/src/openssl31/providers/implementations/signature/rsa_sig.c
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * Copyright 2019-2023 The OpenSSL Project Authors. All Rights Reserved. |
3 | | * |
4 | | * Licensed under the Apache License 2.0 (the "License"). You may not use |
5 | | * this file except in compliance with the License. You can obtain a copy |
6 | | * in the file LICENSE in the source distribution or at |
7 | | * https://www.openssl.org/source/license.html |
8 | | */ |
9 | | |
10 | | /* |
11 | | * RSA low level APIs are deprecated for public use, but still ok for |
12 | | * internal use. |
13 | | */ |
14 | | #include "internal/deprecated.h" |
15 | | |
16 | | #include <string.h> |
17 | | #include <openssl/crypto.h> |
18 | | #include <openssl/core_dispatch.h> |
19 | | #include <openssl/core_names.h> |
20 | | #include <openssl/err.h> |
21 | | #include <openssl/rsa.h> |
22 | | #include <openssl/params.h> |
23 | | #include <openssl/evp.h> |
24 | | #include <openssl/proverr.h> |
25 | | #include "internal/cryptlib.h" |
26 | | #include "internal/nelem.h" |
27 | | #include "internal/sizes.h" |
28 | | #include "crypto/rsa.h" |
29 | | #include "prov/providercommon.h" |
30 | | #include "prov/implementations.h" |
31 | | #include "prov/provider_ctx.h" |
32 | | #include "prov/der_rsa.h" |
33 | | #include "prov/securitycheck.h" |
34 | | |
35 | 0 | #define RSA_DEFAULT_DIGEST_NAME OSSL_DIGEST_NAME_SHA1 |
36 | | |
37 | | static OSSL_FUNC_signature_newctx_fn rsa_newctx; |
38 | | static OSSL_FUNC_signature_sign_init_fn rsa_sign_init; |
39 | | static OSSL_FUNC_signature_verify_init_fn rsa_verify_init; |
40 | | static OSSL_FUNC_signature_verify_recover_init_fn rsa_verify_recover_init; |
41 | | static OSSL_FUNC_signature_sign_fn rsa_sign; |
42 | | static OSSL_FUNC_signature_verify_fn rsa_verify; |
43 | | static OSSL_FUNC_signature_verify_recover_fn rsa_verify_recover; |
44 | | static OSSL_FUNC_signature_digest_sign_init_fn rsa_digest_sign_init; |
45 | | static OSSL_FUNC_signature_digest_sign_update_fn rsa_digest_signverify_update; |
46 | | static OSSL_FUNC_signature_digest_sign_final_fn rsa_digest_sign_final; |
47 | | static OSSL_FUNC_signature_digest_verify_init_fn rsa_digest_verify_init; |
48 | | static OSSL_FUNC_signature_digest_verify_update_fn rsa_digest_signverify_update; |
49 | | static OSSL_FUNC_signature_digest_verify_final_fn rsa_digest_verify_final; |
50 | | static OSSL_FUNC_signature_freectx_fn rsa_freectx; |
51 | | static OSSL_FUNC_signature_dupctx_fn rsa_dupctx; |
52 | | static OSSL_FUNC_signature_get_ctx_params_fn rsa_get_ctx_params; |
53 | | static OSSL_FUNC_signature_gettable_ctx_params_fn rsa_gettable_ctx_params; |
54 | | static OSSL_FUNC_signature_set_ctx_params_fn rsa_set_ctx_params; |
55 | | static OSSL_FUNC_signature_settable_ctx_params_fn rsa_settable_ctx_params; |
56 | | static OSSL_FUNC_signature_get_ctx_md_params_fn rsa_get_ctx_md_params; |
57 | | static OSSL_FUNC_signature_gettable_ctx_md_params_fn rsa_gettable_ctx_md_params; |
58 | | static OSSL_FUNC_signature_set_ctx_md_params_fn rsa_set_ctx_md_params; |
59 | | static OSSL_FUNC_signature_settable_ctx_md_params_fn rsa_settable_ctx_md_params; |
60 | | |
61 | | static OSSL_ITEM padding_item[] = { |
62 | | { RSA_PKCS1_PADDING, OSSL_PKEY_RSA_PAD_MODE_PKCSV15 }, |
63 | | { RSA_NO_PADDING, OSSL_PKEY_RSA_PAD_MODE_NONE }, |
64 | | { RSA_X931_PADDING, OSSL_PKEY_RSA_PAD_MODE_X931 }, |
65 | | { RSA_PKCS1_PSS_PADDING, OSSL_PKEY_RSA_PAD_MODE_PSS }, |
66 | | { 0, NULL } |
67 | | }; |
68 | | |
69 | | /* |
70 | | * What's passed as an actual key is defined by the KEYMGMT interface. |
71 | | * We happen to know that our KEYMGMT simply passes RSA structures, so |
72 | | * we use that here too. |
73 | | */ |
74 | | |
75 | | typedef struct { |
76 | | OSSL_LIB_CTX *libctx; |
77 | | char *propq; |
78 | | RSA *rsa; |
79 | | int operation; |
80 | | |
81 | | /* |
82 | | * Flag to determine if the hash function can be changed (1) or not (0) |
83 | | * Because it's dangerous to change during a DigestSign or DigestVerify |
84 | | * operation, this flag is cleared by their Init function, and set again |
85 | | * by their Final function. |
86 | | */ |
87 | | unsigned int flag_allow_md : 1; |
88 | | unsigned int mgf1_md_set : 1; |
89 | | |
90 | | /* main digest */ |
91 | | EVP_MD *md; |
92 | | EVP_MD_CTX *mdctx; |
93 | | int mdnid; |
94 | | char mdname[OSSL_MAX_NAME_SIZE]; /* Purely informational */ |
95 | | |
96 | | /* RSA padding mode */ |
97 | | int pad_mode; |
98 | | /* message digest for MGF1 */ |
99 | | EVP_MD *mgf1_md; |
100 | | int mgf1_mdnid; |
101 | | char mgf1_mdname[OSSL_MAX_NAME_SIZE]; /* Purely informational */ |
102 | | /* PSS salt length */ |
103 | | int saltlen; |
104 | | /* Minimum salt length or -1 if no PSS parameter restriction */ |
105 | | int min_saltlen; |
106 | | |
107 | | /* Temp buffer */ |
108 | | unsigned char *tbuf; |
109 | | |
110 | | } PROV_RSA_CTX; |
111 | | |
112 | | /* True if PSS parameters are restricted */ |
113 | 37.7k | #define rsa_pss_restricted(prsactx) (prsactx->min_saltlen != -1) |
114 | | |
115 | | static size_t rsa_get_md_size(const PROV_RSA_CTX *prsactx) |
116 | 9.96k | { |
117 | 9.96k | if (prsactx->md != NULL) |
118 | 9.96k | return EVP_MD_get_size(prsactx->md); |
119 | 0 | return 0; |
120 | 9.96k | } |
121 | | |
122 | | static int rsa_check_padding(const PROV_RSA_CTX *prsactx, |
123 | | const char *mdname, const char *mgf1_mdname, |
124 | | int mdnid) |
125 | 81.8k | { |
126 | 81.8k | switch(prsactx->pad_mode) { |
127 | 0 | case RSA_NO_PADDING: |
128 | 0 | if (mdname != NULL || mdnid != NID_undef) { |
129 | 0 | ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_PADDING_MODE); |
130 | 0 | return 0; |
131 | 0 | } |
132 | 0 | break; |
133 | 0 | case RSA_X931_PADDING: |
134 | 0 | if (RSA_X931_hash_id(mdnid) == -1) { |
135 | 0 | ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_X931_DIGEST); |
136 | 0 | return 0; |
137 | 0 | } |
138 | 0 | break; |
139 | 31.2k | case RSA_PKCS1_PSS_PADDING: |
140 | 31.2k | if (rsa_pss_restricted(prsactx)) |
141 | 933 | if ((mdname != NULL && !EVP_MD_is_a(prsactx->md, mdname)) |
142 | 933 | || (mgf1_mdname != NULL |
143 | 916 | && !EVP_MD_is_a(prsactx->mgf1_md, mgf1_mdname))) { |
144 | 17 | ERR_raise(ERR_LIB_PROV, PROV_R_DIGEST_NOT_ALLOWED); |
145 | 17 | return 0; |
146 | 17 | } |
147 | 31.2k | break; |
148 | 50.5k | default: |
149 | 50.5k | break; |
150 | 81.8k | } |
151 | | |
152 | 81.7k | return 1; |
153 | 81.8k | } |
154 | | |
155 | | static int rsa_check_parameters(PROV_RSA_CTX *prsactx, int min_saltlen) |
156 | 256 | { |
157 | 256 | if (prsactx->pad_mode == RSA_PKCS1_PSS_PADDING) { |
158 | 256 | int max_saltlen; |
159 | | |
160 | | /* See if minimum salt length exceeds maximum possible */ |
161 | 256 | max_saltlen = RSA_size(prsactx->rsa) - EVP_MD_get_size(prsactx->md); |
162 | 256 | if ((RSA_bits(prsactx->rsa) & 0x7) == 1) |
163 | 12 | max_saltlen--; |
164 | 256 | if (min_saltlen < 0 || min_saltlen > max_saltlen) { |
165 | 10 | ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_SALT_LENGTH); |
166 | 10 | return 0; |
167 | 10 | } |
