--- /dev/null
+/*
+ * Copyright (c) 2010-2014 Apple Inc. All Rights Reserved.
+ *
+ * @APPLE_LICENSE_HEADER_START@
+ *
+ * This file contains Original Code and/or Modifications of Original Code
+ * as defined in and that are subject to the Apple Public Source License
+ * Version 2.0 (the 'License'). You may not use this file except in
+ * compliance with the License. Please obtain a copy of the License at
+ * http://www.opensource.apple.com/apsl/ and read it before using this
+ * file.
+ *
+ * The Original Code and all software distributed under the License are
+ * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
+ * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
+ * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
+ * Please see the License for the specific language governing rights and
+ * limitations under the License.
+ *
+ * @APPLE_LICENSE_HEADER_END@
+ */
+
+
+#include "EncryptTransform.h"
+#include "SecEncryptTransform.h"
+#include "EncryptTransformUtilities.h"
+#include "Utilities.h"
+#include "SecDigestTransform.h"
+#include "Digest.h"
+#include <Security/SecRandom.h>
+#include "SecMaskGenerationFunctionTransform.h"
+
+static CFStringRef kEncryptTransformType = CFSTR("Encrypt Transform");
+static CFStringRef kDecryptTransformType = CFSTR("Decrypt Transform");
+//static const char *kEncryptTransformType_cstr = "Encrypt Transform";
+//static const char *kDecryptTransformType_cstr = "Decrypt Transform";
+static uint8 iv[16] = { 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 };
+static const CSSM_DATA gKeySalt = {16, iv}; // default Salt for key
+
+dispatch_once_t EncryptDecryptBase::serializerSetUp;
+dispatch_queue_t EncryptDecryptBase::serializerTransformStartingExecution;
+
+/* --------------------------------------------------------------------------
+ Implementation of the EncryptDecryptBase class
+ -------------------------------------------------------------------------- */
+
+/* --------------------------------------------------------------------------
+ method: EncryptDecryptBase (Constructor)
+ description: Initialize a new instance of a EncryptDecryptBase class
+ -------------------------------------------------------------------------- */
+EncryptDecryptBase::EncryptDecryptBase(CFStringRef type) :
+Transform(type),
+m_cssm_padding(CSSM_PADDING_NONE),
+m_mode(CSSM_ALGMODE_CBCPadIV8),
+m_cssm_key(NULL),
+m_handle((CSSM_CC_HANDLE)0),
+m_forEncryption(FALSE),
+m_processedData(NULL),
+m_accumulator(NULL)
+{
+ m_forEncryption = CFEqual(type, kEncryptTransformType);
+ inputAH = transforms_assume(this->getAH(kSecTransformInputAttributeName, false, false));
+}
+
+/* --------------------------------------------------------------------------
+ method: ~EncryptDecryptBase (pre-Destructor)
+ description: Clean m_handle, let Transform::Finalize() do the rest
+ -------------------------------------------------------------------------- */
+void EncryptDecryptBase::Finalize()
+{
+ if (m_handle != (CSSM_CC_HANDLE)0)
+ {
+ CSSM_CC_HANDLE tmp_handle = m_handle;
+ // Leaving this to the destructor causes occasional crashes.
+ // This may be a CDSA thread afinity bug, or it might be more
+ // local.
+ dispatch_async(mDispatchQueue, ^{
+ CSSM_DeleteContext(tmp_handle);
+ });
+ m_handle = ((CSSM_CC_HANDLE)0);
+ }
+
+ Transform::Finalize();
+}
+
+
+/* --------------------------------------------------------------------------
+ method: ~EncryptDecryptBase (Destructor)
+ description: Clean up the memory of an EncryptDecryptBase object
+ -------------------------------------------------------------------------- */
+EncryptDecryptBase::~EncryptDecryptBase()
+{
+ if (NULL != m_processedData)
+ {
+ CFRelease(m_processedData);
+ m_processedData = NULL;
+ }
+ if (NULL != m_accumulator)
+ {
+ CFRelease(m_accumulator);
+ m_accumulator = NULL;
+ }
+}
+
+/* --------------------------------------------------------------------------
+ method: InitializeObject(SecKeyRef key, CFErrorRef *error)
+ description: Initialize an instance of the base encrypt/decrypt transform
+ -------------------------------------------------------------------------- */
+bool EncryptDecryptBase::InitializeObject(SecKeyRef key, CFErrorRef *error)
+{
+ SetAttributeNoCallback(kSecEncryptKey, key);
+ if (error)
+ {
+ *error = NULL;
+ }
+
+ return true;
+}
+
+/* --------------------------------------------------------------------------
+ method: SerializedTransformStartingExecution()
+ description: Get this transform ready to run, should only be called on
+ the serializerTransformStartingExecution queue
+ -------------------------------------------------------------------------- */
+CFErrorRef EncryptDecryptBase::SerializedTransformStartingExecution()
