1 /* Written by Dr Stephen N Henson (steve (at) openssl.org) for the OpenSSL 2 * project 2005. 3 */ 4 /* ==================================================================== 5 * Copyright (c) 2005 The OpenSSL Project. All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in 16 * the documentation and/or other materials provided with the 17 * distribution. 18 * 19 * 3. All advertising materials mentioning features or use of this 20 * software must display the following acknowledgment: 21 * "This product includes software developed by the OpenSSL Project 22 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" 23 * 24 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 25 * endorse or promote products derived from this software without 26 * prior written permission. For written permission, please contact 27 * licensing (at) OpenSSL.org. 28 * 29 * 5. Products derived from this software may not be called "OpenSSL" 30 * nor may "OpenSSL" appear in their names without prior written 31 * permission of the OpenSSL Project. 32 * 33 * 6. Redistributions of any form whatsoever must retain the following 34 * acknowledgment: 35 * "This product includes software developed by the OpenSSL Project 36 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" 37 * 38 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 39 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 40 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 41 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 42 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 43 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 44 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 45 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 46 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 47 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 48 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 49 * OF THE POSSIBILITY OF SUCH DAMAGE. 50 * ==================================================================== 51 * 52 * This product includes cryptographic software written by Eric Young 53 * (eay (at) cryptsoft.com). This product includes software written by Tim 54 * Hudson (tjh (at) cryptsoft.com). */ 55 56 #include <openssl/rsa.h> 57 58 #include <openssl/digest.h> 59 #include <openssl/err.h> 60 #include <openssl/mem.h> 61 #include <openssl/rand.h> 62 #include <openssl/sha.h> 63 64 #include "internal.h" 65 66 /* TODO(fork): don't the check functions have to be constant time? */ 67 68 int RSA_padding_add_PKCS1_type_1(uint8_t *to, unsigned tlen, 69 const uint8_t *from, unsigned flen) { 70 unsigned j; 71 uint8_t *p; 72 73 if (tlen < RSA_PKCS1_PADDING_SIZE) { 74 OPENSSL_PUT_ERROR(RSA, RSA_padding_add_PKCS1_type_1, 75 RSA_R_KEY_SIZE_TOO_SMALL); 76 return 0; 77 } 78 79 if (flen > tlen - RSA_PKCS1_PADDING_SIZE) { 80 OPENSSL_PUT_ERROR(RSA, RSA_padding_add_PKCS1_type_1, 81 RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE); 82 return 0; 