/src/botan/src/lib/pubkey/rsa/rsa.cpp
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * RSA |
3 | | * (C) 1999-2010,2015,2016,2018,2019 Jack Lloyd |
4 | | * |
5 | | * Botan is released under the Simplified BSD License (see license.txt) |
6 | | */ |
7 | | |
8 | | #include <botan/rsa.h> |
9 | | #include <botan/internal/pk_ops_impl.h> |
10 | | #include <botan/keypair.h> |
11 | | #include <botan/blinding.h> |
12 | | #include <botan/reducer.h> |
13 | | #include <botan/workfactor.h> |
14 | | #include <botan/der_enc.h> |
15 | | #include <botan/ber_dec.h> |
16 | | #include <botan/monty.h> |
17 | | #include <botan/divide.h> |
18 | | #include <botan/internal/monty_exp.h> |
19 | | |
20 | | #if defined(BOTAN_HAS_OPENSSL) |
21 | | #include <botan/internal/openssl.h> |
22 | | #endif |
23 | | |
24 | | #if defined(BOTAN_HAS_THREAD_UTILS) |
25 | | #include <botan/internal/thread_pool.h> |
26 | | #endif |
27 | | |
28 | | namespace Botan { |
29 | | |
30 | | class RSA_Public_Data final |
31 | | { |
32 | | public: |
33 | | RSA_Public_Data(BigInt&& n, BigInt&& e) : |
34 | | m_n(n), |
35 | | m_e(e), |
36 | | m_monty_n(std::make_shared<Montgomery_Params>(m_n)), |
37 | | m_public_modulus_bits(m_n.bits()), |
38 | | m_public_modulus_bytes(m_n.bytes()) |
39 | 5.88k | {} |
40 | | |
41 | | BigInt public_op(const BigInt& m) const |
42 | 5.69k | { |
43 | 5.69k | const size_t powm_window = 1; |
44 | 5.69k | auto powm_m_n = monty_precompute(m_monty_n, m, powm_window, false); |
45 | 5.69k | return monty_execute_vartime(*powm_m_n, m_e); |
46 | 5.69k | } |
47 | | |
48 | 5.77k | const BigInt& get_n() const { return m_n; } |
49 | 0 | const BigInt& get_e() const { return m_e; } |
50 | 5.74k | size_t public_modulus_bits() const { return m_public_modulus_bits; } |
51 | 52 | size_t public_modulus_bytes() const { return m_public_modulus_bytes; } |
52 | | |
53 | | private: |
54 | | BigInt m_n; |
55 | | BigInt m_e; |
56 | | std::shared_ptr<const Montgomery_Params> m_monty_n; |
57 | | size_t m_public_modulus_bits; |
58 | | size_t m_public_modulus_bytes; |
59 | | }; |
60 | | |
61 | | class RSA_Private_Data final |
62 | | { |
63 | | public: |
64 | | RSA_Private_Data(BigInt&& d, BigInt&& p, BigInt&& q, |
65 | | BigInt&& d1, BigInt&& d2, BigInt&& c) : |
66 | | m_d(d), |
67 | | m_p(p), |
68 | | m_q(q), |
69 | | m_d1(d1), |
70 | | m_d2(d2), |
71 | | m_c(c), |
72 | | m_mod_p(m_p), |
73 | | m_mod_q(m_q), |
74 | | m_monty_p(std::make_shared<Montgomery_Params>(m_p, m_mod_p)), |
75 | | m_monty_q(std::make_shared<Montgomery_Params>(m_q, m_mod_q)), |
76 | | m_p_bits(m_p.bits()), |
77 | | m_q_bits(m_q.bits()) |
78 | 13 | {} |
79 | | |
80 | 0 | const BigInt& get_d() const { return m_d; } |
81 | 0 | const BigInt& get_p() const { return m_p; } |
82 | 0 | const BigInt& get_q() const { return m_q; } |
83 | 0 | const BigInt& get_d1() const { return m_d1; } |
84 | 0 | const BigInt& get_d2() const { return m_d2; } |
85 | 0 | const BigInt& get_c() const { return m_c; } |
86 | | |
87 | | //private: |
88 | | BigInt m_d; |
89 | | BigInt m_p; |
90 | | BigInt m_q; |
91 | | BigInt m_d1; |
92 | | BigInt m_d2; |
93 | | BigInt m_c; |
94 | | |
95 | | Modular_Reducer m_mod_p; |
96 | | Modular_Reducer m_mod_q; |
97 | | std::shared_ptr<const Montgomery_Params> m_monty_p; |
98 | | std::shared_ptr<const Montgomery_Params> m_monty_q; |
99 | | size_t m_p_bits; |
100 | | size_t m_q_bits; |
101 | | }; |
102 | | |
103 | | std::shared_ptr<const RSA_Public_Data> RSA_PublicKey::public_data() const |
104 | 5.77k | { |
105 | 5.77k | return m_public; |
106 | 5.77k | } |
107 | | |
108 | 0 | const BigInt& RSA_PublicKey::get_n() const { return m_public->get_n(); } |
109 | 0 | const BigInt& RSA_PublicKey::get_e() const { return m_public->get_e(); } |
110 | | |
