diff --git a/ChangeLog b/ChangeLog index 79ffb76fd..6c285aae3 100644 --- a/ChangeLog +++ b/ChangeLog @@ -10,6 +10,7 @@ Features (POLARSSL_ENTROPY_FORCE_SHA256) * Testing script ssl-opt.sh added for testing 'live' ssl option interoperability against OpenSSL and PolarSSL + * Support for reading EC keys that use SpecifiedECDomain in some cases. Changes * Deprecated the Memory layer diff --git a/include/polarssl/config.h b/include/polarssl/config.h index c070df2ac..decfc73ae 100644 --- a/include/polarssl/config.h +++ b/include/polarssl/config.h @@ -587,6 +587,20 @@ */ #define POLARSSL_KEY_EXCHANGE_ECDH_RSA_ENABLED +/** + * \def POLARSSL_PK_PARSE_EC_EXTENDED + * + * Enhance support for reading EC keys using variants of SEC1 not allowed by + * RFC 5915 and RFC 5480. + * + * Currently this means parsing the SpecifiedECDomain choice of EC + * parameters (only known groups are supported, not arbitrary domains, to + * avoid validation issues). + * + * Disable if you only need to support RFC 5915 + 5480 key formats. + */ +#define POLARSSL_PK_PARSE_EC_EXTENDED + /** * \def POLARSSL_ERROR_STRERROR_BC * diff --git a/include/polarssl/ecp.h b/include/polarssl/ecp.h index b35b0d1d0..61d6a1dd4 100644 --- a/include/polarssl/ecp.h +++ b/include/polarssl/ecp.h @@ -376,8 +376,10 @@ int ecp_point_write_binary( const ecp_group *grp, const ecp_point *P, * \param ilen Actual length of input * * \return 0 if successful, - * POLARSSL_ERR_ECP_BAD_INPUT_DATA if input is invalid - * POLARSSL_ERR_MPI_MALLOC_FAILED if memory allocation failed + * POLARSSL_ERR_ECP_BAD_INPUT_DATA if input is invalid, + * POLARSSL_ERR_MPI_MALLOC_FAILED if memory allocation failed, + * POLARSSL_ERR_ECP_FEATURE_UNAVAILABLE if the point format + * is not implemented. * * \note This function does NOT check that the point actually * belongs to the given group, see ecp_check_pubkey() for diff --git a/include/polarssl/oid.h b/include/polarssl/oid.h index f000b8e7e..2470d5e1d 100644 --- a/include/polarssl/oid.h +++ b/include/polarssl/oid.h @@ -315,6 +315,15 @@ /* brainpoolP512r1 OBJECT IDENTIFIER ::= {versionOne 13} */ #define OID_EC_GRP_BP512R1 OID_EC_BRAINPOOL_V1 "\x0D" +/* + * SEC1 C.1 + * + * prime-field OBJECT IDENTIFIER ::= { id-fieldType 1 } + * id-fieldType OBJECT IDENTIFIER ::= { ansi-X9-62 fieldType(1)} + */ +#define OID_ANSI_X9_62_FIELD_TYPE OID_ANSI_X9_62 "\x01" +#define OID_ANSI_X9_62_PRIME_FIELD OID_ANSI_X9_62_FIELD_TYPE "\x01" + /* * ECDSA signature identifers, from RFC 5480 */ diff --git a/library/ecp.c b/library/ecp.c index f4f2d1c13..7cfb44f2c 100644 --- a/library/ecp.c +++ b/library/ecp.c @@ -478,7 +478,8 @@ cleanup: * Import a point from unsigned binary data (SEC1 2.3.4) */ int ecp_point_read_binary( const ecp_group *grp, ecp_point *pt, - const unsigned char *buf, size_t ilen ) { + const unsigned char *buf, size_t ilen ) +{ int ret; size_t plen; @@ -487,7 +488,10 @@ int ecp_point_read_binary( const ecp_group *grp, ecp_point *pt, plen = mpi_size( &grp->P ); - if( ilen != 2 * plen + 1 || buf[0] != 0x04 ) + if( buf[0] != 