xref: /freebsd/crypto/heimdal/lib/hx509/crypto.c (revision 884a2a699669ec61e2366e3e358342dbc94be24a)
1 /*
2  * Copyright (c) 2004 - 2007 Kungliga Tekniska H�gskolan
3  * (Royal Institute of Technology, Stockholm, Sweden).
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  *
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  *
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * 3. Neither the name of the Institute nor the names of its contributors
18  *    may be used to endorse or promote products derived from this software
19  *    without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  */
33 
34 #include "hx_locl.h"
35 RCSID("$Id: crypto.c 22435 2008-01-14 20:53:56Z lha $");
36 
37 struct hx509_crypto;
38 
39 struct signature_alg;
40 
41 enum crypto_op_type {
42     COT_SIGN
43 };
44 
45 struct hx509_generate_private_context {
46     const heim_oid *key_oid;
47     int isCA;
48     unsigned long num_bits;
49 };
50 
51 struct hx509_private_key_ops {
52     const char *pemtype;
53     const heim_oid *(*key_oid)(void);
54     int (*get_spki)(hx509_context,
55 		    const hx509_private_key,
56 		    SubjectPublicKeyInfo *);
57     int (*export)(hx509_context context,
58 		  const hx509_private_key,
59 		  heim_octet_string *);
60     int (*import)(hx509_context,
61 		  const void *data,
62 		  size_t len,
63 		  hx509_private_key private_key);
64     int (*generate_private_key)(hx509_context,
65 				struct hx509_generate_private_context *,
66 				hx509_private_key);
67     BIGNUM *(*get_internal)(hx509_context, hx509_private_key, const char *);
68     int (*handle_alg)(const hx509_private_key,
69 		      const AlgorithmIdentifier *,
70 		      enum crypto_op_type);
71     int (*sign)(hx509_context context,
72 		const hx509_private_key,
73 		const AlgorithmIdentifier *,
74 		const heim_octet_string *,
75 		AlgorithmIdentifier *,
76 		heim_octet_string *);
77 #if 0
78     const AlgorithmIdentifier *(*preferred_sig_alg)
79 	(const hx509_private_key,
80 	 const hx509_peer_info);
81     int (*unwrap)(hx509_context context,
82 		  const hx509_private_key,
83 		  const AlgorithmIdentifier *,
84 		  const heim_octet_string *,
85 		  heim_octet_string *);
86 #endif
87 };
88 
89 struct hx509_private_key {
90     unsigned int ref;
91     const struct signature_alg *md;
92     const heim_oid *signature_alg;
93     union {
94 	RSA *rsa;
95 	void *keydata;
96     } private_key;
97     /* new crypto layer */
98     hx509_private_key_ops *ops;
99 };
100 
101 /*
102  *
103  */
104 
105 struct signature_alg {
106     const char *name;
107     const heim_oid *(*sig_oid)(void);
108     const AlgorithmIdentifier *(*sig_alg)(void);
109     const heim_oid *(*key_oid)(void);
110     const heim_oid *(*digest_oid)(void);
111     int flags;
112 #define PROVIDE_CONF 1
113 #define REQUIRE_SIGNER 2
114 
115 #define SIG_DIGEST	0x100
116 #define SIG_PUBLIC_SIG	0x200
117 #define SIG_SECRET	0x400
118 
119 #define RA_RSA_USES_DIGEST_INFO 0x1000000
120 
121 
122     int (*verify_signature)(hx509_context context,
123 			    const struct signature_alg *,
124 			    const Certificate *,
125 			    const AlgorithmIdentifier *,
126 			    const heim_octet_string *,
127 			    const heim_octet_string *);
128     int (*create_signature)(hx509_context,
129 			    const struct signature_alg *,
130 			    const hx509_private_key,
131 			    const AlgorithmIdentifier *,
132 			    const heim_octet_string *,
133 			    AlgorithmIdentifier *,
134 			    heim_octet_string *);
135 };
136 
137 /*
138  *
139  */
140 
141 static BIGNUM *
142 heim_int2BN(const heim_integer *i)
143 {
144     BIGNUM *bn;
145 
146     bn = BN_bin2bn(i->data, i->length, NULL);
147     BN_set_negative(bn, i->negative);
148     return bn;
149 }
150 
151 /*
152  *
153  */
154 
155 static int
156 set_digest_alg(DigestAlgorithmIdentifier *id,
157 	       const heim_oid *oid,
158 	       const void *param, size_t length)
159 {
160     int ret;
161     if (param) {
162 	id->parameters = malloc(sizeof(*id->parameters));
163 	if (id->parameters == NULL)
164 	    return ENOMEM;
165 	id->parameters->data = malloc(length);
166 	if (id->parameters->data == NULL) {
167 	    free(id->parameters);
168 	    id->parameters = NULL;
169 	    return ENOMEM;
170 	}
171 	memcpy(id->parameters->data, param, length);
172 	id->parameters->length = length;
173     } else
174 	id->parameters = NULL;
175     ret = der_copy_oid(oid, &id->algorithm);
176     if (ret) {
177 	if (id->parameters) {
178 	    free(id->parameters->data);
179 	    free(id->parameters);
180 	    id->parameters = NULL;
181 	}
182 	return ret;
183     }
184     return 0;
185 }
186 
187 /*
188  *
189  */
190 
191 static int
192 rsa_verify_signature(hx509_context context,
193 		     const struct signature_alg *sig_alg,
194 		     const Certificate *signer,
195 		     const AlgorithmIdentifier *alg,
196 		     const heim_octet_string *data,
197 		     const heim_octet_string *sig)
198 {
199     const SubjectPublicKeyInfo *spi;
200     DigestInfo di;
201     unsigned char *to;
202     int tosize, retsize;
203     int ret;
204     RSA *rsa;
205     RSAPublicKey pk;
206     size_t size;
207 
208     memset(&di, 0, sizeof(di));
209 
210     spi = &signer->tbsCertificate.subjectPublicKeyInfo;
211 
212     rsa = RSA_new();
213     if (rsa == NULL) {
214 	hx509_set_error_string(context, 0, ENOMEM, "out of memory");
215 	return ENOMEM;
216     }
217     ret = decode_RSAPublicKey(spi->subjectPublicKey.data,
218 			      spi->subjectPublicKey.length / 8,
219 			      &pk, &size);
220     if (ret) {
221 	hx509_set_error_string(context, 0, ret, "Failed to decode RSAPublicKey");
222 	goto out;
223     }
224 
225     rsa->n = heim_int2BN(&pk.modulus);
226     rsa->e = heim_int2BN(&pk.publicExponent);
227 
228     free_RSAPublicKey(&pk);
229 
230     if (rsa->n == NULL || rsa->e == NULL) {
231 	ret = ENOMEM;
232 	hx509_set_error_string(context, 0, ret, "out of memory");
233 	goto out;
234     }
235 
236     tosize = RSA_size(rsa);
237     to = malloc(tosize);
238     if (to == NULL) {
239 	ret = ENOMEM;
240 	hx509_set_error_string(context, 0, ret, "out of memory");
241 	goto out;
242     }
243 
244     retsize = RSA_public_decrypt(sig->length, (unsigned char *)sig->data,
245 				 to, rsa, RSA_PKCS1_PADDING);
246     if (retsize <= 0) {
247 	ret = HX509_CRYPTO_SIG_INVALID_FORMAT;
248 	hx509_set_error_string(context, 0, ret,
249 			       "RSA public decrypt failed: %d", retsize);
250 	free(to);
251 	goto out;
252     }
253     if (retsize > tosize)
254 	_hx509_abort("internal rsa decryption failure: ret > tosize");
255 
256     if (sig_alg->flags & RA_RSA_USES_DIGEST_INFO) {
257 
258 	ret = decode_DigestInfo(to, retsize, &di, &size);
259 	free(to);
260 	if (ret) {
261 	    goto out;
262 	}
263 
264 	/* Check for extra data inside the sigature */
265 	if (size != retsize) {
266 	    ret = HX509_CRYPTO_SIG_INVALID_FORMAT;
267 	    hx509_set_error_string(context, 0, ret, "size from decryption mismatch");
268 	    goto out;
269 	}
270 
271 	if (sig_alg->digest_oid &&
272 	    der_heim_oid_cmp(&di.digestAlgorithm.algorithm,
273 			     (*sig_alg->digest_oid)()) != 0)
274 	{
275 	    ret = HX509_CRYPTO_OID_MISMATCH;
276 	    hx509_set_error_string(context, 0, ret, "object identifier in RSA sig mismatch");
277 	    goto out;
278 	}
279 
280 	/* verify that the parameters are NULL or the NULL-type */
281 	if (di.digestAlgorithm.parameters != NULL &&
282 	    (di.digestAlgorithm.parameters->length != 2 ||
283 	     memcmp(di.digestAlgorithm.parameters->data, "\x05\x00", 2) != 0))
284 	{
285 	    ret = HX509_CRYPTO_SIG_INVALID_FORMAT;
286 	    hx509_set_error_string(context, 0, ret, "Extra parameters inside RSA signature");
287 	    goto out;
288 	}
289 
290 	ret = _hx509_verify_signature(context,
291 				      NULL,
292 				      &di.digestAlgorithm,
293 				      data,
294 				      &di.digest);
295     } else {
296 	if (retsize != data->length ||
297 	    memcmp(to, data->data, retsize) != 0)
298 	{
299 	    ret = HX509_CRYPTO_SIG_INVALID_FORMAT;
300 	    hx509_set_error_string(context, 0, ret, "RSA Signature incorrect");
301 	    goto out;
302 	}
303 	free(to);
304     }
305 
306  out:
307     free_DigestInfo(&di);
308     RSA_free(rsa);
309     return ret;
310 }
311 
312 static int
313 rsa_create_signature(hx509_context context,
314 		     const struct signature_alg *sig_alg,
315 		     const hx509_private_key signer,
316 		     const AlgorithmIdentifier *alg,
317 		     const heim_octet_string *data,
318 		     AlgorithmIdentifier *signatureAlgorithm,
319 		     heim_octet_string *sig)
320 {
321     const AlgorithmIdentifier *digest_alg;
322     heim_octet_string indata;
323     const heim_oid *sig_oid;
324     size_t size;
325     int ret;
326 
327     if (alg)
328 	sig_oid = &alg->algorithm;
329     else
330 	sig_oid = signer->signature_alg;
331 
332     if (der_heim_oid_cmp(sig_oid, oid_id_pkcs1_sha256WithRSAEncryption()) == 0) {
333 	digest_alg = hx509_signature_sha256();
334     } else if (der_heim_oid_cmp(sig_oid, oid_id_pkcs1_sha1WithRSAEncryption()) == 0) {
335 	digest_alg = hx509_signature_sha1();
336     } else if (der_heim_oid_cmp(sig_oid, oid_id_pkcs1_md5WithRSAEncryption()) == 0) {
337 	digest_alg = hx509_signature_md5();
338     } else if (der_heim_oid_cmp(sig_oid, oid_id_pkcs1_md5WithRSAEncryption()) == 0) {
339 	digest_alg = hx509_signature_md5();
340     } else if (der_heim_oid_cmp(sig_oid, oid_id_dsa_with_sha1()) == 0) {
341 	digest_alg = hx509_signature_sha1();
