openssl: Fixes for ECDSA with OpenSSL 3.0

2022-04-14 19:05:44 +02:00
parent be0ce6db93
commit 293a912c7d
5 changed files with 347 additions and 300 deletions
@@ -27,6 +27,10 @@
 #include <openssl/ecdsa.h>
 #include <openssl/x509.h>

+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#include <openssl/core_names.h>
+#endif
+
 #if OPENSSL_VERSION_NUMBER < 0x10100000L
 OPENSSL_KEY_FALLBACK(ECDSA_SIG, r, s)
 #endif
@@ -45,7 +49,7 @@ struct private_openssl_ec_public_key_t {
 	/**
 	 * EC key object
 	 */
-	EC_KEY *ec;
+	EVP_PKEY *key;

 	/**
 	 * reference counter
@@ -53,14 +57,48 @@ struct private_openssl_ec_public_key_t {
 	refcount_t ref;
 };

+/**
+ * Verification of a DER encoded signature as in RFC 3279
+ */
+static bool verify_der_signature(private_openssl_ec_public_key_t *this,
+								 int nid_hash, chunk_t data, chunk_t signature)
+{
+	EVP_MD_CTX *ctx;
+	const EVP_MD *md;
+
+	/* remove any preceding 0-bytes from signature */
+	while (signature.len && signature.ptr[0] == 0x00)
+	{
+		signature = chunk_skip(signature, 1);
+	}
+	md = EVP_get_digestbynid(nid_hash);
+	if (!md)
+	{
+		return FALSE;
+	}
+	ctx = EVP_MD_CTX_create();
+	if (!ctx ||
+		EVP_DigestVerifyInit(ctx, NULL, md, NULL, this->key) <= 0 ||
+		EVP_DigestVerifyUpdate(ctx, data.ptr, data.len) <= 0 ||
+		EVP_DigestVerifyFinal(ctx, signature.ptr, signature.len) != 1)
+	{
+		EVP_MD_CTX_destroy(ctx);
+		return FALSE;
+	}
+	EVP_MD_CTX_destroy(ctx);
+	return TRUE;
+}
+
 /**
 * Verification of a signature as in RFC 4754
 */
 static bool verify_signature(private_openssl_ec_public_key_t *this,
-							 chunk_t hash, chunk_t signature)
+							 int nid_hash, chunk_t data, chunk_t signature)
 {
+	EVP_PKEY_CTX *ctx;
 	BIGNUM *r, *s;
 	ECDSA_SIG *sig;
+	chunk_t der_sig;
 	bool valid = FALSE;

 	sig = ECDSA_SIG_new();
@@ -77,13 +115,73 @@ static bool verify_signature(private_openssl_ec_public_key_t *this,
 		}
 		if (ECDSA_SIG_set0(sig, r, s))
 		{
-			valid = (ECDSA_do_verify(hash.ptr, hash.len, sig, this->ec) == 1);
+			der_sig = openssl_i2chunk(ECDSA_SIG, sig);
+			if (!nid_hash)
+			{	/* EVP_DigestVerify*() has issues with NULL EVP_MD */
+				ctx = EVP_PKEY_CTX_new(this->key, NULL);
+				valid = ctx && EVP_PKEY_verify_init(ctx) > 0 &&
+						EVP_PKEY_verify(ctx, der_sig.ptr, der_sig.len,
+										data.ptr, data.len) > 0;
+				EVP_PKEY_CTX_free(ctx);
+			}
+			else
+			{
+				valid = verify_der_signature(this, nid_hash, data, der_sig);
+			}
+			chunk_free(&der_sig);
 		}
 		ECDSA_SIG_free(sig);
 	}
 	return valid;
 }

