blob: 487777b67046e0d2fd62e65964582f620e3019c0 [file] [log] [blame]
Juan Castillo11abdcd2014-10-21 11:30:42 +01001/*
Juan Pablo Conde3539c742022-10-25 19:41:02 -04002 * Copyright (c) 2015-2022, Arm Limited and Contributors. All rights reserved.
Juan Castillo11abdcd2014-10-21 11:30:42 +01003 *
dp-armfa3cf0b2017-05-03 09:38:09 +01004 * SPDX-License-Identifier: BSD-3-Clause
Juan Castillo11abdcd2014-10-21 11:30:42 +01005 */
6
7#include <getopt.h>
8#include <stdio.h>
9#include <stdlib.h>
10#include <string.h>
11
12#include <openssl/conf.h>
13#include <openssl/evp.h>
14#include <openssl/pem.h>
15
16#include "cert.h"
Juan Castillo1218dd52015-07-03 16:23:16 +010017#include "cmd_opt.h"
Juan Castillo11abdcd2014-10-21 11:30:42 +010018#include "debug.h"
19#include "key.h"
Juan Castillo11abdcd2014-10-21 11:30:42 +010020#include "sha.h"
21
22#define MAX_FILENAME_LEN 1024
23
Pankaj Guptadd906e62020-12-09 14:02:38 +053024key_t *keys;
25unsigned int num_keys;
26
Juan Pablo Conde3539c742022-10-25 19:41:02 -040027#if !USING_OPENSSL3
Juan Castillo11abdcd2014-10-21 11:30:42 +010028/*
Juan Castillof9f39c32015-06-01 16:34:23 +010029 * Create a new key container
Juan Castillo11abdcd2014-10-21 11:30:42 +010030 */
Masahiro Yamadabccb1092017-02-06 21:15:01 +090031int key_new(key_t *key)
Juan Castillo11abdcd2014-10-21 11:30:42 +010032{
Juan Castillo11abdcd2014-10-21 11:30:42 +010033 /* Create key pair container */
Juan Castillof9f39c32015-06-01 16:34:23 +010034 key->key = EVP_PKEY_new();
35 if (key->key == NULL) {
Juan Castillo11abdcd2014-10-21 11:30:42 +010036 return 0;
37 }
38
Juan Castillof9f39c32015-06-01 16:34:23 +010039 return 1;
40}
Juan Pablo Conde3539c742022-10-25 19:41:02 -040041#endif
Juan Castillof9f39c32015-06-01 16:34:23 +010042
Justin Chadwellfebe86c2019-07-29 17:13:45 +010043static int key_create_rsa(key_t *key, int key_bits)
Juan Castillof9f39c32015-06-01 16:34:23 +010044{
Juan Pablo Conde3539c742022-10-25 19:41:02 -040045#if USING_OPENSSL3
Juan Pablo Conde7275a5a2022-03-02 18:10:08 -050046 EVP_PKEY *rsa = EVP_RSA_gen(key_bits);
Juan Castilloa2224ab2015-06-30 13:36:57 +010047 if (rsa == NULL) {
Michalis Pappas38628942017-10-06 16:11:44 +080048 printf("Cannot generate RSA key\n");
Juan Pablo Conde7275a5a2022-03-02 18:10:08 -050049 return 0;
Juan Castillo11abdcd2014-10-21 11:30:42 +010050 }
Juan Pablo Conde7275a5a2022-03-02 18:10:08 -050051 key->key = rsa;
Juan Castillof9f39c32015-06-01 16:34:23 +010052 return 1;
Juan Pablo Conde3539c742022-10-25 19:41:02 -040053#else
54 BIGNUM *e;
55 RSA *rsa = NULL;
56
57 e = BN_new();
58 if (e == NULL) {
59 printf("Cannot create RSA exponent\n");
60 return 0;
61 }
62
63 if (!BN_set_word(e, RSA_F4)) {
64 printf("Cannot assign RSA exponent\n");
65 goto err2;
66 }
67
68 rsa = RSA_new();
69 if (rsa == NULL) {
70 printf("Cannot create RSA key\n");
