[thirdparty/openssl.git] / crypto / rsa / rsa_pss.c

/*
 * Copyright 2005-2020 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

/*
 * RSA low level APIs are deprecated for public use, but still ok for
 * internal use.
 */
#include "internal/deprecated.h"

#include <stdio.h>
#include "internal/cryptlib.h"
#include <openssl/bn.h>
#include <openssl/rsa.h>
#include <openssl/evp.h>
#include <openssl/rand.h>
#include <openssl/sha.h>
#include "rsa_local.h"

static const unsigned char zeroes[] = { 0, 0, 0, 0, 0, 0, 0, 0 };

#if defined(_MSC_VER) && defined(_ARM_)
# pragma optimize("g", off)
#endif

int RSA_verify_PKCS1_PSS(RSA *rsa, const unsigned char *mHash,
                         const EVP_MD *Hash, const unsigned char *EM,
                         int sLen)
{
    return RSA_verify_PKCS1_PSS_mgf1(rsa, mHash, Hash, NULL, EM, sLen);
}

int RSA_verify_PKCS1_PSS_mgf1(RSA *rsa, const unsigned char *mHash,
                              const EVP_MD *Hash, const EVP_MD *mgf1Hash,
                              const unsigned char *EM, int sLen)
{
    int i;
    int ret = 0;
    int hLen, maskedDBLen, MSBits, emLen;
    const unsigned char *H;
    unsigned char *DB = NULL;
    EVP_MD_CTX *ctx = EVP_MD_CTX_new();
    unsigned char H_[EVP_MAX_MD_SIZE];

    if (ctx == NULL)
        goto err;

    if (mgf1Hash == NULL)
        mgf1Hash = Hash;

    hLen = EVP_MD_size(Hash);
    if (hLen < 0)
        goto err;
    /*-
     * Negative sLen has special meanings:
     *      -1      sLen == hLen
     *      -2      salt length is autorecovered from signature
     *      -3      salt length is maximized
     *      -N      reserved
     */
    if (sLen == RSA_PSS_SALTLEN_DIGEST) {
        sLen = hLen;
    } else if (sLen < RSA_PSS_SALTLEN_MAX) {
        RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_SLEN_CHECK_FAILED);
        goto err;
    }

    MSBits = (BN_num_bits(rsa->n) - 1) & 0x7;
    emLen = RSA_size(rsa);
    if (EM[0] & (0xFF << MSBits)) {
        RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_FIRST_OCTET_INVALID);
        goto err;
    }
    if (MSBits == 0) {
        EM++;
        emLen--;
    }
    if (emLen < hLen + 2) {
        RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_DATA_TOO_LARGE);
        goto err;
    }
    if (sLen == RSA_PSS_SALTLEN_MAX) {
        sLen = emLen - hLen - 2;
    } else if (sLen > emLen - hLen - 2) { /* sLen can be small negative */
        RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_DATA_TOO_LARGE);
        goto err;
    }
    if (EM[emLen - 1] != 0xbc) {
        RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_LAST_OCTET_INVALID);
        goto err;
    }
    maskedDBLen = emLen - hLen - 1;
    H = EM + maskedDBLen;
    DB = OPENSSL_malloc(maskedDBLen);
    if (DB == NULL) {
        RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, ERR_R_MALLOC_FAILURE);
        goto err;
    }
    if (PKCS1_MGF1(DB, maskedDBLen, H, hLen, mgf1Hash) < 0)
        goto err;
    for (i = 0; i < maskedDBLen; i++)
        DB[i] ^= EM[i];
    if (MSBits)
        DB[0] &= 0xFF >> (8 - MSBits);
    for (i = 0; DB[i] == 0 && i < (maskedDBLen - 1); i++) ;
    if (DB[i++] != 0x1) {
        RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_SLEN_RECOVERY_FAILED);
        goto err;
    }
    if (sLen != RSA_PSS_SALTLEN_AUTO && (maskedDBLen - i) != sLen) {
        RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_SLEN_CHECK_FAILED);
        goto err;
    }
    if (!EVP_DigestInit_ex(ctx, Hash, NULL)
        || !EVP_DigestUpdate(ctx, zeroes, sizeof(zeroes))
        || !EVP_DigestUpdate(ctx, mHash, hLen))
        goto err;
    if (maskedDBLen - i) {
        if (!EVP_DigestUpdate(ctx, DB + i, maskedDBLen - i))
            goto err;
    }
    if (!EVP_DigestFinal_ex(ctx, H_, NULL))
        goto err;
    if (memcmp(H_, H, hLen)) {
        RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_BAD_SIGNATURE);
        ret = 0;
    } else {
        ret = 1;
    }

 err:
    OPENSSL_free(DB);
    EVP_MD_CTX_free(ctx);

    return ret;

