1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License, Version 1.0 only 6 * (the "License"). You may not use this file except in compliance 7 * with the License. 8 * 9 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10 * or http://www.opensolaris.org/os/licensing. 11 * See the License for the specific language governing permissions 12 * and limitations under the License. 13 * 14 * When distributing Covered Code, include this CDDL HEADER in each 15 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16 * If applicable, add the following below this CDDL HEADER, with the 17 * fields enclosed by brackets "[]" replaced with your own identifying 18 * information: Portions Copyright [yyyy] [name of copyright owner] 19 * 20 * CDDL HEADER END 21 */ 22 /* 23 * Copyright 2005 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 */ 26 27 #pragma ident "%Z%%M% %I% %E% SMI" 28 29 #include <pthread.h> 30 #include <stdlib.h> 31 #include <string.h> 32 #include <strings.h> 33 #include <sys/types.h> 34 #include <security/cryptoki.h> 35 #include <aes_impl.h> 36 #include <blowfish_impl.h> 37 #include <des_impl.h> 38 #include <arcfour.h> 39 #include "softGlobal.h" 40 #include "softSession.h" 41 #include "softObject.h" 42 #include "softDSA.h" 43 #include "softRSA.h" 44 #include "softDH.h" 45 #include "softRandom.h" 46 #include "softMAC.h" 47 #include "softOps.h" 48 #include "softKeys.h" 49 #include "softKeystore.h" 50 #include "softSSL.h" 51 #include "softASN1.h" 52 53 54 #define local_min(a, b) ((a) < (b) ? (a) : (b)) 55 56 static CK_RV 57 soft_pkcs12_pbe(soft_session_t *, CK_MECHANISM_PTR, soft_object_t *); 58 59 /* 60 * Create a temporary key object struct by filling up its template attributes. 61 */ 62 CK_RV 63 soft_gen_keyobject(CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount, 64 CK_ULONG *objecthandle_p, soft_session_t *sp, 65 CK_OBJECT_CLASS class, CK_KEY_TYPE key_type, CK_ULONG keylen, CK_ULONG mode, 66 boolean_t internal) 67 { 68 69 CK_RV rv; 70 soft_object_t *new_objp = NULL; 71 72 new_objp = calloc(1, sizeof (soft_object_t)); 73 if (new_objp == NULL) { 74 return (CKR_HOST_MEMORY); 75 } 76 77 new_objp->extra_attrlistp = NULL; 78 79 /* 80 * Validate attribute template and fill in the attributes 81 * in the soft_object_t. 82 */ 83 rv = soft_build_key(pTemplate, ulCount, new_objp, class, key_type, 84 keylen, mode); 85 if (rv != CKR_OK) { 86 goto fail_cleanup1; 87 } 88 89 /* 90 * If generating a key is an internal request (i.e. not a C_XXX 91 * API request), then skip the following checks. 92 */ 93 if (!internal) { 94 rv = soft_pin_expired_check(new_objp); 95 if (rv != CKR_OK) { 96 goto fail_cleanup2; 97 } 98 99 rv = soft_object_write_access_check(sp, new_objp); 100 if (rv != CKR_OK) { 101 goto fail_cleanup2; 102 } 103 } 104 105 /* Initialize the rest of stuffs in soft_object_t. */ 106 (void) pthread_mutex_init(&new_objp->object_mutex, NULL); 107 new_objp->magic_marker = SOFTTOKEN_OBJECT_MAGIC; 108 109 /* Write the new token object to the keystore */ 110 if (IS_TOKEN_OBJECT(new_objp)) { 111 new_objp->version = 1; 112 new_objp->session_handle = (CK_SESSION_HANDLE)NULL; 113 soft_add_token_object_to_slot(new_objp); 114 /* 115 * Type casting the address of an object struct to 116 * an object handle. 117 */ 118 *objecthandle_p = (CK_ULONG)new_objp; 119 120 return (CKR_OK); 121 } 122 123 new_objp->session_handle = (CK_SESSION_HANDLE)sp; 124 125 /* Add the new object to the session's object list. */ 126 soft_add_object_to_session(new_objp, sp); 127 128 /* Type casting the address of an object struct to an object handle. */ 129 *objecthandle_p = (CK_ULONG)new_objp; 130 131 return (CKR_OK); 132 133 fail_cleanup2: 134 /* 135 * When any error occurs after soft_build_key(), we will need to 136 * clean up the memory allocated by the soft_build_key(). 137 */ 138 soft_cleanup_object(new_objp); 139 140 fail_cleanup1: 141 if (new_objp) { 142 /* 143 * The storage allocated inside of this object should have 144 * been cleaned up by the soft_build_key() if it failed. 145 * Therefore, we can safely free the object. 146 */ 147 free(new_objp); 148 } 149 150 return (rv); 151 } 152 153 CK_RV 154 soft_genkey(soft_session_t *session_p, CK_MECHANISM_PTR pMechanism, 155 CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount, CK_OBJECT_HANDLE_PTR phKey) 156 { 157 158 CK_RV rv = CKR_OK; 159 soft_object_t *secret_key; 160 CK_KEY_TYPE key_type; 161 CK_ULONG keylen = 0; 162 CK_ULONG i; 163 int des_strength = 0; 164 int retry = 0; 165 int keyfound = 0; 166 boolean_t is_ssl_mech = B_FALSE; 167 168 switch (pMechanism->mechanism) { 169 case CKM_DES_KEY_GEN: 170 key_type = CKK_DES; 171 break; 172 173 case CKM_DES3_KEY_GEN: 174 key_type = CKK_DES3; 175 break; 176 177 case CKM_AES_KEY_GEN: 178 key_type = CKK_AES; 179 break; 180 181 case CKM_BLOWFISH_KEY_GEN: 182 key_type = CKK_BLOWFISH; 183 break; 184 185 case CKM_RC4_KEY_GEN: 186 key_type = CKK_RC4; 187 break; 188 189 case CKM_SSL3_PRE_MASTER_KEY_GEN: 190 case CKM_TLS_PRE_MASTER_KEY_GEN: 191 if (pMechanism->pParameter == NULL || 192 pMechanism->ulParameterLen != sizeof (CK_VERSION)) 193 return (CKR_TEMPLATE_INCOMPLETE); 194 is_ssl_mech = B_TRUE; 195 key_type = CKK_GENERIC_SECRET; 196 keylen = 48; 197 break; 198 199 case CKM_PKCS5_PBKD2: 200 keyfound = 0; 201 for (i = 0; i < ulCount && !keyfound; i++) { 202 if (pTemplate[i].type == CKA_KEY_TYPE && 203 pTemplate[i].pValue != NULL) { 204 key_type = *((CK_KEY_TYPE*)pTemplate[i].pValue); 205 keyfound = 1; 206 } 207 } 208 if (!keyfound) 209 return (CKR_TEMPLATE_INCOMPLETE); 210 /* 211 * Make sure that parameters were given for this 212 * mechanism. 213 */ 214 if (pMechanism->pParameter == NULL || 215 pMechanism->ulParameterLen != 216 sizeof (CK_PKCS5_PBKD2_PARAMS)) 217 return (CKR_TEMPLATE_INCOMPLETE); 218 break; 219 220 case CKM_PBE_SHA1_RC4_128: 221 keyfound = 0; 222 for (i = 0; i < ulCount; i++) { 223 if (pTemplate[i].type == CKA_KEY_TYPE && 224 pTemplate[i].pValue != NULL) { 225 key_type = *((CK_KEY_TYPE*)pTemplate[i].pValue); 226 keyfound = 1; 227 } 228 if (pTemplate[i].type == CKA_VALUE_LEN && 229 pTemplate[i].pValue != NULL) { 230 keylen = *((CK_ULONG*)pTemplate[i].pValue); 231 } 232 } 233 /* If a keytype was specified, it had better be CKK_RC4 */ 234 if (keyfound && key_type != CKK_RC4) 235 return (CKR_TEMPLATE_INCONSISTENT); 236 else if (!keyfound) 237 key_type = CKK_RC4; 238 239 /* If key length was specified, it better be 16 bytes */ 240 if (keylen != 0 && keylen != 16) 241 return (CKR_TEMPLATE_INCONSISTENT); 242 243 /* 244 * Make sure that parameters were given for this 245 * mechanism. 