sctint.c

SecuDe是一个由安全应用程序接口组成,对验证机制、证件处理、PEM、X.400报文处理和密钥管理提供支持。SecuDe提供DES、 RSA杂凑函数、密钥生成以及数字签名的生成和核实等多种密码机制。

/*						    | GMD */
/*						    +-----*/
/* PROC  sct_perror	     VERSION   2.0		  */
/*				DATE   November 1991	  */
/*				  BY   L.Eckstein,GMD	  */
/*							  */
/* DESCRIPTION						  */
/*   Print error message				  */
/*   In case of sct_errno > 0, sct_perror first prints	  */
/*   msg, then a colon	and a blank, and then the error   */
/*   message to stderr. If msg is NULL or "", only the    */
/*   error message is printed.				  */
/*							  */
/*							  */
/*							  */
/*							  */
/*							  */
/* IN			     DESCRIPTION		  */
/*   msg		       additional message	  */
/*							  */
/* OUT							  */
/*							  */
/* RETURN		     DESCRIPTION		  */
/*   0			       o.k.			  */
/*							  */
/*							  */
/*							  */
/*							  */
/*--------------------------------------------------------*/
int
sct_perror(msg)
	char           *msg;	/* additional message	 */
{
	/*----------------------------------------------------------*/
	/* Statements					       */
	/*----------------------------------------------------------*/

	if (msg && strlen(msg))
		fprintf(stderr, "%s: ", msg);
	fprintf(stderr, "%s\n", sct_error[sct_errno].msg);
	return (S_NOERR);
}

/*-------------------------------------------------------------*/
/* E N D   O F	 P R O C E D U R E	sct_perror	       */
/*-------------------------------------------------------------*/




/*--------------------------------------------------------*/
/*						    | GMD */
/*						    +-----*/
/* PROC  sct_info	     VERSION   2.0		  */
/*				DATE   November 1991	  */
/*				  BY   L.Eckstein,GMD	  */
/*							  */
/* DESCRIPTION						  */
/*   Information about SCT / SC 			  */
/*							  */
/*							  */
/*							  */
/*							  */
/*							  */
/* IN			     DESCRIPTION		  */
/*   sct_id		      SCT-Identifier		  */
/*							  */
/*  sctinfo		      Pointer to structure	  */
/*							  */
/*							  */
/* OUT							  */
/*  sctinfo->history_sc       Pointer to Bytestring	  */
/*							  */
/*							  */
/* RETURN		     DESCRIPTION		  */
/*  0			      o.k			  */
/*							  */
/*  -1			      no element found in LIST	  */
/*                             ESIDUNK                    */
/*							  */
/*							  */
/* CALLED FUNCTIONS					  */
/*  get_idelem						  */
/*--------------------------------------------------------*/
int
sct_info(sct_id, sctinfo)
	int             sct_id;	/* SCT - Identifier */
	SCTInfo        *sctinfo;/* SCTInfo structure */
{
	/*----------------------------------------------------------*/
	/* Definitions					       */
	/*----------------------------------------------------------*/
	struct s_portparam *p_elem;

#ifdef PROCDAT
	char           *proc = "sct_info";

#ifdef SECSCTEST
	fprintf(stderr, "SECSC-Function: %s\n", proc);
#endif

#endif 	/* PROCDAT */

	/*----------------------------------------------------------*/
	/* Statements					       */
	/*----------------------------------------------------------*/
	sct_errno = 0;
	sctinfo->apdusize = 0;
	sctinfo->history_sc = NULL;
	sctinfo->port_open = FALSE;
	sctinfo->sc_request = FALSE;
	sctinfo->sessionkey = FALSE;

#ifdef PROCDAT

	/*------------------------------------*/
	/* Create sct_list			 */
	/*------------------------------------*/
	if (!resfirst) {	/* create sct-list */

		/*
	   	   Problem war: 
			"sct_info()" wird von fast jeder STARMOD Funktion als erstes 
			aufgerufen, "sct_reset()" oder "sct_interface()" wurden 
			noch nicht aufgerufen. Somit wurden bei einem neuen Prozess
	 	        alte Prozess Daten noch nicht gelesen und auch noch keine
			SCT Liste erzeugt.
			Nach dem Kreieren der SCT Liste wird "get_idelem()" 
			aufgerufen und damit die alten Prozess Daten gelesen.
		*/

		if (cr_sctlist() == -1)
			return (S_ERR);
		resfirst = TRUE;
	};
#else

	if (!resfirst) {	/* sct-list not created  */
		return (S_NOERR);
	};
#endif

	/*------------------------------------*/
	/* test sct_id  in sct_list		 */
	/*------------------------------------*/
	if ((p_elem = get_idelem(sct_id)) == PORTNULL)
		return (S_ERR);	/* ERROR: sct_id not in sct-list */

