/src/openssl30/crypto/rsa/rsa_lib.c
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved. |
3 | | * |
4 | | * Licensed under the Apache License 2.0 (the "License"). You may not use |
5 | | * this file except in compliance with the License. You can obtain a copy |
6 | | * in the file LICENSE in the source distribution or at |
7 | | * https://www.openssl.org/source/license.html |
8 | | */ |
9 | | |
10 | | /* |
11 | | * RSA low level APIs are deprecated for public use, but still ok for |
12 | | * internal use. |
13 | | */ |
14 | | #include "internal/deprecated.h" |
15 | | |
16 | | #include <openssl/crypto.h> |
17 | | #include <openssl/core_names.h> |
18 | | #ifndef FIPS_MODULE |
19 | | # include <openssl/engine.h> |
20 | | #endif |
21 | | #include <openssl/evp.h> |
22 | | #include <openssl/param_build.h> |
23 | | #include "internal/cryptlib.h" |
24 | | #include "internal/refcount.h" |
25 | | #include "crypto/bn.h" |
26 | | #include "crypto/evp.h" |
27 | | #include "crypto/rsa.h" |
28 | | #include "crypto/security_bits.h" |
29 | | #include "rsa_local.h" |
30 | | |
31 | | static RSA *rsa_new_intern(ENGINE *engine, OSSL_LIB_CTX *libctx); |
32 | | |
33 | | #ifndef FIPS_MODULE |
34 | | RSA *RSA_new(void) |
35 | 374k | { |
36 | 374k | return rsa_new_intern(NULL, NULL); |
37 | 374k | } |
38 | | |
39 | | const RSA_METHOD *RSA_get_method(const RSA *rsa) |
40 | 128k | { |
41 | 128k | return rsa->meth; |
42 | 128k | } |
43 | | |
44 | | int RSA_set_method(RSA *rsa, const RSA_METHOD *meth) |
45 | 0 | { |
46 | | /* |
47 | | * NB: The caller is specifically setting a method, so it's not up to us |
48 | | * to deal with which ENGINE it comes from. |
49 | | */ |
50 | 0 | const RSA_METHOD *mtmp; |
51 | 0 | mtmp = rsa->meth; |
52 | 0 | if (mtmp->finish) |
53 | 0 | mtmp->finish(rsa); |
54 | 0 | #ifndef OPENSSL_NO_ENGINE |
55 | 0 | ENGINE_finish(rsa->engine); |
56 | 0 | rsa->engine = NULL; |
57 | 0 | #endif |
58 | 0 | rsa->meth = meth; |
59 | 0 | if (meth->init) |
60 | 0 | meth->init(rsa); |
61 | 0 | return 1; |
62 | 0 | } |
63 | | |
64 | | RSA *RSA_new_method(ENGINE *engine) |
65 | 0 | { |
66 | 0 | return rsa_new_intern(engine, NULL); |
67 | 0 | } |
68 | | #endif |
69 | | |
70 | | RSA *ossl_rsa_new_with_ctx(OSSL_LIB_CTX *libctx) |
71 | 31.3k | { |
72 | 31.3k | return rsa_new_intern(NULL, libctx); |
73 | 31.3k | } |
74 | | |
75 | | static RSA *rsa_new_intern(ENGINE *engine, OSSL_LIB_CTX *libctx) |
76 | 200k | { |
77 | 200k | RSA *ret = OPENSSL_zalloc(sizeof(*ret)); |
78 | | |
79 | 200k | if (ret == NULL) { |
80 | 0 | ERR_raise(ERR_LIB_RSA, ERR_R_MALLOC_FAILURE); |
81 | 0 | return NULL; |
82 | 0 | } |
83 | | |
84 | 200k | ret->references = 1; |
85 | 200k | ret->lock = CRYPTO_THREAD_lock_new(); |
86 | 200k | if (ret->lock == NULL) { |
87 | 0 | ERR_raise(ERR_LIB_RSA, ERR_R_MALLOC_FAILURE); |
88 | 0 | OPENSSL_free(ret); |
89 | 0 | return NULL; |
90 | 0 | } |
91 | | |
92 | 200k | ret->libctx = libctx; |
93 | 200k | ret->meth = RSA_get_default_method(); |
94 | 200k | #if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE) |
95 | 200k | ret->flags = ret->meth->flags & ~RSA_FLAG_NON_FIPS_ALLOW; |
96 | 200k | if (engine) { |
97 | 0 | if (!ENGINE_init(engine)) { |
98 | 0 | ERR_raise(ERR_LIB_RSA, ERR_R_ENGINE_LIB); |
99 | 0 | goto err; |
100 | 0 | } |
101 | 0 | ret->engine = engine; |
102 | 200k | } else { |
103 | 200k | ret->engine = ENGINE_get_default_RSA(); |
104 | 200k | } |
105 | 200k | if (ret->engine) { |
106 | 0 | ret->meth = ENGINE_get_RSA(ret->engine); |
107 | 0 | if (ret->meth == NULL) { |
108 | 0 | ERR_raise(ERR_LIB_RSA, ERR_R_ENGINE_LIB); |
109 | 0 | goto err; |
110 | 0 | } |
111 | 0 | } |
112 | 200k | #endif |
113 | | |
114 | 200k | ret->flags = ret->meth->flags & ~RSA_FLAG_NON_FIPS_ALLOW; |
115 | 200k | #ifndef FIPS_MODULE |
116 | 200k | if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_RSA, ret, &ret->ex_data)) { |
117 | 0 | goto err; |
118 | 0 | } |
119 | 200k | #endif |
120 | | |
121 | 200k | if ((ret->meth->init != NULL) && !ret->meth->init(ret)) { |
122 | 0 | ERR_raise(ERR_LIB_RSA, ERR_R_INIT_FAIL); |
123 | 0 | goto err; |
124 | 0 | } |
125 | | |
126 | 200k | return ret; |
127 | | |
128 | 0 | err: |
129 | 0 | RSA_free(ret); |
130 | 0 | return NULL; |
131 | 200k | } |
132 | | |
133 | | void RSA_free(RSA *r) |
134 | 1.15M | { |
135 | 1.15M | int i; |
136 | | |
137 | 1.15M | if (r == NULL) |
138 | 567k | return; |
139 | | |
140 | 582k | CRYPTO_DOWN_REF(&r->references, &i, r->lock); |
141 | 582k | REF_PRINT_COUNT("RSA", r); |
142 | 582k | if (i > 0) |
143 | 177k | return; |
144 | 405k | REF_ASSERT_ISNT(i < 0); |
145 | | |
146 | 405k | if (r->meth != NULL && r->meth->finish != NULL) |
147 | 405k | r->meth->finish(r); |
148 | 405k | #if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE) |
149 | 405k | ENGINE_finish(r->engine); |
150 | 405k | #endif |
151 | | |
152 | 405k | #ifndef FIPS_MODULE |
153 | 405k | CRYPTO_free_ex_data(CRYPTO_EX_INDEX_RSA, r, &r->ex_data); |
154 | 405k | #endif |
155 | | |
156 | 405k | CRYPTO_THREAD_lock_free(r->lock); |
157 | | |
158 | 405k | BN_free(r->n); |
159 | 405k | BN_free(r->e); |
160 | 405k | BN_clear_free(r->d); |
161 | 405k | BN_clear_free(r->p); |
162 | 405k | BN_clear_free(r->q); |
163 | 405k | BN_clear_free(r->dmp1); |
164 | 405k | BN_clear_free(r->dmq1); |
165 | 405k | BN_clear_free(r->iqmp); |
166 | | |
167 | | #if defined(FIPS_MODULE) && !defined(OPENSSL_NO_ACVP_TESTS) |
168 | | ossl_rsa_acvp_test_free(r->acvp_test); |
169 | | #endif |
170 | | |
171 | 405k | #ifndef FIPS_MODULE |
172 | 405k | RSA_PSS_PARAMS_free(r->pss); |
173 | 405k | sk_RSA_PRIME_INFO_pop_free(r->prime_infos, ossl_rsa_multip_info_free); |
174 | 405k | #endif |
175 | 405k | BN_BLINDING_free(r->blinding); |
176 | 405k | BN_BLINDING_free(r->mt_blinding); |
