Skip to content

Commit e344505

Browse files
fcasalfcasal
committed
quantum-c#: refactor AVCs for hashes and signatures.
1 parent f3c436a commit e344505

File tree

5 files changed

+58
-69
lines changed

5 files changed

+58
-69
lines changed

‎csharp/ql/lib/experimental/quantum/dotnet/AlgorithmInstances.qll‎

Lines changed: 0 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -27,33 +27,9 @@ abstract class SigningAlgorithmInstance extends Crypto::KeyOperationAlgorithmIns
2727

2828
override Crypto::ConsumerInputDataFlowNode getKeySizeConsumer() { none() }
2929

30-
3130
override int getKeySizeFixed() { none() }
3231
}
3332

34-
class EcdsaAlgorithmInstance extends SigningAlgorithmInstance instanceof SigningCreateCall {
35-
EcdsaAlgorithmInstance() { this instanceof ECDsaCreateCall }
36-
37-
EcdsaAlgorithmValueConsumer getConsumer() { result = super.getQualifier() }
38-
39-
override string getRawAlgorithmName() { result = "ECDsa" }
40-
41-
override Crypto::KeyOpAlg::Algorithm getAlgorithmType() {
42-
result = Crypto::KeyOpAlg::TSignature(Crypto::KeyOpAlg::ECDSA())
43-
}
44-
}
45-
46-
class RsaAlgorithmInstance extends SigningAlgorithmInstance {
47-
RsaAlgorithmInstance() { this = any(RSACreateCall c).getQualifier() }
48-
49-
override string getRawAlgorithmName() { result = "RSA" }
50-
51-
override Crypto::KeyOpAlg::Algorithm getAlgorithmType() {
52-
// TODO there is no RSA TSignature type, so we use OtherSignatureAlgorithmType
53-
result = Crypto::KeyOpAlg::TSignature(Crypto::KeyOpAlg::OtherSignatureAlgorithmType())
54-
}
55-
}
56-
5733
class HashAlgorithmNameInstance extends Crypto::HashAlgorithmInstance instanceof HashAlgorithmName {
5834
HashAlgorithmNameConsumer consumer;
5935

‎csharp/ql/lib/experimental/quantum/dotnet/AlgorithmValueConsumers.qll‎

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -4,18 +4,6 @@ private import AlgorithmInstances
44
private import OperationInstances
55
private import Cryptography
66

7-
class EcdsaAlgorithmValueConsumer extends Crypto::AlgorithmValueConsumer {
8-
ECDsaCreateCall call;
9-
10-
EcdsaAlgorithmValueConsumer() { this = call.getAlgorithmArg() }
11-
12-
override Crypto::ConsumerInputDataFlowNode getInputNode() { result.asExpr() = this }
13-
14-
override Crypto::AlgorithmInstance getAKnownAlgorithmSource() {
15-
exists(EcdsaAlgorithmInstance l | l.getConsumer() = this and result = l)
16-
}
17-
}
18-
197
class HashAlgorithmNameConsumer extends Crypto::AlgorithmValueConsumer {
208
HashAlgorithmNameUser call;
219

‎csharp/ql/lib/experimental/quantum/dotnet/Cryptography.qll‎

Lines changed: 55 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ class HashAlgorithmType extends CryptographyType {
3737
// This class models Create calls for the ECDsa and RSA classes in .NET.
3838
class CryptographyCreateCall extends MethodCall {
3939
CryptographyCreateCall() {
40-
this.getTarget().getName() = "Create" and
40+
this.getTarget().hasName("Create") and
4141
this.getQualifier().getType() instanceof CryptographyType
4242
}
4343

@@ -58,27 +58,35 @@ class CryptographyCreateCall extends MethodCall {
5858
}
5959
}
6060

61-
class ECDsaCreateCall extends CryptographyCreateCall {
62-
ECDsaCreateCall() { this.getQualifier().getType().hasName("ECDsa") }
61+
class EcdsaType extends CryptographyType {
62+
EcdsaType() { this.hasName("ECDsa") }
63+
}
64+
65+
class RsaType extends CryptographyType {
66+
RsaType() { this.hasName("RSA") }
67+
}
68+
69+
class EcdsaCreateCall extends CryptographyCreateCall {
70+
EcdsaCreateCall() { this.getQualifier().getType().hasName("ECDsa") }
6371
}
6472

6573
// This class is used to model the `ECDsa.Create(ECParameters)` call
66-
class ECDsaCreateCallWithParameters extends ECDsaCreateCall {
74+
class ECDsaCreateCallWithParameters extends EcdsaCreateCall {
6775
ECDsaCreateCallWithParameters() { this.getArgument(0).getType() instanceof ECParameters }
6876
}
6977

70-
class ECDsaCreateCallWithECCurve extends ECDsaCreateCall {
78+
class ECDsaCreateCallWithECCurve extends EcdsaCreateCall {
7179
ECDsaCreateCallWithECCurve() { this.getArgument(0).getType() instanceof ECCurve }
7280
}
7381

74-
class RSACreateCall extends CryptographyCreateCall {
75-
RSACreateCall() { this.getQualifier().getType().hasName("RSA") }
82+
class RsaCreateCall extends CryptographyCreateCall {
83+
RsaCreateCall() { this.getQualifier().getType().hasName("RSA") }
7684
}
7785

7886
class SigningCreateCall extends CryptographyCreateCall {
7987
SigningCreateCall() {
80-
this instanceof ECDsaCreateCall or
81-
this instanceof RSACreateCall
88+
this instanceof EcdsaCreateCall or
89+
this instanceof RsaCreateCall
8290
}
8391
}
8492

