Skip to content

Commit 9c02b4f

Browse files
RasmusWLRasmusWL
authored
Merge pull request github#14289 from microsoft/jb1/16-cryptography-models-libraries-and-queries-migration
16 cryptography models libraries and queries migration
2 parents 99646ba + de2e8b0 commit 9c02b4f

File tree

75 files changed

+19025
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

75 files changed

+19025
-0
lines changed

‎cpp/ql/lib/experimental/cryptography/Concepts.qll

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
import experimental.cryptography.CryptoArtifact
2+
import experimental.cryptography.CryptoAlgorithmNames
3+
import experimental.cryptography.modules.OpenSSL as OpenSSL

‎cpp/ql/lib/experimental/cryptography/CryptoAlgorithmNames.qll

Lines changed: 239 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,239 @@
1+
/**
2+
* Names of known cryptographic algorithms.
3+
* The names are standardized into upper-case, no spaces, dashes or underscores.
4+
*/
5+
6+
/**
7+
* Returns a string to represent generally unknown algorithms.
8+
* Predicate is to be used to get a consistent string representation
9+
* for unknown algorithms.
10+
*/
11+
string unknownAlgorithm() { result = "UNKNOWN" }
12+
13+
string getHashType() { result = "HASH" }
14+
15+
string getSymmetricEncryptionType() { result = "SYMMETRIC_ENCRYPTION" }
16+
17+
string getAsymmetricEncryptionType() { result = "ASYMMETRIC_ENCRYPTION" }
18+
19+
string getKeyDerivationType() { result = "KEY_DERIVATION" }
20+
21+
string getCipherBlockModeType() { result = "BLOCK_MODE" }
22+
23+
string getSymmetricPaddingType() { result = "SYMMETRIC_PADDING" }
24+
25+
string getAsymmetricPaddingType() { result = "ASYMMETRIC_PADDING" }
26+
27+
string getEllipticCurveType() { result = "ELLIPTIC_CURVE" }
28+
29+
string getSignatureType() { result = "SIGNATURE" }
30+
31+
string getKeyExchangeType() { result = "KEY_EXCHANGE" }
32+
33+
string getAsymmetricType() {
34+
result in [
35+
getAsymmetricEncryptionType(), getSignatureType(), getKeyExchangeType(),
36+
getEllipticCurveType()
37+
]
38+
}
39+
40+
predicate isKnownType(string algType) {
41+
algType in [
42+
getHashType(), getSymmetricEncryptionType(), getAsymmetricEncryptionType(),
43+
getKeyDerivationType(), getCipherBlockModeType(), getSymmetricPaddingType(),
44+
getAsymmetricPaddingType(), getEllipticCurveType(), getSignatureType(), getKeyExchangeType()
45+
]
46+
}
47+
48+
predicate isKnownAlgorithm(string name) { isKnownAlgorithm(name, _) }
49+
50+
predicate isKnownAlgorithm(string name, string algType) {
51+
isHashingAlgorithm(name) and algType = "HASH"
52+
or
53+
isEncryptionAlgorithm(name, algType) and
54+
algType in ["SYMMETRIC_ENCRYPTION", "ASYMMETRIC_ENCRYPTION"]
55+
or
56+
isKeyDerivationAlgorithm(name) and algType = "KEY_DERIVATION"
57+
or
58+
isCipherBlockModeAlgorithm(name) and algType = "BLOCK_MODE"
59+
or
60+
isPaddingAlgorithm(name, algType) and algType in ["SYMMETRIC_PADDING", "ASYMMETRIC_PADDING"]
61+
or
62+
isEllipticCurveAlgorithm(name) and algType = "ELLIPTIC_CURVE"
63+
or
64+
isSignatureAlgorithm(name) and algType = "SIGNATURE"
65+
