1 /*
2  *  Privacy Enhanced Mail (PEM) decoding
3  *
4  *  Copyright The Mbed TLS Contributors
5  *  SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
6  */
7 
8 #include "common.h"
9 
10 #if defined(MBEDTLS_PEM_PARSE_C) || defined(MBEDTLS_PEM_WRITE_C)
11 
12 #include "mbedtls/pem.h"
13 #include "mbedtls/base64.h"
14 #include "mbedtls/des.h"
15 #include "mbedtls/aes.h"
16 #include "mbedtls/md.h"
17 #include "mbedtls/cipher.h"
18 #include "mbedtls/platform_util.h"
19 #include "mbedtls/error.h"
20 
21 #include <string.h>
22 
23 #include "mbedtls/platform.h"
24 
25 #if defined(MBEDTLS_USE_PSA_CRYPTO)
26 #include "psa/crypto.h"
27 #endif
28 
29 #if defined(MBEDTLS_MD_CAN_MD5) &&  \
30     defined(MBEDTLS_CIPHER_MODE_CBC) &&                             \
31     (defined(MBEDTLS_DES_C) || defined(MBEDTLS_AES_C))
32 #define PEM_RFC1421
33 #endif /* MBEDTLS_MD_CAN_MD5 &&
34           MBEDTLS_CIPHER_MODE_CBC &&
35           ( MBEDTLS_AES_C || MBEDTLS_DES_C ) */
36 
37 #if defined(MBEDTLS_PEM_PARSE_C)
mbedtls_pem_init(mbedtls_pem_context * ctx)38 void mbedtls_pem_init(mbedtls_pem_context *ctx)
39 {
40     memset(ctx, 0, sizeof(mbedtls_pem_context));
41 }
42 
43 #if defined(PEM_RFC1421)
44 /*
45  * Read a 16-byte hex string and convert it to binary
46  */
pem_get_iv(const unsigned char * s,unsigned char * iv,size_t iv_len)47 static int pem_get_iv(const unsigned char *s, unsigned char *iv,
48                       size_t iv_len)
49 {
50     size_t i, j, k;
51 
52     memset(iv, 0, iv_len);
53 
54     for (i = 0; i < iv_len * 2; i++, s++) {
55         if (*s >= '0' && *s <= '9') {
56             j = *s - '0';
57         } else
58         if (*s >= 'A' && *s <= 'F') {
59             j = *s - '7';
60         } else
61         if (*s >= 'a' && *s <= 'f') {
62             j = *s - 'W';
63         } else {
64             return MBEDTLS_ERR_PEM_INVALID_ENC_IV;
65         }
66 
67         k = ((i & 1) != 0) ? j : j << 4;
68 
69         iv[i >> 1] = (unsigned char) (iv[i >> 1] | k);
70     }
71 
72     return 0;
73 }
74 
pem_pbkdf1(unsigned char * key,size_t keylen,unsigned char * iv,const unsigned char * pwd,size_t pwdlen)75 static int pem_pbkdf1(unsigned char *key, size_t keylen,
76                       unsigned char *iv,
77                       const unsigned char *pwd, size_t pwdlen)
78 {
79     mbedtls_md_context_t md5_ctx;
80     const mbedtls_md_info_t *md5_info;
81     unsigned char md5sum[16];
82     size_t use_len;
83     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
84 
85     mbedtls_md_init(&md5_ctx);
86 
87     /* Prepare the context. (setup() errors gracefully on NULL info.) */
88     md5_info = mbedtls_md_info_from_type(MBEDTLS_MD_MD5);
89     if ((ret = mbedtls_md_setup(&md5_ctx, md5_info, 0)) != 0) {
90         goto exit;
91     }
92 
93     /*
94      * key[ 0..15] = MD5(pwd || IV)
95      */
96     if ((ret = mbedtls_md_starts(&md5_ctx)) != 0) {
97         goto exit;
98     }
99     if ((ret = mbedtls_md_update(&md5_ctx, pwd, pwdlen)) != 0) {
100         goto exit;
101     }
102     if ((ret = mbedtls_md_update(&md5_ctx, iv,  8)) != 0) {
103         goto exit;
104     }
105     if ((ret = mbedtls_md_finish(&md5_ctx, md5sum)) != 0) {
106         goto exit;
107     }
108 
109     if (keylen <= 16) {
110         memcpy(key, md5sum, keylen);
111         goto exit;
112     }
113 
114     memcpy(key, md5sum, 16);
115 
116     /*
117      * key[16..23] = MD5(key[ 0..15] || pwd || IV])
118      */
119     if ((ret = mbedtls_md_starts(&md5_ctx)) != 0) {
