1 /*
2 * Privacy Enhanced Mail (PEM) decoding
3 *
4 * Copyright The Mbed TLS Contributors
5 * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
6 */
7
8 #include "common.h"
9
10 #if defined(MBEDTLS_PEM_PARSE_C) || defined(MBEDTLS_PEM_WRITE_C)
11
12 #include "mbedtls/pem.h"
13 #include "mbedtls/base64.h"
14 #include "mbedtls/des.h"
15 #include "mbedtls/aes.h"
16 #include "mbedtls/md5.h"
17 #include "mbedtls/cipher.h"
18 #include "mbedtls/platform_util.h"
19 #include "mbedtls/error.h"
20
21 #include <string.h>
22
23 #include "mbedtls/platform.h"
24
25 #if defined(MBEDTLS_PEM_PARSE_C)
mbedtls_pem_init(mbedtls_pem_context * ctx)26 void mbedtls_pem_init(mbedtls_pem_context *ctx)
27 {
28 memset(ctx, 0, sizeof(mbedtls_pem_context));
29 }
30
31 #if defined(MBEDTLS_MD5_C) && defined(MBEDTLS_CIPHER_MODE_CBC) && \
32 (defined(MBEDTLS_DES_C) || defined(MBEDTLS_AES_C))
33 /*
34 * Read a 16-byte hex string and convert it to binary
35 */
pem_get_iv(const unsigned char * s,unsigned char * iv,size_t iv_len)36 static int pem_get_iv(const unsigned char *s, unsigned char *iv,
37 size_t iv_len)
38 {
39 size_t i, j, k;
40
41 memset(iv, 0, iv_len);
42
43 for (i = 0; i < iv_len * 2; i++, s++) {
44 if (*s >= '0' && *s <= '9') {
45 j = *s - '0';
46 } else
47 if (*s >= 'A' && *s <= 'F') {
48 j = *s - '7';
49 } else
50 if (*s >= 'a' && *s <= 'f') {
51 j = *s - 'W';
52 } else {
53 return MBEDTLS_ERR_PEM_INVALID_ENC_IV;
54 }
55
56 k = ((i & 1) != 0) ? j : j << 4;
57
58 iv[i >> 1] = (unsigned char) (iv[i >> 1] | k);
59 }
60
61 return 0;
62 }
63
pem_pbkdf1(unsigned char * key,size_t keylen,unsigned char * iv,const unsigned char * pwd,size_t pwdlen)64 static int pem_pbkdf1(unsigned char *key, size_t keylen,
65 unsigned char *iv,
66 const unsigned char *pwd, size_t pwdlen)
67 {
68 mbedtls_md5_context md5_ctx;
69 unsigned char md5sum[16];
70 size_t use_len;
71 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
72
73 mbedtls_md5_init(&md5_ctx);
74
75 /*
76 * key[ 0..15] = MD5(pwd || IV)
77 */
78 if ((ret = mbedtls_md5_starts_ret(&md5_ctx)) != 0) {
79 goto exit;
80 }
81 if ((ret = mbedtls_md5_update_ret(&md5_ctx, pwd, pwdlen)) != 0) {
82 goto exit;
83 }
84 if ((ret = mbedtls_md5_update_ret(&md5_ctx, iv, 8)) != 0) {
85 goto exit;
86 }
87 if ((ret = mbedtls_md5_finish_ret(&md5_ctx, md5sum)) != 0) {
88 goto exit;
89 }
90
91 if (keylen <= 16) {
92 memcpy(key, md5sum, keylen);
93 goto exit;
94 }
95
96 memcpy(key, md5sum, 16);
97
98 /*
99 * key[16..23] = MD5(key[ 0..15] || pwd || IV])
100 */
101 if ((ret = mbedtls_md5_starts_ret(&md5_ctx)) != 0) {
102 goto exit;
103 }
104 if ((ret = mbedtls_md5_update_ret(&md5_ctx, md5sum, 16)) != 0) {
105 goto exit;
106 }
107 if ((ret = mbedtls_md5_update_ret(&md5_ctx, pwd, pwdlen)) != 0) {
108 goto exit;
109 }
110 if ((ret = mbedtls_md5_update_ret(&md5_ctx, iv, 8)) != 0) {
111 goto exit;
112 }
113 if ((ret = mbedtls_md5_finish_ret(&md5_ctx, md5sum)) != 0) {
114 goto exit;
115 }
116
117 use_len = 16;
