18 #include <openssl/ssl.h>
19 #include <openssl/engine.h>
20 #include <openssl/rand.h>
54 key_list->
_keys = NULL;
100 k->
_key.
key = ENGINE_load_private_key(e, key_id, UI_OpenSSL(), NULL);
118 ENGINE* ldns_gost_engine = NULL;
123 static int gost_id = 0;
124 const EVP_PKEY_ASN1_METHOD* meth;
127 if(gost_id)
return gost_id;
130 meth = EVP_PKEY_asn1_find_str(NULL,
"gost2001", -1);
132 EVP_PKEY_asn1_get0_info(&gost_id, NULL, NULL, NULL, NULL, meth);
137 e = ENGINE_by_id(
"gost");
140 ENGINE_load_builtin_engines();
141 ENGINE_load_dynamic();
142 e = ENGINE_by_id(
"gost");
148 if(!ENGINE_set_default(e, ENGINE_METHOD_ALL)) {
154 meth = EVP_PKEY_asn1_find_str(&e,
"gost2001", -1);
163 ldns_gost_engine = e;
165 EVP_PKEY_asn1_get0_info(&gost_id, NULL, NULL, NULL, NULL, meth);
171 if(ldns_gost_engine) {
172 ENGINE_finish(ldns_gost_engine);
173 ENGINE_free(ldns_gost_engine);
174 ldns_gost_engine = NULL;
180 ldns_key_new_frm_fp_gost_l(FILE* fp,
int* line_nr)
183 const unsigned char* pp;
193 sizeof(token), line_nr) == -1)
195 while(strlen(token) < 96) {
198 sizeof(token)-strlen(token), line_nr) == -1)
204 pkey = d2i_PrivateKey(gost_id, NULL, &pp, (
int)
ldns_rdf_size(b64rdf));
213 ldns_EC_KEY_calc_public(EC_KEY* ec)
216 const EC_GROUP* group;
217 group = EC_KEY_get0_group(ec);
218 pub_key = EC_POINT_new(group);
219 if(!pub_key)
return 0;
220 if(!EC_POINT_copy(pub_key, EC_GROUP_get0_generator(group))) {
221 EC_POINT_free(pub_key);
224 if(!EC_POINT_mul(group, pub_key, EC_KEY_get0_private_key(ec),
226 EC_POINT_free(pub_key);
229 if(EC_KEY_set_public_key(ec, pub_key) == 0) {
230 EC_POINT_free(pub_key);
233 EC_POINT_free(pub_key);
239 ldns_key_new_frm_fp_ecdsa_l(FILE* fp,
ldns_algorithm alg,
int* line_nr)
248 sizeof(token), line_nr) == -1)
255 ec = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
257 ec = EC_KEY_new_by_curve_name(NID_secp384r1);
269 EC_KEY_set_private_key(ec, bn);
271 if(!ldns_EC_KEY_calc_public(ec)) {
276 evp_key = EVP_PKEY_new();
281 if (!EVP_PKEY_assign_EC_KEY(evp_key, ec)) {
282 EVP_PKEY_free(evp_key);
329 if (strncmp(d,
"v1.", 3) != 0) {
345 if (strncmp(d,
"1 RSA", 2) == 0) {
348 if (strncmp(d,
"2 DH", 2) == 0) {
351 if (strncmp(d,
"3 DSA", 2) == 0) {
354 if (strncmp(d,
"4 ECC", 2) == 0) {
357 if (strncmp(d,
"5 RSASHA1", 2) == 0) {
360 if (strncmp(d,
"6 DSA", 2) == 0) {
363 if (strncmp(d,
"7 RSASHA1", 2) == 0) {
367 if (strncmp(d,
"8 RSASHA256", 2) == 0) {
371 fprintf(stderr,
"Warning: SHA256 not compiled into this ");
372 fprintf(stderr,
"version of ldns\n");
375 if (strncmp(d,
"10 RSASHA512", 3) == 0) {
379 fprintf(stderr,
"Warning: SHA512 not compiled into this ");
380 fprintf(stderr,
"version of ldns\n");
383 if (strncmp(d,
"12 ECC-GOST", 3) == 0) {
387 fprintf(stderr,
"Warning: ECC-GOST not compiled into this ");
388 fprintf(stderr,
"version of ldns, use --enable-gost\n");
391 if (strncmp(d,
"13 ECDSAP256SHA256", 3) == 0) {
395 fprintf(stderr,
"Warning: ECDSA not compiled into this ");
396 fprintf(stderr,
"version of ldns, use --enable-ecdsa\n");
399 if (strncmp(d,
"14 ECDSAP384SHA384", 3) == 0) {
403 fprintf(stderr,
"Warning: ECDSA not compiled into this ");
404 fprintf(stderr,
"version of ldns, use --enable-ecdsa\n");
407 if (strncmp(d,