120         goto exit;
121     }
122     if ((ret = mbedtls_md_update(&md5_ctx, md5sum, 16)) != 0) {
123         goto exit;
124     }
125     if ((ret = mbedtls_md_update(&md5_ctx, pwd, pwdlen)) != 0) {
126         goto exit;
127     }
128     if ((ret = mbedtls_md_update(&md5_ctx, iv, 8)) != 0) {
129         goto exit;
130     }
131     if ((ret = mbedtls_md_finish(&md5_ctx, md5sum)) != 0) {
132         goto exit;
133     }
134 
135     use_len = 16;
136     if (keylen < 32) {
137         use_len = keylen - 16;
138     }
139 
140     memcpy(key + 16, md5sum, use_len);
141 
142 exit:
143     mbedtls_md_free(&md5_ctx);
144     mbedtls_platform_zeroize(md5sum, 16);
145 
146     return ret;
147 }
148 
149 #if defined(MBEDTLS_DES_C)
150 /*
151  * Decrypt with DES-CBC, using PBKDF1 for key derivation
152  */
pem_des_decrypt(unsigned char des_iv[8],unsigned char * buf,size_t buflen,const unsigned char * pwd,size_t pwdlen)153 static int pem_des_decrypt(unsigned char des_iv[8],
154                            unsigned char *buf, size_t buflen,
155                            const unsigned char *pwd, size_t pwdlen)
156 {
157     mbedtls_des_context des_ctx;
158     unsigned char des_key[8];
159     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
160 
161     mbedtls_des_init(&des_ctx);
162 
163     if ((ret = pem_pbkdf1(des_key, 8, des_iv, pwd, pwdlen)) != 0) {
164         goto exit;
165     }
166 
167     if ((ret = mbedtls_des_setkey_dec(&des_ctx, des_key)) != 0) {
168         goto exit;
169     }
170     ret = mbedtls_des_crypt_cbc(&des_ctx, MBEDTLS_DES_DECRYPT, buflen,
171                                 des_iv, buf, buf);
172 
173 exit:
174     mbedtls_des_free(&des_ctx);
175     mbedtls_platform_zeroize(des_key, 8);
176 
177     return ret;
178 }
179 
180 /*
181  * Decrypt with 3DES-CBC, using PBKDF1 for key derivation
182  */
pem_des3_decrypt(unsigned char des3_iv[8],unsigned char * buf,size_t buflen,const unsigned char * pwd,size_t pwdlen)183 static int pem_des3_decrypt(unsigned char des3_iv[8],
184                             unsigned char *buf, size_t buflen,
185                             const unsigned char *pwd, size_t pwdlen)
186 {
187     mbedtls_des3_context des3_ctx;
188     unsigned char des3_key[24];
189     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
190 
191     mbedtls_des3_init(&des3_ctx);
192 
193     if ((ret = pem_pbkdf1(des3_key, 24, des3_iv, pwd, pwdlen)) != 0) {
194         goto exit;
195     }
196 
197     if ((ret = mbedtls_des3_set3key_dec(&des3_ctx, des3_key)) != 0) {
198         goto exit;
199     }
200     ret = mbedtls_des3_crypt_cbc(&des3_ctx, MBEDTLS_DES_DECRYPT, buflen,
201                                  des3_iv, buf, buf);
202 
203 exit:
204     mbedtls_des3_free(&des3_ctx);
205     mbedtls_platform_zeroize(des3_key, 24);
206 
207     return ret;
208 }
209 #endif /* MBEDTLS_DES_C */
210 
211 #if defined(MBEDTLS_AES_C)
212 /*
213  * Decrypt with AES-XXX-CBC, using PBKDF1 for key derivation
214  */
pem_aes_decrypt(unsigned char aes_iv[16],unsigned int keylen,unsigned char * buf,size_t buflen,const unsigned char * pwd,size_t pwdlen)215 static int pem_aes_decrypt(unsigned char aes_iv[16], unsigned int keylen,
216                            unsigned char *buf, size_t buflen,
217                            const unsigned char *pwd, size_t pwdlen)
218 {
219     mbedtls_aes_context aes_ctx;
220     unsigned char aes_key[32];
221     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
