[PATCH v2 1/6] bcrypt: Validate key size when importing RSA key.

[Santino Mazza]

Signed-off-by: Santino Mazza 
---
 dlls/bcrypt/bcrypt_main.c  | 1 +
 dlls/bcrypt/tests/bcrypt.c | 3 ---
 2 files changed, 1 insertion(+), 3 deletions(-)

diff --git a/dlls/bcrypt/bcrypt_main.c b/dlls/bcrypt/bcrypt_main.c
index 0fb78ce39a5..7353cae26eb 100644
--- a/dlls/bcrypt/bcrypt_main.c
+++ b/dlls/bcrypt/bcrypt_main.c
@@ -1413,6 +1413,7 @@ static NTSTATUS key_import_pair( struct algorithm *alg, const WCHAR *type, BCRYP
             return STATUS_NOT_SUPPORTED;

size = sizeof(*rsa_blob) + rsa_blob->cbPublicExp + rsa_blob->cbModulus;
+        if(size != input_len) return NTE_BAD_DATA;
         return key_asymmetric_create( (struct key **)ret_key, alg, rsa_blob->BitLength, (BYTE *)rsa_blob, size );
     }
     else if (!wcscmp( type, BCRYPT_RSAPRIVATE_BLOB ) || !wcscmp( type, BCRYPT_RSAFULLPRIVATE_BLOB ))
diff --git a/dlls/bcrypt/tests/bcrypt.c b/dlls/bcrypt/tests/bcrypt.c
index 5fb29a0e0ff..95addc1ab16 100644
--- a/dlls/bcrypt/tests/bcrypt.c
+++ b/dlls/bcrypt/tests/bcrypt.c
@@ -2122,11 +2122,8 @@ static void test_RSA(void)
     ret = BCryptDestroyKey(key);
     ok(!ret, "got %#lx\n", ret);

-    todo_wine
-    {
     ret = BCryptImportKeyPair(alg, NULL, BCRYPT_RSAPUBLIC_BLOB, &key, rsaPublicBlobWithInvalidPublicExpSize, sizeof(rsaPublicBlobWithInvalidPublicExpSize), 0);
     ok(ret == NTE_BAD_DATA, "got %#lx\n", ret);
-    }

ret = BCryptImportKeyPair(alg, NULL, BCRYPT_RSAPUBLIC_BLOB, &key, buf, size, 0);
     ok(ret == STATUS_SUCCESS, "got %#lx\n", ret);

[PATCH v2 2/6] bcrypt: Implement KeyLength property.

[Santino Mazza]

Signed-off-by: Santino Mazza 
---
 dlls/bcrypt/bcrypt_main.c  |  5 +++++
 dlls/bcrypt/tests/bcrypt.c | 18 +++++++++++++++++-
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/dlls/bcrypt/bcrypt_main.c b/dlls/bcrypt/bcrypt_main.c
index 7353cae26eb..e62be127bb4 100644
--- a/dlls/bcrypt/bcrypt_main.c
+++ b/dlls/bcrypt/bcrypt_main.c
@@ -701,6 +701,11 @@ static NTSTATUS set_key_property( struct key *key, const WCHAR *prop, UCHAR *val
             return STATUS_NOT_IMPLEMENTED;
         }
     }
+    else if (!wcscmp( prop, BCRYPT_KEY_LENGTH ))
+    {
+        key->u.a.bitlen = *(DWORD*)value;
+        return STATUS_SUCCESS;
+    }

FIXME( "unsupported key property %s\n", debugstr_w(prop) );
     return STATUS_NOT_IMPLEMENTED;
diff --git a/dlls/bcrypt/tests/bcrypt.c b/dlls/bcrypt/tests/bcrypt.c
index 95addc1ab16..f71c2ac6b37 100644
--- a/dlls/bcrypt/tests/bcrypt.c
+++ b/dlls/bcrypt/tests/bcrypt.c
@@ -672,6 +672,7 @@ static void test_BCryptGenerateSymmetricKey(void)
     BCRYPT_KEY_LENGTHS_STRUCT key_lengths;
     ULONG size, len, i;
     NTSTATUS ret;
+    DWORD keylen;

ret = BCryptOpenAlgorithmProvider(&aes, BCRYPT_AES_ALGORITHM, NULL, 0);
     ok(ret == STATUS_SUCCESS, "got %#lx\n", ret);
@@ -706,6 +707,13 @@ static void test_BCryptGenerateSymmetricKey(void)
                             sizeof(BCRYPT_CHAIN_MODE_CBC), 0);
     ok(ret == STATUS_SUCCESS, "got %#lx\n", ret);