342     } else if (der_heim_oid_cmp(sig_oid, oid_id_pkcs1_rsaEncryption()) == 0) {
343 	digest_alg = hx509_signature_sha1();
344     } else if (der_heim_oid_cmp(sig_oid, oid_id_heim_rsa_pkcs1_x509()) == 0) {
345 	digest_alg = NULL;
346     } else
347 	return HX509_ALG_NOT_SUPP;
348 
349     if (signatureAlgorithm) {
350 	ret = set_digest_alg(signatureAlgorithm, sig_oid, "\x05\x00", 2);
351 	if (ret) {
352 	    hx509_clear_error_string(context);
353 	    return ret;
354 	}
355     }
356 
357     if (digest_alg) {
358 	DigestInfo di;
359 	memset(&di, 0, sizeof(di));
360 
361 	ret = _hx509_create_signature(context,
362 				      NULL,
363 				      digest_alg,
364 				      data,
365 				      &di.digestAlgorithm,
366 				      &di.digest);
367 	if (ret)
368 	    return ret;
369 	ASN1_MALLOC_ENCODE(DigestInfo,
370 			   indata.data,
371 			   indata.length,
372 			   &di,
373 			   &size,
374 			   ret);
375 	free_DigestInfo(&di);
376 	if (ret) {
377 	    hx509_set_error_string(context, 0, ret, "out of memory");
378 	    return ret;
379 	}
380 	if (indata.length != size)
381 	    _hx509_abort("internal ASN.1 encoder error");
382     } else {
383 	indata = *data;
384     }
385 
386     sig->length = RSA_size(signer->private_key.rsa);
387     sig->data = malloc(sig->length);
388     if (sig->data == NULL) {
389 	der_free_octet_string(&indata);
390 	hx509_set_error_string(context, 0, ENOMEM, "out of memory");
391 	return ENOMEM;
392     }
393 
394     ret = RSA_private_encrypt(indata.length, indata.data,
395 			      sig->data,
396 			      signer->private_key.rsa,
397 			      RSA_PKCS1_PADDING);
398     if (indata.data != data->data)
399 	der_free_octet_string(&indata);
400     if (ret <= 0) {
401 	ret = HX509_CMS_FAILED_CREATE_SIGATURE;
402 	hx509_set_error_string(context, 0, ret,
403 			       "RSA private decrypt failed: %d", ret);
404 	return ret;
405     }
406     if (ret > sig->length)
407 	_hx509_abort("RSA signature prelen longer the output len");
408 
409     sig->length = ret;
410 
411     return 0;
412 }
413 
414 static int
415 rsa_private_key_import(hx509_context context,
416 		       const void *data,
417 		       size_t len,
418 		       hx509_private_key private_key)
419 {
420     const unsigned char *p = data;
421 
422     private_key->private_key.rsa =
423 	d2i_RSAPrivateKey(NULL, &p, len);
424     if (private_key->private_key.rsa == NULL) {
425 	hx509_set_error_string(context, 0, HX509_PARSING_KEY_FAILED,
426 			       "Failed to parse RSA key");
427 	return HX509_PARSING_KEY_FAILED;
428     }
429     private_key->signature_alg = oid_id_pkcs1_sha1WithRSAEncryption();
430 
431     return 0;
432 }
433 
434 static int
435 rsa_private_key2SPKI(hx509_context context,
436 		     hx509_private_key private_key,
437 		     SubjectPublicKeyInfo *spki)
438 {
439     int len, ret;
440 
441     memset(spki, 0, sizeof(*spki));
442 
443     len = i2d_RSAPublicKey(private_key->private_key.rsa, NULL);
444 
445     spki->subjectPublicKey.data = malloc(len);
446     if (spki->subjectPublicKey.data == NULL) {
447 	hx509_set_error_string(context, 0, ENOMEM, "malloc - out of memory");
448 	return ENOMEM;
449     }
450     spki->subjectPublicKey.length = len * 8;
451 
452     ret = set_digest_alg(&spki->algorithm,oid_id_pkcs1_rsaEncryption(),
453 			 "\x05\x00", 2);
454     if (ret) {
455 	hx509_set_error_string(context, 0, ret, "malloc - out of memory");
456 	free(spki->subjectPublicKey.data);
457 	spki->subjectPublicKey.data = NULL;
458 	spki->subjectPublicKey.length = 0;
459 	return ret;
460     }
461 
462     {
463 	unsigned char *pp = spki->subjectPublicKey.data;
464 	i2d_RSAPublicKey(private_key->private_key.rsa, &pp);
465     }
466 
467     return 0;
468 }
469 
470 static int
471 rsa_generate_private_key(hx509_context context,
472 			 struct hx509_generate_private_context *ctx,
473 			 hx509_private_key private_key)
474 {
475     BIGNUM *e;
476     int ret;
477     unsigned long bits;
478 
479     static const int default_rsa_e = 65537;
480     static const int default_rsa_bits = 1024;
481 
482     private_key->private_key.rsa = RSA_new();
483     if (private_key->private_key.rsa == NULL) {
484 	hx509_set_error_string(context, 0, HX509_PARSING_KEY_FAILED,
485 			       "Failed to generate RSA key");
486 	return HX509_PARSING_KEY_FAILED;
487     }
488 
489     e = BN_new();
490     BN_set_word(e, default_rsa_e);
491 
492     bits = default_rsa_bits;
493 
494     if (ctx->num_bits)
495 	bits = ctx->num_bits;
496     else if (ctx->isCA)
497 	bits *= 2;
498 
499     ret = RSA_generate_key_ex(private_key->private_key.rsa, bits, e, NULL);
500     BN_free(e);
501     if (ret != 1) {
502 	hx509_set_error_string(context, 0, HX509_PARSING_KEY_FAILED,
503 			       "Failed to generate RSA key");
504 	return HX509_PARSING_KEY_FAILED;
505     }
506     private_key->signature_alg = oid_id_pkcs1_sha1WithRSAEncryption();
507 
508     return 0;
509 }
510 
511 static int
512 rsa_private_key_export(hx509_context context,
513 		       const hx509_private_key key,
514 		       heim_octet_string *data)
515 {
516     int ret;
517 
518     data->data = NULL;
519     data->length = 0;
520 
521     ret = i2d_RSAPrivateKey(key->private_key.rsa, NULL);
522     if (ret <= 0) {
523 	ret = EINVAL;
524 	hx509_set_error_string(context, 0, ret,
525 			       "Private key is not exportable");
526 	return ret;
527     }
528 
529     data->data = malloc(ret);
530     if (data->data == NULL) {
531 	ret = ENOMEM;
532 	hx509_set_error_string(context, 0, ret, "malloc out of memory");
533 	return ret;
534     }
535     data->length = ret;
536 
537     {
538 	unsigned char *p = data->data;
539 	i2d_RSAPrivateKey(key->private_key.rsa, &p);
540     }
541 
542     return 0;
543 }
544 
545 static BIGNUM *
546 rsa_get_internal(hx509_context context, hx509_private_key key, const char *type)
547 {
548     if (strcasecmp(type, "rsa-modulus") == 0) {
549 	return BN_dup(key->private_key.rsa->n);
550     } else if (strcasecmp(type, "rsa-exponent") == 0) {
551 	return BN_dup(key->private_key.rsa->e);
552     } else
553 	return NULL;
554 }
555 
556 
557 
558 static hx509_private_key_ops rsa_private_key_ops = {
559     "RSA PRIVATE KEY",
560     oid_id_pkcs1_rsaEncryption,
561     rsa_private_key2SPKI,
562     rsa_private_key_export,
563     rsa_private_key_import,
564     rsa_generate_private_key,
565     rsa_get_internal
566 };
567 
568 
569 /*
570  *
571  */
572 
573 static int
574 dsa_verify_signature(hx509_context context,
575 		     const struct signature_alg *sig_alg,
576 		     const Certificate *signer,
577 		     const AlgorithmIdentifier *alg,
578 		     const heim_octet_string *data,
579 		     const heim_octet_string *sig)
580 {
581     const SubjectPublicKeyInfo *spi;
582     DSAPublicKey pk;
583     DSAParams param;
584     size_t size;
585     DSA *dsa;
586     int ret;
587 
588     spi = &signer->tbsCertificate.subjectPublicKeyInfo;
589 
590     dsa = DSA_new();
591     if (dsa == NULL) {
592 	hx509_set_error_string(context, 0, ENOMEM, "out of memory");
593 	return ENOMEM;
594     }
595 
596     ret = decode_DSAPublicKey(spi->subjectPublicKey.data,
597 			      spi->subjectPublicKey.length / 8,
598 			      &pk, &size);
599     if (ret)
600 	goto out;
601 
602     dsa->pub_key = heim_int2BN(&pk);
603 
604     free_DSAPublicKey(&pk);
605 
606     if (dsa->pub_key == NULL) {
607 	ret = ENOMEM;
608 	hx509_set_error_string(context, 0, ret, "out of memory");
609 	goto out;
610     }
611 
612     if (spi->algorithm.parameters == NULL) {
613 	ret = HX509_CRYPTO_SIG_INVALID_FORMAT;
614 	hx509_set_error_string(context, 0, ret, "DSA parameters missing");
615 	goto out;
616     }
617 
618     ret = decode_DSAParams(spi->algorithm.parameters->data,
619 			   spi->algorithm.parameters->length,
620 			   &param,
621 			   &size);
622     if (ret) {
623 	hx509_set_error_string(context, 0, ret, "DSA parameters failed to decode");
624 	goto out;
625     }
626 
627     dsa->p = heim_int2BN(&param.p);
628     dsa->q = heim_int2BN(&param.q);
629     dsa->g = heim_int2BN(&param.g);
630 
631     free_DSAParams(&param);
632 
633     if (dsa->p == NULL || dsa->q == NULL || dsa->g == NULL) {
634 	ret = ENOMEM;
635 	hx509_set_error_string(context, 0, ret, "out of memory");
636 	goto out;
637     }
638 
639     ret = DSA_verify(-1, data->data, data->length,
640 		     (unsigned char*)sig->data, sig->length,
641 		     dsa);
642     if (ret == 1)
643 	ret = 0;
644     else if (ret == 0 || ret == -1) {
645 	ret = HX509_CRYPTO_BAD_SIGNATURE;
646 	hx509_set_error_string(context, 0, ret, "BAD DSA sigature");
647     } else {
648 	ret = HX509_CRYPTO_SIG_INVALID_FORMAT;
649 	hx509_set_error_string(context, 0, ret, "Invalid format of DSA sigature");
650     }
651 
652  out:
653     DSA_free(dsa);
654 
655     return ret;
656 }
657 
658 #if 0
659 static int
660 dsa_parse_private_key(hx509_context context,
661 		      const void *data,
662 		      size_t len,
663 		      hx509_private_key private_key)
664 {
665     const unsigned char *p = data;
666 
667     private_key->private_key.dsa =
668 	d2i_DSAPrivateKey(NULL, &p, len);
669     if (private_key->private_key.dsa == NULL)
670 	return EINVAL;
671     private_key->signature_alg = oid_id_dsa_with_sha1();
672 
673     return 0;
674 /* else */
675     hx509_set_error_string(context, 0, HX509_PARSING_KEY_FAILED,
676 			   "No support to parse DSA keys");
677     return HX509_PARSING_KEY_FAILED;
678 }
679 #endif
680 
681 
682 static int
683 sha1_verify_signature(hx509_context context,
684 		      const struct signature_alg *sig_alg,
