1 /*
2 * Copyright 2006-2023 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the OpenSSL license (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10 #include <stdio.h>
11 #include "internal/cryptlib.h"
12 #include <openssl/asn1t.h>
13 #include <openssl/x509.h>
14 #include <openssl/bn.h>
15 #include <openssl/cms.h>
16 #include "crypto/asn1.h"
17 #include "crypto/evp.h"
18 #include "rsa_local.h"
19
20 #ifndef OPENSSL_NO_CMS
21 static int rsa_cms_sign(CMS_SignerInfo *si);
22 static int rsa_cms_verify(CMS_SignerInfo *si);
23 static int rsa_cms_decrypt(CMS_RecipientInfo *ri);
24 static int rsa_cms_encrypt(CMS_RecipientInfo *ri);
25 #endif
26
27 static RSA_PSS_PARAMS *rsa_pss_decode(const X509_ALGOR *alg);
28
29 /* Set any parameters associated with pkey */
rsa_param_encode(const EVP_PKEY * pkey,ASN1_STRING ** pstr,int * pstrtype)30 static int rsa_param_encode(const EVP_PKEY *pkey,
31 ASN1_STRING **pstr, int *pstrtype)
32 {
33 const RSA *rsa = pkey->pkey.rsa;
34
35 *pstr = NULL;
36 /* If RSA it's just NULL type */
37 if (pkey->ameth->pkey_id != EVP_PKEY_RSA_PSS) {
38 *pstrtype = V_ASN1_NULL;
39 return 1;
40 }
41 /* If no PSS parameters we omit parameters entirely */
42 if (rsa->pss == NULL) {
43 *pstrtype = V_ASN1_UNDEF;
44 return 1;
45 }
46 /* Encode PSS parameters */
47 if (ASN1_item_pack(rsa->pss, ASN1_ITEM_rptr(RSA_PSS_PARAMS), pstr) == NULL)
48 return 0;
49
50 *pstrtype = V_ASN1_SEQUENCE;
51 return 1;
52 }
53 /* Decode any parameters and set them in RSA structure */
rsa_param_decode(RSA * rsa,const X509_ALGOR * alg)54 static int rsa_param_decode(RSA *rsa, const X509_ALGOR *alg)
55 {
56 const ASN1_OBJECT *algoid;
57 const void *algp;
58 int algptype;
59
60 X509_ALGOR_get0(&algoid, &algptype, &algp, alg);
61 if (OBJ_obj2nid(algoid) != EVP_PKEY_RSA_PSS)
62 return 1;
63 if (algptype == V_ASN1_UNDEF)
64 return 1;
65 if (algptype != V_ASN1_SEQUENCE) {
66 RSAerr(RSA_F_RSA_PARAM_DECODE, RSA_R_INVALID_PSS_PARAMETERS);
67 return 0;
68 }
69 rsa->pss = rsa_pss_decode(alg);
70 if (rsa->pss == NULL)
71 return 0;
72 return 1;
73 }
74
rsa_pub_encode(X509_PUBKEY * pk,const EVP_PKEY * pkey)75 static int rsa_pub_encode(X509_PUBKEY *pk, const EVP_PKEY *pkey)
76 {
77 unsigned char *penc = NULL;
78 int penclen;
79 ASN1_STRING *str;
80 int strtype;
81
82 if (!rsa_param_encode(pkey, &str, &strtype))
83 return 0;
84 penclen = i2d_RSAPublicKey(pkey->pkey.rsa, &penc);
85 if (penclen <= 0) {
86 ASN1_STRING_free(str);
87 return 0;
88 }
89 if (X509_PUBKEY_set0_param(pk, OBJ_nid2obj(pkey->ameth->pkey_id),
90 strtype, str, penc, penclen))
91 return 1;
92
93 OPENSSL_free(penc);
94 ASN1_STRING_free(str);
95 return 0;
96 }
97
rsa_pub_decode(EVP_PKEY * pkey,X509_PUBKEY * pubkey)98 static int rsa_pub_decode(EVP_PKEY *pkey, X509_PUBKEY *pubkey)
99 {
100 const unsigned char *p;
101 int pklen;
102 X509_ALGOR *alg;
103 RSA *rsa = NULL;
104
105 if (!X509_PUBKEY_get0_param(NULL, &p, &pklen, &alg, pubkey))
106 return 0;
107 if ((rsa = d2i_RSAPublicKey(NULL, &p, pklen)) == NULL) {
108 RSAerr(RSA_F_RSA_PUB_DECODE, ERR_R_RSA_LIB);
109 return 0;
110 }
111 if (!rsa_param_decode(rsa, alg)) {
112 RSA_free(rsa);
113 return 0;
114 }
115 if (!EVP_PKEY_assign(pkey, pkey->ameth->pkey_id, rsa)) {
116 RSA_free(rsa);
117 return 0;
118 }
119 return 1;
120 }
121
rsa_pub_cmp(const EVP_PKEY * a,const EVP_PKEY * b)122 static int rsa_pub_cmp(const EVP_PKEY *a, const EVP_PKEY *b)
123 {
124 /*
125 * Don't check the public/private key, this is mostly for smart
126 * cards.
