1*de0e0e4dSAntonio Huete Jimenez /* $OpenBSD: rsa_crpt.c,v 1.20 2022/01/07 09:55:32 tb Exp $ */
2f5b1c8a1SJohn Marino /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3f5b1c8a1SJohn Marino * All rights reserved.
4f5b1c8a1SJohn Marino *
5f5b1c8a1SJohn Marino * This package is an SSL implementation written
6f5b1c8a1SJohn Marino * by Eric Young (eay@cryptsoft.com).
7f5b1c8a1SJohn Marino * The implementation was written so as to conform with Netscapes SSL.
8f5b1c8a1SJohn Marino *
9f5b1c8a1SJohn Marino * This library is free for commercial and non-commercial use as long as
10f5b1c8a1SJohn Marino * the following conditions are aheared to. The following conditions
11f5b1c8a1SJohn Marino * apply to all code found in this distribution, be it the RC4, RSA,
12f5b1c8a1SJohn Marino * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13f5b1c8a1SJohn Marino * included with this distribution is covered by the same copyright terms
14f5b1c8a1SJohn Marino * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15f5b1c8a1SJohn Marino *
16f5b1c8a1SJohn Marino * Copyright remains Eric Young's, and as such any Copyright notices in
17f5b1c8a1SJohn Marino * the code are not to be removed.
18f5b1c8a1SJohn Marino * If this package is used in a product, Eric Young should be given attribution
19f5b1c8a1SJohn Marino * as the author of the parts of the library used.
20f5b1c8a1SJohn Marino * This can be in the form of a textual message at program startup or
21f5b1c8a1SJohn Marino * in documentation (online or textual) provided with the package.
22f5b1c8a1SJohn Marino *
23f5b1c8a1SJohn Marino * Redistribution and use in source and binary forms, with or without
24f5b1c8a1SJohn Marino * modification, are permitted provided that the following conditions
25f5b1c8a1SJohn Marino * are met:
26f5b1c8a1SJohn Marino * 1. Redistributions of source code must retain the copyright
27f5b1c8a1SJohn Marino * notice, this list of conditions and the following disclaimer.
28f5b1c8a1SJohn Marino * 2. Redistributions in binary form must reproduce the above copyright
29f5b1c8a1SJohn Marino * notice, this list of conditions and the following disclaimer in the
30f5b1c8a1SJohn Marino * documentation and/or other materials provided with the distribution.
31f5b1c8a1SJohn Marino * 3. All advertising materials mentioning features or use of this software
32f5b1c8a1SJohn Marino * must display the following acknowledgement:
33f5b1c8a1SJohn Marino * "This product includes cryptographic software written by
34f5b1c8a1SJohn Marino * Eric Young (eay@cryptsoft.com)"
35f5b1c8a1SJohn Marino * The word 'cryptographic' can be left out if the rouines from the library
36f5b1c8a1SJohn Marino * being used are not cryptographic related :-).
37f5b1c8a1SJohn Marino * 4. If you include any Windows specific code (or a derivative thereof) from
38f5b1c8a1SJohn Marino * the apps directory (application code) you must include an acknowledgement:
39f5b1c8a1SJohn Marino * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40f5b1c8a1SJohn Marino *
41f5b1c8a1SJohn Marino * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42f5b1c8a1SJohn Marino * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43f5b1c8a1SJohn Marino * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44f5b1c8a1SJohn Marino * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45f5b1c8a1SJohn Marino * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46f5b1c8a1SJohn Marino * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47f5b1c8a1SJohn Marino * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48f5b1c8a1SJohn Marino * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49f5b1c8a1SJohn Marino * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50f5b1c8a1SJohn Marino * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51f5b1c8a1SJohn Marino * SUCH DAMAGE.
52f5b1c8a1SJohn Marino *
53f5b1c8a1SJohn Marino * The licence and distribution terms for any publically available version or
54f5b1c8a1SJohn Marino * derivative of this code cannot be changed. i.e. this code cannot simply be
55f5b1c8a1SJohn Marino * copied and put under another distribution licence
56f5b1c8a1SJohn Marino * [including the GNU Public Licence.]
