->parameters && derKey->parametersLength > 2 &&
 136                              derKey->parameters[1] <= derKey->parametersLength - 2, errOut, err = errSecDecode);
 137         ccec_const_cp_t cp = ccec_cp_for_oid(derKey->parameters);
 138         require_action_quiet(cp, errOut, err = errSecDecode);
 139
 140         err = (ccec_import_pub(cp, derKey->keyLength, derKey->key, pubkey)
 141                ? errSecDecode : errSecSuccess);
 142         break;
 143     }
 144     case kSecKeyEncodingBytes:
 145     {
 146         ccec_const_cp_t cp = getCPForPublicSize(keyDataLength);
 147         require_action_quiet(cp, errOut, err = errSecDecode);
 148         err = (ccec_import_pub(cp, keyDataLength, keyData, pubkey)
 149                ? errSecDecode : errSecSuccess);
 150         break;
 151     }
 152     case kSecExtractPublicFromPrivate:
 153     {
 154         ccec_full_ctx_t fullKey = (ccec_full_ctx_t)keyData;
 155
 156         cc_size fullKeyN = ccec_ctx_n(fullKey);
 157         require_quiet(fullKeyN <= ccn_nof(kMaximumECKeySize), errOut);
 158         memcpy(pubkey, fullKey, ccec_pub_ctx_size(ccn_sizeof_n(fullKeyN)));
 159         err = errSecSuccess;
 160         break;
 161     }
 162     case kSecKeyEncodingApplePkcs1:
 163     default:
 164         err = errSecParam;
 165         break;
 166     }
 167
 168 errOut:
 169     return err;
 170 }
 171
 172 static CFTypeRef SecECPublicKeyCopyOperationResult(SecKeyRef key, SecKeyOperationType operation, SecKeyAlgorithm algorithm,
 173                                                    CFArrayRef algorithms, SecKeyOperationMode mode,
 174                                                    CFTypeRef in1, CFTypeRef in2, CFErrorRef *error) {
 175     if (operation != kSecKeyOperationTypeVerify || !CFEqual(algorithm, kSecKeyAlgorithmECDSASignatureDigestX962)) {
 176         // EC public key supports only signature verification with X962 algorithm.
 177         return kCFNull;
 178     }
 179
 180     if (mode == kSecKeyOperationModePerform) {
 181         bool valid = false;
 182         int err = -1;
 183         size_t sigLen = CFDataGetLength(in2);
 184         uint8_t *sig = (uint8_t *)CFDataGetBytePtr(in2);
 185         ccec_pub_ctx_t pubkey = key->key;
 186
 187         err = ccec_verify(pubkey, CFDataGetLength(in1), CFDataGetBytePtr(in1), sigLen, sig, &valid);
 188         if (err != 0) {
 189             SecError(errSecVerifyFailed, error, CFSTR("EC signature verification failed (ccerr %d)"), err);
 190             return NULL;
 191         } else if (!valid) {
 192             SecError(errSecVerifyFailed, error, CFSTR("EC signature verification failed, no match"));
 193             return NULL;
 194         } else {
 195             return kCFBooleanTrue;
 196         }
 197     } else {
 198         // Algorithm is supported.