+/**
+ * Check that the given key's curve matches a specific one. Also used by
+ * private key.
+ */
+bool openssl_check_ec_key_curve(EVP_PKEY *key, int nid_curve)
+{
+	EC_GROUP *req_group, *my_group = NULL;
+	bool matches = FALSE;
+
+	req_group = EC_GROUP_new_by_curve_name(nid_curve);
+	if (!req_group)
+	{
+		goto error;
+	}
+
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	char name[BUF_LEN];
+	OSSL_PARAM params[] = {
+		OSSL_PARAM_utf8_string(OSSL_PKEY_PARAM_GROUP_NAME, name, sizeof(name)),
+		OSSL_PARAM_END,
+	};
+
+	if (!EVP_PKEY_get_group_name(key, name, sizeof(name), NULL))
+	{
+		goto error;
+	}
+	my_group = EC_GROUP_new_from_params(params, NULL, NULL);
+#elif OPENSSL_VERSION_NUMBER >= 0x1010000fL
+	EC_KEY *ec = EVP_PKEY_get0_EC_KEY(key);
+	my_group = EC_GROUP_dup(EC_KEY_get0_group(ec));
+#else
+	EC_KEY *ec = EVP_PKEY_get1_EC_KEY(key);
+	my_group = EC_GROUP_dup(EC_KEY_get0_group(ec));
+	EC_KEY_free(ec);
+#endif
+
+	if (EC_GROUP_cmp(my_group, req_group, NULL) == 0)
+	{
+		matches = TRUE;
+	}
+
+error:
+	EC_GROUP_free(my_group);
+	EC_GROUP_free(req_group);
+	return matches;
+}
+
 /**
 * Verify a RFC 4754 signature for a specified curve and hash algorithm
 */
@@ -91,56 +189,13 @@ static bool verify_curve_signature(private_openssl_ec_public_key_t *this,
 								signature_scheme_t scheme, int nid_hash,
 								int nid_curve, chunk_t data, chunk_t signature)
 {
-	const EC_GROUP *my_group;
-	EC_GROUP *req_group;
-	chunk_t hash;
-	bool valid;
-
-	req_group = EC_GROUP_new_by_curve_name(nid_curve);
-	if (!req_group)
+	if (!openssl_check_ec_key_curve(this->key, nid_curve))
 	{
-		DBG1(DBG_LIB, "signature scheme %N not supported in EC (required curve "
-			 "not supported)", signature_scheme_names, scheme);
-		return FALSE;
-	}
-	my_group = EC_KEY_get0_group(this->ec);
-	if (EC_GROUP_cmp(my_group, req_group, NULL) != 0)
-	{
-		DBG1(DBG_LIB, "signature scheme %N not supported by private key",
+		DBG1(DBG_LIB, "signature scheme %N not supported by key",
 			 signature_scheme_names, scheme);
 		return FALSE;
 	}
-	EC_GROUP_free(req_group);
-	if (!openssl_hash_chunk(nid_hash, data, &hash))
-	{
-		return FALSE;
-	}
-	valid = verify_signature(this, hash, signature);
-	chunk_free(&hash);
-	return valid;
-}
-
-/**
- * Verification of a DER encoded signature as in RFC 3279
- */
-static bool verify_der_signature(private_openssl_ec_public_key_t *this,
-								 int nid_hash, chunk_t data, chunk_t signature)
-{
-	chunk_t hash;
-	bool valid = FALSE;
-
-	/* remove any preceding 0-bytes from signature */
-	while (signature.len && signature.ptr[0] == 0x00)
-	{
-		signature = chunk_skip(signature, 1);
-	}
-	if (openssl_hash_chunk(nid_hash, data, &hash))
-	{
-		valid = ECDSA_verify(0, hash.ptr, hash.len,
-							 signature.ptr, signature.len, this->ec) == 1;
-		free(hash.ptr);
-	}
-	return valid;
+	return verify_signature(this, nid_hash, data, signature);
 }

 METHOD(public_key_t, get_type, key_type_t,
@@ -164,7 +219,7 @@ METHOD(public_key_t, verify, bool,
 		case SIGN_ECDSA_WITH_SHA512_DER:
 			return verify_der_signature(this, NID_sha512, data, signature);
 		case SIGN_ECDSA_WITH_NULL:
-			return verify_signature(this, data, signature);
+			return verify_signature(this, 0, data, signature);
 		case SIGN_ECDSA_256:
 			return verify_curve_signature(this, scheme, NID_sha256,
 										  NID_X9_62_prime256v1, data, signature);
@@ -192,56 +247,14 @@ METHOD(public_key_t, encrypt, bool,
 METHOD(public_key_t, get_keysize, int,
 	private_openssl_ec_public_key_t *this)
 {
-	return EC_GROUP_get_degree(EC_KEY_get0_group(this->ec));
-}
-
-/**
- * Calculate fingerprint from a EC_KEY, also used in ec private key.
- */
-bool openssl_ec_fingerprint(EC_KEY *ec, cred_encoding_type_t type, chunk_t *fp)
-{
-	hasher_t *hasher;
-	chunk_t key;
-	u_char *p;
-
-	if (lib->encoding->get_cache(lib->encoding, type, ec, fp))
-	{
-		return TRUE;
-	}
-	switch (type)
-	{
-		case KEYID_PUBKEY_SHA1:
-			key = chunk_alloc(i2o_ECPublicKey(ec, NULL));
-			p = key.ptr;
-			i2o_ECPublicKey(ec, &p);
-			break;
-		case KEYID_PUBKEY_INFO_SHA1:
-			key = chunk_alloc(i2d_EC_PUBKEY(ec, NULL));
-			p = key.ptr;
-			i2d_EC_PUBKEY(ec, &p);
-			break;
-		default:
-			return FALSE;
-	}
-	hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
-	if (!hasher || !hasher->allocate_hash(hasher, key, fp))
-	{
-		DBG1(DBG_LIB, "SHA1 hash algorithm not supported, fingerprinting failed");
-		DESTROY_IF(hasher);
-		free(key.ptr);
-		return FALSE;
-	}
-	hasher->destroy(hasher);
-	free(key.ptr);
-	lib->encoding->cache(lib->encoding, type, ec, *fp);
-	return TRUE;
+	return EVP_PKEY_bits(this->key);
 }

