path: root/src/pluto/pkcs7.c

/* Support of PKCS#7 data structures
 * Copyright (C) 2005 Jan Hutter, Martin Willi
 * Copyright (C) 2002-2005 Andreas Steffen
 * Hochschule fuer Technik Rapperswil, Switzerland
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
 * Free Software Foundation; either version 2 of the License, or (at your
 * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
 *
 * This program is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * RCSID $Id: pkcs7.c 3252 2007-10-06 21:24:50Z andreas $
 */

#include <stdlib.h>
#include <string.h>
#include <libdes/des.h>

#include <freeswan.h>

#include "constants.h"
#include "defs.h"
#include "asn1.h"
#include <asn1/oid.h>
#include "log.h"
#include "x509.h"
#include "certs.h"
#include "pkcs7.h"
#include "rnd.h"

const contentInfo_t empty_contentInfo = {
    OID_UNKNOWN , /* type */
    { NULL, 0 }   /* content */
};

/* ASN.1 definition of the PKCS#7 ContentInfo type */

static const asn1Object_t contentInfoObjects[] = {
  { 0, "contentInfo",			ASN1_SEQUENCE,     ASN1_NONE }, /*  0 */
  { 1,   "contentType",			ASN1_OID,          ASN1_BODY }, /*  1 */
  { 1,   "content",			ASN1_CONTEXT_C_0,  ASN1_OPT |
							   ASN1_BODY }, /*  2 */
  { 1,   "end opt",			ASN1_EOC,	   ASN1_END  }  /*  3 */
};

#define PKCS7_INFO_TYPE		1
#define PKCS7_INFO_CONTENT	2
#define PKCS7_INFO_ROOF		4

/* ASN.1 definition of the PKCS#7 signedData type */

static const asn1Object_t signedDataObjects[] = {
  { 0, "signedData",			  ASN1_SEQUENCE,     ASN1_NONE }, /*  0 */
  { 1,   "version",			  ASN1_INTEGER,      ASN1_BODY }, /*  1 */
  { 1,   "digestAlgorithms",		  ASN1_SET,          ASN1_LOOP }, /*  2 */
  { 2,     "algorithm",			  ASN1_EOC,          ASN1_RAW  }, /*  3 */
  { 1,   "end loop",			  ASN1_EOC,          ASN1_END  }, /*  4 */
  { 1,   "contentInfo",			  ASN1_EOC,          ASN1_RAW  }, /*  5 */
  { 1,   "certificates",		  ASN1_CONTEXT_C_0,  ASN1_OPT |
							     ASN1_LOOP }, /*  6 */
  { 2,      "certificate",		  ASN1_SEQUENCE,     ASN1_OBJ  }, /*  7 */
  { 1,   "end opt or loop",		  ASN1_EOC,	     ASN1_END  }, /*  8 */
  { 1,   "crls",			  ASN1_CONTEXT_C_1,  ASN1_OPT |
							     ASN1_LOOP }, /*  9 */
  { 2,	    "crl",			  ASN1_SEQUENCE,     ASN1_OBJ  }, /* 10 */
  { 1,   "end opt or loop",		  ASN1_EOC,	     ASN1_END  }, /* 11 */
  { 1,   "signerInfos",			  ASN1_SET,	     ASN1_LOOP }, /* 12 */
  { 2,     "signerInfo",		  ASN1_SEQUENCE,     ASN1_NONE }, /* 13 */
  { 3,       "version",			  ASN1_INTEGER,	     ASN1_BODY }, /* 14 */
  { 3,       "issuerAndSerialNumber",	  ASN1_SEQUENCE,     ASN1_BODY }, /* 15 */
  { 4,         "issuer",	          ASN1_SEQUENCE,     ASN1_OBJ  }, /* 16 */
  { 4,         "serial",	          ASN1_INTEGER,	     ASN1_BODY }, /* 17 */
  { 3,       "digestAlgorithm",		  ASN1_EOC,	     ASN1_RAW  }, /* 18 */
  { 3,       "authenticatedAttributes",	  ASN1_CONTEXT_C_0,  ASN1_OPT |
							     ASN1_OBJ  }, /* 19 */
  { 3,       "end opt",			  ASN1_EOC,	     ASN1_END  }, /* 20 */
  { 3,       "digestEncryptionAlgorithm", ASN1_EOC,	     ASN1_RAW  }, /* 21 */
  { 3,       "encryptedDigest",		  ASN1_OCTET_STRING, ASN1_BODY }, /* 22 */
  { 3,       "unauthenticatedAttributes", ASN1_CONTEXT_C_1,  ASN1_OPT  }, /* 23 */
  { 3,       "end opt",			  ASN1_EOC,	     ASN1_END  }, /* 24 */
  { 1,   "end loop",			  ASN1_EOC,	     ASN1_END  }  /* 25 */
};

