1/*
2 * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
3 * Use is subject to license terms.
4 */
5
6
7/*
8 * lib/kdb/encrypt_key.c
9 *
10 * Copyright 1990,1991 by the Massachusetts Institute of Technology.
11 * All Rights Reserved.
12 *
13 * Export of this software from the United States of America may
14 *   require a specific license from the United States Government.
15 *   It is the responsibility of any person or organization contemplating
16 *   export to obtain such a license before exporting.
17 *
18 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
19 * distribute this software and its documentation for any purpose and
20 * without fee is hereby granted, provided that the above copyright
21 * notice appear in all copies and that both that copyright notice and
22 * this permission notice appear in supporting documentation, and that
23 * the name of M.I.T. not be used in advertising or publicity pertaining
24 * to distribution of the software without specific, written prior
25 * permission.  Furthermore if you modify this software you must label
26 * your software as modified software and not distribute it in such a
27 * fashion that it might be confused with the original M.I.T. software.
28 * M.I.T. makes no representations about the suitability of
29 * this software for any purpose.  It is provided "as is" without express
30 * or implied warranty.
31 *
32 *
33 * krb5_kdb_encrypt_key(), krb5_kdb_decrypt_key functions
34 */
35
36/*
37 * Copyright (C) 1998 by the FundsXpress, INC.
38 *
39 * All rights reserved.
40 *
41 * Export of this software from the United States of America may require
42 * a specific license from the United States Government.  It is the
43 * responsibility of any person or organization contemplating export to
44 * obtain such a license before exporting.
45 *
46 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
47 * distribute this software and its documentation for any purpose and
48 * without fee is hereby granted, provided that the above copyright
49 * notice appear in all copies and that both that copyright notice and
50 * this permission notice appear in supporting documentation, and that
51 * the name of FundsXpress. not be used in advertising or publicity pertaining
52 * to distribution of the software without specific, written prior
53 * permission.  FundsXpress makes no representations about the suitability of
54 * this software for any purpose.  It is provided "as is" without express
55 * or implied warranty.
56 *
57 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
58 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
59 * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
60 */
61
62#include "k5-int.h"
63#include <krb5/kdb.h>
64
65/*
66 * Encrypt a key for storage in the database.  "eblock" is used
67 * to encrypt the key in "in" into "out"; the storage pointed to by "out"
68 * is allocated before use.
69 */
70
71krb5_error_code
72krb5_dbekd_encrypt_key_data( krb5_context 		  context,
73			     const krb5_keyblock	* mkey,
74			     const krb5_keyblock 	* dbkey,
75			     const krb5_keysalt		* keysalt,
76			     int			  keyver,
77			     krb5_key_data	        * key_data)
78{
79    krb5_error_code 		  retval;
80    krb5_octet			* ptr;
81    size_t			  len;
82    int				  i;
83    krb5_data			  plain;
84    krb5_enc_data		  cipher;
85
86    for (i = 0; i < key_data->key_data_ver; i++)
87	if (key_data->key_data_contents[i])
88	    krb5_xfree(key_data->key_data_contents[i]);
89
90    key_data->key_data_ver = 1;
91    key_data->key_data_kvno = keyver;
92
93    /*
94     * The First element of the type/length/contents
95     * fields is the key type/length/contents
96     */
97    if ((retval = krb5_c_encrypt_length(context, mkey->enctype, dbkey->length,
98					&len)))
99	return(retval);
100
101    if ((ptr = (krb5_octet *) malloc(2 + len)) == NULL)
102	return(ENOMEM);
103
104    (void) memset(ptr, 0, 2 + len);
105
106    key_data->key_data_type[0] = dbkey->enctype;
107    key_data->key_data_length[0] = 2 + len;
108    key_data->key_data_contents[0] = ptr;
109
110    krb5_kdb_encode_int16(dbkey->length, ptr);
111    ptr += 2;
112
113    plain.length = dbkey->length;
114    plain.data = (char *)dbkey->contents;  /* SUNWresync121 XXX */
115
116    cipher.ciphertext.length = len;
117    cipher.ciphertext.data = (char *)ptr; /* SUNWresync121 XXX */
118
119    if ((retval = krb5_c_encrypt(context, mkey, /* XXX */ 0, 0,
120				 &plain, &cipher))) {
121	krb5_xfree(key_data->key_data_contents[0]);
122	return retval;
123    }
124
125    /* After key comes the salt in necessary */
126    if (keysalt) {
127	if (keysalt->type > 0) {
128	    key_data->key_data_ver++;
129	    key_data->key_data_type[1] = keysalt->type;
130	    if ((key_data->key_data_length[1] = keysalt->data.length) != 0) {
131		key_data->key_data_contents[1] =
132		    (krb5_octet *)malloc(keysalt->data.length);
133		if (key_data->key_data_contents[1] == NULL) {
134		    krb5_xfree(key_data->key_data_contents[0]);
135		    return ENOMEM;
136		}
137		memcpy(key_data->key_data_contents[1], keysalt->data.data,
138		       (size_t) keysalt->data.length);
139	    }
140	}
141    }
142
143    return retval;
144}
145