feedc0de/wolfssl
1
0
Fork 0
forked from wolfSSL/wolfssl
Code Pull Requests Activity

Merge pull request #6964 from lealem47/zd16470

Browse Source 
Parse explicit parameters in StoreEccKey()
This commit is contained in:
JacobBarthelmeh
2023-11-16 15:59:21 -07:00
committed by GitHub
parent 6945093221 04ea4da6fd
commit 957a0ce300
3 changed files with 65 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/ssl.c
View File

@ -7629,8 +7629,16 @@ int ProcessBuffer(WOLFSSL_CTX* ctx, const unsigned char* buff,
keyType = ecc_dsa_sa_algo; keyType = ecc_dsa_sa_algo;
#endif #endif
/* Determine ECC key size based on curve */ /* Determine ECC key size based on curve */
#ifdef WOLFSSL_CUSTOM_CURVES
if (cert->pkCurveOID == 0 && cert->pkCurveSize != 0) {
keySz = cert->pkCurveSize * 8;
}
else
#endif
{
keySz = wc_ecc_get_curve_size_from_id( keySz = wc_ecc_get_curve_size_from_id(
wc_ecc_get_oid(cert->pkCurveOID, NULL, NULL)); wc_ecc_get_oid(cert->pkCurveOID, NULL, NULL));
}
if (ssl && !ssl->options.verifyNone) { if (ssl && !ssl->options.verifyNone) {
if (ssl->options.minEccKeySz < 0 || if (ssl->options.minEccKeySz < 0 ||