+    todo_wine
+    {
+    keylen = 512;
+    ret = BCryptSetProperty(aes, BCRYPT_KEY_LENGTH, &keylen, sizeof(keylen), 0);
+    ok(ret == STATUS_NOT_SUPPORTED, "got %#lx\n", ret);
+    }
+
     size = 0;
     memset(mode, 0, sizeof(mode));
     ret = BCryptGetProperty(key, BCRYPT_CHAINING_MODE, mode, sizeof(mode), &size, 0);
@@ -2005,6 +2013,7 @@ static void test_RSA(void)
     ULONG len, size, size2, schemes;
     NTSTATUS ret;
     BYTE *buf;
+    DWORD keylen;

ret = BCryptOpenAlgorithmProvider(&alg, BCRYPT_RSA_ALGORITHM, NULL, 0);
     if (ret)
@@ -2052,12 +2061,19 @@ static void test_RSA(void)
     ok(!ret, "BCryptDestroyKey failed: %#lx\n", ret);

/* sign/verify with export/import round-trip */
-    ret = BCryptGenerateKeyPair(alg, &key, 512, 0);
+    ret = BCryptGenerateKeyPair(alg, &key, 1024, 0);
+    ok(ret == STATUS_SUCCESS, "got %#lx\n", ret);
+
+    keylen = 512;
+    ret = BCryptSetProperty(key, BCRYPT_KEY_LENGTH, &keylen, sizeof(keylen), 0);
     ok(ret == STATUS_SUCCESS, "got %#lx\n", ret);

ret = BCryptFinalizeKeyPair(key, 0);
     ok(ret == STATUS_SUCCESS, "got %#lx\n", ret);

+    ret = BCryptSetProperty(key, BCRYPT_KEY_LENGTH, &keylen, sizeof(keylen), 0);
+    ok(ret == STATUS_SUCCESS, "got %#lx\n", ret);
+
     pad.pszAlgId = BCRYPT_SHA1_ALGORITHM;
     memset(sig, 0, sizeof(sig));
     ret = BCryptSignHash(key, &pad, hash, sizeof(hash), sig, sizeof(sig), &len, BCRYPT_PAD_PKCS1);

[PATCH v2 2/6] bcrypt: Implement KeyLength property.

[Hans Leidekker]

On Sun, 2022-03-06 at 12:22 -0300, Santino Mazza wrote:
> Signed-off-by: Santino Mazza
>
> dlls/bcrypt/bcrypt_main.c  |  5 +++++
>  dlls/bcrypt/tests/bcrypt.c | 18 +++++++++++++++++-
>  2 files changed, 22 insertions(+), 1 deletion(-)
>
> diff --git a/dlls/bcrypt/bcrypt_main.c b/dlls/bcrypt/bcrypt_main.c
> index 7353cae26eb..e62be127bb4 100644
> --- a/dlls/bcrypt/bcrypt_main.c
> +++ b/dlls/bcrypt/bcrypt_main.c
> @@ -701,6 +701,11 @@ static NTSTATUS set_key_property( struct key *key, const WCHAR *prop, UCHAR *val
>              return STATUS_NOT_IMPLEMENTED;
>          }
>      }
> - else if (!wcscmp( prop, BCRYPT_KEY_LENGTH ))
> - {
> -
>    key->u.a.bitlen = *(DWORD*)value;
> -
>    return STATUS_SUCCESS;
> - }

You should check that input length is larger than or equal to sizeof(DWORD)
before reading from the buffer.
> - ret = BCryptSetProperty(key, BCRYPT_KEY_LENGTH, &keylen, sizeof(keylen), 0);
> - ok(ret == STATUS_SUCCESS, "got %#lx\n", ret);
> -
>
> pad.pszAlgId = BCRYPT_SHA1_ALGORITHM;
>      memset(sig, 0, sizeof(sig));
>      ret = BCryptSignHash(key, &pad, hash, sizeof(hash), sig, sizeof(sig), &len, BCRYPT_PAD_PKCS1);

This produces warnings:

../wine/dlls/bcrypt/tests/bcrypt.c:713:53: warning: passing argument 3 of ‘BCryptSetProperty’ from incompatible pointer type [-Wincompatible-pointer-types]
  713 |     ret = BCryptSetProperty(aes, BCRYPT_KEY_LENGTH, &keylen, sizeof(keylen), 0);
      |                                                     ^~~~~~~
      |                                                     |
      |                                                     DWORD * {aka long unsigned int *}

[PATCH v2 3/6] ncrypt: Make use of bcrypt for low level cryptography.

[Santino Mazza]

Signed-off-by: Santino Mazza 
---
 dlls/ncrypt/Makefile.in       |  1 +
 dlls/ncrypt/main.c            | 98 +++++++++++++----------------------
 dlls/ncrypt/ncrypt_internal.h | 29 ++---------
 3 files changed, 40 insertions(+), 88 deletions(-)

diff --git a/dlls/ncrypt/Makefile.in b/dlls/ncrypt/Makefile.in
index ad3ed409961..58ec6b3456b 100644
--- a/dlls/ncrypt/Makefile.in
+++ b/dlls/ncrypt/Makefile.in
@@ -1,5 +1,6 @@
 IMPORTLIB = ncrypt
 MODULE    = ncrypt.dll
+IMPORTS	  = bcrypt

