]> git.saurik.com Git - apple/security.git/blob - sec/Security/p12pbegen.c
ee86c783954d6524a95473ec69d6276e6b37d20b
[apple/security.git] / sec / Security / p12pbegen.c
1 /*
2 * Copyright (c) 2007-2008,2010 Apple Inc. All Rights Reserved.
3 *
4 * @APPLE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. Please obtain a copy of the License at
10 * http://www.opensource.apple.com/apsl/ and read it before using this
11 * file.
12 *
13 * The Original Code and all software distributed under the License are
14 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
15 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
16 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
17 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
18 * Please see the License for the specific language governing rights and
19 * limitations under the License.
20 *
21 * @APPLE_LICENSE_HEADER_END@
22 */
23
24 #include <stdlib.h>
25 #include <string.h> // memcpy
26
27 #include <CommonCrypto/CommonDigest.h>
28
29 #include <corecrypto/ccn.h>
30
31 #include "p12pbegen.h"
32
33 static uint8_t *concatenate_to_blocksize(const uint8_t *data, size_t data_length,
34 size_t blocksize, size_t *blocklength)
35 {
36 size_t block_length = blocksize * ((data_length + blocksize - 1) / blocksize);
37 uint8_t *block_ptr, *block;
38 block_ptr = block = malloc(block_length);
39 if (!block_ptr)
40 return NULL;
41 while (block_ptr < block + block_length) {
42 size_t bytes_to_move = block + block_length - block_ptr;
43 memcpy(block_ptr, data, bytes_to_move > data_length ? data_length : bytes_to_move);
44 block_ptr += data_length;
45 }
46 *blocklength = block_length;
47 return block;
48 }
49
50 int p12_pbe_gen(CFStringRef passphrase, uint8_t *salt_ptr, size_t salt_length,
51 unsigned iter_count, P12_PBE_ID pbe_id, uint8_t *data, size_t length)
52 {
53 unsigned int hash_blocksize = CC_SHA1_BLOCK_BYTES;
54 unsigned int hash_outputsize = CC_SHA1_DIGEST_LENGTH;
55
56 if (!passphrase)
57 return -1;
58
59 /* generate diversifier block */
60 unsigned char diversifier[hash_blocksize];
61 memset(diversifier, pbe_id, sizeof(diversifier));
62
63 /* convert passphrase to BE UTF16 and append double null */
64 CFDataRef passphrase_be_unicode = CFStringCreateExternalRepresentation(kCFAllocatorDefault, passphrase, kCFStringEncodingUTF16BE, '\0');
65 if (!passphrase_be_unicode)
66 return -1;
67 uint8_t null_termination[2] = { 0, 0 };
68 CFMutableDataRef passphrase_be_unicode_null_term = CFDataCreateMutableCopy(NULL, 0, passphrase_be_unicode);
69 CFRelease(passphrase_be_unicode);
70 if (!passphrase_be_unicode_null_term)
71 return -1;
72 CFDataAppendBytes(passphrase_be_unicode_null_term, null_termination, sizeof(null_termination));
73
74 /* generate passphrase block */
75 uint8_t *passphrase_data = NULL;
76 size_t passphrase_data_len = 0;
77 size_t passphrase_length = CFDataGetLength(passphrase_be_unicode_null_term);
78 const unsigned char *passphrase_ptr = CFDataGetBytePtr(passphrase_be_unicode_null_term);
79 passphrase_data = concatenate_to_blocksize(passphrase_ptr, passphrase_length, hash_blocksize, &passphrase_data_len);
80 CFRelease(passphrase_be_unicode_null_term);
81 if (!passphrase_data)
82 return -1;
83
84 /* generate salt block */
85 uint8_t *salt_data = NULL;
86 size_t salt_data_len = 0;
87 if (salt_length)
88 salt_data = concatenate_to_blocksize(salt_ptr, salt_length, hash_blocksize, &salt_data_len);
89 if (!salt_data)
90 return -1;
91
92 /* generate S||P block */
93 size_t I_length = salt_data_len + passphrase_data_len;
94 uint8_t *I_data = malloc(I_length);
95 if (!I_data)
96 return -1;
97
98 memcpy(I_data + 0, salt_data, salt_data_len);
99 memcpy(I_data + salt_data_len, passphrase_data, passphrase_data_len);
100 free(salt_data);
101 free(passphrase_data);
102
103 /* round up output buffer to multiple of hash block size and allocate */
104 size_t hash_output_blocks = (length + hash_outputsize - 1) / hash_outputsize;
105 size_t temp_buf_size = hash_output_blocks * hash_outputsize;
106 uint8_t *temp_buf = malloc(temp_buf_size);
107 uint8_t *cursor = temp_buf;
108 if (!temp_buf)
109 return -1;
110
111 /* 64 bits cast(s): worst case here is we dont hash all the data and incorectly derive the wrong key,
112 when the passphrase + salt are over 2^32 bytes long */
113 /* loop over output in hash_output_size increments */
114 while (cursor < temp_buf + temp_buf_size) {
115 CC_SHA1_CTX ctx;
116 CC_SHA1_Init(&ctx);
117 CC_SHA1_Update(&ctx, diversifier, (CC_LONG)sizeof(diversifier));
118 assert(I_length<=UINT32_MAX); /* debug check. Correct as long as CC_LONG is uint32_t */
119 CC_SHA1_Update(&ctx, I_data, (CC_LONG)I_length);
120 CC_SHA1_Final(cursor, &ctx);
121
122 /* run block through SHA-1 for iteration count */
123 unsigned int i;
124 for (i = 1; /*first round done above*/ i < iter_count; i++)
125 CC_SHA1(cursor, hash_outputsize, cursor);
126
127 /*
128 * b) Concatenate copies of A[i] to create a string B of
129 * length v bits (the final copy of A[i]i may be truncated
130 * to create B).
