1 /* crypto/rsa/rsa_pmeth.c */ 2 /* 3 * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL project 4 * 2006. 5 */ 6 /* ==================================================================== 7 * Copyright (c) 2006 The OpenSSL Project. All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 16 * 2. Redistributions in binary form must reproduce the above copyright 17 * notice, this list of conditions and the following disclaimer in 18 * the documentation and/or other materials provided with the 19 * distribution. 20 * 21 * 3. All advertising materials mentioning features or use of this 22 * software must display the following acknowledgment: 23 * "This product includes software developed by the OpenSSL Project 24 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" 25 * 26 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 27 * endorse or promote products derived from this software without 28 * prior written permission. For written permission, please contact 29 * licensing@OpenSSL.org. 30 * 31 * 5. Products derived from this software may not be called "OpenSSL" 32 * nor may "OpenSSL" appear in their names without prior written 33 * permission of the OpenSSL Project. 34 * 35 * 6. Redistributions of any form whatsoever must retain the following 36 * acknowledgment: 37 * "This product includes software developed by the OpenSSL Project 38 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" 39 * 40 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 41 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 42 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 43 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 44 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 45 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 46 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 47 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 49 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 50 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 51 * OF THE POSSIBILITY OF SUCH DAMAGE. 52 * ==================================================================== 53 * 54 * This product includes cryptographic software written by Eric Young 55 * (eay@cryptsoft.com). This product includes software written by Tim 56 * Hudson (tjh@cryptsoft.com). 57 * 58 */ 59 60 #include <stdio.h> 61 #include "cryptlib.h" 62 #include <openssl/asn1t.h> 63 #include <openssl/x509.h> 64 #include <openssl/rsa.h> 65 #include <openssl/bn.h> 66 #include <openssl/evp.h> 67 #include <openssl/x509v3.h> 68 #ifndef OPENSSL_NO_CMS 69 # include <openssl/cms.h> 70 #endif 71 #ifdef OPENSSL_FIPS 72 # include <openssl/fips.h> 73 #endif 74 #include "evp_locl.h" 75 #include "rsa_locl.h" 76 77 /* RSA pkey context structure */ 78 79 typedef struct { 80 /* Key gen parameters */ 81 int nbits; 82 BIGNUM *pub_exp; 83 /* Keygen callback info */ 84 int gentmp[2]; 85 /* RSA padding mode */ 86 int pad_mode; 87 /* message digest */ 88 const EVP_MD *md; 