2 RFC3161 Timestamp Countersignature Verification over OpenSSL.
3 The timestamp is generated by a TimeStamping Authority (TSA) and asserts that a
4 publisher's signature existed before the specified time. The timestamp extends
5 the lifetime of the signature when a signing certificate expires or is later
8 Copyright (c) 2014 - 2017, Intel Corporation. All rights reserved.<BR>
9 This program and the accompanying materials
10 are licensed and made available under the terms and conditions of the BSD License
11 which accompanies this distribution. The full text of the license may be found at
12 http://opensource.org/licenses/bsd-license.php
14 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
15 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
19 #include "InternalCryptLib.h"
21 #include <openssl/asn1.h>
22 #include <openssl/asn1t.h>
23 #include <openssl/x509.h>
24 #include <openssl/x509v3.h>
25 #include <openssl/pkcs7.h>
28 // OID ASN.1 Value for SPC_RFC3161_OBJID ("1.3.6.1.4.1.311.3.3.1")
30 UINT8 mSpcRFC3161OidValue
[] = {
31 0x2b, 0x06, 0x01, 0x04, 0x01, 0x82, 0x37, 0x03, 0x03, 0x01
35 /// The messageImprint field SHOULD contain the hash of the datum to be
36 /// time-stamped. The hash is represented as an OCTET STRING. Its
37 /// length MUST match the length of the hash value for that algorithm
38 /// (e.g., 20 bytes for SHA-1 or 16 bytes for MD5).
40 /// MessageImprint ::= SEQUENCE {
41 /// hashAlgorithm AlgorithmIdentifier,
42 /// hashedMessage OCTET STRING }
45 X509_ALGOR
*HashAlgorithm
;
46 ASN1_OCTET_STRING
*HashedMessage
;
50 // ASN.1 Functions for TS_MESSAGE_IMPRINT
52 DECLARE_ASN1_FUNCTIONS (TS_MESSAGE_IMPRINT
)
53 ASN1_SEQUENCE (TS_MESSAGE_IMPRINT
) = {
54 ASN1_SIMPLE (TS_MESSAGE_IMPRINT
, HashAlgorithm
, X509_ALGOR
),
55 ASN1_SIMPLE (TS_MESSAGE_IMPRINT
, HashedMessage
, ASN1_OCTET_STRING
)
56 } ASN1_SEQUENCE_END (TS_MESSAGE_IMPRINT
)
57 IMPLEMENT_ASN1_FUNCTIONS (TS_MESSAGE_IMPRINT
)
60 /// Accuracy represents the time deviation around the UTC time contained
61 /// in GeneralizedTime of time-stamp token.
63 /// Accuracy ::= SEQUENCE {
64 /// seconds INTEGER OPTIONAL,
65 /// millis [0] INTEGER (1..999) OPTIONAL,
66 /// micros [1] INTEGER (1..999) OPTIONAL }
69 ASN1_INTEGER
*Seconds
;
75 // ASN.1 Functions for TS_ACCURACY
77 DECLARE_ASN1_FUNCTIONS (TS_ACCURACY
)
78 ASN1_SEQUENCE (TS_ACCURACY
) = {
79 ASN1_OPT (TS_ACCURACY
, Seconds
, ASN1_INTEGER
),
80 ASN1_IMP_OPT (TS_ACCURACY
, Millis
, ASN1_INTEGER
, 0),
81 ASN1_IMP_OPT (TS_ACCURACY
, Micros
, ASN1_INTEGER
, 1)
82 } ASN1_SEQUENCE_END (TS_ACCURACY
)
83 IMPLEMENT_ASN1_FUNCTIONS (TS_ACCURACY
)
86 /// The timestamp token info resulting from a successful timestamp request,
87 /// as defined in RFC 3161.
89 /// TSTInfo ::= SEQUENCE {
90 /// version INTEGER { v1(1) },
91 /// policy TSAPolicyId,
92 /// messageImprint MessageImprint,
93 /// -- MUST have the same value as the similar field in
95 /// serialNumber INTEGER,
96 /// -- Time-Stamping users MUST be ready to accommodate integers
97 /// -- up to 160 bits.
