/src/openssl/crypto/rsa/rsa_backend.c
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * Copyright 2020-2024 The OpenSSL Project Authors. All Rights Reserved. |
3 | | * |
4 | | * Licensed under the Apache License 2.0 (the "License"). You may not use |
5 | | * this file except in compliance with the License. You can obtain a copy |
6 | | * in the file LICENSE in the source distribution or at |
7 | | * https://www.openssl.org/source/license.html |
8 | | */ |
9 | | |
10 | | /* |
11 | | * RSA low level APIs are deprecated for public use, but still ok for |
12 | | * internal use. |
13 | | */ |
14 | | #include "internal/deprecated.h" |
15 | | |
16 | | #include <string.h> |
17 | | #include <openssl/core_names.h> |
18 | | #include <openssl/params.h> |
19 | | #include <openssl/err.h> |
20 | | #include <openssl/evp.h> |
21 | | #ifndef FIPS_MODULE |
22 | | # include <openssl/x509.h> |
23 | | # include "crypto/asn1.h" |
24 | | #endif |
25 | | #include "internal/sizes.h" |
26 | | #include "internal/param_build_set.h" |
27 | | #include "crypto/rsa.h" |
28 | | #include "rsa_local.h" |
29 | | |
30 | | /* |
31 | | * The intention with the "backend" source file is to offer backend support |
32 | | * for legacy backends (EVP_PKEY_ASN1_METHOD and EVP_PKEY_METHOD) and provider |
33 | | * implementations alike. |
34 | | */ |
35 | | |
36 | | DEFINE_STACK_OF(BIGNUM) |
37 | | |
38 | | static int collect_numbers(STACK_OF(BIGNUM) *numbers, |
39 | | const OSSL_PARAM params[], const char *names[]) |
40 | 0 | { |
41 | 0 | const OSSL_PARAM *p = NULL; |
42 | 0 | int i; |
43 | |
|
44 | 0 | if (numbers == NULL) |
45 | 0 | return 0; |
46 | | |
47 | 0 | for (i = 0; names[i] != NULL; i++) { |
48 | 0 | p = OSSL_PARAM_locate_const(params, names[i]); |
49 | 0 | if (p != NULL) { |
50 | 0 | BIGNUM *tmp = NULL; |
51 | |
|
52 | 0 | if (!OSSL_PARAM_get_BN(p, &tmp)) |
53 | 0 | return 0; |
54 | 0 | if (sk_BIGNUM_push(numbers, tmp) == 0) { |
55 | 0 | BN_clear_free(tmp); |
56 | 0 | return 0; |
57 | 0 | } |
58 | 0 | } |
59 | 0 | } |
60 | | |
61 | 0 | return 1; |
62 | 0 | } |
63 | | |
64 | | int ossl_rsa_fromdata(RSA *rsa, const OSSL_PARAM params[], int include_private) |
65 | 0 | { |
66 | 0 | const OSSL_PARAM *param_n, *param_e, *param_d = NULL; |
67 | 0 | const OSSL_PARAM *param_p, *param_q = NULL; |
68 | 0 | const OSSL_PARAM *param_derive = NULL; |
69 | 0 | BIGNUM *p = NULL, *q = NULL, *n = NULL, *e = NULL, *d = NULL; |
70 | 0 | STACK_OF(BIGNUM) *factors = NULL, *exps = NULL, *coeffs = NULL; |
71 | 0 | int is_private = 0; |
72 | 0 | int derive_from_pq = 0; |
73 | 0 | BN_CTX *ctx = NULL; |
74 | |
|
75 | 0 | if (rsa == NULL) |
76 | 0 | return 0; |
77 | | |
78 | 0 | param_n = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_RSA_N); |
79 | 0 | param_e = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_RSA_E); |
80 | |
|
81 | 0 | if ((param_n == NULL || !OSSL_PARAM_get_BN(param_n, &n)) |
82 | 0 | || (param_e == NULL || !OSSL_PARAM_get_BN(param_e, &e))) { |
83 | 0 | ERR_raise(ERR_LIB_RSA, ERR_R_PASSED_NULL_PARAMETER); |
84 | 0 | goto err; |
85 | 0 | } |
86 | | |
87 | 0 | if (include_private) { |
88 | |
|
89 | 0 | param_derive = OSSL_PARAM_locate_const(params, |
90 | 0 | OSSL_PKEY_PARAM_RSA_DERIVE_FROM_PQ); |
91 | 0 | if ((param_derive != NULL) |
92 | 0 | && !OSSL_PARAM_get_int(param_derive, &derive_from_pq)) |
