OLD | NEW |
1 /* crypto/rsa/rsa_sign.c */ | 1 /* crypto/rsa/rsa_sign.c */ |
2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | 2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) |
3 * All rights reserved. | 3 * All rights reserved. |
4 * | 4 * |
5 * This package is an SSL implementation written | 5 * This package is an SSL implementation written |
6 * by Eric Young (eay@cryptsoft.com). | 6 * by Eric Young (eay@cryptsoft.com). |
7 * The implementation was written so as to conform with Netscapes SSL. | 7 * The implementation was written so as to conform with Netscapes SSL. |
8 * | 8 * |
9 * This library is free for commercial and non-commercial use as long as | 9 * This library is free for commercial and non-commercial use as long as |
10 * the following conditions are aheared to. The following conditions | 10 * the following conditions are aheared to. The following conditions |
(...skipping 44 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
55 * copied and put under another distribution licence | 55 * copied and put under another distribution licence |
56 * [including the GNU Public Licence.] | 56 * [including the GNU Public Licence.] |
57 */ | 57 */ |
58 | 58 |
59 #include <stdio.h> | 59 #include <stdio.h> |
60 #include "cryptlib.h" | 60 #include "cryptlib.h" |
61 #include <openssl/bn.h> | 61 #include <openssl/bn.h> |
62 #include <openssl/rsa.h> | 62 #include <openssl/rsa.h> |
63 #include <openssl/objects.h> | 63 #include <openssl/objects.h> |
64 #include <openssl/x509.h> | 64 #include <openssl/x509.h> |
| 65 #include "rsa_locl.h" |
65 | 66 |
66 /* Size of an SSL signature: MD5+SHA1 */ | 67 /* Size of an SSL signature: MD5+SHA1 */ |
67 #define SSL_SIG_LENGTH 36 | 68 #define SSL_SIG_LENGTH 36 |
68 | 69 |
69 int RSA_sign(int type, const unsigned char *m, unsigned int m_len, | 70 int RSA_sign(int type, const unsigned char *m, unsigned int m_len, |
70 unsigned char *sigret, unsigned int *siglen, RSA *rsa) | 71 unsigned char *sigret, unsigned int *siglen, RSA *rsa) |
71 { | 72 { |
72 X509_SIG sig; | 73 X509_SIG sig; |
73 ASN1_TYPE parameter; | 74 ASN1_TYPE parameter; |
74 int i,j,ret=1; | 75 int i,j,ret=1; |
75 unsigned char *p, *tmps = NULL; | 76 unsigned char *p, *tmps = NULL; |
76 const unsigned char *s = NULL; | 77 const unsigned char *s = NULL; |
77 X509_ALGOR algor; | 78 X509_ALGOR algor; |
78 ASN1_OCTET_STRING digest; | 79 ASN1_OCTET_STRING digest; |
79 if((rsa->flags & RSA_FLAG_SIGN_VER) && rsa->meth->rsa_sign) | 80 if((rsa->flags & RSA_FLAG_SIGN_VER) && rsa->meth->rsa_sign) |
80 { | 81 { |
81 return rsa->meth->rsa_sign(type, m, m_len, | 82 return rsa->meth->rsa_sign(type, m, m_len, |