EXTRADLLFLAGS = -Wb,--prefer-native

diff --git a/dlls/ncrypt/main.c b/dlls/ncrypt/main.c
index 68d9d884618..e82c76103de 100644
--- a/dlls/ncrypt/main.c
+++ b/dlls/ncrypt/main.c
@@ -88,20 +88,14 @@ SECURITY_STATUS WINAPI NCryptFreeBuffer(PVOID buf)

static SECURITY_STATUS free_key_object(struct key *key)
 {
-    switch (key->alg)
-    {
-    case RSA:
-    {
-        free(key->rsa.modulus);
-        free(key->rsa.public_exp);
-        free(key->rsa.prime1);
-        free(key->rsa.prime2);
-        break;
-    }
-    default:
-        WARN("invalid key %p\n", key);
-        return NTE_INVALID_HANDLE;
-    }
+    NTSTATUS bcrypt_ret;
+
+    bcrypt_ret = BCryptDestroyKey(key->bcrypt_key);
+    if(bcrypt_ret != ERROR_SUCCESS) return NTE_INVALID_HANDLE;
+
+    bcrypt_ret = BCryptCloseAlgorithmProvider(key->alg_prov, 0);
+    if(bcrypt_ret != ERROR_SUCCESS) return NTE_INVALID_HANDLE;
+
     return ERROR_SUCCESS;
 }

@@ -246,6 +240,7 @@ SECURITY_STATUS WINAPI NCryptImportKey(NCRYPT_PROV_HANDLE provider, NCRYPT_KEY_H
                                        BYTE *data, DWORD datasize, DWORD flags)
 {
     BCRYPT_KEY_BLOB *header = (BCRYPT_KEY_BLOB *)data;
+    struct object *key_object;

TRACE("(%#Ix, %#Ix, %s, %p, %p, %p, %lu, %#lx): stub\n", provider, decrypt_key, wine_dbgstr_w(type),
           params, handle, data, datasize, flags);
@@ -270,70 +265,47 @@ SECURITY_STATUS WINAPI NCryptImportKey(NCRYPT_PROV_HANDLE provider, NCRYPT_KEY_H
         return NTE_BAD_FLAGS;
     }

-    switch (header->Magic)
+    if (!(key_object = allocate_object(KEY)))
+    {
+        ERR("Error allocating memory\n");
+        return NTE_NO_MEMORY;
+    }
+
+    switch(header->Magic)
     {
+    case BCRYPT_RSAFULLPRIVATE_MAGIC:
+    case BCRYPT_RSAPRIVATE_MAGIC:
     case BCRYPT_RSAPUBLIC_MAGIC:
     {
-        DWORD expected_size;
-        struct object *object;
-        struct key *key;
-        BYTE *public_exp, *modulus;
-        BCRYPT_RSAKEY_BLOB *rsaheader = (BCRYPT_RSAKEY_BLOB *)data;
-
-        if (datasize < sizeof(*rsaheader))
+        NTSTATUS ret;
+        BCRYPT_RSAKEY_BLOB *rsablob = (BCRYPT_RSAKEY_BLOB *)data;
+        ret = BCryptOpenAlgorithmProvider(&key_object->key.alg_prov, BCRYPT_RSA_ALGORITHM, NULL, 0);
+        if (ret != ERROR_SUCCESS)
         {
-            ERR("Invalid buffer size.\n");
-            return NTE_BAD_DATA;
+            ERR("Error opening algorithm provider\n");
+            return NTE_INTERNAL_ERROR;
         }
-
-        expected_size = sizeof(*rsaheader) + rsaheader->cbPublicExp + rsaheader->cbModulus;
-        if (datasize != expected_size)
+        ret = BCryptImportKeyPair(key_object->key.alg_prov, NULL, type, &key_object->key.bcrypt_key, data, datasize, 0);
+        if (ret != ERROR_SUCCESS)
         {
-            ERR("Invalid buffer size.\n");
+            ERR("Error importing keypair with bcrypt %#lx\n", ret);
             return NTE_BAD_DATA;
         }