168 | 246 | prsactx->min_saltlen = min_saltlen; |
169 | 246 | } |
170 | 246 | return 1; |
171 | 256 | } |
172 | | |
173 | | static void *rsa_newctx(void *provctx, const char *propq) |
174 | 50.9k | { |
175 | 50.9k | PROV_RSA_CTX *prsactx = NULL; |
176 | 50.9k | char *propq_copy = NULL; |
177 | | |
178 | 50.9k | if (!ossl_prov_is_running()) |
179 | 0 | return NULL; |
180 | | |
181 | 50.9k | if ((prsactx = OPENSSL_zalloc(sizeof(PROV_RSA_CTX))) == NULL |
182 | 50.9k | || (propq != NULL |
183 | 50.9k | && (propq_copy = OPENSSL_strdup(propq)) == NULL)) { |
184 | 0 | OPENSSL_free(prsactx); |
185 | 0 | ERR_raise(ERR_LIB_PROV, ERR_R_MALLOC_FAILURE); |
186 | 0 | return NULL; |
187 | 0 | } |
188 | | |
189 | 50.9k | prsactx->libctx = PROV_LIBCTX_OF(provctx); |
190 | 50.9k | prsactx->flag_allow_md = 1; |
191 | 50.9k | prsactx->propq = propq_copy; |
192 | | /* Maximum up to digest length for sign, auto for verify */ |
193 | 50.9k | prsactx->saltlen = RSA_PSS_SALTLEN_AUTO_DIGEST_MAX; |
194 | 50.9k | prsactx->min_saltlen = -1; |
195 | 50.9k | return prsactx; |
196 | 50.9k | } |
197 | | |
198 | | static int rsa_pss_compute_saltlen(PROV_RSA_CTX *ctx) |
199 | 0 | { |
200 | 0 | int saltlen = ctx->saltlen; |
201 | 0 | int saltlenMax = -1; |
202 | | |
203 | | /* FIPS 186-4 section 5 "The RSA Digital Signature Algorithm", subsection |
204 | | * 5.5 "PKCS #1" says: "For RSASSA-PSS […] the length (in bytes) of the |
205 | | * salt (sLen) shall satisfy 0 <= sLen <= hLen, where hLen is the length of |
206 | | * the hash function output block (in bytes)." |
207 | | * |
208 | | * Provide a way to use at most the digest length, so that the default does |
209 | | * not violate FIPS 186-4. */ |
210 | 0 | if (saltlen == RSA_PSS_SALTLEN_DIGEST) { |
211 | 0 | saltlen = EVP_MD_get_size(ctx->md); |
212 | 0 | } else if (saltlen == RSA_PSS_SALTLEN_AUTO_DIGEST_MAX) { |
213 | 0 | saltlen = RSA_PSS_SALTLEN_MAX; |
214 | 0 | saltlenMax = EVP_MD_get_size(ctx->md); |
215 | 0 | } |
216 | 0 | if (saltlen == RSA_PSS_SALTLEN_MAX || saltlen == RSA_PSS_SALTLEN_AUTO) { |
217 | 0 | saltlen = RSA_size(ctx->rsa) - EVP_MD_get_size(ctx->md) - 2; |
218 | 0 | if ((RSA_bits(ctx->rsa) & 0x7) == 1) |
219 | 0 | saltlen--; |
220 | 0 | if (saltlenMax >= 0 && saltlen > saltlenMax) |
221 | 0 | saltlen = saltlenMax; |
222 | 0 | } |
223 | 0 | if (saltlen < 0) { |
224 | 0 | ERR_raise(ERR_LIB_PROV, ERR_R_INTERNAL_ERROR); |
225 | 0 | return -1; |
226 | 0 | } else if (saltlen < ctx->min_saltlen) { |
227 | 0 | ERR_raise_data(ERR_LIB_PROV, PROV_R_PSS_SALTLEN_TOO_SMALL, |
228 | 0 | "minimum salt length: %d, actual salt length: %d", |
229 | 0 | ctx->min_saltlen, saltlen); |
230 | 0 | return -1; |
231 | 0 | } |
232 | 0 | return saltlen; |
233 | 0 | } |
234 | | |
235 | | static unsigned char *rsa_generate_signature_aid(PROV_RSA_CTX *ctx, |
236 | | unsigned char *aid_buf, |
237 | | size_t buf_len, |
238 | | size_t *aid_len) |
239 | 0 | { |
240 | 0 | WPACKET pkt; |
241 | 0 | unsigned char *aid = NULL; |
242 | 0 | int saltlen; |
243 | 0 | RSA_PSS_PARAMS_30 pss_params; |
244 | 0 | int ret; |
245 | |
|
246 | 0 | if (!WPACKET_init_der(&pkt, aid_buf, buf_len)) { |
247 | 0 | ERR_raise(ERR_LIB_PROV, ERR_R_MALLOC_FAILURE); |
248 | 0 | return NULL; |
249 | 0 | } |
250 | | |
251 | 0 | switch(ctx->pad_mode) { |
252 | 0 | case RSA_PKCS1_PADDING: |
253 | 0 | ret = ossl_DER_w_algorithmIdentifier_MDWithRSAEncryption(&pkt, -1, |
254 | 0 | ctx->mdnid); |
255 | |
|
256 | 0 | if (ret > 0) { |
257 | 0 | break; |
258 | 0 | } else if (ret == 0) { |
259 | 0 | ERR_raise(ERR_LIB_PROV, ERR_R_INTERNAL_ERROR); |
260 | 0 | goto cleanup; |
261 | 0 | } |
262 | 0 | ERR_raise_data(ERR_LIB_PROV, ERR_R_UNSUPPORTED, |
263 | 0 | "Algorithm ID generation - md NID: %d", |
264 | 0 | ctx->mdnid); |
265 | 0 | goto cleanup; |
266 | 0 | case RSA_PKCS1_PSS_PADDING: |
267 | 0 | saltlen = rsa_pss_compute_saltlen(ctx); |
268 | 0 | if (saltlen < 0) |
269 | 0 | goto cleanup; |
270 | 0 | if (!ossl_rsa_pss_params_30_set_defaults(&pss_params) |
271 | 0 | || !ossl_rsa_pss_params_30_set_hashalg(&pss_params, ctx->mdnid) |
272 | 0 | || !ossl_rsa_pss_params_30_set_maskgenhashalg(&pss_params, |
273 | 0 | ctx->mgf1_mdnid) |
274 | 0 | || !ossl_rsa_pss_params_30_set_saltlen(&pss_params, saltlen) |
275 | 0 | || !ossl_DER_w_algorithmIdentifier_RSA_PSS(&pkt, -1, |
276 | 0 | RSA_FLAG_TYPE_RSASSAPSS, |
277 | 0 | &pss_params)) { |
278 | 0 | ERR_raise(ERR_LIB_PROV, ERR_R_INTERNAL_ERROR); |
279 | 0 | goto cleanup; |
280 | 0 | } |
281 | 0 | break; |
282 | 0 | default: |
283 | 0 | ERR_raise_data(ERR_LIB_PROV, ERR_R_UNSUPPORTED, |
284 | 0 | "Algorithm ID generation - pad mode: %d", |
285 | 0 | ctx->pad_mode); |
286 | 0 | goto cleanup; |
287 | 0 | } |
288 | 0 | if (WPACKET_finish(&pkt)) { |
289 | 0 | WPACKET_get_total_written(&pkt, aid_len); |
290 | 0 | aid = WPACKET_get_curr(&pkt); |
291 | 0 | } |
292 | 0 | cleanup: |
293 | 0 | WPACKET_cleanup(&pkt); |
294 | 0 | return aid; |
295 | 0 | } |
296 | | |
297 | | static int rsa_setup_md(PROV_RSA_CTX *ctx, const char *mdname, |
298 | | const char *mdprops) |
299 | 35.7k | { |
300 | 35.7k | if (mdprops == NULL) |
301 | 35.7k | mdprops = ctx->propq; |
302 | | |
303 | 35.7k | if (mdname != NULL) { |
304 | 35.7k | EVP_MD *md = EVP_MD_fetch(ctx->libctx, mdname, mdprops); |
305 | 35.7k | int sha1_allowed = (ctx->operation != EVP_PKEY_OP_SIGN); |
306 | 35.7k | int md_nid = ossl_digest_rsa_sign_get_md_nid(ctx->libctx, md, |
307 | 35.7k | sha1_allowed); |
308 | 35.7k | size_t mdname_len = strlen(mdname); |
309 | | |
310 | 35.7k | if (md == NULL |
311 | 35.7k | || md_nid <= 0 |
312 | 35.7k | || !rsa_check_padding(ctx, mdname, NULL, md_nid) |
313 | 35.7k | || mdname_len >= sizeof(ctx->mdname)) { |
314 | 59 | if (md == NULL) |
315 | 48 | ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_DIGEST, |
316 | 48 | "%s could not be fetched", mdname); |
317 | 59 | if (md_nid <= 0) |
318 | 48 | ERR_raise_data(ERR_LIB_PROV, PROV_R_DIGEST_NOT_ALLOWED, |
319 | 48 | "digest=%s", mdname); |
320 | 59 | if (mdname_len >= sizeof(ctx->mdname)) |
321 | 0 | ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_DIGEST, |
322 | 0 | "%s exceeds name buffer length", mdname); |
323 | 59 | EVP_MD_free(md); |
324 | 59 | return 0; |
325 | 59 | } |
326 | | |
327 | 35.6k | if (!ctx->flag_allow_md) { |
328 | 0 | if (ctx->mdname[0] != '\0' && !EVP_MD_is_a(md, ctx->mdname)) { |
329 | 0 | ERR_raise_data(ERR_LIB_PROV, PROV_R_DIGEST_NOT_ALLOWED, |
330 | 0 | "digest %s != %s", mdname, ctx->mdname); |
331 | 0 | EVP_MD_free(md); |
332 | 0 | return 0; |
333 | 0 | } |
334 | 0 | EVP_MD_free(md); |
335 | 0 | return 1; |
336 | 0 | } |
337 | | |
338 | 35.6k | if (!ctx->mgf1_md_set) { |
339 | 35.4k | if (!EVP_MD_up_ref(md)) { |
340 | 0 | EVP_MD_free(md); |
341 | 0 | return 0; |
342 | 0 | } |
343 | 35.4k | EVP_MD_free(ctx->mgf1_md); |
344 | 35.4k | ctx->mgf1_md = md; |
345 | 35.4k | ctx->mgf1_mdnid = md_nid; |
346 | 35.4k | OPENSSL_strlcpy(ctx->mgf1_mdname, mdname, sizeof(ctx->mgf1_mdname)); |
347 | 35.4k | } |
348 | | |
349 | 35.6k | EVP_MD_CTX_free(ctx->mdctx); |
350 | 35.6k | EVP_MD_free(ctx->md); |
351 | | |
