j3d1/bearssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

New "i15" implementation of big integers (faster, and constant-time, on ARM Cortex M0/M0+); imported into EC, ECDSA, RSA.

Browse source
This commit is contained in:
Thomas Pornin 2017-01-04 19:21:09 +01:00
parent 6dd8c51ba7
commit 28e4e120b8
29 changed files with 2993 additions and 326 deletions
Download patch file Download diff file Expand all files Collapse all files

37
src/rsa/rsa_i15_pkcs1_sign.c Normal file
View file

@ -0,0 +1,37 @@
/*
* Copyright (c) 2017 Thomas Pornin <pornin@bolet.org>
*
* Permission is hereby granted, free of charge, to any person obtaining
* a copy of this software and associated documentation files (the
* "Software"), to deal in the Software without restriction, including
* without limitation the rights to use, copy, modify, merge, publish,
* distribute, sublicense, and/or sell copies of the Software, and to
* permit persons to whom the Software is furnished to do so, subject to
* the following conditions:
*
* The above copyright notice and this permission notice shall be
* included in all copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
* BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
* ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
* CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
* SOFTWARE.
*/
#include "inner.h"
/* see bearssl_rsa.h */
uint32_t
br_rsa_i15_pkcs1_sign(const unsigned char *hash_oid,
const unsigned char *hash, size_t hash_len,
const br_rsa_private_key *sk, unsigned char *x)
{
if (!br_rsa_pkcs1_sig_pad(hash_oid, hash, hash_len, sk->n_bitlen, x)) {
return 0;
}
return br_rsa_i15_private(x, sk);
}

43
src/rsa/rsa_i15_pkcs1_vrfy.c Normal file
View file

@ -0,0 +1,43 @@
/*
* Copyright (c) 2017 Thomas Pornin <pornin@bolet.org>
*
* Permission is hereby granted, free of charge, to any person obtaining
* a copy of this software and associated documentation files (the
* "Software"), to deal in the Software without restriction, including
* without limitation the rights to use, copy, modify, merge, publish,
* distribute, sublicense, and/or sell copies of the Software, and to
* permit persons to whom the Software is furnished to do so, subject to
* the following conditions:
*
* The above copyright notice and this permission notice shall be
* included in all copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
* BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
* ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
* CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
* SOFTWARE.
*/
#include "inner.h"
/* see bearssl_rsa.h */
uint32_t
br_rsa_i15_pkcs1_vrfy(const unsigned char *x, size_t xlen,
const unsigned char *hash_oid, size_t hash_len,
const br_rsa_public_key *pk, unsigned char *hash_out)
{
unsigned char sig[BR_MAX_RSA_SIZE >> 3];
if (xlen > (sizeof sig)) {
return 0;
}
memcpy(sig, x, xlen);
if (!br_rsa_i15_public(sig, xlen, pk)) {
return 0;
}
return br_rsa_pkcs1_sig_unpad(sig, xlen, hash_oid, hash_len, hash_out);
}