89 /* message digest for MGF1 */ 90 const EVP_MD *mgf1md; 91 /* PSS salt length */ 92 int saltlen; 93 /* Temp buffer */ 94 unsigned char *tbuf; 95 /* OAEP label */ 96 unsigned char *oaep_label; 97 size_t oaep_labellen; 98 } RSA_PKEY_CTX; 99 100 static int pkey_rsa_init(EVP_PKEY_CTX *ctx) 101 { 102 RSA_PKEY_CTX *rctx; 103 rctx = OPENSSL_malloc(sizeof(RSA_PKEY_CTX)); 104 if (!rctx) 105 return 0; 106 rctx->nbits = 1024; 107 rctx->pub_exp = NULL; 108 rctx->pad_mode = RSA_PKCS1_PADDING; 109 rctx->md = NULL; 110 rctx->mgf1md = NULL; 111 rctx->tbuf = NULL; 112 113 rctx->saltlen = -2; 114 115 rctx->oaep_label = NULL; 116 rctx->oaep_labellen = 0; 117 118 ctx->data = rctx; 119 ctx->keygen_info = rctx->gentmp; 120 ctx->keygen_info_count = 2; 121 122 return 1; 123 } 124 125 static int pkey_rsa_copy(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src) 126 { 127 RSA_PKEY_CTX *dctx, *sctx; 128 if (!pkey_rsa_init(dst)) 129 return 0; 130 sctx = src->data; 131 dctx = dst->data; 132 dctx->nbits = sctx->nbits; 133 if (sctx->pub_exp) { 134 dctx->pub_exp = BN_dup(sctx->pub_exp); 135 if (!dctx->pub_exp) 136 return 0; 137 } 138 dctx->pad_mode = sctx->pad_mode; 139 dctx->md = sctx->md; 140 dctx->mgf1md = sctx->mgf1md; 141 if (sctx->oaep_label) { 142 if (dctx->oaep_label) 143 OPENSSL_free(dctx->oaep_label); 144 dctx->oaep_label = BUF_memdup(sctx->oaep_label, sctx->oaep_labellen); 145 if (!dctx->oaep_label) 146 return 0; 147 dctx->oaep_labellen = sctx->oaep_labellen; 148 } 149 return 1; 150 } 151 152 static int setup_tbuf(RSA_PKEY_CTX *ctx, EVP_PKEY_CTX *pk) 153 { 154 if (ctx->tbuf) 155 return 1; 156 ctx->tbuf = OPENSSL_malloc(EVP_PKEY_size(pk->pkey)); 157 if (!ctx->tbuf) 158 return 0; 159 return 1; 160 } 161 162 static void pkey_rsa_cleanup(EVP_PKEY_CTX *ctx) 163 { 164 RSA_PKEY_CTX *rctx = ctx->data; 165 if (rctx) { 166 if (rctx->pub_exp) 167 BN_free(rctx->pub_exp); 168 if (rctx->tbuf) 169 OPENSSL_free(rctx->tbuf); 170 if (rctx->oaep_label) 171 OPENSSL_free(rctx->oaep_label); 172 OPENSSL_free(rctx); 173 } 174 } 175 176 #ifdef OPENSSL_FIPS 177 /* 178 * FIP checker. Return value indicates status of context parameters: 1 : 179 * redirect to FIPS. 0 : don't redirect to FIPS. -1 : illegal operation in 180 * FIPS mode. 181 */ 182 183 static int pkey_fips_check_ctx(EVP_PKEY_CTX *ctx) 184 { 185 RSA_PKEY_CTX *rctx = ctx->data; 186 RSA *rsa = ctx->pkey->pkey.rsa; 187 int rv = -1; 188 if (!FIPS_mode()) 189 return 0; 190 if (rsa->flags & RSA_FLAG_NON_FIPS_ALLOW) 191 rv = 0; 192 if (!(rsa->meth->flags & RSA_FLAG_FIPS_METHOD) && rv) 193 return -1; 194 if (rctx->md) { 195 const EVP_MD *fmd; 196 fmd = FIPS_get_digestbynid(EVP_MD_type(rctx->md)); 197 if (!fmd || !(fmd->flags & EVP_MD_FLAG_FIPS)) 198 return rv; 199 } 200 if (rctx->mgf1md && !(rctx->mgf1md->flags & EVP_MD_FLAG_FIPS)) { 201 const EVP_MD *fmd; 202 fmd = FIPS_get_digestbynid(EVP_MD_type(rctx->mgf1md)); 203 if (!fmd || !