1  /*
  2   * Copyright (c) 2003-2004,2011-2014 Apple Inc. All Rights Reserved.
  3   * 
  4   * @APPLE_LICENSE_HEADER_START@
  5   * 
  6   * This file contains Original Code and/or Modifications of Original Code
  7   * as defined in and that are subject to the Apple Public Source License
  8   * Version 2.0 (the 'License'). You may not use this file except in
  9   * compliance with the License. Please obtain a copy of the License at
 10   * http://www.opensource.apple.com/apsl/ and read it before using this
 11   * file.
 12   * 
 13   * The Original Code and all software distributed under the License are
 14   * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
 15   * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
 16   * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
 17   * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
 18   * Please see the License for the specific language governing rights and
 19   * limitations under the License.
 20   * 
 21   * @APPLE_LICENSE_HEADER_END@
 22   */
 23  
 24  /*
 25   * pkcs12Encode.h - P12Coder encoding engine.
 26   * 
 27   * Unlike the decoding side of P12Coder, which can parse PFXs with
 28   * more or less arbitrary structures, this encoding engine has 
 29   * a specific layout for what bags go where in the jungle of 
 30   * SafeContents and ContentInfos. It would be impractical to allow
 31   * (or to expect) the app to specify this structure. 
 32   *
 33   * The knowledge of how a PFX is built out of various components
 34   * is encapsulated in the authSafeBuild() member function. The rest
 35   * of the functions in this file are pretty much "PFX-structure-
 36   * agnostic", so if one wanted to change the overall PFX structure,
 37   * one would only have to focus on the authSafeBuild() function. 
 38   */
 39  
 40  #include "pkcs12Coder.h"
 41  #include "pkcs12Debug.h"
 42  #include "pkcs12Crypto.h"
 43  #include "pkcs12Templates.h"
 44  #include "pkcs12Utils.h"
 45  #include <Security/cssmerr.h>
 46  #include <Security/oidsattr.h>
 47  #include <Security/SecBase.h>
 48  
 49  void P12Coder::encode(
 50  	CFDataRef				*cpfx)		// RETURNED
 51  {
 52  	p12EncodeLog("encode top");
 53  	SecNssCoder localCdr;
 54  	NSS_P12_DecodedPFX pfx;
 55  	
 56  	memset(&pfx, 0, sizeof(pfx));
 57  	p12IntToData(3, pfx.version, localCdr);
 58  	authSafeBuild(pfx.authSafe, localCdr);
 59  	macSignPfx(pfx, localCdr);
 60  	CSSM_DATA derPfx = {0, NULL};
 61  	if(localCdr.encodeItem(&pfx, NSS_P12_DecodedPFXTemplate, derPfx)) {
 62  		p12ErrorLog("Error encoding top-level pfx\n");
 63  		P12_THROW_ENCODE;
 64  	}
 65  	CFDataRef cp = CFDataCreate(NULL, derPfx.Data, derPfx.Length);
 66  	*cpfx = cp;
 67  }
 68  
 69  void P12Coder::macSignPfx(
 70  	NSS_P12_DecodedPFX &pfx,
 71  	SecNssCoder &localCdr)
 72  {
 73  	p12EncodeLog("macSignPfx");
 74  	NSS_P12_MacData *macData = localCdr.mallocn<NSS_P12_MacData>();
 75  	pfx.macData = macData;
 76  	p12GenSalt(macData->macSalt, localCdr);
 77  	p12IntToData(mMacIterCount, macData->iterations, localCdr);
 78  	NSS_P7_DigestInfo &digInfo = macData->mac;
 79  	
 80  	/* this is not negotiable; it's the only one P12 allows */
 81  	localCdr.allocCopyItem(CSSMOID_SHA1, digInfo.digestAlgorithm.algorithm);
 82  	/* null algorithm parameters */
 83  	p12NullAlgParams(digInfo.digestAlgorithm);
 84  	
 85  	const CSSM_DATA *macPhrase = getMacPassPhrase();
 86  	const CSSM_KEY *macPassKey = getMacPassKey();
 87  	if((macPhrase == NULL) && (macPassKey == NULL)) {
 88  		p12ErrorLog("no passphrase set\n");
 89  		CssmError::throwMe(CSSMERR_CSP_MISSING_ATTR_PASSPHRASE);
 90  	}
 91  	
 92  	CSSM_RETURN crtn = p12GenMac(mCspHand, 
 93  		*pfx.authSafe.content.data, 
 94  		CSSM_ALGID_SHA1, mMacIterCount, macData->macSalt, 
 95  		macPhrase, macPassKey, localCdr, digInfo.digest);
 96  	if(crtn) {
 97  		p12ErrorLog("Error generating PFX MAC\n");
 98  		CssmError::throwMe(crtn);
 99  	}
100  }
101  
102  /*
103   * This is the heart of the encoding engine. All knowledge of 
104   * "what bags go where" is here. The PFX structure implemented here
105   * is derived from empirical observation of PFXs obtained from
106   * Mozilla 1.2b and from the DoD test vectors for "Conformance 
107   * Testing of Relying Party Client Certificate Path Processing 
108   * Logic", written by Cygnacom, Septemtber 28, 2001. 
