Update to NSS 3.14.3 Beta 1 for the TLS CBC constant-time

mozilla/security/nss/lib/softoken/pkcs11c.c

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 /*
  * This file implements PKCS 11 on top of our existing security modules
  *
  * For more information about PKCS 11 See PKCS 11 Token Inteface Standard.
  *   This implementation has two slots:
  *      slot 1 is our generic crypto support. It does not require login.
  *   It supports Public Key ops, and all they bulk ciphers and hashes. 
@@ skipping 439 matching lines @@
     case CKM_AES_CTS:
         return NSS_AES_CTS;
     case CKM_AES_CTR:
         return NSS_AES_CTR;
     case CKM_AES_GCM:
         return NSS_AES_GCM;
     }
     return -1;
 }
 
+static SECStatus
+sftk_EncryptOAEP(SFTKOAEPEncryptInfo *info, unsigned char *output,
+                 unsigned int *outputLen, unsigned int maxLen,
+                 unsigned char *input, unsigned int inputLen)
+{
+    return RSA_EncryptOAEP(info->params, info->key, output, outputLen,
+                           maxLen, input, inputLen);
+}
+
+static SECStatus
+sftk_DecryptOAEP(SFTKOAEPDecryptInfo *info, unsigned char *output,
+                 unsigned int *outputLen, unsigned int maxLen,
+                 unsigned char *input, unsigned int inputLen)
+{
+    return RSA_DecryptOAEP(info->params, info->key, output, outputLen,
+                           maxLen, input, inputLen);
+}
+
 /** NSC_CryptInit initializes an encryption/Decryption operation.
  *
  * Always called by NSC_EncryptInit, NSC_DecryptInit, NSC_WrapKey,NSC_UnwrapKey.
  * Called by NSC_SignInit, NSC_VerifyInit (via sftk_InitCBCMac) only for block
  *  ciphers MAC'ing.
  */
 static CK_RV
 sftk_CryptInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism,
      CK_OBJECT_HANDLE hKey,
      CK_ATTRIBUTE_TYPE mechUsage, CK_ATTRIBUTE_TYPE keyUsage,
@@ skipping 36 matching lines @@
     case CKM_RSA_X_509:
         if (key_type != CKK_RSA) {
             crv = CKR_KEY_TYPE_INCONSISTENT;
             break;
         }
         context->multi = PR_FALSE;
         context->rsa = PR_TRUE;
         if (isEncrypt) {
             NSSLOWKEYPublicKey *pubKey = sftk_GetPubKey(key,CKK_RSA,&crv);
             if (pubKey == NULL) {
+                crv = CKR_KEY_HANDLE_INVALID;
                 break;
             }
             context->maxLen = nsslowkey_PublicModulusLen(pubKey);
             context->cipherInfo =  (void *)pubKey;
             context->update = (SFTKCipher) 
                 (pMechanism->mechanism == CKM_RSA_X_509
                                         ? RSA_EncryptRaw : RSA_EncryptBlock);
         } else {
             NSSLOWKEYPrivateKey *privKey = sftk_GetPrivKey(key,CKK_RSA,&crv);
             if (privKey == NULL) {
+                crv = CKR_KEY_HANDLE_INVALID;
                 break;
             }
             context->maxLen = nsslowkey_PrivateModulusLen(privKey);
             context->cipherInfo =  (void *)privKey;
             context->update = (SFTKCipher) 
                 (pMechanism->mechanism == CKM_RSA_X_509
                                         ? RSA_DecryptRaw : RSA_DecryptBlock);
         }
         context->destroy = sftk_Null;
         break;
+/* XXX: Disabled until unit tests land.
+    case CKM_RSA_PKCS_OAEP:
+        if (key_type != CKK_RSA) {
+            crv = CKR_KEY_TYPE_INCONSISTENT;
+            break;
+        }
+        context->multi = PR_FALSE;
+        context->rsa = PR_TRUE;
+        if (pMechanism->ulParameterLen != sizeof(CK_RSA_PKCS_OAEP_PARAMS)) {
+            crv = CKR_MECHANISM_PARAM_INVALID;
+            break;
+        }
+        /\* XXX: Need Parameter validation here *\/
+        if (isEncrypt) {
+            SFTKOAEPEncryptInfo *info = PORT_New(SFTKOAEPEncryptInfo);
+            if (info == NULL) {
+                crv = CKR_HOST_MEMORY;
+                break;
+            }
+            info->params = pMechanism->pParameter;
+            info->key = sftk_GetPubKey(key, CKK_RSA, &crv);
+            if (info->key == NULL) {
+                PORT_Free(info);
+                crv = CKR_KEY_HANDLE_INVALID;
+                break;
+            }
+            context->update = (SFTKCipher) sftk_EncryptOAEP;
+            context->maxLen = nsslowkey_PublicModulusLen(info->key);
+            context->cipherInfo = info;
+        } else {
+            SFTKOAEPDecryptInfo *info = PORT_New(SFTKOAEPDecryptInfo);
+            if (info == NULL) {
+                crv = CKR_HOST_MEMORY;
+                break;
+            }
+            info->params = pMechanism->pParameter;
+            info->key = sftk_GetPrivKey(key, CKK_RSA, &crv);
+            if (info->key == NULL) {
+                PORT_Free(info);
+                crv = CKR_KEY_HANDLE_INVALID;
+                break;
+            }
+            context->update = (SFTKCipher) sftk_DecryptOAEP;
+            context->maxLen = nsslowkey_PrivateModulusLen(info->key);
+            context->cipherInfo = info;
+        }
+        context->destroy = (SFTKDestroy) sftk_Space;
+        break;
+*/
     case CKM_RC2_CBC_PAD:
         context->doPad = PR_TRUE;
         /* fall thru */
     case CKM_RC2_ECB:
     case CKM_RC2_CBC:
         context->blockSize = 8;
         if (key_type != CKK_RC2) {
             crv = CKR_KEY_TYPE_INCONSISTENT;
             break;
         }
@@ skipping 907 matching lines @@
 }
 
