crypto/rsa/rsa_ameth.c

   1 /* crypto/rsa/rsa_ameth.c */
   2 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
   3  * project 2006.
   4  */
   5 /* ====================================================================
   6  * Copyright (c) 2006 The OpenSSL Project.  All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  *
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in
  17  *    the documentation and/or other materials provided with the
  18  *    distribution.
  19  *
  20  * 3. All advertising materials mentioning features or use of this
  21  *    software must display the following acknowledgment:
  22  *    "This product includes software developed by the OpenSSL Project
  23  *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
  24  *
  25  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  26  *    endorse or promote products derived from this software without
  27  *    prior written permission. For written permission, please contact
  28  *    licensing@OpenSSL.org.
  29  *
  30  * 5. Products derived from this software may not be called "OpenSSL"
  31  *    nor may "OpenSSL" appear in their names without prior written
  32  *    permission of the OpenSSL Project.
  33  *
  34  * 6. Redistributions of any form whatsoever must retain the following
  35  *    acknowledgment:
  36  *    "This product includes software developed by the OpenSSL Project
  37  *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
  38  *
  39  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  40  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  41  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  42  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  43  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  44  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  45  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  46  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  47  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  48  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  49  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
  50  * OF THE POSSIBILITY OF SUCH DAMAGE.
  51  * ====================================================================
  52  *
  53  * This product includes cryptographic software written by Eric Young
  54  * (eay@cryptsoft.com).  This product includes software written by Tim
  55  * Hudson (tjh@cryptsoft.com).
  56  *
  57  */
  58
  59 #include <stdio.h>
  60 #include "cryptlib.h"
  61 #include <openssl/asn1t.h>
  62 #include <openssl/x509.h>
  63 #include <openssl/rsa.h>
  64 #include <openssl/bn.h>
  65 #ifndef OPENSSL_NO_CMS
  66 #include <openssl/cms.h>
  67 #endif
  68 #include "asn1_locl.h"
  69
  70 static int rsa_cms_sign(CMS_SignerInfo *si);
  71 static int rsa_cms_verify(CMS_SignerInfo *si);
  72 static int rsa_cms_decrypt(CMS_RecipientInfo *ri);
  73 static int rsa_cms_encrypt(CMS_RecipientInfo *ri);
  74
  75 static int rsa_pub_encode(X509_PUBKEY *pk, const EVP_PKEY *pkey)
  76         {
  77         unsigned char *penc = NULL;
  78         int penclen;
  79         penclen = i2d_RSAPublicKey(pkey->pkey.rsa, &penc);
  80         if (penclen <= 0)
  81                 return 0;
  82         if (X509_PUBKEY_set0_param(pk, OBJ_nid2obj(EVP_PKEY_RSA),
  83                                 V_ASN1_NULL, NULL, penc, penclen))
  84                 return 1;
  85
  86         OPENSSL_free(penc);
  87         return 0;
  88         }
  89
  90 static int rsa_pub_decode(EVP_PKEY *pkey, X509_PUBKEY *pubkey)
  91         {
  92         const unsigned char *p;
  93         int pklen;
  94         RSA *rsa = NULL;
  95         if (!X509_PUBKEY_get0_param(NULL, &p, &pklen, NULL, pubkey))
  96                 return 0;
  97         if (!(rsa = d2i_RSAPublicKey(NULL, &p, pklen)))
  98                 {
  99                 RSAerr(RSA_F_RSA_PUB_DECODE, ERR_R_RSA_LIB);
 100                 return 0;
 101                 }
 102         EVP_PKEY_assign_RSA (pkey, rsa);
 103         return 1;
 104         }
 105
 106 static int rsa_pub_cmp(const EVP_PKEY *a, const EVP_PKEY *b)
 107         {
 108         if (BN_cmp(b->pkey.rsa->n,a->pkey.rsa->n) != 0
 109                 || BN_cmp(b->pkey.rsa->e,a->pkey.rsa->e) != 0)
 110                         return 0;
 111         return 1;
 112         }
 113
 114 static int old_rsa_priv_decode(EVP_PKEY *pkey,
 115                                         const unsigned char **pder, int derlen)
 116         {
 117         RSA *rsa;
 118         if (!(rsa = d2i_RSAPrivateKey (NULL, pder, derlen)))
 119                 {
 120                 RSAerr(RSA_F_OLD_RSA_PRIV_DECODE, ERR_R_RSA_LIB);
 121                 return 0;
 122                 }
 123         EVP_PKEY_assign_RSA(pkey, rsa);
 124         return 1;
 125         }
 126
 127 static int old_rsa_priv_encode(const EVP_PKEY *pkey, unsigned char **pder)
 128         {
 129         return i2d_RSAPrivateKey(pkey->pkey.rsa, pder);
 130         }
 131
