FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

src: move more crypto to ncrypto · nodejs/node@8fb03d8 · GitHub

/ node Public

Commit 8fb03d8

Browse files
jasnell
authored and
aduh95
committed
src: move more crypto to ncrypto
PR-URL: #56653 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
1 parent 38acdb5 commit 8fb03d8

25 files changed

Lines changed: 1989 additions & 1134 deletions

‎deps/ncrypto/ncrypto.cc‎

Lines changed: 936 additions & 6 deletions
Large diffs are not rendered by default.

‎deps/ncrypto/ncrypto.h‎

Lines changed: 280 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -201,18 +201,28 @@ struct FunctionDeleter {
201201
template <typename T, void (*function)(T*)>
202202
using DeleteFnPtr = typename FunctionDeleter<T, function>::Pointer;
203203

204-
using BignumCtxPointer = DeleteFnPtr<BN_CTX, BN_CTX_free>;
205-
using BignumGenCallbackPointer = DeleteFnPtr<BN_GENCB, BN_GENCB_free>;
206-
using EVPKeyCtxPointer = DeleteFnPtr<EVP_PKEY_CTX, EVP_PKEY_CTX_free>;
207-
using EVPMDCtxPointer = DeleteFnPtr<EVP_MD_CTX, EVP_MD_CTX_free>;
208-
using HMACCtxPointer = DeleteFnPtr<HMAC_CTX, HMAC_CTX_free>;
209-
using NetscapeSPKIPointer = DeleteFnPtr<NETSCAPE_SPKI, NETSCAPE_SPKI_free>;
210204
using PKCS8Pointer = DeleteFnPtr<PKCS8_PRIV_KEY_INFO, PKCS8_PRIV_KEY_INFO_free>;
211205
using RSAPointer = DeleteFnPtr<RSA, RSA_free>;
212206
using SSLSessionPointer = DeleteFnPtr<SSL_SESSION, SSL_SESSION_free>;
213207

208+
class BIOPointer;
209+
class BignumPointer;
214210
class CipherCtxPointer;
211+
class DataPointer;
212+
class DHPointer;
215213
class ECKeyPointer;
214+
class EVPKeyPointer;
215+
class EVPMDCtxPointer;
216+
class SSLCtxPointer;
217+
class SSLPointer;
218+
class X509View;
219+
class X509Pointer;
220+
class ECDSASigPointer;
221+
class ECGroupPointer;
222+
class ECPointPointer;
223+
class ECKeyPointer;
224+
class Rsa;
225+
class Ec;
216226

217227
struct StackOfXASN1Deleter {
218228
void operator()(STACK_OF(ASN1_OBJECT) * p) const {
@@ -228,6 +238,9 @@ struct Buffer {
228238
size_t len = 0;
229239
};
230240

241+
DataPointer hashDigest(const Buffer<const unsigned char>& data,
242+
const EVP_MD* md);
243+
231244
class Cipher final {
232245
public:
233246
Cipher() = default;
@@ -258,15 +271,108 @@ class Cipher final {
258271
static const Cipher FromNid(int nid);
259272
static const Cipher FromCtx(const CipherCtxPointer& ctx);
260273

274+
struct CipherParams {
275+
int padding;
276+
const EVP_MD* digest;
277+
const Buffer<const void> label;
278+
};
279+
280+
static DataPointer encrypt(const EVPKeyPointer& key,
281+
const CipherParams& params,
282+
const Buffer<const void> in);
283+
static DataPointer decrypt(const EVPKeyPointer& key,
284+
const CipherParams& params,
285+
const Buffer<const void> in);
286+
287+
static DataPointer sign(const EVPKeyPointer& key,
288+
const CipherParams& params,
289+
const Buffer<const void> in);
290+
291+
static DataPointer recover(const EVPKeyPointer& key,
292+
const CipherParams& params,
293+
const Buffer<const void> in);
294+
261295
private:
262296
const EVP_CIPHER* cipher_ = nullptr;
263297
};
264298