"157 HMAC-MD5", 4) == 0) {
410 if (strncmp(d,
"158 HMAC-SHA1", 4) == 0) {
413 if (strncmp(d,
"159 HMAC-SHA256", 4) == 0) {
465 #if defined(HAVE_SSL) && defined(USE_GOST)
471 ldns_key_new_frm_fp_gost_l(fp, line_nr));
553 if (!d || !rsa || !buf) {
565 i =
ldns_b64_pton((
const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
567 rsa->n = BN_bin2bn((
const char unsigned*)buf, i, NULL);
576 i =
ldns_b64_pton((
const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
577 rsa->e = BN_bin2bn((
const char unsigned*)buf, i, NULL);
586 i =
ldns_b64_pton((
const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
587 rsa->d = BN_bin2bn((
const char unsigned*)buf, i, NULL);
596 i =
ldns_b64_pton((
const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
597 rsa->p = BN_bin2bn((
const char unsigned*)buf, i, NULL);
606 i =
ldns_b64_pton((
const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
607 rsa->q = BN_bin2bn((
const char unsigned*)buf, i, NULL);
616 i =
ldns_b64_pton((
const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
617 rsa->dmp1 = BN_bin2bn((
const char unsigned*)buf, i, NULL);
626 i =
ldns_b64_pton((
const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
627 rsa->dmq1 = BN_bin2bn((
const char unsigned*)buf, i, NULL);
636 i =
ldns_b64_pton((
const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
637 rsa->iqmp = BN_bin2bn((
const char unsigned*)buf, i, NULL);
671 if (!d || !dsa || !buf) {
681 i =
ldns_b64_pton((
const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
683 dsa->p = BN_bin2bn((
const char unsigned*)buf, i, NULL);
692 i =
ldns_b64_pton((
const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
693 dsa->q = BN_bin2bn((
const char unsigned*)buf, i, NULL);
702 i =
ldns_b64_pton((
const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
703 dsa->g = BN_bin2bn((
const char unsigned*)buf, i, NULL);
712 i =
ldns_b64_pton((
const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
713 dsa->priv_key = BN_bin2bn((
const char unsigned*)buf, i, NULL);
714 if (!dsa->priv_key) {
722 i =
ldns_b64_pton((
const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
723 dsa->pub_key = BN_bin2bn((
const char unsigned*)buf, i, NULL);
755 unsigned char *buf = NULL;
760 bufsz = ldns_b64_ntop_calculate_size(strlen(d));
776 ldns_gen_gost_key(
void)
783 ctx = EVP_PKEY_CTX_new_id(gost_id, NULL);
788 if(EVP_PKEY_CTX_ctrl_str(ctx,
"paramset",
"A") <= 0) {
790 EVP_PKEY_CTX_free(ctx);
794 if(EVP_PKEY_keygen_init(ctx) <= 0) {
795 EVP_PKEY_CTX_free(ctx);
798 if(EVP_PKEY_keygen(ctx, &p) <= 0) {
800 EVP_PKEY_CTX_free(ctx);
803 EVP_PKEY_CTX_free(ctx);
835 r = RSA_generate_key((
int)size, RSA_F4, NULL, NULL);
840 if (RSA_check_key(r) != 1) {
851 d = DSA_generate_parameters((
int)size, NULL, 0, NULL, NULL, NULL, NULL);
856 if (DSA_generate_key(d) != 1) {
881 if (RAND_bytes(hmac, (
int) size) != 1) {
887 while (offset +
sizeof(i) < size) {
889 memcpy(&hmac[offset], &i,
sizeof(i));
894 memcpy(&hmac[offset], &i, size - offset);
902 #if defined(HAVE_SSL) && defined(USE_GOST)
919 ec = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
921 ec = EC_KEY_new_by_curve_name(NID_secp384r1);
926 if(!EC_KEY_generate_key(ec)) {
938 if (!EVP_PKEY_assign_EC_KEY(k->
_key.