 DOSUB(MD2)
 DOSUB(MD5)
 DOSUB(SHA1)
 DOSUB(SHA224)
 DOSUB(SHA256)
 DOSUB(SHA384)
 DOSUB(SHA512)
 
-/*
- * HMAC General copies only a portion of the result. This update routine likes
- * the final HMAC output with the signature.
- */
 static SECStatus
-sftk_HMACCopy(CK_ULONG *copyLen,unsigned char *sig,unsigned int *sigLen,
-                unsigned int maxLen,unsigned char *hash, unsigned int hashLen)
+sftk_SignCopy(
+        CK_ULONG *copyLen,
+        void *out, unsigned int *outLength,
+        unsigned int maxLength,
+        const unsigned char *hashResult,
+        unsigned int hashResultLength)
 {
-    if (maxLen < *copyLen) return SECFailure;
-    PORT_Memcpy(sig,hash,*copyLen);
-    *sigLen = *copyLen;
+    unsigned int toCopy = *copyLen;
+    if (toCopy > maxLength) {
+        toCopy = maxLength;
+    }
+    if (toCopy > hashResultLength) {
+        toCopy = hashResultLength;
+    }
+    memcpy(out, hashResult, toCopy);
+    if (outLength) {
+        *outLength = toCopy;
+    }
     return SECSuccess;
 }
 
 /* Verify is just a compare for HMAC */
 static SECStatus
 sftk_HMACCmp(CK_ULONG *copyLen,unsigned char *sig,unsigned int sigLen,
                                 unsigned char *hash, unsigned int hashLen)
 {
     return (PORT_Memcmp(sig,hash,*copyLen) == 0) ? SECSuccess : SECFailure ; 
 }
@@ skipping 28 matching lines @@
     if (context->hashInfo == NULL) {
         if (PORT_GetError() == SEC_ERROR_INVALID_ARGS) {
             return CKR_KEY_SIZE_RANGE;
         }
         return CKR_HOST_MEMORY;
     }
     context->hashUpdate = (SFTKHash) HMAC_Update;
     context->end = (SFTKEnd) HMAC_Finish;
 
     context->hashdestroy = (SFTKDestroy) HMAC_Destroy;
-    intpointer = (CK_ULONG *) PORT_Alloc(sizeof(CK_ULONG));
+    intpointer = PORT_New(CK_ULONG);
     if (intpointer == NULL) {
         return CKR_HOST_MEMORY;
     }
     *intpointer = mac_size;
-    context->cipherInfo = (void *) intpointer;
+    context->cipherInfo = intpointer;
     context->destroy = (SFTKDestroy) sftk_Space;
-    context->update = (SFTKCipher) sftk_HMACCopy;
+    context->update = (SFTKCipher) sftk_SignCopy;
     context->verify = (SFTKVerify) sftk_HMACCmp;
     context->maxLen = hashObj->length;
     HMAC_Begin(HMACcontext);
     return CKR_OK;
 }
 
