blob: 4c55d341b666fbf5401fe721ff077ff8dd504b8d [file] [log] [blame]
Paul Bakker1a7550a2013-09-15 13:01:22 +02001/*
2 * Public Key layer for parsing key files and structures
3 *
Bence Szépkúti1e148272020-08-07 13:07:28 +02004 * Copyright The Mbed TLS Contributors
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +02005 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
Paul Bakker1a7550a2013-09-15 13:01:22 +020018 */
19
Gilles Peskinedb09ef62020-06-03 01:43:33 +020020#include "common.h"
Paul Bakker1a7550a2013-09-15 13:01:22 +020021
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020022#if defined(MBEDTLS_PK_PARSE_C)
Paul Bakker1a7550a2013-09-15 13:01:22 +020023
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000024#include "mbedtls/pk.h"
25#include "mbedtls/asn1.h"
26#include "mbedtls/oid.h"
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050027#include "mbedtls/platform_util.h"
Janos Follath24eed8d2019-11-22 13:21:35 +000028#include "mbedtls/error.h"
Valerio Setti77a75682023-05-15 11:18:46 +020029#include "pk_internal.h"
Paul Bakker1a7550a2013-09-15 13:01:22 +020030
Rich Evans00ab4702015-02-06 13:43:58 +000031#include <string.h>
32
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020033#if defined(MBEDTLS_RSA_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000034#include "mbedtls/rsa.h"
Paul Bakker1a7550a2013-09-15 13:01:22 +020035#endif
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000036#include "mbedtls/ecp.h"
Jethro Beekman01672442023-04-19 14:08:14 +020037#if defined(MBEDTLS_RSA_C) || defined(MBEDTLS_ECP_C)
38#include "pkwrite.h"
Paul Bakker1a7550a2013-09-15 13:01:22 +020039#endif
Valerio Setti4064dbb2023-05-17 15:33:07 +020040#if defined(MBEDTLS_ECP_LIGHT)
41#include "pk_internal.h"
42#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020043#if defined(MBEDTLS_ECDSA_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000044#include "mbedtls/ecdsa.h"
Paul Bakker1a7550a2013-09-15 13:01:22 +020045#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020046#if defined(MBEDTLS_PEM_PARSE_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000047#include "mbedtls/pem.h"
Paul Bakker1a7550a2013-09-15 13:01:22 +020048#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020049#if defined(MBEDTLS_PKCS5_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000050#include "mbedtls/pkcs5.h"
Paul Bakker1a7550a2013-09-15 13:01:22 +020051#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020052#if defined(MBEDTLS_PKCS12_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000053#include "mbedtls/pkcs12.h"
Paul Bakker1a7550a2013-09-15 13:01:22 +020054#endif
55
Valerio Setti34f67552023-04-03 15:19:18 +020056#if defined(MBEDTLS_PSA_CRYPTO_C)
57#include "mbedtls/psa_util.h"
58#endif
59
60#if defined(MBEDTLS_USE_PSA_CRYPTO)
61#include "psa/crypto.h"
62#endif
63
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000064#include "mbedtls/platform.h"
Paul Bakker1a7550a2013-09-15 13:01:22 +020065
Valerio Settie0e63112023-05-18 18:48:07 +020066/* Helper for Montgomery curves */
67#if defined(MBEDTLS_ECP_LIGHT) && defined(MBEDTLS_PK_HAVE_RFC8410_CURVES)
68#define MBEDTLS_PK_IS_RFC8410_GROUP_ID(id) \
69 ((id == MBEDTLS_ECP_DP_CURVE25519) || (id == MBEDTLS_ECP_DP_CURVE448))
70#endif /* MBEDTLS_ECP_LIGHT && MBEDTLS_PK_HAVE_RFC8410_CURVES */
71
Gilles Peskine832f3492017-11-30 11:42:12 +010072#if defined(MBEDTLS_FS_IO)
Paul Bakker1a7550a2013-09-15 13:01:22 +020073/*
74 * Load all data from a file into a given buffer.
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +020075 *
76 * The file is expected to contain either PEM or DER encoded data.
77 * A terminating null byte is always appended. It is included in the announced
78 * length only if the data looks like it is PEM encoded.
Paul Bakker1a7550a2013-09-15 13:01:22 +020079 */
Gilles Peskine449bd832023-01-11 14:50:10 +010080int mbedtls_pk_load_file(const char *path, unsigned char **buf, size_t *n)
Paul Bakker1a7550a2013-09-15 13:01:22 +020081{
82 FILE *f;
83 long size;
84
Gilles Peskine449bd832023-01-11 14:50:10 +010085 if ((f = fopen(path, "rb")) == NULL) {
86 return MBEDTLS_ERR_PK_FILE_IO_ERROR;
87 }
Paul Bakker1a7550a2013-09-15 13:01:22 +020088
Gilles Peskineda0913b2022-06-30 17:03:40 +020089 /* Ensure no stdio buffering of secrets, as such buffers cannot be wiped. */
Gilles Peskine449bd832023-01-11 14:50:10 +010090 mbedtls_setbuf(f, NULL);
Gilles Peskineda0913b2022-06-30 17:03:40 +020091
Gilles Peskine449bd832023-01-11 14:50:10 +010092 fseek(f, 0, SEEK_END);
93 if ((size = ftell(f)) == -1) {
94 fclose(f);
95 return MBEDTLS_ERR_PK_FILE_IO_ERROR;
Paul Bakker1a7550a2013-09-15 13:01:22 +020096 }
Gilles Peskine449bd832023-01-11 14:50:10 +010097 fseek(f, 0, SEEK_SET);
Paul Bakker1a7550a2013-09-15 13:01:22 +020098
99 *n = (size_t) size;
100
Gilles Peskine449bd832023-01-11 14:50:10 +0100101 if (*n + 1 == 0 ||
102 (*buf = mbedtls_calloc(1, *n + 1)) == NULL) {
103 fclose(f);
104 return MBEDTLS_ERR_PK_ALLOC_FAILED;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200105 }
106
Gilles Peskine449bd832023-01-11 14:50:10 +0100107 if (fread(*buf, 1, *n, f) != *n) {
108 fclose(f);
Andres Amaya Garcia1f2666f2017-06-26 10:36:20 +0100109
Gilles Peskine449bd832023-01-11 14:50:10 +0100110 mbedtls_platform_zeroize(*buf, *n);
111 mbedtls_free(*buf);
Andres Amaya Garcia1f2666f2017-06-26 10:36:20 +0100112
Gilles Peskine449bd832023-01-11 14:50:10 +0100113 return MBEDTLS_ERR_PK_FILE_IO_ERROR;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200114 }
115
Gilles Peskine449bd832023-01-11 14:50:10 +0100116 fclose(f);
Paul Bakker1a7550a2013-09-15 13:01:22 +0200117
118 (*buf)[*n] = '\0';
119
Gilles Peskine449bd832023-01-11 14:50:10 +0100120 if (strstr((const char *) *buf, "-----BEGIN ") != NULL) {
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +0200121 ++*n;
Gilles Peskine449bd832023-01-11 14:50:10 +0100122 }
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +0200123
Gilles Peskine449bd832023-01-11 14:50:10 +0100124 return 0;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200125}
126
127/*
128 * Load and parse a private key
129 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100130int mbedtls_pk_parse_keyfile(mbedtls_pk_context *ctx,
131 const char *path, const char *pwd,
132 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng)
Paul Bakker1a7550a2013-09-15 13:01:22 +0200133{
Janos Follath24eed8d2019-11-22 13:21:35 +0000134 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200135 size_t n;
136 unsigned char *buf;
137
Gilles Peskine449bd832023-01-11 14:50:10 +0100138 if ((ret = mbedtls_pk_load_file(path, &buf, &n)) != 0) {
139 return ret;
140 }
Paul Bakker1a7550a2013-09-15 13:01:22 +0200141
Gilles Peskine449bd832023-01-11 14:50:10 +0100142 if (pwd == NULL) {
143 ret = mbedtls_pk_parse_key(ctx, buf, n, NULL, 0, f_rng, p_rng);
144 } else {
145 ret = mbedtls_pk_parse_key(ctx, buf, n,
146 (const unsigned char *) pwd, strlen(pwd), f_rng, p_rng);
147 }
Paul Bakker1a7550a2013-09-15 13:01:22 +0200148
Gilles Peskine449bd832023-01-11 14:50:10 +0100149 mbedtls_platform_zeroize(buf, n);
150 mbedtls_free(buf);
Paul Bakker1a7550a2013-09-15 13:01:22 +0200151
Gilles Peskine449bd832023-01-11 14:50:10 +0100152 return ret;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200153}
154
155/*
156 * Load and parse a public key
157 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100158int mbedtls_pk_parse_public_keyfile(mbedtls_pk_context *ctx, const char *path)
Paul Bakker1a7550a2013-09-15 13:01:22 +0200159{
Janos Follath24eed8d2019-11-22 13:21:35 +0000160 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200161 size_t n;
162 unsigned char *buf;
163
Gilles Peskine449bd832023-01-11 14:50:10 +0100164 if ((ret = mbedtls_pk_load_file(path, &buf, &n)) != 0) {
165 return ret;
166 }
Paul Bakker1a7550a2013-09-15 13:01:22 +0200167
Gilles Peskine449bd832023-01-11 14:50:10 +0100168 ret = mbedtls_pk_parse_public_key(ctx, buf, n);
Paul Bakker1a7550a2013-09-15 13:01:22 +0200169
Gilles Peskine449bd832023-01-11 14:50:10 +0100170 mbedtls_platform_zeroize(buf, n);
171 mbedtls_free(buf);
Paul Bakker1a7550a2013-09-15 13:01:22 +0200172
Gilles Peskine449bd832023-01-11 14:50:10 +0100173 return ret;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200174}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200175#endif /* MBEDTLS_FS_IO */
Paul Bakker1a7550a2013-09-15 13:01:22 +0200176
Valerio Setti0d2980f2023-04-05 18:17:13 +0200177#if defined(MBEDTLS_ECP_LIGHT)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200178/* Minimally parse an ECParameters buffer to and mbedtls_asn1_buf
Paul Bakker1a7550a2013-09-15 13:01:22 +0200179 *
180 * ECParameters ::= CHOICE {
181 * namedCurve OBJECT IDENTIFIER
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100182 * specifiedCurve SpecifiedECDomain -- = SEQUENCE { ... }
Paul Bakker1a7550a2013-09-15 13:01:22 +0200183 * -- implicitCurve NULL
Paul Bakker1a7550a2013-09-15 13:01:22 +0200184 * }
185 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100186static int pk_get_ecparams(unsigned char **p, const unsigned char *end,
187 mbedtls_asn1_buf *params)
Paul Bakker1a7550a2013-09-15 13:01:22 +0200188{
Janos Follath24eed8d2019-11-22 13:21:35 +0000189 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200190
Gilles Peskine449bd832023-01-11 14:50:10 +0100191 if (end - *p < 1) {
192 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT,
193 MBEDTLS_ERR_ASN1_OUT_OF_DATA);
194 }
Sanne Woudab2b29d52017-08-21 15:58:12 +0100195
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100196 /* Tag may be either OID or SEQUENCE */
Paul Bakker1a7550a2013-09-15 13:01:22 +0200197 params->tag = **p;
Gilles Peskine449bd832023-01-11 14:50:10 +0100198 if (params->tag != MBEDTLS_ASN1_OID
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200199#if defined(MBEDTLS_PK_PARSE_EC_EXTENDED)
Gilles Peskine449bd832023-01-11 14:50:10 +0100200 && params->tag != (MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)
Manuel Pégourié-Gonnard6fac3512014-03-19 16:39:52 +0100201#endif
Gilles Peskine449bd832023-01-11 14:50:10 +0100202 ) {
203 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT,
204 MBEDTLS_ERR_ASN1_UNEXPECTED_TAG);
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100205 }
Paul Bakker1a7550a2013-09-15 13:01:22 +0200206
Gilles Peskine449bd832023-01-11 14:50:10 +0100207 if ((ret = mbedtls_asn1_get_tag(p, end, &params->len, params->tag)) != 0) {
208 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret);
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100209 }
Paul Bakker1a7550a2013-09-15 13:01:22 +0200210
211 params->p = *p;
212 *p += params->len;
213
Gilles Peskine449bd832023-01-11 14:50:10 +0100214 if (*p != end) {
215 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT,
216 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
217 }
Paul Bakker1a7550a2013-09-15 13:01:22 +0200218
Gilles Peskine449bd832023-01-11 14:50:10 +0100219 return 0;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200220}
221
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200222#if defined(MBEDTLS_PK_PARSE_EC_EXTENDED)
Paul Bakker1a7550a2013-09-15 13:01:22 +0200223/*
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100224 * Parse a SpecifiedECDomain (SEC 1 C.2) and (mostly) fill the group with it.
225 * WARNING: the resulting group should only be used with
226 * pk_group_id_from_specified(), since its base point may not be set correctly
227 * if it was encoded compressed.
228 *
229 * SpecifiedECDomain ::= SEQUENCE {
230 * version SpecifiedECDomainVersion(ecdpVer1 | ecdpVer2 | ecdpVer3, ...),
231 * fieldID FieldID {{FieldTypes}},
232 * curve Curve,
233 * base ECPoint,
234 * order INTEGER,
235 * cofactor INTEGER OPTIONAL,
236 * hash HashAlgorithm OPTIONAL,
237 * ...
238 * }
239 *
240 * We only support prime-field as field type, and ignore hash and cofactor.
