CryptoPkg: Change OPTIONAL keyword usage style

[mirror_edk2.git] / CryptoPkg / Library / BaseCryptLib / Pk / CryptPkcs1Oaep.c

/** @file\r
  This file contains UEFI wrapper functions for RSA PKCS1v2 OAEP encryption routines.\r
\r
  SPDX-License-Identifier: BSD-2-Clause-Patent\r
\r
  Copyright (C) 2016 Microsoft Corporation. All Rights Reserved.\r
  Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>\r
\r
**/\r
\r
#include "InternalCryptLib.h"\r
#include <openssl/objects.h>\r
#include <openssl/rsa.h>\r
#include <openssl/x509.h>\r
#include <Library/MemoryAllocationLib.h>\r
\r
/**\r
  Encrypts a blob using PKCS1v2 (RSAES-OAEP) schema. On success, will return the\r
  encrypted message in a newly allocated buffer.\r
\r
  Things that can cause a failure include:\r
  - X509 key size does not match any known key size.\r
  - Fail to parse X509 certificate.\r
  - Fail to allocate an intermediate buffer.\r
  - Null pointer provided for a non-optional parameter.\r
  - Data size is too large for the provided key size (max size is a function of key size\r
    and hash digest size).\r
\r
  @param[in]  PublicKey           A pointer to the DER-encoded X509 certificate that\r
                                  will be used to encrypt the data.\r
  @param[in]  PublicKeySize       Size of the X509 cert buffer.\r
  @param[in]  InData              Data to be encrypted.\r
  @param[in]  InDataSize          Size of the data buffer.\r
  @param[in]  PrngSeed            [Optional] If provided, a pointer to a random seed buffer\r
                                  to be used when initializing the PRNG. NULL otherwise.\r
  @param[in]  PrngSeedSize        [Optional] If provided, size of the random seed buffer.\r
                                  0 otherwise.\r
  @param[out] EncryptedData       Pointer to an allocated buffer containing the encrypted\r
                                  message.\r
  @param[out] EncryptedDataSize   Size of the encrypted message buffer.\r
\r
  @retval     TRUE                Encryption was successful.\r
  @retval     FALSE               Encryption failed.\r
\r
**/\r
BOOLEAN\r
EFIAPI\r
Pkcs1v2Encrypt (\r
  IN   CONST UINT8  *PublicKey,\r
  IN   UINTN        PublicKeySize,\r
  IN   UINT8        *InData,\r
  IN   UINTN        InDataSize,\r
  IN   CONST UINT8  *PrngSeed   OPTIONAL,\r
  IN   UINTN        PrngSeedSize   OPTIONAL,\r
  OUT  UINT8        **EncryptedData,\r
  OUT  UINTN        *EncryptedDataSize\r
  )\r
{\r
  BOOLEAN       Result;\r
  CONST UINT8   *TempPointer;\r
  X509          *CertData;\r
  EVP_PKEY      *InternalPublicKey;\r
  EVP_PKEY_CTX  *PkeyCtx;\r
  UINT8         *OutData;\r
  UINTN         OutDataSize;\r
\r
  //\r
  // Check input parameters.\r
  //\r
  if (PublicKey == NULL || InData == NULL ||\r
      EncryptedData == NULL || EncryptedDataSize == NULL) {\r
    return FALSE;\r
  }\r
\r
  //\r
  // Check public key size.\r
  //\r
  if (PublicKeySize > 0xFFFFFFFF) {\r
    //\r
    // Public key size is too large for implementation.\r
    //\r
    return FALSE;\r
  }\r
\r
  *EncryptedData        = NULL;\r
  *EncryptedDataSize    = 0;\r
  Result                = FALSE;\r
  TempPointer           = NULL;\r
  CertData              = NULL;\r
  InternalPublicKey     = NULL;\r
  PkeyCtx               = NULL;\r
  OutData               = NULL;\r
  OutDataSize           = 0;\r
\r
  //\r
  // If it provides a seed then use it.\r
  // Ohterwise, we'll seed with fixed values and hope that the PRNG has already been\r
  // used enough to generate sufficient entropy.\r
  //\r
  if (PrngSeed != NULL) {\r
    RandomSeed (PrngSeed, PrngSeedSize);\r
  } else {\r
    RandomSeed (NULL, 0);\r
  }\r
\r
  //\r
  // Parse the X509 cert and extract the public key.\r
  //\r
  TempPointer = PublicKey;\r
  CertData = d2i_X509 (&CertData, &TempPointer, (UINT32)PublicKeySize);\r
  if (CertData == NULL) {\r
    //\r
    // Fail to parse X509 cert.\r
    //\r
    goto _Exit;\r
  }\r
\r
  //\r
  // Extract the public key from the x509 cert in a format that\r
  // OpenSSL can use.\r
  //\r
  InternalPublicKey = X509_get_pubkey (CertData);\r
  if (InternalPublicKey == NULL) {\r
    //\r
    // Fail to extract public key.\r
    //\r
    goto _Exit;\r
  }\r
\r
  //\r
  // Create a context for the public key operation.\r
  //\r
  PkeyCtx = EVP_PKEY_CTX_new (InternalPublicKey, NULL);\r
  if (PkeyCtx == NULL) {\r
    //\r
    // Fail to create contex.\r
    //\r
    goto _Exit;\r
  }\r
  //\r
  // Initialize the context and set the desired padding.\r
  //\r
  if (EVP_PKEY_encrypt_init (PkeyCtx) <= 0 ||\r
      EVP_PKEY_CTX_set_rsa_padding (PkeyCtx, RSA_PKCS1_OAEP_PADDING) <= 0) {\r
    //\r
    // Fail to initialize the context.\r
    //\r
    goto _Exit;\r
  }\r
\r
  //\r
  // Determine the required buffer length for malloc'ing.\r
  //\r
  if (EVP_PKEY_encrypt (PkeyCtx, NULL, &OutDataSize, InData, InDataSize) <= 0) {\r
    //\r
    // Fail to determine output buffer size.\r
    //\r
    goto _Exit;\r
  }\r
\r
  //\r
  // Allocate a buffer for the output data.\r
  //\r
  OutData = AllocatePool (OutDataSize);\r
  if (OutData == NULL) {\r
    //\r
    // Fail to allocate the output buffer.\r
    //\r
    goto _Exit;\r
  }\r
\r
  //\r
  // Encrypt Data.\r
  //\r
  if (EVP_PKEY_encrypt (PkeyCtx, OutData, &OutDataSize, InData, InDataSize) <= 0) {\r
    //\r
    // Fail to encrypt data, need to free the output buffer.\r
    //\r
    FreePool (OutData);\r
    OutData = NULL;\r
    OutDataSize = 0;\r
    goto _Exit;\r
  }\r
\r
  //\r
  // Encrypt done.\r
  //\r
  *EncryptedData = OutData;\r
  *EncryptedDataSize = OutDataSize;\r
  Result = TRUE;\r
\r
_Exit:\r
  //\r
  // Release Resources\r
  //\r
  if (CertData != NULL) {\r
    X509_free (CertData );\r
  }\r
  if (InternalPublicKey != NULL) {\r
    EVP_PKEY_free (InternalPublicKey);\r
  }\r
  if (PkeyCtx != NULL) {\r
    EVP_PKEY_CTX_free (PkeyCtx);\r
  }\r
\r
  return Result;\r
}\r