1 /*
2 * Key writing application
3 *
4 * Copyright The Mbed TLS Contributors
5 * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
6 */
7
8 #include "mbedtls/build_info.h"
9
10 #include "mbedtls/platform.h"
11
12 #if !defined(MBEDTLS_PK_PARSE_C) || \
13 !defined(MBEDTLS_PK_WRITE_C) || \
14 !defined(MBEDTLS_FS_IO) || \
15 !defined(MBEDTLS_ENTROPY_C) || \
16 !defined(MBEDTLS_CTR_DRBG_C) || \
17 !defined(MBEDTLS_BIGNUM_C)
main(void)18 int main(void)
19 {
20 mbedtls_printf("MBEDTLS_PK_PARSE_C and/or MBEDTLS_PK_WRITE_C and/or "
21 "MBEDTLS_ENTROPY_C and/or MBEDTLS_CTR_DRBG_C and/or "
22 "MBEDTLS_FS_IO and/or MBEDTLS_BIGNUM_C not defined.\n");
23 mbedtls_exit(0);
24 }
25 #else
26
27 #include "mbedtls/error.h"
28 #include "mbedtls/pk.h"
29 #include "mbedtls/error.h"
30
31 #include "mbedtls/entropy.h"
32 #include "mbedtls/ctr_drbg.h"
33
34 #include <stdio.h>
35 #include <string.h>
36
37 #if defined(MBEDTLS_PEM_WRITE_C)
38 #define USAGE_OUT \
39 " output_file=%%s default: keyfile.pem\n" \
40 " output_format=pem|der default: pem\n"
41 #else
42 #define USAGE_OUT \
43 " output_file=%%s default: keyfile.der\n" \
44 " output_format=der default: der\n"
45 #endif
46
47 #if defined(MBEDTLS_PEM_WRITE_C)
48 #define DFL_OUTPUT_FILENAME "keyfile.pem"
49 #define DFL_OUTPUT_FORMAT OUTPUT_FORMAT_PEM
50 #else
51 #define DFL_OUTPUT_FILENAME "keyfile.der"
52 #define DFL_OUTPUT_FORMAT OUTPUT_FORMAT_DER
53 #endif
54
55 #define DFL_MODE MODE_NONE
56 #define DFL_FILENAME "keyfile.key"
57 #define DFL_DEBUG_LEVEL 0
58 #define DFL_OUTPUT_MODE OUTPUT_MODE_NONE
59
60 #define MODE_NONE 0
61 #define MODE_PRIVATE 1
62 #define MODE_PUBLIC 2
63
64 #define OUTPUT_MODE_NONE 0
65 #define OUTPUT_MODE_PRIVATE 1
66 #define OUTPUT_MODE_PUBLIC 2
67
68 #define OUTPUT_FORMAT_PEM 0
69 #define OUTPUT_FORMAT_DER 1
70
71 #define USAGE \
72 "\n usage: key_app_writer param=<>...\n" \
73 "\n acceptable parameters:\n" \
74 " mode=private|public default: none\n" \
75 " filename=%%s default: keyfile.key\n" \
76 " output_mode=private|public default: none\n" \
77 USAGE_OUT \
78 "\n"
79
80
81 /*
82 * global options
83 */
84 struct options {
85 int mode; /* the mode to run the application in */
86 const char *filename; /* filename of the key file */
87 int output_mode; /* the output mode to use */
88 const char *output_file; /* where to store the constructed key file */
89 int output_format; /* the output format to use */
90 } opt;
91
write_public_key(mbedtls_pk_context * key,const char * output_file)92 static int write_public_key(mbedtls_pk_context *key, const char *output_file)
93 {
94 int ret;
95 FILE *f;
96 unsigned char output_buf[16000];
97 unsigned char *c = output_buf;
98 size_t len = 0;
99