71 goto err2;
72 }
73
74 if (!RSA_generate_key_ex(rsa, key_bits, e, NULL)) {
75 printf("Cannot generate RSA key\n");
76 goto err;
77 }
78
79 if (!EVP_PKEY_assign_RSA(key->key, rsa)) {
80 printf("Cannot assign RSA key\n");
81 goto err;
82 }
83
84 BN_free(e);
85 return 1;
86
87err:
88 RSA_free(rsa);
89err2:
90 BN_free(e);
91 return 0;
92#endif
Juan Castilloa2224ab2015-06-30 13:36:57 +010093}
94
95#ifndef OPENSSL_NO_EC
Juan Pablo Conde3539c742022-10-25 19:41:02 -040096#if USING_OPENSSL3
Lionel Debievefefeffb2022-11-14 11:03:42 +010097static int key_create_ecdsa(key_t *key, int key_bits, const char *curve)
98{
99 EVP_PKEY *ec = EVP_EC_gen(curve);
Juan Castilloa2224ab2015-06-30 13:36:57 +0100100 if (ec == NULL) {
Juan Castilloa2224ab2015-06-30 13:36:57 +0100101 printf("Cannot generate EC key\n");
Juan Pablo Conde7275a5a2022-03-02 18:10:08 -0500102 return 0;
Juan Castilloa2224ab2015-06-30 13:36:57 +0100103 }
Lionel Debievefefeffb2022-11-14 11:03:42 +0100104
Juan Pablo Conde7275a5a2022-03-02 18:10:08 -0500105 key->key = ec;
Juan Castilloa2224ab2015-06-30 13:36:57 +0100106 return 1;
Lionel Debievefefeffb2022-11-14 11:03:42 +0100107}
108
109static int key_create_ecdsa_nist(key_t *key, int key_bits)
110{
111 return key_create_ecdsa(key, key_bits, "prime256v1");
112}
113
114static int key_create_ecdsa_brainpool_r(key_t *key, int key_bits)
115{
116 return key_create_ecdsa(key, key_bits, "brainpoolP256r1");
117}
118
119static int key_create_ecdsa_brainpool_t(key_t *key, int key_bits)
120{
121 return key_create_ecdsa(key, key_bits, "brainpoolP256t1");
122}
Juan Pablo Conde3539c742022-10-25 19:41:02 -0400123#else
Lionel Debievefefeffb2022-11-14 11:03:42 +0100124static int key_create_ecdsa(key_t *key, int key_bits, const int curve_id)
125{
Juan Pablo Conde3539c742022-10-25 19:41:02 -0400126 EC_KEY *ec;
127
Lionel Debievefefeffb2022-11-14 11:03:42 +0100128 ec = EC_KEY_new_by_curve_name(curve_id);
Juan Pablo Conde3539c742022-10-25 19:41:02 -0400129 if (ec == NULL) {
130 printf("Cannot create EC key\n");
131 return 0;
132 }
133 if (!EC_KEY_generate_key(ec)) {
134 printf("Cannot generate EC key\n");
135 goto err;
136 }
137 EC_KEY_set_flags(ec, EC_PKEY_NO_PARAMETERS);
138 EC_KEY_set_asn1_flag(ec, OPENSSL_EC_NAMED_CURVE);
139 if (!EVP_PKEY_assign_EC_KEY(key->key, ec)) {
140 printf("Cannot assign EC key\n");
141 goto err;
142 }
143
144 return 1;
145
146err:
147 EC_KEY_free(ec);
148 return 0;
Lionel Debievefefeffb2022-11-14 11:03:42 +0100149}
150
151static int key_create_ecdsa_nist(key_t *key, int key_bits)
152{
153 return key_create_ecdsa(key, key_bits, NID_X9_62_prime256v1);
154}
155
156static int key_create_ecdsa_brainpool_r(key_t *key, int key_bits)
157{
158 return key_create_ecdsa(key, key_bits, NID_brainpoolP256r1);
159}
160
