]> git.ipfire.org Git - thirdparty/openssl.git/blame_incremental - crypto/rsa/rsa_ossl.c
projects / thirdparty / openssl.git / blame_incremental
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (non-incremental) | history | HEAD
Update util/analyze-contention-log.sh
[thirdparty/openssl.git] / crypto / rsa / rsa_ossl.c
... / ...
CommitLineData
1/*
2 * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10/*
11 * RSA low level APIs are deprecated for public use, but still ok for
12 * internal use.
13 */
14#include "internal/deprecated.h"
15
16#include "internal/cryptlib.h"
17#include "crypto/bn.h"
18#include "crypto/sparse_array.h"
19#include "rsa_local.h"
20#include "internal/constant_time.h"
21#include <openssl/evp.h>
22#include <openssl/sha.h>
23#include <openssl/hmac.h>
24
25DEFINE_SPARSE_ARRAY_OF(BN_BLINDING);
26
27static int rsa_ossl_public_encrypt(int flen, const unsigned char *from,
28 unsigned char *to, RSA *rsa, int padding);
29static int rsa_ossl_private_encrypt(int flen, const unsigned char *from,
30 unsigned char *to, RSA *rsa, int padding);
31static int rsa_ossl_public_decrypt(int flen, const unsigned char *from,
32 unsigned char *to, RSA *rsa, int padding);
33static int rsa_ossl_private_decrypt(int flen, const unsigned char *from,
34 unsigned char *to, RSA *rsa, int padding);
35static int rsa_ossl_mod_exp(BIGNUM *r0, const BIGNUM *i, RSA *rsa,
36 BN_CTX *ctx);
37static int rsa_ossl_init(RSA *rsa);
38static int rsa_ossl_finish(RSA *rsa);
39#ifdef S390X_MOD_EXP
40static int rsa_ossl_s390x_mod_exp(BIGNUM *r0, const BIGNUM *i, RSA *rsa,
41 BN_CTX *ctx);
42static RSA_METHOD rsa_pkcs1_ossl_meth = {
43 "OpenSSL PKCS#1 RSA",
44 rsa_ossl_public_encrypt,
45 rsa_ossl_public_decrypt, /* signature verification */
46 rsa_ossl_private_encrypt, /* signing */
47 rsa_ossl_private_decrypt,
48 rsa_ossl_s390x_mod_exp,
49 s390x_mod_exp,
50 rsa_ossl_init,
51 rsa_ossl_finish,
52 RSA_FLAG_FIPS_METHOD, /* flags */
53 NULL,
54 0, /* rsa_sign */
55 0, /* rsa_verify */
56 NULL, /* rsa_keygen */
57 NULL /* rsa_multi_prime_keygen */
58};
59#else
60static RSA_METHOD rsa_pkcs1_ossl_meth = {
61 "OpenSSL PKCS#1 RSA",
62 rsa_ossl_public_encrypt,
63 rsa_ossl_public_decrypt, /* signature verification */
64 rsa_ossl_private_encrypt, /* signing */
65 rsa_ossl_private_decrypt,
66 rsa_ossl_mod_exp,
67 BN_mod_exp_mont, /* XXX probably we should not use Montgomery
68 * if e == 3 */
69 rsa_ossl_init,
70 rsa_ossl_finish,
71 RSA_FLAG_FIPS_METHOD, /* flags */
72 NULL,
73 0, /* rsa_sign */
74 0, /* rsa_verify */
75 NULL, /* rsa_keygen */
76 NULL /* rsa_multi_prime_keygen */
77};
78#endif
79
80static const RSA_METHOD *default_RSA_meth = &rsa_pkcs1_ossl_meth;
81
82void RSA_set_default_method(const RSA_METHOD *meth)
83{
84 default_RSA_meth = meth;
85}
86
87const RSA_METHOD *RSA_get_default_method(void)
88{
89 return default_RSA_meth;
90}
91
92const RSA_METHOD *RSA_PKCS1_OpenSSL(void)
93{
94 return &rsa_pkcs1_ossl_meth;
95}
96
97const RSA_METHOD *RSA_null_method(void)
98{
99 return NULL;
100}
101
102static int rsa_ossl_public_encrypt(int flen, const unsigned char *from,
103 unsigned char *to, RSA *rsa, int padding)
104{
105 BIGNUM *f, *ret;
106 int i, num = 0, r = -1;
107 unsigned char *buf = NULL;
108 BN_CTX *ctx = NULL;
109
110 if (BN_num_bits(rsa->n) > OPENSSL_RSA_MAX_MODULUS_BITS) {
111 ERR_raise(ERR_LIB_RSA, RSA_R_MODULUS_TOO_LARGE);
112 return -1;
113 }
114
115 if (BN_ucmp(rsa->n, rsa->e) <= 0) {
116 ERR_raise(ERR_LIB_RSA, RSA_R_BAD_E_VALUE);
117 return -1;
118 }
119
120 /* for large moduli, enforce exponent limit */
121 if (BN_num_bits(rsa->n) > OPENSSL_RSA_SMALL_MODULUS_BITS) {
122 if (BN_num_bits(rsa->e) > OPENSSL_RSA_MAX_PUBEXP_BITS) {
123 ERR_raise(ERR_LIB_RSA, RSA_R_BAD_E_VALUE);
124 return -1;
125 }
126 }
127
128 if ((ctx = BN_CTX_new_ex(rsa->libctx)) == NULL)
129 goto err;
130 BN_CTX_start(ctx);
131 f = BN_CTX_get(ctx);
132 ret = BN_CTX_get(ctx);
133 num = BN_num_bytes(rsa->n);
134 buf = OPENSSL_malloc(num);
135 if (ret == NULL || buf == NULL)
136 goto err;
137
138 switch (padding) {
139 case RSA_PKCS1_PADDING:
140 i = ossl_rsa_padding_add_PKCS1_type_2_ex(rsa->libctx, buf, num,
141 from, flen);
142 break;
143 case RSA_PKCS1_OAEP_PADDING:
144 i = ossl_rsa_padding_add_PKCS1_OAEP_mgf1_ex(rsa->libctx, buf, num,
145 from, flen, NULL, 0,
146 NULL, NULL);
147 break;
148 case RSA_NO_PADDING:
149 i = RSA_padding_add_none(buf, num, from, flen);
150 break;
151 default:
152 ERR_raise(ERR_LIB_RSA, RSA_R_UNKNOWN_PADDING_TYPE);
153 goto err;
154 }
155 if (i <= 0)
156 goto err;
157
158 if (BN_bin2bn(buf, num, f) == NULL)
159 goto err;
160
161#ifdef FIPS_MODULE
162 /*
163 * See SP800-56Br2, section 7.1.1.1
164 * RSAEP: 1 < f < (n – 1).
