| OLD | NEW |
|---|
| (Empty) |
| 1 /* This Source Code Form is subject to the terms of the Mozilla Public | |
| 2 * License, v. 2.0. If a copy of the MPL was not distributed with this | |
| 3 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ | |
| 4 | |
| 5 /* | |
| 6 * RSA PKCS#1 v2.1 (RFC 3447) operations | |
| 7 */ | |
| 8 | |
| 9 #ifdef FREEBL_NO_DEPEND | |
| 10 #include "stubs.h" | |
| 11 #endif | |
| 12 | |
| 13 #include "secerr.h" | |
| 14 | |
| 15 #include "blapi.h" | |
| 16 #include "secitem.h" | |
| 17 #include "blapii.h" | |
| 18 | |
| 19 #define RSA_BLOCK_MIN_PAD_LEN 8 | |
| 20 #define RSA_BLOCK_FIRST_OCTET 0x00 | |
| 21 #define RSA_BLOCK_PRIVATE_PAD_OCTET 0xff | |
| 22 #define RSA_BLOCK_AFTER_PAD_OCTET 0x00 | |
| 23 | |
| 24 /* | |
| 25 * RSA block types | |
| 26 * | |
| 27 * The values of RSA_BlockPrivate and RSA_BlockPublic are fixed. | |
| 28 * The value of RSA_BlockRaw isn't fixed by definition, but we are keeping | |
| 29 * the value that NSS has been using in the past. | |
| 30 */ | |
| 31 typedef enum { | |
| 32 RSA_BlockPrivate = 1, /* pad for a private-key operation */ | |
| 33 RSA_BlockPublic = 2, /* pad for a public-key operation */ | |
| 34 RSA_BlockRaw = 4 /* simply justify the block appropriately */ | |
| 35 } RSA_BlockType; | |
| 36 | |
| 37 /* Needed for RSA-PSS functions */ | |
| 38 static const unsigned char eightZeros[] = { 0, 0, 0, 0, 0, 0, 0, 0 }; | |
| 39 | |
| 40 /* Constant time comparison of a single byte. | |
| 41 * Returns 1 iff a == b, otherwise returns 0. | |
| 42 * Note: For ranges of bytes, use constantTimeCompare. | |
| 43 */ | |
| 44 static unsigned char constantTimeEQ8(unsigned char a, unsigned char b) { | |
| 45 unsigned char c = ~((a - b) | (b - a)); | |
| 46 c >>= 7; | |
| 47 return c; | |
| 48 } | |
| 49 | |
| 50 /* Constant time comparison of a range of bytes. | |
| 51 * Returns 1 iff len bytes of a are identical to len bytes of b, otherwise | |
| 52 * returns 0. | |
| 53 */ | |
| 54 static unsigned char constantTimeCompare(const unsigned char *a, | |
| 55 const unsigned char *b, | |
| 56 unsigned int len) { | |
| 57 unsigned char tmp = 0; | |
| 58 unsigned int i; | |
| 59 for (i = 0; i < len; ++i, ++a, ++b) | |
| 60 tmp |= *a ^ *b; | |
| 61 return constantTimeEQ8(0x00, tmp); | |
| 62 } | |
| 63 | |
| 64 /* Constant time conditional. | |
| 65 * Returns a if c is 1, or b if c is 0. The result is undefined if c is | |
| 66 * not 0 or 1. | |
| 67 */ | |
| 68 static unsigned int constantTimeCondition(unsigned int c, | |
| 69 unsigned int a, | |
| 70 unsigned int b) | |
| 71 { | |
| 72 return (~(c - 1) & a) | ((c - 1) & b); | |
| 73 } | |
| 74 | |
| 75 static unsigned int | |
| 76 rsa_modulusLen(SECItem * modulus) | |
| 77 { | |
| 78 unsigned char byteZero = modulus->data[0]; | |
| 79 unsigned int modLen = modulus->len - !byteZero; | |
| 80 return modLen; | |
| 81 } | |
| 82 | |
| 83 /* | |
| 84 * Format one block of data for public/private key encryption using | |
| 85 * the rules defined in PKCS #1. | |
| 86 */ | |
| 87 static unsigned char * | |
| 88 rsa_FormatOneBlock(unsigned modulusLen, | |
| 89 RSA_BlockType blockType, | |
| 90 SECItem * data) | |
| 91 { | |
| 92 unsigned char *block; | |
| 93 unsigned char *bp; | |
| 94 int padLen; | |
| 95 int i, j; | |
| 96 SECStatus rv; | |
| 97 | |
| 98 block = (unsigned char *) PORT_Alloc(modulusLen); | |
| 99 if (block == NULL) | |
| 100 return NULL; | |
| 101 | |
| 102 bp = block; | |
| 103 | |
| 104 /* | |
| 105 * All RSA blocks start with two octets: | |
| 106 * 0x00 || BlockType | |
| 107 */ | |
| 108 *bp++ = RSA_BLOCK_FIRST_OCTET; | |
| 109 *bp++ = (unsigned char) blockType; | |
| 110 | |
| 111 switch (blockType) { | |
| 112 | |
| 113 /* | |
| 114 * Blocks intended for private-key operation. | |
| 115 */ | |
| 116 case RSA_BlockPrivate: /* preferred method */ | |
| 117 /* | |
| 118 * 0x00 || BT || Pad || 0x00 || ActualData | |
| 119 * 1 1 padLen 1 data->len | |
| 120 * Pad is either all 0x00 or all 0xff bytes, depending on blockType. | |
| 121 */ | |
| 122 padLen = modulusLen - data->len - 3; | |
| 123 PORT_Assert(padLen >= RSA_BLOCK_MIN_PAD_LEN); | |
| 124 if (padLen < RSA_BLOCK_MIN_PAD_LEN) { | |
| 125 PORT_Free(block); | |
| 126 return NULL; | |
| 127 } | |
| 128 PORT_Memset(bp, RSA_BLOCK_PRIVATE_PAD_OCTET, padLen); | |
| 129 bp += padLen; | |
| 130 *bp++ = RSA_BLOCK_AFTER_PAD_OCTET; | |
| 131 PORT_Memcpy(bp, data->data, data->len); | |
| 132 break; | |
| 133 | |
| 134 /* | |
| 135 * Blocks intended for public-key operation. | |
| 136 */ | |
| 137 case RSA_BlockPublic: | |
| 138 /* | |
| 139 * 0x00 || BT || Pad || 0x00 || ActualData | |
| 140 * 1 1 padLen 1 data->len | |
| 141 * Pad is all non-zero random bytes. | |
| 142 * | |
| 143 * Build the block left to right. | |
| 144 * Fill the entire block from Pad to the end with random bytes. | |
| 145 * Use the bytes after Pad as a supply of extra random bytes from | |
| 146 * which to find replacements for the zero bytes in Pad. | |
| 147 * If we need more than that, refill the bytes after Pad with | |
| 148 * new random bytes as necessary. | |
| 149 */ | |
| 150 padLen = modulusLen - (data->len + 3); | |
| 151 PORT_Assert(padLen >= RSA_BLOCK_MIN_PAD_LEN); | |
| 152 if (padLen < RSA_BLOCK_MIN_PAD_LEN) { | |
| 153 PORT_Free(block); | |
| 154 return NULL; | |
| 155 } | |
| 156 j = modulusLen - 2; | |
| 157 rv = RNG_GenerateGlobalRandomBytes(bp, j); | |
| 158 if (rv == SECSuccess) { | |
| 159 for (i = 0; i < padLen; ) { | |
| 160 unsigned char repl; | |
| 161 /* Pad with non-zero random data. */ | |
| 162 if (bp[i] != RSA_BLOCK_AFTER_PAD_OCTET) { | |
| 163 ++i; | |
| 164 continue; | |
| 165 } | |
| 166 if (j <= padLen) { | |
| 167 rv = RNG_GenerateGlobalRandomBytes(bp + padLen, | |
| 168 modulusLen - (2 + padLen)); | |