#define PKCS7_DIGEST_ALG	 	 3
#define PKCS7_SIGNED_CONTENT_INFO	 5
#define PKCS7_SIGNED_CERT	 	 7
#define PKCS7_SIGNER_INFO		13
#define PKCS7_SIGNED_ISSUER		16
#define PKCS7_SIGNED_SERIAL_NUMBER	17
#define PKCS7_DIGEST_ALGORITHM		18
#define PKCS7_AUTH_ATTRIBUTES		19
#define PKCS7_DIGEST_ENC_ALGORITHM	21
#define PKCS7_ENCRYPTED_DIGEST		22
#define PKCS7_SIGNED_ROOF		26

/* ASN.1 definition of the PKCS#7 envelopedData type */

static const asn1Object_t envelopedDataObjects[] = {
  { 0, "envelopedData",				ASN1_SEQUENCE,		ASN1_NONE }, /*  0 */
  { 1,   "version",				ASN1_INTEGER, 		ASN1_BODY }, /*  1 */
  { 1,   "recipientInfos",			ASN1_SET,    		ASN1_LOOP }, /*  2 */
  { 2,     "recipientInfo",			ASN1_SEQUENCE, 		ASN1_BODY }, /*  3 */
  { 3,       "version",				ASN1_INTEGER, 		ASN1_BODY }, /*  4 */
  { 3,       "issuerAndSerialNumber",	        ASN1_SEQUENCE,		ASN1_BODY }, /*  5 */
  { 4,         "issuer",	        	ASN1_SEQUENCE,		ASN1_OBJ  }, /*  6 */
  { 4,         "serial",	        	ASN1_INTEGER,		ASN1_BODY }, /*  7 */
  { 3,       "encryptionAlgorithm",	       	ASN1_EOC,		ASN1_RAW  }, /*  8 */
  { 3,       "encryptedKey",		       	ASN1_OCTET_STRING,	ASN1_BODY }, /*  9 */
  { 1,   "end loop",				ASN1_EOC,		ASN1_END  }, /* 10 */
  { 1,   "encryptedContentInfo",		ASN1_SEQUENCE,		ASN1_OBJ  }, /* 11 */
  { 2,     "contentType",			ASN1_OID,		ASN1_BODY }, /* 12 */
  { 2,     "contentEncryptionAlgorithm",	ASN1_EOC,		ASN1_RAW  }, /* 13 */
  { 2,     "encryptedContent",			ASN1_CONTEXT_S_0, 	ASN1_BODY }  /* 14 */
};

#define PKCS7_ENVELOPED_VERSION		 1
#define PKCS7_RECIPIENT_INFO_VERSION	 4
#define PKCS7_ISSUER			 6
#define PKCS7_SERIAL_NUMBER		 7
#define PKCS7_ENCRYPTION_ALG		 8
#define PKCS7_ENCRYPTED_KEY		 9
#define PKCS7_CONTENT_TYPE		12
#define PKCS7_CONTENT_ENC_ALGORITHM	13
#define PKCS7_ENCRYPTED_CONTENT		14
#define PKCS7_ENVELOPED_ROOF		15

