Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 1 | /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */ |
Luca Keidel | 941fd8c | 2017-07-24 15:21:22 +0200 | [diff] [blame] | 2 | /* |
Davide Pesavento | 3c7969f | 2018-09-08 15:31:35 -0400 | [diff] [blame] | 3 | * Copyright (c) 2013-2018 Regents of the University of California. |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 4 | * |
| 5 | * This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions). |
| 6 | * |
| 7 | * ndn-cxx library is free software: you can redistribute it and/or modify it under the |
| 8 | * terms of the GNU Lesser General Public License as published by the Free Software |
| 9 | * Foundation, either version 3 of the License, or (at your option) any later version. |
| 10 | * |
| 11 | * ndn-cxx library is distributed in the hope that it will be useful, but WITHOUT ANY |
| 12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A |
| 13 | * PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. |
| 14 | * |
| 15 | * You should have received copies of the GNU General Public License and GNU Lesser |
| 16 | * General Public License along with ndn-cxx, e.g., in COPYING.md file. If not, see |
| 17 | * <http://www.gnu.org/licenses/>. |
| 18 | * |
| 19 | * See AUTHORS.md for complete list of ndn-cxx authors and contributors. |
| 20 | */ |
| 21 | |
| 22 | #include "private-key.hpp" |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 23 | #include "base64-decode.hpp" |
Davide Pesavento | e178989 | 2017-02-26 15:50:52 -0500 | [diff] [blame] | 24 | #include "base64-encode.hpp" |
| 25 | #include "buffer-source.hpp" |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 26 | #include "stream-sink.hpp" |
Davide Pesavento | e178989 | 2017-02-26 15:50:52 -0500 | [diff] [blame] | 27 | #include "stream-source.hpp" |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 28 | #include "../detail/openssl-helper.hpp" |
| 29 | #include "../key-params.hpp" |
Davide Pesavento | e178989 | 2017-02-26 15:50:52 -0500 | [diff] [blame] | 30 | #include "../../encoding/buffer-stream.hpp" |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 31 | |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 32 | #include <boost/lexical_cast.hpp> |
Davide Pesavento | e178989 | 2017-02-26 15:50:52 -0500 | [diff] [blame] | 33 | #include <cstring> |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 34 | |
| 35 | #define ENSURE_PRIVATE_KEY_LOADED(key) \ |
| 36 | do { \ |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 37 | if ((key) == nullptr) \ |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 38 | BOOST_THROW_EXCEPTION(Error("Private key has not been loaded yet")); \ |
| 39 | } while (false) |
| 40 | |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 41 | #define ENSURE_PRIVATE_KEY_NOT_LOADED(key) \ |
| 42 | do { \ |
| 43 | if ((key) != nullptr) \ |
| 44 | BOOST_THROW_EXCEPTION(Error("Private key has already been loaded")); \ |
| 45 | } while (false) |
| 46 | |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 47 | namespace ndn { |
| 48 | namespace security { |
| 49 | namespace transform { |
| 50 | |
Luca Keidel | 941fd8c | 2017-07-24 15:21:22 +0200 | [diff] [blame] | 51 | static void |
| 52 | opensslInitAlgorithms() |
| 53 | { |
| 54 | #if OPENSSL_VERSION_NUMBER < 0x1010000fL |
| 55 | static bool isInitialized = false; |
| 56 | if (!isInitialized) { |
| 57 | OpenSSL_add_all_algorithms(); |
| 58 | isInitialized = true; |
| 59 | } |
| 60 | #endif // OPENSSL_VERSION_NUMBER < 0x1010000fL |
| 61 | } |
| 62 | |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 63 | class PrivateKey::Impl |
| 64 | { |
| 65 | public: |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 66 | Impl() noexcept |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 67 | : key(nullptr) |
| 68 | { |
| 69 | } |
| 70 | |
| 71 | ~Impl() |
| 72 | { |
| 73 | EVP_PKEY_free(key); |
| 74 | } |
| 75 | |
| 76 | public: |
| 77 | EVP_PKEY* key; |
| 78 | }; |
| 79 | |
| 80 | PrivateKey::PrivateKey() |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 81 | : m_impl(make_unique<Impl>()) |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 82 | { |
