crypto/rsa/rsa_pmeth.c

   1 /*
   2  * Copyright 2006-2017 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the OpenSSL license (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include <stdio.h>
  11 #include "internal/cryptlib.h"
  12 #include <openssl/asn1t.h>
  13 #include <openssl/x509.h>
  14 #include <openssl/rsa.h>
  15 #include <openssl/bn.h>
  16 #include <openssl/evp.h>
  17 #include <openssl/x509v3.h>
  18 #include <openssl/cms.h>
  19 #include "internal/evp_int.h"
  20 #include "rsa_locl.h"
  21
  22 /* RSA pkey context structure */
  23
  24 typedef struct {
  25     /* Key gen parameters */
  26     int nbits;
  27     BIGNUM *pub_exp;
  28     /* Keygen callback info */
  29     int gentmp[2];
  30     /* RSA padding mode */
  31     int pad_mode;
  32     /* message digest */
  33     const EVP_MD *md;
  34     /* message digest for MGF1 */
  35     const EVP_MD *mgf1md;
  36     /* PSS salt length */
  37     int saltlen;
  38     /* Minimum salt length or -1 if no PSS parameter restriction */
  39     int min_saltlen;
  40     /* Temp buffer */
  41     unsigned char *tbuf;
  42     /* OAEP label */
  43     unsigned char *oaep_label;
  44     size_t oaep_labellen;
  45 } RSA_PKEY_CTX;
  46
  47 /* True if PSS parameters are restricted */
  48 #define rsa_pss_restricted(rctx) (rctx->min_saltlen != -1)
  49
  50 static int pkey_rsa_init(EVP_PKEY_CTX *ctx)
  51 {
  52     RSA_PKEY_CTX *rctx = OPENSSL_zalloc(sizeof(*rctx));
  53
  54     if (rctx == NULL)
  55         return 0;
  56     rctx->nbits = 1024;
  57     if (pkey_ctx_is_pss(ctx))
  58         rctx->pad_mode = RSA_PKCS1_PSS_PADDING;
  59     else
  60         rctx->pad_mode = RSA_PKCS1_PADDING;
  61     /* Maximum for sign, auto for verify */
  62     rctx->saltlen = RSA_PSS_SALTLEN_AUTO;
  63     rctx->min_saltlen = -1;
  64     ctx->data = rctx;
  65     ctx->keygen_info = rctx->gentmp;
  66     ctx->keygen_info_count = 2;
  67
  68     return 1;
  69 }
  70
  71 static int pkey_rsa_copy(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src)
  72 {
  73     RSA_PKEY_CTX *dctx, *sctx;
  74
  75     if (!pkey_rsa_init(dst))
  76         return 0;
  77     sctx = src->data;
  78     dctx = dst->data;
  79     dctx->nbits = sctx->nbits;
  80     if (sctx->pub_exp) {
  81         dctx->pub_exp = BN_dup(sctx->pub_exp);
  82         if (!dctx->pub_exp)
  83             return 0;
  84     }
  85     dctx->pad_mode = sctx->pad_mode;
  86     dctx->md = sctx->md;
  87     dctx->mgf1md = sctx->mgf1md;
  88     if (sctx->oaep_label) {
  89         OPENSSL_free(dctx->oaep_label);
  90         dctx->oaep_label = OPENSSL_memdup(sctx->oaep_label, sctx->oaep_labellen);
  91         if (!dctx->oaep_label)
  92             return 0;
  93         dctx->oaep_labellen = sctx->oaep_labellen;
  94     }
  95     return 1;
  96 }
  97
  98 static int setup_tbuf(RSA_PKEY_CTX *ctx, EVP_PKEY_CTX *pk)
  99 {
 100     if (ctx->tbuf != NULL)
 101         return 1;
 102     ctx->tbuf = OPENSSL_malloc(EVP_PKEY_size(pk->pkey));
 103     if (ctx->tbuf == NULL)
 104         return 0;
 105     return 1;
 106 }
 107
 108 static void pkey_rsa_cleanup(EVP_PKEY_CTX *ctx)
 109 {
 110     RSA_PKEY_CTX *rctx = ctx->data;
 111     if (rctx) {
 112         BN_free(rctx->pub_exp);
 113         OPENSSL_free(rctx->tbuf);
 114         OPENSSL_free(rctx->oaep_label);
 115         OPENSSL_free(rctx);
 116     }
 117 }
 118
 119 static int pkey_rsa_sign(EVP_PKEY_CTX *ctx, unsigned char *sig,
 120                          size_t *siglen, const unsigned char *tbs,
 121                          size_t tbslen)
 122 {