(fmd->flags & EVP_MD_FLAG_FIPS)) 204 return rv; 205 } 206 return 1; 207 } 208 #endif 209 210 static int pkey_rsa_sign(EVP_PKEY_CTX *ctx, unsigned char *sig, 211 size_t *siglen, const unsigned char *tbs, 212 size_t tbslen) 213 { 214 int ret; 215 RSA_PKEY_CTX *rctx = ctx->data; 216 RSA *rsa = ctx->pkey->pkey.rsa; 217 218 #ifdef OPENSSL_FIPS 219 ret = pkey_fips_check_ctx(ctx); 220 if (ret < 0) { 221 RSAerr(RSA_F_PKEY_RSA_SIGN, RSA_R_OPERATION_NOT_ALLOWED_IN_FIPS_MODE); 222 return -1; 223 } 224 #endif 225 226 if (rctx->md) { 227 if (tbslen != (size_t)EVP_MD_size(rctx->md)) { 228 RSAerr(RSA_F_PKEY_RSA_SIGN, RSA_R_INVALID_DIGEST_LENGTH); 229 return -1; 230 } 231 #ifdef OPENSSL_FIPS 232 if (ret > 0) { 233 unsigned int slen; 234 ret = FIPS_rsa_sign_digest(rsa, tbs, tbslen, rctx->md, 235 rctx->pad_mode, 236 rctx->saltlen, 237 rctx->mgf1md, sig, &slen); 238 if (ret > 0) 239 *siglen = slen; 240 else 241 *siglen = 0; 242 return ret; 243 } 244 #endif 245 246 if (EVP_MD_type(rctx->md) == NID_mdc2) { 247 unsigned int sltmp; 248 if (rctx->pad_mode != RSA_PKCS1_PADDING) 249 return -1; 250 ret = RSA_sign_ASN1_OCTET_STRING(NID_mdc2, 251 tbs, tbslen, sig, &sltmp, rsa); 252 253 if (ret <= 0) 254 return ret; 255 ret = sltmp; 256 } else if (rctx->pad_mode == RSA_X931_PADDING) { 257 if ((size_t)EVP_PKEY_size(ctx->pkey) < tbslen + 1) { 258 RSAerr(RSA_F_PKEY_RSA_SIGN, RSA_R_KEY_SIZE_TOO_SMALL); 259 return -1; 260 } 261 if (!setup_tbuf(rctx, ctx)) { 262 RSAerr(RSA_F_PKEY_RSA_SIGN, ERR_R_MALLOC_FAILURE); 263 return -1; 264 } 265 memcpy(rctx->tbuf, tbs, tbslen); 266 rctx->tbuf[tbslen] = RSA_X931_hash_id(EVP_MD_type(rctx->md)); 267 ret = RSA_private_encrypt(tbslen + 1, rctx->tbuf, 268 sig, rsa, RSA_X931_PADDING); 269 } else if (rctx->pad_mode == RSA_PKCS1_PADDING) { 270 unsigned int sltmp; 271 ret = RSA_sign(EVP_MD_type(rctx->md), 272 tbs, tbslen, sig, &sltmp, rsa); 273 if (ret <= 0) 274 return ret; 275 ret = sltmp; 276 } else if (rctx->pad_mode == RSA_PKCS1_PSS_PADDING) { 277 if (!setup_tbuf(rctx, ctx)) 278 return -1; 279 if (!RSA_padding_add_PKCS1_PSS_mgf1(rsa, 280 rctx->tbuf, tbs, 281 rctx->md, rctx->mgf1md, 282 rctx->saltlen)) 283 return -1; 284 ret = RSA_private_encrypt(RSA_size(rsa), rctx->tbuf, 285 sig, rsa, RSA_NO_PADDING); 286 } else 287 return -1; 288 } else 289 ret = RSA_private_encrypt(tbslen, tbs, sig, ctx->pkey->pkey.rsa, 290 rctx->pad_mode); 291 if (ret < 0) 292 return ret; 293 *siglen = ret; 294 return 1; 295 } 296 297 static int pkey_rsa_verifyrecover(EVP_PKEY_CTX *ctx, 298 unsigned char *rout, size_t *routlen, 299 const unsigned char *sig, size_t siglen) 300 { 301 int ret; 302 RSA_PKEY_CTX *rctx = ctx->data; 303 304 if (rctx->md) { 305 if (rctx->pad_mode == RSA_X931_PADDING) { 306 if (!setup_tbuf(rctx, ctx)) 307 return -1; 308 ret = RSA_public_decrypt(siglen, sig, 309 rctx->tbuf, ctx->pkey->pkey.rsa, 310 RSA_X931_PADDING); 311 if (ret < 1) 312 return 0; 313 ret--; 314 if (rctx->tbuf[ret] != RSA_X931_hash_id(EVP_MD_type(rctx->md))) { 315 RSAerr(RSA_F_PKEY_RSA_VERIFYRECOVER, 316 