Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 8fb03d8

Browse filesBrowse files
jasnelladuh95
jasnell
authored and
aduh95
committed
src: move more crypto to ncrypto
PR-URL: #56653 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
1 parent 38acdb5 commit 8fb03d8
Copy full SHA for 8fb03d8
Expand file treeCollapse file tree

25 files changed

+1989
-1134
lines changed
Open diff view settings
Collapse file

‎deps/ncrypto/ncrypto.cc‎

Copy file name to clipboardExpand all lines: deps/ncrypto/ncrypto.cc
+936-6Lines changed: 936 additions & 6 deletions
Large diffs are not rendered by default.
Collapse file

‎deps/ncrypto/ncrypto.h‎

Copy file name to clipboardExpand all lines: deps/ncrypto/ncrypto.h
+280-9Lines changed: 280 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -201,18 +201,28 @@ struct FunctionDeleter {
201201
template <typename T, void (*function)(T*)>
202202
using DeleteFnPtr = typename FunctionDeleter<T, function>::Pointer;
203203

204-
using BignumCtxPointer = DeleteFnPtr<BN_CTX, BN_CTX_free>;
205-
using BignumGenCallbackPointer = DeleteFnPtr<BN_GENCB, BN_GENCB_free>;
206-
using EVPKeyCtxPointer = DeleteFnPtr<EVP_PKEY_CTX, EVP_PKEY_CTX_free>;
207-
using EVPMDCtxPointer = DeleteFnPtr<EVP_MD_CTX, EVP_MD_CTX_free>;
208-
using HMACCtxPointer = DeleteFnPtr<HMAC_CTX, HMAC_CTX_free>;
209-
using NetscapeSPKIPointer = DeleteFnPtr<NETSCAPE_SPKI, NETSCAPE_SPKI_free>;
210204
using PKCS8Pointer = DeleteFnPtr<PKCS8_PRIV_KEY_INFO, PKCS8_PRIV_KEY_INFO_free>;
211205
using RSAPointer = DeleteFnPtr<RSA, RSA_free>;
212206
using SSLSessionPointer = DeleteFnPtr<SSL_SESSION, SSL_SESSION_free>;
213207

208+
class BIOPointer;
209+
class BignumPointer;
214210
class CipherCtxPointer;
211+
class DataPointer;
212+
class DHPointer;
215213
class ECKeyPointer;
214+
class EVPKeyPointer;
215+
class EVPMDCtxPointer;
216+
class SSLCtxPointer;
217+
class SSLPointer;
218+
class X509View;
219+
class X509Pointer;
220+
class ECDSASigPointer;
221+
class ECGroupPointer;
222+
class ECPointPointer;
223+
class ECKeyPointer;
224+
class Rsa;
225+
class Ec;
216226

217227
struct StackOfXASN1Deleter {
218228
void operator()(STACK_OF(ASN1_OBJECT) * p) const {
@@ -228,6 +238,9 @@ struct Buffer {
228238
size_t len = 0;
229239
};
230240

241+
DataPointer hashDigest(const Buffer<const unsigned char>& data,
242+
const EVP_MD* md);
243+
231244
class Cipher final {
232245
public:
233246
Cipher() = default;
@@ -258,15 +271,108 @@ class Cipher final {
258271
static const Cipher FromNid(int nid);
259272
static const Cipher FromCtx(const CipherCtxPointer& ctx);
260273

274+
struct CipherParams {
275+
int padding;
276+
const EVP_MD* digest;
277+
const Buffer<const void> label;
278+
};
279+
280+
static DataPointer encrypt(const EVPKeyPointer& key,
281+
const CipherParams& params,
282+
const Buffer<const void> in);
283+
static DataPointer decrypt(const EVPKeyPointer& key,
284+
const CipherParams& params,
285+
const Buffer<const void> in);
286+
287+
static DataPointer sign(const EVPKeyPointer& key,
288+
const CipherParams& params,
289+
const Buffer<const void> in);
290+
291+
static DataPointer recover(const EVPKeyPointer& key,
292+
const CipherParams& params,
293+
const Buffer<const void> in);
294+
261295
private:
262296
const EVP_CIPHER* cipher_ = nullptr;
263297
};
264298

