1 /* crypto/rsa/rsa_pmeth.c */
3 * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL project
6 /* ====================================================================
7 * Copyright (c) 2006 The OpenSSL Project. All rights reserved.
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
16 * 2. Redistributions in binary form must reproduce the above copyright
17 * notice, this list of conditions and the following disclaimer in
18 * the documentation and/or other materials provided with the
21 * 3. All advertising materials mentioning features or use of this
22 * software must display the following acknowledgment:
23 * "This product includes software developed by the OpenSSL Project
24 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
26 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
27 * endorse or promote products derived from this software without
28 * prior written permission. For written permission, please contact
29 * licensing@OpenSSL.org.
31 * 5. Products derived from this software may not be called "OpenSSL"
32 * nor may "OpenSSL" appear in their names without prior written
33 * permission of the OpenSSL Project.
35 * 6. Redistributions of any form whatsoever must retain the following
37 * "This product includes software developed by the OpenSSL Project
38 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
40 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
41 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
42 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
43 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
44 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
45 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
46 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
47 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
49 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
50 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
51 * OF THE POSSIBILITY OF SUCH DAMAGE.
52 * ====================================================================
54 * This product includes cryptographic software written by Eric Young
55 * (eay@cryptsoft.com). This product includes software written by Tim
56 * Hudson (tjh@cryptsoft.com).
61 #include "internal/cryptlib.h"
62 #include <openssl/asn1t.h>
63 #include <openssl/x509.h>
64 #include <openssl/rsa.h>
65 #include <openssl/bn.h>
66 #include <openssl/evp.h>
67 #include <openssl/x509v3.h>
68 #ifndef OPENSSL_NO_CMS
69 # include <openssl/cms.h>
71 #include "internal/evp_int.h"
74 /* RSA pkey context structure */
77 /* Key gen parameters */
80 /* Keygen callback info */
82 /* RSA padding mode */
86 /* message digest for MGF1 */
93 unsigned char *oaep_label;
97 static int pkey_rsa_init(EVP_PKEY_CTX *ctx)