-        if (!(object = allocate_object(KEY)))
-        {
-            ERR("Error allocating memory.\n");
-            return NTE_NO_MEMORY;
-        }
-
-        key = &object->key;
-        key->alg = RSA;
-        key->rsa.bit_length = rsaheader->BitLength;
-        key->rsa.public_exp_size = rsaheader->cbPublicExp;
-        key->rsa.modulus_size = rsaheader->cbModulus;
-        if (!(key->rsa.public_exp = malloc(rsaheader->cbPublicExp)))
-        {
-            ERR("Error allocating memory.\n");
-            free(object);
-            return NTE_NO_MEMORY;
-        }
-        if (!(key->rsa.modulus = malloc(rsaheader->cbModulus)))
-        {
-            ERR("Error allocating memory.\n");
-            free(key->rsa.public_exp);
-            free(object);
-            return NTE_NO_MEMORY;
-        }
-
-        public_exp = &data[sizeof(*rsaheader)]; /* The public exp is after the header. */
-        modulus = &public_exp[rsaheader->cbPublicExp]; /* The modulus is after the public exponent. */
-        memcpy(key->rsa.public_exp, public_exp, rsaheader->cbPublicExp);
-        memcpy(key->rsa.modulus, modulus, rsaheader->cbModulus);
-
-        set_object_property(object, NCRYPT_ALGORITHM_GROUP_PROPERTY, (BYTE *)L"RSA", sizeof(L"RSA"));
-        set_object_property(object, NCRYPT_LENGTH_PROPERTY, (BYTE *)&key->rsa.bit_length, sizeof(key->rsa.bit_length));
-        set_object_property(object, NCRYPT_PROVIDER_HANDLE_PROPERTY, (BYTE *)&provider, sizeof(provider));
-        *handle = (NCRYPT_KEY_HANDLE)object;
+        set_object_property(key_object, NCRYPT_PROVIDER_HANDLE_PROPERTY, (BYTE *)&provider, sizeof(NCRYPT_PROV_HANDLE));
+        set_object_property(key_object, NCRYPT_ALGORITHM_GROUP_PROPERTY, (BYTE *)BCRYPT_RSA_ALGORITHM, sizeof(BCRYPT_RSA_ALGORITHM));
+        set_object_property(key_object, NCRYPT_LENGTH_PROPERTY, (BYTE *)&rsablob->BitLength, sizeof(rsablob->BitLength));
         break;
     }
     default:
-        FIXME("Unhandled key magic %#lx.\n", header->Magic);
+    {
+        FIXME("Unhandled key magic %#lx\n", header->Magic);
         return NTE_INVALID_PARAMETER;
+        break;
+    }
     }

+    *handle = (NCRYPT_KEY_HANDLE)key_object;
     return ERROR_SUCCESS;
 }

diff --git a/dlls/ncrypt/ncrypt_internal.h b/dlls/ncrypt/ncrypt_internal.h
index 3966dd73ed6..de5cde5fa8b 100644
--- a/dlls/ncrypt/ncrypt_internal.h
+++ b/dlls/ncrypt/ncrypt_internal.h
@@ -16,34 +16,13 @@
  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  */

-enum key_algorithm
-{
-    DH,
-    DSA,
-    ECC,
-    RSA,
-};
-
-struct rsa_key
-{
-    DWORD bit_length;
-    DWORD public_exp_size;
-    BYTE *public_exp;
-    DWORD modulus_size;
-    BYTE *modulus;
-    DWORD prime1_size;
-    BYTE *prime1;
-    DWORD prime2_size;
-    BYTE *prime2;
-};
+#include <ncrypt.h>
+#include <bcrypt.h>

struct key
 {
-    enum key_algorithm alg;
-    union
-    {
-        struct rsa_key rsa;
-    };
+    BCRYPT_ALG_HANDLE alg_prov;
+    BCRYPT_KEY_HANDLE bcrypt_key;
 };

struct storage_provider

[PATCH v2 3/6] ncrypt: Make use of bcrypt for low level cryptography.

[Hans Leidekker]

On Sun, 2022-03-06 at 12:22 -0300, Santino Mazza wrote:
> Signed-off-by: Santino Mazza
>
> dlls/ncrypt/Makefile.in       |  1 +
>  dlls/ncrypt/main.c            | 98 +++++++++++++----------------------
>  dlls/ncrypt/ncrypt_internal.h | 29 ++---------
>  3 files changed, 40 insertions(+), 88 deletions(-)
>
> diff --git a/dlls/ncrypt/Makefile.in b/dlls/ncrypt/Makefile.in
> index ad3ed409961..58ec6b3456b 100644
> --- a/dlls/ncrypt/Makefile.in
> +++ b/dlls/ncrypt/Makefile.in
> @@ -1,5 +1,6 @@
>  IMPORTLIB = ncrypt
>  MODULE    = ncrypt.dll
> +IMPORTS	  = bcrypt

Please use spaces here.
> diff --git a/dlls/ncrypt/main.c b/dlls/ncrypt/main.c
> index 68d9d884618..e82c76103de 100644
> --- a/dlls/ncrypt/main.c
> +++ b/dlls/ncrypt/main.c
> @@ -88,20 +88,14 @@ SECURITY_STATUS WINAPI NCryptFreeBuffer(PVOID buf)
>   static SECURITY_STATUS free_key_object(struct key *key)
>
> {
> - switch (key->alg)
> - {
> - case RSA:
> - {
> -
>    free(key->rsa.modulus);
> -
>    free(key->rsa.public_exp);
> -
>    free(key->rsa.prime1);
> -
>    free(key->rsa.prime2);
> -
>    break;
> - }
> - default:
> -
>    WARN("invalid key %p\n", key);
> -
>    return NTE_INVALID_HANDLE;
> - }
> - NTSTATUS bcrypt_ret;
> -
> - bcrypt_ret = BCryptDestroyKey(key->bcrypt_key);
> - if(bcrypt_ret != ERROR_SUCCESS) return NTE_INVALID_HANDLE;
> -
> - bcrypt_ret = BCryptCloseAlgorithmProvider(key->alg_prov, 0);
> - if(bcrypt_ret != ERROR_SUCCESS) return NTE_INVALID_HANDLE;

