1 /*
2 * Copyright 2006-2018 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the OpenSSL license (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10 #include <stdio.h>
11 #include "internal/cryptlib.h"
12 #include <openssl/asn1t.h>
13 #include <openssl/x509.h>
14 #include <openssl/bn.h>
15 #include <openssl/cms.h>
16 #include "internal/asn1_int.h"
17 #include "internal/evp_int.h"
18 #include "rsa_locl.h"
19
20 #ifndef OPENSSL_NO_CMS
21 static int rsa_cms_sign(CMS_SignerInfo *si);
22 static int rsa_cms_verify(CMS_SignerInfo *si);
23 static int rsa_cms_decrypt(CMS_RecipientInfo *ri);
24 static int rsa_cms_encrypt(CMS_RecipientInfo *ri);
25 #endif
26
27 static RSA_PSS_PARAMS *rsa_pss_decode(const X509_ALGOR *alg);
28
29 /* Set any parameters associated with pkey */
rsa_param_encode(const EVP_PKEY * pkey,ASN1_STRING ** pstr,int * pstrtype)30 static int rsa_param_encode(const EVP_PKEY *pkey,
31 ASN1_STRING **pstr, int *pstrtype)
32 {
33 const RSA *rsa = pkey->pkey.rsa;
34
35 *pstr = NULL;
36 /* If RSA it's just NULL type */
37 if (pkey->ameth->pkey_id != EVP_PKEY_RSA_PSS) {
38 *pstrtype = V_ASN1_NULL;
39 return 1;
40 }
41 /* If no PSS parameters we omit parameters entirely */
42 if (rsa->pss == NULL) {
43 *pstrtype = V_ASN1_UNDEF;
44 return 1;
45 }
46 /* Encode PSS parameters */
47 if (ASN1_item_pack(rsa->pss, ASN1_ITEM_rptr(RSA_PSS_PARAMS), pstr) == NULL)
48 return 0;
49
50 *pstrtype = V_ASN1_SEQUENCE;
51 return 1;
52 }
53 /* Decode any parameters and set them in RSA structure */
rsa_param_decode(RSA * rsa,const X509_ALGOR * alg)54 static int rsa_param_decode(RSA *rsa, const X509_ALGOR *alg)
55 {
56 const ASN1_OBJECT *algoid;
57 const void *algp;
58 int algptype;
59
60 X509_ALGOR_get0(&algoid, &algptype, &algp, alg);
61 if (OBJ_obj2nid(algoid) != EVP_PKEY_RSA_PSS)
62 return 1;
63 if (algptype == V_ASN1_UNDEF)
64 return 1;
65 if (algptype != V_ASN1_SEQUENCE) {
66 RSAerr(RSA_F_RSA_PARAM_DECODE, RSA_R_INVALID_PSS_PARAMETERS);
67 return 0;
68 }
69 rsa->pss = rsa_pss_decode(alg);
70 if (rsa->pss == NULL)
71 return 0;
72 return 1;
73 }
74
rsa_pub_encode(X509_PUBKEY * pk,const EVP_PKEY * pkey)75 static int rsa_pub_encode(X509_PUBKEY *pk, const EVP_PKEY *pkey)
76 {
77 unsigned char *penc = NULL;
78 int penclen;
79 ASN1_STRING *str;
80 int strtype;
81
82 if (!rsa_param_encode(pkey, &str, &strtype))
83 return 0;
84 penclen = i2d_RSAPublicKey(pkey->pkey.rsa, &penc);
85 if (penclen <= 0)
86 return 0;
87 if (X509_PUBKEY_set0_param(pk, OBJ_nid2obj(pkey->ameth->pkey_id),
88 strtype, str, penc, penclen))
89 return 1;
90
91 OPENSSL_free(penc);
92 return 0;
93 }
94
rsa_pub_decode(EVP_PKEY * pkey,X509_PUBKEY * pubkey)95 static int rsa_pub_decode(EVP_PKEY *pkey, X509_PUBKEY *pubkey)
96 {
97 const unsigned char *p;
98 int pklen;
99 X509_ALGOR *alg;
100 RSA *rsa = NULL;
101
102 if (!X509_PUBKEY_get0_param(NULL, &p, &pklen, &alg, pubkey))
103 return 0;
104 if ((rsa = d2i_RSAPublicKey(NULL, &p, pklen)) == NULL) {
105 RSAerr(RSA_F_RSA_PUB_DECODE, ERR_R_RSA_LIB);
106 return 0;
107 }
108 if (!rsa_param_decode(rsa, alg)) {
109 RSA_free(rsa);
110 return 0;
111 }
112 if (!EVP_PKEY_assign(pkey, pkey->ameth->pkey_id, rsa)) {
113 RSA_free(rsa);
114 return 0;
115 }
116 return 1;
117 }
118
rsa_pub_cmp(const EVP_PKEY * a,const EVP_PKEY * b)119 static int rsa_pub_cmp(const EVP_PKEY *a, const EVP_PKEY *b)
120 {
121 if (BN_cmp(b->pkey.rsa->n, a->pkey.rsa->n) != 0
122 || BN_cmp(b->pkey.rsa->e, a->pkey.rsa->e) != 0)
123 return 0;
124 return 1;
125 }
126
old_rsa_priv_decode(EVP_PKEY * pkey,const unsigned char ** pder,int derlen)127 static int old_rsa_priv_decode(EVP_PKEY *pkey,
128 const unsigned char **pder, int derlen)
129 {
130 RSA *rsa;
131
132 if ((rsa = d2i_RSAPrivateKey(NULL, pder, derlen)) == NULL) {
133 RSAerr(RSA_F_OLD_RSA_PRIV_DECODE, ERR_R_RSA_LIB);
134 return 0;
135 }
136 EVP_PKEY_assign(pkey, pkey->ameth->pkey_id, rsa);
137 return 1;