118 if (keylen < 32) {
119 use_len = keylen - 16;
120 }
121
122 memcpy(key + 16, md5sum, use_len);
123
124 exit:
125 mbedtls_md5_free(&md5_ctx);
126 mbedtls_platform_zeroize(md5sum, 16);
127
128 return ret;
129 }
130
131 #if defined(MBEDTLS_DES_C)
132 /*
133 * Decrypt with DES-CBC, using PBKDF1 for key derivation
134 */
pem_des_decrypt(unsigned char des_iv[8],unsigned char * buf,size_t buflen,const unsigned char * pwd,size_t pwdlen)135 static int pem_des_decrypt(unsigned char des_iv[8],
136 unsigned char *buf, size_t buflen,
137 const unsigned char *pwd, size_t pwdlen)
138 {
139 mbedtls_des_context des_ctx;
140 unsigned char des_key[8];
141 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
142
143 mbedtls_des_init(&des_ctx);
144
145 if ((ret = pem_pbkdf1(des_key, 8, des_iv, pwd, pwdlen)) != 0) {
146 goto exit;
147 }
148
149 if ((ret = mbedtls_des_setkey_dec(&des_ctx, des_key)) != 0) {
150 goto exit;
151 }
152 ret = mbedtls_des_crypt_cbc(&des_ctx, MBEDTLS_DES_DECRYPT, buflen,
153 des_iv, buf, buf);
154
155 exit:
156 mbedtls_des_free(&des_ctx);
157 mbedtls_platform_zeroize(des_key, 8);
158
159 return ret;
160 }
161
162 /*
163 * Decrypt with 3DES-CBC, using PBKDF1 for key derivation
164 */
pem_des3_decrypt(unsigned char des3_iv[8],unsigned char * buf,size_t buflen,const unsigned char * pwd,size_t pwdlen)165 static int pem_des3_decrypt(unsigned char des3_iv[8],
166 unsigned char *buf, size_t buflen,
167 const unsigned char *pwd, size_t pwdlen)
168 {
169 mbedtls_des3_context des3_ctx;
170 unsigned char des3_key[24];
171 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
172
173 mbedtls_des3_init(&des3_ctx);
174
175 if ((ret = pem_pbkdf1(des3_key, 24, des3_iv, pwd, pwdlen)) != 0) {
176 goto exit;
177 }
178
179 if ((ret = mbedtls_des3_set3key_dec(&des3_ctx, des3_key)) != 0) {
180 goto exit;
181 }
182 ret = mbedtls_des3_crypt_cbc(&des3_ctx, MBEDTLS_DES_DECRYPT, buflen,
183 des3_iv, buf, buf);
184
185 exit:
186 mbedtls_des3_free(&des3_ctx);
187 mbedtls_platform_zeroize(des3_key, 24);
188
189 return ret;
190 }
191 #endif /* MBEDTLS_DES_C */
192
193 #if defined(MBEDTLS_AES_C)
194 /*
195 * Decrypt with AES-XXX-CBC, using PBKDF1 for key derivation
196 */
pem_aes_decrypt(unsigned char aes_iv[16],unsigned int keylen,unsigned char * buf,size_t buflen,const unsigned char * pwd,size_t pwdlen)197 static int pem_aes_decrypt(unsigned char aes_iv[16], unsigned int keylen,
198 unsigned char *buf, size_t buflen,
199 const unsigned char *pwd, size_t pwdlen)
200 {
201 mbedtls_aes_context aes_ctx;
202 unsigned char aes_key[32];
203 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
204
205 mbedtls_aes_init(&aes_ctx);
206
207 if ((ret = pem_pbkdf1(aes_key, keylen, aes_iv, pwd, pwdlen)) != 0) {
208 goto exit;
209 }
210
211 if ((ret = mbedtls_aes_setkey_dec(&aes_ctx, aes_key, keylen * 8)) != 0) {
212 goto exit;
213 }
214 ret = mbedtls_aes_crypt_cbc(&aes_ctx, MBEDTLS_AES_DECRYPT, buflen,
215 aes_iv, buf, buf);