I'd say the bcrypt_ prefix is redundant here. It's pretty clear from the
function names that these are bcrypt return values.
> @@ -246,6 +240,7 @@ SECURITY_STATUS WINAPI NCryptImportKey(NCRYPT_PROV_HANDLE provider, NCRYPT_KEY_H
>                                         BYTE *data, DWORD datasize, DWORD flags)
>  {

...
> BCRYPT_KEY_BLOB *header = (BCRYPT_KEY_BLOB *)data;
> -
>
> struct object *key_object;
> -
>    ret = BCryptImportKeyPair(key_object->key.alg_prov, NULL, type, &key_object->key.bcrypt_key, data, datasize, 0);
>
> -
>    if (ret != ERROR_SUCCESS)
>
> {
> -
>        ERR("Invalid buffer size.\n");
> -
>        ERR("Error importing keypair with bcrypt %#lx\n", ret);
>
> return NTE_BAD_DATA;
>          }

This should be a WARN.
> -
>    if (!(object = allocate_object(KEY)))
> -
>    {
> -
>        ERR("Error allocating memory.\n");
> -
>        return NTE_NO_MEMORY;
> -
>    }
> -
> -
>    key = &object->key;
> -
>    key->alg = RSA;
> -
>    key->rsa.bit_length = rsaheader->BitLength;
> -
>    key->rsa.public_exp_size = rsaheader->cbPublicExp;
> -
>    key->rsa.modulus_size = rsaheader->cbModulus;
> -
>    if (!(key->rsa.public_exp = malloc(rsaheader->cbPublicExp)))
> -
>    {
> -
>        ERR("Error allocating memory.\n");
> -
>        free(object);
> -
>        return NTE_NO_MEMORY;
> -
>    }
> -
>    if (!(key->rsa.modulus = malloc(rsaheader->cbModulus)))
> -
>    {
> -
>        ERR("Error allocating memory.\n");
> -
>        free(key->rsa.public_exp);
> -
>        free(object);
> -
>        return NTE_NO_MEMORY;
> -
>    }
> -
> -
>    public_exp = &data[sizeof(*rsaheader)]; /* The public exp is after the header. */
> -
>    modulus = &public_exp[rsaheader->cbPublicExp]; /* The modulus is after the public exponent. */
> -
>    memcpy(key->rsa.public_exp, public_exp, rsaheader->cbPublicExp);
> -
>    memcpy(key->rsa.modulus, modulus, rsaheader->cbModulus);
> -
> -
>    set_object_property(object, NCRYPT_ALGORITHM_GROUP_PROPERTY, (BYTE *)L"RSA", sizeof(L"RSA"));
> -
>    set_object_property(object, NCRYPT_LENGTH_PROPERTY, (BYTE *)&key->rsa.bit_length, sizeof(key->rsa.bit_length));
> -
>    set_object_property(object, NCRYPT_PROVIDER_HANDLE_PROPERTY, (BYTE *)&provider, sizeof(provider));
> -
>    *handle = (NCRYPT_KEY_HANDLE)object;
> -
>    set_object_property(key_object, NCRYPT_PROVIDER_HANDLE_PROPERTY, (BYTE *)&provider, sizeof(NCRYPT_PROV_HANDLE));

This change is not needed.
> -
>    set_object_property(key_object, NCRYPT_ALGORITHM_GROUP_PROPERTY, (BYTE *)BCRYPT_RSA_ALGORITHM, sizeof(BCRYPT_RSA_ALGORITHM));
> -
>    set_object_property(key_object, NCRYPT_LENGTH_PROPERTY, (BYTE *)&rsablob->BitLength, sizeof(rsablob->BitLength));
>
> break;
>      }
>      default:
> -
>    FIXME("Unhandled key magic %#lx.\n", header->Magic);
> - {
> -
>    FIXME("Unhandled key magic %#lx\n", header->Magic);
>
> return NTE_INVALID_PARAMETER;
> -
>    break;
> - }
>
> }

This break will never be reached. 'object' is leaked on error.
> diff --git a/dlls/ncrypt/ncrypt_internal.h b/dlls/ncrypt/ncrypt_internal.h
> index 3966dd73ed6..de5cde5fa8b 100644
> --- a/dlls/ncrypt/ncrypt_internal.h
> +++ b/dlls/ncrypt/ncrypt_internal.h
> @@ -16,34 +16,13 @@
> - Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
>
> */
>
> -enum key_algorithm
> -{
> - DH,
> - DSA,
> - ECC,
> - RSA,
>
> -};
> -
>
> -struct rsa_key
> -{
> - DWORD bit_length;
> - DWORD public_exp_size;
> - BYTE *public_exp;
> - DWORD modulus_size;
> - BYTE *modulus;
> - DWORD prime1_size;
> - BYTE *prime1;
> - DWORD prime2_size;
> - BYTE *prime2;
>
> -};
> +#include <ncrypt.h>
> +#include <bcrypt.h>

The ncrypt.h include is not needed.

