LCOV - code coverage report
Current view: top level - g10 - pubkey-enc.c (source / functions) Hit Total Coverage
Test: coverage.info Lines: 110 198 55.6 %
Date: 2016-11-29 15:00:56 Functions: 3 4 75.0 %

          Line data    Source code
       1             : /* pubkey-enc.c - Process a public key encoded packet.
       2             :  * Copyright (C) 1998, 1999, 2000, 2001, 2002, 2006, 2009,
       3             :  *               2010 Free Software Foundation, Inc.
       4             :  *
       5             :  * This file is part of GnuPG.
       6             :  *
       7             :  * GnuPG is free software; you can redistribute it and/or modify
       8             :  * it under the terms of the GNU General Public License as published by
       9             :  * the Free Software Foundation; either version 3 of the License, or
      10             :  * (at your option) any later version.
      11             :  *
      12             :  * GnuPG is distributed in the hope that it will be useful,
      13             :  * but WITHOUT ANY WARRANTY; without even the implied warranty of
      14             :  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
      15             :  * GNU General Public License for more details.
      16             :  *
      17             :  * You should have received a copy of the GNU General Public License
      18             :  * along with this program; if not, see <https://www.gnu.org/licenses/>.
      19             :  */
      20             : 
      21             : #include <config.h>
      22             : #include <stdio.h>
      23             : #include <stdlib.h>
      24             : #include <string.h>
      25             : 
      26             : #include "gpg.h"
      27             : #include "util.h"
      28             : #include "packet.h"
      29             : #include "keydb.h"
      30             : #include "trustdb.h"
      31             : #include "status.h"
      32             : #include "options.h"
      33             : #include "main.h"
      34             : #include "i18n.h"
      35             : #include "pkglue.h"
      36             : #include "call-agent.h"
      37             : #include "host2net.h"
      38             : 
      39             : 
      40             : static gpg_error_t get_it (PKT_pubkey_enc *k,
      41             :                            DEK *dek, PKT_public_key *sk, u32 *keyid);
      42             : 
      43             : 
      44             : /* Check that the given algo is mentioned in one of the valid user-ids. */
      45             : static int
      46         240 : is_algo_in_prefs (kbnode_t keyblock, preftype_t type, int algo)
      47             : {
      48             :   kbnode_t k;
      49             : 
      50         844 :   for (k = keyblock; k; k = k->next)
      51             :     {
      52         753 :       if (k->pkt->pkttype == PKT_USER_ID)
      53             :         {
      54         240 :           PKT_user_id *uid = k->pkt->pkt.user_id;
      55         240 :           prefitem_t *prefs = uid->prefs;
      56             : 
      57         240 :           if (uid->created && prefs && !uid->is_revoked && !uid->is_expired)
      58             :             {
      59         842 :               for (; prefs->type; prefs++)
      60         751 :                 if (prefs->type == type && prefs->value == algo)
      61         149 :                   return 1;
      62             :             }
      63             :         }
      64             :     }
      65          91 :   return 0;
      66             : }
      67             : 
      68             : 
      69             : /*
      70             :  * Get the session key from a pubkey enc packet and return it in DEK,
      71             :  * which should have been allocated in secure memory by the caller.
