Magnificent7 / Hackathon

Includes library modifications to allow access to AIN_4 (AIN_0 / 5)

mbd_os/features/mbedtls/src/rsa.c@0:eafc3fd41f75, 2016-09-20 (annotated)

Committer:
bryantaylor
Date:
Tue Sep 20 21:26:12 2016 +0000
Revision:
0:eafc3fd41f75
hackathon

Who changed what in which revision?

UserRevisionLine numberNew contents of line
bryantaylor 0:eafc3fd41f75 1 /*
bryantaylor 0:eafc3fd41f75 2 * The RSA public-key cryptosystem
bryantaylor 0:eafc3fd41f75 3 *
bryantaylor 0:eafc3fd41f75 4 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
bryantaylor 0:eafc3fd41f75 5 * SPDX-License-Identifier: Apache-2.0
bryantaylor 0:eafc3fd41f75 6 *
bryantaylor 0:eafc3fd41f75 7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
bryantaylor 0:eafc3fd41f75 8 * not use this file except in compliance with the License.
bryantaylor 0:eafc3fd41f75 9 * You may obtain a copy of the License at
bryantaylor 0:eafc3fd41f75 10 *
bryantaylor 0:eafc3fd41f75 11 * http://www.apache.org/licenses/LICENSE-2.0
bryantaylor 0:eafc3fd41f75 12 *
bryantaylor 0:eafc3fd41f75 13 * Unless required by applicable law or agreed to in writing, software
bryantaylor 0:eafc3fd41f75 14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
bryantaylor 0:eafc3fd41f75 15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
bryantaylor 0:eafc3fd41f75 16 * See the License for the specific language governing permissions and
bryantaylor 0:eafc3fd41f75 17 * limitations under the License.
bryantaylor 0:eafc3fd41f75 18 *
bryantaylor 0:eafc3fd41f75 19 * This file is part of mbed TLS (https://tls.mbed.org)
bryantaylor 0:eafc3fd41f75 20 */
bryantaylor 0:eafc3fd41f75 21 /*
bryantaylor 0:eafc3fd41f75 22 * The following sources were referenced in the design of this implementation
bryantaylor 0:eafc3fd41f75 23 * of the RSA algorithm:
bryantaylor 0:eafc3fd41f75 24 *
bryantaylor 0:eafc3fd41f75 25 * [1] A method for obtaining digital signatures and public-key cryptosystems
bryantaylor 0:eafc3fd41f75 26 * R Rivest, A Shamir, and L Adleman
bryantaylor 0:eafc3fd41f75 27 * http://people.csail.mit.edu/rivest/pubs.html#RSA78
bryantaylor 0:eafc3fd41f75 28 *
bryantaylor 0:eafc3fd41f75 29 * [2] Handbook of Applied Cryptography - 1997, Chapter 8
bryantaylor 0:eafc3fd41f75 30 * Menezes, van Oorschot and Vanstone
bryantaylor 0:eafc3fd41f75 31 *
bryantaylor 0:eafc3fd41f75 32 */
bryantaylor 0:eafc3fd41f75 33
bryantaylor 0:eafc3fd41f75 34 #if !defined(MBEDTLS_CONFIG_FILE)
bryantaylor 0:eafc3fd41f75 35 #include "mbedtls/config.h"
bryantaylor 0:eafc3fd41f75 36 #else
bryantaylor 0:eafc3fd41f75 37 #include MBEDTLS_CONFIG_FILE
bryantaylor 0:eafc3fd41f75 38 #endif
bryantaylor 0:eafc3fd41f75 39
bryantaylor 0:eafc3fd41f75 40 #if defined(MBEDTLS_RSA_C)
bryantaylor 0:eafc3fd41f75 41
bryantaylor 0:eafc3fd41f75 42 #include "mbedtls/rsa.h"
bryantaylor 0:eafc3fd41f75 43 #include "mbedtls/oid.h"
bryantaylor 0:eafc3fd41f75 44
bryantaylor 0:eafc3fd41f75 45 #include <string.h>
bryantaylor 0:eafc3fd41f75 46
bryantaylor 0:eafc3fd41f75 47 #if defined(MBEDTLS_PKCS1_V21)
bryantaylor 0:eafc3fd41f75 48 #include "mbedtls/md.h"
bryantaylor 0:eafc3fd41f75 49 #endif
bryantaylor 0:eafc3fd41f75 50
bryantaylor 0:eafc3fd41f75 51 #if defined(MBEDTLS_PKCS1_V15) && !defined(__OpenBSD__)
bryantaylor 0:eafc3fd41f75 52 #include <stdlib.h>
bryantaylor 0:eafc3fd41f75 53 #endif
bryantaylor 0:eafc3fd41f75 54
bryantaylor 0:eafc3fd41f75 55 #if defined(MBEDTLS_PLATFORM_C)
bryantaylor 0:eafc3fd41f75 56 #include "mbedtls/platform.h"
bryantaylor 0:eafc3fd41f75 57 #else
bryantaylor 0:eafc3fd41f75 58 #include <stdio.h>
bryantaylor 0:eafc3fd41f75 59 #define mbedtls_printf printf
bryantaylor 0:eafc3fd41f75 60 #define mbedtls_calloc calloc
bryantaylor 0:eafc3fd41f75 61 #define mbedtls_free free
bryantaylor 0:eafc3fd41f75 62 #endif
bryantaylor 0:eafc3fd41f75 63
bryantaylor 0:eafc3fd41f75 64 /*
bryantaylor 0:eafc3fd41f75 65 * Initialize an RSA context
bryantaylor 0:eafc3fd41f75 66 */
bryantaylor 0:eafc3fd41f75 67 void mbedtls_rsa_init( mbedtls_rsa_context *ctx,
bryantaylor 0:eafc3fd41f75 68 int padding,
bryantaylor 0:eafc3fd41f75 69 int hash_id )
bryantaylor 0:eafc3fd41f75 70 {
bryantaylor 0:eafc3fd41f75 71 memset( ctx, 0, sizeof( mbedtls_rsa_context ) );
bryantaylor 0:eafc3fd41f75 72
bryantaylor 0:eafc3fd41f75 73 mbedtls_rsa_set_padding( ctx, padding, hash_id );
bryantaylor 0:eafc3fd41f75 74
bryantaylor 0:eafc3fd41f75 75 #if defined(MBEDTLS_THREADING_C)
bryantaylor 0:eafc3fd41f75 76 mbedtls_mutex_init( &ctx->mutex );
bryantaylor 0:eafc3fd41f75 77 #endif
bryantaylor 0:eafc3fd41f75 78 }
bryantaylor 0:eafc3fd41f75 79
bryantaylor 0:eafc3fd41f75 80 /*
bryantaylor 0:eafc3fd41f75 81 * Set padding for an existing RSA context
bryantaylor 0:eafc3fd41f75 82 */
bryantaylor 0:eafc3fd41f75 83 void mbedtls_rsa_set_padding( mbedtls_rsa_context *ctx, int padding, int hash_id )
bryantaylor 0:eafc3fd41f75 84 {
bryantaylor 0:eafc3fd41f75 85 ctx->padding = padding;
bryantaylor 0:eafc3fd41f75 86 ctx->hash_id = hash_id;
bryantaylor 0:eafc3fd41f75 87 }
bryantaylor 0:eafc3fd41f75 88
bryantaylor 0:eafc3fd41f75 89 #if defined(MBEDTLS_GENPRIME)
bryantaylor 0:eafc3fd41f75 90
bryantaylor 0:eafc3fd41f75 91 /*
bryantaylor 0:eafc3fd41f75 92 * Generate an RSA keypair
bryantaylor 0:eafc3fd41f75 93 */
bryantaylor 0:eafc3fd41f75 94 int mbedtls_rsa_gen_key( mbedtls_rsa_context *ctx,
bryantaylor 0:eafc3fd41f75 95 int (*f_rng)(void *, unsigned char *, size_t),
bryantaylor 0:eafc3fd41f75 96 void *p_rng,
bryantaylor 0:eafc3fd41f75 97 unsigned int nbits, int exponent )
bryantaylor 0:eafc3fd41f75 98 {
bryantaylor 0:eafc3fd41f75 99 int ret;
bryantaylor 0:eafc3fd41f75 100 mbedtls_mpi P1, Q1, H, G;
bryantaylor 0:eafc3fd41f75 101
bryantaylor 0:eafc3fd41f75 102 if( f_rng == NULL || nbits < 128 || exponent < 3 )
bryantaylor 0:eafc3fd41f75 103 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
bryantaylor 0:eafc3fd41f75 104
bryantaylor 0:eafc3fd41f75 105 mbedtls_mpi_init( &P1 ); mbedtls_mpi_init( &Q1 );
bryantaylor 0:eafc3fd41f75 106 mbedtls_mpi_init( &H ); mbedtls_mpi_init( &G );
bryantaylor 0:eafc3fd41f75 107
bryantaylor 0:eafc3fd41f75 108 /*
bryantaylor 0:eafc3fd41f75 109 * find primes P and Q with Q < P so that:
bryantaylor 0:eafc3fd41f75 110 * GCD( E, (P-1)*(Q-1) ) == 1
bryantaylor 0:eafc3fd41f75 111 */
bryantaylor 0:eafc3fd41f75 112 MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &ctx->E, exponent ) );
bryantaylor 0:eafc3fd41f75 113
bryantaylor 0:eafc3fd41f75 114 do
bryantaylor 0:eafc3fd41f75 115 {
bryantaylor 0:eafc3fd41f75 116 MBEDTLS_MPI_CHK( mbedtls_mpi_gen_prime( &ctx->P, nbits >> 1, 0,
bryantaylor 0:eafc3fd41f75 117 f_rng, p_rng ) );
bryantaylor 0:eafc3fd41f75 118
bryantaylor 0:eafc3fd41f75 119 if( nbits % 2 )
bryantaylor 0:eafc3fd41f75 120 {
bryantaylor 0:eafc3fd41f75 121 MBEDTLS_MPI_CHK( mbedtls_mpi_gen_prime( &ctx->Q, ( nbits >> 1 ) + 1, 0,
bryantaylor 0:eafc3fd41f75 122 f_rng, p_rng ) );
bryantaylor 0:eafc3fd41f75 123 }
bryantaylor 0:eafc3fd41f75 124 else
bryantaylor 0:eafc3fd41f75 125 {
bryantaylor 0:eafc3fd41f75 126 MBEDTLS_MPI_CHK( mbedtls_mpi_gen_prime( &ctx->Q, nbits >> 1, 0,
bryantaylor 0:eafc3fd41f75 127 f_rng, p_rng ) );
bryantaylor 0:eafc3fd41f75 128 }
bryantaylor 0:eafc3fd41f75 129
bryantaylor 0:eafc3fd41f75 130 if( mbedtls_mpi_cmp_mpi( &ctx->P, &ctx->Q ) == 0 )
bryantaylor 0:eafc3fd41f75 131 continue;
bryantaylor 0:eafc3fd41f75 132
bryantaylor 0:eafc3fd41f75 133 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ctx->N, &ctx->P, &ctx->Q ) );
bryantaylor 0:eafc3fd41f75 134 if( mbedtls_mpi_bitlen( &ctx->N ) != nbits )
bryantaylor 0:eafc3fd41f75 135 continue;
bryantaylor 0:eafc3fd41f75 136
bryantaylor 0:eafc3fd41f75 137 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &P1, &ctx->P, 1 ) );
bryantaylor 0:eafc3fd41f75 138 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &Q1, &ctx->Q, 1 ) );
bryantaylor 0:eafc3fd41f75 139 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &H, &P1, &Q1 ) );
bryantaylor 0:eafc3fd41f75 140 MBEDTLS_MPI_CHK( mbedtls_mpi_gcd( &G, &ctx->E, &H ) );
bryantaylor 0:eafc3fd41f75 141 }
bryantaylor 0:eafc3fd41f75 142 while( mbedtls_mpi_cmp_int( &G, 1 ) != 0 );
bryantaylor 0:eafc3fd41f75 143
bryantaylor 0:eafc3fd41f75 144 /*
bryantaylor 0:eafc3fd41f75 145 * D = E^-1 mod ((P-1)*(Q-1))
bryantaylor 0:eafc3fd41f75 146 * DP = D mod (P - 1)
bryantaylor 0:eafc3fd41f75 147 * DQ = D mod (Q - 1)
bryantaylor 0:eafc3fd41f75 148 * QP = Q^-1 mod P
bryantaylor 0:eafc3fd41f75 149 */
bryantaylor 0:eafc3fd41f75 150 MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( &ctx->D , &ctx->E, &H ) );
bryantaylor 0:eafc3fd41f75 151 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &ctx->DP, &ctx->D, &P1 ) );
bryantaylor 0:eafc3fd41f75 152 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &ctx->DQ, &ctx->D, &Q1 ) );
bryantaylor 0:eafc3fd41f75 153 MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( &ctx->QP, &ctx->Q, &ctx->P ) );
bryantaylor 0:eafc3fd41f75 154
bryantaylor 0:eafc3fd41f75 155 ctx->len = ( mbedtls_mpi_bitlen( &ctx->N ) + 7 ) >> 3;
bryantaylor 0:eafc3fd41f75 156
bryantaylor 0:eafc3fd41f75 157 cleanup:
bryantaylor 0:eafc3fd41f75 158
bryantaylor 0:eafc3fd41f75 159 mbedtls_mpi_free( &P1 ); mbedtls_mpi_free( &Q1 ); mbedtls_mpi_free( &H ); mbedtls_mpi_free( &G );
bryantaylor 0:eafc3fd41f75 160
bryantaylor 0:eafc3fd41f75 161 if( ret != 0 )
bryantaylor 0:eafc3fd41f75 162 {
bryantaylor 0:eafc3fd41f75 163 mbedtls_rsa_free( ctx );
bryantaylor 0:eafc3fd41f75 164 return( MBEDTLS_ERR_RSA_KEY_GEN_FAILED + ret );
bryantaylor 0:eafc3fd41f75 165 }
bryantaylor 0:eafc3fd41f75 166
bryantaylor 0:eafc3fd41f75 167 return( 0 );
bryantaylor 0:eafc3fd41f75 168 }
bryantaylor 0:eafc3fd41f75 169
bryantaylor 0:eafc3fd41f75 170 #endif /* MBEDTLS_GENPRIME */
bryantaylor 0:eafc3fd41f75 171
bryantaylor 0:eafc3fd41f75 172 /*
bryantaylor 0:eafc3fd41f75 173 * Check a public RSA key
bryantaylor 0:eafc3fd41f75 174 */
bryantaylor 0:eafc3fd41f75 175 int mbedtls_rsa_check_pubkey( const mbedtls_rsa_context *ctx )
bryantaylor 0:eafc3fd41f75 176 {
bryantaylor 0:eafc3fd41f75 177 if( !ctx->N.p || !ctx->E.p )
bryantaylor 0:eafc3fd41f75 178 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
bryantaylor 0:eafc3fd41f75 179
bryantaylor 0:eafc3fd41f75 180 if( ( ctx->N.p[0] & 1 ) == 0 ||
bryantaylor 0:eafc3fd41f75 181 ( ctx->E.p[0] & 1 ) == 0 )
bryantaylor 0:eafc3fd41f75 182 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
bryantaylor 0:eafc3fd41f75 183
bryantaylor 0:eafc3fd41f75 184 if( mbedtls_mpi_bitlen( &ctx->N ) < 128 ||
bryantaylor 0:eafc3fd41f75 185 mbedtls_mpi_bitlen( &ctx->N ) > MBEDTLS_MPI_MAX_BITS )
bryantaylor 0:eafc3fd41f75 186 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
bryantaylor 0:eafc3fd41f75 187
bryantaylor 0:eafc3fd41f75 188 if( mbedtls_mpi_bitlen( &ctx->E ) < 2 ||
bryantaylor 0:eafc3fd41f75 189 mbedtls_mpi_cmp_mpi( &ctx->E, &ctx->N ) >= 0 )
bryantaylor 0:eafc3fd41f75 190 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
bryantaylor 0:eafc3fd41f75 191
bryantaylor 0:eafc3fd41f75 192 return( 0 );
bryantaylor 0:eafc3fd41f75 193 }
bryantaylor 0:eafc3fd41f75 194
bryantaylor 0:eafc3fd41f75 195 /*
bryantaylor 0:eafc3fd41f75 196 * Check a private RSA key
bryantaylor 0:eafc3fd41f75 197 */
bryantaylor 0:eafc3fd41f75 198 int mbedtls_rsa_check_privkey( const mbedtls_rsa_context *ctx )
bryantaylor 0:eafc3fd41f75 199 {
bryantaylor 0:eafc3fd41f75 200 int ret;
bryantaylor 0:eafc3fd41f75 201 mbedtls_mpi PQ, DE, P1, Q1, H, I, G, G2, L1, L2, DP, DQ, QP;
bryantaylor 0:eafc3fd41f75 202
bryantaylor 0:eafc3fd41f75 203 if( ( ret = mbedtls_rsa_check_pubkey( ctx ) ) != 0 )
bryantaylor 0:eafc3fd41f75 204 return( ret );
bryantaylor 0:eafc3fd41f75 205
bryantaylor 0:eafc3fd41f75 206 if( !ctx->P.p || !ctx->Q.p || !ctx->D.p )
bryantaylor 0:eafc3fd41f75 207 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
bryantaylor 0:eafc3fd41f75 208
bryantaylor 0:eafc3fd41f75 209 mbedtls_mpi_init( &PQ ); mbedtls_mpi_init( &DE ); mbedtls_mpi_init( &P1 ); mbedtls_mpi_init( &Q1 );
bryantaylor 0:eafc3fd41f75 210 mbedtls_mpi_init( &H ); mbedtls_mpi_init( &I ); mbedtls_mpi_init( &G ); mbedtls_mpi_init( &G2 );
bryantaylor 0:eafc3fd41f75 211 mbedtls_mpi_init( &L1 ); mbedtls_mpi_init( &L2 ); mbedtls_mpi_init( &DP ); mbedtls_mpi_init( &DQ );
bryantaylor 0:eafc3fd41f75 212 mbedtls_mpi_init( &QP );
bryantaylor 0:eafc3fd41f75 213
bryantaylor 0:eafc3fd41f75 214 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &PQ, &ctx->P, &ctx->Q ) );
bryantaylor 0:eafc3fd41f75 215 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &DE, &ctx->D, &ctx->E ) );
bryantaylor 0:eafc3fd41f75 216 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &P1, &ctx->P, 1 ) );
bryantaylor 0:eafc3fd41f75 217 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &Q1, &ctx->Q, 1 ) );
bryantaylor 0:eafc3fd41f75 218 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &H, &P1, &Q1 ) );
bryantaylor 0:eafc3fd41f75 219 MBEDTLS_MPI_CHK( mbedtls_mpi_gcd( &G, &ctx->E, &H ) );
bryantaylor 0:eafc3fd41f75 220
bryantaylor 0:eafc3fd41f75 221 MBEDTLS_MPI_CHK( mbedtls_mpi_gcd( &G2, &P1, &Q1 ) );
bryantaylor 0:eafc3fd41f75 222 MBEDTLS_MPI_CHK( mbedtls_mpi_div_mpi( &L1, &L2, &H, &G2 ) );
bryantaylor 0:eafc3fd41f75 223 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &I, &DE, &L1 ) );
bryantaylor 0:eafc3fd41f75 224
bryantaylor 0:eafc3fd41f75 225 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &DP, &ctx->D, &P1 ) );
bryantaylor 0:eafc3fd41f75 226 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &DQ, &ctx->D, &Q1 ) );
bryantaylor 0:eafc3fd41f75 227 MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( &QP, &ctx->Q, &ctx->P ) );
