|
Packit |
6b81fa |
/*
|
|
Packit |
6b81fa |
* Copyright (C) 2018 Anderson Toshiyuki Sasaki
|
|
Packit |
6b81fa |
* Copyright (c) 2018 Red Hat, Inc.
|
|
Packit |
6b81fa |
* All rights reserved.
|
|
Packit |
6b81fa |
*
|
|
Packit |
6b81fa |
* Redistribution and use in source and binary forms, with or without
|
|
Packit |
6b81fa |
* modification, are permitted provided that the following conditions
|
|
Packit |
6b81fa |
* are met:
|
|
Packit |
6b81fa |
* 1. Redistributions of source code must retain the above copyright
|
|
Packit |
6b81fa |
* notice, this list of conditions and the following disclaimer.
|
|
Packit |
6b81fa |
* 2. Redistributions in binary form must reproduce the above copyright
|
|
Packit |
6b81fa |
* notice, this list of conditions and the following disclaimer in the
|
|
Packit |
6b81fa |
* documentation and/or other materials provided with the distribution.
|
|
Packit |
6b81fa |
*
|
|
Packit |
6b81fa |
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
|
Packit |
6b81fa |
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
Packit |
6b81fa |
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
Packit |
6b81fa |
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
|
Packit |
6b81fa |
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
Packit |
6b81fa |
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
Packit |
6b81fa |
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
Packit |
6b81fa |
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
Packit |
6b81fa |
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
Packit |
6b81fa |
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
Packit |
6b81fa |
* SUCH DAMAGE.
|
|
Packit |
6b81fa |
*
|
|
Packit |
6b81fa |
*/
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
#include <stdio.h>
|
|
Packit |
6b81fa |
#include <stdlib.h>
|
|
Packit |
6b81fa |
#include <string.h>
|
|
Packit |
6b81fa |
#include <openssl/rsa.h>
|
|
Packit |
6b81fa |
#include <openssl/evp.h>
|
|
Packit |
6b81fa |
#include <openssl/pem.h>
|
|
Packit |
6b81fa |
#include <openssl/err.h>
|
|
Packit |
6b81fa |
#include <openssl/engine.h>
|
|
Packit |
6b81fa |
#include <openssl/conf.h>
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
static void display_openssl_errors(int l)
|
|
Packit |
6b81fa |
{
|
|
Packit |
6b81fa |
const char *file;
|
|
Packit |
6b81fa |
char buf[120];
|
|
Packit |
6b81fa |
int e, line;
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
if (ERR_peek_error() == 0)
|
|
Packit |
6b81fa |
return;
|
|
Packit |
6b81fa |
fprintf(stderr, "At main.c:%d:\n", l);
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
while ((e = ERR_get_error_line(&file, &line))) {
|
|
Packit |
6b81fa |
ERR_error_string(e, buf);
|
|
Packit |
6b81fa |
fprintf(stderr, "- SSL %s: %s:%d\n", buf, file, line);
|
|
Packit |
6b81fa |
}
|
|
Packit |
6b81fa |
}
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
int main(int argc, char **argv)
|
|
Packit |
6b81fa |
{
|
|
Packit |
6b81fa |
EVP_PKEY *private_key, *public_key;
|
|
Packit |
6b81fa |
EVP_PKEY_CTX *pkey_ctx;
|
|
Packit |
6b81fa |
EVP_MD_CTX *md_ctx;
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
const EVP_MD *digest_algo;
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
char *private_key_name, *public_key_name;
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
unsigned char sig[4096];
|
|
Packit |
6b81fa |
size_t sig_len;
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
unsigned char md[128];
|
|
Packit |
6b81fa |
size_t md_len;
|
|
Packit |
6b81fa |
unsigned digest_len;
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
char *key_pass = NULL;
|
|
Packit |
6b81fa |
const char *module_path, *efile;
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
ENGINE *e;
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
int ret;
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
if (argc < 5) {
|
|
Packit |
6b81fa |
fprintf(stderr, "usage: %s [PIN] [CONF] [private key URL] [public key URL] [module]\n", argv[0]);
|
|
Packit |
6b81fa |
fprintf(stderr, "\n");
|
|
Packit |
6b81fa |
exit(1);
|
|
Packit |
6b81fa |
}
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
key_pass = argv[1];
|
|
Packit |
6b81fa |