100 rctx = OPENSSL_zalloc(sizeof(*rctx));
104 rctx->pad_mode = RSA_PKCS1_PADDING;
107 ctx->keygen_info = rctx->gentmp;
108 ctx->keygen_info_count = 2;
113 static int pkey_rsa_copy(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src)
115 RSA_PKEY_CTX *dctx, *sctx;
116 if (!pkey_rsa_init(dst))
120 dctx->nbits = sctx->nbits;
122 dctx->pub_exp = BN_dup(sctx->pub_exp);
126 dctx->pad_mode = sctx->pad_mode;
128 dctx->mgf1md = sctx->mgf1md;
129 if (sctx->oaep_label) {
130 OPENSSL_free(dctx->oaep_label);
131 dctx->oaep_label = OPENSSL_memdup(sctx->oaep_label, sctx->oaep_labellen);
132 if (!dctx->oaep_label)
134 dctx->oaep_labellen = sctx->oaep_labellen;
139 static int setup_tbuf(RSA_PKEY_CTX *ctx, EVP_PKEY_CTX *pk)
143 ctx->tbuf = OPENSSL_malloc(EVP_PKEY_size(pk->pkey));
144 if (ctx->tbuf == NULL)
149 static void pkey_rsa_cleanup(EVP_PKEY_CTX *ctx)
151 RSA_PKEY_CTX *rctx = ctx->data;
153 BN_free(rctx->pub_exp);
154 OPENSSL_free(rctx->tbuf);
155 OPENSSL_free(rctx->oaep_label);
160 static int pkey_rsa_sign(EVP_PKEY_CTX *ctx, unsigned char *sig,
161 size_t *siglen, const unsigned char *tbs,
165 RSA_PKEY_CTX *rctx = ctx->data;
166 RSA *rsa = ctx->pkey->pkey.rsa;
169 if (tbslen != (size_t)EVP_MD_size(rctx->md)) {
170 RSAerr(RSA_F_PKEY_RSA_SIGN, RSA_R_INVALID_DIGEST_LENGTH);
174 if (EVP_MD_type(rctx->md) == NID_mdc2) {
176 if (rctx->pad_mode != RSA_PKCS1_PADDING)
178 ret = RSA_sign_ASN1_OCTET_STRING(NID_mdc2,
179 tbs, tbslen, sig, &sltmp, rsa);
184 } else if (rctx->pad_mode == RSA_X931_PADDING) {
185 if ((size_t)EVP_PKEY_size(ctx->pkey) < tbslen + 1) {
186 RSAerr(RSA_F_PKEY_RSA_SIGN, RSA_R_KEY_SIZE_TOO_SMALL);
189 if (!setup_tbuf(rctx, ctx)) {
190 RSAerr(RSA_F_PKEY_RSA_SIGN, ERR_R_MALLOC_FAILURE);
193 memcpy(rctx->tbuf, tbs, tbslen);
194 rctx->tbuf[tbslen] = RSA_X931_hash_id(EVP_MD_type(rctx->md));
195 ret = RSA_private_encrypt(tbslen + 1, rctx->tbuf,
196 sig, rsa, RSA_X931_PADDING);
197 } else if (rctx->pad_mode == RSA_PKCS1_PADDING) {
199 ret = RSA_sign(EVP_MD_type(rctx->md),
200 tbs, tbslen, sig, &sltmp, rsa);
204 } else if (rctx->pad_mode == RSA_PKCS1_PSS_PADDING) {
205 if (!setup_tbuf(rctx, ctx))
207 if (!RSA_padding_add_PKCS1_PSS_mgf1(rsa,
209 rctx->md, rctx->mgf1md,
212 ret = RSA_private_encrypt(RSA_size(rsa), rctx->tbuf,
213 sig, rsa, RSA_NO_PADDING);
217 ret = RSA_private_encrypt(tbslen, tbs, sig, ctx->pkey->pkey.rsa,
225 static int pkey_rsa_verifyrecover(EVP_PKEY_CTX *ctx,
226 unsigned char *rout, size_t *routlen,
227 const unsigned char *sig, size_t siglen)
230 RSA_PKEY_CTX *rctx = ctx->data;
233 if (rctx->pad_mode == RSA_X931_PADDING) {
234 if (!setup_tbuf(rctx, ctx))
236 ret = RSA_public_decrypt(siglen, sig,
237 rctx->tbuf, ctx->pkey->pkey.rsa,