/* PKCS7 contentInfo OIDs */

static u_char ASN1_pkcs7_data_oid_str[] = {
    0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x07, 0x01
};

static u_char ASN1_pkcs7_signed_data_oid_str[] = {
    0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x07, 0x02
};

static u_char ASN1_pkcs7_enveloped_data_oid_str[] = {
    0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x07, 0x03
};

static u_char ASN1_pkcs7_signed_enveloped_data_oid_str[] = {
    0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x07, 0x04
};

static u_char ASN1_pkcs7_digested_data_oid_str[] = {
    0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x07, 0x05
};

static char ASN1_pkcs7_encrypted_data_oid_str[] = {
    0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x07, 0x06
};

static const chunk_t ASN1_pkcs7_data_oid = 
			strchunk(ASN1_pkcs7_data_oid_str);
static const chunk_t ASN1_pkcs7_signed_data_oid =
			strchunk(ASN1_pkcs7_signed_data_oid_str);
static const chunk_t ASN1_pkcs7_enveloped_data_oid =
			strchunk(ASN1_pkcs7_enveloped_data_oid_str);
static const chunk_t ASN1_pkcs7_signed_enveloped_data_oid = 
			strchunk(ASN1_pkcs7_signed_enveloped_data_oid_str);
static const chunk_t ASN1_pkcs7_digested_data_oid =
			strchunk(ASN1_pkcs7_digested_data_oid_str);
static const chunk_t ASN1_pkcs7_encrypted_data_oid =
			strchunk(ASN1_pkcs7_encrypted_data_oid_str);

/* 3DES and DES encryption OIDs */

static u_char ASN1_3des_ede_cbc_oid_str[] = {
    0x06, 0x08, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x03, 0x07
};

static u_char ASN1_des_cbc_oid_str[] = {
    0x06, 0x05, 0x2B, 0x0E, 0x03, 0x02, 0x07
};

static const chunk_t ASN1_3des_ede_cbc_oid = 
			strchunk(ASN1_3des_ede_cbc_oid_str);
static const chunk_t ASN1_des_cbc_oid =
			strchunk(ASN1_des_cbc_oid_str);

/* PKCS#7 attribute type OIDs */

static u_char ASN1_contentType_oid_str[] = {
    0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x09, 0x03
};

static u_char ASN1_messageDigest_oid_str[] = {
    0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x09, 0x04
};

static const chunk_t ASN1_contentType_oid =
			strchunk(ASN1_contentType_oid_str);
static const chunk_t ASN1_messageDigest_oid =
			strchunk(ASN1_messageDigest_oid_str);

/*
 * Parse PKCS#7 ContentInfo object
 */
bool
pkcs7_parse_contentInfo(chunk_t blob, u_int level0, contentInfo_t *cInfo)
{
    asn1_ctx_t ctx;
    chunk_t object;
    u_int level;
    int objectID = 0;

    asn1_init(&ctx, blob, level0, FALSE, DBG_RAW);

    while (objectID < PKCS7_INFO_ROOF)
    {
	if (!extract_object(contentInfoObjects, &objectID, &object, &level, &ctx))
	     return FALSE;

	if (objectID == PKCS7_INFO_TYPE)
	{
	    cInfo->type = known_oid(object);
	    if (cInfo->type < OID_PKCS7_DATA
	    ||  cInfo->type > OID_PKCS7_ENCRYPTED_DATA)
	    {
		plog("unknown pkcs7 content type");
		return FALSE;
	    }
	}
	else if (objectID == PKCS7_INFO_CONTENT)
	{
	    cInfo->content = object;
	}
	objectID++;
    }
    return TRUE;
}