146
src/rsa/rsa_i15_priv.c Normal file
View file

@ -0,0 +1,146 @@
/*
* Copyright (c) 2017 Thomas Pornin <pornin@bolet.org>
*
* Permission is hereby granted, free of charge, to any person obtaining
* a copy of this software and associated documentation files (the
* "Software"), to deal in the Software without restriction, including
* without limitation the rights to use, copy, modify, merge, publish,
* distribute, sublicense, and/or sell copies of the Software, and to
* permit persons to whom the Software is furnished to do so, subject to
* the following conditions:
*
* The above copyright notice and this permission notice shall be
* included in all copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
* BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
* ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
* CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
* SOFTWARE.
*/
#include "inner.h"
#define U (1 + ((BR_MAX_RSA_FACTOR + 14) / 15))
/* see bearssl_rsa.h */
uint32_t
br_rsa_i15_private(unsigned char *x, const br_rsa_private_key *sk)
{
const unsigned char *p, *q;
size_t plen, qlen;
uint16_t tmp[6 * U];
uint16_t *mp, *mq, *s1, *s2, *t1, *t2, *t3;
uint16_t p0i, q0i;
size_t xlen;
/*
* All our temporary buffers are from the tmp[] array.
*
* The mp, mq, s1, s2, t1 and t2 buffers are large enough to
* contain a RSA factor. The t3 buffer can contain a complete
* RSA modulus. t3 shares its storage space with s2, s1 and t1,
* in that order (this is important, see below).
*/
mq = tmp;
mp = tmp + U;
t2 = tmp + 2 * U;
s2 = tmp + 3 * U;
s1 = tmp + 4 * U;
t1 = tmp + 5 * U;
t3 = s2;
/*
* Compute the actual lengths (in bytes) of p and q, and check
* that they fit within our stack buffers.
*/
p = sk->p;
plen = sk->plen;
while (plen > 0 && *p == 0) {
p ++;
plen --;
}
q = sk->q;
qlen = sk->qlen;
while (qlen > 0 && *q == 0) {
q ++;
qlen --;
}
if (plen > (BR_MAX_RSA_FACTOR >> 3)
|| qlen > (BR_MAX_RSA_FACTOR >> 3))
{
return 0;
}
/*
* Decode p and q.
*/
br_i15_decode(mp, p, plen);
br_i15_decode(mq, q, qlen);
/*
* Compute signature length (in bytes).
*/
xlen = (sk->n_bitlen + 7) >> 3;
/*
* Compute s1 = x^dp mod p.
*/
p0i = br_i15_ninv15(mp[1]);
br_i15_decode_reduce(s1, x, xlen, mp);
br_i15_modpow(s1, sk->dp, sk->dplen, mp, p0i, t1, t2);
/*
* Compute s2 = x^dq mod q.
*/
q0i = br_i15_ninv15(mq[1]);
br_i15_decode_reduce(s2, x, xlen, mq);
br_i15_modpow(s2, sk->dq, sk->dqlen, mq, q0i, t1, t2);
/*
* Compute:
* h = (s1 - s2)*(1/q) mod p
* s1 is an integer modulo p, but s2 is modulo q. PKCS#1 is
* unclear about whether p may be lower than q (some existing,
* widely deployed implementations of RSA don't tolerate p < q),
* but we want to support that occurrence, so we need to use the
* reduction function.
*
* Since we use br_i15_decode_reduce() for iq (purportedly, the
* inverse of q modulo p), we also tolerate improperly large
* values for this parameter.
*/
br_i15_reduce(t2, s2, mp);
br_i15_add(s1, mp, br_i15_sub(s1, t2, 1));
br_i15_to_monty(s1, mp);
br_i15_decode_reduce(t1, sk->iq, sk->iqlen, mp);
br_i15_montymul(t2, s1, t1, mp, p0i);
/*
* h is now in t2. We compute the final result:
* s = s2 + q*h
* All these operations are non-modular.
*
* We need mq, s2 and t2. We use the t3 buffer as destination.
* The buffers mp, s1 and t1 are no longer needed. Moreover,
* the first step is to copy s2 into the destination buffer t3.
* We thus arranged for t3 to actually share space with s2, and
* to be followed by the space formerly used by s1 and t1.
*/
br_i15_mulacc(t3, mq, t2);
/*
* Encode the result. Since we already checked the value of xlen,
* we can just use it right away.
*/
br_i15_encode(x, xlen, t3);
/*
* The only error conditions remaining at that point are invalid
* values for p and q (even integers).
*/
return p0i & q0i & 1;
}