+{
+ CFErrorRef result = NULL; // Assume all is well
+ SecKeyRef key = (SecKeyRef) GetAttribute(kSecEncryptKey);
+ if (NULL == key)
+ {
+ return CreateSecTransformErrorRef(kSecTransformErrorAttributeNotFound, "The attribute %@ was not found.", kSecEncryptKey);
+ }
+
+ OSStatus err = errSecSuccess;
+ err = SecKeyGetCSSMKey(key, (const CSSM_KEY **)&m_cssm_key);
+ if (errSecSuccess != err)
+ {
+ CFStringRef result = SecCopyErrorMessageString(err, NULL);
+ CFErrorRef retValue = CreateSecTransformErrorRef(err, "CDSA error (%@).", result);
+ CFRelease(result);
+ return retValue;
+ }
+
+ CSSM_CSP_HANDLE csp;
+ err = SecKeyGetCSPHandle(key, &csp);
+ if (errSecSuccess != err)
+ {
+ CFStringRef result = SecCopyErrorMessageString(err, NULL);
+ CFErrorRef retValue = CreateSecTransformErrorRef(err, "CDSA error (%@).", result);
+ CFRelease(result);
+ return retValue;
+ }
+
+ CSSM_ALGORITHMS keyAlg = m_cssm_key->KeyHeader.AlgorithmId;
+
+ m_cssm_padding = CSSM_PADDING_NONE;
+ CFStringRef paddingStr = (CFStringRef) GetAttribute(kSecPaddingKey);
+ CFStringRef modeStr = (CFStringRef) GetAttribute (kSecEncryptionMode);
+ CFDataRef ivData = (CFDataRef) GetAttribute(kSecIVKey);
+
+ Boolean hasPadding = (paddingStr != NULL);
+ Boolean hasMode = (modeStr != NULL);
+ Boolean hasIVData = (ivData != NULL);
+ Boolean isSymmetrical = (m_cssm_key->KeyHeader.KeyClass == CSSM_KEYCLASS_SESSION_KEY);
+
+
+ if (!hasPadding)
+ {
+ if (CSSM_ALGID_RSA == keyAlg || CSSM_ALGID_ECDSA == keyAlg)
+ {
+ m_cssm_padding = CSSM_PADDING_PKCS1;
+ }
+ else
+ {
+ m_cssm_padding = CSSM_PADDING_PKCS7;
+ }
+ m_oaep_padding = false;
+ }
+ else
+ {
+ if (CFStringCompare(kSecPaddingOAEPKey, paddingStr, kCFCompareAnchored)) {
+ m_oaep_padding = false;
+ m_cssm_padding = ConvertPaddingStringToEnum(paddingStr);
+ } else {
+ m_cssm_padding = CSSM_PADDING_NONE;
+ m_oaep_padding = true;
+ m_accumulator = CFDataCreateMutable(NULL, 0);
+ if (!m_accumulator) {
+ return GetNoMemoryErrorAndRetain();
+ }
+ }
+ }
+
+ if (!hasMode)
+ {
+ m_mode = (CSSM_PADDING_NONE == m_cssm_padding) ? CSSM_ALGMODE_CBC_IV8 : CSSM_ALGMODE_CBCPadIV8;
+ }
+ else
+ {
+ m_mode = ConvertEncryptModeStringToEnum(modeStr, (CSSM_PADDING_NONE != m_cssm_padding));
+ }
+
+
+ CSSM_RETURN crtn = CSSM_OK;
+ CSSM_ACCESS_CREDENTIALS creds;
+ CSSM_ACCESS_CREDENTIALS* credPtr = NULL;
+ memset(&creds, 0, sizeof(CSSM_ACCESS_CREDENTIALS));
+
+ err = SecKeyGetCredentials(key,
+ (m_forEncryption) ? CSSM_ACL_AUTHORIZATION_ENCRYPT : CSSM_ACL_AUTHORIZATION_DECRYPT,
+ kSecCredentialTypeDefault,
+ (const CSSM_ACCESS_CREDENTIALS **)&credPtr);
+ if (errSecSuccess != err)
+ {
+ memset(&creds, 0, sizeof(CSSM_ACCESS_CREDENTIALS));
+ credPtr = &creds;
+ }
+
+ if (isSymmetrical)
+ {
+ CSSM_DATA initVector;
+ if (hasIVData)
+ {
+ initVector.Length = CFDataGetLength(ivData);
+ initVector.Data = const_cast<uint8_t*>(CFDataGetBytePtr(ivData));
+ }
+ else
+ {
+ initVector.Length = gKeySalt.Length;
+ initVector.Data = (uint8 *)malloc(initVector.Length);
+ initVector.Data = gKeySalt.Data;
+ }
+
+ crtn = CSSM_CSP_CreateSymmetricContext(csp, keyAlg, m_mode, credPtr, m_cssm_key,
+ &initVector, m_cssm_padding, NULL, &m_handle);
+
+ // Need better error here
+ if (crtn != CSSM_OK)
+ {
+ CFStringRef result = SecCopyErrorMessageString(crtn, NULL);
+ CFErrorRef retValue = CreateSecTransformErrorRef(kSecTransformErrorNotInitializedCorrectly, "CDSA error (%@).", result);
+ CFRelease(result);
+ return retValue;
+ }
+ }
+ else
+ {
+ crtn = CSSM_CSP_CreateAsymmetricContext(csp, keyAlg, credPtr, m_cssm_key, m_cssm_padding, &m_handle);
+
+ // Need better error here
+ if (crtn != CSSM_OK)
+ {
+ CFStringRef result = SecCopyErrorMessageString(crtn, NULL);
+ CFErrorRef retValue = CreateSecTransformErrorRef(kSecTransformErrorNotInitializedCorrectly, "CDSA error (%@).", result);
+ CFRelease(result);
+ return retValue;
+ }
+ }
+
+ // Encryption
+ crtn = (m_forEncryption) ? CSSM_EncryptDataInit(m_handle) : CSSM_DecryptDataInit(m_handle);
+ // Need better error here
+ if (crtn != CSSM_OK)
+ {
+ CFStringRef result = SecCopyErrorMessageString(crtn, NULL);
+ CFErrorRef retValue = CreateSecTransformErrorRef(kSecTransformErrorNotInitializedCorrectly, "CDSA encrypt/decrypt init error (%@).", result);
+ CFRelease(result);
+ return retValue;
+ }
+
+
+ return result;
+}
+
+/* --------------------------------------------------------------------------
+ method: TransformStartingExecution()
+ description: Get this transform ready to run.
+ NOTE: the encrypt/decrypt setup is not safe to call for a single
+ key from multiple threads at once, TransformStartingExecution is
+ responsable making sure this doesn't happen,
+ SerializedTransformStartingExecution() does the real set up work.
