1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 * 25 * Copyright 2020 Joyent, Inc. 26 */ 27 28 #include <pthread.h> 29 #include <stdlib.h> 30 #include <string.h> 31 #include <strings.h> 32 #include <sys/types.h> 33 #include <security/cryptoki.h> 34 #include <sys/crypto/common.h> 35 #include <aes_impl.h> 36 #include <blowfish_impl.h> 37 #include <des_impl.h> 38 #include <arcfour.h> 39 #include <cryptoutil.h> 40 #include "softGlobal.h" 41 #include "softSession.h" 42 #include "softObject.h" 43 #include "softDSA.h" 44 #include "softRSA.h" 45 #include "softDH.h" 46 #include "softEC.h" 47 #include "softMAC.h" 48 #include "softOps.h" 49 #include "softKeys.h" 50 #include "softKeystore.h" 51 #include "softSSL.h" 52 #include "softASN1.h" 53 54 55 #define local_min(a, b) ((a) < (b) ? (a) : (b)) 56 57 static CK_RV 58 soft_pkcs12_pbe(soft_session_t *, CK_MECHANISM_PTR, soft_object_t *); 59 60 /* 61 * Create a temporary key object struct by filling up its template attributes. 62 */ 63 CK_RV 64 soft_gen_keyobject(CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount, 65 soft_object_t **objp, soft_session_t *sp, 66 CK_OBJECT_CLASS class, CK_KEY_TYPE key_type, CK_ULONG keylen, CK_ULONG mode, 67 boolean_t internal) 68 { 69 CK_RV rv; 70 soft_object_t *new_objp = NULL; 71 72 new_objp = calloc(1, sizeof (soft_object_t)); 73 if (new_objp == NULL) { 74 return (CKR_HOST_MEMORY); 75 } 76 77 new_objp->extra_attrlistp = NULL; 78 79 /* 80 * Validate attribute template and fill in the attributes 81 * in the soft_object_t. 82 */ 83 rv = soft_build_key(pTemplate, ulCount, new_objp, class, key_type, 84 keylen, mode); 85 if (rv != CKR_OK) { 86 goto fail_cleanup1; 87 } 88 89 /* 90 * If generating a key is an internal request (i.e. not a C_XXX 91 * API request), then skip the following checks. 92 */ 93 if (!internal) { 94 rv = soft_pin_expired_check(new_objp); 95 if (rv != CKR_OK) { 96 goto fail_cleanup2; 97 } 98 99 rv = soft_object_write_access_check(sp, new_objp); 100 if (rv != CKR_OK) { 101 goto fail_cleanup2; 102 } 103 } 104 105 /* Initialize the rest of stuffs in soft_object_t. */ 106 (void) pthread_mutex_init(&new_objp->object_mutex, NULL); 107 new_objp->magic_marker = SOFTTOKEN_OBJECT_MAGIC; 108 109 /* Write the new token object to the keystore */ 110 if (IS_TOKEN_OBJECT(new_objp)) { 111 new_objp->version = 1; 112 new_objp->session_handle = CK_INVALID_HANDLE; 113 soft_add_token_object_to_slot(new_objp); 114 115 set_objecthandle(new_objp); 116 *objp = new_objp; 117 118 return (CKR_OK); 119 } 120 121 new_objp->session_handle = sp->handle; 122 123 /* Add the new object to the session's object list. */ 124 soft_add_object_to_session(new_objp, sp); 125 126 set_objecthandle(new_objp); 127 *objp = new_objp; 128 129 return (CKR_OK); 130 131 fail_cleanup2: 132 /* 133 * When any error occurs after soft_build_key(), we will need to 134 * clean up the memory allocated by the soft_build_key(). 135 */ 136 soft_cleanup_object(new_objp); 137 138 fail_cleanup1: 139 if (new_objp) { 140 /* 141 * The storage allocated inside of this object should have 142 * been cleaned up by the soft_build_key() if it failed. 143 * Therefore, we can safely free the object. 144 */ 145 free(new_objp); 146 } 147 148 return (rv); 149 } 150 151 CK_RV 152 soft_genkey(soft_session_t *session_p, CK_MECHANISM_PTR pMechanism, 153 CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount, CK_OBJECT_HANDLE_PTR phKey) 154 { 155 156 CK_RV rv = CKR_OK; 157 soft_object_t *secret_key; 158 CK_KEY_TYPE key_type; 159 CK_ULONG keylen = 0; 160 CK_ULONG i; 161 int des_strength = 0; 162 int retry = 0; 163 int keyfound = 0; 164 boolean_t is_ssl_mech = B_FALSE; 165 166 switch (pMechanism->mechanism) { 167 case CKM_DES_KEY_GEN: 168 key_type = CKK_DES; 169 break; 170 171 case CKM_DES2_KEY_GEN: 172 key_type = CKK_DES2; 173 break; 174 175 case CKM_DES3_KEY_GEN: 176 key_type = CKK_DES3; 177 break; 178 179 case CKM_AES_KEY_GEN: 180 key_type = CKK_AES; 181 break; 182 183 case CKM_BLOWFISH_KEY_GEN: 184 key_type = CKK_BLOWFISH; 185 break; 186 187 case CKM_RC4_KEY_GEN: 188 key_type = CKK_RC4; 189 break; 190 191 case CKM_SSL3_PRE_MASTER_KEY_GEN: 192 case CKM_TLS_PRE_MASTER_KEY_GEN: 193 if (pMechanism->pParameter == NULL || 194 pMechanism->ulParameterLen != sizeof (CK_VERSION)) 195 return (CKR_TEMPLATE_INCOMPLETE); 196 is_ssl_mech = B_TRUE; 197 key_type = CKK_GENERIC_SECRET; 198 keylen = 48; 199 break; 200 201 case CKM_PKCS5_PBKD2: 202 keyfound = 0; 203 for (i = 0; i < ulCount && !keyfound; i++) { 204 if (pTemplate[i].type == CKA_KEY_TYPE && 205 pTemplate[i].pValue != NULL) { 206 key_type = *((CK_KEY_TYPE*)pTemplate[i].pValue); 207 keyfound = 1; 208 } 209 } 210 if (!keyfound) 211 return (CKR_TEMPLATE_INCOMPLETE); 212 /* 213 * Make sure that parameters were given for this 214 * mechanism. 215 */ 216 if (pMechanism->pParameter == NULL || 217 pMechanism->ulParameterLen != 218 sizeof (CK_PKCS5_PBKD2_PARAMS)) 219 return (CKR_TEMPLATE_INCOMPLETE); 220 break; 221 222 case CKM_PBE_SHA1_RC4_128: 223 keyfound = 0; 224 for (i = 0; i < ulCount; i++) { 225 if (pTemplate[i].type == CKA_KEY_TYPE && 226 pTemplate[i].pValue != NULL) { 227 key_type = *((CK_KEY_TYPE*)pTemplate[i].pValue); 228 keyfound = 1; 229 } 230 if (pTemplate[i].type == CKA_VALUE_LEN && 231 pTemplate[i].pValue != NULL) { 232 keylen = *((CK_ULONG*)pTemplate[i].pValue); 233 } 234 } 235 /* If a keytype was specified, it had better be CKK_RC4 */ 236 if (keyfound && key_type != CKK_RC4) 237 return (CKR_TEMPLATE_INCONSISTENT); 238 else if (!keyfound) 239 key_type = CKK_RC4; 240 241 /* If key length was specified, it better be 16 bytes */ 242 if (keylen != 0 && keylen != 16) 243 return (CKR_TEMPLATE_INCONSISTENT); 244 245 /* 246 * Make sure that parameters were given for this 247 * mechanism. 248 */ 249 if (pMechanism->pParameter == NULL || 250 pMechanism->ulParameterLen != 251 sizeof (CK_PBE_PARAMS)) 252 return (CKR_TEMPLATE_INCOMPLETE); 253 break; 254 default: 255 return (CKR_MECHANISM_INVALID); 256 } 257 258 /* Create a new object for secret key. */ 259 rv = soft_gen_keyobject(pTemplate, ulCount, &secret_key, session_p, 260 CKO_SECRET_KEY, key_type, keylen, SOFT_GEN_KEY, B_FALSE); 261 262 if (rv != CKR_OK) { 263 return (rv); 264 } 265 266 switch (pMechanism->mechanism) { 267 case CKM_DES_KEY_GEN: 268 /* 269 * Set up key value len since it is not a required 270 * attribute for C_GenerateKey. 