109   *
110   * The PFX structure is as follows:
111   *
112   * -- One AuthenticatedSafe element (a PKCS7 ContentInfo) containing
113   *    all certificates and CRLs. 
114   *
115   *    ContentInfo.type = CT_EncryptedData
116   *    Encryption algorithm is our "weak" encryption Alg, default 
117   *        of CSSMOID_PKCS12_pbeWithSHAAnd40BitRC4.
118   *
119   * -- One AuthenticatedSafe element containing all private keys in
120   *    the form of ShroudedKeyBags.
121   *
122   *    ContentInfo.type = CT_Data
123   *    Encryption algorithm for shrouded key bags is our "strong"
124   *        encryption, default CSSMOID_PKCS12_pbeWithSHAAnd3Key3DESCBC
125   *
126   * -- Everything else goes in another AuthenticatedSafe element.
127   *
128   *    ContentInfo.type = CT_EncryptedData
129   *    Encryption algorithm is our "strong" encryption Alg
130   */
131  void P12Coder::authSafeBuild(
132  	NSS_P7_DecodedContentInfo &authSafe,
133  	SecNssCoder &localCdr)
134  {
135  	p12EncodeLog("authSafeBuild top");
136  
137  	/* how many contentInfos are we going to build? */
138  	unsigned numContents = 0;
139  	if(mCerts.size() || mCrls.size()) {
140  		numContents++;
141  	}
142  	if(mKeys.size()) {
143  		numContents++;
144  	}
145  	if(mOpaques.size()) {
146  		numContents++;
147  	}
148  
149  	if(numContents == 0) {
150  		p12ErrorLog("authSafeBuild: no contents\n");
151  		MacOSError::throwMe(errSecParam);
152  	}
153  	
154  	NSS_P7_DecodedContentInfo **contents = 
155  		(NSS_P7_DecodedContentInfo **)p12NssNullArray(numContents, 
156  			localCdr);
157  	unsigned contentDex = 0;
158  	
159  	NSS_P12_SafeBag **safeBags;
160  
161  	/* certs & crls */
162  	unsigned numBags = (unsigned)(mCerts.size() + mCrls.size());
163  	p12EncodeLog("authSafeBuild : %u certs + CRLS", numBags);
164  	if(numBags) {
165  		safeBags = (NSS_P12_SafeBag **)p12NssNullArray(numBags, localCdr);
166  		unsigned bagDex = 0;
167  		for(unsigned dex=0; dex<mCerts.size(); dex++) {
168  			safeBags[bagDex++] = certBagBuild(mCerts[dex], localCdr);
169  		} 
170  		for(unsigned dex=0; dex<mCrls.size(); dex++) {
171  			safeBags[bagDex++] = crlBagBuild(mCrls[dex], localCdr);
172  		} 
173  		contents[contentDex++] = safeContentsBuild(safeBags, 
174  			CT_EncryptedData, &mWeakEncrAlg, mWeakEncrIterCount, localCdr);
175  	}
176  	
177  	/* shrouded keys - encrypted at bag level */
178  	numBags = (unsigned)mKeys.size();
179  	if(numBags) {
180  		p12EncodeLog("authSafeBuild : %u keys", numBags);
181  		safeBags = (NSS_P12_SafeBag **)p12NssNullArray(numBags, localCdr);
182  		unsigned bagDex = 0;
183  		for(unsigned dex=0; dex<numBags; dex++) {
184  			safeBags[bagDex++] = keyBagBuild(mKeys[dex], localCdr);
185  		} 
186  		contents[contentDex++] = safeContentsBuild(safeBags, 
187  			CT_Data, NULL, 0, localCdr);
188  	}
189  	
190  	/* opaque */
191  	numBags = (unsigned)mOpaques.size();
