SOSRecoveryKeyBag.m [plain text]
/*
* Copyright (c) 2016 Apple Inc. All Rights Reserved.
*
* @APPLE_LICENSE_HEADER_START@
*
* This file contains Original Code and/or Modifications of Original Code
* as defined in and that are subject to the Apple Public Source License
* Version 2.0 (the 'License'). You may not use this file except in
* compliance with the License. Please obtain a copy of the License at
* http://www.opensource.apple.com/apsl/ and read it before using this
* file.
*
* The Original Code and all software distributed under the License are
* distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
* EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
* INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
* FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
* Please see the License for the specific language governing rights and
* limitations under the License.
*
* @APPLE_LICENSE_HEADER_END@
*/
//
// SOSRecoveryKeyBag.c
// sec
//
#include "SOSRecoveryKeyBag.h"
#include "AssertMacros.h"
#include <Security/SecureObjectSync/SOSGenCount.h>
#include <Security/SecureObjectSync/SOSAccountPriv.h>
#include <Security/SecureObjectSync/SOSRecoveryKeyBag.h>
#include <utilities/SecCFWrappers.h>
#include <utilities/SecAKSWrappers.h>
#include <utilities/SecBuffer.h>
#include <utilities/SecCFError.h>
#include <utilities/der_set.h>
#include <utilities/der_plist_internal.h>
#include <Security/SecRandom.h>
#include <corecrypto/ccec.h>
#include <corecrypto/ccsha2.h>
#include <corecrypto/ccrng.h>
#include <limits.h>
#include "SOSInternal.h"
#define CURRENT_RKB_VERSION 1
//
// MARK: Type creation
//
struct __OpaqueSOSRecoveryKeyBag {
CFRuntimeBase _base;
CFStringRef accountDSID;
SOSGenCountRef generation;
uint64_t rkbVersion;
CFDataRef recoveryKeyBag;
};
static void SOSRecoveryKeyBagDestroy(CFTypeRef aObj) {
SOSRecoveryKeyBagRef rb = (SOSRecoveryKeyBagRef) aObj;
CFReleaseNull(rb->accountDSID);
CFReleaseNull(rb->generation);
CFReleaseNull(rb->recoveryKeyBag);
}
static CFStringRef SOSRecoveryKeyBagCopyFormatDescription(CFTypeRef aObj, CFDictionaryRef formatOptions) {
SOSRecoveryKeyBagRef rb = (SOSRecoveryKeyBagRef) aObj;
CFStringRef gcString = SOSGenerationCountCopyDescription(rb->generation);
CFStringRef rkbID = SOSCopyIDOfDataBufferWithLength(rb->recoveryKeyBag, 8, NULL);
CFMutableStringRef description = CFStringCreateMutable(kCFAllocatorDefault, 0);
CFStringAppendFormat(description, NULL, CFSTR("<SOSRecoveryKeyBag@ CFStringAppend(description, CFSTR(">"));
CFReleaseNull(gcString);
CFReleaseNull(rkbID);
return description;
}
CFGiblisFor(SOSRecoveryKeyBag);
// Der encoding/decoding
const uint8_t* der_decode_RecoveryKeyBag(CFAllocatorRef allocator,
SOSRecoveryKeyBagRef* RecoveryKeyBag, CFErrorRef *error,
const uint8_t* der, const uint8_t *der_end) {
if (der == NULL) return der;
const uint8_t *result = NULL;
SOSRecoveryKeyBagRef rb = CFTypeAllocate(SOSRecoveryKeyBag, struct __OpaqueSOSRecoveryKeyBag, allocator);
require_quiet(SecAllocationError(rb, error, CFSTR("Recovery bag allocation failed")), fail);
const uint8_t *sequence_end = NULL;
der = ccder_decode_sequence_tl(&sequence_end, der, der_end);
