Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Latest update.

Browse Source
This commit is contained in:
Hakase
2020-05-17 20:27:18 +09:00
parent ad9fce94c2
commit 3a6d64bb68
619 changed files with 13638 additions and 4698 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crypto/rsa/build.info
+1 -1
View File
@@ -3,7 +3,7 @@ LIBS=../../libcrypto
$COMMON=rsa_ossl.c rsa_gen.c rsa_lib.c rsa_sign.c rsa_pk1.c \
rsa_none.c rsa_oaep.c rsa_chk.c rsa_pss.c rsa_x931.c rsa_crpt.c \
rsa_x931g.c rsa_sp800_56b_gen.c rsa_sp800_56b_check.c rsa_backend.c \
rsa_mp_names.c
rsa_mp_names.c rsa_schemes.c
SOURCE[../../libcrypto]=$COMMON\
rsa_saos.c rsa_err.c rsa_asn1.c rsa_ameth.c rsa_prn.c \
crypto/rsa/rsa_ameth.c
+132 -73
View File
@@ -37,7 +37,7 @@ static int rsa_param_encode(const EVP_PKEY *pkey,
*pstr = NULL;
/* If RSA it's just NULL type */
if (pkey->ameth->pkey_id != EVP_PKEY_RSA_PSS) {
if (RSA_test_flags(rsa, RSA_FLAG_TYPE_MASK) != RSA_FLAG_TYPE_RSASSAPSS) {
*pstrtype = V_ASN1_NULL;
return 1;
}
@@ -190,6 +190,20 @@ static int rsa_priv_decode(EVP_PKEY *pkey, const PKCS8_PRIV_KEY_INFO *p8)
RSA_free(rsa);
return 0;
}
RSA_clear_flags(rsa, RSA_FLAG_TYPE_MASK);
switch (pkey->ameth->pkey_id) {
case EVP_PKEY_RSA:
RSA_set_flags(rsa, RSA_FLAG_TYPE_RSA);
break;
case EVP_PKEY_RSA_PSS:
RSA_set_flags(rsa, RSA_FLAG_TYPE_RSASSAPSS);
break;
default:
/* Leave the type bits zero */
break;
}
EVP_PKEY_assign(pkey, pkey->ameth->pkey_id, rsa);
return 1;
}
@@ -1072,18 +1086,23 @@ static size_t rsa_pkey_dirty_cnt(const EVP_PKEY *pkey)
return pkey->pkey.rsa->dirty_cnt;
}
DEFINE_SPECIAL_STACK_OF_CONST(BIGNUM_const, BIGNUM)
static int rsa_pkey_export_to(const EVP_PKEY *from, void *to_keydata,
EVP_KEYMGMT *to_keymgmt, OPENSSL_CTX *libctx,
const char *propq)
/*
* For the moment, we trust the call path, where keys going through
* rsa_pkey_export_to() match a KEYMGMT for the "RSA" keytype, while
* keys going through rsa_pss_pkey_export_to() match a KEYMGMT for the
* "RSA-PSS" keytype.
* TODO(3.0) Investigate whether we should simply continue to trust the
* call path, or if we should strengthen this function by checking that
* |rsa_type| matches the RSA key subtype. The latter requires ensuring
* that the type flag for the RSA key is properly set by other functions
* in this file.
*/
static int rsa_int_export_to(const EVP_PKEY *from, int rsa_type,
void *to_keydata, EVP_KEYMGMT *to_keymgmt,
OPENSSL_CTX *libctx, const char *propq)
{
RSA *rsa = from->pkey.rsa;
OSSL_PARAM_BLD *tmpl = OSSL_PARAM_BLD_new();
const BIGNUM *n = RSA_get0_n(rsa), *e = RSA_get0_e(rsa);
const BIGNUM *d = RSA_get0_d(rsa);
STACK_OF(BIGNUM_const) *primes = NULL, *exps = NULL, *coeffs = NULL;
int numprimes = 0, numexps = 0, numcoeffs = 0;
OSSL_PARAM *params = NULL;
int selection = 0;
int rv = 0;
@@ -1098,65 +1117,32 @@ static int rsa_pkey_export_to(const EVP_PKEY *from, void *to_keydata,
goto err;
/* Public parameters must always be present */
if (n == NULL || e == NULL)
if (RSA_get0_n(rsa) == NULL || RSA_get0_e(rsa) == NULL)
goto err;
/* |e| and |n| are always present */
if (!OSSL_PARAM_BLD_push_BN(tmpl, OSSL_PKEY_PARAM_RSA_E, e))
goto err;
if (!OSSL_PARAM_BLD_push_BN(tmpl, OSSL_PKEY_PARAM_RSA_N, n))
if (!rsa_todata(rsa, tmpl, NULL))
goto err;
selection |= OSSL_KEYMGMT_SELECT_PUBLIC_KEY;
if (d != NULL) {
int i;
/* Get all the primes and CRT params */
if ((primes = sk_BIGNUM_const_new_null()) == NULL
|| (exps = sk_BIGNUM_const_new_null()) == NULL
|| (coeffs = sk_BIGNUM_const_new_null()) == NULL)
goto err;
if (!rsa_get0_all_params(rsa, primes, exps, coeffs))
goto err;
numprimes = sk_BIGNUM_const_num(primes);
numexps = sk_BIGNUM_const_num(exps);
numcoeffs = sk_BIGNUM_const_num(coeffs);
/*
* It's permisssible to have zero primes, i.e. no CRT params.
* Otherwise, there must be at least two, as many exponents,
* and one coefficient less.
*/
if (numprimes != 0
&& (numprimes < 2 || numexps < 2 || numcoeffs < 1))
goto err;
if (!OSSL_PARAM_BLD_push_BN(tmpl, OSSL_PKEY_PARAM_RSA_D, d))
goto err;
if (RSA_get0_d(rsa) != NULL)
selection |= OSSL_KEYMGMT_SELECT_PRIVATE_KEY;
for (i = 0; i < numprimes && rsa_mp_factor_names[i] != NULL; i++) {
const BIGNUM *num = sk_BIGNUM_const_value(primes, i);
if (rsa->pss != NULL) {
const EVP_MD *md = NULL, *mgf1md = NULL;
int md_nid, mgf1md_nid, saltlen;
RSA_PSS_PARAMS_30 pss_params;
if (!OSSL_PARAM_BLD_push_BN(tmpl, rsa_mp_factor_names[i], num))
goto err;
}
for (i = 0; i < numexps && rsa_mp_exp_names[i] != NULL; i++) {
const BIGNUM *num = sk_BIGNUM_const_value(exps, i);
if (!OSSL_PARAM_BLD_push_BN(tmpl, rsa_mp_exp_names[i], num))
goto err;
}
for (i = 0; i < numcoeffs && rsa_mp_coeff_names[i] != NULL; i++) {
const BIGNUM *num = sk_BIGNUM_const_value(coeffs, i);
if (!OSSL_PARAM_BLD_push_BN(tmpl, rsa_mp_coeff_names[i], num))
goto err;
}
if (!rsa_pss_get_param(rsa->pss, &md, &mgf1md, &saltlen))
goto err;
md_nid = EVP_MD_type(md);
mgf1md_nid = EVP_MD_type(mgf1md);
if (!rsa_pss_params_30_set_defaults(&pss_params)
|| !rsa_pss_params_30_set_hashalg(&pss_params, md_nid)
|| !rsa_pss_params_30_set_maskgenhashalg(&pss_params, mgf1md_nid)
|| !rsa_pss_params_30_set_saltlen(&pss_params, saltlen)
|| !rsa_pss_params_30_todata(&pss_params, propq, tmpl, NULL))
goto err;
selection |= OSSL_KEYMGMT_SELECT_OTHER_PARAMETERS;
}
if ((params = OSSL_PARAM_BLD_to_param(tmpl)) == NULL)
@@ -1166,31 +1152,104 @@ static int rsa_pkey_export_to(const EVP_PKEY *from, void *to_keydata,
rv = evp_keymgmt_import(to_keymgmt, to_keydata, selection, params);
err:
sk_BIGNUM_const_free(primes);
sk_BIGNUM_const_free(exps);
sk_BIGNUM_const_free(coeffs);
OSSL_PARAM_BLD_free_params(params);
OSSL_PARAM_BLD_free(tmpl);
return rv;
}
static int rsa_pkey_import_from(const OSSL_PARAM params[], void *vpctx)
static int rsa_int_import_from(const OSSL_PARAM params[], void *vpctx,
int rsa_type)
{
EVP_PKEY_CTX *pctx = vpctx;
EVP_PKEY *pkey = EVP_PKEY_CTX_get0_pkey(pctx);
RSA *rsa = rsa_new_with_ctx(pctx->libctx);
RSA_PSS_PARAMS_30 rsa_pss_params = { 0, };
int ok = 0;
if (rsa == NULL) {
ERR_raise(ERR_LIB_DH, ERR_R_MALLOC_FAILURE);
return 0;
}
if (!rsa_fromdata(rsa, params)
|| !EVP_PKEY_assign_RSA(pkey, rsa)) {
RSA_free(rsa);
return 0;
RSA_clear_flags(rsa, RSA_FLAG_TYPE_MASK);
RSA_set_flags(rsa, rsa_type);
if (!rsa_pss_params_30_fromdata(&rsa_pss_params, params, pctx->libctx))
goto err;
switch (rsa_type) {
case RSA_FLAG_TYPE_RSA:
/*
* Were PSS parameters filled in?