685 		      const Certificate *signer,
686 		      const AlgorithmIdentifier *alg,
687 		      const heim_octet_string *data,
688 		      const heim_octet_string *sig)
689 {
690     unsigned char digest[SHA_DIGEST_LENGTH];
691     SHA_CTX m;
692 
693     if (sig->length != SHA_DIGEST_LENGTH) {
694 	hx509_set_error_string(context, 0, HX509_CRYPTO_SIG_INVALID_FORMAT,
695 			       "SHA1 sigature have wrong length");
696 	return HX509_CRYPTO_SIG_INVALID_FORMAT;
697     }
698 
699     SHA1_Init(&m);
700     SHA1_Update(&m, data->data, data->length);
701     SHA1_Final (digest, &m);
702 
703     if (memcmp(digest, sig->data, SHA_DIGEST_LENGTH) != 0) {
704 	hx509_set_error_string(context, 0, HX509_CRYPTO_BAD_SIGNATURE,
705 			       "Bad SHA1 sigature");
706 	return HX509_CRYPTO_BAD_SIGNATURE;
707     }
708 
709     return 0;
710 }
711 
712 static int
713 sha256_create_signature(hx509_context context,
714 			const struct signature_alg *sig_alg,
715 			const hx509_private_key signer,
716 			const AlgorithmIdentifier *alg,
717 			const heim_octet_string *data,
718 			AlgorithmIdentifier *signatureAlgorithm,
719 			heim_octet_string *sig)
720 {
721     SHA256_CTX m;
722 
723     memset(sig, 0, sizeof(*sig));
724 
725     if (signatureAlgorithm) {
726 	int ret;
727 	ret = set_digest_alg(signatureAlgorithm, (*sig_alg->sig_oid)(),
728 			     "\x05\x00", 2);
729 	if (ret)
730 	    return ret;
731     }
732 
733 
734     sig->data = malloc(SHA256_DIGEST_LENGTH);
735     if (sig->data == NULL) {
736 	sig->length = 0;
737 	return ENOMEM;
738     }
739     sig->length = SHA256_DIGEST_LENGTH;
740 
741     SHA256_Init(&m);
742     SHA256_Update(&m, data->data, data->length);
743     SHA256_Final (sig->data, &m);
744 
745     return 0;
746 }
747 
748 static int
749 sha256_verify_signature(hx509_context context,
750 			const struct signature_alg *sig_alg,
751 			const Certificate *signer,
752 			const AlgorithmIdentifier *alg,
753 			const heim_octet_string *data,
754 			const heim_octet_string *sig)
755 {
756     unsigned char digest[SHA256_DIGEST_LENGTH];
757     SHA256_CTX m;
758 
759     if (sig->length != SHA256_DIGEST_LENGTH) {
760 	hx509_set_error_string(context, 0, HX509_CRYPTO_SIG_INVALID_FORMAT,
761 			       "SHA256 sigature have wrong length");
762 	return HX509_CRYPTO_SIG_INVALID_FORMAT;
763     }
764 
765     SHA256_Init(&m);
766     SHA256_Update(&m, data->data, data->length);
767     SHA256_Final (digest, &m);
768 
769     if (memcmp(digest, sig->data, SHA256_DIGEST_LENGTH) != 0) {
770 	hx509_set_error_string(context, 0, HX509_CRYPTO_BAD_SIGNATURE,
771 			       "Bad SHA256 sigature");
772 	return HX509_CRYPTO_BAD_SIGNATURE;
773     }
774 
775     return 0;
776 }
777 
778 static int
779 sha1_create_signature(hx509_context context,
780 		      const struct signature_alg *sig_alg,
781 		      const hx509_private_key signer,
782 		      const AlgorithmIdentifier *alg,
783 		      const heim_octet_string *data,
784 		      AlgorithmIdentifier *signatureAlgorithm,
785 		      heim_octet_string *sig)
786 {
787     SHA_CTX m;
788 
789     memset(sig, 0, sizeof(*sig));
790 
791     if (signatureAlgorithm) {
792 	int ret;
793 	ret = set_digest_alg(signatureAlgorithm, (*sig_alg->sig_oid)(),
794 			     "\x05\x00", 2);
795 	if (ret)
796 	    return ret;
797     }
798 
799 
800     sig->data = malloc(SHA_DIGEST_LENGTH);
801     if (sig->data == NULL) {
802 	sig->length = 0;
803 	return ENOMEM;
804     }
805     sig->length = SHA_DIGEST_LENGTH;
806 
807     SHA1_Init(&m);
808     SHA1_Update(&m, data->data, data->length);
809     SHA1_Final (sig->data, &m);
810 
811     return 0;
812 }
813 
814 static int
815 md5_verify_signature(hx509_context context,
816 		     const struct signature_alg *sig_alg,
817 		     const Certificate *signer,
818 		     const AlgorithmIdentifier *alg,
819 		     const heim_octet_string *data,
820 		     const heim_octet_string *sig)
821 {
822     unsigned char digest[MD5_DIGEST_LENGTH];
823     MD5_CTX m;
824 
825     if (sig->length != MD5_DIGEST_LENGTH) {
826 	hx509_set_error_string(context, 0, HX509_CRYPTO_SIG_INVALID_FORMAT,
827 			       "MD5 sigature have wrong length");
828 	return HX509_CRYPTO_SIG_INVALID_FORMAT;
829     }
830 
831     MD5_Init(&m);
832     MD5_Update(&m, data->data, data->length);
833     MD5_Final (digest, &m);
834 
835     if (memcmp(digest, sig->data, MD5_DIGEST_LENGTH) != 0) {
836 	hx509_set_error_string(context, 0, HX509_CRYPTO_BAD_SIGNATURE,
837 			       "Bad MD5 sigature");
838 	return HX509_CRYPTO_BAD_SIGNATURE;
839     }
840 
841     return 0;
842 }
843 
844 static int
845 md2_verify_signature(hx509_context context,
846 		     const struct signature_alg *sig_alg,
847 		     const Certificate *signer,
848 		     const AlgorithmIdentifier *alg,
849 		     const heim_octet_string *data,
850 		     const heim_octet_string *sig)
851 {
852     unsigned char digest[MD2_DIGEST_LENGTH];
853     MD2_CTX m;
854 
855     if (sig->length != MD2_DIGEST_LENGTH) {
856 	hx509_set_error_string(context, 0, HX509_CRYPTO_SIG_INVALID_FORMAT,
857 			       "MD2 sigature have wrong length");
858 	return HX509_CRYPTO_SIG_INVALID_FORMAT;
859     }
860 
861     MD2_Init(&m);
862     MD2_Update(&m, data->data, data->length);
863     MD2_Final (digest, &m);
864 
865     if (memcmp(digest, sig->data, MD2_DIGEST_LENGTH) != 0) {
866 	hx509_set_error_string(context, 0, HX509_CRYPTO_BAD_SIGNATURE,
867 			       "Bad MD2 sigature");
868 	return HX509_CRYPTO_BAD_SIGNATURE;
869     }
870 
871     return 0;
872 }
873 
874 static const struct signature_alg heim_rsa_pkcs1_x509 = {
875     "rsa-pkcs1-x509",
876     oid_id_heim_rsa_pkcs1_x509,
877     hx509_signature_rsa_pkcs1_x509,
878     oid_id_pkcs1_rsaEncryption,
879     NULL,
880     PROVIDE_CONF|REQUIRE_SIGNER|SIG_PUBLIC_SIG,
881     rsa_verify_signature,
882     rsa_create_signature
883 };
884 
885 static const struct signature_alg pkcs1_rsa_sha1_alg = {
886     "rsa",
887     oid_id_pkcs1_rsaEncryption,
888     hx509_signature_rsa_with_sha1,
889     oid_id_pkcs1_rsaEncryption,
890     NULL,
891     PROVIDE_CONF|REQUIRE_SIGNER|RA_RSA_USES_DIGEST_INFO|SIG_PUBLIC_SIG,
892     rsa_verify_signature,
893     rsa_create_signature
894 };
895 
896 static const struct signature_alg rsa_with_sha256_alg = {
897     "rsa-with-sha256",
898     oid_id_pkcs1_sha256WithRSAEncryption,
899     hx509_signature_rsa_with_sha256,
900     oid_id_pkcs1_rsaEncryption,
901     oid_id_sha256,
902     PROVIDE_CONF|REQUIRE_SIGNER|RA_RSA_USES_DIGEST_INFO|SIG_PUBLIC_SIG,
903     rsa_verify_signature,
904     rsa_create_signature
905 };
906 
907 static const struct signature_alg rsa_with_sha1_alg = {
908     "rsa-with-sha1",
909     oid_id_pkcs1_sha1WithRSAEncryption,
910     hx509_signature_rsa_with_sha1,
911     oid_id_pkcs1_rsaEncryption,
912     oid_id_secsig_sha_1,
913     PROVIDE_CONF|REQUIRE_SIGNER|RA_RSA_USES_DIGEST_INFO|SIG_PUBLIC_SIG,
914     rsa_verify_signature,
915     rsa_create_signature
916 };
917 
918 static const struct signature_alg rsa_with_md5_alg = {
919     "rsa-with-md5",
920     oid_id_pkcs1_md5WithRSAEncryption,
921     hx509_signature_rsa_with_md5,
922     oid_id_pkcs1_rsaEncryption,
923     oid_id_rsa_digest_md5,
924     PROVIDE_CONF|REQUIRE_SIGNER|RA_RSA_USES_DIGEST_INFO|SIG_PUBLIC_SIG,
925     rsa_verify_signature,
926     rsa_create_signature
927 };
928 
929 static const struct signature_alg rsa_with_md2_alg = {
930     "rsa-with-md2",
931     oid_id_pkcs1_md2WithRSAEncryption,
932     hx509_signature_rsa_with_md2,
933     oid_id_pkcs1_rsaEncryption,
934     oid_id_rsa_digest_md2,
935     PROVIDE_CONF|REQUIRE_SIGNER|RA_RSA_USES_DIGEST_INFO|SIG_PUBLIC_SIG,
936     rsa_verify_signature,
937     rsa_create_signature
938 };
939 
940 static const struct signature_alg dsa_sha1_alg = {
941     "dsa-with-sha1",
942     oid_id_dsa_with_sha1,
943     NULL,
944     oid_id_dsa,
945     oid_id_secsig_sha_1,
946     PROVIDE_CONF|REQUIRE_SIGNER|SIG_PUBLIC_SIG,
947     dsa_verify_signature,
948     /* create_signature */ NULL,
949 };
950 
951 static const struct signature_alg sha256_alg = {
952     "sha-256",
953     oid_id_sha256,
954     hx509_signature_sha256,
955     NULL,
956     NULL,
957     SIG_DIGEST,
958     sha256_verify_signature,
959     sha256_create_signature
960 };
961 
962 static const struct signature_alg sha1_alg = {
963     "sha1",
964     oid_id_secsig_sha_1,
965     hx509_signature_sha1,
966     NULL,
967     NULL,
968     SIG_DIGEST,
969     sha1_verify_signature,
970     sha1_create_signature
971 };
972 
973 static const struct signature_alg md5_alg = {
974     "rsa-md5",
975     oid_id_rsa_digest_md5,
976     hx509_signature_md5,
977     NULL,
978     NULL,
979     SIG_DIGEST,
980     md5_verify_signature
981 };
982 
983 static const struct signature_alg md2_alg = {
984     "rsa-md2",
985     oid_id_rsa_digest_md2,
986     hx509_signature_md2,
987     NULL,
988     NULL,
989     SIG_DIGEST,
990     md2_verify_signature
991 };
992 
993 /*
994  * Order matter in this structure, "best" first for each "key
995  * compatible" type (type is RSA, DSA, none, etc)
996  */
997 
998 static const struct signature_alg *sig_algs[] = {
999     &rsa_with_sha256_alg,
1000     &rsa_with_sha1_alg,
1001     &pkcs1_rsa_sha1_alg,
1002     &rsa_with_md5_alg,
1003     &rsa_with_md2_alg,
1004     &heim_rsa_pkcs1_x509,
1005     &dsa_sha1_alg,
1006     &sha256_alg,
1007     &sha1_alg,
1008     &md5_alg,
1009     &md2_alg,
1010     NULL
1011 };
1012 
1013 static const struct signature_alg *