82 sigret, siglen, rsa); | 83 sigret, siglen, rsa); |
83 } | 84 } |
84 /* Special case: SSL signature, just check the length */ | 85 /* Special case: SSL signature, just check the length */ |
85 if(type == NID_md5_sha1) { | 86 if(type == NID_md5_sha1) { |
86 if(m_len != SSL_SIG_LENGTH) { | 87 if(m_len != SSL_SIG_LENGTH) { |
87 RSAerr(RSA_F_RSA_SIGN,RSA_R_INVALID_MESSAGE_LENGTH); | 88 RSAerr(RSA_F_RSA_SIGN,RSA_R_INVALID_MESSAGE_LENGTH); |
88 return(0); | 89 return(0); |
89 } | 90 } |
90 i = SSL_SIG_LENGTH; | 91 i = SSL_SIG_LENGTH; |
91 s = m; | 92 s = m; |
92 } else { | 93 } else { |
93 /* NB: in FIPS mode block anything that isn't a TLS signature */ | |
94 #ifdef OPENSSL_FIPS | |
95 if(FIPS_mode() && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW)) | |
96 { | |
97 RSAerr(RSA_F_RSA_SIGN, RSA_R_OPERATION_NOT_ALLOWED_IN_FI
PS_MODE); | |
98 return 0; | |
99 } | |
100 #endif | |
101 sig.algor= &algor; | 94 sig.algor= &algor; |
102 sig.algor->algorithm=OBJ_nid2obj(type); | 95 sig.algor->algorithm=OBJ_nid2obj(type); |
103 if (sig.algor->algorithm == NULL) | 96 if (sig.algor->algorithm == NULL) |
104 { | 97 { |
105 RSAerr(RSA_F_RSA_SIGN,RSA_R_UNKNOWN_ALGORITHM_TYPE); | 98 RSAerr(RSA_F_RSA_SIGN,RSA_R_UNKNOWN_ALGORITHM_TYPE); |
106 return(0); | 99 return(0); |
107 } | 100 } |
108 if (sig.algor->algorithm->length == 0) | 101 if (sig.algor->algorithm->length == 0) |
109 { | 102 { |
110 RSAerr(RSA_F_RSA_SIGN,RSA_R_THE_ASN1_OBJECT_IDENTIFIER_I
S_NOT_KNOWN_FOR_THIS_MD); | 103 RSAerr(RSA_F_RSA_SIGN,RSA_R_THE_ASN1_OBJECT_IDENTIFIER_I
S_NOT_KNOWN_FOR_THIS_MD); |
(...skipping 19 matching lines...) Expand all Loading... |
130 tmps=(unsigned char *)OPENSSL_malloc((unsigned int)j+1); | 123 tmps=(unsigned char *)OPENSSL_malloc((unsigned int)j+1); |
131 if (tmps == NULL) | 124 if (tmps == NULL) |
132 { | 125 { |
133 RSAerr(RSA_F_RSA_SIGN,ERR_R_MALLOC_FAILURE); | 126 RSAerr(RSA_F_RSA_SIGN,ERR_R_MALLOC_FAILURE); |
134 return(0); | 127 return(0); |
135 } | 128 } |
136 p=tmps; | 129 p=tmps; |
137 i2d_X509_SIG(&sig,&p); | 130 i2d_X509_SIG(&sig,&p); |
138 s=tmps; | 131 s=tmps; |
139 } | 132 } |
140 #ifdef OPENSSL_FIPS | |
141 /* Bypass algorithm blocking: this is allowed if we get this far */ | |
142 i=rsa->meth->rsa_priv_enc(i,s,sigret,rsa,RSA_PKCS1_PADDING); | |
143 #else | |
144 i=RSA_private_encrypt(i,s,sigret,rsa,RSA_PKCS1_PADDING); | 133 i=RSA_private_encrypt(i,s,sigret,rsa,RSA_PKCS1_PADDING); |
145 #endif | |
146 if (i <= 0) | 134 if (i <= 0) |
147 ret=0; | 135 ret=0; |
148 else | 136 else |
149 *siglen=i; | 137 *siglen=i; |
150 | 138 |
151 if(type != NID_md5_sha1) { | 139 if(type != NID_md5_sha1) { |