[PATCH v2 4/6] ncrypt/tests: Test for symmetric keys support.

[Santino Mazza]

Signed-off-by: Santino Mazza 
---
 dlls/ncrypt/tests/ncrypt.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/dlls/ncrypt/tests/ncrypt.c b/dlls/ncrypt/tests/ncrypt.c
index d1bcbbcab2a..f4eb7207d2d 100644
--- a/dlls/ncrypt/tests/ncrypt.c
+++ b/dlls/ncrypt/tests/ncrypt.c
@@ -291,6 +291,18 @@ static void test_create_persisted_key(void)

NCryptFinalizeKey(key, 0);
     NCryptFreeObject(key);
+
+    todo_wine
+    {
+    key = 0;
+    ret = NCryptCreatePersistedKey(prov, &key, BCRYPT_AES_ALGORITHM, NULL, 0, 0);
+    ok(ret == ERROR_SUCCESS || broken(ret == NTE_NOT_SUPPORTED) /* win 7 */, "got %#lx\n", ret);
+    if (ret != NTE_NOT_SUPPORTED)
+    {
+        ok(key, "got null handle\n");
+    }
+    }
+
     NCryptFreeObject(prov);
     }
 }

[PATCH v2 5/6] ncrypt: Implement NCryptCreatePersistedKey.

[Santino Mazza]

Signed-off-by: Santino Mazza 
---
 dlls/ncrypt/main.c            | 59 ++++++++++++++++++++++++++++++-----
 dlls/ncrypt/ncrypt_internal.h |  6 ++++
 dlls/ncrypt/tests/ncrypt.c    |  5 +--
 3 files changed, 60 insertions(+), 10 deletions(-)

diff --git a/dlls/ncrypt/main.c b/dlls/ncrypt/main.c
index e82c76103de..9a4438d7caa 100644
--- a/dlls/ncrypt/main.c
+++ b/dlls/ncrypt/main.c
@@ -30,14 +30,6 @@

WINE_DEFAULT_DEBUG_CHANNEL(ncrypt);

-SECURITY_STATUS WINAPI NCryptCreatePersistedKey(NCRYPT_PROV_HANDLE provider, NCRYPT_KEY_HANDLE *key,
-                                                const WCHAR *algid, const WCHAR *name, DWORD keyspec, DWORD flags)
-{
-    FIXME("(%#Ix, %p, %s, %s, %#lx, %#lx): stub\n", provider, key, wine_dbgstr_w(algid),
-          wine_dbgstr_w(name), keyspec, flags);
-    return NTE_NOT_SUPPORTED;
-}
-
 SECURITY_STATUS WINAPI NCryptDecrypt(NCRYPT_KEY_HANDLE key, BYTE *input, DWORD insize, void *padding,
                                      BYTE *output, DWORD outsize, DWORD *result, DWORD flags)
 {
@@ -354,6 +346,57 @@ SECURITY_STATUS WINAPI NCryptSetProperty(NCRYPT_HANDLE handle, const WCHAR *name
     return set_object_property(object, name, input, insize);
 }

