blob: 14c8e18ade4112b18e47936879ca2118800ab490 [file] [log] [blame]
Juan Castillo11abdcd2014-10-21 11:30:42 +01001/*
laurenw-arm00185ea2023-08-15 14:53:59 -05002 * Copyright (c) 2015-2023, Arm Limited and Contributors. All rights reserved.
Juan Castillo11abdcd2014-10-21 11:30:42 +01003 *
dp-armfa3cf0b2017-05-03 09:38:09 +01004 * SPDX-License-Identifier: BSD-3-Clause
Juan Castillo11abdcd2014-10-21 11:30:42 +01005 */
6
laurenw-arm00185ea2023-08-15 14:53:59 -05007#include <assert.h>
Juan Castillo11abdcd2014-10-21 11:30:42 +01008#include <getopt.h>
9#include <stdio.h>
10#include <stdlib.h>
11#include <string.h>
12
Robin van der Gracht06b5cdb2023-09-12 11:16:23 +020013/* Suppress OpenSSL engine deprecation warnings */
14#define OPENSSL_SUPPRESS_DEPRECATED
15
Juan Castillo11abdcd2014-10-21 11:30:42 +010016#include <openssl/conf.h>
Robin van der Gracht06b5cdb2023-09-12 11:16:23 +020017#include <openssl/engine.h>
Juan Castillo11abdcd2014-10-21 11:30:42 +010018#include <openssl/evp.h>
19#include <openssl/pem.h>
20
21#include "cert.h"
Juan Castillo1218dd52015-07-03 16:23:16 +010022#include "cmd_opt.h"
Juan Castillo11abdcd2014-10-21 11:30:42 +010023#include "debug.h"
24#include "key.h"
Juan Castillo11abdcd2014-10-21 11:30:42 +010025#include "sha.h"
26
27#define MAX_FILENAME_LEN 1024
28
Pankaj Guptadd906e62020-12-09 14:02:38 +053029key_t *keys;
30unsigned int num_keys;
31
Juan Pablo Conde3539c742022-10-25 19:41:02 -040032#if !USING_OPENSSL3
Juan Castillo11abdcd2014-10-21 11:30:42 +010033/*
Juan Castillof9f39c32015-06-01 16:34:23 +010034 * Create a new key container
Juan Castillo11abdcd2014-10-21 11:30:42 +010035 */
Masahiro Yamadabccb1092017-02-06 21:15:01 +090036int key_new(key_t *key)
Juan Castillo11abdcd2014-10-21 11:30:42 +010037{
Juan Castillo11abdcd2014-10-21 11:30:42 +010038 /* Create key pair container */
Juan Castillof9f39c32015-06-01 16:34:23 +010039 key->key = EVP_PKEY_new();
40 if (key->key == NULL) {
Juan Castillo11abdcd2014-10-21 11:30:42 +010041 return 0;
42 }
43
Juan Castillof9f39c32015-06-01 16:34:23 +010044 return 1;
45}
Juan Pablo Conde3539c742022-10-25 19:41:02 -040046#endif
Juan Castillof9f39c32015-06-01 16:34:23 +010047
Justin Chadwellfebe86c2019-07-29 17:13:45 +010048static int key_create_rsa(key_t *key, int key_bits)
Juan Castillof9f39c32015-06-01 16:34:23 +010049{
Juan Pablo Conde3539c742022-10-25 19:41:02 -040050#if USING_OPENSSL3
Juan Pablo Conde7275a5a2022-03-02 18:10:08 -050051 EVP_PKEY *rsa = EVP_RSA_gen(key_bits);
Juan Castilloa2224ab2015-06-30 13:36:57 +010052 if (rsa == NULL) {
Michalis Pappas38628942017-10-06 16:11:44 +080053 printf("Cannot generate RSA key\n");
Juan Pablo Conde7275a5a2022-03-02 18:10:08 -050054 return 0;
Juan Castillo11abdcd2014-10-21 11:30:42 +010055 }
Juan Pablo Conde7275a5a2022-03-02 18:10:08 -050056 key->key = rsa;
Juan Castillof9f39c32015-06-01 16:34:23 +010057 return 1;
Juan Pablo Conde3539c742022-10-25 19:41:02 -040058#else
59 BIGNUM *e;
60 RSA *rsa = NULL;
61
62 e = BN_new();
63 if (e == NULL) {
64 printf("Cannot create RSA exponent\n");
65 return 0;
66 }
67
68 if (!BN_set_word(e, RSA_F4)) {
69 printf("Cannot assign RSA exponent\n");
70 goto err2;
71 }
72
73 rsa = RSA_new();
74 if (rsa == NULL) {
75 printf("Cannot create RSA key\n");
76 goto err2;
77 }
78
79 if (!RSA_generate_key_ex(rsa, key_bits, e, NULL)) {