93 | 0 | goto err; |
94 | | |
95 | 0 | param_d = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_RSA_D); |
96 | 0 | if (param_d != NULL && !OSSL_PARAM_get_BN(param_d, &d)) { |
97 | 0 | ERR_raise(ERR_LIB_RSA, ERR_R_PASSED_NULL_PARAMETER); |
98 | 0 | goto err; |
99 | 0 | } |
100 | | |
101 | 0 | if (derive_from_pq) { |
102 | 0 | ctx = BN_CTX_new_ex(rsa->libctx); |
103 | 0 | if (ctx == NULL) |
104 | 0 | goto err; |
105 | | |
106 | | /* we need at minimum p, q */ |
107 | 0 | param_p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_RSA_FACTOR1); |
108 | 0 | param_q = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_RSA_FACTOR2); |
109 | 0 | if ((param_p == NULL || !OSSL_PARAM_get_BN(param_p, &p)) |
110 | 0 | || (param_q == NULL || !OSSL_PARAM_get_BN(param_q, &q))) { |
111 | 0 | ERR_raise(ERR_LIB_RSA, ERR_R_PASSED_NULL_PARAMETER); |
112 | 0 | goto err; |
113 | 0 | } |
114 | |
|
115 | 0 | } |
116 | 0 | } |
117 | | |
118 | 0 | is_private = (d != NULL); |
119 | |
|
120 | 0 | if (!RSA_set0_key(rsa, n, e, d)) |
121 | 0 | goto err; |
122 | 0 | n = e = d = NULL; |
123 | |
|
124 | 0 | if (is_private) { |
125 | 0 | if (!collect_numbers(factors = sk_BIGNUM_new_null(), params, |
126 | 0 | ossl_rsa_mp_factor_names) |
127 | 0 | || !collect_numbers(exps = sk_BIGNUM_new_null(), params, |
128 | 0 | ossl_rsa_mp_exp_names) |
129 | 0 | || !collect_numbers(coeffs = sk_BIGNUM_new_null(), params, |
130 | 0 | ossl_rsa_mp_coeff_names)) |
131 | 0 | goto err; |
132 | | |
133 | 0 | if (derive_from_pq && sk_BIGNUM_num(exps) == 0 |
134 | 0 | && sk_BIGNUM_num(coeffs) == 0) { |
135 | | /* |
136 | | * If we want to use crt to derive our exponents/coefficients, we |
137 | | * need to have at least 2 factors |
138 | | */ |
139 | 0 | if (sk_BIGNUM_num(factors) < 2) { |
140 | 0 | ERR_raise(ERR_LIB_RSA, ERR_R_PASSED_NULL_PARAMETER); |
141 | 0 | goto err; |
142 | 0 | } |
143 | | |
144 | | /* |
145 | | * if we have more than two factors, n and d must also have |
146 | | * been provided |
147 | | */ |
148 | 0 | if (sk_BIGNUM_num(factors) > 2 |
149 | 0 | && (param_n == NULL || param_d == NULL)) { |
150 | 0 | ERR_raise(ERR_LIB_RSA, ERR_R_PASSED_NULL_PARAMETER); |
151 | 0 | goto err; |
152 | 0 | } |
153 | | |
154 | | /* build our exponents and coefficients here */ |
155 | 0 | if (sk_BIGNUM_num(factors) == 2) { |
156 | | /* for 2 factors we can use the sp800 functions to do this */ |
157 | 0 | if (!RSA_set0_factors(rsa, sk_BIGNUM_value(factors, 0), |
158 | 0 | sk_BIGNUM_value(factors, 1))) { |
159 | 0 | ERR_raise(ERR_LIB_RSA, ERR_R_INTERNAL_ERROR); |
160 | 0 | goto err; |
161 | 0 | } |
162 | | /* |
163 | | * once consumed by RSA_set0_factors, pop those off the stack |
164 | | * so we don't free them below |
165 | | */ |
166 | 0 | sk_BIGNUM_pop(factors); |
167 | 0 | sk_BIGNUM_pop(factors); |
168 | | |
169 | | /* |
170 | | * Note: Because we only have 2 factors here, there will be no |
171 | | * additional pinfo fields to hold additional factors, and |
172 | | * since we set our key and 2 factors above we can skip |
173 | | * the call to ossl_rsa_set0_all_params |
174 | | */ |
175 | 0 | if (!ossl_rsa_sp800_56b_derive_params_from_pq(rsa, |
176 | 0 | RSA_bits(rsa), |
177 | 0 | NULL, ctx)) { |
178 | 0 | ERR_raise(ERR_LIB_RSA, ERR_R_INTERNAL_ERROR); |
179 | 0 | goto err; |
180 | 0 | } |
181 | 0 | } else { |
182 | 0 | #ifndef FIPS_MODULE |