111 | | void RSA_PublicKey::init(BigInt&& n, BigInt&& e) |
112 | 5.94k | { |
113 | 5.94k | if(n.is_negative() || n.is_even() || e.is_negative() || e.is_even()) |
114 | 53 | throw Decoding_Error("Invalid RSA public key parameters"); |
115 | 5.88k | m_public = std::make_shared<RSA_Public_Data>(std::move(n), std::move(e)); |
116 | 5.88k | } |
117 | | |
118 | | RSA_PublicKey::RSA_PublicKey(const AlgorithmIdentifier&, |
119 | | const std::vector<uint8_t>& key_bits) |
120 | 6.04k | { |
121 | 6.04k | BigInt n, e; |
122 | 6.04k | BER_Decoder(key_bits) |
123 | 6.04k | .start_cons(SEQUENCE) |
124 | 6.04k | .decode(n) |
125 | 6.04k | .decode(e) |
126 | 6.04k | .end_cons(); |
127 | 6.04k | |
128 | 6.04k | init(std::move(n), std::move(e)); |
129 | 6.04k | } Unexecuted instantiation: Botan::RSA_PublicKey::RSA_PublicKey(Botan::AlgorithmIdentifier const&, std::__1::vector<unsigned char, std::__1::allocator<unsigned char> > const&) Botan::RSA_PublicKey::RSA_PublicKey(Botan::AlgorithmIdentifier const&, std::__1::vector<unsigned char, std::__1::allocator<unsigned char> > const&) Line | Count | Source | 120 | 6.04k | { | 121 | 6.04k | BigInt n, e; | 122 | 6.04k | BER_Decoder(key_bits) | 123 | 6.04k | .start_cons(SEQUENCE) | 124 | 6.04k | .decode(n) | 125 | 6.04k | .decode(e) | 126 | 6.04k | .end_cons(); | 127 | 6.04k | | 128 | 6.04k | init(std::move(n), std::move(e)); | 129 | 6.04k | } |
|
130 | | |
131 | | RSA_PublicKey::RSA_PublicKey(const BigInt& modulus, const BigInt& exponent) |
132 | 0 | { |
133 | 0 | BigInt n = modulus; |
134 | 0 | BigInt e = exponent; |
135 | 0 | init(std::move(n), std::move(e)); |
136 | 0 | } Unexecuted instantiation: Botan::RSA_PublicKey::RSA_PublicKey(Botan::BigInt const&, Botan::BigInt const&) Unexecuted instantiation: Botan::RSA_PublicKey::RSA_PublicKey(Botan::BigInt const&, Botan::BigInt const&) |
137 | | |
138 | | size_t RSA_PublicKey::key_length() const |
139 | 43 | { |
140 | 43 | return m_public->public_modulus_bits(); |
141 | 43 | } |
142 | | |
143 | | size_t RSA_PublicKey::estimated_strength() const |
144 | 0 | { |
145 | 0 | return if_work_factor(key_length()); |
146 | 0 | } |
147 | | |
148 | | AlgorithmIdentifier RSA_PublicKey::algorithm_identifier() const |
149 | 0 | { |
150 | 0 | return AlgorithmIdentifier(get_oid(), AlgorithmIdentifier::USE_NULL_PARAM); |
151 | 0 | } |
152 | | |
153 | | std::vector<uint8_t> RSA_PublicKey::public_key_bits() const |
154 | 0 | { |
155 | 0 | std::vector<uint8_t> output; |
156 | 0 | DER_Encoder der(output); |
157 | 0 | der.start_cons(SEQUENCE) |
158 | 0 | .encode(get_n()) |
159 | 0 | .encode(get_e()) |
160 | 0 | .end_cons(); |
161 | 0 |
|
162 | 0 | return output; |
163 | 0 | } |
164 | | |
165 | | /* |
166 | | * Check RSA Public Parameters |
167 | | */ |
168 | | bool RSA_PublicKey::check_key(RandomNumberGenerator&, bool) const |
169 | 0 | { |
170 | 0 | if(get_n() < 35 || get_n().is_even() || get_e() < 3 || get_e().is_even()) |
171 | 0 | return false; |
172 | 0 | return true; |
173 | 0 | } |
174 | | |
175 | | std::shared_ptr<const RSA_Private_Data> RSA_PrivateKey::private_data() const |
176 | 0 | { |
177 | 0 | return m_private; |
178 | 0 | } |
179 | | |
180 | | secure_vector<uint8_t> RSA_PrivateKey::private_key_bits() const |
181 | 0 | { |
182 | 0 | return DER_Encoder() |
183 | 0 | .start_cons(SEQUENCE) |
184 | 0 | .encode(static_cast<size_t>(0)) |
185 | 0 | .encode(get_n()) |
186 | 0 | .encode(get_e()) |
187 | 0 | .encode(get_d()) |
188 | 0 | .encode(get_p()) |
189 | 0 | .encode(get_q()) |
190 | 0 | .encode(get_d1()) |
191 | 0 | .encode(get_d2()) |
192 | 0 | .encode(get_c()) |
193 | 0 | .end_cons() |
194 | 0 | .get_contents(); |
195 | 0 | } |
196 | | |
197 | 0 | const BigInt& RSA_PrivateKey::get_p() const { return m_private->get_p(); } |
