1340 lines
38 KiB
C
1340 lines
38 KiB
C
/////////////////////////////////////////////////////////////////////////////
|
|
// FILE : swnt_pk.c //
|
|
// DESCRIPTION : //
|
|
// Software nametag public key management functions. These functions //
|
|
// isolate the peculiarities of public key management without a token //
|
|
// //
|
|
// AUTHOR : //
|
|
// HISTORY : //
|
|
// Jan 25 1995 larrys Changed from Nametag //
|
|
// Mar 01 1995 terences Fixed key pair handle creation //
|
|
// Mar 08 1995 larrys Fixed warning //
|
|
// Mar 23 1995 larrys Added variable key length //
|
|
// Apr 17 1995 larrys Added 1024 key gen //
|
|
// Apr 19 1995 larrys Changed CRYPT_EXCH_PUB to AT_KEYEXCHANGE //
|
|
// Aug 16 1995 larrys Removed exchange key stuff //
|
|
// Sep 12 1995 larrys Removed 2 DWORDS from exported keys //
|
|
// Sep 28 1995 larrys Changed format of PKCS //
|
|
// Oct 04 1995 larrys Fixed problem with PKCS format //
|
|
// Oct 27 1995 rajeshk RandSeed Stuff added hUID to PKCS2Encrypt //
|
|
// Nov 3 1995 larrys Merge for NT checkin //
|
|
// Dec 11 1995 larrys Added check for error return from RSA routine //
|
|
// May 15 1996 larrys Changed NTE_NO_MEMORY to ERROR_NOT_ENOUGHT... //
|
|
// Oct 14 1996 jeffspel Changed GenRandoms to NewGenRandoms //
|
|
// May 8 2000 dbarlow Reworked status return codes //
|
|
// //
|
|
// Copyright (C) 1993 - 2000, Microsoft Corporation //
|
|
// All Rights Reserved //
|
|
/////////////////////////////////////////////////////////////////////////////
|
|
|
|
#include "precomp.h"
|
|
#include "randlib.h"
|
|
#include "ntagum.h"
|
|
#include "swnt_pk.h"
|
|
#include "protstor.h"
|
|
#include "sha.h"
|
|
|
|
#define GetNextAlignedValue(c, alignment) ((c + alignment) & ~(alignment - 1))
|
|
|
|
extern CSP_STRINGS g_Strings;
|
|
|
|
extern void
|
|
FIPS186GenRandomWithException(
|
|
IN HANDLE *phRNGDriver,
|
|
IN BYTE **ppbContextSeed,
|
|
IN DWORD *pcbContextSeed,
|
|
IN OUT BYTE *pb,
|
|
IN DWORD cb);
|
|
|
|
|
|
// do the modular exponentiation calculation M^PubKey mod N
|
|
|
|
DWORD
|
|
RSAPublicEncrypt(
|
|
IN PEXPO_OFFLOAD_STRUCT pOffloadInfo,
|
|
IN BSAFE_PUB_KEY *pBSPubKey,
|
|
IN BYTE *pbInput,
|
|
IN BYTE *pbOutput)
|
|
{
|
|
DWORD dwReturn = ERROR_INTERNAL_ERROR;
|
|
BOOL fOffloadSuccess = FALSE;
|
|
DWORD cbMod;
|
|
|
|
//
|
|
// Two checks (needed for FIPS) before offloading to the offload
|
|
// module.
|
|
//
|
|
// First check is if there is an offload module, this
|
|
// will only be the case if the pOffloadInfo is not NULL.
|
|
//
|
|
// Second check is if this public key is OK, by checking
|
|
// the magic value in the key struct.
|
|
//
|
|
if (NULL != pOffloadInfo)
|
|
{
|
|
if (RSA1 != pBSPubKey->magic)
|
|
{
|
|
dwReturn = (DWORD)NTE_BAD_KEY;
|
|
goto ErrorExit;
|
|
}
|
|
|
|
cbMod = (pBSPubKey->bitlen + 7) / 8;
|
|
fOffloadSuccess = ModularExpOffload(pOffloadInfo,
|
|
pbInput,
|
|
(BYTE*)&(pBSPubKey->pubexp),
|
|
sizeof(pBSPubKey->pubexp),
|
|
(BYTE*)pBSPubKey +
|
|
sizeof(BSAFE_PUB_KEY),
|
|
cbMod, pbOutput, NULL, 0);
|
|
}
|
|
|
|
if (!fOffloadSuccess)
|
|
{
|
|
if (!BSafeEncPublic(pBSPubKey, pbInput, pbOutput))
|
|
{
|
|
dwReturn = ERROR_NOT_ENOUGH_MEMORY; // ?Really?
|
|
goto ErrorExit;
|
|
}
|
|
}
|
|
|
|
dwReturn = ERROR_SUCCESS;
|
|
|
|
ErrorExit:
|
|
return dwReturn;
|
|
}
|
|
|
|
|
|
// do the modular exponentiation calculation M^PrivKey Exponent mod N
|
|
|
|
DWORD
|
|
RSAPrivateDecrypt(
|
|
IN PEXPO_OFFLOAD_STRUCT pOffloadInfo,
|
|
IN BSAFE_PRV_KEY *pBSPrivKey,
|
|
IN BYTE *pbInput,
|
|
IN BYTE *pbOutput)
|
|
{
|
|
DWORD dwReturn = ERROR_INTERNAL_ERROR;
|
|
BOOL fOffloadSuccess = FALSE;
|
|
DWORD cbMod;
|
|
DWORD cbHalfKeylen;
|
|
OFFLOAD_PRIVATE_KEY OffloadPrivateKey;
|
|
|
|
//
|
|
// Two checks (needed for FIPS) before offloading to the offload
|
|
// module.
|
|
//
|
|
// First check is if there is an offload module, this
|
|
// will only be the case if the pOffloadInfo is not NULL.
|
|
//
|
|
// Second check is if this private key is OK, by checking
|
|
// the magic value in the key struct.
|
|
//
|
|
|
|
if (NULL != pOffloadInfo)
|
|
{
|
|
if (RSA2 != pBSPrivKey->magic)
|
|
{
|
|
dwReturn = (DWORD)NTE_BAD_KEY;
|
|
goto ErrorExit;
|
|
}
|
|
|
|
cbMod = (pBSPrivKey->bitlen + 7) / 8;
|
|
cbHalfKeylen = (pBSPrivKey->keylen + 1) / 2;
|
|
|
|
OffloadPrivateKey.dwVersion = CUR_OFFLOAD_VERSION;
|
|
OffloadPrivateKey.pbPrime1 =
|
|
(BYTE*)pBSPrivKey + sizeof(BSAFE_PRV_KEY) + cbHalfKeylen * 2;
|
|
OffloadPrivateKey.cbPrime1 = cbHalfKeylen;
|
|
OffloadPrivateKey.pbPrime2 =
|
|
(BYTE*)pBSPrivKey + sizeof(BSAFE_PRV_KEY) + cbHalfKeylen * 3;
|
|
OffloadPrivateKey.cbPrime2 = cbHalfKeylen;
|
|
|
|
fOffloadSuccess = ModularExpOffload(pOffloadInfo,
|
|
pbInput,
|
|
(BYTE*)pBSPrivKey + sizeof(BSAFE_PUB_KEY)
|
|
+ cbHalfKeylen * 7,
|
|
cbMod,
|
|
(BYTE*)pBSPrivKey + sizeof(BSAFE_PUB_KEY),
|
|
cbMod, pbOutput, (PVOID) &OffloadPrivateKey, 0);
|
|
}
|
|
|
|
if (!fOffloadSuccess)
|
|
{
|
|
if (!BSafeDecPrivate(pBSPrivKey, pbInput, pbOutput))
|
|
{
|
|
dwReturn = ERROR_NOT_ENOUGH_MEMORY; // ?Really?
