src/libstrongswan/plugins/gcrypt/gcrypt_rsa_private_key.c

   1 /*
   2  * Copyright (C) 2005-2009 Martin Willi
   3  * Hochschule fuer Technik Rapperswil
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  */
  15
  16 #include <gcrypt.h>
  17
  18 #include "gcrypt_rsa_private_key.h"
  19
  20 #include <debug.h>
  21 #include <asn1/oid.h>
  22 #include <asn1/asn1.h>
  23 #include <asn1/asn1_parser.h>
  24
  25 typedef struct private_gcrypt_rsa_private_key_t private_gcrypt_rsa_private_key_t;
  26
  27 /**
  28  * Private data of a gcrypt_rsa_private_key_t object.
  29  */
  30 struct private_gcrypt_rsa_private_key_t {
  31
  32         /**
  33          * Public interface
  34          */
  35         gcrypt_rsa_private_key_t public;
  36
  37         /**
  38          * gcrypt S-expression representing an RSA key
  39          */
  40         gcry_sexp_t key;
  41
  42         /**
  43          * Keyid formed as a SHA-1 hash of a publicKey object
  44          */
  45         identification_t* keyid;
  46
  47         /**
  48          * Keyid formed as a SHA-1 hash of a publicKeyInfo object
  49          */
  50         identification_t* keyid_info;
  51
  52         /**
  53          * reference count
  54          */
  55         refcount_t ref;
  56 };
  57
  58 /**
  59  * Implemented in gcrypt_rsa_public_key.c
  60  */
  61 public_key_t *gcrypt_rsa_public_key_create_from_sexp(gcry_sexp_t key);
  62
  63 /**
  64  * find a token in a S-expression. If a key is given, its length is used to
  65  * pad the output to a given length.
  66  */
  67 chunk_t gcrypt_rsa_find_token(gcry_sexp_t sexp, char *name, gcry_sexp_t key)
  68 {
  69         gcry_sexp_t token;
  70         chunk_t data = chunk_empty, tmp;
  71         size_t len = 0;
  72
  73         token = gcry_sexp_find_token(sexp, name, 1);
  74         if (token)
  75         {
  76                 data.ptr = (char*)gcry_sexp_nth_data(token, 1, &data.len);
  77                 if (!data.ptr)
  78                 {
  79                         data.len = 0;
  80                 }
  81                 else
  82                 {
  83                         if (key)
  84                         {
  85                                 /* gcrypt might return more bytes than necessary. Truncate
  86                                  * to key lenght if key given, or prepend zeros if needed  */
  87                                 len = gcry_pk_get_nbits(key);
  88                                 len = len / 8 + (len % 8 ? 1 : 0);
  89                                 if (len > data.len)
  90                                 {
  91                                         tmp = chunk_alloc(len);
  92                                         len -= data.len;
  93                                         memset(tmp.ptr, 0, tmp.len - len);
  94                                         memcpy(tmp.ptr + len, data.ptr, data.len);
  95                                         data = tmp;
  96                                 }
  97                                 else if (len < data.len)
  98                                 {
  99                                         data = chunk_clone(chunk_skip(data, data.len - len));
 100                                 }
 101                                 else
 102                                 {
 103                                         data = chunk_clone(data);
 104                                 }
 105                         }
 106                         else
 107                         {
 108                                 data = chunk_clone(data);
 109                         }
 110                 }
 111                 gcry_sexp_release(token);
 112         }
 113         return data;
 114 }
 115
 116 /**
 117  * Sign a chunk of data with direct PKCS#1 encoding, no hash OID
 118  */
 119 static bool sign_raw(private_gcrypt_rsa_private_key_t *this,
 120                                          chunk_t data, chunk_t *signature)
 121 {
 122         gcry_sexp_t in, out;
 123         gcry_error_t err;
 124         chunk_t em;
 125         size_t k;
 126
 127         /* EM = 0x00 || 0x01 || PS || 0x00 || T
 128          * PS = 0xFF padding, with length to fill em
 129          * T  = data
 130          */
 131         k = gcry_pk_get_nbits(this->key) / 8;
 132         if (data.len > k - 3)
 133         {
 134                 return FALSE;