165 * (where f is the plaintext).
166 */
167 if (padding == RSA_NO_PADDING) {
168 BIGNUM *nminus1 = BN_CTX_get(ctx);
169
170 if (BN_ucmp(f, BN_value_one()) <= 0) {
171 ERR_raise(ERR_LIB_RSA, RSA_R_DATA_TOO_SMALL);
172 goto err;
173 }
174 if (nminus1 == NULL
175 || BN_copy(nminus1, rsa->n) == NULL
176 || !BN_sub_word(nminus1, 1))
177 goto err;
178 if (BN_ucmp(f, nminus1) >= 0) {
179 ERR_raise(ERR_LIB_RSA, RSA_R_DATA_TOO_LARGE_FOR_MODULUS);
180 goto err;
181 }
182 } else
183#endif
184 {
185 if (BN_ucmp(f, rsa->n) >= 0) {
186 /* usually the padding functions would catch this */
187 ERR_raise(ERR_LIB_RSA, RSA_R_DATA_TOO_LARGE_FOR_MODULUS);
188 goto err;
189 }
190 }
191
192 if (rsa->flags & RSA_FLAG_CACHE_PUBLIC)
193 if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_n, rsa->lock,
194 rsa->n, ctx))
195 goto err;
196
197 if (!rsa->meth->bn_mod_exp(ret, f, rsa->e, rsa->n, ctx,
198 rsa->_method_mod_n))
199 goto err;
200
201 /*
202 * BN_bn2binpad puts in leading 0 bytes if the number is less than
203 * the length of the modulus.
204 */
205 r = BN_bn2binpad(ret, to, num);
206 err:
207 BN_CTX_end(ctx);
208 BN_CTX_free(ctx);
209 OPENSSL_clear_free(buf, num);
210 return r;
211}
212
213static void free_bn_blinding(ossl_uintmax_t idx, BN_BLINDING *b, void *arg)
214{
215 BN_BLINDING_free(b);
216}
217
218void ossl_rsa_free_blinding(RSA *rsa)
219{
220 SPARSE_ARRAY_OF(BN_BLINDING) *blindings = rsa->blindings_sa;
221
222 ossl_sa_BN_BLINDING_doall_arg(blindings, free_bn_blinding, NULL);
223 ossl_sa_BN_BLINDING_free(blindings);
224}
225
226void *ossl_rsa_alloc_blinding(void)
227{
228 return ossl_sa_BN_BLINDING_new();
229}
230
231static BN_BLINDING *ossl_rsa_get_thread_bn_blinding(RSA *rsa)
232{
233 SPARSE_ARRAY_OF(BN_BLINDING) *blindings = rsa->blindings_sa;
234 uintptr_t tid = (uintptr_t)CRYPTO_THREAD_get_current_id();
235
236 return ossl_sa_BN_BLINDING_get(blindings, tid);
237}
238
239static int ossl_rsa_set_thread_bn_blinding(RSA *rsa, BN_BLINDING *b)
240{
241 SPARSE_ARRAY_OF(BN_BLINDING) *blindings = rsa->blindings_sa;
242 uintptr_t tid = (uintptr_t)CRYPTO_THREAD_get_current_id();
243
244 return ossl_sa_BN_BLINDING_set(blindings, tid, b);
245}
246
247static BN_BLINDING *rsa_get_blinding(RSA *rsa, BN_CTX *ctx)
248{
249 BN_BLINDING *ret;
250
251 if (!CRYPTO_THREAD_read_lock(rsa->lock))
252 return NULL;
253
254 ret = ossl_rsa_get_thread_bn_blinding(rsa);
255 CRYPTO_THREAD_unlock(rsa->lock);
256
257 if (ret == NULL) {
258 ret = RSA_setup_blinding(rsa, ctx);
259 if (!CRYPTO_THREAD_write_lock(rsa->lock)) {
260 BN_BLINDING_free(ret);
261 ret = NULL;
262 } else {
263 if (!ossl_rsa_set_thread_bn_blinding(rsa, ret)) {
264 BN_BLINDING_free(ret);
265 ret = NULL;
266 }
267 }
268 CRYPTO_THREAD_unlock(rsa->lock);
269 }
270
271 return ret;
272}
273
274static int rsa_blinding_convert(BN_BLINDING *b, BIGNUM *f, BN_CTX *ctx)
275{
276 /*
277 * Local blinding: store the unblinding factor in BN_BLINDING.
278 */
279 return BN_BLINDING_convert_ex(f, NULL, b, ctx);
280}
281
282static int rsa_blinding_invert(BN_BLINDING *b, BIGNUM *f, BN_CTX *ctx)
283{
284 /*
285 * For local blinding, unblind is set to NULL, and BN_BLINDING_invert_ex
286 * will use the unblinding factor stored in BN_BLINDING. If BN_BLINDING
287 * is shared between threads, unblind must be non-null:
288 * BN_BLINDING_invert_ex will then use the local unblinding factor, and
289 * will only read the modulus from BN_BLINDING. In both cases it's safe
290 * to access the blinding without a lock.