216
217 exit:
218 mbedtls_aes_free(&aes_ctx);
219 mbedtls_platform_zeroize(aes_key, keylen);
220
221 return ret;
222 }
223 #endif /* MBEDTLS_AES_C */
224
225 #endif /* MBEDTLS_MD5_C && MBEDTLS_CIPHER_MODE_CBC &&
226 ( MBEDTLS_AES_C || MBEDTLS_DES_C ) */
227
mbedtls_pem_read_buffer(mbedtls_pem_context * ctx,const char * header,const char * footer,const unsigned char * data,const unsigned char * pwd,size_t pwdlen,size_t * use_len)228 int mbedtls_pem_read_buffer(mbedtls_pem_context *ctx, const char *header, const char *footer,
229 const unsigned char *data, const unsigned char *pwd,
230 size_t pwdlen, size_t *use_len)
231 {
232 int ret, enc;
233 size_t len;
234 unsigned char *buf;
235 const unsigned char *s1, *s2, *end;
236 #if defined(MBEDTLS_MD5_C) && defined(MBEDTLS_CIPHER_MODE_CBC) && \
237 (defined(MBEDTLS_DES_C) || defined(MBEDTLS_AES_C))
238 unsigned char pem_iv[16];
239 mbedtls_cipher_type_t enc_alg = MBEDTLS_CIPHER_NONE;
240 #else
241 ((void) pwd);
242 ((void) pwdlen);
243 #endif /* MBEDTLS_MD5_C && MBEDTLS_CIPHER_MODE_CBC &&
244 ( MBEDTLS_AES_C || MBEDTLS_DES_C ) */
245
246 if (ctx == NULL) {
247 return MBEDTLS_ERR_PEM_BAD_INPUT_DATA;
248 }
249
250 s1 = (unsigned char *) strstr((const char *) data, header);
251
252 if (s1 == NULL) {
253 return MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT;
254 }
255
256 s2 = (unsigned char *) strstr((const char *) data, footer);
257
258 if (s2 == NULL || s2 <= s1) {
259 return MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT;
260 }
261
262 s1 += strlen(header);
263 if (*s1 == ' ') {
264 s1++;
265 }
266 if (*s1 == '\r') {
267 s1++;
268 }
269 if (*s1 == '\n') {
270 s1++;
271 } else {
272 return MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT;
273 }
274
275 end = s2;
276 end += strlen(footer);
277 if (*end == ' ') {
278 end++;
279 }
280 if (*end == '\r') {
281 end++;
282 }
283 if (*end == '\n') {
284 end++;
285 }
286 *use_len = end - data;
287
288 enc = 0;
289
290 if (s2 - s1 >= 22 && memcmp(s1, "Proc-Type: 4,ENCRYPTED", 22) == 0) {
291 #if defined(MBEDTLS_MD5_C) && defined(MBEDTLS_CIPHER_MODE_CBC) && \
292 (defined(MBEDTLS_DES_C) || defined(MBEDTLS_AES_C))
293 enc++;
294
295 s1 += 22;
296 if (*s1 == '\r') {
297 s1++;
298 }
299 if (*s1 == '\n') {
300 s1++;
301 } else {
302 return MBEDTLS_ERR_PEM_INVALID_DATA;
303 }
304
305
306 #if defined(MBEDTLS_DES_C)
307 if (s2 - s1 >= 23 && memcmp(s1, "DEK-Info: DES-EDE3-CBC,", 23) == 0) {
308 enc_alg = MBEDTLS_CIPHER_DES_EDE3_CBC;
309
310 s1 += 23;
311 if (s2 - s1 < 16 || pem_get_iv(s1, pem_iv, 8) != 0) {
312 return MBEDTLS_ERR_PEM_INVALID_ENC_IV;
313 }
314
315 s1 += 16;
316 } else if (s2 - s1 >= 18 && memcmp(s1, "DEK-Info: DES-CBC,", 18) == 0) {
317 enc_alg = MBEDTLS_CIPHER_DES_CBC;
318
319 s1 += 18;
320 if (s2 - s1 < 16 || pem_get_iv(s1, pem_iv, 8) != 0) {
321 return MBEDTLS_ERR_PEM_INVALID_ENC_IV;
322 }
323
324 s1 += 16;
325 }
326 #endif /* MBEDTLS_DES_C */
327
328 #if defined(MBEDTLS_AES_C)
