Line data Source code
1 : /* pubkey-enc.c - Process a public key encoded packet.
2 : * Copyright (C) 1998, 1999, 2000, 2001, 2002, 2006, 2009,
3 : * 2010 Free Software Foundation, Inc.
4 : *
5 : * This file is part of GnuPG.
6 : *
7 : * GnuPG is free software; you can redistribute it and/or modify
8 : * it under the terms of the GNU General Public License as published by
9 : * the Free Software Foundation; either version 3 of the License, or
10 : * (at your option) any later version.
11 : *
12 : * GnuPG is distributed in the hope that it will be useful,
13 : * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 : * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 : * GNU General Public License for more details.
16 : *
17 : * You should have received a copy of the GNU General Public License
18 : * along with this program; if not, see <http://www.gnu.org/licenses/>.
19 : */
20 :
21 : #include <config.h>
22 : #include <stdio.h>
23 : #include <stdlib.h>
24 : #include <string.h>
25 : #include <assert.h>
26 :
27 : #include "gpg.h"
28 : #include "util.h"
29 : #include "packet.h"
30 : #include "keydb.h"
31 : #include "trustdb.h"
32 : #include "status.h"
33 : #include "options.h"
34 : #include "main.h"
35 : #include "i18n.h"
36 : #include "pkglue.h"
37 : #include "call-agent.h"
38 : #include "host2net.h"
39 :
40 :
41 : static gpg_error_t get_it (PKT_pubkey_enc *k,
42 : DEK *dek, PKT_public_key *sk, u32 *keyid);
43 :
44 :
45 : /* Check that the given algo is mentioned in one of the valid user-ids. */
46 : static int
47 233 : is_algo_in_prefs (kbnode_t keyblock, preftype_t type, int algo)
48 : {
49 : kbnode_t k;
50 :
51 830 : for (k = keyblock; k; k = k->next)
52 : {
53 739 : if (k->pkt->pkttype == PKT_USER_ID)
54 : {
55 233 : PKT_user_id *uid = k->pkt->pkt.user_id;
56 233 : prefitem_t *prefs = uid->prefs;
57 :
58 233 : if (uid->created && prefs && !uid->is_revoked && !uid->is_expired)
59 : {
60 835 : for (; prefs->type; prefs++)
61 744 : if (prefs->type == type && prefs->value == algo)
62 142 : return 1;
63 : }
64 : }
65 : }
66 91 : return 0;
67 : }
68 :
69 :
70 : /*
71 : * Get the session key from a pubkey enc packet and return it in DEK,
72 : * which should have been allocated in secure memory by the caller.
73 : */
74 : gpg_error_t
75 252 : get_session_key (ctrl_t ctrl, PKT_pubkey_enc * k, DEK * dek)
76 : {
77 252 : PKT_public_key *sk = NULL;
78 : int rc;
79 :
80 252 : if (DBG_CLOCK)
81 0 : log_clock ("get_session_key enter");
82 :
83 252 : rc = openpgp_pk_test_algo2 (k->pubkey_algo, PUBKEY_USAGE_ENC);
84 252 : if (rc)
85 0 : goto leave;
86 :
87 252 : if ((k->keyid[0] || k->keyid[1]) && !opt.try_all_secrets)
88 : {
89 252 : sk = xmalloc_clear (sizeof *sk);
90 252 : sk->pubkey_algo = k->pubkey_algo; /* We want a pubkey with this algo. */
91 504 : if (!(rc = get_seckey (sk, k->keyid)))
92 252 : rc = get_it (k, dek, sk, k->keyid);
93 : }
94 0 : else if (opt.skip_hidden_recipients)
95 0 : rc = gpg_error (GPG_ERR_NO_SECKEY);
96 : else /* Anonymous receiver: Try all available secret keys. */
97 : {
98 0 : void *enum_context = NULL;
99 : u32 keyid[2];
100 :
101 : for (;;)
102 : {
103 0 : free_public_key (sk);
104 0 : sk = xmalloc_clear (sizeof *sk);
105 0 : rc = enum_secret_keys (ctrl, &enum_context, sk);
106 0 : if (rc)
107 : {
108 0 : rc = GPG_ERR_NO_SECKEY;
109 0 : break;
110 : }