183 | | /* |
184 | | * in the multiprime case we have to generate exps/coeffs here |
185 | | * for each additional prime |
186 | | */ |
187 | 0 | if (!ossl_rsa_multiprime_derive(rsa, RSA_bits(rsa), |
188 | 0 | sk_BIGNUM_num(factors), |
189 | 0 | rsa->e, factors, exps, |
190 | 0 | coeffs)) { |
191 | 0 | ERR_raise(ERR_LIB_RSA, ERR_R_INTERNAL_ERROR); |
192 | 0 | goto err; |
193 | 0 | } |
194 | | |
195 | | /* |
196 | | * Now we should have all our factors, exponents and |
197 | | * coefficients |
198 | | */ |
199 | 0 | if (!ossl_rsa_set0_all_params(rsa, factors, exps, coeffs)) { |
200 | 0 | ERR_raise(ERR_LIB_RSA, ERR_R_INTERNAL_ERROR); |
201 | 0 | goto err; |
202 | 0 | } |
203 | |
|
204 | | #else |
205 | | /* multiprime case is disallowed in FIPS mode, raise an error */ |
206 | | ERR_raise(ERR_LIB_RSA, ERR_R_UNSUPPORTED); |
207 | | goto err; |
208 | | #endif |
209 | 0 | } |
210 | |
|
211 | 0 | } else { |
212 | | /* |
213 | | * It's ok if this private key just has n, e and d |
214 | | * but only if we're not using derive_from_pq |
215 | | */ |
216 | 0 | if (sk_BIGNUM_num(factors) != 0 |
217 | 0 | && !ossl_rsa_set0_all_params(rsa, factors, exps, coeffs)) |
218 | 0 | goto err; |
219 | 0 | } |
220 | | /* sanity check to ensure we used everything in our stacks */ |
221 | 0 | if (sk_BIGNUM_num(factors) != 0 |
222 | 0 | || sk_BIGNUM_num(exps) != 0 |
223 | 0 | || sk_BIGNUM_num(coeffs) != 0) { |
224 | 0 | ERR_raise_data(ERR_LIB_RSA, ERR_R_INTERNAL_ERROR, |
225 | 0 | "There are %d, %d, %d elements left on our factors, exps, coeffs stacks\n", |
226 | 0 | sk_BIGNUM_num(factors), sk_BIGNUM_num(exps), |
227 | 0 | sk_BIGNUM_num(coeffs)); |
228 | 0 | goto err; |
229 | 0 | } |
230 | 0 | } |
231 | | |
232 | 0 | if (!ossl_rsa_check_factors(rsa)) { |
233 | 0 | ERR_raise_data(ERR_LIB_RSA, RSA_R_INVALID_KEYPAIR, |
234 | 0 | "RSA factors/exponents are too big for for n-modulus\n"); |
235 | 0 | goto err; |
236 | 0 | } |
237 | | |
238 | 0 | BN_clear_free(p); |
239 | 0 | BN_clear_free(q); |
240 | 0 | sk_BIGNUM_free(factors); |
241 | 0 | sk_BIGNUM_free(exps); |
242 | 0 | sk_BIGNUM_free(coeffs); |
243 | 0 | BN_CTX_free(ctx); |
244 | 0 | return 1; |
245 | | |
246 | 0 | err: |
247 | 0 | BN_free(n); |
248 | 0 | BN_free(e); |
249 | 0 | BN_free(d); |
250 | 0 | sk_BIGNUM_pop_free(factors, BN_clear_free); |
251 | 0 | sk_BIGNUM_pop_free(exps, BN_clear_free); |
252 | 0 | sk_BIGNUM_pop_free(coeffs, BN_clear_free); |
253 | 0 | BN_CTX_free(ctx); |
254 | 0 | return 0; |
255 | 0 | } |
256 | | |
257 | | DEFINE_SPECIAL_STACK_OF_CONST(BIGNUM_const, BIGNUM) |
258 | | |
259 | | int ossl_rsa_todata(RSA *rsa, OSSL_PARAM_BLD *bld, OSSL_PARAM params[], |
260 | | int include_private) |
261 | 0 | { |
262 | 0 | int ret = 0; |
263 | 0 | const BIGNUM *rsa_d = NULL, *rsa_n = NULL, *rsa_e = NULL; |
264 | 0 | STACK_OF(BIGNUM_const) *factors = sk_BIGNUM_const_new_null(); |
265 | 0 | STACK_OF(BIGNUM_const) *exps = sk_BIGNUM_const_new_null(); |
266 | 0 | STACK_OF(BIGNUM_const) *coeffs = sk_BIGNUM_const_new_null(); |
267 | |
|
268 | 0 | if (rsa == NULL || factors == NULL || exps == NULL || coeffs == NULL) |
269 | 0 | goto err; |
270 | | |
271 | 0 | RSA_get0_key(rsa, &rsa_n, &rsa_e, &rsa_d); |
272 | 0 | ossl_rsa_get0_all_params(rsa, factors, exps, coeffs); |
273 | |
|
274 | 0 | if (!ossl_param_build_set_bn(bld, params, OSSL_PKEY_PARAM_RSA_N, rsa_n) |
