key: finish key encoding and start cert

pkg/pkcs15/encrypted_envelope.go

@@ -0,0 +1,219 @@
+package pkcs15
+
+import (
+	"apc-p15-tool/pkg/tools"
+	"apc-p15-tool/pkg/tools/asn1obj"
+	"crypto/cipher"
+	"crypto/des"
+	"crypto/hmac"
+	"crypto/rand"
+	"crypto/sha1"
+	"crypto/sha256"
+	"encoding/asn1"
+	"math/big"
+
+	"golang.org/x/crypto/pbkdf2"
+)
+
+// fixed specs for apc cert
+const (
+	apcKEKPassword   = "user"
+	apcKEKIterations = 5000
+)
+
+// encryptedKeyEnvelope encrypts p15's rsa private key using the algorithms and
+// params expected in the APC file. Salt values are always random.
+func (p15 *pkcs15KeyCert) encryptedKeyEnvelope() ([]byte, error) {
+	// calculate values for the object
+	kekSalt := make([]byte, 8)
+	_, err := rand.Read(kekSalt)
+	if err != nil {
+		return nil, err
+	}
+
+	// kek hash alg
+	kekHash := sha256.New
+	// size of 3DES key (k1 + k2 + k3)
+	kekSize := 24
+
+	// kek
+	kek := pbkdf2.Key([]byte(apcKEKPassword), kekSalt, apcKEKIterations, kekSize, kekHash)
+
+	// make DES cipher from KEK for CEK
+	cekDesCipher, err := des.NewTripleDESCipher(kek)
+	if err != nil {
+		return nil, err
+	}
+
+	// cek (16 bytes for authEnc128) -- see: rfc3211
+	cekLen := uint8(16)
+	cek := make([]byte, cekLen)
+	_, err = rand.Read(cek)
+	if err != nil {
+		return nil, err
+	}
+
+	// LEN + Check Val [3]
+	wrappedCEK := append([]byte{cekLen}, tools.BitwiseComplimentOf(cek[:3])...)
+
+	// + CEK
+	wrappedCEK = append(wrappedCEK, cek...)
+
+	// + padding (if needed)
+	// pad wrapped CEK to min 2 * block len
+	cekPadLen := 0
+	if len(wrappedCEK) < 2*cekDesCipher.BlockSize() {
+		cekPadLen = 2*cekDesCipher.BlockSize() - len(wrappedCEK)
+	} else if len(wrappedCEK)%cekDesCipher.BlockSize() != 0 {
+		// pad if not a multiple of block len
+		cekPadLen = cekDesCipher.BlockSize() - len(wrappedCEK)%cekDesCipher.BlockSize()
+	}
+	cekPadding := make([]byte, cekPadLen)
+	_, err = rand.Read(cekPadding)
+	if err != nil {
+		return nil, err
+	}
+	wrappedCEK = append(wrappedCEK, cekPadding...)
+
+	// double encrypt CEK
+	cekEncryptSalt := make([]byte, 8)
+	_, err = rand.Read(cekEncryptSalt)
+	if err != nil {
+		return nil, err
+	}
+
+	cekEncrypter := cipher.NewCBCEncrypter(cekDesCipher, cekEncryptSalt)
+
+	encryptedCEKOnly1Rd := make([]byte, len(wrappedCEK))
+	cekEncrypter.CryptBlocks(encryptedCEKOnly1Rd, wrappedCEK)
+	encryptedCEK := make([]byte, len(encryptedCEKOnly1Rd))
+	cekEncrypter.CryptBlocks(encryptedCEK, encryptedCEKOnly1Rd)
+
+	// content encryption
+	contentEncSalt := make([]byte, 8)
+	_, err = rand.Read(contentEncSalt)
+	if err != nil {
+		return nil, err
+	}
+
+	contentEncryptKey := pbkdf2.Key(cek, []byte("encryption"), 1, 24, sha1.New)
+	contentDesCipher, err := des.NewTripleDESCipher(contentEncryptKey)
+	if err != nil {
+		return nil, err
+	}
+
+	content := p15.privateKeyObject()
+	// pad content, see: https://datatracker.ietf.org/doc/html/rfc3852 6.3
+	contentPadLen := uint8(contentDesCipher.BlockSize() - (len(content) % contentDesCipher.BlockSize()))
+	// ALWAYS pad, if content is exact, add full block of padding
+	if contentPadLen == 0 {
+		contentPadLen = uint8(contentDesCipher.BlockSize())
+	}
+	for i := uint8(1); i <= contentPadLen; i++ {