 135         }
 136         em = chunk_alloc(k);
 137         memset(em.ptr, 0xFF, em.len);
 138         em.ptr[0] = 0x00;
 139         em.ptr[1] = 0x01;
 140         em.ptr[em.len - data.len - 1] = 0x00;
 141         memcpy(em.ptr + em.len - data.len, data.ptr, data.len);
 142
 143         err = gcry_sexp_build(&in, NULL, "(data(flags raw)(value %b))",
 144                                                   em.len, em.ptr);
 145         chunk_free(&em);
 146         if (err)
 147         {
 148                 DBG1("building signature S-expression failed: %s", gpg_strerror(err));
 149                 return FALSE;
 150         }
 151         err = gcry_pk_sign(&out, in, this->key);
 152         gcry_sexp_release(in);
 153         if (err)
 154         {
 155                 DBG1("creating pkcs1 signature failed: %s", gpg_strerror(err));
 156                 return FALSE;
 157         }
 158         *signature = gcrypt_rsa_find_token(out, "s", this->key);
 159         gcry_sexp_release(out);
 160         return !!signature->len;
 161 }
 162
 163 /**
 164  * Sign a chunk of data using hashing and PKCS#1 encoding
 165  */
 166 static bool sign_pkcs1(private_gcrypt_rsa_private_key_t *this,
 167                                            hash_algorithm_t hash_algorithm, char *hash_name,
 168                                            chunk_t data, chunk_t *signature)
 169 {
 170         hasher_t *hasher;
 171         chunk_t hash;
 172         gcry_error_t err;
 173         gcry_sexp_t in, out;
 174         int hash_oid;
 175
 176         hash_oid = hasher_algorithm_to_oid(hash_algorithm);
 177         if (hash_oid == OID_UNKNOWN)
 178         {
 179                 return FALSE;
 180         }
 181         hasher = lib->crypto->create_hasher(lib->crypto, hash_algorithm);
 182         if (!hasher)
 183         {
 184                 return FALSE;
 185         }
 186         hasher->allocate_hash(hasher, data, &hash);
 187         hasher->destroy(hasher);
 188
 189         err = gcry_sexp_build(&in, NULL, "(data(flags pkcs1)(hash %s %b))",
 190                                                   hash_name, hash.len, hash.ptr);
 191         chunk_free(&hash);
 192         if (err)
 193         {
 194                 DBG1("building signature S-expression failed: %s", gpg_strerror(err));
 195                 return FALSE;
 196         }
 197         err = gcry_pk_sign(&out, in, this->key);
 198         gcry_sexp_release(in);
 199         if (err)
 200         {
 201                 DBG1("creating pkcs1 signature failed: %s", gpg_strerror(err));
 202                 return FALSE;
 203         }
 204         *signature = gcrypt_rsa_find_token(out, "s", this->key);
 205         gcry_sexp_release(out);
 206         return !!signature->len;
 207 }
 208
 209 /**
 210  * Implementation of gcrypt_rsa_private_key.destroy.
 211  */
 212 static key_type_t get_type(private_gcrypt_rsa_private_key_t *this)
 213 {
 214         return KEY_RSA;
 215 }
 216
 217 /**
 218  * Implementation of gcrypt_rsa_private_key.destroy.
 219  */
 220 static bool sign(private_gcrypt_rsa_private_key_t *this, signature_scheme_t scheme,
 221                                  chunk_t data, chunk_t *sig)
 222 {
 223         switch (scheme)
 224         {
 225                 case SIGN_RSA_EMSA_PKCS1_NULL:
 226                         return sign_raw(this, data, sig);
 227                 case SIGN_RSA_EMSA_PKCS1_SHA1:
 228                         return sign_pkcs1(this, HASH_SHA1, "sha1", data, sig);
 229                 case SIGN_RSA_EMSA_PKCS1_SHA256:
 230                         return sign_pkcs1(this, HASH_SHA256, "sha256", data, sig);
 231                 case SIGN_RSA_EMSA_PKCS1_SHA384:
 232                         return sign_pkcs1(this, HASH_SHA384, "sha384", data, sig);
 233                 case SIGN_RSA_EMSA_PKCS1_SHA512:
 234                         return sign_pkcs1(this, HASH_SHA512, "sha512", data, sig);
 235                 case SIGN_RSA_EMSA_PKCS1_MD5:
 236                         return sign_pkcs1(this, HASH_MD5, "md5", data, sig);
 237                 default:
 238                         DBG1("signature scheme %N not supported in RSA",
 239                                  signature_scheme_names, scheme);
 240                         return FALSE;
 241         }
 242 }
 243
 244 /**
 245  * Implementation of gcrypt_rsa_private_key.destroy.
