path: root/src/manager/service/key-provider.cpp

/*
 *  Copyright (c) 2014 - 2019 Samsung Electronics Co., Ltd All Rights Reserved
 *
 *  Licensed under the Apache License, Version 2.0 (the "License");
 *  you may not use this file except in compliance with the License.
 *  You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 *  Unless required by applicable law or agreed to in writing, software
 *  distributed under the License is distributed on an "AS IS" BASIS,
 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *  See the License for the specific language governing permissions and
 *  limitations under the License
 */

#include <exception.h>
#include <key-provider.h>
#include <dpl/log/log.h>
#include <ckm/ckm-zero-memory.h>
#include <string.h>

#include <array>
#include <memory>

using namespace CKM;

namespace {

template<typename T>
RawBuffer toRawBuffer(const T &data)
{
	RawBuffer output;
	const unsigned char *ptr = reinterpret_cast<const unsigned char *>(&data);
	output.assign(ptr, ptr + sizeof(T));
	return output;
}

// You cannot use toRawBuffer template with pointers
template<typename T>
RawBuffer toRawBuffer(T *)
{
	class NoPointerAllowed {
		NoPointerAllowed() {}
	};
	NoPointerAllowed a;
	return RawBuffer();
}

typedef std::unique_ptr<EVP_CIPHER_CTX, decltype(&EVP_CIPHER_CTX_free)> CipherCtxPtr;

int encryptAes256Gcm(const unsigned char *plaintext,
                     int plaintext_len, const unsigned char *key, const unsigned char *iv,
                     unsigned char *ciphertext, unsigned char *tag)
{
	int len;
	int ciphertext_len = 0;

	CipherCtxPtr ctx(EVP_CIPHER_CTX_new(), EVP_CIPHER_CTX_free);
	if (!ctx)
		return OPENSSL_ENGINE_ERROR;

	if (!EVP_EncryptInit_ex(ctx.get(), EVP_aes_256_gcm(), NULL, NULL, NULL))
		return OPENSSL_ENGINE_ERROR;

	if (!EVP_EncryptInit_ex(ctx.get(), NULL, NULL, key, iv))
		return OPENSSL_ENGINE_ERROR;

	if (!EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_GCM_SET_IVLEN, MAX_IV_SIZE, NULL))
		return OPENSSL_ENGINE_ERROR;

	if (!EVP_EncryptUpdate(ctx.get(), ciphertext, &len, plaintext, plaintext_len))
		return OPENSSL_ENGINE_ERROR;

	ciphertext_len = len;

	if (!EVP_EncryptFinal_ex(ctx.get(), ciphertext + len, &len))
		return OPENSSL_ENGINE_ERROR;

	ciphertext_len += len;

	if (!EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_GCM_GET_TAG, MAX_IV_SIZE, tag))
		return OPENSSL_ENGINE_ERROR;

	return ciphertext_len;
}

int decryptAes256Gcm(const unsigned char *ciphertext,
                     int ciphertext_len, unsigned char *tag, const unsigned char *key,
                     const unsigned char *iv, unsigned char *plaintext)
{
	int len;
	int plaintext_len;
	int ret;

	CipherCtxPtr ctx(EVP_CIPHER_CTX_new(), EVP_CIPHER_CTX_free);
	if (!ctx)
		return OPENSSL_ENGINE_ERROR;

	if (!EVP_DecryptInit_ex(ctx.get(), EVP_aes_256_gcm(), NULL, NULL, NULL))
		return OPENSSL_ENGINE_ERROR;

	if (!EVP_DecryptInit_ex(ctx.get(), NULL, NULL, key, iv))
		return OPENSSL_ENGINE_ERROR;

	if (!EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_GCM_SET_IVLEN, MAX_IV_SIZE, NULL))
		return OPENSSL_ENGINE_ERROR;

	if (!EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_GCM_SET_TAG, MAX_IV_SIZE, tag))
		return OPENSSL_ENGINE_ERROR;

	if (!EVP_DecryptUpdate(ctx.get(), plaintext, &len, ciphertext, ciphertext_len))
		return OPENSSL_ENGINE_ERROR;

	plaintext_len = len;

	if (!(ret = EVP_DecryptFinal_ex(ctx.get(), plaintext + len, &len)))
		return OPENSSL_ENGINE_ERROR;

	if (ret > 0) {
		plaintext_len += len;
		return plaintext_len;
	} else {
		return -1;
	}
}

typedef std::array<uint8_t, MAX_KEY_SIZE> KeyData;