 123     int ret;
 124     RSA_PKEY_CTX *rctx = ctx->data;
 125     RSA *rsa = ctx->pkey->pkey.rsa;
 126
 127     if (rctx->md) {
 128         if (tbslen != (size_t)EVP_MD_size(rctx->md)) {
 129             RSAerr(RSA_F_PKEY_RSA_SIGN, RSA_R_INVALID_DIGEST_LENGTH);
 130             return -1;
 131         }
 132
 133         if (EVP_MD_type(rctx->md) == NID_mdc2) {
 134             unsigned int sltmp;
 135             if (rctx->pad_mode != RSA_PKCS1_PADDING)
 136                 return -1;
 137             ret = RSA_sign_ASN1_OCTET_STRING(0,
 138                                              tbs, tbslen, sig, &sltmp, rsa);
 139
 140             if (ret <= 0)
 141                 return ret;
 142             ret = sltmp;
 143         } else if (rctx->pad_mode == RSA_X931_PADDING) {
 144             if ((size_t)EVP_PKEY_size(ctx->pkey) < tbslen + 1) {
 145                 RSAerr(RSA_F_PKEY_RSA_SIGN, RSA_R_KEY_SIZE_TOO_SMALL);
 146                 return -1;
 147             }
 148             if (!setup_tbuf(rctx, ctx)) {
 149                 RSAerr(RSA_F_PKEY_RSA_SIGN, ERR_R_MALLOC_FAILURE);
 150                 return -1;
 151             }
 152             memcpy(rctx->tbuf, tbs, tbslen);
 153             rctx->tbuf[tbslen] = RSA_X931_hash_id(EVP_MD_type(rctx->md));
 154             ret = RSA_private_encrypt(tbslen + 1, rctx->tbuf,
 155                                       sig, rsa, RSA_X931_PADDING);
 156         } else if (rctx->pad_mode == RSA_PKCS1_PADDING) {
 157             unsigned int sltmp;
 158             ret = RSA_sign(EVP_MD_type(rctx->md),
 159                            tbs, tbslen, sig, &sltmp, rsa);
 160             if (ret <= 0)
 161                 return ret;
 162             ret = sltmp;
 163         } else if (rctx->pad_mode == RSA_PKCS1_PSS_PADDING) {
 164             if (!setup_tbuf(rctx, ctx))
 165                 return -1;
 166             if (!RSA_padding_add_PKCS1_PSS_mgf1(rsa,
 167                                                 rctx->tbuf, tbs,
 168                                                 rctx->md, rctx->mgf1md,
 169                                                 rctx->saltlen))
 170                 return -1;
 171             ret = RSA_private_encrypt(RSA_size(rsa), rctx->tbuf,
 172                                       sig, rsa, RSA_NO_PADDING);
 173         } else {
 174             return -1;
 175         }
 176     } else {
 177         ret = RSA_private_encrypt(tbslen, tbs, sig, ctx->pkey->pkey.rsa,
 178                                   rctx->pad_mode);
 179     }
 180     if (ret < 0)
 181         return ret;
 182     *siglen = ret;
 183     return 1;
 184 }
 185
 186 static int pkey_rsa_verifyrecover(EVP_PKEY_CTX *ctx,
 187                                   unsigned char *rout, size_t *routlen,
 188                                   const unsigned char *sig, size_t siglen)
 189 {
 190     int ret;
 191     RSA_PKEY_CTX *rctx = ctx->data;
 192
 193     if (rctx->md) {
 194         if (rctx->pad_mode == RSA_X931_PADDING) {
 195             if (!setup_tbuf(rctx, ctx))
 196                 return -1;
 197             ret = RSA_public_decrypt(siglen, sig,
 198                                      rctx->tbuf, ctx->pkey->pkey.rsa,
 199                                      RSA_X931_PADDING);
 200             if (ret < 1)
 201                 return 0;
 202             ret--;
 203             if (rctx->tbuf[ret] != RSA_X931_hash_id(EVP_MD_type(rctx->md))) {
 204                 RSAerr(RSA_F_PKEY_RSA_VERIFYRECOVER,
 205                        RSA_R_ALGORITHM_MISMATCH);
 206                 return 0;
 207             }
 208             if (ret != EVP_MD_size(rctx->md)) {
 209                 RSAerr(RSA_F_PKEY_RSA_VERIFYRECOVER,
 210                        RSA_R_INVALID_DIGEST_LENGTH);
 211                 return 0;
 212             }
 213             if (rout)
 214                 memcpy(rout, rctx->tbuf, ret);
 215         } else if (rctx->pad_mode == RSA_PKCS1_PADDING) {
 216             size_t sltmp;
 217             ret = int_rsa_verify(EVP_MD_type(rctx->md),
 218                                  NULL, 0, rout, &sltmp,
 219                                  sig, siglen, ctx->pkey->pkey.rsa);
 220             if (ret <= 0)
 221                 return 0;
 222             ret = sltmp;
 223         } else {
 224             return -1;
 225         }
 226     } else {
 227         ret = RSA_public_decrypt(siglen, sig, rout, ctx->pkey->pkey.rsa,
 228                                  rctx->pad_mode);
 229     }
 230     if (ret < 0)
 231         return ret;
 232     *routlen = ret;
 233     return 1;
 234 }
 235
 236 static int pkey_rsa_verify(EVP_PKEY_CTX *ctx,
 237                            const unsigned char *sig, size_t siglen,
 238                            const unsigned char *tbs, size_t tbslen)
 239 {
 240     RSA_PKEY_CTX *rctx = ctx->data;
 241     RSA *rsa = ctx->pkey->pkey.rsa;
 242     size_t rslen;
 243
 244     if (rctx->md) {
 245         if (rctx->pad_mode == RSA_PKCS1_PADDING)
 246             return RSA_verify(EVP_MD_type(rctx->md), tbs, tbslen,
 247                               sig, siglen, rsa);
 248         if (tbslen != (size_t)EVP_MD_size(rctx->md)) {
 249             RSAerr(RSA_F_PKEY_RSA_VERIFY, RSA_R_INVALID_DIGEST_LENGTH);
 250             return -1;
 251         }
 252         if (rctx->pad_mode == RSA_X931_PADDING) {
 253             if (pkey_rsa_verifyrecover(ctx, NULL, &rslen, sig, siglen) <= 0)
 254                 return 0;
 255         } else if (rctx->pad_mode == RSA_PKCS1_PSS_PADDING) {
 256             int ret;
 257             if (!setup_tbuf(rctx, ctx))
 258                 return -1;
 259             ret = RSA_public_decrypt(siglen, sig, rctx->tbuf,
 260                                      rsa, RSA_NO_PADDING);
 261             if (ret <= 0)
 262                 return 0;
 263             ret = RSA_verify_PKCS1_PSS_mgf1(rsa, tbs,
 264                                             rctx->md, rctx->mgf1md,
 265                                             rctx->tbuf, rctx->saltlen);
 266             if (ret <= 0)
 267                 return 0;
 268             return 1;
 269         } else {
 270             return -1;
 271         }
 272     } else {
 273         if (!setup_tbuf(rctx, ctx))
 274             return -1;
 275         rslen = RSA_public_decrypt(siglen, sig, rctx->tbuf,
 276                                    rsa, rctx->pad_mode);
 277         if (rslen == 0)
 278             return 0;
 279     }
 280
 281     if ((rslen != tbslen) || memcmp(tbs, rctx->tbuf, rslen))
 282         return 0;
 283
 284     return 1;
 285
 286 }
 287
 288 static int pkey_rsa_encrypt(EVP_PKEY_CTX *ctx,
 289                             unsigned char *out, size_t *outlen,
 290                             const unsigned char *in, size_t inlen)
 291 {
 292     int ret;
 293     RSA_PKEY_CTX *rctx = ctx->data;
 294
 295     if (rctx->pad_mode == RSA_PKCS1_OAEP_PADDING) {
 296         int klen = RSA_size(ctx->pkey->pkey.rsa);
 297         if (!setup_tbuf(rctx, ctx))
 298             return -1;
 299         if (!RSA_padding_add_PKCS1_OAEP_mgf1(rctx->tbuf, klen,
 300                                              in, inlen,
 301                                              rctx->oaep_label,