275 | 0 | || !ossl_param_build_set_bn(bld, params, OSSL_PKEY_PARAM_RSA_E, rsa_e)) |
276 | 0 | goto err; |
277 | | |
278 | | /* Check private key data integrity */ |
279 | 0 | if (include_private && rsa_d != NULL) { |
280 | |
|
281 | 0 | if (!ossl_param_build_set_bn(bld, params, OSSL_PKEY_PARAM_RSA_D, |
282 | 0 | rsa_d) |
283 | 0 | || !ossl_param_build_set_multi_key_bn(bld, params, |
284 | 0 | ossl_rsa_mp_factor_names, |
285 | 0 | factors) |
286 | 0 | || !ossl_param_build_set_multi_key_bn(bld, params, |
287 | 0 | ossl_rsa_mp_exp_names, exps) |
288 | 0 | || !ossl_param_build_set_multi_key_bn(bld, params, |
289 | 0 | ossl_rsa_mp_coeff_names, |
290 | 0 | coeffs)) |
291 | 0 | goto err; |
292 | 0 | } |
293 | | |
294 | | #if defined(FIPS_MODULE) && !defined(OPENSSL_NO_ACVP_TESTS) |
295 | | /* The acvp test results are not meant for export so check for bld == NULL */ |
296 | | if (bld == NULL) |
297 | | ossl_rsa_acvp_test_get_params(rsa, params); |
298 | | #endif |
299 | 0 | ret = 1; |
300 | 0 | err: |
301 | 0 | sk_BIGNUM_const_free(factors); |
302 | 0 | sk_BIGNUM_const_free(exps); |
303 | 0 | sk_BIGNUM_const_free(coeffs); |
304 | 0 | return ret; |
305 | 0 | } |
306 | | |
307 | | int ossl_rsa_pss_params_30_todata(const RSA_PSS_PARAMS_30 *pss, |
308 | | OSSL_PARAM_BLD *bld, OSSL_PARAM params[]) |
309 | 0 | { |
310 | 0 | if (!ossl_rsa_pss_params_30_is_unrestricted(pss)) { |
311 | 0 | int hashalg_nid = ossl_rsa_pss_params_30_hashalg(pss); |
312 | 0 | int maskgenalg_nid = ossl_rsa_pss_params_30_maskgenalg(pss); |
313 | 0 | int maskgenhashalg_nid = ossl_rsa_pss_params_30_maskgenhashalg(pss); |
314 | 0 | int saltlen = ossl_rsa_pss_params_30_saltlen(pss); |
315 | 0 | int default_hashalg_nid = ossl_rsa_pss_params_30_hashalg(NULL); |
316 | 0 | int default_maskgenalg_nid = ossl_rsa_pss_params_30_maskgenalg(NULL); |
317 | 0 | int default_maskgenhashalg_nid = |
318 | 0 | ossl_rsa_pss_params_30_maskgenhashalg(NULL); |
319 | 0 | const char *mdname = |
320 | 0 | (hashalg_nid == default_hashalg_nid |
321 | 0 | ? NULL : ossl_rsa_oaeppss_nid2name(hashalg_nid)); |
322 | 0 | const char *mgfname = |
323 | 0 | (maskgenalg_nid == default_maskgenalg_nid |
324 | 0 | ? NULL : ossl_rsa_oaeppss_nid2name(maskgenalg_nid)); |
325 | 0 | const char *mgf1mdname = |
326 | 0 | (maskgenhashalg_nid == default_maskgenhashalg_nid |
327 | 0 | ? NULL : ossl_rsa_oaeppss_nid2name(maskgenhashalg_nid)); |
328 | 0 | const char *key_md = OSSL_PKEY_PARAM_RSA_DIGEST; |
329 | 0 | const char *key_mgf = OSSL_PKEY_PARAM_RSA_MASKGENFUNC; |
330 | 0 | const char *key_mgf1_md = OSSL_PKEY_PARAM_RSA_MGF1_DIGEST; |
331 | 0 | const char *key_saltlen = OSSL_PKEY_PARAM_RSA_PSS_SALTLEN; |
332 | | |
333 | | /* |
334 | | * To ensure that the key isn't seen as unrestricted by the recipient, |
335 | | * we make sure that at least one PSS-related parameter is passed, even |
336 | | * if it has a default value; saltlen. |
337 | | */ |
338 | 0 | if ((mdname != NULL |
339 | 0 | && !ossl_param_build_set_utf8_string(bld, params, key_md, mdname)) |
340 | 0 | || (mgfname != NULL |
341 | 0 | && !ossl_param_build_set_utf8_string(bld, params, |
342 | 0 | key_mgf, mgfname)) |
343 | 0 | || (mgf1mdname != NULL |
344 | 0 | && !ossl_param_build_set_utf8_string(bld, params, |
345 | 0 | key_mgf1_md, mgf1mdname)) |