78
src/rsa/rsa_i15_pub.c Normal file
View file

@ -0,0 +1,78 @@
/*
* Copyright (c) 2017 Thomas Pornin <pornin@bolet.org>
*
* Permission is hereby granted, free of charge, to any person obtaining
* a copy of this software and associated documentation files (the
* "Software"), to deal in the Software without restriction, including
* without limitation the rights to use, copy, modify, merge, publish,
* distribute, sublicense, and/or sell copies of the Software, and to
* permit persons to whom the Software is furnished to do so, subject to
* the following conditions:
*
* The above copyright notice and this permission notice shall be
* included in all copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
* BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
* ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
* CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
* SOFTWARE.
*/
#include "inner.h"
/* see bearssl_rsa.h */
uint32_t
br_rsa_i15_public(unsigned char *x, size_t xlen,
const br_rsa_public_key *pk)
{
const unsigned char *n;
size_t nlen;
uint16_t m[1 + ((BR_MAX_RSA_SIZE + 14) / 15)];
uint16_t a[1 + ((BR_MAX_RSA_SIZE + 14) / 15)];
uint16_t t1[1 + ((BR_MAX_RSA_SIZE + 14) / 15)];
uint16_t t2[1 + ((BR_MAX_RSA_SIZE + 14) / 15)];
uint16_t m0i;
uint32_t r;
/*
* Get the actual length of the modulus, and see if it fits within
* our stack buffer. We also check that the length of x[] is valid.
*/
n = pk->n;
nlen = pk->nlen;
while (nlen > 0 && *n == 0) {
n ++;
nlen --;
}
if (nlen == 0 || nlen > (BR_MAX_RSA_SIZE >> 3) || xlen != nlen) {
return 0;
}
br_i15_decode(m, n, nlen);
m0i = br_i15_ninv15(m[1]);
/*
* Note: if m[] is even, then m0i == 0. Otherwise, m0i must be
* an odd integer.
*/
r = m0i & 1;
/*
* Decode x[] into a[]; we also check that its value is proper.
*/
r &= br_i15_decode_mod(a, x, xlen, m);
/*
* Compute the modular exponentiation.
*/
br_i15_modpow(a, pk->e, pk->elen, m, m0i, t1, t2);
/*
* Encode the result.
*/
br_i15_encode(x, xlen, a);
return r;
}

71
src/rsa/rsa_i31_pkcs1_sign.c
View file

@ -30,75 +30,8 @@ br_rsa_i31_pkcs1_sign(const unsigned char *hash_oid,
const unsigned char *hash, size_t hash_len,
const br_rsa_private_key *sk, unsigned char *x)
{
size_t u, x3, xlen;
/*
* Padded hash value has format:
* 00 01 FF .. FF 00 30 x1 30 x2 06 x3 OID 05 00 04 x4 HASH
*
* with the following rules:
*
* -- Total length is equal to the modulus length (unsigned
* encoding).
*
* -- There must be at least eight bytes of value 0xFF.
*
* -- x4 is equal to the hash length (hash_len).
*
* -- x3 is equal to the encoded OID value length (hash_oid[0]).
*
* -- x2 = x3 + 4.
*
* -- x1 = x2 + x4 + 4 = x3 + x4 + 8.
*
* Note: the "05 00" is optional (signatures with and without
* that sequence exist in practice), but notes in PKCS#1 seem to
* indicate that the presence of that sequence (specifically,
* an ASN.1 NULL value for the hash parameters) may be slightly
* more "standard" than the opposite.
*/
xlen = (sk->n_bitlen + 7) >> 3;
if (hash_oid == NULL) {
if (xlen < hash_len + 11) {
return 0;
}
x[0] = 0x00;
x[1] = 0x01;
u = xlen - hash_len;
memset(x + 2, 0xFF, u - 3);
x[u - 1] = 0x00;
} else {
x3 = hash_oid[0];
/*
* Check that there is enough room for all the elements,
* including at least eight bytes of value 0xFF.
*/
if (xlen < (x3 + hash_len + 21)) {
return 0;
}
x[0] = 0x00;
x[1] = 0x01;
u = xlen - x3 - hash_len - 11;
memset(x + 2, 0xFF, u - 2);
x[u] = 0x00;
x[u + 1] = 0x30;
x[u + 2] = x3 + hash_len + 8;
x[u + 3] = 0x30;
x[u + 4] = x3 + 4;
x[u + 5] = 0x06;
memcpy(x + u + 6, hash_oid, x3 + 1);
u += x3 + 7;
x[u ++] = 0x05;
x[u ++] = 0x00;
x[u ++] = 0x04;
x[u ++] = hash_len;
if (!br_rsa_pkcs1_sig_pad(hash_oid, hash, hash_len, sk->n_bitlen, x)) {
return 0;
}
memcpy(x + u, hash, hash_len);
/*
* Do the actual computation.
*/
return br_rsa_i31_private(x, sk);
}