| 169 if (rv != SECSuccess) | |
| 170 break; | |
| 171 j = modulusLen - 2; | |
| 172 } | |
| 173 do { | |
| 174 repl = bp[--j]; | |
| 175 } while (repl == RSA_BLOCK_AFTER_PAD_OCTET && j > padLen); | |
| 176 if (repl != RSA_BLOCK_AFTER_PAD_OCTET) { | |
| 177 bp[i++] = repl; | |
| 178 } | |
| 179 } | |
| 180 } | |
| 181 if (rv != SECSuccess) { | |
| 182 PORT_Free(block); | |
| 183 PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); | |
| 184 return NULL; | |
| 185 } | |
| 186 bp += padLen; | |
| 187 *bp++ = RSA_BLOCK_AFTER_PAD_OCTET; | |
| 188 PORT_Memcpy(bp, data->data, data->len); | |
| 189 break; | |
| 190 | |
| 191 default: | |
| 192 PORT_Assert(0); | |
| 193 PORT_Free(block); | |
| 194 return NULL; | |
| 195 } | |
| 196 | |
| 197 return block; | |
| 198 } | |
| 199 | |
| 200 static SECStatus | |
| 201 rsa_FormatBlock(SECItem * result, | |
| 202 unsigned modulusLen, | |
| 203 RSA_BlockType blockType, | |
| 204 SECItem * data) | |
| 205 { | |
| 206 switch (blockType) { | |
| 207 case RSA_BlockPrivate: | |
| 208 case RSA_BlockPublic: | |
| 209 /* | |
| 210 * 0x00 || BT || Pad || 0x00 || ActualData | |
| 211 * | |
| 212 * The "3" below is the first octet + the second octet + the 0x00 | |
| 213 * octet that always comes just before the ActualData. | |
| 214 */ | |
| 215 PORT_Assert(data->len <= (modulusLen - (3 + RSA_BLOCK_MIN_PAD_LEN))); | |
| 216 | |
| 217 result->data = rsa_FormatOneBlock(modulusLen, blockType, data); | |
| 218 if (result->data == NULL) { | |
| 219 result->len = 0; | |
| 220 return SECFailure; | |
| 221 } | |
| 222 result->len = modulusLen; | |
| 223 | |
| 224 break; | |
| 225 | |
| 226 case RSA_BlockRaw: | |
| 227 /* | |
| 228 * Pad || ActualData | |
| 229 * Pad is zeros. The application is responsible for recovering | |
| 230 * the actual data. | |
| 231 */ | |
| 232 if (data->len > modulusLen ) { | |
| 233 return SECFailure; | |
| 234 } | |
| 235 result->data = (unsigned char*)PORT_ZAlloc(modulusLen); | |
| 236 result->len = modulusLen; | |
| 237 PORT_Memcpy(result->data + (modulusLen - data->len), | |
| 238 data->data, data->len); | |
| 239 break; | |
| 240 | |
| 241 default: | |
| 242 PORT_Assert(0); | |
| 243 result->data = NULL; | |
| 244 result->len = 0; | |
| 245 return SECFailure; | |
| 246 } | |
| 247 | |
| 248 return SECSuccess; | |
| 249 } | |
| 250 | |
| 251 /* | |
| 252 * Mask generation function MGF1 as defined in PKCS #1 v2.1 / RFC 3447. | |
| 253 */ | |
| 254 static SECStatus | |
| 255 MGF1(HASH_HashType hashAlg, | |
| 256 unsigned char * mask, | |
| 257 unsigned int maskLen, | |
| 258 const unsigned char * mgfSeed, | |
| 259 unsigned int mgfSeedLen) | |
| 260 { | |
| 261 unsigned int digestLen; | |
| 262 PRUint32 counter; | |
| 263 PRUint32 rounds; | |
| 264 unsigned char * tempHash; | |
| 265 unsigned char * temp; | |
| 266 const SECHashObject * hash; | |
| 267 void * hashContext; | |
| 268 unsigned char C[4]; | |
| 269 | |
| 270 hash = HASH_GetRawHashObject(hashAlg); | |
| 271 if (hash == NULL) | |
| 272 return SECFailure; | |
| 273 | |
| 274 hashContext = (*hash->create)(); | |
| 275 rounds = (maskLen + hash->length - 1) / hash->length; | |
| 276 for (counter = 0; counter < rounds; counter++) { | |
| 277 C[0] = (unsigned char)((counter >> 24) & 0xff); | |
| 278 C[1] = (unsigned char)((counter >> 16) & 0xff); | |
| 279 C[2] = (unsigned char)((counter >> 8) & 0xff); | |
| 280 C[3] = (unsigned char)(counter & 0xff); | |
| 281 | |
| 282 /* This could be optimized when the clone functions in | |
| 283 * rawhash.c are implemented. */ | |
| 284 (*hash->begin)(hashContext); | |
| 285 (*hash->update)(hashContext, mgfSeed, mgfSeedLen); | |
| 286 (*hash->update)(hashContext, C, sizeof C); | |
| 287 | |
| 288 tempHash = mask + counter * hash->length; | |
| 289 if (counter != (rounds - 1)) { | |
| 290 (*hash->end)(hashContext, tempHash, &digestLen, hash->length); | |
| 291 } else { /* we're in the last round and need to cut the hash */ | |
| 292 temp = (unsigned char *)PORT_Alloc(hash->length); | |
| 293 (*hash->end)(hashContext, temp, &digestLen, hash->length); | |
| 294 PORT_Memcpy(tempHash, temp, maskLen - counter * hash->length); | |
| 295 PORT_Free(temp); | |
| 296 } | |
| 297 } | |
| 298 (*hash->destroy)(hashContext, PR_TRUE); | |
| 299 | |
| 300 return SECSuccess; | |
| 301 } | |
| 302 | |
| 303 /* XXX Doesn't set error code */ | |
| 304 SECStatus | |
| 305 RSA_SignRaw(RSAPrivateKey * key, | |
| 306 unsigned char * output, | |
| 307 unsigned int * outputLen, | |
| 308 unsigned int maxOutputLen, | |
| 309 const unsigned char * data, | |
| 310 unsigned int dataLen) | |
| 311 { | |
| 312 SECStatus rv = SECSuccess; | |
| 313 unsigned int modulusLen = rsa_modulusLen(&key->modulus); | |
| 314 SECItem formatted; | |
| 315 SECItem unformatted; | |
| 316 | |
| 317 if (maxOutputLen < modulusLen) | |
| 318 return SECFailure; | |
| 319 | |
| 320 unformatted.len = dataLen; | |
| 321 unformatted.data = (unsigned char*)data; | |
| 322 formatted.data = NULL; | |
| 323 rv = rsa_FormatBlock(&formatted, modulusLen, RSA_BlockRaw, &unformatted); | |
| 324 if (rv != SECSuccess) | |
| 325 goto done; | |
| 326 | |
| 327 rv = RSA_PrivateKeyOpDoubleChecked(key, output, formatted.data); | |
| 328 *outputLen = modulusLen; | |
| 329 | |
| 330 done: | |
| 331 if (formatted.data != NULL) | |
| 332 PORT_ZFree(formatted.data, modulusLen); | |
| 333 return rv; | |
| 334 } | |
| 335 | |
| 336 /* XXX Doesn't set error code */ | |
| 337 SECStatus | |
| 338 RSA_CheckSignRaw(RSAPublicKey * key, | |
| 339 const unsigned char * sig, | |
| 340 unsigned int sigLen, | |
| 341 const unsigned char * hash, | |
| 342 unsigned int hashLen) | |
| 343 { | |
| 344 SECStatus rv; | |
| 345 unsigned int modulusLen = rsa_modulusLen(&key->modulus); | |
