1// Copyright (c) 2009-present The Bitcoin Core developers
2// Distributed under the MIT software license, see the accompanying
3// file COPYING or http://www.opensource.org/licenses/mit-license.php.
4
5#include <wallet/crypter.h>
6
7#include <common/system.h>
8#include <crypto/aes.h>
9#include <crypto/sha512.h>
10
11#include <type_traits>
12#include <vector>
13
14namespace wallet {
15int CCrypter::BytesToKeySHA512AES(const std::span<const unsigned char> salt, const SecureString& key_data, unsigned int count, unsigned char* key, unsigned char* iv) const
16{
17    // This mimics the behavior of openssl's EVP_BytesToKey with an aes256cbc
18    // cipher and sha512 message digest. Because sha512's output size (64b) is
19    // greater than the aes256 block size (16b) + aes256 key size (32b),
20    // there's no need to process more than once (D_0).
21
22    if(!count || !key || !iv)
23        return 0;
24
25    unsigned char buf[CSHA512::OUTPUT_SIZE];
26    CSHA512 di;
27
28    di.Write(UCharCast(key_data.data()), key_data.size());
29    di.Write(salt.data(), salt.size());
30    di.Finalize(buf);
31
32    for (unsigned int i = 0; i != count - 1; ++i)
33        di.Reset().Write(buf, sizeof(buf)).Finalize(buf);
34
35    memcpy(key, buf, WALLET_CRYPTO_KEY_SIZE);
36    memcpy(iv, buf + WALLET_CRYPTO_KEY_SIZE, WALLET_CRYPTO_IV_SIZE);
37    memory_cleanse(buf, sizeof(buf));
38    return WALLET_CRYPTO_KEY_SIZE;
39}
40
41bool CCrypter::SetKeyFromPassphrase(const SecureString& key_data, const std::span<const unsigned char> salt, const unsigned int rounds, const unsigned int derivation_method)
42{
43    if (!rounds || salt.size() != WALLET_CRYPTO_SALT_SIZE) {
44        return false;
45    }
46
47    int i = 0;
48    if (derivation_method == 0) {
49        i = BytesToKeySHA512AES(salt, key_data, rounds, vchKey.data(), vchIV.data());
50    }
51
52    if (i != (int)WALLET_CRYPTO_KEY_SIZE)
53    {
54        memory_cleanse(vchKey.data(), vchKey.size());
55        memory_cleanse(vchIV.data(), vchIV.size());
56        return false;
57    }
58
59    fKeySet = true;
60    return true;
61}
62
63bool CCrypter::SetKey(const CKeyingMaterial& new_key, const std::span<const unsigned char> new_iv)
64{
65    if (new_key.size() != WALLET_CRYPTO_KEY_SIZE || new_iv.size() != WALLET_CRYPTO_IV_SIZE) {
66        return false;
67    }
68
69    memcpy(vchKey.data(), new_key.data(), new_key.size());
70    memcpy(vchIV.data(), new_iv.data(), new_iv.size());
71
72    fKeySet = true;
73    return true;
74}
75
76bool CCrypter::Encrypt(const CKeyingMaterial& vchPlaintext, std::vector<unsigned char> &vchCiphertext) const
77{
78    if (!fKeySet)
79        return false;
80
81    // max ciphertext len for a n bytes of plaintext is
82    // n + AES_BLOCKSIZE bytes
83    vchCiphertext.resize(vchPlaintext.size() + AES_BLOCKSIZE);
84
85    AES256CBCEncrypt enc(vchKey.data(), vchIV.data(), true);
86    size_t nLen = enc.Encrypt(vchPlaintext.data(), vchPlaintext.size(), vchCiphertext.data());
87    if(nLen < vchPlaintext.size())
88        return false;
89    vchCiphertext.resize(nLen);
90
91    return true;
92}
93
94bool CCrypter::Decrypt(const std::span<const unsigned char> ciphertext, CKeyingMaterial& plaintext) const
95{
96    if (!fKeySet)
97        return false;
98
99    // plaintext will always be equal to or lesser than length of ciphertext
100    plaintext.resize(ciphertext.size());
101
102    AES256CBCDecrypt dec(vchKey.data(), vchIV.data(), true);
103    int len = dec.Decrypt(ciphertext.data(), ciphertext.size(), plaintext.data());
104    if (len == 0) {
105        return false;
106    }
107    plaintext.resize(len);
108    return true;
109}
110
111bool EncryptSecret(const CKeyingMaterial& vMasterKey, const CKeyingMaterial &vchPlaintext, const uint256& nIV, std::vector<unsigned char> &vchCiphertext)
112{
113    CCrypter cKeyCrypter;
114    std::vector<unsigned char> chIV(WALLET_CRYPTO_IV_SIZE);
115    memcpy(chIV.data(), &nIV, WALLET_CRYPTO_IV_SIZE);
116    if(!cKeyCrypter.SetKey(vMasterKey, chIV))
117        return false;
118    return cKeyCrypter.Encrypt(vchPlaintext, vchCiphertext);
119}
120
121bool DecryptSecret(const CKeyingMaterial& master_key, const std::span<const unsigned char> ciphertext, const uint256& iv, CKeyingMaterial& plaintext)
122{
123    CCrypter key_crypter;
124    static_assert(WALLET_CRYPTO_IV_SIZE <= std::remove_reference_t<decltype(iv)>::size());
125    const std::span iv_prefix{iv.data(), WALLET_CRYPTO_IV_SIZE};
126    if (!key_crypter.SetKey(master_key, iv_prefix)) {
127        return false;
128    }
129    return key_crypter.Decrypt(ciphertext, plaintext);
130}
131
132bool DecryptKey(const CKeyingMaterial& master_key, const std::span<const unsigned char> crypted_secret, const CPubKey& pub_key, CKey& key)
133{
134    CKeyingMaterial secret;
135    if (!DecryptSecret(master_key, crypted_secret, pub_key.GetHash(), secret)) {
136        return false;
137    }
138
139    if (secret.size() != 32) {
140        return false;
141    }
142
143    key.Set(secret.begin(), secret.end(), pub_key.IsCompressed());
144    return key.VerifyPubKey(pub_key);
145}
146} // namespace wallet
147