80 printf("Cannot generate RSA key\n");
81 goto err;
82 }
83
84 if (!EVP_PKEY_assign_RSA(key->key, rsa)) {
85 printf("Cannot assign RSA key\n");
86 goto err;
87 }
88
89 BN_free(e);
90 return 1;
91
92err:
93 RSA_free(rsa);
94err2:
95 BN_free(e);
96 return 0;
97#endif
Juan Castilloa2224ab2015-06-30 13:36:57 +010098}
99
100#ifndef OPENSSL_NO_EC
Juan Pablo Conde3539c742022-10-25 19:41:02 -0400101#if USING_OPENSSL3
Lionel Debievefefeffb2022-11-14 11:03:42 +0100102static int key_create_ecdsa(key_t *key, int key_bits, const char *curve)
103{
104 EVP_PKEY *ec = EVP_EC_gen(curve);
Juan Castilloa2224ab2015-06-30 13:36:57 +0100105 if (ec == NULL) {
Juan Castilloa2224ab2015-06-30 13:36:57 +0100106 printf("Cannot generate EC key\n");
Juan Pablo Conde7275a5a2022-03-02 18:10:08 -0500107 return 0;
Juan Castilloa2224ab2015-06-30 13:36:57 +0100108 }
Lionel Debievefefeffb2022-11-14 11:03:42 +0100109
Juan Pablo Conde7275a5a2022-03-02 18:10:08 -0500110 key->key = ec;
Juan Castilloa2224ab2015-06-30 13:36:57 +0100111 return 1;
Lionel Debievefefeffb2022-11-14 11:03:42 +0100112}
113
114static int key_create_ecdsa_nist(key_t *key, int key_bits)
115{
laurenw-arm00185ea2023-08-15 14:53:59 -0500116 if (key_bits == 384) {
117 return key_create_ecdsa(key, key_bits, "secp384r1");
118 } else {
119 assert(key_bits == 256);
120 return key_create_ecdsa(key, key_bits, "prime256v1");
121 }
Lionel Debievefefeffb2022-11-14 11:03:42 +0100122}
123
124static int key_create_ecdsa_brainpool_r(key_t *key, int key_bits)
125{
126 return key_create_ecdsa(key, key_bits, "brainpoolP256r1");
127}
128
129static int key_create_ecdsa_brainpool_t(key_t *key, int key_bits)
130{
131 return key_create_ecdsa(key, key_bits, "brainpoolP256t1");
132}
Juan Pablo Conde3539c742022-10-25 19:41:02 -0400133#else
Lionel Debievefefeffb2022-11-14 11:03:42 +0100134static int key_create_ecdsa(key_t *key, int key_bits, const int curve_id)
135{
Juan Pablo Conde3539c742022-10-25 19:41:02 -0400136 EC_KEY *ec;
137
Lionel Debievefefeffb2022-11-14 11:03:42 +0100138 ec = EC_KEY_new_by_curve_name(curve_id);
Juan Pablo Conde3539c742022-10-25 19:41:02 -0400139 if (ec == NULL) {
140 printf("Cannot create EC key\n");
141 return 0;
142 }
143 if (!EC_KEY_generate_key(ec)) {
144 printf("Cannot generate EC key\n");
145 goto err;
146 }
147 EC_KEY_set_flags(ec, EC_PKEY_NO_PARAMETERS);
148 EC_KEY_set_asn1_flag(ec, OPENSSL_EC_NAMED_CURVE);
149 if (!EVP_PKEY_assign_EC_KEY(key->key, ec)) {
150 printf("Cannot assign EC key\n");
151 goto err;
152 }
153
154 return 1;
155
156err:
157 EC_KEY_free(ec);
158 return 0;
Lionel Debievefefeffb2022-11-14 11:03:42 +0100159}
160
161static int key_create_ecdsa_nist(key_t *key, int key_bits)
162{
laurenw-arm00185ea2023-08-15 14:53:59 -0500163 if (key_bits == 384) {
164 return key_create_ecdsa(key, key_bits, NID_secp384r1);
165 } else {
166 assert(key_bits == 256);
167 return key_create_ecdsa(key, key_bits, NID_X9_62_prime256v1);
168 }
Lionel Debievefefeffb2022-11-14 11:03:42 +0100169}
170
171static int key_create_ecdsa_brainpool_r(key_t *key, int key_bits)
172{
173 return key_create_ecdsa(key, key_bits, NID_brainpoolP256r1);
174}
175
176static int key_create_ecdsa_brainpool_t(key_t *key, int key_bits)
177{
178 return key_create_ecdsa(key, key_bits, NID_brainpoolP256t1);
Juan Castilloa2224ab2015-06-30 13:36:57 +0100179}