100 memset(output_buf, 0, 16000);
101
102 #if defined(MBEDTLS_PEM_WRITE_C)
103 if (opt.output_format == OUTPUT_FORMAT_PEM) {
104 if ((ret = mbedtls_pk_write_pubkey_pem(key, output_buf, 16000)) != 0) {
105 return ret;
106 }
107
108 len = strlen((char *) output_buf);
109 } else
110 #endif
111 {
112 if ((ret = mbedtls_pk_write_pubkey_der(key, output_buf, 16000)) < 0) {
113 return ret;
114 }
115
116 len = ret;
117 c = output_buf + sizeof(output_buf) - len;
118 }
119
120 if ((f = fopen(output_file, "w")) == NULL) {
121 return -1;
122 }
123
124 if (fwrite(c, 1, len, f) != len) {
125 fclose(f);
126 return -1;
127 }
128
129 fclose(f);
130
131 return 0;
132 }
133
write_private_key(mbedtls_pk_context * key,const char * output_file)134 static int write_private_key(mbedtls_pk_context *key, const char *output_file)
135 {
136 int ret;
137 FILE *f;
138 unsigned char output_buf[16000];
139 unsigned char *c = output_buf;
140 size_t len = 0;
141
142 memset(output_buf, 0, 16000);
143
144 #if defined(MBEDTLS_PEM_WRITE_C)
145 if (opt.output_format == OUTPUT_FORMAT_PEM) {
146 if ((ret = mbedtls_pk_write_key_pem(key, output_buf, 16000)) != 0) {
147 return ret;
148 }
149
150 len = strlen((char *) output_buf);
151 } else
152 #endif
153 {
154 if ((ret = mbedtls_pk_write_key_der(key, output_buf, 16000)) < 0) {
155 return ret;
156 }
157
158 len = ret;
159 c = output_buf + sizeof(output_buf) - len;
160 }
161
162 if ((f = fopen(output_file, "w")) == NULL) {
163 return -1;
164 }
165
166 if (fwrite(c, 1, len, f) != len) {
167 fclose(f);
168 return -1;
169 }
170
171 fclose(f);
172
173 return 0;
174 }
175
176 #if defined(MBEDTLS_ECP_C)
show_ecp_key(const mbedtls_ecp_keypair * ecp,int has_private)177 static int show_ecp_key(const mbedtls_ecp_keypair *ecp, int has_private)
178 {
179 int ret = 0;
180
181 const mbedtls_ecp_curve_info *curve_info =
182 mbedtls_ecp_curve_info_from_grp_id(
183 mbedtls_ecp_keypair_get_group_id(ecp));
184 mbedtls_printf("curve: %s\n", curve_info->name);
185
186 mbedtls_ecp_group grp;
187 mbedtls_ecp_group_init(&grp);
188 mbedtls_mpi D;
189 mbedtls_mpi_init(&D);
190 mbedtls_ecp_point pt;
191 mbedtls_ecp_point_init(&pt);
192 mbedtls_mpi X, Y;
193 mbedtls_mpi_init(&X); mbedtls_mpi_init(&Y);
194
195 MBEDTLS_MPI_CHK(mbedtls_ecp_export(ecp, &grp,
196 (has_private ? &D : NULL),
197 &pt));
198
199 unsigned char point_bin[MBEDTLS_ECP_MAX_PT_LEN];
200 size_t len = 0;
201 MBEDTLS_MPI_CHK(mbedtls_ecp_point_write_binary(
202 &grp, &pt, MBEDTLS_ECP_PF_UNCOMPRESSED,
203 &len, point_bin, sizeof(point_bin)));
204 switch (mbedtls_ecp_get_type(&grp)) {
205 case MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS:
206 if ((len & 1) == 0 || point_bin[0] != 0x04) {