242 if (rctx->tbuf[ret] != RSA_X931_hash_id(EVP_MD_type(rctx->md))) {
243 RSAerr(RSA_F_PKEY_RSA_VERIFYRECOVER,
244 RSA_R_ALGORITHM_MISMATCH);
247 if (ret != EVP_MD_size(rctx->md)) {
248 RSAerr(RSA_F_PKEY_RSA_VERIFYRECOVER,
249 RSA_R_INVALID_DIGEST_LENGTH);
253 memcpy(rout, rctx->tbuf, ret);
254 } else if (rctx->pad_mode == RSA_PKCS1_PADDING) {
256 ret = int_rsa_verify(EVP_MD_type(rctx->md),
257 NULL, 0, rout, &sltmp,
258 sig, siglen, ctx->pkey->pkey.rsa);
265 ret = RSA_public_decrypt(siglen, sig, rout, ctx->pkey->pkey.rsa,
273 static int pkey_rsa_verify(EVP_PKEY_CTX *ctx,
274 const unsigned char *sig, size_t siglen,
275 const unsigned char *tbs, size_t tbslen)
277 RSA_PKEY_CTX *rctx = ctx->data;
278 RSA *rsa = ctx->pkey->pkey.rsa;
281 if (rctx->pad_mode == RSA_PKCS1_PADDING)
282 return RSA_verify(EVP_MD_type(rctx->md), tbs, tbslen,
284 if (rctx->pad_mode == RSA_X931_PADDING) {
285 if (pkey_rsa_verifyrecover(ctx, NULL, &rslen, sig, siglen) <= 0)
287 } else if (rctx->pad_mode == RSA_PKCS1_PSS_PADDING) {
289 if (!setup_tbuf(rctx, ctx))
291 ret = RSA_public_decrypt(siglen, sig, rctx->tbuf,
292 rsa, RSA_NO_PADDING);
295 ret = RSA_verify_PKCS1_PSS_mgf1(rsa, tbs,
296 rctx->md, rctx->mgf1md,
297 rctx->tbuf, rctx->saltlen);
304 if (!setup_tbuf(rctx, ctx))
306 rslen = RSA_public_decrypt(siglen, sig, rctx->tbuf,
307 rsa, rctx->pad_mode);
312 if ((rslen != tbslen) || memcmp(tbs, rctx->tbuf, rslen))
319 static int pkey_rsa_encrypt(EVP_PKEY_CTX *ctx,
320 unsigned char *out, size_t *outlen,
321 const unsigned char *in, size_t inlen)
324 RSA_PKEY_CTX *rctx = ctx->data;
325 if (rctx->pad_mode == RSA_PKCS1_OAEP_PADDING) {
326 int klen = RSA_size(ctx->pkey->pkey.rsa);
327 if (!setup_tbuf(rctx, ctx))
329 if (!RSA_padding_add_PKCS1_OAEP_mgf1(rctx->tbuf, klen,
333 rctx->md, rctx->mgf1md))
335 ret = RSA_public_encrypt(klen, rctx->tbuf, out,
336 ctx->pkey->pkey.rsa, RSA_NO_PADDING);
338 ret = RSA_public_encrypt(inlen, in, out, ctx->pkey->pkey.rsa,
346 static int pkey_rsa_decrypt(EVP_PKEY_CTX *ctx,
347 unsigned char *out, size_t *outlen,
348 const unsigned char *in, size_t inlen)
351 RSA_PKEY_CTX *rctx = ctx->data;
352 if (rctx->pad_mode == RSA_PKCS1_OAEP_PADDING) {
354 if (!setup_tbuf(rctx, ctx))
356 ret = RSA_private_decrypt(inlen, in, rctx->tbuf,
357 ctx->pkey->pkey.rsa, RSA_NO_PADDING);
360 for (i = 0; i < ret; i++) {
364 ret = RSA_padding_check_PKCS1_OAEP_mgf1(out, ret, rctx->tbuf + i,
368 rctx->md, rctx->mgf1md);
370 ret = RSA_private_decrypt(inlen, in, out, ctx->pkey->pkey.rsa,
378 static int check_padding_md(const EVP_MD *md, int padding)
384 mdnid = EVP_MD_type(md);
386 if (padding == RSA_NO_PADDING) {
387 RSAerr(RSA_F_CHECK_PADDING_MD, RSA_R_INVALID_PADDING_MODE);
391 if (padding == RSA_X931_PADDING) {
392 if (RSA_X931_hash_id(mdnid) == -1) {
