]>
Commit | Line | Data |
---|---|---|
2039c421 | 1 | /* |
169e422e | 2 | * Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved. |
d02b48c6 | 3 | * |
2a7b6f39 | 4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
2039c421 RS |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
d02b48c6 RE |
8 | */ |
9 | ||
c5f87134 P |
10 | /* |
11 | * RSA low level APIs are deprecated for public use, but still ok for | |
12 | * internal use. | |
13 | */ | |
14 | #include "internal/deprecated.h" | |
15 | ||
d02b48c6 | 16 | #include <stdio.h> |
b39fc560 | 17 | #include "internal/cryptlib.h" |
ec577822 BM |
18 | #include <openssl/bn.h> |
19 | #include <openssl/rsa.h> | |
20 | #include <openssl/objects.h> | |
21 | #include <openssl/x509.h> | |
25f2138b | 22 | #include "crypto/x509.h" |
169e422e SL |
23 | #ifndef OPENSSL_NO_MD2 |
24 | # include <openssl/md2.h> /* uses MD2_DIGEST_LENGTH */ | |
25 | #endif | |
6f4b7663 RL |
26 | #ifndef OPENSSL_NO_MD4 |
27 | # include <openssl/md4.h> /* uses MD4_DIGEST_LENGTH */ | |
28 | #endif | |
169e422e SL |
29 | #ifndef OPENSSL_NO_MD5 |
30 | # include <openssl/md5.h> /* uses MD5_DIGEST_LENGTH */ | |
31 | #endif | |
32 | #ifndef OPENSSL_NO_MDC2 | |
33 | # include <openssl/mdc2.h> /* uses MDC2_DIGEST_LENGTH */ | |
34 | #endif | |
6f4b7663 RL |
35 | #ifndef OPENSSL_NO_RMD160 |
36 | # include <openssl/ripemd.h> /* uses RIPEMD160_DIGEST_LENGTH */ | |
37 | #endif | |
169e422e | 38 | #include <openssl/sha.h> /* uses SHA???_DIGEST_LENGTH */ |
6f4b7663 | 39 | #include "crypto/rsa.h" |
706457b7 | 40 | #include "rsa_local.h" |
d02b48c6 | 41 | |
169e422e SL |
42 | /* |
43 | * The general purpose ASN1 code is not available inside the FIPS provider. | |
44 | * To remove the dependency RSASSA-PKCS1-v1_5 DigestInfo encodings can be | |
45 | * treated as a special case by pregenerating the required ASN1 encoding. | |
46 | * This encoding will also be shared by the default provider. | |
47 | * | |
48 | * The EMSA-PKCS1-v1_5 encoding method includes an ASN.1 value of type | |
49 | * DigestInfo, where the type DigestInfo has the syntax | |
50 | * | |
51 | * DigestInfo ::= SEQUENCE { | |
52 | * digestAlgorithm DigestAlgorithm, | |
53 | * digest OCTET STRING | |
54 | * } | |
55 | * | |
56 | * DigestAlgorithm ::= AlgorithmIdentifier { | |
57 | * {PKCS1-v1-5DigestAlgorithms} | |
58 | * } | |
59 | * | |
60 | * The AlgorithmIdentifier is a sequence containing the digest OID and | |
61 | * parameters (a value of type NULL). | |
62 | * | |
63 | * The ENCODE_DIGESTINFO_SHA() and ENCODE_DIGESTINFO_MD() macros define an | |
64 | * initialized array containing the DER encoded DigestInfo for the specified | |
65 | * SHA or MD digest. The content of the OCTET STRING is not included. | |
66 | * |name| is the digest name. | |
67 | * |n| is last byte in the encoded OID for the digest. | |