/*
 * Parse a PKCS#7 signedData object
 */
bool
pkcs7_parse_signedData(chunk_t blob, contentInfo_t *data, x509cert_t **cert
, chunk_t *attributes, const x509cert_t *cacert)
{
    u_char buf[BUF_LEN];
    asn1_ctx_t ctx;
    chunk_t object;
    u_int level;
    int digest_alg = OID_UNKNOWN;
    int enc_alg    = OID_UNKNOWN;
    int signerInfos = 0;
    int objectID = 0;

    contentInfo_t cInfo = empty_contentInfo;
    chunk_t encrypted_digest = empty_chunk;

    if (!pkcs7_parse_contentInfo(blob, 0, &cInfo))
	return FALSE;

    if (cInfo.type != OID_PKCS7_SIGNED_DATA)
    {
	plog("pkcs7 content type is not signedData");
	return FALSE;
    }

    asn1_init(&ctx, cInfo.content, 2, FALSE, DBG_RAW);

    while (objectID < PKCS7_SIGNED_ROOF)
   {
	if (!extract_object(signedDataObjects, &objectID, &object, &level, &ctx))
	     return FALSE;

	switch (objectID)
	{
	case PKCS7_DIGEST_ALG:
	    digest_alg = parse_algorithmIdentifier(object, level, NULL);
	    break;
	case PKCS7_SIGNED_CONTENT_INFO:
	    if (data != NULL)
	    {
		pkcs7_parse_contentInfo(object, level, data);
	    }
	    break;
	case PKCS7_SIGNED_CERT:
	    if (cert != NULL)
	    {
		chunk_t cert_blob;

		x509cert_t *newcert = alloc_thing(x509cert_t
					, "pkcs7 wrapped x509cert");

		clonetochunk(cert_blob, object.ptr, object.len
			    , "pkcs7 cert blob");
		*newcert = empty_x509cert;

		DBG(DBG_CONTROL | DBG_PARSING,
		    DBG_log("parsing pkcs7-wrapped certificate")
		)
		if (parse_x509cert(cert_blob, level+1, newcert))
		{
		    newcert->next = *cert;
		    *cert = newcert;
		}
	        else
		{
		    free_x509cert(newcert);
	    	}
	    }
	    break;
	case PKCS7_SIGNER_INFO:
	    signerInfos++;
	    DBG(DBG_PARSING,
		DBG_log("  signer #%d", signerInfos)
	    )
	    break;	
	case PKCS7_SIGNED_ISSUER:
	    DBG(DBG_PARSING,
		dntoa(buf, BUF_LEN, object);
		DBG_log("  '%s'",buf)
	    )
	    break;
	case PKCS7_AUTH_ATTRIBUTES:
	    if (attributes != NULL)
	    {
		*attributes = object;
		*attributes->ptr = ASN1_SET;
	    }
	    break;
	case PKCS7_DIGEST_ALGORITHM:
	    digest_alg = parse_algorithmIdentifier(object, level, NULL);
	    break;
	case PKCS7_DIGEST_ENC_ALGORITHM:
	    enc_alg = parse_algorithmIdentifier(object, level, NULL);
	    break;
	case PKCS7_ENCRYPTED_DIGEST:
	    encrypted_digest = object;
	}
	objectID++;
    }

    /* check the signature only if a cacert is available */
    if (cacert != NULL)
    {
	if (signerInfos == 0)
	{
	    plog("no signerInfo object found");
	    return FALSE;
	}
	else if (signerInfos > 1)
	{
	    plog("more than one signerInfo object found");
	    return FALSE;
	}
	if (attributes->ptr == NULL)
	{
	    plog("no authenticatedAttributes object found");
	    return FALSE;
	}
	if (!check_signature(*attributes, encrypted_digest, digest_alg
	   , enc_alg, cacert))
	{
	    plog("invalid signature");
	    return FALSE;
	}
	else
	{
	    DBG(DBG_CONTROL,
		DBG_log("signature is valid")
	    )
	}
    }
    return TRUE;
}

