pkix-verify.cpp@ 73668

最後變更在這個檔案從73668是 73665,由 vboxsync 提交於 7 年前
IPRT,SUP,Main: Working on new crypto key handling and rsa signing. bugref:9152
屬性 svn:eol-style 設為 `native` 屬性 svn:keywords 設為 `Author Date Id Revision`
檔案大小: 12.0 KB

行
1	/* $Id: pkix-verify.cpp 73665 2018-08-14 17:49:23Z vboxsync $ */
2	/** @file
3	* IPRT - Crypto - Public Key Infrastructure API, Verification.
4	*/
5
6	/*
7	* Copyright (C) 2006-2017 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.alldomusa.eu.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* The contents of this file may alternatively be used under the terms
18	* of the Common Development and Distribution License Version 1.0
19	* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20	* VirtualBox OSE distribution, in which case the provisions of the
21	* CDDL are applicable instead of those of the GPL.
22	*
23	* You may elect to license modified versions of this file under the
24	* terms and conditions of either the GPL or the CDDL or both.
25	*/
26
27
28	/*********************************************************************************************************************************
29	* Header Files *
30	*********************************************************************************************************************************/
31	#include "internal/iprt.h"
32	#include <iprt/crypto/pkix.h>
33
34	#include <iprt/err.h>
35	#include <iprt/string.h>
36	#include <iprt/crypto/digest.h>
37	#include <iprt/crypto/key.h>
38
39	#ifdef IPRT_WITH_OPENSSL
40	# include "internal/iprt-openssl.h"
41	# include "openssl/evp.h"
42	# ifndef OPENSSL_VERSION_NUMBER
43	# error "Missing OPENSSL_VERSION_NUMBER!"
44	# endif
45	#endif
46
47
48
49	RTDECL(int) RTCrPkixPubKeyVerifySignature(PCRTASN1OBJID pAlgorithm, RTCRKEY hPublicKey, PCRTASN1DYNTYPE pParameters,
50	PCRTASN1BITSTRING pSignatureValue, const void *pvData, size_t cbData,
51	PRTERRINFO pErrInfo)
52	{
53	/*
54	* Valid input.
55	*/
56	AssertPtrReturn(pAlgorithm, VERR_INVALID_POINTER);
57	AssertReturn(RTAsn1ObjId_IsPresent(pAlgorithm), VERR_INVALID_POINTER);
58
59	if (pParameters)
60	{
61	AssertPtrReturn(pParameters, VERR_INVALID_POINTER);
62	if (pParameters->enmType == RTASN1TYPE_NULL)
63	pParameters = NULL;
64	}
65
66	AssertPtrReturn(hPublicKey, VERR_INVALID_POINTER);
67	Assert(RTCrKeyHasPublicPart(hPublicKey));
68
69	AssertPtrReturn(pSignatureValue, VERR_INVALID_POINTER);
70	AssertReturn(RTAsn1BitString_IsPresent(pSignatureValue), VERR_INVALID_POINTER);
71
72	AssertPtrReturn(pvData, VERR_INVALID_POINTER);
73	AssertReturn(cbData > 0, VERR_INVALID_PARAMETER);
74
75	/*
76	* Parameters are not currently supported (openssl code path).
77	*/
78	if (pParameters)
79	return RTErrInfoSet(pErrInfo, VERR_CR_PKIX_CIPHER_ALGO_PARAMS_NOT_IMPL,
80	"Cipher algorithm parameters are not yet supported.");
81
82	/*
83	* Validate using IPRT.