68 | * |sz| is the digest length in bytes. It must not be greater than 110. | |
69 | */ | |
70 | ||
71 | #define ASN1_SEQUENCE 0x30 | |
72 | #define ASN1_OCTET_STRING 0x04 | |
73 | #define ASN1_NULL 0x05 | |
74 | #define ASN1_OID 0x06 | |
75 | ||
76 | /* SHA OIDs are of the form: (2 16 840 1 101 3 4 2 |n|) */ | |
77 | #define ENCODE_DIGESTINFO_SHA(name, n, sz) \ | |
78 | static const unsigned char digestinfo_##name##_der[] = { \ | |
79 | ASN1_SEQUENCE, 0x11 + sz, \ | |
80 | ASN1_SEQUENCE, 0x0d, \ | |
81 | ASN1_OID, 0x09, 2 * 40 + 16, 0x86, 0x48, 1, 101, 3, 4, 2, n, \ | |
82 | ASN1_NULL, 0x00, \ | |
83 | ASN1_OCTET_STRING, sz \ | |
84 | }; | |
85 | ||
6f4b7663 | 86 | /* MD2, MD4 and MD5 OIDs are of the form: (1 2 840 113549 2 |n|) */ |
169e422e SL |
87 | #define ENCODE_DIGESTINFO_MD(name, n, sz) \ |
88 | static const unsigned char digestinfo_##name##_der[] = { \ | |
89 | ASN1_SEQUENCE, 0x10 + sz, \ | |
90 | ASN1_SEQUENCE, 0x0c, \ | |
91 | ASN1_OID, 0x08, 1 * 40 + 2, 0x86, 0x48, 0x86, 0xf7, 0x0d, 2, n, \ | |
92 | ASN1_NULL, 0x00, \ | |
93 | ASN1_OCTET_STRING, sz \ | |
94 | }; | |
95 | ||
96 | #ifndef FIPS_MODE | |
97 | # ifndef OPENSSL_NO_MD2 | |
98 | ENCODE_DIGESTINFO_MD(md2, 0x02, MD2_DIGEST_LENGTH) | |
99 | # endif | |
6f4b7663 RL |
100 | # ifndef OPENSSL_NO_MD4 |
101 | ENCODE_DIGESTINFO_MD(md4, 0x03, MD4_DIGEST_LENGTH) | |
102 | # endif | |
169e422e SL |
103 | # ifndef OPENSSL_NO_MD5 |
104 | ENCODE_DIGESTINFO_MD(md5, 0x05, MD5_DIGEST_LENGTH) | |
105 | # endif | |
106 | # ifndef OPENSSL_NO_MDC2 | |
107 | /* MDC-2 (2 5 8 3 101) */ | |
108 | static const unsigned char digestinfo_mdc2_der[] = { | |
109 | ASN1_SEQUENCE, 0x0c + MDC2_DIGEST_LENGTH, | |
110 | ASN1_SEQUENCE, 0x08, | |
111 | ASN1_OID, 0x04, 2 * 40 + 5, 8, 3, 101, | |
112 | ASN1_NULL, 0x00, | |
113 | ASN1_OCTET_STRING, MDC2_DIGEST_LENGTH | |
114 | }; | |
115 | # endif | |
6f4b7663 RL |
116 | # ifndef OPENSSL_NO_RMD160 |
117 | /* RIPEMD160 (1 3 36 3 3 1 2) */ | |
118 | static const unsigned char digestinfo_ripemd160_der[] = { | |
119 | ASN1_SEQUENCE, 0x0c + RIPEMD160_DIGEST_LENGTH, | |
120 | ASN1_SEQUENCE, 0x08, | |
121 | ASN1_OID, 0x04, 1 * 40 + 3, 36, 3, 3, 1, 2, | |
122 | ASN1_NULL, 0x00, | |
123 | ASN1_OCTET_STRING, RIPEMD160_DIGEST_LENGTH | |
124 | }; | |
125 | # endif | |
126 | #endif /* FIPS_MODE */ | |
127 | ||
169e422e SL |
128 | /* SHA-1 (1 3 14 3 2 26) */ |
129 | static const unsigned char digestinfo_sha1_der[] = { | |
130 | ASN1_SEQUENCE, 0x0d + SHA_DIGEST_LENGTH, | |
131 | ASN1_SEQUENCE, 0x09, | |
132 | ASN1_OID, 0x05, 1 * 40 + 3, 14, 3, 2, 26, | |
133 | ASN1_NULL, 0x00, | |
134 | ASN1_OCTET_STRING, SHA_DIGEST_LENGTH | |
135 | }; | |
136 | ||
169e422e SL |
137 | ENCODE_DIGESTINFO_SHA(sha256, 0x01, SHA256_DIGEST_LENGTH) |
138 | ENCODE_DIGESTINFO_SHA(sha384, 0x02, SHA384_DIGEST_LENGTH) | |