#ifdef MEMTRACE
	fprintf(sct_trfp, "Element after get_idelem in sct_info\n");
	pr_element(sct_trfp, p_elem);
#endif

	sctinfo->apdusize = p_elem->apdusize;
	sctinfo->history_sc = p_elem->schistory;
	if (p_elem->port_id > 0)
		sctinfo->port_open = TRUE;
	if (p_elem->sc_request > 0)
		sctinfo->sc_request = TRUE;
	if (p_elem->session_key.subjectkey.bits != NULL)
		sctinfo->sessionkey = TRUE;

	return (S_NOERR);

}

/*-------------------------------------------------------------*/
/* E N D   O F	 P R O C E D U R E	sct_info	       */
/*-------------------------------------------------------------*/




/*--------------------------------------------------------*/
/*						    | GMD */
/*						    +-----*/
/* PROC  sct_secure	     VERSION   2.0		  */
/*				DATE   November 1991	  */
/*				  BY   L.Eckstein,GMD	  */
/*							  */
/* DESCRIPTION						  */
/*   Generate sessionkey and set it and the ssc in        */
/*   port-memory for secure messaging  between DTE and SCT*/
/*							  */
/*							  */
/*							  */
/*							  */
/*							  */
/* IN			     DESCRIPTION		  */
/*   sct_id		      SCT-Identifier		  */
/*							  */
/*							  */
/*							  */
/* OUT							  */
/*							  */
/*							  */
/* RETURN		     DESCRIPTION		  */
/*  0			      o.k			  */
/*							  */
/*  -1			      no element found in LIST	  */
/*                             ESIDUNK                    */
/*			       EGENSESS			  */
/*			       EMEMAVAIL		  */
/*			       EKEY			  */
/* 			       ERSAENC			  */
/*                             EINVARG			  */
/*                             ETOOLONG		          */
/*                             EPARMISSED                 */
/*                             EINVPAR                    */
/*                             EINVINS                    */
/*                             sw1/sw2 from SCT response  */
/*                             T1 - ERROR                 */
/*							  */
/*							  */
/* CALLED FUNCTIONS					  */
/*  get_idelem						  */
/*  sec_random_bstr					  */
/*  sct_interface					  */
/*  rsa_get_key						  */
/*  rsa_encrypt						  */
/*  aux_free_BitString					  */
/*  sta_aux_bytestr_free				  */
/*  aux_free2_OctetString				  */
/*  aux_free2_BitString					  */
/*  aux_fxdump					  */
/*--------------------------------------------------------*/
int
sct_secure(sct_id)
	int             sct_id;	/* SCT - Identifier */
{
	/*----------------------------------------------------------*/
	/* Definitions					       */
	/*----------------------------------------------------------*/
	struct s_portparam *p_elem;
	int             rc, i, ssc, key_pos;
	BitString      *sessionkey;	/* Structure will be allocated by
					 * sec_random_bstr */

	/* must be set free by aux_free_BitString	     */
	KeyBits         key_bits;
	OctetString     in;
	BitString       out;
	Bytestring      enc_sess_key;
	More            more;
	int             keysize, memolen;

	AlgId          *subjectAI;
	SessionKey      sess_key_par;
	Request         request;
	Bytestring      response;
	Boolean         old_key;
	char           *des_key;


	/*----------------------------------------------------------*/
	/* Statements					       */
	/*----------------------------------------------------------*/
	sct_errno = 0;

	if (!resfirst) {	/* sct-list not created  */
		return (S_NOERR);
	};

	/*------------------------------------*/
	/* test sct_id  in sct_list		 */
	/*------------------------------------*/
	if ((p_elem = get_idelem(sct_id)) == PORTNULL)
		return (S_ERR);	/* ERROR: sct_id not in sct-list */

#ifdef MEMTRACE
	fprintf(sct_trfp, "Element after get_idelem in sct_secure\n");
	pr_element(sct_trfp, p_elem);
#endif



	/*--------------------------------------*/
	/* generate DES-Sessionkey	    	   */
	/*--------------------------------------*/
	sessionkey = BITNULL;
	if (p_elem->session_key.subjectkey.bits == NULL) {
		if ((sessionkey = sec_random_bstr(64)) == BITNULL) {
			sct_errno = EGENSESS;
			sct_errmsg = sct_error[sct_errno].msg;
			return (-1);
		}
		old_key = FALSE;

#ifdef STREAM
		fprintf(sct_trfp, "new sessionkey          : \n");
		fprintf(sct_trfp, "    nbits               : %d\n", sessionkey->nbits);
		fprintf(sct_trfp, "    bits                : \n");
		aux_fxdump(sct_trfp, sessionkey->bits, sessionkey->nbits / 8, 0);
#endif
	} else {
		old_key = TRUE;
		sessionkey = &p_elem->session_key.subjectkey;