      72             :  */
      73             : gpg_error_t
      74         262 : get_session_key (ctrl_t ctrl, PKT_pubkey_enc * k, DEK * dek)
      75             : {
      76         262 :   PKT_public_key *sk = NULL;
      77             :   int rc;
      78             : 
      79         262 :   if (DBG_CLOCK)
      80           0 :     log_clock ("get_session_key enter");
      81             : 
      82         262 :   rc = openpgp_pk_test_algo2 (k->pubkey_algo, PUBKEY_USAGE_ENC);
      83         262 :   if (rc)
      84           0 :     goto leave;
      85             : 
      86         262 :   if ((k->keyid[0] || k->keyid[1]) && !opt.try_all_secrets)
      87             :     {
      88         262 :       sk = xmalloc_clear (sizeof *sk);
      89         262 :       sk->pubkey_algo = k->pubkey_algo; /* We want a pubkey with this algo.  */
      90         524 :       if (!(rc = get_seckey (sk, k->keyid)))
      91         262 :         rc = get_it (k, dek, sk, k->keyid);
      92             :     }
      93           0 :   else if (opt.skip_hidden_recipients)
      94           0 :     rc = gpg_error (GPG_ERR_NO_SECKEY);
      95             :   else  /* Anonymous receiver: Try all available secret keys.  */
      96             :     {
      97           0 :       void *enum_context = NULL;
      98             :       u32 keyid[2];
      99             : 
     100             :       for (;;)
     101             :         {
     102           0 :           free_public_key (sk);
     103           0 :           sk = xmalloc_clear (sizeof *sk);
     104           0 :           rc = enum_secret_keys (ctrl, &enum_context, sk);
     105           0 :           if (rc)
     106             :             {
     107           0 :               rc = GPG_ERR_NO_SECKEY;
     108           0 :               break;
     109             :             }
     110           0 :           if (sk->pubkey_algo != k->pubkey_algo)
     111           0 :             continue;
     112           0 :           if (!(sk->pubkey_usage & PUBKEY_USAGE_ENC))
     113           0 :             continue;
     114           0 :           keyid_from_pk (sk, keyid);
     115           0 :           if (!opt.quiet)
     116           0 :             log_info (_("anonymous recipient; trying secret key %s ...\n"),
     117             :                       keystr (keyid));
     118             : 
     119           0 :           rc = get_it (k, dek, sk, keyid);
     120           0 :           if (!rc)
     121             :             {
     122           0 :               if (!opt.quiet)
     123           0 :                 log_info (_("okay, we are the anonymous recipient.\n"));
     124           0 :               break;
     125             :             }
     126           0 :           else if (gpg_err_code (rc) == GPG_ERR_FULLY_CANCELED)
     127           0 :             break; /* Don't try any more secret keys.  */
     128           0 :         }
     129           0 :       enum_secret_keys (ctrl, &enum_context, NULL);  /* free context */
     130             :     }
     131             : 
     132             : leave:
     133         262 :   free_public_key (sk);
     134         262 :   if (DBG_CLOCK)
     135           0 :     log_clock ("get_session_key leave");
     136         262 :   return rc;
     137             : }
     138             : 
     139             : 
     140             : static gpg_error_t
     141         262 : get_it (PKT_pubkey_enc *enc, DEK *dek, PKT_public_key *sk, u32 *keyid)
     142             : {
     143             :   gpg_error_t err;
     144         262 :   byte *frame = NULL;
     145             :   unsigned int n;
     146             :   size_t nframe;
     147             :   u16 csum, csum2;
     148             :   int padding;
     149             :   gcry_sexp_t s_data;
     150             :   char *desc;
     151             :   char *keygrip;
     152             :   byte fp[MAX_FINGERPRINT_LEN];
     153             :   size_t fpn;
     154             : 
     155         262 :   if (DBG_CLOCK)
     156           0 :     log_clock ("decryption start");
     157             : 
     158             :   /* Get the keygrip.  */
     159         262 :   err = hexkeygrip_from_pk (sk, &keygrip);
     160         262 :   if (err)
     161           0 :     goto leave;
     162             : 
     163             :   /* Convert the data to an S-expression.  */
     164         262 :   if (sk->pubkey_algo == PUBKEY_ALGO_ELGAMAL
     165         262 :       || sk->pubkey_algo == PUBKEY_ALGO_ELGAMAL_E)
     166             :     {
     167         470 :       if (!enc->data[0] || !enc->data[1])
     168           0 :         err = gpg_error (GPG_ERR_BAD_MPI);
     169             :       else