| 83 | } |
| 84 | |
| 85 | PrivateKey::~PrivateKey() = default; |
| 86 | |
Davide Pesavento | 06f1bdf | 2017-09-16 18:59:15 -0400 | [diff] [blame] | 87 | KeyType |
| 88 | PrivateKey::getKeyType() const |
| 89 | { |
| 90 | if (!m_impl->key) |
| 91 | return KeyType::NONE; |
| 92 | |
| 93 | switch (detail::getEvpPkeyType(m_impl->key)) { |
| 94 | case EVP_PKEY_RSA: |
| 95 | return KeyType::RSA; |
| 96 | case EVP_PKEY_EC: |
| 97 | return KeyType::EC; |
| 98 | default: |
| 99 | return KeyType::NONE; |
| 100 | } |
| 101 | } |
| 102 | |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 103 | void |
| 104 | PrivateKey::loadPkcs1(const uint8_t* buf, size_t size) |
| 105 | { |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 106 | ENSURE_PRIVATE_KEY_NOT_LOADED(m_impl->key); |
| 107 | opensslInitAlgorithms(); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 108 | |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 109 | if (d2i_AutoPrivateKey(&m_impl->key, &buf, static_cast<long>(size)) == nullptr) |
| 110 | BOOST_THROW_EXCEPTION(Error("Failed to load private key")); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 111 | } |
| 112 | |
| 113 | void |
| 114 | PrivateKey::loadPkcs1(std::istream& is) |
| 115 | { |
| 116 | OBufferStream os; |
| 117 | streamSource(is) >> streamSink(os); |
Davide Pesavento | 5d0b010 | 2017-10-07 13:43:16 -0400 | [diff] [blame] | 118 | this->loadPkcs1(os.buf()->data(), os.buf()->size()); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 119 | } |
| 120 | |
| 121 | void |
| 122 | PrivateKey::loadPkcs1Base64(const uint8_t* buf, size_t size) |
| 123 | { |
| 124 | OBufferStream os; |
| 125 | bufferSource(buf, size) >> base64Decode() >> streamSink(os); |
Davide Pesavento | 5d0b010 | 2017-10-07 13:43:16 -0400 | [diff] [blame] | 126 | this->loadPkcs1(os.buf()->data(), os.buf()->size()); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 127 | } |
| 128 | |
| 129 | void |
| 130 | PrivateKey::loadPkcs1Base64(std::istream& is) |
| 131 | { |
| 132 | OBufferStream os; |
| 133 | streamSource(is) >> base64Decode() >> streamSink(os); |
Davide Pesavento | 5d0b010 | 2017-10-07 13:43:16 -0400 | [diff] [blame] | 134 | this->loadPkcs1(os.buf()->data(), os.buf()->size()); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 135 | } |
| 136 | |
| 137 | void |
| 138 | PrivateKey::loadPkcs8(const uint8_t* buf, size_t size, const char* pw, size_t pwLen) |
| 139 | { |
| 140 | BOOST_ASSERT(std::strlen(pw) == pwLen); |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 141 | ENSURE_PRIVATE_KEY_NOT_LOADED(m_impl->key); |
Luca Keidel | 941fd8c | 2017-07-24 15:21:22 +0200 | [diff] [blame] | 142 | opensslInitAlgorithms(); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 143 | |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 144 | detail::Bio membio(BIO_s_mem()); |
| 145 | if (!membio.write(buf, size)) |
| 146 | BOOST_THROW_EXCEPTION(Error("Failed to copy buffer")); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 147 | |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 148 | if (d2i_PKCS8PrivateKey_bio(membio, &m_impl->key, nullptr, const_cast<char*>(pw)) == nullptr) |
| 149 | BOOST_THROW_EXCEPTION(Error("Failed to load private key")); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 150 | } |
| 151 | |
| 152 | static inline int |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 153 | passwordCallbackWrapper(char* buf, int size, int rwflag, void* u) |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 154 | { |
Luca Keidel | 941fd8c | 2017-07-24 15:21:22 +0200 | [diff] [blame] | 155 | BOOST_ASSERT(size >= 0); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 156 | auto cb = reinterpret_cast<PrivateKey::PasswordCallback*>(u); |
Luca Keidel | 941fd8c | 2017-07-24 15:21:22 +0200 | [diff] [blame] | 157 | return (*cb)(buf, static_cast<size_t>(size), rwflag); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 158 | } |
| 159 | |
| 160 | void |
| 161 | PrivateKey::loadPkcs8(const uint8_t* buf, size_t size, PasswordCallback pwCallback) |