+ -------------------------------------------------------------------------- */
+CFErrorRef EncryptDecryptBase::TransformStartingExecution()
+{
+
+ dispatch_once(&serializerSetUp, ^{
+ serializerTransformStartingExecution = dispatch_queue_create("com.apple.security.EncryptDecrypt.key-setup", NULL);
+ });
+
+ __block CFErrorRef result = NULL; // Assume all is well
+
+ dispatch_sync(serializerTransformStartingExecution, ^{
+ result = SerializedTransformStartingExecution();
+ });
+ return result;
+}
+
+/* --------------------------------------------------------------------------
+ method: TransformCanExecute
+ description: Do we have a key?
+ -------------------------------------------------------------------------- */
+Boolean EncryptDecryptBase::TransformCanExecute()
+{
+ // make sure we have a key -- there may be some circumstance when one isn't available
+ // and besides, it helps test this logic
+ SecKeyRef key = (SecKeyRef) GetAttribute(kSecEncryptKey);
+ return key != NULL;
+}
+
+void EncryptDecryptBase::SendCSSMError(CSSM_RETURN retCode)
+{
+ // make a CFErrorRef for the error message
+ CFStringRef errorString = SecCopyErrorMessageString(retCode, NULL);
+ CFErrorRef errorRef = CreateGenericErrorRef(kCFErrorDomainOSStatus, retCode, "%@", errorString);
+ CFRelease(errorString);
+
+ SendAttribute(kSecTransformOutputAttributeName, errorRef);
+ CFRelease(errorRef);
+}
+
+#warning "This declaration should be in some header"
+void xor_bytes(UInt8 *dst, const UInt8 *src1, const UInt8 *src2, CFIndex length);
+void xor_bytes(UInt8 *dst, const UInt8 *src1, const UInt8 *src2, CFIndex length)
+{
+ // NOTE: this can be made faster, but see if we already have a faster version somewhere first.
+
+ // _mm_xor_ps would be nice here
+ // failing that, getting to an aligned boundry and switching to uint64_t
+ // would be good.
+
+ while (length--) {
+ *dst++ = *src1++ ^ *src2++;
+ }
+}
+
+extern "C" {
+ extern CFDataRef oaep_unpadding_via_c(CFDataRef encodedMessage);
+}
+
+CFDataRef EncryptDecryptBase::remove_oaep_padding(CFDataRef encodedMessage)
+{
+#if 1
+ return oaep_unpadding_via_c(encodedMessage);
+#else
+ CFStringRef hashAlgo = NULL;
+ CFDataRef message = NULL, maskedSeed = NULL, maskedDB = NULL, seedMask = NULL, seed = NULL, dbMask = NULL;
+ CFDataRef pHash = NULL, pHashPrime = NULL;
+ CFDataRef EncodingParameters = NULL;
+ CFErrorRef error = NULL;
+ UInt8 *raw_seed = NULL, *raw_DB = NULL, *addr01 = NULL;
+ SecTransformRef mgf_maskedDB = NULL, mgf_dbMask = NULL, hash = NULL;
+ int hLen = -1;
+ // RSA's OAEP documentation assumes the crypto layer will remove the leading (partial) byte,
+ // but CDSA leaves that responsability to us (we did ask it for "no padding" after all).
+ // (use extraPaddingLength = 0 when using a layer that does strip that byte)
+ const int extraPaddingLength = 1;
+
+ // The numbered steps below correspond to RSA Laboratories' RSAES-OAEP Encryption Scheme
+ // document's numbered steps.
+
+ // NOTE: we omit step 1: "If the length of P is greater than the input limitation for the hash
+ // function (2^61 − 1 octets for SHA-1) then output ‘‘decoding error’’ and stop."; we don't have
+ // ready access to the input limits of the hash functions, and in the real world we won't be
+ // seeing messages that long anyway.
+
+ // (2) If emLen < 2hLen + 1, output ‘‘decoding error’’ and stop.
+ hashAlgo = (CFStringRef)this->GetAttribute(kSecOAEPMGF1DigestAlgorithmAttributeName);
+ if (hashAlgo == NULL) {
+ hashAlgo = kSecDigestSHA1;
+ }
+ hLen = Digest::LengthForType(hashAlgo);
+ if (CFDataGetLength(encodedMessage) < 2*hLen + 1) {
+ goto out;
+ }
+
+ // (3) Let maskedSeed be the first hLen octets of EM and let maskedDB be the remaining emLen−hLen
+ // octets.
+ maskedSeed = CFDataCreateWithBytesNoCopy(NULL, CFDataGetBytePtr(encodedMessage) +extraPaddingLength, hLen, kCFAllocatorNull);
+ maskedDB = CFDataCreateWithBytesNoCopy(NULL, CFDataGetBytePtr(encodedMessage) + hLen +extraPaddingLength, CFDataGetLength(encodedMessage) - hLen -extraPaddingLength, kCFAllocatorNull);
+
+ // (4) Let seedMask = MGF(maskedDB, hLen).
+ mgf_maskedDB = SecCreateMaskGenerationFunctionTransform(hashAlgo, hLen, &error);
+ if (!mgf_maskedDB) {
+ goto out;
+ }
+ if (!SecTransformSetAttribute(mgf_maskedDB, kSecTransformInputAttributeName, maskedDB, &error)) {
+ goto out;
+ }
+ seedMask = (CFDataRef)SecTransformExecute(mgf_maskedDB, &error);
+ if (!seedMask) {
+ goto out;
+ }
+ (void)transforms_assume(hLen == CFDataGetLength(seedMask));
+
+ // (5) Let seed = maskedSeed ⊕ seedMask.
