pegasus_dev

Users » switches » Code » pegasus_dev

features/mbedtls/src/rsa.c@3:1198227e6421, 2016-12-16 (annotated)

Committer:: switches
Date:: Fri Dec 16 16:27:57 2016 +0000
Revision:: 3:1198227e6421
Parent:: 0:5c4d7b2438d3

Changed ADC scale for MAX32625 platforms to 1.2V full scale to match MAX32630 platforms

Who changed what in which revision?

User	Revision	Line number	New contents of line
switches	0:5c4d7b2438d3	1	/*
switches	0:5c4d7b2438d3	2	* The RSA public-key cryptosystem
switches	0:5c4d7b2438d3	3	*
switches	0:5c4d7b2438d3	4	* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
switches	0:5c4d7b2438d3	5	* SPDX-License-Identifier: Apache-2.0
switches	0:5c4d7b2438d3	6	*
switches	0:5c4d7b2438d3	7	* Licensed under the Apache License, Version 2.0 (the "License"); you may
switches	0:5c4d7b2438d3	8	* not use this file except in compliance with the License.
switches	0:5c4d7b2438d3	9	* You may obtain a copy of the License at
switches	0:5c4d7b2438d3	10	*
switches	0:5c4d7b2438d3	11	* http://www.apache.org/licenses/LICENSE-2.0
switches	0:5c4d7b2438d3	12	*
switches	0:5c4d7b2438d3	13	* Unless required by applicable law or agreed to in writing, software
switches	0:5c4d7b2438d3	14	* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
switches	0:5c4d7b2438d3	15	* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
switches	0:5c4d7b2438d3	16	* See the License for the specific language governing permissions and
switches	0:5c4d7b2438d3	17	* limitations under the License.
switches	0:5c4d7b2438d3	18	*
switches	0:5c4d7b2438d3	19	* This file is part of mbed TLS (https://tls.mbed.org)
switches	0:5c4d7b2438d3	20	*/
switches	0:5c4d7b2438d3	21	/*
switches	0:5c4d7b2438d3	22	* The following sources were referenced in the design of this implementation
switches	0:5c4d7b2438d3	23	* of the RSA algorithm:
switches	0:5c4d7b2438d3	24	*
switches	0:5c4d7b2438d3	25	* [1] A method for obtaining digital signatures and public-key cryptosystems
switches	0:5c4d7b2438d3	26	* R Rivest, A Shamir, and L Adleman
switches	0:5c4d7b2438d3	27	* http://people.csail.mit.edu/rivest/pubs.html#RSA78
switches	0:5c4d7b2438d3	28	*
switches	0:5c4d7b2438d3	29	* [2] Handbook of Applied Cryptography - 1997, Chapter 8
switches	0:5c4d7b2438d3	30	* Menezes, van Oorschot and Vanstone
switches	0:5c4d7b2438d3	31	*
switches	0:5c4d7b2438d3	32	*/
switches	0:5c4d7b2438d3	33
switches	0:5c4d7b2438d3	34	#if !defined(MBEDTLS_CONFIG_FILE)
switches	0:5c4d7b2438d3	35	#include "mbedtls/config.h"
switches	0:5c4d7b2438d3	36	#else
switches	0:5c4d7b2438d3	37	#include MBEDTLS_CONFIG_FILE
switches	0:5c4d7b2438d3	38	#endif
switches	0:5c4d7b2438d3	39
switches	0:5c4d7b2438d3	40	#if defined(MBEDTLS_RSA_C)
switches	0:5c4d7b2438d3	41
switches	0:5c4d7b2438d3	42	#include "mbedtls/rsa.h"
switches	0:5c4d7b2438d3	43	#include "mbedtls/oid.h"
switches	0:5c4d7b2438d3	44
switches	0:5c4d7b2438d3	45	#include <string.h>
switches	0:5c4d7b2438d3	46
switches	0:5c4d7b2438d3	47	#if defined(MBEDTLS_PKCS1_V21)
switches	0:5c4d7b2438d3	48	#include "mbedtls/md.h"
switches	0:5c4d7b2438d3	49	#endif
switches	0:5c4d7b2438d3	50
switches	0:5c4d7b2438d3	51	#if defined(MBEDTLS_PKCS1_V15) && !defined(__OpenBSD__)
switches	0:5c4d7b2438d3	52	#include <stdlib.h>
switches	0:5c4d7b2438d3	53	#endif
switches	0:5c4d7b2438d3	54
switches	0:5c4d7b2438d3	55	#if defined(MBEDTLS_PLATFORM_C)
switches	0:5c4d7b2438d3	56	#include "mbedtls/platform.h"
switches	0:5c4d7b2438d3	57	#else
switches	0:5c4d7b2438d3	58	#include <stdio.h>
switches	0:5c4d7b2438d3	59	#define mbedtls_printf printf
switches	0:5c4d7b2438d3	60	#define mbedtls_calloc calloc
switches	0:5c4d7b2438d3	61	#define mbedtls_free free
switches	0:5c4d7b2438d3	62	#endif
switches	0:5c4d7b2438d3	63
switches	0:5c4d7b2438d3	64	/*
switches	0:5c4d7b2438d3	65	* Initialize an RSA context
switches	0:5c4d7b2438d3	66	*/
switches	0:5c4d7b2438d3	67	void mbedtls_rsa_init( mbedtls_rsa_context *ctx,
switches	0:5c4d7b2438d3	68	int padding,
switches	0:5c4d7b2438d3	69	int hash_id )
switches	0:5c4d7b2438d3	70	{
switches	0:5c4d7b2438d3	71	memset( ctx, 0, sizeof( mbedtls_rsa_context ) );
switches	0:5c4d7b2438d3	72
switches	0:5c4d7b2438d3	73	mbedtls_rsa_set_padding( ctx, padding, hash_id );
switches	0:5c4d7b2438d3	74
switches	0:5c4d7b2438d3	75	#if defined(MBEDTLS_THREADING_C)
switches	0:5c4d7b2438d3	76	mbedtls_mutex_init( &ctx->mutex );
switches	0:5c4d7b2438d3	77	#endif
switches	0:5c4d7b2438d3	78	}
switches	0:5c4d7b2438d3	79
switches	0:5c4d7b2438d3	80	/*
switches	0:5c4d7b2438d3	81	* Set padding for an existing RSA context
switches	0:5c4d7b2438d3	82	*/
switches	0:5c4d7b2438d3	83	void mbedtls_rsa_set_padding( mbedtls_rsa_context *ctx, int padding, int hash_id )
switches	0:5c4d7b2438d3	84	{
switches	0:5c4d7b2438d3	85	ctx->padding = padding;
switches	0:5c4d7b2438d3	86	ctx->hash_id = hash_id;
switches	0:5c4d7b2438d3	87	}
switches	0:5c4d7b2438d3	88
switches	0:5c4d7b2438d3	89	#if defined(MBEDTLS_GENPRIME)
switches	0:5c4d7b2438d3	90
switches	0:5c4d7b2438d3	91	/*
switches	0:5c4d7b2438d3	92	* Generate an RSA keypair
switches	0:5c4d7b2438d3	93	*/
switches	0:5c4d7b2438d3	94	int mbedtls_rsa_gen_key( mbedtls_rsa_context *ctx,
switches	0:5c4d7b2438d3	95	int (f_rng)(void , unsigned char *, size_t),
switches	0:5c4d7b2438d3	96	void *p_rng,
switches	0:5c4d7b2438d3	97	unsigned int nbits, int exponent )
switches	0:5c4d7b2438d3	98	{
switches	0:5c4d7b2438d3	99	int ret;
switches	0:5c4d7b2438d3	100	mbedtls_mpi P1, Q1, H, G;
switches	0:5c4d7b2438d3	101
switches	0:5c4d7b2438d3	102	if( f_rng == NULL \|\| nbits < 128 \|\| exponent < 3 )
switches	0:5c4d7b2438d3	103	return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
switches	0:5c4d7b2438d3	104
switches	0:5c4d7b2438d3	105	if( nbits % 2 )
switches	0:5c4d7b2438d3	106	return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
switches	0:5c4d7b2438d3	107
switches	0:5c4d7b2438d3	108	mbedtls_mpi_init( &P1 ); mbedtls_mpi_init( &Q1 );
switches	0:5c4d7b2438d3	109	mbedtls_mpi_init( &H ); mbedtls_mpi_init( &G );
switches	0:5c4d7b2438d3	110
switches	0:5c4d7b2438d3	111	/*
switches	0:5c4d7b2438d3	112	* find primes P and Q with Q < P so that:
switches	0:5c4d7b2438d3	113	* GCD( E, (P-1)*(Q-1) ) == 1
switches	0:5c4d7b2438d3	114	*/
switches	0:5c4d7b2438d3	115	MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &ctx->E, exponent ) );
switches	0:5c4d7b2438d3	116
switches	0:5c4d7b2438d3	117	do
switches	0:5c4d7b2438d3	118	{
switches	0:5c4d7b2438d3	119	MBEDTLS_MPI_CHK( mbedtls_mpi_gen_prime( &ctx->P, nbits >> 1, 0,
switches	0:5c4d7b2438d3	120	f_rng, p_rng ) );
switches	0:5c4d7b2438d3	121
switches	0:5c4d7b2438d3	122	MBEDTLS_MPI_CHK( mbedtls_mpi_gen_prime( &ctx->Q, nbits >> 1, 0,
switches	0:5c4d7b2438d3	123	f_rng, p_rng ) );
switches	0:5c4d7b2438d3	124
switches	0:5c4d7b2438d3	125	if( mbedtls_mpi_cmp_mpi( &ctx->P, &ctx->Q ) == 0 )
switches	0:5c4d7b2438d3	126	continue;
switches	0:5c4d7b2438d3	127
switches	0:5c4d7b2438d3	128	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ctx->N, &ctx->P, &ctx->Q ) );
switches	0:5c4d7b2438d3	129	if( mbedtls_mpi_bitlen( &ctx->N ) != nbits )
switches	0:5c4d7b2438d3	130	continue;
switches	0:5c4d7b2438d3	131
switches	0:5c4d7b2438d3	132	if( mbedtls_mpi_cmp_mpi( &ctx->P, &ctx->Q ) < 0 )
switches	0:5c4d7b2438d3	133	mbedtls_mpi_swap( &ctx->P, &ctx->Q );
switches	0:5c4d7b2438d3	134
switches	0:5c4d7b2438d3	135	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &P1, &ctx->P, 1 ) );
switches	0:5c4d7b2438d3	136	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &Q1, &ctx->Q, 1 ) );
switches	0:5c4d7b2438d3	137	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &H, &P1, &Q1 ) );
switches	0:5c4d7b2438d3	138	MBEDTLS_MPI_CHK( mbedtls_mpi_gcd( &G, &ctx->E, &H ) );
switches	0:5c4d7b2438d3	139	}
switches	0:5c4d7b2438d3	140	while( mbedtls_mpi_cmp_int( &G, 1 ) != 0 );
switches	0:5c4d7b2438d3	141
switches	0:5c4d7b2438d3	142	/*
switches	0:5c4d7b2438d3	143	* D = E^-1 mod ((P-1)*(Q-1))
switches	0:5c4d7b2438d3	144	* DP = D mod (P - 1)
switches	0:5c4d7b2438d3	145	* DQ = D mod (Q - 1)
switches	0:5c4d7b2438d3	146	* QP = Q^-1 mod P
switches	0:5c4d7b2438d3	147	*/
switches	0:5c4d7b2438d3	148	MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( &ctx->D , &ctx->E, &H ) );
switches	0:5c4d7b2438d3	149	MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &ctx->DP, &ctx->D, &P1 ) );
switches	0:5c4d7b2438d3	150	MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &ctx->DQ, &ctx->D, &Q1 ) );
switches	0:5c4d7b2438d3	151	MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( &ctx->QP, &ctx->Q, &ctx->P ) );
switches	0:5c4d7b2438d3	152
switches	0:5c4d7b2438d3	153	ctx->len = ( mbedtls_mpi_bitlen( &ctx->N ) + 7 ) >> 3;
switches	0:5c4d7b2438d3	154
switches	0:5c4d7b2438d3	155	cleanup:
switches	0:5c4d7b2438d3	156
switches	0:5c4d7b2438d3	157	mbedtls_mpi_free( &P1 ); mbedtls_mpi_free( &Q1 ); mbedtls_mpi_free( &H ); mbedtls_mpi_free( &G );
switches	0:5c4d7b2438d3	158
switches	0:5c4d7b2438d3	159	if( ret != 0 )
switches	0:5c4d7b2438d3	160	{
switches	0:5c4d7b2438d3	161	mbedtls_rsa_free( ctx );
switches	0:5c4d7b2438d3	162	return( MBEDTLS_ERR_RSA_KEY_GEN_FAILED + ret );
switches	0:5c4d7b2438d3	163	}
switches	0:5c4d7b2438d3	164
switches	0:5c4d7b2438d3	165	return( 0 );
switches	0:5c4d7b2438d3	166	}
switches	0:5c4d7b2438d3	167
switches	0:5c4d7b2438d3	168	#endif /* MBEDTLS_GENPRIME */
switches	0:5c4d7b2438d3	169
switches	0:5c4d7b2438d3	170	/*
switches	0:5c4d7b2438d3	171	* Check a public RSA key
switches	0:5c4d7b2438d3	172	*/
switches	0:5c4d7b2438d3	173	int mbedtls_rsa_check_pubkey( const mbedtls_rsa_context *ctx )
switches	0:5c4d7b2438d3	174	{
switches	0:5c4d7b2438d3	175	if( !ctx->N.p \|\| !ctx->E.p )
switches	0:5c4d7b2438d3	176	return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
switches	0:5c4d7b2438d3	177
switches	0:5c4d7b2438d3	178	if( ( ctx->N.p[0] & 1 ) == 0 \|\|
switches	0:5c4d7b2438d3	179	( ctx->E.p[0] & 1 ) == 0 )
switches	0:5c4d7b2438d3	180	return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
switches	0:5c4d7b2438d3	181
switches	0:5c4d7b2438d3	182	if( mbedtls_mpi_bitlen( &ctx->N ) < 128 \|\|
switches	0:5c4d7b2438d3	183	mbedtls_mpi_bitlen( &ctx->N ) > MBEDTLS_MPI_MAX_BITS )
switches	0:5c4d7b2438d3	184	return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
switches	0:5c4d7b2438d3	185
switches	0:5c4d7b2438d3	186	if( mbedtls_mpi_bitlen( &ctx->E ) < 2 \|\|
switches	0:5c4d7b2438d3	187	mbedtls_mpi_cmp_mpi( &ctx->E, &ctx->N ) >= 0 )
switches	0:5c4d7b2438d3	188	return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
switches	0:5c4d7b2438d3	189
switches	0:5c4d7b2438d3	190	return( 0 );
switches	0:5c4d7b2438d3	191	}
switches	0:5c4d7b2438d3	192
switches	0:5c4d7b2438d3	193	/*
switches	0:5c4d7b2438d3	194	* Check a private RSA key
switches	0:5c4d7b2438d3	195	*/
switches	0:5c4d7b2438d3	196	int mbedtls_rsa_check_privkey( const mbedtls_rsa_context *ctx )
switches	0:5c4d7b2438d3	197	{
switches	0:5c4d7b2438d3	198	int ret;
switches	0:5c4d7b2438d3	199	mbedtls_mpi PQ, DE, P1, Q1, H, I, G, G2, L1, L2, DP, DQ, QP;
switches	0:5c4d7b2438d3	200
switches	0:5c4d7b2438d3	201	if( ( ret = mbedtls_rsa_check_pubkey( ctx ) ) != 0 )
switches	0:5c4d7b2438d3	202	return( ret );
switches	0:5c4d7b2438d3	203
switches	0:5c4d7b2438d3	204	if( !ctx->P.p \|\| !ctx->Q.p \|\| !ctx->D.p )
switches	0:5c4d7b2438d3	205	return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
switches	0:5c4d7b2438d3	206
switches	0:5c4d7b2438d3	207	mbedtls_mpi_init( &PQ ); mbedtls_mpi_init( &DE ); mbedtls_mpi_init( &P1 ); mbedtls_mpi_init( &Q1 );
switches	0:5c4d7b2438d3	208	mbedtls_mpi_init( &H ); mbedtls_mpi_init( &I ); mbedtls_mpi_init( &G ); mbedtls_mpi_init( &G2 );
switches	0:5c4d7b2438d3	209	mbedtls_mpi_init( &L1 ); mbedtls_mpi_init( &L2 ); mbedtls_mpi_init( &DP ); mbedtls_mpi_init( &DQ );