| 162 | { |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 163 | ENSURE_PRIVATE_KEY_NOT_LOADED(m_impl->key); |
Luca Keidel | 941fd8c | 2017-07-24 15:21:22 +0200 | [diff] [blame] | 164 | opensslInitAlgorithms(); |
| 165 | |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 166 | detail::Bio membio(BIO_s_mem()); |
| 167 | if (!membio.write(buf, size)) |
| 168 | BOOST_THROW_EXCEPTION(Error("Failed to copy buffer")); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 169 | |
| 170 | if (pwCallback) |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 171 | m_impl->key = d2i_PKCS8PrivateKey_bio(membio, nullptr, &passwordCallbackWrapper, &pwCallback); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 172 | else |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 173 | m_impl->key = d2i_PKCS8PrivateKey_bio(membio, nullptr, nullptr, nullptr); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 174 | |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 175 | if (m_impl->key == nullptr) |
| 176 | BOOST_THROW_EXCEPTION(Error("Failed to load private key")); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 177 | } |
| 178 | |
| 179 | void |
| 180 | PrivateKey::loadPkcs8(std::istream& is, const char* pw, size_t pwLen) |
| 181 | { |
| 182 | OBufferStream os; |
| 183 | streamSource(is) >> streamSink(os); |
Davide Pesavento | 5d0b010 | 2017-10-07 13:43:16 -0400 | [diff] [blame] | 184 | this->loadPkcs8(os.buf()->data(), os.buf()->size(), pw, pwLen); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 185 | } |
| 186 | |
| 187 | void |
| 188 | PrivateKey::loadPkcs8(std::istream& is, PasswordCallback pwCallback) |
| 189 | { |
| 190 | OBufferStream os; |
| 191 | streamSource(is) >> streamSink(os); |
Davide Pesavento | 5d0b010 | 2017-10-07 13:43:16 -0400 | [diff] [blame] | 192 | this->loadPkcs8(os.buf()->data(), os.buf()->size(), pwCallback); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 193 | } |
| 194 | |
| 195 | void |
| 196 | PrivateKey::loadPkcs8Base64(const uint8_t* buf, size_t size, const char* pw, size_t pwLen) |
| 197 | { |
| 198 | OBufferStream os; |
| 199 | bufferSource(buf, size) >> base64Decode() >> streamSink(os); |
Davide Pesavento | 5d0b010 | 2017-10-07 13:43:16 -0400 | [diff] [blame] | 200 | this->loadPkcs8(os.buf()->data(), os.buf()->size(), pw, pwLen); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 201 | } |
| 202 | |
| 203 | void |
| 204 | PrivateKey::loadPkcs8Base64(const uint8_t* buf, size_t size, PasswordCallback pwCallback) |
| 205 | { |
| 206 | OBufferStream os; |
| 207 | bufferSource(buf, size) >> base64Decode() >> streamSink(os); |
Davide Pesavento | 5d0b010 | 2017-10-07 13:43:16 -0400 | [diff] [blame] | 208 | this->loadPkcs8(os.buf()->data(), os.buf()->size(), pwCallback); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 209 | } |
| 210 | |
| 211 | void |
| 212 | PrivateKey::loadPkcs8Base64(std::istream& is, const char* pw, size_t pwLen) |
| 213 | { |
| 214 | OBufferStream os; |
| 215 | streamSource(is) >> base64Decode() >> streamSink(os); |
Davide Pesavento | 5d0b010 | 2017-10-07 13:43:16 -0400 | [diff] [blame] | 216 | this->loadPkcs8(os.buf()->data(), os.buf()->size(), pw, pwLen); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 217 | } |
| 218 | |
| 219 | void |
| 220 | PrivateKey::loadPkcs8Base64(std::istream& is, PasswordCallback pwCallback) |
| 221 | { |
| 222 | OBufferStream os; |
| 223 | streamSource(is) >> base64Decode() >> streamSink(os); |
Davide Pesavento | 5d0b010 | 2017-10-07 13:43:16 -0400 | [diff] [blame] | 224 | this->loadPkcs8(os.buf()->data(), os.buf()->size(), pwCallback); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 225 | } |
| 226 | |
| 227 | void |
| 228 | PrivateKey::savePkcs1(std::ostream& os) const |
| 229 | { |
| 230 | bufferSource(*this->toPkcs1()) >> streamSink(os); |
| 231 | } |
| 232 | |
| 233 | void |
| 234 | PrivateKey::savePkcs1Base64(std::ostream& os) const |
| 235 | { |
| 236 | bufferSource(*this->toPkcs1()) >> base64Encode() >> streamSink(os); |
| 237 | } |
| 238 | |
| 239 | void |
| 240 | PrivateKey::savePkcs8(std::ostream& os, const char* pw, size_t pwLen) const |