127 */
128 if (((RSA_flags(a->pkey.rsa) & RSA_METHOD_FLAG_NO_CHECK))
129 || (RSA_flags(b->pkey.rsa) & RSA_METHOD_FLAG_NO_CHECK)) {
130 return 1;
131 }
132
133 if (BN_cmp(b->pkey.rsa->n, a->pkey.rsa->n) != 0
134 || BN_cmp(b->pkey.rsa->e, a->pkey.rsa->e) != 0)
135 return 0;
136 return 1;
137 }
138
old_rsa_priv_decode(EVP_PKEY * pkey,const unsigned char ** pder,int derlen)139 static int old_rsa_priv_decode(EVP_PKEY *pkey,
140 const unsigned char **pder, int derlen)
141 {
142 RSA *rsa;
143
144 if ((rsa = d2i_RSAPrivateKey(NULL, pder, derlen)) == NULL) {
145 RSAerr(RSA_F_OLD_RSA_PRIV_DECODE, ERR_R_RSA_LIB);
146 return 0;
147 }
148 EVP_PKEY_assign(pkey, pkey->ameth->pkey_id, rsa);
149 return 1;
150 }
151
old_rsa_priv_encode(const EVP_PKEY * pkey,unsigned char ** pder)152 static int old_rsa_priv_encode(const EVP_PKEY *pkey, unsigned char **pder)
153 {
154 return i2d_RSAPrivateKey(pkey->pkey.rsa, pder);
155 }
156
rsa_priv_encode(PKCS8_PRIV_KEY_INFO * p8,const EVP_PKEY * pkey)157 static int rsa_priv_encode(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pkey)
158 {
159 unsigned char *rk = NULL;
160 int rklen;
161 ASN1_STRING *str;
162 int strtype;
163
164 if (!rsa_param_encode(pkey, &str, &strtype))
165 return 0;
166 rklen = i2d_RSAPrivateKey(pkey->pkey.rsa, &rk);
167
168 if (rklen <= 0) {
169 RSAerr(RSA_F_RSA_PRIV_ENCODE, ERR_R_MALLOC_FAILURE);
170 ASN1_STRING_free(str);
171 return 0;
172 }
173
174 if (!PKCS8_pkey_set0(p8, OBJ_nid2obj(pkey->ameth->pkey_id), 0,
175 strtype, str, rk, rklen)) {
176 RSAerr(RSA_F_RSA_PRIV_ENCODE, ERR_R_MALLOC_FAILURE);
177 ASN1_STRING_free(str);
178 OPENSSL_clear_free(rk, rklen);
179 return 0;
180 }
181
182 return 1;
183 }
184
rsa_priv_decode(EVP_PKEY * pkey,const PKCS8_PRIV_KEY_INFO * p8)185 static int rsa_priv_decode(EVP_PKEY *pkey, const PKCS8_PRIV_KEY_INFO *p8)
186 {
187 const unsigned char *p;
188 RSA *rsa;
189 int pklen;
190 const X509_ALGOR *alg;
191
192 if (!PKCS8_pkey_get0(NULL, &p, &pklen, &alg, p8))
193 return 0;
194 rsa = d2i_RSAPrivateKey(NULL, &p, pklen);
195 if (rsa == NULL) {
196 RSAerr(RSA_F_RSA_PRIV_DECODE, ERR_R_RSA_LIB);
197 return 0;
198 }
199 if (!rsa_param_decode(rsa, alg)) {
200 RSA_free(rsa);
201 return 0;
202 }
203 EVP_PKEY_assign(pkey, pkey->ameth->pkey_id, rsa);
204 return 1;
205 }
206
int_rsa_size(const EVP_PKEY * pkey)207 static int int_rsa_size(const EVP_PKEY *pkey)
208 {
209 return RSA_size(pkey->pkey.rsa);
210 }
211
rsa_bits(const EVP_PKEY * pkey)212 static int rsa_bits(const EVP_PKEY *pkey)
213 {
214 return BN_num_bits(pkey->pkey.rsa->n);
215 }
216
rsa_security_bits(const EVP_PKEY * pkey)217 static int rsa_security_bits(const EVP_PKEY *pkey)
218 {
219 return RSA_security_bits(pkey->pkey.rsa);
220 }
221
int_rsa_free(EVP_PKEY * pkey)222 static void int_rsa_free(EVP_PKEY *pkey)
223 {
224 RSA_free(pkey->pkey.rsa);
225 }
226
rsa_mgf1_decode(X509_ALGOR * alg)227 static X509_ALGOR *rsa_mgf1_decode(X509_ALGOR *alg)
228 {
229 if (OBJ_obj2nid(alg->algorithm) != NID_mgf1)
230 return NULL;
231 return ASN1_TYPE_unpack_sequence(ASN1_ITEM_rptr(X509_ALGOR),
232 alg->parameter);
233 }
234
rsa_pss_param_print(BIO * bp,int pss_key,RSA_PSS_PARAMS * pss,int indent)235 static int rsa_pss_param_print(BIO *bp, int pss_key, RSA_PSS_PARAMS *pss,
236 int indent)
237 {
238 int rv = 0;
239 X509_ALGOR *maskHash = NULL;
240
241 if (!BIO_indent(bp, indent, 128))
242 goto err;
243 if (pss_key) {
244 if (pss == NULL) {
245 if (BIO_puts(bp, "No PSS parameter restrictions\n") <= 0)
246 return 0;
247 return 1;
248 } else {
249 if (BIO_puts(bp, "PSS parameter restrictions:") <= 0)
250 return 0;
251 }
252 } else if (pss == NULL) {
253 if (BIO_puts(bp,"(INVALID PSS PARAMETERS)\n") <= 0)
254 return 0;
255 return 1;
256 }
257 if (BIO_puts(bp, "\n") <= 0)
258 goto err;
259 if (pss_key)
260 indent += 2;
261 if (!BIO_indent(bp, indent, 128))
262 goto err;
263 if (BIO_puts(bp, "Hash Algorithm: ") <= 0)
264 goto err;
265
266 if (pss->hashAlgorithm) {
267 if (i2a_ASN1_OBJECT(bp, pss->hashAlgorithm->algorithm) <= 0)
268 goto err;
269 } else if (BIO_puts(bp, "sha1 (default)") <= 0) {
270 goto err;
271 }
272
273 if (BIO_puts(bp, "\n") <= 0)
274 goto err;
275
276 if (!BIO_indent(bp, indent, 128))
277 goto err;
278
279 if (BIO_puts(bp, "Mask Algorithm: ") <= 0)
