/*

 * Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved.

 *

 * Licensed under the Apache License 2.0 (the "License").  You may not use

 * this file except in compliance with the License.  You can obtain a copy

 * in the file LICENSE in the source distribution or at

 * https://www.openssl.org/source/license.html

 */

/*

 * RSA low level APIs are deprecated for public use, but still ok for

 * internal use.

 */

#include "internal/deprecated.h"

#include <openssl/obj_mac.h>

#include "internal/cryptlib.h"

#include "prov/der_rsa.h"

#include "prov/der_digests.h"

/* More complex pre-compiled sequences. */

/*-

 * From https://tools.ietf.org/html/rfc8017#appendix-A.2.1

 *

 * OAEP-PSSDigestAlgorithms    ALGORITHM-IDENTIFIER ::= {

 *     { OID id-sha1       PARAMETERS NULL }|

 *     { OID id-sha224     PARAMETERS NULL }|

 *     { OID id-sha256     PARAMETERS NULL }|

 *     { OID id-sha384     PARAMETERS NULL }|

 *     { OID id-sha512     PARAMETERS NULL }|

 *     { OID id-sha512-224 PARAMETERS NULL }|

 *     { OID id-sha512-256 PARAMETERS NULL },

 *     ...  -- Allows for future expansion --

 * }

 */

#define DER_V_NULL DER_P_NULL, 0

#define DER_SZ_NULL 2

/*

 * The names for the hash function AlgorithmIdentifiers are borrowed and

 * expanded from https://tools.ietf.org/html/rfc4055#section-2.1

 *

 * sha1Identifier  AlgorithmIdentifier  ::=  { id-sha1, NULL }

 * sha224Identifier  AlgorithmIdentifier  ::=  { id-sha224, NULL }

 * sha256Identifier  AlgorithmIdentifier  ::=  { id-sha256, NULL }

 * sha384Identifier  AlgorithmIdentifier  ::=  { id-sha384, NULL }

 * sha512Identifier  AlgorithmIdentifier  ::=  { id-sha512, NULL }

 */

/*

 * NOTE: Some of the arrays aren't used other than inside sizeof(), which

 * clang complains about (-Wno-unneeded-internal-declaration).  To get

 * around that, we make them non-static, and declare them an extra time to

 * avoid compilers complaining about definitions without declarations.

 */

#define DER_AID_V_sha1Identifier          \

    DER_P_SEQUENCE | DER_F_CONSTRUCTED,   \

        DER_OID_SZ_id_sha1 + DER_SZ_NULL, \

        DER_OID_V_id_sha1,                \

        DER_V_NULL

extern const unsigned char ossl_der_aid_sha1Identifier[];

const unsigned char ossl_der_aid_sha1Identifier[] = {

    DER_AID_V_sha1Identifier

};

#define DER_AID_SZ_sha1Identifier sizeof(ossl_der_aid_sha1Identifier)

#define DER_AID_V_sha224Identifier          \

    DER_P_SEQUENCE | DER_F_CONSTRUCTED,     \

        DER_OID_SZ_id_sha224 + DER_SZ_NULL, \

        DER_OID_V_id_sha224,                \

        DER_V_NULL

extern const unsigned char ossl_der_aid_sha224Identifier[];

const unsigned char ossl_der_aid_sha224Identifier[] = {

    DER_AID_V_sha224Identifier

};

#define DER_AID_SZ_sha224Identifier sizeof(ossl_der_aid_sha224Identifier)

#define DER_AID_V_sha256Identifier          \

    DER_P_SEQUENCE | DER_F_CONSTRUCTED,     \

        DER_OID_SZ_id_sha256 + DER_SZ_NULL, \

        DER_OID_V_id_sha256,                \

        DER_V_NULL

extern const unsigned char ossl_der_aid_sha256Identifier[];

const unsigned char ossl_der_aid_sha256Identifier[] = {

    DER_AID_V_sha256Identifier

};