83 } 84 85 p = (uint8_t *)to; 86 87 *(p++) = 0; 88 *(p++) = 1; /* Private Key BT (Block Type) */ 89 90 /* pad out with 0xff data */ 91 j = tlen - 3 - flen; 92 memset(p, 0xff, j); 93 p += j; 94 *(p++) = 0; 95 memcpy(p, from, (unsigned int)flen); 96 return 1; 97 } 98 99 int RSA_padding_check_PKCS1_type_1(uint8_t *to, unsigned tlen, 100 const uint8_t *from, unsigned flen) { 101 unsigned i, j; 102 const uint8_t *p; 103 104 if (flen < 2) { 105 OPENSSL_PUT_ERROR(RSA, RSA_padding_check_PKCS1_type_1, 106 RSA_R_DATA_TOO_SMALL); 107 return -1; 108 } 109 110 p = from; 111 if ((*(p++) != 0) || (*(p++) != 1)) { 112 OPENSSL_PUT_ERROR(RSA, RSA_padding_check_PKCS1_type_1, 113 RSA_R_BLOCK_TYPE_IS_NOT_01); 114 return -1; 115 } 116 117 /* scan over padding data */ 118 j = flen - 2; /* one for leading 00, one for type. */ 119 for (i = 0; i < j; i++) { 120 /* should decrypt to 0xff */ 121 if (*p != 0xff) { 122 if (*p == 0) { 123 p++; 124 break; 125 } else { 126 OPENSSL_PUT_ERROR(RSA, RSA_padding_check_PKCS1_type_1, 127 RSA_R_BAD_FIXED_HEADER_DECRYPT); 128 return -1; 129 } 130 } 131 p++; 132 } 133 134 if (i == j) { 135 OPENSSL_PUT_ERROR(RSA, RSA_padding_check_PKCS1_type_1, 136 RSA_R_NULL_BEFORE_BLOCK_MISSING); 137 return -1; 138 } 139 140 if (i < 8) { 141 OPENSSL_PUT_ERROR(RSA, RSA_padding_check_PKCS1_type_1, 142 RSA_R_BAD_PAD_BYTE_COUNT); 143 return -1; 144 } 145 i++; /* Skip over the '\0' */ 146 j -= i; 147 if (j > tlen) { 148 OPENSSL_PUT_ERROR(RSA, RSA_padding_check_PKCS1_type_1, 149 RSA_R_DATA_TOO_LARGE); 150 return -1; 151 } 152 memcpy(to, p, j); 153 154 return j; 155 } 156 157 int RSA_padding_add_PKCS1_type_2(uint8_t *to, unsigned tlen, 158 const uint8_t *from, unsigned flen) { 159 unsigned i, j; 160 uint8_t *p; 161 162 if (tlen < RSA_PKCS1_PADDING_SIZE) { 163 OPENSSL_PUT_ERROR(RSA, RSA_padding_add_PKCS1_type_2, 164 RSA_R_KEY_SIZE_TOO_SMALL); 165 return 0; 166 } 167 168 if (flen > tlen - RSA_PKCS1_PADDING_SIZE) { 169 OPENSSL_PUT_ERROR(RSA, RSA_padding_add_PKCS1_type_2, 170 RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE); 171 return 0; 172 } 173 174 p = (unsigned char *)to; 175 176 *(p++) = 0; 177 *(p++) = 2; /* Public Key BT (Block Type) */ 178 179 /* pad out with non-zero random data */ 180 j = tlen - 3 - flen; 181 182 if (RAND_pseudo_bytes(p, j) <= 0) { 183 return 0; 184 } 185 186 for (i = 0; i < j; i++) { 187 while (*p == 0) { 188 if (RAND_pseudo_bytes(p, 1) <= 0) { 189 return 0; 190 } 191 } 192 p++; 193 } 194 195 *(p++) = 0; 196 197 memcpy(p, from, (unsigned int)flen); 198 return 1; 199 } 200 201 /* constant_time_byte_eq returns 1 if |x| == |y| and 0 otherwise. */ 202 static int constant_time_byte_eq(unsigned char a, unsigned char b) { 203 unsigned char z = ~(a ^ b); 204 z &= z >> 4; 205 z &= z >> 2; 206 z &= z >> 1; 207 208 return z; 209 } 210 211 /* constant_time_select returns |x| if |v| is 1 and |y| if |v| is 0. 