 METHOD(public_key_t, get_fingerprint, bool,
 	private_openssl_ec_public_key_t *this, cred_encoding_type_t type,
 	chunk_t *fingerprint)
 {
-	return openssl_ec_fingerprint(this->ec, type, fingerprint);
+	return openssl_fingerprint(this->key, type, fingerprint);
 }

 METHOD(public_key_t, get_encoding, bool,
@@ -249,11 +262,8 @@ METHOD(public_key_t, get_encoding, bool,
 	chunk_t *encoding)
 {
 	bool success = TRUE;
-	u_char *p;

-	*encoding = chunk_alloc(i2d_EC_PUBKEY(this->ec, NULL));
-	p = encoding->ptr;
-	i2d_EC_PUBKEY(this->ec, &p);
+	*encoding = openssl_i2chunk(PUBKEY, this->key);

 	if (type != PUBKEY_SPKI_ASN1_DER)
 	{
@@ -279,21 +289,45 @@ METHOD(public_key_t, destroy, void,
 {
 	if (ref_put(&this->ref))
 	{
-		if (this->ec)
+		if (this->key)
 		{
-			lib->encoding->clear_cache(lib->encoding, this->ec);
-			EC_KEY_free(this->ec);
+			lib->encoding->clear_cache(lib->encoding, this->key);
+			EVP_PKEY_free(this->key);
 		}
 		free(this);
 	}
 }

 /**
- * Generic private constructor
+ * See header.
 */
-static private_openssl_ec_public_key_t *create_empty()
+openssl_ec_public_key_t *openssl_ec_public_key_load(key_type_t type,
+													va_list args)
 {
 	private_openssl_ec_public_key_t *this;
+	chunk_t blob = chunk_empty;
+	EVP_PKEY *key;
+
+	while (TRUE)
+	{
+		switch (va_arg(args, builder_part_t))
+		{
+			case BUILD_BLOB_ASN1_DER:
+				blob = va_arg(args, chunk_t);
+				continue;
+			case BUILD_END:
+				break;
+			default:
+				return NULL;
+		}
+		break;
+	}
+	key = d2i_PUBKEY(NULL, (const u_char**)&blob.ptr, blob.len);
+	if (!key || EVP_PKEY_base_id(key) != EVP_PKEY_EC)
+	{
+		EVP_PKEY_free(key);
+		return NULL;
+	}

 	INIT(this,
 		.public = {
@@ -311,47 +345,9 @@ static private_openssl_ec_public_key_t *create_empty()
 			},
 		},
 		.ref = 1,
+		.key = key,
 	);
-
-	return this;
-}
-
-/**
- * See header.
- */
-openssl_ec_public_key_t *openssl_ec_public_key_load(key_type_t type,
-													va_list args)
-{
-	private_openssl_ec_public_key_t *this;
-	chunk_t blob = chunk_empty;
-
-	if (type != KEY_ECDSA)
-	{
-		return NULL;
-	}
-
-	while (TRUE)
-	{
-		switch (va_arg(args, builder_part_t))
-		{
-			case BUILD_BLOB_ASN1_DER:
-				blob = va_arg(args, chunk_t);
-				continue;
-			case BUILD_END:
-				break;
-			default:
-				return NULL;
-		}
-		break;
-	}
-	this = create_empty();
-	this->ec = d2i_EC_PUBKEY(NULL, (const u_char**)&blob.ptr, blob.len);
-	if (!this->ec)
-	{
-		destroy(this);
-		return NULL;
-	}
 	return &this->public;
 }
-#endif /* OPENSSL_NO_ECDSA */

+#endif /* OPENSSL_NO_ECDSA */