192  	if(numBags) {
193  		p12EncodeLog("authSafeBuild : %u opaques", numBags);
194  		safeBags = (NSS_P12_SafeBag **)p12NssNullArray(numBags, localCdr);
195  		unsigned bagDex = 0;
196  		for(unsigned dex=0; dex<numBags; dex++) {
197  			safeBags[bagDex++] = opaqueBagBuild(mOpaques[dex], localCdr);
198  		} 
199  		contents[contentDex++] = safeContentsBuild(safeBags, 
200  			CT_EncryptedData, &mStrongEncrAlg, mStrongEncrIterCount, localCdr);
201  	}
202  	
203  	/*
204  	 * Encode the whole elements array into authSafe.content.data
205  	 */
206  	NSS_P12_AuthenticatedSafe safe;
207  	safe.info = contents;
208  	CSSM_DATA *adata = localCdr.mallocn<CSSM_DATA>();
209  	authSafe.content.data = adata;
210  	adata->Data = NULL;
211  	adata->Length = 0;
212  	if(localCdr.encodeItem(&safe, NSS_P12_AuthenticatedSafeTemplate,
213  			*adata)) {
214  		p12ErrorLog("authSafeBuild: error encoding auth safe\n");
215  		P12_THROW_ENCODE;
216  	}
217  	authSafe.type = CT_Data;
218  	authSafe.contentType = CSSMOID_PKCS7_Data;
219  }
220  
221  /*
222   * Build a AuthSafe element of specified type out of the 
223   * specified array of bags.
224   */
225  NSS_P7_DecodedContentInfo *P12Coder::safeContentsBuild(
226  	NSS_P12_SafeBag **bags,
227  	NSS_P7_CI_Type type,	// CT_Data, CT_EncryptedData
228  	CSSM_OID *encrOid,		// only for CT_EncryptedData
229  	unsigned iterCount,		// ditto
230  	SecNssCoder &localCdr)
231  {
232  	p12EncodeLog("safeContentsBuild type %u", (unsigned)type);
233  
234  	/*
235  	 * First, encode the bag array as a SafeContents
236  	 */
237  	CSSM_DATA encSafeContents = {0, NULL};
238  	NSS_P12_SafeContents safeContents = {bags};
239  	if(localCdr.encodeItem(&safeContents,
240  			NSS_P12_SafeContentsTemplate, encSafeContents)) {
241  		p12ErrorLog("error encoding SafeContents\n");
242  		P12_THROW_ENCODE;
243  	}
244  	
245  	NSS_P7_DecodedContentInfo *dci = 
246  		localCdr.mallocn<NSS_P7_DecodedContentInfo>();
247  	dci->type = type;
248  	if(type == CT_Data) {
249  		/* plaintext gets encoded as an octet string */
250  		localCdr.allocCopyItem(CSSMOID_PKCS7_Data, dci->contentType);
251  		dci->content.data = localCdr.mallocn<CSSM_DATA>();
252  		localCdr.allocCopyItem(encSafeContents, *dci->content.data);
253  	}
254  	else if(type == CT_EncryptedData) {
255  		/* encrypt the encoded SafeContents */
256  		localCdr.allocCopyItem(CSSMOID_PKCS7_EncryptedData, 
257  			dci->contentType);
258  		dci->content.encryptData = localCdr.mallocn<NSS_P7_EncryptedData>();
259  		NSS_P7_EncryptedData *ed = dci->content.encryptData;
260  		assert(encrOid != NULL);
261  		encryptData(encSafeContents, *encrOid, iterCount, *ed, localCdr);
262  	}
263  	else {
264  		p12ErrorLog("bad type in safeContentsBuild\n");
265  		CssmError::throwMe(CSSMERR_CL_INTERNAL_ERROR);
266  	}
267  	return dci;
268  }
269  
270  /*
271   * Encrypt the specified plaintext with specified algorithm.