     170         235 :         err = gcry_sexp_build (&s_data, NULL, "(enc-val(elg(a%m)(b%m)))",
     171             :                                enc->data[0], enc->data[1]);
     172             :     }
     173          27 :   else if (sk->pubkey_algo == PUBKEY_ALGO_RSA
     174          24 :            || sk->pubkey_algo == PUBKEY_ALGO_RSA_E)
     175             :     {
     176           6 :       if (!enc->data[0])
     177           0 :         err = gpg_error (GPG_ERR_BAD_MPI);
     178             :       else
     179           3 :         err = gcry_sexp_build (&s_data, NULL, "(enc-val(rsa(a%m)))",
     180             :                                enc->data[0]);
     181             :     }
     182          24 :   else if (sk->pubkey_algo == PUBKEY_ALGO_ECDH)
     183             :     {
     184          24 :       if (!enc->data[0] || !enc->data[1])
     185           0 :         err = gpg_error (GPG_ERR_BAD_MPI);
     186             :       else
     187          24 :         err = gcry_sexp_build (&s_data, NULL, "(enc-val(ecdh(s%m)(e%m)))",
     188             :                                enc->data[1], enc->data[0]);
     189             :     }
     190             :   else
     191           0 :     err = gpg_error (GPG_ERR_BUG);
     192             : 
     193         262 :   if (err)
     194           0 :     goto leave;
     195             : 
     196         262 :   if (sk->pubkey_algo == PUBKEY_ALGO_ECDH)
     197             :     {
     198          24 :       fingerprint_from_pk (sk, fp, &fpn);
     199          24 :       log_assert (fpn == 20);
     200             :     }
     201             : 
     202             :   /* Decrypt. */
     203         262 :   desc = gpg_format_keydesc (sk, FORMAT_KEYDESC_NORMAL, 1);
     204         786 :   err = agent_pkdecrypt (NULL, keygrip,
     205         524 :                          desc, sk->keyid, sk->main_keyid, sk->pubkey_algo,
     206             :                          s_data, &frame, &nframe, &padding);
     207         262 :   xfree (desc);
     208         262 :   gcry_sexp_release (s_data);
     209         262 :   if (err)
     210           0 :     goto leave;
     211             : 
     212             :   /* Now get the DEK (data encryption key) from the frame
     213             :    *
     214             :    * Old versions encode the DEK in in this format (msb is left):
     215             :    *
     216             :    *     0  1  DEK(16 bytes)  CSUM(2 bytes)  0  RND(n bytes) 2
     217             :    *
     218             :    * Later versions encode the DEK like this:
     219             :    *
     220             :    *     0  2  RND(n bytes)  0  A  DEK(k bytes)  CSUM(2 bytes)
     221             :    *
     222             :    * (mpi_get_buffer already removed the leading zero).
     223             :    *
     224             :    * RND are non-zero randow bytes.
     225             :    * A   is the cipher algorithm
     226             :    * DEK is the encryption key (session key) with length k
     227             :    * CSUM
     228             :    */
     229         262 :   if (DBG_CRYPTO)
     230           0 :     log_printhex ("DEK frame:", frame, nframe);
     231         262 :   n = 0;
     232             : 
     233         262 :   if (sk->pubkey_algo == PUBKEY_ALGO_ECDH)
     234             :     {
     235             :       gcry_mpi_t shared_mpi;
     236             :       gcry_mpi_t decoded;
     237             : 
     238             :       /* At the beginning the frame are the bytes of shared point MPI.  */
     239          24 :       err = gcry_mpi_scan (&shared_mpi, GCRYMPI_FMT_USG, frame, nframe, NULL);
     240          24 :       if (err)
     241             :         {
     242           0 :           err = gpg_error (GPG_ERR_WRONG_SECKEY);
     243           0 :           goto leave;
     244             :         }
     245             : 
     246          24 :       err = pk_ecdh_decrypt (&decoded, fp, enc->data[1]/*encr data as an MPI*/,
     247          24 :                              shared_mpi, sk->pkey);
     248          24 :       mpi_release (shared_mpi);
     249          24 :       if(err)
     250           0 :         goto leave;
     251             : 
     252          24 :       xfree (frame);
     253          24 :       err = gcry_mpi_aprint (GCRYMPI_FMT_USG, &frame, &nframe, decoded);
     254          24 :       mpi_release (decoded);
     255          24 :       if (err)
     256           0 :         goto leave;
     257             : 
     258             :       /* Now the frame are the bytes decrypted but padded session key.  */
     259             : 
     260             :       /* Allow double padding for the benefit of DEK size concealment.
