weave/src/lib/profiles/security/WeaveProvBundle.cpp - nest-cam/4320010/weave - Git at Google

 /*
  *
  *    Copyright (c) 2013-2017 Nest Labs, Inc.
  *    All rights reserved.
  *
  *    Licensed under the Apache License, Version 2.0 (the "License");
  *    you may not use this file except in compliance with the License.
  *    You may obtain a copy of the License at
  *
  *        http://www.apache.org/licenses/LICENSE-2.0
  *
  *    Unless required by applicable law or agreed to in writing, software
  *    distributed under the License is distributed on an "AS IS" BASIS,
  *    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  *    See the License for the specific language governing permissions and
  *    limitations under the License.
  */

 /**
  *    @file
  *      This file implements an object for decoding, verifying, and
  *      accessing a Weave device provisioning bundle, consisting of a
  *      certificate, private key, and pairing (entry) code.
  *
  */

 #ifndef __STDC_LIMIT_MACROS
 #define __STDC_LIMIT_MACROS
 #endif
 #include <stdint.h>

 #include <Weave/Core/WeaveCore.h>

 #if WEAVE_CONFIG_ENABLE_PROVISIONING_BUNDLE_SUPPORT

 #include <Weave/Core/WeaveEncoding.h>
 #include <Weave/Support/crypto/WeaveCrypto.h>
 #include <Weave/Support/crypto/HMAC.h>
 #include <Weave/Support/verhoeff/Verhoeff.h>
 #include <Weave/Profiles/security/WeaveSecurity.h>
 #include <Weave/Profiles/security/WeaveCert.h>
 #include <Weave/Profiles/security/WeavePrivateKey.h>
 #include <Weave/Profiles/security/WeaveProvBundle.h>
 #include <Weave/Support/ASN1.h>
 #include <Weave/Support/CodeUtils.h>
 #include <Weave/Support/Base64.h>

 #if WEAVE_CONFIG_ENABLE_PROVISIONING_BUNDLE_SUPPORT && !WEAVE_WITH_OPENSSL
 #error "INVALID WEAVE CONFIG: Provisioning bundle feature enabled but OpenSSL not available (WEAVE_CONFIG_ENABLE_PROVISIONING_BUNDLE_SUPPORT == 1 && WEAVE_WITH_OPENSSL == 0)."
 #endif

 #include <openssl/evp.h>
 #include <openssl/err.h>

 // Weave Provisioning Bundle Format
 //                                                Included
 // Field              Size           Encrypted    in MAC
 //
 // Version            2 Byte         N            Y
 // Certificate Len    2 Bytes        Y            Y
 // Private Key Len    2 Bytes        Y            Y
 // Pairing Code Len   2 Bytes        Y            Y
 // Device Id/MAC Addr 8 Bytes        Y            Y
 // Certificate        variable       Y            Y
 // Private Key        variable       Y            Y
 // Pairing Code       variable       Y            Y
 // MAC                32 bytes       Y            N
 // Encryption Padding variable       Y            N
 // Encryption IV      32 bytes       N            N
 //
 // Encryption algorithm is AES-256-CBC with PKCS5 padding.
 // MAC algorithm is HMAC-SHA256.
 // Encryption and MAC keys are derived from master key using PBDKF2-SHA1, 1000 iterations with fixed salt.
 // All numeric values (lengths, MAC address) are encoded little-endian.

 namespace nl {
 namespace Weave {
 namespace Profiles {
 namespace Security {

 using namespace nl::Weave::Encoding;
 using namespace nl::Weave::Crypto;
 using namespace nl::Weave::ASN1;

 enum {
     kProvisioningBundleVersion = 1,
     kProvisioningBundleKDFIters = 1000
 };

 const char gProvisioningBundleKDFSalt[] = "Weave Provisioning Bundle v1";
 #define gProvisioningBundleKDFSaltLen (sizeof(gProvisioningBundleKDFSalt) - 1)

 static WEAVE_ERROR TranslateOpenSSLError(WEAVE_ERROR defaultErr)
 {
     if (ERR_GET_REASON(ERR_get_error()) == ERR_R_MALLOC_FAILURE)
         return WEAVE_ERROR_NO_MEMORY;
     return defaultErr;
 }