| 346 unsigned char * buffer; | |
| 347 | |
| 348 if (sigLen != modulusLen) | |
| 349 goto failure; | |
| 350 if (hashLen > modulusLen) | |
| 351 goto failure; | |
| 352 | |
| 353 buffer = (unsigned char *)PORT_Alloc(modulusLen + 1); | |
| 354 if (!buffer) | |
| 355 goto failure; | |
| 356 | |
| 357 rv = RSA_PublicKeyOp(key, buffer, sig); | |
| 358 if (rv != SECSuccess) | |
| 359 goto loser; | |
| 360 | |
| 361 /* | |
| 362 * make sure we get the same results | |
| 363 */ | |
| 364 /* XXX(rsleevi): Constant time */ | |
| 365 /* NOTE: should we verify the leading zeros? */ | |
| 366 if (PORT_Memcmp(buffer + (modulusLen - hashLen), hash, hashLen) != 0) | |
| 367 goto loser; | |
| 368 | |
| 369 PORT_Free(buffer); | |
| 370 return SECSuccess; | |
| 371 | |
| 372 loser: | |
| 373 PORT_Free(buffer); | |
| 374 failure: | |
| 375 return SECFailure; | |
| 376 } | |
| 377 | |
| 378 /* XXX Doesn't set error code */ | |
| 379 SECStatus | |
| 380 RSA_CheckSignRecoverRaw(RSAPublicKey * key, | |
| 381 unsigned char * data, | |
| 382 unsigned int * dataLen, | |
| 383 unsigned int maxDataLen, | |
| 384 const unsigned char * sig, | |
| 385 unsigned int sigLen) | |
| 386 { | |
| 387 SECStatus rv; | |
| 388 unsigned int modulusLen = rsa_modulusLen(&key->modulus); | |
| 389 | |
| 390 if (sigLen != modulusLen) | |
| 391 goto failure; | |
| 392 if (maxDataLen < modulusLen) | |
| 393 goto failure; | |
| 394 | |
| 395 rv = RSA_PublicKeyOp(key, data, sig); | |
| 396 if (rv != SECSuccess) | |
| 397 goto failure; | |
| 398 | |
| 399 *dataLen = modulusLen; | |
| 400 return SECSuccess; | |
| 401 | |
| 402 failure: | |
| 403 return SECFailure; | |
| 404 } | |
| 405 | |
| 406 /* XXX Doesn't set error code */ | |
| 407 SECStatus | |
| 408 RSA_EncryptRaw(RSAPublicKey * key, | |
| 409 unsigned char * output, | |
| 410 unsigned int * outputLen, | |
| 411 unsigned int maxOutputLen, | |
| 412 const unsigned char * input, | |
| 413 unsigned int inputLen) | |
| 414 { | |
| 415 SECStatus rv; | |
| 416 unsigned int modulusLen = rsa_modulusLen(&key->modulus); | |
| 417 SECItem formatted; | |
| 418 SECItem unformatted; | |
| 419 | |
| 420 formatted.data = NULL; | |
| 421 if (maxOutputLen < modulusLen) | |
| 422 goto failure; | |
| 423 | |
| 424 unformatted.len = inputLen; | |
| 425 unformatted.data = (unsigned char*)input; | |
| 426 formatted.data = NULL; | |
| 427 rv = rsa_FormatBlock(&formatted, modulusLen, RSA_BlockRaw, &unformatted); | |
| 428 if (rv != SECSuccess) | |
| 429 goto failure; | |
| 430 | |
| 431 rv = RSA_PublicKeyOp(key, output, formatted.data); | |
| 432 if (rv != SECSuccess) | |
| 433 goto failure; | |
| 434 | |
| 435 PORT_ZFree(formatted.data, modulusLen); | |
| 436 *outputLen = modulusLen; | |
| 437 return SECSuccess; | |
| 438 | |
| 439 failure: | |
| 440 if (formatted.data != NULL) | |
| 441 PORT_ZFree(formatted.data, modulusLen); | |
| 442 return SECFailure; | |
| 443 } | |
| 444 | |
| 445 /* XXX Doesn't set error code */ | |
| 446 SECStatus | |
| 447 RSA_DecryptRaw(RSAPrivateKey * key, | |
| 448 unsigned char * output, | |
| 449 unsigned int * outputLen, | |
| 450 unsigned int maxOutputLen, | |
| 451 const unsigned char * input, | |
| 452 unsigned int inputLen) | |
| 453 { | |
| 454 SECStatus rv; | |
| 455 unsigned int modulusLen = rsa_modulusLen(&key->modulus); | |
| 456 | |
| 457 if (modulusLen > maxOutputLen) | |
| 458 goto failure; | |
| 459 if (inputLen != modulusLen) | |
| 460 goto failure; | |
| 461 | |
| 462 rv = RSA_PrivateKeyOp(key, output, input); | |
| 463 if (rv != SECSuccess) | |
| 464 goto failure; | |
| 465 | |
| 466 *outputLen = modulusLen; | |
| 467 return SECSuccess; | |
| 468 | |
| 469 failure: | |
| 470 return SECFailure; | |
| 471 } | |
| 472 | |
| 473 /* | |
| 474 * Decodes an EME-OAEP encoded block, validating the encoding in constant | |
| 475 * time. | |
| 476 * Described in RFC 3447, section 7.1.2. | |
| 477 * input contains the encoded block, after decryption. | |
| 478 * label is the optional value L that was associated with the message. | |
| 479 * On success, the original message and message length will be stored in | |
| 480 * output and outputLen. | |
| 481 */ | |
| 482 static SECStatus | |
| 483 eme_oaep_decode(unsigned char * output, | |
| 484 unsigned int * outputLen, | |
| 485 unsigned int maxOutputLen, | |
| 486 const unsigned char * input, | |
| 487 unsigned int inputLen, | |
| 488 HASH_HashType hashAlg, | |
| 489 HASH_HashType maskHashAlg, | |
| 490 const unsigned char * label, | |
| 491 unsigned int labelLen) | |
| 492 { | |
| 493 const SECHashObject * hash; | |
| 494 void * hashContext; | |
| 495 SECStatus rv = SECFailure; | |
| 496 unsigned char labelHash[HASH_LENGTH_MAX]; | |
| 497 unsigned int i; | |
| 498 unsigned int maskLen; | |
| 499 unsigned int paddingOffset; | |
| 500 unsigned char * mask = NULL; | |
| 501 unsigned char * tmpOutput = NULL; | |
| 502 unsigned char isGood; | |
| 503 unsigned char foundPaddingEnd; | |
| 504 | |
| 505 hash = HASH_GetRawHashObject(hashAlg); | |
| 506 | |
| 507 /* 1.c */ | |
| 508 if (inputLen < (hash->length * 2) + 2) { | |
| 509 PORT_SetError(SEC_ERROR_INPUT_LEN); | |
| 510 return SECFailure; | |
| 511 } | |
| 512 | |
| 513 /* Step 3.a - Generate lHash */ | |
| 514 hashContext = (*hash->create)(); | |
| 515 if (hashContext == NULL) { | |
| 516 PORT_SetError(SEC_ERROR_NO_MEMORY); | |
| 517 return SECFailure; | |
| 518 } | |
| 519 (*hash->begin)(hashContext); | |
| 520 if (labelLen > 0) | |
| 521 (*hash->update)(hashContext, label, labelLen); | |
| 522 (*hash->end)(hashContext, labelHash, &i, sizeof(labelHash)); | |
| 523 (*hash->destroy)(hashContext, PR_TRUE); | |
| 524 | |
| 525 tmpOutput = (unsigned char*)PORT_Alloc(inputLen); | |
| 526 if (tmpOutput == NULL) { | |
| 527 PORT_SetError(SEC_ERROR_NO_MEMORY); | |