212 * Its behavior is undefined if |v| takes any other value. */ 213 static int constant_time_select(int v, int x, int y) { 214 return ((~(v - 1)) & x) | ((v - 1) & y); 215 } 216 217 /* constant_time_le returns 1 if |x| <= |y| and 0 otherwise. 218 * |x| and |y| must be positive. */ 219 static int constant_time_le(int x, int y) { 220 return ((x - y - 1) >> (sizeof(int) * 8 - 1)) & 1; 221 } 222 223 int RSA_message_index_PKCS1_type_2(const uint8_t *from, size_t from_len, 224 size_t *out_index) { 225 size_t i; 226 int first_byte_is_zero, second_byte_is_two, looking_for_index; 227 int valid_index, zero_index = 0; 228 229 /* PKCS#1 v1.5 decryption. See "PKCS #1 v2.2: RSA Cryptography 230 * Standard", section 7.2.2. */ 231 if (from_len < RSA_PKCS1_PADDING_SIZE) { 232 return 0; 233 } 234 235 first_byte_is_zero = constant_time_byte_eq(from[0], 0); 236 second_byte_is_two = constant_time_byte_eq(from[1], 2); 237 238 looking_for_index = 1; 239 for (i = 2; i < from_len; i++) { 240 int equals0 = constant_time_byte_eq(from[i], 0); 241 zero_index = 242 constant_time_select(looking_for_index & equals0, i, zero_index); 243 looking_for_index = constant_time_select(equals0, 0, looking_for_index); 244 } 245 246 /* The input must begin with 00 02. */ 247 valid_index = first_byte_is_zero; 248 valid_index &= second_byte_is_two; 249 250 /* We must have found the end of PS. */ 251 valid_index &= ~looking_for_index; 252 253 /* PS must be at least 8 bytes long, and it starts two bytes into |from|. */ 254 valid_index &= constant_time_le(2 + 8, zero_index); 255 256 /* Skip the zero byte. */ 257 *out_index = zero_index + 1; 258 259 return valid_index; 260 } 261 262 int RSA_padding_check_PKCS1_type_2(uint8_t *to, unsigned tlen, 263 const uint8_t *from, unsigned flen) { 264 size_t msg_index, msg_len; 265 266 if (flen == 0) { 267 OPENSSL_PUT_ERROR(RSA, RSA_padding_check_PKCS1_type_2, 268 RSA_R_EMPTY_PUBLIC_KEY); 269 return -1; 270 } 271 272 /* NOTE: Although |RSA_message_index_PKCS1_type_2| itself is constant time, 273 * the API contracts of this function and |RSA_decrypt| with 274 * |RSA_PKCS1_PADDING| make it impossible to completely avoid Bleichenbacher's 275 * attack. */ 276 if (!RSA_message_index_PKCS1_type_2(from, flen, &msg_index)) { 277 OPENSSL_PUT_ERROR(RSA, RSA_padding_check_PKCS1_type_2, 278 RSA_R_PKCS_DECODING_ERROR); 279 return -1; 280 } 281 282 msg_len = flen - msg_index; 283 if (msg_len > tlen) { 284 /* This shouldn't happen because this function is always called with |tlen| 285 * the key size and |flen| is bounded by the key size. */ 286 OPENSSL_PUT_ERROR(RSA, RSA_padding_check_PKCS1_type_2, 287 RSA_R_PKCS_DECODING_ERROR); 288 return -1; 289 } 290 memcpy(to, &from[msg_index], msg_len); 291 return msg_len; 292 } 293 294 int RSA_padding_add_none(uint8_t *to, unsigned tlen, const uint8_t *from, unsigned flen) { 295 if (flen > tlen) { 296 OPENSSL_PUT_ERROR(RSA, RSA_padding_add_none, 297 RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE); 298 return 0; 299 } 300 301 if (flen < tlen) { 302 