crypto/rsa/rsa_sp800_56b_check.c

   1 /*
   2  * Copyright 2018-2019 The OpenSSL Project Authors. All Rights Reserved.
   3  * Copyright (c) 2018-2019, Oracle and/or its affiliates.  All rights reserved.
   4  *
   5  * Licensed under the OpenSSL license (the "License").  You may not use
   6  * this file except in compliance with the License.  You can obtain a copy
   7  * in the file LICENSE in the source distribution or at
   8  * https://www.openssl.org/source/license.html
   9  */
  10
  11 #include <openssl/err.h>
  12 #include <openssl/bn.h>
  13 #include "crypto/bn.h"
  14 #include "rsa_local.h"
  15
  16 /*
  17  * Part of the RSA keypair test.
  18  * Check the Chinese Remainder Theorem components are valid.
  19  *
  20  * See SP800-5bBr1
  21  *   6.4.1.2.3: rsakpv1-crt Step 7
  22  *   6.4.1.3.3: rsakpv2-crt Step 7
  23  */
  24 int rsa_check_crt_components(const RSA *rsa, BN_CTX *ctx)
  25 {
  26     int ret = 0;
  27     BIGNUM *r = NULL, *p1 = NULL, *q1 = NULL;
  28
  29     /* check if only some of the crt components are set */
  30     if (rsa->dmp1 == NULL || rsa->dmq1 == NULL || rsa->iqmp == NULL) {
  31         if (rsa->dmp1 != NULL || rsa->dmq1 != NULL || rsa->iqmp != NULL)
  32             return 0;
  33         return 1; /* return ok if all components are NULL */
  34     }
  35
  36     BN_CTX_start(ctx);
  37     r = BN_CTX_get(ctx);
  38     p1 = BN_CTX_get(ctx);
  39     q1 = BN_CTX_get(ctx);
  40     ret = (q1 != NULL)
  41           /* p1 = p -1 */
  42           && (BN_copy(p1, rsa->p) != NULL)
  43           && BN_sub_word(p1, 1)
  44           /* q1 = q - 1 */
  45           && (BN_copy(q1, rsa->q) != NULL)
  46           && BN_sub_word(q1, 1)
  47           /* (a) 1 < dP < (p – 1). */
  48           && (BN_cmp(rsa->dmp1, BN_value_one()) > 0)
  49           && (BN_cmp(rsa->dmp1, p1) < 0)
  50           /* (b) 1 < dQ < (q - 1). */
  51           && (BN_cmp(rsa->dmq1, BN_value_one()) > 0)
  52           && (BN_cmp(rsa->dmq1, q1) < 0)
  53           /* (c) 1 < qInv < p */
  54           && (BN_cmp(rsa->iqmp, BN_value_one()) > 0)
  55           && (BN_cmp(rsa->iqmp, rsa->p) < 0)
  56           /* (d) 1 = (dP . e) mod (p - 1)*/
  57           && BN_mod_mul(r, rsa->dmp1, rsa->e, p1, ctx)
  58           && BN_is_one(r)
  59           /* (e) 1 = (dQ . e) mod (q - 1) */
  60           && BN_mod_mul(r, rsa->dmq1, rsa->e, q1, ctx)
  61           && BN_is_one(r)
  62           /* (f) 1 = (qInv . q) mod p */
  63           && BN_mod_mul(r, rsa->iqmp, rsa->q, rsa->p, ctx)
  64           && BN_is_one(r);
  65     BN_clear(p1);
  66     BN_clear(q1);
  67     BN_CTX_end(ctx);
  68     return ret;
  69 }
  70
  71 /*
  72  * Part of the RSA keypair test.
  73  * Check that (√2)(2^(nbits/2 - 1) <= p <= 2^(nbits/2) - 1
  74  *
  75  * See SP800-5bBr1 6.4.1.2.1 Part 5 (c) & (g) - used for both p and q.
  76  *
  77  * (√2)(2^(nbits/2 - 1) = (√2/2)(2^(nbits/2))
  78  * √2/2 = 0.707106781186547524400 = 0.B504F333F9DE6484597D8
  79  * 0.B504F334 gives an approximation to 11 decimal places.