291 */
292 BN_set_flags(f, BN_FLG_CONSTTIME);
293 return BN_BLINDING_invert_ex(f, NULL, b, ctx);
294}
295
296/* signing */
297static int rsa_ossl_private_encrypt(int flen, const unsigned char *from,
298 unsigned char *to, RSA *rsa, int padding)
299{
300 BIGNUM *f, *ret, *res;
301 int i, num = 0, r = -1;
302 unsigned char *buf = NULL;
303 BN_CTX *ctx = NULL;
304 BN_BLINDING *blinding = NULL;
305
306 if ((ctx = BN_CTX_new_ex(rsa->libctx)) == NULL)
307 goto err;
308 BN_CTX_start(ctx);
309 f = BN_CTX_get(ctx);
310 ret = BN_CTX_get(ctx);
311 num = BN_num_bytes(rsa->n);
312 buf = OPENSSL_malloc(num);
313 if (ret == NULL || buf == NULL)
314 goto err;
315
316 switch (padding) {
317 case RSA_PKCS1_PADDING:
318 i = RSA_padding_add_PKCS1_type_1(buf, num, from, flen);
319 break;
320 case RSA_X931_PADDING:
321 i = RSA_padding_add_X931(buf, num, from, flen);
322 break;
323 case RSA_NO_PADDING:
324 i = RSA_padding_add_none(buf, num, from, flen);
325 break;
326 default:
327 ERR_raise(ERR_LIB_RSA, RSA_R_UNKNOWN_PADDING_TYPE);
328 goto err;
329 }
330 if (i <= 0)
331 goto err;
332
333 if (BN_bin2bn(buf, num, f) == NULL)
334 goto err;
335
336 if (BN_ucmp(f, rsa->n) >= 0) {
337 /* usually the padding functions would catch this */
338 ERR_raise(ERR_LIB_RSA, RSA_R_DATA_TOO_LARGE_FOR_MODULUS);
339 goto err;
340 }
341
342 if (rsa->flags & RSA_FLAG_CACHE_PUBLIC)
343 if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_n, rsa->lock,
344 rsa->n, ctx))
345 goto err;
346
347 if (!(rsa->flags & RSA_FLAG_NO_BLINDING)) {
348 blinding = rsa_get_blinding(rsa, ctx);
349 if (blinding == NULL) {
350 ERR_raise(ERR_LIB_RSA, ERR_R_INTERNAL_ERROR);
351 goto err;
352 }
353
354 if (!rsa_blinding_convert(blinding, f, ctx))
355 goto err;
356 }
357
358 if ((rsa->flags & RSA_FLAG_EXT_PKEY) ||
359 (rsa->version == RSA_ASN1_VERSION_MULTI) ||
360 ((rsa->p != NULL) &&
361 (rsa->q != NULL) &&
362 (rsa->dmp1 != NULL) && (rsa->dmq1 != NULL) && (rsa->iqmp != NULL))) {
363 if (!rsa->meth->rsa_mod_exp(ret, f, rsa, ctx))
364 goto err;
365 } else {
366 BIGNUM *d = BN_new();
367 if (d == NULL) {
368 ERR_raise(ERR_LIB_RSA, ERR_R_BN_LIB);
369 goto err;
370 }
371 if (rsa->d == NULL) {
372 ERR_raise(ERR_LIB_RSA, RSA_R_MISSING_PRIVATE_KEY);
373 BN_free(d);
374 goto err;
375 }
376 BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME);
377
378 if (!rsa->meth->bn_mod_exp(ret, f, d, rsa->n, ctx,
379 rsa->_method_mod_n)) {
380 BN_free(d);
381 goto err;
382 }
383 /* We MUST free d before any further use of rsa->d */
384 BN_free(d);
385 }
386
387 if (blinding)
388 if (!rsa_blinding_invert(blinding, ret, ctx))
389 goto err;
390
391 if (padding == RSA_X931_PADDING) {
392 if (!BN_sub(f, rsa->n, ret))
393 goto err;
394 if (BN_cmp(ret, f) > 0)
395 res = f;
396 else
397 res = ret;
398 } else {
399 res = ret;
400 }
401
402 /*
403 * BN_bn2binpad puts in leading 0 bytes if the number is less than
404 * the length of the modulus.
