blob: 4fc0addd686d12c33b8f261d2410ff76fc469900 [file] [log] [blame]
Juan Castillo11abdcd2014-10-21 11:30:42 +01001/*
Manish V Badarkhe7b425de2024-07-19 08:31:51 +01002 * Copyright (c) 2015-2024, Arm Limited and Contributors. All rights reserved.
Juan Castillo11abdcd2014-10-21 11:30:42 +01003 *
dp-armfa3cf0b2017-05-03 09:38:09 +01004 * SPDX-License-Identifier: BSD-3-Clause
Juan Castillo11abdcd2014-10-21 11:30:42 +01005 */
6
laurenw-arm00185ea2023-08-15 14:53:59 -05007#include <assert.h>
Juan Castillo11abdcd2014-10-21 11:30:42 +01008#include <getopt.h>
9#include <stdio.h>
10#include <stdlib.h>
11#include <string.h>
12
Robin van der Gracht06b5cdb2023-09-12 11:16:23 +020013/* Suppress OpenSSL engine deprecation warnings */
14#define OPENSSL_SUPPRESS_DEPRECATED
15
Juan Castillo11abdcd2014-10-21 11:30:42 +010016#include <openssl/conf.h>
Robin van der Gracht06b5cdb2023-09-12 11:16:23 +020017#include <openssl/engine.h>
Juan Castillo11abdcd2014-10-21 11:30:42 +010018#include <openssl/evp.h>
19#include <openssl/pem.h>
Gatien Chevalliercaf56ce2024-10-18 17:26:43 +020020#include <openssl/ssl.h>
Juan Castillo11abdcd2014-10-21 11:30:42 +010021
22#include "cert.h"
Juan Castillo1218dd52015-07-03 16:23:16 +010023#include "cmd_opt.h"
Juan Castillo11abdcd2014-10-21 11:30:42 +010024#include "debug.h"
25#include "key.h"
Juan Castillo11abdcd2014-10-21 11:30:42 +010026#include "sha.h"
27
28#define MAX_FILENAME_LEN 1024
29
Manish V Badarkhe7b425de2024-07-19 08:31:51 +010030cert_key_t *keys;
Pankaj Guptadd906e62020-12-09 14:02:38 +053031unsigned int num_keys;
32
Juan Pablo Conde3539c742022-10-25 19:41:02 -040033#if !USING_OPENSSL3
Juan Castillo11abdcd2014-10-21 11:30:42 +010034/*
Juan Castillof9f39c32015-06-01 16:34:23 +010035 * Create a new key container
Juan Castillo11abdcd2014-10-21 11:30:42 +010036 */
Manish V Badarkhe7b425de2024-07-19 08:31:51 +010037int key_new(cert_key_t *key)
Juan Castillo11abdcd2014-10-21 11:30:42 +010038{
Juan Castillo11abdcd2014-10-21 11:30:42 +010039 /* Create key pair container */
Juan Castillof9f39c32015-06-01 16:34:23 +010040 key->key = EVP_PKEY_new();
41 if (key->key == NULL) {
Juan Castillo11abdcd2014-10-21 11:30:42 +010042 return 0;
43 }
44
Juan Castillof9f39c32015-06-01 16:34:23 +010045 return 1;
46}
Juan Pablo Conde3539c742022-10-25 19:41:02 -040047#endif
Juan Castillof9f39c32015-06-01 16:34:23 +010048
Manish V Badarkhe7b425de2024-07-19 08:31:51 +010049static int key_create_rsa(cert_key_t *key, int key_bits)
Juan Castillof9f39c32015-06-01 16:34:23 +010050{
Juan Pablo Conde3539c742022-10-25 19:41:02 -040051#if USING_OPENSSL3
Juan Pablo Conde7275a5a2022-03-02 18:10:08 -050052 EVP_PKEY *rsa = EVP_RSA_gen(key_bits);
Juan Castilloa2224ab2015-06-30 13:36:57 +010053 if (rsa == NULL) {
Michalis Pappas38628942017-10-06 16:11:44 +080054 printf("Cannot generate RSA key\n");
Juan Pablo Conde7275a5a2022-03-02 18:10:08 -050055 return 0;
Juan Castillo11abdcd2014-10-21 11:30:42 +010056 }