bryantaylor 0:eafc3fd41f75 228 /*
bryantaylor 0:eafc3fd41f75 229 * Check for a valid PKCS1v2 private key
bryantaylor 0:eafc3fd41f75 230 */
bryantaylor 0:eafc3fd41f75 231 if( mbedtls_mpi_cmp_mpi( &PQ, &ctx->N ) != 0 ||
bryantaylor 0:eafc3fd41f75 232 mbedtls_mpi_cmp_mpi( &DP, &ctx->DP ) != 0 ||
bryantaylor 0:eafc3fd41f75 233 mbedtls_mpi_cmp_mpi( &DQ, &ctx->DQ ) != 0 ||
bryantaylor 0:eafc3fd41f75 234 mbedtls_mpi_cmp_mpi( &QP, &ctx->QP ) != 0 ||
bryantaylor 0:eafc3fd41f75 235 mbedtls_mpi_cmp_int( &L2, 0 ) != 0 ||
bryantaylor 0:eafc3fd41f75 236 mbedtls_mpi_cmp_int( &I, 1 ) != 0 ||
bryantaylor 0:eafc3fd41f75 237 mbedtls_mpi_cmp_int( &G, 1 ) != 0 )
bryantaylor 0:eafc3fd41f75 238 {
bryantaylor 0:eafc3fd41f75 239 ret = MBEDTLS_ERR_RSA_KEY_CHECK_FAILED;
bryantaylor 0:eafc3fd41f75 240 }
bryantaylor 0:eafc3fd41f75 241
bryantaylor 0:eafc3fd41f75 242 cleanup:
bryantaylor 0:eafc3fd41f75 243 mbedtls_mpi_free( &PQ ); mbedtls_mpi_free( &DE ); mbedtls_mpi_free( &P1 ); mbedtls_mpi_free( &Q1 );
bryantaylor 0:eafc3fd41f75 244 mbedtls_mpi_free( &H ); mbedtls_mpi_free( &I ); mbedtls_mpi_free( &G ); mbedtls_mpi_free( &G2 );
bryantaylor 0:eafc3fd41f75 245 mbedtls_mpi_free( &L1 ); mbedtls_mpi_free( &L2 ); mbedtls_mpi_free( &DP ); mbedtls_mpi_free( &DQ );
bryantaylor 0:eafc3fd41f75 246 mbedtls_mpi_free( &QP );
bryantaylor 0:eafc3fd41f75 247
bryantaylor 0:eafc3fd41f75 248 if( ret == MBEDTLS_ERR_RSA_KEY_CHECK_FAILED )
bryantaylor 0:eafc3fd41f75 249 return( ret );
bryantaylor 0:eafc3fd41f75 250
bryantaylor 0:eafc3fd41f75 251 if( ret != 0 )
bryantaylor 0:eafc3fd41f75 252 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED + ret );
bryantaylor 0:eafc3fd41f75 253
bryantaylor 0:eafc3fd41f75 254 return( 0 );
bryantaylor 0:eafc3fd41f75 255 }
bryantaylor 0:eafc3fd41f75 256
bryantaylor 0:eafc3fd41f75 257 /*
bryantaylor 0:eafc3fd41f75 258 * Check if contexts holding a public and private key match
bryantaylor 0:eafc3fd41f75 259 */
bryantaylor 0:eafc3fd41f75 260 int mbedtls_rsa_check_pub_priv( const mbedtls_rsa_context *pub, const mbedtls_rsa_context *prv )
bryantaylor 0:eafc3fd41f75 261 {
bryantaylor 0:eafc3fd41f75 262 if( mbedtls_rsa_check_pubkey( pub ) != 0 ||
bryantaylor 0:eafc3fd41f75 263 mbedtls_rsa_check_privkey( prv ) != 0 )
bryantaylor 0:eafc3fd41f75 264 {
bryantaylor 0:eafc3fd41f75 265 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
bryantaylor 0:eafc3fd41f75 266 }
bryantaylor 0:eafc3fd41f75 267
bryantaylor 0:eafc3fd41f75 268 if( mbedtls_mpi_cmp_mpi( &pub->N, &prv->N ) != 0 ||
bryantaylor 0:eafc3fd41f75 269 mbedtls_mpi_cmp_mpi( &pub->E, &prv->E ) != 0 )
bryantaylor 0:eafc3fd41f75 270 {
bryantaylor 0:eafc3fd41f75 271 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
bryantaylor 0:eafc3fd41f75 272 }
bryantaylor 0:eafc3fd41f75 273
bryantaylor 0:eafc3fd41f75 274 return( 0 );
bryantaylor 0:eafc3fd41f75 275 }
bryantaylor 0:eafc3fd41f75 276
bryantaylor 0:eafc3fd41f75 277 /*
bryantaylor 0:eafc3fd41f75 278 * Do an RSA public key operation
bryantaylor 0:eafc3fd41f75 279 */
bryantaylor 0:eafc3fd41f75 280 int mbedtls_rsa_public( mbedtls_rsa_context *ctx,
bryantaylor 0:eafc3fd41f75 281 const unsigned char *input,
bryantaylor 0:eafc3fd41f75 282 unsigned char *output )
bryantaylor 0:eafc3fd41f75 283 {
bryantaylor 0:eafc3fd41f75 284 int ret;
bryantaylor 0:eafc3fd41f75 285 size_t olen;
bryantaylor 0:eafc3fd41f75 286 mbedtls_mpi T;
bryantaylor 0:eafc3fd41f75 287
bryantaylor 0:eafc3fd41f75 288 mbedtls_mpi_init( &T );
bryantaylor 0:eafc3fd41f75 289
bryantaylor 0:eafc3fd41f75 290 #if defined(MBEDTLS_THREADING_C)
bryantaylor 0:eafc3fd41f75 291 if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
bryantaylor 0:eafc3fd41f75 292 return( ret );
bryantaylor 0:eafc3fd41f75 293 #endif
bryantaylor 0:eafc3fd41f75 294
bryantaylor 0:eafc3fd41f75 295 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &T, input, ctx->len ) );
bryantaylor 0:eafc3fd41f75 296
bryantaylor 0:eafc3fd41f75 297 if( mbedtls_mpi_cmp_mpi( &T, &ctx->N ) >= 0 )
bryantaylor 0:eafc3fd41f75 298 {
bryantaylor 0:eafc3fd41f75 299 ret = MBEDTLS_ERR_MPI_BAD_INPUT_DATA;
bryantaylor 0:eafc3fd41f75 300 goto cleanup;
bryantaylor 0:eafc3fd41f75 301 }
bryantaylor 0:eafc3fd41f75 302
bryantaylor 0:eafc3fd41f75 303 olen = ctx->len;
bryantaylor 0:eafc3fd41f75 304 MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &T, &T, &ctx->E, &ctx->N, &ctx->RN ) );
bryantaylor 0:eafc3fd41f75 305 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &T, output, olen ) );
bryantaylor 0:eafc3fd41f75 306
bryantaylor 0:eafc3fd41f75 307 cleanup:
bryantaylor 0:eafc3fd41f75 308 #if defined(MBEDTLS_THREADING_C)
bryantaylor 0:eafc3fd41f75 309 if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
bryantaylor 0:eafc3fd41f75 310 return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
bryantaylor 0:eafc3fd41f75 311 #endif
bryantaylor 0:eafc3fd41f75 312
bryantaylor 0:eafc3fd41f75 313 mbedtls_mpi_free( &T );
bryantaylor 0:eafc3fd41f75 314
bryantaylor 0:eafc3fd41f75 315 if( ret != 0 )
bryantaylor 0:eafc3fd41f75 316 return( MBEDTLS_ERR_RSA_PUBLIC_FAILED + ret );
bryantaylor 0:eafc3fd41f75 317
bryantaylor 0:eafc3fd41f75 318 return( 0 );
bryantaylor 0:eafc3fd41f75 319 }
bryantaylor 0:eafc3fd41f75 320
bryantaylor 0:eafc3fd41f75 321 /*
bryantaylor 0:eafc3fd41f75 322 * Generate or update blinding values, see section 10 of:
bryantaylor 0:eafc3fd41f75 323 * KOCHER, Paul C. Timing attacks on implementations of Diffie-Hellman, RSA,
bryantaylor 0:eafc3fd41f75 324 * DSS, and other systems. In : Advances in Cryptology-CRYPTO'96. Springer
bryantaylor 0:eafc3fd41f75 325 * Berlin Heidelberg, 1996. p. 104-113.
bryantaylor 0:eafc3fd41f75 326 */
bryantaylor 0:eafc3fd41f75 327 static int rsa_prepare_blinding( mbedtls_rsa_context *ctx,
bryantaylor 0:eafc3fd41f75 328 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
bryantaylor 0:eafc3fd41f75 329 {
bryantaylor 0:eafc3fd41f75 330 int ret, count = 0;
bryantaylor 0:eafc3fd41f75 331
bryantaylor 0:eafc3fd41f75 332 if( ctx->Vf.p != NULL )
bryantaylor 0:eafc3fd41f75 333 {
bryantaylor 0:eafc3fd41f75 334 /* We already have blinding values, just update them by squaring */
bryantaylor 0:eafc3fd41f75 335 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ctx->Vi, &ctx->Vi, &ctx->Vi ) );
bryantaylor 0:eafc3fd41f75 336 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &ctx->Vi, &ctx->Vi, &ctx->N ) );
bryantaylor 0:eafc3fd41f75 337 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ctx->Vf, &ctx->Vf, &ctx->Vf ) );
bryantaylor 0:eafc3fd41f75 338 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &ctx->Vf, &ctx->Vf, &ctx->N ) );
bryantaylor 0:eafc3fd41f75 339
bryantaylor 0:eafc3fd41f75 340 goto cleanup;
bryantaylor 0:eafc3fd41f75 341 }
bryantaylor 0:eafc3fd41f75 342
bryantaylor 0:eafc3fd41f75 343 /* Unblinding value: Vf = random number, invertible mod N */
bryantaylor 0:eafc3fd41f75 344 do {
bryantaylor 0:eafc3fd41f75 345 if( count++ > 10 )
bryantaylor 0:eafc3fd41f75 346 return( MBEDTLS_ERR_RSA_RNG_FAILED );
bryantaylor 0:eafc3fd41f75 347
bryantaylor 0:eafc3fd41f75 348 MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &ctx->Vf, ctx->len - 1, f_rng, p_rng ) );
bryantaylor 0:eafc3fd41f75 349 MBEDTLS_MPI_CHK( mbedtls_mpi_gcd( &ctx->Vi, &ctx->Vf, &ctx->N ) );
bryantaylor 0:eafc3fd41f75 350 } while( mbedtls_mpi_cmp_int( &ctx->Vi, 1 ) != 0 );
bryantaylor 0:eafc3fd41f75 351
bryantaylor 0:eafc3fd41f75 352 /* Blinding value: Vi = Vf^(-e) mod N */
bryantaylor 0:eafc3fd41f75 353 MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( &ctx->Vi, &ctx->Vf, &ctx->N ) );
bryantaylor 0:eafc3fd41f75 354 MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &ctx->Vi, &ctx->Vi, &ctx->E, &ctx->N, &ctx->RN ) );
bryantaylor 0:eafc3fd41f75 355
bryantaylor 0:eafc3fd41f75 356
bryantaylor 0:eafc3fd41f75 357 cleanup:
bryantaylor 0:eafc3fd41f75 358 return( ret );
bryantaylor 0:eafc3fd41f75 359 }
bryantaylor 0:eafc3fd41f75 360
bryantaylor 0:eafc3fd41f75 361 /*
bryantaylor 0:eafc3fd41f75 362 * Do an RSA private key operation
bryantaylor 0:eafc3fd41f75 363 */
bryantaylor 0:eafc3fd41f75 364 int mbedtls_rsa_private( mbedtls_rsa_context *ctx,
bryantaylor 0:eafc3fd41f75 365 int (*f_rng)(void *, unsigned char *, size_t),
bryantaylor 0:eafc3fd41f75 366 void *p_rng,
bryantaylor 0:eafc3fd41f75 367 const unsigned char *input,
bryantaylor 0:eafc3fd41f75 368 unsigned char *output )
bryantaylor 0:eafc3fd41f75 369 {
bryantaylor 0:eafc3fd41f75 370 int ret;
bryantaylor 0:eafc3fd41f75 371 size_t olen;
bryantaylor 0:eafc3fd41f75 372 mbedtls_mpi T, T1, T2;
bryantaylor 0:eafc3fd41f75 373
bryantaylor 0:eafc3fd41f75 374 /* Make sure we have private key info, prevent possible misuse */
bryantaylor 0:eafc3fd41f75 375 if( ctx->P.p == NULL || ctx->Q.p == NULL || ctx->D.p == NULL )
bryantaylor 0:eafc3fd41f75 376 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
bryantaylor 0:eafc3fd41f75 377
bryantaylor 0:eafc3fd41f75 378 mbedtls_mpi_init( &T ); mbedtls_mpi_init( &T1 ); mbedtls_mpi_init( &T2 );
bryantaylor 0:eafc3fd41f75 379
bryantaylor 0:eafc3fd41f75 380 #if defined(MBEDTLS_THREADING_C)
bryantaylor 0:eafc3fd41f75 381 if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
bryantaylor 0:eafc3fd41f75 382 return( ret );
bryantaylor 0:eafc3fd41f75 383 #endif
bryantaylor 0:eafc3fd41f75 384
bryantaylor 0:eafc3fd41f75 385 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &T, input, ctx->len ) );
bryantaylor 0:eafc3fd41f75 386 if( mbedtls_mpi_cmp_mpi( &T, &ctx->N ) >= 0 )
bryantaylor 0:eafc3fd41f75 387 {
bryantaylor 0:eafc3fd41f75 388 ret = MBEDTLS_ERR_MPI_BAD_INPUT_DATA;
bryantaylor 0:eafc3fd41f75 389 goto cleanup;
bryantaylor 0:eafc3fd41f75 390 }
bryantaylor 0:eafc3fd41f75 391
bryantaylor 0:eafc3fd41f75 392 if( f_rng != NULL )
bryantaylor 0:eafc3fd41f75 393 {
bryantaylor 0:eafc3fd41f75 394 /*
bryantaylor 0:eafc3fd41f75 395 * Blinding
bryantaylor 0:eafc3fd41f75 396 * T = T * Vi mod N
bryantaylor 0:eafc3fd41f75 397 */
bryantaylor 0:eafc3fd41f75 398 MBEDTLS_MPI_CHK( rsa_prepare_blinding( ctx, f_rng, p_rng ) );
bryantaylor 0:eafc3fd41f75 399 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T, &T, &ctx->Vi ) );
bryantaylor 0:eafc3fd41f75 400 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &T, &T, &ctx->N ) );
bryantaylor 0:eafc3fd41f75 401 }
bryantaylor 0:eafc3fd41f75 402
bryantaylor 0:eafc3fd41f75 403 #if defined(MBEDTLS_RSA_NO_CRT)
bryantaylor 0:eafc3fd41f75 404 MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &T, &T, &ctx->D, &ctx->N, &ctx->RN ) );
bryantaylor 0:eafc3fd41f75 405 #else
bryantaylor 0:eafc3fd41f75 406 /*
bryantaylor 0:eafc3fd41f75 407 * faster decryption using the CRT
bryantaylor 0:eafc3fd41f75 408 *
bryantaylor 0:eafc3fd41f75 409 * T1 = input ^ dP mod P
bryantaylor 0:eafc3fd41f75 410 * T2 = input ^ dQ mod Q
bryantaylor 0:eafc3fd41f75 411 */
bryantaylor 0:eafc3fd41f75 412 MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &T1, &T, &ctx->DP, &ctx->P, &ctx->RP ) );
bryantaylor 0:eafc3fd41f75 413 MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &T2, &T, &ctx->DQ, &ctx->Q, &ctx->RQ ) );
bryantaylor 0:eafc3fd41f75 414
bryantaylor 0:eafc3fd41f75 415 /*
bryantaylor 0:eafc3fd41f75 416 * T = (T1 - T2) * (Q^-1 mod P) mod P
bryantaylor 0:eafc3fd41f75 417 */
bryantaylor 0:eafc3fd41f75 418 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &T, &T1, &T2 ) );
bryantaylor 0:eafc3fd41f75 419 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T1, &T, &ctx->QP ) );
bryantaylor 0:eafc3fd41f75 420 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &T, &T1, &ctx->P ) );
bryantaylor 0:eafc3fd41f75 421
bryantaylor 0:eafc3fd41f75 422 /*
bryantaylor 0:eafc3fd41f75 423 * T = T2 + T * Q
bryantaylor 0:eafc3fd41f75 424 */
bryantaylor 0:eafc3fd41f75 425 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T1, &T, &ctx->Q ) );
bryantaylor 0:eafc3fd41f75 426 MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &T, &T2, &T1 ) );
bryantaylor 0:eafc3fd41f75 427 #endif /* MBEDTLS_RSA_NO_CRT */
bryantaylor 0:eafc3fd41f75 428
bryantaylor 0:eafc3fd41f75 429 if( f_rng != NULL )
bryantaylor 0:eafc3fd41f75 430 {
bryantaylor 0:eafc3fd41f75 431 /*
bryantaylor 0:eafc3fd41f75 432 * Unblind
bryantaylor 0:eafc3fd41f75 433 * T = T * Vf mod N
bryantaylor 0:eafc3fd41f75 434 */
bryantaylor 0:eafc3fd41f75 435 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T, &T, &ctx->Vf ) );
bryantaylor 0:eafc3fd41f75 436 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &T, &T, &ctx->N ) );
bryantaylor 0:eafc3fd41f75 437 }
bryantaylor 0:eafc3fd41f75 438
bryantaylor 0:eafc3fd41f75 439 olen = ctx->len;
bryantaylor 0:eafc3fd41f75 440 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &T, output, olen ) );
bryantaylor 0:eafc3fd41f75 441
bryantaylor 0:eafc3fd41f75 442 cleanup:
bryantaylor 0:eafc3fd41f75 443 #if defined(MBEDTLS_THREADING_C)
bryantaylor 0:eafc3fd41f75 444 if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
bryantaylor 0:eafc3fd41f75 445 return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
bryantaylor 0:eafc3fd41f75 446 #endif
bryantaylor 0:eafc3fd41f75 447
bryantaylor 0:eafc3fd41f75 448 mbedtls_mpi_free( &T ); mbedtls_mpi_free( &T1 ); mbedtls_mpi_free( &T2 );
bryantaylor 0:eafc3fd41f75 449
bryantaylor 0:eafc3fd41f75 450 if( ret != 0 )
bryantaylor 0:eafc3fd41f75 451 return( MBEDTLS_ERR_RSA_PRIVATE_FAILED + ret );
bryantaylor 0:eafc3fd41f75 452
bryantaylor 0:eafc3fd41f75 453 return( 0 );
bryantaylor 0:eafc3fd41f75 454 }
bryantaylor 0:eafc3fd41f75 455
bryantaylor 0:eafc3fd41f75 456 #if defined(MBEDTLS_PKCS1_V21)
bryantaylor 0:eafc3fd41f75 457 /**
bryantaylor 0:eafc3fd41f75 458 * Generate and apply the MGF1 operation (from PKCS#1 v2.1) to a buffer.
