cms_lcl.h revision 352193
1/* crypto/cms/cms_lcl.h */ 2/* 3 * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL 4 * project. 5 */ 6/* ==================================================================== 7 * Copyright (c) 2008-2019 The OpenSSL Project. All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 16 * 2. Redistributions in binary form must reproduce the above copyright 17 * notice, this list of conditions and the following disclaimer in 18 * the documentation and/or other materials provided with the 19 * distribution. 20 * 21 * 3. All advertising materials mentioning features or use of this 22 * software must display the following acknowledgment: 23 * "This product includes software developed by the OpenSSL Project 24 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" 25 * 26 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 27 * endorse or promote products derived from this software without 28 * prior written permission. For written permission, please contact 29 * licensing@OpenSSL.org. 30 * 31 * 5. Products derived from this software may not be called "OpenSSL" 32 * nor may "OpenSSL" appear in their names without prior written 33 * permission of the OpenSSL Project. 34 * 35 * 6. Redistributions of any form whatsoever must retain the following 36 * acknowledgment: 37 * "This product includes software developed by the OpenSSL Project 38 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" 39 * 40 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 41 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 42 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 43 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 44 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 45 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 46 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 47 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 49 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 50 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 51 * OF THE POSSIBILITY OF SUCH DAMAGE. 52 * ==================================================================== 53 */ 54 55#ifndef HEADER_CMS_LCL_H 56# define HEADER_CMS_LCL_H 57 58#ifdef __cplusplus 59extern "C" { 60#endif 61 62# include <openssl/x509.h> 63 64/* 65 * Cryptographic message syntax (CMS) structures: taken from RFC3852 66 */ 67 68/* Forward references */ 69 70typedef struct CMS_IssuerAndSerialNumber_st CMS_IssuerAndSerialNumber; 71typedef struct CMS_EncapsulatedContentInfo_st CMS_EncapsulatedContentInfo; 72typedef struct CMS_SignerIdentifier_st CMS_SignerIdentifier; 73typedef struct CMS_SignedData_st CMS_SignedData; 74typedef struct CMS_OtherRevocationInfoFormat_st CMS_OtherRevocationInfoFormat; 75typedef struct CMS_OriginatorInfo_st CMS_OriginatorInfo; 76typedef struct CMS_EncryptedContentInfo_st CMS_EncryptedContentInfo; 77typedef struct CMS_EnvelopedData_st CMS_EnvelopedData; 78typedef struct CMS_DigestedData_st CMS_DigestedData; 79typedef struct CMS_EncryptedData_st