1 /*
2 * Copyright 2006-2025 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10 /*
11 * RSA low level APIs are deprecated for public use, but still ok for
12 * internal use.
13 */
14 #include "internal/deprecated.h"
15
16 #include "internal/constant_time.h"
17
18 #include <stdio.h>
19 #include "internal/cryptlib.h"
20 #include <openssl/asn1t.h>
21 #include <openssl/x509.h>
22 #include <openssl/rsa.h>
23 #include <openssl/bn.h>
24 #include <openssl/evp.h>
25 #include <openssl/x509v3.h>
26 #include <openssl/cms.h>
27 #include "crypto/evp.h"
28 #include "crypto/rsa.h"
29 #include "rsa_local.h"
30
31 /* RSA pkey context structure */
32
33 typedef struct {
34 /* Key gen parameters */
35 int nbits;
36 BIGNUM *pub_exp;
37 int primes;
38 /* Keygen callback info */
39 int gentmp[2];
40 /* RSA padding mode */
41 int pad_mode;
42 /* message digest */
43 const EVP_MD *md;
44 /* message digest for MGF1 */
45 const EVP_MD *mgf1md;
46 /* PSS salt length */
47 int saltlen;
48 /* Minimum salt length or -1 if no PSS parameter restriction */
49 int min_saltlen;
50 /* Temp buffer */
51 unsigned char *tbuf;
52 /* OAEP label */
53 unsigned char *oaep_label;
54 size_t oaep_labellen;
55 /* if to use implicit rejection in PKCS#1 v1.5 decryption */
56 int implicit_rejection;
57 } RSA_PKEY_CTX;
58
59 /* True if PSS parameters are restricted */
60 #define rsa_pss_restricted(rctx) (rctx->min_saltlen != -1)
61
pkey_rsa_init(EVP_PKEY_CTX * ctx)62 static int pkey_rsa_init(EVP_PKEY_CTX *ctx)
63 {
64 RSA_PKEY_CTX *rctx = OPENSSL_zalloc(sizeof(*rctx));
65
66 if (rctx == NULL)
67 return 0;
68 rctx->nbits = 2048;
69 rctx->primes = RSA_DEFAULT_PRIME_NUM;
70 if (pkey_ctx_is_pss(ctx))
71 rctx->pad_mode = RSA_PKCS1_PSS_PADDING;
72 else
73 rctx->pad_mode = RSA_PKCS1_PADDING;
74 /* Maximum for sign, auto for verify */
75 rctx->saltlen = RSA_PSS_SALTLEN_AUTO;
76 rctx->min_saltlen = -1;
77 rctx->implicit_rejection = 1;
78 ctx->data = rctx;
79 ctx->keygen_info = rctx->gentmp;
80 ctx->keygen_info_count = 2;
81
82 return 1;
83 }
84
pkey_rsa_copy(EVP_PKEY_CTX * dst,const EVP_PKEY_CTX * src)85 static int pkey_rsa_copy(EVP_PKEY_CTX *dst, const EVP_PKEY_CTX *src)
86 {
87 RSA_PKEY_CTX *dctx, *sctx;
88
89 if (!pkey_rsa_init(dst))
90 return 0;
91 sctx = src->data;
92 dctx = dst->data;
93 dctx->nbits = sctx->nbits;
94 if (sctx->pub_exp) {
95 dctx->pub_exp = BN_dup(sctx->pub_exp);
96 if (!dctx->pub_exp)
97 return 0;
98 }
99 dctx->pad_mode = sctx->pad_mode;
100 dctx->md = sctx->md;
101 dctx->mgf1md = sctx->mgf1md;
102 dctx->saltlen = sctx->saltlen;
103 dctx->implicit_rejection = sctx->implicit_rejection;
104 if (sctx->oaep_label) {
105 OPENSSL_free(dctx->oaep_label);
106 dctx->oaep_label = OPENSSL_memdup(sctx->oaep_label, sctx->oaep_labellen);
107 if (!dctx->oaep_label)
108 return 0;
109 dctx->oaep_labellen = sctx->oaep_labellen;
110 }
111 return 1;
112 }
113
setup_tbuf(RSA_PKEY_CTX * ctx,EVP_PKEY_CTX * pk)114 static int setup_tbuf(RSA_PKEY_CTX *ctx, EVP_PKEY_CTX *pk)
115 {
116 if (ctx->tbuf != NULL)
117 return 1;
118 if ((ctx->tbuf = OPENSSL_malloc(RSA_size(EVP_PKEY_get0_RSA(pk->pkey)))) == NULL)
119 return 0;
120 return 1;
121 }
122
pkey_rsa_cleanup(EVP_PKEY_CTX * ctx)123 static void pkey_rsa_cleanup(EVP_PKEY_CTX *ctx)
124 {
125 RSA_PKEY_CTX *rctx = ctx->data;
126 if (rctx) {
127 BN_free(rctx->pub_exp);
128 OPENSSL_free(rctx->tbuf);
129 OPENSSL_free(rctx->oaep_label);
130 OPENSSL_free(rctx);
131 }
132 }
133
pkey_rsa_sign(EVP_PKEY_CTX * ctx,unsigned char * sig,size_t * siglen,const unsigned char * tbs,size_t tbslen)134 static int pkey_rsa_sign(EVP_PKEY_CTX *ctx, unsigned char *sig,
135 size_t *siglen, const unsigned char *tbs,
136 size_t tbslen)
137 {
138 int ret;
139 RSA_PKEY_CTX *rctx = ctx->data;
140 /*
141 * Discard const. Its marked as const because this may be a cached copy of
142 * the "real" key. These calls don't make any modifications that need to
143 * be reflected back in the "original" key.