switches	0:5c4d7b2438d3	210	mbedtls_mpi_init( &QP );
switches	0:5c4d7b2438d3	211
switches	0:5c4d7b2438d3	212	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &PQ, &ctx->P, &ctx->Q ) );
switches	0:5c4d7b2438d3	213	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &DE, &ctx->D, &ctx->E ) );
switches	0:5c4d7b2438d3	214	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &P1, &ctx->P, 1 ) );
switches	0:5c4d7b2438d3	215	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &Q1, &ctx->Q, 1 ) );
switches	0:5c4d7b2438d3	216	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &H, &P1, &Q1 ) );
switches	0:5c4d7b2438d3	217	MBEDTLS_MPI_CHK( mbedtls_mpi_gcd( &G, &ctx->E, &H ) );
switches	0:5c4d7b2438d3	218
switches	0:5c4d7b2438d3	219	MBEDTLS_MPI_CHK( mbedtls_mpi_gcd( &G2, &P1, &Q1 ) );
switches	0:5c4d7b2438d3	220	MBEDTLS_MPI_CHK( mbedtls_mpi_div_mpi( &L1, &L2, &H, &G2 ) );
switches	0:5c4d7b2438d3	221	MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &I, &DE, &L1 ) );
switches	0:5c4d7b2438d3	222
switches	0:5c4d7b2438d3	223	MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &DP, &ctx->D, &P1 ) );
switches	0:5c4d7b2438d3	224	MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &DQ, &ctx->D, &Q1 ) );
switches	0:5c4d7b2438d3	225	MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( &QP, &ctx->Q, &ctx->P ) );
switches	0:5c4d7b2438d3	226	/*
switches	0:5c4d7b2438d3	227	* Check for a valid PKCS1v2 private key
switches	0:5c4d7b2438d3	228	*/
switches	0:5c4d7b2438d3	229	if( mbedtls_mpi_cmp_mpi( &PQ, &ctx->N ) != 0 \|\|
switches	0:5c4d7b2438d3	230	mbedtls_mpi_cmp_mpi( &DP, &ctx->DP ) != 0 \|\|
switches	0:5c4d7b2438d3	231	mbedtls_mpi_cmp_mpi( &DQ, &ctx->DQ ) != 0 \|\|
switches	0:5c4d7b2438d3	232	mbedtls_mpi_cmp_mpi( &QP, &ctx->QP ) != 0 \|\|
switches	0:5c4d7b2438d3	233	mbedtls_mpi_cmp_int( &L2, 0 ) != 0 \|\|
switches	0:5c4d7b2438d3	234	mbedtls_mpi_cmp_int( &I, 1 ) != 0 \|\|
switches	0:5c4d7b2438d3	235	mbedtls_mpi_cmp_int( &G, 1 ) != 0 )
switches	0:5c4d7b2438d3	236	{
switches	0:5c4d7b2438d3	237	ret = MBEDTLS_ERR_RSA_KEY_CHECK_FAILED;
switches	0:5c4d7b2438d3	238	}
switches	0:5c4d7b2438d3	239
switches	0:5c4d7b2438d3	240	cleanup:
switches	0:5c4d7b2438d3	241	mbedtls_mpi_free( &PQ ); mbedtls_mpi_free( &DE ); mbedtls_mpi_free( &P1 ); mbedtls_mpi_free( &Q1 );
switches	0:5c4d7b2438d3	242	mbedtls_mpi_free( &H ); mbedtls_mpi_free( &I ); mbedtls_mpi_free( &G ); mbedtls_mpi_free( &G2 );
switches	0:5c4d7b2438d3	243	mbedtls_mpi_free( &L1 ); mbedtls_mpi_free( &L2 ); mbedtls_mpi_free( &DP ); mbedtls_mpi_free( &DQ );
switches	0:5c4d7b2438d3	244	mbedtls_mpi_free( &QP );
switches	0:5c4d7b2438d3	245
switches	0:5c4d7b2438d3	246	if( ret == MBEDTLS_ERR_RSA_KEY_CHECK_FAILED )
switches	0:5c4d7b2438d3	247	return( ret );
switches	0:5c4d7b2438d3	248
switches	0:5c4d7b2438d3	249	if( ret != 0 )
switches	0:5c4d7b2438d3	250	return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED + ret );
switches	0:5c4d7b2438d3	251
switches	0:5c4d7b2438d3	252	return( 0 );
switches	0:5c4d7b2438d3	253	}
switches	0:5c4d7b2438d3	254
switches	0:5c4d7b2438d3	255	/*
switches	0:5c4d7b2438d3	256	* Check if contexts holding a public and private key match
switches	0:5c4d7b2438d3	257	*/
switches	0:5c4d7b2438d3	258	int mbedtls_rsa_check_pub_priv( const mbedtls_rsa_context pub, const mbedtls_rsa_context prv )
switches	0:5c4d7b2438d3	259	{
switches	0:5c4d7b2438d3	260	if( mbedtls_rsa_check_pubkey( pub ) != 0 \|\|
switches	0:5c4d7b2438d3	261	mbedtls_rsa_check_privkey( prv ) != 0 )
switches	0:5c4d7b2438d3	262	{
switches	0:5c4d7b2438d3	263	return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
switches	0:5c4d7b2438d3	264	}
switches	0:5c4d7b2438d3	265
switches	0:5c4d7b2438d3	266	if( mbedtls_mpi_cmp_mpi( &pub->N, &prv->N ) != 0 \|\|
switches	0:5c4d7b2438d3	267	mbedtls_mpi_cmp_mpi( &pub->E, &prv->E ) != 0 )
switches	0:5c4d7b2438d3	268	{
switches	0:5c4d7b2438d3	269	return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
switches	0:5c4d7b2438d3	270	}
switches	0:5c4d7b2438d3	271
switches	0:5c4d7b2438d3	272	return( 0 );
switches	0:5c4d7b2438d3	273	}
switches	0:5c4d7b2438d3	274
switches	0:5c4d7b2438d3	275	/*
switches	0:5c4d7b2438d3	276	* Do an RSA public key operation
switches	0:5c4d7b2438d3	277	*/
switches	0:5c4d7b2438d3	278	int mbedtls_rsa_public( mbedtls_rsa_context *ctx,
switches	0:5c4d7b2438d3	279	const unsigned char *input,
switches	0:5c4d7b2438d3	280	unsigned char *output )
switches	0:5c4d7b2438d3	281	{
switches	0:5c4d7b2438d3	282	int ret;
switches	0:5c4d7b2438d3	283	size_t olen;
switches	0:5c4d7b2438d3	284	mbedtls_mpi T;
switches	0:5c4d7b2438d3	285
switches	0:5c4d7b2438d3	286	mbedtls_mpi_init( &T );
switches	0:5c4d7b2438d3	287
switches	0:5c4d7b2438d3	288	#if defined(MBEDTLS_THREADING_C)
switches	0:5c4d7b2438d3	289	if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
switches	0:5c4d7b2438d3	290	return( ret );
switches	0:5c4d7b2438d3	291	#endif
switches	0:5c4d7b2438d3	292
switches	0:5c4d7b2438d3	293	MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &T, input, ctx->len ) );
switches	0:5c4d7b2438d3	294
switches	0:5c4d7b2438d3	295	if( mbedtls_mpi_cmp_mpi( &T, &ctx->N ) >= 0 )
switches	0:5c4d7b2438d3	296	{
switches	0:5c4d7b2438d3	297	ret = MBEDTLS_ERR_MPI_BAD_INPUT_DATA;
switches	0:5c4d7b2438d3	298	goto cleanup;
switches	0:5c4d7b2438d3	299	}
switches	0:5c4d7b2438d3	300
switches	0:5c4d7b2438d3	301	olen = ctx->len;
switches	0:5c4d7b2438d3	302	MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &T, &T, &ctx->E, &ctx->N, &ctx->RN ) );
switches	0:5c4d7b2438d3	303	MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &T, output, olen ) );
switches	0:5c4d7b2438d3	304
switches	0:5c4d7b2438d3	305	cleanup:
switches	0:5c4d7b2438d3	306	#if defined(MBEDTLS_THREADING_C)
switches	0:5c4d7b2438d3	307	if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
switches	0:5c4d7b2438d3	308	return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
switches	0:5c4d7b2438d3	309	#endif
switches	0:5c4d7b2438d3	310
switches	0:5c4d7b2438d3	311	mbedtls_mpi_free( &T );
switches	0:5c4d7b2438d3	312
switches	0:5c4d7b2438d3	313	if( ret != 0 )
switches	0:5c4d7b2438d3	314	return( MBEDTLS_ERR_RSA_PUBLIC_FAILED + ret );
switches	0:5c4d7b2438d3	315
switches	0:5c4d7b2438d3	316	return( 0 );
switches	0:5c4d7b2438d3	317	}
switches	0:5c4d7b2438d3	318
switches	0:5c4d7b2438d3	319	/*
switches	0:5c4d7b2438d3	320	* Generate or update blinding values, see section 10 of:
switches	0:5c4d7b2438d3	321	* KOCHER, Paul C. Timing attacks on implementations of Diffie-Hellman, RSA,
switches	0:5c4d7b2438d3	322	* DSS, and other systems. In : Advances in Cryptology-CRYPTO'96. Springer
switches	0:5c4d7b2438d3	323	* Berlin Heidelberg, 1996. p. 104-113.
switches	0:5c4d7b2438d3	324	*/
switches	0:5c4d7b2438d3	325	static int rsa_prepare_blinding( mbedtls_rsa_context *ctx,
switches	0:5c4d7b2438d3	326	int (f_rng)(void , unsigned char , size_t), void p_rng )
switches	0:5c4d7b2438d3	327	{
switches	0:5c4d7b2438d3	328	int ret, count = 0;
switches	0:5c4d7b2438d3	329
switches	0:5c4d7b2438d3	330	if( ctx->Vf.p != NULL )
switches	0:5c4d7b2438d3	331	{
switches	0:5c4d7b2438d3	332	/* We already have blinding values, just update them by squaring */
switches	0:5c4d7b2438d3	333	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ctx->Vi, &ctx->Vi, &ctx->Vi ) );
switches	0:5c4d7b2438d3	334	MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &ctx->Vi, &ctx->Vi, &ctx->N ) );
switches	0:5c4d7b2438d3	335	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ctx->Vf, &ctx->Vf, &ctx->Vf ) );
switches	0:5c4d7b2438d3	336	MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &ctx->Vf, &ctx->Vf, &ctx->N ) );
switches	0:5c4d7b2438d3	337
switches	0:5c4d7b2438d3	338	goto cleanup;
switches	0:5c4d7b2438d3	339	}
switches	0:5c4d7b2438d3	340
switches	0:5c4d7b2438d3	341	/* Unblinding value: Vf = random number, invertible mod N */
switches	0:5c4d7b2438d3	342	do {
switches	0:5c4d7b2438d3	343	if( count++ > 10 )
switches	0:5c4d7b2438d3	344	return( MBEDTLS_ERR_RSA_RNG_FAILED );
switches	0:5c4d7b2438d3	345
switches	0:5c4d7b2438d3	346	MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &ctx->Vf, ctx->len - 1, f_rng, p_rng ) );
switches	0:5c4d7b2438d3	347	MBEDTLS_MPI_CHK( mbedtls_mpi_gcd( &ctx->Vi, &ctx->Vf, &ctx->N ) );
switches	0:5c4d7b2438d3	348	} while( mbedtls_mpi_cmp_int( &ctx->Vi, 1 ) != 0 );
switches	0:5c4d7b2438d3	349
switches	0:5c4d7b2438d3	350	/* Blinding value: Vi = Vf^(-e) mod N */
switches	0:5c4d7b2438d3	351	MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( &ctx->Vi, &ctx->Vf, &ctx->N ) );
switches	0:5c4d7b2438d3	352	MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &ctx->Vi, &ctx->Vi, &ctx->E, &ctx->N, &ctx->RN ) );
switches	0:5c4d7b2438d3	353
switches	0:5c4d7b2438d3	354
switches	0:5c4d7b2438d3	355	cleanup:
switches	0:5c4d7b2438d3	356	return( ret );
switches	0:5c4d7b2438d3	357	}
switches	0:5c4d7b2438d3	358
switches	0:5c4d7b2438d3	359	/*
switches	0:5c4d7b2438d3	360	* Do an RSA private key operation
switches	0:5c4d7b2438d3	361	*/
switches	0:5c4d7b2438d3	362	int mbedtls_rsa_private( mbedtls_rsa_context *ctx,
switches	0:5c4d7b2438d3	363	int (f_rng)(void , unsigned char *, size_t),
switches	0:5c4d7b2438d3	364	void *p_rng,
switches	0:5c4d7b2438d3	365	const unsigned char *input,
switches	0:5c4d7b2438d3	366	unsigned char *output )
switches	0:5c4d7b2438d3	367	{
switches	0:5c4d7b2438d3	368	int ret;
switches	0:5c4d7b2438d3	369	size_t olen;
switches	0:5c4d7b2438d3	370	mbedtls_mpi T, T1, T2;
switches	0:5c4d7b2438d3	371
switches	0:5c4d7b2438d3	372	/* Make sure we have private key info, prevent possible misuse */
switches	0:5c4d7b2438d3	373	if( ctx->P.p == NULL \|\| ctx->Q.p == NULL \|\| ctx->D.p == NULL )
switches	0:5c4d7b2438d3	374	return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
switches	0:5c4d7b2438d3	375
switches	0:5c4d7b2438d3	376	mbedtls_mpi_init( &T ); mbedtls_mpi_init( &T1 ); mbedtls_mpi_init( &T2 );
switches	0:5c4d7b2438d3	377
switches	0:5c4d7b2438d3	378	#if defined(MBEDTLS_THREADING_C)
switches	0:5c4d7b2438d3	379	if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
switches	0:5c4d7b2438d3	380	return( ret );
switches	0:5c4d7b2438d3	381	#endif
switches	0:5c4d7b2438d3	382
switches	0:5c4d7b2438d3	383	MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &T, input, ctx->len ) );
switches	0:5c4d7b2438d3	384	if( mbedtls_mpi_cmp_mpi( &T, &ctx->N ) >= 0 )
switches	0:5c4d7b2438d3	385	{
switches	0:5c4d7b2438d3	386	ret = MBEDTLS_ERR_MPI_BAD_INPUT_DATA;
switches	0:5c4d7b2438d3	387	goto cleanup;
switches	0:5c4d7b2438d3	388	}
switches	0:5c4d7b2438d3	389
switches	0:5c4d7b2438d3	390	if( f_rng != NULL )
switches	0:5c4d7b2438d3	391	{
switches	0:5c4d7b2438d3	392	/*
switches	0:5c4d7b2438d3	393	* Blinding
switches	0:5c4d7b2438d3	394	* T = T * Vi mod N
switches	0:5c4d7b2438d3	395	*/
switches	0:5c4d7b2438d3	396	MBEDTLS_MPI_CHK( rsa_prepare_blinding( ctx, f_rng, p_rng ) );
switches	0:5c4d7b2438d3	397	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T, &T, &ctx->Vi ) );
switches	0:5c4d7b2438d3	398	MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &T, &T, &ctx->N ) );
switches	0:5c4d7b2438d3	399	}
switches	0:5c4d7b2438d3	400
switches	0:5c4d7b2438d3	401	#if defined(MBEDTLS_RSA_NO_CRT)
switches	0:5c4d7b2438d3	402	MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &T, &T, &ctx->D, &ctx->N, &ctx->RN ) );
switches	0:5c4d7b2438d3	403	#else
switches	0:5c4d7b2438d3	404	/*
switches	0:5c4d7b2438d3	405	* faster decryption using the CRT
switches	0:5c4d7b2438d3	406	*
switches	0:5c4d7b2438d3	407	* T1 = input ^ dP mod P
switches	0:5c4d7b2438d3	408	* T2 = input ^ dQ mod Q
switches	0:5c4d7b2438d3	409	*/
switches	0:5c4d7b2438d3	410	MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &T1, &T, &ctx->DP, &ctx->P, &ctx->RP ) );