}

int RSA_padding_add_PKCS1_PSS(RSA *rsa, unsigned char *EM,
                              const unsigned char *mHash,
                              const EVP_MD *Hash, int sLen)
{
    return RSA_padding_add_PKCS1_PSS_mgf1(rsa, EM, mHash, Hash, NULL, sLen);
}

int RSA_padding_add_PKCS1_PSS_mgf1(RSA *rsa, unsigned char *EM,
                                   const unsigned char *mHash,
                                   const EVP_MD *Hash, const EVP_MD *mgf1Hash,
                                   int sLen)
{
    int i;
    int ret = 0;
    int hLen, maskedDBLen, MSBits, emLen;
    unsigned char *H, *salt = NULL, *p;
    EVP_MD_CTX *ctx = NULL;

    if (mgf1Hash == NULL)
        mgf1Hash = Hash;

    hLen = EVP_MD_size(Hash);
    if (hLen < 0)
        goto err;
    /*-
     * Negative sLen has special meanings:
     *      -1      sLen == hLen
     *      -2      salt length is maximized
     *      -3      same as above (on signing)
     *      -N      reserved
     */
    if (sLen == RSA_PSS_SALTLEN_DIGEST) {
        sLen = hLen;
    } else if (sLen == RSA_PSS_SALTLEN_MAX_SIGN) {
        sLen = RSA_PSS_SALTLEN_MAX;
    } else if (sLen < RSA_PSS_SALTLEN_MAX) {
        RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_PSS_MGF1, RSA_R_SLEN_CHECK_FAILED);
        goto err;
    }

    MSBits = (BN_num_bits(rsa->n) - 1) & 0x7;
    emLen = RSA_size(rsa);
    if (MSBits == 0) {
        *EM++ = 0;
        emLen--;
    }
    if (emLen < hLen + 2) {
        RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_PSS_MGF1,
               RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE);
        goto err;
    }
    if (sLen == RSA_PSS_SALTLEN_MAX) {
        sLen = emLen - hLen - 2;
    } else if (sLen > emLen - hLen - 2) {
        RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_PSS_MGF1,
               RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE);
        goto err;
    }
    if (sLen > 0) {
        salt = OPENSSL_malloc(sLen);
        if (salt == NULL) {
            RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_PSS_MGF1,
                   ERR_R_MALLOC_FAILURE);
            goto err;
        }
        if (RAND_bytes_ex(rsa->libctx, salt, sLen) <= 0)
            goto err;
    }
    maskedDBLen = emLen - hLen - 1;
    H = EM + maskedDBLen;
    ctx = EVP_MD_CTX_new();
    if (ctx == NULL)
        goto err;
    if (!EVP_DigestInit_ex(ctx, Hash, NULL)
        || !EVP_DigestUpdate(ctx, zeroes, sizeof(zeroes))
        || !EVP_DigestUpdate(ctx, mHash, hLen))
        goto err;
    if (sLen && !EVP_DigestUpdate(ctx, salt, sLen))
        goto err;
    if (!EVP_DigestFinal_ex(ctx, H, NULL))
        goto err;

    /* Generate dbMask in place then perform XOR on it */
    if (PKCS1_MGF1(EM, maskedDBLen, H, hLen, mgf1Hash))
        goto err;

    p = EM;

    /*
     * Initial PS XORs with all zeroes which is a NOP so just update pointer.
     * Note from a test above this value is guaranteed to be non-negative.
     */
    p += emLen - sLen - hLen - 2;
    *p++ ^= 0x1;
    if (sLen > 0) {
        for (i = 0; i < sLen; i++)
            *p++ ^= salt[i];
    }
    if (MSBits)
        EM[0] &= 0xFF >> (8 - MSBits);