 132 static int rsa_priv_encode(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pkey)
 133         {
 134         unsigned char *rk = NULL;
 135         int rklen;
 136         rklen = i2d_RSAPrivateKey(pkey->pkey.rsa, &rk);
 137
 138         if (rklen <= 0)
 139                 {
 140                 RSAerr(RSA_F_RSA_PRIV_ENCODE,ERR_R_MALLOC_FAILURE);
 141                 return 0;
 142                 }
 143
 144         if (!PKCS8_pkey_set0(p8, OBJ_nid2obj(NID_rsaEncryption), 0,
 145                                 V_ASN1_NULL, NULL, rk, rklen))
 146                 {
 147                 RSAerr(RSA_F_RSA_PRIV_ENCODE,ERR_R_MALLOC_FAILURE);
 148                 return 0;
 149                 }
 150
 151         return 1;
 152         }
 153
 154 static int rsa_priv_decode(EVP_PKEY *pkey, PKCS8_PRIV_KEY_INFO *p8)
 155         {
 156         const unsigned char *p;
 157         int pklen;
 158         if (!PKCS8_pkey_get0(NULL, &p, &pklen, NULL, p8))
 159                 return 0;
 160         return old_rsa_priv_decode(pkey, &p, pklen);
 161         }
 162
 163 static int int_rsa_size(const EVP_PKEY *pkey)
 164         {
 165         return RSA_size(pkey->pkey.rsa);
 166         }
 167
 168 static int rsa_bits(const EVP_PKEY *pkey)
 169         {
 170         return BN_num_bits(pkey->pkey.rsa->n);
 171         }
 172
 173 static void int_rsa_free(EVP_PKEY *pkey)
 174         {
 175         RSA_free(pkey->pkey.rsa);
 176         }
 177
 178
 179 static void update_buflen(const BIGNUM *b, size_t *pbuflen)
 180         {
 181         size_t i;
 182         if (!b)
 183                 return;
 184         if (*pbuflen < (i = (size_t)BN_num_bytes(b)))
 185                         *pbuflen = i;
 186         }
 187
 188 static int do_rsa_print(BIO *bp, const RSA *x, int off, int priv)
 189         {
 190         char *str;
 191         const char *s;
 192         unsigned char *m=NULL;
 193         int ret=0, mod_len = 0;
 194         size_t buf_len=0;
 195
 196         update_buflen(x->n, &buf_len);
 197         update_buflen(x->e, &buf_len);
 198
 199         if (priv)
 200                 {
 201                 update_buflen(x->d, &buf_len);
 202                 update_buflen(x->p, &buf_len);
 203                 update_buflen(x->q, &buf_len);
 204                 update_buflen(x->dmp1, &buf_len);
 205                 update_buflen(x->dmq1, &buf_len);
 206                 update_buflen(x->iqmp, &buf_len);
 207                 }
 208
 209         m=(unsigned char *)OPENSSL_malloc(buf_len+10);
 210         if (m == NULL)
 211                 {
 212                 RSAerr(RSA_F_DO_RSA_PRINT,ERR_R_MALLOC_FAILURE);
 213                 goto err;
 214                 }
 215
 216         if (x->n != NULL)
 217                 mod_len = BN_num_bits(x->n);
 218
 219         if(!BIO_indent(bp,off,128))
 220                 goto err;
 221
 222         if (priv && x->d)
 223                 {
 224                 if (BIO_printf(bp,"Private-Key: (%d bit)\n", mod_len)
 225                         <= 0) goto err;
 226                 str = "modulus:";
 227                 s = "publicExponent:";
 228                 }
 229         else
 230                 {
 231                 if (BIO_printf(bp,"Public-Key: (%d bit)\n", mod_len)
 232                         <= 0) goto err;
 233                 str = "Modulus:";
 234                 s= "Exponent:";
 235                 }
 236         if (!ASN1_bn_print(bp,str,x->n,m,off)) goto err;
 237         if (!ASN1_bn_print(bp,s,x->e,m,off))
 238                 goto err;
 239         if (priv)
 240                 {
 241                 if (!ASN1_bn_print(bp,"privateExponent:",x->d,m,off))
 242                         goto err;
 243                 if (!ASN1_bn_print(bp,"prime1:",x->p,m,off))
 244                         goto err;
 245                 if (!ASN1_bn_print(bp,"prime2:",x->q,m,off))
 246                         goto err;
 247                 if (!ASN1_bn_print(bp,"exponent1:",x->dmp1,m,off))
 248                         goto err;
 249                 if (!ASN1_bn_print(bp,"exponent2:",x->dmq1,m,off))
 250                         goto err;
 251                 if (!ASN1_bn_print(bp,"coefficient:",x->iqmp,m,off))
 252                         goto err;
 253                 }
 254         ret=1;
 255 err:
 256         if (m != NULL) OPENSSL_free(m);
 257         return(ret);
 258         }
 259
 260 static int rsa_pub_print(BIO *bp, const EVP_PKEY *pkey, int indent,
 261                                                         ASN1_PCTX *ctx)
 262         {
 263         return do_rsa_print(bp, pkey->pkey.rsa, indent, 0);
 264         }
 265
 266
 267 static int rsa_priv_print(BIO *bp, const EVP_PKEY *pkey, int indent,
 268                                                         ASN1_PCTX *ctx)
 269         {
 270         return do_rsa_print(bp, pkey->pkey.rsa, indent, 1);
 271         }
 272
 273 /* Given an MGF1 Algorithm ID decode to an Algorithm Identifier */