CMS_EncryptedData; 80typedef struct CMS_AuthenticatedData_st CMS_AuthenticatedData; 81typedef struct CMS_CompressedData_st CMS_CompressedData; 82typedef struct CMS_OtherCertificateFormat_st CMS_OtherCertificateFormat; 83typedef struct CMS_KeyTransRecipientInfo_st CMS_KeyTransRecipientInfo; 84typedef struct CMS_OriginatorPublicKey_st CMS_OriginatorPublicKey; 85typedef struct CMS_OriginatorIdentifierOrKey_st CMS_OriginatorIdentifierOrKey; 86typedef struct CMS_KeyAgreeRecipientInfo_st CMS_KeyAgreeRecipientInfo; 87typedef struct CMS_RecipientKeyIdentifier_st CMS_RecipientKeyIdentifier; 88typedef struct CMS_KeyAgreeRecipientIdentifier_st 89 CMS_KeyAgreeRecipientIdentifier; 90typedef struct CMS_KEKIdentifier_st CMS_KEKIdentifier; 91typedef struct CMS_KEKRecipientInfo_st CMS_KEKRecipientInfo; 92typedef struct CMS_PasswordRecipientInfo_st CMS_PasswordRecipientInfo; 93typedef struct CMS_OtherRecipientInfo_st CMS_OtherRecipientInfo; 94typedef struct CMS_ReceiptsFrom_st CMS_ReceiptsFrom; 95 96struct CMS_ContentInfo_st { 97 ASN1_OBJECT *contentType; 98 union { 99 ASN1_OCTET_STRING *data; 100 CMS_SignedData *signedData; 101 CMS_EnvelopedData *envelopedData; 102 CMS_DigestedData *digestedData; 103 CMS_EncryptedData *encryptedData; 104 CMS_AuthenticatedData *authenticatedData; 105 CMS_CompressedData *compressedData; 106 ASN1_TYPE *other; 107 /* Other types ... */ 108 void *otherData; 109 } d; 110}; 111 112struct CMS_SignedData_st { 113 long version; 114 STACK_OF(X509_ALGOR) *digestAlgorithms; 115 CMS_EncapsulatedContentInfo *encapContentInfo; 116 STACK_OF(CMS_CertificateChoices) *certificates; 117 STACK_OF(CMS_RevocationInfoChoice) *crls; 118 STACK_OF(CMS_SignerInfo) *signerInfos; 119}; 120 121struct CMS_EncapsulatedContentInfo_st { 122 ASN1_OBJECT *eContentType; 123 ASN1_OCTET_STRING *eContent; 124 /* Set to 1 if incomplete structure only part set up */ 125 int partial; 126}; 127 128struct CMS_SignerInfo_st { 129 long version; 130 CMS_SignerIdentifier *sid; 131 X509_ALGOR *digestAlgorithm; 132 STACK_OF(X509_ATTRIBUTE) *signedAttrs; 133 X509_ALGOR *signatureAlgorithm; 134 ASN1_OCTET_STRING *signature; 135 STACK_OF(X509_ATTRIBUTE) *unsignedAttrs; 136 /* Signing certificate and key */ 137 X509 *signer; 138 EVP_PKEY *pkey; 139 /* Digest and public key context for alternative parameters */ 140 EVP_MD_CTX mctx; 141 EVP_PKEY_CTX *pctx; 142}; 143 144struct CMS_SignerIdentifier_st { 145 int type; 146 union { 147 CMS_IssuerAndSerialNumber *issuerAndSerialNumber; 148 ASN1_OCTET_STRING *subjectKeyIdentifier; 149 } d; 150}; 151 152struct CMS_EnvelopedData_st { 153 long version; 154 CMS_OriginatorInfo *originatorInfo; 155 STACK_OF(CMS_RecipientInfo) *recipientInfos; 156 CMS_EncryptedContentInfo *encryptedContentInfo; 157 STACK_OF(X509_ATTRIBUTE) *unprotectedAttrs; 158}; 159 160struct CMS_OriginatorInfo_st { 161 STACK_OF(CMS_CertificateChoices) *certificates; 162 STACK_OF(CMS_RevocationInfoChoice) *crls; 163}; 164 165struct CMS_EncryptedContentInfo_st { 166 ASN1_OBJECT *contentType; 167 