switches	0:5c4d7b2438d3	411	MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &T2, &T, &ctx->DQ, &ctx->Q, &ctx->RQ ) );
switches	0:5c4d7b2438d3	412
switches	0:5c4d7b2438d3	413	/*
switches	0:5c4d7b2438d3	414	* T = (T1 - T2) * (Q^-1 mod P) mod P
switches	0:5c4d7b2438d3	415	*/
switches	0:5c4d7b2438d3	416	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &T, &T1, &T2 ) );
switches	0:5c4d7b2438d3	417	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T1, &T, &ctx->QP ) );
switches	0:5c4d7b2438d3	418	MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &T, &T1, &ctx->P ) );
switches	0:5c4d7b2438d3	419
switches	0:5c4d7b2438d3	420	/*
switches	0:5c4d7b2438d3	421	* T = T2 + T * Q
switches	0:5c4d7b2438d3	422	*/
switches	0:5c4d7b2438d3	423	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T1, &T, &ctx->Q ) );
switches	0:5c4d7b2438d3	424	MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &T, &T2, &T1 ) );
switches	0:5c4d7b2438d3	425	#endif /* MBEDTLS_RSA_NO_CRT */
switches	0:5c4d7b2438d3	426
switches	0:5c4d7b2438d3	427	if( f_rng != NULL )
switches	0:5c4d7b2438d3	428	{
switches	0:5c4d7b2438d3	429	/*
switches	0:5c4d7b2438d3	430	* Unblind
switches	0:5c4d7b2438d3	431	* T = T * Vf mod N
switches	0:5c4d7b2438d3	432	*/
switches	0:5c4d7b2438d3	433	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T, &T, &ctx->Vf ) );
switches	0:5c4d7b2438d3	434	MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &T, &T, &ctx->N ) );
switches	0:5c4d7b2438d3	435	}
switches	0:5c4d7b2438d3	436
switches	0:5c4d7b2438d3	437	olen = ctx->len;
switches	0:5c4d7b2438d3	438	MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &T, output, olen ) );
switches	0:5c4d7b2438d3	439
switches	0:5c4d7b2438d3	440	cleanup:
switches	0:5c4d7b2438d3	441	#if defined(MBEDTLS_THREADING_C)
switches	0:5c4d7b2438d3	442	if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
switches	0:5c4d7b2438d3	443	return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
switches	0:5c4d7b2438d3	444	#endif
switches	0:5c4d7b2438d3	445
switches	0:5c4d7b2438d3	446	mbedtls_mpi_free( &T ); mbedtls_mpi_free( &T1 ); mbedtls_mpi_free( &T2 );
switches	0:5c4d7b2438d3	447
switches	0:5c4d7b2438d3	448	if( ret != 0 )
switches	0:5c4d7b2438d3	449	return( MBEDTLS_ERR_RSA_PRIVATE_FAILED + ret );
switches	0:5c4d7b2438d3	450
switches	0:5c4d7b2438d3	451	return( 0 );
switches	0:5c4d7b2438d3	452	}
switches	0:5c4d7b2438d3	453
switches	0:5c4d7b2438d3	454	#if defined(MBEDTLS_PKCS1_V21)
switches	0:5c4d7b2438d3	455	/**
switches	0:5c4d7b2438d3	456	* Generate and apply the MGF1 operation (from PKCS#1 v2.1) to a buffer.
switches	0:5c4d7b2438d3	457	*
switches	0:5c4d7b2438d3	458	* \param dst buffer to mask
switches	0:5c4d7b2438d3	459	* \param dlen length of destination buffer
switches	0:5c4d7b2438d3	460	* \param src source of the mask generation
switches	0:5c4d7b2438d3	461	* \param slen length of the source buffer
switches	0:5c4d7b2438d3	462	* \param md_ctx message digest context to use
switches	0:5c4d7b2438d3	463	*/
switches	0:5c4d7b2438d3	464	static void mgf_mask( unsigned char dst, size_t dlen, unsigned char src,
switches	0:5c4d7b2438d3	465	size_t slen, mbedtls_md_context_t *md_ctx )
switches	0:5c4d7b2438d3	466	{
switches	0:5c4d7b2438d3	467	unsigned char mask[MBEDTLS_MD_MAX_SIZE];
switches	0:5c4d7b2438d3	468	unsigned char counter[4];
switches	0:5c4d7b2438d3	469	unsigned char *p;
switches	0:5c4d7b2438d3	470	unsigned int hlen;
switches	0:5c4d7b2438d3	471	size_t i, use_len;
switches	0:5c4d7b2438d3	472
switches	0:5c4d7b2438d3	473	memset( mask, 0, MBEDTLS_MD_MAX_SIZE );
switches	0:5c4d7b2438d3	474	memset( counter, 0, 4 );
switches	0:5c4d7b2438d3	475
switches	0:5c4d7b2438d3	476	hlen = mbedtls_md_get_size( md_ctx->md_info );
switches	0:5c4d7b2438d3	477
switches	0:5c4d7b2438d3	478	/* Generate and apply dbMask */
switches	0:5c4d7b2438d3	479	p = dst;
switches	0:5c4d7b2438d3	480
switches	0:5c4d7b2438d3	481	while( dlen > 0 )
switches	0:5c4d7b2438d3	482	{
switches	0:5c4d7b2438d3	483	use_len = hlen;
switches	0:5c4d7b2438d3	484	if( dlen < hlen )
switches	0:5c4d7b2438d3	485	use_len = dlen;
switches	0:5c4d7b2438d3	486
switches	0:5c4d7b2438d3	487	mbedtls_md_starts( md_ctx );
switches	0:5c4d7b2438d3	488	mbedtls_md_update( md_ctx, src, slen );
switches	0:5c4d7b2438d3	489	mbedtls_md_update( md_ctx, counter, 4 );
switches	0:5c4d7b2438d3	490	mbedtls_md_finish( md_ctx, mask );
switches	0:5c4d7b2438d3	491
switches	0:5c4d7b2438d3	492	for( i = 0; i < use_len; ++i )
switches	0:5c4d7b2438d3	493	*p++ ^= mask[i];
switches	0:5c4d7b2438d3	494
switches	0:5c4d7b2438d3	495	counter[3]++;
switches	0:5c4d7b2438d3	496
switches	0:5c4d7b2438d3	497	dlen -= use_len;
switches	0:5c4d7b2438d3	498	}
switches	0:5c4d7b2438d3	499	}
switches	0:5c4d7b2438d3	500	#endif /* MBEDTLS_PKCS1_V21 */
switches	0:5c4d7b2438d3	501
switches	0:5c4d7b2438d3	502	#if defined(MBEDTLS_PKCS1_V21)
switches	0:5c4d7b2438d3	503	/*
switches	0:5c4d7b2438d3	504	* Implementation of the PKCS#1 v2.1 RSAES-OAEP-ENCRYPT function
switches	0:5c4d7b2438d3	505	*/
switches	0:5c4d7b2438d3	506	int mbedtls_rsa_rsaes_oaep_encrypt( mbedtls_rsa_context *ctx,
switches	0:5c4d7b2438d3	507	int (f_rng)(void , unsigned char *, size_t),
switches	0:5c4d7b2438d3	508	void *p_rng,
switches	0:5c4d7b2438d3	509	int mode,
switches	0:5c4d7b2438d3	510	const unsigned char *label, size_t label_len,
switches	0:5c4d7b2438d3	511	size_t ilen,
switches	0:5c4d7b2438d3	512	const unsigned char *input,
switches	0:5c4d7b2438d3	513	unsigned char *output )
switches	0:5c4d7b2438d3	514	{
switches	0:5c4d7b2438d3	515	size_t olen;
switches	0:5c4d7b2438d3	516	int ret;
switches	0:5c4d7b2438d3	517	unsigned char *p = output;
switches	0:5c4d7b2438d3	518	unsigned int hlen;
switches	0:5c4d7b2438d3	519	const mbedtls_md_info_t *md_info;
switches	0:5c4d7b2438d3	520	mbedtls_md_context_t md_ctx;
switches	0:5c4d7b2438d3	521
switches	0:5c4d7b2438d3	522	if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V21 )
switches	0:5c4d7b2438d3	523	return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
switches	0:5c4d7b2438d3	524
switches	0:5c4d7b2438d3	525	if( f_rng == NULL )
switches	0:5c4d7b2438d3	526	return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
switches	0:5c4d7b2438d3	527
switches	0:5c4d7b2438d3	528	md_info = mbedtls_md_info_from_type( (mbedtls_md_type_t) ctx->hash_id );
switches	0:5c4d7b2438d3	529	if( md_info == NULL )
switches	0:5c4d7b2438d3	530	return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
switches	0:5c4d7b2438d3	531
switches	0:5c4d7b2438d3	532	olen = ctx->len;
switches	0:5c4d7b2438d3	533	hlen = mbedtls_md_get_size( md_info );
switches	0:5c4d7b2438d3	534
switches	0:5c4d7b2438d3	535	/* first comparison checks for overflow */
switches	0:5c4d7b2438d3	536	if( ilen + 2 * hlen + 2 < ilen \|\| olen < ilen + 2 * hlen + 2 )
switches	0:5c4d7b2438d3	537	return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
switches	0:5c4d7b2438d3	538
switches	0:5c4d7b2438d3	539	memset( output, 0, olen );
switches	0:5c4d7b2438d3	540
switches	0:5c4d7b2438d3	541	*p++ = 0;
switches	0:5c4d7b2438d3	542
switches	0:5c4d7b2438d3	543	/* Generate a random octet string seed */
switches	0:5c4d7b2438d3	544	if( ( ret = f_rng( p_rng, p, hlen ) ) != 0 )
switches	0:5c4d7b2438d3	545	return( MBEDTLS_ERR_RSA_RNG_FAILED + ret );
switches	0:5c4d7b2438d3	546
switches	0:5c4d7b2438d3	547	p += hlen;
switches	0:5c4d7b2438d3	548
switches	0:5c4d7b2438d3	549	/* Construct DB */
switches	0:5c4d7b2438d3	550	mbedtls_md( md_info, label, label_len, p );
switches	0:5c4d7b2438d3	551	p += hlen;
switches	0:5c4d7b2438d3	552	p += olen - 2 * hlen - 2 - ilen;
switches	0:5c4d7b2438d3	553	*p++ = 1;
switches	0:5c4d7b2438d3	554	memcpy( p, input, ilen );
switches	0:5c4d7b2438d3	555
switches	0:5c4d7b2438d3	556	mbedtls_md_init( &md_ctx );
switches	0:5c4d7b2438d3	557	if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 0 ) ) != 0 )
switches	0:5c4d7b2438d3	558	{
switches	0:5c4d7b2438d3	559	mbedtls_md_free( &md_ctx );
switches	0:5c4d7b2438d3	560	return( ret );
switches	0:5c4d7b2438d3	561	}
switches	0:5c4d7b2438d3	562
switches	0:5c4d7b2438d3	563	/* maskedDB: Apply dbMask to DB */
switches	0:5c4d7b2438d3	564	mgf_mask( output + hlen + 1, olen - hlen - 1, output + 1, hlen,
switches	0:5c4d7b2438d3	565	&md_ctx );
switches	0:5c4d7b2438d3	566
switches	0:5c4d7b2438d3	567	/* maskedSeed: Apply seedMask to seed */
switches	0:5c4d7b2438d3	568	mgf_mask( output + 1, hlen, output + hlen + 1, olen - hlen - 1,
switches	0:5c4d7b2438d3	569	&md_ctx );
switches	0:5c4d7b2438d3	570
switches	0:5c4d7b2438d3	571	mbedtls_md_free( &md_ctx );
switches	0:5c4d7b2438d3	572
switches	0:5c4d7b2438d3	573	return( ( mode == MBEDTLS_RSA_PUBLIC )
switches	0:5c4d7b2438d3	574	? mbedtls_rsa_public( ctx, output, output )
switches	0:5c4d7b2438d3	575	: mbedtls_rsa_private( ctx, f_rng, p_rng, output, output ) );
switches	0:5c4d7b2438d3	576	}
switches	0:5c4d7b2438d3	577	#endif /* MBEDTLS_PKCS1_V21 */
switches	0:5c4d7b2438d3	578
switches	0:5c4d7b2438d3	579	#if defined(MBEDTLS_PKCS1_V15)
switches	0:5c4d7b2438d3	580	/*
switches	0:5c4d7b2438d3	581	* Implementation of the PKCS#1 v2.1 RSAES-PKCS1-V1_5-ENCRYPT function
switches	0:5c4d7b2438d3	582	*/
switches	0:5c4d7b2438d3	583	int mbedtls_rsa_rsaes_pkcs1_v15_encrypt( mbedtls_rsa_context *ctx,
switches	0:5c4d7b2438d3	584	int (f_rng)(void , unsigned char *, size_t),
switches	0:5c4d7b2438d3	585	void *p_rng,
switches	0:5c4d7b2438d3	586	int mode, size_t ilen,
switches	0:5c4d7b2438d3	587	const unsigned char *input,
switches	0:5c4d7b2438d3	588	unsigned char *output )
switches	0:5c4d7b2438d3	589	{
switches	0:5c4d7b2438d3	590	size_t nb_pad, olen;
switches	0:5c4d7b2438d3	591	int ret;
switches	0:5c4d7b2438d3	592	unsigned char *p = output;
switches	0:5c4d7b2438d3	593
switches	0:5c4d7b2438d3	594	if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V15 )
switches	0:5c4d7b2438d3	595	return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
switches	0:5c4d7b2438d3	596
switches	0:5c4d7b2438d3	597	// We don't check p_rng because it won't be dereferenced here
switches	0:5c4d7b2438d3	598	if( f_rng == NULL \|\| input == NULL \|\| output == NULL )
switches	0:5c4d7b2438d3	599	return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
switches	0:5c4d7b2438d3	600
switches	0:5c4d7b2438d3	601	olen = ctx->len;
switches	0:5c4d7b2438d3	602
switches	0:5c4d7b2438d3	603	/* first comparison checks for overflow */
switches	0:5c4d7b2438d3	604	if( ilen + 11 < ilen \|\| olen < ilen + 11 )
switches	0:5c4d7b2438d3	605	return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
switches	0:5c4d7b2438d3	606
switches	0:5c4d7b2438d3	607	nb_pad = olen - 3 - ilen;
switches	0:5c4d7b2438d3	608
switches	0:5c4d7b2438d3	609	*p++ = 0;
switches	0:5c4d7b2438d3	610	if( mode == MBEDTLS_RSA_PUBLIC )
switches	0:5c4d7b2438d3	611	{
switches	0:5c4d7b2438d3	612	*p++ = MBEDTLS_RSA_CRYPT;
switches	0:5c4d7b2438d3	613
switches	0:5c4d7b2438d3	614	while( nb_pad-- > 0 )
switches	0:5c4d7b2438d3	615	{
switches	0:5c4d7b2438d3	616	int rng_dl = 100;
switches	0:5c4d7b2438d3	617
switches	0:5c4d7b2438d3	618	do {
switches	0:5c4d7b2438d3	619	ret = f_rng( p_rng, p, 1 );
switches	0:5c4d7b2438d3	620	} while( *p == 0 && --rng_dl && ret == 0 );
switches	0:5c4d7b2438d3	621
switches	0:5c4d7b2438d3	622	/* Check if RNG failed to generate data */
switches	0:5c4d7b2438d3	623	if( rng_dl == 0 \|\| ret != 0 )
switches	0:5c4d7b2438d3	624	return( MBEDTLS_ERR_RSA_RNG_FAILED + ret );
switches	0:5c4d7b2438d3	625
switches	0:5c4d7b2438d3	626	p++;
switches	0:5c4d7b2438d3	627	}
switches	0:5c4d7b2438d3	628	}
switches	0:5c4d7b2438d3	629	else
switches	0:5c4d7b2438d3	630	{
switches	0:5c4d7b2438d3	631	*p++ = MBEDTLS_RSA_SIGN;
switches	0:5c4d7b2438d3	632
switches	0:5c4d7b2438d3	633	while( nb_pad-- > 0 )
switches	0:5c4d7b2438d3	634	*p++ = 0xFF;
switches	0:5c4d7b2438d3	635	}