* In that case, something's wrong
*/
if (!rsa_pss_params_30_is_unrestricted(&rsa_pss_params))
goto err;
break;
case RSA_FLAG_TYPE_RSASSAPSS:
/*
* Were PSS parameters filled in? In that case, create the old
* RSA_PSS_PARAMS structure. Otherwise, this is an unrestricted key.
*/
if (!rsa_pss_params_30_is_unrestricted(&rsa_pss_params)) {
/* Create the older RSA_PSS_PARAMS from RSA_PSS_PARAMS_30 data */
int mdnid = rsa_pss_params_30_hashalg(&rsa_pss_params);
int mgf1mdnid = rsa_pss_params_30_maskgenhashalg(&rsa_pss_params);
int saltlen = rsa_pss_params_30_saltlen(&rsa_pss_params);
const EVP_MD *md = EVP_get_digestbynid(mdnid);
const EVP_MD *mgf1md = EVP_get_digestbynid(mgf1mdnid);
if ((rsa->pss = rsa_pss_params_create(md, mgf1md, saltlen)) == NULL)
goto err;
}
break;
default:
/* RSA key sub-types we don't know how to handle yet */
goto err;
}
return 1;
if (!rsa_fromdata(rsa, params))
goto err;
switch (rsa_type) {
case RSA_FLAG_TYPE_RSA:
ok = EVP_PKEY_assign_RSA(pkey, rsa);
break;
case RSA_FLAG_TYPE_RSASSAPSS:
ok = EVP_PKEY_assign(pkey, EVP_PKEY_RSA_PSS, rsa);
break;
}
err:
if (!ok)
RSA_free(rsa);
return ok;
}
static int rsa_pkey_export_to(const EVP_PKEY *from, void *to_keydata,
EVP_KEYMGMT *to_keymgmt, OPENSSL_CTX *libctx,
const char *propq)
{
return rsa_int_export_to(from, RSA_FLAG_TYPE_RSA, to_keydata,
to_keymgmt, libctx, propq);
}
static int rsa_pss_pkey_export_to(const EVP_PKEY *from, void *to_keydata,
EVP_KEYMGMT *to_keymgmt, OPENSSL_CTX *libctx,
const char *propq)
{
return rsa_int_export_to(from, RSA_FLAG_TYPE_RSASSAPSS, to_keydata,
to_keymgmt, libctx, propq);
}
static int rsa_pkey_import_from(const OSSL_PARAM params[], void *vpctx)
{
return rsa_int_import_from(params, vpctx, RSA_FLAG_TYPE_RSA);
}
static int rsa_pss_pkey_import_from(const OSSL_PARAM params[], void *vpctx)
{
return rsa_int_import_from(params, vpctx, RSA_FLAG_TYPE_RSASSAPSS);
}
const EVP_PKEY_ASN1_METHOD rsa_asn1_meths[2] = {
@@ -1277,6 +1336,6 @@ const EVP_PKEY_ASN1_METHOD rsa_pss_asn1_meth = {
0, 0, 0, 0,
rsa_pkey_dirty_cnt,
rsa_pkey_export_to,
rsa_pkey_import_from
rsa_pss_pkey_export_to,
rsa_pss_pkey_import_from
};
crypto/rsa/rsa_backend.c
+191
View File
@@ -7,10 +7,16 @@
* https://www.openssl.org/source/license.html
*/
#include <string.h>
#include <openssl/core_names.h>
#include <openssl/params.h>
#include <openssl/evp.h>
#include "internal/sizes.h"
#include "internal/param_build_set.h"
#include "crypto/rsa.h"
#include "e_os.h" /* strcasecmp for Windows() */
/*
* The intention with the "backend" source file is to offer backend support
* for legacy backends (EVP_PKEY_ASN1_METHOD and EVP_PKEY_METHOD) and provider
@@ -97,3 +103,188 @@ int rsa_fromdata(RSA *rsa, const OSSL_PARAM params[])
return 0;
}
DEFINE_SPECIAL_STACK_OF_CONST(BIGNUM_const, BIGNUM)
int rsa_todata(RSA *rsa, OSSL_PARAM_BLD *bld, OSSL_PARAM params[])
{
int ret = 0;
const BIGNUM *rsa_d = NULL, *rsa_n = NULL, *rsa_e = NULL;
STACK_OF(BIGNUM_const) *factors = sk_BIGNUM_const_new_null();
STACK_OF(BIGNUM_const) *exps = sk_BIGNUM_const_new_null();
STACK_OF(BIGNUM_const) *coeffs = sk_BIGNUM_const_new_null();
if (rsa == NULL || factors == NULL || exps == NULL || coeffs == NULL)
goto err;
RSA_get0_key(rsa, &rsa_n, &rsa_e, &rsa_d);
rsa_get0_all_params(rsa, factors, exps, coeffs);
/* Check private key data integrity */
if (rsa_d != NULL) {
int numprimes = sk_BIGNUM_const_num(factors);
int numexps = sk_BIGNUM_const_num(exps);
int numcoeffs = sk_BIGNUM_const_num(coeffs);
/*
* It's permisssible to have zero primes, i.e. no CRT params.
* Otherwise, there must be at least two, as many exponents,
* and one coefficient less.
