rsa_pmeth.c 25 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859
  1. /*
  2. * Copyright 2006-2017 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the OpenSSL license (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #include <stdio.h>
  10. #include "internal/cryptlib.h"
  11. #include <openssl/asn1t.h>
  12. #include <openssl/x509.h>
  13. #include <openssl/rsa.h>
  14. #include <openssl/bn.h>
  15. #include <openssl/evp.h>
  16. #include <openssl/x509v3.h>
  17. #include <openssl/cms.h>
  18. #include "internal/evp_int.h"
  19. #include "rsa_locl.h"
  20. /* RSA pkey context structure */
  21. typedef struct {
  22. /* Key gen parameters */
  23. int nbits;
  24. BIGNUM *pub_exp;
  25. int primes;
  26. /* Keygen callback info */
  27. int gentmp[2];
  28. /* RSA padding mode */
  29. int pad_mode;
  30. /* message digest */
  31. const EVP_MD *md;
  32. /* message digest for MGF1 */
  33. const EVP_MD *mgf1md;
  34. /* PSS salt length */
  35. int saltlen;
  36. /* Minimum salt length or -1 if no PSS parameter restriction */
  37. int min_saltlen;
  38. /* Temp buffer */
  39. unsigned char *tbuf;
  40. /* OAEP label */
  41. unsigned char *oaep_label;
  42. size_t oaep_labellen;
  43. } RSA_PKEY_CTX;
  44. /* True if PSS parameters are restricted */
  45. #define rsa_pss_restricted(rctx) (rctx->min_saltlen != -1)
  46. static int pkey_rsa_init(EVP_PKEY_CTX *ctx)
  47. {
  48. RSA_PKEY_CTX *rctx = OPENSSL_zalloc(sizeof(*rctx));
  49. if (rctx == NULL)
  50. return 0;
  51. rctx->nbits = 1024;
  52. rctx->primes = RSA_DEFAULT_PRIME_NUM;
  53. if (pkey_ctx_is_pss(ctx))
  54. rctx->pad_mode = RSA_PKCS1_PSS_PADDING;
  55. else
  56. rctx->pad_mode = RSA_PKCS1_PADDING;
  57. /* Maximum for sign, auto for verify */
  58. rctx->saltlen = RSA_PSS_SALTLEN_AUTO;
  59. rctx->min_saltlen = -1;
  60. ctx->data = rctx;
  61. ctx->keygen_info = rctx->gentmp;
  62. ctx->keygen_info_count = 2;
  63. return 1;
  64. }
  65. static int pkey_rsa_copy(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src)
  66. {
  67. RSA_PKEY_CTX *dctx, *sctx;
  68. if (!pkey_rsa_init(dst))
  69. return 0;
  70. sctx = src->data;
  71. dctx = dst->data;
  72. dctx->nbits = sctx->nbits;
  73. if (sctx->pub_exp) {
  74. dctx->pub_exp = BN_dup(sctx->pub_exp);
  75. if (!dctx->pub_exp)
  76. return 0;
  77. }
  78. dctx->pad_mode = sctx->pad_mode;
  79. dctx->md = sctx->md;
  80. dctx->mgf1md = sctx->mgf1md;
  81. if (sctx->oaep_label) {
  82. OPENSSL_free(dctx->oaep_label);
  83. dctx->oaep_label = OPENSSL_memdup(sctx->oaep_label, sctx->oaep_labellen);
  84. if (!dctx->oaep_label)
  85. return 0;
  86. dctx->oaep_labellen = sctx->oaep_labellen;
  87. }
  88. return 1;
  89. }
  90. static int setup_tbuf(RSA_PKEY_CTX *ctx, EVP_PKEY_CTX *pk)
  91. {
  92. if (ctx->tbuf != NULL)
  93. return 1;
  94. ctx->tbuf = OPENSSL_malloc(EVP_PKEY_size(pk->pkey));
  95. if (ctx->tbuf == NULL)
  96. return 0;
  97. return 1;
  98. }