Juan Pablo Conde7275a5a2022-03-02 18:10:08 -050057 key->key = rsa;
Juan Castillof9f39c32015-06-01 16:34:23 +010058 return 1;
Juan Pablo Conde3539c742022-10-25 19:41:02 -040059#else
60 BIGNUM *e;
61 RSA *rsa = NULL;
62
63 e = BN_new();
64 if (e == NULL) {
65 printf("Cannot create RSA exponent\n");
66 return 0;
67 }
68
69 if (!BN_set_word(e, RSA_F4)) {
70 printf("Cannot assign RSA exponent\n");
71 goto err2;
72 }
73
74 rsa = RSA_new();
75 if (rsa == NULL) {
76 printf("Cannot create RSA key\n");
77 goto err2;
78 }
79
80 if (!RSA_generate_key_ex(rsa, key_bits, e, NULL)) {
81 printf("Cannot generate RSA key\n");
82 goto err;
83 }
84
85 if (!EVP_PKEY_assign_RSA(key->key, rsa)) {
86 printf("Cannot assign RSA key\n");
87 goto err;
88 }
89
90 BN_free(e);
91 return 1;
92
93err:
94 RSA_free(rsa);
95err2:
96 BN_free(e);
97 return 0;
98#endif
Juan Castilloa2224ab2015-06-30 13:36:57 +010099}
100
101#ifndef OPENSSL_NO_EC
Juan Pablo Conde3539c742022-10-25 19:41:02 -0400102#if USING_OPENSSL3
Manish V Badarkhe7b425de2024-07-19 08:31:51 +0100103static int key_create_ecdsa(cert_key_t *key, int key_bits, const char *curve)
Lionel Debievefefeffb2022-11-14 11:03:42 +0100104{
105 EVP_PKEY *ec = EVP_EC_gen(curve);
Juan Castilloa2224ab2015-06-30 13:36:57 +0100106 if (ec == NULL) {
Juan Castilloa2224ab2015-06-30 13:36:57 +0100107 printf("Cannot generate EC key\n");
Juan Pablo Conde7275a5a2022-03-02 18:10:08 -0500108 return 0;
Juan Castilloa2224ab2015-06-30 13:36:57 +0100109 }
Lionel Debievefefeffb2022-11-14 11:03:42 +0100110
Juan Pablo Conde7275a5a2022-03-02 18:10:08 -0500111 key->key = ec;
Juan Castilloa2224ab2015-06-30 13:36:57 +0100112 return 1;
Lionel Debievefefeffb2022-11-14 11:03:42 +0100113}
114
Manish V Badarkhe7b425de2024-07-19 08:31:51 +0100115static int key_create_ecdsa_nist(cert_key_t *key, int key_bits)
Lionel Debievefefeffb2022-11-14 11:03:42 +0100116{
laurenw-arm00185ea2023-08-15 14:53:59 -0500117 if (key_bits == 384) {
118 return key_create_ecdsa(key, key_bits, "secp384r1");
119 } else {
120 assert(key_bits == 256);
121 return key_create_ecdsa(key, key_bits, "prime256v1");
122 }
Lionel Debievefefeffb2022-11-14 11:03:42 +0100123}
124
Manish V Badarkhe7b425de2024-07-19 08:31:51 +0100125static int key_create_ecdsa_brainpool_r(cert_key_t *key, int key_bits)
Lionel Debievefefeffb2022-11-14 11:03:42 +0100126{
127 return key_create_ecdsa(key, key_bits, "brainpoolP256r1");
128}
129
Manish V Badarkhe7b425de2024-07-19 08:31:51 +0100130static int key_create_ecdsa_brainpool_t(cert_key_t *key, int key_bits)
Lionel Debievefefeffb2022-11-14 11:03:42 +0100131{
132 return key_create_ecdsa(key, key_bits, "brainpoolP256t1");
133}
Juan Pablo Conde3539c742022-10-25 19:41:02 -0400134#else
Manish V Badarkhe7b425de2024-07-19 08:31:51 +0100135static int key_create_ecdsa(cert_key_t *key, int key_bits, const int curve_id)
Lionel Debievefefeffb2022-11-14 11:03:42 +0100136{