299+
// ============================================================================
300+
// RSA
301+
302+
class Rsa final {
303+
public:
304+
Rsa();
305+
Rsa(OSSL3_CONST RSA* rsa);
306+
NCRYPTO_DISALLOW_COPY_AND_MOVE(Rsa)
307+
308+
inline operator bool() const { return rsa_ != nullptr; }
309+
inline operator OSSL3_CONST RSA*() const { return rsa_; }
310+
311+
struct PublicKey {
312+
const BIGNUM* n;
313+
const BIGNUM* e;
314+
const BIGNUM* d;
315+
};
316+
struct PrivateKey {
317+
const BIGNUM* p;
318+
const BIGNUM* q;
319+
const BIGNUM* dp;
320+
const BIGNUM* dq;
321+
const BIGNUM* qi;
322+
};
323+
struct PssParams {
324+
std::string_view digest = "sha1";
325+
std::optional<std::string_view> mgf1_digest = "sha1";
326+
int64_t salt_length = 20;
327+
};
328+
329+
const PublicKey getPublicKey() const;
330+
const PrivateKey getPrivateKey() const;
331+
const std::optional<PssParams> getPssParams() const;
332+
333+
bool setPublicKey(BignumPointer&& n, BignumPointer&& e);
334+
bool setPrivateKey(BignumPointer&& d,
335+
BignumPointer&& q,
336+
BignumPointer&& p,
337+
BignumPointer&& dp,
338+
BignumPointer&& dq,
339+
BignumPointer&& qi);
340+
341+
using CipherParams = Cipher::CipherParams;
342+
343+
static DataPointer encrypt(const EVPKeyPointer& key,
344+
const CipherParams& params,
345+
const Buffer<const void> in);
346+
static DataPointer decrypt(const EVPKeyPointer& key,
347+
const CipherParams& params,
348+
const Buffer<const void> in);
349+
350+
private:
351+
OSSL3_CONST RSA* rsa_;
352+
};
353+
354+
class Ec final {
355+
public:
356+
Ec();
357+
Ec(OSSL3_CONST EC_KEY* key);
358+
NCRYPTO_DISALLOW_COPY_AND_MOVE(Ec)
359+
360+
const EC_GROUP* getGroup() const;
361+
int getCurve() const;
362+
363+
inline operator bool() const { return ec_ != nullptr; }
364+
inline operator OSSL3_CONST EC_KEY*() const { return ec_; }
365+
366+
private:
367+
OSSL3_CONST EC_KEY* ec_ = nullptr;
368+
};
369+
265370
// A managed pointer to a buffer of data. When destroyed the underlying
266371
// buffer will be freed.
267372
class DataPointer final {
268373
public:
269374
static DataPointer Alloc(size_t len);
375+
static DataPointer Copy(const Buffer<const void>& buffer);
270376

271377
DataPointer() = default;
272378
explicit DataPointer(void* data, size_t len);
@@ -283,6 +389,11 @@ class DataPointer final {
283389
void reset(void* data = nullptr, size_t len = 0);
284390
void reset(const Buffer<void>& buffer);
285391

392+
// Sets the underlying data buffer to all zeros.
393+
void zero();
394+
395+
DataPointer resize(size_t len);
396+
286397
// Releases ownership of the underlying data buffer. It is the caller's
287398
// responsibility to ensure the buffer is appropriately freed.
288399
Buffer<void> release();
@@ -471,13 +582,83 @@ class CipherCtxPointer final {
471582
DeleteFnPtr<EVP_CIPHER_CTX, EVP_CIPHER_CTX_free> ctx_;
472583
};
473584