  80  * The range is then from
  81  *   0xB504F334_0000.......................000 to
  82  *   0xFFFFFFFF_FFFF.......................FFF
  83  */
  84 int rsa_check_prime_factor_range(const BIGNUM *p, int nbits, BN_CTX *ctx)
  85 {
  86     int ret = 0;
  87     BIGNUM *tmp, *low;
  88
  89     nbits >>= 1;
  90
  91     /* Upper bound check */
  92     if (BN_num_bits(p) != nbits)
  93         return 0;
  94
  95     BN_CTX_start(ctx);
  96     tmp = BN_CTX_get(ctx);
  97     low = BN_CTX_get(ctx);
  98
  99     /* set low = (√2)(2^(nbits/2 - 1) */
 100     if (low == NULL || !BN_set_word(tmp, 0xB504F334))
 101         goto err;
 102
 103     if (nbits >= 32) {
 104         if (!BN_lshift(low, tmp, nbits - 32))
 105             goto err;
 106     } else if (!BN_rshift(low, tmp, 32 - nbits)) {
 107         goto err;
 108     }
 109     if (BN_cmp(p, low) < 0)
 110         goto err;
 111     ret = 1;
 112 err:
 113     BN_CTX_end(ctx);
 114     return ret;
 115 }
 116
 117 /*
 118  * Part of the RSA keypair test.
 119  * Check the prime factor (for either p or q)
 120  * i.e: p is prime AND GCD(p - 1, e) = 1
 121  *
 122  * See SP800-5bBr1 6.4.1.2.3 Step 5 (a to d) & (e to h).
 123  */
 124 int rsa_check_prime_factor(BIGNUM *p, BIGNUM *e, int nbits, BN_CTX *ctx)
 125 {
 126     int checks = bn_rsa_fips186_4_prime_MR_min_checks(nbits);
 127     int ret = 0;
 128     BIGNUM *p1 = NULL, *gcd = NULL;
 129
 130     /* (Steps 5 a-b) prime test */
 131     if (BN_is_prime_fasttest_ex(p, checks, ctx, 1, NULL) != 1
 132             /* (Step 5c) (√2)(2^(nbits/2 - 1) <= p <= 2^(nbits/2 - 1) */
 133             || rsa_check_prime_factor_range(p, nbits, ctx) != 1)
 134         return 0;
 135
 136     BN_CTX_start(ctx);
 137     p1 = BN_CTX_get(ctx);
 138     gcd = BN_CTX_get(ctx);
 139     ret = (gcd != NULL)
 140           /* (Step 5d) GCD(p-1, e) = 1 */
 141           && (BN_copy(p1, p) != NULL)
 142           && BN_sub_word(p1, 1)
 143           && BN_gcd(gcd, p1, e, ctx)
 144           && BN_is_one(gcd);
 145
 146     BN_clear(p1);
 147     BN_CTX_end(ctx);
 148     return ret;
 149 }
 150
 151 /*
 152  * See SP800-56Br1 6.4.1.2.3 Part 6(a-b) Check the private exponent d
 153  * satisfies:
 154  *     (Step 6a) 2^(nBit/2) < d < LCM(p–1, q–1).
 155  *     (Step 6b) 1 = (d*e) mod LCM(p–1, q–1)
 156  */
 157 int rsa_check_private_exponent(const RSA *rsa, int nbits, BN_CTX *ctx)
 158 {
 159     int ret;
 160     BIGNUM *r, *p1, *q1, *lcm, *p1q1, *gcd;
 161
 162     /* (Step 6a) 2^(nbits/2) < d */
 163     if (BN_num_bits(rsa->d) <= (nbits >> 1))
 164         return 0;
 165
 166     BN_CTX_start(ctx);
 167     r = BN_CTX_get(ctx);
 168     p1 = BN_CTX_get(ctx);
 169     q1 = BN_CTX_get(ctx);
 170     lcm = BN_CTX_get(ctx);
 171     p1q1 = BN_CTX_get(ctx);
 172     gcd = BN_CTX_get(ctx);
 173     ret = (gcd != NULL
 174           /* LCM(p - 1, q - 1) */
 175           && (rsa_get_lcm(ctx, rsa->p, rsa->q, lcm, gcd, p1, q1, p1q1) == 1)
 176           /* (Step 6a) d < LCM(p - 1, q - 1) */
 177           && (BN_cmp(rsa->d, lcm) < 0)
 178           /* (Step 6b) 1 = (e . d) mod LCM(p - 1, q - 1) */
 179           && BN_mod_mul(r, rsa->e, rsa->d, lcm, ctx)
 180           && BN_is_one(r));
 181
 182     BN_clear(p1);
 183     BN_clear(q1);
 184     BN_clear(lcm);
 185     BN_clear(gcd);
 186     BN_CTX_end(ctx);
 187     return ret;
 188 }
 189
 190 /* Check exponent is odd, and has a bitlen ranging from [17..256] */
 191 int rsa_check_public_exponent(const BIGNUM *e)
 192 {