Juan Pablo Conde3539c742022-10-25 19:41:02 -0400137 EC_KEY *ec;
138
Lionel Debievefefeffb2022-11-14 11:03:42 +0100139 ec = EC_KEY_new_by_curve_name(curve_id);
Juan Pablo Conde3539c742022-10-25 19:41:02 -0400140 if (ec == NULL) {
141 printf("Cannot create EC key\n");
142 return 0;
143 }
144 if (!EC_KEY_generate_key(ec)) {
145 printf("Cannot generate EC key\n");
146 goto err;
147 }
148 EC_KEY_set_flags(ec, EC_PKEY_NO_PARAMETERS);
149 EC_KEY_set_asn1_flag(ec, OPENSSL_EC_NAMED_CURVE);
150 if (!EVP_PKEY_assign_EC_KEY(key->key, ec)) {
151 printf("Cannot assign EC key\n");
152 goto err;
153 }
154
155 return 1;
156
157err:
158 EC_KEY_free(ec);
159 return 0;
Lionel Debievefefeffb2022-11-14 11:03:42 +0100160}
161
Manish V Badarkhe7b425de2024-07-19 08:31:51 +0100162static int key_create_ecdsa_nist(cert_key_t *key, int key_bits)
Lionel Debievefefeffb2022-11-14 11:03:42 +0100163{
laurenw-arm00185ea2023-08-15 14:53:59 -0500164 if (key_bits == 384) {
165 return key_create_ecdsa(key, key_bits, NID_secp384r1);
166 } else {
167 assert(key_bits == 256);
168 return key_create_ecdsa(key, key_bits, NID_X9_62_prime256v1);
169 }
Lionel Debievefefeffb2022-11-14 11:03:42 +0100170}
171
Donald Chan50d53972024-04-10 14:56:53 -0700172#if OPENSSL_VERSION_NUMBER >= 0x10100000L
Manish V Badarkhe7b425de2024-07-19 08:31:51 +0100173static int key_create_ecdsa_brainpool_r(cert_key_t *key, int key_bits)
Lionel Debievefefeffb2022-11-14 11:03:42 +0100174{
175 return key_create_ecdsa(key, key_bits, NID_brainpoolP256r1);
176}
177
Manish V Badarkhe7b425de2024-07-19 08:31:51 +0100178static int key_create_ecdsa_brainpool_t(cert_key_t *key, int key_bits)
Lionel Debievefefeffb2022-11-14 11:03:42 +0100179{
180 return key_create_ecdsa(key, key_bits, NID_brainpoolP256t1);
Juan Castilloa2224ab2015-06-30 13:36:57 +0100181}
Donald Chan50d53972024-04-10 14:56:53 -0700182#endif
Lionel Debievefefeffb2022-11-14 11:03:42 +0100183#endif /* USING_OPENSSL3 */
Juan Castilloa2224ab2015-06-30 13:36:57 +0100184#endif /* OPENSSL_NO_EC */
185
Manish V Badarkhe7b425de2024-07-19 08:31:51 +0100186typedef int (*key_create_fn_t)(cert_key_t *key, int key_bits);
Juan Castilloa2224ab2015-06-30 13:36:57 +0100187static const key_create_fn_t key_create_fn[KEY_ALG_MAX_NUM] = {
Lionel Debievefefeffb2022-11-14 11:03:42 +0100188 [KEY_ALG_RSA] = key_create_rsa,
Juan Castilloa2224ab2015-06-30 13:36:57 +0100189#ifndef OPENSSL_NO_EC
Lionel Debievefefeffb2022-11-14 11:03:42 +0100190 [KEY_ALG_ECDSA_NIST] = key_create_ecdsa_nist,
Donald Chan50d53972024-04-10 14:56:53 -0700191#if OPENSSL_VERSION_NUMBER >= 0x10100000L
Lionel Debievefefeffb2022-11-14 11:03:42 +0100192 [KEY_ALG_ECDSA_BRAINPOOL_R] = key_create_ecdsa_brainpool_r,
193 [KEY_ALG_ECDSA_BRAINPOOL_T] = key_create_ecdsa_brainpool_t,
Donald Chan50d53972024-04-10 14:56:53 -0700194#endif
Juan Castilloa2224ab2015-06-30 13:36:57 +0100195#endif /* OPENSSL_NO_EC */
196};
197
Manish V Badarkhe7b425de2024-07-19 08:31:51 +0100198int key_create(cert_key_t *key, int type, int key_bits)