|
|
goto ErrorExit;
|
|
}
|
|
}
|
|
|
|
dwReturn = ERROR_SUCCESS;
|
|
|
|
ErrorExit:
|
|
return dwReturn;
|
|
}
|
|
|
|
|
|
BOOL
|
|
CheckDataLenForRSAEncrypt(
|
|
IN DWORD cbMod, // length of the modulus
|
|
IN DWORD cbData, // length of the data
|
|
IN DWORD dwFlags) // flags
|
|
{
|
|
BOOL fRet = FALSE;
|
|
|
|
if (dwFlags & CRYPT_OAEP)
|
|
{
|
|
// if the OAEP flag is set then check for that length
|
|
if (cbMod < (cbData + A_SHA_DIGEST_LEN * 2 + 1))
|
|
goto ErrorExit;
|
|
}
|
|
else
|
|
{
|
|
// Check for PKCS 1 type 2 padding
|
|
// one byte for the top zero byte, one byte for the type,
|
|
// and one byte for the low zero byte,
|
|
// plus a minimum padding string is 8 bytes
|
|
if (cbMod < (cbData + 11))
|
|
goto ErrorExit;
|
|
}
|
|
|
|
fRet = TRUE;
|
|
|
|
ErrorExit:
|
|
return fRet;
|
|
}
|
|
|
|
|
|
/************************************************************************/
|
|
/* MaskGeneration generates a mask for OAEP based on the SHA1 hash */
|
|
/* function. */
|
|
/* NULL for the ppbMask parameter indicates the buffer is to be alloced.*/
|
|
/************************************************************************/
|
|
|
|
/*static*/ DWORD
|
|
MaskGeneration(
|
|
IN BYTE *pbSeed,
|
|
IN DWORD cbSeed,
|
|
IN DWORD cbMask,
|
|
OUT BYTE **ppbMask,
|
|
IN BOOL fAlloc)
|
|
{
|
|
DWORD dwReturn = ERROR_INTERNAL_ERROR;
|
|
DWORD dwCount;
|
|
BYTE rgbCount[sizeof(DWORD)];
|
|
BYTE *pbCount;
|
|
A_SHA_CTX SHA1Ctxt;
|
|
DWORD cb = cbMask;
|
|
BYTE *pb;
|
|
DWORD i;
|
|
DWORD j;
|
|
|
|
// NULL for *ppbMask indicates the buffer is to be alloced
|
|
if (fAlloc)
|
|
{
|
|
*ppbMask = (BYTE*)_nt_malloc(cbMask);
|
|
if (NULL == *ppbMask)
|
|
{
|
|
dwReturn = ERROR_NOT_ENOUGH_MEMORY;
|
|
goto ErrorExit;
|
|
}
|
|
}
|
|
pb = *ppbMask;
|
|
|
|
dwCount = (cbMask + (A_SHA_DIGEST_LEN - 1)) / A_SHA_DIGEST_LEN;
|
|
|
|
for (i = 0; i < dwCount; i++)
|
|
{
|
|
// clear the hash context
|
|
memset(&SHA1Ctxt, 0, sizeof(SHA1Ctxt));
|
|
|
|
// hash the seed and the count
|
|
A_SHAInit(&SHA1Ctxt);
|
|
A_SHAUpdate(&SHA1Ctxt, pbSeed, cbSeed);
|
|
// Reverse the count bytes
|
|
pbCount = (BYTE*)&i;
|
|
for (j = 0; j < sizeof(DWORD); j++)
|
|
rgbCount[j] = pbCount[sizeof(DWORD) - j - 1];
|
|
A_SHAUpdate(&SHA1Ctxt, rgbCount, sizeof(DWORD));
|
|
A_SHAFinal(&SHA1Ctxt, SHA1Ctxt.HashVal);
|
|
|
|
// copy the bytes from this hash into the mask buffer
|
|
if (cb >= A_SHA_DIGEST_LEN)
|
|
memcpy(pb, SHA1Ctxt.HashVal, A_SHA_DIGEST_LEN);
|
|
else
|
|
{
|
|
memcpy(pb, SHA1Ctxt.HashVal, cb);
|
|
break;
|
|
}
|
|
cb -= A_SHA_DIGEST_LEN;
|
|
pb += A_SHA_DIGEST_LEN;
|
|
}
|
|
|
|
dwReturn = ERROR_SUCCESS;
|
|
|
|
ErrorExit:
|
|
return dwReturn;
|
|
}
|
|
|
|
|
|
/************************************************************************/
|
|
/* ApplyPadding applies OAEP (Bellare-Rogoway) padding to a RSA key */
|
|
/* blob. The function does the seed generation, MGF and masking. */
|
|
/************************************************************************/
|
|
|
|
/*static*/ DWORD
|
|
ApplyPadding(
|
|
IN PNTAGUserList pTmpUser,
|
|
IN OUT BYTE* pb, // buffer
|
|
IN DWORD cb) // length of the data to mask not including seed
|
|
{
|
|
DWORD dwReturn = ERROR_INTERNAL_ERROR;
|
|
BYTE rgbSeed[A_SHA_DIGEST_LEN];
|
|
BYTE *pbMask = NULL;
|
|
BYTE rgbSeedMask[A_SHA_DIGEST_LEN];
|
|
BYTE *pbSeedMask;
|
|
DWORD i;
|
|
DWORD dwSts;
|
|
|
|
// generate the random seed
|
|
dwSts = FIPS186GenRandom(&pTmpUser->hRNGDriver,
|
|
&pTmpUser->ContInfo.pbRandom,
|
|
&pTmpUser->ContInfo.ContLens.cbRandom,
|
|
rgbSeed, A_SHA_DIGEST_LEN);
|
|
if (ERROR_SUCCESS != dwSts)
|
|
{
|
|
dwReturn = dwSts; // NTE_FAIL
|
|
goto ErrorExit;
|
|
}
|
|
|
|
// generate the data mask from the seed
|
|
dwSts = MaskGeneration(rgbSeed, sizeof(rgbSeed), cb, &pbMask, TRUE);
|
|
if (ERROR_SUCCESS != dwSts)
|
|
{
|
|
dwReturn = dwSts;
|
|
goto ErrorExit;
|
|
}
|
|
|
|
// XOR the data mask with the data
|
|
for (i = 0; i < cb; i++)
|
|
pb[i + A_SHA_DIGEST_LEN + 1] = (BYTE)(pb[i + A_SHA_DIGEST_LEN + 1] ^ pbMask[i]);
|
|
|
|
// generate the seed mask from the masked data
|
|
pbSeedMask = rgbSeedMask;
|
|
dwSts = MaskGeneration(pb + A_SHA_DIGEST_LEN + 1, cb,
|
|
A_SHA_DIGEST_LEN, &pbSeedMask, FALSE);
|
|
if (ERROR_SUCCESS != dwSts)
|
|
{
|
|
dwReturn = dwSts;
|
|
goto ErrorExit;
|
|
}
|
|
|
|
// XOR the seed mask with the seed and put that into the
|
|
// pb buffer
|
|
for (i = 0; i < A_SHA_DIGEST_LEN; i++)
|
|
pb[i + 1] = (BYTE)(rgbSeed[i] ^ rgbSeedMask[i]);