 302                                              rctx->oaep_labellen,
 303                                              rctx->md, rctx->mgf1md))
 304             return -1;
 305         ret = RSA_public_encrypt(klen, rctx->tbuf, out,
 306                                  ctx->pkey->pkey.rsa, RSA_NO_PADDING);
 307     } else {
 308         ret = RSA_public_encrypt(inlen, in, out, ctx->pkey->pkey.rsa,
 309                                  rctx->pad_mode);
 310     }
 311     if (ret < 0)
 312         return ret;
 313     *outlen = ret;
 314     return 1;
 315 }
 316
 317 static int pkey_rsa_decrypt(EVP_PKEY_CTX *ctx,
 318                             unsigned char *out, size_t *outlen,
 319                             const unsigned char *in, size_t inlen)
 320 {
 321     int ret;
 322     RSA_PKEY_CTX *rctx = ctx->data;
 323
 324     if (rctx->pad_mode == RSA_PKCS1_OAEP_PADDING) {
 325         if (!setup_tbuf(rctx, ctx))
 326             return -1;
 327         ret = RSA_private_decrypt(inlen, in, rctx->tbuf,
 328                                   ctx->pkey->pkey.rsa, RSA_NO_PADDING);
 329         if (ret <= 0)
 330             return ret;
 331         ret = RSA_padding_check_PKCS1_OAEP_mgf1(out, ret, rctx->tbuf,
 332                                                 ret, ret,
 333                                                 rctx->oaep_label,
 334                                                 rctx->oaep_labellen,
 335                                                 rctx->md, rctx->mgf1md);
 336     } else {
 337         ret = RSA_private_decrypt(inlen, in, out, ctx->pkey->pkey.rsa,
 338                                   rctx->pad_mode);
 339     }
 340     if (ret < 0)
 341         return ret;
 342     *outlen = ret;
 343     return 1;
 344 }
 345
 346 static int check_padding_md(const EVP_MD *md, int padding)
 347 {
 348     int mdnid;
 349
 350     if (!md)
 351         return 1;
 352
 353     mdnid = EVP_MD_type(md);
 354
 355     if (padding == RSA_NO_PADDING) {
 356         RSAerr(RSA_F_CHECK_PADDING_MD, RSA_R_INVALID_PADDING_MODE);
 357         return 0;
 358     }
 359
 360     if (padding == RSA_X931_PADDING) {
 361         if (RSA_X931_hash_id(mdnid) == -1) {
 362             RSAerr(RSA_F_CHECK_PADDING_MD, RSA_R_INVALID_X931_DIGEST);
 363             return 0;
 364         }
 365     } else {
 366         switch(mdnid) {
 367         /* List of all supported RSA digests */
 368         case NID_sha1:
 369         case NID_sha224:
 370         case NID_sha256:
 371         case NID_sha384:
 372         case NID_sha512:
 373         case NID_md5:
 374         case NID_md5_sha1:
 375         case NID_md2:
 376         case NID_md4:
 377         case NID_mdc2:
 378         case NID_ripemd160:
 379         case NID_sha3_224:
 380         case NID_sha3_256:
 381         case NID_sha3_384:
 382         case NID_sha3_512:
 383             return 1;
 384
 385         default:
 386             RSAerr(RSA_F_CHECK_PADDING_MD, RSA_R_INVALID_DIGEST);
 387             return 0;
 388
 389         }
 390     }
 391
 392     return 1;
 393 }
 394
 395 static int pkey_rsa_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2)
 396 {
 397     RSA_PKEY_CTX *rctx = ctx->data;
 398
 399     switch (type) {
 400     case EVP_PKEY_CTRL_RSA_PADDING:
 401         if ((p1 >= RSA_PKCS1_PADDING) && (p1 <= RSA_PKCS1_PSS_PADDING)) {
 402             if (!check_padding_md(rctx->md, p1))
 403                 return 0;
 404             if (p1 == RSA_PKCS1_PSS_PADDING) {
 405                 if (!(ctx->operation &
 406                       (EVP_PKEY_OP_SIGN | EVP_PKEY_OP_VERIFY)))