161static int key_create_ecdsa_brainpool_t(key_t *key, int key_bits)
162{
163 return key_create_ecdsa(key, key_bits, NID_brainpoolP256t1);
Juan Castilloa2224ab2015-06-30 13:36:57 +0100164}
Lionel Debievefefeffb2022-11-14 11:03:42 +0100165#endif /* USING_OPENSSL3 */
Juan Castilloa2224ab2015-06-30 13:36:57 +0100166#endif /* OPENSSL_NO_EC */
167
Justin Chadwellfebe86c2019-07-29 17:13:45 +0100168typedef int (*key_create_fn_t)(key_t *key, int key_bits);
Juan Castilloa2224ab2015-06-30 13:36:57 +0100169static const key_create_fn_t key_create_fn[KEY_ALG_MAX_NUM] = {
Lionel Debievefefeffb2022-11-14 11:03:42 +0100170 [KEY_ALG_RSA] = key_create_rsa,
Juan Castilloa2224ab2015-06-30 13:36:57 +0100171#ifndef OPENSSL_NO_EC
Lionel Debievefefeffb2022-11-14 11:03:42 +0100172 [KEY_ALG_ECDSA_NIST] = key_create_ecdsa_nist,
173 [KEY_ALG_ECDSA_BRAINPOOL_R] = key_create_ecdsa_brainpool_r,
174 [KEY_ALG_ECDSA_BRAINPOOL_T] = key_create_ecdsa_brainpool_t,
Juan Castilloa2224ab2015-06-30 13:36:57 +0100175#endif /* OPENSSL_NO_EC */
176};
177
Justin Chadwellfebe86c2019-07-29 17:13:45 +0100178int key_create(key_t *key, int type, int key_bits)
Juan Castilloa2224ab2015-06-30 13:36:57 +0100179{
180 if (type >= KEY_ALG_MAX_NUM) {
181 printf("Invalid key type\n");
182 return 0;
183 }
184
Juan Castilloa2224ab2015-06-30 13:36:57 +0100185 if (key_create_fn[type]) {
Justin Chadwellfebe86c2019-07-29 17:13:45 +0100186 return key_create_fn[type](key, key_bits);
Juan Castilloa2224ab2015-06-30 13:36:57 +0100187 }
Juan Castillof9f39c32015-06-01 16:34:23 +0100188
Juan Castillo11abdcd2014-10-21 11:30:42 +0100189 return 0;
190}
191
Juan Castillof9f39c32015-06-01 16:34:23 +0100192int key_load(key_t *key, unsigned int *err_code)
Juan Castillo11abdcd2014-10-21 11:30:42 +0100193{
Masahiro Yamada48cb5e52017-02-06 19:47:44 +0900194 FILE *fp;
195 EVP_PKEY *k;
Juan Castillo11abdcd2014-10-21 11:30:42 +0100196
Juan Castillo11abdcd2014-10-21 11:30:42 +0100197 if (key->fn) {
198 /* Load key from file */
199 fp = fopen(key->fn, "r");
200 if (fp) {
Juan Castillof9f39c32015-06-01 16:34:23 +0100201 k = PEM_read_PrivateKey(fp, &key->key, NULL, NULL);
Juan Castillo11abdcd2014-10-21 11:30:42 +0100202 fclose(fp);
203 if (k) {
Juan Castillof9f39c32015-06-01 16:34:23 +0100204 *err_code = KEY_ERR_NONE;
Juan Castillo11abdcd2014-10-21 11:30:42 +0100205 return 1;
206 } else {
Juan Castillof9f39c32015-06-01 16:34:23 +0100207 ERROR("Cannot load key from %s\n", key->fn);
208 *err_code = KEY_ERR_LOAD;
Juan Castillo11abdcd2014-10-21 11:30:42 +0100209 }
210 } else {
Juan Castillof9f39c32015-06-01 16:34:23 +0100211 WARN("Cannot open file %s\n", key->fn);
212 *err_code = KEY_ERR_OPEN;
Juan Castillo11abdcd2014-10-21 11:30:42 +0100213 }
214 } else {
Juan Castillof9f39c32015-06-01 16:34:23 +0100215 WARN("Key filename not specified\n");
216 *err_code = KEY_ERR_FILENAME;