#define DER_AID_SZ_sha256Identifier sizeof(ossl_der_aid_sha256Identifier)

#define DER_AID_V_sha384Identifier          \

    DER_P_SEQUENCE | DER_F_CONSTRUCTED,     \

        DER_OID_SZ_id_sha384 + DER_SZ_NULL, \

        DER_OID_V_id_sha384,                \

        DER_V_NULL

extern const unsigned char ossl_der_aid_sha384Identifier[];

const unsigned char ossl_der_aid_sha384Identifier[] = {

    DER_AID_V_sha384Identifier

};

#define DER_AID_SZ_sha384Identifier sizeof(ossl_der_aid_sha384Identifier)

#define DER_AID_V_sha512Identifier          \

    DER_P_SEQUENCE | DER_F_CONSTRUCTED,     \

        DER_OID_SZ_id_sha512 + DER_SZ_NULL, \

        DER_OID_V_id_sha512,                \

        DER_V_NULL

extern const unsigned char ossl_der_aid_sha512Identifier[];

const unsigned char ossl_der_aid_sha512Identifier[] = {

    DER_AID_V_sha512Identifier

};

#define DER_AID_SZ_sha512Identifier sizeof(ossl_der_aid_sha512Identifier)

#define DER_AID_V_sha512_224Identifier          \

    DER_P_SEQUENCE | DER_F_CONSTRUCTED,         \

        DER_OID_SZ_id_sha512_224 + DER_SZ_NULL, \

        DER_OID_V_id_sha512_224,                \

        DER_V_NULL

extern const unsigned char ossl_der_aid_sha512_224Identifier[];

const unsigned char ossl_der_aid_sha512_224Identifier[] = {

    DER_AID_V_sha512_224Identifier

};

#define DER_AID_SZ_sha512_224Identifier sizeof(ossl_der_aid_sha512_224Identifier)

#define DER_AID_V_sha512_256Identifier          \

    DER_P_SEQUENCE | DER_F_CONSTRUCTED,         \

        DER_OID_SZ_id_sha512_256 + DER_SZ_NULL, \

        DER_OID_V_id_sha512_256,                \

        DER_V_NULL

extern const unsigned char ossl_der_aid_sha512_256Identifier[];

const unsigned char ossl_der_aid_sha512_256Identifier[] = {

    DER_AID_V_sha512_256Identifier

};

#define DER_AID_SZ_sha512_256Identifier sizeof(ossl_der_aid_sha512_256Identifier)

/*-

 * From https://tools.ietf.org/html/rfc8017#appendix-A.2.1

 *

 * HashAlgorithm ::= AlgorithmIdentifier {

 *    {OAEP-PSSDigestAlgorithms}

 * }

 *

 * ...

 *

 * PKCS1MGFAlgorithms    ALGORITHM-IDENTIFIER ::= {

 *     { OID id-mgf1 PARAMETERS HashAlgorithm },

 *     ...  -- Allows for future expansion --

 * }

 */

/*

 * The names for the MGF1 AlgorithmIdentifiers are borrowed and expanded

 * from https://tools.ietf.org/html/rfc4055#section-2.1

 *

 * mgf1SHA1Identifier  AlgorithmIdentifier  ::=

 *                      { id-mgf1, sha1Identifier }

 * mgf1SHA224Identifier  AlgorithmIdentifier  ::=

 *                      { id-mgf1, sha224Identifier }

 * mgf1SHA256Identifier  AlgorithmIdentifier  ::=

 *                      { id-mgf1, sha256Identifier }

 * mgf1SHA384Identifier  AlgorithmIdentifier  ::=

 *                      { id-mgf1, sha384Identifier }

 * mgf1SHA512Identifier  AlgorithmIdentifier  ::=

 *                      { id-mgf1, sha512Identifier }

 */

#if 0 /* Currently unused */

#define DER_AID_V_mgf1SHA1Identifier                    \

    DER_P_SEQUENCE | DER_F_CONSTRUCTED,                 \

        DER_OID_SZ_id_mgf1 + DER_AID_SZ_sha1Identifier, \

        DER_OID_V_id_mgf1,                              \

        DER_AID_V_sha1Identifier

static const unsigned char der_aid_mgf1SHA1Identifier[] = {

    DER_AID_V_mgf1SHA1Identifier

};