405 */
406 r = BN_bn2binpad(res, to, num);
407 err:
408 BN_CTX_end(ctx);
409 BN_CTX_free(ctx);
410 OPENSSL_clear_free(buf, num);
411 return r;
412}
413
414static int derive_kdk(int flen, const unsigned char *from, RSA *rsa,
415 unsigned char *buf, int num, unsigned char *kdk)
416{
417 int ret = 0;
418 HMAC_CTX *hmac = NULL;
419 EVP_MD *md = NULL;
420 unsigned int md_len = SHA256_DIGEST_LENGTH;
421 unsigned char d_hash[SHA256_DIGEST_LENGTH] = {0};
422 /*
423 * because we use d as a handle to rsa->d we need to keep it local and
424 * free before any further use of rsa->d
425 */
426 BIGNUM *d = BN_new();
427
428 if (d == NULL) {
429 ERR_raise(ERR_LIB_RSA, ERR_R_CRYPTO_LIB);
430 goto err;
431 }
432 if (rsa->d == NULL) {
433 ERR_raise(ERR_LIB_RSA, RSA_R_MISSING_PRIVATE_KEY);
434 BN_free(d);
435 goto err;
436 }
437 BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME);
438 if (BN_bn2binpad(d, buf, num) < 0) {
439 ERR_raise(ERR_LIB_RSA, ERR_R_INTERNAL_ERROR);
440 BN_free(d);
441 goto err;
442 }
443 BN_free(d);
444
445 /*
446 * we use hardcoded hash so that migrating between versions that use
447 * different hash doesn't provide a Bleichenbacher oracle:
448 * if the attacker can see that different versions return different
449 * messages for the same ciphertext, they'll know that the message is
450 * synthetically generated, which means that the padding check failed
451 */
452 md = EVP_MD_fetch(rsa->libctx, "sha256", NULL);
453 if (md == NULL) {
454 ERR_raise(ERR_LIB_RSA, ERR_R_FETCH_FAILED);
455 goto err;
456 }
457
458 if (EVP_Digest(buf, num, d_hash, NULL, md, NULL) <= 0) {
459 ERR_raise(ERR_LIB_RSA, ERR_R_INTERNAL_ERROR);
460 goto err;
461 }
462
463 hmac = HMAC_CTX_new();
464 if (hmac == NULL) {
465 ERR_raise(ERR_LIB_RSA, ERR_R_CRYPTO_LIB);
466 goto err;
467 }
468
469 if (HMAC_Init_ex(hmac, d_hash, sizeof(d_hash), md, NULL) <= 0) {
470 ERR_raise(ERR_LIB_RSA, ERR_R_INTERNAL_ERROR);
471 goto err;
472 }
473
474 if (flen < num) {
475 memset(buf, 0, num - flen);
476 if (HMAC_Update(hmac, buf, num - flen) <= 0) {
477 ERR_raise(ERR_LIB_RSA, ERR_R_INTERNAL_ERROR);
478 goto err;
479 }
480 }
481 if (HMAC_Update(hmac, from, flen) <= 0) {
482 ERR_raise(ERR_LIB_RSA, ERR_R_INTERNAL_ERROR);
483 goto err;
484 }
485
486 md_len = SHA256_DIGEST_LENGTH;
487 if (HMAC_Final(hmac, kdk, &md_len) <= 0) {
488 ERR_raise(ERR_LIB_RSA, ERR_R_INTERNAL_ERROR);
489 goto err;
490 }
491 ret = 1;
492
493 err:
494 HMAC_CTX_free(hmac);
495 EVP_MD_free(md);
496 return ret;
497}
498
499static int rsa_ossl_private_decrypt(int flen, const unsigned char *from,
500 unsigned char *to, RSA *rsa, int padding)
501{
502 BIGNUM *f, *ret;
503 int j, num = 0, r = -1;
504 unsigned char *buf = NULL;
505 unsigned char kdk[SHA256_DIGEST_LENGTH] = {0};
506 BN_CTX *ctx = NULL;
507 BN_BLINDING *blinding = NULL;
508
509 /*
510 * we need the value of the private exponent to perform implicit rejection
511 */
512 if ((rsa->flags & RSA_FLAG_EXT_PKEY) && (padding == RSA_PKCS1_PADDING))
513 padding = RSA_PKCS1_NO_IMPLICIT_REJECT_PADDING;
514
515 if ((ctx = BN_CTX_new_ex(rsa->libctx)) == NULL)
516 goto err;
517 BN_CTX_start(ctx);
518 f = BN_CTX_get(ctx);
519 ret = BN_CTX_get(ctx);
520 if (ret == NULL) {
521 ERR_raise(ERR_LIB_RSA, ERR_R_BN_LIB);
522 goto err;
523 }
524 num = BN_num_bytes(rsa->n);
525 buf = OPENSSL_malloc(num);
526 if (buf == NULL)
527 goto err;
528
529 /*
530 * This check was for equality but PGP does evil things and chops off the
531 * top '0' bytes
532 */
533 if (flen > num) {
534 ERR_raise(ERR_LIB_RSA, RSA_R_DATA_GREATER_THAN_MOD_LEN);
535 goto err;
536 }
537
538 if (flen < 1) {
539 ERR_raise(ERR_LIB_RSA, RSA_R_DATA_TOO_SMALL);
540 goto err;
541 }
542
543 /* make data into a big number */
544 if (BN_bin2bn(from, (int)flen, f) == NULL)
545 goto err;
546
547#ifdef FIPS_MODULE
548 /*
549 * See SP800-56Br2, section 7.1.2.1
550 * RSADP: 1 < f < (n – 1)
551 * (where f is the ciphertext).
