Home | History | Annotate | Download | only in kdb
      1 /*
      2  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
      3  * Use is subject to license terms.
      4  */
      5 
      6 
      7 /*
      8  * lib/kdb/decrypt_key.c
      9  *
     10  * Copyright 1990,1991 by the Massachusetts Institute of Technology.
     11  * All Rights Reserved.
     12  *
     13  * Export of this software from the United States of America may
     14  *   require a specific license from the United States Government.
     15  *   It is the responsibility of any person or organization contemplating
     16  *   export to obtain such a license before exporting.
     17  *
     18  * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
     19  * distribute this software and its documentation for any purpose and
     20  * without fee is hereby granted, provided that the above copyright
     21  * notice appear in all copies and that both that copyright notice and
     22  * this permission notice appear in supporting documentation, and that
     23  * the name of M.I.T. not be used in advertising or publicity pertaining
     24  * to distribution of the software without specific, written prior
     25  * permission.  Furthermore if you modify this software you must label
     26  * your software as modified software and not distribute it in such a
     27  * fashion that it might be confused with the original M.I.T. software.
     28  * M.I.T. makes no representations about the suitability of
     29  * this software for any purpose.  It is provided "as is" without express
     30  * or implied warranty.
     31  *
     32  *
     33  * krb5_kdb_encrypt_key(), krb5_kdb_decrypt_key functions
     34  */
     35 
     36 /*
     37  * Copyright (C) 1998 by the FundsXpress, INC.
     38  *
     39  * All rights reserved.
     40  *
     41  * Export of this software from the United States of America may require
     42  * a specific license from the United States Government.  It is the
     43  * responsibility of any person or organization contemplating export to
     44  * obtain such a license before exporting.
     45  *
     46  * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
     47  * distribute this software and its documentation for any purpose and
     48  * without fee is hereby granted, provided that the above copyright
     49  * notice appear in all copies and that both that copyright notice and
     50  * this permission notice appear in supporting documentation, and that
     51  * the name of FundsXpress. not be used in advertising or publicity pertaining
     52  * to distribution of the software without specific, written prior
     53  * permission.  FundsXpress makes no representations about the suitability of
     54  * this software for any purpose.  It is provided "as is" without express
     55  * or implied warranty.
     56  *
     57  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
     58  * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
     59  * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
     60  */
     61 
     62 #include "k5-int.h"
     63 #include <krb5/kdb.h>
     64 
     65 /*
     66  * Decrypt a key from storage in the database.  "eblock" is used
     67  * to decrypt the key in "in" into "out"; the storage pointed to by "out"
     68  * is allocated before use.
     69  */
     70 
     71 krb5_error_code
     72 krb5_dbekd_decrypt_key_data( krb5_context 	  context,
     73 			     const krb5_keyblock	* mkey,
     74 			     const krb5_key_data	* key_data,
     75 			     krb5_keyblock 	* dbkey,
     76 			     krb5_keysalt 	* keysalt)
     77 {
     78     krb5_error_code 	  retval = 0;
     79     krb5_int16		  tmplen;
     80     krb5_octet		* ptr;
     81     krb5_enc_data	  cipher;
     82     krb5_data		  plain;
     83 
     84     ptr = key_data->key_data_contents[0];
     85 
     86     if (ptr) {
     87 	krb5_kdb_decode_int16(ptr, tmplen);
     88 	ptr += 2;
     89 
     90 	cipher.enctype = ENCTYPE_UNKNOWN;
     91 	cipher.ciphertext.length = key_data->key_data_length[0]-2;
     92 	cipher.ciphertext.data = (char *)ptr;  /* SUNWresync121 XXX */
     93 	plain.length = key_data->key_data_length[0]-2;
     94 	if ((plain.data = (char *) malloc(plain.length)) == NULL)
     95 	    return(ENOMEM);
     96 	(void) memset(plain.data, 0, plain.length);
     97 
     98 	if ((retval = krb5_c_decrypt(context, mkey, 0 /* XXX */, 0,
     99 				     &cipher, &plain))) {
    100 	    krb5_xfree(plain.data);
    101 	    return retval;
    102 	}
    103 
    104 	/* tmplen is the true length of the key.  plain.data is the
    105 	   plaintext data length, but it may be padded, since the
    106 	   old-style etypes didn't store the real length.  I can check
    107 	   to make sure that there are enough bytes, but I can't do
    108 	   any better than that. */
    109 
    110 	if (tmplen > plain.length) {
    111 	    krb5_xfree(plain.data);
    112 	    return(KRB5_CRYPTO_INTERNAL);
    113 	}
    114 
    115 	dbkey->magic = KV5M_KEYBLOCK;
    116 	dbkey->enctype = key_data->key_data_type[0];
    117 	dbkey->length = tmplen;
    118 	dbkey->contents = (unsigned char *) plain.data;  /* SUNWresync121 XXX */
    119 	dbkey->dk_list = NULL;
    120 	dbkey->hKey = CK_INVALID_HANDLE;
    121     }
    122 
    123     /* Decode salt data */
    124     if (keysalt) {
    125 	if (key_data->key_data_ver == 2) {
    126 	    keysalt->type = key_data->key_data_type[1];
    127 	    if ((keysalt->data.length = key_data->key_data_length[1])) {
    128 		if (!(keysalt->data.data=(char *)malloc(keysalt->data.length))){
    129 		    if (key_data->key_data_contents[0]) {
    130 			krb5_xfree(dbkey->contents);
    131 			dbkey->contents = 0;
    132 			dbkey->length = 0;
    133 		    }
    134 		    return ENOMEM;
    135 		}
    136 		memcpy(keysalt->data.data, key_data->key_data_contents[1],
    137 		       (size_t) keysalt->data.length);
    138 	    } else
    139 		keysalt->data.data = (char *) NULL;
    140 	} else {
    141 	    keysalt->type = KRB5_KDB_SALTTYPE_NORMAL;
    142 	    keysalt->data.data = (char *) NULL;
    143 	    keysalt->data.length = 0;
    144 	}
    145     }
    146 
    147     return retval;
    148 }
    149