Coverage Report

Created: 2023-06-08 06:41

/src/openssl111/crypto/rsa/rsa_pk1.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
 * Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved.
3
 *
4
 * Licensed under the OpenSSL license (the "License").  You may not use
5
 * this file except in compliance with the License.  You can obtain a copy
6
 * in the file LICENSE in the source distribution or at
7
 * https://www.openssl.org/source/license.html
8
 */
9
10
#include "internal/constant_time.h"
11
12
#include <stdio.h>
13
#include "internal/cryptlib.h"
14
#include <openssl/bn.h>
15
#include <openssl/rsa.h>
16
#include <openssl/rand.h>
17
18
int RSA_padding_add_PKCS1_type_1(unsigned char *to, int tlen,
19
                                 const unsigned char *from, int flen)
20
0
{
21
0
    int j;
22
0
    unsigned char *p;
23
24
0
    if (flen > (tlen - RSA_PKCS1_PADDING_SIZE)) {
25
0
        RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_TYPE_1,
26
0
               RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE);
27
0
        return 0;
28
0
    }
29
30
0
    p = (unsigned char *)to;
31
32
0
    *(p++) = 0;
33
0
    *(p++) = 1;                 /* Private Key BT (Block Type) */
34
35
    /* pad out with 0xff data */
36
0
    j = tlen - 3 - flen;
37
0
    memset(p, 0xff, j);
38
0
    p += j;
39
0
    *(p++) = '\0';
40
0
    memcpy(p, from, (unsigned int)flen);
41
0
    return 1;
42
0
}
43
44
int RSA_padding_check_PKCS1_type_1(unsigned char *to, int tlen,
45
                                   const unsigned char *from, int flen,
46
                                   int num)
47
0
{
48
0
    int i, j;
49
0
    const unsigned char *p;
50
51
0
    p = from;
52
53
    /*
54
     * The format is
55
     * 00 || 01 || PS || 00 || D
56
     * PS - padding string, at least 8 bytes of FF
57
     * D  - data.
58
     */
59
60
0
    if (num < RSA_PKCS1_PADDING_SIZE)
61
0
        return -1;
62
63
    /* Accept inputs with and without the leading 0-byte. */
64
0
    if (num == flen) {
65
0
        if ((*p++) != 0x00) {
66
0
            RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_1,
67
0
                   RSA_R_INVALID_PADDING);
68
0
            return -1;
69
0
        }
70
0
        flen--;
71
0
    }
72
73
0
    if ((num != (flen + 1)) || (*(p++) != 0x01)) {
74
0
        RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_1,
75
0
               RSA_R_BLOCK_TYPE_IS_NOT_01);
76
0
        return -1;
77
0
    }
78
79
    /* scan over padding data */
80
0
    j = flen - 1;               /* one for type. */
81
0
    for (i = 0; i < j; i++) {
82
0
        if (*p != 0xff) {       /* should decrypt to 0xff */
83
0
            if (*p == 0) {
84
0
                p++;
85
0
                break;
86
0
            } else {
87
0
                RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_1,
88
0
                       RSA_R_BAD_FIXED_HEADER_DECRYPT);
89
0
                return -1;
90
0
            }
91
0
        }
92
0
        p++;
93
0
    }
94
95
0
    if (i == j) {
96
0
        RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_1,
97
0
               RSA_R_NULL_BEFORE_BLOCK_MISSING);
98
0
        return -1;
99
0
    }
100
101
0
    if (i < 8) {
102
0
        RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_1,
103
0
               RSA_R_BAD_PAD_BYTE_COUNT);
104
0
        return -1;
105
0
    }
106
0
    i++;                        /* Skip over the '\0' */
107
0
    j -= i;
108
0
    if (j > tlen) {
109
0
        RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_1, RSA_R_DATA_TOO_LARGE);
110
0
        return -1;
111
0
    }
112
0
    memcpy(to, p, (unsigned int)j);
113
114
0
    return j;
115
0
}
116
117
int RSA_padding_add_PKCS1_type_2(unsigned char *to, int tlen,
118
                                 const unsigned char *from, int flen)
119
0
{
120
0
    int i, j;
121
0
    unsigned char *p;
122
123
0
    if (flen > (tlen - RSA_PKCS1_PADDING_SIZE)) {
124
0
        RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_TYPE_2,
125
0
               RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE);
126
0
        return 0;
127
0
    }
128
129
0
    p = (unsigned char *)to;
130
131
0
    *(p++) = 0;
132
0
    *(p++) = 2;                 /* Public Key BT (Block Type) */
133
134
    /* pad out with non-zero random data */
135
0
    j = tlen - 3 - flen;
136
137
0
    if (RAND_bytes(p, j) <= 0)
138
0
        return 0;
139
0
    for (i = 0; i < j; i++) {
140
0
        if (*p == '\0')
141
0
            do {
142
0
                if (RAND_bytes(p, 1) <= 0)
143
0
                    return 0;
144
0
            } while (*p == '\0');
145
0
        p++;
146
0
    }
147
148
0
    *(p++) = '\0';
149
150
0
    memcpy(p, from, (unsigned int)flen);
151
0
    return 1;
152
0
}
153
154
int RSA_padding_check_PKCS1_type_2(unsigned char *to, int tlen,
155
                                   const unsigned char *from, int flen,
156
                                   int num)
157
0
{
158
0
    int i;
159
    /* |em| is the encoded message, zero-padded to exactly |num| bytes */
160
0
    unsigned char *em = NULL;
161
0
    unsigned int good, found_zero_byte, mask;
162
0
    int zero_index = 0, msg_index, mlen = -1;
163
164
0
    if (tlen <= 0 || flen <= 0)
165
0
        return -1;
166
167
    /*
168
     * PKCS#1 v1.5 decryption. See "PKCS #1 v2.2: RSA Cryptography Standard",
169
     * section 7.2.2.
