openpgp_card_rpgp/

private.rs

// SPDX-FileCopyrightText: Wiktor Kwapisiewicz <wiktor@metacode.biz>
// SPDX-FileCopyrightText: Heiko Schaefer <heiko@schaefer.name>
// SPDX-License-Identifier: Apache-2.0 OR MIT

use openpgp_card::ocard::crypto::{CardUploadableKey, EccKey, EccType, PrivateKeyMaterial, RSAKey};
use openpgp_card::ocard::data::{Fingerprint, KeyGenerationTime};
use openpgp_card::Error;
use pgp::crypto::ecc_curve::ECCCurve;
use pgp::types::{
    EcdhPublicParams, EcdsaPublicParams, EddsaLegacyPublicParams, KeyDetails, PlainSecretParams,
    PublicKeyTrait, PublicParams, SecretParams,
};
use rsa::traits::{PrivateKeyParts, PublicKeyParts};
use rsa::BigUint;

/// Shared type for rPGP "secret key" packets (primary or subkey)
enum Sec {
    Key(pgp::packet::SecretKey),
    SubKey(pgp::packet::SecretSubkey),
}

impl Sec {
    fn public_params(&self) -> &PublicParams {
        match self {
            Sec::Key(sk) => sk.public_key().public_params(),
            Sec::SubKey(ssk) => ssk.public_key().public_params(),
        }
    }

    fn secret_params(&self) -> &SecretParams {
        match self {
            Sec::Key(sk) => sk.secret_params(),
            Sec::SubKey(ssk) => ssk.secret_params(),
        }
    }
}

/// Private key material that can be uploaded to a card slot.
///
/// The data in an `UploadableKey` corresponds to an OpenPGP secret key packet.
pub struct UploadableKey {
    key: Sec,
    unlocked: Option<PlainSecretParams>,
}

impl From<pgp::packet::SecretKey> for UploadableKey {
    fn from(value: pgp::packet::SecretKey) -> Self {
        Self {
            key: Sec::Key(value),
            unlocked: None,
        }
    }
}

impl From<pgp::packet::SecretSubkey> for UploadableKey {
    fn from(value: pgp::packet::SecretSubkey) -> Self {
        Self {
            key: Sec::SubKey(value),
            unlocked: None,
        }
    }
}

impl UploadableKey {
    pub fn is_locked(&self) -> bool {
        match self.key.secret_params() {
            SecretParams::Plain(_) => false,
            SecretParams::Encrypted(_) => true,
        }
    }

    /// Returns:
    /// - `Ok(false)` for keys that are not password protected
    /// - `Ok(true)` for protected keys that were successfully unlocked
    /// - `Err` when the password did not unlock the key (in this case, the key cannot be imported to a card).
    pub fn try_unlock(&mut self, pw: &str) -> Result<bool, Error> {
        match self.key.secret_params() {
            SecretParams::Plain(_) => Ok(false),
            SecretParams::Encrypted(esp) => {
                match &self.key {
                    // FIXME: this duplication is unfortunate
                    Sec::Key(sk) => {
                        if let Ok(psp) = esp.unlock(&pw.into(), sk.public_key(), None) {
                            self.unlocked = Some(psp);
                            return Ok(true);
                        }
                    }
                    Sec::SubKey(ssk) => {
                        if let Ok(psp) = esp.unlock(&pw.into(), ssk.public_key(), None) {
                            self.unlocked = Some(psp);
                            return Ok(true);
                        }
                    }
                }

                Err(Error::InternalError("Could not unlock key".to_string()))
            }
        }
    }
}

impl CardUploadableKey for UploadableKey {
    fn private_key(&self) -> Result<PrivateKeyMaterial, Error> {
        fn to_privatekeymaterial(
            psp: &PlainSecretParams,
            pp: &PublicParams,
        ) -> Result<PrivateKeyMaterial, Error> {
            match (psp, pp) {
                (PlainSecretParams::RSA(secret), PublicParams::RSA(public)) => {
                    let (d, p, q, _u) = secret.to_bytes();