/*
 * Parse a PKCS#7 envelopedData object
 */
bool
pkcs7_parse_envelopedData(chunk_t blob, chunk_t *data
, chunk_t serialNumber, const RSA_private_key_t *key)
{
    asn1_ctx_t ctx;
    chunk_t object;
    chunk_t iv                = empty_chunk;
    chunk_t symmetric_key     = empty_chunk;
    chunk_t encrypted_content = empty_chunk;

    u_char buf[BUF_LEN];
    u_int level;
    u_int total_keys = 3;
    int enc_alg         = OID_UNKNOWN;
    int content_enc_alg = OID_UNKNOWN;
    int objectID = 0;

    contentInfo_t cInfo = empty_contentInfo;
    *data = empty_chunk;

    if (!pkcs7_parse_contentInfo(blob, 0, &cInfo))
	goto failed;

    if (cInfo.type != OID_PKCS7_ENVELOPED_DATA)
    {
	plog("pkcs7 content type is not envelopedData");
	return FALSE;
    }

    asn1_init(&ctx, cInfo.content, 2, FALSE, DBG_RAW);

    while (objectID < PKCS7_ENVELOPED_ROOF)
    {
	if (!extract_object(envelopedDataObjects, &objectID, &object, &level, &ctx))
	     goto failed;

	switch (objectID)
	{
	case PKCS7_ENVELOPED_VERSION:
	if (*object.ptr != 0)
	{
	    plog("envelopedData version is not 0");
	    goto failed;
	}
	break;
	case PKCS7_RECIPIENT_INFO_VERSION:
	    if (*object.ptr != 0)
	    {
		plog("recipient info version is not 0");
		goto failed;
	    }
	    break;
	case PKCS7_ISSUER:
	    DBG(DBG_PARSING,
		dntoa(buf, BUF_LEN, object);
		DBG_log("  '%s'", buf)
	    )
	    break;	
	case PKCS7_SERIAL_NUMBER:
	    if (!same_chunk(serialNumber, object))
	    {
		plog("serial numbers do not match");
		goto failed;
	    }	
	    break;	
	case PKCS7_ENCRYPTION_ALG:
	    enc_alg = parse_algorithmIdentifier(object, level, NULL);
	    if (enc_alg != OID_RSA_ENCRYPTION)
	    {
		plog("only rsa encryption supported");
		goto failed;
	    } 
	    break;
	case PKCS7_ENCRYPTED_KEY:
	    if (!RSA_decrypt(key, object, &symmetric_key))
	    {
		plog("symmetric key could not be decrypted with rsa");
		goto failed;
	    }
	    DBG(DBG_PRIVATE,
		DBG_dump_chunk("symmetric key :", symmetric_key)
	    )
	    break;
	case PKCS7_CONTENT_TYPE:
	    if (known_oid(object) != OID_PKCS7_DATA)
	    {
		 plog("encrypted content not of type pkcs7 data");
		 goto failed;
	    }
	    break;
	case PKCS7_CONTENT_ENC_ALGORITHM:
	    content_enc_alg = parse_algorithmIdentifier(object, level, &iv);

	    switch (content_enc_alg)
	    {
	    case OID_DES_CBC:
		total_keys = 1;
		break;
	    case OID_3DES_EDE_CBC:
		total_keys = 3;
		break;
	    default:
		plog("Only DES and 3DES supported for symmetric encryption");
		goto failed;
	    }
	    if (symmetric_key.len != (total_keys * DES_CBC_BLOCK_SIZE))
	    {
		plog("key length is not %d",(total_keys * DES_CBC_BLOCK_SIZE));
		goto failed;
	    }
	    if (!parse_asn1_simple_object(&iv, ASN1_OCTET_STRING, level+1, "IV"))
	    {
		plog("IV could not be parsed");
		goto failed;
	    }
	    if (iv.len != DES_CBC_BLOCK_SIZE)
	    {
		plog("IV has wrong length");
		goto failed;
	    }
	    break;
	case PKCS7_ENCRYPTED_CONTENT:
	    encrypted_content = object;
	    break;
	}
	objectID++;
    }

