PKIFCryptoPPUtils.cpp

Go to the documentation of this file.

#include "PKIFCryptoPPUtils.h"
#include "PKIFCryptoPPKeyMaterial.h"
#include "PKIFCryptoPPCredential.h"

#include "FileUtils.h"
#include "PKIFBase64.h"
#include "Buffer.h"
#include "OID.h"
#include "PKIFMemoryUtils.h"

#include "PKIFCredential.h"
#include "PKIFKeyMaterial.h"
#include "SubjectPublicKeyInfo.h"
#include "Certificate.h"

#include "ASN1Helper.h"
#include "PKIX1Explicit88.h"
#include "ECC-CMS.h"

#include "PKIFAlgorithm.h"

#if defined(WIN32) || defined(_WIN32)
    #include <Winsock2.h>
#endif

#if !defined(_WIN32)
#include <netinet/in.h>
#endif

#include "boost/filesystem/path.hpp"
#include "boost/filesystem/operations.hpp"
#include "boost/filesystem/fstream.hpp"
#include "boost/scoped_ptr.hpp"
#include <iostream>
#include <sstream>

#include "boost/numeric/conversion/cast.hpp"
#include "boost/numeric/conversion/bounds.hpp"
#include "boost/limits.hpp"

#include "cryptlib.h"
#include "queue.h"
#include "asn.h"
#include "sha.h"

#include <iostream>
#include <strstream>


using boost::numeric_cast;
using boost::bad_numeric_cast;

using namespace std;
namespace fs = boost::filesystem;

using namespace CryptoPP;

using namespace boost;

CPKIFBufferPtr GetTBSCertSequence(
      const CPKIFCertificate & cert)
{
    CPKIFBufferPtr wholeCert = cert.Encoded();
    ByteQueue certReader, tbsCertWriter;
    certReader.Put(wholeCert->GetBuffer(),wholeCert->GetLength());
    BERSequenceDecoder x509Cert(certReader);
    BERSequenceDecoder tbsCert(x509Cert);
    DERSequenceEncoder tbsCertEnc(tbsCertWriter);
    tbsCert.CopyTo(tbsCertEnc);
    tbsCertEnc.MessageEnd();
    unsigned char * tbsCertBuf = 0;

    unsigned long size = 0;
    try 
    {
        size = numeric_cast<unsigned long>(tbsCertWriter.MaxRetrievable());
    }
    catch(bad_numeric_cast &) 
    {
        throw CPKIFException(TOOLKIT_CRYPTO, COMMON_INVALID_INPUT, "Cert size is an impossibly long number.");
    }
    unsigned long tbsCertSize = size;
    tbsCertBuf = new unsigned char[tbsCertSize];
    tbsCertWriter.Get(tbsCertBuf,tbsCertSize);
    CPKIFBufferPtr tbsOut(new CPKIFBuffer(true,tbsCertBuf,tbsCertSize));
    return tbsOut;
}
CPKIFCredentialPtr _MakeCredentialFromP8File(
    const std::string & file)
{
    // For the time being, this is suboptimal; crypto++ doesn't support any
    // password-protected store natively, so all it can use are clear PKCS#8
    // files
    CPKIFCredentialPtr rv((CPKIFCredential *)0);
    CPKIFBufferPtr filebuf = ReadFileIntoBuffer(file);
    unsigned char * derdata = 0;
    unsigned long derlen = 0;
    bool dataWasPEM = false;
    // sniff for PEM
    if(filebuf->GetBuffer()[0] == '-') {
        // if the first byte is '-' it's not DER and is most likely PEM
        char * bufstr = new char[filebuf->GetLength()+1];
        memcpy(bufstr,filebuf->GetBuffer(),filebuf->GetLength());
        bufstr[filebuf->GetLength()] = 0;
        if(!PEMDecode_l(bufstr,filebuf->GetLength(),&derdata,&derlen)) {
            delete[] bufstr;
            // XXX would we rather throw?
            return rv;
        }
        dataWasPEM = true;
        delete[] bufstr;
    } else {
        derdata = const_cast<unsigned char *>(filebuf->GetBuffer());
        derlen = filebuf->GetLength();
    }

    // just do enough processing on the key material to determine the algorithm.
    // further processing occurs during the sign operation.
    ByteQueue keyReader;
    keyReader.Put(derdata,derlen);
    BERSequenceDecoder privateKeyInfo(keyReader);
    word32 version;
    BERDecodeUnsigned<word32>(privateKeyInfo, version, INTEGER, 0, 0);  // check version
    OID pkOID;
    BERSequenceDecoder algorithm(privateKeyInfo);
    pkOID.BERDecode(algorithm);

    int size = 0;
    try 
    {
        size = numeric_cast<int>(pkOID.m_values.size());
    }
    catch(bad_numeric_cast &) 
    {
        throw CPKIFException(TOOLKIT_CRYPTO, COMMON_INVALID_INPUT, "Size is an impossibly long number.");
    }

    int ncomps = size;
    ostringstream os;
    for(int i = 0; i < ncomps; ++i)
    {
        os << pkOID.m_values[i];
        if(i != ncomps - 1) os << ".";
    }
    string oidStr = os.str();
    CPKIFOIDPtr keyOID(new CPKIFOID(oidStr));
    CPKIFAlgorithm * keyAlg = CPKIFAlgorithm::GetAlg(keyOID);
    // if no algorithm could be had, the key is unsupported in PKIF
    if(!keyAlg) {
        if(dataWasPEM) {
            PKIFZero(derdata,derlen);
            delete[] derdata;
        }
        return rv;
    }
    // once we know we understand the key and it's formatted properly,
    // dump it into a credential
    CPKIFCryptoPPCredentialPtr credOut(new CPKIFCryptoPPCredential());
    CPKIFBufferPtr keyBuf(new CPKIFBuffer(derdata,derlen));
    credOut->SetPrivateKey(keyBuf);
    credOut->SetAlgorithm(keyAlg);
    rv = dynamic_pointer_cast<CPKIFCredential,CPKIFCryptoPPCredential>(credOut);
    if(dataWasPEM) {
        PKIFZero(derdata,derlen);
        delete[] derdata;
    }
    return rv;
}