57f5b1c8a1SJohn Marino */
58f5b1c8a1SJohn Marino
59f5b1c8a1SJohn Marino #include <stdio.h>
60f5b1c8a1SJohn Marino
61f5b1c8a1SJohn Marino #include <openssl/opensslconf.h>
62f5b1c8a1SJohn Marino
63f5b1c8a1SJohn Marino #include <openssl/bn.h>
64f5b1c8a1SJohn Marino #include <openssl/crypto.h>
65f5b1c8a1SJohn Marino #include <openssl/err.h>
66f5b1c8a1SJohn Marino #include <openssl/lhash.h>
67f5b1c8a1SJohn Marino #include <openssl/rsa.h>
68f5b1c8a1SJohn Marino
6972c33676SMaxim Ag #include "bn_lcl.h"
70*de0e0e4dSAntonio Huete Jimenez #include "rsa_locl.h"
7172c33676SMaxim Ag
72f5b1c8a1SJohn Marino #ifndef OPENSSL_NO_ENGINE
73f5b1c8a1SJohn Marino #include <openssl/engine.h>
74f5b1c8a1SJohn Marino #endif
75f5b1c8a1SJohn Marino
76f5b1c8a1SJohn Marino int
RSA_bits(const RSA * r)7772c33676SMaxim Ag RSA_bits(const RSA *r)
7872c33676SMaxim Ag {
7972c33676SMaxim Ag return BN_num_bits(r->n);
8072c33676SMaxim Ag }
8172c33676SMaxim Ag
8272c33676SMaxim Ag int
RSA_size(const RSA * r)83f5b1c8a1SJohn Marino RSA_size(const RSA *r)
84f5b1c8a1SJohn Marino {
85f5b1c8a1SJohn Marino return BN_num_bytes(r->n);
86f5b1c8a1SJohn Marino }
87f5b1c8a1SJohn Marino
88f5b1c8a1SJohn Marino int
RSA_public_encrypt(int flen,const unsigned char * from,unsigned char * to,RSA * rsa,int padding)89f5b1c8a1SJohn Marino RSA_public_encrypt(int flen, const unsigned char *from, unsigned char *to,
90f5b1c8a1SJohn Marino RSA *rsa, int padding)
91f5b1c8a1SJohn Marino {
92f5b1c8a1SJohn Marino return rsa->meth->rsa_pub_enc(flen, from, to, rsa, padding);
93f5b1c8a1SJohn Marino }
94f5b1c8a1SJohn Marino
95f5b1c8a1SJohn Marino int
RSA_private_encrypt(int flen,const unsigned char * from,unsigned char * to,RSA * rsa,int padding)96f5b1c8a1SJohn Marino RSA_private_encrypt(int flen, const unsigned char *from, unsigned char *to,
97f5b1c8a1SJohn Marino RSA *rsa, int padding)
98f5b1c8a1SJohn Marino {
99f5b1c8a1SJohn Marino return rsa->meth->rsa_priv_enc(flen, from, to, rsa, padding);
100f5b1c8a1SJohn Marino }
101f5b1c8a1SJohn Marino
102f5b1c8a1SJohn Marino int
RSA_private_decrypt(int flen,const unsigned char * from,unsigned char * to,RSA * rsa,int padding)103f5b1c8a1SJohn Marino RSA_private_decrypt(int flen, const unsigned char *from, unsigned char *to,
104f5b1c8a1SJohn Marino RSA *rsa, int padding)
105f5b1c8a1SJohn Marino {
106f5b1c8a1SJohn Marino return rsa->meth->rsa_priv_dec(flen, from, to, rsa, padding);
107f5b1c8a1SJohn Marino }
108f5b1c8a1SJohn Marino
109f5b1c8a1SJohn Marino int