// derives a key used for DomainKEK encryption (aka PKEK1) from random salt & user password
KeyData makePKEK1(const KeyComponentsInfo& keyInfo, const Password &password)
{
	std::string concatPasswordClient(password.c_str());
	concatPasswordClient += std::string(keyInfo.client);

	KeyData key;
	if (!PKCS5_PBKDF2_HMAC_SHA1(concatPasswordClient.c_str(),
	                            concatPasswordClient.size(),
	                            keyInfo.salt,
	                            MAX_SALT_SIZE,
	                            PBKDF2_ITERATIONS,
	                            key.size(),
	                            key.data())) {
		ThrowErr(Exc::InternalError, "OPENSSL_ENGINE_ERROR");
	}
	return key;
}

// derives a key (PKEK2) from DomainKEK and custom client string (may be a client id or uid)
KeyData makePKEK2(const uint8_t *domainKEK, const std::string &client)
{
	KeyData key;
	if (!PKCS5_PBKDF2_HMAC_SHA1(client.c_str(),
	                            client.size(),
	                            domainKEK,
	                            MAX_SALT_SIZE,
	                            PBKDF2_ITERATIONS,
	                            key.size(),
	                            key.data())) {
		ThrowErr(Exc::InternalError, "OPENSSL_ENGINE_ERROR");
	}
	return key;
}

void unwrapDomainKEK(const RawBuffer &wrappedDomainKEKbuffer,
                     const Password &password,
                     KeyAndInfoContainer &domainKEK)
{
	WrappedKeyAndInfoContainer wrappedDomainKEK(wrappedDomainKEKbuffer.data());

	KeyData PKEK1 = makePKEK1(wrappedDomainKEK.getWrappedKeyAndInfo().keyInfo, password);

	int keyLength;
	if (0 > (keyLength = decryptAes256Gcm(wrappedDomainKEK.getWrappedKeyAndInfo().wrappedKey,
	                                      wrappedDomainKEK.getWrappedKeyAndInfo().keyInfo.keyLength,
	                                      wrappedDomainKEK.getWrappedKeyAndInfo().keyInfo.tag,
	                                      PKEK1.data(),
	                                      wrappedDomainKEK.getWrappedKeyAndInfo().keyInfo.iv,
	                                      domainKEK.getKeyAndInfo().key)))
		ThrowErr(Exc::AuthenticationFailed, "DomainKEK decryption failed");

	domainKEK.setKeyInfo(&(wrappedDomainKEK.getWrappedKeyAndInfo().keyInfo));
	domainKEK.setKeyInfoKeyLength(static_cast<unsigned int>(keyLength));
}

RawBuffer wrapDomainKEK(KeyAndInfoContainer &domainKEK, const Password &password)
{
	KeyData PKEK1 = makePKEK1(domainKEK.getKeyAndInfo().keyInfo, password);

	WrappedKeyAndInfoContainer wrappedDomainKEK = WrappedKeyAndInfoContainer();
	wrappedDomainKEK.setKeyInfo(&(domainKEK.getKeyAndInfo().keyInfo));

	int wrappedLength;
	if (0 > (wrappedLength = encryptAes256Gcm(domainKEK.getKeyAndInfo().key,
	                                          domainKEK.getKeyAndInfo().keyInfo.keyLength,
	                                          PKEK1.data(),
	                                          domainKEK.getKeyAndInfo().keyInfo.iv,
	                                          wrappedDomainKEK.getWrappedKeyAndInfo().wrappedKey,
	                                          wrappedDomainKEK.getWrappedKeyAndInfo().keyInfo.tag)))
		ThrowErr(Exc::InternalError, "DomainKEK encryption failed");

	wrappedDomainKEK.setKeyInfoKeyLength(static_cast<unsigned int>(wrappedLength));
	return toRawBuffer(wrappedDomainKEK.getWrappedKeyAndInfo());
}

template <size_t N>
bool randomize(uint8_t (&array)[N])
{
	return RAND_bytes(array, N) == 1;
}