 246  */
 247 static bool decrypt(private_gcrypt_rsa_private_key_t *this,
 248                                         chunk_t encrypted, chunk_t *plain)
 249 {
 250         gcry_error_t err;
 251         gcry_sexp_t in, out;
 252         chunk_t padded;
 253         u_char *pos = NULL;;
 254
 255         err = gcry_sexp_build(&in, NULL, "(enc-val(flags)(rsa(a %b)))",
 256                                                   encrypted.len, encrypted.ptr);
 257         if (err)
 258         {
 259                 DBG1("building decryption S-expression failed: %s", gpg_strerror(err));
 260                 return FALSE;
 261         }
 262         err = gcry_pk_decrypt(&out, in, this->key);
 263         gcry_sexp_release(in);
 264         if (err)
 265         {
 266                 DBG1("decrypting pkcs1 data failed: %s", gpg_strerror(err));
 267                 return FALSE;
 268         }
 269         padded.ptr = (u_char*)gcry_sexp_nth_data(out, 1, &padded.len);
 270         /* result is padded, but gcrypt strips leading zero:
 271          *  00 | 02 | RANDOM | 00 | DATA */
 272         if (padded.ptr && padded.len > 2 && padded.ptr[0] == 0x02)
 273         {
 274                 pos = memchr(padded.ptr, 0x00, padded.len - 1);
 275                 if (pos)
 276                 {
 277                         pos++;
 278                         *plain = chunk_clone(chunk_create(
 279                                                                                 pos, padded.len - (pos - padded.ptr)));
 280                 }
 281         }
 282         gcry_sexp_release(out);
 283         if (!pos)
 284         {
 285                 DBG1("decrypted data has invalid pkcs1 padding");
 286                 return FALSE;
 287         }
 288         return TRUE;
 289 }
 290
 291 /**
 292  * Implementation of gcrypt_rsa_private_key.get_keysize.
 293  */
 294 static size_t get_keysize(private_gcrypt_rsa_private_key_t *this)
 295 {
 296         return gcry_pk_get_nbits(this->key) / 8;
 297 }
 298
 299 /**
 300  * Implementation of gcrypt_rsa_private_key.destroy.
 301  */
 302 static identification_t* get_id(private_gcrypt_rsa_private_key_t *this,
 303                                                                 id_type_t type)
 304 {
 305         switch (type)
 306         {
 307                 case ID_PUBKEY_INFO_SHA1:
 308                         return this->keyid_info;
 309                 case ID_PUBKEY_SHA1:
 310                         return this->keyid;
 311                 default:
 312                         return NULL;
 313         }
 314 }
 315
 316 /**
 317  * Implementation of gcrypt_rsa_private_key.get_public_key.
 318  */
 319 static public_key_t* get_public_key(private_gcrypt_rsa_private_key_t *this)
 320 {
 321         return gcrypt_rsa_public_key_create_from_sexp(this->key);
 322 }
 323
 324 /**
 325  * Implementation of gcrypt_rsa_private_key.equals.
 326  */
 327 static bool equals(private_gcrypt_rsa_private_key_t *this, private_key_t *other)
 328 {
 329         identification_t *keyid;
 330
 331         if (&this->public.interface == other)
 332         {
 333                 return TRUE;
 334         }
 335         if (other->get_type(other) != KEY_RSA)
 336         {
 337                 return FALSE;
 338         }
 339         keyid = other->get_id(other, ID_PUBKEY_SHA1);
 340         if (keyid && keyid->equals(keyid, this->keyid))
 341         {
 342                 return TRUE;
 343         }
 344         keyid = other->get_id(other, ID_PUBKEY_INFO_SHA1);
 345         if (keyid && keyid->equals(keyid, this->keyid_info))
 346         {
 347                 return TRUE;
 348         }
 349         return FALSE;
 350 }
 351
 352 /**
 353  * Implementation of gcrypt_rsa_private_key.belongs_to.
 354  */
 355 static bool belongs_to(private_gcrypt_rsa_private_key_t *this,
 356                                            public_key_t *public)
 357 {
 358         identification_t *keyid;
 359
 360         if (public->get_type(public) != KEY_RSA)
 361         {
 362                 return FALSE;
 363         }
 364         keyid = public->get_id(public, ID_PUBKEY_SHA1);
 365         if (keyid && keyid->equals(keyid, this->keyid))
 366         {
 367                 return TRUE;
 368         }
 369         keyid = public->get_id(public, ID_PUBKEY_INFO_SHA1);
 370         if (keyid && keyid->equals(keyid, this->keyid_info))
 371         {
 372                 return TRUE;
 373         }
 374         return FALSE;
 375 }
 376
 377 /**
 378  * Implementation of private_key_t.get_encoding.
 379  */
 380 static chunk_t get_encoding(private_gcrypt_rsa_private_key_t *this)
 381 {
 382         chunk_t cp, cq, cd, cexp1 = chunk_empty, cexp2 = chunk_empty;
 383         gcry_mpi_t p = NULL, q = NULL, d = NULL, exp1, exp2;
 384         gcry_error_t err;
 385
 386         /* p and q are swapped, gcrypt expects p < q */
 387         cp = gcrypt_rsa_find_token(this->key, "q", NULL);
 388         cq = gcrypt_rsa_find_token(this->key, "p", NULL);
 389         cd = gcrypt_rsa_find_token(this->key, "d", NULL);
 390
 391         err = gcry_mpi_scan(&p, GCRYMPI_FMT_USG, cp.ptr, cp.len, NULL)
 392                 | gcry_mpi_scan(&q, GCRYMPI_FMT_USG, cq.ptr, cq.len, NULL)
 393                 | gcry_mpi_scan(&d, GCRYMPI_FMT_USG, cd.ptr, cd.len, NULL);
 394         if (err)
 395         {
 396                 gcry_mpi_release(p);
 397                 gcry_mpi_release(q);
 398                 gcry_mpi_release(d);
 399                 chunk_clear(&cp);
 400                 chunk_clear(&cq);
 401                 chunk_clear(&cd);
 402                 DBG1("scanning mpi for export failed: %s", gpg_strerror(err));
 403                 return chunk_empty;
 404         }
 405
 406         gcry_mpi_sub_ui(p, p, 1);
 407         exp1 = gcry_mpi_new(gcry_pk_get_nbits(this->key));
 408         gcry_mpi_mod(exp1, d, p);
 409         gcry_mpi_release(p);
 410
 411         gcry_mpi_sub_ui(q, q, 1);
 412         exp2 = gcry_mpi_new(gcry_pk_get_nbits(this->key));
 413         gcry_mpi_mod(exp1, d, q);
 414         gcry_mpi_release(q);
 415
 416         err = gcry_mpi_aprint(GCRYMPI_FMT_USG, &cexp1.ptr, &cexp1.len, exp1)
 417                 | gcry_mpi_aprint(GCRYMPI_FMT_USG, &cexp2.ptr, &cexp2.len, exp2);
 418
 419         gcry_mpi_release(d);
 420         gcry_mpi_release(exp1);
 421         gcry_mpi_release(exp2);
 422
 423         if (err)
 424         {
 425                 DBG1("printing mpi for export failed: %s", gpg_strerror(err));
 426                 chunk_clear(&cp);
 427                 chunk_clear(&cq);
 428                 chunk_clear(&cd);
 429                 chunk_clear(&cexp1);
 430                 chunk_clear(&cexp2);
 431                 return chunk_empty;
 432         }
 433
 434         return asn1_wrap(ASN1_SEQUENCE, "cmmmmmmmm", ASN1_INTEGER_0,
 435                         asn1_integer("m", gcrypt_rsa_find_token(this->key, "n", NULL)),
 436                         asn1_integer("m", gcrypt_rsa_find_token(this->key, "e", NULL)),
 437                         asn1_integer("m", cd),
 438                         asn1_integer("m", cp),
 439                         asn1_integer("m", cq),
 440                         asn1_integer("m", cexp1),
 441                         asn1_integer("m", cexp2),
 442                         asn1_integer("m", gcrypt_rsa_find_token(this->key, "u", NULL)));
 443 }
 444
 445 /**
 446  * Implementation of gcrypt_rsa_private_key.get_ref.
 447  */
 448 static private_key_t* get_ref(private_gcrypt_rsa_private_key_t *this)
 449 {
 450         ref_get(&this->ref);
 451         return &this->public.interface;
 452 }
 453
 454 /**
 455  * Implementation of gcrypt_rsa_private_key.destroy.
 456  */
 457 static void destroy(private_gcrypt_rsa_private_key_t *this)
 458 {
 459         if (ref_put(&this->ref))
 460         {
 461                 DESTROY_IF(this->keyid);
 462                 DESTROY_IF(this->keyid_info);
 463                 gcry_sexp_release(this->key);
 464                 free(this);
 465         }
 466 }
 467
 468 /**
 469  * Internal generic constructor
 470  */
 471 static private_gcrypt_rsa_private_key_t *gcrypt_rsa_private_key_create_empty()
 472 {
 473         private_gcrypt_rsa_private_key_t *this = malloc_thing(private_gcrypt_rsa_private_key_t);
 474
 475         this->public.interface.get_type = (key_type_t (*)(private_key_t *this))get_type;
 476         this->public.interface.sign = (bool (*)(private_key_t *this, signature_scheme_t scheme, chunk_t data, chunk_t *signature))sign;
 477         this->public.interface.decrypt = (bool (*)(private_key_t *this, chunk_t crypto, chunk_t *plain))decrypt;
 478         this->public.interface.get_keysize = (size_t (*) (private_key_t *this))get_keysize;
 479         this->public.interface.get_id = (identification_t* (*) (private_key_t *this,id_type_t))get_id;
 480         this->public.interface.get_public_key = (public_key_t* (*)(private_key_t *this))get_public_key;
 481         this->public.interface.equals = (bool (*) (private_key_t*, private_key_t*))equals;
 482         this->public.interface.belongs_to = (bool (*) (private_key_t *this, public_key_t *public))belongs_to;
 483         this->public.interface.get_encoding = (chunk_t(*)(private_key_t*))get_encoding;
 484         this->public.interface.get_ref = (private_key_t* (*)(private_key_t *this))get_ref;
 485         this->public.interface.destroy = (void (*)(private_key_t *this))destroy;
 486
 487         this->key = NULL;
 488         this->keyid = NULL;
 489         this->keyid_info = NULL;
 490         this->ref = 1;
 491
 492         return this;
 493 }
 494
 495 /**
 496  * build the keyids of a private/public key
 497  */
 498 bool gcrypt_rsa_build_keyids(gcry_sexp_t key, identification_t **keyid,
 499                                                          identification_t **keyid_info)
 500 {
 501         chunk_t publicKeyInfo, publicKey, hash;
 502         hasher_t *hasher;
 503
 504         hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
 505         if (!hasher)
 506         {
 507                 DBG1("SHA1 hash algorithm not supported, unable to use RSA");
 508                 return FALSE;
 509         }
 510         publicKey = asn1_wrap(ASN1_SEQUENCE, "mm",
 511                                  asn1_integer("m", gcrypt_rsa_find_token(key, "n", NULL)),
 512                                  asn1_integer("m", gcrypt_rsa_find_token(key, "e", NULL)));
 513         hasher->allocate_hash(hasher, publicKey, &hash);
 514         *keyid = identification_create_from_encoding(ID_PUBKEY_SHA1, hash);
 515         chunk_free(&hash);
 516
 517         publicKeyInfo = asn1_wrap(ASN1_SEQUENCE, "cm",
 518                                                 asn1_algorithmIdentifier(OID_RSA_ENCRYPTION),
 519                                                 asn1_bitstring("m", publicKey));
 520         hasher->allocate_hash(hasher, publicKeyInfo, &hash);
 521         *keyid_info = identification_create_from_encoding(ID_PUBKEY_INFO_SHA1, hash);
 522         chunk_free(&hash);
 523
 524         hasher->destroy(hasher);
 525         chunk_free(&publicKeyInfo);
 526
 527         return TRUE;
 528 }
 529
 530 /**
 531  * Generate an RSA key of specified key size
 532  */
 533 static gcrypt_rsa_private_key_t *generate(size_t key_size)
 534 {
 535         private_gcrypt_rsa_private_key_t *this;
 536         gcry_sexp_t param, key;
 537         gcry_error_t err;
 538
 539         err = gcry_sexp_build(&param, NULL, "(genkey(rsa(nbits %d)))", key_size);
 540         if (err)
 541         {
 542                 DBG1("building S-expression failed: %s", gpg_strerror(err));
 543                 return NULL;
 544         }
 545
 546         err = gcry_pk_genkey(&key, param);
 547         gcry_sexp_release(param);
 548         if (err)
 549         {
 550                 DBG1("generating RSA key failed: %s", gpg_strerror(err));
 551                 return NULL;
 552         }
 553         this = gcrypt_rsa_private_key_create_empty();
 554         this->key = key;
 555
 556         if (!gcrypt_rsa_build_keyids(this->key, &this->keyid, &this->keyid_info))
 557         {
 558                 destroy(this);
 559                 return NULL;
 560         }
 561
 562         return &this->public;
 563 }
 564
 565 /**
 566  * ASN.1 definition of a PKCS#1 RSA private key
 567  */
 568 static const asn1Object_t privkeyObjects[] = {
 569         { 0, "RSAPrivateKey",           ASN1_SEQUENCE,     ASN1_NONE }, /*  0 */
 570         { 1,   "version",                       ASN1_INTEGER,      ASN1_BODY }, /*  1 */
 571         { 1,   "modulus",                       ASN1_INTEGER,      ASN1_BODY }, /*  2 */
 572         { 1,   "publicExponent",        ASN1_INTEGER,      ASN1_BODY }, /*  3 */
 573         { 1,   "privateExponent",       ASN1_INTEGER,      ASN1_BODY }, /*  4 */
 574         { 1,   "prime1",                        ASN1_INTEGER,      ASN1_BODY }, /*  5 */
 575         { 1,   "prime2",                        ASN1_INTEGER,      ASN1_BODY }, /*  6 */
 576         { 1,   "exponent1",                     ASN1_INTEGER,      ASN1_BODY }, /*  7 */
 577         { 1,   "exponent2",                     ASN1_INTEGER,      ASN1_BODY }, /*  8 */
 578         { 1,   "coefficient",           ASN1_INTEGER,      ASN1_BODY }, /*  9 */
 579         { 1,   "otherPrimeInfos",       ASN1_SEQUENCE,     ASN1_OPT |
 580                                                                                                    ASN1_LOOP }, /* 10 */
 581         { 2,     "otherPrimeInfo",      ASN1_SEQUENCE,     ASN1_NONE }, /* 11 */
 582         { 3,       "prime",                     ASN1_INTEGER,      ASN1_BODY }, /* 12 */
 583         { 3,       "exponent",          ASN1_INTEGER,      ASN1_BODY }, /* 13 */
 584         { 3,       "coefficient",       ASN1_INTEGER,      ASN1_BODY }, /* 14 */
 585         { 1,   "end opt or loop",       ASN1_EOC,          ASN1_END  }, /* 15 */
 586         { 0, "exit",                            ASN1_EOC,          ASN1_EXIT }
 587 };
 588 #define PRIV_KEY_VERSION                 1
 589 #define PRIV_KEY_MODULUS                 2
 590 #define PRIV_KEY_PUB_EXP                 3
 591 #define PRIV_KEY_PRIV_EXP                4
 592 #define PRIV_KEY_PRIME1                  5
 593 #define PRIV_KEY_PRIME2                  6
 594 #define PRIV_KEY_EXP1                    7
 595 #define PRIV_KEY_EXP2                    8
 596 #define PRIV_KEY_COEFF                   9
 597
 598 /**
 599  * load private key from a ASN1 encoded blob
 600  */
 601 static gcrypt_rsa_private_key_t *load(chunk_t blob)
 602 {
 603         private_gcrypt_rsa_private_key_t *this;
 604         asn1_parser_t *parser;
 605         chunk_t object;
 606         int objectID ;
 607         bool success = FALSE;
 608         chunk_t n, e, d, u, p, q;
 609         gcry_error_t err;
 610
 611         n = e = d = u = p = q = chunk_empty;
 612
 613         parser = asn1_parser_create(privkeyObjects, blob);
 614         parser->set_flags(parser, FALSE, TRUE);
 615
 616         while (parser->iterate(parser, &objectID, &object))
 617         {
 618                 switch (objectID)
 619                 {
 620                         case PRIV_KEY_VERSION:
 621                                 if (object.len > 0 && *object.ptr != 0)
 622                                 {
 623                                         goto end;
 624                                 }
 625                                 break;
 626                         case PRIV_KEY_MODULUS:
 627                                 n = object;
 628                                 break;
 629                         case PRIV_KEY_PUB_EXP:
 630                                 e = object;
 631                                 break;
 632                         case PRIV_KEY_PRIV_EXP:
 633                                 d = object;
 634                                 break;
 635                         case PRIV_KEY_PRIME1:
 636                                 /* p and q are swapped, as gcrypt expects p < q */
 637                                 q = object;
 638                                 break;
 639                         case PRIV_KEY_PRIME2:
 640                                 p = object;
 641                                 break;
 642                         case PRIV_KEY_EXP1:
 643                         case PRIV_KEY_EXP2:
 644                                 break;
 645                         case PRIV_KEY_COEFF:
 646                                 u = object;
 647                                 break;
 648                 }
 649         }
 650         success = parser->success(parser);
 651
 652 end:
 653         parser->destroy(parser);
 654
 655         if (!success)
 656         {
 657                 return NULL;
 658         }
 659
 660         this = gcrypt_rsa_private_key_create_empty();
 661         err = gcry_sexp_build(&this->key, NULL,
 662                                         "(private-key(rsa(n %b)(e %b)(d %b)(p %b)(q %b)(u %b)))",
 663                                         n.len, n.ptr, e.len, e.ptr, d.len, d.ptr,
 664                                         p.len, p.ptr, q.len, q.ptr, u.len, u.ptr);
 665         if (err)
 666         {
 667                 DBG1("loading private key failed: %s", gpg_strerror(err));
 668                 free(this);
 669                 return NULL;
 670         }
 671         err = gcry_pk_testkey(this->key);
 672         if (err)
 673         {
 674                 DBG1("private key sanity check failed: %s", gpg_strerror(err));
 675                 destroy(this);
 676                 return NULL;
 677         }
 678         if (!gcrypt_rsa_build_keyids(this->key, &this->keyid, &this->keyid_info))
 679         {
 680                 destroy(this);
 681                 return NULL;
 682         }
 683         return &this->public;
 684 }
 685
 686 typedef struct private_builder_t private_builder_t;
 687
 688 /**
 689  * Builder implementation for key loading/generation
 690  */
 691 struct private_builder_t {
 692         /** implements the builder interface */
 693         builder_t public;
 694         /** loaded/generated private key */
 695         gcrypt_rsa_private_key_t *key;
 696 };
 697
 698 /**
 699  * Implementation of builder_t.build
 700  */
 701 static gcrypt_rsa_private_key_t *build(private_builder_t *this)
 702 {
 703         gcrypt_rsa_private_key_t *key = this->key;
 704
 705         free(this);
 706         return key;
 707 }
 708
 709 /**
 710  * Implementation of builder_t.add
 711  */
 712 static void add(private_builder_t *this, builder_part_t part, ...)
 713 {
 714         if (!this->key)
 715         {
 716                 va_list args;
 717
 718                 switch (part)
 719                 {
 720                         case BUILD_BLOB_ASN1_DER:
 721                         {
 722                                 va_start(args, part);
 723                                 this->key = load(va_arg(args, chunk_t));
 724                                 va_end(args);
 725                                 return;
 726                         }
 727                         case BUILD_KEY_SIZE:
 728                         {
 729                                 va_start(args, part);
 730                                 this->key = generate(va_arg(args, u_int));
 731                                 va_end(args);
 732                                 return;
 733                         }
 734                         default:
 735                                 break;
 736                 }
 737         }
 738         if (this->key)
 739         {
 740                 destroy((private_gcrypt_rsa_private_key_t*)this->key);
 741         }
 742         builder_cancel(&this->public);
 743 }
 744
 745 /**
 746  * Builder construction function
 747  */
 748 builder_t *gcrypt_rsa_private_key_builder(key_type_t type)
 749 {
 750         private_builder_t *this;
 751
 752         if (type != KEY_RSA)
 753         {
 754                 return NULL;
 755         }
 756
 757         this = malloc_thing(private_builder_t);
 758
 759         this->key = NULL;
 760         this->public.add = (void(*)(builder_t *this, builder_part_t part, ...))add;
 761         this->public.build = (void*(*)(builder_t *this))build;
 762
 763         return &this->public;
 764 }
 765