| 241 | { |
| 242 | bufferSource(*this->toPkcs8(pw, pwLen)) >> streamSink(os); |
| 243 | } |
| 244 | |
| 245 | void |
| 246 | PrivateKey::savePkcs8(std::ostream& os, PasswordCallback pwCallback) const |
| 247 | { |
| 248 | bufferSource(*this->toPkcs8(pwCallback)) >> streamSink(os); |
| 249 | } |
| 250 | |
| 251 | void |
| 252 | PrivateKey::savePkcs8Base64(std::ostream& os, const char* pw, size_t pwLen) const |
| 253 | { |
| 254 | bufferSource(*this->toPkcs8(pw, pwLen)) >> base64Encode() >> streamSink(os); |
| 255 | } |
| 256 | |
| 257 | void |
| 258 | PrivateKey::savePkcs8Base64(std::ostream& os, PasswordCallback pwCallback) const |
| 259 | { |
| 260 | bufferSource(*this->toPkcs8(pwCallback)) >> base64Encode() >> streamSink(os); |
| 261 | } |
| 262 | |
| 263 | ConstBufferPtr |
| 264 | PrivateKey::derivePublicKey() const |
| 265 | { |
| 266 | ENSURE_PRIVATE_KEY_LOADED(m_impl->key); |
| 267 | |
| 268 | uint8_t* pkcs8 = nullptr; |
| 269 | int len = i2d_PUBKEY(m_impl->key, &pkcs8); |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 270 | if (len < 0) |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 271 | BOOST_THROW_EXCEPTION(Error("Failed to derive public key")); |
| 272 | |
| 273 | auto result = make_shared<Buffer>(pkcs8, len); |
| 274 | OPENSSL_free(pkcs8); |
| 275 | |
| 276 | return result; |
| 277 | } |
| 278 | |
| 279 | ConstBufferPtr |
| 280 | PrivateKey::decrypt(const uint8_t* cipherText, size_t cipherLen) const |
| 281 | { |
| 282 | ENSURE_PRIVATE_KEY_LOADED(m_impl->key); |
| 283 | |
Davide Pesavento | c21979d | 2017-09-16 14:52:17 -0400 | [diff] [blame] | 284 | int keyType = detail::getEvpPkeyType(m_impl->key); |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 285 | switch (keyType) { |
| 286 | case EVP_PKEY_NONE: |
| 287 | BOOST_THROW_EXCEPTION(Error("Failed to determine key type")); |
Luca Keidel | 941fd8c | 2017-07-24 15:21:22 +0200 | [diff] [blame] | 288 | case EVP_PKEY_RSA: |
| 289 | return rsaDecrypt(cipherText, cipherLen); |
| 290 | default: |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 291 | BOOST_THROW_EXCEPTION(Error("Decryption is not supported for key type " + to_string(keyType))); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 292 | } |
| 293 | } |
| 294 | |
| 295 | void* |
| 296 | PrivateKey::getEvpPkey() const |
| 297 | { |
| 298 | return m_impl->key; |
| 299 | } |
| 300 | |
| 301 | ConstBufferPtr |
| 302 | PrivateKey::toPkcs1() const |
| 303 | { |
| 304 | ENSURE_PRIVATE_KEY_LOADED(m_impl->key); |
Luca Keidel | 941fd8c | 2017-07-24 15:21:22 +0200 | [diff] [blame] | 305 | opensslInitAlgorithms(); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 306 | |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 307 | detail::Bio membio(BIO_s_mem()); |
| 308 | if (!i2d_PrivateKey_bio(membio, m_impl->key)) |
| 309 | BOOST_THROW_EXCEPTION(Error("Cannot convert key to PKCS #1 format")); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 310 | |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 311 | auto buffer = make_shared<Buffer>(BIO_pending(membio)); |
Davide Pesavento | 5d0b010 | 2017-10-07 13:43:16 -0400 | [diff] [blame] | 312 | membio.read(buffer->data(), buffer->size()); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 313 | |
| 314 | return buffer; |
| 315 | } |
| 316 | |
| 317 | ConstBufferPtr |
| 318 | PrivateKey::toPkcs8(const char* pw, size_t pwLen) const |
| 319 | { |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 320 | BOOST_ASSERT(std::strlen(pw) == pwLen); |
Luca Keidel | 941fd8c | 2017-07-24 15:21:22 +0200 | [diff] [blame] | 321 | ENSURE_PRIVATE_KEY_LOADED(m_impl->key); |
| 322 | opensslInitAlgorithms(); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 323 | |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 324 | detail::Bio membio(BIO_s_mem()); |
Davide Pesavento | ee77ca0 | 2018-10-10 01:45:24 -0400 | [diff] [blame^] | 325 | if (!i2d_PKCS8PrivateKey_bio(membio, m_impl->key, EVP_aes_256_cbc(), nullptr, 0, |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 326 | nullptr, const_cast<char*>(pw))) |