241 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100242static int pk_group_from_specified(const mbedtls_asn1_buf *params, mbedtls_ecp_group *grp)
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100243{
Janos Follath24eed8d2019-11-22 13:21:35 +0000244 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100245 unsigned char *p = params->p;
Jethro Beekman01672442023-04-19 14:08:14 +0200246 const unsigned char *const end = params->p + params->len;
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100247 const unsigned char *end_field, *end_curve;
248 size_t len;
249 int ver;
250
251 /* SpecifiedECDomainVersion ::= INTEGER { 1, 2, 3 } */
Gilles Peskine449bd832023-01-11 14:50:10 +0100252 if ((ret = mbedtls_asn1_get_int(&p, end, &ver)) != 0) {
253 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret);
254 }
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100255
Gilles Peskine449bd832023-01-11 14:50:10 +0100256 if (ver < 1 || ver > 3) {
257 return MBEDTLS_ERR_PK_KEY_INVALID_FORMAT;
258 }
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100259
260 /*
261 * FieldID { FIELD-ID:IOSet } ::= SEQUENCE { -- Finite field
262 * fieldType FIELD-ID.&id({IOSet}),
263 * parameters FIELD-ID.&Type({IOSet}{@fieldType})
264 * }
265 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100266 if ((ret = mbedtls_asn1_get_tag(&p, end, &len,
267 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) {
268 return ret;
269 }
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100270
271 end_field = p + len;
272
273 /*
274 * FIELD-ID ::= TYPE-IDENTIFIER
275 * FieldTypes FIELD-ID ::= {
276 * { Prime-p IDENTIFIED BY prime-field } |
277 * { Characteristic-two IDENTIFIED BY characteristic-two-field }
278 * }
279 * prime-field OBJECT IDENTIFIER ::= { id-fieldType 1 }
280 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100281 if ((ret = mbedtls_asn1_get_tag(&p, end_field, &len, MBEDTLS_ASN1_OID)) != 0) {
282 return ret;
283 }
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100284
Gilles Peskine449bd832023-01-11 14:50:10 +0100285 if (len != MBEDTLS_OID_SIZE(MBEDTLS_OID_ANSI_X9_62_PRIME_FIELD) ||
286 memcmp(p, MBEDTLS_OID_ANSI_X9_62_PRIME_FIELD, len) != 0) {
287 return MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE;
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100288 }
289
290 p += len;
291
292 /* Prime-p ::= INTEGER -- Field of size p. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100293 if ((ret = mbedtls_asn1_get_mpi(&p, end_field, &grp->P)) != 0) {
294 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret);
295 }
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100296
Gilles Peskine449bd832023-01-11 14:50:10 +0100297 grp->pbits = mbedtls_mpi_bitlen(&grp->P);
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100298
Gilles Peskine449bd832023-01-11 14:50:10 +0100299 if (p != end_field) {
300 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT,
301 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
302 }
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100303
304 /*
305 * Curve ::= SEQUENCE {
306 * a FieldElement,
307 * b FieldElement,
308 * seed BIT STRING OPTIONAL
309 * -- Shall be present if used in SpecifiedECDomain
310 * -- with version equal to ecdpVer2 or ecdpVer3
311 * }
312 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100313 if ((ret = mbedtls_asn1_get_tag(&p, end, &len,
314 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) {
315 return ret;
316 }
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100317
318 end_curve = p + len;
319
320 /*
321 * FieldElement ::= OCTET STRING
322 * containing an integer in the case of a prime field
323 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100324 if ((ret = mbedtls_asn1_get_tag(&p, end_curve, &len, MBEDTLS_ASN1_OCTET_STRING)) != 0 ||
325 (ret = mbedtls_mpi_read_binary(&grp->A, p, len)) != 0) {
326 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret);
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100327 }
328
329 p += len;
330
Gilles Peskine449bd832023-01-11 14:50:10 +0100331 if ((ret = mbedtls_asn1_get_tag(&p, end_curve, &len, MBEDTLS_ASN1_OCTET_STRING)) != 0 ||
332 (ret = mbedtls_mpi_read_binary(&grp->B, p, len)) != 0) {
333 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret);
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100334 }
335
336 p += len;
337
338 /* Ignore seed BIT STRING OPTIONAL */
Gilles Peskine449bd832023-01-11 14:50:10 +0100339 if ((ret = mbedtls_asn1_get_tag(&p, end_curve, &len, MBEDTLS_ASN1_BIT_STRING)) == 0) {
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100340 p += len;
Gilles Peskine449bd832023-01-11 14:50:10 +0100341 }
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100342
Gilles Peskine449bd832023-01-11 14:50:10 +0100343 if (p != end_curve) {
344 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT,
345 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
346 }
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100347
348 /*
349 * ECPoint ::= OCTET STRING
350 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100351 if ((ret = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_OCTET_STRING)) != 0) {
352 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret);
353 }
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100354
Gilles Peskine449bd832023-01-11 14:50:10 +0100355 if ((ret = mbedtls_ecp_point_read_binary(grp, &grp->G,
356 (const unsigned char *) p, len)) != 0) {
Manuel Pégourié-Gonnard5246ee52014-03-19 16:18:38 +0100357 /*
358 * If we can't read the point because it's compressed, cheat by
359 * reading only the X coordinate and the parity bit of Y.
360 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100361 if (ret != MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE ||
362 (p[0] != 0x02 && p[0] != 0x03) ||
363 len != mbedtls_mpi_size(&grp->P) + 1 ||
364 mbedtls_mpi_read_binary(&grp->G.X, p + 1, len - 1) != 0 ||
365 mbedtls_mpi_lset(&grp->G.Y, p[0] - 2) != 0 ||
366 mbedtls_mpi_lset(&grp->G.Z, 1) != 0) {
367 return MBEDTLS_ERR_PK_KEY_INVALID_FORMAT;
Manuel Pégourié-Gonnard5246ee52014-03-19 16:18:38 +0100368 }
369 }
370
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100371 p += len;
372
373 /*
374 * order INTEGER
375 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100376 if ((ret = mbedtls_asn1_get_mpi(&p, end, &grp->N)) != 0) {
377 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret);
378 }
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100379
Gilles Peskine449bd832023-01-11 14:50:10 +0100380 grp->nbits = mbedtls_mpi_bitlen(&grp->N);
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100381
382 /*
383 * Allow optional elements by purposefully not enforcing p == end here.
384 */
385
Gilles Peskine449bd832023-01-11 14:50:10 +0100386 return 0;
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100387}
388
389/*
390 * Find the group id associated with an (almost filled) group as generated by
391 * pk_group_from_specified(), or return an error if unknown.
392 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100393static int pk_group_id_from_group(const mbedtls_ecp_group *grp, mbedtls_ecp_group_id *grp_id)
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100394{
Manuel Pégourié-Gonnard5b8c4092014-03-27 14:59:42 +0100395 int ret = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200396 mbedtls_ecp_group ref;
397 const mbedtls_ecp_group_id *id;
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100398
Gilles Peskine449bd832023-01-11 14:50:10 +0100399 mbedtls_ecp_group_init(&ref);
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100400
Gilles Peskine449bd832023-01-11 14:50:10 +0100401 for (id = mbedtls_ecp_grp_id_list(); *id != MBEDTLS_ECP_DP_NONE; id++) {
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100402 /* Load the group associated to that id */
Gilles Peskine449bd832023-01-11 14:50:10 +0100403 mbedtls_ecp_group_free(&ref);
404 MBEDTLS_MPI_CHK(mbedtls_ecp_group_load(&ref, *id));
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100405
406 /* Compare to the group we were given, starting with easy tests */
Gilles Peskine449bd832023-01-11 14:50:10 +0100407 if (grp->pbits == ref.pbits && grp->nbits == ref.nbits &&
408 mbedtls_mpi_cmp_mpi(&grp->P, &ref.P) == 0 &&
409 mbedtls_mpi_cmp_mpi(&grp->A, &ref.A) == 0 &&
410 mbedtls_mpi_cmp_mpi(&grp->B, &ref.B) == 0 &&
411 mbedtls_mpi_cmp_mpi(&grp->N, &ref.N) == 0 &&
412 mbedtls_mpi_cmp_mpi(&grp->G.X, &ref.G.X) == 0 &&
413 mbedtls_mpi_cmp_mpi(&grp->G.Z, &ref.G.Z) == 0 &&
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100414 /* For Y we may only know the parity bit, so compare only that */
Gilles Peskine449bd832023-01-11 14:50:10 +0100415 mbedtls_mpi_get_bit(&grp->G.Y, 0) == mbedtls_mpi_get_bit(&ref.G.Y, 0)) {
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100416 break;
417 }
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100418 }
419
420cleanup:
Gilles Peskine449bd832023-01-11 14:50:10 +0100421 mbedtls_ecp_group_free(&ref);
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100422
423 *grp_id = *id;
424
Gilles Peskine449bd832023-01-11 14:50:10 +0100425 if (ret == 0 && *id == MBEDTLS_ECP_DP_NONE) {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200426 ret = MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE;
Gilles Peskine449bd832023-01-11 14:50:10 +0100427 }
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100428
Gilles Peskine449bd832023-01-11 14:50:10 +0100429 return ret;
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100430}
431
432/*
433 * Parse a SpecifiedECDomain (SEC 1 C.2) and find the associated group ID
434 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100435static int pk_group_id_from_specified(const mbedtls_asn1_buf *params,
436 mbedtls_ecp_group_id *grp_id)
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100437{
Janos Follath24eed8d2019-11-22 13:21:35 +0000438 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200439 mbedtls_ecp_group grp;
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100440
Gilles Peskine449bd832023-01-11 14:50:10 +0100441 mbedtls_ecp_group_init(&grp);
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100442
Gilles Peskine449bd832023-01-11 14:50:10 +0100443 if ((ret = pk_group_from_specified(params, &grp)) != 0) {
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100444 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +0100445 }
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100446
Gilles Peskine449bd832023-01-11 14:50:10 +0100447 ret = pk_group_id_from_group(&grp, grp_id);
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100448
449cleanup:
Minos Galanakis8692ec82023-01-20 15:27:32 +0000450 /* The API respecting lifecycle for mbedtls_ecp_group struct is
451 * _init(), _load() and _free(). In pk_group_id_from_specified() the
452 * temporary grp breaks that flow and it's members are populated
453 * by pk_group_id_from_group(). As such mbedtls_ecp_group_free()
454 * which is assuming a group populated by _setup() may not clean-up
455 * properly -> Manually free it's members.
456 */
Minos Galanakisc8e381a2023-01-19 16:08:34 +0000457 mbedtls_mpi_free(&grp.N);
458 mbedtls_mpi_free(&grp.P);
459 mbedtls_mpi_free(&grp.A);
460 mbedtls_mpi_free(&grp.B);
461 mbedtls_ecp_point_free(&grp.G);
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100462
Gilles Peskine449bd832023-01-11 14:50:10 +0100463 return ret;
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100464}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200465#endif /* MBEDTLS_PK_PARSE_EC_EXTENDED */
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100466
Valerio Setti4064dbb2023-05-17 15:33:07 +0200467#if defined(MBEDTLS_PK_USE_PSA_EC_DATA)
468/* Functions pk_use_ecparams() and pk_use_ecparams_rfc8410() update the
469 * ecp_keypair structure with proper group ID. The purpose of this helper
470 * function is to update ec_family and ec_bits accordingly. */
471static int pk_update_psa_ecparams(mbedtls_pk_context *pk,
472 mbedtls_ecp_group_id grp_id)
473{
474 psa_ecc_family_t ec_family;
475 size_t bits;
476
477 ec_family = mbedtls_ecc_group_to_psa(grp_id, &bits);
478
479 if ((pk->ec_family != 0) && (pk->ec_family != ec_family)) {
480 return MBEDTLS_ERR_PK_KEY_INVALID_FORMAT;
481 }
482
483 pk->ec_family = ec_family;
484 pk->ec_bits = bits;
485
486 return 0;
487}
488#endif /* MBEDTLS_PK_USE_PSA_EC_DATA */
489
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100490/*
Paul Bakker1a7550a2013-09-15 13:01:22 +0200491 * Use EC parameters to initialise an EC group
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100492 *
493 * ECParameters ::= CHOICE {
494 * namedCurve OBJECT IDENTIFIER
495 * specifiedCurve SpecifiedECDomain -- = SEQUENCE { ... }
496 * -- implicitCurve NULL
Paul Bakker1a7550a2013-09-15 13:01:22 +0200497 */
Valerio Setti4064dbb2023-05-17 15:33:07 +0200498static int pk_use_ecparams(const mbedtls_asn1_buf *params, mbedtls_pk_context *pk)
Paul Bakker1a7550a2013-09-15 13:01:22 +0200499{
Janos Follath24eed8d2019-11-22 13:21:35 +0000500 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200501 mbedtls_ecp_group_id grp_id;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200502
Gilles Peskine449bd832023-01-11 14:50:10 +0100503 if (params->tag == MBEDTLS_ASN1_OID) {
504 if (mbedtls_oid_get_ec_grp(params, &grp_id) != 0) {
505 return MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE;
506 }
507 } else {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200508#if defined(MBEDTLS_PK_PARSE_EC_EXTENDED)
Gilles Peskine449bd832023-01-11 14:50:10 +0100509 if ((ret = pk_group_id_from_specified(params, &grp_id)) != 0) {
510 return ret;
511 }
Manuel Pégourié-Gonnard6fac3512014-03-19 16:39:52 +0100512#else
Gilles Peskine449bd832023-01-11 14:50:10 +0100513 return MBEDTLS_ERR_PK_KEY_INVALID_FORMAT;
Manuel Pégourié-Gonnard6fac3512014-03-19 16:39:52 +0100514#endif
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +0100515 }
Paul Bakker1a7550a2013-09-15 13:01:22 +0200516
Valerio Setti00e8dd12023-05-18 18:56:59 +0200517#if defined(MBEDTLS_PK_USE_PSA_EC_DATA)
518 ret = pk_update_psa_ecparams(pk, grp_id);
519#else
Valerio Setti4064dbb2023-05-17 15:33:07 +0200520 /* grp may already be initialized; if so, make sure IDs match */
521 if (mbedtls_pk_ec_ro(*pk)->grp.id != MBEDTLS_ECP_DP_NONE &&
522 mbedtls_pk_ec_ro(*pk)->grp.id != grp_id) {
Gilles Peskine449bd832023-01-11 14:50:10 +0100523 return MBEDTLS_ERR_PK_KEY_INVALID_FORMAT;
524 }
Paul Bakker1a7550a2013-09-15 13:01:22 +0200525
Valerio Setti4064dbb2023-05-17 15:33:07 +0200526 if ((ret = mbedtls_ecp_group_load(&(mbedtls_pk_ec_rw(*pk)->grp),
527 grp_id)) != 0) {
Gilles Peskine449bd832023-01-11 14:50:10 +0100528 return ret;
529 }
Valerio Setti4064dbb2023-05-17 15:33:07 +0200530#endif /* MBEDTLS_PK_USE_PSA_EC_DATA */
Paul Bakker1a7550a2013-09-15 13:01:22 +0200531
Valerio Setti4064dbb2023-05-17 15:33:07 +0200532 return ret;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200533}
534
Jethro Beekman01672442023-04-19 14:08:14 +0200535/*
536 * Helper function for deriving a public key from its private counterpart.