RSA_R_ALGORITHM_MISMATCH); 317 return 0; 318 } 319 if (ret != EVP_MD_size(rctx->md)) { 320 RSAerr(RSA_F_PKEY_RSA_VERIFYRECOVER, 321 RSA_R_INVALID_DIGEST_LENGTH); 322 return 0; 323 } 324 if (rout) 325 memcpy(rout, rctx->tbuf, ret); 326 } else if (rctx->pad_mode == RSA_PKCS1_PADDING) { 327 size_t sltmp; 328 ret = int_rsa_verify(EVP_MD_type(rctx->md), 329 NULL, 0, rout, &sltmp, 330 sig, siglen, ctx->pkey->pkey.rsa); 331 if (ret <= 0) 332 return 0; 333 ret = sltmp; 334 } else 335 return -1; 336 } else 337 ret = RSA_public_decrypt(siglen, sig, rout, ctx->pkey->pkey.rsa, 338 rctx->pad_mode); 339 if (ret < 0) 340 return ret; 341 *routlen = ret; 342 return 1; 343 } 344 345 static int pkey_rsa_verify(EVP_PKEY_CTX *ctx, 346 const unsigned char *sig, size_t siglen, 347 const unsigned char *tbs, size_t tbslen) 348 { 349 RSA_PKEY_CTX *rctx = ctx->data; 350 RSA *rsa = ctx->pkey->pkey.rsa; 351 size_t rslen; 352 #ifdef OPENSSL_FIPS 353 int rv; 354 rv = pkey_fips_check_ctx(ctx); 355 if (rv < 0) { 356 RSAerr(RSA_F_PKEY_RSA_VERIFY, 357 RSA_R_OPERATION_NOT_ALLOWED_IN_FIPS_MODE); 358 return -1; 359 } 360 #endif 361 if (rctx->md) { 362 #ifdef OPENSSL_FIPS 363 if (rv > 0) { 364 return FIPS_rsa_verify_digest(rsa, 365 tbs, tbslen, 366 rctx->md, 367 rctx->pad_mode, 368 rctx->saltlen, 369 rctx->mgf1md, sig, siglen); 370 371 } 372 #endif 373 if (rctx->pad_mode == RSA_PKCS1_PADDING) 374 return RSA_verify(EVP_MD_type(rctx->md), tbs, tbslen, 375 sig, siglen, rsa); 376 if (tbslen != (size_t)EVP_MD_size(rctx->md)) { 377 RSAerr(RSA_F_PKEY_RSA_VERIFY, RSA_R_INVALID_DIGEST_LENGTH); 378 return -1; 379 } 380 if (rctx->pad_mode == RSA_X931_PADDING) { 381 if (pkey_rsa_verifyrecover(ctx, NULL, &rslen, sig, siglen) <= 0) 382 return 0; 383 } else if (rctx->pad_mode == RSA_PKCS1_PSS_PADDING) { 384 int ret; 385 if (!setup_tbuf(rctx, ctx)) 386 return -1; 387 ret = RSA_public_decrypt(siglen, sig, rctx->tbuf, 388 rsa, RSA_NO_PADDING); 389 if (ret <= 0) 390 return 0; 391 ret = RSA_verify_PKCS1_PSS_mgf1(rsa, tbs, 392 rctx->md, rctx->mgf1md, 393 rctx->tbuf, rctx->saltlen); 394 if (ret <= 0) 395 return 0; 396 return 1; 397 } else 398 return -1; 399 } else { 400 if (!setup_tbuf(rctx, ctx)) 401 return -1; 402 rslen = RSA_public_decrypt(siglen, sig, rctx->tbuf, 403 rsa, rctx->pad_mode); 404 if (rslen == 0) 405 return 0; 406 } 407 408 if ((rslen != tbslen) || memcmp(tbs, rctx->tbuf, rslen)) 409 return 0; 410 411 return 1; 412 413 } 414 415 static int pkey_rsa_encrypt(EVP_PKEY_CTX *ctx, 416 unsigned char *out, size_t *outlen, 417 const unsigned char *in, size_t inlen) 418 { 419 int ret; 420 RSA_PKEY_CTX *rctx = ctx->data; 421 if (rctx->pad_mode == RSA_PKCS1_OAEP_PADDING) { 422 int klen = RSA_size(ctx->pkey->pkey.rsa); 423 if (!setup_tbuf(rctx, ctx)) 424 return -1; 425 if (!RSA_padding_add_PKCS1_OAEP_mgf1(rctx->tbuf, klen, 426 in, inlen, 427 rctx->oaep_label, 428 rctx->oaep_labellen, 429 rctx->md, rctx->mgf1md)) 430 return -1; 431 ret = RSA_public_encrypt(klen, rctx->tbuf, out, 