From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001

From: Daniel Axtens <dja@axtens.net>

Date: Thu, 30 Jul 2020 01:33:46 +1000

Subject: [PATCH] appended signatures: parse PKCS#7 signedData and X.509

 certificates

This code allows us to parse:

 - PKCS#7 signedData messages. Only a single signerInfo is supported,

   which is all that the Linux sign-file utility supports creating

   out-of-the-box. Only RSA, SHA-256 and SHA-512 are supported.

   Any certificate embedded in the PKCS#7 message will be ignored.

 - X.509 certificates: at least enough to verify the signatures on the

   PKCS#7 messages. We expect that the certificates embedded in grub will

   be leaf certificates, not CA certificates. The parser enforces this.

Signed-off-by: Daniel Axtens <dja@axtens.net>

---

 grub-core/commands/appendedsig/asn1util.c    | 102 +++

 grub-core/commands/appendedsig/pkcs7.c       | 305 +++++++++

 grub-core/commands/appendedsig/x509.c        | 958 +++++++++++++++++++++++++++

 grub-core/commands/appendedsig/appendedsig.h | 110 +++

 4 files changed, 1475 insertions(+)

 create mode 100644 grub-core/commands/appendedsig/asn1util.c

 create mode 100644 grub-core/commands/appendedsig/pkcs7.c

 create mode 100644 grub-core/commands/appendedsig/x509.c

 create mode 100644 grub-core/commands/appendedsig/appendedsig.h

diff --git a/grub-core/commands/appendedsig/asn1util.c b/grub-core/commands/appendedsig/asn1util.c

new file mode 100644

index 00000000000..eff095a9df2

--- /dev/null

+++ b/grub-core/commands/appendedsig/asn1util.c

@@ -0,0 +1,102 @@

+/*

+ *  GRUB  --  GRand Unified Bootloader

+ *  Copyright (C) 2020  IBM Corporation.

+ *

+ *  GRUB is free software: you can redistribute it and/or modify

+ *  it under the terms of the GNU General Public License as published by

+ *  the Free Software Foundation, either version 3 of the License, or

+ *  (at your option) any later version.

+ *

+ *  GRUB is distributed in the hope that it will be useful,

+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of

+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

+ *  GNU General Public License for more details.

+ *

+ *  You should have received a copy of the GNU General Public License

+ *  along with GRUB.  If not, see <http://www.gnu.org/licenses/>.

+ */

+

+#include <grub/libtasn1.h>

+#include <grub/types.h>

+#include <grub/err.h>

+#include <grub/mm.h>

+#include <grub/crypto.h>

+#include <grub/gcrypt/gcrypt.h>

+

+#include "appendedsig.h"

+

+asn1_node _gnutls_gnutls_asn = ASN1_TYPE_EMPTY;

+asn1_node _gnutls_pkix_asn = ASN1_TYPE_EMPTY;

+

+extern const ASN1_ARRAY_TYPE gnutls_asn1_tab[];

+extern const ASN1_ARRAY_TYPE pkix_asn1_tab[];

+

+/*

+ * Read a value from an ASN1 node, allocating memory to store it.

+ *

+ * It will work for anything where the size libtasn1 returns is right:

+ *  - Integers

+ *  - Octet strings

+ *  - DER encoding of other structures

+ * It will _not_ work for things where libtasn1 size requires adjustment:

+ *  - Strings that require an extra NULL byte at the end

+ *  - Bit strings because libtasn1 returns the length in bits, not bytes.

+ *

+ * If the function returns a non-NULL value, the caller must free it.

+ */

+void *

+grub_asn1_allocate_and_read (asn1_node node, const char *name,

+			     const char *friendly_name, int *content_size)

+{

+  int result;

+  grub_uint8_t *tmpstr = NULL;

+  int tmpstr_size = 0;

+

+  result = asn1_read_value (node, name, NULL, &tmpstr_size);

+  if (result != ASN1_MEM_ERROR)

+    {

+      grub_snprintf (grub_errmsg, sizeof (grub_errmsg),

+		     _

+		     ("Reading size of %s did not return expected status: %s"),

+		     friendly_name, asn1_strerror (result));

+      grub_errno = GRUB_ERR_BAD_FILE_TYPE;

+      return NULL;

+    }

+

+  tmpstr = grub_malloc (tmpstr_size);

+  if (tmpstr == NULL)

+    {

+      grub_snprintf (grub_errmsg, sizeof (grub_errmsg),

+		     "Could not allocate memory to store %s", friendly_name);