537 */
Valerio Setti4064dbb2023-05-17 15:33:07 +0200538static int pk_derive_public_key(mbedtls_pk_context *pk,
Jethro Beekman01672442023-04-19 14:08:14 +0200539 const unsigned char *d, size_t d_len,
540 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng)
541{
542 int ret;
543#if defined(MBEDTLS_USE_PSA_CRYPTO)
Valerio Setti00e8dd12023-05-18 18:56:59 +0200544 psa_status_t status;
545 (void) f_rng;
546 (void) p_rng;
547#if defined(MBEDTLS_PK_USE_PSA_EC_DATA)
548 (void) d;
549 (void) d_len;
550
551 status = psa_export_public_key(pk->priv_id, pk->pub_raw, sizeof(pk->pub_raw),
552 &pk->pub_raw_len);
553 ret = psa_pk_status_to_mbedtls(status);
554#else /* MBEDTLS_PK_USE_PSA_EC_DATA */
555 mbedtls_ecp_keypair *eck = (mbedtls_ecp_keypair *) pk->pk_ctx;
556 unsigned char key_buf[MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH];
557 size_t key_len;
558 mbedtls_svc_key_id_t key_id = MBEDTLS_SVC_KEY_ID_INIT;
Jethro Beekman01672442023-04-19 14:08:14 +0200559 psa_key_attributes_t key_attr = PSA_KEY_ATTRIBUTES_INIT;
560 size_t curve_bits;
561 psa_ecc_family_t curve = mbedtls_ecc_group_to_psa(eck->grp.id, &curve_bits);
Valerio Setti00e8dd12023-05-18 18:56:59 +0200562 psa_status_t destruction_status;
Jethro Beekman01672442023-04-19 14:08:14 +0200563
564 psa_set_key_type(&key_attr, PSA_KEY_TYPE_ECC_KEY_PAIR(curve));
565 psa_set_key_usage_flags(&key_attr, PSA_KEY_USAGE_EXPORT);
566
567 status = psa_import_key(&key_attr, d, d_len, &key_id);
568 ret = psa_pk_status_to_mbedtls(status);
569 if (ret != 0) {
570 return ret;
571 }
572
Jethro Beekman01672442023-04-19 14:08:14 +0200573 status = psa_export_public_key(key_id, key_buf, sizeof(key_buf), &key_len);
574 ret = psa_pk_status_to_mbedtls(status);
575 destruction_status = psa_destroy_key(key_id);
576 if (ret != 0) {
577 return ret;
578 } else if (destruction_status != PSA_SUCCESS) {
579 return psa_pk_status_to_mbedtls(destruction_status);
580 }
Jethro Beekman01672442023-04-19 14:08:14 +0200581 ret = mbedtls_ecp_point_read_binary(&eck->grp, &eck->Q, key_buf, key_len);
Valerio Setti00e8dd12023-05-18 18:56:59 +0200582#endif /* MBEDTLS_PK_USE_PSA_EC_DATA */
Jethro Beekman01672442023-04-19 14:08:14 +0200583#else /* MBEDTLS_USE_PSA_CRYPTO */
Valerio Setti00e8dd12023-05-18 18:56:59 +0200584 mbedtls_ecp_keypair *eck = (mbedtls_ecp_keypair *) pk->pk_ctx;
Jethro Beekman01672442023-04-19 14:08:14 +0200585 (void) d;
586 (void) d_len;
587
588 ret = mbedtls_ecp_mul(&eck->grp, &eck->Q, &eck->d, &eck->grp.G, f_rng, p_rng);
589#endif /* MBEDTLS_USE_PSA_CRYPTO */
590 return ret;
591}
592
593#if defined(MBEDTLS_PK_HAVE_RFC8410_CURVES)
594
595/*
596 * Load an RFC8410 EC key, which doesn't have any parameters
597 */
598static int pk_use_ecparams_rfc8410(const mbedtls_asn1_buf *params,
599 mbedtls_ecp_group_id grp_id,
Valerio Setti4064dbb2023-05-17 15:33:07 +0200600 mbedtls_pk_context *pk)
Jethro Beekman01672442023-04-19 14:08:14 +0200601{
Valerio Setti4064dbb2023-05-17 15:33:07 +0200602 int ret;
603
Jethro Beekman01672442023-04-19 14:08:14 +0200604 if (params->tag != 0 || params->len != 0) {
605 return MBEDTLS_ERR_PK_KEY_INVALID_FORMAT;
606 }
607
Valerio Setti00e8dd12023-05-18 18:56:59 +0200608#if defined(MBEDTLS_PK_USE_PSA_EC_DATA)
609 ret = pk_update_psa_ecparams(pk, grp_id);
610#else
611 mbedtls_ecp_keypair *ecp = mbedtls_pk_ec_rw(*pk);
Valerio Setti4064dbb2023-05-17 15:33:07 +0200612 ret = mbedtls_ecp_group_load(&(ecp->grp), grp_id);
613 if (ret != 0) {
614 return ret;
615 }
Valerio Setti00e8dd12023-05-18 18:56:59 +0200616#endif
Valerio Setti4064dbb2023-05-17 15:33:07 +0200617 return ret;
Jethro Beekman01672442023-04-19 14:08:14 +0200618}
619
620/*
621 * Parse an RFC 8410 encoded private EC key
622 *
623 * CurvePrivateKey ::= OCTET STRING
624 */
Valerio Setti4064dbb2023-05-17 15:33:07 +0200625static int pk_parse_key_rfc8410_der(mbedtls_pk_context *pk,
Jethro Beekman01672442023-04-19 14:08:14 +0200626 unsigned char *key, size_t keylen, const unsigned char *end,
627 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng)
628{
629 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
630 size_t len;
631
632 if ((ret = mbedtls_asn1_get_tag(&key, (key + keylen), &len, MBEDTLS_ASN1_OCTET_STRING)) != 0) {
633 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret);
634 }
635
636 if (key + len != end) {
637 return MBEDTLS_ERR_PK_KEY_INVALID_FORMAT;
638 }
639
Valerio Setti00e8dd12023-05-18 18:56:59 +0200640#if defined(MBEDTLS_PK_USE_PSA_EC_DATA)
641 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
642 psa_status_t status;
643
644 psa_set_key_type(&attributes, PSA_KEY_TYPE_ECC_KEY_PAIR(pk->ec_family));
Valerio Setti51aa52e2023-05-24 12:37:50 +0200645 psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_EXPORT |
646 PSA_KEY_USAGE_DERIVE);
647 psa_set_key_algorithm(&attributes, PSA_ALG_ECDH);
Valerio Setti00e8dd12023-05-18 18:56:59 +0200648
649 status = psa_import_key(&attributes, key, len, &pk->priv_id);
650 if (status != PSA_SUCCESS) {
651 ret = psa_pk_status_to_mbedtls(status);
652 return ret;
653 }
654#else /* MBEDTLS_PK_USE_PSA_EC_DATA */
655 mbedtls_ecp_keypair *eck = mbedtls_pk_ec_rw(*pk);
656
Jethro Beekman01672442023-04-19 14:08:14 +0200657 if ((ret = mbedtls_mpi_read_binary_le(&eck->d, key, len)) != 0) {
658 mbedtls_ecp_keypair_free(eck);
659 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret);
660 }
Valerio Setti00e8dd12023-05-18 18:56:59 +0200661#endif /* MBEDTLS_PK_USE_PSA_EC_DATA */
Jethro Beekman01672442023-04-19 14:08:14 +0200662
Valerio Setti4064dbb2023-05-17 15:33:07 +0200663 /* pk_parse_key_pkcs8_unencrypted_der() only supports version 1 PKCS8 keys,
664 * which never contain a public key. As such, derive the public key
665 * unconditionally. */
666 if ((ret = pk_derive_public_key(pk, key, len, f_rng, p_rng)) != 0) {
Valerio Setti00e8dd12023-05-18 18:56:59 +0200667#if !defined(MBEDTLS_PK_USE_PSA_EC_DATA)
Jethro Beekman01672442023-04-19 14:08:14 +0200668 mbedtls_ecp_keypair_free(eck);
Valerio Setti00e8dd12023-05-18 18:56:59 +0200669#endif /* !MBEDTLS_PK_USE_PSA_EC_DATA */
Jethro Beekman01672442023-04-19 14:08:14 +0200670 return ret;
671 }
672
Valerio Setti00e8dd12023-05-18 18:56:59 +0200673 /* When MBEDTLS_PK_USE_PSA_EC_DATA the key is checked while importing it
674 * into PSA. */
675#if !defined(MBEDTLS_PK_USE_PSA_EC_DATA)
Jethro Beekman01672442023-04-19 14:08:14 +0200676 if ((ret = mbedtls_ecp_check_privkey(&eck->grp, &eck->d)) != 0) {
677 mbedtls_ecp_keypair_free(eck);
678 return ret;
679 }
Valerio Setti00e8dd12023-05-18 18:56:59 +0200680#endif /* !MBEDTLS_PK_USE_PSA_EC_DATA */
Jethro Beekman01672442023-04-19 14:08:14 +0200681
682 return 0;
683}
684#endif /* MBEDTLS_PK_HAVE_RFC8410_CURVES */
Valerio Setti4064dbb2023-05-17 15:33:07 +0200685
Valerio Settiaddeee42023-06-14 10:46:55 +0200686#if defined(MBEDTLS_PK_USE_PSA_EC_DATA) && defined(MBEDTLS_PK_PARSE_EC_COMPRESSED)
Valerio Setti4064dbb2023-05-17 15:33:07 +0200687/*
688 * Create a temporary ecp_keypair for converting an EC point in compressed
689 * format to an uncompressed one
690 */
691static int pk_convert_compressed_ec(mbedtls_pk_context *pk,
692 const unsigned char *in_start, size_t in_len,
693 size_t *out_buf_len, unsigned char *out_buf,
694 size_t out_buf_size)
695{
696 mbedtls_ecp_keypair ecp_key;
697 mbedtls_ecp_group_id ecp_group_id;
698 int ret;
699
700 ecp_group_id = mbedtls_ecc_group_of_psa(pk->ec_family, pk->ec_bits, 0);
701
702 mbedtls_ecp_keypair_init(&ecp_key);
703 ret = mbedtls_ecp_group_load(&(ecp_key.grp), ecp_group_id);
704 if (ret != 0) {
705 return ret;
706 }
707 ret = mbedtls_ecp_point_read_binary(&(ecp_key.grp), &ecp_key.Q,
708 in_start, in_len);
709 if (ret != 0) {
710 goto exit;
711 }
712 ret = mbedtls_ecp_point_write_binary(&(ecp_key.grp), &ecp_key.Q,
713 MBEDTLS_ECP_PF_UNCOMPRESSED,
714 out_buf_len, out_buf, out_buf_size);
715
716exit:
717 mbedtls_ecp_keypair_free(&ecp_key);
718 return ret;
719}
Valerio Settiaddeee42023-06-14 10:46:55 +0200720#endif /* MBEDTLS_PK_USE_PSA_EC_DATA && MBEDTLS_PK_PARSE_EC_COMPRESSED */
Jethro Beekman01672442023-04-19 14:08:14 +0200721
Paul Bakker1a7550a2013-09-15 13:01:22 +0200722/*
723 * EC public key is an EC point
Manuel Pégourié-Gonnard5246ee52014-03-19 16:18:38 +0100724 *
725 * The caller is responsible for clearing the structure upon failure if
726 * desired. Take care to pass along the possible ECP_FEATURE_UNAVAILABLE
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200727 * return code of mbedtls_ecp_point_read_binary() and leave p in a usable state.