CPKIFCredentialPtr MakeCredentialFromP8File(
    const std::string & file)
{
    return _MakeCredentialFromP8File(file);
}
CPKIFCredentialPtr MakeCredentialFromP8File(const std::string & file, const std::string & certFile )
{
    CPKIFCredentialPtr cred = _MakeCredentialFromP8File(file);
    if(cred != (CPKIFCredential*)NULL)
    {
        CPKIFBufferPtr filebuf = ReadFileIntoBuffer(certFile);
        unsigned char * derdata = 0;
        unsigned long derlen = 0;
        bool dataWasPEM = false;
        // sniff for PEM
        if(filebuf->GetBuffer()[0] == '-') {
            // if the first byte is '-' it's not DER and is most likely PEM
            char * bufstr = new char[filebuf->GetLength()+1];
            memcpy(bufstr,filebuf->GetBuffer(),filebuf->GetLength());
            bufstr[filebuf->GetLength()] = 0;
            if(!PEMDecode_l(bufstr,filebuf->GetLength(),&derdata,&derlen)) {
                delete[] bufstr;
                // XXX would we rather throw?
                return cred;
            }
            dataWasPEM = true;
            delete[] bufstr;
        } else {
            derdata = const_cast<unsigned char *>(filebuf->GetBuffer());
            derlen = filebuf->GetLength();
        }

        CPKIFCertificatePtr cert(new CPKIFCertificate);
        cert->Decode(derdata, derlen);

        CPKIFCryptoPPCredentialPtr cppCred = dynamic_pointer_cast<CPKIFCryptoPPCredential, CPKIFCredential>(cred);
        cppCred->SetCertificate(cert);
    }
    return cred;
}

CPKIFBufferPtr GetEncodedSPKIFromKM(const CPKIFKeyMaterial & km)
{
    CPKIFCryptoPPKeyMaterialPtr cppKM(new CPKIFCryptoPPKeyMaterial(km));
    CPKIFBufferPtr rv = cppKM->GetRawSPKI();
    return rv;
}

CPKIFBufferPtr DeriveKeyFromSecret(
                                   const CPKIFBufferPtr & secret,
                                   const CPKIFBufferPtr & sharedInfo,
                                   unsigned int keyLength)
{
    CPKIFBufferPtr rv;

    CACASNWRAPPER_CREATE(ECC_CMS_SharedInfo,ecsPDU);

    unsigned long derivedKeyLen = keyLength;
    
    // if the caller did not specify a key length, attempt to pull it out of the sharedInfo structure
    if(0 == derivedKeyLen) {
        ECC_CMS_SharedInfo * ecsi = ecsPDU.Decode(sharedInfo->GetBuffer(),sharedInfo->GetLength());
        if(!ecsi) throw CPKIFException(TOOLKIT_CRYPTO, COMMON_INVALID_INPUT, "sharedInfo is invalid.");
        u_long nwKeySize32;
        if(ecsi->suppPubInfo.numocts > sizeof(u_long)) throw CPKIFException(TOOLKIT_CRYPTO, COMMON_INVALID_INPUT, "sharedInfo is invalid.");
        memcpy(&nwKeySize32,ecsi->suppPubInfo.data,ecsi->suppPubInfo.numocts);
        u_long keySize32 = ntohl(nwKeySize32);
        derivedKeyLen = keySize32;
    }

    CryptoPP::HashTransformation * sha = 0;

    // select a hash according to Russ Housley's Suite B S/MIME draft, with allowance
    // for the fact that we support more key sizes. That only allows for AES128/256 keys.
    // since 192 is also supported here, we'll treat it like 256 for key generation purposes
    if(derivedKeyLen <= 16) {
        sha = new CryptoPP::SHA256();
    } else {
        sha = new CryptoPP::SHA384();
    }
    boost::scoped_ptr<CryptoPP::HashTransformation> pSha(sha);

    if(!pSha) throw std::runtime_error(string("Internal error: unable to instantiate hash object for key derivation"));
    
    // counter is constant for this
    unsigned char counter[4] = {0x00,0x00,0x00,0x01};

    pSha->Update(secret->GetBuffer(),secret->GetLength());
    pSha->Update(counter,4);
    pSha->Update(sharedInfo->GetBuffer(),sharedInfo->GetLength());
    unsigned int digestLen = sha->DigestSize();
    unsigned char * temp = new unsigned char[digestLen];
    try {
        pSha->Final(temp);
    }catch(std::exception & e){
        delete[] temp;
        throw e;
    }
    rv = CPKIFBufferPtr(new CPKIFBuffer(true,temp,digestLen));
    return rv;
}