1*0957b409SSimon J. Gerraty /* 2*0957b409SSimon J. Gerraty * Copyright (c) 2018 Thomas Pornin <pornin@bolet.org> 3*0957b409SSimon J. Gerraty * 4*0957b409SSimon J. Gerraty * Permission is hereby granted, free of charge, to any person obtaining 5*0957b409SSimon J. Gerraty * a copy of this software and associated documentation files (the 6*0957b409SSimon J. Gerraty * "Software"), to deal in the Software without restriction, including 7*0957b409SSimon J. Gerraty * without limitation the rights to use, copy, modify, merge, publish, 8*0957b409SSimon J. Gerraty * distribute, sublicense, and/or sell copies of the Software, and to 9*0957b409SSimon J. Gerraty * permit persons to whom the Software is furnished to do so, subject to 10*0957b409SSimon J. Gerraty * the following conditions: 11*0957b409SSimon J. Gerraty * 12*0957b409SSimon J. Gerraty * The above copyright notice and this permission notice shall be 13*0957b409SSimon J. Gerraty * included in all copies or substantial portions of the Software. 14*0957b409SSimon J. Gerraty * 15*0957b409SSimon J. Gerraty * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 16*0957b409SSimon J. Gerraty * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF 17*0957b409SSimon J. Gerraty * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 18*0957b409SSimon J. Gerraty * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS 19*0957b409SSimon J. Gerraty * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN 20*0957b409SSimon J. Gerraty * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN 21*0957b409SSimon J. Gerraty * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 22*0957b409SSimon J. Gerraty * SOFTWARE. 23*0957b409SSimon J. Gerraty */ 24*0957b409SSimon J. Gerraty 25*0957b409SSimon J. Gerraty #include "inner.h" 26*0957b409SSimon J. Gerraty 27*0957b409SSimon J. Gerraty /* see inner.h */ 28*0957b409SSimon J. Gerraty const unsigned char * 29*0957b409SSimon J. Gerraty br_get_curve_OID(int curve) 30*0957b409SSimon J. Gerraty { 31*0957b409SSimon J. Gerraty static const unsigned char OID_secp256r1[] = { 32*0957b409SSimon J. Gerraty 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07 33*0957b409SSimon J. Gerraty }; 34*0957b409SSimon J. Gerraty static const unsigned char OID_secp384r1[] = { 35*0957b409SSimon J. Gerraty 0x05, 0x2b, 0x81, 0x04, 0x00, 0x22 36*0957b409SSimon J. Gerraty }; 37*0957b409SSimon J. Gerraty static const unsigned char OID_secp521r1[] = { 38*0957b409SSimon J. Gerraty 0x05, 0x2b, 0x81, 0x04, 0x00, 0x23 39*0957b409SSimon J. Gerraty }; 40*0957b409SSimon J. Gerraty 41*0957b409SSimon J. Gerraty switch (curve) { 42*0957b409SSimon J. Gerraty case BR_EC_secp256r1: return OID_secp256r1; 43*0957b409SSimon J. Gerraty case BR_EC_secp384r1: return OID_secp384r1; 44*0957b409SSimon J. Gerraty case BR_EC_secp521r1: return OID_secp521r1; 45*0957b409SSimon J. Gerraty default: 46*0957b409SSimon J. Gerraty return NULL; 47*0957b409SSimon J. Gerraty } 48*0957b409SSimon J. Gerraty } 49*0957b409SSimon J. Gerraty 50*0957b409SSimon