OPENSSL_PUT_ERROR(RSA, RSA_padding_add_none, 303 RSA_R_DATA_TOO_SMALL_FOR_KEY_SIZE); 304 return 0; 305 } 306 307 memcpy(to, from, (unsigned int)flen); 308 return 1; 309 } 310 311 int RSA_padding_check_none(uint8_t *to, unsigned tlen, const uint8_t *from, 312 unsigned flen) { 313 if (flen > tlen) { 314 OPENSSL_PUT_ERROR(RSA, RSA_padding_check_none, RSA_R_DATA_TOO_LARGE); 315 return -1; 316 } 317 318 memcpy(to, from, flen); 319 return flen; 320 } 321 322 int PKCS1_MGF1(uint8_t *mask, unsigned len, const uint8_t *seed, 323 unsigned seedlen, const EVP_MD *dgst) { 324 unsigned outlen = 0; 325 uint32_t i; 326 uint8_t cnt[4]; 327 EVP_MD_CTX c; 328 uint8_t md[EVP_MAX_MD_SIZE]; 329 unsigned mdlen; 330 int ret = -1; 331 332 EVP_MD_CTX_init(&c); 333 mdlen = EVP_MD_size(dgst); 334 335 for (i = 0; outlen < len; i++) { 336 cnt[0] = (uint8_t)((i >> 24) & 255); 337 cnt[1] = (uint8_t)((i >> 16) & 255); 338 cnt[2] = (uint8_t)((i >> 8)) & 255; 339 cnt[3] = (uint8_t)(i & 255); 340 if (!EVP_DigestInit_ex(&c, dgst, NULL) || 341 !EVP_DigestUpdate(&c, seed, seedlen) || !EVP_DigestUpdate(&c, cnt, 4)) { 342 goto err; 343 } 344 345 if (outlen + mdlen <= len) { 346 if (!EVP_DigestFinal_ex(&c, mask + outlen, NULL)) { 347 goto err; 348 } 349 outlen += mdlen; 350 } else { 351 if (!EVP_DigestFinal_ex(&c, md, NULL)) { 352 goto err; 353 } 354 memcpy(mask + outlen, md, len - outlen); 355 outlen = len; 356 } 357 } 358 ret = 0; 359 360 err: 361 EVP_MD_CTX_cleanup(&c); 362 return ret; 363 } 364 365 int RSA_padding_add_PKCS1_OAEP_mgf1(uint8_t *to, unsigned tlen, 366 const uint8_t *from, unsigned flen, 367 const uint8_t *param, unsigned plen, 368 const EVP_MD *md, const EVP_MD *mgf1md) { 369 unsigned i, emlen, mdlen; 370 uint8_t *db, *seed; 371 uint8_t *dbmask = NULL, seedmask[EVP_MAX_MD_SIZE]; 372 int ret = 0; 373 374 if (md == NULL) { 375 md = EVP_sha1(); 376 } 377 if (mgf1md == NULL) { 378 mgf1md = md; 379 } 380 381 mdlen = EVP_MD_size(md); 382 383 if (tlen < 2 * mdlen + 2) { 384 OPENSSL_PUT_ERROR(RSA, RSA_padding_add_PKCS1_OAEP_mgf1, 385 RSA_R_KEY_SIZE_TOO_SMALL); 386 return 0; 387 } 388 389 emlen = tlen - 1; 390 if (flen > emlen - 2 * mdlen - 1) { 391 OPENSSL_PUT_ERROR(RSA, RSA_padding_add_PKCS1_OAEP_mgf1, 392 RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE); 393 return 0; 394 } 395 396 if (emlen < 2 * mdlen + 1) { 397 OPENSSL_PUT_ERROR(RSA, RSA_padding_add_PKCS1_OAEP_mgf1, 398 RSA_R_KEY_SIZE_TOO_SMALL); 399 return 0; 400 } 401 402 to[0] = 0; 403 seed = to + 1; 404 db = to + mdlen + 1; 405 406 if (!EVP_Digest((void *)param, plen, db, NULL, md, NULL)) { 407 return 0; 408 } 409 memset(db + mdlen, 0, emlen - flen - 2 * mdlen - 1); 410 db[emlen - flen - mdlen - 1] = 0x01; 411 memcpy(db + emlen - flen - mdlen, from, flen); 412 if (RAND_pseudo_bytes(seed, mdlen) <= 0) { 413 return 0; 414 } 415 416 dbmask = OPENSSL_malloc(emlen - mdlen); 417 if (dbmask == NULL) { 418 OPENSSL_PUT_ERROR(RSA, RSA_padding_add_PKCS1_OAEP_mgf1, 419 ERR_R_MALLOC_FAILURE); 