  99. static void pkey_rsa_cleanup(EVP_PKEY_CTX *ctx)
  100. {
  101. RSA_PKEY_CTX *rctx = ctx->data;
  102. if (rctx) {
  103. BN_free(rctx->pub_exp);
  104. OPENSSL_free(rctx->tbuf);
  105. OPENSSL_free(rctx->oaep_label);
  106. OPENSSL_free(rctx);
  107. }
  108. }
  109. static int pkey_rsa_sign(EVP_PKEY_CTX *ctx, unsigned char *sig,
  110. size_t *siglen, const unsigned char *tbs,
  111. size_t tbslen)
  112. {
  113. int ret;
  114. RSA_PKEY_CTX *rctx = ctx->data;
  115. RSA *rsa = ctx->pkey->pkey.rsa;
  116. if (rctx->md) {
  117. if (tbslen != (size_t)EVP_MD_size(rctx->md)) {
  118. RSAerr(RSA_F_PKEY_RSA_SIGN, RSA_R_INVALID_DIGEST_LENGTH);
  119. return -1;
  120. }
  121. if (EVP_MD_type(rctx->md) == NID_mdc2) {
  122. unsigned int sltmp;
  123. if (rctx->pad_mode != RSA_PKCS1_PADDING)
  124. return -1;
  125. ret = RSA_sign_ASN1_OCTET_STRING(0,
  126. tbs, tbslen, sig, &sltmp, rsa);
  127. if (ret <= 0)
  128. return ret;
  129. ret = sltmp;
  130. } else if (rctx->pad_mode == RSA_X931_PADDING) {
  131. if ((size_t)EVP_PKEY_size(ctx->pkey) < tbslen + 1) {
  132. RSAerr(RSA_F_PKEY_RSA_SIGN, RSA_R_KEY_SIZE_TOO_SMALL);
  133. return -1;
  134. }
  135. if (!setup_tbuf(rctx, ctx)) {
  136. RSAerr(RSA_F_PKEY_RSA_SIGN, ERR_R_MALLOC_FAILURE);
  137. return -1;
  138. }
  139. memcpy(rctx->tbuf, tbs, tbslen);
  140. rctx->tbuf[tbslen] = RSA_X931_hash_id(EVP_MD_type(rctx->md));
  141. ret = RSA_private_encrypt(tbslen + 1, rctx->tbuf,
  142. sig, rsa, RSA_X931_PADDING);
  143. } else if (rctx->pad_mode == RSA_PKCS1_PADDING) {
  144. unsigned int sltmp;
  145. ret = RSA_sign(EVP_MD_type(rctx->md),
  146. tbs, tbslen, sig, &sltmp, rsa);
  147. if (ret <= 0)
  148. return ret;
  149. ret = sltmp;
  150. } else if (rctx->pad_mode == RSA_PKCS1_PSS_PADDING) {
  151. if (!setup_tbuf(rctx, ctx))
  152. return -1;
  153. if (!RSA_padding_add_PKCS1_PSS_mgf1(rsa,
  154. rctx->tbuf, tbs,
  155. rctx->md, rctx->mgf1md,
  156. rctx->saltlen))
  157. return -1;
  158. ret = RSA_private_encrypt(RSA_size(rsa), rctx->tbuf,
  159. sig, rsa, RSA_NO_PADDING);
  160. } else {
  161. return -1;
  162. }
  163. } else {
  164. ret = RSA_private_encrypt(tbslen, tbs, sig, ctx->pkey->pkey.rsa,
  165. rctx->pad_mode);
  166. }
  167. if (ret < 0)
  168. return ret;
  169. *siglen = ret;
  170. return 1;
  171. }
  172. static int pkey_rsa_verifyrecover(EVP_PKEY_CTX *ctx,
  173. unsigned char *rout, size_t *routlen,
  174. const unsigned char *sig, size_t siglen)
  175. {
  176. int ret;
  177. RSA_PKEY_CTX *rctx = ctx->data;
  178. if (rctx->md) {
  179. if (rctx->pad_mode == RSA_X931_PADDING) {
  180. if (!setup_tbuf(rctx, ctx))
  181. return -1;
  182. ret = RSA_public_decrypt(siglen, sig,
  183. rctx->tbuf, ctx->pkey->pkey.rsa,
  184. RSA_X931_PADDING);
  185. if (ret < 1)
  186. return 0;
  187. ret--;
  188. if (rctx->tbuf[ret] != RSA_X931_hash_id(EVP_MD_type(rctx->md))) {
  189. RSAerr(RSA_F_PKEY_RSA_VERIFYRECOVER,
  190. RSA_R_ALGORITHM_MISMATCH);
  191. return 0;