     261             :          Higher than this is wasteful. */
     262          24 :       if (!nframe || frame[nframe-1] > 8*2 || nframe <= 8
     263          24 :           || frame[nframe-1] > nframe)
     264             :         {
     265           0 :           err = gpg_error (GPG_ERR_WRONG_SECKEY);
     266           0 :           goto leave;
     267             :         }
     268          24 :       nframe -= frame[nframe-1]; /* Remove padding.  */
     269          24 :       log_assert (!n); /* (used just below) */
     270             :     }
     271             :   else
     272             :     {
     273         238 :       if (padding)
     274             :         {
     275         238 :           if (n + 7 > nframe)
     276             :             {
     277           0 :               err = gpg_error (GPG_ERR_WRONG_SECKEY);
     278           0 :               goto leave;
     279             :             }
     280         238 :           if (frame[n] == 1 && frame[nframe - 1] == 2)
     281             :             {
     282           0 :               log_info (_("old encoding of the DEK is not supported\n"));
     283           0 :               err = gpg_error (GPG_ERR_CIPHER_ALGO);
     284           0 :               goto leave;
     285             :             }
     286         238 :           if (frame[n] != 2) /* Something went wrong.  */
     287             :             {
     288           0 :               err = gpg_error (GPG_ERR_WRONG_SECKEY);
     289           0 :               goto leave;
     290             :             }
     291         238 :           for (n++; n < nframe && frame[n]; n++) /* Skip the random bytes.  */
     292             :             ;
     293         238 :           n++; /* Skip the zero byte.  */
     294             :         }
     295             :     }
     296             : 
     297         262 :   if (n + 4 > nframe)
     298             :     {
     299           0 :       err = gpg_error (GPG_ERR_WRONG_SECKEY);
     300           0 :       goto leave;
     301             :     }
     302             : 
     303         262 :   dek->keylen = nframe - (n + 1) - 2;
     304         262 :   dek->algo = frame[n++];
     305         262 :   err = openpgp_cipher_test_algo (dek->algo);
     306         262 :   if (err)
     307             :     {
     308           0 :       if (!opt.quiet && gpg_err_code (err) == GPG_ERR_CIPHER_ALGO)
     309             :         {
     310           0 :           log_info (_("cipher algorithm %d%s is unknown or disabled\n"),
     311             :                     dek->algo,
     312           0 :                     dek->algo == CIPHER_ALGO_IDEA ? " (IDEA)" : "");
     313             :         }
     314           0 :       dek->algo = 0;
     315           0 :       goto leave;
     316             :     }
     317         262 :   if (dek->keylen != openpgp_cipher_get_algo_keylen (dek->algo))
     318             :     {
     319           0 :       err = gpg_error (GPG_ERR_WRONG_SECKEY);
     320           0 :       goto leave;
     321             :     }
     322             : 
     323             :   /* Copy the key to DEK and compare the checksum.  */
     324         262 :   csum = buf16_to_u16 (frame+nframe-2);
     325         262 :   memcpy (dek->key, frame + n, dek->keylen);
     326        6790 :   for (csum2 = 0, n = 0; n < dek->keylen; n++)
     327        6528 :     csum2 += dek->key[n];
     328         262 :   if (csum != csum2)
     329             :     {
     330           0 :       err = gpg_error (GPG_ERR_WRONG_SECKEY);
     331           0 :       goto leave;
     332             :     }
     333         262 :   if (DBG_CLOCK)
     334           0 :     log_clock ("decryption ready");
     335         262 :   if (DBG_CRYPTO)
     336           0 :     log_printhex ("DEK is:", dek->key, dek->keylen);
     337             : 
     338             :   /* Check that the algo is in the preferences and whether it has expired.  */
     339             :   {
     340         262 :     PKT_public_key *pk = NULL;
     341         262 :     KBNODE pkb = get_pubkeyblock (keyid);
     342             : 