352 | 35.6k | ctx->mdctx = NULL; |
353 | 35.6k | ctx->md = md; |
354 | 35.6k | ctx->mdnid = md_nid; |
355 | 35.6k | OPENSSL_strlcpy(ctx->mdname, mdname, sizeof(ctx->mdname)); |
356 | 35.6k | } |
357 | | |
358 | 35.6k | return 1; |
359 | 35.7k | } |
360 | | |
361 | | static int rsa_setup_mgf1_md(PROV_RSA_CTX *ctx, const char *mdname, |
362 | | const char *mdprops) |
363 | 3.95k | { |
364 | 3.95k | size_t len; |
365 | 3.95k | EVP_MD *md = NULL; |
366 | 3.95k | int mdnid; |
367 | | |
368 | 3.95k | if (mdprops == NULL) |
369 | 3.95k | mdprops = ctx->propq; |
370 | | |
371 | 3.95k | if ((md = EVP_MD_fetch(ctx->libctx, mdname, mdprops)) == NULL) { |
372 | 0 | ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_DIGEST, |
373 | 0 | "%s could not be fetched", mdname); |
374 | 0 | return 0; |
375 | 0 | } |
376 | | /* The default for mgf1 is SHA1 - so allow SHA1 */ |
377 | 3.95k | if ((mdnid = ossl_digest_rsa_sign_get_md_nid(ctx->libctx, md, 1)) <= 0 |
378 | 3.95k | || !rsa_check_padding(ctx, NULL, mdname, mdnid)) { |
379 | 0 | if (mdnid <= 0) |
380 | 0 | ERR_raise_data(ERR_LIB_PROV, PROV_R_DIGEST_NOT_ALLOWED, |
381 | 0 | "digest=%s", mdname); |
382 | 0 | EVP_MD_free(md); |
383 | 0 | return 0; |
384 | 0 | } |
385 | 3.95k | len = OPENSSL_strlcpy(ctx->mgf1_mdname, mdname, sizeof(ctx->mgf1_mdname)); |
386 | 3.95k | if (len >= sizeof(ctx->mgf1_mdname)) { |
387 | 0 | ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_DIGEST, |
388 | 0 | "%s exceeds name buffer length", mdname); |
389 | 0 | EVP_MD_free(md); |
390 | 0 | return 0; |
391 | 0 | } |
392 | | |
393 | 3.95k | EVP_MD_free(ctx->mgf1_md); |
394 | 3.95k | ctx->mgf1_md = md; |
395 | 3.95k | ctx->mgf1_mdnid = mdnid; |
396 | 3.95k | ctx->mgf1_md_set = 1; |
397 | 3.95k | return 1; |
398 | 3.95k | } |
399 | | |
400 | | static int rsa_signverify_init(void *vprsactx, void *vrsa, |
401 | | const OSSL_PARAM params[], int operation) |
402 | 35.7k | { |
403 | 35.7k | PROV_RSA_CTX *prsactx = (PROV_RSA_CTX *)vprsactx; |
404 | | |
405 | 35.7k | if (!ossl_prov_is_running() || prsactx == NULL) |
406 | 0 | return 0; |
407 | | |
408 | 35.7k | if (vrsa == NULL && prsactx->rsa == NULL) { |
409 | 0 | ERR_raise(ERR_LIB_PROV, PROV_R_NO_KEY_SET); |
410 | 0 | return 0; |
411 | 0 | } |
412 | | |
413 | 35.7k | if (vrsa != NULL) { |
414 | 35.7k | if (!ossl_rsa_check_key(prsactx->libctx, vrsa, operation)) |
415 | 0 | return 0; |
416 | | |
417 | 35.7k | if (!RSA_up_ref(vrsa)) |
418 | 0 | return 0; |
419 | 35.7k | RSA_free(prsactx->rsa); |
420 | 35.7k | prsactx->rsa = vrsa; |
421 | 35.7k | } |
422 | | |
423 | 35.7k | prsactx->operation = operation; |
424 | | |
425 | | /* Maximize up to digest length for sign, auto for verify */ |
426 | 35.7k | prsactx->saltlen = RSA_PSS_SALTLEN_AUTO_DIGEST_MAX; |
427 | 35.7k | prsactx->min_saltlen = -1; |
428 | | |
429 | 35.7k | switch (RSA_test_flags(prsactx->rsa, RSA_FLAG_TYPE_MASK)) { |
430 | 35.4k | case RSA_FLAG_TYPE_RSA: |
431 | 35.4k | prsactx->pad_mode = RSA_PKCS1_PADDING; |
432 | 35.4k | break; |
433 | 240 | case RSA_FLAG_TYPE_RSASSAPSS: |
434 | 240 | prsactx->pad_mode = RSA_PKCS1_PSS_PADDING; |
435 | | |
436 | 240 | { |
437 | 240 | const RSA_PSS_PARAMS_30 *pss = |
438 | 240 | ossl_rsa_get0_pss_params_30(prsactx->rsa); |
439 | | |
440 | 240 | if (!ossl_rsa_pss_params_30_is_unrestricted(pss)) { |
441 | 240 | int md_nid = ossl_rsa_pss_params_30_hashalg(pss); |
442 | 240 | int mgf1md_nid = ossl_rsa_pss_params_30_maskgenhashalg(pss); |
443 | 240 | int min_saltlen = ossl_rsa_pss_params_30_saltlen(pss); |
444 | 240 | const char *mdname, *mgf1mdname; |
445 | 240 | size_t len; |
446 | | |
447 | 240 | mdname = ossl_rsa_oaeppss_nid2name(md_nid); |
448 | 240 | mgf1mdname = ossl_rsa_oaeppss_nid2name(mgf1md_nid); |
449 | | |
450 | 240 | if (mdname == NULL) { |
451 | 0 | ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_DIGEST, |
452 | 0 | "PSS restrictions lack hash algorithm"); |
453 | 0 | return 0; |
454 | 0 | } |
455 | 240 | if (mgf1mdname == NULL) { |
456 | 0 | ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_DIGEST, |
457 | 0 | "PSS restrictions lack MGF1 hash algorithm"); |
458 | 0 | return 0; |
459 | 0 | } |
460 | | |
461 | 240 | len = OPENSSL_strlcpy(prsactx->mdname, mdname, |
462 | 240 | sizeof(prsactx->mdname)); |
463 | 240 | if (len >= sizeof(prsactx->mdname)) { |
464 | 0 | ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_DIGEST, |
465 | 0 | "hash algorithm name too long"); |
466 | 0 | return 0; |
467 | 0 | } |
468 | 240 | len = OPENSSL_strlcpy(prsactx->mgf1_mdname, mgf1mdname, |
469 | 240 | sizeof(prsactx->mgf1_mdname)); |
470 | 240 | if (len >= sizeof(prsactx->mgf1_mdname)) { |
471 | 0 | ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_DIGEST, |
472 | 0 | "MGF1 hash algorithm name too long"); |
473 | 0 | return 0; |
474 | 0 | } |
475 | 240 | prsactx->saltlen = min_saltlen; |
476 | | |
477 | | /* call rsa_setup_mgf1_md before rsa_setup_md to avoid duplication */ |
478 | 240 | if (!rsa_setup_mgf1_md(prsactx, mgf1mdname, prsactx->propq) |
479 | 240 | || !rsa_setup_md(prsactx, mdname, prsactx->propq) |
480 | 240 | || !rsa_check_parameters(prsactx, min_saltlen)) |
481 | 7 | return 0; |
482 | 240 | } |
483 | 240 | } |
484 | | |
485 | 233 | break; |
486 | 233 | default: |
487 | 0 | ERR_raise(ERR_LIB_RSA, PROV_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE); |
488 | 0 | return 0; |
489 | 35.7k | } |
490 | | |
491 | 35.7k | if (!rsa_set_ctx_params(prsactx, params)) |
492 | 0 | return 0; |
493 | | |
494 | 35.7k | return 1; |
495 | 35.7k | } |
496 | | |
497 | | static int setup_tbuf(PROV_RSA_CTX *ctx) |
498 | 11.6k | { |
499 | 11.6k | if (ctx->tbuf != NULL) |
500 | 0 | return 1; |
501 | 11.6k | if ((ctx->tbuf = OPENSSL_malloc(RSA_size(ctx->rsa))) == NULL) { |
502 | 13 | ERR_raise(ERR_LIB_PROV, ERR_R_MALLOC_FAILURE); |
503 | 13 | return 0; |
504 | 13 | } |
505 | 11.6k | return 1; |
506 | 11.6k | } |
507 | | |
508 | | static void clean_tbuf(PROV_RSA_CTX *ctx) |
509 | 68.6k | { |
510 | 68.6k | if (ctx->tbuf != NULL) |
511 | 12.4k | OPENSSL_cleanse(ctx->tbuf, RSA_size(ctx->rsa)); |
512 | 68.6k | } |
513 | | |
514 | | static void free_tbuf(PROV_RSA_CTX *ctx) |
515 | 67.8k | { |
516 | 67.8k | clean_tbuf(ctx); |
517 | 67.8k | OPENSSL_free(ctx->tbuf); |
518 | 67.8k | ctx->tbuf = NULL; |
519 | 67.8k | } |
520 | | |
521 | | static int rsa_sign_init(void *vprsactx, void *vrsa, const OSSL_PARAM params[]) |
522 | 0 | { |
523 | 0 | if (!ossl_prov_is_running()) |
524 | 0 | return 0; |
525 | 0 | return rsa_signverify_init(vprsactx, vrsa, params, EVP_PKEY_OP_SIGN); |
526 | 0 | } |
527 | | |
528 | | static int rsa_sign(void *vprsactx, unsigned char *sig, size_t *siglen, |
529 | | size_t sigsize, const unsigned char *tbs, size_t tbslen) |
530 | 6.38k | { |
531 | 6.38k | PROV_RSA_CTX *prsactx = (PROV_RSA_CTX *)vprsactx; |
532 | 6.38k | int ret; |
533 | 6.38k | size_t rsasize = RSA_size(prsactx->rsa); |
534 | 6.38k | size_t mdsize = rsa_get_md_size(prsactx); |
535 | | |
536 | 6.38k | if (!ossl_prov_is_running()) |
537 | 0 | return 0; |
538 | | |
539 | 6.38k | if (sig == NULL) { |
540 | 3.19k | *siglen = rsasize; |