111 0 : if (sk->pubkey_algo != k->pubkey_algo)
112 0 : continue;
113 0 : if (!(sk->pubkey_usage & PUBKEY_USAGE_ENC))
114 0 : continue;
115 0 : keyid_from_pk (sk, keyid);
116 0 : if (!opt.quiet)
117 0 : log_info (_("anonymous recipient; trying secret key %s ...\n"),
118 : keystr (keyid));
119 :
120 0 : rc = get_it (k, dek, sk, keyid);
121 0 : if (!rc)
122 : {
123 0 : if (!opt.quiet)
124 0 : log_info (_("okay, we are the anonymous recipient.\n"));
125 0 : break;
126 : }
127 0 : else if (gpg_err_code (rc) == GPG_ERR_FULLY_CANCELED)
128 0 : break; /* Don't try any more secret keys. */
129 0 : }
130 0 : enum_secret_keys (ctrl, &enum_context, NULL); /* free context */
131 : }
132 :
133 : leave:
134 252 : free_public_key (sk);
135 252 : if (DBG_CLOCK)
136 0 : log_clock ("get_session_key leave");
137 252 : return rc;
138 : }
139 :
140 :
141 : static gpg_error_t
142 252 : get_it (PKT_pubkey_enc *enc, DEK *dek, PKT_public_key *sk, u32 *keyid)
143 : {
144 : gpg_error_t err;
145 252 : byte *frame = NULL;
146 : unsigned int n;
147 : size_t nframe;
148 : u16 csum, csum2;
149 : int padding;
150 : gcry_sexp_t s_data;
151 : char *desc;
152 : char *keygrip;
153 : byte fp[MAX_FINGERPRINT_LEN];
154 : size_t fpn;
155 :
156 252 : if (DBG_CLOCK)
157 0 : log_clock ("decryption start");
158 :
159 : /* Get the keygrip. */
160 252 : err = hexkeygrip_from_pk (sk, &keygrip);
161 252 : if (err)
162 0 : goto leave;
163 :
164 : /* Convert the data to an S-expression. */
165 252 : if (sk->pubkey_algo == PUBKEY_ALGO_ELGAMAL
166 252 : || sk->pubkey_algo == PUBKEY_ALGO_ELGAMAL_E)
167 : {
168 456 : if (!enc->data[0] || !enc->data[1])
169 0 : err = gpg_error (GPG_ERR_BAD_MPI);
170 : else
171 228 : err = gcry_sexp_build (&s_data, NULL, "(enc-val(elg(a%m)(b%m)))",
172 : enc->data[0], enc->data[1]);
173 : }
174 24 : else if (sk->pubkey_algo == PUBKEY_ALGO_RSA
175 24 : || sk->pubkey_algo == PUBKEY_ALGO_RSA_E)
176 : {
177 0 : if (!enc->data[0])
178 0 : err = gpg_error (GPG_ERR_BAD_MPI);
179 : else
180 0 : err = gcry_sexp_build (&s_data, NULL, "(enc-val(rsa(a%m)))",
181 : enc->data[0]);
182 : }
183 24 : else if (sk->pubkey_algo == PUBKEY_ALGO_ECDH)
184 : {
185 24 : if (!enc->data[0] || !enc->data[1])
186 0 : err = gpg_error (GPG_ERR_BAD_MPI);
187 : else
188 24 : err = gcry_sexp_build (&s_data, NULL, "(enc-val(ecdh(s%m)(e%m)))",
189 : enc->data[1], enc->data[0]);
190 : }
191 : else
192 0 : err = gpg_error (GPG_ERR_BUG);
193 :
194 252 : if (err)
195 0 : goto leave;
196 :
197 252 : if (sk->pubkey_algo == PUBKEY_ALGO_ECDH)
198 : {
199 24 : fingerprint_from_pk (sk, fp, &fpn);
200 24 : assert (fpn == 20);
201 : }
202 :
203 : /* Decrypt. */
204 252 : desc = gpg_format_keydesc (sk, FORMAT_KEYDESC_NORMAL, 1);
205 756 : err = agent_pkdecrypt (NULL, keygrip,
206 504 : desc, sk->keyid, sk->main_keyid, sk->pubkey_algo,
207 : s_data, &frame, &nframe, &padding);
208 252 : xfree (desc);
209 252 : gcry_sexp_release (s_data);
210 252 : if (err)
211 0 : goto leave;
212 :
213 : /* Now get the DEK (data encryption key) from the frame
214 : *
215 : * Old versions encode the DEK in in this format (msb is left):
216 : *
217 : * 0 1 DEK(16 bytes) CSUM(2 bytes) 0 RND(n bytes) 2
218 : *
219 : * Later versions encode the DEK like this:
220 : *
221 : * 0 2 RND(n bytes) 0 A DEK(k bytes) CSUM(2 bytes)
222 : *
223 : * (mpi_get_buffer already removed the leading zero).