222 
223     mbedtls_aes_init(&aes_ctx);
224 
225     if ((ret = pem_pbkdf1(aes_key, keylen, aes_iv, pwd, pwdlen)) != 0) {
226         goto exit;
227     }
228 
229     if ((ret = mbedtls_aes_setkey_dec(&aes_ctx, aes_key, keylen * 8)) != 0) {
230         goto exit;
231     }
232     ret = mbedtls_aes_crypt_cbc(&aes_ctx, MBEDTLS_AES_DECRYPT, buflen,
233                                 aes_iv, buf, buf);
234 
235 exit:
236     mbedtls_aes_free(&aes_ctx);
237     mbedtls_platform_zeroize(aes_key, keylen);
238 
239     return ret;
240 }
241 #endif /* MBEDTLS_AES_C */
242 
243 #endif /* PEM_RFC1421 */
244 
mbedtls_pem_read_buffer(mbedtls_pem_context * ctx,const char * header,const char * footer,const unsigned char * data,const unsigned char * pwd,size_t pwdlen,size_t * use_len)245 int mbedtls_pem_read_buffer(mbedtls_pem_context *ctx, const char *header, const char *footer,
246                             const unsigned char *data, const unsigned char *pwd,
247                             size_t pwdlen, size_t *use_len)
248 {
249     int ret, enc;
250     size_t len;
251     unsigned char *buf;
252     const unsigned char *s1, *s2, *end;
253 #if defined(PEM_RFC1421)
254     unsigned char pem_iv[16];
255     mbedtls_cipher_type_t enc_alg = MBEDTLS_CIPHER_NONE;
256 #else
257     ((void) pwd);
258     ((void) pwdlen);
259 #endif /* PEM_RFC1421 */
260 
261     if (ctx == NULL) {
262         return MBEDTLS_ERR_PEM_BAD_INPUT_DATA;
263     }
264 
265     s1 = (unsigned char *) strstr((const char *) data, header);
266 
267     if (s1 == NULL) {
268         return MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT;
269     }
270 
271     s2 = (unsigned char *) strstr((const char *) data, footer);
272 
273     if (s2 == NULL || s2 <= s1) {
274         return MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT;
275     }
276 
277     s1 += strlen(header);
278     if (*s1 == ' ') {
279         s1++;
280     }
281     if (*s1 == '\r') {
282         s1++;
283     }
284     if (*s1 == '\n') {
285         s1++;
286     } else {
287         return MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT;
288     }
289 
290     end = s2;
291     end += strlen(footer);
292     if (*end == ' ') {
293         end++;
294     }
295     if (*end == '\r') {
296         end++;
297     }
298     if (*end == '\n') {
299         end++;
300     }
301     *use_len = end - data;
302 
303     enc = 0;
304 
305     if (s2 - s1 >= 22 && memcmp(s1, "Proc-Type: 4,ENCRYPTED", 22) == 0) {
306 #if defined(PEM_RFC1421)
307         enc++;
308 
309         s1 += 22;
310         if (*s1 == '\r') {
311             s1++;
312         }
313         if (*s1 == '\n') {
314             s1++;
315         } else {
316             return MBEDTLS_ERR_PEM_INVALID_DATA;
317         }
318 
319 
320 #if defined(MBEDTLS_DES_C)
321         if (s2 - s1 >= 23 && memcmp(s1, "DEK-Info: DES-EDE3-CBC,", 23) == 0) {
322             enc_alg = MBEDTLS_CIPHER_DES_EDE3_CBC;
323 
324             s1 += 23;
325             if (s2 - s1 < 16 || pem_get_iv(s1, pem_iv, 8) != 0) {
326                 return MBEDTLS_ERR_PEM_INVALID_ENC_IV;
327             }
328 
329             s1 += 16;
330         } else if (s2 - s1 >= 18 && memcmp(s1, "DEK-Info: DES-CBC,", 18) == 0) {
331             enc_alg = MBEDTLS_CIPHER_DES_CBC;
332 
333             s1 += 18;
334             if (s2 - s1 < 16 || pem_get_iv(s1, pem_iv, 8) != 0) {
335                 return MBEDTLS_ERR_PEM_INVALID_ENC_IV;
336             }
337 
338             s1 += 16;
339         }
340 #endif /* MBEDTLS_DES_C */
341 
342 #if defined(MBEDTLS_AES_C)
343         if (s2 - s1 >= 14 && memcmp(s1, "DEK-Info: AES-", 14) == 0) {
344             if (s2 - s1 < 22) {
345                 return MBEDTLS_ERR_PEM_UNKNOWN_ENC_ALG;
346             } else if (memcmp(s1, "DEK-Info: AES-128-CBC,", 22) == 0) {
347                 enc_alg = MBEDTLS_CIPHER_AES_128_CBC;
348             } else if (memcmp(s1, "DEK-Info: AES-192-CBC,", 22) == 0) {
349                 enc_alg = MBEDTLS_CIPHER_AES_192_CBC;
350             } else if (memcmp(s1, "DEK-Info: AES-256-CBC,", 22) == 0) {
351                 enc_alg = MBEDTLS_CIPHER_AES_256_CBC;
352             } else {
353                 return MBEDTLS_ERR_PEM_UNKNOWN_ENC_ALG;
354             }
355 
356             s1 += 22;
357             if (s2 - s1 < 32 || pem_get_iv(s1, pem_iv, 16) != 0) {
358                 return MBEDTLS_ERR_PEM_INVALID_ENC_IV;
359             }
360 
361             s1 += 32;
362         }
363 #endif /* MBEDTLS_AES_C */
364 
365         if (enc_alg == MBEDTLS_CIPHER_NONE) {
366             return MBEDTLS_ERR_PEM_UNKNOWN_ENC_ALG;
367         }
368 
369         if (*s1 == '\r') {
370             s1++;
371         }
372         if (*s1 == '\n') {
373             s1++;
374         } else {
375             return MBEDTLS_ERR_PEM_INVALID_DATA;
376         }
377 #else
378         return MBEDTLS_ERR_PEM_FEATURE_UNAVAILABLE;
379 #endif /* PEM_RFC1421 */
380     }
381 
382     if (s1 >= s2) {
383         return MBEDTLS_ERR_PEM_INVALID_DATA;
384     }
385 
386     ret = mbedtls_base64_decode(NULL, 0, &len, s1, s2 - s1);
387 
388     if (ret == MBEDTLS_ERR_BASE64_INVALID_CHARACTER) {
389         return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PEM_INVALID_DATA, ret);
390     }
391 
392     if ((buf = mbedtls_calloc(1, len)) == NULL) {
393         return MBEDTLS_ERR_PEM_ALLOC_FAILED;
394     }
395 
396     if ((ret = mbedtls_base64_decode(buf, len, &len, s1, s2 - s1)) != 0) {
397         mbedtls_zeroize_and_free(buf, len);
398         return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PEM_INVALID_DATA, ret);
399     }
400 
401     if (enc != 0) {
402 #if defined(PEM_RFC1421)
403         if (pwd == NULL) {
404             mbedtls_zeroize_and_free(buf, len);
405             return MBEDTLS_ERR_PEM_PASSWORD_REQUIRED;
406         }
407 
408         ret = 0;
409 
410 #if defined(MBEDTLS_DES_C)
411         if (enc_alg == MBEDTLS_CIPHER_DES_EDE3_CBC) {
412             ret = pem_des3_decrypt(pem_iv, buf, len, pwd, pwdlen);
413         } else if (enc_alg == MBEDTLS_CIPHER_DES_CBC) {
414             ret = pem_des_decrypt(pem_iv, buf, len, pwd, pwdlen);
415         }
416 #endif /* MBEDTLS_DES_C */
417 
418 #if defined(MBEDTLS_AES_C)
419         if (enc_alg == MBEDTLS_CIPHER_AES_128_CBC) {
420             ret = pem_aes_decrypt(pem_iv, 16, buf, len, pwd, pwdlen);
421         } else if (enc_alg == MBEDTLS_CIPHER_AES_192_CBC) {
422             ret = pem_aes_decrypt(pem_iv, 24, buf, len, pwd, pwdlen);
423         } else if (enc_alg == MBEDTLS_CIPHER_AES_256_CBC) {
424             ret = pem_aes_decrypt(pem_iv, 32, buf, len, pwd, pwdlen);
425         }
426 #endif /* MBEDTLS_AES_C */
427 
428         if (ret != 0) {
429             mbedtls_free(buf);
430             return ret;
431         }
432 
433         /*
434          * The result will be ASN.1 starting with a SEQUENCE tag, with 1 to 3
435          * length bytes (allow 4 to be sure) in all known use cases.