1014 find_sig_alg(const heim_oid *oid)
1015 {
1016     int i;
1017     for (i = 0; sig_algs[i]; i++)
1018 	if (der_heim_oid_cmp((*sig_algs[i]->sig_oid)(), oid) == 0)
1019 	    return sig_algs[i];
1020     return NULL;
1021 }
1022 
1023 /*
1024  *
1025  */
1026 
1027 static struct hx509_private_key_ops *private_algs[] = {
1028     &rsa_private_key_ops,
1029     NULL
1030 };
1031 
1032 static hx509_private_key_ops *
1033 find_private_alg(const heim_oid *oid)
1034 {
1035     int i;
1036     for (i = 0; private_algs[i]; i++) {
1037 	if (private_algs[i]->key_oid == NULL)
1038 	    continue;
1039 	if (der_heim_oid_cmp((*private_algs[i]->key_oid)(), oid) == 0)
1040 	    return private_algs[i];
1041     }
1042     return NULL;
1043 }
1044 
1045 
1046 int
1047 _hx509_verify_signature(hx509_context context,
1048 			const Certificate *signer,
1049 			const AlgorithmIdentifier *alg,
1050 			const heim_octet_string *data,
1051 			const heim_octet_string *sig)
1052 {
1053     const struct signature_alg *md;
1054 
1055     md = find_sig_alg(&alg->algorithm);
1056     if (md == NULL) {
1057 	hx509_clear_error_string(context);
1058 	return HX509_SIG_ALG_NO_SUPPORTED;
1059     }
1060     if (signer && (md->flags & PROVIDE_CONF) == 0) {
1061 	hx509_clear_error_string(context);
1062 	return HX509_CRYPTO_SIG_NO_CONF;
1063     }
1064     if (signer == NULL && (md->flags & REQUIRE_SIGNER)) {
1065 	    hx509_clear_error_string(context);
1066 	return HX509_CRYPTO_SIGNATURE_WITHOUT_SIGNER;
1067     }
1068     if (md->key_oid && signer) {
1069 	const SubjectPublicKeyInfo *spi;
1070 	spi = &signer->tbsCertificate.subjectPublicKeyInfo;
1071 
1072 	if (der_heim_oid_cmp(&spi->algorithm.algorithm, (*md->key_oid)()) != 0) {
1073 	    hx509_clear_error_string(context);
1074 	    return HX509_SIG_ALG_DONT_MATCH_KEY_ALG;
1075 	}
1076     }
1077     return (*md->verify_signature)(context, md, signer, alg, data, sig);
1078 }
1079 
1080 int
1081 _hx509_verify_signature_bitstring(hx509_context context,
1082 				  const Certificate *signer,
1083 				  const AlgorithmIdentifier *alg,
1084 				  const heim_octet_string *data,
1085 				  const heim_bit_string *sig)
1086 {
1087     heim_octet_string os;
1088 
1089     if (sig->length & 7) {
1090 	hx509_set_error_string(context, 0, HX509_CRYPTO_SIG_INVALID_FORMAT,
1091 			       "signature not multiple of 8 bits");
1092 	return HX509_CRYPTO_SIG_INVALID_FORMAT;
1093     }
1094 
1095     os.data = sig->data;
1096     os.length = sig->length / 8;
1097 
1098     return _hx509_verify_signature(context, signer, alg, data, &os);
1099 }
1100 
1101 int
1102 _hx509_create_signature(hx509_context context,
1103 			const hx509_private_key signer,
1104 			const AlgorithmIdentifier *alg,
1105 			const heim_octet_string *data,
1106 			AlgorithmIdentifier *signatureAlgorithm,
1107 			heim_octet_string *sig)
1108 {
1109     const struct signature_alg *md;
1110 
1111     if (signer && signer->ops && signer->ops->handle_alg &&
1112 	(*signer->ops->handle_alg)(signer, alg, COT_SIGN))
1113     {
1114 	return (*signer->ops->sign)(context, signer, alg, data,
1115 				    signatureAlgorithm, sig);
1116     }
1117 
1118     md = find_sig_alg(&alg->algorithm);
1119     if (md == NULL) {
1120 	hx509_set_error_string(context, 0, HX509_SIG_ALG_NO_SUPPORTED,
1121 	    "algorithm no supported");
1122 	return HX509_SIG_ALG_NO_SUPPORTED;
1123     }
1124 
1125     if (signer && (md->flags & PROVIDE_CONF) == 0) {
1126 	hx509_set_error_string(context, 0, HX509_SIG_ALG_NO_SUPPORTED,
1127 	    "algorithm provides no conf");
1128 	return HX509_CRYPTO_SIG_NO_CONF;
1129     }
1130 
1131     return (*md->create_signature)(context, md, signer, alg, data,
1132 				   signatureAlgorithm, sig);
1133 }
1134 
1135 int
1136 _hx509_create_signature_bitstring(hx509_context context,
1137 				  const hx509_private_key signer,
1138 				  const AlgorithmIdentifier *alg,
1139 				  const heim_octet_string *data,
1140 				  AlgorithmIdentifier *signatureAlgorithm,
1141 				  heim_bit_string *sig)
1142 {
1143     heim_octet_string os;
1144     int ret;
1145 
1146     ret = _hx509_create_signature(context, signer, alg,
1147 				  data, signatureAlgorithm, &os);
1148     if (ret)
1149 	return ret;
1150     sig->data = os.data;
1151     sig->length = os.length * 8;
1152     return 0;
1153 }
1154 
1155 int
1156 _hx509_public_encrypt(hx509_context context,
1157 		      const heim_octet_string *cleartext,
1158 		      const Certificate *cert,
1159 		      heim_oid *encryption_oid,
1160 		      heim_octet_string *ciphertext)
1161 {
1162     const SubjectPublicKeyInfo *spi;
1163     unsigned char *to;
1164     int tosize;
1165     int ret;
1166     RSA *rsa;
1167     RSAPublicKey pk;
1168     size_t size;
1169 
1170     ciphertext->data = NULL;
1171     ciphertext->length = 0;
1172 
1173     spi = &cert->tbsCertificate.subjectPublicKeyInfo;
1174 
1175     rsa = RSA_new();
1176     if (rsa == NULL) {
1177 	hx509_set_error_string(context, 0, ENOMEM, "out of memory");
1178 	return ENOMEM;
1179     }
1180 
1181     ret = decode_RSAPublicKey(spi->subjectPublicKey.data,
1182 			      spi->subjectPublicKey.length / 8,
1183 			      &pk, &size);
1184     if (ret) {
1185 	RSA_free(rsa);
1186 	hx509_set_error_string(context, 0, ret, "RSAPublicKey decode failure");
1187 	return ret;
1188     }
1189     rsa->n = heim_int2BN(&pk.modulus);
1190     rsa->e = heim_int2BN(&pk.publicExponent);
1191 
1192     free_RSAPublicKey(&pk);
1193 
1194     if (rsa->n == NULL || rsa->e == NULL) {
1195 	RSA_free(rsa);
1196 	hx509_set_error_string(context, 0, ENOMEM, "out of memory");
1197 	return ENOMEM;
1198     }
1199 
1200     tosize = RSA_size(rsa);
1201     to = malloc(tosize);
1202     if (to == NULL) {
1203 	RSA_free(rsa);
1204 	hx509_set_error_string(context, 0, ENOMEM, "out of memory");
1205 	return ENOMEM;
1206     }
1207 
1208     ret = RSA_public_encrypt(cleartext->length,
1209 			     (unsigned char *)cleartext->data,
1210 			     to, rsa, RSA_PKCS1_PADDING);
1211     RSA_free(rsa);
1212     if (ret <= 0) {
1213 	free(to);
1214 	hx509_set_error_string(context, 0, HX509_CRYPTO_RSA_PUBLIC_ENCRYPT,
1215 			       "RSA public encrypt failed with %d", ret);
1216 	return HX509_CRYPTO_RSA_PUBLIC_ENCRYPT;
1217     }
1218     if (ret > tosize)
1219 	_hx509_abort("internal rsa decryption failure: ret > tosize");
1220 
1221     ciphertext->length = ret;
1222     ciphertext->data = to;
1223 
1224     ret = der_copy_oid(oid_id_pkcs1_rsaEncryption(), encryption_oid);
1225     if (ret) {
1226 	der_free_octet_string(ciphertext);
1227 	hx509_set_error_string(context, 0, ENOMEM, "out of memory");
1228 	return ENOMEM;
1229     }
1230 
1231     return 0;
1232 }
1233 
1234 int
1235 _hx509_private_key_private_decrypt(hx509_context context,
1236 				   const heim_octet_string *ciphertext,
1237 				   const heim_oid *encryption_oid,
1238 				   hx509_private_key p,
1239 				   heim_octet_string *cleartext)
1240 {
1241     int ret;
1242 
1243     cleartext->data = NULL;
1244     cleartext->length = 0;
1245 
1246     if (p->private_key.rsa == NULL) {
1247 	hx509_set_error_string(context, 0, HX509_PRIVATE_KEY_MISSING,
1248 			       "Private RSA key missing");
1249 	return HX509_PRIVATE_KEY_MISSING;
1250     }
1251 
1252     cleartext->length = RSA_size(p->private_key.rsa);
1253     cleartext->data = malloc(cleartext->length);
1254     if (cleartext->data == NULL) {
1255 	hx509_set_error_string(context, 0, ENOMEM, "out of memory");
1256 	return ENOMEM;
1257     }
1258     ret = RSA_private_decrypt(ciphertext->length, ciphertext->data,
1259 			      cleartext->data,
1260 			      p->private_key.rsa,
1261 			      RSA_PKCS1_PADDING);
1262     if (ret <= 0) {
1263 	der_free_octet_string(cleartext);
1264 	hx509_set_error_string(context, 0, HX509_CRYPTO_RSA_PRIVATE_DECRYPT,
1265 			       "Failed to decrypt using private key: %d", ret);
1266 	return HX509_CRYPTO_RSA_PRIVATE_DECRYPT;
1267     }
1268     if (cleartext->length < ret)
1269 	_hx509_abort("internal rsa decryption failure: ret > tosize");
1270 
1271     cleartext->length = ret;
1272 
1273     return 0;
1274 }
1275 
1276 
1277 int
1278 _hx509_parse_private_key(hx509_context context,
1279 			 const heim_oid *key_oid,
1280 			 const void *data,
1281 			 size_t len,
1282 			 hx509_private_key *private_key)
1283 {
1284     struct hx509_private_key_ops *ops;
1285     int ret;
1286 
1287     *private_key = NULL;
1288 
1289     ops = find_private_alg(key_oid);
1290     if (ops == NULL) {
1291 	hx509_clear_error_string(context);
1292 	return HX509_SIG_ALG_NO_SUPPORTED;
1293     }
1294 
1295     ret = _hx509_private_key_init(private_key, ops, NULL);
1296     if (ret) {
1297 	hx509_set_error_string(context, 0, ret, "out of memory");
1298 	return ret;
1299     }
1300 
1301     ret = (*ops->import)(context, data, len, *private_key);
1302     if (ret)
1303 	_hx509_private_key_free(private_key);
1304 
1305     return ret;
1306 }
1307 
1308 /*
1309  *
1310  */
1311 
1312 int
1313 _hx509_private_key2SPKI(hx509_context context,
1314 			hx509_private_key private_key,
1315 			SubjectPublicKeyInfo *spki)
1316 {
1317     const struct hx509_private_key_ops *ops = private_key->ops;
1318     if (ops == NULL || ops->get_spki == NULL) {
1319 	hx509_set_error_string(context, 0, HX509_UNIMPLEMENTED_OPERATION,
1320 			       "Private key have no key2SPKI function");
1321 	return HX509_UNIMPLEMENTED_OPERATION;
1322     }
1323     return (*ops->get_spki)(context, private_key, spki);
1324 }
1325 
1326 int
1327 _hx509_generate_private_key_init(hx509_context context,