224 : *
225 : * RND are non-zero randow bytes.
226 : * A is the cipher algorithm
227 : * DEK is the encryption key (session key) with length k
228 : * CSUM
229 : */
230 252 : if (DBG_CRYPTO)
231 0 : log_printhex ("DEK frame:", frame, nframe);
232 252 : n = 0;
233 :
234 252 : if (sk->pubkey_algo == PUBKEY_ALGO_ECDH)
235 : {
236 : gcry_mpi_t shared_mpi;
237 : gcry_mpi_t decoded;
238 :
239 : /* At the beginning the frame are the bytes of shared point MPI. */
240 24 : err = gcry_mpi_scan (&shared_mpi, GCRYMPI_FMT_USG, frame, nframe, NULL);
241 24 : if (err)
242 : {
243 0 : err = gpg_error (GPG_ERR_WRONG_SECKEY);
244 0 : goto leave;
245 : }
246 :
247 24 : err = pk_ecdh_decrypt (&decoded, fp, enc->data[1]/*encr data as an MPI*/,
248 24 : shared_mpi, sk->pkey);
249 24 : mpi_release (shared_mpi);
250 24 : if(err)
251 0 : goto leave;
252 :
253 24 : xfree (frame);
254 24 : err = gcry_mpi_aprint (GCRYMPI_FMT_USG, &frame, &nframe, decoded);
255 24 : mpi_release (decoded);
256 24 : if (err)
257 0 : goto leave;
258 :
259 : /* Now the frame are the bytes decrypted but padded session key. */
260 :
261 : /* Allow double padding for the benefit of DEK size concealment.
262 : Higher than this is wasteful. */
263 24 : if (!nframe || frame[nframe-1] > 8*2 || nframe <= 8
264 24 : || frame[nframe-1] > nframe)
265 : {
266 0 : err = gpg_error (GPG_ERR_WRONG_SECKEY);
267 0 : goto leave;
268 : }
269 24 : nframe -= frame[nframe-1]; /* Remove padding. */
270 24 : assert (!n); /* (used just below) */
271 : }
272 : else
273 : {
274 228 : if (padding)
275 : {
276 228 : if (n + 7 > nframe)
277 : {
278 0 : err = gpg_error (GPG_ERR_WRONG_SECKEY);
279 0 : goto leave;
280 : }
281 228 : if (frame[n] == 1 && frame[nframe - 1] == 2)
282 : {
283 0 : log_info (_("old encoding of the DEK is not supported\n"));
284 0 : err = gpg_error (GPG_ERR_CIPHER_ALGO);
285 0 : goto leave;
286 : }
287 228 : if (frame[n] != 2) /* Something went wrong. */
288 : {
289 0 : err = gpg_error (GPG_ERR_WRONG_SECKEY);
290 0 : goto leave;
291 : }
292 228 : for (n++; n < nframe && frame[n]; n++) /* Skip the random bytes. */
293 : ;
294 228 : n++; /* Skip the zero byte. */
295 : }
296 : }
297 :
298 252 : if (n + 4 > nframe)
299 : {
300 0 : err = gpg_error (GPG_ERR_WRONG_SECKEY);
301 0 : goto leave;
302 : }
303 :
304 252 : dek->keylen = nframe - (n + 1) - 2;
305 252 : dek->algo = frame[n++];
306 252 : err = openpgp_cipher_test_algo (dek->algo);
307 252 : if (err)
308 : {
309 0 : if (!opt.quiet && gpg_err_code (err) == GPG_ERR_CIPHER_ALGO)
310 : {
311 0 : log_info (_("cipher algorithm %d%s is unknown or disabled\n"),
312 : dek->algo,
313 0 : dek->algo == CIPHER_ALGO_IDEA ? " (IDEA)" : "");
314 : }
315 0 : dek->algo = 0;
316 0 : goto leave;
317 : }
318 252 : if (dek->keylen != openpgp_cipher_get_algo_keylen (dek->algo))
319 : {
320 0 : err = gpg_error (GPG_ERR_WRONG_SECKEY);
321 0 : goto leave;
322 : }
323 :
324 : /* Copy the key to DEK and compare the checksum. */