switches	0:5c4d7b2438d3	636
switches	0:5c4d7b2438d3	637	*p++ = 0;
switches	0:5c4d7b2438d3	638	memcpy( p, input, ilen );
switches	0:5c4d7b2438d3	639
switches	0:5c4d7b2438d3	640	return( ( mode == MBEDTLS_RSA_PUBLIC )
switches	0:5c4d7b2438d3	641	? mbedtls_rsa_public( ctx, output, output )
switches	0:5c4d7b2438d3	642	: mbedtls_rsa_private( ctx, f_rng, p_rng, output, output ) );
switches	0:5c4d7b2438d3	643	}
switches	0:5c4d7b2438d3	644	#endif /* MBEDTLS_PKCS1_V15 */
switches	0:5c4d7b2438d3	645
switches	0:5c4d7b2438d3	646	/*
switches	0:5c4d7b2438d3	647	* Add the message padding, then do an RSA operation
switches	0:5c4d7b2438d3	648	*/
switches	0:5c4d7b2438d3	649	int mbedtls_rsa_pkcs1_encrypt( mbedtls_rsa_context *ctx,
switches	0:5c4d7b2438d3	650	int (f_rng)(void , unsigned char *, size_t),
switches	0:5c4d7b2438d3	651	void *p_rng,
switches	0:5c4d7b2438d3	652	int mode, size_t ilen,
switches	0:5c4d7b2438d3	653	const unsigned char *input,
switches	0:5c4d7b2438d3	654	unsigned char *output )
switches	0:5c4d7b2438d3	655	{
switches	0:5c4d7b2438d3	656	switch( ctx->padding )
switches	0:5c4d7b2438d3	657	{
switches	0:5c4d7b2438d3	658	#if defined(MBEDTLS_PKCS1_V15)
switches	0:5c4d7b2438d3	659	case MBEDTLS_RSA_PKCS_V15:
switches	0:5c4d7b2438d3	660	return mbedtls_rsa_rsaes_pkcs1_v15_encrypt( ctx, f_rng, p_rng, mode, ilen,
switches	0:5c4d7b2438d3	661	input, output );
switches	0:5c4d7b2438d3	662	#endif
switches	0:5c4d7b2438d3	663
switches	0:5c4d7b2438d3	664	#if defined(MBEDTLS_PKCS1_V21)
switches	0:5c4d7b2438d3	665	case MBEDTLS_RSA_PKCS_V21:
switches	0:5c4d7b2438d3	666	return mbedtls_rsa_rsaes_oaep_encrypt( ctx, f_rng, p_rng, mode, NULL, 0,
switches	0:5c4d7b2438d3	667	ilen, input, output );
switches	0:5c4d7b2438d3	668	#endif
switches	0:5c4d7b2438d3	669
switches	0:5c4d7b2438d3	670	default:
switches	0:5c4d7b2438d3	671	return( MBEDTLS_ERR_RSA_INVALID_PADDING );
switches	0:5c4d7b2438d3	672	}
switches	0:5c4d7b2438d3	673	}
switches	0:5c4d7b2438d3	674
switches	0:5c4d7b2438d3	675	#if defined(MBEDTLS_PKCS1_V21)
switches	0:5c4d7b2438d3	676	/*
switches	0:5c4d7b2438d3	677	* Implementation of the PKCS#1 v2.1 RSAES-OAEP-DECRYPT function
switches	0:5c4d7b2438d3	678	*/
switches	0:5c4d7b2438d3	679	int mbedtls_rsa_rsaes_oaep_decrypt( mbedtls_rsa_context *ctx,
switches	0:5c4d7b2438d3	680	int (f_rng)(void , unsigned char *, size_t),
switches	0:5c4d7b2438d3	681	void *p_rng,
switches	0:5c4d7b2438d3	682	int mode,
switches	0:5c4d7b2438d3	683	const unsigned char *label, size_t label_len,
switches	0:5c4d7b2438d3	684	size_t *olen,
switches	0:5c4d7b2438d3	685	const unsigned char *input,
switches	0:5c4d7b2438d3	686	unsigned char *output,
switches	0:5c4d7b2438d3	687	size_t output_max_len )
switches	0:5c4d7b2438d3	688	{
switches	0:5c4d7b2438d3	689	int ret;
switches	0:5c4d7b2438d3	690	size_t ilen, i, pad_len;
switches	0:5c4d7b2438d3	691	unsigned char *p, bad, pad_done;
switches	0:5c4d7b2438d3	692	unsigned char buf[MBEDTLS_MPI_MAX_SIZE];
switches	0:5c4d7b2438d3	693	unsigned char lhash[MBEDTLS_MD_MAX_SIZE];
switches	0:5c4d7b2438d3	694	unsigned int hlen;
switches	0:5c4d7b2438d3	695	const mbedtls_md_info_t *md_info;
switches	0:5c4d7b2438d3	696	mbedtls_md_context_t md_ctx;
switches	0:5c4d7b2438d3	697
switches	0:5c4d7b2438d3	698	/*
switches	0:5c4d7b2438d3	699	* Parameters sanity checks
switches	0:5c4d7b2438d3	700	*/
switches	0:5c4d7b2438d3	701	if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V21 )
switches	0:5c4d7b2438d3	702	return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
switches	0:5c4d7b2438d3	703
switches	0:5c4d7b2438d3	704	ilen = ctx->len;
switches	0:5c4d7b2438d3	705
switches	0:5c4d7b2438d3	706	if( ilen < 16 \|\| ilen > sizeof( buf ) )
switches	0:5c4d7b2438d3	707	return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
switches	0:5c4d7b2438d3	708
switches	0:5c4d7b2438d3	709	md_info = mbedtls_md_info_from_type( (mbedtls_md_type_t) ctx->hash_id );
switches	0:5c4d7b2438d3	710	if( md_info == NULL )
switches	0:5c4d7b2438d3	711	return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
switches	0:5c4d7b2438d3	712
switches	0:5c4d7b2438d3	713	hlen = mbedtls_md_get_size( md_info );
switches	0:5c4d7b2438d3	714
switches	0:5c4d7b2438d3	715	// checking for integer underflow
switches	0:5c4d7b2438d3	716	if( 2 * hlen + 2 > ilen )
switches	0:5c4d7b2438d3	717	return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
switches	0:5c4d7b2438d3	718
switches	0:5c4d7b2438d3	719	/*
switches	0:5c4d7b2438d3	720	* RSA operation
switches	0:5c4d7b2438d3	721	*/
switches	0:5c4d7b2438d3	722	ret = ( mode == MBEDTLS_RSA_PUBLIC )
switches	0:5c4d7b2438d3	723	? mbedtls_rsa_public( ctx, input, buf )
switches	0:5c4d7b2438d3	724	: mbedtls_rsa_private( ctx, f_rng, p_rng, input, buf );
switches	0:5c4d7b2438d3	725
switches	0:5c4d7b2438d3	726	if( ret != 0 )
switches	0:5c4d7b2438d3	727	return( ret );
switches	0:5c4d7b2438d3	728
switches	0:5c4d7b2438d3	729	/*
switches	0:5c4d7b2438d3	730	* Unmask data and generate lHash
switches	0:5c4d7b2438d3	731	*/
switches	0:5c4d7b2438d3	732	mbedtls_md_init( &md_ctx );
switches	0:5c4d7b2438d3	733	if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 0 ) ) != 0 )
switches	0:5c4d7b2438d3	734	{
switches	0:5c4d7b2438d3	735	mbedtls_md_free( &md_ctx );
switches	0:5c4d7b2438d3	736	return( ret );
switches	0:5c4d7b2438d3	737	}
switches	0:5c4d7b2438d3	738
switches	0:5c4d7b2438d3	739
switches	0:5c4d7b2438d3	740	/* Generate lHash */
switches	0:5c4d7b2438d3	741	mbedtls_md( md_info, label, label_len, lhash );
switches	0:5c4d7b2438d3	742
switches	0:5c4d7b2438d3	743	/* seed: Apply seedMask to maskedSeed */
switches	0:5c4d7b2438d3	744	mgf_mask( buf + 1, hlen, buf + hlen + 1, ilen - hlen - 1,
switches	0:5c4d7b2438d3	745	&md_ctx );
switches	0:5c4d7b2438d3	746
switches	0:5c4d7b2438d3	747	/* DB: Apply dbMask to maskedDB */
switches	0:5c4d7b2438d3	748	mgf_mask( buf + hlen + 1, ilen - hlen - 1, buf + 1, hlen,
switches	0:5c4d7b2438d3	749	&md_ctx );
switches	0:5c4d7b2438d3	750
switches	0:5c4d7b2438d3	751	mbedtls_md_free( &md_ctx );
switches	0:5c4d7b2438d3	752
switches	0:5c4d7b2438d3	753	/*
switches	0:5c4d7b2438d3	754	* Check contents, in "constant-time"
switches	0:5c4d7b2438d3	755	*/
switches	0:5c4d7b2438d3	756	p = buf;
switches	0:5c4d7b2438d3	757	bad = 0;
switches	0:5c4d7b2438d3	758
switches	0:5c4d7b2438d3	759	bad \|= p++; / First byte must be 0 */
switches	0:5c4d7b2438d3	760
switches	0:5c4d7b2438d3	761	p += hlen; /* Skip seed */
switches	0:5c4d7b2438d3	762
switches	0:5c4d7b2438d3	763	/* Check lHash */
switches	0:5c4d7b2438d3	764	for( i = 0; i < hlen; i++ )
switches	0:5c4d7b2438d3	765	bad \|= lhash[i] ^ *p++;
switches	0:5c4d7b2438d3	766
switches	0:5c4d7b2438d3	767	/* Get zero-padding len, but always read till end of buffer
switches	0:5c4d7b2438d3	768	* (minus one, for the 01 byte) */
switches	0:5c4d7b2438d3	769	pad_len = 0;
switches	0:5c4d7b2438d3	770	pad_done = 0;
switches	0:5c4d7b2438d3	771	for( i = 0; i < ilen - 2 * hlen - 2; i++ )
switches	0:5c4d7b2438d3	772	{
switches	0:5c4d7b2438d3	773	pad_done \|= p[i];
switches	0:5c4d7b2438d3	774	pad_len += ((pad_done \| (unsigned char)-pad_done) >> 7) ^ 1;
switches	0:5c4d7b2438d3	775	}
switches	0:5c4d7b2438d3	776
switches	0:5c4d7b2438d3	777	p += pad_len;
switches	0:5c4d7b2438d3	778	bad \|= *p++ ^ 0x01;
switches	0:5c4d7b2438d3	779
switches	0:5c4d7b2438d3	780	/*
switches	0:5c4d7b2438d3	781	* The only information "leaked" is whether the padding was correct or not
switches	0:5c4d7b2438d3	782	* (eg, no data is copied if it was not correct). This meets the
switches	0:5c4d7b2438d3	783	* recommendations in PKCS#1 v2.2: an opponent cannot distinguish between
switches	0:5c4d7b2438d3	784	* the different error conditions.
switches	0:5c4d7b2438d3	785	*/
switches	0:5c4d7b2438d3	786	if( bad != 0 )
switches	0:5c4d7b2438d3	787	return( MBEDTLS_ERR_RSA_INVALID_PADDING );
switches	0:5c4d7b2438d3	788
switches	0:5c4d7b2438d3	789	if( ilen - ( p - buf ) > output_max_len )
switches	0:5c4d7b2438d3	790	return( MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE );
switches	0:5c4d7b2438d3	791
switches	0:5c4d7b2438d3	792	*olen = ilen - (p - buf);
switches	0:5c4d7b2438d3	793	memcpy( output, p, *olen );
switches	0:5c4d7b2438d3	794
switches	0:5c4d7b2438d3	795	return( 0 );
switches	0:5c4d7b2438d3	796	}
switches	0:5c4d7b2438d3	797	#endif /* MBEDTLS_PKCS1_V21 */
switches	0:5c4d7b2438d3	798
switches	0:5c4d7b2438d3	799	#if defined(MBEDTLS_PKCS1_V15)
switches	0:5c4d7b2438d3	800	/*
switches	0:5c4d7b2438d3	801	* Implementation of the PKCS#1 v2.1 RSAES-PKCS1-V1_5-DECRYPT function
switches	0:5c4d7b2438d3	802	*/
switches	0:5c4d7b2438d3	803	int mbedtls_rsa_rsaes_pkcs1_v15_decrypt( mbedtls_rsa_context *ctx,
switches	0:5c4d7b2438d3	804	int (f_rng)(void , unsigned char *, size_t),
switches	0:5c4d7b2438d3	805	void *p_rng,
switches	0:5c4d7b2438d3	806	int mode, size_t *olen,
switches	0:5c4d7b2438d3	807	const unsigned char *input,
switches	0:5c4d7b2438d3	808	unsigned char *output,
switches	0:5c4d7b2438d3	809	size_t output_max_len)
switches	0:5c4d7b2438d3	810	{
switches	0:5c4d7b2438d3	811	int ret;
switches	0:5c4d7b2438d3	812	size_t ilen, pad_count = 0, i;
switches	0:5c4d7b2438d3	813	unsigned char *p, bad, pad_done = 0;
switches	0:5c4d7b2438d3	814	unsigned char buf[MBEDTLS_MPI_MAX_SIZE];
switches	0:5c4d7b2438d3	815
switches	0:5c4d7b2438d3	816	if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V15 )
switches	0:5c4d7b2438d3	817	return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
switches	0:5c4d7b2438d3	818
switches	0:5c4d7b2438d3	819	ilen = ctx->len;
switches	0:5c4d7b2438d3	820
switches	0:5c4d7b2438d3	821	if( ilen < 16 \|\| ilen > sizeof( buf ) )
switches	0:5c4d7b2438d3	822	return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
switches	0:5c4d7b2438d3	823
switches	0:5c4d7b2438d3	824	ret = ( mode == MBEDTLS_RSA_PUBLIC )
switches	0:5c4d7b2438d3	825	? mbedtls_rsa_public( ctx, input, buf )
switches	0:5c4d7b2438d3	826	: mbedtls_rsa_private( ctx, f_rng, p_rng, input, buf );
switches	0:5c4d7b2438d3	827
switches	0:5c4d7b2438d3	828	if( ret != 0 )
switches	0:5c4d7b2438d3	829	return( ret );
switches	0:5c4d7b2438d3	830
switches	0:5c4d7b2438d3	831	p = buf;
switches	0:5c4d7b2438d3	832	bad = 0;
switches	0:5c4d7b2438d3	833
switches	0:5c4d7b2438d3	834	/*
switches	0:5c4d7b2438d3	835	* Check and get padding len in "constant-time"
switches	0:5c4d7b2438d3	836	*/
switches	0:5c4d7b2438d3	837	bad \|= p++; / First byte must be 0 */
switches	0:5c4d7b2438d3	838
switches	0:5c4d7b2438d3	839	/* This test does not depend on secret data */
switches	0:5c4d7b2438d3	840	if( mode == MBEDTLS_RSA_PRIVATE )
switches	0:5c4d7b2438d3	841	{
switches	0:5c4d7b2438d3	842	bad \|= *p++ ^ MBEDTLS_RSA_CRYPT;
switches	0:5c4d7b2438d3	843
switches	0:5c4d7b2438d3	844	/* Get padding len, but always read till end of buffer
switches	0:5c4d7b2438d3	845	* (minus one, for the 00 byte) */
switches	0:5c4d7b2438d3	846	for( i = 0; i < ilen - 3; i++ )
switches	0:5c4d7b2438d3	847	{
switches	0:5c4d7b2438d3	848	pad_done \|= ((p[i] \| (unsigned char)-p[i]) >> 7) ^ 1;
switches	0:5c4d7b2438d3	849	pad_count += ((pad_done \| (unsigned char)-pad_done) >> 7) ^ 1;
switches	0:5c4d7b2438d3	850	}
switches	0:5c4d7b2438d3	851
switches	0:5c4d7b2438d3	852	p += pad_count;
switches	0:5c4d7b2438d3	853	bad \|= p++; / Must be zero */
switches	0:5c4d7b2438d3	854	}
switches	0:5c4d7b2438d3	855	else
switches	0:5c4d7b2438d3	856	{
switches	0:5c4d7b2438d3	857	bad \|= *p++ ^ MBEDTLS_RSA_SIGN;
switches	0:5c4d7b2438d3	858
switches	0:5c4d7b2438d3	859	/* Get padding len, but always read till end of buffer
switches	0:5c4d7b2438d3	860	* (minus one, for the 00 byte) */
switches	0:5c4d7b2438d3	861	for( i = 0; i < ilen - 3; i++ )
switches	0:5c4d7b2438d3	862	{
switches	0:5c4d7b2438d3	863	pad_done \|= ( p[i] != 0xFF );