131 */
132 size_t A_i_len = 0;
133 uint8_t *A_i = concatenate_to_blocksize(cursor,
134 hash_outputsize, hash_blocksize, &A_i_len);
135 if (!A_i)
136 return -1;
137
138 /*
139 * c) Treating I as a concatenation I[0], I[1], ...,
140 * I[k-1] of v-bit blocks, where k = ceil(s/v) + ceil(p/v),
141 * modify I by setting I[j]=(I[j]+B+1) mod (2 ** v)
142 * for each j.
143 */
144
145 /* tmp1 = B+1 */
146
147 const cc_size tmp_n = ccn_nof_size(A_i_len + 1) > ccn_nof_size(hash_blocksize) ? ccn_nof_size(A_i_len + 1) : ccn_nof_size(hash_blocksize);
148 cc_unit tmp1[tmp_n];
149 ccn_read_uint(tmp_n, tmp1, A_i_len, A_i);
150 ccn_add1(tmp_n, tmp1, tmp1, 1);
151
152 free(A_i);
153
154 cc_unit tmp2[tmp_n];
155 unsigned int j;
156 for (j = 0; j < I_length; j+=hash_blocksize) {
157 /* tempg = I[j]; */
158 ccn_read_uint(tmp_n, tmp2, hash_blocksize, I_data + j);
159 /* tempg += tmp1 */
160 ccn_add(tmp_n, tmp2, tmp2, tmp1);
161
162 /* I[j] = tempg mod 2**v
163 Just clear all the high bits above 2**v
164 In practice at most it rolled over by 1 bit, since all we did was add so
165 we should only clear one bit at most.
166 */
167 size_t bitSize;
168 const size_t hash_blocksize_bits = hash_blocksize * 8;
169 while ((bitSize = ccn_bitlen(tmp_n, tmp2)) > hash_blocksize_bits)
170 {
171 ccn_set_bit(tmp2, bitSize - 1, 0);
172 }
173
174 ccn_write_uint_padded(tmp_n, tmp2, hash_blocksize, I_data + j);
175 }
176
177 cursor += hash_outputsize;
178 }
179
180 /*
181 * 7. Concatenate A[1], A[2], ..., A[c] together to form a
182 * pseudo-random bit string, A.
183 *
184 * 8. Use the first n bits of A as the output of this entire
185 * process.