246 */ 247 if (pMechanism->pParameter == NULL || 248 pMechanism->ulParameterLen != 249 sizeof (CK_PBE_PARAMS)) 250 return (CKR_TEMPLATE_INCOMPLETE); 251 break; 252 default: 253 return (CKR_MECHANISM_INVALID); 254 } 255 256 /* Create a new object for secret key. */ 257 rv = soft_gen_keyobject(pTemplate, ulCount, phKey, session_p, 258 CKO_SECRET_KEY, key_type, keylen, SOFT_GEN_KEY, B_FALSE); 259 260 if (rv != CKR_OK) { 261 return (rv); 262 } 263 264 /* Obtain the secret object pointer. */ 265 secret_key = (soft_object_t *)*phKey; 266 267 switch (pMechanism->mechanism) { 268 case CKM_DES_KEY_GEN: 269 /* 270 * Set up key value len since it is not a required 271 * attribute for C_GenerateKey. 272 */ 273 keylen = OBJ_SEC_VALUE_LEN(secret_key) = DES_KEYSIZE; 274 des_strength = DES; 275 break; 276 277 case CKM_DES3_KEY_GEN: 278 /* 279 * Set up key value len since it is not a required 280 * attribute for C_GenerateKey. 281 */ 282 keylen = OBJ_SEC_VALUE_LEN(secret_key) = DES3_KEYSIZE; 283 des_strength = DES3; 284 break; 285 286 case CKM_SSL3_PRE_MASTER_KEY_GEN: 287 case CKM_TLS_PRE_MASTER_KEY_GEN: 288 secret_key->bool_attr_mask |= DERIVE_BOOL_ON; 289 /* FALLTHRU */ 290 291 case CKM_AES_KEY_GEN: 292 case CKM_BLOWFISH_KEY_GEN: 293 case CKM_PBE_SHA1_RC4_128: 294 case CKM_RC4_KEY_GEN: 295 keylen = OBJ_SEC_VALUE_LEN(secret_key); 296 break; 297 298 case CKM_PKCS5_PBKD2: 299 /* 300 * PKCS#11 does not allow one to specify key 301 * sizes for DES and 3DES, so we must set it here 302 * when using PBKD2 algorithms. 303 */ 304 if (key_type == CKK_DES) { 305 OBJ_SEC_VALUE_LEN(secret_key) = DES_KEYSIZE; 306 des_strength = DES; 307 } else if (key_type == CKK_DES3) { 308 OBJ_SEC_VALUE_LEN(secret_key) = DES3_KEYSIZE; 309 des_strength = DES3; 310 } 311 312 keylen = OBJ_SEC_VALUE_LEN(secret_key); 313 break; 314 } 315 316 if ((OBJ_SEC_VALUE(secret_key) = malloc(keylen)) == NULL) { 317 if (IS_TOKEN_OBJECT(secret_key)) 318 soft_delete_token_object(secret_key, B_FALSE, B_FALSE); 319 else 320 soft_delete_object(session_p, secret_key, B_FALSE); 321 322 return (CKR_HOST_MEMORY); 323 } 324 switch (pMechanism->mechanism) { 325 case CKM_PBE_SHA1_RC4_128: 326 /* 327 * Use the PBE algorithm described in PKCS#11 section 328 * 12.33 to derive the key. 329 */ 330 rv = soft_pkcs12_pbe(session_p, pMechanism, secret_key); 331 break; 332 case CKM_PKCS5_PBKD2: 333 /* Generate keys using PKCS#5 PBKD2 algorithm */ 334 rv = soft_generate_pkcs5_pbkdf2_key(session_p, pMechanism, 335 secret_key); 336 if (rv == CKR_OK && des_strength > 0) { 337 /* Perform weak key checking for DES and DES3. */ 338 if (des_keycheck(OBJ_SEC_VALUE(secret_key), 339 des_strength, OBJ_SEC_VALUE(secret_key)) == 340 B_FALSE) { 341 /* We got a weak secret key. */ 342 rv = CKR_FUNCTION_FAILED; 343 } 344 } 345 break; 346 default: 347 do { 348 rv = soft_random_generator( 349 OBJ_SEC_VALUE(secret_key), keylen, B_FALSE); 350 351 /* If this fails, bail out */ 352 if (rv != CKR_OK) 353 break; 354 355 /* Perform weak key checking for DES and DES3. */ 356 if (des_strength > 0) { 357 rv = CKR_OK; 358 if (des_keycheck(OBJ_SEC_VALUE(secret_key), 359 des_strength, OBJ_SEC_VALUE(secret_key)) == 360 B_FALSE) { 361 /* We got a weak key, retry! */ 362 retry++; 363 rv = CKR_FUNCTION_FAILED; 364 } 365 } 366 /* 367 * Copy over the SSL client version For SSL mechs 368 * The first two bytes of the key is the version 369 */ 370 if (is_ssl_mech) 371 bcopy(pMechanism->pParameter, 372 OBJ_SEC_VALUE(secret_key), 373 sizeof (CK_VERSION)); 374 375 } while (rv != CKR_OK && retry < KEYGEN_RETRY); 376 if (retry == KEYGEN_RETRY) 377 rv = CKR_FUNCTION_FAILED; 378 break; 379 } 380 381 if (rv != CKR_OK) 382 if (IS_TOKEN_OBJECT(secret_key)) 383 soft_delete_token_object(secret_key, B_FALSE, B_FALSE); 384 else 385 soft_delete_object(session_p, secret_key, B_FALSE); 386 387 if (IS_TOKEN_OBJECT(secret_key)) { 388 /* 389 * All the info has been filled, so we can write to 390 * keystore now. 391 */ 392 rv = soft_put_object_to_keystore(secret_key); 393 if (rv != CKR_OK) 394 soft_delete_token_object(secret_key, B_FALSE, B_FALSE); 395 } 396 397 return (rv); 398 } 399 400 CK_RV 401 soft_genkey_pair(soft_session_t *session_p, CK_MECHANISM_PTR pMechanism, 402 CK_ATTRIBUTE_PTR pPublicKeyTemplate, CK_ULONG ulPublicAttrCount, 403 CK_ATTRIBUTE_PTR pPrivateKeyTemplate, CK_ULONG ulPrivateAttrCount, 404 CK_OBJECT_HANDLE_PTR phPublicKey, CK_OBJECT_HANDLE_PTR phPrivateKey) 405 { 406 407 CK_RV rv; 408 soft_object_t *public_key, *private_key; 409 CK_KEY_TYPE key_type; 410 411 switch (pMechanism->mechanism) { 412 413 case CKM_RSA_PKCS_KEY_PAIR_GEN: 414 key_type = CKK_RSA; 415 break; 416 417 case CKM_DSA_KEY_PAIR_GEN: 418 key_type = CKK_DSA; 419 break; 420 421 case CKM_DH_PKCS_KEY_PAIR_GEN: 422 key_type = CKK_DH; 423 break; 424 425 default: 426 return (CKR_MECHANISM_INVALID); 427 } 428 429 /* Create a new object for public key. */ 430 rv = soft_gen_keyobject(pPublicKeyTemplate, ulPublicAttrCount, 431 phPublicKey, session_p, CKO_PUBLIC_KEY, key_type, 0, 432 SOFT_GEN_KEY, B_FALSE); 433 434 if (rv != CKR_OK) { 435 return (rv); 436 } 437 438 /* Obtain the public object pointer. */ 439 public_key = (soft_object_t *)*phPublicKey; 440 441 /* Create a new object for private key. */ 442 rv = soft_gen_keyobject(pPrivateKeyTemplate, ulPrivateAttrCount, 443 phPrivateKey, session_p, CKO_PRIVATE_KEY, key_type, 0, 444 SOFT_GEN_KEY, B_FALSE); 445 446 if (rv != CKR_OK) { 447 /* 448 * Both public key and private key must be successful. 449 */ 450 if (IS_TOKEN_OBJECT(public_key)) 451 soft_delete_token_object(public_key, B_FALSE, B_FALSE); 452 else 453 soft_delete_object(session_p, public_key, B_FALSE); 454 return (rv); 455 } 456 457 /* Obtain the private object pointer. */ 458 private_key = (soft_object_t *)*phPrivateKey; 459 460 /* 461 * At this point, both public key and private key objects 462 * are settled with the application specified attributes. 463 * We are ready to generate the rest of key attributes based 464 * on the existing attributes. 