*/
if (numprimes != 0
&& (numprimes < 2 || numexps < 2 || numcoeffs < 1))
goto err;
}
if (!ossl_param_build_set_bn(bld, params, OSSL_PKEY_PARAM_RSA_N, rsa_n)
|| !ossl_param_build_set_bn(bld, params, OSSL_PKEY_PARAM_RSA_E, rsa_e)
|| !ossl_param_build_set_bn(bld, params, OSSL_PKEY_PARAM_RSA_D, rsa_d)
|| !ossl_param_build_set_multi_key_bn(bld, params, rsa_mp_factor_names,
factors)
|| !ossl_param_build_set_multi_key_bn(bld, params, rsa_mp_exp_names,
exps)
|| !ossl_param_build_set_multi_key_bn(bld, params, rsa_mp_coeff_names,
coeffs))
goto err;
ret = 1;
err:
sk_BIGNUM_const_free(factors);
sk_BIGNUM_const_free(exps);
sk_BIGNUM_const_free(coeffs);
return ret;
}
int rsa_pss_params_30_todata(const RSA_PSS_PARAMS_30 *pss, const char *propq,
OSSL_PARAM_BLD *bld, OSSL_PARAM params[])
{
if (!rsa_pss_params_30_is_unrestricted(pss)) {
int hashalg_nid = rsa_pss_params_30_hashalg(pss);
int maskgenalg_nid = rsa_pss_params_30_maskgenalg(pss);
int maskgenhashalg_nid = rsa_pss_params_30_maskgenhashalg(pss);
int saltlen = rsa_pss_params_30_saltlen(pss);
int default_hashalg_nid = rsa_pss_params_30_hashalg(NULL);
int default_maskgenalg_nid = rsa_pss_params_30_maskgenalg(NULL);
int default_maskgenhashalg_nid = rsa_pss_params_30_maskgenhashalg(NULL);
const char *mdname =
(hashalg_nid == default_hashalg_nid
? NULL : rsa_oaeppss_nid2name(hashalg_nid));
const char *mgfname =
(maskgenalg_nid == default_maskgenalg_nid
? NULL : rsa_oaeppss_nid2name(maskgenalg_nid));
const char *mgf1mdname =
(maskgenhashalg_nid == default_maskgenhashalg_nid
? NULL : rsa_oaeppss_nid2name(maskgenhashalg_nid));
const char *key_md = OSSL_PKEY_PARAM_RSA_DIGEST;
const char *key_mgf = OSSL_PKEY_PARAM_RSA_MASKGENFUNC;
const char *key_mgf1_md = OSSL_PKEY_PARAM_RSA_MGF1_DIGEST;
const char *key_saltlen = OSSL_PKEY_PARAM_RSA_PSS_SALTLEN;
/*
* To ensure that the key isn't seen as unrestricted by the recipient,
* we make sure that at least one PSS-related parameter is passed, even
* if it has a default value; saltlen.
*/
if ((mdname != NULL
&& !ossl_param_build_set_utf8_string(bld, params, key_md, mdname))
|| (mgfname != NULL
&& !ossl_param_build_set_utf8_string(bld, params,
key_mgf, mgfname))
|| (mgf1mdname != NULL
&& !ossl_param_build_set_utf8_string(bld, params,
key_mgf1_md, mgf1mdname))
|| (!ossl_param_build_set_int(bld, params, key_saltlen, saltlen)))
return 0;
}
return 1;
}
int rsa_pss_params_30_fromdata(RSA_PSS_PARAMS_30 *pss_params,
const OSSL_PARAM params[], OPENSSL_CTX *libctx)
{
const OSSL_PARAM *param_md, *param_mgf, *param_mgf1md, *param_saltlen;
EVP_MD *md = NULL, *mgf1md = NULL;
int saltlen;
int ret = 0;
if (pss_params == NULL)
return 0;
param_md =
OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_RSA_DIGEST);
param_mgf =
OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_RSA_MASKGENFUNC);
param_mgf1md =
OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_RSA_MGF1_DIGEST);
param_saltlen =
OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_RSA_PSS_SALTLEN);
/*
* If we get any of the parameters, we know we have at least some
* restrictions, so we start by setting default values, and let each
* parameter override their specific restriction data.
*/
if (param_md != NULL || param_mgf != NULL || param_mgf1md != NULL
|| param_saltlen != NULL)
if (!rsa_pss_params_30_set_defaults(pss_params))
return 0;
if (param_mgf != NULL) {
int default_maskgenalg_nid = rsa_pss_params_30_maskgenalg(NULL);
const char *mgfname = NULL;
if (param_mgf->data_type == OSSL_PARAM_UTF8_STRING)
mgfname = param_mgf->data;
else if (!OSSL_PARAM_get_utf8_ptr(param_mgf, &mgfname))
return 0;
/* TODO Revisit this if / when a new MGF algorithm appears */
if (strcasecmp(param_mgf->data,
rsa_mgf_nid2name(default_maskgenalg_nid)) != 0)
return 0;
}
/*
* We're only interested in the NIDs that correspond to the MDs, so the
* exact propquery is unimportant in the EVP_MD_fetch() calls below.
*/
if (param_md != NULL) {
const char *mdname = NULL;
if (param_md->data_type == OSSL_PARAM_UTF8_STRING)
mdname = param_md->data;
else if (!OSSL_PARAM_get_utf8_ptr(param_mgf, &mdname))
goto err;
if ((md = EVP_MD_fetch(libctx, mdname, NULL)) == NULL
|| !rsa_pss_params_30_set_hashalg(pss_params,
rsa_oaeppss_md2nid(md)))
goto err;
}
if (param_mgf1md != NULL) {
const char *mgf1mdname = NULL;
if (param_mgf1md->data_type == OSSL_PARAM_UTF8_STRING)
mgf1mdname = param_mgf1md->data;
else if (!OSSL_PARAM_get_utf8_ptr(param_mgf, &mgf1mdname))
goto err;
if ((mgf1md = EVP_MD_fetch(libctx, mgf1mdname, NULL)) == NULL
|| !rsa_pss_params_30_set_maskgenhashalg(pss_params,
rsa_oaeppss_md2nid(mgf1md)))
goto err;
}
if (param_saltlen != NULL) {
if (!OSSL_PARAM_get_int(param_saltlen, &saltlen)
|| !rsa_pss_params_30_set_saltlen(pss_params, saltlen))
goto err;
}
ret = 1;
err:
EVP_MD_free(md);
EVP_MD_free(mgf1md);
return ret;
}
crypto/rsa/rsa_chk.c
+5 -5
View File
@@ -12,7 +12,7 @@
#include "crypto/rsa.h"
#include "rsa_local.h"
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
static int rsa_validate_keypair_multiprime(const RSA *key, BN_GENCB *cb)
{
BIGNUM *i, *j, *k, *l, *m;
@@ -222,7 +222,7 @@ static int rsa_validate_keypair_multiprime(const RSA *key, BN_GENCB *cb)
BN_CTX_free(ctx);
return ret;
}