177 | 405k | OPENSSL_free(r); |
178 | 405k | } |
179 | | |
180 | | int RSA_up_ref(RSA *r) |
181 | 177k | { |
182 | 177k | int i; |
183 | | |
184 | 177k | if (CRYPTO_UP_REF(&r->references, &i, r->lock) <= 0) |
185 | 0 | return 0; |
186 | | |
187 | 177k | REF_PRINT_COUNT("RSA", r); |
188 | 177k | REF_ASSERT_ISNT(i < 2); |
189 | 177k | return i > 1 ? 1 : 0; |
190 | 177k | } |
191 | | |
192 | | OSSL_LIB_CTX *ossl_rsa_get0_libctx(RSA *r) |
193 | 0 | { |
194 | 0 | return r->libctx; |
195 | 0 | } |
196 | | |
197 | | void ossl_rsa_set0_libctx(RSA *r, OSSL_LIB_CTX *libctx) |
198 | 104k | { |
199 | 104k | r->libctx = libctx; |
200 | 104k | } |
201 | | |
202 | | #ifndef FIPS_MODULE |
203 | | int RSA_set_ex_data(RSA *r, int idx, void *arg) |
204 | 0 | { |
205 | 0 | return CRYPTO_set_ex_data(&r->ex_data, idx, arg); |
206 | 0 | } |
207 | | |
208 | | void *RSA_get_ex_data(const RSA *r, int idx) |
209 | 0 | { |
210 | 0 | return CRYPTO_get_ex_data(&r->ex_data, idx); |
211 | 0 | } |
212 | | #endif |
213 | | |
214 | | /* |
215 | | * Define a scaling constant for our fixed point arithmetic. |
216 | | * This value must be a power of two because the base two logarithm code |
217 | | * makes this assumption. The exponent must also be a multiple of three so |
218 | | * that the scale factor has an exact cube root. Finally, the scale factor |
219 | | * should not be so large that a multiplication of two scaled numbers |
220 | | * overflows a 64 bit unsigned integer. |
221 | | */ |
222 | | static const unsigned int scale = 1 << 18; |
223 | | static const unsigned int cbrt_scale = 1 << (2 * 18 / 3); |
224 | | |
225 | | /* Define some constants, none exceed 32 bits */ |
226 | | static const unsigned int log_2 = 0x02c5c8; /* scale * log(2) */ |
227 | | static const unsigned int log_e = 0x05c551; /* scale * log2(M_E) */ |
228 | | static const unsigned int c1_923 = 0x07b126; /* scale * 1.923 */ |
229 | | static const unsigned int c4_690 = 0x12c28f; /* scale * 4.690 */ |
230 | | |
231 | | /* |
232 | | * Multiply two scaled integers together and rescale the result. |
233 | | */ |
234 | | static ossl_inline uint64_t mul2(uint64_t a, uint64_t b) |
235 | 1.00M | { |
236 | 1.00M | return a * b / scale; |
237 | 1.00M | } |
238 | | |
239 | | /* |
240 | | * Calculate the cube root of a 64 bit scaled integer. |
241 | | * Although the cube root of a 64 bit number does fit into a 32 bit unsigned |
242 | | * integer, this is not guaranteed after scaling, so this function has a |
243 | | * 64 bit return. This uses the shifting nth root algorithm with some |
244 | | * algebraic simplifications. |
245 | | */ |
246 | | static uint64_t icbrt64(uint64_t x) |
247 | 47.7k | { |
248 | 47.7k | uint64_t r = 0; |
249 | 47.7k | uint64_t b; |
250 | 47.7k | int s; |
251 | | |
252 | 1.09M | for (s = 63; s >= 0; s -= 3) { |
253 | 1.05M | r <<= 1; |
254 | 1.05M | b = 3 * r * (r + 1) + 1; |
255 | 1.05M | if ((x >> s) >= b) { |
256 | 259k | x -= b << s; |
257 | 259k | r++; |
258 | 259k | } |
259 | 1.05M | } |
260 | 47.7k | return r * cbrt_scale; |
261 | 47.7k | } |
262 | | |
263 | | /* |
264 | | * Calculate the natural logarithm of a 64 bit scaled integer. |
265 | | * This is done by calculating a base two logarithm and scaling. |
266 | | * The maximum logarithm (base 2) is 64 and this reduces base e, so |
267 | | * a 32 bit result should not overflow. The argument passed must be |
268 | | * greater than unity so we don't need to handle negative results. |
269 | | */ |
270 | | static uint32_t ilog_e(uint64_t v) |
271 | 47.7k | { |
272 | 47.7k | uint32_t i, r = 0; |
273 | | |
274 | | /* |
275 | | * Scale down the value into the range 1 .. 2. |
276 | | * |
277 | | * If fractional numbers need to be processed, another loop needs |
278 | | * to go here that checks v < scale and if so multiplies it by 2 and |
279 | | * reduces r by scale. This also means making r signed. |
280 | | */ |
281 | 399k | while (v >= 2 * scale) { |
282 | 351k | v >>= 1; |
283 | 351k | r += scale; |
284 | 351k | } |
285 | 907k | for (i = scale / 2; i != 0; i /= 2) { |
286 | 859k | v = mul2(v, v); |
287 | 859k | if (v >= 2 * scale) { |
288 | 426k | v >>= 1; |
289 | 426k | r += i; |
290 | 426k | } |
291 | 859k | } |
292 | 47.7k | r = (r * (uint64_t)scale) / log_e; |
293 | 47.7k | return r; |
294 | 47.7k | } |
295 | | |
296 | | /* |
297 | | * NIST SP 800-56B rev 2 Appendix D: Maximum Security Strength Estimates for IFC |
298 | | * Modulus Lengths. |
299 | | * |
300 | | * Note that this formula is also referred to in SP800-56A rev3 Appendix D: |
301 | | * for FFC safe prime groups for modp and ffdhe. |
302 | | * After Table 25 and Table 26 it refers to |
303 | | * "The maximum security strength estimates were calculated using the formula in |
304 | | * Section 7.5 of the FIPS 140 IG and rounded to the nearest multiple of eight |
305 | | * bits". |
306 | | * |
307 | | * The formula is: |
308 | | * |
309 | | * E = \frac{1.923 \sqrt[3]{nBits \cdot log_e(2)} |
310 | | * \cdot(log_e(nBits \cdot log_e(2))^{2/3} - 4.69}{log_e(2)} |
311 | | * The two cube roots are merged together here. |
312 | | */ |
313 | | uint16_t ossl_ifc_ffc_compute_security_bits(int n) |
314 | 105k | { |
315 | 105k | uint64_t x; |
316 | 105k | uint32_t lx; |
317 | 105k | uint16_t y, cap; |
318 | | |
319 | | /* |
320 | | * Look for common values as listed in standards. |
321 | | * These values are not exactly equal to the results from the formulae in |
322 | | * the standards but are defined to be canonical. |
323 | | */ |
324 | 105k | switch (n) { |
325 | 40.9k | case 2048: /* SP 800-56B rev 2 Appendix D and FIPS 140-2 IG 7.5 */ |
326 | 40.9k | return 112; |
327 | 318 | case 3072: /* SP 800-56B rev 2 Appendix D and FIPS 140-2 IG 7.5 */ |