Juan Castillo11abdcd2014-10-21 11:30:42 +0100217 }
218
Juan Castillo11abdcd2014-10-21 11:30:42 +0100219 return 0;
220}
221
222int key_store(key_t *key)
223{
Masahiro Yamada48cb5e52017-02-06 19:47:44 +0900224 FILE *fp;
Juan Castillo11abdcd2014-10-21 11:30:42 +0100225
226 if (key->fn) {
227 fp = fopen(key->fn, "w");
228 if (fp) {
229 PEM_write_PrivateKey(fp, key->key,
230 NULL, NULL, 0, NULL, NULL);
231 fclose(fp);
232 return 1;
233 } else {
234 ERROR("Cannot create file %s\n", key->fn);
235 }
236 } else {
237 ERROR("Key filename not specified\n");
238 }
239
240 return 0;
241}
Juan Castillo1218dd52015-07-03 16:23:16 +0100242
243int key_init(void)
244{
Juan Castillo212f7382015-12-15 16:37:57 +0000245 cmd_opt_t cmd_opt;
Juan Castillo1218dd52015-07-03 16:23:16 +0100246 key_t *key;
Juan Castillo1218dd52015-07-03 16:23:16 +0100247 unsigned int i;
248
Pankaj Guptadd906e62020-12-09 14:02:38 +0530249 keys = malloc((num_def_keys * sizeof(def_keys[0]))
250#ifdef PDEF_KEYS
251 + (num_pdef_keys * sizeof(pdef_keys[0]))
252#endif
253 );
254
255 if (keys == NULL) {
256 ERROR("%s:%d Failed to allocate memory.\n", __func__, __LINE__);
257 return 1;
258 }
259
260 memcpy(&keys[0], &def_keys[0], (num_def_keys * sizeof(def_keys[0])));
261#ifdef PDEF_KEYS
262 memcpy(&keys[num_def_keys], &pdef_keys[0],
263 (num_pdef_keys * sizeof(pdef_keys[0])));
264
265 num_keys = num_def_keys + num_pdef_keys;
266#else
267 num_keys = num_def_keys;
268#endif
269 ;
270
Juan Castillo1218dd52015-07-03 16:23:16 +0100271 for (i = 0; i < num_keys; i++) {
272 key = &keys[i];
273 if (key->opt != NULL) {
Juan Castillo212f7382015-12-15 16:37:57 +0000274 cmd_opt.long_opt.name = key->opt;
275 cmd_opt.long_opt.has_arg = required_argument;
276 cmd_opt.long_opt.flag = NULL;
277 cmd_opt.long_opt.val = CMD_OPT_KEY;
278 cmd_opt.help_msg = key->help_msg;
279 cmd_opt_add(&cmd_opt);
Juan Castillo1218dd52015-07-03 16:23:16 +0100280 }
281 }
282
Masahiro Yamada48cb5e52017-02-06 19:47:44 +0900283 return 0;
Juan Castillo1218dd52015-07-03 16:23:16 +0100284}
285
286key_t *key_get_by_opt(const char *opt)
287{
Masahiro Yamada48cb5e52017-02-06 19:47:44 +0900288 key_t *key;
Juan Castillo1218dd52015-07-03 16:23:16 +0100289 unsigned int i;
290
291 /* Sequential search. This is not a performance concern since the number
292 * of keys is bounded and the code runs on a host machine */
293 for (i = 0; i < num_keys; i++) {
294 key = &keys[i];
295 if (0 == strcmp(key->opt, opt)) {
296 return key;
297 }
298 }
299
300 return NULL;
301}
Juan Pablo Conde3539c742022-10-25 19:41:02 -0400302
303void key_cleanup(void)
304{
305 unsigned int i;
306
307 for (i = 0; i < num_keys; i++) {
308 EVP_PKEY_free(keys[i].key);
309 if (keys[i].fn != NULL) {
310 void *ptr = keys[i].fn;
311
312 free(ptr);
313 keys[i].fn = NULL;
314 }
315 }
316 free(keys);
317}
318