PKIFXSECCryptoKeyRSA.cpp

Go to the documentation of this file.

#include "PKIFXSECCryptoKeyRSA.h"

#include "PKIFXSECCrypto.h"

#include <xsec/enc/XSCrypt/XSCryptCryptoBase64.hpp>
#include <xsec/enc/XSECCryptoException.hpp>
#include <xsec/enc/XSECCryptoUtils.hpp>
#include <xsec/framework/XSECError.hpp>
struct PKIFXSECCryptoKeyRSAImpl
{
    IPKIFMediatorPtr m_med;
    CPKIFKeyMaterialPtr m_km;
    CPKIFCredentialPtr m_cred;
    CPKIFBufferPtr m_oaepParams;
};
PKIFCRYPTO::HASH_ALG haFromHashMethod(hashMethod hm)
{
    switch(hm) {
        case HASH_SHA1:
            return PKIFCRYPTO::SHA1;
            break;
        case HASH_MD5:
            return PKIFCRYPTO::MD5;
            break;
        case HASH_SHA224:
            return PKIFCRYPTO::SHA224;
            break;
        case HASH_SHA256:
            return PKIFCRYPTO::SHA256;
            break;
        case HASH_SHA384:
            return PKIFCRYPTO::SHA384;
            break;
        case HASH_SHA512:
            return PKIFCRYPTO::SHA512;
            break;
        default:
            break;
    }
    // this is the library's default
    return PKIFCRYPTO::SHA1;
}

PKIFXSECCryptoKeyRSA::PKIFXSECCryptoKeyRSA()
:m_impl(new PKIFXSECCryptoKeyRSAImpl())
{
}

PKIFXSECCryptoKeyRSA::~PKIFXSECCryptoKeyRSA()
{
    if(m_impl) {
        delete m_impl;
        m_impl = 0;
    }
}

XSECCryptoKey * PKIFXSECCryptoKeyRSA::clone() const
{
    PKIFXSECCryptoKeyRSA * rv = new PKIFXSECCryptoKeyRSA();
    rv->m_impl->m_cred = m_impl->m_cred;
    rv->m_impl->m_km = m_impl->m_km;
    rv->m_impl->m_med = m_impl->m_med;
    rv->m_impl->m_oaepParams = m_impl->m_oaepParams;
    return rv;
}

void PKIFXSECCryptoKeyRSA::setOAEPparams(unsigned char * params, unsigned int paramsLen)
{
    m_impl->m_oaepParams = CPKIFBufferPtr(new CPKIFBuffer(params,paramsLen));
}

unsigned int PKIFXSECCryptoKeyRSA::getOAEPparamsLen() const
{
    if(!m_impl->m_oaepParams) return 0;
    return m_impl->m_oaepParams->GetLength();
}
const unsigned char * PKIFXSECCryptoKeyRSA::getOAEPparams() const
{
    if(!m_impl->m_oaepParams) return 0;
    return m_impl->m_oaepParams->GetBuffer();
}

XSECCryptoKey::KeyType PKIFXSECCryptoKeyRSA::getKeyType() const
{
    if(!m_impl) return XSECCryptoKey::KEY_NONE;
    if(m_impl->m_cred) return XSECCryptoKey::KEY_RSA_PAIR;
    if(m_impl->m_km) return XSECCryptoKey::KEY_RSA_PUBLIC;
    return XSECCryptoKey::KEY_NONE;
}


bool PKIFXSECCryptoKeyRSA::verifySHA1PKCS1Base64Signature(
    const unsigned char * hashBuf,
    unsigned int hashLen,
    const char * base64Signature,
    unsigned int sigLen,
    hashMethod hm)
{
    if(!m_impl->m_km){
        throw XSECCryptoException(XSECCryptoException::RSAError,
        "PKIFXSECCryptoKeyRSA - No key available for RSA verification");
    }
    IPKIFCryptoRawOperations* cm = m_impl->m_med->GetMediator<IPKIFCryptoRawOperations>();
    if(!cm) {
        throw XSECCryptoException(XSECCryptoException::RSAError,
        "PKIFXSECCryptoKeyRSA - No appropriate mediator available for RSA verification");
    }
    // Decode the signature
    XSCryptCryptoBase64 b64;
    unsigned char * decSig = new unsigned char[sigLen];
    b64.decodeInit();
    unsigned int decSigLen = b64.decode((unsigned char *) base64Signature, sigLen, decSig, sigLen);
    decSigLen += b64.decodeFinish(&decSig[decSigLen], sigLen - decSigLen);
    bool ok = false;
    try {
        ok = cm->Verify(*(m_impl->m_km),const_cast<unsigned char *>(hashBuf),hashLen,decSig,decSigLen,haFromHashMethod(hm));
    }catch(CPKIFException & e){
        throw XSECCryptoException(XSECCryptoException::RSAError, e.GetDescription());
    }
    // the key resolver class will have already verified the cert and set up the key material
    return ok;
}

unsigned int PKIFXSECCryptoKeyRSA::signSHA1PKCS1Base64Signature(
    unsigned char * hashBuf,
    unsigned int hashLen,
    char * base64SignatureBuf,
    unsigned int base64SignatureBufLen,
    hashMethod hm)
{
    if(!m_impl->m_cred) {
        throw XSECCryptoException(XSECCryptoException::RSAError,
        "PKIFXSECCryptoKeyRSA - No key available for RSA signing");
    }
    IPKIFCryptoKeyIDOperations* cm = m_impl->m_med->GetMediator<IPKIFCryptoKeyIDOperations>();
    if(!cm) {
        throw XSECCryptoException(XSECCryptoException::RSAError,
        "PKIFXSECCryptoKeyRSA - No appropriate mediator available for RSA signing");
    }
    // slightly wasteful but this is fast, the waste is temporary, and it's safe.
    int sigOutLen = 2 * getLength();
    unsigned char * sigOut = new unsigned char[sigOutLen];
    try {
        cm->Sign(*(m_impl->m_cred),hashBuf,hashLen,sigOut,&sigOutLen,haFromHashMethod(hm));
    }catch(CPKIFException & e){
        throw XSECCryptoException(XSECCryptoException::RSAError, e.GetDescription());
    }