328 | 318 | return 128; |
329 | 317 | case 4096: /* SP 800-56B rev 2 Appendix D */ |
330 | 317 | return 152; |
331 | 152 | case 6144: /* SP 800-56B rev 2 Appendix D */ |
332 | 152 | return 176; |
333 | 21 | case 7680: /* FIPS 140-2 IG 7.5 */ |
334 | 21 | return 192; |
335 | 399 | case 8192: /* SP 800-56B rev 2 Appendix D */ |
336 | 399 | return 200; |
337 | 23 | case 15360: /* FIPS 140-2 IG 7.5 */ |
338 | 23 | return 256; |
339 | 105k | } |
340 | | |
341 | | /* |
342 | | * The first incorrect result (i.e. not accurate or off by one low) occurs |
343 | | * for n = 699668. The true value here is 1200. Instead of using this n |
344 | | * as the check threshold, the smallest n such that the correct result is |
345 | | * 1200 is used instead. |
346 | | */ |
347 | 63.4k | if (n >= 687737) |
348 | 22 | return 1200; |
349 | 63.4k | if (n < 8) |
350 | 15.6k | return 0; |
351 | | |
352 | | /* |
353 | | * To ensure that the output is non-decreasing with respect to n, |
354 | | * a cap needs to be applied to the two values where the function over |
355 | | * estimates the strength (according to the above fast path). |
356 | | */ |
357 | 47.7k | if (n <= 7680) |
358 | 46.7k | cap = 192; |
359 | 988 | else if (n <= 15360) |
360 | 540 | cap = 256; |
361 | 448 | else |
362 | 448 | cap = 1200; |
363 | | |
364 | 47.7k | x = n * (uint64_t)log_2; |
365 | 47.7k | lx = ilog_e(x); |
366 | 47.7k | y = (uint16_t)((mul2(c1_923, icbrt64(mul2(mul2(x, lx), lx))) - c4_690) |
367 | 47.7k | / log_2); |
368 | 47.7k | y = (y + 4) & ~7; |
369 | 47.7k | if (y > cap) |
370 | 138 | y = cap; |
371 | 47.7k | return y; |
372 | 63.4k | } |
373 | | |
374 | | |
375 | | |
376 | | int RSA_security_bits(const RSA *rsa) |
377 | 105k | { |
378 | 105k | int bits = BN_num_bits(rsa->n); |
379 | | |
380 | 105k | #ifndef FIPS_MODULE |
381 | 105k | if (rsa->version == RSA_ASN1_VERSION_MULTI) { |
382 | | /* This ought to mean that we have private key at hand. */ |
383 | 965 | int ex_primes = sk_RSA_PRIME_INFO_num(rsa->prime_infos); |
384 | | |
385 | 965 | if (ex_primes <= 0 || (ex_primes + 2) > ossl_rsa_multip_cap(bits)) |
386 | 826 | return 0; |
387 | 965 | } |
388 | 104k | #endif |
389 | 104k | return ossl_ifc_ffc_compute_security_bits(bits); |
390 | 105k | } |
391 | | |
392 | | int RSA_set0_key(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d) |
393 | 30.7k | { |
394 | | /* If the fields n and e in r are NULL, the corresponding input |
395 | | * parameters MUST be non-NULL for n and e. d may be |
396 | | * left NULL (in case only the public key is used). |
397 | | */ |
398 | 30.7k | if ((r->n == NULL && n == NULL) |
399 | 30.7k | || (r->e == NULL && e == NULL)) |
400 | 0 | return 0; |
401 | | |
402 | 30.7k | if (n != NULL) { |
403 | 30.7k | BN_free(r->n); |
404 | 30.7k | r->n = n; |
405 | 30.7k | } |
406 | 30.7k | if (e != NULL) { |
407 | 30.7k | BN_free(r->e); |
408 | 30.7k | r->e = e; |
409 | 30.7k | } |
410 | 30.7k | if (d != NULL) { |
411 | 30.1k | BN_clear_free(r->d); |
412 | 30.1k | r->d = d; |
413 | 30.1k | BN_set_flags(r->d, BN_FLG_CONSTTIME); |
414 | 30.1k | } |
415 | 30.7k | r->dirty_cnt++; |
416 | | |
417 | 30.7k | return 1; |
418 | 30.7k | } |
419 | | |
420 | | int RSA_set0_factors(RSA *r, BIGNUM *p, BIGNUM *q) |
421 | 30.1k | { |
422 | | /* If the fields p and q in r are NULL, the corresponding input |
423 | | * parameters MUST be non-NULL. |
424 | | */ |
425 | 30.1k | if ((r->p == NULL && p == NULL) |
426 | 30.1k | || (r->q == NULL && q == NULL)) |
427 | 0 | return 0; |
428 | | |
429 | 30.1k | if (p != NULL) { |
430 | 30.1k | BN_clear_free(r->p); |
431 | 30.1k | r->p = p; |
432 | 30.1k | BN_set_flags(r->p, BN_FLG_CONSTTIME); |
433 | 30.1k | } |
434 | 30.1k | if (q != NULL) { |
435 | 30.1k | BN_clear_free(r->q); |
436 | 30.1k | r->q = q; |
437 | 30.1k | BN_set_flags(r->q, BN_FLG_CONSTTIME); |
438 | 30.1k | } |
439 | 30.1k | r->dirty_cnt++; |
440 | | |
441 | 30.1k | return 1; |
442 | 30.1k | } |
443 | | |
444 | | int RSA_set0_crt_params(RSA *r, BIGNUM *dmp1, BIGNUM *dmq1, BIGNUM *iqmp) |
445 | 30.1k | { |
446 | | /* If the fields dmp1, dmq1 and iqmp in r are NULL, the corresponding input |
447 | | * parameters MUST be non-NULL. |
448 | | */ |
449 | 30.1k | if ((r->dmp1 == NULL && dmp1 == NULL) |
450 | 30.1k | || (r->dmq1 == NULL && dmq1 == NULL) |
451 | 30.1k | || (r->iqmp == NULL && iqmp == NULL)) |
452 | 0 | return 0; |
453 | | |
454 | 30.1k | if (dmp1 != NULL) { |
455 | 30.1k | BN_clear_free(r->dmp1); |
456 | 30.1k | r->dmp1 = dmp1; |
457 | 30.1k | BN_set_flags(r->dmp1, BN_FLG_CONSTTIME); |
458 | 30.1k | } |
459 | 30.1k | if (dmq1 != NULL) { |
460 | 30.1k | BN_clear_free(r->dmq1); |
461 | 30.1k | r->dmq1 = dmq1; |
462 | 30.1k | BN_set_flags(r->dmq1, BN_FLG_CONSTTIME); |
463 | 30.1k | } |
464 | 30.1k | if (iqmp != NULL) { |
465 | 30.1k | BN_clear_free(r->iqmp); |
466 | 30.1k | r->iqmp = iqmp; |
467 | 30.1k | BN_set_flags(r->iqmp, BN_FLG_CONSTTIME); |
468 | 30.1k | } |
469 | 30.1k | r->dirty_cnt++; |
470 | | |
471 | 30.1k | return 1; |
472 | 30.1k | } |
473 | | |
474 | | #ifndef FIPS_MODULE |
475 | | /* |
476 | | * Is it better to export RSA_PRIME_INFO structure |
477 | | * and related functions to let user pass a triplet? |
478 | | */ |
479 | | int RSA_set0_multi_prime_params(RSA *r, BIGNUM *primes[], BIGNUM *exps[], |
480 | | BIGNUM *coeffs[], int pnum) |
481 | 0 | { |
482 | 0 | STACK_OF(RSA_PRIME_INFO) *prime_infos, *old = NULL; |
483 | 0 | RSA_PRIME_INFO *pinfo; |
484 | 0 | int i; |
485 | |
|
486 | 0 | if (primes == NULL || exps == NULL || coeffs == NULL || pnum == 0) |
487 | 0 | return 0; |
488 | | |
489 | 0 | prime_infos = sk_RSA_PRIME_INFO_new_reserve(NULL, pnum); |
490 | 0 | if (prime_infos == NULL) |
491 | 0 | return 0; |
492 | | |
493 | 0 | if (r->prime_infos != NULL) |