switches	0:5c4d7b2438d3	864	pad_count += ( pad_done == 0 );
switches	0:5c4d7b2438d3	865	}
switches	0:5c4d7b2438d3	866
switches	0:5c4d7b2438d3	867	p += pad_count;
switches	0:5c4d7b2438d3	868	bad \|= p++; / Must be zero */
switches	0:5c4d7b2438d3	869	}
switches	0:5c4d7b2438d3	870
switches	0:5c4d7b2438d3	871	bad \|= ( pad_count < 8 );
switches	0:5c4d7b2438d3	872
switches	0:5c4d7b2438d3	873	if( bad )
switches	0:5c4d7b2438d3	874	return( MBEDTLS_ERR_RSA_INVALID_PADDING );
switches	0:5c4d7b2438d3	875
switches	0:5c4d7b2438d3	876	if( ilen - ( p - buf ) > output_max_len )
switches	0:5c4d7b2438d3	877	return( MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE );
switches	0:5c4d7b2438d3	878
switches	0:5c4d7b2438d3	879	*olen = ilen - (p - buf);
switches	0:5c4d7b2438d3	880	memcpy( output, p, *olen );
switches	0:5c4d7b2438d3	881
switches	0:5c4d7b2438d3	882	return( 0 );
switches	0:5c4d7b2438d3	883	}
switches	0:5c4d7b2438d3	884	#endif /* MBEDTLS_PKCS1_V15 */
switches	0:5c4d7b2438d3	885
switches	0:5c4d7b2438d3	886	/*
switches	0:5c4d7b2438d3	887	* Do an RSA operation, then remove the message padding
switches	0:5c4d7b2438d3	888	*/
switches	0:5c4d7b2438d3	889	int mbedtls_rsa_pkcs1_decrypt( mbedtls_rsa_context *ctx,
switches	0:5c4d7b2438d3	890	int (f_rng)(void , unsigned char *, size_t),
switches	0:5c4d7b2438d3	891	void *p_rng,
switches	0:5c4d7b2438d3	892	int mode, size_t *olen,
switches	0:5c4d7b2438d3	893	const unsigned char *input,
switches	0:5c4d7b2438d3	894	unsigned char *output,
switches	0:5c4d7b2438d3	895	size_t output_max_len)
switches	0:5c4d7b2438d3	896	{
switches	0:5c4d7b2438d3	897	switch( ctx->padding )
switches	0:5c4d7b2438d3	898	{
switches	0:5c4d7b2438d3	899	#if defined(MBEDTLS_PKCS1_V15)
switches	0:5c4d7b2438d3	900	case MBEDTLS_RSA_PKCS_V15:
switches	0:5c4d7b2438d3	901	return mbedtls_rsa_rsaes_pkcs1_v15_decrypt( ctx, f_rng, p_rng, mode, olen,
switches	0:5c4d7b2438d3	902	input, output, output_max_len );
switches	0:5c4d7b2438d3	903	#endif
switches	0:5c4d7b2438d3	904
switches	0:5c4d7b2438d3	905	#if defined(MBEDTLS_PKCS1_V21)
switches	0:5c4d7b2438d3	906	case MBEDTLS_RSA_PKCS_V21:
switches	0:5c4d7b2438d3	907	return mbedtls_rsa_rsaes_oaep_decrypt( ctx, f_rng, p_rng, mode, NULL, 0,
switches	0:5c4d7b2438d3	908	olen, input, output,
switches	0:5c4d7b2438d3	909	output_max_len );
switches	0:5c4d7b2438d3	910	#endif
switches	0:5c4d7b2438d3	911
switches	0:5c4d7b2438d3	912	default:
switches	0:5c4d7b2438d3	913	return( MBEDTLS_ERR_RSA_INVALID_PADDING );
switches	0:5c4d7b2438d3	914	}
switches	0:5c4d7b2438d3	915	}
switches	0:5c4d7b2438d3	916
switches	0:5c4d7b2438d3	917	#if defined(MBEDTLS_PKCS1_V21)
switches	0:5c4d7b2438d3	918	/*
switches	0:5c4d7b2438d3	919	* Implementation of the PKCS#1 v2.1 RSASSA-PSS-SIGN function
switches	0:5c4d7b2438d3	920	*/
switches	0:5c4d7b2438d3	921	int mbedtls_rsa_rsassa_pss_sign( mbedtls_rsa_context *ctx,
switches	0:5c4d7b2438d3	922	int (f_rng)(void , unsigned char *, size_t),
switches	0:5c4d7b2438d3	923	void *p_rng,
switches	0:5c4d7b2438d3	924	int mode,
switches	0:5c4d7b2438d3	925	mbedtls_md_type_t md_alg,
switches	0:5c4d7b2438d3	926	unsigned int hashlen,
switches	0:5c4d7b2438d3	927	const unsigned char *hash,
switches	0:5c4d7b2438d3	928	unsigned char *sig )
switches	0:5c4d7b2438d3	929	{
switches	0:5c4d7b2438d3	930	size_t olen;
switches	0:5c4d7b2438d3	931	unsigned char *p = sig;
switches	0:5c4d7b2438d3	932	unsigned char salt[MBEDTLS_MD_MAX_SIZE];
switches	0:5c4d7b2438d3	933	unsigned int slen, hlen, offset = 0;
switches	0:5c4d7b2438d3	934	int ret;
switches	0:5c4d7b2438d3	935	size_t msb;
switches	0:5c4d7b2438d3	936	const mbedtls_md_info_t *md_info;
switches	0:5c4d7b2438d3	937	mbedtls_md_context_t md_ctx;
switches	0:5c4d7b2438d3	938
switches	0:5c4d7b2438d3	939	if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V21 )
switches	0:5c4d7b2438d3	940	return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
switches	0:5c4d7b2438d3	941
switches	0:5c4d7b2438d3	942	if( f_rng == NULL )
switches	0:5c4d7b2438d3	943	return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
switches	0:5c4d7b2438d3	944
switches	0:5c4d7b2438d3	945	olen = ctx->len;
switches	0:5c4d7b2438d3	946
switches	0:5c4d7b2438d3	947	if( md_alg != MBEDTLS_MD_NONE )
switches	0:5c4d7b2438d3	948	{
switches	0:5c4d7b2438d3	949	/* Gather length of hash to sign */
switches	0:5c4d7b2438d3	950	md_info = mbedtls_md_info_from_type( md_alg );
switches	0:5c4d7b2438d3	951	if( md_info == NULL )
switches	0:5c4d7b2438d3	952	return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
switches	0:5c4d7b2438d3	953
switches	0:5c4d7b2438d3	954	hashlen = mbedtls_md_get_size( md_info );
switches	0:5c4d7b2438d3	955	}
switches	0:5c4d7b2438d3	956
switches	0:5c4d7b2438d3	957	md_info = mbedtls_md_info_from_type( (mbedtls_md_type_t) ctx->hash_id );
switches	0:5c4d7b2438d3	958	if( md_info == NULL )
switches	0:5c4d7b2438d3	959	return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
switches	0:5c4d7b2438d3	960
switches	0:5c4d7b2438d3	961	hlen = mbedtls_md_get_size( md_info );
switches	0:5c4d7b2438d3	962	slen = hlen;
switches	0:5c4d7b2438d3	963
switches	0:5c4d7b2438d3	964	if( olen < hlen + slen + 2 )
switches	0:5c4d7b2438d3	965	return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
switches	0:5c4d7b2438d3	966
switches	0:5c4d7b2438d3	967	memset( sig, 0, olen );
switches	0:5c4d7b2438d3	968
switches	0:5c4d7b2438d3	969	/* Generate salt of length slen */
switches	0:5c4d7b2438d3	970	if( ( ret = f_rng( p_rng, salt, slen ) ) != 0 )
switches	0:5c4d7b2438d3	971	return( MBEDTLS_ERR_RSA_RNG_FAILED + ret );
switches	0:5c4d7b2438d3	972
switches	0:5c4d7b2438d3	973	/* Note: EMSA-PSS encoding is over the length of N - 1 bits */
switches	0:5c4d7b2438d3	974	msb = mbedtls_mpi_bitlen( &ctx->N ) - 1;
switches	0:5c4d7b2438d3	975	p += olen - hlen * 2 - 2;
switches	0:5c4d7b2438d3	976	*p++ = 0x01;
switches	0:5c4d7b2438d3	977	memcpy( p, salt, slen );
switches	0:5c4d7b2438d3	978	p += slen;
switches	0:5c4d7b2438d3	979
switches	0:5c4d7b2438d3	980	mbedtls_md_init( &md_ctx );
switches	0:5c4d7b2438d3	981	if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 0 ) ) != 0 )
switches	0:5c4d7b2438d3	982	{
switches	0:5c4d7b2438d3	983	mbedtls_md_free( &md_ctx );
switches	0:5c4d7b2438d3	984	return( ret );
switches	0:5c4d7b2438d3	985	}
switches	0:5c4d7b2438d3	986
switches	0:5c4d7b2438d3	987	/* Generate H = Hash( M' ) */
switches	0:5c4d7b2438d3	988	mbedtls_md_starts( &md_ctx );
switches	0:5c4d7b2438d3	989	mbedtls_md_update( &md_ctx, p, 8 );
switches	0:5c4d7b2438d3	990	mbedtls_md_update( &md_ctx, hash, hashlen );
switches	0:5c4d7b2438d3	991	mbedtls_md_update( &md_ctx, salt, slen );
switches	0:5c4d7b2438d3	992	mbedtls_md_finish( &md_ctx, p );
switches	0:5c4d7b2438d3	993
switches	0:5c4d7b2438d3	994	/* Compensate for boundary condition when applying mask */
switches	0:5c4d7b2438d3	995	if( msb % 8 == 0 )
switches	0:5c4d7b2438d3	996	offset = 1;
switches	0:5c4d7b2438d3	997
switches	0:5c4d7b2438d3	998	/* maskedDB: Apply dbMask to DB */
switches	0:5c4d7b2438d3	999	mgf_mask( sig + offset, olen - hlen - 1 - offset, p, hlen, &md_ctx );
switches	0:5c4d7b2438d3	1000
switches	0:5c4d7b2438d3	1001	mbedtls_md_free( &md_ctx );
switches	0:5c4d7b2438d3	1002
switches	0:5c4d7b2438d3	1003	msb = mbedtls_mpi_bitlen( &ctx->N ) - 1;
switches	0:5c4d7b2438d3	1004	sig[0] &= 0xFF >> ( olen * 8 - msb );
switches	0:5c4d7b2438d3	1005
switches	0:5c4d7b2438d3	1006	p += hlen;
switches	0:5c4d7b2438d3	1007	*p++ = 0xBC;
switches	0:5c4d7b2438d3	1008
switches	0:5c4d7b2438d3	1009	return( ( mode == MBEDTLS_RSA_PUBLIC )
switches	0:5c4d7b2438d3	1010	? mbedtls_rsa_public( ctx, sig, sig )
switches	0:5c4d7b2438d3	1011	: mbedtls_rsa_private( ctx, f_rng, p_rng, sig, sig ) );
switches	0:5c4d7b2438d3	1012	}
switches	0:5c4d7b2438d3	1013	#endif /* MBEDTLS_PKCS1_V21 */
switches	0:5c4d7b2438d3	1014
switches	0:5c4d7b2438d3	1015	#if defined(MBEDTLS_PKCS1_V15)
switches	0:5c4d7b2438d3	1016	/*
switches	0:5c4d7b2438d3	1017	* Implementation of the PKCS#1 v2.1 RSASSA-PKCS1-V1_5-SIGN function
switches	0:5c4d7b2438d3	1018	*/
switches	0:5c4d7b2438d3	1019	/*
switches	0:5c4d7b2438d3	1020	* Do an RSA operation to sign the message digest
switches	0:5c4d7b2438d3	1021	*/
switches	0:5c4d7b2438d3	1022	int mbedtls_rsa_rsassa_pkcs1_v15_sign( mbedtls_rsa_context *ctx,
switches	0:5c4d7b2438d3	1023	int (f_rng)(void , unsigned char *, size_t),
switches	0:5c4d7b2438d3	1024	void *p_rng,
switches	0:5c4d7b2438d3	1025	int mode,
switches	0:5c4d7b2438d3	1026	mbedtls_md_type_t md_alg,
switches	0:5c4d7b2438d3	1027	unsigned int hashlen,
switches	0:5c4d7b2438d3	1028	const unsigned char *hash,
switches	0:5c4d7b2438d3	1029	unsigned char *sig )
switches	0:5c4d7b2438d3	1030	{
switches	0:5c4d7b2438d3	1031	size_t nb_pad, olen, oid_size = 0;
switches	0:5c4d7b2438d3	1032	unsigned char *p = sig;
switches	0:5c4d7b2438d3	1033	const char *oid = NULL;
switches	0:5c4d7b2438d3	1034	unsigned char sig_try = NULL, verif = NULL;
switches	0:5c4d7b2438d3	1035	size_t i;
switches	0:5c4d7b2438d3	1036	unsigned char diff;
switches	0:5c4d7b2438d3	1037	volatile unsigned char diff_no_optimize;
switches	0:5c4d7b2438d3	1038	int ret;
switches	0:5c4d7b2438d3	1039
switches	0:5c4d7b2438d3	1040	if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V15 )
switches	0:5c4d7b2438d3	1041	return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
switches	0:5c4d7b2438d3	1042
switches	0:5c4d7b2438d3	1043	olen = ctx->len;
switches	0:5c4d7b2438d3	1044	nb_pad = olen - 3;
switches	0:5c4d7b2438d3	1045
switches	0:5c4d7b2438d3	1046	if( md_alg != MBEDTLS_MD_NONE )
switches	0:5c4d7b2438d3	1047	{
switches	0:5c4d7b2438d3	1048	const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type( md_alg );
switches	0:5c4d7b2438d3	1049	if( md_info == NULL )
switches	0:5c4d7b2438d3	1050	return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
switches	0:5c4d7b2438d3	1051
switches	0:5c4d7b2438d3	1052	if( mbedtls_oid_get_oid_by_md( md_alg, &oid, &oid_size ) != 0 )
switches	0:5c4d7b2438d3	1053	return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
switches	0:5c4d7b2438d3	1054
switches	0:5c4d7b2438d3	1055	nb_pad -= 10 + oid_size;
switches	0:5c4d7b2438d3	1056
switches	0:5c4d7b2438d3	1057	hashlen = mbedtls_md_get_size( md_info );
switches	0:5c4d7b2438d3	1058	}
switches	0:5c4d7b2438d3	1059
switches	0:5c4d7b2438d3	1060	nb_pad -= hashlen;
switches	0:5c4d7b2438d3	1061
switches	0:5c4d7b2438d3	1062	if( ( nb_pad < 8 ) \|\| ( nb_pad > olen ) )
switches	0:5c4d7b2438d3	1063	return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
switches	0:5c4d7b2438d3	1064
switches	0:5c4d7b2438d3	1065	*p++ = 0;
switches	0:5c4d7b2438d3	1066	*p++ = MBEDTLS_RSA_SIGN;
switches	0:5c4d7b2438d3	1067	memset( p, 0xFF, nb_pad );
switches	0:5c4d7b2438d3	1068	p += nb_pad;
switches	0:5c4d7b2438d3	1069	*p++ = 0;
switches	0:5c4d7b2438d3	1070
switches	0:5c4d7b2438d3	1071	if( md_alg == MBEDTLS_MD_NONE )
switches	0:5c4d7b2438d3	1072	{
switches	0:5c4d7b2438d3	1073	memcpy( p, hash, hashlen );
switches	0:5c4d7b2438d3	1074	}
switches	0:5c4d7b2438d3	1075	else
switches	0:5c4d7b2438d3	1076	{
switches	0:5c4d7b2438d3	1077	/*
switches	0:5c4d7b2438d3	1078	* DigestInfo ::= SEQUENCE {
switches	0:5c4d7b2438d3	1079	* digestAlgorithm DigestAlgorithmIdentifier,
switches	0:5c4d7b2438d3	1080	* digest Digest }
switches	0:5c4d7b2438d3	1081	*
switches	0:5c4d7b2438d3	1082	* DigestAlgorithmIdentifier ::= AlgorithmIdentifier
switches	0:5c4d7b2438d3	1083	*
switches	0:5c4d7b2438d3	1084	* Digest ::= OCTET STRING
switches	0:5c4d7b2438d3	1085	*/
switches	0:5c4d7b2438d3	1086	*p++ = MBEDTLS_ASN1_SEQUENCE \| MBEDTLS_ASN1_CONSTRUCTED;
switches	0:5c4d7b2438d3	1087	*p++ = (unsigned char) ( 0x08 + oid_size + hashlen );
switches	0:5c4d7b2438d3	1088	*p++ = MBEDTLS_ASN1_SEQUENCE \| MBEDTLS_ASN1_CONSTRUCTED;