@@ -95,10 +103,9 @@ class HashAlgorithmCreateCall extends Crypto::AlgorithmValueConsumer instanceof
95103
override Crypto::ConsumerInputDataFlowNode getInputNode() { none() }
96104
}
97105

98-
class HashAlgorithmQualifier extends Crypto::HashAlgorithmInstance instanceof Expr {
99-
HashAlgorithmQualifier() {
100-
this = any(HashAlgorithmCreateCall c).(CryptographyCreateCall).getQualifier()
101-
}
106+
class HashAlgorithmQualifier extends Crypto::AlgorithmValueConsumer, Crypto::HashAlgorithmInstance instanceof Expr
107+
{
108+
HashAlgorithmQualifier() { this = any(HashUse c).getQualifier() }
102109

103110
override Crypto::THashType getHashFamily() {
104111
result = getHashFamily(this.getRawHashAlgorithmName())
@@ -109,6 +116,10 @@ class HashAlgorithmQualifier extends Crypto::HashAlgorithmInstance instanceof Ex
109116
override int getFixedDigestLength() {
110117
hashAlgorithmToFamily(this.getRawHashAlgorithmName(), _, result)
111118
}
119+
120+
override Crypto::AlgorithmInstance getAKnownAlgorithmSource() { result = this }
121+
122+
override Crypto::ConsumerInputDataFlowNode getInputNode() { none() }
112123
}
113124

114125
class NamedCurvePropertyAccess extends PropertyAccess {
@@ -264,6 +275,37 @@ class HashUse extends Crypto::AlgorithmValueConsumer instanceof MethodCall {
264275
override Crypto::AlgorithmInstance getAKnownAlgorithmSource() { result = super.getQualifier() }
265276

266277
override Crypto::ConsumerInputDataFlowNode getInputNode() { none() }
278+
279+
Expr getQualifier() { result = super.getQualifier() }
280+
}
281+
282+
abstract class SignerQualifier extends Crypto::AlgorithmValueConsumer, SigningAlgorithmInstance instanceof Expr
283+
{
284+
SignerQualifier() { this = any(SignerUse s).getQualifier() }
285+
286+
override Crypto::AlgorithmInstance getAKnownAlgorithmSource() { result = this }
287+
288+
override Crypto::ConsumerInputDataFlowNode getInputNode() { none() }
289+
}
290+
291+
class EcdsaSignerQualifier extends SignerQualifier instanceof Expr {
292+
EcdsaSignerQualifier() { super.getType() instanceof EcdsaType }
293+
294+
override string getRawAlgorithmName() { result = "ECDsa" }
295+
296+
override Crypto::KeyOpAlg::Algorithm getAlgorithmType() {
297+
result = Crypto::KeyOpAlg::TSignature(Crypto::KeyOpAlg::ECDSA())
298+
}
299+
}
300+
301+
class RsaSignerQualifier extends SignerQualifier instanceof Expr {
302+
RsaSignerQualifier() { super.getType() instanceof RsaType }
303+
304+
override string getRawAlgorithmName() { result = "RSA" }
305+
306+
override Crypto::KeyOpAlg::Algorithm getAlgorithmType() {
307+
result = Crypto::KeyOpAlg::TSignature(Crypto::KeyOpAlg::OtherSignatureAlgorithmType())
308+
}
267309
}
268310

269311
class SignerUse extends MethodCall {

‎csharp/ql/lib/experimental/quantum/dotnet/FlowAnalysis.qll‎

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -54,20 +54,6 @@ module CreationToUseFlow<CreationCallSig Creation, UseCallSig Use> {
5454
}
5555
}
5656

57-
/**
58-
* Flow from a known ECDsa property access to a `ECDsa.Create(sink)` call.
59-
*/
60-
module SigningNamedCurveToSignatureCreateFlowConfig implements DataFlow::ConfigSig {
61-
predicate isSource(DataFlow::Node src) { src.asExpr() instanceof NamedCurvePropertyAccess }
62-
63-
predicate isSink(DataFlow::Node sink) {
64-
exists(EcdsaAlgorithmValueConsumer consumer | sink = consumer.getInputNode())
65-
}
66-
}
67-
68-
module SigningNamedCurveToSignatureCreateFlow =
69-
DataFlow::Global<SigningNamedCurveToSignatureCreateFlowConfig>;
70-
7157
module HashAlgorithmNameToUseConfig implements DataFlow::ConfigSig {
7258
predicate isSource(DataFlow::Node src) { src.asExpr() instanceof HashAlgorithmName }
7359

‎csharp/ql/lib/experimental/quantum/dotnet/OperationInstances.qll‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,9 @@ private import AlgorithmValueConsumers
55
private import FlowAnalysis
66
private import Cryptography
77

8-
class ECDsaORRSASigningOperationInstance extends Crypto::SignatureOperationInstance instanceof SignerUse
9-
{
8+
class SigningOperationInstance extends Crypto::SignatureOperationInstance instanceof SignerUse {
109
override Crypto::AlgorithmValueConsumer getAnAlgorithmValueConsumer() {
11-
result = SigningCreateToUseFlow::getCreationFromUse(this, _, _).getAlgorithmArg()
10+
result = super.getQualifier()
1211
}
1312

1413
override Crypto::KeyOperationSubtype getKeyOperationSubtype() {
@@ -52,9 +51,7 @@ class HashOperationInstance extends Crypto::HashOperationInstance instanceof Has
5251
}
5352

5453
override Crypto::AlgorithmValueConsumer getAnAlgorithmValueConsumer() {
55-
if exists(HashCreateToUseFlow::getCreationFromUse(this, _, _))
56-
then result = HashCreateToUseFlow::getCreationFromUse(this, _, _)
57-
else result = this
54+
result = super.getQualifier()
5855
}
5956
}
6057

0 commit comments

Comments
 (0)