diff options
| author | Michael Stahl <michael.stahl@allotropia.de> | 2023-12-08 21:16:31 +0100 |
|---|---|---|
| committer | Michael Stahl <michael.stahl@allotropia.de> | 2023-12-12 10:40:42 +0100 |
| commit | 1fbad81c1e28fae31c655c637a513405c3e62317 (patch) | |
| tree | 90bb529b9408c5a422c76cd2fe5dbe49f608c67f /sfx2 | |
| parent | 1345eba186501f75d9bc814875d7946a36679796 (diff) | |
tdf#105844 offapi,package,sfx2,xmlsecurity: add AEAD w/ AES GCM
... and use it in the new experimental ODF encryption mode.
https://www.w3.org/TR/xmlenc-core1/#sec-AES-GCM
Unfortunately it turned out that NSS PK11_CipherOp() does not work with
CKM_AES_GCM because it is initialized with "context->multi = PR_FALSE"
in sftk_CryptInit(), so the one-step functions PK11_Encrypt() and
PK11_Decrypt() have to be used.
NSS 3.52 also changed a parameter struct definition - see
https://fedoraproject.org/wiki/Changes/NssGCMParams - which is not a
problem for RHEL or SUSE system NSS since those are rebased, but it
is likely a problem for less well maintained Ubuntu LTS, so use
the old struct definition which evidently still works with NSS 3.94.
NSS 3.52 also added a new PK11_AEADOp() API but it looks like this
doesn't support incremental encryption either.
Change-Id: Ibd4a672db74b65b1218926ba35ff8d2f70444c7e
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/160505
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
(cherry picked from commit f0fda7ad2236f478fea396a23d4f982e5fc37e68)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/160581
Diffstat (limited to 'sfx2')
| -rw-r--r-- | sfx2/source/doc/objstor.cxx | 20 |
1 files changed, 16 insertions, 4 deletions
diff --git a/sfx2/source/doc/objstor.cxx b/sfx2/source/doc/objstor.cxx index 598b85aa07e8..8a303d1c331f 100644 --- a/sfx2/source/doc/objstor.cxx +++ b/sfx2/source/doc/objstor.cxx @@ -167,6 +167,11 @@ bool SfxObjectShell::QuerySlotExecutable( sal_uInt16 /*nSlotId*/ ) return true; } +static bool UseODFWholesomeEncryption(SvtSaveOptions::ODFSaneDefaultVersion const nODFVersion) +{ + return nODFVersion == SvtSaveOptions::ODFSVER_LATEST_EXTENDED + && officecfg::Office::Common::Misc::ExperimentalMode::get(); +} bool GetEncryptionData_Impl( const SfxItemSet* pSet, uno::Sequence< beans::NamedValue >& o_rEncryptionData ) { @@ -358,8 +363,16 @@ void SfxObjectShell::SetupStorage( const uno::Reference< embed::XStorage >& xSto auto pEncryptionAlgs = aEncryptionAlgs.getArray(); pEncryptionAlgs[0].Value <<= xml::crypto::DigestID::SHA256; - pEncryptionAlgs[2].Value <<= xml::crypto::DigestID::SHA256_1K; - pEncryptionAlgs[1].Value <<= xml::crypto::CipherID::AES_CBC_W3C_PADDING; + if (UseODFWholesomeEncryption(nDefVersion)) + { + pEncryptionAlgs[1].Value <<= xml::crypto::CipherID::AES_GCM_W3C; + pEncryptionAlgs[2].Value <<= xml::crypto::DigestID::SHA256_1K; + } + else + { + pEncryptionAlgs[1].Value <<= xml::crypto::CipherID::AES_CBC_W3C_PADDING; + pEncryptionAlgs[2].Value <<= xml::crypto::DigestID::SHA256_1K; + } } try @@ -1225,8 +1238,7 @@ bool SfxObjectShell::SaveTo_Impl if (GetEncryptionData_Impl(&rMedium.GetItemSet(), aEncryptionData)) { assert(aEncryptionData.getLength() != 0); - if (bOwnTarget && nVersion == SvtSaveOptions::ODFSVER_LATEST_EXTENDED - && officecfg::Office::Common::Misc::ExperimentalMode::get()) + if (bOwnTarget && UseODFWholesomeEncryption(nVersion)) { // when embedded objects are stored here, it should be called from // this function for the root document and encryption data was cleared |