 407                     goto bad_pad;
 408                 if (!rctx->md)
 409                     rctx->md = EVP_sha1();
 410             } else if (pkey_ctx_is_pss(ctx)) {
 411                 goto bad_pad;
 412             }
 413             if (p1 == RSA_PKCS1_OAEP_PADDING) {
 414                 if (!(ctx->operation & EVP_PKEY_OP_TYPE_CRYPT))
 415                     goto bad_pad;
 416                 if (!rctx->md)
 417                     rctx->md = EVP_sha1();
 418             }
 419             rctx->pad_mode = p1;
 420             return 1;
 421         }
 422  bad_pad:
 423         RSAerr(RSA_F_PKEY_RSA_CTRL,
 424                RSA_R_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE);
 425         return -2;
 426
 427     case EVP_PKEY_CTRL_GET_RSA_PADDING:
 428         *(int *)p2 = rctx->pad_mode;
 429         return 1;
 430
 431     case EVP_PKEY_CTRL_RSA_PSS_SALTLEN:
 432     case EVP_PKEY_CTRL_GET_RSA_PSS_SALTLEN:
 433         if (rctx->pad_mode != RSA_PKCS1_PSS_PADDING) {
 434             RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_INVALID_PSS_SALTLEN);
 435             return -2;
 436         }
 437         if (type == EVP_PKEY_CTRL_GET_RSA_PSS_SALTLEN) {
 438             *(int *)p2 = rctx->saltlen;
 439         } else {
 440             if (p1 < RSA_PSS_SALTLEN_MAX)
 441                 return -2;
 442             if (rsa_pss_restricted(rctx)) {
 443                 if (p1 == RSA_PSS_SALTLEN_AUTO
 444                     && ctx->operation == EVP_PKEY_OP_VERIFY) {
 445                     RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_INVALID_PSS_SALTLEN);
 446                     return -2;
 447                 }
 448                 if ((p1 == RSA_PSS_SALTLEN_DIGEST
 449                      && rctx->min_saltlen > EVP_MD_size(rctx->md))
 450                     || (p1 >= 0 && p1 < rctx->min_saltlen)) {
 451                     RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_PSS_SALTLEN_TOO_SMALL);
 452                     return 0;
 453                 }
 454             }
 455             rctx->saltlen = p1;
 456         }
 457         return 1;
 458
 459     case EVP_PKEY_CTRL_RSA_KEYGEN_BITS:
 460         if (p1 < 512) {
 461             RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_KEY_SIZE_TOO_SMALL);
 462             return -2;
 463         }
 464         rctx->nbits = p1;
 465         return 1;
 466
 467     case EVP_PKEY_CTRL_RSA_KEYGEN_PUBEXP:
 468         if (p2 == NULL || !BN_is_odd((BIGNUM *)p2) || BN_is_one((BIGNUM *)p2)) {
 469             RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_BAD_E_VALUE);
 470             return -2;
 471         }
 472         BN_free(rctx->pub_exp);
 473         rctx->pub_exp = p2;
 474         return 1;
 475
 476     case EVP_PKEY_CTRL_RSA_OAEP_MD:
 477     case EVP_PKEY_CTRL_GET_RSA_OAEP_MD:
 478         if (rctx->pad_mode != RSA_PKCS1_OAEP_PADDING) {
 479             RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_INVALID_PADDING_MODE);
 480             return -2;
 481         }
 482         if (type == EVP_PKEY_CTRL_GET_RSA_OAEP_MD)
 483             *(const EVP_MD **)p2 = rctx->md;
 484         else
 485             rctx->md = p2;
 486         return 1;
 487
 488     case EVP_PKEY_CTRL_MD:
 489         if (!check_padding_md(p2, rctx->pad_mode))
 490             return 0;
 491         if (rsa_pss_restricted(rctx)) {
 492             if (EVP_MD_type(rctx->md) == EVP_MD_type(p2))
 493                 return 1;
 494             RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_DIGEST_NOT_ALLOWED);
 495             return 0;