198 | 0 | const BigInt& RSA_PrivateKey::get_q() const { return m_private->get_q(); } |
199 | 0 | const BigInt& RSA_PrivateKey::get_d() const { return m_private->get_d(); } |
200 | 0 | const BigInt& RSA_PrivateKey::get_c() const { return m_private->get_c(); } |
201 | 0 | const BigInt& RSA_PrivateKey::get_d1() const { return m_private->get_d1(); } |
202 | 0 | const BigInt& RSA_PrivateKey::get_d2() const { return m_private->get_d2(); } |
203 | | |
204 | | void RSA_PrivateKey::init(BigInt&& d, BigInt&& p, BigInt&& q, |
205 | | BigInt&& d1, BigInt&& d2, BigInt&& c) |
206 | 13 | { |
207 | 13 | m_private = std::make_shared<RSA_Private_Data>( |
208 | 13 | std::move(d), std::move(p), std::move(q), std::move(d1), std::move(d2), std::move(c)); |
209 | 13 | } |
210 | | |
211 | | RSA_PrivateKey::RSA_PrivateKey(const AlgorithmIdentifier&, |
212 | | const secure_vector<uint8_t>& key_bits) |
213 | 31 | { |
214 | 31 | BigInt n, e, d, p, q, d1, d2, c; |
215 | 31 | |
216 | 31 | BER_Decoder(key_bits) |
217 | 31 | .start_cons(SEQUENCE) |
218 | 31 | .decode_and_check<size_t>(0, "Unknown PKCS #1 key format version") |
219 | 31 | .decode(n) |
220 | 31 | .decode(e) |
221 | 31 | .decode(d) |
222 | 31 | .decode(p) |
223 | 31 | .decode(q) |
224 | 31 | .decode(d1) |
225 | 31 | .decode(d2) |
226 | 31 | .decode(c) |
227 | 31 | .end_cons(); |
228 | 31 | |
229 | 31 | RSA_PublicKey::init(std::move(n), std::move(e)); |
230 | 31 | |
231 | 31 | RSA_PrivateKey::init(std::move(d), std::move(p), std::move(q), |
232 | 31 | std::move(d1), std::move(d2), std::move(c)); |
233 | 31 | } Unexecuted instantiation: Botan::RSA_PrivateKey::RSA_PrivateKey(Botan::AlgorithmIdentifier const&, std::__1::vector<unsigned char, Botan::secure_allocator<unsigned char> > const&) Botan::RSA_PrivateKey::RSA_PrivateKey(Botan::AlgorithmIdentifier const&, std::__1::vector<unsigned char, Botan::secure_allocator<unsigned char> > const&) Line | Count | Source | 213 | 31 | { | 214 | 31 | BigInt n, e, d, p, q, d1, d2, c; | 215 | 31 | | 216 | 31 | BER_Decoder(key_bits) | 217 | 31 | .start_cons(SEQUENCE) | 218 | 31 | .decode_and_check<size_t>(0, "Unknown PKCS #1 key format version") | 219 | 31 | .decode(n) | 220 | 31 | .decode(e) | 221 | 31 | .decode(d) | 222 | 31 | .decode(p) | 223 | 31 | .decode(q) | 224 | 31 | .decode(d1) | 225 | 31 | .decode(d2) | 226 | 31 | .decode(c) | 227 | 31 | .end_cons(); | 228 | 31 | | 229 | 31 | RSA_PublicKey::init(std::move(n), std::move(e)); | 230 | 31 | | 231 | 31 | RSA_PrivateKey::init(std::move(d), std::move(p), std::move(q), | 232 | 31 | std::move(d1), std::move(d2), std::move(c)); | 233 | 31 | } |
|
234 | | |
235 | | RSA_PrivateKey::RSA_PrivateKey(const BigInt& prime1, |
236 | | const BigInt& prime2, |
237 | | const BigInt& exp, |
238 | | const BigInt& d_exp, |
239 | | const BigInt& mod) |
240 | 0 | { |
241 | 0 | BigInt p = prime1; |
242 | 0 | BigInt q = prime2; |
243 | 0 | BigInt n = mod; |
244 | 0 | if(n.is_zero()) |
245 | 0 | n = p * q; |
246 | 0 |
|
247 | 0 | BigInt e = exp; |
248 | 0 |
|
249 | 0 | BigInt d = d_exp; |
250 | 0 |
|
251 | 0 | const BigInt p_minus_1 = p - 1; |
252 | 0 | const BigInt q_minus_1 = q - 1; |
253 | 0 |
|
254 | 0 | if(d.is_zero()) |
255 | 0 | { |
256 | 0 | const BigInt phi_n = lcm(p_minus_1, q_minus_1); |
257 | 0 | d = inverse_mod(e, phi_n); |
258 | 0 | } |
259 | 0 |
|
260 | 0 | BigInt d1 = ct_modulo(d, p_minus_1); |
261 | 0 | BigInt d2 = ct_modulo(d, q_minus_1); |
262 | 0 | BigInt c = inverse_mod(q, p); |
263 | 0 |
|
264 | 0 | RSA_PublicKey::init(std::move(n), std::move(e)); |
265 | 0 |
|
266 | 0 | RSA_PrivateKey::init(std::move(d), std::move(p), std::move(q), |
267 | 0 | std::move(d1), std::move(d2), std::move(c)); |