efile = argv[2];
|
|
Packit |
6b81fa |
private_key_name = argv[3];
|
|
Packit |
6b81fa |
public_key_name = argv[4];
|
|
Packit |
6b81fa |
module_path = argv[5];
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
ret = CONF_modules_load_file(efile, "engines", 0);
|
|
Packit |
6b81fa |
if (ret <= 0) {
|
|
Packit |
6b81fa |
fprintf(stderr, "cannot load %s\n", efile);
|
|
Packit |
6b81fa |
display_openssl_errors(__LINE__);
|
|
Packit |
6b81fa |
exit(1);
|
|
Packit |
6b81fa |
}
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
ENGINE_add_conf_module();
|
|
Packit |
6b81fa |
#if OPENSSL_VERSION_NUMBER>=0x10100000
|
|
Packit |
6b81fa |
OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS \
|
|
Packit |
6b81fa |
| OPENSSL_INIT_ADD_ALL_DIGESTS \
|
|
Packit |
6b81fa |
| OPENSSL_INIT_LOAD_CONFIG, NULL);
|
|
Packit |
6b81fa |
#else
|
|
Packit |
6b81fa |
OpenSSL_add_all_algorithms();
|
|
Packit |
6b81fa |
OpenSSL_add_all_digests();
|
|
Packit |
6b81fa |
ERR_load_crypto_strings();
|
|
Packit |
6b81fa |
#endif
|
|
Packit |
6b81fa |
ERR_clear_error();
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
ENGINE_load_builtin_engines();
|
|
Packit |
6b81fa |
e = ENGINE_by_id("pkcs11");
|
|
Packit |
6b81fa |
if (e == NULL) {
|
|
Packit |
6b81fa |
display_openssl_errors(__LINE__);
|
|
Packit |
6b81fa |
exit(1);
|
|
Packit |
6b81fa |
}
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
if (!ENGINE_ctrl_cmd_string(e, "VERBOSE", NULL, 0)) {
|
|
Packit |
6b81fa |
display_openssl_errors(__LINE__);
|
|
Packit |
6b81fa |
exit(1);
|
|
Packit |
6b81fa |
}
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
if (!ENGINE_ctrl_cmd_string(e, "MODULE_PATH", module_path, 0)) {
|
|
Packit |
6b81fa |
display_openssl_errors(__LINE__);
|
|
Packit |
6b81fa |
exit(1);
|
|
Packit |
6b81fa |
}
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
if (!ENGINE_init(e)) {
|
|
Packit |
6b81fa |
display_openssl_errors(__LINE__);
|
|
Packit |
6b81fa |
exit(1);
|
|
Packit |
6b81fa |
}
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
if (key_pass && !ENGINE_ctrl_cmd_string(e, "PIN", key_pass, 0)) {
|
|
Packit |
6b81fa |
display_openssl_errors(__LINE__);
|
|
Packit |
6b81fa |
exit(1);
|
|
Packit |
6b81fa |
}
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
private_key = ENGINE_load_private_key(e, private_key_name, NULL, NULL);
|
|
Packit |
6b81fa |
if (private_key == NULL) {
|
|
Packit |
6b81fa |
fprintf(stderr, "cannot load: %s\n", private_key_name);
|
|
Packit |
6b81fa |
display_openssl_errors(__LINE__);
|
|
Packit |
6b81fa |
exit(1);
|
|
Packit |
6b81fa |
}
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
public_key = ENGINE_load_public_key(e, public_key_name, NULL, NULL);
|
|
Packit |
6b81fa |
if (public_key == NULL) {
|
|
Packit |
6b81fa |
fprintf(stderr, "cannot load: %s\n", public_key_name);
|
|
Packit |
6b81fa |
display_openssl_errors(__LINE__);
|
|
Packit |
6b81fa |
exit(1);
|
|
Packit |
6b81fa |
}
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
digest_algo = EVP_get_digestbyname("sha256");
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
#define TEST_DATA "test data"
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
md_ctx = EVP_MD_CTX_create();
|
|
Packit |
6b81fa |
if (EVP_DigestInit(md_ctx, digest_algo) <= 0) {
|
|
Packit |
6b81fa |
display_openssl_errors(__LINE__);
|
|
Packit |
6b81fa |
exit(1);
|
|
Packit |
6b81fa |
}
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
if (EVP_DigestUpdate(md_ctx, TEST_DATA, sizeof(TEST_DATA)) <= 0) {
|
|
Packit |
6b81fa |
display_openssl_errors(__LINE__);
|
|
Packit |
6b81fa |
exit(1);
|
|
Packit |
6b81fa |
}
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
digest_len = sizeof(md);
|
|
Packit |
6b81fa |
if (EVP_DigestFinal(md_ctx, md, &digest_len) <= 0) {
|
|
Packit |
6b81fa |
display_openssl_errors(__LINE__);
|
|
Packit |
6b81fa |
exit(1);
|
|
Packit |
6b81fa |
}
|
|
Packit |
6b81fa |
md_len = digest_len;
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
EVP_MD_CTX_destroy(md_ctx);
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
/* Sign the hash */
|
|
Packit |
6b81fa |
pkey_ctx = EVP_PKEY_CTX_new(private_key, e);
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