186 */
187 memmove(data, temp_buf, length);
188 free(temp_buf);
189 free(I_data);
190 return 0;
191 }
192
193 #if 0
194 bool test()
195 {
196 //smeg => 0073006D006500670000
197 CFStringRef password = CFSTR("smeg");
198 //Salt (length 8):
199 unsigned char salt_bytes[] = { 0x0A, 0x58, 0xCF, 0x64, 0x53, 0x0D, 0x82, 0x3F };
200 CFDataRef salt = CFDataCreate(NULL, salt_bytes, sizeof(salt_bytes));
201 // ID 1, ITER 1
202 // Output KEY (length 24)
203 unsigned char correct_result[] = { 0x8A, 0xAA, 0xE6, 0x29, 0x7B, 0x6C, 0xB0, 0x46, 0x42, 0xAB, 0x5B, 0x07, 0x78, 0x51, 0x28, 0x4E, 0xB7, 0x12, 0x8F, 0x1A, 0x2A, 0x7F, 0xBC, 0xA3 };
204 unsigned char result[24];
205 p12PbeGen(password, salt, 1, PBE_ID_Key, result, sizeof(result));
206 if (memcmp(correct_result, result, sizeof(correct_result))) {
207 printf("test failure\n");
208 return false;
209 }
210 return true;
211 }
212
213 bool test2()
214 {
215 CFStringRef password = CFSTR("queeg");
216 unsigned char salt_bytes[] = { 0x05,0xDE,0xC9,0x59,0xAC,0xFF,0x72,0xF7 };
217 CFDataRef salt = CFDataCreate(NULL, salt_bytes, sizeof(salt_bytes));
218 unsigned char correct_result[] = { 0xED,0x20,0x34,0xE3,0x63,0x28,0x83,0x0F,0xF0,0x9D,0xF1,0xE1,0xA0,0x7D,0xD3,0x57,0x18,0x5D,0xAC,0x0D,0x4F,0x9E,0xB3,0xD4 };
219 unsigned char result[24];
220 p12PbeGen(password, salt, 1000, PBE_ID_Key, result, sizeof(result));
221 if (memcmp(correct_result, result, sizeof(correct_result))) {
222 printf("test failure\n");
223 return false;
224 }
225 return true;
226 }
227
228 int main(int argc, char *argv[])
229 {
230 test();
231 test2();
232 }
233
234 #endif
235
236 /* http://www.drh-consultancy.demon.co.uk/test.txt
237
238 Test Vectors set 1.
239
240 Password: smeg
241
242 KEYGEN DEBUG
243 ID 1, ITER 1
244 Password (length 10):
245 0073006D006500670000
246 Salt (length 8):
247 0A58CF64530D823F
248 ID 1, ITER 1
249 Output KEY (length 24)
250 8AAAE6297B6CB04642AB5B077851284EB7128F1A2A7FBCA3
251
252 KEYGEN DEBUG
253 ID 2, ITER 1
254 Password (length 10):
255 0073006D006500670000
256 Salt (length 8):
257 0A58CF64530D823F
258 ID 2, ITER 1
259 Output KEY (length 8)
260 79993DFE048D3B76
261
262 KEYGEN DEBUG
263 ID 1, ITER 1
264 Password (length 10):
265 0073006D006500670000
266 Salt (length 8):
267 642B99AB44FB4B1F
268 ID 1, ITER 1
269 Output KEY (length 24)
270 F3A95FEC48D7711E985CFE67908C5AB79FA3D7C5CAA5D966
271
272 KEYGEN DEBUG
273 ID 2, ITER 1
274 Password (length 10):
275 0073006D006500670000
276 Salt (length 8):
277 642B99AB44FB4B1F
278 ID 2, ITER 1
279 Output KEY (length 8)
280 C0A38D64A79BEA1D
281
282 KEYGEN DEBUG
283 ID 3, ITER 1
284 Password (length 10):
285 0073006D006500670000
286 Salt (length 8):
287 3D83C0E4546AC140
288 ID 3, ITER 1
289 Output KEY (length 20)
290 8D967D88F6CAA9D714800AB3D48051D63F73A312
291
292 Test Vectors set 2.
293 Password: queeg
294
295 KEYGEN DEBUG
296 ID 1, ITER 1000
297 Password (length 12):
298 007100750065006500670000
299 Salt (length 8):
300 05DEC959ACFF72F7
301 ID 1, ITER 1000
302 Output KEY (length 24)
303 ED2034E36328830FF09DF1E1A07DD357185DAC0D4F9EB3D4
304
305 KEYGEN DEBUG
306 ID 2, ITER 1000
307 Password (length 12):
308 007100750065006500670000
309 Salt (length 8):
310 05DEC959ACFF72F7
311 ID 2, ITER 1000
312 Output KEY (length 8)
313 11DEDAD7758D4860
314
315 KEYGEN DEBUG
316 ID 1, ITER 1000
317 Password (length 12):
318 007100750065006500670000
319 Salt (length 8):
320 1682C0FC5B3F7EC5
321 ID 1, ITER 1000
322 Output KEY (length 24)
323 483DD6E919D7DE2E8E648BA8F862F3FBFBDC2BCB2C02957F
324
325 KEYGEN DEBUG
326 ID 2, ITER 1000
327 Password (length 12):
328 007100750065006500670000
329 Salt (length 8):
330 1682C0FC5B3F7EC5
331 ID 2, ITER 1000
332 Output KEY (length 8)
333 9D461D1B00355C50
334
335 KEYGEN DEBUG
336 ID 3, ITER 1000
337 Password (length 12):
338 007100750065006500670000
339 Salt (length 8):
340 263216FCC2FAB31C
341 ID 3, ITER 1000
342 Output KEY (length 20)
343 5EC4C7A80DF652294C3925B6489A7AB857C83476
344 */
345