465 */ 466 467 switch (key_type) { 468 case CKK_RSA: 469 rv = soft_rsa_genkey_pair(public_key, private_key); 470 break; 471 472 case CKK_DSA: 473 rv = soft_dsa_genkey_pair(public_key, private_key); 474 break; 475 476 case CKK_DH: 477 rv = soft_dh_genkey_pair(public_key, private_key); 478 private_key->bool_attr_mask |= DERIVE_BOOL_ON; 479 break; 480 } 481 482 if (rv != CKR_OK) { 483 if (IS_TOKEN_OBJECT(public_key)) { 484 soft_delete_token_object(public_key, B_FALSE, B_FALSE); 485 soft_delete_token_object(private_key, B_FALSE, B_FALSE); 486 } else { 487 soft_delete_object(session_p, public_key, B_FALSE); 488 soft_delete_object(session_p, private_key, B_FALSE); 489 } 490 } 491 492 if (IS_TOKEN_OBJECT(public_key)) { 493 /* 494 * All the info has been filled, so we can write to 495 * keystore now. 496 */ 497 rv = soft_put_object_to_keystore(public_key); 498 if (rv != CKR_OK) { 499 soft_delete_token_object(public_key, B_FALSE, B_FALSE); 500 soft_delete_token_object(private_key, B_FALSE, B_FALSE); 501 } 502 } 503 504 if (IS_TOKEN_OBJECT(private_key)) { 505 rv = soft_put_object_to_keystore(private_key); 506 if (rv != CKR_OK) { 507 /* 508 * We also need to delete the public token object 509 * from keystore. 510 */ 511 soft_delete_token_object(public_key, B_TRUE, B_FALSE); 512 soft_delete_token_object(private_key, B_FALSE, B_FALSE); 513 } 514 } 515 516 return (rv); 517 } 518 519 520 CK_RV 521 soft_key_derive_check_length(soft_object_t *secret_key, CK_ULONG max_keylen) 522 { 523 524 switch (secret_key->key_type) { 525 case CKK_GENERIC_SECRET: 526 if (OBJ_SEC_VALUE_LEN(secret_key) == 0) { 527 OBJ_SEC_VALUE_LEN(secret_key) = max_keylen; 528 return (CKR_OK); 529 } else if (OBJ_SEC_VALUE_LEN(secret_key) > max_keylen) { 530 return (CKR_ATTRIBUTE_VALUE_INVALID); 531 } 532 break; 533 case CKK_RC4: 534 case CKK_AES: 535 case CKK_BLOWFISH: 536 if ((OBJ_SEC_VALUE_LEN(secret_key) == 0) || 537 (OBJ_SEC_VALUE_LEN(secret_key) > max_keylen)) { 538 /* RC4 and AES has variable key length */ 539 return (CKR_ATTRIBUTE_VALUE_INVALID); 540 } 541 break; 542 case CKK_DES: 543 if (OBJ_SEC_VALUE_LEN(secret_key) == 0) { 544 /* DES has a well-defined length */ 545 OBJ_SEC_VALUE_LEN(secret_key) = DES_KEYSIZE; 546 return (CKR_OK); 547 } else if (OBJ_SEC_VALUE_LEN(secret_key) != DES_KEYSIZE) { 548 return (CKR_ATTRIBUTE_VALUE_INVALID); 549 } 550 break; 551 case CKK_DES2: 552 if (OBJ_SEC_VALUE_LEN(secret_key) == 0) { 553 /* DES2 has a well-defined length */ 554 OBJ_SEC_VALUE_LEN(secret_key) = DES2_KEYSIZE; 555 return (CKR_OK); 556 } else if (OBJ_SEC_VALUE_LEN(secret_key) != DES2_KEYSIZE) { 557 return (CKR_ATTRIBUTE_VALUE_INVALID); 558 } 559 break; 560 561 default: 562 return (CKR_MECHANISM_INVALID); 563 } 564 565 return (CKR_OK); 566 } 567 568 /* 569 * PKCS#11 (12.33) says that v = 512 bits (64 bytes) for SHA1 570 * PBE methods. 571 */ 572 #define PKCS12_BUFFER_SIZE 64 573 /* 574 * PKCS#12 defines 3 different ID bytes to be used for 575 * deriving keys for different operations. 576 */ 577 #define PBE_ID_ENCRYPT 1 578 #define PBE_ID_IV 2 579 #define PBE_ID_MAC 3 580 #define PBE_CEIL(a, b) (((a)/(b)) + (((a)%(b)) > 0)) 581 582 static CK_RV 583 soft_pkcs12_pbe(soft_session_t *session_p, 584 CK_MECHANISM_PTR pMechanism, 585 soft_object_t *derived_key) 586 { 587 CK_RV rv = CKR_OK; 588 CK_PBE_PARAMS *params = pMechanism->pParameter; 589 CK_ULONG c, i, j, k; 590 CK_ULONG hashSize; 591 CK_ULONG buffSize; 592 /* 593 * Terse variable names are used to make following 594 * the PKCS#12 spec easier. 595 */ 596 CK_BYTE *A = NULL; 597 CK_BYTE *Ai = NULL; 598 CK_BYTE *B = NULL; 599 CK_BYTE *D = NULL; 600 CK_BYTE *I = NULL, *S, *P; 601 CK_BYTE *keybuf = NULL; 602 CK_ULONG Alen, Ilen, Slen, Plen, AiLen, Blen, Dlen; 603 CK_ULONG keysize = OBJ_SEC_VALUE_LEN(derived_key); 604 CK_MECHANISM digest_mech; 605 606 /* U = hash function output bits */ 607 if (pMechanism->mechanism == CKM_PBE_SHA1_RC4_128) { 608 hashSize = SHA1_HASH_SIZE; 609 buffSize = PKCS12_BUFFER_SIZE; 610 digest_mech.mechanism = CKM_SHA_1; 611 digest_mech.pParameter = NULL; 612 digest_mech.ulParameterLen = 0; 613 } else { 614 /* we only support 1 PBE mech for now */ 615 return (CKR_MECHANISM_INVALID); 616 } 617 keybuf = OBJ_SEC_VALUE(derived_key); 618 619 Blen = Dlen = buffSize; 620 D = (CK_BYTE *)malloc(Dlen); 621 if (D == NULL) { 622 rv = CKR_HOST_MEMORY; 623 goto cleanup; 624 } 625 626 B = (CK_BYTE *)malloc(Blen); 627 if (B == NULL) { 628 rv = CKR_HOST_MEMORY; 629 goto cleanup; 630 } 631 632 /* 633 * Initialize some values and create some buffers 634 * that we need later. 635 * 636 * Slen = buffSize * CEIL(SaltLength/buffSize) 637 */ 638 Slen = buffSize * PBE_CEIL(params->ulSaltLen, buffSize); 639 640 /* 641 * Plen = buffSize * CEIL(PasswordLength/buffSize) 642 */ 643 Plen = buffSize * PBE_CEIL(params->ulPasswordLen, buffSize); 644 645 /* 646 * From step 4: I = S + P, so: Ilen = Slen + Plen 647 */ 648 Ilen = Slen + Plen; 649 I = (CK_BYTE *)malloc(Ilen); 650 if (I == NULL) { 651 rv = CKR_HOST_MEMORY; 652 goto cleanup; 653 } 654 655 S = I; 656 P = I + Slen; 657 658 /* 659 * Step 1. 660 * We are only interested in deriving keys for encrypt/decrypt 661 * for now, so construct the "D"iversifier accordingly. 662 */ 663 (void) memset(D, PBE_ID_ENCRYPT, Dlen); 664 665 /* 666 * Step 2. 667 * Concatenate copies of the salt together to make S. 668 */ 669 for (i = 0; i < Slen; i += params->ulSaltLen) { 670 (void) memcpy(S+i, params->pSalt, 671 ((Slen - i) > params->ulSaltLen ? 672 params->ulSaltLen : (Slen - i))); 673 } 674 675 /* 676 * Step 3. 677 * Concatenate copies of the password together to make 678 * a string P. 679 */ 680 for (i = 0; i < Plen; i += params->ulPasswordLen) { 681 (void) memcpy(P+i, params->pPassword, 682 ((Plen - i) > params->ulPasswordLen ? 683 params->ulPasswordLen : (Plen - i))); 684 } 685 686 /* 687 * Step 4. 688 * I = S+P - this is now done because S and P are 689 * pointers into I. 690 * 691 * Step 5. 692 * c= CEIL[n/u] 693 * where n = pseudorandom bits of output desired. 694 */ 695 c = PBE_CEIL(keysize, hashSize); 696 697 /* 698 * Step 6. 