541 | 3.19k | return 1; |
542 | 3.19k | } |
543 | | |
544 | 3.19k | if (sigsize < rsasize) { |
545 | 0 | ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_SIGNATURE_SIZE, |
546 | 0 | "is %zu, should be at least %zu", sigsize, rsasize); |
547 | 0 | return 0; |
548 | 0 | } |
549 | | |
550 | 3.19k | if (mdsize != 0) { |
551 | 3.19k | if (tbslen != mdsize) { |
552 | 0 | ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_DIGEST_LENGTH); |
553 | 0 | return 0; |
554 | 0 | } |
555 | | |
556 | 3.19k | #ifndef FIPS_MODULE |
557 | 3.19k | if (EVP_MD_is_a(prsactx->md, OSSL_DIGEST_NAME_MDC2)) { |
558 | 0 | unsigned int sltmp; |
559 | |
|
560 | 0 | if (prsactx->pad_mode != RSA_PKCS1_PADDING) { |
561 | 0 | ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_PADDING_MODE, |
562 | 0 | "only PKCS#1 padding supported with MDC2"); |
563 | 0 | return 0; |
564 | 0 | } |
565 | 0 | ret = RSA_sign_ASN1_OCTET_STRING(0, tbs, tbslen, sig, &sltmp, |
566 | 0 | prsactx->rsa); |
567 | |
|
568 | 0 | if (ret <= 0) { |
569 | 0 | ERR_raise(ERR_LIB_PROV, ERR_R_RSA_LIB); |
570 | 0 | return 0; |
571 | 0 | } |
572 | 0 | ret = sltmp; |
573 | 0 | goto end; |
574 | 0 | } |
575 | 3.19k | #endif |
576 | 3.19k | switch (prsactx->pad_mode) { |
577 | 0 | case RSA_X931_PADDING: |
578 | 0 | if ((size_t)RSA_size(prsactx->rsa) < tbslen + 1) { |
579 | 0 | ERR_raise_data(ERR_LIB_PROV, PROV_R_KEY_SIZE_TOO_SMALL, |
580 | 0 | "RSA key size = %d, expected minimum = %d", |
581 | 0 | RSA_size(prsactx->rsa), tbslen + 1); |
582 | 0 | return 0; |
583 | 0 | } |
584 | 0 | if (!setup_tbuf(prsactx)) { |
585 | 0 | ERR_raise(ERR_LIB_PROV, ERR_R_MALLOC_FAILURE); |
586 | 0 | return 0; |
587 | 0 | } |
588 | 0 | memcpy(prsactx->tbuf, tbs, tbslen); |
589 | 0 | prsactx->tbuf[tbslen] = RSA_X931_hash_id(prsactx->mdnid); |
590 | 0 | ret = RSA_private_encrypt(tbslen + 1, prsactx->tbuf, |
591 | 0 | sig, prsactx->rsa, RSA_X931_PADDING); |
592 | 0 | clean_tbuf(prsactx); |
593 | 0 | break; |
594 | | |
595 | 2.36k | case RSA_PKCS1_PADDING: |
596 | 2.36k | { |
597 | 2.36k | unsigned int sltmp; |
598 | | |
599 | 2.36k | ret = RSA_sign(prsactx->mdnid, tbs, tbslen, sig, &sltmp, |
600 | 2.36k | prsactx->rsa); |
601 | 2.36k | if (ret <= 0) { |
602 | 0 | ERR_raise(ERR_LIB_PROV, ERR_R_RSA_LIB); |
603 | 0 | return 0; |
604 | 0 | } |
605 | 2.36k | ret = sltmp; |
606 | 2.36k | } |
607 | 0 | break; |
608 | | |
609 | 826 | case RSA_PKCS1_PSS_PADDING: |
610 | | /* Check PSS restrictions */ |
611 | 826 | if (rsa_pss_restricted(prsactx)) { |
612 | 0 | switch (prsactx->saltlen) { |
613 | 0 | case RSA_PSS_SALTLEN_DIGEST: |
614 | 0 | if (prsactx->min_saltlen > EVP_MD_get_size(prsactx->md)) { |
615 | 0 | ERR_raise_data(ERR_LIB_PROV, |
616 | 0 | PROV_R_PSS_SALTLEN_TOO_SMALL, |
617 | 0 | "minimum salt length set to %d, " |
618 | 0 | "but the digest only gives %d", |
619 | 0 | prsactx->min_saltlen, |
620 | 0 | EVP_MD_get_size(prsactx->md)); |
621 | 0 | return 0; |
622 | 0 | } |
623 | | /* FALLTHRU */ |
624 | 0 | default: |
625 | 0 | if (prsactx->saltlen >= 0 |
626 | 0 | && prsactx->saltlen < prsactx->min_saltlen) { |
627 | 0 | ERR_raise_data(ERR_LIB_PROV, |
628 | 0 | PROV_R_PSS_SALTLEN_TOO_SMALL, |
629 | 0 | "minimum salt length set to %d, but the" |
630 | 0 | "actual salt length is only set to %d", |
631 | 0 | prsactx->min_saltlen, |
632 | 0 | prsactx->saltlen); |
633 | 0 | return 0; |
634 | 0 | } |
635 | 0 | break; |
636 | 0 | } |
637 | 0 | } |
638 | 826 | if (!setup_tbuf(prsactx)) |
639 | 0 | return 0; |
640 | 826 | if (!RSA_padding_add_PKCS1_PSS_mgf1(prsactx->rsa, |
641 | 826 | prsactx->tbuf, tbs, |
642 | 826 | prsactx->md, prsactx->mgf1_md, |
643 | 826 | prsactx->saltlen)) { |
644 | 0 | ERR_raise(ERR_LIB_PROV, ERR_R_RSA_LIB); |
645 | 0 | return 0; |
646 | 0 | } |
647 | 826 | ret = RSA_private_encrypt(RSA_size(prsactx->rsa), prsactx->tbuf, |
648 | 826 | sig, prsactx->rsa, RSA_NO_PADDING); |
649 | 826 | clean_tbuf(prsactx); |
650 | 826 | break; |
651 | | |
652 | 0 | default: |
653 | 0 | ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_PADDING_MODE, |
654 | 0 | "Only X.931, PKCS#1 v1.5 or PSS padding allowed"); |
655 | 0 | return 0; |
656 | 3.19k | } |
657 | 3.19k | } else { |
658 | 0 | ret = RSA_private_encrypt(tbslen, tbs, sig, prsactx->rsa, |
659 | 0 | prsactx->pad_mode); |
660 | 0 | } |
661 | | |
662 | 3.19k | #ifndef FIPS_MODULE |
663 | 3.19k | end: |
664 | 3.19k | #endif |
665 | 3.19k | if (ret <= 0) { |
666 | 0 | ERR_raise(ERR_LIB_PROV, ERR_R_RSA_LIB); |
667 | 0 | return 0; |
668 | 0 | } |
669 | | |
670 | 3.19k | *siglen = ret; |
671 | 3.19k | return 1; |
672 | 3.19k | } |
673 | | |
674 | | static int rsa_verify_recover_init(void *vprsactx, void *vrsa, |
675 | | const OSSL_PARAM params[]) |
676 | 0 | { |
677 | 0 | if (!ossl_prov_is_running()) |
678 | 0 | return 0; |
679 | 0 | return rsa_signverify_init(vprsactx, vrsa, params, |
680 | 0 | EVP_PKEY_OP_VERIFYRECOVER); |
681 | 0 | } |
682 | | |
683 | | static int rsa_verify_recover(void *vprsactx, |
684 | | unsigned char *rout, |
685 | | size_t *routlen, |
686 | | size_t routsize, |
687 | | const unsigned char *sig, |
688 | | size_t siglen) |
689 | 0 | { |
690 | 0 | PROV_RSA_CTX *prsactx = (PROV_RSA_CTX *)vprsactx; |
691 | 0 | int ret; |
692 | |
|
693 | 0 | if (!ossl_prov_is_running()) |
694 | 0 | return 0; |
695 | | |
696 | 0 | if (rout == NULL) { |
697 | 0 | *routlen = RSA_size(prsactx->rsa); |
698 | 0 | return 1; |
699 | 0 | } |
700 | | |
701 | 0 | if (prsactx->md != NULL) { |
702 | 0 | switch (prsactx->pad_mode) { |
703 | 0 | case RSA_X931_PADDING: |
704 | 0 | if (!setup_tbuf(prsactx)) |
705 | 0 | return 0; |
706 | 0 | ret = RSA_public_decrypt(siglen, sig, prsactx->tbuf, prsactx->rsa, |
707 | 0 | RSA_X931_PADDING); |
708 | 0 | if (ret < 1) { |
709 | 0 | ERR_raise(ERR_LIB_PROV, ERR_R_RSA_LIB); |
710 | 0 | return 0; |
711 | 0 | } |
712 | 0 | ret--; |
713 | 0 | if (prsactx->tbuf[ret] != RSA_X931_hash_id(prsactx->mdnid)) { |
714 | 0 | ERR_raise(ERR_LIB_PROV, PROV_R_ALGORITHM_MISMATCH); |
715 | 0 | return 0; |
716 | 0 | } |
717 | 0 | if (ret != EVP_MD_get_size(prsactx->md)) { |
718 | 0 | ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_DIGEST_LENGTH, |
719 | 0 | "Should be %d, but got %d", |
720 | 0 | EVP_MD_get_size(prsactx->md), ret); |
721 | 0 | return 0; |
722 | 0 | } |
723 | | |
724 | 0 | *routlen = ret; |
725 | 0 | if (rout != prsactx->tbuf) { |
726 | 0 | if (routsize < (size_t)ret) { |
727 | 0 | ERR_raise_data(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL, |
728 | 0 | "buffer size is %d, should be %d", |
729 | 0 | routsize, ret); |
730 | 0 | return 0; |
731 | 0 | } |
732 | 0 | memcpy(rout, prsactx->tbuf, ret); |
733 | 0 | } |
734 | 0 | break; |
735 | | |
736 | 0 | case RSA_PKCS1_PADDING: |
737 | 0 | { |
738 | 0 | size_t sltmp; |
739 | |
|
740 | 0 | ret = ossl_rsa_verify(prsactx->mdnid, NULL, 0, rout, &sltmp, |
741 | 0 | sig, siglen, prsactx->rsa); |
742 | 0 | if (ret <= 0) { |
743 | 0 | ERR_raise(ERR_LIB_PROV, ERR_R_RSA_LIB); |
744 | 0 | return 0; |
745 | 0 | } |
746 | 0 | ret = sltmp; |
747 | 0 | } |
748 | 0 | break; |
749 | | |
750 | 0 | default: |