268 | 0 | } Unexecuted instantiation: Botan::RSA_PrivateKey::RSA_PrivateKey(Botan::BigInt const&, Botan::BigInt const&, Botan::BigInt const&, Botan::BigInt const&, Botan::BigInt const&) Unexecuted instantiation: Botan::RSA_PrivateKey::RSA_PrivateKey(Botan::BigInt const&, Botan::BigInt const&, Botan::BigInt const&, Botan::BigInt const&, Botan::BigInt const&) |
269 | | |
270 | | /* |
271 | | * Create a RSA private key |
272 | | */ |
273 | | RSA_PrivateKey::RSA_PrivateKey(RandomNumberGenerator& rng, |
274 | | size_t bits, size_t exp) |
275 | 0 | { |
276 | 0 | if(bits < 1024) |
277 | 0 | throw Invalid_Argument(algo_name() + ": Can't make a key that is only " + |
278 | 0 | std::to_string(bits) + " bits long"); |
279 | 0 | if(exp < 3 || exp % 2 == 0) |
280 | 0 | throw Invalid_Argument(algo_name() + ": Invalid encryption exponent"); |
281 | 0 | |
282 | 0 | BigInt n, e, d, p, q, d1, d2, c; |
283 | 0 |
|
284 | 0 | e = exp; |
285 | 0 |
|
286 | 0 | const size_t p_bits = (bits + 1) / 2; |
287 | 0 | const size_t q_bits = bits - p_bits; |
288 | 0 |
|
289 | 0 | do |
290 | 0 | { |
291 | 0 | // TODO could generate primes in thread pool |
292 | 0 | p = generate_rsa_prime(rng, rng, p_bits, e); |
293 | 0 | q = generate_rsa_prime(rng, rng, q_bits, e); |
294 | 0 | n = p * q; |
295 | 0 | } while(n.bits() != bits); |
296 | 0 |
|
297 | 0 | const BigInt p_minus_1 = p - 1; |
298 | 0 | const BigInt q_minus_1 = q - 1; |
299 | 0 |
|
300 | 0 | const BigInt phi_n = lcm(p_minus_1, q_minus_1); |
301 | 0 | d = inverse_mod(e, phi_n); |
302 | 0 | d1 = ct_modulo(d, p_minus_1); |
303 | 0 | d2 = ct_modulo(d, q_minus_1); |
304 | 0 | c = inverse_mod(q, p); |
305 | 0 |
|
306 | 0 | RSA_PublicKey::init(std::move(n), std::move(e)); |
307 | 0 |
|
308 | 0 | RSA_PrivateKey::init(std::move(d), std::move(p), std::move(q), |
309 | 0 | std::move(d1), std::move(d2), std::move(c)); |
310 | 0 | } Unexecuted instantiation: Botan::RSA_PrivateKey::RSA_PrivateKey(Botan::RandomNumberGenerator&, unsigned long, unsigned long) Unexecuted instantiation: Botan::RSA_PrivateKey::RSA_PrivateKey(Botan::RandomNumberGenerator&, unsigned long, unsigned long) |
311 | | |
312 | | /* |
313 | | * Check Private RSA Parameters |
314 | | */ |
315 | | bool RSA_PrivateKey::check_key(RandomNumberGenerator& rng, bool strong) const |
316 | 0 | { |
317 | 0 | if(get_n() < 35 || get_n().is_even() || get_e() < 3 || get_e().is_even()) |
318 | 0 | return false; |
319 | 0 | |
320 | 0 | if(get_d() < 2 || get_p() < 3 || get_q() < 3) |
321 | 0 | return false; |
322 | 0 | |
323 | 0 | if(get_p() * get_q() != get_n()) |
324 | 0 | return false; |
325 | 0 | |
326 | 0 | if(get_d1() != ct_modulo(get_d(), get_p() - 1)) |
327 | 0 | return false; |
328 | 0 | if(get_d2() != ct_modulo(get_d(), get_q() - 1)) |
329 | 0 | return false; |
330 | 0 | if(get_c() != inverse_mod(get_q(), get_p())) |
331 | 0 | return false; |
332 | 0 | |
333 | 0 | const size_t prob = (strong) ? 128 : 12; |
334 | 0 |
|
335 | 0 | if(!is_prime(get_p(), rng, prob)) |
336 | 0 | return false; |
337 | 0 | if(!is_prime(get_q(), rng, prob)) |
338 | 0 | return false; |
339 | 0 | |
340 | 0 | if(strong) |
341 | 0 | { |
342 | 0 | if(ct_modulo(get_e() * get_d(), lcm(get_p() - 1, get_q() - 1)) != 1) |
343 | 0 | return false; |
344 | 0 | |
345 | 0 | return KeyPair::signature_consistency_check(rng, *this, "EMSA4(SHA-256)"); |
346 | 0 | } |
347 | 0 | |
348 | 0 | return true; |
349 | 0 | } |
350 | | |
351 | | namespace { |
352 | | |
353 | | /** |
354 | | * RSA private (decrypt/sign) operation |
355 | | */ |
356 | | class RSA_Private_Operation |
357 | | { |
358 | | protected: |
359 | 0 | size_t public_modulus_bits() const { return m_public->public_modulus_bits(); } |
360 | 0 | size_t public_modulus_bytes() const { return m_public->public_modulus_bytes(); } |
361 | | |