271 */ 272 keylen = OBJ_SEC_VALUE_LEN(secret_key) = DES_KEYSIZE; 273 des_strength = DES; 274 break; 275 276 case CKM_DES2_KEY_GEN: 277 /* 278 * Set up key value len since it is not a required 279 * attribute for C_GenerateKey. 280 */ 281 keylen = OBJ_SEC_VALUE_LEN(secret_key) = DES2_KEYSIZE; 282 des_strength = DES2; 283 break; 284 285 case CKM_DES3_KEY_GEN: 286 /* 287 * Set up key value len since it is not a required 288 * attribute for C_GenerateKey. 289 */ 290 keylen = OBJ_SEC_VALUE_LEN(secret_key) = DES3_KEYSIZE; 291 des_strength = DES3; 292 break; 293 294 case CKM_SSL3_PRE_MASTER_KEY_GEN: 295 case CKM_TLS_PRE_MASTER_KEY_GEN: 296 secret_key->bool_attr_mask |= DERIVE_BOOL_ON; 297 /* FALLTHRU */ 298 299 case CKM_AES_KEY_GEN: 300 case CKM_BLOWFISH_KEY_GEN: 301 case CKM_PBE_SHA1_RC4_128: 302 case CKM_RC4_KEY_GEN: 303 keylen = OBJ_SEC_VALUE_LEN(secret_key); 304 break; 305 306 case CKM_PKCS5_PBKD2: 307 /* 308 * PKCS#11 does not allow one to specify key 309 * sizes for DES and 3DES, so we must set it here 310 * when using PBKD2 algorithms. 311 */ 312 if (key_type == CKK_DES) { 313 OBJ_SEC_VALUE_LEN(secret_key) = DES_KEYSIZE; 314 des_strength = DES; 315 } else if (key_type == CKK_DES3) { 316 OBJ_SEC_VALUE_LEN(secret_key) = DES3_KEYSIZE; 317 des_strength = DES3; 318 } 319 320 keylen = OBJ_SEC_VALUE_LEN(secret_key); 321 break; 322 } 323 324 if ((OBJ_SEC_VALUE(secret_key) = malloc(keylen)) == NULL) { 325 if (IS_TOKEN_OBJECT(secret_key)) 326 soft_delete_token_object(secret_key, B_FALSE, B_FALSE); 327 else 328 soft_delete_object(session_p, secret_key, 329 B_FALSE, B_FALSE); 330 331 return (CKR_HOST_MEMORY); 332 } 333 switch (pMechanism->mechanism) { 334 case CKM_PBE_SHA1_RC4_128: 335 /* 336 * Use the PBE algorithm described in PKCS#11 section 337 * 12.33 to derive the key. 338 */ 339 rv = soft_pkcs12_pbe(session_p, pMechanism, secret_key); 340 break; 341 case CKM_PKCS5_PBKD2: 342 /* Generate keys using PKCS#5 PBKD2 algorithm */ 343 rv = soft_generate_pkcs5_pbkdf2_key(session_p, pMechanism, 344 secret_key); 345 if (rv == CKR_OK && des_strength > 0) { 346 /* Perform weak key checking for DES and DES3. */ 347 if (des_keycheck(OBJ_SEC_VALUE(secret_key), 348 des_strength, OBJ_SEC_VALUE(secret_key)) == 349 B_FALSE) { 350 /* We got a weak secret key. */ 351 rv = CKR_FUNCTION_FAILED; 352 } 353 } 354 break; 355 default: 356 do { 357 /* If this fails, bail out */ 358 rv = CKR_OK; 359 if (pkcs11_get_urandom( 360 OBJ_SEC_VALUE(secret_key), keylen) < 0) { 361 rv = CKR_DEVICE_ERROR; 362 break; 363 } 364 365 /* Perform weak key checking for DES and DES3. */ 366 if (des_strength > 0) { 367 rv = CKR_OK; 368 if (des_keycheck(OBJ_SEC_VALUE(secret_key), 369 des_strength, OBJ_SEC_VALUE(secret_key)) == 370 B_FALSE) { 371 /* We got a weak key, retry! */ 372 retry++; 373 rv = CKR_FUNCTION_FAILED; 374 } 375 } 376 /* 377 * Copy over the SSL client version For SSL mechs 378 * The first two bytes of the key is the version 379 */ 380 if (is_ssl_mech) 381 bcopy(pMechanism->pParameter, 382 OBJ_SEC_VALUE(secret_key), 383 sizeof (CK_VERSION)); 384 385 } while (rv != CKR_OK && retry < KEYGEN_RETRY); 386 if (retry == KEYGEN_RETRY) 387 rv = CKR_FUNCTION_FAILED; 388 break; 389 } 390 391 if (rv != CKR_OK) 392 if (IS_TOKEN_OBJECT(secret_key)) 393 soft_delete_token_object(secret_key, B_FALSE, B_FALSE); 394 else 395 soft_delete_object(session_p, secret_key, 396 B_FALSE, B_FALSE); 397 398 if (IS_TOKEN_OBJECT(secret_key)) { 399 /* 400 * All the info has been filled, so we can write to 401 * keystore now. 402 */ 403 rv = soft_put_object_to_keystore(secret_key); 404 if (rv != CKR_OK) 405 soft_delete_token_object(secret_key, B_FALSE, B_FALSE); 406 } 407 408 *phKey = secret_key->handle; 409 return (rv); 410 } 411 412 CK_RV 413 soft_genkey_pair(soft_session_t *session_p, CK_MECHANISM_PTR pMechanism, 414 CK_ATTRIBUTE_PTR pPublicKeyTemplate, CK_ULONG ulPublicAttrCount, 415 CK_ATTRIBUTE_PTR pPrivateKeyTemplate, CK_ULONG ulPrivateAttrCount, 416 CK_OBJECT_HANDLE_PTR phPublicKey, CK_OBJECT_HANDLE_PTR phPrivateKey) 417 { 418 419 CK_RV rv; 420 soft_object_t *public_key, *private_key; 421 CK_KEY_TYPE key_type; 422 423 switch (pMechanism->mechanism) { 424 425 case CKM_RSA_PKCS_KEY_PAIR_GEN: 426 key_type = CKK_RSA; 427 break; 428 429 case CKM_DSA_KEY_PAIR_GEN: 430 key_type = CKK_DSA; 431 break; 432 433 case CKM_DH_PKCS_KEY_PAIR_GEN: 434 key_type = CKK_DH; 435 break; 436 437 case CKM_EC_KEY_PAIR_GEN: 438 key_type = CKK_EC; 439 break; 440 441 default: 442 return (CKR_MECHANISM_INVALID); 443 } 444 445 /* Create a new object for public key. */ 446 rv = soft_gen_keyobject(pPublicKeyTemplate, ulPublicAttrCount, 447 &public_key, session_p, CKO_PUBLIC_KEY, key_type, 0, 448 SOFT_GEN_KEY, B_FALSE); 449 450 if (rv != CKR_OK) { 451 return (rv); 452 } 453 454 /* Create a new object for private key. */ 455 rv = soft_gen_keyobject(pPrivateKeyTemplate, ulPrivateAttrCount, 456 &private_key, session_p, CKO_PRIVATE_KEY, key_type, 0, 457 SOFT_GEN_KEY, B_FALSE); 458 459 if (rv != CKR_OK) { 460 /* 461 * Both public key and private key must be successful. 462 */ 463 if (IS_TOKEN_OBJECT(public_key)) 464 soft_delete_token_object(public_key, B_FALSE, B_FALSE); 465 else 466 soft_delete_object(session_p, public_key, 467 B_FALSE, B_FALSE); 468 return (rv); 469 } 470 471 /* 472 * At this point, both public key and private key objects 473 * are settled with the application specified attributes. 474 * We are ready to generate the rest of key attributes based 475 * on the existing attributes. 476 */ 477 478 switch (key_type) { 479 case CKK_RSA: 480 rv = soft_rsa_genkey_pair(public_key, private_key); 481 break; 482 483 case CKK_DSA: 484 rv = soft_dsa_genkey_pair(public_key, private_key); 485 break; 486 487 case CKK_DH: 488 rv = soft_dh_genkey_pair(public_key, private_key); 489 private_key->bool_attr_mask |= DERIVE_BOOL_ON; 490 break; 491 case CKK_EC: 492 rv = soft_ec_genkey_pair(public_key, private_key); 493 private_key->bool_attr_mask |= DERIVE_BOOL_ON; 494 break; 495 } 496 497 if (rv != CKR_OK) { 498 if (IS_TOKEN_OBJECT(public_key)) { 499 soft_delete_token_object(public_key, B_FALSE, B_FALSE); 500 soft_delete_token_object(private_key, B_FALSE, B_FALSE); 501 } else { 502 soft_delete_object(session_p, public_key, 503 B_FALSE, B_FALSE); 504 soft_delete_object(session_p, private_key, 505 B_FALSE, B_FALSE); 506 } 507 return (rv); 508 } 509 510 if (IS_TOKEN_OBJECT(public_key)) { 511 /* 512 * All the info has been filled, so we can write to 513 * keystore now. 514 */ 515 rv = soft_put_object_to_keystore(public_key); 516 if (rv != CKR_OK) { 517 soft_delete_token_object(public_key, B_FALSE, B_FALSE); 518 soft_delete_token_object(private_key, B_FALSE, B_FALSE); 519 return (rv); 520 } 521 } 522 523 if (IS_TOKEN_OBJECT(private_key)) { 524 rv = soft_put_object_to_keystore(private_key); 525 if (rv != CKR_OK) { 526 /* 527 * We also need to delete the public token object 528 * from keystore. 