699 */ 700 Alen = c * hashSize; 701 A = (CK_BYTE *)malloc(Alen); 702 if (A == NULL) { 703 rv = CKR_HOST_MEMORY; 704 goto cleanup; 705 } 706 AiLen = hashSize; 707 Ai = (CK_BYTE *)malloc(AiLen); 708 if (Ai == NULL) { 709 rv = CKR_HOST_MEMORY; 710 goto cleanup; 711 } 712 713 /* 714 * Step 6a. 715 * Ai = Hr(D+I) 716 */ 717 for (i = 0; i < c; i++) { 718 (void) pthread_mutex_lock(&session_p->session_mutex); 719 720 if (session_p->sign.flags & CRYPTO_OPERATION_ACTIVE) { 721 (void) pthread_mutex_unlock(&session_p->session_mutex); 722 rv = CKR_OPERATION_ACTIVE; 723 goto cleanup; 724 } 725 session_p->sign.flags |= CRYPTO_OPERATION_ACTIVE; 726 (void) pthread_mutex_unlock(&session_p->session_mutex); 727 728 for (j = 0; j < params->ulIteration; j++) { 729 rv = soft_digest_init(session_p, &digest_mech); 730 if (rv != CKR_OK) 731 goto digest_done; 732 733 if (j == 0) { 734 rv = soft_digest_update(session_p, D, 735 Dlen); 736 if (rv != CKR_OK) 737 goto digest_done; 738 739 rv = soft_digest_update(session_p, I, 740 Ilen); 741 } else { 742 rv = soft_digest_update(session_p, 743 Ai, AiLen); 744 } 745 if (rv != CKR_OK) 746 goto digest_done; 747 748 rv = soft_digest_final(session_p, Ai, &AiLen); 749 if (rv != CKR_OK) 750 goto digest_done; 751 } 752 digest_done: 753 (void) pthread_mutex_lock(&session_p->session_mutex); 754 session_p->sign.flags &= ~CRYPTO_OPERATION_ACTIVE; 755 (void) pthread_mutex_unlock(&session_p->session_mutex); 756 757 if (rv != CKR_OK) 758 goto cleanup; 759 /* 760 * Step 6b. 761 * Concatenate Ai to make B 762 */ 763 for (j = 0; j < Blen; j += hashSize) { 764 (void) memcpy(B+j, Ai, ((Blen - j > hashSize) ? 765 hashSize : Blen - j)); 766 } 767 768 /* 769 * Step 6c. 770 */ 771 k = Ilen / Blen; 772 for (j = 0; j < k; j++) { 773 uchar_t idx; 774 CK_ULONG m, q = 1, cbit = 0; 775 776 for (m = Blen - 1; m >= (CK_ULONG)0; m--, q = 0) { 777 idx = m + j*Blen; 778 779 q += (CK_ULONG)I[idx] + (CK_ULONG)B[m]; 780 q += cbit; 781 I[idx] = (CK_BYTE)(q & 0xff); 782 cbit = (q > 0xff); 783 } 784 } 785 786 /* 787 * Step 7. 788 * A += Ai 789 */ 790 (void) memcpy(A + i*hashSize, Ai, AiLen); 791 } 792 793 /* 794 * Step 8. 795 * The final output of this process is the A buffer 796 */ 797 (void) memcpy(keybuf, A, keysize); 798 799 cleanup: 800 if (A) { 801 bzero(A, Alen); 802 free(A); 803 } 804 if (Ai) { 805 bzero(Ai, AiLen); 806 free(Ai); 807 } 808 if (B) { 809 bzero(B, Blen); 810 free(B); 811 } 812 if (D) { 813 bzero(D, Dlen); 814 free(D); 815 } 816 if (I) { 817 bzero(I, Ilen); 818 free(I); 819 } 820 return (rv); 821 } 822 823 CK_RV 824 soft_derivekey(soft_session_t *session_p, CK_MECHANISM_PTR pMechanism, 825 soft_object_t *basekey_p, CK_ATTRIBUTE_PTR pTemplate, 826 CK_ULONG ulAttributeCount, CK_OBJECT_HANDLE_PTR phKey) 827 { 828 829 CK_RV rv = CKR_OK; 830 soft_object_t *secret_key; 831 CK_BYTE *public_value; 832 CK_ULONG public_value_len; 833 CK_MECHANISM digest_mech; 834 CK_BYTE hash[SHA512_DIGEST_LENGTH]; /* space enough for all mechs */ 835 CK_ULONG hash_len = SHA512_DIGEST_LENGTH; 836 CK_ULONG secret_key_len; 837 CK_ULONG hash_size; 838 839 switch (pMechanism->mechanism) { 840 841 case CKM_DH_PKCS_DERIVE: 842 /* Get public value and value_len from the parameters. */ 843 public_value = (CK_BYTE *)(pMechanism->pParameter); 844 public_value_len = pMechanism->ulParameterLen; 845 846 if (phKey == NULL_PTR) 847 return (CKR_ARGUMENTS_BAD); 848 /* 849 * Create a new object for secret key. The key type should 850 * be provided in the template. 851 */ 852 rv = soft_gen_keyobject(pTemplate, ulAttributeCount, 853 phKey, session_p, CKO_SECRET_KEY, (CK_KEY_TYPE)~0UL, 0, 854 SOFT_DERIVE_KEY_DH, B_FALSE); 855 856 if (rv != CKR_OK) { 857 return (rv); 858 } 859 860 /* Obtain the secret object pointer. */ 861 secret_key = (soft_object_t *)*phKey; 862 863 rv = soft_dh_key_derive(basekey_p, secret_key, public_value, 864 public_value_len); 865 866 if (rv != CKR_OK) { 867 if (IS_TOKEN_OBJECT(secret_key)) 868 soft_delete_token_object(secret_key, B_FALSE, 869 B_FALSE); 870 else 871 soft_delete_object(session_p, secret_key, 872 B_FALSE); 873 return (rv); 874 } 875 876 break; 877 878 case CKM_SHA1_KEY_DERIVATION: 879 hash_size = SHA1_HASH_SIZE; 880 digest_mech.mechanism = CKM_SHA_1; 881 goto common; 882 883 case CKM_MD5_KEY_DERIVATION: 884 hash_size = MD5_HASH_SIZE; 885 digest_mech.mechanism = CKM_MD5; 886 goto common; 887 888 case CKM_SHA256_KEY_DERIVATION: 889 hash_size = SHA256_DIGEST_LENGTH; 890 digest_mech.mechanism = CKM_SHA256; 891 goto common; 892 893 case CKM_SHA384_KEY_DERIVATION: 894 hash_size = SHA384_DIGEST_LENGTH; 895 digest_mech.mechanism = CKM_SHA384; 896 goto common; 897 898 case CKM_SHA512_KEY_DERIVATION: 899 hash_size = SHA512_DIGEST_LENGTH; 900 digest_mech.mechanism = CKM_SHA512; 901 goto common; 902 903 common: 904 /* 905 * Create a new object for secret key. The key type is optional 906 * to be provided in the template. If it is not specified in 907 * the template, the default is CKK_GENERIC_SECRET. 908 */ 909 if (phKey == NULL_PTR) 910 return (CKR_ARGUMENTS_BAD); 911 912 rv = soft_gen_keyobject(pTemplate, ulAttributeCount, 913 phKey, session_p, CKO_SECRET_KEY, 914 (CK_KEY_TYPE)CKK_GENERIC_SECRET, 0, 915 SOFT_DERIVE_KEY_OTHER, B_FALSE); 916 917 if (rv != CKR_OK) { 918 return (rv); 919 } 920 921 /* Obtain the secret object pointer. */ 922 secret_key = (soft_object_t *)*phKey; 923 924 /* Validate the key type and key length */ 925 rv = soft_key_derive_check_length(secret_key, hash_size); 926 if (rv != CKR_OK) { 927 if (IS_TOKEN_OBJECT(secret_key)) 928 soft_delete_token_object(secret_key, B_FALSE, 929 B_FALSE); 930 else 931 soft_delete_object(session_p, secret_key, 932 B_FALSE); 933 return (rv); 934 } 935 936 /* 937 * Derive the secret key by digesting the value of another 938 * secret key (base key) with SHA-1 or MD5. 939 */ 940 rv = soft_digest_init_internal(session_p, &digest_mech); 941 if (rv != CKR_OK) { 942 if (IS_TOKEN_OBJECT(secret_key)) 943 soft_delete_token_object(secret_key, B_FALSE, 944 B_FALSE); 945 else 946 soft_delete_object(session_p, secret_key, 947 B_FALSE); 948 return (rv); 949 } 950 951 rv = soft_digest(session_p, OBJ_SEC_VALUE(basekey_p), 952 OBJ_SEC_VALUE_LEN(basekey_p), hash, &hash_len); 953 954 (void) pthread_mutex_lock(&session_p->session_mutex); 955 /* soft_digest_common() has freed the digest context */ 956 session_p->digest.flags = 0; 957 (void) pthread_mutex_unlock(&session_p->session_mutex); 958 959 if (rv != CKR_OK) { 960 if (IS_TOKEN_OBJECT(secret_key)) 961 soft_delete_token_object(secret_key, B_FALSE, 962 B_FALSE); 963 else 964 soft_delete_object(session_p, secret_key, 965 B_FALSE); 966 return (rv); 967 } 968 969 secret_key_len = OBJ_SEC_VALUE_LEN(secret_key); 970 971 if ((OBJ_SEC_VALUE(secret_key) = malloc(secret_key_len)) == 972 NULL) { 973 if (IS_TOKEN_OBJECT(secret_key)) 974 soft_delete_token_object(secret_key, B_FALSE, 975 B_FALSE); 976 else 977 soft_delete_object(session_p, secret_key, 978 B_FALSE); 979 return (CKR_HOST_MEMORY); 980 } 981 982 /* 983 * The key produced by this mechanism will be of the 984 * specified type and length. 