/* * Standard CSPContext init, called from CSPFullPluginSession::init(). * Reusable, e.g., query followed by en/decrypt. */ void BlowfishContext::init( const Context &context, bool encrypting) { if(mInitFlag && !opStarted()) { return; } CSSM_SIZE keyLen; uint8 *keyData = NULL; bool sameKeySize = false; /* obtain key from context */ symmetricKeyBits(context, session(), CSSM_ALGID_BLOWFISH, encrypting ? CSSM_KEYUSE_ENCRYPT : CSSM_KEYUSE_DECRYPT, keyData, keyLen); if((keyLen < BF_MIN_KEY_SIZE_BYTES) || (keyLen > BF_MAX_KEY_SIZE_BYTES)) { CssmError::throwMe(CSSMERR_CSP_INVALID_ATTR_KEY); } /* * Delete existing key if key size changed */ if(mRawKeySize == keyLen) { sameKeySize = true; } else { deleteKey(); } /* init key only if key size or key bits have changed */ if(!sameKeySize || memcmp(mRawKey, keyData, mRawKeySize)) { BF_set_key(&mBfKey, (int)keyLen, keyData); /* save this raw key data */ memmove(mRawKey, keyData, keyLen); mRawKeySize = (unsigned int)keyLen; } /* Finally, have BlockCryptor do its setup */ setup(BF_BLOCK, context); mInitFlag = true; }
/* * Standard CSPContext init, called from CSPFullPluginSession::init(). * Reusable, e.g., query followed by en/decrypt. */ void CastContext::init( const Context &context, bool encrypting) { if(mInitFlag && !opStarted()) { return; } CSSM_SIZE keyLen; uint8 *keyData = NULL; bool sameKeySize = false; /* obtain key from context */ symmetricKeyBits(context, session(), CSSM_ALGID_CAST, encrypting ? CSSM_KEYUSE_ENCRYPT : CSSM_KEYUSE_DECRYPT, keyData, keyLen); if((keyLen < kCCKeySizeMinCAST) || (keyLen > kCCKeySizeMaxCAST)) { CssmError::throwMe(CSSMERR_CSP_INVALID_ATTR_KEY); } /* * Delete existing key if key size changed */ if(mRawKeySize == keyLen) { sameKeySize = true; } else { deleteKey(); } /* init key only if key size or key bits have changed */ if(!sameKeySize || memcmp(mRawKey, keyData, mRawKeySize)) { (void) CCCryptorCreateWithMode(0, kCCModeECB, kCCAlgorithmCAST, ccDefaultPadding, NULL, keyData, keyLen, NULL, 0, 0, 0, &mCastKey); /* save this raw key data */ memmove(mRawKey, keyData, keyLen); mRawKeySize = (uint32)keyLen; } /* Finally, have BlockCryptor do its setup */ setup(kCCBlockSizeCAST, context); mInitFlag = true; }
/* called by CSPFullPluginSession */ void RSA_CryptContext::init(const Context &context, bool encoding /*= true*/) { StLock<Mutex> _(gMutex()); if(mInitFlag && !opStarted()) { /* reusing - e.g. query followed by encrypt */ return; } /* optional mode to use alternate key class (e.g., decrypt with public key) */ CSSM_KEYCLASS keyClass; switch (context.getInt(CSSM_ATTRIBUTE_MODE)) { case CSSM_ALGMODE_PUBLIC_KEY: keyClass = CSSM_KEYCLASS_PUBLIC_KEY; break; case CSSM_ALGMODE_PRIVATE_KEY: keyClass = CSSM_KEYCLASS_PRIVATE_KEY; break; case CSSM_ALGMODE_NONE: /* default, not present in context: infer from op type */ keyClass = encoding ? CSSM_KEYCLASS_PUBLIC_KEY : CSSM_KEYCLASS_PRIVATE_KEY; break; default: CssmError::throwMe(CSSMERR_CSP_INVALID_ATTR_MODE); } /* fetch key from context */ if(mRsaKey == NULL) { assert(!opStarted()); CSSM_DATA label = {0, NULL}; mRsaKey = contextToRsaKey(context, session(), keyClass, encoding ? CSSM_KEYUSE_ENCRYPT : CSSM_KEYUSE_DECRYPT, mAllocdRsaKey, label); if(label.Data) { mLabel.copy(label); mOaep = true; free(label.Data); } } else { assert(opStarted()); } unsigned cipherBlockSize = RSA_size(mRsaKey); unsigned plainBlockSize; /* padding - not present means value zero, CSSM_PADDING_NONE */ uint32 padding = context.getInt(CSSM_ATTRIBUTE_PADDING); switch(padding) { case CSSM_PADDING_NONE: mPadding = RSA_NO_PADDING; plainBlockSize = cipherBlockSize; break; case CSSM_PADDING_PKCS1: mPadding = RSA_PKCS1_PADDING; plainBlockSize = cipherBlockSize - 11; break; case CSSM_PADDING_APPLE_SSLv2: rsaCryptDebug("RSA_CryptContext::init using CSSM_PADDING_APPLE_SSLv2"); mPadding = RSA_SSLV23_PADDING; plainBlockSize = cipherBlockSize - 11; break; default: rsaCryptDebug("RSA_CryptContext::init bad padding (0x%x)", (unsigned)padding); CssmError::throwMe(CSSMERR_CSP_INVALID_ATTR_PADDING); } /* optional blinding attribute */ uint32 blinding = context.getInt(CSSM_ATTRIBUTE_RSA_BLINDING); if(blinding) { if(RSA_blinding_on(mRsaKey, NULL) <= 0) { /* actually no legit failures */ CssmError::throwMe(CSSMERR_CSP_INTERNAL_ERROR); } } else { RSA_blinding_off(mRsaKey); } /* finally, have BlockCryptor set up its stuff. */ setup(encoding ? plainBlockSize : cipherBlockSize, // blockSizeIn encoding ? cipherBlockSize : plainBlockSize, // blockSizeOut false, // pkcs5Pad false, // needsFinal BCM_ECB, NULL); // IV mInitFlag = true; }
/* * Standard CSPContext init, called from CSPFullPluginSession::init(). * Reusable, e.g., query followed by en/decrypt. Even reusable after context * changed (i.e., new IV in Encrypted File System). */ void GAESContext::init( const Context &context, bool encrypting) { if(mInitFlag && !opStarted()) { return; } CSSM_SIZE keyLen; uint8 *keyData = NULL; bool sameKeySize = false; /* obtain key from context */ symmetricKeyBits(context, session(), CSSM_ALGID_AES, encrypting ? CSSM_KEYUSE_ENCRYPT : CSSM_KEYUSE_DECRYPT, keyData, keyLen); switch(keyLen) { case kCCKeySizeAES128: case kCCKeySizeAES192: case kCCKeySizeAES256: break; default: CssmError::throwMe(CSSMERR_CSP_INVALID_ATTR_KEY); } /* * Delete existing key if key size changed */ if(mRawKeySize == keyLen) { sameKeySize = true; } else { deleteKey(); } /* * Init key only if key size or key bits have changed, or * we're doing a different operation than the previous key * was scheduled for. */ if(!sameKeySize || (mWasEncrypting != encrypting) || memcmp(mRawKey, keyData, mRawKeySize)) { (void) CCCryptorCreateWithMode(0, kCCModeECB, kCCAlgorithmAES128, ccDefaultPadding, NULL, keyData, keyLen, NULL, 0, 0, 0, &mAesKey); /* save this raw key data */ memmove(mRawKey, keyData, keyLen); mRawKeySize = keyLen; mWasEncrypting = encrypting; } /* we handle CBC, and hence the IV, ourselves */ CSSM_ENCRYPT_MODE cssmMode = context.getInt(CSSM_ATTRIBUTE_MODE); switch (cssmMode) { /* no mode attr --> 0 == CSSM_ALGMODE_NONE, not currently supported */ case CSSM_ALGMODE_CBCPadIV8: case CSSM_ALGMODE_CBC_IV8: { CssmData *iv = context.get<CssmData>(CSSM_ATTRIBUTE_INIT_VECTOR); if(iv == NULL) { CssmError::throwMe(CSSMERR_CSP_MISSING_ATTR_INIT_VECTOR); } if(iv->Length != kCCBlockSizeAES128) { CssmError::throwMe(CSSMERR_CSP_INVALID_ATTR_INIT_VECTOR); } } break; default: break; } /* Finally, have BlockCryptor do its setup */ setup(GLADMAN_BLOCK_SIZE_BYTES, context); mInitFlag = true; }