RSA_public_decrypt(int flen,const unsigned char * from,unsigned char * to,RSA * rsa,int padding)110f5b1c8a1SJohn Marino RSA_public_decrypt(int flen, const unsigned char *from, unsigned char *to,
111f5b1c8a1SJohn Marino RSA *rsa, int padding)
112f5b1c8a1SJohn Marino {
113f5b1c8a1SJohn Marino return rsa->meth->rsa_pub_dec(flen, from, to, rsa, padding);
114f5b1c8a1SJohn Marino }
115f5b1c8a1SJohn Marino
116f5b1c8a1SJohn Marino int
RSA_flags(const RSA * r)117f5b1c8a1SJohn Marino RSA_flags(const RSA *r)
118f5b1c8a1SJohn Marino {
119f5b1c8a1SJohn Marino return r == NULL ? 0 : r->meth->flags;
120f5b1c8a1SJohn Marino }
121f5b1c8a1SJohn Marino
122f5b1c8a1SJohn Marino void
RSA_blinding_off(RSA * rsa)123f5b1c8a1SJohn Marino RSA_blinding_off(RSA *rsa)
124f5b1c8a1SJohn Marino {
125f5b1c8a1SJohn Marino BN_BLINDING_free(rsa->blinding);
126f5b1c8a1SJohn Marino rsa->blinding = NULL;
127f5b1c8a1SJohn Marino rsa->flags |= RSA_FLAG_NO_BLINDING;
128f5b1c8a1SJohn Marino }
129f5b1c8a1SJohn Marino
130f5b1c8a1SJohn Marino int
RSA_blinding_on(RSA * rsa,BN_CTX * ctx)131f5b1c8a1SJohn Marino RSA_blinding_on(RSA *rsa, BN_CTX *ctx)
132f5b1c8a1SJohn Marino {
133f5b1c8a1SJohn Marino int ret = 0;
134f5b1c8a1SJohn Marino
135f5b1c8a1SJohn Marino if (rsa->blinding != NULL)
136f5b1c8a1SJohn Marino RSA_blinding_off(rsa);
137f5b1c8a1SJohn Marino
138f5b1c8a1SJohn Marino rsa->blinding = RSA_setup_blinding(rsa, ctx);
139f5b1c8a1SJohn Marino if (rsa->blinding == NULL)
140f5b1c8a1SJohn Marino goto err;
141f5b1c8a1SJohn Marino
142f5b1c8a1SJohn Marino rsa->flags &= ~RSA_FLAG_NO_BLINDING;
143f5b1c8a1SJohn Marino ret = 1;
144f5b1c8a1SJohn Marino err:
145f5b1c8a1SJohn Marino return (ret);
146f5b1c8a1SJohn Marino }
147f5b1c8a1SJohn Marino
148f5b1c8a1SJohn Marino static BIGNUM *
rsa_get_public_exp(const BIGNUM * d,const BIGNUM * p,const BIGNUM * q,BN_CTX * ctx)149f5b1c8a1SJohn Marino rsa_get_public_exp(const BIGNUM *d, const BIGNUM *p, const BIGNUM *q,
150f5b1c8a1SJohn Marino BN_CTX *ctx)
151f5b1c8a1SJohn Marino {
152f5b1c8a1SJohn Marino BIGNUM *ret = NULL, *r0, *r1, *r2;
153f5b1c8a1SJohn Marino
154f5b1c8a1SJohn Marino if (d == NULL || p == NULL || q == NULL)
155f5b1c8a1SJohn Marino return NULL;
156f5b1c8a1SJohn Marino
157f5b1c8a1SJohn Marino BN_CTX_start(ctx);
158f5b1c8a1SJohn Marino if ((r0 = BN_CTX_get(ctx)) == NULL)
159f5b1c8a1SJohn Marino goto err;
160f5b1c8a1SJohn Marino if ((r1 = BN_CTX_get(ctx)) == NULL)
161f5b1c8a1SJohn Marino goto err;
162f5b1c8a1SJohn Marino if ((r2 = BN_CTX_get(ctx)) == NULL)