bryantaylor 0:eafc3fd41f75 459 *
bryantaylor 0:eafc3fd41f75 460 * \param dst buffer to mask
bryantaylor 0:eafc3fd41f75 461 * \param dlen length of destination buffer
bryantaylor 0:eafc3fd41f75 462 * \param src source of the mask generation
bryantaylor 0:eafc3fd41f75 463 * \param slen length of the source buffer
bryantaylor 0:eafc3fd41f75 464 * \param md_ctx message digest context to use
bryantaylor 0:eafc3fd41f75 465 */
bryantaylor 0:eafc3fd41f75 466 static void mgf_mask( unsigned char *dst, size_t dlen, unsigned char *src,
bryantaylor 0:eafc3fd41f75 467 size_t slen, mbedtls_md_context_t *md_ctx )
bryantaylor 0:eafc3fd41f75 468 {
bryantaylor 0:eafc3fd41f75 469 unsigned char mask[MBEDTLS_MD_MAX_SIZE];
bryantaylor 0:eafc3fd41f75 470 unsigned char counter[4];
bryantaylor 0:eafc3fd41f75 471 unsigned char *p;
bryantaylor 0:eafc3fd41f75 472 unsigned int hlen;
bryantaylor 0:eafc3fd41f75 473 size_t i, use_len;
bryantaylor 0:eafc3fd41f75 474
bryantaylor 0:eafc3fd41f75 475 memset( mask, 0, MBEDTLS_MD_MAX_SIZE );
bryantaylor 0:eafc3fd41f75 476 memset( counter, 0, 4 );
bryantaylor 0:eafc3fd41f75 477
bryantaylor 0:eafc3fd41f75 478 hlen = mbedtls_md_get_size( md_ctx->md_info );
bryantaylor 0:eafc3fd41f75 479
bryantaylor 0:eafc3fd41f75 480 /* Generate and apply dbMask */
bryantaylor 0:eafc3fd41f75 481 p = dst;
bryantaylor 0:eafc3fd41f75 482
bryantaylor 0:eafc3fd41f75 483 while( dlen > 0 )
bryantaylor 0:eafc3fd41f75 484 {
bryantaylor 0:eafc3fd41f75 485 use_len = hlen;
bryantaylor 0:eafc3fd41f75 486 if( dlen < hlen )
bryantaylor 0:eafc3fd41f75 487 use_len = dlen;
bryantaylor 0:eafc3fd41f75 488
bryantaylor 0:eafc3fd41f75 489 mbedtls_md_starts( md_ctx );
bryantaylor 0:eafc3fd41f75 490 mbedtls_md_update( md_ctx, src, slen );
bryantaylor 0:eafc3fd41f75 491 mbedtls_md_update( md_ctx, counter, 4 );
bryantaylor 0:eafc3fd41f75 492 mbedtls_md_finish( md_ctx, mask );
bryantaylor 0:eafc3fd41f75 493
bryantaylor 0:eafc3fd41f75 494 for( i = 0; i < use_len; ++i )
bryantaylor 0:eafc3fd41f75 495 *p++ ^= mask[i];
bryantaylor 0:eafc3fd41f75 496
bryantaylor 0:eafc3fd41f75 497 counter[3]++;
bryantaylor 0:eafc3fd41f75 498
bryantaylor 0:eafc3fd41f75 499 dlen -= use_len;
bryantaylor 0:eafc3fd41f75 500 }
bryantaylor 0:eafc3fd41f75 501 }
bryantaylor 0:eafc3fd41f75 502 #endif /* MBEDTLS_PKCS1_V21 */
bryantaylor 0:eafc3fd41f75 503
bryantaylor 0:eafc3fd41f75 504 #if defined(MBEDTLS_PKCS1_V21)
bryantaylor 0:eafc3fd41f75 505 /*
bryantaylor 0:eafc3fd41f75 506 * Implementation of the PKCS#1 v2.1 RSAES-OAEP-ENCRYPT function
bryantaylor 0:eafc3fd41f75 507 */
bryantaylor 0:eafc3fd41f75 508 int mbedtls_rsa_rsaes_oaep_encrypt( mbedtls_rsa_context *ctx,
bryantaylor 0:eafc3fd41f75 509 int (*f_rng)(void *, unsigned char *, size_t),
bryantaylor 0:eafc3fd41f75 510 void *p_rng,
bryantaylor 0:eafc3fd41f75 511 int mode,
bryantaylor 0:eafc3fd41f75 512 const unsigned char *label, size_t label_len,
bryantaylor 0:eafc3fd41f75 513 size_t ilen,
bryantaylor 0:eafc3fd41f75 514 const unsigned char *input,
bryantaylor 0:eafc3fd41f75 515 unsigned char *output )
bryantaylor 0:eafc3fd41f75 516 {
bryantaylor 0:eafc3fd41f75 517 size_t olen;
bryantaylor 0:eafc3fd41f75 518 int ret;
bryantaylor 0:eafc3fd41f75 519 unsigned char *p = output;
bryantaylor 0:eafc3fd41f75 520 unsigned int hlen;
bryantaylor 0:eafc3fd41f75 521 const mbedtls_md_info_t *md_info;
bryantaylor 0:eafc3fd41f75 522 mbedtls_md_context_t md_ctx;
bryantaylor 0:eafc3fd41f75 523
bryantaylor 0:eafc3fd41f75 524 if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V21 )
bryantaylor 0:eafc3fd41f75 525 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
bryantaylor 0:eafc3fd41f75 526
bryantaylor 0:eafc3fd41f75 527 if( f_rng == NULL )
bryantaylor 0:eafc3fd41f75 528 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
bryantaylor 0:eafc3fd41f75 529
bryantaylor 0:eafc3fd41f75 530 md_info = mbedtls_md_info_from_type( (mbedtls_md_type_t) ctx->hash_id );
bryantaylor 0:eafc3fd41f75 531 if( md_info == NULL )
bryantaylor 0:eafc3fd41f75 532 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
bryantaylor 0:eafc3fd41f75 533
bryantaylor 0:eafc3fd41f75 534 olen = ctx->len;
bryantaylor 0:eafc3fd41f75 535 hlen = mbedtls_md_get_size( md_info );
bryantaylor 0:eafc3fd41f75 536
bryantaylor 0:eafc3fd41f75 537 /* first comparison checks for overflow */
bryantaylor 0:eafc3fd41f75 538 if( ilen + 2 * hlen + 2 < ilen || olen < ilen + 2 * hlen + 2 )
bryantaylor 0:eafc3fd41f75 539 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
bryantaylor 0:eafc3fd41f75 540
bryantaylor 0:eafc3fd41f75 541 memset( output, 0, olen );
bryantaylor 0:eafc3fd41f75 542
bryantaylor 0:eafc3fd41f75 543 *p++ = 0;
bryantaylor 0:eafc3fd41f75 544
bryantaylor 0:eafc3fd41f75 545 /* Generate a random octet string seed */
bryantaylor 0:eafc3fd41f75 546 if( ( ret = f_rng( p_rng, p, hlen ) ) != 0 )
bryantaylor 0:eafc3fd41f75 547 return( MBEDTLS_ERR_RSA_RNG_FAILED + ret );
bryantaylor 0:eafc3fd41f75 548
bryantaylor 0:eafc3fd41f75 549 p += hlen;
bryantaylor 0:eafc3fd41f75 550
bryantaylor 0:eafc3fd41f75 551 /* Construct DB */
bryantaylor 0:eafc3fd41f75 552 mbedtls_md( md_info, label, label_len, p );
bryantaylor 0:eafc3fd41f75 553 p += hlen;
bryantaylor 0:eafc3fd41f75 554 p += olen - 2 * hlen - 2 - ilen;
bryantaylor 0:eafc3fd41f75 555 *p++ = 1;
bryantaylor 0:eafc3fd41f75 556 memcpy( p, input, ilen );
bryantaylor 0:eafc3fd41f75 557
bryantaylor 0:eafc3fd41f75 558 mbedtls_md_init( &md_ctx );
bryantaylor 0:eafc3fd41f75 559 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 0 ) ) != 0 )
bryantaylor 0:eafc3fd41f75 560 {
bryantaylor 0:eafc3fd41f75 561 mbedtls_md_free( &md_ctx );
bryantaylor 0:eafc3fd41f75 562 return( ret );
bryantaylor 0:eafc3fd41f75 563 }
bryantaylor 0:eafc3fd41f75 564
bryantaylor 0:eafc3fd41f75 565 /* maskedDB: Apply dbMask to DB */
bryantaylor 0:eafc3fd41f75 566 mgf_mask( output + hlen + 1, olen - hlen - 1, output + 1, hlen,
bryantaylor 0:eafc3fd41f75 567 &md_ctx );
bryantaylor 0:eafc3fd41f75 568
bryantaylor 0:eafc3fd41f75 569 /* maskedSeed: Apply seedMask to seed */
bryantaylor 0:eafc3fd41f75 570 mgf_mask( output + 1, hlen, output + hlen + 1, olen - hlen - 1,
bryantaylor 0:eafc3fd41f75 571 &md_ctx );
bryantaylor 0:eafc3fd41f75 572
bryantaylor 0:eafc3fd41f75 573 mbedtls_md_free( &md_ctx );
bryantaylor 0:eafc3fd41f75 574
bryantaylor 0:eafc3fd41f75 575 return( ( mode == MBEDTLS_RSA_PUBLIC )
bryantaylor 0:eafc3fd41f75 576 ? mbedtls_rsa_public( ctx, output, output )
bryantaylor 0:eafc3fd41f75 577 : mbedtls_rsa_private( ctx, f_rng, p_rng, output, output ) );
bryantaylor 0:eafc3fd41f75 578 }
bryantaylor 0:eafc3fd41f75 579 #endif /* MBEDTLS_PKCS1_V21 */
bryantaylor 0:eafc3fd41f75 580
bryantaylor 0:eafc3fd41f75 581 #if defined(MBEDTLS_PKCS1_V15)
bryantaylor 0:eafc3fd41f75 582 /*
bryantaylor 0:eafc3fd41f75 583 * Implementation of the PKCS#1 v2.1 RSAES-PKCS1-V1_5-ENCRYPT function
bryantaylor 0:eafc3fd41f75 584 */
bryantaylor 0:eafc3fd41f75 585 int mbedtls_rsa_rsaes_pkcs1_v15_encrypt( mbedtls_rsa_context *ctx,
bryantaylor 0:eafc3fd41f75 586 int (*f_rng)(void *, unsigned char *, size_t),
bryantaylor 0:eafc3fd41f75 587 void *p_rng,
bryantaylor 0:eafc3fd41f75 588 int mode, size_t ilen,
bryantaylor 0:eafc3fd41f75 589 const unsigned char *input,
bryantaylor 0:eafc3fd41f75 590 unsigned char *output )
bryantaylor 0:eafc3fd41f75 591 {
bryantaylor 0:eafc3fd41f75 592 size_t nb_pad, olen;
bryantaylor 0:eafc3fd41f75 593 int ret;
bryantaylor 0:eafc3fd41f75 594 unsigned char *p = output;
bryantaylor 0:eafc3fd41f75 595
bryantaylor 0:eafc3fd41f75 596 if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V15 )
bryantaylor 0:eafc3fd41f75 597 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
bryantaylor 0:eafc3fd41f75 598
bryantaylor 0:eafc3fd41f75 599 // We don't check p_rng because it won't be dereferenced here
bryantaylor 0:eafc3fd41f75 600 if( f_rng == NULL || input == NULL || output == NULL )
bryantaylor 0:eafc3fd41f75 601 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
bryantaylor 0:eafc3fd41f75 602
bryantaylor 0:eafc3fd41f75 603 olen = ctx->len;
bryantaylor 0:eafc3fd41f75 604
bryantaylor 0:eafc3fd41f75 605 /* first comparison checks for overflow */
bryantaylor 0:eafc3fd41f75 606 if( ilen + 11 < ilen || olen < ilen + 11 )
bryantaylor 0:eafc3fd41f75 607 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
bryantaylor 0:eafc3fd41f75 608
bryantaylor 0:eafc3fd41f75 609 nb_pad = olen - 3 - ilen;
bryantaylor 0:eafc3fd41f75 610
bryantaylor 0:eafc3fd41f75 611 *p++ = 0;
bryantaylor 0:eafc3fd41f75 612 if( mode == MBEDTLS_RSA_PUBLIC )
bryantaylor 0:eafc3fd41f75 613 {
bryantaylor 0:eafc3fd41f75 614 *p++ = MBEDTLS_RSA_CRYPT;
bryantaylor 0:eafc3fd41f75 615
bryantaylor 0:eafc3fd41f75 616 while( nb_pad-- > 0 )
bryantaylor 0:eafc3fd41f75 617 {
bryantaylor 0:eafc3fd41f75 618 int rng_dl = 100;
bryantaylor 0:eafc3fd41f75 619
bryantaylor 0:eafc3fd41f75 620 do {
bryantaylor 0:eafc3fd41f75 621 ret = f_rng( p_rng, p, 1 );
bryantaylor 0:eafc3fd41f75 622 } while( *p == 0 && --rng_dl && ret == 0 );
bryantaylor 0:eafc3fd41f75 623
bryantaylor 0:eafc3fd41f75 624 /* Check if RNG failed to generate data */
bryantaylor 0:eafc3fd41f75 625 if( rng_dl == 0 || ret != 0 )
bryantaylor 0:eafc3fd41f75 626 return( MBEDTLS_ERR_RSA_RNG_FAILED + ret );
bryantaylor 0:eafc3fd41f75 627
bryantaylor 0:eafc3fd41f75 628 p++;
bryantaylor 0:eafc3fd41f75 629 }
bryantaylor 0:eafc3fd41f75 630 }
bryantaylor 0:eafc3fd41f75 631 else
bryantaylor 0:eafc3fd41f75 632 {
bryantaylor 0:eafc3fd41f75 633 *p++ = MBEDTLS_RSA_SIGN;
bryantaylor 0:eafc3fd41f75 634
bryantaylor 0:eafc3fd41f75 635 while( nb_pad-- > 0 )
bryantaylor 0:eafc3fd41f75 636 *p++ = 0xFF;
bryantaylor 0:eafc3fd41f75 637 }
bryantaylor 0:eafc3fd41f75 638
bryantaylor 0:eafc3fd41f75 639 *p++ = 0;
bryantaylor 0:eafc3fd41f75 640 memcpy( p, input, ilen );
bryantaylor 0:eafc3fd41f75 641
bryantaylor 0:eafc3fd41f75 642 return( ( mode == MBEDTLS_RSA_PUBLIC )
bryantaylor 0:eafc3fd41f75 643 ? mbedtls_rsa_public( ctx, output, output )
bryantaylor 0:eafc3fd41f75 644 : mbedtls_rsa_private( ctx, f_rng, p_rng, output, output ) );
bryantaylor 0:eafc3fd41f75 645 }
bryantaylor 0:eafc3fd41f75 646 #endif /* MBEDTLS_PKCS1_V15 */
bryantaylor 0:eafc3fd41f75 647
bryantaylor 0:eafc3fd41f75 648 /*
bryantaylor 0:eafc3fd41f75 649 * Add the message padding, then do an RSA operation
bryantaylor 0:eafc3fd41f75 650 */
bryantaylor 0:eafc3fd41f75 651 int mbedtls_rsa_pkcs1_encrypt( mbedtls_rsa_context *ctx,
bryantaylor 0:eafc3fd41f75 652 int (*f_rng)(void *, unsigned char *, size_t),
bryantaylor 0:eafc3fd41f75 653 void *p_rng,
bryantaylor 0:eafc3fd41f75 654 int mode, size_t ilen,
bryantaylor 0:eafc3fd41f75 655 const unsigned char *input,
bryantaylor 0:eafc3fd41f75 656 unsigned char *output )
bryantaylor 0:eafc3fd41f75 657 {
bryantaylor 0:eafc3fd41f75 658 switch( ctx->padding )
bryantaylor 0:eafc3fd41f75 659 {
bryantaylor 0:eafc3fd41f75 660 #if defined(MBEDTLS_PKCS1_V15)
bryantaylor 0:eafc3fd41f75 661 case MBEDTLS_RSA_PKCS_V15:
bryantaylor 0:eafc3fd41f75 662 return mbedtls_rsa_rsaes_pkcs1_v15_encrypt( ctx, f_rng, p_rng, mode, ilen,
bryantaylor 0:eafc3fd41f75 663 input, output );
bryantaylor 0:eafc3fd41f75 664 #endif
bryantaylor 0:eafc3fd41f75 665
bryantaylor 0:eafc3fd41f75 666 #if defined(MBEDTLS_PKCS1_V21)
bryantaylor 0:eafc3fd41f75 667 case MBEDTLS_RSA_PKCS_V21:
bryantaylor 0:eafc3fd41f75 668 return mbedtls_rsa_rsaes_oaep_encrypt( ctx, f_rng, p_rng, mode, NULL, 0,
bryantaylor 0:eafc3fd41f75 669 ilen, input, output );
bryantaylor 0:eafc3fd41f75 670 #endif
bryantaylor 0:eafc3fd41f75 671
bryantaylor 0:eafc3fd41f75 672 default:
bryantaylor 0:eafc3fd41f75 673 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
bryantaylor 0:eafc3fd41f75 674 }
bryantaylor 0:eafc3fd41f75 675 }
bryantaylor 0:eafc3fd41f75 676
bryantaylor 0:eafc3fd41f75 677 #if defined(MBEDTLS_PKCS1_V21)