| 528 goto done; | |
| 529 } | |
| 530 | |
| 531 maskLen = inputLen - hash->length - 1; | |
| 532 mask = (unsigned char*)PORT_Alloc(maskLen); | |
| 533 if (mask == NULL) { | |
| 534 PORT_SetError(SEC_ERROR_NO_MEMORY); | |
| 535 goto done; | |
| 536 } | |
| 537 | |
| 538 PORT_Memcpy(tmpOutput, input, inputLen); | |
| 539 | |
| 540 /* 3.c - Generate seedMask */ | |
| 541 MGF1(maskHashAlg, mask, hash->length, &tmpOutput[1 + hash->length], | |
| 542 inputLen - hash->length - 1); | |
| 543 /* 3.d - Unmask seed */ | |
| 544 for (i = 0; i < hash->length; ++i) | |
| 545 tmpOutput[1 + i] ^= mask[i]; | |
| 546 | |
| 547 /* 3.e - Generate dbMask */ | |
| 548 MGF1(maskHashAlg, mask, maskLen, &tmpOutput[1], hash->length); | |
| 549 /* 3.f - Unmask DB */ | |
| 550 for (i = 0; i < maskLen; ++i) | |
| 551 tmpOutput[1 + hash->length + i] ^= mask[i]; | |
| 552 | |
| 553 /* 3.g - Compare Y, lHash, and PS in constant time | |
| 554 * Warning: This code is timing dependent and must not disclose which of | |
| 555 * these were invalid. | |
| 556 */ | |
| 557 paddingOffset = 0; | |
| 558 isGood = 1; | |
| 559 foundPaddingEnd = 0; | |
| 560 | |
| 561 /* Compare Y */ | |
| 562 isGood &= constantTimeEQ8(0x00, tmpOutput[0]); | |
| 563 | |
| 564 /* Compare lHash and lHash' */ | |
| 565 isGood &= constantTimeCompare(&labelHash[0], | |
| 566 &tmpOutput[1 + hash->length], | |
| 567 hash->length); | |
| 568 | |
| 569 /* Compare that the padding is zero or more zero octets, followed by a | |
| 570 * 0x01 octet */ | |
| 571 for (i = 1 + (hash->length * 2); i < inputLen; ++i) { | |
| 572 unsigned char isZero = constantTimeEQ8(0x00, tmpOutput[i]); | |
| 573 unsigned char isOne = constantTimeEQ8(0x01, tmpOutput[i]); | |
| 574 /* non-constant time equivalent: | |
| 575 * if (tmpOutput[i] == 0x01 && !foundPaddingEnd) | |
| 576 * paddingOffset = i; | |
| 577 */ | |
| 578 paddingOffset = constantTimeCondition(isOne & ~foundPaddingEnd, i, | |
| 579 paddingOffset); | |
| 580 /* non-constant time equivalent: | |
| 581 * if (tmpOutput[i] == 0x01) | |
| 582 * foundPaddingEnd = true; | |
| 583 * | |
| 584 * Note: This may yield false positives, as it will be set whenever | |
| 585 * a 0x01 byte is encountered. If there was bad padding (eg: | |
| 586 * 0x03 0x02 0x01), foundPaddingEnd will still be set to true, and | |
| 587 * paddingOffset will still be set to 2. | |
| 588 */ | |
| 589 foundPaddingEnd = constantTimeCondition(isOne, 1, foundPaddingEnd); | |
| 590 /* non-constant time equivalent: | |
| 591 * if (tmpOutput[i] != 0x00 && tmpOutput[i] != 0x01 && | |
| 592 * !foundPaddingEnd) { | |
| 593 * isGood = false; | |
| 594 * } | |
| 595 * | |
| 596 * Note: This may yield false positives, as a message (and padding) | |
| 597 * that is entirely zeros will result in isGood still being true. Thus | |
| 598 * it's necessary to check foundPaddingEnd is positive below. | |
| 599 */ | |
| 600 isGood = constantTimeCondition(~foundPaddingEnd & ~isZero, 0, isGood); | |
| 601 } | |
| 602 | |
| 603 /* While both isGood and foundPaddingEnd may have false positives, they | |
| 604 * cannot BOTH have false positives. If both are not true, then an invalid | |
| 605 * message was received. Note, this comparison must still be done in constan
t | |
| 606 * time so as not to leak either condition. | |
| 607 */ | |
| 608 if (!(isGood & foundPaddingEnd)) { | |
| 609 PORT_SetError(SEC_ERROR_BAD_DATA); | |
| 610 goto done; | |
| 611 } | |
| 612 | |
| 613 /* End timing dependent code */ | |
| 614 | |
| 615 ++paddingOffset; /* Skip the 0x01 following the end of PS */ | |
| 616 | |
| 617 *outputLen = inputLen - paddingOffset; | |
| 618 if (*outputLen > maxOutputLen) { | |
| 619 PORT_SetError(SEC_ERROR_OUTPUT_LEN); | |
| 620 goto done; | |
| 621 } | |
| 622 | |
| 623 if (*outputLen) | |
| 624 PORT_Memcpy(output, &tmpOutput[paddingOffset], *outputLen); | |
| 625 rv = SECSuccess; | |
| 626 | |
| 627 done: | |
| 628 if (mask) | |
| 629 PORT_ZFree(mask, maskLen); | |
| 630 if (tmpOutput) | |
| 631 PORT_ZFree(tmpOutput, inputLen); | |
| 632 return rv; | |
| 633 } | |
| 634 | |
| 635 /* | |
| 636 * Generate an EME-OAEP encoded block for encryption | |
| 637 * Described in RFC 3447, section 7.1.1 | |
| 638 * We use input instead of M for the message to be encrypted | |
| 639 * label is the optional value L to be associated with the message. | |
| 640 */ | |
| 641 static SECStatus | |
| 642 eme_oaep_encode(unsigned char * em, | |
| 643 unsigned int emLen, | |
| 644 const unsigned char * input, | |
| 645 unsigned int inputLen, | |
| 646 HASH_HashType hashAlg, | |
| 647 HASH_HashType maskHashAlg, | |
| 648 const unsigned char * label, | |
| 649 unsigned int labelLen, | |
| 650 const unsigned char * seed, | |
| 651 unsigned int seedLen) | |
| 652 { | |
| 653 const SECHashObject * hash; | |
| 654 void * hashContext; | |
| 655 SECStatus rv; | |
| 656 unsigned char * mask; | |
| 657 unsigned int reservedLen; | |
| 658 unsigned int dbMaskLen; | |
| 659 unsigned int i; | |
| 660 | |
| 661 hash = HASH_GetRawHashObject(hashAlg); | |
| 662 PORT_Assert(seed == NULL || seedLen == hash->length); | |
| 663 | |
| 664 /* Step 1.b */ | |
| 665 reservedLen = (2 * hash->length) + 2; | |
| 666 if (emLen < reservedLen || inputLen > (emLen - reservedLen)) { | |
| 667 PORT_SetError(SEC_ERROR_INPUT_LEN); | |
| 668 return SECFailure; | |
| 669 } | |
| 670 | |
| 671 /* | |
| 672 * From RFC 3447, Section 7.1 | |
| 673 * +----------+---------+-------+ | |
| 674 * DB = | lHash | PS | M | | |
| 675 * +----------+---------+-------+ | |
| 676 * | | |
| 677 * +----------+ V | |
| 678 * | seed |--> MGF ---> xor | |
| 679 * +----------+ | | |
| 680 * | | | |
| 681 * +--+ V | | |
| 682 * |00| xor <----- MGF <-----| | |
| 683 * +--+ | | | |
| 684 * | | | | |
| 685 * V V V | |