  192. }
  193. if (ret != EVP_MD_size(rctx->md)) {
  194. RSAerr(RSA_F_PKEY_RSA_VERIFYRECOVER,
  195. RSA_R_INVALID_DIGEST_LENGTH);
  196. return 0;
  197. }
  198. if (rout)
  199. memcpy(rout, rctx->tbuf, ret);
  200. } else if (rctx->pad_mode == RSA_PKCS1_PADDING) {
  201. size_t sltmp;
  202. ret = int_rsa_verify(EVP_MD_type(rctx->md),
  203. NULL, 0, rout, &sltmp,
  204. sig, siglen, ctx->pkey->pkey.rsa);
  205. if (ret <= 0)
  206. return 0;
  207. ret = sltmp;
  208. } else {
  209. return -1;
  210. }
  211. } else {
  212. ret = RSA_public_decrypt(siglen, sig, rout, ctx->pkey->pkey.rsa,
  213. rctx->pad_mode);
  214. }
  215. if (ret < 0)
  216. return ret;
  217. *routlen = ret;
  218. return 1;
  219. }
  220. static int pkey_rsa_verify(EVP_PKEY_CTX *ctx,
  221. const unsigned char *sig, size_t siglen,
  222. const unsigned char *tbs, size_t tbslen)
  223. {
  224. RSA_PKEY_CTX *rctx = ctx->data;
  225. RSA *rsa = ctx->pkey->pkey.rsa;
  226. size_t rslen;
  227. if (rctx->md) {
  228. if (rctx->pad_mode == RSA_PKCS1_PADDING)
  229. return RSA_verify(EVP_MD_type(rctx->md), tbs, tbslen,
  230. sig, siglen, rsa);
  231. if (tbslen != (size_t)EVP_MD_size(rctx->md)) {
  232. RSAerr(RSA_F_PKEY_RSA_VERIFY, RSA_R_INVALID_DIGEST_LENGTH);
  233. return -1;
  234. }
  235. if (rctx->pad_mode == RSA_X931_PADDING) {
  236. if (pkey_rsa_verifyrecover(ctx, NULL, &rslen, sig, siglen) <= 0)
  237. return 0;
  238. } else if (rctx->pad_mode == RSA_PKCS1_PSS_PADDING) {
  239. int ret;
  240. if (!setup_tbuf(rctx, ctx))
  241. return -1;
  242. ret = RSA_public_decrypt(siglen, sig, rctx->tbuf,
  243. rsa, RSA_NO_PADDING);
  244. if (ret <= 0)
  245. return 0;
  246. ret = RSA_verify_PKCS1_PSS_mgf1(rsa, tbs,
  247. rctx->md, rctx->mgf1md,
  248. rctx->tbuf, rctx->saltlen);
  249. if (ret <= 0)
  250. return 0;
  251. return 1;
  252. } else {
  253. return -1;
  254. }
  255. } else {
  256. if (!setup_tbuf(rctx, ctx))
  257. return -1;
  258. rslen = RSA_public_decrypt(siglen, sig, rctx->tbuf,
  259. rsa, rctx->pad_mode);
  260. if (rslen == 0)
  261. return 0;
  262. }
  263. if ((rslen != tbslen) || memcmp(tbs, rctx->tbuf, rslen))
  264. return 0;
  265. return 1;
  266. }
  267. static int pkey_rsa_encrypt(EVP_PKEY_CTX *ctx,
  268. unsigned char *out, size_t *outlen,
  269. const unsigned char *in, size_t inlen)
  270. {
  271. int ret;
  272. RSA_PKEY_CTX *rctx = ctx->data;
  273. if (rctx->pad_mode == RSA_PKCS1_OAEP_PADDING) {
  274. int klen = RSA_size(ctx->pkey->pkey.rsa);
  275. if (!setup_tbuf(rctx, ctx))
  276. return -1;
  277. if (!RSA_padding_add_PKCS1_OAEP_mgf1(rctx->tbuf, klen,
  278. in, inlen,
  279. rctx->oaep_label,
  280. rctx->oaep_labellen,
  281. rctx->md, rctx->mgf1md))
  282. return -1;
  283. ret = RSA_public_encrypt(klen, rctx->tbuf, out,
  284. ctx->pkey->pkey.rsa, RSA_NO_PADDING);
  285. } else {
  286. ret = RSA_public_encrypt(inlen, in, out, ctx->pkey->pkey.rsa,
  287. rctx->pad_mode);
