Harden PKIX path validation and support trusted certificate PEM blocks

CryptoLib.Benchmark/Delphi/CryptoLib.BenchmarkConsole.dpr

@@ -708,6 +708,10 @@ uses
   ClpOpenSslPemWriter in '..\..\CryptoLib\src\OpenSsl\ClpOpenSslPemWriter.pas',
   ClpIOpenSslPemWriter in '..\..\CryptoLib\src\Interfaces\OpenSsl\ClpIOpenSslPemWriter.pas',
   ClpOpenSslPemReader in '..\..\CryptoLib\src\OpenSsl\ClpOpenSslPemReader.pas',
+  ClpICertificateTrustBlock in '..\..\CryptoLib\src\Interfaces\OpenSsl\ClpICertificateTrustBlock.pas',
+  ClpIX509TrustedCertificateBlock in '..\..\CryptoLib\src\Interfaces\OpenSsl\ClpIX509TrustedCertificateBlock.pas',
+  ClpCertificateTrustBlock in '..\..\CryptoLib\src\OpenSsl\ClpCertificateTrustBlock.pas',
+  ClpX509TrustedCertificateBlock in '..\..\CryptoLib\src\OpenSsl\ClpX509TrustedCertificateBlock.pas',
   ClpIOpenSslPemReader in '..\..\CryptoLib\src\Interfaces\OpenSsl\ClpIOpenSslPemReader.pas',
   ClpIPemParser in '..\..\CryptoLib\src\Interfaces\Pem\ClpIPemParser.pas',
   ClpIPemReader in '..\..\CryptoLib\src\Interfaces\Pem\ClpIPemReader.pas',

CryptoLib.Examples/Delphi.Examples/CryptoLib.Examples.dpr

@@ -725,6 +725,10 @@ uses
   ClpOpenSslPemWriter in '..\..\CryptoLib\src\OpenSsl\ClpOpenSslPemWriter.pas',
   ClpIOpenSslPemWriter in '..\..\CryptoLib\src\Interfaces\OpenSsl\ClpIOpenSslPemWriter.pas',
   ClpOpenSslPemReader in '..\..\CryptoLib\src\OpenSsl\ClpOpenSslPemReader.pas',
+  ClpICertificateTrustBlock in '..\..\CryptoLib\src\Interfaces\OpenSsl\ClpICertificateTrustBlock.pas',
+  ClpIX509TrustedCertificateBlock in '..\..\CryptoLib\src\Interfaces\OpenSsl\ClpIX509TrustedCertificateBlock.pas',
+  ClpCertificateTrustBlock in '..\..\CryptoLib\src\OpenSsl\ClpCertificateTrustBlock.pas',
+  ClpX509TrustedCertificateBlock in '..\..\CryptoLib\src\OpenSsl\ClpX509TrustedCertificateBlock.pas',
   ClpIOpenSslPemReader in '..\..\CryptoLib\src\Interfaces\OpenSsl\ClpIOpenSslPemReader.pas',
   ClpIPemParser in '..\..\CryptoLib\src\Interfaces\Pem\ClpIPemParser.pas',
   ClpIPemReader in '..\..\CryptoLib\src\Interfaces\Pem\ClpIPemReader.pas',

CryptoLib.Tests/Data/OpenSsl/Reader/Keys/EddsaUnencrypted.pem

@@ -0,0 +1,3 @@
+-----BEGIN PRIVATE KEY-----
+MC4CAQAwBQYDK2VwBCIEIErU1sdUkfufFIiIjeyB6XCqEKR4dFtTYejBjH/jeM4O
+-----END PRIVATE KEY-----

CryptoLib.Tests/Data/OpenSsl/Reader/Manifest.csv

@@ -39,3 +39,4 @@ RsaBlowfishEcb,OpenSsl/Reader/Keys/RsaBlowfishEcb.pem,changeit,Rsa,
 RsaBlowfishOfb,OpenSsl/Reader/Keys/RsaBlowfishOfb.pem,changeit,Rsa,
 RsaUnencrypted,OpenSsl/Reader/Keys/RsaUnencrypted.pem,,Rsa,
 RsaAes256CbcUtf8Pass,OpenSsl/Reader/Keys/RsaAes256CbcUtf8Pass.pem,pässwörd€,Rsa,UTF-8 passphrase
+EddsaUnencrypted,OpenSsl/Reader/Keys/EddsaUnencrypted.pem,,Ed25519,