585+
class EVPKeyCtxPointer final {
586+
public:
587+
EVPKeyCtxPointer();
588+
explicit EVPKeyCtxPointer(EVP_PKEY_CTX* ctx);
589+
EVPKeyCtxPointer(EVPKeyCtxPointer&& other) noexcept;
590+
EVPKeyCtxPointer& operator=(EVPKeyCtxPointer&& other) noexcept;
591+
NCRYPTO_DISALLOW_COPY(EVPKeyCtxPointer)
592+
~EVPKeyCtxPointer();
593+
594+
inline bool operator==(std::nullptr_t) const noexcept {
595+
return ctx_ == nullptr;
596+
}
597+
inline operator bool() const { return ctx_ != nullptr; }
598+
inline EVP_PKEY_CTX* get() const { return ctx_.get(); }
599+
void reset(EVP_PKEY_CTX* ctx = nullptr);
600+
EVP_PKEY_CTX* release();
601+
602+
bool initForDerive(const EVPKeyPointer& peer);
603+
DataPointer derive() const;
604+
605+
bool initForParamgen();
606+
bool setDhParameters(int prime_size, uint32_t generator);
607+
bool setDsaParameters(uint32_t bits, std::optional<int> q_bits);
608+
bool setEcParameters(int curve, int encoding);
609+
610+
bool setRsaOaepMd(const EVP_MD* md);
611+
bool setRsaMgf1Md(const EVP_MD* md);
612+
bool setRsaPadding(int padding);
613+
bool setRsaKeygenPubExp(BignumPointer&& e);
614+
bool setRsaKeygenBits(int bits);
615+
bool setRsaPssKeygenMd(const EVP_MD* md);
616+
bool setRsaPssKeygenMgf1Md(const EVP_MD* md);
617+
bool setRsaPssSaltlen(int salt_len);
618+
bool setRsaImplicitRejection();
619+
bool setRsaOaepLabel(DataPointer&& data);
620+
621+
bool setSignatureMd(const EVPMDCtxPointer& md);
622+
623+
bool publicCheck() const;
624+
bool privateCheck() const;
625+
626+
bool verify(const Buffer<const unsigned char>& sig,
627+
const Buffer<const unsigned char>& data);
628+
DataPointer sign(const Buffer<const unsigned char>& data);
629+
bool signInto(const Buffer<const unsigned char>& data,
630+
Buffer<unsigned char>* sig);
631+
632+
static constexpr int kDefaultRsaExponent = 0x10001;
633+
634+
static bool setRsaPadding(EVP_PKEY_CTX* ctx,
635+
int padding,
636+
std::optional<int> salt_len = std::nullopt);
637+
638+
EVPKeyPointer paramgen() const;
639+
640+
bool initForEncrypt();
641+
bool initForDecrypt();
642+
bool initForKeygen();
643+
int initForVerify();
644+
int initForSign();
645+
646+
static EVPKeyCtxPointer New(const EVPKeyPointer& key);
647+
static EVPKeyCtxPointer NewFromID(int id);
648+
649+
private:
650+
DeleteFnPtr<EVP_PKEY_CTX, EVP_PKEY_CTX_free> ctx_;
651+
};
652+
474653
class EVPKeyPointer final {
475654
public:
476655
static EVPKeyPointer New();
477656
static EVPKeyPointer NewRawPublic(int id,
478657
const Buffer<const unsigned char>& data);
479658
static EVPKeyPointer NewRawPrivate(int id,
480659
const Buffer<const unsigned char>& data);
660+
static EVPKeyPointer NewDH(DHPointer&& dh);
661+
static EVPKeyPointer NewRSA(RSAPointer&& rsa);
481662

482663
enum class PKEncodingType {
483664
// RSAPublicKey / RSAPrivateKey according to PKCS#1.
@@ -578,6 +759,15 @@ class EVPKeyPointer final {
578759

579760
static bool IsRSAPrivateKey(const Buffer<const unsigned char>& buffer);
580761

762+
std::optional<uint32_t> getBytesOfRS() const;
763+
int getDefaultSignPadding() const;
764+
operator Rsa() const;
765+
766+
bool isRsaVariant() const;
767+
bool isOneShotVariant() const;
768+
bool isSigVariant() const;
769+
bool validateDsaParameters() const;
770+
581771
private:
582772
DeleteFnPtr<EVP_PKEY, EVP_PKEY_free> pkey_;
583773
};
@@ -663,9 +853,6 @@ struct StackOfX509Deleter {
663853
};
664854
using StackOfX509 = std::unique_ptr<STACK_OF(X509), StackOfX509Deleter>;
665855

666-
class X509Pointer;
667-
class X509View;
668-
669856
class SSLCtxPointer final {
670857
public:
671858
SSLCtxPointer() = default;
@@ -792,6 +979,14 @@ class X509View final {
792979
CheckMatch checkEmail(const std::string_view email, int flags) const;
793980
CheckMatch checkIp(const std::string_view ip, int flags) const;
794981

982+
using UsageCallback = std::function<void(std::string_view)>;
983+
bool enumUsages(UsageCallback callback) const;
984+
985+
template <typename T>
986+
using KeyCallback = std::function<bool(const T& t)>;
987+
bool ifRsa(KeyCallback<Rsa> callback) const;
988+
bool ifEc(KeyCallback<Ec> callback) const;
989+
795990
private:
796991
const X509* cert_ = nullptr;
797992
};
@@ -948,6 +1143,77 @@ class ECKeyPointer final {
9481143
DeleteFnPtr<EC_KEY, EC_KEY_free> key_;
9491144
};
9501145