+      grub_errno = GRUB_ERR_OUT_OF_MEMORY;

+      return NULL;

+    }

+

+  result = asn1_read_value (node, name, tmpstr, &tmpstr_size);

+  if (result != ASN1_SUCCESS)

+    {

+      grub_free (tmpstr);

+      grub_snprintf (grub_errmsg, sizeof (grub_errmsg),

+		     "Error reading %s: %s",

+		     friendly_name, asn1_strerror (result));

+      grub_errno = GRUB_ERR_BAD_FILE_TYPE;

+      return NULL;

+    }

+

+  *content_size = tmpstr_size;

+

+  return tmpstr;

+}

+

+int

+asn1_init (void)

+{

+  int res;

+  res = asn1_array2tree (gnutls_asn1_tab, &_gnutls_gnutls_asn, NULL);

+  if (res != ASN1_SUCCESS)

+    {

+      return res;

+    }

+  res = asn1_array2tree (pkix_asn1_tab, &_gnutls_pkix_asn, NULL);

+  return res;

+}

diff --git a/grub-core/commands/appendedsig/pkcs7.c b/grub-core/commands/appendedsig/pkcs7.c

new file mode 100644

index 00000000000..dc6afe203f7

--- /dev/null

+++ b/grub-core/commands/appendedsig/pkcs7.c

@@ -0,0 +1,305 @@

+/*

+ *  GRUB  --  GRand Unified Bootloader

+ *  Copyright (C) 2020  IBM Corporation.

+ *

+ *  GRUB is free software: you can redistribute it and/or modify

+ *  it under the terms of the GNU General Public License as published by

+ *  the Free Software Foundation, either version 3 of the License, or

+ *  (at your option) any later version.

+ *

+ *  GRUB is distributed in the hope that it will be useful,

+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of

+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

+ *  GNU General Public License for more details.

+ *

+ *  You should have received a copy of the GNU General Public License

+ *  along with GRUB.  If not, see <http://www.gnu.org/licenses/>.

+ */

+

+#include "appendedsig.h"

+#include <grub/misc.h>

+#include <grub/crypto.h>

+#include <grub/gcrypt/gcrypt.h>

+

+

+static char asn1_error[ASN1_MAX_ERROR_DESCRIPTION_SIZE];

+

+/*

+ * RFC 5652 s 5.1

+ */

+const char *signedData_oid = "1.2.840.113549.1.7.2";

+

+/*

+ * RFC 4055 s 2.1

+ */

+const char *sha256_oid = "2.16.840.1.101.3.4.2.1";

+const char *sha512_oid = "2.16.840.1.101.3.4.2.3";

+

+static grub_err_t

+process_content (grub_uint8_t * content, int size,

+		 struct pkcs7_signedData *msg)

+{

+  int res;

+  asn1_node signed_part;

+  grub_err_t err = GRUB_ERR_NONE;

+  char algo_oid[MAX_OID_LEN];

+  int algo_oid_size = sizeof (algo_oid);

+  int algo_count;

+  char version;

+  int version_size = sizeof (version);

+  grub_uint8_t *result_buf;

+  int result_size = 0;

+  int crls_size = 0;

+  gcry_error_t gcry_err;

+

+  res = asn1_create_element (_gnutls_pkix_asn, "PKIX1.pkcs-7-SignedData",

+			     &signed_part);

+  if (res != ASN1_SUCCESS)

+    {

+      return grub_error (GRUB_ERR_OUT_OF_MEMORY,

+			 "Could not create ASN.1 structure for PKCS#7 signed part.");

+    }

+

+  res = asn1_der_decoding2 (&signed_part, content, &size,

+			    ASN1_DECODE_FLAG_STRICT_DER, asn1_error);

+  if (res != ASN1_SUCCESS)

+    {

+      err =

+	grub_error (GRUB_ERR_BAD_SIGNATURE,

+		    "Error reading PKCS#7 signed data: %s", asn1_error);

+      goto cleanup_signed_part;

+    }

+

+  /* SignedData ::= SEQUENCE {

+   *     version CMSVersion,

+   *     digestAlgorithms DigestAlgorithmIdentifiers,

+   *     encapContentInfo EncapsulatedContentInfo,

+   *     certificates [0] IMPLICIT CertificateSet OPTIONAL,

+   *     crls [1] IMPLICIT RevocationInfoChoices OPTIONAL,

+   *     signerInfos SignerInfos }

+   */

+

+  /* version per the algo in 5.1, must be 1 */

+  res = asn1_read_value (signed_part, "version", &version, &version_size);