|
|
|
|
dwReturn = ERROR_SUCCESS;
|
|
|
|
ErrorExit:
|
|
if (pbMask)
|
|
_nt_free(pbMask, cb);
|
|
return dwReturn;
|
|
}
|
|
|
|
|
|
/************************************************************************/
|
|
/* RemovePadding checks OAEP (Bellare-Rogoway) padding on a RSA decrypt */
|
|
/* blob. */
|
|
/************************************************************************/
|
|
|
|
/*static*/ DWORD
|
|
RemovePadding(
|
|
IN OUT BYTE* pb,
|
|
IN DWORD cb)
|
|
{
|
|
DWORD dwReturn = ERROR_INTERNAL_ERROR;
|
|
BYTE rgbSeedMask[A_SHA_DIGEST_LEN];
|
|
BYTE *pbSeedMask;
|
|
BYTE *pbMask = NULL;
|
|
DWORD i;
|
|
DWORD dwSts;
|
|
|
|
memset(rgbSeedMask, 0, A_SHA_DIGEST_LEN);
|
|
|
|
// check the most significant byte is 0x00
|
|
if (0x00 != pb[0])
|
|
{
|
|
dwReturn = (DWORD)NTE_BAD_DATA;
|
|
goto ErrorExit;
|
|
}
|
|
|
|
// generate the seed mask from the masked data
|
|
pbSeedMask = rgbSeedMask;
|
|
dwSts = MaskGeneration(pb + A_SHA_DIGEST_LEN + 1, cb - (A_SHA_DIGEST_LEN + 1),
|
|
A_SHA_DIGEST_LEN, &pbSeedMask, FALSE);
|
|
if (ERROR_SUCCESS != dwSts)
|
|
{
|
|
dwReturn = dwSts;
|
|
goto ErrorExit;
|
|
}
|
|
|
|
// XOR the seed mask with the seed and put that into the
|
|
// pb buffer
|
|
for (i = 0; i < A_SHA_DIGEST_LEN; i++)
|
|
pb[i + 1] = (BYTE)(pb[i + 1] ^ rgbSeedMask[i]);
|
|
|
|
// generate the data mask from the seed
|
|
dwSts = MaskGeneration(pb + 1, A_SHA_DIGEST_LEN,
|
|
cb - (A_SHA_DIGEST_LEN + 1), &pbMask, TRUE);
|
|
if (ERROR_SUCCESS != dwSts)
|
|
{
|
|
dwReturn = dwSts;
|
|
goto ErrorExit;
|
|
}
|
|
|
|
// XOR the data mask with the data
|
|
for (i = 0; i < cb - (A_SHA_DIGEST_LEN + 1); i++)
|
|
{
|
|
pb[i + A_SHA_DIGEST_LEN + 1] =
|
|
(BYTE)(pb[i + A_SHA_DIGEST_LEN + 1] ^ pbMask[i]);
|
|
}
|
|
|
|
dwReturn = ERROR_SUCCESS;
|
|
|
|
ErrorExit:
|
|
if (pbMask)
|
|
_nt_free(pbMask, cb - (A_SHA_DIGEST_LEN + 1));
|
|
return dwReturn;
|
|
}
|
|
|
|
|
|
/************************************************************************/
|
|
/* OAEPEncrypt performs a RSA encryption using OAEP (Bellare-Rogoway) */
|
|
/* as the padding scheme. The current implementation uses SHA1 as the */
|
|
/* hash function. */
|
|
/************************************************************************/
|
|
|
|
/*static*/ DWORD
|
|
OAEPEncrypt(
|
|
IN PNTAGUserList pTmpUser,
|
|
IN BSAFE_PUB_KEY *pBSPubKey,
|
|
IN BYTE *pbPlaintext,
|
|
IN DWORD cbPlaintext,
|
|
IN BYTE *pbParams,
|
|
IN DWORD cbParams,
|
|
OUT BYTE *pbOut)
|
|
{
|
|
DWORD dwReturn = ERROR_INTERNAL_ERROR;
|
|
BYTE *pbInput = NULL;
|
|
BYTE *pbOutput = NULL;
|
|
BYTE *pbReverse = NULL;
|
|
A_SHA_CTX SHA1Ctxt;
|
|
DWORD i;
|
|
DWORD cb;
|
|
DWORD dwSts;
|
|
|
|
memset(&SHA1Ctxt, 0, sizeof(SHA1Ctxt));
|
|
|
|
// start off by hashing the Encoding parameters (pbParams)
|
|
A_SHAInit(&SHA1Ctxt);
|
|
if (0 != cbParams)
|
|
A_SHAUpdate(&SHA1Ctxt, pbParams, cbParams);
|
|
A_SHAFinal(&SHA1Ctxt, SHA1Ctxt.HashVal);
|
|
|
|
// alloc space for an internal buffer
|
|
pbInput = (BYTE *)_nt_malloc(pBSPubKey->keylen * 2
|
|
+ ((pBSPubKey->bitlen + 7) / 8));
|
|
if (NULL == pbInput)
|
|
{
|
|
dwReturn = ERROR_NOT_ENOUGH_MEMORY;
|
|
goto ErrorExit;
|
|
}
|
|
|
|
pbOutput = pbInput + pBSPubKey->keylen;
|
|
pbReverse = pbInput + pBSPubKey->keylen * 2;
|
|
|
|
// add the pHash
|
|
memcpy(pbReverse + A_SHA_DIGEST_LEN + 1, SHA1Ctxt.HashVal,
|
|
A_SHA_DIGEST_LEN);
|
|
|
|
// figure the length of PS,
|
|
|
|
// put the 0x01 byte in, skipping past the PS,
|
|
// note that the PS is zero bytes so it is just there
|
|
cb = ((pBSPubKey->bitlen + 7) / 8) - (1 + cbPlaintext);
|
|
pbReverse[cb] = 0x01;
|
|
cb++;
|
|
|
|
// copy in the message bytes
|
|
memcpy(pbReverse + cb, pbPlaintext, cbPlaintext);
|
|
|
|
// do the seed generation, MGF and masking
|
|
cb = ((pBSPubKey->bitlen + 7) / 8) - (A_SHA_DIGEST_LEN + 1);
|
|
dwSts = ApplyPadding(pTmpUser, pbReverse, cb);
|
|
if (ERROR_SUCCESS != dwSts)
|
|
{
|
|
dwReturn = dwSts;
|
|
goto ErrorExit;
|
|
}
|
|
|
|
// byte reverse the whole thing before RSA encrypting
|
|
for (i = 0; i < (pBSPubKey->bitlen + 7) / 8; i++)
|
|
pbInput[i] = pbReverse[((pBSPubKey->bitlen + 7) / 8) - i - 1];
|
|
|
|
// RSA encrypt this
|
|
dwSts = RSAPublicEncrypt(pTmpUser->pOffloadInfo, pBSPubKey,
|
|
pbInput, pbOutput);
|
|
if (ERROR_SUCCESS != dwSts)
|
|
{
|
|
dwReturn = dwSts; // NTE_FAIL
|
|
goto ErrorExit;
|
|
}
|
|
|
|
memcpy(pbOut, pbOutput, (pBSPubKey->bitlen + 7) / 8);
|
|
|
|
dwReturn = ERROR_SUCCESS;
|
|
|