Paul Bakker1a7550a2013-09-15 13:01:22 +0200728 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100729static int pk_get_ecpubkey(unsigned char **p, const unsigned char *end,
Valerio Setti4064dbb2023-05-17 15:33:07 +0200730 mbedtls_pk_context *pk)
Paul Bakker1a7550a2013-09-15 13:01:22 +0200731{
Janos Follath24eed8d2019-11-22 13:21:35 +0000732 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200733
Valerio Setti4064dbb2023-05-17 15:33:07 +0200734#if defined(MBEDTLS_PK_USE_PSA_EC_DATA)
735 mbedtls_svc_key_id_t key;
736 psa_key_attributes_t key_attrs = PSA_KEY_ATTRIBUTES_INIT;
737 size_t len = (end - *p);
738
739 if (len > PSA_EXPORT_PUBLIC_KEY_MAX_SIZE) {
740 return MBEDTLS_ERR_PK_BAD_INPUT_DATA;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200741 }
742
Valerio Setti4064dbb2023-05-17 15:33:07 +0200743 /* Compressed point format are not supported yet by PSA crypto. As a
744 * consequence ecp functions are used to "convert" the point to
745 * uncompressed format */
746 if ((**p == 0x02) || (**p == 0x03)) {
Valerio Settiaddeee42023-06-14 10:46:55 +0200747#if defined(MBEDTLS_PK_PARSE_EC_COMPRESSED)
Valerio Setti4064dbb2023-05-17 15:33:07 +0200748 ret = pk_convert_compressed_ec(pk, *p, len,
749 &(pk->pub_raw_len), pk->pub_raw,
750 PSA_EXPORT_PUBLIC_KEY_MAX_SIZE);
751 if (ret != 0) {
752 return ret;
753 }
Valerio Settiaddeee42023-06-14 10:46:55 +0200754#else /* MBEDTLS_PK_PARSE_EC_COMPRESSED */
755 return MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE;
756#endif /* MBEDTLS_PK_PARSE_EC_COMPRESSED */
Valerio Setti4064dbb2023-05-17 15:33:07 +0200757 } else {
758 /* Uncompressed format */
759 if ((end - *p) > MBEDTLS_PK_MAX_EC_PUBKEY_RAW_LEN) {
Valerio Setti016264b2023-05-22 18:40:35 +0200760 return MBEDTLS_ERR_PK_BUFFER_TOO_SMALL;
Valerio Setti4064dbb2023-05-17 15:33:07 +0200761 }
762 memcpy(pk->pub_raw, *p, (end - *p));
763 pk->pub_raw_len = end - *p;
764 }
765
766 /* Validate the key by trying to importing it */
767 psa_set_key_usage_flags(&key_attrs, 0);
768 psa_set_key_algorithm(&key_attrs, PSA_ALG_ECDSA_ANY);
769 psa_set_key_type(&key_attrs, PSA_KEY_TYPE_ECC_PUBLIC_KEY(pk->ec_family));
770 psa_set_key_bits(&key_attrs, pk->ec_bits);
771
772 if ((psa_import_key(&key_attrs, pk->pub_raw, pk->pub_raw_len,
773 &key) != PSA_SUCCESS) ||
774 (psa_destroy_key(key) != PSA_SUCCESS)) {
775 mbedtls_platform_zeroize(pk->pub_raw, MBEDTLS_PK_MAX_EC_PUBKEY_RAW_LEN);
776 pk->pub_raw_len = 0;
777 return MBEDTLS_ERR_PK_BAD_INPUT_DATA;
778 }
779 ret = 0;
780#else /* MBEDTLS_PK_USE_PSA_EC_DATA */
781 mbedtls_ecp_keypair *ec_key = (mbedtls_ecp_keypair *) pk->pk_ctx;
782 if ((ret = mbedtls_ecp_point_read_binary(&ec_key->grp, &ec_key->Q,
783 (const unsigned char *) *p,
784 end - *p)) == 0) {
785 ret = mbedtls_ecp_check_pubkey(&ec_key->grp, &ec_key->Q);
786 }
787#endif /* MBEDTLS_PK_USE_PSA_EC_DATA */
788
Paul Bakker1a7550a2013-09-15 13:01:22 +0200789 /*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200790 * We know mbedtls_ecp_point_read_binary consumed all bytes or failed
Paul Bakker1a7550a2013-09-15 13:01:22 +0200791 */
792 *p = (unsigned char *) end;
793
Gilles Peskine449bd832023-01-11 14:50:10 +0100794 return ret;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200795}
Valerio Setti0d2980f2023-04-05 18:17:13 +0200796#endif /* MBEDTLS_ECP_LIGHT */
Paul Bakker1a7550a2013-09-15 13:01:22 +0200797
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200798#if defined(MBEDTLS_RSA_C)
Paul Bakker1a7550a2013-09-15 13:01:22 +0200799/*
800 * RSAPublicKey ::= SEQUENCE {
801 * modulus INTEGER, -- n
802 * publicExponent INTEGER -- e
803 * }
804 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100805static int pk_get_rsapubkey(unsigned char **p,
806 const unsigned char *end,
807 mbedtls_rsa_context *rsa)
Paul Bakker1a7550a2013-09-15 13:01:22 +0200808{
Janos Follath24eed8d2019-11-22 13:21:35 +0000809 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200810 size_t len;
811
Gilles Peskine449bd832023-01-11 14:50:10 +0100812 if ((ret = mbedtls_asn1_get_tag(p, end, &len,
813 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) {
814 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_INVALID_PUBKEY, ret);
815 }
Paul Bakker1a7550a2013-09-15 13:01:22 +0200816
Gilles Peskine449bd832023-01-11 14:50:10 +0100817 if (*p + len != end) {
818 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_INVALID_PUBKEY,
819 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
820 }
Paul Bakker1a7550a2013-09-15 13:01:22 +0200821
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100822 /* Import N */
Gilles Peskine449bd832023-01-11 14:50:10 +0100823 if ((ret = mbedtls_asn1_get_tag(p, end, &len, MBEDTLS_ASN1_INTEGER)) != 0) {
824 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_INVALID_PUBKEY, ret);
825 }
Paul Bakker1a7550a2013-09-15 13:01:22 +0200826
Gilles Peskine449bd832023-01-11 14:50:10 +0100827 if ((ret = mbedtls_rsa_import_raw(rsa, *p, len, NULL, 0, NULL, 0,
828 NULL, 0, NULL, 0)) != 0) {
829 return MBEDTLS_ERR_PK_INVALID_PUBKEY;
830 }
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100831
832 *p += len;
833
834 /* Import E */
Gilles Peskine449bd832023-01-11 14:50:10 +0100835 if ((ret = mbedtls_asn1_get_tag(p, end, &len, MBEDTLS_ASN1_INTEGER)) != 0) {
836 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_INVALID_PUBKEY, ret);
837 }
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100838
Gilles Peskine449bd832023-01-11 14:50:10 +0100839 if ((ret = mbedtls_rsa_import_raw(rsa, NULL, 0, NULL, 0, NULL, 0,
840 NULL, 0, *p, len)) != 0) {
841 return MBEDTLS_ERR_PK_INVALID_PUBKEY;
842 }
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100843
844 *p += len;
845
Gilles Peskine449bd832023-01-11 14:50:10 +0100846 if (mbedtls_rsa_complete(rsa) != 0 ||
847 mbedtls_rsa_check_pubkey(rsa) != 0) {
848 return MBEDTLS_ERR_PK_INVALID_PUBKEY;
Hanno Becker895c5ab2018-01-05 08:08:09 +0000849 }
Hanno Beckerd58c5b22017-08-22 14:33:21 +0100850
Gilles Peskine449bd832023-01-11 14:50:10 +0100851 if (*p != end) {
852 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_INVALID_PUBKEY,
853 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
854 }
Paul Bakker1a7550a2013-09-15 13:01:22 +0200855
Gilles Peskine449bd832023-01-11 14:50:10 +0100856 return 0;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200857}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200858#endif /* MBEDTLS_RSA_C */
Paul Bakker1a7550a2013-09-15 13:01:22 +0200859
860/* Get a PK algorithm identifier
861 *
862 * AlgorithmIdentifier ::= SEQUENCE {
863 * algorithm OBJECT IDENTIFIER,
864 * parameters ANY DEFINED BY algorithm OPTIONAL }
865 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100866static int pk_get_pk_alg(unsigned char **p,
867 const unsigned char *end,
Jethro Beekman01672442023-04-19 14:08:14 +0200868 mbedtls_pk_type_t *pk_alg, mbedtls_asn1_buf *params,
869 mbedtls_ecp_group_id *ec_grp_id)
Paul Bakker1a7550a2013-09-15 13:01:22 +0200870{
Janos Follath24eed8d2019-11-22 13:21:35 +0000871 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200872 mbedtls_asn1_buf alg_oid;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200873
Gilles Peskine449bd832023-01-11 14:50:10 +0100874 memset(params, 0, sizeof(mbedtls_asn1_buf));
Paul Bakker1a7550a2013-09-15 13:01:22 +0200875
Gilles Peskine449bd832023-01-11 14:50:10 +0100876 if ((ret = mbedtls_asn1_get_alg(p, end, &alg_oid, params)) != 0) {
877 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_INVALID_ALG, ret);
878 }
Paul Bakker1a7550a2013-09-15 13:01:22 +0200879
Jethro Beekman01672442023-04-19 14:08:14 +0200880 ret = mbedtls_oid_get_pk_alg(&alg_oid, pk_alg);
881#if defined(MBEDTLS_ECP_LIGHT)
882 if (ret == MBEDTLS_ERR_OID_NOT_FOUND) {
883 ret = mbedtls_oid_get_ec_grp_algid(&alg_oid, ec_grp_id);
884 if (ret == 0) {
885 *pk_alg = MBEDTLS_PK_ECKEY;
886 }
887 }
888#else
889 (void) ec_grp_id;
890#endif
891 if (ret != 0) {
Gilles Peskine449bd832023-01-11 14:50:10 +0100892 return MBEDTLS_ERR_PK_UNKNOWN_PK_ALG;
893 }
Paul Bakker1a7550a2013-09-15 13:01:22 +0200894
895 /*
896 * No parameters with RSA (only for EC)
897 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100898 if (*pk_alg == MBEDTLS_PK_RSA &&
899 ((params->tag != MBEDTLS_ASN1_NULL && params->tag != 0) ||
900 params->len != 0)) {
901 return MBEDTLS_ERR_PK_INVALID_ALG;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200902 }
903
Gilles Peskine449bd832023-01-11 14:50:10 +0100904 return 0;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200905}
906
907/*
908 * SubjectPublicKeyInfo ::= SEQUENCE {
909 * algorithm AlgorithmIdentifier,
910 * subjectPublicKey BIT STRING }
911 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100912int mbedtls_pk_parse_subpubkey(unsigned char **p, const unsigned char *end,
913 mbedtls_pk_context *pk)
Paul Bakker1a7550a2013-09-15 13:01:22 +0200914{
Janos Follath24eed8d2019-11-22 13:21:35 +0000915 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200916 size_t len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200917 mbedtls_asn1_buf alg_params;
918 mbedtls_pk_type_t pk_alg = MBEDTLS_PK_NONE;
Jethro Beekman01672442023-04-19 14:08:14 +0200919 mbedtls_ecp_group_id ec_grp_id = MBEDTLS_ECP_DP_NONE;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200920 const mbedtls_pk_info_t *pk_info;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200921
Gilles Peskine449bd832023-01-11 14:50:10 +0100922 if ((ret = mbedtls_asn1_get_tag(p, end, &len,
923 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) {
924 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret);
Paul Bakker1a7550a2013-09-15 13:01:22 +0200925 }
926
927 end = *p + len;
928
Jethro Beekman01672442023-04-19 14:08:14 +0200929 if ((ret = pk_get_pk_alg(p, end, &pk_alg, &alg_params, &ec_grp_id)) != 0) {
Gilles Peskine449bd832023-01-11 14:50:10 +0100930 return ret;
931 }
Paul Bakker1a7550a2013-09-15 13:01:22 +0200932
Gilles Peskine449bd832023-01-11 14:50:10 +0100933 if ((ret = mbedtls_asn1_get_bitstring_null(p, end, &len)) != 0) {
934 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_INVALID_PUBKEY, ret);
935 }
Paul Bakker1a7550a2013-09-15 13:01:22 +0200936
Gilles Peskine449bd832023-01-11 14:50:10 +0100937 if (*p + len != end) {
938 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_INVALID_PUBKEY,
939 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
940 }
Paul Bakker1a7550a2013-09-15 13:01:22 +0200941
Gilles Peskine449bd832023-01-11 14:50:10 +0100942 if ((pk_info = mbedtls_pk_info_from_type(pk_alg)) == NULL) {
943 return MBEDTLS_ERR_PK_UNKNOWN_PK_ALG;
944 }
Paul Bakker1a7550a2013-09-15 13:01:22 +0200945
Gilles Peskine449bd832023-01-11 14:50:10 +0100946 if ((ret = mbedtls_pk_setup(pk, pk_info)) != 0) {
947 return ret;
948 }
Paul Bakker1a7550a2013-09-15 13:01:22 +0200949
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200950#if defined(MBEDTLS_RSA_C)
Gilles Peskine449bd832023-01-11 14:50:10 +0100951 if (pk_alg == MBEDTLS_PK_RSA) {
952 ret = pk_get_rsapubkey(p, end, mbedtls_pk_rsa(*pk));
Paul Bakker1a7550a2013-09-15 13:01:22 +0200953 } else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200954#endif /* MBEDTLS_RSA_C */
Valerio Setti0d2980f2023-04-05 18:17:13 +0200955#if defined(MBEDTLS_ECP_LIGHT)
Gilles Peskine449bd832023-01-11 14:50:10 +0100956 if (pk_alg == MBEDTLS_PK_ECKEY_DH || pk_alg == MBEDTLS_PK_ECKEY) {
Jethro Beekman01672442023-04-19 14:08:14 +0200957#if defined(MBEDTLS_PK_HAVE_RFC8410_CURVES)
Valerio Setti00e8dd12023-05-18 18:56:59 +0200958 if (MBEDTLS_PK_IS_RFC8410_GROUP_ID(ec_grp_id)) {
Valerio Setti4064dbb2023-05-17 15:33:07 +0200959 ret = pk_use_ecparams_rfc8410(&alg_params, ec_grp_id, pk);
Jethro Beekman01672442023-04-19 14:08:14 +0200960 } else
961#endif
962 {
Valerio Setti4064dbb2023-05-17 15:33:07 +0200963 ret = pk_use_ecparams(&alg_params, pk);
Jethro Beekman01672442023-04-19 14:08:14 +0200964 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100965 if (ret == 0) {
Valerio Setti4064dbb2023-05-17 15:33:07 +0200966 ret = pk_get_ecpubkey(p, end, pk);
Gilles Peskine449bd832023-01-11 14:50:10 +0100967 }
Paul Bakker1a7550a2013-09-15 13:01:22 +0200968 } else
Valerio Setti0d2980f2023-04-05 18:17:13 +0200969#endif /* MBEDTLS_ECP_LIGHT */
Gilles Peskine449bd832023-01-11 14:50:10 +0100970 ret = MBEDTLS_ERR_PK_UNKNOWN_PK_ALG;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200971
Gilles Peskine449bd832023-01-11 14:50:10 +0100972 if (ret == 0 && *p != end) {
973 ret = MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_INVALID_PUBKEY,
974 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
975 }
Paul Bakker1a7550a2013-09-15 13:01:22 +0200976
Gilles Peskine449bd832023-01-11 14:50:10 +0100977 if (ret != 0) {
978 mbedtls_pk_free(pk);
979 }
Paul Bakker1a7550a2013-09-15 13:01:22 +0200980
Gilles Peskine449bd832023-01-11 14:50:10 +0100981 return ret;
Paul Bakker1a7550a2013-09-15 13:01:22 +0200982}
983
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200984#if defined(MBEDTLS_RSA_C)
Paul Bakker1a7550a2013-09-15 13:01:22 +0200985/*
Manuel Pégourié-Gonnarda04a2c32020-02-18 10:12:14 +0100986 * Wrapper around mbedtls_asn1_get_mpi() that rejects zero.
987 *
988 * The value zero is:
989 * - never a valid value for an RSA parameter
990 * - interpreted as "omitted, please reconstruct" by mbedtls_rsa_complete().