751 | 0 | ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_PADDING_MODE, |
752 | 0 | "Only X.931 or PKCS#1 v1.5 padding allowed"); |
753 | 0 | return 0; |
754 | 0 | } |
755 | 0 | } else { |
756 | 0 | ret = RSA_public_decrypt(siglen, sig, rout, prsactx->rsa, |
757 | 0 | prsactx->pad_mode); |
758 | 0 | if (ret < 0) { |
759 | 0 | ERR_raise(ERR_LIB_PROV, ERR_R_RSA_LIB); |
760 | 0 | return 0; |
761 | 0 | } |
762 | 0 | } |
763 | 0 | *routlen = ret; |
764 | 0 | return 1; |
765 | 0 | } |
766 | | |
767 | | static int rsa_verify_init(void *vprsactx, void *vrsa, |
768 | | const OSSL_PARAM params[]) |
769 | 0 | { |
770 | 0 | if (!ossl_prov_is_running()) |
771 | 0 | return 0; |
772 | 0 | return rsa_signverify_init(vprsactx, vrsa, params, EVP_PKEY_OP_VERIFY); |
773 | 0 | } |
774 | | |
775 | | static int rsa_verify(void *vprsactx, const unsigned char *sig, size_t siglen, |
776 | | const unsigned char *tbs, size_t tbslen) |
777 | 13.7k | { |
778 | 13.7k | PROV_RSA_CTX *prsactx = (PROV_RSA_CTX *)vprsactx; |
779 | 13.7k | size_t rslen; |
780 | | |
781 | 13.7k | if (!ossl_prov_is_running()) |
782 | 0 | return 0; |
783 | 13.7k | if (prsactx->md != NULL) { |
784 | 13.7k | switch (prsactx->pad_mode) { |
785 | 2.93k | case RSA_PKCS1_PADDING: |
786 | 2.93k | if (!RSA_verify(prsactx->mdnid, tbs, tbslen, sig, siglen, |
787 | 2.93k | prsactx->rsa)) { |
788 | 2.62k | ERR_raise(ERR_LIB_PROV, ERR_R_RSA_LIB); |
789 | 2.62k | return 0; |
790 | 2.62k | } |
791 | 308 | return 1; |
792 | 0 | case RSA_X931_PADDING: |
793 | 0 | if (!setup_tbuf(prsactx)) |
794 | 0 | return 0; |
795 | 0 | if (rsa_verify_recover(prsactx, prsactx->tbuf, &rslen, 0, |
796 | 0 | sig, siglen) <= 0) |
797 | 0 | return 0; |
798 | 0 | break; |
799 | 10.8k | case RSA_PKCS1_PSS_PADDING: |
800 | 10.8k | { |
801 | 10.8k | int ret; |
802 | 10.8k | size_t mdsize; |
803 | | |
804 | | /* |
805 | | * We need to check this for the RSA_verify_PKCS1_PSS_mgf1() |
806 | | * call |
807 | | */ |
808 | 10.8k | mdsize = rsa_get_md_size(prsactx); |
809 | 10.8k | if (tbslen != mdsize) { |
810 | 0 | ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_DIGEST_LENGTH, |
811 | 0 | "Should be %d, but got %d", |
812 | 0 | mdsize, tbslen); |
813 | 0 | return 0; |
814 | 0 | } |
815 | | |
816 | 10.8k | if (!setup_tbuf(prsactx)) |
817 | 13 | return 0; |
818 | 10.8k | ret = RSA_public_decrypt(siglen, sig, prsactx->tbuf, |
819 | 10.8k | prsactx->rsa, RSA_NO_PADDING); |
820 | 10.8k | if (ret <= 0) { |
821 | 2.18k | ERR_raise(ERR_LIB_PROV, ERR_R_RSA_LIB); |
822 | 2.18k | return 0; |
823 | 2.18k | } |
824 | 8.63k | ret = RSA_verify_PKCS1_PSS_mgf1(prsactx->rsa, tbs, |
825 | 8.63k | prsactx->md, prsactx->mgf1_md, |
826 | 8.63k | prsactx->tbuf, |
827 | 8.63k | prsactx->saltlen); |
828 | 8.63k | if (ret <= 0) { |
829 | 8.63k | ERR_raise(ERR_LIB_PROV, ERR_R_RSA_LIB); |
830 | 8.63k | return 0; |
831 | 8.63k | } |
832 | 9 | return 1; |
833 | 8.63k | } |
834 | 0 | default: |
835 | 0 | ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_PADDING_MODE, |
836 | 0 | "Only X.931, PKCS#1 v1.5 or PSS padding allowed"); |
837 | 0 | return 0; |
838 | 13.7k | } |
839 | 13.7k | } else { |
840 | 0 | int ret; |
841 | |
|
842 | 0 | if (!setup_tbuf(prsactx)) |
843 | 0 | return 0; |
844 | 0 | ret = RSA_public_decrypt(siglen, sig, prsactx->tbuf, prsactx->rsa, |
845 | 0 | prsactx->pad_mode); |
846 | 0 | if (ret <= 0) { |
847 | 0 | ERR_raise(ERR_LIB_PROV, ERR_R_RSA_LIB); |
848 | 0 | return 0; |
849 | 0 | } |
850 | 0 | rslen = (size_t)ret; |
851 | 0 | } |
852 | | |
853 | 0 | if ((rslen != tbslen) || memcmp(tbs, prsactx->tbuf, rslen)) |
854 | 0 | return 0; |
855 | | |
856 | 0 | return 1; |
857 | 0 | } |
858 | | |
859 | | static int rsa_digest_signverify_init(void *vprsactx, const char *mdname, |
860 | | void *vrsa, const OSSL_PARAM params[], |
861 | | int operation) |
862 | 50.9k | { |
863 | 50.9k | PROV_RSA_CTX *prsactx = (PROV_RSA_CTX *)vprsactx; |
864 | | |
865 | 50.9k | if (!ossl_prov_is_running()) |
866 | 0 | return 0; |
867 | | |
868 | 50.9k | if (!rsa_signverify_init(vprsactx, vrsa, params, operation)) |
869 | 10 | return 0; |
870 | | |
871 | 50.9k | if (mdname != NULL |
872 | | /* was rsa_setup_md already called in rsa_signverify_init()? */ |
873 | 50.9k | && (mdname[0] == '\0' || OPENSSL_strcasecmp(prsactx->mdname, mdname) != 0) |
874 | 50.9k | && !rsa_setup_md(prsactx, mdname, prsactx->propq)) |
875 | 109 | return 0; |
876 | | |
877 | 50.7k | prsactx->flag_allow_md = 0; |
878 | | |
879 | 50.7k | if (prsactx->mdctx == NULL) { |
880 | 50.7k | prsactx->mdctx = EVP_MD_CTX_new(); |
881 | 50.7k | if (prsactx->mdctx == NULL) |
882 | 0 | goto error; |
883 | 50.7k | } |
884 | | |
885 | 50.7k | if (!EVP_DigestInit_ex2(prsactx->mdctx, prsactx->md, params)) |
886 | 0 | goto error; |
887 | | |
888 | 50.7k | return 1; |
889 | | |
890 | 0 | error: |
891 | 0 | EVP_MD_CTX_free(prsactx->mdctx); |
892 | 0 | prsactx->mdctx = NULL; |
893 | 0 | return 0; |
894 | 50.7k | } |
895 | | |
896 | | static int rsa_digest_signverify_update(void *vprsactx, |
897 | | const unsigned char *data, |
898 | | size_t datalen) |
899 | 16.9k | { |
900 | 16.9k | PROV_RSA_CTX *prsactx = (PROV_RSA_CTX *)vprsactx; |
901 | | |
902 | 16.9k | if (prsactx == NULL || prsactx->mdctx == NULL) |
903 | 0 | return 0; |
904 | | |
905 | 16.9k | return EVP_DigestUpdate(prsactx->mdctx, data, datalen); |
906 | 16.9k | } |
907 | | |
908 | | static int rsa_digest_sign_init(void *vprsactx, const char *mdname, |
909 | | void *vrsa, const OSSL_PARAM params[]) |
910 | 37.0k | { |
911 | 37.0k | if (!ossl_prov_is_running()) |
912 | 0 | return 0; |
913 | 37.0k | return rsa_digest_signverify_init(vprsactx, mdname, vrsa, |
914 | 37.0k | params, EVP_PKEY_OP_SIGN); |
915 | 37.0k | } |
916 | | |
917 | | static int rsa_digest_sign_final(void *vprsactx, unsigned char *sig, |
918 | | size_t *siglen, size_t sigsize) |
919 | 6.38k | { |
920 | 6.38k | PROV_RSA_CTX *prsactx = (PROV_RSA_CTX *)vprsactx; |
921 | 6.38k | unsigned char digest[EVP_MAX_MD_SIZE]; |
922 | 6.38k | unsigned int dlen = 0; |
923 | | |
924 | 6.38k | if (!ossl_prov_is_running() || prsactx == NULL) |
925 | 0 | return 0; |
926 | 6.38k | prsactx->flag_allow_md = 1; |
927 | 6.38k | if (prsactx->mdctx == NULL) |
928 | 0 | return 0; |
929 | | /* |
930 | | * If sig is NULL then we're just finding out the sig size. Other fields |
931 | | * are ignored. Defer to rsa_sign. |
932 | | */ |
933 | 6.38k | if (sig != NULL) { |
934 | | /* |
935 | | * The digests used here are all known (see rsa_get_md_nid()), so they |
936 | | * should not exceed the internal buffer size of EVP_MAX_MD_SIZE. |
937 | | */ |
938 | 3.19k | if (!EVP_DigestFinal_ex(prsactx->mdctx, digest, &dlen)) |
939 | 0 | return 0; |
940 | 3.19k | } |
941 | | |
942 | 6.38k | return rsa_sign(vprsactx, sig, siglen, sigsize, digest, (size_t)dlen); |
943 | 6.38k | } |
944 | | |
945 | | static int rsa_digest_verify_init(void *vprsactx, const char *mdname, |
946 | | void *vrsa, const OSSL_PARAM params[]) |
947 | 13.8k | { |
948 | 13.8k | if (!ossl_prov_is_running()) |
949 | 0 | return 0; |
950 | 13.8k | return rsa_digest_signverify_init(vprsactx, mdname, vrsa, |