529 */ 530 soft_delete_token_object(public_key, B_TRUE, B_FALSE); 531 soft_delete_token_object(private_key, B_FALSE, B_FALSE); 532 } 533 } 534 535 *phPublicKey = public_key->handle; 536 *phPrivateKey = private_key->handle; 537 538 return (rv); 539 } 540 541 542 CK_RV 543 soft_key_derive_check_length(soft_object_t *secret_key, CK_ULONG max_keylen) 544 { 545 546 switch (secret_key->key_type) { 547 case CKK_GENERIC_SECRET: 548 if (OBJ_SEC_VALUE_LEN(secret_key) == 0) { 549 OBJ_SEC_VALUE_LEN(secret_key) = max_keylen; 550 return (CKR_OK); 551 } else if (OBJ_SEC_VALUE_LEN(secret_key) > max_keylen) { 552 return (CKR_ATTRIBUTE_VALUE_INVALID); 553 } 554 break; 555 case CKK_RC4: 556 case CKK_AES: 557 case CKK_BLOWFISH: 558 if ((OBJ_SEC_VALUE_LEN(secret_key) == 0) || 559 (OBJ_SEC_VALUE_LEN(secret_key) > max_keylen)) { 560 /* RC4 and AES has variable key length */ 561 return (CKR_ATTRIBUTE_VALUE_INVALID); 562 } 563 break; 564 case CKK_DES: 565 if (OBJ_SEC_VALUE_LEN(secret_key) == 0) { 566 /* DES has a well-defined length */ 567 OBJ_SEC_VALUE_LEN(secret_key) = DES_KEYSIZE; 568 return (CKR_OK); 569 } else if (OBJ_SEC_VALUE_LEN(secret_key) != DES_KEYSIZE) { 570 return (CKR_ATTRIBUTE_VALUE_INVALID); 571 } 572 break; 573 case CKK_DES2: 574 if (OBJ_SEC_VALUE_LEN(secret_key) == 0) { 575 /* DES2 has a well-defined length */ 576 OBJ_SEC_VALUE_LEN(secret_key) = DES2_KEYSIZE; 577 return (CKR_OK); 578 } else if (OBJ_SEC_VALUE_LEN(secret_key) != DES2_KEYSIZE) { 579 return (CKR_ATTRIBUTE_VALUE_INVALID); 580 } 581 break; 582 583 default: 584 return (CKR_MECHANISM_INVALID); 585 } 586 587 return (CKR_OK); 588 } 589 590 /* 591 * PKCS#11 (12.33) says that v = 512 bits (64 bytes) for SHA1 592 * PBE methods. 593 */ 594 #define PKCS12_BUFFER_SIZE 64 595 /* 596 * PKCS#12 defines 3 different ID bytes to be used for 597 * deriving keys for different operations. 598 */ 599 #define PBE_ID_ENCRYPT 1 600 #define PBE_ID_IV 2 601 #define PBE_ID_MAC 3 602 #define PBE_CEIL(a, b) (((a)/(b)) + (((a)%(b)) > 0)) 603 604 static CK_RV 605 soft_pkcs12_pbe(soft_session_t *session_p, 606 CK_MECHANISM_PTR pMechanism, soft_object_t *derived_key) 607 { 608 CK_RV rv = CKR_OK; 609 CK_PBE_PARAMS *params = pMechanism->pParameter; 610 CK_ULONG c, i, j, k; 611 CK_ULONG hashSize; 612 CK_ULONG buffSize; 613 /* 614 * Terse variable names are used to make following 615 * the PKCS#12 spec easier. 616 */ 617 CK_BYTE *A = NULL; 618 CK_BYTE *Ai = NULL; 619 CK_BYTE *B = NULL; 620 CK_BYTE *D = NULL; 621 CK_BYTE *I = NULL, *S, *P; 622 CK_BYTE *keybuf = NULL; 623 CK_ULONG Alen, Ilen, Slen, Plen, AiLen, Blen, Dlen; 624 CK_ULONG keysize = OBJ_SEC_VALUE_LEN(derived_key); 625 CK_MECHANISM digest_mech; 626 627 /* U = hash function output bits */ 628 if (pMechanism->mechanism == CKM_PBE_SHA1_RC4_128) { 629 hashSize = SHA1_HASH_SIZE; 630 buffSize = PKCS12_BUFFER_SIZE; 631 digest_mech.mechanism = CKM_SHA_1; 632 digest_mech.pParameter = NULL; 633 digest_mech.ulParameterLen = 0; 634 } else { 635 /* we only support 1 PBE mech for now */ 636 return (CKR_MECHANISM_INVALID); 637 } 638 keybuf = OBJ_SEC_VALUE(derived_key); 639 640 Blen = Dlen = buffSize; 641 D = (CK_BYTE *)malloc(Dlen); 642 if (D == NULL) { 643 rv = CKR_HOST_MEMORY; 644 goto cleanup; 645 } 646 647 B = (CK_BYTE *)malloc(Blen); 648 if (B == NULL) { 649 rv = CKR_HOST_MEMORY; 650 goto cleanup; 651 } 652 653 /* 654 * Initialize some values and create some buffers 655 * that we need later. 656 * 657 * Slen = buffSize * CEIL(SaltLength/buffSize) 658 */ 659 Slen = buffSize * PBE_CEIL(params->ulSaltLen, buffSize); 660 661 /* 662 * Plen = buffSize * CEIL(PasswordLength/buffSize) 663 */ 664 Plen = buffSize * PBE_CEIL(params->ulPasswordLen, buffSize); 665 666 /* 667 * From step 4: I = S + P, so: Ilen = Slen + Plen 668 */ 669 Ilen = Slen + Plen; 670 I = (CK_BYTE *)malloc(Ilen); 671 if (I == NULL) { 672 rv = CKR_HOST_MEMORY; 673 goto cleanup; 674 } 675 676 S = I; 677 P = I + Slen; 678 679 /* 680 * Step 1. 681 * We are only interested in deriving keys for encrypt/decrypt 682 * for now, so construct the "D"iversifier accordingly. 683 */ 684 (void) memset(D, PBE_ID_ENCRYPT, Dlen); 685 686 /* 687 * Step 2. 688 * Concatenate copies of the salt together to make S. 689 */ 690 for (i = 0; i < Slen; i += params->ulSaltLen) { 691 (void) memcpy(S+i, params->pSalt, 692 ((Slen - i) > params->ulSaltLen ? 693 params->ulSaltLen : (Slen - i))); 694 } 695 696 /* 697 * Step 3. 698 * Concatenate copies of the password together to make 699 * a string P. 700 */ 701 for (i = 0; i < Plen; i += params->ulPasswordLen) { 702 (void) memcpy(P+i, params->pPassword, 703 ((Plen - i) > params->ulPasswordLen ? 704 params->ulPasswordLen : (Plen - i))); 705 } 706 707 /* 708 * Step 4. 709 * I = S+P - this is now done because S and P are 710 * pointers into I. 711 * 712 * Step 5. 713 * c= CEIL[n/u] 714 * where n = pseudorandom bits of output desired. 715 */ 716 c = PBE_CEIL(keysize, hashSize); 717 718 /* 719 * Step 6. 720 */ 721 Alen = c * hashSize; 722 A = (CK_BYTE *)malloc(Alen); 723 if (A == NULL) { 724 rv = CKR_HOST_MEMORY; 725 goto cleanup; 726 } 727 AiLen = hashSize; 728 Ai = (CK_BYTE *)malloc(AiLen); 729 if (Ai == NULL) { 730 rv = CKR_HOST_MEMORY; 731 goto cleanup; 732 } 733 734 /* 735 * Step 6a. 736 * Ai = Hr(D+I) 737 */ 738 for (i = 0; i < c; i++) { 739 (void) pthread_mutex_lock(&session_p->session_mutex); 740 741 if (session_p->sign.flags & CRYPTO_OPERATION_ACTIVE) { 742 (void) pthread_mutex_unlock(&session_p->session_mutex); 743 rv = CKR_OPERATION_ACTIVE; 744 goto cleanup; 745 } 746 session_p->sign.flags |= CRYPTO_OPERATION_ACTIVE; 747 (void) pthread_mutex_unlock(&session_p->session_mutex); 748 749 for (j = 0; j < params->ulIteration; j++) { 750 rv = soft_digest_init(session_p, &digest_mech); 751 if (rv != CKR_OK) 752 goto digest_done; 753 754 if (j == 0) { 755 rv = soft_digest_update(session_p, D, Dlen); 756 if (rv != CKR_OK) 757 goto digest_done; 758 759 rv = soft_digest_update(session_p, I, Ilen); 760 } else { 761 rv = soft_digest_update(session_p, Ai, AiLen); 762 } 763 if (rv != CKR_OK) 764 goto digest_done; 765 766 rv = soft_digest_final(session_p, Ai, &AiLen); 767 if (rv != CKR_OK) 768 goto digest_done; 769 } 770 digest_done: 771 (void) pthread_mutex_lock(&session_p->session_mutex); 772 session_p->sign.flags &= ~CRYPTO_OPERATION_ACTIVE; 773 (void) pthread_mutex_unlock(&session_p->session_mutex); 774 775 if (rv != CKR_OK) 776 goto cleanup; 777 /* 778 * Step 6b. 779 * Concatenate Ai to make B 780 */ 781 for (j = 0; j < Blen; j += hashSize) { 782 (void) memcpy(B+j, Ai, ((Blen - j > hashSize) ? 