985 * The truncation removes extra bytes from the leading 986 * of the digested key value. 987 */ 988 (void) memcpy(OBJ_SEC_VALUE(secret_key), 989 (hash + hash_len - secret_key_len), 990 secret_key_len); 991 992 break; 993 994 /* 995 * The key sensitivity and extractability rules for the generated 996 * keys will be enforced inside soft_ssl_master_key_derive() and 997 * soft_ssl_key_and_mac_derive() 998 */ 999 case CKM_SSL3_MASTER_KEY_DERIVE: 1000 case CKM_SSL3_MASTER_KEY_DERIVE_DH: 1001 case CKM_TLS_MASTER_KEY_DERIVE: 1002 case CKM_TLS_MASTER_KEY_DERIVE_DH: 1003 if (phKey == NULL_PTR) 1004 return (CKR_ARGUMENTS_BAD); 1005 return (soft_ssl_master_key_derive(session_p, pMechanism, 1006 basekey_p, pTemplate, ulAttributeCount, phKey)); 1007 1008 case CKM_SSL3_KEY_AND_MAC_DERIVE: 1009 case CKM_TLS_KEY_AND_MAC_DERIVE: 1010 return (soft_ssl_key_and_mac_derive(session_p, pMechanism, 1011 basekey_p, pTemplate, ulAttributeCount)); 1012 1013 default: 1014 return (CKR_MECHANISM_INVALID); 1015 } 1016 1017 soft_derive_enforce_flags(basekey_p, secret_key); 1018 1019 if (IS_TOKEN_OBJECT(secret_key)) { 1020 /* 1021 * All the info has been filled, so we can write to 1022 * keystore now. 1023 */ 1024 rv = soft_put_object_to_keystore(secret_key); 1025 if (rv != CKR_OK) 1026 soft_delete_token_object(secret_key, B_FALSE, B_FALSE); 1027 } 1028 1029 return (rv); 1030 } 1031 1032 1033 /* 1034 * Perform key derivation rules on key's sensitivity and extractability. 1035 */ 1036 void 1037 soft_derive_enforce_flags(soft_object_t *basekey, soft_object_t *newkey) 1038 { 1039 1040 boolean_t new_sensitive = B_FALSE; 1041 boolean_t new_extractable = B_FALSE; 1042 1043 /* 1044 * The sensitive and extractable bits have been set when 1045 * the newkey was built. 1046 */ 1047 if (newkey->bool_attr_mask & SENSITIVE_BOOL_ON) { 1048 new_sensitive = B_TRUE; 1049 } 1050 1051 if (newkey->bool_attr_mask & EXTRACTABLE_BOOL_ON) { 1052 new_extractable = B_TRUE; 1053 } 1054 1055 /* Derive the CKA_ALWAYS_SENSITIVE flag */ 1056 if (!basekey->bool_attr_mask & ALWAYS_SENSITIVE_BOOL_ON) { 1057 /* 1058 * If the base key has its CKA_ALWAYS_SENSITIVE set to 1059 * FALSE, then the derived key will as well. 1060 */ 1061 newkey->bool_attr_mask &= ~ALWAYS_SENSITIVE_BOOL_ON; 1062 } else { 1063 /* 1064 * If the base key has its CKA_ALWAYS_SENSITIVE set to TRUE, 1065 * then the derived key has the CKA_ALWAYS_SENSITIVE set to 1066 * the same value as its CKA_SENSITIVE; 1067 */ 1068 if (new_sensitive) { 1069 newkey->bool_attr_mask |= ALWAYS_SENSITIVE_BOOL_ON; 1070 } else { 1071 newkey->bool_attr_mask &= ~ALWAYS_SENSITIVE_BOOL_ON; 1072 } 1073 } 1074 1075 /* Derive the CKA_NEVER_EXTRACTABLE flag */ 1076 if (!basekey->bool_attr_mask & NEVER_EXTRACTABLE_BOOL_ON) { 1077 /* 1078 * If the base key has its CKA_NEVER_EXTRACTABLE set to 1079 * FALSE, then the derived key will as well. 1080 */ 1081 newkey->bool_attr_mask &= ~NEVER_EXTRACTABLE_BOOL_ON; 1082 } else { 1083 /* 1084 * If the base key has its CKA_NEVER_EXTRACTABLE set to TRUE, 1085 * then the derived key has the CKA_NEVER_EXTRACTABLE set to 1086 * the opposite value from its CKA_EXTRACTABLE; 1087 */ 1088 if (new_extractable) { 1089 newkey->bool_attr_mask &= ~NEVER_EXTRACTABLE_BOOL_ON; 1090 } else { 1091 newkey->bool_attr_mask |= NEVER_EXTRACTABLE_BOOL_ON; 1092 } 1093 } 1094 1095 /* Set the CKA_LOCAL flag to false */ 1096 newkey->bool_attr_mask &= ~LOCAL_BOOL_ON; 1097 } 1098 1099 1100 /* 1101 * do_prf 1102 * 1103 * This routine implements Step 3. of the PBKDF2 function 1104 * defined in PKCS#5 for generating derived keys from a 1105 * password. 1106 * 1107 * Currently, PRF is always SHA_1_HMAC. 1108 */ 1109 static CK_RV 1110 do_prf(soft_session_t *session_p, 1111 CK_PKCS5_PBKD2_PARAMS_PTR params, 1112 soft_object_t *hmac_key, 1113 CK_BYTE *newsalt, CK_ULONG saltlen, 1114 CK_BYTE *blockdata, CK_ULONG blocklen) 1115 { 1116 CK_RV rv = CKR_OK; 1117 CK_MECHANISM digest_mech = {CKM_SHA_1_HMAC, NULL, 0}; 1118 CK_BYTE buffer[2][SHA1_HASH_SIZE]; 1119 CK_ULONG hmac_outlen = SHA1_HASH_SIZE; 1120 CK_ULONG inlen; 1121 CK_BYTE *input, *output; 1122 CK_ULONG i, j; 1123 1124 input = newsalt; 1125 inlen = saltlen; 1126 1127 output = buffer[1]; 1128 (void) pthread_mutex_lock(&session_p->session_mutex); 1129 1130 if (session_p->sign.flags & CRYPTO_OPERATION_ACTIVE) { 1131 (void) pthread_mutex_unlock(&session_p->session_mutex); 1132 return (CKR_OPERATION_ACTIVE); 1133 } 1134 session_p->sign.flags |= CRYPTO_OPERATION_ACTIVE; 1135 (void) pthread_mutex_unlock(&session_p->session_mutex); 1136 1137 for (i = 0; i < params->iterations; i++) { 1138 /* 1139 * The key doesn't change, its always the 1140 * password iniitally given. 1141 */ 1142 rv = soft_sign_init(session_p, &digest_mech, hmac_key); 1143 1144 if (rv != CKR_OK) { 1145 goto cleanup; 1146 } 1147 1148 /* Call PRF function (SHA1_HMAC for now). */ 1149 rv = soft_sign(session_p, input, inlen, 1150 output, &hmac_outlen); 1151 1152 if (rv != CKR_OK) { 1153 goto cleanup; 1154 } 1155 /* 1156 * The first time, initialize the output buffer 1157 * with the HMAC signature. 1158 */ 1159 if (i == 0) { 1160 (void) memcpy(blockdata, output, 1161 local_min(blocklen, hmac_outlen)); 1162 } else { 1163 /* 1164 * XOR the existing data with output from PRF. 1165 * 1166 * Only XOR up to the length of the blockdata, 1167 * it may be less than a full hmac buffer when 1168 * the final block is being computed. 1169 */ 1170 for (j = 0; j < hmac_outlen && j < blocklen; j++) 1171 blockdata[j] ^= output[j]; 1172 } 1173 /* Output from previous PRF is input for next round */ 1174 input = output; 1175 inlen = hmac_outlen; 1176 1177 /* 1178 * Switch buffers to avoid overuse of memcpy. 1179 * Initially we used buffer[1], so after the end of 1180 * the first iteration (i==0), we switch to buffer[0] 1181 * and continue swapping with each iteration. 