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
int rsa_validate_public(const RSA *key)
{
@@ -236,7 +236,7 @@ int rsa_validate_private(const RSA *key)
int rsa_validate_pairwise(const RSA *key)
{
#ifdef FIPS_MODE
#ifdef FIPS_MODULE
return rsa_sp800_56b_check_keypair(key, NULL, -1, RSA_bits(key));
#else
return rsa_validate_keypair_multiprime(key, NULL);
@@ -250,11 +250,11 @@ int RSA_check_key(const RSA *key)
int RSA_check_key_ex(const RSA *key, BN_GENCB *cb)
{
#ifdef FIPS_MODE
#ifdef FIPS_MODULE
return rsa_validate_public(key)
&& rsa_validate_private(key)
&& rsa_validate_pairwise(key);
#else
return rsa_validate_keypair_multiprime(key, cb);
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
}
crypto/rsa/rsa_gen.c
+5 -5
View File
@@ -43,7 +43,7 @@ int RSA_generate_key_ex(RSA *rsa, int bits, BIGNUM *e_value, BN_GENCB *cb)
int RSA_generate_multi_prime_key(RSA *rsa, int bits, int primes,
BIGNUM *e_value, BN_GENCB *cb)
{
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
/* multi-prime is only supported with the builtin key generation */
if (rsa->meth->rsa_multi_prime_keygen != NULL) {
return rsa->meth->rsa_multi_prime_keygen(rsa, bits, primes,
@@ -60,7 +60,7 @@ int RSA_generate_multi_prime_key(RSA *rsa, int bits, int primes,
else
return 0;
}
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
return rsa_keygen(NULL, rsa, bits, primes, e_value, cb, 0);
}
@@ -68,7 +68,7 @@ static int rsa_keygen(OPENSSL_CTX *libctx, RSA *rsa, int bits, int primes,
BIGNUM *e_value, BN_GENCB *cb, int pairwise_test)
{
int ok = -1;
#ifdef FIPS_MODE
#ifdef FIPS_MODULE
if (primes != 2)
return 0;
ok = rsa_sp800_56b_generate_key(rsa, bits, e_value, cb);
@@ -401,7 +401,7 @@ static int rsa_keygen(OPENSSL_CTX *libctx, RSA *rsa, int bits, int primes,
}
BN_CTX_end(ctx);
BN_CTX_free(ctx);
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
if (pairwise_test && ok > 0) {
OSSL_CALLBACK *stcb = NULL;
@@ -457,7 +457,7 @@ static int rsa_keygen_pairwise_test(RSA *rsa, OSSL_CALLBACK *cb, void *cbarg)
if (ciphertxt_len <= 0)
goto err;
if (ciphertxt_len == plaintxt_len
&& memcmp(decoded, plaintxt, plaintxt_len) == 0)
&& memcmp(ciphertxt, plaintxt, plaintxt_len) == 0)
goto err;
OSSL_SELF_TEST_oncorrupt_byte(st, ciphertxt);
crypto/rsa/rsa_lib.c
+114 -68
View File
@@ -23,7 +23,7 @@
static RSA *rsa_new_intern(ENGINE *engine, OPENSSL_CTX *libctx);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
RSA *RSA_new(void)
{
return rsa_new_intern(NULL, NULL);
@@ -84,7 +84,7 @@ static RSA *rsa_new_intern(ENGINE *engine, OPENSSL_CTX *libctx)
ret->libctx = libctx;
ret->meth = RSA_get_default_method();
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
ret->flags = ret->meth->flags & ~RSA_FLAG_NON_FIPS_ALLOW;
if (engine) {
if (!ENGINE_init(engine)) {
@@ -105,7 +105,7 @@ static RSA *rsa_new_intern(ENGINE *engine, OPENSSL_CTX *libctx)
#endif
ret->flags = ret->meth->flags & ~RSA_FLAG_NON_FIPS_ALLOW;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_RSA, ret, &ret->ex_data)) {
goto err;
}
@@ -138,11 +138,11 @@ void RSA_free(RSA *r)
if (r->meth != NULL && r->meth->finish != NULL)
r->meth->finish(r);
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
ENGINE_finish(r->engine);
#endif
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
CRYPTO_free_ex_data(CRYPTO_EX_INDEX_RSA, r, &r->ex_data);
#endif
@@ -156,8 +156,7 @@ void RSA_free(RSA *r)
BN_clear_free(r->dmp1);
BN_clear_free(r->dmq1);
BN_clear_free(r->iqmp);
/* TODO(3.0): Support PSS in FIPS_MODE */
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
RSA_PSS_PARAMS_free(r->pss);
sk_RSA_PRIME_INFO_pop_free(r->prime_infos, rsa_multip_info_free);
#endif
@@ -179,7 +178,12 @@ int RSA_up_ref(RSA *r)
return i > 1 ? 1 : 0;
}
#ifndef FIPS_MODE
OPENSSL_CTX *rsa_get0_libctx(RSA *r)
{
return r->libctx;
}
#ifndef FIPS_MODULE
int RSA_set_ex_data(RSA *r, int idx, void *arg)
{
return CRYPTO_set_ex_data(&r->ex_data, idx, arg);
@@ -333,7 +337,7 @@ int RSA_security_bits(const RSA *rsa)
{
int bits = BN_num_bits(rsa->n);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
if (rsa->version == RSA_ASN1_VERSION_MULTI) {
/* This ought to mean that we have private key at hand. */
int ex_primes = sk_RSA_PRIME_INFO_num(rsa->prime_infos);
@@ -427,7 +431,7 @@ int RSA_set0_crt_params(RSA *r, BIGNUM *dmp1, BIGNUM *dmq1, BIGNUM *iqmp)
return 1;
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
/*
* Is it better to export RSA_PRIME_INFO structure
* and related functions to let user pass a triplet?
@@ -517,7 +521,7 @@ void RSA_get0_factors(const RSA *r, const BIGNUM **p, const BIGNUM **q)
*q = r->q;
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
int RSA_get_multi_prime_extra_count(const RSA *r)
{
int pnum;
@@ -561,7 +565,7 @@ void RSA_get0_crt_params(const RSA *r,
*iqmp = r->iqmp;
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
int RSA_get0_multi_prime_crt_params(const RSA *r, const BIGNUM *exps[],
const BIGNUM *coeffs[])
{
@@ -631,7 +635,17 @@ const BIGNUM *RSA_get0_iqmp(const RSA *r)
const RSA_PSS_PARAMS *RSA_get0_pss_params(const RSA *r)
{
#ifdef FIPS_MODULE
return NULL;
#else
return r->pss;
#endif
}
/* Internal */
RSA_PSS_PARAMS_30 *rsa_get0_pss_params_30(RSA *r)
{
return &r->pss_params;
}
void RSA_clear_flags(RSA *r, int flags)