key, ec)) {
959 fprintf(output,
"%s", str);
961 fprintf(output,
"Unable to convert private key to string\n");
990 EVP_PKEY *key = EVP_PKEY_new();
991 EVP_PKEY_set1_RSA(key, r);
998 EVP_PKEY *key = EVP_PKEY_new();
999 EVP_PKEY_set1_DSA(key, d);
1006 EVP_PKEY *key = EVP_PKEY_new();
1007 EVP_PKEY_assign_RSA(key, r);
1014 EVP_PKEY *key = EVP_PKEY_new();
1015 EVP_PKEY_assign_DSA(key, d);
1080 return key->
_keys[nr];
1121 return EVP_PKEY_get1_RSA(k->
_key.
key);
1131 return EVP_PKEY_get1_DSA(k->
_key.
key);
1234 key_list->
_keys = keys;
1235 key_list->
_keys[key_count] = key;
1253 if (key_count == 0) {
1262 key_list->
_keys = a;
1274 ldns_key_rsa2bin(
unsigned char *data, RSA *k, uint16_t *size)
1282 if (BN_num_bytes(k->e) <= 256) {
1286 data[0] = (
unsigned char) BN_num_bytes(k->e);
1287 i = BN_bn2bin(k->e, data + 1);
1288 j = BN_bn2bin(k->n, data + i + 1);
1289 *size = (uint16_t) i + j;
1290 }
else if (BN_num_bytes(k->e) <= 65536) {
1293 ldns_write_uint16(data + 1, (uint16_t) BN_num_bytes(k->e));
1295 BN_bn2bin(k->e, data + 3);
1296 BN_bn2bin(k->n, data + 4 + BN_num_bytes(k->e));
1297 *size = (uint16_t) BN_num_bytes(k->n) + 6;
1306 ldns_key_dsa2bin(
unsigned char *data, DSA *k, uint16_t *size)
1315 *size = (uint16_t)BN_num_bytes(k->p);
1316 T = (*size - 64) / 8;
1317 memcpy(data, &T, 1);
1320 fprintf(stderr,
"DSA key with T > 8 (ie. > 1024 bits)");
1321 fprintf(stderr,
" not implemented\n");
1326 data[0] = (
unsigned char)T;
1327 BN_bn2bin(k->q, data + 1 );
1328 BN_bn2bin(k->p, data + 21 );
1329 BN_bn2bin(k->g, data + 21 + *size);
1330 BN_bn2bin(k->pub_key, data + 21 + *size + *size);
1331 *size = 21 + (*size * 3);
1337 ldns_key_gost2bin(
unsigned char* data, EVP_PKEY* k, uint16_t* size)
1340 unsigned char* pp = NULL;
1341 if(i2d_PUBKEY(k, &pp) != 37 + 64) {
1367 unsigned char *bin = NULL;
1376 int internal_data = 0;
1422 if (!ldns_key_rsa2bin(bin, rsa, &size)) {
1444 if (!ldns_key_dsa2bin(bin, dsa, &size)) {
1465 if (!ldns_key_dsa2bin(bin, dsa, &size)) {
1478 #if defined(HAVE_SSL) && defined(USE_GOST)
1485 if (!ldns_key_gost2bin(bin, k->
_key.
key, &size)) {
1504 ec = EVP_PKEY_get1_EC_KEY(k->
_key.
key);
1506 EC_KEY_set_conv_form(ec, POINT_CONVERSION_UNCOMPRESSED);
1507 size = (uint16_t)i2o_ECPublicKey(ec, NULL);
1508 if(!i2o_ECPublicKey(ec, &bin)) {
1518 assert(bin[0] == POINT_CONVERSION_UNCOMPRESSED);
1520 memmove(bin, bin+1, size);
1548 if (internal_data) {
1565 unsigned char* hmac;
1606 fp = fopen(filename,
"r");
1608 fprintf(stderr,
"Unable to open %s: %s\n", filename, strerror(errno));
1622 fprintf(stderr,
"nothing read from %s", filename);
1642 char *file_base_name;
1653 return file_base_name;
1690 if(strcasecmp(lt->
name, name) == 0)
1696 if(strcasecmp(lt->
name, name) == 0)