 274 static X509_ALGOR *rsa_mgf1_decode(X509_ALGOR *alg)
 275         {
 276         const unsigned char *p;
 277         int plen;
 278         if (alg == NULL)
 279                 return NULL;
 280         if (OBJ_obj2nid(alg->algorithm) != NID_mgf1)
 281                 return NULL;
 282         if (alg->parameter->type != V_ASN1_SEQUENCE)
 283                 return NULL;
 284
 285         p = alg->parameter->value.sequence->data;
 286         plen = alg->parameter->value.sequence->length;
 287         return d2i_X509_ALGOR(NULL, &p, plen);
 288         }
 289
 290 static RSA_PSS_PARAMS *rsa_pss_decode(const X509_ALGOR *alg,
 291                                         X509_ALGOR **pmaskHash)
 292         {
 293         const unsigned char *p;
 294         int plen;
 295         RSA_PSS_PARAMS *pss;
 296
 297         *pmaskHash = NULL;
 298
 299         if (!alg->parameter || alg->parameter->type != V_ASN1_SEQUENCE)
 300                 return NULL;
 301         p = alg->parameter->value.sequence->data;
 302         plen = alg->parameter->value.sequence->length;
 303         pss = d2i_RSA_PSS_PARAMS(NULL, &p, plen);
 304
 305         if (!pss)
 306                 return NULL;
 307
 308         *pmaskHash = rsa_mgf1_decode(pss->maskGenAlgorithm);
 309
 310         return pss;
 311         }
 312
 313 static int rsa_pss_param_print(BIO *bp, RSA_PSS_PARAMS *pss,
 314                                 X509_ALGOR *maskHash, int indent)
 315         {
 316         int rv = 0;
 317         if (!pss)
 318                 {
 319                 if (BIO_puts(bp, " (INVALID PSS PARAMETERS)\n") <= 0)
 320                         return 0;
 321                 return 1;
 322                 }
 323         if (BIO_puts(bp, "\n") <= 0)
 324                 goto err;
 325         if (!BIO_indent(bp, indent, 128))
 326                 goto err;
 327         if (BIO_puts(bp, "Hash Algorithm: ") <= 0)
 328                 goto err;
 329
 330         if (pss->hashAlgorithm)
 331                 {
 332                 if (i2a_ASN1_OBJECT(bp, pss->hashAlgorithm->algorithm) <= 0)
 333                         goto err;
 334                 }
 335         else if (BIO_puts(bp, "sha1 (default)") <= 0)
 336                 goto err;
 337
 338         if (BIO_puts(bp, "\n") <= 0)
 339                 goto err;
 340
 341         if (!BIO_indent(bp, indent, 128))
 342                 goto err;
 343
 344         if (BIO_puts(bp, "Mask Algorithm: ") <= 0)
 345                         goto err;
 346         if (pss->maskGenAlgorithm)
 347                 {
 348                 if (i2a_ASN1_OBJECT(bp, pss->maskGenAlgorithm->algorithm) <= 0)
 349                         goto err;
 350                 if (BIO_puts(bp, " with ") <= 0)
 351                         goto err;
 352                 if (maskHash)
 353                         {
 354                         if (i2a_ASN1_OBJECT(bp, maskHash->algorithm) <= 0)
 355                         goto err;
 356                         }
 357                 else if (BIO_puts(bp, "INVALID") <= 0)
 358                         goto err;
 359                 }
 360         else if (BIO_puts(bp, "mgf1 with sha1 (default)") <= 0)
 361                 goto err;
 362         BIO_puts(bp, "\n");
 363
 364         if (!BIO_indent(bp, indent, 128))
 365                 goto err;
 366         if (BIO_puts(bp, "Salt Length: 0x") <= 0)
 367                         goto err;
 368         if (pss->saltLength)
 369                 {
 370                 if (i2a_ASN1_INTEGER(bp, pss->saltLength) <= 0)
 371                         goto err;
 372                 }
 373         else if (BIO_puts(bp, "0x14 (default)") <= 0)
 374                 goto err;
 375         BIO_puts(bp, "\n");
 376
 377         if (!BIO_indent(bp, indent, 128))
 378                 goto err;
 379         if (BIO_puts(bp, "Trailer Field: 0x") <= 0)
 380                         goto err;
 381         if (pss->trailerField)
 382                 {
 383                 if (i2a_ASN1_INTEGER(bp, pss->trailerField) <= 0)
 384                         goto err;
 385                 }
 386         else if (BIO_puts(bp, "BC (default)") <= 0)
 387                 goto err;
 388         BIO_puts(bp, "\n");
 389
 390         rv = 1;
 391
 392         err:
 393         return rv;
 394
 395         }
 396
 397 static int rsa_sig_print(BIO *bp, const X509_ALGOR *sigalg,
 398                                         const ASN1_STRING *sig,
 399                                         int indent, ASN1_PCTX *pctx)
 400         {
 401         if (OBJ_obj2nid(sigalg->algorithm) == NID_rsassaPss)
 402                 {
 403                 int rv;
 404                 RSA_PSS_PARAMS *pss;
 405                 X509_ALGOR *maskHash;
 406                 pss = rsa_pss_decode(sigalg, &maskHash);
 407                 rv = rsa_pss_param_print(bp, pss, maskHash, indent);
 408                 if (pss)
 409                         RSA_PSS_PARAMS_free(pss);
 410                 if (maskHash)