152 OPENSSL_cleanse(tmps,(unsigned int)j+1); | 140 OPENSSL_cleanse(tmps,(unsigned int)j+1); |
153 OPENSSL_free(tmps); | 141 OPENSSL_free(tmps); |
154 } | 142 } |
155 return(ret); | 143 return(ret); |
156 } | 144 } |
157 | 145 |
158 int RSA_verify(int dtype, const unsigned char *m, unsigned int m_len, | 146 int int_rsa_verify(int dtype, const unsigned char *m, |
159 » unsigned char *sigbuf, unsigned int siglen, RSA *rsa) | 147 » » » unsigned int m_len, |
| 148 » » » unsigned char *rm, size_t *prm_len, |
| 149 » » » const unsigned char *sigbuf, size_t siglen, |
| 150 » » » RSA *rsa) |
160 { | 151 { |
161 int i,ret=0,sigtype; | 152 int i,ret=0,sigtype; |
162 unsigned char *s; | 153 unsigned char *s; |
163 X509_SIG *sig=NULL; | 154 X509_SIG *sig=NULL; |
164 | 155 |
165 if (siglen != (unsigned int)RSA_size(rsa)) | 156 if (siglen != (unsigned int)RSA_size(rsa)) |
166 { | 157 { |
167 » » RSAerr(RSA_F_RSA_VERIFY,RSA_R_WRONG_SIGNATURE_LENGTH); | 158 » » RSAerr(RSA_F_INT_RSA_VERIFY,RSA_R_WRONG_SIGNATURE_LENGTH); |
168 return(0); | 159 return(0); |
169 } | 160 } |
170 | 161 |
171 » if((rsa->flags & RSA_FLAG_SIGN_VER) && rsa->meth->rsa_verify) | 162 » if((dtype == NID_md5_sha1) && rm) |
172 { | 163 { |
173 » » return rsa->meth->rsa_verify(dtype, m, m_len, | 164 » » i = RSA_public_decrypt((int)siglen, |
174 » » » sigbuf, siglen, rsa); | 165 » » » » » sigbuf,rm,rsa,RSA_PKCS1_PADDING); |
| 166 » » if (i <= 0) |
| 167 » » » return 0; |
| 168 » » *prm_len = i; |
| 169 » » return 1; |
175 } | 170 } |
176 | 171 |
177 s=(unsigned char *)OPENSSL_malloc((unsigned int)siglen); | 172 s=(unsigned char *)OPENSSL_malloc((unsigned int)siglen); |
178 if (s == NULL) | 173 if (s == NULL) |
179 { | 174 { |
180 » » RSAerr(RSA_F_RSA_VERIFY,ERR_R_MALLOC_FAILURE); | 175 » » RSAerr(RSA_F_INT_RSA_VERIFY,ERR_R_MALLOC_FAILURE); |
181 goto err; | 176 goto err; |
182 } | 177 } |
183 » if(dtype == NID_md5_sha1) | 178 » if((dtype == NID_md5_sha1) && (m_len != SSL_SIG_LENGTH) ) { |
184 » » { | 179 » » » RSAerr(RSA_F_INT_RSA_VERIFY,RSA_R_INVALID_MESSAGE_LENGTH
); |
185 » » if (m_len != SSL_SIG_LENGTH) | |
186 » » » { | |
187 » » » RSAerr(RSA_F_RSA_VERIFY,RSA_R_INVALID_MESSAGE_LENGTH); | |
188 goto err; | 180 goto err; |
189 » » » } | 181 » } |
190 » » } | |
191 » /* NB: in FIPS mode block anything that isn't a TLS signature */ | |
192 #ifdef OPENSSL_FIPS | |
193 » else if(FIPS_mode() && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW)) | |
194 » » { | |
195 » » RSAerr(RSA_F_RSA_VERIFY, RSA_R_OPERATION_NOT_ALLOWED_IN_FIPS_MOD
E); | |
196 » » return 0; | |
197 » » } | |
198 » /* Bypass algorithm blocking: this is allowed */ | |