                    let rsa_key = Rsa::new(
                        public.key.e().to_bytes_be(),
                        d,
                        public.key.n().to_bytes_be(),
                        p,
                        q,
                    )?;
                    Ok(PrivateKeyMaterial::R(Box::new(rsa_key)))
                }
                (PlainSecretParams::ECDSA(s), PublicParams::ECDSA(p)) => {
                    let (curve, public, private) = match (p, s) {
                        (
                            EcdsaPublicParams::P256 { key },
                            pgp::crypto::ecdsa::SecretKey::P256(secret),
                        ) => (
                            ECCCurve::P256,
                            key.to_sec1_bytes(),
                            secret.to_bytes().to_vec(),
                        ),
                        (
                            EcdsaPublicParams::P384 { key },
                            pgp::crypto::ecdsa::SecretKey::P384(secret),
                        ) => (
                            ECCCurve::P384,
                            key.to_sec1_bytes(),
                            secret.to_bytes().to_vec(),
                        ),
                        (
                            EcdsaPublicParams::P521 { key },
                            pgp::crypto::ecdsa::SecretKey::P521(secret),
                        ) => (
                            ECCCurve::P521,
                            key.to_sec1_bytes(),
                            secret.to_bytes().to_vec(),
                        ),
                        (
                            EcdsaPublicParams::Secp256k1 { .. },
                            pgp::crypto::ecdsa::SecretKey::Secp256k1(_),
                        ) => {
                            return Err(Error::UnsupportedAlgo(
                                "ECDSA with curve Secp256k1 is unsupported".to_string(),
                            ))
                        }
                        _ => {
                            return Err(Error::UnsupportedAlgo(format!(
                                "ECDSA with unsupported algorithm(s) {p:?} / {s:?}"
                            )))
                        }
                    };

                    let ecc = Ecc::new(curve, private, public.to_vec(), EccType::ECDSA);
                    Ok(PrivateKeyMaterial::E(Box::new(ecc)))
                }
                (
                    PlainSecretParams::Ed25519Legacy(m),
                    PublicParams::EdDSALegacy(EddsaLegacyPublicParams::Ed25519 { key }),
                ) => {
                    let mut public = Vec::with_capacity(33);
                    public.push(0x40);
                    public.extend_from_slice(key.as_bytes());

                    let ecc = Ecc::new(
                        ECCCurve::Ed25519.clone(),
                        m.as_bytes().to_vec(),
                        public,
                        EccType::EdDSA,
                    );
                    Ok(PrivateKeyMaterial::E(Box::new(ecc)))
                }
                (
                    PlainSecretParams::ECDH(pgp::crypto::ecdh::SecretKey::Curve25519(secret)),
                    PublicParams::ECDH(EcdhPublicParams::Curve25519 { p, .. }),
                ) => {
                    // Behold: the sad reversed x25519 wire format in OpenPGP
                    let reversed_private = secret.to_bytes_rev();

                    let mut public = Vec::with_capacity(33);
                    public.push(0x40);
                    public.extend_from_slice(p.as_ref());

                    let ecc = Ecc::new(
                        ECCCurve::Curve25519.clone(),
                        reversed_private.to_vec(),
                        public.to_vec(),
                        EccType::ECDH,
                    );
                    Ok(PrivateKeyMaterial::E(Box::new(ecc)))
                }
                (
                    PlainSecretParams::ECDH(pgp::crypto::ecdh::SecretKey::P256 { secret }),
                    PublicParams::ECDH(EcdhPublicParams::P256 { p, .. }),
                ) => {
                    let ecc = Ecc::new(
                        ECCCurve::P256.clone(),
                        secret.to_bytes().to_vec(),
                        p.to_sec1_bytes().to_vec(),
                        EccType::ECDH,
                    );
                    Ok(PrivateKeyMaterial::E(Box::new(ecc)))
                }
                (
                    PlainSecretParams::ECDH(pgp::crypto::ecdh::SecretKey::P384 { secret }),
                    PublicParams::ECDH(EcdhPublicParams::P384 { p, .. }),
                ) => {
                    let ecc = Ecc::new(
                        ECCCurve::P384.clone(),
                        secret.to_bytes().to_vec(),
                        p.to_sec1_bytes().to_vec(),
                        EccType::ECDH,
                    );
                    Ok(PrivateKeyMaterial::E(Box::new(ecc)))
                }
                (
                    PlainSecretParams::ECDH(pgp::crypto::ecdh::SecretKey::P521 { secret }),
                    PublicParams::ECDH(EcdhPublicParams::P521 { p, .. }),
                ) => {
                    let ecc = Ecc::new(
                        ECCCurve::P521.clone(),
                        secret.to_bytes().to_vec(),
                        p.to_sec1_bytes().to_vec(),
                        EccType::ECDH,
                    );
                    Ok(PrivateKeyMaterial::E(Box::new(ecc)))
                }