X509_ALGOR *contentEncryptionAlgorithm; 168 ASN1_OCTET_STRING *encryptedContent; 169 /* Content encryption algorithm and key */ 170 const EVP_CIPHER *cipher; 171 unsigned char *key; 172 size_t keylen; 173 /* Set to 1 if we are debugging decrypt and don't fake keys for MMA */ 174 int debug; 175 /* Set to 1 if we have no cert and need extra safety measures for MMA */ 176 int havenocert; 177}; 178 179struct CMS_RecipientInfo_st { 180 int type; 181 union { 182 CMS_KeyTransRecipientInfo *ktri; 183 CMS_KeyAgreeRecipientInfo *kari; 184 CMS_KEKRecipientInfo *kekri; 185 CMS_PasswordRecipientInfo *pwri; 186 CMS_OtherRecipientInfo *ori; 187 } d; 188}; 189 190typedef CMS_SignerIdentifier CMS_RecipientIdentifier; 191 192struct CMS_KeyTransRecipientInfo_st { 193 long version; 194 CMS_RecipientIdentifier *rid; 195 X509_ALGOR *keyEncryptionAlgorithm; 196 ASN1_OCTET_STRING *encryptedKey; 197 /* Recipient Key and cert */ 198 X509 *recip; 199 EVP_PKEY *pkey; 200 /* Public key context for this operation */ 201 EVP_PKEY_CTX *pctx; 202}; 203 204struct CMS_KeyAgreeRecipientInfo_st { 205 long version; 206 CMS_OriginatorIdentifierOrKey *originator; 207 ASN1_OCTET_STRING *ukm; 208 X509_ALGOR *keyEncryptionAlgorithm; 209 STACK_OF(CMS_RecipientEncryptedKey) *recipientEncryptedKeys; 210 /* Public key context associated with current operation */ 211 EVP_PKEY_CTX *pctx; 212 /* Cipher context for CEK wrapping */ 213 EVP_CIPHER_CTX ctx; 214}; 215 216struct CMS_OriginatorIdentifierOrKey_st { 217 int type; 218 union { 219 CMS_IssuerAndSerialNumber *issuerAndSerialNumber; 220 ASN1_OCTET_STRING *subjectKeyIdentifier; 221 CMS_OriginatorPublicKey *originatorKey; 222 } d; 223}; 224 225struct CMS_OriginatorPublicKey_st { 226 X509_ALGOR *algorithm; 227 ASN1_BIT_STRING *publicKey; 228}; 229 230struct CMS_RecipientEncryptedKey_st { 231 CMS_KeyAgreeRecipientIdentifier *rid; 232 ASN1_OCTET_STRING *encryptedKey; 233 /* Public key associated with this recipient */ 234 EVP_PKEY *pkey; 235}; 236 237struct CMS_KeyAgreeRecipientIdentifier_st { 238 int type; 239 union { 240 CMS_IssuerAndSerialNumber *issuerAndSerialNumber; 241 CMS_RecipientKeyIdentifier *rKeyId; 242 } d; 243}; 244 245struct CMS_RecipientKeyIdentifier_st { 246 ASN1_OCTET_STRING *subjectKeyIdentifier; 247 ASN1_GENERALIZEDTIME *date; 248 CMS_OtherKeyAttribute *other; 249}; 250 251struct CMS_KEKRecipientInfo_st { 252 long version; 253 CMS_KEKIdentifier *kekid; 254 X509_ALGOR *keyEncryptionAlgorithm; 255 ASN1_OCTET_STRING *encryptedKey; 256 /* Extra info: symmetric key to use */ 257 unsigned char *key; 258 size_t keylen; 259}; 260 261struct CMS_KEKIdentifier_st { 262 ASN1_OCTET_STRING *keyIdentifier; 263 ASN1_GENERALIZEDTIME *date; 264 CMS_OtherKeyAttribute *other; 265}; 266 267struct CMS_PasswordRecipientInfo_st { 268 long version; 269 X509_ALGOR *keyDerivationAlgorithm; 270 X509_ALGOR *keyEncryptionAlgorithm; 271 ASN1_OCTET_STRING *encryptedKey; 272 /* Extra info: password to use */ 273 unsigned char *pass; 274 size_t passlen; 275}; 276 277struct