272   * Drop result and other interesting info into an NSS_P7_EncryptedData.
273   */
274  void P12Coder::encryptData(
275  	const CSSM_DATA			&ptext,
276  	CSSM_OID 				&encrOid,
277  	unsigned 				iterCount,
278  	NSS_P7_EncryptedData	&ed,
279  	SecNssCoder				&localCdr)
280  {
281  	p12EncodeLog("encryptData");
282  
283  	/* do the raw encrypt first to make sure we can do it... */
284  	CSSM_ALGORITHMS		keyAlg;			// e.g., CSSM_ALGID_DES
285  	CSSM_ALGORITHMS		encrAlg;		// e.g., CSSM_ALGID_3DES_3KEY_EDE
286  	CSSM_ALGORITHMS		pbeHashAlg;		// SHA1 or MD5
287  	uint32				keySizeInBits;
288  	uint32				blockSizeInBytes;	// for IV, optional
289  	CSSM_PADDING		padding;		// CSSM_PADDING_PKCS7, etc.
290  	CSSM_ENCRYPT_MODE	mode;			// CSSM_ALGMODE_CBCPadIV8, etc.
291  	PKCS_Which			pkcs;
292  	
293  	bool found = pkcsOidToParams(&encrOid,
294  		keyAlg, encrAlg, pbeHashAlg, keySizeInBits, blockSizeInBytes,
295  		padding, mode, pkcs);
296  	if(!found || (pkcs != PW_PKCS12)) {
297  		p12ErrorLog("encryptData encrAlg not understood\n");
298  		CssmError::throwMe(CSSMERR_CSP_INVALID_ALGORITHM);
299  	}
300  	
301  	/* Salt: we generate random bytes */
302  	CSSM_DATA salt;
303  	p12GenSalt(salt, localCdr);
304  
305  	const CSSM_DATA *pwd = getEncrPassPhrase();
306  	const CSSM_KEY *passKey = getEncrPassKey();
307  	if((pwd == NULL) && (passKey == NULL)) {
308  		p12ErrorLog("no passphrase set\n");
309  		CssmError::throwMe(CSSMERR_CSP_MISSING_ATTR_PASSPHRASE);
310  	}
311  	CSSM_DATA ctext = {0, NULL};
312  	
313  	CSSM_RETURN crtn = p12Encrypt(mCspHand, ptext, 
314  		keyAlg, encrAlg, pbeHashAlg,
315  		keySizeInBits, blockSizeInBytes,
316  		padding, mode,
317  		iterCount, salt,
318  		pwd, passKey, localCdr,
319  		ctext);
320  	if(crtn) {
321  		CssmError::throwMe(crtn);
322  	}
323  	
324  	/* Now fill in the NSS_P7_EncryptedData */
325  	p12IntToData(0, ed.version, localCdr);
326  	NSS_P7_EncrContentInfo &eci = ed.contentInfo;
327  	localCdr.allocCopyItem(CSSMOID_PKCS7_Data, eci.contentType);
328  	algIdBuild(eci.encrAlg, encrOid, salt, iterCount, localCdr);
329  	eci.encrContent = ctext;
330  }
331  
332  /* 
333   * Fill in an CSSM_X509_ALGORITHM_IDENTIFIER with parameters in
334   * the form of an encoded NSS_P12_PBE_Params
335   */
336  void P12Coder::algIdBuild(
337  	CSSM_X509_ALGORITHM_IDENTIFIER	&algId,
338  	const CSSM_OID &algOid,
339  	const CSSM_DATA &salt,
340  	unsigned iterCount,
341  	SecNssCoder &localCdr)
342  {
343  	p12EncodeLog("algIdBuild");
344  	localCdr.allocCopyItem(algOid, algId.algorithm);
345  	NSS_P12_PBE_Params pbeParams;
346  	pbeParams.salt = salt;
347  	p12IntToData(iterCount, pbeParams.iterations, localCdr);
348  	if(localCdr.encodeItem(&pbeParams, NSS_P12_PBE_ParamsTemplate,
349  			algId.parameters)) {
350  		p12ErrorLog("error encoding NSS_P12_PBE_Params\n");
351  		P12_THROW_ENCODE;
352  	}
353  }
354  
355  #pragma mark --- Individual Bag Builders ---
356  
357  NSS_P12_SafeBag *P12Coder::certBagBuild(
358  	P12CertBag *cert,
359  	SecNssCoder &localCdr)
360  {
361  	p12EncodeLog("certBagBuild");
362  
363  	NSS_P12_SafeBag *safeBag = localCdr.mallocn<NSS_P12_SafeBag>();
364  	safeBag->bagId = CSSMOID_PKCS12_certBag;
365  	safeBag->type = BT_CertBag;
366  	
367  	NSS_P12_CertBag *certBag = localCdr.mallocn<NSS_P12_CertBag>();
368  	safeBag->bagValue.certBag = certBag;
369  	const CSSM_OID *certTypeOid = NULL;
370  	switch(cert->certType()) {
371  		case CT_X509:
372  			certTypeOid = &CSSMOID_PKCS9_X509Certificate;
373  			break;
374  		case CT_SDSI:
375  			certTypeOid = &CSSMOID_PKCS9_SdsiCertificate;
376  			break;
377  		default:
378  			p12ErrorLog("unknown certType on encode\n");
379  			CssmError::throwMe(CSSMERR_CSP_INTERNAL_ERROR);
380  			
381  	}
382  	
383  	/* copies not needed, same scope as P12CertBag */
384  	certBag->bagType = *certTypeOid;
385  	certBag->type = cert->certType();
386  	certBag->certValue = cert->certData();
387  	safeBag->bagAttrs = cert->getAllAttrs();
388  	return safeBag;
389  }
390  
391  NSS_P12_SafeBag *P12Coder::crlBagBuild(
392  	P12CrlBag *crl,
393  	SecNssCoder &localCdr)
394  {
395  	p12EncodeLog("crlBagBuild");
396  
397  	NSS_P12_SafeBag *safeBag = localCdr.mallocn<NSS_P12_SafeBag>();
398  	safeBag->bagId = CSSMOID_PKCS12_crlBag;
399  	safeBag->type = BT_CrlBag;
400  	
401  	NSS_P12_CrlBag *crlBag = localCdr.mallocn<NSS_P12_CrlBag>();
402  	safeBag->bagValue.crlBag = crlBag;
403  	const CSSM_OID *crlTypeOid = NULL;
404  	switch(crl->crlType()) {
405  		case CRT_X509:
406  			crlTypeOid = &CSSMOID_PKCS9_X509Crl;
407  			break;
408  		default:
409  			p12ErrorLog("unknown crlType on encode\n");
410  			CssmError::throwMe(CSSMERR_CSP_INTERNAL_ERROR);
411  			
412  	}
413  	
414  	/* copies not needed, same scope as P12CrlBag */
415  	crlBag->bagType = *crlTypeOid;
416  	crlBag->type = crl->crlType();
417  	crlBag->crlValue = crl->crlData();
418  	safeBag->bagAttrs = crl->getAllAttrs();
419  	return safeBag;
420  }
421  
422  NSS_P12_SafeBag *P12Coder::keyBagBuild(
423  	P12KeyBag *key,
424  	SecNssCoder &localCdr)
425  {
426  	p12EncodeLog("keyBagBuild");
427  
428  	NSS_P12_SafeBag *safeBag = localCdr.mallocn<NSS_P12_SafeBag>();
429  	safeBag->bagId = CSSMOID_PKCS12_shroudedKeyBag;
430  	safeBag->type = BT_ShroudedKeyBag;