 411                         X509_ALGOR_free(maskHash);
 412                 if (!rv)
 413                         return 0;
 414                 }
 415         else if (!sig && BIO_puts(bp, "\n") <= 0)
 416                 return 0;
 417         if (sig)
 418                 return X509_signature_dump(bp, sig, indent);
 419         return 1;
 420         }
 421
 422 static int rsa_pkey_ctrl(EVP_PKEY *pkey, int op, long arg1, void *arg2)
 423         {
 424         X509_ALGOR *alg = NULL;
 425         switch (op)
 426                 {
 427
 428                 case ASN1_PKEY_CTRL_PKCS7_SIGN:
 429                 if (arg1 == 0)
 430                         PKCS7_SIGNER_INFO_get0_algs(arg2, NULL, NULL, &alg);
 431                 break;
 432
 433                 case ASN1_PKEY_CTRL_PKCS7_ENCRYPT:
 434                 if (arg1 == 0)
 435                         PKCS7_RECIP_INFO_get0_alg(arg2, &alg);
 436                 break;
 437 #ifndef OPENSSL_NO_CMS
 438                 case ASN1_PKEY_CTRL_CMS_SIGN:
 439                 if (arg1 == 0)
 440                         return rsa_cms_sign(arg2);
 441                 else if (arg1 == 1)
 442                         return rsa_cms_verify(arg2);
 443                 break;
 444
 445                 case ASN1_PKEY_CTRL_CMS_ENVELOPE:
 446                 if (arg1 == 0)
 447                         return rsa_cms_encrypt(arg2);
 448                 else if (arg1 == 1)
 449                         return rsa_cms_decrypt(arg2);
 450                 break;
 451 #endif
 452
 453                 case ASN1_PKEY_CTRL_DEFAULT_MD_NID:
 454                 *(int *)arg2 = NID_sha1;
 455                 return 1;
 456
 457                 default:
 458                 return -2;
 459
 460                 }
 461
 462         if (alg)
 463                 X509_ALGOR_set0(alg, OBJ_nid2obj(NID_rsaEncryption),
 464                                                         V_ASN1_NULL, 0);
 465
 466         return 1;
 467
 468         }
 469
 470 /* allocate and set algorithm ID from EVP_MD, default SHA1 */
 471 static int rsa_md_to_algor(X509_ALGOR **palg, const EVP_MD *md)
 472         {
 473         if (EVP_MD_type(md) == NID_sha1)
 474                 return 1;
 475         *palg = X509_ALGOR_new();
 476         if (!*palg)
 477                 return 0;
 478         X509_ALGOR_set_md(*palg, md);
 479         return 1;
 480         }
 481
 482 /* Allocate and set MGF1 algorithm ID from EVP_MD */
 483 static int rsa_md_to_mgf1(X509_ALGOR **palg, const EVP_MD *mgf1md)
 484         {
 485         X509_ALGOR *algtmp = NULL;
 486         ASN1_STRING *stmp = NULL;
 487         *palg = NULL;
 488         if (EVP_MD_type(mgf1md) == NID_sha1)
 489                 return 1;
 490         /* need to embed algorithm ID inside another */
 491         if (!rsa_md_to_algor(&algtmp, mgf1md))
 492                 goto err;
 493         if (!ASN1_item_pack(algtmp, ASN1_ITEM_rptr(X509_ALGOR), &stmp))
 494                         goto err;
 495         *palg = X509_ALGOR_new();
 496         if (!*palg)
 497                 goto err;
 498         X509_ALGOR_set0(*palg, OBJ_nid2obj(NID_mgf1), V_ASN1_SEQUENCE, stmp);
 499         stmp = NULL;
 500         err:
 501         if (stmp)
 502                 ASN1_STRING_free(stmp);
 503         if (algtmp)
 504                 X509_ALGOR_free(algtmp);
 505         if (*palg)
 506                 return 1;
 507         return 0;
 508         }
 509
 510 /* convert algorithm ID to EVP_MD, default SHA1 */
 511 static const EVP_MD *rsa_algor_to_md(X509_ALGOR *alg)
 512         {
 513         const EVP_MD *md;
 514         if (!alg)
 515                 return EVP_sha1();
 516         md = EVP_get_digestbyobj(alg->algorithm);
 517         if (md == NULL)
 518                 RSAerr(RSA_F_RSA_ALGOR_TO_MD, RSA_R_UNKNOWN_DIGEST);
 519         return md;
 520         }
 521 /* convert MGF1 algorithm ID to EVP_MD, default SHA1 */
 522 static const EVP_MD *rsa_mgf1_to_md(X509_ALGOR *alg, X509_ALGOR *maskHash)
 523         {
 524         const EVP_MD *md;
 525         if (!alg)
 526                 return EVP_sha1();
 527         /* Check mask and lookup mask hash algorithm */
 528         if (OBJ_obj2nid(alg->algorithm) != NID_mgf1)
 529                 {
 530                 RSAerr(RSA_F_RSA_MGF1_TO_MD, RSA_R_UNSUPPORTED_MASK_ALGORITHM);
 531                 return NULL;
 532                 }
 533         if (!maskHash)
 534                 {
 535                 RSAerr(RSA_F_RSA_MGF1_TO_MD, RSA_R_UNSUPPORTED_MASK_PARAMETER);
 536                 return NULL;
 537                 }
 538         md = EVP_get_digestbyobj(maskHash->algorithm);
 539         if (md == NULL)
 540                 {
 541                 RSAerr(RSA_F_RSA_MGF1_TO_MD, RSA_R_UNKNOWN_MASK_DIGEST);
 542                 return NULL;
 543                 }
 544         return md;
 545         }
 546
 547 /* Convert EVP_PKEY_CTX is PSS mode into corresponding algorithm parameter,
 548  * suitable for setting an AlgorithmIdentifier.