951 | 13.8k | params, EVP_PKEY_OP_VERIFY); |
952 | 13.8k | } |
953 | | |
954 | | int rsa_digest_verify_final(void *vprsactx, const unsigned char *sig, |
955 | | size_t siglen) |
956 | 13.7k | { |
957 | 13.7k | PROV_RSA_CTX *prsactx = (PROV_RSA_CTX *)vprsactx; |
958 | 13.7k | unsigned char digest[EVP_MAX_MD_SIZE]; |
959 | 13.7k | unsigned int dlen = 0; |
960 | | |
961 | 13.7k | if (!ossl_prov_is_running()) |
962 | 0 | return 0; |
963 | | |
964 | 13.7k | if (prsactx == NULL) |
965 | 0 | return 0; |
966 | 13.7k | prsactx->flag_allow_md = 1; |
967 | 13.7k | if (prsactx->mdctx == NULL) |
968 | 0 | return 0; |
969 | | |
970 | | /* |
971 | | * The digests used here are all known (see rsa_get_md_nid()), so they |
972 | | * should not exceed the internal buffer size of EVP_MAX_MD_SIZE. |
973 | | */ |
974 | 13.7k | if (!EVP_DigestFinal_ex(prsactx->mdctx, digest, &dlen)) |
975 | 0 | return 0; |
976 | | |
977 | 13.7k | return rsa_verify(vprsactx, sig, siglen, digest, (size_t)dlen); |
978 | 13.7k | } |
979 | | |
980 | | static void rsa_freectx(void *vprsactx) |
981 | 67.8k | { |
982 | 67.8k | PROV_RSA_CTX *prsactx = (PROV_RSA_CTX *)vprsactx; |
983 | | |
984 | 67.8k | if (prsactx == NULL) |
985 | 0 | return; |
986 | | |
987 | 67.8k | EVP_MD_CTX_free(prsactx->mdctx); |
988 | 67.8k | EVP_MD_free(prsactx->md); |
989 | 67.8k | EVP_MD_free(prsactx->mgf1_md); |
990 | 67.8k | OPENSSL_free(prsactx->propq); |
991 | 67.8k | free_tbuf(prsactx); |
992 | 67.8k | RSA_free(prsactx->rsa); |
993 | | |
994 | 67.8k | OPENSSL_clear_free(prsactx, sizeof(*prsactx)); |
995 | 67.8k | } |
996 | | |
997 | | static void *rsa_dupctx(void *vprsactx) |
998 | 16.9k | { |
999 | 16.9k | PROV_RSA_CTX *srcctx = (PROV_RSA_CTX *)vprsactx; |
1000 | 16.9k | PROV_RSA_CTX *dstctx; |
1001 | | |
1002 | 16.9k | if (!ossl_prov_is_running()) |
1003 | 0 | return NULL; |
1004 | | |
1005 | 16.9k | dstctx = OPENSSL_zalloc(sizeof(*srcctx)); |
1006 | 16.9k | if (dstctx == NULL) { |
1007 | 0 | ERR_raise(ERR_LIB_PROV, ERR_R_MALLOC_FAILURE); |
1008 | 0 | return NULL; |
1009 | 0 | } |
1010 | | |
1011 | 16.9k | *dstctx = *srcctx; |
1012 | 16.9k | dstctx->rsa = NULL; |
1013 | 16.9k | dstctx->md = NULL; |
1014 | 16.9k | dstctx->mgf1_md = NULL; |
1015 | 16.9k | dstctx->mdctx = NULL; |
1016 | 16.9k | dstctx->tbuf = NULL; |
1017 | 16.9k | dstctx->propq = NULL; |
1018 | | |
1019 | 16.9k | if (srcctx->rsa != NULL && !RSA_up_ref(srcctx->rsa)) |
1020 | 0 | goto err; |
1021 | 16.9k | dstctx->rsa = srcctx->rsa; |
1022 | | |
1023 | 16.9k | if (srcctx->md != NULL && !EVP_MD_up_ref(srcctx->md)) |
1024 | 0 | goto err; |
1025 | 16.9k | dstctx->md = srcctx->md; |
1026 | | |
1027 | 16.9k | if (srcctx->mgf1_md != NULL && !EVP_MD_up_ref(srcctx->mgf1_md)) |
1028 | 0 | goto err; |
1029 | 16.9k | dstctx->mgf1_md = srcctx->mgf1_md; |
1030 | | |
1031 | 16.9k | if (srcctx->mdctx != NULL) { |
1032 | 16.9k | dstctx->mdctx = EVP_MD_CTX_new(); |
1033 | 16.9k | if (dstctx->mdctx == NULL |
1034 | 16.9k | || !EVP_MD_CTX_copy_ex(dstctx->mdctx, srcctx->mdctx)) |
1035 | 0 | goto err; |
1036 | 16.9k | } |
1037 | | |
1038 | 16.9k | if (srcctx->propq != NULL) { |
1039 | 0 | dstctx->propq = OPENSSL_strdup(srcctx->propq); |
1040 | 0 | if (dstctx->propq == NULL) |
1041 | 0 | goto err; |
1042 | 0 | } |
1043 | | |
1044 | 16.9k | return dstctx; |
1045 | 0 | err: |
1046 | 0 | rsa_freectx(dstctx); |
1047 | 0 | return NULL; |
1048 | 16.9k | } |
1049 | | |
1050 | | static int rsa_get_ctx_params(void *vprsactx, OSSL_PARAM *params) |
1051 | 0 | { |
1052 | 0 | PROV_RSA_CTX *prsactx = (PROV_RSA_CTX *)vprsactx; |
1053 | 0 | OSSL_PARAM *p; |
1054 | |
|
1055 | 0 | if (prsactx == NULL) |
1056 | 0 | return 0; |
1057 | | |
1058 | 0 | p = OSSL_PARAM_locate(params, OSSL_SIGNATURE_PARAM_ALGORITHM_ID); |
1059 | 0 | if (p != NULL) { |
1060 | | /* The Algorithm Identifier of the combined signature algorithm */ |
1061 | 0 | unsigned char aid_buf[128]; |
1062 | 0 | unsigned char *aid; |
1063 | 0 | size_t aid_len; |
1064 | |
|
1065 | 0 | aid = rsa_generate_signature_aid(prsactx, aid_buf, |
1066 | 0 | sizeof(aid_buf), &aid_len); |
1067 | 0 | if (aid == NULL || !OSSL_PARAM_set_octet_string(p, aid, aid_len)) |
1068 | 0 | return 0; |
1069 | 0 | } |
1070 | | |
1071 | 0 | p = OSSL_PARAM_locate(params, OSSL_SIGNATURE_PARAM_PAD_MODE); |
1072 | 0 | if (p != NULL) |
1073 | 0 | switch (p->data_type) { |
1074 | 0 | case OSSL_PARAM_INTEGER: |
1075 | 0 | if (!OSSL_PARAM_set_int(p, prsactx->pad_mode)) |
1076 | 0 | return 0; |
1077 | 0 | break; |
1078 | 0 | case OSSL_PARAM_UTF8_STRING: |
1079 | 0 | { |
1080 | 0 | int i; |
1081 | 0 | const char *word = NULL; |
1082 | |
|
1083 | 0 | for (i = 0; padding_item[i].id != 0; i++) { |
1084 | 0 | if (prsactx->pad_mode == (int)padding_item[i].id) { |
1085 | 0 | word = padding_item[i].ptr; |
1086 | 0 | break; |
1087 | 0 | } |
1088 | 0 | } |
1089 | |
|
1090 | 0 | if (word != NULL) { |
1091 | 0 | if (!OSSL_PARAM_set_utf8_string(p, word)) |
1092 | 0 | return 0; |
1093 | 0 | } else { |
1094 | 0 | ERR_raise(ERR_LIB_PROV, ERR_R_INTERNAL_ERROR); |
1095 | 0 | } |
1096 | 0 | } |
1097 | 0 | break; |
1098 | 0 | default: |
1099 | 0 | return 0; |
1100 | 0 | } |
1101 | | |
1102 | 0 | p = OSSL_PARAM_locate(params, OSSL_SIGNATURE_PARAM_DIGEST); |
1103 | 0 | if (p != NULL && !OSSL_PARAM_set_utf8_string(p, prsactx->mdname)) |
1104 | 0 | return 0; |
1105 | | |
1106 | 0 | p = OSSL_PARAM_locate(params, OSSL_SIGNATURE_PARAM_MGF1_DIGEST); |
1107 | 0 | if (p != NULL && !OSSL_PARAM_set_utf8_string(p, prsactx->mgf1_mdname)) |
1108 | 0 | return 0; |
1109 | | |
1110 | 0 | p = OSSL_PARAM_locate(params, OSSL_SIGNATURE_PARAM_PSS_SALTLEN); |
1111 | 0 | if (p != NULL) { |
1112 | 0 | if (p->data_type == OSSL_PARAM_INTEGER) { |
1113 | 0 | if (!OSSL_PARAM_set_int(p, prsactx->saltlen)) |
1114 | 0 | return 0; |
1115 | 0 | } else if (p->data_type == OSSL_PARAM_UTF8_STRING) { |
1116 | 0 | const char *value = NULL; |
1117 | |
|
1118 | 0 | switch (prsactx->saltlen) { |
1119 | 0 | case RSA_PSS_SALTLEN_DIGEST: |
1120 | 0 | value = OSSL_PKEY_RSA_PSS_SALT_LEN_DIGEST; |
1121 | 0 | break; |
1122 | 0 | case RSA_PSS_SALTLEN_MAX: |
1123 | 0 | value = OSSL_PKEY_RSA_PSS_SALT_LEN_MAX; |
1124 | 0 | break; |
1125 | 0 | case RSA_PSS_SALTLEN_AUTO: |
1126 | 0 | value = OSSL_PKEY_RSA_PSS_SALT_LEN_AUTO; |
1127 | 0 | break; |
1128 | 0 | case RSA_PSS_SALTLEN_AUTO_DIGEST_MAX: |
1129 | 0 | value = OSSL_PKEY_RSA_PSS_SALT_LEN_AUTO_DIGEST_MAX; |
1130 | 0 | break; |
1131 | 0 | default: |
1132 | 0 | { |
1133 | 0 | int len = BIO_snprintf(p->data, p->data_size, "%d", |
1134 | 0 | prsactx->saltlen); |
1135 | |
|
1136 | 0 | if (len <= 0) |
1137 | 0 | return 0; |
1138 | 0 | p->return_size = len; |
1139 | 0 | break; |
1140 | 0 | } |
1141 | 0 | } |
1142 | 0 | if (value != NULL |
1143 | 0 | && !OSSL_PARAM_set_utf8_string(p, value)) |
1144 | 0 | return 0; |
1145 | 0 | } |
1146 | 0 | } |
1147 | | |
1148 | 0 | return 1; |
1149 | 0 | } |
1150 | | |
1151 | | static const OSSL_PARAM known_gettable_ctx_params[] = { |
1152 | | OSSL_PARAM_octet_string(OSSL_SIGNATURE_PARAM_ALGORITHM_ID, NULL, 0), |
1153 | | OSSL_PARAM_utf8_string(OSSL_SIGNATURE_PARAM_PAD_MODE, NULL, 0), |