84	*/
85	RTCRPKIXSIGNATURE hSignature;
86	int rcIprt = RTCrPkixSignatureCreateByObjId(&hSignature, pAlgorithm, hPublicKey, pParameters, false /fSigning/);
87	if (RT_FAILURE(rcIprt))
88	return RTErrInfoSetF(pErrInfo, VERR_CR_PKIX_CIPHER_ALGO_NOT_KNOWN,
89	"Unknown public key algorithm [IPRT]: %s", pAlgorithm->szObjId);
90
91	RTCRDIGEST hDigest;
92	rcIprt = RTCrDigestCreateByObjId(&hDigest, pAlgorithm);
93	if (RT_SUCCESS(rcIprt))
94	{
95	/* Calculate the digest. */
96	rcIprt = RTCrDigestUpdate(hDigest, pvData, cbData);
97	if (RT_SUCCESS(rcIprt))
98	{
99	rcIprt = RTCrPkixSignatureVerifyBitString(hSignature, hDigest, pSignatureValue);
100	if (RT_FAILURE(rcIprt))
101	RTErrInfoSet(pErrInfo, rcIprt, "RTCrPkixSignatureVerifyBitString failed");
102	}
103	else
104	RTErrInfoSet(pErrInfo, rcIprt, "RTCrDigestUpdate failed");
105	RTCrDigestRelease(hDigest);
106	}
107	else
108	RTErrInfoSetF(pErrInfo, rcIprt, "Unknown digest algorithm [IPRT]: %s", pAlgorithm->szObjId);
109	RTCrPkixSignatureRelease(hSignature);
110
111	#ifdef IPRT_WITH_OPENSSL
112	/*
113	* Validate using OpenSSL EVP.
114	*/
115	/* Create an EVP public key. */
116	EVP_PKEY *pEvpPublicKey = NULL;
117	const EVP_MD *pEvpMdType = NULL;
118	int rcOssl = rtCrKeyToOpenSslKey(hPublicKey, true /fNeedPublic/, pAlgorithm->szObjId, &pEvpPublicKey, &pEvpMdType, pErrInfo);
119	if (RT_SUCCESS(rcOssl))
120	{
121	EVP_MD_CTX *pEvpMdCtx = EVP_MD_CTX_create();
122	if (pEvpMdCtx)
123	{
124	if (EVP_VerifyInit_ex(pEvpMdCtx, pEvpMdType, NULL /engine/))
125	{
126	/* Digest the data. */
127	EVP_VerifyUpdate(pEvpMdCtx, pvData, cbData);
128
129	/* Verify the signature. */
130	if (EVP_VerifyFinal(pEvpMdCtx,
131	RTASN1BITSTRING_GET_BIT0_PTR(pSignatureValue),
132	RTASN1BITSTRING_GET_BYTE_SIZE(pSignatureValue),
133	pEvpPublicKey) > 0)
134	rcOssl = VINF_SUCCESS;
135	else
136	rcOssl = RTErrInfoSet(pErrInfo, VERR_CR_PKIX_OSSL_VERIFY_FINAL_FAILED, "EVP_VerifyFinal failed");
137
138	/* Cleanup and return: */
139	}
140	else
141	rcOssl = RTErrInfoSetF(pErrInfo, VERR_CR_PKIX_OSSL_CIPHER_ALOG_INIT_FAILED,
142	"EVP_VerifyInit_ex failed (algorithm type is %s)", pAlgorithm->szObjId);
143	EVP_MD_CTX_destroy(pEvpMdCtx);
144	}
145	else
146	rcOssl = RTErrInfoSetF(pErrInfo, VERR_NO_MEMORY, "EVP_MD_CTX_create failed");
147	EVP_PKEY_free(pEvpPublicKey);
148	}
149
150	/*
151	* Check the result.
152	*/
153	if (RT_SUCCESS(rcIprt) && RT_SUCCESS(rcOssl))
154	return VINF_SUCCESS;
155	if (RT_FAILURE_NP(rcIprt) && RT_FAILURE_NP(rcOssl))
156	return rcIprt;
157	AssertMsgFailed(("rcIprt=%Rrc rcOssl=%Rrc\n", rcIprt, rcOssl));
158	if (RT_FAILURE_NP(rcOssl))
159	return rcOssl;
160	#endif /* IPRT_WITH_OPENSSL */
161
162	return rcIprt;
163	}
164
165
166	RTDECL(int) RTCrPkixPubKeyVerifySignedDigest(PCRTASN1OBJID pAlgorithm, RTCRKEY hPublicKey, PCRTASN1DYNTYPE pParameters,
167	void const *pvSignedDigest, size_t cbSignedDigest, RTCRDIGEST hDigest,
168	PRTERRINFO pErrInfo)
169	{
170	/*
171	* Valid input.
172	*/
173	AssertPtrReturn(pAlgorithm, VERR_INVALID_POINTER);
174	AssertReturn(RTAsn1ObjId_IsPresent(pAlgorithm), VERR_INVALID_POINTER);
175
176	if (pParameters)
177	{
178	AssertPtrReturn(pParameters, VERR_INVALID_POINTER);
179	if (pParameters->enmType == RTASN1TYPE_NULL)
180	pParameters = NULL;
181	}
182
183	AssertPtrReturn(hPublicKey, VERR_INVALID_POINTER);
184	Assert(RTCrKeyHasPublicPart(hPublicKey));
185
186	AssertPtrReturn(pvSignedDigest, VERR_INVALID_POINTER);
187	AssertReturn(cbSignedDigest, VERR_INVALID_PARAMETER);
188
189	AssertPtrReturn(hDigest, VERR_INVALID_HANDLE);
190
191	/*
192	* Parameters are not currently supported (openssl code path).
193	*/
194	if (pParameters)
195	return RTErrInfoSet(pErrInfo, VERR_CR_PKIX_CIPHER_ALGO_PARAMS_NOT_IMPL,
196	"Cipher algorithm parameters are not yet supported.");
197
198	/*
199	* Validate using IPRT.
200	*/
201	RTCRPKIXSIGNATURE hSignature;
202	int rcIprt = RTCrPkixSignatureCreateByObjId(&hSignature, pAlgorithm, hPublicKey, pParameters, false /fSigning/);
203	if (RT_FAILURE(rcIprt))
204	return RTErrInfoSetF(pErrInfo, VERR_CR_PKIX_CIPHER_ALGO_NOT_KNOWN,
205	"Unknown public key algorithm [IPRT]: %s", pAlgorithm->szObjId);
206
207	rcIprt = RTCrPkixSignatureVerify(hSignature, hDigest, pvSignedDigest, cbSignedDigest);
208	if (RT_FAILURE(rcIprt))
209	RTErrInfoSet(pErrInfo, rcIprt, "RTCrPkixSignatureVerifyBitString failed");
210
211	RTCrPkixSignatureRelease(hSignature);
212
213	#if defined(IPRT_WITH_OPENSSL) \
214	&& (OPENSSL_VERSION_NUMBER > 0x10000000L) /* 0.9.8 doesn't seem to have EVP_PKEY_CTX_set_signature_md. */
215	/*
216	* Validate using OpenSSL EVP.
217	*/
218	/* Combine encryption and digest if the algorithm doesn't specify the digest type. */
219	const char *pszAlgObjId = pAlgorithm->szObjId;
220	if (!strcmp(pszAlgObjId, RTCRX509ALGORITHMIDENTIFIERID_RSA))
221	{
222	pszAlgObjId = RTCrX509AlgorithmIdentifier_CombineEncryptionOidAndDigestOid(pszAlgObjId,
223	RTCrDigestGetAlgorithmOid(hDigest));
224	AssertMsgStmt(pszAlgObjId, ("enc=%s hash=%s\n", pAlgorithm->szObjId, RTCrDigestGetAlgorithmOid(hDigest)),
225	pszAlgObjId = RTCrDigestGetAlgorithmOid(hDigest));
226	}
227
228	/* Create an EVP public key. */
229	EVP_PKEY *pEvpPublicKey = NULL;
230	const EVP_MD *pEvpMdType = NULL;
231	int rcOssl = rtCrKeyToOpenSslKey(hPublicKey, true /fNeedPublic/, pszAlgObjId, &pEvpPublicKey, &pEvpMdType, pErrInfo);
232	if (RT_SUCCESS(rcOssl))
233	{
234	/* Create an EVP public key context we can use to validate the digest. */