 193     int bitlen = BN_num_bits(e);
 194
 195     return (BN_is_odd(e) &&  bitlen > 16 && bitlen < 257);
 196 }
 197
 198 /*
 199  * SP800-56Br1 6.4.1.2.1 (Step 5i): |p - q| > 2^(nbits/2 - 100)
 200  * i.e- numbits(p-q-1) > (nbits/2 -100)
 201  */
 202 int rsa_check_pminusq_diff(BIGNUM *diff, const BIGNUM *p, const BIGNUM *q,
 203                            int nbits)
 204 {
 205     int bitlen = (nbits >> 1) - 100;
 206
 207     if (!BN_sub(diff, p, q))
 208         return -1;
 209     BN_set_negative(diff, 0);
 210
 211     if (BN_is_zero(diff))
 212         return 0;
 213
 214     if (!BN_sub_word(diff, 1))
 215         return -1;
 216     return (BN_num_bits(diff) > bitlen);
 217 }
 218
 219 /* return LCM(p-1, q-1) */
 220 int rsa_get_lcm(BN_CTX *ctx, const BIGNUM *p, const BIGNUM *q,
 221                 BIGNUM *lcm, BIGNUM *gcd, BIGNUM *p1, BIGNUM *q1,
 222                 BIGNUM *p1q1)
 223 {
 224     return BN_sub(p1, p, BN_value_one())    /* p-1 */
 225            && BN_sub(q1, q, BN_value_one()) /* q-1 */
 226            && BN_mul(p1q1, p1, q1, ctx)     /* (p-1)(q-1) */
 227            && BN_gcd(gcd, p1, q1, ctx)
 228            && BN_div(lcm, NULL, p1q1, gcd, ctx); /* LCM((p-1, q-1)) */
 229 }
 230
 231 /*
 232  * SP800-56Br1 6.4.2.2 Partial Public Key Validation for RSA refers to
 233  * SP800-89 5.3.3 (Explicit) Partial Public Key Validation for RSA
 234  * caveat is that the modulus must be as specified in SP800-56Br1
 235  */
 236 int rsa_sp800_56b_check_public(const RSA *rsa)
 237 {
 238     int ret = 0, nbits, iterations, status;
 239     BN_CTX *ctx = NULL;
 240     BIGNUM *gcd = NULL;
 241
 242     if (rsa->n == NULL || rsa->e == NULL)
 243         return 0;
 244
 245     /*
 246      * (Step a): modulus must be 2048 or 3072 (caveat from SP800-56Br1)
 247      * NOTE: changed to allow keys >= 2048
 248      */
 249     nbits = BN_num_bits(rsa->n);
 250     if (!rsa_sp800_56b_validate_strength(nbits, -1)) {
 251         RSAerr(RSA_F_RSA_SP800_56B_CHECK_PUBLIC, RSA_R_INVALID_KEY_LENGTH);
 252         return 0;
 253     }
 254     if (!BN_is_odd(rsa->n)) {
 255         RSAerr(RSA_F_RSA_SP800_56B_CHECK_PUBLIC, RSA_R_INVALID_MODULUS);
 256         return 0;
 257     }
 258
 259     /* (Steps b-c): 2^16 < e < 2^256, n and e must be odd */
 260     if (!rsa_check_public_exponent(rsa->e)) {
 261         RSAerr(RSA_F_RSA_SP800_56B_CHECK_PUBLIC,
 262                RSA_R_PUB_EXPONENT_OUT_OF_RANGE);
 263         return 0;
 264     }
 265
 266     ctx = BN_CTX_new();
 267     gcd = BN_new();
 268     if (ctx == NULL || gcd == NULL)
 269         goto err;
 270
 271     iterations = bn_rsa_fips186_4_prime_MR_min_checks(nbits);
 272     /* (Steps d-f):
 273      * The modulus is composite, but not a power of a prime.
 274      * The modulus has no factors smaller than 752.
 275      */
 276     if (!BN_gcd(gcd, rsa->n, bn_get0_small_factors(), ctx) || !BN_is_one(gcd)) {
 277         RSAerr(RSA_F_RSA_SP800_56B_CHECK_PUBLIC, RSA_R_INVALID_MODULUS);
 278         goto err;
 279     }
 280
 281     ret = bn_miller_rabin_is_prime(rsa->n, iterations, ctx, NULL, 1, &status);
 282     if (ret != 1 || status != BN_PRIMETEST_COMPOSITE_NOT_POWER_OF_PRIME) {
 283         RSAerr(RSA_F_RSA_SP800_56B_CHECK_PUBLIC, RSA_R_INVALID_MODULUS);
 284         ret = 0;
 285         goto err;
 286     }
 287
 288     ret = 1;
 289 err:
 290     BN_free(gcd);
 291     BN_CTX_free(ctx);
 292     return ret;
 293 }
 294
 295 /*
 296  * Perform validation of the RSA private key to check that 0 < D < N.
