crypto/cms/cms_rsa.c

   1 /*
   2  * Copyright 2006-2022 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include <assert.h>
  11 #include <openssl/cms.h>
  12 #include <openssl/err.h>
  13 #include <openssl/core_names.h>
  14 #include "crypto/asn1.h"
  15 #include "crypto/rsa.h"
  16 #include "cms_local.h"
  17
  18 static RSA_OAEP_PARAMS *rsa_oaep_decode(const X509_ALGOR *alg)
  19 {
  20     RSA_OAEP_PARAMS *oaep;
  21
  22     oaep = ASN1_TYPE_unpack_sequence(ASN1_ITEM_rptr(RSA_OAEP_PARAMS),
  23                                      alg->parameter);
  24
  25     if (oaep == NULL)
  26         return NULL;
  27
  28     if (oaep->maskGenFunc != NULL) {
  29         oaep->maskHash = ossl_x509_algor_mgf1_decode(oaep->maskGenFunc);
  30         if (oaep->maskHash == NULL) {
  31             RSA_OAEP_PARAMS_free(oaep);
  32             return NULL;
  33         }
  34     }
  35     return oaep;
  36 }
  37
  38 static int rsa_cms_decrypt(CMS_RecipientInfo *ri)
  39 {
  40     EVP_PKEY_CTX *pkctx;
  41     X509_ALGOR *cmsalg;
  42     int nid;
  43     int rv = -1;
  44     unsigned char *label = NULL;
  45     int labellen = 0;
  46     const EVP_MD *mgf1md = NULL, *md = NULL;
  47     RSA_OAEP_PARAMS *oaep;
  48
  49     pkctx = CMS_RecipientInfo_get0_pkey_ctx(ri);
  50     if (pkctx == NULL)
  51         return 0;
  52     if (!CMS_RecipientInfo_ktri_get0_algs(ri, NULL, NULL, &cmsalg))
  53         return -1;
  54     nid = OBJ_obj2nid(cmsalg->algorithm);
  55     if (nid == NID_rsaEncryption)
  56         return 1;
  57     if (nid != NID_rsaesOaep) {
  58         ERR_raise(ERR_LIB_CMS, CMS_R_UNSUPPORTED_ENCRYPTION_TYPE);
  59         return -1;
  60     }
  61     /* Decode OAEP parameters */
  62     oaep = rsa_oaep_decode(cmsalg);
  63
  64     if (oaep == NULL) {
  65         ERR_raise(ERR_LIB_CMS, CMS_R_INVALID_OAEP_PARAMETERS);
  66         goto err;
  67     }
  68
  69     mgf1md = ossl_x509_algor_get_md(oaep->maskHash);
  70     if (mgf1md == NULL)
  71         goto err;
  72     md = ossl_x509_algor_get_md(oaep->hashFunc);
  73     if (md == NULL)
  74         goto err;
  75
  76     if (oaep->pSourceFunc != NULL) {
  77         X509_ALGOR *plab = oaep->pSourceFunc;
  78
  79         if (OBJ_obj2nid(plab->algorithm) != NID_pSpecified) {
  80             ERR_raise(ERR_LIB_CMS, CMS_R_UNSUPPORTED_LABEL_SOURCE);
  81             goto err;
  82         }
  83         if (plab->parameter->type != V_ASN1_OCTET_STRING) {
  84             ERR_raise(ERR_LIB_CMS, CMS_R_INVALID_LABEL);
  85             goto err;
  86         }
  87
  88         label = plab->parameter->value.octet_string->data;
  89         /* Stop label being freed when OAEP parameters are freed */
  90         plab->parameter->value.octet_string->data = NULL;
  91         labellen = plab->parameter->value.octet_string->length;
  92     }
  93
  94     if (EVP_PKEY_CTX_set_rsa_padding(pkctx, RSA_PKCS1_OAEP_PADDING) <= 0)