     343         262 :     if (!pkb)
     344             :       {
     345           0 :         err = -1;
     346           0 :         log_error ("oops: public key not found for preference check\n");
     347             :       }
     348         262 :     else if (pkb->pkt->pkt.public_key->selfsigversion > 3
     349         262 :              && dek->algo != CIPHER_ALGO_3DES
     350         240 :              && !opt.quiet
     351         240 :              && !is_algo_in_prefs (pkb, PREFTYPE_SYM, dek->algo))
     352          91 :       log_info (_("WARNING: cipher algorithm %s not found in recipient"
     353          91 :                   " preferences\n"), openpgp_cipher_algo_name (dek->algo));
     354         262 :     if (!err)
     355             :       {
     356             :         KBNODE k;
     357             : 
     358        1060 :         for (k = pkb; k; k = k->next)
     359             :           {
     360        1060 :             if (k->pkt->pkttype == PKT_PUBLIC_KEY
     361         798 :                 || k->pkt->pkttype == PKT_PUBLIC_SUBKEY)
     362             :               {
     363             :                 u32 aki[2];
     364         524 :                 keyid_from_pk (k->pkt->pkt.public_key, aki);
     365             : 
     366         524 :                 if (aki[0] == keyid[0] && aki[1] == keyid[1])
     367             :                   {
     368         262 :                     pk = k->pkt->pkt.public_key;
     369         262 :                     break;
     370             :                   }
     371             :               }
     372             :           }
     373         262 :         if (!pk)
     374           0 :           BUG ();
     375         262 :         if (pk->expiredate && pk->expiredate <= make_timestamp ())
     376             :           {
     377           0 :             log_info (_("Note: secret key %s expired at %s\n"),
     378             :                       keystr (keyid), asctimestamp (pk->expiredate));
     379             :           }
     380             :       }
     381             : 
     382         262 :     if (pk && pk->flags.revoked)
     383             :       {
     384           0 :         log_info (_("Note: key has been revoked"));
     385           0 :         log_printf ("\n");
     386           0 :         show_revocation_reason (pk, 1);
     387             :       }
     388             : 
     389         262 :     release_kbnode (pkb);
     390         262 :     err = 0;
     391             :   }
     392             : 
     393             :  leave:
     394         262 :   xfree (frame);
     395         262 :   xfree (keygrip);
     396         262 :   return err;
     397             : }
     398             : 
     399             : 
     400             : /*
     401             :  * Get the session key from the given string.
     402             :  * String is supposed to be formatted as this:
     403             :  *  <algo-id>:<even-number-of-hex-digits>
     404             :  */
     405             : gpg_error_t
     406           0 : get_override_session_key (DEK *dek, const char *string)
     407             : {
     408             :   const char *s;
     409             :   int i;
     410             : 
     411           0 :   if (!string)
     412           0 :     return GPG_ERR_BAD_KEY;
     413           0 :   dek->algo = atoi (string);
     414           0 :   if (dek->algo < 1)
     415           0 :     return GPG_ERR_BAD_KEY;
     416           0 :   if (!(s = strchr (string, ':')))
     417           0 :     return GPG_ERR_BAD_KEY;
     418           0 :   s++;
     419           0 :   for (i = 0; i < DIM (dek->key) && *s; i++, s += 2)
     420             :     {
     421           0 :       int c = hextobyte (s);
     422           0 :       if (c == -1)
     423           0 :         return GPG_ERR_BAD_KEY;
     424           0 :       dek->key[i] = c;
     425             :     }
     426           0 :   if (*s)
     427           0 :     return GPG_ERR_BAD_KEY;
     428           0 :   dek->keylen = i;
     429           0 :   return 0;
     430             : }

Generated by: LCOV version 1.11