432 ctx->pkey->pkey.rsa, RSA_NO_PADDING); 433 } else 434 ret = RSA_public_encrypt(inlen, in, out, ctx->pkey->pkey.rsa, 435 rctx->pad_mode); 436 if (ret < 0) 437 return ret; 438 *outlen = ret; 439 return 1; 440 } 441 442 static int pkey_rsa_decrypt(EVP_PKEY_CTX *ctx, 443 unsigned char *out, size_t *outlen, 444 const unsigned char *in, size_t inlen) 445 { 446 int ret; 447 RSA_PKEY_CTX *rctx = ctx->data; 448 if (rctx->pad_mode == RSA_PKCS1_OAEP_PADDING) { 449 if (!setup_tbuf(rctx, ctx)) 450 return -1; 451 ret = RSA_private_decrypt(inlen, in, rctx->tbuf, 452 ctx->pkey->pkey.rsa, RSA_NO_PADDING); 453 if (ret <= 0) 454 return ret; 455 ret = RSA_padding_check_PKCS1_OAEP_mgf1(out, ret, rctx->tbuf, 456 ret, ret, 457 rctx->oaep_label, 458 rctx->oaep_labellen, 459 rctx->md, rctx->mgf1md); 460 } else 461 ret = RSA_private_decrypt(inlen, in, out, ctx->pkey->pkey.rsa, 462 rctx->pad_mode); 463 if (ret < 0) 464 return ret; 465 *outlen = ret; 466 return 1; 467 } 468 469 static int check_padding_md(const EVP_MD *md, int padding) 470 { 471 if (!md) 472 return 1; 473 474 if (padding == RSA_NO_PADDING) { 475 RSAerr(RSA_F_CHECK_PADDING_MD, RSA_R_INVALID_PADDING_MODE); 476 return 0; 477 } 478 479 if (padding == RSA_X931_PADDING) { 480 if (RSA_X931_hash_id(EVP_MD_type(md)) == -1) { 481 RSAerr(RSA_F_CHECK_PADDING_MD, RSA_R_INVALID_X931_DIGEST); 482 return 0; 483 } 484 return 1; 485 } 486 487 return 1; 488 } 489 490 static int pkey_rsa_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2) 491 { 492 RSA_PKEY_CTX *rctx = ctx->data; 493 switch (type) { 494 case EVP_PKEY_CTRL_RSA_PADDING: 495 if ((p1 >= RSA_PKCS1_PADDING) && (p1 <= RSA_PKCS1_PSS_PADDING)) { 496 if (!check_padding_md(rctx->md, p1)) 497 return 0; 498 if (p1 == RSA_PKCS1_PSS_PADDING) { 499 if (!(ctx->operation & 500 (EVP_PKEY_OP_SIGN | EVP_PKEY_OP_VERIFY))) 501 goto bad_pad; 502 if (!rctx->md) 503 rctx->md = EVP_sha1(); 504 } 505 if (p1 == RSA_PKCS1_OAEP_PADDING) { 506 if (!(ctx->operation & EVP_PKEY_OP_TYPE_CRYPT)) 507 goto bad_pad; 508 if (!rctx->md) 509 rctx->md = EVP_sha1(); 510 } 511 rctx->pad_mode = p1; 512 return 1; 513 } 514 bad_pad: 515 RSAerr(RSA_F_PKEY_RSA_CTRL, 516 RSA_R_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE); 517 return -2; 518 519 case EVP_PKEY_CTRL_GET_RSA_PADDING: 520 *(int *)p2 = rctx->pad_mode; 521 return 1; 522 523 case EVP_PKEY_CTRL_RSA_PSS_SALTLEN: 524 case EVP_PKEY_CTRL_GET_RSA_PSS_SALTLEN: 525 if (rctx->pad_mode != RSA_PKCS1_PSS_PADDING) { 526 RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_INVALID_PSS_SALTLEN); 527 return -2; 528 } 529 if (type == EVP_PKEY_CTRL_GET_RSA_PSS_SALTLEN) 530 *(int *)p2 = rctx->saltlen; 531 else { 532 if (p1 < -2) 533 return -2; 534 rctx->saltlen = p1; 535 } 536 return 1; 537 538 case EVP_PKEY_CTRL_RSA_KEYGEN_BITS: 539 if (p1 < 256) { 540 RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_INVALID_KEYBITS); 541 return -2; 542 } 543 rctx->nbits = p1; 544 return 1; 545 546 case