|
ErrorExit:
|
|
if (pbInput)
|
|
{
|
|
memset(pbInput, 0, pBSPubKey->keylen * 2 + (pBSPubKey->bitlen + 7) / 8);
|
|
_nt_free(pbInput, pBSPubKey->keylen * 2 + (pBSPubKey->bitlen + 7) / 8);
|
|
}
|
|
return dwReturn;
|
|
}
|
|
|
|
|
|
/************************************************************************/
|
|
/* OAEPDecrypt performs a RSA decryption checking that OAEP */
|
|
/* (Bellare-Rogoway) is the padding scheme. The current implementation */
|
|
/* uses SHA1 as the hash function. */
|
|
/************************************************************************/
|
|
|
|
/*static*/ DWORD
|
|
OAEPDecrypt(
|
|
IN PNTAGUserList pTmpUser,
|
|
IN BSAFE_PRV_KEY *pBSPrivKey,
|
|
IN CONST BYTE *pbBlob,
|
|
IN DWORD cbBlob,
|
|
IN BYTE *pbParams,
|
|
IN DWORD cbParams,
|
|
OUT BYTE **ppbPlaintext,
|
|
OUT DWORD *pcbPlaintext)
|
|
{
|
|
DWORD dwReturn = ERROR_INTERNAL_ERROR;
|
|
BYTE* pbOutput = NULL;
|
|
BYTE* pbInput = NULL;
|
|
BYTE* pbReverse = NULL;
|
|
A_SHA_CTX SHA1Ctxt;
|
|
DWORD cb;
|
|
DWORD i;
|
|
DWORD dwSts;
|
|
DWORD dwAlignedBufLen = 0;
|
|
|
|
memset(&SHA1Ctxt, 0, sizeof(SHA1Ctxt));
|
|
|
|
cb = (pBSPrivKey->bitlen + 7) / 8;
|
|
if (cbBlob > cb)
|
|
{
|
|
dwReturn = (DWORD)NTE_BAD_DATA;
|
|
goto ErrorExit;
|
|
}
|
|
|
|
dwAlignedBufLen = GetNextAlignedValue(pBSPrivKey->keylen + 2, sizeof(DWORD));
|
|
pbOutput = (BYTE *)_nt_malloc(dwAlignedBufLen * 2 + cb);
|
|
if (NULL == pbOutput)
|
|
{
|
|
dwReturn = ERROR_NOT_ENOUGH_MEMORY;
|
|
goto ErrorExit;
|
|
}
|
|
|
|
pbInput = pbOutput + dwAlignedBufLen;
|
|
pbReverse = pbOutput + dwAlignedBufLen * 2;
|
|
|
|
// perform the RSA decryption
|
|
memcpy(pbInput, pbBlob, cb);
|
|
dwSts = RSAPrivateDecrypt(pTmpUser->pOffloadInfo, pBSPrivKey,
|
|
pbInput, pbOutput);
|
|
if (ERROR_SUCCESS != dwSts)
|
|
{
|
|
dwReturn = dwSts; // NTE_FAIL
|
|
goto ErrorExit;
|
|
}
|
|
|
|
for (i = 0; i < cb; i++)
|
|
pbReverse[i] = pbOutput[cb - i - 1];
|
|
|
|
// remove OAEP (Bellare-Rogoway) padding
|
|
dwSts = RemovePadding(pbReverse, cb);
|
|
if (ERROR_SUCCESS != dwSts)
|
|
{
|
|
dwReturn = dwSts; // NTE_FAIL
|
|
goto ErrorExit;
|
|
}
|
|
|
|
// hash the Encoding parameters (pbParams)
|
|
A_SHAInit(&SHA1Ctxt);
|
|
if (0 != cbParams)
|
|
A_SHAUpdate(&SHA1Ctxt, pbParams, cbParams);
|
|
A_SHAFinal(&SHA1Ctxt, SHA1Ctxt.HashVal);
|
|
|
|
// check the hash of the encoding parameters against the message
|
|
if (0 != memcmp(SHA1Ctxt.HashVal, pbReverse + A_SHA_DIGEST_LEN + 1,
|
|
A_SHA_DIGEST_LEN))
|
|
{
|
|
dwReturn = (DWORD)NTE_BAD_DATA;
|
|
goto ErrorExit;
|
|
}
|
|
|
|
// check the zero bytes and check the 0x01 byte
|
|
for (i = A_SHA_DIGEST_LEN * 2 + 1; i < cb; i++)
|
|
{
|
|
if (0x01 == pbReverse[i])
|
|
{
|
|
i++;
|
|
break;
|
|
}
|
|
else if (0x00 != pbReverse[i])
|
|
{
|
|
dwReturn = (DWORD)NTE_BAD_DATA;
|
|
goto ErrorExit;
|
|
}
|
|
}
|
|
|
|
*pcbPlaintext = cb - i;
|
|
*ppbPlaintext = (BYTE*)_nt_malloc(*pcbPlaintext);
|
|
if (NULL == *ppbPlaintext)
|
|
{
|
|
dwReturn = ERROR_NOT_ENOUGH_MEMORY;
|
|
goto ErrorExit;
|
|
}
|
|
|
|
memcpy(*ppbPlaintext, pbReverse + i, *pcbPlaintext);
|
|
|
|
dwReturn = ERROR_SUCCESS;
|
|
|
|
ErrorExit:
|
|
// scrub the output buffer
|
|
if (pbOutput)
|
|
{
|
|
memset(pbOutput, 0, dwAlignedBufLen * 2 + cb);
|
|
_nt_free(pbOutput, dwAlignedBufLen * 2 + cb);
|
|
}
|
|
return dwReturn;
|
|
}
|
|
|
|
|
|
/*static*/ DWORD
|
|
PKCS2Encrypt(
|
|
PNTAGUserList pTmpUser,
|
|
DWORD dwFlags,
|
|
BSAFE_PUB_KEY *pKey,
|
|
BYTE *InBuf,
|
|
DWORD InBufLen,
|
|
BYTE *OutBuf)
|
|
{
|
|
DWORD dwReturn = ERROR_INTERNAL_ERROR;
|
|
BYTE *pScratch = NULL;
|
|
BYTE *pScratch2 = NULL;
|
|
BYTE *pLocal;
|
|
DWORD temp;
|
|
DWORD z;
|
|
DWORD dwSts;
|
|
|
|
pScratch = (BYTE *)_nt_malloc(pKey->keylen);
|
|
if (NULL == pScratch)
|
|
{
|
|
dwReturn = ERROR_NOT_ENOUGH_MEMORY;
|
|
goto ErrorExit;
|
|
}
|
|
|
|
pScratch2 = (BYTE *)_nt_malloc(pKey->keylen);
|
|
if (NULL == pScratch2)
|
|
{
|
|
dwReturn = ERROR_NOT_ENOUGH_MEMORY;
|
|
goto ErrorExit;
|
|
}
|
|
|
|
memset(pScratch, 0, pKey->keylen);
|
|
|
|
pScratch[pKey->datalen - 1] = PKCS_BLOCKTYPE_2;
|
|
dwSts = FIPS186GenRandom(&pTmpUser->hRNGDriver,
|
|
&pTmpUser->ContInfo.pbRandom,
|
|
&pTmpUser->ContInfo.ContLens.cbRandom,
|
|
pScratch+InBufLen+1,
|
|
(pKey->datalen)-InBufLen-2);
|
|
if (ERROR_SUCCESS != dwSts)
|
|
{
|
|
dwReturn = dwSts; // NTE_FAIL
|
|
goto ErrorExit;
|
|
}
|
|
|
|
pLocal = pScratch + InBufLen + 1;
|
|
|
|
// Need to insure that none of the padding bytes are zero.