0x04 ) + return( POLARSSL_ERR_ECP_FEATURE_UNAVAILABLE ); + + if( ilen != 2 * plen + 1 ) return( POLARSSL_ERR_ECP_BAD_INPUT_DATA ); MPI_CHK( mpi_read_binary( &pt->X, buf + 1, plen ) ); diff --git a/library/pkparse.c b/library/pkparse.c index dcb0f3f91..4e9e4001d 100644 --- a/library/pkparse.c +++ b/library/pkparse.c @@ -148,12 +148,12 @@ int pk_parse_public_keyfile( pk_context *ctx, const char *path ) #endif /* POLARSSL_FS_IO */ #if defined(POLARSSL_ECP_C) -/* Get an EC group id from an ECParameters buffer +/* Minimally parse an ECParameters buffer to and asn1_buf * * ECParameters ::= CHOICE { * namedCurve OBJECT IDENTIFIER + * specifiedCurve SpecifiedECDomain -- = SEQUENCE { ... } * -- implicitCurve NULL - * -- specifiedCurve SpecifiedECDomain * } */ static int pk_get_ecparams( unsigned char **p, const unsigned char *end, @@ -161,10 +161,22 @@ static int pk_get_ecparams( unsigned char **p, const unsigned char *end, { int ret; + /* Tag may be either OID or SEQUENCE */ params->tag = **p; + if( params->tag != ASN1_OID +#if defined(POLARSSL_PK_PARSE_EC_EXTENDED) + && params->tag != ( ASN1_CONSTRUCTED | ASN1_SEQUENCE ) +#endif + ) + { + return( POLARSSL_ERR_PK_KEY_INVALID_FORMAT + + POLARSSL_ERR_ASN1_UNEXPECTED_TAG ); + } - if( ( ret = asn1_get_tag( p, end, ¶ms->len, ASN1_OID ) ) != 0 ) + if( ( ret = asn1_get_tag( p, end, ¶ms->len, params->tag ) ) != 0 ) + { return( POLARSSL_ERR_PK_KEY_INVALID_FORMAT + ret ); + } params->p = *p; *p += params->len; @@ -176,16 +188,262 @@ static int pk_get_ecparams( unsigned char **p, const unsigned char *end, return( 0 ); } +#if defined(POLARSSL_PK_PARSE_EC_EXTENDED) +/* + * Parse a SpecifiedECDomain (SEC 1 C.2) and (mostly) fill the group with it. + * WARNING: the resulting group should only be used with + * pk_group_id_from_specified(), since its base point may not be set correctly + * if it was encoded compressed. + * + * SpecifiedECDomain ::= SEQUENCE { + * version SpecifiedECDomainVersion(ecdpVer1 | ecdpVer2 | ecdpVer3, ...), + * fieldID FieldID {{FieldTypes}}, + * curve Curve, + * base ECPoint, + * order INTEGER, + * cofactor INTEGER OPTIONAL, + * hash HashAlgorithm OPTIONAL, + * ... + * } + * + * We only support prime-field as field type, and ignore hash and cofactor. + */ +static int pk_group_from_specified( const asn1_buf *params, ecp_group *grp ) +{ + int ret; + unsigned char *p = params->p; + const unsigned char * const end = params->p + params->len; + const unsigned char *end_field, *end_curve; + size_t len; + int ver; + + /* SpecifiedECDomainVersion ::= INTEGER { 1, 2, 3 } */ + if( ( ret = asn1_get_int( &p, end, &ver ) ) != 0 ) + return( POLARSSL_ERR_PK_KEY_INVALID_FORMAT + ret ); + + if( ver < 1 || ver > 3 ) + return( POLARSSL_ERR_PK_KEY_INVALID_FORMAT ); + + /* + * FieldID { FIELD-ID:IOSet } ::= SEQUENCE { -- Finite field + * fieldType FIELD-ID.&id({IOSet}), + * parameters FIELD-ID.