+  if (res != ASN1_SUCCESS)

+    {

+      err =

+	grub_error (GRUB_ERR_BAD_SIGNATURE,

+		    "Error reading signedData version: %s",

+		    asn1_strerror (res));

+      goto cleanup_signed_part;

+    }

+

+  if (version != 1)

+    {

+      err =

+	grub_error (GRUB_ERR_BAD_SIGNATURE,

+		    "Unexpected signature version v%d, only v1 supported",

+		    version);

+      goto cleanup_signed_part;

+    }

+

+  /*

+   * digestAlgorithms DigestAlgorithmIdentifiers

+   *

+   * DigestAlgorithmIdentifiers ::= SET OF DigestAlgorithmIdentifier

+   * DigestAlgorithmIdentifer is an X.509 AlgorithmIdentifier (10.1.1)

+   * 

+   * RFC 4055 s 2.1:

+   * sha256Identifier  AlgorithmIdentifier  ::=  { id-sha256, NULL }

+   * sha512Identifier  AlgorithmIdentifier  ::=  { id-sha512, NULL }

+   *

+   * We only support 1 element in the set, and we do not check parameters atm.

+   */

+  res =

+    asn1_number_of_elements (signed_part, "digestAlgorithms", &algo_count);

+  if (res != ASN1_SUCCESS)

+    {

+      err =

+	grub_error (GRUB_ERR_BAD_SIGNATURE,

+		    "Error counting number of digest algorithms: %s",

+		    asn1_strerror (res));

+      goto cleanup_signed_part;

+    }

+

+  if (algo_count != 1)

+    {

+      err =

+	grub_error (GRUB_ERR_NOT_IMPLEMENTED_YET,

+		    "Only 1 digest algorithm is supported");

+      goto cleanup_signed_part;

+    }

+

+  res =

+    asn1_read_value (signed_part, "digestAlgorithms.?1.algorithm", algo_oid,

+		     &algo_oid_size);

+  if (res != ASN1_SUCCESS)

+    {

+      err =

+	grub_error (GRUB_ERR_BAD_SIGNATURE,

+		    "Error reading digest algorithm: %s",

+		    asn1_strerror (res));

+      goto cleanup_signed_part;

+    }

+

+  if (grub_strncmp (sha512_oid, algo_oid, algo_oid_size) == 0)

+    {

+      msg->hash = grub_crypto_lookup_md_by_name ("sha512");

+    }

+  else if (grub_strncmp (sha256_oid, algo_oid, algo_oid_size) == 0)

+    {

+      msg->hash = grub_crypto_lookup_md_by_name ("sha256");

+    }

+  else

+    {

+      err =

+	grub_error (GRUB_ERR_NOT_IMPLEMENTED_YET,

+		    "Only SHA-256 and SHA-512 hashes are supported, found OID %s",

+		    algo_oid);

+      goto cleanup_signed_part;

+    }

+

+  if (!msg->hash)

+    {

+      err =

+	grub_error (GRUB_ERR_BAD_SIGNATURE,

+		    "Hash algorithm for OID %s not loaded", algo_oid);

+      goto cleanup_signed_part;

+    }

+

+  /*

+   * We ignore the certificates, but we don't permit CRLs.

+   * A CRL entry might be revoking the certificate we're using, and we have

+   * no way of dealing with that at the moment.

+   */

+  res = asn1_read_value (signed_part, "crls", NULL, &crls_size);

+  if (res != ASN1_ELEMENT_NOT_FOUND)

+    {

+      err =

+	grub_error (GRUB_ERR_NOT_IMPLEMENTED_YET,

+		    "PKCS#7 messages with embedded CRLs are not supported");

+      goto cleanup_signed_part;

+    }

+

+  /* read the signature */

+  result_buf =

+    grub_asn1_allocate_and_read (signed_part, "signerInfos.?1.signature",

+				 "signature data", &result_size);

+  if (!result_buf)

+    {

+      err = grub_errno;

+      goto cleanup_signed_part;

+    }

+

+  gcry_err =

+    gcry_mpi_scan (&(msg->sig_mpi), GCRYMPI_FMT_USG, result_buf, result_size,

+		   NULL);

+  if (gcry_err != GPG_ERR_NO_ERROR)