#define DER_AID_SZ_mgf1SHA1Identifier sizeof(der_aid_mgf1SHA1Identifier)

#endif

#define DER_AID_V_mgf1SHA224Identifier                    \

    DER_P_SEQUENCE | DER_F_CONSTRUCTED,                   \

        DER_OID_SZ_id_mgf1 + DER_AID_SZ_sha224Identifier, \

        DER_OID_V_id_mgf1,                                \

        DER_AID_V_sha224Identifier

static const unsigned char der_aid_mgf1SHA224Identifier[] = {

    DER_AID_V_mgf1SHA224Identifier

};

#define DER_AID_SZ_mgf1SHA224Identifier sizeof(der_aid_mgf1SHA224Identifier)

#define DER_AID_V_mgf1SHA256Identifier                    \

    DER_P_SEQUENCE | DER_F_CONSTRUCTED,                   \

        DER_OID_SZ_id_mgf1 + DER_AID_SZ_sha256Identifier, \

        DER_OID_V_id_mgf1,                                \

        DER_AID_V_sha256Identifier

static const unsigned char der_aid_mgf1SHA256Identifier[] = {

    DER_AID_V_mgf1SHA256Identifier

};

#define DER_AID_SZ_mgf1SHA256Identifier sizeof(der_aid_mgf1SHA256Identifier)

#define DER_AID_V_mgf1SHA384Identifier                    \

    DER_P_SEQUENCE | DER_F_CONSTRUCTED,                   \

        DER_OID_SZ_id_mgf1 + DER_AID_SZ_sha384Identifier, \

        DER_OID_V_id_mgf1,                                \

        DER_AID_V_sha384Identifier

static const unsigned char der_aid_mgf1SHA384Identifier[] = {

    DER_AID_V_mgf1SHA384Identifier

};

#define DER_AID_SZ_mgf1SHA384Identifier sizeof(der_aid_mgf1SHA384Identifier)

#define DER_AID_V_mgf1SHA512Identifier                    \

    DER_P_SEQUENCE | DER_F_CONSTRUCTED,                   \

        DER_OID_SZ_id_mgf1 + DER_AID_SZ_sha512Identifier, \

        DER_OID_V_id_mgf1,                                \

        DER_AID_V_sha512Identifier

static const unsigned char der_aid_mgf1SHA512Identifier[] = {

    DER_AID_V_mgf1SHA512Identifier

};

#define DER_AID_SZ_mgf1SHA512Identifier sizeof(der_aid_mgf1SHA512Identifier)

#define DER_AID_V_mgf1SHA512_224Identifier                    \

    DER_P_SEQUENCE | DER_F_CONSTRUCTED,                       \

        DER_OID_SZ_id_mgf1 + DER_AID_SZ_sha512_224Identifier, \

        DER_OID_V_id_mgf1,                                    \

        DER_AID_V_sha512_224Identifier

static const unsigned char der_aid_mgf1SHA512_224Identifier[] = {

    DER_AID_V_mgf1SHA512_224Identifier

};

#define DER_AID_SZ_mgf1SHA512_224Identifier sizeof(der_aid_mgf1SHA512_224Identifier)

#define DER_AID_V_mgf1SHA512_256Identifier                    \

    DER_P_SEQUENCE | DER_F_CONSTRUCTED,                       \

        DER_OID_SZ_id_mgf1 + DER_AID_SZ_sha512_256Identifier, \

        DER_OID_V_id_mgf1,                                    \

        DER_AID_V_sha512_256Identifier

static const unsigned char der_aid_mgf1SHA512_256Identifier[] = {

    DER_AID_V_mgf1SHA512_256Identifier

};