552 */
553 if (padding == RSA_NO_PADDING) {
554 BIGNUM *nminus1 = BN_CTX_get(ctx);
555
556 if (BN_ucmp(f, BN_value_one()) <= 0) {
557 ERR_raise(ERR_LIB_RSA, RSA_R_DATA_TOO_SMALL);
558 goto err;
559 }
560 if (nminus1 == NULL
561 || BN_copy(nminus1, rsa->n) == NULL
562 || !BN_sub_word(nminus1, 1))
563 goto err;
564 if (BN_ucmp(f, nminus1) >= 0) {
565 ERR_raise(ERR_LIB_RSA, RSA_R_DATA_TOO_LARGE_FOR_MODULUS);
566 goto err;
567 }
568 } else
569#endif
570 {
571 if (BN_ucmp(f, rsa->n) >= 0) {
572 ERR_raise(ERR_LIB_RSA, RSA_R_DATA_TOO_LARGE_FOR_MODULUS);
573 goto err;
574 }
575 }
576 if (rsa->flags & RSA_FLAG_CACHE_PUBLIC)
577 if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_n, rsa->lock,
578 rsa->n, ctx))
579 goto err;
580
581 if (!(rsa->flags & RSA_FLAG_NO_BLINDING)) {
582 blinding = rsa_get_blinding(rsa, ctx);
583 if (blinding == NULL) {
584 ERR_raise(ERR_LIB_RSA, ERR_R_INTERNAL_ERROR);
585 goto err;
586 }
587
588 if (!rsa_blinding_convert(blinding, f, ctx))
589 goto err;
590 }
591
592 /* do the decrypt */
593 if ((rsa->flags & RSA_FLAG_EXT_PKEY) ||
594 (rsa->version == RSA_ASN1_VERSION_MULTI) ||
595 ((rsa->p != NULL) &&
596 (rsa->q != NULL) &&
597 (rsa->dmp1 != NULL) && (rsa->dmq1 != NULL) && (rsa->iqmp != NULL))) {
598 if (!rsa->meth->rsa_mod_exp(ret, f, rsa, ctx))
599 goto err;
600 } else {
601 BIGNUM *d = BN_new();
602 if (d == NULL) {
603 ERR_raise(ERR_LIB_RSA, ERR_R_BN_LIB);
604 goto err;
605 }
606 if (rsa->d == NULL) {
607 ERR_raise(ERR_LIB_RSA, RSA_R_MISSING_PRIVATE_KEY);
608 BN_free(d);
609 goto err;
610 }
611 BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME);
612 if (!rsa->meth->bn_mod_exp(ret, f, d, rsa->n, ctx,
613 rsa->_method_mod_n)) {
614 BN_free(d);
615 goto err;
616 }
617 /* We MUST free d before any further use of rsa->d */
618 BN_free(d);
619 }
620
621 if (blinding)
622 if (!rsa_blinding_invert(blinding, ret, ctx))
623 goto err;
624
625 /*
626 * derive the Key Derivation Key from private exponent and public
627 * ciphertext
628 */
629 if (padding == RSA_PKCS1_PADDING) {
630 if (derive_kdk(flen, from, rsa, buf, num, kdk) == 0)
631 goto err;
632 }
633
634 j = BN_bn2binpad(ret, buf, num);
635 if (j < 0)
636 goto err;
637
638 switch (padding) {
639 case RSA_PKCS1_NO_IMPLICIT_REJECT_PADDING:
640 r = RSA_padding_check_PKCS1_type_2(to, num, buf, j, num);
641 break;
642 case RSA_PKCS1_PADDING:
643 r = ossl_rsa_padding_check_PKCS1_type_2(rsa->libctx, to, num, buf, j, num, kdk);
644 break;
645 case RSA_PKCS1_OAEP_PADDING:
646 r = RSA_padding_check_PKCS1_OAEP(to, num, buf, j, num, NULL, 0);
647 break;
648 case RSA_NO_PADDING:
649 memcpy(to, buf, (r = j));
650 break;
651 default:
652 ERR_raise(ERR_LIB_RSA, RSA_R_UNKNOWN_PADDING_TYPE);
653 goto err;
654 }
655#ifndef FIPS_MODULE
656 /*
657 * This trick doesn't work in the FIPS provider because libcrypto manages
658 * the error stack. Instead we opt not to put an error on the stack at all
659 * in case of padding failure in the FIPS provider.
660 */
661 ERR_raise(ERR_LIB_RSA, RSA_R_PADDING_CHECK_FAILED);
662 err_clear_last_constant_time(1 & ~constant_time_msb(r));
663#endif
664
665 err:
666 BN_CTX_end(ctx);
667 BN_CTX_free(ctx);
668 OPENSSL_clear_free(buf, num);
669 return r;
670}
671
672/* signature verification */
673static int rsa_ossl_public_decrypt(int flen, const unsigned char *from,
674 unsigned char *to, RSA *rsa, int padding)
675{
676 BIGNUM *f, *ret;
677 int i, num = 0, r = -1;
678 unsigned char *buf = NULL;
679 BN_CTX *ctx = NULL;
680
681 if (BN_num_bits(rsa->n) > OPENSSL_RSA_MAX_MODULUS_BITS) {
682 ERR_raise(ERR_LIB_RSA, RSA_R_MODULUS_TOO_LARGE);
683 return -1;
684 }
685
686 if (BN_ucmp(rsa->n, rsa->e) <= 0) {
687 ERR_raise(ERR_LIB_RSA, RSA_R_BAD_E_VALUE);
688 return -1;
689 }
690
691 /* for large moduli, enforce exponent limit */
692 if (BN_num_bits(rsa->n) > OPENSSL_RSA_SMALL_MODULUS_BITS) {
693 if (BN_num_bits(rsa->e) > OPENSSL_RSA_MAX_PUBEXP_BITS) {
694 ERR_raise(ERR_LIB_RSA, RSA_R_BAD_E_VALUE);
695 return -1;
696 }
697 }
698
699 if ((ctx = BN_CTX_new_ex(rsa->libctx)) == NULL)
700 goto err;
701 BN_CTX_start(ctx);
702 f = BN_CTX_get(ctx);
703 ret = BN_CTX_get(ctx);
704 if (ret == NULL) {
705 ERR_raise(ERR_LIB_RSA, ERR_R_BN_LIB);
706 goto err;
707 }
708 num = BN_num_bytes(rsa->n);
709 buf = OPENSSL_malloc(num);
710 if (buf == NULL)
711 goto err;
712
713 /*
714 * This check was for equality but PGP does evil things and chops off the
715 * top '0' bytes
716 */
717 if (flen > num) {
718 ERR_raise(ERR_LIB_RSA, RSA_R_DATA_GREATER_THAN_MOD_LEN);
719 goto err;
720 }
721