420 return 0; 421 } 422 423 if (PKCS1_MGF1(dbmask, emlen - mdlen, seed, mdlen, mgf1md) < 0) { 424 goto out; 425 } 426 for (i = 0; i < emlen - mdlen; i++) { 427 db[i] ^= dbmask[i]; 428 } 429 430 if (PKCS1_MGF1(seedmask, mdlen, db, emlen - mdlen, mgf1md) < 0) { 431 goto out; 432 } 433 for (i = 0; i < mdlen; i++) { 434 seed[i] ^= seedmask[i]; 435 } 436 ret = 1; 437 438 out: 439 if (dbmask != NULL) { 440 OPENSSL_free(dbmask); 441 } 442 return ret; 443 } 444 445 int RSA_padding_check_PKCS1_OAEP_mgf1(uint8_t *to, unsigned tlen, 446 const uint8_t *from, unsigned flen, 447 const uint8_t *param, unsigned plen, 448 const EVP_MD *md, const EVP_MD *mgf1md) { 449 unsigned i, dblen, mlen = -1, mdlen; 450 const uint8_t *maskeddb, *maskedseed; 451 uint8_t *db = NULL, seed[EVP_MAX_MD_SIZE], phash[EVP_MAX_MD_SIZE]; 452 int bad, looking_for_one_byte, one_index = 0; 453 454 if (md == NULL) { 455 md = EVP_sha1(); 456 } 457 if (mgf1md == NULL) { 458 mgf1md = md; 459 } 460 461 mdlen = EVP_MD_size(md); 462 463 /* The encoded message is one byte smaller than the modulus to ensure that it 464 * doesn't end up greater than the modulus. Thus there's an extra "+1" here 465 * compared to https://tools.ietf.org/html/rfc2437#section-9.1.1.2. */ 466 if (flen < 1 + 2*mdlen + 1) { 467 /* 'flen' is the length of the modulus, i.e. does not depend on the 468 * particular ciphertext. */ 469 goto decoding_err; 470 } 471 472 dblen = flen - mdlen - 1; 473 db = OPENSSL_malloc(dblen); 474 if (db == NULL) { 475 OPENSSL_PUT_ERROR(RSA, RSA_padding_check_PKCS1_OAEP_mgf1, 476 ERR_R_MALLOC_FAILURE); 477 goto err; 478 } 479 480 maskedseed = from + 1; 481 maskeddb = from + 1 + mdlen; 482 483 if (PKCS1_MGF1(seed, mdlen, maskeddb, dblen, mgf1md)) { 484 goto err; 485 } 486 for (i = 0; i < mdlen; i++) { 487 seed[i] ^= maskedseed[i]; 488 } 489 490 if (PKCS1_MGF1(db, dblen, seed, mdlen, mgf1md)) { 491 goto err; 492 } 493 for (i = 0; i < dblen; i++) { 494 db[i] ^= maskeddb[i]; 495 } 496 497 if (!EVP_Digest((void *)param, plen, phash, NULL, md, NULL)) { 498 goto err; 499 } 500 501 bad = CRYPTO_memcmp(db, phash, mdlen); 502 bad |= from[0]; 503 504 looking_for_one_byte = 1; 505 for (i = mdlen; i < dblen; i++) { 506 int equals1 = constant_time_byte_eq(db[i], 1); 507 int equals0 = constant_time_byte_eq(db[i], 0); 508 one_index = 509 constant_time_select(looking_for_one_byte & equals1, i, one_index); 510 looking_for_one_byte = 511 constant_time_select(equals1, 0, looking_for_one_byte); 512 bad |= looking_for_one_byte & ~equals0; 513 } 514 515 bad |= looking_for_one_byte; 516 517 if (bad) { 518 goto decoding_err; 519 } 520 521 one_index++; 522 mlen = dblen - one_index; 523 if (tlen < mlen) { 524 OPENSSL_PUT_ERROR(RSA, RSA_padding_check_PKCS1_OAEP_mgf1, 525 RSA_R_DATA_TOO_LARGE); 526 mlen = -1; 527 } else { 528 memcpy(to, db + one_index, mlen); 529 } 530 531 OPENSSL_free(db); 532 return mlen; 533 534 decoding_err: 535 /* to avoid chosen ciphertext