431  	
432  	NSS_EncryptedPrivateKeyInfo *keyInfo = localCdr.
433  		mallocn<NSS_EncryptedPrivateKeyInfo>();
434  	safeBag->bagValue.shroudedKeyBag = keyInfo;
435  	safeBag->bagAttrs = key->getAllAttrs();
436  
437  	/* Prepare for key wrap */
438  	CSSM_DATA salt;
439  	p12GenSalt(salt, localCdr);
440  	algIdBuild(keyInfo->algorithm, mStrongEncrAlg, salt, 
441  		mStrongEncrIterCount, localCdr);
442  	
443  	CSSM_ALGORITHMS		keyAlg;			// e.g., CSSM_ALGID_DES
444  	CSSM_ALGORITHMS		encrAlg;		// e.g., CSSM_ALGID_3DES_3KEY_EDE
445  	CSSM_ALGORITHMS		pbeHashAlg;		// SHA1 or MD5
446  	uint32				keySizeInBits;
447  	uint32				blockSizeInBytes;	// for IV, optional
448  	CSSM_PADDING		padding;		// CSSM_PADDING_PKCS7, etc.
449  	CSSM_ENCRYPT_MODE	mode;			// CSSM_ALGMODE_CBCPadIV8, etc.
450  	PKCS_Which			pkcs;
451  	
452  	bool found = pkcsOidToParams(&mStrongEncrAlg,
453  		keyAlg, encrAlg, pbeHashAlg, keySizeInBits, blockSizeInBytes,
454  		padding, mode, pkcs);
455  	if(!found || (pkcs != PW_PKCS12)) {
456  		/* app config error - they gave us bogus algorithm */
457  		p12ErrorLog("keyBagBuild encrAlg not understood\n");
458  		CssmError::throwMe(CSSMERR_CSP_INVALID_ALGORITHM);
459  	}
460  	const CSSM_DATA *encrPhrase = getEncrPassPhrase();
461  	const CSSM_KEY *passKey = getEncrPassKey();
462  	if((encrPhrase == NULL) && (passKey == NULL)) {
463  		p12ErrorLog("no passphrase set\n");
464  		CssmError::throwMe(CSSMERR_CSP_MISSING_ATTR_PASSPHRASE);
465  	}
466  	CSSM_DATA shroudedBits = {0, NULL};
467  	
468  	CSSM_RETURN crtn = p12WrapKey(mCspHand,
469  		key->key(), key->privKeyCreds(),
470  		keyAlg, encrAlg, pbeHashAlg,
471  		keySizeInBits, blockSizeInBytes,
472  		padding, mode,
473  		mStrongEncrIterCount, salt,
474  		encrPhrase,
475  		passKey,
476  		localCdr, 
477  		shroudedBits);
478  	if(crtn) {
479  		p12ErrorLog("Error wrapping private key\n");
480  		CssmError::throwMe(crtn);
481  	}
482  	
483  	keyInfo->encryptedData = shroudedBits;
484  	return safeBag;
485  }
486  
487  NSS_P12_SafeBag *P12Coder::opaqueBagBuild(
488  	P12OpaqueBag *opaque,
489  	SecNssCoder &localCdr)
490  {
491  	p12EncodeLog("opaqueBagBuild");
492  	NSS_P12_SafeBag *safeBag = localCdr.mallocn<NSS_P12_SafeBag>();
493  	safeBag->bagId = opaque->oid();
494  	safeBag->bagValue.secretBag = &opaque->blob();
495  	safeBag->bagAttrs = opaque->getAllAttrs();
496  	return safeBag;
497  }