switches	0:5c4d7b2438d3	1089	*p++ = (unsigned char) ( 0x04 + oid_size );
switches	0:5c4d7b2438d3	1090	*p++ = MBEDTLS_ASN1_OID;
switches	0:5c4d7b2438d3	1091	*p++ = oid_size & 0xFF;
switches	0:5c4d7b2438d3	1092	memcpy( p, oid, oid_size );
switches	0:5c4d7b2438d3	1093	p += oid_size;
switches	0:5c4d7b2438d3	1094	*p++ = MBEDTLS_ASN1_NULL;
switches	0:5c4d7b2438d3	1095	*p++ = 0x00;
switches	0:5c4d7b2438d3	1096	*p++ = MBEDTLS_ASN1_OCTET_STRING;
switches	0:5c4d7b2438d3	1097	*p++ = hashlen;
switches	0:5c4d7b2438d3	1098	memcpy( p, hash, hashlen );
switches	0:5c4d7b2438d3	1099	}
switches	0:5c4d7b2438d3	1100
switches	0:5c4d7b2438d3	1101	if( mode == MBEDTLS_RSA_PUBLIC )
switches	0:5c4d7b2438d3	1102	return( mbedtls_rsa_public( ctx, sig, sig ) );
switches	0:5c4d7b2438d3	1103
switches	0:5c4d7b2438d3	1104	/*
switches	0:5c4d7b2438d3	1105	* In order to prevent Lenstra's attack, make the signature in a
switches	0:5c4d7b2438d3	1106	* temporary buffer and check it before returning it.
switches	0:5c4d7b2438d3	1107	*/
switches	0:5c4d7b2438d3	1108	sig_try = mbedtls_calloc( 1, ctx->len );
switches	0:5c4d7b2438d3	1109	if( sig_try == NULL )
switches	0:5c4d7b2438d3	1110	return( MBEDTLS_ERR_MPI_ALLOC_FAILED );
switches	0:5c4d7b2438d3	1111
switches	0:5c4d7b2438d3	1112	verif = mbedtls_calloc( 1, ctx->len );
switches	0:5c4d7b2438d3	1113	if( verif == NULL )
switches	0:5c4d7b2438d3	1114	{
switches	0:5c4d7b2438d3	1115	mbedtls_free( sig_try );
switches	0:5c4d7b2438d3	1116	return( MBEDTLS_ERR_MPI_ALLOC_FAILED );
switches	0:5c4d7b2438d3	1117	}
switches	0:5c4d7b2438d3	1118
switches	0:5c4d7b2438d3	1119	MBEDTLS_MPI_CHK( mbedtls_rsa_private( ctx, f_rng, p_rng, sig, sig_try ) );
switches	0:5c4d7b2438d3	1120	MBEDTLS_MPI_CHK( mbedtls_rsa_public( ctx, sig_try, verif ) );
switches	0:5c4d7b2438d3	1121
switches	0:5c4d7b2438d3	1122	/* Compare in constant time just in case */
switches	0:5c4d7b2438d3	1123	for( diff = 0, i = 0; i < ctx->len; i++ )
switches	0:5c4d7b2438d3	1124	diff \|= verif[i] ^ sig[i];
switches	0:5c4d7b2438d3	1125	diff_no_optimize = diff;
switches	0:5c4d7b2438d3	1126
switches	0:5c4d7b2438d3	1127	if( diff_no_optimize != 0 )
switches	0:5c4d7b2438d3	1128	{
switches	0:5c4d7b2438d3	1129	ret = MBEDTLS_ERR_RSA_PRIVATE_FAILED;
switches	0:5c4d7b2438d3	1130	goto cleanup;
switches	0:5c4d7b2438d3	1131	}
switches	0:5c4d7b2438d3	1132
switches	0:5c4d7b2438d3	1133	memcpy( sig, sig_try, ctx->len );
switches	0:5c4d7b2438d3	1134
switches	0:5c4d7b2438d3	1135	cleanup:
switches	0:5c4d7b2438d3	1136	mbedtls_free( sig_try );
switches	0:5c4d7b2438d3	1137	mbedtls_free( verif );
switches	0:5c4d7b2438d3	1138
switches	0:5c4d7b2438d3	1139	return( ret );
switches	0:5c4d7b2438d3	1140	}
switches	0:5c4d7b2438d3	1141	#endif /* MBEDTLS_PKCS1_V15 */
switches	0:5c4d7b2438d3	1142
switches	0:5c4d7b2438d3	1143	/*
switches	0:5c4d7b2438d3	1144	* Do an RSA operation to sign the message digest
switches	0:5c4d7b2438d3	1145	*/
switches	0:5c4d7b2438d3	1146	int mbedtls_rsa_pkcs1_sign( mbedtls_rsa_context *ctx,
switches	0:5c4d7b2438d3	1147	int (f_rng)(void , unsigned char *, size_t),
switches	0:5c4d7b2438d3	1148	void *p_rng,
switches	0:5c4d7b2438d3	1149	int mode,
switches	0:5c4d7b2438d3	1150	mbedtls_md_type_t md_alg,
switches	0:5c4d7b2438d3	1151	unsigned int hashlen,
switches	0:5c4d7b2438d3	1152	const unsigned char *hash,
switches	0:5c4d7b2438d3	1153	unsigned char *sig )
switches	0:5c4d7b2438d3	1154	{
switches	0:5c4d7b2438d3	1155	switch( ctx->padding )
switches	0:5c4d7b2438d3	1156	{
switches	0:5c4d7b2438d3	1157	#if defined(MBEDTLS_PKCS1_V15)
switches	0:5c4d7b2438d3	1158	case MBEDTLS_RSA_PKCS_V15:
switches	0:5c4d7b2438d3	1159	return mbedtls_rsa_rsassa_pkcs1_v15_sign( ctx, f_rng, p_rng, mode, md_alg,
switches	0:5c4d7b2438d3	1160	hashlen, hash, sig );
switches	0:5c4d7b2438d3	1161	#endif
switches	0:5c4d7b2438d3	1162
switches	0:5c4d7b2438d3	1163	#if defined(MBEDTLS_PKCS1_V21)
switches	0:5c4d7b2438d3	1164	case MBEDTLS_RSA_PKCS_V21:
switches	0:5c4d7b2438d3	1165	return mbedtls_rsa_rsassa_pss_sign( ctx, f_rng, p_rng, mode, md_alg,
switches	0:5c4d7b2438d3	1166	hashlen, hash, sig );
switches	0:5c4d7b2438d3	1167	#endif
switches	0:5c4d7b2438d3	1168
switches	0:5c4d7b2438d3	1169	default:
switches	0:5c4d7b2438d3	1170	return( MBEDTLS_ERR_RSA_INVALID_PADDING );
switches	0:5c4d7b2438d3	1171	}
switches	0:5c4d7b2438d3	1172	}
switches	0:5c4d7b2438d3	1173
switches	0:5c4d7b2438d3	1174	#if defined(MBEDTLS_PKCS1_V21)
switches	0:5c4d7b2438d3	1175	/*
switches	0:5c4d7b2438d3	1176	* Implementation of the PKCS#1 v2.1 RSASSA-PSS-VERIFY function
switches	0:5c4d7b2438d3	1177	*/
switches	0:5c4d7b2438d3	1178	int mbedtls_rsa_rsassa_pss_verify_ext( mbedtls_rsa_context *ctx,
switches	0:5c4d7b2438d3	1179	int (f_rng)(void , unsigned char *, size_t),
switches	0:5c4d7b2438d3	1180	void *p_rng,
switches	0:5c4d7b2438d3	1181	int mode,
switches	0:5c4d7b2438d3	1182	mbedtls_md_type_t md_alg,
switches	0:5c4d7b2438d3	1183	unsigned int hashlen,
switches	0:5c4d7b2438d3	1184	const unsigned char *hash,
switches	0:5c4d7b2438d3	1185	mbedtls_md_type_t mgf1_hash_id,
switches	0:5c4d7b2438d3	1186	int expected_salt_len,
switches	0:5c4d7b2438d3	1187	const unsigned char *sig )
switches	0:5c4d7b2438d3	1188	{
switches	0:5c4d7b2438d3	1189	int ret;
switches	0:5c4d7b2438d3	1190	size_t siglen;
switches	0:5c4d7b2438d3	1191	unsigned char *p;
switches	0:5c4d7b2438d3	1192	unsigned char result[MBEDTLS_MD_MAX_SIZE];
switches	0:5c4d7b2438d3	1193	unsigned char zeros[8];
switches	0:5c4d7b2438d3	1194	unsigned int hlen;
switches	0:5c4d7b2438d3	1195	size_t slen, msb;
switches	0:5c4d7b2438d3	1196	const mbedtls_md_info_t *md_info;
switches	0:5c4d7b2438d3	1197	mbedtls_md_context_t md_ctx;
switches	0:5c4d7b2438d3	1198	unsigned char buf[MBEDTLS_MPI_MAX_SIZE];
switches	0:5c4d7b2438d3	1199
switches	0:5c4d7b2438d3	1200	if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V21 )
switches	0:5c4d7b2438d3	1201	return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
switches	0:5c4d7b2438d3	1202
switches	0:5c4d7b2438d3	1203	siglen = ctx->len;
switches	0:5c4d7b2438d3	1204
switches	0:5c4d7b2438d3	1205	if( siglen < 16 \|\| siglen > sizeof( buf ) )
switches	0:5c4d7b2438d3	1206	return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
switches	0:5c4d7b2438d3	1207
switches	0:5c4d7b2438d3	1208	ret = ( mode == MBEDTLS_RSA_PUBLIC )
switches	0:5c4d7b2438d3	1209	? mbedtls_rsa_public( ctx, sig, buf )
switches	0:5c4d7b2438d3	1210	: mbedtls_rsa_private( ctx, f_rng, p_rng, sig, buf );
switches	0:5c4d7b2438d3	1211
switches	0:5c4d7b2438d3	1212	if( ret != 0 )
switches	0:5c4d7b2438d3	1213	return( ret );
switches	0:5c4d7b2438d3	1214
switches	0:5c4d7b2438d3	1215	p = buf;
switches	0:5c4d7b2438d3	1216
switches	0:5c4d7b2438d3	1217	if( buf[siglen - 1] != 0xBC )
switches	0:5c4d7b2438d3	1218	return( MBEDTLS_ERR_RSA_INVALID_PADDING );
switches	0:5c4d7b2438d3	1219
switches	0:5c4d7b2438d3	1220	if( md_alg != MBEDTLS_MD_NONE )
switches	0:5c4d7b2438d3	1221	{
switches	0:5c4d7b2438d3	1222	/* Gather length of hash to sign */
switches	0:5c4d7b2438d3	1223	md_info = mbedtls_md_info_from_type( md_alg );
switches	0:5c4d7b2438d3	1224	if( md_info == NULL )
switches	0:5c4d7b2438d3	1225	return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
switches	0:5c4d7b2438d3	1226
switches	0:5c4d7b2438d3	1227	hashlen = mbedtls_md_get_size( md_info );
switches	0:5c4d7b2438d3	1228	}
switches	0:5c4d7b2438d3	1229
switches	0:5c4d7b2438d3	1230	md_info = mbedtls_md_info_from_type( mgf1_hash_id );
switches	0:5c4d7b2438d3	1231	if( md_info == NULL )
switches	0:5c4d7b2438d3	1232	return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
switches	0:5c4d7b2438d3	1233
switches	0:5c4d7b2438d3	1234	hlen = mbedtls_md_get_size( md_info );
switches	0:5c4d7b2438d3	1235	slen = siglen - hlen - 1; /* Currently length of salt + padding */
switches	0:5c4d7b2438d3	1236
switches	0:5c4d7b2438d3	1237	memset( zeros, 0, 8 );
switches	0:5c4d7b2438d3	1238
switches	0:5c4d7b2438d3	1239	/*
switches	0:5c4d7b2438d3	1240	* Note: EMSA-PSS verification is over the length of N - 1 bits
switches	0:5c4d7b2438d3	1241	*/
switches	0:5c4d7b2438d3	1242	msb = mbedtls_mpi_bitlen( &ctx->N ) - 1;
switches	0:5c4d7b2438d3	1243
switches	0:5c4d7b2438d3	1244	/* Compensate for boundary condition when applying mask */
switches	0:5c4d7b2438d3	1245	if( msb % 8 == 0 )
switches	0:5c4d7b2438d3	1246	{
switches	0:5c4d7b2438d3	1247	p++;
switches	0:5c4d7b2438d3	1248	siglen -= 1;
switches	0:5c4d7b2438d3	1249	}
switches	0:5c4d7b2438d3	1250	if( buf[0] >> ( 8 - siglen * 8 + msb ) )
switches	0:5c4d7b2438d3	1251	return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
switches	0:5c4d7b2438d3	1252
switches	0:5c4d7b2438d3	1253	mbedtls_md_init( &md_ctx );
switches	0:5c4d7b2438d3	1254	if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 0 ) ) != 0 )
switches	0:5c4d7b2438d3	1255	{
switches	0:5c4d7b2438d3	1256	mbedtls_md_free( &md_ctx );
switches	0:5c4d7b2438d3	1257	return( ret );
switches	0:5c4d7b2438d3	1258	}
switches	0:5c4d7b2438d3	1259
switches	0:5c4d7b2438d3	1260	mgf_mask( p, siglen - hlen - 1, p + siglen - hlen - 1, hlen, &md_ctx );
switches	0:5c4d7b2438d3	1261
switches	0:5c4d7b2438d3	1262	buf[0] &= 0xFF >> ( siglen * 8 - msb );
switches	0:5c4d7b2438d3	1263
switches	0:5c4d7b2438d3	1264	while( p < buf + siglen && *p == 0 )
switches	0:5c4d7b2438d3	1265	p++;
switches	0:5c4d7b2438d3	1266
switches	0:5c4d7b2438d3	1267	if( p == buf + siglen \|\|
switches	0:5c4d7b2438d3	1268	*p++ != 0x01 )
switches	0:5c4d7b2438d3	1269	{
switches	0:5c4d7b2438d3	1270	mbedtls_md_free( &md_ctx );
switches	0:5c4d7b2438d3	1271	return( MBEDTLS_ERR_RSA_INVALID_PADDING );
switches	0:5c4d7b2438d3	1272	}
switches	0:5c4d7b2438d3	1273
switches	0:5c4d7b2438d3	1274	/* Actual salt len */
switches	0:5c4d7b2438d3	1275	slen -= p - buf;
switches	0:5c4d7b2438d3	1276
switches	0:5c4d7b2438d3	1277	if( expected_salt_len != MBEDTLS_RSA_SALT_LEN_ANY &&
switches	0:5c4d7b2438d3	1278	slen != (size_t) expected_salt_len )
switches	0:5c4d7b2438d3	1279	{
switches	0:5c4d7b2438d3	1280	mbedtls_md_free( &md_ctx );
switches	0:5c4d7b2438d3	1281	return( MBEDTLS_ERR_RSA_INVALID_PADDING );
switches	0:5c4d7b2438d3	1282	}
switches	0:5c4d7b2438d3	1283
switches	0:5c4d7b2438d3	1284	/*
switches	0:5c4d7b2438d3	1285	* Generate H = Hash( M' )
switches	0:5c4d7b2438d3	1286	*/
switches	0:5c4d7b2438d3	1287	mbedtls_md_starts( &md_ctx );
switches	0:5c4d7b2438d3	1288	mbedtls_md_update( &md_ctx, zeros, 8 );
switches	0:5c4d7b2438d3	1289	mbedtls_md_update( &md_ctx, hash, hashlen );
switches	0:5c4d7b2438d3	1290	mbedtls_md_update( &md_ctx, p, slen );
switches	0:5c4d7b2438d3	1291	mbedtls_md_finish( &md_ctx, result );
switches	0:5c4d7b2438d3	1292
switches	0:5c4d7b2438d3	1293	mbedtls_md_free( &md_ctx );
switches	0:5c4d7b2438d3	1294
switches	0:5c4d7b2438d3	1295	if( memcmp( p + slen, result, hlen ) == 0 )
switches	0:5c4d7b2438d3	1296	return( 0 );
switches	0:5c4d7b2438d3	1297	else
switches	0:5c4d7b2438d3	1298	return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
switches	0:5c4d7b2438d3	1299	}
switches	0:5c4d7b2438d3	1300
switches	0:5c4d7b2438d3	1301	/*
switches	0:5c4d7b2438d3	1302	* Simplified PKCS#1 v2.1 RSASSA-PSS-VERIFY function
switches	0:5c4d7b2438d3	1303	*/
switches	0:5c4d7b2438d3	1304	int mbedtls_rsa_rsassa_pss_verify( mbedtls_rsa_context *ctx,
switches	0:5c4d7b2438d3	1305	int (f_rng)(void , unsigned char *, size_t),
switches	0:5c4d7b2438d3	1306	void *p_rng,
switches	0:5c4d7b2438d3	1307	int mode,
switches	0:5c4d7b2438d3	1308	mbedtls_md_type_t md_alg,
switches	0:5c4d7b2438d3	1309	unsigned int hashlen,
switches	0:5c4d7b2438d3	1310	const unsigned char *hash,
switches	0:5c4d7b2438d3	1311	const unsigned char *sig )
switches	0:5c4d7b2438d3	1312	{
switches	0:5c4d7b2438d3	1313	mbedtls_md_type_t mgf1_hash_id = ( ctx->hash_id != MBEDTLS_MD_NONE )
switches	0:5c4d7b2438d3	1314	? (mbedtls_md_type_t) ctx->hash_id