&Type({IOSet}{@fieldType}) + * } + */ + if( ( ret = asn1_get_tag( &p, end, &len, + ASN1_CONSTRUCTED | ASN1_SEQUENCE ) ) != 0 ) + return( ret ); + + end_field = p + len; + + /* + * FIELD-ID ::= TYPE-IDENTIFIER + * FieldTypes FIELD-ID ::= { + * { Prime-p IDENTIFIED BY prime-field } | + * { Characteristic-two IDENTIFIED BY characteristic-two-field } + * } + * prime-field OBJECT IDENTIFIER ::= { id-fieldType 1 } + */ + if( ( ret = asn1_get_tag( &p, end_field, &len, ASN1_OID ) ) != 0 ) + return( ret ); + + if( len != OID_SIZE( OID_ANSI_X9_62_PRIME_FIELD ) || + memcmp( p, OID_ANSI_X9_62_PRIME_FIELD, len ) != 0 ) + { + return( POLARSSL_ERR_PK_FEATURE_UNAVAILABLE ); + } + + p += len; + + /* Prime-p ::= INTEGER -- Field of size p. */ + if( ( ret = asn1_get_mpi( &p, end_field, &grp->P ) ) != 0 ) + return( POLARSSL_ERR_PK_KEY_INVALID_FORMAT + ret ); + + grp->pbits = mpi_msb( &grp->P ); + + if( p != end_field ) + return( POLARSSL_ERR_PK_KEY_INVALID_FORMAT + + POLARSSL_ERR_ASN1_LENGTH_MISMATCH ); + + /* + * Curve ::= SEQUENCE { + * a FieldElement, + * b FieldElement, + * seed BIT STRING OPTIONAL + * -- Shall be present if used in SpecifiedECDomain + * -- with version equal to ecdpVer2 or ecdpVer3 + * } + */ + if( ( ret = asn1_get_tag( &p, end, &len, + ASN1_CONSTRUCTED | ASN1_SEQUENCE ) ) != 0 ) + return( ret ); + + end_curve = p + len; + + /* + * FieldElement ::= OCTET STRING + * containing an integer in the case of a prime field + */ + if( ( ret = asn1_get_tag( &p, end_curve, &len, ASN1_OCTET_STRING ) ) != 0 || + ( ret = mpi_read_binary( &grp->A, p, len ) ) != 0 ) + { + return( POLARSSL_ERR_PK_KEY_INVALID_FORMAT + ret ); + } + + p += len; + + if( ( ret = asn1_get_tag( &p, end_curve, &len, ASN1_OCTET_STRING ) ) != 0 || + ( ret = mpi_read_binary( &grp->B, p, len ) ) != 0 ) + { + return( POLARSSL_ERR_PK_KEY_INVALID_FORMAT + ret ); + } + + p += len; + + /* Ignore seed BIT STRING OPTIONAL */ + if( ( ret = asn1_get_tag( &p, end_curve, &len, ASN1_BIT_STRING ) ) == 0 ) + p += len; + + if( p != end_curve ) + return( POLARSSL_ERR_PK_KEY_INVALID_FORMAT + + POLARSSL_ERR_ASN1_LENGTH_MISMATCH ); + + /* + * ECPoint ::= OCTET STRING + */ + if( ( ret = asn1_get_tag( &p, end, &len, ASN1_OCTET_STRING ) ) != 0 ) + return( POLARSSL_ERR_PK_KEY_INVALID_FORMAT + ret ); + + if( ( ret = ecp_point_read_binary( grp, &grp->G, + ( const unsigned char *) p, len ) ) != 0 ) + { + /* + * If we can't read the point because it's compressed, cheat by + * reading only the X coordinate and the parity bit of Y. + */ + if( ret != POLARSSL_ERR_ECP_FEATURE_UNAVAILABLE || + ( p[0] != 0x02 && p[0] != 0x03 ) || + len != mpi_size( &grp->P ) + 1 || + mpi_read_binary( &grp->G.X, p + 1, len - 1 ) != 0 || + mpi_lset( &grp->G.Y, p[0] - 2 ) != 0 || + mpi_lset( &grp->G.Z, 1 ) != 0 ) + { + return( POLARSSL_ERR_PK_KEY_INVALID_FORMAT ); + } + } + + p += len; + + /* + * order INTEGER + */ + if( ( ret = asn1_get_mpi( &p, end, &grp->N ) ) ) + return( POLARSSL_ERR_PK_KEY_INVALID_FORMAT + ret ); + + grp->nbits = mpi_msb( &grp->N ); + + /* + * Allow optional elements by purposefully not enforcing p == end here. + */ + + return( 0 ); +} + +/* + * Find the group id associated with an (almost filled) group as generated by + * pk_group_from_specified(), or return an error if unknown. + */ +static int pk_group_id_from_group( const ecp_group *grp, ecp_group_id *grp_id ) +{ + int ret; + ecp_group ref; + const ecp_group_id *id; + + ecp_group_init( &ref ); + + for( id = ecp_grp_id_list(); *id != POLARSSL_ECP_DP_NONE; id++ ) + { + /* Load the group associated to that id */ + ecp_group_free( &ref ); + MPI_CHK( ecp_use_known_dp( &ref, *id ) ); + + /* Compare to the group we were given, starting with easy tests */ + if( grp->pbits == ref.pbits && grp->nbits == ref.nbits && + mpi_cmp_mpi( &grp->P, &ref.P ) == 0 && + mpi_cmp_mpi( &grp->A, &ref.A ) == 0 && + mpi_cmp_mpi( &grp->B, &ref.B ) == 0 && + mpi_cmp_mpi( &grp->N, &ref.N ) == 0 && + mpi_cmp_mpi( &grp->G.X, &ref.G.X ) == 0 && + mpi_cmp_mpi( &grp->G.Z, &ref.G.Z ) == 0 && + /* For Y we may only know the parity bit, so compare only that */ + mpi_get_bit( &grp->G.Y, 0 ) == mpi_get_bit( &ref.G.Y, 0 ) ) + { + break; + } + + } + +cleanup: + ecp_group_free( &ref ); + + *grp_id = *id; + + if( ret == 0 && *id == POLARSSL_ECP_DP_NONE ) + ret = POLARSSL_ERR_ECP_FEATURE_UNAVAILABLE; + + return( ret ); +} + +/* + * Parse a SpecifiedECDomain (SEC 1 C.2) and find the associated group ID + */ +static int pk_group_id_from_specified( const asn1_buf *params, + ecp_group_id *grp_id ) +{ + int ret; + ecp_group grp; + + ecp_group_init( &grp ); + + if( ( ret = pk_group_from_specified( params, &grp ) ) != 0 ) + goto cleanup; + + ret = pk_group_id_from_group( &grp, grp_id ); + +cleanup: + ecp_group_free( &grp ); + + return( ret ); +} +#endif /* POLARSSL_PK_PARSE_EC_EXTENDED */ + /* * Use EC parameters to initialise an EC group + * + * ECParameters ::= CHOICE { + * namedCurve OBJECT IDENTIFIER + * specifiedCurve SpecifiedECDomain -- = SEQUENCE { ... } + * -- implicitCurve NULL */ static int pk_use_ecparams( const asn1_buf *params, ecp_group *grp ) { int ret; ecp_group_id grp_id; - if( oid_get_ec_grp( params, &grp_id ) != 0 ) - return( POLARSSL_ERR_PK_UNKNOWN_NAMED_CURVE ); + if( params->tag == ASN1_OID ) + { + if( oid_get_ec_grp( params, &grp_id ) != 0 ) + return( POLARSSL_ERR_PK_UNKNOWN_NAMED_CURVE ); + } + else + { +#if defined(POLARSSL_PK_PARSE_EC_EXTENDED) + if( ( ret = pk_group_id_from_specified( params, &grp_id ) ) != 0 ) + return( ret ); +#else + return( POLARSSL_ERR_PK_KEY_INVALID_FORMAT ); +#endif + } /* * grp may already be initilialized; if so, make sure IDs match @@ -201,6 +459,10 @@ static int pk_use_ecparams( const asn1_buf *params, ecp_group *grp ) /* * EC public key is an EC point + * + * The caller is responsible for clearing the structure upon failure if + * desired. Take care to pass along the possible ECP_FEATURE_UNAVAILABLE + * return code of ecp_point_read_binary() and leave p in a usable state. */ static int pk_get_ecpubkey( unsigned char **p, const unsigned char *end, ecp_keypair *key ) @@ -208,19 +470,17 @@ static int pk_get_ecpubkey( unsigned char **p, const unsigned char *end, int ret; if( ( ret = ecp_point_read_binary( &key->grp, &key->Q, - (const unsigned char *) *p, end - *p ) ) != 0 || - ( ret = ecp_check_pubkey( &key->grp, &key->Q ) ) != 0 ) + (const unsigned char *) *p, end - *p ) ) == 0 ) { - ecp_keypair_free( key ); - return( POLARSSL_ERR_PK_INVALID_PUBKEY ); + ret = ecp_check_pubkey( &key->grp, &key->Q ); } /* - * We know ecp_point_read_binary consumed all bytes + * We know ecp_point_read_binary consumed all bytes or failed */ *p = (unsigned char *) end; - return( 0 ); + return( ret ); } #endif /* POLARSSL_ECP_C */ @@ -451,7 +711,7 @@ static int pk_parse_key_sec1_der( ecp_keypair *eck, size_t keylen ) { int ret; - int version; + int version, pubkey_done; size_t len; asn1_buf params; unsigned char *p = (unsigned char *) key; @@ -513,8 +773,10 @@ static int pk_parse_key_sec1_der( ecp_keypair *eck, } /* - * Is 'publickey' present? If not, create it from the private key. + * Is 'publickey' present? If not, or if we can't read it (eg because it + * is compressed), create it from the private key. */ + pubkey_done = 0; if( ( ret = asn1_get_tag( &p, end, &len, ASN1_CONTEXT_SPECIFIC | ASN1_CONSTRUCTED | 1 ) ) == 0 ) { @@ -527,16 +789,27 @@ static int pk_parse_key_sec1_der( ecp_keypair *eck, return( POLARSSL_ERR_PK_KEY_INVALID_FORMAT + POLARSSL_ERR_ASN1_LENGTH_MISMATCH ); - if( ( ret = pk_get_ecpubkey( &p, end2, eck ) ) != 0 ) - return( ret ); + if( ( ret = pk_get_ecpubkey( &p, end2, eck ) ) == 0 ) + pubkey_done = 1; + else + { + /* + * The only acceptable failure mode of pk_get_ecpubkey() above + * is if the point format is not recognized. + */ + if( ret != POLARSSL_ERR_ECP_FEATURE_UNAVAILABLE ) + return( POLARSSL_ERR_PK_KEY_INVALID_FORMAT ); + } } else if ( ret != POLARSSL_ERR_ASN1_UNEXPECTED_TAG ) { ecp_keypair_free( eck ); return( POLARSSL_ERR_PK_KEY_INVALID_FORMAT + ret ); } - else if( ( ret = ecp_mul( &eck->grp, &eck->Q, &eck->d, &eck->grp.G, - NULL, NULL ) ) != 0 ) + + if( ! pubkey_done && + ( ret = ecp_mul( &eck->grp, &eck->Q, &eck->d, &eck->grp.G, + NULL, NULL ) ) != 0 ) { ecp_keypair_free( eck ); return( POLARSSL_ERR_PK_KEY_INVALID_FORMAT + ret ); diff --git a/tests/data_files/ec_prv.specdom.der b/tests/data_files/ec_prv.specdom.der new file mode 100644 index 000000000..a80a2e3ca Binary files /dev/null and b/tests/data_files/ec_prv.specdom.der differ diff --git a/tests/suites/test_suite_pkparse.data b/tests/suites/test_suite_pkparse.data index dc13fdbde..b502017b0 100644 --- a/tests/suites/test_suite_pkparse.data +++ b/tests/suites/test_suite_pkparse.data @@ -198,6 +198,10 @@ Parse EC Key #14 (SEC1 PEM, bp512r1) depends_on:POLARSSL_PEM_PARSE_C:POLARSSL_ECP_C:POLARSSL_ECP_DP_BP512R1_ENABLED pk_parse_keyfile_ec:"data_files/ec_bp512_prv.pem":"NULL":0 +Parse EC Key #15 (SEC1 DER, secp256k1, SpecifiedECDomain) +depends_on:POLARSSL_PEM_PARSE_C:POLARSSL_ECP_C:POLARSSL_ECP_DP_SECP256K1_ENABLED:POLARSSL_PK_PARSE_EC_EXTENDED +pk_parse_keyfile_ec:"data_files/ec_prv.specdom.der":"NULL":0 + Key ASN1 (Incorrect first tag) pk_parse_key_rsa:"":"":POLARSSL_ERR_PK_KEY_INVALID_FORMAT