+ raw_seed = (UInt8*)malloc(hLen);
+ xor_bytes(raw_seed, CFDataGetBytePtr(maskedSeed), CFDataGetBytePtr(seedMask), hLen);
+ seed = CFDataCreateWithBytesNoCopy(NULL, raw_seed, hLen, kCFAllocatorNull);
+ if (!seed) {
+ free(raw_seed);
+ error = GetNoMemoryErrorAndRetain();
+ goto out;
+ }
+ // (6) Let dbMask = MGF (seed, emLen − hLen).
+ mgf_dbMask = SecCreateMaskGenerationFunctionTransform(hashAlgo, CFDataGetLength(encodedMessage) - hLen, &error);
+ if (!mgf_dbMask) {
+ goto out;
+ }
+ if (!SecTransformSetAttribute(mgf_dbMask, kSecTransformInputAttributeName, seed, &error)) {
+ goto out;
+ }
+ dbMask = (CFDataRef)SecTransformExecute(mgf_dbMask, &error);
+ if (!dbMask) {
+ goto out;
+ }
+
+ // (7) Let DB = maskedDB ⊕ dbMask.
+ raw_DB = (UInt8*)malloc(CFDataGetLength(dbMask));
+ xor_bytes(raw_DB, CFDataGetBytePtr(maskedDB), CFDataGetBytePtr(dbMask), CFDataGetLength(dbMask));
+
+ // (8) Let pHash = Hash(P), an octet string of length hLen.
+ hash = SecDigestTransformCreate(hashAlgo, 0, &error);
+ if (!hash) {
+ goto out;
+ }
+ EncodingParameters = (CFDataRef)this->GetAttribute(kSecOAEPEncodingParametersAttributeName);
+ if (EncodingParameters) {
+ CFRetain(EncodingParameters);
+ } else {
+ EncodingParameters = CFDataCreate(NULL, (UInt8*)"", 0);
+ if (!EncodingParameters) {
+ goto out;
+ }
+ }
+ if (!SecTransformSetAttribute(hash, kSecTransformInputAttributeName, EncodingParameters, &error)) {
+ goto out;
+ }
+
+ pHash = (CFDataRef)transforms_assume(SecTransformExecute(hash, &error));
+ if (!pHash) {
+ goto out;
+ }
+ (void)transforms_assume(hLen == CFDataGetLength(pHash));
+
+
+ // (9) Separate DB into an octet string pHash’ consisting of the first hLen octets of DB, a
+ // (possibly empty) octet string PS consisting of consecutive zero octets following pHash’,
+ // and a message M as If there is no 01 octet to separate PS from M , output ‘‘decoding error’’ and stop.
+ pHashPrime = CFDataCreateWithBytesNoCopy(NULL, raw_DB, hLen, kCFAllocatorNull);
+ if (CFEqual(pHash, pHashPrime)) {
+ addr01 = (UInt8*)memchr(raw_DB + hLen, 0x01, CFDataGetLength(dbMask) - hLen);
+ if (!addr01) {
+ goto out;
+ }
+ message = CFDataCreate(NULL, addr01 + 1, (CFDataGetLength(dbMask) - ((addr01 - raw_DB) + 1)) -extraPaddingLength);
+ } else {
+ // (10) If pHash’ does not equal pHash, output ‘‘decoding error’’ and stop.
+ goto out;
+ }
+
+out:
+ if (!message) {
+ if (!error) {
+ error = CreateSecTransformErrorRef(kSecTransformErrorInvalidInput, "decoding error");
+ }
+ SetAttributeNoCallback(kSecTransformOutputAttributeName, error);
+ }
+
+ // Release eveything except:
+ // hashAlgo (obtained via get)
+ // message (return value)
+ CFSafeRelease(maskedSeed);
+ CFSafeRelease(maskedDB);
+ CFSafeRelease(seedMask);
+ CFSafeRelease(seed);
+ CFSafeRelease(dbMask);
+ CFSafeRelease(pHash);
+ CFSafeRelease(pHashPrime);
+ CFSafeRelease(mgf_dbMask);
+ CFSafeRelease(mgf_maskedDB);
+ CFSafeRelease(hash);
+ CFSafeRelease(EncodingParameters);
+ // raw_seed is free'd via CFData, addr01 was never allocated, so raw_DB is our lot
+ free(raw_DB);
+
+ // (11) Output M.