138 }
139
old_rsa_priv_encode(const EVP_PKEY * pkey,unsigned char ** pder)140 static int old_rsa_priv_encode(const EVP_PKEY *pkey, unsigned char **pder)
141 {
142 return i2d_RSAPrivateKey(pkey->pkey.rsa, pder);
143 }
144
rsa_priv_encode(PKCS8_PRIV_KEY_INFO * p8,const EVP_PKEY * pkey)145 static int rsa_priv_encode(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pkey)
146 {
147 unsigned char *rk = NULL;
148 int rklen;
149 ASN1_STRING *str;
150 int strtype;
151
152 if (!rsa_param_encode(pkey, &str, &strtype))
153 return 0;
154 rklen = i2d_RSAPrivateKey(pkey->pkey.rsa, &rk);
155
156 if (rklen <= 0) {
157 RSAerr(RSA_F_RSA_PRIV_ENCODE, ERR_R_MALLOC_FAILURE);
158 ASN1_STRING_free(str);
159 return 0;
160 }
161
162 if (!PKCS8_pkey_set0(p8, OBJ_nid2obj(pkey->ameth->pkey_id), 0,
163 strtype, str, rk, rklen)) {
164 RSAerr(RSA_F_RSA_PRIV_ENCODE, ERR_R_MALLOC_FAILURE);
165 ASN1_STRING_free(str);
166 return 0;
167 }
168
169 return 1;
170 }
171
rsa_priv_decode(EVP_PKEY * pkey,const PKCS8_PRIV_KEY_INFO * p8)172 static int rsa_priv_decode(EVP_PKEY *pkey, const PKCS8_PRIV_KEY_INFO *p8)
173 {
174 const unsigned char *p;
175 RSA *rsa;
176 int pklen;
177 const X509_ALGOR *alg;
178
179 if (!PKCS8_pkey_get0(NULL, &p, &pklen, &alg, p8))
180 return 0;
181 rsa = d2i_RSAPrivateKey(NULL, &p, pklen);
182 if (rsa == NULL) {
183 RSAerr(RSA_F_RSA_PRIV_DECODE, ERR_R_RSA_LIB);
184 return 0;
185 }
186 if (!rsa_param_decode(rsa, alg)) {
187 RSA_free(rsa);
188 return 0;
189 }
190 EVP_PKEY_assign(pkey, pkey->ameth->pkey_id, rsa);
191 return 1;
192 }
193
int_rsa_size(const EVP_PKEY * pkey)194 static int int_rsa_size(const EVP_PKEY *pkey)
195 {
196 return RSA_size(pkey->pkey.rsa);
197 }
198
rsa_bits(const EVP_PKEY * pkey)199 static int rsa_bits(const EVP_PKEY *pkey)
200 {
201 return BN_num_bits(pkey->pkey.rsa->n);
202 }
203
rsa_security_bits(const EVP_PKEY * pkey)204 static int rsa_security_bits(const EVP_PKEY *pkey)
205 {
206 return RSA_security_bits(pkey->pkey.rsa);
207 }
208
int_rsa_free(EVP_PKEY * pkey)209 static void int_rsa_free(EVP_PKEY *pkey)
210 {
211 RSA_free(pkey->pkey.rsa);
212 }
213
rsa_mgf1_decode(X509_ALGOR * alg)214 static X509_ALGOR *rsa_mgf1_decode(X509_ALGOR *alg)
215 {
216 if (OBJ_obj2nid(alg->algorithm) != NID_mgf1)
217 return NULL;
218 return ASN1_TYPE_unpack_sequence(ASN1_ITEM_rptr(X509_ALGOR),
219 alg->parameter);
220 }
221
rsa_pss_param_print(BIO * bp,int pss_key,RSA_PSS_PARAMS * pss,int indent)222 static int rsa_pss_param_print(BIO *bp, int pss_key, RSA_PSS_PARAMS *pss,
223 int indent)
224 {
225 int rv = 0;
226 X509_ALGOR *maskHash = NULL;
227
228 if (!BIO_indent(bp, indent, 128))
229 goto err;
230 if (pss_key) {
231 if (pss == NULL) {
232 if (BIO_puts(bp, "No PSS parameter restrictions\n") <= 0)
233 return 0;
234 return 1;
235 } else {
236 if (BIO_puts(bp, "PSS parameter restrictions:") <= 0)
237 return 0;
238 }
239 } else if (pss == NULL) {
240 if (BIO_puts(bp,"(INVALID PSS PARAMETERS)\n") <= 0)
241 return 0;
242 return 1;
243 }
244 if (BIO_puts(bp, "\n") <= 0)
245 goto err;
246 if (pss_key)
247 indent += 2;
248 if (!BIO_indent(bp, indent, 128))
249 goto err;
250 if (BIO_puts(bp, "Hash Algorithm: ") <= 0)
251 goto err;
252
253 if (pss->hashAlgorithm) {
254 if (i2a_ASN1_OBJECT(bp, pss->hashAlgorithm->algorithm) <= 0)
255 goto err;
256 } else if (BIO_puts(bp, "sha1 (default)") <= 0) {
257 goto err;
258 }
259
260 if (BIO_puts(bp, "\n") <= 0)
261 goto err;
262
263 if (!BIO_indent(bp, indent, 128))
264 goto err;
265
266 if (BIO_puts(bp, "Mask Algorithm: ") <= 0)
267 goto err;
268 if (pss->maskGenAlgorithm) {
269 if (i2a_ASN1_OBJECT(bp, pss->maskGenAlgorithm->algorithm) <= 0)
270 goto err;
271 if (BIO_puts(bp, " with ") <= 0)
272 goto err;
273 maskHash = rsa_mgf1_decode(pss->maskGenAlgorithm);
274 if (maskHash != NULL) {
275 if (i2a_ASN1_OBJECT(bp, maskHash->algorithm) <= 0)
276 goto err;
277 } else if (BIO_puts(bp, "INVALID") <= 0) {