#define DER_AID_SZ_mgf1SHA512_256Identifier sizeof(der_aid_mgf1SHA512_256Identifier)

#define MGF1_SHA_CASE(bits, var)                              \

    case NID_sha##bits:                                       \

        var = der_aid_mgf1SHA##bits##Identifier;              \

        var##_sz = sizeof(der_aid_mgf1SHA##bits##Identifier); \

        break;

/*-

 * The name is borrowed from https://tools.ietf.org/html/rfc8017#appendix-A.2.1

 *

 * MaskGenAlgorithm ::= AlgorithmIdentifier { {PKCS1MGFAlgorithms} }

 */

static int DER_w_MaskGenAlgorithm(WPACKET *pkt, int tag,

    const RSA_PSS_PARAMS_30 *pss)

{

    if (pss != NULL && ossl_rsa_pss_params_30_maskgenalg(pss) == NID_mgf1) {

        int maskgenhashalg_nid = ossl_rsa_pss_params_30_maskgenhashalg(pss);

        const unsigned char *maskgenalg = NULL;

        size_t maskgenalg_sz = 0;

        switch (maskgenhashalg_nid) {

        case NID_sha1:

            break;

            MGF1_SHA_CASE(224, maskgenalg);

            MGF1_SHA_CASE(256, maskgenalg);

            MGF1_SHA_CASE(384, maskgenalg);

            MGF1_SHA_CASE(512, maskgenalg);

            MGF1_SHA_CASE(512_224, maskgenalg);

            MGF1_SHA_CASE(512_256, maskgenalg);

        default:

            return 0;

        }

        /* If there is none (or it was the default), we write nothing */

        if (maskgenalg == NULL)

            return 1;

        return ossl_DER_w_precompiled(pkt, tag, maskgenalg, maskgenalg_sz);

    }

    return 0;

}

#define OAEP_PSS_MD_CASE(name, var)                         \

    case NID_##name:                                        \

        var = ossl_der_aid_##name##Identifier;              \

        var##_sz = sizeof(ossl_der_aid_##name##Identifier); \

        break;

int ossl_DER_w_RSASSA_PSS_params(WPACKET *pkt, int tag,

    const RSA_PSS_PARAMS_30 *pss)

{

    int hashalg_nid, default_hashalg_nid;

    int saltlen, default_saltlen;

    int trailerfield, default_trailerfield;

    const unsigned char *hashalg = NULL;

    size_t hashalg_sz = 0;

    /*

     * For an unrestricted key, this function should not have been called;

     * the caller must be in control, because unrestricted keys are permitted

     * in some situations (when encoding the public key in a SubjectKeyInfo,

     * for example) while not in others, and this function doesn't know the

     * intent.  Therefore, we assert that here, the PSS parameters must show

     * that the key is restricted.

     */

    if (!ossl_assert(pss != NULL

            && !ossl_rsa_pss_params_30_is_unrestricted(pss)))

        return 0;

    hashalg_nid = ossl_rsa_pss_params_30_hashalg(pss);

    saltlen = ossl_rsa_pss_params_30_saltlen(pss);

    trailerfield = ossl_rsa_pss_params_30_trailerfield(pss);

    if (saltlen < 0) {

        ERR_raise(ERR_LIB_RSA, RSA_R_INVALID_SALT_LENGTH);

        return 0;

    }

    if (trailerfield != 1) {

        ERR_raise(ERR_LIB_RSA, RSA_R_INVALID_TRAILER);

        return 0;

    }

    /* Getting default values */

    default_hashalg_nid = ossl_rsa_pss_params_30_hashalg(NULL);

    default_saltlen = ossl_rsa_pss_params_30_saltlen(NULL);

    default_trailerfield = ossl_rsa_pss_params_30_trailerfield(NULL);