@@ -655,7 +669,7 @@ int RSA_get_version(RSA *r)
return r->version;
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
ENGINE *RSA_get0_engine(const RSA *r)
{
return r->engine;
@@ -678,7 +692,7 @@ int rsa_set0_all_params(RSA *r, const STACK_OF(BIGNUM) *primes,
const STACK_OF(BIGNUM) *exps,
const STACK_OF(BIGNUM) *coeffs)
{
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
STACK_OF(RSA_PRIME_INFO) *prime_infos, *old_infos = NULL;
#endif
int pnum;
@@ -699,12 +713,12 @@ int rsa_set0_all_params(RSA *r, const STACK_OF(BIGNUM) *primes,
sk_BIGNUM_value(coeffs, 0)))
return 0;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
old_infos = r->prime_infos;
#endif
if (pnum > 2) {
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
int i;
prime_infos = sk_RSA_PRIME_INFO_new_reserve(NULL, pnum);
@@ -746,7 +760,7 @@ int rsa_set0_all_params(RSA *r, const STACK_OF(BIGNUM) *primes,
#endif
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
if (old_infos != NULL) {
/*
* This is hard to deal with, since the old infos could
@@ -762,7 +776,7 @@ int rsa_set0_all_params(RSA *r, const STACK_OF(BIGNUM) *primes,
r->dirty_cnt++;
return 1;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
err:
/* r, d, t should not be freed */
sk_RSA_PRIME_INFO_pop_free(prime_infos, rsa_multip_info_free_ex);
@@ -776,7 +790,7 @@ int rsa_get0_all_params(RSA *r, STACK_OF(BIGNUM_const) *primes,
STACK_OF(BIGNUM_const) *exps,
STACK_OF(BIGNUM_const) *coeffs)
{
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
RSA_PRIME_INFO *pinfo;
int i, pnum;
#endif
@@ -794,7 +808,7 @@ int rsa_get0_all_params(RSA *r, STACK_OF(BIGNUM_const) *primes,
sk_BIGNUM_const_push(exps, RSA_get0_dmq1(r));
sk_BIGNUM_const_push(coeffs, RSA_get0_iqmp(r));
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
pnum = RSA_get_multi_prime_extra_count(r);
for (i = 0; i < pnum; i++) {
pinfo = sk_RSA_PRIME_INFO_value(r->prime_infos, i);
@@ -807,7 +821,7 @@ int rsa_get0_all_params(RSA *r, STACK_OF(BIGNUM_const) *primes,
return 1;
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
int EVP_PKEY_CTX_set_rsa_padding(EVP_PKEY_CTX *ctx, int pad_mode)
{
OSSL_PARAM pad_params[2], *p = pad_params;
@@ -986,47 +1000,16 @@ int EVP_PKEY_CTX_get_rsa_oaep_md(EVP_PKEY_CTX *ctx, const EVP_MD **md)
return 1;
}
int EVP_PKEY_CTX_set_rsa_mgf1_md(EVP_PKEY_CTX *ctx, const EVP_MD *md)
{
const char *name;
if (ctx == NULL
|| (!EVP_PKEY_CTX_IS_ASYM_CIPHER_OP(ctx)
&& !EVP_PKEY_CTX_IS_SIGNATURE_OP(ctx))) {
ERR_raise(ERR_LIB_EVP, EVP_R_COMMAND_NOT_SUPPORTED);
/* Uses the same return values as EVP_PKEY_CTX_ctrl */
return -2;
}
/* If key type not RSA return error */
if (ctx->pmeth != NULL
&& ctx->pmeth->pkey_id != EVP_PKEY_RSA
&& ctx->pmeth->pkey_id != EVP_PKEY_RSA_PSS)
return -1;
/* TODO(3.0): Remove this eventually when no more legacy */
if ((EVP_PKEY_CTX_IS_ASYM_CIPHER_OP(ctx)
&& ctx->op.ciph.ciphprovctx == NULL)
|| (EVP_PKEY_CTX_IS_SIGNATURE_OP(ctx)
&& ctx->op.sig.sigprovctx == NULL))
return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA,
EVP_PKEY_OP_TYPE_SIG | EVP_PKEY_OP_TYPE_CRYPT,
EVP_PKEY_CTRL_RSA_MGF1_MD, 0, (void *)md);
name = (md == NULL) ? "" : EVP_MD_name(md);
return EVP_PKEY_CTX_set_rsa_mgf1_md_name(ctx, name, NULL);
}
int EVP_PKEY_CTX_set_rsa_mgf1_md_name(EVP_PKEY_CTX *ctx, const char *mdname,
const char *mdprops)
static int int_set_rsa_mgf1_md(EVP_PKEY_CTX *ctx,
/* For EVP_PKEY_CTX_ctrl() */
int keytype, int optype, int cmd,
const EVP_MD *md,
/* For EVP_PKEY_CTX_set_params() */
const char *mdname, const char *mdprops)
{
OSSL_PARAM rsa_params[3], *p = rsa_params;
if (ctx == NULL
|| mdname == NULL
|| (!EVP_PKEY_CTX_IS_ASYM_CIPHER_OP(ctx)
&& !EVP_PKEY_CTX_IS_SIGNATURE_OP(ctx))) {
if (ctx == NULL || (ctx->operation & optype) == 0) {
ERR_raise(ERR_LIB_EVP, EVP_R_COMMAND_NOT_SUPPORTED);
/* Uses the same return values as EVP_PKEY_CTX_ctrl */
return -2;
@@ -1034,10 +1017,26 @@ int EVP_PKEY_CTX_set_rsa_mgf1_md_name(EVP_PKEY_CTX *ctx, const char *mdname,
/* If key type not RSA return error */
if (ctx->pmeth != NULL
&& ctx->pmeth->pkey_id != EVP_PKEY_RSA
&& ctx->pmeth->pkey_id != EVP_PKEY_RSA_PSS)
&& (keytype == -1
? (ctx->pmeth->pkey_id != EVP_PKEY_RSA
&& ctx->pmeth->pkey_id != EVP_PKEY_RSA_PSS)
: ctx->pmeth->pkey_id != keytype))
return -1;
/* TODO(3.0): Remove this eventually when no more legacy */
if (cmd != -1) {
if ((EVP_PKEY_CTX_IS_ASYM_CIPHER_OP(ctx)
&& ctx->op.ciph.ciphprovctx == NULL)
|| (EVP_PKEY_CTX_IS_SIGNATURE_OP(ctx)
&& ctx->op.sig.sigprovctx == NULL)
|| (EVP_PKEY_CTX_IS_GEN_OP(ctx)
&& ctx->op.keymgmt.genctx == NULL))
return EVP_PKEY_CTX_ctrl(ctx, keytype, optype, cmd, 0, (void *)md);
mdname = (md == NULL) ? "" : EVP_MD_name(md);
}
*p++ = OSSL_PARAM_construct_utf8_string(OSSL_PKEY_PARAM_MGF1_DIGEST,
/*
* Cast away the const. This is
@@ -1058,6 +1057,36 @@ int EVP_PKEY_CTX_set_rsa_mgf1_md_name(EVP_PKEY_CTX *ctx, const char *mdname,
return EVP_PKEY_CTX_set_params(ctx, rsa_params);
}
int EVP_PKEY_CTX_set_rsa_mgf1_md(EVP_PKEY_CTX *ctx, const EVP_MD *md)
{
return int_set_rsa_mgf1_md(ctx, -1,
EVP_PKEY_OP_TYPE_CRYPT | EVP_PKEY_OP_TYPE_SIG,
EVP_PKEY_CTRL_RSA_MGF1_MD, md, NULL, NULL);
}
int EVP_PKEY_CTX_set_rsa_mgf1_md_name(EVP_PKEY_CTX *ctx, const char *mdname,