 199         return kCFBooleanTrue;
 200     }
 201 }
 202
 203 static size_t SecECPublicKeyBlockSize(SecKeyRef key) {
 204     /* Get key size in octets */
 205     return ccec_ctx_size(ccec_ctx_pub(key->key));
 206 }
 207
 208 /* Encode the public key and return it in a newly allocated CFDataRef. */
 209 static CFDataRef SecECPublicKeyExport(CFAllocatorRef allocator,
 210         ccec_pub_ctx_t pubkey) {
 211     size_t pub_size = ccec_export_pub_size(pubkey);
 212         CFMutableDataRef blob = CFDataCreateMutableWithScratch(allocator, pub_size);
 213     ccec_export_pub(pubkey, CFDataGetMutableBytePtr(blob));
 214         return blob;
 215 }
 216
 217 static CFDataRef SecECPublicKeyCopyExternalRepresentation(SecKeyRef key, CFErrorRef *error) {
 218     ccec_pub_ctx_t pubkey = key->key;
 219     return SecECPublicKeyExport(NULL, pubkey);
 220 }
 221
 222 static OSStatus SecECPublicKeyCopyPublicOctets(SecKeyRef key, CFDataRef *serailziation)
 223 {
 224     ccec_pub_ctx_t pubkey = key->key;
 225
 226         CFAllocatorRef allocator = CFGetAllocator(key);
 227     *serailziation = SecECPublicKeyExport(allocator, pubkey);
 228
 229     if (NULL == *serailziation)
 230         return errSecDecode;
 231     else
 232         return errSecSuccess;
 233 }
 234
 235 static CFDictionaryRef SecECPublicKeyCopyAttributeDictionary(SecKeyRef key) {
 236     CFDictionaryRef dict = SecKeyGeneratePublicAttributeDictionary(key, kSecAttrKeyTypeEC);
 237     CFMutableDictionaryRef mutableDict = CFDictionaryCreateMutableCopy(NULL, 0, dict);
 238     CFDictionarySetValue(mutableDict, kSecAttrCanDerive, kCFBooleanFalse);
 239     CFAssignRetained(dict, mutableDict);
 240     return dict;
 241 }
 242
 243 static const char *
 244 getCurveName(SecKeyRef key)
 245 {
 246     SecECNamedCurve curveType = SecECKeyGetNamedCurve(key);
 247
 248     switch (curveType)
 249     {
 250         case kSecECCurveSecp256r1:
 251             return "kSecECCurveSecp256r1";
 252             break;
 253         case kSecECCurveSecp384r1:
 254             return "kSecECCurveSecp384r1";
 255             break;
 256         case kSecECCurveSecp521r1:
 257             return "kSecECCurveSecp521r1";
 258         default:
 259             return "kSecECCurveNone";
 260     }
 261 }
 262
 263 static CFStringRef SecECPublicKeyCopyKeyDescription(SecKeyRef key)
 264 {
 265     NSMutableString *strings[2];
 266     const char* curve = getCurveName(key);
 267
 268     ccec_pub_ctx_t ecPubkey = key->key;
 269     size_t len = ccec_ctx_size(ecPubkey);
 270     NSMutableData *buffer = [NSMutableData dataWithLength:len];
 271     for (int i = 0; i < 2; ++i) {
 272         ccn_write_uint(ccec_ctx_n(ecPubkey), (i == 0) ? ccec_ctx_x(ecPubkey) : ccec_ctx_y(ecPubkey), len, buffer.mutableBytes);
 273         strings[i] = [NSMutableString stringWithCapacity:len * 2];
 274         for (size_t byteIndex = 0; byteIndex < len; ++byteIndex) {
 275             [strings[i] appendFormat:@"%02X", ((const uint8_t *)buffer.bytes)[byteIndex]];
 276         }
 277     }
 278
 279     NSString *description = [NSString stringWithFormat:@"<SecKeyRef curve type: %s, algorithm id: %lu, key type: %s, version: %d, block size: %zu bits, y: %@, x: %@, addr: %p>",
 280                              curve, (long)SecKeyGetAlgorithmId(key), key->key_class->name, key->key_class->version,
 281                              8 * SecKeyGetBlockSize(key), strings[1], strings[0], key];
 282     return CFBridgingRetain(description);
 283 }
 284
 285 static const struct ccec_rfc6637_curve * get_rfc6637_curve(SecKeyRef key)
 286 {
 287     SecECNamedCurve curveType = SecECKeyGetNamedCurve(key);
 288
 289     if (curveType == kSecECCurveSecp256r1) {
 290         return &ccec_rfc6637_dh_curve_p256;
 291     } else if (curveType == kSecECCurveSecp521r1) {
 292         return &ccec_rfc6637_dh_curve_p521;
 293     }
 294     return NULL;
 295 }
 296
 297 static CFDataRef SecECKeyCopyWrapKey(SecKeyRef key, SecKeyWrapType type, CFDataRef unwrappedKey, CFDictionaryRef parameters, CFDictionaryRef *outParam, CFErrorRef *error)
 298 {
 299     ccec_pub_ctx_t pubkey = key->key;