1328 				 const heim_oid *oid,
1329 				 struct hx509_generate_private_context **ctx)
1330 {
1331     *ctx = NULL;
1332 
1333     if (der_heim_oid_cmp(oid, oid_id_pkcs1_rsaEncryption()) != 0) {
1334 	hx509_set_error_string(context, 0, EINVAL,
1335 			       "private key not an RSA key");
1336 	return EINVAL;
1337     }
1338 
1339     *ctx = calloc(1, sizeof(**ctx));
1340     if (*ctx == NULL) {
1341 	hx509_set_error_string(context, 0, ENOMEM, "out of memory");
1342 	return ENOMEM;
1343     }
1344     (*ctx)->key_oid = oid;
1345 
1346     return 0;
1347 }
1348 
1349 int
1350 _hx509_generate_private_key_is_ca(hx509_context context,
1351 				  struct hx509_generate_private_context *ctx)
1352 {
1353     ctx->isCA = 1;
1354     return 0;
1355 }
1356 
1357 int
1358 _hx509_generate_private_key_bits(hx509_context context,
1359 				 struct hx509_generate_private_context *ctx,
1360 				 unsigned long bits)
1361 {
1362     ctx->num_bits = bits;
1363     return 0;
1364 }
1365 
1366 
1367 void
1368 _hx509_generate_private_key_free(struct hx509_generate_private_context **ctx)
1369 {
1370     free(*ctx);
1371     *ctx = NULL;
1372 }
1373 
1374 int
1375 _hx509_generate_private_key(hx509_context context,
1376 			    struct hx509_generate_private_context *ctx,
1377 			    hx509_private_key *private_key)
1378 {
1379     struct hx509_private_key_ops *ops;
1380     int ret;
1381 
1382     *private_key = NULL;
1383 
1384     ops = find_private_alg(ctx->key_oid);
1385     if (ops == NULL) {
1386 	hx509_clear_error_string(context);
1387 	return HX509_SIG_ALG_NO_SUPPORTED;
1388     }
1389 
1390     ret = _hx509_private_key_init(private_key, ops, NULL);
1391     if (ret) {
1392 	hx509_set_error_string(context, 0, ret, "out of memory");
1393 	return ret;
1394     }
1395 
1396     ret = (*ops->generate_private_key)(context, ctx, *private_key);
1397     if (ret)
1398 	_hx509_private_key_free(private_key);
1399 
1400     return ret;
1401 }
1402 
1403 
1404 /*
1405  *
1406  */
1407 
1408 static const heim_octet_string null_entry_oid = { 2, rk_UNCONST("\x05\x00") };
1409 
1410 static const unsigned sha512_oid_tree[] = { 2, 16, 840, 1, 101, 3, 4, 2, 3 };
1411 const AlgorithmIdentifier _hx509_signature_sha512_data = {
1412     { 9, rk_UNCONST(sha512_oid_tree) }, rk_UNCONST(&null_entry_oid)
1413 };
1414 
1415 static const unsigned sha384_oid_tree[] = { 2, 16, 840, 1, 101, 3, 4, 2, 2 };
1416 const AlgorithmIdentifier _hx509_signature_sha384_data = {
1417     { 9, rk_UNCONST(sha384_oid_tree) }, rk_UNCONST(&null_entry_oid)
1418 };
1419 
1420 static const unsigned sha256_oid_tree[] = { 2, 16, 840, 1, 101, 3, 4, 2, 1 };
1421 const AlgorithmIdentifier _hx509_signature_sha256_data = {
1422     { 9, rk_UNCONST(sha256_oid_tree) }, rk_UNCONST(&null_entry_oid)
1423 };
1424 
1425 static const unsigned sha1_oid_tree[] = { 1, 3, 14, 3, 2, 26 };
1426 const AlgorithmIdentifier _hx509_signature_sha1_data = {
1427     { 6, rk_UNCONST(sha1_oid_tree) }, rk_UNCONST(&null_entry_oid)
1428 };
1429 
1430 static const unsigned md5_oid_tree[] = { 1, 2, 840, 113549, 2, 5 };
1431 const AlgorithmIdentifier _hx509_signature_md5_data = {
1432     { 6, rk_UNCONST(md5_oid_tree) }, rk_UNCONST(&null_entry_oid)
1433 };
1434 
1435 static const unsigned md2_oid_tree[] = { 1, 2, 840, 113549, 2, 2 };
1436 const AlgorithmIdentifier _hx509_signature_md2_data = {
1437     { 6, rk_UNCONST(md2_oid_tree) }, rk_UNCONST(&null_entry_oid)
1438 };
1439 
1440 static const unsigned rsa_with_sha512_oid[] ={ 1, 2, 840, 113549, 1, 1, 13 };
1441 const AlgorithmIdentifier _hx509_signature_rsa_with_sha512_data = {
1442     { 7, rk_UNCONST(rsa_with_sha512_oid) }, NULL
1443 };
1444 
1445 static const unsigned rsa_with_sha384_oid[] ={ 1, 2, 840, 113549, 1, 1, 12 };
1446 const AlgorithmIdentifier _hx509_signature_rsa_with_sha384_data = {
1447     { 7, rk_UNCONST(rsa_with_sha384_oid) }, NULL
1448 };
1449 
1450 static const unsigned rsa_with_sha256_oid[] ={ 1, 2, 840, 113549, 1, 1, 11 };
1451 const AlgorithmIdentifier _hx509_signature_rsa_with_sha256_data = {
1452     { 7, rk_UNCONST(rsa_with_sha256_oid) }, NULL
1453 };
1454 
1455 static const unsigned rsa_with_sha1_oid[] ={ 1, 2, 840, 113549, 1, 1, 5 };
1456 const AlgorithmIdentifier _hx509_signature_rsa_with_sha1_data = {
1457     { 7, rk_UNCONST(rsa_with_sha1_oid) }, NULL
1458 };
1459 
1460 static const unsigned rsa_with_md5_oid[] ={ 1, 2, 840, 113549, 1, 1, 4 };
1461 const AlgorithmIdentifier _hx509_signature_rsa_with_md5_data = {
1462     { 7, rk_UNCONST(rsa_with_md5_oid) }, NULL
1463 };
1464 
1465 static const unsigned rsa_with_md2_oid[] ={ 1, 2, 840, 113549, 1, 1, 2 };
1466 const AlgorithmIdentifier _hx509_signature_rsa_with_md2_data = {
1467     { 7, rk_UNCONST(rsa_with_md2_oid) }, NULL
1468 };
1469 
1470 static const unsigned rsa_oid[] ={ 1, 2, 840, 113549, 1, 1, 1 };
1471 const AlgorithmIdentifier _hx509_signature_rsa_data = {
1472     { 7, rk_UNCONST(rsa_oid) }, NULL
1473 };
1474 
1475 static const unsigned rsa_pkcs1_x509_oid[] ={ 1, 2, 752, 43, 16, 1 };
1476 const AlgorithmIdentifier _hx509_signature_rsa_pkcs1_x509_data = {
1477     { 6, rk_UNCONST(rsa_pkcs1_x509_oid) }, NULL
1478 };
1479 
1480 static const unsigned des_rsdi_ede3_cbc_oid[] ={ 1, 2, 840, 113549, 3, 7 };
1481 const AlgorithmIdentifier _hx509_des_rsdi_ede3_cbc_oid = {
1482     { 6, rk_UNCONST(des_rsdi_ede3_cbc_oid) }, NULL
1483 };
1484 
1485 static const unsigned aes128_cbc_oid[] ={ 2, 16, 840, 1, 101, 3, 4, 1, 2 };
1486 const AlgorithmIdentifier _hx509_crypto_aes128_cbc_data = {
1487     { 9, rk_UNCONST(aes128_cbc_oid) }, NULL
1488 };
1489 
1490 static const unsigned aes256_cbc_oid[] ={ 2, 16, 840, 1, 101, 3, 4, 1, 42 };
1491 const AlgorithmIdentifier _hx509_crypto_aes256_cbc_data = {
1492     { 9, rk_UNCONST(aes256_cbc_oid) }, NULL
1493 };
1494 
1495 const AlgorithmIdentifier *
1496 hx509_signature_sha512(void)
1497 { return &_hx509_signature_sha512_data; }
1498 
1499 const AlgorithmIdentifier *
1500 hx509_signature_sha384(void)
1501 { return &_hx509_signature_sha384_data; }
1502 
1503 const AlgorithmIdentifier *
1504 hx509_signature_sha256(void)
1505 { return &_hx509_signature_sha256_data; }
1506 
1507 const AlgorithmIdentifier *
1508 hx509_signature_sha1(void)
1509 { return &_hx509_signature_sha1_data; }
1510 
1511 const AlgorithmIdentifier *
1512 hx509_signature_md5(void)
1513 { return &_hx509_signature_md5_data; }
1514 
1515 const AlgorithmIdentifier *
1516 hx509_signature_md2(void)
1517 { return &_hx509_signature_md2_data; }
1518 
1519 const AlgorithmIdentifier *
1520 hx509_signature_rsa_with_sha512(void)
1521 { return &_hx509_signature_rsa_with_sha512_data; }
1522 
1523 const AlgorithmIdentifier *
1524 hx509_signature_rsa_with_sha384(void)
1525 { return &_hx509_signature_rsa_with_sha384_data; }
1526 
1527 const AlgorithmIdentifier *
1528 hx509_signature_rsa_with_sha256(void)
1529 { return &_hx509_signature_rsa_with_sha256_data; }
1530 
1531 const AlgorithmIdentifier *
1532 hx509_signature_rsa_with_sha1(void)
1533 { return &_hx509_signature_rsa_with_sha1_data; }
1534 
1535 const AlgorithmIdentifier *
1536 hx509_signature_rsa_with_md5(void)
1537 { return &_hx509_signature_rsa_with_md5_data; }
1538 
1539 const AlgorithmIdentifier *
1540 hx509_signature_rsa_with_md2(void)
1541 { return &_hx509_signature_rsa_with_md2_data; }
1542 
1543 const AlgorithmIdentifier *
1544 hx509_signature_rsa(void)
1545 { return &_hx509_signature_rsa_data; }
1546 
1547 const AlgorithmIdentifier *
1548 hx509_signature_rsa_pkcs1_x509(void)
1549 { return &_hx509_signature_rsa_pkcs1_x509_data; }
1550 
1551 const AlgorithmIdentifier *
1552 hx509_crypto_des_rsdi_ede3_cbc(void)
1553 { return &_hx509_des_rsdi_ede3_cbc_oid; }
1554 
1555 const AlgorithmIdentifier *
1556 hx509_crypto_aes128_cbc(void)
1557 { return &_hx509_crypto_aes128_cbc_data; }
1558 
1559 const AlgorithmIdentifier *
1560 hx509_crypto_aes256_cbc(void)
1561 { return &_hx509_crypto_aes256_cbc_data; }
1562 
1563 /*
1564  *
1565  */
1566 
1567 const AlgorithmIdentifier * _hx509_crypto_default_sig_alg =
1568     &_hx509_signature_rsa_with_sha1_data;
1569 const AlgorithmIdentifier * _hx509_crypto_default_digest_alg =
1570     &_hx509_signature_sha1_data;
1571 const AlgorithmIdentifier * _hx509_crypto_default_secret_alg =
1572     &_hx509_crypto_aes128_cbc_data;
1573 
1574 /*
1575  *
1576  */
1577 
1578 int
1579 _hx509_private_key_init(hx509_private_key *key,
1580 			hx509_private_key_ops *ops,
1581 			void *keydata)
1582 {
1583     *key = calloc(1, sizeof(**key));
1584     if (*key == NULL)
1585 	return ENOMEM;
1586     (*key)->ref = 1;
1587     (*key)->ops = ops;
1588     (*key)->private_key.keydata = keydata;
1589     return 0;
1590 }
1591 
1592 hx509_private_key
1593 _hx509_private_key_ref(hx509_private_key key)
1594 {
1595     if (key->ref <= 0)
1596 	_hx509_abort("refcount <= 0");
1597     key->ref++;
1598     if (key->ref == 0)
1599 	_hx509_abort("refcount == 0");
1600     return key;
1601 }
1602 
1603 const char *
1604 _hx509_private_pem_name(hx509_private_key key)
1605 {
1606     return key->ops->pemtype;
1607 }
1608 
1609 int
1610 _hx509_private_key_free(hx509_private_key *key)
1611 {
1612     if (key == NULL || *key == NULL)
1613 	return 0;
1614 
1615     if ((*key)->ref <= 0)
1616 	_hx509_abort("refcount <= 0");
1617     if (--(*key)->ref > 0)
1618 	return 0;
1619 
1620     if ((*key)->private_key.rsa)
1621 	RSA_free((*key)->private_key.rsa);
1622     (*key)->private_key.rsa = NULL;
1623     free(*key);
1624     *key = NULL;
1625     return 0;
1626 }
1627 
1628 void