} // anonymous namespace

WrappedKeyAndInfoContainer::WrappedKeyAndInfoContainer()
{
	memset(&wrappedKeyAndInfo, 0, sizeof(WrappedKeyAndInfo));
}

WrappedKeyAndInfoContainer::WrappedKeyAndInfoContainer(const unsigned char
		*data)
{
	memcpy(&wrappedKeyAndInfo, data, sizeof(WrappedKeyAndInfo));

	if (wrappedKeyAndInfo.keyInfo.keyLength > sizeof(wrappedKeyAndInfo.wrappedKey)) {
		ThrowErr(Exc::InternalError,
		         "Wrapped key info is corrupted. Key length exceeds the size of the key buffer.");
	}

	size_t maxlen = sizeof(wrappedKeyAndInfo.keyInfo.client);
	if (strnlen(wrappedKeyAndInfo.keyInfo.client, maxlen) == maxlen) {
		ThrowErr(Exc::InternalError,
		         "Wrapped key info is corrupted. Client id is not NULL terminated.");
	}
}

WrappedKeyAndInfo &WrappedKeyAndInfoContainer::getWrappedKeyAndInfo()
{
	return wrappedKeyAndInfo;
}

void WrappedKeyAndInfoContainer::setKeyInfoKeyLength(const unsigned int length)
{
	wrappedKeyAndInfo.keyInfo.keyLength = length;
}

void WrappedKeyAndInfoContainer::setKeyInfoClient(const std::string resized_client)
{
	if (resized_client.size() >= sizeof(wrappedKeyAndInfo.keyInfo.client)) {
		ThrowErr(Exc::InternalError, "Client name too long");
	}

	strcpy(wrappedKeyAndInfo.keyInfo.client, resized_client.c_str());
}

void WrappedKeyAndInfoContainer::setKeyInfoSalt(const unsigned char *salt,
		const int size)
{
	memcpy(wrappedKeyAndInfo.keyInfo.salt, salt, size);
}

void WrappedKeyAndInfoContainer::setKeyInfo(const KeyComponentsInfo
		*keyComponentsInfo)
{
	memcpy(&(wrappedKeyAndInfo.keyInfo), keyComponentsInfo,
		   sizeof(KeyComponentsInfo));
}

WrappedKeyAndInfoContainer::~WrappedKeyAndInfoContainer()
{
}

KeyAndInfoContainer::KeyAndInfoContainer()
{
	memset(&keyAndInfo, 0, sizeof(KeyAndInfo));
}

KeyAndInfoContainer::KeyAndInfoContainer(const unsigned char *data)
{
	memcpy(&keyAndInfo, data, sizeof(KeyAndInfo));
}

KeyAndInfo &KeyAndInfoContainer::getKeyAndInfo()
{
	return keyAndInfo;
}

void KeyAndInfoContainer::setKeyInfoKeyLength(unsigned int length)
{
	keyAndInfo.keyInfo.keyLength = length;
}

void KeyAndInfoContainer::setKeyInfo(const KeyComponentsInfo *keyComponentsInfo)
{
	memcpy(&(keyAndInfo.keyInfo), keyComponentsInfo, sizeof(KeyComponentsInfo));
}

KeyAndInfoContainer::~KeyAndInfoContainer()
{
	// overwrite key
	ZeroMemory(reinterpret_cast<unsigned char*>(&keyAndInfo), sizeof(KeyAndInfo));
}

KeyProvider::KeyProvider() :
	m_domainKEK(NULL),
	m_isInitialized(false)
{
	LogDebug("Created empty KeyProvider");
}