393 RSAerr(RSA_F_CHECK_PADDING_MD, RSA_R_INVALID_X931_DIGEST);
398 /* List of all supported RSA digests */
413 RSAerr(RSA_F_CHECK_PADDING_MD, RSA_R_INVALID_DIGEST);
422 static int pkey_rsa_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2)
424 RSA_PKEY_CTX *rctx = ctx->data;
426 case EVP_PKEY_CTRL_RSA_PADDING:
427 if ((p1 >= RSA_PKCS1_PADDING) && (p1 <= RSA_PKCS1_PSS_PADDING)) {
428 if (!check_padding_md(rctx->md, p1))
430 if (p1 == RSA_PKCS1_PSS_PADDING) {
431 if (!(ctx->operation &
432 (EVP_PKEY_OP_SIGN | EVP_PKEY_OP_VERIFY)))
435 rctx->md = EVP_sha1();
437 if (p1 == RSA_PKCS1_OAEP_PADDING) {
438 if (!(ctx->operation & EVP_PKEY_OP_TYPE_CRYPT))
441 rctx->md = EVP_sha1();
447 RSAerr(RSA_F_PKEY_RSA_CTRL,
448 RSA_R_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE);
451 case EVP_PKEY_CTRL_GET_RSA_PADDING:
452 *(int *)p2 = rctx->pad_mode;
455 case EVP_PKEY_CTRL_RSA_PSS_SALTLEN:
456 case EVP_PKEY_CTRL_GET_RSA_PSS_SALTLEN:
457 if (rctx->pad_mode != RSA_PKCS1_PSS_PADDING) {
458 RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_INVALID_PSS_SALTLEN);
461 if (type == EVP_PKEY_CTRL_GET_RSA_PSS_SALTLEN)
462 *(int *)p2 = rctx->saltlen;
470 case EVP_PKEY_CTRL_RSA_KEYGEN_BITS:
472 RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_KEY_SIZE_TOO_SMALL);
478 case EVP_PKEY_CTRL_RSA_KEYGEN_PUBEXP:
481 BN_free(rctx->pub_exp);
485 case EVP_PKEY_CTRL_RSA_OAEP_MD:
486 case EVP_PKEY_CTRL_GET_RSA_OAEP_MD:
487 if (rctx->pad_mode != RSA_PKCS1_OAEP_PADDING) {
488 RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_INVALID_PADDING_MODE);
491 if (type == EVP_PKEY_CTRL_GET_RSA_OAEP_MD)
492 *(const EVP_MD **)p2 = rctx->md;
497 case EVP_PKEY_CTRL_MD:
498 if (!check_padding_md(p2, rctx->pad_mode))
503 case EVP_PKEY_CTRL_GET_MD:
504 *(const EVP_MD **)p2 = rctx->md;
507 case EVP_PKEY_CTRL_RSA_MGF1_MD:
508 case EVP_PKEY_CTRL_GET_RSA_MGF1_MD:
509 if (rctx->pad_mode != RSA_PKCS1_PSS_PADDING
510 && rctx->pad_mode != RSA_PKCS1_OAEP_PADDING) {
511 RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_INVALID_MGF1_MD);
514 if (type == EVP_PKEY_CTRL_GET_RSA_MGF1_MD) {
516 *(const EVP_MD **)p2 = rctx->mgf1md;
518 *(const EVP_MD **)p2 = rctx->md;
523 case EVP_PKEY_CTRL_RSA_OAEP_LABEL:
524 if (rctx->pad_mode != RSA_PKCS1_OAEP_PADDING) {
525 RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_INVALID_PADDING_MODE);
528 OPENSSL_free(rctx->oaep_label);
530 rctx->oaep_label = p2;
531 rctx->oaep_labellen = p1;
533 rctx->oaep_label = NULL;
534 rctx->oaep_labellen = 0;
538 case EVP_PKEY_CTRL_GET_RSA_OAEP_LABEL:
539 if (rctx->pad_mode != RSA_PKCS1_OAEP_PADDING) {
540 RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_INVALID_PADDING_MODE);
543 *(unsigned char **)p2 = rctx->oaep_label;