362 | | explicit RSA_Private_Operation(const RSA_PrivateKey& rsa, RandomNumberGenerator& rng) : |
363 | | m_public(rsa.public_data()), |
364 | | m_private(rsa.private_data()), |
365 | | m_blinder(m_public->get_n(), rng, |
366 | 0 | [this](const BigInt& k) { return m_public->public_op(k); }, |
367 | 0 | [this](const BigInt& k) { return inverse_mod(k, m_public->get_n()); }), |
368 | | m_blinding_bits(64), |
369 | | m_max_d1_bits(m_private->m_p_bits + m_blinding_bits), |
370 | | m_max_d2_bits(m_private->m_q_bits + m_blinding_bits) |
371 | 0 | { |
372 | 0 | } |
373 | | |
374 | | secure_vector<uint8_t> raw_op(const uint8_t input[], size_t input_len) |
375 | 0 | { |
376 | 0 | const BigInt input_bn(input, input_len); |
377 | 0 | if(input_bn >= m_public->get_n()) |
378 | 0 | throw Invalid_Argument("RSA private op - input is too large"); |
379 | 0 | |
380 | 0 | // TODO: This should be a function on blinder |
381 | 0 | // BigInt Blinder::run_blinded_function(std::function<BigInt, BigInt> fn, const BigInt& input); |
382 | 0 | |
383 | 0 | const BigInt recovered = m_blinder.unblind(rsa_private_op(m_blinder.blind(input_bn))); |
384 | 0 | BOTAN_ASSERT(input_bn == m_public->public_op(recovered), "RSA consistency check"); |
385 | 0 | return BigInt::encode_1363(recovered, m_public->public_modulus_bytes()); |
386 | 0 | } |
387 | | |
388 | | private: |
389 | | |
390 | | BigInt rsa_private_op(const BigInt& m) const |
391 | 0 | { |
392 | 0 | /* |
393 | 0 | TODO |
394 | 0 | Consider using Montgomery reduction instead of Barrett, using |
395 | 0 | the "Smooth RSA-CRT" method. https://eprint.iacr.org/2007/039.pdf |
396 | 0 | */ |
397 | 0 |
|
398 | 0 | static constexpr size_t powm_window = 4; |
399 | 0 |
|
400 | 0 | // Compute this in main thread to avoid racing on the rng |
401 | 0 | const BigInt d1_mask(m_blinder.rng(), m_blinding_bits); |
402 | 0 |
|
403 | 0 | #if defined(BOTAN_HAS_THREAD_UTILS) && !defined(BOTAN_HAS_VALGRIND) |
404 | 0 | #define BOTAN_RSA_USE_ASYNC |
405 | 0 | #endif |
406 | 0 |
|
407 | 0 | #if defined(BOTAN_RSA_USE_ASYNC) |
408 | 0 | /* |
409 | 0 | * Precompute m.sig_words in the main thread before calling async. Otherwise |
410 | 0 | * the two threads race (during Modular_Reducer::reduce) and while the output |
411 | 0 | * is correct in both threads, helgrind warns. |
412 | 0 | */ |
413 | 0 | m.sig_words(); |
414 | 0 |
|
415 | 0 | auto future_j1 = Thread_Pool::global_instance().run([this, &m, &d1_mask]() { |
416 | 0 | #endif |
417 | 0 | const BigInt masked_d1 = m_private->get_d1() + (d1_mask * (m_private->get_p() - 1)); |
418 | 0 | auto powm_d1_p = monty_precompute(m_private->m_monty_p, m_private->m_mod_p.reduce(m), powm_window); |
419 | 0 | BigInt j1 = monty_execute(*powm_d1_p, masked_d1, m_max_d1_bits); |
420 | 0 |
|
421 | 0 | #if defined(BOTAN_RSA_USE_ASYNC) |
422 | 0 | return j1; |
423 | 0 | }); |
424 | 0 | #endif |
425 | 0 |
|
426 | 0 | const BigInt d2_mask(m_blinder.rng(), m_blinding_bits); |
427 | 0 | const BigInt masked_d2 = m_private->get_d2() + (d2_mask * (m_private->get_q() - 1)); |
428 | 0 | auto powm_d2_q = monty_precompute(m_private->m_monty_q, m_private->m_mod_q.reduce(m), powm_window); |
429 | 0 | const BigInt j2 = monty_execute(*powm_d2_q, masked_d2, m_max_d2_bits); |
430 | 0 |
|
431 | 0 | #if defined(BOTAN_RSA_USE_ASYNC) |
432 | 0 | BigInt j1 = future_j1.get(); |
433 | 0 | #endif |
434 | 0 |
|
435 | 0 | /* |
436 | 0 | * To recover the final value from the CRT representation (j1,j2) |
437 | 0 | * we use Garner's algorithm: |
438 | 0 | * c = q^-1 mod p (this is precomputed) |
439 | 0 | * h = c*(j1-j2) mod p |
440 | 0 | * m = j2 + h*q |
441 | 0 | * |
442 | 0 | * We must avoid leaking if j1 >= j2 or not, as doing so allows deriving |
443 | 0 | * information about the secret prime. Do this by first adding p to j1, |