280 goto err;
281 if (pss->maskGenAlgorithm) {
282 if (i2a_ASN1_OBJECT(bp, pss->maskGenAlgorithm->algorithm) <= 0)
283 goto err;
284 if (BIO_puts(bp, " with ") <= 0)
285 goto err;
286 maskHash = rsa_mgf1_decode(pss->maskGenAlgorithm);
287 if (maskHash != NULL) {
288 if (i2a_ASN1_OBJECT(bp, maskHash->algorithm) <= 0)
289 goto err;
290 } else if (BIO_puts(bp, "INVALID") <= 0) {
291 goto err;
292 }
293 } else if (BIO_puts(bp, "mgf1 with sha1 (default)") <= 0) {
294 goto err;
295 }
296 BIO_puts(bp, "\n");
297
298 if (!BIO_indent(bp, indent, 128))
299 goto err;
300 if (BIO_printf(bp, "%s Salt Length: 0x", pss_key ? "Minimum" : "") <= 0)
301 goto err;
302 if (pss->saltLength) {
303 if (i2a_ASN1_INTEGER(bp, pss->saltLength) <= 0)
304 goto err;
305 } else if (BIO_puts(bp, "14 (default)") <= 0) {
306 goto err;
307 }
308 BIO_puts(bp, "\n");
309
310 if (!BIO_indent(bp, indent, 128))
311 goto err;
312 if (BIO_puts(bp, "Trailer Field: 0x") <= 0)
313 goto err;
314 if (pss->trailerField) {
315 if (i2a_ASN1_INTEGER(bp, pss->trailerField) <= 0)
316 goto err;
317 } else if (BIO_puts(bp, "BC (default)") <= 0) {
318 goto err;
319 }
320 BIO_puts(bp, "\n");
321
322 rv = 1;
323
324 err:
325 X509_ALGOR_free(maskHash);
326 return rv;
327
328 }
329
pkey_rsa_print(BIO * bp,const EVP_PKEY * pkey,int off,int priv)330 static int pkey_rsa_print(BIO *bp, const EVP_PKEY *pkey, int off, int priv)
331 {
332 const RSA *x = pkey->pkey.rsa;
333 char *str;
334 const char *s;
335 int ret = 0, mod_len = 0, ex_primes;
336
337 if (x->n != NULL)
338 mod_len = BN_num_bits(x->n);
339 ex_primes = sk_RSA_PRIME_INFO_num(x->prime_infos);
340
341 if (!BIO_indent(bp, off, 128))
342 goto err;
343
344 if (BIO_printf(bp, "%s ", pkey_is_pss(pkey) ? "RSA-PSS" : "RSA") <= 0)
345 goto err;
346
347 if (priv && x->d) {
348 if (BIO_printf(bp, "Private-Key: (%d bit, %d primes)\n",
349 mod_len, ex_primes <= 0 ? 2 : ex_primes + 2) <= 0)
350 goto err;
351 str = "modulus:";
352 s = "publicExponent:";
353 } else {
354 if (BIO_printf(bp, "Public-Key: (%d bit)\n", mod_len) <= 0)
355 goto err;
356 str = "Modulus:";
357 s = "Exponent:";
358 }
359 if (!ASN1_bn_print(bp, str, x->n, NULL, off))
360 goto err;
361 if (!ASN1_bn_print(bp, s, x->e, NULL, off))
362 goto err;
363 if (priv) {
364 int i;
365
366 if (!ASN1_bn_print(bp, "privateExponent:", x->d, NULL, off))
367 goto err;
368 if (!ASN1_bn_print(bp, "prime1:", x->p, NULL, off))
369 goto err;
370 if (!ASN1_bn_print(bp, "prime2:", x->q, NULL, off))
371 goto err;
372 if (!ASN1_bn_print(bp, "exponent1:", x->dmp1, NULL, off))
373 goto err;
374 if (!ASN1_bn_print(bp, "exponent2:", x->dmq1, NULL, off))
375 goto err;
376 if (!ASN1_bn_print(bp, "coefficient:", x->iqmp, NULL, off))
377 goto err;
378 for (i = 0; i < sk_RSA_PRIME_INFO_num(x->prime_infos); i++) {
379 /* print multi-prime info */
380 BIGNUM *bn = NULL;
381 RSA_PRIME_INFO *pinfo;
382 int j;
383
384 pinfo = sk_RSA_PRIME_INFO_value(x->prime_infos, i);
385 for (j = 0; j < 3; j++) {
386 if (!BIO_indent(bp, off, 128))
387 goto err;
388 switch (j) {
389 case 0:
390 if (BIO_printf(bp, "prime%d:", i + 3) <= 0)
391 goto err;
392 bn = pinfo->r;
393 break;
394 case 1:
395 if (BIO_printf(bp, "exponent%d:", i + 3) <= 0)
396 goto err;
397 bn = pinfo->d;
398 break;
399 case 2:
400 if (BIO_printf(bp, "coefficient%d:", i + 3) <= 0)
401 goto err;
402 bn = pinfo->t;
403 break;
404 default:
405 break;
406 }
407 if (!ASN1_bn_print(bp, "", bn, NULL, off))
408 goto err;
409 }
410 }
411 }
412 if (pkey_is_pss(pkey) && !rsa_pss_param_print(bp, 1, x->pss, off))
413 goto err;
414 ret = 1;
415 err:
416 return ret;
417 }
418
rsa_pub_print(BIO * bp,const EVP_PKEY * pkey,int indent,ASN1_PCTX * ctx)419 static int rsa_pub_print(BIO *bp, const EVP_PKEY *pkey, int indent,
420 ASN1_PCTX *ctx)
421 {
422 return pkey_rsa_print(bp, pkey, indent, 0);
423 }
424
rsa_priv_print(BIO * bp,const EVP_PKEY * pkey,int indent,ASN1_PCTX * ctx)425 static int rsa_priv_print(BIO *bp, const EVP_PKEY *pkey, int indent,
426 ASN1_PCTX *ctx)
427 {
428 return pkey_rsa_print(bp, pkey, indent, 1);
429 }
430
rsa_pss_decode(const X509_ALGOR * alg)431 static RSA_PSS_PARAMS *rsa_pss_decode(const X509_ALGOR *alg)
432 {
433 RSA_PSS_PARAMS *pss;
434
435 pss = ASN1_TYPE_unpack_sequence(ASN1_ITEM_rptr(RSA_PSS_PARAMS),
