diff options
Diffstat (limited to 'pkcs11.c')
| -rw-r--r-- | pkcs11.c | 1618 |
1 files changed, 494 insertions, 1124 deletions
@@ -46,7 +46,7 @@ #include <sqlite3.h> -#include "cryptlib.h" +#include <hal.h> /* * Magic PKCS #11 macros that must be defined before including @@ -100,39 +100,6 @@ #define P11_VERSION_HW_MINOR 0 /* - * A value that can't possibly be a valid Cryptlib handle. - */ - -#ifndef CRYPT_HANDLE_NONE -#define CRYPT_HANDLE_NONE (-1) -#endif - -/* - * Whether to enable hardware (FPGA) support. This option may go away - * eventually, once we have enough algorithms implemented in Verilog. - */ - -#ifndef ENABLE_CRYPTLIB_DEVICE -#define ENABLE_CRYPTLIB_DEVICE 1 -#endif - -/* - * Whehter to enable software algorithms. This is not really an - * option at the moment, as the code won't run or even build properly - * if this is disabled. It's a placeholder to let us flag bits of - * code that probably should go away if and when we're doing all the - * crypto algorithms on the FPGA. - */ - -#ifndef ENABLE_CRYPTLIB_SOFTWARE -#define ENABLE_CRYPTLIB_SOFTWARE 1 -#endif - -#if !ENABLE_CRYPTLIB_SOFTWARE -#error Code will not work correctly with software algorithm support disabled -#endif - -/* * Debugging control. */ @@ -150,19 +117,6 @@ #endif /* - * Default name for PKCS #15 keyring. Can be overriden at runtime by - * setting PKCS11_KEYRING environment variable. - * - * In the long term this probably goes away, as all keys should live - * behind the Cryptlib hardware interface, but we need something for - * initial testing. - */ - -#ifndef PKCS15_KEYRING -#define PKCS15_KEYRING ".cryptech-pkcs11.p15" -#endif - -/* * Whether to include POSIX-specific features. */ @@ -183,38 +137,25 @@ */ /* - * Cryptlib handles in the session structure are defined via a silly - * macro so that we can automate initialization and finalization - * without accidently missing any of the handles. + * At present we have no concept of encryption or signature algorithms + * in libhal, as we only support RSA and AES. For PKCS #11 purposes + * we can figure out what kind of key we're looking at from attributes + * like CKA_KEY_TYPE, so it's just something we look up given the key + * object handle. * - * Note that the encryption and decryption cases (other than raw - * encryption with no symmetric cipher algorithm) will need to use the - * enveloping API: see pp 61-62, 70-71, 190 of the Cryptlib manual. - * We may not really need to keep all the contexts around in this case - * once we've bound them into the envelope, drive off that bridge when - * we get to it. + * At the moment we don't need to keep any signature or digest state + * in the session structure, which is good since the current hash + * cores don't allow us to extract state anyway. This makes it + * impossible to implement the incremental operations + * (C_DigestUpdate(), C_SignUpdate()) but also simplifies our current + * task. * - * Syntax: One handle per line, as calls to to-be-defined macros - * SESSION_CRYPTLIB_CONTEXT() or SESSION_CRYPTLIB_ENVELOPE(), entries - * separated by semicolons, no semicolon after last entry. + * General idea is that we have separate descriptors/handles/state for + * each operation that we're allowed to do in parallel, so sign, + * verify, digest, encrypt, decrypt, wrapkey, and unwrapkey all need + * separate slots in the session structure. Add these as we go. */ -#define SESSION_CRYPTLIB_HANDLES \ - SESSION_CRYPTLIB_CONTEXT(sign_key_context); \ - SESSION_CRYPTLIB_CONTEXT(sign_digest_context); \ - SESSION_CRYPTLIB_CONTEXT(verify_key_context); \ - SESSION_CRYPTLIB_CONTEXT(verify_digest_context); \ - SESSION_CRYPTLIB_CONTEXT(digest_context) - -#if 0 - SESSION_CRYPTLIB_CONTEXT(encrypt_key_context); - SESSION_CRYPTLIB_CONTEXT(encrypt_cipher_context); - SESSION_CRYPTLIB_CONTEXT(decrypt_key_context); - SESSION_CRYPTLIB_CONTEXT(decrypt_cipher_context); - SESSION_CRYPTLIB_ENVELOPE(encrypt_envelope); - SESSION_CRYPTLIB_ENVELOPE(decrypt_envelope); -#endif - typedef struct p11_session { CK_SESSION_HANDLE handle; /* Session handle */ struct p11_session *link; /* Next session in list */ @@ -223,12 +164,10 @@ typedef struct p11_session { CK_VOID_PTR application; /* Application data */ sqlite3_stmt *find_query; /* FindObject*() query state */ int find_query_done; /* find_query has terminated */ - -#define SESSION_CRYPTLIB_CONTEXT(_ctx_) CRYPT_CONTEXT _ctx_ -#define SESSION_CRYPTLIB_ENVELOPE(_env_) CRYPT_ENVELOPE _env_ - SESSION_CRYPTLIB_HANDLES; -#undef SESSION_CRYPTLIB_ENVELOPE -#undef SESSION_CRYPTLIB_CONTEXT + const hal_hash_descriptor_t + *digest_descriptor, /* Hash for C_Digest*() */ + *sign_digest_descriptor; /* Hash for C_Sign*() */ + CK_OBJECT_HANDLE sign_key_handle; /* Key for C_Sign*() */ } p11_session_t; @@ -277,19 +216,6 @@ static p11_session_t *p11_sessions; static sqlite3 *sqldb = NULL; /* - * Saved copy of PIN (sigh). - * - * We'd like to do better than this, but as long as we're supporting - * software keysets which require a password every time we read or - * write a private key, we need this. Once we're dealing with just - * the hardware interface we should be able to skip this. - */ - -#if ENABLE_CRYPTLIB_SOFTWARE -static char *pin = NULL; -#endif - -/* * Next PKCS #11 handle to allocate. We use a single handle space for * both session and object handles, and we just keep incrementing * until it wraps, to reduce the amount of time we have to spend @@ -299,21 +225,6 @@ static char *pin = NULL; static CK_ULONG next_handle; /* - * Cryptlib handle for hardware device. - */ - -#if ENABLE_CRYPTLIB_DEVICE -static CRYPT_DEVICE cryptlib_device = CRYPT_HANDLE_NONE; -#endif - -/* - * Filenames for SQL database and PKCS #15 keyring. - */ - -static char *database_filename = NULL; -static char *keyring_filename = NULL; - -/* * Mutex callbacks. */ @@ -362,14 +273,18 @@ static pid_t initialized_pid; */ #if DEBUG_SQL + #define sql_whine(_expr_) \ (fprintf(stderr, "%s:%u: %s returned %s\n", \ __FILE__, __LINE__, #_expr_, sqlite3_errmsg(sqldb)), \ sql_breakpoint()) -#else + +#else /* DEBUG_SQL */ + #define sql_whine(_expr_) \ ((void) 0) -#endif + +#endif /* DEBUG_SQL */ #define sql_check(_good_, _expr_) \ ((_expr_) == (_good_) ? 1 : (sql_whine(_expr_), 0)) @@ -379,52 +294,31 @@ static pid_t initialized_pid; #define sql_check_done(_expr_) sql_check(SQLITE_DONE, _expr_) #define sql_whine_step() sql_whine(sqlite3_step()) - - /* - * Filename utilities. + * Error checking for libhal calls. */ -/* - * Construct name of configuration file if we don't already have it cached. - */ - -static char *cf_generate(char **fn, /* Output filename */ - const char * const env, /* Name of environment variable */ - const char * const base) /* Filename in home directory */ -{ - char *var; - - assert(fn != NULL && env != NULL && base != NULL); - - if (*fn != NULL) - return *fn; - - if ((var = getenv(env)) != NULL && (*fn = malloc(strlen(var) + 1)) != NULL) - strcpy(*fn, var); +#ifndef DEBUG_HAL +#define DEBUG_HAL 0 +#endif - else if (var == NULL && (var = getenv("HOME")) != NULL && (*fn = malloc(strlen(var) + strlen(base) + 2)) != NULL) - sprintf(*fn, "%s/%s", var, base); - - else if (var == NULL && (*fn = malloc(strlen(base) + 1)) != NULL) - strcpy(*fn, base); +#if DEBUG_HAL - return *fn; +static int _hal_check(const hal_error_t err, const char * const expr, const const * const file, const unsigned line) +{ + if (err == HAL_OK) + return 1; + fprintf(stderr, "%s:%u: %s returned %s\n", file, line, hal_errorstring(err), expr); + return 0; } -/* - * Closures over cf_generate() for particular filenames. - */ +#define hal_check(_expr_) (_hal_check((_expr_), #_expr_, __FILE__, __LINE__)) -static char *cf_sql_database(void) -{ - return cf_generate(&database_filename, "PKCS11_DATABASE", SQL_DATABASE); -} +#else /* DEBUG_HAL */ -static char *cf_pkcs15_keyring(void) -{ - return cf_generate(&keyring_filename, "PKCS11_KEYRING", PKCS15_KEYRING); -} +#define hal_check(_expr_) ((_expr_) == HAL_OK) + +#endif /* DEBUG_HAL */ @@ -595,130 +489,6 @@ static CK_RV posix_mutex_unlock(CK_VOID_PTR pMutex) /* - * Wrappers around some of Cryptlib's context functions, so that the - * rest of the code can mostly ignore whether a particular algorithm - * is implemented in hardware or not. In theory, we could achieve - * this simply by always trying cryptDeviceCreateContext() and - * checking its return code to see whether we should fall back to - * CryptCreateContext(), but for the moment I'm more comfortable with - * explictly coding the list of algorithms we expect to be supported - * here. This may change at some future date, once the HAL code is a - * little further along. - */ - -static int cryptlib_implemented_in_hardware(const CRYPT_ALGO_TYPE algo) -{ -#if ENABLE_CRYPTLIB_DEVICE - switch (algo) { - case CRYPT_ALGO_YOU_NEED_TO_SPECIFY_SOMETHING_HERE_BOZO: - return 1; - } -#endif - - return 0; -} - -/* - * Create a context -- hardware if supported, software otherwise. - */ - -static C_RET cryptlib_create_context(CRYPT_CONTEXT *ctx, const CRYPT_ALGO_TYPE algo) -{ -#if ENABLE_CRYPTLIB_DEVICE - if (cryptlib_implemented_in_hardware(algo)) - return cryptDeviceCreateContext(cryptlib_device, ctx, algo); -#endif - - return cryptCreateContext(ctx, CRYPT_UNUSED, algo); -} - -/* - * Store a key. This is a no-op for hardware contexts (the hardware - * device functions as a key store), but requires writing to the PKCS - * #15 keyring for software contexts. - */ - -static C_RET cryptlib_store_key(const CRYPT_CONTEXT ctx) -{ - CRYPT_KEYSET keyset; - int ret, algo; - - if ((ret = cryptGetAttribute(ctx, CRYPT_CTXINFO_ALGO, &algo)) != CRYPT_OK) - return ret; - - if (cryptlib_implemented_in_hardware(algo)) - return CRYPT_OK; - - ret = cryptKeysetOpen(&keyset, CRYPT_UNUSED, CRYPT_KEYSET_FILE, cf_pkcs15_keyring(), CRYPT_KEYOPT_NONE); - - if (ret == CRYPT_ERROR_OPEN || ret == CRYPT_ERROR_NOTFOUND) - ret = cryptKeysetOpen(&keyset, CRYPT_UNUSED, CRYPT_KEYSET_FILE, cf_pkcs15_keyring(), CRYPT_KEYOPT_CREATE); - - if (ret != CRYPT_OK) - return ret; - - ret = cryptAddPrivateKey(keyset, ctx, pin); - - cryptKeysetClose(keyset); - - return ret; -} - -/* - * Load a key. This creates a new context. - */ - -static C_RET cryptlib_load_key(CRYPT_CONTEXT *ctx, const char *keyid) -{ - CRYPT_KEYSET keyset; - int ret; - - assert(ctx != NULL); - - *ctx = CRYPT_HANDLE_NONE; - -#if ENABLE_CRYPTLIB_DEVICE - if ((ret = cryptGetPrivateKey(cryptlib_device, ctx, CRYPT_KEYID_NAME, keyid, NULL)) == CRYPT_OK) - return ret; -#endif - - if ((ret = cryptKeysetOpen(&keyset, CRYPT_UNUSED, CRYPT_KEYSET_FILE, cf_pkcs15_keyring(), CRYPT_KEYOPT_READONLY)) != CRYPT_OK) - return ret; - - ret = cryptGetPrivateKey(keyset, ctx, CRYPT_KEYID_NAME, keyid, pin); - - cryptKeysetClose(keyset); - - return ret; -} - -/* - * Delete a key. - */ - -static C_RET cryptlib_delete_key(const char *keyid) -{ - CRYPT_KEYSET keyset; - int ret; - -#if ENABLE_CRYPTLIB_DEVICE - if ((ret = cryptDeleteKey(cryptlib_device, CRYPT_KEYID_NAME, keyid)) == CRYPT_OK) - return ret; -#endif - - if ((ret = cryptKeysetOpen(&keyset, CRYPT_UNUSED, CRYPT_KEYSET_FILE, cf_pkcs15_keyring(), CRYPT_KEYOPT_NONE)) != CRYPT_OK) - return ret; - - ret = cryptDeleteKey(keyset, CRYPT_KEYID_NAME, keyid); - - cryptKeysetClose(keyset); - - return ret; -} - - - -/* * SQL utilities. */ @@ -766,7 +536,26 @@ static int sql_init(void) assert(sqldb == NULL); - return sql_check_ok(sqlite3_open(cf_sql_database(), &sqldb)) && sql_exec(schema); + const char * const env = getenv("PKCS11_DATABASE"); + const char * const home = getenv("HOME"); + const char * const base = SQL_DATABASE; + int ok; + + if (env != NULL) { + ok = sql_check_ok(sqlite3_open(env, &sqldb)); + } + + else if (home == NULL) { + ok = sql_check_ok(sqlite3_open(base, &sqldb)); + } + + else { + char fn[strlen(home) + strlen(base) + 2]; + snprintf(fn, sizeof(fn), "%s/%s", home, base); + ok = sql_check_ok(sqlite3_open(fn, &sqldb)); + } + + return ok && sql_exec(schema); } /* @@ -825,150 +614,68 @@ static int sql_prepare(sqlite3_stmt **q, const char *format, ...) return sqlite3_prepare_v2(sqldb, buffer, -1, q, NULL); } - - /* - * (Extremely) minimal ASN.1 parser, just good enough to pick a few - * fields out of something like a well-formed ASN.1 DER representation - * of a certificate. + * This idiom occurs frequently, bundle it so we have the option of + * doing it along with the normal conditional control flow that SQL + * queries seem to follow. */ -#define ASN1_UNIVERSAL 0x00 -#define ASN1_APPLICATION 0x40 -#define ASN1_CONTEXT_SPECIFIC 0x80 -#define ASN1_PRIVATE 0xC0 +static int sql_finalize_and_clear(sqlite3_stmt **q) +{ + assert(q != NULL); -#define ASN1_PRIMITIVE 0x00 -#define ASN1_CONSTRUCTED 0x20 + int err = sqlite3_finalize(*q); -#define ASN1_TAG_MASK 0x1F + if (err != SQLITE_OK) + return err; -#define ASN1_INTEGER (ASN1_PRIMITIVE | 0x02) -#define ASN1_BIT_STRING (ASN1_PRIMITIVE | 0x03) -#define ASN1_OCTET_STRING (ASN1_PRIMITIVE | 0x04) -#define ASN1_NULL (ASN1_PRIMITIVE | 0x05) -#define ASN1_OBJECT_IDENTIFIER (ASN1_PRIMITIVE | 0x06) -#define ASN1_SEQUENCE (ASN1_CONSTRUCTED | 0x10) -#define ASN1_SET (ASN1_CONSTRUCTED | 0x11) + *q = NULL; + return SQLITE_OK; +} -#define ASN1_EXPLICIT_CONTEXT (ASN1_CONTEXT_SPECIFIC | ASN1_CONSTRUCTED) -#define ASN1_EXPLICIT_0 (ASN1_EXPLICIT_CONTEXT + 0) + /* - * Common setup code for asn1_dive() and asn1_skip(). + * Initialize KEK. If we had proper hardware support the KEK would be + * living in special RAM where we could wipe it if anything triggered + * our tamper circuitry. But we have no such at the moment, so we + * have no good place to store the KEK. * - * Check ASN.1 tag and various errors, decode length field. - * Outputs are length of header (tag + length) and value. + * So we store it in the SQL database, which kind of defeats the point + * of wrapping private keys that live in the same database -- except + * that we're trying to get all the other bits right so that we can + * just move the KEK to secure memory once we have it. */ -static int asn1_prep(const unsigned char tag, - const unsigned char * const der, - const size_t len, - size_t *phlen, - size_t *pvlen) +static int kek_init(void) { - size_t i, hlen, vlen; - - if (der == NULL || len < 2 || phlen == NULL || pvlen == NULL || der[0] != tag || der[1] > 0x84) - return 0; - - if ((der[1] & 0x80) == 0) { - hlen = 2; - vlen = der[1]; - } + static const char test_kek[] = + " SELECT kek IS NULL FROM global"; - else { - hlen = 2 + (der[1] & 0x7F); - vlen = 0; + static const char set_kek[] = + " UPDATE global SET kek = ?1"; - if (hlen >= len) - return 0; + sqlite3_stmt *q = NULL; - for (i = 2; i < hlen; i++) - vlen = (vlen << 8) + der[i]; - } + int ok = (sql_check_ok(sql_prepare(&q, test_kek)) && + sql_check_row(sqlite3_step(q))); - if (hlen + vlen > len) - return 0; + if (ok && sqlite3_column_int(q, 0)) { + uint8_t kekbuf[bitsToBytes(256)]; - *phlen = hlen; - *pvlen = vlen; - return 1; -} + ok = (hal_check(hal_get_random(kekbuf, sizeof(kekbuf))) && + sql_check_ok(sql_finalize_and_clear(&q)) && + sql_check_ok(sql_prepare(&q, set_kek)) && + sql_check_ok(sqlite3_bind_blob(q, 1, kekbuf, + sizeof(kekbuf), + NULL)) && + sql_check_done(sqlite3_step(q))); -/* - * Dive into an ASN.1 object. - * - * The special handling for BIT STRING is only appropriate for the - * intended use, where BIT STRING always encapsulates another ASN.1 - * object like SubjectPublicKeyInfo and is thus always required to be - * a multiple of 8 bits in length. If we ever need to use this code - * to deal with real bit strings, the special handling will need to - * move to a separate function which we can call when appropriate. - */ - -static int asn1_dive(const unsigned char tag, - const unsigned char **der, - size_t *len) -{ - size_t hlen, vlen; - - if (der == NULL || len == NULL || !asn1_prep(tag, *der, *len, &hlen, &vlen)) - return 0; - - if (tag == ASN1_BIT_STRING) { - if (vlen == 0 || hlen >= *len || (*der)[hlen] != 0x00) - return 0; - hlen++, vlen--; + memset(kekbuf, 0, sizeof(kekbuf)); } - assert(hlen + vlen <= *len); - *der += hlen; /* Advance past the header */ - *len = vlen; /* Shrink range to be just the content */ - return 1; -} - -/* - * Skip over an ASN.1 object. - */ - -static int asn1_skip(const unsigned char tag, - const unsigned char **der, - size_t *len) -{ - size_t hlen, vlen; - - if (der == NULL || len == NULL || !asn1_prep(tag, *der, *len, &hlen, &vlen)) - return 0; - - assert(hlen + vlen <= *len); - *der += hlen + vlen; /* Advance past entire object */ - *len -= hlen + vlen; /* Reduce range by length of object */ - return 1; -} - -/* - * Grovel through a DER encoded X.509v3 certificate object until we - * find the subjectPublicKey field. See the ASN.1 in RFC 5280. - * - * This is much too simplistic for general use, but should suffice to - * pick the subjectPublicKey data out of a certificate generated for - * us by Cryptlib. - */ - -static int asn1_find_x509_spki(const unsigned char **der, size_t *len) -{ - return (asn1_dive(ASN1_SEQUENCE, der, len) && /* Dive into certificate */ - asn1_dive(ASN1_SEQUENCE, der, len) && /* Dive into tbsCertificate */ - asn1_skip(ASN1_EXPLICIT_0, der, len) && /* Skip version */ - asn1_skip(ASN1_INTEGER, der, len) && /* Skip serialNumber */ - asn1_skip(ASN1_SEQUENCE, der, len) && /* Skip signature */ - asn1_skip(ASN1_SEQUENCE, der, len) && /* Skip issuer */ - asn1_skip(ASN1_SEQUENCE, der, len) && /* skip validity */ - asn1_skip(ASN1_SEQUENCE, der, len) && /* Skip subject */ - asn1_dive(ASN1_SEQUENCE, der, len) && /* Dive into subjectPublicKeyInfo */ - asn1_skip(ASN1_SEQUENCE, der, len) && /* Skip algorithm */ - asn1_dive(ASN1_BIT_STRING, der, len)); /* Dive into subjectPublicKey */ + sqlite3_finalize(q); + return ok; } @@ -1201,8 +908,15 @@ static int p11_attribute_find_in_template(const CK_ATTRIBUTE_TYPE type, * values, it may be necessary to defer calling this method until * after the default and mandatory values have been merged into the * values supplied by the