494 | 0 | old = r->prime_infos; |
495 | |
|
496 | 0 | for (i = 0; i < pnum; i++) { |
497 | 0 | pinfo = ossl_rsa_multip_info_new(); |
498 | 0 | if (pinfo == NULL) |
499 | 0 | goto err; |
500 | 0 | if (primes[i] != NULL && exps[i] != NULL && coeffs[i] != NULL) { |
501 | 0 | BN_clear_free(pinfo->r); |
502 | 0 | BN_clear_free(pinfo->d); |
503 | 0 | BN_clear_free(pinfo->t); |
504 | 0 | pinfo->r = primes[i]; |
505 | 0 | pinfo->d = exps[i]; |
506 | 0 | pinfo->t = coeffs[i]; |
507 | 0 | BN_set_flags(pinfo->r, BN_FLG_CONSTTIME); |
508 | 0 | BN_set_flags(pinfo->d, BN_FLG_CONSTTIME); |
509 | 0 | BN_set_flags(pinfo->t, BN_FLG_CONSTTIME); |
510 | 0 | } else { |
511 | 0 | ossl_rsa_multip_info_free(pinfo); |
512 | 0 | goto err; |
513 | 0 | } |
514 | 0 | (void)sk_RSA_PRIME_INFO_push(prime_infos, pinfo); |
515 | 0 | } |
516 | | |
517 | 0 | r->prime_infos = prime_infos; |
518 | |
|
519 | 0 | if (!ossl_rsa_multip_calc_product(r)) { |
520 | 0 | r->prime_infos = old; |
521 | 0 | goto err; |
522 | 0 | } |
523 | | |
524 | 0 | if (old != NULL) { |
525 | | /* |
526 | | * This is hard to deal with, since the old infos could |
527 | | * also be set by this function and r, d, t should not |
528 | | * be freed in that case. So currently, stay consistent |
529 | | * with other *set0* functions: just free it... |
530 | | */ |
531 | 0 | sk_RSA_PRIME_INFO_pop_free(old, ossl_rsa_multip_info_free); |
532 | 0 | } |
533 | |
|
534 | 0 | r->version = RSA_ASN1_VERSION_MULTI; |
535 | 0 | r->dirty_cnt++; |
536 | |
|
537 | 0 | return 1; |
538 | 0 | err: |
539 | | /* r, d, t should not be freed */ |
540 | 0 | sk_RSA_PRIME_INFO_pop_free(prime_infos, ossl_rsa_multip_info_free_ex); |
541 | 0 | return 0; |
542 | 0 | } |
543 | | #endif |
544 | | |
545 | | void RSA_get0_key(const RSA *r, |
546 | | const BIGNUM **n, const BIGNUM **e, const BIGNUM **d) |
547 | 144k | { |
548 | 144k | if (n != NULL) |
549 | 144k | *n = r->n; |
550 | 144k | if (e != NULL) |
551 | 144k | *e = r->e; |
552 | 144k | if (d != NULL) |
553 | 144k | *d = r->d; |
554 | 144k | } |
555 | | |
556 | | void RSA_get0_factors(const RSA *r, const BIGNUM **p, const BIGNUM **q) |
557 | 0 | { |
558 | 0 | if (p != NULL) |
559 | 0 | *p = r->p; |
560 | 0 | if (q != NULL) |
561 | 0 | *q = r->q; |
562 | 0 | } |
563 | | |
564 | | #ifndef FIPS_MODULE |
565 | | int RSA_get_multi_prime_extra_count(const RSA *r) |
566 | 60.5k | { |
567 | 60.5k | int pnum; |
568 | | |
569 | 60.5k | pnum = sk_RSA_PRIME_INFO_num(r->prime_infos); |
570 | 60.5k | if (pnum <= 0) |
571 | 57.0k | pnum = 0; |
572 | 60.5k | return pnum; |
573 | 60.5k | } |
574 | | |
575 | | int RSA_get0_multi_prime_factors(const RSA *r, const BIGNUM *primes[]) |
576 | 0 | { |
577 | 0 | int pnum, i; |
578 | 0 | RSA_PRIME_INFO *pinfo; |
579 | |
|
580 | 0 | if ((pnum = RSA_get_multi_prime_extra_count(r)) == 0) |
581 | 0 | return 0; |
582 | | |
583 | | /* |
584 | | * return other primes |
585 | | * it's caller's responsibility to allocate oth_primes[pnum] |
586 | | */ |
587 | 0 | for (i = 0; i < pnum; i++) { |
588 | 0 | pinfo = sk_RSA_PRIME_INFO_value(r->prime_infos, i); |
589 | 0 | primes[i] = pinfo->r; |
590 | 0 | } |
591 | |
|
592 | 0 | return 1; |
593 | 0 | } |
594 | | #endif |
595 | | |
596 | | void RSA_get0_crt_params(const RSA *r, |
597 | | const BIGNUM **dmp1, const BIGNUM **dmq1, |
598 | | const BIGNUM **iqmp) |
599 | 0 | { |
600 | 0 | if (dmp1 != NULL) |
601 | 0 | *dmp1 = r->dmp1; |
602 | 0 | if (dmq1 != NULL) |
603 | 0 | *dmq1 = r->dmq1; |
604 | 0 | if (iqmp != NULL) |
605 | 0 | *iqmp = r->iqmp; |
606 | 0 | } |
607 | | |
608 | | #ifndef FIPS_MODULE |
609 | | int RSA_get0_multi_prime_crt_params(const RSA *r, const BIGNUM *exps[], |
610 | | const BIGNUM *coeffs[]) |
611 | 0 | { |
612 | 0 | int pnum; |
613 | |
|
614 | 0 | if ((pnum = RSA_get_multi_prime_extra_count(r)) == 0) |
615 | 0 | return 0; |
616 | | |
617 | | /* return other primes */ |
618 | 0 | if (exps != NULL || coeffs != NULL) { |
619 | 0 | RSA_PRIME_INFO *pinfo; |
620 | 0 | int i; |
621 | | |
622 | | /* it's the user's job to guarantee the buffer length */ |
623 | 0 | for (i = 0; i < pnum; i++) { |
624 | 0 | pinfo = sk_RSA_PRIME_INFO_value(r->prime_infos, i); |
625 | 0 | if (exps != NULL) |
626 | 0 | exps[i] = pinfo->d; |
627 | 0 | if (coeffs != NULL) |
628 | 0 | coeffs[i] = pinfo->t; |
629 | 0 | } |
630 | 0 | } |
631 | |
|
632 | 0 | return 1; |
633 | 0 | } |
634 | | #endif |
635 | | |
636 | | const BIGNUM *RSA_get0_n(const RSA *r) |
637 | 305k | { |
638 | 305k | return r->n; |
639 | 305k | } |
640 | | |
641 | | const BIGNUM *RSA_get0_e(const RSA *r) |
642 | 157k | { |
643 | 157k | return r->e; |
644 | 157k | } |
645 | | |
646 | | const BIGNUM *RSA_get0_d(const RSA *r) |
647 | 94.9k | { |
648 | 94.9k | return r->d; |
649 | 94.9k | } |
650 | | |
651 | | const BIGNUM *RSA_get0_p(const RSA *r) |
652 | 248k | { |
653 | 248k | return r->p; |
654 | 248k | } |
655 | | |
656 | | const BIGNUM *RSA_get0_q(const RSA *r) |
657 | 60.5k | { |
658 | 60.5k | return r->q; |
659 | 60.5k | } |
660 | | |
661 | | const BIGNUM *RSA_get0_dmp1(const RSA *r) |
662 | 60.5k | { |
663 | 60.5k | return r->dmp1; |
664 | 60.5k | } |
665 | | |
666 | | const BIGNUM *RSA_get0_dmq1(const RSA *r) |
667 | 60.5k | { |
668 | 60.5k | return r->dmq1; |
669 | 60.5k | } |
670 | | |
671 | | const BIGNUM *RSA_get0_iqmp(const RSA *r) |
672 | 60.5k | { |
673 | 60.5k | return r->iqmp; |
674 | 60.5k | } |
675 | | |
676 | | const RSA_PSS_PARAMS *RSA_get0_pss_params(const RSA *r) |
677 | 22.9k | { |
678 | | #ifdef FIPS_MODULE |
679 | | return NULL; |
680 | | #else |
681 | 22.9k | return r->pss; |
682 | 22.9k | #endif |
683 | 22.9k | } |
684 | | |
685 | | /* Internal */ |
686 | | int ossl_rsa_set0_pss_params(RSA *r, RSA_PSS_PARAMS *pss) |
687 | 22.9k | { |