 300     int err = errSecUnimplemented;
 301     const struct ccec_rfc6637_curve *curve;
 302     const struct ccec_rfc6637_wrap *wrap = NULL;
 303     uint8_t sym_alg = 0;
 304     int32_t flags = 0;
 305
 306     if (type != kSecKeyWrapPublicKeyPGP) {
 307         SecError(errSecUnsupportedOperation, error, CFSTR("unsupported key wrapping algorithm"));
 308         return NULL;
 309     }
 310
 311     curve = get_rfc6637_curve(key);
 312     if (curve == NULL) {
 313         SecError(errSecUnsupportedOperation, error, CFSTR("unsupported curve"));
 314         return NULL;
 315     }
 316
 317     CFNumberRef num = CFDictionaryGetValue(parameters, _kSecKeyWrapPGPSymAlg);
 318     if (!isNumber(num) || !CFNumberGetValue(num, kCFNumberSInt8Type, &sym_alg)) {
 319         SecError(errSecUnsupportedOperation, error, CFSTR("unknown symalg given"));
 320         return NULL;
 321     }
 322
 323     CFDataRef fingerprint = CFDictionaryGetValue(parameters, _kSecKeyWrapPGPFingerprint);
 324     if (!isData(fingerprint) || CFDataGetLength(fingerprint) < kSecKeyWrapPGPFingerprintMinSize) {
 325         SecError(errSecUnsupportedOperation, error, CFSTR("invalid fingerprint"));
 326         return NULL;
 327     }
 328
 329     CFTypeRef wrapAlg = CFDictionaryGetValue(parameters, _kSecKeyWrapPGPWrapAlg);
 330     if (wrapAlg == NULL) {
 331         SecError(errSecUnsupportedOperation, error, CFSTR("no wrap alg"));
 332         return NULL;
 333     } else if (CFEqual(wrapAlg, _kSecKeyWrapRFC6637WrapDigestSHA256KekAES128)) {
 334         wrap = &ccec_rfc6637_wrap_sha256_kek_aes128;
 335     } else if (CFEqual(wrapAlg, _kSecKeyWrapRFC6637WrapDigestSHA512KekAES256)) {
 336         wrap = &ccec_rfc6637_wrap_sha512_kek_aes256;
 337     } else {
 338         SecError(errSecUnsupportedOperation, error, CFSTR("unknown wrap alg"));
 339         return NULL;
 340     }
 341
 342     num = CFDictionaryGetValue(parameters, _kSecKeyWrapRFC6637Flags);
 343     if (isNumber(num)) {
 344         if (!CFNumberGetValue(num, kCFNumberSInt32Type, &flags)) {
 345             SecError(errSecUnsupportedOperation, error, CFSTR("invalid flags: %@"), num);
 346             return NULL;
 347         }
 348     } else if (num) {
 349         SecError(errSecUnsupportedOperation, error, CFSTR("unknown flags"));
 350         return NULL;
 351     }
 352
 353     CFIndex unwrappedKey_size = CFDataGetLength(unwrappedKey);
 354
 355     CFIndex output_size = ccec_rfc6637_wrap_key_size(pubkey, flags, unwrappedKey_size);
 356     if (output_size == 0) {
 357         SecError(errSecUnsupportedOperation, error, CFSTR("can't wrap that key, can't build size"));
 358         return NULL;
 359     }
 360
 361     CFMutableDataRef data = CFDataCreateMutableWithScratch(NULL, output_size);
 362     require_quiet(data, errOut);
 363
 364     err = ccec_rfc6637_wrap_key(pubkey, CFDataGetMutableBytePtr(data), flags,
 365                                 sym_alg, CFDataGetLength(unwrappedKey), CFDataGetBytePtr(unwrappedKey),
 366                                 curve, wrap, CFDataGetBytePtr(fingerprint),
 367                                 ccrng_seckey);
 368     if (err) {
 369         SecError(errSecUnsupportedOperation, error, CFSTR("Failed to wrap key"));
 370         CFReleaseNull(data);
 371     }
 372
 373 errOut:
 374     return data;
 375 }
 376
 377 SecKeyDescriptor kSecECPublicKeyDescriptor = {
 378     .version = kSecKeyDescriptorVersion,
 379     .name = "ECPublicKey",
 380     .extraBytes = ccec_pub_ctx_size(ccn_sizeof(kMaximumECKeySize)),
 381     .init = SecECPublicKeyInit,
 382     .destroy = SecECPublicKeyDestroy,
 383     .blockSize = SecECPublicKeyBlockSize,
 384     .copyDictionary = SecECPublicKeyCopyAttributeDictionary,
 385     .copyExternalRepresentation = SecECPublicKeyCopyExternalRepresentation,
 386     .describe = SecECPublicKeyCopyKeyDescription,
 387     .getAlgorithmID = SecECKeyGetAlgorithmID,
 388     .copyPublic = SecECPublicKeyCopyPublicOctets,
 389     .copyWrapKey = SecECKeyCopyWrapKey,
 390     .copyOperationResult = SecECPublicKeyCopyOperationResult,
 391 };
 392
 393 /* Public Key API functions. */