CMS_OtherRecipientInfo_st { 278 ASN1_OBJECT *oriType; 279 ASN1_TYPE *oriValue; 280}; 281 282struct CMS_DigestedData_st { 283 long version; 284 X509_ALGOR *digestAlgorithm; 285 CMS_EncapsulatedContentInfo *encapContentInfo; 286 ASN1_OCTET_STRING *digest; 287}; 288 289struct CMS_EncryptedData_st { 290 long version; 291 CMS_EncryptedContentInfo *encryptedContentInfo; 292 STACK_OF(X509_ATTRIBUTE) *unprotectedAttrs; 293}; 294 295struct CMS_AuthenticatedData_st { 296 long version; 297 CMS_OriginatorInfo *originatorInfo; 298 STACK_OF(CMS_RecipientInfo) *recipientInfos; 299 X509_ALGOR *macAlgorithm; 300 X509_ALGOR *digestAlgorithm; 301 CMS_EncapsulatedContentInfo *encapContentInfo; 302 STACK_OF(X509_ATTRIBUTE) *authAttrs; 303 ASN1_OCTET_STRING *mac; 304 STACK_OF(X509_ATTRIBUTE) *unauthAttrs; 305}; 306 307struct CMS_CompressedData_st { 308 long version; 309 X509_ALGOR *compressionAlgorithm; 310 STACK_OF(CMS_RecipientInfo) *recipientInfos; 311 CMS_EncapsulatedContentInfo *encapContentInfo; 312}; 313 314struct CMS_RevocationInfoChoice_st { 315 int type; 316 union { 317 X509_CRL *crl; 318 CMS_OtherRevocationInfoFormat *other; 319 } d; 320}; 321 322# define CMS_REVCHOICE_CRL 0 323# define CMS_REVCHOICE_OTHER 1 324 325struct CMS_OtherRevocationInfoFormat_st { 326 ASN1_OBJECT *otherRevInfoFormat; 327 ASN1_TYPE *otherRevInfo; 328}; 329 330struct CMS_CertificateChoices { 331 int type; 332 union { 333 X509 *certificate; 334 ASN1_STRING *extendedCertificate; /* Obsolete */ 335 ASN1_STRING *v1AttrCert; /* Left encoded for now */ 336 ASN1_STRING *v2AttrCert; /* Left encoded for now */ 337 CMS_OtherCertificateFormat *other; 338 } d; 339}; 340 341# define CMS_CERTCHOICE_CERT 0 342# define CMS_CERTCHOICE_EXCERT 1 343# define CMS_CERTCHOICE_V1ACERT 2 344# define CMS_CERTCHOICE_V2ACERT 3 345# define CMS_CERTCHOICE_OTHER 4 346 347struct CMS_OtherCertificateFormat_st { 348 ASN1_OBJECT *otherCertFormat; 349 ASN1_TYPE *otherCert; 350}; 351 352/* 353 * This is also defined in pkcs7.h but we duplicate it to allow the CMS code 354 * to be independent of PKCS#7 355 */ 356 357struct CMS_IssuerAndSerialNumber_st { 358 X509_NAME *issuer; 359 ASN1_INTEGER *serialNumber; 360}; 361 362struct CMS_OtherKeyAttribute_st { 363 ASN1_OBJECT *keyAttrId; 364 ASN1_TYPE *keyAttr; 365}; 366 367/* ESS structures */ 368 369# ifdef HEADER_X509V3_H 370 371struct CMS_ReceiptRequest_st { 372 ASN1_OCTET_STRING *signedContentIdentifier; 373 CMS_ReceiptsFrom *receiptsFrom; 374 STACK_OF(GENERAL_NAMES) *receiptsTo; 375}; 376 377struct CMS_ReceiptsFrom_st { 378 int type; 379 union { 380 long allOrFirstTier; 381 STACK_OF(GENERAL_NAMES) *receiptList; 382 } d; 383}; 384# endif 385 386struct CMS_Receipt_st { 387 long version; 388 ASN1_OBJECT *contentType; 389 ASN1_OCTET_STRING *signedContentIdentifier; 390 ASN1_OCTET_STRING *originatorSignatureValue; 391}; 392 393DECLARE_ASN1_FUNCTIONS(CMS_ContentInfo) 394DECLARE_ASN1_ITEM(CMS_SignerInfo) 395DECLARE_ASN1_ITEM(CMS_IssuerAndSerialNumber) 396DECLARE_ASN1_ITEM(CMS_Attributes_Sign) 