    /*

     * From https://tools.ietf.org/html/rfc8017#appendix-A.2.1:

     *

     * OAEP-PSSDigestAlgorithms    ALGORITHM-IDENTIFIER ::= {

     *     { OID id-sha1       PARAMETERS NULL }|

     *     { OID id-sha224     PARAMETERS NULL }|

     *     { OID id-sha256     PARAMETERS NULL }|

     *     { OID id-sha384     PARAMETERS NULL }|

     *     { OID id-sha512     PARAMETERS NULL }|

     *     { OID id-sha512-224 PARAMETERS NULL }|

     *     { OID id-sha512-256 PARAMETERS NULL },

     *     ...  -- Allows for future expansion --

     * }

     */

    switch (hashalg_nid) {

        OAEP_PSS_MD_CASE(sha1, hashalg);

        OAEP_PSS_MD_CASE(sha224, hashalg);

        OAEP_PSS_MD_CASE(sha256, hashalg);

        OAEP_PSS_MD_CASE(sha384, hashalg);

        OAEP_PSS_MD_CASE(sha512, hashalg);

        OAEP_PSS_MD_CASE(sha512_224, hashalg);

        OAEP_PSS_MD_CASE(sha512_256, hashalg);

    default:

        return 0;

    }

    return ossl_DER_w_begin_sequence(pkt, tag)

        && (trailerfield == default_trailerfield

            || ossl_DER_w_uint32(pkt, 3, (uint32_t)trailerfield))

        && (saltlen == default_saltlen || ossl_DER_w_uint32(pkt, 2, (uint32_t)saltlen))

        && DER_w_MaskGenAlgorithm(pkt, 1, pss)

        && (hashalg_nid == default_hashalg_nid

            || ossl_DER_w_precompiled(pkt, 0, hashalg, hashalg_sz))

        && ossl_DER_w_end_sequence(pkt, tag);

}

/* Aliases so we can have a uniform RSA_CASE */

#define ossl_der_oid_rsassaPss ossl_der_oid_id_RSASSA_PSS

#define RSA_CASE(name, var)                     \

    var##_nid = NID_##name;                     \

    var##_oid = ossl_der_oid_##name;            \

    var##_oid_sz = sizeof(ossl_der_oid_##name); \

    break;

int ossl_DER_w_algorithmIdentifier_RSA_PSS(WPACKET *pkt, int tag,

    int rsa_type,

    const RSA_PSS_PARAMS_30 *pss)

{

    int rsa_nid = NID_undef;

    const unsigned char *rsa_oid = NULL;

    size_t rsa_oid_sz = 0;

    switch (rsa_type) {

    case RSA_FLAG_TYPE_RSA:

        RSA_CASE(rsaEncryption, rsa);

    case RSA_FLAG_TYPE_RSASSAPSS:

        RSA_CASE(rsassaPss, rsa);

    }

    if (rsa_oid == NULL)

        return 0;

    return ossl_DER_w_begin_sequence(pkt, tag)

        && (rsa_nid != NID_rsassaPss

            || ossl_rsa_pss_params_30_is_unrestricted(pss)

            || ossl_DER_w_RSASSA_PSS_params(pkt, -1, pss))

        && ossl_DER_w_precompiled(pkt, -1, rsa_oid, rsa_oid_sz)

        && ossl_DER_w_end_sequence(pkt, tag);

}

int ossl_DER_w_algorithmIdentifier_RSA(WPACKET *pkt, int tag, RSA *rsa)

{

    int rsa_type = RSA_test_flags(rsa, RSA_FLAG_TYPE_MASK);

    RSA_PSS_PARAMS_30 *pss_params = ossl_rsa_get0_pss_params_30(rsa);

    return ossl_DER_w_algorithmIdentifier_RSA_PSS(pkt, tag, rsa_type,

        pss_params);

}