    // Now encode
    XSCryptCryptoBase64 b64;
    b64.encodeInit();
    unsigned int ret = b64.encode(sigOut, sigOutLen, (unsigned char *) base64SignatureBuf, base64SignatureBufLen);
    ret += b64.encodeFinish((unsigned char *) &base64SignatureBuf[ret], base64SignatureBufLen - ret);
    return ret;
}

unsigned int PKIFXSECCryptoKeyRSA::privateDecrypt(
    const unsigned char * inBuf,
    unsigned char * plainBuf,
    unsigned int inLength,
    unsigned int maxOutLength,
    PaddingType padding,
    hashMethod hm)
{
    if(padding != PAD_PKCS_1_5) {
        throw XSECCryptoException(XSECCryptoException::RSAError,"PKIF only supports PKCS 1.5 padding");
    }
    if(!m_impl->m_cred) {
        throw XSECCryptoException(XSECCryptoException::RSAError,
        "PKIFXSECCryptoKeyRSA - No key available for RSA decryption");
    }
    IPKIFCryptoKeyIDOperations* cm = m_impl->m_med->GetMediator<IPKIFCryptoKeyIDOperations>();
    if(!cm) {
        throw XSECCryptoException(XSECCryptoException::RSAError,
        "PKIFXSECCryptoKeyRSA - No appropriate mediator available for RSA decryption");
    }
    int rv = maxOutLength;
    try {
        cm->Decrypt(*(m_impl->m_cred),const_cast<unsigned char *>(inBuf),inLength,plainBuf,&rv);
    } catch(CPKIFException & e) {
        throw XSECCryptoException(XSECCryptoException::RSAError, e.GetDescription());
    }
    return rv;
}

unsigned int PKIFXSECCryptoKeyRSA::publicEncrypt(
    const unsigned char * inBuf,
    unsigned char * cipherBuf,
    unsigned int inLength,
    unsigned int maxOutLength,
    PaddingType padding,
    hashMethod hm)
{
    if(padding != PAD_PKCS_1_5) {
        throw XSECCryptoException(XSECCryptoException::RSAError,"PKIF only supports PKCS 1.5 padding");
    }
    if(!m_impl->m_km){
        throw XSECCryptoException(XSECCryptoException::RSAError,
        "PKIFXSECCryptoKeyRSA - No key available for RSA encryption");
    }
    IPKIFCryptoRawOperations* cm = m_impl->m_med->GetMediator<IPKIFCryptoRawOperations>();
    if(!cm) {
        throw XSECCryptoException(XSECCryptoException::RSAError,
        "PKIFXSECCryptoKeyRSA - No appropriate mediator available for RSA encryption");
    }
    int rv = maxOutLength;
    try {
        cm->Encrypt(*(m_impl->m_km),const_cast<unsigned char *>(inBuf),inLength,cipherBuf,&rv);
    } catch(CPKIFException & e) {
        throw XSECCryptoException(XSECCryptoException::RSAError, e.GetDescription());
    }
    return rv;
}

unsigned int PKIFXSECCryptoKeyRSA::getLength() const
{
    int len = 0;
    CPKIFKeyMaterialPtr km;
    if(m_impl->m_cred) {
        km = m_impl->m_cred->GetPublicKey();
    } else {
        km = m_impl->m_km;
    }
    if(!km) return 0;
    // ideally, the key material object we've now got will just have an SPKI object ready. That's not always true
    // at the moment. If it's not, we can try to decode one.
    CPKIFSubjectPublicKeyInfoPtr spki = km->GetSubjectPublicKeyInfo();
    // if the key material class we're stuck with doens't keep the subject public key info handy,
    // extract it from the cert.
    if(!spki) {
        CPKIFCertificatePtr cert(new CPKIFCertificate());
        cert->Decode(km->GetCertificate(),km->GetCertificateLength());
        if(!cert) return 0;
        spki = cert->GetSubjectPublicKeyInfo();
    }
    // if after all that we still don't have a valid subjectPublicKeyInfo, this object can't offer a proper answer.
    if(!spki) return 0;
    len = (spki->numBits() / 8);
    return len;
}

void PKIFXSECCryptoKeyRSA::SetMediator(
   IPKIFMediatorPtr & med)
{
    m_impl->m_med = med;
}

void PKIFXSECCryptoKeyRSA::SetCredential(
    CPKIFCredentialPtr & cred)
{
    m_impl->m_cred = cred;
}

void PKIFXSECCryptoKeyRSA::SetKeyMaterial(
    CPKIFKeyMaterialPtr & km)
{
    m_impl->m_km = km;
}

const XMLCh * PKIFXSECCryptoKeyRSA::getProviderName() const
{
    return pkifProvName();
}