|
|
temp = pKey->datalen - InBufLen - 2;
|
|
while (temp)
|
|
{
|
|
if (*pLocal == 0)
|
|
{
|
|
dwSts = FIPS186GenRandom(&pTmpUser->hRNGDriver,
|
|
&pTmpUser->ContInfo.pbRandom,
|
|
&pTmpUser->ContInfo.ContLens.cbRandom,
|
|
pLocal, 1);
|
|
if (ERROR_SUCCESS != dwSts)
|
|
{
|
|
dwReturn = dwSts; // NTE_FAIL
|
|
goto ErrorExit;
|
|
}
|
|
}
|
|
else
|
|
{
|
|
pLocal++;
|
|
temp--;
|
|
}
|
|
}
|
|
|
|
#ifdef CSP_USE_SSL3
|
|
// if SSL2_FALLBACK has been specified then put threes in the 8
|
|
// least significant bytes of the random padding
|
|
if (CRYPT_SSL2_FALLBACK & dwFlags)
|
|
memset(pScratch + InBufLen + 1, 0x03, 8);
|
|
#endif
|
|
|
|
// Reverse the session key bytes
|
|
for (z = 0; z < InBufLen; ++z)
|
|
pScratch[z] = InBuf[InBufLen - z - 1];
|
|
|
|
dwSts = RSAPublicEncrypt(pTmpUser->pOffloadInfo,
|
|
pKey, pScratch, pScratch2);
|
|
if (ERROR_SUCCESS != dwSts)
|
|
{
|
|
dwReturn = dwSts;
|
|
goto ErrorExit;
|
|
}
|
|
|
|
memcpy(OutBuf, pScratch2, (pKey->bitlen + 7) / 8);
|
|
dwReturn = ERROR_SUCCESS;
|
|
|
|
ErrorExit:
|
|
if (pScratch)
|
|
_nt_free(pScratch, pKey->keylen);
|
|
if (pScratch2)
|
|
_nt_free(pScratch2, pKey->keylen);
|
|
return dwReturn;
|
|
}
|
|
|
|
|
|
/*static*/ DWORD
|
|
PKCS2Decrypt(
|
|
IN PNTAGUserList pTmpUser,
|
|
IN BSAFE_PRV_KEY *pKey,
|
|
IN DWORD dwFlags,
|
|
IN CONST BYTE *InBuf,
|
|
OUT BYTE **ppbOutBuf,
|
|
OUT DWORD *pcbOutBuf)
|
|
{
|
|
DWORD dwReturn = ERROR_INTERNAL_ERROR;
|
|
DWORD i;
|
|
BYTE *pScratch = NULL;
|
|
BYTE *pScratch2 = NULL;
|
|
DWORD z;
|
|
DWORD dwSts;
|
|
|
|
pScratch = (BYTE *)_nt_malloc(pKey->keylen * 2);
|
|
if (NULL == pScratch)
|
|
{
|
|
dwReturn = ERROR_NOT_ENOUGH_MEMORY;
|
|
goto ErrorExit;
|
|
}
|
|
|
|
pScratch2 = pScratch + pKey->keylen;
|
|
memcpy(pScratch2, InBuf, (pKey->bitlen + 7) / 8);
|
|
|
|
dwSts = RSAPrivateDecrypt(pTmpUser->pOffloadInfo, pKey,
|
|
pScratch2, pScratch);
|
|
if (ERROR_SUCCESS != dwSts)
|
|
{
|
|
dwReturn = dwSts; // NTE_FAIL
|
|
goto ErrorExit;
|
|
}
|
|
|
|
if ((pScratch[pKey->datalen - 1] != PKCS_BLOCKTYPE_2) ||
|
|
(pScratch[pKey->datalen] != 0))
|
|
{
|
|
dwReturn = (DWORD) NTE_BAD_DATA;
|
|
goto ErrorExit;
|
|
}
|
|
|
|
i = pKey->datalen - 2;
|
|
|
|
while ((i > 0) && (pScratch[i]))
|
|
i--;
|
|
|
|
*ppbOutBuf = (BYTE *)_nt_malloc(i);
|
|
if (NULL == *ppbOutBuf)
|
|
{
|
|
dwReturn = ERROR_NOT_ENOUGH_MEMORY;
|
|
goto ErrorExit;
|
|
}
|
|
|
|
*pcbOutBuf = i;
|
|
|
|
#ifdef CSP_USE_SSL3
|
|
|
|
// if SSL2_FALLBACK has been specified then check if threes
|
|
// are in the 8 least significant bytes of the random padding
|
|
if (CRYPT_SSL2_FALLBACK & dwFlags)
|
|
{
|
|
BOOL fFallbackError = TRUE;
|
|
|
|
for (z = i + 1; z < i + 9; z++)
|
|
{
|
|
if (0x03 != pScratch[z])
|
|
{
|
|
fFallbackError = FALSE;
|
|
break;
|
|
}
|
|
}
|
|
if (fFallbackError)
|
|
{
|
|
dwReturn = (DWORD)NTE_BAD_VER;
|
|
goto ErrorExit;
|
|
}
|
|
}
|
|
#endif
|
|
|
|
// Reverse the session key bytes
|
|
for (z = 0; z < i; ++z)
|
|
(*ppbOutBuf)[z] = pScratch[i - z - 1];
|
|
|
|
dwReturn = ERROR_SUCCESS;
|
|
|
|
ErrorExit:
|
|
if (pScratch)
|
|
_nt_free(pScratch, pKey->keylen);
|
|
return dwReturn;
|
|
}
|
|
|
|
|
|
/************************************************************************/
|
|
/* RSAEncrypt performs a RSA encryption. */
|
|
/************************************************************************/
|
|
|
|
DWORD
|
|
RSAEncrypt(
|
|
IN PNTAGUserList pTmpUser,
|
|
IN BSAFE_PUB_KEY *pBSPubKey,
|
|
IN BYTE *pbPlaintext,
|
|
IN DWORD cbPlaintext,
|
|
IN BYTE *pbParams,
|
|
IN DWORD cbParams,
|
|
IN DWORD dwFlags,
|
|
OUT BYTE *pbOut)
|
|
{
|
|
DWORD dwReturn = ERROR_INTERNAL_ERROR;
|
|
DWORD dwSts;
|
|
|
|
// check the length of the data
|
|
if (!CheckDataLenForRSAEncrypt((pBSPubKey->bitlen + 7) / 8,
|
|
cbPlaintext, dwFlags))
|
|
{
|
|
dwReturn = (DWORD)NTE_BAD_LEN;
|
|
goto ErrorExit;
|
|
}
|
|
|
|
// use OAEP if the flag is set
|
|
if (dwFlags & CRYPT_OAEP)
|
|
{
|
|
// use OAEP if the flag is set
|
|
dwSts = OAEPEncrypt(pTmpUser, pBSPubKey, pbPlaintext,
|
|
cbPlaintext, pbParams, cbParams, pbOut);
|
|
if (ERROR_SUCCESS != dwSts)
|
|
{
|
|
dwReturn = dwSts;
|
|
goto ErrorExit;
|
|
}
|
|
}
|
|
else
|
|
{
|
|
// use PKCS #1 Type 2
|
|
dwSts = PKCS2Encrypt(pTmpUser, dwFlags, pBSPubKey,
|
|