    /* H is already in place so just set final 0xbc */

    EM[emLen - 1] = 0xbc;

    ret = 1;

 err:
    EVP_MD_CTX_free(ctx);
    OPENSSL_clear_free(salt, (size_t)sLen); /* salt != NULL implies sLen > 0 */

    return ret;

}

/*
 * The defaults for PSS restrictions are defined in RFC 8017, A.2.3 RSASSA-PSS
 * (https://tools.ietf.org/html/rfc8017#appendix-A.2.3):
 *
 * If the default values of the hashAlgorithm, maskGenAlgorithm, and
 * trailerField fields of RSASSA-PSS-params are used, then the algorithm
 * identifier will have the following value:
 *
 *     rSASSA-PSS-Default-Identifier    RSASSA-AlgorithmIdentifier ::= {
 *         algorithm   id-RSASSA-PSS,
 *         parameters  RSASSA-PSS-params : {
 *             hashAlgorithm       sha1,
 *             maskGenAlgorithm    mgf1SHA1,
 *             saltLength          20,
 *             trailerField        trailerFieldBC
 *         }
 *     }
 *
 *     RSASSA-AlgorithmIdentifier ::= AlgorithmIdentifier {
 *         {PKCS1Algorithms}
 *     }
 */
static const RSA_PSS_PARAMS_30 default_RSASSA_PSS_params = {
    NID_sha1,                    /* default hashAlgorithm */
    {
        NID_mgf1,                /* default maskGenAlgorithm */
        NID_sha1                 /* default MGF1 hash */
    },
    20,                          /* default saltLength */
    1                            /* default trailerField (0xBC) */
};

int ossl_rsa_pss_params_30_set_defaults(RSA_PSS_PARAMS_30 *rsa_pss_params)
{
    if (rsa_pss_params == NULL)
        return 0;
    *rsa_pss_params = default_RSASSA_PSS_params;
    return 1;
}

int ossl_rsa_pss_params_30_is_unrestricted(const RSA_PSS_PARAMS_30 *rsa_pss_params)
{
    static RSA_PSS_PARAMS_30 pss_params_cmp = { 0, };

    return rsa_pss_params == NULL
        || memcmp(rsa_pss_params, &pss_params_cmp,
                  sizeof(*rsa_pss_params)) == 0;
}

int ossl_rsa_pss_params_30_copy(RSA_PSS_PARAMS_30 *to,
                                const RSA_PSS_PARAMS_30 *from)
{
    memcpy(to, from, sizeof(*to));
    return 1;
}

int ossl_rsa_pss_params_30_set_hashalg(RSA_PSS_PARAMS_30 *rsa_pss_params,
                                       int hashalg_nid)
{
    if (rsa_pss_params == NULL)
        return 0;
    rsa_pss_params->hash_algorithm_nid = hashalg_nid;
    return 1;
}

int ossl_rsa_pss_params_30_set_maskgenalg(RSA_PSS_PARAMS_30 *rsa_pss_params,
                                          int maskgenalg_nid)
{
    if (rsa_pss_params == NULL)
        return 0;
    rsa_pss_params->mask_gen.algorithm_nid = maskgenalg_nid;
    return 1;
}

int ossl_rsa_pss_params_30_set_maskgenhashalg(RSA_PSS_PARAMS_30 *rsa_pss_params,
                                              int maskgenhashalg_nid)
{
    if (rsa_pss_params == NULL)
        return 0;
    rsa_pss_params->mask_gen.hash_algorithm_nid = maskgenhashalg_nid;
    return 1;
}

int ossl_rsa_pss_params_30_set_saltlen(RSA_PSS_PARAMS_30 *rsa_pss_params,
                                       int saltlen)
{
    if (rsa_pss_params == NULL)
        return 0;
    rsa_pss_params->salt_len = saltlen;
    return 1;
}

int ossl_rsa_pss_params_30_set_trailerfield(RSA_PSS_PARAMS_30 *rsa_pss_params,
                                            int trailerfield)
{
    if (rsa_pss_params == NULL)
        return 0;
    rsa_pss_params->trailer_field = trailerfield;
    return 1;
}