783 hashSize : Blen - j)); 784 } 785 786 /* 787 * Step 6c. 788 */ 789 k = Ilen / Blen; 790 for (j = 0; j < k; j++) { 791 uchar_t idx; 792 CK_ULONG m, q = 1, cbit = 0; 793 794 for (m = Blen - 1; m >= (CK_ULONG)0; m--, q = 0) { 795 idx = m + j*Blen; 796 797 q += (CK_ULONG)I[idx] + (CK_ULONG)B[m]; 798 q += cbit; 799 I[idx] = (CK_BYTE)(q & 0xff); 800 cbit = (q > 0xff); 801 } 802 } 803 804 /* 805 * Step 7. 806 * A += Ai 807 */ 808 (void) memcpy(A + i*hashSize, Ai, AiLen); 809 } 810 811 /* 812 * Step 8. 813 * The final output of this process is the A buffer 814 */ 815 (void) memcpy(keybuf, A, keysize); 816 817 cleanup: 818 freezero(A, Alen); 819 freezero(Ai, AiLen); 820 freezero(B, Blen); 821 freezero(D, Dlen); 822 freezero(I, Ilen); 823 return (rv); 824 } 825 826 CK_RV 827 soft_derivekey(soft_session_t *session_p, CK_MECHANISM_PTR pMechanism, 828 soft_object_t *basekey_p, CK_ATTRIBUTE_PTR pTemplate, 829 CK_ULONG ulAttributeCount, CK_OBJECT_HANDLE_PTR phKey) 830 { 831 832 CK_RV rv = CKR_OK; 833 soft_object_t *secret_key; 834 CK_MECHANISM digest_mech; 835 CK_BYTE hash[SHA512_DIGEST_LENGTH]; /* space enough for all mechs */ 836 CK_ULONG hash_len = SHA512_DIGEST_LENGTH; 837 CK_ULONG secret_key_len; 838 CK_ULONG hash_size; 839 840 switch (pMechanism->mechanism) { 841 case CKM_DH_PKCS_DERIVE: 842 /* 843 * Create a new object for secret key. The key type should 844 * be provided in the template. 845 */ 846 rv = soft_gen_keyobject(pTemplate, ulAttributeCount, 847 &secret_key, session_p, CKO_SECRET_KEY, (CK_KEY_TYPE)~0UL, 848 0, SOFT_DERIVE_KEY_DH, B_FALSE); 849 850 if (rv != CKR_OK) { 851 return (rv); 852 } 853 854 rv = soft_dh_key_derive(basekey_p, secret_key, 855 (CK_BYTE *)pMechanism->pParameter, 856 pMechanism->ulParameterLen); 857 858 if (rv != CKR_OK) { 859 if (IS_TOKEN_OBJECT(secret_key)) 860 soft_delete_token_object(secret_key, B_FALSE, 861 B_FALSE); 862 else 863 soft_delete_object(session_p, secret_key, 864 B_FALSE, B_FALSE); 865 return (rv); 866 } 867 868 break; 869 870 case CKM_ECDH1_DERIVE: 871 /* 872 * Create a new object for secret key. The key type should 873 * be provided in the template. 874 */ 875 rv = soft_gen_keyobject(pTemplate, ulAttributeCount, 876 &secret_key, session_p, CKO_SECRET_KEY, (CK_KEY_TYPE)~0UL, 877 0, SOFT_DERIVE_KEY_DH, B_FALSE); 878 879 if (rv != CKR_OK) { 880 return (rv); 881 } 882 883 rv = soft_ec_key_derive(basekey_p, secret_key, 884 (CK_BYTE *)pMechanism->pParameter, 885 pMechanism->ulParameterLen); 886 887 if (rv != CKR_OK) { 888 if (IS_TOKEN_OBJECT(secret_key)) 889 soft_delete_token_object(secret_key, B_FALSE, 890 B_FALSE); 891 else 892 soft_delete_object(session_p, secret_key, 893 B_FALSE, B_FALSE); 894 return (rv); 895 } 896 897 break; 898 899 case CKM_SHA1_KEY_DERIVATION: 900 hash_size = SHA1_HASH_SIZE; 901 digest_mech.mechanism = CKM_SHA_1; 902 goto common; 903 904 case CKM_MD5_KEY_DERIVATION: 905 hash_size = MD5_HASH_SIZE; 906 digest_mech.mechanism = CKM_MD5; 907 goto common; 908 909 case CKM_SHA256_KEY_DERIVATION: 910 hash_size = SHA256_DIGEST_LENGTH; 911 digest_mech.mechanism = CKM_SHA256; 912 goto common; 913 914 case CKM_SHA384_KEY_DERIVATION: 915 hash_size = SHA384_DIGEST_LENGTH; 916 digest_mech.mechanism = CKM_SHA384; 917 goto common; 918 919 case CKM_SHA512_KEY_DERIVATION: 920 hash_size = SHA512_DIGEST_LENGTH; 921 digest_mech.mechanism = CKM_SHA512; 922 goto common; 923 924 case CKM_SHA512_224_KEY_DERIVATION: 925 hash_size = SHA512_224_DIGEST_LENGTH; 926 digest_mech.mechanism = CKM_SHA512_224; 927 goto common; 928 929 case CKM_SHA512_256_KEY_DERIVATION: 930 hash_size = SHA512_256_DIGEST_LENGTH; 931 digest_mech.mechanism = CKM_SHA512_256; 932 goto common; 933 934 common: 935 /* 936 * Create a new object for secret key. The key type is optional 937 * to be provided in the template. If it is not specified in 938 * the template, the default is CKK_GENERIC_SECRET. 939 */ 940 rv = soft_gen_keyobject(pTemplate, ulAttributeCount, 941 &secret_key, session_p, CKO_SECRET_KEY, 942 (CK_KEY_TYPE)CKK_GENERIC_SECRET, 0, 943 SOFT_DERIVE_KEY_OTHER, B_FALSE); 944 945 if (rv != CKR_OK) { 946 return (rv); 947 } 948 949 *phKey = secret_key->handle; 950 951 /* Validate the key type and key length */ 952 rv = soft_key_derive_check_length(secret_key, hash_size); 953 if (rv != CKR_OK) { 954 if (IS_TOKEN_OBJECT(secret_key)) 955 soft_delete_token_object(secret_key, B_FALSE, 956 B_FALSE); 957 else 958 soft_delete_object(session_p, secret_key, 959 B_FALSE, B_FALSE); 960 return (rv); 961 } 962 963 /* 964 * Derive the secret key by digesting the value of another 965 * secret key (base key) with SHA-1 or MD5. 966 */ 967 rv = soft_digest_init_internal(session_p, &digest_mech); 968 if (rv != CKR_OK) { 969 if (IS_TOKEN_OBJECT(secret_key)) 970 soft_delete_token_object(secret_key, B_FALSE, 971 B_FALSE); 972 else 973 soft_delete_object(session_p, secret_key, 974 B_FALSE, B_FALSE); 975 return (rv); 976 } 977 978 rv = soft_digest(session_p, OBJ_SEC_VALUE(basekey_p), 979 OBJ_SEC_VALUE_LEN(basekey_p), hash, &hash_len); 980 981 (void) pthread_mutex_lock(&session_p->session_mutex); 982 /* soft_digest_common() has freed the digest context */ 983 session_p->digest.flags = 0; 984 (void) pthread_mutex_unlock(&session_p->session_mutex); 985 986 if (rv != CKR_OK) { 987 if (IS_TOKEN_OBJECT(secret_key)) 988 soft_delete_token_object(secret_key, B_FALSE, 989 B_FALSE); 990 else 991 soft_delete_object(session_p, secret_key, 992 B_FALSE, B_FALSE); 993 return (rv); 994 } 995 996 secret_key_len = OBJ_SEC_VALUE_LEN(secret_key); 997 998 if ((OBJ_SEC_VALUE(secret_key) = malloc(secret_key_len)) == 999 NULL) { 1000 if (IS_TOKEN_OBJECT(secret_key)) 1001 soft_delete_token_object(secret_key, B_FALSE, 1002 B_FALSE); 1003 else 1004 soft_delete_object(session_p, secret_key, 1005 B_FALSE, B_FALSE); 1006 return (CKR_HOST_MEMORY); 1007 } 1008 1009 /* 1010 * The key produced by this mechanism will be of the 1011 * specified type and length. 