1182 */ 1183 output = buffer[i%2]; 1184 } 1185 cleanup: 1186 (void) pthread_mutex_lock(&session_p->session_mutex); 1187 session_p->sign.flags &= ~CRYPTO_OPERATION_ACTIVE; 1188 (void) pthread_mutex_unlock(&session_p->session_mutex); 1189 1190 return (rv); 1191 } 1192 1193 static CK_RV 1194 soft_create_hmac_key(soft_session_t *session_p, CK_BYTE *passwd, 1195 CK_ULONG passwd_len, CK_OBJECT_HANDLE_PTR phKey) 1196 { 1197 CK_RV rv = CKR_OK; 1198 CK_OBJECT_CLASS keyclass = CKO_SECRET_KEY; 1199 CK_KEY_TYPE keytype = CKK_GENERIC_SECRET; 1200 CK_BBOOL True = TRUE; 1201 CK_ATTRIBUTE keytemplate[4]; 1202 /* 1203 * We must initialize each template member individually 1204 * because at the time of initial coding for ON10, the 1205 * compiler was using the "-xc99=%none" option 1206 * which prevents us from being able to declare the whole 1207 * template in place as usual. 1208 */ 1209 keytemplate[0].type = CKA_CLASS; 1210 keytemplate[0].pValue = &keyclass; 1211 keytemplate[0].ulValueLen = sizeof (keyclass); 1212 1213 keytemplate[1].type = CKA_KEY_TYPE; 1214 keytemplate[1].pValue = &keytype; 1215 keytemplate[1].ulValueLen = sizeof (keytype); 1216 1217 keytemplate[2].type = CKA_SIGN; 1218 keytemplate[2].pValue = &True; 1219 keytemplate[2].ulValueLen = sizeof (True); 1220 1221 keytemplate[3].type = CKA_VALUE; 1222 keytemplate[3].pValue = passwd; 1223 keytemplate[3].ulValueLen = passwd_len; 1224 /* 1225 * Create a generic key object to be used for HMAC operations. 1226 * The "value" for this key is the password from the 1227 * mechanism parameter structure. 1228 */ 1229 rv = soft_gen_keyobject(keytemplate, 1230 sizeof (keytemplate)/sizeof (CK_ATTRIBUTE), 1231 phKey, session_p, CKO_SECRET_KEY, 1232 (CK_KEY_TYPE)CKK_GENERIC_SECRET, 0, 1233 SOFT_CREATE_OBJ, B_TRUE); 1234 1235 return (rv); 1236 } 1237 1238 CK_RV 1239 soft_generate_pkcs5_pbkdf2_key(soft_session_t *session_p, 1240 CK_MECHANISM_PTR pMechanism, 1241 soft_object_t *secret_key) 1242 { 1243 CK_RV rv = CKR_OK; 1244 CK_PKCS5_PBKD2_PARAMS *params = 1245 (CK_PKCS5_PBKD2_PARAMS *)pMechanism->pParameter; 1246 CK_ULONG hLen = SHA1_HASH_SIZE; 1247 CK_ULONG dkLen, i; 1248 CK_ULONG blocks, remainder; 1249 CK_OBJECT_HANDLE phKey = 0; 1250 soft_object_t *hmac_key = NULL; 1251 CK_BYTE *salt = NULL; 1252 CK_BYTE *keydata = NULL; 1253 1254 params = (CK_PKCS5_PBKD2_PARAMS_PTR) pMechanism->pParameter; 1255 1256 if (params->prf != CKP_PKCS5_PBKD2_HMAC_SHA1) 1257 return (CKR_MECHANISM_PARAM_INVALID); 1258 1259 if (params->pPrfData != NULL || params->ulPrfDataLen != 0) 1260 return (CKR_DATA_INVALID); 1261 1262 if (params->saltSource != CKZ_SALT_SPECIFIED || 1263 params->iterations == 0) 1264 return (CKR_MECHANISM_PARAM_INVALID); 1265 1266 /* 1267 * Create a key object to use for HMAC operations. 1268 */ 1269 rv = soft_create_hmac_key(session_p, params->pPassword, 1270 *params->ulPasswordLen, &phKey); 1271 1272 if (rv != CKR_OK) 1273 return (rv); 1274 1275 hmac_key = (soft_object_t *)phKey; 1276 1277 /* Step 1. */ 1278 dkLen = OBJ_SEC_VALUE_LEN(secret_key); /* length of desired key */ 1279 1280 if (dkLen > ((((u_longlong_t)1)<<32)-1)*hLen) { 1281 (void) soft_delete_object(session_p, hmac_key, B_FALSE); 1282 return (CKR_KEY_SIZE_RANGE); 1283 } 1284 1285 /* Step 2. */ 1286 blocks = dkLen / hLen; 1287 1288 /* crude "Ceiling" function to adjust the number of blocks to use */ 1289 if (blocks * hLen != dkLen) 1290 blocks++; 1291 1292 remainder = dkLen - ((blocks - 1) * hLen); 1293 1294 /* Step 3 */ 1295 salt = (CK_BYTE *)malloc(params->ulSaltSourceDataLen + 4); 1296 if (salt == NULL) { 1297 (void) soft_delete_object(session_p, hmac_key, B_FALSE); 1298 return (CKR_HOST_MEMORY); 1299 } 1300 /* 1301 * Nothing in PKCS#5 says you cannot pass an empty 1302 * salt, so we will allow for this and not return error 1303 * if the salt is not specified. 1304 */ 1305 if (params->pSaltSourceData != NULL && 1306 params->ulSaltSourceDataLen > 0) 1307 (void) memcpy(salt, params->pSaltSourceData, 1308 params->ulSaltSourceDataLen); 1309 1310 /* 1311 * Get pointer to the data section of the key, 1312 * this will be used below as output from the 1313 * PRF iteration/concatenations so that when the 1314 * blocks are all iterated, the secret_key will 1315 * have the resulting derived key value. 1316 */ 1317 keydata = (CK_BYTE *)OBJ_SEC_VALUE(secret_key); 1318 1319 /* Step 4. */ 1320 for (i = 0; i < blocks && (rv == CKR_OK); i++) { 1321 CK_BYTE *s; 1322 1323 s = salt + params->ulSaltSourceDataLen; 1324 1325 /* 1326 * Append the block index to the salt as input 1327 * to the PRF. Block index should start at 1 1328 * not 0. 1329 */ 1330 *s++ = ((i+1) >> 24) & 0xff; 1331 *s++ = ((i+1) >> 16) & 0xff; 1332 *s++ = ((i+1) >> 8) & 0xff; 1333 *s = ((i+1)) & 0xff; 1334 1335 /* 1336 * Adjust the key pointer so we always append the 1337 * PRF output to the current key. 1338 */ 1339 rv = do_prf(session_p, params, hmac_key, 1340 salt, params->ulSaltSourceDataLen + 4, 1341 keydata, 1342 ((i + 1) == blocks ? remainder : hLen)); 1343 1344 keydata += hLen; 1345 } 1346 (void) soft_delete_object(session_p, hmac_key, B_FALSE); 1347 free(salt); 1348 1349 return (rv); 1350 } 1351 1352 CK_RV 1353 soft_wrapkey(soft_session_t *session_p, CK_MECHANISM_PTR pMechanism, 1354 soft_object_t *wrappingKey_p, soft_object_t *hkey_p, 1355 CK_BYTE_PTR pWrappedKey, CK_ULONG_PTR pulWrappedKeyLen) 1356 { 1357 CK_RV rv = CKR_OK; 1358 CK_ULONG plain_len = 0; 1359 CK_BYTE_PTR plain_data = NULL; 1360 CK_ULONG padded_len = 0; 1361 CK_BYTE_PTR padded_data = NULL; 1362 CK_ULONG wkey_blksz = 1; /* so modulo will work right */ 1363 1364 /* Check if the mechanism is supported. */ 1365 switch (pMechanism->mechanism) { 1366 case CKM_DES_CBC_PAD: 1367 case CKM_DES3_CBC_PAD: 1368 case CKM_AES_CBC_PAD: 1369 /* 1370 * Secret key mechs with padding can be used to wrap secret 1371 * keys and private keys only. See PKCS#11, * sec 11.14, 1372 * C_WrapKey and secs 12.* for each mechanism's wrapping/ 1373 * unwrapping constraints. 1374 */ 1375 if (hkey_p->class != CKO_SECRET_KEY && hkey_p->class != 1376 CKO_PRIVATE_KEY) 1377 return (CKR_MECHANISM_INVALID); 1378 break; 1379 case CKM_RSA_PKCS: 1380 case CKM_RSA_X_509: 1381 case CKM_DES_ECB: 1382 case CKM_DES3_ECB: 1383 case CKM_AES_ECB: 1384 case CKM_DES_CBC: 1385 case CKM_DES3_CBC: 1386 case CKM_AES_CBC: 1387 case CKM_BLOWFISH_CBC: 1388 /* 1389 * Unpadded secret key mechs and private key mechs are only 1390 * defined for wrapping secret keys. See PKCS#11 refs above. 