switches	0:5c4d7b2438d3	1315	: md_alg;
switches	0:5c4d7b2438d3	1316
switches	0:5c4d7b2438d3	1317	return( mbedtls_rsa_rsassa_pss_verify_ext( ctx, f_rng, p_rng, mode,
switches	0:5c4d7b2438d3	1318	md_alg, hashlen, hash,
switches	0:5c4d7b2438d3	1319	mgf1_hash_id, MBEDTLS_RSA_SALT_LEN_ANY,
switches	0:5c4d7b2438d3	1320	sig ) );
switches	0:5c4d7b2438d3	1321
switches	0:5c4d7b2438d3	1322	}
switches	0:5c4d7b2438d3	1323	#endif /* MBEDTLS_PKCS1_V21 */
switches	0:5c4d7b2438d3	1324
switches	0:5c4d7b2438d3	1325	#if defined(MBEDTLS_PKCS1_V15)
switches	0:5c4d7b2438d3	1326	/*
switches	0:5c4d7b2438d3	1327	* Implementation of the PKCS#1 v2.1 RSASSA-PKCS1-v1_5-VERIFY function
switches	0:5c4d7b2438d3	1328	*/
switches	0:5c4d7b2438d3	1329	int mbedtls_rsa_rsassa_pkcs1_v15_verify( mbedtls_rsa_context *ctx,
switches	0:5c4d7b2438d3	1330	int (f_rng)(void , unsigned char *, size_t),
switches	0:5c4d7b2438d3	1331	void *p_rng,
switches	0:5c4d7b2438d3	1332	int mode,
switches	0:5c4d7b2438d3	1333	mbedtls_md_type_t md_alg,
switches	0:5c4d7b2438d3	1334	unsigned int hashlen,
switches	0:5c4d7b2438d3	1335	const unsigned char *hash,
switches	0:5c4d7b2438d3	1336	const unsigned char *sig )
switches	0:5c4d7b2438d3	1337	{
switches	0:5c4d7b2438d3	1338	int ret;
switches	0:5c4d7b2438d3	1339	size_t len, siglen, asn1_len;
switches	0:5c4d7b2438d3	1340	unsigned char p, end;
switches	0:5c4d7b2438d3	1341	mbedtls_md_type_t msg_md_alg;
switches	0:5c4d7b2438d3	1342	const mbedtls_md_info_t *md_info;
switches	0:5c4d7b2438d3	1343	mbedtls_asn1_buf oid;
switches	0:5c4d7b2438d3	1344	unsigned char buf[MBEDTLS_MPI_MAX_SIZE];
switches	0:5c4d7b2438d3	1345
switches	0:5c4d7b2438d3	1346	if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V15 )
switches	0:5c4d7b2438d3	1347	return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
switches	0:5c4d7b2438d3	1348
switches	0:5c4d7b2438d3	1349	siglen = ctx->len;
switches	0:5c4d7b2438d3	1350
switches	0:5c4d7b2438d3	1351	if( siglen < 16 \|\| siglen > sizeof( buf ) )
switches	0:5c4d7b2438d3	1352	return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
switches	0:5c4d7b2438d3	1353
switches	0:5c4d7b2438d3	1354	ret = ( mode == MBEDTLS_RSA_PUBLIC )
switches	0:5c4d7b2438d3	1355	? mbedtls_rsa_public( ctx, sig, buf )
switches	0:5c4d7b2438d3	1356	: mbedtls_rsa_private( ctx, f_rng, p_rng, sig, buf );
switches	0:5c4d7b2438d3	1357
switches	0:5c4d7b2438d3	1358	if( ret != 0 )
switches	0:5c4d7b2438d3	1359	return( ret );
switches	0:5c4d7b2438d3	1360
switches	0:5c4d7b2438d3	1361	p = buf;
switches	0:5c4d7b2438d3	1362
switches	0:5c4d7b2438d3	1363	if( p++ != 0 \|\| p++ != MBEDTLS_RSA_SIGN )
switches	0:5c4d7b2438d3	1364	return( MBEDTLS_ERR_RSA_INVALID_PADDING );
switches	0:5c4d7b2438d3	1365
switches	0:5c4d7b2438d3	1366	while( *p != 0 )
switches	0:5c4d7b2438d3	1367	{
switches	0:5c4d7b2438d3	1368	if( p >= buf + siglen - 1 \|\| *p != 0xFF )
switches	0:5c4d7b2438d3	1369	return( MBEDTLS_ERR_RSA_INVALID_PADDING );
switches	0:5c4d7b2438d3	1370	p++;
switches	0:5c4d7b2438d3	1371	}
switches	0:5c4d7b2438d3	1372	p++;
switches	0:5c4d7b2438d3	1373
switches	0:5c4d7b2438d3	1374	len = siglen - ( p - buf );
switches	0:5c4d7b2438d3	1375
switches	0:5c4d7b2438d3	1376	if( len == hashlen && md_alg == MBEDTLS_MD_NONE )
switches	0:5c4d7b2438d3	1377	{
switches	0:5c4d7b2438d3	1378	if( memcmp( p, hash, hashlen ) == 0 )
switches	0:5c4d7b2438d3	1379	return( 0 );
switches	0:5c4d7b2438d3	1380	else
switches	0:5c4d7b2438d3	1381	return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
switches	0:5c4d7b2438d3	1382	}
switches	0:5c4d7b2438d3	1383
switches	0:5c4d7b2438d3	1384	md_info = mbedtls_md_info_from_type( md_alg );
switches	0:5c4d7b2438d3	1385	if( md_info == NULL )
switches	0:5c4d7b2438d3	1386	return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
switches	0:5c4d7b2438d3	1387	hashlen = mbedtls_md_get_size( md_info );
switches	0:5c4d7b2438d3	1388
switches	0:5c4d7b2438d3	1389	end = p + len;
switches	0:5c4d7b2438d3	1390
switches	0:5c4d7b2438d3	1391	/*
switches	0:5c4d7b2438d3	1392	* Parse the ASN.1 structure inside the PKCS#1 v1.5 structure
switches	0:5c4d7b2438d3	1393	*/
switches	0:5c4d7b2438d3	1394	if( ( ret = mbedtls_asn1_get_tag( &p, end, &asn1_len,
switches	0:5c4d7b2438d3	1395	MBEDTLS_ASN1_CONSTRUCTED \| MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
switches	0:5c4d7b2438d3	1396	return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
switches	0:5c4d7b2438d3	1397
switches	0:5c4d7b2438d3	1398	if( asn1_len + 2 != len )
switches	0:5c4d7b2438d3	1399	return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
switches	0:5c4d7b2438d3	1400
switches	0:5c4d7b2438d3	1401	if( ( ret = mbedtls_asn1_get_tag( &p, end, &asn1_len,
switches	0:5c4d7b2438d3	1402	MBEDTLS_ASN1_CONSTRUCTED \| MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
switches	0:5c4d7b2438d3	1403	return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
switches	0:5c4d7b2438d3	1404
switches	0:5c4d7b2438d3	1405	if( asn1_len + 6 + hashlen != len )
switches	0:5c4d7b2438d3	1406	return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
switches	0:5c4d7b2438d3	1407
switches	0:5c4d7b2438d3	1408	if( ( ret = mbedtls_asn1_get_tag( &p, end, &oid.len, MBEDTLS_ASN1_OID ) ) != 0 )
switches	0:5c4d7b2438d3	1409	return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
switches	0:5c4d7b2438d3	1410
switches	0:5c4d7b2438d3	1411	oid.p = p;
switches	0:5c4d7b2438d3	1412	p += oid.len;
switches	0:5c4d7b2438d3	1413
switches	0:5c4d7b2438d3	1414	if( mbedtls_oid_get_md_alg( &oid, &msg_md_alg ) != 0 )
switches	0:5c4d7b2438d3	1415	return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
switches	0:5c4d7b2438d3	1416
switches	0:5c4d7b2438d3	1417	if( md_alg != msg_md_alg )
switches	0:5c4d7b2438d3	1418	return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
switches	0:5c4d7b2438d3	1419
switches	0:5c4d7b2438d3	1420	/*
switches	0:5c4d7b2438d3	1421	* assume the algorithm parameters must be NULL
switches	0:5c4d7b2438d3	1422	*/
switches	0:5c4d7b2438d3	1423	if( ( ret = mbedtls_asn1_get_tag( &p, end, &asn1_len, MBEDTLS_ASN1_NULL ) ) != 0 )
switches	0:5c4d7b2438d3	1424	return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
switches	0:5c4d7b2438d3	1425
switches	0:5c4d7b2438d3	1426	if( ( ret = mbedtls_asn1_get_tag( &p, end, &asn1_len, MBEDTLS_ASN1_OCTET_STRING ) ) != 0 )
switches	0:5c4d7b2438d3	1427	return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
switches	0:5c4d7b2438d3	1428
switches	0:5c4d7b2438d3	1429	if( asn1_len != hashlen )
switches	0:5c4d7b2438d3	1430	return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
switches	0:5c4d7b2438d3	1431
switches	0:5c4d7b2438d3	1432	if( memcmp( p, hash, hashlen ) != 0 )
switches	0:5c4d7b2438d3	1433	return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
switches	0:5c4d7b2438d3	1434
switches	0:5c4d7b2438d3	1435	p += hashlen;
switches	0:5c4d7b2438d3	1436
switches	0:5c4d7b2438d3	1437	if( p != end )
switches	0:5c4d7b2438d3	1438	return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
switches	0:5c4d7b2438d3	1439
switches	0:5c4d7b2438d3	1440	return( 0 );
switches	0:5c4d7b2438d3	1441	}
switches	0:5c4d7b2438d3	1442	#endif /* MBEDTLS_PKCS1_V15 */
switches	0:5c4d7b2438d3	1443
switches	0:5c4d7b2438d3	1444	/*
switches	0:5c4d7b2438d3	1445	* Do an RSA operation and check the message digest
switches	0:5c4d7b2438d3	1446	*/
switches	0:5c4d7b2438d3	1447	int mbedtls_rsa_pkcs1_verify( mbedtls_rsa_context *ctx,
switches	0:5c4d7b2438d3	1448	int (f_rng)(void , unsigned char *, size_t),
switches	0:5c4d7b2438d3	1449	void *p_rng,
switches	0:5c4d7b2438d3	1450	int mode,
switches	0:5c4d7b2438d3	1451	mbedtls_md_type_t md_alg,
switches	0:5c4d7b2438d3	1452	unsigned int hashlen,
switches	0:5c4d7b2438d3	1453	const unsigned char *hash,
switches	0:5c4d7b2438d3	1454	const unsigned char *sig )
switches	0:5c4d7b2438d3	1455	{
switches	0:5c4d7b2438d3	1456	switch( ctx->padding )
switches	0:5c4d7b2438d3	1457	{
switches	0:5c4d7b2438d3	1458	#if defined(MBEDTLS_PKCS1_V15)
switches	0:5c4d7b2438d3	1459	case MBEDTLS_RSA_PKCS_V15:
switches	0:5c4d7b2438d3	1460	return mbedtls_rsa_rsassa_pkcs1_v15_verify( ctx, f_rng, p_rng, mode, md_alg,
switches	0:5c4d7b2438d3	1461	hashlen, hash, sig );
switches	0:5c4d7b2438d3	1462	#endif
switches	0:5c4d7b2438d3	1463
switches	0:5c4d7b2438d3	1464	#if defined(MBEDTLS_PKCS1_V21)
switches	0:5c4d7b2438d3	1465	case MBEDTLS_RSA_PKCS_V21:
switches	0:5c4d7b2438d3	1466	return mbedtls_rsa_rsassa_pss_verify( ctx, f_rng, p_rng, mode, md_alg,
switches	0:5c4d7b2438d3	1467	hashlen, hash, sig );
switches	0:5c4d7b2438d3	1468	#endif
switches	0:5c4d7b2438d3	1469
switches	0:5c4d7b2438d3	1470	default:
switches	0:5c4d7b2438d3	1471	return( MBEDTLS_ERR_RSA_INVALID_PADDING );
switches	0:5c4d7b2438d3	1472	}
switches	0:5c4d7b2438d3	1473	}
switches	0:5c4d7b2438d3	1474
switches	0:5c4d7b2438d3	1475	/*
switches	0:5c4d7b2438d3	1476	* Copy the components of an RSA key
switches	0:5c4d7b2438d3	1477	*/
switches	0:5c4d7b2438d3	1478	int mbedtls_rsa_copy( mbedtls_rsa_context dst, const mbedtls_rsa_context src )
switches	0:5c4d7b2438d3	1479	{
switches	0:5c4d7b2438d3	1480	int ret;
switches	0:5c4d7b2438d3	1481
switches	0:5c4d7b2438d3	1482	dst->ver = src->ver;
switches	0:5c4d7b2438d3	1483	dst->len = src->len;
switches	0:5c4d7b2438d3	1484
switches	0:5c4d7b2438d3	1485	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->N, &src->N ) );
switches	0:5c4d7b2438d3	1486	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->E, &src->E ) );
switches	0:5c4d7b2438d3	1487
switches	0:5c4d7b2438d3	1488	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->D, &src->D ) );
switches	0:5c4d7b2438d3	1489	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->P, &src->P ) );
switches	0:5c4d7b2438d3	1490	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->Q, &src->Q ) );
switches	0:5c4d7b2438d3	1491	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->DP, &src->DP ) );
switches	0:5c4d7b2438d3	1492	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->DQ, &src->DQ ) );
switches	0:5c4d7b2438d3	1493	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->QP, &src->QP ) );
switches	0:5c4d7b2438d3	1494
switches	0:5c4d7b2438d3	1495	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->RN, &src->RN ) );
switches	0:5c4d7b2438d3	1496	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->RP, &src->RP ) );
switches	0:5c4d7b2438d3	1497	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->RQ, &src->RQ ) );
switches	0:5c4d7b2438d3	1498
switches	0:5c4d7b2438d3	1499	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->Vi, &src->Vi ) );
switches	0:5c4d7b2438d3	1500	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->Vf, &src->Vf ) );
switches	0:5c4d7b2438d3	1501
switches	0:5c4d7b2438d3	1502	dst->padding = src->padding;
switches	0:5c4d7b2438d3	1503	dst->hash_id = src->hash_id;
switches	0:5c4d7b2438d3	1504
switches	0:5c4d7b2438d3	1505	cleanup:
switches	0:5c4d7b2438d3	1506	if( ret != 0 )
switches	0:5c4d7b2438d3	1507	mbedtls_rsa_free( dst );
switches	0:5c4d7b2438d3	1508
switches	0:5c4d7b2438d3	1509	return( ret );
switches	0:5c4d7b2438d3	1510	}
switches	0:5c4d7b2438d3	1511
switches	0:5c4d7b2438d3	1512	/*
switches	0:5c4d7b2438d3	1513	* Free the components of an RSA key
switches	0:5c4d7b2438d3	1514	*/
switches	0:5c4d7b2438d3	1515	void mbedtls_rsa_free( mbedtls_rsa_context *ctx )
switches	0:5c4d7b2438d3	1516	{
switches	0:5c4d7b2438d3	1517	mbedtls_mpi_free( &ctx->Vi ); mbedtls_mpi_free( &ctx->Vf );
switches	0:5c4d7b2438d3	1518	mbedtls_mpi_free( &ctx->RQ ); mbedtls_mpi_free( &ctx->RP ); mbedtls_mpi_free( &ctx->RN );
switches	0:5c4d7b2438d3	1519	mbedtls_mpi_free( &ctx->QP ); mbedtls_mpi_free( &ctx->DQ ); mbedtls_mpi_free( &ctx->DP );
switches	0:5c4d7b2438d3	1520	mbedtls_mpi_free( &ctx->Q ); mbedtls_mpi_free( &ctx->P ); mbedtls_mpi_free( &ctx->D );