436 alg->parameter);
437
438 if (pss == NULL)
439 return NULL;
440
441 if (pss->maskGenAlgorithm != NULL) {
442 pss->maskHash = rsa_mgf1_decode(pss->maskGenAlgorithm);
443 if (pss->maskHash == NULL) {
444 RSA_PSS_PARAMS_free(pss);
445 return NULL;
446 }
447 }
448
449 return pss;
450 }
451
rsa_sig_print(BIO * bp,const X509_ALGOR * sigalg,const ASN1_STRING * sig,int indent,ASN1_PCTX * pctx)452 static int rsa_sig_print(BIO *bp, const X509_ALGOR *sigalg,
453 const ASN1_STRING *sig, int indent, ASN1_PCTX *pctx)
454 {
455 if (OBJ_obj2nid(sigalg->algorithm) == EVP_PKEY_RSA_PSS) {
456 int rv;
457 RSA_PSS_PARAMS *pss = rsa_pss_decode(sigalg);
458
459 rv = rsa_pss_param_print(bp, 0, pss, indent);
460 RSA_PSS_PARAMS_free(pss);
461 if (!rv)
462 return 0;
463 } else if (!sig && BIO_puts(bp, "\n") <= 0) {
464 return 0;
465 }
466 if (sig)
467 return X509_signature_dump(bp, sig, indent);
468 return 1;
469 }
470
rsa_pkey_ctrl(EVP_PKEY * pkey,int op,long arg1,void * arg2)471 static int rsa_pkey_ctrl(EVP_PKEY *pkey, int op, long arg1, void *arg2)
472 {
473 X509_ALGOR *alg = NULL;
474 const EVP_MD *md;
475 const EVP_MD *mgf1md;
476 int min_saltlen;
477
478 switch (op) {
479
480 case ASN1_PKEY_CTRL_PKCS7_SIGN:
481 if (arg1 == 0)
482 PKCS7_SIGNER_INFO_get0_algs(arg2, NULL, NULL, &alg);
483 break;
484
485 case ASN1_PKEY_CTRL_PKCS7_ENCRYPT:
486 if (pkey_is_pss(pkey))
487 return -2;
488 if (arg1 == 0)
489 PKCS7_RECIP_INFO_get0_alg(arg2, &alg);
490 break;
491 #ifndef OPENSSL_NO_CMS
492 case ASN1_PKEY_CTRL_CMS_SIGN:
493 if (arg1 == 0)
494 return rsa_cms_sign(arg2);
495 else if (arg1 == 1)
496 return rsa_cms_verify(arg2);
497 break;
498
499 case ASN1_PKEY_CTRL_CMS_ENVELOPE:
500 if (pkey_is_pss(pkey))
501 return -2;
502 if (arg1 == 0)
503 return rsa_cms_encrypt(arg2);
504 else if (arg1 == 1)
505 return rsa_cms_decrypt(arg2);
506 break;
507
508 case ASN1_PKEY_CTRL_CMS_RI_TYPE:
509 if (pkey_is_pss(pkey))
510 return -2;
511 *(int *)arg2 = CMS_RECIPINFO_TRANS;
512 return 1;
513 #endif
514
515 case ASN1_PKEY_CTRL_DEFAULT_MD_NID:
516 if (pkey->pkey.rsa->pss != NULL) {
517 if (!rsa_pss_get_param(pkey->pkey.rsa->pss, &md, &mgf1md,
518 &min_saltlen)) {
519 RSAerr(0, ERR_R_INTERNAL_ERROR);
520 return 0;
521 }
522 *(int *)arg2 = EVP_MD_type(md);
523 /* Return of 2 indicates this MD is mandatory */
524 return 2;
525 }
526 *(int *)arg2 = NID_sha256;
527 return 1;
528
529 default:
530 return -2;
531
532 }
533
534 if (alg)
535 X509_ALGOR_set0(alg, OBJ_nid2obj(NID_rsaEncryption), V_ASN1_NULL, 0);
536
537 return 1;
538
539 }
540
541 /* allocate and set algorithm ID from EVP_MD, default SHA1 */
rsa_md_to_algor(X509_ALGOR ** palg,const EVP_MD * md)542 static int rsa_md_to_algor(X509_ALGOR **palg, const EVP_MD *md)
543 {
544 if (md == NULL || EVP_MD_type(md) == NID_sha1)
545 return 1;
546 *palg = X509_ALGOR_new();
547 if (*palg == NULL)
548 return 0;
549 X509_ALGOR_set_md(*palg, md);
550 return 1;
551 }
552
553 /* Allocate and set MGF1 algorithm ID from EVP_MD */
rsa_md_to_mgf1(X509_ALGOR ** palg,const EVP_MD * mgf1md)554 static int rsa_md_to_mgf1(X509_ALGOR **palg, const EVP_MD *mgf1md)
555 {
556 X509_ALGOR *algtmp = NULL;
557 ASN1_STRING *stmp = NULL;
558
559 *palg = NULL;
560 if (mgf1md == NULL || EVP_MD_type(mgf1md) == NID_sha1)
561 return 1;
562 /* need to embed algorithm ID inside another */
563 if (!rsa_md_to_algor(&algtmp, mgf1md))
564 goto err;
565 if (ASN1_item_pack(algtmp, ASN1_ITEM_rptr(X509_ALGOR), &stmp) == NULL)
566 goto err;
567 *palg = X509_ALGOR_new();
568 if (*palg == NULL)
569 goto err;
570 X509_ALGOR_set0(*palg, OBJ_nid2obj(NID_mgf1), V_ASN1_SEQUENCE, stmp);
571 stmp = NULL;
572 err:
573 ASN1_STRING_free(stmp);
574 X509_ALGOR_free(algtmp);
575 if (*palg)
576 return 1;
577 return 0;
578 }
579
580 /* convert algorithm ID to EVP_MD, default SHA1 */
rsa_algor_to_md(X509_ALGOR * alg)581 static const EVP_MD *rsa_algor_to_md(X509_ALGOR *alg)
582 {
583 const EVP_MD *md;
584
585 if (!alg)
586 return EVP_sha1();
587 md = EVP_get_digestbyobj(alg->algorithm);
588 if (md == NULL)
589 RSAerr(RSA_F_RSA_ALGOR_TO_MD, RSA_R_UNKNOWN_DIGEST);
590 return md;
591 }
592
593 /*
594 * Convert EVP_PKEY_CTX in PSS mode into corresponding algorithm parameter,
595 * suitable for setting an AlgorithmIdentifier.