+SECURITY_STATUS WINAPI NCryptCreatePersistedKey(NCRYPT_PROV_HANDLE provider, NCRYPT_KEY_HANDLE *key,
+                                                const WCHAR *algid, const WCHAR *name, DWORD keyspec, DWORD flags)
+{
+    struct object *key_object;
+    TRACE("(%#Ix, %p, %s, %s, %#lx, %#lx)\n", provider, key, wine_dbgstr_w(algid),
+          wine_dbgstr_w(name), keyspec, flags);
+
+    if (!provider) return NTE_INVALID_HANDLE;
+    if (!algid) return HRESULT_FROM_WIN32(RPC_X_NULL_REF_POINTER);
+    if (name) FIXME("Persistant keys not supported\n");
+
+    if (!(key_object = allocate_object(KEY)))
+    {
+        ERR("Error allocating memory\n");
+        return NTE_NO_MEMORY;
+    }
+
+    if (!lstrcmpiW(algid, BCRYPT_RSA_ALGORITHM))
+    {
+        NTSTATUS ret = BCryptOpenAlgorithmProvider(&key_object->key.alg_prov, BCRYPT_RSA_ALGORITHM, NULL, 0);
+        DWORD default_bitlength = 1024;
+
+        if (ret != ERROR_SUCCESS)
+        {
+            ERR("Error opening algorithm provider\n");
+            NCryptFreeObject((NCRYPT_HANDLE)key_object);
+            return NTE_INTERNAL_ERROR;
+        }
+
+        ret = BCryptGenerateKeyPair(key_object->key.alg_prov, &key_object->key.bcrypt_key, 1024, 0);
+        if (ret != ERROR_SUCCESS)
+        {
+            ERR("Error generating key pair\n");
+            return NTE_INTERNAL_ERROR;
+        }
+
+        key_object->key.type = ASYMMETRIC;
+        set_object_property(key_object, NCRYPT_PROVIDER_HANDLE_PROPERTY, (BYTE *)&provider, sizeof(NCRYPT_PROV_HANDLE));
+        set_object_property(key_object, NCRYPT_ALGORITHM_GROUP_PROPERTY, (BYTE *)BCRYPT_RSA_ALGORITHM, sizeof(BCRYPT_RSA_ALGORITHM));
+        set_object_property(key_object, NCRYPT_LENGTH_PROPERTY, (BYTE *)&default_bitlength, sizeof(default_bitlength));
+    }
+    else
+    {
+        FIXME("Algorithm not handled %s\n", wine_dbgstr_w(algid));
+        return NTE_NOT_SUPPORTED;
+    }
+
+    *key = (NCRYPT_KEY_HANDLE)key_object;
+    return ERROR_SUCCESS;
+}
+
 SECURITY_STATUS WINAPI NCryptVerifySignature(NCRYPT_KEY_HANDLE handle, void *padding, BYTE *hash, DWORD hash_size,
                                              BYTE *signature, DWORD signature_size, DWORD flags)
 {
diff --git a/dlls/ncrypt/ncrypt_internal.h b/dlls/ncrypt/ncrypt_internal.h
index de5cde5fa8b..7bd7a96bb04 100644
--- a/dlls/ncrypt/ncrypt_internal.h
+++ b/dlls/ncrypt/ncrypt_internal.h
@@ -19,8 +19,14 @@
 #include <ncrypt.h>
 #include <bcrypt.h>

+enum key_type {
+    SYMMETRIC,
+    ASYMMETRIC
+};
+
 struct key
 {
+    enum key_type type;
     BCRYPT_ALG_HANDLE alg_prov;
     BCRYPT_KEY_HANDLE bcrypt_key;
 };
diff --git a/dlls/ncrypt/tests/ncrypt.c b/dlls/ncrypt/tests/ncrypt.c
index f4eb7207d2d..3d0ce329ea0 100644
--- a/dlls/ncrypt/tests/ncrypt.c
+++ b/dlls/ncrypt/tests/ncrypt.c
@@ -229,6 +229,7 @@ static void test_set_property(void)
     {
     ret = NCryptSetProperty(key, NCRYPT_NAME_PROPERTY, (BYTE *)L"Key name", sizeof(L"Key name"), 0);
     ok(ret == NTE_NOT_SUPPORTED, "got %#lx\n", ret);
+    }
     NCryptFreeObject(key);

key = 0;
@@ -240,6 +241,8 @@ static void test_set_property(void)
     ret = NCryptSetProperty(key, NCRYPT_LENGTH_PROPERTY, (BYTE *)&keylength, sizeof(keylength), 0);
     ok(ret == ERROR_SUCCESS, "got %#lx\n", ret);

+    todo_wine
+    {
     ret = NCryptSetProperty(key, NCRYPT_NAME_PROPERTY, (BYTE *)L"Key name", sizeof(L"Key name"), 0);
     ok(ret == NTE_NOT_SUPPORTED, "got %#lx\n", ret);

@@ -261,7 +264,6 @@ static void test_create_persisted_key(void)
     ret = NCryptOpenStorageProvider(&prov, NULL, 0);
     ok(ret == ERROR_SUCCESS, "got %#lx\n", ret);

-    todo_wine {
     key = 0;
     ret = NCryptCreatePersistedKey(0, &key, BCRYPT_RSA_ALGORITHM, NULL, 0, 0);
     ok(ret == NTE_INVALID_HANDLE, "got %#lx\n", ret);
@@ -304,7 +306,6 @@ static void test_create_persisted_key(void)
     }

NCryptFreeObject(prov);
-    }
 }

START_TEST(ncrypt)

[PATCH v2 6/6] ncrypt: Implement NCryptFinalizeKey

[Santino Mazza]

Signed-off-by: Santino Mazza 
---
 dlls/ncrypt/main.c            | 48 ++++++++++++++++++++++++++++++-----
 dlls/ncrypt/ncrypt_internal.h |  1 +
 dlls/ncrypt/tests/ncrypt.c    | 25 ++++++++++++++++++
 3 files changed, 68 insertions(+), 6 deletions(-)

diff --git a/dlls/ncrypt/main.c b/dlls/ncrypt/main.c
index 9a4438d7caa..2e076fac714 100644
--- a/dlls/ncrypt/main.c
+++ b/dlls/ncrypt/main.c
@@ -66,12 +66,6 @@ SECURITY_STATUS WINAPI NCryptEnumKeys(NCRYPT_PROV_HANDLE provider, const WCHAR *
     return NTE_NOT_SUPPORTED;
 }