87
src/rsa/rsa_i31_pkcs1_vrfy.c
View file

@ -30,97 +30,14 @@ br_rsa_i31_pkcs1_vrfy(const unsigned char *x, size_t xlen,
const unsigned char *hash_oid, size_t hash_len,
const br_rsa_public_key *pk, unsigned char *hash_out)
{
static const unsigned char pad1[] = {
0x00, 0x01, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
};
unsigned char sig[BR_MAX_RSA_SIZE >> 3];
unsigned char pad2[43];
size_t u, x2, x3, pad_len, zlen;
if (xlen > (sizeof sig) || xlen < 11) {
if (xlen > (sizeof sig)) {
return 0;
}
memcpy(sig, x, xlen);
if (!br_rsa_i31_public(sig, xlen, pk)) {
return 0;
}
/*
* Expected format:
* 00 01 FF ... FF 00 30 x1 30 x2 06 x3 OID [ 05 00 ] 04 x4 HASH
*
* with the following rules:
*
* -- Total length is that of the modulus and the signature
* (this was already verified by br_rsa_i31_public()).
*
* -- There are at least eight bytes of value 0xFF.
*
* -- x4 is equal to the hash length (hash_len).
*
* -- x3 is equal to the encoded OID value length (so x3 is the
* first byte of hash_oid[]).
*
* -- If the "05 00" is present, then x2 == x3 + 4; otherwise,
* x2 == x3 + 2.
*
* -- x1 == x2 + x4 + 4.
*
* So the total length after the last "FF" is either x3 + x4 + 11
* (with the "05 00") or x3 + x4 + 9 (without the "05 00").
*/
/*
* Check the "00 01 FF .. FF 00" with at least eight 0xFF bytes.
* The comparaison is valid because we made sure that the signature
* is at least 11 bytes long.
*/
if (memcmp(sig, pad1, sizeof pad1) != 0) {
return 0;
}
for (u = sizeof pad1; u < xlen; u ++) {
if (sig[u] != 0xFF) {
break;
}
}
/*
* Remaining length is xlen - u bytes (including the 00 just
* after the last FF). This must be equal to one of the two
* possible values (depending on whether the "05 00" sequence is
* present or not).
*/
if (hash_oid == NULL) {
if (xlen - u != hash_len + 1 || sig[u] != 0x00) {
return 0;
}
} else {
x3 = hash_oid[0];
pad_len = x3 + 9;
memset(pad2, 0, pad_len);
zlen = xlen - u - hash_len;
if (zlen == pad_len) {
x2 = x3 + 2;
} else if (zlen == pad_len + 2) {
x2 = x3 + 4;
pad_len = zlen;
pad2[pad_len - 4] = 0x05;
} else {
return 0;
}
pad2[1] = 0x30;
pad2[2] = x2 + hash_len + 4;
pad2[3] = 0x30;
pad2[4] = x2;
pad2[5] = 0x06;
memcpy(pad2 + 6, hash_oid, x3 + 1);
pad2[pad_len - 2] = 0x04;
pad2[pad_len - 1] = hash_len;
if (memcmp(pad2, sig + u, pad_len) != 0) {
return 0;
}
}
memcpy(hash_out, sig + xlen - hash_len, hash_len);
return 1;
return br_rsa_pkcs1_sig_unpad(sig, xlen, hash_oid, hash_len, hash_out);
}