pbPlaintext, cbPlaintext, pbOut);
|
|
if (ERROR_SUCCESS != dwSts)
|
|
{
|
|
dwReturn = dwSts;
|
|
goto ErrorExit;
|
|
}
|
|
}
|
|
|
|
dwReturn = ERROR_SUCCESS;
|
|
|
|
ErrorExit:
|
|
return dwReturn;
|
|
}
|
|
|
|
|
|
/************************************************************************/
|
|
/* RSADecrypt performs a RSA decryption. */
|
|
/************************************************************************/
|
|
|
|
DWORD
|
|
RSADecrypt(
|
|
IN PNTAGUserList pTmpUser,
|
|
IN BSAFE_PRV_KEY *pBSPrivKey,
|
|
IN CONST BYTE *pbBlob,
|
|
IN DWORD cbBlob,
|
|
IN BYTE *pbParams,
|
|
IN DWORD cbParams,
|
|
IN DWORD dwFlags,
|
|
OUT BYTE **ppbPlaintext,
|
|
OUT DWORD *pcbPlaintext)
|
|
{
|
|
DWORD dwReturn = ERROR_INTERNAL_ERROR;
|
|
DWORD dwSts;
|
|
|
|
// use OAEP if the flag is set
|
|
if (dwFlags & CRYPT_OAEP)
|
|
{
|
|
// use OAEP if the flag is set
|
|
dwSts = OAEPDecrypt(pTmpUser, pBSPrivKey, pbBlob, cbBlob, pbParams,
|
|
cbParams, ppbPlaintext, pcbPlaintext);
|
|
if (ERROR_SUCCESS != dwSts)
|
|
{
|
|
dwReturn = dwSts;
|
|
goto ErrorExit;
|
|
}
|
|
}
|
|
else
|
|
{
|
|
// use PKCS #1 Type 2
|
|
dwSts = PKCS2Decrypt(pTmpUser, pBSPrivKey, dwFlags, pbBlob,
|
|
ppbPlaintext, pcbPlaintext);
|
|
if (ERROR_SUCCESS != dwSts)
|
|
{
|
|
dwReturn = dwSts;
|
|
goto ErrorExit;
|
|
}
|
|
}
|
|
|
|
dwReturn = ERROR_SUCCESS;
|
|
|
|
ErrorExit:
|
|
return dwReturn;
|
|
}
|
|
|
|
|
|
//
|
|
// Function : EncryptAndDecryptWithRSAKey
|
|
//
|
|
// Description : This function creates a buffer and then encrypts that with
|
|
// the passed in private key and decrypts with the passed in
|
|
// public key. The function is used for FIPS 140-1 compliance
|
|
// to make sure that newly generated/imported keys work and
|
|
// in the self test during DLL initialization.
|
|
//
|
|
|
|
DWORD
|
|
EncryptAndDecryptWithRSAKey(
|
|
IN BYTE *pbRSAPub,
|
|
IN BYTE *pbRSAPriv,
|
|
IN BOOL fSigKey,
|
|
IN BOOL fEncryptCheck)
|
|
{
|
|
DWORD dwReturn = ERROR_INTERNAL_ERROR;
|
|
BSAFE_PRV_KEY *pBSafePriv = (BSAFE_PRV_KEY*)pbRSAPriv;
|
|
BYTE *pb = NULL;
|
|
DWORD cb;
|
|
DWORD cbKey;
|
|
DWORD i;
|
|
|
|
// alloc space for the plaintext and ciphertext
|
|
cb = pBSafePriv->keylen;
|
|
cbKey = pBSafePriv->bitlen / 8;
|
|
pb = _nt_malloc(cb * 3);
|
|
if (NULL == pb)
|
|
{
|
|
dwReturn = ERROR_NOT_ENOUGH_MEMORY;
|
|
goto ErrorExit;
|
|
}
|
|
|
|
// reverse the hash so it is in little endian
|
|
for (i = 0; i < 16; i++)
|
|
pb[i] = (BYTE)(i + 1);
|
|
memset(pb + 17, 0xFF, cbKey - 18);
|
|
|
|
if (fSigKey)
|
|
{
|
|
// encrypt with the private key
|
|
if (!BSafeDecPrivate(pBSafePriv, pb, pb + cb))
|
|
{
|
|
dwReturn = (DWORD)NTE_BAD_KEY;
|
|
goto ErrorExit;
|
|
}
|
|
}
|
|
else
|
|
{
|
|
// encrypt with the public key
|
|
if (!BSafeEncPublic((BSAFE_PUB_KEY*)pbRSAPub, pb, pb + cb))
|
|
{
|
|
dwReturn = (DWORD)NTE_BAD_KEY;
|
|
goto ErrorExit;
|
|
}
|
|
}
|
|
|
|
// we can't do this check when importing private keys since many
|
|
// applications use private keys with exponent of 1 to import
|
|
// plaintext symmetric keys
|
|
if (fEncryptCheck)
|
|
{
|
|
if (0 == (memcmp(pb, pb + cb, cb)))
|
|
{
|
|
dwReturn = (DWORD)NTE_BAD_KEY;
|
|
goto ErrorExit;
|
|
}
|
|
}
|
|
|
|
if (fSigKey)
|
|
{
|
|
// decrypt with the public key
|
|
if (!BSafeEncPublic((BSAFE_PUB_KEY*)pbRSAPub, pb + cb, pb + (cb * 2)))
|
|
{
|
|
dwReturn = (DWORD)NTE_BAD_KEY;
|
|
goto ErrorExit;
|
|
}
|
|
}
|
|
else
|
|
{
|
|
// encrypt with the private key
|
|
if (!BSafeDecPrivate(pBSafePriv, pb + cb, pb + (cb * 2)))
|
|
{
|
|
dwReturn = (DWORD)NTE_BAD_KEY;
|
|
goto ErrorExit;
|
|
}
|
|
}
|
|
|
|
// compare to the plaintext and the decrypted text
|
|
if (memcmp(pb, pb + cb * 2, cbKey))
|
|
{
|
|
dwReturn = (DWORD)NTE_BAD_KEY;
|
|
goto ErrorExit;
|
|
}
|
|
|
|
dwReturn = ERROR_SUCCESS;
|
|
|
|
ErrorExit:
|
|
if (pb)
|
|
_nt_free(pb, cbB * 3);
|
|
return dwReturn;
|
|
}
|
|
|
|
|
|
DWORD
|
|
ReGenKey(
|
|
HCRYPTPROV hUser,
|
|
DWORD dwFlags,
|
|
DWORD dwWhichKey,
|
|
HCRYPTKEY *phKey,
|
|
DWORD bits)
|
|
{
|
|
DWORD dwReturn = ERROR_INTERNAL_ERROR;
|
|
BYTE **ThisPubKey, **ThisPrivKey;
|
|
DWORD *pThisPubLen, *pThisPrivLen;
|
|
BYTE *pNewPubKey = NULL;
|
|
BYTE *pNewPrivKey = NULL;
|
|
DWORD PrivateKeySize, PublicKeySize;
|
|
DWORD localbits;
|
|