| 327 | BOOST_THROW_EXCEPTION(Error("Cannot convert key to PKCS #8 format")); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 328 | |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 329 | auto buffer = make_shared<Buffer>(BIO_pending(membio)); |
Davide Pesavento | 5d0b010 | 2017-10-07 13:43:16 -0400 | [diff] [blame] | 330 | membio.read(buffer->data(), buffer->size()); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 331 | |
| 332 | return buffer; |
| 333 | } |
| 334 | |
| 335 | ConstBufferPtr |
| 336 | PrivateKey::toPkcs8(PasswordCallback pwCallback) const |
| 337 | { |
| 338 | ENSURE_PRIVATE_KEY_LOADED(m_impl->key); |
Luca Keidel | 941fd8c | 2017-07-24 15:21:22 +0200 | [diff] [blame] | 339 | opensslInitAlgorithms(); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 340 | |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 341 | detail::Bio membio(BIO_s_mem()); |
Davide Pesavento | ee77ca0 | 2018-10-10 01:45:24 -0400 | [diff] [blame^] | 342 | if (!i2d_PKCS8PrivateKey_bio(membio, m_impl->key, EVP_aes_256_cbc(), nullptr, 0, |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 343 | &passwordCallbackWrapper, &pwCallback)) |
| 344 | BOOST_THROW_EXCEPTION(Error("Cannot convert key to PKCS #8 format")); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 345 | |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 346 | auto buffer = make_shared<Buffer>(BIO_pending(membio)); |
Davide Pesavento | 5d0b010 | 2017-10-07 13:43:16 -0400 | [diff] [blame] | 347 | membio.read(buffer->data(), buffer->size()); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 348 | |
| 349 | return buffer; |
| 350 | } |
| 351 | |
| 352 | ConstBufferPtr |
| 353 | PrivateKey::rsaDecrypt(const uint8_t* cipherText, size_t cipherLen) const |
| 354 | { |
| 355 | detail::EvpPkeyCtx ctx(m_impl->key); |
| 356 | |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 357 | if (EVP_PKEY_decrypt_init(ctx) <= 0) |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 358 | BOOST_THROW_EXCEPTION(Error("Failed to initialize decryption context")); |
| 359 | |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 360 | if (EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_OAEP_PADDING) <= 0) |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 361 | BOOST_THROW_EXCEPTION(Error("Failed to set padding")); |
| 362 | |
| 363 | size_t outlen = 0; |
| 364 | // Determine buffer length |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 365 | if (EVP_PKEY_decrypt(ctx, nullptr, &outlen, cipherText, cipherLen) <= 0) |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 366 | BOOST_THROW_EXCEPTION(Error("Failed to estimate output length")); |
| 367 | |
| 368 | auto out = make_shared<Buffer>(outlen); |
Davide Pesavento | 5d0b010 | 2017-10-07 13:43:16 -0400 | [diff] [blame] | 369 | if (EVP_PKEY_decrypt(ctx, out->data(), &outlen, cipherText, cipherLen) <= 0) |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 370 | BOOST_THROW_EXCEPTION(Error("Failed to decrypt ciphertext")); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 371 | |
| 372 | out->resize(outlen); |
| 373 | return out; |
| 374 | } |
| 375 | |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 376 | unique_ptr<PrivateKey> |
| 377 | PrivateKey::generateRsaKey(uint32_t keySize) |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 378 | { |
| 379 | detail::EvpPkeyCtx kctx(EVP_PKEY_RSA); |
| 380 | |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 381 | if (EVP_PKEY_keygen_init(kctx) <= 0) |
| 382 | BOOST_THROW_EXCEPTION(PrivateKey::Error("Failed to initialize RSA keygen context")); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 383 | |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 384 | if (EVP_PKEY_CTX_set_rsa_keygen_bits(kctx, static_cast<int>(keySize)) <= 0) |
| 385 | BOOST_THROW_EXCEPTION(PrivateKey::Error("Failed to set RSA key length")); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 386 | |
| 387 | auto privateKey = make_unique<PrivateKey>(); |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 388 | if (EVP_PKEY_keygen(kctx, &privateKey->m_impl->key) <= 0) |