or
66+
isKeyExchangeAlgorithm(name) and algType = "KEY_EXCHANGE"
67+
}
68+
69+
/**
70+
* Holds if `name` is a known hashing algorithm in the model/library.
71+
*/
72+
predicate isHashingAlgorithm(string name) {
73+
name =
74+
[
75+
"BLAKE2", "BLAKE2B", "BLAKE2S", "SHA2", "SHA224", "SHA256", "SHA384", "SHA512", "SHA512224",
76+
"SHA512256", "SHA3", "SHA3224", "SHA3256", "SHA3384", "SHA3512", "SHAKE128", "SHAKE256",
77+
"SM3", "WHIRLPOOL", "POLY1305", "HAVEL128", "MD2", "MD4", "MD5", "PANAMA", "RIPEMD",
78+
"RIPEMD128", "RIPEMD256", "RIPEMD160", "RIPEMD320", "SHA0", "SHA1", "SHA", "MGF1", "MGF1SHA1",
79+
"MDC2", "SIPHASH"
80+
]
81+
}
82+
83+
predicate isEncryptionAlgorithm(string name, string algType) {
84+
isAsymmetricEncryptionAlgorithm(name) and algType = "ASYMMETRIC_ENCRYPTION"
85+
or
86+
isSymmetricEncryptionAlgorithm(name) and algType = "SYMMETRIC_ENCRYPTION"
87+
}
88+
89+
predicate isEncryptionAlgorithm(string name) { isEncryptionAlgorithm(name, _) }
90+
91+
/**
92+
* Holds if `name` corresponds to a known symmetric encryption algorithm.
93+
*/
94+
predicate isSymmetricEncryptionAlgorithm(string name) {
95+
// NOTE: AES is meant to caputure all possible key lengths
96+
name =
97+
[
98+
"AES", "AES128", "AES192", "AES256", "ARIA", "BLOWFISH", "BF", "ECIES", "CAST", "CAST5",
99+
"CAMELLIA", "CAMELLIA128", "CAMELLIA192", "CAMELLIA256", "CHACHA", "CHACHA20",
100+
"CHACHA20POLY1305", "GOST", "GOSTR34102001", "GOSTR341094", "GOSTR341194", "GOST2814789",
101+
"GOSTR341194", "GOST2814789", "GOST28147", "GOSTR341094", "GOST89", "GOST94", "GOST34102012",
102+
"GOST34112012", "IDEA", "RABBIT", "SEED", "SM4", "DES", "DESX", "3DES", "TDES", "2DES",
103+
"DES3", "TRIPLEDES", "TDEA", "TRIPLEDEA", "ARC2", "RC2", "ARC4", "RC4", "ARCFOUR", "ARC5",
104+
"RC5", "MAGMA", "KUZNYECHIK"
105+
]
106+
}
107+
108+
/**
109+
* Holds if `name` corresponds to a known key derivation algorithm.
110+
*/
111+
predicate isKeyDerivationAlgorithm(string name) {
112+
name =
113+
[
114+
"ARGON2", "CONCATKDF", "CONCATKDFHASH", "CONCATKDFHMAC", "KBKDFCMAC", "BCRYPT", "HKDF",
115+
"HKDFEXPAND", "KBKDF", "KBKDFHMAC", "PBKDF1", "PBKDF2", "PBKDF2HMAC", "PKCS5", "SCRYPT",
116+
"X963KDF", "EVPKDF"
117+
]
118+
}
119+
120+
/**
121+
* Holds if `name` corresponds to a known cipher block mode
122+
*/
123+
predicate isCipherBlockModeAlgorithm(string name) {
124+
name = ["CBC", "GCM", "CCM", "CFB", "OFB", "CFB8", "CTR", "OPENPGP", "XTS", "EAX", "SIV", "ECB"]
125+
}
126+
127+
/**
128+
* Holds if `name` corresponds to a known padding algorithm
129+
*/
130+
predicate isPaddingAlgorithm(string name, string algType) {
131+
isSymmetricPaddingAlgorithm(name) and algType = "SYMMETRIC_PADDING"
132+
or
133+
isAsymmetricPaddingAlgorithm(name) and algType = "ASYMMETRIC_PADDING"
134+
}
135+
136+
/**
137+
* holds if `name` corresponds to a known symmetric padding algorithm
138+
*/
139+
predicate isSymmetricPaddingAlgorithm(string name) { name = ["PKCS7", "ANSIX923"] }
140+
141+
/**
142+
* Holds if `name` corresponds to a known asymmetric padding algorithm
143+
*/
144+