int ossl_rsa_pss_params_30_hashalg(const RSA_PSS_PARAMS_30 *rsa_pss_params)
{
    if (rsa_pss_params == NULL)
        return default_RSASSA_PSS_params.hash_algorithm_nid;
    return rsa_pss_params->hash_algorithm_nid;
}

int ossl_rsa_pss_params_30_maskgenalg(const RSA_PSS_PARAMS_30 *rsa_pss_params)
{
    if (rsa_pss_params == NULL)
        return default_RSASSA_PSS_params.mask_gen.algorithm_nid;
    return rsa_pss_params->mask_gen.algorithm_nid;
}

int ossl_rsa_pss_params_30_maskgenhashalg(const RSA_PSS_PARAMS_30 *rsa_pss_params)
{
    if (rsa_pss_params == NULL)
        return default_RSASSA_PSS_params.hash_algorithm_nid;
    return rsa_pss_params->mask_gen.hash_algorithm_nid;
}

int ossl_rsa_pss_params_30_saltlen(const RSA_PSS_PARAMS_30 *rsa_pss_params)
{
    if (rsa_pss_params == NULL)
        return default_RSASSA_PSS_params.salt_len;
    return rsa_pss_params->salt_len;
}

int ossl_rsa_pss_params_30_trailerfield(const RSA_PSS_PARAMS_30 *rsa_pss_params)
{
    if (rsa_pss_params == NULL)
        return default_RSASSA_PSS_params.trailer_field;
    return rsa_pss_params->trailer_field;
}