346 | 0 | || (!ossl_param_build_set_int(bld, params, key_saltlen, saltlen))) |
347 | 0 | return 0; |
348 | 0 | } |
349 | 0 | return 1; |
350 | 0 | } |
351 | | |
352 | | int ossl_rsa_pss_params_30_fromdata(RSA_PSS_PARAMS_30 *pss_params, |
353 | | int *defaults_set, |
354 | | const OSSL_PARAM params[], |
355 | | OSSL_LIB_CTX *libctx) |
356 | 0 | { |
357 | 0 | const OSSL_PARAM *param_md, *param_mgf, *param_mgf1md, *param_saltlen; |
358 | 0 | const OSSL_PARAM *param_propq; |
359 | 0 | const char *propq = NULL; |
360 | 0 | EVP_MD *md = NULL, *mgf1md = NULL; |
361 | 0 | int saltlen; |
362 | 0 | int ret = 0; |
363 | |
|
364 | 0 | if (pss_params == NULL) |
365 | 0 | return 0; |
366 | 0 | param_propq = |
367 | 0 | OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_RSA_DIGEST_PROPS); |
368 | 0 | param_md = |
369 | 0 | OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_RSA_DIGEST); |
370 | 0 | param_mgf = |
371 | 0 | OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_RSA_MASKGENFUNC); |
372 | 0 | param_mgf1md = |
373 | 0 | OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_RSA_MGF1_DIGEST); |
374 | 0 | param_saltlen = |
375 | 0 | OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_RSA_PSS_SALTLEN); |
376 | |
|
377 | 0 | if (param_propq != NULL) { |
378 | 0 | if (param_propq->data_type == OSSL_PARAM_UTF8_STRING) |
379 | 0 | propq = param_propq->data; |
380 | 0 | } |
381 | | /* |
382 | | * If we get any of the parameters, we know we have at least some |
383 | | * restrictions, so we start by setting default values, and let each |
384 | | * parameter override their specific restriction data. |
385 | | */ |
386 | 0 | if (!*defaults_set |
387 | 0 | && (param_md != NULL || param_mgf != NULL || param_mgf1md != NULL |
388 | 0 | || param_saltlen != NULL)) { |
389 | 0 | if (!ossl_rsa_pss_params_30_set_defaults(pss_params)) |
390 | 0 | return 0; |
391 | 0 | *defaults_set = 1; |
392 | 0 | } |
393 | | |
394 | 0 | if (param_mgf != NULL) { |
395 | 0 | int default_maskgenalg_nid = ossl_rsa_pss_params_30_maskgenalg(NULL); |
396 | 0 | const char *mgfname = NULL; |
397 | |
|
398 | 0 | if (param_mgf->data_type == OSSL_PARAM_UTF8_STRING) |
399 | 0 | mgfname = param_mgf->data; |
400 | 0 | else if (!OSSL_PARAM_get_utf8_ptr(param_mgf, &mgfname)) |
401 | 0 | return 0; |
402 | | |
403 | 0 | if (OPENSSL_strcasecmp(param_mgf->data, |
404 | 0 | ossl_rsa_mgf_nid2name(default_maskgenalg_nid)) != 0) |
405 | 0 | return 0; |
406 | 0 | } |
407 | | |
408 | | /* |
409 | | * We're only interested in the NIDs that correspond to the MDs, so the |
410 | | * exact propquery is unimportant in the EVP_MD_fetch() calls below. |
411 | | */ |
412 | | |
413 | 0 | if (param_md != NULL) { |
414 | 0 | const char *mdname = NULL; |
415 | |
|
416 | 0 | if (param_md->data_type == OSSL_PARAM_UTF8_STRING) |
417 | 0 | mdname = param_md->data; |
418 | 0 | else if (!OSSL_PARAM_get_utf8_ptr(param_mgf, &mdname)) |
419 | 0 | goto err; |
420 | | |
421 | 0 | if ((md = EVP_MD_fetch(libctx, mdname, propq)) == NULL |
422 | 0 | || !ossl_rsa_pss_params_30_set_hashalg(pss_params, |
423 | 0 | ossl_rsa_oaeppss_md2nid(md))) |
424 | 0 | goto err; |
425 | 0 | } |
426 | | |
427 | 0 | if (param_mgf1md != NULL) { |
428 | 0 | const char *mgf1mdname = NULL; |
429 | |
|
430 | 0 | if (param_mgf1md->data_type == OSSL_PARAM_UTF8_STRING) |
431 | 0 | mgf1mdname = param_mgf1md->data; |