predicate isAsymmetricPaddingAlgorithm(string name) { name = ["OAEP", "PKCS1V15", "PSS", "KEM"] }
145+
146+
predicate isBrainpoolCurve(string curveName, int keySize) {
147+
// ALL BRAINPOOL CURVES
148+
keySize in [160, 192, 224, 256, 320, 384, 512] and
149+
(
150+
curveName = "BRAINPOOLP" + keySize.toString() + "R1"
151+
or
152+
curveName = "BRAINPOOLP" + keySize.toString() + "T1"
153+
)
154+
}
155+
156+
predicate isSecCurve(string curveName, int keySize) {
157+
// ALL SEC CURVES
158+
keySize in [112, 113, 128, 131, 160, 163, 192, 193, 224, 233, 239, 256, 283, 384, 409, 521, 571] and
159+
exists(string suff | suff in ["R1", "R2", "K1"] |
160+
curveName = "SECT" + keySize.toString() + suff or
161+
curveName = "SECP" + keySize.toString() + suff
162+
)
163+
}
164+
165+
predicate isC2Curve(string curveName, int keySize) {
166+
// ALL C2 CURVES
167+
keySize in [163, 176, 191, 208, 239, 272, 304, 359, 368, 431] and
168+
exists(string pre, string suff |
169+
pre in ["PNB", "ONB", "TNB"] and suff in ["V1", "V2", "V3", "V4", "V5", "W1", "R1"]
170+
|
171+
curveName = "C2" + pre + keySize.toString() + suff
172+
)
173+
}
174+
175+
predicate isPrimeCurve(string curveName, int keySize) {
176+
// ALL PRIME CURVES
177+
keySize in [192, 239, 256] and
178+
exists(string suff | suff in ["V1", "V2", "V3"] | curveName = "PRIME" + keySize.toString() + suff)
179+
}
180+
181+
predicate isEllipticCurveAlgorithm(string curveName) { isEllipticCurveAlgorithm(curveName, _) }
182+
183+
/**
184+
* Holds if `name` corresponds to a known elliptic curve.
185+
*/
186+
predicate isEllipticCurveAlgorithm(string curveName, int keySize) {
187+
isSecCurve(curveName, keySize)
188+
or
189+
isBrainpoolCurve(curveName, keySize)
190+
or
191+
isC2Curve(curveName, keySize)
192+
or
193+
isPrimeCurve(curveName, keySize)
194+
or
195+
curveName = "ES256" and keySize = 256
196+
or
197+
curveName = "CURVE25519" and keySize = 255
198+
or
199+
curveName = "X25519" and keySize = 255
200+
or
201+
curveName = "ED25519" and keySize = 255
202+
or
203+
curveName = "CURVE448" and keySize = 448 // TODO: need to check the key size
204+
or
205+
curveName = "ED448" and keySize = 448
206+
or
207+
curveName = "X448" and keySize = 448
208+
or
209+
curveName = "NUMSP256T1" and keySize = 256
210+
or
211+
curveName = "NUMSP384T1" and keySize = 384
212+
or
213+
curveName = "NUMSP512T1" and keySize = 512
214+
or
215+
curveName = "SM2" and keySize in [256, 512]
216+
}
217+
218+
/**
219+
* Holds if `name` corresponds to a known signature algorithm.
220+
*/
221+
predicate isSignatureAlgorithm(string name) {
222+
name =
223+
[
224+
"DSA", "ECDSA", "EDDSA", "ES256", "ES256K", "ES384", "ES512", "ED25519", "ED448", "ECDSA256",
225+
"ECDSA384", "ECDSA512"
226+
]
227+
}
228+
229+
/**
230+
* Holds if `name` is a key exchange algorithm.
231+
*/
232+
predicate isKeyExchangeAlgorithm(string name) {
233+
name = ["ECDH", "DH", "DIFFIEHELLMAN", "X25519", "X448"]
234+
}
235+
236+
/**
237+
* Holds if `name` corresponds to a known asymmetric encryption.
238+
*/
239+
predicate isAsymmetricEncryptionAlgorithm(string name) { name = ["RSA"] }

0 commit comments

Comments
 (0)