444 | 0 | * which should ensure the subtraction of j2 does not underflow. But |
445 | 0 | * this may still underflow if p and q are imbalanced in size. |
446 | 0 | */ |
447 | 0 |
|
448 | 0 | j1 = m_private->m_mod_p.multiply(m_private->m_mod_p.reduce((m_private->get_p() + j1) - j2), m_private->get_c()); |
449 | 0 | return mul_add(j1, m_private->get_q(), j2); |
450 | 0 | } |
451 | | |
452 | | std::shared_ptr<const RSA_Public_Data> m_public; |
453 | | std::shared_ptr<const RSA_Private_Data> m_private; |
454 | | |
455 | | // XXX could the blinder starting pair be shared? |
456 | | Blinder m_blinder; |
457 | | const size_t m_blinding_bits; |
458 | | const size_t m_max_d1_bits; |
459 | | const size_t m_max_d2_bits; |
460 | | }; |
461 | | |
462 | | class RSA_Signature_Operation final : public PK_Ops::Signature_with_EMSA, |
463 | | private RSA_Private_Operation |
464 | | { |
465 | | public: |
466 | 0 | size_t max_input_bits() const override { return public_modulus_bits() - 1; } |
467 | | |
468 | 0 | size_t signature_length() const override { return public_modulus_bytes(); } |
469 | | |
470 | | RSA_Signature_Operation(const RSA_PrivateKey& rsa, const std::string& emsa, RandomNumberGenerator& rng) : |
471 | | PK_Ops::Signature_with_EMSA(emsa), |
472 | | RSA_Private_Operation(rsa, rng) |
473 | 0 | { |
474 | 0 | } |
475 | | |
476 | | secure_vector<uint8_t> raw_sign(const uint8_t input[], size_t input_len, |
477 | | RandomNumberGenerator&) override |
478 | 0 | { |
479 | 0 | return raw_op(input, input_len); |
480 | 0 | } |
481 | | }; |
482 | | |
483 | | class RSA_Decryption_Operation final : public PK_Ops::Decryption_with_EME, |
484 | | private RSA_Private_Operation |
485 | | { |
486 | | public: |
487 | | |
488 | | RSA_Decryption_Operation(const RSA_PrivateKey& rsa, const std::string& eme, RandomNumberGenerator& rng) : |
489 | | PK_Ops::Decryption_with_EME(eme), |
490 | | RSA_Private_Operation(rsa, rng) |
491 | 0 | { |
492 | 0 | } |
493 | | |
494 | 0 | size_t plaintext_length(size_t) const override { return public_modulus_bytes(); } |
495 | | |
496 | | secure_vector<uint8_t> raw_decrypt(const uint8_t input[], size_t input_len) override |
497 | 0 | { |
498 | 0 | return raw_op(input, input_len); |
499 | 0 | } |
500 | | }; |
501 | | |
502 | | class RSA_KEM_Decryption_Operation final : public PK_Ops::KEM_Decryption_with_KDF, |
503 | | private RSA_Private_Operation |
504 | | { |
505 | | public: |
506 | | |
507 | | RSA_KEM_Decryption_Operation(const RSA_PrivateKey& key, |
508 | | const std::string& kdf, |
509 | | RandomNumberGenerator& rng) : |
510 | | PK_Ops::KEM_Decryption_with_KDF(kdf), |
511 | | RSA_Private_Operation(key, rng) |
512 | 0 | {} |
513 | | |
514 | | secure_vector<uint8_t> |
515 | | raw_kem_decrypt(const uint8_t encap_key[], size_t len) override |
516 | 0 | { |
517 | 0 | return raw_op(encap_key, len); |
518 | 0 | } |
519 | | }; |
520 | | |
521 | | /** |
522 | | * RSA public (encrypt/verify) operation |
523 | | */ |
524 | | class RSA_Public_Operation |
525 | | { |
526 | | public: |
527 | | explicit RSA_Public_Operation(const RSA_PublicKey& rsa) : |
528 | | m_public(rsa.public_data()) |
529 | 5.77k | {} |
530 | | |
531 | | size_t get_max_input_bits() const |
532 | 5.70k | { |
533 | 5.70k | const size_t n_bits = m_public->public_modulus_bits(); |
534 | 5.70k | |
535 | 5.70k | /* |
536 | 5.70k | Make Coverity happy that n_bits - 1 won't underflow |
537 | 5.70k | |
538 | 5.70k | 5 bit minimum: smallest possible RSA key is 3*5 |
539 | 5.70k | */ |
540 | 5.70k | BOTAN_ASSERT_NOMSG(n_bits >= 5); |
541 | 5.70k | return n_bits - 1; |
542 | 5.70k | } |
543 | | |
544 | | protected: |
545 | | BigInt public_op(const BigInt& m) const |
546 | 5.77k | { |
547 | 5.77k | if(m >= m_public->get_n()) |