 394 SecKeyRef SecKeyCreateECPublicKey(CFAllocatorRef allocator,
 395     const uint8_t *keyData, CFIndex keyDataLength,
 396     SecKeyEncoding encoding) {
 397     return SecKeyCreate(allocator, &kSecECPublicKeyDescriptor, keyData,
 398                         keyDataLength, encoding);
 399 }
 400
 401
 402
 403 /*
 404  *
 405  * Private Key
 406  *
 407  */
 408
 409 /* Private key static functions. */
 410 static void SecECPrivateKeyDestroy(SecKeyRef key) {
 411     /* Zero out the public key */
 412     ccec_full_ctx_t fullkey = key->key;
 413
 414     if (ccec_ctx_cp(fullkey))
 415         cc_clear(ccec_full_ctx_size(ccn_sizeof_n(ccec_ctx_n(fullkey))), fullkey);
 416 }
 417
 418
 419 static OSStatus SecECPrivateKeyInit(SecKeyRef key,
 420     const uint8_t *keyData, CFIndex keyDataLength, SecKeyEncoding encoding) {
 421     ccec_full_ctx_t fullkey = key->key;
 422     OSStatus err = errSecParam;
 423
 424     switch (encoding) {
 425     case kSecKeyEncodingPkcs1:
 426     {
 427         /* TODO: DER import size (and thus cp), pub.x, pub.y and k. */
 428         //err = ecc_import(keyData, keyDataLength, fullkey);
 429
 430         /* DER != PKCS#1, but we'll go along with it */
 431         const unsigned char *oid;
 432         size_t n;
 433         ccec_const_cp_t cp;
 434
 435         require_noerr_quiet(ccec_der_import_priv_keytype(keyDataLength, keyData, (ccoid_t*)&oid, &n), abort);
 436         cp = ccec_cp_for_oid(oid);
 437         if (cp == NULL) {
 438             cp = ccec_curve_for_length_lookup(n * 8 /* bytes -> bits */,
 439                 ccec_cp_192(), ccec_cp_224(), ccec_cp_256(), ccec_cp_384(), ccec_cp_521(), NULL);
 440         }
 441         require_action_quiet(cp != NULL, abort, err = errSecDecode);
 442         ccec_ctx_init(cp, fullkey);
 443
 444         require_noerr_quiet(ccec_der_import_priv(cp, keyDataLength, keyData, fullkey), abort);
 445         err = errSecSuccess;
 446         break;
 447     }
 448     case kSecKeyEncodingBytes:
 449     {
 450         ccec_const_cp_t cp = getCPForPrivateSize(keyDataLength);
 451         require_quiet(cp != NULL, abort);
 452
 453         ccec_ctx_init(cp, fullkey);
 454         size_t pubSize = ccec_export_pub_size(ccec_ctx_pub(fullkey));
 455
 456         require_quiet(pubSize < (size_t) keyDataLength, abort);
 457         require_noerr_action_quiet(ccec_import_pub(cp, pubSize, keyData, ccec_ctx_pub(fullkey)),
 458                              abort,
 459                              err = errSecDecode);
 460
 461
 462         keyData += pubSize;
 463         keyDataLength -= pubSize;
 464
 465         cc_unit *k = ccec_ctx_k(fullkey);
 466         require_noerr_action_quiet(ccn_read_uint(ccec_ctx_n(fullkey), k, keyDataLength, keyData),
 467                                    abort,
 468                                    err = errSecDecode);
 469
 470         err = errSecSuccess;
 471         break;
 472
 473     }
 474     case kSecGenerateKey:
 475     {
 476         CFDictionaryRef parameters = (CFDictionaryRef) keyData;
 477
 478         CFTypeRef ksize = CFDictionaryGetValue(parameters, kSecAttrKeySizeInBits);
 479         CFIndex keyLengthInBits = getIntValue(ksize);
 480
 481         ccec_const_cp_t cp = ccec_get_cp(keyLengthInBits);
 482
 483         if (!cp) {
 484             secwarning("Invalid or missing key size in: %@", parameters);
 485             return errSecKeySizeNotAllowed;
 486         }
 487
 488         if (!ccec_generate_key_fips(cp, ccrng_seckey, fullkey))
 489             err = errSecSuccess;
 490         break;
 491     }
 492
 493     default:
 494         break;
 495     }
 496 abort:
 497     return err;
 498 }
 499
 500 static CFTypeRef SecECPrivateKeyCopyOperationResult(SecKeyRef key, SecKeyOperationType operation, SecKeyAlgorithm algorithm,
 501                                                     CFArrayRef allAlgorithms, SecKeyOperationMode mode,
 502                                                     CFTypeRef in1, CFTypeRef in2, CFErrorRef *error) {
 503     // Default answer is 'unsupported', unless we find out that we can support it.