199 » i=rsa->meth->rsa_pub_dec((int)siglen,sigbuf,s,rsa,RSA_PKCS1_PADDING); | |
200 #else | |
201 i=RSA_public_decrypt((int)siglen,sigbuf,s,rsa,RSA_PKCS1_PADDING); | 182 i=RSA_public_decrypt((int)siglen,sigbuf,s,rsa,RSA_PKCS1_PADDING); |
202 #endif | |
203 | 183 |
204 if (i <= 0) goto err; | 184 if (i <= 0) goto err; |
205 | 185 |
206 /* Special case: SSL signature */ | 186 /* Special case: SSL signature */ |
207 if(dtype == NID_md5_sha1) { | 187 if(dtype == NID_md5_sha1) { |
208 if((i != SSL_SIG_LENGTH) || memcmp(s, m, SSL_SIG_LENGTH)) | 188 if((i != SSL_SIG_LENGTH) || memcmp(s, m, SSL_SIG_LENGTH)) |
209 » » » » RSAerr(RSA_F_RSA_VERIFY,RSA_R_BAD_SIGNATURE); | 189 » » » » RSAerr(RSA_F_INT_RSA_VERIFY,RSA_R_BAD_SIGNATURE)
; |
210 else ret = 1; | 190 else ret = 1; |
211 } else { | 191 } else { |
212 const unsigned char *p=s; | 192 const unsigned char *p=s; |
213 sig=d2i_X509_SIG(NULL,&p,(long)i); | 193 sig=d2i_X509_SIG(NULL,&p,(long)i); |
214 | 194 |
215 if (sig == NULL) goto err; | 195 if (sig == NULL) goto err; |
216 | 196 |
217 /* Excess data can be used to create forgeries */ | 197 /* Excess data can be used to create forgeries */ |
218 if(p != s+i) | 198 if(p != s+i) |
219 { | 199 { |
220 » » » RSAerr(RSA_F_RSA_VERIFY,RSA_R_BAD_SIGNATURE); | 200 » » » RSAerr(RSA_F_INT_RSA_VERIFY,RSA_R_BAD_SIGNATURE); |
221 goto err; | 201 goto err; |
222 } | 202 } |
223 | 203 |
224 /* Parameters to the signature algorithm can also be used to | 204 /* Parameters to the signature algorithm can also be used to |
225 create forgeries */ | 205 create forgeries */ |
226 if(sig->algor->parameter | 206 if(sig->algor->parameter |
227 && ASN1_TYPE_get(sig->algor->parameter) != V_ASN1_NULL) | 207 && ASN1_TYPE_get(sig->algor->parameter) != V_ASN1_NULL) |
228 { | 208 { |
229 » » » RSAerr(RSA_F_RSA_VERIFY,RSA_R_BAD_SIGNATURE); | 209 » » » RSAerr(RSA_F_INT_RSA_VERIFY,RSA_R_BAD_SIGNATURE); |
230 goto err; | 210 goto err; |
231 } | 211 } |
232 | 212 |
233 sigtype=OBJ_obj2nid(sig->algor->algorithm); | 213 sigtype=OBJ_obj2nid(sig->algor->algorithm); |
234 | 214 |
235 | 215 |
236 #ifdef RSA_DEBUG | 216 #ifdef RSA_DEBUG |
237 /* put a backward compatibility flag in EAY */ | 217 /* put a backward compatibility flag in EAY */ |
238 fprintf(stderr,"in(%s) expect(%s)\n",OBJ_nid2ln(sigtype), | 218 fprintf(stderr,"in(%s) expect(%s)\n",OBJ_nid2ln(sigtype), |
239 OBJ_nid2ln(dtype)); | 219 OBJ_nid2ln(dtype)); |
240 #endif | 220 #endif |
241 if (sigtype != dtype) | 221 if (sigtype != dtype) |
242 { | 222 { |
243 if (((dtype == NID_md5) && | 223 if (((dtype == NID_md5) && |
244 (sigtype == NID_md5WithRSAEncryption)) || | 224 (sigtype == NID_md5WithRSAEncryption)) || |