278 goto err;
279 }
280 } else if (BIO_puts(bp, "mgf1 with sha1 (default)") <= 0) {
281 goto err;
282 }
283 BIO_puts(bp, "\n");
284
285 if (!BIO_indent(bp, indent, 128))
286 goto err;
287 if (BIO_printf(bp, "%s Salt Length: 0x", pss_key ? "Minimum" : "") <= 0)
288 goto err;
289 if (pss->saltLength) {
290 if (i2a_ASN1_INTEGER(bp, pss->saltLength) <= 0)
291 goto err;
292 } else if (BIO_puts(bp, "14 (default)") <= 0) {
293 goto err;
294 }
295 BIO_puts(bp, "\n");
296
297 if (!BIO_indent(bp, indent, 128))
298 goto err;
299 if (BIO_puts(bp, "Trailer Field: 0x") <= 0)
300 goto err;
301 if (pss->trailerField) {
302 if (i2a_ASN1_INTEGER(bp, pss->trailerField) <= 0)
303 goto err;
304 } else if (BIO_puts(bp, "BC (default)") <= 0) {
305 goto err;
306 }
307 BIO_puts(bp, "\n");
308
309 rv = 1;
310
311 err:
312 X509_ALGOR_free(maskHash);
313 return rv;
314
315 }
316
pkey_rsa_print(BIO * bp,const EVP_PKEY * pkey,int off,int priv)317 static int pkey_rsa_print(BIO *bp, const EVP_PKEY *pkey, int off, int priv)
318 {
319 const RSA *x = pkey->pkey.rsa;
320 char *str;
321 const char *s;
322 int ret = 0, mod_len = 0, ex_primes;
323
324 if (x->n != NULL)
325 mod_len = BN_num_bits(x->n);
326 ex_primes = sk_RSA_PRIME_INFO_num(x->prime_infos);
327
328 if (!BIO_indent(bp, off, 128))
329 goto err;
330
331 if (BIO_printf(bp, "%s ", pkey_is_pss(pkey) ? "RSA-PSS" : "RSA") <= 0)
332 goto err;
333
334 if (priv && x->d) {
335 if (BIO_printf(bp, "Private-Key: (%d bit, %d primes)\n",
336 mod_len, ex_primes <= 0 ? 2 : ex_primes + 2) <= 0)
337 goto err;
338 str = "modulus:";
339 s = "publicExponent:";
340 } else {
341 if (BIO_printf(bp, "Public-Key: (%d bit)\n", mod_len) <= 0)
342 goto err;
343 str = "Modulus:";
344 s = "Exponent:";
345 }
346 if (!ASN1_bn_print(bp, str, x->n, NULL, off))
347 goto err;
348 if (!ASN1_bn_print(bp, s, x->e, NULL, off))
349 goto err;
350 if (priv) {
351 int i;
352
353 if (!ASN1_bn_print(bp, "privateExponent:", x->d, NULL, off))
354 goto err;
355 if (!ASN1_bn_print(bp, "prime1:", x->p, NULL, off))
356 goto err;
357 if (!ASN1_bn_print(bp, "prime2:", x->q, NULL, off))
358 goto err;
359 if (!ASN1_bn_print(bp, "exponent1:", x->dmp1, NULL, off))
360 goto err;
361 if (!ASN1_bn_print(bp, "exponent2:", x->dmq1, NULL, off))
362 goto err;
363 if (!ASN1_bn_print(bp, "coefficient:", x->iqmp, NULL, off))
364 goto err;
365 for (i = 0; i < sk_RSA_PRIME_INFO_num(x->prime_infos); i++) {
366 /* print multi-prime info */
367 BIGNUM *bn = NULL;
368 RSA_PRIME_INFO *pinfo;
369 int j;
370
371 pinfo = sk_RSA_PRIME_INFO_value(x->prime_infos, i);
372 for (j = 0; j < 3; j++) {
373 if (!BIO_indent(bp, off, 128))
374 goto err;
375 switch (j) {
376 case 0:
377 if (BIO_printf(bp, "prime%d:", i + 3) <= 0)
378 goto err;
379 bn = pinfo->r;
380 break;
381 case 1:
382 if (BIO_printf(bp, "exponent%d:", i + 3) <= 0)
383 goto err;
384 bn = pinfo->d;
385 break;
386 case 2:
387 if (BIO_printf(bp, "coefficient%d:", i + 3) <= 0)
388 goto err;
389 bn = pinfo->t;
390 break;
391 default:
392 break;
393 }
394 if (!ASN1_bn_print(bp, "", bn, NULL, off))
395 goto err;
396 }
397 }
398 }
399 if (pkey_is_pss(pkey) && !rsa_pss_param_print(bp, 1, x->pss, off))
400 goto err;
401 ret = 1;
402 err:
403 return ret;
404 }
405
rsa_pub_print(BIO * bp,const EVP_PKEY * pkey,int indent,ASN1_PCTX * ctx)406 static int rsa_pub_print(BIO *bp, const EVP_PKEY *pkey, int indent,
407 ASN1_PCTX *ctx)
408 {
409 return pkey_rsa_print(bp, pkey, indent, 0);
410 }
411
rsa_priv_print(BIO * bp,const EVP_PKEY * pkey,int indent,ASN1_PCTX * ctx)412 static int rsa_priv_print(BIO *bp, const EVP_PKEY *pkey, int indent,
413 ASN1_PCTX *ctx)
414 {
415 return pkey_rsa_print(bp, pkey, indent, 1);
416 }
417
rsa_pss_decode(const X509_ALGOR * alg)418 static RSA_PSS_PARAMS *rsa_pss_decode(const X509_ALGOR *alg)
419 {
420 RSA_PSS_PARAMS *pss;
421
422 pss = ASN1_TYPE_unpack_sequence(ASN1_ITEM_rptr(RSA_PSS_PARAMS),