 504     CFTypeRef result = kCFNull;
 505
 506     ccec_full_ctx_t fullkey = key->key;
 507     switch (operation) {
 508         case kSecKeyOperationTypeSign: {
 509             if (CFEqual(algorithm, kSecKeyAlgorithmECDSASignatureDigestX962)) {
 510                 if (mode == kSecKeyOperationModePerform) {
 511                     // Perform x962 mode of signature.
 512                     size_t size = ccec_sign_max_size(ccec_ctx_cp(fullkey));
 513                     result = CFDataCreateMutableWithScratch(NULL, size);
 514                     int err = ccec_sign(fullkey, CFDataGetLength(in1), CFDataGetBytePtr(in1),
 515                                         &size, CFDataGetMutableBytePtr((CFMutableDataRef)result), ccrng_seckey);
 516                     require_action_quiet(err == 0, out, (CFReleaseNull(result),
 517                                                          SecError(errSecParam, error, CFSTR("%@: X962 signing failed (ccerr %d)"),
 518                                                                   key, err)));
 519                     CFDataSetLength((CFMutableDataRef)result, size);
 520                 } else {
 521                     // Operation is supported.
 522                     result = kCFBooleanTrue;
 523                 }
 524             }
 525             break;
 526         }
 527         case kSecKeyOperationTypeKeyExchange:
 528             if (CFEqual(algorithm, kSecKeyAlgorithmECDHKeyExchangeStandard) ||
 529                 CFEqual(algorithm, kSecKeyAlgorithmECDHKeyExchangeCofactor)) {
 530                 if (mode == kSecKeyOperationModePerform) {
 531                     int err;
 532                     ccec_const_cp_t cp = getCPForPublicSize(CFDataGetLength(in1));
 533                     require_action_quiet(cp != NULL, out,
 534                                          SecError(errSecParam, error, CFSTR("ECpriv sharedsecret: bad public key")));
 535                     ccec_pub_ctx_decl_cp(cp, pubkey);
 536                     err = ccec_import_pub(cp, CFDataGetLength(in1), CFDataGetBytePtr(in1), pubkey);
 537                     require_noerr_action_quiet(err, out, SecError(errSecParam, error,
 538                                                                   CFSTR("ECpriv sharedsecret: bad public key (err %d)"), err));
 539                     size_t size = ccec_ccn_size(cp);
 540                     result = CFDataCreateMutableWithScratch(NULL, size);
 541                     err = ccecdh_compute_shared_secret(fullkey, pubkey, &size,
 542                                                        CFDataGetMutableBytePtr((CFMutableDataRef)result), ccrng_seckey);
 543                     require_noerr_action_quiet(err, out, (CFReleaseNull(result),
 544                                                           SecError(errSecDecode, error,
 545                                                                    CFSTR("ECpriv failed to compute shared secret (err %d)"), err)));
 546                     CFDataSetLength((CFMutableDataRef)result, size);
 547                 } else {
 548                     // Operation is supported.