1154 | | OSSL_PARAM_utf8_string(OSSL_SIGNATURE_PARAM_DIGEST, NULL, 0), |
1155 | | OSSL_PARAM_utf8_string(OSSL_SIGNATURE_PARAM_MGF1_DIGEST, NULL, 0), |
1156 | | OSSL_PARAM_utf8_string(OSSL_SIGNATURE_PARAM_PSS_SALTLEN, NULL, 0), |
1157 | | OSSL_PARAM_END |
1158 | | }; |
1159 | | |
1160 | | static const OSSL_PARAM *rsa_gettable_ctx_params(ossl_unused void *vprsactx, |
1161 | | ossl_unused void *provctx) |
1162 | 0 | { |
1163 | 0 | return known_gettable_ctx_params; |
1164 | 0 | } |
1165 | | |
1166 | | static int rsa_set_ctx_params(void *vprsactx, const OSSL_PARAM params[]) |
1167 | 36.5k | { |
1168 | 36.5k | PROV_RSA_CTX *prsactx = (PROV_RSA_CTX *)vprsactx; |
1169 | 36.5k | const OSSL_PARAM *p; |
1170 | 36.5k | int pad_mode; |
1171 | 36.5k | int saltlen; |
1172 | 36.5k | char mdname[OSSL_MAX_NAME_SIZE] = "", *pmdname = NULL; |
1173 | 36.5k | char mdprops[OSSL_MAX_PROPQUERY_SIZE] = "", *pmdprops = NULL; |
1174 | 36.5k | char mgf1mdname[OSSL_MAX_NAME_SIZE] = "", *pmgf1mdname = NULL; |
1175 | 36.5k | char mgf1mdprops[OSSL_MAX_PROPQUERY_SIZE] = "", *pmgf1mdprops = NULL; |
1176 | | |
1177 | 36.5k | if (prsactx == NULL) |
1178 | 0 | return 0; |
1179 | 36.5k | if (params == NULL) |
1180 | 23.6k | return 1; |
1181 | | |
1182 | 12.9k | pad_mode = prsactx->pad_mode; |
1183 | 12.9k | saltlen = prsactx->saltlen; |
1184 | | |
1185 | 12.9k | p = OSSL_PARAM_locate_const(params, OSSL_SIGNATURE_PARAM_DIGEST); |
1186 | 12.9k | if (p != NULL) { |
1187 | 0 | const OSSL_PARAM *propsp = |
1188 | 0 | OSSL_PARAM_locate_const(params, |
1189 | 0 | OSSL_SIGNATURE_PARAM_PROPERTIES); |
1190 | |
|
1191 | 0 | pmdname = mdname; |
1192 | 0 | if (!OSSL_PARAM_get_utf8_string(p, &pmdname, sizeof(mdname))) |
1193 | 0 | return 0; |
1194 | | |
1195 | 0 | if (propsp != NULL) { |
1196 | 0 | pmdprops = mdprops; |
1197 | 0 | if (!OSSL_PARAM_get_utf8_string(propsp, |
1198 | 0 | &pmdprops, sizeof(mdprops))) |
1199 | 0 | return 0; |
1200 | 0 | } |
1201 | 0 | } |
1202 | | |
1203 | 12.9k | p = OSSL_PARAM_locate_const(params, OSSL_SIGNATURE_PARAM_PAD_MODE); |
1204 | 12.9k | if (p != NULL) { |
1205 | 5.68k | const char *err_extra_text = NULL; |
1206 | | |
1207 | 5.68k | switch (p->data_type) { |
1208 | 5.68k | case OSSL_PARAM_INTEGER: /* Support for legacy pad mode number */ |
1209 | 5.68k | if (!OSSL_PARAM_get_int(p, &pad_mode)) |
1210 | 0 | return 0; |
1211 | 5.68k | break; |
1212 | 5.68k | case OSSL_PARAM_UTF8_STRING: |
1213 | 0 | { |
1214 | 0 | int i; |
1215 | |
|
1216 | 0 | if (p->data == NULL) |
1217 | 0 | return 0; |
1218 | | |
1219 | 0 | for (i = 0; padding_item[i].id != 0; i++) { |
1220 | 0 | if (strcmp(p->data, padding_item[i].ptr) == 0) { |
1221 | 0 | pad_mode = padding_item[i].id; |
1222 | 0 | break; |
1223 | 0 | } |
1224 | 0 | } |
1225 | 0 | } |
1226 | 0 | break; |
1227 | 0 | default: |
1228 | 0 | return 0; |
1229 | 5.68k | } |
1230 | | |
1231 | 5.68k | switch (pad_mode) { |
1232 | 0 | case RSA_PKCS1_OAEP_PADDING: |
1233 | | /* |
1234 | | * OAEP padding is for asymmetric cipher only so is not compatible |
1235 | | * with signature use. |
1236 | | */ |
1237 | 0 | err_extra_text = "OAEP padding not allowed for signing / verifying"; |
1238 | 0 | goto bad_pad; |
1239 | 5.68k | case RSA_PKCS1_PSS_PADDING: |
1240 | 5.68k | if ((prsactx->operation |
1241 | 5.68k | & (EVP_PKEY_OP_SIGN | EVP_PKEY_OP_VERIFY)) == 0) { |
1242 | 0 | err_extra_text = |
1243 | 0 | "PSS padding only allowed for sign and verify operations"; |
1244 | 0 | goto bad_pad; |
1245 | 0 | } |
1246 | 5.68k | break; |
1247 | 5.68k | case RSA_PKCS1_PADDING: |
1248 | 0 | err_extra_text = "PKCS#1 padding not allowed with RSA-PSS"; |
1249 | 0 | goto cont; |
1250 | 0 | case RSA_NO_PADDING: |
1251 | 0 | err_extra_text = "No padding not allowed with RSA-PSS"; |
1252 | 0 | goto cont; |
1253 | 0 | case RSA_X931_PADDING: |
1254 | 0 | err_extra_text = "X.931 padding not allowed with RSA-PSS"; |
1255 | 0 | cont: |
1256 | 0 | if (RSA_test_flags(prsactx->rsa, |
1257 | 0 | RSA_FLAG_TYPE_MASK) == RSA_FLAG_TYPE_RSA) |
1258 | 0 | break; |
1259 | | /* FALLTHRU */ |
1260 | 0 | default: |
1261 | 0 | bad_pad: |
1262 | 0 | if (err_extra_text == NULL) |
1263 | 0 | ERR_raise(ERR_LIB_PROV, |
1264 | 0 | PROV_R_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE); |
1265 | 0 | else |
1266 | 0 | ERR_raise_data(ERR_LIB_PROV, |
1267 | 0 | PROV_R_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE, |
1268 | 0 | err_extra_text); |
1269 | 0 | return 0; |
1270 | 5.68k | } |
1271 | 5.68k | } |
1272 | | |
1273 | 12.9k | p = OSSL_PARAM_locate_const(params, OSSL_SIGNATURE_PARAM_PSS_SALTLEN); |
1274 | 12.9k | if (p != NULL) { |
1275 | 5.68k | if (pad_mode != RSA_PKCS1_PSS_PADDING) { |
1276 | 0 | ERR_raise_data(ERR_LIB_PROV, PROV_R_NOT_SUPPORTED, |
1277 | 0 | "PSS saltlen can only be specified if " |
1278 | 0 | "PSS padding has been specified first"); |
1279 | 0 | return 0; |
1280 | 0 | } |
1281 | | |
1282 | 5.68k | switch (p->data_type) { |
1283 | 0 | case OSSL_PARAM_INTEGER: /* Support for legacy pad mode number */ |
1284 | 0 | if (!OSSL_PARAM_get_int(p, &saltlen)) |
1285 | 0 | return 0; |
1286 | 0 | break; |
1287 | 5.68k | case OSSL_PARAM_UTF8_STRING: |
1288 | 5.68k | if (strcmp(p->data, OSSL_PKEY_RSA_PSS_SALT_LEN_DIGEST) == 0) |
1289 | 4.12k | saltlen = RSA_PSS_SALTLEN_DIGEST; |
1290 | 1.56k | else if (strcmp(p->data, OSSL_PKEY_RSA_PSS_SALT_LEN_MAX) == 0) |
1291 | 0 | saltlen = RSA_PSS_SALTLEN_MAX; |
1292 | 1.56k | else if (strcmp(p->data, OSSL_PKEY_RSA_PSS_SALT_LEN_AUTO) == 0) |
1293 | 0 | saltlen = RSA_PSS_SALTLEN_AUTO; |
1294 | 1.56k | else if (strcmp(p->data, OSSL_PKEY_RSA_PSS_SALT_LEN_AUTO_DIGEST_MAX) == 0) |
1295 | 0 | saltlen = RSA_PSS_SALTLEN_AUTO_DIGEST_MAX; |
1296 | 1.56k | else |
1297 | 1.56k | saltlen = atoi(p->data); |
1298 | 5.68k | break; |
1299 | 0 | default: |
1300 | 0 | return 0; |
1301 | 5.68k | } |
1302 | | |
1303 | | /* |
1304 | | * RSA_PSS_SALTLEN_AUTO_DIGEST_MAX seems curiously named in this check. |
1305 | | * Contrary to what it's name suggests, it's the currently lowest |
1306 | | * saltlen number possible. |
1307 | | */ |
1308 | 5.68k | if (saltlen < RSA_PSS_SALTLEN_AUTO_DIGEST_MAX) { |
1309 | 0 | ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_SALT_LENGTH); |
1310 | 0 | return 0; |
1311 | 0 | } |
1312 | | |
1313 | 5.68k | if (rsa_pss_restricted(prsactx)) { |
1314 | 7 | switch (saltlen) { |
1315 | 0 | case RSA_PSS_SALTLEN_AUTO: |
1316 | 0 | case RSA_PSS_SALTLEN_AUTO_DIGEST_MAX: |
1317 | 0 | if (prsactx->operation == EVP_PKEY_OP_VERIFY) { |
1318 | 0 | ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_SALT_LENGTH, |
1319 | 0 | "Cannot use autodetected salt length"); |
1320 | 0 | return 0; |
1321 | 0 | } |
1322 | 0 | break; |
1323 | 0 | case RSA_PSS_SALTLEN_DIGEST: |
1324 | 0 | if (prsactx->min_saltlen > EVP_MD_get_size(prsactx->md)) { |
1325 | 0 | ERR_raise_data(ERR_LIB_PROV, |
1326 | 0 | PROV_R_PSS_SALTLEN_TOO_SMALL, |
1327 | 0 | "Should be more than %d, but would be " |
1328 | 0 | "set to match digest size (%d)", |
1329 | 0 | prsactx->min_saltlen, |
1330 | 0 | EVP_MD_get_size(prsactx->md)); |
1331 | 0 | return 0; |
1332 | 0 | } |