 WEAVE_ERROR WeaveProvisioningBundle::Verify(uint64_t expectedDeviceId)
 {
     WEAVE_ERROR err = WEAVE_NO_ERROR;
     WeaveCertificateSet certSet;
     WeaveCertificateData *certData;
     uint32_t weaveCurveId;
     EncodedECPublicKey pubKey;
     EncodedECPrivateKey privKey;

     // Initialize the certificate set to hold a single certificate.
     err = certSet.Init(1, 1024);
     SuccessOrExit(err);

     // Load the device certificate contained in the bundle.
     err = certSet.LoadCert(Certificate, CertificateLen, 0, certData);
     SuccessOrExit(err);

     // Verify the certificate is indeed a device certificate.
     VerifyOrExit(certData->SubjectDN.AttrOID == kOID_AttributeType_WeaveDeviceId, err = WEAVE_ERROR_INVALID_PROVISIONING_BUNDLE);

     // Verify the certificate is identifies the expected device id.
     VerifyOrExit(certData->SubjectDN.AttrValue.WeaveId == expectedDeviceId, err = WEAVE_ERROR_INVALID_PROVISIONING_BUNDLE);

     // Verify the certificate contains a supported public key type.
     VerifyOrExit(certData->PubKeyAlgoOID == kOID_PubKeyAlgo_ECPublicKey, err = WEAVE_ERROR_INVALID_PROVISIONING_BUNDLE);

     // Decode the private key contained in the bundle.
     err = DecodeWeaveECPrivateKey(PrivateKey, PrivateKeyLen, weaveCurveId, pubKey, privKey);
     SuccessOrExit(err);

     // Verify that the EC curve used by the public key in certificate matches that used
     // by the private key.
     VerifyOrExit(certData->PubKeyCurveId == weaveCurveId, err = WEAVE_ERROR_INVALID_PROVISIONING_BUNDLE);

     // Verify that the public key in the certificate matches that in the private key.
     VerifyOrExit(certData->PublicKey.EC.IsEqual(pubKey), err = WEAVE_ERROR_INVALID_PROVISIONING_BUNDLE);

     // Verify the check digit in the pairing code.
     VerifyOrExit(Verhoeff32::ValidateCheckChar(PairingCode, PairingCodeLen) == true, err = WEAVE_ERROR_INVALID_PROVISIONING_BUNDLE);

 exit:
     certSet.Release();
     return err;
 }

 WEAVE_ERROR WeaveProvisioningBundle::Decode(uint8_t *provBundleBuf, uint32_t provBundleLen, const char *masterKey, uint32_t masterKeyLen, WeaveProvisioningBundle &provBundle)
 {
     enum {
         kEncryptKeySize         = 32,
         kMACKeySize             = 32,
         kVersionFieldSize       = 2,
         kFixedHeaderSize        = 2 + 2 + 2 + 8, // cert len + priv key len + pairing code len + device id
         kMACFieldSize           = HMACSHA256::kDigestLength,
         kIVSize                 = 32,
     };
     WEAVE_ERROR err = WEAVE_NO_ERROR;
     EVP_CIPHER_CTX *decryptCtx;
     HMACSHA256 hmac;
     uint8_t expectedMAC[kMACFieldSize];
     uint8_t keyMaterial[kEncryptKeySize + kMACKeySize];
     uint32_t encryptedDataLen, decryptedDataLen, expectedDecryptedDataLen, decryptBufSize;
     uint8_t *decryptBuf = NULL, *decodePoint = provBundleBuf;
     uint16_t version;
     int res, outLen;

     provBundle.Clear();

     decryptCtx = EVP_CIPHER_CTX_new();
     VerifyOrExit(decryptCtx != NULL, err = WEAVE_ERROR_NO_MEMORY);

     EVP_CIPHER_CTX_init(decryptCtx);

     // Un-base64 the provisioning bundle, storing the resultant data back into the input buffer.
     provBundleLen = Base64Decode((char *)provBundleBuf, (uint16_t)provBundleLen, (uint8_t *)provBundleBuf);
     VerifyOrExit(provBundleLen != UINT16_MAX, err = WEAVE_ERROR_INVALID_PROVISIONING_BUNDLE);