  288. }
  289. if (ret < 0)
  290. return ret;
  291. *outlen = ret;
  292. return 1;
  293. }
  294. static int pkey_rsa_decrypt(EVP_PKEY_CTX *ctx,
  295. unsigned char *out, size_t *outlen,
  296. const unsigned char *in, size_t inlen)
  297. {
  298. int ret;
  299. RSA_PKEY_CTX *rctx = ctx->data;
  300. if (rctx->pad_mode == RSA_PKCS1_OAEP_PADDING) {
  301. if (!setup_tbuf(rctx, ctx))
  302. return -1;
  303. ret = RSA_private_decrypt(inlen, in, rctx->tbuf,
  304. ctx->pkey->pkey.rsa, RSA_NO_PADDING);
  305. if (ret <= 0)
  306. return ret;
  307. ret = RSA_padding_check_PKCS1_OAEP_mgf1(out, ret, rctx->tbuf,
  308. ret, ret,
  309. rctx->oaep_label,
  310. rctx->oaep_labellen,
  311. rctx->md, rctx->mgf1md);
  312. } else {
  313. ret = RSA_private_decrypt(inlen, in, out, ctx->pkey->pkey.rsa,
  314. rctx->pad_mode);
  315. }
  316. if (ret < 0)
  317. return ret;
  318. *outlen = ret;
  319. return 1;
  320. }
  321. static int check_padding_md(const EVP_MD *md, int padding)
  322. {
  323. int mdnid;
  324. if (!md)
  325. return 1;
  326. mdnid = EVP_MD_type(md);
  327. if (padding == RSA_NO_PADDING) {
  328. RSAerr(RSA_F_CHECK_PADDING_MD, RSA_R_INVALID_PADDING_MODE);
  329. return 0;
  330. }
  331. if (padding == RSA_X931_PADDING) {
  332. if (RSA_X931_hash_id(mdnid) == -1) {
  333. RSAerr(RSA_F_CHECK_PADDING_MD, RSA_R_INVALID_X931_DIGEST);
  334. return 0;
  335. }
  336. } else {
  337. switch(mdnid) {
  338. /* List of all supported RSA digests */
  339. case NID_sha1:
  340. case NID_sha224:
  341. case NID_sha256:
  342. case NID_sha384:
  343. case NID_sha512:
  344. case NID_md5:
  345. case NID_md5_sha1:
  346. case NID_md2:
  347. case NID_md4:
  348. case NID_mdc2:
  349. case NID_ripemd160:
  350. case NID_sha3_224:
  351. case NID_sha3_256:
  352. case NID_sha3_384:
  353. case NID_sha3_512:
  354. return 1;
  355. default:
  356. RSAerr(RSA_F_CHECK_PADDING_MD, RSA_R_INVALID_DIGEST);
  357. return 0;
  358. }
  359. }
  360. return 1;
  361. }
  362. static int pkey_rsa_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2)
  363. {
  364. RSA_PKEY_CTX *rctx = ctx->data;
  365. switch (type) {
  366. case EVP_PKEY_CTRL_RSA_PADDING:
  367. if ((p1 >= RSA_PKCS1_PADDING) && (p1 <= RSA_PKCS1_PSS_PADDING)) {
  368. if (!check_padding_md(rctx->md, p1))
  369. return 0;
  370. if (p1 == RSA_PKCS1_PSS_PADDING) {
  371. if (!(ctx->operation &
  372. (EVP_PKEY_OP_SIGN | EVP_PKEY_OP_VERIFY)))
  373. goto bad_pad;
  374. if (!rctx->md)
  375. rctx->md = EVP_sha1();
  376. } else if (pkey_ctx_is_pss(ctx)) {
  377. goto bad_pad;
  378. }
  379. if (p1 == RSA_PKCS1_OAEP_PADDING) {
  380. if (!(ctx->operation & EVP_PKEY_OP_TYPE_CRYPT))
  381. goto bad_pad;
  382. if (!rctx->md)
  383. rctx->md = EVP_sha1();
  384. }
  385. rctx->pad_mode = p1;
  386. return 1;
  387. }
  388. bad_pad:
  389. RSAerr(RSA_F_PKEY_RSA_CTRL,
  390. RSA_R_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE);
  391. return -2;