71
src/rsa/rsa_i32_pkcs1_sign.c
View file

@ -30,75 +30,8 @@ br_rsa_i32_pkcs1_sign(const unsigned char *hash_oid,
const unsigned char *hash, size_t hash_len,
const br_rsa_private_key *sk, unsigned char *x)
{
size_t u, x3, xlen;
/*
* Padded hash value has format:
* 00 01 FF .. FF 00 30 x1 30 x2 06 x3 OID 05 00 04 x4 HASH
*
* with the following rules:
*
* -- Total length is equal to the modulus length (unsigned
* encoding).
*
* -- There must be at least eight bytes of value 0xFF.
*
* -- x4 is equal to the hash length (hash_len).
*
* -- x3 is equal to the encoded OID value length (hash_oid[0]).
*
* -- x2 = x3 + 4.
*
* -- x1 = x2 + x4 + 4 = x3 + x4 + 8.
*
* Note: the "05 00" is optional (signatures with and without
* that sequence exist in practice), but notes in PKCS#1 seem to
* indicate that the presence of that sequence (specifically,
* an ASN.1 NULL value for the hash parameters) may be slightly
* more "standard" than the opposite.
*/
xlen = (sk->n_bitlen + 7) >> 3;
if (hash_oid == NULL) {
if (xlen < hash_len + 11) {
return 0;
}
x[0] = 0x00;
x[1] = 0x01;
u = xlen - hash_len;
memset(x + 2, 0xFF, u - 3);
x[u - 1] = 0x00;
} else {
x3 = hash_oid[0];
/*
* Check that there is enough room for all the elements,
* including at least eight bytes of value 0xFF.
*/
if (xlen < (x3 + hash_len + 21)) {
return 0;
}
x[0] = 0x00;
x[1] = 0x01;
u = xlen - x3 - hash_len - 11;
memset(x + 2, 0xFF, u - 2);
x[u] = 0x00;
x[u + 1] = 0x30;
x[u + 2] = x3 + hash_len + 8;
x[u + 3] = 0x30;
x[u + 4] = x3 + 4;
x[u + 5] = 0x06;
memcpy(x + u + 6, hash_oid, x3 + 1);
u += x3 + 7;
x[u ++] = 0x05;
x[u ++] = 0x00;
x[u ++] = 0x04;
x[u ++] = hash_len;
if (!br_rsa_pkcs1_sig_pad(hash_oid, hash, hash_len, sk->n_bitlen, x)) {
return 0;
}
memcpy(x + u, hash, hash_len);
/*
* Do the actual computation.
*/
return br_rsa_i32_private(x, sk);
}

87
src/rsa/rsa_i32_pkcs1_vrfy.c
View file

@ -30,97 +30,14 @@ br_rsa_i32_pkcs1_vrfy(const unsigned char *x, size_t xlen,
const unsigned char *hash_oid, size_t hash_len,
const br_rsa_public_key *pk, unsigned char *hash_out)
{
static const unsigned char pad1[] = {
0x00, 0x01, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
};
unsigned char sig[BR_MAX_RSA_SIZE >> 3];
unsigned char pad2[43];
size_t u, x2, x3, pad_len, zlen;
if (xlen > (sizeof sig) || xlen < 11) {
if (xlen > (sizeof sig)) {
return 0;
}
memcpy(sig, x, xlen);
if (!br_rsa_i32_public(sig, xlen, pk)) {
return 0;
}
/*
* Expected format:
* 00 01 FF ... FF 00 30 x1 30 x2 06 x3 OID [ 05 00 ] 04 x4 HASH
*
* with the following rules:
*
* -- Total length is that of the modulus and the signature
* (this was already verified by br_rsa_i32_public()).
*
* -- There are at least eight bytes of value 0xFF.
*
* -- x4 is equal to the hash length (hash_len).
*
* -- x3 is equal to the encoded OID value length (so x3 is the
* first byte of hash_oid[]).
*
* -- If the "05 00" is present, then x2 == x3 + 4; otherwise,
* x2 == x3 + 2.
*
* -- x1 == x2 + x4 + 4.
*
* So the total length after the last "FF" is either x3 + x4 + 11
* (with the "05 00") or x3 + x4 + 9 (without the "05 00").
*/
/*
* Check the "00 01 FF .. FF 00" with at least eight 0xFF bytes.
* The comparaison is valid because we made sure that the signature
* is at least 11 bytes long.
*/
if (memcmp(sig, pad1, sizeof pad1) != 0) {
return 0;
}
for (u = sizeof pad1; u < xlen; u ++) {
if (sig[u] != 0xFF) {
break;
}
}
/*
* Remaining length is xlen - u bytes (including the 00 just
* after the last FF). This must be equal to one of the two
* possible values (depending on whether the "05 00" sequence is
* present or not).
*/
if (hash_oid == NULL) {
if (xlen - u != hash_len + 1 || sig[u] != 0x00) {
return 0;
}
} else {
x3 = hash_oid[0];
pad_len = x3 + 9;
memset(pad2, 0, pad_len);
zlen = xlen - u - hash_len;
if (zlen == pad_len) {
x2 = x3 + 2;
} else if (zlen == pad_len + 2) {
x2 = x3 + 4;
pad_len = zlen;
pad2[pad_len - 4] = 0x05;
} else {
return 0;
}
pad2[1] = 0x30;
pad2[2] = x2 + hash_len + 4;
pad2[3] = 0x30;
pad2[4] = x2;
pad2[5] = 0x06;
memcpy(pad2 + 6, hash_oid, x3 + 1);
pad2[pad_len - 2] = 0x04;
pad2[pad_len - 1] = hash_len;
if (memcmp(pad2, sig + u, pad_len) != 0) {
return 0;
}
}
memcpy(hash_out, sig + xlen - hash_len, hash_len);
return 1;
return br_rsa_pkcs1_sig_unpad(sig, xlen, hash_oid, hash_len, hash_out);
}