KeyProvider::KeyProvider(
	const RawBuffer &domainKEKInWrapForm,
	const Password &password) :
	m_domainKEK(new KeyAndInfoContainer()),
	m_isInitialized(true)
{
	if (!m_isInitialized)
		ThrowErr(Exc::InternalError, "Object not initialized!. Should not happened");

	if (domainKEKInWrapForm.size() != sizeof(WrappedKeyAndInfo)) {
		LogError("input size:" << domainKEKInWrapForm.size()
				 << " Expected: " << sizeof(WrappedKeyAndInfo));
		ThrowErr(Exc::InternalError,
				 "buffer doesn't have proper size to store WrappedKeyAndInfo in KeyProvider Constructor");
	}

	unwrapDomainKEK(domainKEKInWrapForm, password, *m_domainKEK);
}

KeyProvider &KeyProvider::operator=(KeyProvider &&second)
{
	LogDebug("Moving KeyProvider");

	if (this == &second)
		return *this;

	m_isInitialized = second.m_isInitialized;
	m_domainKEK = second.m_domainKEK;
	second.m_isInitialized = false;
	second.m_domainKEK = NULL;
	return *this;
}

KeyProvider::KeyProvider(KeyProvider &&second)
{
	LogDebug("Moving KeyProvider");
	m_isInitialized = second.m_isInitialized;
	m_domainKEK = second.m_domainKEK;
	second.m_isInitialized = false;
	second.m_domainKEK = NULL;
}

bool KeyProvider::isInitialized()
{
	return m_isInitialized;
}

RawBuffer KeyProvider::getPureDomainKEK()
{
	if (!m_isInitialized)
		ThrowErr(Exc::InternalError, "Object not initialized!");

	// TODO secure
	return RawBuffer(m_domainKEK->getKeyAndInfo().key,
					 (m_domainKEK->getKeyAndInfo().key) +
					 m_domainKEK->getKeyAndInfo().keyInfo.keyLength);
}

RawBuffer KeyProvider::getWrappedDomainKEK(const Password &password)
{
	if (!m_isInitialized)
		ThrowErr(Exc::InternalError, "Object not initialized!");

	return wrapDomainKEK(*m_domainKEK, password);
}


RawBuffer KeyProvider::getPureDEK(const RawBuffer &DEKInWrapForm)
{
	if (!m_isInitialized)
		ThrowErr(Exc::InternalError, "Object not initialized!");

	if (DEKInWrapForm.size() != sizeof(WrappedKeyAndInfo)) {
		LogError("input size:" << DEKInWrapForm.size()
				 << " Expected: " << sizeof(WrappedKeyAndInfo));
		ThrowErr(Exc::InternalError,
				 "buffer doesn't have proper size to store "
				 "WrappedKeyAndInfo in KeyProvider::getPureDEK");
	}

	KeyAndInfoContainer kmcDEK = KeyAndInfoContainer();
	WrappedKeyAndInfoContainer wkmcDEK = WrappedKeyAndInfoContainer(
			DEKInWrapForm.data());

	KeyData PKEK2 = makePKEK2(m_domainKEK->getKeyAndInfo().key,
	                          wkmcDEK.getWrappedKeyAndInfo().keyInfo.client);

	int keyLength;
	if (0 > (keyLength = decryptAes256Gcm(
							 wkmcDEK.getWrappedKeyAndInfo().wrappedKey,
							 wkmcDEK.getWrappedKeyAndInfo().keyInfo.keyLength,
							 wkmcDEK.getWrappedKeyAndInfo().keyInfo.tag,
							 PKEK2.data(),
							 wkmcDEK.getWrappedKeyAndInfo().keyInfo.iv,
							 kmcDEK.getKeyAndInfo().key)))
		ThrowErr(Exc::InternalError,
				 "UnwrapDEK Failed in KeyProvider::getPureDEK");

	kmcDEK.setKeyInfoKeyLength((unsigned int)keyLength);

	LogDebug("getPureDEK SUCCESS");
	return RawBuffer(
			   kmcDEK.getKeyAndInfo().key,
			   (kmcDEK.getKeyAndInfo().key) + kmcDEK.getKeyAndInfo().keyInfo.keyLength);
}

