1 /* 2 * Copyright 2014 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #include "rsa_operation.h" 18 19 #include <limits.h> 20 21 #include <new> 22 23 #include <openssl/err.h> 24 25 #include <keymaster/logger.h> 26 27 #include "openssl_err.h" 28 #include "openssl_utils.h" 29 #include "rsa_key.h" 30 31 namespace keymaster { 32 33 const size_t kPssOverhead = 2; 34 35 // Overhead for PKCS#1 v1.5 signature padding of undigested messages. Digested messages have 36 // additional overhead, for the digest algorithmIdentifier required by PKCS#1. 37 const size_t kPkcs1UndigestedSignaturePaddingOverhead = 11; 38 39 /* static */ 40 EVP_PKEY* RsaOperationFactory::GetRsaKey(const Key& key, keymaster_error_t* error) { 41 const RsaKey* rsa_key = static_cast<const RsaKey*>(&key); 42 assert(rsa_key); 43 if (!rsa_key || !rsa_key->key()) { 44 *error = KM_ERROR_UNKNOWN_ERROR; 45 return nullptr; 46 } 47 48 UniquePtr<EVP_PKEY, EVP_PKEY_Delete> pkey(EVP_PKEY_new()); 49 if (!rsa_key->InternalToEvp(pkey.get())) { 50 *error = KM_ERROR_UNKNOWN_ERROR; 51 return nullptr; 52 } 53 return pkey.release(); 54 } 55 56 static const keymaster_digest_t supported_digests[] = { 57 KM_DIGEST_NONE, KM_DIGEST_MD5, KM_DIGEST_SHA1, KM_DIGEST_SHA_2_224, 58 KM_DIGEST_SHA_2_256, KM_DIGEST_SHA_2_384, KM_DIGEST_SHA_2_512}; 59 60 const keymaster_digest_t* RsaOperationFactory::SupportedDigests(size_t* digest_count) const { 61 *digest_count = array_length(supported_digests); 62 return supported_digests; 63 } 64 65 RsaOperation* RsaOperationFactory::CreateRsaOperation(const Key& key, 66 const AuthorizationSet& begin_params, 67 keymaster_error_t* error) { 68 keymaster_padding_t padding; 69 if (!GetAndValidatePadding(begin_params, key, &padding, error)) 70 return nullptr; 71 72 bool require_digest = (purpose() == KM_PURPOSE_SIGN || purpose() == KM_PURPOSE_VERIFY || 73 padding == KM_PAD_RSA_OAEP); 74 75 keymaster_digest_t digest = KM_DIGEST_NONE; 76 if (require_digest && !GetAndValidateDigest(begin_params, key, &digest, error)) 77 return nullptr; 78 79 UniquePtr<EVP_PKEY, EVP_PKEY_Delete> rsa(GetRsaKey(key, error)); 80 if (!rsa.get()) 81 return nullptr; 82 83 RsaOperation* op = InstantiateOperation(digest, padding, rsa.release()); 84 if (!op) 85 *error = KM_ERROR_MEMORY_ALLOCATION_FAILED; 86 return op; 87 } 88 89 static const keymaster_padding_t supported_sig_padding[] = {KM_PAD_NONE, KM_PAD_RSA_PKCS1_1_5_SIGN, 90 KM_PAD_RSA_PSS}; 91 const keymaster_padding_t* 92 RsaDigestingOperationFactory::SupportedPaddingModes(size_t* padding_mode_count) const { 93 *padding_mode_count = array_length(supported_sig_padding); 94 return supported_sig_padding; 95 } 96 97 RsaOperation* RsaCryptingOperationFactory::CreateRsaOperation(const Key& key, 98 const AuthorizationSet& begin_params, 99 keymaster_error_t* error) { 100 UniquePtr<RsaOperation> op(RsaOperationFactory::CreateRsaOperation(key, begin_params, error)); 101 if (op.get()) { 102 switch (op->padding()) { 103 case KM_PAD_NONE: 104 case KM_PAD_RSA_PKCS1_1_5_ENCRYPT: 