  392. case EVP_PKEY_CTRL_GET_RSA_PADDING:
  393. *(int *)p2 = rctx->pad_mode;
  394. return 1;
  395. case EVP_PKEY_CTRL_RSA_PSS_SALTLEN:
  396. case EVP_PKEY_CTRL_GET_RSA_PSS_SALTLEN:
  397. if (rctx->pad_mode != RSA_PKCS1_PSS_PADDING) {
  398. RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_INVALID_PSS_SALTLEN);
  399. return -2;
  400. }
  401. if (type == EVP_PKEY_CTRL_GET_RSA_PSS_SALTLEN) {
  402. *(int *)p2 = rctx->saltlen;
  403. } else {
  404. if (p1 < RSA_PSS_SALTLEN_MAX)
  405. return -2;
  406. if (rsa_pss_restricted(rctx)) {
  407. if (p1 == RSA_PSS_SALTLEN_AUTO
  408. && ctx->operation == EVP_PKEY_OP_VERIFY) {
  409. RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_INVALID_PSS_SALTLEN);
  410. return -2;
  411. }
  412. if ((p1 == RSA_PSS_SALTLEN_DIGEST
  413. && rctx->min_saltlen > EVP_MD_size(rctx->md))
  414. || (p1 >= 0 && p1 < rctx->min_saltlen)) {
  415. RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_PSS_SALTLEN_TOO_SMALL);
  416. return 0;
  417. }
  418. }
  419. rctx->saltlen = p1;
  420. }
  421. return 1;
  422. case EVP_PKEY_CTRL_RSA_KEYGEN_BITS:
  423. if (p1 < RSA_MIN_MODULUS_BITS) {
  424. RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_KEY_SIZE_TOO_SMALL);
  425. return -2;
  426. }
  427. rctx->nbits = p1;
  428. return 1;
  429. case EVP_PKEY_CTRL_RSA_KEYGEN_PUBEXP:
  430. if (p2 == NULL || !BN_is_odd((BIGNUM *)p2) || BN_is_one((BIGNUM *)p2)) {
  431. RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_BAD_E_VALUE);
  432. return -2;
  433. }
  434. BN_free(rctx->pub_exp);
  435. rctx->pub_exp = p2;
  436. return 1;
  437. case EVP_PKEY_CTRL_RSA_KEYGEN_PRIMES:
  438. if (p1 < RSA_DEFAULT_PRIME_NUM || p1 > RSA_MAX_PRIME_NUM) {
  439. RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_KEY_PRIME_NUM_INVALID);
  440. return -2;
  441. }
  442. rctx->primes = p1;
  443. return 1;
  444. case EVP_PKEY_CTRL_RSA_OAEP_MD:
  445. case EVP_PKEY_CTRL_GET_RSA_OAEP_MD:
  446. if (rctx->pad_mode != RSA_PKCS1_OAEP_PADDING) {
  447. RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_INVALID_PADDING_MODE);
  448. return -2;
  449. }
  450. if (type == EVP_PKEY_CTRL_GET_RSA_OAEP_MD)
  451. *(const EVP_MD **)p2 = rctx->md;
  452. else
  453. rctx->md = p2;
  454. return 1;
  455. case EVP_PKEY_CTRL_MD:
  456. if (!check_padding_md(p2, rctx->pad_mode))
  457. return 0;
  458. if (rsa_pss_restricted(rctx)) {
  459. if (EVP_MD_type(rctx->md) == EVP_MD_type(p2))
  460. return 1;
  461. RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_DIGEST_NOT_ALLOWED);
  462. return 0;
  463. }
  464. rctx->md = p2;
  465. return 1;
  466. case EVP_PKEY_CTRL_GET_MD:
  467. *(const EVP_MD **)p2 = rctx->md;
  468. return 1;
  469. case EVP_PKEY_CTRL_RSA_MGF1_MD:
  470. case EVP_PKEY_CTRL_GET_RSA_MGF1_MD:
  471. if (rctx->pad_mode != RSA_PKCS1_PSS_PADDING
  472. && rctx->pad_mode != RSA_PKCS1_OAEP_PADDING) {
  473. RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_INVALID_MGF1_MD);
  474. return -2;
  475. }
  476. if (type == EVP_PKEY_CTRL_GET_RSA_MGF1_MD) {
  477. if (rctx->mgf1md)
  478. *(const EVP_MD **)p2 = rctx->mgf1md;
  479. else
  480. *(const EVP_MD **)p2 = rctx->md;
  481. } else {
  482. if (rsa_pss_restricted(rctx)) {
  483. if (EVP_MD_type(rctx->mgf1md) == EVP_MD_type(p2))
  484. return 1;
  485. RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_MGF1_DIGEST_NOT_ALLOWED);
  486. return 0;
  487. }
  488. rctx->mgf1md = p2;
  489. }
  490. return 1;
  491. case EVP_PKEY_CTRL_RSA_OAEP_LABEL:
  492. if (rctx->pad_mode != RSA_PKCS1_OAEP_PADDING) {
  493. RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_INVALID_PADDING_MODE);
  494. return -2;
  495. }
  496. OPENSSL_free(rctx->oaep_label);
  497. if (p2 && p1 > 0) {
  498. rctx->oaep_label = p2;
  499. rctx->oaep_labellen = p1;
  500. } else {
  501. rctx->oaep_label = NULL;
  502. rctx->oaep_labellen = 0;
  503. }
  504. return 1;
  505. case EVP_PKEY_CTRL_GET_RSA_OAEP_LABEL:
  506. if (rctx->pad_mode != RSA_PKCS1_OAEP_PADDING) {
  507. RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_INVALID_PADDING_MODE);
  508. return -2;
  509. }
  510. *(unsigned char **)p2 = rctx->oaep_label;
  511. return rctx->oaep_labellen;
  512. case EVP_PKEY_CTRL_DIGESTINIT:
  513. case EVP_PKEY_CTRL_PKCS7_SIGN:
  514. #ifndef OPENSSL_NO_CMS
  515. case EVP_PKEY_CTRL_CMS_SIGN:
  516. #endif
  517. return 1;
  518. case EVP_PKEY_CTRL_PKCS7_ENCRYPT:
  519. case EVP_PKEY_CTRL_PKCS7_DECRYPT:
  520. #ifndef OPENSSL_NO_CMS
  521. case EVP_PKEY_CTRL_CMS_DECRYPT:
  522. case EVP_PKEY_CTRL_CMS_ENCRYPT:
  523. #endif
  524. if (!pkey_ctx_is_pss(ctx))
  525. return 1;
  526. /* fall through */
  527. case EVP_PKEY_CTRL_PEER_KEY:
  528. RSAerr(RSA_F_PKEY_RSA_CTRL,
  529. RSA_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
  530. return -2;
  531. default:
  532. return -2;
  533. }
  534. }
  535. static int pkey_rsa_ctrl_str(EVP_PKEY_CTX *ctx,
  536. const char *type, const char *value)
  537. {
  538. if (value == NULL) {
  539. RSAerr(RSA_F_PKEY_RSA_CTRL_STR, RSA_R_VALUE_MISSING);
  540. return 0;
  541. }
  542. if (strcmp(type, "rsa_padding_mode") == 0) {
  543. int pm;
  544. if (strcmp(value, "pkcs1") == 0) {
  545. pm = RSA_PKCS1_PADDING;
  546. } else if (strcmp(value, "sslv23") == 0) {
  547. pm = RSA_SSLV23_PADDING;
  548. } else if (strcmp(value, "none") == 0) {
  549. pm = RSA_NO_PADDING;
  550. } else if (strcmp(value, "oeap") == 0) {
  551. pm = RSA_PKCS1_OAEP_PADDING;
  552. } else if (strcmp(value, "oaep") == 0) {
  553. pm = RSA_PKCS1_OAEP_PADDING;
  554. } else if (strcmp(value, "x931") == 0) {
  555. pm = RSA_X931_PADDING;
  556. } else if (strcmp(value, "pss") == 0) {
  557. pm = RSA_PKCS1_PSS_PADDING;
  558. } else {
  559. RSAerr(RSA_F_PKEY_RSA_CTRL_STR, RSA_R_UNKNOWN_PADDING_TYPE);
  560. return -2;
  561. }
  562. return EVP_PKEY_CTX_set_rsa_padding(ctx, pm);
  563. }
  564. if (strcmp(type, "rsa_pss_saltlen") == 0) {
  565. int saltlen;
  566. if (!strcmp(value, "digest"))
  567. saltlen = RSA_PSS_SALTLEN_DIGEST;
  568. else if (!strcmp(value, "max"))
  569. saltlen = RSA_PSS_SALTLEN_MAX;
  570. else if (!strcmp(value, "auto"))
  571. saltlen = RSA_PSS_SALTLEN_AUTO;
  572. else
  573. saltlen = atoi(value);
  574. return EVP_PKEY_CTX_set_rsa_pss_saltlen(ctx, saltlen);
  575. }
  576. if (strcmp(type, "rsa_keygen_bits") == 0) {
  577. int nbits = atoi(value);
  578. return EVP_PKEY_CTX_set_rsa_keygen_bits(ctx, nbits);
  579. }
  580. if (strcmp(type, "rsa_keygen_pubexp") == 0) {
  581. int ret;
  582. BIGNUM *pubexp = NULL;
  583. if (!BN_asc2bn(&pubexp, value))
  584. return 0;
  585. ret = EVP_PKEY_CTX_set_rsa_keygen_pubexp(ctx, pubexp);
  586. if (ret <= 0)
  587. BN_free(pubexp);
  588. return ret;
  589. }
  590. if (strcmp(type, "rsa_keygen_primes") == 0) {
  591. int nprimes = atoi(value);
  592. return EVP_PKEY_CTX_set_rsa_keygen_primes(ctx, nprimes);
  593. }
  594. if (strcmp(type, "rsa_mgf1_md") == 0)
  595. return EVP_PKEY_CTX_md(ctx,
  596. EVP_PKEY_OP_TYPE_SIG | EVP_PKEY_OP_TYPE_CRYPT,
  597. EVP_PKEY_CTRL_RSA_MGF1_MD, value);
  598. if (pkey_ctx_is_pss(ctx)) {
  599. if (strcmp(type, "rsa_pss_keygen_mgf1_md") == 0)
  600. return EVP_PKEY_CTX_md(ctx, EVP_PKEY_OP_KEYGEN,
  601. EVP_PKEY_CTRL_RSA_MGF1_MD, value);
  602. if (strcmp(type, "rsa_pss_keygen_md") == 0)
  603. return EVP_PKEY_CTX_md(ctx, EVP_PKEY_OP_KEYGEN,
  604. EVP_PKEY_CTRL_MD, value);
  605. if (strcmp(type, "rsa_pss_keygen_saltlen") == 0) {
  606. int saltlen = atoi(value);
  607. return EVP_PKEY_CTX_set_rsa_pss_keygen_saltlen(ctx, saltlen);
  608. }
  609. }
  610. if (strcmp(type, "rsa_oaep_md") == 0)
  611. return EVP_PKEY_CTX_md(ctx, EVP_PKEY_OP_TYPE_CRYPT,
  612. EVP_PKEY_CTRL_RSA_OAEP_MD, value);
  613. if (strcmp(type, "rsa_oaep_label") == 0) {
  614. unsigned char *lab;
  615. long lablen;
  616. int ret;
  617. lab = OPENSSL_hexstr2buf(value, &lablen);
  618. if (!lab)
  619. return 0;
  620. ret = EVP_PKEY_CTX_set0_rsa_oaep_label(ctx, lab, lablen);
  621. if (ret <= 0)
  622. OPENSSL_free(lab);
  623. return ret;
  624. }
  625. return -2;
  626. }
  627. /* Set PSS parameters when generating a key, if necessary */
  628. static int rsa_set_pss_param(RSA *rsa, EVP_PKEY_CTX *ctx)
  629. {
  630. RSA_PKEY_CTX *rctx = ctx->data;
  631. if (!pkey_ctx_is_pss(ctx))
  632. return 1;
  633. /* If all parameters are default values don't set pss */
  634. if (rctx->md == NULL && rctx->mgf1md == NULL && rctx->saltlen == -2)
  635. return 1;
  636. rsa->pss = rsa_pss_params_create(rctx->md, rctx->mgf1md,
  637. rctx->saltlen == -2 ? 0 : rctx->saltlen);
  638. if (rsa->pss == NULL)
  639. return 0;
  640. return 1;
  641. }
  642. static int pkey_rsa_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)
  643. {
  644. RSA *rsa = NULL;
  645. RSA_PKEY_CTX *rctx = ctx->data;
  646. BN_GENCB *pcb;
  647. int ret;
  648. if (rctx->pub_exp == NULL) {
  649. rctx->pub_exp = BN_new();
  650. if (rctx->pub_exp == NULL || !BN_set_word(rctx->pub_exp, RSA_F4))
  651. return 0;
  652. }
  653. rsa = RSA_new();
  654. if (rsa == NULL)
  655. return 0;
  656. if (ctx->pkey_gencb) {
  657. pcb = BN_GENCB_new();
  658. if (pcb == NULL) {
  659. RSA_free(rsa);
  660. return 0;
  661. }
  662. evp_pkey_set_cb_translate(pcb, ctx);
  663. } else {
  664. pcb = NULL;
  665. }
  666. ret = RSA_generate_multi_prime_key(rsa, rctx->nbits, rctx->primes,
  667. rctx->pub_exp, pcb);
  668. BN_GENCB_free(pcb);
  669. if (ret > 0 && !rsa_set_pss_param(rsa, ctx)) {
  670. RSA_free(rsa);
  671. return 0;
  672. }
  673. if (ret > 0)
  674. EVP_PKEY_assign(pkey, ctx->pmeth->pkey_id, rsa);
  675. else
  676. RSA_free(rsa);
  677. return ret;
  678. }
  679. const EVP_PKEY_METHOD rsa_pkey_meth = {
  680. EVP_PKEY_RSA,
  681. EVP_PKEY_FLAG_AUTOARGLEN,
  682. pkey_rsa_init,
  683. pkey_rsa_copy,
  684. pkey_rsa_cleanup,
  685. 0, 0,
  686. 0,
  687. pkey_rsa_keygen,
  688. 0,
  689. pkey_rsa_sign,
  690. 0,
  691. pkey_rsa_verify,
  692. 0,
  693. pkey_rsa_verifyrecover,
  694. 0, 0, 0, 0,
  695. 0,
  696. pkey_rsa_encrypt,
  697. 0,
  698. pkey_rsa_decrypt,
  699. 0, 0,
  700. pkey_rsa_ctrl,
  701. pkey_rsa_ctrl_str
  702. };
  703. /*
  704. * Called for PSS sign or verify initialisation: checks PSS parameter
  705. * sanity and sets any restrictions on key usage.
  706. */
  707. static int pkey_pss_init(EVP_PKEY_CTX *ctx)
  708. {
  709. RSA *rsa;
  710. RSA_PKEY_CTX *rctx = ctx->data;
  711. const EVP_MD *md;
  712. const EVP_MD *mgf1md;
  713. int min_saltlen, max_saltlen;
  714. /* Should never happen */
  715. if (!pkey_ctx_is_pss(ctx))
  716. return 0;
  717. rsa = ctx->pkey->pkey.rsa;
  718. /* If no restrictions just return */
  719. if (rsa->pss == NULL)
  720. return 1;
  721. /* Get and check parameters */
  722. if (!rsa_pss_get_param(rsa->pss, &md, &mgf1md, &min_saltlen))
  723. return 0;
  724. /* See if minimum salt length exceeds maximum possible */
  725. max_saltlen = RSA_size(rsa) - EVP_MD_size(md);
  726. if ((RSA_bits(rsa) & 0x7) == 1)
  727. max_saltlen--;
  728. if (min_saltlen > max_saltlen) {
  729. RSAerr(RSA_F_PKEY_PSS_INIT, RSA_R_INVALID_SALT_LENGTH);
  730. return 0;
  731. }
  732. rctx->min_saltlen = min_saltlen;
  733. /*
  734. * Set PSS restrictions as defaults: we can then block any attempt to
  735. * use invalid values in pkey_rsa_ctrl
  736. */
  737. rctx->md = md;
  738. rctx->mgf1md = mgf1md;
  739. rctx->saltlen = min_saltlen;
  740. return 1;
  741. }
  742. const EVP_PKEY_METHOD rsa_pss_pkey_meth = {
  743. EVP_PKEY_RSA_PSS,
  744. EVP_PKEY_FLAG_AUTOARGLEN,
  745. pkey_rsa_init,
  746. pkey_rsa_copy,
  747. pkey_rsa_cleanup,
  748. 0, 0,
  749. 0,
  750. pkey_rsa_keygen,
  751. pkey_pss_init,
  752. pkey_rsa_sign,
  753. pkey_pss_init,
  754. pkey_rsa_verify,
  755. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  756. pkey_rsa_ctrl,
  757. pkey_rsa_ctrl_str
  758. };