J. Gerraty /* see inner.h */ 51*0957b409SSimon J. Gerraty size_t 52*0957b409SSimon J. Gerraty br_encode_ec_raw_der_inner(void *dest, 53*0957b409SSimon J. Gerraty const br_ec_private_key *sk, const br_ec_public_key *pk, 54*0957b409SSimon J. Gerraty int include_curve_oid) 55*0957b409SSimon J. Gerraty { 56*0957b409SSimon J. Gerraty /* 57*0957b409SSimon J. Gerraty * ASN.1 format: 58*0957b409SSimon J. Gerraty * 59*0957b409SSimon J. Gerraty * ECPrivateKey ::= SEQUENCE { 60*0957b409SSimon J. Gerraty * version INTEGER { ecPrivkeyVer1(1) } (ecPrivkeyVer1), 61*0957b409SSimon J. Gerraty * privateKey OCTET STRING, 62*0957b409SSimon J. Gerraty * parameters [0] ECParameters {{ NamedCurve }} OPTIONAL, 63*0957b409SSimon J. Gerraty * publicKey [1] BIT STRING OPTIONAL 64*0957b409SSimon J. Gerraty * } 65*0957b409SSimon J. Gerraty * 66*0957b409SSimon J. Gerraty * The tages '[0]' and '[1]' are explicit. The 'ECParameters' 67*0957b409SSimon J. Gerraty * is a CHOICE; in our case, it will always be an OBJECT IDENTIFIER 68*0957b409SSimon J. Gerraty * that identifies the curve. 69*0957b409SSimon J. Gerraty * 70*0957b409SSimon J. Gerraty * The value of the 'privateKey' field is the raw unsigned big-endian 71*0957b409SSimon J. Gerraty * encoding of the private key (integer modulo the curve subgroup 72*0957b409SSimon J. Gerraty * order); there is no INTEGER tag, and the leading bit may be 1. 73*0957b409SSimon J. Gerraty * Also, leading bytes of value 0x00 are _not_ removed. 74*0957b409SSimon J. Gerraty * 75*0957b409SSimon J. Gerraty * The 'publicKey' contents are the raw encoded public key point, 76*0957b409SSimon J. Gerraty * normally uncompressed (leading byte of value 0x04, followed 77*0957b409SSimon J. Gerraty * by the unsigned big-endian encodings of the X and Y coordinates, 78*0957b409SSimon J. Gerraty * padded to the full field length if necessary). 79*0957b409SSimon J. Gerraty */ 80*0957b409SSimon J. Gerraty 81*0957b409SSimon J. Gerraty size_t len_version, len_privateKey, len_parameters, len_publicKey; 82*0957b409SSimon J. Gerraty size_t len_publicKey_bits, len_seq; 83*0957b409SSimon J. Gerraty const unsigned char *oid; 84*0957b409SSimon J. Gerraty 85*0957b409SSimon J. Gerraty if (include_curve_oid) { 86*0957b409SSimon J. Gerraty oid = br_get_curve_OID(sk->curve); 87*0957b409SSimon J. Gerraty if (oid == NULL) { 88*0957b409SSimon J. Gerraty return 0; 89*0957b409SSimon J. Gerraty } 90*0957b409SSimon J. Gerraty } else { 91*0957b409SSimon J. Gerraty oid = NULL; 92*0957b409SSimon J. Gerraty } 93*0957b409SSimon J. Gerraty len_version = 3; 94*0957b409SSimon J. Gerraty len_privateKey = 1 + len_of_len(sk->xlen) + sk->xlen; 95*0957b409SSimon J. Gerraty if (include_curve_oid) { 96*0957b409SSimon J. Gerraty len_parameters = 4 + oid[0]; 97*0957b409SSimon J. Gerraty } else { 98*0957b409SSimon J. Gerraty len_parameters = 0; 99*0957b409SSimon J. Gerraty } 100*0957b409SSimon J. Gerraty if (pk == NULL) { 101*0957b409SSimon J. Gerraty len_publicKey = 0; 102*0957b409SSimon J. Gerraty