207 /* Point in an unxepected format. This shouldn't happen. */
208 ret = -1;
209 goto cleanup;
210 }
211 MBEDTLS_MPI_CHK(
212 mbedtls_mpi_read_binary(&X, point_bin + 1, len / 2));
213 MBEDTLS_MPI_CHK(
214 mbedtls_mpi_read_binary(&Y, point_bin + 1 + len / 2, len / 2));
215 mbedtls_mpi_write_file("X_Q: ", &X, 16, NULL);
216 mbedtls_mpi_write_file("Y_Q: ", &Y, 16, NULL);
217 break;
218 case MBEDTLS_ECP_TYPE_MONTGOMERY:
219 MBEDTLS_MPI_CHK(mbedtls_mpi_read_binary(&X, point_bin, len));
220 mbedtls_mpi_write_file("X_Q: ", &X, 16, NULL);
221 break;
222 default:
223 mbedtls_printf(
224 "This program does not yet support listing coordinates for this curve type.\n");
225 break;
226 }
227
228 if (has_private) {
229 mbedtls_mpi_write_file("D: ", &D, 16, NULL);
230 }
231
232 cleanup:
233 mbedtls_ecp_group_free(&grp);
234 mbedtls_mpi_free(&D);
235 mbedtls_ecp_point_free(&pt);
236 mbedtls_mpi_free(&X); mbedtls_mpi_free(&Y);
237 return ret;
238 }
239 #endif
240
main(int argc,char * argv[])241 int main(int argc, char *argv[])
242 {
243 int ret = 1;
244 int exit_code = MBEDTLS_EXIT_FAILURE;
245 #if defined(MBEDTLS_ERROR_C)
246 char buf[200];
247 #endif
248 int i;
249 char *p, *q;
250
251 const char *pers = "pkey/key_app";
252 mbedtls_entropy_context entropy;
253 mbedtls_ctr_drbg_context ctr_drbg;
254
255 mbedtls_pk_context key;
256 #if defined(MBEDTLS_RSA_C)
257 mbedtls_mpi N, P, Q, D, E, DP, DQ, QP;
258 #endif /* MBEDTLS_RSA_C */
259
260 /*
261 * Set to sane values
262 */
263 mbedtls_entropy_init(&entropy);
264 mbedtls_ctr_drbg_init(&ctr_drbg);
265
266 mbedtls_pk_init(&key);
267 #if defined(MBEDTLS_ERROR_C)
268 memset(buf, 0, sizeof(buf));
269 #endif
270
271 #if defined(MBEDTLS_USE_PSA_CRYPTO)
272 psa_status_t status = psa_crypto_init();
273 if (status != PSA_SUCCESS) {
274 mbedtls_fprintf(stderr, "Failed to initialize PSA Crypto implementation: %d\n",
275 (int) status);
276 goto exit;
277 }
278 #endif /* MBEDTLS_USE_PSA_CRYPTO */
279
280 #if defined(MBEDTLS_RSA_C)
281 mbedtls_mpi_init(&N); mbedtls_mpi_init(&P); mbedtls_mpi_init(&Q);
282 mbedtls_mpi_init(&D); mbedtls_mpi_init(&E); mbedtls_mpi_init(&DP);
283 mbedtls_mpi_init(&DQ); mbedtls_mpi_init(&QP);
284 #endif /* MBEDTLS_RSA_C */
285
286 if (argc < 2) {
287 usage:
288 mbedtls_printf(USAGE);
289 goto exit;
290 }
291
292 opt.mode = DFL_MODE;
293 opt.filename = DFL_FILENAME;
294 opt.output_mode = DFL_OUTPUT_MODE;
295 opt.output_file = DFL_OUTPUT_FILENAME;
296 opt.output_format = DFL_OUTPUT_FORMAT;
297
298 for (i = 1; i < argc; i++) {
299 p = argv[i];
300 if ((q = strchr(p, '=')) == NULL) {
301 goto usage;
302 }
303 *q++ = '\0';
304
305 if (strcmp(p, "mode") == 0) {
306 if (strcmp(q, "private") == 0) {
307 opt.mode = MODE_PRIVATE;