170
     */
171
172
0
    if (flen > num || num < RSA_PKCS1_PADDING_SIZE) {
173
0
        RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2,
174
0
               RSA_R_PKCS_DECODING_ERROR);
175
0
        return -1;
176
0
    }
177
178
0
    em = OPENSSL_malloc(num);
179
0
    if (em == NULL) {
180
0
        RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2, ERR_R_MALLOC_FAILURE);
181
0
        return -1;
182
0
    }
183
    /*
184
     * Caller is encouraged to pass zero-padded message created with
185
     * BN_bn2binpad. Trouble is that since we can't read out of |from|'s
186
     * bounds, it's impossible to have an invariant memory access pattern
187
     * in case |from| was not zero-padded in advance.
188
     */
189
0
    for (from += flen, em += num, i = 0; i < num; i++) {
190
0
        mask = ~constant_time_is_zero(flen);
191
0
        flen -= 1 & mask;
192
0
        from -= 1 & mask;
193
0
        *--em = *from & mask;
194
0
    }
195
196
0
    good = constant_time_is_zero(em[0]);
197
0
    good &= constant_time_eq(em[1], 2);
198
199
    /* scan over padding data */
200
0
    found_zero_byte = 0;
201
0
    for (i = 2; i < num; i++) {
202
0
        unsigned int equals0 = constant_time_is_zero(em[i]);
203
204
0
        zero_index = constant_time_select_int(~found_zero_byte & equals0,
205
0
                                              i, zero_index);
206
0
        found_zero_byte |= equals0;
207
0
    }
208
209
    /*
210
     * PS must be at least 8 bytes long, and it starts two bytes into |em|.
211
     * If we never found a 0-byte, then |zero_index| is 0 and the check
212
     * also fails.
213
     */
214
0
    good &= constant_time_ge(zero_index, 2 + 8);
215
216
    /*
217
     * Skip the zero byte. This is incorrect if we never found a zero-byte
218
     * but in this case we also do not copy the message out.
219
     */
220
0
    msg_index = zero_index + 1;
221
0
    mlen = num - msg_index;
222
223
    /*
224
     * For good measure, do this check in constant time as well.
225
     */
226
0
    good &= constant_time_ge(tlen, mlen);
227
228
    /*
229
     * Move the result in-place by |num|-RSA_PKCS1_PADDING_SIZE-|mlen| bytes to the left.
230
     * Then if |good| move |mlen| bytes from |em|+RSA_PKCS1_PADDING_SIZE to |to|.
231
     * Otherwise leave |to| unchanged.
232
     * Copy the memory back in a way that does not reveal the size of
233
     * the data being copied via a timing side channel. This requires copying
234
     * parts of the buffer multiple times based on the bits set in the real
235
     * length. Clear bits do a non-copy with identical access pattern.
236
     * The loop below has overall complexity of O(N*log(N)).
237
     */
238
0
    tlen = constant_time_select_int(constant_time_lt(num - RSA_PKCS1_PADDING_SIZE, tlen),
239
0
                                    num - RSA_PKCS1_PADDING_SIZE, tlen);
240
0
    for (msg_index = 1; msg_index < num - RSA_PKCS1_PADDING_SIZE; msg_index <<= 1) {
241
0
        mask = ~constant_time_eq(msg_index & (num - RSA_PKCS1_PADDING_SIZE - mlen), 0);
242
0
        for (i = RSA_PKCS1_PADDING_SIZE; i < num - msg_index; i++)
243
0
            em[i] = constant_time_select_8(mask, em[i + msg_index], em[i]);
244
0
    }
245
0
    for (i = 0; i < tlen; i++) {
246
0
        mask = good & constant_time_lt(i, mlen);
247
0
        to[i] = constant_time_select_8(mask, em[i + RSA_PKCS1_PADDING_SIZE], to[i]);
248
0
    }
249
250
0
    OPENSSL_clear_free(em, num);
251
0
    RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2, RSA_R_PKCS_DECODING_ERROR);
252
0
    err_clear_last_constant_time(1 & good);
253
254
0
    return constant_time_select_int(good, mlen, -1);
255
0
}