245 ((dtype == NID_md2) && | 225 ((dtype == NID_md2) && |
246 (sigtype == NID_md2WithRSAEncryption))) | 226 (sigtype == NID_md2WithRSAEncryption))) |
247 { | 227 { |
248 /* ok, we will let it through */ | 228 /* ok, we will let it through */ |
249 #if !defined(OPENSSL_NO_STDIO) && !defined(OPENSSL_SYS_WIN16) | 229 #if !defined(OPENSSL_NO_STDIO) && !defined(OPENSSL_SYS_WIN16) |
250 fprintf(stderr,"signature has problems, re-make
with post SSLeay045\n"); | 230 fprintf(stderr,"signature has problems, re-make
with post SSLeay045\n"); |
251 #endif | 231 #endif |
252 } | 232 } |
253 else | 233 else |
254 { | 234 { |
255 » » » » RSAerr(RSA_F_RSA_VERIFY, | 235 » » » » RSAerr(RSA_F_INT_RSA_VERIFY, |
256 RSA_R_ALGORITHM_MISMATCH); | 236 RSA_R_ALGORITHM_MISMATCH); |
257 goto err; | 237 goto err; |
258 } | 238 } |
259 } | 239 } |
260 » » if (» ((unsigned int)sig->digest->length != m_len) || | 240 » » if (rm) |
| 241 » » » { |
| 242 » » » const EVP_MD *md; |
| 243 » » » md = EVP_get_digestbynid(dtype); |
| 244 » » » if (md && (EVP_MD_size(md) != sig->digest->length)) |
| 245 » » » » RSAerr(RSA_F_INT_RSA_VERIFY, |
| 246 » » » » » » RSA_R_INVALID_DIGEST_LENGTH); |
| 247 » » » else |
| 248 » » » » { |
| 249 » » » » memcpy(rm, sig->digest->data, |
| 250 » » » » » » » sig->digest->length); |
| 251 » » » » *prm_len = sig->digest->length; |
| 252 » » » » ret = 1; |
| 253 » » » » } |
| 254 » » » } |
| 255 » » else if (((unsigned int)sig->digest->length != m_len) || |
261 (memcmp(m,sig->digest->data,m_len) != 0)) | 256 (memcmp(m,sig->digest->data,m_len) != 0)) |
262 { | 257 { |
263 » » » RSAerr(RSA_F_RSA_VERIFY,RSA_R_BAD_SIGNATURE); | 258 » » » RSAerr(RSA_F_INT_RSA_VERIFY,RSA_R_BAD_SIGNATURE); |
264 } | 259 } |
265 else | 260 else |
266 ret=1; | 261 ret=1; |
267 } | 262 } |
268 err: | 263 err: |
269 if (sig != NULL) X509_SIG_free(sig); | 264 if (sig != NULL) X509_SIG_free(sig); |
270 if (s != NULL) | 265 if (s != NULL) |
271 { | 266 { |
272 OPENSSL_cleanse(s,(unsigned int)siglen); | 267 OPENSSL_cleanse(s,(unsigned int)siglen); |
273 OPENSSL_free(s); | 268 OPENSSL_free(s); |
274 } | 269 } |
275 return(ret); | 270 return(ret); |
276 } | 271 } |
277 | 272 |
| 273 int RSA_verify(int dtype, const unsigned char *m, unsigned int m_len, |
| 274 const unsigned char *sigbuf, unsigned int siglen, |
| 275 RSA *rsa) |
| 276 { |
| 277 |
| 278 if((rsa->flags & RSA_FLAG_SIGN_VER) && rsa->meth->rsa_verify) |
| 279 { |
| 280 return rsa->meth->rsa_verify(dtype, m, m_len, |
| 281 sigbuf, siglen, rsa); |
| 282 } |
| 283 |
| 284 return int_rsa_verify(dtype, m, m_len, NULL, NULL, sigbuf, siglen, rsa); |
| 285 } |
OLD | NEW |