432 | 0 | else if (!OSSL_PARAM_get_utf8_ptr(param_mgf, &mgf1mdname)) |
433 | 0 | goto err; |
434 | | |
435 | 0 | if ((mgf1md = EVP_MD_fetch(libctx, mgf1mdname, propq)) == NULL |
436 | 0 | || !ossl_rsa_pss_params_30_set_maskgenhashalg( |
437 | 0 | pss_params, ossl_rsa_oaeppss_md2nid(mgf1md))) |
438 | 0 | goto err; |
439 | 0 | } |
440 | | |
441 | 0 | if (param_saltlen != NULL) { |
442 | 0 | if (!OSSL_PARAM_get_int(param_saltlen, &saltlen) |
443 | 0 | || !ossl_rsa_pss_params_30_set_saltlen(pss_params, saltlen)) |
444 | 0 | goto err; |
445 | 0 | } |
446 | | |
447 | 0 | ret = 1; |
448 | |
|
449 | 0 | err: |
450 | 0 | EVP_MD_free(md); |
451 | 0 | EVP_MD_free(mgf1md); |
452 | 0 | return ret; |
453 | 0 | } |
454 | | |
455 | | int ossl_rsa_is_foreign(const RSA *rsa) |
456 | 0 | { |
457 | 0 | #ifndef FIPS_MODULE |
458 | 0 | if (rsa->engine != NULL || RSA_get_method(rsa) != RSA_PKCS1_OpenSSL()) |
459 | 0 | return 1; |
460 | 0 | #endif |
461 | 0 | return 0; |
462 | 0 | } |
463 | | |
464 | | static ossl_inline int rsa_bn_dup_check(BIGNUM **out, const BIGNUM *f) |
465 | 0 | { |
466 | 0 | if (f != NULL && (*out = BN_dup(f)) == NULL) |
467 | 0 | return 0; |
468 | 0 | return 1; |
469 | 0 | } |
470 | | |
471 | | RSA *ossl_rsa_dup(const RSA *rsa, int selection) |
472 | 0 | { |
473 | 0 | RSA *dupkey = NULL; |
474 | 0 | #ifndef FIPS_MODULE |
475 | 0 | int pnum, i; |
476 | 0 | #endif |
477 | | |
478 | | /* Do not try to duplicate foreign RSA keys */ |
479 | 0 | if (ossl_rsa_is_foreign(rsa)) |
480 | 0 | return NULL; |
481 | | |
482 | 0 | if ((dupkey = ossl_rsa_new_with_ctx(rsa->libctx)) == NULL) |
483 | 0 | return NULL; |
484 | | |
485 | | /* public key */ |
486 | 0 | if ((selection & OSSL_KEYMGMT_SELECT_KEYPAIR) != 0) { |
487 | 0 | if (!rsa_bn_dup_check(&dupkey->n, rsa->n)) |
488 | 0 | goto err; |
489 | 0 | if (!rsa_bn_dup_check(&dupkey->e, rsa->e)) |
490 | 0 | goto err; |
491 | 0 | } |
492 | | |
493 | 0 | if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0) { |
494 | | |
495 | | /* private key */ |
496 | 0 | if (!rsa_bn_dup_check(&dupkey->d, rsa->d)) |
497 | 0 | goto err; |
498 | | |
499 | | /* factors and crt params */ |
500 | 0 | if (!rsa_bn_dup_check(&dupkey->p, rsa->p)) |
501 | 0 | goto err; |
502 | 0 | if (!rsa_bn_dup_check(&dupkey->q, rsa->q)) |
503 | 0 | goto err; |
504 | 0 | if (!rsa_bn_dup_check(&dupkey->dmp1, rsa->dmp1)) |
505 | 0 | goto err; |
506 | 0 | if (!rsa_bn_dup_check(&dupkey->dmq1, rsa->dmq1)) |
507 | 0 | goto err; |
508 | 0 | if (!rsa_bn_dup_check(&dupkey->iqmp, rsa->iqmp)) |
509 | 0 | goto err; |
510 | 0 | } |
511 | | |
512 | 0 | dupkey->version = rsa->version; |
513 | 0 | dupkey->flags = rsa->flags; |
514 | | /* we always copy the PSS parameters regardless of selection */ |
515 | 0 | dupkey->pss_params = rsa->pss_params; |
516 | |
|
517 | 0 | #ifndef FIPS_MODULE |
518 | | /* multiprime */ |
519 | 0 | if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0 |
520 | 0 | && (pnum = sk_RSA_PRIME_INFO_num(rsa->prime_infos)) > 0) { |
521 | 0 | dupkey->prime_infos = sk_RSA_PRIME_INFO_new_reserve(NULL, pnum); |
522 | 0 | if (dupkey->prime_infos == NULL) |
523 | 0 | goto err; |
524 | 0 | for (i = 0; i < pnum; i++) { |
525 | 0 | const RSA_PRIME_INFO *pinfo = NULL; |
526 | 0 | RSA_PRIME_INFO *duppinfo = NULL; |
527 | |
|
528 | 0 | if ((duppinfo = OPENSSL_zalloc(sizeof(*duppinfo))) == NULL) |