1012 * The truncation removes extra bytes from the leading 1013 * of the digested key value. 1014 */ 1015 (void) memcpy(OBJ_SEC_VALUE(secret_key), 1016 (hash + hash_len - secret_key_len), 1017 secret_key_len); 1018 1019 break; 1020 1021 /* 1022 * The key sensitivity and extractability rules for the generated 1023 * keys will be enforced inside soft_ssl_master_key_derive() and 1024 * soft_ssl_key_and_mac_derive() 1025 */ 1026 case CKM_SSL3_MASTER_KEY_DERIVE: 1027 case CKM_SSL3_MASTER_KEY_DERIVE_DH: 1028 case CKM_TLS_MASTER_KEY_DERIVE: 1029 case CKM_TLS_MASTER_KEY_DERIVE_DH: 1030 if (phKey == NULL_PTR) 1031 return (CKR_ARGUMENTS_BAD); 1032 return (soft_ssl_master_key_derive(session_p, pMechanism, 1033 basekey_p, pTemplate, ulAttributeCount, phKey)); 1034 1035 case CKM_SSL3_KEY_AND_MAC_DERIVE: 1036 case CKM_TLS_KEY_AND_MAC_DERIVE: 1037 return (soft_ssl_key_and_mac_derive(session_p, pMechanism, 1038 basekey_p, pTemplate, ulAttributeCount)); 1039 1040 case CKM_TLS_PRF: 1041 if (pMechanism->pParameter == NULL || 1042 pMechanism->ulParameterLen != sizeof (CK_TLS_PRF_PARAMS) || 1043 phKey != NULL) 1044 return (CKR_ARGUMENTS_BAD); 1045 1046 if (pTemplate != NULL) 1047 return (CKR_TEMPLATE_INCONSISTENT); 1048 1049 return (derive_tls_prf( 1050 (CK_TLS_PRF_PARAMS_PTR)pMechanism->pParameter, basekey_p)); 1051 1052 default: 1053 return (CKR_MECHANISM_INVALID); 1054 } 1055 1056 soft_derive_enforce_flags(basekey_p, secret_key); 1057 1058 if (IS_TOKEN_OBJECT(secret_key)) { 1059 /* 1060 * All the info has been filled, so we can write to 1061 * keystore now. 1062 */ 1063 rv = soft_put_object_to_keystore(secret_key); 1064 if (rv != CKR_OK) 1065 soft_delete_token_object(secret_key, B_FALSE, B_FALSE); 1066 } 1067 1068 return (rv); 1069 } 1070 1071 1072 /* 1073 * Perform key derivation rules on key's sensitivity and extractability. 1074 */ 1075 void 1076 soft_derive_enforce_flags(soft_object_t *basekey, soft_object_t *newkey) 1077 { 1078 1079 boolean_t new_sensitive = B_FALSE; 1080 boolean_t new_extractable = B_FALSE; 1081 1082 /* 1083 * The sensitive and extractable bits have been set when 1084 * the newkey was built. 1085 */ 1086 if (newkey->bool_attr_mask & SENSITIVE_BOOL_ON) { 1087 new_sensitive = B_TRUE; 1088 } 1089 1090 if (newkey->bool_attr_mask & EXTRACTABLE_BOOL_ON) { 1091 new_extractable = B_TRUE; 1092 } 1093 1094 /* Derive the CKA_ALWAYS_SENSITIVE flag */ 1095 if (!basekey->bool_attr_mask & ALWAYS_SENSITIVE_BOOL_ON) { 1096 /* 1097 * If the base key has its CKA_ALWAYS_SENSITIVE set to 1098 * FALSE, then the derived key will as well. 1099 */ 1100 newkey->bool_attr_mask &= ~ALWAYS_SENSITIVE_BOOL_ON; 1101 } else { 1102 /* 1103 * If the base key has its CKA_ALWAYS_SENSITIVE set to TRUE, 1104 * then the derived key has the CKA_ALWAYS_SENSITIVE set to 1105 * the same value as its CKA_SENSITIVE; 1106 */ 1107 if (new_sensitive) { 1108 newkey->bool_attr_mask |= ALWAYS_SENSITIVE_BOOL_ON; 1109 } else { 1110 newkey->bool_attr_mask &= ~ALWAYS_SENSITIVE_BOOL_ON; 1111 } 1112 } 1113 1114 /* Derive the CKA_NEVER_EXTRACTABLE flag */ 1115 if (!basekey->bool_attr_mask & NEVER_EXTRACTABLE_BOOL_ON) { 1116 /* 1117 * If the base key has its CKA_NEVER_EXTRACTABLE set to 1118 * FALSE, then the derived key will as well. 1119 */ 1120 newkey->bool_attr_mask &= ~NEVER_EXTRACTABLE_BOOL_ON; 1121 } else { 1122 /* 1123 * If the base key has its CKA_NEVER_EXTRACTABLE set to TRUE, 1124 * then the derived key has the CKA_NEVER_EXTRACTABLE set to 1125 * the opposite value from its CKA_EXTRACTABLE; 1126 */ 1127 if (new_extractable) { 1128 newkey->bool_attr_mask &= ~NEVER_EXTRACTABLE_BOOL_ON; 1129 } else { 1130 newkey->bool_attr_mask |= NEVER_EXTRACTABLE_BOOL_ON; 1131 } 1132 } 1133 1134 /* Set the CKA_LOCAL flag to false */ 1135 newkey->bool_attr_mask &= ~LOCAL_BOOL_ON; 1136 } 1137 1138 1139 /* 1140 * do_prf 1141 * 1142 * This routine implements Step 3. of the PBKDF2 function 1143 * defined in PKCS#5 for generating derived keys from a 1144 * password. 1145 * 1146 * Currently, PRF is always SHA_1_HMAC. 1147 */ 1148 static CK_RV 1149 do_prf(soft_session_t *session_p, CK_PKCS5_PBKD2_PARAMS_PTR params, 1150 soft_object_t *hmac_key, CK_BYTE *newsalt, CK_ULONG saltlen, 1151 CK_BYTE *blockdata, CK_ULONG blocklen) 1152 { 1153 CK_RV rv = CKR_OK; 1154 CK_MECHANISM digest_mech = {CKM_SHA_1_HMAC, NULL, 0}; 1155 CK_BYTE buffer[2][SHA1_HASH_SIZE]; 1156 CK_ULONG hmac_outlen = SHA1_HASH_SIZE; 1157 CK_ULONG inlen; 1158 CK_BYTE *input, *output; 1159 CK_ULONG i, j; 1160 1161 input = newsalt; 1162 inlen = saltlen; 1163 1164 output = buffer[1]; 1165 (void) pthread_mutex_lock(&session_p->session_mutex); 1166 1167 if (session_p->sign.flags & CRYPTO_OPERATION_ACTIVE) { 1168 (void) pthread_mutex_unlock(&session_p->session_mutex); 1169 return (CKR_OPERATION_ACTIVE); 1170 } 1171 session_p->sign.flags |= CRYPTO_OPERATION_ACTIVE; 1172 (void) pthread_mutex_unlock(&session_p->session_mutex); 1173 1174 for (i = 0; i < params->iterations; i++) { 1175 /* 1176 * The key doesn't change, its always the 1177 * password iniitally given. 1178 */ 1179 rv = soft_sign_init(session_p, &digest_mech, hmac_key); 1180 1181 if (rv != CKR_OK) { 1182 goto cleanup; 1183 } 1184 1185 /* Call PRF function (SHA1_HMAC for now). */ 1186 rv = soft_sign(session_p, input, inlen, output, &hmac_outlen); 1187 1188 if (rv != CKR_OK) { 1189 goto cleanup; 1190 } 1191 /* 1192 * The first time, initialize the output buffer 1193 * with the HMAC signature. 1194 */ 1195 if (i == 0) { 1196 (void) memcpy(blockdata, output, 1197 local_min(blocklen, hmac_outlen)); 1198 } else { 1199 /* 1200 * XOR the existing data with output from PRF. 1201 * 1202 * Only XOR up to the length of the blockdata, 1203 * it may be less than a full hmac buffer when 1204 * the final block is being computed. 1205 */ 1206 for (j = 0; j < hmac_outlen && j < blocklen; j++) 1207 blockdata[j] ^= output[j]; 1208 } 1209 /* Output from previous PRF is input for next round */ 1210 input = output; 1211 inlen = hmac_outlen; 1212 1213 /* 1214 * Switch buffers to avoid overuse of memcpy. 1215 * Initially we used buffer[1], so after the end of 1216 * the first iteration (i==0), we switch to buffer[0] 1217 * and continue swapping with each iteration. 