+ return message;
+#endif
+}
+
+extern "C" {
+ extern CFDataRef oaep_padding_via_c(int desired_message_length, CFDataRef dataValue);
+}
+
+CFDataRef EncryptDecryptBase::apply_oaep_padding(CFDataRef dataValue)
+{
+#if 1
+ // MGF1 w/ SHA1 assumed here
+
+ CFErrorRef error = NULL;
+ int hLen = Digest::LengthForType(kSecDigestSHA1);
+ CFNumberRef desired_message_length_cf = (CFNumberRef)this->GetAttribute(kSecOAEPMessageLengthAttributeName);
+ int desired_message_length = 0;
+ CSSM_QUERY_SIZE_DATA RSA_size;
+ CFDataRef EM = NULL;
+
+ if (desired_message_length_cf) {
+ CFNumberGetValue(desired_message_length_cf, kCFNumberIntType, &desired_message_length);
+ } else {
+ // take RSA (or whatever crypto) block size onto account too
+ RSA_size.SizeInputBlock = (uint32)(CFDataGetLength(dataValue) + 2*hLen +1);
+ RSA_size.SizeOutputBlock = 0;
+ OSStatus status = CSSM_QuerySize(m_handle, CSSM_TRUE, 1, &RSA_size);
+ if (status != errSecSuccess) {
+ CFStringRef errorString = SecCopyErrorMessageString(status, NULL);
+ error = CreateSecTransformErrorRef(kSecTransformErrorInvalidOperation, "CDSA error (%@).", errorString);
+ CFRelease(errorString);
+ SetAttributeNoCallback(kSecTransformOutputAttributeName, error);
+ (void)transforms_assume_zero(EM);
+ return EM;
+ }
+ (void)transforms_assume(RSA_size.SizeInputBlock <= RSA_size.SizeOutputBlock);
+ desired_message_length = RSA_size.SizeOutputBlock;
+ }
+ CFDataRef returnData = oaep_padding_via_c(desired_message_length, dataValue);
+ return returnData;
+
+#else
+ CFDataRef seed = NULL, dbMask = NULL, maskedDB = NULL, seedMask = NULL, padHash = NULL, padZeros = NULL;
+ CFDataRef EncodingParameters = NULL;
+ CFMutableDataRef EM = NULL, dataBlob = NULL;
+ CFNumberRef desired_message_length_cf = NULL;
+ CFErrorRef error = NULL;
+ CFStringRef hashAlgo = NULL;
+ UInt8 *raw_padZeros = NULL, *raw_seed = NULL, *raw_maskedSeed = NULL, *raw_maskedDB = NULL;
+ SecTransformRef mgf_dbMask = NULL, mgf_seedMask = NULL, hash = NULL;
+ CFIndex paddingNeeded = -1, padLen = -1;
+ int hLen = -1;
+ CSSM_QUERY_SIZE_DATA RSA_size;
+
+ // NOTE: we omit (1) If the length of P is greater than the input limitation for the hash function
+ // (2^61 − 1 octets for SHA-1) then output ‘‘parameter string too long’’ and stop.
+ // We don't have ready access to the input limit of the hash functions, and in the real world
+ // we won't be seeing a message that long anyway.
+
+ // (2) If mLen > emLen − 2hLen − 1, output ‘‘message too long’’ and stop.
+ hashAlgo = (CFStringRef)this->GetAttribute(kSecOAEPMGF1DigestAlgorithmAttributeName);
+ if (hashAlgo == NULL) {
+ hashAlgo = kSecDigestSHA1;
+ }
+ hLen = Digest::LengthForType(hashAlgo);
+ desired_message_length_cf = (CFNumberRef)this->GetAttribute(kSecOAEPMessageLengthAttributeName);
+ int desired_message_length = 0;
+ if (desired_message_length_cf) {
+ CFNumberGetValue(desired_message_length_cf, kCFNumberIntType, &desired_message_length);
+ } else {
+ // take RSA (or whatever crypto) block size onto account too
+ RSA_size.SizeInputBlock = CFDataGetLength(dataValue) + 2*hLen +1;
+ RSA_size.SizeOutputBlock = 0;
+ OSStatus status = CSSM_QuerySize(m_handle, CSSM_TRUE, 1, &RSA_size);
+ if (status != errSecSuccess) {
+ CFStringRef errorString = SecCopyErrorMessageString(status, NULL);
+ error = CreateSecTransformErrorRef(kSecTransformErrorInvalidOperation, "CDSA error (%@).", errorString);
+ CFRelease(errorString);
+ goto out;
+ }
+ (void)transforms_assume(RSA_size.SizeInputBlock <= RSA_size.SizeOutputBlock);
+ desired_message_length = RSA_size.SizeOutputBlock -1;
+ }
+ padLen = (desired_message_length - (2*hLen) -1) - CFDataGetLength(dataValue);
+ if (padLen < 0) {
+ error = CreateSecTransformErrorRef(kSecTransformErrorInvalidLength, "Your message is too long for your message length, it needs to be %d bytes shorter, or you need to adjust the kSecOAEPMessageLengthAttributeName attribute", -padLen);
+ goto out;
+ }
+
+ // (3) Generate an octet string PS consisting of emLen − mLen − 2hLen − 1 zero octets. The length of PS may be 0.
+ raw_padZeros = (UInt8*)calloc(padLen, 1);
+ if (!raw_padZeros) {
+ error = GetNoMemoryErrorAndRetain();
+ goto out;
+ }
+ padZeros = CFDataCreateWithBytesNoCopy(NULL, raw_padZeros, padLen, kCFAllocatorMalloc);
+ if (!padZeros) {
+ free(raw_padZeros);
+ error = GetNoMemoryErrorAndRetain();
+ goto out;
+ }
+
+ // (4) Let pHash = Hash(P), an octet string of length hLen.
+ hash = SecDigestTransformCreate(hashAlgo, 0, &error);
+ if (!hash) {
+ goto out;
+ }
+ EncodingParameters = (CFDataRef)this->GetAttribute(kSecOAEPEncodingParametersAttributeName);
+ if (EncodingParameters) {
+ CFRetain(EncodingParameters);
+ } else {
+ EncodingParameters = CFDataCreate(NULL, (UInt8*)"", 0);
+ if (!EncodingParameters) {
+ error = GetNoMemoryErrorAndRetain();
+ goto out;
+ }
+ }
+ if (!SecTransformSetAttribute(hash, kSecTransformInputAttributeName, EncodingParameters, &error)) {
+ goto out;
+ }
+
+ padHash = (CFDataRef)transforms_assume(SecTransformExecute(hash, &error));
+ if (!padHash) {
+ goto out;
+ }
+ (void)transforms_assume(hLen == CFDataGetLength(padHash));
+
+ // (5) Concatenate pHash,PS, the message M, and other padding to form a data block DB as DB = pHash∥PS∥01∥M.
+ dataBlob = CFDataCreateMutable(NULL, CFDataGetLength(padHash) + padLen + 1 + CFDataGetLength(dataValue));
+ if (!dataBlob) {
+ error = GetNoMemoryErrorAndRetain();
+ goto out;
+ }
+ CFDataAppendBytes(dataBlob, CFDataGetBytePtr(padHash), hLen);
+ CFDataAppendBytes(dataBlob, raw_padZeros, padLen);
+ CFDataAppendBytes(dataBlob, (UInt8*)"\01", 1);
+ CFDataAppendBytes(dataBlob, CFDataGetBytePtr(dataValue), CFDataGetLength(dataValue));
+
+ // (6) Generate a random octet string seed of length hLen.