+		content = append(content, byte(contentPadLen))
+	}
+
+	contentEncrypter := cipher.NewCBCEncrypter(contentDesCipher, contentEncSalt)
+	encryptedContent := make([]byte, len(content))
+	contentEncrypter.CryptBlocks(encryptedContent, content)
+
+	// encrypted content MAC
+	macKey := pbkdf2.Key(cek, []byte("authentication"), 1, 32, sha1.New)
+
+	// data encryption alg block
+	encAlgObj := asn1obj.Sequence([][]byte{
+		// ContentEncryptionAlgorithmIdentifier
+		asn1obj.ObjectIdentifier(asn1obj.OIDauthEnc128),
+		// ContentEncryptionAlgorithmIdentifier details/info
+		asn1obj.Sequence([][]byte{
+			// encryption alg & salt
+			asn1obj.Sequence([][]byte{
+				// encryption alg
+				asn1obj.ObjectIdentifier(asn1obj.OIDdesEDE3CBC),
+				// encryption alg's salt
+				asn1obj.OctetString(contentEncSalt),
+			}),
+			// mac alg
+			asn1obj.Sequence([][]byte{
+				asn1obj.ObjectIdentifier(asn1obj.OIDhmacWithSHA256),
+				asn1.NullBytes,
+			}),
+		}),
+	})
+
+	macHasher := hmac.New(sha256.New, macKey)
+	// the data the MAC covers is the algId header bytes + encrypted data bytes
+	hashMe := append(encAlgObj, encryptedContent...)
+
+	// make MAC
+	_, err = macHasher.Write(hashMe)
+	if err != nil {
+		return nil, err
+	}
+	mac := macHasher.Sum(nil)
+
+	// build object
+	// AuthEnvelopedData Type
+	envelope := [][]byte{
+		// CMSVersion
+		asn1obj.Integer(big.NewInt(2)),
+		// RecipientInfos
+		asn1obj.Set([][]byte{
+			// 1st and only 'RecipientInfo' - pwri [3] PasswordRecipientinfo
+			asn1obj.ExplicitCompound(3, [][]byte{
+				// CMSVersion
+				asn1obj.Integer(big.NewInt(0)),
+				// keyDerivationAlgorithm [0]
+				asn1obj.ExplicitCompound(0, [][]byte{
+					// KeyDerivationAlgorithmIdentifier
+					asn1obj.ObjectIdentifier(asn1obj.OIDpkcs5PBKDF2),
+					// KeyDerivationAlgorithmIdentifier details/info
+					asn1obj.Sequence([][]byte{
+						// kek pbkdf2 Salt
+						asn1obj.OctetString(kekSalt),
+						// kek pbkdf2 Iterations
+						asn1obj.Integer(big.NewInt(apcKEKIterations)),
+						// kek pbkdf2 hash type
+						asn1obj.Sequence([][]byte{
+							asn1obj.ObjectIdentifier(asn1obj.OIDhmacWithSHA256),
+							asn1.NullBytes,
+						}),
+					}),
+				}),
+				// keyEncryptionAlgorithm (for CEK)
+				asn1obj.Sequence([][]byte{
+					// KeyEncryptionAlgorithmIdentifier
+					asn1obj.ObjectIdentifier(asn1obj.OIDpwriKEK),
+					// KeyEncryptionAlgorithmIdentifier details/info
+					asn1obj.Sequence([][]byte{
+						// encryption alg
+						asn1obj.ObjectIdentifier(asn1obj.OIDdesEDE3CBC),
+						// encryption alg's salt
+						asn1obj.OctetString(cekEncryptSalt),
+					}),
+				}),
+				// EncryptedKey (the actual ciphertext for the CEK)
+				asn1obj.OctetString(encryptedCEK),
+			}),
+		}),
+		// EncryptedContentInfo (actual encrypted content)
+		asn1obj.Sequence([][]byte{
+			// ContentType
+			asn1obj.ObjectIdentifier(asn1obj.OIDpkcs7Data),
+			// encryption alg OBJ
+			encAlgObj,
+			// [0] IMPLICIT EncryptedContent (AKA the ciphertext)
+			asn1obj.ExplicitValue(0, encryptedContent),
+		}),
+		// MAC
+		asn1obj.OctetString(mac),
+	}
+
+	// combine to singular byte slice
+	finalEnv := []byte{}
+	for i := range envelope {
+		finalEnv = append(finalEnv, envelope[i]...)
+	}
+
+	return finalEnv, nil
+}