-SECURITY_STATUS WINAPI NCryptFinalizeKey(NCRYPT_KEY_HANDLE key, DWORD flags)
-{
-    FIXME("(%#Ix, %#lx): stub\n", key, flags);
-    return NTE_NOT_SUPPORTED;
-}
-
 SECURITY_STATUS WINAPI NCryptFreeBuffer(PVOID buf)
 {
     FIXME("(%p): stub\n", buf);
@@ -397,6 +391,48 @@ SECURITY_STATUS WINAPI NCryptCreatePersistedKey(NCRYPT_PROV_HANDLE provider, NCR
     return ERROR_SUCCESS;
 }

+SECURITY_STATUS WINAPI NCryptFinalizeKey(NCRYPT_KEY_HANDLE key, DWORD flags)
+{
+    struct object *key_object = (struct object*)key;
+    DWORD key_length;
+    struct object_property *prop;
+    NTSTATUS ret;
+
+    TRACE("(%#Ix, %#lx): stub\n", key, flags);
+
+    if (!key) return NTE_INVALID_HANDLE;
+    if (key_object->key.finalized_key) return NTE_INVALID_HANDLE;
+
+    if (key_object->key.type == ASYMMETRIC)
+    {
+        prop = get_object_property(key_object, NCRYPT_LENGTH_PROPERTY);
+        if (!prop) return NTE_INVALID_HANDLE;
+
+        key_length = *(DWORD *)prop->value;
+        BCryptSetProperty(key_object->key.bcrypt_key, BCRYPT_KEY_LENGTH, (UCHAR*)&key_length, sizeof(key_length), 0);
+
+        ret = BCryptFinalizeKeyPair(key_object->key.bcrypt_key, 0);
+        if (ret != ERROR_SUCCESS)
+        {
+            ERR("Error finalizing key pair\n");
+            return NTE_INTERNAL_ERROR;
+        }
+    }
+    else if (key_object->key.type == SYMMETRIC)
+    {
+        FIXME("Symmetric keys not implemented\n");
+        return NTE_NOT_SUPPORTED;
+    }
+    else
+    {
+        ERR("Got handle with invalid key type");
+        return NTE_INVALID_HANDLE;
+    }
+
+    key_object->key.finalized_key = 1;
+    return ERROR_SUCCESS;
+}
+
 SECURITY_STATUS WINAPI NCryptVerifySignature(NCRYPT_KEY_HANDLE handle, void *padding, BYTE *hash, DWORD hash_size,
                                              BYTE *signature, DWORD signature_size, DWORD flags)
 {
diff --git a/dlls/ncrypt/ncrypt_internal.h b/dlls/ncrypt/ncrypt_internal.h
index 7bd7a96bb04..510db516955 100644
--- a/dlls/ncrypt/ncrypt_internal.h
+++ b/dlls/ncrypt/ncrypt_internal.h
@@ -26,6 +26,7 @@ enum key_type {

struct key
 {
+    DWORD finalized_key;
     enum key_type type;
     BCRYPT_ALG_HANDLE alg_prov;
     BCRYPT_KEY_HANDLE bcrypt_key;
diff --git a/dlls/ncrypt/tests/ncrypt.c b/dlls/ncrypt/tests/ncrypt.c
index 3d0ce329ea0..0e0c8942313 100644
--- a/dlls/ncrypt/tests/ncrypt.c
+++ b/dlls/ncrypt/tests/ncrypt.c
@@ -308,6 +308,30 @@ static void test_create_persisted_key(void)
     NCryptFreeObject(prov);
 }

+static void test_finalize_key(void)
+{
+    NCRYPT_PROV_HANDLE prov;
+    NCRYPT_KEY_HANDLE key;
+    SECURITY_STATUS ret;
+
+    ret = NCryptOpenStorageProvider(&prov, NULL, 0);
+    ok(ret == ERROR_SUCCESS, "got %#lx\n", ret);
+
+    ret = NCryptCreatePersistedKey(prov, &key, BCRYPT_RSA_ALGORITHM, NULL, 0, 0);
+    ok(ret == ERROR_SUCCESS, "got %#lx\n", ret);
+
+    ret = NCryptFinalizeKey(key, 0);
+    ok(ret == ERROR_SUCCESS, "got %#lx\n", ret);
+
+    ret = NCryptFinalizeKey(key, 0);
+    ok(ret == NTE_INVALID_HANDLE, "got %#lx\n", ret);
+
+    ret = NCryptFinalizeKey(0, 0);
+    ok(ret == NTE_INVALID_HANDLE, "got %#lx\n", ret);
+
+    NCryptFreeObject(key);
+}
+
 START_TEST(ncrypt)
 {
     test_key_import_rsa();
@@ -315,4 +339,5 @@ START_TEST(ncrypt)
     test_get_property();
     test_set_property();
     test_create_persisted_key();
+    test_finalize_key();
 }