+    {

+      err =

+	grub_error (GRUB_ERR_BAD_SIGNATURE,

+		    "Error loading signature into MPI structure: %d",

+		    gcry_err);

+      goto cleanup_result;

+    }

+

+cleanup_result:

+  grub_free (result_buf);

+cleanup_signed_part:

+  asn1_delete_structure (&signed_part);

+

+  return err;

+}

+

+grub_err_t

+parse_pkcs7_signedData (void *sigbuf, grub_size_t data_size,

+			struct pkcs7_signedData *msg)

+{

+  int res;

+  asn1_node content_info;

+  grub_err_t err = GRUB_ERR_NONE;

+  char content_oid[MAX_OID_LEN];

+  grub_uint8_t *content;

+  int content_size;

+  int content_oid_size = sizeof (content_oid);

+  int size;

+

+  if (data_size > GRUB_INT_MAX)

+    return grub_error (GRUB_ERR_OUT_OF_RANGE,

+		       "Cannot parse a PKCS#7 message where data size > INT_MAX");

+  size = (int) data_size;

+

+  res = asn1_create_element (_gnutls_pkix_asn,

+			     "PKIX1.pkcs-7-ContentInfo", &content_info);

+  if (res != ASN1_SUCCESS)

+    {

+      return grub_error (GRUB_ERR_OUT_OF_MEMORY,

+			 "Could not create ASN.1 structure for PKCS#7 data: %s",

+			 asn1_strerror (res));

+    }

+

+  res = asn1_der_decoding2 (&content_info, sigbuf, &size,

+			    ASN1_DECODE_FLAG_STRICT_DER, asn1_error);

+  if (res != ASN1_SUCCESS)

+    {

+      err =

+	grub_error (GRUB_ERR_BAD_SIGNATURE,

+		    "Error decoding PKCS#7 message DER: %s", asn1_error);

+      goto cleanup;

+    }

+

+  /*

+   * ContentInfo ::= SEQUENCE {

+   *     contentType ContentType,

+   *     content [0] EXPLICIT ANY DEFINED BY contentType }

+   *

+   * ContentType ::= OBJECT IDENTIFIER

+   */

+  res =

+    asn1_read_value (content_info, "contentType", content_oid,

+		     &content_oid_size);

+  if (res != ASN1_SUCCESS)

+    {

+      err =

+	grub_error (GRUB_ERR_BAD_SIGNATURE,

+		    "Error reading PKCS#7 content type: %s",

+		    asn1_strerror (res));

+      goto cleanup;

+    }

+

+  /* OID for SignedData defined in 5.1 */

+  if (grub_strncmp (signedData_oid, content_oid, content_oid_size) != 0)

+    {

+      err =

+	grub_error (GRUB_ERR_BAD_SIGNATURE,

+		    "Unexpected content type in PKCS#7 message: OID %s",

+		    content_oid);

+      goto cleanup;

+    }

+

+  content =

+    grub_asn1_allocate_and_read (content_info, "content",

+				 "PKCS#7 message content", &content_size);

+  if (!content)

+    {

+      err = grub_errno;

+      goto cleanup;

+    }

+

+  err = process_content (content, content_size, msg);

+  grub_free (content);

+

+cleanup:

+  asn1_delete_structure (&content_info);

+  return err;

+}

+

+/*

+ * Release all the storage associated with the PKCS#7 message.

+ * If the caller dynamically allocated the message, it must free it.

+ */

+void

+pkcs7_signedData_release (struct pkcs7_signedData *msg)

+{

+  gcry_mpi_release (msg->sig_mpi);

+}

diff --git a/grub-core/commands/appendedsig/x509.c b/grub-core/commands/appendedsig/x509.c

new file mode 100644

index 00000000000..2b38b3670a2

--- /dev/null

+++ b/grub-core/commands/appendedsig/x509.c

@@ -0,0 +1,958 @@

+/*

+ *  GRUB  --  GRand Unified Bootloader

+ *  Copyright (C) 2020  IBM Corporation.

+ *

+ *  GRUB is free software: you can redistribute it and/or modify

+ *  it under the terms of the GNU General Public License as published by

+ *  the Free Software Foundation, either version 3 of the License, or

+ *  (at your option) any later version.

+ *

+ *  GRUB is distributed in the hope that it will be useful,

+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of

+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

+ *  GNU General Public License for more details.

+ *

+ *  You should have received a copy of the GNU General Public License

+ *  along with GRUB.  If not, see <http://www.gnu.org/licenses/>.