105 if (op->digest() != KM_DIGEST_NONE) { 106 *error = KM_ERROR_INCOMPATIBLE_DIGEST; 107 return nullptr; 108 } 109 break; 110 111 case KM_PAD_RSA_OAEP: 112 if (op->digest() == KM_DIGEST_NONE) { 113 *error = KM_ERROR_INCOMPATIBLE_DIGEST; 114 return nullptr; 115 } 116 break; 117 118 default: 119 *error = KM_ERROR_UNSUPPORTED_PADDING_MODE; 120 return nullptr; 121 } 122 } 123 return op.release(); 124 } 125 126 static const keymaster_padding_t supported_crypt_padding[] = {KM_PAD_NONE, KM_PAD_RSA_OAEP, 127 KM_PAD_RSA_PKCS1_1_5_ENCRYPT}; 128 const keymaster_padding_t* 129 RsaCryptingOperationFactory::SupportedPaddingModes(size_t* padding_mode_count) const { 130 *padding_mode_count = array_length(supported_crypt_padding); 131 return supported_crypt_padding; 132 } 133 134 RsaOperation::~RsaOperation() { 135 if (rsa_key_ != NULL) 136 EVP_PKEY_free(rsa_key_); 137 } 138 139 keymaster_error_t RsaOperation::Begin(const AuthorizationSet& /* input_params */, 140 AuthorizationSet* /* output_params */) { 141 return InitDigest(); 142 } 143 144 keymaster_error_t RsaOperation::Update(const AuthorizationSet& /* additional_params */, 145 const Buffer& input, AuthorizationSet* /* output_params */, 146 Buffer* /* output */, size_t* input_consumed) { 147 assert(input_consumed); 148 switch (purpose()) { 149 default: 150 return KM_ERROR_UNIMPLEMENTED; 151 case KM_PURPOSE_SIGN: 152 case KM_PURPOSE_VERIFY: 153 case KM_PURPOSE_ENCRYPT: 154 case KM_PURPOSE_DECRYPT: 155 return StoreData(input, input_consumed); 156 } 157 } 158 159 keymaster_error_t RsaOperation::StoreData(const Buffer& input, size_t* input_consumed) { 160 assert(input_consumed); 161 162 if (!data_.reserve(EVP_PKEY_size(rsa_key_))) 163 return KM_ERROR_MEMORY_ALLOCATION_FAILED; 164 // If the write fails, it's because input length exceeds key size. 165 if (!data_.write(input.peek_read(), input.available_read())) { 166 LOG_E("Input too long: cannot operate on %u bytes of data with %u-byte RSA key", 167 input.available_read() + data_.available_read(), EVP_PKEY_size(rsa_key_)); 168 return KM_ERROR_INVALID_INPUT_LENGTH; 169 } 170 171 *input_consumed = input.available_read(); 172 return KM_ERROR_OK; 173 } 174 175 keymaster_error_t RsaOperation::SetRsaPaddingInEvpContext(EVP_PKEY_CTX* pkey_ctx, bool signing) { 176 keymaster_error_t error; 177 int openssl_padding = GetOpensslPadding(&error); 178 if (error != KM_ERROR_OK) 179 return error; 180 181 if (EVP_PKEY_CTX_set_rsa_padding(pkey_ctx, openssl_padding) <= 0) 182 return TranslateLastOpenSslError(); 183 184 if (signing && openssl_padding == RSA_PKCS1_PSS_PADDING) { 185 // Also need to set the length of the salt used in the padding generation. We set it equal 186 // to the length of the selected digest. 