1218 */ 1219 output = buffer[i%2]; 1220 } 1221 cleanup: 1222 (void) pthread_mutex_lock(&session_p->session_mutex); 1223 session_p->sign.flags &= ~CRYPTO_OPERATION_ACTIVE; 1224 (void) pthread_mutex_unlock(&session_p->session_mutex); 1225 1226 return (rv); 1227 } 1228 1229 static CK_RV 1230 soft_create_hmac_key(soft_session_t *session_p, CK_BYTE *passwd, 1231 CK_ULONG passwd_len, CK_OBJECT_HANDLE_PTR phKey) 1232 { 1233 CK_RV rv = CKR_OK; 1234 CK_OBJECT_CLASS keyclass = CKO_SECRET_KEY; 1235 CK_KEY_TYPE keytype = CKK_GENERIC_SECRET; 1236 CK_BBOOL True = TRUE; 1237 CK_ATTRIBUTE keytemplate[4]; 1238 soft_object_t *keyobj; 1239 1240 /* 1241 * We must initialize each template member individually 1242 * because at the time of initial coding for ON10, the 1243 * compiler was using the "-xc99=%none" option 1244 * which prevents us from being able to declare the whole 1245 * template in place as usual. 1246 */ 1247 keytemplate[0].type = CKA_CLASS; 1248 keytemplate[0].pValue = &keyclass; 1249 keytemplate[0].ulValueLen = sizeof (keyclass); 1250 1251 keytemplate[1].type = CKA_KEY_TYPE; 1252 keytemplate[1].pValue = &keytype; 1253 keytemplate[1].ulValueLen = sizeof (keytype); 1254 1255 keytemplate[2].type = CKA_SIGN; 1256 keytemplate[2].pValue = &True; 1257 keytemplate[2].ulValueLen = sizeof (True); 1258 1259 keytemplate[3].type = CKA_VALUE; 1260 keytemplate[3].pValue = passwd; 1261 keytemplate[3].ulValueLen = passwd_len; 1262 /* 1263 * Create a generic key object to be used for HMAC operations. 1264 * The "value" for this key is the password from the 1265 * mechanism parameter structure. 1266 */ 1267 rv = soft_gen_keyobject(keytemplate, 1268 sizeof (keytemplate)/sizeof (CK_ATTRIBUTE), &keyobj, session_p, 1269 CKO_SECRET_KEY, (CK_KEY_TYPE)CKK_GENERIC_SECRET, 0, 1270 SOFT_CREATE_OBJ, B_TRUE); 1271 1272 if (keyobj != NULL) 1273 *phKey = keyobj->handle; 1274 1275 return (rv); 1276 } 1277 1278 CK_RV 1279 soft_generate_pkcs5_pbkdf2_key(soft_session_t *session_p, 1280 CK_MECHANISM_PTR pMechanism, soft_object_t *secret_key) 1281 { 1282 CK_RV rv = CKR_OK; 1283 CK_PKCS5_PBKD2_PARAMS *params = 1284 (CK_PKCS5_PBKD2_PARAMS *)pMechanism->pParameter; 1285 CK_ULONG hLen = SHA1_HASH_SIZE; 1286 CK_ULONG dkLen, i; 1287 CK_ULONG blocks, remainder; 1288 CK_OBJECT_HANDLE phKey = 0; 1289 soft_object_t *hmac_key = NULL; 1290 CK_BYTE *salt = NULL; 1291 CK_BYTE *keydata = NULL; 1292 1293 params = (CK_PKCS5_PBKD2_PARAMS_PTR) pMechanism->pParameter; 1294 1295 if (params->prf != CKP_PKCS5_PBKD2_HMAC_SHA1) 1296 return (CKR_MECHANISM_PARAM_INVALID); 1297 1298 if (params->pPrfData != NULL || params->ulPrfDataLen != 0) 1299 return (CKR_DATA_INVALID); 1300 1301 if (params->saltSource != CKZ_SALT_SPECIFIED || 1302 params->iterations == 0) 1303 return (CKR_MECHANISM_PARAM_INVALID); 1304 1305 /* 1306 * Create a key object to use for HMAC operations. 1307 */ 1308 rv = soft_create_hmac_key(session_p, params->pPassword, 1309 *params->ulPasswordLen, &phKey); 1310 1311 if (rv != CKR_OK) 1312 return (rv); 1313 1314 hmac_key = (soft_object_t *)phKey; 1315 1316 /* Step 1. */ 1317 dkLen = OBJ_SEC_VALUE_LEN(secret_key); /* length of desired key */ 1318 1319 if (dkLen > ((((u_longlong_t)1)<<32)-1)*hLen) { 1320 (void) soft_delete_object(session_p, hmac_key, B_FALSE, 1321 B_FALSE); 1322 return (CKR_KEY_SIZE_RANGE); 1323 } 1324 1325 /* Step 2. */ 1326 blocks = dkLen / hLen; 1327 1328 /* crude "Ceiling" function to adjust the number of blocks to use */ 1329 if (blocks * hLen != dkLen) 1330 blocks++; 1331 1332 remainder = dkLen - ((blocks - 1) * hLen); 1333 1334 /* Step 3 */ 1335 salt = (CK_BYTE *)malloc(params->ulSaltSourceDataLen + 4); 1336 if (salt == NULL) { 1337 (void) soft_delete_object(session_p, hmac_key, B_FALSE, 1338 B_FALSE); 1339 return (CKR_HOST_MEMORY); 1340 } 1341 /* 1342 * Nothing in PKCS#5 says you cannot pass an empty 1343 * salt, so we will allow for this and not return error 1344 * if the salt is not specified. 1345 */ 1346 if (params->pSaltSourceData != NULL && params->ulSaltSourceDataLen > 0) 1347 (void) memcpy(salt, params->pSaltSourceData, 1348 params->ulSaltSourceDataLen); 1349 1350 /* 1351 * Get pointer to the data section of the key, 1352 * this will be used below as output from the 1353 * PRF iteration/concatenations so that when the 1354 * blocks are all iterated, the secret_key will 1355 * have the resulting derived key value. 1356 */ 1357 keydata = (CK_BYTE *)OBJ_SEC_VALUE(secret_key); 1358 1359 /* Step 4. */ 1360 for (i = 0; i < blocks && (rv == CKR_OK); i++) { 1361 CK_BYTE *s; 1362 1363 s = salt + params->ulSaltSourceDataLen; 1364 1365 /* 1366 * Append the block index to the salt as input 1367 * to the PRF. Block index should start at 1 1368 * not 0. 1369 */ 1370 *s++ = ((i+1) >> 24) & 0xff; 1371 *s++ = ((i+1) >> 16) & 0xff; 1372 *s++ = ((i+1) >> 8) & 0xff; 1373 *s = ((i+1)) & 0xff; 1374 1375 /* 1376 * Adjust the key pointer so we always append the 1377 * PRF output to the current key. 1378 */ 1379 rv = do_prf(session_p, params, hmac_key, 1380 salt, params->ulSaltSourceDataLen + 4, keydata, 1381 ((i + 1) == blocks ? remainder : hLen)); 1382 1383 keydata += hLen; 1384 } 1385 (void) soft_delete_object(session_p, hmac_key, B_FALSE, B_FALSE); 1386 freezero(salt, params->ulSaltSourceDataLen); 1387 1388 return (rv); 1389 } 1390 1391 CK_RV 1392 soft_wrapkey(soft_session_t *session_p, CK_MECHANISM_PTR pMechanism, 1393 soft_object_t *wrappingKey_p, soft_object_t *hkey_p, 1394 CK_BYTE_PTR pWrappedKey, CK_ULONG_PTR pulWrappedKeyLen) 1395 { 1396 CK_RV rv = CKR_OK; 1397 CK_ULONG plain_len = 0; 1398 CK_BYTE_PTR plain_data = NULL; 1399 CK_ULONG padded_len = 0; 1400 CK_BYTE_PTR padded_data = NULL; 1401 CK_ULONG wkey_blksz = 1; /* so modulo will work right */ 1402 1403 /* Check if the mechanism is supported. */ 1404 switch (pMechanism->mechanism) { 1405 case CKM_DES_CBC_PAD: 1406 case CKM_DES3_CBC_PAD: 1407 case CKM_AES_CBC_PAD: 1408 /* 1409 * Secret key mechs with padding can be used to wrap secret 1410 * keys and private keys only. See PKCS#11, * sec 11.14, 1411 * C_WrapKey and secs 12.* for each mechanism's wrapping/ 1412 * unwrapping constraints. 1413 */ 1414 if (hkey_p->class != CKO_SECRET_KEY && hkey_p->class != 1415 CKO_PRIVATE_KEY) 1416 return (CKR_MECHANISM_INVALID); 1417 break; 1418 case CKM_RSA_PKCS: 1419 case CKM_RSA_X_509: 1420 case CKM_DES_ECB: 1421 case CKM_DES3_ECB: 1422 case CKM_AES_ECB: 1423 case CKM_DES_CBC: 1424 case CKM_DES3_CBC: 1425 case CKM_AES_CBC: 1426 case CKM_AES_CTR: 1427 case CKM_BLOWFISH_CBC: 1428 /* 1429 * Unpadded secret key mechs and private key mechs are only 1430 * defined for wrapping secret keys. See PKCS#11 refs above. 