596 */
597
rsa_ctx_to_pss(EVP_PKEY_CTX * pkctx)598 static RSA_PSS_PARAMS *rsa_ctx_to_pss(EVP_PKEY_CTX *pkctx)
599 {
600 const EVP_MD *sigmd, *mgf1md;
601 EVP_PKEY *pk = EVP_PKEY_CTX_get0_pkey(pkctx);
602 int saltlen;
603
604 if (EVP_PKEY_CTX_get_signature_md(pkctx, &sigmd) <= 0)
605 return NULL;
606 if (EVP_PKEY_CTX_get_rsa_mgf1_md(pkctx, &mgf1md) <= 0)
607 return NULL;
608 if (!EVP_PKEY_CTX_get_rsa_pss_saltlen(pkctx, &saltlen))
609 return NULL;
610 if (saltlen == -1) {
611 saltlen = EVP_MD_size(sigmd);
612 } else if (saltlen == -2 || saltlen == -3) {
613 saltlen = EVP_PKEY_size(pk) - EVP_MD_size(sigmd) - 2;
614 if ((EVP_PKEY_bits(pk) & 0x7) == 1)
615 saltlen--;
616 if (saltlen < 0)
617 return NULL;
618 }
619
620 return rsa_pss_params_create(sigmd, mgf1md, saltlen);
621 }
622
rsa_pss_params_create(const EVP_MD * sigmd,const EVP_MD * mgf1md,int saltlen)623 RSA_PSS_PARAMS *rsa_pss_params_create(const EVP_MD *sigmd,
624 const EVP_MD *mgf1md, int saltlen)
625 {
626 RSA_PSS_PARAMS *pss = RSA_PSS_PARAMS_new();
627
628 if (pss == NULL)
629 goto err;
630 if (saltlen != 20) {
631 pss->saltLength = ASN1_INTEGER_new();
632 if (pss->saltLength == NULL)
633 goto err;
634 if (!ASN1_INTEGER_set(pss->saltLength, saltlen))
635 goto err;
636 }
637 if (!rsa_md_to_algor(&pss->hashAlgorithm, sigmd))
638 goto err;
639 if (mgf1md == NULL)
640 mgf1md = sigmd;
641 if (!rsa_md_to_mgf1(&pss->maskGenAlgorithm, mgf1md))
642 goto err;
643 if (!rsa_md_to_algor(&pss->maskHash, mgf1md))
644 goto err;
645 return pss;
646 err:
647 RSA_PSS_PARAMS_free(pss);
648 return NULL;
649 }
650
rsa_ctx_to_pss_string(EVP_PKEY_CTX * pkctx)651 static ASN1_STRING *rsa_ctx_to_pss_string(EVP_PKEY_CTX *pkctx)
652 {
653 RSA_PSS_PARAMS *pss = rsa_ctx_to_pss(pkctx);
654 ASN1_STRING *os;
655
656 if (pss == NULL)
657 return NULL;
658
659 os = ASN1_item_pack(pss, ASN1_ITEM_rptr(RSA_PSS_PARAMS), NULL);
660 RSA_PSS_PARAMS_free(pss);
661 return os;
662 }
663
664 /*
665 * From PSS AlgorithmIdentifier set public key parameters. If pkey isn't NULL
666 * then the EVP_MD_CTX is setup and initialised. If it is NULL parameters are
667 * passed to pkctx instead.
668 */
669
rsa_pss_to_ctx(EVP_MD_CTX * ctx,EVP_PKEY_CTX * pkctx,X509_ALGOR * sigalg,EVP_PKEY * pkey)670 static int rsa_pss_to_ctx(EVP_MD_CTX *ctx, EVP_PKEY_CTX *pkctx,
671 X509_ALGOR *sigalg, EVP_PKEY *pkey)
672 {
673 int rv = -1;
674 int saltlen;
675 const EVP_MD *mgf1md = NULL, *md = NULL;
676 RSA_PSS_PARAMS *pss;
677
678 /* Sanity check: make sure it is PSS */
679 if (OBJ_obj2nid(sigalg->algorithm) != EVP_PKEY_RSA_PSS) {
680 RSAerr(RSA_F_RSA_PSS_TO_CTX, RSA_R_UNSUPPORTED_SIGNATURE_TYPE);
681 return -1;
682 }
683 /* Decode PSS parameters */
684 pss = rsa_pss_decode(sigalg);
685
686 if (!rsa_pss_get_param(pss, &md, &mgf1md, &saltlen)) {
687 RSAerr(RSA_F_RSA_PSS_TO_CTX, RSA_R_INVALID_PSS_PARAMETERS);
688 goto err;
689 }
690
691 /* We have all parameters now set up context */
692 if (pkey) {
693 if (!EVP_DigestVerifyInit(ctx, &pkctx, md, NULL, pkey))
694 goto err;
695 } else {
696 const EVP_MD *checkmd;
697 if (EVP_PKEY_CTX_get_signature_md(pkctx, &checkmd) <= 0)
698 goto err;
699 if (EVP_MD_type(md) != EVP_MD_type(checkmd)) {
700 RSAerr(RSA_F_RSA_PSS_TO_CTX, RSA_R_DIGEST_DOES_NOT_MATCH);
701 goto err;
702 }
703 }
704
705 if (EVP_PKEY_CTX_set_rsa_padding(pkctx, RSA_PKCS1_PSS_PADDING) <= 0)
706 goto err;
707
708 if (EVP_PKEY_CTX_set_rsa_pss_saltlen(pkctx, saltlen) <= 0)
709 goto err;
710
711 if (EVP_PKEY_CTX_set_rsa_mgf1_md(pkctx, mgf1md) <= 0)
712 goto err;
713 /* Carry on */
714 rv = 1;
715
716 err:
717 RSA_PSS_PARAMS_free(pss);
718 return rv;
719 }
720
rsa_pss_get_param(const RSA_PSS_PARAMS * pss,const EVP_MD ** pmd,const EVP_MD ** pmgf1md,int * psaltlen)721 int rsa_pss_get_param(const RSA_PSS_PARAMS *pss, const EVP_MD **pmd,
722 const EVP_MD **pmgf1md, int *psaltlen)
723 {
724 if (pss == NULL)
725 return 0;
726 *pmd = rsa_algor_to_md(pss->hashAlgorithm);
727 if (*pmd == NULL)
728 return 0;
729 *pmgf1md = rsa_algor_to_md(pss->maskHash);
730 if (*pmgf1md == NULL)
731 return 0;
732 if (pss->saltLength) {
733 *psaltlen = ASN1_INTEGER_get(pss->saltLength);
734 if (*psaltlen < 0) {
735 RSAerr(RSA_F_RSA_PSS_GET_PARAM, RSA_R_INVALID_SALT_LENGTH);
736 return 0;
737 }
738 } else {
739 *psaltlen = 20;
740 }
741
742 /*
743 * low-level routines support only trailer field 0xbc (value 1) and
744 * PKCS#1 says we should reject any other value anyway.