529 | 0 | goto err; |
530 | | /* push first so cleanup in error case works */ |
531 | 0 | (void)sk_RSA_PRIME_INFO_push(dupkey->prime_infos, duppinfo); |
532 | |
|
533 | 0 | pinfo = sk_RSA_PRIME_INFO_value(rsa->prime_infos, i); |
534 | 0 | if (!rsa_bn_dup_check(&duppinfo->r, pinfo->r)) |
535 | 0 | goto err; |
536 | 0 | if (!rsa_bn_dup_check(&duppinfo->d, pinfo->d)) |
537 | 0 | goto err; |
538 | 0 | if (!rsa_bn_dup_check(&duppinfo->t, pinfo->t)) |
539 | 0 | goto err; |
540 | 0 | } |
541 | 0 | if (!ossl_rsa_multip_calc_product(dupkey)) |
542 | 0 | goto err; |
543 | 0 | } |
544 | | |
545 | 0 | if (rsa->pss != NULL) { |
546 | 0 | dupkey->pss = RSA_PSS_PARAMS_dup(rsa->pss); |
547 | 0 | if (rsa->pss->maskGenAlgorithm != NULL |
548 | 0 | && dupkey->pss->maskGenAlgorithm == NULL) { |
549 | 0 | dupkey->pss->maskHash = ossl_x509_algor_mgf1_decode(rsa->pss->maskGenAlgorithm); |
550 | 0 | if (dupkey->pss->maskHash == NULL) |
551 | 0 | goto err; |
552 | 0 | } |
553 | 0 | } |
554 | 0 | if (!CRYPTO_dup_ex_data(CRYPTO_EX_INDEX_RSA, |
555 | 0 | &dupkey->ex_data, &rsa->ex_data)) |
556 | 0 | goto err; |
557 | 0 | #endif |
558 | | |
559 | 0 | return dupkey; |
560 | | |
561 | 0 | err: |
562 | 0 | RSA_free(dupkey); |
563 | 0 | return NULL; |
564 | 0 | } |
565 | | |
566 | | #ifndef FIPS_MODULE |
567 | | RSA_PSS_PARAMS *ossl_rsa_pss_decode(const X509_ALGOR *alg) |
568 | 0 | { |
569 | 0 | RSA_PSS_PARAMS *pss; |
570 | |
|
571 | 0 | pss = ASN1_TYPE_unpack_sequence(ASN1_ITEM_rptr(RSA_PSS_PARAMS), |
572 | 0 | alg->parameter); |
573 | |
|
574 | 0 | if (pss == NULL) |
575 | 0 | return NULL; |
576 | | |
577 | 0 | if (pss->maskGenAlgorithm != NULL) { |
578 | 0 | pss->maskHash = ossl_x509_algor_mgf1_decode(pss->maskGenAlgorithm); |
579 | 0 | if (pss->maskHash == NULL) { |
580 | 0 | RSA_PSS_PARAMS_free(pss); |
581 | 0 | return NULL; |
582 | 0 | } |
583 | 0 | } |
584 | | |
585 | 0 | return pss; |
586 | 0 | } |
587 | | |
588 | | static int ossl_rsa_sync_to_pss_params_30(RSA *rsa) |
589 | 0 | { |
590 | 0 | const RSA_PSS_PARAMS *legacy_pss = NULL; |
591 | 0 | RSA_PSS_PARAMS_30 *pss = NULL; |
592 | |
|
593 | 0 | if (rsa != NULL |
594 | 0 | && (legacy_pss = RSA_get0_pss_params(rsa)) != NULL |
595 | 0 | && (pss = ossl_rsa_get0_pss_params_30(rsa)) != NULL) { |
596 | 0 | const EVP_MD *md = NULL, *mgf1md = NULL; |
597 | 0 | int md_nid, mgf1md_nid, saltlen, trailerField; |
598 | 0 | RSA_PSS_PARAMS_30 pss_params; |
599 | | |
600 | | /* |
601 | | * We don't care about the validity of the fields here, we just |
602 | | * want to synchronise values. Verifying here makes it impossible |
603 | | * to even read a key with invalid values, making it hard to test |
604 | | * a bad situation. |
605 | | * |
606 | | * Other routines use ossl_rsa_pss_get_param(), so the values will |
607 | | * be checked, eventually. |
608 | | */ |
609 | 0 | if (!ossl_rsa_pss_get_param_unverified(legacy_pss, &md, &mgf1md, |
610 | 0 | &saltlen, &trailerField)) |
611 | 0 | return 0; |
612 | 0 | md_nid = EVP_MD_get_type(md); |
613 | 0 | mgf1md_nid = EVP_MD_get_type(mgf1md); |
614 | 0 | if (!ossl_rsa_pss_params_30_set_defaults(&pss_params) |
615 | 0 | || !ossl_rsa_pss_params_30_set_hashalg(&pss_params, md_nid) |
616 | 0 | || !ossl_rsa_pss_params_30_set_maskgenhashalg(&pss_params, |
617 | 0 | mgf1md_nid) |
618 | 0 | || !ossl_rsa_pss_params_30_set_saltlen(&pss_params, saltlen) |