EVP_PKEY_CTRL_RSA_KEYGEN_PUBEXP: 547 if (p2 == NULL || !BN_is_odd((BIGNUM *)p2) || BN_is_one((BIGNUM *)p2)) { 548 RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_BAD_E_VALUE); 549 return -2; 550 } 551 BN_free(rctx->pub_exp); 552 rctx->pub_exp = p2; 553 return 1; 554 555 case EVP_PKEY_CTRL_RSA_OAEP_MD: 556 case EVP_PKEY_CTRL_GET_RSA_OAEP_MD: 557 if (rctx->pad_mode != RSA_PKCS1_OAEP_PADDING) { 558 RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_INVALID_PADDING_MODE); 559 return -2; 560 } 561 if (type == EVP_PKEY_CTRL_GET_RSA_OAEP_MD) 562 *(const EVP_MD **)p2 = rctx->md; 563 else 564 rctx->md = p2; 565 return 1; 566 567 case EVP_PKEY_CTRL_MD: 568 if (!check_padding_md(p2, rctx->pad_mode)) 569 return 0; 570 rctx->md = p2; 571 return 1; 572 573 case EVP_PKEY_CTRL_GET_MD: 574 *(const EVP_MD **)p2 = rctx->md; 575 return 1; 576 577 case EVP_PKEY_CTRL_RSA_MGF1_MD: 578 case EVP_PKEY_CTRL_GET_RSA_MGF1_MD: 579 if (rctx->pad_mode != RSA_PKCS1_PSS_PADDING 580 && rctx->pad_mode != RSA_PKCS1_OAEP_PADDING) { 581 RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_INVALID_MGF1_MD); 582 return -2; 583 } 584 if (type == EVP_PKEY_CTRL_GET_RSA_MGF1_MD) { 585 if (rctx->mgf1md) 586 *(const EVP_MD **)p2 = rctx->mgf1md; 587 else 588 *(const EVP_MD **)p2 = rctx->md; 589 } else 590 rctx->mgf1md = p2; 591 return 1; 592 593 case EVP_PKEY_CTRL_RSA_OAEP_LABEL: 594 if (rctx->pad_mode != RSA_PKCS1_OAEP_PADDING) { 595 RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_INVALID_PADDING_MODE); 596 return -2; 597 } 598 if (rctx->oaep_label) 599 OPENSSL_free(rctx->oaep_label); 600 if (p2 && p1 > 0) { 601 rctx->oaep_label = p2; 602 rctx->oaep_labellen = p1; 603 } else { 604 rctx->oaep_label = NULL; 605 rctx->oaep_labellen = 0; 606 } 607 return 1; 608 609 case EVP_PKEY_CTRL_GET_RSA_OAEP_LABEL: 610 if (rctx->pad_mode != RSA_PKCS1_OAEP_PADDING) { 611 RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_INVALID_PADDING_MODE); 612 return -2; 613 } 614 *(unsigned char **)p2 = rctx->oaep_label; 615 return rctx->oaep_labellen; 616 617 case EVP_PKEY_CTRL_DIGESTINIT: 618 case EVP_PKEY_CTRL_PKCS7_ENCRYPT: 619 case EVP_PKEY_CTRL_PKCS7_DECRYPT: 620 case EVP_PKEY_CTRL_PKCS7_SIGN: 621 return 1; 622 #ifndef OPENSSL_NO_CMS 623 case EVP_PKEY_CTRL_CMS_DECRYPT: 624 case EVP_PKEY_CTRL_CMS_ENCRYPT: 625 case EVP_PKEY_CTRL_CMS_SIGN: 626 return 1; 627 #endif 628 case EVP_PKEY_CTRL_PEER_KEY: 629 RSAerr(RSA_F_PKEY_RSA_CTRL, 630 RSA_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE); 631 return -2; 632 633 default: 634 return -2; 635 636 } 637 } 638 639 static int pkey_rsa_ctrl_str(EVP_PKEY_CTX *ctx, 640 const char *type, const char *value) 641 { 642 if (!value) { 643 RSAerr(RSA_F_PKEY_RSA_CTRL_STR, RSA_R_VALUE_MISSING); 644 return 0; 645 } 646 if (!strcmp(type, "rsa_padding_mode")) { 647 int pm; 648 if (!strcmp(value, "pkcs1")) 649 pm = RSA_PKCS1_PADDING; 650 else if (!strcmp(value, "sslv23")) 651 pm = RSA_SSLV23_PADDING; 652 else if (!strcmp(value, "none")) 653 pm = RSA_NO_PADDING; 654 else if (!strcmp(value, "oeap")) 655 pm = RSA_PKCS1_OAEP_PADDING; 656 else if (!strcmp(value, "oaep")) 657 pm = RSA_PKCS1_OAEP_PADDING; 658 else if (!strcmp(value, "x931")) 659 pm = RSA_X931_PADDING; 660 else if (!strcmp(value, "pss")) 661 pm = RSA_PKCS1_PSS_PADDING; 662 else { 663 RSAerr(RSA_F_PKEY_RSA_CTRL_STR, RSA_R_UNKNOWN_PADDING_TYPE); 664 return -2; 665 } 666 return EVP_PKEY_CTX_set_rsa_padding(ctx, pm); 667 } 668 669 if (!strcmp(type, "rsa_pss_saltlen")) { 670 int saltlen; 671 saltlen = atoi(value); 672 return EVP_PKEY_CTX_set_rsa_pss_saltlen(ctx, saltlen); 673 } 674 675 if (!strcmp(type, "rsa_keygen_bits")) { 676 int nbits; 677 nbits = atoi(value); 678 return EVP_PKEY_CTX_set_rsa_keygen_bits(ctx, nbits); 679 } 680 681 if (!strcmp(type, "rsa_keygen_pubexp")) { 682 int ret; 683 BIGNUM *pubexp = NULL; 684 if (!BN_asc2bn(&pubexp, value)) 685 return 0; 686 ret = EVP_PKEY_CTX_set_rsa_keygen_pubexp(ctx, pubexp); 687 if (ret <= 0) 688 BN_free(pubexp); 689 return ret; 690 } 691 692 if (!strcmp(type, "rsa_mgf1_md")) { 693 const EVP_MD *md; 694 if (!(md = EVP_get_digestbyname(value))) { 695 RSAerr(RSA_F_PKEY_RSA_CTRL_STR, RSA_R_INVALID_DIGEST); 696 return 0; 697 } 698 return EVP_PKEY_CTX_set_rsa_mgf1_md(ctx, md); 699 } 700 701 if (!strcmp(type, "rsa_oaep_md")) { 702 const EVP_MD *md; 703 if (!(md = EVP_get_digestbyname(value))) { 704 RSAerr(RSA_F_PKEY_RSA_CTRL_STR, RSA_R_INVALID_DIGEST); 705 return 0; 706 } 707 return EVP_PKEY_CTX_set_rsa_oaep_md(ctx, md); 708 } 709 if (!strcmp(type, "rsa_oaep_label")) { 710 unsigned char *lab; 711 long lablen; 712 int ret; 713 lab = string_to_hex(value, &lablen); 714 if (!lab) 715 return 0; 716 ret = EVP_PKEY_CTX_set0_rsa_oaep_label(ctx, lab, lablen); 717 if (ret <= 0) 718 OPENSSL_free(lab); 719 return ret; 720 } 721 722 return -2; 723 } 724 725 static int pkey_rsa_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey) 726 { 727 RSA *rsa = NULL; 728 RSA_PKEY_CTX *rctx = ctx->data; 729 BN_GENCB *pcb, cb; 730 int ret; 731 if (!rctx->pub_exp) { 732 rctx->pub_exp = BN_new(); 733 if (!rctx->pub_exp || !BN_set_word(rctx->pub_exp, RSA_F4)) 734 return 0; 735 } 736 rsa = RSA_new(); 737 if (!rsa) 738 return 0; 739 if (ctx->pkey_gencb) { 740 pcb = &cb; 741 evp_pkey_set_cb_translate(pcb, ctx); 742 } else 743 pcb = NULL; 744 ret = RSA_generate_key_ex(rsa, rctx->nbits, rctx->pub_exp, pcb); 745 if (ret > 0) 746 EVP_PKEY_assign_RSA(pkey, rsa); 747 else 748 RSA_free(rsa); 749 return ret; 750 } 751 752 const EVP_PKEY_METHOD rsa_pkey_meth = { 753 EVP_PKEY_RSA, 754 EVP_PKEY_FLAG_AUTOARGLEN, 755 pkey_rsa_init, 756 pkey_rsa_copy, 757 pkey_rsa_cleanup, 758 759 0, 0, 760 761 0, 762 pkey_rsa_keygen, 763 764 0, 765 pkey_rsa_sign, 766 767 0, 768 pkey_rsa_verify, 769 770 0, 771 pkey_rsa_verifyrecover, 772 773 0, 0, 0, 0, 774 775 0, 776 pkey_rsa_encrypt, 777 778 0, 779 pkey_rsa_decrypt, 780 781 0, 0, 782 783 pkey_rsa_ctrl, 784 pkey_rsa_ctrl_str 785 }; 786