bryantaylor 0:eafc3fd41f75 678 /*
bryantaylor 0:eafc3fd41f75 679 * Implementation of the PKCS#1 v2.1 RSAES-OAEP-DECRYPT function
bryantaylor 0:eafc3fd41f75 680 */
bryantaylor 0:eafc3fd41f75 681 int mbedtls_rsa_rsaes_oaep_decrypt( mbedtls_rsa_context *ctx,
bryantaylor 0:eafc3fd41f75 682 int (*f_rng)(void *, unsigned char *, size_t),
bryantaylor 0:eafc3fd41f75 683 void *p_rng,
bryantaylor 0:eafc3fd41f75 684 int mode,
bryantaylor 0:eafc3fd41f75 685 const unsigned char *label, size_t label_len,
bryantaylor 0:eafc3fd41f75 686 size_t *olen,
bryantaylor 0:eafc3fd41f75 687 const unsigned char *input,
bryantaylor 0:eafc3fd41f75 688 unsigned char *output,
bryantaylor 0:eafc3fd41f75 689 size_t output_max_len )
bryantaylor 0:eafc3fd41f75 690 {
bryantaylor 0:eafc3fd41f75 691 int ret;
bryantaylor 0:eafc3fd41f75 692 size_t ilen, i, pad_len;
bryantaylor 0:eafc3fd41f75 693 unsigned char *p, bad, pad_done;
bryantaylor 0:eafc3fd41f75 694 unsigned char buf[MBEDTLS_MPI_MAX_SIZE];
bryantaylor 0:eafc3fd41f75 695 unsigned char lhash[MBEDTLS_MD_MAX_SIZE];
bryantaylor 0:eafc3fd41f75 696 unsigned int hlen;
bryantaylor 0:eafc3fd41f75 697 const mbedtls_md_info_t *md_info;
bryantaylor 0:eafc3fd41f75 698 mbedtls_md_context_t md_ctx;
bryantaylor 0:eafc3fd41f75 699
bryantaylor 0:eafc3fd41f75 700 /*
bryantaylor 0:eafc3fd41f75 701 * Parameters sanity checks
bryantaylor 0:eafc3fd41f75 702 */
bryantaylor 0:eafc3fd41f75 703 if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V21 )
bryantaylor 0:eafc3fd41f75 704 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
bryantaylor 0:eafc3fd41f75 705
bryantaylor 0:eafc3fd41f75 706 ilen = ctx->len;
bryantaylor 0:eafc3fd41f75 707
bryantaylor 0:eafc3fd41f75 708 if( ilen < 16 || ilen > sizeof( buf ) )
bryantaylor 0:eafc3fd41f75 709 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
bryantaylor 0:eafc3fd41f75 710
bryantaylor 0:eafc3fd41f75 711 md_info = mbedtls_md_info_from_type( (mbedtls_md_type_t) ctx->hash_id );
bryantaylor 0:eafc3fd41f75 712 if( md_info == NULL )
bryantaylor 0:eafc3fd41f75 713 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
bryantaylor 0:eafc3fd41f75 714
bryantaylor 0:eafc3fd41f75 715 hlen = mbedtls_md_get_size( md_info );
bryantaylor 0:eafc3fd41f75 716
bryantaylor 0:eafc3fd41f75 717 // checking for integer underflow
bryantaylor 0:eafc3fd41f75 718 if( 2 * hlen + 2 > ilen )
bryantaylor 0:eafc3fd41f75 719 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
bryantaylor 0:eafc3fd41f75 720
bryantaylor 0:eafc3fd41f75 721 /*
bryantaylor 0:eafc3fd41f75 722 * RSA operation
bryantaylor 0:eafc3fd41f75 723 */
bryantaylor 0:eafc3fd41f75 724 ret = ( mode == MBEDTLS_RSA_PUBLIC )
bryantaylor 0:eafc3fd41f75 725 ? mbedtls_rsa_public( ctx, input, buf )
bryantaylor 0:eafc3fd41f75 726 : mbedtls_rsa_private( ctx, f_rng, p_rng, input, buf );
bryantaylor 0:eafc3fd41f75 727
bryantaylor 0:eafc3fd41f75 728 if( ret != 0 )
bryantaylor 0:eafc3fd41f75 729 return( ret );
bryantaylor 0:eafc3fd41f75 730
bryantaylor 0:eafc3fd41f75 731 /*
bryantaylor 0:eafc3fd41f75 732 * Unmask data and generate lHash
bryantaylor 0:eafc3fd41f75 733 */
bryantaylor 0:eafc3fd41f75 734 mbedtls_md_init( &md_ctx );
bryantaylor 0:eafc3fd41f75 735 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 0 ) ) != 0 )
bryantaylor 0:eafc3fd41f75 736 {
bryantaylor 0:eafc3fd41f75 737 mbedtls_md_free( &md_ctx );
bryantaylor 0:eafc3fd41f75 738 return( ret );
bryantaylor 0:eafc3fd41f75 739 }
bryantaylor 0:eafc3fd41f75 740
bryantaylor 0:eafc3fd41f75 741
bryantaylor 0:eafc3fd41f75 742 /* Generate lHash */
bryantaylor 0:eafc3fd41f75 743 mbedtls_md( md_info, label, label_len, lhash );
bryantaylor 0:eafc3fd41f75 744
bryantaylor 0:eafc3fd41f75 745 /* seed: Apply seedMask to maskedSeed */
bryantaylor 0:eafc3fd41f75 746 mgf_mask( buf + 1, hlen, buf + hlen + 1, ilen - hlen - 1,
bryantaylor 0:eafc3fd41f75 747 &md_ctx );
bryantaylor 0:eafc3fd41f75 748
bryantaylor 0:eafc3fd41f75 749 /* DB: Apply dbMask to maskedDB */
bryantaylor 0:eafc3fd41f75 750 mgf_mask( buf + hlen + 1, ilen - hlen - 1, buf + 1, hlen,
bryantaylor 0:eafc3fd41f75 751 &md_ctx );
bryantaylor 0:eafc3fd41f75 752
bryantaylor 0:eafc3fd41f75 753 mbedtls_md_free( &md_ctx );
bryantaylor 0:eafc3fd41f75 754
bryantaylor 0:eafc3fd41f75 755 /*
bryantaylor 0:eafc3fd41f75 756 * Check contents, in "constant-time"
bryantaylor 0:eafc3fd41f75 757 */
bryantaylor 0:eafc3fd41f75 758 p = buf;
bryantaylor 0:eafc3fd41f75 759 bad = 0;
bryantaylor 0:eafc3fd41f75 760
bryantaylor 0:eafc3fd41f75 761 bad |= *p++; /* First byte must be 0 */
bryantaylor 0:eafc3fd41f75 762
bryantaylor 0:eafc3fd41f75 763 p += hlen; /* Skip seed */
bryantaylor 0:eafc3fd41f75 764
bryantaylor 0:eafc3fd41f75 765 /* Check lHash */
bryantaylor 0:eafc3fd41f75 766 for( i = 0; i < hlen; i++ )
bryantaylor 0:eafc3fd41f75 767 bad |= lhash[i] ^ *p++;
bryantaylor 0:eafc3fd41f75 768
bryantaylor 0:eafc3fd41f75 769 /* Get zero-padding len, but always read till end of buffer
bryantaylor 0:eafc3fd41f75 770 * (minus one, for the 01 byte) */
bryantaylor 0:eafc3fd41f75 771 pad_len = 0;
bryantaylor 0:eafc3fd41f75 772 pad_done = 0;
bryantaylor 0:eafc3fd41f75 773 for( i = 0; i < ilen - 2 * hlen - 2; i++ )
bryantaylor 0:eafc3fd41f75 774 {
bryantaylor 0:eafc3fd41f75 775 pad_done |= p[i];
bryantaylor 0:eafc3fd41f75 776 pad_len += ((pad_done | (unsigned char)-pad_done) >> 7) ^ 1;
bryantaylor 0:eafc3fd41f75 777 }
bryantaylor 0:eafc3fd41f75 778
bryantaylor 0:eafc3fd41f75 779 p += pad_len;
bryantaylor 0:eafc3fd41f75 780 bad |= *p++ ^ 0x01;
bryantaylor 0:eafc3fd41f75 781
bryantaylor 0:eafc3fd41f75 782 /*
bryantaylor 0:eafc3fd41f75 783 * The only information "leaked" is whether the padding was correct or not
bryantaylor 0:eafc3fd41f75 784 * (eg, no data is copied if it was not correct). This meets the
bryantaylor 0:eafc3fd41f75 785 * recommendations in PKCS#1 v2.2: an opponent cannot distinguish between
bryantaylor 0:eafc3fd41f75 786 * the different error conditions.
bryantaylor 0:eafc3fd41f75 787 */
bryantaylor 0:eafc3fd41f75 788 if( bad != 0 )
bryantaylor 0:eafc3fd41f75 789 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
bryantaylor 0:eafc3fd41f75 790
bryantaylor 0:eafc3fd41f75 791 if( ilen - ( p - buf ) > output_max_len )
bryantaylor 0:eafc3fd41f75 792 return( MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE );
bryantaylor 0:eafc3fd41f75 793
bryantaylor 0:eafc3fd41f75 794 *olen = ilen - (p - buf);
bryantaylor 0:eafc3fd41f75 795 memcpy( output, p, *olen );
bryantaylor 0:eafc3fd41f75 796
bryantaylor 0:eafc3fd41f75 797 return( 0 );
bryantaylor 0:eafc3fd41f75 798 }
bryantaylor 0:eafc3fd41f75 799 #endif /* MBEDTLS_PKCS1_V21 */
bryantaylor 0:eafc3fd41f75 800
bryantaylor 0:eafc3fd41f75 801 #if defined(MBEDTLS_PKCS1_V15)
bryantaylor 0:eafc3fd41f75 802 /*
bryantaylor 0:eafc3fd41f75 803 * Implementation of the PKCS#1 v2.1 RSAES-PKCS1-V1_5-DECRYPT function
bryantaylor 0:eafc3fd41f75 804 */
bryantaylor 0:eafc3fd41f75 805 int mbedtls_rsa_rsaes_pkcs1_v15_decrypt( mbedtls_rsa_context *ctx,
bryantaylor 0:eafc3fd41f75 806 int (*f_rng)(void *, unsigned char *, size_t),
bryantaylor 0:eafc3fd41f75 807 void *p_rng,
bryantaylor 0:eafc3fd41f75 808 int mode, size_t *olen,
bryantaylor 0:eafc3fd41f75 809 const unsigned char *input,
bryantaylor 0:eafc3fd41f75 810 unsigned char *output,
bryantaylor 0:eafc3fd41f75 811 size_t output_max_len)
bryantaylor 0:eafc3fd41f75 812 {
bryantaylor 0:eafc3fd41f75 813 int ret;
bryantaylor 0:eafc3fd41f75 814 size_t ilen, pad_count = 0, i;
bryantaylor 0:eafc3fd41f75 815 unsigned char *p, bad, pad_done = 0;
bryantaylor 0:eafc3fd41f75 816 unsigned char buf[MBEDTLS_MPI_MAX_SIZE];
bryantaylor 0:eafc3fd41f75 817
bryantaylor 0:eafc3fd41f75 818 if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V15 )
bryantaylor 0:eafc3fd41f75 819 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
bryantaylor 0:eafc3fd41f75 820
bryantaylor 0:eafc3fd41f75 821 ilen = ctx->len;
bryantaylor 0:eafc3fd41f75 822
bryantaylor 0:eafc3fd41f75 823 if( ilen < 16 || ilen > sizeof( buf ) )
bryantaylor 0:eafc3fd41f75 824 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
bryantaylor 0:eafc3fd41f75 825
bryantaylor 0:eafc3fd41f75 826 ret = ( mode == MBEDTLS_RSA_PUBLIC )
bryantaylor 0:eafc3fd41f75 827 ? mbedtls_rsa_public( ctx, input, buf )
bryantaylor 0:eafc3fd41f75 828 : mbedtls_rsa_private( ctx, f_rng, p_rng, input, buf );
bryantaylor 0:eafc3fd41f75 829
bryantaylor 0:eafc3fd41f75 830 if( ret != 0 )
bryantaylor 0:eafc3fd41f75 831 return( ret );
bryantaylor 0:eafc3fd41f75 832
bryantaylor 0:eafc3fd41f75 833 p = buf;
bryantaylor 0:eafc3fd41f75 834 bad = 0;
bryantaylor 0:eafc3fd41f75 835
bryantaylor 0:eafc3fd41f75 836 /*
bryantaylor 0:eafc3fd41f75 837 * Check and get padding len in "constant-time"
bryantaylor 0:eafc3fd41f75 838 */
bryantaylor 0:eafc3fd41f75 839 bad |= *p++; /* First byte must be 0 */
bryantaylor 0:eafc3fd41f75 840
bryantaylor 0:eafc3fd41f75 841 /* This test does not depend on secret data */
bryantaylor 0:eafc3fd41f75 842 if( mode == MBEDTLS_RSA_PRIVATE )
bryantaylor 0:eafc3fd41f75 843 {
bryantaylor 0:eafc3fd41f75 844 bad |= *p++ ^ MBEDTLS_RSA_CRYPT;
bryantaylor 0:eafc3fd41f75 845
bryantaylor 0:eafc3fd41f75 846 /* Get padding len, but always read till end of buffer
bryantaylor 0:eafc3fd41f75 847 * (minus one, for the 00 byte) */
bryantaylor 0:eafc3fd41f75 848 for( i = 0; i < ilen - 3; i++ )
bryantaylor 0:eafc3fd41f75 849 {
bryantaylor 0:eafc3fd41f75 850 pad_done |= ((p[i] | (unsigned char)-p[i]) >> 7) ^ 1;
bryantaylor 0:eafc3fd41f75 851 pad_count += ((pad_done | (unsigned char)-pad_done) >> 7) ^ 1;
bryantaylor 0:eafc3fd41f75 852 }
bryantaylor 0:eafc3fd41f75 853
bryantaylor 0:eafc3fd41f75 854 p += pad_count;
bryantaylor 0:eafc3fd41f75 855 bad |= *p++; /* Must be zero */
bryantaylor 0:eafc3fd41f75 856 }
bryantaylor 0:eafc3fd41f75 857 else
bryantaylor 0:eafc3fd41f75 858 {
bryantaylor 0:eafc3fd41f75 859 bad |= *p++ ^ MBEDTLS_RSA_SIGN;
bryantaylor 0:eafc3fd41f75 860
bryantaylor 0:eafc3fd41f75 861 /* Get padding len, but always read till end of buffer
bryantaylor 0:eafc3fd41f75 862 * (minus one, for the 00 byte) */
bryantaylor 0:eafc3fd41f75 863 for( i = 0; i < ilen - 3; i++ )
bryantaylor 0:eafc3fd41f75 864 {
bryantaylor 0:eafc3fd41f75 865 pad_done |= ( p[i] != 0xFF );
bryantaylor 0:eafc3fd41f75 866 pad_count += ( pad_done == 0 );
bryantaylor 0:eafc3fd41f75 867 }
bryantaylor 0:eafc3fd41f75 868
bryantaylor 0:eafc3fd41f75 869 p += pad_count;
bryantaylor 0:eafc3fd41f75 870 bad |= *p++; /* Must be zero */
bryantaylor 0:eafc3fd41f75 871 }
bryantaylor 0:eafc3fd41f75 872
bryantaylor 0:eafc3fd41f75 873 bad |= ( pad_count < 8 );
bryantaylor 0:eafc3fd41f75 874
bryantaylor 0:eafc3fd41f75 875 if( bad )
bryantaylor 0:eafc3fd41f75 876 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
bryantaylor 0:eafc3fd41f75 877
bryantaylor 0:eafc3fd41f75 878 if( ilen - ( p - buf ) > output_max_len )
bryantaylor 0:eafc3fd41f75 879 return( MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE );
bryantaylor 0:eafc3fd41f75 880
bryantaylor 0:eafc3fd41f75 881 *olen = ilen - (p - buf);
bryantaylor 0:eafc3fd41f75 882 memcpy( output, p, *olen );
bryantaylor 0:eafc3fd41f75 883
bryantaylor 0:eafc3fd41f75 884 return( 0 );
bryantaylor 0:eafc3fd41f75 885 }
bryantaylor 0:eafc3fd41f75 886 #endif /* MBEDTLS_PKCS1_V15 */
bryantaylor 0:eafc3fd41f75 887
bryantaylor 0:eafc3fd41f75 888 /*
bryantaylor 0:eafc3fd41f75 889 * Do an RSA operation, then remove the message padding
bryantaylor 0:eafc3fd41f75 890 */
bryantaylor 0:eafc3fd41f75 891 int mbedtls_rsa_pkcs1_decrypt( mbedtls_rsa_context *ctx,
bryantaylor 0:eafc3fd41f75 892 int (*f_rng)(void *, unsigned char *, size_t),
bryantaylor 0:eafc3fd41f75 893 void *p_rng,
bryantaylor 0:eafc3fd41f75 894 int mode, size_t *olen,
bryantaylor 0:eafc3fd41f75 895 const unsigned char *input,
bryantaylor 0:eafc3fd41f75 896 unsigned char *output,