325 252 : csum = buf16_to_u16 (frame+nframe-2);
326 252 : memcpy (dek->key, frame + n, dek->keylen);
327 6564 : for (csum2 = 0, n = 0; n < dek->keylen; n++)
328 6312 : csum2 += dek->key[n];
329 252 : if (csum != csum2)
330 : {
331 0 : err = gpg_error (GPG_ERR_WRONG_SECKEY);
332 0 : goto leave;
333 : }
334 252 : if (DBG_CLOCK)
335 0 : log_clock ("decryption ready");
336 252 : if (DBG_CRYPTO)
337 0 : log_printhex ("DEK is:", dek->key, dek->keylen);
338 :
339 : /* Check that the algo is in the preferences and whether it has expired. */
340 : {
341 252 : PKT_public_key *pk = NULL;
342 252 : KBNODE pkb = get_pubkeyblock (keyid);
343 :
344 252 : if (!pkb)
345 : {
346 0 : err = -1;
347 0 : log_error ("oops: public key not found for preference check\n");
348 : }
349 252 : else if (pkb->pkt->pkt.public_key->selfsigversion > 3
350 252 : && dek->algo != CIPHER_ALGO_3DES
351 233 : && !opt.quiet
352 233 : && !is_algo_in_prefs (pkb, PREFTYPE_SYM, dek->algo))
353 91 : log_info (_("WARNING: cipher algorithm %s not found in recipient"
354 91 : " preferences\n"), openpgp_cipher_algo_name (dek->algo));
355 252 : if (!err)
356 : {
357 : KBNODE k;
358 :
359 1017 : for (k = pkb; k; k = k->next)
360 : {
361 1017 : if (k->pkt->pkttype == PKT_PUBLIC_KEY
362 765 : || k->pkt->pkttype == PKT_PUBLIC_SUBKEY)
363 : {
364 : u32 aki[2];
365 504 : keyid_from_pk (k->pkt->pkt.public_key, aki);
366 :
367 504 : if (aki[0] == keyid[0] && aki[1] == keyid[1])
368 : {
369 252 : pk = k->pkt->pkt.public_key;
370 252 : break;
371 : }
372 : }
373 : }
374 252 : if (!pk)
375 0 : BUG ();
376 252 : if (pk->expiredate && pk->expiredate <= make_timestamp ())
377 : {
378 0 : log_info (_("Note: secret key %s expired at %s\n"),
379 : keystr (keyid), asctimestamp (pk->expiredate));
380 : }
381 : }
382 :
383 252 : if (pk && pk->flags.revoked)
384 : {
385 0 : log_info (_("Note: key has been revoked"));
386 0 : log_printf ("\n");
387 0 : show_revocation_reason (pk, 1);
388 : }
389 :
390 252 : release_kbnode (pkb);
391 252 : err = 0;
392 : }
393 :
394 : leave:
395 252 : xfree (frame);
396 252 : xfree (keygrip);
397 252 : return err;
398 : }
399 :
400 :
401 : /*
402 : * Get the session key from the given string.
403 : * String is supposed to be formatted as this:
404 : * <algo-id>:<even-number-of-hex-digits>
405 : */
406 : gpg_error_t
407 0 : get_override_session_key (DEK *dek, const char *string)
408 : {
409 : const char *s;
410 : int i;
411 :
412 0 : if (!string)
413 0 : return GPG_ERR_BAD_KEY;
414 0 : dek->algo = atoi (string);
415 0 : if (dek->algo < 1)
416 0 : return GPG_ERR_BAD_KEY;
417 0 : if (!(s = strchr (string, ':')))
418 0 : return GPG_ERR_BAD_KEY;
419 0 : s++;
420 0 : for (i = 0; i < DIM (dek->key) && *s; i++, s += 2)
421 : {
422 0 : int c = hextobyte (s);
423 0 : if (c == -1)
424 0 : return GPG_ERR_BAD_KEY;
425 0 : dek->key[i] = c;
426 : }
427 0 : if (*s)
428 0 : return GPG_ERR_BAD_KEY;
429 0 : dek->keylen = i;
430 0 : return 0;
431 : }
|