PNTAGUserList pOurUser;
|
|
BOOL fSigKey;
|
|
LPWSTR szPrompt;
|
|
BOOL *pfExportable;
|
|
BOOL fAlloc = FALSE;
|
|
BOOL fInCritSec = FALSE;
|
|
BSAFE_OTHER_INFO OtherInfo;
|
|
BSAFE_OTHER_INFO *pOtherInfo = NULL;
|
|
DWORD dwSts;
|
|
PNTAGKeyList pTmpKey = NULL;
|
|
|
|
memset(&OtherInfo, 0, sizeof(OtherInfo));
|
|
|
|
// ## MTS: No user structure locking
|
|
pOurUser = (PNTAGUserList) NTLCheckList(hUser, USER_HANDLE);
|
|
if (NULL == pOurUser)
|
|
{
|
|
dwReturn = (DWORD)NTE_BAD_UID;
|
|
goto ErrorExit;
|
|
}
|
|
|
|
// wrap with a try since there is a critical sections in here
|
|
__try
|
|
{
|
|
EnterCriticalSection(&pOurUser->CritSec);
|
|
fInCritSec = TRUE;
|
|
|
|
localbits = bits;
|
|
|
|
if (!BSafeComputeKeySizes(&PublicKeySize, &PrivateKeySize,
|
|
&localbits))
|
|
{
|
|
dwReturn = (DWORD)NTE_FAIL;
|
|
goto ErrorExit;
|
|
}
|
|
|
|
pNewPubKey = (BYTE *)_nt_malloc(PublicKeySize);
|
|
if (NULL == pNewPubKey)
|
|
{
|
|
dwReturn = ERROR_NOT_ENOUGH_MEMORY;
|
|
goto ErrorExit;
|
|
}
|
|
fAlloc = TRUE;
|
|
|
|
// allocate space for the new key exchange public key
|
|
pNewPrivKey = (BYTE *)_nt_malloc(PrivateKeySize);
|
|
if (NULL == pNewPrivKey)
|
|
{
|
|
dwReturn = ERROR_NOT_ENOUGH_MEMORY;
|
|
goto ErrorExit;
|
|
}
|
|
|
|
// generate the key exchange key pair
|
|
if (INVALID_HANDLE_VALUE != pOurUser->hRNGDriver)
|
|
{
|
|
OtherInfo.pRNGInfo = &pOurUser->hRNGDriver;
|
|
OtherInfo.pFuncRNG = FIPS186GenRandomWithException;
|
|
pOtherInfo = &OtherInfo;
|
|
}
|
|
|
|
// ?Note? -- Shouldn't this be in a try/except?
|
|
if (!BSafeMakeKeyPairEx2(pOtherInfo,
|
|
(BSAFE_PUB_KEY *) pNewPubKey,
|
|
(BSAFE_PRV_KEY *) pNewPrivKey,
|
|
bits,
|
|
0x10001))
|
|
{
|
|
dwReturn = (DWORD)NTE_FAIL;
|
|
goto ErrorExit;
|
|
}
|
|
|
|
// test the RSA key to make sure it works
|
|
dwSts = EncryptAndDecryptWithRSAKey(pNewPubKey, pNewPrivKey,
|
|
TRUE, TRUE);
|
|
if (ERROR_SUCCESS != dwSts)
|
|
{
|
|
dwReturn = dwSts;
|
|
goto ErrorExit;
|
|
}
|
|
|
|
// test the RSA key to make sure it works
|
|
dwSts = EncryptAndDecryptWithRSAKey(pNewPubKey, pNewPrivKey,
|
|
FALSE, TRUE);
|
|
if (ERROR_SUCCESS != dwSts)
|
|
{
|
|
dwReturn = dwSts;
|
|
goto ErrorExit;
|
|
}
|
|
|
|
if (dwWhichKey == NTPK_USE_SIG)
|
|
{
|
|
ThisPubKey = &pOurUser->ContInfo.pbSigPub;
|
|
ThisPrivKey = &pOurUser->pSigPrivKey;
|
|
pThisPubLen = &pOurUser->ContInfo.ContLens.cbSigPub;
|
|
pThisPrivLen = &pOurUser->SigPrivLen;
|
|
pfExportable = &pOurUser->ContInfo.fSigExportable;
|
|
fSigKey = TRUE;
|
|
szPrompt = g_Strings.pwszCreateRSASig;
|
|
}
|
|
else
|
|
{
|
|
ThisPubKey = &pOurUser->ContInfo.pbExchPub;
|
|
ThisPrivKey = &pOurUser->pExchPrivKey;
|
|
pThisPubLen = &pOurUser->ContInfo.ContLens.cbExchPub;
|
|
pThisPrivLen = &pOurUser->ExchPrivLen;
|
|
pfExportable = &pOurUser->ContInfo.fExchExportable;
|
|
fSigKey = FALSE;
|
|
szPrompt = g_Strings.pwszCreateRSAExch;
|
|
}
|
|
|
|
if (*ThisPubKey)
|
|
{
|
|
ASSERT(*pThisPubLen);
|
|
ASSERT(*pThisPrivLen);
|
|
ASSERT(*ThisPrivKey);
|
|
|
|
_nt_free (*ThisPubKey, *pThisPubLen);
|
|
_nt_free (*ThisPrivKey, *pThisPrivLen);
|
|
}
|
|
#ifdef NTAGDEBUG
|
|
else
|
|
{
|
|
ASSERT(*pThisPrivLen == 0);
|
|
ASSERT(*pThisPubLen == 0);
|
|
ASSERT(*ThisPrivKey == 0);
|
|
ASSERT(*ThisPubKey == 0);
|
|
}
|
|
#endif
|
|
|
|
fAlloc = FALSE;
|
|
|
|
*pThisPrivLen = PrivateKeySize;
|
|
*pThisPubLen = PublicKeySize;
|
|
*ThisPrivKey = pNewPrivKey;
|
|
*ThisPubKey = pNewPubKey;
|
|
|
|
if (dwFlags & CRYPT_EXPORTABLE)
|
|
*pfExportable = TRUE;
|
|
else
|
|
*pfExportable = FALSE;
|
|
|
|
// if the context being used is a Verify Context then the key is not
|
|
// persisted to storage
|
|
if (!(pOurUser->Rights & CRYPT_VERIFYCONTEXT))
|
|
{
|
|
// write the new keys to the user storage file
|
|
dwSts = ProtectPrivKey(pOurUser, szPrompt, dwFlags, fSigKey);
|
|
if (ERROR_SUCCESS != dwSts)
|
|
{
|
|
dwReturn = dwSts;
|
|
goto ErrorExit;
|
|
}
|
|
}
|
|
|
|
if (dwWhichKey == NTPK_USE_SIG)
|
|
{
|
|
if (!CPGetUserKey(hUser, AT_SIGNATURE, phKey))
|
|
{
|
|
dwReturn = GetLastError();
|
|
goto ErrorExit;
|
|
}
|
|
|
|
dwSts = NTLValidate(*phKey, hUser, SIGPUBKEY_HANDLE, &pTmpKey);
|
|
if (ERROR_SUCCESS != dwSts)
|
|
{
|
|
// NTLValidate doesn't know what error to set
|
|
// so it set NTE_FAIL -- fix it up.
