1 /* Copyright (c) 2022, Google Inc.
2 *
3 * Permission to use, copy, modify, and/or distribute this software for any
4 * purpose with or without fee is hereby granted, provided that the above
5 * copyright notice and this permission notice appear in all copies.
6 *
7 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
8 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
10 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
12 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
13 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
14
15 #include <openssl/evp.h>
16
17 #include <openssl/bytestring.h>
18 #include <openssl/err.h>
19 #include <openssl/hkdf.h>
20 #include <openssl/kdf.h>
21 #include <openssl/mem.h>
22
23 #include "../internal.h"
24 #include "internal.h"
25
26
27 typedef struct {
28 int mode;
29 const EVP_MD *md;
30 uint8_t *key;
31 size_t key_len;
32 uint8_t *salt;
33 size_t salt_len;
34 CBB info;
35 } HKDF_PKEY_CTX;
36
pkey_hkdf_init(EVP_PKEY_CTX * ctx)37 static int pkey_hkdf_init(EVP_PKEY_CTX *ctx) {
38 HKDF_PKEY_CTX *hctx = OPENSSL_malloc(sizeof(HKDF_PKEY_CTX));
39 if (hctx == NULL) {
40 return 0;
41 }
42
43 OPENSSL_memset(hctx, 0, sizeof(HKDF_PKEY_CTX));
44 if (!CBB_init(&hctx->info, 0)) {
45 OPENSSL_free(hctx);
46 return 0;
47 }
48
49 ctx->data = hctx;
50 return 1;
51 }
52
pkey_hkdf_copy(EVP_PKEY_CTX * dst,EVP_PKEY_CTX * src)53 static int pkey_hkdf_copy(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src) {
54 if (!pkey_hkdf_init(dst)) {
55 return 0;
56 }
57
58 HKDF_PKEY_CTX *hctx_dst = dst->data;
59 const HKDF_PKEY_CTX *hctx_src = src->data;
60 hctx_dst->mode = hctx_src->mode;
61 hctx_dst->md = hctx_src->md;
62
63 if (hctx_src->key_len != 0) {
64 hctx_dst->key = OPENSSL_memdup(hctx_src->key, hctx_src->key_len);
65 if (hctx_dst->key == NULL) {
66 return 0;
67 }
68 hctx_dst->key_len = hctx_src->key_len;
69 }
70
71 if (hctx_src->salt_len != 0) {
72 hctx_dst->salt = OPENSSL_memdup(hctx_src->salt, hctx_src->salt_len);
73 if (hctx_dst->salt == NULL) {
74 return 0;
75 }
76 hctx_dst->salt_len = hctx_src->salt_len;
77 }
78
79 if (!CBB_add_bytes(&hctx_dst->info, CBB_data(&hctx_src->info),
80 CBB_len(&hctx_src->info))) {
81 return 0;
82 }
83
84 return 1;
85 }
86
pkey_hkdf_cleanup(EVP_PKEY_CTX * ctx)87 static void pkey_hkdf_cleanup(EVP_PKEY_CTX *ctx) {
88 HKDF_PKEY_CTX *hctx = ctx->data;
89 if (hctx != NULL) {
90 OPENSSL_free(hctx->key);
91 OPENSSL_free(hctx->salt);
92 CBB_cleanup(&hctx->info);
93 OPENSSL_free(hctx);
94 ctx->data = NULL;
95 }
96 }
97
pkey_hkdf_derive(EVP_PKEY_CTX * ctx,uint8_t * out,size_t * out_len)98 static int pkey_hkdf_derive(EVP_PKEY_CTX *ctx, uint8_t *out, size_t *out_len) {
99 HKDF_PKEY_CTX *hctx = ctx->data;
100 if (hctx->md == NULL) {
101 OPENSSL_PUT_ERROR(EVP, EVP_R_MISSING_PARAMETERS);
102 return 0;
103 }
104 if (hctx->key_len == 0) {
105 OPENSSL_PUT_ERROR(EVP, EVP_R_NO_KEY_SET);
106 return 0;
107 }
108
109 if (out == NULL) {
110 if (hctx->mode == EVP_PKEY_HKDEF_MODE_EXTRACT_ONLY) {
111 *out_len = EVP_MD_size(hctx->md);
112 }
113 // HKDF-Expand is variable-length and returns |*out_len| bytes. "Output" the
114 // input length by leaving it alone.