1629 _hx509_private_key_assign_rsa(hx509_private_key key, void *ptr)
1630 {
1631     if (key->private_key.rsa)
1632 	RSA_free(key->private_key.rsa);
1633     key->private_key.rsa = ptr;
1634     key->signature_alg = oid_id_pkcs1_sha1WithRSAEncryption();
1635     key->md = &pkcs1_rsa_sha1_alg;
1636 }
1637 
1638 int
1639 _hx509_private_key_oid(hx509_context context,
1640 		       const hx509_private_key key,
1641 		       heim_oid *data)
1642 {
1643     int ret;
1644     ret = der_copy_oid((*key->ops->key_oid)(), data);
1645     if (ret)
1646 	hx509_set_error_string(context, 0, ret, "malloc out of memory");
1647     return ret;
1648 }
1649 
1650 int
1651 _hx509_private_key_exportable(hx509_private_key key)
1652 {
1653     if (key->ops->export == NULL)
1654 	return 0;
1655     return 1;
1656 }
1657 
1658 BIGNUM *
1659 _hx509_private_key_get_internal(hx509_context context,
1660 				hx509_private_key key,
1661 				const char *type)
1662 {
1663     if (key->ops->get_internal == NULL)
1664 	return NULL;
1665     return (*key->ops->get_internal)(context, key, type);
1666 }
1667 
1668 int
1669 _hx509_private_key_export(hx509_context context,
1670 			  const hx509_private_key key,
1671 			  heim_octet_string *data)
1672 {
1673     if (key->ops->export == NULL) {
1674 	hx509_clear_error_string(context);
1675 	return HX509_UNIMPLEMENTED_OPERATION;
1676     }
1677     return (*key->ops->export)(context, key, data);
1678 }
1679 
1680 /*
1681  *
1682  */
1683 
1684 struct hx509cipher {
1685     const char *name;
1686     const heim_oid *(*oid_func)(void);
1687     const AlgorithmIdentifier *(*ai_func)(void);
1688     const EVP_CIPHER *(*evp_func)(void);
1689     int (*get_params)(hx509_context, const hx509_crypto,
1690 		      const heim_octet_string *, heim_octet_string *);
1691     int (*set_params)(hx509_context, const heim_octet_string *,
1692 		      hx509_crypto, heim_octet_string *);
1693 };
1694 
1695 struct hx509_crypto_data {
1696     char *name;
1697     const struct hx509cipher *cipher;
1698     const EVP_CIPHER *c;
1699     heim_octet_string key;
1700     heim_oid oid;
1701     void *param;
1702 };
1703 
1704 /*
1705  *
1706  */
1707 
1708 static const heim_oid *
1709 oid_private_rc2_40(void)
1710 {
1711     static unsigned oid_data[] = { 127, 1 };
1712     static const heim_oid oid = { 2, oid_data };
1713 
1714     return &oid;
1715 }
1716 
1717 
1718 /*
1719  *
1720  */
1721 
1722 static int
1723 CMSCBCParam_get(hx509_context context, const hx509_crypto crypto,
1724 		 const heim_octet_string *ivec, heim_octet_string *param)
1725 {
1726     size_t size;
1727     int ret;
1728 
1729     assert(crypto->param == NULL);
1730     if (ivec == NULL)
1731 	return 0;
1732 
1733     ASN1_MALLOC_ENCODE(CMSCBCParameter, param->data, param->length,
1734 		       ivec, &size, ret);
1735     if (ret == 0 && size != param->length)
1736 	_hx509_abort("Internal asn1 encoder failure");
1737     if (ret)
1738 	hx509_clear_error_string(context);
1739     return ret;
1740 }
1741 
1742 static int
1743 CMSCBCParam_set(hx509_context context, const heim_octet_string *param,
1744 		hx509_crypto crypto, heim_octet_string *ivec)
1745 {
1746     int ret;
1747     if (ivec == NULL)
1748 	return 0;
1749 
1750     ret = decode_CMSCBCParameter(param->data, param->length, ivec, NULL);
1751     if (ret)
1752 	hx509_clear_error_string(context);
1753 
1754     return ret;
1755 }
1756 
1757 struct _RC2_params {
1758     int maximum_effective_key;
1759 };
1760 
1761 static int
1762 CMSRC2CBCParam_get(hx509_context context, const hx509_crypto crypto,
1763 		   const heim_octet_string *ivec, heim_octet_string *param)
1764 {
1765     CMSRC2CBCParameter rc2params;
1766     const struct _RC2_params *p = crypto->param;
1767     int maximum_effective_key = 128;
1768     size_t size;
1769     int ret;
1770 
1771     memset(&rc2params, 0, sizeof(rc2params));
1772 
1773     if (p)
1774 	maximum_effective_key = p->maximum_effective_key;
1775 
1776     switch(maximum_effective_key) {
1777     case 40:
1778 	rc2params.rc2ParameterVersion = 160;
1779 	break;
1780     case 64:
1781 	rc2params.rc2ParameterVersion = 120;
1782 	break;
1783     case 128:
1784 	rc2params.rc2ParameterVersion = 58;
1785 	break;
1786     }
1787     rc2params.iv = *ivec;
1788 
1789     ASN1_MALLOC_ENCODE(CMSRC2CBCParameter, param->data, param->length,
1790 		       &rc2params, &size, ret);
1791     if (ret == 0 && size != param->length)
1792 	_hx509_abort("Internal asn1 encoder failure");
1793 
1794     return ret;
1795 }
1796 
1797 static int
1798 CMSRC2CBCParam_set(hx509_context context, const heim_octet_string *param,
1799 		   hx509_crypto crypto, heim_octet_string *ivec)
1800 {
1801     CMSRC2CBCParameter rc2param;
1802     struct _RC2_params *p;
1803     size_t size;
1804     int ret;
1805 
1806     ret = decode_CMSRC2CBCParameter(param->data, param->length,
1807 				    &rc2param, &size);
1808     if (ret) {
1809 	hx509_clear_error_string(context);
1810 	return ret;
1811     }
1812 
1813     p = calloc(1, sizeof(*p));
1814     if (p == NULL) {
1815 	free_CMSRC2CBCParameter(&rc2param);
1816 	hx509_clear_error_string(context);
1817 	return ENOMEM;
1818     }
1819     switch(rc2param.rc2ParameterVersion) {
1820     case 160:
1821 	crypto->c = EVP_rc2_40_cbc();
1822 	p->maximum_effective_key = 40;
1823 	break;
1824     case 120:
1825 	crypto->c = EVP_rc2_64_cbc();
1826 	p->maximum_effective_key = 64;
1827 	break;
1828     case 58:
1829 	crypto->c = EVP_rc2_cbc();
1830 	p->maximum_effective_key = 128;
1831 	break;
1832     default:
1833 	free(p);
1834 	free_CMSRC2CBCParameter(&rc2param);
1835 	return HX509_CRYPTO_SIG_INVALID_FORMAT;
1836     }
1837     if (ivec)
1838 	ret = der_copy_octet_string(&rc2param.iv, ivec);
1839     free_CMSRC2CBCParameter(&rc2param);
1840     if (ret) {
1841 	free(p);
1842 	hx509_clear_error_string(context);
1843     } else
1844 	crypto->param = p;
1845 
1846     return ret;
1847 }
1848 
1849 /*
1850  *
1851  */
1852 
1853 static const struct hx509cipher ciphers[] = {
1854     {
1855 	"rc2-cbc",
1856 	oid_id_pkcs3_rc2_cbc,
1857 	NULL,
1858 	EVP_rc2_cbc,
1859 	CMSRC2CBCParam_get,
1860 	CMSRC2CBCParam_set
1861     },
1862     {
1863 	"rc2-cbc",
1864 	oid_id_rsadsi_rc2_cbc,
1865 	NULL,
1866 	EVP_rc2_cbc,
1867 	CMSRC2CBCParam_get,
1868 	CMSRC2CBCParam_set
1869     },
1870     {
1871 	"rc2-40-cbc",
1872 	oid_private_rc2_40,
1873 	NULL,
1874 	EVP_rc2_40_cbc,
1875 	CMSRC2CBCParam_get,
1876 	CMSRC2CBCParam_set
1877     },
1878     {
1879 	"des-ede3-cbc",
1880 	oid_id_pkcs3_des_ede3_cbc,
1881 	NULL,
1882 	EVP_des_ede3_cbc,
1883 	CMSCBCParam_get,
1884 	CMSCBCParam_set
1885     },
1886     {
1887 	"des-ede3-cbc",
1888 	oid_id_rsadsi_des_ede3_cbc,
1889 	hx509_crypto_des_rsdi_ede3_cbc,
1890 	EVP_des_ede3_cbc,
1891 	CMSCBCParam_get,
1892 	CMSCBCParam_set
1893     },
1894     {
1895 	"aes-128-cbc",
1896 	oid_id_aes_128_cbc,
1897 	hx509_crypto_aes128_cbc,
1898 	EVP_aes_128_cbc,
1899 	CMSCBCParam_get,
1900 	CMSCBCParam_set
1901     },
1902     {
1903 	"aes-192-cbc",
1904 	oid_id_aes_192_cbc,
1905 	NULL,
1906 	EVP_aes_192_cbc,
1907 	CMSCBCParam_get,
1908 	CMSCBCParam_set
1909     },
1910     {
1911 	"aes-256-cbc",
1912 	oid_id_aes_256_cbc,
1913 	hx509_crypto_aes256_cbc,
1914 	EVP_aes_256_cbc,
1915 	CMSCBCParam_get,
1916 	CMSCBCParam_set
1917     }
1918 };
1919 
1920 static const struct hx509cipher *
1921 find_cipher_by_oid(const heim_oid *oid)
1922 {
1923     int i;
1924 
1925     for (i = 0; i < sizeof(ciphers)/sizeof(ciphers[0]); i++)
1926 	if (der_heim_oid_cmp(oid, (*ciphers[i].oid_func)()) == 0)
1927 	    return &ciphers[i];
1928 
1929     return NULL;
1930 }
1931 
1932 static const struct hx509cipher *
1933 find_cipher_by_name(const char *name)
1934 {
1935     int i;
1936 
1937     for (i = 0; i < sizeof(ciphers)/sizeof(ciphers[0]); i++)
1938 	if (strcasecmp(name, ciphers[i].name) == 0)
1939 	    return &ciphers[i];
1940 
1941     return NULL;
1942 }
1943 
1944 
1945 const heim_oid *
1946 hx509_crypto_enctype_by_name(const char *name)
1947 {
1948     const struct hx509cipher *cipher;
1949 
1950     cipher = find_cipher_by_name(name);
1951     if (cipher == NULL)
1952 	return NULL;
1953     return (*cipher->oid_func)();
1954 }
1955 
1956 int
1957 hx509_crypto_init(hx509_context context,
1958 		  const char *provider,
1959 		  const heim_oid *enctype,
1960 		  hx509_crypto *crypto)
1961 {
1962     const struct hx509cipher *cipher;
1963 
1964     *crypto = NULL;
1965 
1966     cipher = find_cipher_by_oid(enctype);
1967     if (cipher == NULL) {
1968 	hx509_set_error_string(context, 0, HX509_ALG_NOT_SUPP,
1969 			       "Algorithm not supported");
1970 	return HX509_ALG_NOT_SUPP;
1971     }
1972 
1973     *crypto = calloc(1, sizeof(**crypto));
1974     if (*crypto == NULL) {
1975 	hx509_clear_error_string(context);
1976 	return ENOMEM;
1977     }
1978 
1979     (*crypto)->cipher = cipher;
1980     (*crypto)->c = (*cipher->evp_func)();
1981 
1982     if (der_copy_oid(enctype, &(*crypto)->oid)) {
1983 	hx509_crypto_destroy(*crypto);
1984 	*crypto = NULL;
1985 	hx509_clear_error_string(context);
1986 	return ENOMEM;
1987     }
1988 
1989     return 0;
1990 }
1991 
1992 const char *
1993 hx509_crypto_provider(hx509_crypto crypto)
1994 {
1995     return "unknown";
1996 }
1997 
1998 void
1999 hx509_crypto_destroy(hx509_crypto crypto)
2000 {
2001     if (crypto->name)
2002 	free(crypto->name);
2003     if (crypto->key.data)
2004 	free(crypto->key.data);
2005     if (crypto->param)
2006 	free(crypto->param);
2007     der_free_oid(&crypto->oid);