139 | ENCODE_DIGESTINFO_SHA(sha512, 0x03, SHA512_DIGEST_LENGTH) | |
140 | ENCODE_DIGESTINFO_SHA(sha224, 0x04, SHA224_DIGEST_LENGTH) | |
141 | ENCODE_DIGESTINFO_SHA(sha512_224, 0x05, SHA224_DIGEST_LENGTH) | |
142 | ENCODE_DIGESTINFO_SHA(sha512_256, 0x06, SHA256_DIGEST_LENGTH) | |
143 | ENCODE_DIGESTINFO_SHA(sha3_224, 0x07, SHA224_DIGEST_LENGTH) | |
144 | ENCODE_DIGESTINFO_SHA(sha3_256, 0x08, SHA256_DIGEST_LENGTH) | |
145 | ENCODE_DIGESTINFO_SHA(sha3_384, 0x09, SHA384_DIGEST_LENGTH) | |
146 | ENCODE_DIGESTINFO_SHA(sha3_512, 0x0a, SHA512_DIGEST_LENGTH) | |
147 | ||
148 | #define MD_CASE(name) \ | |
149 | case NID_##name: \ | |
150 | *len = sizeof(digestinfo_##name##_der); \ | |
151 | return digestinfo_##name##_der; | |
152 | ||
6f4b7663 | 153 | const unsigned char *rsa_digestinfo_encoding(int md_nid, size_t *len) |
169e422e | 154 | { |
6f4b7663 | 155 | switch (md_nid) { |
169e422e SL |
156 | #ifndef FIPS_MODE |
157 | # ifndef OPENSSL_NO_MDC2 | |
158 | MD_CASE(mdc2) | |
159 | # endif | |
160 | # ifndef OPENSSL_NO_MD2 | |
161 | MD_CASE(md2) | |
162 | # endif | |
6f4b7663 RL |
163 | # ifndef OPENSSL_NO_MD4 |
164 | MD_CASE(md4) | |
165 | # endif | |
169e422e SL |
166 | # ifndef OPENSSL_NO_MD5 |
167 | MD_CASE(md5) | |
168 | # endif | |
6f4b7663 RL |
169 | # ifndef OPENSSL_NO_RMD160 |
170 | MD_CASE(ripemd160) | |
171 | # endif | |
169e422e | 172 | #endif /* FIPS_MODE */ |
6f4b7663 | 173 | MD_CASE(sha1) |
169e422e SL |
174 | MD_CASE(sha224) |
175 | MD_CASE(sha256) | |
176 | MD_CASE(sha384) | |
177 | MD_CASE(sha512) | |
178 | MD_CASE(sha512_224) | |
179 | MD_CASE(sha512_256) | |
180 | MD_CASE(sha3_224) | |
181 | MD_CASE(sha3_256) | |
182 | MD_CASE(sha3_384) | |
183 | MD_CASE(sha3_512) | |
184 | default: | |
185 | return NULL; | |
186 | } | |
187 | } | |
188 | ||
1c80019a | 189 | /* Size of an SSL signature: MD5+SHA1 */ |
0f113f3e | 190 | #define SSL_SIG_LENGTH 36 |
1c80019a | 191 | |
608a0264 | 192 | /* |
169e422e | 193 | * Encodes a DigestInfo prefix of hash |type| and digest |m|, as |
608a0264 DB |
194 | * described in EMSA-PKCS1-v1_5-ENCODE, RFC 3447 section 9.2 step 2. This |
195 | * encodes the DigestInfo (T and tLen) but does not add the padding. | |
196 | * | |
197 | * On success, it returns one and sets |*out| to a newly allocated buffer | |
198 | * containing the result and |*out_len| to its length. The caller must free | |
169e422e | 199 | * |*out| with OPENSSL_free(). Otherwise, it returns zero. |
608a0264 | 200 | */ |
169e422e SL |
201 | static int encode_pkcs1(unsigned char **out, size_t *out_len, int type, |
202 | const unsigned char *m, size_t m_len) | |
0f113f3e | 203 | { |
169e422e SL |
204 | size_t di_prefix_len, dig_info_len; |
205 | const unsigned char *di_prefix; | |
206 | unsigned char *dig_info; | |
207 | ||