423 alg->parameter);
424
425 if (pss == NULL)
426 return NULL;
427
428 if (pss->maskGenAlgorithm != NULL) {
429 pss->maskHash = rsa_mgf1_decode(pss->maskGenAlgorithm);
430 if (pss->maskHash == NULL) {
431 RSA_PSS_PARAMS_free(pss);
432 return NULL;
433 }
434 }
435
436 return pss;
437 }
438
rsa_sig_print(BIO * bp,const X509_ALGOR * sigalg,const ASN1_STRING * sig,int indent,ASN1_PCTX * pctx)439 static int rsa_sig_print(BIO *bp, const X509_ALGOR *sigalg,
440 const ASN1_STRING *sig, int indent, ASN1_PCTX *pctx)
441 {
442 if (OBJ_obj2nid(sigalg->algorithm) == EVP_PKEY_RSA_PSS) {
443 int rv;
444 RSA_PSS_PARAMS *pss = rsa_pss_decode(sigalg);
445
446 rv = rsa_pss_param_print(bp, 0, pss, indent);
447 RSA_PSS_PARAMS_free(pss);
448 if (!rv)
449 return 0;
450 } else if (!sig && BIO_puts(bp, "\n") <= 0) {
451 return 0;
452 }
453 if (sig)
454 return X509_signature_dump(bp, sig, indent);
455 return 1;
456 }
457
rsa_pkey_ctrl(EVP_PKEY * pkey,int op,long arg1,void * arg2)458 static int rsa_pkey_ctrl(EVP_PKEY *pkey, int op, long arg1, void *arg2)
459 {
460 X509_ALGOR *alg = NULL;
461
462 switch (op) {
463
464 case ASN1_PKEY_CTRL_PKCS7_SIGN:
465 if (arg1 == 0)
466 PKCS7_SIGNER_INFO_get0_algs(arg2, NULL, NULL, &alg);
467 break;
468
469 case ASN1_PKEY_CTRL_PKCS7_ENCRYPT:
470 if (pkey_is_pss(pkey))
471 return -2;
472 if (arg1 == 0)
473 PKCS7_RECIP_INFO_get0_alg(arg2, &alg);
474 break;
475 #ifndef OPENSSL_NO_CMS
476 case ASN1_PKEY_CTRL_CMS_SIGN:
477 if (arg1 == 0)
478 return rsa_cms_sign(arg2);
479 else if (arg1 == 1)
480 return rsa_cms_verify(arg2);
481 break;
482
483 case ASN1_PKEY_CTRL_CMS_ENVELOPE:
484 if (pkey_is_pss(pkey))
485 return -2;
486 if (arg1 == 0)
487 return rsa_cms_encrypt(arg2);
488 else if (arg1 == 1)
489 return rsa_cms_decrypt(arg2);
490 break;
491
492 case ASN1_PKEY_CTRL_CMS_RI_TYPE:
493 if (pkey_is_pss(pkey))
494 return -2;
495 *(int *)arg2 = CMS_RECIPINFO_TRANS;
496 return 1;
497 #endif
498
499 case ASN1_PKEY_CTRL_DEFAULT_MD_NID:
500 *(int *)arg2 = NID_sha256;
501 return 1;
502
503 default:
504 return -2;
505
506 }
507
508 if (alg)
509 X509_ALGOR_set0(alg, OBJ_nid2obj(NID_rsaEncryption), V_ASN1_NULL, 0);
510
511 return 1;
512
513 }
514
515 /* allocate and set algorithm ID from EVP_MD, default SHA1 */
rsa_md_to_algor(X509_ALGOR ** palg,const EVP_MD * md)516 static int rsa_md_to_algor(X509_ALGOR **palg, const EVP_MD *md)
517 {
518 if (md == NULL || EVP_MD_type(md) == NID_sha1)
519 return 1;
520 *palg = X509_ALGOR_new();
521 if (*palg == NULL)
522 return 0;
523 X509_ALGOR_set_md(*palg, md);
524 return 1;
525 }
526
527 /* Allocate and set MGF1 algorithm ID from EVP_MD */
rsa_md_to_mgf1(X509_ALGOR ** palg,const EVP_MD * mgf1md)528 static int rsa_md_to_mgf1(X509_ALGOR **palg, const EVP_MD *mgf1md)
529 {
530 X509_ALGOR *algtmp = NULL;
531 ASN1_STRING *stmp = NULL;
532
533 *palg = NULL;
534 if (mgf1md == NULL || EVP_MD_type(mgf1md) == NID_sha1)
535 return 1;
536 /* need to embed algorithm ID inside another */
537 if (!rsa_md_to_algor(&algtmp, mgf1md))
538 goto err;
539 if (ASN1_item_pack(algtmp, ASN1_ITEM_rptr(X509_ALGOR), &stmp) == NULL)
540 goto err;
541 *palg = X509_ALGOR_new();
542 if (*palg == NULL)
543 goto err;
544 X509_ALGOR_set0(*palg, OBJ_nid2obj(NID_mgf1), V_ASN1_SEQUENCE, stmp);
545 stmp = NULL;
546 err:
547 ASN1_STRING_free(stmp);
548 X509_ALGOR_free(algtmp);
549 if (*palg)
550 return 1;
551 return 0;
552 }
553
554 /* convert algorithm ID to EVP_MD, default SHA1 */
rsa_algor_to_md(X509_ALGOR * alg)555 static const EVP_MD *rsa_algor_to_md(X509_ALGOR *alg)
556 {
557 const EVP_MD *md;
558
559 if (!alg)
560 return EVP_sha1();
561 md = EVP_get_digestbyobj(alg->algorithm);
562 if (md == NULL)
563 RSAerr(RSA_F_RSA_ALGOR_TO_MD, RSA_R_UNKNOWN_DIGEST);
564 return md;
565 }
566
567 /*
568 * Convert EVP_PKEY_CTX in PSS mode into corresponding algorithm parameter,
569 * suitable for setting an AlgorithmIdentifier.