688 | | #ifdef FIPS_MODULE |
689 | | return 0; |
690 | | #else |
691 | 22.9k | RSA_PSS_PARAMS_free(r->pss); |
692 | 22.9k | r->pss = pss; |
693 | 22.9k | return 1; |
694 | 22.9k | #endif |
695 | 22.9k | } |
696 | | |
697 | | /* Internal */ |
698 | | RSA_PSS_PARAMS_30 *ossl_rsa_get0_pss_params_30(RSA *r) |
699 | 142k | { |
700 | 142k | return &r->pss_params; |
701 | 142k | } |
702 | | |
703 | | void RSA_clear_flags(RSA *r, int flags) |
704 | 131k | { |
705 | 131k | r->flags &= ~flags; |
706 | 131k | } |
707 | | |
708 | | int RSA_test_flags(const RSA *r, int flags) |
709 | 413k | { |
710 | 413k | return r->flags & flags; |
711 | 413k | } |
712 | | |
713 | | void RSA_set_flags(RSA *r, int flags) |
714 | 131k | { |
715 | 131k | r->flags |= flags; |
716 | 131k | } |
717 | | |
718 | | int RSA_get_version(RSA *r) |
719 | 0 | { |
720 | | /* { two-prime(0), multi(1) } */ |
721 | 0 | return r->version; |
722 | 0 | } |
723 | | |
724 | | #ifndef FIPS_MODULE |
725 | | ENGINE *RSA_get0_engine(const RSA *r) |
726 | 0 | { |
727 | 0 | return r->engine; |
728 | 0 | } |
729 | | |
730 | | int RSA_pkey_ctx_ctrl(EVP_PKEY_CTX *ctx, int optype, int cmd, int p1, void *p2) |
731 | 34.0k | { |
732 | | /* If key type not RSA or RSA-PSS return error */ |
733 | 34.0k | if (ctx != NULL && ctx->pmeth != NULL |
734 | 34.0k | && ctx->pmeth->pkey_id != EVP_PKEY_RSA |
735 | 34.0k | && ctx->pmeth->pkey_id != EVP_PKEY_RSA_PSS) |
736 | 0 | return -1; |
737 | 34.0k | return EVP_PKEY_CTX_ctrl(ctx, -1, optype, cmd, p1, p2); |
738 | 34.0k | } |
739 | | #endif |
740 | | |
741 | | DEFINE_STACK_OF(BIGNUM) |
742 | | |
743 | | int ossl_rsa_set0_all_params(RSA *r, const STACK_OF(BIGNUM) *primes, |
744 | | const STACK_OF(BIGNUM) *exps, |
745 | | const STACK_OF(BIGNUM) *coeffs) |
746 | 29.9k | { |
747 | 29.9k | #ifndef FIPS_MODULE |
748 | 29.9k | STACK_OF(RSA_PRIME_INFO) *prime_infos, *old_infos = NULL; |
749 | 29.9k | #endif |
750 | 29.9k | int pnum; |
751 | | |
752 | 29.9k | if (primes == NULL || exps == NULL || coeffs == NULL) |
753 | 0 | return 0; |
754 | | |
755 | 29.9k | pnum = sk_BIGNUM_num(primes); |
756 | 29.9k | if (pnum < 2) |
757 | 0 | return 0; |
758 | | |
759 | 29.9k | if (!RSA_set0_factors(r, sk_BIGNUM_value(primes, 0), |
760 | 29.9k | sk_BIGNUM_value(primes, 1))) |
761 | 0 | return 0; |
762 | | |
763 | 29.9k | if (pnum == sk_BIGNUM_num(exps) |
764 | 29.9k | && pnum == sk_BIGNUM_num(coeffs) + 1) { |
765 | | |
766 | 29.9k | if (!RSA_set0_crt_params(r, sk_BIGNUM_value(exps, 0), |
767 | 29.9k | sk_BIGNUM_value(exps, 1), |
768 | 29.9k | sk_BIGNUM_value(coeffs, 0))) |
769 | 0 | return 0; |
770 | 29.9k | } |
771 | | |
772 | 29.9k | #ifndef FIPS_MODULE |
773 | 29.9k | old_infos = r->prime_infos; |
774 | 29.9k | #endif |
775 | | |
776 | 29.9k | if (pnum > 2) { |
777 | 0 | #ifndef FIPS_MODULE |
778 | 0 | int i; |
779 | |
|
780 | 0 | prime_infos = sk_RSA_PRIME_INFO_new_reserve(NULL, pnum); |
781 | 0 | if (prime_infos == NULL) |
782 | 0 | return 0; |
783 | | |
784 | 0 | for (i = 2; i < pnum; i++) { |
785 | 0 | BIGNUM *prime = sk_BIGNUM_value(primes, i); |
786 | 0 | BIGNUM *exp = sk_BIGNUM_value(exps, i); |
787 | 0 | BIGNUM *coeff = sk_BIGNUM_value(coeffs, i - 1); |
788 | 0 | RSA_PRIME_INFO *pinfo = NULL; |
789 | |
|
790 | 0 | if (!ossl_assert(prime != NULL && exp != NULL && coeff != NULL)) |
791 | 0 | goto err; |
792 | | |
793 | | /* Using ossl_rsa_multip_info_new() is wasteful, so allocate directly */ |
794 | 0 | if ((pinfo = OPENSSL_zalloc(sizeof(*pinfo))) == NULL) { |
795 | 0 | ERR_raise(ERR_LIB_RSA, ERR_R_MALLOC_FAILURE); |
796 | 0 | goto err; |
797 | 0 | } |
798 | | |
799 | 0 | pinfo->r = prime; |
800 | 0 | pinfo->d = exp; |
801 | 0 | pinfo->t = coeff; |
802 | 0 | BN_set_flags(pinfo->r, BN_FLG_CONSTTIME); |
803 | 0 | BN_set_flags(pinfo->d, BN_FLG_CONSTTIME); |
804 | 0 | BN_set_flags(pinfo->t, BN_FLG_CONSTTIME); |
805 | 0 | (void)sk_RSA_PRIME_INFO_push(prime_infos, pinfo); |
806 | 0 | } |
807 | | |
808 | 0 | r->prime_infos = prime_infos; |
809 | |
|
810 | 0 | if (!ossl_rsa_multip_calc_product(r)) { |
811 | 0 | r->prime_infos = old_infos; |
812 | 0 | goto err; |
813 | 0 | } |
814 | | #else |
815 | | return 0; |
816 | | #endif |
817 | 0 | } |
818 | | |
819 | 29.9k | #ifndef FIPS_MODULE |
820 | 29.9k | if (old_infos != NULL) { |
821 | | /* |
822 | | * This is hard to deal with, since the old infos could |
823 | | * also be set by this function and r, d, t should not |
824 | | * be freed in that case. So currently, stay consistent |
825 | | * with other *set0* functions: just free it... |
826 | | */ |
827 | 0 | sk_RSA_PRIME_INFO_pop_free(old_infos, ossl_rsa_multip_info_free); |
828 | 0 | } |
829 | 29.9k | #endif |
830 | | |
831 | 29.9k | r->version = pnum > 2 ? RSA_ASN1_VERSION_MULTI : RSA_ASN1_VERSION_DEFAULT; |
832 | 29.9k | r->dirty_cnt++; |
833 | | |
834 | 29.9k | return 1; |
835 | 0 | #ifndef FIPS_MODULE |
836 | 0 | err: |
837 | | /* r, d, t should not be freed */ |
838 | 0 | sk_RSA_PRIME_INFO_pop_free(prime_infos, ossl_rsa_multip_info_free_ex); |
839 | 0 | return 0; |
840 | 29.9k | #endif |
841 | 29.9k | } |
842 | | |
843 | | DEFINE_SPECIAL_STACK_OF_CONST(BIGNUM_const, BIGNUM) |
844 | | |
845 | | int ossl_rsa_get0_all_params(RSA *r, STACK_OF(BIGNUM_const) *primes, |
846 | | STACK_OF(BIGNUM_const) *exps, |
847 | | STACK_OF(BIGNUM_const) *coeffs) |
848 | 188k | { |
849 | 188k | #ifndef FIPS_MODULE |
850 | 188k | RSA_PRIME_INFO *pinfo; |
851 | 188k | int i, pnum; |
852 | 188k | #endif |
853 | | |
854 | 188k | if (r == NULL) |
855 | 0 | return 0; |
856 | | |
857 | | /* If |p| is NULL, there are no CRT parameters */ |
858 | 188k | if (RSA_get0_p(r) == NULL) |
859 | 127k | return 1; |
860 | | |
861 | 60.5k | sk_BIGNUM_const_push(primes, RSA_get0_p(r)); |
862 | 60.5k | sk_BIGNUM_const_push(primes, RSA_get0_q(r)); |