299+
// ============================================================================
300+
// RSA
301+
302+
class Rsa final {
303+
public:
304+
Rsa();
305+
Rsa(OSSL3_CONST RSA* rsa);
306+
NCRYPTO_DISALLOW_COPY_AND_MOVE(Rsa)
307+
308+
inline operator bool() const { return rsa_ != nullptr; }
309+
inline operator OSSL3_CONST RSA*() const { return rsa_; }
310+
311+
struct PublicKey {
312+
const BIGNUM* n;
313+
const BIGNUM* e;
314+
const BIGNUM* d;
315+
};
316+
struct PrivateKey {
317+
const BIGNUM* p;
318+
const BIGNUM* q;
319+
const BIGNUM* dp;
320+
const BIGNUM* dq;
321+
const BIGNUM* qi;
322+
};
323+
struct PssParams {
324+
std::string_view digest = "sha1";
325+
std::optional<std::string_view> mgf1_digest = "sha1";
326+
int64_t salt_length = 20;
327+
};
328+
329+
const PublicKey getPublicKey() const;
330+
const PrivateKey getPrivateKey() const;
331+
const std::optional<PssParams> getPssParams() const;
332+
333+
bool setPublicKey(BignumPointer&& n, BignumPointer&& e);
334+
bool setPrivateKey(BignumPointer&& d,
335+
BignumPointer&& q,
336+
BignumPointer&& p,
337+
BignumPointer&& dp,
338+
BignumPointer&& dq,
339+
BignumPointer&& qi);
340+
341+
using CipherParams = Cipher::CipherParams;
342+
343+
static DataPointer encrypt(const EVPKeyPointer& key,
344+
const CipherParams& params,
345+
const Buffer<const void> in);
346+
static DataPointer decrypt(const EVPKeyPointer& key,
347+
const CipherParams& params,
348+
const Buffer<const void> in);
349+
350+
private:
351+
OSSL3_CONST RSA* rsa_;
352+
};
353+
354+
class Ec final {
355+
public:
356+
Ec();
357+
Ec(OSSL3_CONST EC_KEY* key);
358+
NCRYPTO_DISALLOW_COPY_AND_MOVE(Ec)
359+
360+
const EC_GROUP* getGroup() const;
361+
int getCurve() const;
362+
363+
inline operator bool() const { return ec_ != nullptr; }
364+
inline operator OSSL3_CONST EC_KEY*() const { return ec_; }
365+
366+
private:
367+
OSSL3_CONST EC_KEY* ec_ = nullptr;
368+
};
369+
265370
// A managed pointer to a buffer of data. When destroyed the underlying
266371
// buffer will be freed.
267372
class DataPointer final {
268373
public:
269374
static DataPointer Alloc(size_t len);
375+
static DataPointer Copy(const Buffer<const void>& buffer);
270376

271377
DataPointer() = default;
272378
explicit DataPointer(void* data, size_t len);
@@ -283,6 +389,11 @@ class DataPointer final {
283389
void reset(void* data = nullptr, size_t len = 0);
284390
void reset(const Buffer<void>& buffer);
285391

392+
// Sets the underlying data buffer to all zeros.
393+
void zero();
394+
395+
DataPointer resize(size_t len);
396+
286397
// Releases ownership of the underlying data buffer. It is the caller's
287398
// responsibility to ensure the buffer is appropriately freed.
288399
Buffer<void> release();
@@ -471,13 +582,83 @@ class CipherCtxPointer final {
471582
DeleteFnPtr<EVP_CIPHER_CTX, EVP_CIPHER_CTX_free> ctx_;
472583
};
473584