745 */
746 if (pss->trailerField && ASN1_INTEGER_get(pss->trailerField) != 1) {
747 RSAerr(RSA_F_RSA_PSS_GET_PARAM, RSA_R_INVALID_TRAILER);
748 return 0;
749 }
750
751 return 1;
752 }
753
754 #ifndef OPENSSL_NO_CMS
rsa_cms_verify(CMS_SignerInfo * si)755 static int rsa_cms_verify(CMS_SignerInfo *si)
756 {
757 int nid, nid2;
758 X509_ALGOR *alg;
759 EVP_PKEY_CTX *pkctx = CMS_SignerInfo_get0_pkey_ctx(si);
760
761 CMS_SignerInfo_get0_algs(si, NULL, NULL, NULL, &alg);
762 nid = OBJ_obj2nid(alg->algorithm);
763 if (nid == EVP_PKEY_RSA_PSS)
764 return rsa_pss_to_ctx(NULL, pkctx, alg, NULL);
765 /* Only PSS allowed for PSS keys */
766 if (pkey_ctx_is_pss(pkctx)) {
767 RSAerr(RSA_F_RSA_CMS_VERIFY, RSA_R_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE);
768 return 0;
769 }
770 if (nid == NID_rsaEncryption)
771 return 1;
772 /* Workaround for some implementation that use a signature OID */
773 if (OBJ_find_sigid_algs(nid, NULL, &nid2)) {
774 if (nid2 == NID_rsaEncryption)
775 return 1;
776 }
777 return 0;
778 }
779 #endif
780
781 /*
782 * Customised RSA item verification routine. This is called when a signature
783 * is encountered requiring special handling. We currently only handle PSS.
784 */
785
rsa_item_verify(EVP_MD_CTX * ctx,const ASN1_ITEM * it,void * asn,X509_ALGOR * sigalg,ASN1_BIT_STRING * sig,EVP_PKEY * pkey)786 static int rsa_item_verify(EVP_MD_CTX *ctx, const ASN1_ITEM *it, void *asn,
787 X509_ALGOR *sigalg, ASN1_BIT_STRING *sig,
788 EVP_PKEY *pkey)
789 {
790 /* Sanity check: make sure it is PSS */
791 if (OBJ_obj2nid(sigalg->algorithm) != EVP_PKEY_RSA_PSS) {
792 RSAerr(RSA_F_RSA_ITEM_VERIFY, RSA_R_UNSUPPORTED_SIGNATURE_TYPE);
793 return -1;
794 }
795 if (rsa_pss_to_ctx(ctx, NULL, sigalg, pkey) > 0) {
796 /* Carry on */
797 return 2;
798 }
799 return -1;
800 }
801
802 #ifndef OPENSSL_NO_CMS
rsa_cms_sign(CMS_SignerInfo * si)803 static int rsa_cms_sign(CMS_SignerInfo *si)
804 {
805 int pad_mode = RSA_PKCS1_PADDING;
806 X509_ALGOR *alg;
807 EVP_PKEY_CTX *pkctx = CMS_SignerInfo_get0_pkey_ctx(si);
808 ASN1_STRING *os = NULL;
809
810 CMS_SignerInfo_get0_algs(si, NULL, NULL, NULL, &alg);
811 if (pkctx) {
812 if (EVP_PKEY_CTX_get_rsa_padding(pkctx, &pad_mode) <= 0)
813 return 0;
814 }
815 if (pad_mode == RSA_PKCS1_PADDING) {
816 X509_ALGOR_set0(alg, OBJ_nid2obj(NID_rsaEncryption), V_ASN1_NULL, 0);
817 return 1;
818 }
819 /* We don't support it */
820 if (pad_mode != RSA_PKCS1_PSS_PADDING)
821 return 0;
822 os = rsa_ctx_to_pss_string(pkctx);
823 if (!os)
824 return 0;
825 X509_ALGOR_set0(alg, OBJ_nid2obj(EVP_PKEY_RSA_PSS), V_ASN1_SEQUENCE, os);
826 return 1;
827 }
828 #endif
829
rsa_item_sign(EVP_MD_CTX * ctx,const ASN1_ITEM * it,void * asn,X509_ALGOR * alg1,X509_ALGOR * alg2,ASN1_BIT_STRING * sig)830 static int rsa_item_sign(EVP_MD_CTX *ctx, const ASN1_ITEM *it, void *asn,
831 X509_ALGOR *alg1, X509_ALGOR *alg2,
832 ASN1_BIT_STRING *sig)
833 {
834 int pad_mode;
835 EVP_PKEY_CTX *pkctx = EVP_MD_CTX_pkey_ctx(ctx);
836
837 if (EVP_PKEY_CTX_get_rsa_padding(pkctx, &pad_mode) <= 0)
838 return 0;
839 if (pad_mode == RSA_PKCS1_PADDING)
840 return 2;
841 if (pad_mode == RSA_PKCS1_PSS_PADDING) {
842 ASN1_STRING *os1 = NULL;
843 os1 = rsa_ctx_to_pss_string(pkctx);
844 if (!os1)
845 return 0;
846 /* Duplicate parameters if we have to */
847 if (alg2) {
848 ASN1_STRING *os2 = ASN1_STRING_dup(os1);
849 if (!os2) {
850 ASN1_STRING_free(os1);
851 return 0;
852 }
853 X509_ALGOR_set0(alg2, OBJ_nid2obj(EVP_PKEY_RSA_PSS),
854 V_ASN1_SEQUENCE, os2);
855 }
856 X509_ALGOR_set0(alg1, OBJ_nid2obj(EVP_PKEY_RSA_PSS),
857 V_ASN1_SEQUENCE, os1);
858 return 3;
859 }
860 return 2;
861 }