991 *
992 * Since values can't be omitted in PKCS#1, passing a zero value to
993 * rsa_complete() would be incorrect, so reject zero values early.
994 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100995static int asn1_get_nonzero_mpi(unsigned char **p,
996 const unsigned char *end,
997 mbedtls_mpi *X)
Manuel Pégourié-Gonnarda04a2c32020-02-18 10:12:14 +0100998{
999 int ret;
1000
Gilles Peskine449bd832023-01-11 14:50:10 +01001001 ret = mbedtls_asn1_get_mpi(p, end, X);
1002 if (ret != 0) {
1003 return ret;
1004 }
Manuel Pégourié-Gonnarda04a2c32020-02-18 10:12:14 +01001005
Gilles Peskine449bd832023-01-11 14:50:10 +01001006 if (mbedtls_mpi_cmp_int(X, 0) == 0) {
1007 return MBEDTLS_ERR_PK_KEY_INVALID_FORMAT;
1008 }
Manuel Pégourié-Gonnarda04a2c32020-02-18 10:12:14 +01001009
Gilles Peskine449bd832023-01-11 14:50:10 +01001010 return 0;
Manuel Pégourié-Gonnarda04a2c32020-02-18 10:12:14 +01001011}
1012
1013/*
Paul Bakker1a7550a2013-09-15 13:01:22 +02001014 * Parse a PKCS#1 encoded private RSA key
1015 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001016static int pk_parse_key_pkcs1_der(mbedtls_rsa_context *rsa,
1017 const unsigned char *key,
1018 size_t keylen)
Paul Bakker1a7550a2013-09-15 13:01:22 +02001019{
Hanno Beckerd58c5b22017-08-22 14:33:21 +01001020 int ret, version;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001021 size_t len;
1022 unsigned char *p, *end;
1023
Hanno Beckerefa14e82017-10-11 19:45:19 +01001024 mbedtls_mpi T;
Gilles Peskine449bd832023-01-11 14:50:10 +01001025 mbedtls_mpi_init(&T);
Hanno Beckerd58c5b22017-08-22 14:33:21 +01001026
Paul Bakker1a7550a2013-09-15 13:01:22 +02001027 p = (unsigned char *) key;
1028 end = p + keylen;
1029
1030 /*
1031 * This function parses the RSAPrivateKey (PKCS#1)
1032 *
1033 * RSAPrivateKey ::= SEQUENCE {
1034 * version Version,
1035 * modulus INTEGER, -- n
1036 * publicExponent INTEGER, -- e
1037 * privateExponent INTEGER, -- d
1038 * prime1 INTEGER, -- p
1039 * prime2 INTEGER, -- q
1040 * exponent1 INTEGER, -- d mod (p-1)
1041 * exponent2 INTEGER, -- d mod (q-1)
1042 * coefficient INTEGER, -- (inverse of q) mod p
1043 * otherPrimeInfos OtherPrimeInfos OPTIONAL
1044 * }
1045 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001046 if ((ret = mbedtls_asn1_get_tag(&p, end, &len,
1047 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) {
1048 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret);
Paul Bakker1a7550a2013-09-15 13:01:22 +02001049 }
1050
1051 end = p + len;
1052
Gilles Peskine449bd832023-01-11 14:50:10 +01001053 if ((ret = mbedtls_asn1_get_int(&p, end, &version)) != 0) {
1054 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret);
Paul Bakker1a7550a2013-09-15 13:01:22 +02001055 }
1056
Gilles Peskine449bd832023-01-11 14:50:10 +01001057 if (version != 0) {
1058 return MBEDTLS_ERR_PK_KEY_INVALID_VERSION;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001059 }
1060
Hanno Beckerd58c5b22017-08-22 14:33:21 +01001061 /* Import N */
Gilles Peskine449bd832023-01-11 14:50:10 +01001062 if ((ret = asn1_get_nonzero_mpi(&p, end, &T)) != 0 ||
1063 (ret = mbedtls_rsa_import(rsa, &T, NULL, NULL,
1064 NULL, NULL)) != 0) {
Hanno Beckerd58c5b22017-08-22 14:33:21 +01001065 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01001066 }
Paul Bakker1a7550a2013-09-15 13:01:22 +02001067
Hanno Beckerd58c5b22017-08-22 14:33:21 +01001068 /* Import E */
Gilles Peskine449bd832023-01-11 14:50:10 +01001069 if ((ret = asn1_get_nonzero_mpi(&p, end, &T)) != 0 ||
1070 (ret = mbedtls_rsa_import(rsa, NULL, NULL, NULL,
1071 NULL, &T)) != 0) {
Hanno Beckerd58c5b22017-08-22 14:33:21 +01001072 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01001073 }
Hanno Beckerd58c5b22017-08-22 14:33:21 +01001074
1075 /* Import D */
Gilles Peskine449bd832023-01-11 14:50:10 +01001076 if ((ret = asn1_get_nonzero_mpi(&p, end, &T)) != 0 ||
1077 (ret = mbedtls_rsa_import(rsa, NULL, NULL, NULL,
1078 &T, NULL)) != 0) {
Hanno Beckerd58c5b22017-08-22 14:33:21 +01001079 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01001080 }
Hanno Beckerd58c5b22017-08-22 14:33:21 +01001081
1082 /* Import P */
Gilles Peskine449bd832023-01-11 14:50:10 +01001083 if ((ret = asn1_get_nonzero_mpi(&p, end, &T)) != 0 ||
1084 (ret = mbedtls_rsa_import(rsa, NULL, &T, NULL,
1085 NULL, NULL)) != 0) {
Hanno Beckerd58c5b22017-08-22 14:33:21 +01001086 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01001087 }
Hanno Beckerd58c5b22017-08-22 14:33:21 +01001088
1089 /* Import Q */
Gilles Peskine449bd832023-01-11 14:50:10 +01001090 if ((ret = asn1_get_nonzero_mpi(&p, end, &T)) != 0 ||
1091 (ret = mbedtls_rsa_import(rsa, NULL, NULL, &T,
1092 NULL, NULL)) != 0) {
Hanno Beckerd58c5b22017-08-22 14:33:21 +01001093 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01001094 }
Hanno Beckerd58c5b22017-08-22 14:33:21 +01001095
Manuel Pégourié-Gonnardbbb5a0a2020-02-18 10:22:54 +01001096#if !defined(MBEDTLS_RSA_NO_CRT) && !defined(MBEDTLS_RSA_ALT)
Jack Lloyd8c2631b2020-01-23 17:23:52 -05001097 /*
Gilles Peskine449bd832023-01-11 14:50:10 +01001098 * The RSA CRT parameters DP, DQ and QP are nominally redundant, in
1099 * that they can be easily recomputed from D, P and Q. However by
1100 * parsing them from the PKCS1 structure it is possible to avoid
1101 * recalculating them which both reduces the overhead of loading
1102 * RSA private keys into memory and also avoids side channels which
1103 * can arise when computing those values, since all of D, P, and Q
1104 * are secret. See https://eprint.iacr.org/2020/055 for a
1105 * description of one such attack.
1106 */
Jack Lloyd8c2631b2020-01-23 17:23:52 -05001107
Jack Lloyd80cc8112020-01-22 17:34:29 -05001108 /* Import DP */
Gilles Peskine449bd832023-01-11 14:50:10 +01001109 if ((ret = asn1_get_nonzero_mpi(&p, end, &T)) != 0 ||
1110 (ret = mbedtls_mpi_copy(&rsa->DP, &T)) != 0) {
1111 goto cleanup;
1112 }
Jack Lloyd80cc8112020-01-22 17:34:29 -05001113
1114 /* Import DQ */
Gilles Peskine449bd832023-01-11 14:50:10 +01001115 if ((ret = asn1_get_nonzero_mpi(&p, end, &T)) != 0 ||
1116 (ret = mbedtls_mpi_copy(&rsa->DQ, &T)) != 0) {
1117 goto cleanup;
1118 }
Jack Lloyd80cc8112020-01-22 17:34:29 -05001119
1120 /* Import QP */
Gilles Peskine449bd832023-01-11 14:50:10 +01001121 if ((ret = asn1_get_nonzero_mpi(&p, end, &T)) != 0 ||
1122 (ret = mbedtls_mpi_copy(&rsa->QP, &T)) != 0) {
1123 goto cleanup;
1124 }
Jack Lloyd2e9eef42020-01-28 14:43:52 -05001125
Jack Lloyd60239752020-01-27 17:53:36 -05001126#else
Shaun Case8b0ecbc2021-12-20 21:14:10 -08001127 /* Verify existence of the CRT params */
Gilles Peskine449bd832023-01-11 14:50:10 +01001128 if ((ret = asn1_get_nonzero_mpi(&p, end, &T)) != 0 ||
1129 (ret = asn1_get_nonzero_mpi(&p, end, &T)) != 0 ||
1130 (ret = asn1_get_nonzero_mpi(&p, end, &T)) != 0) {
1131 goto cleanup;
1132 }
Jack Lloyd60239752020-01-27 17:53:36 -05001133#endif
Jack Lloyd80cc8112020-01-22 17:34:29 -05001134
Manuel Pégourié-Gonnardc4226792020-02-14 11:28:47 +01001135 /* rsa_complete() doesn't complete anything with the default
1136 * implementation but is still called:
1137 * - for the benefit of alternative implementation that may want to
1138 * pre-compute stuff beyond what's provided (eg Montgomery factors)
1139 * - as is also sanity-checks the key
1140 *
1141 * Furthermore, we also check the public part for consistency with
1142 * mbedtls_pk_parse_pubkey(), as it includes size minima for example.
1143 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001144 if ((ret = mbedtls_rsa_complete(rsa)) != 0 ||
1145 (ret = mbedtls_rsa_check_pubkey(rsa)) != 0) {
Hanno Beckerd58c5b22017-08-22 14:33:21 +01001146 goto cleanup;
Manuel Pégourié-Gonnardc4226792020-02-14 11:28:47 +01001147 }
Hanno Beckerd58c5b22017-08-22 14:33:21 +01001148
Gilles Peskine449bd832023-01-11 14:50:10 +01001149 if (p != end) {
1150 ret = MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT,
1151 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
Paul Bakker1a7550a2013-09-15 13:01:22 +02001152 }
1153
Hanno Beckerd58c5b22017-08-22 14:33:21 +01001154cleanup:
1155
Gilles Peskine449bd832023-01-11 14:50:10 +01001156 mbedtls_mpi_free(&T);
Hanno Beckerd58c5b22017-08-22 14:33:21 +01001157
Gilles Peskine449bd832023-01-11 14:50:10 +01001158 if (ret != 0) {
Hanno Beckerefa14e82017-10-11 19:45:19 +01001159 /* Wrap error code if it's coming from a lower level */
Gilles Peskine449bd832023-01-11 14:50:10 +01001160 if ((ret & 0xff80) == 0) {
1161 ret = MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret);
1162 } else {
Hanno Beckerd58c5b22017-08-22 14:33:21 +01001163 ret = MBEDTLS_ERR_PK_KEY_INVALID_FORMAT;
Gilles Peskine449bd832023-01-11 14:50:10 +01001164 }
Hanno Beckerd58c5b22017-08-22 14:33:21 +01001165
Gilles Peskine449bd832023-01-11 14:50:10 +01001166 mbedtls_rsa_free(rsa);
Paul Bakker1a7550a2013-09-15 13:01:22 +02001167 }
1168
Gilles Peskine449bd832023-01-11 14:50:10 +01001169 return ret;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001170}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001171#endif /* MBEDTLS_RSA_C */
Paul Bakker1a7550a2013-09-15 13:01:22 +02001172
Valerio Setti0d2980f2023-04-05 18:17:13 +02001173#if defined(MBEDTLS_ECP_LIGHT)
Paul Bakker1a7550a2013-09-15 13:01:22 +02001174/*
1175 * Parse a SEC1 encoded private EC key
1176 */
Valerio Setti4064dbb2023-05-17 15:33:07 +02001177static int pk_parse_key_sec1_der(mbedtls_pk_context *pk,
Gilles Peskine449bd832023-01-11 14:50:10 +01001178 const unsigned char *key, size_t keylen,
1179 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng)
Paul Bakker1a7550a2013-09-15 13:01:22 +02001180{
Janos Follath24eed8d2019-11-22 13:21:35 +00001181 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +01001182 int version, pubkey_done;
Jethro Beekman01672442023-04-19 14:08:14 +02001183 size_t len, d_len;
Leonid Rozenboima3008e72022-04-21 17:28:18 -07001184 mbedtls_asn1_buf params = { 0, 0, NULL };
Paul Bakker1a7550a2013-09-15 13:01:22 +02001185 unsigned char *p = (unsigned char *) key;
Jethro Beekman01672442023-04-19 14:08:14 +02001186 unsigned char *d;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001187 unsigned char *end = p + keylen;
1188 unsigned char *end2;
Valerio Setti4064dbb2023-05-17 15:33:07 +02001189 mbedtls_ecp_keypair *eck = mbedtls_pk_ec_rw(*pk);
Valerio Setti00e8dd12023-05-18 18:56:59 +02001190#if defined(MBEDTLS_PK_USE_PSA_EC_DATA)
1191 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
1192 psa_status_t status;
Valerio Setti00e8dd12023-05-18 18:56:59 +02001193#endif /* MBEDTLS_PK_USE_PSA_EC_DATA */
Paul Bakker1a7550a2013-09-15 13:01:22 +02001194
1195 /*
1196 * RFC 5915, or SEC1 Appendix C.4
1197 *
1198 * ECPrivateKey ::= SEQUENCE {
1199 * version INTEGER { ecPrivkeyVer1(1) } (ecPrivkeyVer1),
1200 * privateKey OCTET STRING,
1201 * parameters [0] ECParameters {{ NamedCurve }} OPTIONAL,
1202 * publicKey [1] BIT STRING OPTIONAL
1203 * }
1204 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001205 if ((ret = mbedtls_asn1_get_tag(&p, end, &len,
1206 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) {
1207 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret);
Paul Bakker1a7550a2013-09-15 13:01:22 +02001208 }
1209
1210 end = p + len;
1211
Gilles Peskine449bd832023-01-11 14:50:10 +01001212 if ((ret = mbedtls_asn1_get_int(&p, end, &version)) != 0) {
1213 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret);
1214 }
Paul Bakker1a7550a2013-09-15 13:01:22 +02001215
Gilles Peskine449bd832023-01-11 14:50:10 +01001216 if (version != 1) {
1217 return MBEDTLS_ERR_PK_KEY_INVALID_VERSION;
1218 }
Paul Bakker1a7550a2013-09-15 13:01:22 +02001219
Gilles Peskine449bd832023-01-11 14:50:10 +01001220 if ((ret = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_OCTET_STRING)) != 0) {
1221 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret);
1222 }
Paul Bakker1a7550a2013-09-15 13:01:22 +02001223
Jethro Beekman01672442023-04-19 14:08:14 +02001224 d = p;
1225 d_len = len;
Valerio Setti00e8dd12023-05-18 18:56:59 +02001226
Valerio Settia541e012023-05-24 14:31:21 +02001227#if !defined(MBEDTLS_PK_USE_PSA_EC_DATA)
Gilles Peskine449bd832023-01-11 14:50:10 +01001228 if ((ret = mbedtls_mpi_read_binary(&eck->d, p, len)) != 0) {
1229 mbedtls_ecp_keypair_free(eck);
1230 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret);
Paul Bakker1a7550a2013-09-15 13:01:22 +02001231 }
Valerio Setti00e8dd12023-05-18 18:56:59 +02001232#endif
Paul Bakker1a7550a2013-09-15 13:01:22 +02001233
1234 p += len;
1235
Manuel Pégourié-Gonnard924cd102015-04-14 11:18:04 +02001236 pubkey_done = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01001237 if (p != end) {
Manuel Pégourié-Gonnard924cd102015-04-14 11:18:04 +02001238 /*
1239 * Is 'parameters' present?