 549  */
 550
 551 static ASN1_STRING *rsa_ctx_to_pss(EVP_PKEY_CTX *pkctx)
 552         {
 553         const EVP_MD *sigmd, *mgf1md;
 554         RSA_PSS_PARAMS *pss = NULL;
 555         ASN1_STRING *os = NULL;
 556         EVP_PKEY *pk = EVP_PKEY_CTX_get0_pkey(pkctx);
 557         int saltlen, rv = 0;
 558         if (EVP_PKEY_CTX_get_signature_md(pkctx, &sigmd) <= 0)
 559                 goto err;
 560         if (EVP_PKEY_CTX_get_rsa_mgf1_md(pkctx, &mgf1md) <= 0)
 561                 goto err;
 562         if (!EVP_PKEY_CTX_get_rsa_pss_saltlen(pkctx, &saltlen))
 563                 goto err;
 564         if (saltlen == -1)
 565                 saltlen = EVP_MD_size(sigmd);
 566         else if (saltlen == -2)
 567                 {
 568                 saltlen = EVP_PKEY_size(pk) - EVP_MD_size(sigmd) - 2;
 569                 if (((EVP_PKEY_bits(pk) - 1) & 0x7) == 0)
 570                         saltlen--;
 571                 }
 572         pss = RSA_PSS_PARAMS_new();
 573         if (!pss)
 574                 goto err;
 575         if (saltlen != 20)
 576                 {
 577                 pss->saltLength = ASN1_INTEGER_new();
 578                 if (!pss->saltLength)
 579                         goto err;
 580                 if (!ASN1_INTEGER_set(pss->saltLength, saltlen))
 581                         goto err;
 582                 }
 583         if (!rsa_md_to_algor(&pss->hashAlgorithm, sigmd))
 584                 goto err;
 585         if (!rsa_md_to_mgf1(&pss->maskGenAlgorithm, mgf1md))
 586                 goto err;
 587         /* Finally create string with pss parameter encoding. */
 588         if (!ASN1_item_pack(pss, ASN1_ITEM_rptr(RSA_PSS_PARAMS), &os))
 589                 goto err;
 590         rv = 1;
 591         err:
 592         if (pss)
 593                 RSA_PSS_PARAMS_free(pss);
 594         if (rv)
 595                 return os;
 596         if (os)
 597                 ASN1_STRING_free(os);
 598         return NULL;
 599         }
 600
 601 /* From PSS AlgorithmIdentifier set public key parameters. If pkey
 602  * isn't NULL then the EVP_MD_CTX is setup and initalised. If it
 603  * is NULL parameters are passed to pkctx instead.
 604  */
 605
 606 static int rsa_pss_to_ctx(EVP_MD_CTX *ctx, EVP_PKEY_CTX *pkctx,
 607                                 X509_ALGOR *sigalg, EVP_PKEY *pkey)
 608         {
 609         int rv = -1;
 610         int saltlen;
 611         const EVP_MD *mgf1md = NULL, *md = NULL;
 612         RSA_PSS_PARAMS *pss;
 613         X509_ALGOR *maskHash;
 614         /* Sanity check: make sure it is PSS */
 615         if (OBJ_obj2nid(sigalg->algorithm) != NID_rsassaPss)
 616                 {
 617                 RSAerr(RSA_F_RSA_PSS_TO_CTX, RSA_R_UNSUPPORTED_SIGNATURE_TYPE);
 618                 return -1;
 619                 }
 620         /* Decode PSS parameters */
 621         pss = rsa_pss_decode(sigalg, &maskHash);
 622
 623         if (pss == NULL)
 624                 {
 625                 RSAerr(RSA_F_RSA_PSS_TO_CTX, RSA_R_INVALID_PSS_PARAMETERS);
 626                 goto err;
 627                 }
 628         mgf1md = rsa_mgf1_to_md(pss->maskGenAlgorithm, maskHash);
 629         if (!mgf1md)
 630                 goto err;
 631         md = rsa_algor_to_md(pss->hashAlgorithm);
 632         if (!md)
 633                 goto err;
 634
 635         if (pss->saltLength)
 636                 {
 637                 saltlen = ASN1_INTEGER_get(pss->saltLength);
 638
 639                 /* Could perform more salt length sanity checks but the main
 640                  * RSA routines will trap other invalid values anyway.