require_quiet(sequence_end == der_end, fail);
der = der_decode_string(kCFAllocatorDefault, kCFPropertyListImmutable, &rb->accountDSID, error, der, sequence_end);
rb->generation = SOSGenCountCreateFromDER(kCFAllocatorDefault, error, &der, sequence_end);
der = ccder_decode_uint64(&rb->rkbVersion, der, sequence_end);
der = der_decode_data(allocator, kCFPropertyListImmutable, &rb->recoveryKeyBag, error, der, sequence_end);
require_quiet(SecRequirementError(der == der_end, error, CFSTR("Extra space in sequence")), fail);
if (RecoveryKeyBag) CFTransferRetained(*RecoveryKeyBag, rb);
result = der;
fail:
CFReleaseNull(rb);
return result;
}
static bool SOSRecoveryKeyBagIsComplete(SOSRecoveryKeyBagRef RecoveryKeyBag, CFErrorRef *error) {
if(!RecoveryKeyBag) {
SOSCreateError(kSOSErrorEncodeFailure, CFSTR("NULL RecoveryKeyBag"), NULL, error);
return false;
}
bool retval = true;
if(!RecoveryKeyBag->recoveryKeyBag) {
SOSCreateError(kSOSErrorEncodeFailure, CFSTR("RecoveryKeyBag has no public key"), NULL, error);
retval = false;
}
if(!RecoveryKeyBag->accountDSID) {
SOSCreateError(kSOSErrorEncodeFailure, CFSTR("RecoveryKeyBag has no DSID"), NULL, error);
retval = false;
}
if(!RecoveryKeyBag->generation) {
SOSCreateError(kSOSErrorEncodeFailure, CFSTR("RecoveryKeyBag has no generation"), NULL, error);
retval = false;
}
return retval;
}
size_t der_sizeof_RecoveryKeyBag(SOSRecoveryKeyBagRef RecoveryKeyBag, CFErrorRef *error) {
size_t result = 0;
if(SOSRecoveryKeyBagIsComplete(RecoveryKeyBag, error)) {
size_t partSize = der_sizeof_string(RecoveryKeyBag->accountDSID, NULL);
partSize += SOSGenCountGetDEREncodedSize(RecoveryKeyBag->generation, NULL);
partSize += ccder_sizeof_uint64(RecoveryKeyBag->rkbVersion);
partSize += der_sizeof_data(RecoveryKeyBag->recoveryKeyBag, NULL);
result = ccder_sizeof(CCDER_CONSTRUCTED_SEQUENCE, partSize);
}
return result;
}
uint8_t* der_encode_RecoveryKeyBag(SOSRecoveryKeyBagRef RecoveryKeyBag, CFErrorRef *error,
const uint8_t *der, uint8_t *der_end) {
uint8_t *result = NULL;
if (der_end == NULL) return der_end;
if(SOSRecoveryKeyBagIsComplete(RecoveryKeyBag, error)) {
der_end = ccder_encode_constructed_tl(CCDER_CONSTRUCTED_SEQUENCE, der_end, der,
der_encode_string(RecoveryKeyBag->accountDSID, error, der,
SOSGenCountEncodeToDER(RecoveryKeyBag->generation, error, der,
ccder_encode_uint64(RecoveryKeyBag->rkbVersion, der,
der_encode_data(RecoveryKeyBag->recoveryKeyBag, error, der, der_end)))));
require_quiet(der_end == der, errOut);
result = der_end;
}
errOut:
return result;
}
SOSRecoveryKeyBagRef SOSRecoveryKeyBagCreateForAccount(CFAllocatorRef allocator, CFTypeRef account, CFDataRef pubData, CFErrorRef *error) {
SOSRecoveryKeyBagRef retval = NULL;
SOSGenCountRef gencount = NULL;
require_action_quiet(account, errOut, SOSCreateError(kSOSErrorEncodeFailure, CFSTR("Null Account Object"), NULL, error));
CFStringRef dsid = NULL;
dsid = asString(SOSAccountGetValue((__bridge SOSAccount*)account, kSOSDSIDKey, NULL), error);
require_action_quiet(dsid, errOut, SOSCreateError(kSOSErrorEncodeFailure, CFSTR("Couldn't get dsid for recovery keybag components"), NULL, error));
gencount = SOSGenerationCreate();
require_action_quiet(pubData && dsid && gencount, errOut, SOSCreateError(kSOSErrorEncodeFailure, CFSTR("Couldn't get recovery keybag components"), NULL, error));
retval = CFTypeAllocate(SOSRecoveryKeyBag, struct __OpaqueSOSRecoveryKeyBag, allocator);
require_action_quiet(retval, errOut, SOSCreateError(kSOSErrorEncodeFailure, CFSTR("Couldn't get memory for recoveryKeyBag"), NULL, error));
retval->rkbVersion = CURRENT_RKB_VERSION;
retval->accountDSID = CFStringCreateCopy(allocator, dsid);
CFRetainAssign(retval->generation, gencount);
retval->recoveryKeyBag = CFDataCreateCopy(allocator, pubData);
errOut:
CFReleaseNull(gencount);
return retval;
}
CFDataRef SOSRecoveryKeyCopyKeyForAccount(CFAllocatorRef allocator, CFTypeRef account, SOSRecoveryKeyBagRef recoveryKeyBag, CFErrorRef *error) {
CFDataRef retval = NULL;
require_action_quiet(recoveryKeyBag && recoveryKeyBag->recoveryKeyBag && recoveryKeyBag->accountDSID,
errOut, SOSCreateError(kSOSErrorDecodeFailure, CFSTR("Null recoveryKeyBag Object"), NULL, error));
CFStringRef dsid = NULL;
dsid = asString(SOSAccountGetValue((__bridge SOSAccount *)(account), kSOSDSIDKey, NULL), error);
require_action_quiet(dsid, errOut, SOSCreateError(kSOSErrorDecodeFailure, CFSTR("No DSID in Account"), NULL, error));
require_action_quiet(CFEqual(dsid, recoveryKeyBag->accountDSID), errOut, SOSCreateError(kSOSErrorDecodeFailure, CFSTR("Account/RecoveryKeybag DSID miss-match"), NULL, error));
retval = CFDataCreateCopy(allocator, recoveryKeyBag->recoveryKeyBag);
errOut:
return retval;
}
CFDataRef SOSRecoveryKeyBagCopyEncoded(SOSRecoveryKeyBagRef RecoveryKeyBag, CFErrorRef* error) {
CFDataRef result = NULL;
CFMutableDataRef encoded = NULL;
size_t encodedSize = der_sizeof_RecoveryKeyBag(RecoveryKeyBag, error);
require_quiet(encodedSize, fail);
encoded = CFDataCreateMutableWithScratch(kCFAllocatorDefault, encodedSize);
require_quiet(SecAllocationError(encoded, error, CFSTR("Failed to create scratch")), fail);
uint8_t *encode_to = CFDataGetMutableBytePtr(encoded);
uint8_t *encode_to_end = encode_to + CFDataGetLength(encoded);
require_quiet(encode_to == der_encode_RecoveryKeyBag(RecoveryKeyBag, error, encode_to, encode_to_end), fail);
CFTransferRetained(result, encoded);
fail:
CFReleaseSafe(encoded);
return result;
}
SOSRecoveryKeyBagRef SOSRecoveryKeyBagCreateFromData(CFAllocatorRef allocator, CFDataRef data, CFErrorRef *error) {
SOSRecoveryKeyBagRef result = NULL;
SOSRecoveryKeyBagRef decodedBag = NULL;
const uint8_t *der = CFDataGetBytePtr(data);
const uint8_t *der_end = der + CFDataGetLength(data);
der = der_decode_RecoveryKeyBag(allocator, &decodedBag, error, der, der_end);
require_quiet(SecRequirementError(der == der_end, error, CFSTR("Didn't consume all data supplied")), fail);
CFTransferRetained(result, decodedBag);
fail:
CFReleaseNull(decodedBag);
return result;
}
CFDataRef SOSRecoveryKeyBagGetKeyData(SOSRecoveryKeyBagRef rkbg, CFErrorRef *error) {
return rkbg->recoveryKeyBag;
}
bool SOSRecoveryKeyBagDSIDIs(SOSRecoveryKeyBagRef rkbg, CFStringRef dsid) {
if(!rkbg) return false;
return CFEqualSafe(rkbg->accountDSID, dsid);
}