stacrypt.c

SecuDe是一个由安全应用程序接口组成,对验证机制、证件处理、PEM、X.400报文处理和密钥管理提供支持。SecuDe提供DES、 RSA杂凑函数、密钥生成以及数字签名的生成和核实等多种密码机制。

/*                             signed.                         */
/*                                                             */
/*   signature                 Algorithm to be used and        */
/*			       returned signature (memory is   */
/*                             provided by the called program) */
/*                                                             */
/*   more		       = MORE -> more data is expected */
/*   			       = END  -> Last data for this    */
/*				         sign process.         */
/*                                                             */
/*   key_id                    Key-Id of the sigature key      */
/*                             Level of this key must be a     */
/*                             level on the smartcard.         */
/*                                                             */
/*   hash_par                  Additional algorithm (hash_alg) */
/*                             specific parameters or the NULL */
/*                             pointer.                        */
/*							       */
/* OUT							       */
/*   signature->signature      returned signature              */
/*			       Memory is provided by this      */
/*			       function and must be released   */
/*			       by calling routine.             */
/*							       */
/*   signature->signAI         Only if this function is called */
/*			       with signature->signAI = NULL,  */
/*			       then this function creates a    */
/*			       structure AlgId and returns it. */
/*			       In this case the allocated      */
/*			       memory must be released by the  */
/*			       calling routine.                */
/*							       */
/*   signature->signAI->parm   If the given keysize is unequal */
/*			       to the keysize, which is        */
/*			       returned by the SCT, then this  */
/*			       function sets signature->       */
/*			       signAI->parm to the correct     */
/*			       value.                          */
/*			       In this case M_KEYLEN is        */
/*			       returned.                       */
/*							       */
/*							       */
/* RETURN		     DESCRIPTION	      	       */
/*   0	         	       o.k			       */
/*   1				 M_KEYLEN		       */
/*  -1			       error			       */
/*				 M_EINDATA		       */
/*				 M_EPOINTER		       */
/*				 EINVALGID		       */
/*				 M_EMORE		       */
/*				 M_ELEVEL		       */
/*				 M_EHASHPAR		       */
/*				 M_EMEMORY		       */
/*				 M_EFUNCTION		       */
/*				 M_EHASH		       */
/*				 M_EPAR  		       */
/*							       */
/* CALLED FUNCTIONS					       */
/*  check_sct_sc               ERROR-Codes		       */
/*			         ENOCARD		       */
/*			         ESIDUNK		       */
/*			 	 ENOSHELL		       */
/*                               EOPERR                        */
/*			         EEMPTY                        */
/*                               EMEMAVAIL                     */
/*                               ECLERR                        */
/*                               ESIDUNK                       */
/*                               ERDERR                        */
/*                               EINVARG		       */
/*                               ETOOLONG		       */
/*                               sw1/sw2 from SCT response     */
/*                               T1 - ERROR                    */
/*							       */
/*  get_sct_algid              ERROR-Codes		       */
/*			         EINVALGID		       */
/*				 EKEYLENINV		       */
/*							       */
/*  get_sct_keyid              ERROR-Codes		       */
/*			         EINVKID		       */
/*							       */
/*							       */
/*  rsa_get_key		       ERROR-Codes		       */
/*				 -1 -> M_EHASHPAR              */
/*							       */
/*  hash_sqmodn 	       ERROR-Codes     	               */
/*				 -1 -> M_EHASH                 */
/*                                                             */
/*  md2_hash	               ERROR-Codes      	       */
/*				 -1 -> M_EHASH                 */
/*                                                             */
/*  md4_hash	       	       ERROR_Codes      	       */
/*				 -1 -> M_EHASH                 */
/*                                                             */
/*  md5_hash	               ERROR-Codes      	       */
/*				 -1 -> M_EHASH                 */
/*							       */
/*  sct_interface	       ERROR-Codes	               */
/*                               EINVARG		       */
/*                               ETOOLONG		       */
/*                               EMEMAVAIL		       */
/*                               ESIDUNK                       */
/*                               EPARMISSED                    */
/*                               INVPAR                        */
/*                               EINVINS                       */
/*                               sw1/sw2 from SCT response     */
/*                               T1 - ERROR                    */
/*							       */
/*							       */
/*  err_analyse		      ERROR_Codes	               */
/*				ENOSHELL		       */
/*                              EOPERR                         */
/*			        EEMPTY                         */
/*                              ECLERR                         */
/*                              ESIDUNK                        */
/*                              ERDERR                         */
/*							       */
/*  set_errmsg						       */
/*							       */
/*  sta_aux_bytestr_free				       */
/*							       */
/*  aux_free_OctetString		    	               */
/*							       */
/*-------------------------------------------------------------*/
int
sca_sign(sct_id, in_octets, signature, more, key_id, hash_par)
	int             sct_id;
	OctetString    *in_octets;
	Signature      *signature;
	More            more;
	KeyId          *key_id;
	HashPar        *hash_par;
{
	/*----------------------------------------------------------*/
	/* Definitions					       */
	/*----------------------------------------------------------*/
	int             i;
	int             rc;
	char            sct_keyid;	/* char representation of the key_id */
	KeyAlgId        sct_algid;	/* SCT specific alg_id		     */
	Bytestring      sctint_hash;	/* hash string for SCT-Interface     */
	static AlgEnc   algenc;
	static AlgHash  alghash;
	static AlgSpecial     algspecial;
	static OctetString *hash_result;
	OctetString     *encodedDigest;