bryantaylor 0:eafc3fd41f75 897 size_t output_max_len)
bryantaylor 0:eafc3fd41f75 898 {
bryantaylor 0:eafc3fd41f75 899 switch( ctx->padding )
bryantaylor 0:eafc3fd41f75 900 {
bryantaylor 0:eafc3fd41f75 901 #if defined(MBEDTLS_PKCS1_V15)
bryantaylor 0:eafc3fd41f75 902 case MBEDTLS_RSA_PKCS_V15:
bryantaylor 0:eafc3fd41f75 903 return mbedtls_rsa_rsaes_pkcs1_v15_decrypt( ctx, f_rng, p_rng, mode, olen,
bryantaylor 0:eafc3fd41f75 904 input, output, output_max_len );
bryantaylor 0:eafc3fd41f75 905 #endif
bryantaylor 0:eafc3fd41f75 906
bryantaylor 0:eafc3fd41f75 907 #if defined(MBEDTLS_PKCS1_V21)
bryantaylor 0:eafc3fd41f75 908 case MBEDTLS_RSA_PKCS_V21:
bryantaylor 0:eafc3fd41f75 909 return mbedtls_rsa_rsaes_oaep_decrypt( ctx, f_rng, p_rng, mode, NULL, 0,
bryantaylor 0:eafc3fd41f75 910 olen, input, output,
bryantaylor 0:eafc3fd41f75 911 output_max_len );
bryantaylor 0:eafc3fd41f75 912 #endif
bryantaylor 0:eafc3fd41f75 913
bryantaylor 0:eafc3fd41f75 914 default:
bryantaylor 0:eafc3fd41f75 915 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
bryantaylor 0:eafc3fd41f75 916 }
bryantaylor 0:eafc3fd41f75 917 }
bryantaylor 0:eafc3fd41f75 918
bryantaylor 0:eafc3fd41f75 919 #if defined(MBEDTLS_PKCS1_V21)
bryantaylor 0:eafc3fd41f75 920 /*
bryantaylor 0:eafc3fd41f75 921 * Implementation of the PKCS#1 v2.1 RSASSA-PSS-SIGN function
bryantaylor 0:eafc3fd41f75 922 */
bryantaylor 0:eafc3fd41f75 923 int mbedtls_rsa_rsassa_pss_sign( mbedtls_rsa_context *ctx,
bryantaylor 0:eafc3fd41f75 924 int (*f_rng)(void *, unsigned char *, size_t),
bryantaylor 0:eafc3fd41f75 925 void *p_rng,
bryantaylor 0:eafc3fd41f75 926 int mode,
bryantaylor 0:eafc3fd41f75 927 mbedtls_md_type_t md_alg,
bryantaylor 0:eafc3fd41f75 928 unsigned int hashlen,
bryantaylor 0:eafc3fd41f75 929 const unsigned char *hash,
bryantaylor 0:eafc3fd41f75 930 unsigned char *sig )
bryantaylor 0:eafc3fd41f75 931 {
bryantaylor 0:eafc3fd41f75 932 size_t olen;
bryantaylor 0:eafc3fd41f75 933 unsigned char *p = sig;
bryantaylor 0:eafc3fd41f75 934 unsigned char salt[MBEDTLS_MD_MAX_SIZE];
bryantaylor 0:eafc3fd41f75 935 unsigned int slen, hlen, offset = 0;
bryantaylor 0:eafc3fd41f75 936 int ret;
bryantaylor 0:eafc3fd41f75 937 size_t msb;
bryantaylor 0:eafc3fd41f75 938 const mbedtls_md_info_t *md_info;
bryantaylor 0:eafc3fd41f75 939 mbedtls_md_context_t md_ctx;
bryantaylor 0:eafc3fd41f75 940
bryantaylor 0:eafc3fd41f75 941 if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V21 )
bryantaylor 0:eafc3fd41f75 942 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
bryantaylor 0:eafc3fd41f75 943
bryantaylor 0:eafc3fd41f75 944 if( f_rng == NULL )
bryantaylor 0:eafc3fd41f75 945 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
bryantaylor 0:eafc3fd41f75 946
bryantaylor 0:eafc3fd41f75 947 olen = ctx->len;
bryantaylor 0:eafc3fd41f75 948
bryantaylor 0:eafc3fd41f75 949 if( md_alg != MBEDTLS_MD_NONE )
bryantaylor 0:eafc3fd41f75 950 {
bryantaylor 0:eafc3fd41f75 951 /* Gather length of hash to sign */
bryantaylor 0:eafc3fd41f75 952 md_info = mbedtls_md_info_from_type( md_alg );
bryantaylor 0:eafc3fd41f75 953 if( md_info == NULL )
bryantaylor 0:eafc3fd41f75 954 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
bryantaylor 0:eafc3fd41f75 955
bryantaylor 0:eafc3fd41f75 956 hashlen = mbedtls_md_get_size( md_info );
bryantaylor 0:eafc3fd41f75 957 }
bryantaylor 0:eafc3fd41f75 958
bryantaylor 0:eafc3fd41f75 959 md_info = mbedtls_md_info_from_type( (mbedtls_md_type_t) ctx->hash_id );
bryantaylor 0:eafc3fd41f75 960 if( md_info == NULL )
bryantaylor 0:eafc3fd41f75 961 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
bryantaylor 0:eafc3fd41f75 962
bryantaylor 0:eafc3fd41f75 963 hlen = mbedtls_md_get_size( md_info );
bryantaylor 0:eafc3fd41f75 964 slen = hlen;
bryantaylor 0:eafc3fd41f75 965
bryantaylor 0:eafc3fd41f75 966 if( olen < hlen + slen + 2 )
bryantaylor 0:eafc3fd41f75 967 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
bryantaylor 0:eafc3fd41f75 968
bryantaylor 0:eafc3fd41f75 969 memset( sig, 0, olen );
bryantaylor 0:eafc3fd41f75 970
bryantaylor 0:eafc3fd41f75 971 /* Generate salt of length slen */
bryantaylor 0:eafc3fd41f75 972 if( ( ret = f_rng( p_rng, salt, slen ) ) != 0 )
bryantaylor 0:eafc3fd41f75 973 return( MBEDTLS_ERR_RSA_RNG_FAILED + ret );
bryantaylor 0:eafc3fd41f75 974
bryantaylor 0:eafc3fd41f75 975 /* Note: EMSA-PSS encoding is over the length of N - 1 bits */
bryantaylor 0:eafc3fd41f75 976 msb = mbedtls_mpi_bitlen( &ctx->N ) - 1;
bryantaylor 0:eafc3fd41f75 977 p += olen - hlen * 2 - 2;
bryantaylor 0:eafc3fd41f75 978 *p++ = 0x01;
bryantaylor 0:eafc3fd41f75 979 memcpy( p, salt, slen );
bryantaylor 0:eafc3fd41f75 980 p += slen;
bryantaylor 0:eafc3fd41f75 981
bryantaylor 0:eafc3fd41f75 982 mbedtls_md_init( &md_ctx );
bryantaylor 0:eafc3fd41f75 983 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 0 ) ) != 0 )
bryantaylor 0:eafc3fd41f75 984 {
bryantaylor 0:eafc3fd41f75 985 mbedtls_md_free( &md_ctx );
bryantaylor 0:eafc3fd41f75 986 return( ret );
bryantaylor 0:eafc3fd41f75 987 }
bryantaylor 0:eafc3fd41f75 988
bryantaylor 0:eafc3fd41f75 989 /* Generate H = Hash( M' ) */
bryantaylor 0:eafc3fd41f75 990 mbedtls_md_starts( &md_ctx );
bryantaylor 0:eafc3fd41f75 991 mbedtls_md_update( &md_ctx, p, 8 );
bryantaylor 0:eafc3fd41f75 992 mbedtls_md_update( &md_ctx, hash, hashlen );
bryantaylor 0:eafc3fd41f75 993 mbedtls_md_update( &md_ctx, salt, slen );
bryantaylor 0:eafc3fd41f75 994 mbedtls_md_finish( &md_ctx, p );
bryantaylor 0:eafc3fd41f75 995
bryantaylor 0:eafc3fd41f75 996 /* Compensate for boundary condition when applying mask */
bryantaylor 0:eafc3fd41f75 997 if( msb % 8 == 0 )
bryantaylor 0:eafc3fd41f75 998 offset = 1;
bryantaylor 0:eafc3fd41f75 999
bryantaylor 0:eafc3fd41f75 1000 /* maskedDB: Apply dbMask to DB */
bryantaylor 0:eafc3fd41f75 1001 mgf_mask( sig + offset, olen - hlen - 1 - offset, p, hlen, &md_ctx );
bryantaylor 0:eafc3fd41f75 1002
bryantaylor 0:eafc3fd41f75 1003 mbedtls_md_free( &md_ctx );
bryantaylor 0:eafc3fd41f75 1004
bryantaylor 0:eafc3fd41f75 1005 msb = mbedtls_mpi_bitlen( &ctx->N ) - 1;
bryantaylor 0:eafc3fd41f75 1006 sig[0] &= 0xFF >> ( olen * 8 - msb );
bryantaylor 0:eafc3fd41f75 1007
bryantaylor 0:eafc3fd41f75 1008 p += hlen;
bryantaylor 0:eafc3fd41f75 1009 *p++ = 0xBC;
bryantaylor 0:eafc3fd41f75 1010
bryantaylor 0:eafc3fd41f75 1011 return( ( mode == MBEDTLS_RSA_PUBLIC )
bryantaylor 0:eafc3fd41f75 1012 ? mbedtls_rsa_public( ctx, sig, sig )
bryantaylor 0:eafc3fd41f75 1013 : mbedtls_rsa_private( ctx, f_rng, p_rng, sig, sig ) );
bryantaylor 0:eafc3fd41f75 1014 }
bryantaylor 0:eafc3fd41f75 1015 #endif /* MBEDTLS_PKCS1_V21 */
bryantaylor 0:eafc3fd41f75 1016
bryantaylor 0:eafc3fd41f75 1017 #if defined(MBEDTLS_PKCS1_V15)
bryantaylor 0:eafc3fd41f75 1018 /*
bryantaylor 0:eafc3fd41f75 1019 * Implementation of the PKCS#1 v2.1 RSASSA-PKCS1-V1_5-SIGN function
bryantaylor 0:eafc3fd41f75 1020 */
bryantaylor 0:eafc3fd41f75 1021 /*
bryantaylor 0:eafc3fd41f75 1022 * Do an RSA operation to sign the message digest
bryantaylor 0:eafc3fd41f75 1023 */
bryantaylor 0:eafc3fd41f75 1024 int mbedtls_rsa_rsassa_pkcs1_v15_sign( mbedtls_rsa_context *ctx,
bryantaylor 0:eafc3fd41f75 1025 int (*f_rng)(void *, unsigned char *, size_t),
bryantaylor 0:eafc3fd41f75 1026 void *p_rng,
bryantaylor 0:eafc3fd41f75 1027 int mode,
bryantaylor 0:eafc3fd41f75 1028 mbedtls_md_type_t md_alg,
bryantaylor 0:eafc3fd41f75 1029 unsigned int hashlen,
bryantaylor 0:eafc3fd41f75 1030 const unsigned char *hash,
bryantaylor 0:eafc3fd41f75 1031 unsigned char *sig )
bryantaylor 0:eafc3fd41f75 1032 {
bryantaylor 0:eafc3fd41f75 1033 size_t nb_pad, olen, oid_size = 0;
bryantaylor 0:eafc3fd41f75 1034 unsigned char *p = sig;
bryantaylor 0:eafc3fd41f75 1035 const char *oid = NULL;
bryantaylor 0:eafc3fd41f75 1036 unsigned char *sig_try = NULL, *verif = NULL;
bryantaylor 0:eafc3fd41f75 1037 size_t i;
bryantaylor 0:eafc3fd41f75 1038 unsigned char diff;
bryantaylor 0:eafc3fd41f75 1039 volatile unsigned char diff_no_optimize;
bryantaylor 0:eafc3fd41f75 1040 int ret;
bryantaylor 0:eafc3fd41f75 1041
bryantaylor 0:eafc3fd41f75 1042 if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V15 )
bryantaylor 0:eafc3fd41f75 1043 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
bryantaylor 0:eafc3fd41f75 1044
bryantaylor 0:eafc3fd41f75 1045 olen = ctx->len;
bryantaylor 0:eafc3fd41f75 1046 nb_pad = olen - 3;
bryantaylor 0:eafc3fd41f75 1047
bryantaylor 0:eafc3fd41f75 1048 if( md_alg != MBEDTLS_MD_NONE )
bryantaylor 0:eafc3fd41f75 1049 {
bryantaylor 0:eafc3fd41f75 1050 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type( md_alg );
bryantaylor 0:eafc3fd41f75 1051 if( md_info == NULL )
bryantaylor 0:eafc3fd41f75 1052 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
bryantaylor 0:eafc3fd41f75 1053
bryantaylor 0:eafc3fd41f75 1054 if( mbedtls_oid_get_oid_by_md( md_alg, &oid, &oid_size ) != 0 )
bryantaylor 0:eafc3fd41f75 1055 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
bryantaylor 0:eafc3fd41f75 1056
bryantaylor 0:eafc3fd41f75 1057 nb_pad -= 10 + oid_size;
bryantaylor 0:eafc3fd41f75 1058
bryantaylor 0:eafc3fd41f75 1059 hashlen = mbedtls_md_get_size( md_info );
bryantaylor 0:eafc3fd41f75 1060 }
bryantaylor 0:eafc3fd41f75 1061
bryantaylor 0:eafc3fd41f75 1062 nb_pad -= hashlen;
bryantaylor 0:eafc3fd41f75 1063
bryantaylor 0:eafc3fd41f75 1064 if( ( nb_pad < 8 ) || ( nb_pad > olen ) )
bryantaylor 0:eafc3fd41f75 1065 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
bryantaylor 0:eafc3fd41f75 1066
bryantaylor 0:eafc3fd41f75 1067 *p++ = 0;
bryantaylor 0:eafc3fd41f75 1068 *p++ = MBEDTLS_RSA_SIGN;
bryantaylor 0:eafc3fd41f75 1069 memset( p, 0xFF, nb_pad );
bryantaylor 0:eafc3fd41f75 1070 p += nb_pad;
bryantaylor 0:eafc3fd41f75 1071 *p++ = 0;
bryantaylor 0:eafc3fd41f75 1072
bryantaylor 0:eafc3fd41f75 1073 if( md_alg == MBEDTLS_MD_NONE )
bryantaylor 0:eafc3fd41f75 1074 {
bryantaylor 0:eafc3fd41f75 1075 memcpy( p, hash, hashlen );
bryantaylor 0:eafc3fd41f75 1076 }
bryantaylor 0:eafc3fd41f75 1077 else
bryantaylor 0:eafc3fd41f75 1078 {
bryantaylor 0:eafc3fd41f75 1079 /*
bryantaylor 0:eafc3fd41f75 1080 * DigestInfo ::= SEQUENCE {
bryantaylor 0:eafc3fd41f75 1081 * digestAlgorithm DigestAlgorithmIdentifier,
bryantaylor 0:eafc3fd41f75 1082 * digest Digest }
bryantaylor 0:eafc3fd41f75 1083 *
bryantaylor 0:eafc3fd41f75 1084 * DigestAlgorithmIdentifier ::= AlgorithmIdentifier
bryantaylor 0:eafc3fd41f75 1085 *
bryantaylor 0:eafc3fd41f75 1086 * Digest ::= OCTET STRING
bryantaylor 0:eafc3fd41f75 1087 */
bryantaylor 0:eafc3fd41f75 1088 *p++ = MBEDTLS_ASN1_SEQUENCE | MBEDTLS_ASN1_CONSTRUCTED;
bryantaylor 0:eafc3fd41f75 1089 *p++ = (unsigned char) ( 0x08 + oid_size + hashlen );
bryantaylor 0:eafc3fd41f75 1090 *p++ = MBEDTLS_ASN1_SEQUENCE | MBEDTLS_ASN1_CONSTRUCTED;
bryantaylor 0:eafc3fd41f75 1091 *p++ = (unsigned char) ( 0x04 + oid_size );
bryantaylor 0:eafc3fd41f75 1092 *p++ = MBEDTLS_ASN1_OID;
bryantaylor 0:eafc3fd41f75 1093 *p++ = oid_size & 0xFF;
bryantaylor 0:eafc3fd41f75 1094 memcpy( p, oid, oid_size );
bryantaylor 0:eafc3fd41f75 1095 p += oid_size;
bryantaylor 0:eafc3fd41f75 1096 *p++ = MBEDTLS_ASN1_NULL;
bryantaylor 0:eafc3fd41f75 1097 *p++ = 0x00;
bryantaylor 0:eafc3fd41f75 1098 *p++ = MBEDTLS_ASN1_OCTET_STRING;
bryantaylor 0:eafc3fd41f75 1099 *p++ = hashlen;
bryantaylor 0:eafc3fd41f75 1100 memcpy( p, hash, hashlen );
bryantaylor 0:eafc3fd41f75 1101 }
bryantaylor 0:eafc3fd41f75 1102
bryantaylor 0:eafc3fd41f75 1103 if( mode == MBEDTLS_RSA_PUBLIC )
bryantaylor 0:eafc3fd41f75 1104 return( mbedtls_rsa_public( ctx, sig, sig ) );
bryantaylor 0:eafc3fd41f75 1105
bryantaylor 0:eafc3fd41f75 1106 /*
bryantaylor 0:eafc3fd41f75 1107 * In order to prevent Lenstra's attack, make the signature in a
bryantaylor 0:eafc3fd41f75 1108 * temporary buffer and check it before returning it.
bryantaylor 0:eafc3fd41f75 1109 */
bryantaylor 0:eafc3fd41f75 1110 sig_try = mbedtls_calloc( 1, ctx->len );
bryantaylor 0:eafc3fd41f75 1111 if( sig_try == NULL )
bryantaylor 0:eafc3fd41f75 1112 return( MBEDTLS_ERR_MPI_ALLOC_FAILED );
bryantaylor 0:eafc3fd41f75 1113
bryantaylor 0:eafc3fd41f75 1114 verif = mbedtls_calloc( 1, ctx->len );
bryantaylor 0:eafc3fd41f75 1115 if( verif == NULL )
bryantaylor 0:eafc3fd41f75 1116 {
bryantaylor 0:eafc3fd41f75 1117 mbedtls_free( sig_try );
bryantaylor 0:eafc3fd41f75 1118 return( MBEDTLS_ERR_MPI_ALLOC_FAILED );
bryantaylor 0:eafc3fd41f75 1119 }
bryantaylor 0:eafc3fd41f75 1120
bryantaylor 0:eafc3fd41f75 1121 MBEDTLS_MPI_CHK( mbedtls_rsa_private( ctx, f_rng, p_rng, sig, sig_try ) );
bryantaylor 0:eafc3fd41f75 1122 MBEDTLS_MPI_CHK( mbedtls_rsa_public( ctx, sig_try, verif ) );
bryantaylor 0:eafc3fd41f75 1123
bryantaylor 0:eafc3fd41f75 1124 /* Compare in constant time just in case */
bryantaylor 0:eafc3fd41f75 1125 for( diff = 0, i = 0; i < ctx->len; i++ )
bryantaylor 0:eafc3fd41f75 1126 diff |= verif[i] ^ sig[i];
bryantaylor 0:eafc3fd41f75 1127 diff_no_optimize = diff;
bryantaylor 0:eafc3fd41f75 1128
bryantaylor 0:eafc3fd41f75 1129 if( diff_no_optimize != 0 )
bryantaylor 0:eafc3fd41f75 1130 {
bryantaylor 0:eafc3fd41f75 1131 ret = MBEDTLS_ERR_RSA_PRIVATE_FAILED;
bryantaylor 0:eafc3fd41f75 1132 goto cleanup;
bryantaylor 0:eafc3fd41f75 1133 }
bryantaylor 0:eafc3fd41f75 1134
bryantaylor 0:eafc3fd41f75 1135 memcpy( sig, sig_try, ctx->len );
bryantaylor 0:eafc3fd41f75 1136
bryantaylor 0:eafc3fd41f75 1137 cleanup:
bryantaylor 0:eafc3fd41f75 1138 mbedtls_free( sig_try );
bryantaylor 0:eafc3fd41f75 1139 mbedtls_free( verif );
bryantaylor 0:eafc3fd41f75 1140
bryantaylor 0:eafc3fd41f75 1141 return( ret );
bryantaylor 0:eafc3fd41f75 1142 }
bryantaylor 0:eafc3fd41f75 1143 #endif /* MBEDTLS_PKCS1_V15 */
bryantaylor 0:eafc3fd41f75 1144
bryantaylor 0:eafc3fd41f75 1145 /*
bryantaylor 0:eafc3fd41f75 1146 * Do an RSA operation to sign the message digest
bryantaylor 0:eafc3fd41f75 1147 */
bryantaylor 0:eafc3fd41f75 1148 int mbedtls_rsa_pkcs1_sign( mbedtls_rsa_context *ctx,
bryantaylor 0:eafc3fd41f75 1149 int (*f_rng)(void *, unsigned char *, size_t),
bryantaylor 0:eafc3fd41f75 1150 void *p_rng,
bryantaylor 0:eafc3fd41f75 1151 int mode,
bryantaylor 0:eafc3fd41f75 1152 mbedtls_md_type_t md_alg,
bryantaylor 0:eafc3fd41f75 1153 unsigned int hashlen,
bryantaylor 0:eafc3fd41f75 1154 const unsigned char *hash,
bryantaylor 0:eafc3fd41f75 1155 unsigned char *sig )
bryantaylor 0:eafc3fd41f75 1156 {
bryantaylor 0:eafc3fd41f75 1157 switch( ctx->padding )
bryantaylor 0:eafc3fd41f75 1158 {
bryantaylor 0:eafc3fd41f75 1159 #if defined(MBEDTLS_PKCS1_V15)
bryantaylor 0:eafc3fd41f75 1160 case MBEDTLS_RSA_PKCS_V15:
bryantaylor 0:eafc3fd41f75 1161 return mbedtls_rsa_rsassa_pkcs1_v15_sign( ctx, f_rng, p_rng, mode, md_alg,
bryantaylor 0:eafc3fd41f75 1162 hashlen, hash, sig );
bryantaylor 0:eafc3fd41f75 1163 #endif
bryantaylor 0:eafc3fd41f75 1164
bryantaylor 0:eafc3fd41f75 1165 #if defined(MBEDTLS_PKCS1_V21)
bryantaylor 0:eafc3fd41f75 1166 case MBEDTLS_RSA_PKCS_V21:
bryantaylor 0:eafc3fd41f75 1167 return mbedtls_rsa_rsassa_pss_sign( ctx, f_rng, p_rng, mode, md_alg,
bryantaylor 0:eafc3fd41f75 1168 hashlen, hash, sig );
bryantaylor 0:eafc3fd41f75 1169 #endif
bryantaylor 0:eafc3fd41f75 1170
bryantaylor 0:eafc3fd41f75 1171 default:
bryantaylor 0:eafc3fd41f75 1172 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
bryantaylor 0:eafc3fd41f75 1173 }
bryantaylor 0:eafc3fd41f75 1174 }
bryantaylor 0:eafc3fd41f75 1175
bryantaylor 0:eafc3fd41f75 1176 #if defined(MBEDTLS_PKCS1_V21)
bryantaylor 0:eafc3fd41f75 1177 /*
bryantaylor 0:eafc3fd41f75 1178 * Implementation of the PKCS#1 v2.1 RSASSA-PSS-VERIFY function
bryantaylor 0:eafc3fd41f75 1179 */
bryantaylor 0:eafc3fd41f75 1180 int mbedtls_rsa_rsassa_pss_verify_ext( mbedtls_rsa_context *ctx,
bryantaylor 0:eafc3fd41f75 1181 int (*f_rng)(void *, unsigned char *, size_t),
bryantaylor 0:eafc3fd41f75 1182 void *p_rng,
bryantaylor 0:eafc3fd41f75 1183 int mode,
bryantaylor 0:eafc3fd41f75 1184 mbedtls_md_type_t md_alg,
bryantaylor 0:eafc3fd41f75 1185 unsigned int hashlen,
bryantaylor 0:eafc3fd41f75 1186 const unsigned char *hash,
bryantaylor 0:eafc3fd41f75 1187 mbedtls_md_type_t mgf1_hash_id,
bryantaylor 0:eafc3fd41f75 1188 int expected_salt_len,
bryantaylor 0:eafc3fd41f75 1189 const unsigned char *sig )
bryantaylor 0:eafc3fd41f75 1190 {
bryantaylor 0:eafc3fd41f75 1191 int ret;
bryantaylor 0:eafc3fd41f75 1192 size_t siglen;
bryantaylor 0:eafc3fd41f75 1193 unsigned char *p;
bryantaylor 0:eafc3fd41f75 1194 unsigned char result[MBEDTLS_MD_MAX_SIZE];
bryantaylor 0:eafc3fd41f75 1195 unsigned char zeros[8];
bryantaylor 0:eafc3fd41f75 1196 unsigned int hlen;
bryantaylor 0:eafc3fd41f75 1197 size_t slen, msb;
bryantaylor 0:eafc3fd41f75 1198 const mbedtls_md_info_t *md_info;
bryantaylor 0:eafc3fd41f75 1199 mbedtls_md_context_t md_ctx;
bryantaylor 0:eafc3fd41f75 1200 unsigned char buf[MBEDTLS_MPI_MAX_SIZE];
bryantaylor 0:eafc3fd41f75 1201
bryantaylor 0:eafc3fd41f75 1202 if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V21 )
bryantaylor 0:eafc3fd41f75 1203 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
bryantaylor 0:eafc3fd41f75 1204
bryantaylor 0:eafc3fd41f75 1205 siglen = ctx->len;
bryantaylor 0:eafc3fd41f75 1206
bryantaylor 0:eafc3fd41f75 1207 if( siglen < 16 || siglen > sizeof( buf ) )
bryantaylor 0:eafc3fd41f75 1208 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
bryantaylor 0:eafc3fd41f75 1209
bryantaylor 0:eafc3fd41f75 1210 ret = ( mode == MBEDTLS_RSA_PUBLIC )
bryantaylor 0:eafc3fd41f75 1211 ? mbedtls_rsa_public( ctx, sig, buf )
bryantaylor 0:eafc3fd41f75 1212 : mbedtls_rsa_private( ctx, f_rng, p_rng, sig, buf );
bryantaylor 0:eafc3fd41f75 1213
bryantaylor 0:eafc3fd41f75 1214 if( ret != 0 )
bryantaylor 0:eafc3fd41f75 1215 return( ret );
bryantaylor 0:eafc3fd41f75 1216
bryantaylor 0:eafc3fd41f75 1217 p = buf;
bryantaylor 0:eafc3fd41f75 1218
bryantaylor 0:eafc3fd41f75 1219 if( buf[siglen - 1] != 0xBC )
bryantaylor 0:eafc3fd41f75 1220 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
bryantaylor 0:eafc3fd41f75 1221
bryantaylor 0:eafc3fd41f75 1222 if( md_alg != MBEDTLS_MD_NONE )
bryantaylor 0:eafc3fd41f75 1223 {
bryantaylor 0:eafc3fd41f75 1224 /* Gather length of hash to sign */
bryantaylor 0:eafc3fd41f75 1225 md_info = mbedtls_md_info_from_type( md_alg );
bryantaylor 0:eafc3fd41f75 1226 if( md_info == NULL )
bryantaylor 0:eafc3fd41f75 1227 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
bryantaylor 0:eafc3fd41f75 1228
bryantaylor 0:eafc3fd41f75 1229 hashlen = mbedtls_md_get_size( md_info );
bryantaylor 0:eafc3fd41f75 1230 }
bryantaylor 0:eafc3fd41f75 1231
bryantaylor 0:eafc3fd41f75 1232 md_info = mbedtls_md_info_from_type( mgf1_hash_id );
bryantaylor 0:eafc3fd41f75 1233 if( md_info == NULL )
bryantaylor 0:eafc3fd41f75 1234 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
bryantaylor 0:eafc3fd41f75 1235
bryantaylor 0:eafc3fd41f75 1236 hlen = mbedtls_md_get_size( md_info );
bryantaylor 0:eafc3fd41f75 1237 slen = siglen - hlen - 1; /* Currently length of salt + padding */
bryantaylor 0:eafc3fd41f75 1238
bryantaylor 0:eafc3fd41f75 1239 memset( zeros, 0, 8 );
bryantaylor 0:eafc3fd41f75 1240
bryantaylor 0:eafc3fd41f75 1241 /*
bryantaylor 0:eafc3fd41f75 1242 * Note: EMSA-PSS verification is over the length of N - 1 bits
bryantaylor 0:eafc3fd41f75 1243 */
bryantaylor 0:eafc3fd41f75 1244 msb = mbedtls_mpi_bitlen( &ctx->N ) - 1;
bryantaylor 0:eafc3fd41f75 1245
bryantaylor 0:eafc3fd41f75 1246 /* Compensate for boundary condition when applying mask */
bryantaylor 0:eafc3fd41f75 1247 if( msb % 8 == 0 )
bryantaylor 0:eafc3fd41f75 1248 {
bryantaylor 0:eafc3fd41f75 1249 p++;
bryantaylor 0:eafc3fd41f75 1250 siglen -= 1;
bryantaylor 0:eafc3fd41f75 1251 }
bryantaylor 0:eafc3fd41f75 1252 if( buf[0] >> ( 8 - siglen * 8 + msb ) )
bryantaylor 0:eafc3fd41f75 1253 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
bryantaylor 0:eafc3fd41f75 1254
bryantaylor 0:eafc3fd41f75 1255 mbedtls_md_init( &md_ctx );
bryantaylor 0:eafc3fd41f75 1256 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 0 ) ) != 0 )
bryantaylor 0:eafc3fd41f75 1257 {
bryantaylor 0:eafc3fd41f75 1258 mbedtls_md_free( &md_ctx );
bryantaylor 0:eafc3fd41f75 1259 return( ret );
bryantaylor 0:eafc3fd41f75 1260 }
bryantaylor 0:eafc3fd41f75 1261
bryantaylor 0:eafc3fd41f75 1262 mgf_mask( p, siglen - hlen - 1, p + siglen - hlen - 1, hlen, &md_ctx );
bryantaylor 0:eafc3fd41f75 1263
bryantaylor 0:eafc3fd41f75 1264 buf[0] &= 0xFF >> ( siglen * 8 - msb );
bryantaylor 0:eafc3fd41f75 1265
bryantaylor 0:eafc3fd41f75 1266 while( p < buf + siglen && *p == 0 )
bryantaylor 0:eafc3fd41f75 1267 p++;
bryantaylor 0:eafc3fd41f75 1268
bryantaylor 0:eafc3fd41f75 1269 if( p == buf + siglen ||
bryantaylor 0:eafc3fd41f75 1270 *p++ != 0x01 )
bryantaylor 0:eafc3fd41f75 1271 {
bryantaylor 0:eafc3fd41f75 1272 mbedtls_md_free( &md_ctx );
bryantaylor 0:eafc3fd41f75 1273 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
bryantaylor 0:eafc3fd41f75 1274 }
bryantaylor 0:eafc3fd41f75 1275
bryantaylor 0:eafc3fd41f75 1276 /* Actual salt len */
bryantaylor 0:eafc3fd41f75 1277 slen -= p - buf;
bryantaylor 0:eafc3fd41f75 1278
bryantaylor 0:eafc3fd41f75 1279 if( expected_salt_len != MBEDTLS_RSA_SALT_LEN_ANY &&
bryantaylor 0:eafc3fd41f75 1280 slen != (size_t) expected_salt_len )
bryantaylor 0:eafc3fd41f75 1281 {
bryantaylor 0:eafc3fd41f75 1282 mbedtls_md_free( &md_ctx );
bryantaylor 0:eafc3fd41f75 1283 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
bryantaylor 0:eafc3fd41f75 1284 }
bryantaylor 0:eafc3fd41f75 1285
bryantaylor 0:eafc3fd41f75 1286 /*
bryantaylor 0:eafc3fd41f75 1287 * Generate H = Hash( M' )
bryantaylor 0:eafc3fd41f75 1288 */
bryantaylor 0:eafc3fd41f75 1289 mbedtls_md_starts( &md_ctx );
bryantaylor 0:eafc3fd41f75 1290 mbedtls_md_update( &md_ctx, zeros, 8 );
bryantaylor 0:eafc3fd41f75 1291 mbedtls_md_update( &md_ctx, hash, hashlen );
bryantaylor 0:eafc3fd41f75 1292 mbedtls_md_update( &md_ctx, p, slen );
bryantaylor 0:eafc3fd41f75 1293 mbedtls_md_finish( &md_ctx, result );
bryantaylor 0:eafc3fd41f75 1294
bryantaylor 0:eafc3fd41f75 1295 mbedtls_md_free( &md_ctx );
bryantaylor 0:eafc3fd41f75 1296
bryantaylor 0:eafc3fd41f75 1297 if( memcmp( p + slen, result, hlen ) == 0 )
bryantaylor 0:eafc3fd41f75 1298 return( 0 );
bryantaylor 0:eafc3fd41f75 1299 else
bryantaylor 0:eafc3fd41f75 1300 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
bryantaylor 0:eafc3fd41f75 1301 }
bryantaylor 0:eafc3fd41f75 1302
bryantaylor 0:eafc3fd41f75 1303 /*
bryantaylor 0:eafc3fd41f75 1304 * Simplified PKCS#1 v2.1 RSASSA-PSS-VERIFY function
bryantaylor 0:eafc3fd41f75 1305 */
bryantaylor 0:eafc3fd41f75 1306 int mbedtls_rsa_rsassa_pss_verify( mbedtls_rsa_context *ctx,
bryantaylor 0:eafc3fd41f75 1307 int (*f_rng)(void *, unsigned char *, size_t),
bryantaylor 0:eafc3fd41f75 1308 void *p_rng,
bryantaylor 0:eafc3fd41f75 1309 int mode,
bryantaylor 0:eafc3fd41f75 1310 mbedtls_md_type_t md_alg,
bryantaylor 0:eafc3fd41f75 1311 unsigned int hashlen,
bryantaylor 0:eafc3fd41f75 1312 const unsigned char *hash,
bryantaylor 0:eafc3fd41f75 1313 const unsigned char *sig )
bryantaylor 0:eafc3fd41f75 1314 {
bryantaylor 0:eafc3fd41f75 1315 mbedtls_md_type_t mgf1_hash_id = ( ctx->hash_id != MBEDTLS_MD_NONE )
bryantaylor 0:eafc3fd41f75 1316 ? (mbedtls_md_type_t) ctx->hash_id
bryantaylor 0:eafc3fd41f75 1317 : md_alg;
bryantaylor 0:eafc3fd41f75 1318
bryantaylor 0:eafc3fd41f75 1319 return( mbedtls_rsa_rsassa_pss_verify_ext( ctx, f_rng, p_rng, mode,
bryantaylor 0:eafc3fd41f75 1320 md_alg, hashlen, hash,
bryantaylor 0:eafc3fd41f75 1321 mgf1_hash_id, MBEDTLS_RSA_SALT_LEN_ANY,
bryantaylor 0:eafc3fd41f75 1322 sig ) );
bryantaylor 0:eafc3fd41f75 1323
bryantaylor 0:eafc3fd41f75 1324 }
bryantaylor 0:eafc3fd41f75 1325 #endif /* MBEDTLS_PKCS1_V21 */
bryantaylor 0:eafc3fd41f75 1326
bryantaylor 0:eafc3fd41f75 1327 #if defined(MBEDTLS_PKCS1_V15)
bryantaylor 0:eafc3fd41f75 1328 /*
bryantaylor 0:eafc3fd41f75 1329 * Implementation of the PKCS#1 v2.1 RSASSA-PKCS1-v1_5-VERIFY function
bryantaylor 0:eafc3fd41f75 1330 */
bryantaylor 0:eafc3fd41f75 1331 int mbedtls_rsa_rsassa_pkcs1_v15_verify( mbedtls_rsa_context *ctx,
bryantaylor 0:eafc3fd41f75 1332 int (*f_rng)(void *, unsigned char *, size_t),
bryantaylor 0:eafc3fd41f75 1333 void *p_rng,
bryantaylor 0:eafc3fd41f75 1334 int mode,
bryantaylor 0:eafc3fd41f75 1335 mbedtls_md_type_t md_alg,
bryantaylor 0:eafc3fd41f75 1336 unsigned int hashlen,
bryantaylor 0:eafc3fd41f75 1337 const unsigned char *hash,
bryantaylor 0:eafc3fd41f75 1338 const unsigned char *sig )
bryantaylor 0:eafc3fd41f75 1339 {
bryantaylor 0:eafc3fd41f75 1340 int ret;
bryantaylor 0:eafc3fd41f75 1341 size_t len, siglen, asn1_len;
bryantaylor 0:eafc3fd41f75 1342 unsigned char *p, *end;
bryantaylor 0:eafc3fd41f75 1343 mbedtls_md_type_t msg_md_alg;
bryantaylor 0:eafc3fd41f75 1344 const mbedtls_md_info_t *md_info;
bryantaylor 0:eafc3fd41f75 1345 mbedtls_asn1_buf oid;
bryantaylor 0:eafc3fd41f75 1346 unsigned char buf[MBEDTLS_MPI_MAX_SIZE];
bryantaylor 0:eafc3fd41f75 1347
bryantaylor 0:eafc3fd41f75 1348 if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V15 )
bryantaylor 0:eafc3fd41f75 1349 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
bryantaylor 0:eafc3fd41f75 1350
bryantaylor 0:eafc3fd41f75 1351 siglen = ctx->len;
bryantaylor 0:eafc3fd41f75 1352
bryantaylor 0:eafc3fd41f75 1353 if( siglen < 16 || siglen > sizeof( buf ) )
bryantaylor 0:eafc3fd41f75 1354 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
bryantaylor 0:eafc3fd41f75 1355
bryantaylor 0:eafc3fd41f75 1356 ret = ( mode == MBEDTLS_RSA_PUBLIC )
bryantaylor 0:eafc3fd41f75 1357 ? mbedtls_rsa_public( ctx, sig, buf )
bryantaylor 0:eafc3fd41f75 1358 : mbedtls_rsa_private( ctx, f_rng, p_rng, sig, buf );
bryantaylor 0:eafc3fd41f75 1359
bryantaylor 0:eafc3fd41f75 1360 if( ret != 0 )
bryantaylor 0:eafc3fd41f75 1361 return( ret );
bryantaylor 0:eafc3fd41f75 1362
bryantaylor 0:eafc3fd41f75 1363 p = buf;
bryantaylor 0:eafc3fd41f75 1364
bryantaylor 0:eafc3fd41f75 1365 if( *p++ != 0 || *p++ != MBEDTLS_RSA_SIGN )
bryantaylor 0:eafc3fd41f75 1366 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
bryantaylor 0:eafc3fd41f75 1367
bryantaylor 0:eafc3fd41f75 1368 while( *p != 0 )
bryantaylor 0:eafc3fd41f75 1369 {
bryantaylor 0:eafc3fd41f75 1370 if( p >= buf + siglen - 1 || *p != 0xFF )
bryantaylor 0:eafc3fd41f75 1371 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
bryantaylor 0:eafc3fd41f75 1372 p++;
bryantaylor 0:eafc3fd41f75 1373 }
bryantaylor 0:eafc3fd41f75 1374 p++;
bryantaylor 0:eafc3fd41f75 1375
bryantaylor 0:eafc3fd41f75 1376 len = siglen - ( p - buf );
bryantaylor 0:eafc3fd41f75 1377
bryantaylor 0:eafc3fd41f75 1378 if( len == hashlen && md_alg == MBEDTLS_MD_NONE )
bryantaylor 0:eafc3fd41f75 1379 {
bryantaylor 0:eafc3fd41f75 1380 if( memcmp( p, hash, hashlen ) == 0 )
bryantaylor 0:eafc3fd41f75 1381 return( 0 );
bryantaylor 0:eafc3fd41f75 1382 else
bryantaylor 0:eafc3fd41f75 1383 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
bryantaylor 0:eafc3fd41f75 1384 }
bryantaylor 0:eafc3fd41f75 1385
bryantaylor 0:eafc3fd41f75 1386 md_info = mbedtls_md_info_from_type( md_alg );
bryantaylor 0:eafc3fd41f75 1387 if( md_info == NULL )
bryantaylor 0:eafc3fd41f75 1388 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
bryantaylor 0:eafc3fd41f75 1389 hashlen = mbedtls_md_get_size( md_info );
bryantaylor 0:eafc3fd41f75 1390
bryantaylor 0:eafc3fd41f75 1391 end = p + len;
bryantaylor 0:eafc3fd41f75 1392
bryantaylor 0:eafc3fd41f75 1393 /*
bryantaylor 0:eafc3fd41f75 1394 * Parse the ASN.1 structure inside the PKCS#1 v1.5 structure
bryantaylor 0:eafc3fd41f75 1395 */
bryantaylor 0:eafc3fd41f75 1396 if( ( ret = mbedtls_asn1_get_tag( &p, end, &asn1_len,
bryantaylor 0:eafc3fd41f75 1397 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
bryantaylor 0:eafc3fd41f75 1398 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
bryantaylor 0:eafc3fd41f75 1399
bryantaylor 0:eafc3fd41f75 1400 if( asn1_len + 2 != len )
bryantaylor 0:eafc3fd41f75 1401 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
bryantaylor 0:eafc3fd41f75 1402
bryantaylor 0:eafc3fd41f75 1403 if( ( ret = mbedtls_asn1_get_tag( &p, end, &asn1_len,
bryantaylor 0:eafc3fd41f75 1404 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
bryantaylor 0:eafc3fd41f75 1405 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
bryantaylor 0:eafc3fd41f75 1406
bryantaylor 0:eafc3fd41f75 1407 if( asn1_len + 6 + hashlen != len )
bryantaylor 0:eafc3fd41f75 1408 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
bryantaylor 0:eafc3fd41f75 1409
bryantaylor 0:eafc3fd41f75 1410 if( ( ret = mbedtls_asn1_get_tag( &p, end, &oid.len, MBEDTLS_ASN1_OID ) ) != 0 )
bryantaylor 0:eafc3fd41f75 1411 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
bryantaylor 0:eafc3fd41f75 1412
bryantaylor 0:eafc3fd41f75 1413 oid.p = p;
bryantaylor 0:eafc3fd41f75 1414 p += oid.len;
bryantaylor 0:eafc3fd41f75 1415
bryantaylor 0:eafc3fd41f75 1416 if( mbedtls_oid_get_md_alg( &oid, &msg_md_alg ) != 0 )
bryantaylor 0:eafc3fd41f75 1417 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
bryantaylor 0:eafc3fd41f75 1418
bryantaylor 0:eafc3fd41f75 1419 if( md_alg != msg_md_alg )
bryantaylor 0:eafc3fd41f75 1420 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
bryantaylor 0:eafc3fd41f75 1421
bryantaylor 0:eafc3fd41f75 1422 /*
bryantaylor 0:eafc3fd41f75 1423 * assume the algorithm parameters must be NULL
bryantaylor 0:eafc3fd41f75 1424 */
bryantaylor 0:eafc3fd41f75 1425 if( ( ret = mbedtls_asn1_get_tag( &p, end, &asn1_len, MBEDTLS_ASN1_NULL ) ) != 0 )
bryantaylor 0:eafc3fd41f75 1426 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
bryantaylor 0:eafc3fd41f75 1427
bryantaylor 0:eafc3fd41f75 1428 if( ( ret = mbedtls_asn1_get_tag( &p, end, &asn1_len, MBEDTLS_ASN1_OCTET_STRING ) ) != 0 )
bryantaylor 0:eafc3fd41f75 1429 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
bryantaylor 0:eafc3fd41f75 1430
bryantaylor 0:eafc3fd41f75 1431 if( asn1_len != hashlen )
bryantaylor 0:eafc3fd41f75 1432 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
bryantaylor 0:eafc3fd41f75 1433
bryantaylor 0:eafc3fd41f75 1434 if( memcmp( p, hash, hashlen ) != 0 )
bryantaylor 0:eafc3fd41f75 1435 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
bryantaylor 0:eafc3fd41f75 1436
bryantaylor 0:eafc3fd41f75 1437 p += hashlen;
bryantaylor 0:eafc3fd41f75 1438
bryantaylor 0:eafc3fd41f75 1439 if( p != end )
bryantaylor 0:eafc3fd41f75 1440 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
bryantaylor 0:eafc3fd41f75 1441
bryantaylor 0:eafc3fd41f75 1442 return( 0 );
bryantaylor 0:eafc3fd41f75 1443 }
bryantaylor 0:eafc3fd41f75 1444 #endif /* MBEDTLS_PKCS1_V15 */
bryantaylor 0:eafc3fd41f75 1445
bryantaylor 0:eafc3fd41f75 1446 /*
bryantaylor 0:eafc3fd41f75 1447 * Do an RSA operation and check the message digest
bryantaylor 0:eafc3fd41f75 1448 */
bryantaylor 0:eafc3fd41f75 1449 int mbedtls_rsa_pkcs1_verify( mbedtls_rsa_context *ctx,
bryantaylor 0:eafc3fd41f75 1450 int (*f_rng)(void *, unsigned char *, size_t),
bryantaylor 0:eafc3fd41f75 1451 void *p_rng,
bryantaylor 0:eafc3fd41f75 1452 int mode,
bryantaylor 0:eafc3fd41f75 1453 mbedtls_md_type_t md_alg,
bryantaylor 0:eafc3fd41f75 1454 unsigned int hashlen,
bryantaylor 0:eafc3fd41f75 1455 const unsigned char *hash,
bryantaylor 0:eafc3fd41f75 1456 const unsigned char *sig )
bryantaylor 0:eafc3fd41f75 1457 {
bryantaylor 0:eafc3fd41f75 1458 switch( ctx->padding )
bryantaylor 0:eafc3fd41f75 1459 {
bryantaylor 0:eafc3fd41f75 1460 #if defined(MBEDTLS_PKCS1_V15)
bryantaylor 0:eafc3fd41f75 1461 case MBEDTLS_RSA_PKCS_V15:
bryantaylor 0:eafc3fd41f75 1462 return mbedtls_rsa_rsassa_pkcs1_v15_verify( ctx, f_rng, p_rng, mode, md_alg,
bryantaylor 0:eafc3fd41f75 1463 hashlen, hash, sig );
bryantaylor 0:eafc3fd41f75 1464 #endif
bryantaylor 0:eafc3fd41f75 1465
bryantaylor 0:eafc3fd41f75 1466 #if defined(MBEDTLS_PKCS1_V21)
bryantaylor 0:eafc3fd41f75 1467 case MBEDTLS_RSA_PKCS_V21:
bryantaylor 0:eafc3fd41f75 1468 return mbedtls_rsa_rsassa_pss_verify( ctx, f_rng, p_rng, mode, md_alg,
bryantaylor 0:eafc3fd41f75 1469 hashlen, hash, sig );
bryantaylor 0:eafc3fd41f75 1470 #endif
bryantaylor 0:eafc3fd41f75 1471
bryantaylor 0:eafc3fd41f75 1472 default:
bryantaylor 0:eafc3fd41f75 1473 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
bryantaylor 0:eafc3fd41f75 1474 }
bryantaylor 0:eafc3fd41f75 1475 }
bryantaylor 0:eafc3fd41f75 1476
bryantaylor 0:eafc3fd41f75 1477 /*
bryantaylor 0:eafc3fd41f75 1478 * Copy the components of an RSA key
bryantaylor 0:eafc3fd41f75 1479 */
bryantaylor 0:eafc3fd41f75 1480 int mbedtls_rsa_copy( mbedtls_rsa_context *dst, const mbedtls_rsa_context *src )
bryantaylor 0:eafc3fd41f75 1481 {
bryantaylor 0:eafc3fd41f75 1482 int ret;
bryantaylor 0:eafc3fd41f75 1483
bryantaylor 0:eafc3fd41f75 1484 dst->ver = src->ver;
bryantaylor 0:eafc3fd41f75 1485 dst->len = src->len;
bryantaylor 0:eafc3fd41f75 1486
bryantaylor 0:eafc3fd41f75 1487 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->N, &src->N ) );
bryantaylor 0:eafc3fd41f75 1488 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->E, &src->E ) );
bryantaylor 0:eafc3fd41f75 1489
bryantaylor 0:eafc3fd41f75 1490 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->D, &src->D ) );
bryantaylor 0:eafc3fd41f75 1491 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->P, &src->P ) );
bryantaylor 0:eafc3fd41f75 1492 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->Q, &src->Q ) );
bryantaylor 0:eafc3fd41f75 1493 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->DP, &src->DP ) );
bryantaylor 0:eafc3fd41f75 1494 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->DQ, &src->DQ ) );
bryantaylor 0:eafc3fd41f75 1495 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->QP, &src->QP ) );
bryantaylor 0:eafc3fd41f75 1496
bryantaylor 0:eafc3fd41f75 1497 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->RN, &src->RN ) );
bryantaylor 0:eafc3fd41f75 1498 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->RP, &src->RP ) );
bryantaylor 0:eafc3fd41f75 1499 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->RQ, &src->RQ ) );
bryantaylor 0:eafc3fd41f75 1500
bryantaylor 0:eafc3fd41f75 1501 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->Vi, &src->Vi ) );
bryantaylor 0:eafc3fd41f75 1502 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->Vf, &src->Vf ) );
bryantaylor 0:eafc3fd41f75 1503
bryantaylor 0:eafc3fd41f75 1504 dst->padding = src->padding;
bryantaylor 0:eafc3fd41f75 1505 dst->hash_id = src->hash_id;
bryantaylor 0:eafc3fd41f75 1506
bryantaylor 0:eafc3fd41f75 1507 cleanup:
bryantaylor 0:eafc3fd41f75 1508 if( ret != 0 )
bryantaylor 0:eafc3fd41f75 1509 mbedtls_rsa_free( dst );
bryantaylor 0:eafc3fd41f75 1510
bryantaylor 0:eafc3fd41f75 1511 return( ret );
bryantaylor 0:eafc3fd41f75 1512 }
bryantaylor 0:eafc3fd41f75 1513
bryantaylor 0:eafc3fd41f75 1514 /*
bryantaylor 0:eafc3fd41f75 1515 * Free the components of an RSA key
bryantaylor 0:eafc3fd41f75 1516 */
bryantaylor 0:eafc3fd41f75 1517 void mbedtls_rsa_free( mbedtls_rsa_context *ctx )
bryantaylor 0:eafc3fd41f75 1518 {
bryantaylor 0:eafc3fd41f75 1519 mbedtls_mpi_free( &ctx->Vi ); mbedtls_mpi_free( &ctx->Vf );
bryantaylor 0:eafc3fd41f75 1520 mbedtls_mpi_free( &ctx->RQ ); mbedtls_mpi_free( &ctx->RP ); mbedtls_mpi_free( &ctx->RN );
bryantaylor 0:eafc3fd41f75 1521 mbedtls_mpi_free( &ctx->QP ); mbedtls_mpi_free( &ctx->DQ ); mbedtls_mpi_free( &ctx->DP );
bryantaylor 0:eafc3fd41f75 1522 mbedtls_mpi_free( &ctx->Q ); mbedtls_mpi_free( &ctx->P ); mbedtls_mpi_free( &ctx->D );
bryantaylor 0:eafc3fd41f75 1523 mbedtls_mpi_free( &ctx->E ); mbedtls_mpi_free( &ctx->N );
bryantaylor 0:eafc3fd41f75 1524
bryantaylor 0:eafc3fd41f75 1525 #if defined(MBEDTLS_THREADING_C)
bryantaylor 0:eafc3fd41f75 1526 mbedtls_mutex_free( &ctx->mutex );
bryantaylor 0:eafc3fd41f75 1527 #endif
bryantaylor 0:eafc3fd41f75 1528 }
bryantaylor 0:eafc3fd41f75 1529
bryantaylor 0:eafc3fd41f75 1530 #if defined(MBEDTLS_SELF_TEST)
bryantaylor 0:eafc3fd41f75 1531
bryantaylor 0:eafc3fd41f75 1532 #include "mbedtls/sha1.h"
bryantaylor 0:eafc3fd41f75 1533
bryantaylor 0:eafc3fd41f75 1534 /*
bryantaylor 0:eafc3fd41f75 1535 * Example RSA-1024 keypair, for test purposes
bryantaylor 0:eafc3fd41f75 1536 */
bryantaylor 0:eafc3fd41f75 1537 #define KEY_LEN 128
bryantaylor 0:eafc3fd41f75 1538
bryantaylor 0:eafc3fd41f75 1539 #define RSA_N "9292758453063D803DD603D5E777D788" \
bryantaylor 0:eafc3fd41f75 1540 "8ED1D5BF35786190FA2F23EBC0848AEA" \
bryantaylor 0:eafc3fd41f75 1541 "DDA92CA6C3D80B32C4D109BE0F36D6AE" \
bryantaylor 0:eafc3fd41f75 1542 "7130B9CED7ACDF54CFC7555AC14EEBAB" \
bryantaylor 0:eafc3fd41f75 1543 "93A89813FBF3C4F8066D2D800F7C38A8" \
bryantaylor 0:eafc3fd41f75 1544 "1AE31942917403FF4946B0A83D3D3E05" \
bryantaylor 0:eafc3fd41f75 1545 "EE57C6F5F5606FB5D4BC6CD34EE0801A" \
bryantaylor 0:eafc3fd41f75 1546 "5E94BB77B07507233A0BC7BAC8F90F79"
bryantaylor 0:eafc3fd41f75 1547
bryantaylor 0:eafc3fd41f75 1548 #define RSA_E "10001"
bryantaylor 0:eafc3fd41f75 1549
bryantaylor 0:eafc3fd41f75 1550 #define RSA_D "24BF6185468786FDD303083D25E64EFC" \
bryantaylor 0:eafc3fd41f75 1551 "66CA472BC44D253102F8B4A9D3BFA750" \
bryantaylor 0:eafc3fd41f75 1552 "91386C0077937FE33FA3252D28855837" \
bryantaylor 0:eafc3fd41f75 1553 "AE1B484A8A9A45F7EE8C0C634F99E8CD" \
bryantaylor 0:eafc3fd41f75 1554 "DF79C5CE07EE72C7F123142198164234" \
bryantaylor 0:eafc3fd41f75 1555 "CABB724CF78B8173B9F880FC86322407" \
bryantaylor 0:eafc3fd41f75 1556 "AF1FEDFDDE2BEB674CA15F3E81A1521E" \
bryantaylor 0:eafc3fd41f75 1557 "071513A1E85B5DFA031F21ECAE91A34D"
bryantaylor 0:eafc3fd41f75 1558
bryantaylor 0:eafc3fd41f75 1559 #define RSA_P "C36D0EB7FCD285223CFB5AABA5BDA3D8" \
bryantaylor 0:eafc3fd41f75 1560 "2C01CAD19EA484A87EA4377637E75500" \
bryantaylor 0:eafc3fd41f75 1561 "FCB2005C5C7DD6EC4AC023CDA285D796" \
bryantaylor 0:eafc3fd41f75 1562 "C3D9E75E1EFC42488BB4F1D13AC30A57"
bryantaylor 0:eafc3fd41f75 1563
bryantaylor 0:eafc3fd41f75 1564 #define RSA_Q "C000DF51A7C77AE8D7C7370C1FF55B69" \
bryantaylor 0:eafc3fd41f75 1565 "E211C2B9E5DB1ED0BF61D0D9899620F4" \
bryantaylor 0:eafc3fd41f75 1566 "910E4168387E3C30AA1E00C339A79508" \
bryantaylor 0:eafc3fd41f75 1567 "8452DD96A9A5EA5D9DCA68DA636032AF"
bryantaylor 0:eafc3fd41f75 1568
bryantaylor 0:eafc3fd41f75 1569 #define RSA_DP "C1ACF567564274FB07A0BBAD5D26E298" \
bryantaylor 0:eafc3fd41f75 1570 "3C94D22288ACD763FD8E5600ED4A702D" \
bryantaylor 0:eafc3fd41f75 1571 "F84198A5F06C2E72236AE490C93F07F8" \
bryantaylor 0:eafc3fd41f75 1572 "3CC559CD27BC2D1CA488811730BB5725"
bryantaylor 0:eafc3fd41f75 1573
bryantaylor 0:eafc3fd41f75 1574 #define RSA_DQ "4959CBF6F8FEF750AEE6977C155579C7" \
bryantaylor 0:eafc3fd41f75 1575 "D8AAEA56749EA28623272E4F7D0592AF" \
bryantaylor 0:eafc3fd41f75 1576 "7C1F1313CAC9471B5C523BFE592F517B" \
bryantaylor 0:eafc3fd41f75 1577 "407A1BD76C164B93DA2D32A383E58357"
bryantaylor 0:eafc3fd41f75 1578
bryantaylor 0:eafc3fd41f75 1579 #define RSA_QP "9AE7FBC99546432DF71896FC239EADAE" \
bryantaylor 0:eafc3fd41f75 1580 "F38D18D2B2F0E2DD275AA977E2BF4411" \
bryantaylor 0:eafc3fd41f75 1581 "F5A3B2A5D33605AEBBCCBA7FEB9F2D2F" \
bryantaylor 0:eafc3fd41f75 1582 "A74206CEC169D74BF5A8C50D6F48EA08"
bryantaylor 0:eafc3fd41f75 1583
bryantaylor 0:eafc3fd41f75 1584 #define PT_LEN 24
bryantaylor 0:eafc3fd41f75 1585 #define RSA_PT "\xAA\xBB\xCC\x03\x02\x01\x00\xFF\xFF\xFF\xFF\xFF" \
bryantaylor 0:eafc3fd41f75 1586 "\x11\x22\x33\x0A\x0B\x0C\xCC\xDD\xDD\xDD\xDD\xDD"
bryantaylor 0:eafc3fd41f75 1587
bryantaylor 0:eafc3fd41f75 1588 #if defined(MBEDTLS_PKCS1_V15)
bryantaylor 0:eafc3fd41f75 1589 static int myrand( void *rng_state, unsigned char *output, size_t len )
bryantaylor 0:eafc3fd41f75 1590 {
bryantaylor 0:eafc3fd41f75 1591 #if !defined(__OpenBSD__)
bryantaylor 0:eafc3fd41f75 1592 size_t i;
bryantaylor 0:eafc3fd41f75 1593
bryantaylor 0:eafc3fd41f75 1594 if( rng_state != NULL )
bryantaylor 0:eafc3fd41f75 1595 rng_state = NULL;
bryantaylor 0:eafc3fd41f75 1596
bryantaylor 0:eafc3fd41f75 1597 for( i = 0; i < len; ++i )
bryantaylor 0:eafc3fd41f75 1598 output[i] = rand();
bryantaylor 0:eafc3fd41f75 1599 #else
bryantaylor 0:eafc3fd41f75 1600 if( rng_state != NULL )
bryantaylor 0:eafc3fd41f75 1601 rng_state = NULL;
bryantaylor 0:eafc3fd41f75 1602
bryantaylor 0:eafc3fd41f75 1603 arc4random_buf( output, len );
bryantaylor 0:eafc3fd41f75 1604 #endif /* !OpenBSD */
bryantaylor 0:eafc3fd41f75 1605
bryantaylor 0:eafc3fd41f75 1606 return( 0 );
bryantaylor 0:eafc3fd41f75 1607 }
bryantaylor 0:eafc3fd41f75 1608 #endif /* MBEDTLS_PKCS1_V15 */
bryantaylor 0:eafc3fd41f75 1609
bryantaylor 0:eafc3fd41f75 1610 /*
bryantaylor 0:eafc3fd41f75 1611 * Checkup routine
bryantaylor 0:eafc3fd41f75 1612 */
bryantaylor 0:eafc3fd41f75 1613 int mbedtls_rsa_self_test( int verbose )
bryantaylor 0:eafc3fd41f75 1614 {
bryantaylor 0:eafc3fd41f75 1615 int ret = 0;
bryantaylor 0:eafc3fd41f75 1616 #if defined(MBEDTLS_PKCS1_V15)
bryantaylor 0:eafc3fd41f75 1617 size_t len;
bryantaylor 0:eafc3fd41f75 1618 mbedtls_rsa_context rsa;
bryantaylor 0:eafc3fd41f75 1619 unsigned char rsa_plaintext[PT_LEN];
bryantaylor 0:eafc3fd41f75 1620 unsigned char rsa_decrypted[PT_LEN];
bryantaylor 0:eafc3fd41f75 1621 unsigned char rsa_ciphertext[KEY_LEN];
bryantaylor 0:eafc3fd41f75 1622 #if defined(MBEDTLS_SHA1_C)
bryantaylor 0:eafc3fd41f75 1623 unsigned char sha1sum[20];
bryantaylor 0:eafc3fd41f75 1624 #endif
bryantaylor 0:eafc3fd41f75 1625
bryantaylor 0:eafc3fd41f75 1626 mbedtls_rsa_init( &rsa, MBEDTLS_RSA_PKCS_V15, 0 );
bryantaylor 0:eafc3fd41f75 1627
bryantaylor 0:eafc3fd41f75 1628 rsa.len = KEY_LEN;
bryantaylor 0:eafc3fd41f75 1629 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &rsa.N , 16, RSA_N ) );
bryantaylor 0:eafc3fd41f75 1630 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &rsa.E , 16, RSA_E ) );
bryantaylor 0:eafc3fd41f75 1631 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &rsa.D , 16, RSA_D ) );
bryantaylor 0:eafc3fd41f75 1632 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &rsa.P , 16, RSA_P ) );
bryantaylor 0:eafc3fd41f75 1633 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &rsa.Q , 16, RSA_Q ) );
bryantaylor 0:eafc3fd41f75 1634 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &rsa.DP, 16, RSA_DP ) );
bryantaylor 0:eafc3fd41f75 1635 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &rsa.DQ, 16, RSA_DQ ) );
bryantaylor 0:eafc3fd41f75 1636 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &rsa.QP, 16, RSA_QP ) );
bryantaylor 0:eafc3fd41f75 1637
bryantaylor 0:eafc3fd41f75 1638 if( verbose != 0 )
bryantaylor 0:eafc3fd41f75 1639 mbedtls_printf( " RSA key validation: " );
bryantaylor 0:eafc3fd41f75 1640
bryantaylor 0:eafc3fd41f75 1641 if( mbedtls_rsa_check_pubkey( &rsa ) != 0 ||
bryantaylor 0:eafc3fd41f75 1642 mbedtls_rsa_check_privkey( &rsa ) != 0 )
bryantaylor 0:eafc3fd41f75 1643 {
bryantaylor 0:eafc3fd41f75 1644 if( verbose != 0 )
bryantaylor 0:eafc3fd41f75 1645 mbedtls_printf( "failed\n" );
bryantaylor 0:eafc3fd41f75 1646
bryantaylor 0:eafc3fd41f75 1647 return( 1 );
bryantaylor 0:eafc3fd41f75 1648 }
bryantaylor 0:eafc3fd41f75 1649
bryantaylor 0:eafc3fd41f75 1650 if( verbose != 0 )
bryantaylor 0:eafc3fd41f75 1651 mbedtls_printf( "passed\n PKCS#1 encryption : " );
bryantaylor 0:eafc3fd41f75 1652
bryantaylor 0:eafc3fd41f75 1653 memcpy( rsa_plaintext, RSA_PT, PT_LEN );
bryantaylor 0:eafc3fd41f75 1654
bryantaylor 0:eafc3fd41f75 1655 if( mbedtls_rsa_pkcs1_encrypt( &rsa, myrand, NULL, MBEDTLS_RSA_PUBLIC, PT_LEN,
bryantaylor 0:eafc3fd41f75 1656 rsa_plaintext, rsa_ciphertext ) != 0 )
bryantaylor 0:eafc3fd41f75 1657 {
bryantaylor 0:eafc3fd41f75 1658 if( verbose != 0 )
bryantaylor 0:eafc3fd41f75 1659 mbedtls_printf( "failed\n" );
bryantaylor 0:eafc3fd41f75 1660
bryantaylor 0:eafc3fd41f75 1661 return( 1 );
bryantaylor 0:eafc3fd41f75 1662 }
bryantaylor 0:eafc3fd41f75 1663
bryantaylor 0:eafc3fd41f75 1664 if( verbose != 0 )
bryantaylor 0:eafc3fd41f75 1665 mbedtls_printf( "passed\n PKCS#1 decryption : " );
bryantaylor 0:eafc3fd41f75 1666
bryantaylor 0:eafc3fd41f75 1667 if( mbedtls_rsa_pkcs1_decrypt( &rsa, myrand, NULL, MBEDTLS_RSA_PRIVATE, &len,
bryantaylor 0:eafc3fd41f75 1668 rsa_ciphertext, rsa_decrypted,
bryantaylor 0:eafc3fd41f75 1669 sizeof(rsa_decrypted) ) != 0 )
bryantaylor 0:eafc3fd41f75 1670 {
bryantaylor 0:eafc3fd41f75 1671 if( verbose != 0 )
bryantaylor 0:eafc3fd41f75 1672 mbedtls_printf( "failed\n" );
bryantaylor 0:eafc3fd41f75 1673
bryantaylor 0:eafc3fd41f75 1674 return( 1 );
bryantaylor 0:eafc3fd41f75 1675 }
bryantaylor 0:eafc3fd41f75 1676
bryantaylor 0:eafc3fd41f75 1677 if( memcmp( rsa_decrypted, rsa_plaintext, len ) != 0 )
bryantaylor 0:eafc3fd41f75 1678 {
bryantaylor 0:eafc3fd41f75 1679 if( verbose != 0 )
bryantaylor 0:eafc3fd41f75 1680 mbedtls_printf( "failed\n" );
bryantaylor 0:eafc3fd41f75 1681
bryantaylor 0:eafc3fd41f75 1682 return( 1 );
bryantaylor 0:eafc3fd41f75 1683 }
bryantaylor 0:eafc3fd41f75 1684
bryantaylor 0:eafc3fd41f75 1685 if( verbose != 0 )
bryantaylor 0:eafc3fd41f75 1686 mbedtls_printf( "passed\n" );
bryantaylor 0:eafc3fd41f75 1687
bryantaylor 0:eafc3fd41f75 1688 #if defined(MBEDTLS_SHA1_C)
bryantaylor 0:eafc3fd41f75 1689 if( verbose != 0 )
bryantaylor 0:eafc3fd41f75 1690 mbedtls_printf( " PKCS#1 data sign : " );
bryantaylor 0:eafc3fd41f75 1691
bryantaylor 0:eafc3fd41f75 1692 mbedtls_sha1( rsa_plaintext, PT_LEN, sha1sum );
bryantaylor 0:eafc3fd41f75 1693
bryantaylor 0:eafc3fd41f75 1694 if( mbedtls_rsa_pkcs1_sign( &rsa, myrand, NULL, MBEDTLS_RSA_PRIVATE, MBEDTLS_MD_SHA1, 0,
bryantaylor 0:eafc3fd41f75 1695 sha1sum, rsa_ciphertext ) != 0 )
bryantaylor 0:eafc3fd41f75 1696 {
bryantaylor 0:eafc3fd41f75 1697 if( verbose != 0 )
bryantaylor 0:eafc3fd41f75 1698 mbedtls_printf( "failed\n" );
bryantaylor 0:eafc3fd41f75 1699
bryantaylor 0:eafc3fd41f75 1700 return( 1 );
bryantaylor 0:eafc3fd41f75 1701 }
bryantaylor 0:eafc3fd41f75 1702
bryantaylor 0:eafc3fd41f75 1703 if( verbose != 0 )
bryantaylor 0:eafc3fd41f75 1704 mbedtls_printf( "passed\n PKCS#1 sig. verify: " );
bryantaylor 0:eafc3fd41f75 1705
bryantaylor 0:eafc3fd41f75 1706 if( mbedtls_rsa_pkcs1_verify( &rsa, NULL, NULL, MBEDTLS_RSA_PUBLIC, MBEDTLS_MD_SHA1, 0,
bryantaylor 0:eafc3fd41f75 1707 sha1sum, rsa_ciphertext ) != 0 )
bryantaylor 0:eafc3fd41f75 1708 {
bryantaylor 0:eafc3fd41f75 1709 if( verbose != 0 )
bryantaylor 0:eafc3fd41f75 1710 mbedtls_printf( "failed\n" );
bryantaylor 0:eafc3fd41f75 1711
bryantaylor 0:eafc3fd41f75 1712 return( 1 );
bryantaylor 0:eafc3fd41f75 1713 }
bryantaylor 0:eafc3fd41f75 1714
bryantaylor 0:eafc3fd41f75 1715 if( verbose != 0 )
bryantaylor 0:eafc3fd41f75 1716 mbedtls_printf( "passed\n" );
bryantaylor 0:eafc3fd41f75 1717 #endif /* MBEDTLS_SHA1_C */
bryantaylor 0:eafc3fd41f75 1718
bryantaylor 0:eafc3fd41f75 1719 if( verbose != 0 )
bryantaylor 0:eafc3fd41f75 1720 mbedtls_printf( "\n" );
bryantaylor 0:eafc3fd41f75 1721
bryantaylor 0:eafc3fd41f75 1722 cleanup:
bryantaylor 0:eafc3fd41f75 1723 mbedtls_rsa_free( &rsa );
bryantaylor 0:eafc3fd41f75 1724 #else /* MBEDTLS_PKCS1_V15 */
bryantaylor 0:eafc3fd41f75 1725 ((void) verbose);
bryantaylor 0:eafc3fd41f75 1726 #endif /* MBEDTLS_PKCS1_V15 */
bryantaylor 0:eafc3fd41f75 1727 return( ret );
bryantaylor 0:eafc3fd41f75 1728 }
bryantaylor 0:eafc3fd41f75 1729
bryantaylor 0:eafc3fd41f75 1730 #endif /* MBEDTLS_SELF_TEST */
bryantaylor 0:eafc3fd41f75 1731
bryantaylor 0:eafc3fd41f75 1732 #endif /* MBEDTLS_RSA_C */