 297  */
 298 int rsa_sp800_56b_check_private(const RSA *rsa)
 299 {
 300     if (rsa->d == NULL || rsa->n == NULL)
 301         return 0;
 302     return BN_cmp(rsa->d, BN_value_one()) >= 0 && BN_cmp(rsa->d, rsa->n) < 0;
 303 }
 304
 305 /*
 306  * RSA key pair validation.
 307  *
 308  * SP800-56Br1.
 309  *    6.4.1.2 "RSAKPV1 Family: RSA Key - Pair Validation with a Fixed Exponent"
 310  *    6.4.1.3 "RSAKPV2 Family: RSA Key - Pair Validation with a Random Exponent"
 311  *
 312  * It uses:
 313  *     6.4.1.2.3 "rsakpv1 - crt"
 314  *     6.4.1.3.3 "rsakpv2 - crt"
 315  */
 316 int rsa_sp800_56b_check_keypair(const RSA *rsa, const BIGNUM *efixed,
 317                                 int strength, int nbits)
 318 {
 319     int ret = 0;
 320     BN_CTX *ctx = NULL;
 321     BIGNUM *r = NULL;
 322
 323     if (rsa->p == NULL
 324             || rsa->q == NULL
 325             || rsa->e == NULL
 326             || rsa->d == NULL
 327             || rsa->n == NULL) {
 328         RSAerr(RSA_F_RSA_SP800_56B_CHECK_KEYPAIR, RSA_R_INVALID_REQUEST);
 329         return 0;
 330     }
 331     /* (Step 1): Check Ranges */
 332     if (!rsa_sp800_56b_validate_strength(nbits, strength))
 333         return 0;
 334
 335     /* If the exponent is known */
 336     if (efixed != NULL) {
 337         /* (2): Check fixed exponent matches public exponent. */
 338         if (BN_cmp(efixed, rsa->e) != 0) {
 339             RSAerr(RSA_F_RSA_SP800_56B_CHECK_KEYPAIR, RSA_R_INVALID_REQUEST);
 340             return 0;
 341         }
 342     }
 343     /* (Step 1.c): e is odd integer 65537 <= e < 2^256 */
 344     if (!rsa_check_public_exponent(rsa->e)) {
 345         /* exponent out of range */
 346         RSAerr(RSA_F_RSA_SP800_56B_CHECK_KEYPAIR,
 347                RSA_R_PUB_EXPONENT_OUT_OF_RANGE);
 348         return 0;
 349     }
 350     /* (Step 3.b): check the modulus */
 351     if (nbits != BN_num_bits(rsa->n)) {
 352         RSAerr(RSA_F_RSA_SP800_56B_CHECK_KEYPAIR, RSA_R_INVALID_KEYPAIR);
 353         return 0;
 354     }
 355
 356     ctx = BN_CTX_new();
 357     if (ctx == NULL)
 358         return 0;
 359
 360     BN_CTX_start(ctx);
 361     r = BN_CTX_get(ctx);
 362     if (r == NULL || !BN_mul(r, rsa->p, rsa->q, ctx))
 363         goto err;
 364     /* (Step 4.c): Check n = pq */
 365     if (BN_cmp(rsa->n, r) != 0) {
 366         RSAerr(RSA_F_RSA_SP800_56B_CHECK_KEYPAIR, RSA_R_INVALID_REQUEST);
 367         goto err;
 368     }
 369
 370     /* (Step 5): check prime factors p & q */
 371     ret = rsa_check_prime_factor(rsa->p, rsa->e, nbits, ctx)
 372           && rsa_check_prime_factor(rsa->q, rsa->e, nbits, ctx)
 373           && (rsa_check_pminusq_diff(r, rsa->p, rsa->q, nbits) > 0)
 374           /* (Step 6): Check the private exponent d */
 375           && rsa_check_private_exponent(rsa, nbits, ctx)
 376           /* 6.4.1.2.3 (Step 7): Check the CRT components */
 377           && rsa_check_crt_components(rsa, ctx);
 378     if (ret != 1)
 379         RSAerr(RSA_F_RSA_SP800_56B_CHECK_KEYPAIR, RSA_R_INVALID_KEYPAIR);
 380
 381 err:
 382     BN_clear(r);
 383     BN_CTX_end(ctx);
 384     BN_CTX_free(ctx);
 385     return ret;
 386 }