570 */
571
rsa_ctx_to_pss(EVP_PKEY_CTX * pkctx)572 static RSA_PSS_PARAMS *rsa_ctx_to_pss(EVP_PKEY_CTX *pkctx)
573 {
574 const EVP_MD *sigmd, *mgf1md;
575 EVP_PKEY *pk = EVP_PKEY_CTX_get0_pkey(pkctx);
576 int saltlen;
577
578 if (EVP_PKEY_CTX_get_signature_md(pkctx, &sigmd) <= 0)
579 return NULL;
580 if (EVP_PKEY_CTX_get_rsa_mgf1_md(pkctx, &mgf1md) <= 0)
581 return NULL;
582 if (!EVP_PKEY_CTX_get_rsa_pss_saltlen(pkctx, &saltlen))
583 return NULL;
584 if (saltlen == -1) {
585 saltlen = EVP_MD_size(sigmd);
586 } else if (saltlen == -2) {
587 saltlen = EVP_PKEY_size(pk) - EVP_MD_size(sigmd) - 2;
588 if ((EVP_PKEY_bits(pk) & 0x7) == 1)
589 saltlen--;
590 }
591
592 return rsa_pss_params_create(sigmd, mgf1md, saltlen);
593 }
594
rsa_pss_params_create(const EVP_MD * sigmd,const EVP_MD * mgf1md,int saltlen)595 RSA_PSS_PARAMS *rsa_pss_params_create(const EVP_MD *sigmd,
596 const EVP_MD *mgf1md, int saltlen)
597 {
598 RSA_PSS_PARAMS *pss = RSA_PSS_PARAMS_new();
599
600 if (pss == NULL)
601 goto err;
602 if (saltlen != 20) {
603 pss->saltLength = ASN1_INTEGER_new();
604 if (pss->saltLength == NULL)
605 goto err;
606 if (!ASN1_INTEGER_set(pss->saltLength, saltlen))
607 goto err;
608 }
609 if (!rsa_md_to_algor(&pss->hashAlgorithm, sigmd))
610 goto err;
611 if (mgf1md == NULL)
612 mgf1md = sigmd;
613 if (!rsa_md_to_mgf1(&pss->maskGenAlgorithm, mgf1md))
614 goto err;
615 if (!rsa_md_to_algor(&pss->maskHash, mgf1md))
616 goto err;
617 return pss;
618 err:
619 RSA_PSS_PARAMS_free(pss);
620 return NULL;
621 }
622
rsa_ctx_to_pss_string(EVP_PKEY_CTX * pkctx)623 static ASN1_STRING *rsa_ctx_to_pss_string(EVP_PKEY_CTX *pkctx)
624 {
625 RSA_PSS_PARAMS *pss = rsa_ctx_to_pss(pkctx);
626 ASN1_STRING *os;
627
628 if (pss == NULL)
629 return NULL;
630
631 os = ASN1_item_pack(pss, ASN1_ITEM_rptr(RSA_PSS_PARAMS), NULL);
632 RSA_PSS_PARAMS_free(pss);
633 return os;
634 }
635
636 /*
637 * From PSS AlgorithmIdentifier set public key parameters. If pkey isn't NULL
638 * then the EVP_MD_CTX is setup and initialised. If it is NULL parameters are
639 * passed to pkctx instead.
640 */
641
rsa_pss_to_ctx(EVP_MD_CTX * ctx,EVP_PKEY_CTX * pkctx,X509_ALGOR * sigalg,EVP_PKEY * pkey)642 static int rsa_pss_to_ctx(EVP_MD_CTX *ctx, EVP_PKEY_CTX *pkctx,
643 X509_ALGOR *sigalg, EVP_PKEY *pkey)
644 {
645 int rv = -1;
646 int saltlen;
647 const EVP_MD *mgf1md = NULL, *md = NULL;
648 RSA_PSS_PARAMS *pss;
649
650 /* Sanity check: make sure it is PSS */
651 if (OBJ_obj2nid(sigalg->algorithm) != EVP_PKEY_RSA_PSS) {
652 RSAerr(RSA_F_RSA_PSS_TO_CTX, RSA_R_UNSUPPORTED_SIGNATURE_TYPE);
653 return -1;
654 }
655 /* Decode PSS parameters */
656 pss = rsa_pss_decode(sigalg);
657
658 if (!rsa_pss_get_param(pss, &md, &mgf1md, &saltlen)) {
659 RSAerr(RSA_F_RSA_PSS_TO_CTX, RSA_R_INVALID_PSS_PARAMETERS);
660 goto err;
661 }
662
663 /* We have all parameters now set up context */
664 if (pkey) {
665 if (!EVP_DigestVerifyInit(ctx, &pkctx, md, NULL, pkey))
666 goto err;
667 } else {
668 const EVP_MD *checkmd;
669 if (EVP_PKEY_CTX_get_signature_md(pkctx, &checkmd) <= 0)
670 goto err;
671 if (EVP_MD_type(md) != EVP_MD_type(checkmd)) {
672 RSAerr(RSA_F_RSA_PSS_TO_CTX, RSA_R_DIGEST_DOES_NOT_MATCH);
673 goto err;
674 }
675 }
676
677 if (EVP_PKEY_CTX_set_rsa_padding(pkctx, RSA_PKCS1_PSS_PADDING) <= 0)
678 goto err;
679
680 if (EVP_PKEY_CTX_set_rsa_pss_saltlen(pkctx, saltlen) <= 0)
681 goto err;
682
683 if (EVP_PKEY_CTX_set_rsa_mgf1_md(pkctx, mgf1md) <= 0)
684 goto err;
685 /* Carry on */
686 rv = 1;
687
688 err:
689 RSA_PSS_PARAMS_free(pss);
690 return rv;
691 }
692
rsa_pss_get_param(const RSA_PSS_PARAMS * pss,const EVP_MD ** pmd,const EVP_MD ** pmgf1md,int * psaltlen)693 int rsa_pss_get_param(const RSA_PSS_PARAMS *pss, const EVP_MD **pmd,
694 const EVP_MD **pmgf1md, int *psaltlen)
695 {
696 if (pss == NULL)
697 return 0;
698 *pmd = rsa_algor_to_md(pss->hashAlgorithm);
699 if (*pmd == NULL)
700 return 0;
701 *pmgf1md = rsa_algor_to_md(pss->maskHash);
702 if (*pmgf1md == NULL)
703 return 0;
704 if (pss->saltLength) {
705 *psaltlen = ASN1_INTEGER_get(pss->saltLength);
706 if (*psaltlen < 0) {
707 RSAerr(RSA_F_RSA_PSS_GET_PARAM, RSA_R_INVALID_SALT_LENGTH);
708 return 0;
709 }
710 } else {
711 *psaltlen = 20;
712 }
713
714 /*
715 * low-level routines support only trailer field 0xbc (value 1) and
716 * PKCS#1 says we should reject any other value anyway.