+ */

+

+#include <grub/libtasn1.h>

+#include <grub/types.h>

+#include <grub/err.h>

+#include <grub/mm.h>

+#include <grub/crypto.h>

+#include <grub/gcrypt/gcrypt.h>

+

+#include "appendedsig.h"

+

+static char asn1_error[ASN1_MAX_ERROR_DESCRIPTION_SIZE];

+

+/*

+ * RFC 3279 2.3.1  RSA Keys

+ */

+const char *rsaEncryption_oid = "1.2.840.113549.1.1.1";

+

+/*

+ * RFC 5280 Appendix A

+ */

+const char *commonName_oid = "2.5.4.3";

+

+/*

+ * RFC 5280 4.2.1.3 Key Usage

+ */

+const char *keyUsage_oid = "2.5.29.15";

+

+/*

+ * RFC 5280 4.2.1.9 Basic Constraints

+ */

+const char *basicConstraints_oid = "2.5.29.19";

+

+/*

+ * RFC 3279 2.3.1

+ *

+ *  The RSA public key MUST be encoded using the ASN.1 type RSAPublicKey:

+ *

+ *     RSAPublicKey ::= SEQUENCE {

+ *        modulus            INTEGER,    -- n

+ *        publicExponent     INTEGER  }  -- e

+ *

+ *  where modulus is the modulus n, and publicExponent is the public

+ *  exponent e.

+ */

+static grub_err_t

+grub_parse_rsa_pubkey (grub_uint8_t * der, int dersize,

+		       struct x509_certificate *certificate)

+{

+  int result;

+  asn1_node spk = ASN1_TYPE_EMPTY;

+  grub_uint8_t *m_data, *e_data;

+  int m_size, e_size;

+  grub_err_t err = GRUB_ERR_NONE;

+  gcry_error_t gcry_err;

+

+  result =

+    asn1_create_element (_gnutls_gnutls_asn, "GNUTLS.RSAPublicKey", &spk;;

+  if (result != ASN1_SUCCESS)

+    {

+      return grub_error (GRUB_ERR_OUT_OF_MEMORY,

+			 "Cannot create storage for public key ASN.1 data");

+    }

+

+  result = asn1_der_decoding2 (&spk, der, &dersize,

+			       ASN1_DECODE_FLAG_STRICT_DER, asn1_error);

+  if (result != ASN1_SUCCESS)

+    {

+      err =

+	grub_error (GRUB_ERR_BAD_FILE_TYPE,

+		    "Cannot decode certificate public key DER: %s",

+		    asn1_error);

+      goto cleanup;

+    }

+

+  m_data =

+    grub_asn1_allocate_and_read (spk, "modulus", "RSA modulus", &m_size);

+  if (!m_data)

+    {

+      err = grub_errno;

+      goto cleanup;

+    }

+

+  e_data =

+    grub_asn1_allocate_and_read (spk, "publicExponent", "RSA public exponent",

+				 &e_size);

+  if (!e_data)

+    {

+      err = grub_errno;

+      goto cleanup_m_data;

+    }

+

+  /*

+   * convert m, e to mpi

+   *

+   * nscanned is not set for FMT_USG, it's only set for FMT_PGP, 

+   * so we can't verify it

+   */

+  gcry_err =

+    gcry_mpi_scan (&certificate->mpis[0], GCRYMPI_FMT_USG, m_data, m_size,

+		   NULL);

+  if (gcry_err != GPG_ERR_NO_ERROR)

+    {

+      err =

+	grub_error (GRUB_ERR_BAD_FILE_TYPE,

+		    "Error loading RSA modulus into MPI structure: %d",

+		    gcry_err);

+      goto cleanup_e_data;

+    }

+

+  gcry_err =

+    gcry_mpi_scan (&certificate->mpis[1], GCRYMPI_FMT_USG, e_data, e_size,

+		   NULL);

+  if (gcry_err != GPG_ERR_NO_ERROR)

+    {

+      err =

+	grub_error (GRUB_ERR_BAD_FILE_TYPE,

+		    "Error loading RSA exponent into MPI structure: %d",

+		    gcry_err);

+      goto cleanup_m_mpi;

+    }

+

+  grub_free (e_data);

+  grub_free (m_data);

+  asn1_delete_structure (&spk;;

+  return GRUB_ERR_NONE;

+

+cleanup_m_mpi:

+  gcry_mpi_release (certificate->mpis[0]);

+cleanup_e_data:

+  grub_free (e_data);

+cleanup_m_data:

+  grub_free (m_data);

+cleanup:

+  asn1_delete_structure (&spk;;

+  return err;

+}

+

+

+/*

+ * RFC 5280:

+ *   SubjectPublicKeyInfo  ::=  SEQUENCE  {

+ *       algorithm            AlgorithmIdentifier,

+ *       subjectPublicKey     BIT STRING  }

+ *

+ * AlgorithmIdentifiers come from RFC 3279, we are not strictly compilant as we

+ * only support RSA Encryption.