CryptoLib.Tests/Delphi.Tests/CryptoLib.Tests.Mobile.dpr

@@ -701,6 +701,10 @@ uses
   ClpOpenSslPemWriter in '..\..\CryptoLib\src\OpenSsl\ClpOpenSslPemWriter.pas',
   ClpIOpenSslPemWriter in '..\..\CryptoLib\src\Interfaces\OpenSsl\ClpIOpenSslPemWriter.pas',
   ClpOpenSslPemReader in '..\..\CryptoLib\src\OpenSsl\ClpOpenSslPemReader.pas',
+  ClpICertificateTrustBlock in '..\..\CryptoLib\src\Interfaces\OpenSsl\ClpICertificateTrustBlock.pas',
+  ClpIX509TrustedCertificateBlock in '..\..\CryptoLib\src\Interfaces\OpenSsl\ClpIX509TrustedCertificateBlock.pas',
+  ClpCertificateTrustBlock in '..\..\CryptoLib\src\OpenSsl\ClpCertificateTrustBlock.pas',
+  ClpX509TrustedCertificateBlock in '..\..\CryptoLib\src\OpenSsl\ClpX509TrustedCertificateBlock.pas',
   ClpIOpenSslPemReader in '..\..\CryptoLib\src\Interfaces\OpenSsl\ClpIOpenSslPemReader.pas',
   ClpIPemParser in '..\..\CryptoLib\src\Interfaces\Pem\ClpIPemParser.pas',
   ClpIPemReader in '..\..\CryptoLib\src\Interfaces\Pem\ClpIPemReader.pas',
@@ -1135,6 +1139,7 @@ uses
   CertPathTests in '..\src\Pkix\CertPathTests.pas',
   CertPathBuilderTests in '..\src\Pkix\CertPathBuilderTests.pas',
   CertPathValidatorTests in '..\src\Pkix\CertPathValidatorTests.pas',
+  CertPathHardeningTests in '..\src\Pkix\CertPathHardeningTests.pas',
   ValidityModelTests in '..\src\Pkix\ValidityModelTests.pas',
   PkixPolicyMappingTests in '..\src\Pkix\PkixPolicyMappingTests.pas',
   OcspTests in '..\src\Ocsp\OcspTests.pas',

CryptoLib.Tests/Delphi.Tests/CryptoLib.Tests.Mobile.dproj

@@ -1043,6 +1043,10 @@
         <DCCReference Include="..\..\CryptoLib\src\OpenSsl\ClpOpenSslPemWriter.pas"/>
         <DCCReference Include="..\..\CryptoLib\src\Interfaces\OpenSsl\ClpIOpenSslPemWriter.pas"/>
         <DCCReference Include="..\..\CryptoLib\src\OpenSsl\ClpOpenSslPemReader.pas"/>
+        <DCCReference Include="..\..\CryptoLib\src\Interfaces\OpenSsl\ClpICertificateTrustBlock.pas"/>
+        <DCCReference Include="..\..\CryptoLib\src\Interfaces\OpenSsl\ClpIX509TrustedCertificateBlock.pas"/>
+        <DCCReference Include="..\..\CryptoLib\src\OpenSsl\ClpCertificateTrustBlock.pas"/>
+        <DCCReference Include="..\..\CryptoLib\src\OpenSsl\ClpX509TrustedCertificateBlock.pas"/>
         <DCCReference Include="..\..\CryptoLib\src\Interfaces\OpenSsl\ClpIOpenSslPemReader.pas"/>
         <DCCReference Include="..\..\CryptoLib\src\Interfaces\Pem\ClpIPemParser.pas"/>
         <DCCReference Include="..\..\CryptoLib\src\Interfaces\Pem\ClpIPemReader.pas"/>
@@ -1471,6 +1475,7 @@
         <DCCReference Include="..\src\Pkix\CertPathTests.pas"/>
         <DCCReference Include="..\src\Pkix\CertPathBuilderTests.pas"/>
         <DCCReference Include="..\src\Pkix\CertPathValidatorTests.pas"/>
+        <DCCReference Include="..\src\Pkix\CertPathHardeningTests.pas"/>
         <DCCReference Include="..\src\Pkix\ValidityModelTests.pas"/>
         <DCCReference Include="..\src\Pkix\PkixPolicyMappingTests.pas"/>
         <DCCReference Include="..\src\Ocsp\OcspTests.pas"/>

CryptoLib.Tests/Delphi.Tests/CryptoLib.Tests.dpr

@@ -720,6 +720,10 @@ uses
   ClpOpenSslPemWriter in '..\..\CryptoLib\src\OpenSsl\ClpOpenSslPemWriter.pas',
   ClpIOpenSslPemWriter in '..\..\CryptoLib\src\Interfaces\OpenSsl\ClpIOpenSslPemWriter.pas',
   ClpOpenSslPemReader in '..\..\CryptoLib\src\OpenSsl\ClpOpenSslPemReader.pas',
+  ClpICertificateTrustBlock in '..\..\CryptoLib\src\Interfaces\OpenSsl\ClpICertificateTrustBlock.pas',
+  ClpIX509TrustedCertificateBlock in '..\..\CryptoLib\src\Interfaces\OpenSsl\ClpIX509TrustedCertificateBlock.pas',
+  ClpCertificateTrustBlock in '..\..\CryptoLib\src\OpenSsl\ClpCertificateTrustBlock.pas',
+  ClpX509TrustedCertificateBlock in '..\..\CryptoLib\src\OpenSsl\ClpX509TrustedCertificateBlock.pas',
   ClpIOpenSslPemReader in '..\..\CryptoLib\src\Interfaces\OpenSsl\ClpIOpenSslPemReader.pas',
   ClpIPemParser in '..\..\CryptoLib\src\Interfaces\Pem\ClpIPemParser.pas',
   ClpIPemReader in '..\..\CryptoLib\src\Interfaces\Pem\ClpIPemReader.pas',
@@ -1156,6 +1160,7 @@ uses
   CertPathTests in '..\src\Pkix\CertPathTests.pas',
   CertPathBuilderTests in '..\src\Pkix\CertPathBuilderTests.pas',
   CertPathValidatorTests in '..\src\Pkix\CertPathValidatorTests.pas',
+  CertPathHardeningTests in '..\src\Pkix\CertPathHardeningTests.pas',
   ValidityModelTests in '..\src\Pkix\ValidityModelTests.pas',
   PkixPolicyMappingTests in '..\src\Pkix\PkixPolicyMappingTests.pas',
   OcspTests in '..\src\Ocsp\OcspTests.pas',

CryptoLib.Tests/FreePascal.Tests/CryptoLib.Tests.lpi

@@ -79,7 +79,7 @@
         <PackageName Value="FCL"/>
       </Item4>
     </RequiredPackages>
-    <Units Count="223">
+    <Units Count="224">
       <Unit0>
         <Filename Value="CryptoLib.lpr"/>
         <IsPartOfProject Value="True"/>
@@ -973,6 +973,10 @@
         <Filename Value="..\src\Crypto\PrivateKeyWipeTests.pas"/>
         <IsPartOfProject Value="True"/>
       </Unit222>
+      <Unit223>
+        <Filename Value="..\src\Pkix\CertPathHardeningTests.pas"/>
+        <IsPartOfProject Value="True"/>
+      </Unit223>
     </Units>
   </ProjectOptions>
   <CompilerOptions>

CryptoLib.Tests/FreePascal.Tests/CryptoLib.lpr

@@ -49,7 +49,7 @@
   Asn1CipherBuilderWithKeyTests, AesBitSlicedTests, ECDHPrimeConstantTimeTests,
   ECDHBinaryConstantTimeTests, CryptoLibTestBase, PkixFoundationTests,
   PkixNameConstraintTests, PkixComparerTests, CertPathTests, CertPathBuilderTests,
-  CertPathValidatorTests, ValidityModelTests, PkixPolicyMappingTests, OcspTests,
+  CertPathValidatorTests, ValidityModelTests, CertPathHardeningTests, PkixPolicyMappingTests, OcspTests,
   CryptoLibHashSetTests, PkitsTestBase, NistCertPathTests, AttrCertPathTests,
   CtrDrbgTests, DrbgTestSupport, HashDrbgTests, HMacDrbgTests,
   SimdSelectSlotTests, BinaryPrimitivesTests, PkcsEncryptedPrivateKeyInfoTests,

CryptoLib.Tests/FreePascal.Tests/CryptoLibConsole.lpi

@@ -39,7 +39,7 @@
         <PackageName Value="FCL"/>
       </Item2>
     </RequiredPackages>
-    <Units Count="223">
+    <Units Count="224">
       <Unit0>
         <Filename Value="CryptoLibConsole.lpr"/>
         <IsPartOfProject Value="True"/>
@@ -932,6 +932,10 @@
         <Filename Value="..\src\Crypto\PrivateKeyWipeTests.pas"/>
         <IsPartOfProject Value="True"/>
       </Unit222>
+      <Unit223>
+        <Filename Value="..\src\Pkix\CertPathHardeningTests.pas"/>
+        <IsPartOfProject Value="True"/>
+      </Unit223>
     </Units>
   </ProjectOptions>
   <CompilerOptions>

CryptoLib.Tests/FreePascal.Tests/CryptoLibConsole.lpr

@@ -50,6 +50,7 @@
   Lib25519Tests, Asn1CipherBuilderWithKeyTests, AesBitSlicedTests,
   CryptoLibTestBase, PkixFoundationTests, PkixNameConstraintTests,
   PkixComparerTests, CertPathTests, CertPathBuilderTests, CertPathValidatorTests, ValidityModelTests,
+  CertPathHardeningTests,
   PkixPolicyMappingTests, OcspTests, CryptoLibHashSetTests, PkitsTestBase,
   NistCertPathTests, AttrCertPathTests, CtrDrbgTests, DrbgTestSupport,
   HashDrbgTests, HMacDrbgTests, SimdSelectSlotTests, BinaryPrimitivesTests,

CryptoLib.Tests/src/OpenSsl/OpenSslReaderTests.pas

@@ -55,7 +55,19 @@ interface
   ClpICmsAsn1Objects,
   ClpCmsObjectIdentifiers,
   ClpIAsn1Objects,
+  ClpAsn1Objects,
   ClpIX9ECAsn1Objects,
+  ClpIX509Certificate,
+  ClpICertificateTrustBlock,
+  ClpCertificateTrustBlock,
+  ClpIX509TrustedCertificateBlock,
+  ClpX509TrustedCertificateBlock,
+  ClpISigner,
+  ClpEd25519Signer,
+  ClpIEd25519Signer,
+  ClpIEd25519Parameters,
+  ClpCryptoLibTypes,
+  CertTestUtilities,
   CryptoLibTestBase,
   OpenSslVectors;
 
@@ -88,6 +100,8 @@   TOpenSslReaderTest = class(TCryptoLibAlgorithmTestCase)
     procedure TestOpenSslBlowfish;
     procedure TestEncryptedPrivateKey;
     procedure TestPkcs8;
+    procedure TestTrustedCertificateRoundTrip;
+    procedure TestEddsaPrivateKey;
   end;
 
 implementation
@@ -549,6 +563,88 @@ procedure TOpenSslReaderTest.TestPkcs8;
   end;
 end;
 
+procedure TOpenSslReaderTest.TestTrustedCertificateRoundTrip;
+var
+  LKp: IAsymmetricCipherKeyPair;
+  LCert: IX509Certificate;
+  LUses: TCryptoLibGenericArray<IDerObjectIdentifier>;
+  LTrustBlock: ICertificateTrustBlock;
+  LBlock, LReadBlock: IX509TrustedCertificateBlock;
+  LWriteStream, LReadStream: TStringStream;
+  LWriter: IOpenSslPemWriter;
+  LReader: IOpenSslPemReader;
+  LReadVal: TValue;
+begin
+  LKp := TCertTestUtilities.GenerateRsaKeyPair(1024);
+  LCert := TCertTestUtilities.GenerateRootCert(LKp);
+
+  // id-kp-serverAuth and id-kp-clientAuth
+  LUses := TCryptoLibGenericArray<IDerObjectIdentifier>.Create(
+    TDerObjectIdentifier.Create('1.3.6.1.5.5.7.3.1') as IDerObjectIdentifier,
+    TDerObjectIdentifier.Create('1.3.6.1.5.5.7.3.2') as IDerObjectIdentifier);
+  LTrustBlock := TCertificateTrustBlock.Create('Test Trust Alias', LUses) as ICertificateTrustBlock;
+  LBlock := TX509TrustedCertificateBlock.Create(LCert, LTrustBlock) as IX509TrustedCertificateBlock;
+
+  LWriteStream := TStringStream.Create('', TEncoding.ASCII);
+  try
+    LWriter := CreatePemWriter(LWriteStream);
+    LWriter.WriteObject(TValue.From<IX509TrustedCertificateBlock>(LBlock));
+
+    LReadStream := TStringStream.Create(LWriteStream.DataString, TEncoding.ASCII);
+    try
+      LReader := CreatePemReader(LReadStream);
+      LReadVal := LReader.ReadObject();
+      Check(not LReadVal.IsEmpty, 'trusted certificate should read back');
+      Check(LReadVal.TryGetAsType<IX509TrustedCertificateBlock>(LReadBlock),
+        'the object should be a trusted certificate block');
+      Check(LReadBlock.GetCertificate.Equals(LCert), 'the certificate should round-trip');
+      CheckEquals('Test Trust Alias', LReadBlock.GetTrustBlock.GetAlias, 'the alias should round-trip');
+      CheckEquals(2, System.Length(LReadBlock.GetTrustBlock.GetUses),
+        'both key purpose uses should round-trip');
+    finally
+      LReadStream.Free;
+    end;
+  finally
+    LWriteStream.Free;
+  end;
+end;
+
+procedure TOpenSslReaderTest.TestEddsaPrivateKey;
+var
+  LStream: TStringStream;
+  LReader: IOpenSslPemReader;
+  LReadVal: TValue;
+  LKey: IAsymmetricKeyParameter;
+  LPriv: IEd25519PrivateKeyParameters;
+  LPub: IEd25519PublicKeyParameters;
+  LSigner: ISigner;
+  LMsg, LSig: TCryptoLibByteArray;
+begin
+  LStream := TStringStream.Create(TOpenSslVectors.LoadPemString('EddsaUnencrypted'), TEncoding.ASCII);
+  try
+    LReader := CreatePemReader(LStream);
+    LReadVal := LReader.ReadObject();
+    Check(not LReadVal.IsEmpty, 'the Ed25519 private key should read back');
+    Check(LReadVal.TryGetAsType<IAsymmetricKeyParameter>(LKey), 'the object should be an asymmetric key');
+    Check(Supports(LKey, IEd25519PrivateKeyParameters, LPriv), 'the key should be an Ed25519 private key');
+  finally
+    LStream.Free;
+  end;
+
+  LPub := LPriv.GeneratePublicKey();
+  LMsg := TCryptoLibByteArray.Create(1, 6, 3, 32, 7, 43, 2, 5, 7, 78, 4, 23);
+
+  LSigner := TEd25519Signer.Create() as ISigner;
+  LSigner.Init(True, LPriv);
+  LSigner.BlockUpdate(LMsg, 0, System.Length(LMsg));
+  LSig := LSigner.GenerateSignature();
+
+  LSigner := TEd25519Signer.Create() as ISigner;
+  LSigner.Init(False, LPub);
+  LSigner.BlockUpdate(LMsg, 0, System.Length(LMsg));
+  Check(LSigner.VerifySignature(LSig), 'the Ed25519 signature should verify');
+end;
+
 initialization
 
 {$IFDEF FPC}