Juan Castilloa2224ab2015-06-30 13:36:57 +0100199{
200 if (type >= KEY_ALG_MAX_NUM) {
201 printf("Invalid key type\n");
202 return 0;
203 }
204
Juan Castilloa2224ab2015-06-30 13:36:57 +0100205 if (key_create_fn[type]) {
Justin Chadwellfebe86c2019-07-29 17:13:45 +0100206 return key_create_fn[type](key, key_bits);
Juan Castilloa2224ab2015-06-30 13:36:57 +0100207 }
Juan Castillof9f39c32015-06-01 16:34:23 +0100208
Juan Castillo11abdcd2014-10-21 11:30:42 +0100209 return 0;
210}
211
Robin van der Gracht06b5cdb2023-09-12 11:16:23 +0200212static EVP_PKEY *key_load_pkcs11(const char *uri)
213{
214 char *key_pass;
215 EVP_PKEY *pkey;
216 ENGINE *e;
217
Gatien Chevalliercaf56ce2024-10-18 17:26:43 +0200218#if !USING_OPENSSL3
219 if (!OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CONFIG, NULL)) {
220 fprintf(stderr, "Failed to init SSL\n");
221 return NULL;
222 }
223#endif
224
Robin van der Gracht06b5cdb2023-09-12 11:16:23 +0200225 ENGINE_load_builtin_engines();
226 e = ENGINE_by_id("pkcs11");
227 if (!e) {
228 fprintf(stderr, "Cannot Load PKCS#11 ENGINE\n");
229 return NULL;
230 }
231
232 if (!ENGINE_init(e)) {
233 fprintf(stderr, "Cannot ENGINE_init\n");
234 goto err;
235 }
236
237 key_pass = getenv("PKCS11_PIN");
238 if (key_pass) {
239 if (!ENGINE_ctrl_cmd_string(e, "PIN", key_pass, 0)) {
240 fprintf(stderr, "Cannot Set PKCS#11 PIN\n");
241 goto err;
242 }
243 }
244
245 pkey = ENGINE_load_private_key(e, uri, NULL, NULL);
246 if (pkey)
247 return pkey;
248err:
249 ENGINE_free(e);
250 return NULL;
251
252}
253
Manish V Badarkhe7b425de2024-07-19 08:31:51 +0100254unsigned int key_load(cert_key_t *key)
Juan Castillo11abdcd2014-10-21 11:30:42 +0100255{
Sandrine Bailleuxea9f2f52023-10-16 14:52:06 +0200256 if (key->fn == NULL) {
257 VERBOSE("Key not specified\n");
258 return KEY_ERR_FILENAME;
259 }
Juan Castillo11abdcd2014-10-21 11:30:42 +0100260
Sandrine Bailleuxea9f2f52023-10-16 14:52:06 +0200261 if (strncmp(key->fn, "pkcs11:", 7) == 0) {
262 /* Load key through pkcs11 */
263 key->key = key_load_pkcs11(key->fn);
Juan Castillo11abdcd2014-10-21 11:30:42 +0100264 } else {
Sandrine Bailleuxea9f2f52023-10-16 14:52:06 +0200265 /* Load key from file */
266 FILE *fp = fopen(key->fn, "r");
267 if (fp == NULL) {
268 WARN("Cannot open file %s\n", key->fn);
269 return KEY_ERR_OPEN;
270 }
271
272 key->key = PEM_read_PrivateKey(fp, NULL, NULL, NULL);
273 fclose(fp);
274 }
275
276 if (key->key == NULL) {
277 ERROR("Cannot load key from %s\n", key->fn);
278 return KEY_ERR_LOAD;
Juan Castillo11abdcd2014-10-21 11:30:42 +0100279 }
280
Sandrine Bailleuxea9f2f52023-10-16 14:52:06 +0200281 return KEY_ERR_NONE;
Juan Castillo11abdcd2014-10-21 11:30:42 +0100282}
283
Manish V Badarkhe7b425de2024-07-19 08:31:51 +0100284int key_store(cert_key_t *key)
Juan Castillo11abdcd2014-10-21 11:30:42 +0100285{
Masahiro Yamada48cb5e52017-02-06 19:47:44 +0900286 FILE *fp;