1391 */ 1392 if (hkey_p->class != CKO_SECRET_KEY) 1393 return (CKR_MECHANISM_INVALID); 1394 break; 1395 default: 1396 return (CKR_MECHANISM_INVALID); 1397 } 1398 1399 if (hkey_p->class == CKO_SECRET_KEY) { 1400 plain_data = OBJ_SEC_VALUE(hkey_p); 1401 plain_len = OBJ_SEC_VALUE_LEN(hkey_p); 1402 } else { 1403 /* 1404 * BER-encode the object to be wrapped: call first with 1405 * plain_data = NULL to get the size needed, allocate that 1406 * much space, call again to fill space with actual data. 1407 */ 1408 rv = soft_object_to_asn1(hkey_p, NULL, &plain_len); 1409 if (rv != CKR_OK) 1410 return (rv); 1411 if ((plain_data = malloc(plain_len)) == NULL) 1412 return (CKR_HOST_MEMORY); 1413 (void) memset(plain_data, 0x0, plain_len); 1414 rv = soft_object_to_asn1(hkey_p, plain_data, &plain_len); 1415 if (rv != CKR_OK) 1416 goto cleanup_wrap; 1417 } 1418 1419 /* 1420 * For unpadded ECB and CBC mechanisms, the object needs to be 1421 * padded to the wrapping key's blocksize prior to the encryption. 1422 */ 1423 padded_len = plain_len; 1424 padded_data = plain_data; 1425 1426 switch (pMechanism->mechanism) { 1427 case CKM_DES_ECB: 1428 case CKM_DES3_ECB: 1429 case CKM_AES_ECB: 1430 case CKM_DES_CBC: 1431 case CKM_DES3_CBC: 1432 case CKM_AES_CBC: 1433 case CKM_BLOWFISH_CBC: 1434 /* Find the block size of the wrapping key. */ 1435 if (wrappingKey_p->class == CKO_SECRET_KEY) { 1436 switch (wrappingKey_p->key_type) { 1437 case CKK_DES: 1438 case CKK_DES2: 1439 case CKK_DES3: 1440 wkey_blksz = DES_BLOCK_LEN; 1441 break; 1442 case CKK_AES: 1443 wkey_blksz = AES_BLOCK_LEN; 1444 break; 1445 case CKK_BLOWFISH: 1446 wkey_blksz = BLOWFISH_BLOCK_LEN; 1447 break; 1448 default: 1449 break; 1450 } 1451 } else { 1452 rv = CKR_WRAPPING_KEY_TYPE_INCONSISTENT; 1453 goto cleanup_wrap; 1454 } 1455 1456 /* Extend the plain text data to block size boundary. */ 1457 if ((padded_len % wkey_blksz) != 0) { 1458 padded_len += (wkey_blksz - (plain_len % wkey_blksz)); 1459 if ((padded_data = malloc(padded_len)) == NULL) { 1460 rv = CKR_HOST_MEMORY; 1461 goto cleanup_wrap; 1462 } 1463 (void) memset(padded_data, 0x0, padded_len); 1464 (void) memcpy(padded_data, plain_data, plain_len); 1465 } 1466 break; 1467 default: 1468 break; 1469 } 1470 1471 rv = soft_encrypt_init(session_p, pMechanism, wrappingKey_p); 1472 if (rv != CKR_OK) 1473 goto cleanup_wrap; 1474 1475 rv = soft_encrypt(session_p, padded_data, padded_len, 1476 pWrappedKey, pulWrappedKeyLen); 1477 1478 cleanup_wrap: 1479 if (padded_data != NULL && padded_len != plain_len) { 1480 /* Clear buffer before returning to memory pool. */ 1481 (void) memset(padded_data, 0x0, padded_len); 1482 free(padded_data); 1483 } 1484 1485 if ((hkey_p->class != CKO_SECRET_KEY) && (plain_data != NULL)) { 1486 /* Clear buffer before returning to memory pool. */ 1487 (void) memset(plain_data, 0x0, plain_len); 1488 free(plain_data); 1489 } 1490 1491 return (rv); 1492 } 1493 1494 /* 1495 * Quick check for whether unwrapped key length is appropriate for key type 1496 * and whether it needs to be truncated (in case the wrapping function had 1497 * to pad the key prior to wrapping). 1498 */ 1499 static CK_RV 1500 soft_unwrap_secret_len_check(CK_KEY_TYPE keytype, CK_MECHANISM_TYPE mechtype, 1501 CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulAttributeCount) 1502 { 1503 CK_ULONG i; 1504 boolean_t isValueLen = B_FALSE; 1505 1506 /* 1507 * Based on the key type and the mech used to unwrap, need to 1508 * determine if CKA_VALUE_LEN should or should not be specified. 1509 * PKCS#11 v2.11 restricts CKA_VALUE_LEN from being specified 1510 * for C_UnwrapKey for all mechs and key types, but v2.20 loosens 1511 * that restriction, perhaps because it makes it impossible to 1512 * determine the original length of unwrapped variable-length secret 1513 * keys, such as RC4, AES, and GENERIC_SECRET. These variable-length 1514 * secret keys would have been padded with trailing null-bytes so 1515 * that they could be successfully wrapped with *_ECB and *_CBC 1516 * mechanisms. Hence for unwrapping with these mechs, CKA_VALUE_LEN 1517 * must be specified. For unwrapping with other mechs, such as 1518 * *_CBC_PAD, the CKA_VALUE_LEN is not needed. 1519 */ 1520 1521 /* Find out if template has CKA_VALUE_LEN. */ 1522 for (i = 0; i < ulAttributeCount; i++) { 1523 if (pTemplate[i].type == CKA_VALUE_LEN && 1524 pTemplate[i].pValue != NULL) { 1525 isValueLen = B_TRUE; 1526 break; 1527 } 1528 } 1529 1530 /* Does its presence conflict with the mech type and key type? */ 1531 switch (mechtype) { 1532 case CKM_DES_ECB: 1533 case CKM_DES3_ECB: 1534 case CKM_AES_ECB: 1535 case CKM_DES_CBC: 1536 case CKM_DES3_CBC: 1537 case CKM_AES_CBC: 1538 case CKM_BLOWFISH_CBC: 1539 /* 1540 * CKA_VALUE_LEN must be specified 1541 * if keytype is CKK_RC4, CKK_AES and CKK_GENERIC_SECRET 1542 * and must not be specified otherwise 1543 */ 1544 switch (keytype) { 1545 case CKK_DES: 1546 case CKK_DES2: 1547 case CKK_DES3: 1548 if (isValueLen) 1549 return (CKR_TEMPLATE_INCONSISTENT); 1550 break; 1551 case CKK_GENERIC_SECRET: 1552 case CKK_RC4: 1553 case CKK_AES: 1554 case CKK_BLOWFISH: 1555 if (!isValueLen) 1556 return (CKR_TEMPLATE_INCOMPLETE); 1557 break; 1558 default: 1559 return (CKR_FUNCTION_NOT_SUPPORTED); 1560 } 1561 break; 1562 default: 1563 /* CKA_VALUE_LEN must not be specified */ 1564 if (isValueLen) 1565 return (CKR_TEMPLATE_INCONSISTENT); 1566 break; 1567 } 1568 1569 return (CKR_OK); 1570 } 1571 1572 CK_RV 1573 soft_unwrapkey(soft_session_t *session_p, CK_MECHANISM_PTR pMechanism, 1574 soft_object_t *unwrappingkey_p, 1575 CK_BYTE_PTR pWrappedKey, CK_ULONG ulWrappedKeyLen, 1576 CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulAttributeCount, 1577 CK_OBJECT_HANDLE_PTR phKey) 1578 { 1579 CK_RV rv = CKR_OK; 1580 CK_OBJECT_CLASS new_obj_class = ~0UL; 1581 int i = 0; 1582 soft_object_t *new_objp = NULL; 1583 boolean_t persistent = B_FALSE; 1584 CK_BYTE_PTR plain_data = NULL; 1585 CK_ULONG plain_len = 0; 1586 secret_key_obj_t *sck = NULL; 1587 1588 /* Scan the attribute template for the object class. */ 1589 if (pTemplate != NULL && ulAttributeCount != 0) { 1590 for (i = 0; i < ulAttributeCount; i++) { 1591 if (pTemplate[i].type == CKA_CLASS) { 1592 new_obj_class = 1593 *((CK_OBJECT_CLASS *)pTemplate[i].pValue); 1594 break; 1595 } 1596 } 1597 if (new_obj_class == ~0UL) 1598 return (CKR_TEMPLATE_INCOMPLETE); 1599 } 1600 1601 /* 1602 * Check if the mechanism is supported, and now that the new 1603 * object's class is known, the mechanism selected should be 1604 * capable of doing the unwrap. 