lib/rsa/rsa-sign.c

   1 /*
   2  * Copyright (c) 2013, Google Inc.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License as
   6  * published by the Free Software Foundation; either version 2 of
   7  * the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, write to the Free Software
  16  * Foundation, Inc., 59 Temple Place, Suite 330, Boston,
  17  * MA 02111-1307 USA
  18  */
  19
  20 #include "mkimage.h"
  21 #include <stdio.h>
  22 #include <string.h>
  23 #include <image.h>
  24 #include <time.h>
  25 #include <openssl/rsa.h>
  26 #include <openssl/pem.h>
  27 #include <openssl/err.h>
  28 #include <openssl/ssl.h>
  29 #include <openssl/evp.h>
  30
  31 #if OPENSSL_VERSION_NUMBER >= 0x10000000L
  32 #define HAVE_ERR_REMOVE_THREAD_STATE
  33 #endif
  34
  35 static int rsa_err(const char *msg)
  36 {
  37         unsigned long sslErr = ERR_get_error();
  38
  39         fprintf(stderr, "%s", msg);
  40         fprintf(stderr, ": %s\n",
  41                 ERR_error_string(sslErr, 0));
  42
  43         return -1;
  44 }
  45
  46 /**
  47  * rsa_get_pub_key() - read a public key from a .crt file
  48  *
  49  * @keydir:     Directory containins the key
  50  * @name        Name of key file (will have a .crt extension)
  51  * @rsap        Returns RSA object, or NULL on failure
  52  * @return 0 if ok, -ve on error (in which case *rsap will be set to NULL)
  53  */
  54 static int rsa_get_pub_key(const char *keydir, const char *name, RSA **rsap)
  55 {
  56         char path[1024];
  57         EVP_PKEY *key;
  58         X509 *cert;
  59         RSA *rsa;
  60         FILE *f;
  61         int ret;
  62
  63         *rsap = NULL;
  64         snprintf(path, sizeof(path), "%s/%s.crt", keydir, name);
  65         f = fopen(path, "r");
  66         if (!f) {
  67                 fprintf(stderr, "Couldn't open RSA certificate: '%s': %s\n",
  68                         path, strerror(errno));
  69                 return -EACCES;
  70         }
  71
  72         /* Read the certificate */
  73         cert = NULL;
  74         if (!PEM_read_X509(f, &cert, NULL, NULL)) {
  75                 rsa_err("Couldn't read certificate");
  76                 ret = -EINVAL;
  77                 goto err_cert;
  78         }
  79
  80         /* Get the public key from the certificate. */
  81         key = X509_get_pubkey(cert);
  82         if (!key) {
  83                 rsa_err("Couldn't read public key\n");
  84                 ret = -EINVAL;
  85                 goto err_pubkey;
  86         }
  87
  88         /* Convert to a RSA_style key. */
  89         rsa = EVP_PKEY_get1_RSA(key);
  90         if (!rsa) {
  91                 rsa_err("Couldn't convert to a RSA style key");
  92                 goto err_rsa;
  93         }
  94         fclose(f);
  95         EVP_PKEY_free(key);
  96         X509_free(cert);
  97         *rsap = rsa;
  98
  99         return 0;
 100
 101 err_rsa:
 102         EVP_PKEY_free(key);
 103 err_pubkey:
 104         X509_free(cert);
 105 err_cert:
 106         fclose(f);
 107         return ret;
 108 }
 109
 110 /**
 111  * rsa_get_priv_key() - read a private key from a .key file
 112  *
 113  * @keydir:     Directory containins the key
 114  * @name        Name of key file (will have a .key extension)
 115  * @rsap        Returns RSA object, or NULL on failure
 116  * @return 0 if ok, -ve on error (in which case *rsap will be set to NULL)
 117  */
 118 static int rsa_get_priv_key(const char *keydir, const char *name, RSA **rsap)
 119 {
 120         char path[1024];
 121         RSA *rsa;
 122         FILE *f;
 123
 124         *rsap = NULL;
 125         snprintf(path, sizeof(path), "%s/%s.key", keydir, name);
 126         f = fopen(path, "r");
 127         if (!f) {
