1 /* Copyright (c) 2022, Google Inc.
2 *
3 * Permission to use, copy, modify, and/or distribute this software for any
4 * purpose with or without fee is hereby granted, provided that the above
5 * copyright notice and this permission notice appear in all copies.
6 *
7 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
8 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
10 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
12 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
13 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
14
15 #include <openssl/evp.h>
16
17 #include <openssl/bytestring.h>
18 #include <openssl/err.h>
19 #include <openssl/hkdf.h>
20 #include <openssl/kdf.h>
21 #include <openssl/mem.h>
22
23 #include "../internal.h"
24 #include "internal.h"
25
26
27 typedef struct {
28 int mode;
29 const EVP_MD *md;
30 uint8_t *key;
31 size_t key_len;
32 uint8_t *salt;
33 size_t salt_len;
34 CBB info;
35 } HKDF_PKEY_CTX;
36
pkey_hkdf_init(EVP_PKEY_CTX * ctx)37 static int pkey_hkdf_init(EVP_PKEY_CTX *ctx) {
38 HKDF_PKEY_CTX *hctx = OPENSSL_zalloc(sizeof(HKDF_PKEY_CTX));
39 if (hctx == NULL) {
40 return 0;
41 }
42
43 if (!CBB_init(&hctx->info, 0)) {
44 OPENSSL_free(hctx);
45 return 0;
46 }
47
48 ctx->data = hctx;
49 return 1;
50 }
51
pkey_hkdf_copy(EVP_PKEY_CTX * dst,EVP_PKEY_CTX * src)52 static int pkey_hkdf_copy(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src) {
53 if (!pkey_hkdf_init(dst)) {
54 return 0;
55 }
56
57 HKDF_PKEY_CTX *hctx_dst = dst->data;
58 const HKDF_PKEY_CTX *hctx_src = src->data;
59 hctx_dst->mode = hctx_src->mode;
60 hctx_dst->md = hctx_src->md;
61
62 if (hctx_src->key_len != 0) {
63 hctx_dst->key = OPENSSL_memdup(hctx_src->key, hctx_src->key_len);
64 if (hctx_dst->key == NULL) {
65 return 0;
66 }
67 hctx_dst->key_len = hctx_src->key_len;
68 }
69
70 if (hctx_src->salt_len != 0) {
71 hctx_dst->salt = OPENSSL_memdup(hctx_src->salt, hctx_src->salt_len);
72 if (hctx_dst->salt == NULL) {
73 return 0;
74 }
75 hctx_dst->salt_len = hctx_src->salt_len;
76 }
77
78 if (!CBB_add_bytes(&hctx_dst->info, CBB_data(&hctx_src->info),
79 CBB_len(&hctx_src->info))) {
80 return 0;
81 }
82
83 return 1;
84 }
85
pkey_hkdf_cleanup(EVP_PKEY_CTX * ctx)86 static void pkey_hkdf_cleanup(EVP_PKEY_CTX *ctx) {
87 HKDF_PKEY_CTX *hctx = ctx->data;
88 if (hctx != NULL) {
89 OPENSSL_free(hctx->key);
90 OPENSSL_free(hctx->salt);
91 CBB_cleanup(&hctx->info);
92 OPENSSL_free(hctx);
93 ctx->data = NULL;
94 }
95 }
96
pkey_hkdf_derive(EVP_PKEY_CTX * ctx,uint8_t * out,size_t * out_len)97 static int pkey_hkdf_derive(EVP_PKEY_CTX *ctx, uint8_t *out, size_t *out_len) {
98 HKDF_PKEY_CTX *hctx = ctx->data;
99 if (hctx->md == NULL) {
100 OPENSSL_PUT_ERROR(EVP, EVP_R_MISSING_PARAMETERS);
101 return 0;
102 }
103 if (hctx->key_len == 0) {
104 OPENSSL_PUT_ERROR(EVP, EVP_R_NO_KEY_SET);
105 return 0;
106 }
107
108 if (out == NULL) {
109 if (hctx->mode == EVP_PKEY_HKDEF_MODE_EXTRACT_ONLY) {
110 *out_len = EVP_MD_size(hctx->md);
111 }
112 // HKDF-Expand is variable-length and returns |*out_len| bytes. "Output" the
113 // input length by leaving it alone.