 496         }
 497         rctx->md = p2;
 498         return 1;
 499
 500     case EVP_PKEY_CTRL_GET_MD:
 501         *(const EVP_MD **)p2 = rctx->md;
 502         return 1;
 503
 504     case EVP_PKEY_CTRL_RSA_MGF1_MD:
 505     case EVP_PKEY_CTRL_GET_RSA_MGF1_MD:
 506         if (rctx->pad_mode != RSA_PKCS1_PSS_PADDING
 507             && rctx->pad_mode != RSA_PKCS1_OAEP_PADDING) {
 508             RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_INVALID_MGF1_MD);
 509             return -2;
 510         }
 511         if (type == EVP_PKEY_CTRL_GET_RSA_MGF1_MD) {
 512             if (rctx->mgf1md)
 513                 *(const EVP_MD **)p2 = rctx->mgf1md;
 514             else
 515                 *(const EVP_MD **)p2 = rctx->md;
 516         } else {
 517             if (rsa_pss_restricted(rctx)) {
 518                 if (EVP_MD_type(rctx->mgf1md) == EVP_MD_type(p2))
 519                     return 1;
 520                 RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_MGF1_DIGEST_NOT_ALLOWED);
 521                 return 0;
 522             }
 523             rctx->mgf1md = p2;
 524         }
 525         return 1;
 526
 527     case EVP_PKEY_CTRL_RSA_OAEP_LABEL:
 528         if (rctx->pad_mode != RSA_PKCS1_OAEP_PADDING) {
 529             RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_INVALID_PADDING_MODE);
 530             return -2;
 531         }
 532         OPENSSL_free(rctx->oaep_label);
 533         if (p2 && p1 > 0) {
 534             rctx->oaep_label = p2;
 535             rctx->oaep_labellen = p1;
 536         } else {
 537             rctx->oaep_label = NULL;
 538             rctx->oaep_labellen = 0;
 539         }
 540         return 1;
 541
 542     case EVP_PKEY_CTRL_GET_RSA_OAEP_LABEL:
 543         if (rctx->pad_mode != RSA_PKCS1_OAEP_PADDING) {
 544             RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_INVALID_PADDING_MODE);
 545             return -2;
 546         }
 547         *(unsigned char **)p2 = rctx->oaep_label;
 548         return rctx->oaep_labellen;
 549
 550     case EVP_PKEY_CTRL_DIGESTINIT:
 551     case EVP_PKEY_CTRL_PKCS7_SIGN:
 552 #ifndef OPENSSL_NO_CMS
 553     case EVP_PKEY_CTRL_CMS_SIGN:
 554 #endif
 555     return 1;
 556
 557     case EVP_PKEY_CTRL_PKCS7_ENCRYPT:
 558     case EVP_PKEY_CTRL_PKCS7_DECRYPT:
 559 #ifndef OPENSSL_NO_CMS
 560     case EVP_PKEY_CTRL_CMS_DECRYPT:
 561     case EVP_PKEY_CTRL_CMS_ENCRYPT:
 562 #endif
 563     if (!pkey_ctx_is_pss(ctx))
 564         return 1;
 565     /* fall through */
 566     case EVP_PKEY_CTRL_PEER_KEY:
 567         RSAerr(RSA_F_PKEY_RSA_CTRL,
 568                RSA_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
 569         return -2;
 570
 571     default:
 572         return -2;
 573
 574     }
 575 }
 576
 577 static int pkey_rsa_ctrl_str(EVP_PKEY_CTX *ctx,
 578                              const char *type, const char *value)
 579 {
 580     if (value == NULL) {
 581         RSAerr(RSA_F_PKEY_RSA_CTRL_STR, RSA_R_VALUE_MISSING);
 582         return 0;
 583     }
 584     if (strcmp(type, "rsa_padding_mode") == 0) {
 585         int pm;
 586         if (strcmp(value, "pkcs1") == 0) {
 587             pm = RSA_PKCS1_PADDING;
 588         } else if (strcmp(value, "sslv23") == 0) {
 589             pm = RSA_SSLV23_PADDING;
 590         } else if (strcmp(value, "none") == 0) {
 591             pm = RSA_NO_PADDING;
 592         } else if (strcmp(value, "oeap") == 0) {
 593             pm = RSA_PKCS1_OAEP_PADDING;
 594         } else if (strcmp(value, "oaep") == 0) {
 595             pm = RSA_PKCS1_OAEP_PADDING;
