usr/src/lib/krb5/kdb/encrypt_key.c

   1 /*
   2  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
   3  * Use is subject to license terms.
   4  */
   5
   6
   7 /*
   8  * lib/kdb/encrypt_key.c
   9  *
  10  * Copyright 1990,1991 by the Massachusetts Institute of Technology.
  11  * All Rights Reserved.
  12  *
  13  * Export of this software from the United States of America may
  14  *   require a specific license from the United States Government.
  15  *   It is the responsibility of any person or organization contemplating
  16  *   export to obtain such a license before exporting.
  17  *
  18  * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
  19  * distribute this software and its documentation for any purpose and
  20  * without fee is hereby granted, provided that the above copyright
  21  * notice appear in all copies and that both that copyright notice and
  22  * this permission notice appear in supporting documentation, and that
  23  * the name of M.I.T. not be used in advertising or publicity pertaining
  24  * to distribution of the software without specific, written prior
  25  * permission.  Furthermore if you modify this software you must label
  26  * your software as modified software and not distribute it in such a
  27  * fashion that it might be confused with the original M.I.T. software.
  28  * M.I.T. makes no representations about the suitability of
  29  * this software for any purpose.  It is provided "as is" without express
  30  * or implied warranty.
  31  *
  32  *
  33  * krb5_kdb_encrypt_key(), krb5_kdb_decrypt_key functions
  34  */
  35
  36 /*
  37  * Copyright (C) 1998 by the FundsXpress, INC.
  38  *
  39  * All rights reserved.
  40  *
  41  * Export of this software from the United States of America may require
  42  * a specific license from the United States Government.  It is the
  43  * responsibility of any person or organization contemplating export to
  44  * obtain such a license before exporting.
  45  *
  46  * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
  47  * distribute this software and its documentation for any purpose and
  48  * without fee is hereby granted, provided that the above copyright
  49  * notice appear in all copies and that both that copyright notice and
  50  * this permission notice appear in supporting documentation, and that
  51  * the name of FundsXpress. not be used in advertising or publicity pertaining
  52  * to distribution of the software without specific, written prior
  53  * permission.  FundsXpress makes no representations about the suitability of
  54  * this software for any purpose.  It is provided "as is" without express
  55  * or implied warranty.
  56  *
  57  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
  58  * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
  59  * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  60  */
  61
  62 #include "k5-int.h"
  63 #include <krb5/kdb.h>
  64
  65 /*
  66  * Encrypt a key for storage in the database.  "eblock" is used
  67  * to encrypt the key in "in" into "out"; the storage pointed to by "out"
  68  * is allocated before use.
  69  */
  70
  71 krb5_error_code
  72 krb5_dbekd_encrypt_key_data( krb5_context                 context,
  73                              const krb5_keyblock        * mkey,
  74                              const krb5_keyblock        * dbkey,
  75                              const krb5_keysalt         * keysalt,
  76                              int                          keyver,
  77                              krb5_key_data              * key_data)
  78 {
  79     krb5_error_code               retval;
  80     krb5_octet                  * ptr;
  81     size_t                        len;
  82     int                           i;
  83     krb5_data                     plain;
  84     krb5_enc_data                 cipher;
  85
  86     for (i = 0; i < key_data->key_data_ver; i++)
  87         if (key_data->key_data_contents[i])
  88             krb5_xfree(key_data->key_data_contents[i]);
  89
  90     key_data->key_data_ver = 1;
  91     key_data->key_data_kvno = keyver;
  92
  93     /*
  94      * The First element of the type/length/contents
  95      * fields is the key type/length/contents
  96      */
  97     if ((retval = krb5_c_encrypt_length(context, mkey->enctype, dbkey->length,
  98                                         &len)))
  99         return(retval);
 100
 101     if ((ptr = (krb5_octet *) malloc(2 + len)) == NULL)
 102         return(ENOMEM);
 103
 104     (void) memset(ptr, 0, 2 + len);
 105
 106     key_data->key_data_type[0] = dbkey->enctype;
 107     key_data->key_data_length[0] = 2 + len;
 108     key_data->key_data_contents[0] = ptr;
 109
 110     krb5_kdb_encode_int16(dbkey->length, ptr);
 111     ptr += 2;
 112
 113     plain.length = dbkey->length;
 114     plain.data = (char *)dbkey->contents;  /* SUNWresync121 XXX */
 115
 116     cipher.ciphertext.length = len;
 117     cipher.ciphertext.data = (char *)ptr; /* SUNWresync121 XXX */
 118
 119     if ((retval = krb5_c_encrypt(context, mkey, /* XXX */ 0, 0,
 120                                  &plain, &cipher))) {
 121         krb5_xfree(key_data->key_data_contents[0]);
 122         return retval;
 123     }
 124
 125     /* After key comes the salt in necessary */
 126     if (keysalt) {
 127         if (keysalt->type > 0) {
 128             key_data->key_data_ver++;
 129             key_data->key_data_type[1] = keysalt->type;
 130             if ((key_data->key_data_length[1] = keysalt->data.length) != 0) {
 131                 key_data->key_data_contents[1] =
 132                     (krb5_octet *)malloc(keysalt->data.length);
 133                 if (key_data->key_data_contents[1] == NULL) {
 134                     krb5_xfree(key_data->key_data_contents[0]);
 135                     return ENOMEM;
 136                 }
 137                 memcpy(key_data->key_data_contents[1], keysalt->data.data,
 138                        (size_t) keysalt->data.length);
 139             }
 140         }
 141     }
 142
 143     return retval;
 144 }