| 686 * +--+----------+----------------------------+ | |
| 687 * EM = |00|maskedSeed| maskedDB | | |
| 688 * +--+----------+----------------------------+ | |
| 689 * | |
| 690 * We use mask to hold the result of the MGF functions, and all other | |
| 691 * values are generated in their final resting place. | |
| 692 */ | |
| 693 *em = 0x00; | |
| 694 | |
| 695 /* Step 2.a - Generate lHash */ | |
| 696 hashContext = (*hash->create)(); | |
| 697 if (hashContext == NULL) { | |
| 698 PORT_SetError(SEC_ERROR_NO_MEMORY); | |
| 699 return SECFailure; | |
| 700 } | |
| 701 (*hash->begin)(hashContext); | |
| 702 if (labelLen > 0) | |
| 703 (*hash->update)(hashContext, label, labelLen); | |
| 704 (*hash->end)(hashContext, &em[1 + hash->length], &i, hash->length); | |
| 705 (*hash->destroy)(hashContext, PR_TRUE); | |
| 706 | |
| 707 /* Step 2.b - Generate PS */ | |
| 708 if (emLen - reservedLen - inputLen > 0) { | |
| 709 PORT_Memset(em + 1 + (hash->length * 2), 0x00, | |
| 710 emLen - reservedLen - inputLen); | |
| 711 } | |
| 712 | |
| 713 /* Step 2.c. - Generate DB | |
| 714 * DB = lHash || PS || 0x01 || M | |
| 715 * Note that PS and lHash have already been placed into em at their | |
| 716 * appropriate offsets. This just copies M into place | |
| 717 */ | |
| 718 em[emLen - inputLen - 1] = 0x01; | |
| 719 if (inputLen) | |
| 720 PORT_Memcpy(em + emLen - inputLen, input, inputLen); | |
| 721 | |
| 722 if (seed == NULL) { | |
| 723 /* Step 2.d - Generate seed */ | |
| 724 rv = RNG_GenerateGlobalRandomBytes(em + 1, hash->length); | |
| 725 if (rv != SECSuccess) { | |
| 726 return rv; | |
| 727 } | |
| 728 } else { | |
| 729 /* For Known Answer Tests, copy the supplied seed. */ | |
| 730 PORT_Memcpy(em + 1, seed, seedLen); | |
| 731 } | |
| 732 | |
| 733 /* Step 2.e - Generate dbMask*/ | |
| 734 dbMaskLen = emLen - hash->length - 1; | |
| 735 mask = (unsigned char*)PORT_Alloc(dbMaskLen); | |
| 736 if (mask == NULL) { | |
| 737 PORT_SetError(SEC_ERROR_NO_MEMORY); | |
| 738 return SECFailure; | |
| 739 } | |
| 740 MGF1(maskHashAlg, mask, dbMaskLen, em + 1, hash->length); | |
| 741 /* Step 2.f - Compute maskedDB*/ | |
| 742 for (i = 0; i < dbMaskLen; ++i) | |
| 743 em[1 + hash->length + i] ^= mask[i]; | |
| 744 | |
| 745 /* Step 2.g - Generate seedMask */ | |
| 746 MGF1(maskHashAlg, mask, hash->length, &em[1 + hash->length], dbMaskLen); | |
| 747 /* Step 2.h - Compute maskedSeed */ | |
| 748 for (i = 0; i < hash->length; ++i) | |
| 749 em[1 + i] ^= mask[i]; | |
| 750 | |
| 751 PORT_ZFree(mask, dbMaskLen); | |
| 752 return SECSuccess; | |
| 753 } | |
| 754 | |
| 755 SECStatus | |
| 756 RSA_EncryptOAEP(RSAPublicKey * key, | |
| 757 HASH_HashType hashAlg, | |
| 758 HASH_HashType maskHashAlg, | |
| 759 const unsigned char * label, | |
| 760 unsigned int labelLen, | |
| 761 const unsigned char * seed, | |
| 762 unsigned int seedLen, | |
| 763 unsigned char * output, | |
| 764 unsigned int * outputLen, | |
| 765 unsigned int maxOutputLen, | |
| 766 const unsigned char * input, | |
| 767 unsigned int inputLen) | |
| 768 { | |
| 769 SECStatus rv = SECFailure; | |
| 770 unsigned int modulusLen = rsa_modulusLen(&key->modulus); | |
| 771 unsigned char * oaepEncoded = NULL; | |
| 772 | |
| 773 if (maxOutputLen < modulusLen) { | |
| 774 PORT_SetError(SEC_ERROR_OUTPUT_LEN); | |
| 775 return SECFailure; | |
| 776 } | |
| 777 | |
| 778 if ((hashAlg == HASH_AlgNULL) || (maskHashAlg == HASH_AlgNULL)) { | |
| 779 PORT_SetError(SEC_ERROR_INVALID_ALGORITHM); | |
| 780 return SECFailure; | |
| 781 } | |
| 782 | |
| 783 if ((labelLen == 0 && label != NULL) || | |
| 784 (labelLen > 0 && label == NULL)) { | |
| 785 PORT_SetError(SEC_ERROR_INVALID_ALGORITHM); | |
| 786 return SECFailure; | |
| 787 } | |
| 788 | |
| 789 oaepEncoded = (unsigned char *)PORT_Alloc(modulusLen); | |
| 790 if (oaepEncoded == NULL) { | |
| 791 PORT_SetError(SEC_ERROR_NO_MEMORY); | |
| 792 return SECFailure; | |
| 793 } | |
| 794 rv = eme_oaep_encode(oaepEncoded, modulusLen, input, inputLen, | |
| 795 hashAlg, maskHashAlg, label, labelLen, seed, seedLen); | |
| 796 if (rv != SECSuccess) | |
| 797 goto done; | |
| 798 | |
| 799 rv = RSA_PublicKeyOp(key, output, oaepEncoded); | |
| 800 if (rv != SECSuccess) | |
| 801 goto done; | |
| 802 *outputLen = modulusLen; | |
| 803 | |
| 804 done: | |
| 805 PORT_Free(oaepEncoded); | |
| 806 return rv; | |
| 807 } | |
| 808 | |
| 809 SECStatus | |
| 810 RSA_DecryptOAEP(RSAPrivateKey * key, | |
| 811 HASH_HashType hashAlg, | |
| 812 HASH_HashType maskHashAlg, | |
| 813 const unsigned char * label, | |
| 814 unsigned int labelLen, | |
| 815 unsigned char * output, | |
| 816 unsigned int * outputLen, | |
| 817 unsigned int maxOutputLen, | |
| 818 const unsigned char * input, | |
| 819 unsigned int inputLen) | |
| 820 { | |
| 821 SECStatus rv = SECFailure; | |
| 822 unsigned int modulusLen = rsa_modulusLen(&key->modulus); | |
| 823 unsigned char * oaepEncoded = NULL; | |
| 824 | |
| 825 if ((hashAlg == HASH_AlgNULL) || (maskHashAlg == HASH_AlgNULL)) { | |
| 826 PORT_SetError(SEC_ERROR_INVALID_ALGORITHM); | |
| 827 return SECFailure; | |
| 828 } | |
| 829 | |
| 830 if (inputLen != modulusLen) { | |
| 831 PORT_SetError(SEC_ERROR_INPUT_LEN); | |
| 832 return SECFailure; | |
| 833 } | |
| 834 | |
| 835 if ((labelLen == 0 && label != NULL) || | |
| 836 (labelLen > 0 && label == NULL)) { | |
| 837 PORT_SetError(SEC_ERROR_INVALID_ALGORITHM); | |
| 838 return SECFailure; | |
| 839 } | |
| 840 | |
| 841 oaepEncoded = (unsigned char *)PORT_Alloc(modulusLen); | |
| 842 if (oaepEncoded == NULL) { | |
| 843 PORT_SetError(SEC_ERROR_NO_MEMORY); | |
| 844 return SECFailure; | |
| 845 } | |
| 846 | |
| 847 rv = RSA_PrivateKeyOpDoubleChecked(key, oaepEncoded, input); | |
| 848 if (rv != SECSuccess) { | |