544 return rctx->oaep_labellen;
546 case EVP_PKEY_CTRL_DIGESTINIT:
547 case EVP_PKEY_CTRL_PKCS7_ENCRYPT:
548 case EVP_PKEY_CTRL_PKCS7_DECRYPT:
549 case EVP_PKEY_CTRL_PKCS7_SIGN:
551 #ifndef OPENSSL_NO_CMS
552 case EVP_PKEY_CTRL_CMS_DECRYPT:
553 case EVP_PKEY_CTRL_CMS_ENCRYPT:
554 case EVP_PKEY_CTRL_CMS_SIGN:
557 case EVP_PKEY_CTRL_PEER_KEY:
558 RSAerr(RSA_F_PKEY_RSA_CTRL,
559 RSA_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
568 static int pkey_rsa_ctrl_str(EVP_PKEY_CTX *ctx,
569 const char *type, const char *value)
572 RSAerr(RSA_F_PKEY_RSA_CTRL_STR, RSA_R_VALUE_MISSING);
575 if (strcmp(type, "rsa_padding_mode") == 0) {
577 if (strcmp(value, "pkcs1") == 0)
578 pm = RSA_PKCS1_PADDING;
579 else if (strcmp(value, "sslv23") == 0)
580 pm = RSA_SSLV23_PADDING;
581 else if (strcmp(value, "none") == 0)
583 else if (strcmp(value, "oeap") == 0)
584 pm = RSA_PKCS1_OAEP_PADDING;
585 else if (strcmp(value, "oaep") == 0)
586 pm = RSA_PKCS1_OAEP_PADDING;
587 else if (strcmp(value, "x931") == 0)
588 pm = RSA_X931_PADDING;
589 else if (strcmp(value, "pss") == 0)
590 pm = RSA_PKCS1_PSS_PADDING;
592 RSAerr(RSA_F_PKEY_RSA_CTRL_STR, RSA_R_UNKNOWN_PADDING_TYPE);
595 return EVP_PKEY_CTX_set_rsa_padding(ctx, pm);
598 if (strcmp(type, "rsa_pss_saltlen") == 0) {
600 saltlen = atoi(value);
601 return EVP_PKEY_CTX_set_rsa_pss_saltlen(ctx, saltlen);
604 if (strcmp(type, "rsa_keygen_bits") == 0) {
607 return EVP_PKEY_CTX_set_rsa_keygen_bits(ctx, nbits);
610 if (strcmp(type, "rsa_keygen_pubexp") == 0) {
612 BIGNUM *pubexp = NULL;
613 if (!BN_asc2bn(&pubexp, value))
615 ret = EVP_PKEY_CTX_set_rsa_keygen_pubexp(ctx, pubexp);
621 if (strcmp(type, "rsa_mgf1_md") == 0) {
623 if ((md = EVP_get_digestbyname(value)) == NULL) {
624 RSAerr(RSA_F_PKEY_RSA_CTRL_STR, RSA_R_INVALID_DIGEST);
627 return EVP_PKEY_CTX_set_rsa_mgf1_md(ctx, md);
630 if (strcmp(type, "rsa_oaep_md") == 0) {
632 if ((md = EVP_get_digestbyname(value)) == NULL) {
633 RSAerr(RSA_F_PKEY_RSA_CTRL_STR, RSA_R_INVALID_DIGEST);
636 return EVP_PKEY_CTX_set_rsa_oaep_md(ctx, md);
638 if (strcmp(type, "rsa_oaep_label") == 0) {
642 lab = string_to_hex(value, &lablen);
645 ret = EVP_PKEY_CTX_set0_rsa_oaep_label(ctx, lab, lablen);
654 static int pkey_rsa_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)
657 RSA_PKEY_CTX *rctx = ctx->data;
660 if (rctx->pub_exp == NULL) {
661 rctx->pub_exp = BN_new();
662 if (rctx->pub_exp == NULL || !BN_set_word(rctx->pub_exp, RSA_F4))
668 if (ctx->pkey_gencb) {
669 pcb = BN_GENCB_new();
674 evp_pkey_set_cb_translate(pcb, ctx);
677 ret = RSA_generate_key_ex(rsa, rctx->nbits, rctx->pub_exp, pcb);
680 EVP_PKEY_assign_RSA(pkey, rsa);
686 const EVP_PKEY_METHOD rsa_pkey_meth = {
688 EVP_PKEY_FLAG_AUTOARGLEN,
705 pkey_rsa_verifyrecover,