144 */
145 RSA *rsa = (RSA *)EVP_PKEY_get0_RSA(ctx->pkey);
146 int md_size;
147
148 if (rctx->md) {
149 md_size = EVP_MD_get_size(rctx->md);
150 if (md_size <= 0) {
151 ERR_raise(ERR_LIB_RSA, RSA_R_INVALID_DIGEST_LENGTH);
152 return -1;
153 }
154
155 if (tbslen != (size_t)md_size) {
156 ERR_raise(ERR_LIB_RSA, RSA_R_INVALID_DIGEST_LENGTH);
157 return -1;
158 }
159
160 if (EVP_MD_get_type(rctx->md) == NID_mdc2) {
161 unsigned int sltmp;
162 if (rctx->pad_mode != RSA_PKCS1_PADDING)
163 return -1;
164 ret = RSA_sign_ASN1_OCTET_STRING(0, tbs, tbslen, sig, &sltmp, rsa);
165
166 if (ret <= 0)
167 return ret;
168 ret = sltmp;
169 } else if (rctx->pad_mode == RSA_X931_PADDING) {
170 if ((size_t)RSA_size(rsa) < tbslen + 1) {
171 ERR_raise(ERR_LIB_RSA, RSA_R_KEY_SIZE_TOO_SMALL);
172 return -1;
173 }
174 if (!setup_tbuf(rctx, ctx)) {
175 ERR_raise(ERR_LIB_RSA, ERR_R_RSA_LIB);
176 return -1;
177 }
178 memcpy(rctx->tbuf, tbs, tbslen);
179 rctx->tbuf[tbslen] = RSA_X931_hash_id(EVP_MD_get_type(rctx->md));
180 ret = RSA_private_encrypt(tbslen + 1, rctx->tbuf,
181 sig, rsa, RSA_X931_PADDING);
182 } else if (rctx->pad_mode == RSA_PKCS1_PADDING) {
183 unsigned int sltmp;
184 ret = RSA_sign(EVP_MD_get_type(rctx->md),
185 tbs, tbslen, sig, &sltmp, rsa);
186 if (ret <= 0)
187 return ret;
188 ret = sltmp;
189 } else if (rctx->pad_mode == RSA_PKCS1_PSS_PADDING) {
190 if (!setup_tbuf(rctx, ctx))
191 return -1;
192 if (!RSA_padding_add_PKCS1_PSS_mgf1(rsa,
193 rctx->tbuf, tbs,
194 rctx->md, rctx->mgf1md,
195 rctx->saltlen))
196 return -1;
197 ret = RSA_private_encrypt(RSA_size(rsa), rctx->tbuf,
198 sig, rsa, RSA_NO_PADDING);
199 } else {
200 return -1;
201 }
202 } else {
203 ret = RSA_private_encrypt(tbslen, tbs, sig, rsa, rctx->pad_mode);
204 }
205 if (ret < 0)
206 return ret;
207 *siglen = ret;
208 return 1;
209 }
210
pkey_rsa_verifyrecover(EVP_PKEY_CTX * ctx,unsigned char * rout,size_t * routlen,const unsigned char * sig,size_t siglen)211 static int pkey_rsa_verifyrecover(EVP_PKEY_CTX *ctx,
212 unsigned char *rout, size_t *routlen,
213 const unsigned char *sig, size_t siglen)
214 {
215 int ret;
216 RSA_PKEY_CTX *rctx = ctx->data;
217 /*
218 * Discard const. Its marked as const because this may be a cached copy of
219 * the "real" key. These calls don't make any modifications that need to
220 * be reflected back in the "original" key.