| 849 goto done; | |
| 850 } | |
| 851 rv = eme_oaep_decode(output, outputLen, maxOutputLen, oaepEncoded, | |
| 852 modulusLen, hashAlg, maskHashAlg, label, | |
| 853 labelLen); | |
| 854 | |
| 855 done: | |
| 856 if (oaepEncoded) | |
| 857 PORT_ZFree(oaepEncoded, modulusLen); | |
| 858 return rv; | |
| 859 } | |
| 860 | |
| 861 /* XXX Doesn't set error code */ | |
| 862 SECStatus | |
| 863 RSA_EncryptBlock(RSAPublicKey * key, | |
| 864 unsigned char * output, | |
| 865 unsigned int * outputLen, | |
| 866 unsigned int maxOutputLen, | |
| 867 const unsigned char * input, | |
| 868 unsigned int inputLen) | |
| 869 { | |
| 870 SECStatus rv; | |
| 871 unsigned int modulusLen = rsa_modulusLen(&key->modulus); | |
| 872 SECItem formatted; | |
| 873 SECItem unformatted; | |
| 874 | |
| 875 formatted.data = NULL; | |
| 876 if (maxOutputLen < modulusLen) | |
| 877 goto failure; | |
| 878 | |
| 879 unformatted.len = inputLen; | |
| 880 unformatted.data = (unsigned char*)input; | |
| 881 formatted.data = NULL; | |
| 882 rv = rsa_FormatBlock(&formatted, modulusLen, RSA_BlockPublic, | |
| 883 &unformatted); | |
| 884 if (rv != SECSuccess) | |
| 885 goto failure; | |
| 886 | |
| 887 rv = RSA_PublicKeyOp(key, output, formatted.data); | |
| 888 if (rv != SECSuccess) | |
| 889 goto failure; | |
| 890 | |
| 891 PORT_ZFree(formatted.data, modulusLen); | |
| 892 *outputLen = modulusLen; | |
| 893 return SECSuccess; | |
| 894 | |
| 895 failure: | |
| 896 if (formatted.data != NULL) | |
| 897 PORT_ZFree(formatted.data, modulusLen); | |
| 898 return SECFailure; | |
| 899 } | |
| 900 | |
| 901 /* XXX Doesn't set error code */ | |
| 902 SECStatus | |
| 903 RSA_DecryptBlock(RSAPrivateKey * key, | |
| 904 unsigned char * output, | |
| 905 unsigned int * outputLen, | |
| 906 unsigned int maxOutputLen, | |
| 907 const unsigned char * input, | |
| 908 unsigned int inputLen) | |
| 909 { | |
| 910 SECStatus rv; | |
| 911 unsigned int modulusLen = rsa_modulusLen(&key->modulus); | |
| 912 unsigned int i; | |
| 913 unsigned char * buffer; | |
| 914 | |
| 915 if (inputLen != modulusLen) | |
| 916 goto failure; | |
| 917 | |
| 918 buffer = (unsigned char *)PORT_Alloc(modulusLen + 1); | |
| 919 if (!buffer) | |
| 920 goto failure; | |
| 921 | |
| 922 rv = RSA_PrivateKeyOp(key, buffer, input); | |
| 923 if (rv != SECSuccess) | |
| 924 goto loser; | |
| 925 | |
| 926 /* XXX(rsleevi): Constant time */ | |
| 927 if (buffer[0] != RSA_BLOCK_FIRST_OCTET || | |
| 928 buffer[1] != (unsigned char)RSA_BlockPublic) { | |
| 929 goto loser; | |
| 930 } | |
| 931 *outputLen = 0; | |
| 932 for (i = 2; i < modulusLen; i++) { | |
| 933 if (buffer[i] == RSA_BLOCK_AFTER_PAD_OCTET) { | |
| 934 *outputLen = modulusLen - i - 1; | |
| 935 break; | |
| 936 } | |
| 937 } | |
| 938 if (*outputLen == 0) | |
| 939 goto loser; | |
| 940 if (*outputLen > maxOutputLen) | |
| 941 goto loser; | |
| 942 | |
| 943 PORT_Memcpy(output, buffer + modulusLen - *outputLen, *outputLen); | |
| 944 | |
| 945 PORT_Free(buffer); | |
| 946 return SECSuccess; | |
| 947 | |
| 948 loser: | |
| 949 PORT_Free(buffer); | |
| 950 failure: | |
| 951 return SECFailure; | |
| 952 } | |
| 953 | |
| 954 /* | |
| 955 * Encode a RSA-PSS signature. | |
| 956 * Described in RFC 3447, section 9.1.1. | |
| 957 * We use mHash instead of M as input. | |
| 958 * emBits from the RFC is just modBits - 1, see section 8.1.1. | |
| 959 * We only support MGF1 as the MGF. | |
| 960 * | |
| 961 * NOTE: this code assumes modBits is a multiple of 8. | |
| 962 */ | |
| 963 static SECStatus | |
| 964 emsa_pss_encode(unsigned char * em, | |
| 965 unsigned int emLen, | |
| 966 const unsigned char * mHash, | |
| 967 HASH_HashType hashAlg, | |
| 968 HASH_HashType maskHashAlg, | |
| 969 const unsigned char * salt, | |
| 970 unsigned int saltLen) | |
| 971 { | |
| 972 const SECHashObject * hash; | |
| 973 void * hash_context; | |
| 974 unsigned char * dbMask; | |
| 975 unsigned int dbMaskLen; | |
| 976 unsigned int i; | |
| 977 SECStatus rv; | |
| 978 | |
| 979 hash = HASH_GetRawHashObject(hashAlg); | |
| 980 dbMaskLen = emLen - hash->length - 1; | |
| 981 | |
| 982 /* Step 3 */ | |
| 983 if (emLen < hash->length + saltLen + 2) { | |
| 984 PORT_SetError(SEC_ERROR_OUTPUT_LEN); | |
| 985 return SECFailure; | |
| 986 } | |
| 987 | |
| 988 /* Step 4 */ | |
| 989 if (salt == NULL) { | |
| 990 rv = RNG_GenerateGlobalRandomBytes(&em[dbMaskLen - saltLen], saltLen); | |
| 991 if (rv != SECSuccess) { | |
| 992 return rv; | |
| 993 } | |
| 994 } else { | |
| 995 PORT_Memcpy(&em[dbMaskLen - saltLen], salt, saltLen); | |
| 996 } | |
| 997 | |
| 998 /* Step 5 + 6 */ | |
| 999 /* Compute H and store it at its final location &em[dbMaskLen]. */ | |
| 1000 hash_context = (*hash->create)(); | |
| 1001 if (hash_context == NULL) { | |
| 1002 PORT_SetError(SEC_ERROR_NO_MEMORY); | |
| 1003 return SECFailure; | |
| 1004 } | |
| 1005 (*hash->begin)(hash_context); | |
| 1006 (*hash->update)(hash_context, eightZeros, 8); | |
| 1007 (*hash->update)(hash_context, mHash, hash->length); | |
| 1008 (*hash->update)(hash_context, &em[dbMaskLen - saltLen], saltLen); | |
| 1009 (*hash->end)(hash_context, &em[dbMaskLen], &i, hash->length); | |
| 1010 (*hash->destroy)(hash_context, PR_TRUE); | |
| 1011 | |
| 1012 /* Step 7 + 8 */ | |
| 1013 PORT_Memset(em, 0, dbMaskLen - saltLen - 1); | |
| 1014 em[dbMaskLen - saltLen - 1] = 0x01; | |
| 1015 | |
| 1016 /* Step 9 */ | |
| 1017 dbMask = (unsigned char *)PORT_Alloc(dbMaskLen); | |
| 1018 if (dbMask == NULL) { | |
| 1019 PORT_SetError(SEC_ERROR_NO_MEMORY); | |
| 1020 return SECFailure; | |
| 1021 } | |
| 1022 MGF1(maskHashAlg, dbMask, dbMaskLen, &em[dbMaskLen], hash->length); | |
| 1023 | |
| 1024 /* Step 10 */ | |
| 1025 for (i = 0; i < dbMaskLen; i++) | |