114 return 1;
115 }
116
117 switch (hctx->mode) {
118 case EVP_PKEY_HKDEF_MODE_EXTRACT_AND_EXPAND:
119 return HKDF(out, *out_len, hctx->md, hctx->key, hctx->key_len, hctx->salt,
120 hctx->salt_len, CBB_data(&hctx->info), CBB_len(&hctx->info));
121
122 case EVP_PKEY_HKDEF_MODE_EXTRACT_ONLY:
123 if (*out_len < EVP_MD_size(hctx->md)) {
124 OPENSSL_PUT_ERROR(EVP, EVP_R_BUFFER_TOO_SMALL);
125 return 0;
126 }
127 return HKDF_extract(out, out_len, hctx->md, hctx->key, hctx->key_len,
128 hctx->salt, hctx->salt_len);
129
130 case EVP_PKEY_HKDEF_MODE_EXPAND_ONLY:
131 return HKDF_expand(out, *out_len, hctx->md, hctx->key, hctx->key_len,
132 CBB_data(&hctx->info), CBB_len(&hctx->info));
133 }
134 OPENSSL_PUT_ERROR(EVP, ERR_R_INTERNAL_ERROR);
135 return 0;
136 }
137
pkey_hkdf_ctrl(EVP_PKEY_CTX * ctx,int type,int p1,void * p2)138 static int pkey_hkdf_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2) {
139 HKDF_PKEY_CTX *hctx = ctx->data;
140 switch (type) {
141 case EVP_PKEY_CTRL_HKDF_MODE:
142 if (p1 != EVP_PKEY_HKDEF_MODE_EXTRACT_AND_EXPAND &&
143 p1 != EVP_PKEY_HKDEF_MODE_EXTRACT_ONLY &&
144 p1 != EVP_PKEY_HKDEF_MODE_EXPAND_ONLY) {
145 OPENSSL_PUT_ERROR(EVP, EVP_R_INVALID_OPERATION);
146 return 0;
147 }
148 hctx->mode = p1;
149 return 1;
150 case EVP_PKEY_CTRL_HKDF_MD:
151 hctx->md = p2;
152 return 1;
153 case EVP_PKEY_CTRL_HKDF_KEY: {
154 const CBS *key = p2;
155 if (!CBS_stow(key, &hctx->key, &hctx->key_len)) {
156 return 0;
157 }
158 return 1;
159 }
160 case EVP_PKEY_CTRL_HKDF_SALT: {
161 const CBS *salt = p2;
162 if (!CBS_stow(salt, &hctx->salt, &hctx->salt_len)) {
163 return 0;
164 }
165 return 1;
166 }
167 case EVP_PKEY_CTRL_HKDF_INFO: {
168 const CBS *info = p2;
169 // |EVP_PKEY_CTX_add1_hkdf_info| appends to the info string, rather than
170 // replacing it.
171 if (!CBB_add_bytes(&hctx->info, CBS_data(info), CBS_len(info))) {
172 return 0;
173 }
174 return 1;
175 }
176 default:
177 OPENSSL_PUT_ERROR(EVP, EVP_R_COMMAND_NOT_SUPPORTED);
178 return 0;
179 }
180 }
181
182 const EVP_PKEY_METHOD hkdf_pkey_meth = {
183 EVP_PKEY_HKDF,
184 pkey_hkdf_init,
185 pkey_hkdf_copy,
186 pkey_hkdf_cleanup,
187 /*keygen=*/NULL,
188 /*sign=*/NULL,
189 /*sign_message=*/NULL,
190 /*verify=*/NULL,
191 /*verify_message=*/NULL,
192 /*verify_recover=*/NULL,
193 /*encrypt=*/NULL,
194 /*decrypt=*/NULL,
195 pkey_hkdf_derive,
196 /*paramgen=*/NULL,
197 pkey_hkdf_ctrl,
198 };
199
EVP_PKEY_CTX_hkdf_mode(EVP_PKEY_CTX * ctx,int mode)200 int EVP_PKEY_CTX_hkdf_mode(EVP_PKEY_CTX *ctx, int mode) {
201 return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_HKDF, EVP_PKEY_OP_DERIVE,
202 EVP_PKEY_CTRL_HKDF_MODE, mode, NULL);
203 }
204
EVP_PKEY_CTX_set_hkdf_md(EVP_PKEY_CTX * ctx,const EVP_MD * md)205 int EVP_PKEY_CTX_set_hkdf_md(EVP_PKEY_CTX *ctx, const EVP_MD *md) {
206 return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_HKDF, EVP_PKEY_OP_DERIVE,
207 EVP_PKEY_CTRL_HKDF_MD, 0, (void *)md);
208 }
209
EVP_PKEY_CTX_set1_hkdf_key(EVP_PKEY_CTX * ctx,const uint8_t * key,size_t key_len)210 int EVP_PKEY_CTX_set1_hkdf_key(EVP_PKEY_CTX *ctx, const uint8_t *key,
211 size_t key_len) {
212 CBS cbs;
213 CBS_init(&cbs, key, key_len);
214 return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_HKDF, EVP_PKEY_OP_DERIVE,
215 EVP_PKEY_CTRL_HKDF_KEY, 0, &cbs);
216 }
217
EVP_PKEY_CTX_set1_hkdf_salt(EVP_PKEY_CTX * ctx,const uint8_t * salt,size_t salt_len)218 int EVP_PKEY_CTX_set1_hkdf_salt(EVP_PKEY_CTX *ctx, const uint8_t *salt,
219 size_t salt_len) {
220 CBS cbs;
221 CBS_init(&cbs, salt, salt_len);
222 return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_HKDF, EVP_PKEY_OP_DERIVE,
223 EVP_PKEY_CTRL_HKDF_SALT, 0, &cbs);
224 }
225
EVP_PKEY_CTX_add1_hkdf_info(EVP_PKEY_CTX * ctx,const uint8_t * info,size_t info_len)226 int EVP_PKEY_CTX_add1_hkdf_info(EVP_PKEY_CTX *ctx, const uint8_t *info,
227 size_t info_len) {
228 CBS cbs;
229 CBS_init(&cbs, info, info_len);
230 return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_HKDF, EVP_PKEY_OP_DERIVE,
231 EVP_PKEY_CTRL_HKDF_INFO, 0, &cbs);
232 }
233