163f5b1c8a1SJohn Marino goto err;
164f5b1c8a1SJohn Marino
165f5b1c8a1SJohn Marino if (!BN_sub(r1, p, BN_value_one()))
166f5b1c8a1SJohn Marino goto err;
167f5b1c8a1SJohn Marino if (!BN_sub(r2, q, BN_value_one()))
168f5b1c8a1SJohn Marino goto err;
169f5b1c8a1SJohn Marino if (!BN_mul(r0, r1, r2, ctx))
170f5b1c8a1SJohn Marino goto err;
171f5b1c8a1SJohn Marino
17272c33676SMaxim Ag ret = BN_mod_inverse_ct(NULL, d, r0, ctx);
173f5b1c8a1SJohn Marino err:
174f5b1c8a1SJohn Marino BN_CTX_end(ctx);
175f5b1c8a1SJohn Marino return ret;
176f5b1c8a1SJohn Marino }
177f5b1c8a1SJohn Marino
178f5b1c8a1SJohn Marino BN_BLINDING *
RSA_setup_blinding(RSA * rsa,BN_CTX * in_ctx)179f5b1c8a1SJohn Marino RSA_setup_blinding(RSA *rsa, BN_CTX *in_ctx)
180f5b1c8a1SJohn Marino {
181f5b1c8a1SJohn Marino BIGNUM *e;
182f5b1c8a1SJohn Marino BIGNUM n;
183f5b1c8a1SJohn Marino BN_CTX *ctx;
184f5b1c8a1SJohn Marino BN_BLINDING *ret = NULL;
185f5b1c8a1SJohn Marino
186f5b1c8a1SJohn Marino if (in_ctx == NULL) {
187f5b1c8a1SJohn Marino if ((ctx = BN_CTX_new()) == NULL)
188f5b1c8a1SJohn Marino return 0;
189f5b1c8a1SJohn Marino } else
190f5b1c8a1SJohn Marino ctx = in_ctx;
191f5b1c8a1SJohn Marino
192f5b1c8a1SJohn Marino BN_CTX_start(ctx);
193f5b1c8a1SJohn Marino
194f5b1c8a1SJohn Marino if (rsa->e == NULL) {
195f5b1c8a1SJohn Marino e = rsa_get_public_exp(rsa->d, rsa->p, rsa->q, ctx);
196f5b1c8a1SJohn Marino if (e == NULL) {
19772c33676SMaxim Ag RSAerror(RSA_R_NO_PUBLIC_EXPONENT);
198f5b1c8a1SJohn Marino goto err;
199f5b1c8a1SJohn Marino }
200f5b1c8a1SJohn Marino } else
201f5b1c8a1SJohn Marino e = rsa->e;
202f5b1c8a1SJohn Marino
203f5b1c8a1SJohn Marino BN_init(&n);
204f5b1c8a1SJohn Marino BN_with_flags(&n, rsa->n, BN_FLG_CONSTTIME);
205f5b1c8a1SJohn Marino
206f5b1c8a1SJohn Marino ret = BN_BLINDING_create_param(NULL, e, &n, ctx, rsa->meth->bn_mod_exp,
207f5b1c8a1SJohn Marino rsa->_method_mod_n);
208f5b1c8a1SJohn Marino
209f5b1c8a1SJohn Marino if (ret == NULL) {
21072c33676SMaxim Ag RSAerror(ERR_R_BN_LIB);
211f5b1c8a1SJohn Marino goto err;
212f5b1c8a1SJohn Marino }
213f5b1c8a1SJohn Marino CRYPTO_THREADID_current(BN_BLINDING_thread_id(ret));
214f5b1c8a1SJohn Marino err:
215f5b1c8a1SJohn Marino BN_CTX_end(ctx);
216f5b1c8a1SJohn Marino if (in_ctx == NULL)
217f5b1c8a1SJohn Marino BN_CTX_free(ctx);
218f5b1c8a1SJohn Marino if (rsa->e == NULL)
219f5b1c8a1SJohn Marino BN_free(e);
220f5b1c8a1SJohn Marino
221f5b1c8a1SJohn Marino return ret;
222f5b1c8a1SJohn Marino }
223