| 1026 em[i] ^= dbMask[i]; | |
| 1027 PORT_Free(dbMask); | |
| 1028 | |
| 1029 /* Step 11 */ | |
| 1030 em[0] &= 0x7f; | |
| 1031 | |
| 1032 /* Step 12 */ | |
| 1033 em[emLen - 1] = 0xbc; | |
| 1034 | |
| 1035 return SECSuccess; | |
| 1036 } | |
| 1037 | |
| 1038 /* | |
| 1039 * Verify a RSA-PSS signature. | |
| 1040 * Described in RFC 3447, section 9.1.2. | |
| 1041 * We use mHash instead of M as input. | |
| 1042 * emBits from the RFC is just modBits - 1, see section 8.1.2. | |
| 1043 * We only support MGF1 as the MGF. | |
| 1044 * | |
| 1045 * NOTE: this code assumes modBits is a multiple of 8. | |
| 1046 */ | |
| 1047 static SECStatus | |
| 1048 emsa_pss_verify(const unsigned char * mHash, | |
| 1049 const unsigned char * em, | |
| 1050 unsigned int emLen, | |
| 1051 HASH_HashType hashAlg, | |
| 1052 HASH_HashType maskHashAlg, | |
| 1053 unsigned int saltLen) | |
| 1054 { | |
| 1055 const SECHashObject * hash; | |
| 1056 void * hash_context; | |
| 1057 unsigned char * db; | |
| 1058 unsigned char * H_; /* H' from the RFC */ | |
| 1059 unsigned int i; | |
| 1060 unsigned int dbMaskLen; | |
| 1061 SECStatus rv; | |
| 1062 | |
| 1063 hash = HASH_GetRawHashObject(hashAlg); | |
| 1064 dbMaskLen = emLen - hash->length - 1; | |
| 1065 | |
| 1066 /* Step 3 + 4 + 6 */ | |
| 1067 if ((emLen < (hash->length + saltLen + 2)) || | |
| 1068 (em[emLen - 1] != 0xbc) || | |
| 1069 ((em[0] & 0x80) != 0)) { | |
| 1070 PORT_SetError(SEC_ERROR_BAD_SIGNATURE); | |
| 1071 return SECFailure; | |
| 1072 } | |
| 1073 | |
| 1074 /* Step 7 */ | |
| 1075 db = (unsigned char *)PORT_Alloc(dbMaskLen); | |
| 1076 if (db == NULL) { | |
| 1077 PORT_SetError(SEC_ERROR_NO_MEMORY); | |
| 1078 return SECFailure; | |
| 1079 } | |
| 1080 /* &em[dbMaskLen] points to H, used as mgfSeed */ | |
| 1081 MGF1(maskHashAlg, db, dbMaskLen, &em[dbMaskLen], hash->length); | |
| 1082 | |
| 1083 /* Step 8 */ | |
| 1084 for (i = 0; i < dbMaskLen; i++) { | |
| 1085 db[i] ^= em[i]; | |
| 1086 } | |
| 1087 | |
| 1088 /* Step 9 */ | |
| 1089 db[0] &= 0x7f; | |
| 1090 | |
| 1091 /* Step 10 */ | |
| 1092 for (i = 0; i < (dbMaskLen - saltLen - 1); i++) { | |
| 1093 if (db[i] != 0) { | |
| 1094 PORT_Free(db); | |
| 1095 PORT_SetError(SEC_ERROR_BAD_SIGNATURE); | |
| 1096 return SECFailure; | |
| 1097 } | |
| 1098 } | |
| 1099 if (db[dbMaskLen - saltLen - 1] != 0x01) { | |
| 1100 PORT_Free(db); | |
| 1101 PORT_SetError(SEC_ERROR_BAD_SIGNATURE); | |
| 1102 return SECFailure; | |
| 1103 } | |
| 1104 | |
| 1105 /* Step 12 + 13 */ | |
| 1106 H_ = (unsigned char *)PORT_Alloc(hash->length); | |
| 1107 if (H_ == NULL) { | |
| 1108 PORT_Free(db); | |
| 1109 PORT_SetError(SEC_ERROR_NO_MEMORY); | |
| 1110 return SECFailure; | |
| 1111 } | |
| 1112 hash_context = (*hash->create)(); | |
| 1113 if (hash_context == NULL) { | |
| 1114 PORT_Free(db); | |
| 1115 PORT_Free(H_); | |
| 1116 PORT_SetError(SEC_ERROR_NO_MEMORY); | |
| 1117 return SECFailure; | |
| 1118 } | |
| 1119 (*hash->begin)(hash_context); | |
| 1120 (*hash->update)(hash_context, eightZeros, 8); | |
| 1121 (*hash->update)(hash_context, mHash, hash->length); | |
| 1122 (*hash->update)(hash_context, &db[dbMaskLen - saltLen], saltLen); | |
| 1123 (*hash->end)(hash_context, H_, &i, hash->length); | |
| 1124 (*hash->destroy)(hash_context, PR_TRUE); | |
| 1125 | |
| 1126 PORT_Free(db); | |
| 1127 | |
| 1128 /* Step 14 */ | |
| 1129 if (PORT_Memcmp(H_, &em[dbMaskLen], hash->length) != 0) { | |
| 1130 PORT_SetError(SEC_ERROR_BAD_SIGNATURE); | |
| 1131 rv = SECFailure; | |
| 1132 } else { | |
| 1133 rv = SECSuccess; | |
| 1134 } | |
| 1135 | |
| 1136 PORT_Free(H_); | |
| 1137 return rv; | |
| 1138 } | |
| 1139 | |
| 1140 SECStatus | |
| 1141 RSA_SignPSS(RSAPrivateKey * key, | |
| 1142 HASH_HashType hashAlg, | |
| 1143 HASH_HashType maskHashAlg, | |
| 1144 const unsigned char * salt, | |
| 1145 unsigned int saltLength, | |
| 1146 unsigned char * output, | |
| 1147 unsigned int * outputLen, | |
| 1148 unsigned int maxOutputLen, | |
| 1149 const unsigned char * input, | |
| 1150 unsigned int inputLen) | |
| 1151 { | |
| 1152 SECStatus rv = SECSuccess; | |
| 1153 unsigned int modulusLen = rsa_modulusLen(&key->modulus); | |
| 1154 unsigned char *pssEncoded = NULL; | |
| 1155 | |
| 1156 if (maxOutputLen < modulusLen) { | |
| 1157 PORT_SetError(SEC_ERROR_OUTPUT_LEN); | |
| 1158 return SECFailure; | |
| 1159 } | |
| 1160 | |
| 1161 if ((hashAlg == HASH_AlgNULL) || (maskHashAlg == HASH_AlgNULL)) { | |
| 1162 PORT_SetError(SEC_ERROR_INVALID_ALGORITHM); | |
| 1163 return SECFailure; | |
| 1164 } | |
| 1165 | |
| 1166 pssEncoded = (unsigned char *)PORT_Alloc(modulusLen); | |
| 1167 if (pssEncoded == NULL) { | |
| 1168 PORT_SetError(SEC_ERROR_NO_MEMORY); | |
| 1169 return SECFailure; | |
| 1170 } | |
| 1171 rv = emsa_pss_encode(pssEncoded, modulusLen, input, hashAlg, | |
| 1172 maskHashAlg, salt, saltLength); | |
| 1173 if (rv != SECSuccess) | |
| 1174 goto done; | |
| 1175 | |
| 1176 rv = RSA_PrivateKeyOpDoubleChecked(key, output, pssEncoded); | |
| 1177 *outputLen = modulusLen; | |
| 1178 | |
| 1179 done: | |
| 1180 PORT_Free(pssEncoded); | |
| 1181 return rv; | |
| 1182 } | |
| 1183 | |
| 1184 SECStatus | |
| 1185 RSA_CheckSignPSS(RSAPublicKey * key, | |
| 1186 HASH_HashType hashAlg, | |
| 1187 HASH_HashType maskHashAlg, | |
| 1188 unsigned int saltLength, | |
| 1189 const unsigned char * sig, | |
| 1190 unsigned int sigLen, | |
| 1191 const unsigned char * hash, | |
| 1192 unsigned int hashLen) | |
| 1193 { | |
| 1194 SECStatus rv; | |
| 1195 unsigned int modulusLen = rsa_modulusLen(&key->modulus); | |
| 1196 unsigned char * buffer; | |
| 1197 | |
| 1198 if (sigLen != modulusLen) { | |
| 1199 PORT_SetError(SEC_ERROR_BAD_SIGNATURE); | |
| 1200 return SECFailure; | |
| 1201 } | |
| 1202 | |