attacks, the error message should not reveal 536 * which kind of decoding error happened */ 537 OPENSSL_PUT_ERROR(RSA, RSA_padding_check_PKCS1_OAEP_mgf1, 538 RSA_R_OAEP_DECODING_ERROR); 539 err: 540 if (db != NULL) { 541 OPENSSL_free(db); 542 } 543 return -1; 544 } 545 546 static const unsigned char zeroes[] = {0,0,0,0,0,0,0,0}; 547 548 int RSA_verify_PKCS1_PSS_mgf1(RSA *rsa, const uint8_t *mHash, 549 const EVP_MD *Hash, const EVP_MD *mgf1Hash, 550 const uint8_t *EM, int sLen) { 551 int i; 552 int ret = 0; 553 int maskedDBLen, MSBits, emLen; 554 size_t hLen; 555 const uint8_t *H; 556 uint8_t *DB = NULL; 557 EVP_MD_CTX ctx; 558 uint8_t H_[EVP_MAX_MD_SIZE]; 559 EVP_MD_CTX_init(&ctx); 560 561 if (mgf1Hash == NULL) { 562 mgf1Hash = Hash; 563 } 564 565 hLen = EVP_MD_size(Hash); 566 567 /* Negative sLen has special meanings: 568 * -1 sLen == hLen 569 * -2 salt length is autorecovered from signature 570 * -N reserved */ 571 if (sLen == -1) { 572 sLen = hLen; 573 } else if (sLen == -2) { 574 sLen = -2; 575 } else if (sLen < -2) { 576 OPENSSL_PUT_ERROR(RSA, RSA_verify_PKCS1_PSS_mgf1, RSA_R_SLEN_CHECK_FAILED); 577 goto err; 578 } 579 580 MSBits = (BN_num_bits(rsa->n) - 1) & 0x7; 581 emLen = RSA_size(rsa); 582 if (EM[0] & (0xFF << MSBits)) { 583 OPENSSL_PUT_ERROR(RSA, RSA_verify_PKCS1_PSS_mgf1, 584 RSA_R_FIRST_OCTET_INVALID); 585 goto err; 586 } 587 if (MSBits == 0) { 588 EM++; 589 emLen--; 590 } 591 if (emLen < ((int)hLen + sLen + 2)) { 592 /* sLen can be small negative */ 593 OPENSSL_PUT_ERROR(RSA, RSA_verify_PKCS1_PSS_mgf1, RSA_R_DATA_TOO_LARGE); 594 goto err; 595 } 596 if (EM[emLen - 1] != 0xbc) { 597 OPENSSL_PUT_ERROR(RSA, RSA_verify_PKCS1_PSS_mgf1, RSA_R_LAST_OCTET_INVALID); 598 goto err; 599 } 600 maskedDBLen = emLen - hLen - 1; 601 H = EM + maskedDBLen; 602 DB = OPENSSL_malloc(maskedDBLen); 603 if (!DB) { 604 OPENSSL_PUT_ERROR(RSA, RSA_verify_PKCS1_PSS_mgf1, ERR_R_MALLOC_FAILURE); 605 goto err; 606 } 607 if (PKCS1_MGF1(DB, maskedDBLen, H, hLen, mgf1Hash) < 0) { 608 goto err; 609 } 610 for (i = 0; i < maskedDBLen; i++) { 611 DB[i] ^= EM[i]; 612 } 613 if (MSBits) { 614 DB[0] &= 0xFF >> (8 - MSBits); 615 } 616 for (i = 0; DB[i] == 0 && i < (maskedDBLen - 1); i++) 617 ; 618 if (DB[i++] != 0x1) { 619 OPENSSL_PUT_ERROR(RSA, RSA_verify_PKCS1_PSS_mgf1, 620 RSA_R_SLEN_RECOVERY_FAILED); 621 goto err; 622 } 623 if (sLen >= 0 && (maskedDBLen - i) != sLen) { 624 OPENSSL_PUT_ERROR(RSA, RSA_verify_PKCS1_PSS_mgf1, RSA_R_SLEN_CHECK_FAILED); 625 goto err; 626 } 627 if (!EVP_DigestInit_ex(&ctx, Hash, NULL) || 628 !EVP_DigestUpdate(&ctx, zeroes, sizeof zeroes) || 629 !EVP_DigestUpdate(&ctx, mHash, hLen)) { 630 goto err; 631 } 632 if (maskedDBLen - i) { 633 if (!EVP_DigestUpdate(&ctx, DB + i, maskedDBLen - i)) { 634 goto err; 635 } 636 } 637 if (!EVP_DigestFinal_ex(&ctx, H_, NULL)) { 638 goto err; 639 } 640 if (memcmp(H_, H, hLen)) { 641 OPENSSL_PUT_ERROR(RSA, RSA_verify_PKCS1_PSS_mgf1, RSA_R_BAD_SIGNATURE); 642 ret = 0; 643 } else { 644 ret = 1; 645 } 646 647 err: 648 if (DB) { 649 OPENSSL_free(DB); 650 } 651 EVP_MD_CTX_cleanup(&ctx); 652 653 return ret; 654 } 655 656 int RSA_padding_add_PKCS1_PSS_mgf1(RSA *rsa, unsigned char *EM, 657 const unsigned char *mHash, 658 const EVP_MD *Hash, const EVP_MD *mgf1Hash, 659 int sLen) { 660 int i; 661 int ret = 0; 662 int maskedDBLen, MSBits, emLen; 663 size_t hLen; 664 unsigned char *H, *salt = NULL, *p; 665 EVP_MD_CTX ctx; 666 667 if (mgf1Hash == NULL) { 668 mgf1Hash = Hash; 669 } 670 671 hLen = EVP_MD_size(Hash); 672 673 /* Negative sLen has special meanings: 674 * -1 sLen == hLen 675 * -2 salt length is maximized 676 * -N reserved */ 677 if (sLen == -1) { 678 sLen = hLen; 679 } else if (sLen == -2) { 680 sLen = -2; 681 } else if (sLen < -2) { 682 OPENSSL_PUT_ERROR(RSA, RSA_padding_add_PKCS1_PSS_mgf1, 683 RSA_R_SLEN_CHECK_FAILED); 684 goto err; 685 } 686 687 if (BN_is_zero(rsa->n)) { 688 OPENSSL_PUT_ERROR(RSA, RSA_padding_add_PKCS1_PSS_mgf1, 689 RSA_R_EMPTY_PUBLIC_KEY); 690 goto err; 691 } 692 693 MSBits = (BN_num_bits(rsa->n) - 1) & 0x7; 694 emLen = RSA_size(rsa); 695 if (MSBits == 0) { 696 *EM++ = 0; 697 emLen--; 698 } 699 if (sLen == -2) { 700 if (emLen < hLen + 2) { 701 OPENSSL_PUT_ERROR(RSA, RSA_padding_add_PKCS1_PSS_mgf1, 702 RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE); 703 goto err; 704 } 705 sLen = emLen - hLen - 2; 706 } else if (emLen < hLen + sLen + 2) { 707 OPENSSL_PUT_ERROR(RSA, RSA_padding_add_PKCS1_PSS_mgf1, 708 RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE); 709 goto err; 710 } 711 if (sLen > 0) { 712 salt = OPENSSL_malloc(sLen); 713 if (!salt) { 714 OPENSSL_PUT_ERROR(RSA, RSA_padding_add_PKCS1_PSS_mgf1, 715 ERR_R_MALLOC_FAILURE); 716 goto err; 717 } 718 if (RAND_pseudo_bytes(salt, sLen) <= 0) { 719 goto err; 720 } 721 } 722 maskedDBLen = emLen - hLen - 1; 723 H = EM + maskedDBLen; 724 EVP_MD_CTX_init(&ctx); 725 if (!EVP_DigestInit_ex(&ctx, Hash, NULL) || 726 !EVP_DigestUpdate(&ctx, zeroes, sizeof zeroes) || 727 !EVP_DigestUpdate(&ctx, mHash, hLen)) { 728 goto err; 729 } 730 if (sLen && !EVP_DigestUpdate(&ctx, salt, sLen)) { 731 goto err; 732 } 733 if (!EVP_DigestFinal_ex(&ctx, H, NULL)) { 734 goto err; 735 } 736 EVP_MD_CTX_cleanup(&ctx); 737 738 /* Generate dbMask in place then perform XOR on it */ 739 if (PKCS1_MGF1(EM, maskedDBLen, H, hLen, mgf1Hash)) { 740 goto err; 741 } 742 743 p = EM; 744 745 /* Initial PS XORs with all zeroes which is a NOP so just update 746 * pointer. Note from a test above this value is guaranteed to 747 * be non-negative. */ 748 p += emLen - sLen - hLen - 2; 749 *p++ ^= 0x1; 750 if (sLen > 0) { 751 for (i = 0; i < sLen; i++) { 752 *p++ ^= salt[i]; 753 } 754 } 755 if (MSBits) { 756 EM[0] &= 0xFF >> (8 - MSBits); 757 } 758 759 /* H is already in place so just set final 0xbc */ 760 761 EM[emLen - 1] = 0xbc; 762 763 ret = 1; 764 765 err: 766 if (salt) { 767 OPENSSL_free(salt); 768 } 769 770 return ret; 771 } 772