2008     memset(crypto, 0, sizeof(*crypto));
2009     free(crypto);
2010 }
2011 
2012 int
2013 hx509_crypto_set_key_name(hx509_crypto crypto, const char *name)
2014 {
2015     return 0;
2016 }
2017 
2018 int
2019 hx509_crypto_set_key_data(hx509_crypto crypto, const void *data, size_t length)
2020 {
2021     if (EVP_CIPHER_key_length(crypto->c) > length)
2022 	return HX509_CRYPTO_INTERNAL_ERROR;
2023 
2024     if (crypto->key.data) {
2025 	free(crypto->key.data);
2026 	crypto->key.data = NULL;
2027 	crypto->key.length = 0;
2028     }
2029     crypto->key.data = malloc(length);
2030     if (crypto->key.data == NULL)
2031 	return ENOMEM;
2032     memcpy(crypto->key.data, data, length);
2033     crypto->key.length = length;
2034 
2035     return 0;
2036 }
2037 
2038 int
2039 hx509_crypto_set_random_key(hx509_crypto crypto, heim_octet_string *key)
2040 {
2041     if (crypto->key.data) {
2042 	free(crypto->key.data);
2043 	crypto->key.length = 0;
2044     }
2045 
2046     crypto->key.length = EVP_CIPHER_key_length(crypto->c);
2047     crypto->key.data = malloc(crypto->key.length);
2048     if (crypto->key.data == NULL) {
2049 	crypto->key.length = 0;
2050 	return ENOMEM;
2051     }
2052     if (RAND_bytes(crypto->key.data, crypto->key.length) <= 0) {
2053 	free(crypto->key.data);
2054 	crypto->key.data = NULL;
2055 	crypto->key.length = 0;
2056 	return HX509_CRYPTO_INTERNAL_ERROR;
2057     }
2058     if (key)
2059 	return der_copy_octet_string(&crypto->key, key);
2060     else
2061 	return 0;
2062 }
2063 
2064 int
2065 hx509_crypto_set_params(hx509_context context,
2066 			hx509_crypto crypto,
2067 			const heim_octet_string *param,
2068 			heim_octet_string *ivec)
2069 {
2070     return (*crypto->cipher->set_params)(context, param, crypto, ivec);
2071 }
2072 
2073 int
2074 hx509_crypto_get_params(hx509_context context,
2075 			hx509_crypto crypto,
2076 			const heim_octet_string *ivec,
2077 			heim_octet_string *param)
2078 {
2079     return (*crypto->cipher->get_params)(context, crypto, ivec, param);
2080 }
2081 
2082 int
2083 hx509_crypto_random_iv(hx509_crypto crypto, heim_octet_string *ivec)
2084 {
2085     ivec->length = EVP_CIPHER_iv_length(crypto->c);
2086     ivec->data = malloc(ivec->length);
2087     if (ivec->data == NULL) {
2088 	ivec->length = 0;
2089 	return ENOMEM;
2090     }
2091 
2092     if (RAND_bytes(ivec->data, ivec->length) <= 0) {
2093 	free(ivec->data);
2094 	ivec->data = NULL;
2095 	ivec->length = 0;
2096 	return HX509_CRYPTO_INTERNAL_ERROR;
2097     }
2098     return 0;
2099 }
2100 
2101 int
2102 hx509_crypto_encrypt(hx509_crypto crypto,
2103 		     const void *data,
2104 		     const size_t length,
2105 		     const heim_octet_string *ivec,
2106 		     heim_octet_string **ciphertext)
2107 {
2108     EVP_CIPHER_CTX evp;
2109     size_t padsize;
2110     int ret;
2111 
2112     *ciphertext = NULL;
2113 
2114     assert(EVP_CIPHER_iv_length(crypto->c) == ivec->length);
2115 
2116     EVP_CIPHER_CTX_init(&evp);
2117 
2118     ret = EVP_CipherInit_ex(&evp, crypto->c, NULL,
2119 			    crypto->key.data, ivec->data, 1);
2120     if (ret != 1) {
2121 	EVP_CIPHER_CTX_cleanup(&evp);
2122 	ret = HX509_CRYPTO_INTERNAL_ERROR;
2123 	goto out;
2124     }
2125 
2126     *ciphertext = calloc(1, sizeof(**ciphertext));
2127     if (*ciphertext == NULL) {
2128 	ret = ENOMEM;
2129 	goto out;
2130     }
2131 
2132     if (EVP_CIPHER_block_size(crypto->c) == 1) {
2133 	padsize = 0;
2134     } else {
2135 	int bsize = EVP_CIPHER_block_size(crypto->c);
2136 	padsize = bsize - (length % bsize);
2137     }
2138     (*ciphertext)->length = length + padsize;
2139     (*ciphertext)->data = malloc(length + padsize);
2140     if ((*ciphertext)->data == NULL) {
2141 	ret = ENOMEM;
2142 	goto out;
2143     }
2144 
2145     memcpy((*ciphertext)->data, data, length);
2146     if (padsize) {
2147 	int i;
2148 	unsigned char *p = (*ciphertext)->data;
2149 	p += length;
2150 	for (i = 0; i < padsize; i++)
2151 	    *p++ = padsize;
2152     }
2153 
2154     ret = EVP_Cipher(&evp, (*ciphertext)->data,
2155 		     (*ciphertext)->data,
2156 		     length + padsize);
2157     if (ret != 1) {
2158 	ret = HX509_CRYPTO_INTERNAL_ERROR;
2159 	goto out;
2160     }
2161     ret = 0;
2162 
2163  out:
2164     if (ret) {
2165 	if (*ciphertext) {
2166 	    if ((*ciphertext)->data) {
2167 		free((*ciphertext)->data);
2168 	    }
2169 	    free(*ciphertext);
2170 	    *ciphertext = NULL;
2171 	}
2172     }
2173     EVP_CIPHER_CTX_cleanup(&evp);
2174 
2175     return ret;
2176 }
2177 
2178 int
2179 hx509_crypto_decrypt(hx509_crypto crypto,
2180 		     const void *data,
2181 		     const size_t length,
2182 		     heim_octet_string *ivec,
2183 		     heim_octet_string *clear)
2184 {
2185     EVP_CIPHER_CTX evp;
2186     void *idata = NULL;
2187     int ret;
2188 
2189     clear->data = NULL;
2190     clear->length = 0;
2191 
2192     if (ivec && EVP_CIPHER_iv_length(crypto->c) < ivec->length)
2193 	return HX509_CRYPTO_INTERNAL_ERROR;
2194 
2195     if (crypto->key.data == NULL)
2196 	return HX509_CRYPTO_INTERNAL_ERROR;
2197 
2198     if (ivec)
2199 	idata = ivec->data;
2200 
2201     EVP_CIPHER_CTX_init(&evp);
2202 
2203     ret = EVP_CipherInit_ex(&evp, crypto->c, NULL,
2204 			    crypto->key.data, idata, 0);
2205     if (ret != 1) {
2206 	EVP_CIPHER_CTX_cleanup(&evp);
2207 	return HX509_CRYPTO_INTERNAL_ERROR;
2208     }
2209 
2210     clear->length = length;
2211     clear->data = malloc(length);
2212     if (clear->data == NULL) {
2213 	EVP_CIPHER_CTX_cleanup(&evp);
2214 	clear->length = 0;
2215 	return ENOMEM;
2216     }
2217 
2218     if (EVP_Cipher(&evp, clear->data, data, length) != 1) {
2219 	return HX509_CRYPTO_INTERNAL_ERROR;
2220     }
2221     EVP_CIPHER_CTX_cleanup(&evp);
2222 
2223     if (EVP_CIPHER_block_size(crypto->c) > 1) {
2224 	int padsize;
2225 	unsigned char *p;
2226 	int j, bsize = EVP_CIPHER_block_size(crypto->c);
2227 
2228 	if (clear->length < bsize) {
2229 	    ret = HX509_CMS_PADDING_ERROR;
2230 	    goto out;
2231 	}
2232 
2233 	p = clear->data;
2234 	p += clear->length - 1;
2235 	padsize = *p;
2236 	if (padsize > bsize) {
2237 	    ret = HX509_CMS_PADDING_ERROR;
2238 	    goto out;
2239 	}
2240 	clear->length -= padsize;
2241 	for (j = 0; j < padsize; j++) {
2242 	    if (*p-- != padsize) {
2243 		ret = HX509_CMS_PADDING_ERROR;
2244 		goto out;
2245 	    }
2246 	}
2247     }
2248 
2249     return 0;
2250 
2251  out:
2252     if (clear->data)
2253 	free(clear->data);
2254     clear->data = NULL;
2255     clear->length = 0;
2256     return ret;
2257 }
2258 
2259 typedef int (*PBE_string2key_func)(hx509_context,
2260 				   const char *,
2261 				   const heim_octet_string *,
2262 				   hx509_crypto *, heim_octet_string *,
2263 				   heim_octet_string *,
2264 				   const heim_oid *, const EVP_MD *);
2265 
2266 static int
2267 PBE_string2key(hx509_context context,
2268 	       const char *password,
2269 	       const heim_octet_string *parameters,
2270 	       hx509_crypto *crypto,
2271 	       heim_octet_string *key, heim_octet_string *iv,
2272 	       const heim_oid *enc_oid,
2273 	       const EVP_MD *md)
2274 {
2275     PKCS12_PBEParams p12params;
2276     int passwordlen;
2277     hx509_crypto c;
2278     int iter, saltlen, ret;
2279     unsigned char *salt;
2280 
2281     passwordlen = password ? strlen(password) : 0;
2282 
2283     if (parameters == NULL)
2284  	return HX509_ALG_NOT_SUPP;
2285 
2286     ret = decode_PKCS12_PBEParams(parameters->data,
2287 				  parameters->length,
2288 				  &p12params, NULL);
2289     if (ret)
2290 	goto out;
2291 
2292     if (p12params.iterations)
2293 	iter = *p12params.iterations;
2294     else
2295 	iter = 1;
2296     salt = p12params.salt.data;
2297     saltlen = p12params.salt.length;
2298 
2299     if (!PKCS12_key_gen (password, passwordlen, salt, saltlen,
2300 			 PKCS12_KEY_ID, iter, key->length, key->data, md)) {
2301 	ret = HX509_CRYPTO_INTERNAL_ERROR;
2302 	goto out;
2303     }
2304 
2305     if (!PKCS12_key_gen (password, passwordlen, salt, saltlen,
2306 			 PKCS12_IV_ID, iter, iv->length, iv->data, md)) {
2307 	ret = HX509_CRYPTO_INTERNAL_ERROR;
2308 	goto out;
2309     }
2310 
2311     ret = hx509_crypto_init(context, NULL, enc_oid, &c);
2312     if (ret)
2313 	goto out;
2314 
2315     ret = hx509_crypto_set_key_data(c, key->data, key->length);
2316     if (ret) {
2317 	hx509_crypto_destroy(c);
2318 	goto out;
2319     }
2320 
2321     *crypto = c;
2322 out:
2323     free_PKCS12_PBEParams(&p12params);
2324     return ret;
2325 }
2326 
2327 static const heim_oid *
2328 find_string2key(const heim_oid *oid,
2329 		const EVP_CIPHER **c,
2330 		const EVP_MD **md,
2331 		PBE_string2key_func *s2k)
2332 {
2333     if (der_heim_oid_cmp(oid, oid_id_pbewithSHAAnd40BitRC2_CBC()) == 0) {
2334 	*c = EVP_rc2_40_cbc();
2335 	*md = EVP_sha1();
2336 	*s2k = PBE_string2key;
2337 	return oid_private_rc2_40();
2338     } else if (der_heim_oid_cmp(oid, oid_id_pbeWithSHAAnd128BitRC2_CBC()) == 0) {
2339 	*c = EVP_rc2_cbc();
2340 	*md = EVP_sha1();
2341 	*s2k = PBE_string2key;
2342 	return oid_id_pkcs3_rc2_cbc();
2343 #if 0
2344     } else if (der_heim_oid_cmp(oid, oid_id_pbeWithSHAAnd40BitRC4()) == 0) {
2345 	*c = EVP_rc4_40();
2346 	*md = EVP_sha1();
2347 	*s2k = PBE_string2key;
2348 	return NULL;
2349     } else if (der_heim_oid_cmp(oid, oid_id_pbeWithSHAAnd128BitRC4()) == 0) {
2350 	*c = EVP_rc4();
2351 	*md = EVP_sha1();
2352 	*s2k = PBE_string2key;
2353 	return oid_id_pkcs3_rc4();
2354 #endif