| 1203 if ((hashAlg == HASH_AlgNULL) || (maskHashAlg == HASH_AlgNULL)) { | |
| 1204 PORT_SetError(SEC_ERROR_INVALID_ALGORITHM); | |
| 1205 return SECFailure; | |
| 1206 } | |
| 1207 | |
| 1208 buffer = (unsigned char *)PORT_Alloc(modulusLen); | |
| 1209 if (!buffer) { | |
| 1210 PORT_SetError(SEC_ERROR_NO_MEMORY); | |
| 1211 return SECFailure; | |
| 1212 } | |
| 1213 | |
| 1214 rv = RSA_PublicKeyOp(key, buffer, sig); | |
| 1215 if (rv != SECSuccess) { | |
| 1216 PORT_Free(buffer); | |
| 1217 PORT_SetError(SEC_ERROR_BAD_SIGNATURE); | |
| 1218 return SECFailure; | |
| 1219 } | |
| 1220 | |
| 1221 rv = emsa_pss_verify(hash, buffer, modulusLen, hashAlg, | |
| 1222 maskHashAlg, saltLength); | |
| 1223 PORT_Free(buffer); | |
| 1224 | |
| 1225 return rv; | |
| 1226 } | |
| 1227 | |
| 1228 /* XXX Doesn't set error code */ | |
| 1229 SECStatus | |
| 1230 RSA_Sign(RSAPrivateKey * key, | |
| 1231 unsigned char * output, | |
| 1232 unsigned int * outputLen, | |
| 1233 unsigned int maxOutputLen, | |
| 1234 const unsigned char * input, | |
| 1235 unsigned int inputLen) | |
| 1236 { | |
| 1237 SECStatus rv = SECSuccess; | |
| 1238 unsigned int modulusLen = rsa_modulusLen(&key->modulus); | |
| 1239 SECItem formatted; | |
| 1240 SECItem unformatted; | |
| 1241 | |
| 1242 if (maxOutputLen < modulusLen) | |
| 1243 return SECFailure; | |
| 1244 | |
| 1245 unformatted.len = inputLen; | |
| 1246 unformatted.data = (unsigned char*)input; | |
| 1247 formatted.data = NULL; | |
| 1248 rv = rsa_FormatBlock(&formatted, modulusLen, RSA_BlockPrivate, | |
| 1249 &unformatted); | |
| 1250 if (rv != SECSuccess) | |
| 1251 goto done; | |
| 1252 | |
| 1253 rv = RSA_PrivateKeyOpDoubleChecked(key, output, formatted.data); | |
| 1254 *outputLen = modulusLen; | |
| 1255 | |
| 1256 goto done; | |
| 1257 | |
| 1258 done: | |
| 1259 if (formatted.data != NULL) | |
| 1260 PORT_ZFree(formatted.data, modulusLen); | |
| 1261 return rv; | |
| 1262 } | |
| 1263 | |
| 1264 /* XXX Doesn't set error code */ | |
| 1265 SECStatus | |
| 1266 RSA_CheckSign(RSAPublicKey * key, | |
| 1267 const unsigned char * sig, | |
| 1268 unsigned int sigLen, | |
| 1269 const unsigned char * data, | |
| 1270 unsigned int dataLen) | |
| 1271 { | |
| 1272 SECStatus rv; | |
| 1273 unsigned int modulusLen = rsa_modulusLen(&key->modulus); | |
| 1274 unsigned int i; | |
| 1275 unsigned char * buffer; | |
| 1276 | |
| 1277 if (sigLen != modulusLen) | |
| 1278 goto failure; | |
| 1279 /* | |
| 1280 * 0x00 || BT || Pad || 0x00 || ActualData | |
| 1281 * | |
| 1282 * The "3" below is the first octet + the second octet + the 0x00 | |
| 1283 * octet that always comes just before the ActualData. | |
| 1284 */ | |
| 1285 if (dataLen > modulusLen - (3 + RSA_BLOCK_MIN_PAD_LEN)) | |
| 1286 goto failure; | |
| 1287 | |
| 1288 buffer = (unsigned char *)PORT_Alloc(modulusLen + 1); | |
| 1289 if (!buffer) | |
| 1290 goto failure; | |
| 1291 | |
| 1292 rv = RSA_PublicKeyOp(key, buffer, sig); | |
| 1293 if (rv != SECSuccess) | |
| 1294 goto loser; | |
| 1295 | |
| 1296 /* | |
| 1297 * check the padding that was used | |
| 1298 */ | |
| 1299 if (buffer[0] != RSA_BLOCK_FIRST_OCTET || | |
| 1300 buffer[1] != (unsigned char)RSA_BlockPrivate) { | |
| 1301 goto loser; | |
| 1302 } | |
| 1303 for (i = 2; i < modulusLen - dataLen - 1; i++) { | |
| 1304 if (buffer[i] != RSA_BLOCK_PRIVATE_PAD_OCTET) | |
| 1305 goto loser; | |
| 1306 } | |
| 1307 if (buffer[i] != RSA_BLOCK_AFTER_PAD_OCTET) | |
| 1308 goto loser; | |
| 1309 | |
| 1310 /* | |
| 1311 * make sure we get the same results | |
| 1312 */ | |
| 1313 if (PORT_Memcmp(buffer + modulusLen - dataLen, data, dataLen) != 0) | |
| 1314 goto loser; | |
| 1315 | |
| 1316 PORT_Free(buffer); | |
| 1317 return SECSuccess; | |
| 1318 | |
| 1319 loser: | |
| 1320 PORT_Free(buffer); | |
| 1321 failure: | |
| 1322 return SECFailure; | |
| 1323 } | |
| 1324 | |
| 1325 /* XXX Doesn't set error code */ | |
| 1326 SECStatus | |
| 1327 RSA_CheckSignRecover(RSAPublicKey * key, | |
| 1328 unsigned char * output, | |
| 1329 unsigned int * outputLen, | |
| 1330 unsigned int maxOutputLen, | |
| 1331 const unsigned char * sig, | |
| 1332 unsigned int sigLen) | |
| 1333 { | |
| 1334 SECStatus rv; | |
| 1335 unsigned int modulusLen = rsa_modulusLen(&key->modulus); | |
| 1336 unsigned int i; | |
| 1337 unsigned char * buffer; | |
| 1338 | |
| 1339 if (sigLen != modulusLen) | |
| 1340 goto failure; | |
| 1341 | |
| 1342 buffer = (unsigned char *)PORT_Alloc(modulusLen + 1); | |
| 1343 if (!buffer) | |
| 1344 goto failure; | |
| 1345 | |
| 1346 rv = RSA_PublicKeyOp(key, buffer, sig); | |
| 1347 if (rv != SECSuccess) | |
| 1348 goto loser; | |
| 1349 *outputLen = 0; | |
| 1350 | |
| 1351 /* | |
| 1352 * check the padding that was used | |
| 1353 */ | |
| 1354 if (buffer[0] != RSA_BLOCK_FIRST_OCTET || | |
| 1355 buffer[1] != (unsigned char)RSA_BlockPrivate) { | |
| 1356 goto loser; | |
| 1357 } | |
| 1358 for (i = 2; i < modulusLen; i++) { | |
| 1359 if (buffer[i] == RSA_BLOCK_AFTER_PAD_OCTET) { | |
| 1360 *outputLen = modulusLen - i - 1; | |
| 1361 break; | |
| 1362 } | |
| 1363 if (buffer[i] != RSA_BLOCK_PRIVATE_PAD_OCTET) | |
| 1364 goto loser; | |
| 1365 } | |
| 1366 if (*outputLen == 0) | |
| 1367 goto loser; | |
| 1368 if (*outputLen > maxOutputLen) | |
| 1369 goto loser; | |
| 1370 | |
| 1371 PORT_Memcpy(output, buffer + modulusLen - *outputLen, *outputLen); | |
| 1372 | |
| 1373 PORT_Free(buffer); | |
| 1374 return SECSuccess; | |
| 1375 | |
| 1376 loser: | |
| 1377 PORT_Free(buffer); | |
| 1378 failure: | |
| 1379 return SECFailure; | |
| 1380 } | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 2078763002:
Delete bundled copy of NSS and replace with README. (Closed)
Base URL: https://chromium.googlesource.com/chromium/deps/nss@master