1 /*
2 * Copyright 2008 Sun Microsystems, Inc. All rights reserved.
3 * Use is subject to license terms.
4 */
5
6
7 /*
8 * lib/kdb/encrypt_key.c
9 *
10 * Copyright 1990,1991 by the Massachusetts Institute of Technology.
11 * All Rights Reserved.
12 *
13 * Export of this software from the United States of America may
14 * require a specific license from the United States Government.
15 * It is the responsibility of any person or organization contemplating
16 * export to obtain such a license before exporting.
17 *
18 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
19 * distribute this software and its documentation for any purpose and
20 * without fee is hereby granted, provided that the above copyright
21 * notice appear in all copies and that both that copyright notice and
22 * this permission notice appear in supporting documentation, and that
23 * the name of M.I.T. not be used in advertising or publicity pertaining
24 * to distribution of the software without specific, written prior
25 * permission. Furthermore if you modify this software you must label
26 * your software as modified software and not distribute it in such a
27 * fashion that it might be confused with the original M.I.T. software.
28 * M.I.T. makes no representations about the suitability of
29 * this software for any purpose. It is provided "as is" without express
30 * or implied warranty.
31 *
32 *
33 * krb5_kdb_encrypt_key(), krb5_kdb_decrypt_key functions
34 */
35
36 /*
37 * Copyright (C) 1998 by the FundsXpress, INC.
38 *
39 * All rights reserved.
40 *
41 * Export of this software from the United States of America may require
42 * a specific license from the United States Government. It is the
43 * responsibility of any person or organization contemplating export to
44 * obtain such a license before exporting.
45 *
46 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
47 * distribute this software and its documentation for any purpose and
48 * without fee is hereby granted, provided that the above copyright
49 * notice appear in all copies and that both that copyright notice and
50 * this permission notice appear in supporting documentation, and that
51 * the name of FundsXpress. not be used in advertising or publicity pertaining
52 * to distribution of the software without specific, written prior
53 * permission. FundsXpress makes no representations about the suitability of
54 * this software for any purpose. It is provided "as is" without express
55 * or implied warranty.
56 *
57 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
58 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
59 * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
60 */
61
62 #include "k5-int.h"
63 #include <krb5/kdb.h>
64
65 /*
66 * Encrypt a key for storage in the database. "eblock" is used
67 * to encrypt the key in "in" into "out"; the storage pointed to by "out"
68 * is allocated before use.
69 */
70
71 krb5_error_code
krb5_dbekd_encrypt_key_data(krb5_context context,const krb5_keyblock * mkey,const krb5_keyblock * dbkey,const krb5_keysalt * keysalt,int keyver,krb5_key_data * key_data)72 krb5_dbekd_encrypt_key_data( krb5_context context,
73 const krb5_keyblock * mkey,
74 const krb5_keyblock * dbkey,
75 const krb5_keysalt * keysalt,
76 int keyver,
77 krb5_key_data * key_data)
78 {
79 krb5_error_code retval;
80 krb5_octet * ptr;
81 size_t len;
82 int i;
83 krb5_data plain;
84 krb5_enc_data cipher;
85
86 for (i = 0; i < key_data->key_data_ver; i++)
87 if (key_data->key_data_contents[i])
88 krb5_xfree(key_data->key_data_contents[i]);
89
90 key_data->key_data_ver = 1;
91 key_data->key_data_kvno = keyver;
92
93 /*
94 * The First element of the type/length/contents
95 * fields is the key type/length/contents
96 */
97 if ((retval = krb5_c_encrypt_length(context, mkey->enctype, dbkey->length,
98 &len)))
99 return(retval);
100
101 if ((ptr = (krb5_octet *) malloc(2 + len)) == NULL)
102 return(ENOMEM);
103
104 (void) memset(ptr, 0, 2 + len);
105
106 key_data->key_data_type[0] = dbkey->enctype;
107 key_data->key_data_length[0] = 2 + len;
108 key_data->key_data_contents[0] = ptr;
109
110 krb5_kdb_encode_int16(dbkey->length, ptr);
111 ptr += 2;
112
113 plain.length = dbkey->length;
114 plain.data = (char *)dbkey->contents; /* SUNWresync121 XXX */
115
116 cipher.ciphertext.length = len;
117 cipher.ciphertext.data = (char *)ptr; /* SUNWresync121 XXX */
118
119 if ((retval = krb5_c_encrypt(context, mkey, /* XXX */ 0, 0,
120 &plain, &cipher))) {
121 krb5_xfree(key_data->key_data_contents[0]);
122 return retval;
123 }
124
125 /* After key comes the salt in necessary */
126 if (keysalt) {
127 if (keysalt->type > 0) {
128 key_data->key_data_ver++;
129 key_data->key_data_type[1] = keysalt->type;
130 if ((key_data->key_data_length[1] = keysalt->data.length) != 0) {
131 key_data->key_data_contents[1] =
132 (krb5_octet *)malloc(keysalt->data.length);
133 if (key_data->key_data_contents[1] == NULL) {
134 krb5_xfree(key_data->key_data_contents[0]);
135 return ENOMEM;
136 }
137 memcpy(key_data->key_data_contents[1], keysalt->data.data,
138 (size_t) keysalt->data.length);
139 }
140 }
141 }
142
143 return retval;
144 }
145