application-supplied template. + * + * Semantics of the flags follow RFC 5280 4.2.1.3, numeric values + * don't matter particularly as we only use them internally. */ +#define KEYUSAGE_DIGITALSIGNATURE (1 << 0) +#define KEYUSAGE_KEYENCIPHERMENT (1 << 1) +#define KEYUSAGE_DATAENCIPHERMENT (1 << 2) + static void p11_attribute_apply_keyusage(unsigned *keyusage, const CK_ATTRIBUTE_TYPE type, const CK_BBOOL *value) { unsigned flag; @@ -1212,15 +926,15 @@ static void p11_attribute_apply_keyusage(unsigned *keyusage, const CK_ATTRIBUTE_ switch (type) { case CKA_SIGN: /* Generate signature */ case CKA_VERIFY: /* Verify signature */ - flag = CRYPT_KEYUSAGE_DIGITALSIGNATURE; + flag = KEYUSAGE_DIGITALSIGNATURE; break; case CKA_ENCRYPT: /* Encrypt bulk data (seldom used) */ case CKA_DECRYPT: /* Bulk decryption (seldom used) */ - flag = CRYPT_KEYUSAGE_DATAENCIPHERMENT; + flag = KEYUSAGE_DATAENCIPHERMENT; break; case CKA_WRAP: /* Wrap key (normal way of doing encryption) */ case CKA_UNWRAP: /* Unwrap key (normal way of doing decryption) */ - flag = CRYPT_KEYUSAGE_KEYENCIPHERMENT; + flag = KEYUSAGE_KEYENCIPHERMENT; break; default: return; /* Attribute not related to key usage */ @@ -1370,11 +1084,6 @@ static CK_RV p11_object_check_rights(const p11_session_t *session, static int p11_object_delete_all_private(void) { - static const char select_format[] = - " WITH" - " private AS (SELECT session_object_id FROM session_attribute WHERE type = %u AND value <> X'00')" - " SELECT keyid FROM session_object WHERE keyid IS NOT NULL AND session_object_id IN private"; - static const char delete_format[] = " WITH" " s AS (SELECT session_object_id FROM session_attribute WHERE type = %u AND value <> X'00')," @@ -1382,22 +1091,7 @@ static int p11_object_delete_all_private(void) " DELETE FROM object WHERE token_object_id IN t OR session_object_id IN s"; sqlite3_stmt *q = NULL; - int ret, ok = 0; - - if (!sql_check_ok(sql_prepare(&q, select_format, CKA_PRIVATE))) - goto fail; - - while ((ret = sqlite3_step(q)) == SQLITE_ROW) - if (cryptlib_delete_key((const char *) sqlite3_column_text(q, 0)) != CRYPT_OK) - goto fail; - - if (ret != SQLITE_DONE) { - sql_whine_step(); - goto fail; - } - - sqlite3_finalize(q); - q = NULL; + int ok = 0; if (!sql_check_ok(sql_prepare(&q, delete_format, CKA_PRIVATE, CKA_PRIVATE)) || !sql_check_done(sqlite3_step(q))) @@ -1467,8 +1161,8 @@ static CK_OBJECT_HANDLE p11_object_create(const p11_session_t *session, object_id = sqlite3_last_insert_rowid(sqldb); - sqlite3_finalize(q); - q = NULL; + if (!sql_check_ok(sql_finalize_and_clear(&q))) + goto fail; switch (flavor) { @@ -1477,16 +1171,13 @@ static CK_OBJECT_HANDLE p11_object_create(const p11_session_t *session, !sql_check_done(sqlite3_step(q))) goto fail; token_object_id = sqlite3_last_insert_rowid(sqldb); - sqlite3_finalize(q); - q = NULL; - if (!sql_check_ok(sql_prepare(&q, update_object_token_object)) || + if (!sql_check_ok(sql_finalize_and_clear(&q)) || + !sql_check_ok(sql_prepare(&q, update_object_token_object)) || !sql_check_ok(sqlite3_bind_int64(q, 1, token_object_id)) || !sql_check_ok(sqlite3_bind_int64(q, 2, object_id)) || - !sql_check_done(sqlite3_step(q))) - goto fail; - sqlite3_finalize(q); - q = NULL; - if (!sql_check_ok(sql_prepare(&q, insert_token_attribute)) || + !sql_check_done(sqlite3_step(q)) || + !sql_check_ok(sql_finalize_and_clear(&q)) || + !sql_check_ok(sql_prepare(&q, insert_token_attribute)) || !sql_check_ok(sqlite3_bind_int64(q, 1, token_object_id))) goto fail; break; @@ -1497,17 +1188,14 @@ static CK_OBJECT_HANDLE p11_object_create(const p11_session_t *session, !sql_check_done(sqlite3_step(q))) goto fail; session_object_id = sqlite3_last_insert_rowid(sqldb); - sqlite3_finalize(q); - q = NULL; - if (!sql_check_ok(sql_prepare(&q, update_object_session_object)) || + if (!sql_check_ok(sql_finalize_and_clear(&q)) || + !sql_check_ok(sql_prepare(&q, update_object_session_object)) || !sql_check_ok(sqlite3_bind_int64(q, 1, session->handle)) || !sql_check_ok(sqlite3_bind_int64(q, 2, session_object_id)) || !sql_check_ok(sqlite3_bind_int64(q, 3, object_id)) || - !sql_check_done(sqlite3_step(q))) - goto fail; - sqlite3_finalize(q); - q = NULL; - if (!sql_check_ok(sql_prepare(&q, insert_session_attribute)) || + !sql_check_done(sqlite3_step(q)) || + !sql_check_ok(sql_finalize_and_clear(&q)) || + !sql_check_ok(sql_prepare(&q, insert_session_attribute)) || !sql_check_ok(sqlite3_bind_int64(q, 1, session_object_id))) goto fail; break; @@ -1584,188 +1272,111 @@ static CK_OBJECT_HANDLE p11_object_create(const p11_session_t *session, } /* - * Get the keyid for an object. + * Store an RSA private key. * - * This may require calculating the keyid from the CKA_ID attribute. + * Write the key as PKCS #1.5 RSAPrivateKey DER, encrypt that using + * AES key wrap, and store the result as an SQL blob. + * + * We jump through a few minor hoops to let us do all the encoding and + * wrapping in place in a single buffer. */ -static int p11_object_get_keyid(const CK_OBJECT_HANDLE object_handle, - char *keyid, - const size_t maxkeyid) +static int p11_object_set_rsa_private_key(const CK_OBJECT_HANDLE object_handle, + const hal_rsa_key_t key) { - static const char select_format[] = - " SELECT keyid FROM %s_object NATURAL JOIN object WHERE object_handle = ?"; + static const char select_kek[] = + " SELECT kek FROM global"; static const char update_format[] = - " UPDATE %s_object SET keyid = ?1" - " WHERE %s_object_id = (SELECT %s_object_id FROM object WHERE object_handle =?2)"; + " UPDATE %s_object SET private_key = ?1" + " WHERE %s_object_id = (SELECT %s_object_id FROM object WHERE object_handle = ?2)"; + uint8_t wrapbuf[hal_aes_keywrap_ciphertext_length(hal_rsa_key_to_der_len(key))]; const char *flavor = is_token_handle(object_handle) ? "token" : "session"; - sqlite3_stmt *q = NULL; + size_t len; int ok = 0; - if (!sql_check_ok(sql_prepare(&q, select_format, flavor)) || - !sql_check_ok(sqlite3_bind_int64(q, 1, object_handle)) || - !sql_check_row(sqlite3_step(q))) + if (!sql_check_ok(sql_prepare(&q, select_kek)) || + !sql_check_row(sqlite3_step(q)) || + sqlite3_column_type(q, 0) == SQLITE_NULL || + !hal_check(hal_rsa_key_to_der(key, wrapbuf+8, &len, sizeof(wrapbuf)-8)) || + !hal_check(hal_aes_keywrap(sqlite3_column_blob(q, 0), + sqlite3_column_bytes(q, 0), + wrapbuf+8, len, wrapbuf, &len)) || + !sql_check_ok(sql_finalize_and_clear(&q)) || + !sql_check_ok(sql_prepare(&q, update_format, flavor, flavor, flavor)) || + !sql_check_ok(sqlite3_bind_blob( q, 1, wrapbuf, len, NULL)) || + !sql_check_ok(sqlite3_bind_int64(q, 2, object_handle)) || + !sql_check_done(sqlite3_step(q))) goto fail; - if (sqlite3_column_type(q, 0) == SQLITE_NULL) { - - /* - * No keyid set yet, have to create one. We use the CKA_ID - * attribute for this, zero-filling or truncating as necessary. - */ - - const CK_ULONG target_length = (CRYPT_MAX_TEXTSIZE < maxkeyid ? CRYPT_MAX_TEXTSIZE : (maxkeyid - 1)) / 2; - unsigned char id[CRYPT_MAX_HASHSIZE]; - CK_ULONG len; - int i; - - assert(target_length > 0 && target_length <= sizeof(id) && target_length * 2 < maxkeyid); - - if (!p11_attribute_get(object_handle, CKA_ID, id, &len, sizeof(id))) - goto fail; - - if (len < target_length) { - memmove(id + target_length - len, id, len); - memset(id, 0x00, target_length - len); - } - - for (i = 0; i < target_length; i++) - sprintf(keyid + (2 * i), "%02x", id[i]); - keyid[target_length * 2] = '\0'; - - sqlite3_finalize(q); - q = NULL; - - if (!sql_check_ok(sql_prepare(&q, update_format, flavor, flavor, flavor)) || - !sql_check_ok(sqlite3_bind_text( q, 1, keyid, strlen(keyid), NULL)) || - !sql_check_ok(sqlite3_bind_int64(q, 2, object_handle)) || - !sql_check_done(sqlite3_step(q))) - goto fail; - - } else { - - /* - * Already had a keyid, just have to copy it. - */ - - int len = sqlite3_column_bytes(q, 0); - - if (len >= maxkeyid) - goto fail; - - memcpy(keyid, sqlite3_column_text(q, 0), len); - keyid[len] = '\0'; - - } - ok = 1; fail: + memset(wrapbuf, 0, sizeof(wrapbuf)); sqlite3_finalize(q); return ok; } /* - * Add attributes representing the SPKI value of a key we've - * generated. + * Fetch an RSA private key. * - * Cryptlib does such a complete job of protecting our keys that it's - * rather tedious to extract the raw subjectPublicKeyInfo, but the - * PKCS #11 client needs that information, so we have to jump through - * some silly hoops. This routine does most of the work, but uses a - * separate handler (supplied as an argument) to generate attributes - * based on mechanism-specific data from the subjectPublicKey. + * Retrieve SQL blob from the object, unwrap that to get the DER + * encoding of a PKCS #1.5 RSAPrivateKey object, load the key from + * that. * - * Basic approach here is to generate a temporary certificate from the - * key, export that as DER, parse the DER for the data we need, and - * destroy the temporary certificate. + * If the key isn't set, we return success with null key. */ -static int p11_object_add_spki(const