717 */
718 if (pss->trailerField && ASN1_INTEGER_get(pss->trailerField) != 1) {
719 RSAerr(RSA_F_RSA_PSS_GET_PARAM, RSA_R_INVALID_TRAILER);
720 return 0;
721 }
722
723 return 1;
724 }
725
726 #ifndef OPENSSL_NO_CMS
rsa_cms_verify(CMS_SignerInfo * si)727 static int rsa_cms_verify(CMS_SignerInfo *si)
728 {
729 int nid, nid2;
730 X509_ALGOR *alg;
731 EVP_PKEY_CTX *pkctx = CMS_SignerInfo_get0_pkey_ctx(si);
732
733 CMS_SignerInfo_get0_algs(si, NULL, NULL, NULL, &alg);
734 nid = OBJ_obj2nid(alg->algorithm);
735 if (nid == EVP_PKEY_RSA_PSS)
736 return rsa_pss_to_ctx(NULL, pkctx, alg, NULL);
737 /* Only PSS allowed for PSS keys */
738 if (pkey_ctx_is_pss(pkctx)) {
739 RSAerr(RSA_F_RSA_CMS_VERIFY, RSA_R_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE);
740 return 0;
741 }
742 if (nid == NID_rsaEncryption)
743 return 1;
744 /* Workaround for some implementation that use a signature OID */
745 if (OBJ_find_sigid_algs(nid, NULL, &nid2)) {
746 if (nid2 == NID_rsaEncryption)
747 return 1;
748 }
749 return 0;
750 }
751 #endif
752
753 /*
754 * Customised RSA item verification routine. This is called when a signature
755 * is encountered requiring special handling. We currently only handle PSS.
756 */
757
rsa_item_verify(EVP_MD_CTX * ctx,const ASN1_ITEM * it,void * asn,X509_ALGOR * sigalg,ASN1_BIT_STRING * sig,EVP_PKEY * pkey)758 static int rsa_item_verify(EVP_MD_CTX *ctx, const ASN1_ITEM *it, void *asn,
759 X509_ALGOR *sigalg, ASN1_BIT_STRING *sig,
760 EVP_PKEY *pkey)
761 {
762 /* Sanity check: make sure it is PSS */
763 if (OBJ_obj2nid(sigalg->algorithm) != EVP_PKEY_RSA_PSS) {
764 RSAerr(RSA_F_RSA_ITEM_VERIFY, RSA_R_UNSUPPORTED_SIGNATURE_TYPE);
765 return -1;
766 }
767 if (rsa_pss_to_ctx(ctx, NULL, sigalg, pkey) > 0) {
768 /* Carry on */
769 return 2;
770 }
771 return -1;
772 }
773
774 #ifndef OPENSSL_NO_CMS
rsa_cms_sign(CMS_SignerInfo * si)775 static int rsa_cms_sign(CMS_SignerInfo *si)
776 {
777 int pad_mode = RSA_PKCS1_PADDING;
778 X509_ALGOR *alg;
779 EVP_PKEY_CTX *pkctx = CMS_SignerInfo_get0_pkey_ctx(si);
780 ASN1_STRING *os = NULL;
781
782 CMS_SignerInfo_get0_algs(si, NULL, NULL, NULL, &alg);
783 if (pkctx) {
784 if (EVP_PKEY_CTX_get_rsa_padding(pkctx, &pad_mode) <= 0)
785 return 0;
786 }
787 if (pad_mode == RSA_PKCS1_PADDING) {
788 X509_ALGOR_set0(alg, OBJ_nid2obj(NID_rsaEncryption), V_ASN1_NULL, 0);
789 return 1;
790 }
791 /* We don't support it */
792 if (pad_mode != RSA_PKCS1_PSS_PADDING)
793 return 0;
794 os = rsa_ctx_to_pss_string(pkctx);
795 if (!os)
796 return 0;
797 X509_ALGOR_set0(alg, OBJ_nid2obj(EVP_PKEY_RSA_PSS), V_ASN1_SEQUENCE, os);
798 return 1;
799 }
800 #endif
801
rsa_item_sign(EVP_MD_CTX * ctx,const ASN1_ITEM * it,void * asn,X509_ALGOR * alg1,X509_ALGOR * alg2,ASN1_BIT_STRING * sig)802 static int rsa_item_sign(EVP_MD_CTX *ctx, const ASN1_ITEM *it, void *asn,
803 X509_ALGOR *alg1, X509_ALGOR *alg2,
804 ASN1_BIT_STRING *sig)
805 {
806 int pad_mode;
807 EVP_PKEY_CTX *pkctx = EVP_MD_CTX_pkey_ctx(ctx);
808
809 if (EVP_PKEY_CTX_get_rsa_padding(pkctx, &pad_mode) <= 0)
810 return 0;
811 if (pad_mode == RSA_PKCS1_PADDING)
812 return 2;
813 if (pad_mode == RSA_PKCS1_PSS_PADDING) {
814 ASN1_STRING *os1 = NULL;
815 os1 = rsa_ctx_to_pss_string(pkctx);
816 if (!os1)
817 return 0;
818 /* Duplicate parameters if we have to */
819 if (alg2) {
820 ASN1_STRING *os2 = ASN1_STRING_dup(os1);
821 if (!os2) {
822 ASN1_STRING_free(os1);
823 return 0;
824 }
825 X509_ALGOR_set0(alg2, OBJ_nid2obj(EVP_PKEY_RSA_PSS),
826 V_ASN1_SEQUENCE, os2);
827 }
828 X509_ALGOR_set0(alg1, OBJ_nid2obj(EVP_PKEY_RSA_PSS),
829 V_ASN1_SEQUENCE, os1);
830 return 3;
831 }
832 return 2;