     // Verify the provided data is at least big enough to hold the version field and the initialization vector.
     VerifyOrExit(provBundleLen > kVersionFieldSize + kIVSize, err = WEAVE_ERROR_INVALID_PROVISIONING_BUNDLE);

     // Verify the version is supported.
     version = LittleEndian::Read16(decodePoint);
     VerifyOrExit(version == kProvisioningBundleVersion, err = WEAVE_ERROR_INVALID_PROVISIONING_BUNDLE);

     // Allocate a temporary buffer to hold the decrypted data.
     decryptBufSize = provBundleLen;
     decryptBuf = (uint8_t *)malloc(decryptBufSize);

     // Generate the encryption and MAC keys from the master key.
     res = PKCS5_PBKDF2_HMAC(masterKey, (int)masterKeyLen,
                             (const unsigned char *)gProvisioningBundleKDFSalt, gProvisioningBundleKDFSaltLen,
                             kProvisioningBundleKDFIters,
                             EVP_sha1(),
                             sizeof(keyMaterial), keyMaterial);
     if (res != 1)
         ExitNow(err = TranslateOpenSSLError(WEAVE_ERROR_PROVISIONING_BUNDLE_DECRYPTION_ERROR));

     // Initialize the OpenSSL cipher context for decryption using the generated encryption key and
     // the initialization vector from the bundle.
     res = EVP_CipherInit_ex(decryptCtx, EVP_aes_256_cbc(), NULL,
                             keyMaterial,
                             (uint8_t *)provBundleBuf + (provBundleLen - kIVSize),
                             0);
     if (res != 1)
         ExitNow(err = TranslateOpenSSLError(WEAVE_ERROR_PROVISIONING_BUNDLE_DECRYPTION_ERROR));

     // Compute the length of the encrypted portion of the bundle.
     encryptedDataLen = provBundleLen - (kVersionFieldSize + kIVSize);

     // Pass the encrypted data to the decryption function, storing the output in the decryption buffer.
     outLen = provBundleLen;
     res = EVP_CipherUpdate(decryptCtx, decryptBuf, &outLen, decodePoint, (int)encryptedDataLen);
     if (res != 1)
         ExitNow(err = TranslateOpenSSLError(WEAVE_ERROR_PROVISIONING_BUNDLE_DECRYPTION_ERROR));
     decryptedDataLen = outLen;

     // Finalize the decryption process by decrypting and verifying the padding.  Note that EVP_EncryptFinal_ex()
     // does not tell us how long the padding is (although it obviously knows), so decryptedDataLen should be
     // the same as encryptedDataLen.
     outLen = decryptBufSize - decryptedDataLen;
     res = EVP_CipherFinal_ex(decryptCtx, decryptBuf + decryptedDataLen, &outLen);
     if (res != 1)
         ExitNow(err = TranslateOpenSSLError(WEAVE_ERROR_PROVISIONING_BUNDLE_DECRYPTION_ERROR));
     decryptedDataLen += outLen;

     // Verify that the decrypted data is smaller than the encrypted data (this should always be the case because of padding).
     VerifyOrExit(decryptedDataLen < encryptedDataLen, err = WEAVE_ERROR_INVALID_PROVISIONING_BUNDLE);

     // Copy the decrypted data from the temporary buffer back into the input buffer, overwriting
     // the encrypted data in the process.
     memcpy(decodePoint, decryptBuf, decryptedDataLen);

     // Verify that decrypted data is at least as big as the fixed portion of the header.
     VerifyOrExit(decryptedDataLen > kFixedHeaderSize, err = WEAVE_ERROR_INVALID_PROVISIONING_BUNDLE);