 128                 fprintf(stderr, "Couldn't open RSA private key: '%s': %s\n",
 129                         path, strerror(errno));
 130                 return -ENOENT;
 131         }
 132
 133         rsa = PEM_read_RSAPrivateKey(f, 0, NULL, path);
 134         if (!rsa) {
 135                 rsa_err("Failure reading private key");
 136                 fclose(f);
 137                 return -EPROTO;
 138         }
 139         fclose(f);
 140         *rsap = rsa;
 141
 142         return 0;
 143 }
 144
 145 static int rsa_init(void)
 146 {
 147         int ret;
 148
 149         ret = SSL_library_init();
 150         if (!ret) {
 151                 fprintf(stderr, "Failure to init SSL library\n");
 152                 return -1;
 153         }
 154         SSL_load_error_strings();
 155
 156         OpenSSL_add_all_algorithms();
 157         OpenSSL_add_all_digests();
 158         OpenSSL_add_all_ciphers();
 159
 160         return 0;
 161 }
 162
 163 static void rsa_remove(void)
 164 {
 165         CRYPTO_cleanup_all_ex_data();
 166         ERR_free_strings();
 167 #ifdef HAVE_ERR_REMOVE_THREAD_STATE
 168         ERR_remove_thread_state(NULL);
 169 #else
 170         ERR_remove_state(0);
 171 #endif
 172         EVP_cleanup();
 173 }
 174
 175 static int rsa_sign_with_key(RSA *rsa, const struct image_region region[],
 176                 int region_count, uint8_t **sigp, uint *sig_size)
 177 {
 178         EVP_PKEY *key;
 179         EVP_MD_CTX *context;
 180         int size, ret = 0;
 181         uint8_t *sig;
 182         int i;
 183
 184         key = EVP_PKEY_new();
 185         if (!key)
 186                 return rsa_err("EVP_PKEY object creation failed");
 187
 188         if (!EVP_PKEY_set1_RSA(key, rsa)) {
 189                 ret = rsa_err("EVP key setup failed");
 190                 goto err_set;
 191         }
 192
 193         size = EVP_PKEY_size(key);
 194         sig = malloc(size);
 195         if (!sig) {
 196                 fprintf(stderr, "Out of memory for signature (%d bytes)\n",
 197                         size);
 198                 ret = -ENOMEM;
 199                 goto err_alloc;
 200         }
 201
 202         context = EVP_MD_CTX_create();
 203         if (!context) {
 204                 ret = rsa_err("EVP context creation failed");
 205                 goto err_create;
 206         }
 207         EVP_MD_CTX_init(context);
 208         if (!EVP_SignInit(context, EVP_sha1())) {
 209                 ret = rsa_err("Signer setup failed");
 210                 goto err_sign;
 211         }
 212
 213         for (i = 0; i < region_count; i++) {
 214                 if (!EVP_SignUpdate(context, region[i].data, region[i].size)) {
 215                         ret = rsa_err("Signing data failed");
 216                         goto err_sign;
 217                 }
 218         }
 219
 220         if (!EVP_SignFinal(context, sig, sig_size, key)) {
 221                 ret = rsa_err("Could not obtain signature");
 222                 goto err_sign;
 223         }
 224         EVP_MD_CTX_cleanup(context);
 225         EVP_MD_CTX_destroy(context);
 226         EVP_PKEY_free(key);
 227
 228         debug("Got signature: %d bytes, expected %d\n", *sig_size, size);
 229         *sigp = sig;
 230         *sig_size = size;
 231
 232         return 0;
 233
 234 err_sign:
 235         EVP_MD_CTX_destroy(context);
 236 err_create:
 237         free(sig);
 238 err_alloc:
 239 err_set:
 240         EVP_PKEY_free(key);
 241         return ret;
 242 }
 243
 244 int rsa_sign(struct image_sign_info *info,
 245              const struct image_region region[], int region_count,
 246              uint8_t **sigp, uint *sig_len)
 247 {
 248         RSA *rsa;
 249         int ret;
 250
 251         ret = rsa_init();