 641                  */
 642                 if (saltlen < 0)
 643                         {
 644                         RSAerr(RSA_F_RSA_PSS_TO_CTX, RSA_R_INVALID_SALT_LENGTH);
 645                         goto err;
 646                         }
 647                 }
 648         else
 649                 saltlen = 20;
 650
 651         /* low-level routines support only trailer field 0xbc (value 1)
 652          * and PKCS#1 says we should reject any other value anyway.
 653          */
 654         if (pss->trailerField && ASN1_INTEGER_get(pss->trailerField) != 1)
 655                 {
 656                 RSAerr(RSA_F_RSA_PSS_TO_CTX, RSA_R_INVALID_TRAILER);
 657                 goto err;
 658                 }
 659
 660         /* We have all parameters now set up context */
 661
 662         if (pkey)
 663                 {
 664                 if (!EVP_DigestVerifyInit(ctx, &pkctx, md, NULL, pkey))
 665                         goto err;
 666                 }
 667         else
 668                 {
 669                 const EVP_MD *checkmd;
 670                 if (EVP_PKEY_CTX_get_signature_md(pkctx, &checkmd) <= 0)
 671                         goto err;
 672                 if (EVP_MD_type(md) != EVP_MD_type(checkmd))
 673                         {
 674                         RSAerr(RSA_F_RSA_PSS_TO_CTX, RSA_R_DIGEST_DOES_NOT_MATCH);
 675                         goto err;
 676                         }
 677                 }
 678
 679         if (EVP_PKEY_CTX_set_rsa_padding(pkctx, RSA_PKCS1_PSS_PADDING) <= 0)
 680                 goto err;
 681
 682         if (EVP_PKEY_CTX_set_rsa_pss_saltlen(pkctx, saltlen) <= 0)
 683                 goto err;
 684
 685         if (EVP_PKEY_CTX_set_rsa_mgf1_md(pkctx, mgf1md) <= 0)
 686                 goto err;
 687         /* Carry on */
 688         rv = 1;
 689
 690         err:
 691         RSA_PSS_PARAMS_free(pss);
 692         if (maskHash)
 693                 X509_ALGOR_free(maskHash);
 694         return rv;
 695         }
 696
 697 static int rsa_cms_verify(CMS_SignerInfo *si)
 698         {
 699         int nid;
 700         X509_ALGOR *alg;
 701         EVP_PKEY_CTX *pkctx = CMS_SignerInfo_get0_pkey_ctx(si);
 702         CMS_SignerInfo_get0_algs(si, NULL, NULL, NULL, &alg);
 703         nid = OBJ_obj2nid(alg->algorithm);
 704         if (nid == NID_rsaEncryption)
 705                 return 1;
 706         if (nid == NID_rsassaPss)
 707                 return rsa_pss_to_ctx(NULL, pkctx, alg, NULL);
 708         return 0;
 709         }
 710
 711 /* Customised RSA item verification routine. This is called
 712  * when a signature is encountered requiring special handling. We
 713  * currently only handle PSS.
 714  */
 715
 716
 717 static int rsa_item_verify(EVP_MD_CTX *ctx, const ASN1_ITEM *it, void *asn,
 718                         X509_ALGOR *sigalg, ASN1_BIT_STRING *sig,
 719                         EVP_PKEY *pkey)
 720         {
 721         /* Sanity check: make sure it is PSS */
 722         if (OBJ_obj2nid(sigalg->algorithm) != NID_rsassaPss)
 723                 {
 724                 RSAerr(RSA_F_RSA_ITEM_VERIFY, RSA_R_UNSUPPORTED_SIGNATURE_TYPE);
 725                 return -1;
 726                 }
 727         if (rsa_pss_to_ctx(ctx, NULL, sigalg, pkey))
 728                 /* Carry on */
 729                 return 2;
 730         return -1;
 731         }
 732
 733 static int rsa_cms_sign(CMS_SignerInfo *si)
 734         {
 735         int pad_mode = RSA_PKCS1_PADDING;
 736         X509_ALGOR *alg;
 737         EVP_PKEY_CTX *pkctx = CMS_SignerInfo_get0_pkey_ctx(si);
 738         ASN1_STRING *os = NULL;
 739         CMS_SignerInfo_get0_algs(si, NULL, NULL, NULL, &alg);
 740         if (pkctx)
 741                 {
 742                 if (EVP_PKEY_CTX_get_rsa_padding(pkctx, &pad_mode) <= 0)
 743                         return 0;
 744                 }
 745         if (pad_mode == RSA_PKCS1_PADDING)
 746                 {
 747                 X509_ALGOR_set0(alg, OBJ_nid2obj(NID_rsaEncryption),
 748                                                         V_ASN1_NULL, 0);
 749                 return 1;
 750                 }
 751         /* We don't support it */
 752         if (pad_mode != RSA_PKCS1_PSS_PADDING)
 753                 return 0;
 754         os = rsa_ctx_to_pss(pkctx);
 755         if (!os)
 756                 return 0;
 757         X509_ALGOR_set0(alg, OBJ_nid2obj(NID_rsassaPss), V_ASN1_SEQUENCE, os);
 758         return 1;
 759         }
 760
 761 static int rsa_item_sign(EVP_MD_CTX *ctx, const ASN1_ITEM *it, void *asn,
 762                                 X509_ALGOR *alg1, X509_ALGOR *alg2,