208 | if (type == NID_undef) { | |
608a0264 DB |
209 | RSAerr(RSA_F_ENCODE_PKCS1, RSA_R_UNKNOWN_ALGORITHM_TYPE); |
210 | return 0; | |
211 | } | |
6f4b7663 | 212 | di_prefix = rsa_digestinfo_encoding(type, &di_prefix_len); |
169e422e | 213 | if (di_prefix == NULL) { |
608a0264 DB |
214 | RSAerr(RSA_F_ENCODE_PKCS1, |
215 | RSA_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD); | |
216 | return 0; | |
217 | } | |
169e422e SL |
218 | dig_info_len = di_prefix_len + m_len; |
219 | dig_info = OPENSSL_malloc(dig_info_len); | |
220 | if (dig_info == NULL) { | |
221 | RSAerr(RSA_F_ENCODE_PKCS1, ERR_R_MALLOC_FAILURE); | |
608a0264 | 222 | return 0; |
169e422e SL |
223 | } |
224 | memcpy(dig_info, di_prefix, di_prefix_len); | |
225 | memcpy(dig_info + di_prefix_len, m, m_len); | |
608a0264 | 226 | |
169e422e SL |
227 | *out = dig_info; |
228 | *out_len = dig_info_len; | |
608a0264 DB |
229 | return 1; |
230 | } | |
231 | ||
232 | int RSA_sign(int type, const unsigned char *m, unsigned int m_len, | |
233 | unsigned char *sigret, unsigned int *siglen, RSA *rsa) | |
234 | { | |
169e422e SL |
235 | int encrypt_len, ret = 0; |
236 | size_t encoded_len = 0; | |
608a0264 DB |
237 | unsigned char *tmps = NULL; |
238 | const unsigned char *encoded = NULL; | |
239 | ||
169e422e | 240 | if (rsa->meth->rsa_sign != NULL) |
0f113f3e | 241 | return rsa->meth->rsa_sign(type, m, m_len, sigret, siglen, rsa); |
608a0264 DB |
242 | |
243 | /* Compute the encoded digest. */ | |
0f113f3e | 244 | if (type == NID_md5_sha1) { |
608a0264 DB |
245 | /* |
246 | * NID_md5_sha1 corresponds to the MD5/SHA1 combination in TLS 1.1 and | |
247 | * earlier. It has no DigestInfo wrapper but otherwise is | |
248 | * RSASSA-PKCS1-v1_5. | |
249 | */ | |
0f113f3e MC |
250 | if (m_len != SSL_SIG_LENGTH) { |
251 | RSAerr(RSA_F_RSA_SIGN, RSA_R_INVALID_MESSAGE_LENGTH); | |
608a0264 | 252 | return 0; |
0f113f3e | 253 | } |
608a0264 DB |
254 | encoded_len = SSL_SIG_LENGTH; |
255 | encoded = m; | |
0f113f3e | 256 | } else { |
608a0264 DB |
257 | if (!encode_pkcs1(&tmps, &encoded_len, type, m, m_len)) |
258 | goto err; | |
259 | encoded = tmps; | |
0f113f3e | 260 | } |
608a0264 | 261 | |
169e422e | 262 | if (encoded_len + RSA_PKCS1_PADDING_SIZE > (size_t)RSA_size(rsa)) { |
0f113f3e | 263 | RSAerr(RSA_F_RSA_SIGN, RSA_R_DIGEST_TOO_BIG_FOR_RSA_KEY); |
608a0264 | 264 | goto err; |
0f113f3e | 265 | } |
169e422e | 266 | encrypt_len = RSA_private_encrypt((int)encoded_len, encoded, sigret, rsa, |
608a0264 DB |
267 | RSA_PKCS1_PADDING); |
268 | if (encrypt_len <= 0) | |
269 | goto err; | |
d02b48c6 | 270 | |
608a0264 DB |
271 | *siglen = encrypt_len; |
272 | ret = 1; | |
273 | ||
274 | err: | |
169e422e | 275 | OPENSSL_clear_free(tmps, encoded_len); |
0f113f3e MC |
276 | return ret; |
277 | } | |
1cfd255c | 278 | |