1240 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001241 if ((ret = mbedtls_asn1_get_tag(&p, end, &len,
1242 MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED |
1243 0)) == 0) {
1244 if ((ret = pk_get_ecparams(&p, p + len, &params)) != 0 ||
Valerio Setti4064dbb2023-05-17 15:33:07 +02001245 (ret = pk_use_ecparams(&params, pk)) != 0) {
Gilles Peskine449bd832023-01-11 14:50:10 +01001246 mbedtls_ecp_keypair_free(eck);
1247 return ret;
Manuel Pégourié-Gonnard924cd102015-04-14 11:18:04 +02001248 }
Gilles Peskine449bd832023-01-11 14:50:10 +01001249 } else if (ret != MBEDTLS_ERR_ASN1_UNEXPECTED_TAG) {
1250 mbedtls_ecp_keypair_free(eck);
1251 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret);
Manuel Pégourié-Gonnard5246ee52014-03-19 16:18:38 +01001252 }
Jethro Beekmand2df9362018-02-16 13:11:04 -08001253 }
Manuel Pégourié-Gonnard924cd102015-04-14 11:18:04 +02001254
Gilles Peskine449bd832023-01-11 14:50:10 +01001255 if (p != end) {
Manuel Pégourié-Gonnard924cd102015-04-14 11:18:04 +02001256 /*
1257 * Is 'publickey' present? If not, or if we can't read it (eg because it
1258 * is compressed), create it from the private key.
1259 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001260 if ((ret = mbedtls_asn1_get_tag(&p, end, &len,
1261 MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED |
1262 1)) == 0) {
Manuel Pégourié-Gonnard924cd102015-04-14 11:18:04 +02001263 end2 = p + len;
1264
Gilles Peskine449bd832023-01-11 14:50:10 +01001265 if ((ret = mbedtls_asn1_get_bitstring_null(&p, end2, &len)) != 0) {
1266 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret);
1267 }
Manuel Pégourié-Gonnard924cd102015-04-14 11:18:04 +02001268
Gilles Peskine449bd832023-01-11 14:50:10 +01001269 if (p + len != end2) {
1270 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT,
1271 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
1272 }
Manuel Pégourié-Gonnard924cd102015-04-14 11:18:04 +02001273
Valerio Setti4064dbb2023-05-17 15:33:07 +02001274 if ((ret = pk_get_ecpubkey(&p, end2, pk)) == 0) {
Manuel Pégourié-Gonnard924cd102015-04-14 11:18:04 +02001275 pubkey_done = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01001276 } else {
Manuel Pégourié-Gonnard924cd102015-04-14 11:18:04 +02001277 /*
1278 * The only acceptable failure mode of pk_get_ecpubkey() above
1279 * is if the point format is not recognized.
1280 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001281 if (ret != MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE) {
1282 return MBEDTLS_ERR_PK_KEY_INVALID_FORMAT;
1283 }
Manuel Pégourié-Gonnard924cd102015-04-14 11:18:04 +02001284 }
Gilles Peskine449bd832023-01-11 14:50:10 +01001285 } else if (ret != MBEDTLS_ERR_ASN1_UNEXPECTED_TAG) {
1286 mbedtls_ecp_keypair_free(eck);
1287 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret);
Manuel Pégourié-Gonnard924cd102015-04-14 11:18:04 +02001288 }
Paul Bakker1a7550a2013-09-15 13:01:22 +02001289 }
Manuel Pégourié-Gonnardeab20d22014-03-14 17:58:42 +01001290
Valerio Setti00e8dd12023-05-18 18:56:59 +02001291#if defined(MBEDTLS_PK_USE_PSA_EC_DATA)
1292 psa_set_key_type(&attributes, PSA_KEY_TYPE_ECC_KEY_PAIR(pk->ec_family));
1293 /* Setting largest masks for usage and key algorithms */
1294 psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_HASH |
1295 PSA_KEY_USAGE_SIGN_MESSAGE |
Valerio Setti51aa52e2023-05-24 12:37:50 +02001296 PSA_KEY_USAGE_EXPORT | PSA_KEY_USAGE_DERIVE);
Valerio Setti00e8dd12023-05-18 18:56:59 +02001297#if defined(MBEDTLS_ECDSA_DETERMINISTIC)
1298 psa_set_key_algorithm(&attributes,
1299 PSA_ALG_DETERMINISTIC_ECDSA(PSA_ALG_ANY_HASH));
1300#else
1301 psa_set_key_algorithm(&attributes, PSA_ALG_ECDSA(PSA_ALG_ANY_HASH));
1302#endif
Valerio Setti51aa52e2023-05-24 12:37:50 +02001303 psa_set_key_enrollment_algorithm(&attributes, PSA_ALG_ECDH);
Valerio Setti00e8dd12023-05-18 18:56:59 +02001304
Valerio Settia541e012023-05-24 14:31:21 +02001305 status = psa_import_key(&attributes, d, d_len, &pk->priv_id);
Valerio Setti00e8dd12023-05-18 18:56:59 +02001306 if (status != PSA_SUCCESS) {
1307 ret = psa_pk_status_to_mbedtls(status);
1308 return ret;
1309 }
1310#endif /* MBEDTLS_PK_USE_PSA_EC_DATA */
1311
Valerio Setti34f67552023-04-03 15:19:18 +02001312 if (!pubkey_done) {
Valerio Setti4064dbb2023-05-17 15:33:07 +02001313 if ((ret = pk_derive_public_key(pk, d, d_len, f_rng, p_rng)) != 0) {
Valerio Setti34f67552023-04-03 15:19:18 +02001314 mbedtls_ecp_keypair_free(eck);
Valerio Setti520c0382023-04-07 11:38:09 +02001315 return ret;
Valerio Setti34f67552023-04-03 15:19:18 +02001316 }
Manuel Pégourié-Gonnardff29f9c2013-09-18 16:13:02 +02001317 }
Paul Bakker1a7550a2013-09-15 13:01:22 +02001318
Valerio Setti00e8dd12023-05-18 18:56:59 +02001319#if !defined(MBEDTLS_PK_USE_PSA_EC_DATA)
Gilles Peskine449bd832023-01-11 14:50:10 +01001320 if ((ret = mbedtls_ecp_check_privkey(&eck->grp, &eck->d)) != 0) {
1321 mbedtls_ecp_keypair_free(eck);
1322 return ret;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001323 }
Valerio Setti00e8dd12023-05-18 18:56:59 +02001324#endif /* !MBEDTLS_PK_USE_PSA_EC_DATA */
Paul Bakker1a7550a2013-09-15 13:01:22 +02001325
Gilles Peskine449bd832023-01-11 14:50:10 +01001326 return 0;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001327}
Valerio Setti0d2980f2023-04-05 18:17:13 +02001328#endif /* MBEDTLS_ECP_LIGHT */
Paul Bakker1a7550a2013-09-15 13:01:22 +02001329
1330/*
1331 * Parse an unencrypted PKCS#8 encoded private key
Hanno Beckerb4274212017-09-29 19:18:51 +01001332 *
1333 * Notes:
1334 *
1335 * - This function does not own the key buffer. It is the
1336 * responsibility of the caller to take care of zeroizing
1337 * and freeing it after use.
1338 *
1339 * - The function is responsible for freeing the provided
1340 * PK context on failure.
1341 *
Paul Bakker1a7550a2013-09-15 13:01:22 +02001342 */
1343static int pk_parse_key_pkcs8_unencrypted_der(
Gilles Peskine449bd832023-01-11 14:50:10 +01001344 mbedtls_pk_context *pk,
1345 const unsigned char *key, size_t keylen,
1346 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng)
Paul Bakker1a7550a2013-09-15 13:01:22 +02001347{
1348 int ret, version;
1349 size_t len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001350 mbedtls_asn1_buf params;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001351 unsigned char *p = (unsigned char *) key;
1352 unsigned char *end = p + keylen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001353 mbedtls_pk_type_t pk_alg = MBEDTLS_PK_NONE;
Jethro Beekman01672442023-04-19 14:08:14 +02001354 mbedtls_ecp_group_id ec_grp_id = MBEDTLS_ECP_DP_NONE;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001355 const mbedtls_pk_info_t *pk_info;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001356
Jethro Beekman01672442023-04-19 14:08:14 +02001357#if !defined(MBEDTLS_ECP_LIGHT)
Manuel Pégourié-Gonnard609ab642021-06-16 14:29:11 +02001358 (void) f_rng;
1359 (void) p_rng;
1360#endif
1361
Paul Bakker1a7550a2013-09-15 13:01:22 +02001362 /*
Hanno Becker9c6cb382017-09-05 10:08:01 +01001363 * This function parses the PrivateKeyInfo object (PKCS#8 v1.2 = RFC 5208)
Paul Bakker1a7550a2013-09-15 13:01:22 +02001364 *
1365 * PrivateKeyInfo ::= SEQUENCE {
1366 * version Version,
1367 * privateKeyAlgorithm PrivateKeyAlgorithmIdentifier,
1368 * privateKey PrivateKey,
1369 * attributes [0] IMPLICIT Attributes OPTIONAL }
1370 *
1371 * Version ::= INTEGER
1372 * PrivateKeyAlgorithmIdentifier ::= AlgorithmIdentifier
1373 * PrivateKey ::= OCTET STRING
1374 *
1375 * The PrivateKey OCTET STRING is a SEC1 ECPrivateKey
1376 */
1377
Gilles Peskine449bd832023-01-11 14:50:10 +01001378 if ((ret = mbedtls_asn1_get_tag(&p, end, &len,
1379 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) {
1380 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret);
Paul Bakker1a7550a2013-09-15 13:01:22 +02001381 }
1382
1383 end = p + len;
1384
Gilles Peskine449bd832023-01-11 14:50:10 +01001385 if ((ret = mbedtls_asn1_get_int(&p, end, &version)) != 0) {
1386 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret);
Chris Jonesfdb588b2021-04-14 18:15:24 +01001387 }
Paul Bakker1a7550a2013-09-15 13:01:22 +02001388
Gilles Peskine449bd832023-01-11 14:50:10 +01001389 if (version != 0) {
1390 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_VERSION, ret);
1391 }
Paul Bakker1a7550a2013-09-15 13:01:22 +02001392
Jethro Beekman01672442023-04-19 14:08:14 +02001393 if ((ret = pk_get_pk_alg(&p, end, &pk_alg, &params, &ec_grp_id)) != 0) {
Gilles Peskine449bd832023-01-11 14:50:10 +01001394 return ret;
1395 }
Paul Bakker1a7550a2013-09-15 13:01:22 +02001396
Gilles Peskine449bd832023-01-11 14:50:10 +01001397 if ((ret = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_OCTET_STRING)) != 0) {
1398 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret);
1399 }
Paul Bakker1a7550a2013-09-15 13:01:22 +02001400
Gilles Peskine449bd832023-01-11 14:50:10 +01001401 if (len < 1) {
1402 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT,
1403 MBEDTLS_ERR_ASN1_OUT_OF_DATA);
1404 }
1405
1406 if ((pk_info = mbedtls_pk_info_from_type(pk_alg)) == NULL) {
1407 return MBEDTLS_ERR_PK_UNKNOWN_PK_ALG;
1408 }
1409
1410 if ((ret = mbedtls_pk_setup(pk, pk_info)) != 0) {
1411 return ret;
1412 }
Paul Bakker1a7550a2013-09-15 13:01:22 +02001413
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001414#if defined(MBEDTLS_RSA_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001415 if (pk_alg == MBEDTLS_PK_RSA) {
1416 if ((ret = pk_parse_key_pkcs1_der(mbedtls_pk_rsa(*pk), p, len)) != 0) {
1417 mbedtls_pk_free(pk);
1418 return ret;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001419 }
1420 } else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001421#endif /* MBEDTLS_RSA_C */
Valerio Setti0d2980f2023-04-05 18:17:13 +02001422#if defined(MBEDTLS_ECP_LIGHT)
Gilles Peskine449bd832023-01-11 14:50:10 +01001423 if (pk_alg == MBEDTLS_PK_ECKEY || pk_alg == MBEDTLS_PK_ECKEY_DH) {
Jethro Beekman01672442023-04-19 14:08:14 +02001424#if defined(MBEDTLS_PK_HAVE_RFC8410_CURVES)
Valerio Setti00e8dd12023-05-18 18:56:59 +02001425 if (MBEDTLS_PK_IS_RFC8410_GROUP_ID(ec_grp_id)) {
Valerio Setti4064dbb2023-05-17 15:33:07 +02001426 if ((ret =
1427 pk_use_ecparams_rfc8410(&params, ec_grp_id, pk)) != 0 ||
Jethro Beekman01672442023-04-19 14:08:14 +02001428 (ret =
Valerio Setti4064dbb2023-05-17 15:33:07 +02001429 pk_parse_key_rfc8410_der(pk, p, len, end, f_rng,
Jethro Beekman01672442023-04-19 14:08:14 +02001430 p_rng)) != 0) {
1431 mbedtls_pk_free(pk);
1432 return ret;
1433 }
1434 } else
1435#endif
1436 {
Valerio Setti4064dbb2023-05-17 15:33:07 +02001437 if ((ret = pk_use_ecparams(&params, pk)) != 0 ||
1438 (ret = pk_parse_key_sec1_der(pk, p, len, f_rng, p_rng)) != 0) {
Jethro Beekman01672442023-04-19 14:08:14 +02001439 mbedtls_pk_free(pk);
1440 return ret;
1441 }
Paul Bakker1a7550a2013-09-15 13:01:22 +02001442 }
1443 } else
Valerio Setti0d2980f2023-04-05 18:17:13 +02001444#endif /* MBEDTLS_ECP_LIGHT */
Gilles Peskine449bd832023-01-11 14:50:10 +01001445 return MBEDTLS_ERR_PK_UNKNOWN_PK_ALG;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001446
Gilles Peskine449bd832023-01-11 14:50:10 +01001447 return 0;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001448}
1449
1450/*
1451 * Parse an encrypted PKCS#8 encoded private key
Hanno Beckerb4274212017-09-29 19:18:51 +01001452 *
1453 * To save space, the decryption happens in-place on the given key buffer.