 763                                 ASN1_BIT_STRING *sig)
 764         {
 765         int pad_mode;
 766         EVP_PKEY_CTX *pkctx = ctx->pctx;
 767         if (EVP_PKEY_CTX_get_rsa_padding(pkctx, &pad_mode) <= 0)
 768                 return 0;
 769         if (pad_mode == RSA_PKCS1_PADDING)
 770                 return 2;
 771         if (pad_mode == RSA_PKCS1_PSS_PADDING)
 772                 {
 773                 ASN1_STRING *os1 = NULL;
 774                 os1 = rsa_ctx_to_pss(pkctx);
 775                 if (!os1)
 776                         return 0;
 777                 /* Duplicate parameters if we have to */
 778                 if (alg2)
 779                         {
 780                         ASN1_STRING *os2 = ASN1_STRING_dup(os1);
 781                         if (!os2)
 782                                 {
 783                                 ASN1_STRING_free(os1);
 784                                 return 0;
 785                                 }
 786                         X509_ALGOR_set0(alg2, OBJ_nid2obj(NID_rsassaPss),
 787                                                 V_ASN1_SEQUENCE, os2);
 788                         }
 789                 X509_ALGOR_set0(alg1, OBJ_nid2obj(NID_rsassaPss),
 790                                         V_ASN1_SEQUENCE, os1);
 791                 return 3;
 792                 }
 793         return 2;
 794         }
 795
 796 static RSA_OAEP_PARAMS *rsa_oaep_decode(const X509_ALGOR *alg,
 797                                         X509_ALGOR **pmaskHash)
 798         {
 799         const unsigned char *p;
 800         int plen;
 801         RSA_OAEP_PARAMS *pss;
 802
 803         *pmaskHash = NULL;
 804
 805         if (!alg->parameter || alg->parameter->type != V_ASN1_SEQUENCE)
 806                 return NULL;
 807         p = alg->parameter->value.sequence->data;
 808         plen = alg->parameter->value.sequence->length;
 809         pss = d2i_RSA_OAEP_PARAMS(NULL, &p, plen);
 810
 811         if (!pss)
 812                 return NULL;
 813
 814         *pmaskHash = rsa_mgf1_decode(pss->maskGenFunc);
 815
 816         return pss;
 817         }
 818
 819 static int rsa_cms_decrypt(CMS_RecipientInfo *ri)
 820         {
 821         EVP_PKEY_CTX *pkctx;
 822         X509_ALGOR *cmsalg;
 823         int nid;
 824         int rv = -1;
 825         unsigned char *label = NULL;
 826         int labellen = 0;
 827         const EVP_MD *mgf1md = NULL, *md = NULL;
 828         RSA_OAEP_PARAMS *oaep;
 829         X509_ALGOR *maskHash;
 830         pkctx = CMS_RecipientInfo_get0_pkey_ctx(ri);
 831         if (!pkctx)
 832                 return 0;
 833         if (!CMS_RecipientInfo_ktri_get0_algs(ri, NULL, NULL, &cmsalg))
 834                 return -1;
 835         nid = OBJ_obj2nid(cmsalg->algorithm);
 836         if (nid == NID_rsaEncryption)
 837                 return 1;
 838         if (nid != NID_rsaesOaep)
 839                 {
 840                 RSAerr(RSA_F_RSA_CMS_DECRYPT, RSA_R_UNSUPPORTED_ENCRYPTION_TYPE);
 841                 return -1;
 842                 }
 843         /* Decode OAEP parameters */
 844         oaep = rsa_oaep_decode(cmsalg, &maskHash);
 845
 846         if (oaep == NULL)
 847                 {
 848                 RSAerr(RSA_F_RSA_CMS_DECRYPT, RSA_R_INVALID_OAEP_PARAMETERS);
 849                 goto err;
 850                 }
 851
 852         mgf1md = rsa_mgf1_to_md(oaep->maskGenFunc, maskHash);
 853         if (!mgf1md)
 854                 goto err;
 855         md = rsa_algor_to_md(oaep->hashFunc);
 856         if (!md)
 857                 goto err;
 858
 859         if (oaep->pSourceFunc)
 860                 {
 861                 X509_ALGOR *plab = oaep->pSourceFunc;
 862                 if (OBJ_obj2nid(plab->algorithm) != NID_pSpecified)
 863                         {
 864                         RSAerr(RSA_F_RSA_CMS_DECRYPT, RSA_R_UNSUPPORTED_LABEL_SOURCE);
 865                         goto err;
 866                         }
 867                 if (plab->parameter->type != V_ASN1_OCTET_STRING)
 868                         {
 869                         RSAerr(RSA_F_RSA_CMS_DECRYPT, RSA_R_INVALID_LABEL);
 870                         goto err;
 871                         }
 872
 873                 label = plab->parameter->value.octet_string->data;
 874                 /* Stop label being freed when OAEP parameters are freed */
 875                 plab->parameter->value.octet_string->data = NULL;
 876                 labellen = plab->parameter->value.octet_string->length;
 877                 }
 878