1605 */ 1606 switch (pMechanism->mechanism) { 1607 case CKM_RSA_PKCS: 1608 case CKM_RSA_X_509: 1609 case CKM_DES_ECB: 1610 case CKM_DES3_ECB: 1611 case CKM_AES_ECB: 1612 case CKM_DES_CBC: 1613 case CKM_DES3_CBC: 1614 case CKM_AES_CBC: 1615 case CKM_BLOWFISH_CBC: 1616 if (new_obj_class != CKO_SECRET_KEY) 1617 return (CKR_MECHANISM_INVALID); 1618 break; 1619 case CKM_DES_CBC_PAD: 1620 case CKM_DES3_CBC_PAD: 1621 case CKM_AES_CBC_PAD: 1622 if (new_obj_class != CKO_SECRET_KEY && new_obj_class != 1623 CKO_PRIVATE_KEY) 1624 return (CKR_MECHANISM_INVALID); 1625 break; 1626 default: 1627 return (CKR_MECHANISM_INVALID); 1628 } 1629 1630 /* Create a new object based on the attribute template. */ 1631 rv = soft_gen_keyobject(pTemplate, ulAttributeCount, 1632 (CK_ULONG *)&new_objp, session_p, (CK_OBJECT_CLASS)~0UL, 1633 (CK_KEY_TYPE)~0UL, 0, SOFT_UNWRAP_KEY, B_FALSE); 1634 if (rv != CKR_OK) 1635 return (rv); 1636 1637 /* 1638 * New key will have CKA_ALWAYS_SENSITIVE and CKA_NEVER_EXTRACTABLE 1639 * both set to FALSE. CKA_EXTRACTABLE will be set _by_default_ to 1640 * true -- leaving the possibility that it may be set FALSE by the 1641 * supplied attribute template. If the precise template cannot be 1642 * supported, unwrap fails. PKCS#11 spec, Sec. 11.14, C_UnwrapKey. 1643 * 1644 * Therefore, check the new object's NEVER_EXTRACTABLE_BOOL_ON and 1645 * ALWAYS_SENSITVE_BOOL_ON; if they are TRUE, the template must 1646 * have supplied them and therefore we cannot honor the unwrap. 1647 */ 1648 if ((new_objp->bool_attr_mask & NEVER_EXTRACTABLE_BOOL_ON) || 1649 (new_objp->bool_attr_mask & ALWAYS_SENSITIVE_BOOL_ON)) { 1650 rv = CKR_TEMPLATE_INCONSISTENT; 1651 goto cleanup_unwrap; 1652 } 1653 1654 rv = soft_decrypt_init(session_p, pMechanism, unwrappingkey_p); 1655 if (rv != CKR_OK) 1656 goto cleanup_unwrap; 1657 1658 /* First get the length of the plain data */ 1659 rv = soft_decrypt(session_p, pWrappedKey, ulWrappedKeyLen, NULL, 1660 &plain_len); 1661 if (rv != CKR_OK) 1662 goto cleanup_unwrap; 1663 1664 /* Allocate space for the unwrapped data */ 1665 if ((plain_data = malloc(plain_len)) == NULL) { 1666 rv = CKR_HOST_MEMORY; 1667 goto cleanup_unwrap; 1668 } 1669 (void) memset(plain_data, 0x0, plain_len); 1670 1671 /* Perform actual decryption into the allocated space. */ 1672 rv = soft_decrypt(session_p, pWrappedKey, ulWrappedKeyLen, plain_data, 1673 &plain_len); 1674 if (rv != CKR_OK) 1675 goto cleanup_unwrap; 1676 1677 if (new_objp->class == CKO_SECRET_KEY) { 1678 /* 1679 * Since no ASN.1 encoding is done for secret keys, check for 1680 * appropriateness and copy decrypted buffer to the key object. 1681 */ 1682 1683 /* Check keytype and mechtype don't conflict with valuelen */ 1684 rv = soft_unwrap_secret_len_check(new_objp->key_type, 1685 pMechanism->mechanism, pTemplate, ulAttributeCount); 1686 if (rv != CKR_OK) 1687 goto cleanup_unwrap; 1688 1689 /* 1690 * Allocate the secret key structure if not already there; 1691 * it will exist for variable length keys since CKA_VALUE_LEN 1692 * is specified and saved, but not for fixed length keys. 1693 */ 1694 if (OBJ_SEC(new_objp) == NULL) { 1695 if ((sck = calloc(1, sizeof (secret_key_obj_t))) == 1696 NULL) { 1697 rv = CKR_HOST_MEMORY; 1698 goto cleanup_unwrap; 1699 } 1700 OBJ_SEC(new_objp) = sck; 1701 } 1702 1703 switch (new_objp->key_type) { 1704 /* Fixed length secret keys don't have CKA_VALUE_LEN */ 1705 case CKK_DES: 1706 OBJ_SEC_VALUE_LEN(new_objp) = DES_KEYSIZE; 1707 break; 1708 case CKK_DES2: 1709 OBJ_SEC_VALUE_LEN(new_objp) = DES2_KEYSIZE; 1710 break; 1711 case CKK_DES3: 1712 OBJ_SEC_VALUE_LEN(new_objp) = DES3_KEYSIZE; 1713 break; 1714 1715 /* 1716 * Variable length secret keys. CKA_VALUE_LEN must be 1717 * provided by the template when mech is *_ECB or *_CBC, and 1718 * should already have been set during soft_gen_keyobject(). 1719 * Otherwise we don't need CKA_VALUE_LEN. 1720 */ 1721 case CKK_GENERIC_SECRET: 1722 case CKK_RC4: 1723 case CKK_AES: 1724 case CKK_BLOWFISH: 1725 break; 1726 default: 1727 rv = CKR_WRAPPED_KEY_INVALID; 1728 goto cleanup_unwrap; 1729 }; 1730 1731 if (OBJ_SEC_VALUE_LEN(new_objp) == 0) { 1732 /* No CKA_VALUE_LEN set so set it now and save data */ 1733 OBJ_SEC_VALUE_LEN(new_objp) = plain_len; 1734 OBJ_SEC_VALUE(new_objp) = plain_data; 1735 } else if (OBJ_SEC_VALUE_LEN(new_objp) == plain_len) { 1736 /* No need to truncate, just save the data */ 1737 OBJ_SEC_VALUE(new_objp) = plain_data; 1738 } else if (OBJ_SEC_VALUE_LEN(new_objp) > plain_len) { 1739 /* Length can't be bigger than what was decrypted */ 1740 rv = CKR_WRAPPED_KEY_LEN_RANGE; 1741 goto cleanup_unwrap; 1742 } else { /* betw 0 and plain_len, hence padded */ 1743 /* Truncate the data before saving. */ 1744 OBJ_SEC_VALUE(new_objp) = realloc(plain_data, 1745 OBJ_SEC_VALUE_LEN(new_objp)); 1746 if (OBJ_SEC_VALUE(new_objp) == NULL) { 1747 rv = CKR_HOST_MEMORY; 1748 goto cleanup_unwrap; 1749 } 1750 } 1751 } else { 1752 /* BER-decode the object to be unwrapped. */ 1753 rv = soft_asn1_to_object(new_objp, plain_data, plain_len); 1754 if (rv != CKR_OK) 1755 goto cleanup_unwrap; 1756 } 1757 1758 /* If it needs to be persistent, write it to the keystore */ 1759 if (IS_TOKEN_OBJECT(new_objp)) { 1760 persistent = B_TRUE; 1761 rv = soft_put_object_to_keystore(new_objp); 1762 if (rv != CKR_OK) 1763 goto cleanup_unwrap; 1764 } 1765 1766 if (new_objp->class != CKO_SECRET_KEY) { 1767 /* Clear buffer before returning to memory pool. */ 1768 (void) memset(plain_data, 0x0, plain_len); 1769 free(plain_data); 1770 } 1771 1772 *phKey = (CK_OBJECT_HANDLE)new_objp; 1773 1774 return (CKR_OK); 1775 1776 cleanup_unwrap: 1777 /* The decrypted private key buffer must be freed explicitly. */ 1778 if ((new_objp->class != CKO_SECRET_KEY) && (plain_data != NULL)) { 1779 /* Clear buffer before returning to memory pool. */ 1780 (void) memset(plain_data, 0x0, plain_len); 1781 free(plain_data); 1782 } 1783 1784 /* sck and new_objp are indirectly free()d inside these functions */ 1785 if (IS_TOKEN_OBJECT(new_objp)) 1786 soft_delete_token_object(new_objp, persistent, B_FALSE); 1787 else 1788 soft_delete_object(session_p, new_objp, B_FALSE); 1789 1790 return (rv); 1791 } 1792