 252         if (ret)
 253                 return ret;
 254
 255         ret = rsa_get_priv_key(info->keydir, info->keyname, &rsa);
 256         if (ret)
 257                 goto err_priv;
 258         ret = rsa_sign_with_key(rsa, region, region_count, sigp, sig_len);
 259         if (ret)
 260                 goto err_sign;
 261
 262         RSA_free(rsa);
 263         rsa_remove();
 264
 265         return ret;
 266
 267 err_sign:
 268         RSA_free(rsa);
 269 err_priv:
 270         rsa_remove();
 271         return ret;
 272 }
 273
 274 /*
 275  * rsa_get_params(): - Get the important parameters of an RSA public key
 276  */
 277 int rsa_get_params(RSA *key, uint32_t *n0_invp, BIGNUM **modulusp,
 278                    BIGNUM **r_squaredp)
 279 {
 280         BIGNUM *big1, *big2, *big32, *big2_32;
 281         BIGNUM *n, *r, *r_squared, *tmp;
 282         BN_CTX *bn_ctx = BN_CTX_new();
 283         int ret = 0;
 284
 285         /* Initialize BIGNUMs */
 286         big1 = BN_new();
 287         big2 = BN_new();
 288         big32 = BN_new();
 289         r = BN_new();
 290         r_squared = BN_new();
 291         tmp = BN_new();
 292         big2_32 = BN_new();
 293         n = BN_new();
 294         if (!big1 || !big2 || !big32 || !r || !r_squared || !tmp || !big2_32 ||
 295             !n) {
 296                 fprintf(stderr, "Out of memory (bignum)\n");
 297                 return -ENOMEM;
 298         }
 299
 300         if (!BN_copy(n, key->n) || !BN_set_word(big1, 1L) ||
 301             !BN_set_word(big2, 2L) || !BN_set_word(big32, 32L))
 302                 ret = -1;
 303
 304         /* big2_32 = 2^32 */
 305         if (!BN_exp(big2_32, big2, big32, bn_ctx))
 306                 ret = -1;
 307
 308         /* Calculate n0_inv = -1 / n[0] mod 2^32 */
 309         if (!BN_mod_inverse(tmp, n, big2_32, bn_ctx) ||
 310             !BN_sub(tmp, big2_32, tmp))
 311                 ret = -1;
 312         *n0_invp = BN_get_word(tmp);
 313
 314         /* Calculate R = 2^(# of key bits) */
 315         if (!BN_set_word(tmp, BN_num_bits(n)) ||
 316             !BN_exp(r, big2, tmp, bn_ctx))
 317                 ret = -1;
 318
 319         /* Calculate r_squared = R^2 mod n */
 320         if (!BN_copy(r_squared, r) ||
 321             !BN_mul(tmp, r_squared, r, bn_ctx) ||
 322             !BN_mod(r_squared, tmp, n, bn_ctx))
 323                 ret = -1;
 324
 325         *modulusp = n;
 326         *r_squaredp = r_squared;
 327
 328         BN_free(big1);
 329         BN_free(big2);
 330         BN_free(big32);
 331         BN_free(r);
 332         BN_free(tmp);
 333         BN_free(big2_32);
 334         if (ret) {
 335                 fprintf(stderr, "Bignum operations failed\n");
 336                 return -ENOMEM;
 337         }
 338
 339         return ret;
 340 }
 341
 342 static int fdt_add_bignum(void *blob, int noffset, const char *prop_name,
 343                           BIGNUM *num, int num_bits)
 344 {
 345         int nwords = num_bits / 32;
 346         int size;
 347         uint32_t *buf, *ptr;
 348         BIGNUM *tmp, *big2, *big32, *big2_32;
 349         BN_CTX *ctx;
 350         int ret;
 351
 352         tmp = BN_new();
 353         big2 = BN_new();
 354         big32 = BN_new();
 355         big2_32 = BN_new();
 356         if (!tmp || !big2 || !big32 || !big2_32) {
 357                 fprintf(stderr, "Out of memory (bignum)\n");
 358                 return -ENOMEM;
 359         }
 360         ctx = BN_CTX_new();
 361         if (!tmp) {
 362                 fprintf(stderr, "Out of memory (bignum context)\n");
 363                 return -ENOMEM;
 364         }
 365         BN_set_word(big2, 2L);
 366         BN_set_word(big32, 32L);
 367         BN_exp(big2_32, big2, big32, ctx); /* B = 2^32 */