 879         if (EVP_PKEY_CTX_set_rsa_padding(pkctx, RSA_PKCS1_OAEP_PADDING) <= 0)
 880                 goto err;
 881         if (EVP_PKEY_CTX_set_rsa_oaep_md(pkctx, md) <= 0)
 882                 goto err;
 883         if (EVP_PKEY_CTX_set_rsa_mgf1_md(pkctx, mgf1md) <= 0)
 884                 goto err;
 885         if (EVP_PKEY_CTX_set0_rsa_oaep_label(pkctx, label, labellen) <= 0)
 886                 goto err;
 887         /* Carry on */
 888         rv = 1;
 889
 890         err:
 891         RSA_OAEP_PARAMS_free(oaep);
 892         if (maskHash)
 893                 X509_ALGOR_free(maskHash);
 894         return rv;
 895         }
 896
 897 static int rsa_cms_encrypt(CMS_RecipientInfo *ri)
 898         {
 899         const EVP_MD *md, *mgf1md;
 900         RSA_OAEP_PARAMS *oaep = NULL;
 901         ASN1_STRING *os = NULL;
 902         X509_ALGOR *alg;
 903         EVP_PKEY_CTX *pkctx = CMS_RecipientInfo_get0_pkey_ctx(ri);
 904         int pad_mode = RSA_PKCS1_PADDING, rv = 0, labellen;
 905         unsigned char *label;
 906         CMS_RecipientInfo_ktri_get0_algs(ri, NULL, NULL, &alg);
 907         if (pkctx)
 908                 {
 909                 if (EVP_PKEY_CTX_get_rsa_padding(pkctx, &pad_mode) <= 0)
 910                         return 0;
 911                 }
 912         if (pad_mode == RSA_PKCS1_PADDING)
 913                 {
 914                 X509_ALGOR_set0(alg, OBJ_nid2obj(NID_rsaEncryption),
 915                                                         V_ASN1_NULL, 0);
 916                 return 1;
 917                 }
 918         /* Not supported */
 919         if (pad_mode != RSA_PKCS1_OAEP_PADDING)
 920                 return 0;
 921         if (EVP_PKEY_CTX_get_rsa_oaep_md(pkctx, &md) <= 0)
 922                 goto err;
 923         if (EVP_PKEY_CTX_get_rsa_mgf1_md(pkctx, &mgf1md) <= 0)
 924                 goto err;
 925         labellen = EVP_PKEY_CTX_get0_rsa_oaep_label(pkctx, &label);
 926         if (labellen < 0)
 927                 goto err;
 928         oaep = RSA_OAEP_PARAMS_new();
 929         if (!oaep)
 930                 goto err;
 931         if (!rsa_md_to_algor(&oaep->hashFunc, md))
 932                 goto err;
 933         if (!rsa_md_to_mgf1(&oaep->maskGenFunc, mgf1md))
 934                 goto err;
 935         if (labellen > 0)
 936                 {
 937                 ASN1_OCTET_STRING *los = ASN1_OCTET_STRING_new();
 938                 oaep->pSourceFunc = X509_ALGOR_new();
 939                 if (!oaep->pSourceFunc)
 940                         goto err;
 941                 if (!los)
 942                         goto err;
 943                 if (!ASN1_OCTET_STRING_set(los, label, labellen))
 944                         {
 945                         ASN1_OCTET_STRING_free(los);
 946                         goto err;
 947                         }
 948                 X509_ALGOR_set0(oaep->pSourceFunc, OBJ_nid2obj(NID_pSpecified),
 949                                                 V_ASN1_OCTET_STRING, los);
 950                 }
 951         /* create string with pss parameter encoding. */
 952         if (!ASN1_item_pack(oaep, ASN1_ITEM_rptr(RSA_OAEP_PARAMS), &os))
 953                 goto err;
 954         X509_ALGOR_set0(alg, OBJ_nid2obj(NID_rsaesOaep), V_ASN1_SEQUENCE, os);
 955         os = NULL;
 956         rv = 1;
 957         err:
 958         if (oaep)
 959                 RSA_OAEP_PARAMS_free(oaep);
 960         if (os)
 961                 ASN1_STRING_free(os);
 962         return rv;
 963         }
 964
 965 const EVP_PKEY_ASN1_METHOD rsa_asn1_meths[] =
 966         {
 967                 {
 968                 EVP_PKEY_RSA,
 969                 EVP_PKEY_RSA,
 970                 ASN1_PKEY_SIGPARAM_NULL,
 971
 972                 "RSA",
 973                 "OpenSSL RSA method",
 974
 975                 rsa_pub_decode,
 976                 rsa_pub_encode,
 977                 rsa_pub_cmp,
 978                 rsa_pub_print,
 979
 980                 rsa_priv_decode,
 981                 rsa_priv_encode,
 982                 rsa_priv_print,
 983
 984                 int_rsa_size,
 985                 rsa_bits,
 986
 987                 0,0,0,0,0,0,
 988
 989                 rsa_sig_print,
 990                 int_rsa_free,
 991                 rsa_pkey_ctrl,
 992                 old_rsa_priv_decode,
 993                 old_rsa_priv_encode,
 994                 rsa_item_verify,
 995                 rsa_item_sign
 996                 },
 997
 998                 {
 999                 EVP_PKEY_RSA2,
1000                 EVP_PKEY_RSA,
1001                 ASN1_PKEY_ALIAS
1002                 }
1003         };