608a0264 | 279 | /* |
169e422e SL |
280 | * Verify an RSA signature in |sigbuf| using |rsa|. |
281 | * |type| is the NID of the digest algorithm to use. | |
282 | * If |rm| is NULL, it verifies the signature for digest |m|, otherwise | |
283 | * it recovers the digest from the signature, writing the digest to |rm| and | |
284 | * the length to |*prm_len|. | |
285 | * | |
286 | * It returns one on successful verification or zero otherwise. | |
608a0264 DB |
287 | */ |
288 | int int_rsa_verify(int type, const unsigned char *m, unsigned int m_len, | |
0f113f3e MC |
289 | unsigned char *rm, size_t *prm_len, |
290 | const unsigned char *sigbuf, size_t siglen, RSA *rsa) | |
291 | { | |
169e422e SL |
292 | int len, ret = 0; |
293 | size_t decrypt_len, encoded_len = 0; | |
608a0264 | 294 | unsigned char *decrypt_buf = NULL, *encoded = NULL; |
d02b48c6 | 295 | |
608a0264 | 296 | if (siglen != (size_t)RSA_size(rsa)) { |
0f113f3e | 297 | RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_WRONG_SIGNATURE_LENGTH); |
608a0264 | 298 | return 0; |
0f113f3e | 299 | } |
d02b48c6 | 300 | |
608a0264 DB |
301 | /* Recover the encoded digest. */ |
302 | decrypt_buf = OPENSSL_malloc(siglen); | |
303 | if (decrypt_buf == NULL) { | |
0f113f3e MC |
304 | RSAerr(RSA_F_INT_RSA_VERIFY, ERR_R_MALLOC_FAILURE); |
305 | goto err; | |
306 | } | |
d02b48c6 | 307 | |
169e422e SL |
308 | len = RSA_public_decrypt((int)siglen, sigbuf, decrypt_buf, rsa, |
309 | RSA_PKCS1_PADDING); | |
310 | if (len <= 0) | |
0f113f3e | 311 | goto err; |
169e422e | 312 | decrypt_len = len; |
608a0264 DB |
313 | |
314 | if (type == NID_md5_sha1) { | |
315 | /* | |
316 | * NID_md5_sha1 corresponds to the MD5/SHA1 combination in TLS 1.1 and | |
317 | * earlier. It has no DigestInfo wrapper but otherwise is | |
318 | * RSASSA-PKCS1-v1_5. | |
319 | */ | |
320 | if (decrypt_len != SSL_SIG_LENGTH) { | |
0f113f3e | 321 | RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_BAD_SIGNATURE); |
608a0264 | 322 | goto err; |
dffe5109 | 323 | } |
b79aa05e | 324 | |
608a0264 DB |
325 | if (rm != NULL) { |
326 | memcpy(rm, decrypt_buf, SSL_SIG_LENGTH); | |
327 | *prm_len = SSL_SIG_LENGTH; | |
328 | } else { | |
329 | if (m_len != SSL_SIG_LENGTH) { | |
330 | RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_INVALID_MESSAGE_LENGTH); | |
331 | goto err; | |
332 | } | |
b79aa05e | 333 | |
608a0264 DB |
334 | if (memcmp(decrypt_buf, m, SSL_SIG_LENGTH) != 0) { |
335 | RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_BAD_SIGNATURE); | |
336 | goto err; | |
337 | } | |
0f113f3e | 338 | } |
608a0264 DB |
339 | } else if (type == NID_mdc2 && decrypt_len == 2 + 16 |
340 | && decrypt_buf[0] == 0x04 && decrypt_buf[1] == 0x10) { | |
341 | /* | |
342 | * Oddball MDC2 case: signature can be OCTET STRING. check for correct | |