722 if (BN_bin2bn(from, flen, f) == NULL)
723 goto err;
724
725 if (BN_ucmp(f, rsa->n) >= 0) {
726 ERR_raise(ERR_LIB_RSA, RSA_R_DATA_TOO_LARGE_FOR_MODULUS);
727 goto err;
728 }
729
730 if (rsa->flags & RSA_FLAG_CACHE_PUBLIC)
731 if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_n, rsa->lock,
732 rsa->n, ctx))
733 goto err;
734
735 if (!rsa->meth->bn_mod_exp(ret, f, rsa->e, rsa->n, ctx,
736 rsa->_method_mod_n))
737 goto err;
738
739 /* For X9.31: Assuming e is odd it does a 12 mod 16 test */
740 if ((padding == RSA_X931_PADDING) && ((bn_get_words(ret)[0] & 0xf) != 12))
741 if (!BN_sub(ret, rsa->n, ret))
742 goto err;
743
744 i = BN_bn2binpad(ret, buf, num);
745 if (i < 0)
746 goto err;
747
748 switch (padding) {
749 case RSA_PKCS1_PADDING:
750 r = RSA_padding_check_PKCS1_type_1(to, num, buf, i, num);
751 break;
752 case RSA_X931_PADDING:
753 r = RSA_padding_check_X931(to, num, buf, i, num);
754 break;
755 case RSA_NO_PADDING:
756 memcpy(to, buf, (r = i));
757 break;
758 default:
759 ERR_raise(ERR_LIB_RSA, RSA_R_UNKNOWN_PADDING_TYPE);
760 goto err;
761 }
762 if (r < 0)
763 ERR_raise(ERR_LIB_RSA, RSA_R_PADDING_CHECK_FAILED);
764
765 err:
766 BN_CTX_end(ctx);
767 BN_CTX_free(ctx);
768 OPENSSL_clear_free(buf, num);
769 return r;
770}
771
772static int rsa_ossl_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)
773{
774 BIGNUM *r1, *m1, *vrfy;
775 int ret = 0, smooth = 0;
776#ifndef FIPS_MODULE
777 BIGNUM *r2, *m[RSA_MAX_PRIME_NUM - 2];
778 int i, ex_primes = 0;
779 RSA_PRIME_INFO *pinfo;
780#endif
781
782 BN_CTX_start(ctx);
783
784 r1 = BN_CTX_get(ctx);
785#ifndef FIPS_MODULE
786 r2 = BN_CTX_get(ctx);
787#endif
788 m1 = BN_CTX_get(ctx);
789 vrfy = BN_CTX_get(ctx);
790 if (vrfy == NULL)
791 goto err;
792
793#ifndef FIPS_MODULE
794 if (rsa->version == RSA_ASN1_VERSION_MULTI
795 && ((ex_primes = sk_RSA_PRIME_INFO_num(rsa->prime_infos)) <= 0
796 || ex_primes > RSA_MAX_PRIME_NUM - 2))
797 goto err;
798#endif
799
800 if (rsa->flags & RSA_FLAG_CACHE_PRIVATE) {
801 BIGNUM *factor = BN_new();
802
803 if (factor == NULL)
804 goto err;
805
806 /*
807 * Make sure BN_mod_inverse in Montgomery initialization uses the
808 * BN_FLG_CONSTTIME flag
809 */
810 if (!(BN_with_flags(factor, rsa->p, BN_FLG_CONSTTIME),
811 BN_MONT_CTX_set_locked(&rsa->_method_mod_p, rsa->lock,
812 factor, ctx))
813 || !(BN_with_flags(factor, rsa->q, BN_FLG_CONSTTIME),
814 BN_MONT_CTX_set_locked(&rsa->_method_mod_q, rsa->lock,
815 factor, ctx))) {
816 BN_free(factor);
817 goto err;
818 }
819#ifndef FIPS_MODULE
820 for (i = 0; i < ex_primes; i++) {
821 pinfo = sk_RSA_PRIME_INFO_value(rsa->prime_infos, i);
822 BN_with_flags(factor, pinfo->r, BN_FLG_CONSTTIME);
823 if (!BN_MONT_CTX_set_locked(&pinfo->m, rsa->lock, factor, ctx)) {
824 BN_free(factor);
825 goto err;
826 }
827 }
828#endif
829 /*
830 * We MUST free |factor| before any further use of the prime factors
831 */
832 BN_free(factor);
833
834 smooth = (rsa->meth->bn_mod_exp == BN_mod_exp_mont)
835#ifndef FIPS_MODULE
836 && (ex_primes == 0)
837#endif
838 && (BN_num_bits(rsa->q) == BN_num_bits(rsa->p));
839 }
840
841 if (rsa->flags & RSA_FLAG_CACHE_PUBLIC)
842 if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_n, rsa->lock,
843 rsa->n, ctx))
844 goto err;
845
846 if (smooth) {
847 /*
848 * Conversion from Montgomery domain, a.k.a. Montgomery reduction,
849 * accepts values in [0-m*2^w) range. w is m's bit width rounded up
850 * to limb width. So that at the very least if |I| is fully reduced,
851 * i.e. less than p*q, we can count on from-to round to perform
852 * below modulo operations on |I|. Unlike BN_mod it's constant time.
853 */
854 if (/* m1 = I moq q */
855 !bn_from_mont_fixed_top(m1, I, rsa->_method_mod_q, ctx)
856 || !bn_to_mont_fixed_top(m1, m1, rsa->_method_mod_q, ctx)
857 /* r1 = I mod p */
858 || !bn_from_mont_fixed_top(r1, I, rsa->_method_mod_p, ctx)
859 || !bn_to_mont_fixed_top(r1, r1, rsa->_method_mod_p, ctx)
860 /*
861 * Use parallel exponentiations optimization if possible,
862 * otherwise fallback to two sequential exponentiations:
863 * m1 = m1^dmq1 mod q
864 * r1 = r1^dmp1 mod p
865 */
866 || !BN_mod_exp_mont_consttime_x2(m1, m1, rsa->dmq1, rsa->q,
867 rsa->_method_mod_q,
868 r1, r1, rsa->dmp1, rsa->p,
869 rsa->_method_mod_p,
870 ctx)
871 /* r1 = (r1 - m1) mod p */
872 /*
873 * bn_mod_sub_fixed_top is not regular modular subtraction,
874 * it can tolerate subtrahend to be larger than modulus, but
875 * not bit-wise wider. This makes up for uncommon q>p case,
876 * when |m1| can be larger than |rsa->p|.