397DECLARE_ASN1_ITEM(CMS_Attributes_Verify) 398DECLARE_ASN1_ITEM(CMS_RecipientInfo) 399DECLARE_ASN1_ITEM(CMS_PasswordRecipientInfo) 400DECLARE_ASN1_ALLOC_FUNCTIONS(CMS_IssuerAndSerialNumber) 401 402# define CMS_SIGNERINFO_ISSUER_SERIAL 0 403# define CMS_SIGNERINFO_KEYIDENTIFIER 1 404 405# define CMS_RECIPINFO_ISSUER_SERIAL 0 406# define CMS_RECIPINFO_KEYIDENTIFIER 1 407 408# define CMS_REK_ISSUER_SERIAL 0 409# define CMS_REK_KEYIDENTIFIER 1 410 411# define CMS_OIK_ISSUER_SERIAL 0 412# define CMS_OIK_KEYIDENTIFIER 1 413# define CMS_OIK_PUBKEY 2 414 415BIO *cms_content_bio(CMS_ContentInfo *cms); 416 417CMS_ContentInfo *cms_Data_create(void); 418 419CMS_ContentInfo *cms_DigestedData_create(const EVP_MD *md); 420BIO *cms_DigestedData_init_bio(CMS_ContentInfo *cms); 421int cms_DigestedData_do_final(CMS_ContentInfo *cms, BIO *chain, int verify); 422 423BIO *cms_SignedData_init_bio(CMS_ContentInfo *cms); 424int cms_SignedData_final(CMS_ContentInfo *cms, BIO *chain); 425int cms_set1_SignerIdentifier(CMS_SignerIdentifier *sid, X509 *cert, 426 int type); 427int cms_SignerIdentifier_get0_signer_id(CMS_SignerIdentifier *sid, 428 ASN1_OCTET_STRING **keyid, 429 X509_NAME **issuer, 430 ASN1_INTEGER **sno); 431int cms_SignerIdentifier_cert_cmp(CMS_SignerIdentifier *sid, X509 *cert); 432 433CMS_ContentInfo *cms_CompressedData_create(int comp_nid); 434BIO *cms_CompressedData_init_bio(CMS_ContentInfo *cms); 435 436void cms_DigestAlgorithm_set(X509_ALGOR *alg, const EVP_MD *md); 437BIO *cms_DigestAlgorithm_init_bio(X509_ALGOR *digestAlgorithm); 438int cms_DigestAlgorithm_find_ctx(EVP_MD_CTX *mctx, BIO *chain, 439 X509_ALGOR *mdalg); 440 441int cms_ias_cert_cmp(CMS_IssuerAndSerialNumber *ias, X509 *cert); 442int cms_keyid_cert_cmp(ASN1_OCTET_STRING *keyid, X509 *cert); 443int cms_set1_ias(CMS_IssuerAndSerialNumber **pias, X509 *cert); 444int cms_set1_keyid(ASN1_OCTET_STRING **pkeyid, X509 *cert); 445 446BIO *cms_EncryptedContent_init_bio(CMS_EncryptedContentInfo *ec); 447BIO *cms_EncryptedData_init_bio(CMS_ContentInfo *cms); 448int cms_EncryptedContent_init(CMS_EncryptedContentInfo *ec, 449 const EVP_CIPHER *cipher, 450 const unsigned char *key, size_t keylen); 451 452int cms_Receipt_verify(CMS_ContentInfo *cms, CMS_ContentInfo *req_cms); 453int cms_msgSigDigest_add1(CMS_SignerInfo *dest, CMS_SignerInfo *src); 454ASN1_OCTET_STRING *cms_encode_Receipt(CMS_SignerInfo *si); 455 456BIO *cms_EnvelopedData_init_bio(CMS_ContentInfo *cms); 457CMS_EnvelopedData *cms_get0_enveloped(CMS_ContentInfo *cms); 458int cms_env_asn1_ctrl(CMS_RecipientInfo *ri, int cmd); 459int cms_pkey_get_ri_type(EVP_PKEY *pk); 460/* KARI routines */ 461int cms_RecipientInfo_kari_init(CMS_RecipientInfo *ri, X509 *recip, 462 EVP_PKEY *pk, unsigned int flags); 463int cms_RecipientInfo_kari_encrypt(CMS_ContentInfo *cms, 464 CMS_RecipientInfo *ri); 465 466/* PWRI routines */ 467int cms_RecipientInfo_pwri_crypt(CMS_ContentInfo *cms, CMS_RecipientInfo *ri, 468 int en_de); 469 470#ifdef __cplusplus 471} 472#endif 473#endif 474