     // Decode the fields of the provisioning bundle into the provided object.
     provBundle.CertificateLen = LittleEndian::Read16(decodePoint);
     provBundle.PrivateKeyLen = LittleEndian::Read16(decodePoint);
     provBundle.PairingCodeLen = LittleEndian::Read16(decodePoint);
     provBundle.WeaveDeviceId = LittleEndian::Read64(decodePoint);
     provBundle.Certificate = decodePoint; decodePoint += provBundle.CertificateLen;
     provBundle.PrivateKey = decodePoint; decodePoint += provBundle.PrivateKeyLen;
     provBundle.PairingCode = (const char *)decodePoint; decodePoint += provBundle.PairingCodeLen;

     // Verify that the size of the data within the provisioning bundle matches the length of the data
     // returned by decryption.
     expectedDecryptedDataLen = kFixedHeaderSize + provBundle.CertificateLen + provBundle.PrivateKeyLen + provBundle.PairingCodeLen + kMACFieldSize;
     VerifyOrExit(decryptedDataLen == expectedDecryptedDataLen, err = WEAVE_ERROR_INVALID_PROVISIONING_BUNDLE);

     // Recompute the MAC using the generated MAC key.
     hmac.Begin(keyMaterial + kEncryptKeySize, kMACKeySize);
     hmac.AddData(provBundleBuf, kVersionFieldSize + kFixedHeaderSize + provBundle.CertificateLen + provBundle.PrivateKeyLen + provBundle.PairingCodeLen);
     hmac.Finish(expectedMAC);

     // Fail if the MAC supplied in the bundle does not match the computed MAC.
     if (!ConstantTimeCompare(decodePoint, expectedMAC, kMACFieldSize))
         ExitNow(err = WEAVE_ERROR_INVALID_PROVISIONING_BUNDLE);

 exit:
     if (decryptBuf != NULL)
         free(decryptBuf);
     if (decryptCtx != NULL)
         EVP_CIPHER_CTX_free(decryptCtx);
     return err;
 }

 void WeaveProvisioningBundle::Clear()
 {
     WeaveDeviceId = 0;
     Certificate = NULL;
     CertificateLen = 0;
     PrivateKey = NULL;
     PrivateKeyLen = 0;
     PairingCode = NULL;
     PairingCodeLen = 0;
 }

 } // namespace Security
 } // namespace Profiles
 } // namespace Weave
 } // namespace nl


 #endif // WEAVE_CONFIG_ENABLE_PROVISIONING_BUNDLE_SUPPORT
	/*
	*
	* Copyright (c) 2013-2017 Nest Labs, Inc.
	* All rights reserved.
	*
	* Licensed under the Apache License, Version 2.0 (the "License");
	* you may not use this file except in compliance with the License.
	* You may obtain a copy of the License at
	*
	* http://www.apache.org/licenses/LICENSE-2.0
	*
	* Unless required by applicable law or agreed to in writing, software
	* distributed under the License is distributed on an "AS IS" BASIS,
	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	* See the License for the specific language governing permissions and
	* limitations under the License.
	*/

	/**
	* @file
	* This file implements an object for decoding, verifying, and
	* accessing a Weave device provisioning bundle, consisting of a
	* certificate, private key, and pairing (entry) code.
	*
	*/

	#ifndef __STDC_LIMIT_MACROS
	#define __STDC_LIMIT_MACROS
	#endif
	#include <stdint.h>

	#include <Weave/Core/WeaveCore.h>

	#if WEAVE_CONFIG_ENABLE_PROVISIONING_BUNDLE_SUPPORT

	#include <Weave/Core/WeaveEncoding.h>
	#include <Weave/Support/crypto/WeaveCrypto.h>
	#include <Weave/Support/crypto/HMAC.h>
	#include <Weave/Support/verhoeff/Verhoeff.h>
	#include <Weave/Profiles/security/WeaveSecurity.h>
	#include <Weave/Profiles/security/WeaveCert.h>
	#include <Weave/Profiles/security/WeavePrivateKey.h>
	#include <Weave/Profiles/security/WeaveProvBundle.h>
	#include <Weave/Support/ASN1.h>
	#include <Weave/Support/CodeUtils.h>
	#include <Weave/Support/Base64.h>

	#if WEAVE_CONFIG_ENABLE_PROVISIONING_BUNDLE_SUPPORT && !WEAVE_WITH_OPENSSL
	#error "INVALID WEAVE CONFIG: Provisioning bundle feature enabled but OpenSSL not available (WEAVE_CONFIG_ENABLE_PROVISIONING_BUNDLE_SUPPORT == 1 && WEAVE_WITH_OPENSSL == 0)."
	#endif

	#include <openssl/evp.h>
	#include <openssl/err.h>

	// Weave Provisioning Bundle Format
	// Included
	// Field Size Encrypted in MAC
	//
	// Version 2 Byte N Y
	// Certificate Len 2 Bytes Y Y
	// Private Key Len 2 Bytes Y Y
	// Pairing Code Len 2 Bytes Y Y
	// Device Id/MAC Addr 8 Bytes Y Y
	// Certificate variable Y Y
	// Private Key variable Y Y
	// Pairing Code variable Y Y
	// MAC 32 bytes Y N
	// Encryption Padding variable Y N
	// Encryption IV 32 bytes N N
	//
	// Encryption algorithm is AES-256-CBC with PKCS5 padding.
	// MAC algorithm is HMAC-SHA256.
	// Encryption and MAC keys are derived from master key using PBDKF2-SHA1, 1000 iterations with fixed salt.
	// All numeric values (lengths, MAC address) are encoded little-endian.

	namespace nl {
	namespace Weave {
	namespace Profiles {
	namespace Security {

	using namespace nl::Weave::Encoding;
	using namespace nl::Weave::Crypto;
	using namespace nl::Weave::ASN1;

	enum {
	kProvisioningBundleVersion = 1,
	kProvisioningBundleKDFIters = 1000
	};

	const char gProvisioningBundleKDFSalt[] = "Weave Provisioning Bundle v1";
	#define gProvisioningBundleKDFSaltLen (sizeof(gProvisioningBundleKDFSalt) - 1)

	static WEAVE_ERROR TranslateOpenSSLError(WEAVE_ERROR defaultErr)
	{
	if (ERR_GET_REASON(ERR_get_error()) == ERR_R_MALLOC_FAILURE)
	return WEAVE_ERROR_NO_MEMORY;
	return defaultErr;
	}

	WEAVE_ERROR WeaveProvisioningBundle::Verify(uint64_t expectedDeviceId)
	{
	WEAVE_ERROR err = WEAVE_NO_ERROR;
	WeaveCertificateSet certSet;
	WeaveCertificateData *certData;
	uint32_t weaveCurveId;
	EncodedECPublicKey pubKey;
	EncodedECPrivateKey privKey;

	// Initialize the certificate set to hold a single certificate.
	err = certSet.Init(1, 1024);
	SuccessOrExit(err);

	// Load the device certificate contained in the bundle.
	err = certSet.LoadCert(Certificate, CertificateLen, 0, certData);
	SuccessOrExit(err);

	// Verify the certificate is indeed a device certificate.
	VerifyOrExit(certData->SubjectDN.AttrOID == kOID_AttributeType_WeaveDeviceId, err = WEAVE_ERROR_INVALID_PROVISIONING_BUNDLE);

	// Verify the certificate is identifies the expected device id.
	VerifyOrExit(certData->SubjectDN.AttrValue.WeaveId == expectedDeviceId, err = WEAVE_ERROR_INVALID_PROVISIONING_BUNDLE);

	// Verify the certificate contains a supported public key type.
	VerifyOrExit(certData->PubKeyAlgoOID == kOID_PubKeyAlgo_ECPublicKey, err = WEAVE_ERROR_INVALID_PROVISIONING_BUNDLE);

	// Decode the private key contained in the bundle.
	err = DecodeWeaveECPrivateKey(PrivateKey, PrivateKeyLen, weaveCurveId, pubKey, privKey);
	SuccessOrExit(err);

	// Verify that the EC curve used by the public key in certificate matches that used
	// by the private key.
	VerifyOrExit(certData->PubKeyCurveId == weaveCurveId, err = WEAVE_ERROR_INVALID_PROVISIONING_BUNDLE);

	// Verify that the public key in the certificate matches that in the private key.
	VerifyOrExit(certData->PublicKey.EC.IsEqual(pubKey), err = WEAVE_ERROR_INVALID_PROVISIONING_BUNDLE);

	// Verify the check digit in the pairing code.
	VerifyOrExit(Verhoeff32::ValidateCheckChar(PairingCode, PairingCodeLen) == true, err = WEAVE_ERROR_INVALID_PROVISIONING_BUNDLE);

	exit:
	certSet.Release();
	return err;
	}

	WEAVE_ERROR WeaveProvisioningBundle::Decode(uint8_t provBundleBuf, uint32_t provBundleLen, const char masterKey, uint32_t masterKeyLen, WeaveProvisioningBundle &provBundle)
	{
	enum {
	kEncryptKeySize = 32,
	kMACKeySize = 32,
	kVersionFieldSize = 2,
	kFixedHeaderSize = 2 + 2 + 2 + 8, // cert len + priv key len + pairing code len + device id
	kMACFieldSize = HMACSHA256::kDigestLength,
	kIVSize = 32,
	};
	WEAVE_ERROR err = WEAVE_NO_ERROR;
	EVP_CIPHER_CTX *decryptCtx;
	HMACSHA256 hmac;
	uint8_t expectedMAC[kMACFieldSize];
	uint8_t keyMaterial[kEncryptKeySize + kMACKeySize];
	uint32_t encryptedDataLen, decryptedDataLen, expectedDecryptedDataLen, decryptBufSize;
	uint8_t decryptBuf = NULL, decodePoint = provBundleBuf;
	uint16_t version;
	int res, outLen;

	provBundle.Clear();

	decryptCtx = EVP_CIPHER_CTX_new();
	VerifyOrExit(decryptCtx != NULL, err = WEAVE_ERROR_NO_MEMORY);

	EVP_CIPHER_CTX_init(decryptCtx);

	// Un-base64 the provisioning bundle, storing the resultant data back into the input buffer.
	provBundleLen = Base64Decode((char )provBundleBuf, (uint16_t)provBundleLen, (uint8_t )provBundleBuf);
	VerifyOrExit(provBundleLen != UINT16_MAX, err = WEAVE_ERROR_INVALID_PROVISIONING_BUNDLE);

	// Verify the provided data is at least big enough to hold the version field and the initialization vector.
	VerifyOrExit(provBundleLen > kVersionFieldSize + kIVSize, err = WEAVE_ERROR_INVALID_PROVISIONING_BUNDLE);

	// Verify the version is supported.
	version = LittleEndian::Read16(decodePoint);
	VerifyOrExit(version == kProvisioningBundleVersion, err = WEAVE_ERROR_INVALID_PROVISIONING_BUNDLE);

	// Allocate a temporary buffer to hold the decrypted data.
	decryptBufSize = provBundleLen;
	decryptBuf = (uint8_t *)malloc(decryptBufSize);

	// Generate the encryption and MAC keys from the master key.
	res = PKCS5_PBKDF2_HMAC(masterKey, (int)masterKeyLen,
	(const unsigned char *)gProvisioningBundleKDFSalt, gProvisioningBundleKDFSaltLen,
	kProvisioningBundleKDFIters,
	EVP_sha1(),
	sizeof(keyMaterial), keyMaterial);
	if (res != 1)
	ExitNow(err = TranslateOpenSSLError(WEAVE_ERROR_PROVISIONING_BUNDLE_DECRYPTION_ERROR));

	// Initialize the OpenSSL cipher context for decryption using the generated encryption key and
	// the initialization vector from the bundle.
	res = EVP_CipherInit_ex(decryptCtx, EVP_aes_256_cbc(), NULL,
	keyMaterial,
	(uint8_t *)provBundleBuf + (provBundleLen - kIVSize),
	0);
	if (res != 1)
	ExitNow(err = TranslateOpenSSLError(WEAVE_ERROR_PROVISIONING_BUNDLE_DECRYPTION_ERROR));

	// Compute the length of the encrypted portion of the bundle.
	encryptedDataLen = provBundleLen - (kVersionFieldSize + kIVSize);

	// Pass the encrypted data to the decryption function, storing the output in the decryption buffer.
	outLen = provBundleLen;
	res = EVP_CipherUpdate(decryptCtx, decryptBuf, &outLen, decodePoint, (int)encryptedDataLen);
	if (res != 1)
	ExitNow(err = TranslateOpenSSLError(WEAVE_ERROR_PROVISIONING_BUNDLE_DECRYPTION_ERROR));
	decryptedDataLen = outLen;

	// Finalize the decryption process by decrypting and verifying the padding. Note that EVP_EncryptFinal_ex()
	// does not tell us how long the padding is (although it obviously knows), so decryptedDataLen should be
	// the same as encryptedDataLen.
	outLen = decryptBufSize - decryptedDataLen;
	res = EVP_CipherFinal_ex(decryptCtx, decryptBuf + decryptedDataLen, &outLen);
	if (res != 1)
	ExitNow(err = TranslateOpenSSLError(WEAVE_ERROR_PROVISIONING_BUNDLE_DECRYPTION_ERROR));
	decryptedDataLen += outLen;

	// Verify that the decrypted data is smaller than the encrypted data (this should always be the case because of padding).
	VerifyOrExit(decryptedDataLen < encryptedDataLen, err = WEAVE_ERROR_INVALID_PROVISIONING_BUNDLE);

	// Copy the decrypted data from the temporary buffer back into the input buffer, overwriting
	// the encrypted data in the process.
	memcpy(decodePoint, decryptBuf, decryptedDataLen);

	// Verify that decrypted data is at least as big as the fixed portion of the header.
	VerifyOrExit(decryptedDataLen > kFixedHeaderSize, err = WEAVE_ERROR_INVALID_PROVISIONING_BUNDLE);

	// Decode the fields of the provisioning bundle into the provided object.
	provBundle.CertificateLen = LittleEndian::Read16(decodePoint);
	provBundle.PrivateKeyLen = LittleEndian::Read16(decodePoint);
	provBundle.PairingCodeLen = LittleEndian::Read16(decodePoint);
	provBundle.WeaveDeviceId = LittleEndian::Read64(decodePoint);
	provBundle.Certificate = decodePoint; decodePoint += provBundle.CertificateLen;
	provBundle.PrivateKey = decodePoint; decodePoint += provBundle.PrivateKeyLen;
	provBundle.PairingCode = (const char *)decodePoint; decodePoint += provBundle.PairingCodeLen;

	// Verify that the size of the data within the provisioning bundle matches the length of the data
	// returned by decryption.
	expectedDecryptedDataLen = kFixedHeaderSize + provBundle.CertificateLen + provBundle.PrivateKeyLen + provBundle.PairingCodeLen + kMACFieldSize;
	VerifyOrExit(decryptedDataLen == expectedDecryptedDataLen, err = WEAVE_ERROR_INVALID_PROVISIONING_BUNDLE);

	// Recompute the MAC using the generated MAC key.
	hmac.Begin(keyMaterial + kEncryptKeySize, kMACKeySize);
	hmac.AddData(provBundleBuf, kVersionFieldSize + kFixedHeaderSize + provBundle.CertificateLen + provBundle.PrivateKeyLen + provBundle.PairingCodeLen);
	hmac.Finish(expectedMAC);

	// Fail if the MAC supplied in the bundle does not match the computed MAC.
	if (!ConstantTimeCompare(decodePoint, expectedMAC, kMACFieldSize))
	ExitNow(err = WEAVE_ERROR_INVALID_PROVISIONING_BUNDLE);

	exit:
	if (decryptBuf != NULL)
	free(decryptBuf);
	if (decryptCtx != NULL)
	EVP_CIPHER_CTX_free(decryptCtx);
	return err;
	}

	void WeaveProvisioningBundle::Clear()
	{
	WeaveDeviceId = 0;
	Certificate = NULL;
	CertificateLen = 0;
	PrivateKey = NULL;
	PrivateKeyLen = 0;
	PairingCode = NULL;
	PairingCodeLen = 0;
	}

	} // namespace Security
	} // namespace Profiles
	} // namespace Weave
	} // namespace nl


	#endif // WEAVE_CONFIG_ENABLE_PROVISIONING_BUNDLE_SUPPORT