#ifdef VERSION10
	int             j;
	static OctetString *hash2_result;	/* is used for padding the
						 * hash-result */
	int             modulus_len;	/* modulus length in bytes             */
	char            *dd;

#endif

	/*----------------------------------------------------------*/
	/* Statements					       */
	/*----------------------------------------------------------*/
	rc = 0;
	sca_errno = M_NOERR;
	sca_errmsg = NULL;

#ifdef TEST
	fprintf(stdout, "\n***** STAMOD-Routine sca_sign *********************************************\n\n");
	fprintf(stdout, "input-parameters:\n");
	fprintf(stdout, "sct_id:     %d\n", sct_id);
	if (in_octets != NULL) {
		fprintf(stdout, "in_octets: \n");
		aux_fxdump(stdout, in_octets->octets, in_octets->noctets, 0);
	}
	if (signature->signAI != NULL)
		if (signature->signAI->parm != NULL)
			fprintf(stdout, "signAI.keysize:    %d\n", RSA_PARM(signature->signAI->parm));
	if (more == MORE)
		fprintf(stdout, "more = MORE\n");
	if (more == END)
		fprintf(stdout, "more = END\n");
	if (key_id->key_level == SC_MF)
		fprintf(stdout, "key_id: MF-level Key_No: ");
	if (key_id->key_level == SC_DF)
		fprintf(stdout, "key_id: DF-level Key_No: ");
	if (key_id->key_level == SC_SF)
		fprintf(stdout, "key_id: SF-level Key_No: ");
	if (key_id->key_level == SCT)
		fprintf(stdout, "key_id: SCT-level Key_No: ");
	fprintf(stdout, "%d\n", key_id->key_number);
	if (hash_par != NULL) {
		fprintf(stdout, "hash_par (modulus): \n");
		aux_fxdump(stdout, hash_par->sqmodn_par.part1.octets, hash_par->sqmodn_par.part1.noctets, 0);
	}
	fprintf(stdout, "\n\n");
#endif

	/*-----------------------------------------------------*/
	/* Check input parameters			       */
	/*-----------------------------------------------------*/

	/*-----------------------------------------------------*/
	/* call check_sct_sc    		               */
	/*-----------------------------------------------------*/
	if (check_sct_sc(sct_id, TRUE) == -1)
		return (-1);