308 } else if (strcmp(q, "public") == 0) {
309 opt.mode = MODE_PUBLIC;
310 } else {
311 goto usage;
312 }
313 } else if (strcmp(p, "output_mode") == 0) {
314 if (strcmp(q, "private") == 0) {
315 opt.output_mode = OUTPUT_MODE_PRIVATE;
316 } else if (strcmp(q, "public") == 0) {
317 opt.output_mode = OUTPUT_MODE_PUBLIC;
318 } else {
319 goto usage;
320 }
321 } else if (strcmp(p, "output_format") == 0) {
322 #if defined(MBEDTLS_PEM_WRITE_C)
323 if (strcmp(q, "pem") == 0) {
324 opt.output_format = OUTPUT_FORMAT_PEM;
325 } else
326 #endif
327 if (strcmp(q, "der") == 0) {
328 opt.output_format = OUTPUT_FORMAT_DER;
329 } else {
330 goto usage;
331 }
332 } else if (strcmp(p, "filename") == 0) {
333 opt.filename = q;
334 } else if (strcmp(p, "output_file") == 0) {
335 opt.output_file = q;
336 } else {
337 goto usage;
338 }
339 }
340
341 if (opt.mode == MODE_NONE && opt.output_mode != OUTPUT_MODE_NONE) {
342 mbedtls_printf("\nCannot output a key without reading one.\n");
343 goto exit;
344 }
345
346 if (opt.mode == MODE_PUBLIC && opt.output_mode == OUTPUT_MODE_PRIVATE) {
347 mbedtls_printf("\nCannot output a private key from a public key.\n");
348 goto exit;
349 }
350
351 if (opt.mode == MODE_PRIVATE) {
352 /*
353 * 1.1. Load the key
354 */
355 mbedtls_printf("\n . Loading the private key ...");
356 fflush(stdout);
357
358 if ((ret = mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func, &entropy,
359 (const unsigned char *) pers,
360 strlen(pers))) != 0) {
361 mbedtls_printf(" failed\n ! mbedtls_ctr_drbg_seed returned -0x%04x\n",
362 (unsigned int) -ret);
363 goto exit;
364 }
365
366 ret = mbedtls_pk_parse_keyfile(&key, opt.filename, NULL,
367 mbedtls_ctr_drbg_random, &ctr_drbg);
368 if (ret != 0) {
369 mbedtls_printf(" failed\n ! mbedtls_pk_parse_keyfile returned -0x%04x",
370 (unsigned int) -ret);
371 goto exit;
372 }
373
374 mbedtls_printf(" ok\n");
375
376 /*
377 * 1.2 Print the key
378 */
379 mbedtls_printf(" . Key information ...\n");
380
381 #if defined(MBEDTLS_RSA_C)
382 if (mbedtls_pk_get_type(&key) == MBEDTLS_PK_RSA) {
383 mbedtls_rsa_context *rsa = mbedtls_pk_rsa(key);
384
385 if ((ret = mbedtls_rsa_export(rsa, &N, &P, &Q, &D, &E)) != 0 ||
386 (ret = mbedtls_rsa_export_crt(rsa, &DP, &DQ, &QP)) != 0) {
387 mbedtls_printf(" failed\n ! could not export RSA parameters\n\n");
388 goto exit;
389 }
390
391 mbedtls_mpi_write_file("N: ", &N, 16, NULL);
392 mbedtls_mpi_write_file("E: ", &E, 16, NULL);
393 mbedtls_mpi_write_file("D: ", &D, 16, NULL);
394 mbedtls_mpi_write_file("P: ", &P, 16, NULL);
395 mbedtls_mpi_write_file("Q: ", &Q, 16, NULL);
396 mbedtls_mpi_write_file("DP: ", &DP, 16, NULL);
397 mbedtls_mpi_write_file("DQ: ", &DQ, 16, NULL);
398 mbedtls_mpi_write_file("QP: ", &QP, 16, NULL);
399 } else
400 #endif
401 #if defined(MBEDTLS_ECP_C)
402 if (mbedtls_pk_get_type(&key) == MBEDTLS_PK_ECKEY) {
403 if (show_ecp_key(mbedtls_pk_ec(key), 1) != 0) {
404 mbedtls_printf(" failed\n ! could not export ECC parameters\n\n");
405 goto exit;
406 }
407 } else
408 #endif
409 mbedtls_printf("key type not supported yet\n");
410
411 } else if (opt.mode == MODE_PUBLIC) {
412 /*
413 * 1.1. Load the key
414 */
415 mbedtls_printf("\n . Loading the public key ...");
416 fflush(stdout);
417
418 ret = mbedtls_pk_parse_public_keyfile(&key, opt.filename);
419
420 if (ret != 0) {
421 mbedtls_printf(" failed\n ! mbedtls_pk_parse_public_key returned -0x%04x",
422 (unsigned int) -ret);
423 goto exit;
424 }
425
426 mbedtls_printf(" ok\n");
427
428 /*
429 * 1.2 Print the key
430 */
431 mbedtls_printf(" . Key information ...\n");
432
433 #if defined(MBEDTLS_RSA_C)
434 if (mbedtls_pk_get_type(&key) == MBEDTLS_PK_RSA) {
435 mbedtls_rsa_context *rsa = mbedtls_pk_rsa(key);
436
437 if ((ret = mbedtls_rsa_export(rsa, &N, NULL, NULL,
438 NULL, &E)) != 0) {
439 mbedtls_printf(" failed\n ! could not export RSA parameters\n\n");
440 goto exit;
441 }
442 mbedtls_mpi_write_file("N: ", &N, 16, NULL);
443 mbedtls_mpi_write_file("E: ", &E, 16, NULL);
444 } else
445 #endif
446 #if defined(MBEDTLS_ECP_C)
447 if (mbedtls_pk_get_type(&key) == MBEDTLS_PK_ECKEY) {
448 if (show_ecp_key(mbedtls_pk_ec(key), 0) != 0) {
449 mbedtls_printf(" failed\n ! could not export ECC parameters\n\n");
450 goto exit;
451 }
452 } else
453 #endif
454 mbedtls_printf("key type not supported yet\n");
455 } else {
456 goto usage;
457 }
458
459 if (opt.output_mode == OUTPUT_MODE_PUBLIC) {
460 write_public_key(&key, opt.output_file);
461 }
462 if (opt.output_mode == OUTPUT_MODE_PRIVATE) {
463 write_private_key(&key, opt.output_file);
464 }
465
466 exit_code = MBEDTLS_EXIT_SUCCESS;
467
468 exit:
469
470 if (exit_code != MBEDTLS_EXIT_SUCCESS) {
471 #ifdef MBEDTLS_ERROR_C
472 mbedtls_strerror(ret, buf, sizeof(buf));
473 mbedtls_printf(" - %s\n", buf);
474 #else
475 mbedtls_printf("\n");
476 #endif
477 }
478
479 #if defined(MBEDTLS_RSA_C)
480 mbedtls_mpi_free(&N); mbedtls_mpi_free(&P); mbedtls_mpi_free(&Q);
481 mbedtls_mpi_free(&D); mbedtls_mpi_free(&E); mbedtls_mpi_free(&DP);
482 mbedtls_mpi_free(&DQ); mbedtls_mpi_free(&QP);
483 #endif /* MBEDTLS_RSA_C */
484
485 mbedtls_pk_free(&key);
486
487 mbedtls_ctr_drbg_free(&ctr_drbg);
488 mbedtls_entropy_free(&entropy);
489 #if defined(MBEDTLS_USE_PSA_CRYPTO)
490 mbedtls_psa_crypto_free();
491 #endif /* MBEDTLS_USE_PSA_CRYPTO */
492
493 mbedtls_exit(exit_code);
494 }
495 #endif /* program viability conditions */
496
