Hannes Tschofenig
Example program to test AES-GCM functionality. Used for a workshop
Embed:
(wiki syntax)
Show/hide line numbers
rsa.c
00001 /* 00002 * The RSA public-key cryptosystem 00003 * 00004 * Copyright (C) 2006-2014, Brainspark B.V. 00005 * 00006 * This file is part of PolarSSL (http://www.polarssl.org) 00007 * Lead Maintainer: Paul Bakker <polarssl_maintainer at polarssl.org> 00008 * 00009 * All rights reserved. 00010 * 00011 * This program is free software; you can redistribute it and/or modify 00012 * it under the terms of the GNU General Public License as published by 00013 * the Free Software Foundation; either version 2 of the License, or 00014 * (at your option) any later version. 00015 * 00016 * This program is distributed in the hope that it will be useful, 00017 * but WITHOUT ANY WARRANTY; without even the implied warranty of 00018 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 00019 * GNU General Public License for more details. 00020 * 00021 * You should have received a copy of the GNU General Public License along 00022 * with this program; if not, write to the Free Software Foundation, Inc., 00023 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. 00024 */ 00025 /* 00026 * RSA was designed by Ron Rivest, Adi Shamir and Len Adleman. 00027 * 00028 * http://theory.lcs.mit.edu/~rivest/rsapaper.pdf 00029 * http://www.cacr.math.uwaterloo.ca/hac/about/chap8.pdf 00030 */ 00031 00032 #if !defined(POLARSSL_CONFIG_FILE) 00033 #include "polarssl/config.h" 00034 #else 00035 #include POLARSSL_CONFIG_FILE 00036 #endif 00037 00038 #if defined(POLARSSL_RSA_C) 00039 00040 #include "polarssl/rsa.h" 00041 #include "polarssl/oid.h" 00042 00043 #if defined(POLARSSL_PKCS1_V21) 00044 #include "polarssl/md.h" 00045 #endif 00046 00047 #include <stdlib.h> 00048 #include <stdio.h> 00049 00050 #if defined(POLARSSL_PLATFORM_C) 00051 #include "polarssl/platform.h" 00052 #else 00053 #define polarssl_printf printf 00054 #endif 00055 00056 /* 00057 * Initialize an RSA context 00058 */ 00059 void rsa_init( rsa_context *ctx, 00060 int padding, 00061 int hash_id ) 00062 { 00063 memset( ctx, 0, sizeof( rsa_context ) ); 00064 00065 rsa_set_padding( ctx, padding, hash_id ); 00066 00067 #if defined(POLARSSL_THREADING_C) 00068 polarssl_mutex_init( &ctx->mutex ); 00069 #endif 00070 } 00071 00072 /* 00073 * Set padding for an existing RSA context 00074 */ 00075 void rsa_set_padding( rsa_context *ctx, int padding, int hash_id ) 00076 { 00077 ctx->padding = padding; 00078 ctx->hash_id = hash_id; 00079 } 00080 00081 #if defined(POLARSSL_GENPRIME) 00082 00083 /* 00084 * Generate an RSA keypair 00085 */ 00086 int rsa_gen_key( rsa_context *ctx, 00087 int (*f_rng)(void *, unsigned char *, size_t), 00088 void *p_rng, 00089 unsigned int nbits, int exponent ) 00090 { 00091 int ret; 00092 mpi P1, Q1, H, G; 00093 00094 if( f_rng == NULL || nbits < 128 || exponent < 3 ) 00095 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA ); 00096 00097 mpi_init( &P1 ); mpi_init( &Q1 ); mpi_init( &H ); mpi_init( &G ); 00098 00099 /* 00100 * find primes P and Q with Q < P so that: 00101 * GCD( E, (P-1)*(Q-1) ) == 1 00102 */ 00103 MPI_CHK( mpi_lset( &ctx->E , exponent ) ); 00104 00105 do 00106 { 00107 MPI_CHK( mpi_gen_prime( &ctx->P , ( nbits + 1 ) >> 1, 0, 00108 f_rng, p_rng ) ); 00109 00110 MPI_CHK( mpi_gen_prime( &ctx->Q , ( nbits + 1 ) >> 1, 0, 00111 f_rng, p_rng ) ); 00112 00113 if( mpi_cmp_mpi( &ctx->P , &ctx->Q ) < 0 ) 00114 mpi_swap( &ctx->P , &ctx->Q ); 00115 00116 if( mpi_cmp_mpi( &ctx->P , &ctx->Q ) == 0 ) 00117 continue; 00118 00119 MPI_CHK( mpi_mul_mpi( &ctx->N , &ctx->P , &ctx->Q ) ); 00120 if( mpi_msb( &ctx->N ) != nbits ) 00121 continue; 00122 00123 MPI_CHK( mpi_sub_int( &P1, &ctx->P , 1 ) ); 00124 MPI_CHK( mpi_sub_int( &Q1, &ctx->Q , 1 ) ); 00125 MPI_CHK( mpi_mul_mpi( &H, &P1, &Q1 ) ); 00126 MPI_CHK( mpi_gcd( &G, &ctx->E , &H ) ); 00127 } 00128 while( mpi_cmp_int( &G, 1 ) != 0 ); 00129 00130 /* 00131 * D = E^-1 mod ((P-1)*(Q-1)) 00132 * DP = D mod (P - 1) 00133 * DQ = D mod (Q - 1) 00134 * QP = Q^-1 mod P 00135 */ 00136 MPI_CHK( mpi_inv_mod( &ctx->D , &ctx->E , &H ) ); 00137 MPI_CHK( mpi_mod_mpi( &ctx->DP , &ctx->D , &P1 ) ); 00138 MPI_CHK( mpi_mod_mpi( &ctx->DQ , &ctx->D , &Q1 ) ); 00139 MPI_CHK( mpi_inv_mod( &ctx->QP , &ctx->Q , &ctx->P ) ); 00140 00141 ctx->len = ( mpi_msb( &ctx->N ) + 7 ) >> 3; 00142 00143 cleanup: 00144 00145 mpi_free( &P1 ); mpi_free( &Q1 ); mpi_free( &H ); mpi_free( &G ); 00146 00147 if( ret != 0 ) 00148 { 00149 rsa_free( ctx ); 00150 return( POLARSSL_ERR_RSA_KEY_GEN_FAILED + ret ); 00151 } 00152 00153 return( 0 ); 00154 } 00155 00156 #endif /* POLARSSL_GENPRIME */ 00157 00158 /* 00159 * Check a public RSA key 00160 */ 00161 int rsa_check_pubkey( const rsa_context *ctx ) 00162 { 00163 if( !ctx->N .p || !ctx->E .p ) 00164 return( POLARSSL_ERR_RSA_KEY_CHECK_FAILED ); 00165 00166 if( ( ctx->N .p [0] & 1 ) == 0 || 00167 ( ctx->E .p [0] & 1 ) == 0 ) 00168 return( POLARSSL_ERR_RSA_KEY_CHECK_FAILED ); 00169 00170 if( mpi_msb( &ctx->N ) < 128 || 00171 mpi_msb( &ctx->N ) > POLARSSL_MPI_MAX_BITS ) 00172 return( POLARSSL_ERR_RSA_KEY_CHECK_FAILED ); 00173 00174 if( mpi_msb( &ctx->E ) < 2 || 00175 mpi_cmp_mpi( &ctx->E , &ctx->N ) >= 0 ) 00176 return( POLARSSL_ERR_RSA_KEY_CHECK_FAILED ); 00177 00178 return( 0 ); 00179 } 00180 00181 /* 00182 * Check a private RSA key 00183 */ 00184 int rsa_check_privkey( const rsa_context *ctx ) 00185 { 00186 int ret; 00187 mpi PQ, DE, P1, Q1, H, I, G, G2, L1, L2, DP, DQ, QP; 00188 00189 if( ( ret = rsa_check_pubkey( ctx ) ) != 0 ) 00190 return( ret ); 00191 00192 if( !ctx->P .p || !ctx->Q .p || !ctx->D .p ) 00193 return( POLARSSL_ERR_RSA_KEY_CHECK_FAILED ); 00194 00195 mpi_init( &PQ ); mpi_init( &DE ); mpi_init( &P1 ); mpi_init( &Q1 ); 00196 mpi_init( &H ); mpi_init( &I ); mpi_init( &G ); mpi_init( &G2 ); 00197 mpi_init( &L1 ); mpi_init( &L2 ); mpi_init( &DP ); mpi_init( &DQ ); 00198 mpi_init( &QP ); 00199 00200 MPI_CHK( mpi_mul_mpi( &PQ, &ctx->P , &ctx->Q ) ); 00201 MPI_CHK( mpi_mul_mpi( &DE, &ctx->D , &ctx->E ) ); 00202 MPI_CHK( mpi_sub_int( &P1, &ctx->P , 1 ) ); 00203 MPI_CHK( mpi_sub_int( &Q1, &ctx->Q , 1 ) ); 00204 MPI_CHK( mpi_mul_mpi( &H, &P1, &Q1 ) ); 00205 MPI_CHK( mpi_gcd( &G, &ctx->E , &H ) ); 00206 00207 MPI_CHK( mpi_gcd( &G2, &P1, &Q1 ) ); 00208 MPI_CHK( mpi_div_mpi( &L1, &L2, &H, &G2 ) ); 00209 MPI_CHK( mpi_mod_mpi( &I, &DE, &L1 ) ); 00210 00211 MPI_CHK( mpi_mod_mpi( &DP, &ctx->D , &P1 ) ); 00212 MPI_CHK( mpi_mod_mpi( &DQ, &ctx->D , &Q1 ) ); 00213 MPI_CHK( mpi_inv_mod( &QP, &ctx->Q , &ctx->P ) ); 00214 /* 00215 * Check for a valid PKCS1v2 private key 00216 */ 00217 if( mpi_cmp_mpi( &PQ, &ctx->N ) != 0 || 00218 mpi_cmp_mpi( &DP, &ctx->DP ) != 0 || 00219 mpi_cmp_mpi( &DQ, &ctx->DQ ) != 0 || 00220 mpi_cmp_mpi( &QP, &ctx->QP ) != 0 || 00221 mpi_cmp_int( &L2, 0 ) != 0 || 00222 mpi_cmp_int( &I, 1 ) != 0 || 00223 mpi_cmp_int( &G, 1 ) != 0 ) 00224 { 00225 ret = POLARSSL_ERR_RSA_KEY_CHECK_FAILED; 00226 } 00227 00228 cleanup: 00229 mpi_free( &PQ ); mpi_free( &DE ); mpi_free( &P1 ); mpi_free( &Q1 ); 00230 mpi_free( &H ); mpi_free( &I ); mpi_free( &G ); mpi_free( &G2 ); 00231 mpi_free( &L1 ); mpi_free( &L2 ); mpi_free( &DP ); mpi_free( &DQ ); 00232 mpi_free( &QP ); 00233 00234 if( ret == POLARSSL_ERR_RSA_KEY_CHECK_FAILED ) 00235 return( ret ); 00236 00237 if( ret != 0 ) 00238 return( POLARSSL_ERR_RSA_KEY_CHECK_FAILED + ret ); 00239 00240 return( 0 ); 00241 } 00242 00243 /* 00244 * Do an RSA public key operation 00245 */ 00246 int rsa_public( rsa_context *ctx, 00247 const unsigned char *input, 00248 unsigned char *output ) 00249 { 00250 int ret; 00251 size_t olen; 00252 mpi T; 00253 00254 mpi_init( &T ); 00255 00256 MPI_CHK( mpi_read_binary( &T, input, ctx->len ) ); 00257 00258 if( mpi_cmp_mpi( &T, &ctx->N ) >= 0 ) 00259 { 00260 mpi_free( &T ); 00261 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA ); 00262 } 00263 00264 olen = ctx->len ; 00265 MPI_CHK( mpi_exp_mod( &T, &T, &ctx->E , &ctx->N , &ctx->RN ) ); 00266 MPI_CHK( mpi_write_binary( &T, output, olen ) ); 00267 00268 cleanup: 00269 00270 mpi_free( &T ); 00271 00272 if( ret != 0 ) 00273 return( POLARSSL_ERR_RSA_PUBLIC_FAILED + ret ); 00274 00275 return( 0 ); 00276 } 00277 00278 #if !defined(POLARSSL_RSA_NO_CRT) 00279 /* 00280 * Generate or update blinding values, see section 10 of: 00281 * KOCHER, Paul C. Timing attacks on implementations of Diffie-Hellman, RSA, 00282 * DSS, and other systems. In : Advances in Cryptology—CRYPTO’96. Springer 00283 * Berlin Heidelberg, 1996. p. 104-113. 00284 */ 00285 static int rsa_prepare_blinding( rsa_context *ctx, mpi *Vi, mpi *Vf, 00286 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng ) 00287 { 00288 int ret, count = 0; 00289 00290 #if defined(POLARSSL_THREADING_C) 00291 polarssl_mutex_lock( &ctx->mutex ); 00292 #endif 00293 00294 if( ctx->Vf .p != NULL ) 00295 { 00296 /* We already have blinding values, just update them by squaring */ 00297 MPI_CHK( mpi_mul_mpi( &ctx->Vi , &ctx->Vi , &ctx->Vi ) ); 00298 MPI_CHK( mpi_mod_mpi( &ctx->Vi , &ctx->Vi , &ctx->N ) ); 00299 MPI_CHK( mpi_mul_mpi( &ctx->Vf , &ctx->Vf , &ctx->Vf ) ); 00300 MPI_CHK( mpi_mod_mpi( &ctx->Vf , &ctx->Vf , &ctx->N ) ); 00301 00302 goto done; 00303 } 00304 00305 /* Unblinding value: Vf = random number, invertible mod N */ 00306 do { 00307 if( count++ > 10 ) 00308 return( POLARSSL_ERR_RSA_RNG_FAILED ); 00309 00310 MPI_CHK( mpi_fill_random( &ctx->Vf , ctx->len - 1, f_rng, p_rng ) ); 00311 MPI_CHK( mpi_gcd( &ctx->Vi , &ctx->Vf , &ctx->N ) ); 00312 } while( mpi_cmp_int( &ctx->Vi , 1 ) != 0 ); 00313 00314 /* Blinding value: Vi = Vf^(-e) mod N */ 00315 MPI_CHK( mpi_inv_mod( &ctx->Vi , &ctx->Vf , &ctx->N ) ); 00316 MPI_CHK( mpi_exp_mod( &ctx->Vi , &ctx->Vi , &ctx->E , &ctx->N , &ctx->RN ) ); 00317 00318 done: 00319 if( Vi != &ctx->Vi ) 00320 { 00321 MPI_CHK( mpi_copy( Vi, &ctx->Vi ) ); 00322 MPI_CHK( mpi_copy( Vf, &ctx->Vf ) ); 00323 } 00324 00325 cleanup: 00326 #if defined(POLARSSL_THREADING_C) 00327 polarssl_mutex_unlock( &ctx->mutex ); 00328 #endif 00329 00330 return( ret ); 00331 } 00332 #endif /* !POLARSSL_RSA_NO_CRT */ 00333 00334 /* 00335 * Do an RSA private key operation 00336 */ 00337 int rsa_private( rsa_context *ctx, 00338 int (*f_rng)(void *, unsigned char *, size_t), 00339 void *p_rng, 00340 const unsigned char *input, 00341 unsigned char *output ) 00342 { 00343 int ret; 00344 size_t olen; 00345 mpi T, T1, T2; 00346 #if !defined(POLARSSL_RSA_NO_CRT) 00347 mpi *Vi, *Vf; 00348 00349 /* 00350 * When using the Chinese Remainder Theorem, we use blinding values. 00351 * Without threading, we just read them directly from the context, 00352 * otherwise we make a local copy in order to reduce locking contention. 00353 */ 00354 #if defined(POLARSSL_THREADING_C) 00355 mpi Vi_copy, Vf_copy; 00356 00357 mpi_init( &Vi_copy ); mpi_init( &Vf_copy ); 00358 Vi = &Vi_copy; 00359 Vf = &Vf_copy; 00360 #else 00361 Vi = &ctx->Vi ; 00362 Vf = &ctx->Vf ; 00363 #endif 00364 #endif /* !POLARSSL_RSA_NO_CRT */ 00365 00366 mpi_init( &T ); mpi_init( &T1 ); mpi_init( &T2 ); 00367 00368 MPI_CHK( mpi_read_binary( &T, input, ctx->len ) ); 00369 if( mpi_cmp_mpi( &T, &ctx->N ) >= 0 ) 00370 { 00371 mpi_free( &T ); 00372 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA ); 00373 } 00374 00375 #if defined(POLARSSL_RSA_NO_CRT) 00376 ((void) f_rng); 00377 ((void) p_rng); 00378 MPI_CHK( mpi_exp_mod( &T, &T, &ctx->D , &ctx->N , &ctx->RN ) ); 00379 #else 00380 if( f_rng != NULL ) 00381 { 00382 /* 00383 * Blinding 00384 * T = T * Vi mod N 00385 */ 00386 MPI_CHK( rsa_prepare_blinding( ctx, Vi, Vf, f_rng, p_rng ) ); 00387 MPI_CHK( mpi_mul_mpi( &T, &T, Vi ) ); 00388 MPI_CHK( mpi_mod_mpi( &T, &T, &ctx->N ) ); 00389 } 00390 00391 /* 00392 * faster decryption using the CRT 00393 * 00394 * T1 = input ^ dP mod P 00395 * T2 = input ^ dQ mod Q 00396 */ 00397 MPI_CHK( mpi_exp_mod( &T1, &T, &ctx->DP , &ctx->P , &ctx->RP ) ); 00398 MPI_CHK( mpi_exp_mod( &T2, &T, &ctx->DQ , &ctx->Q , &ctx->RQ ) ); 00399 00400 /* 00401 * T = (T1 - T2) * (Q^-1 mod P) mod P 00402 */ 00403 MPI_CHK( mpi_sub_mpi( &T, &T1, &T2 ) ); 00404 MPI_CHK( mpi_mul_mpi( &T1, &T, &ctx->QP ) ); 00405 MPI_CHK( mpi_mod_mpi( &T, &T1, &ctx->P ) ); 00406 00407 /* 00408 * T = T2 + T * Q 00409 */ 00410 MPI_CHK( mpi_mul_mpi( &T1, &T, &ctx->Q ) ); 00411 MPI_CHK( mpi_add_mpi( &T, &T2, &T1 ) ); 00412 00413 if( f_rng != NULL ) 00414 { 00415 /* 00416 * Unblind 00417 * T = T * Vf mod N 00418 */ 00419 MPI_CHK( mpi_mul_mpi( &T, &T, Vf ) ); 00420 MPI_CHK( mpi_mod_mpi( &T, &T, &ctx->N ) ); 00421 } 00422 #endif /* POLARSSL_RSA_NO_CRT */ 00423 00424 olen = ctx->len ; 00425 MPI_CHK( mpi_write_binary( &T, output, olen ) ); 00426 00427 cleanup: 00428 mpi_free( &T ); mpi_free( &T1 ); mpi_free( &T2 ); 00429 #if !defined(POLARSSL_RSA_NO_CRT) && defined(POLARSSL_THREADING_C) 00430 mpi_free( &Vi_copy ); mpi_free( &Vf_copy ); 00431 #endif 00432 00433 if( ret != 0 ) 00434 return( POLARSSL_ERR_RSA_PRIVATE_FAILED + ret ); 00435 00436 return( 0 ); 00437 } 00438 00439 #if defined(POLARSSL_PKCS1_V21) 00440 /** 00441 * Generate and apply the MGF1 operation (from PKCS#1 v2.1) to a buffer. 00442 * 00443 * \param dst buffer to mask 00444 * \param dlen length of destination buffer 00445 * \param src source of the mask generation 00446 * \param slen length of the source buffer 00447 * \param md_ctx message digest context to use 00448 */ 00449 static void mgf_mask( unsigned char *dst, size_t dlen, unsigned char *src, 00450 size_t slen, md_context_t *md_ctx ) 00451 { 00452 unsigned char mask[POLARSSL_MD_MAX_SIZE]; 00453 unsigned char counter[4]; 00454 unsigned char *p; 00455 unsigned int hlen; 00456 size_t i, use_len; 00457 00458 memset( mask, 0, POLARSSL_MD_MAX_SIZE ); 00459 memset( counter, 0, 4 ); 00460 00461 hlen = md_ctx->md_info->size; 00462 00463 // Generate and apply dbMask 00464 // 00465 p = dst; 00466 00467 while( dlen > 0 ) 00468 { 00469 use_len = hlen; 00470 if( dlen < hlen ) 00471 use_len = dlen; 00472 00473 md_starts( md_ctx ); 00474 md_update( md_ctx, src, slen ); 00475 md_update( md_ctx, counter, 4 ); 00476 md_finish( md_ctx, mask ); 00477 00478 for( i = 0; i < use_len; ++i ) 00479 *p++ ^= mask[i]; 00480 00481 counter[3]++; 00482 00483 dlen -= use_len; 00484 } 00485 } 00486 #endif /* POLARSSL_PKCS1_V21 */ 00487 00488 #if defined(POLARSSL_PKCS1_V21) 00489 /* 00490 * Implementation of the PKCS#1 v2.1 RSAES-OAEP-ENCRYPT function 00491 */ 00492 int rsa_rsaes_oaep_encrypt( rsa_context *ctx, 00493 int (*f_rng)(void *, unsigned char *, size_t), 00494 void *p_rng, 00495 int mode, 00496 const unsigned char *label, size_t label_len, 00497 size_t ilen, 00498 const unsigned char *input, 00499 unsigned char *output ) 00500 { 00501 size_t olen; 00502 int ret; 00503 unsigned char *p = output; 00504 unsigned int hlen; 00505 const md_info_t *md_info; 00506 md_context_t md_ctx; 00507 00508 if( ctx->padding != RSA_PKCS_V21 || f_rng == NULL ) 00509 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA ); 00510 00511 md_info = md_info_from_type( ctx->hash_id ); 00512 if( md_info == NULL ) 00513 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA ); 00514 00515 olen = ctx->len ; 00516 hlen = md_get_size( md_info ); 00517 00518 if( olen < ilen + 2 * hlen + 2 || f_rng == NULL ) 00519 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA ); 00520 00521 memset( output, 0, olen ); 00522 00523 *p++ = 0; 00524 00525 // Generate a random octet string seed 00526 // 00527 if( ( ret = f_rng( p_rng, p, hlen ) ) != 0 ) 00528 return( POLARSSL_ERR_RSA_RNG_FAILED + ret ); 00529 00530 p += hlen; 00531 00532 // Construct DB 00533 // 00534 md( md_info, label, label_len, p ); 00535 p += hlen; 00536 p += olen - 2 * hlen - 2 - ilen; 00537 *p++ = 1; 00538 memcpy( p, input, ilen ); 00539 00540 md_init_ctx( &md_ctx, md_info ); 00541 00542 // maskedDB: Apply dbMask to DB 00543 // 00544 mgf_mask( output + hlen + 1, olen - hlen - 1, output + 1, hlen, 00545 &md_ctx ); 00546 00547 // maskedSeed: Apply seedMask to seed 00548 // 00549 mgf_mask( output + 1, hlen, output + hlen + 1, olen - hlen - 1, 00550 &md_ctx ); 00551 00552 md_free_ctx( &md_ctx ); 00553 00554 return( ( mode == RSA_PUBLIC ) 00555 ? rsa_public( ctx, output, output ) 00556 : rsa_private( ctx, f_rng, p_rng, output, output ) ); 00557 } 00558 #endif /* POLARSSL_PKCS1_V21 */ 00559 00560 #if defined(POLARSSL_PKCS1_V15) 00561 /* 00562 * Implementation of the PKCS#1 v2.1 RSAES-PKCS1-V1_5-ENCRYPT function 00563 */ 00564 int rsa_rsaes_pkcs1_v15_encrypt( rsa_context *ctx, 00565 int (*f_rng)(void *, unsigned char *, size_t), 00566 void *p_rng, 00567 int mode, size_t ilen, 00568 const unsigned char *input, 00569 unsigned char *output ) 00570 { 00571 size_t nb_pad, olen; 00572 int ret; 00573 unsigned char *p = output; 00574 00575 if( ctx->padding != RSA_PKCS_V15 || f_rng == NULL ) 00576 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA ); 00577 00578 olen = ctx->len ; 00579 00580 if( olen < ilen + 11 ) 00581 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA ); 00582 00583 nb_pad = olen - 3 - ilen; 00584 00585 *p++ = 0; 00586 if( mode == RSA_PUBLIC ) 00587 { 00588 *p++ = RSA_CRYPT; 00589 00590 while( nb_pad-- > 0 ) 00591 { 00592 int rng_dl = 100; 00593 00594 do { 00595 ret = f_rng( p_rng, p, 1 ); 00596 } while( *p == 0 && --rng_dl && ret == 0 ); 00597 00598 // Check if RNG failed to generate data 00599 // 00600 if( rng_dl == 0 || ret != 0) 00601 return POLARSSL_ERR_RSA_RNG_FAILED + ret; 00602 00603 p++; 00604 } 00605 } 00606 else 00607 { 00608 *p++ = RSA_SIGN; 00609 00610 while( nb_pad-- > 0 ) 00611 *p++ = 0xFF; 00612 } 00613 00614 *p++ = 0; 00615 memcpy( p, input, ilen ); 00616 00617 return( ( mode == RSA_PUBLIC ) 00618 ? rsa_public( ctx, output, output ) 00619 : rsa_private( ctx, f_rng, p_rng, output, output ) ); 00620 } 00621 #endif /* POLARSSL_PKCS1_V15 */ 00622 00623 /* 00624 * Add the message padding, then do an RSA operation 00625 */ 00626 int rsa_pkcs1_encrypt( rsa_context *ctx, 00627 int (*f_rng)(void *, unsigned char *, size_t), 00628 void *p_rng, 00629 int mode, size_t ilen, 00630 const unsigned char *input, 00631 unsigned char *output ) 00632 { 00633 switch( ctx->padding ) 00634 { 00635 #if defined(POLARSSL_PKCS1_V15) 00636 case RSA_PKCS_V15: 00637 return rsa_rsaes_pkcs1_v15_encrypt( ctx, f_rng, p_rng, mode, ilen, 00638 input, output ); 00639 #endif 00640 00641 #if defined(POLARSSL_PKCS1_V21) 00642 case RSA_PKCS_V21: 00643 return rsa_rsaes_oaep_encrypt( ctx, f_rng, p_rng, mode, NULL, 0, 00644 ilen, input, output ); 00645 #endif 00646 00647 default: 00648 return( POLARSSL_ERR_RSA_INVALID_PADDING ); 00649 } 00650 } 00651 00652 #if defined(POLARSSL_PKCS1_V21) 00653 /* 00654 * Implementation of the PKCS#1 v2.1 RSAES-OAEP-DECRYPT function 00655 */ 00656 int rsa_rsaes_oaep_decrypt( rsa_context *ctx, 00657 int (*f_rng)(void *, unsigned char *, size_t), 00658 void *p_rng, 00659 int mode, 00660 const unsigned char *label, size_t label_len, 00661 size_t *olen, 00662 const unsigned char *input, 00663 unsigned char *output, 00664 size_t output_max_len ) 00665 { 00666 int ret; 00667 size_t ilen, i, pad_len; 00668 unsigned char *p, bad, pad_done; 00669 unsigned char buf[POLARSSL_MPI_MAX_SIZE]; 00670 unsigned char lhash[POLARSSL_MD_MAX_SIZE]; 00671 unsigned int hlen; 00672 const md_info_t *md_info; 00673 md_context_t md_ctx; 00674 00675 /* 00676 * Parameters sanity checks 00677 */ 00678 if( ctx->padding != RSA_PKCS_V21 ) 00679 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA ); 00680 00681 ilen = ctx->len ; 00682 00683 if( ilen < 16 || ilen > sizeof( buf ) ) 00684 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA ); 00685 00686 md_info = md_info_from_type( ctx->hash_id ); 00687 if( md_info == NULL ) 00688 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA ); 00689 00690 /* 00691 * RSA operation 00692 */ 00693 ret = ( mode == RSA_PUBLIC ) 00694 ? rsa_public( ctx, input, buf ) 00695 : rsa_private( ctx, f_rng, p_rng, input, buf ); 00696 00697 if( ret != 0 ) 00698 return( ret ); 00699 00700 /* 00701 * Unmask data and generate lHash 00702 */ 00703 hlen = md_get_size( md_info ); 00704 00705 md_init_ctx( &md_ctx, md_info ); 00706 00707 /* Generate lHash */ 00708 md( md_info, label, label_len, lhash ); 00709 00710 /* seed: Apply seedMask to maskedSeed */ 00711 mgf_mask( buf + 1, hlen, buf + hlen + 1, ilen - hlen - 1, 00712 &md_ctx ); 00713 00714 /* DB: Apply dbMask to maskedDB */ 00715 mgf_mask( buf + hlen + 1, ilen - hlen - 1, buf + 1, hlen, 00716 &md_ctx ); 00717 00718 md_free_ctx( &md_ctx ); 00719 00720 /* 00721 * Check contents, in "constant-time" 00722 */ 00723 p = buf; 00724 bad = 0; 00725 00726 bad |= *p++; /* First byte must be 0 */ 00727 00728 p += hlen; /* Skip seed */ 00729 00730 /* Check lHash */ 00731 for( i = 0; i < hlen; i++ ) 00732 bad |= lhash[i] ^ *p++; 00733 00734 /* Get zero-padding len, but always read till end of buffer 00735 * (minus one, for the 01 byte) */ 00736 pad_len = 0; 00737 pad_done = 0; 00738 for( i = 0; i < ilen - 2 * hlen - 2; i++ ) 00739 { 00740 pad_done |= p[i]; 00741 pad_len += ( pad_done == 0 ); 00742 } 00743 00744 p += pad_len; 00745 bad |= *p++ ^ 0x01; 00746 00747 /* 00748 * The only information "leaked" is whether the padding was correct or not 00749 * (eg, no data is copied if it was not correct). This meets the 00750 * recommendations in PKCS#1 v2.2: an opponent cannot distinguish between 00751 * the different error conditions. 00752 */ 00753 if( bad != 0 ) 00754 return( POLARSSL_ERR_RSA_INVALID_PADDING ); 00755 00756 if (ilen - (p - buf) > output_max_len) 00757 return( POLARSSL_ERR_RSA_OUTPUT_TOO_LARGE ); 00758 00759 *olen = ilen - (p - buf); 00760 memcpy( output, p, *olen ); 00761 00762 return( 0 ); 00763 } 00764 #endif /* POLARSSL_PKCS1_V21 */ 00765 00766 #if defined(POLARSSL_PKCS1_V15) 00767 /* 00768 * Implementation of the PKCS#1 v2.1 RSAES-PKCS1-V1_5-DECRYPT function 00769 */ 00770 int rsa_rsaes_pkcs1_v15_decrypt( rsa_context *ctx, 00771 int (*f_rng)(void *, unsigned char *, size_t), 00772 void *p_rng, 00773 int mode, size_t *olen, 00774 const unsigned char *input, 00775 unsigned char *output, 00776 size_t output_max_len) 00777 { 00778 int ret; 00779 size_t ilen, pad_count = 0, i; 00780 unsigned char *p, bad, pad_done = 0; 00781 unsigned char buf[POLARSSL_MPI_MAX_SIZE]; 00782 00783 if( ctx->padding != RSA_PKCS_V15 ) 00784 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA ); 00785 00786 ilen = ctx->len ; 00787 00788 if( ilen < 16 || ilen > sizeof( buf ) ) 00789 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA ); 00790 00791 ret = ( mode == RSA_PUBLIC ) 00792 ? rsa_public( ctx, input, buf ) 00793 : rsa_private( ctx, f_rng, p_rng, input, buf ); 00794 00795 if( ret != 0 ) 00796 return( ret ); 00797 00798 p = buf; 00799 bad = 0; 00800 00801 /* 00802 * Check and get padding len in "constant-time" 00803 */ 00804 bad |= *p++; /* First byte must be 0 */ 00805 00806 /* This test does not depend on secret data */ 00807 if( mode == RSA_PRIVATE ) 00808 { 00809 bad |= *p++ ^ RSA_CRYPT; 00810 00811 /* Get padding len, but always read till end of buffer 00812 * (minus one, for the 00 byte) */ 00813 for( i = 0; i < ilen - 3; i++ ) 00814 { 00815 pad_done |= ( p[i] == 0 ); 00816 pad_count += ( pad_done == 0 ); 00817 } 00818 00819 p += pad_count; 00820 bad |= *p++; /* Must be zero */ 00821 } 00822 else 00823 { 00824 bad |= *p++ ^ RSA_SIGN; 00825 00826 /* Get padding len, but always read till end of buffer 00827 * (minus one, for the 00 byte) */ 00828 for( i = 0; i < ilen - 3; i++ ) 00829 { 00830 pad_done |= ( p[i] != 0xFF ); 00831 pad_count += ( pad_done == 0 ); 00832 } 00833 00834 p += pad_count; 00835 bad |= *p++; /* Must be zero */ 00836 } 00837 00838 if( bad ) 00839 return( POLARSSL_ERR_RSA_INVALID_PADDING ); 00840 00841 if (ilen - (p - buf) > output_max_len) 00842 return( POLARSSL_ERR_RSA_OUTPUT_TOO_LARGE ); 00843 00844 *olen = ilen - (p - buf); 00845 memcpy( output, p, *olen ); 00846 00847 return( 0 ); 00848 } 00849 #endif /* POLARSSL_PKCS1_V15 */ 00850 00851 /* 00852 * Do an RSA operation, then remove the message padding 00853 */ 00854 int rsa_pkcs1_decrypt( rsa_context *ctx, 00855 int (*f_rng)(void *, unsigned char *, size_t), 00856 void *p_rng, 00857 int mode, size_t *olen, 00858 const unsigned char *input, 00859 unsigned char *output, 00860 size_t output_max_len) 00861 { 00862 switch( ctx->padding ) 00863 { 00864 #if defined(POLARSSL_PKCS1_V15) 00865 case RSA_PKCS_V15: 00866 return rsa_rsaes_pkcs1_v15_decrypt( ctx, f_rng, p_rng, mode, olen, 00867 input, output, output_max_len ); 00868 #endif 00869 00870 #if defined(POLARSSL_PKCS1_V21) 00871 case RSA_PKCS_V21: 00872 return rsa_rsaes_oaep_decrypt( ctx, f_rng, p_rng, mode, NULL, 0, 00873 olen, input, output, 00874 output_max_len ); 00875 #endif 00876 00877 default: 00878 return( POLARSSL_ERR_RSA_INVALID_PADDING ); 00879 } 00880 } 00881 00882 #if defined(POLARSSL_PKCS1_V21) 00883 /* 00884 * Implementation of the PKCS#1 v2.1 RSASSA-PSS-SIGN function 00885 */ 00886 int rsa_rsassa_pss_sign( rsa_context *ctx, 00887 int (*f_rng)(void *, unsigned char *, size_t), 00888 void *p_rng, 00889 int mode, 00890 md_type_t md_alg, 00891 unsigned int hashlen, 00892 const unsigned char *hash, 00893 unsigned char *sig ) 00894 { 00895 size_t olen; 00896 unsigned char *p = sig; 00897 unsigned char salt[POLARSSL_MD_MAX_SIZE]; 00898 unsigned int slen, hlen, offset = 0; 00899 int ret; 00900 size_t msb; 00901 const md_info_t *md_info; 00902 md_context_t md_ctx; 00903 00904 if( ctx->padding != RSA_PKCS_V21 || f_rng == NULL ) 00905 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA ); 00906 00907 olen = ctx->len ; 00908 00909 if( md_alg != POLARSSL_MD_NONE ) 00910 { 00911 // Gather length of hash to sign 00912 // 00913 md_info = md_info_from_type( md_alg ); 00914 if( md_info == NULL ) 00915 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA ); 00916 00917 hashlen = md_get_size( md_info ); 00918 } 00919 00920 md_info = md_info_from_type( ctx->hash_id ); 00921 if( md_info == NULL ) 00922 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA ); 00923 00924 hlen = md_get_size( md_info ); 00925 slen = hlen; 00926 00927 if( olen < hlen + slen + 2 ) 00928 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA ); 00929 00930 memset( sig, 0, olen ); 00931 00932 // Generate salt of length slen 00933 // 00934 if( ( ret = f_rng( p_rng, salt, slen ) ) != 0 ) 00935 return( POLARSSL_ERR_RSA_RNG_FAILED + ret ); 00936 00937 // Note: EMSA-PSS encoding is over the length of N - 1 bits 00938 // 00939 msb = mpi_msb( &ctx->N ) - 1; 00940 p += olen - hlen * 2 - 2; 00941 *p++ = 0x01; 00942 memcpy( p, salt, slen ); 00943 p += slen; 00944 00945 md_init_ctx( &md_ctx, md_info ); 00946 00947 // Generate H = Hash( M' ) 00948 // 00949 md_starts( &md_ctx ); 00950 md_update( &md_ctx, p, 8 ); 00951 md_update( &md_ctx, hash, hashlen ); 00952 md_update( &md_ctx, salt, slen ); 00953 md_finish( &md_ctx, p ); 00954 00955 // Compensate for boundary condition when applying mask 00956 // 00957 if( msb % 8 == 0 ) 00958 offset = 1; 00959 00960 // maskedDB: Apply dbMask to DB 00961 // 00962 mgf_mask( sig + offset, olen - hlen - 1 - offset, p, hlen, &md_ctx ); 00963 00964 md_free_ctx( &md_ctx ); 00965 00966 msb = mpi_msb( &ctx->N ) - 1; 00967 sig[0] &= 0xFF >> ( olen * 8 - msb ); 00968 00969 p += hlen; 00970 *p++ = 0xBC; 00971 00972 return( ( mode == RSA_PUBLIC ) 00973 ? rsa_public( ctx, sig, sig ) 00974 : rsa_private( ctx, f_rng, p_rng, sig, sig ) ); 00975 } 00976 #endif /* POLARSSL_PKCS1_V21 */ 00977 00978 #if defined(POLARSSL_PKCS1_V15) 00979 /* 00980 * Implementation of the PKCS#1 v2.1 RSASSA-PKCS1-V1_5-SIGN function 00981 */ 00982 /* 00983 * Do an RSA operation to sign the message digest 00984 */ 00985 int rsa_rsassa_pkcs1_v15_sign( rsa_context *ctx, 00986 int (*f_rng)(void *, unsigned char *, size_t), 00987 void *p_rng, 00988 int mode, 00989 md_type_t md_alg, 00990 unsigned int hashlen, 00991 const unsigned char *hash, 00992 unsigned char *sig ) 00993 { 00994 size_t nb_pad, olen, oid_size = 0; 00995 unsigned char *p = sig; 00996 const char *oid; 00997 00998 if( ctx->padding != RSA_PKCS_V15 ) 00999 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA ); 01000 01001 olen = ctx->len ; 01002 nb_pad = olen - 3; 01003 01004 if( md_alg != POLARSSL_MD_NONE ) 01005 { 01006 const md_info_t *md_info = md_info_from_type( md_alg ); 01007 if( md_info == NULL ) 01008 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA ); 01009 01010 if( oid_get_oid_by_md( md_alg, &oid, &oid_size ) != 0 ) 01011 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA ); 01012 01013 nb_pad -= 10 + oid_size; 01014 01015 hashlen = md_get_size( md_info ); 01016 } 01017 01018 nb_pad -= hashlen; 01019 01020 if( ( nb_pad < 8 ) || ( nb_pad > olen ) ) 01021 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA ); 01022 01023 *p++ = 0; 01024 *p++ = RSA_SIGN; 01025 memset( p, 0xFF, nb_pad ); 01026 p += nb_pad; 01027 *p++ = 0; 01028 01029 if( md_alg == POLARSSL_MD_NONE ) 01030 { 01031 memcpy( p, hash, hashlen ); 01032 } 01033 else 01034 { 01035 /* 01036 * DigestInfo ::= SEQUENCE { 01037 * digestAlgorithm DigestAlgorithmIdentifier, 01038 * digest Digest } 01039 * 01040 * DigestAlgorithmIdentifier ::= AlgorithmIdentifier 01041 * 01042 * Digest ::= OCTET STRING 01043 */ 01044 *p++ = ASN1_SEQUENCE | ASN1_CONSTRUCTED; 01045 *p++ = (unsigned char) ( 0x08 + oid_size + hashlen ); 01046 *p++ = ASN1_SEQUENCE | ASN1_CONSTRUCTED; 01047 *p++ = (unsigned char) ( 0x04 + oid_size ); 01048 *p++ = ASN1_OID; 01049 *p++ = oid_size & 0xFF; 01050 memcpy( p, oid, oid_size ); 01051 p += oid_size; 01052 *p++ = ASN1_NULL; 01053 *p++ = 0x00; 01054 *p++ = ASN1_OCTET_STRING; 01055 *p++ = hashlen; 01056 memcpy( p, hash, hashlen ); 01057 } 01058 01059 return( ( mode == RSA_PUBLIC ) 01060 ? rsa_public( ctx, sig, sig ) 01061 : rsa_private( ctx, f_rng, p_rng, sig, sig ) ); 01062 } 01063 #endif /* POLARSSL_PKCS1_V15 */ 01064 01065 /* 01066 * Do an RSA operation to sign the message digest 01067 */ 01068 int rsa_pkcs1_sign( rsa_context *ctx, 01069 int (*f_rng)(void *, unsigned char *, size_t), 01070 void *p_rng, 01071 int mode, 01072 md_type_t md_alg, 01073 unsigned int hashlen, 01074 const unsigned char *hash, 01075 unsigned char *sig ) 01076 { 01077 switch( ctx->padding ) 01078 { 01079 #if defined(POLARSSL_PKCS1_V15) 01080 case RSA_PKCS_V15: 01081 return rsa_rsassa_pkcs1_v15_sign( ctx, f_rng, p_rng, mode, md_alg, 01082 hashlen, hash, sig ); 01083 #endif 01084 01085 #if defined(POLARSSL_PKCS1_V21) 01086 case RSA_PKCS_V21: 01087 return rsa_rsassa_pss_sign( ctx, f_rng, p_rng, mode, md_alg, 01088 hashlen, hash, sig ); 01089 #endif 01090 01091 default: 01092 return( POLARSSL_ERR_RSA_INVALID_PADDING ); 01093 } 01094 } 01095 01096 #if defined(POLARSSL_PKCS1_V21) 01097 /* 01098 * Implementation of the PKCS#1 v2.1 RSASSA-PSS-VERIFY function 01099 */ 01100 int rsa_rsassa_pss_verify( rsa_context *ctx, 01101 int (*f_rng)(void *, unsigned char *, size_t), 01102 void *p_rng, 01103 int mode, 01104 md_type_t md_alg, 01105 unsigned int hashlen, 01106 const unsigned char *hash, 01107 const unsigned char *sig ) 01108 { 01109 int ret; 01110 size_t siglen; 01111 unsigned char *p; 01112 unsigned char buf[POLARSSL_MPI_MAX_SIZE]; 01113 unsigned char result[POLARSSL_MD_MAX_SIZE]; 01114 unsigned char zeros[8]; 01115 unsigned int hlen; 01116 size_t slen, msb; 01117 const md_info_t *md_info; 01118 md_context_t md_ctx; 01119 01120 if( ctx->padding != RSA_PKCS_V21 ) 01121 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA ); 01122 01123 siglen = ctx->len ; 01124 01125 if( siglen < 16 || siglen > sizeof( buf ) ) 01126 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA ); 01127 01128 ret = ( mode == RSA_PUBLIC ) 01129 ? rsa_public( ctx, sig, buf ) 01130 : rsa_private( ctx, f_rng, p_rng, sig, buf ); 01131 01132 if( ret != 0 ) 01133 return( ret ); 01134 01135 p = buf; 01136 01137 if( buf[siglen - 1] != 0xBC ) 01138 return( POLARSSL_ERR_RSA_INVALID_PADDING ); 01139 01140 if( md_alg != POLARSSL_MD_NONE ) 01141 { 01142 // Gather length of hash to sign 01143 // 01144 md_info = md_info_from_type( md_alg ); 01145 if( md_info == NULL ) 01146 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA ); 01147 01148 hashlen = md_get_size( md_info ); 01149 } 01150 01151 md_info = md_info_from_type( ctx->hash_id ); 01152 if( md_info == NULL ) 01153 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA ); 01154 01155 hlen = md_get_size( md_info ); 01156 slen = siglen - hlen - 1; 01157 01158 memset( zeros, 0, 8 ); 01159 01160 // Note: EMSA-PSS verification is over the length of N - 1 bits 01161 // 01162 msb = mpi_msb( &ctx->N ) - 1; 01163 01164 // Compensate for boundary condition when applying mask 01165 // 01166 if( msb % 8 == 0 ) 01167 { 01168 p++; 01169 siglen -= 1; 01170 } 01171 if( buf[0] >> ( 8 - siglen * 8 + msb ) ) 01172 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA ); 01173 01174 md_init_ctx( &md_ctx, md_info ); 01175 01176 mgf_mask( p, siglen - hlen - 1, p + siglen - hlen - 1, hlen, &md_ctx ); 01177 01178 buf[0] &= 0xFF >> ( siglen * 8 - msb ); 01179 01180 while( p < buf + siglen && *p == 0 ) 01181 p++; 01182 01183 if( p == buf + siglen || 01184 *p++ != 0x01 ) 01185 { 01186 md_free_ctx( &md_ctx ); 01187 return( POLARSSL_ERR_RSA_INVALID_PADDING ); 01188 } 01189 01190 slen -= p - buf; 01191 01192 // Generate H = Hash( M' ) 01193 // 01194 md_starts( &md_ctx ); 01195 md_update( &md_ctx, zeros, 8 ); 01196 md_update( &md_ctx, hash, hashlen ); 01197 md_update( &md_ctx, p, slen ); 01198 md_finish( &md_ctx, result ); 01199 01200 md_free_ctx( &md_ctx ); 01201 01202 if( memcmp( p + slen, result, hlen ) == 0 ) 01203 return( 0 ); 01204 else 01205 return( POLARSSL_ERR_RSA_VERIFY_FAILED ); 01206 } 01207 #endif /* POLARSSL_PKCS1_V21 */ 01208 01209 #if defined(POLARSSL_PKCS1_V15) 01210 /* 01211 * Implementation of the PKCS#1 v2.1 RSASSA-PKCS1-v1_5-VERIFY function 01212 */ 01213 int rsa_rsassa_pkcs1_v15_verify( rsa_context *ctx, 01214 int (*f_rng)(void *, unsigned char *, size_t), 01215 void *p_rng, 01216 int mode, 01217 md_type_t md_alg, 01218 unsigned int hashlen, 01219 const unsigned char *hash, 01220 const unsigned char *sig ) 01221 { 01222 int ret; 01223 size_t len, siglen, asn1_len; 01224 unsigned char *p, *end; 01225 unsigned char buf[POLARSSL_MPI_MAX_SIZE]; 01226 md_type_t msg_md_alg; 01227 const md_info_t *md_info; 01228 asn1_buf oid; 01229 01230 if( ctx->padding != RSA_PKCS_V15 ) 01231 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA ); 01232 01233 siglen = ctx->len ; 01234 01235 if( siglen < 16 || siglen > sizeof( buf ) ) 01236 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA ); 01237 01238 ret = ( mode == RSA_PUBLIC ) 01239 ? rsa_public( ctx, sig, buf ) 01240 : rsa_private( ctx, f_rng, p_rng, sig, buf ); 01241 01242 if( ret != 0 ) 01243 return( ret ); 01244 01245 p = buf; 01246 01247 if( *p++ != 0 || *p++ != RSA_SIGN ) 01248 return( POLARSSL_ERR_RSA_INVALID_PADDING ); 01249 01250 while( *p != 0 ) 01251 { 01252 if( p >= buf + siglen - 1 || *p != 0xFF ) 01253 return( POLARSSL_ERR_RSA_INVALID_PADDING ); 01254 p++; 01255 } 01256 p++; 01257 01258 len = siglen - ( p - buf ); 01259 01260 if( len == hashlen && md_alg == POLARSSL_MD_NONE ) 01261 { 01262 if( memcmp( p, hash, hashlen ) == 0 ) 01263 return( 0 ); 01264 else 01265 return( POLARSSL_ERR_RSA_VERIFY_FAILED ); 01266 } 01267 01268 md_info = md_info_from_type( md_alg ); 01269 if( md_info == NULL ) 01270 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA ); 01271 hashlen = md_get_size( md_info ); 01272 01273 end = p + len; 01274 01275 // Parse the ASN.1 structure inside the PKCS#1 v1.5 structure 01276 // 01277 if( ( ret = asn1_get_tag( &p, end, &asn1_len, 01278 ASN1_CONSTRUCTED | ASN1_SEQUENCE ) ) != 0 ) 01279 return( POLARSSL_ERR_RSA_VERIFY_FAILED ); 01280 01281 if( asn1_len + 2 != len ) 01282 return( POLARSSL_ERR_RSA_VERIFY_FAILED ); 01283 01284 if( ( ret = asn1_get_tag( &p, end, &asn1_len, 01285 ASN1_CONSTRUCTED | ASN1_SEQUENCE ) ) != 0 ) 01286 return( POLARSSL_ERR_RSA_VERIFY_FAILED ); 01287 01288 if( asn1_len + 6 + hashlen != len ) 01289 return( POLARSSL_ERR_RSA_VERIFY_FAILED ); 01290 01291 if( ( ret = asn1_get_tag( &p, end, &oid.len, ASN1_OID ) ) != 0 ) 01292 return( POLARSSL_ERR_RSA_VERIFY_FAILED ); 01293 01294 oid.p = p; 01295 p += oid.len; 01296 01297 if( oid_get_md_alg( &oid, &msg_md_alg ) != 0 ) 01298 return( POLARSSL_ERR_RSA_VERIFY_FAILED ); 01299 01300 if( md_alg != msg_md_alg ) 01301 return( POLARSSL_ERR_RSA_VERIFY_FAILED ); 01302 01303 /* 01304 * assume the algorithm parameters must be NULL 01305 */ 01306 if( ( ret = asn1_get_tag( &p, end, &asn1_len, ASN1_NULL ) ) != 0 ) 01307 return( POLARSSL_ERR_RSA_VERIFY_FAILED ); 01308 01309 if( ( ret = asn1_get_tag( &p, end, &asn1_len, ASN1_OCTET_STRING ) ) != 0 ) 01310 return( POLARSSL_ERR_RSA_VERIFY_FAILED ); 01311 01312 if( asn1_len != hashlen ) 01313 return( POLARSSL_ERR_RSA_VERIFY_FAILED ); 01314 01315 if( memcmp( p, hash, hashlen ) != 0 ) 01316 return( POLARSSL_ERR_RSA_VERIFY_FAILED ); 01317 01318 p += hashlen; 01319 01320 if( p != end ) 01321 return( POLARSSL_ERR_RSA_VERIFY_FAILED ); 01322 01323 return( 0 ); 01324 } 01325 #endif /* POLARSSL_PKCS1_V15 */ 01326 01327 /* 01328 * Do an RSA operation and check the message digest 01329 */ 01330 int rsa_pkcs1_verify( rsa_context *ctx, 01331 int (*f_rng)(void *, unsigned char *, size_t), 01332 void *p_rng, 01333 int mode, 01334 md_type_t md_alg, 01335 unsigned int hashlen, 01336 const unsigned char *hash, 01337 const unsigned char *sig ) 01338 { 01339 switch( ctx->padding ) 01340 { 01341 #if defined(POLARSSL_PKCS1_V15) 01342 case RSA_PKCS_V15: 01343 return rsa_rsassa_pkcs1_v15_verify( ctx, f_rng, p_rng, mode, md_alg, 01344 hashlen, hash, sig ); 01345 #endif 01346 01347 #if defined(POLARSSL_PKCS1_V21) 01348 case RSA_PKCS_V21: 01349 return rsa_rsassa_pss_verify( ctx, f_rng, p_rng, mode, md_alg, 01350 hashlen, hash, sig ); 01351 #endif 01352 01353 default: 01354 return( POLARSSL_ERR_RSA_INVALID_PADDING ); 01355 } 01356 } 01357 01358 /* 01359 * Copy the components of an RSA key 01360 */ 01361 int rsa_copy( rsa_context *dst, const rsa_context *src ) 01362 { 01363 int ret; 01364 01365 dst->ver = src->ver ; 01366 dst->len = src->len ; 01367 01368 MPI_CHK( mpi_copy( &dst->N , &src->N ) ); 01369 MPI_CHK( mpi_copy( &dst->E , &src->E ) ); 01370 01371 MPI_CHK( mpi_copy( &dst->D , &src->D ) ); 01372 MPI_CHK( mpi_copy( &dst->P , &src->P ) ); 01373 MPI_CHK( mpi_copy( &dst->Q , &src->Q ) ); 01374 MPI_CHK( mpi_copy( &dst->DP , &src->DP ) ); 01375 MPI_CHK( mpi_copy( &dst->DQ , &src->DQ ) ); 01376 MPI_CHK( mpi_copy( &dst->QP , &src->QP ) ); 01377 01378 MPI_CHK( mpi_copy( &dst->RN , &src->RN ) ); 01379 MPI_CHK( mpi_copy( &dst->RP , &src->RP ) ); 01380 MPI_CHK( mpi_copy( &dst->RQ , &src->RQ ) ); 01381 01382 #if !defined(POLARSSL_RSA_NO_CRT) 01383 MPI_CHK( mpi_copy( &dst->Vi , &src->Vi ) ); 01384 MPI_CHK( mpi_copy( &dst->Vf , &src->Vf ) ); 01385 #endif 01386 01387 dst->padding = src->padding ; 01388 dst->hash_id = src->hash_id ; 01389 01390 cleanup: 01391 if( ret != 0 ) 01392 rsa_free( dst ); 01393 01394 return( ret ); 01395 } 01396 01397 /* 01398 * Free the components of an RSA key 01399 */ 01400 void rsa_free( rsa_context *ctx ) 01401 { 01402 #if !defined(POLARSSL_RSA_NO_CRT) 01403 mpi_free( &ctx->Vi ); mpi_free( &ctx->Vf ); 01404 #endif 01405 mpi_free( &ctx->RQ ); mpi_free( &ctx->RP ); mpi_free( &ctx->RN ); 01406 mpi_free( &ctx->QP ); mpi_free( &ctx->DQ ); mpi_free( &ctx->DP ); 01407 mpi_free( &ctx->Q ); mpi_free( &ctx->P ); mpi_free( &ctx->D ); 01408 mpi_free( &ctx->E ); mpi_free( &ctx->N ); 01409 01410 #if defined(POLARSSL_THREADING_C) 01411 polarssl_mutex_free( &ctx->mutex ); 01412 #endif 01413 } 01414 01415 #if defined(POLARSSL_SELF_TEST) 01416 01417 #include "polarssl/sha1.h" 01418 01419 /* 01420 * Example RSA-1024 keypair, for test purposes 01421 */ 01422 #define KEY_LEN 128 01423 01424 #define RSA_N "9292758453063D803DD603D5E777D788" \ 01425 "8ED1D5BF35786190FA2F23EBC0848AEA" \ 01426 "DDA92CA6C3D80B32C4D109BE0F36D6AE" \ 01427 "7130B9CED7ACDF54CFC7555AC14EEBAB" \ 01428 "93A89813FBF3C4F8066D2D800F7C38A8" \ 01429 "1AE31942917403FF4946B0A83D3D3E05" \ 01430 "EE57C6F5F5606FB5D4BC6CD34EE0801A" \ 01431 "5E94BB77B07507233A0BC7BAC8F90F79" 01432 01433 #define RSA_E "10001" 01434 01435 #define RSA_D "24BF6185468786FDD303083D25E64EFC" \ 01436 "66CA472BC44D253102F8B4A9D3BFA750" \ 01437 "91386C0077937FE33FA3252D28855837" \ 01438 "AE1B484A8A9A45F7EE8C0C634F99E8CD" \ 01439 "DF79C5CE07EE72C7F123142198164234" \ 01440 "CABB724CF78B8173B9F880FC86322407" \ 01441 "AF1FEDFDDE2BEB674CA15F3E81A1521E" \ 01442 "071513A1E85B5DFA031F21ECAE91A34D" 01443 01444 #define RSA_P "C36D0EB7FCD285223CFB5AABA5BDA3D8" \ 01445 "2C01CAD19EA484A87EA4377637E75500" \ 01446 "FCB2005C5C7DD6EC4AC023CDA285D796" \ 01447 "C3D9E75E1EFC42488BB4F1D13AC30A57" 01448 01449 #define RSA_Q "C000DF51A7C77AE8D7C7370C1FF55B69" \ 01450 "E211C2B9E5DB1ED0BF61D0D9899620F4" \ 01451 "910E4168387E3C30AA1E00C339A79508" \ 01452 "8452DD96A9A5EA5D9DCA68DA636032AF" 01453 01454 #define RSA_DP "C1ACF567564274FB07A0BBAD5D26E298" \ 01455 "3C94D22288ACD763FD8E5600ED4A702D" \ 01456 "F84198A5F06C2E72236AE490C93F07F8" \ 01457 "3CC559CD27BC2D1CA488811730BB5725" 01458 01459 #define RSA_DQ "4959CBF6F8FEF750AEE6977C155579C7" \ 01460 "D8AAEA56749EA28623272E4F7D0592AF" \ 01461 "7C1F1313CAC9471B5C523BFE592F517B" \ 01462 "407A1BD76C164B93DA2D32A383E58357" 01463 01464 #define RSA_QP "9AE7FBC99546432DF71896FC239EADAE" \ 01465 "F38D18D2B2F0E2DD275AA977E2BF4411" \ 01466 "F5A3B2A5D33605AEBBCCBA7FEB9F2D2F" \ 01467 "A74206CEC169D74BF5A8C50D6F48EA08" 01468 01469 #define PT_LEN 24 01470 #define RSA_PT "\xAA\xBB\xCC\x03\x02\x01\x00\xFF\xFF\xFF\xFF\xFF" \ 01471 "\x11\x22\x33\x0A\x0B\x0C\xCC\xDD\xDD\xDD\xDD\xDD" 01472 01473 #if defined(POLARSSL_PKCS1_V15) 01474 static int myrand( void *rng_state, unsigned char *output, size_t len ) 01475 { 01476 #if !defined(__OpenBSD__) 01477 size_t i; 01478 01479 if( rng_state != NULL ) 01480 rng_state = NULL; 01481 01482 for( i = 0; i < len; ++i ) 01483 output[i] = rand(); 01484 #else 01485 if( rng_state != NULL ) 01486 rng_state = NULL; 01487 01488 arc4random_buf( output, len ); 01489 #endif /* !OpenBSD */ 01490 01491 return( 0 ); 01492 } 01493 #endif /* POLARSSL_PKCS1_V15 */ 01494 01495 /* 01496 * Checkup routine 01497 */ 01498 int rsa_self_test( int verbose ) 01499 { 01500 int ret = 0; 01501 #if defined(POLARSSL_PKCS1_V15) 01502 size_t len; 01503 rsa_context rsa; 01504 unsigned char rsa_plaintext[PT_LEN]; 01505 unsigned char rsa_decrypted[PT_LEN]; 01506 unsigned char rsa_ciphertext[KEY_LEN]; 01507 #if defined(POLARSSL_SHA1_C) 01508 unsigned char sha1sum[20]; 01509 #endif 01510 01511 rsa_init( &rsa, RSA_PKCS_V15, 0 ); 01512 01513 rsa.len = KEY_LEN; 01514 MPI_CHK( mpi_read_string( &rsa.N , 16, RSA_N ) ); 01515 MPI_CHK( mpi_read_string( &rsa.E , 16, RSA_E ) ); 01516 MPI_CHK( mpi_read_string( &rsa.D , 16, RSA_D ) ); 01517 MPI_CHK( mpi_read_string( &rsa.P , 16, RSA_P ) ); 01518 MPI_CHK( mpi_read_string( &rsa.Q , 16, RSA_Q ) ); 01519 MPI_CHK( mpi_read_string( &rsa.DP , 16, RSA_DP ) ); 01520 MPI_CHK( mpi_read_string( &rsa.DQ , 16, RSA_DQ ) ); 01521 MPI_CHK( mpi_read_string( &rsa.QP , 16, RSA_QP ) ); 01522 01523 if( verbose != 0 ) 01524 polarssl_printf( " RSA key validation: " ); 01525 01526 if( rsa_check_pubkey( &rsa ) != 0 || 01527 rsa_check_privkey( &rsa ) != 0 ) 01528 { 01529 if( verbose != 0 ) 01530 polarssl_printf( "failed\n" ); 01531 01532 return( 1 ); 01533 } 01534 01535 if( verbose != 0 ) 01536 polarssl_printf( "passed\n PKCS#1 encryption : " ); 01537 01538 memcpy( rsa_plaintext, RSA_PT, PT_LEN ); 01539 01540 if( rsa_pkcs1_encrypt( &rsa, myrand, NULL, RSA_PUBLIC, PT_LEN, 01541 rsa_plaintext, rsa_ciphertext ) != 0 ) 01542 { 01543 if( verbose != 0 ) 01544 polarssl_printf( "failed\n" ); 01545 01546 return( 1 ); 01547 } 01548 01549 if( verbose != 0 ) 01550 polarssl_printf( "passed\n PKCS#1 decryption : " ); 01551 01552 if( rsa_pkcs1_decrypt( &rsa, myrand, NULL, RSA_PRIVATE, &len, 01553 rsa_ciphertext, rsa_decrypted, 01554 sizeof(rsa_decrypted) ) != 0 ) 01555 { 01556 if( verbose != 0 ) 01557 polarssl_printf( "failed\n" ); 01558 01559 return( 1 ); 01560 } 01561 01562 if( memcmp( rsa_decrypted, rsa_plaintext, len ) != 0 ) 01563 { 01564 if( verbose != 0 ) 01565 polarssl_printf( "failed\n" ); 01566 01567 return( 1 ); 01568 } 01569 01570 #if defined(POLARSSL_SHA1_C) 01571 if( verbose != 0 ) 01572 polarssl_printf( "passed\n PKCS#1 data sign : " ); 01573 01574 sha1( rsa_plaintext, PT_LEN, sha1sum ); 01575 01576 if( rsa_pkcs1_sign( &rsa, myrand, NULL, RSA_PRIVATE, POLARSSL_MD_SHA1, 0, 01577 sha1sum, rsa_ciphertext ) != 0 ) 01578 { 01579 if( verbose != 0 ) 01580 polarssl_printf( "failed\n" ); 01581 01582 return( 1 ); 01583 } 01584 01585 if( verbose != 0 ) 01586 polarssl_printf( "passed\n PKCS#1 sig. verify: " ); 01587 01588 if( rsa_pkcs1_verify( &rsa, NULL, NULL, RSA_PUBLIC, POLARSSL_MD_SHA1, 0, 01589 sha1sum, rsa_ciphertext ) != 0 ) 01590 { 01591 if( verbose != 0 ) 01592 polarssl_printf( "failed\n" ); 01593 01594 return( 1 ); 01595 } 01596 01597 if( verbose != 0 ) 01598 polarssl_printf( "passed\n\n" ); 01599 #endif /* POLARSSL_SHA1_C */ 01600 01601 cleanup: 01602 rsa_free( &rsa ); 01603 #else /* POLARSSL_PKCS1_V15 */ 01604 ((void) verbose); 01605 #endif /* POLARSSL_PKCS1_V15 */ 01606 return( ret ); 01607 } 01608 01609 #endif /* POLARSSL_SELF_TEST */ 01610 01611 #endif /* POLARSSL_RSA_C */ 01612 01613
Generated on Tue Jul 12 2022 19:40:20 by
1.7.2