if (pkey_ctx == NULL) {
|
|
Packit |
6b81fa |
fprintf(stderr, "Could not create context\n");
|
|
Packit |
6b81fa |
display_openssl_errors(__LINE__);
|
|
Packit |
6b81fa |
exit(1);
|
|
Packit |
6b81fa |
}
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
if (EVP_PKEY_sign_init(pkey_ctx) <= 0) {
|
|
Packit |
6b81fa |
fprintf(stderr, "Could not init signature\n");
|
|
Packit |
6b81fa |
display_openssl_errors(__LINE__);
|
|
Packit |
6b81fa |
exit(1);
|
|
Packit |
6b81fa |
}
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
if (EVP_PKEY_CTX_set_rsa_padding(pkey_ctx, RSA_PKCS1_PSS_PADDING) <= 0) {
|
|
Packit |
6b81fa |
fprintf(stderr, "Could not set padding\n");
|
|
Packit |
6b81fa |
display_openssl_errors(__LINE__);
|
|
Packit |
6b81fa |
exit(1);
|
|
Packit |
6b81fa |
}
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
if (EVP_PKEY_CTX_set_signature_md(pkey_ctx, digest_algo) <= 0) {
|
|
Packit |
6b81fa |
fprintf(stderr, "Could not set message digest algorithm\n");
|
|
Packit |
6b81fa |
display_openssl_errors(__LINE__);
|
|
Packit |
6b81fa |
exit(1);
|
|
Packit |
6b81fa |
}
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
sig_len = sizeof(sig);
|
|
Packit |
6b81fa |
if (EVP_PKEY_sign(pkey_ctx, sig, &sig_len, md,
|
|
Packit |
6b81fa |
EVP_MD_size(digest_algo)) <= 0) {
|
|
Packit |
6b81fa |
display_openssl_errors(__LINE__);
|
|
Packit |
6b81fa |
exit(1);
|
|
Packit |
6b81fa |
}
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
EVP_PKEY_CTX_free(pkey_ctx);
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
printf("Signature created\n");
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
#if OPENSSL_VERSION_NUMBER >= 0x1000000fL
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
pkey_ctx = EVP_PKEY_CTX_new(public_key, e);
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
if (pkey_ctx == NULL) {
|
|
Packit |
6b81fa |
fprintf(stderr, "Could not create context\n");
|
|
Packit |
6b81fa |
display_openssl_errors(__LINE__);
|
|
Packit |
6b81fa |
exit(1);
|
|
Packit |
6b81fa |
}
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
if (EVP_PKEY_verify_init(pkey_ctx) <= 0) {
|
|
Packit |
6b81fa |
fprintf(stderr, "Could not init verify\n");
|
|
Packit |
6b81fa |
display_openssl_errors(__LINE__);
|
|
Packit |
6b81fa |
exit(1);
|
|
Packit |
6b81fa |
}
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
if (EVP_PKEY_CTX_set_rsa_padding(pkey_ctx, RSA_PKCS1_PSS_PADDING) <= 0) {
|
|
Packit |
6b81fa |
fprintf(stderr, "Could not set padding\n");
|
|
Packit |
6b81fa |
display_openssl_errors(__LINE__);
|
|
Packit |
6b81fa |
exit(1);
|
|
Packit |
6b81fa |
}
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
if (EVP_PKEY_CTX_set_signature_md(pkey_ctx, digest_algo) <= 0) {
|
|
Packit |
6b81fa |
fprintf(stderr, "Could not set message digest algorithm\n");
|
|
Packit |
6b81fa |
display_openssl_errors(__LINE__);
|
|
Packit |
6b81fa |
exit(1);
|
|
Packit |
6b81fa |
}
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
ret = EVP_PKEY_verify(pkey_ctx, sig, sig_len, md, md_len);
|
|
Packit |
6b81fa |
if (ret < 0) {
|
|
Packit |
6b81fa |
display_openssl_errors(__LINE__);
|
|
Packit |
6b81fa |
exit(1);
|
|
Packit |
6b81fa |
}
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
EVP_PKEY_CTX_free(pkey_ctx);
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
if (ret == 1) {
|
|
Packit |
6b81fa |
printf("Signature verified\n");
|
|
Packit |
6b81fa |
}
|
|
Packit |
6b81fa |
else {
|
|
Packit |
6b81fa |
printf("Verification failed\n");
|
|
Packit |
6b81fa |
display_openssl_errors(__LINE__);
|
|
Packit |
6b81fa |
exit(1);
|
|
Packit |
6b81fa |
}
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
#else /* OPENSSL_VERSION_NUMBER >= 0x1000000fL */
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
printf("Unable to verify signature with %s\n", OPENSSL_VERSION_TEXT);
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
#endif /* OPENSSL_VERSION_NUMBER >= 0x1000000fL */
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
ENGINE_finish(e);
|
|
Packit |
6b81fa |
CONF_modules_unload(1);
|
|
Packit |
6b81fa |
return 0;
|
|
Packit |
6b81fa |
}
|
|
Packit |
6b81fa |
|
|
Packit |
6b81fa |
/* vim: set noexpandtab: */
|