436          *
437          * Use that as a heuristic to try to detect password mismatches.
438          */
439         if (len <= 2 || buf[0] != 0x30 || buf[1] > 0x83) {
440             mbedtls_zeroize_and_free(buf, len);
441             return MBEDTLS_ERR_PEM_PASSWORD_MISMATCH;
442         }
443 #else
444         mbedtls_zeroize_and_free(buf, len);
445         return MBEDTLS_ERR_PEM_FEATURE_UNAVAILABLE;
446 #endif /* PEM_RFC1421 */
447     }
448 
449     ctx->buf = buf;
450     ctx->buflen = len;
451 
452     return 0;
453 }
454 
mbedtls_pem_free(mbedtls_pem_context * ctx)455 void mbedtls_pem_free(mbedtls_pem_context *ctx)
456 {
457     if (ctx->buf != NULL) {
458         mbedtls_zeroize_and_free(ctx->buf, ctx->buflen);
459     }
460     mbedtls_free(ctx->info);
461 
462     mbedtls_platform_zeroize(ctx, sizeof(mbedtls_pem_context));
463 }
464 #endif /* MBEDTLS_PEM_PARSE_C */
465 
466 #if defined(MBEDTLS_PEM_WRITE_C)
mbedtls_pem_write_buffer(const char * header,const char * footer,const unsigned char * der_data,size_t der_len,unsigned char * buf,size_t buf_len,size_t * olen)467 int mbedtls_pem_write_buffer(const char *header, const char *footer,
468                              const unsigned char *der_data, size_t der_len,
469                              unsigned char *buf, size_t buf_len, size_t *olen)
470 {
471     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
472     unsigned char *encode_buf = NULL, *c, *p = buf;
473     size_t len = 0, use_len, add_len = 0;
474 
475     mbedtls_base64_encode(NULL, 0, &use_len, der_data, der_len);
476     add_len = strlen(header) + strlen(footer) + (((use_len > 2) ? (use_len - 2) : 0) / 64) + 1;
477 
478     if (use_len + add_len > buf_len) {
479         *olen = use_len + add_len;
480         return MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL;
481     }
482 
483     if (use_len != 0 &&
484         ((encode_buf = mbedtls_calloc(1, use_len)) == NULL)) {
485         return MBEDTLS_ERR_PEM_ALLOC_FAILED;
486     }
487 
488     if ((ret = mbedtls_base64_encode(encode_buf, use_len, &use_len, der_data,
489                                      der_len)) != 0) {
490         mbedtls_free(encode_buf);
491         return ret;
492     }
493 
494     memcpy(p, header, strlen(header));
495     p += strlen(header);
496     c = encode_buf;
497 
498     while (use_len) {
499         len = (use_len > 64) ? 64 : use_len;
500         memcpy(p, c, len);
501         use_len -= len;
502         p += len;
503         c += len;
504         *p++ = '\n';
505     }
506 
507     memcpy(p, footer, strlen(footer));
508     p += strlen(footer);
509 
510     *p++ = '\0';
511     *olen = p - buf;
512 
513     /* Clean any remaining data previously written to the buffer */
514     memset(buf + *olen, 0, buf_len - *olen);
515 
516     mbedtls_free(encode_buf);
517     return 0;
518 }
519 #endif /* MBEDTLS_PEM_WRITE_C */
520 #endif /* MBEDTLS_PEM_PARSE_C || MBEDTLS_PEM_WRITE_C */
521