100
src/rsa/rsa_pkcs1_sig_pad.c Normal file
View file

@ -0,0 +1,100 @@
/*
* Copyright (c) 2017 Thomas Pornin <pornin@bolet.org>
*
* Permission is hereby granted, free of charge, to any person obtaining
* a copy of this software and associated documentation files (the
* "Software"), to deal in the Software without restriction, including
* without limitation the rights to use, copy, modify, merge, publish,
* distribute, sublicense, and/or sell copies of the Software, and to
* permit persons to whom the Software is furnished to do so, subject to
* the following conditions:
*
* The above copyright notice and this permission notice shall be
* included in all copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
* BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
* ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
* CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
* SOFTWARE.
*/
#include "inner.h"
/* see inner.h */
uint32_t
br_rsa_pkcs1_sig_pad(const unsigned char *hash_oid,
const unsigned char *hash, size_t hash_len,
uint32_t n_bitlen, unsigned char *x)
{
size_t u, x3, xlen;
/*
* Padded hash value has format:
* 00 01 FF .. FF 00 30 x1 30 x2 06 x3 OID 05 00 04 x4 HASH
*
* with the following rules:
*
* -- Total length is equal to the modulus length (unsigned
* encoding).
*
* -- There must be at least eight bytes of value 0xFF.
*
* -- x4 is equal to the hash length (hash_len).
*
* -- x3 is equal to the encoded OID value length (hash_oid[0]).
*
* -- x2 = x3 + 4.
*
* -- x1 = x2 + x4 + 4 = x3 + x4 + 8.
*
* Note: the "05 00" is optional (signatures with and without
* that sequence exist in practice), but notes in PKCS#1 seem to
* indicate that the presence of that sequence (specifically,
* an ASN.1 NULL value for the hash parameters) may be slightly
* more "standard" than the opposite.
*/
xlen = (n_bitlen + 7) >> 3;
if (hash_oid == NULL) {
if (xlen < hash_len + 11) {
return 0;
}
x[0] = 0x00;
x[1] = 0x01;
u = xlen - hash_len;
memset(x + 2, 0xFF, u - 3);
x[u - 1] = 0x00;
} else {
x3 = hash_oid[0];
/*
* Check that there is enough room for all the elements,
* including at least eight bytes of value 0xFF.
*/
if (xlen < (x3 + hash_len + 21)) {
return 0;
}
x[0] = 0x00;
x[1] = 0x01;
u = xlen - x3 - hash_len - 11;
memset(x + 2, 0xFF, u - 2);
x[u] = 0x00;
x[u + 1] = 0x30;
x[u + 2] = x3 + hash_len + 8;
x[u + 3] = 0x30;
x[u + 4] = x3 + 4;
x[u + 5] = 0x06;
memcpy(x + u + 6, hash_oid, x3 + 1);
u += x3 + 7;
x[u ++] = 0x05;
x[u ++] = 0x00;
x[u ++] = 0x04;
x[u ++] = hash_len;
}
memcpy(x + u, hash, hash_len);
return 1;
}