98 /// genTime GeneralizedTime,
99 /// accuracy Accuracy OPTIONAL,
100 /// ordering BOOLEAN DEFAULT FALSE,
101 /// nonce INTEGER OPTIONAL,
102 /// -- MUST be present if the similar field was present
103 /// -- in TimeStampReq. In that case it MUST have the same value.
104 /// tsa [0] GeneralName OPTIONAL,
105 /// extensions [1] IMPLICIT Extensions OPTIONAL }
108 ASN1_INTEGER
*Version
;
110 TS_MESSAGE_IMPRINT
*MessageImprint
;
111 ASN1_INTEGER
*SerialNumber
;
112 ASN1_GENERALIZEDTIME
*GenTime
;
113 TS_ACCURACY
*Accuracy
;
114 ASN1_BOOLEAN Ordering
;
117 STACK_OF(X509_EXTENSION
) *Extensions
;
121 // ASN.1 Functions for TS_TST_INFO
123 DECLARE_ASN1_FUNCTIONS (TS_TST_INFO
)
124 ASN1_SEQUENCE (TS_TST_INFO
) = {
125 ASN1_SIMPLE (TS_TST_INFO
, Version
, ASN1_INTEGER
),
126 ASN1_SIMPLE (TS_TST_INFO
, Policy
, ASN1_OBJECT
),
127 ASN1_SIMPLE (TS_TST_INFO
, MessageImprint
, TS_MESSAGE_IMPRINT
),
128 ASN1_SIMPLE (TS_TST_INFO
, SerialNumber
, ASN1_INTEGER
),
129 ASN1_SIMPLE (TS_TST_INFO
, GenTime
, ASN1_GENERALIZEDTIME
),
130 ASN1_OPT (TS_TST_INFO
, Accuracy
, TS_ACCURACY
),
131 ASN1_OPT (TS_TST_INFO
, Ordering
, ASN1_FBOOLEAN
),
132 ASN1_OPT (TS_TST_INFO
, Nonce
, ASN1_INTEGER
),
133 ASN1_EXP_OPT(TS_TST_INFO
, Tsa
, GENERAL_NAME
, 0),
134 ASN1_IMP_SEQUENCE_OF_OPT (TS_TST_INFO
, Extensions
, X509_EXTENSION
, 1)
135 } ASN1_SEQUENCE_END (TS_TST_INFO
)
136 IMPLEMENT_ASN1_FUNCTIONS (TS_TST_INFO
)
140 Convert ASN.1 GeneralizedTime to EFI Time.
142 @param[in] Asn1Time Pointer to the ASN.1 GeneralizedTime to be converted.
143 @param[out] SigningTime Return the corresponding EFI Time.
145 @retval TRUE The time conversion succeeds.
146 @retval FALSE Invalid parameters.
151 ConvertAsn1TimeToEfiTime (
152 IN ASN1_TIME
*Asn1Time
,
153 OUT EFI_TIME
*EfiTime
159 if ((Asn1Time
== NULL
) || (EfiTime
== NULL
)) {
163 Str
= (CONST CHAR8
*)Asn1Time
->data
;
164 SetMem (EfiTime
, 0, sizeof (EFI_TIME
));
167 if (Asn1Time
->type
== V_ASN1_UTCTIME
) { /* two digit year */
168 EfiTime
->Year
= (Str
[Index
++] - '0') * 10;
169 EfiTime
->Year
+= (Str
[Index
++] - '0');
170 if (EfiTime
->Year
< 70) {
171 EfiTime
->Year
+= 100;
173 } else if (Asn1Time
->type
== V_ASN1_GENERALIZEDTIME
) { /* four digit year */
174 EfiTime
->Year
= (Str
[Index
++] - '0') * 1000;
175 EfiTime
->Year
+= (Str
[Index
++] - '0') * 100;
176 EfiTime
->Year
+= (Str
[Index
++] - '0') * 10;
177 EfiTime
->Year
+= (Str
[Index
++] - '0');
178 if ((EfiTime
->Year
< 1900) || (EfiTime
->Year
> 9999)) {
183 EfiTime
->Month
= (Str
[Index
++] - '0') * 10;
184 EfiTime
->Month
+= (Str
[Index
++] - '0');
185 if ((EfiTime
->Month
< 1) || (EfiTime
->Month
> 12)) {
189 EfiTime
->Day
= (Str
[Index
++] - '0') * 10;
190 EfiTime
->Day
+= (Str
[Index
++] - '0');
191 if ((EfiTime
->Day
< 1) || (EfiTime
->Day
> 31)) {
195 EfiTime
->Hour
= (Str
[Index
++] - '0') * 10;
196 EfiTime
->Hour
+= (Str
[Index
++] - '0');
197 if (EfiTime
->Hour
> 23) {
201 EfiTime
->Minute
= (Str
[Index
++] - '0') * 10;
202 EfiTime
->Minute
+= (Str
[Index
++] - '0');
203 if (EfiTime
->Minute
> 59) {
207 EfiTime
->Second
= (Str
[Index
++] - '0') * 10;
208 EfiTime
->Second
+= (Str
[Index
++] - '0');