2355     } else if (der_heim_oid_cmp(oid, oid_id_pbeWithSHAAnd3_KeyTripleDES_CBC()) == 0) {
2356 	*c = EVP_des_ede3_cbc();
2357 	*md = EVP_sha1();
2358 	*s2k = PBE_string2key;
2359 	return oid_id_pkcs3_des_ede3_cbc();
2360     }
2361 
2362     return NULL;
2363 }
2364 
2365 /*
2366  *
2367  */
2368 
2369 int
2370 _hx509_pbe_encrypt(hx509_context context,
2371 		   hx509_lock lock,
2372 		   const AlgorithmIdentifier *ai,
2373 		   const heim_octet_string *content,
2374 		   heim_octet_string *econtent)
2375 {
2376     hx509_clear_error_string(context);
2377     return EINVAL;
2378 }
2379 
2380 /*
2381  *
2382  */
2383 
2384 int
2385 _hx509_pbe_decrypt(hx509_context context,
2386 		   hx509_lock lock,
2387 		   const AlgorithmIdentifier *ai,
2388 		   const heim_octet_string *econtent,
2389 		   heim_octet_string *content)
2390 {
2391     const struct _hx509_password *pw;
2392     heim_octet_string key, iv;
2393     const heim_oid *enc_oid;
2394     const EVP_CIPHER *c;
2395     const EVP_MD *md;
2396     PBE_string2key_func s2k;
2397     int i, ret = 0;
2398 
2399     memset(&key, 0, sizeof(key));
2400     memset(&iv, 0, sizeof(iv));
2401 
2402     memset(content, 0, sizeof(*content));
2403 
2404     enc_oid = find_string2key(&ai->algorithm, &c, &md, &s2k);
2405     if (enc_oid == NULL) {
2406 	hx509_set_error_string(context, 0, HX509_ALG_NOT_SUPP,
2407 			       "String to key algorithm not supported");
2408 	ret = HX509_ALG_NOT_SUPP;
2409 	goto out;
2410     }
2411 
2412     key.length = EVP_CIPHER_key_length(c);
2413     key.data = malloc(key.length);
2414     if (key.data == NULL) {
2415 	ret = ENOMEM;
2416 	hx509_clear_error_string(context);
2417 	goto out;
2418     }
2419 
2420     iv.length = EVP_CIPHER_iv_length(c);
2421     iv.data = malloc(iv.length);
2422     if (iv.data == NULL) {
2423 	ret = ENOMEM;
2424 	hx509_clear_error_string(context);
2425 	goto out;
2426     }
2427 
2428     pw = _hx509_lock_get_passwords(lock);
2429 
2430     ret = HX509_CRYPTO_INTERNAL_ERROR;
2431     for (i = 0; i < pw->len + 1; i++) {
2432 	hx509_crypto crypto;
2433 	const char *password;
2434 
2435 	if (i < pw->len)
2436 	    password = pw->val[i];
2437 	else if (i < pw->len + 1)
2438 	    password = "";
2439 	else
2440 	    password = NULL;
2441 
2442 	ret = (*s2k)(context, password, ai->parameters, &crypto,
2443 		     &key, &iv, enc_oid, md);
2444 	if (ret)
2445 	    goto out;
2446 
2447 	ret = hx509_crypto_decrypt(crypto,
2448 				   econtent->data,
2449 				   econtent->length,
2450 				   &iv,
2451 				   content);
2452 	hx509_crypto_destroy(crypto);
2453 	if (ret == 0)
2454 	    goto out;
2455 
2456     }
2457 out:
2458     if (key.data)
2459 	der_free_octet_string(&key);
2460     if (iv.data)
2461 	der_free_octet_string(&iv);
2462     return ret;
2463 }
2464 
2465 /*
2466  *
2467  */
2468 
2469 
2470 int
2471 _hx509_match_keys(hx509_cert c, hx509_private_key private_key)
2472 {
2473     const Certificate *cert;
2474     const SubjectPublicKeyInfo *spi;
2475     RSAPublicKey pk;
2476     RSA *rsa;
2477     size_t size;
2478     int ret;
2479 
2480     if (private_key->private_key.rsa == NULL)
2481 	return 0;
2482 
2483     rsa = private_key->private_key.rsa;
2484     if (rsa->d == NULL || rsa->p == NULL || rsa->q == NULL)
2485 	return 0;
2486 
2487     cert = _hx509_get_cert(c);
2488     spi = &cert->tbsCertificate.subjectPublicKeyInfo;
2489 
2490     rsa = RSA_new();
2491     if (rsa == NULL)
2492 	return 0;
2493 
2494     ret = decode_RSAPublicKey(spi->subjectPublicKey.data,
2495 			      spi->subjectPublicKey.length / 8,
2496 			      &pk, &size);
2497     if (ret) {
2498 	RSA_free(rsa);
2499 	return 0;
2500     }
2501     rsa->n = heim_int2BN(&pk.modulus);
2502     rsa->e = heim_int2BN(&pk.publicExponent);
2503 
2504     free_RSAPublicKey(&pk);
2505 
2506     rsa->d = BN_dup(private_key->private_key.rsa->d);
2507     rsa->p = BN_dup(private_key->private_key.rsa->p);
2508     rsa->q = BN_dup(private_key->private_key.rsa->q);
2509     rsa->dmp1 = BN_dup(private_key->private_key.rsa->dmp1);
2510     rsa->dmq1 = BN_dup(private_key->private_key.rsa->dmq1);
2511     rsa->iqmp = BN_dup(private_key->private_key.rsa->iqmp);
2512 
2513     if (rsa->n == NULL || rsa->e == NULL ||
2514 	rsa->d == NULL || rsa->p == NULL|| rsa->q == NULL ||
2515 	rsa->dmp1 == NULL || rsa->dmq1 == NULL) {
2516 	RSA_free(rsa);
2517 	return 0;
2518     }
2519 
2520     ret = RSA_check_key(rsa);
2521     RSA_free(rsa);
2522 
2523     return ret == 1;
2524 }
2525 
2526 static const heim_oid *
2527 find_keytype(const hx509_private_key key)
2528 {
2529     const struct signature_alg *md;
2530 
2531     if (key == NULL)
2532 	return NULL;
2533 
2534     md = find_sig_alg(key->signature_alg);
2535     if (md == NULL)
2536 	return NULL;
2537     return (*md->key_oid)();
2538 }
2539 
2540 
2541 int
2542 hx509_crypto_select(const hx509_context context,
2543 		    int type,
2544 		    const hx509_private_key source,
2545 		    hx509_peer_info peer,
2546 		    AlgorithmIdentifier *selected)
2547 {
2548     const AlgorithmIdentifier *def;
2549     size_t i, j;
2550     int ret, bits;
2551 
2552     memset(selected, 0, sizeof(*selected));
2553 
2554     if (type == HX509_SELECT_DIGEST) {
2555 	bits = SIG_DIGEST;
2556 	def = _hx509_crypto_default_digest_alg;
2557     } else if (type == HX509_SELECT_PUBLIC_SIG) {
2558 	bits = SIG_PUBLIC_SIG;
2559 	/* XXX depend on `source� and `peer� */
2560 	def = _hx509_crypto_default_sig_alg;
2561     } else if (type == HX509_SELECT_SECRET_ENC) {
2562 	bits = SIG_SECRET;
2563 	def = _hx509_crypto_default_secret_alg;
2564     } else {
2565 	hx509_set_error_string(context, 0, EINVAL,
2566 			       "Unknown type %d of selection", type);
2567 	return EINVAL;
2568     }
2569 
2570     if (peer) {
2571 	const heim_oid *keytype = NULL;
2572 
2573 	keytype = find_keytype(source);
2574 
2575 	for (i = 0; i < peer->len; i++) {
2576 	    for (j = 0; sig_algs[j]; j++) {
2577 		if ((sig_algs[j]->flags & bits) != bits)
2578 		    continue;
2579 		if (der_heim_oid_cmp((*sig_algs[j]->sig_oid)(),
2580 				     &peer->val[i].algorithm) != 0)
2581 		    continue;
2582 		if (keytype && sig_algs[j]->key_oid &&
2583 		    der_heim_oid_cmp(keytype, (*sig_algs[j]->key_oid)()))
2584 		    continue;
2585 
2586 		/* found one, use that */
2587 		ret = copy_AlgorithmIdentifier(&peer->val[i], selected);
2588 		if (ret)
2589 		    hx509_clear_error_string(context);
2590 		return ret;
2591 	    }
2592 	    if (bits & SIG_SECRET) {
2593 		const struct hx509cipher *cipher;
2594 
2595 		cipher = find_cipher_by_oid(&peer->val[i].algorithm);
2596 		if (cipher == NULL)
2597 		    continue;
2598 		if (cipher->ai_func == NULL)
2599 		    continue;
2600 		ret = copy_AlgorithmIdentifier(cipher->ai_func(), selected);
2601 		if (ret)
2602 		    hx509_clear_error_string(context);
2603 		return ret;
2604 	    }
2605 	}
2606     }
2607 
2608     /* use default */
2609     ret = copy_AlgorithmIdentifier(def, selected);
2610     if (ret)
2611 	hx509_clear_error_string(context);
2612     return ret;
2613 }
2614 
2615 int
2616 hx509_crypto_available(hx509_context context,
2617 		       int type,
2618 		       hx509_cert source,
2619 		       AlgorithmIdentifier **val,
2620 		       unsigned int *plen)
2621 {
2622     const heim_oid *keytype = NULL;
2623     unsigned int len, i;
2624     void *ptr;
2625     int bits, ret;
2626 
2627     *val = NULL;
2628 
2629     if (type == HX509_SELECT_ALL) {
2630 	bits = SIG_DIGEST | SIG_PUBLIC_SIG | SIG_SECRET;
2631     } else if (type == HX509_SELECT_DIGEST) {
2632 	bits = SIG_DIGEST;
2633     } else if (type == HX509_SELECT_PUBLIC_SIG) {
2634 	bits = SIG_PUBLIC_SIG;
2635     } else {
2636 	hx509_set_error_string(context, 0, EINVAL,
2637 			       "Unknown type %d of available", type);
2638 	return EINVAL;
2639     }
2640 
2641     if (source)
2642 	keytype = find_keytype(_hx509_cert_private_key(source));
2643 
2644     len = 0;
2645     for (i = 0; sig_algs[i]; i++) {
2646 	if ((sig_algs[i]->flags & bits) == 0)
2647 	    continue;
2648 	if (sig_algs[i]->sig_alg == NULL)
2649 	    continue;
2650 	if (keytype && sig_algs[i]->key_oid &&
2651 	    der_heim_oid_cmp((*sig_algs[i]->key_oid)(), keytype))
2652 	    continue;
2653 
2654 	/* found one, add that to the list */
2655 	ptr = realloc(*val, sizeof(**val) * (len + 1));
2656 	if (ptr == NULL)
2657 	    goto out;
2658 	*val = ptr;
2659 
2660 	ret = copy_AlgorithmIdentifier((*sig_algs[i]->sig_alg)(), &(*val)[len]);
2661 	if (ret)
2662 	    goto out;
2663 	len++;
2664     }
2665 
2666     /* Add AES */
2667     if (bits & SIG_SECRET) {
2668 
2669 	for (i = 0; i < sizeof(ciphers)/sizeof(ciphers[0]); i++) {
2670 
2671 	    if (ciphers[i].ai_func == NULL)
2672 		continue;
2673 
2674 	    ptr = realloc(*val, sizeof(**val) * (len + 1));
2675 	    if (ptr == NULL)
2676 		goto out;
2677 	    *val = ptr;
2678 
2679 	    ret = copy_AlgorithmIdentifier((ciphers[i].ai_func)(), &(*val)[len]);
2680 	    if (ret)
2681 		goto out;
2682 	    len++;
2683 	}
2684     }
2685 
2686     *plen = len;
2687     return 0;
2688 
2689 out:
2690     for (i = 0; i < len; i++)
2691 	free_AlgorithmIdentifier(&(*val)[i]);
2692     free(*val);
2693     *val = NULL;
2694     hx509_set_error_string(context, 0, ENOMEM, "out of memory");
2695     return ENOMEM;
2696 }
2697 
2698 void
2699 hx509_crypto_free_algs(AlgorithmIdentifier *val,
2700 		       unsigned int len)
2701 {
2702     unsigned int i;
2703     for (i = 0; i < len; i++)
2704 	free_AlgorithmIdentifier(&val[i]);
2705     free(val);
2706 }
2707