    /* decrypt the content */
    {
	u_int i;
	des_cblock des_key[3], des_iv;
	des_key_schedule key_s[3];

	memcpy((char *)des_key, symmetric_key.ptr, symmetric_key.len);
	memcpy((char *)des_iv, iv.ptr, iv.len);

	for (i = 0; i < total_keys; i++)
	{
	    if (des_set_key(&des_key[i], key_s[i]))
	    {
		plog("des key schedule failed");
		goto failed;
	    }
	}

	data->len = encrypted_content.len;
	data->ptr = alloc_bytes(data->len, "decrypted data");

	switch (content_enc_alg)
	{
	case OID_DES_CBC:
	    des_cbc_encrypt((des_cblock*)encrypted_content.ptr
			  , (des_cblock*)data->ptr, data->len
			  , key_s[0], &des_iv, DES_DECRYPT);
	    break;
	case OID_3DES_EDE_CBC:
	    des_ede3_cbc_encrypt( (des_cblock*)encrypted_content.ptr
				, (des_cblock*)data->ptr, data->len
				, key_s[0], key_s[1], key_s[2]
				, &des_iv, DES_DECRYPT);
	}
	DBG(DBG_PRIVATE,
	    DBG_dump_chunk("decrypted content with padding:\n", *data)
	)
    }
 
    /* remove the padding */
    {
	u_char *pos = data->ptr + data->len - 1;
	u_char pattern = *pos;
	size_t padding = pattern;

	if (padding > data->len)
	{
	    plog("padding greater than data length");
	    goto failed;
	}
	data->len -= padding;

	while (padding-- > 0)
	{
	    if (*pos-- != pattern)
	    {
		plog("wrong padding pattern");
		goto failed;
	    }
	}
    }
    freeanychunk(symmetric_key);
    return TRUE;

failed:
    freeanychunk(symmetric_key);
    pfreeany(data->ptr);
    return FALSE;
}

/**
 * @brief Builds a contentType attribute
 *
 * @return ASN.1 encoded contentType attribute
 */
chunk_t
pkcs7_contentType_attribute(void)
{
    return asn1_wrap(ASN1_SEQUENCE, "cm"
		, ASN1_contentType_oid
		, asn1_simple_object(ASN1_SET, ASN1_pkcs7_data_oid));
}

/**
 * @brief Builds a messageDigest attribute
 * 
 * 
 * @param[in] blob content to create digest of
 * @param[in] digest_alg digest algorithm to be used
 * @return ASN.1 encoded messageDigest attribute
 * 
 */
chunk_t
pkcs7_messageDigest_attribute(chunk_t content, int digest_alg)
{
    u_char digest_buf[MAX_DIGEST_LEN];
    chunk_t digest = { digest_buf, MAX_DIGEST_LEN };

    compute_digest(content, digest_alg, &digest);

    return asn1_wrap(ASN1_SEQUENCE, "cm"
		, ASN1_messageDigest_oid
		, asn1_wrap(ASN1_SET, "m"
		    , asn1_simple_object(ASN1_OCTET_STRING, digest)
		  )
	   );
}
/*
 * build a DER-encoded contentInfo object
 */
static chunk_t
pkcs7_build_contentInfo(contentInfo_t *cInfo)
{
    chunk_t content_type;

    /* select DER-encoded OID for pkcs7 contentInfo type */
    switch(cInfo->type)
    {
    case OID_PKCS7_DATA:
	content_type = ASN1_pkcs7_data_oid;
	break;
    case OID_PKCS7_SIGNED_DATA:
	content_type = ASN1_pkcs7_signed_data_oid;
	break;
    case OID_PKCS7_ENVELOPED_DATA:
	content_type = ASN1_pkcs7_enveloped_data_oid;
	break;
    case OID_PKCS7_SIGNED_ENVELOPED_DATA:
	content_type = ASN1_pkcs7_signed_enveloped_data_oid;
	break;
    case OID_PKCS7_DIGESTED_DATA:
	content_type = ASN1_pkcs7_digested_data_oid;
	break;
    case OID_PKCS7_ENCRYPTED_DATA:
	content_type = ASN1_pkcs7_encrypted_data_oid;
	break;
    case OID_UNKNOWN:
    default:
	fprintf(stderr, "invalid pkcs7 contentInfo type");
	return empty_chunk;
    }

    return (cInfo->content.ptr == NULL)
	? asn1_simple_object(ASN1_SEQUENCE, content_type)
	: asn1_wrap(ASN1_SEQUENCE, "cm"
	    , content_type
	    , asn1_simple_object(ASN1_CONTEXT_C_0, cInfo->content)
          );
}