Lionel Debievefefeffb2022-11-14 11:03:42 +0100180#endif /* USING_OPENSSL3 */
Juan Castilloa2224ab2015-06-30 13:36:57 +0100181#endif /* OPENSSL_NO_EC */
182
Justin Chadwellfebe86c2019-07-29 17:13:45 +0100183typedef int (*key_create_fn_t)(key_t *key, int key_bits);
Juan Castilloa2224ab2015-06-30 13:36:57 +0100184static const key_create_fn_t key_create_fn[KEY_ALG_MAX_NUM] = {
Lionel Debievefefeffb2022-11-14 11:03:42 +0100185 [KEY_ALG_RSA] = key_create_rsa,
Juan Castilloa2224ab2015-06-30 13:36:57 +0100186#ifndef OPENSSL_NO_EC
Lionel Debievefefeffb2022-11-14 11:03:42 +0100187 [KEY_ALG_ECDSA_NIST] = key_create_ecdsa_nist,
188 [KEY_ALG_ECDSA_BRAINPOOL_R] = key_create_ecdsa_brainpool_r,
189 [KEY_ALG_ECDSA_BRAINPOOL_T] = key_create_ecdsa_brainpool_t,
Juan Castilloa2224ab2015-06-30 13:36:57 +0100190#endif /* OPENSSL_NO_EC */
191};
192
Justin Chadwellfebe86c2019-07-29 17:13:45 +0100193int key_create(key_t *key, int type, int key_bits)
Juan Castilloa2224ab2015-06-30 13:36:57 +0100194{
195 if (type >= KEY_ALG_MAX_NUM) {
196 printf("Invalid key type\n");
197 return 0;
198 }
199
Juan Castilloa2224ab2015-06-30 13:36:57 +0100200 if (key_create_fn[type]) {
Justin Chadwellfebe86c2019-07-29 17:13:45 +0100201 return key_create_fn[type](key, key_bits);
Juan Castilloa2224ab2015-06-30 13:36:57 +0100202 }
Juan Castillof9f39c32015-06-01 16:34:23 +0100203
Juan Castillo11abdcd2014-10-21 11:30:42 +0100204 return 0;
205}
206
Robin van der Gracht06b5cdb2023-09-12 11:16:23 +0200207static EVP_PKEY *key_load_pkcs11(const char *uri)
208{
209 char *key_pass;
210 EVP_PKEY *pkey;
211 ENGINE *e;
212
213 ENGINE_load_builtin_engines();
214 e = ENGINE_by_id("pkcs11");
215 if (!e) {
216 fprintf(stderr, "Cannot Load PKCS#11 ENGINE\n");
217 return NULL;
218 }
219
220 if (!ENGINE_init(e)) {
221 fprintf(stderr, "Cannot ENGINE_init\n");
222 goto err;
223 }
224
225 key_pass = getenv("PKCS11_PIN");
226 if (key_pass) {
227 if (!ENGINE_ctrl_cmd_string(e, "PIN", key_pass, 0)) {
228 fprintf(stderr, "Cannot Set PKCS#11 PIN\n");
229 goto err;
230 }
231 }
232
233 pkey = ENGINE_load_private_key(e, uri, NULL, NULL);
234 if (pkey)
235 return pkey;
236err:
237 ENGINE_free(e);
238 return NULL;
239
240}
241
Juan Castillof9f39c32015-06-01 16:34:23 +0100242int key_load(key_t *key, unsigned int *err_code)
Juan Castillo11abdcd2014-10-21 11:30:42 +0100243{
Masahiro Yamada48cb5e52017-02-06 19:47:44 +0900244 FILE *fp;
Juan Castillo11abdcd2014-10-21 11:30:42 +0100245
Juan Castillo11abdcd2014-10-21 11:30:42 +0100246 if (key->fn) {
Robin van der Gracht06b5cdb2023-09-12 11:16:23 +0200247 if (!strncmp(key->fn, "pkcs11:", 7)) {
248 /* Load key through pkcs11 */
249 key->key = key_load_pkcs11(key->fn);
250 } else {
251 /* Load key from file */
252 fp = fopen(key->fn, "r");
253 if (fp) {
254 key->key = PEM_read_PrivateKey(fp, NULL, NULL, NULL);
255 fclose(fp);
Juan Castillo11abdcd2014-10-21 11:30:42 +0100256 } else {
Robin van der Gracht06b5cdb2023-09-12 11:16:23 +0200257 WARN("Cannot open file %s\n", key->fn);
258 *err_code = KEY_ERR_OPEN;
Juan Castillo11abdcd2014-10-21 11:30:42 +0100259 }
Robin van der Gracht06b5cdb2023-09-12 11:16:23 +0200260 }
261 if (key->key) {
262 *err_code = KEY_ERR_NONE;
263 return 1;
Juan Castillo11abdcd2014-10-21 11:30:42 +0100264 } else {
Robin van der Gracht06b5cdb2023-09-12 11:16:23 +0200265 ERROR("Cannot load key from %s\n", key->fn);