329 if (s2 - s1 >= 14 && memcmp(s1, "DEK-Info: AES-", 14) == 0) {
330 if (s2 - s1 < 22) {
331 return MBEDTLS_ERR_PEM_UNKNOWN_ENC_ALG;
332 } else if (memcmp(s1, "DEK-Info: AES-128-CBC,", 22) == 0) {
333 enc_alg = MBEDTLS_CIPHER_AES_128_CBC;
334 } else if (memcmp(s1, "DEK-Info: AES-192-CBC,", 22) == 0) {
335 enc_alg = MBEDTLS_CIPHER_AES_192_CBC;
336 } else if (memcmp(s1, "DEK-Info: AES-256-CBC,", 22) == 0) {
337 enc_alg = MBEDTLS_CIPHER_AES_256_CBC;
338 } else {
339 return MBEDTLS_ERR_PEM_UNKNOWN_ENC_ALG;
340 }
341
342 s1 += 22;
343 if (s2 - s1 < 32 || pem_get_iv(s1, pem_iv, 16) != 0) {
344 return MBEDTLS_ERR_PEM_INVALID_ENC_IV;
345 }
346
347 s1 += 32;
348 }
349 #endif /* MBEDTLS_AES_C */
350
351 if (enc_alg == MBEDTLS_CIPHER_NONE) {
352 return MBEDTLS_ERR_PEM_UNKNOWN_ENC_ALG;
353 }
354
355 if (*s1 == '\r') {
356 s1++;
357 }
358 if (*s1 == '\n') {
359 s1++;
360 } else {
361 return MBEDTLS_ERR_PEM_INVALID_DATA;
362 }
363 #else
364 return MBEDTLS_ERR_PEM_FEATURE_UNAVAILABLE;
365 #endif /* MBEDTLS_MD5_C && MBEDTLS_CIPHER_MODE_CBC &&
366 ( MBEDTLS_AES_C || MBEDTLS_DES_C ) */
367 }
368
369 if (s1 >= s2) {
370 return MBEDTLS_ERR_PEM_INVALID_DATA;
371 }
372
373 ret = mbedtls_base64_decode(NULL, 0, &len, s1, s2 - s1);
374
375 if (ret == MBEDTLS_ERR_BASE64_INVALID_CHARACTER) {
376 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PEM_INVALID_DATA, ret);
377 }
378
379 if ((buf = mbedtls_calloc(1, len)) == NULL) {
380 return MBEDTLS_ERR_PEM_ALLOC_FAILED;
381 }
382
383 if ((ret = mbedtls_base64_decode(buf, len, &len, s1, s2 - s1)) != 0) {
384 mbedtls_platform_zeroize(buf, len);
385 mbedtls_free(buf);
386 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PEM_INVALID_DATA, ret);
387 }
388
389 if (enc != 0) {
390 #if defined(MBEDTLS_MD5_C) && defined(MBEDTLS_CIPHER_MODE_CBC) && \
391 (defined(MBEDTLS_DES_C) || defined(MBEDTLS_AES_C))
392 if (pwd == NULL) {
393 mbedtls_platform_zeroize(buf, len);
394 mbedtls_free(buf);
395 return MBEDTLS_ERR_PEM_PASSWORD_REQUIRED;
396 }
397
398 ret = 0;
399
400 #if defined(MBEDTLS_DES_C)
401 if (enc_alg == MBEDTLS_CIPHER_DES_EDE3_CBC) {
402 ret = pem_des3_decrypt(pem_iv, buf, len, pwd, pwdlen);
403 } else if (enc_alg == MBEDTLS_CIPHER_DES_CBC) {
404 ret = pem_des_decrypt(pem_iv, buf, len, pwd, pwdlen);
405 }
406 #endif /* MBEDTLS_DES_C */
407
408 #if defined(MBEDTLS_AES_C)
409 if (enc_alg == MBEDTLS_CIPHER_AES_128_CBC) {
410 ret = pem_aes_decrypt(pem_iv, 16, buf, len, pwd, pwdlen);
411 } else if (enc_alg == MBEDTLS_CIPHER_AES_192_CBC) {
412 ret = pem_aes_decrypt(pem_iv, 24, buf, len, pwd, pwdlen);
413 } else if (enc_alg == MBEDTLS_CIPHER_AES_256_CBC) {
414 ret = pem_aes_decrypt(pem_iv, 32, buf, len, pwd, pwdlen);
415 }
416 #endif /* MBEDTLS_AES_C */
417
418 if (ret != 0) {
419 mbedtls_free(buf);
420 return ret;
421 }
422
423 /*
424 * The result will be ASN.1 starting with a SEQUENCE tag, with 1 to 3
425 * length bytes (allow 4 to be sure) in all known use cases.