548 | 74 | throw Invalid_Argument("RSA public op - input is too large"); |
549 | 5.69k | |
550 | 5.69k | return m_public->public_op(m); |
551 | 5.69k | } |
552 | | |
553 | 52 | size_t public_modulus_bytes() const { return m_public->public_modulus_bytes(); } |
554 | | |
555 | 0 | const BigInt& get_n() const { return m_public->get_n(); } |
556 | | |
557 | | std::shared_ptr<const RSA_Public_Data> m_public; |
558 | | }; |
559 | | |
560 | | class RSA_Encryption_Operation final : public PK_Ops::Encryption_with_EME, |
561 | | private RSA_Public_Operation |
562 | | { |
563 | | public: |
564 | | |
565 | | RSA_Encryption_Operation(const RSA_PublicKey& rsa, const std::string& eme) : |
566 | | PK_Ops::Encryption_with_EME(eme), |
567 | | RSA_Public_Operation(rsa) |
568 | 55 | { |
569 | 55 | } |
570 | | |
571 | 0 | size_t ciphertext_length(size_t) const override { return public_modulus_bytes(); } |
572 | | |
573 | 55 | size_t max_raw_input_bits() const override { return get_max_input_bits(); } |
574 | | |
575 | | secure_vector<uint8_t> raw_encrypt(const uint8_t input[], size_t input_len, |
576 | | RandomNumberGenerator&) override |
577 | 52 | { |
578 | 52 | BigInt input_bn(input, input_len); |
579 | 52 | return BigInt::encode_1363(public_op(input_bn), public_modulus_bytes()); |
580 | 52 | } |
581 | | }; |
582 | | |
583 | | class RSA_Verify_Operation final : public PK_Ops::Verification_with_EMSA, |
584 | | private RSA_Public_Operation |
585 | | { |
586 | | public: |
587 | | |
588 | 5.64k | size_t max_input_bits() const override { return get_max_input_bits(); } |
589 | | |
590 | | RSA_Verify_Operation(const RSA_PublicKey& rsa, const std::string& emsa) : |
591 | | PK_Ops::Verification_with_EMSA(emsa), |
592 | | RSA_Public_Operation(rsa) |
593 | 5.72k | { |
594 | 5.72k | } |
595 | | |
596 | 5.72k | bool with_recovery() const override { return true; } |
597 | | |
598 | | secure_vector<uint8_t> verify_mr(const uint8_t input[], size_t input_len) override |
599 | 5.72k | { |
600 | 5.72k | BigInt input_bn(input, input_len); |
601 | 5.72k | return BigInt::encode_locked(public_op(input_bn)); |
602 | 5.72k | } |
603 | | }; |
604 | | |
605 | | class RSA_KEM_Encryption_Operation final : public PK_Ops::KEM_Encryption_with_KDF, |
606 | | private RSA_Public_Operation |
607 | | { |
608 | | public: |
609 | | |
610 | | RSA_KEM_Encryption_Operation(const RSA_PublicKey& key, |
611 | | const std::string& kdf) : |
612 | | PK_Ops::KEM_Encryption_with_KDF(kdf), |
613 | 0 | RSA_Public_Operation(key) {} |
614 | | |
615 | | private: |
616 | | void raw_kem_encrypt(secure_vector<uint8_t>& out_encapsulated_key, |
617 | | secure_vector<uint8_t>& raw_shared_key, |
618 | | Botan::RandomNumberGenerator& rng) override |
619 | 0 | { |
620 | 0 | const BigInt r = BigInt::random_integer(rng, 1, get_n()); |
621 | 0 | const BigInt c = public_op(r); |
622 | 0 |
|
623 | 0 | out_encapsulated_key = BigInt::encode_locked(c); |
624 | 0 | raw_shared_key = BigInt::encode_locked(r); |
625 | 0 | } |
626 | | }; |
627 | | |
628 | | } |
629 | | |
630 | | std::unique_ptr<PK_Ops::Encryption> |
631 | | RSA_PublicKey::create_encryption_op(RandomNumberGenerator& /*rng*/, |
632 | | const std::string& params, |
633 | | const std::string& provider) const |
634 | 55 | { |
635 | | #if defined(BOTAN_HAS_OPENSSL) |
636 | | if(provider == "openssl" || provider.empty()) |
637 | | { |
638 | | try |
639 | | { |
640 | | return make_openssl_rsa_enc_op(*this, params); |
641 | | } |
642 | | catch(Exception& e) |
643 | | { |
644 | | /* |
645 | | * If OpenSSL for some reason could not handle this (eg due to OAEP params), |
646 | | * throw if openssl was specifically requested but otherwise just fall back |
647 | | * to the normal version. |
648 | | */ |
649 | | if(provider == "openssl") |