 368
 369         size = nwords * sizeof(uint32_t);
 370         buf = malloc(size);
 371         if (!buf) {
 372                 fprintf(stderr, "Out of memory (%d bytes)\n", size);
 373                 return -ENOMEM;
 374         }
 375
 376         /* Write out modulus as big endian array of integers */
 377         for (ptr = buf + nwords - 1; ptr >= buf; ptr--) {
 378                 BN_mod(tmp, num, big2_32, ctx); /* n = N mod B */
 379                 *ptr = cpu_to_fdt32(BN_get_word(tmp));
 380                 BN_rshift(num, num, 32); /*  N = N/B */
 381         }
 382
 383         ret = fdt_setprop(blob, noffset, prop_name, buf, size);
 384         if (ret) {
 385                 fprintf(stderr, "Failed to write public key to FIT\n");
 386                 return -ENOSPC;
 387         }
 388         free(buf);
 389         BN_free(tmp);
 390         BN_free(big2);
 391         BN_free(big32);
 392         BN_free(big2_32);
 393
 394         return ret;
 395 }
 396
 397 int rsa_add_verify_data(struct image_sign_info *info, void *keydest)
 398 {
 399         BIGNUM *modulus, *r_squared;
 400         uint32_t n0_inv;
 401         int parent, node;
 402         char name[100];
 403         int ret;
 404         int bits;
 405         RSA *rsa;
 406
 407         debug("%s: Getting verification data\n", __func__);
 408         ret = rsa_get_pub_key(info->keydir, info->keyname, &rsa);
 409         if (ret)
 410                 return ret;
 411         ret = rsa_get_params(rsa, &n0_inv, &modulus, &r_squared);
 412         if (ret)
 413                 return ret;
 414         bits = BN_num_bits(modulus);
 415         parent = fdt_subnode_offset(keydest, 0, FIT_SIG_NODENAME);
 416         if (parent == -FDT_ERR_NOTFOUND) {
 417                 parent = fdt_add_subnode(keydest, 0, FIT_SIG_NODENAME);
 418                 if (parent < 0) {
 419                         fprintf(stderr, "Couldn't create signature node: %s\n",
 420                                 fdt_strerror(parent));
 421                         return -EINVAL;
 422                 }
 423         }
 424
 425         /* Either create or overwrite the named key node */
 426         snprintf(name, sizeof(name), "key-%s", info->keyname);
 427         node = fdt_subnode_offset(keydest, parent, name);
 428         if (node == -FDT_ERR_NOTFOUND) {
 429                 node = fdt_add_subnode(keydest, parent, name);
 430                 if (node < 0) {
 431                         fprintf(stderr, "Could not create key subnode: %s\n",
 432                                 fdt_strerror(node));
 433                         return -EINVAL;
 434                 }
 435         } else if (node < 0) {
 436                 fprintf(stderr, "Cannot select keys parent: %s\n",
 437                         fdt_strerror(node));
 438                 return -ENOSPC;
 439         }
 440
 441         ret = fdt_setprop_string(keydest, node, "key-name-hint",
 442                                  info->keyname);
 443         ret |= fdt_setprop_u32(keydest, node, "rsa,num-bits", bits);
 444         ret |= fdt_setprop_u32(keydest, node, "rsa,n0-inverse", n0_inv);
 445         ret |= fdt_add_bignum(keydest, node, "rsa,modulus", modulus, bits);
 446         ret |= fdt_add_bignum(keydest, node, "rsa,r-squared", r_squared, bits);
 447         ret |= fdt_setprop_string(keydest, node, FIT_ALGO_PROP,
 448                                   info->algo->name);
 449         if (info->require_keys) {
 450                 fdt_setprop_string(keydest, node, "required",
 451                                    info->require_keys);
 452         }
 453         BN_free(modulus);
 454         BN_free(r_squared);
 455         if (ret)
 456                 return -EIO;
 457
 458         return 0;
 459 }