	/*-----------------------------------------------------*/
	/* check data to be signed    		               */
	/*-----------------------------------------------------*/
	if (in_octets == NULL) {
		sca_errno = M_EINDATA;
		set_errmsg();
		return (-1);
	}
	/*-----------------------------------------------------*/
	/* check signature algorithm , must be RSA            */
	/* if  signature->signAI = NULL pointer               */
	/* then take sqmodnWithRsa and set signature->signAI */
	/* to the corresponding values	       */
	/*-----------------------------------------------------*/
	if (signature == NULL) {
		sca_errno = M_EPOINTER;
		set_errmsg();
		return (-1);
	} 
	else {
		if(signature->signAI == NULL) signature->signAI = sqmodnWithRsa;
		if ((aux_ObjId2ParmType(signature->signAI->objid) == PARM_NULL) &&
		    (signature->signAI->parm)) {
			sca_errno = M_EPAR;
			set_errmsg();
			return (-1);
		}
	}

	if ((sct_algid = get_sct_algid(signature->signAI)) == -1)
		return (-1);
	if (sct_algid != S_RSA_F4) {
		sca_errno = EINVALGID;
		set_errmsg();
		return (-1);
	}
	/*-----------------------------------------------------*/
	/* check parameter more  		               */
	/*-----------------------------------------------------*/
	if ((more != END) && (more != MORE)) {
		sca_errno = M_EMORE;
		set_errmsg();
		return (-1);
	}
	/*-----------------------------------------------------*/
	/* check key_id and get keyid in char representation  */
	/* if level of key = SCT		               */
	/* then return (error)			       */
	/* RSA key must be a key on the smartcard.            */
	/*-----------------------------------------------------*/
	if ((sct_keyid = get_sct_keyid(key_id)) == -1)
		return (-1);
	if (key_id->key_level == SCT) {
		sca_errno = M_ELEVEL;
		set_errmsg();
		return (-1);
	}
/************** input parameter check done *********************************/
/************** now start hash function     *********************************/


	/*-----------------------------------------------------*/
	/* if first call of sign function		       */
	/* then 1) get hash algorithm,                         */
	/* 2) if algorithm = RSA-sqmodn                        */
	/* then set key (modulus) for hash-fct.                */
	/* 3) allocate storage for hash result and             */
	/* signature.bits                                      */
	/*-----------------------------------------------------*/

	if (act_function == F_null) {	/* first call of sca_sign */

		algenc = aux_ObjId2AlgEnc(signature->signAI->objid);
		alghash = aux_ObjId2AlgHash(signature->signAI->objid);
		algspecial = aux_ObjId2AlgSpecial(signature->signAI->objid);

		if (alghash == SQMODN) {
			if (hash_par == NULL) {
				sca_errno = M_EHASHPAR;
				set_errmsg();
				return (-1);
			}
			if (hash_par->sqmodn_par.part1.octets == NULL) {
				sca_errno = M_EHASHPAR;
				set_errmsg();
				return (-1);
			}
			/* set key in an internal function for hash-function */
			rc = rsa_get_key(&hash_par->sqmodn_par, 0);
			if (rc < 0) {
				sca_errno = M_EHASHPAR;
				set_errmsg();
				return (-1);
			}
		}
		/* allocate storage for hash_result and signature.bits */
		ALLOC_OCTET(hash_result, OctetString);
		hash_result->noctets = 0;
		ALLOC_CHAR(hash_result->octets, (RSA_PARM(signature->signAI->parm) + 7) / 8);

		signature->signature.nbits = 0;
		ALLOC_CHAR(signature->signature.bits, (RSA_PARM(signature->signAI->parm) + 7) / 8);
		act_function = F_sign;

	}
	/* end if (act_function == F_null) */
	else
	 /* not first call of sca_sign */ if (act_function != F_sign) {
		sca_errno = M_EFUNCTION;	/* wrong function call */
		set_errmsg();
		goto errcase;
	}
	/*-----------------------------------------------------*/
	/* Call hash function depending on algorithm         */
	/*-----------------------------------------------------*/
	switch (alghash) {
	case SQMODN:
		rc = hash_sqmodn(in_octets, hash_result, more,
				 RSA_PARM(signature->signAI->parm));
		break;
	case MD2:
		rc = md2_hash(in_octets, hash_result, more);
		break;
	case MD4:
		rc = md4_hash(in_octets, hash_result, more);
		break;
	case MD5:
		rc = md5_hash(in_octets, hash_result, more);
		break;
	case SHA: