|
|
/*++
Copyright (c) 1997 Microsoft Corporation
Module Name:
exchange.cxx
Abstract:
This module implements the IIS_CRYPTO_EXCHANGE_CLIENT class.
Author:
Keith Moore (keithmo) 02-Dec-1996
Revision History:
--*/
#include "precomp.hxx"
#pragma hdrstop
//
// Private constants.
//
//
// Private types.
//
//
// Private globals.
//
//
// Private prototypes.
//
//
// Public functions.
//
IIS_CRYPTO_EXCHANGE_CLIENT::IIS_CRYPTO_EXCHANGE_CLIENT()
/*++
Routine Description:
IIS_CRYPTO_EXCHANGE_CLIENT class constructor.
Arguments:
None.
Return Value:
None.
--*/
{
//
// Just put the member variables into known states.
//
m_hServerKeyExchangeKey = CRYPT_NULL; m_hServerSignatureKey = CRYPT_NULL;
} // IIS_CRYPTO_EXCHANGE_CLIENT::IIS_CRYPTO_EXCHANGE_CLIENT
IIS_CRYPTO_EXCHANGE_CLIENT::~IIS_CRYPTO_EXCHANGE_CLIENT()
/*++
Routine Description:
IIS_CRYPTO_EXCHANGE_CLIENT class destructor.
Arguments:
None.
Return Value:
None.
--*/
{
//
// Close any open keys.
//
CLOSE_KEY( m_hServerKeyExchangeKey ); CLOSE_KEY( m_hServerSignatureKey );
} // IIS_CRYPTO_EXCHANGE_CLIENT::~IIS_CRYPTO_EXCHANGE_CLIENT
HRESULTIIS_CRYPTO_EXCHANGE_CLIENT::ClientPhase1( OUT PIIS_CRYPTO_BLOB * ppClientKeyExchangeKeyBlob, OUT PIIS_CRYPTO_BLOB * ppClientSignatureKeyBlob )
/*++
Routine Description:
Performs client-side phase 1 of the multi-phase key exchange protocol.
Arguments:
ppClientKeyExchangeKeyBlob - Receives a pointer to the client's key exchange key public blob if successful. It is the client's responsibility to (somehow) transmit this to the server.
ppClientSignatureKeyBlob - Receives a pointer to the client's signature public blob if successful. It is the client's responsibility to (somehow) transmit this to the server.
Return Value:
HRESULT - Completion status, 0 if successful, !0 otherwise.
--*/
{
HRESULT result; PIIS_CRYPTO_BLOB keyExchangeKeyBlob; PIIS_CRYPTO_BLOB signatureKeyBlob;
//
// Sanity check.
//
DBG_ASSERT( ValidateState() ); DBG_ASSERT( ppClientKeyExchangeKeyBlob != NULL ); DBG_ASSERT( ppClientSignatureKeyBlob != NULL );
//
// Setup our locals so we know how to cleanup on exit.
//
keyExchangeKeyBlob = NULL; signatureKeyBlob = NULL;
//
// Export the key exchange key blob.
//
result = ::IISCryptoExportPublicKeyBlob( &keyExchangeKeyBlob, m_hProv, m_hKeyExchangeKey );
if( FAILED(result) ) { goto fatal; }
//
// Export the signature key blob.
//
result = ::IISCryptoExportPublicKeyBlob( &signatureKeyBlob, m_hProv, m_hSignatureKey );
if( FAILED(result) ) { goto fatal; }
//
// Success!
//
DBG_ASSERT( keyExchangeKeyBlob != NULL ); DBG_ASSERT( signatureKeyBlob != NULL );
*ppClientKeyExchangeKeyBlob = keyExchangeKeyBlob; *ppClientSignatureKeyBlob = signatureKeyBlob;
return NO_ERROR;
fatal:
FREE_BLOB( keyExchangeKeyBlob ); FREE_BLOB( signatureKeyBlob );
DBG_ASSERT( FAILED(result) ); return result;
} // IIS_CRYPTO_EXCHANGE_CLIENT::ClientPhase1
HRESULTIIS_CRYPTO_EXCHANGE_CLIENT::ClientPhase2( IN PIIS_CRYPTO_BLOB pServerKeyExchangeKeyBlob, IN PIIS_CRYPTO_BLOB pServerSignatureKeyBlob, IN PIIS_CRYPTO_BLOB pServerSessionKeyBlob, OUT PIIS_CRYPTO_BLOB * ppClientSessionKeyBlob, OUT PIIS_CRYPTO_BLOB * ppClientHashBlob )
/*++
Routine Description:
Performs client-side phase 2 of the multi-phase key exchange protocol.
Arguments:
pServerKeyExchangeKeyBlob - Pointer to the server's key exchange public key blob.
pServerSignatureKeyBlob - Pointer to the server's signature public key blob.
pServerSessionKeyBlob - Pointer to the server's session key blob.
ppClientSessionKeyBlob - Receives a pointer to the client's session key blob if successful.
ppClientHashBlob - Receives a pointer to the client's hash blob if successful.
Return Value:
HRESULT - Completion status, 0 if successful, !0 otherwise.
--*/
{
HRESULT result; PIIS_CRYPTO_BLOB sessionKeyBlob; PIIS_CRYPTO_BLOB hashBlob;
//
// Sanity check.
//
DBG_ASSERT( ValidateState() ); DBG_ASSERT( pServerKeyExchangeKeyBlob != NULL ); DBG_ASSERT( IISCryptoIsValidBlob( pServerKeyExchangeKeyBlob ) ); DBG_ASSERT( pServerSignatureKeyBlob != NULL ); DBG_ASSERT( IISCryptoIsValidBlob( pServerSignatureKeyBlob ) ); DBG_ASSERT( pServerSessionKeyBlob != NULL ); DBG_ASSERT( IISCryptoIsValidBlob( pServerSessionKeyBlob ) ); DBG_ASSERT( ppClientSessionKeyBlob != NULL ); DBG_ASSERT( ppClientHashBlob != NULL );
//
// Setup our locals so we know how to cleanup on exit.
//
sessionKeyBlob = NULL; hashBlob = NULL;
//
// Import the server's keys.
//
DBG_ASSERT( m_hServerKeyExchangeKey == CRYPT_NULL ); result = ::IISCryptoImportPublicKeyBlob( &m_hServerKeyExchangeKey, pServerKeyExchangeKeyBlob, m_hProv );
if( FAILED(result) ) { goto fatal; }
DBG_ASSERT( m_hServerSignatureKey == CRYPT_NULL ); result = ::IISCryptoImportPublicKeyBlob( &m_hServerSignatureKey, pServerSignatureKeyBlob, m_hProv );
if( FAILED(result) ) { goto fatal; }
DBG_ASSERT( m_hServerSessionKey == CRYPT_NULL ); result = SafeImportSessionKeyBlob( &m_hServerSessionKey, pServerSessionKeyBlob, m_hProv, m_hServerSignatureKey );
if( FAILED(result) ) { goto fatal; }
//
// Generate our local session key.
//
DBG_ASSERT( m_hClientSessionKey == CRYPT_NULL ); result = ::IISCryptoGenerateSessionKey( &m_hClientSessionKey, m_hProv );
if( FAILED(result) ) { goto fatal; }
//
// Export it.
//
result = SafeExportSessionKeyBlob( &sessionKeyBlob, m_hProv, m_hClientSessionKey, m_hServerKeyExchangeKey );
if( FAILED(result) ) { goto fatal; }
//
// Create the phase 3 hash blob.
//
result = CreatePhase3Hash( &hashBlob );
if( FAILED(result) ) { goto fatal; }
//
// Success!
//
*ppClientSessionKeyBlob = sessionKeyBlob; *ppClientHashBlob = hashBlob;
return NO_ERROR;
fatal:
FREE_BLOB( sessionKeyBlob ); FREE_BLOB( hashBlob );
DBG_ASSERT( FAILED(result) ); return result;
} // IIS_CRYPTO_EXCHANGE_CLIENT::ClientPhase2
HRESULTIIS_CRYPTO_EXCHANGE_CLIENT::ClientPhase3( IN PIIS_CRYPTO_BLOB pServerHashBlob )
/*++
Routine Description:
Performs client-side phase 3 of the multi-phase key exchange protocol.
Arguments:
pServerHashBlob - Pointer to the server's hash blob.
Return Value:
HRESULT - Completion status, 0 if successful, !0 otherwise.
--*/
{
HRESULT result; PIIS_CRYPTO_BLOB hashBlob;
//
// Sanity check.
//
DBG_ASSERT( ValidateState() ); DBG_ASSERT( pServerHashBlob != NULL ); DBG_ASSERT( IISCryptoIsValidBlob( pServerHashBlob ) );
//
// Setup our locals so we know how to cleanup on exit.
//
hashBlob = NULL;
//
// Create the phase 4 hash blob.
//
result = CreatePhase4Hash( &hashBlob );
if( FAILED(result) ) { goto fatal; }
//
// Compare this blob with the one we got from the server.
// If they match, then the exchange is complete.
//
if( !::IISCryptoCompareBlobs( pServerHashBlob, hashBlob ) ) {
result = ERROR_INVALID_DATA; goto fatal;
}
//
// Success!
//
FREE_BLOB(hashBlob);
return NO_ERROR;
fatal:
FREE_BLOB(hashBlob);
DBG_ASSERT( FAILED(result) ); return result;
} // IIS_CRYPTO_EXCHANGE_CLIENT::ClientPhase3
//
// Private functions.
//
|