const char *mdprops)
{
return int_set_rsa_mgf1_md(ctx, -1,
EVP_PKEY_OP_TYPE_CRYPT | EVP_PKEY_OP_TYPE_SIG,
-1, NULL, mdname, mdprops);
}
int EVP_PKEY_CTX_set_rsa_pss_keygen_mgf1_md(EVP_PKEY_CTX *ctx, const EVP_MD *md)
{
return int_set_rsa_mgf1_md(ctx, EVP_PKEY_RSA_PSS,
EVP_PKEY_OP_KEYGEN, EVP_PKEY_CTRL_RSA_MGF1_MD,
md, NULL, NULL);
}
int EVP_PKEY_CTX_set_rsa_pss_keygen_mgf1_md_name(EVP_PKEY_CTX *ctx,
const char *mdname)
{
return int_set_rsa_mgf1_md(ctx, EVP_PKEY_RSA_PSS,
EVP_PKEY_OP_TYPE_CRYPT | EVP_PKEY_OP_TYPE_SIG,
-1, NULL, mdname, NULL);
}
int EVP_PKEY_CTX_get_rsa_mgf1_md_name(EVP_PKEY_CTX *ctx, char *name,
size_t namelen)
{
@@ -1196,11 +1225,12 @@ int EVP_PKEY_CTX_get0_rsa_oaep_label(EVP_PKEY_CTX *ctx, unsigned char **label)
return (int)labellen;
}
int EVP_PKEY_CTX_set_rsa_pss_saltlen(EVP_PKEY_CTX *ctx, int saltlen)
static int int_set_rsa_pss_saltlen(EVP_PKEY_CTX *ctx, int saltlen,
int keytype, int optype)
{
OSSL_PARAM pad_params[2], *p = pad_params;
if (ctx == NULL) {
if (ctx == NULL || (ctx->operation & optype) == 0) {
ERR_raise(ERR_LIB_EVP, EVP_R_COMMAND_NOT_SUPPORTED);
/* Uses the same return values as EVP_PKEY_CTX_ctrl */
return -2;
@@ -1208,14 +1238,19 @@ int EVP_PKEY_CTX_set_rsa_pss_saltlen(EVP_PKEY_CTX *ctx, int saltlen)
/* If key type not RSA or RSA-PSS return error */
if (ctx->pmeth != NULL
&& ctx->pmeth->pkey_id != EVP_PKEY_RSA
&& ctx->pmeth->pkey_id != EVP_PKEY_RSA_PSS)
&& (keytype == -1
? (ctx->pmeth->pkey_id != EVP_PKEY_RSA
&& ctx->pmeth->pkey_id != EVP_PKEY_RSA_PSS)
: ctx->pmeth->pkey_id != keytype))
return -1;
/* TODO(3.0): Remove this eventually when no more legacy */
if (!EVP_PKEY_CTX_IS_SIGNATURE_OP(ctx)
|| ctx->op.sig.sigprovctx == NULL)
return EVP_PKEY_CTX_ctrl(ctx, -1, -1, EVP_PKEY_CTRL_RSA_PSS_SALTLEN,
if ((EVP_PKEY_CTX_IS_SIGNATURE_OP(ctx)
&& ctx->op.sig.sigprovctx == NULL)
|| (EVP_PKEY_CTX_IS_GEN_OP(ctx)
&& ctx->op.keymgmt.genctx == NULL))
return EVP_PKEY_CTX_ctrl(ctx, keytype, optype,
EVP_PKEY_CTRL_RSA_PSS_SALTLEN,
saltlen, NULL);
*p++ =
@@ -1225,6 +1260,17 @@ int EVP_PKEY_CTX_set_rsa_pss_saltlen(EVP_PKEY_CTX *ctx, int saltlen)
return EVP_PKEY_CTX_set_params(ctx, pad_params);
}
int EVP_PKEY_CTX_set_rsa_pss_saltlen(EVP_PKEY_CTX *ctx, int saltlen)
{
return int_set_rsa_pss_saltlen(ctx, saltlen, -1, EVP_PKEY_OP_TYPE_SIG);
}
int EVP_PKEY_CTX_set_rsa_pss_keygen_saltlen(EVP_PKEY_CTX *ctx, int saltlen)
{
return int_set_rsa_pss_saltlen(ctx, saltlen, EVP_PKEY_RSA_PSS,
EVP_PKEY_OP_KEYGEN);
}
int EVP_PKEY_CTX_get_rsa_pss_saltlen(EVP_PKEY_CTX *ctx, int *saltlen)
{
OSSL_PARAM pad_params[2], *p = pad_params;
crypto/rsa/rsa_local.h
+13 -2
View File
@@ -12,6 +12,7 @@
#include <openssl/rsa.h>
#include "internal/refcount.h"
#include "crypto/rsa.h"
#define RSA_MAX_PRIME_NUM 5
#define RSA_MIN_MODULUS_BITS 512
@@ -50,9 +51,19 @@ struct rsa_st {
BIGNUM *dmp1;
BIGNUM *dmq1;
BIGNUM *iqmp;
/* If a PSS only key this contains the parameter restrictions */
/*
* If a PSS only key this contains the parameter restrictions.
* There are two structures for the same thing, used in different cases.
*/
/* This is used uniquely by OpenSSL provider implementations. */
RSA_PSS_PARAMS_30 pss_params;
#ifndef FIPS_MODULE
/* This is used uniquely by rsa_ameth.c and rsa_pmeth.c. */
RSA_PSS_PARAMS *pss;
#ifndef FIPS_MODE
#endif
#ifndef FIPS_MODULE
/* for multi-prime RSA, defined in RFC 8017 */
STACK_OF(RSA_PRIME_INFO) *prime_infos;
/* Be careful using this if the RSA structure is shared */
crypto/rsa/rsa_mp_names.c
+3 -3
View File
@@ -23,7 +23,7 @@
const char *rsa_mp_factor_names[] = {
OSSL_PKEY_PARAM_RSA_FACTOR1,
OSSL_PKEY_PARAM_RSA_FACTOR2,
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
OSSL_PKEY_PARAM_RSA_FACTOR3,
OSSL_PKEY_PARAM_RSA_FACTOR4,
OSSL_PKEY_PARAM_RSA_FACTOR5,
@@ -43,7 +43,7 @@ const char *rsa_mp_factor_names[] = {
const char *rsa_mp_exp_names[] = {
OSSL_PKEY_PARAM_RSA_EXPONENT1,
OSSL_PKEY_PARAM_RSA_EXPONENT2,
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
OSSL_PKEY_PARAM_RSA_EXPONENT3,
OSSL_PKEY_PARAM_RSA_EXPONENT4,
OSSL_PKEY_PARAM_RSA_EXPONENT5,
@@ -63,7 +63,7 @@ const char *rsa_mp_exp_names[] = {
const char *rsa_mp_coeff_names[] = {
OSSL_PKEY_PARAM_RSA_COEFFICIENT1,
OSSL_PKEY_PARAM_RSA_COEFFICIENT2,
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
OSSL_PKEY_PARAM_RSA_COEFFICIENT3,
OSSL_PKEY_PARAM_RSA_COEFFICIENT4,
OSSL_PKEY_PARAM_RSA_COEFFICIENT5,
crypto/rsa/rsa_oaep.c
+3 -3
View File
@@ -61,7 +61,7 @@ int rsa_padding_add_PKCS1_OAEP_mgf1_with_libctx(OPENSSL_CTX *libctx,
unsigned char seedmask[EVP_MAX_MD_SIZE];
int mdlen, dbmask_len = 0;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
if (md == NULL)
md = EVP_sha1();
#else
@@ -165,7 +165,7 @@ int RSA_padding_check_PKCS1_OAEP_mgf1(unsigned char *to, int tlen,
int mdlen;
if (md == NULL) {
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
md = EVP_sha1();
#else
RSAerr(0, ERR_R_PASSED_NULL_PARAMETER);
@@ -296,7 +296,7 @@ int RSA_padding_check_PKCS1_OAEP_mgf1(unsigned char *to, int tlen,
to[i] = constant_time_select_8(mask, db[i + mdlen + 1], to[i]);
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
/*
* To avoid chosen ciphertext attacks, the error message should not
* reveal which kind of decoding error happened.