426 *
427 * Use that as a heuristic to try to detect password mismatches.
428 */
429 if (len <= 2 || buf[0] != 0x30 || buf[1] > 0x83) {
430 mbedtls_platform_zeroize(buf, len);
431 mbedtls_free(buf);
432 return MBEDTLS_ERR_PEM_PASSWORD_MISMATCH;
433 }
434 #else
435 mbedtls_platform_zeroize(buf, len);
436 mbedtls_free(buf);
437 return MBEDTLS_ERR_PEM_FEATURE_UNAVAILABLE;
438 #endif /* MBEDTLS_MD5_C && MBEDTLS_CIPHER_MODE_CBC &&
439 ( MBEDTLS_AES_C || MBEDTLS_DES_C ) */
440 }
441
442 ctx->buf = buf;
443 ctx->buflen = len;
444
445 return 0;
446 }
447
mbedtls_pem_free(mbedtls_pem_context * ctx)448 void mbedtls_pem_free(mbedtls_pem_context *ctx)
449 {
450 if (ctx->buf != NULL) {
451 mbedtls_platform_zeroize(ctx->buf, ctx->buflen);
452 mbedtls_free(ctx->buf);
453 }
454 mbedtls_free(ctx->info);
455
456 mbedtls_platform_zeroize(ctx, sizeof(mbedtls_pem_context));
457 }
458 #endif /* MBEDTLS_PEM_PARSE_C */
459
460 #if defined(MBEDTLS_PEM_WRITE_C)
mbedtls_pem_write_buffer(const char * header,const char * footer,const unsigned char * der_data,size_t der_len,unsigned char * buf,size_t buf_len,size_t * olen)461 int mbedtls_pem_write_buffer(const char *header, const char *footer,
462 const unsigned char *der_data, size_t der_len,
463 unsigned char *buf, size_t buf_len, size_t *olen)
464 {
465 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
466 unsigned char *encode_buf = NULL, *c, *p = buf;
467 size_t len = 0, use_len, add_len = 0;
468
469 mbedtls_base64_encode(NULL, 0, &use_len, der_data, der_len);
470 add_len = strlen(header) + strlen(footer) + (use_len / 64) + 1;
471
472 if (use_len + add_len > buf_len) {
473 *olen = use_len + add_len;
474 return MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL;
475 }
476
477 if (use_len != 0 &&
478 ((encode_buf = mbedtls_calloc(1, use_len)) == NULL)) {
479 return MBEDTLS_ERR_PEM_ALLOC_FAILED;
480 }
481
482 if ((ret = mbedtls_base64_encode(encode_buf, use_len, &use_len, der_data,
483 der_len)) != 0) {
484 mbedtls_free(encode_buf);
485 return ret;
486 }
487
488 memcpy(p, header, strlen(header));
489 p += strlen(header);
490 c = encode_buf;
491
492 while (use_len) {
493 len = (use_len > 64) ? 64 : use_len;
494 memcpy(p, c, len);
495 use_len -= len;
496 p += len;
497 c += len;
498 *p++ = '\n';
499 }
500
501 memcpy(p, footer, strlen(footer));
502 p += strlen(footer);
503
504 *p++ = '\0';
505 *olen = p - buf;
506
507 /* Clean any remaining data previously written to the buffer */
508 memset(buf + *olen, 0, buf_len - *olen);
509
510 mbedtls_free(encode_buf);
511 return 0;
512 }
513 #endif /* MBEDTLS_PEM_WRITE_C */
514 #endif /* MBEDTLS_PEM_PARSE_C || MBEDTLS_PEM_WRITE_C */
515