650 | | throw Lookup_Error("OpenSSL RSA provider rejected key:" + std::string(e.what())); |
651 | | } |
652 | | } |
653 | | #endif |
654 | | |
655 | 55 | if(provider == "base" || provider.empty()) |
656 | 55 | return std::unique_ptr<PK_Ops::Encryption>(new RSA_Encryption_Operation(*this, params)); |
657 | 0 | throw Provider_Not_Found(algo_name(), provider); |
658 | 0 | } |
659 | | |
660 | | std::unique_ptr<PK_Ops::KEM_Encryption> |
661 | | RSA_PublicKey::create_kem_encryption_op(RandomNumberGenerator& /*rng*/, |
662 | | const std::string& params, |
663 | | const std::string& provider) const |
664 | 0 | { |
665 | 0 | if(provider == "base" || provider.empty()) |
666 | 0 | return std::unique_ptr<PK_Ops::KEM_Encryption>(new RSA_KEM_Encryption_Operation(*this, params)); |
667 | 0 | throw Provider_Not_Found(algo_name(), provider); |
668 | 0 | } |
669 | | |
670 | | std::unique_ptr<PK_Ops::Verification> |
671 | | RSA_PublicKey::create_verification_op(const std::string& params, |
672 | | const std::string& provider) const |
673 | 5.72k | { |
674 | | #if defined(BOTAN_HAS_OPENSSL) |
675 | | if(provider == "openssl" || provider.empty()) |
676 | | { |
677 | | std::unique_ptr<PK_Ops::Verification> res = make_openssl_rsa_ver_op(*this, params); |
678 | | if(res) |
679 | | return res; |
680 | | } |
681 | | #endif |
682 | | |
683 | 5.72k | if(provider == "base" || provider.empty()) |
684 | 5.72k | return std::unique_ptr<PK_Ops::Verification>(new RSA_Verify_Operation(*this, params)); |
685 | 0 | |
686 | 0 | throw Provider_Not_Found(algo_name(), provider); |
687 | 0 | } |
688 | | |
689 | | std::unique_ptr<PK_Ops::Decryption> |
690 | | RSA_PrivateKey::create_decryption_op(RandomNumberGenerator& rng, |
691 | | const std::string& params, |
692 | | const std::string& provider) const |
693 | 0 | { |
694 | | #if defined(BOTAN_HAS_OPENSSL) |
695 | | if(provider == "openssl" || provider.empty()) |
696 | | { |
697 | | try |
698 | | { |
699 | | return make_openssl_rsa_dec_op(*this, params); |
700 | | } |
701 | | catch(Exception& e) |
702 | | { |
703 | | if(provider == "openssl") |
704 | | throw Lookup_Error("OpenSSL RSA provider rejected key:" + std::string(e.what())); |
705 | | } |
706 | | } |
707 | | #endif |
708 | |
|
709 | 0 | if(provider == "base" || provider.empty()) |
710 | 0 | return std::unique_ptr<PK_Ops::Decryption>(new RSA_Decryption_Operation(*this, params, rng)); |
711 | 0 | |
712 | 0 | throw Provider_Not_Found(algo_name(), provider); |
713 | 0 | } |
714 | | |
715 | | std::unique_ptr<PK_Ops::KEM_Decryption> |
716 | | RSA_PrivateKey::create_kem_decryption_op(RandomNumberGenerator& rng, |
717 | | const std::string& params, |
718 | | const std::string& provider) const |
719 | 0 | { |
720 | 0 | if(provider == "base" || provider.empty()) |
721 | 0 | return std::unique_ptr<PK_Ops::KEM_Decryption>(new RSA_KEM_Decryption_Operation(*this, params, rng)); |
722 | 0 | |
723 | 0 | throw Provider_Not_Found(algo_name(), provider); |
724 | 0 | } |
725 | | |
726 | | std::unique_ptr<PK_Ops::Signature> |
727 | | RSA_PrivateKey::create_signature_op(RandomNumberGenerator& rng, |
728 | | const std::string& params, |
729 | | const std::string& provider) const |
730 | 0 | { |
731 | | #if defined(BOTAN_HAS_OPENSSL) |
732 | | if(provider == "openssl" || provider.empty()) |
733 | | { |
734 | | std::unique_ptr<PK_Ops::Signature> res = make_openssl_rsa_sig_op(*this, params); |
735 | | if(res) |
736 | | return res; |
737 | | } |
738 | | #endif |
739 | |
|
740 | 0 | if(provider == "base" || provider.empty()) |
741 | 0 | return std::unique_ptr<PK_Ops::Signature>(new RSA_Signature_Operation(*this, params, rng)); |
742 | 0 | |
743 | 0 | throw Provider_Not_Found(algo_name(), provider); |
744 | 0 | } |
745 | | |
746 | | } |