343 | * tag and length octets. | |
344 | */ | |
345 | if (rm != NULL) { | |
346 | memcpy(rm, decrypt_buf + 2, 16); | |
347 | *prm_len = 16; | |
348 | } else { | |
349 | if (m_len != 16) { | |
350 | RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_INVALID_MESSAGE_LENGTH); | |
351 | goto err; | |
352 | } | |
b79aa05e | 353 | |
608a0264 DB |
354 | if (memcmp(m, decrypt_buf + 2, 16) != 0) { |
355 | RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_BAD_SIGNATURE); | |
356 | goto err; | |
357 | } | |
358 | } | |
359 | } else { | |
0f113f3e | 360 | /* |
608a0264 DB |
361 | * If recovering the digest, extract a digest-sized output from the end |
362 | * of |decrypt_buf| for |encode_pkcs1|, then compare the decryption | |
363 | * output as in a standard verification. | |
0f113f3e | 364 | */ |
608a0264 DB |
365 | if (rm != NULL) { |
366 | const EVP_MD *md = EVP_get_digestbynid(type); | |
367 | if (md == NULL) { | |
368 | RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_UNKNOWN_ALGORITHM_TYPE); | |
369 | goto err; | |
370 | } | |
371 | ||
169e422e SL |
372 | len = EVP_MD_size(md); |
373 | if (len <= 0) | |
374 | goto err; | |
375 | m_len = (unsigned int)len; | |
376 | if (m_len > decrypt_len) { | |
608a0264 DB |
377 | RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_INVALID_DIGEST_LENGTH); |
378 | goto err; | |
379 | } | |
380 | m = decrypt_buf + decrypt_len - m_len; | |
0f113f3e | 381 | } |
d02b48c6 | 382 | |
608a0264 DB |
383 | /* Construct the encoded digest and ensure it matches. */ |
384 | if (!encode_pkcs1(&encoded, &encoded_len, type, m, m_len)) | |
385 | goto err; | |
dfeab068 | 386 | |
608a0264 | 387 | if (encoded_len != decrypt_len |
169e422e | 388 | || memcmp(encoded, decrypt_buf, encoded_len) != 0) { |
608a0264 | 389 | RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_BAD_SIGNATURE); |
3d0cf918 | 390 | goto err; |
0f113f3e | 391 | } |
608a0264 DB |
392 | |
393 | /* Output the recovered digest. */ | |
394 | if (rm != NULL) { | |
395 | memcpy(rm, m, m_len); | |
396 | *prm_len = m_len; | |
397 | } | |
0f113f3e | 398 | } |
608a0264 DB |
399 | |
400 | ret = 1; | |
401 | ||
402 | err: | |
169e422e | 403 | OPENSSL_clear_free(encoded, encoded_len); |
608a0264 DB |
404 | OPENSSL_clear_free(decrypt_buf, siglen); |
405 | return ret; | |
0f113f3e | 406 | } |
d02b48c6 | 407 | |
608a0264 | 408 | int RSA_verify(int type, const unsigned char *m, unsigned int m_len, |
0f113f3e MC |
409 | const unsigned char *sigbuf, unsigned int siglen, RSA *rsa) |
410 | { | |
b2a97be7 | 411 | |
169e422e | 412 | if (rsa->meth->rsa_verify != NULL) |
608a0264 | 413 | return rsa->meth->rsa_verify(type, m, m_len, sigbuf, siglen, rsa); |
b2a97be7 | 414 | |
608a0264 | 415 | return int_rsa_verify(type, m, m_len, NULL, NULL, sigbuf, siglen, rsa); |
0f113f3e | 416 | } |