/*
 * build issuerAndSerialNumber object
 */
chunk_t
pkcs7_build_issuerAndSerialNumber(const x509cert_t *cert)
{
    return asn1_wrap(ASN1_SEQUENCE, "cm"
		, cert->issuer
		, asn1_simple_object(ASN1_INTEGER, cert->serialNumber));
}

/*
 * create a signed pkcs7 contentInfo object
 */
chunk_t
pkcs7_build_signedData(chunk_t data, chunk_t attributes, const x509cert_t *cert
, int digest_alg, const RSA_private_key_t *key)
{
    contentInfo_t pkcs7Data, signedData;
    chunk_t authenticatedAttributes, encryptedDigest, signerInfo, cInfo;

    chunk_t digestAlgorithm = asn1_algorithmIdentifier(digest_alg);

    if (attributes.ptr != NULL)
    {
	encryptedDigest = pkcs1_build_signature(attributes, digest_alg
				, key, FALSE);
	clonetochunk(authenticatedAttributes, attributes.ptr, attributes.len
	    , "authenticatedAttributes");
	*authenticatedAttributes.ptr = ASN1_CONTEXT_C_0;
    }
    else
    {
	encryptedDigest = (data.ptr == NULL)? empty_chunk
		: pkcs1_build_signature(data, digest_alg, key, FALSE);
	authenticatedAttributes = empty_chunk;
    }

    signerInfo = asn1_wrap(ASN1_SEQUENCE, "cmcmcm"
		, ASN1_INTEGER_1
		, pkcs7_build_issuerAndSerialNumber(cert)
		, digestAlgorithm
		, authenticatedAttributes
		, ASN1_rsaEncryption_id
		, encryptedDigest);

    pkcs7Data.type    = OID_PKCS7_DATA;
    pkcs7Data.content = (data.ptr == NULL)? empty_chunk
		: asn1_simple_object(ASN1_OCTET_STRING, data);

    signedData.type = OID_PKCS7_SIGNED_DATA;
    signedData.content = asn1_wrap(ASN1_SEQUENCE, "cmmmm"
		, ASN1_INTEGER_1
		, asn1_simple_object(ASN1_SET, digestAlgorithm)
		, pkcs7_build_contentInfo(&pkcs7Data)
		, asn1_simple_object(ASN1_CONTEXT_C_0, cert->certificate)
		, asn1_wrap(ASN1_SET, "m", signerInfo));

    cInfo = pkcs7_build_contentInfo(&signedData);
    DBG(DBG_RAW,
	DBG_dump_chunk("signedData:\n", cInfo)
    )

    freeanychunk(pkcs7Data.content);
    freeanychunk(signedData.content);
    return cInfo;
}

/*
 * create a symmetrically encrypted pkcs7 contentInfo object
 */
chunk_t
pkcs7_build_envelopedData(chunk_t data, const x509cert_t *cert, int cipher)
{
    bool des_check_key_save;
    des_key_schedule ks[3];
    des_cblock key[3], des_iv, des_iv_buf;

    chunk_t iv = { (u_char *)des_iv_buf, DES_CBC_BLOCK_SIZE };
    chunk_t out;
    chunk_t cipher_oid;

    u_int total_keys, i;
    size_t padding = pad_up(data.len, DES_CBC_BLOCK_SIZE);

    RSA_public_key_t public_key;

    init_RSA_public_key(&public_key, cert->publicExponent
				   , cert->modulus);

    if (padding == 0)
	padding += DES_CBC_BLOCK_SIZE;

    out.len = data.len + padding;
    out.ptr = alloc_bytes(out.len, "DES-encrypted output");

    DBG(DBG_CONTROL,
	DBG_log("padding %d bytes of data to multiple DES block size of %d bytes"
		, (int)data.len, (int)out.len)
    )

    /* copy data */
    memcpy(out.ptr, data.ptr, data.len);
    /* append padding */
    memset(out.ptr + data.len, padding, padding);