585+
class EVPKeyCtxPointer final {
586+
public:
587+
EVPKeyCtxPointer();
588+
explicit EVPKeyCtxPointer(EVP_PKEY_CTX* ctx);
589+
EVPKeyCtxPointer(EVPKeyCtxPointer&& other) noexcept;
590+
EVPKeyCtxPointer& operator=(EVPKeyCtxPointer&& other) noexcept;
591+
NCRYPTO_DISALLOW_COPY(EVPKeyCtxPointer)
592+
~EVPKeyCtxPointer();
593+
594+
inline bool operator==(std::nullptr_t) const noexcept {
595+
return ctx_ == nullptr;
596+
}
597+
inline operator bool() const { return ctx_ != nullptr; }
598+
inline EVP_PKEY_CTX* get() const { return ctx_.get(); }
599+
void reset(EVP_PKEY_CTX* ctx = nullptr);
600+
EVP_PKEY_CTX* release();
601+
602+
bool initForDerive(const EVPKeyPointer& peer);
603+
DataPointer derive() const;
604+
605+
bool initForParamgen();
606+
bool setDhParameters(int prime_size, uint32_t generator);
607+
bool setDsaParameters(uint32_t bits, std::optional<int> q_bits);
608+
bool setEcParameters(int curve, int encoding);
609+
610+
bool setRsaOaepMd(const EVP_MD* md);
611+
bool setRsaMgf1Md(const EVP_MD* md);
612+
bool setRsaPadding(int padding);
613+
bool setRsaKeygenPubExp(BignumPointer&& e);
614+
bool setRsaKeygenBits(int bits);
615+
bool setRsaPssKeygenMd(const EVP_MD* md);
616+
bool setRsaPssKeygenMgf1Md(const EVP_MD* md);
617+
bool setRsaPssSaltlen(int salt_len);
618+
bool setRsaImplicitRejection();
619+
bool setRsaOaepLabel(DataPointer&& data);
620+
621+
bool setSignatureMd(const EVPMDCtxPointer& md);
622+
623+
bool publicCheck() const;
624+
bool privateCheck() const;
625+
626+
bool verify(const Buffer<const unsigned char>& sig,
627+
const Buffer<const unsigned char>& data);
628+
DataPointer sign(const Buffer<const unsigned char>& data);
629+
bool signInto(const Buffer<const unsigned char>& data,
630+
Buffer<unsigned char>* sig);
631+
632+
static constexpr int kDefaultRsaExponent = 0x10001;
633+
634+
static bool setRsaPadding(EVP_PKEY_CTX* ctx,
635+
int padding,
636+
std::optional<int> salt_len = std::nullopt);
637+
638+
EVPKeyPointer paramgen() const;
639+
640+
bool initForEncrypt();
641+
bool initForDecrypt();
642+
bool initForKeygen();
643+
int initForVerify();
644+
int initForSign();
645+
646+
static EVPKeyCtxPointer New(const EVPKeyPointer& key);
647+
static EVPKeyCtxPointer NewFromID(int id);
648+
649+
private:
650+
DeleteFnPtr<EVP_PKEY_CTX, EVP_PKEY_CTX_free> ctx_;
651+
};
652+
474653
class EVPKeyPointer final {
475654
public:
476655
static EVPKeyPointer New();
477656
static EVPKeyPointer NewRawPublic(int id,
478657
const Buffer<const unsigned char>& data);
479658
static EVPKeyPointer NewRawPrivate(int id,
480659
const Buffer<const unsigned char>& data);
660+
static EVPKeyPointer NewDH(DHPointer&& dh);
661+
static EVPKeyPointer NewRSA(RSAPointer&& rsa);
481662

482663
enum class PKEncodingType {
483664
// RSAPublicKey / RSAPrivateKey according to PKCS#1.
@@ -578,6 +759,15 @@ class EVPKeyPointer final {
578759

579760
static bool IsRSAPrivateKey(const Buffer<const unsigned char>& buffer);
580761

762+
std::optional<uint32_t> getBytesOfRS() const;
763+
int getDefaultSignPadding() const;
764+
operator Rsa() const;
765+
766+
bool isRsaVariant() const;
767+
bool isOneShotVariant() const;
768+
bool isSigVariant() const;
769+
bool validateDsaParameters() const;
770+
581771
private:
582772
DeleteFnPtr<EVP_PKEY, EVP_PKEY_free> pkey_;
583773
};
@@ -663,9 +853,6 @@ struct StackOfX509Deleter {
663853
};
664854
using StackOfX509 = std::unique_ptr<STACK_OF(X509), StackOfX509Deleter>;
665855

666-
class X509Pointer;
667-
class X509View;
668-
669856
class SSLCtxPointer final {
670857
public:
671858
SSLCtxPointer() = default;
@@ -792,6 +979,14 @@ class X509View final {
792979
CheckMatch checkEmail(const std::string_view email, int flags) const;
793980
CheckMatch checkIp(const std::string_view ip, int flags) const;
794981

982+
using UsageCallback = std::function<void(std::string_view)>;
983+
bool enumUsages(UsageCallback callback) const;
984+
985+
template <typename T>
986+
using KeyCallback = std::function<bool(const T& t)>;
987+
bool ifRsa(KeyCallback<Rsa> callback) const;
988+
bool ifEc(KeyCallback<Ec> callback) const;
989+
795990
private:
796991
const X509* cert_ = nullptr;
797992
};
@@ -948,6 +1143,77 @@ class ECKeyPointer final {
9481143
DeleteFnPtr<EC_KEY, EC_KEY_free> key_;
9491144
};
9501145