221 */
222 RSA *rsa = (RSA *)EVP_PKEY_get0_RSA(ctx->pkey);
223
224 if (rctx->md) {
225 if (rctx->pad_mode == RSA_X931_PADDING) {
226 if (!setup_tbuf(rctx, ctx))
227 return -1;
228 ret = RSA_public_decrypt(siglen, sig, rctx->tbuf, rsa,
229 RSA_X931_PADDING);
230 if (ret <= 0)
231 return 0;
232 ret--;
233 if (rctx->tbuf[ret] != RSA_X931_hash_id(EVP_MD_get_type(rctx->md))) {
234 ERR_raise(ERR_LIB_RSA, RSA_R_ALGORITHM_MISMATCH);
235 return 0;
236 }
237 if (ret != EVP_MD_get_size(rctx->md)) {
238 ERR_raise(ERR_LIB_RSA, RSA_R_INVALID_DIGEST_LENGTH);
239 return 0;
240 }
241 if (rout)
242 memcpy(rout, rctx->tbuf, ret);
243 } else if (rctx->pad_mode == RSA_PKCS1_PADDING) {
244 size_t sltmp;
245 ret = ossl_rsa_verify(EVP_MD_get_type(rctx->md),
246 NULL, 0, rout, &sltmp,
247 sig, siglen, rsa);
248 if (ret <= 0)
249 return 0;
250 ret = sltmp;
251 } else {
252 return -1;
253 }
254 } else {
255 ret = RSA_public_decrypt(siglen, sig, rout, rsa, rctx->pad_mode);
256 }
257 if (ret <= 0)
258 return ret;
259 *routlen = ret;
260 return 1;
261 }
262
pkey_rsa_verify(EVP_PKEY_CTX * ctx,const unsigned char * sig,size_t siglen,const unsigned char * tbs,size_t tbslen)263 static int pkey_rsa_verify(EVP_PKEY_CTX *ctx,
264 const unsigned char *sig, size_t siglen,
265 const unsigned char *tbs, size_t tbslen)
266 {
267 RSA_PKEY_CTX *rctx = ctx->data;
268 /*
269 * Discard const. Its marked as const because this may be a cached copy of
270 * the "real" key. These calls don't make any modifications that need to
271 * be reflected back in the "original" key.
272 */
273 RSA *rsa = (RSA *)EVP_PKEY_get0_RSA(ctx->pkey);
274 size_t rslen;
275 int md_size;
276
277 if (rctx->md) {
278 if (rctx->pad_mode == RSA_PKCS1_PADDING)
279 return RSA_verify(EVP_MD_get_type(rctx->md), tbs, tbslen,
280 sig, siglen, rsa);
281 md_size = EVP_MD_get_size(rctx->md);
282 if (md_size <= 0) {
283 ERR_raise(ERR_LIB_RSA, RSA_R_INVALID_DIGEST_LENGTH);
284 return -1;
285 }
286 if (tbslen != (size_t)md_size) {
287 ERR_raise(ERR_LIB_RSA, RSA_R_INVALID_DIGEST_LENGTH);
288 return -1;
289 }
290 if (rctx->pad_mode == RSA_X931_PADDING) {
291 if (pkey_rsa_verifyrecover(ctx, NULL, &rslen, sig, siglen) <= 0)
292 return 0;
293 } else if (rctx->pad_mode == RSA_PKCS1_PSS_PADDING) {
294 int ret;
295 if (!setup_tbuf(rctx, ctx))
296 return -1;
297 ret = RSA_public_decrypt(siglen, sig, rctx->tbuf,
298 rsa, RSA_NO_PADDING);
299 if (ret <= 0)
300 return 0;
301 ret = RSA_verify_PKCS1_PSS_mgf1(rsa, tbs,
302 rctx->md, rctx->mgf1md,
303 rctx->tbuf, rctx->saltlen);
304 if (ret <= 0)
305 return 0;
306 return 1;
307 } else {
308 return -1;
309 }
310 } else {
311 if (!setup_tbuf(rctx, ctx))
312 return -1;
313 rslen = RSA_public_decrypt(siglen, sig, rctx->tbuf,
314 rsa, rctx->pad_mode);
315 if (rslen <= 0)
316 return 0;
317 }
318
319 if ((rslen != tbslen) || memcmp(tbs, rctx->tbuf, rslen))
320 return 0;
321
322 return 1;
323 }
324
pkey_rsa_encrypt(EVP_PKEY_CTX * ctx,unsigned char * out,size_t * outlen,const unsigned char * in,size_t inlen)325 static int pkey_rsa_encrypt(EVP_PKEY_CTX *ctx,
326 unsigned char *out, size_t *outlen,
327 const unsigned char *in, size_t inlen)
328 {
329 int ret;
330 RSA_PKEY_CTX *rctx = ctx->data;
331 /*
332 * Discard const. Its marked as const because this may be a cached copy of
333 * the "real" key. These calls don't make any modifications that need to
334 * be reflected back in the "original" key.