len_publicKey_bits = 0; 103*0957b409SSimon J. Gerraty } else { 104*0957b409SSimon J. Gerraty len_publicKey_bits = 2 + len_of_len(pk->qlen) + pk->qlen; 105*0957b409SSimon J. Gerraty len_publicKey = 1 + len_of_len(len_publicKey_bits) 106*0957b409SSimon J. Gerraty + len_publicKey_bits; 107*0957b409SSimon J. Gerraty } 108*0957b409SSimon J. Gerraty len_seq = len_version + len_privateKey + len_parameters + len_publicKey; 109*0957b409SSimon J. Gerraty if (dest == NULL) { 110*0957b409SSimon J. Gerraty return 1 + len_of_len(len_seq) + len_seq; 111*0957b409SSimon J. Gerraty } else { 112*0957b409SSimon J. Gerraty unsigned char *buf; 113*0957b409SSimon J. Gerraty size_t lenlen; 114*0957b409SSimon J. Gerraty 115*0957b409SSimon J. Gerraty buf = dest; 116*0957b409SSimon J. Gerraty *buf ++ = 0x30; /* SEQUENCE tag */ 117*0957b409SSimon J. Gerraty lenlen = br_asn1_encode_length(buf, len_seq); 118*0957b409SSimon J. Gerraty buf += lenlen; 119*0957b409SSimon J. Gerraty 120*0957b409SSimon J. Gerraty /* version */ 121*0957b409SSimon J. Gerraty *buf ++ = 0x02; 122*0957b409SSimon J. Gerraty *buf ++ = 0x01; 123*0957b409SSimon J. Gerraty *buf ++ = 0x01; 124*0957b409SSimon J. Gerraty 125*0957b409SSimon J. Gerraty /* privateKey */ 126*0957b409SSimon J. Gerraty *buf ++ = 0x04; 127*0957b409SSimon J. Gerraty buf += br_asn1_encode_length(buf, sk->xlen); 128*0957b409SSimon J. Gerraty memcpy(buf, sk->x, sk->xlen); 129*0957b409SSimon J. Gerraty buf += sk->xlen; 130*0957b409SSimon J. Gerraty 131*0957b409SSimon J. Gerraty /* parameters */ 132*0957b409SSimon J. Gerraty if (include_curve_oid) { 133*0957b409SSimon J. Gerraty *buf ++ = 0xA0; 134*0957b409SSimon J. Gerraty *buf ++ = oid[0] + 2; 135*0957b409SSimon J. Gerraty *buf ++ = 0x06; 136*0957b409SSimon J. Gerraty memcpy(buf, oid, oid[0] + 1); 137*0957b409SSimon J. Gerraty buf += oid[0] + 1; 138*0957b409SSimon J. Gerraty } 139*0957b409SSimon J. Gerraty 140*0957b409SSimon J. Gerraty /* publicKey */ 141*0957b409SSimon J. Gerraty if (pk != NULL) { 142*0957b409SSimon J. Gerraty *buf ++ = 0xA1; 143*0957b409SSimon J. Gerraty buf += br_asn1_encode_length(buf, len_publicKey_bits); 144*0957b409SSimon J. Gerraty *buf ++ = 0x03; 145*0957b409SSimon J. Gerraty buf += br_asn1_encode_length(buf, pk->qlen + 1); 146*0957b409SSimon J. Gerraty *buf ++ = 0x00; 147*0957b409SSimon J. Gerraty memcpy(buf, pk->q, pk->qlen); 148*0957b409SSimon J. Gerraty /* buf += pk->qlen; */ 149*0957b409SSimon J. Gerraty } 150*0957b409SSimon J. Gerraty 151*0957b409SSimon J. Gerraty return 1 + lenlen + len_seq; 152*0957b409SSimon J. Gerraty } 153*0957b409SSimon J. Gerraty } 154*0957b409SSimon J. Gerraty 155*0957b409SSimon J. Gerraty /* see bearssl_x509.h */ 156*0957b409SSimon J. Gerraty size_t 157*0957b409SSimon J. Gerraty br_encode_ec_raw_der(void *dest, 158*0957b409SSimon J. Gerraty const br_ec_private_key *sk, const br_ec_public_key *pk) 159*0957b409SSimon J. Gerraty { 160*0957b409SSimon J. Gerraty return br_encode_ec_raw_der_inner(dest, sk, pk, 1); 161*0957b409SSimon J. Gerraty } 162