 549                     result = kCFBooleanTrue;
 550                 }
 551             }
 552             break;
 553         default:
 554             break;
 555     }
 556
 557 out:
 558     return result;
 559 }
 560
 561 static size_t SecECPrivateKeyBlockSize(SecKeyRef key) {
 562     ccec_full_ctx_t fullkey = key->key;
 563     /* Get key size in octets */
 564     return ccec_ctx_size(fullkey);
 565 }
 566
 567 static OSStatus SecECPrivateKeyCopyPublicOctets(SecKeyRef key, CFDataRef *serailziation)
 568 {
 569     ccec_full_ctx_t fullkey = key->key;
 570
 571         CFAllocatorRef allocator = CFGetAllocator(key);
 572     *serailziation = SecECPublicKeyExport(allocator, ccec_ctx_pub(fullkey));
 573
 574     if (NULL == *serailziation)
 575         return errSecDecode;
 576     else
 577         return errSecSuccess;
 578 }
 579
 580 static CFDataRef SecECPrivateKeyCopyExternalRepresentation(SecKeyRef key, CFErrorRef *error) {
 581     ccec_full_ctx_t fullkey = key->key;
 582     size_t prime_size = ccec_cp_prime_size(ccec_ctx_cp(fullkey));
 583     size_t key_size = ccec_export_pub_size(ccec_ctx_pub(fullkey)) + prime_size;
 584     CFMutableDataRef blob = CFDataCreateMutableWithScratch(NULL, key_size);
 585     ccec_export_pub(ccec_ctx_pub(fullkey), CFDataGetMutableBytePtr(blob));
 586     UInt8 *dest = CFDataGetMutableBytePtr(blob) + ccec_export_pub_size(ccec_ctx_pub(fullkey));
 587     const cc_unit *k = ccec_ctx_k(fullkey);
 588     ccn_write_uint_padded(ccec_ctx_n(fullkey), k, prime_size, dest);
 589     return blob;
 590 }
 591
 592 static CFDictionaryRef SecECPrivateKeyCopyAttributeDictionary(SecKeyRef key) {
 593     /* Export the full ec key pair. */
 594     CFDataRef fullKeyBlob = SecECPrivateKeyCopyExternalRepresentation(key, NULL);
 595
 596     CFDictionaryRef dict = SecKeyGeneratePrivateAttributeDictionary(key, kSecAttrKeyTypeEC, fullKeyBlob);
 597         CFReleaseSafe(fullKeyBlob);
 598         return dict;
 599 }
 600 static CFStringRef SecECPrivateKeyCopyKeyDescription(SecKeyRef key) {
 601
 602     const char* curve = getCurveName(key);
 603
 604         return CFStringCreateWithFormat(kCFAllocatorDefault,NULL,CFSTR( "<SecKeyRef curve type: %s, algorithm id: %lu, key type: %s, version: %d, block size: %zu bits, addr: %p>"), curve, (long)SecKeyGetAlgorithmId(key), key->key_class->name, key->key_class->version, (8*SecKeyGetBlockSize(key)), key);
 605
 606 }
 607
 608 static CFDataRef SecECKeyCopyUnwrapKey(SecKeyRef key, SecKeyWrapType type, CFDataRef wrappedKey, CFDictionaryRef parameters, CFDictionaryRef *outParam, CFErrorRef *error)
 609 {
 610     const struct ccec_rfc6637_curve *curve;
 611     const struct ccec_rfc6637_unwrap *unwrap;
 612     ccec_full_ctx_t fullkey = key->key;
 613     CFMutableDataRef data;
 614     int res;
 615     uint8_t sym_alg = 0;
 616     int32_t flags = 0;
 617
 618     curve = get_rfc6637_curve(key);
 619     if (curve == NULL) {
 620         SecError(errSecUnsupportedOperation, error, CFSTR("unsupported curve"));
 621         return NULL;
 622     }
 623
 624     CFTypeRef wrapAlg = CFDictionaryGetValue(parameters, _kSecKeyWrapPGPWrapAlg);
 625     if (wrapAlg == NULL) {
 626         SecError(errSecUnsupportedOperation, error, CFSTR("no wrap alg"));
 627         return NULL;
 628     } else if (CFEqual(wrapAlg, _kSecKeyWrapRFC6637WrapDigestSHA256KekAES128)) {
 629         unwrap = &ccec_rfc6637_unwrap_sha256_kek_aes128;
 630     } else if (CFEqual(wrapAlg, _kSecKeyWrapRFC6637WrapDigestSHA512KekAES256)) {