+ seed = (CFDataRef)this->GetAttribute(CFSTR("FixedSeedForOAEPTesting"));
+ raw_seed = NULL;
+ if (seed) {
+ raw_seed = (UInt8*)CFDataGetBytePtr(seed);
+ (void)transforms_assume(hLen == CFDataGetLength(seed));
+ CFRetain(seed);
+ } else {
+ raw_seed = (UInt8*)malloc(hLen);
+ if (!raw_seed) {
+ error = GetNoMemoryErrorAndRetain();
+ goto out;
+ }
+ SecRandomCopyBytes(kSecRandomDefault, hLen, raw_seed);
+ seed = CFDataCreateWithBytesNoCopy(NULL, raw_seed, hLen, kCFAllocatorMalloc);
+ if (!seed) {
+ free(raw_seed);
+ error = GetNoMemoryErrorAndRetain();
+ }
+ }
+
+ // (7) Let dbMask = MGF (seed, emLen − hLen).
+ mgf_dbMask = transforms_assume(SecCreateMaskGenerationFunctionTransform(hashAlgo, desired_message_length - hLen, &error));
+ if (!mgf_dbMask) {
+ goto out;
+ }
+ if (!SecTransformSetAttribute(mgf_dbMask, kSecTransformInputAttributeName, seed, &error)) {
+ goto out;
+ }
+ dbMask = (CFDataRef)SecTransformExecute(mgf_dbMask, &error);
+
+ // (8) Let maskedDB = DB ⊕ dbMask.
+ // NOTE: we do some allocations above...you know, we should be able to malloc ONE buffer of the
+ // proper size.
+ raw_maskedDB = (UInt8 *)malloc(CFDataGetLength(dbMask));
+ if (!raw_maskedDB) {
+ error = GetNoMemoryErrorAndRetain();
+ goto out;
+ }
+ xor_bytes(raw_maskedDB, CFDataGetBytePtr(dbMask), CFDataGetBytePtr(dataBlob), CFDataGetLength(dbMask));
+ maskedDB = CFDataCreateWithBytesNoCopy(NULL, raw_maskedDB, CFDataGetLength(dataBlob), kCFAllocatorMalloc);
+ if (!maskedDB) {
+ free(raw_maskedDB);
+ error = GetNoMemoryErrorAndRetain();
+ goto out;
+ }
+
+ // (9) Let seedMask = MGF(maskedDB, hLen).
+ mgf_seedMask = transforms_assume(SecCreateMaskGenerationFunctionTransform(hashAlgo, hLen, &error));
+ if (!mgf_seedMask) {
+ goto out;
+ }
+ if (!SecTransformSetAttribute(mgf_seedMask, kSecTransformInputAttributeName, maskedDB, &error)) {
+ goto out;
+ }
+ seedMask = transforms_assume((CFDataRef)SecTransformExecute(mgf_seedMask, &error));
+ if (!seedMask) {
+ goto out;
+ }
+
+ // (10) Let maskedSeed = seed ⊕ seedMask
+ raw_maskedSeed = (UInt8 *)malloc(hLen);
+ if (!raw_maskedSeed) {
+ error = GetNoMemoryErrorAndRetain();
+ goto out;
+ }
+ xor_bytes(raw_maskedSeed, raw_seed, CFDataGetBytePtr(seedMask), hLen);
+
+ // (11) Let EM = maskedSeed∥maskedDB (if we didn't have to pushback the NULL we could do this without physically concatanating)
+ // (figure out amount of leading zero padding we need)
+ RSA_size.SizeInputBlock = hLen + CFDataGetLength(maskedDB);
+ CSSM_QuerySize(m_handle, CSSM_TRUE, 1, &RSA_size);
+ paddingNeeded = RSA_size.SizeOutputBlock - RSA_size.SizeInputBlock;
+ (void)transforms_assume(paddingNeeded >= 0);
+
+ EM = CFDataCreateMutable(NULL, CFDataGetLength(maskedDB) + hLen + paddingNeeded);
+ if (!EM) {
+ error = GetNoMemoryErrorAndRetain();
+ goto out;
+ }
+ while(paddingNeeded--) {
+ CFDataAppendBytes(EM, (UInt8*)"", 1);
+ }
+
+ CFDataAppendBytes(EM, raw_maskedSeed, hLen);
+ CFDataAppendBytes(EM, raw_maskedDB, CFDataGetLength(maskedDB));
+out:
+ if (error) {
+ SetAttributeNoCallback(kSecTransformOutputAttributeName, error);
+ (void)transforms_assume_zero(EM);
+ }
+
+ CFSafeRelease(seed); // via get??
+ CFSafeRelease(dbMask);
+ CFSafeRelease(maskedDB);
+ CFSafeRelease(seedMask);
+ CFSafeRelease(padHash);
+ CFSafeRelease(padZeros);
+ CFSafeRelease(EncodingParameters);
+ CFSafeRelease(dataBlob);
+ // desired_message_length_cf -- via get
+ // hashAlgo -- via get
+ CFSafeRelease(mgf_dbMask);
+ CFSafeRelease(mgf_seedMask);
+ CFSafeRelease(hash);
+ // raw_* are all freed by their associated CFDatas, except raw_maskedSeed
+ free(raw_maskedSeed);
+
+ // (12) Output EM.