    DBG(DBG_RAW,
	DBG_dump_chunk("Padded unencrypted data:\n", out)
    )

    /* select OID and keylength for specified cipher */
    switch (cipher)
    {
    case OID_DES_CBC:
	 total_keys = 1;
	 cipher_oid = ASN1_des_cbc_oid;
	 break;
    case OID_3DES_EDE_CBC:
    default:
	total_keys = 3;
	cipher_oid = ASN1_3des_ede_cbc_oid;
    }
    DBG(DBG_CONTROLMORE,
	DBG_log("pkcs7 encryption cipher: %s", oid_names[cipher].name)
    )

    /* generate a strong random key for DES/3DES */
    des_check_key_save = des_check_key;
    des_check_key = TRUE;
    for (i = 0; i < total_keys;i++)
    {
	for (;;)
	{
	    get_rnd_bytes((char*)key[i], DES_CBC_BLOCK_SIZE);
	    des_set_odd_parity(&key[i]);
	    if (!des_set_key(&key[i], ks[i]))
		break;
	    plog("weak DES key discarded - we try again");
	}
	DBG(DBG_PRIVATE,
	    DBG_dump("DES key:", key[i], 8)
	)
    }
    des_check_key = des_check_key_save;

    /* generate an iv for DES/3DES CBC */
    get_rnd_bytes(des_iv, DES_CBC_BLOCK_SIZE);
    memcpy(iv.ptr, des_iv, DES_CBC_BLOCK_SIZE);
    DBG(DBG_RAW,
	DBG_dump_chunk("DES IV :", iv)
    )

    /* encryption using specified cipher */
    switch (cipher)
    {
    case OID_DES_CBC:
	des_cbc_encrypt((des_cblock*)out.ptr, (des_cblock*)out.ptr, out.len
		       , ks[0], &des_iv, DES_ENCRYPT);
	break;
    case OID_3DES_EDE_CBC:
    default:
	des_ede3_cbc_encrypt((des_cblock*)out.ptr, (des_cblock*)out.ptr, out.len
			    , ks[0], ks[1], ks[2], &des_iv, DES_ENCRYPT);	
    }
    DBG(DBG_RAW,
	DBG_dump_chunk("Encrypted data:\n", out));
	
    /* build pkcs7 enveloped data object */ 
    {
	chunk_t contentEncryptionAlgorithm = asn1_wrap(ASN1_SEQUENCE, "cm"
		    , cipher_oid
		    , asn1_simple_object(ASN1_OCTET_STRING, iv));
	
	chunk_t encryptedContentInfo = asn1_wrap(ASN1_SEQUENCE, "cmm"
		    , ASN1_pkcs7_data_oid
		    , contentEncryptionAlgorithm
		    , asn1_wrap(ASN1_CONTEXT_S_0, "m", out));

        chunk_t plainKey = { (u_char *)key, DES_CBC_BLOCK_SIZE * total_keys };

	chunk_t encryptedKey = asn1_wrap(ASN1_OCTET_STRING, "m"
		    , RSA_encrypt(&public_key, plainKey));

	chunk_t recipientInfo = asn1_wrap(ASN1_SEQUENCE, "cmcm"
		    , ASN1_INTEGER_0
		    , pkcs7_build_issuerAndSerialNumber(cert)
		    , ASN1_rsaEncryption_id
		    , encryptedKey);

        chunk_t cInfo;
	contentInfo_t envelopedData;

        envelopedData.type = OID_PKCS7_ENVELOPED_DATA;
	envelopedData.content = asn1_wrap(ASN1_SEQUENCE, "cmm"
		    , ASN1_INTEGER_0
		    , asn1_wrap(ASN1_SET, "m", recipientInfo)
		    , encryptedContentInfo);

	cInfo = pkcs7_build_contentInfo(&envelopedData);
	DBG(DBG_RAW,
	    DBG_dump_chunk("envelopedData:\n", cInfo)
	)

	free_RSA_public_content(&public_key);
	freeanychunk(envelopedData.content);
	return cInfo;
    }
}