1146+
class EVPMDCtxPointer final {
1147+
public:
1148+
EVPMDCtxPointer();
1149+
explicit EVPMDCtxPointer(EVP_MD_CTX* ctx);
1150+
EVPMDCtxPointer(EVPMDCtxPointer&& other) noexcept;
1151+
EVPMDCtxPointer& operator=(EVPMDCtxPointer&& other) noexcept;
1152+
NCRYPTO_DISALLOW_COPY(EVPMDCtxPointer)
1153+
~EVPMDCtxPointer();
1154+
1155+
inline bool operator==(std::nullptr_t) noexcept { return ctx_ == nullptr; }
1156+
inline operator bool() const { return ctx_ != nullptr; }
1157+
inline EVP_MD_CTX* get() const { return ctx_.get(); }
1158+
inline operator EVP_MD_CTX*() const { return ctx_.get(); }
1159+
void reset(EVP_MD_CTX* ctx = nullptr);
1160+
EVP_MD_CTX* release();
1161+
1162+
bool digestInit(const EVP_MD* digest);
1163+
bool digestUpdate(const Buffer<const void>& in);
1164+
DataPointer digestFinal(size_t length);
1165+
bool digestFinalInto(Buffer<void>* buf);
1166+
size_t getExpectedSize();
1167+
1168+
std::optional<EVP_PKEY_CTX*> signInit(const EVPKeyPointer& key,
1169+
const EVP_MD* digest);
1170+
std::optional<EVP_PKEY_CTX*> verifyInit(const EVPKeyPointer& key,
1171+
const EVP_MD* digest);
1172+
1173+
DataPointer signOneShot(const Buffer<const unsigned char>& buf) const;
1174+
DataPointer sign(const Buffer<const unsigned char>& buf) const;
1175+
bool verify(const Buffer<const unsigned char>& buf,
1176+
const Buffer<const unsigned char>& sig) const;
1177+
1178+
const EVP_MD* getDigest() const;
1179+
size_t getDigestSize() const;
1180+
bool hasXofFlag() const;
1181+
1182+
bool copyTo(const EVPMDCtxPointer& other) const;
1183+
1184+
static EVPMDCtxPointer New();
1185+
1186+
private:
1187+
DeleteFnPtr<EVP_MD_CTX, EVP_MD_CTX_free> ctx_;
1188+
};
1189+
1190+
class HMACCtxPointer final {
1191+
public:
1192+
HMACCtxPointer();
1193+
explicit HMACCtxPointer(HMAC_CTX* ctx);
1194+
HMACCtxPointer(HMACCtxPointer&& other) noexcept;
1195+
HMACCtxPointer& operator=(HMACCtxPointer&& other) noexcept;
1196+
NCRYPTO_DISALLOW_COPY(HMACCtxPointer)
1197+
~HMACCtxPointer();
1198+
1199+
inline bool operator==(std::nullptr_t) noexcept { return ctx_ == nullptr; }
1200+
inline operator bool() const { return ctx_ != nullptr; }
1201+
inline HMAC_CTX* get() const { return ctx_.get(); }
1202+
inline operator HMAC_CTX*() const { return ctx_.get(); }
1203+
void reset(HMAC_CTX* ctx = nullptr);
1204+
HMAC_CTX* release();
1205+
1206+
bool init(const Buffer<const void>& buf, const EVP_MD* md);
1207+
bool update(const Buffer<const void>& buf);
1208+
DataPointer digest();
1209+
bool digestInto(Buffer<void>* buf);
1210+
1211+
static HMACCtxPointer New();
1212+
1213+
private:
1214+
DeleteFnPtr<HMAC_CTX, HMAC_CTX_free> ctx_;
1215+
};
1216+
9511217
#ifndef OPENSSL_NO_ENGINE
9521218
class EnginePointer final {
9531219
public:
@@ -1025,12 +1291,17 @@ Buffer<char> ExportChallenge(const char* input, size_t length);
10251291
// KDF
10261292

10271293
const EVP_MD* getDigestByName(const std::string_view name);
1294+
const EVP_CIPHER* getCipherByName(const std::string_view name);
10281295

10291296
// Verify that the specified HKDF output length is valid for the given digest.
10301297
// The maximum length for HKDF output for a given digest is 255 times the
10311298
// hash size for the given digest algorithm.
10321299
bool checkHkdfLength(const EVP_MD* md, size_t length);
10331300

1301+
bool extractP1363(const Buffer<const unsigned char>& buf,
1302+
unsigned char* dest,
1303+
size_t n);
1304+
10341305
DataPointer hkdf(const EVP_MD* md,
10351306
const Buffer<const unsigned char>& key,
10361307
const Buffer<const unsigned char>& info,

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.