+ return EM;
+#endif
+}
+
+/* --------------------------------------------------------------------------
+ method: AttributeChanged
+ description: deal with input
+ -------------------------------------------------------------------------- */
+void EncryptDecryptBase::AttributeChanged(SecTransformAttributeRef ah, CFTypeRef value)
+{
+ // sanity check our arguments
+ if (ah != inputAH)
+ {
+ return; // we only deal with input
+ }
+
+ if (value != NULL)
+ {
+ CFTypeID valueType = CFGetTypeID(value);
+ if (valueType != CFDataGetTypeID())
+ {
+ CFStringRef realType = CFCopyTypeIDDescription(valueType);
+ CFErrorRef error = CreateSecTransformErrorRef(kSecTransformErrorNotInitializedCorrectly, "Value is not a CFDataRef -- this one is a %@", realType);
+ CFRelease(realType);
+ SetAttributeNoCallback(kSecTransformOutputAttributeName, error);
+ return;
+ }
+
+ if (m_forEncryption && m_accumulator) {
+ CFDataRef d = (CFDataRef)value;
+ CFDataAppendBytes(m_accumulator, CFDataGetBytePtr(d), CFDataGetLength(d));
+ return;
+ }
+ }
+
+ if (m_forEncryption && m_accumulator) {
+ (void)transforms_assume_zero(value);
+ value = m_accumulator;
+ m_accumulator = NULL;
+ dispatch_async(this->mDispatchQueue, ^{
+ CFSafeRelease(value);
+ });
+ this->Pushback(inputAH, NULL);
+
+ if (m_oaep_padding) {
+ value = apply_oaep_padding((CFDataRef)value);
+ dispatch_async(this->mDispatchQueue, ^{
+ CFSafeRelease(value);
+ });
+ }
+ }
+
+ // add the input to our cryptor
+ CFDataRef valueRef = (CFDataRef) value;
+ CSSM_RETURN crtn = CSSM_OK;
+ Boolean inFinal = FALSE;
+
+ if (valueRef != NULL)
+ {
+ // Convert to A CSSM_DATA
+ CSSM_DATA dataStruct;
+ dataStruct.Length = CFDataGetLength(valueRef);
+ dataStruct.Data = const_cast<uint8_t*>(CFDataGetBytePtr(valueRef));
+
+ CSSM_DATA intermediateDataStruct;
+ memset(&intermediateDataStruct, 0, sizeof(intermediateDataStruct));
+
+ CSSM_SIZE bytesProcessed = 0;
+
+ if (m_forEncryption)
+ {
+ crtn = CSSM_EncryptDataUpdate(m_handle,
+ &dataStruct,
+ 1,
+ &intermediateDataStruct,
+ 1,
+ &bytesProcessed);
+ }
+ else
+ {
+ crtn = CSSM_DecryptDataUpdate(m_handle,
+ &dataStruct,
+ 1,
+ &intermediateDataStruct,
+ 1,
+ &bytesProcessed);
+ }
+
+ if (CSSM_OK != crtn)
+ {
+ SendCSSMError(crtn);
+ return;
+ }
+
+
+ if (intermediateDataStruct.Length > 0)
+ {
+ if (NULL == m_processedData)
+ {
+ m_processedData = CFDataCreateMutable(kCFAllocatorDefault, 0);
+ }
+
+ CFDataAppendBytes(m_processedData, intermediateDataStruct.Data, bytesProcessed);
+ free(intermediateDataStruct.Data);
+ }
+ }
+ else
+ {
+ // Finalize
+
+ inFinal = TRUE;
+ CSSM_DATA remData;
+ memset(&remData, 0, sizeof(remData));
+
+ crtn = (m_forEncryption) ? CSSM_EncryptDataFinal(m_handle, &remData) : CSSM_DecryptDataFinal(m_handle, &remData);
+
+ if (CSSM_OK == crtn)
+ {
+ if (m_forEncryption == false && m_accumulator) {
+ (void)transforms_assume_zero(m_processedData);
+ if (remData.Length > 0) {
+ CFDataAppendBytes(m_accumulator, remData.Data, remData.Length);
+ }
+ } else {
+ if (NULL == m_processedData)
+ {
+ m_processedData = CFDataCreateMutable(kCFAllocatorDefault, 0);
+ }
+
+ if (remData.Length > 0)
+ {
+ CFDataAppendBytes(m_processedData, remData.Data, remData.Length);
+ }
+ }
+ }
+
+ free(remData.Data);
+
+ if (CSSM_OK != crtn)
+ {
+ SendCSSMError(crtn);
+ return;
+ }
+ }
+
+ if (NULL != m_processedData)
+ {
+ SendAttribute(kSecTransformOutputAttributeName, m_processedData);
+ CFRelease(m_processedData);
+ m_processedData = NULL;
+ }
+
+ if (inFinal)
+ {
+ if (m_oaep_padding && m_forEncryption == false) {
+ CFTypeRef unpadded = remove_oaep_padding(m_accumulator);
+ SendAttribute(kSecTransformOutputAttributeName, unpadded);
+ CFRelease(unpadded);
+ }
+ SendAttribute(kSecTransformOutputAttributeName, NULL);
+ }
+
+
+}
+
+/* --------------------------------------------------------------------------
+ method: CopyState
+ description: Copy the current state of this transform
+ -------------------------------------------------------------------------- */
+CFDictionaryRef EncryptDecryptBase::CopyState()
+{
+ // make a dictionary for our state
+ CFMutableDictionaryRef state = (CFMutableDictionaryRef) CFDictionaryCreateMutable(NULL, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
+ CFStringRef paddingStr = (CFStringRef) GetAttribute(kSecPaddingKey);
+ CFStringRef modeStr = (CFStringRef) GetAttribute (kSecEncryptionMode);
+ CFDataRef ivData = (CFDataRef) GetAttribute(kSecIVKey);
+ if (NULL != paddingStr)
+ {
+ CFDictionaryAddValue(state, kSecPaddingKey, paddingStr);
+ }
+
+ if (NULL != modeStr)
+ {
+ CFDictionaryAddValue(state, kSecEncryptionMode, modeStr);
+ }
+
+ if (NULL != ivData)
+ {
+ CFDictionaryAddValue(state, kSecIVKey, ivData);
+ }
+
+ return state;
+}
+
+/* --------------------------------------------------------------------------
+ method: RestoreState
+ description: Restore the state of this transform from a dictionary
+ -------------------------------------------------------------------------- */
+void EncryptDecryptBase::RestoreState(CFDictionaryRef state)
+{
+ if (NULL == state)
+ {
+ return;
+ }
+
+ CFStringRef paddingStr = (CFStringRef)CFDictionaryGetValue(state, kSecPaddingKey);
+ CFStringRef modeStr = (CFStringRef)CFDictionaryGetValue(state, kSecEncryptionMode);
+ CFDataRef ivData = (CFDataRef)CFDictionaryGetValue(state, kSecIVKey);