833 }
834
rsa_sig_info_set(X509_SIG_INFO * siginf,const X509_ALGOR * sigalg,const ASN1_STRING * sig)835 static int rsa_sig_info_set(X509_SIG_INFO *siginf, const X509_ALGOR *sigalg,
836 const ASN1_STRING *sig)
837 {
838 int rv = 0;
839 int mdnid, saltlen;
840 uint32_t flags;
841 const EVP_MD *mgf1md = NULL, *md = NULL;
842 RSA_PSS_PARAMS *pss;
843
844 /* Sanity check: make sure it is PSS */
845 if (OBJ_obj2nid(sigalg->algorithm) != EVP_PKEY_RSA_PSS)
846 return 0;
847 /* Decode PSS parameters */
848 pss = rsa_pss_decode(sigalg);
849 if (!rsa_pss_get_param(pss, &md, &mgf1md, &saltlen))
850 goto err;
851 mdnid = EVP_MD_type(md);
852 /*
853 * For TLS need SHA256, SHA384 or SHA512, digest and MGF1 digest must
854 * match and salt length must equal digest size
855 */
856 if ((mdnid == NID_sha256 || mdnid == NID_sha384 || mdnid == NID_sha512)
857 && mdnid == EVP_MD_type(mgf1md) && saltlen == EVP_MD_size(md))
858 flags = X509_SIG_INFO_TLS;
859 else
860 flags = 0;
861 /* Note: security bits half number of digest bits */
862 X509_SIG_INFO_set(siginf, mdnid, EVP_PKEY_RSA_PSS, EVP_MD_size(md) * 4,
863 flags);
864 rv = 1;
865 err:
866 RSA_PSS_PARAMS_free(pss);
867 return rv;
868 }
869
870 #ifndef OPENSSL_NO_CMS
rsa_oaep_decode(const X509_ALGOR * alg)871 static RSA_OAEP_PARAMS *rsa_oaep_decode(const X509_ALGOR *alg)
872 {
873 RSA_OAEP_PARAMS *oaep;
874
875 oaep = ASN1_TYPE_unpack_sequence(ASN1_ITEM_rptr(RSA_OAEP_PARAMS),
876 alg->parameter);
877
878 if (oaep == NULL)
879 return NULL;
880
881 if (oaep->maskGenFunc != NULL) {
882 oaep->maskHash = rsa_mgf1_decode(oaep->maskGenFunc);
883 if (oaep->maskHash == NULL) {
884 RSA_OAEP_PARAMS_free(oaep);
885 return NULL;
886 }
887 }
888 return oaep;
889 }
890
rsa_cms_decrypt(CMS_RecipientInfo * ri)891 static int rsa_cms_decrypt(CMS_RecipientInfo *ri)
892 {
893 EVP_PKEY_CTX *pkctx;
894 X509_ALGOR *cmsalg;
895 int nid;
896 int rv = -1;
897 unsigned char *label = NULL;
898 int labellen = 0;
899 const EVP_MD *mgf1md = NULL, *md = NULL;
900 RSA_OAEP_PARAMS *oaep;
901
902 pkctx = CMS_RecipientInfo_get0_pkey_ctx(ri);
903 if (pkctx == NULL)
904 return 0;
905 if (!CMS_RecipientInfo_ktri_get0_algs(ri, NULL, NULL, &cmsalg))
906 return -1;
907 nid = OBJ_obj2nid(cmsalg->algorithm);
908 if (nid == NID_rsaEncryption)
909 return 1;
910 if (nid != NID_rsaesOaep) {
911 RSAerr(RSA_F_RSA_CMS_DECRYPT, RSA_R_UNSUPPORTED_ENCRYPTION_TYPE);
912 return -1;
913 }
914 /* Decode OAEP parameters */
915 oaep = rsa_oaep_decode(cmsalg);
916
917 if (oaep == NULL) {
918 RSAerr(RSA_F_RSA_CMS_DECRYPT, RSA_R_INVALID_OAEP_PARAMETERS);
919 goto err;
920 }
921
922 mgf1md = rsa_algor_to_md(oaep->maskHash);
923 if (mgf1md == NULL)
924 goto err;
925 md = rsa_algor_to_md(oaep->hashFunc);
926 if (md == NULL)
927 goto err;
928
929 if (oaep->pSourceFunc != NULL) {
930 X509_ALGOR *plab = oaep->pSourceFunc;
931
932 if (OBJ_obj2nid(plab->algorithm) != NID_pSpecified) {
933 RSAerr(RSA_F_RSA_CMS_DECRYPT, RSA_R_UNSUPPORTED_LABEL_SOURCE);
934 goto err;
935 }
936 if (plab->parameter->type != V_ASN1_OCTET_STRING) {
937 RSAerr(RSA_F_RSA_CMS_DECRYPT, RSA_R_INVALID_LABEL);
938 goto err;
939 }
940
941 label = plab->parameter->value.octet_string->data;
942 /* Stop label being freed when OAEP parameters are freed */
943 plab->parameter->value.octet_string->data = NULL;
944 labellen = plab->parameter->value.octet_string->length;
945 }
946
947 if (EVP_PKEY_CTX_set_rsa_padding(pkctx, RSA_PKCS1_OAEP_PADDING) <= 0)
948 goto err;
949 if (EVP_PKEY_CTX_set_rsa_oaep_md(pkctx, md) <= 0)
950 goto err;
951 if (EVP_PKEY_CTX_set_rsa_mgf1_md(pkctx, mgf1md) <= 0)
952 goto err;