209 if (EfiTime
->Second
> 59) {
213 /* Note: we did not adjust the time based on time zone information */
220 Check the validity of TimeStamp Token Information.
222 @param[in] TstInfo Pointer to the TS_TST_INFO structure.
223 @param[in] TimestampedData Pointer to the data to be time-stamped.
224 @param[in] DataSize Size of timestamped data in bytes.
226 @retval TRUE The TimeStamp Token Information is valid.
227 @retval FALSE Invalid TimeStamp Token Information.
233 IN CONST TS_TST_INFO
*TstInfo
,
234 IN CONST UINT8
*TimestampedData
,
239 TS_MESSAGE_IMPRINT
*Imprint
;
240 X509_ALGOR
*HashAlgo
;
255 // -- Check version number of Timestamp:
256 // The version field (currently v1) describes the version of the time-stamp token.
257 // Conforming time-stamping servers MUST be able to provide version 1 time-stamp tokens.
259 if ((ASN1_INTEGER_get (TstInfo
->Version
)) != 1) {
265 // The policy field MUST indicate the TSA's policy under which the response was produced.
267 if (TstInfo
->Policy
== NULL
) {
268 /// NOTE: Need to check if the requested and returned policies.
269 /// We have no information about the Requested TSA Policy.
274 // -- Compute & Check Message Imprint
276 Imprint
= TstInfo
->MessageImprint
;
277 HashAlgo
= X509_ALGOR_dup (Imprint
->HashAlgorithm
);
279 Md
= EVP_get_digestbyobj (HashAlgo
->algorithm
);
284 MdSize
= EVP_MD_size (Md
);
285 HashedMsg
= AllocateZeroPool (MdSize
);
286 if (HashedMsg
== NULL
) {
289 MdCtx
= EVP_MD_CTX_new ();
293 if ((EVP_DigestInit_ex (MdCtx
, Md
, NULL
) != 1) ||
294 (EVP_DigestUpdate (MdCtx
, TimestampedData
, DataSize
) != 1) ||
295 (EVP_DigestFinal (MdCtx
, HashedMsg
, NULL
) != 1)) {
298 if ((MdSize
== (UINTN
)ASN1_STRING_length (Imprint
->HashedMessage
)) &&
299 (CompareMem (HashedMsg
, ASN1_STRING_get0_data (Imprint
->HashedMessage
), MdSize
) != 0)) {
306 if (TstInfo
->Nonce
!= NULL
) {
308 // Nonces is optional, No error if no nonce is returned;
313 // -- Check if the TSA name and signer certificate is matched.
315 if (TstInfo
->Tsa
!= NULL
) {
317 // Ignored the optional Tsa field checking.
324 X509_ALGOR_free (HashAlgo
);
325 EVP_MD_CTX_free (MdCtx
);
326 if (HashedMsg
!= NULL
) {
327 FreePool (HashedMsg
);
334 Verifies the validity of a TimeStamp Token as described in RFC 3161 ("Internet
335 X.509 Public Key Infrastructure Time-Stamp Protocol (TSP)").
337 If TSToken is NULL, then return FALSE.
338 If TimestampedData is NULL, then return FALSE.
340 @param[in] TSToken Pointer to the RFC3161 TimeStamp Token, which is generated
341 by a TSA and located in the software publisher's SignerInfo
343 @param[in] TokenSize Size of the TimeStamp Token in bytes.