266 *err_code = KEY_ERR_LOAD;
Juan Castillo11abdcd2014-10-21 11:30:42 +0100267 }
268 } else {
Robin van der Gracht06b5cdb2023-09-12 11:16:23 +0200269 VERBOSE("Key not specified\n");
Juan Castillof9f39c32015-06-01 16:34:23 +0100270 *err_code = KEY_ERR_FILENAME;
Juan Castillo11abdcd2014-10-21 11:30:42 +0100271 }
272
Juan Castillo11abdcd2014-10-21 11:30:42 +0100273 return 0;
274}
275
276int key_store(key_t *key)
277{
Masahiro Yamada48cb5e52017-02-06 19:47:44 +0900278 FILE *fp;
Juan Castillo11abdcd2014-10-21 11:30:42 +0100279
280 if (key->fn) {
Robin van der Gracht06b5cdb2023-09-12 11:16:23 +0200281 if (!strncmp(key->fn, "pkcs11:", 7)) {
282 ERROR("PKCS11 URI provided instead of a file");
283 return 0;
284 }
Juan Castillo11abdcd2014-10-21 11:30:42 +0100285 fp = fopen(key->fn, "w");
286 if (fp) {
287 PEM_write_PrivateKey(fp, key->key,
288 NULL, NULL, 0, NULL, NULL);
289 fclose(fp);
290 return 1;
291 } else {
292 ERROR("Cannot create file %s\n", key->fn);
293 }
294 } else {
295 ERROR("Key filename not specified\n");
296 }
297
298 return 0;
299}
Juan Castillo1218dd52015-07-03 16:23:16 +0100300
301int key_init(void)
302{
Juan Castillo212f7382015-12-15 16:37:57 +0000303 cmd_opt_t cmd_opt;
Juan Castillo1218dd52015-07-03 16:23:16 +0100304 key_t *key;
Juan Castillo1218dd52015-07-03 16:23:16 +0100305 unsigned int i;
306
Pankaj Guptadd906e62020-12-09 14:02:38 +0530307 keys = malloc((num_def_keys * sizeof(def_keys[0]))
308#ifdef PDEF_KEYS
309 + (num_pdef_keys * sizeof(pdef_keys[0]))
310#endif
311 );
312
313 if (keys == NULL) {
314 ERROR("%s:%d Failed to allocate memory.\n", __func__, __LINE__);
315 return 1;
316 }
317
318 memcpy(&keys[0], &def_keys[0], (num_def_keys * sizeof(def_keys[0])));
319#ifdef PDEF_KEYS
320 memcpy(&keys[num_def_keys], &pdef_keys[0],
321 (num_pdef_keys * sizeof(pdef_keys[0])));
322
323 num_keys = num_def_keys + num_pdef_keys;
324#else
325 num_keys = num_def_keys;
326#endif
327 ;
328
Juan Castillo1218dd52015-07-03 16:23:16 +0100329 for (i = 0; i < num_keys; i++) {
330 key = &keys[i];
331 if (key->opt != NULL) {
Juan Castillo212f7382015-12-15 16:37:57 +0000332 cmd_opt.long_opt.name = key->opt;
333 cmd_opt.long_opt.has_arg = required_argument;
334 cmd_opt.long_opt.flag = NULL;
335 cmd_opt.long_opt.val = CMD_OPT_KEY;
336 cmd_opt.help_msg = key->help_msg;
337 cmd_opt_add(&cmd_opt);
Juan Castillo1218dd52015-07-03 16:23:16 +0100338 }
339 }
340
Masahiro Yamada48cb5e52017-02-06 19:47:44 +0900341 return 0;
Juan Castillo1218dd52015-07-03 16:23:16 +0100342}
343
344key_t *key_get_by_opt(const char *opt)
345{
Masahiro Yamada48cb5e52017-02-06 19:47:44 +0900346 key_t *key;
Juan Castillo1218dd52015-07-03 16:23:16 +0100347 unsigned int i;
348
349 /* Sequential search. This is not a performance concern since the number
350 * of keys is bounded and the code runs on a host machine */
351 for (i = 0; i < num_keys; i++) {
352 key = &keys[i];
353 if (0 == strcmp(key->opt, opt)) {
354 return key;
355 }
356 }
357
358 return NULL;
359}
Juan Pablo Conde3539c742022-10-25 19:41:02 -0400360
361void key_cleanup(void)
362{
363 unsigned int i;
364
365 for (i = 0; i < num_keys; i++) {
366 EVP_PKEY_free(keys[i].key);
367 if (keys[i].fn != NULL) {
368 void *ptr = keys[i].fn;
369
370 free(ptr);
371 keys[i].fn = NULL;
372 }
373 }
374 free(keys);
375}
376