switches	0:5c4d7b2438d3	1521	mbedtls_mpi_free( &ctx->E ); mbedtls_mpi_free( &ctx->N );
switches	0:5c4d7b2438d3	1522
switches	0:5c4d7b2438d3	1523	#if defined(MBEDTLS_THREADING_C)
switches	0:5c4d7b2438d3	1524	mbedtls_mutex_free( &ctx->mutex );
switches	0:5c4d7b2438d3	1525	#endif
switches	0:5c4d7b2438d3	1526	}
switches	0:5c4d7b2438d3	1527
switches	0:5c4d7b2438d3	1528	#if defined(MBEDTLS_SELF_TEST)
switches	0:5c4d7b2438d3	1529
switches	0:5c4d7b2438d3	1530	#include "mbedtls/sha1.h"
switches	0:5c4d7b2438d3	1531
switches	0:5c4d7b2438d3	1532	/*
switches	0:5c4d7b2438d3	1533	* Example RSA-1024 keypair, for test purposes
switches	0:5c4d7b2438d3	1534	*/
switches	0:5c4d7b2438d3	1535	#define KEY_LEN 128
switches	0:5c4d7b2438d3	1536
switches	0:5c4d7b2438d3	1537	#define RSA_N "9292758453063D803DD603D5E777D788" \
switches	0:5c4d7b2438d3	1538	"8ED1D5BF35786190FA2F23EBC0848AEA" \
switches	0:5c4d7b2438d3	1539	"DDA92CA6C3D80B32C4D109BE0F36D6AE" \
switches	0:5c4d7b2438d3	1540	"7130B9CED7ACDF54CFC7555AC14EEBAB" \
switches	0:5c4d7b2438d3	1541	"93A89813FBF3C4F8066D2D800F7C38A8" \
switches	0:5c4d7b2438d3	1542	"1AE31942917403FF4946B0A83D3D3E05" \
switches	0:5c4d7b2438d3	1543	"EE57C6F5F5606FB5D4BC6CD34EE0801A" \
switches	0:5c4d7b2438d3	1544	"5E94BB77B07507233A0BC7BAC8F90F79"
switches	0:5c4d7b2438d3	1545
switches	0:5c4d7b2438d3	1546	#define RSA_E "10001"
switches	0:5c4d7b2438d3	1547
switches	0:5c4d7b2438d3	1548	#define RSA_D "24BF6185468786FDD303083D25E64EFC" \
switches	0:5c4d7b2438d3	1549	"66CA472BC44D253102F8B4A9D3BFA750" \
switches	0:5c4d7b2438d3	1550	"91386C0077937FE33FA3252D28855837" \
switches	0:5c4d7b2438d3	1551	"AE1B484A8A9A45F7EE8C0C634F99E8CD" \
switches	0:5c4d7b2438d3	1552	"DF79C5CE07EE72C7F123142198164234" \
switches	0:5c4d7b2438d3	1553	"CABB724CF78B8173B9F880FC86322407" \
switches	0:5c4d7b2438d3	1554	"AF1FEDFDDE2BEB674CA15F3E81A1521E" \
switches	0:5c4d7b2438d3	1555	"071513A1E85B5DFA031F21ECAE91A34D"
switches	0:5c4d7b2438d3	1556
switches	0:5c4d7b2438d3	1557	#define RSA_P "C36D0EB7FCD285223CFB5AABA5BDA3D8" \
switches	0:5c4d7b2438d3	1558	"2C01CAD19EA484A87EA4377637E75500" \
switches	0:5c4d7b2438d3	1559	"FCB2005C5C7DD6EC4AC023CDA285D796" \
switches	0:5c4d7b2438d3	1560	"C3D9E75E1EFC42488BB4F1D13AC30A57"
switches	0:5c4d7b2438d3	1561
switches	0:5c4d7b2438d3	1562	#define RSA_Q "C000DF51A7C77AE8D7C7370C1FF55B69" \
switches	0:5c4d7b2438d3	1563	"E211C2B9E5DB1ED0BF61D0D9899620F4" \
switches	0:5c4d7b2438d3	1564	"910E4168387E3C30AA1E00C339A79508" \
switches	0:5c4d7b2438d3	1565	"8452DD96A9A5EA5D9DCA68DA636032AF"
switches	0:5c4d7b2438d3	1566
switches	0:5c4d7b2438d3	1567	#define RSA_DP "C1ACF567564274FB07A0BBAD5D26E298" \
switches	0:5c4d7b2438d3	1568	"3C94D22288ACD763FD8E5600ED4A702D" \
switches	0:5c4d7b2438d3	1569	"F84198A5F06C2E72236AE490C93F07F8" \
switches	0:5c4d7b2438d3	1570	"3CC559CD27BC2D1CA488811730BB5725"
switches	0:5c4d7b2438d3	1571
switches	0:5c4d7b2438d3	1572	#define RSA_DQ "4959CBF6F8FEF750AEE6977C155579C7" \
switches	0:5c4d7b2438d3	1573	"D8AAEA56749EA28623272E4F7D0592AF" \
switches	0:5c4d7b2438d3	1574	"7C1F1313CAC9471B5C523BFE592F517B" \
switches	0:5c4d7b2438d3	1575	"407A1BD76C164B93DA2D32A383E58357"
switches	0:5c4d7b2438d3	1576
switches	0:5c4d7b2438d3	1577	#define RSA_QP "9AE7FBC99546432DF71896FC239EADAE" \
switches	0:5c4d7b2438d3	1578	"F38D18D2B2F0E2DD275AA977E2BF4411" \
switches	0:5c4d7b2438d3	1579	"F5A3B2A5D33605AEBBCCBA7FEB9F2D2F" \
switches	0:5c4d7b2438d3	1580	"A74206CEC169D74BF5A8C50D6F48EA08"
switches	0:5c4d7b2438d3	1581
switches	0:5c4d7b2438d3	1582	#define PT_LEN 24
switches	0:5c4d7b2438d3	1583	#define RSA_PT "\xAA\xBB\xCC\x03\x02\x01\x00\xFF\xFF\xFF\xFF\xFF" \
switches	0:5c4d7b2438d3	1584	"\x11\x22\x33\x0A\x0B\x0C\xCC\xDD\xDD\xDD\xDD\xDD"
switches	0:5c4d7b2438d3	1585
switches	0:5c4d7b2438d3	1586	#if defined(MBEDTLS_PKCS1_V15)
switches	0:5c4d7b2438d3	1587	static int myrand( void rng_state, unsigned char output, size_t len )
switches	0:5c4d7b2438d3	1588	{
switches	0:5c4d7b2438d3	1589	#if !defined(__OpenBSD__)
switches	0:5c4d7b2438d3	1590	size_t i;
switches	0:5c4d7b2438d3	1591
switches	0:5c4d7b2438d3	1592	if( rng_state != NULL )
switches	0:5c4d7b2438d3	1593	rng_state = NULL;
switches	0:5c4d7b2438d3	1594
switches	0:5c4d7b2438d3	1595	for( i = 0; i < len; ++i )
switches	0:5c4d7b2438d3	1596	output[i] = rand();
switches	0:5c4d7b2438d3	1597	#else
switches	0:5c4d7b2438d3	1598	if( rng_state != NULL )
switches	0:5c4d7b2438d3	1599	rng_state = NULL;
switches	0:5c4d7b2438d3	1600
switches	0:5c4d7b2438d3	1601	arc4random_buf( output, len );
switches	0:5c4d7b2438d3	1602	#endif /* !OpenBSD */
switches	0:5c4d7b2438d3	1603
switches	0:5c4d7b2438d3	1604	return( 0 );
switches	0:5c4d7b2438d3	1605	}
switches	0:5c4d7b2438d3	1606	#endif /* MBEDTLS_PKCS1_V15 */
switches	0:5c4d7b2438d3	1607
switches	0:5c4d7b2438d3	1608	/*
switches	0:5c4d7b2438d3	1609	* Checkup routine
switches	0:5c4d7b2438d3	1610	*/
switches	0:5c4d7b2438d3	1611	int mbedtls_rsa_self_test( int verbose )
switches	0:5c4d7b2438d3	1612	{
switches	0:5c4d7b2438d3	1613	int ret = 0;
switches	0:5c4d7b2438d3	1614	#if defined(MBEDTLS_PKCS1_V15)
switches	0:5c4d7b2438d3	1615	size_t len;
switches	0:5c4d7b2438d3	1616	mbedtls_rsa_context rsa;
switches	0:5c4d7b2438d3	1617	unsigned char rsa_plaintext[PT_LEN];
switches	0:5c4d7b2438d3	1618	unsigned char rsa_decrypted[PT_LEN];
switches	0:5c4d7b2438d3	1619	unsigned char rsa_ciphertext[KEY_LEN];
switches	0:5c4d7b2438d3	1620	#if defined(MBEDTLS_SHA1_C)
switches	0:5c4d7b2438d3	1621	unsigned char sha1sum[20];
switches	0:5c4d7b2438d3	1622	#endif
switches	0:5c4d7b2438d3	1623
switches	0:5c4d7b2438d3	1624	mbedtls_rsa_init( &rsa, MBEDTLS_RSA_PKCS_V15, 0 );
switches	0:5c4d7b2438d3	1625
switches	0:5c4d7b2438d3	1626	rsa.len = KEY_LEN;
switches	0:5c4d7b2438d3	1627	MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &rsa.N , 16, RSA_N ) );
switches	0:5c4d7b2438d3	1628	MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &rsa.E , 16, RSA_E ) );
switches	0:5c4d7b2438d3	1629	MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &rsa.D , 16, RSA_D ) );
switches	0:5c4d7b2438d3	1630	MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &rsa.P , 16, RSA_P ) );
switches	0:5c4d7b2438d3	1631	MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &rsa.Q , 16, RSA_Q ) );
switches	0:5c4d7b2438d3	1632	MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &rsa.DP, 16, RSA_DP ) );
switches	0:5c4d7b2438d3	1633	MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &rsa.DQ, 16, RSA_DQ ) );
switches	0:5c4d7b2438d3	1634	MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &rsa.QP, 16, RSA_QP ) );
switches	0:5c4d7b2438d3	1635
switches	0:5c4d7b2438d3	1636	if( verbose != 0 )
switches	0:5c4d7b2438d3	1637	mbedtls_printf( " RSA key validation: " );
switches	0:5c4d7b2438d3	1638
switches	0:5c4d7b2438d3	1639	if( mbedtls_rsa_check_pubkey( &rsa ) != 0 \|\|
switches	0:5c4d7b2438d3	1640	mbedtls_rsa_check_privkey( &rsa ) != 0 )
switches	0:5c4d7b2438d3	1641	{
switches	0:5c4d7b2438d3	1642	if( verbose != 0 )
switches	0:5c4d7b2438d3	1643	mbedtls_printf( "failed\n" );
switches	0:5c4d7b2438d3	1644
switches	0:5c4d7b2438d3	1645	return( 1 );
switches	0:5c4d7b2438d3	1646	}
switches	0:5c4d7b2438d3	1647
switches	0:5c4d7b2438d3	1648	if( verbose != 0 )
switches	0:5c4d7b2438d3	1649	mbedtls_printf( "passed\n PKCS#1 encryption : " );
switches	0:5c4d7b2438d3	1650
switches	0:5c4d7b2438d3	1651	memcpy( rsa_plaintext, RSA_PT, PT_LEN );
switches	0:5c4d7b2438d3	1652
switches	0:5c4d7b2438d3	1653	if( mbedtls_rsa_pkcs1_encrypt( &rsa, myrand, NULL, MBEDTLS_RSA_PUBLIC, PT_LEN,
switches	0:5c4d7b2438d3	1654	rsa_plaintext, rsa_ciphertext ) != 0 )
switches	0:5c4d7b2438d3	1655	{
switches	0:5c4d7b2438d3	1656	if( verbose != 0 )
switches	0:5c4d7b2438d3	1657	mbedtls_printf( "failed\n" );
switches	0:5c4d7b2438d3	1658
switches	0:5c4d7b2438d3	1659	return( 1 );
switches	0:5c4d7b2438d3	1660	}
switches	0:5c4d7b2438d3	1661
switches	0:5c4d7b2438d3	1662	if( verbose != 0 )
switches	0:5c4d7b2438d3	1663	mbedtls_printf( "passed\n PKCS#1 decryption : " );
switches	0:5c4d7b2438d3	1664
switches	0:5c4d7b2438d3	1665	if( mbedtls_rsa_pkcs1_decrypt( &rsa, myrand, NULL, MBEDTLS_RSA_PRIVATE, &len,
switches	0:5c4d7b2438d3	1666	rsa_ciphertext, rsa_decrypted,
switches	0:5c4d7b2438d3	1667	sizeof(rsa_decrypted) ) != 0 )
switches	0:5c4d7b2438d3	1668	{
switches	0:5c4d7b2438d3	1669	if( verbose != 0 )
switches	0:5c4d7b2438d3	1670	mbedtls_printf( "failed\n" );
switches	0:5c4d7b2438d3	1671
switches	0:5c4d7b2438d3	1672	return( 1 );
switches	0:5c4d7b2438d3	1673	}
switches	0:5c4d7b2438d3	1674
switches	0:5c4d7b2438d3	1675	if( memcmp( rsa_decrypted, rsa_plaintext, len ) != 0 )
switches	0:5c4d7b2438d3	1676	{
switches	0:5c4d7b2438d3	1677	if( verbose != 0 )
switches	0:5c4d7b2438d3	1678	mbedtls_printf( "failed\n" );
switches	0:5c4d7b2438d3	1679
switches	0:5c4d7b2438d3	1680	return( 1 );
switches	0:5c4d7b2438d3	1681	}
switches	0:5c4d7b2438d3	1682
switches	0:5c4d7b2438d3	1683	if( verbose != 0 )
switches	0:5c4d7b2438d3	1684	mbedtls_printf( "passed\n" );
switches	0:5c4d7b2438d3	1685
switches	0:5c4d7b2438d3	1686	#if defined(MBEDTLS_SHA1_C)
switches	0:5c4d7b2438d3	1687	if( verbose != 0 )
switches	0:5c4d7b2438d3	1688	mbedtls_printf( " PKCS#1 data sign : " );
switches	0:5c4d7b2438d3	1689
switches	0:5c4d7b2438d3	1690	mbedtls_sha1( rsa_plaintext, PT_LEN, sha1sum );
switches	0:5c4d7b2438d3	1691
switches	0:5c4d7b2438d3	1692	if( mbedtls_rsa_pkcs1_sign( &rsa, myrand, NULL, MBEDTLS_RSA_PRIVATE, MBEDTLS_MD_SHA1, 0,
switches	0:5c4d7b2438d3	1693	sha1sum, rsa_ciphertext ) != 0 )
switches	0:5c4d7b2438d3	1694	{
switches	0:5c4d7b2438d3	1695	if( verbose != 0 )
switches	0:5c4d7b2438d3	1696	mbedtls_printf( "failed\n" );
switches	0:5c4d7b2438d3	1697
switches	0:5c4d7b2438d3	1698	return( 1 );
switches	0:5c4d7b2438d3	1699	}
switches	0:5c4d7b2438d3	1700
switches	0:5c4d7b2438d3	1701	if( verbose != 0 )
switches	0:5c4d7b2438d3	1702	mbedtls_printf( "passed\n PKCS#1 sig. verify: " );
switches	0:5c4d7b2438d3	1703
switches	0:5c4d7b2438d3	1704	if( mbedtls_rsa_pkcs1_verify( &rsa, NULL, NULL, MBEDTLS_RSA_PUBLIC, MBEDTLS_MD_SHA1, 0,
switches	0:5c4d7b2438d3	1705	sha1sum, rsa_ciphertext ) != 0 )
switches	0:5c4d7b2438d3	1706	{
switches	0:5c4d7b2438d3	1707	if( verbose != 0 )
switches	0:5c4d7b2438d3	1708	mbedtls_printf( "failed\n" );
switches	0:5c4d7b2438d3	1709
switches	0:5c4d7b2438d3	1710	return( 1 );
switches	0:5c4d7b2438d3	1711	}
switches	0:5c4d7b2438d3	1712
switches	0:5c4d7b2438d3	1713	if( verbose != 0 )
switches	0:5c4d7b2438d3	1714	mbedtls_printf( "passed\n" );
switches	0:5c4d7b2438d3	1715	#endif /* MBEDTLS_SHA1_C */
switches	0:5c4d7b2438d3	1716
switches	0:5c4d7b2438d3	1717	if( verbose != 0 )
switches	0:5c4d7b2438d3	1718	mbedtls_printf( "\n" );
switches	0:5c4d7b2438d3	1719
switches	0:5c4d7b2438d3	1720	cleanup:
switches	0:5c4d7b2438d3	1721	mbedtls_rsa_free( &rsa );
switches	0:5c4d7b2438d3	1722	#else /* MBEDTLS_PKCS1_V15 */
switches	0:5c4d7b2438d3	1723	((void) verbose);
switches	0:5c4d7b2438d3	1724	#endif /* MBEDTLS_PKCS1_V15 */
switches	0:5c4d7b2438d3	1725	return( ret );
switches	0:5c4d7b2438d3	1726	}
switches	0:5c4d7b2438d3	1727
switches	0:5c4d7b2438d3	1728	#endif /* MBEDTLS_SELF_TEST */
switches	0:5c4d7b2438d3	1729
switches	0:5c4d7b2438d3	1730	#endif /* MBEDTLS_RSA_C */

Repository toolbox

Export to desktop IDE

Repository details

Type:	Library
Created:	11 Nov 2016
Imports:	21
Forks:	0
Commits:	4
Dependents:	1
Dependencies:	0
Followers:	4

This repository is Public (Unlisted).

Developers

Greg Steiert

Jesse Marroquin

features/mbedtls/src/rsa.c@3:1198227e6421, 2016-12-16 (annotated)

Who changed what in which revision?

Repository toolbox

Repository details

Developers

Important Information for this Arm website

Access Warning