1454 * Also, while this function may modify the keybuffer, it doesn't own it,
1455 * and instead it is the responsibility of the caller to zeroize and properly
1456 * free it after use.
1457 *
Paul Bakker1a7550a2013-09-15 13:01:22 +02001458 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001459#if defined(MBEDTLS_PKCS12_C) || defined(MBEDTLS_PKCS5_C)
Paul Bakker1a7550a2013-09-15 13:01:22 +02001460static int pk_parse_key_pkcs8_encrypted_der(
Gilles Peskine449bd832023-01-11 14:50:10 +01001461 mbedtls_pk_context *pk,
1462 unsigned char *key, size_t keylen,
1463 const unsigned char *pwd, size_t pwdlen,
1464 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng)
Paul Bakker1a7550a2013-09-15 13:01:22 +02001465{
Paul Bakkerf4cf80b2014-04-17 17:19:56 +02001466 int ret, decrypted = 0;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001467 size_t len;
Hanno Beckerfab35692017-08-25 13:38:26 +01001468 unsigned char *buf;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001469 unsigned char *p, *end;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001470 mbedtls_asn1_buf pbe_alg_oid, pbe_params;
1471#if defined(MBEDTLS_PKCS12_C)
1472 mbedtls_cipher_type_t cipher_alg;
1473 mbedtls_md_type_t md_alg;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001474#endif
1475
Hanno Becker2aa80a72017-09-07 15:28:45 +01001476 p = key;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001477 end = p + keylen;
1478
Gilles Peskine449bd832023-01-11 14:50:10 +01001479 if (pwdlen == 0) {
1480 return MBEDTLS_ERR_PK_PASSWORD_REQUIRED;
1481 }
Paul Bakker1a7550a2013-09-15 13:01:22 +02001482
1483 /*
Hanno Beckerf04111f2017-09-29 19:18:42 +01001484 * This function parses the EncryptedPrivateKeyInfo object (PKCS#8)
Paul Bakker1a7550a2013-09-15 13:01:22 +02001485 *
1486 * EncryptedPrivateKeyInfo ::= SEQUENCE {
1487 * encryptionAlgorithm EncryptionAlgorithmIdentifier,
1488 * encryptedData EncryptedData
1489 * }
1490 *
1491 * EncryptionAlgorithmIdentifier ::= AlgorithmIdentifier
1492 *
1493 * EncryptedData ::= OCTET STRING
1494 *
1495 * The EncryptedData OCTET STRING is a PKCS#8 PrivateKeyInfo
Hanno Beckerb8d16572017-09-07 15:29:01 +01001496 *
Paul Bakker1a7550a2013-09-15 13:01:22 +02001497 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001498 if ((ret = mbedtls_asn1_get_tag(&p, end, &len,
1499 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) {
1500 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret);
Paul Bakker1a7550a2013-09-15 13:01:22 +02001501 }
1502
1503 end = p + len;
1504
Gilles Peskine449bd832023-01-11 14:50:10 +01001505 if ((ret = mbedtls_asn1_get_alg(&p, end, &pbe_alg_oid, &pbe_params)) != 0) {
1506 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret);
1507 }
Paul Bakker1a7550a2013-09-15 13:01:22 +02001508
Gilles Peskine449bd832023-01-11 14:50:10 +01001509 if ((ret = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_OCTET_STRING)) != 0) {
1510 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret);
1511 }
Paul Bakker1a7550a2013-09-15 13:01:22 +02001512
Hanno Beckerfab35692017-08-25 13:38:26 +01001513 buf = p;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001514
1515 /*
Hanno Beckerb8d16572017-09-07 15:29:01 +01001516 * Decrypt EncryptedData with appropriate PBE
Paul Bakker1a7550a2013-09-15 13:01:22 +02001517 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001518#if defined(MBEDTLS_PKCS12_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001519 if (mbedtls_oid_get_pkcs12_pbe_alg(&pbe_alg_oid, &md_alg, &cipher_alg) == 0) {
1520 if ((ret = mbedtls_pkcs12_pbe(&pbe_params, MBEDTLS_PKCS12_PBE_DECRYPT,
1521 cipher_alg, md_alg,
1522 pwd, pwdlen, p, len, buf)) != 0) {
1523 if (ret == MBEDTLS_ERR_PKCS12_PASSWORD_MISMATCH) {
1524 return MBEDTLS_ERR_PK_PASSWORD_MISMATCH;
1525 }
Paul Bakker1a7550a2013-09-15 13:01:22 +02001526
Gilles Peskine449bd832023-01-11 14:50:10 +01001527 return ret;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001528 }
Paul Bakkerf4cf80b2014-04-17 17:19:56 +02001529
1530 decrypted = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01001531 } else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001532#endif /* MBEDTLS_PKCS12_C */
1533#if defined(MBEDTLS_PKCS5_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001534 if (MBEDTLS_OID_CMP(MBEDTLS_OID_PKCS5_PBES2, &pbe_alg_oid) == 0) {
1535 if ((ret = mbedtls_pkcs5_pbes2(&pbe_params, MBEDTLS_PKCS5_DECRYPT, pwd, pwdlen,
1536 p, len, buf)) != 0) {
1537 if (ret == MBEDTLS_ERR_PKCS5_PASSWORD_MISMATCH) {
1538 return MBEDTLS_ERR_PK_PASSWORD_MISMATCH;
1539 }
Paul Bakker1a7550a2013-09-15 13:01:22 +02001540
Gilles Peskine449bd832023-01-11 14:50:10 +01001541 return ret;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001542 }
Paul Bakkerf4cf80b2014-04-17 17:19:56 +02001543
1544 decrypted = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01001545 } else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001546#endif /* MBEDTLS_PKCS5_C */
Manuel Pégourié-Gonnard1032c1d2013-09-18 17:18:34 +02001547 {
1548 ((void) pwd);
Manuel Pégourié-Gonnard1032c1d2013-09-18 17:18:34 +02001549 }
Paul Bakker1a7550a2013-09-15 13:01:22 +02001550
Gilles Peskine449bd832023-01-11 14:50:10 +01001551 if (decrypted == 0) {
1552 return MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE;
1553 }
Paul Bakkerf4cf80b2014-04-17 17:19:56 +02001554
Gilles Peskine449bd832023-01-11 14:50:10 +01001555 return pk_parse_key_pkcs8_unencrypted_der(pk, buf, len, f_rng, p_rng);
Paul Bakker1a7550a2013-09-15 13:01:22 +02001556}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001557#endif /* MBEDTLS_PKCS12_C || MBEDTLS_PKCS5_C */
Paul Bakker1a7550a2013-09-15 13:01:22 +02001558
1559/*
1560 * Parse a private key
1561 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001562int mbedtls_pk_parse_key(mbedtls_pk_context *pk,
1563 const unsigned char *key, size_t keylen,
1564 const unsigned char *pwd, size_t pwdlen,
1565 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng)
Paul Bakker1a7550a2013-09-15 13:01:22 +02001566{
Janos Follath24eed8d2019-11-22 13:21:35 +00001567 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001568 const mbedtls_pk_info_t *pk_info;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001569#if defined(MBEDTLS_PEM_PARSE_C)
Paul Bakker1a7550a2013-09-15 13:01:22 +02001570 size_t len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001571 mbedtls_pem_context pem;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001572#endif
Paul Bakker1a7550a2013-09-15 13:01:22 +02001573
Gilles Peskine449bd832023-01-11 14:50:10 +01001574 if (keylen == 0) {
1575 return MBEDTLS_ERR_PK_KEY_INVALID_FORMAT;
1576 }
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001577
1578#if defined(MBEDTLS_PEM_PARSE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001579 mbedtls_pem_init(&pem);
Paul Bakker1a7550a2013-09-15 13:01:22 +02001580
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001581#if defined(MBEDTLS_RSA_C)
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +02001582 /* Avoid calling mbedtls_pem_read_buffer() on non-null-terminated string */
Gilles Peskine449bd832023-01-11 14:50:10 +01001583 if (key[keylen - 1] != '\0') {
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +02001584 ret = MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT;
Gilles Peskine449bd832023-01-11 14:50:10 +01001585 } else {
1586 ret = mbedtls_pem_read_buffer(&pem,
1587 "-----BEGIN RSA PRIVATE KEY-----",
1588 "-----END RSA PRIVATE KEY-----",
1589 key, pwd, pwdlen, &len);
1590 }
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +02001591
Gilles Peskine449bd832023-01-11 14:50:10 +01001592 if (ret == 0) {
1593 pk_info = mbedtls_pk_info_from_type(MBEDTLS_PK_RSA);
1594 if ((ret = mbedtls_pk_setup(pk, pk_info)) != 0 ||
1595 (ret = pk_parse_key_pkcs1_der(mbedtls_pk_rsa(*pk),
1596 pem.buf, pem.buflen)) != 0) {
1597 mbedtls_pk_free(pk);
Paul Bakker1a7550a2013-09-15 13:01:22 +02001598 }
1599
Gilles Peskine449bd832023-01-11 14:50:10 +01001600 mbedtls_pem_free(&pem);
1601 return ret;
1602 } else if (ret == MBEDTLS_ERR_PEM_PASSWORD_MISMATCH) {
1603 return MBEDTLS_ERR_PK_PASSWORD_MISMATCH;
1604 } else if (ret == MBEDTLS_ERR_PEM_PASSWORD_REQUIRED) {
1605 return MBEDTLS_ERR_PK_PASSWORD_REQUIRED;
1606 } else if (ret != MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT) {
1607 return ret;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001608 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001609#endif /* MBEDTLS_RSA_C */
Paul Bakker1a7550a2013-09-15 13:01:22 +02001610
Valerio Setti0d2980f2023-04-05 18:17:13 +02001611#if defined(MBEDTLS_ECP_LIGHT)
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +02001612 /* Avoid calling mbedtls_pem_read_buffer() on non-null-terminated string */
Gilles Peskine449bd832023-01-11 14:50:10 +01001613 if (key[keylen - 1] != '\0') {
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +02001614 ret = MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT;
Gilles Peskine449bd832023-01-11 14:50:10 +01001615 } else {
1616 ret = mbedtls_pem_read_buffer(&pem,
1617 "-----BEGIN EC PRIVATE KEY-----",
1618 "-----END EC PRIVATE KEY-----",
1619 key, pwd, pwdlen, &len);
1620 }
1621 if (ret == 0) {
1622 pk_info = mbedtls_pk_info_from_type(MBEDTLS_PK_ECKEY);
Paul Bakker1a7550a2013-09-15 13:01:22 +02001623
Gilles Peskine449bd832023-01-11 14:50:10 +01001624 if ((ret = mbedtls_pk_setup(pk, pk_info)) != 0 ||
Valerio Setti4064dbb2023-05-17 15:33:07 +02001625 (ret = pk_parse_key_sec1_der(pk,
Gilles Peskine449bd832023-01-11 14:50:10 +01001626 pem.buf, pem.buflen,
1627 f_rng, p_rng)) != 0) {
1628 mbedtls_pk_free(pk);
Paul Bakker1a7550a2013-09-15 13:01:22 +02001629 }
1630
Gilles Peskine449bd832023-01-11 14:50:10 +01001631 mbedtls_pem_free(&pem);
1632 return ret;
1633 } else if (ret == MBEDTLS_ERR_PEM_PASSWORD_MISMATCH) {
1634 return MBEDTLS_ERR_PK_PASSWORD_MISMATCH;
1635 } else if (ret == MBEDTLS_ERR_PEM_PASSWORD_REQUIRED) {
1636 return MBEDTLS_ERR_PK_PASSWORD_REQUIRED;
1637 } else if (ret != MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT) {
1638 return ret;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001639 }
Valerio Setti0d2980f2023-04-05 18:17:13 +02001640#endif /* MBEDTLS_ECP_LIGHT */
Paul Bakker1a7550a2013-09-15 13:01:22 +02001641
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +02001642 /* Avoid calling mbedtls_pem_read_buffer() on non-null-terminated string */
Gilles Peskine449bd832023-01-11 14:50:10 +01001643 if (key[keylen - 1] != '\0') {
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +02001644 ret = MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT;
Gilles Peskine449bd832023-01-11 14:50:10 +01001645 } else {
1646 ret = mbedtls_pem_read_buffer(&pem,
1647 "-----BEGIN PRIVATE KEY-----",
1648 "-----END PRIVATE KEY-----",
1649 key, NULL, 0, &len);
1650 }
1651 if (ret == 0) {
1652 if ((ret = pk_parse_key_pkcs8_unencrypted_der(pk,
1653 pem.buf, pem.buflen, f_rng, p_rng)) != 0) {
1654 mbedtls_pk_free(pk);
Paul Bakker1a7550a2013-09-15 13:01:22 +02001655 }
1656
Gilles Peskine449bd832023-01-11 14:50:10 +01001657 mbedtls_pem_free(&pem);
1658 return ret;
1659 } else if (ret != MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT) {
1660 return ret;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001661 }