115 return 1;
116 }
117
118 switch (hctx->mode) {
119 case EVP_PKEY_HKDEF_MODE_EXTRACT_AND_EXPAND:
120 return HKDF(out, *out_len, hctx->md, hctx->key, hctx->key_len, hctx->salt,
121 hctx->salt_len, CBB_data(&hctx->info), CBB_len(&hctx->info));
122
123 case EVP_PKEY_HKDEF_MODE_EXTRACT_ONLY:
124 if (*out_len < EVP_MD_size(hctx->md)) {
125 OPENSSL_PUT_ERROR(EVP, EVP_R_BUFFER_TOO_SMALL);
126 return 0;
127 }
128 return HKDF_extract(out, out_len, hctx->md, hctx->key, hctx->key_len,
129 hctx->salt, hctx->salt_len);
130
131 case EVP_PKEY_HKDEF_MODE_EXPAND_ONLY:
132 return HKDF_expand(out, *out_len, hctx->md, hctx->key, hctx->key_len,
133 CBB_data(&hctx->info), CBB_len(&hctx->info));
134 }
135 OPENSSL_PUT_ERROR(EVP, ERR_R_INTERNAL_ERROR);
136 return 0;
137 }
138
pkey_hkdf_ctrl(EVP_PKEY_CTX * ctx,int type,int p1,void * p2)139 static int pkey_hkdf_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2) {
140 HKDF_PKEY_CTX *hctx = ctx->data;
141 switch (type) {
142 case EVP_PKEY_CTRL_HKDF_MODE:
143 if (p1 != EVP_PKEY_HKDEF_MODE_EXTRACT_AND_EXPAND &&
144 p1 != EVP_PKEY_HKDEF_MODE_EXTRACT_ONLY &&
145 p1 != EVP_PKEY_HKDEF_MODE_EXPAND_ONLY) {
146 OPENSSL_PUT_ERROR(EVP, EVP_R_INVALID_OPERATION);
147 return 0;
148 }
149 hctx->mode = p1;
150 return 1;
151 case EVP_PKEY_CTRL_HKDF_MD:
152 hctx->md = p2;
153 return 1;
154 case EVP_PKEY_CTRL_HKDF_KEY: {
155 const CBS *key = p2;
156 if (!CBS_stow(key, &hctx->key, &hctx->key_len)) {
157 return 0;
158 }
159 return 1;
160 }
161 case EVP_PKEY_CTRL_HKDF_SALT: {
162 const CBS *salt = p2;
163 if (!CBS_stow(salt, &hctx->salt, &hctx->salt_len)) {
164 return 0;
165 }
166 return 1;
167 }
168 case EVP_PKEY_CTRL_HKDF_INFO: {
169 const CBS *info = p2;
170 // |EVP_PKEY_CTX_add1_hkdf_info| appends to the info string, rather than
171 // replacing it.
172 if (!CBB_add_bytes(&hctx->info, CBS_data(info), CBS_len(info))) {
173 return 0;
174 }
175 return 1;
176 }
177 default:
178 OPENSSL_PUT_ERROR(EVP, EVP_R_COMMAND_NOT_SUPPORTED);
179 return 0;
180 }
181 }
182
183 const EVP_PKEY_METHOD hkdf_pkey_meth = {
184 EVP_PKEY_HKDF,
185 pkey_hkdf_init,
186 pkey_hkdf_copy,
187 pkey_hkdf_cleanup,
188 /*keygen=*/NULL,
189 /*sign=*/NULL,
190 /*sign_message=*/NULL,
191 /*verify=*/NULL,
192 /*verify_message=*/NULL,
193 /*verify_recover=*/NULL,
194 /*encrypt=*/NULL,
195 /*decrypt=*/NULL,
196 pkey_hkdf_derive,
197 /*paramgen=*/NULL,
198 pkey_hkdf_ctrl,
199 };
200
EVP_PKEY_CTX_hkdf_mode(EVP_PKEY_CTX * ctx,int mode)201 int EVP_PKEY_CTX_hkdf_mode(EVP_PKEY_CTX *ctx, int mode) {
202 return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_HKDF, EVP_PKEY_OP_DERIVE,
203 EVP_PKEY_CTRL_HKDF_MODE, mode, NULL);
204 }
205
EVP_PKEY_CTX_set_hkdf_md(EVP_PKEY_CTX * ctx,const EVP_MD * md)206 int EVP_PKEY_CTX_set_hkdf_md(EVP_PKEY_CTX *ctx, const EVP_MD *md) {
207 return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_HKDF, EVP_PKEY_OP_DERIVE,
208 EVP_PKEY_CTRL_HKDF_MD, 0, (void *)md);
209 }
210
EVP_PKEY_CTX_set1_hkdf_key(EVP_PKEY_CTX * ctx,const uint8_t * key,size_t key_len)211 int EVP_PKEY_CTX_set1_hkdf_key(EVP_PKEY_CTX *ctx, const uint8_t *key,
212 size_t key_len) {
213 CBS cbs;
214 CBS_init(&cbs, key, key_len);
215 return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_HKDF, EVP_PKEY_OP_DERIVE,
216 EVP_PKEY_CTRL_HKDF_KEY, 0, &cbs);
217 }
218
EVP_PKEY_CTX_set1_hkdf_salt(EVP_PKEY_CTX * ctx,const uint8_t * salt,size_t salt_len)219 int EVP_PKEY_CTX_set1_hkdf_salt(EVP_PKEY_CTX *ctx, const uint8_t *salt,
220 size_t salt_len) {
221 CBS cbs;
222 CBS_init(&cbs, salt, salt_len);
223 return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_HKDF, EVP_PKEY_OP_DERIVE,
224 EVP_PKEY_CTRL_HKDF_SALT, 0, &cbs);
225 }
226
EVP_PKEY_CTX_add1_hkdf_info(EVP_PKEY_CTX * ctx,const uint8_t * info,size_t info_len)227 int EVP_PKEY_CTX_add1_hkdf_info(EVP_PKEY_CTX *ctx, const uint8_t *info,
228 size_t info_len) {
229 CBS cbs;
230 CBS_init(&cbs, info, info_len);
231 return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_HKDF, EVP_PKEY_OP_DERIVE,
232 EVP_PKEY_CTRL_HKDF_INFO, 0, &cbs);
233 }
234