344 @param[in] TsaCert Pointer to a trusted/root TSA certificate encoded in DER.
345 @param[in] CertSize Size of the trusted TSA certificate in bytes.
346 @param[in] TimestampedData Pointer to the data to be time-stamped.
347 @param[in] DataSize Size of timestamped data in bytes.
348 @param[out] SigningTime Return the time of timestamp generation time if the timestamp
351 @retval TRUE The specified timestamp token is valid.
352 @retval FALSE Invalid timestamp token.
357 TimestampTokenVerify (
358 IN CONST UINT8
*TSToken
,
360 IN CONST UINT8
*TsaCert
,
362 IN CONST UINT8
*TimestampedData
,
364 OUT EFI_TIME
*SigningTime
368 CONST UINT8
*TokenTemp
;
371 CONST UINT8
*CertTemp
;
372 X509_STORE
*CertStore
;
376 CONST UINT8
*TstTemp
;
377 TS_TST_INFO
*TstInfo
;
382 // Check input parameters
384 if ((TSToken
== NULL
) || (TsaCert
== NULL
) || (TimestampedData
== NULL
) ||
385 (TokenSize
> INT_MAX
) || (CertSize
> INT_MAX
) || (DataSize
> INT_MAX
)) {
392 if (SigningTime
!= NULL
) {
393 SetMem (SigningTime
, sizeof (EFI_TIME
), 0);
403 // TimeStamp Token should contain one valid DER-encoded ASN.1 PKCS#7 structure.
406 Pkcs7
= d2i_PKCS7 (NULL
, (const unsigned char **) &TokenTemp
, (int) TokenSize
);
412 // The timestamp signature (TSA's response) will be one PKCS#7 signed data.
414 if (!PKCS7_type_is_signed (Pkcs7
)) {
419 // Read the trusted TSA certificate (DER-encoded), and Construct X509 Certificate.
422 Cert
= d2i_X509 (NULL
, &CertTemp
, (long) CertSize
);
428 // Setup X509 Store for trusted certificate.
430 CertStore
= X509_STORE_new ();
431 if ((CertStore
== NULL
) || !(X509_STORE_add_cert (CertStore
, Cert
))) {
436 // Allow partial certificate chains, terminated by a non-self-signed but
437 // still trusted intermediate certificate. Also disable time checks.
439 X509_STORE_set_flags (CertStore
,
440 X509_V_FLAG_PARTIAL_CHAIN
| X509_V_FLAG_NO_CHECK_TIME
);
442 X509_STORE_set_purpose (CertStore
, X509_PURPOSE_ANY
);
445 // Verifies the PKCS#7 signedData structure, and output the signed contents.
447 OutBio
= BIO_new (BIO_s_mem ());
448 if (OutBio
== NULL
) {
451 if (!PKCS7_verify (Pkcs7
, NULL
, CertStore
, NULL
, OutBio
, PKCS7_BINARY
)) {
456 // Read the signed contents detached in timestamp signature.
458 TstData
= AllocateZeroPool (2048);
459 if (TstData
== NULL
) {
462 TstSize
= BIO_read (OutBio
, (void *) TstData
, 2048);
465 // Construct TS_TST_INFO structure from the signed contents.
468 TstInfo
= d2i_TS_TST_INFO (NULL
, (const unsigned char **) &TstTemp
,
470 if (TstInfo
== NULL
) {
475 // Check TS_TST_INFO structure.
477 Status
= CheckTSTInfo (TstInfo
, TimestampedData
, DataSize
);
483 // Retrieve the signing time from TS_TST_INFO structure.