 /*
  *  SSL Macing support. SSL Macs are inited, then update with the base
  * hashing algorithm, then finalized in sign and verify
  */
@@ skipping 625 matching lines @@
         crv = sftk_doSSLMACInit(context,SEC_OID_MD5,key,
                                         *(CK_ULONG *)pMechanism->pParameter);
         break;
     case CKM_SSL3_SHA1_MAC:
         crv = sftk_doSSLMACInit(context,SEC_OID_SHA1,key,
                                         *(CK_ULONG *)pMechanism->pParameter);
         break;
     case CKM_TLS_PRF_GENERAL:
         crv = sftk_TLSPRFInit(context, key, key_type);
         break;
+
+    case CKM_NSS_HMAC_CONSTANT_TIME: {
+        sftk_MACConstantTimeCtx *ctx =
+            sftk_HMACConstantTime_New(pMechanism,key);
+        CK_ULONG *intpointer;
+
+        if (ctx == NULL) {
+            crv = CKR_ARGUMENTS_BAD;
+            break;
+        }
+        intpointer = PORT_New(CK_ULONG);
+        if (intpointer == NULL) {
+            crv = CKR_HOST_MEMORY;
+            break;
+        }
+        *intpointer = ctx->hash->length;
+
+        context->cipherInfo    = intpointer;
+        context->hashInfo      = ctx;
+        context->currentMech   = pMechanism->mechanism;
+        context->hashUpdate    = sftk_HMACConstantTime_Update;
+        context->hashdestroy   = sftk_MACConstantTime_DestroyContext;
+        context->end           = sftk_MACConstantTime_EndHash;
+        context->update        = sftk_SignCopy;
+        context->destroy       = sftk_Space;
+        context->maxLen        = 64;
+        context->multi         = PR_TRUE;
+        break;
+    }
+
+    case CKM_NSS_SSL3_MAC_CONSTANT_TIME: {
+        sftk_MACConstantTimeCtx *ctx =
+            sftk_SSLv3MACConstantTime_New(pMechanism,key);
+        CK_ULONG *intpointer;
+
+        if (ctx == NULL) {
+            crv = CKR_ARGUMENTS_BAD;
+            break;
+        }
+        intpointer = PORT_New(CK_ULONG);
+        if (intpointer == NULL) {
+            crv = CKR_HOST_MEMORY;
+            break;
+        }
+        *intpointer = ctx->hash->length;
+
+        context->cipherInfo    = intpointer;
+        context->hashInfo      = ctx;
+        context->currentMech   = pMechanism->mechanism;
+        context->hashUpdate    = sftk_SSLv3MACConstantTime_Update;
+        context->hashdestroy   = sftk_MACConstantTime_DestroyContext;
+        context->end           = sftk_MACConstantTime_EndHash;
+        context->update        = sftk_SignCopy;
+        context->destroy       = sftk_Space;
+        context->maxLen        = 64;
+        context->multi         = PR_TRUE;
+        break;
+    }
+
     default:
         crv = CKR_MECHANISM_INVALID;
         break;
     }
 
     if (crv != CKR_OK) {
         if (info) PORT_Free(info);
         sftk_FreeContext(context);
         sftk_FreeSession(session);
         return crv;
@@ skipping 4601 matching lines @@
     att = sftk_FindAttribute(key,CKA_VALUE);
     sftk_FreeObject(key);
     if (!att) {
         return CKR_KEY_HANDLE_INVALID;        
     }
     crv = NSC_DigestUpdate(hSession,(CK_BYTE_PTR)att->attrib.pValue,
                            att->attrib.ulValueLen);
     sftk_FreeAttribute(att);
     return crv;
 }