 631         unwrap = &ccec_rfc6637_unwrap_sha512_kek_aes256;
 632     } else {
 633         SecError(errSecUnsupportedOperation, error, CFSTR("unknown wrap alg"));
 634         return NULL;
 635     }
 636
 637     CFDataRef fingerprint = CFDictionaryGetValue(parameters, _kSecKeyWrapPGPFingerprint);
 638     if (!isData(fingerprint) || CFDataGetLength(fingerprint) < kSecKeyWrapPGPFingerprintMinSize) {
 639         SecError(errSecUnsupportedOperation, error, CFSTR("invalid fingerprint"));
 640         return NULL;
 641     }
 642
 643     CFNumberRef num = CFDictionaryGetValue(parameters, _kSecKeyWrapRFC6637Flags);
 644     if (isNumber(num)) {
 645         if (!CFNumberGetValue(num, kCFNumberSInt32Type, &flags)) {
 646             SecError(errSecUnsupportedOperation, error, CFSTR("invalid flags: %@"), num);
 647             return NULL;
 648         }
 649     } else if (num) {
 650         SecError(errSecUnsupportedOperation, error, CFSTR("unknown flags"));
 651         return NULL;
 652     }
 653
 654     size_t keysize = CFDataGetLength(wrappedKey);
 655     data = CFDataCreateMutableWithScratch(NULL, keysize);
 656     if (data == NULL)
 657         return NULL;
 658
 659     res = ccec_rfc6637_unwrap_key(fullkey, &keysize, CFDataGetMutableBytePtr(data),
 660                                   flags, &sym_alg, curve, unwrap,
 661                                   CFDataGetBytePtr(fingerprint),
 662                                   CFDataGetLength(wrappedKey), CFDataGetBytePtr(wrappedKey));
 663     if (res != 0) {
 664         CFReleaseNull(data);
 665         SecError(errSecUnsupportedOperation, error, CFSTR("failed to wrap key"));
 666         return NULL;
 667     }
 668     assert(keysize <= (size_t)CFDataGetLength(data));
 669     CFDataSetLength(data, keysize);
 670
 671     if (outParam) {
 672         CFMutableDictionaryRef out =  CFDictionaryCreateMutableForCFTypes(NULL);
 673         if (out) {
 674             CFNumberRef num = CFNumberCreate(NULL, kCFNumberSInt8Type, &sym_alg);
 675             if (num) {
 676                 CFDictionarySetValue(out, _kSecKeyWrapPGPSymAlg, num);
 677                 CFRelease(num);
 678             }
 679             *outParam = out;
 680         }
 681     }
 682
 683     return data;
 684 }
 685
 686 SecKeyDescriptor kSecECPrivateKeyDescriptor = {
 687     .version = kSecKeyDescriptorVersion,
 688     .name = "ECPrivateKey",
 689     .extraBytes = ccec_full_ctx_size(ccn_sizeof(kMaximumECKeySize)),
 690
 691     .init = SecECPrivateKeyInit,
 692     .destroy = SecECPrivateKeyDestroy,
 693     .blockSize = SecECPrivateKeyBlockSize,
 694     .copyDictionary = SecECPrivateKeyCopyAttributeDictionary,
 695     .describe = SecECPrivateKeyCopyKeyDescription,
 696     .getAlgorithmID = SecECKeyGetAlgorithmID,
 697     .copyPublic = SecECPrivateKeyCopyPublicOctets,
 698     .copyExternalRepresentation = SecECPrivateKeyCopyExternalRepresentation,
 699     .copyWrapKey = SecECKeyCopyWrapKey,
 700     .copyUnwrapKey = SecECKeyCopyUnwrapKey,
 701     .copyOperationResult = SecECPrivateKeyCopyOperationResult,
 702 };
 703
 704 /* Private Key API functions. */
 705 SecKeyRef SecKeyCreateECPrivateKey(CFAllocatorRef allocator,
 706     const uint8_t *keyData, CFIndex keyDataLength,
 707     SecKeyEncoding encoding) {
 708     return SecKeyCreate(allocator, &kSecECPrivateKeyDescriptor, keyData,
 709         keyDataLength, encoding);
 710 }
 711
 712