 596         } else if (strcmp(value, "x931") == 0) {
 597             pm = RSA_X931_PADDING;
 598         } else if (strcmp(value, "pss") == 0) {
 599             pm = RSA_PKCS1_PSS_PADDING;
 600         } else {
 601             RSAerr(RSA_F_PKEY_RSA_CTRL_STR, RSA_R_UNKNOWN_PADDING_TYPE);
 602             return -2;
 603         }
 604         return EVP_PKEY_CTX_set_rsa_padding(ctx, pm);
 605     }
 606
 607     if (strcmp(type, "rsa_pss_saltlen") == 0) {
 608         int saltlen;
 609         if (!strcmp(value, "digest"))
 610             saltlen = RSA_PSS_SALTLEN_DIGEST;
 611         else if (!strcmp(value, "max"))
 612             saltlen = RSA_PSS_SALTLEN_MAX;
 613         else if (!strcmp(value, "auto"))
 614             saltlen = RSA_PSS_SALTLEN_AUTO;
 615         else
 616             saltlen = atoi(value);
 617         return EVP_PKEY_CTX_set_rsa_pss_saltlen(ctx, saltlen);
 618     }
 619
 620     if (strcmp(type, "rsa_keygen_bits") == 0) {
 621         int nbits;
 622         nbits = atoi(value);
 623         return EVP_PKEY_CTX_set_rsa_keygen_bits(ctx, nbits);
 624     }
 625
 626     if (strcmp(type, "rsa_keygen_pubexp") == 0) {
 627         int ret;
 628         BIGNUM *pubexp = NULL;
 629         if (!BN_asc2bn(&pubexp, value))
 630             return 0;
 631         ret = EVP_PKEY_CTX_set_rsa_keygen_pubexp(ctx, pubexp);
 632         if (ret <= 0)
 633             BN_free(pubexp);
 634         return ret;
 635     }
 636
 637     if (strcmp(type, "rsa_mgf1_md") == 0)
 638         return EVP_PKEY_CTX_md(ctx,
 639                                EVP_PKEY_OP_TYPE_SIG | EVP_PKEY_OP_TYPE_CRYPT,
 640                                EVP_PKEY_CTRL_RSA_MGF1_MD, value);
 641
 642     if (pkey_ctx_is_pss(ctx)) {
 643
 644         if (strcmp(type, "rsa_pss_keygen_mgf1_md") == 0)
 645             return EVP_PKEY_CTX_md(ctx, EVP_PKEY_OP_KEYGEN,
 646                                    EVP_PKEY_CTRL_RSA_MGF1_MD, value);
 647
 648         if (strcmp(type, "rsa_pss_keygen_md") == 0)
 649             return EVP_PKEY_CTX_md(ctx, EVP_PKEY_OP_KEYGEN,
 650                                    EVP_PKEY_CTRL_MD, value);
 651
 652         if (strcmp(type, "rsa_pss_keygen_saltlen") == 0) {
 653             int saltlen = atoi(value);
 654
 655             return EVP_PKEY_CTX_set_rsa_pss_keygen_saltlen(ctx, saltlen);
 656         }
 657     }
 658
 659     if (strcmp(type, "rsa_oaep_md") == 0)
 660         return EVP_PKEY_CTX_md(ctx, EVP_PKEY_OP_TYPE_CRYPT,
 661                                EVP_PKEY_CTRL_RSA_OAEP_MD, value);
 662
 663     if (strcmp(type, "rsa_oaep_label") == 0) {
 664         unsigned char *lab;
 665         long lablen;
 666         int ret;
 667         lab = OPENSSL_hexstr2buf(value, &lablen);
 668         if (!lab)
 669             return 0;
 670         ret = EVP_PKEY_CTX_set0_rsa_oaep_label(ctx, lab, lablen);
 671         if (ret <= 0)
 672             OPENSSL_free(lab);
 673         return ret;
 674     }
 675
 676     return -2;
 677 }
 678
 679 /* Set PSS parameters when generating a key, if necessary */
 680 static int rsa_set_pss_param(RSA *rsa, EVP_PKEY_CTX *ctx)
 681 {
 682     RSA_PKEY_CTX *rctx = ctx->data;
 683
 684     if (!pkey_ctx_is_pss(ctx))
 685         return 1;
 686     /* If all parameters are default values don't set pss */
 687     if (rctx->md == NULL && rctx->mgf1md == NULL && rctx->saltlen == -2)
 688         return 1;
 689     rsa->pss = rsa_pss_params_create(rctx->md, rctx->mgf1md,
 690                                      rctx->saltlen == -2 ? 0 : rctx->saltlen);
 691     if (rsa->pss == NULL)
 692         return 0;
 693     return 1;