1333 | 0 | break; |
1334 | 7 | default: |
1335 | 7 | if (saltlen >= 0 && saltlen < prsactx->min_saltlen) { |
1336 | 0 | ERR_raise_data(ERR_LIB_PROV, |
1337 | 0 | PROV_R_PSS_SALTLEN_TOO_SMALL, |
1338 | 0 | "Should be more than %d, " |
1339 | 0 | "but would be set to %d", |
1340 | 0 | prsactx->min_saltlen, saltlen); |
1341 | 0 | return 0; |
1342 | 0 | } |
1343 | 7 | } |
1344 | 7 | } |
1345 | 5.68k | } |
1346 | | |
1347 | 12.9k | p = OSSL_PARAM_locate_const(params, OSSL_SIGNATURE_PARAM_MGF1_DIGEST); |
1348 | 12.9k | if (p != NULL) { |
1349 | 1.56k | const OSSL_PARAM *propsp = |
1350 | 1.56k | OSSL_PARAM_locate_const(params, |
1351 | 1.56k | OSSL_SIGNATURE_PARAM_MGF1_PROPERTIES); |
1352 | | |
1353 | 1.56k | pmgf1mdname = mgf1mdname; |
1354 | 1.56k | if (!OSSL_PARAM_get_utf8_string(p, &pmgf1mdname, sizeof(mgf1mdname))) |
1355 | 0 | return 0; |
1356 | | |
1357 | 1.56k | if (propsp != NULL) { |
1358 | 0 | pmgf1mdprops = mgf1mdprops; |
1359 | 0 | if (!OSSL_PARAM_get_utf8_string(propsp, |
1360 | 0 | &pmgf1mdprops, sizeof(mgf1mdprops))) |
1361 | 0 | return 0; |
1362 | 0 | } |
1363 | | |
1364 | 1.56k | if (pad_mode != RSA_PKCS1_PSS_PADDING) { |
1365 | 0 | ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_MGF1_MD); |
1366 | 0 | return 0; |
1367 | 0 | } |
1368 | 1.56k | } |
1369 | | |
1370 | 12.9k | prsactx->saltlen = saltlen; |
1371 | 12.9k | prsactx->pad_mode = pad_mode; |
1372 | | |
1373 | 12.9k | if (prsactx->md == NULL && pmdname == NULL |
1374 | 12.9k | && pad_mode == RSA_PKCS1_PSS_PADDING) |
1375 | 0 | pmdname = RSA_DEFAULT_DIGEST_NAME; |
1376 | | |
1377 | 12.9k | if (pmgf1mdname != NULL |
1378 | 12.9k | && !rsa_setup_mgf1_md(prsactx, pmgf1mdname, pmgf1mdprops)) |
1379 | 0 | return 0; |
1380 | | |
1381 | 12.9k | if (pmdname != NULL) { |
1382 | 0 | if (!rsa_setup_md(prsactx, pmdname, pmdprops)) |
1383 | 0 | return 0; |
1384 | 12.9k | } else { |
1385 | 12.9k | if (!rsa_check_padding(prsactx, NULL, NULL, prsactx->mdnid)) |
1386 | 0 | return 0; |
1387 | 12.9k | } |
1388 | 12.9k | return 1; |
1389 | 12.9k | } |
1390 | | |
1391 | | static const OSSL_PARAM settable_ctx_params[] = { |
1392 | | OSSL_PARAM_utf8_string(OSSL_SIGNATURE_PARAM_DIGEST, NULL, 0), |
1393 | | OSSL_PARAM_utf8_string(OSSL_SIGNATURE_PARAM_PROPERTIES, NULL, 0), |
1394 | | OSSL_PARAM_utf8_string(OSSL_SIGNATURE_PARAM_PAD_MODE, NULL, 0), |
1395 | | OSSL_PARAM_utf8_string(OSSL_SIGNATURE_PARAM_MGF1_DIGEST, NULL, 0), |
1396 | | OSSL_PARAM_utf8_string(OSSL_SIGNATURE_PARAM_MGF1_PROPERTIES, NULL, 0), |
1397 | | OSSL_PARAM_utf8_string(OSSL_SIGNATURE_PARAM_PSS_SALTLEN, NULL, 0), |
1398 | | OSSL_PARAM_END |
1399 | | }; |
1400 | | |
1401 | | static const OSSL_PARAM settable_ctx_params_no_digest[] = { |
1402 | | OSSL_PARAM_utf8_string(OSSL_SIGNATURE_PARAM_PAD_MODE, NULL, 0), |
1403 | | OSSL_PARAM_utf8_string(OSSL_SIGNATURE_PARAM_MGF1_DIGEST, NULL, 0), |
1404 | | OSSL_PARAM_utf8_string(OSSL_SIGNATURE_PARAM_MGF1_PROPERTIES, NULL, 0), |
1405 | | OSSL_PARAM_utf8_string(OSSL_SIGNATURE_PARAM_PSS_SALTLEN, NULL, 0), |
1406 | | OSSL_PARAM_END |
1407 | | }; |
1408 | | |
1409 | | static const OSSL_PARAM *rsa_settable_ctx_params(void *vprsactx, |
1410 | | ossl_unused void *provctx) |
1411 | 27.0k | { |
1412 | 27.0k | PROV_RSA_CTX *prsactx = (PROV_RSA_CTX *)vprsactx; |
1413 | | |
1414 | 27.0k | if (prsactx != NULL && !prsactx->flag_allow_md) |
1415 | 27.0k | return settable_ctx_params_no_digest; |
1416 | 4 | return settable_ctx_params; |
1417 | 27.0k | } |
1418 | | |
1419 | | static int rsa_get_ctx_md_params(void *vprsactx, OSSL_PARAM *params) |
1420 | 0 | { |
1421 | 0 | PROV_RSA_CTX *prsactx = (PROV_RSA_CTX *)vprsactx; |
1422 | |
|
1423 | 0 | if (prsactx->mdctx == NULL) |
1424 | 0 | return 0; |
1425 | | |
1426 | 0 | return EVP_MD_CTX_get_params(prsactx->mdctx, params); |
1427 | 0 | } |
1428 | | |
1429 | | static const OSSL_PARAM *rsa_gettable_ctx_md_params(void *vprsactx) |
1430 | 0 | { |
1431 | 0 | PROV_RSA_CTX *prsactx = (PROV_RSA_CTX *)vprsactx; |
1432 | |
|
1433 | 0 | if (prsactx->md == NULL) |
1434 | 0 | return 0; |
1435 | | |
1436 | 0 | return EVP_MD_gettable_ctx_params(prsactx->md); |
1437 | 0 | } |
1438 | | |
1439 | | static int rsa_set_ctx_md_params(void *vprsactx, const OSSL_PARAM params[]) |
1440 | 0 | { |
1441 | 0 | PROV_RSA_CTX *prsactx = (PROV_RSA_CTX *)vprsactx; |
1442 | |
|
1443 | 0 | if (prsactx->mdctx == NULL) |
1444 | 0 | return 0; |
1445 | | |
1446 | 0 | return EVP_MD_CTX_set_params(prsactx->mdctx, params); |
1447 | 0 | } |
1448 | | |
1449 | | static const OSSL_PARAM *rsa_settable_ctx_md_params(void *vprsactx) |
1450 | 0 | { |
1451 | 0 | PROV_RSA_CTX *prsactx = (PROV_RSA_CTX *)vprsactx; |
1452 | |
|
1453 | 0 | if (prsactx->md == NULL) |
1454 | 0 | return 0; |
1455 | | |
1456 | 0 | return EVP_MD_settable_ctx_params(prsactx->md); |
1457 | 0 | } |
1458 | | |
1459 | | const OSSL_DISPATCH ossl_rsa_signature_functions[] = { |
1460 | | { OSSL_FUNC_SIGNATURE_NEWCTX, (void (*)(void))rsa_newctx }, |
1461 | | { OSSL_FUNC_SIGNATURE_SIGN_INIT, (void (*)(void))rsa_sign_init }, |
1462 | | { OSSL_FUNC_SIGNATURE_SIGN, (void (*)(void))rsa_sign }, |
1463 | | { OSSL_FUNC_SIGNATURE_VERIFY_INIT, (void (*)(void))rsa_verify_init }, |
1464 | | { OSSL_FUNC_SIGNATURE_VERIFY, (void (*)(void))rsa_verify }, |
1465 | | { OSSL_FUNC_SIGNATURE_VERIFY_RECOVER_INIT, |
1466 | | (void (*)(void))rsa_verify_recover_init }, |
1467 | | { OSSL_FUNC_SIGNATURE_VERIFY_RECOVER, |
1468 | | (void (*)(void))rsa_verify_recover }, |
1469 | | { OSSL_FUNC_SIGNATURE_DIGEST_SIGN_INIT, |
1470 | | (void (*)(void))rsa_digest_sign_init }, |
1471 | | { OSSL_FUNC_SIGNATURE_DIGEST_SIGN_UPDATE, |
1472 | | (void (*)(void))rsa_digest_signverify_update }, |
1473 | | { OSSL_FUNC_SIGNATURE_DIGEST_SIGN_FINAL, |
1474 | | (void (*)(void))rsa_digest_sign_final }, |
1475 | | { OSSL_FUNC_SIGNATURE_DIGEST_VERIFY_INIT, |
1476 | | (void (*)(void))rsa_digest_verify_init }, |
1477 | | { OSSL_FUNC_SIGNATURE_DIGEST_VERIFY_UPDATE, |
1478 | | (void (*)(void))rsa_digest_signverify_update }, |
1479 | | { OSSL_FUNC_SIGNATURE_DIGEST_VERIFY_FINAL, |
1480 | | (void (*)(void))rsa_digest_verify_final }, |
1481 | | { OSSL_FUNC_SIGNATURE_FREECTX, (void (*)(void))rsa_freectx }, |
1482 | | { OSSL_FUNC_SIGNATURE_DUPCTX, (void (*)(void))rsa_dupctx }, |
1483 | | { OSSL_FUNC_SIGNATURE_GET_CTX_PARAMS, (void (*)(void))rsa_get_ctx_params }, |
1484 | | { OSSL_FUNC_SIGNATURE_GETTABLE_CTX_PARAMS, |
1485 | | (void (*)(void))rsa_gettable_ctx_params }, |
1486 | | { OSSL_FUNC_SIGNATURE_SET_CTX_PARAMS, (void (*)(void))rsa_set_ctx_params }, |
1487 | | { OSSL_FUNC_SIGNATURE_SETTABLE_CTX_PARAMS, |
1488 | | (void (*)(void))rsa_settable_ctx_params }, |
1489 | | { OSSL_FUNC_SIGNATURE_GET_CTX_MD_PARAMS, |
1490 | | (void (*)(void))rsa_get_ctx_md_params }, |
1491 | | { OSSL_FUNC_SIGNATURE_GETTABLE_CTX_MD_PARAMS, |
1492 | | (void (*)(void))rsa_gettable_ctx_md_params }, |
1493 | | { OSSL_FUNC_SIGNATURE_SET_CTX_MD_PARAMS, |
1494 | | (void (*)(void))rsa_set_ctx_md_params }, |
1495 | | { OSSL_FUNC_SIGNATURE_SETTABLE_CTX_MD_PARAMS, |
1496 | | (void (*)(void))rsa_settable_ctx_md_params }, |
1497 | | { 0, NULL } |
1498 | | }; |