863 | 60.5k | sk_BIGNUM_const_push(exps, RSA_get0_dmp1(r)); |
864 | 60.5k | sk_BIGNUM_const_push(exps, RSA_get0_dmq1(r)); |
865 | 60.5k | sk_BIGNUM_const_push(coeffs, RSA_get0_iqmp(r)); |
866 | | |
867 | 60.5k | #ifndef FIPS_MODULE |
868 | 60.5k | pnum = RSA_get_multi_prime_extra_count(r); |
869 | 331k | for (i = 0; i < pnum; i++) { |
870 | 270k | pinfo = sk_RSA_PRIME_INFO_value(r->prime_infos, i); |
871 | 270k | sk_BIGNUM_const_push(primes, pinfo->r); |
872 | 270k | sk_BIGNUM_const_push(exps, pinfo->d); |
873 | 270k | sk_BIGNUM_const_push(coeffs, pinfo->t); |
874 | 270k | } |
875 | 60.5k | #endif |
876 | | |
877 | 60.5k | return 1; |
878 | 188k | } |
879 | | |
880 | | #ifndef FIPS_MODULE |
881 | | /* Helpers to set or get diverse hash algorithm names */ |
882 | | static int int_set_rsa_md_name(EVP_PKEY_CTX *ctx, |
883 | | /* For checks */ |
884 | | int keytype, int optype, |
885 | | /* For EVP_PKEY_CTX_set_params() */ |
886 | | const char *mdkey, const char *mdname, |
887 | | const char *propkey, const char *mdprops) |
888 | 0 | { |
889 | 0 | OSSL_PARAM params[3], *p = params; |
890 | |
|
891 | 0 | if (ctx == NULL || mdname == NULL || (ctx->operation & optype) == 0) { |
892 | 0 | ERR_raise(ERR_LIB_EVP, EVP_R_COMMAND_NOT_SUPPORTED); |
893 | | /* Uses the same return values as EVP_PKEY_CTX_ctrl */ |
894 | 0 | return -2; |
895 | 0 | } |
896 | | |
897 | | /* If key type not RSA return error */ |
898 | 0 | switch (keytype) { |
899 | 0 | case -1: |
900 | 0 | if (!EVP_PKEY_CTX_is_a(ctx, "RSA") |
901 | 0 | && !EVP_PKEY_CTX_is_a(ctx, "RSA-PSS")) |
902 | 0 | return -1; |
903 | 0 | break; |
904 | 0 | default: |
905 | 0 | if (!EVP_PKEY_CTX_is_a(ctx, evp_pkey_type2name(keytype))) |
906 | 0 | return -1; |
907 | 0 | break; |
908 | 0 | } |
909 | | |
910 | | /* Cast away the const. This is read only so should be safe */ |
911 | 0 | *p++ = OSSL_PARAM_construct_utf8_string(mdkey, (char *)mdname, 0); |
912 | 0 | if (evp_pkey_ctx_is_provided(ctx) && mdprops != NULL) { |
913 | | /* Cast away the const. This is read only so should be safe */ |
914 | 0 | *p++ = OSSL_PARAM_construct_utf8_string(propkey, (char *)mdprops, 0); |
915 | 0 | } |
916 | 0 | *p++ = OSSL_PARAM_construct_end(); |
917 | |
|
918 | 0 | return evp_pkey_ctx_set_params_strict(ctx, params); |
919 | 0 | } |
920 | | |
921 | | /* Helpers to set or get diverse hash algorithm names */ |
922 | | static int int_get_rsa_md_name(EVP_PKEY_CTX *ctx, |
923 | | /* For checks */ |
924 | | int keytype, int optype, |
925 | | /* For EVP_PKEY_CTX_get_params() */ |
926 | | const char *mdkey, |
927 | | char *mdname, size_t mdnamesize) |
928 | 0 | { |
929 | 0 | OSSL_PARAM params[2], *p = params; |
930 | |
|
931 | 0 | if (ctx == NULL || mdname == NULL || (ctx->operation & optype) == 0) { |
932 | 0 | ERR_raise(ERR_LIB_EVP, EVP_R_COMMAND_NOT_SUPPORTED); |
933 | | /* Uses the same return values as EVP_PKEY_CTX_ctrl */ |
934 | 0 | return -2; |
935 | 0 | } |
936 | | |
937 | | /* If key type not RSA return error */ |
938 | 0 | switch (keytype) { |
939 | 0 | case -1: |
940 | 0 | if (!EVP_PKEY_CTX_is_a(ctx, "RSA") |
941 | 0 | && !EVP_PKEY_CTX_is_a(ctx, "RSA-PSS")) |
942 | 0 | return -1; |
943 | 0 | break; |
944 | 0 | default: |
945 | 0 | if (!EVP_PKEY_CTX_is_a(ctx, evp_pkey_type2name(keytype))) |
946 | 0 | return -1; |
947 | 0 | break; |
948 | 0 | } |
949 | | |
950 | | /* Cast away the const. This is read only so should be safe */ |
951 | 0 | *p++ = OSSL_PARAM_construct_utf8_string(mdkey, (char *)mdname, mdnamesize); |
952 | 0 | *p++ = OSSL_PARAM_construct_end(); |
953 | |
|
954 | 0 | return evp_pkey_ctx_get_params_strict(ctx, params); |
955 | 0 | } |
956 | | |
957 | | /* |
958 | | * This one is currently implemented as an EVP_PKEY_CTX_ctrl() wrapper, |
959 | | * simply because that's easier. |
960 | | */ |
961 | | int EVP_PKEY_CTX_set_rsa_padding(EVP_PKEY_CTX *ctx, int pad_mode) |
962 | 17.8k | { |
963 | 17.8k | return RSA_pkey_ctx_ctrl(ctx, -1, EVP_PKEY_CTRL_RSA_PADDING, |
964 | 17.8k | pad_mode, NULL); |
965 | 17.8k | } |
966 | | |
967 | | /* |
968 | | * This one is currently implemented as an EVP_PKEY_CTX_ctrl() wrapper, |
969 | | * simply because that's easier. |
970 | | */ |
971 | | int EVP_PKEY_CTX_get_rsa_padding(EVP_PKEY_CTX *ctx, int *pad_mode) |
972 | 0 | { |
973 | 0 | return RSA_pkey_ctx_ctrl(ctx, -1, EVP_PKEY_CTRL_GET_RSA_PADDING, |
974 | 0 | 0, pad_mode); |
975 | 0 | } |
976 | | |
977 | | /* |
978 | | * This one is currently implemented as an EVP_PKEY_CTX_ctrl() wrapper, |
979 | | * simply because that's easier. |
980 | | */ |
981 | | int EVP_PKEY_CTX_set_rsa_pss_keygen_md(EVP_PKEY_CTX *ctx, const EVP_MD *md) |
982 | 0 | { |
983 | 0 | return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA_PSS, EVP_PKEY_OP_KEYGEN, |
984 | 0 | EVP_PKEY_CTRL_MD, 0, (void *)(md)); |
985 | 0 | } |
986 | | |
987 | | int EVP_PKEY_CTX_set_rsa_pss_keygen_md_name(EVP_PKEY_CTX *ctx, |
988 | | const char *mdname, |
989 | | const char *mdprops) |
990 | 0 | { |
991 | 0 | return int_set_rsa_md_name(ctx, EVP_PKEY_RSA_PSS, EVP_PKEY_OP_KEYGEN, |
992 | 0 | OSSL_PKEY_PARAM_RSA_DIGEST, mdname, |
993 | 0 | OSSL_PKEY_PARAM_RSA_DIGEST_PROPS, mdprops); |
994 | 0 | } |
995 | | |
996 | | /* |
997 | | * This one is currently implemented as an EVP_PKEY_CTX_ctrl() wrapper, |
998 | | * simply because that's easier. |
999 | | */ |
1000 | | int EVP_PKEY_CTX_set_rsa_oaep_md(EVP_PKEY_CTX *ctx, const EVP_MD *md) |
1001 | 0 | { |
1002 | | /* If key type not RSA return error */ |
1003 | 0 | if (!EVP_PKEY_CTX_is_a(ctx, "RSA")) |
1004 | 0 | return -1; |
1005 | | |
1006 | 0 | return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA, EVP_PKEY_OP_TYPE_CRYPT, |
1007 | 0 | EVP_PKEY_CTRL_RSA_OAEP_MD, 0, (void *)(md)); |
1008 | 0 | } |
1009 | | |