862
rsa_sig_info_set(X509_SIG_INFO * siginf,const X509_ALGOR * sigalg,const ASN1_STRING * sig)863 static int rsa_sig_info_set(X509_SIG_INFO *siginf, const X509_ALGOR *sigalg,
864 const ASN1_STRING *sig)
865 {
866 int rv = 0;
867 int mdnid, saltlen;
868 uint32_t flags;
869 const EVP_MD *mgf1md = NULL, *md = NULL;
870 RSA_PSS_PARAMS *pss;
871
872 /* Sanity check: make sure it is PSS */
873 if (OBJ_obj2nid(sigalg->algorithm) != EVP_PKEY_RSA_PSS)
874 return 0;
875 /* Decode PSS parameters */
876 pss = rsa_pss_decode(sigalg);
877 if (!rsa_pss_get_param(pss, &md, &mgf1md, &saltlen))
878 goto err;
879 mdnid = EVP_MD_type(md);
880 /*
881 * For TLS need SHA256, SHA384 or SHA512, digest and MGF1 digest must
882 * match and salt length must equal digest size
883 */
884 if ((mdnid == NID_sha256 || mdnid == NID_sha384 || mdnid == NID_sha512)
885 && mdnid == EVP_MD_type(mgf1md) && saltlen == EVP_MD_size(md))
886 flags = X509_SIG_INFO_TLS;
887 else
888 flags = 0;
889 /* Note: security bits half number of digest bits */
890 X509_SIG_INFO_set(siginf, mdnid, EVP_PKEY_RSA_PSS, EVP_MD_size(md) * 4,
891 flags);
892 rv = 1;
893 err:
894 RSA_PSS_PARAMS_free(pss);
895 return rv;
896 }
897
898 #ifndef OPENSSL_NO_CMS
rsa_oaep_decode(const X509_ALGOR * alg)899 static RSA_OAEP_PARAMS *rsa_oaep_decode(const X509_ALGOR *alg)
900 {
901 RSA_OAEP_PARAMS *oaep;
902
903 oaep = ASN1_TYPE_unpack_sequence(ASN1_ITEM_rptr(RSA_OAEP_PARAMS),
904 alg->parameter);
905
906 if (oaep == NULL)
907 return NULL;
908
909 if (oaep->maskGenFunc != NULL) {
910 oaep->maskHash = rsa_mgf1_decode(oaep->maskGenFunc);
911 if (oaep->maskHash == NULL) {
912 RSA_OAEP_PARAMS_free(oaep);
913 return NULL;
914 }
915 }
916 return oaep;
917 }
918
rsa_cms_decrypt(CMS_RecipientInfo * ri)919 static int rsa_cms_decrypt(CMS_RecipientInfo *ri)
920 {
921 EVP_PKEY_CTX *pkctx;
922 X509_ALGOR *cmsalg;
923 int nid;
924 int rv = -1;
925 unsigned char *label = NULL;
926 int labellen = 0;
927 const EVP_MD *mgf1md = NULL, *md = NULL;
928 RSA_OAEP_PARAMS *oaep;
929
930 pkctx = CMS_RecipientInfo_get0_pkey_ctx(ri);
931 if (pkctx == NULL)
932 return 0;
933 if (!CMS_RecipientInfo_ktri_get0_algs(ri, NULL, NULL, &cmsalg))
934 return -1;
935 nid = OBJ_obj2nid(cmsalg->algorithm);
936 if (nid == NID_rsaEncryption)
937 return 1;
938 if (nid != NID_rsaesOaep) {
939 RSAerr(RSA_F_RSA_CMS_DECRYPT, RSA_R_UNSUPPORTED_ENCRYPTION_TYPE);
940 return -1;
941 }
942 /* Decode OAEP parameters */
943 oaep = rsa_oaep_decode(cmsalg);
944
945 if (oaep == NULL) {
946 RSAerr(RSA_F_RSA_CMS_DECRYPT, RSA_R_INVALID_OAEP_PARAMETERS);
947 goto err;
948 }
949
950 mgf1md = rsa_algor_to_md(oaep->maskHash);
951 if (mgf1md == NULL)
952 goto err;
953 md = rsa_algor_to_md(oaep->hashFunc);
954 if (md == NULL)
955 goto err;
956
957 if (oaep->pSourceFunc != NULL) {
958 X509_ALGOR *plab = oaep->pSourceFunc;
959
960 if (OBJ_obj2nid(plab->algorithm) != NID_pSpecified) {
961 RSAerr(RSA_F_RSA_CMS_DECRYPT, RSA_R_UNSUPPORTED_LABEL_SOURCE);
962 goto err;
963 }
964 if (plab->parameter->type != V_ASN1_OCTET_STRING) {
965 RSAerr(RSA_F_RSA_CMS_DECRYPT, RSA_R_INVALID_LABEL);
966 goto err;
967 }
968
969 label = plab->parameter->value.octet_string->data;
970 /* Stop label being freed when OAEP parameters are freed */
971 plab->parameter->value.octet_string->data = NULL;
972 labellen = plab->parameter->value.octet_string->length;
973 }
974
975 if (EVP_PKEY_CTX_set_rsa_padding(pkctx, RSA_PKCS1_OAEP_PADDING) <= 0)
976 goto err;
977 if (EVP_PKEY_CTX_set_rsa_oaep_md(pkctx, md) <= 0)
978 goto err;
979 if (EVP_PKEY_CTX_set_rsa_mgf1_md(pkctx, mgf1md) <= 0)
980 goto err;
981 if (EVP_PKEY_CTX_set0_rsa_oaep_label(pkctx, label, labellen) <= 0)
982 goto err;
983 /* Carry on */
984 rv = 1;
985
986 err:
987 RSA_OAEP_PARAMS_free(oaep);
988 return rv;
989 }
990
rsa_cms_encrypt(CMS_RecipientInfo * ri)991 static int rsa_cms_encrypt(CMS_RecipientInfo *ri)
992 {
993 const EVP_MD *md, *mgf1md;
994 RSA_OAEP_PARAMS *oaep = NULL;
995 ASN1_STRING *os = NULL;
996 X509_ALGOR *alg;
997 EVP_PKEY_CTX *pkctx = CMS_RecipientInfo_get0_pkey_ctx(ri);
998 int pad_mode = RSA_PKCS1_PADDING, rv = 0, labellen;
999 unsigned char *label;
1000
1001 if (CMS_RecipientInfo_ktri_get0_algs(ri, NULL, NULL, &alg) <= 0)
1002 return 0;
1003 if (pkctx) {
1004 if (EVP_PKEY_CTX_get_rsa_padding(pkctx, &pad_mode) <= 0)
1005 return 0;
1006 }
1007 if (pad_mode == RSA_PKCS1_PADDING) {
1008 X509_ALGOR_set0(alg, OBJ_nid2obj(NID_rsaEncryption), V_ASN1_NULL, 0);
1009 return 1;
1010 }
1011 /* Not supported */
1012 if (pad_mode != RSA_PKCS1_OAEP_PADDING)
1013 return 0;
1014 if (EVP_PKEY_CTX_get_rsa_oaep_md(pkctx, &md) <= 0)
1015 goto err;
1016 if (EVP_PKEY_CTX_get_rsa_mgf1_md(pkctx, &mgf1md) <= 0)
1017 goto err;
1018 labellen = EVP_PKEY_CTX_get0_rsa_oaep_label(pkctx, &label);
1019 if (labellen < 0)
1020 goto err;
1021 oaep = RSA_OAEP_PARAMS_new();
1022 if (oaep == NULL)
1023 goto err;
1024 if (!rsa_md_to_algor(&oaep->hashFunc, md))
1025 goto err;
1026 if (!rsa_md_to_mgf1(&oaep->maskGenFunc, mgf1md))
1027 goto err;
1028 if (labellen > 0) {
1029 ASN1_OCTET_STRING *los;
1030 oaep->pSourceFunc = X509_ALGOR_new();
1031 if (oaep->pSourceFunc == NULL)
1032 goto err;
1033 los = ASN1_OCTET_STRING_new();
1034 if (los == NULL)
1035 goto err;
1036 if (!ASN1_OCTET_STRING_set(los, label, labellen)) {
1037 ASN1_OCTET_STRING_free(los);
1038 goto err;
1039 }
1040 X509_ALGOR_set0(oaep->pSourceFunc, OBJ_nid2obj(NID_pSpecified),
1041 V_ASN1_OCTET_STRING, los);
1042 }
1043 /* create string with pss parameter encoding. */
1044 if (!ASN1_item_pack(oaep, ASN1_ITEM_rptr(RSA_OAEP_PARAMS), &os))
1045 goto err;
1046 X509_ALGOR_set0(alg, OBJ_nid2obj(NID_rsaesOaep), V_ASN1_SEQUENCE, os);
1047 os = NULL;
1048 rv = 1;
1049 err:
1050 RSA_OAEP_PARAMS_free(oaep);
1051 ASN1_STRING_free(os);
1052 return rv;
1053 }
1054 #endif
1055
rsa_pkey_check(const EVP_PKEY * pkey)1056 static int rsa_pkey_check(const EVP_PKEY *pkey)
1057 {
1058 return RSA_check_key_ex(pkey->pkey.rsa, NULL);
1059 }
1060
1061 const EVP_PKEY_ASN1_METHOD rsa_asn1_meths[2] = {
1062 {
1063 EVP_PKEY_RSA,
1064 EVP_PKEY_RSA,
1065 ASN1_PKEY_SIGPARAM_NULL,
1066
1067 "RSA",
1068 "OpenSSL RSA method",
1069
1070 rsa_pub_decode,
1071 rsa_pub_encode,
1072 rsa_pub_cmp,
1073 rsa_pub_print,
1074
1075 rsa_priv_decode,
1076 rsa_priv_encode,
1077 rsa_priv_print,
1078
1079 int_rsa_size,
1080 rsa_bits,
1081 rsa_security_bits,
1082
1083 0, 0, 0, 0, 0, 0,
1084
1085 rsa_sig_print,
1086 int_rsa_free,
1087 rsa_pkey_ctrl,
1088 old_rsa_priv_decode,
1089 old_rsa_priv_encode,
1090 rsa_item_verify,
1091 rsa_item_sign,
1092 rsa_sig_info_set,
1093 rsa_pkey_check
1094 },
1095
1096 {
1097 EVP_PKEY_RSA2,
1098 EVP_PKEY_RSA,
1099 ASN1_PKEY_ALIAS}
1100 };
1101
1102 const EVP_PKEY_ASN1_METHOD rsa_pss_asn1_meth = {
1103 EVP_PKEY_RSA_PSS,
1104 EVP_PKEY_RSA_PSS,
1105 ASN1_PKEY_SIGPARAM_NULL,
1106
1107 "RSA-PSS",
1108 "OpenSSL RSA-PSS method",
1109
1110 rsa_pub_decode,
1111 rsa_pub_encode,
1112 rsa_pub_cmp,
1113 rsa_pub_print,
1114
1115 rsa_priv_decode,
1116 rsa_priv_encode,
1117 rsa_priv_print,
1118
1119 int_rsa_size,
1120 rsa_bits,
1121 rsa_security_bits,
1122
1123 0, 0, 0, 0, 0, 0,
1124
1125 rsa_sig_print,
1126 int_rsa_free,
1127 rsa_pkey_ctrl,
1128 0, 0,
1129 rsa_item_verify,
1130 rsa_item_sign,
1131 0,
1132 rsa_pkey_check
1133 };
1134