#if defined(_MSC_VER)
# pragma optimize("",on)
#endif
Commit	Line	Data
0f113f3e	1	/*
33388b44	2	* Copyright 2005-2020 The OpenSSL Project Authors. All Rights Reserved.
429168e7	3	*
2a7b6f39	4	* Licensed under the Apache License 2.0 (the "License"). You may not use
2039c421 RS	5	* this file except in compliance with the License. You can obtain a copy
	6	* in the file LICENSE in the source distribution or at
	7	* https://www.openssl.org/source/license.html
429168e7 DSH	8	*/
429168e7 DSH	9
c5f87134 P	10	/*
	11	* RSA low level APIs are deprecated for public use, but still ok for
	12	* internal use.
	13	*/
	14	#include "internal/deprecated.h"
	15
429168e7	16	#include <stdio.h>
b39fc560	17	#include "internal/cryptlib.h"
429168e7 DSH	18	#include <openssl/bn.h>
	19	#include <openssl/rsa.h>
	20	#include <openssl/evp.h>
	21	#include <openssl/rand.h>
	22	#include <openssl/sha.h>
706457b7	23	#include "rsa_local.h"
429168e7	24
0f113f3e	25	static const unsigned char zeroes[] = { 0, 0, 0, 0, 0, 0, 0, 0 };
429168e7	26
0491e058	27	#if defined(_MSC_VER) && defined(_ARM_)
0f113f3e	28	# pragma optimize("g", off)
0491e058 AP	29	#endif
0491e058 AP	30
429168e7	31	int RSA_verify_PKCS1_PSS(RSA rsa, const unsigned char mHash,
0f113f3e MC	32	const EVP_MD Hash, const unsigned char EM,
	33	int sLen)
	34	{
	35	return RSA_verify_PKCS1_PSS_mgf1(rsa, mHash, Hash, NULL, EM, sLen);
	36	}
e8254d40 DSH	37
e8254d40 DSH	38	int RSA_verify_PKCS1_PSS_mgf1(RSA rsa, const unsigned char mHash,
0f113f3e MC	39	const EVP_MD Hash, const EVP_MD mgf1Hash,
	40	const unsigned char *EM, int sLen)
	41	{
	42	int i;
	43	int ret = 0;
	44	int hLen, maskedDBLen, MSBits, emLen;
	45	const unsigned char *H;
	46	unsigned char *DB = NULL;
bfb0641f	47	EVP_MD_CTX *ctx = EVP_MD_CTX_new();
0f113f3e	48	unsigned char H_[EVP_MAX_MD_SIZE];
6e59a892	49
6e59a892 RL	50	if (ctx == NULL)
6e59a892 RL	51	goto err;
d51204f1	52
0f113f3e MC	53	if (mgf1Hash == NULL)
0f113f3e MC	54	mgf1Hash = Hash;
e8254d40	55
6e59a892	56	hLen = EVP_MD_size(Hash);
0f113f3e MC	57	if (hLen < 0)
0f113f3e MC	58	goto err;
50e735f9 MC	59	/*-
	60	* Negative sLen has special meanings:
	61	* -1 sLen == hLen
	62	* -2 salt length is autorecovered from signature
108909d3	63	* -3 salt length is maximized
50e735f9 MC	64	* -N reserved
50e735f9 MC	65	*/
90862ab4	66	if (sLen == RSA_PSS_SALTLEN_DIGEST) {
0f113f3e	67	sLen = hLen;
90862ab4	68	} else if (sLen < RSA_PSS_SALTLEN_MAX) {
0f113f3e MC	69	RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_SLEN_CHECK_FAILED);
	70	goto err;
	71	}
d51204f1	72
0f113f3e MC	73	MSBits = (BN_num_bits(rsa->n) - 1) & 0x7;
	74	emLen = RSA_size(rsa);
	75	if (EM[0] & (0xFF << MSBits)) {
	76	RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_FIRST_OCTET_INVALID);
	77	goto err;
	78	}
	79	if (MSBits == 0) {
	80	EM++;
	81	emLen--;
	82	}
108909d3 BE	83	if (emLen < hLen + 2) {
	84	RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_DATA_TOO_LARGE);
	85	goto err;
	86	}
137096a7 DSH	87	if (sLen == RSA_PSS_SALTLEN_MAX) {
137096a7 DSH	88	sLen = emLen - hLen - 2;
108909d3	89	} else if (sLen > emLen - hLen - 2) { /* sLen can be small negative */
0f113f3e MC	90	RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_DATA_TOO_LARGE);
	91	goto err;
	92	}
	93	if (EM[emLen - 1] != 0xbc) {
	94	RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_LAST_OCTET_INVALID);