+ */

+

+static grub_err_t

+grub_x509_read_subject_public_key (asn1_node asn,

+				   struct x509_certificate *results)

+{

+  int result;

+  grub_err_t err;

+  const char *algo_name =

+    "tbsCertificate.subjectPublicKeyInfo.algorithm.algorithm";

+  const char *params_name =

+    "tbsCertificate.subjectPublicKeyInfo.algorithm.parameters";

+  const char *pk_name =

+    "tbsCertificate.subjectPublicKeyInfo.subjectPublicKey";

+  char algo_oid[MAX_OID_LEN];

+  int algo_size = sizeof (algo_oid);

+  char params_value[2];

+  int params_size = sizeof (params_value);

+  grub_uint8_t *key_data = NULL;

+  int key_size = 0;

+  unsigned int key_type;

+

+  /* algorithm: see notes for rsaEncryption_oid */

+  result = asn1_read_value (asn, algo_name, algo_oid, &algo_size);

+  if (result != ASN1_SUCCESS)

+    {

+      return grub_error (GRUB_ERR_BAD_FILE_TYPE,

+			 "Error reading x509 public key algorithm: %s",

+			 asn1_strerror (result));

+    }

+

+  if (grub_strncmp (algo_oid, rsaEncryption_oid, sizeof (rsaEncryption_oid))

+      != 0)

+    {

+      return grub_error (GRUB_ERR_NOT_IMPLEMENTED_YET,

+			 "Unsupported x509 public key algorithm: %s",

+			 algo_oid);

+    }

+

+  /* 

+   * RFC 3279 2.3.1

+   * The rsaEncryption OID is intended to be used in the algorithm field

+   * of a value of type AlgorithmIdentifier.  The parameters field MUST

+   * have ASN.1 type NULL for this algorithm identifier.

+   */

+  result = asn1_read_value (asn, params_name, params_value, &params_size);

+  if (result != ASN1_SUCCESS)

+    {

+      return grub_error (GRUB_ERR_BAD_FILE_TYPE,

+			 "Error reading x509 public key parameters: %s",

+			 asn1_strerror (result));

+    }

+

+  if (params_value[0] != ASN1_TAG_NULL)

+    {

+      return grub_error (GRUB_ERR_BAD_FILE_TYPE,

+			 "Invalid x509 public key parameters: expected NULL");

+    }

+

+  /*

+   * RFC 3279 2.3.1:  The DER encoded RSAPublicKey is the value of the BIT

+   * STRING subjectPublicKey.

+   */

+  result = asn1_read_value_type (asn, pk_name, NULL, &key_size, &key_type);

+  if (result != ASN1_MEM_ERROR)

+    {

+      return grub_error (GRUB_ERR_BAD_FILE_TYPE,

+			 "Error reading size of x509 public key: %s",

+			 asn1_strerror (result));

+    }

+  if (key_type != ASN1_ETYPE_BIT_STRING)

+    {

+      return grub_error (GRUB_ERR_BAD_FILE_TYPE,

+			 "Unexpected ASN.1 type when reading x509 public key: %x",

+			 key_type);

+    }

+

+  /* length is in bits */

+  key_size = (key_size + 7) / 8;

+

+  key_data = grub_malloc (key_size);

+  if (!key_data)

+    {

+      return grub_error (GRUB_ERR_OUT_OF_MEMORY,

+			 "Out of memory for x509 public key");

+    }

+

+  result = asn1_read_value (asn, pk_name, key_data, &key_size);

+  if (result != ASN1_SUCCESS)

+    {

+      grub_free (key_data);

+      return grub_error (GRUB_ERR_BAD_FILE_TYPE,

+			 "Error reading public key data");

+    }

+  key_size = (key_size + 7) / 8;

+

+  err = grub_parse_rsa_pubkey (key_data, key_size, results);

+  grub_free (key_data);

+

+  return err;

+}

+