58
wolfcrypt/src/asn.c
View File

@ -12027,6 +12027,11 @@ enum {
/* Number of items in ASN.1 template for header before ECC key in cert. */ /* Number of items in ASN.1 template for header before ECC key in cert. */
#define eccCertKeyASN_Length (sizeof(eccCertKeyASN) / sizeof(ASNItem)) #define eccCertKeyASN_Length (sizeof(eccCertKeyASN) / sizeof(ASNItem))
#ifdef WOLFSSL_CUSTOM_CURVES
static int EccSpecifiedECDomainDecode(const byte* input, word32 inSz,
ecc_key* key, void* heap, int* curveSz);
#endif /* WOLFSSL_CUSTOM_CURVES */
#endif /* WOLFSSL_ASN_TEMPLATE */ #endif /* WOLFSSL_ASN_TEMPLATE */
/* Store public ECC key in certificate object. /* Store public ECC key in certificate object.
@ -12140,7 +12145,18 @@ static int StoreEccKey(DecodedCert* cert, const byte* source, word32* srcIdx,
/* Store curve OID. */ /* Store curve OID. */
cert->pkCurveOID = dataASN[ECCCERTKEYASN_IDX_OID].data.oid.sum; cert->pkCurveOID = dataASN[ECCCERTKEYASN_IDX_OID].data.oid.sum;
} }
/* Ignore explicit parameters. */ else {
#ifdef WOLFSSL_CUSTOM_CURVES
/* Parse explicit parameters. */
ret = EccSpecifiedECDomainDecode(
dataASN[ECCCERTKEYASN_IDX_PARAMS].data.ref.data,
dataASN[ECCCERTKEYASN_IDX_PARAMS].data.ref.length, NULL,
NULL, &cert->pkCurveSize);
#else
/* Explicit parameters not supported in build configuration. */
ret = ASN_PARSE_E;
#endif
}
#ifdef WOLFSSL_MAXQ10XX_TLS #ifdef WOLFSSL_MAXQ10XX_TLS
cert->publicKeyIndex = cert->publicKeyIndex =
@ -12149,11 +12165,14 @@ static int StoreEccKey(DecodedCert* cert, const byte* source, word32* srcIdx,
#endif #endif
#ifdef HAVE_OCSP #ifdef HAVE_OCSP
if (ret == 0) {
/* Calculate the hash of the subject public key for OCSP. */ /* Calculate the hash of the subject public key for OCSP. */
ret = CalcHashId_ex(dataASN[ECCCERTKEYASN_IDX_SUBJPUBKEY].data.ref.data, ret = CalcHashId_ex(
dataASN[ECCCERTKEYASN_IDX_SUBJPUBKEY].data.ref.data,
dataASN[ECCCERTKEYASN_IDX_SUBJPUBKEY].data.ref.length, dataASN[ECCCERTKEYASN_IDX_SUBJPUBKEY].data.ref.length,
cert->subjectKeyHash, HashIdAlg(cert->signatureOID)); cert->subjectKeyHash, HashIdAlg(cert->signatureOID));
} }
}
if (ret == 0) { if (ret == 0) {
#endif #endif
/* Store public key data length. */ /* Store public key data length. */
@ -32271,7 +32290,7 @@ static const char ecSetCustomName[] = "Custom";
/* Explicit EC parameter values. */ /* Explicit EC parameter values. */
static int EccSpecifiedECDomainDecode(const byte* input, word32 inSz, static int EccSpecifiedECDomainDecode(const byte* input, word32 inSz,
ecc_key* key) ecc_key* key, void* heap, int* curveSz)
{ {
DECL_ASNGETDATA(dataASN, eccSpecifiedASN_Length); DECL_ASNGETDATA(dataASN, eccSpecifiedASN_Length);
int ret = 0; int ret = 0;
@ -32283,7 +32302,7 @@ static int EccSpecifiedECDomainDecode(const byte* input, word32 inSz,
word32 baseLen; word32 baseLen;
/* Allocate a new parameter set. */ /* Allocate a new parameter set. */
curve = (ecc_set_type*)XMALLOC(sizeof(*curve), key->heap, curve = (ecc_set_type*)XMALLOC(sizeof(*curve), heap,
DYNAMIC_TYPE_ECC_BUFFER); DYNAMIC_TYPE_ECC_BUFFER);
if (curve == NULL) { if (curve == NULL) {
ret = MEMORY_E; ret = MEMORY_E;
@ -32293,7 +32312,7 @@ static int EccSpecifiedECDomainDecode(const byte* input, word32 inSz,
XMEMSET(curve, 0, sizeof(*curve)); XMEMSET(curve, 0, sizeof(*curve));
} }
CALLOC_ASNGETDATA(dataASN, eccSpecifiedASN_Length, ret, key->heap); CALLOC_ASNGETDATA(dataASN, eccSpecifiedASN_Length, ret, heap);
if (ret == 0) { if (ret == 0) {
/* Set name to be: "Custom" */ /* Set name to be: "Custom" */
@ -32356,13 +32375,13 @@ static int EccSpecifiedECDomainDecode(const byte* input, word32 inSz,
if (ret == 0) { if (ret == 0) {
/* Base X-ordinate */ /* Base X-ordinate */
ret = DataToHexStringAlloc(base + 1, (word32)curve->size, ret = DataToHexStringAlloc(base + 1, (word32)curve->size,
(char**)&curve->Gx, key->heap, (char**)&curve->Gx, heap,
DYNAMIC_TYPE_ECC_BUFFER); DYNAMIC_TYPE_ECC_BUFFER);
} }
if (ret == 0) { if (ret == 0) {
/* Base Y-ordinate */ /* Base Y-ordinate */
ret = DataToHexStringAlloc(base + 1 + curve->size, (word32)curve->size, ret = DataToHexStringAlloc(base + 1 + curve->size, (word32)curve->size,
(char**)&curve->Gy, key->heap, (char**)&curve->Gy, heap,
DYNAMIC_TYPE_ECC_BUFFER); DYNAMIC_TYPE_ECC_BUFFER);
} }
if (ret == 0) { if (ret == 0) {
@ -32370,28 +32389,28 @@ static int EccSpecifiedECDomainDecode(const byte* input, word32 inSz,
ret = DataToHexStringAlloc( ret = DataToHexStringAlloc(
dataASN[ECCSPECIFIEDASN_IDX_PRIME_P].data.ref.data, dataASN[ECCSPECIFIEDASN_IDX_PRIME_P].data.ref.data,
dataASN[ECCSPECIFIEDASN_IDX_PRIME_P].data.ref.length, dataASN[ECCSPECIFIEDASN_IDX_PRIME_P].data.ref.length,