235	EVP_PKEY_CTX *pEvpPKeyCtx = EVP_PKEY_CTX_new(pEvpPublicKey, NULL);
236	if (pEvpPKeyCtx)
237	{
238	rcOssl = EVP_PKEY_verify_init(pEvpPKeyCtx);
239	if (rcOssl > 0)
240	{
241	rcOssl = EVP_PKEY_CTX_set_signature_md(pEvpPKeyCtx, pEvpMdType);
242	if (rcOssl > 0)
243	{
244	/* Get the digest from hDigest and verify it. */
245	rcOssl = EVP_PKEY_verify(pEvpPKeyCtx,
246	(uint8_t const *)pvSignedDigest,
247	cbSignedDigest,
248	RTCrDigestGetHash(hDigest),
249	RTCrDigestGetHashSize(hDigest));
250	if (rcOssl > 0)
251	rcOssl = VINF_SUCCESS;
252	else
253	rcOssl = RTErrInfoSetF(pErrInfo, VERR_CR_PKIX_OSSL_VERIFY_FINAL_FAILED,
254	"EVP_PKEY_verify failed (%d)", rcOssl);
255	/* Cleanup and return: */
256	}
257	else
258	rcOssl = RTErrInfoSetF(pErrInfo, VERR_CR_PKIX_OSSL_EVP_PKEY_TYPE_ERROR,
259	"EVP_PKEY_CTX_set_signature_md failed (%d)", rcOssl);
260	}
261	else
262	rcOssl = RTErrInfoSetF(pErrInfo, VERR_CR_PKIX_OSSL_EVP_PKEY_TYPE_ERROR,
263	"EVP_PKEY_verify_init failed (%d)", rcOssl);
264	EVP_PKEY_CTX_free(pEvpPKeyCtx);
265	}
266	else
267	rcOssl = RTErrInfoSet(pErrInfo, VERR_CR_PKIX_OSSL_EVP_PKEY_TYPE_ERROR, "EVP_PKEY_CTX_new failed");
268	EVP_PKEY_free(pEvpPublicKey);
269	}
270
271	/*
272	* Check the result.
273	*/
274	if (RT_SUCCESS(rcIprt) && RT_SUCCESS(rcOssl))
275	return VINF_SUCCESS;
276	if (RT_FAILURE_NP(rcIprt) && RT_FAILURE_NP(rcOssl))
277	return rcIprt;
278	AssertMsgFailed(("rcIprt=%Rrc rcOssl=%Rrc\n", rcIprt, rcOssl));
279	if (RT_FAILURE_NP(rcOssl))
280	return rcOssl;
281	#endif /* IPRT_WITH_OPENSSL */
282
283	return rcIprt;
284	}
285
286
287	RTDECL(int) RTCrPkixPubKeyVerifySignedDigestByCertPubKeyInfo(PCRTCRX509SUBJECTPUBLICKEYINFO pCertPubKeyInfo,
288	void const *pvSignedDigest, size_t cbSignedDigest,
289	RTCRDIGEST hDigest, PRTERRINFO pErrInfo)
290	{
291	RTCRKEY hPublicKey;
292	int rc = RTCrKeyCreateFromPublicAlgorithmAndBits(&hPublicKey, &pCertPubKeyInfo->Algorithm.Algorithm,
293	&pCertPubKeyInfo->SubjectPublicKey, pErrInfo, NULL);
294	if (RT_SUCCESS(rc))
295	{
296	rc = RTCrPkixPubKeyVerifySignedDigest(&pCertPubKeyInfo->Algorithm.Algorithm, hPublicKey,
297	&pCertPubKeyInfo->Algorithm.Parameters, pvSignedDigest, cbSignedDigest,
298	hDigest, pErrInfo);
299
300	uint32_t cRefs = RTCrKeyRelease(hPublicKey);
301	Assert(cRefs == 0); RT_NOREF(cRefs);
302	}
303	return rc;
304	}
305

注意: 瀏覽 TracBrowser 來幫助您使用儲存庫瀏覽器

source: vbox/trunk/src/VBox/Runtime/common/crypto/pkix-verify.cpp@ 73668

以其他格式下載: