Marco Zecchini / Mbed OS Example_RTOS

Rtos API example

mbed-os/features/mbedtls/src/rsa.c@0:9fca2b23d0ba, 2019-02-23 (annotated)

Committer:
marcozecchini
Date:
Sat Feb 23 12:13:36 2019 +0000
Revision:
0:9fca2b23d0ba
final commit

Who changed what in which revision?

UserRevisionLine numberNew contents of line
marcozecchini 0:9fca2b23d0ba 1 /*
marcozecchini 0:9fca2b23d0ba 2 * The RSA public-key cryptosystem
marcozecchini 0:9fca2b23d0ba 3 *
marcozecchini 0:9fca2b23d0ba 4 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
marcozecchini 0:9fca2b23d0ba 5 * SPDX-License-Identifier: Apache-2.0
marcozecchini 0:9fca2b23d0ba 6 *
marcozecchini 0:9fca2b23d0ba 7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
marcozecchini 0:9fca2b23d0ba 8 * not use this file except in compliance with the License.
marcozecchini 0:9fca2b23d0ba 9 * You may obtain a copy of the License at
marcozecchini 0:9fca2b23d0ba 10 *
marcozecchini 0:9fca2b23d0ba 11 * http://www.apache.org/licenses/LICENSE-2.0
marcozecchini 0:9fca2b23d0ba 12 *
marcozecchini 0:9fca2b23d0ba 13 * Unless required by applicable law or agreed to in writing, software
marcozecchini 0:9fca2b23d0ba 14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
marcozecchini 0:9fca2b23d0ba 15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
marcozecchini 0:9fca2b23d0ba 16 * See the License for the specific language governing permissions and
marcozecchini 0:9fca2b23d0ba 17 * limitations under the License.
marcozecchini 0:9fca2b23d0ba 18 *
marcozecchini 0:9fca2b23d0ba 19 * This file is part of mbed TLS (https://tls.mbed.org)
marcozecchini 0:9fca2b23d0ba 20 */
marcozecchini 0:9fca2b23d0ba 21 /*
marcozecchini 0:9fca2b23d0ba 22 * The following sources were referenced in the design of this implementation
marcozecchini 0:9fca2b23d0ba 23 * of the RSA algorithm:
marcozecchini 0:9fca2b23d0ba 24 *
marcozecchini 0:9fca2b23d0ba 25 * [1] A method for obtaining digital signatures and public-key cryptosystems
marcozecchini 0:9fca2b23d0ba 26 * R Rivest, A Shamir, and L Adleman
marcozecchini 0:9fca2b23d0ba 27 * http://people.csail.mit.edu/rivest/pubs.html#RSA78
marcozecchini 0:9fca2b23d0ba 28 *
marcozecchini 0:9fca2b23d0ba 29 * [2] Handbook of Applied Cryptography - 1997, Chapter 8
marcozecchini 0:9fca2b23d0ba 30 * Menezes, van Oorschot and Vanstone
marcozecchini 0:9fca2b23d0ba 31 *
marcozecchini 0:9fca2b23d0ba 32 * [3] Malware Guard Extension: Using SGX to Conceal Cache Attacks
marcozecchini 0:9fca2b23d0ba 33 * Michael Schwarz, Samuel Weiser, Daniel Gruss, Clémentine Maurice and
marcozecchini 0:9fca2b23d0ba 34 * Stefan Mangard
marcozecchini 0:9fca2b23d0ba 35 * https://arxiv.org/abs/1702.08719v2
marcozecchini 0:9fca2b23d0ba 36 *
marcozecchini 0:9fca2b23d0ba 37 */
marcozecchini 0:9fca2b23d0ba 38
marcozecchini 0:9fca2b23d0ba 39 #if !defined(MBEDTLS_CONFIG_FILE)
marcozecchini 0:9fca2b23d0ba 40 #include "mbedtls/config.h"
marcozecchini 0:9fca2b23d0ba 41 #else
marcozecchini 0:9fca2b23d0ba 42 #include MBEDTLS_CONFIG_FILE
marcozecchini 0:9fca2b23d0ba 43 #endif
marcozecchini 0:9fca2b23d0ba 44
marcozecchini 0:9fca2b23d0ba 45 #if defined(MBEDTLS_RSA_C)
marcozecchini 0:9fca2b23d0ba 46
marcozecchini 0:9fca2b23d0ba 47 #include "mbedtls/rsa.h"
marcozecchini 0:9fca2b23d0ba 48 #include "mbedtls/oid.h"
marcozecchini 0:9fca2b23d0ba 49
marcozecchini 0:9fca2b23d0ba 50 #include <string.h>
marcozecchini 0:9fca2b23d0ba 51
marcozecchini 0:9fca2b23d0ba 52 #if defined(MBEDTLS_PKCS1_V21)
marcozecchini 0:9fca2b23d0ba 53 #include "mbedtls/md.h"
marcozecchini 0:9fca2b23d0ba 54 #endif
marcozecchini 0:9fca2b23d0ba 55
marcozecchini 0:9fca2b23d0ba 56 #if defined(MBEDTLS_PKCS1_V15) && !defined(__OpenBSD__)
marcozecchini 0:9fca2b23d0ba 57 #include <stdlib.h>
marcozecchini 0:9fca2b23d0ba 58 #endif
marcozecchini 0:9fca2b23d0ba 59
marcozecchini 0:9fca2b23d0ba 60 #if defined(MBEDTLS_PLATFORM_C)
marcozecchini 0:9fca2b23d0ba 61 #include "mbedtls/platform.h"
marcozecchini 0:9fca2b23d0ba 62 #else
marcozecchini 0:9fca2b23d0ba 63 #include <stdio.h>
marcozecchini 0:9fca2b23d0ba 64 #define mbedtls_printf printf
marcozecchini 0:9fca2b23d0ba 65 #define mbedtls_calloc calloc
marcozecchini 0:9fca2b23d0ba 66 #define mbedtls_free free
marcozecchini 0:9fca2b23d0ba 67 #endif
marcozecchini 0:9fca2b23d0ba 68
marcozecchini 0:9fca2b23d0ba 69 /* Implementation that should never be optimized out by the compiler */
marcozecchini 0:9fca2b23d0ba 70 static void mbedtls_zeroize( void *v, size_t n ) {
marcozecchini 0:9fca2b23d0ba 71 volatile unsigned char *p = (unsigned char*)v; while( n-- ) *p++ = 0;
marcozecchini 0:9fca2b23d0ba 72 }
marcozecchini 0:9fca2b23d0ba 73
marcozecchini 0:9fca2b23d0ba 74 /*
marcozecchini 0:9fca2b23d0ba 75 * Initialize an RSA context
marcozecchini 0:9fca2b23d0ba 76 */
marcozecchini 0:9fca2b23d0ba 77 void mbedtls_rsa_init( mbedtls_rsa_context *ctx,
marcozecchini 0:9fca2b23d0ba 78 int padding,
marcozecchini 0:9fca2b23d0ba 79 int hash_id )
marcozecchini 0:9fca2b23d0ba 80 {
marcozecchini 0:9fca2b23d0ba 81 memset( ctx, 0, sizeof( mbedtls_rsa_context ) );
marcozecchini 0:9fca2b23d0ba 82
marcozecchini 0:9fca2b23d0ba 83 mbedtls_rsa_set_padding( ctx, padding, hash_id );
marcozecchini 0:9fca2b23d0ba 84
marcozecchini 0:9fca2b23d0ba 85 #if defined(MBEDTLS_THREADING_C)
marcozecchini 0:9fca2b23d0ba 86 mbedtls_mutex_init( &ctx->mutex );
marcozecchini 0:9fca2b23d0ba 87 #endif
marcozecchini 0:9fca2b23d0ba 88 }
marcozecchini 0:9fca2b23d0ba 89
marcozecchini 0:9fca2b23d0ba 90 /*
marcozecchini 0:9fca2b23d0ba 91 * Set padding for an existing RSA context
marcozecchini 0:9fca2b23d0ba 92 */
marcozecchini 0:9fca2b23d0ba 93 void mbedtls_rsa_set_padding( mbedtls_rsa_context *ctx, int padding, int hash_id )
marcozecchini 0:9fca2b23d0ba 94 {
marcozecchini 0:9fca2b23d0ba 95 ctx->padding = padding;
marcozecchini 0:9fca2b23d0ba 96 ctx->hash_id = hash_id;
marcozecchini 0:9fca2b23d0ba 97 }
marcozecchini 0:9fca2b23d0ba 98
marcozecchini 0:9fca2b23d0ba 99 #if defined(MBEDTLS_GENPRIME)
marcozecchini 0:9fca2b23d0ba 100
marcozecchini 0:9fca2b23d0ba 101 /*
marcozecchini 0:9fca2b23d0ba 102 * Generate an RSA keypair
marcozecchini 0:9fca2b23d0ba 103 */
marcozecchini 0:9fca2b23d0ba 104 int mbedtls_rsa_gen_key( mbedtls_rsa_context *ctx,
marcozecchini 0:9fca2b23d0ba 105 int (*f_rng)(void *, unsigned char *, size_t),
marcozecchini 0:9fca2b23d0ba 106 void *p_rng,
marcozecchini 0:9fca2b23d0ba 107 unsigned int nbits, int exponent )
marcozecchini 0:9fca2b23d0ba 108 {
marcozecchini 0:9fca2b23d0ba 109 int ret;
marcozecchini 0:9fca2b23d0ba 110 mbedtls_mpi P1, Q1, H, G;
marcozecchini 0:9fca2b23d0ba 111
marcozecchini 0:9fca2b23d0ba 112 if( f_rng == NULL || nbits < 128 || exponent < 3 )
marcozecchini 0:9fca2b23d0ba 113 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
marcozecchini 0:9fca2b23d0ba 114
marcozecchini 0:9fca2b23d0ba 115 if( nbits % 2 )
marcozecchini 0:9fca2b23d0ba 116 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
marcozecchini 0:9fca2b23d0ba 117
marcozecchini 0:9fca2b23d0ba 118 mbedtls_mpi_init( &P1 ); mbedtls_mpi_init( &Q1 );
marcozecchini 0:9fca2b23d0ba 119 mbedtls_mpi_init( &H ); mbedtls_mpi_init( &G );
marcozecchini 0:9fca2b23d0ba 120
marcozecchini 0:9fca2b23d0ba 121 /*
marcozecchini 0:9fca2b23d0ba 122 * find primes P and Q with Q < P so that:
marcozecchini 0:9fca2b23d0ba 123 * GCD( E, (P-1)*(Q-1) ) == 1
marcozecchini 0:9fca2b23d0ba 124 */
marcozecchini 0:9fca2b23d0ba 125 MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &ctx->E, exponent ) );
marcozecchini 0:9fca2b23d0ba 126
marcozecchini 0:9fca2b23d0ba 127 do
marcozecchini 0:9fca2b23d0ba 128 {
marcozecchini 0:9fca2b23d0ba 129 MBEDTLS_MPI_CHK( mbedtls_mpi_gen_prime( &ctx->P, nbits >> 1, 0,
marcozecchini 0:9fca2b23d0ba 130 f_rng, p_rng ) );
marcozecchini 0:9fca2b23d0ba 131
marcozecchini 0:9fca2b23d0ba 132 MBEDTLS_MPI_CHK( mbedtls_mpi_gen_prime( &ctx->Q, nbits >> 1, 0,
marcozecchini 0:9fca2b23d0ba 133 f_rng, p_rng ) );
marcozecchini 0:9fca2b23d0ba 134
marcozecchini 0:9fca2b23d0ba 135 if( mbedtls_mpi_cmp_mpi( &ctx->P, &ctx->Q ) == 0 )
marcozecchini 0:9fca2b23d0ba 136 continue;
marcozecchini 0:9fca2b23d0ba 137
marcozecchini 0:9fca2b23d0ba 138 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ctx->N, &ctx->P, &ctx->Q ) );
marcozecchini 0:9fca2b23d0ba 139 if( mbedtls_mpi_bitlen( &ctx->N ) != nbits )
marcozecchini 0:9fca2b23d0ba 140 continue;
marcozecchini 0:9fca2b23d0ba 141
marcozecchini 0:9fca2b23d0ba 142 if( mbedtls_mpi_cmp_mpi( &ctx->P, &ctx->Q ) < 0 )
marcozecchini 0:9fca2b23d0ba 143 mbedtls_mpi_swap( &ctx->P, &ctx->Q );
marcozecchini 0:9fca2b23d0ba 144
marcozecchini 0:9fca2b23d0ba 145 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &P1, &ctx->P, 1 ) );
marcozecchini 0:9fca2b23d0ba 146 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &Q1, &ctx->Q, 1 ) );
marcozecchini 0:9fca2b23d0ba 147 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &H, &P1, &Q1 ) );
marcozecchini 0:9fca2b23d0ba 148 MBEDTLS_MPI_CHK( mbedtls_mpi_gcd( &G, &ctx->E, &H ) );
marcozecchini 0:9fca2b23d0ba 149 }
marcozecchini 0:9fca2b23d0ba 150 while( mbedtls_mpi_cmp_int( &G, 1 ) != 0 );
marcozecchini 0:9fca2b23d0ba 151
marcozecchini 0:9fca2b23d0ba 152 /*
marcozecchini 0:9fca2b23d0ba 153 * D = E^-1 mod ((P-1)*(Q-1))
marcozecchini 0:9fca2b23d0ba 154 * DP = D mod (P - 1)
marcozecchini 0:9fca2b23d0ba 155 * DQ = D mod (Q - 1)
marcozecchini 0:9fca2b23d0ba 156 * QP = Q^-1 mod P
marcozecchini 0:9fca2b23d0ba 157 */
marcozecchini 0:9fca2b23d0ba 158 MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( &ctx->D , &ctx->E, &H ) );
marcozecchini 0:9fca2b23d0ba 159 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &ctx->DP, &ctx->D, &P1 ) );
marcozecchini 0:9fca2b23d0ba 160 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &ctx->DQ, &ctx->D, &Q1 ) );
marcozecchini 0:9fca2b23d0ba 161 MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( &ctx->QP, &ctx->Q, &ctx->P ) );
marcozecchini 0:9fca2b23d0ba 162
marcozecchini 0:9fca2b23d0ba 163 ctx->len = ( mbedtls_mpi_bitlen( &ctx->N ) + 7 ) >> 3;
marcozecchini 0:9fca2b23d0ba 164
marcozecchini 0:9fca2b23d0ba 165 cleanup:
marcozecchini 0:9fca2b23d0ba 166
marcozecchini 0:9fca2b23d0ba 167 mbedtls_mpi_free( &P1 ); mbedtls_mpi_free( &Q1 ); mbedtls_mpi_free( &H ); mbedtls_mpi_free( &G );
marcozecchini 0:9fca2b23d0ba 168
marcozecchini 0:9fca2b23d0ba 169 if( ret != 0 )
marcozecchini 0:9fca2b23d0ba 170 {
marcozecchini 0:9fca2b23d0ba 171 mbedtls_rsa_free( ctx );
marcozecchini 0:9fca2b23d0ba 172 return( MBEDTLS_ERR_RSA_KEY_GEN_FAILED + ret );
marcozecchini 0:9fca2b23d0ba 173 }
marcozecchini 0:9fca2b23d0ba 174
marcozecchini 0:9fca2b23d0ba 175 return( 0 );
marcozecchini 0:9fca2b23d0ba 176 }
marcozecchini 0:9fca2b23d0ba 177
marcozecchini 0:9fca2b23d0ba 178 #endif /* MBEDTLS_GENPRIME */
marcozecchini 0:9fca2b23d0ba 179
marcozecchini 0:9fca2b23d0ba 180 /*
marcozecchini 0:9fca2b23d0ba 181 * Check a public RSA key
marcozecchini 0:9fca2b23d0ba 182 */
marcozecchini 0:9fca2b23d0ba 183 int mbedtls_rsa_check_pubkey( const mbedtls_rsa_context *ctx )
marcozecchini 0:9fca2b23d0ba 184 {
marcozecchini 0:9fca2b23d0ba 185 if( !ctx->N.p || !ctx->E.p )
marcozecchini 0:9fca2b23d0ba 186 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
marcozecchini 0:9fca2b23d0ba 187
marcozecchini 0:9fca2b23d0ba 188 if( ( ctx->N.p[0] & 1 ) == 0 ||
marcozecchini 0:9fca2b23d0ba 189 ( ctx->E.p[0] & 1 ) == 0 )
marcozecchini 0:9fca2b23d0ba 190 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
marcozecchini 0:9fca2b23d0ba 191
marcozecchini 0:9fca2b23d0ba 192 if( mbedtls_mpi_bitlen( &ctx->N ) < 128 ||
marcozecchini 0:9fca2b23d0ba 193 mbedtls_mpi_bitlen( &ctx->N ) > MBEDTLS_MPI_MAX_BITS )
marcozecchini 0:9fca2b23d0ba 194 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
marcozecchini 0:9fca2b23d0ba 195
marcozecchini 0:9fca2b23d0ba 196 if( mbedtls_mpi_bitlen( &ctx->E ) < 2 ||
marcozecchini 0:9fca2b23d0ba 197 mbedtls_mpi_cmp_mpi( &ctx->E, &ctx->N ) >= 0 )
marcozecchini 0:9fca2b23d0ba 198 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
marcozecchini 0:9fca2b23d0ba 199
marcozecchini 0:9fca2b23d0ba 200 return( 0 );
marcozecchini 0:9fca2b23d0ba 201 }
marcozecchini 0:9fca2b23d0ba 202
marcozecchini 0:9fca2b23d0ba 203 /*
marcozecchini 0:9fca2b23d0ba 204 * Check a private RSA key
marcozecchini 0:9fca2b23d0ba 205 */
marcozecchini 0:9fca2b23d0ba 206 int mbedtls_rsa_check_privkey( const mbedtls_rsa_context *ctx )
marcozecchini 0:9fca2b23d0ba 207 {
marcozecchini 0:9fca2b23d0ba 208 int ret;
marcozecchini 0:9fca2b23d0ba 209 mbedtls_mpi PQ, DE, P1, Q1, H, I, G, G2, L1, L2, DP, DQ, QP;
marcozecchini 0:9fca2b23d0ba 210
marcozecchini 0:9fca2b23d0ba 211 if( ( ret = mbedtls_rsa_check_pubkey( ctx ) ) != 0 )
marcozecchini 0:9fca2b23d0ba 212 return( ret );
marcozecchini 0:9fca2b23d0ba 213
marcozecchini 0:9fca2b23d0ba 214 if( !ctx->P.p || !ctx->Q.p || !ctx->D.p )
marcozecchini 0:9fca2b23d0ba 215 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
marcozecchini 0:9fca2b23d0ba 216
marcozecchini 0:9fca2b23d0ba 217 mbedtls_mpi_init( &PQ ); mbedtls_mpi_init( &DE ); mbedtls_mpi_init( &P1 ); mbedtls_mpi_init( &Q1 );
marcozecchini 0:9fca2b23d0ba 218 mbedtls_mpi_init( &H ); mbedtls_mpi_init( &I ); mbedtls_mpi_init( &G ); mbedtls_mpi_init( &G2 );
marcozecchini 0:9fca2b23d0ba 219 mbedtls_mpi_init( &L1 ); mbedtls_mpi_init( &L2 ); mbedtls_mpi_init( &DP ); mbedtls_mpi_init( &DQ );
marcozecchini 0:9fca2b23d0ba 220 mbedtls_mpi_init( &QP );
marcozecchini 0:9fca2b23d0ba 221
marcozecchini 0:9fca2b23d0ba 222 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &PQ, &ctx->P, &ctx->Q ) );
marcozecchini 0:9fca2b23d0ba 223 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &DE, &ctx->D, &ctx->E ) );
marcozecchini 0:9fca2b23d0ba 224 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &P1, &ctx->P, 1 ) );
marcozecchini 0:9fca2b23d0ba 225 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &Q1, &ctx->Q, 1 ) );
marcozecchini 0:9fca2b23d0ba 226 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &H, &P1, &Q1 ) );
marcozecchini 0:9fca2b23d0ba 227 MBEDTLS_MPI_CHK( mbedtls_mpi_gcd( &G, &ctx->E, &H ) );
marcozecchini 0:9fca2b23d0ba 228
marcozecchini 0:9fca2b23d0ba 229 MBEDTLS_MPI_CHK( mbedtls_mpi_gcd( &G2, &P1, &Q1 ) );
marcozecchini 0:9fca2b23d0ba 230 MBEDTLS_MPI_CHK( mbedtls_mpi_div_mpi( &L1, &L2, &H, &G2 ) );
marcozecchini 0:9fca2b23d0ba 231 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &I, &DE, &L1 ) );
marcozecchini 0:9fca2b23d0ba 232
marcozecchini 0:9fca2b23d0ba 233 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &DP, &ctx->D, &P1 ) );
marcozecchini 0:9fca2b23d0ba 234 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &DQ, &ctx->D, &Q1 ) );
marcozecchini 0:9fca2b23d0ba 235 MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( &QP, &ctx->Q, &ctx->P ) );
marcozecchini 0:9fca2b23d0ba 236 /*
marcozecchini 0:9fca2b23d0ba 237 * Check for a valid PKCS1v2 private key
marcozecchini 0:9fca2b23d0ba 238 */
marcozecchini 0:9fca2b23d0ba 239 if( mbedtls_mpi_cmp_mpi( &PQ, &ctx->N ) != 0 ||
marcozecchini 0:9fca2b23d0ba 240 mbedtls_mpi_cmp_mpi( &DP, &ctx->DP ) != 0 ||
marcozecchini 0:9fca2b23d0ba 241 mbedtls_mpi_cmp_mpi( &DQ, &ctx->DQ ) != 0 ||
marcozecchini 0:9fca2b23d0ba 242 mbedtls_mpi_cmp_mpi( &QP, &ctx->QP ) != 0 ||
marcozecchini 0:9fca2b23d0ba 243 mbedtls_mpi_cmp_int( &L2, 0 ) != 0 ||
marcozecchini 0:9fca2b23d0ba 244 mbedtls_mpi_cmp_int( &I, 1 ) != 0 ||
marcozecchini 0:9fca2b23d0ba 245 mbedtls_mpi_cmp_int( &G, 1 ) != 0 )
marcozecchini 0:9fca2b23d0ba 246 {
marcozecchini 0:9fca2b23d0ba 247 ret = MBEDTLS_ERR_RSA_KEY_CHECK_FAILED;
marcozecchini 0:9fca2b23d0ba 248 }
marcozecchini 0:9fca2b23d0ba 249
marcozecchini 0:9fca2b23d0ba 250 cleanup:
marcozecchini 0:9fca2b23d0ba 251 mbedtls_mpi_free( &PQ ); mbedtls_mpi_free( &DE ); mbedtls_mpi_free( &P1 ); mbedtls_mpi_free( &Q1 );
marcozecchini 0:9fca2b23d0ba 252 mbedtls_mpi_free( &H ); mbedtls_mpi_free( &I ); mbedtls_mpi_free( &G ); mbedtls_mpi_free( &G2 );
marcozecchini 0:9fca2b23d0ba 253 mbedtls_mpi_free( &L1 ); mbedtls_mpi_free( &L2 ); mbedtls_mpi_free( &DP ); mbedtls_mpi_free( &DQ );
marcozecchini 0:9fca2b23d0ba 254 mbedtls_mpi_free( &QP );
marcozecchini 0:9fca2b23d0ba 255
marcozecchini 0:9fca2b23d0ba 256 if( ret == MBEDTLS_ERR_RSA_KEY_CHECK_FAILED )
marcozecchini 0:9fca2b23d0ba 257 return( ret );
marcozecchini 0:9fca2b23d0ba 258
marcozecchini 0:9fca2b23d0ba 259 if( ret != 0 )
marcozecchini 0:9fca2b23d0ba 260 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED + ret );
marcozecchini 0:9fca2b23d0ba 261
marcozecchini 0:9fca2b23d0ba 262 return( 0 );
marcozecchini 0:9fca2b23d0ba 263 }
marcozecchini 0:9fca2b23d0ba 264
marcozecchini 0:9fca2b23d0ba 265 /*
marcozecchini 0:9fca2b23d0ba 266 * Check if contexts holding a public and private key match
marcozecchini 0:9fca2b23d0ba 267 */
marcozecchini 0:9fca2b23d0ba 268 int mbedtls_rsa_check_pub_priv( const mbedtls_rsa_context *pub, const mbedtls_rsa_context *prv )
marcozecchini 0:9fca2b23d0ba 269 {
marcozecchini 0:9fca2b23d0ba 270 if( mbedtls_rsa_check_pubkey( pub ) != 0 ||
marcozecchini 0:9fca2b23d0ba 271 mbedtls_rsa_check_privkey( prv ) != 0 )
marcozecchini 0:9fca2b23d0ba 272 {
marcozecchini 0:9fca2b23d0ba 273 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
marcozecchini 0:9fca2b23d0ba 274 }
marcozecchini 0:9fca2b23d0ba 275
marcozecchini 0:9fca2b23d0ba 276 if( mbedtls_mpi_cmp_mpi( &pub->N, &prv->N ) != 0 ||
marcozecchini 0:9fca2b23d0ba 277 mbedtls_mpi_cmp_mpi( &pub->E, &prv->E ) != 0 )
marcozecchini 0:9fca2b23d0ba 278 {
marcozecchini 0:9fca2b23d0ba 279 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
marcozecchini 0:9fca2b23d0ba 280 }
marcozecchini 0:9fca2b23d0ba 281
marcozecchini 0:9fca2b23d0ba 282 return( 0 );
marcozecchini 0:9fca2b23d0ba 283 }
marcozecchini 0:9fca2b23d0ba 284
marcozecchini 0:9fca2b23d0ba 285 /*
marcozecchini 0:9fca2b23d0ba 286 * Do an RSA public key operation
marcozecchini 0:9fca2b23d0ba 287 */
marcozecchini 0:9fca2b23d0ba 288 int mbedtls_rsa_public( mbedtls_rsa_context *ctx,
marcozecchini 0:9fca2b23d0ba 289 const unsigned char *input,
marcozecchini 0:9fca2b23d0ba 290 unsigned char *output )
marcozecchini 0:9fca2b23d0ba 291 {
marcozecchini 0:9fca2b23d0ba 292 int ret;
marcozecchini 0:9fca2b23d0ba 293 size_t olen;
marcozecchini 0:9fca2b23d0ba 294 mbedtls_mpi T;
marcozecchini 0:9fca2b23d0ba 295
marcozecchini 0:9fca2b23d0ba 296 mbedtls_mpi_init( &T );
marcozecchini 0:9fca2b23d0ba 297
marcozecchini 0:9fca2b23d0ba 298 #if defined(MBEDTLS_THREADING_C)
marcozecchini 0:9fca2b23d0ba 299 if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
marcozecchini 0:9fca2b23d0ba 300 return( ret );
marcozecchini 0:9fca2b23d0ba 301 #endif
marcozecchini 0:9fca2b23d0ba 302
marcozecchini 0:9fca2b23d0ba 303 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &T, input, ctx->len ) );
marcozecchini 0:9fca2b23d0ba 304
marcozecchini 0:9fca2b23d0ba 305 if( mbedtls_mpi_cmp_mpi( &T, &ctx->N ) >= 0 )
marcozecchini 0:9fca2b23d0ba 306 {
marcozecchini 0:9fca2b23d0ba 307 ret = MBEDTLS_ERR_MPI_BAD_INPUT_DATA;
marcozecchini 0:9fca2b23d0ba 308 goto cleanup;
marcozecchini 0:9fca2b23d0ba 309 }
marcozecchini 0:9fca2b23d0ba 310
marcozecchini 0:9fca2b23d0ba 311 olen = ctx->len;
marcozecchini 0:9fca2b23d0ba 312 MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &T, &T, &ctx->E, &ctx->N, &ctx->RN ) );
marcozecchini 0:9fca2b23d0ba 313 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &T, output, olen ) );
marcozecchini 0:9fca2b23d0ba 314
marcozecchini 0:9fca2b23d0ba 315 cleanup:
marcozecchini 0:9fca2b23d0ba 316 #if defined(MBEDTLS_THREADING_C)
marcozecchini 0:9fca2b23d0ba 317 if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
marcozecchini 0:9fca2b23d0ba 318 return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
marcozecchini 0:9fca2b23d0ba 319 #endif
marcozecchini 0:9fca2b23d0ba 320
marcozecchini 0:9fca2b23d0ba 321 mbedtls_mpi_free( &T );
marcozecchini 0:9fca2b23d0ba 322
marcozecchini 0:9fca2b23d0ba 323 if( ret != 0 )
marcozecchini 0:9fca2b23d0ba 324 return( MBEDTLS_ERR_RSA_PUBLIC_FAILED + ret );
marcozecchini 0:9fca2b23d0ba 325
marcozecchini 0:9fca2b23d0ba 326 return( 0 );
marcozecchini 0:9fca2b23d0ba 327 }
marcozecchini 0:9fca2b23d0ba 328
marcozecchini 0:9fca2b23d0ba 329 /*
marcozecchini 0:9fca2b23d0ba 330 * Generate or update blinding values, see section 10 of:
marcozecchini 0:9fca2b23d0ba 331 * KOCHER, Paul C. Timing attacks on implementations of Diffie-Hellman, RSA,
marcozecchini 0:9fca2b23d0ba 332 * DSS, and other systems. In : Advances in Cryptology-CRYPTO'96. Springer
marcozecchini 0:9fca2b23d0ba 333 * Berlin Heidelberg, 1996. p. 104-113.
marcozecchini 0:9fca2b23d0ba 334 */
marcozecchini 0:9fca2b23d0ba 335 static int rsa_prepare_blinding( mbedtls_rsa_context *ctx,
marcozecchini 0:9fca2b23d0ba 336 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
marcozecchini 0:9fca2b23d0ba 337 {
marcozecchini 0:9fca2b23d0ba 338 int ret, count = 0;
marcozecchini 0:9fca2b23d0ba 339
marcozecchini 0:9fca2b23d0ba 340 if( ctx->Vf.p != NULL )
marcozecchini 0:9fca2b23d0ba 341 {
marcozecchini 0:9fca2b23d0ba 342 /* We already have blinding values, just update them by squaring */
marcozecchini 0:9fca2b23d0ba 343 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ctx->Vi, &ctx->Vi, &ctx->Vi ) );
marcozecchini 0:9fca2b23d0ba 344 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &ctx->Vi, &ctx->Vi, &ctx->N ) );
marcozecchini 0:9fca2b23d0ba 345 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ctx->Vf, &ctx->Vf, &ctx->Vf ) );
marcozecchini 0:9fca2b23d0ba 346 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &ctx->Vf, &ctx->Vf, &ctx->N ) );
marcozecchini 0:9fca2b23d0ba 347
marcozecchini 0:9fca2b23d0ba 348 goto cleanup;
marcozecchini 0:9fca2b23d0ba 349 }
marcozecchini 0:9fca2b23d0ba 350
marcozecchini 0:9fca2b23d0ba 351 /* Unblinding value: Vf = random number, invertible mod N */
marcozecchini 0:9fca2b23d0ba 352 do {
marcozecchini 0:9fca2b23d0ba 353 if( count++ > 10 )
marcozecchini 0:9fca2b23d0ba 354 return( MBEDTLS_ERR_RSA_RNG_FAILED );
marcozecchini 0:9fca2b23d0ba 355
marcozecchini 0:9fca2b23d0ba 356 MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &ctx->Vf, ctx->len - 1, f_rng, p_rng ) );
marcozecchini 0:9fca2b23d0ba 357 MBEDTLS_MPI_CHK( mbedtls_mpi_gcd( &ctx->Vi, &ctx->Vf, &ctx->N ) );
marcozecchini 0:9fca2b23d0ba 358 } while( mbedtls_mpi_cmp_int( &ctx->Vi, 1 ) != 0 );
marcozecchini 0:9fca2b23d0ba 359
marcozecchini 0:9fca2b23d0ba 360 /* Blinding value: Vi = Vf^(-e) mod N */
marcozecchini 0:9fca2b23d0ba 361 MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( &ctx->Vi, &ctx->Vf, &ctx->N ) );
marcozecchini 0:9fca2b23d0ba 362 MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &ctx->Vi, &ctx->Vi, &ctx->E, &ctx->N, &ctx->RN ) );
marcozecchini 0:9fca2b23d0ba 363
marcozecchini 0:9fca2b23d0ba 364
marcozecchini 0:9fca2b23d0ba 365 cleanup:
marcozecchini 0:9fca2b23d0ba 366 return( ret );
marcozecchini 0:9fca2b23d0ba 367 }
marcozecchini 0:9fca2b23d0ba 368
marcozecchini 0:9fca2b23d0ba 369 /*
marcozecchini 0:9fca2b23d0ba 370 * Exponent blinding supposed to prevent side-channel attacks using multiple
marcozecchini 0:9fca2b23d0ba 371 * traces of measurements to recover the RSA key. The more collisions are there,
marcozecchini 0:9fca2b23d0ba 372 * the more bits of the key can be recovered. See [3].
marcozecchini 0:9fca2b23d0ba 373 *
marcozecchini 0:9fca2b23d0ba 374 * Collecting n collisions with m bit long blinding value requires 2^(m-m/n)
marcozecchini 0:9fca2b23d0ba 375 * observations on avarage.
marcozecchini 0:9fca2b23d0ba 376 *
marcozecchini 0:9fca2b23d0ba 377 * For example with 28 byte blinding to achieve 2 collisions the adversary has
marcozecchini 0:9fca2b23d0ba 378 * to make 2^112 observations on avarage.
marcozecchini 0:9fca2b23d0ba 379 *
marcozecchini 0:9fca2b23d0ba 380 * (With the currently (as of 2017 April) known best algorithms breaking 2048
marcozecchini 0:9fca2b23d0ba 381 * bit RSA requires approximately as much time as trying out 2^112 random keys.
marcozecchini 0:9fca2b23d0ba 382 * Thus in this sense with 28 byte blinding the security is not reduced by
marcozecchini 0:9fca2b23d0ba 383 * side-channel attacks like the one in [3])
marcozecchini 0:9fca2b23d0ba 384 *
marcozecchini 0:9fca2b23d0ba 385 * This countermeasure does not help if the key recovery is possible with a
marcozecchini 0:9fca2b23d0ba 386 * single trace.
marcozecchini 0:9fca2b23d0ba 387 */
marcozecchini 0:9fca2b23d0ba 388 #define RSA_EXPONENT_BLINDING 28
marcozecchini 0:9fca2b23d0ba 389
marcozecchini 0:9fca2b23d0ba 390 /*
marcozecchini 0:9fca2b23d0ba 391 * Do an RSA private key operation
marcozecchini 0:9fca2b23d0ba 392 */
marcozecchini 0:9fca2b23d0ba 393 int mbedtls_rsa_private( mbedtls_rsa_context *ctx,
marcozecchini 0:9fca2b23d0ba 394 int (*f_rng)(void *, unsigned char *, size_t),
marcozecchini 0:9fca2b23d0ba 395 void *p_rng,
marcozecchini 0:9fca2b23d0ba 396 const unsigned char *input,
marcozecchini 0:9fca2b23d0ba 397 unsigned char *output )
marcozecchini 0:9fca2b23d0ba 398 {
marcozecchini 0:9fca2b23d0ba 399 int ret;
marcozecchini 0:9fca2b23d0ba 400 size_t olen;
marcozecchini 0:9fca2b23d0ba 401 mbedtls_mpi T, T1, T2;
marcozecchini 0:9fca2b23d0ba 402 mbedtls_mpi P1, Q1, R;
marcozecchini 0:9fca2b23d0ba 403 #if defined(MBEDTLS_RSA_NO_CRT)
marcozecchini 0:9fca2b23d0ba 404 mbedtls_mpi D_blind;
marcozecchini 0:9fca2b23d0ba 405 mbedtls_mpi *D = &ctx->D;
marcozecchini 0:9fca2b23d0ba 406 #else
marcozecchini 0:9fca2b23d0ba 407 mbedtls_mpi DP_blind, DQ_blind;
marcozecchini 0:9fca2b23d0ba 408 mbedtls_mpi *DP = &ctx->DP;
marcozecchini 0:9fca2b23d0ba 409 mbedtls_mpi *DQ = &ctx->DQ;
marcozecchini 0:9fca2b23d0ba 410 #endif
marcozecchini 0:9fca2b23d0ba 411
marcozecchini 0:9fca2b23d0ba 412 /* Make sure we have private key info, prevent possible misuse */
marcozecchini 0:9fca2b23d0ba 413 if( ctx->P.p == NULL || ctx->Q.p == NULL || ctx->D.p == NULL )
marcozecchini 0:9fca2b23d0ba 414 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
marcozecchini 0:9fca2b23d0ba 415
marcozecchini 0:9fca2b23d0ba 416 mbedtls_mpi_init( &T ); mbedtls_mpi_init( &T1 ); mbedtls_mpi_init( &T2 );
marcozecchini 0:9fca2b23d0ba 417 mbedtls_mpi_init( &P1 ); mbedtls_mpi_init( &Q1 ); mbedtls_mpi_init( &R );
marcozecchini 0:9fca2b23d0ba 418
marcozecchini 0:9fca2b23d0ba 419
marcozecchini 0:9fca2b23d0ba 420 if( f_rng != NULL )
marcozecchini 0:9fca2b23d0ba 421 {
marcozecchini 0:9fca2b23d0ba 422 #if defined(MBEDTLS_RSA_NO_CRT)
marcozecchini 0:9fca2b23d0ba 423 mbedtls_mpi_init( &D_blind );
marcozecchini 0:9fca2b23d0ba 424 #else
marcozecchini 0:9fca2b23d0ba 425 mbedtls_mpi_init( &DP_blind );
marcozecchini 0:9fca2b23d0ba 426 mbedtls_mpi_init( &DQ_blind );
marcozecchini 0:9fca2b23d0ba 427 #endif
marcozecchini 0:9fca2b23d0ba 428 }
marcozecchini 0:9fca2b23d0ba 429
marcozecchini 0:9fca2b23d0ba 430
marcozecchini 0:9fca2b23d0ba 431 #if defined(MBEDTLS_THREADING_C)
marcozecchini 0:9fca2b23d0ba 432 if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
marcozecchini 0:9fca2b23d0ba 433 return( ret );
marcozecchini 0:9fca2b23d0ba 434 #endif
marcozecchini 0:9fca2b23d0ba 435
marcozecchini 0:9fca2b23d0ba 436 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &T, input, ctx->len ) );
marcozecchini 0:9fca2b23d0ba 437 if( mbedtls_mpi_cmp_mpi( &T, &ctx->N ) >= 0 )
marcozecchini 0:9fca2b23d0ba 438 {
marcozecchini 0:9fca2b23d0ba 439 ret = MBEDTLS_ERR_MPI_BAD_INPUT_DATA;
marcozecchini 0:9fca2b23d0ba 440 goto cleanup;
marcozecchini 0:9fca2b23d0ba 441 }
marcozecchini 0:9fca2b23d0ba 442
marcozecchini 0:9fca2b23d0ba 443 if( f_rng != NULL )
marcozecchini 0:9fca2b23d0ba 444 {
marcozecchini 0:9fca2b23d0ba 445 /*
marcozecchini 0:9fca2b23d0ba 446 * Blinding
marcozecchini 0:9fca2b23d0ba 447 * T = T * Vi mod N
marcozecchini 0:9fca2b23d0ba 448 */
marcozecchini 0:9fca2b23d0ba 449 MBEDTLS_MPI_CHK( rsa_prepare_blinding( ctx, f_rng, p_rng ) );
marcozecchini 0:9fca2b23d0ba 450 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T, &T, &ctx->Vi ) );
marcozecchini 0:9fca2b23d0ba 451 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &T, &T, &ctx->N ) );
marcozecchini 0:9fca2b23d0ba 452
marcozecchini 0:9fca2b23d0ba 453 /*
marcozecchini 0:9fca2b23d0ba 454 * Exponent blinding
marcozecchini 0:9fca2b23d0ba 455 */
marcozecchini 0:9fca2b23d0ba 456 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &P1, &ctx->P, 1 ) );
marcozecchini 0:9fca2b23d0ba 457 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &Q1, &ctx->Q, 1 ) );
marcozecchini 0:9fca2b23d0ba 458
marcozecchini 0:9fca2b23d0ba 459 #if defined(MBEDTLS_RSA_NO_CRT)
marcozecchini 0:9fca2b23d0ba 460 /*
marcozecchini 0:9fca2b23d0ba 461 * D_blind = ( P - 1 ) * ( Q - 1 ) * R + D
marcozecchini 0:9fca2b23d0ba 462 */
marcozecchini 0:9fca2b23d0ba 463 MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &R, RSA_EXPONENT_BLINDING,
marcozecchini 0:9fca2b23d0ba 464 f_rng, p_rng ) );
marcozecchini 0:9fca2b23d0ba 465 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &D_blind, &P1, &Q1 ) );
marcozecchini 0:9fca2b23d0ba 466 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &D_blind, &D_blind, &R ) );
marcozecchini 0:9fca2b23d0ba 467 MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &D_blind, &D_blind, &ctx->D ) );
marcozecchini 0:9fca2b23d0ba 468
marcozecchini 0:9fca2b23d0ba 469 D = &D_blind;
marcozecchini 0:9fca2b23d0ba 470 #else
marcozecchini 0:9fca2b23d0ba 471 /*
marcozecchini 0:9fca2b23d0ba 472 * DP_blind = ( P - 1 ) * R + DP
marcozecchini 0:9fca2b23d0ba 473 */
marcozecchini 0:9fca2b23d0ba 474 MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &R, RSA_EXPONENT_BLINDING,
marcozecchini 0:9fca2b23d0ba 475 f_rng, p_rng ) );
marcozecchini 0:9fca2b23d0ba 476 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &DP_blind, &P1, &R ) );
marcozecchini 0:9fca2b23d0ba 477 MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &DP_blind, &DP_blind,
marcozecchini 0:9fca2b23d0ba 478 &ctx->DP ) );
marcozecchini 0:9fca2b23d0ba 479
marcozecchini 0:9fca2b23d0ba 480 DP = &DP_blind;
marcozecchini 0:9fca2b23d0ba 481
marcozecchini 0:9fca2b23d0ba 482 /*
marcozecchini 0:9fca2b23d0ba 483 * DQ_blind = ( Q - 1 ) * R + DQ
marcozecchini 0:9fca2b23d0ba 484 */
marcozecchini 0:9fca2b23d0ba 485 MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &R, RSA_EXPONENT_BLINDING,
marcozecchini 0:9fca2b23d0ba 486 f_rng, p_rng ) );
marcozecchini 0:9fca2b23d0ba 487 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &DQ_blind, &Q1, &R ) );
marcozecchini 0:9fca2b23d0ba 488 MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &DQ_blind, &DQ_blind,
marcozecchini 0:9fca2b23d0ba 489 &ctx->DQ ) );
marcozecchini 0:9fca2b23d0ba 490
marcozecchini 0:9fca2b23d0ba 491 DQ = &DQ_blind;
marcozecchini 0:9fca2b23d0ba 492 #endif /* MBEDTLS_RSA_NO_CRT */
marcozecchini 0:9fca2b23d0ba 493 }
marcozecchini 0:9fca2b23d0ba 494
marcozecchini 0:9fca2b23d0ba 495 #if defined(MBEDTLS_RSA_NO_CRT)
marcozecchini 0:9fca2b23d0ba 496 MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &T, &T, D, &ctx->N, &ctx->RN ) );
marcozecchini 0:9fca2b23d0ba 497 #else
marcozecchini 0:9fca2b23d0ba 498 /*
marcozecchini 0:9fca2b23d0ba 499 * Faster decryption using the CRT
marcozecchini 0:9fca2b23d0ba 500 *
marcozecchini 0:9fca2b23d0ba 501 * T1 = input ^ dP mod P
marcozecchini 0:9fca2b23d0ba 502 * T2 = input ^ dQ mod Q
marcozecchini 0:9fca2b23d0ba 503 */
marcozecchini 0:9fca2b23d0ba 504 MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &T1, &T, DP, &ctx->P, &ctx->RP ) );
marcozecchini 0:9fca2b23d0ba 505 MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &T2, &T, DQ, &ctx->Q, &ctx->RQ ) );
marcozecchini 0:9fca2b23d0ba 506
marcozecchini 0:9fca2b23d0ba 507 /*
marcozecchini 0:9fca2b23d0ba 508 * T = (T1 - T2) * (Q^-1 mod P) mod P
marcozecchini 0:9fca2b23d0ba 509 */
marcozecchini 0:9fca2b23d0ba 510 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &T, &T1, &T2 ) );
marcozecchini 0:9fca2b23d0ba 511 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T1, &T, &ctx->QP ) );
marcozecchini 0:9fca2b23d0ba 512 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &T, &T1, &ctx->P ) );
marcozecchini 0:9fca2b23d0ba 513
marcozecchini 0:9fca2b23d0ba 514 /*
marcozecchini 0:9fca2b23d0ba 515 * T = T2 + T * Q
marcozecchini 0:9fca2b23d0ba 516 */
marcozecchini 0:9fca2b23d0ba 517 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T1, &T, &ctx->Q ) );
marcozecchini 0:9fca2b23d0ba 518 MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &T, &T2, &T1 ) );
marcozecchini 0:9fca2b23d0ba 519 #endif /* MBEDTLS_RSA_NO_CRT */
marcozecchini 0:9fca2b23d0ba 520
marcozecchini 0:9fca2b23d0ba 521 if( f_rng != NULL )
marcozecchini 0:9fca2b23d0ba 522 {
marcozecchini 0:9fca2b23d0ba 523 /*
marcozecchini 0:9fca2b23d0ba 524 * Unblind
marcozecchini 0:9fca2b23d0ba 525 * T = T * Vf mod N
marcozecchini 0:9fca2b23d0ba 526 */
marcozecchini 0:9fca2b23d0ba 527 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T, &T, &ctx->Vf ) );
marcozecchini 0:9fca2b23d0ba 528 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &T, &T, &ctx->N ) );
marcozecchini 0:9fca2b23d0ba 529 }
marcozecchini 0:9fca2b23d0ba 530
marcozecchini 0:9fca2b23d0ba 531 olen = ctx->len;
marcozecchini 0:9fca2b23d0ba 532 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &T, output, olen ) );
marcozecchini 0:9fca2b23d0ba 533
marcozecchini 0:9fca2b23d0ba 534 cleanup:
marcozecchini 0:9fca2b23d0ba 535 #if defined(MBEDTLS_THREADING_C)
marcozecchini 0:9fca2b23d0ba 536 if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
marcozecchini 0:9fca2b23d0ba 537 return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
marcozecchini 0:9fca2b23d0ba 538 #endif
marcozecchini 0:9fca2b23d0ba 539
marcozecchini 0:9fca2b23d0ba 540 mbedtls_mpi_free( &T ); mbedtls_mpi_free( &T1 ); mbedtls_mpi_free( &T2 );
marcozecchini 0:9fca2b23d0ba 541 mbedtls_mpi_free( &P1 ); mbedtls_mpi_free( &Q1 ); mbedtls_mpi_free( &R );
marcozecchini 0:9fca2b23d0ba 542
marcozecchini 0:9fca2b23d0ba 543 if( f_rng != NULL )
marcozecchini 0:9fca2b23d0ba 544 {
marcozecchini 0:9fca2b23d0ba 545 #if defined(MBEDTLS_RSA_NO_CRT)
marcozecchini 0:9fca2b23d0ba 546 mbedtls_mpi_free( &D_blind );
marcozecchini 0:9fca2b23d0ba 547 #else
marcozecchini 0:9fca2b23d0ba 548 mbedtls_mpi_free( &DP_blind );
marcozecchini 0:9fca2b23d0ba 549 mbedtls_mpi_free( &DQ_blind );
marcozecchini 0:9fca2b23d0ba 550 #endif
marcozecchini 0:9fca2b23d0ba 551 }
marcozecchini 0:9fca2b23d0ba 552
marcozecchini 0:9fca2b23d0ba 553 if( ret != 0 )
marcozecchini 0:9fca2b23d0ba 554 return( MBEDTLS_ERR_RSA_PRIVATE_FAILED + ret );
marcozecchini 0:9fca2b23d0ba 555
marcozecchini 0:9fca2b23d0ba 556 return( 0 );
marcozecchini 0:9fca2b23d0ba 557 }
marcozecchini 0:9fca2b23d0ba 558
marcozecchini 0:9fca2b23d0ba 559 #if defined(MBEDTLS_PKCS1_V21)
marcozecchini 0:9fca2b23d0ba 560 /**
marcozecchini 0:9fca2b23d0ba 561 * Generate and apply the MGF1 operation (from PKCS#1 v2.1) to a buffer.
marcozecchini 0:9fca2b23d0ba 562 *
marcozecchini 0:9fca2b23d0ba 563 * \param dst buffer to mask
marcozecchini 0:9fca2b23d0ba 564 * \param dlen length of destination buffer
marcozecchini 0:9fca2b23d0ba 565 * \param src source of the mask generation
marcozecchini 0:9fca2b23d0ba 566 * \param slen length of the source buffer
marcozecchini 0:9fca2b23d0ba 567 * \param md_ctx message digest context to use
marcozecchini 0:9fca2b23d0ba 568 */
marcozecchini 0:9fca2b23d0ba 569 static void mgf_mask( unsigned char *dst, size_t dlen, unsigned char *src,
marcozecchini 0:9fca2b23d0ba 570 size_t slen, mbedtls_md_context_t *md_ctx )
marcozecchini 0:9fca2b23d0ba 571 {
marcozecchini 0:9fca2b23d0ba 572 unsigned char mask[MBEDTLS_MD_MAX_SIZE];
marcozecchini 0:9fca2b23d0ba 573 unsigned char counter[4];
marcozecchini 0:9fca2b23d0ba 574 unsigned char *p;
marcozecchini 0:9fca2b23d0ba 575 unsigned int hlen;
marcozecchini 0:9fca2b23d0ba 576 size_t i, use_len;
marcozecchini 0:9fca2b23d0ba 577
marcozecchini 0:9fca2b23d0ba 578 memset( mask, 0, MBEDTLS_MD_MAX_SIZE );
marcozecchini 0:9fca2b23d0ba 579 memset( counter, 0, 4 );
marcozecchini 0:9fca2b23d0ba 580
marcozecchini 0:9fca2b23d0ba 581 hlen = mbedtls_md_get_size( md_ctx->md_info );
marcozecchini 0:9fca2b23d0ba 582
marcozecchini 0:9fca2b23d0ba 583 /* Generate and apply dbMask */
marcozecchini 0:9fca2b23d0ba 584 p = dst;
marcozecchini 0:9fca2b23d0ba 585
marcozecchini 0:9fca2b23d0ba 586 while( dlen > 0 )
marcozecchini 0:9fca2b23d0ba 587 {
marcozecchini 0:9fca2b23d0ba 588 use_len = hlen;
marcozecchini 0:9fca2b23d0ba 589 if( dlen < hlen )
marcozecchini 0:9fca2b23d0ba 590 use_len = dlen;
marcozecchini 0:9fca2b23d0ba 591
marcozecchini 0:9fca2b23d0ba 592 mbedtls_md_starts( md_ctx );
marcozecchini 0:9fca2b23d0ba 593 mbedtls_md_update( md_ctx, src, slen );
marcozecchini 0:9fca2b23d0ba 594 mbedtls_md_update( md_ctx, counter, 4 );
marcozecchini 0:9fca2b23d0ba 595 mbedtls_md_finish( md_ctx, mask );
marcozecchini 0:9fca2b23d0ba 596
marcozecchini 0:9fca2b23d0ba 597 for( i = 0; i < use_len; ++i )
marcozecchini 0:9fca2b23d0ba 598 *p++ ^= mask[i];
marcozecchini 0:9fca2b23d0ba 599
marcozecchini 0:9fca2b23d0ba 600 counter[3]++;
marcozecchini 0:9fca2b23d0ba 601
marcozecchini 0:9fca2b23d0ba 602 dlen -= use_len;
marcozecchini 0:9fca2b23d0ba 603 }
marcozecchini 0:9fca2b23d0ba 604
marcozecchini 0:9fca2b23d0ba 605 mbedtls_zeroize( mask, sizeof( mask ) );
marcozecchini 0:9fca2b23d0ba 606 }
marcozecchini 0:9fca2b23d0ba 607 #endif /* MBEDTLS_PKCS1_V21 */
marcozecchini 0:9fca2b23d0ba 608
marcozecchini 0:9fca2b23d0ba 609 #if defined(MBEDTLS_PKCS1_V21)
marcozecchini 0:9fca2b23d0ba 610 /*
marcozecchini 0:9fca2b23d0ba 611 * Implementation of the PKCS#1 v2.1 RSAES-OAEP-ENCRYPT function
marcozecchini 0:9fca2b23d0ba 612 */
marcozecchini 0:9fca2b23d0ba 613 int mbedtls_rsa_rsaes_oaep_encrypt( mbedtls_rsa_context *ctx,
marcozecchini 0:9fca2b23d0ba 614 int (*f_rng)(void *, unsigned char *, size_t),
marcozecchini 0:9fca2b23d0ba 615 void *p_rng,
marcozecchini 0:9fca2b23d0ba 616 int mode,
marcozecchini 0:9fca2b23d0ba 617 const unsigned char *label, size_t label_len,
marcozecchini 0:9fca2b23d0ba 618 size_t ilen,
marcozecchini 0:9fca2b23d0ba 619 const unsigned char *input,
marcozecchini 0:9fca2b23d0ba 620 unsigned char *output )
marcozecchini 0:9fca2b23d0ba 621 {
marcozecchini 0:9fca2b23d0ba 622 size_t olen;
marcozecchini 0:9fca2b23d0ba 623 int ret;
marcozecchini 0:9fca2b23d0ba 624 unsigned char *p = output;
marcozecchini 0:9fca2b23d0ba 625 unsigned int hlen;
marcozecchini 0:9fca2b23d0ba 626 const mbedtls_md_info_t *md_info;
marcozecchini 0:9fca2b23d0ba 627 mbedtls_md_context_t md_ctx;
marcozecchini 0:9fca2b23d0ba 628
marcozecchini 0:9fca2b23d0ba 629 if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V21 )
marcozecchini 0:9fca2b23d0ba 630 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
marcozecchini 0:9fca2b23d0ba 631
marcozecchini 0:9fca2b23d0ba 632 if( f_rng == NULL )
marcozecchini 0:9fca2b23d0ba 633 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
marcozecchini 0:9fca2b23d0ba 634
marcozecchini 0:9fca2b23d0ba 635 md_info = mbedtls_md_info_from_type( (mbedtls_md_type_t) ctx->hash_id );
marcozecchini 0:9fca2b23d0ba 636 if( md_info == NULL )
marcozecchini 0:9fca2b23d0ba 637 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
marcozecchini 0:9fca2b23d0ba 638
marcozecchini 0:9fca2b23d0ba 639 olen = ctx->len;
marcozecchini 0:9fca2b23d0ba 640 hlen = mbedtls_md_get_size( md_info );
marcozecchini 0:9fca2b23d0ba 641
marcozecchini 0:9fca2b23d0ba 642 /* first comparison checks for overflow */
marcozecchini 0:9fca2b23d0ba 643 if( ilen + 2 * hlen + 2 < ilen || olen < ilen + 2 * hlen + 2 )
marcozecchini 0:9fca2b23d0ba 644 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
marcozecchini 0:9fca2b23d0ba 645
marcozecchini 0:9fca2b23d0ba 646 memset( output, 0, olen );
marcozecchini 0:9fca2b23d0ba 647
marcozecchini 0:9fca2b23d0ba 648 *p++ = 0;
marcozecchini 0:9fca2b23d0ba 649
marcozecchini 0:9fca2b23d0ba 650 /* Generate a random octet string seed */
marcozecchini 0:9fca2b23d0ba 651 if( ( ret = f_rng( p_rng, p, hlen ) ) != 0 )
marcozecchini 0:9fca2b23d0ba 652 return( MBEDTLS_ERR_RSA_RNG_FAILED + ret );
marcozecchini 0:9fca2b23d0ba 653
marcozecchini 0:9fca2b23d0ba 654 p += hlen;
marcozecchini 0:9fca2b23d0ba 655
marcozecchini 0:9fca2b23d0ba 656 /* Construct DB */
marcozecchini 0:9fca2b23d0ba 657 mbedtls_md( md_info, label, label_len, p );
marcozecchini 0:9fca2b23d0ba 658 p += hlen;
marcozecchini 0:9fca2b23d0ba 659 p += olen - 2 * hlen - 2 - ilen;
marcozecchini 0:9fca2b23d0ba 660 *p++ = 1;
marcozecchini 0:9fca2b23d0ba 661 memcpy( p, input, ilen );
marcozecchini 0:9fca2b23d0ba 662
marcozecchini 0:9fca2b23d0ba 663 mbedtls_md_init( &md_ctx );
marcozecchini 0:9fca2b23d0ba 664 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 0 ) ) != 0 )
marcozecchini 0:9fca2b23d0ba 665 {
marcozecchini 0:9fca2b23d0ba 666 mbedtls_md_free( &md_ctx );
marcozecchini 0:9fca2b23d0ba 667 return( ret );
marcozecchini 0:9fca2b23d0ba 668 }
marcozecchini 0:9fca2b23d0ba 669
marcozecchini 0:9fca2b23d0ba 670 /* maskedDB: Apply dbMask to DB */
marcozecchini 0:9fca2b23d0ba 671 mgf_mask( output + hlen + 1, olen - hlen - 1, output + 1, hlen,
marcozecchini 0:9fca2b23d0ba 672 &md_ctx );
marcozecchini 0:9fca2b23d0ba 673
marcozecchini 0:9fca2b23d0ba 674 /* maskedSeed: Apply seedMask to seed */
marcozecchini 0:9fca2b23d0ba 675 mgf_mask( output + 1, hlen, output + hlen + 1, olen - hlen - 1,
marcozecchini 0:9fca2b23d0ba 676 &md_ctx );
marcozecchini 0:9fca2b23d0ba 677
marcozecchini 0:9fca2b23d0ba 678 mbedtls_md_free( &md_ctx );
marcozecchini 0:9fca2b23d0ba 679
marcozecchini 0:9fca2b23d0ba 680 return( ( mode == MBEDTLS_RSA_PUBLIC )
marcozecchini 0:9fca2b23d0ba 681 ? mbedtls_rsa_public( ctx, output, output )
marcozecchini 0:9fca2b23d0ba 682 : mbedtls_rsa_private( ctx, f_rng, p_rng, output, output ) );
marcozecchini 0:9fca2b23d0ba 683 }
marcozecchini 0:9fca2b23d0ba 684 #endif /* MBEDTLS_PKCS1_V21 */
marcozecchini 0:9fca2b23d0ba 685
marcozecchini 0:9fca2b23d0ba 686 #if defined(MBEDTLS_PKCS1_V15)
marcozecchini 0:9fca2b23d0ba 687 /*
marcozecchini 0:9fca2b23d0ba 688 * Implementation of the PKCS#1 v2.1 RSAES-PKCS1-V1_5-ENCRYPT function
marcozecchini 0:9fca2b23d0ba 689 */
marcozecchini 0:9fca2b23d0ba 690 int mbedtls_rsa_rsaes_pkcs1_v15_encrypt( mbedtls_rsa_context *ctx,
marcozecchini 0:9fca2b23d0ba 691 int (*f_rng)(void *, unsigned char *, size_t),
marcozecchini 0:9fca2b23d0ba 692 void *p_rng,
marcozecchini 0:9fca2b23d0ba 693 int mode, size_t ilen,
marcozecchini 0:9fca2b23d0ba 694 const unsigned char *input,
marcozecchini 0:9fca2b23d0ba 695 unsigned char *output )
marcozecchini 0:9fca2b23d0ba 696 {
marcozecchini 0:9fca2b23d0ba 697 size_t nb_pad, olen;
marcozecchini 0:9fca2b23d0ba 698 int ret;
marcozecchini 0:9fca2b23d0ba 699 unsigned char *p = output;
marcozecchini 0:9fca2b23d0ba 700
marcozecchini 0:9fca2b23d0ba 701 if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V15 )
marcozecchini 0:9fca2b23d0ba 702 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
marcozecchini 0:9fca2b23d0ba 703
marcozecchini 0:9fca2b23d0ba 704 // We don't check p_rng because it won't be dereferenced here
marcozecchini 0:9fca2b23d0ba 705 if( f_rng == NULL || input == NULL || output == NULL )
marcozecchini 0:9fca2b23d0ba 706 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
marcozecchini 0:9fca2b23d0ba 707
marcozecchini 0:9fca2b23d0ba 708 olen = ctx->len;
marcozecchini 0:9fca2b23d0ba 709
marcozecchini 0:9fca2b23d0ba 710 /* first comparison checks for overflow */
marcozecchini 0:9fca2b23d0ba 711 if( ilen + 11 < ilen || olen < ilen + 11 )
marcozecchini 0:9fca2b23d0ba 712 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
marcozecchini 0:9fca2b23d0ba 713
marcozecchini 0:9fca2b23d0ba 714 nb_pad = olen - 3 - ilen;
marcozecchini 0:9fca2b23d0ba 715
marcozecchini 0:9fca2b23d0ba 716 *p++ = 0;
marcozecchini 0:9fca2b23d0ba 717 if( mode == MBEDTLS_RSA_PUBLIC )
marcozecchini 0:9fca2b23d0ba 718 {
marcozecchini 0:9fca2b23d0ba 719 *p++ = MBEDTLS_RSA_CRYPT;
marcozecchini 0:9fca2b23d0ba 720
marcozecchini 0:9fca2b23d0ba 721 while( nb_pad-- > 0 )
marcozecchini 0:9fca2b23d0ba 722 {
marcozecchini 0:9fca2b23d0ba 723 int rng_dl = 100;
marcozecchini 0:9fca2b23d0ba 724
marcozecchini 0:9fca2b23d0ba 725 do {
marcozecchini 0:9fca2b23d0ba 726 ret = f_rng( p_rng, p, 1 );
marcozecchini 0:9fca2b23d0ba 727 } while( *p == 0 && --rng_dl && ret == 0 );
marcozecchini 0:9fca2b23d0ba 728
marcozecchini 0:9fca2b23d0ba 729 /* Check if RNG failed to generate data */
marcozecchini 0:9fca2b23d0ba 730 if( rng_dl == 0 || ret != 0 )
marcozecchini 0:9fca2b23d0ba 731 return( MBEDTLS_ERR_RSA_RNG_FAILED + ret );
marcozecchini 0:9fca2b23d0ba 732
marcozecchini 0:9fca2b23d0ba 733 p++;
marcozecchini 0:9fca2b23d0ba 734 }
marcozecchini 0:9fca2b23d0ba 735 }
marcozecchini 0:9fca2b23d0ba 736 else
marcozecchini 0:9fca2b23d0ba 737 {
marcozecchini 0:9fca2b23d0ba 738 *p++ = MBEDTLS_RSA_SIGN;
marcozecchini 0:9fca2b23d0ba 739
marcozecchini 0:9fca2b23d0ba 740 while( nb_pad-- > 0 )
marcozecchini 0:9fca2b23d0ba 741 *p++ = 0xFF;
marcozecchini 0:9fca2b23d0ba 742 }
marcozecchini 0:9fca2b23d0ba 743
marcozecchini 0:9fca2b23d0ba 744 *p++ = 0;
marcozecchini 0:9fca2b23d0ba 745 memcpy( p, input, ilen );
marcozecchini 0:9fca2b23d0ba 746
marcozecchini 0:9fca2b23d0ba 747 return( ( mode == MBEDTLS_RSA_PUBLIC )
marcozecchini 0:9fca2b23d0ba 748 ? mbedtls_rsa_public( ctx, output, output )
marcozecchini 0:9fca2b23d0ba 749 : mbedtls_rsa_private( ctx, f_rng, p_rng, output, output ) );
marcozecchini 0:9fca2b23d0ba 750 }
marcozecchini 0:9fca2b23d0ba 751 #endif /* MBEDTLS_PKCS1_V15 */
marcozecchini 0:9fca2b23d0ba 752
marcozecchini 0:9fca2b23d0ba 753 /*
marcozecchini 0:9fca2b23d0ba 754 * Add the message padding, then do an RSA operation
marcozecchini 0:9fca2b23d0ba 755 */
marcozecchini 0:9fca2b23d0ba 756 int mbedtls_rsa_pkcs1_encrypt( mbedtls_rsa_context *ctx,
marcozecchini 0:9fca2b23d0ba 757 int (*f_rng)(void *, unsigned char *, size_t),
marcozecchini 0:9fca2b23d0ba 758 void *p_rng,
marcozecchini 0:9fca2b23d0ba 759 int mode, size_t ilen,
marcozecchini 0:9fca2b23d0ba 760 const unsigned char *input,
marcozecchini 0:9fca2b23d0ba 761 unsigned char *output )
marcozecchini 0:9fca2b23d0ba 762 {
marcozecchini 0:9fca2b23d0ba 763 switch( ctx->padding )
marcozecchini 0:9fca2b23d0ba 764 {
marcozecchini 0:9fca2b23d0ba 765 #if defined(MBEDTLS_PKCS1_V15)
marcozecchini 0:9fca2b23d0ba 766 case MBEDTLS_RSA_PKCS_V15:
marcozecchini 0:9fca2b23d0ba 767 return mbedtls_rsa_rsaes_pkcs1_v15_encrypt( ctx, f_rng, p_rng, mode, ilen,
marcozecchini 0:9fca2b23d0ba 768 input, output );
marcozecchini 0:9fca2b23d0ba 769 #endif
marcozecchini 0:9fca2b23d0ba 770
marcozecchini 0:9fca2b23d0ba 771 #if defined(MBEDTLS_PKCS1_V21)
marcozecchini 0:9fca2b23d0ba 772 case MBEDTLS_RSA_PKCS_V21:
marcozecchini 0:9fca2b23d0ba 773 return mbedtls_rsa_rsaes_oaep_encrypt( ctx, f_rng, p_rng, mode, NULL, 0,
marcozecchini 0:9fca2b23d0ba 774 ilen, input, output );
marcozecchini 0:9fca2b23d0ba 775 #endif
marcozecchini 0:9fca2b23d0ba 776
marcozecchini 0:9fca2b23d0ba 777 default:
marcozecchini 0:9fca2b23d0ba 778 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
marcozecchini 0:9fca2b23d0ba 779 }
marcozecchini 0:9fca2b23d0ba 780 }
marcozecchini 0:9fca2b23d0ba 781
marcozecchini 0:9fca2b23d0ba 782 #if defined(MBEDTLS_PKCS1_V21)
marcozecchini 0:9fca2b23d0ba 783 /*
marcozecchini 0:9fca2b23d0ba 784 * Implementation of the PKCS#1 v2.1 RSAES-OAEP-DECRYPT function
marcozecchini 0:9fca2b23d0ba 785 */
marcozecchini 0:9fca2b23d0ba 786 int mbedtls_rsa_rsaes_oaep_decrypt( mbedtls_rsa_context *ctx,
marcozecchini 0:9fca2b23d0ba 787 int (*f_rng)(void *, unsigned char *, size_t),
marcozecchini 0:9fca2b23d0ba 788 void *p_rng,
marcozecchini 0:9fca2b23d0ba 789 int mode,
marcozecchini 0:9fca2b23d0ba 790 const unsigned char *label, size_t label_len,
marcozecchini 0:9fca2b23d0ba 791 size_t *olen,
marcozecchini 0:9fca2b23d0ba 792 const unsigned char *input,
marcozecchini 0:9fca2b23d0ba 793 unsigned char *output,
marcozecchini 0:9fca2b23d0ba 794 size_t output_max_len )
marcozecchini 0:9fca2b23d0ba 795 {
marcozecchini 0:9fca2b23d0ba 796 int ret;
marcozecchini 0:9fca2b23d0ba 797 size_t ilen, i, pad_len;
marcozecchini 0:9fca2b23d0ba 798 unsigned char *p, bad, pad_done;
marcozecchini 0:9fca2b23d0ba 799 unsigned char buf[MBEDTLS_MPI_MAX_SIZE];
marcozecchini 0:9fca2b23d0ba 800 unsigned char lhash[MBEDTLS_MD_MAX_SIZE];
marcozecchini 0:9fca2b23d0ba 801 unsigned int hlen;
marcozecchini 0:9fca2b23d0ba 802 const mbedtls_md_info_t *md_info;
marcozecchini 0:9fca2b23d0ba 803 mbedtls_md_context_t md_ctx;
marcozecchini 0:9fca2b23d0ba 804
marcozecchini 0:9fca2b23d0ba 805 /*
marcozecchini 0:9fca2b23d0ba 806 * Parameters sanity checks
marcozecchini 0:9fca2b23d0ba 807 */
marcozecchini 0:9fca2b23d0ba 808 if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V21 )
marcozecchini 0:9fca2b23d0ba 809 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
marcozecchini 0:9fca2b23d0ba 810
marcozecchini 0:9fca2b23d0ba 811 ilen = ctx->len;
marcozecchini 0:9fca2b23d0ba 812
marcozecchini 0:9fca2b23d0ba 813 if( ilen < 16 || ilen > sizeof( buf ) )
marcozecchini 0:9fca2b23d0ba 814 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
marcozecchini 0:9fca2b23d0ba 815
marcozecchini 0:9fca2b23d0ba 816 md_info = mbedtls_md_info_from_type( (mbedtls_md_type_t) ctx->hash_id );
marcozecchini 0:9fca2b23d0ba 817 if( md_info == NULL )
marcozecchini 0:9fca2b23d0ba 818 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
marcozecchini 0:9fca2b23d0ba 819
marcozecchini 0:9fca2b23d0ba 820 hlen = mbedtls_md_get_size( md_info );
marcozecchini 0:9fca2b23d0ba 821
marcozecchini 0:9fca2b23d0ba 822 // checking for integer underflow
marcozecchini 0:9fca2b23d0ba 823 if( 2 * hlen + 2 > ilen )
marcozecchini 0:9fca2b23d0ba 824 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
marcozecchini 0:9fca2b23d0ba 825
marcozecchini 0:9fca2b23d0ba 826 /*
marcozecchini 0:9fca2b23d0ba 827 * RSA operation
marcozecchini 0:9fca2b23d0ba 828 */
marcozecchini 0:9fca2b23d0ba 829 ret = ( mode == MBEDTLS_RSA_PUBLIC )
marcozecchini 0:9fca2b23d0ba 830 ? mbedtls_rsa_public( ctx, input, buf )
marcozecchini 0:9fca2b23d0ba 831 : mbedtls_rsa_private( ctx, f_rng, p_rng, input, buf );
marcozecchini 0:9fca2b23d0ba 832
marcozecchini 0:9fca2b23d0ba 833 if( ret != 0 )
marcozecchini 0:9fca2b23d0ba 834 goto cleanup;
marcozecchini 0:9fca2b23d0ba 835
marcozecchini 0:9fca2b23d0ba 836 /*
marcozecchini 0:9fca2b23d0ba 837 * Unmask data and generate lHash
marcozecchini 0:9fca2b23d0ba 838 */
marcozecchini 0:9fca2b23d0ba 839 mbedtls_md_init( &md_ctx );
marcozecchini 0:9fca2b23d0ba 840 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 0 ) ) != 0 )
marcozecchini 0:9fca2b23d0ba 841 {
marcozecchini 0:9fca2b23d0ba 842 mbedtls_md_free( &md_ctx );
marcozecchini 0:9fca2b23d0ba 843 goto cleanup;
marcozecchini 0:9fca2b23d0ba 844 }
marcozecchini 0:9fca2b23d0ba 845
marcozecchini 0:9fca2b23d0ba 846
marcozecchini 0:9fca2b23d0ba 847 /* Generate lHash */
marcozecchini 0:9fca2b23d0ba 848 mbedtls_md( md_info, label, label_len, lhash );
marcozecchini 0:9fca2b23d0ba 849
marcozecchini 0:9fca2b23d0ba 850 /* seed: Apply seedMask to maskedSeed */
marcozecchini 0:9fca2b23d0ba 851 mgf_mask( buf + 1, hlen, buf + hlen + 1, ilen - hlen - 1,
marcozecchini 0:9fca2b23d0ba 852 &md_ctx );
marcozecchini 0:9fca2b23d0ba 853
marcozecchini 0:9fca2b23d0ba 854 /* DB: Apply dbMask to maskedDB */
marcozecchini 0:9fca2b23d0ba 855 mgf_mask( buf + hlen + 1, ilen - hlen - 1, buf + 1, hlen,
marcozecchini 0:9fca2b23d0ba 856 &md_ctx );
marcozecchini 0:9fca2b23d0ba 857
marcozecchini 0:9fca2b23d0ba 858 mbedtls_md_free( &md_ctx );
marcozecchini 0:9fca2b23d0ba 859
marcozecchini 0:9fca2b23d0ba 860 /*
marcozecchini 0:9fca2b23d0ba 861 * Check contents, in "constant-time"
marcozecchini 0:9fca2b23d0ba 862 */
marcozecchini 0:9fca2b23d0ba 863 p = buf;
marcozecchini 0:9fca2b23d0ba 864 bad = 0;
marcozecchini 0:9fca2b23d0ba 865
marcozecchini 0:9fca2b23d0ba 866 bad |= *p++; /* First byte must be 0 */
marcozecchini 0:9fca2b23d0ba 867
marcozecchini 0:9fca2b23d0ba 868 p += hlen; /* Skip seed */
marcozecchini 0:9fca2b23d0ba 869
marcozecchini 0:9fca2b23d0ba 870 /* Check lHash */
marcozecchini 0:9fca2b23d0ba 871 for( i = 0; i < hlen; i++ )
marcozecchini 0:9fca2b23d0ba 872 bad |= lhash[i] ^ *p++;
marcozecchini 0:9fca2b23d0ba 873
marcozecchini 0:9fca2b23d0ba 874 /* Get zero-padding len, but always read till end of buffer
marcozecchini 0:9fca2b23d0ba 875 * (minus one, for the 01 byte) */
marcozecchini 0:9fca2b23d0ba 876 pad_len = 0;
marcozecchini 0:9fca2b23d0ba 877 pad_done = 0;
marcozecchini 0:9fca2b23d0ba 878 for( i = 0; i < ilen - 2 * hlen - 2; i++ )
marcozecchini 0:9fca2b23d0ba 879 {
marcozecchini 0:9fca2b23d0ba 880 pad_done |= p[i];
marcozecchini 0:9fca2b23d0ba 881 pad_len += ((pad_done | (unsigned char)-pad_done) >> 7) ^ 1;
marcozecchini 0:9fca2b23d0ba 882 }
marcozecchini 0:9fca2b23d0ba 883
marcozecchini 0:9fca2b23d0ba 884 p += pad_len;
marcozecchini 0:9fca2b23d0ba 885 bad |= *p++ ^ 0x01;
marcozecchini 0:9fca2b23d0ba 886
marcozecchini 0:9fca2b23d0ba 887 /*
marcozecchini 0:9fca2b23d0ba 888 * The only information "leaked" is whether the padding was correct or not
marcozecchini 0:9fca2b23d0ba 889 * (eg, no data is copied if it was not correct). This meets the
marcozecchini 0:9fca2b23d0ba 890 * recommendations in PKCS#1 v2.2: an opponent cannot distinguish between
marcozecchini 0:9fca2b23d0ba 891 * the different error conditions.
marcozecchini 0:9fca2b23d0ba 892 */
marcozecchini 0:9fca2b23d0ba 893 if( bad != 0 )
marcozecchini 0:9fca2b23d0ba 894 {
marcozecchini 0:9fca2b23d0ba 895 ret = MBEDTLS_ERR_RSA_INVALID_PADDING;
marcozecchini 0:9fca2b23d0ba 896 goto cleanup;
marcozecchini 0:9fca2b23d0ba 897 }
marcozecchini 0:9fca2b23d0ba 898
marcozecchini 0:9fca2b23d0ba 899 if( ilen - ( p - buf ) > output_max_len )
marcozecchini 0:9fca2b23d0ba 900 {
marcozecchini 0:9fca2b23d0ba 901 ret = MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE;
marcozecchini 0:9fca2b23d0ba 902 goto cleanup;
marcozecchini 0:9fca2b23d0ba 903 }
marcozecchini 0:9fca2b23d0ba 904
marcozecchini 0:9fca2b23d0ba 905 *olen = ilen - (p - buf);
marcozecchini 0:9fca2b23d0ba 906 memcpy( output, p, *olen );
marcozecchini 0:9fca2b23d0ba 907 ret = 0;
marcozecchini 0:9fca2b23d0ba 908
marcozecchini 0:9fca2b23d0ba 909 cleanup:
marcozecchini 0:9fca2b23d0ba 910 mbedtls_zeroize( buf, sizeof( buf ) );
marcozecchini 0:9fca2b23d0ba 911 mbedtls_zeroize( lhash, sizeof( lhash ) );
marcozecchini 0:9fca2b23d0ba 912
marcozecchini 0:9fca2b23d0ba 913 return( ret );
marcozecchini 0:9fca2b23d0ba 914 }
marcozecchini 0:9fca2b23d0ba 915 #endif /* MBEDTLS_PKCS1_V21 */
marcozecchini 0:9fca2b23d0ba 916
marcozecchini 0:9fca2b23d0ba 917 #if defined(MBEDTLS_PKCS1_V15)
marcozecchini 0:9fca2b23d0ba 918 /*
marcozecchini 0:9fca2b23d0ba 919 * Implementation of the PKCS#1 v2.1 RSAES-PKCS1-V1_5-DECRYPT function
marcozecchini 0:9fca2b23d0ba 920 */
marcozecchini 0:9fca2b23d0ba 921 int mbedtls_rsa_rsaes_pkcs1_v15_decrypt( mbedtls_rsa_context *ctx,
marcozecchini 0:9fca2b23d0ba 922 int (*f_rng)(void *, unsigned char *, size_t),
marcozecchini 0:9fca2b23d0ba 923 void *p_rng,
marcozecchini 0:9fca2b23d0ba 924 int mode, size_t *olen,
marcozecchini 0:9fca2b23d0ba 925 const unsigned char *input,
marcozecchini 0:9fca2b23d0ba 926 unsigned char *output,
marcozecchini 0:9fca2b23d0ba 927 size_t output_max_len)
marcozecchini 0:9fca2b23d0ba 928 {
marcozecchini 0:9fca2b23d0ba 929 int ret;
marcozecchini 0:9fca2b23d0ba 930 size_t ilen, pad_count = 0, i;
marcozecchini 0:9fca2b23d0ba 931 unsigned char *p, bad, pad_done = 0;
marcozecchini 0:9fca2b23d0ba 932 unsigned char buf[MBEDTLS_MPI_MAX_SIZE];
marcozecchini 0:9fca2b23d0ba 933
marcozecchini 0:9fca2b23d0ba 934 if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V15 )
marcozecchini 0:9fca2b23d0ba 935 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
marcozecchini 0:9fca2b23d0ba 936
marcozecchini 0:9fca2b23d0ba 937 ilen = ctx->len;
marcozecchini 0:9fca2b23d0ba 938
marcozecchini 0:9fca2b23d0ba 939 if( ilen < 16 || ilen > sizeof( buf ) )
marcozecchini 0:9fca2b23d0ba 940 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
marcozecchini 0:9fca2b23d0ba 941
marcozecchini 0:9fca2b23d0ba 942 ret = ( mode == MBEDTLS_RSA_PUBLIC )
marcozecchini 0:9fca2b23d0ba 943 ? mbedtls_rsa_public( ctx, input, buf )
marcozecchini 0:9fca2b23d0ba 944 : mbedtls_rsa_private( ctx, f_rng, p_rng, input, buf );
marcozecchini 0:9fca2b23d0ba 945
marcozecchini 0:9fca2b23d0ba 946 if( ret != 0 )
marcozecchini 0:9fca2b23d0ba 947 goto cleanup;
marcozecchini 0:9fca2b23d0ba 948
marcozecchini 0:9fca2b23d0ba 949 p = buf;
marcozecchini 0:9fca2b23d0ba 950 bad = 0;
marcozecchini 0:9fca2b23d0ba 951
marcozecchini 0:9fca2b23d0ba 952 /*
marcozecchini 0:9fca2b23d0ba 953 * Check and get padding len in "constant-time"
marcozecchini 0:9fca2b23d0ba 954 */
marcozecchini 0:9fca2b23d0ba 955 bad |= *p++; /* First byte must be 0 */
marcozecchini 0:9fca2b23d0ba 956
marcozecchini 0:9fca2b23d0ba 957 /* This test does not depend on secret data */
marcozecchini 0:9fca2b23d0ba 958 if( mode == MBEDTLS_RSA_PRIVATE )
marcozecchini 0:9fca2b23d0ba 959 {
marcozecchini 0:9fca2b23d0ba 960 bad |= *p++ ^ MBEDTLS_RSA_CRYPT;
marcozecchini 0:9fca2b23d0ba 961
marcozecchini 0:9fca2b23d0ba 962 /* Get padding len, but always read till end of buffer
marcozecchini 0:9fca2b23d0ba 963 * (minus one, for the 00 byte) */
marcozecchini 0:9fca2b23d0ba 964 for( i = 0; i < ilen - 3; i++ )
marcozecchini 0:9fca2b23d0ba 965 {
marcozecchini 0:9fca2b23d0ba 966 pad_done |= ((p[i] | (unsigned char)-p[i]) >> 7) ^ 1;
marcozecchini 0:9fca2b23d0ba 967 pad_count += ((pad_done | (unsigned char)-pad_done) >> 7) ^ 1;
marcozecchini 0:9fca2b23d0ba 968 }
marcozecchini 0:9fca2b23d0ba 969
marcozecchini 0:9fca2b23d0ba 970 p += pad_count;
marcozecchini 0:9fca2b23d0ba 971 bad |= *p++; /* Must be zero */
marcozecchini 0:9fca2b23d0ba 972 }
marcozecchini 0:9fca2b23d0ba 973 else
marcozecchini 0:9fca2b23d0ba 974 {
marcozecchini 0:9fca2b23d0ba 975 bad |= *p++ ^ MBEDTLS_RSA_SIGN;
marcozecchini 0:9fca2b23d0ba 976
marcozecchini 0:9fca2b23d0ba 977 /* Get padding len, but always read till end of buffer
marcozecchini 0:9fca2b23d0ba 978 * (minus one, for the 00 byte) */
marcozecchini 0:9fca2b23d0ba 979 for( i = 0; i < ilen - 3; i++ )
marcozecchini 0:9fca2b23d0ba 980 {
marcozecchini 0:9fca2b23d0ba 981 pad_done |= ( p[i] != 0xFF );
marcozecchini 0:9fca2b23d0ba 982 pad_count += ( pad_done == 0 );
marcozecchini 0:9fca2b23d0ba 983 }
marcozecchini 0:9fca2b23d0ba 984
marcozecchini 0:9fca2b23d0ba 985 p += pad_count;
marcozecchini 0:9fca2b23d0ba 986 bad |= *p++; /* Must be zero */
marcozecchini 0:9fca2b23d0ba 987 }
marcozecchini 0:9fca2b23d0ba 988
marcozecchini 0:9fca2b23d0ba 989 bad |= ( pad_count < 8 );
marcozecchini 0:9fca2b23d0ba 990
marcozecchini 0:9fca2b23d0ba 991 if( bad )
marcozecchini 0:9fca2b23d0ba 992 {
marcozecchini 0:9fca2b23d0ba 993 ret = MBEDTLS_ERR_RSA_INVALID_PADDING;
marcozecchini 0:9fca2b23d0ba 994 goto cleanup;
marcozecchini 0:9fca2b23d0ba 995 }
marcozecchini 0:9fca2b23d0ba 996
marcozecchini 0:9fca2b23d0ba 997 if( ilen - ( p - buf ) > output_max_len )
marcozecchini 0:9fca2b23d0ba 998 {
marcozecchini 0:9fca2b23d0ba 999 ret = MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE;
marcozecchini 0:9fca2b23d0ba 1000 goto cleanup;
marcozecchini 0:9fca2b23d0ba 1001 }
marcozecchini 0:9fca2b23d0ba 1002
marcozecchini 0:9fca2b23d0ba 1003 *olen = ilen - (p - buf);
marcozecchini 0:9fca2b23d0ba 1004 memcpy( output, p, *olen );
marcozecchini 0:9fca2b23d0ba 1005 ret = 0;
marcozecchini 0:9fca2b23d0ba 1006
marcozecchini 0:9fca2b23d0ba 1007 cleanup:
marcozecchini 0:9fca2b23d0ba 1008 mbedtls_zeroize( buf, sizeof( buf ) );
marcozecchini 0:9fca2b23d0ba 1009
marcozecchini 0:9fca2b23d0ba 1010 return( ret );
marcozecchini 0:9fca2b23d0ba 1011 }
marcozecchini 0:9fca2b23d0ba 1012 #endif /* MBEDTLS_PKCS1_V15 */
marcozecchini 0:9fca2b23d0ba 1013
marcozecchini 0:9fca2b23d0ba 1014 /*
marcozecchini 0:9fca2b23d0ba 1015 * Do an RSA operation, then remove the message padding
marcozecchini 0:9fca2b23d0ba 1016 */
marcozecchini 0:9fca2b23d0ba 1017 int mbedtls_rsa_pkcs1_decrypt( mbedtls_rsa_context *ctx,
marcozecchini 0:9fca2b23d0ba 1018 int (*f_rng)(void *, unsigned char *, size_t),
marcozecchini 0:9fca2b23d0ba 1019 void *p_rng,
marcozecchini 0:9fca2b23d0ba 1020 int mode, size_t *olen,
marcozecchini 0:9fca2b23d0ba 1021 const unsigned char *input,
marcozecchini 0:9fca2b23d0ba 1022 unsigned char *output,
marcozecchini 0:9fca2b23d0ba 1023 size_t output_max_len)
marcozecchini 0:9fca2b23d0ba 1024 {
marcozecchini 0:9fca2b23d0ba 1025 switch( ctx->padding )
marcozecchini 0:9fca2b23d0ba 1026 {
marcozecchini 0:9fca2b23d0ba 1027 #if defined(MBEDTLS_PKCS1_V15)
marcozecchini 0:9fca2b23d0ba 1028 case MBEDTLS_RSA_PKCS_V15:
marcozecchini 0:9fca2b23d0ba 1029 return mbedtls_rsa_rsaes_pkcs1_v15_decrypt( ctx, f_rng, p_rng, mode, olen,
marcozecchini 0:9fca2b23d0ba 1030 input, output, output_max_len );
marcozecchini 0:9fca2b23d0ba 1031 #endif
marcozecchini 0:9fca2b23d0ba 1032
marcozecchini 0:9fca2b23d0ba 1033 #if defined(MBEDTLS_PKCS1_V21)
marcozecchini 0:9fca2b23d0ba 1034 case MBEDTLS_RSA_PKCS_V21:
marcozecchini 0:9fca2b23d0ba 1035 return mbedtls_rsa_rsaes_oaep_decrypt( ctx, f_rng, p_rng, mode, NULL, 0,
marcozecchini 0:9fca2b23d0ba 1036 olen, input, output,
marcozecchini 0:9fca2b23d0ba 1037 output_max_len );
marcozecchini 0:9fca2b23d0ba 1038 #endif
marcozecchini 0:9fca2b23d0ba 1039
marcozecchini 0:9fca2b23d0ba 1040 default:
marcozecchini 0:9fca2b23d0ba 1041 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
marcozecchini 0:9fca2b23d0ba 1042 }
marcozecchini 0:9fca2b23d0ba 1043 }
marcozecchini 0:9fca2b23d0ba 1044
marcozecchini 0:9fca2b23d0ba 1045 #if defined(MBEDTLS_PKCS1_V21)
marcozecchini 0:9fca2b23d0ba 1046 /*
marcozecchini 0:9fca2b23d0ba 1047 * Implementation of the PKCS#1 v2.1 RSASSA-PSS-SIGN function
marcozecchini 0:9fca2b23d0ba 1048 */
marcozecchini 0:9fca2b23d0ba 1049 int mbedtls_rsa_rsassa_pss_sign( mbedtls_rsa_context *ctx,
marcozecchini 0:9fca2b23d0ba 1050 int (*f_rng)(void *, unsigned char *, size_t),
marcozecchini 0:9fca2b23d0ba 1051 void *p_rng,
marcozecchini 0:9fca2b23d0ba 1052 int mode,
marcozecchini 0:9fca2b23d0ba 1053 mbedtls_md_type_t md_alg,
marcozecchini 0:9fca2b23d0ba 1054 unsigned int hashlen,
marcozecchini 0:9fca2b23d0ba 1055 const unsigned char *hash,
marcozecchini 0:9fca2b23d0ba 1056 unsigned char *sig )
marcozecchini 0:9fca2b23d0ba 1057 {
marcozecchini 0:9fca2b23d0ba 1058 size_t olen;
marcozecchini 0:9fca2b23d0ba 1059 unsigned char *p = sig;
marcozecchini 0:9fca2b23d0ba 1060 unsigned char salt[MBEDTLS_MD_MAX_SIZE];
marcozecchini 0:9fca2b23d0ba 1061 unsigned int slen, hlen, offset = 0;
marcozecchini 0:9fca2b23d0ba 1062 int ret;
marcozecchini 0:9fca2b23d0ba 1063 size_t msb;
marcozecchini 0:9fca2b23d0ba 1064 const mbedtls_md_info_t *md_info;
marcozecchini 0:9fca2b23d0ba 1065 mbedtls_md_context_t md_ctx;
marcozecchini 0:9fca2b23d0ba 1066
marcozecchini 0:9fca2b23d0ba 1067 if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V21 )
marcozecchini 0:9fca2b23d0ba 1068 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
marcozecchini 0:9fca2b23d0ba 1069
marcozecchini 0:9fca2b23d0ba 1070 if( f_rng == NULL )
marcozecchini 0:9fca2b23d0ba 1071 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
marcozecchini 0:9fca2b23d0ba 1072
marcozecchini 0:9fca2b23d0ba 1073 olen = ctx->len;
marcozecchini 0:9fca2b23d0ba 1074
marcozecchini 0:9fca2b23d0ba 1075 if( md_alg != MBEDTLS_MD_NONE )
marcozecchini 0:9fca2b23d0ba 1076 {
marcozecchini 0:9fca2b23d0ba 1077 /* Gather length of hash to sign */
marcozecchini 0:9fca2b23d0ba 1078 md_info = mbedtls_md_info_from_type( md_alg );
marcozecchini 0:9fca2b23d0ba 1079 if( md_info == NULL )
marcozecchini 0:9fca2b23d0ba 1080 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
marcozecchini 0:9fca2b23d0ba 1081
marcozecchini 0:9fca2b23d0ba 1082 hashlen = mbedtls_md_get_size( md_info );
marcozecchini 0:9fca2b23d0ba 1083 }
marcozecchini 0:9fca2b23d0ba 1084
marcozecchini 0:9fca2b23d0ba 1085 md_info = mbedtls_md_info_from_type( (mbedtls_md_type_t) ctx->hash_id );
marcozecchini 0:9fca2b23d0ba 1086 if( md_info == NULL )
marcozecchini 0:9fca2b23d0ba 1087 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
marcozecchini 0:9fca2b23d0ba 1088
marcozecchini 0:9fca2b23d0ba 1089 hlen = mbedtls_md_get_size( md_info );
marcozecchini 0:9fca2b23d0ba 1090 slen = hlen;
marcozecchini 0:9fca2b23d0ba 1091
marcozecchini 0:9fca2b23d0ba 1092 if( olen < hlen + slen + 2 )
marcozecchini 0:9fca2b23d0ba 1093 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
marcozecchini 0:9fca2b23d0ba 1094
marcozecchini 0:9fca2b23d0ba 1095 memset( sig, 0, olen );
marcozecchini 0:9fca2b23d0ba 1096
marcozecchini 0:9fca2b23d0ba 1097 /* Generate salt of length slen */
marcozecchini 0:9fca2b23d0ba 1098 if( ( ret = f_rng( p_rng, salt, slen ) ) != 0 )
marcozecchini 0:9fca2b23d0ba 1099 return( MBEDTLS_ERR_RSA_RNG_FAILED + ret );
marcozecchini 0:9fca2b23d0ba 1100
marcozecchini 0:9fca2b23d0ba 1101 /* Note: EMSA-PSS encoding is over the length of N - 1 bits */
marcozecchini 0:9fca2b23d0ba 1102 msb = mbedtls_mpi_bitlen( &ctx->N ) - 1;
marcozecchini 0:9fca2b23d0ba 1103 p += olen - hlen * 2 - 2;
marcozecchini 0:9fca2b23d0ba 1104 *p++ = 0x01;
marcozecchini 0:9fca2b23d0ba 1105 memcpy( p, salt, slen );
marcozecchini 0:9fca2b23d0ba 1106 p += slen;
marcozecchini 0:9fca2b23d0ba 1107
marcozecchini 0:9fca2b23d0ba 1108 mbedtls_md_init( &md_ctx );
marcozecchini 0:9fca2b23d0ba 1109 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 0 ) ) != 0 )
marcozecchini 0:9fca2b23d0ba 1110 {
marcozecchini 0:9fca2b23d0ba 1111 mbedtls_md_free( &md_ctx );
marcozecchini 0:9fca2b23d0ba 1112 /* No need to zeroize salt: we didn't use it. */
marcozecchini 0:9fca2b23d0ba 1113 return( ret );
marcozecchini 0:9fca2b23d0ba 1114 }
marcozecchini 0:9fca2b23d0ba 1115
marcozecchini 0:9fca2b23d0ba 1116 /* Generate H = Hash( M' ) */
marcozecchini 0:9fca2b23d0ba 1117 mbedtls_md_starts( &md_ctx );
marcozecchini 0:9fca2b23d0ba 1118 mbedtls_md_update( &md_ctx, p, 8 );
marcozecchini 0:9fca2b23d0ba 1119 mbedtls_md_update( &md_ctx, hash, hashlen );
marcozecchini 0:9fca2b23d0ba 1120 mbedtls_md_update( &md_ctx, salt, slen );
marcozecchini 0:9fca2b23d0ba 1121 mbedtls_md_finish( &md_ctx, p );
marcozecchini 0:9fca2b23d0ba 1122 mbedtls_zeroize( salt, sizeof( salt ) );
marcozecchini 0:9fca2b23d0ba 1123
marcozecchini 0:9fca2b23d0ba 1124 /* Compensate for boundary condition when applying mask */
marcozecchini 0:9fca2b23d0ba 1125 if( msb % 8 == 0 )
marcozecchini 0:9fca2b23d0ba 1126 offset = 1;
marcozecchini 0:9fca2b23d0ba 1127
marcozecchini 0:9fca2b23d0ba 1128 /* maskedDB: Apply dbMask to DB */
marcozecchini 0:9fca2b23d0ba 1129 mgf_mask( sig + offset, olen - hlen - 1 - offset, p, hlen, &md_ctx );
marcozecchini 0:9fca2b23d0ba 1130
marcozecchini 0:9fca2b23d0ba 1131 mbedtls_md_free( &md_ctx );
marcozecchini 0:9fca2b23d0ba 1132
marcozecchini 0:9fca2b23d0ba 1133 msb = mbedtls_mpi_bitlen( &ctx->N ) - 1;
marcozecchini 0:9fca2b23d0ba 1134 sig[0] &= 0xFF >> ( olen * 8 - msb );
marcozecchini 0:9fca2b23d0ba 1135
marcozecchini 0:9fca2b23d0ba 1136 p += hlen;
marcozecchini 0:9fca2b23d0ba 1137 *p++ = 0xBC;
marcozecchini 0:9fca2b23d0ba 1138
marcozecchini 0:9fca2b23d0ba 1139 return( ( mode == MBEDTLS_RSA_PUBLIC )
marcozecchini 0:9fca2b23d0ba 1140 ? mbedtls_rsa_public( ctx, sig, sig )
marcozecchini 0:9fca2b23d0ba 1141 : mbedtls_rsa_private( ctx, f_rng, p_rng, sig, sig ) );
marcozecchini 0:9fca2b23d0ba 1142 }
marcozecchini 0:9fca2b23d0ba 1143 #endif /* MBEDTLS_PKCS1_V21 */
marcozecchini 0:9fca2b23d0ba 1144
marcozecchini 0:9fca2b23d0ba 1145 #if defined(MBEDTLS_PKCS1_V15)
marcozecchini 0:9fca2b23d0ba 1146 /*
marcozecchini 0:9fca2b23d0ba 1147 * Implementation of the PKCS#1 v2.1 RSASSA-PKCS1-V1_5-SIGN function
marcozecchini 0:9fca2b23d0ba 1148 */
marcozecchini 0:9fca2b23d0ba 1149 /*
marcozecchini 0:9fca2b23d0ba 1150 * Do an RSA operation to sign the message digest
marcozecchini 0:9fca2b23d0ba 1151 */
marcozecchini 0:9fca2b23d0ba 1152 int mbedtls_rsa_rsassa_pkcs1_v15_sign( mbedtls_rsa_context *ctx,
marcozecchini 0:9fca2b23d0ba 1153 int (*f_rng)(void *, unsigned char *, size_t),
marcozecchini 0:9fca2b23d0ba 1154 void *p_rng,
marcozecchini 0:9fca2b23d0ba 1155 int mode,
marcozecchini 0:9fca2b23d0ba 1156 mbedtls_md_type_t md_alg,
marcozecchini 0:9fca2b23d0ba 1157 unsigned int hashlen,
marcozecchini 0:9fca2b23d0ba 1158 const unsigned char *hash,
marcozecchini 0:9fca2b23d0ba 1159 unsigned char *sig )
marcozecchini 0:9fca2b23d0ba 1160 {
marcozecchini 0:9fca2b23d0ba 1161 size_t nb_pad, olen, oid_size = 0;
marcozecchini 0:9fca2b23d0ba 1162 unsigned char *p = sig;
marcozecchini 0:9fca2b23d0ba 1163 const char *oid = NULL;
marcozecchini 0:9fca2b23d0ba 1164 unsigned char *sig_try = NULL, *verif = NULL;
marcozecchini 0:9fca2b23d0ba 1165 size_t i;
marcozecchini 0:9fca2b23d0ba 1166 unsigned char diff;
marcozecchini 0:9fca2b23d0ba 1167 volatile unsigned char diff_no_optimize;
marcozecchini 0:9fca2b23d0ba 1168 int ret;
marcozecchini 0:9fca2b23d0ba 1169
marcozecchini 0:9fca2b23d0ba 1170 if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V15 )
marcozecchini 0:9fca2b23d0ba 1171 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
marcozecchini 0:9fca2b23d0ba 1172
marcozecchini 0:9fca2b23d0ba 1173 olen = ctx->len;
marcozecchini 0:9fca2b23d0ba 1174 nb_pad = olen - 3;
marcozecchini 0:9fca2b23d0ba 1175
marcozecchini 0:9fca2b23d0ba 1176 if( md_alg != MBEDTLS_MD_NONE )
marcozecchini 0:9fca2b23d0ba 1177 {
marcozecchini 0:9fca2b23d0ba 1178 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type( md_alg );
marcozecchini 0:9fca2b23d0ba 1179 if( md_info == NULL )
marcozecchini 0:9fca2b23d0ba 1180 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
marcozecchini 0:9fca2b23d0ba 1181
marcozecchini 0:9fca2b23d0ba 1182 if( mbedtls_oid_get_oid_by_md( md_alg, &oid, &oid_size ) != 0 )
marcozecchini 0:9fca2b23d0ba 1183 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
marcozecchini 0:9fca2b23d0ba 1184
marcozecchini 0:9fca2b23d0ba 1185 nb_pad -= 10 + oid_size;
marcozecchini 0:9fca2b23d0ba 1186
marcozecchini 0:9fca2b23d0ba 1187 hashlen = mbedtls_md_get_size( md_info );
marcozecchini 0:9fca2b23d0ba 1188 }
marcozecchini 0:9fca2b23d0ba 1189
marcozecchini 0:9fca2b23d0ba 1190 nb_pad -= hashlen;
marcozecchini 0:9fca2b23d0ba 1191
marcozecchini 0:9fca2b23d0ba 1192 if( ( nb_pad < 8 ) || ( nb_pad > olen ) )
marcozecchini 0:9fca2b23d0ba 1193 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
marcozecchini 0:9fca2b23d0ba 1194
marcozecchini 0:9fca2b23d0ba 1195 *p++ = 0;
marcozecchini 0:9fca2b23d0ba 1196 *p++ = MBEDTLS_RSA_SIGN;
marcozecchini 0:9fca2b23d0ba 1197 memset( p, 0xFF, nb_pad );
marcozecchini 0:9fca2b23d0ba 1198 p += nb_pad;
marcozecchini 0:9fca2b23d0ba 1199 *p++ = 0;
marcozecchini 0:9fca2b23d0ba 1200
marcozecchini 0:9fca2b23d0ba 1201 if( md_alg == MBEDTLS_MD_NONE )
marcozecchini 0:9fca2b23d0ba 1202 {
marcozecchini 0:9fca2b23d0ba 1203 memcpy( p, hash, hashlen );
marcozecchini 0:9fca2b23d0ba 1204 }
marcozecchini 0:9fca2b23d0ba 1205 else
marcozecchini 0:9fca2b23d0ba 1206 {
marcozecchini 0:9fca2b23d0ba 1207 /*
marcozecchini 0:9fca2b23d0ba 1208 * DigestInfo ::= SEQUENCE {
marcozecchini 0:9fca2b23d0ba 1209 * digestAlgorithm DigestAlgorithmIdentifier,
marcozecchini 0:9fca2b23d0ba 1210 * digest Digest }
marcozecchini 0:9fca2b23d0ba 1211 *
marcozecchini 0:9fca2b23d0ba 1212 * DigestAlgorithmIdentifier ::= AlgorithmIdentifier
marcozecchini 0:9fca2b23d0ba 1213 *
marcozecchini 0:9fca2b23d0ba 1214 * Digest ::= OCTET STRING
marcozecchini 0:9fca2b23d0ba 1215 */
marcozecchini 0:9fca2b23d0ba 1216 *p++ = MBEDTLS_ASN1_SEQUENCE | MBEDTLS_ASN1_CONSTRUCTED;
marcozecchini 0:9fca2b23d0ba 1217 *p++ = (unsigned char) ( 0x08 + oid_size + hashlen );
marcozecchini 0:9fca2b23d0ba 1218 *p++ = MBEDTLS_ASN1_SEQUENCE | MBEDTLS_ASN1_CONSTRUCTED;
marcozecchini 0:9fca2b23d0ba 1219 *p++ = (unsigned char) ( 0x04 + oid_size );
marcozecchini 0:9fca2b23d0ba 1220 *p++ = MBEDTLS_ASN1_OID;
marcozecchini 0:9fca2b23d0ba 1221 *p++ = oid_size & 0xFF;
marcozecchini 0:9fca2b23d0ba 1222 memcpy( p, oid, oid_size );
marcozecchini 0:9fca2b23d0ba 1223 p += oid_size;
marcozecchini 0:9fca2b23d0ba 1224 *p++ = MBEDTLS_ASN1_NULL;
marcozecchini 0:9fca2b23d0ba 1225 *p++ = 0x00;
marcozecchini 0:9fca2b23d0ba 1226 *p++ = MBEDTLS_ASN1_OCTET_STRING;
marcozecchini 0:9fca2b23d0ba 1227 *p++ = hashlen;
marcozecchini 0:9fca2b23d0ba 1228 memcpy( p, hash, hashlen );
marcozecchini 0:9fca2b23d0ba 1229 }
marcozecchini 0:9fca2b23d0ba 1230
marcozecchini 0:9fca2b23d0ba 1231 if( mode == MBEDTLS_RSA_PUBLIC )
marcozecchini 0:9fca2b23d0ba 1232 return( mbedtls_rsa_public( ctx, sig, sig ) );
marcozecchini 0:9fca2b23d0ba 1233
marcozecchini 0:9fca2b23d0ba 1234 /*
marcozecchini 0:9fca2b23d0ba 1235 * In order to prevent Lenstra's attack, make the signature in a
marcozecchini 0:9fca2b23d0ba 1236 * temporary buffer and check it before returning it.
marcozecchini 0:9fca2b23d0ba 1237 */
marcozecchini 0:9fca2b23d0ba 1238 sig_try = mbedtls_calloc( 1, ctx->len );
marcozecchini 0:9fca2b23d0ba 1239 if( sig_try == NULL )
marcozecchini 0:9fca2b23d0ba 1240 return( MBEDTLS_ERR_MPI_ALLOC_FAILED );
marcozecchini 0:9fca2b23d0ba 1241
marcozecchini 0:9fca2b23d0ba 1242 verif = mbedtls_calloc( 1, ctx->len );
marcozecchini 0:9fca2b23d0ba 1243 if( verif == NULL )
marcozecchini 0:9fca2b23d0ba 1244 {
marcozecchini 0:9fca2b23d0ba 1245 mbedtls_free( sig_try );
marcozecchini 0:9fca2b23d0ba 1246 return( MBEDTLS_ERR_MPI_ALLOC_FAILED );
marcozecchini 0:9fca2b23d0ba 1247 }
marcozecchini 0:9fca2b23d0ba 1248
marcozecchini 0:9fca2b23d0ba 1249 MBEDTLS_MPI_CHK( mbedtls_rsa_private( ctx, f_rng, p_rng, sig, sig_try ) );
marcozecchini 0:9fca2b23d0ba 1250 MBEDTLS_MPI_CHK( mbedtls_rsa_public( ctx, sig_try, verif ) );
marcozecchini 0:9fca2b23d0ba 1251
marcozecchini 0:9fca2b23d0ba 1252 /* Compare in constant time just in case */
marcozecchini 0:9fca2b23d0ba 1253 for( diff = 0, i = 0; i < ctx->len; i++ )
marcozecchini 0:9fca2b23d0ba 1254 diff |= verif[i] ^ sig[i];
marcozecchini 0:9fca2b23d0ba 1255 diff_no_optimize = diff;
marcozecchini 0:9fca2b23d0ba 1256
marcozecchini 0:9fca2b23d0ba 1257 if( diff_no_optimize != 0 )
marcozecchini 0:9fca2b23d0ba 1258 {
marcozecchini 0:9fca2b23d0ba 1259 ret = MBEDTLS_ERR_RSA_PRIVATE_FAILED;
marcozecchini 0:9fca2b23d0ba 1260 goto cleanup;
marcozecchini 0:9fca2b23d0ba 1261 }
marcozecchini 0:9fca2b23d0ba 1262
marcozecchini 0:9fca2b23d0ba 1263 memcpy( sig, sig_try, ctx->len );
marcozecchini 0:9fca2b23d0ba 1264
marcozecchini 0:9fca2b23d0ba 1265 cleanup:
marcozecchini 0:9fca2b23d0ba 1266 mbedtls_free( sig_try );
marcozecchini 0:9fca2b23d0ba 1267 mbedtls_free( verif );
marcozecchini 0:9fca2b23d0ba 1268
marcozecchini 0:9fca2b23d0ba 1269 return( ret );
marcozecchini 0:9fca2b23d0ba 1270 }
marcozecchini 0:9fca2b23d0ba 1271 #endif /* MBEDTLS_PKCS1_V15 */
marcozecchini 0:9fca2b23d0ba 1272
marcozecchini 0:9fca2b23d0ba 1273 /*
marcozecchini 0:9fca2b23d0ba 1274 * Do an RSA operation to sign the message digest
marcozecchini 0:9fca2b23d0ba 1275 */
marcozecchini 0:9fca2b23d0ba 1276 int mbedtls_rsa_pkcs1_sign( mbedtls_rsa_context *ctx,
marcozecchini 0:9fca2b23d0ba 1277 int (*f_rng)(void *, unsigned char *, size_t),
marcozecchini 0:9fca2b23d0ba 1278 void *p_rng,
marcozecchini 0:9fca2b23d0ba 1279 int mode,
marcozecchini 0:9fca2b23d0ba 1280 mbedtls_md_type_t md_alg,
marcozecchini 0:9fca2b23d0ba 1281 unsigned int hashlen,
marcozecchini 0:9fca2b23d0ba 1282 const unsigned char *hash,
marcozecchini 0:9fca2b23d0ba 1283 unsigned char *sig )
marcozecchini 0:9fca2b23d0ba 1284 {
marcozecchini 0:9fca2b23d0ba 1285 switch( ctx->padding )
marcozecchini 0:9fca2b23d0ba 1286 {
marcozecchini 0:9fca2b23d0ba 1287 #if defined(MBEDTLS_PKCS1_V15)
marcozecchini 0:9fca2b23d0ba 1288 case MBEDTLS_RSA_PKCS_V15:
marcozecchini 0:9fca2b23d0ba 1289 return mbedtls_rsa_rsassa_pkcs1_v15_sign( ctx, f_rng, p_rng, mode, md_alg,
marcozecchini 0:9fca2b23d0ba 1290 hashlen, hash, sig );
marcozecchini 0:9fca2b23d0ba 1291 #endif
marcozecchini 0:9fca2b23d0ba 1292
marcozecchini 0:9fca2b23d0ba 1293 #if defined(MBEDTLS_PKCS1_V21)
marcozecchini 0:9fca2b23d0ba 1294 case MBEDTLS_RSA_PKCS_V21:
marcozecchini 0:9fca2b23d0ba 1295 return mbedtls_rsa_rsassa_pss_sign( ctx, f_rng, p_rng, mode, md_alg,
marcozecchini 0:9fca2b23d0ba 1296 hashlen, hash, sig );
marcozecchini 0:9fca2b23d0ba 1297 #endif
marcozecchini 0:9fca2b23d0ba 1298
marcozecchini 0:9fca2b23d0ba 1299 default:
marcozecchini 0:9fca2b23d0ba 1300 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
marcozecchini 0:9fca2b23d0ba 1301 }
marcozecchini 0:9fca2b23d0ba 1302 }
marcozecchini 0:9fca2b23d0ba 1303
marcozecchini 0:9fca2b23d0ba 1304 #if defined(MBEDTLS_PKCS1_V21)
marcozecchini 0:9fca2b23d0ba 1305 /*
marcozecchini 0:9fca2b23d0ba 1306 * Implementation of the PKCS#1 v2.1 RSASSA-PSS-VERIFY function
marcozecchini 0:9fca2b23d0ba 1307 */
marcozecchini 0:9fca2b23d0ba 1308 int mbedtls_rsa_rsassa_pss_verify_ext( mbedtls_rsa_context *ctx,
marcozecchini 0:9fca2b23d0ba 1309 int (*f_rng)(void *, unsigned char *, size_t),
marcozecchini 0:9fca2b23d0ba 1310 void *p_rng,
marcozecchini 0:9fca2b23d0ba 1311 int mode,
marcozecchini 0:9fca2b23d0ba 1312 mbedtls_md_type_t md_alg,
marcozecchini 0:9fca2b23d0ba 1313 unsigned int hashlen,
marcozecchini 0:9fca2b23d0ba 1314 const unsigned char *hash,
marcozecchini 0:9fca2b23d0ba 1315 mbedtls_md_type_t mgf1_hash_id,
marcozecchini 0:9fca2b23d0ba 1316 int expected_salt_len,
marcozecchini 0:9fca2b23d0ba 1317 const unsigned char *sig )
marcozecchini 0:9fca2b23d0ba 1318 {
marcozecchini 0:9fca2b23d0ba 1319 int ret;
marcozecchini 0:9fca2b23d0ba 1320 size_t siglen;
marcozecchini 0:9fca2b23d0ba 1321 unsigned char *p;
marcozecchini 0:9fca2b23d0ba 1322 unsigned char result[MBEDTLS_MD_MAX_SIZE];
marcozecchini 0:9fca2b23d0ba 1323 unsigned char zeros[8];
marcozecchini 0:9fca2b23d0ba 1324 unsigned int hlen;
marcozecchini 0:9fca2b23d0ba 1325 size_t slen, msb;
marcozecchini 0:9fca2b23d0ba 1326 const mbedtls_md_info_t *md_info;
marcozecchini 0:9fca2b23d0ba 1327 mbedtls_md_context_t md_ctx;
marcozecchini 0:9fca2b23d0ba 1328 unsigned char buf[MBEDTLS_MPI_MAX_SIZE];
marcozecchini 0:9fca2b23d0ba 1329
marcozecchini 0:9fca2b23d0ba 1330 if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V21 )
marcozecchini 0:9fca2b23d0ba 1331 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
marcozecchini 0:9fca2b23d0ba 1332
marcozecchini 0:9fca2b23d0ba 1333 siglen = ctx->len;
marcozecchini 0:9fca2b23d0ba 1334
marcozecchini 0:9fca2b23d0ba 1335 if( siglen < 16 || siglen > sizeof( buf ) )
marcozecchini 0:9fca2b23d0ba 1336 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
marcozecchini 0:9fca2b23d0ba 1337
marcozecchini 0:9fca2b23d0ba 1338 ret = ( mode == MBEDTLS_RSA_PUBLIC )
marcozecchini 0:9fca2b23d0ba 1339 ? mbedtls_rsa_public( ctx, sig, buf )
marcozecchini 0:9fca2b23d0ba 1340 : mbedtls_rsa_private( ctx, f_rng, p_rng, sig, buf );
marcozecchini 0:9fca2b23d0ba 1341
marcozecchini 0:9fca2b23d0ba 1342 if( ret != 0 )
marcozecchini 0:9fca2b23d0ba 1343 return( ret );
marcozecchini 0:9fca2b23d0ba 1344
marcozecchini 0:9fca2b23d0ba 1345 p = buf;
marcozecchini 0:9fca2b23d0ba 1346
marcozecchini 0:9fca2b23d0ba 1347 if( buf[siglen - 1] != 0xBC )
marcozecchini 0:9fca2b23d0ba 1348 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
marcozecchini 0:9fca2b23d0ba 1349
marcozecchini 0:9fca2b23d0ba 1350 if( md_alg != MBEDTLS_MD_NONE )
marcozecchini 0:9fca2b23d0ba 1351 {
marcozecchini 0:9fca2b23d0ba 1352 /* Gather length of hash to sign */
marcozecchini 0:9fca2b23d0ba 1353 md_info = mbedtls_md_info_from_type( md_alg );
marcozecchini 0:9fca2b23d0ba 1354 if( md_info == NULL )
marcozecchini 0:9fca2b23d0ba 1355 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
marcozecchini 0:9fca2b23d0ba 1356
marcozecchini 0:9fca2b23d0ba 1357 hashlen = mbedtls_md_get_size( md_info );
marcozecchini 0:9fca2b23d0ba 1358 }
marcozecchini 0:9fca2b23d0ba 1359
marcozecchini 0:9fca2b23d0ba 1360 md_info = mbedtls_md_info_from_type( mgf1_hash_id );
marcozecchini 0:9fca2b23d0ba 1361 if( md_info == NULL )
marcozecchini 0:9fca2b23d0ba 1362 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
marcozecchini 0:9fca2b23d0ba 1363
marcozecchini 0:9fca2b23d0ba 1364 hlen = mbedtls_md_get_size( md_info );
marcozecchini 0:9fca2b23d0ba 1365 slen = siglen - hlen - 1; /* Currently length of salt + padding */
marcozecchini 0:9fca2b23d0ba 1366
marcozecchini 0:9fca2b23d0ba 1367 memset( zeros, 0, 8 );
marcozecchini 0:9fca2b23d0ba 1368
marcozecchini 0:9fca2b23d0ba 1369 /*
marcozecchini 0:9fca2b23d0ba 1370 * Note: EMSA-PSS verification is over the length of N - 1 bits
marcozecchini 0:9fca2b23d0ba 1371 */
marcozecchini 0:9fca2b23d0ba 1372 msb = mbedtls_mpi_bitlen( &ctx->N ) - 1;
marcozecchini 0:9fca2b23d0ba 1373
marcozecchini 0:9fca2b23d0ba 1374 /* Compensate for boundary condition when applying mask */
marcozecchini 0:9fca2b23d0ba 1375 if( msb % 8 == 0 )
marcozecchini 0:9fca2b23d0ba 1376 {
marcozecchini 0:9fca2b23d0ba 1377 p++;
marcozecchini 0:9fca2b23d0ba 1378 siglen -= 1;
marcozecchini 0:9fca2b23d0ba 1379 }
marcozecchini 0:9fca2b23d0ba 1380 if( buf[0] >> ( 8 - siglen * 8 + msb ) )
marcozecchini 0:9fca2b23d0ba 1381 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
marcozecchini 0:9fca2b23d0ba 1382
marcozecchini 0:9fca2b23d0ba 1383 mbedtls_md_init( &md_ctx );
marcozecchini 0:9fca2b23d0ba 1384 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 0 ) ) != 0 )
marcozecchini 0:9fca2b23d0ba 1385 {
marcozecchini 0:9fca2b23d0ba 1386 mbedtls_md_free( &md_ctx );
marcozecchini 0:9fca2b23d0ba 1387 return( ret );
marcozecchini 0:9fca2b23d0ba 1388 }
marcozecchini 0:9fca2b23d0ba 1389
marcozecchini 0:9fca2b23d0ba 1390 mgf_mask( p, siglen - hlen - 1, p + siglen - hlen - 1, hlen, &md_ctx );
marcozecchini 0:9fca2b23d0ba 1391
marcozecchini 0:9fca2b23d0ba 1392 buf[0] &= 0xFF >> ( siglen * 8 - msb );
marcozecchini 0:9fca2b23d0ba 1393
marcozecchini 0:9fca2b23d0ba 1394 while( p < buf + siglen && *p == 0 )
marcozecchini 0:9fca2b23d0ba 1395 p++;
marcozecchini 0:9fca2b23d0ba 1396
marcozecchini 0:9fca2b23d0ba 1397 if( p == buf + siglen ||
marcozecchini 0:9fca2b23d0ba 1398 *p++ != 0x01 )
marcozecchini 0:9fca2b23d0ba 1399 {
marcozecchini 0:9fca2b23d0ba 1400 mbedtls_md_free( &md_ctx );
marcozecchini 0:9fca2b23d0ba 1401 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
marcozecchini 0:9fca2b23d0ba 1402 }
marcozecchini 0:9fca2b23d0ba 1403
marcozecchini 0:9fca2b23d0ba 1404 /* Actual salt len */
marcozecchini 0:9fca2b23d0ba 1405 slen -= p - buf;
marcozecchini 0:9fca2b23d0ba 1406
marcozecchini 0:9fca2b23d0ba 1407 if( expected_salt_len != MBEDTLS_RSA_SALT_LEN_ANY &&
marcozecchini 0:9fca2b23d0ba 1408 slen != (size_t) expected_salt_len )
marcozecchini 0:9fca2b23d0ba 1409 {
marcozecchini 0:9fca2b23d0ba 1410 mbedtls_md_free( &md_ctx );
marcozecchini 0:9fca2b23d0ba 1411 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
marcozecchini 0:9fca2b23d0ba 1412 }
marcozecchini 0:9fca2b23d0ba 1413
marcozecchini 0:9fca2b23d0ba 1414 /*
marcozecchini 0:9fca2b23d0ba 1415 * Generate H = Hash( M' )
marcozecchini 0:9fca2b23d0ba 1416 */
marcozecchini 0:9fca2b23d0ba 1417 mbedtls_md_starts( &md_ctx );
marcozecchini 0:9fca2b23d0ba 1418 mbedtls_md_update( &md_ctx, zeros, 8 );
marcozecchini 0:9fca2b23d0ba 1419 mbedtls_md_update( &md_ctx, hash, hashlen );
marcozecchini 0:9fca2b23d0ba 1420 mbedtls_md_update( &md_ctx, p, slen );
marcozecchini 0:9fca2b23d0ba 1421 mbedtls_md_finish( &md_ctx, result );
marcozecchini 0:9fca2b23d0ba 1422
marcozecchini 0:9fca2b23d0ba 1423 mbedtls_md_free( &md_ctx );
marcozecchini 0:9fca2b23d0ba 1424
marcozecchini 0:9fca2b23d0ba 1425 if( memcmp( p + slen, result, hlen ) == 0 )
marcozecchini 0:9fca2b23d0ba 1426 return( 0 );
marcozecchini 0:9fca2b23d0ba 1427 else
marcozecchini 0:9fca2b23d0ba 1428 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
marcozecchini 0:9fca2b23d0ba 1429 }
marcozecchini 0:9fca2b23d0ba 1430
marcozecchini 0:9fca2b23d0ba 1431 /*
marcozecchini 0:9fca2b23d0ba 1432 * Simplified PKCS#1 v2.1 RSASSA-PSS-VERIFY function
marcozecchini 0:9fca2b23d0ba 1433 */
marcozecchini 0:9fca2b23d0ba 1434 int mbedtls_rsa_rsassa_pss_verify( mbedtls_rsa_context *ctx,
marcozecchini 0:9fca2b23d0ba 1435 int (*f_rng)(void *, unsigned char *, size_t),
marcozecchini 0:9fca2b23d0ba 1436 void *p_rng,
marcozecchini 0:9fca2b23d0ba 1437 int mode,
marcozecchini 0:9fca2b23d0ba 1438 mbedtls_md_type_t md_alg,
marcozecchini 0:9fca2b23d0ba 1439 unsigned int hashlen,
marcozecchini 0:9fca2b23d0ba 1440 const unsigned char *hash,
marcozecchini 0:9fca2b23d0ba 1441 const unsigned char *sig )
marcozecchini 0:9fca2b23d0ba 1442 {
marcozecchini 0:9fca2b23d0ba 1443 mbedtls_md_type_t mgf1_hash_id = ( ctx->hash_id != MBEDTLS_MD_NONE )
marcozecchini 0:9fca2b23d0ba 1444 ? (mbedtls_md_type_t) ctx->hash_id
marcozecchini 0:9fca2b23d0ba 1445 : md_alg;
marcozecchini 0:9fca2b23d0ba 1446
marcozecchini 0:9fca2b23d0ba 1447 return( mbedtls_rsa_rsassa_pss_verify_ext( ctx, f_rng, p_rng, mode,
marcozecchini 0:9fca2b23d0ba 1448 md_alg, hashlen, hash,
marcozecchini 0:9fca2b23d0ba 1449 mgf1_hash_id, MBEDTLS_RSA_SALT_LEN_ANY,
marcozecchini 0:9fca2b23d0ba 1450 sig ) );
marcozecchini 0:9fca2b23d0ba 1451
marcozecchini 0:9fca2b23d0ba 1452 }
marcozecchini 0:9fca2b23d0ba 1453 #endif /* MBEDTLS_PKCS1_V21 */
marcozecchini 0:9fca2b23d0ba 1454
marcozecchini 0:9fca2b23d0ba 1455 #if defined(MBEDTLS_PKCS1_V15)
marcozecchini 0:9fca2b23d0ba 1456 /*
marcozecchini 0:9fca2b23d0ba 1457 * Implementation of the PKCS#1 v2.1 RSASSA-PKCS1-v1_5-VERIFY function
marcozecchini 0:9fca2b23d0ba 1458 */
marcozecchini 0:9fca2b23d0ba 1459 int mbedtls_rsa_rsassa_pkcs1_v15_verify( mbedtls_rsa_context *ctx,
marcozecchini 0:9fca2b23d0ba 1460 int (*f_rng)(void *, unsigned char *, size_t),
marcozecchini 0:9fca2b23d0ba 1461 void *p_rng,
marcozecchini 0:9fca2b23d0ba 1462 int mode,
marcozecchini 0:9fca2b23d0ba 1463 mbedtls_md_type_t md_alg,
marcozecchini 0:9fca2b23d0ba 1464 unsigned int hashlen,
marcozecchini 0:9fca2b23d0ba 1465 const unsigned char *hash,
marcozecchini 0:9fca2b23d0ba 1466 const unsigned char *sig )
marcozecchini 0:9fca2b23d0ba 1467 {
marcozecchini 0:9fca2b23d0ba 1468 int ret;
marcozecchini 0:9fca2b23d0ba 1469 size_t len, siglen, asn1_len;
marcozecchini 0:9fca2b23d0ba 1470 unsigned char *p, *p0, *end;
marcozecchini 0:9fca2b23d0ba 1471 mbedtls_md_type_t msg_md_alg;
marcozecchini 0:9fca2b23d0ba 1472 const mbedtls_md_info_t *md_info;
marcozecchini 0:9fca2b23d0ba 1473 mbedtls_asn1_buf oid;
marcozecchini 0:9fca2b23d0ba 1474 unsigned char buf[MBEDTLS_MPI_MAX_SIZE];
marcozecchini 0:9fca2b23d0ba 1475
marcozecchini 0:9fca2b23d0ba 1476 if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V15 )
marcozecchini 0:9fca2b23d0ba 1477 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
marcozecchini 0:9fca2b23d0ba 1478
marcozecchini 0:9fca2b23d0ba 1479 siglen = ctx->len;
marcozecchini 0:9fca2b23d0ba 1480
marcozecchini 0:9fca2b23d0ba 1481 if( siglen < 16 || siglen > sizeof( buf ) )
marcozecchini 0:9fca2b23d0ba 1482 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
marcozecchini 0:9fca2b23d0ba 1483
marcozecchini 0:9fca2b23d0ba 1484 ret = ( mode == MBEDTLS_RSA_PUBLIC )
marcozecchini 0:9fca2b23d0ba 1485 ? mbedtls_rsa_public( ctx, sig, buf )
marcozecchini 0:9fca2b23d0ba 1486 : mbedtls_rsa_private( ctx, f_rng, p_rng, sig, buf );
marcozecchini 0:9fca2b23d0ba 1487
marcozecchini 0:9fca2b23d0ba 1488 if( ret != 0 )
marcozecchini 0:9fca2b23d0ba 1489 return( ret );
marcozecchini 0:9fca2b23d0ba 1490
marcozecchini 0:9fca2b23d0ba 1491 p = buf;
marcozecchini 0:9fca2b23d0ba 1492
marcozecchini 0:9fca2b23d0ba 1493 if( *p++ != 0 || *p++ != MBEDTLS_RSA_SIGN )
marcozecchini 0:9fca2b23d0ba 1494 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
marcozecchini 0:9fca2b23d0ba 1495
marcozecchini 0:9fca2b23d0ba 1496 while( *p != 0 )
marcozecchini 0:9fca2b23d0ba 1497 {
marcozecchini 0:9fca2b23d0ba 1498 if( p >= buf + siglen - 1 || *p != 0xFF )
marcozecchini 0:9fca2b23d0ba 1499 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
marcozecchini 0:9fca2b23d0ba 1500 p++;
marcozecchini 0:9fca2b23d0ba 1501 }
marcozecchini 0:9fca2b23d0ba 1502 p++; /* skip 00 byte */
marcozecchini 0:9fca2b23d0ba 1503
marcozecchini 0:9fca2b23d0ba 1504 /* We've read: 00 01 PS 00 where PS must be at least 8 bytes */
marcozecchini 0:9fca2b23d0ba 1505 if( p - buf < 11 )
marcozecchini 0:9fca2b23d0ba 1506 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
marcozecchini 0:9fca2b23d0ba 1507
marcozecchini 0:9fca2b23d0ba 1508 len = siglen - ( p - buf );
marcozecchini 0:9fca2b23d0ba 1509
marcozecchini 0:9fca2b23d0ba 1510 if( len == hashlen && md_alg == MBEDTLS_MD_NONE )
marcozecchini 0:9fca2b23d0ba 1511 {
marcozecchini 0:9fca2b23d0ba 1512 if( memcmp( p, hash, hashlen ) == 0 )
marcozecchini 0:9fca2b23d0ba 1513 return( 0 );
marcozecchini 0:9fca2b23d0ba 1514 else
marcozecchini 0:9fca2b23d0ba 1515 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
marcozecchini 0:9fca2b23d0ba 1516 }
marcozecchini 0:9fca2b23d0ba 1517
marcozecchini 0:9fca2b23d0ba 1518 md_info = mbedtls_md_info_from_type( md_alg );
marcozecchini 0:9fca2b23d0ba 1519 if( md_info == NULL )
marcozecchini 0:9fca2b23d0ba 1520 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
marcozecchini 0:9fca2b23d0ba 1521 hashlen = mbedtls_md_get_size( md_info );
marcozecchini 0:9fca2b23d0ba 1522
marcozecchini 0:9fca2b23d0ba 1523 end = p + len;
marcozecchini 0:9fca2b23d0ba 1524
marcozecchini 0:9fca2b23d0ba 1525 /*
marcozecchini 0:9fca2b23d0ba 1526 * Parse the ASN.1 structure inside the PKCS#1 v1.5 structure.
marcozecchini 0:9fca2b23d0ba 1527 * Insist on 2-byte length tags, to protect against variants of
marcozecchini 0:9fca2b23d0ba 1528 * Bleichenbacher's forgery attack against lax PKCS#1v1.5 verification.
marcozecchini 0:9fca2b23d0ba 1529 */
marcozecchini 0:9fca2b23d0ba 1530 p0 = p;
marcozecchini 0:9fca2b23d0ba 1531 if( ( ret = mbedtls_asn1_get_tag( &p, end, &asn1_len,
marcozecchini 0:9fca2b23d0ba 1532 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
marcozecchini 0:9fca2b23d0ba 1533 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
marcozecchini 0:9fca2b23d0ba 1534 if( p != p0 + 2 || asn1_len + 2 != len )
marcozecchini 0:9fca2b23d0ba 1535 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
marcozecchini 0:9fca2b23d0ba 1536
marcozecchini 0:9fca2b23d0ba 1537 p0 = p;
marcozecchini 0:9fca2b23d0ba 1538 if( ( ret = mbedtls_asn1_get_tag( &p, end, &asn1_len,
marcozecchini 0:9fca2b23d0ba 1539 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
marcozecchini 0:9fca2b23d0ba 1540 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
marcozecchini 0:9fca2b23d0ba 1541 if( p != p0 + 2 || asn1_len + 6 + hashlen != len )
marcozecchini 0:9fca2b23d0ba 1542 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
marcozecchini 0:9fca2b23d0ba 1543
marcozecchini 0:9fca2b23d0ba 1544 p0 = p;
marcozecchini 0:9fca2b23d0ba 1545 if( ( ret = mbedtls_asn1_get_tag( &p, end, &oid.len, MBEDTLS_ASN1_OID ) ) != 0 )
marcozecchini 0:9fca2b23d0ba 1546 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
marcozecchini 0:9fca2b23d0ba 1547 if( p != p0 + 2 )
marcozecchini 0:9fca2b23d0ba 1548 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
marcozecchini 0:9fca2b23d0ba 1549
marcozecchini 0:9fca2b23d0ba 1550 oid.p = p;
marcozecchini 0:9fca2b23d0ba 1551 p += oid.len;
marcozecchini 0:9fca2b23d0ba 1552
marcozecchini 0:9fca2b23d0ba 1553 if( mbedtls_oid_get_md_alg( &oid, &msg_md_alg ) != 0 )
marcozecchini 0:9fca2b23d0ba 1554 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
marcozecchini 0:9fca2b23d0ba 1555
marcozecchini 0:9fca2b23d0ba 1556 if( md_alg != msg_md_alg )
marcozecchini 0:9fca2b23d0ba 1557 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
marcozecchini 0:9fca2b23d0ba 1558
marcozecchini 0:9fca2b23d0ba 1559 /*
marcozecchini 0:9fca2b23d0ba 1560 * assume the algorithm parameters must be NULL
marcozecchini 0:9fca2b23d0ba 1561 */
marcozecchini 0:9fca2b23d0ba 1562 p0 = p;
marcozecchini 0:9fca2b23d0ba 1563 if( ( ret = mbedtls_asn1_get_tag( &p, end, &asn1_len, MBEDTLS_ASN1_NULL ) ) != 0 )
marcozecchini 0:9fca2b23d0ba 1564 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
marcozecchini 0:9fca2b23d0ba 1565 if( p != p0 + 2 )
marcozecchini 0:9fca2b23d0ba 1566 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
marcozecchini 0:9fca2b23d0ba 1567
marcozecchini 0:9fca2b23d0ba 1568 p0 = p;
marcozecchini 0:9fca2b23d0ba 1569 if( ( ret = mbedtls_asn1_get_tag( &p, end, &asn1_len, MBEDTLS_ASN1_OCTET_STRING ) ) != 0 )
marcozecchini 0:9fca2b23d0ba 1570 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
marcozecchini 0:9fca2b23d0ba 1571 if( p != p0 + 2 || asn1_len != hashlen )
marcozecchini 0:9fca2b23d0ba 1572 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
marcozecchini 0:9fca2b23d0ba 1573
marcozecchini 0:9fca2b23d0ba 1574 if( memcmp( p, hash, hashlen ) != 0 )
marcozecchini 0:9fca2b23d0ba 1575 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
marcozecchini 0:9fca2b23d0ba 1576
marcozecchini 0:9fca2b23d0ba 1577 p += hashlen;
marcozecchini 0:9fca2b23d0ba 1578
marcozecchini 0:9fca2b23d0ba 1579 if( p != end )
marcozecchini 0:9fca2b23d0ba 1580 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
marcozecchini 0:9fca2b23d0ba 1581
marcozecchini 0:9fca2b23d0ba 1582 return( 0 );
marcozecchini 0:9fca2b23d0ba 1583 }
marcozecchini 0:9fca2b23d0ba 1584 #endif /* MBEDTLS_PKCS1_V15 */
marcozecchini 0:9fca2b23d0ba 1585
marcozecchini 0:9fca2b23d0ba 1586 /*
marcozecchini 0:9fca2b23d0ba 1587 * Do an RSA operation and check the message digest
marcozecchini 0:9fca2b23d0ba 1588 */
marcozecchini 0:9fca2b23d0ba 1589 int mbedtls_rsa_pkcs1_verify( mbedtls_rsa_context *ctx,
marcozecchini 0:9fca2b23d0ba 1590 int (*f_rng)(void *, unsigned char *, size_t),
marcozecchini 0:9fca2b23d0ba 1591 void *p_rng,
marcozecchini 0:9fca2b23d0ba 1592 int mode,
marcozecchini 0:9fca2b23d0ba 1593 mbedtls_md_type_t md_alg,
marcozecchini 0:9fca2b23d0ba 1594 unsigned int hashlen,
marcozecchini 0:9fca2b23d0ba 1595 const unsigned char *hash,
marcozecchini 0:9fca2b23d0ba 1596 const unsigned char *sig )
marcozecchini 0:9fca2b23d0ba 1597 {
marcozecchini 0:9fca2b23d0ba 1598 switch( ctx->padding )
marcozecchini 0:9fca2b23d0ba 1599 {
marcozecchini 0:9fca2b23d0ba 1600 #if defined(MBEDTLS_PKCS1_V15)
marcozecchini 0:9fca2b23d0ba 1601 case MBEDTLS_RSA_PKCS_V15:
marcozecchini 0:9fca2b23d0ba 1602 return mbedtls_rsa_rsassa_pkcs1_v15_verify( ctx, f_rng, p_rng, mode, md_alg,
marcozecchini 0:9fca2b23d0ba 1603 hashlen, hash, sig );
marcozecchini 0:9fca2b23d0ba 1604 #endif
marcozecchini 0:9fca2b23d0ba 1605
marcozecchini 0:9fca2b23d0ba 1606 #if defined(MBEDTLS_PKCS1_V21)
marcozecchini 0:9fca2b23d0ba 1607 case MBEDTLS_RSA_PKCS_V21:
marcozecchini 0:9fca2b23d0ba 1608 return mbedtls_rsa_rsassa_pss_verify( ctx, f_rng, p_rng, mode, md_alg,
marcozecchini 0:9fca2b23d0ba 1609 hashlen, hash, sig );
marcozecchini 0:9fca2b23d0ba 1610 #endif
marcozecchini 0:9fca2b23d0ba 1611
marcozecchini 0:9fca2b23d0ba 1612 default:
marcozecchini 0:9fca2b23d0ba 1613 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
marcozecchini 0:9fca2b23d0ba 1614 }
marcozecchini 0:9fca2b23d0ba 1615 }
marcozecchini 0:9fca2b23d0ba 1616
marcozecchini 0:9fca2b23d0ba 1617 /*
marcozecchini 0:9fca2b23d0ba 1618 * Copy the components of an RSA key
marcozecchini 0:9fca2b23d0ba 1619 */
marcozecchini 0:9fca2b23d0ba 1620 int mbedtls_rsa_copy( mbedtls_rsa_context *dst, const mbedtls_rsa_context *src )
marcozecchini 0:9fca2b23d0ba 1621 {
marcozecchini 0:9fca2b23d0ba 1622 int ret;
marcozecchini 0:9fca2b23d0ba 1623
marcozecchini 0:9fca2b23d0ba 1624 dst->ver = src->ver;
marcozecchini 0:9fca2b23d0ba 1625 dst->len = src->len;
marcozecchini 0:9fca2b23d0ba 1626
marcozecchini 0:9fca2b23d0ba 1627 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->N, &src->N ) );
marcozecchini 0:9fca2b23d0ba 1628 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->E, &src->E ) );
marcozecchini 0:9fca2b23d0ba 1629
marcozecchini 0:9fca2b23d0ba 1630 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->D, &src->D ) );
marcozecchini 0:9fca2b23d0ba 1631 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->P, &src->P ) );
marcozecchini 0:9fca2b23d0ba 1632 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->Q, &src->Q ) );
marcozecchini 0:9fca2b23d0ba 1633 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->DP, &src->DP ) );
marcozecchini 0:9fca2b23d0ba 1634 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->DQ, &src->DQ ) );
marcozecchini 0:9fca2b23d0ba 1635 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->QP, &src->QP ) );
marcozecchini 0:9fca2b23d0ba 1636
marcozecchini 0:9fca2b23d0ba 1637 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->RN, &src->RN ) );
marcozecchini 0:9fca2b23d0ba 1638 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->RP, &src->RP ) );
marcozecchini 0:9fca2b23d0ba 1639 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->RQ, &src->RQ ) );
marcozecchini 0:9fca2b23d0ba 1640
marcozecchini 0:9fca2b23d0ba 1641 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->Vi, &src->Vi ) );
marcozecchini 0:9fca2b23d0ba 1642 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->Vf, &src->Vf ) );
marcozecchini 0:9fca2b23d0ba 1643
marcozecchini 0:9fca2b23d0ba 1644 dst->padding = src->padding;
marcozecchini 0:9fca2b23d0ba 1645 dst->hash_id = src->hash_id;
marcozecchini 0:9fca2b23d0ba 1646
marcozecchini 0:9fca2b23d0ba 1647 cleanup:
marcozecchini 0:9fca2b23d0ba 1648 if( ret != 0 )
marcozecchini 0:9fca2b23d0ba 1649 mbedtls_rsa_free( dst );
marcozecchini 0:9fca2b23d0ba 1650
marcozecchini 0:9fca2b23d0ba 1651 return( ret );
marcozecchini 0:9fca2b23d0ba 1652 }
marcozecchini 0:9fca2b23d0ba 1653
marcozecchini 0:9fca2b23d0ba 1654 /*
marcozecchini 0:9fca2b23d0ba 1655 * Free the components of an RSA key
marcozecchini 0:9fca2b23d0ba 1656 */
marcozecchini 0:9fca2b23d0ba 1657 void mbedtls_rsa_free( mbedtls_rsa_context *ctx )
marcozecchini 0:9fca2b23d0ba 1658 {
marcozecchini 0:9fca2b23d0ba 1659 mbedtls_mpi_free( &ctx->Vi ); mbedtls_mpi_free( &ctx->Vf );
marcozecchini 0:9fca2b23d0ba 1660 mbedtls_mpi_free( &ctx->RQ ); mbedtls_mpi_free( &ctx->RP ); mbedtls_mpi_free( &ctx->RN );
marcozecchini 0:9fca2b23d0ba 1661 mbedtls_mpi_free( &ctx->QP ); mbedtls_mpi_free( &ctx->DQ ); mbedtls_mpi_free( &ctx->DP );
marcozecchini 0:9fca2b23d0ba 1662 mbedtls_mpi_free( &ctx->Q ); mbedtls_mpi_free( &ctx->P ); mbedtls_mpi_free( &ctx->D );
marcozecchini 0:9fca2b23d0ba 1663 mbedtls_mpi_free( &ctx->E ); mbedtls_mpi_free( &ctx->N );
marcozecchini 0:9fca2b23d0ba 1664
marcozecchini 0:9fca2b23d0ba 1665 #if defined(MBEDTLS_THREADING_C)
marcozecchini 0:9fca2b23d0ba 1666 mbedtls_mutex_free( &ctx->mutex );
marcozecchini 0:9fca2b23d0ba 1667 #endif
marcozecchini 0:9fca2b23d0ba 1668 }
marcozecchini 0:9fca2b23d0ba 1669
marcozecchini 0:9fca2b23d0ba 1670 #if defined(MBEDTLS_SELF_TEST)
marcozecchini 0:9fca2b23d0ba 1671
marcozecchini 0:9fca2b23d0ba 1672 #include "mbedtls/sha1.h"
marcozecchini 0:9fca2b23d0ba 1673
marcozecchini 0:9fca2b23d0ba 1674 /*
marcozecchini 0:9fca2b23d0ba 1675 * Example RSA-1024 keypair, for test purposes
marcozecchini 0:9fca2b23d0ba 1676 */
marcozecchini 0:9fca2b23d0ba 1677 #define KEY_LEN 128
marcozecchini 0:9fca2b23d0ba 1678
marcozecchini 0:9fca2b23d0ba 1679 #define RSA_N "9292758453063D803DD603D5E777D788" \
marcozecchini 0:9fca2b23d0ba 1680 "8ED1D5BF35786190FA2F23EBC0848AEA" \
marcozecchini 0:9fca2b23d0ba 1681 "DDA92CA6C3D80B32C4D109BE0F36D6AE" \
marcozecchini 0:9fca2b23d0ba 1682 "7130B9CED7ACDF54CFC7555AC14EEBAB" \
marcozecchini 0:9fca2b23d0ba 1683 "93A89813FBF3C4F8066D2D800F7C38A8" \
marcozecchini 0:9fca2b23d0ba 1684 "1AE31942917403FF4946B0A83D3D3E05" \
marcozecchini 0:9fca2b23d0ba 1685 "EE57C6F5F5606FB5D4BC6CD34EE0801A" \
marcozecchini 0:9fca2b23d0ba 1686 "5E94BB77B07507233A0BC7BAC8F90F79"
marcozecchini 0:9fca2b23d0ba 1687
marcozecchini 0:9fca2b23d0ba 1688 #define RSA_E "10001"
marcozecchini 0:9fca2b23d0ba 1689
marcozecchini 0:9fca2b23d0ba 1690 #define RSA_D "24BF6185468786FDD303083D25E64EFC" \
marcozecchini 0:9fca2b23d0ba 1691 "66CA472BC44D253102F8B4A9D3BFA750" \
marcozecchini 0:9fca2b23d0ba 1692 "91386C0077937FE33FA3252D28855837" \
marcozecchini 0:9fca2b23d0ba 1693 "AE1B484A8A9A45F7EE8C0C634F99E8CD" \
marcozecchini 0:9fca2b23d0ba 1694 "DF79C5CE07EE72C7F123142198164234" \
marcozecchini 0:9fca2b23d0ba 1695 "CABB724CF78B8173B9F880FC86322407" \
marcozecchini 0:9fca2b23d0ba 1696 "AF1FEDFDDE2BEB674CA15F3E81A1521E" \
marcozecchini 0:9fca2b23d0ba 1697 "071513A1E85B5DFA031F21ECAE91A34D"
marcozecchini 0:9fca2b23d0ba 1698
marcozecchini 0:9fca2b23d0ba 1699 #define RSA_P "C36D0EB7FCD285223CFB5AABA5BDA3D8" \
marcozecchini 0:9fca2b23d0ba 1700 "2C01CAD19EA484A87EA4377637E75500" \
marcozecchini 0:9fca2b23d0ba 1701 "FCB2005C5C7DD6EC4AC023CDA285D796" \
marcozecchini 0:9fca2b23d0ba 1702 "C3D9E75E1EFC42488BB4F1D13AC30A57"
marcozecchini 0:9fca2b23d0ba 1703
marcozecchini 0:9fca2b23d0ba 1704 #define RSA_Q "C000DF51A7C77AE8D7C7370C1FF55B69" \
marcozecchini 0:9fca2b23d0ba 1705 "E211C2B9E5DB1ED0BF61D0D9899620F4" \
marcozecchini 0:9fca2b23d0ba 1706 "910E4168387E3C30AA1E00C339A79508" \
marcozecchini 0:9fca2b23d0ba 1707 "8452DD96A9A5EA5D9DCA68DA636032AF"
marcozecchini 0:9fca2b23d0ba 1708
marcozecchini 0:9fca2b23d0ba 1709 #define RSA_DP "C1ACF567564274FB07A0BBAD5D26E298" \
marcozecchini 0:9fca2b23d0ba 1710 "3C94D22288ACD763FD8E5600ED4A702D" \
marcozecchini 0:9fca2b23d0ba 1711 "F84198A5F06C2E72236AE490C93F07F8" \
marcozecchini 0:9fca2b23d0ba 1712 "3CC559CD27BC2D1CA488811730BB5725"
marcozecchini 0:9fca2b23d0ba 1713
marcozecchini 0:9fca2b23d0ba 1714 #define RSA_DQ "4959CBF6F8FEF750AEE6977C155579C7" \
marcozecchini 0:9fca2b23d0ba 1715 "D8AAEA56749EA28623272E4F7D0592AF" \
marcozecchini 0:9fca2b23d0ba 1716 "7C1F1313CAC9471B5C523BFE592F517B" \
marcozecchini 0:9fca2b23d0ba 1717 "407A1BD76C164B93DA2D32A383E58357"
marcozecchini 0:9fca2b23d0ba 1718
marcozecchini 0:9fca2b23d0ba 1719 #define RSA_QP "9AE7FBC99546432DF71896FC239EADAE" \
marcozecchini 0:9fca2b23d0ba 1720 "F38D18D2B2F0E2DD275AA977E2BF4411" \
marcozecchini 0:9fca2b23d0ba 1721 "F5A3B2A5D33605AEBBCCBA7FEB9F2D2F" \
marcozecchini 0:9fca2b23d0ba 1722 "A74206CEC169D74BF5A8C50D6F48EA08"
marcozecchini 0:9fca2b23d0ba 1723
marcozecchini 0:9fca2b23d0ba 1724 #define PT_LEN 24
marcozecchini 0:9fca2b23d0ba 1725 #define RSA_PT "\xAA\xBB\xCC\x03\x02\x01\x00\xFF\xFF\xFF\xFF\xFF" \
marcozecchini 0:9fca2b23d0ba 1726 "\x11\x22\x33\x0A\x0B\x0C\xCC\xDD\xDD\xDD\xDD\xDD"
marcozecchini 0:9fca2b23d0ba 1727
marcozecchini 0:9fca2b23d0ba 1728 #if defined(MBEDTLS_PKCS1_V15)
marcozecchini 0:9fca2b23d0ba 1729 static int myrand( void *rng_state, unsigned char *output, size_t len )
marcozecchini 0:9fca2b23d0ba 1730 {
marcozecchini 0:9fca2b23d0ba 1731 #if !defined(__OpenBSD__)
marcozecchini 0:9fca2b23d0ba 1732 size_t i;
marcozecchini 0:9fca2b23d0ba 1733
marcozecchini 0:9fca2b23d0ba 1734 if( rng_state != NULL )
marcozecchini 0:9fca2b23d0ba 1735 rng_state = NULL;
marcozecchini 0:9fca2b23d0ba 1736
marcozecchini 0:9fca2b23d0ba 1737 for( i = 0; i < len; ++i )
marcozecchini 0:9fca2b23d0ba 1738 output[i] = rand();
marcozecchini 0:9fca2b23d0ba 1739 #else
marcozecchini 0:9fca2b23d0ba 1740 if( rng_state != NULL )
marcozecchini 0:9fca2b23d0ba 1741 rng_state = NULL;
marcozecchini 0:9fca2b23d0ba 1742
marcozecchini 0:9fca2b23d0ba 1743 arc4random_buf( output, len );
marcozecchini 0:9fca2b23d0ba 1744 #endif /* !OpenBSD */
marcozecchini 0:9fca2b23d0ba 1745
marcozecchini 0:9fca2b23d0ba 1746 return( 0 );
marcozecchini 0:9fca2b23d0ba 1747 }
marcozecchini 0:9fca2b23d0ba 1748 #endif /* MBEDTLS_PKCS1_V15 */
marcozecchini 0:9fca2b23d0ba 1749
marcozecchini 0:9fca2b23d0ba 1750 /*
marcozecchini 0:9fca2b23d0ba 1751 * Checkup routine
marcozecchini 0:9fca2b23d0ba 1752 */
marcozecchini 0:9fca2b23d0ba 1753 int mbedtls_rsa_self_test( int verbose )
marcozecchini 0:9fca2b23d0ba 1754 {
marcozecchini 0:9fca2b23d0ba 1755 int ret = 0;
marcozecchini 0:9fca2b23d0ba 1756 #if defined(MBEDTLS_PKCS1_V15)
marcozecchini 0:9fca2b23d0ba 1757 size_t len;
marcozecchini 0:9fca2b23d0ba 1758 mbedtls_rsa_context rsa;
marcozecchini 0:9fca2b23d0ba 1759 unsigned char rsa_plaintext[PT_LEN];
marcozecchini 0:9fca2b23d0ba 1760 unsigned char rsa_decrypted[PT_LEN];
marcozecchini 0:9fca2b23d0ba 1761 unsigned char rsa_ciphertext[KEY_LEN];
marcozecchini 0:9fca2b23d0ba 1762 #if defined(MBEDTLS_SHA1_C)
marcozecchini 0:9fca2b23d0ba 1763 unsigned char sha1sum[20];
marcozecchini 0:9fca2b23d0ba 1764 #endif
marcozecchini 0:9fca2b23d0ba 1765
marcozecchini 0:9fca2b23d0ba 1766 mbedtls_rsa_init( &rsa, MBEDTLS_RSA_PKCS_V15, 0 );
marcozecchini 0:9fca2b23d0ba 1767
marcozecchini 0:9fca2b23d0ba 1768 rsa.len = KEY_LEN;
marcozecchini 0:9fca2b23d0ba 1769 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &rsa.N , 16, RSA_N ) );
marcozecchini 0:9fca2b23d0ba 1770 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &rsa.E , 16, RSA_E ) );
marcozecchini 0:9fca2b23d0ba 1771 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &rsa.D , 16, RSA_D ) );
marcozecchini 0:9fca2b23d0ba 1772 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &rsa.P , 16, RSA_P ) );
marcozecchini 0:9fca2b23d0ba 1773 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &rsa.Q , 16, RSA_Q ) );
marcozecchini 0:9fca2b23d0ba 1774 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &rsa.DP, 16, RSA_DP ) );
marcozecchini 0:9fca2b23d0ba 1775 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &rsa.DQ, 16, RSA_DQ ) );
marcozecchini 0:9fca2b23d0ba 1776 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &rsa.QP, 16, RSA_QP ) );
marcozecchini 0:9fca2b23d0ba 1777
marcozecchini 0:9fca2b23d0ba 1778 if( verbose != 0 )
marcozecchini 0:9fca2b23d0ba 1779 mbedtls_printf( " RSA key validation: " );
marcozecchini 0:9fca2b23d0ba 1780
marcozecchini 0:9fca2b23d0ba 1781 if( mbedtls_rsa_check_pubkey( &rsa ) != 0 ||
marcozecchini 0:9fca2b23d0ba 1782 mbedtls_rsa_check_privkey( &rsa ) != 0 )
marcozecchini 0:9fca2b23d0ba 1783 {
marcozecchini 0:9fca2b23d0ba 1784 if( verbose != 0 )
marcozecchini 0:9fca2b23d0ba 1785 mbedtls_printf( "failed\n" );
marcozecchini 0:9fca2b23d0ba 1786
marcozecchini 0:9fca2b23d0ba 1787 return( 1 );
marcozecchini 0:9fca2b23d0ba 1788 }
marcozecchini 0:9fca2b23d0ba 1789
marcozecchini 0:9fca2b23d0ba 1790 if( verbose != 0 )
marcozecchini 0:9fca2b23d0ba 1791 mbedtls_printf( "passed\n PKCS#1 encryption : " );
marcozecchini 0:9fca2b23d0ba 1792
marcozecchini 0:9fca2b23d0ba 1793 memcpy( rsa_plaintext, RSA_PT, PT_LEN );
marcozecchini 0:9fca2b23d0ba 1794
marcozecchini 0:9fca2b23d0ba 1795 if( mbedtls_rsa_pkcs1_encrypt( &rsa, myrand, NULL, MBEDTLS_RSA_PUBLIC, PT_LEN,
marcozecchini 0:9fca2b23d0ba 1796 rsa_plaintext, rsa_ciphertext ) != 0 )
marcozecchini 0:9fca2b23d0ba 1797 {
marcozecchini 0:9fca2b23d0ba 1798 if( verbose != 0 )
marcozecchini 0:9fca2b23d0ba 1799 mbedtls_printf( "failed\n" );
marcozecchini 0:9fca2b23d0ba 1800
marcozecchini 0:9fca2b23d0ba 1801 return( 1 );
marcozecchini 0:9fca2b23d0ba 1802 }
marcozecchini 0:9fca2b23d0ba 1803
marcozecchini 0:9fca2b23d0ba 1804 if( verbose != 0 )
marcozecchini 0:9fca2b23d0ba 1805 mbedtls_printf( "passed\n PKCS#1 decryption : " );
marcozecchini 0:9fca2b23d0ba 1806
marcozecchini 0:9fca2b23d0ba 1807 if( mbedtls_rsa_pkcs1_decrypt( &rsa, myrand, NULL, MBEDTLS_RSA_PRIVATE, &len,
marcozecchini 0:9fca2b23d0ba 1808 rsa_ciphertext, rsa_decrypted,
marcozecchini 0:9fca2b23d0ba 1809 sizeof(rsa_decrypted) ) != 0 )
marcozecchini 0:9fca2b23d0ba 1810 {
marcozecchini 0:9fca2b23d0ba 1811 if( verbose != 0 )
marcozecchini 0:9fca2b23d0ba 1812 mbedtls_printf( "failed\n" );
marcozecchini 0:9fca2b23d0ba 1813
marcozecchini 0:9fca2b23d0ba 1814 return( 1 );
marcozecchini 0:9fca2b23d0ba 1815 }
marcozecchini 0:9fca2b23d0ba 1816
marcozecchini 0:9fca2b23d0ba 1817 if( memcmp( rsa_decrypted, rsa_plaintext, len ) != 0 )
marcozecchini 0:9fca2b23d0ba 1818 {
marcozecchini 0:9fca2b23d0ba 1819 if( verbose != 0 )
marcozecchini 0:9fca2b23d0ba 1820 mbedtls_printf( "failed\n" );
marcozecchini 0:9fca2b23d0ba 1821
marcozecchini 0:9fca2b23d0ba 1822 return( 1 );
marcozecchini 0:9fca2b23d0ba 1823 }
marcozecchini 0:9fca2b23d0ba 1824
marcozecchini 0:9fca2b23d0ba 1825 if( verbose != 0 )
marcozecchini 0:9fca2b23d0ba 1826 mbedtls_printf( "passed\n" );
marcozecchini 0:9fca2b23d0ba 1827
marcozecchini 0:9fca2b23d0ba 1828 #if defined(MBEDTLS_SHA1_C)
marcozecchini 0:9fca2b23d0ba 1829 if( verbose != 0 )
marcozecchini 0:9fca2b23d0ba 1830 mbedtls_printf( " PKCS#1 data sign : " );
marcozecchini 0:9fca2b23d0ba 1831
marcozecchini 0:9fca2b23d0ba 1832 mbedtls_sha1( rsa_plaintext, PT_LEN, sha1sum );
marcozecchini 0:9fca2b23d0ba 1833
marcozecchini 0:9fca2b23d0ba 1834 if( mbedtls_rsa_pkcs1_sign( &rsa, myrand, NULL, MBEDTLS_RSA_PRIVATE, MBEDTLS_MD_SHA1, 0,
marcozecchini 0:9fca2b23d0ba 1835 sha1sum, rsa_ciphertext ) != 0 )
marcozecchini 0:9fca2b23d0ba 1836 {
marcozecchini 0:9fca2b23d0ba 1837 if( verbose != 0 )
marcozecchini 0:9fca2b23d0ba 1838 mbedtls_printf( "failed\n" );
marcozecchini 0:9fca2b23d0ba 1839
marcozecchini 0:9fca2b23d0ba 1840 return( 1 );
marcozecchini 0:9fca2b23d0ba 1841 }
marcozecchini 0:9fca2b23d0ba 1842
marcozecchini 0:9fca2b23d0ba 1843 if( verbose != 0 )
marcozecchini 0:9fca2b23d0ba 1844 mbedtls_printf( "passed\n PKCS#1 sig. verify: " );
marcozecchini 0:9fca2b23d0ba 1845
marcozecchini 0:9fca2b23d0ba 1846 if( mbedtls_rsa_pkcs1_verify( &rsa, NULL, NULL, MBEDTLS_RSA_PUBLIC, MBEDTLS_MD_SHA1, 0,
marcozecchini 0:9fca2b23d0ba 1847 sha1sum, rsa_ciphertext ) != 0 )
marcozecchini 0:9fca2b23d0ba 1848 {
marcozecchini 0:9fca2b23d0ba 1849 if( verbose != 0 )
marcozecchini 0:9fca2b23d0ba 1850 mbedtls_printf( "failed\n" );
marcozecchini 0:9fca2b23d0ba 1851
marcozecchini 0:9fca2b23d0ba 1852 return( 1 );
marcozecchini 0:9fca2b23d0ba 1853 }
marcozecchini 0:9fca2b23d0ba 1854
marcozecchini 0:9fca2b23d0ba 1855 if( verbose != 0 )
marcozecchini 0:9fca2b23d0ba 1856 mbedtls_printf( "passed\n" );
marcozecchini 0:9fca2b23d0ba 1857 #endif /* MBEDTLS_SHA1_C */
marcozecchini 0:9fca2b23d0ba 1858
marcozecchini 0:9fca2b23d0ba 1859 if( verbose != 0 )
marcozecchini 0:9fca2b23d0ba 1860 mbedtls_printf( "\n" );
marcozecchini 0:9fca2b23d0ba 1861
marcozecchini 0:9fca2b23d0ba 1862 cleanup:
marcozecchini 0:9fca2b23d0ba 1863 mbedtls_rsa_free( &rsa );
marcozecchini 0:9fca2b23d0ba 1864 #else /* MBEDTLS_PKCS1_V15 */
marcozecchini 0:9fca2b23d0ba 1865 ((void) verbose);
marcozecchini 0:9fca2b23d0ba 1866 #endif /* MBEDTLS_PKCS1_V15 */
marcozecchini 0:9fca2b23d0ba 1867 return( ret );
marcozecchini 0:9fca2b23d0ba 1868 }
marcozecchini 0:9fca2b23d0ba 1869
marcozecchini 0:9fca2b23d0ba 1870 #endif /* MBEDTLS_SELF_TEST */
marcozecchini 0:9fca2b23d0ba 1871
marcozecchini 0:9fca2b23d0ba 1872 #endif /* MBEDTLS_RSA_C */