(char**)&curve->prime, key->heap, DYNAMIC_TYPE_ECC_BUFFER); (char**)&curve->prime, heap, DYNAMIC_TYPE_ECC_BUFFER);
} }
if (ret == 0) { if (ret == 0) {
/* Parameter A */ /* Parameter A */
ret = DataToHexStringAlloc( ret = DataToHexStringAlloc(
dataASN[ECCSPECIFIEDASN_IDX_PARAM_A].data.ref.data, dataASN[ECCSPECIFIEDASN_IDX_PARAM_A].data.ref.data,
dataASN[ECCSPECIFIEDASN_IDX_PARAM_A].data.ref.length, dataASN[ECCSPECIFIEDASN_IDX_PARAM_A].data.ref.length,
(char**)&curve->Af, key->heap, DYNAMIC_TYPE_ECC_BUFFER); (char**)&curve->Af, heap, DYNAMIC_TYPE_ECC_BUFFER);
} }
if (ret == 0) { if (ret == 0) {
/* Parameter B */ /* Parameter B */
ret = DataToHexStringAlloc( ret = DataToHexStringAlloc(
dataASN[ECCSPECIFIEDASN_IDX_PARAM_B].data.ref.data, dataASN[ECCSPECIFIEDASN_IDX_PARAM_B].data.ref.data,
dataASN[ECCSPECIFIEDASN_IDX_PARAM_B].data.ref.length, dataASN[ECCSPECIFIEDASN_IDX_PARAM_B].data.ref.length,
(char**)&curve->Bf, key->heap, DYNAMIC_TYPE_ECC_BUFFER); (char**)&curve->Bf, heap, DYNAMIC_TYPE_ECC_BUFFER);
} }
if (ret == 0) { if (ret == 0) {
/* Order of curve */ /* Order of curve */
ret = DataToHexStringAlloc( ret = DataToHexStringAlloc(
dataASN[ECCSPECIFIEDASN_IDX_ORDER].data.ref.data, dataASN[ECCSPECIFIEDASN_IDX_ORDER].data.ref.data,
dataASN[ECCSPECIFIEDASN_IDX_ORDER].data.ref.length, dataASN[ECCSPECIFIEDASN_IDX_ORDER].data.ref.length,
(char**)&curve->order, key->heap, DYNAMIC_TYPE_ECC_BUFFER); (char**)&curve->order, heap, DYNAMIC_TYPE_ECC_BUFFER);
} }
#else #else
if (ret == 0) { if (ret == 0) {
@ -32418,6 +32437,7 @@ static int EccSpecifiedECDomainDecode(const byte* input, word32 inSz,
} }
#endif /* WOLFSSL_ECC_CURVE_STATIC */ #endif /* WOLFSSL_ECC_CURVE_STATIC */
if (key) {
/* Store parameter set in key. */ /* Store parameter set in key. */
if ((ret == 0) && (wc_ecc_set_custom_curve(key, curve) < 0)) { if ((ret == 0) && (wc_ecc_set_custom_curve(key, curve) < 0)) {
ret = ASN_PARSE_E; ret = ASN_PARSE_E;
@ -32426,18 +32446,22 @@ static int EccSpecifiedECDomainDecode(const byte* input, word32 inSz,
/* The parameter set was allocated.. */ /* The parameter set was allocated.. */
key->deallocSet = 1; key->deallocSet = 1;
} }
}
if (curveSz) {
*curveSz = curve->size;
}
if ((ret != 0) && (curve != NULL)) { if ((ret != 0) && (curve != NULL)) {
/* Failed to set parameters so free parameter set. */ /* Failed to set parameters so free parameter set. */
wc_ecc_free_curve(curve, key->heap); wc_ecc_free_curve(curve, heap);
} }
FREE_ASNGETDATA(dataASN, key->heap); FREE_ASNGETDATA(dataASN, heap);
return ret; return ret;
} }
#endif /* WOLFSSL_CUSTOM_CURVES */ #endif /* WOLFSSL_CUSTOM_CURVES */
#endif /* WOLFSSL_ASN_TEMPLATE */ #endif /* WOLFSSL_ASN_TEMPLATE */
#ifdef HAVE_ECC #ifdef HAVE_ECC
#ifdef WOLFSSL_ASN_TEMPLATE #ifdef WOLFSSL_ASN_TEMPLATE
@ -32665,7 +32689,8 @@ int wc_EccPrivateKeyDecode(const byte* input, word32* inOutIdx, ecc_key* key,
/* Parse explicit parameters. */ /* Parse explicit parameters. */
ret = EccSpecifiedECDomainDecode( ret = EccSpecifiedECDomainDecode(
dataASN[ECCKEYASN_IDX_CURVEPARAMS].data.ref.data, dataASN[ECCKEYASN_IDX_CURVEPARAMS].data.ref.data,
dataASN[ECCKEYASN_IDX_CURVEPARAMS].data.ref.length, key); dataASN[ECCKEYASN_IDX_CURVEPARAMS].data.ref.length, key,
key->heap, NULL);
#else #else
/* Explicit parameters not supported in build configuration. */ /* Explicit parameters not supported in build configuration. */
ret = ASN_PARSE_E; ret = ASN_PARSE_E;
@ -33100,7 +33125,8 @@ int wc_EccPublicKeyDecode(const byte* input, word32* inOutIdx,
#ifdef WOLFSSL_CUSTOM_CURVES #ifdef WOLFSSL_CUSTOM_CURVES
/* Parse explicit parameters. */ /* Parse explicit parameters. */
ret = EccSpecifiedECDomainDecode(dataASN[specIdx].data.ref.data, ret = EccSpecifiedECDomainDecode(dataASN[specIdx].data.ref.data,
dataASN[specIdx].data.ref.length, key); dataASN[specIdx].data.ref.length, key,
key->heap, NULL);
#else #else
/* Explicit parameters not supported in build configuration. */ /* Explicit parameters not supported in build configuration. */
ret = ASN_PARSE_E; ret = ASN_PARSE_E;

3
wolfssl/wolfcrypt/asn.h
View File

@ -1717,6 +1717,9 @@ struct DecodedCert {
#if defined(HAVE_ECC) || defined(HAVE_ED25519) || defined(HAVE_ED448) #if defined(HAVE_ECC) || defined(HAVE_ED25519) || defined(HAVE_ED448)
word32 pkCurveOID; /* Public Key's curve OID */ word32 pkCurveOID; /* Public Key's curve OID */
#ifdef WOLFSSL_CUSTOM_CURVES
int pkCurveSize; /* Public Key's curve size */
#endif
#endif /* HAVE_ECC */ #endif /* HAVE_ECC */
const byte* beforeDate; const byte* beforeDate;
int beforeDateLen; int beforeDateLen;