Paul Bakker1a7550a2013-09-15 13:01:22 +02001662
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001663#if defined(MBEDTLS_PKCS12_C) || defined(MBEDTLS_PKCS5_C)
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +02001664 /* Avoid calling mbedtls_pem_read_buffer() on non-null-terminated string */
Gilles Peskine449bd832023-01-11 14:50:10 +01001665 if (key[keylen - 1] != '\0') {
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +02001666 ret = MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT;
Gilles Peskine449bd832023-01-11 14:50:10 +01001667 } else {
1668 ret = mbedtls_pem_read_buffer(&pem,
1669 "-----BEGIN ENCRYPTED PRIVATE KEY-----",
1670 "-----END ENCRYPTED PRIVATE KEY-----",
1671 key, NULL, 0, &len);
1672 }
1673 if (ret == 0) {
1674 if ((ret = pk_parse_key_pkcs8_encrypted_der(pk, pem.buf, pem.buflen,
1675 pwd, pwdlen, f_rng, p_rng)) != 0) {
1676 mbedtls_pk_free(pk);
Paul Bakker1a7550a2013-09-15 13:01:22 +02001677 }
1678
Gilles Peskine449bd832023-01-11 14:50:10 +01001679 mbedtls_pem_free(&pem);
1680 return ret;
1681 } else if (ret != MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT) {
1682 return ret;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001683 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001684#endif /* MBEDTLS_PKCS12_C || MBEDTLS_PKCS5_C */
Paul Bakker1a7550a2013-09-15 13:01:22 +02001685#else
1686 ((void) pwd);
1687 ((void) pwdlen);
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001688#endif /* MBEDTLS_PEM_PARSE_C */
Paul Bakker1a7550a2013-09-15 13:01:22 +02001689
1690 /*
Brian J Murray2adecba2016-11-06 04:45:15 -08001691 * At this point we only know it's not a PEM formatted key. Could be any
1692 * of the known DER encoded private key formats
1693 *
1694 * We try the different DER format parsers to see if one passes without
1695 * error
1696 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001697#if defined(MBEDTLS_PKCS12_C) || defined(MBEDTLS_PKCS5_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001698 if (pwdlen != 0) {
Hanno Beckerfab35692017-08-25 13:38:26 +01001699 unsigned char *key_copy;
1700
Gilles Peskine449bd832023-01-11 14:50:10 +01001701 if ((key_copy = mbedtls_calloc(1, keylen)) == NULL) {
1702 return MBEDTLS_ERR_PK_ALLOC_FAILED;
1703 }
Hanno Beckerfab35692017-08-25 13:38:26 +01001704
Gilles Peskine449bd832023-01-11 14:50:10 +01001705 memcpy(key_copy, key, keylen);
Hanno Beckerfab35692017-08-25 13:38:26 +01001706
Gilles Peskine449bd832023-01-11 14:50:10 +01001707 ret = pk_parse_key_pkcs8_encrypted_der(pk, key_copy, keylen,
1708 pwd, pwdlen, f_rng, p_rng);
Hanno Beckerfab35692017-08-25 13:38:26 +01001709
Gilles Peskine449bd832023-01-11 14:50:10 +01001710 mbedtls_platform_zeroize(key_copy, keylen);
1711 mbedtls_free(key_copy);
Paul Bakker1a7550a2013-09-15 13:01:22 +02001712 }
1713
Gilles Peskine449bd832023-01-11 14:50:10 +01001714 if (ret == 0) {
1715 return 0;
1716 }
Hanno Beckerfab35692017-08-25 13:38:26 +01001717
Gilles Peskine449bd832023-01-11 14:50:10 +01001718 mbedtls_pk_free(pk);
1719 mbedtls_pk_init(pk);
Paul Bakker1a7550a2013-09-15 13:01:22 +02001720
Gilles Peskine449bd832023-01-11 14:50:10 +01001721 if (ret == MBEDTLS_ERR_PK_PASSWORD_MISMATCH) {
1722 return ret;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001723 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001724#endif /* MBEDTLS_PKCS12_C || MBEDTLS_PKCS5_C */
Paul Bakker1a7550a2013-09-15 13:01:22 +02001725
Gilles Peskine449bd832023-01-11 14:50:10 +01001726 ret = pk_parse_key_pkcs8_unencrypted_der(pk, key, keylen, f_rng, p_rng);
1727 if (ret == 0) {
1728 return 0;
Manuel Pégourié-Gonnard84dea012021-06-15 11:29:26 +02001729 }
Paul Bakker1a7550a2013-09-15 13:01:22 +02001730
Gilles Peskine449bd832023-01-11 14:50:10 +01001731 mbedtls_pk_free(pk);
1732 mbedtls_pk_init(pk);
Paul Bakker1a7550a2013-09-15 13:01:22 +02001733
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001734#if defined(MBEDTLS_RSA_C)
Paul Bakker1a7550a2013-09-15 13:01:22 +02001735
Gilles Peskine449bd832023-01-11 14:50:10 +01001736 pk_info = mbedtls_pk_info_from_type(MBEDTLS_PK_RSA);
1737 if (mbedtls_pk_setup(pk, pk_info) == 0 &&
1738 pk_parse_key_pkcs1_der(mbedtls_pk_rsa(*pk), key, keylen) == 0) {
1739 return 0;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001740 }
1741
Gilles Peskine449bd832023-01-11 14:50:10 +01001742 mbedtls_pk_free(pk);
1743 mbedtls_pk_init(pk);
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001744#endif /* MBEDTLS_RSA_C */
Paul Bakker1a7550a2013-09-15 13:01:22 +02001745
Valerio Setti0d2980f2023-04-05 18:17:13 +02001746#if defined(MBEDTLS_ECP_LIGHT)
Gilles Peskine449bd832023-01-11 14:50:10 +01001747 pk_info = mbedtls_pk_info_from_type(MBEDTLS_PK_ECKEY);
1748 if (mbedtls_pk_setup(pk, pk_info) == 0 &&
Valerio Setti4064dbb2023-05-17 15:33:07 +02001749 pk_parse_key_sec1_der(pk,
Gilles Peskine449bd832023-01-11 14:50:10 +01001750 key, keylen, f_rng, p_rng) == 0) {
1751 return 0;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001752 }
Gilles Peskine449bd832023-01-11 14:50:10 +01001753 mbedtls_pk_free(pk);
Valerio Setti0d2980f2023-04-05 18:17:13 +02001754#endif /* MBEDTLS_ECP_LIGHT */
Paul Bakker1a7550a2013-09-15 13:01:22 +02001755
Valerio Setti4064dbb2023-05-17 15:33:07 +02001756 /* If MBEDTLS_RSA_C is defined but MBEDTLS_ECP_LIGHT isn't,
Hanno Becker780f0a42018-10-10 11:23:33 +01001757 * it is ok to leave the PK context initialized but not
1758 * freed: It is the caller's responsibility to call pk_init()
1759 * before calling this function, and to call pk_free()
Valerio Setti4064dbb2023-05-17 15:33:07 +02001760 * when it fails. If MBEDTLS_ECP_LIGHT is defined but MBEDTLS_RSA_C
Hanno Becker780f0a42018-10-10 11:23:33 +01001761 * isn't, this leads to mbedtls_pk_free() being called
1762 * twice, once here and once by the caller, but this is
1763 * also ok and in line with the mbedtls_pk_free() calls
1764 * on failed PEM parsing attempts. */
1765
Gilles Peskine449bd832023-01-11 14:50:10 +01001766 return MBEDTLS_ERR_PK_KEY_INVALID_FORMAT;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001767}
1768
1769/*
1770 * Parse a public key
1771 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001772int mbedtls_pk_parse_public_key(mbedtls_pk_context *ctx,
1773 const unsigned char *key, size_t keylen)
Paul Bakker1a7550a2013-09-15 13:01:22 +02001774{
Janos Follath24eed8d2019-11-22 13:21:35 +00001775 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001776 unsigned char *p;
Ron Eldor5472d432017-10-17 09:49:00 +03001777#if defined(MBEDTLS_RSA_C)
1778 const mbedtls_pk_info_t *pk_info;
1779#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001780#if defined(MBEDTLS_PEM_PARSE_C)
Paul Bakker1a7550a2013-09-15 13:01:22 +02001781 size_t len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001782 mbedtls_pem_context pem;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001783#endif
Paul Bakker1a7550a2013-09-15 13:01:22 +02001784
Gilles Peskine449bd832023-01-11 14:50:10 +01001785 if (keylen == 0) {
1786 return MBEDTLS_ERR_PK_KEY_INVALID_FORMAT;
1787 }
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001788
1789#if defined(MBEDTLS_PEM_PARSE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001790 mbedtls_pem_init(&pem);
Ron Eldord0c56de2017-10-10 17:03:08 +03001791#if defined(MBEDTLS_RSA_C)
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +02001792 /* Avoid calling mbedtls_pem_read_buffer() on non-null-terminated string */
Gilles Peskine449bd832023-01-11 14:50:10 +01001793 if (key[keylen - 1] != '\0') {
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +02001794 ret = MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT;
Gilles Peskine449bd832023-01-11 14:50:10 +01001795 } else {
1796 ret = mbedtls_pem_read_buffer(&pem,
1797 "-----BEGIN RSA PUBLIC KEY-----",
1798 "-----END RSA PUBLIC KEY-----",
1799 key, NULL, 0, &len);
Ron Eldord0c56de2017-10-10 17:03:08 +03001800 }
Gilles Peskine449bd832023-01-11 14:50:10 +01001801
1802 if (ret == 0) {
1803 p = pem.buf;
1804 if ((pk_info = mbedtls_pk_info_from_type(MBEDTLS_PK_RSA)) == NULL) {
1805 mbedtls_pem_free(&pem);
1806 return MBEDTLS_ERR_PK_UNKNOWN_PK_ALG;
1807 }
1808
1809 if ((ret = mbedtls_pk_setup(ctx, pk_info)) != 0) {
1810 mbedtls_pem_free(&pem);
1811 return ret;
1812 }
1813
1814 if ((ret = pk_get_rsapubkey(&p, p + pem.buflen, mbedtls_pk_rsa(*ctx))) != 0) {
1815 mbedtls_pk_free(ctx);
1816 }
1817
1818 mbedtls_pem_free(&pem);
1819 return ret;
1820 } else if (ret != MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT) {
1821 mbedtls_pem_free(&pem);
1822 return ret;
Ron Eldord0c56de2017-10-10 17:03:08 +03001823 }
1824#endif /* MBEDTLS_RSA_C */
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +02001825
1826 /* Avoid calling mbedtls_pem_read_buffer() on non-null-terminated string */
Gilles Peskine449bd832023-01-11 14:50:10 +01001827 if (key[keylen - 1] != '\0') {
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +02001828 ret = MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT;
Gilles Peskine449bd832023-01-11 14:50:10 +01001829 } else {
1830 ret = mbedtls_pem_read_buffer(&pem,
1831 "-----BEGIN PUBLIC KEY-----",
1832 "-----END PUBLIC KEY-----",
1833 key, NULL, 0, &len);
1834 }
Paul Bakker1a7550a2013-09-15 13:01:22 +02001835
Gilles Peskine449bd832023-01-11 14:50:10 +01001836 if (ret == 0) {
Paul Bakker1a7550a2013-09-15 13:01:22 +02001837 /*
1838 * Was PEM encoded
1839 */
Ron Eldor40b14a82017-10-16 19:30:00 +03001840 p = pem.buf;
1841
Jethro Beekman01672442023-04-19 14:08:14 +02001842 ret = mbedtls_pk_parse_subpubkey(&p, p + pem.buflen, ctx);
Gilles Peskine449bd832023-01-11 14:50:10 +01001843 mbedtls_pem_free(&pem);
1844 return ret;
1845 } else if (ret != MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT) {
1846 mbedtls_pem_free(&pem);
1847 return ret;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001848 }
Gilles Peskine449bd832023-01-11 14:50:10 +01001849 mbedtls_pem_free(&pem);
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001850#endif /* MBEDTLS_PEM_PARSE_C */
Ron Eldor40b14a82017-10-16 19:30:00 +03001851
1852#if defined(MBEDTLS_RSA_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001853 if ((pk_info = mbedtls_pk_info_from_type(MBEDTLS_PK_RSA)) == NULL) {
1854 return MBEDTLS_ERR_PK_UNKNOWN_PK_ALG;
Ron Eldor40b14a82017-10-16 19:30:00 +03001855 }
Gilles Peskine449bd832023-01-11 14:50:10 +01001856
1857 if ((ret = mbedtls_pk_setup(ctx, pk_info)) != 0) {
1858 return ret;
1859 }
1860
1861 p = (unsigned char *) key;
1862 ret = pk_get_rsapubkey(&p, p + keylen, mbedtls_pk_rsa(*ctx));
1863 if (ret == 0) {
1864 return ret;
1865 }
1866 mbedtls_pk_free(ctx);
1867 if (ret != (MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_INVALID_PUBKEY,
1868 MBEDTLS_ERR_ASN1_UNEXPECTED_TAG))) {
1869 return ret;
Ron Eldor40b14a82017-10-16 19:30:00 +03001870 }
1871#endif /* MBEDTLS_RSA_C */
Paul Bakker1a7550a2013-09-15 13:01:22 +02001872 p = (unsigned char *) key;
1873
Gilles Peskine449bd832023-01-11 14:50:10 +01001874 ret = mbedtls_pk_parse_subpubkey(&p, p + keylen, ctx);
Paul Bakker1a7550a2013-09-15 13:01:22 +02001875
Gilles Peskine449bd832023-01-11 14:50:10 +01001876 return ret;
Paul Bakker1a7550a2013-09-15 13:01:22 +02001877}
1878
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001879#endif /* MBEDTLS_PK_PARSE_C */