 694 }
 695
 696 static int pkey_rsa_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)
 697 {
 698     RSA *rsa = NULL;
 699     RSA_PKEY_CTX *rctx = ctx->data;
 700     BN_GENCB *pcb;
 701     int ret;
 702
 703     if (rctx->pub_exp == NULL) {
 704         rctx->pub_exp = BN_new();
 705         if (rctx->pub_exp == NULL || !BN_set_word(rctx->pub_exp, RSA_F4))
 706             return 0;
 707     }
 708     rsa = RSA_new();
 709     if (rsa == NULL)
 710         return 0;
 711     if (ctx->pkey_gencb) {
 712         pcb = BN_GENCB_new();
 713         if (pcb == NULL) {
 714             RSA_free(rsa);
 715             return 0;
 716         }
 717         evp_pkey_set_cb_translate(pcb, ctx);
 718     } else {
 719         pcb = NULL;
 720     }
 721     ret = RSA_generate_key_ex(rsa, rctx->nbits, rctx->pub_exp, pcb);
 722     BN_GENCB_free(pcb);
 723     if (ret > 0 && !rsa_set_pss_param(rsa, ctx)) {
 724         RSA_free(rsa);
 725         return 0;
 726     }
 727     if (ret > 0)
 728         EVP_PKEY_assign(pkey, ctx->pmeth->pkey_id, rsa);
 729     else
 730         RSA_free(rsa);
 731     return ret;
 732 }
 733
 734 const EVP_PKEY_METHOD rsa_pkey_meth = {
 735     EVP_PKEY_RSA,
 736     EVP_PKEY_FLAG_AUTOARGLEN,
 737     pkey_rsa_init,
 738     pkey_rsa_copy,
 739     pkey_rsa_cleanup,
 740
 741     0, 0,
 742
 743     0,
 744     pkey_rsa_keygen,
 745
 746     0,
 747     pkey_rsa_sign,
 748
 749     0,
 750     pkey_rsa_verify,
 751
 752     0,
 753     pkey_rsa_verifyrecover,
 754
 755     0, 0, 0, 0,
 756
 757     0,
 758     pkey_rsa_encrypt,
 759
 760     0,
 761     pkey_rsa_decrypt,
 762
 763     0, 0,
 764
 765     pkey_rsa_ctrl,
 766     pkey_rsa_ctrl_str
 767 };
 768
 769 /*
 770  * Called for PSS sign or verify initialisation: checks PSS parameter
 771  * sanity and sets any restrictions on key usage.
 772  */
 773
 774 static int pkey_pss_init(EVP_PKEY_CTX *ctx)
 775 {
 776     RSA *rsa;
 777     RSA_PKEY_CTX *rctx = ctx->data;
 778     const EVP_MD *md;
 779     const EVP_MD *mgf1md;
 780     int min_saltlen, max_saltlen;
 781
 782     /* Should never happen */
 783     if (!pkey_ctx_is_pss(ctx))
 784         return 0;
 785     rsa = ctx->pkey->pkey.rsa;
 786     /* If no restrictions just return */
 787     if (rsa->pss == NULL)
 788         return 1;
 789     /* Get and check parameters */
 790     if (!rsa_pss_get_param(rsa->pss, &md, &mgf1md, &min_saltlen))
 791         return 0;
 792
 793     /* See if minimum salt length exceeds maximum possible */
 794     max_saltlen = RSA_size(rsa) - EVP_MD_size(md);
 795     if ((RSA_bits(rsa) & 0x7) == 1)
 796         max_saltlen--;
 797     if (min_saltlen > max_saltlen) {
 798         RSAerr(RSA_F_PKEY_PSS_INIT, RSA_R_INVALID_SALT_LENGTH);
 799         return 0;
 800     }
 801
 802     rctx->min_saltlen = min_saltlen;
 803
 804     /*
 805      * Set PSS restrictions as defaults: we can then block any attempt to
 806      * use invalid values in pkey_rsa_ctrl
 807      */
 808
 809     rctx->md = md;
 810     rctx->mgf1md = mgf1md;
 811     rctx->saltlen = min_saltlen;
 812
 813     return 1;
 814 }
 815
 816 const EVP_PKEY_METHOD rsa_pss_pkey_meth = {
 817     EVP_PKEY_RSA_PSS,
 818     EVP_PKEY_FLAG_AUTOARGLEN,
 819     pkey_rsa_init,
 820     pkey_rsa_copy,
 821     pkey_rsa_cleanup,
 822
 823     0, 0,
 824
 825     0,
 826     pkey_rsa_keygen,
 827
 828     pkey_pss_init,
 829     pkey_rsa_sign,
 830
 831     pkey_pss_init,
 832     pkey_rsa_verify,
 833
 834     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
 835
 836     pkey_rsa_ctrl,
 837     pkey_rsa_ctrl_str
 838 };