Juan Castillo11abdcd2014-10-21 11:30:42 +0100287
288 if (key->fn) {
Robin van der Gracht06b5cdb2023-09-12 11:16:23 +0200289 if (!strncmp(key->fn, "pkcs11:", 7)) {
290 ERROR("PKCS11 URI provided instead of a file");
291 return 0;
292 }
Juan Castillo11abdcd2014-10-21 11:30:42 +0100293 fp = fopen(key->fn, "w");
294 if (fp) {
295 PEM_write_PrivateKey(fp, key->key,
296 NULL, NULL, 0, NULL, NULL);
297 fclose(fp);
298 return 1;
299 } else {
300 ERROR("Cannot create file %s\n", key->fn);
301 }
302 } else {
303 ERROR("Key filename not specified\n");
304 }
305
306 return 0;
307}
Juan Castillo1218dd52015-07-03 16:23:16 +0100308
309int key_init(void)
310{
Juan Castillo212f7382015-12-15 16:37:57 +0000311 cmd_opt_t cmd_opt;
Manish V Badarkhe7b425de2024-07-19 08:31:51 +0100312 cert_key_t *key;
Juan Castillo1218dd52015-07-03 16:23:16 +0100313 unsigned int i;
314
Pankaj Guptadd906e62020-12-09 14:02:38 +0530315 keys = malloc((num_def_keys * sizeof(def_keys[0]))
316#ifdef PDEF_KEYS
317 + (num_pdef_keys * sizeof(pdef_keys[0]))
318#endif
319 );
320
321 if (keys == NULL) {
322 ERROR("%s:%d Failed to allocate memory.\n", __func__, __LINE__);
323 return 1;
324 }
325
326 memcpy(&keys[0], &def_keys[0], (num_def_keys * sizeof(def_keys[0])));
327#ifdef PDEF_KEYS
328 memcpy(&keys[num_def_keys], &pdef_keys[0],
329 (num_pdef_keys * sizeof(pdef_keys[0])));
330
331 num_keys = num_def_keys + num_pdef_keys;
332#else
333 num_keys = num_def_keys;
334#endif
335 ;
336
Juan Castillo1218dd52015-07-03 16:23:16 +0100337 for (i = 0; i < num_keys; i++) {
338 key = &keys[i];
339 if (key->opt != NULL) {
Juan Castillo212f7382015-12-15 16:37:57 +0000340 cmd_opt.long_opt.name = key->opt;
341 cmd_opt.long_opt.has_arg = required_argument;
342 cmd_opt.long_opt.flag = NULL;
343 cmd_opt.long_opt.val = CMD_OPT_KEY;
344 cmd_opt.help_msg = key->help_msg;
345 cmd_opt_add(&cmd_opt);
Juan Castillo1218dd52015-07-03 16:23:16 +0100346 }
347 }
348
Masahiro Yamada48cb5e52017-02-06 19:47:44 +0900349 return 0;
Juan Castillo1218dd52015-07-03 16:23:16 +0100350}
351
Manish V Badarkhe7b425de2024-07-19 08:31:51 +0100352cert_key_t *key_get_by_opt(const char *opt)
Juan Castillo1218dd52015-07-03 16:23:16 +0100353{
Manish V Badarkhe7b425de2024-07-19 08:31:51 +0100354 cert_key_t *key;
Juan Castillo1218dd52015-07-03 16:23:16 +0100355 unsigned int i;
356
357 /* Sequential search. This is not a performance concern since the number
358 * of keys is bounded and the code runs on a host machine */
359 for (i = 0; i < num_keys; i++) {
360 key = &keys[i];
361 if (0 == strcmp(key->opt, opt)) {
362 return key;
363 }
364 }
365
366 return NULL;
367}
Juan Pablo Conde3539c742022-10-25 19:41:02 -0400368
369void key_cleanup(void)
370{
371 unsigned int i;
372
373 for (i = 0; i < num_keys; i++) {
374 EVP_PKEY_free(keys[i].key);
375 if (keys[i].fn != NULL) {
376 void *ptr = keys[i].fn;
377
378 free(ptr);
379 keys[i].fn = NULL;
380 }
381 }
382 free(keys);
383}
384