619 | 0 | || !ossl_rsa_pss_params_30_set_trailerfield(&pss_params, |
620 | 0 | trailerField)) |
621 | 0 | return 0; |
622 | 0 | *pss = pss_params; |
623 | 0 | } |
624 | 0 | return 1; |
625 | 0 | } |
626 | | |
627 | | int ossl_rsa_pss_get_param_unverified(const RSA_PSS_PARAMS *pss, |
628 | | const EVP_MD **pmd, const EVP_MD **pmgf1md, |
629 | | int *psaltlen, int *ptrailerField) |
630 | 0 | { |
631 | 0 | RSA_PSS_PARAMS_30 pss_params; |
632 | | |
633 | | /* Get the defaults from the ONE place */ |
634 | 0 | (void)ossl_rsa_pss_params_30_set_defaults(&pss_params); |
635 | |
|
636 | 0 | if (pss == NULL) |
637 | 0 | return 0; |
638 | 0 | *pmd = ossl_x509_algor_get_md(pss->hashAlgorithm); |
639 | 0 | if (*pmd == NULL) |
640 | 0 | return 0; |
641 | 0 | *pmgf1md = ossl_x509_algor_get_md(pss->maskHash); |
642 | 0 | if (*pmgf1md == NULL) |
643 | 0 | return 0; |
644 | 0 | if (pss->saltLength) |
645 | 0 | *psaltlen = ASN1_INTEGER_get(pss->saltLength); |
646 | 0 | else |
647 | 0 | *psaltlen = ossl_rsa_pss_params_30_saltlen(&pss_params); |
648 | 0 | if (pss->trailerField) |
649 | 0 | *ptrailerField = ASN1_INTEGER_get(pss->trailerField); |
650 | 0 | else |
651 | 0 | *ptrailerField = ossl_rsa_pss_params_30_trailerfield(&pss_params); |
652 | |
|
653 | 0 | return 1; |
654 | 0 | } |
655 | | |
656 | | int ossl_rsa_param_decode(RSA *rsa, const X509_ALGOR *alg) |
657 | 0 | { |
658 | 0 | RSA_PSS_PARAMS *pss; |
659 | 0 | const ASN1_OBJECT *algoid; |
660 | 0 | const void *algp; |
661 | 0 | int algptype; |
662 | |
|
663 | 0 | X509_ALGOR_get0(&algoid, &algptype, &algp, alg); |
664 | 0 | if (OBJ_obj2nid(algoid) != EVP_PKEY_RSA_PSS) |
665 | 0 | return 1; |
666 | 0 | if (algptype == V_ASN1_UNDEF) |
667 | 0 | return 1; |
668 | 0 | if (algptype != V_ASN1_SEQUENCE) { |
669 | 0 | ERR_raise(ERR_LIB_RSA, RSA_R_INVALID_PSS_PARAMETERS); |
670 | 0 | return 0; |
671 | 0 | } |
672 | 0 | if ((pss = ossl_rsa_pss_decode(alg)) == NULL |
673 | 0 | || !ossl_rsa_set0_pss_params(rsa, pss)) { |
674 | 0 | RSA_PSS_PARAMS_free(pss); |
675 | 0 | return 0; |
676 | 0 | } |
677 | 0 | if (!ossl_rsa_sync_to_pss_params_30(rsa)) |
678 | 0 | return 0; |
679 | 0 | return 1; |
680 | 0 | } |
681 | | |
682 | | RSA *ossl_rsa_key_from_pkcs8(const PKCS8_PRIV_KEY_INFO *p8inf, |
683 | | OSSL_LIB_CTX *libctx, const char *propq) |
684 | 0 | { |
685 | 0 | const unsigned char *p; |
686 | 0 | RSA *rsa; |
687 | 0 | int pklen; |
688 | 0 | const X509_ALGOR *alg; |
689 | |
|
690 | 0 | if (!PKCS8_pkey_get0(NULL, &p, &pklen, &alg, p8inf)) |
691 | 0 | return 0; |
692 | 0 | rsa = d2i_RSAPrivateKey(NULL, &p, pklen); |
693 | 0 | if (rsa == NULL) { |
694 | 0 | ERR_raise(ERR_LIB_RSA, ERR_R_RSA_LIB); |
695 | 0 | return NULL; |
696 | 0 | } |
697 | 0 | if (!ossl_rsa_param_decode(rsa, alg)) { |
698 | 0 | RSA_free(rsa); |
699 | 0 | return NULL; |
700 | 0 | } |
701 | | |
702 | 0 | RSA_clear_flags(rsa, RSA_FLAG_TYPE_MASK); |
703 | 0 | switch (OBJ_obj2nid(alg->algorithm)) { |
704 | 0 | case EVP_PKEY_RSA: |
705 | 0 | RSA_set_flags(rsa, RSA_FLAG_TYPE_RSA); |
706 | 0 | break; |
707 | 0 | case EVP_PKEY_RSA_PSS: |
708 | 0 | RSA_set_flags(rsa, RSA_FLAG_TYPE_RSASSAPSS); |
709 | 0 | break; |
710 | 0 | default: |
711 | | /* Leave the type bits zero */ |
712 | 0 | break; |
713 | 0 | } |
714 | | |
715 | 0 | return rsa; |
716 | 0 | } |
717 | | #endif |