crypto/rsa/rsa_ossl.c
+11 -11
View File
@@ -113,7 +113,7 @@ static int rsa_ossl_public_encrypt(int flen, const unsigned char *from,
from, flen, NULL, 0,
NULL, NULL);
break;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
case RSA_SSLV23_PADDING:
i = rsa_padding_add_SSLv23_with_libctx(rsa->libctx, buf, num, from,
flen);
@@ -486,7 +486,7 @@ static int rsa_ossl_private_decrypt(int flen, const unsigned char *from,
case RSA_PKCS1_OAEP_PADDING:
r = RSA_padding_check_PKCS1_OAEP(to, num, buf, j, num, NULL, 0);
break;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
case RSA_SSLV23_PADDING:
r = RSA_padding_check_SSLv23(to, num, buf, j, num);
break;
@@ -498,7 +498,7 @@ static int rsa_ossl_private_decrypt(int flen, const unsigned char *from,
RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT, RSA_R_UNKNOWN_PADDING_TYPE);
goto err;
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
/*
* This trick doesn't work in the FIPS provider because libcrypto manages
* the error stack. Instead we opt not to put an error on the stack at all
@@ -617,7 +617,7 @@ static int rsa_ossl_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)
{
BIGNUM *r1, *m1, *vrfy;
int ret = 0, smooth = 0;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
BIGNUM *r2, *m[RSA_MAX_PRIME_NUM - 2];
int i, ex_primes = 0;
RSA_PRIME_INFO *pinfo;
@@ -626,7 +626,7 @@ static int rsa_ossl_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)
BN_CTX_start(ctx);
r1 = BN_CTX_get(ctx);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
r2 = BN_CTX_get(ctx);
#endif
m1 = BN_CTX_get(ctx);
@@ -634,7 +634,7 @@ static int rsa_ossl_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)
if (vrfy == NULL)
goto err;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
if (rsa->version == RSA_ASN1_VERSION_MULTI
&& ((ex_primes = sk_RSA_PRIME_INFO_num(rsa->prime_infos)) <= 0
|| ex_primes > RSA_MAX_PRIME_NUM - 2))
@@ -660,7 +660,7 @@ static int rsa_ossl_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)
BN_free(factor);
goto err;
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
for (i = 0; i < ex_primes; i++) {
pinfo = sk_RSA_PRIME_INFO_value(rsa->prime_infos, i);
BN_with_flags(factor, pinfo->r, BN_FLG_CONSTTIME);
@@ -676,7 +676,7 @@ static int rsa_ossl_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)
BN_free(factor);
smooth = (rsa->meth->bn_mod_exp == BN_mod_exp_mont)
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
&& (ex_primes == 0)
#endif
&& (BN_num_bits(rsa->q) == BN_num_bits(rsa->p));
@@ -784,7 +784,7 @@ static int rsa_ossl_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)
BN_free(dmp1);
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
/*
* calculate m_i in multi-prime case
*
@@ -878,7 +878,7 @@ static int rsa_ossl_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)
if (!BN_add(r0, r1, m1))
goto err;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
/* add m_i to m in multi-prime case */
if (ex_primes > 0) {
BIGNUM *pr2 = BN_new();
@@ -997,7 +997,7 @@ static int rsa_ossl_init(RSA *rsa)
static int rsa_ossl_finish(RSA *rsa)
{
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
int i;
RSA_PRIME_INFO *pinfo;
crypto/rsa/rsa_pk1.c
+1 -1
View File
@@ -259,7 +259,7 @@ int RSA_padding_check_PKCS1_type_2(unsigned char *to, int tlen,
}
OPENSSL_clear_free(em, num);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
/*
* This trick doesn't work in the FIPS provider because libcrypto manages
* the error stack. Instead we opt not to put an error on the stack at all
crypto/rsa/rsa_pmeth.c
+2
View File
@@ -376,6 +376,8 @@ static int check_padding_md(const EVP_MD *md, int padding)
case NID_sha256:
case NID_sha384:
case NID_sha512:
case NID_sha512_224:
case NID_sha512_256:
case NID_md5:
case NID_md5_sha1:
case NID_md2:
crypto/rsa/rsa_pss.c
+136
View File
@@ -250,6 +250,142 @@ int RSA_padding_add_PKCS1_PSS_mgf1(RSA *rsa, unsigned char *EM,
}
/*
* The defaults for PSS restrictions are defined in RFC 8017, A.2.3 RSASSA-PSS
* (https://tools.ietf.org/html/rfc8017#appendix-A.2.3):
*
* If the default values of the hashAlgorithm, maskGenAlgorithm, and
* trailerField fields of RSASSA-PSS-params are used, then the algorithm
* identifier will have the following value:
*
* rSASSA-PSS-Default-Identifier RSASSA-AlgorithmIdentifier ::= {
* algorithm id-RSASSA-PSS,
* parameters RSASSA-PSS-params : {
* hashAlgorithm sha1,
* maskGenAlgorithm mgf1SHA1,
* saltLength 20,
* trailerField trailerFieldBC
* }
* }
*
* RSASSA-AlgorithmIdentifier ::= AlgorithmIdentifier {
* {PKCS1Algorithms}
* }
*/
static const RSA_PSS_PARAMS_30 default_RSASSA_PSS_params = {
NID_sha1, /* default hashAlgorithm */
{
NID_mgf1, /* default maskGenAlgorithm */
NID_sha1 /* default MGF1 hash */
},
20, /* default saltLength */
1 /* default trailerField (0xBC) */
};
int rsa_pss_params_30_set_defaults(RSA_PSS_PARAMS_30 *rsa_pss_params)
{
if (rsa_pss_params == NULL)
return 0;
*rsa_pss_params = default_RSASSA_PSS_params;
return 1;
}
int rsa_pss_params_30_is_unrestricted(const RSA_PSS_PARAMS_30 *rsa_pss_params)
{
static RSA_PSS_PARAMS_30 pss_params_cmp = { 0, };
return rsa_pss_params == NULL
|| memcmp(rsa_pss_params, &pss_params_cmp,
sizeof(*rsa_pss_params)) == 0;
}
int rsa_pss_params_30_copy(RSA_PSS_PARAMS_30 *to,
const RSA_PSS_PARAMS_30 *from)
{
memcpy(to, from, sizeof(*to));
return 1;
}
int rsa_pss_params_30_set_hashalg(RSA_PSS_PARAMS_30 *rsa_pss_params,
int hashalg_nid)
{
if (rsa_pss_params == NULL)
return 0;
rsa_pss_params->hash_algorithm_nid = hashalg_nid;
return 1;
}
int rsa_pss_params_30_set_maskgenalg(RSA_PSS_PARAMS_30 *rsa_pss_params,
int maskgenalg_nid)
{
if (rsa_pss_params == NULL)
return 0;
rsa_pss_params->mask_gen.algorithm_nid = maskgenalg_nid;
return 1;
}
int rsa_pss_params_30_set_maskgenhashalg(RSA_PSS_PARAMS_30 *rsa_pss_params,
int maskgenhashalg_nid)
{
if (rsa_pss_params == NULL)
return 0;
rsa_pss_params->mask_gen.hash_algorithm_nid = maskgenhashalg_nid;
return 1;
}
int rsa_pss_params_30_set_saltlen(RSA_PSS_PARAMS_30 *rsa_pss_params,
int saltlen)
{
if (rsa_pss_params == NULL)
return 0;
rsa_pss_params->salt_len = saltlen;
return 1;
}
int rsa_pss_params_30_set_trailerfield(RSA_PSS_PARAMS_30 *rsa_pss_params,
int trailerfield)
{
if (rsa_pss_params == NULL)
return 0;
rsa_pss_params->trailer_field = trailerfield;
return 1;
}
int rsa_pss_params_30_hashalg(const RSA_PSS_PARAMS_30 *rsa_pss_params)
{
if (rsa_pss_params == NULL)
return default_RSASSA_PSS_params.hash_algorithm_nid;
return rsa_pss_params->hash_algorithm_nid;
}
int rsa_pss_params_30_maskgenalg(const RSA_PSS_PARAMS_30 *rsa_pss_params)
{
if (rsa_pss_params == NULL)
return default_RSASSA_PSS_params.mask_gen.algorithm_nid;
return rsa_pss_params->mask_gen.algorithm_nid;
}
int rsa_pss_params_30_maskgenhashalg(const RSA_PSS_PARAMS_30 *rsa_pss_params)
{
if (rsa_pss_params == NULL)
return default_RSASSA_PSS_params.hash_algorithm_nid;
return rsa_pss_params->mask_gen.hash_algorithm_nid;
}
int rsa_pss_params_30_saltlen(const RSA_PSS_PARAMS_30 *rsa_pss_params)
{
if (rsa_pss_params == NULL)
return default_RSASSA_PSS_params.salt_len;
return rsa_pss_params->salt_len;
}
int rsa_pss_params_30_trailerfield(const RSA_PSS_PARAMS_30 *rsa_pss_params)
{
if (rsa_pss_params == NULL)
return default_RSASSA_PSS_params.trailer_field;
return rsa_pss_params->trailer_field;
}
#if defined(_MSC_VER)
# pragma optimize("",on)
#endif
crypto/rsa/rsa_schemes.c
+86
View File
@@ -0,0 +1,86 @@
/*
* Copyright 2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include <openssl/core.h>
#include <openssl/core_names.h>
#include <openssl/evp.h>
#include <openssl/obj_mac.h>
#include "internal/nelem.h"
#include "crypto/rsa.h"
static int meth2nid(const void *meth,
int (*meth_is_a)(const void *meth, const char *name),
const OSSL_ITEM *items, size_t items_n)
{
size_t i;
if (meth != NULL)
for (i = 0; i < items_n; i++)
if (meth_is_a(meth, items[i].ptr))
return (int)items[i].id;
return NID_undef;
}
static const char *nid2name(int meth, const OSSL_ITEM *items, size_t items_n)
{
size_t i;
for (i = 0; i < items_n; i++)
if (meth == (int)items[i].id)
return items[i].ptr;
return NULL;
}
/*
* The list of permitted hash functions are taken from
* https://tools.ietf.org/html/rfc8017#appendix-A.2.1:
*
* OAEP-PSSDigestAlgorithms ALGORITHM-IDENTIFIER ::= {
* { OID id-sha1 PARAMETERS NULL }|
* { OID id-sha224 PARAMETERS NULL }|
* { OID id-sha256 PARAMETERS NULL }|
* { OID id-sha384 PARAMETERS NULL }|
* { OID id-sha512 PARAMETERS NULL }|
* { OID id-sha512-224 PARAMETERS NULL }|
* { OID id-sha512-256 PARAMETERS NULL },
* ... -- Allows for future expansion --
* }
*/
static const OSSL_ITEM oaeppss_name_nid_map[] = {
{ NID_sha1, OSSL_DIGEST_NAME_SHA1 },
{ NID_sha224, OSSL_DIGEST_NAME_SHA2_224 },
{ NID_sha256, OSSL_DIGEST_NAME_SHA2_256 },
{ NID_sha384, OSSL_DIGEST_NAME_SHA2_384 },
{ NID_sha512, OSSL_DIGEST_NAME_SHA2_512 },
{ NID_sha512_224, OSSL_DIGEST_NAME_SHA2_512_224 },
{ NID_sha512_256, OSSL_DIGEST_NAME_SHA2_512_256 },
};
static int md_is_a(const void *md, const char *name)
{
return EVP_MD_is_a(md, name);
}
int rsa_oaeppss_md2nid(const EVP_MD *md)
{
return meth2nid(md, md_is_a,
oaeppss_name_nid_map, OSSL_NELEM(oaeppss_name_nid_map));
}
const char *rsa_oaeppss_nid2name(int md)
{
return nid2name(md, oaeppss_name_nid_map, OSSL_NELEM(oaeppss_name_nid_map));
}
const char *rsa_mgf_nid2name(int mgf)
{
if (mgf == NID_mgf1)
return SN_mgf1;
return NULL;
}
crypto/rsa/rsa_sign.c
+10 -10
View File
@@ -87,7 +87,7 @@ static const unsigned char digestinfo_##name##_der[] = { \
ASN1_OCTET_STRING, sz \
};
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
# ifndef OPENSSL_NO_MD2
ENCODE_DIGESTINFO_MD(md2, 0x02, MD2_DIGEST_LENGTH)
# endif
@@ -117,7 +117,7 @@ static const unsigned char digestinfo_ripemd160_der[] = {
ASN1_OCTET_STRING, RIPEMD160_DIGEST_LENGTH
};
# endif
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
/* SHA-1 (1 3 14 3 2 26) */
static const unsigned char digestinfo_sha1_der[] = {
@@ -147,7 +147,7 @@ ENCODE_DIGESTINFO_SHA(sha3_512, 0x0a, SHA512_DIGEST_LENGTH)
const unsigned char *rsa_digestinfo_encoding(int md_nid, size_t *len)
{
switch (md_nid) {
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
# ifndef OPENSSL_NO_MDC2
MD_CASE(mdc2)
# endif
@@ -163,7 +163,7 @@ const unsigned char *rsa_digestinfo_encoding(int md_nid, size_t *len)
# ifndef OPENSSL_NO_RMD160
MD_CASE(ripemd160)
# endif
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
MD_CASE(sha1)
MD_CASE(sha224)
MD_CASE(sha256)
@@ -187,7 +187,7 @@ const unsigned char *rsa_digestinfo_encoding(int md_nid, size_t *len)
static int digest_sz_from_nid(int nid)
{
switch (nid) {
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
# ifndef OPENSSL_NO_MDC2
MD_NID_CASE(mdc2, MDC2_DIGEST_LENGTH)
# endif
@@ -203,7 +203,7 @@ static int digest_sz_from_nid(int nid)
# ifndef OPENSSL_NO_RMD160
MD_NID_CASE(ripemd160, RIPEMD160_DIGEST_LENGTH)
# endif
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
MD_NID_CASE(sha1, SHA_DIGEST_LENGTH)
MD_NID_CASE(sha224, SHA224_DIGEST_LENGTH)
MD_NID_CASE(sha256, SHA256_DIGEST_LENGTH)
@@ -272,10 +272,10 @@ int RSA_sign(int type, const unsigned char *m, unsigned int m_len,
unsigned char *tmps = NULL;
const unsigned char *encoded = NULL;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
if (rsa->meth->rsa_sign != NULL)
return rsa->meth->rsa_sign(type, m, m_len, sigret, siglen, rsa);
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
/* Compute the encoded digest. */
if (type == NID_md5_sha1) {
@@ -348,7 +348,7 @@ int int_rsa_verify(int type, const unsigned char *m, unsigned int m_len,
goto err;
decrypt_len = len;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
if (type == NID_md5_sha1) {
/*
* NID_md5_sha1 corresponds to the MD5/SHA1 combination in TLS 1.1 and
@@ -395,7 +395,7 @@ int int_rsa_verify(int type, const unsigned char *m, unsigned int m_len,
}
}
} else
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
{
/*
* If recovering the digest, extract a digest-sized output from the end
crypto/rsa/rsa_sp800_56b_check.c
+3 -3
View File
@@ -2,7 +2,7 @@
* Copyright 2018-2020 The OpenSSL Project Authors. All Rights Reserved.
* Copyright (c) 2018-2019, Oracle and/or its affiliates. All rights reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
@@ -238,7 +238,7 @@ int rsa_get_lcm(BN_CTX *ctx, const BIGNUM *p, const BIGNUM *q,
int rsa_sp800_56b_check_public(const RSA *rsa)
{
int ret = 0, status;
#ifdef FIPS_MODE
#ifdef FIPS_MODULE
int nbits;
#endif
BN_CTX *ctx = NULL;
@@ -247,7 +247,7 @@ int rsa_sp800_56b_check_public(const RSA *rsa)
if (rsa->n == NULL || rsa->e == NULL)
return 0;
#ifdef FIPS_MODE
#ifdef FIPS_MODULE
/*
* (Step a): modulus must be 2048 or 3072 (caveat from SP800-56Br1)
* NOTE: changed to allow keys >= 2048
crypto/rsa/rsa_sp800_56b_gen.c
+1 -1
View File
@@ -2,7 +2,7 @@
* Copyright 2018-2020 The OpenSSL Project Authors. All Rights Reserved.
* Copyright (c) 2018-2019, Oracle and/or its affiliates. All rights reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html