|
|
dwReturn = (dwSts == NTE_FAIL) ? (DWORD)NTE_BAD_KEY : dwSts;
|
|
goto ErrorExit;
|
|
}
|
|
}
|
|
else
|
|
{
|
|
if (!CPGetUserKey(hUser, AT_KEYEXCHANGE, phKey))
|
|
{
|
|
dwReturn = GetLastError();
|
|
goto ErrorExit;
|
|
}
|
|
|
|
dwSts = NTLValidate(*phKey, hUser, EXCHPUBKEY_HANDLE, &pTmpKey);
|
|
if (ERROR_SUCCESS != dwSts)
|
|
{
|
|
// NTLValidate doesn't know what error to set
|
|
// so it set NTE_FAIL -- fix it up.
|
|
dwReturn = (dwSts == NTE_FAIL) ? (DWORD)NTE_BAD_KEY : dwSts;
|
|
goto ErrorExit;
|
|
}
|
|
}
|
|
|
|
|
|
//
|
|
// Fix-up archivability.
|
|
//
|
|
|
|
if (0 != (CRYPT_ARCHIVABLE & dwFlags))
|
|
{
|
|
pTmpKey->Rights |= CRYPT_ARCHIVABLE;
|
|
pTmpKey->Permissions |= CRYPT_ARCHIVE;
|
|
}
|
|
}
|
|
__except ( EXCEPTION_EXECUTE_HANDLER )
|
|
{
|
|
dwReturn = ERROR_INVALID_PARAMETER;
|
|
goto ErrorExit;
|
|
}
|
|
|
|
dwReturn = ERROR_SUCCESS;
|
|
|
|
ErrorExit:
|
|
if (fInCritSec)
|
|
LeaveCriticalSection(&pOurUser->CritSec);
|
|
if (fAlloc)
|
|
{
|
|
if (pNewPrivKey)
|
|
_nt_free(pNewPrivKey, PrivateKeySize);
|
|
if (pNewPubKey)
|
|
_nt_free(pNewPubKey, PublicKeySize);
|
|
}
|
|
return dwReturn;
|
|
}
|
|
|
|
|
|
//
|
|
// Routine : DerivePublicFromPrivate
|
|
//
|
|
// Description : Derive the public RSA key from the private RSA key. This is
|
|
// done and the resulting public key is placed in the appropriate
|
|
// place in the context pointer (pTmpUser).
|
|
//
|
|
|
|
DWORD
|
|
DerivePublicFromPrivate(
|
|
IN PNTAGUserList pUser,
|
|
IN BOOL fSigKey)
|
|
{
|
|
DWORD dwReturn = ERROR_INTERNAL_ERROR;
|
|
DWORD *pcbPubKey;
|
|
BYTE **ppbPubKey = NULL;
|
|
BSAFE_PUB_KEY *pBSafePubKey;
|
|
BSAFE_PRV_KEY *pBSafePrivKey;
|
|
DWORD cb;
|
|
|
|
// variable assignments depending on if its sig or exch
|
|
if (fSigKey)
|
|
{
|
|
pcbPubKey = &pUser->ContInfo.ContLens.cbSigPub;
|
|
ppbPubKey = &pUser->ContInfo.pbSigPub;
|
|
pBSafePrivKey = (BSAFE_PRV_KEY*)pUser->pSigPrivKey;
|
|
}
|
|
else
|
|
{
|
|
pcbPubKey = &pUser->ContInfo.ContLens.cbExchPub;
|
|
ppbPubKey = &pUser->ContInfo.pbExchPub;
|
|
pBSafePrivKey = (BSAFE_PRV_KEY*)pUser->pExchPrivKey;
|
|
}
|
|
|
|
// figure out how much space is needed for the public key
|
|
cb = ((((pBSafePrivKey->bitlen >> 1) + 63) / 32) * 8); // 8 = 2 * DIGIT_BYTES (rsa_fast.h)
|
|
cb += sizeof(BSAFE_PUB_KEY);
|
|
|
|
// check if space has been alloced for the public key and if
|
|
// so is it large enough
|
|
if (cb > *pcbPubKey)
|
|
{
|
|
_nt_free(*ppbPubKey, *pcbPubKey);
|
|
*pcbPubKey = cb;
|
|
|
|
*ppbPubKey = _nt_malloc(*pcbPubKey);
|
|
if (NULL == *ppbPubKey)
|
|
{
|
|
dwReturn = ERROR_NOT_ENOUGH_MEMORY;
|
|
goto ErrorExit;
|
|
}
|
|
}
|
|
|
|
// copy over the public key components
|
|
pBSafePubKey = (BSAFE_PUB_KEY*)*ppbPubKey;
|
|
pBSafePubKey->magic = RSA1;
|
|
pBSafePubKey->keylen = pBSafePrivKey->keylen;
|
|
pBSafePubKey->bitlen = pBSafePrivKey->bitlen;
|
|
pBSafePubKey->datalen = pBSafePrivKey->datalen;
|
|
pBSafePubKey->pubexp = pBSafePrivKey->pubexp;
|
|
memcpy(*ppbPubKey + sizeof(BSAFE_PUB_KEY),
|
|
(BYTE*)pBSafePrivKey + sizeof(BSAFE_PRV_KEY),
|
|
cb - sizeof(BSAFE_PUB_KEY));
|
|
|
|
dwReturn = ERROR_SUCCESS;
|
|
|
|
ErrorExit:
|
|
return dwReturn;
|
|
}
|
|
|