877 */
878 || !bn_mod_sub_fixed_top(r1, r1, m1, rsa->p)
879
880 /* r1 = r1 * iqmp mod p */
881 || !bn_to_mont_fixed_top(r1, r1, rsa->_method_mod_p, ctx)
882 || !bn_mul_mont_fixed_top(r1, r1, rsa->iqmp, rsa->_method_mod_p,
883 ctx)
884 /* r0 = r1 * q + m1 */
885 || !bn_mul_fixed_top(r0, r1, rsa->q, ctx)
886 || !bn_mod_add_fixed_top(r0, r0, m1, rsa->n))
887 goto err;
888
889 goto tail;
890 }
891
892 /* compute I mod q */
893 {
894 BIGNUM *c = BN_new();
895 if (c == NULL)
896 goto err;
897 BN_with_flags(c, I, BN_FLG_CONSTTIME);
898
899 if (!BN_mod(r1, c, rsa->q, ctx)) {
900 BN_free(c);
901 goto err;
902 }
903
904 {
905 BIGNUM *dmq1 = BN_new();
906 if (dmq1 == NULL) {
907 BN_free(c);
908 goto err;
909 }
910 BN_with_flags(dmq1, rsa->dmq1, BN_FLG_CONSTTIME);
911
912 /* compute r1^dmq1 mod q */
913 if (!rsa->meth->bn_mod_exp(m1, r1, dmq1, rsa->q, ctx,
914 rsa->_method_mod_q)) {
915 BN_free(c);
916 BN_free(dmq1);
917 goto err;
918 }
919 /* We MUST free dmq1 before any further use of rsa->dmq1 */
920 BN_free(dmq1);
921 }
922
923 /* compute I mod p */
924 if (!BN_mod(r1, c, rsa->p, ctx)) {
925 BN_free(c);
926 goto err;
927 }
928 /* We MUST free c before any further use of I */
929 BN_free(c);
930 }
931
932 {
933 BIGNUM *dmp1 = BN_new();
934 if (dmp1 == NULL)
935 goto err;
936 BN_with_flags(dmp1, rsa->dmp1, BN_FLG_CONSTTIME);
937
938 /* compute r1^dmp1 mod p */
939 if (!rsa->meth->bn_mod_exp(r0, r1, dmp1, rsa->p, ctx,
940 rsa->_method_mod_p)) {
941 BN_free(dmp1);
942 goto err;
943 }
944 /* We MUST free dmp1 before any further use of rsa->dmp1 */
945 BN_free(dmp1);
946 }
947
948#ifndef FIPS_MODULE
949 if (ex_primes > 0) {
950 BIGNUM *di = BN_new(), *cc = BN_new();
951
952 if (cc == NULL || di == NULL) {
953 BN_free(cc);
954 BN_free(di);
955 goto err;
956 }
957
958 for (i = 0; i < ex_primes; i++) {
959 /* prepare m_i */
960 if ((m[i] = BN_CTX_get(ctx)) == NULL) {
961 BN_free(cc);
962 BN_free(di);
963 goto err;
964 }
965
966 pinfo = sk_RSA_PRIME_INFO_value(rsa->prime_infos, i);
967
968 /* prepare c and d_i */
969 BN_with_flags(cc, I, BN_FLG_CONSTTIME);
970 BN_with_flags(di, pinfo->d, BN_FLG_CONSTTIME);
971
972 if (!BN_mod(r1, cc, pinfo->r, ctx)) {
973 BN_free(cc);
974 BN_free(di);
975 goto err;
976 }
977 /* compute r1 ^ d_i mod r_i */
978 if (!rsa->meth->bn_mod_exp(m[i], r1, di, pinfo->r, ctx, pinfo->m)) {
979 BN_free(cc);
980 BN_free(di);
981 goto err;
982 }
983 }
984
985 BN_free(cc);
986 BN_free(di);
987 }
988#endif
989
990 if (!BN_sub(r0, r0, m1))
991 goto err;
992 /*
993 * This will help stop the size of r0 increasing, which does affect the
994 * multiply if it optimised for a power of 2 size
995 */
996 if (BN_is_negative(r0))
997 if (!BN_add(r0, r0, rsa->p))
998 goto err;
999
1000 if (!BN_mul(r1, r0, rsa->iqmp, ctx))
1001 goto err;
1002
1003 {
1004 BIGNUM *pr1 = BN_new();
1005 if (pr1 == NULL)
1006 goto err;
1007 BN_with_flags(pr1, r1, BN_FLG_CONSTTIME);
1008
1009 if (!BN_mod(r0, pr1, rsa->p, ctx)) {
1010 BN_free(pr1);
1011 goto err;
1012 }
1013 /* We MUST free pr1 before any further use of r1 */
1014 BN_free(pr1);
1015 }
1016
1017 /*
1018 * If p < q it is occasionally possible for the correction of adding 'p'
1019 * if r0 is negative above to leave the result still negative. This can
1020 * break the private key operations: the following second correction
1021 * should *always* correct this rare occurrence. This will *never* happen
1022 * with OpenSSL generated keys because they ensure p > q [steve]
1023 */
1024 if (BN_is_negative(r0))
1025 if (!BN_add(r0, r0, rsa->p))
1026 goto err;
1027 if (!BN_mul(r1, r0, rsa->q, ctx))
1028 goto err;
1029 if (!BN_add(r0, r1, m1))
1030 goto err;
1031
1032#ifndef FIPS_MODULE
1033 /* add m_i to m in multi-prime case */
1034 if (ex_primes > 0) {
1035 BIGNUM *pr2 = BN_new();
1036