RawBuffer KeyProvider::generateDEK(const std::string &client)
{
	if (!m_isInitialized)
		ThrowErr(Exc::InternalError, "Object not initialized!");

	WrappedKeyAndInfoContainer wkmcDEK = WrappedKeyAndInfoContainer();
	std::string resized_client;

	if (client.length() < MAX_CLIENT_ID_SIZE)
		resized_client = client;
	else
		resized_client = client.substr(0, MAX_CLIENT_ID_SIZE - 1);

	uint8_t key[MAX_KEY_SIZE];

	if (!randomize(key) || !randomize(wkmcDEK.getWrappedKeyAndInfo().keyInfo.iv))
		ThrowErr(Exc::InternalError, "OPENSSL_ENGINE_ERROR");

	KeyData PKEK2 = makePKEK2(m_domainKEK->getKeyAndInfo().key, resized_client);

	int wrappedKeyLength;
	if (0 > (wrappedKeyLength = encryptAes256Gcm(key,
	                                             m_domainKEK->getKeyAndInfo().keyInfo.keyLength,
	                                             PKEK2.data(),
	                                             wkmcDEK.getWrappedKeyAndInfo().keyInfo.iv,
	                                             wkmcDEK.getWrappedKeyAndInfo().wrappedKey,
	                                             wkmcDEK.getWrappedKeyAndInfo().keyInfo.tag)))
		ThrowErr(Exc::InternalError, "GenerateDEK Failed in KeyProvider::generateDEK");

	wkmcDEK.setKeyInfoKeyLength((unsigned int)wrappedKeyLength);
	wkmcDEK.setKeyInfoClient(resized_client);

	LogDebug("GenerateDEK Success");
	return toRawBuffer(wkmcDEK.getWrappedKeyAndInfo());
}

RawBuffer KeyProvider::reencrypt(
	const RawBuffer &domainKEKInWrapForm,
	const Password &oldPass,
	const Password &newPass)
{
	if (domainKEKInWrapForm.size() != sizeof(WrappedKeyAndInfo)) {
		LogError("input size:" << domainKEKInWrapForm.size()
				 << " Expected: " << sizeof(WrappedKeyAndInfo));
		ThrowErr(Exc::InternalError,
				 "buffer doesn't have proper size to store "
				 "WrappedKeyAndInfo in KeyProvider::reencrypt");
	}

	KeyAndInfoContainer domainKEK;
	unwrapDomainKEK(domainKEKInWrapForm, oldPass, domainKEK);
	return wrapDomainKEK(domainKEK, newPass);
}

RawBuffer KeyProvider::generateDomainKEK(
	const std::string &user,
	const Password &userPassword)
{
	WrappedKeyAndInfoContainer wkmcDKEK = WrappedKeyAndInfoContainer();

	KeyAndInfoContainer domainKEK;

	if (!randomize(domainKEK.getKeyAndInfo().keyInfo.salt) ||
		!randomize(domainKEK.getKeyAndInfo().key) ||
	    !randomize(domainKEK.getKeyAndInfo().keyInfo.iv)) {
		ThrowErr(Exc::InternalError, "OPENSSL_ENGINE_ERROR");
	}

	domainKEK.setKeyInfoKeyLength(sizeof(domainKEK.getKeyAndInfo().key));

	if (user.size() >= sizeof(domainKEK.getKeyAndInfo().keyInfo.client)) {
		ThrowErr(Exc::InternalError, "Client name too long");
	}
	strcpy(domainKEK.getKeyAndInfo().keyInfo.client, user.c_str());

	return wrapDomainKEK(domainKEK, userPassword);
}

int KeyProvider::initializeLibrary()
{
	LogDebug("initializeLibrary Success");
	return SUCCESS;
}

int KeyProvider::closeLibrary()
{
	LogDebug("closeLibrary Success");
	return SUCCESS;
}

KeyProvider::~KeyProvider()
{
	LogDebug("KeyProvider Destructor");
}