#ifdef STREAM
		fprintf(sct_trfp, "old sessionkey          : \n");
		fprintf(sct_trfp, "    nbits               : %d\n", sessionkey->nbits);
		fprintf(sct_trfp, "    bits                : \n");
		aux_fxdump(sct_trfp, sessionkey->bits, sessionkey->nbits / 8, 0);
#endif
	}






	/*--------------------------------------*/
	/* Prepare parameters for the           */
	/* SCT Interface Cmd S_GET_TRANSPORT_KEY */
	/*--------------------------------------*/
	request.rq_p2.algid = S_RSA_F4;

	/*--------------------------------------*/
	/* Call SCT Interface 			 */
	/*--------------------------------------*/
	rc = sct_interface(sct_id, S_GET_TRANSPORT_KEY, &request, &response);
	if (rc < 0) {
		if (old_key == FALSE)
			aux_free_BitString(&sessionkey);
		return (-1);
	}
#ifdef STREAM
	fprintf(sct_trfp, "modulus from the SCT    : \n");
	fprintf(sct_trfp, "    nbytes              : %d\n", response.nbytes);
	fprintf(sct_trfp, "    bytes               : \n");
	aux_fxdump(sct_trfp, response.bytes, response.nbytes, 0);
#endif

	/*--------------------------------------*/
	/* get modulus from SCT response and    */
	/* construct public key (modulus,       */
	/* Fermat-F4)                           */
	/*--------------------------------------*/
	key_bits.part1.noctets = response.nbytes;
	if ((key_bits.part1.octets = (char *) malloc(response.nbytes)) == NULL) {
		sct_errno = EMEMAVAIL;
		sct_errmsg = sct_error[sct_errno].msg;
		sta_aux_bytestr_free(&response);
		if (old_key == FALSE)
			aux_free_BitString(&sessionkey);
		return (-1);
	}
	for (i = 0; i < response.nbytes; i++)
		key_bits.part1.octets[i] = response.bytes[i];

	/* get fermat-f4 as public exponent */
	key_bits.part2.noctets = fermat_f4_len;
	key_bits.part2.octets = fermat_f4;
	key_bits.part3.noctets = 0;
	key_bits.part4.noctets = 0;

#ifdef STREAM
	fprintf(sct_trfp, "Key_bits                : \n");
	fprintf(sct_trfp, "    part1.noctets       : %d\n", key_bits.part1.noctets);
	fprintf(sct_trfp, "    part1.octets        : \n");
	aux_fxdump(sct_trfp, key_bits.part1.octets, key_bits.part1.noctets, 0);
	fprintf(sct_trfp, "    part2.noctets       : %d\n", key_bits.part2.noctets);
	fprintf(sct_trfp, "    part2.octets        : \n");
	aux_fxdump(sct_trfp, key_bits.part2.octets, key_bits.part2.noctets, 0);
#endif


	/*--------------------------------------*/
	/* Release storage   		        */
	/*--------------------------------------*/
	sta_aux_bytestr_free(&response);

	/*--------------------------------------*/
	/* set key in an internal function for  */
	/* hash-function                        */
	/*--------------------------------------*/
	rc = rsa_get_key(&key_bits, 0);
	if (rc < 0) {
		sct_errno = EKEY;
		sct_errmsg = sct_error[sct_errno].msg;
		aux_free2_OctetString(&key_bits.part1);
		if (old_key == FALSE)
			aux_free_BitString(&sessionkey);
		return (-1);
	}
	/*--------------------------------------*/
	/* encrypt sessionkey with RSA-Publickey */
	/*--------------------------------------*/

#ifdef MALLOC
	/* allocate buffer for DES-Key             */
	/* The Key must be set in the last 8 Bytes */
	/* The first 56 Bytes are set to 0x00      */
	des_key = malloc(((sessionkey->nbits / 8) * 8) - 1);
#endif

	if (des_key == NULL) {
		sct_errno = EMEMAVAIL;
		sct_errmsg = sct_error[sct_errno].msg;
		aux_free2_OctetString(&key_bits.part1);
		if (old_key == FALSE)
			aux_free_BitString(&sessionkey);
		return (-1);
	}
	for (i = 0; i < ((sessionkey->nbits / 8) * 8) - 1; i++)
		*(des_key + i) = 0x00;
	key_pos = 55;

	for (i = 0; i < 8; i++)
		*(des_key + key_pos + i) = *(sessionkey->bits + i);
	in.noctets = ((sessionkey->nbits / 8) * 8) - 1;
	in.octets = des_key;

#ifdef STREAM
	fprintf(sct_trfp, "in                      : \n");
	fprintf(sct_trfp, "    noctets             : %d\n", in.noctets);
	fprintf(sct_trfp, "    octets              : \n");
	aux_fxdump(sct_trfp, in.octets, in.noctets, 0);
#endif

	subjectAI = rsa;