1431 */ 1432 if (hkey_p->class != CKO_SECRET_KEY) 1433 return (CKR_MECHANISM_INVALID); 1434 break; 1435 default: 1436 return (CKR_MECHANISM_INVALID); 1437 } 1438 1439 if (hkey_p->class == CKO_SECRET_KEY) { 1440 plain_data = OBJ_SEC_VALUE(hkey_p); 1441 plain_len = OBJ_SEC_VALUE_LEN(hkey_p); 1442 } else { 1443 /* 1444 * BER-encode the object to be wrapped: call first with 1445 * plain_data = NULL to get the size needed, allocate that 1446 * much space, call again to fill space with actual data. 1447 */ 1448 rv = soft_object_to_asn1(hkey_p, NULL, &plain_len); 1449 if (rv != CKR_OK) 1450 return (rv); 1451 if ((plain_data = malloc(plain_len)) == NULL) 1452 return (CKR_HOST_MEMORY); 1453 (void) memset(plain_data, 0x0, plain_len); 1454 rv = soft_object_to_asn1(hkey_p, plain_data, &plain_len); 1455 if (rv != CKR_OK) 1456 goto cleanup_wrap; 1457 } 1458 1459 /* 1460 * For unpadded ECB and CBC mechanisms, the object needs to be 1461 * padded to the wrapping key's blocksize prior to the encryption. 1462 */ 1463 padded_len = plain_len; 1464 padded_data = plain_data; 1465 1466 switch (pMechanism->mechanism) { 1467 case CKM_DES_ECB: 1468 case CKM_DES3_ECB: 1469 case CKM_AES_ECB: 1470 case CKM_DES_CBC: 1471 case CKM_DES3_CBC: 1472 case CKM_AES_CBC: 1473 case CKM_BLOWFISH_CBC: 1474 /* Find the block size of the wrapping key. */ 1475 if (wrappingKey_p->class == CKO_SECRET_KEY) { 1476 switch (wrappingKey_p->key_type) { 1477 case CKK_DES: 1478 case CKK_DES2: 1479 case CKK_DES3: 1480 wkey_blksz = DES_BLOCK_LEN; 1481 break; 1482 case CKK_AES: 1483 wkey_blksz = AES_BLOCK_LEN; 1484 break; 1485 case CKK_BLOWFISH: 1486 wkey_blksz = BLOWFISH_BLOCK_LEN; 1487 break; 1488 default: 1489 break; 1490 } 1491 } else { 1492 rv = CKR_WRAPPING_KEY_TYPE_INCONSISTENT; 1493 goto cleanup_wrap; 1494 } 1495 1496 /* Extend the plain text data to block size boundary. */ 1497 if ((padded_len % wkey_blksz) != 0) { 1498 padded_len += (wkey_blksz - (plain_len % wkey_blksz)); 1499 if ((padded_data = malloc(padded_len)) == NULL) { 1500 rv = CKR_HOST_MEMORY; 1501 goto cleanup_wrap; 1502 } 1503 (void) memset(padded_data, 0x0, padded_len); 1504 (void) memcpy(padded_data, plain_data, plain_len); 1505 } 1506 break; 1507 default: 1508 break; 1509 } 1510 1511 rv = soft_encrypt_init(session_p, pMechanism, wrappingKey_p); 1512 if (rv != CKR_OK) 1513 goto cleanup_wrap; 1514 1515 rv = soft_encrypt(session_p, padded_data, padded_len, 1516 pWrappedKey, pulWrappedKeyLen); 1517 1518 cleanup_wrap: 1519 if (padded_data != NULL && padded_len != plain_len) { 1520 /* Clear buffer before returning to memory pool. */ 1521 freezero(padded_data, padded_len); 1522 } 1523 1524 if ((hkey_p->class != CKO_SECRET_KEY) && (plain_data != NULL)) { 1525 /* Clear buffer before returning to memory pool. */ 1526 freezero(plain_data, plain_len); 1527 } 1528 1529 return (rv); 1530 } 1531 1532 /* 1533 * Quick check for whether unwrapped key length is appropriate for key type 1534 * and whether it needs to be truncated (in case the wrapping function had 1535 * to pad the key prior to wrapping). 1536 */ 1537 static CK_RV 1538 soft_unwrap_secret_len_check(CK_KEY_TYPE keytype, CK_MECHANISM_TYPE mechtype, 1539 CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulAttributeCount) 1540 { 1541 CK_ULONG i; 1542 boolean_t isValueLen = B_FALSE; 1543 1544 /* 1545 * Based on the key type and the mech used to unwrap, need to 1546 * determine if CKA_VALUE_LEN should or should not be specified. 1547 * PKCS#11 v2.11 restricts CKA_VALUE_LEN from being specified 1548 * for C_UnwrapKey for all mechs and key types, but v2.20 loosens 1549 * that restriction, perhaps because it makes it impossible to 1550 * determine the original length of unwrapped variable-length secret 1551 * keys, such as RC4, AES, and GENERIC_SECRET. These variable-length 1552 * secret keys would have been padded with trailing null-bytes so 1553 * that they could be successfully wrapped with *_ECB and *_CBC 1554 * mechanisms. Hence for unwrapping with these mechs, CKA_VALUE_LEN 1555 * must be specified. For unwrapping with other mechs, such as 1556 * *_CBC_PAD, the CKA_VALUE_LEN is not needed. 1557 */ 1558 1559 /* Find out if template has CKA_VALUE_LEN. */ 1560 for (i = 0; i < ulAttributeCount; i++) { 1561 if (pTemplate[i].type == CKA_VALUE_LEN && 1562 pTemplate[i].pValue != NULL) { 1563 isValueLen = B_TRUE; 1564 break; 1565 } 1566 } 1567 1568 /* Does its presence conflict with the mech type and key type? */ 1569 switch (mechtype) { 1570 case CKM_DES_ECB: 1571 case CKM_DES3_ECB: 1572 case CKM_AES_ECB: 1573 case CKM_DES_CBC: 1574 case CKM_DES3_CBC: 1575 case CKM_AES_CBC: 1576 case CKM_BLOWFISH_CBC: 1577 /* 1578 * CKA_VALUE_LEN must be specified 1579 * if keytype is CKK_RC4, CKK_AES and CKK_GENERIC_SECRET 1580 * and must not be specified otherwise 1581 */ 1582 switch (keytype) { 1583 case CKK_DES: 1584 case CKK_DES2: 1585 case CKK_DES3: 1586 if (isValueLen) 1587 return (CKR_TEMPLATE_INCONSISTENT); 1588 break; 1589 case CKK_GENERIC_SECRET: 1590 case CKK_RC4: 1591 case CKK_AES: 1592 case CKK_BLOWFISH: 1593 if (!isValueLen) 1594 return (CKR_TEMPLATE_INCOMPLETE); 1595 break; 1596 default: 1597 return (CKR_FUNCTION_NOT_SUPPORTED); 1598 } 1599 break; 1600 default: 1601 /* CKA_VALUE_LEN must not be specified */ 1602 if (isValueLen) 1603 return (CKR_TEMPLATE_INCONSISTENT); 1604 break; 1605 } 1606 1607 return (CKR_OK); 1608 } 1609 1610 CK_RV 1611 soft_unwrapkey(soft_session_t *session_p, CK_MECHANISM_PTR pMechanism, 1612 soft_object_t *unwrappingkey_p, CK_BYTE_PTR pWrappedKey, 1613 CK_ULONG ulWrappedKeyLen, CK_ATTRIBUTE_PTR pTemplate, 1614 CK_ULONG ulAttributeCount, CK_OBJECT_HANDLE_PTR phKey) 1615 { 1616 CK_RV rv = CKR_OK; 1617 CK_OBJECT_CLASS new_obj_class = ~0UL; 1618 int i = 0; 1619 soft_object_t *new_objp = NULL; 1620 boolean_t persistent = B_FALSE; 1621 CK_BYTE_PTR plain_data = NULL; 1622 CK_ULONG plain_len = 0; 1623 secret_key_obj_t *sck = NULL; 1624 1625 /* Scan the attribute template for the object class. */ 1626 if (pTemplate != NULL && ulAttributeCount != 0) { 1627 for (i = 0; i < ulAttributeCount; i++) { 1628 if (pTemplate[i].type == CKA_CLASS) { 1629 new_obj_class = 1630 *((CK_OBJECT_CLASS *)pTemplate[i].pValue); 1631 break; 1632 } 1633 } 1634 if (new_obj_class == ~0UL) 1635 return (CKR_TEMPLATE_INCOMPLETE); 1636 } 1637 1638 /* 1639 * Check if the mechanism is supported, and now that the new 1640 * object's class is known, the mechanism selected should be 1641 * capable of doing the unwrap. 