| 389 | BOOST_THROW_EXCEPTION(PrivateKey::Error("Failed to generate RSA key")); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 390 | |
| 391 | return privateKey; |
| 392 | } |
| 393 | |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 394 | unique_ptr<PrivateKey> |
| 395 | PrivateKey::generateEcKey(uint32_t keySize) |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 396 | { |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 397 | detail::EvpPkeyCtx pctx(EVP_PKEY_EC); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 398 | |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 399 | if (EVP_PKEY_paramgen_init(pctx) <= 0) |
| 400 | BOOST_THROW_EXCEPTION(PrivateKey::Error("Failed to initialize EC paramgen context")); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 401 | |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 402 | int ret; |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 403 | switch (keySize) { |
Davide Pesavento | 3c7969f | 2018-09-08 15:31:35 -0400 | [diff] [blame] | 404 | case 224: |
| 405 | ret = EVP_PKEY_CTX_set_ec_paramgen_curve_nid(pctx, NID_secp224r1); |
| 406 | break; |
| 407 | case 256: |
| 408 | ret = EVP_PKEY_CTX_set_ec_paramgen_curve_nid(pctx, NID_X9_62_prime256v1); // same as secp256r1 |
| 409 | break; |
| 410 | case 384: |
| 411 | ret = EVP_PKEY_CTX_set_ec_paramgen_curve_nid(pctx, NID_secp384r1); |
| 412 | break; |
| 413 | case 521: |
| 414 | ret = EVP_PKEY_CTX_set_ec_paramgen_curve_nid(pctx, NID_secp521r1); |
| 415 | break; |
| 416 | default: |
| 417 | BOOST_THROW_EXCEPTION(std::invalid_argument("Unsupported EC key length " + to_string(keySize))); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 418 | } |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 419 | if (ret <= 0) |
| 420 | BOOST_THROW_EXCEPTION(PrivateKey::Error("Failed to set EC curve")); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 421 | |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 422 | Impl params; |
| 423 | if (EVP_PKEY_paramgen(pctx, ¶ms.key) <= 0) |
| 424 | BOOST_THROW_EXCEPTION(PrivateKey::Error("Failed to generate EC parameters")); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 425 | |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 426 | detail::EvpPkeyCtx kctx(params.key); |
| 427 | if (EVP_PKEY_keygen_init(kctx) <= 0) |
| 428 | BOOST_THROW_EXCEPTION(PrivateKey::Error("Failed to initialize EC keygen context")); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 429 | |
| 430 | auto privateKey = make_unique<PrivateKey>(); |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 431 | if (EVP_PKEY_keygen(kctx, &privateKey->m_impl->key) <= 0) |
| 432 | BOOST_THROW_EXCEPTION(PrivateKey::Error("Failed to generate EC key")); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 433 | |
| 434 | return privateKey; |
| 435 | } |
| 436 | |
| 437 | unique_ptr<PrivateKey> |
| 438 | generatePrivateKey(const KeyParams& keyParams) |
| 439 | { |
| 440 | switch (keyParams.getKeyType()) { |
| 441 | case KeyType::RSA: { |
| 442 | const RsaKeyParams& rsaParams = static_cast<const RsaKeyParams&>(keyParams); |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 443 | return PrivateKey::generateRsaKey(rsaParams.getKeySize()); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 444 | } |
| 445 | case KeyType::EC: { |
Spyridon Mastorakis | 1ece2e3 | 2015-08-27 18:52:21 -0700 | [diff] [blame] | 446 | const EcKeyParams& ecParams = static_cast<const EcKeyParams&>(keyParams); |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 447 | return PrivateKey::generateEcKey(ecParams.getKeySize()); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 448 | } |
| 449 | default: |
Davide Pesavento | f45fa21 | 2017-09-14 17:23:56 -0400 | [diff] [blame] | 450 | BOOST_THROW_EXCEPTION(std::invalid_argument("Unsupported asymmetric key type " + |
| 451 | boost::lexical_cast<std::string>(keyParams.getKeyType()))); |
Yingdi Yu | 202a2e9 | 2015-07-12 16:49:25 -0700 | [diff] [blame] | 452 | } |
| 453 | } |
| 454 | |
| 455 | } // namespace transform |
| 456 | } // namespace security |
| 457 | } // namespace ndn |