187 assert(digest_algorithm_); 188 if (EVP_PKEY_CTX_set_rsa_pss_saltlen(pkey_ctx, EVP_MD_size(digest_algorithm_)) <= 0) 189 return TranslateLastOpenSslError(); 190 } 191 192 return KM_ERROR_OK; 193 } 194 195 keymaster_error_t RsaOperation::InitDigest() { 196 if (digest_ == KM_DIGEST_NONE) { 197 if (require_digest()) 198 return KM_ERROR_INCOMPATIBLE_DIGEST; 199 return KM_ERROR_OK; 200 } 201 202 switch (digest_) { 203 case KM_DIGEST_NONE: 204 return KM_ERROR_OK; 205 case KM_DIGEST_MD5: 206 digest_algorithm_ = EVP_md5(); 207 return KM_ERROR_OK; 208 case KM_DIGEST_SHA1: 209 digest_algorithm_ = EVP_sha1(); 210 return KM_ERROR_OK; 211 case KM_DIGEST_SHA_2_224: 212 digest_algorithm_ = EVP_sha224(); 213 return KM_ERROR_OK; 214 case KM_DIGEST_SHA_2_256: 215 digest_algorithm_ = EVP_sha256(); 216 return KM_ERROR_OK; 217 case KM_DIGEST_SHA_2_384: 218 digest_algorithm_ = EVP_sha384(); 219 return KM_ERROR_OK; 220 case KM_DIGEST_SHA_2_512: 221 digest_algorithm_ = EVP_sha512(); 222 return KM_ERROR_OK; 223 default: 224 return KM_ERROR_UNSUPPORTED_DIGEST; 225 } 226 } 227 228 RsaDigestingOperation::RsaDigestingOperation(keymaster_purpose_t purpose, keymaster_digest_t digest, 229 keymaster_padding_t padding, EVP_PKEY* key) 230 : RsaOperation(purpose, digest, padding, key) { 231 EVP_MD_CTX_init(&digest_ctx_); 232 } 233 RsaDigestingOperation::~RsaDigestingOperation() { 234 EVP_MD_CTX_cleanup(&digest_ctx_); 235 } 236 237 int RsaDigestingOperation::GetOpensslPadding(keymaster_error_t* error) { 238 *error = KM_ERROR_OK; 239 switch (padding_) { 240 case KM_PAD_NONE: 241 return RSA_NO_PADDING; 242 case KM_PAD_RSA_PKCS1_1_5_SIGN: 243 return RSA_PKCS1_PADDING; 244 case KM_PAD_RSA_PSS: 245 if (digest_ == KM_DIGEST_NONE) { 246 *error = KM_ERROR_INCOMPATIBLE_PADDING_MODE; 247 return -1; 248 } 249 if (EVP_MD_size(digest_algorithm_) * 2 + kPssOverhead > (size_t)EVP_PKEY_size(rsa_key_)) { 250 LOG_E("Input too long: %d-byte digest cannot be used with %d-byte RSA key in PSS " 251 "padding mode", 252 EVP_MD_size(digest_algorithm_), EVP_PKEY_size(rsa_key_)); 253 *error = KM_ERROR_INCOMPATIBLE_DIGEST; 254 return -1; 255 } 256 return RSA_PKCS1_PSS_PADDING; 257 default: 258 return -1; 259 } 260 } 261 262 keymaster_error_t RsaSignOperation::Begin(const AuthorizationSet& input_params, 263 AuthorizationSet* output_params) { 264 keymaster_error_t error = RsaDigestingOperation::Begin(input_params, output_params); 265 if (error != KM_ERROR_OK) 266 return error; 267 268 if (digest_ == KM_DIGEST_NONE) 269 return KM_ERROR_OK; 270 271 EVP_PKEY_CTX* pkey_ctx; 272 if (EVP_DigestSignInit(&digest_ctx_, &pkey_ctx, digest_algorithm_, nullptr /* engine */, 273 rsa_key_) != 1) 274 return TranslateLastOpenSslError(); 275 return SetRsaPaddingInEvpContext(pkey_ctx, true /* signing */); 276 } 277 278 keymaster_error_t RsaSignOperation::Update(const AuthorizationSet& additional_params, 279 const Buffer& input, AuthorizationSet* output_params, 280 Buffer* output, size_t* input_consumed) { 281 if (digest_ == KM_DIGEST_NONE) 282 // Just buffer the data. 283 return RsaOperation::Update(additional_params, input, output_params, output, 284 input_consumed); 285 286 if (EVP_DigestSignUpdate(&digest_ctx_, input.peek_read(), input.available_read()) != 1) 287 return TranslateLastOpenSslError(); 288 *input_consumed = input.available_read(); 289 return KM_ERROR_OK; 290 } 291 292 keymaster_error_t RsaSignOperation::Finish(const AuthorizationSet& additional_params, 293 const Buffer& input, const Buffer& /* signature */, 294 AuthorizationSet* /* output_params */, Buffer* output) { 295 assert(output); 296 297 keymaster_error_t error = UpdateForFinish(additional_params, input); 298 if (error != KM_ERROR_OK) 299 return error; 300 301 if (digest_ == KM_DIGEST_NONE) 302 return SignUndigested(output); 303 else 304 return SignDigested(output); 305 } 306 307 static keymaster_error_t zero_pad_left(UniquePtr<uint8_t[]>* dest, size_t padded_len, Buffer& src) { 308 assert(padded_len > src.available_read()); 309 310 dest->reset(new uint8_t[padded_len]); 311 if (!dest->get()) 312 return KM_ERROR_MEMORY_ALLOCATION_FAILED; 313 314 size_t padding_len = padded_len - src.available_read(); 315 memset(dest->get(), 0, padding_len); 316 if (!src.read(dest->get() + padding_len, src.available_read())) 317 return KM_ERROR_UNKNOWN_ERROR; 318 319 return KM_ERROR_OK; 320 } 321 322 keymaster_error_t RsaSignOperation::SignUndigested(Buffer* output) { 323 UniquePtr<RSA, RSA_Delete> rsa(EVP_PKEY_get1_RSA(const_cast<EVP_PKEY*>(rsa_key_))); 324 if (!rsa.get()) 325 return TranslateLastOpenSslError(); 326 327 if (!output->Reinitialize(RSA_size(rsa.get()))) 328 return KM_ERROR_MEMORY_ALLOCATION_FAILED; 329 330 size_t key_len = EVP_PKEY_size(rsa_key_); 331 int bytes_encrypted; 332 switch (padding_) { 333 case KM_PAD_NONE: { 334 const uint8_t* to_encrypt = data_.peek_read(); 335 UniquePtr<uint8_t[]> zero_padded; 336 if (data_.available_read() > key_len) { 337 return KM_ERROR_INVALID_INPUT_LENGTH; 338 } else if (data_.available_read() < key_len) { 339 keymaster_error_t error = zero_pad_left(&zero_padded, key_len, data_); 340 if (error != KM_ERROR_OK) 341 return error; 342 to_encrypt = zero_padded.get(); 343 } 344 bytes_encrypted = RSA_private_encrypt(key_len, to_encrypt, output->peek_write(), rsa.get(), 345 RSA_NO_PADDING); 346 break; 347 } 348 case KM_PAD_RSA_PKCS1_1_5_SIGN: 349 // Does PKCS1 padding without digesting even make sense? Dunno. We'll support it. 350 if (data_.available_read() + kPkcs1UndigestedSignaturePaddingOverhead > key_len) { 351 LOG_E("Input too long: cannot sign %u-byte message with PKCS1 padding with %u-bit key", 352 data_.available_read(), EVP_PKEY_size(rsa_key_) * 8); 353 return KM_ERROR_INVALID_INPUT_LENGTH; 354 } 355 bytes_encrypted = RSA_private_encrypt(data_.available_read(), data_.peek_read(), 356 output->peek_write(), rsa.get(), RSA_PKCS1_PADDING); 357 break; 358 359 default: 360 return KM_ERROR_UNSUPPORTED_PADDING_MODE; 361 } 362 363 if (bytes_encrypted <= 0) 364 return TranslateLastOpenSslError(); 365 if (!output->advance_write(bytes_encrypted)) 366 return KM_ERROR_UNKNOWN_ERROR; 367 return KM_ERROR_OK; 368 } 369 370 keymaster_error_t RsaSignOperation::SignDigested(Buffer* output) { 371 size_t siglen; 372 if (EVP_DigestSignFinal(&digest_ctx_, nullptr /* signature */, &siglen) != 1) 373 return TranslateLastOpenSslError(); 374 375 if (!output->Reinitialize(siglen)) 376 return KM_ERROR_MEMORY_ALLOCATION_FAILED; 377 378 if (EVP_DigestSignFinal(&digest_ctx_, output->peek_write(), &siglen) <= 0) 379 return TranslateLastOpenSslError(); 380 if (!output->advance_write(siglen)) 381 return KM_ERROR_UNKNOWN_ERROR; 382 383 return KM_ERROR_OK; 384 } 385 386 keymaster_error_t RsaVerifyOperation::Begin(const AuthorizationSet& input_params, 387 AuthorizationSet* output_params) { 388 keymaster_error_t error = RsaDigestingOperation::Begin(input_params, output_params); 389 if (error != KM_ERROR_OK) 390 return error; 391 392 if (digest_ == KM_DIGEST_NONE) 393 return KM_ERROR_OK; 394 395 EVP_PKEY_CTX* pkey_ctx; 396 if (EVP_DigestVerifyInit(&digest_ctx_, &pkey_ctx, digest_algorithm_, NULL, rsa_key_) != 1) 397 return TranslateLastOpenSslError(); 398 return SetRsaPaddingInEvpContext(pkey_ctx, false /* signing */); 399 } 400 401 keymaster_error_t RsaVerifyOperation::Update(const AuthorizationSet& additional_params, 402 const Buffer& input, AuthorizationSet* output_params, 403 Buffer* output, size_t* input_consumed) { 404 if (digest_ == KM_DIGEST_NONE) 405 // Just buffer the data. 406 return RsaOperation::Update(additional_params, input, output_params, output, 407 input_consumed); 408 409 if (EVP_DigestVerifyUpdate(&digest_ctx_, input.peek_read(), input.available_read()) != 1) 410 return TranslateLastOpenSslError(); 411 *input_consumed = input.available_read(); 412 return KM_ERROR_OK; 413 } 414 415 keymaster_error_t RsaVerifyOperation::Finish(const AuthorizationSet& additional_params, 416 const Buffer& input, const Buffer& signature, 417 AuthorizationSet* /* output_params */, 418 Buffer* /* output */) { 419 keymaster_error_t error = UpdateForFinish(additional_params, input); 420 if (error != KM_ERROR_OK) 421 return error; 422 423 if (digest_ == KM_DIGEST_NONE) 424 return VerifyUndigested(signature); 425 else 426 return VerifyDigested(signature); 427 } 428 429 keymaster_error_t RsaVerifyOperation::VerifyUndigested(const Buffer& signature) { 430 UniquePtr<RSA, RSA_Delete> rsa(EVP_PKEY_get1_RSA(const_cast<EVP_PKEY*>(rsa_key_))); 431 if (!rsa.get()) 432 return KM_ERROR_UNKNOWN_ERROR; 433 434 size_t key_len = RSA_size(rsa.get()); 435 int openssl_padding; 436 switch (padding_) { 437 case KM_PAD_NONE: 438 if (data_.available_read() > key_len) 439 return KM_ERROR_INVALID_INPUT_LENGTH; 440 if (key_len != signature.available_read()) 441 return KM_ERROR_VERIFICATION_FAILED; 442 openssl_padding = RSA_NO_PADDING; 443 break; 444 case KM_PAD_RSA_PKCS1_1_5_SIGN: 445 if (data_.available_read() + kPkcs1UndigestedSignaturePaddingOverhead > key_len) { 446 LOG_E("Input too long: cannot verify %u-byte message with PKCS1 padding && %u-bit key", 447 data_.available_read(), key_len * 8); 448 return KM_ERROR_INVALID_INPUT_LENGTH; 449 } 450 openssl_padding = RSA_PKCS1_PADDING; 451 break; 452 default: 453 return KM_ERROR_UNSUPPORTED_PADDING_MODE; 454 } 455 456 UniquePtr<uint8_t[]> decrypted_data(new (std::nothrow) uint8_t[key_len]); 457 if (!decrypted_data.get()) 458 return KM_ERROR_MEMORY_ALLOCATION_FAILED; 459 int bytes_decrypted = RSA_public_decrypt(signature.available_read(), signature.peek_read(), 460 decrypted_data.get(), rsa.get(), openssl_padding); 461 if (bytes_decrypted < 0) 462 return KM_ERROR_VERIFICATION_FAILED; 463 464 const uint8_t* compare_pos = decrypted_data.get(); 465 size_t bytes_to_compare = bytes_decrypted; 466 uint8_t zero_check_result = 0; 467 if (padding_ == KM_PAD_NONE && data_.available_read() < bytes_to_compare) { 468 // If the data is short, for "unpadded" signing we zero-pad to the left. So during 469 // verification we should have zeros on the left of the decrypted data. Do a constant-time 470 // check. 471 const uint8_t* zero_end = compare_pos + bytes_to_compare - data_.available_read(); 472 while (compare_pos < zero_end) 473 zero_check_result |= *compare_pos++; 474 bytes_to_compare = data_.available_read(); 475 } 476 if (memcmp_s(compare_pos, data_.peek_read(), bytes_to_compare) != 0 || zero_check_result != 0) 477 return KM_ERROR_VERIFICATION_FAILED; 478 return KM_ERROR_OK; 479 } 480 481 keymaster_error_t RsaVerifyOperation::VerifyDigested(const Buffer& signature) { 482 if (!EVP_DigestVerifyFinal(&digest_ctx_, signature.peek_read(), signature.available_read())) 483 return KM_ERROR_VERIFICATION_FAILED; 484 return KM_ERROR_OK; 485 } 486 487 keymaster_error_t RsaCryptOperation::SetOaepDigestIfRequired(EVP_PKEY_CTX* pkey_ctx) { 488 if (padding() != KM_PAD_RSA_OAEP) 489 return KM_ERROR_OK; 490 491 assert(digest_algorithm_ != nullptr); 492 if (!EVP_PKEY_CTX_set_rsa_oaep_md(pkey_ctx, digest_algorithm_)) 493 return TranslateLastOpenSslError(); 494 495 // MGF1 MD is always SHA1. 496 if (!EVP_PKEY_CTX_set_rsa_mgf1_md(pkey_ctx, EVP_sha1())) 497 return TranslateLastOpenSslError(); 498 499 return KM_ERROR_OK; 500 } 501 502 int RsaCryptOperation::GetOpensslPadding(keymaster_error_t* error) { 503 *error = KM_ERROR_OK; 504 switch (padding_) { 505 case KM_PAD_NONE: 506 return RSA_NO_PADDING; 507 case KM_PAD_RSA_PKCS1_1_5_ENCRYPT: 508 return RSA_PKCS1_PADDING; 509 case KM_PAD_RSA_OAEP: 510 return RSA_PKCS1_OAEP_PADDING; 511 default: 512 return -1; 513 } 514 } 515 516 struct EVP_PKEY_CTX_Delete { 517 void operator()(EVP_PKEY_CTX* p) { EVP_PKEY_CTX_free(p); } 518 }; 519 520 keymaster_error_t RsaEncryptOperation::Finish(const AuthorizationSet& additional_params, 521 const Buffer& input, const Buffer& /* signature */, 522 AuthorizationSet* /* output_params */, 523 Buffer* output) { 524 if (!output) 525 return KM_ERROR_OUTPUT_PARAMETER_NULL; 526 527 keymaster_error_t error = UpdateForFinish(additional_params, input); 528 if (error != KM_ERROR_OK) 529 return error; 530 531 UniquePtr<EVP_PKEY_CTX, EVP_PKEY_CTX_Delete> ctx( 532 EVP_PKEY_CTX_new(rsa_key_, nullptr /* engine */)); 533 if (!ctx.get()) 534 return KM_ERROR_MEMORY_ALLOCATION_FAILED; 535 536 if (EVP_PKEY_encrypt_init(ctx.get()) <= 0) 537 return