953 if (EVP_PKEY_CTX_set0_rsa_oaep_label(pkctx, label, labellen) <= 0)
954 goto err;
955 /* Carry on */
956 rv = 1;
957
958 err:
959 RSA_OAEP_PARAMS_free(oaep);
960 return rv;
961 }
962
rsa_cms_encrypt(CMS_RecipientInfo * ri)963 static int rsa_cms_encrypt(CMS_RecipientInfo *ri)
964 {
965 const EVP_MD *md, *mgf1md;
966 RSA_OAEP_PARAMS *oaep = NULL;
967 ASN1_STRING *os = NULL;
968 X509_ALGOR *alg;
969 EVP_PKEY_CTX *pkctx = CMS_RecipientInfo_get0_pkey_ctx(ri);
970 int pad_mode = RSA_PKCS1_PADDING, rv = 0, labellen;
971 unsigned char *label;
972
973 if (CMS_RecipientInfo_ktri_get0_algs(ri, NULL, NULL, &alg) <= 0)
974 return 0;
975 if (pkctx) {
976 if (EVP_PKEY_CTX_get_rsa_padding(pkctx, &pad_mode) <= 0)
977 return 0;
978 }
979 if (pad_mode == RSA_PKCS1_PADDING) {
980 X509_ALGOR_set0(alg, OBJ_nid2obj(NID_rsaEncryption), V_ASN1_NULL, 0);
981 return 1;
982 }
983 /* Not supported */
984 if (pad_mode != RSA_PKCS1_OAEP_PADDING)
985 return 0;
986 if (EVP_PKEY_CTX_get_rsa_oaep_md(pkctx, &md) <= 0)
987 goto err;
988 if (EVP_PKEY_CTX_get_rsa_mgf1_md(pkctx, &mgf1md) <= 0)
989 goto err;
990 labellen = EVP_PKEY_CTX_get0_rsa_oaep_label(pkctx, &label);
991 if (labellen < 0)
992 goto err;
993 oaep = RSA_OAEP_PARAMS_new();
994 if (oaep == NULL)
995 goto err;
996 if (!rsa_md_to_algor(&oaep->hashFunc, md))
997 goto err;
998 if (!rsa_md_to_mgf1(&oaep->maskGenFunc, mgf1md))
999 goto err;
1000 if (labellen > 0) {
1001 ASN1_OCTET_STRING *los;
1002 oaep->pSourceFunc = X509_ALGOR_new();
1003 if (oaep->pSourceFunc == NULL)
1004 goto err;
1005 los = ASN1_OCTET_STRING_new();
1006 if (los == NULL)
1007 goto err;
1008 if (!ASN1_OCTET_STRING_set(los, label, labellen)) {
1009 ASN1_OCTET_STRING_free(los);
1010 goto err;
1011 }
1012 X509_ALGOR_set0(oaep->pSourceFunc, OBJ_nid2obj(NID_pSpecified),
1013 V_ASN1_OCTET_STRING, los);
1014 }
1015 /* create string with pss parameter encoding. */
1016 if (!ASN1_item_pack(oaep, ASN1_ITEM_rptr(RSA_OAEP_PARAMS), &os))
1017 goto err;
1018 X509_ALGOR_set0(alg, OBJ_nid2obj(NID_rsaesOaep), V_ASN1_SEQUENCE, os);
1019 os = NULL;
1020 rv = 1;
1021 err:
1022 RSA_OAEP_PARAMS_free(oaep);
1023 ASN1_STRING_free(os);
1024 return rv;
1025 }
1026 #endif
1027
rsa_pkey_check(const EVP_PKEY * pkey)1028 static int rsa_pkey_check(const EVP_PKEY *pkey)
1029 {
1030 return RSA_check_key_ex(pkey->pkey.rsa, NULL);
1031 }
1032
1033 const EVP_PKEY_ASN1_METHOD rsa_asn1_meths[2] = {
1034 {
1035 EVP_PKEY_RSA,
1036 EVP_PKEY_RSA,
1037 ASN1_PKEY_SIGPARAM_NULL,
1038
1039 "RSA",
1040 "OpenSSL RSA method",
1041
1042 rsa_pub_decode,
1043 rsa_pub_encode,
1044 rsa_pub_cmp,
1045 rsa_pub_print,
1046
1047 rsa_priv_decode,
1048 rsa_priv_encode,
1049 rsa_priv_print,
1050
1051 int_rsa_size,
1052 rsa_bits,
1053 rsa_security_bits,
1054
1055 0, 0, 0, 0, 0, 0,
1056
1057 rsa_sig_print,
1058 int_rsa_free,
1059 rsa_pkey_ctrl,
1060 old_rsa_priv_decode,
1061 old_rsa_priv_encode,
1062 rsa_item_verify,
1063 rsa_item_sign,
1064 rsa_sig_info_set,
1065 rsa_pkey_check
1066 },
1067
1068 {
1069 EVP_PKEY_RSA2,
1070 EVP_PKEY_RSA,
1071 ASN1_PKEY_ALIAS}
1072 };
1073
1074 const EVP_PKEY_ASN1_METHOD rsa_pss_asn1_meth = {
1075 EVP_PKEY_RSA_PSS,
1076 EVP_PKEY_RSA_PSS,
1077 ASN1_PKEY_SIGPARAM_NULL,
1078
1079 "RSA-PSS",
1080 "OpenSSL RSA-PSS method",
1081
1082 rsa_pub_decode,
1083 rsa_pub_encode,
1084 rsa_pub_cmp,
1085 rsa_pub_print,
1086
1087 rsa_priv_decode,
1088 rsa_priv_encode,
1089 rsa_priv_print,
1090
1091 int_rsa_size,
1092 rsa_bits,
1093 rsa_security_bits,
1094
1095 0, 0, 0, 0, 0, 0,
1096
1097 rsa_sig_print,
1098 int_rsa_free,
1099 rsa_pkey_ctrl,
1100 0, 0,
1101 rsa_item_verify,
1102 rsa_item_sign,
1103 0,
1104 rsa_pkey_check
1105 };
1106