  95         goto err;
  96     if (EVP_PKEY_CTX_set_rsa_oaep_md(pkctx, md) <= 0)
  97         goto err;
  98     if (EVP_PKEY_CTX_set_rsa_mgf1_md(pkctx, mgf1md) <= 0)
  99         goto err;
 100     if (label != NULL
 101             && EVP_PKEY_CTX_set0_rsa_oaep_label(pkctx, label, labellen) <= 0)
 102         goto err;
 103     /* Carry on */
 104     rv = 1;
 105
 106  err:
 107     RSA_OAEP_PARAMS_free(oaep);
 108     return rv;
 109 }
 110
 111 static int rsa_cms_encrypt(CMS_RecipientInfo *ri)
 112 {
 113     const EVP_MD *md, *mgf1md;
 114     RSA_OAEP_PARAMS *oaep = NULL;
 115     ASN1_STRING *os = NULL;
 116     X509_ALGOR *alg;
 117     EVP_PKEY_CTX *pkctx = CMS_RecipientInfo_get0_pkey_ctx(ri);
 118     int pad_mode = RSA_PKCS1_PADDING, rv = 0, labellen;
 119     unsigned char *label;
 120
 121     if (CMS_RecipientInfo_ktri_get0_algs(ri, NULL, NULL, &alg) <= 0)
 122         return 0;
 123     if (pkctx != NULL) {
 124         if (EVP_PKEY_CTX_get_rsa_padding(pkctx, &pad_mode) <= 0)
 125             return 0;
 126     }
 127     if (pad_mode == RSA_PKCS1_PADDING)
 128         return X509_ALGOR_set0(alg, OBJ_nid2obj(NID_rsaEncryption),
 129                                V_ASN1_NULL, NULL);
 130
 131     /* Not supported */
 132     if (pad_mode != RSA_PKCS1_OAEP_PADDING)
 133         return 0;
 134     if (EVP_PKEY_CTX_get_rsa_oaep_md(pkctx, &md) <= 0)
 135         goto err;
 136     if (EVP_PKEY_CTX_get_rsa_mgf1_md(pkctx, &mgf1md) <= 0)
 137         goto err;
 138     labellen = EVP_PKEY_CTX_get0_rsa_oaep_label(pkctx, &label);
 139     if (labellen < 0)
 140         goto err;
 141     oaep = RSA_OAEP_PARAMS_new();
 142     if (oaep == NULL)
 143         goto err;
 144     if (!ossl_x509_algor_new_from_md(&oaep->hashFunc, md))
 145         goto err;
 146     if (!ossl_x509_algor_md_to_mgf1(&oaep->maskGenFunc, mgf1md))
 147         goto err;
 148     if (labellen > 0) {
 149         ASN1_OCTET_STRING *los = ASN1_OCTET_STRING_new();
 150
 151         if (los == NULL)
 152             goto err;
 153         if (!ASN1_OCTET_STRING_set(los, label, labellen)) {
 154             ASN1_OCTET_STRING_free(los);
 155             goto err;
 156         }
 157         oaep->pSourceFunc = ossl_X509_ALGOR_from_nid(NID_pSpecified,
 158                                                      V_ASN1_OCTET_STRING, los);
 159         if (oaep->pSourceFunc == NULL)
 160             goto err;
 161     }
 162     /* create string with pss parameter encoding. */
 163     if (!ASN1_item_pack(oaep, ASN1_ITEM_rptr(RSA_OAEP_PARAMS), &os))
 164         goto err;
 165     if (!X509_ALGOR_set0(alg, OBJ_nid2obj(NID_rsaesOaep), V_ASN1_SEQUENCE, os))
 166         goto err;
 167     os = NULL;
 168     rv = 1;
 169  err:
 170     RSA_OAEP_PARAMS_free(oaep);
 171     ASN1_STRING_free(os);
 172     return rv;
 173 }
 174
 175 int ossl_cms_rsa_envelope(CMS_RecipientInfo *ri, int decrypt)