1146+
class EVPMDCtxPointer final {
1147+
public:
1148+
EVPMDCtxPointer();
1149+
explicit EVPMDCtxPointer(EVP_MD_CTX* ctx);
1150+
EVPMDCtxPointer(EVPMDCtxPointer&& other) noexcept;
1151+
EVPMDCtxPointer& operator=(EVPMDCtxPointer&& other) noexcept;
1152+
NCRYPTO_DISALLOW_COPY(EVPMDCtxPointer)
1153+
~EVPMDCtxPointer();
1154+
1155+
inline bool operator==(std::nullptr_t) noexcept { return ctx_ == nullptr; }
1156+
inline operator bool() const { return ctx_ != nullptr; }
1157+
inline EVP_MD_CTX* get() const { return ctx_.get(); }
1158+
inline operator EVP_MD_CTX*() const { return ctx_.get(); }
1159+
void reset(EVP_MD_CTX* ctx = nullptr);
1160+
EVP_MD_CTX* release();
1161+
1162+
bool digestInit(const EVP_MD* digest);
1163+
bool digestUpdate(const Buffer<const void>& in);
1164+
DataPointer digestFinal(size_t length);
1165+
bool digestFinalInto(Buffer<void>* buf);
1166+
size_t getExpectedSize();
1167+
1168+
std::optional<EVP_PKEY_CTX*> signInit(const EVPKeyPointer& key,
1169+
const EVP_MD* digest);
1170+
std::optional<EVP_PKEY_CTX*> verifyInit(const EVPKeyPointer& key,
1171+
const EVP_MD* digest);
1172+
1173+
DataPointer signOneShot(const Buffer<const unsigned char>& buf) const;
1174+
DataPointer sign(const Buffer<const unsigned char>& buf) const;
1175+
bool verify(const Buffer<const unsigned char>& buf,
1176+
const Buffer<const unsigned char>& sig) const;
1177+
1178+
const EVP_MD* getDigest() const;
1179+
size_t getDigestSize() const;
1180+
bool hasXofFlag() const;
1181+
1182+
bool copyTo(const EVPMDCtxPointer& other) const;
1183+
1184+
static EVPMDCtxPointer New();
1185+
1186+
private:
1187+
DeleteFnPtr<EVP_MD_CTX, EVP_MD_CTX_free> ctx_;
1188+
};
1189+
1190+
class HMACCtxPointer final {
1191+
public:
1192+
HMACCtxPointer();
1193+
explicit HMACCtxPointer(HMAC_CTX* ctx);
1194+
HMACCtxPointer(HMACCtxPointer&& other) noexcept;
1195+
HMACCtxPointer& operator=(HMACCtxPointer&& other) noexcept;
1196+
NCRYPTO_DISALLOW_COPY(HMACCtxPointer)
1197+
~HMACCtxPointer();
1198+
1199+
inline bool operator==(std::nullptr_t) noexcept { return ctx_ == nullptr; }
1200+
inline operator bool() const { return ctx_ != nullptr; }
1201+
inline HMAC_CTX* get() const { return ctx_.get(); }
1202+
inline operator HMAC_CTX*() const { return ctx_.get(); }
1203+
void reset(HMAC_CTX* ctx = nullptr);
1204+
HMAC_CTX* release();
1205+
1206+
bool init(const Buffer<const void>& buf, const EVP_MD* md);
1207+
bool update(const Buffer<const void>& buf);
1208+
DataPointer digest();
1209+
bool digestInto(Buffer<void>* buf);
1210+
1211+
static HMACCtxPointer New();
1212+
1213+
private:
1214+
DeleteFnPtr<HMAC_CTX, HMAC_CTX_free> ctx_;
1215+
};
1216+
9511217
#ifndef OPENSSL_NO_ENGINE
9521218
class EnginePointer final {
9531219
public:
@@ -1025,12 +1291,17 @@ Buffer<char> ExportChallenge(const char* input, size_t length);
10251291
// KDF
10261292

10271293
const EVP_MD* getDigestByName(const std::string_view name);
1294+
const EVP_CIPHER* getCipherByName(const std::string_view name);
10281295

10291296
// Verify that the specified HKDF output length is valid for the given digest.
10301297
// The maximum length for HKDF output for a given digest is 255 times the
10311298
// hash size for the given digest algorithm.
10321299
bool checkHkdfLength(const EVP_MD* md, size_t length);
10331300

1301+
bool extractP1363(const Buffer<const unsigned char>& buf,
1302+
unsigned char* dest,
1303+
size_t n);
1304+
10341305
DataPointer hkdf(const EVP_MD* md,
10351306
const Buffer<const unsigned char>& key,
10361307
const Buffer<const unsigned char>& info,

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL