1*0Sstevel@tonic-gate /* crypto/asn1/a_sign.c */ 2*0Sstevel@tonic-gate /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 3*0Sstevel@tonic-gate * All rights reserved. 4*0Sstevel@tonic-gate * 5*0Sstevel@tonic-gate * This package is an SSL implementation written 6*0Sstevel@tonic-gate * by Eric Young (eay@cryptsoft.com). 7*0Sstevel@tonic-gate * The implementation was written so as to conform with Netscapes SSL. 8*0Sstevel@tonic-gate * 9*0Sstevel@tonic-gate * This library is free for commercial and non-commercial use as long as 10*0Sstevel@tonic-gate * the following conditions are aheared to. The following conditions 11*0Sstevel@tonic-gate * apply to all code found in this distribution, be it the RC4, RSA, 12*0Sstevel@tonic-gate * lhash, DES, etc., code; not just the SSL code. The SSL documentation 13*0Sstevel@tonic-gate * included with this distribution is covered by the same copyright terms 14*0Sstevel@tonic-gate * except that the holder is Tim Hudson (tjh@cryptsoft.com). 15*0Sstevel@tonic-gate * 16*0Sstevel@tonic-gate * Copyright remains Eric Young's, and as such any Copyright notices in 17*0Sstevel@tonic-gate * the code are not to be removed. 18*0Sstevel@tonic-gate * If this package is used in a product, Eric Young should be given attribution 19*0Sstevel@tonic-gate * as the author of the parts of the library used. 20*0Sstevel@tonic-gate * This can be in the form of a textual message at program startup or 21*0Sstevel@tonic-gate * in documentation (online or textual) provided with the package. 22*0Sstevel@tonic-gate * 23*0Sstevel@tonic-gate * Redistribution and use in source and binary forms, with or without 24*0Sstevel@tonic-gate * modification, are permitted provided that the following conditions 25*0Sstevel@tonic-gate * are met: 26*0Sstevel@tonic-gate * 1. Redistributions of source code must retain the copyright 27*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer. 28*0Sstevel@tonic-gate * 2. Redistributions in binary form must reproduce the above copyright 29*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer in the 30*0Sstevel@tonic-gate * documentation and/or other materials provided with the distribution. 31*0Sstevel@tonic-gate * 3. All advertising materials mentioning features or use of this software 32*0Sstevel@tonic-gate * must display the following acknowledgement: 33*0Sstevel@tonic-gate * "This product includes cryptographic software written by 34*0Sstevel@tonic-gate * Eric Young (eay@cryptsoft.com)" 35*0Sstevel@tonic-gate * The word 'cryptographic' can be left out if the rouines from the library 36*0Sstevel@tonic-gate * being used are not cryptographic related :-). 37*0Sstevel@tonic-gate * 4. If you include any Windows specific code (or a derivative thereof) from 38*0Sstevel@tonic-gate * the apps directory (application code) you must include an acknowledgement: 39*0Sstevel@tonic-gate * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" 40*0Sstevel@tonic-gate * 41*0Sstevel@tonic-gate * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND 42*0Sstevel@tonic-gate * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 43*0Sstevel@tonic-gate * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 44*0Sstevel@tonic-gate * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 45*0Sstevel@tonic-gate * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 46*0Sstevel@tonic-gate * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 47*0Sstevel@tonic-gate * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 48*0Sstevel@tonic-gate * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 49*0Sstevel@tonic-gate * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 50*0Sstevel@tonic-gate * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 51*0Sstevel@tonic-gate * SUCH DAMAGE. 52*0Sstevel@tonic-gate * 53*0Sstevel@tonic-gate * The licence and distribution terms for any publically available version or 54*0Sstevel@tonic-gate * derivative of this code cannot be changed. i.e. this code cannot simply be 55*0Sstevel@tonic-gate * copied and put under another distribution licence 56*0Sstevel@tonic-gate * [including the GNU Public Licence.] 57*0Sstevel@tonic-gate */ 58*0Sstevel@tonic-gate /* ==================================================================== 59*0Sstevel@tonic-gate * Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved. 60*0Sstevel@tonic-gate * 61*0Sstevel@tonic-gate * Redistribution and use in source and binary forms, with or without 62*0Sstevel@tonic-gate * modification, are permitted provided that the following conditions 63*0Sstevel@tonic-gate * are met: 64*0Sstevel@tonic-gate * 65*0Sstevel@tonic-gate * 1. Redistributions of source code must retain the above copyright 66*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer. 67*0Sstevel@tonic-gate * 68*0Sstevel@tonic-gate * 2. Redistributions in binary form must reproduce the above copyright 69*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer in 70*0Sstevel@tonic-gate * the documentation and/or other materials provided with the 71*0Sstevel@tonic-gate * distribution. 72*0Sstevel@tonic-gate * 73*0Sstevel@tonic-gate * 3. All advertising materials mentioning features or use of this 74*0Sstevel@tonic-gate * software must display the following acknowledgment: 75*0Sstevel@tonic-gate * "This product includes software developed by the OpenSSL Project 76*0Sstevel@tonic-gate * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" 77*0Sstevel@tonic-gate * 78*0Sstevel@tonic-gate * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 79*0Sstevel@tonic-gate * endorse or promote products derived from this software without 80*0Sstevel@tonic-gate * prior written permission. For written permission, please contact 81*0Sstevel@tonic-gate * openssl-core@openssl.org. 82*0Sstevel@tonic-gate * 83*0Sstevel@tonic-gate * 5. Products derived from this software may not be called "OpenSSL" 84*0Sstevel@tonic-gate * nor may "OpenSSL" appear in their names without prior written 85*0Sstevel@tonic-gate * permission of the OpenSSL Project. 86*0Sstevel@tonic-gate * 87*0Sstevel@tonic-gate * 6. Redistributions of any form whatsoever must retain the following 88*0Sstevel@tonic-gate * acknowledgment: 89*0Sstevel@tonic-gate * "This product includes software developed by the OpenSSL Project 90*0Sstevel@tonic-gate * for use in the OpenSSL Toolkit (http://www.openssl.org/)" 91*0Sstevel@tonic-gate * 92*0Sstevel@tonic-gate * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 93*0Sstevel@tonic-gate * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 94*0Sstevel@tonic-gate * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 95*0Sstevel@tonic-gate * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 96*0Sstevel@tonic-gate * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 97*0Sstevel@tonic-gate * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 98*0Sstevel@tonic-gate * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 99*0Sstevel@tonic-gate * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 100*0Sstevel@tonic-gate * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 101*0Sstevel@tonic-gate * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 102*0Sstevel@tonic-gate * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 103*0Sstevel@tonic-gate * OF THE POSSIBILITY OF SUCH DAMAGE. 104*0Sstevel@tonic-gate * ==================================================================== 105*0Sstevel@tonic-gate * 106*0Sstevel@tonic-gate * This product includes cryptographic software written by Eric Young 107*0Sstevel@tonic-gate * (eay@cryptsoft.com). This product includes software written by Tim 108*0Sstevel@tonic-gate * Hudson (tjh@cryptsoft.com). 109*0Sstevel@tonic-gate * 110*0Sstevel@tonic-gate */ 111*0Sstevel@tonic-gate 112*0Sstevel@tonic-gate #include <stdio.h> 113*0Sstevel@tonic-gate #include <time.h> 114*0Sstevel@tonic-gate 115*0Sstevel@tonic-gate #include "cryptlib.h" 116*0Sstevel@tonic-gate 117*0Sstevel@tonic-gate #ifndef NO_SYS_TYPES_H 118*0Sstevel@tonic-gate # include <sys/types.h> 119*0Sstevel@tonic-gate #endif 120*0Sstevel@tonic-gate 121*0Sstevel@tonic-gate #include <openssl/bn.h> 122*0Sstevel@tonic-gate #include <openssl/evp.h> 123*0Sstevel@tonic-gate #include <openssl/x509.h> 124*0Sstevel@tonic-gate #include <openssl/objects.h> 125*0Sstevel@tonic-gate #include <openssl/buffer.h> 126*0Sstevel@tonic-gate 127*0Sstevel@tonic-gate #ifndef NO_ASN1_OLD 128*0Sstevel@tonic-gate 129*0Sstevel@tonic-gate int ASN1_sign(int (*i2d)(), X509_ALGOR *algor1, X509_ALGOR *algor2, 130*0Sstevel@tonic-gate ASN1_BIT_STRING *signature, char *data, EVP_PKEY *pkey, 131*0Sstevel@tonic-gate const EVP_MD *type) 132*0Sstevel@tonic-gate { 133*0Sstevel@tonic-gate EVP_MD_CTX ctx; 134*0Sstevel@tonic-gate unsigned char *p,*buf_in=NULL,*buf_out=NULL; 135*0Sstevel@tonic-gate int i,inl=0,outl=0,outll=0; 136*0Sstevel@tonic-gate X509_ALGOR *a; 137*0Sstevel@tonic-gate 138*0Sstevel@tonic-gate EVP_MD_CTX_init(&ctx); 139*0Sstevel@tonic-gate for (i=0; i<2; i++) 140*0Sstevel@tonic-gate { 141*0Sstevel@tonic-gate if (i == 0) 142*0Sstevel@tonic-gate a=algor1; 143*0Sstevel@tonic-gate else 144*0Sstevel@tonic-gate a=algor2; 145*0Sstevel@tonic-gate if (a == NULL) continue; 146*0Sstevel@tonic-gate if (type->pkey_type == NID_dsaWithSHA1) 147*0Sstevel@tonic-gate { 148*0Sstevel@tonic-gate /* special case: RFC 2459 tells us to omit 'parameters' 149*0Sstevel@tonic-gate * with id-dsa-with-sha1 */ 150*0Sstevel@tonic-gate ASN1_TYPE_free(a->parameter); 151*0Sstevel@tonic-gate a->parameter = NULL; 152*0Sstevel@tonic-gate } 153*0Sstevel@tonic-gate else if ((a->parameter == NULL) || 154*0Sstevel@tonic-gate (a->parameter->type != V_ASN1_NULL)) 155*0Sstevel@tonic-gate { 156*0Sstevel@tonic-gate ASN1_TYPE_free(a->parameter); 157*0Sstevel@tonic-gate if ((a->parameter=ASN1_TYPE_new()) == NULL) goto err; 158*0Sstevel@tonic-gate a->parameter->type=V_ASN1_NULL; 159*0Sstevel@tonic-gate } 160*0Sstevel@tonic-gate ASN1_OBJECT_free(a->algorithm); 161*0Sstevel@tonic-gate a->algorithm=OBJ_nid2obj(type->pkey_type); 162*0Sstevel@tonic-gate if (a->algorithm == NULL) 163*0Sstevel@tonic-gate { 164*0Sstevel@tonic-gate ASN1err(ASN1_F_ASN1_SIGN,ASN1_R_UNKNOWN_OBJECT_TYPE); 165*0Sstevel@tonic-gate goto err; 166*0Sstevel@tonic-gate } 167*0Sstevel@tonic-gate if (a->algorithm->length == 0) 168*0Sstevel@tonic-gate { 169*0Sstevel@tonic-gate ASN1err(ASN1_F_ASN1_SIGN,ASN1_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD); 170*0Sstevel@tonic-gate goto err; 171*0Sstevel@tonic-gate } 172*0Sstevel@tonic-gate } 173*0Sstevel@tonic-gate inl=i2d(data,NULL); 174*0Sstevel@tonic-gate buf_in=(unsigned char *)OPENSSL_malloc((unsigned int)inl); 175*0Sstevel@tonic-gate outll=outl=EVP_PKEY_size(pkey); 176*0Sstevel@tonic-gate buf_out=(unsigned char *)OPENSSL_malloc((unsigned int)outl); 177*0Sstevel@tonic-gate if ((buf_in == NULL) || (buf_out == NULL)) 178*0Sstevel@tonic-gate { 179*0Sstevel@tonic-gate outl=0; 180*0Sstevel@tonic-gate ASN1err(ASN1_F_ASN1_SIGN,ERR_R_MALLOC_FAILURE); 181*0Sstevel@tonic-gate goto err; 182*0Sstevel@tonic-gate } 183*0Sstevel@tonic-gate p=buf_in; 184*0Sstevel@tonic-gate 185*0Sstevel@tonic-gate i2d(data,&p); 186*0Sstevel@tonic-gate EVP_SignInit_ex(&ctx,type, NULL); 187*0Sstevel@tonic-gate EVP_SignUpdate(&ctx,(unsigned char *)buf_in,inl); 188*0Sstevel@tonic-gate if (!EVP_SignFinal(&ctx,(unsigned char *)buf_out, 189*0Sstevel@tonic-gate (unsigned int *)&outl,pkey)) 190*0Sstevel@tonic-gate { 191*0Sstevel@tonic-gate outl=0; 192*0Sstevel@tonic-gate ASN1err(ASN1_F_ASN1_SIGN,ERR_R_EVP_LIB); 193*0Sstevel@tonic-gate goto err; 194*0Sstevel@tonic-gate } 195*0Sstevel@tonic-gate if (signature->data != NULL) OPENSSL_free(signature->data); 196*0Sstevel@tonic-gate signature->data=buf_out; 197*0Sstevel@tonic-gate buf_out=NULL; 198*0Sstevel@tonic-gate signature->length=outl; 199*0Sstevel@tonic-gate /* In the interests of compatibility, I'll make sure that 200*0Sstevel@tonic-gate * the bit string has a 'not-used bits' value of 0 201*0Sstevel@tonic-gate */ 202*0Sstevel@tonic-gate signature->flags&= ~(ASN1_STRING_FLAG_BITS_LEFT|0x07); 203*0Sstevel@tonic-gate signature->flags|=ASN1_STRING_FLAG_BITS_LEFT; 204*0Sstevel@tonic-gate err: 205*0Sstevel@tonic-gate EVP_MD_CTX_cleanup(&ctx); 206*0Sstevel@tonic-gate if (buf_in != NULL) 207*0Sstevel@tonic-gate { OPENSSL_cleanse((char *)buf_in,(unsigned int)inl); OPENSSL_free(buf_in); } 208*0Sstevel@tonic-gate if (buf_out != NULL) 209*0Sstevel@tonic-gate { OPENSSL_cleanse((char *)buf_out,outll); OPENSSL_free(buf_out); } 210*0Sstevel@tonic-gate return(outl); 211*0Sstevel@tonic-gate } 212*0Sstevel@tonic-gate 213*0Sstevel@tonic-gate #endif 214*0Sstevel@tonic-gate 215*0Sstevel@tonic-gate int ASN1_item_sign(const ASN1_ITEM *it, X509_ALGOR *algor1, X509_ALGOR *algor2, 216*0Sstevel@tonic-gate ASN1_BIT_STRING *signature, void *asn, EVP_PKEY *pkey, 217*0Sstevel@tonic-gate const EVP_MD *type) 218*0Sstevel@tonic-gate { 219*0Sstevel@tonic-gate EVP_MD_CTX ctx; 220*0Sstevel@tonic-gate unsigned char *buf_in=NULL,*buf_out=NULL; 221*0Sstevel@tonic-gate int i,inl=0,outl=0,outll=0; 222*0Sstevel@tonic-gate X509_ALGOR *a; 223*0Sstevel@tonic-gate 224*0Sstevel@tonic-gate EVP_MD_CTX_init(&ctx); 225*0Sstevel@tonic-gate for (i=0; i<2; i++) 226*0Sstevel@tonic-gate { 227*0Sstevel@tonic-gate if (i == 0) 228*0Sstevel@tonic-gate a=algor1; 229*0Sstevel@tonic-gate else 230*0Sstevel@tonic-gate a=algor2; 231*0Sstevel@tonic-gate if (a == NULL) continue; 232*0Sstevel@tonic-gate if (type->pkey_type == NID_dsaWithSHA1) 233*0Sstevel@tonic-gate { 234*0Sstevel@tonic-gate /* special case: RFC 2459 tells us to omit 'parameters' 235*0Sstevel@tonic-gate * with id-dsa-with-sha1 */ 236*0Sstevel@tonic-gate ASN1_TYPE_free(a->parameter); 237*0Sstevel@tonic-gate a->parameter = NULL; 238*0Sstevel@tonic-gate } 239*0Sstevel@tonic-gate else if ((a->parameter == NULL) || 240*0Sstevel@tonic-gate (a->parameter->type != V_ASN1_NULL)) 241*0Sstevel@tonic-gate { 242*0Sstevel@tonic-gate ASN1_TYPE_free(a->parameter); 243*0Sstevel@tonic-gate if ((a->parameter=ASN1_TYPE_new()) == NULL) goto err; 244*0Sstevel@tonic-gate a->parameter->type=V_ASN1_NULL; 245*0Sstevel@tonic-gate } 246*0Sstevel@tonic-gate ASN1_OBJECT_free(a->algorithm); 247*0Sstevel@tonic-gate a->algorithm=OBJ_nid2obj(type->pkey_type); 248*0Sstevel@tonic-gate if (a->algorithm == NULL) 249*0Sstevel@tonic-gate { 250*0Sstevel@tonic-gate ASN1err(ASN1_F_ASN1_SIGN,ASN1_R_UNKNOWN_OBJECT_TYPE); 251*0Sstevel@tonic-gate goto err; 252*0Sstevel@tonic-gate } 253*0Sstevel@tonic-gate if (a->algorithm->length == 0) 254*0Sstevel@tonic-gate { 255*0Sstevel@tonic-gate ASN1err(ASN1_F_ASN1_SIGN,ASN1_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD); 256*0Sstevel@tonic-gate goto err; 257*0Sstevel@tonic-gate } 258*0Sstevel@tonic-gate } 259*0Sstevel@tonic-gate inl=ASN1_item_i2d(asn,&buf_in, it); 260*0Sstevel@tonic-gate outll=outl=EVP_PKEY_size(pkey); 261*0Sstevel@tonic-gate buf_out=(unsigned char *)OPENSSL_malloc((unsigned int)outl); 262*0Sstevel@tonic-gate if ((buf_in == NULL) || (buf_out == NULL)) 263*0Sstevel@tonic-gate { 264*0Sstevel@tonic-gate outl=0; 265*0Sstevel@tonic-gate ASN1err(ASN1_F_ASN1_SIGN,ERR_R_MALLOC_FAILURE); 266*0Sstevel@tonic-gate goto err; 267*0Sstevel@tonic-gate } 268*0Sstevel@tonic-gate 269*0Sstevel@tonic-gate EVP_SignInit_ex(&ctx,type, NULL); 270*0Sstevel@tonic-gate EVP_SignUpdate(&ctx,(unsigned char *)buf_in,inl); 271*0Sstevel@tonic-gate if (!EVP_SignFinal(&ctx,(unsigned char *)buf_out, 272*0Sstevel@tonic-gate (unsigned int *)&outl,pkey)) 273*0Sstevel@tonic-gate { 274*0Sstevel@tonic-gate outl=0; 275*0Sstevel@tonic-gate ASN1err(ASN1_F_ASN1_SIGN,ERR_R_EVP_LIB); 276*0Sstevel@tonic-gate goto err; 277*0Sstevel@tonic-gate } 278*0Sstevel@tonic-gate if (signature->data != NULL) OPENSSL_free(signature->data); 279*0Sstevel@tonic-gate signature->data=buf_out; 280*0Sstevel@tonic-gate buf_out=NULL; 281*0Sstevel@tonic-gate signature->length=outl; 282*0Sstevel@tonic-gate /* In the interests of compatibility, I'll make sure that 283*0Sstevel@tonic-gate * the bit string has a 'not-used bits' value of 0 284*0Sstevel@tonic-gate */ 285*0Sstevel@tonic-gate signature->flags&= ~(ASN1_STRING_FLAG_BITS_LEFT|0x07); 286*0Sstevel@tonic-gate signature->flags|=ASN1_STRING_FLAG_BITS_LEFT; 287*0Sstevel@tonic-gate err: 288*0Sstevel@tonic-gate EVP_MD_CTX_cleanup(&ctx); 289*0Sstevel@tonic-gate if (buf_in != NULL) 290*0Sstevel@tonic-gate { OPENSSL_cleanse((char *)buf_in,(unsigned int)inl); OPENSSL_free(buf_in); } 291*0Sstevel@tonic-gate if (buf_out != NULL) 292*0Sstevel@tonic-gate { OPENSSL_cleanse((char *)buf_out,outll); OPENSSL_free(buf_out); } 293*0Sstevel@tonic-gate return(outl); 294*0Sstevel@tonic-gate } 295