1010 | | int EVP_PKEY_CTX_set_rsa_oaep_md_name(EVP_PKEY_CTX *ctx, const char *mdname, |
1011 | | const char *mdprops) |
1012 | 0 | { |
1013 | 0 | return |
1014 | 0 | int_set_rsa_md_name(ctx, EVP_PKEY_RSA, EVP_PKEY_OP_TYPE_CRYPT, |
1015 | 0 | OSSL_ASYM_CIPHER_PARAM_OAEP_DIGEST, mdname, |
1016 | 0 | OSSL_ASYM_CIPHER_PARAM_OAEP_DIGEST_PROPS, mdprops); |
1017 | 0 | } |
1018 | | |
1019 | | int EVP_PKEY_CTX_get_rsa_oaep_md_name(EVP_PKEY_CTX *ctx, char *name, |
1020 | | size_t namesize) |
1021 | 0 | { |
1022 | 0 | return int_get_rsa_md_name(ctx, EVP_PKEY_RSA, EVP_PKEY_OP_TYPE_CRYPT, |
1023 | 0 | OSSL_ASYM_CIPHER_PARAM_OAEP_DIGEST, |
1024 | 0 | name, namesize); |
1025 | 0 | } |
1026 | | |
1027 | | /* |
1028 | | * This one is currently implemented as an EVP_PKEY_CTX_ctrl() wrapper, |
1029 | | * simply because that's easier. |
1030 | | */ |
1031 | | int EVP_PKEY_CTX_get_rsa_oaep_md(EVP_PKEY_CTX *ctx, const EVP_MD **md) |
1032 | 0 | { |
1033 | | /* If key type not RSA return error */ |
1034 | 0 | if (!EVP_PKEY_CTX_is_a(ctx, "RSA")) |
1035 | 0 | return -1; |
1036 | | |
1037 | 0 | return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA, EVP_PKEY_OP_TYPE_CRYPT, |
1038 | 0 | EVP_PKEY_CTRL_GET_RSA_OAEP_MD, 0, (void *)md); |
1039 | 0 | } |
1040 | | |
1041 | | /* |
1042 | | * This one is currently implemented as an EVP_PKEY_CTX_ctrl() wrapper, |
1043 | | * simply because that's easier. |
1044 | | */ |
1045 | | int EVP_PKEY_CTX_set_rsa_mgf1_md(EVP_PKEY_CTX *ctx, const EVP_MD *md) |
1046 | 3.94k | { |
1047 | 3.94k | return RSA_pkey_ctx_ctrl(ctx, EVP_PKEY_OP_TYPE_SIG | EVP_PKEY_OP_TYPE_CRYPT, |
1048 | 3.94k | EVP_PKEY_CTRL_RSA_MGF1_MD, 0, (void *)(md)); |
1049 | 3.94k | } |
1050 | | |
1051 | | int EVP_PKEY_CTX_set_rsa_mgf1_md_name(EVP_PKEY_CTX *ctx, const char *mdname, |
1052 | | const char *mdprops) |
1053 | 0 | { |
1054 | 0 | return int_set_rsa_md_name(ctx, -1, |
1055 | 0 | EVP_PKEY_OP_TYPE_CRYPT | EVP_PKEY_OP_TYPE_SIG, |
1056 | 0 | OSSL_PKEY_PARAM_MGF1_DIGEST, mdname, |
1057 | 0 | OSSL_PKEY_PARAM_MGF1_PROPERTIES, mdprops); |
1058 | 0 | } |
1059 | | |
1060 | | int EVP_PKEY_CTX_get_rsa_mgf1_md_name(EVP_PKEY_CTX *ctx, char *name, |
1061 | | size_t namesize) |
1062 | 0 | { |
1063 | 0 | return int_get_rsa_md_name(ctx, -1, |
1064 | 0 | EVP_PKEY_OP_TYPE_CRYPT | EVP_PKEY_OP_TYPE_SIG, |
1065 | 0 | OSSL_PKEY_PARAM_MGF1_DIGEST, name, namesize); |
1066 | 0 | } |
1067 | | |
1068 | | /* |
1069 | | * This one is currently implemented as an EVP_PKEY_CTX_ctrl() wrapper, |
1070 | | * simply because that's easier. |
1071 | | */ |
1072 | | int EVP_PKEY_CTX_set_rsa_pss_keygen_mgf1_md(EVP_PKEY_CTX *ctx, const EVP_MD *md) |
1073 | 0 | { |
1074 | 0 | return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA_PSS, EVP_PKEY_OP_KEYGEN, |
1075 | 0 | EVP_PKEY_CTRL_RSA_MGF1_MD, 0, (void *)(md)); |
1076 | 0 | } |
1077 | | |
1078 | | int EVP_PKEY_CTX_set_rsa_pss_keygen_mgf1_md_name(EVP_PKEY_CTX *ctx, |
1079 | | const char *mdname) |
1080 | 0 | { |
1081 | 0 | return int_set_rsa_md_name(ctx, EVP_PKEY_RSA_PSS, EVP_PKEY_OP_KEYGEN, |
1082 | 0 | OSSL_PKEY_PARAM_MGF1_DIGEST, mdname, |
1083 | 0 | NULL, NULL); |
1084 | 0 | } |
1085 | | |
1086 | | /* |
1087 | | * This one is currently implemented as an EVP_PKEY_CTX_ctrl() wrapper, |
1088 | | * simply because that's easier. |
1089 | | */ |
1090 | | int EVP_PKEY_CTX_get_rsa_mgf1_md(EVP_PKEY_CTX *ctx, const EVP_MD **md) |
1091 | 0 | { |
1092 | 0 | return RSA_pkey_ctx_ctrl(ctx, EVP_PKEY_OP_TYPE_SIG | EVP_PKEY_OP_TYPE_CRYPT, |
1093 | 0 | EVP_PKEY_CTRL_GET_RSA_MGF1_MD, 0, (void *)(md)); |
1094 | 0 | } |
1095 | | |
1096 | | int EVP_PKEY_CTX_set0_rsa_oaep_label(EVP_PKEY_CTX *ctx, void *label, int llen) |
1097 | 0 | { |
1098 | 0 | OSSL_PARAM rsa_params[2], *p = rsa_params; |
1099 | 0 | const char *empty = ""; |
1100 | | /* |
1101 | | * Needed as we swap label with empty if it is NULL, and label is |
1102 | | * freed at the end of this function. |
1103 | | */ |
1104 | 0 | void *plabel = label; |
1105 | 0 | int ret; |
1106 | |
|
1107 | 0 | if (ctx == NULL || !EVP_PKEY_CTX_IS_ASYM_CIPHER_OP(ctx)) { |
1108 | 0 | ERR_raise(ERR_LIB_EVP, EVP_R_COMMAND_NOT_SUPPORTED); |
1109 | | /* Uses the same return values as EVP_PKEY_CTX_ctrl */ |
1110 | 0 | return -2; |
1111 | 0 | } |
1112 | | |
1113 | | /* If key type not RSA return error */ |
1114 | 0 | if (!EVP_PKEY_CTX_is_a(ctx, "RSA")) |
1115 | 0 | return -1; |
1116 | | |
1117 | | /* Accept NULL for backward compatibility */ |
1118 | 0 | if (label == NULL && llen == 0) |
1119 | 0 | plabel = (void *)empty; |
1120 | | |
1121 | | /* Cast away the const. This is read only so should be safe */ |
1122 | 0 | *p++ = OSSL_PARAM_construct_octet_string(OSSL_ASYM_CIPHER_PARAM_OAEP_LABEL, |
1123 | 0 | (void *)plabel, (size_t)llen); |
1124 | 0 | *p++ = OSSL_PARAM_construct_end(); |
1125 | |
|
1126 | 0 | ret = evp_pkey_ctx_set_params_strict(ctx, rsa_params); |
1127 | 0 | if (ret <= 0) |
1128 | 0 | return ret; |
1129 | | |
1130 | | /* Ownership is supposed to be transfered to the callee. */ |
1131 | 0 | OPENSSL_free(label); |
1132 | 0 | return 1; |
1133 | 0 | } |
1134 | | |
1135 | | int EVP_PKEY_CTX_get0_rsa_oaep_label(EVP_PKEY_CTX *ctx, unsigned char **label) |
1136 | 0 | { |
1137 | 0 | OSSL_PARAM rsa_params[2], *p = rsa_params; |
1138 | 0 | size_t labellen; |
1139 | |
|
1140 | 0 | if (ctx == NULL || !EVP_PKEY_CTX_IS_ASYM_CIPHER_OP(ctx)) { |
1141 | 0 | ERR_raise(ERR_LIB_EVP, EVP_R_COMMAND_NOT_SUPPORTED); |
1142 | | /* Uses the same return values as EVP_PKEY_CTX_ctrl */ |
1143 | 0 | return -2; |
1144 | 0 | } |
1145 | | |
1146 | | /* If key type not RSA return error */ |
1147 | 0 | if (!EVP_PKEY_CTX_is_a(ctx, "RSA")) |
1148 | 0 | return -1; |
1149 | | |
1150 | 0 | *p++ = OSSL_PARAM_construct_octet_ptr(OSSL_ASYM_CIPHER_PARAM_OAEP_LABEL, |