	95	goto err;
	96	}
	97	maskedDBLen = emLen - hLen - 1;
	98	H = EM + maskedDBLen;
	99	DB = OPENSSL_malloc(maskedDBLen);
90945fa3	100	if (DB == NULL) {
0f113f3e MC	101	RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, ERR_R_MALLOC_FAILURE);
	102	goto err;
	103	}
	104	if (PKCS1_MGF1(DB, maskedDBLen, H, hLen, mgf1Hash) < 0)
	105	goto err;
	106	for (i = 0; i < maskedDBLen; i++)
	107	DB[i] ^= EM[i];
	108	if (MSBits)
	109	DB[0] &= 0xFF >> (8 - MSBits);
	110	for (i = 0; DB[i] == 0 && i < (maskedDBLen - 1); i++) ;
	111	if (DB[i++] != 0x1) {
	112	RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_SLEN_RECOVERY_FAILED);
	113	goto err;
	114	}
137096a7	115	if (sLen != RSA_PSS_SALTLEN_AUTO && (maskedDBLen - i) != sLen) {
0f113f3e MC	116	RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_SLEN_CHECK_FAILED);
	117	goto err;
	118	}
6e59a892	119	if (!EVP_DigestInit_ex(ctx, Hash, NULL)
cbe29648	120	\|\| !EVP_DigestUpdate(ctx, zeroes, sizeof(zeroes))
6e59a892	121	\|\| !EVP_DigestUpdate(ctx, mHash, hLen))
0f113f3e MC	122	goto err;
0f113f3e MC	123	if (maskedDBLen - i) {
6e59a892	124	if (!EVP_DigestUpdate(ctx, DB + i, maskedDBLen - i))
0f113f3e MC	125	goto err;
0f113f3e MC	126	}
6e59a892	127	if (!EVP_DigestFinal_ex(ctx, H_, NULL))
0f113f3e MC	128	goto err;
	129	if (memcmp(H_, H, hLen)) {
	130	RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_BAD_SIGNATURE);
	131	ret = 0;
90862ab4	132	} else {
0f113f3e	133	ret = 1;
90862ab4	134	}
429168e7	135
0f113f3e	136	err:
b548a1f1	137	OPENSSL_free(DB);
bfb0641f	138	EVP_MD_CTX_free(ctx);
429168e7	139
0f113f3e	140	return ret;
429168e7	141
0f113f3e	142	}
429168e7 DSH	143
429168e7 DSH	144	int RSA_padding_add_PKCS1_PSS(RSA rsa, unsigned char EM,
0f113f3e MC	145	const unsigned char *mHash,
	146	const EVP_MD *Hash, int sLen)
	147	{
	148	return RSA_padding_add_PKCS1_PSS_mgf1(rsa, EM, mHash, Hash, NULL, sLen);
	149	}
e8254d40 DSH	150
e8254d40 DSH	151	int RSA_padding_add_PKCS1_PSS_mgf1(RSA rsa, unsigned char EM,
0f113f3e MC	152	const unsigned char *mHash,
	153	const EVP_MD Hash, const EVP_MD mgf1Hash,
	154	int sLen)
	155	{
	156	int i;
	157	int ret = 0;
	158	int hLen, maskedDBLen, MSBits, emLen;
	159	unsigned char H, salt = NULL, *p;
6e59a892	160	EVP_MD_CTX *ctx = NULL;
d51204f1	161
0f113f3e MC	162	if (mgf1Hash == NULL)
0f113f3e MC	163	mgf1Hash = Hash;
e8254d40	164
6e59a892	165	hLen = EVP_MD_size(Hash);
0f113f3e MC	166	if (hLen < 0)
0f113f3e MC	167	goto err;
50e735f9 MC	168	/*-
	169	* Negative sLen has special meanings:
	170	* -1 sLen == hLen
	171	* -2 salt length is maximized
108909d3	172	* -3 same as above (on signing)
50e735f9 MC	173	* -N reserved
50e735f9 MC	174	*/
90862ab4	175	if (sLen == RSA_PSS_SALTLEN_DIGEST) {
0f113f3e	176	sLen = hLen;
90862ab4	177	} else if (sLen == RSA_PSS_SALTLEN_MAX_SIGN) {
137096a7	178	sLen = RSA_PSS_SALTLEN_MAX;
90862ab4	179	} else if (sLen < RSA_PSS_SALTLEN_MAX) {
0f113f3e MC	180	RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_PSS_MGF1, RSA_R_SLEN_CHECK_FAILED);
	181	goto err;
	182	}
d51204f1	183
0f113f3e MC	184	MSBits = (BN_num_bits(rsa->n) - 1) & 0x7;
	185	emLen = RSA_size(rsa);
	186	if (MSBits == 0) {
	187	*EM++ = 0;
	188	emLen--;
	189	}
108909d3 BE	190	if (emLen < hLen + 2) {
	191	RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_PSS_MGF1,
	192	RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE);