CK_OBJECT_HANDLE public_handle, - const CK_OBJECT_HANDLE private_handle, - const CRYPT_CONTEXT key, - int (*handler)(const CK_OBJECT_HANDLE, - const CK_OBJECT_HANDLE, - const unsigned char *, - const size_t)) +static int p11_object_get_rsa_private_key(const CK_OBJECT_HANDLE object_handle, + hal_rsa_key_t *key, + uint8_t *keybuf, const size_t keybuf_len) { - static const char label[] = "Don't care"; - CRYPT_CERTIFICATE cert = CRYPT_HANDLE_NONE; - unsigned char *buffer = NULL; - const unsigned char *der; - int ilen, ok = 0; - size_t ulen; - - if (handler == NULL || - cryptCreateCert(&cert, CRYPT_UNUSED, CRYPT_CERTTYPE_CERTIFICATE) != CRYPT_OK || - cryptSetAttribute(cert, CRYPT_CERTINFO_SUBJECTPUBLICKEYINFO, key) != CRYPT_OK || - cryptSetAttribute(cert, CRYPT_CERTINFO_XYZZY, 1) != CRYPT_OK || - cryptSetAttributeString(cert, CRYPT_CERTINFO_COMMONNAME, label, sizeof(label)) != CRYPT_OK || - cryptSignCert(cert, key) != CRYPT_OK || - cryptExportCert(NULL, 0, &ilen, CRYPT_CERTFORMAT_CERTIFICATE, cert) != CRYPT_OK || - (der = buffer = malloc(ulen = (size_t) ilen)) == NULL || - cryptExportCert(buffer, ilen, &ilen, CRYPT_CERTFORMAT_CERTIFICATE, cert) != CRYPT_OK || - !asn1_find_x509_spki(&der, &ulen) || - !handler(public_handle, private_handle, der, ulen)) - goto fail; - - ok = 1; - - fail: - if (buffer != NULL) - free(buffer); - if (cert != CRYPT_HANDLE_NONE) - cryptDestroyCert(cert); - return ok; -} + static const char select_format[] = + " SELECT kek, private_key FROM global, %s_object NATURAL JOIN object WHERE object_handle = ?1"; -/* - * RSA-specific handler to go with p11_object_add_spki(). - * - * Extract RSA modulus and public exponent from the subjectPublicKey - * and adds the appropriate attributes to the public and private keys. - */ + const char *flavor = is_token_handle(object_handle) ? "token" : "session"; + sqlite3_stmt *q = NULL; + int ok; -static int p11_object_add_spki_rsa(const CK_OBJECT_HANDLE public_handle, - const CK_OBJECT_HANDLE private_handle, - const unsigned char *der, - const size_t len) -{ - const unsigned char *modulus = der, *publicExponent = der; - size_t modulus_len = len, publicExponent_len = len; + assert(key != NULL && keybuf != NULL); /* - * Dig the relevant integers out of the ASN.1. + * Pull everything we need from the database. */ - if (!asn1_dive(ASN1_SEQUENCE, &modulus, &modulus_len) || - !asn1_dive(ASN1_INTEGER, &modulus, &modulus_len) || - !asn1_dive(ASN1_SEQUENCE, &publicExponent, &publicExponent_len) || - !asn1_skip(ASN1_INTEGER, &publicExponent, &publicExponent_len) || - !asn1_dive(ASN1_INTEGER, &publicExponent, &publicExponent_len)) - return 0; - /* - * ASN.1 INTEGERs are signed while PKCS #11 "big integers" are - * unsigned, so skip leading zero byte, if present. - */ + if (!sql_check_ok(sql_prepare(&q, select_format, flavor)) || + !sql_check_ok(sqlite3_bind_int64(q, 1, object_handle)) || + !sql_check_row(sqlite3_step(q)) || + sqlite3_column_type(q, 0) == SQLITE_NULL) { + ok = 0; + } - if (modulus_len > 0 && *modulus == 0x00) - modulus_len--, modulus++; + else if (sqlite3_column_type(q, 1) == SQLITE_NULL) { + key->key = NULL; + ok = 1; + } - if (publicExponent_len > 0 && *publicExponent == 0x00) - publicExponent_len--, publicExponent++; - - /* - * Insert the attributes and we're done. - */ + else { + const uint8_t * const kek = sqlite3_column_blob(q, 0); + const uint8_t * const pkey = sqlite3_column_blob(q, 1); + const size_t kek_len = sqlite3_column_bytes(q, 0); + const size_t pkey_len = sqlite3_column_bytes(q, 1); + uint8_t wrapbuf[sqlite3_column_bytes(q, 1)]; + size_t wrapbuf_len; - return (p11_attribute_set(public_handle, CKA_MODULUS, modulus, modulus_len) && - p11_attribute_set(public_handle, CKA_PUBLIC_EXPONENT, publicExponent, publicExponent_len) && - p11_attribute_set(private_handle, CKA_MODULUS, modulus, modulus_len) && - p11_attribute_set(private_handle, CKA_PUBLIC_EXPONENT, publicExponent, publicExponent_len)); + ok = (hal_check(hal_aes_keyunwrap(kek, kek_len, pkey, pkey_len, wrapbuf, &wrapbuf_len)) && + hal_check(hal_rsa_key_from_der(key, keybuf, keybuf_len, wrapbuf, wrapbuf_len))); + + memset(wrapbuf, 0, sizeof(wrapbuf)); + } + + if (!ok || key->key == NULL) + memset(keybuf, 0, keybuf_len); + + sqlite3_finalize(q); + return ok; } @@ -1784,13 +1395,6 @@ static p11_session_t *p11_session_new(void) if (session == NULL) return NULL; memset(session, 0, sizeof(*session)); - -#define SESSION_CRYPTLIB_CONTEXT(_ctx_) session->_ctx_ = CRYPT_HANDLE_NONE -#define SESSION_CRYPTLIB_ENVELOPE(_env_) session->_env_ = CRYPT_HANDLE_NONE - SESSION_CRYPTLIB_HANDLES; -#undef SESSION_CRYPTLIB_ENVELOPE -#undef SESSION_CRYPTLIB_CONTEXT - return session; } @@ -1803,14 +1407,7 @@ static void p11_session_free(p11_session_t *session) if (session == NULL) return; - if (session->find_query != NULL) - sqlite3_finalize(session->find_query); - -#define SESSION_CRYPTLIB_CONTEXT(_ctx_) if (session->_ctx_ != CRYPT_HANDLE_NONE) cryptDestroyContext(session->_ctx_) -#define SESSION_CRYPTLIB_ENVELOPE(_env_) if (session->_env_ != CRYPT_HANDLE_NONE) cryptDestroyEnvelope(session->_env_) - SESSION_CRYPTLIB_HANDLES; -#undef SESSION_CRYPTLIB_ENVELOPE -#undef SESSION_CRYPTLIB_CONTEXT + sql_finalize_and_clear(&session->find_query); free(session); } @@ -1876,45 +1473,21 @@ static p11_session_t *p11_session_find(const CK_SESSION_HANDLE session_handle) * Delete a session: remove it from SQL and free the session data * structure. * - * Since this destroys all associated session objects, we also have to - * delete any keys we might be holding for session objects. - * * This method assumes the move-to-the-front behavior of * p11_session_find(). */ static CK_RV p11_session_delete(const CK_SESSION_HANDLE session_handle) { - static const char select_keyid[] = - " SELECT keyid FROM session NATURAL JOIN session_object" - " WHERE session_handle = ?1 AND keyid IS NOT NULL"; - static const char delete_session[] = " DELETE FROM session WHERE session_handle = ?"; p11_session_t *session = p11_session_find(session_handle); sqlite3_stmt *q = NULL; CK_RV rv = CKR_OK; - int ret; if (session == NULL) return CKR_SESSION_HANDLE_INVALID; - - if (!sql_check_ok(sql_prepare(&q, select_keyid)) || - !sql_check_ok(sqlite3_bind_int64(q, 1, session_handle))) - lose(CKR_FUNCTION_FAILED); - - while ((ret = sqlite3_step(q)) == SQLITE_ROW) - if (cryptlib_delete_key((const char *) sqlite3_column_text(q, 0)) != CRYPT_OK) - lose(CKR_FUNCTION_FAILED); - - if (ret != SQLITE_DONE) { - sql_whine_step(); - lose(CKR_FUNCTION_FAILED); - } - - sqlite3_finalize(q); - q = NULL; if (!sql_check_ok(sql_prepare(&q, delete_session)) || !sql_check_ok(sqlite3_bind_int64(q, 1, session_handle)) || @@ -1934,41 +1507,18 @@ static CK_RV p11_session_delete(const CK_SESSION_HANDLE session_handle) /* * Delete all sessions. - * - * Like p11_session_delete(), this must also delete any keys held in - * session objects. */ -static CK_RV p11_session_delete_all(void) -{ - static const char select_keys[] = - " SELECT keyid FROM session_object WHERE keyid IS NOT NULL"; - #warning Should this also clear the object table? +static CK_RV p11_session_delete_all(void) +{ static const char delete_all_sessions[] = " DELETE FROM session"; p11_session_t *session; - sqlite3_stmt *q = NULL; - int ret = SQLITE_OK; CK_RV rv = CKR_OK; - if (!sql_check_ok(sql_prepare(&q, select_keys))) - lose(CKR_FUNCTION_FAILED); - - while ((ret = sqlite3_step(q)) == SQLITE_ROW) - if (cryptlib_delete_key((const char *) sqlite3_column_text(q, 0)) != CRYPT_OK) - lose(CKR_FUNCTION_FAILED); - - if (ret != SQLITE_DONE) { - sql_whine_step(); - lose(CKR_FUNCTION_FAILED); - } - - sqlite3_finalize(q); - q = NULL; - if (!sql_exec(delete_all_sessions)) lose(CKR_FUNCTION_FAILED); @@ -1979,7 +1529,6 @@ static CK_RV p11_session_delete_all(void) } fail: - sqlite3_finalize(q); return rv; } @@ -2156,15 +1705,10 @@ static CK_RV p11_check_keypair_attributes_check_template_2(const p11_session_t * * amount of checking. We automate as much of the dumb stuff as * possible through the object descriptor. * - * Key usage handling here is based on RFC 5280 4.2.1.3, same as - * Cryptlib. We reuse Cryptlib's bit flags because they're - * convenient. + * Key usage handling here is based on RFC 5280 4.2.1.3. * - * We use the PKCS #11 CKA_ID attribute to generate the Cryptlib key - * label. PKCS #11 suggests but does not require CKA_ID values for - * public and private key to match; we do insist on this, because we - * really only have one key label which applies to both the public and - * private keys. + * PKCS #11 suggests but does not require CKA_ID values for public and + * private key to match. */ static CK_RV p11_check_keypair_attributes(const p11_session_t *session, @@ -2176,8 +1720,6 @@ static CK_RV p11_check_keypair_attributes(const p11_session_t *session, const p11_descriptor_t * const private_descriptor) { unsigned public_keyusage = 0, private_keyusage = 0; - const CK_BYTE *id = NULL; - size_t id_len = 0; CK_RV rv = CKR_OK; int i; @@ -2208,11 +1750,6 @@ static CK_RV p11_check_keypair_attributes(const p11_session_t *session, goto fail; p11_attribute_apply_keyusage(&public_keyusage, type, val); - - if (type == CKA_ID) { - id = val; - id_len = len; - } } for (i = 0; i < ulPrivateKeyAttributeCount; i++) { @@ -2224,14 +1761,6 @@ static CK_RV p11_check_keypair_attributes(const p11_session_t *session, goto fail; p11_attribute_apply_keyusage(&private_keyusage, type, val); - - if (type == CKA_ID && id == NULL) { - id = val; - id_len = len; - } - - if (type == CKA_ID && (len != id_len || memcmp(id, val, len))) - lose(CKR_TEMPLATE_INCONSISTENT); } /* @@ -2243,13 +1772,6 @@ static CK_RV p11_check_keypair_attributes(const p11_session_t *session, lose(CKR_TEMPLATE_INCONSISTENT); /* - * We require a key ID. - */ - - if (id == NULL || id_len == 0) - lose(CKR_TEMPLATE_INCOMPLETE); - - /* * Check that all required attributes have been specified. */ @@ -2294,11 +1816,15 @@ static CK_RV generate_keypair_rsa_pkcs(p11_session_t *session, CK_OBJECT_HANDLE public_handle = CK_INVALID_HANDLE; handle_flavor_t public_handle_flavor = handle_flavor_session_object; handle_flavor_t private_handle_flavor = handle_flavor_session_object; - char keyid[CRYPT_MAX_HASHSIZE * 2 + 1]; - CRYPT_CONTEXT ctx = CRYPT_HANDLE_NONE; - const CK_BYTE *id = NULL; + uint8_t + keybuf[hal_rsa_key_t_size], + modulus[hal_rsa_key_t_size/8], + public_exponent[hal_rsa_key_t_size/8]; + size_t + modulus_len, + public_exponent_len; + hal_rsa_key_t key = { NULL }; CK_ULONG keysize = 0; - size_t id_len = 0; CK_RV rv; int i; @@ -2316,8 +1842,6 @@ static CK_RV generate_keypair_rsa_pkcs(p11_session_t *session, pPublicKeyTemplate != NULL && phPublicKey != NULL && pPrivateKeyTemplate != NULL && phPrivateKey != NULL); - memset(keyid, 0, sizeof(keyid)); - /* * Grab values and perform mechanism-specific checks. */ @@ -2335,12 +1859,7 @@ static CK_RV generate_keypair_rsa_pkcs(p11_session_t *session, public_handle_flavor = p11_handle_flavor_from_cka_token(val); continue; - case CKA_ID: /* We use PKCS #11 "ID" as Cryptlib label */ - id = val; - id_len = len; - continue; - - case CKA_MODULUS_BITS: /* Keysize in bits -- Cryptlib only allows multiples of 8 */ + case CKA_MODULUS_BITS: /* Keysize in bits -- only allow multiples of 8 */ keysize = *(CK_ULONG *) val; if ((keysize & 7) != 0) return CKR_ATTRIBUTE_VALUE_INVALID; @@ -2362,52 +1881,40 @@ static CK_RV generate_keypair_rsa_pkcs(p11_session_t *session, private_handle_flavor = p11_handle_flavor_from_cka_token(val); continue; - case CKA_ID: /* We use PKCS #11 "ID" as Cryptlib label */ - id = val; - id_len = len; - continue; - } } /* - * We require a key ID and a key size, and if either key is a token - * object, the other must be too. + * We require a key size, and if either key is a token object, the + * other must be too. */ - if (id == NULL || id_len == 0 || keysize == 0 || public_handle_flavor != private_handle_flavor) + if (keysize == 0 || public_handle_flavor != private_handle_flavor) return CKR_TEMPLATE_INCOMPLETE; /* - * If we got this far, create the PKCS #11 objects. + * Create the PKCS #11 objects and generate the keypair. */ - if (!sql_exec("BEGIN")) + if (!sql_exec("BEGIN") || + (public_handle = p11_object_create(session, public_handle_flavor, + pPublicKeyTemplate, ulPublicKeyAttributeCount, + &p11_descriptor_rsa_public_key, + pMechanism)) == CK_INVALID_HANDLE || + (private_handle = p11_object_create(session, private_handle_flavor, + pPrivateKeyTemplate, ulPrivateKeyAttributeCount, + &p11_descriptor_rsa_private_key, + pMechanism)) == CK_INVALID_HANDLE || + !p11_attribute_get(public_handle, CKA_PUBLIC_EXPONENT, + public_exponent, &public_exponent_len, sizeof(public_exponent)) || + !hal_check(hal_rsa_key_gen(&key, keybuf, sizeof(keybuf), keysize, + public_exponent, public_exponent_len)) || + !p11_object_set_rsa_private_key(private_handle, key) || + !hal_check(hal_rsa_key_get_modulus(key, modulus, &modulus_len, sizeof(modulus))) || + !p11_attribute_set(public_handle, CKA_MODULUS, modulus, modulus_len) || + !p11_attribute_set(private_handle, CKA_MODULUS, modulus, modulus_len)) lose(CKR_FUNCTION_FAILED); - public_handle = p11_object_create(session, public_handle_flavor, - pPublicKeyTemplate, ulPublicKeyAttributeCount, - &p11_descriptor_rsa_public_key, pMechanism); - - private_handle = p11_object_create(session, private_handle_flavor, - pPrivateKeyTemplate, ulPrivateKeyAttributeCount, - &p11_descriptor_rsa_private_key, pMechanism); - - if (public_handle == CK_INVALID_HANDLE || private_handle == CK_INVALID_HANDLE) - lose(CKR_FUNCTION_FAILED); - - /* - * Generate the keypair. - */ - - if (!p11_object_get_keyid(private_handle, keyid, sizeof(keyid)) || - cryptlib_create_context(&ctx, CRYPT_ALGO_RSA) != CRYPT_OK || - cryptSetAttributeString(ctx, CRYPT_CTXINFO_LABEL, keyid, strlen(keyid)) != CRYPT_OK || - cryptSetAttribute(ctx, CRYPT_CTXINFO_KEYSIZE, keysize / 8) != CRYPT_OK || - cryptGenerateKey(ctx) != CRYPT_OK || - !p11_object_add_spki(public_handle, private_handle, ctx, p11_object_add_spki_rsa) || - cryptlib_store_key(ctx) != CRYPT_OK || - cryptDestroyContext(ctx) != CRYPT_OK) - lose(CKR_FUNCTION_FAILED); + hal_rsa_key_clear(key); /* * Commit the SQL transaction. @@ -2425,11 +1932,7 @@ static CK_RV generate_keypair_rsa_pkcs(p11_session_t *session, fail: - if (ctx != CRYPT_HANDLE_NONE) - cryptDestroyContext(ctx); - - if (ctx != CRYPT_HANDLE_NONE && keyid[0] != 0x00) - (void) cryptlib_delete_key(keyid); + memset(keybuf, 0, sizeof(keybuf)); if (!sql_exec("ROLLBACK")) rv = CKR_GENERAL_ERROR; @@ -2437,6 +1940,54 @@ static CK_RV generate_keypair_rsa_pkcs(p11_session_t *session, return rv; } +/* + * Sign a PKCS #1 DigestInfo using an RSA key and PKCS #1.5 padding. + * + * As explained in RFC 3447, the RSASP1 (signature generation) + * operation is the same mathematical operation as the RSADP + * (decryption) operation (both use the private key as exponent). + */ + +static CK_RV sign_rsa_pkcs(hal_rsa_key_t key, + const uint8_t * const digest_info, const size_t digest_info_len, + uint8_t *signature, const size_t signature_len) +{ + CK_RV rv; + + assert(digest_info != NULL && signature != NULL); + + /* + * Congregation will now please turn to RFC 2313 8.1 as we + * construct a PKCS #1.5 type 01 encryption block. + */ + + if (digest_info_len > signature_len - 11) + lose(CKR_DATA_LEN_RANGE); + + signature[0] = 0x00; + signature[1] = 0x01; + memset(signature + 2, 0xFF, signature_len - 3 - digest_info_len); + signature[signature_len - digest_info_len - 1] = 0x00; + memcpy(signature + signature_len - digest_info_len, digest_info, digest_info_len); + +#if 0 + fprintf(stderr, "[PKCS #1.5 signature_len %lu digest_info_len %lu block ", signature_len, digest_info_len); + for (int i = 0; i < signature_len; i++) + fprintf(stderr, "%s%02x", i == 0 ? "" : ":", signature[i]); + fprintf(stderr, "]\n"); +#endif + + if (!hal_check(hal_rsa_decrypt(key, signature, signature_len, signature, signature_len))) + lose(CKR_FUNCTION_FAILED); + + return CKR_OK; + + fail: + memset(signature, 0, signature_len); + return rv; +} + + /* @@ -2445,8 +1996,8 @@ static CK_RV generate_keypair_rsa_pkcs(p11_session_t *session, CK_RV C_Initialize(CK_VOID_PTR pInitArgs) { - int initialized_sql = 0, initialized_cryptlib = 0; CK_C_INITIALIZE_ARGS_PTR a = pInitArgs; + int initialized_sql = 0; CK_RV rv; /* @@ -2549,27 +2100,9 @@ CK_RV C_Initialize(CK_VOID_PTR pInitArgs) initialized_sql = 1; - /* - * Initialize cryptlib and open the hardware crypto device (our FPGA). - * - * The option settings are to make sure that internal stuff like the - * PKCS #15 keyset code uses algorithms we like. - */ - - if (cryptInit() != CRYPT_OK) - lose(CKR_GENERAL_ERROR); - - initialized_cryptlib = 1; - - if (cryptSetAttribute(CRYPT_UNUSED, CRYPT_OPTION_ENCR_ALGO, CRYPT_ALGO_AES) != CRYPT_OK || - cryptSetAttribute(CRYPT_UNUSED, CRYPT_OPTION_ENCR_HASH, CRYPT_ALGO_SHA2) != CRYPT_OK) + if (!kek_init()) lose(CKR_GENERAL_ERROR); -#if ENABLE_CRYPTLIB_DEVICE - if (cryptDeviceOpen(&cryptlib_device, CRYPT_UNUSED, CRYPT_DEVICE_HARDWARE, NULL) != CRYPT_OK) - lose(CKR_GENERAL_ERROR); -#endif - #if USE_POSIX initialized_pid = getpid(); #endif @@ -2578,16 +2111,6 @@ CK_RV C_Initialize(CK_VOID_PTR pInitArgs) fail: -#if ENABLE_CRYPTLIB_DEVICE - if (cryptlib_device != CRYPT_HANDLE_NONE) { - cryptDeviceClose(cryptlib_device); - cryptlib_device = CRYPT_HANDLE_NONE; - } -#endif - - if (initialized_cryptlib) - cryptEnd(); - if (initialized_sql) sql_fini(); @@ -2617,19 +2140,6 @@ CK_RV C_Finalize(CK_VOID_PTR pReserved) lose(CKR_GENERAL_ERROR); /* - * Shut down hardware device and exit cryptlib. Is there any point - * in checking error codes here? - */ - -#if ENABLE_CRYPTLIB_DEVICE - if (cryptlib_device != CRYPT_HANDLE_NONE) - cryptDeviceClose(cryptlib_device); - cryptlib_device = CRYPT_HANDLE_NONE; -#endif - - cryptEnd(); - - /* * By this point we're pretty well committed to shutting down, so * there's not much to be done if these mutex operations fail. */ @@ -2873,9 +2383,13 @@ CK_RV C_Login(CK_SESSION_HANDLE hSession, CK_UTF8CHAR_PTR pPin, CK_ULONG ulPinLen) { + static const char pin_query_format[] = + " SELECT pbkdf2_iterations, %s_pin, %s_pin_salt from global"; + p11_session_t *session; + sqlite3_stmt *q = NULL; + const char *pin_type; CK_RV rv = CKR_OK; - int crypt_cmd; mutex_lock_or_return_failure(p11_global_mutex); @@ -2892,20 +2406,6 @@ CK_RV C_Login(CK_SESSION_HANDLE hSession, lose(CKR_SESSION_HANDLE_INVALID); /* - * This is where the combination of pure-software and hardware - * starts to get confusing. See the CRYPT_DEVINFO_* attributes for - * the operations we can do during device setup (setting PINs, - * logging in using pins, etc). - * - * All fine, but behaves somewhat differently from the case where - * we're doing everything in software and using the PIN primarily as - * the encryption password for the PKCS #15 keyring. - * - * In the long run just want the hardware interface. This will - * require cleanup. - */ - - /* * We don't currently support re-login without an intervening * logout, so reject the login attempt if we're already logged in. */ @@ -2914,53 +2414,82 @@ CK_RV C_Login(CK_SESSION_HANDLE hSession, lose(CKR_USER_ALREADY_LOGGED_IN); /* + * Figure out which PIN we're checking. * We don't (yet?) support CKU_CONTEXT_SPECIFIC. - */ - - switch (userType) { - case CKU_USER: crypt_cmd = CRYPT_DEVINFO_AUTHENT_USER; break; - case CKU_SO: crypt_cmd = CRYPT_DEVINFO_AUTHENT_SUPERVISOR; break; - case CKU_CONTEXT_SPECIFIC: lose(CKR_OPERATION_NOT_INITIALIZED); - default: lose(CKR_USER_TYPE_INVALID); - } - - /* + * * Read-only SO is an illegal state, so reject the login attempt if * we have any read-only sessions and we're trying to log in as SO. */ - if (userType == CKU_SO) + switch (userType) { + case CKU_USER: + pin_type = "user"; + break; + case CKU_SO: for (session = p11_sessions; session != NULL; session = session->link) if (session->state == CKS_RO_PUBLIC_SESSION) lose(CKR_SESSION_READ_ONLY_EXISTS); + pin_type = "so"; + break; + case CKU_CONTEXT_SPECIFIC: + lose(CKR_OPERATION_NOT_INITIALIZED); + default: + lose(CKR_USER_TYPE_INVALID); + } /* - * Ask Cryptlib to log us in. We may need to examine cryptlib error - * return more closely than this. + * Look up the PIN and make sure it's set. + * + * Not obvious what error we should return if SO PIN isn't set, for + * now consider this state "locked" (because it hasn't been set yet). */ -#if ENABLE_CRYPTLIB_DEVICE - if (cryptSetAttributeString(cryptlib_device, crypt_cmd, pPin, ulPinLen) != CRYPT_OK) - lose(CKR_PIN_INCORRECT); -#endif + if (!sql_check_ok(sql_prepare(&q, pin_query_format, pin_type, pin_type)) || + !sql_check_row(sqlite3_step(q))) + lose(CKR_FUNCTION_FAILED); + + if (sqlite3_column_type(q, 1) == SQLITE_NULL || + sqlite3_column_type(q, 2) == SQLITE_NULL) { + switch (userType) { + case CKU_USER: + lose(CKR_USER_PIN_NOT_INITIALIZED); + case CKU_SO: + lose(CKR_PIN_LOCKED); + default: + lose(CKR_USER_TYPE_INVALID); + } + } + + /* + * Run PBKDF2 over the supplied PIN and compare results. + * + * Probably not really necessary to use constant-time string + * comparison, but it's harmless and cheap, so we might as well. + */ -#if ENABLE_CRYPTLIB_SOFTWARE { - char *newpin; - if (memchr(pPin, '\0', ulPinLen) != NULL) + const unsigned iterations = sqlite3_column_int(q, 0); + const uint8_t * const pin = sqlite3_column_blob(q, 1); + const uint8_t * const salt = sqlite3_column_blob(q, 2); + const size_t pin_len = sqlite3_column_bytes(q, 1); + const size_t salt_len = sqlite3_column_bytes(q, 2); + uint8_t pinbuf[pin_len]; + unsigned diff = 0; + + if (!hal_check(hal_pbkdf2(hal_hash_sha256, pPin, ulPinLen, salt, salt_len, + pinbuf, sizeof(pinbuf), iterations))) + lose(CKR_FUNCTION_FAILED); + + for (int i = 0; i < pin_len; i++) + diff |= pin[i] ^ pinbuf[i]; + + if (diff != 0) lose(CKR_PIN_INCORRECT); - if ((newpin = malloc(ulPinLen + 1)) == NULL) - lose(CKR_HOST_MEMORY); - memcpy(newpin, pPin, ulPinLen); - newpin[ulPinLen] = '\0'; - if (pin != NULL) - free(pin); - pin = newpin; } -#endif /* - * Update global login state, then whack each session into correct new state. + * If we get here, the PIN was OK. Update global login state, then + * whack every session into the correct new state. */ assert(p11_session_consistent_login()); @@ -2985,6 +2514,7 @@ CK_RV C_Login(CK_SESSION_HANDLE hSession, assert(p11_session_consistent_login()); fail: + sqlite3_finalize(q); mutex_unlock_return_with_rv(rv, p11_global_mutex); } @@ -2992,7 +2522,6 @@ CK_RV C_Logout(CK_SESSION_HANDLE hSession) { p11_session_t *session; CK_RV rv = CKR_OK; - int crypt_cmd; mutex_lock_or_return_failure(p11_global_mutex); @@ -3005,31 +2534,8 @@ CK_RV C_Logout(CK_SESSION_HANDLE hSession) if (p11_session_find(hSession) == NULL) lose(CKR_SESSION_HANDLE_INVALID); - switch (logged_in_as) { - case logged_in_as_user: crypt_cmd = CRYPT_DEVINFO_AUTHENT_USER; break; - case logged_in_as_so: crypt_cmd = CRYPT_DEVINFO_AUTHENT_SUPERVISOR; break; - case not_logged_in: lose(CKR_USER_NOT_LOGGED_IN); - } - - /* - * This is a bit problematic, because Cryptlib doesn't have a logout - * function per se. For lack of a better idea, construe logout as a - * new authentication attempt with an empty PIN. This is a little - * weird, but at least it's something we can use as a relatively - * clear signal to the HAL, and it's consistent with the way - * cryptlib does things like terminating digest inputs. - */ - -#if ENABLE_CRYPTLIB_DEVICE - if (cryptSetAttributeString(cryptlib_device, crypt_cmd, "", 0) != CRYPT_OK) - lose(CKR_FUNCTION_FAILED); -#endif - -#if ENABLE_CRYPTLIB_SOFTWARE - if (pin != NULL) - free(pin); - pin = NULL; -#endif + if (logged_in_as == not_logged_in) + lose(CKR_USER_NOT_LOGGED_IN); /* * Update global login state, then delete any private objects and @@ -3066,20 +2572,16 @@ CK_RV C_Logout(CK_SESSION_HANDLE hSession) CK_RV C_DestroyObject(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE hObject) { - static const char select_format[] = - " SELECT %s_object_id, keyid FROM object NATURAL JOIN %s_object WHERE object_handle = ?1"; - static const char delete_object[] = " DELETE FROM object WHERE object_handle = ?"; static const char delete_token_object[] = - " DELETE FROM token_object WHERE token_object_id = ?"; - - const char *flavor = is_token_handle(hObject) ? "token" : "session"; + " WITH" + " t AS (SELECT token_object_id FROM object WHERE object_handle = ?)" + " DELETE FROM token_object WHERE token_object_id = t"; p11_session_t *session; sqlite3_stmt *q = NULL; - sqlite3_int64 id; CK_RV rv = CKR_OK; mutex_lock_or_return_failure(p11_global_mutex); @@ -3089,39 +2591,15 @@ CK_RV C_DestroyObject(CK_SESSION_HANDLE hSession, if ((rv = p11_object_check_rights(session, hObject, p11_object_access_write)) != CKR_OK) goto fail; - if (!sql_check_ok(sql_prepare(&q, select_format, flavor, flavor)) || - !sql_check_ok(sqlite3_bind_int64(q, 1, hObject))) - lose(CKR_FUNCTION_FAILED); - - switch (sqlite3_step(q)) { - case SQLITE_ROW: - break; - case SQLITE_DONE: - lose(CKR_OBJECT_HANDLE_INVALID); - default: - sql_whine_step(); - lose(CKR_FUNCTION_FAILED); - } - - id = sqlite3_column_int64(q, 0); - - if (sqlite3_column_type(q, 1) == SQLITE_TEXT && - cryptlib_delete_key((const char *) sqlite3_column_text(q, 1)) != CRYPT_OK) - lose(CKR_FUNCTION_FAILED); - - sqlite3_finalize(q); - q = NULL; - if (is_token_handle(hObject) && (!sql_check_ok(sql_prepare(&q, delete_token_object)) || - !sql_check_ok(sqlite3_bind_int64(q, 1, id)) || - !sql_check_done(sqlite3_step(q)))) + !sql_check_ok(sqlite3_bind_int64(q, 1, hObject)) || + !sql_check_done(sqlite3_step(q)) || + !sql_check_ok(sql_finalize_and_clear(&q)))) lose(CKR_FUNCTION_FAILED); - sqlite3_finalize(q); - q = NULL; - - if (!sql_check_ok(sql_prepare(&q, delete_object)) || + if ( + !sql_check_ok(sql_prepare(&q, delete_object)) || !sql_check_ok(sqlite3_bind_int64(q, 1, hObject)) || !sql_check_done(sqlite3_step(q))) lose(CKR_FUNCTION_FAILED); @@ -3300,10 +2778,6 @@ CK_RV C_FindObjectsInit(CK_SESSION_HANDLE hSession, lose(CKR_FUNCTION_FAILED); } - sqlite3_finalize(q1); - sqlite3_finalize(q2); - q1 = q2 = NULL; - /* * Create a temporary table to hold this session's FindObjects * state. Populate this with every object this session knows about, @@ -3311,27 +2785,30 @@ CK_RV C_FindObjectsInit(CK_SESSION_HANDLE hSession, * the caller supplied. */ - if (!sql_check_ok(sql_prepare(&q1, drop_format, hSession)) || + if (!sql_check_ok(sql_finalize_and_clear(&q1)) || + !sql_check_ok(sql_finalize_and_clear(&q2)) || + !sql_check_ok(sql_prepare(&q1, drop_format, hSession)) || !sql_check_done(sqlite3_step(q1)) || !sql_check_ok(sql_prepare(&q2, create_format, hSession)) || !sql_check_ok(sqlite3_bind_int64(q2, 1, hSession)) || - !sql_check_done(sqlite3_step(q2))) - lose(CKR_FUNCTION_FAILED); - - sqlite3_finalize(q1); - sqlite3_finalize(q2); - q1 = q2 = NULL; - - if (!sql_check_ok(sql_prepare(&q1, delete_format, hSession))) + !sql_check_done(sqlite3_step(q2)) || + !sql_check_ok(sql_finalize_and_clear(&q1)) || + !sql_check_ok(sql_finalize_and_clear(&q2)) || + !sql_check_ok(sql_prepare(&q1, delete_format, hSession))) lose(CKR_FUNCTION_FAILED); /* - * We only see private objects when logged in as the regular user. + * If we're not logged in as the regular user, run an extra filter + * cycle to remove all private objects before we get to the + * caller-supplied template. */ if (logged_in_as != logged_in_as_user) { - if (!sql_check_ok(sqlite3_bind_int64(q1, 1, CKA_PRIVATE)) || - !sql_check_ok(sqlite3_bind_blob(q1, 2, &const_CK_FALSE, sizeof(const_CK_FALSE), NULL)) || + if (!sql_check_ok(sqlite3_bind_int64(q1, 1, CKA_PRIVATE)) || + !sql_check_ok(sqlite3_bind_blob( q1, 2, + &const_CK_FALSE, + sizeof(const_CK_FALSE), + NULL)) || !sql_check_done(sqlite3_step(q1))) lose(CKR_FUNCTION_FAILED); } @@ -3441,10 +2918,8 @@ CK_RV C_FindObjectsFinal(CK_SESSION_HANDLE hSession) * Clean up result query and temporary table. */ - sqlite3_finalize(session->find_query); - session->find_query = NULL; - - if (!sql_check_ok(sql_prepare(&q, drop_format, hSession)) || + if (!sql_check_ok(sql_finalize_and_clear(&session->find_query)) || + !sql_check_ok(sql_prepare(&q, drop_format, hSession)) || !sql_check_done(sqlite3_step(q))) lose(CKR_FUNCTION_FAILED); @@ -3457,8 +2932,6 @@ CK_RV C_DigestInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism) { p11_session_t *session; - CRYPT_ALGO_TYPE algo; - unsigned hash_len = 0; CK_RV rv = CKR_OK; mutex_lock_or_return_failure(p11_global_mutex); @@ -3469,33 +2942,25 @@ CK_RV C_DigestInit(CK_SESSION_HANDLE hSession, if (pMechanism == NULL) lose(CKR_ARGUMENTS_BAD); - if (session->digest_context != CRYPT_HANDLE_NONE) + if (session->digest_descriptor != NULL) lose(CKR_OPERATION_ACTIVE); switch (pMechanism->mechanism) { - case CKM_SHA_1: algo = CRYPT_ALGO_SHA1; break; - case CKM_SHA256: algo = CRYPT_ALGO_SHA2; hash_len = 256; break; - case CKM_SHA384: algo = CRYPT_ALGO_SHA2; hash_len = 384; break; - case CKM_SHA512: algo = CRYPT_ALGO_SHA2; hash_len = 512; break; + case CKM_SHA_1: session->digest_descriptor = hal_hash_sha1; break; + case CKM_SHA256: session->digest_descriptor = hal_hash_sha256; break; + case CKM_SHA384: session->digest_descriptor = hal_hash_sha384; break; + case CKM_SHA512: session->digest_descriptor = hal_hash_sha512; break; default: lose(CKR_MECHANISM_INVALID); } - assert((hash_len & 7) == 0); - - if (cryptlib_create_context(&session->digest_context, algo) != CRYPT_OK) - lose(CKR_FUNCTION_FAILED); - - if (algo == CRYPT_ALGO_SHA2 && - cryptSetAttribute(session->digest_context, CRYPT_CTXINFO_BLOCKSIZE, hash_len >> 3) != CRYPT_OK) - lose(CKR_FUNCTION_FAILED); + if (!hal_check(hal_hash_core_present(session->digest_descriptor))) { + session->digest_descriptor = NULL; + lose(CKR_MECHANISM_INVALID); + } return mutex_unlock(p11_global_mutex); fail: - if (session != NULL && session->digest_context != CRYPT_HANDLE_NONE) { - cryptDestroyContext(session->digest_context); - session->digest_context = CRYPT_HANDLE_NONE; - } mutex_unlock_return_with_rv(rv, p11_global_mutex); } @@ -3507,7 +2972,6 @@ CK_RV C_Digest(CK_SESSION_HANDLE hSession, { p11_session_t *session; CK_RV rv = CKR_OK; - int len; mutex_lock_or_return_failure(p11_global_mutex); @@ -3517,43 +2981,35 @@ CK_RV C_Digest(CK_SESSION_HANDLE hSession, if (pData == NULL || pulDigestLen == NULL) lose(CKR_ARGUMENTS_BAD); - if (session->digest_context == CRYPT_HANDLE_NONE) + if (session->digest_descriptor == NULL) lose(CKR_OPERATION_NOT_INITIALIZED); - if (pDigest == NULL) { - if (cryptGetAttribute(session->digest_context, CRYPT_CTXINFO_BLOCKSIZE, &len) != CRYPT_OK) - lose(CKR_FUNCTION_FAILED); - *pulDigestLen = len; - return mutex_unlock(p11_global_mutex); - } - - if (cryptEncrypt(session->digest_context, pData, ulDataLen) != CRYPT_OK) - lose(CKR_FUNCTION_FAILED); + rv = *pulDigestLen < session->digest_descriptor->digest_length ? CKR_BUFFER_TOO_SMALL : CKR_OK; - if (ulDataLen != 0 && - cryptEncrypt(session->digest_context, pData, 0) != CRYPT_OK) - lose(CKR_FUNCTION_FAILED); + *pulDigestLen = session->digest_descriptor->digest_length; - if (cryptGetAttributeString(session->digest_context, - CRYPT_CTXINFO_HASHVALUE, NULL, &len) != CRYPT_OK) - lose(CKR_FUNCTION_FAILED); + if (pDigest == NULL) + return mutex_unlock(p11_global_mutex); - if (len > *pulDigestLen) + if (rv == CKR_BUFFER_TOO_SMALL) lose(CKR_BUFFER_TOO_SMALL); - if (cryptGetAttributeString(session->digest_context, - CRYPT_CTXINFO_HASHVALUE, pDigest, &len) != CRYPT_OK) - lose(CKR_FUNCTION_FAILED); + { + uint8_t statebuf[session->digest_descriptor->hash_state_length]; + hal_hash_state_t state = { NULL }; - *pulDigestLen = len; + if (!hal_check(hal_hash_initialize(session->digest_descriptor, + &state, statebuf, sizeof(statebuf))) || + !hal_check(hal_hash_update(state, pData, ulDataLen)) || + !hal_check(hal_hash_finalize(state, pDigest, *pulDigestLen))) + lose(CKR_FUNCTION_FAILED); + } rv = CKR_OK; /* Fall through */ fail: - if (session != NULL && session->digest_context != CRYPT_HANDLE_NONE) { - cryptDestroyContext(session->digest_context); - session->digest_context = CRYPT_HANDLE_NONE; - } + if (session != NULL) + session->digest_descriptor = NULL; mutex_unlock_return_with_rv(rv, p11_global_mutex); } @@ -3562,11 +3018,6 @@ CK_RV C_SignInit(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE hKey) { p11_session_t *session; - char keyid[CRYPT_MAX_HASHSIZE * 2 + 1]; - CRYPT_ALGO_TYPE sign_algo, hash_algo; - unsigned hash_size = 0; - int need_cleanup = 0; - int key_algo; CK_RV rv = CKR_OK; mutex_lock_or_return_failure(p11_global_mutex); @@ -3577,60 +3028,35 @@ CK_RV C_SignInit(CK_SESSION_HANDLE hSession, if (pMechanism == NULL) lose(CKR_ARGUMENTS_BAD); - if (session->sign_key_context != CRYPT_HANDLE_NONE || - session->sign_digest_context != CRYPT_HANDLE_NONE) + if (session->sign_key_handle != CK_INVALID_HANDLE || session->sign_digest_descriptor != NULL) lose(CKR_OPERATION_ACTIVE); if ((rv = p11_object_check_rights(session, hKey, p11_object_access_read)) != CKR_OK) goto fail; + /* + * Will need to check key algorithm type here once we add support + * for signature algorithms other than RSA. + */ + + session->sign_key_handle = hKey; + switch (pMechanism->mechanism) { - case CKM_RSA_PKCS: sign_algo = CRYPT_ALGO_RSA; hash_algo = CRYPT_ALGO_NONE; break; - case CKM_SHA1_RSA_PKCS: sign_algo = CRYPT_ALGO_RSA; hash_algo = CRYPT_ALGO_SHA1; break; - case CKM_SHA256_RSA_PKCS: sign_algo = CRYPT_ALGO_RSA; hash_algo = CRYPT_ALGO_SHA2; hash_size = 256; break; - case CKM_SHA384_RSA_PKCS: sign_algo = CRYPT_ALGO_RSA; hash_algo = CRYPT_ALGO_SHA2; hash_size = 384; break; - case CKM_SHA512_RSA_PKCS: sign_algo = CRYPT_ALGO_RSA; hash_algo = CRYPT_ALGO_SHA2; hash_size = 512; break; + case CKM_RSA_PKCS: session->sign_digest_descriptor = NULL; break; + case CKM_SHA1_RSA_PKCS: session->sign_digest_descriptor = hal_hash_sha1; break; + case CKM_SHA256_RSA_PKCS: session->sign_digest_descriptor = hal_hash_sha256; break; + case CKM_SHA384_RSA_PKCS: session->sign_digest_descriptor = hal_hash_sha384; break; + case CKM_SHA512_RSA_PKCS: session->sign_digest_descriptor = hal_hash_sha512; break; default: return CKR_MECHANISM_INVALID; } - assert((hash_size & 7) == 0); - - need_cleanup = 1; - - if (!p11_object_get_keyid(hKey, keyid, sizeof(keyid)) || - cryptlib_load_key(&session->sign_key_context, keyid) != CRYPT_OK || - cryptGetAttribute(session->sign_key_context, CRYPT_CTXINFO_ALGO, &key_algo) != CRYPT_OK) - lose(CKR_KEY_HANDLE_INVALID); - - if (sign_algo != key_algo) - lose(CKR_KEY_TYPE_INCONSISTENT); - - if (hash_algo != CRYPT_ALGO_NONE && - cryptlib_create_context(&session->sign_digest_context, hash_algo) != CRYPT_OK) - lose(CKR_FUNCTION_FAILED); - - if (hash_algo == CRYPT_ALGO_SHA2 && - cryptSetAttribute(session->sign_digest_context, - CRYPT_CTXINFO_BLOCKSIZE, hash_size >> 3) != CRYPT_OK) - lose(CKR_FUNCTION_FAILED); - - need_cleanup = 0; - - rv = CKR_OK; /* Fall through */ + return mutex_unlock(p11_global_mutex); fail: - assert(!need_cleanup || session != NULL); - - if (need_cleanup && session->sign_key_context != CRYPT_HANDLE_NONE) { - cryptDestroyContext(session->sign_key_context); - session->sign_key_context = CRYPT_HANDLE_NONE; - } - - if (need_cleanup && session->sign_digest_context != CRYPT_HANDLE_NONE) { - cryptDestroyContext(session->sign_digest_context); - session->sign_digest_context = CRYPT_HANDLE_NONE; + if (session != NULL) { + session->sign_key_handle = CK_INVALID_HANDLE; + session->sign_digest_descriptor = NULL; } - mutex_unlock_return_with_rv(rv, p11_global_mutex); } @@ -3640,8 +3066,10 @@ CK_RV C_Sign(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pSignature, CK_ULONG_PTR pulSignatureLen) { + uint8_t keybuf[hal_rsa_key_t_size]; + hal_rsa_key_t key = { NULL }; p11_session_t *session; - int len, algo; + size_t signature_len; CK_RV rv; mutex_lock_or_return_failure(p11_global_mutex); @@ -3652,160 +3080,111 @@ CK_RV C_Sign(CK_SESSION_HANDLE hSession, if (pData == NULL || pulSignatureLen == NULL) lose(CKR_ARGUMENTS_BAD); - if (session->sign_key_context == CRYPT_HANDLE_NONE) + if (session->sign_key_handle == CK_INVALID_HANDLE) lose(CKR_OPERATION_NOT_INITIALIZED); - if (pSignature == NULL) { - /* - * Caller just wants to know the signature length, which we can - * get from cryptCreateSignature(), using a dummy hash context if - * necessary. - * - * There may be an easier way: at least for RSA, reading the key's - * CRYPT_CTXINFO_KEYSIZE would give us the answer. But the - * constraint that messages_size == key_size doesn't necessarily - * hold for all asymmetric algorithms, so best to be safe here. - */ - - CRYPT_CONTEXT ctx = session->sign_digest_context; - - if (ctx == CRYPT_HANDLE_NONE && cryptCreateContext(&ctx, CRYPT_UNUSED, CRYPT_ALGO_SHA2) != CRYPT_OK) - lose(CKR_FUNCTION_FAILED); - - if (cryptCreateSignature(NULL, 0, &len, session->sign_key_context, ctx) != CRYPT_OK) - len = 0; + /* + * From here down this function is RSA-specific, and will need + * rewriting when we add support for other algorithms. + */ - if (session->sign_digest_context == CRYPT_HANDLE_NONE) - cryptDestroyContext(ctx); + if (!p11_object_get_rsa_private_key(session->sign_key_handle, + &key, keybuf, sizeof(keybuf))) + lose(CKR_FUNCTION_FAILED); - if (len == 0) - lose(CKR_FUNCTION_FAILED); - } + /* + * Retrieve signature length. For RSA this is just the modulus + * length, other algorithms will need a more generic solution. + */ - else if (session->sign_digest_context != CRYPT_HANDLE_NONE) { - /* - * Caller wanted a hash-and-sign operation, so we can use cryptCreateSignature(). - */ + if (!hal_check(hal_rsa_key_get_modulus(key, NULL, &signature_len, 0))) + lose(CKR_FUNCTION_FAILED); - if (cryptEncrypt(session->sign_digest_context, pData, ulDataLen) != CRYPT_OK) - lose(CKR_FUNCTION_FAILED); + rv = signature_len > *pulSignatureLen ? CKR_BUFFER_TOO_SMALL : CKR_OK; - if (ulDataLen != 0 && - cryptEncrypt(session->sign_digest_context, pData, 0) != CRYPT_OK) - lose(CKR_FUNCTION_FAILED); + *pulSignatureLen = signature_len; - if (cryptCreateSignature(pSignature, *pulSignatureLen, &len, - session->sign_key_context, - session->sign_digest_context) != CRYPT_OK) - lose(CKR_FUNCTION_FAILED); + if (pSignature == NULL) { + hal_rsa_key_clear(key); + return mutex_unlock(p11_global_mutex); } - else { + if (rv == CKR_BUFFER_TOO_SMALL) + lose(CKR_BUFFER_TOO_SMALL); + if (session->sign_digest_descriptor != NULL) { /* - * Caller wanted a pure-signature operation, have to use - * cryptDeCrypt() [sic]. + * Caller wanted a hash-and-sign operation. We need to hash the + * caller's data and construct a DigestInfo SEQUENCE. * - * At the moment we just blindly sign this without checking that - * what we're signing really is (eg) a valid DigestInfo SEQUENCE. - * Should we bother checking the syntax here, given that we have - * no way of checking the digest itself (if we get here, we've - * never seen the original plaintext, just the purported digest)? + * This probably ought to be a library function somewhere. */ - if (cryptGetAttribute(session->sign_key_context, CRYPT_CTXINFO_ALGO, &algo) != CRYPT_OK || - cryptGetAttribute(session->sign_key_context, CRYPT_CTXINFO_KEYSIZE, &len) != CRYPT_OK) - lose(CKR_FUNCTION_FAILED); - - switch (algo) { - - case CRYPT_ALGO_RSA: - - /* - * Congregation will now please turn to RFC 2313 8.1 as we - * construct a PKCS #1.5 type 01 encryption block. - */ + const hal_hash_descriptor_t *desc = session->sign_digest_descriptor; + uint8_t digest_info[desc->digest_length + desc->digest_algorithm_id_length + 4]; + uint8_t statebuf[session->digest_descriptor->hash_state_length]; + hal_hash_state_t state = { NULL }; + uint8_t *d = digest_info; - if (len > *pulSignatureLen) - lose(CKR_BUFFER_TOO_SMALL); + /* + * This encoder will fail if the DigestInfo object is more than + * 129 octets long. Rewrite if and when we need to support + * digests or OIDs long enough for that to be an issue. + */ + assert(sizeof(digest_info) < 130); - if (ulDataLen > len - 11) - return CKR_DATA_LEN_RANGE; + *d++ = 0x30; /* SEQUENCE */ + *d++ = (uint8_t) (sizeof(digest_info) - 2); - pSignature[0] = 0x00; - pSignature[1] = 0x01; - memset(pSignature + 2, 0xFF, len - 3 - ulDataLen); - pSignature[len - ulDataLen - 1] = 0x00; - memcpy(pSignature + len - ulDataLen, pData, ulDataLen); + memcpy(d, desc->digest_algorithm_id, desc->digest_algorithm_id_length); + d += desc->digest_algorithm_id_length; -#if 0 - /* XXX */ - { - int i; - fprintf(stderr, "[PKCS #1.5 len %lu ulDataLen %lu block ", len, ulDataLen); - for (i = 0; i < len; i++) - fprintf(stderr, "%s%02x", i == 0 ? "" : ":", pSignature[i]); - fprintf(stderr, "]\n"); - } -#endif + *d++ = 0x04; /* OCTET STRING */ + *d++ = (uint8_t) desc->digest_length; - break; + assert(digest_info + sizeof(digest_info) == d + desc->digest_length); - default: + if (!hal_check(hal_hash_initialize(desc, &state, statebuf, sizeof(statebuf))) || + !hal_check(hal_hash_update(state, pData, ulDataLen)) || + !hal_check(hal_hash_finalize(state, d, desc->digest_length))) { + memset(digest_info, 0, sizeof(digest_info)); lose(CKR_FUNCTION_FAILED); } + rv = sign_rsa_pkcs(key, digest_info, sizeof(digest_info), pSignature, signature_len); + memset(digest_info, 0, sizeof(digest_info)); + if (rv != CKR_OK) + goto fail; + } + + else { + /* - * The terms "encrypt" and "decrypt" get weird when one goes this - * far past the API that a sane person would be using. As - * explained in RFC 3447, the RSASP1 (signature generation) - * operation is the same mathematical operation as the RSADP - * (decryption) operation, so we have to use cryptDecrypt(), not - * cryptEncrypt() here. No, really. - * - * Well, this works for RSA, anyway. ECDSA may turn out to be a - * whole different bucket of monkey guts. + * Caller wanted a pure-signature operation. We assume that input + * is a valid DigestInfo SEQUENCE: we've never seen the original + * plaintext, thus can't check the hash, so there's not much point + * in checking the ASN.1 structure. */ - if (cryptDecrypt(session->sign_key_context, pSignature, len) != CRYPT_OK) - lose(CKR_FUNCTION_FAILED); + if ((rv = sign_rsa_pkcs(key, pData, ulDataLen, pSignature, signature_len)) != CKR_OK) + goto fail; } - *pulSignatureLen = len; - rv = CKR_OK; /* Fall through */ fail: - if (session != NULL && session->sign_digest_context != CRYPT_HANDLE_NONE) { - cryptDestroyContext(session->sign_digest_context); - session->sign_digest_context = CRYPT_HANDLE_NONE; + if (session != NULL) { + session->sign_key_handle = CK_INVALID_HANDLE; + session->sign_digest_descriptor = NULL; } - if (session != NULL && session->sign_key_context != CRYPT_HANDLE_NONE) { - cryptDestroyContext(session->sign_key_context); - session->sign_key_context = CRYPT_HANDLE_NONE; - } + hal_rsa_key_clear(key); mutex_unlock_return_with_rv(rv, p11_global_mutex); } /* - * libhsm only uses C_GenerateKey() for DSA parameter generation. - * More general use presumably wants this for things like generating - * symmetric keys for later wrapping by asymmetric keys. - */ - -CK_RV C_GenerateKey(CK_SESSION_HANDLE hSession, - CK_MECHANISM_PTR pMechanism, - CK_ATTRIBUTE_PTR pTemplate, - CK_ULONG ulCount, - CK_OBJECT_HANDLE_PTR phKey) -{ - return CKR_FUNCTION_NOT_SUPPORTED; -} - -/* * If there's any method in this entire package which really needs a * more complex mutex structure than the single global mutex, it's * probably this one. Key generation can take a looooong time. @@ -3856,7 +3235,6 @@ CK_RV C_GenerateRandom(CK_SESSION_HANDLE hSession, CK_ULONG ulRandomLen) { p11_session_t *session; - CRYPT_CONTEXT ctx = CRYPT_HANDLE_NONE; CK_RV rv = CKR_OK; mutex_lock_or_return_failure(p11_global_mutex); @@ -3867,25 +3245,10 @@ CK_RV C_GenerateRandom(CK_SESSION_HANDLE hSession, if (RandomData == NULL) lose(CKR_ARGUMENTS_BAD); - /* - * Cryptlib doesn't expose the raw TRNG, but, per the manual, block - * cipher encryption output with a randomly generated key is good - * enough for most sane purposes. - * - * Not certain why the Cryptlib manual suggests using CFB mode - * instead of OFB mode here, but going with the manual for now. - */ - - if (cryptCreateContext(&ctx, CRYPT_UNUSED, CRYPT_ALGO_AES) != CRYPT_OK || - cryptSetAttribute(ctx, CRYPT_CTXINFO_MODE, CRYPT_MODE_CFB) != CRYPT_OK || - cryptGenerateKey(ctx) != CRYPT_OK || - cryptEncrypt(ctx, RandomData, ulRandomLen) != CRYPT_OK) + if (!hal_check(hal_get_random(RandomData, ulRandomLen))) lose(CKR_FUNCTION_FAILED); fail: - if (ctx != CRYPT_HANDLE_NONE) - (void) cryptDestroyContext(ctx); - mutex_unlock_return_with_rv(rv, p11_global_mutex); } @@ -3904,6 +3267,13 @@ CK_RV C_GenerateRandom(CK_SESSION_HANDLE hSession, * there are enough bald yaks in this saga already. */ +CK_RV C_GenerateKey(CK_SESSION_HANDLE hSession, + CK_MECHANISM_PTR pMechanism, + CK_ATTRIBUTE_PTR pTemplate, + CK_ULONG ulCount, + CK_OBJECT_HANDLE_PTR phKey) +{ return CKR_FUNCTION_NOT_SUPPORTED; } + CK_RV C_GetInfo(CK_INFO_PTR pInfo) { return CKR_FUNCTION_NOT_SUPPORTED; } |