Commit d2a53c22 authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

Experimental CMS password based recipient Info support.

parent 480af99e

CHANGES

+4 −0
Original line number Diff line number Diff line
@@ -4,6 +4,10 @@ 


 Changes between 1.0.0 and 1.1.0  [xx XXX xxxx]



  *) Experiemental password based recipient info support for CMS library:

     implementing RFC3211.

     [Steve Henson]



  *) Split password based encryption into PBES2 and PBKDF2 functions. This

     neatly separates the code into cipher and PBE sections and is required

     for some algorithms that split PBES2 into separate pieces (such as

apps/cms.c

+33 −2
Original line number Diff line number Diff line
@@ -136,6 +136,7 @@ int MAIN(int argc, char **argv) 
	char *engine=NULL;

#endif

	unsigned char *secret_key = NULL, *secret_keyid = NULL;

	unsigned char *pwri_pass = NULL, *pwri_tmp = NULL;

	size_t secret_keylen = 0, secret_keyidlen = 0;



	ASN1_OBJECT *econtent_type = NULL;
@@ -326,6 +327,13 @@ int MAIN(int argc, char **argv) 
				}

			secret_keyidlen = (size_t)ltmp;

			}

		else if (!strcmp(*args,"-pwri_password"))

			{

			if (!args[1])

				goto argerr;

			args++;

			pwri_pass = (unsigned char *)*args;

			}

		else if (!strcmp(*args,"-econtent_type"))

			{

			if (!args[1])
@@ -559,7 +567,7 @@ int MAIN(int argc, char **argv) 


	else if (operation == SMIME_DECRYPT)

		{

		if (!recipfile && !keyfile && !secret_key)

		if (!recipfile && !keyfile && !secret_key && !pwri_pass)

			{

			BIO_printf(bio_err, "No recipient certificate or key specified\n");

			badarg = 1;
@@ -567,7 +575,7 @@ int MAIN(int argc, char **argv) 
		}

	else if (operation == SMIME_ENCRYPT)

		{

		if (!*args && !secret_key)

		if (!*args && !secret_key && !pwri_pass)

			{

			BIO_printf(bio_err, "No recipient(s) certificate(s) specified\n");

			badarg = 1;
@@ -917,6 +925,17 @@ int MAIN(int argc, char **argv) 
			secret_key = NULL;

			secret_keyid = NULL;

			}

		if (pwri_pass)

			{

			pwri_tmp = (unsigned char *)BUF_strdup((char *)pwri_pass);

			if (!pwri_tmp)

				goto end;

			if (!CMS_add0_recipient_password(cms,

						-1, NID_undef, NID_undef,

						 pwri_tmp, -1, NULL))

				goto end;

			pwri_tmp = NULL;

			}

		if (!(flags & CMS_STREAM))

			{

			if (!CMS_final(cms, in, NULL, flags))
@@ -1043,6 +1062,16 @@ int MAIN(int argc, char **argv) 
				}

			}



		if (pwri_pass)

			{

			if (!CMS_decrypt_set1_password(cms, pwri_pass, -1))

				{

				BIO_puts(bio_err,

					"Error decrypting CMS using password\n");

				goto end;

				}

			}



		if (!CMS_decrypt(cms, NULL, NULL, indata, out, flags))

			{

			BIO_printf(bio_err, "Error decrypting CMS structure\n");
@@ -1167,6 +1196,8 @@ end: 
		OPENSSL_free(secret_key);

	if (secret_keyid)

		OPENSSL_free(secret_keyid);

	if (pwri_tmp)

		OPENSSL_free(pwri_tmp);

	if (econtent_type)

		ASN1_OBJECT_free(econtent_type);

	if (rr)

crypto/cms/Makefile

+4 −2
Original line number Diff line number Diff line
@@ -18,9 +18,11 @@ APPS= 


LIB=$(TOP)/libcrypto.a

LIBSRC= cms_lib.c cms_asn1.c cms_att.c cms_io.c cms_smime.c cms_err.c \

	cms_sd.c cms_dd.c cms_cd.c cms_env.c cms_enc.c cms_ess.c

	cms_sd.c cms_dd.c cms_cd.c cms_env.c cms_enc.c cms_ess.c \

	cms_pwri.c

LIBOBJ= cms_lib.o cms_asn1.o cms_att.o cms_io.o cms_smime.o cms_err.o \

	cms_sd.o cms_dd.o cms_cd.o cms_env.o cms_enc.o cms_ess.o

	cms_sd.o cms_dd.o cms_cd.o cms_env.o cms_enc.o cms_ess.o \

	cms_pwri.o



SRC= $(LIBSRC)

crypto/cms/cms.h

+19 −0
Original line number Diff line number Diff line
@@ -184,6 +184,8 @@ int CMS_decrypt_set1_pkey(CMS_ContentInfo *cms, EVP_PKEY *pk, X509 *cert); 
int CMS_decrypt_set1_key(CMS_ContentInfo *cms, 

				unsigned char *key, size_t keylen,

				unsigned char *id, size_t idlen);

int CMS_decrypt_set1_password(CMS_ContentInfo *cms, 

				unsigned char *pass, ssize_t passlen);



STACK_OF(CMS_RecipientInfo) *CMS_get0_RecipientInfos(CMS_ContentInfo *cms);

int CMS_RecipientInfo_type(CMS_RecipientInfo *ri);
@@ -219,6 +221,14 @@ int CMS_RecipientInfo_set0_key(CMS_RecipientInfo *ri, 
int CMS_RecipientInfo_kekri_id_cmp(CMS_RecipientInfo *ri, 

					const unsigned char *id, size_t idlen);



int CMS_RecipientInfo_set0_password(CMS_RecipientInfo *ri, 

					unsigned char *pass, ssize_t passlen);



CMS_RecipientInfo *CMS_add0_recipient_password(CMS_ContentInfo *cms,

					int iter, int wrap_nid, int pbe_nid,

					unsigned char *pass, ssize_t passlen,

					const EVP_CIPHER *kekciph);



int CMS_RecipientInfo_decrypt(CMS_ContentInfo *cms, CMS_RecipientInfo *ri);

	

int CMS_uncompress(CMS_ContentInfo *cms, BIO *dcont, BIO *out,
@@ -330,6 +340,7 @@ void ERR_load_CMS_strings(void); 
#define CMS_F_CHECK_CONTENT				 99

#define CMS_F_CMS_ADD0_CERT				 164

#define CMS_F_CMS_ADD0_RECIPIENT_KEY			 100

#define CMS_F_CMS_ADD0_RECIPIENT_PASSWORD		 165

#define CMS_F_CMS_ADD1_RECEIPTREQUEST			 158

#define CMS_F_CMS_ADD1_RECIPIENT_CERT			 101

#define CMS_F_CMS_ADD1_SIGNER				 102
@@ -344,6 +355,7 @@ void ERR_load_CMS_strings(void); 
#define CMS_F_CMS_DATAINIT				 111

#define CMS_F_CMS_DECRYPT				 112

#define CMS_F_CMS_DECRYPT_SET1_KEY			 113

#define CMS_F_CMS_DECRYPT_SET1_PASSWORD			 166

#define CMS_F_CMS_DECRYPT_SET1_PKEY			 114

#define CMS_F_CMS_DIGESTALGORITHM_FIND_CTX		 115

#define CMS_F_CMS_DIGESTALGORITHM_INIT_BIO		 116
@@ -378,7 +390,9 @@ void ERR_load_CMS_strings(void); 
#define CMS_F_CMS_RECIPIENTINFO_KTRI_ENCRYPT		 141

#define CMS_F_CMS_RECIPIENTINFO_KTRI_GET0_ALGS		 142

#define CMS_F_CMS_RECIPIENTINFO_KTRI_GET0_SIGNER_ID	 143

#define CMS_F_CMS_RECIPIENTINFO_PWRI_CRYPT		 167

#define CMS_F_CMS_RECIPIENTINFO_SET0_KEY		 144

#define CMS_F_CMS_RECIPIENTINFO_SET0_PASSWORD		 168

#define CMS_F_CMS_RECIPIENTINFO_SET0_PKEY		 145

#define CMS_F_CMS_SET1_SIGNERIDENTIFIER			 146

#define CMS_F_CMS_SET_DETACHED				 147
@@ -419,6 +433,7 @@ void ERR_load_CMS_strings(void); 
#define CMS_R_ERROR_SETTING_KEY				 115

#define CMS_R_ERROR_SETTING_RECIPIENTINFO		 116

#define CMS_R_INVALID_ENCRYPTED_KEY_LENGTH		 117

#define CMS_R_INVALID_KEY_ENCRYPTION_PARAMETER		 176

#define CMS_R_INVALID_KEY_LENGTH			 118

#define CMS_R_MD_BIO_INIT_ERROR				 119

#define CMS_R_MESSAGEDIGEST_ATTRIBUTE_WRONG_LENGTH	 120
@@ -431,6 +446,7 @@ void ERR_load_CMS_strings(void); 
#define CMS_R_NOT_ENCRYPTED_DATA			 122

#define CMS_R_NOT_KEK					 123

#define CMS_R_NOT_KEY_TRANSPORT				 124

#define CMS_R_NOT_PWRI					 177

#define CMS_R_NOT_SUPPORTED_FOR_THIS_KEY_TYPE		 125

#define CMS_R_NO_CIPHER					 126

#define CMS_R_NO_CONTENT				 127
@@ -443,6 +459,7 @@ void ERR_load_CMS_strings(void); 
#define CMS_R_NO_MATCHING_RECIPIENT			 132

#define CMS_R_NO_MATCHING_SIGNATURE			 166

#define CMS_R_NO_MSGSIGDIGEST				 167

#define CMS_R_NO_PASSWORD				 178

#define CMS_R_NO_PRIVATE_KEY				 133

#define CMS_R_NO_PUBLIC_KEY				 134

#define CMS_R_NO_RECEIPT_REQUEST			 168
@@ -466,10 +483,12 @@ void ERR_load_CMS_strings(void); 
#define CMS_R_UNSUPPORTED_COMPRESSION_ALGORITHM		 151

#define CMS_R_UNSUPPORTED_CONTENT_TYPE			 152

#define CMS_R_UNSUPPORTED_KEK_ALGORITHM			 153

#define CMS_R_UNSUPPORTED_KEY_ENCRYPTION_ALGORITHM	 179

#define CMS_R_UNSUPPORTED_RECIPIENT_TYPE		 154

#define CMS_R_UNSUPPORTED_RECPIENTINFO_TYPE		 155

#define CMS_R_UNSUPPORTED_TYPE				 156

#define CMS_R_UNWRAP_ERROR				 157

#define CMS_R_UNWRAP_FAILURE				 180

#define CMS_R_VERIFICATION_FAILURE			 158

#define CMS_R_WRAP_ERROR				 159

crypto/cms/cms_asn1.c

+9 −0
Original line number Diff line number Diff line
@@ -237,6 +237,15 @@ static int cms_ri_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it, 
				OPENSSL_free(kekri->key);

				}

			}

		else if (ri->type == CMS_RECIPINFO_PASS)

			{

			CMS_PasswordRecipientInfo *pwri = ri->d.pwri;

			if (pwri->pass)

				{

				OPENSSL_cleanse(pwri->pass, pwri->passlen);

				OPENSSL_free(pwri->pass);

				}

			}

		}

	return 1;

	}