121
src/rsa/rsa_pkcs1_sig_unpad.c Normal file
View file

@ -0,0 +1,121 @@
/*
* Copyright (c) 2017 Thomas Pornin <pornin@bolet.org>
*
* Permission is hereby granted, free of charge, to any person obtaining
* a copy of this software and associated documentation files (the
* "Software"), to deal in the Software without restriction, including
* without limitation the rights to use, copy, modify, merge, publish,
* distribute, sublicense, and/or sell copies of the Software, and to
* permit persons to whom the Software is furnished to do so, subject to
* the following conditions:
*
* The above copyright notice and this permission notice shall be
* included in all copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
* BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
* ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
* CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
* SOFTWARE.
*/
#include "inner.h"
/* see bearssl_rsa.h */
uint32_t
br_rsa_pkcs1_sig_unpad(const unsigned char *sig, size_t sig_len,
const unsigned char *hash_oid, size_t hash_len,
unsigned char *hash_out)
{
static const unsigned char pad1[] = {
0x00, 0x01, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
};
unsigned char pad2[43];
size_t u, x2, x3, pad_len, zlen;
if (sig_len < 11) {
return 0;
}
/*
* Expected format:
* 00 01 FF ... FF 00 30 x1 30 x2 06 x3 OID [ 05 00 ] 04 x4 HASH
*
* with the following rules:
*
* -- Total length is that of the modulus and the signature
* (this was already verified by br_rsa_i31_public()).
*
* -- There are at least eight bytes of value 0xFF.
*
* -- x4 is equal to the hash length (hash_len).
*
* -- x3 is equal to the encoded OID value length (so x3 is the
* first byte of hash_oid[]).
*
* -- If the "05 00" is present, then x2 == x3 + 4; otherwise,
* x2 == x3 + 2.
*
* -- x1 == x2 + x4 + 4.
*
* So the total length after the last "FF" is either x3 + x4 + 11
* (with the "05 00") or x3 + x4 + 9 (without the "05 00").
*/
/*
* Check the "00 01 FF .. FF 00" with at least eight 0xFF bytes.
* The comparaison is valid because we made sure that the signature
* is at least 11 bytes long.
*/
if (memcmp(sig, pad1, sizeof pad1) != 0) {
return 0;
}
for (u = sizeof pad1; u < sig_len; u ++) {
if (sig[u] != 0xFF) {
break;
}
}
/*
* Remaining length is sig_len - u bytes (including the 00 just
* after the last FF). This must be equal to one of the two
* possible values (depending on whether the "05 00" sequence is
* present or not).
*/
if (hash_oid == NULL) {
if (sig_len - u != hash_len + 1 || sig[u] != 0x00) {
return 0;
}
} else {
x3 = hash_oid[0];
pad_len = x3 + 9;
memset(pad2, 0, pad_len);
zlen = sig_len - u - hash_len;
if (zlen == pad_len) {
x2 = x3 + 2;
} else if (zlen == pad_len + 2) {
x2 = x3 + 4;
pad_len = zlen;
pad2[pad_len - 4] = 0x05;
} else {
return 0;
}
pad2[1] = 0x30;
pad2[2] = x2 + hash_len + 4;
pad2[3] = 0x30;
pad2[4] = x2;
pad2[5] = 0x06;
memcpy(pad2 + 6, hash_oid, x3 + 1);
pad2[pad_len - 2] = 0x04;
pad2[pad_len - 1] = hash_len;
if (memcmp(pad2, sig + u, pad_len) != 0) {
return 0;
}
}
memcpy(hash_out, sig + sig_len - hash_len, hash_len);
return 1;
}