1642 */ 1643 switch (pMechanism->mechanism) { 1644 case CKM_RSA_PKCS: 1645 case CKM_RSA_X_509: 1646 case CKM_DES_ECB: 1647 case CKM_DES3_ECB: 1648 case CKM_AES_ECB: 1649 case CKM_DES_CBC: 1650 case CKM_DES3_CBC: 1651 case CKM_AES_CBC: 1652 case CKM_BLOWFISH_CBC: 1653 if (new_obj_class != CKO_SECRET_KEY) 1654 return (CKR_MECHANISM_INVALID); 1655 break; 1656 case CKM_DES_CBC_PAD: 1657 case CKM_DES3_CBC_PAD: 1658 case CKM_AES_CBC_PAD: 1659 if (new_obj_class != CKO_SECRET_KEY && new_obj_class != 1660 CKO_PRIVATE_KEY) 1661 return (CKR_MECHANISM_INVALID); 1662 break; 1663 default: 1664 return (CKR_MECHANISM_INVALID); 1665 } 1666 1667 /* Create a new object based on the attribute template. */ 1668 rv = soft_gen_keyobject(pTemplate, ulAttributeCount, 1669 &new_objp, session_p, (CK_OBJECT_CLASS)~0UL, 1670 (CK_KEY_TYPE)~0UL, 0, SOFT_UNWRAP_KEY, B_FALSE); 1671 if (rv != CKR_OK) 1672 return (rv); 1673 1674 /* 1675 * New key will have CKA_ALWAYS_SENSITIVE and CKA_NEVER_EXTRACTABLE 1676 * both set to FALSE. CKA_EXTRACTABLE will be set _by_default_ to 1677 * true -- leaving the possibility that it may be set FALSE by the 1678 * supplied attribute template. If the precise template cannot be 1679 * supported, unwrap fails. PKCS#11 spec, Sec. 11.14, C_UnwrapKey. 1680 * 1681 * Therefore, check the new object's NEVER_EXTRACTABLE_BOOL_ON and 1682 * ALWAYS_SENSITVE_BOOL_ON; if they are TRUE, the template must 1683 * have supplied them and therefore we cannot honor the unwrap. 1684 */ 1685 if ((new_objp->bool_attr_mask & NEVER_EXTRACTABLE_BOOL_ON) || 1686 (new_objp->bool_attr_mask & ALWAYS_SENSITIVE_BOOL_ON)) { 1687 rv = CKR_TEMPLATE_INCONSISTENT; 1688 goto cleanup_unwrap; 1689 } 1690 1691 rv = soft_decrypt_init(session_p, pMechanism, unwrappingkey_p); 1692 if (rv != CKR_OK) 1693 goto cleanup_unwrap; 1694 1695 /* First get the length of the plain data */ 1696 rv = soft_decrypt(session_p, pWrappedKey, ulWrappedKeyLen, NULL, 1697 &plain_len); 1698 if (rv != CKR_OK) 1699 goto cleanup_unwrap; 1700 1701 /* Allocate space for the unwrapped data */ 1702 if ((plain_data = malloc(plain_len)) == NULL) { 1703 rv = CKR_HOST_MEMORY; 1704 goto cleanup_unwrap; 1705 } 1706 (void) memset(plain_data, 0x0, plain_len); 1707 1708 /* Perform actual decryption into the allocated space. */ 1709 rv = soft_decrypt(session_p, pWrappedKey, ulWrappedKeyLen, plain_data, 1710 &plain_len); 1711 if (rv != CKR_OK) 1712 goto cleanup_unwrap; 1713 1714 if (new_objp->class == CKO_SECRET_KEY) { 1715 /* 1716 * Since no ASN.1 encoding is done for secret keys, check for 1717 * appropriateness and copy decrypted buffer to the key object. 1718 */ 1719 1720 /* Check keytype and mechtype don't conflict with valuelen */ 1721 rv = soft_unwrap_secret_len_check(new_objp->key_type, 1722 pMechanism->mechanism, pTemplate, ulAttributeCount); 1723 if (rv != CKR_OK) 1724 goto cleanup_unwrap; 1725 1726 /* 1727 * Allocate the secret key structure if not already there; 1728 * it will exist for variable length keys since CKA_VALUE_LEN 1729 * is specified and saved, but not for fixed length keys. 1730 */ 1731 if (OBJ_SEC(new_objp) == NULL) { 1732 if ((sck = calloc(1, sizeof (secret_key_obj_t))) == 1733 NULL) { 1734 rv = CKR_HOST_MEMORY; 1735 goto cleanup_unwrap; 1736 } 1737 OBJ_SEC(new_objp) = sck; 1738 } 1739 1740 switch (new_objp->key_type) { 1741 /* Fixed length secret keys don't have CKA_VALUE_LEN */ 1742 case CKK_DES: 1743 OBJ_SEC_VALUE_LEN(new_objp) = DES_KEYSIZE; 1744 break; 1745 case CKK_DES2: 1746 OBJ_SEC_VALUE_LEN(new_objp) = DES2_KEYSIZE; 1747 break; 1748 case CKK_DES3: 1749 OBJ_SEC_VALUE_LEN(new_objp) = DES3_KEYSIZE; 1750 break; 1751 1752 /* 1753 * Variable length secret keys. CKA_VALUE_LEN must be 1754 * provided by the template when mech is *_ECB or *_CBC, and 1755 * should already have been set during soft_gen_keyobject(). 1756 * Otherwise we don't need CKA_VALUE_LEN. 1757 */ 1758 case CKK_GENERIC_SECRET: 1759 case CKK_RC4: 1760 case CKK_AES: 1761 case CKK_BLOWFISH: 1762 break; 1763 default: 1764 rv = CKR_WRAPPED_KEY_INVALID; 1765 goto cleanup_unwrap; 1766 }; 1767 1768 if (OBJ_SEC_VALUE_LEN(new_objp) == 0) { 1769 /* No CKA_VALUE_LEN set so set it now and save data */ 1770 OBJ_SEC_VALUE_LEN(new_objp) = plain_len; 1771 OBJ_SEC_VALUE(new_objp) = plain_data; 1772 } else if (OBJ_SEC_VALUE_LEN(new_objp) == plain_len) { 1773 /* No need to truncate, just save the data */ 1774 OBJ_SEC_VALUE(new_objp) = plain_data; 1775 } else if (OBJ_SEC_VALUE_LEN(new_objp) > plain_len) { 1776 /* Length can't be bigger than what was decrypted */ 1777 rv = CKR_WRAPPED_KEY_LEN_RANGE; 1778 goto cleanup_unwrap; 1779 } else { /* betw 0 and plain_len, hence padded */ 1780 /* Truncate the data before saving. */ 1781 OBJ_SEC_VALUE(new_objp) = realloc(plain_data, 1782 OBJ_SEC_VALUE_LEN(new_objp)); 1783 if (OBJ_SEC_VALUE(new_objp) == NULL) { 1784 rv = CKR_HOST_MEMORY; 1785 goto cleanup_unwrap; 1786 } 1787 } 1788 } else { 1789 /* BER-decode the object to be unwrapped. */ 1790 rv = soft_asn1_to_object(new_objp, plain_data, plain_len); 1791 if (rv != CKR_OK) 1792 goto cleanup_unwrap; 1793 } 1794 1795 /* If it needs to be persistent, write it to the keystore */ 1796 if (IS_TOKEN_OBJECT(new_objp)) { 1797 persistent = B_TRUE; 1798 rv = soft_put_object_to_keystore(new_objp); 1799 if (rv != CKR_OK) 1800 goto cleanup_unwrap; 1801 } 1802 1803 if (new_objp->class != CKO_SECRET_KEY) { 1804 /* Clear buffer before returning to memory pool. */ 1805 freezero(plain_data, plain_len); 1806 } 1807 1808 *phKey = (CK_OBJECT_HANDLE)new_objp; 1809 1810 return (CKR_OK); 1811 1812 cleanup_unwrap: 1813 /* The decrypted private key buffer must be freed explicitly. */ 1814 if ((new_objp->class != CKO_SECRET_KEY) && (plain_data != NULL)) { 1815 /* Clear buffer before returning to memory pool. */ 1816 freezero(plain_data, plain_len); 1817 } 1818 1819 /* sck and new_objp are indirectly free()d inside these functions */ 1820 if (IS_TOKEN_OBJECT(new_objp)) 1821 soft_delete_token_object(new_objp, persistent, B_FALSE); 1822 else 1823 soft_delete_object(session_p, new_objp, B_FALSE, B_FALSE); 1824 1825 return (rv); 1826 } 1827