1037 if (pr2 == NULL)
1038 goto err;
1039
1040 for (i = 0; i < ex_primes; i++) {
1041 pinfo = sk_RSA_PRIME_INFO_value(rsa->prime_infos, i);
1042 if (!BN_sub(r1, m[i], r0)) {
1043 BN_free(pr2);
1044 goto err;
1045 }
1046
1047 if (!BN_mul(r2, r1, pinfo->t, ctx)) {
1048 BN_free(pr2);
1049 goto err;
1050 }
1051
1052 BN_with_flags(pr2, r2, BN_FLG_CONSTTIME);
1053
1054 if (!BN_mod(r1, pr2, pinfo->r, ctx)) {
1055 BN_free(pr2);
1056 goto err;
1057 }
1058
1059 if (BN_is_negative(r1))
1060 if (!BN_add(r1, r1, pinfo->r)) {
1061 BN_free(pr2);
1062 goto err;
1063 }
1064 if (!BN_mul(r1, r1, pinfo->pp, ctx)) {
1065 BN_free(pr2);
1066 goto err;
1067 }
1068 if (!BN_add(r0, r0, r1)) {
1069 BN_free(pr2);
1070 goto err;
1071 }
1072 }
1073 BN_free(pr2);
1074 }
1075#endif
1076
1077 tail:
1078 if (rsa->e && rsa->n) {
1079 if (rsa->meth->bn_mod_exp == BN_mod_exp_mont) {
1080 if (!BN_mod_exp_mont(vrfy, r0, rsa->e, rsa->n, ctx,
1081 rsa->_method_mod_n))
1082 goto err;
1083 } else {
1084 bn_correct_top(r0);
1085 if (!rsa->meth->bn_mod_exp(vrfy, r0, rsa->e, rsa->n, ctx,
1086 rsa->_method_mod_n))
1087 goto err;
1088 }
1089 /*
1090 * If 'I' was greater than (or equal to) rsa->n, the operation will
1091 * be equivalent to using 'I mod n'. However, the result of the
1092 * verify will *always* be less than 'n' so we don't check for
1093 * absolute equality, just congruency.
1094 */
1095 if (!BN_sub(vrfy, vrfy, I))
1096 goto err;
1097 if (BN_is_zero(vrfy)) {
1098 bn_correct_top(r0);
1099 ret = 1;
1100 goto err; /* not actually error */
1101 }
1102 if (!BN_mod(vrfy, vrfy, rsa->n, ctx))
1103 goto err;
1104 if (BN_is_negative(vrfy))
1105 if (!BN_add(vrfy, vrfy, rsa->n))
1106 goto err;
1107 if (!BN_is_zero(vrfy)) {
1108 /*
1109 * 'I' and 'vrfy' aren't congruent mod n. Don't leak
1110 * miscalculated CRT output, just do a raw (slower) mod_exp and
1111 * return that instead.
1112 */
1113
1114 BIGNUM *d = BN_new();
1115 if (d == NULL)
1116 goto err;
1117 BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME);
1118
1119 if (!rsa->meth->bn_mod_exp(r0, I, d, rsa->n, ctx,
1120 rsa->_method_mod_n)) {
1121 BN_free(d);
1122 goto err;
1123 }
1124 /* We MUST free d before any further use of rsa->d */
1125 BN_free(d);
1126 }
1127 }
1128 /*
1129 * It's unfortunate that we have to bn_correct_top(r0). What hopefully
1130 * saves the day is that correction is highly unlike, and private key
1131 * operations are customarily performed on blinded message. Which means
1132 * that attacker won't observe correlation with chosen plaintext.
1133 * Secondly, remaining code would still handle it in same computational
1134 * time and even conceal memory access pattern around corrected top.
1135 */
1136 bn_correct_top(r0);
1137 ret = 1;
1138 err:
1139 BN_CTX_end(ctx);
1140 return ret;
1141}
1142
1143static int rsa_ossl_init(RSA *rsa)
1144{
1145 rsa->flags |= RSA_FLAG_CACHE_PUBLIC | RSA_FLAG_CACHE_PRIVATE;
1146 return 1;
1147}
1148
1149static int rsa_ossl_finish(RSA *rsa)
1150{
1151#ifndef FIPS_MODULE
1152 int i;
1153 RSA_PRIME_INFO *pinfo;
1154
1155 for (i = 0; i < sk_RSA_PRIME_INFO_num(rsa->prime_infos); i++) {
1156 pinfo = sk_RSA_PRIME_INFO_value(rsa->prime_infos, i);
1157 BN_MONT_CTX_free(pinfo->m);
1158 }
1159#endif
1160
1161 BN_MONT_CTX_free(rsa->_method_mod_n);
1162 BN_MONT_CTX_free(rsa->_method_mod_p);
1163 BN_MONT_CTX_free(rsa->_method_mod_q);
1164 return 1;
1165}
1166
1167#ifdef S390X_MOD_EXP
1168static int rsa_ossl_s390x_mod_exp(BIGNUM *r0, const BIGNUM *i, RSA *rsa,
1169 BN_CTX *ctx)
1170{
1171 if (rsa->version != RSA_ASN1_VERSION_MULTI) {
1172 if (s390x_crt(r0, i, rsa->p, rsa->q, rsa->dmp1, rsa->dmq1, rsa->iqmp) == 1)
1173 return 1;
1174 }
1175 return rsa_ossl_mod_exp(r0, i, rsa, ctx);
1176}
1177
1178#endif
Mirror of https://github.com/openssl/openssl.git