 176 {
 177     assert(decrypt == 0 || decrypt == 1);
 178
 179     if (decrypt == 1)
 180         return rsa_cms_decrypt(ri);
 181
 182     if (decrypt == 0)
 183         return rsa_cms_encrypt(ri);
 184
 185     ERR_raise(ERR_LIB_CMS, CMS_R_NOT_SUPPORTED_FOR_THIS_KEY_TYPE);
 186     return 0;
 187 }
 188
 189 static int rsa_cms_sign(CMS_SignerInfo *si)
 190 {
 191     int pad_mode = RSA_PKCS1_PADDING;
 192     X509_ALGOR *alg;
 193     EVP_PKEY_CTX *pkctx = CMS_SignerInfo_get0_pkey_ctx(si);
 194     unsigned char aid[128];
 195     const unsigned char *pp = aid;
 196     size_t aid_len = 0;
 197     OSSL_PARAM params[2];
 198
 199     CMS_SignerInfo_get0_algs(si, NULL, NULL, NULL, &alg);
 200     if (pkctx != NULL) {
 201         if (EVP_PKEY_CTX_get_rsa_padding(pkctx, &pad_mode) <= 0)
 202             return 0;
 203     }
 204     if (pad_mode == RSA_PKCS1_PADDING)
 205         return X509_ALGOR_set0(alg, OBJ_nid2obj(NID_rsaEncryption),
 206                                V_ASN1_NULL, NULL);
 207
 208     /* We don't support it */
 209     if (pad_mode != RSA_PKCS1_PSS_PADDING)
 210         return 0;
 211
 212     params[0] = OSSL_PARAM_construct_octet_string(
 213         OSSL_SIGNATURE_PARAM_ALGORITHM_ID, aid, sizeof(aid));
 214     params[1] = OSSL_PARAM_construct_end();
 215
 216     if (EVP_PKEY_CTX_get_params(pkctx, params) <= 0)
 217         return 0;
 218     if ((aid_len = params[0].return_size) == 0)
 219         return 0;
 220     if (d2i_X509_ALGOR(&alg, &pp, aid_len) == NULL)
 221         return 0;
 222     return 1;
 223 }
 224
 225 static int rsa_cms_verify(CMS_SignerInfo *si)
 226 {
 227     int nid, nid2;
 228     X509_ALGOR *alg;
 229     EVP_PKEY_CTX *pkctx = CMS_SignerInfo_get0_pkey_ctx(si);
 230     EVP_PKEY *pkey = EVP_PKEY_CTX_get0_pkey(pkctx);
 231
 232     CMS_SignerInfo_get0_algs(si, NULL, NULL, NULL, &alg);
 233     nid = OBJ_obj2nid(alg->algorithm);
 234     if (nid == EVP_PKEY_RSA_PSS)
 235         return ossl_rsa_pss_to_ctx(NULL, pkctx, alg, NULL) > 0;
 236     /* Only PSS allowed for PSS keys */
 237     if (EVP_PKEY_is_a(pkey, "RSA-PSS")) {
 238         ERR_raise(ERR_LIB_RSA, RSA_R_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE);
 239         return 0;
 240     }
 241     if (nid == NID_rsaEncryption)
 242         return 1;
 243     /* Workaround for some implementation that use a signature OID */
 244     if (OBJ_find_sigid_algs(nid, NULL, &nid2)) {
 245         if (nid2 == NID_rsaEncryption)
 246             return 1;
 247     }
 248     return 0;
 249 }
 250
 251 int ossl_cms_rsa_sign(CMS_SignerInfo *si, int verify)
 252 {
 253     assert(verify == 0 || verify == 1);
 254
 255     if (verify == 1)
 256         return rsa_cms_verify(si);
 257
 258     if (verify == 0)
 259         return rsa_cms_sign(si);
 260
 261     ERR_raise(ERR_LIB_CMS, CMS_R_NOT_SUPPORTED_FOR_THIS_KEY_TYPE);
 262     return 0;
 263 }