 713 OSStatus SecECKeyGeneratePair(CFDictionaryRef parameters,
 714                               SecKeyRef *publicKey, SecKeyRef *privateKey) {
 715     OSStatus status = errSecParam;
 716
 717     CFAllocatorRef allocator = NULL; /* @@@ get from parameters. */
 718     SecKeyRef pubKey = NULL;
 719
 720     SecKeyRef privKey = SecKeyCreate(allocator, &kSecECPrivateKeyDescriptor,
 721                                      (const void*) parameters, 0, kSecGenerateKey);
 722
 723     require_quiet(privKey, errOut);
 724
 725     /* Create SecKeyRef's from the pkcs1 encoded keys. */
 726     pubKey = SecKeyCreate(allocator, &kSecECPublicKeyDescriptor,
 727                           privKey->key, 0, kSecExtractPublicFromPrivate);
 728
 729     require_quiet(pubKey, errOut);
 730
 731     if (publicKey) {
 732         *publicKey = pubKey;
 733         pubKey = NULL;
 734     }
 735     if (privateKey) {
 736         *privateKey = privKey;
 737         privKey = NULL;
 738     }
 739
 740     status = errSecSuccess;
 741
 742 errOut:
 743     CFReleaseSafe(pubKey);
 744     CFReleaseSafe(privKey);
 745
 746     return status;
 747 }
 748
 749
 750 /* It's debatable whether this belongs here or in the ssl code since the
 751    curve values come from a tls related rfc4492. */
 752 SecECNamedCurve SecECKeyGetNamedCurve(SecKeyRef key) {
 753     SecECNamedCurve result = kSecECCurveNone;
 754     CFDictionaryRef attributes = NULL;
 755     require_quiet(SecKeyGetAlgorithmId(key) == kSecECDSAAlgorithmID, out);
 756     require_quiet(attributes = SecKeyCopyAttributes(key), out);
 757     CFTypeRef bitsRef = CFDictionaryGetValue(attributes, kSecAttrKeySizeInBits);
 758     CFIndex bits = 0;
 759     require_quiet(bitsRef != NULL && CFGetTypeID(bitsRef) == CFNumberGetTypeID() &&
 760                   CFNumberGetValue(bitsRef, kCFNumberCFIndexType, &bits), out);
 761     switch (bits) {
 762 #if 0
 763         case 192:
 764             result = kSecECCurveSecp192r1;
 765             break;
 766         case 224:
 767             result = kSecECCurveSecp224r1;
 768             break;
 769 #endif
 770         case 256:
 771             result = kSecECCurveSecp256r1;
 772             break;
 773         case 384:
 774             result = kSecECCurveSecp384r1;
 775             break;
 776         case 521:
 777             result = kSecECCurveSecp521r1;
 778             break;
 779     }
 780
 781 out:
 782     CFReleaseSafe(attributes);
 783     return result;
 784 }
 785
 786 CFDataRef SecECKeyCopyPublicBits(SecKeyRef key) {
 787     CFDataRef bytes = NULL;
 788     SecKeyCopyPublicBytes(key, &bytes);
 789     return bytes;
 790 }
 791
 792 /* Vile accessors that get us the pub or priv key to use temporarily */
 793
 794 bool SecECDoWithFullKey(SecKeyRef key, CFErrorRef* error, void (^action)(ccec_full_ctx_t private)) {
 795     if (key->key_class == &kSecECPrivateKeyDescriptor) {
 796         action(key->key);
 797     } else {
 798         return SecError(errSecParam, error, CFSTR("Not an EC Full Key object, sorry can't do."));
 799     }
 800
 801     return true;
 802 }
 803
 804 bool SecECDoWithPubKey(SecKeyRef key, CFErrorRef* error, void (^action)(ccec_pub_ctx_t public)) {
 805     if (key->key_class == &kSecECPublicKeyDescriptor) {
 806         action(key->key);
 807     } else {
 808         return SecError(errSecParam, error, CFSTR("Not an EC Public Key object, sorry can't do."));
 809     }
 810
 811     return true;
 812 }
 813