	193	goto err;
	194	}
137096a7	195	if (sLen == RSA_PSS_SALTLEN_MAX) {
0f113f3e	196	sLen = emLen - hLen - 2;
108909d3	197	} else if (sLen > emLen - hLen - 2) {
0f113f3e MC	198	RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_PSS_MGF1,
	199	RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE);
	200	goto err;
	201	}
	202	if (sLen > 0) {
	203	salt = OPENSSL_malloc(sLen);
90945fa3	204	if (salt == NULL) {
0f113f3e MC	205	RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_PSS_MGF1,
	206	ERR_R_MALLOC_FAILURE);
	207	goto err;
	208	}
0f2deef5	209	if (RAND_bytes_ex(rsa->libctx, salt, sLen) <= 0)
0f113f3e MC	210	goto err;
	211	}
	212	maskedDBLen = emLen - hLen - 1;
	213	H = EM + maskedDBLen;
bfb0641f	214	ctx = EVP_MD_CTX_new();
6e59a892 RL	215	if (ctx == NULL)
	216	goto err;
	217	if (!EVP_DigestInit_ex(ctx, Hash, NULL)
cbe29648	218	\|\| !EVP_DigestUpdate(ctx, zeroes, sizeof(zeroes))
6e59a892	219	\|\| !EVP_DigestUpdate(ctx, mHash, hLen))
0f113f3e	220	goto err;
6e59a892	221	if (sLen && !EVP_DigestUpdate(ctx, salt, sLen))
0f113f3e	222	goto err;
6e59a892	223	if (!EVP_DigestFinal_ex(ctx, H, NULL))
0f113f3e	224	goto err;
429168e7	225
0f113f3e MC	226	/* Generate dbMask in place then perform XOR on it */
	227	if (PKCS1_MGF1(EM, maskedDBLen, H, hLen, mgf1Hash))
	228	goto err;
429168e7	229
0f113f3e	230	p = EM;
429168e7	231
0f113f3e MC	232	/*
	233	* Initial PS XORs with all zeroes which is a NOP so just update pointer.
	234	* Note from a test above this value is guaranteed to be non-negative.
	235	*/
	236	p += emLen - sLen - hLen - 2;
	237	*p++ ^= 0x1;
	238	if (sLen > 0) {
	239	for (i = 0; i < sLen; i++)
	240	*p++ ^= salt[i];
	241	}
	242	if (MSBits)
	243	EM[0] &= 0xFF >> (8 - MSBits);
429168e7	244
0f113f3e	245	/* H is already in place so just set final 0xbc */
429168e7	246
0f113f3e	247	EM[emLen - 1] = 0xbc;
429168e7	248
0f113f3e	249	ret = 1;
429168e7	250
0f113f3e	251	err:
bfb0641f	252	EVP_MD_CTX_free(ctx);
427e91d9	253	OPENSSL_clear_free(salt, (size_t)sLen); /* salt != NULL implies sLen > 0 */
429168e7	254
0f113f3e	255	return ret;
429168e7	256
0f113f3e	257	}
0491e058	258
15671090 RL	259	/*
	260	* The defaults for PSS restrictions are defined in RFC 8017, A.2.3 RSASSA-PSS
	261	* (https://tools.ietf.org/html/rfc8017#appendix-A.2.3):
	262	*
	263	* If the default values of the hashAlgorithm, maskGenAlgorithm, and
	264	* trailerField fields of RSASSA-PSS-params are used, then the algorithm
	265	* identifier will have the following value:
	266	*
	267	* rSASSA-PSS-Default-Identifier RSASSA-AlgorithmIdentifier ::= {
	268	* algorithm id-RSASSA-PSS,
	269	* parameters RSASSA-PSS-params : {
	270	* hashAlgorithm sha1,
	271	* maskGenAlgorithm mgf1SHA1,
	272	* saltLength 20,
	273	* trailerField trailerFieldBC
	274	* }
	275	* }
	276	*
	277	* RSASSA-AlgorithmIdentifier ::= AlgorithmIdentifier {
	278	* {PKCS1Algorithms}
	279	* }
	280	*/
	281	static const RSA_PSS_PARAMS_30 default_RSASSA_PSS_params = {
	282	NID_sha1, /* default hashAlgorithm */
	283	{
	284	NID_mgf1, /* default maskGenAlgorithm */
	285	NID_sha1 /* default MGF1 hash */
	286	},
	287	20, /* default saltLength */
	288	1 /* default trailerField (0xBC) */
	289	};
	290
23b2fc0b	291	int ossl_rsa_pss_params_30_set_defaults(RSA_PSS_PARAMS_30 *rsa_pss_params)
15671090 RL	292	{
	293	if (rsa_pss_params == NULL)
	294	return 0;