                _ => Err(Error::UnsupportedAlgo(format!(
                    "Unsupported key material {pp:?}"
                ))),
            }
        }

        let pp = self.key.public_params();

        let psp = match self.key.secret_params() {
            SecretParams::Plain(psp) => psp,
            SecretParams::Encrypted(_) => {
                if let Some(psp) = &self.unlocked {
                    psp
                } else {
                    return Err(Error::InternalError(
                        "Secret key packet wasn't unlocked".to_string(),
                    ));
                }
            }
        };

        to_privatekeymaterial(psp, pp)
    }

    fn timestamp(&self) -> KeyGenerationTime {
        let ts = match &self.key {
            Sec::Key(sk) => sk.public_key().created_at(),
            Sec::SubKey(ssk) => ssk.public_key().created_at(),
        };

        let ts = ts.timestamp() as u32;
        ts.into()
    }

    fn fingerprint(&self) -> Result<Fingerprint, Error> {
        let fp = match &self.key {
            Sec::Key(sk) => sk.fingerprint(),
            Sec::SubKey(ssk) => ssk.fingerprint(),
        };

        Fingerprint::try_from(fp.as_bytes())
    }
}

struct Rsa {
    e: Vec<u8>,
    n: Vec<u8>,
    p: Vec<u8>,
    q: Vec<u8>,
    pq: Vec<u8>,
    dp1: Vec<u8>,
    dq1: Vec<u8>,
}

impl Rsa {
    fn new(e: Vec<u8>, d: Vec<u8>, n: Vec<u8>, p: Vec<u8>, q: Vec<u8>) -> Result<Self, Error> {
        let key = rsa::RsaPrivateKey::from_components(
            BigUint::from_bytes_be(&n),
            BigUint::from_bytes_be(&e),
            BigUint::from_bytes_be(&d),
            vec![BigUint::from_bytes_be(&p), BigUint::from_bytes_be(&q)],
        )
        .map_err(|e| Error::InternalError(format!("rsa error {e:?}")))?;

        let pq = key
            .qinv()
            .ok_or_else(|| Error::InternalError("pq value missing".into()))?
            .to_biguint()
            .ok_or_else(|| Error::InternalError("conversion to bigunit failed".into()))?
            .to_bytes_be();

        let dp1 = key
            .dp()
            .ok_or_else(|| Error::InternalError("dp1 value missing".into()))?
            .to_bytes_be();

        let dq1 = key
            .dq()
            .ok_or_else(|| Error::InternalError("dq1 value missing".into()))?
            .to_bytes_be();

        Ok(Self {
            e,
            n,
            p,
            q,
            pq,
            dp1,
            dq1,
        })
    }
}

impl RSAKey for Rsa {
    fn e(&self) -> &[u8] {
        self.e.as_ref()
    }

    fn p(&self) -> &[u8] {
        self.p.as_ref()
    }

    fn q(&self) -> &[u8] {
        self.q.as_ref()
    }

    fn pq(&self) -> Box<[u8]> {
        Box::from(self.pq.as_ref())
    }

    fn dp1(&self) -> Box<[u8]> {
        Box::from(self.dp1.as_ref())
    }

    fn dq1(&self) -> Box<[u8]> {
        Box::from(self.dq1.as_ref())
    }

    fn n(&self) -> &[u8] {
        self.n.as_ref()
    }
}

/// ECC-specific data-structure to hold private (sub)key material for upload
/// with the `openpgp-card` crate.
struct Ecc {
    curve: ECCCurve,
    private: Vec<u8>,
    public: Vec<u8>,
    ecc_type: EccType,

    oid: Vec<u8>,
}

impl Ecc {
    fn new(curve: ECCCurve, private: Vec<u8>, public: Vec<u8>, ecc_type: EccType) -> Self {
        let oid = curve.oid();

        Ecc {
            curve,
            private,
            public,
            ecc_type,
            oid,
        }
    }
}

fn pad(mut v: Vec<u8>, len: usize) -> Vec<u8> {
    while v.len() < len {
        v.insert(0, 0)
    }

    v
}

impl EccKey for Ecc {
    fn oid(&self) -> &[u8] {
        &self.oid
    }

    fn private(&self) -> Vec<u8> {
        match self.curve {
            ECCCurve::P256 => pad(self.private.clone(), 0x20),
            ECCCurve::P384 => pad(self.private.clone(), 0x30),
            ECCCurve::P521 => pad(self.private.clone(), 0x42),
            ECCCurve::Curve25519 | ECCCurve::Ed25519 => pad(self.private.clone(), 0x20),
            _ => self.private.clone(),
        }
    }

    fn public(&self) -> Vec<u8> {
        // FIXME: padding?
        self.public.clone()
    }

    fn ecc_type(&self) -> EccType {
        self.ecc_type
    }
}