485 if (SigningTime
!= NULL
) {
486 SetMem (SigningTime
, sizeof (EFI_TIME
), 0);
487 Status
= ConvertAsn1TimeToEfiTime (TstInfo
->GenTime
, SigningTime
);
496 X509_STORE_free (CertStore
);
498 TS_TST_INFO_free (TstInfo
);
500 if (TstData
!= NULL
) {
508 Verifies the validity of a RFC3161 Timestamp CounterSignature embedded in PE/COFF Authenticode
511 If AuthData is NULL, then return FALSE.
513 @param[in] AuthData Pointer to the Authenticode Signature retrieved from signed
514 PE/COFF image to be verified.
515 @param[in] DataSize Size of the Authenticode Signature in bytes.
516 @param[in] TsaCert Pointer to a trusted/root TSA certificate encoded in DER, which
517 is used for TSA certificate chain verification.
518 @param[in] CertSize Size of the trusted certificate in bytes.
519 @param[out] SigningTime Return the time of timestamp generation time if the timestamp
522 @retval TRUE The specified Authenticode includes a valid RFC3161 Timestamp CounterSignature.
523 @retval FALSE No valid RFC3161 Timestamp CounterSignature in the specified Authenticode data.
528 ImageTimestampVerify (
529 IN CONST UINT8
*AuthData
,
531 IN CONST UINT8
*TsaCert
,
533 OUT EFI_TIME
*SigningTime
539 STACK_OF(PKCS7_SIGNER_INFO
) *SignerInfos
;
540 PKCS7_SIGNER_INFO
*SignInfo
;
542 STACK_OF(X509_ATTRIBUTE
) *Sk
;
546 ASN1_OCTET_STRING
*EncDigest
;
551 // Input Parameters Checking.
553 if ((AuthData
== NULL
) || (TsaCert
== NULL
)) {
557 if ((DataSize
> INT_MAX
) || (CertSize
> INT_MAX
)) {
562 // Register & Initialize necessary digest algorithms for PKCS#7 Handling.
564 if ((EVP_add_digest (EVP_md5 ()) == 0) || (EVP_add_digest (EVP_sha1 ()) == 0) ||
565 (EVP_add_digest (EVP_sha256 ()) == 0) || (EVP_add_digest_alias (SN_sha1WithRSAEncryption
, SN_sha1WithRSA
)) == 0) {
577 // Decode ASN.1-encoded Authenticode data into PKCS7 structure.
580 Pkcs7
= d2i_PKCS7 (NULL
, (const unsigned char **) &Temp
, (int) DataSize
);
586 // Check if there is one and only one signer.
588 SignerInfos
= PKCS7_get_signer_info (Pkcs7
);
589 if (!SignerInfos
|| (sk_PKCS7_SIGNER_INFO_num (SignerInfos
) != 1)) {
594 // Locate the TimeStamp CounterSignature.
596 SignInfo
= sk_PKCS7_SIGNER_INFO_value (SignerInfos
, 0);
597 if (SignInfo
== NULL
) {
602 // Locate Message Digest which will be the data to be time-stamped.
604 EncDigest
= SignInfo
->enc_digest
;
605 if (EncDigest
== NULL
) {
610 // The RFC3161 timestamp counterSignature is contained in unauthenticatedAttributes field
613 Sk
= SignInfo
->unauth_attr
;
614 if (Sk
== NULL
) { // No timestamp counterSignature.
619 for (Index
= 0; Index
< (UINTN
) sk_X509_ATTRIBUTE_num (Sk
); Index
++) {
621 // Search valid RFC3161 timestamp counterSignature based on OBJID.
623 Xa
= sk_X509_ATTRIBUTE_value (Sk
, (int)Index
);
627 XaObj
= X509_ATTRIBUTE_get0_object(Xa
);
631 if ((OBJ_length(XaObj
) != sizeof (mSpcRFC3161OidValue
)) ||
632 (CompareMem (OBJ_get0_data(XaObj
), mSpcRFC3161OidValue
, sizeof (mSpcRFC3161OidValue
)) != 0)) {
635 Asn1Type
= X509_ATTRIBUTE_get0_type(Xa
, 0);
638 if (Asn1Type
== NULL
) {
642 TSToken
= Asn1Type
->value
.octet_string
->data
;
643 TokenSize
= Asn1Type
->value
.octet_string
->length
;
646 // TimeStamp counterSignature (Token) verification.
648 Status
= TimestampTokenVerify (