	295	*rsa_pss_params = default_RSASSA_PSS_params;
	296	return 1;
	297	}
	298
23b2fc0b	299	int ossl_rsa_pss_params_30_is_unrestricted(const RSA_PSS_PARAMS_30 *rsa_pss_params)
15671090 RL	300	{
	301	static RSA_PSS_PARAMS_30 pss_params_cmp = { 0, };
	302
	303	return rsa_pss_params == NULL
	304	\|\| memcmp(rsa_pss_params, &pss_params_cmp,
	305	sizeof(*rsa_pss_params)) == 0;
	306	}
	307
23b2fc0b P	308	int ossl_rsa_pss_params_30_copy(RSA_PSS_PARAMS_30 *to,
23b2fc0b P	309	const RSA_PSS_PARAMS_30 *from)
15671090 RL	310	{
	311	memcpy(to, from, sizeof(*to));
	312	return 1;
	313	}
	314
23b2fc0b P	315	int ossl_rsa_pss_params_30_set_hashalg(RSA_PSS_PARAMS_30 *rsa_pss_params,
23b2fc0b P	316	int hashalg_nid)
15671090 RL	317	{
	318	if (rsa_pss_params == NULL)
	319	return 0;
	320	rsa_pss_params->hash_algorithm_nid = hashalg_nid;
	321	return 1;
	322	}
	323
23b2fc0b P	324	int ossl_rsa_pss_params_30_set_maskgenalg(RSA_PSS_PARAMS_30 *rsa_pss_params,
23b2fc0b P	325	int maskgenalg_nid)
15671090 RL	326	{
	327	if (rsa_pss_params == NULL)
	328	return 0;
	329	rsa_pss_params->mask_gen.algorithm_nid = maskgenalg_nid;
	330	return 1;
	331	}
	332
23b2fc0b P	333	int ossl_rsa_pss_params_30_set_maskgenhashalg(RSA_PSS_PARAMS_30 *rsa_pss_params,
23b2fc0b P	334	int maskgenhashalg_nid)
15671090 RL	335	{
	336	if (rsa_pss_params == NULL)
	337	return 0;
	338	rsa_pss_params->mask_gen.hash_algorithm_nid = maskgenhashalg_nid;
	339	return 1;
	340	}
	341
23b2fc0b P	342	int ossl_rsa_pss_params_30_set_saltlen(RSA_PSS_PARAMS_30 *rsa_pss_params,
23b2fc0b P	343	int saltlen)
15671090 RL	344	{
	345	if (rsa_pss_params == NULL)
	346	return 0;
	347	rsa_pss_params->salt_len = saltlen;
	348	return 1;
	349	}
	350
23b2fc0b P	351	int ossl_rsa_pss_params_30_set_trailerfield(RSA_PSS_PARAMS_30 *rsa_pss_params,
23b2fc0b P	352	int trailerfield)
15671090 RL	353	{
	354	if (rsa_pss_params == NULL)
	355	return 0;
	356	rsa_pss_params->trailer_field = trailerfield;
	357	return 1;
	358	}
	359
23b2fc0b	360	int ossl_rsa_pss_params_30_hashalg(const RSA_PSS_PARAMS_30 *rsa_pss_params)
15671090 RL	361	{
	362	if (rsa_pss_params == NULL)
	363	return default_RSASSA_PSS_params.hash_algorithm_nid;
	364	return rsa_pss_params->hash_algorithm_nid;
	365	}
	366
23b2fc0b	367	int ossl_rsa_pss_params_30_maskgenalg(const RSA_PSS_PARAMS_30 *rsa_pss_params)
15671090 RL	368	{
	369	if (rsa_pss_params == NULL)
	370	return default_RSASSA_PSS_params.mask_gen.algorithm_nid;
	371	return rsa_pss_params->mask_gen.algorithm_nid;
	372	}
	373
23b2fc0b	374	int ossl_rsa_pss_params_30_maskgenhashalg(const RSA_PSS_PARAMS_30 *rsa_pss_params)
15671090 RL	375	{
	376	if (rsa_pss_params == NULL)
	377	return default_RSASSA_PSS_params.hash_algorithm_nid;
	378	return rsa_pss_params->mask_gen.hash_algorithm_nid;
	379	}
	380
23b2fc0b	381	int ossl_rsa_pss_params_30_saltlen(const RSA_PSS_PARAMS_30 *rsa_pss_params)
15671090 RL	382	{
	383	if (rsa_pss_params == NULL)
	384	return default_RSASSA_PSS_params.salt_len;
	385	return rsa_pss_params->salt_len;
	386	}
	387
23b2fc0b	388	int ossl_rsa_pss_params_30_trailerfield(const RSA_PSS_PARAMS_30 *rsa_pss_params)
15671090 RL	389	{
	390	if (rsa_pss_params == NULL)
	391	return default_RSASSA_PSS_params.trailer_field;
	392	return rsa_pss_params->trailer_field;
	393	}
	394
0491e058	395	#if defined(_MSC_VER)
0f113f3e	396	# pragma optimize("",on)
0491e058	397	#endif