TranslateLastOpenSslError(); 538 539 error = SetRsaPaddingInEvpContext(ctx.get(), false /* signing */); 540 if (error != KM_ERROR_OK) 541 return error; 542 error = SetOaepDigestIfRequired(ctx.get()); 543 if (error != KM_ERROR_OK) 544 return error; 545 546 size_t outlen; 547 if (EVP_PKEY_encrypt(ctx.get(), nullptr /* out */, &outlen, data_.peek_read(), 548 data_.available_read()) <= 0) 549 return TranslateLastOpenSslError(); 550 551 if (!output->Reinitialize(outlen)) 552 return KM_ERROR_MEMORY_ALLOCATION_FAILED; 553 554 const uint8_t* to_encrypt = data_.peek_read(); 555 size_t to_encrypt_len = data_.available_read(); 556 UniquePtr<uint8_t[]> zero_padded; 557 if (padding_ == KM_PAD_NONE && to_encrypt_len < outlen) { 558 keymaster_error_t error = zero_pad_left(&zero_padded, outlen, data_); 559 if (error != KM_ERROR_OK) 560 return error; 561 to_encrypt = zero_padded.get(); 562 to_encrypt_len = outlen; 563 } 564 565 if (EVP_PKEY_encrypt(ctx.get(), output->peek_write(), &outlen, to_encrypt, to_encrypt_len) <= 0) 566 return TranslateLastOpenSslError(); 567 if (!output->advance_write(outlen)) 568 return KM_ERROR_UNKNOWN_ERROR; 569 570 return KM_ERROR_OK; 571 } 572 573 keymaster_error_t RsaDecryptOperation::Finish(const AuthorizationSet& additional_params, 574 const Buffer& input, const Buffer& /* signature */, 575 AuthorizationSet* /* output_params */, 576 Buffer* output) { 577 if (!output) 578 return KM_ERROR_OUTPUT_PARAMETER_NULL; 579 580 keymaster_error_t error = UpdateForFinish(additional_params, input); 581 if (error != KM_ERROR_OK) 582 return error; 583 584 UniquePtr<EVP_PKEY_CTX, EVP_PKEY_CTX_Delete> ctx( 585 EVP_PKEY_CTX_new(rsa_key_, nullptr /* engine */)); 586 if (!ctx.get()) 587 return KM_ERROR_MEMORY_ALLOCATION_FAILED; 588 589 if (EVP_PKEY_decrypt_init(ctx.get()) <= 0) 590 return TranslateLastOpenSslError(); 591 592 error = SetRsaPaddingInEvpContext(ctx.get(), false /* signing */); 593 if (error != KM_ERROR_OK) 594 return error; 595 error = SetOaepDigestIfRequired(ctx.get()); 596 if (error != KM_ERROR_OK) 597 return error; 598 599 size_t outlen; 600 if (EVP_PKEY_decrypt(ctx.get(), nullptr /* out */, &outlen, data_.peek_read(), 601 data_.available_read()) <= 0) 602 return TranslateLastOpenSslError(); 603 604 if (!output->Reinitialize(outlen)) 605 return KM_ERROR_MEMORY_ALLOCATION_FAILED; 606 607 const uint8_t* to_decrypt = data_.peek_read(); 608 size_t to_decrypt_len = data_.available_read(); 609 UniquePtr<uint8_t[]> zero_padded; 610 if (padding_ == KM_PAD_NONE && to_decrypt_len < outlen) { 611 keymaster_error_t error = zero_pad_left(&zero_padded, outlen, data_); 612 if (error != KM_ERROR_OK) 613 return error; 614 to_decrypt = zero_padded.get(); 615 to_decrypt_len = outlen; 616 } 617 618 if (EVP_PKEY_decrypt(ctx.get(), output->peek_write(), &outlen, to_decrypt, to_decrypt_len) <= 0) 619 return TranslateLastOpenSslError(); 620 if (!output->advance_write(outlen)) 621 return KM_ERROR_UNKNOWN_ERROR; 622 623 return KM_ERROR_OK; 624 } 625 626 } // namespace keymaster 627