+
+ if (NULL != paddingStr)
+ {
+ SetAttribute(kSecPaddingKey, paddingStr);
+ }
+
+ if (NULL != modeStr)
+ {
+ SetAttribute(kSecEncryptionMode, modeStr);
+ }
+
+ if (NULL != ivData)
+ {
+ SetAttribute(kSecIVKey, ivData);
+ }
+
+}
+
+/* --------------------------------------------------------------------------
+ Implementation of the EncryptTransform
+ -------------------------------------------------------------------------- */
+
+/* --------------------------------------------------------------------------
+ method: EncryptTransform (Constructor)
+ description: Make a new EncryptTransform
+ -------------------------------------------------------------------------- */
+EncryptTransform::EncryptTransform() : EncryptDecryptBase(kEncryptTransformType)
+{
+}
+
+/* --------------------------------------------------------------------------
+ method: ~EncryptTransform (Destructor)
+ description: Clean up the memory of anEncryptTransform
+ -------------------------------------------------------------------------- */
+EncryptTransform::~EncryptTransform()
+{
+}
+
+/* --------------------------------------------------------------------------
+ method: [static] Make
+ description: Make a new instance of this class
+ -------------------------------------------------------------------------- */
+SecTransformRef EncryptTransform::Make()
+{
+ EncryptTransform* tr = new EncryptTransform();
+ SecTransformRef str = (SecTransformRef) CoreFoundationHolder::MakeHolder(kEncryptTransformType, tr);
+ return str;
+}
+
+/* --------------------------------------------------------------------------
+ Interface and implementation of the EncryptTransformFactory
+ -------------------------------------------------------------------------- */
+
+class EncryptTransformFactory : public TransformFactory
+{
+public:
+ EncryptTransformFactory();
+ CFTypeRef Make();
+};
+
+
+/* --------------------------------------------------------------------------
+ method: EncryptTransformFactory (Constructor)
+ description:
+ -------------------------------------------------------------------------- */
+EncryptTransformFactory::EncryptTransformFactory() :
+TransformFactory(kEncryptTransformType)
+{}
+
+
+/* --------------------------------------------------------------------------
+ method: MakeTransformFactory
+ description: Make an instance of this factory class
+ -------------------------------------------------------------------------- */
+TransformFactory* EncryptTransform::MakeTransformFactory()
+{
+ return new EncryptTransformFactory;
+}
+
+/* --------------------------------------------------------------------------
+ method: Make
+ description: Create an instance of this class
+ -------------------------------------------------------------------------- */
+CFTypeRef EncryptTransformFactory::Make()
+{
+ return EncryptTransform::Make();
+}
+
+
+/* --------------------------------------------------------------------------
+ method: DecryptTransform (Constructor)
+ description: Make a new DecryptTransform
+ -------------------------------------------------------------------------- */
+DecryptTransform::DecryptTransform() : EncryptDecryptBase(kDecryptTransformType)
+{
+}
+
+/* --------------------------------------------------------------------------
+ method: ~DecryptTransform (Destructor)
+ description: Clean up the memory of anDecryptTransform
+ -------------------------------------------------------------------------- */
+DecryptTransform::~DecryptTransform()
+{
+}
+
+
+/* --------------------------------------------------------------------------
+ method: [static] Make
+ description: Make a new instance of this class
+ -------------------------------------------------------------------------- */
+SecTransformRef DecryptTransform::Make()
+{
+ DecryptTransform* tr = new DecryptTransform();
+ SecTransformRef str = (SecTransformRef) CoreFoundationHolder::MakeHolder(kDecryptTransformType, tr);
+ return str;
+}
+
+/* --------------------------------------------------------------------------
+ Interface and implementation of the DecryptTransformFactory
+ -------------------------------------------------------------------------- */
+
+class DecryptTransformFactory : public TransformFactory
+{
+public:
+ DecryptTransformFactory();
+ CFTypeRef Make();
+};
+
+
+/* --------------------------------------------------------------------------
+ method: DecryptTransformFactory (Constructor)
+ description:
+ -------------------------------------------------------------------------- */
+DecryptTransformFactory::DecryptTransformFactory() :
+TransformFactory(kDecryptTransformType)
+{}
+
+
+/* --------------------------------------------------------------------------
+ method: MakeTransformFactory
+ description: Make an instance of this factory class
+ -------------------------------------------------------------------------- */
+TransformFactory* DecryptTransform::MakeTransformFactory()
+{
+ return new DecryptTransformFactory;
+}
+
+/* --------------------------------------------------------------------------
+ method: Make
+ description: Create an instance of this class
+ -------------------------------------------------------------------------- */
+CFTypeRef DecryptTransformFactory::Make()
+{
+ return DecryptTransform::Make();
+}
+
projects / apple / security.git / blobdiff