rsa_pss.c 7.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255
  1. /*
  2. * Copyright 2005-2018 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #include <stdio.h>
  10. #include "internal/cryptlib.h"
  11. #include <openssl/bn.h>
  12. #include <openssl/rsa.h>
  13. #include <openssl/evp.h>
  14. #include <openssl/rand.h>
  15. #include <openssl/sha.h>
  16. #include "rsa_local.h"
  17. static const unsigned char zeroes[] = { 0, 0, 0, 0, 0, 0, 0, 0 };
  18. #if defined(_MSC_VER) && defined(_ARM_)
  19. # pragma optimize("g", off)
  20. #endif
  21. int RSA_verify_PKCS1_PSS(RSA *rsa, const unsigned char *mHash,
  22. const EVP_MD *Hash, const unsigned char *EM,
  23. int sLen)
  24. {
  25. return RSA_verify_PKCS1_PSS_mgf1(rsa, mHash, Hash, NULL, EM, sLen);
  26. }
  27. int RSA_verify_PKCS1_PSS_mgf1(RSA *rsa, const unsigned char *mHash,
  28. const EVP_MD *Hash, const EVP_MD *mgf1Hash,
  29. const unsigned char *EM, int sLen)
  30. {
  31. int i;
  32. int ret = 0;
  33. int hLen, maskedDBLen, MSBits, emLen;
  34. const unsigned char *H;
  35. unsigned char *DB = NULL;
  36. EVP_MD_CTX *ctx = EVP_MD_CTX_new();
  37. unsigned char H_[EVP_MAX_MD_SIZE];
  38. if (ctx == NULL)
  39. goto err;
  40. if (mgf1Hash == NULL)
  41. mgf1Hash = Hash;
  42. hLen = EVP_MD_size(Hash);
  43. if (hLen < 0)
  44. goto err;
  45. /*-
  46. * Negative sLen has special meanings:
  47. * -1 sLen == hLen
  48. * -2 salt length is autorecovered from signature
  49. * -3 salt length is maximized
  50. * -N reserved
  51. */
  52. if (sLen == RSA_PSS_SALTLEN_DIGEST) {
  53. sLen = hLen;
  54. } else if (sLen < RSA_PSS_SALTLEN_MAX) {
  55. RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_SLEN_CHECK_FAILED);
  56. goto err;
  57. }
  58. MSBits = (BN_num_bits(rsa->n) - 1) & 0x7;
  59. emLen = RSA_size(rsa);
  60. if (EM[0] & (0xFF << MSBits)) {
  61. RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_FIRST_OCTET_INVALID);
  62. goto err;
  63. }
  64. if (MSBits == 0) {
  65. EM++;
  66. emLen--;
  67. }
  68. if (emLen < hLen + 2) {
  69. RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_DATA_TOO_LARGE);
  70. goto err;
  71. }
  72. if (sLen == RSA_PSS_SALTLEN_MAX) {
  73. sLen = emLen - hLen - 2;
  74. } else if (sLen > emLen - hLen - 2) { /* sLen can be small negative */
  75. RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_DATA_TOO_LARGE);
  76. goto err;
  77. }
  78. if (EM[emLen - 1] != 0xbc) {
  79. RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_LAST_OCTET_INVALID);
  80. goto err;
  81. }
  82. maskedDBLen = emLen - hLen - 1;
  83. H = EM + maskedDBLen;
  84. DB = OPENSSL_malloc(maskedDBLen);
  85. if (DB == NULL) {
  86. RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, ERR_R_MALLOC_FAILURE);
  87. goto err;
  88. }
  89. if (PKCS1_MGF1(DB, maskedDBLen, H, hLen, mgf1Hash) < 0)
  90. goto err;
  91. for (i = 0; i < maskedDBLen; i++)
  92. DB[i] ^= EM[i];
  93. if (MSBits)
  94. DB[0] &= 0xFF >> (8 - MSBits);
  95. for (i = 0; DB[i] == 0 && i < (maskedDBLen - 1); i++) ;
  96. if (DB[i++] != 0x1) {
  97. RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_SLEN_RECOVERY_FAILED);
  98. goto err;
  99. }
  100. if (sLen != RSA_PSS_SALTLEN_AUTO && (maskedDBLen - i) != sLen) {
  101. RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_SLEN_CHECK_FAILED);
  102. goto err;
  103. }
  104. if (!EVP_DigestInit_ex(ctx, Hash, NULL)
  105. || !EVP_DigestUpdate(ctx, zeroes, sizeof(zeroes))
  106. || !EVP_DigestUpdate(ctx, mHash, hLen))
  107. goto err;
  108. if (maskedDBLen - i) {
  109. if (!EVP_DigestUpdate(ctx, DB + i, maskedDBLen - i))
  110. goto err;
  111. }
  112. if (!EVP_DigestFinal_ex(ctx, H_, NULL))
  113. goto err;
  114. if (memcmp(H_, H, hLen)) {
  115. RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_BAD_SIGNATURE);
  116. ret = 0;
  117. } else {
  118. ret = 1;
  119. }
  120. err:
  121. OPENSSL_free(DB);
  122. EVP_MD_CTX_free(ctx);
  123. return ret;
  124. }
  125. int RSA_padding_add_PKCS1_PSS(RSA *rsa, unsigned char *EM,
  126. const unsigned char *mHash,
  127. const EVP_MD *Hash, int sLen)
  128. {
  129. return RSA_padding_add_PKCS1_PSS_mgf1(rsa, EM, mHash, Hash, NULL, sLen);
  130. }
  131. int RSA_padding_add_PKCS1_PSS_mgf1(RSA *rsa, unsigned char *EM,
  132. const unsigned char *mHash,
  133. const EVP_MD *Hash, const EVP_MD *mgf1Hash,
  134. int sLen)
  135. {
  136. int i;
  137. int ret = 0;
  138. int hLen, maskedDBLen, MSBits, emLen;
  139. unsigned char *H, *salt = NULL, *p;
  140. EVP_MD_CTX *ctx = NULL;
  141. if (mgf1Hash == NULL)
  142. mgf1Hash = Hash;
  143. hLen = EVP_MD_size(Hash);
  144. if (hLen < 0)
  145. goto err;
  146. /*-
  147. * Negative sLen has special meanings:
  148. * -1 sLen == hLen
  149. * -2 salt length is maximized
  150. * -3 same as above (on signing)
  151. * -N reserved
  152. */
  153. if (sLen == RSA_PSS_SALTLEN_DIGEST) {
  154. sLen = hLen;
  155. } else if (sLen == RSA_PSS_SALTLEN_MAX_SIGN) {
  156. sLen = RSA_PSS_SALTLEN_MAX;
  157. } else if (sLen < RSA_PSS_SALTLEN_MAX) {
  158. RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_PSS_MGF1, RSA_R_SLEN_CHECK_FAILED);
  159. goto err;
  160. }
  161. MSBits = (BN_num_bits(rsa->n) - 1) & 0x7;
  162. emLen = RSA_size(rsa);
  163. if (MSBits == 0) {
  164. *EM++ = 0;
  165. emLen--;
  166. }
  167. if (emLen < hLen + 2) {
  168. RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_PSS_MGF1,
  169. RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE);
  170. goto err;
  171. }
  172. if (sLen == RSA_PSS_SALTLEN_MAX) {
  173. sLen = emLen - hLen - 2;
  174. } else if (sLen > emLen - hLen - 2) {
  175. RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_PSS_MGF1,
  176. RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE);
  177. goto err;
  178. }
  179. if (sLen > 0) {
  180. salt = OPENSSL_malloc(sLen);
  181. if (salt == NULL) {
  182. RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_PSS_MGF1,
  183. ERR_R_MALLOC_FAILURE);
  184. goto err;
  185. }
  186. if (RAND_bytes(salt, sLen) <= 0)
  187. goto err;
  188. }
  189. maskedDBLen = emLen - hLen - 1;
  190. H = EM + maskedDBLen;
  191. ctx = EVP_MD_CTX_new();
  192. if (ctx == NULL)
  193. goto err;
  194. if (!EVP_DigestInit_ex(ctx, Hash, NULL)
  195. || !EVP_DigestUpdate(ctx, zeroes, sizeof(zeroes))
  196. || !EVP_DigestUpdate(ctx, mHash, hLen))
  197. goto err;
  198. if (sLen && !EVP_DigestUpdate(ctx, salt, sLen))
  199. goto err;
  200. if (!EVP_DigestFinal_ex(ctx, H, NULL))
  201. goto err;
  202. /* Generate dbMask in place then perform XOR on it */
  203. if (PKCS1_MGF1(EM, maskedDBLen, H, hLen, mgf1Hash))
  204. goto err;
  205. p = EM;
  206. /*
  207. * Initial PS XORs with all zeroes which is a NOP so just update pointer.
  208. * Note from a test above this value is guaranteed to be non-negative.
  209. */
  210. p += emLen - sLen - hLen - 2;
  211. *p++ ^= 0x1;
  212. if (sLen > 0) {
  213. for (i = 0; i < sLen; i++)
  214. *p++ ^= salt[i];
  215. }
  216. if (MSBits)
  217. EM[0] &= 0xFF >> (8 - MSBits);
  218. /* H is already in place so just set final 0xbc */
  219. EM[emLen - 1] = 0xbc;
  220. ret = 1;
  221. err:
  222. EVP_MD_CTX_free(ctx);
  223. OPENSSL_clear_free(salt, (size_t)sLen); /* salt != NULL implies sLen > 0 */
  224. return ret;
  225. }
  226. #if defined(_MSC_VER)
  227. # pragma optimize("",on)
  228. #endif