1151 | 0 | (void **)label, 0); |
1152 | 0 | *p++ = OSSL_PARAM_construct_end(); |
1153 | |
|
1154 | 0 | if (!EVP_PKEY_CTX_get_params(ctx, rsa_params)) |
1155 | 0 | return -1; |
1156 | | |
1157 | 0 | labellen = rsa_params[0].return_size; |
1158 | 0 | if (labellen > INT_MAX) |
1159 | 0 | return -1; |
1160 | | |
1161 | 0 | return (int)labellen; |
1162 | 0 | } |
1163 | | |
1164 | | /* |
1165 | | * This one is currently implemented as an EVP_PKEY_CTX_ctrl() wrapper, |
1166 | | * simply because that's easier. |
1167 | | */ |
1168 | | int EVP_PKEY_CTX_set_rsa_pss_saltlen(EVP_PKEY_CTX *ctx, int saltlen) |
1169 | 12.2k | { |
1170 | | /* |
1171 | | * For some reason, the optype was set to this: |
1172 | | * |
1173 | | * EVP_PKEY_OP_SIGN|EVP_PKEY_OP_VERIFY |
1174 | | * |
1175 | | * However, we do use RSA-PSS with the whole gamut of diverse signature |
1176 | | * and verification operations, so the optype gets upgraded to this: |
1177 | | * |
1178 | | * EVP_PKEY_OP_TYPE_SIG |
1179 | | */ |
1180 | 12.2k | return RSA_pkey_ctx_ctrl(ctx, EVP_PKEY_OP_TYPE_SIG, |
1181 | 12.2k | EVP_PKEY_CTRL_RSA_PSS_SALTLEN, saltlen, NULL); |
1182 | 12.2k | } |
1183 | | |
1184 | | /* |
1185 | | * This one is currently implemented as an EVP_PKEY_CTX_ctrl() wrapper, |
1186 | | * simply because that's easier. |
1187 | | */ |
1188 | | int EVP_PKEY_CTX_get_rsa_pss_saltlen(EVP_PKEY_CTX *ctx, int *saltlen) |
1189 | 0 | { |
1190 | | /* |
1191 | | * Because of circumstances, the optype is updated from: |
1192 | | * |
1193 | | * EVP_PKEY_OP_SIGN|EVP_PKEY_OP_VERIFY |
1194 | | * |
1195 | | * to: |
1196 | | * |
1197 | | * EVP_PKEY_OP_TYPE_SIG |
1198 | | */ |
1199 | 0 | return RSA_pkey_ctx_ctrl(ctx, EVP_PKEY_OP_TYPE_SIG, |
1200 | 0 | EVP_PKEY_CTRL_GET_RSA_PSS_SALTLEN, 0, saltlen); |
1201 | 0 | } |
1202 | | |
1203 | | int EVP_PKEY_CTX_set_rsa_pss_keygen_saltlen(EVP_PKEY_CTX *ctx, int saltlen) |
1204 | 0 | { |
1205 | 0 | OSSL_PARAM pad_params[2], *p = pad_params; |
1206 | |
|
1207 | 0 | if (ctx == NULL || !EVP_PKEY_CTX_IS_GEN_OP(ctx)) { |
1208 | 0 | ERR_raise(ERR_LIB_EVP, EVP_R_COMMAND_NOT_SUPPORTED); |
1209 | | /* Uses the same return values as EVP_PKEY_CTX_ctrl */ |
1210 | 0 | return -2; |
1211 | 0 | } |
1212 | | |
1213 | 0 | if (!EVP_PKEY_CTX_is_a(ctx, "RSA-PSS")) |
1214 | 0 | return -1; |
1215 | | |
1216 | 0 | *p++ = OSSL_PARAM_construct_int(OSSL_SIGNATURE_PARAM_PSS_SALTLEN, |
1217 | 0 | &saltlen); |
1218 | 0 | *p++ = OSSL_PARAM_construct_end(); |
1219 | |
|
1220 | 0 | return evp_pkey_ctx_set_params_strict(ctx, pad_params); |
1221 | 0 | } |
1222 | | |
1223 | | int EVP_PKEY_CTX_set_rsa_keygen_bits(EVP_PKEY_CTX *ctx, int bits) |
1224 | 0 | { |
1225 | 0 | OSSL_PARAM params[2], *p = params; |
1226 | 0 | size_t bits2 = bits; |
1227 | |
|
1228 | 0 | if (ctx == NULL || !EVP_PKEY_CTX_IS_GEN_OP(ctx)) { |
1229 | 0 | ERR_raise(ERR_LIB_EVP, EVP_R_COMMAND_NOT_SUPPORTED); |
1230 | | /* Uses the same return values as EVP_PKEY_CTX_ctrl */ |
1231 | 0 | return -2; |
1232 | 0 | } |
1233 | | |
1234 | | /* If key type not RSA return error */ |
1235 | 0 | if (!EVP_PKEY_CTX_is_a(ctx, "RSA") |
1236 | 0 | && !EVP_PKEY_CTX_is_a(ctx, "RSA-PSS")) |
1237 | 0 | return -1; |
1238 | | |
1239 | 0 | *p++ = OSSL_PARAM_construct_size_t(OSSL_PKEY_PARAM_RSA_BITS, &bits2); |
1240 | 0 | *p++ = OSSL_PARAM_construct_end(); |
1241 | |
|
1242 | 0 | return evp_pkey_ctx_set_params_strict(ctx, params); |
1243 | 0 | } |
1244 | | |
1245 | | int EVP_PKEY_CTX_set_rsa_keygen_pubexp(EVP_PKEY_CTX *ctx, BIGNUM *pubexp) |
1246 | 0 | { |
1247 | 0 | int ret = RSA_pkey_ctx_ctrl(ctx, EVP_PKEY_OP_KEYGEN, |
1248 | 0 | EVP_PKEY_CTRL_RSA_KEYGEN_PUBEXP, 0, pubexp); |
1249 | | |
1250 | | /* |
1251 | | * Satisfy memory semantics for pre-3.0 callers of |
1252 | | * EVP_PKEY_CTX_set_rsa_keygen_pubexp(): their expectation is that input |
1253 | | * pubexp BIGNUM becomes managed by the EVP_PKEY_CTX on success. |
1254 | | */ |
1255 | 0 | if (ret > 0 && evp_pkey_ctx_is_provided(ctx)) { |
1256 | 0 | BN_free(ctx->rsa_pubexp); |
1257 | 0 | ctx->rsa_pubexp = pubexp; |
1258 | 0 | } |
1259 | |
|
1260 | 0 | return ret; |
1261 | 0 | } |
1262 | | |
1263 | | int EVP_PKEY_CTX_set1_rsa_keygen_pubexp(EVP_PKEY_CTX *ctx, BIGNUM *pubexp) |
1264 | 0 | { |
1265 | 0 | int ret = 0; |
1266 | | |
1267 | | /* |
1268 | | * When we're dealing with a provider, there's no need to duplicate |
1269 | | * pubexp, as it gets copied when transforming to an OSSL_PARAM anyway. |
1270 | | */ |
1271 | 0 | if (evp_pkey_ctx_is_legacy(ctx)) { |
1272 | 0 | pubexp = BN_dup(pubexp); |
1273 | 0 | if (pubexp == NULL) |
1274 | 0 | return 0; |
1275 | 0 | } |
1276 | 0 | ret = EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA, EVP_PKEY_OP_KEYGEN, |
1277 | 0 | EVP_PKEY_CTRL_RSA_KEYGEN_PUBEXP, 0, pubexp); |
1278 | 0 | if (evp_pkey_ctx_is_legacy(ctx) && ret <= 0) |
1279 | 0 | BN_free(pubexp); |
1280 | 0 | return ret; |
1281 | 0 | } |
1282 | | |
1283 | | int EVP_PKEY_CTX_set_rsa_keygen_primes(EVP_PKEY_CTX *ctx, int primes) |
1284 | 0 | { |
1285 | 0 | OSSL_PARAM params[2], *p = params; |
1286 | 0 | size_t primes2 = primes; |
1287 | |
|
1288 | 0 | if (ctx == NULL || !EVP_PKEY_CTX_IS_GEN_OP(ctx)) { |
1289 | 0 | ERR_raise(ERR_LIB_EVP, EVP_R_COMMAND_NOT_SUPPORTED); |
1290 | | /* Uses the same return values as EVP_PKEY_CTX_ctrl */ |
1291 | 0 | return -2; |
1292 | 0 | } |
1293 | | |
1294 | | /* If key type not RSA return error */ |
1295 | 0 | if (!EVP_PKEY_CTX_is_a(ctx, "RSA") |
1296 | 0 | && !EVP_PKEY_CTX_is_a(ctx, "RSA-PSS")) |
1297 | 0 | return -1; |
1298 | | |
1299 | 0 | *p++ = OSSL_PARAM_construct_size_t(OSSL_PKEY_PARAM_RSA_PRIMES, &primes2); |
1300 | 0 | *p++ = OSSL_PARAM_construct_end(); |
1301 | |
|
1302 | 0 | return evp_pkey_ctx_set_params_strict(ctx, params); |
1303 | 0 | } |
1304 | | #endif |