335 */
336 RSA *rsa = (RSA *)EVP_PKEY_get0_RSA(ctx->pkey);
337
338 if (rctx->pad_mode == RSA_PKCS1_OAEP_PADDING) {
339 int klen = RSA_size(rsa);
340 if (!setup_tbuf(rctx, ctx))
341 return -1;
342 if (!RSA_padding_add_PKCS1_OAEP_mgf1(rctx->tbuf, klen,
343 in, inlen,
344 rctx->oaep_label,
345 rctx->oaep_labellen,
346 rctx->md, rctx->mgf1md))
347 return -1;
348 ret = RSA_public_encrypt(klen, rctx->tbuf, out, rsa, RSA_NO_PADDING);
349 } else {
350 ret = RSA_public_encrypt(inlen, in, out, rsa, rctx->pad_mode);
351 }
352 if (ret < 0)
353 return ret;
354 *outlen = ret;
355 return 1;
356 }
357
pkey_rsa_decrypt(EVP_PKEY_CTX * ctx,unsigned char * out,size_t * outlen,const unsigned char * in,size_t inlen)358 static int pkey_rsa_decrypt(EVP_PKEY_CTX *ctx,
359 unsigned char *out, size_t *outlen,
360 const unsigned char *in, size_t inlen)
361 {
362 int ret;
363 int pad_mode;
364 RSA_PKEY_CTX *rctx = ctx->data;
365 /*
366 * Discard const. Its marked as const because this may be a cached copy of
367 * the "real" key. These calls don't make any modifications that need to
368 * be reflected back in the "original" key.
369 */
370 RSA *rsa = (RSA *)EVP_PKEY_get0_RSA(ctx->pkey);
371
372 if (rctx->pad_mode == RSA_PKCS1_OAEP_PADDING) {
373 if (!setup_tbuf(rctx, ctx))
374 return -1;
375 ret = RSA_private_decrypt(inlen, in, rctx->tbuf, rsa, RSA_NO_PADDING);
376 if (ret <= 0)
377 return ret;
378 ret = RSA_padding_check_PKCS1_OAEP_mgf1(out, ret, rctx->tbuf,
379 ret, ret,
380 rctx->oaep_label,
381 rctx->oaep_labellen,
382 rctx->md, rctx->mgf1md);
383 } else {
384 if (rctx->pad_mode == RSA_PKCS1_PADDING && rctx->implicit_rejection == 0)
385 pad_mode = RSA_PKCS1_NO_IMPLICIT_REJECT_PADDING;
386 else
387 pad_mode = rctx->pad_mode;
388 ret = RSA_private_decrypt(inlen, in, out, rsa, pad_mode);
389 }
390 *outlen = constant_time_select_s(constant_time_msb_s(ret), *outlen, ret);
391 ret = constant_time_select_int(constant_time_msb(ret), ret, 1);
392 return ret;
393 }
394
check_padding_md(const EVP_MD * md,int padding)395 static int check_padding_md(const EVP_MD *md, int padding)
396 {
397 int mdnid;
398
399 if (!md)
400 return 1;
401
402 mdnid = EVP_MD_get_type(md);
403
404 if (padding == RSA_NO_PADDING) {
405 ERR_raise(ERR_LIB_RSA, RSA_R_INVALID_PADDING_MODE);
406 return 0;
407 }
408
409 if (padding == RSA_X931_PADDING) {
410 if (RSA_X931_hash_id(mdnid) == -1) {
411 ERR_raise(ERR_LIB_RSA, RSA_R_INVALID_X931_DIGEST);
412 return 0;
413 }
414 } else {
415 switch (mdnid) {
416 /* List of all supported RSA digests */
417 case NID_sha1:
418 case NID_sha224:
419 case NID_sha256:
420 case NID_sha384:
421 case NID_sha512:
422 case NID_sha512_224:
423 case NID_sha512_256:
424 case NID_md5:
425 case NID_md5_sha1:
426 case NID_md2:
427 case NID_md4:
428 case NID_mdc2:
429 case NID_ripemd160:
430 case NID_sha3_224:
431 case NID_sha3_256:
432 case NID_sha3_384:
433 case NID_sha3_512:
434 return 1;
435
436 default:
437 ERR_raise(ERR_LIB_RSA, RSA_R_INVALID_DIGEST);
438 return 0;
439 }
440 }
441
442 return 1;
443 }
444
pkey_rsa_ctrl(EVP_PKEY_CTX * ctx,int type,int p1,void * p2)445 static int pkey_rsa_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2)
446 {
447 RSA_PKEY_CTX *rctx = ctx->data;
448 int md_size;
449
450 switch (type) {
451 case EVP_PKEY_CTRL_RSA_PADDING:
452 if ((p1 >= RSA_PKCS1_PADDING) && (p1 <= RSA_PKCS1_PSS_PADDING)) {
453 if (!check_padding_md(rctx->md, p1))
454 return 0;
455 if (p1 == RSA_PKCS1_PSS_PADDING) {
456 if (!(ctx->operation & (EVP_PKEY_OP_SIGN | EVP_PKEY_OP_VERIFY)))
457 goto bad_pad;
458 if (!rctx->md)
459 rctx->md = EVP_sha1();
460 } else if (pkey_ctx_is_pss(ctx)) {
461 goto bad_pad;
462 }
463 if (p1 == RSA_PKCS1_OAEP_PADDING) {
464 if (!(ctx->operation & EVP_PKEY_OP_TYPE_CRYPT))
465 goto bad_pad;
466 if (!rctx->md)
467 rctx->md = EVP_sha1();
468 }
469 rctx->pad_mode = p1;
470 return 1;
471 }
472 bad_pad:
473 ERR_raise(ERR_LIB_RSA, RSA_R_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE);
474 return -2;
475
476 case EVP_PKEY_CTRL_GET_RSA_PADDING:
477 *(int *)p2 = rctx->pad_mode;
478 return 1;
479
480 case EVP_PKEY_CTRL_RSA_PSS_SALTLEN:
481 case EVP_PKEY_CTRL_GET_RSA_PSS_SALTLEN:
482 if (rctx->pad_mode != RSA_PKCS1_PSS_PADDING) {
483 ERR_raise(ERR_LIB_RSA, RSA_R_INVALID_PSS_SALTLEN);
484 return -2;
485 }
486 if (type == EVP_PKEY_CTRL_GET_RSA_PSS_SALTLEN) {
487 *(int *)p2 = rctx->saltlen;
488 } else {
489 if (p1 < RSA_PSS_SALTLEN_MAX)
490 return -2;
491 if (rsa_pss_restricted(rctx)) {
492 if (p1 == RSA_PSS_SALTLEN_AUTO
493 && ctx->operation == EVP_PKEY_OP_VERIFY) {
494 ERR_raise(ERR_LIB_RSA, RSA_R_INVALID_PSS_SALTLEN);
495 return -2;
496 }
497 md_size = EVP_MD_get_size(rctx->md);
498 if (md_size <= 0) {
499 ERR_raise(ERR_LIB_RSA, RSA_R_INVALID_DIGEST_LENGTH);
500 return -2;
501 }
502 if ((p1 == RSA_PSS_SALTLEN_DIGEST
503 && rctx->min_saltlen > md_size)
504 || (p1 >= 0 && p1 < rctx->min_saltlen)) {
505 ERR_raise(ERR_LIB_RSA, RSA_R_PSS_SALTLEN_TOO_SMALL);
506 return 0;
507 }
508 }
509 rctx->saltlen = p1;
510 }
511 return 1;
512
513 case EVP_PKEY_CTRL_RSA_KEYGEN_BITS:
514 if (p1 < RSA_MIN_MODULUS_BITS) {
515 ERR_raise(ERR_LIB_RSA, RSA_R_KEY_SIZE_TOO_SMALL);
516 return -2;
517 }
518 rctx->nbits = p1;
519 return 1;
520
521 case EVP_PKEY_CTRL_RSA_KEYGEN_PUBEXP:
522 if (p2 == NULL || !BN_is_odd((BIGNUM *)p2) || BN_is_one((BIGNUM *)p2)) {
523 ERR_raise(ERR_LIB_RSA, RSA_R_BAD_E_VALUE);
524 return -2;
525 }
526 BN_free(rctx->pub_exp);
527 rctx->pub_exp = p2;
528 return 1;
529
530 case EVP_PKEY_CTRL_RSA_KEYGEN_PRIMES:
531 if (p1 < RSA_DEFAULT_PRIME_NUM || p1 > RSA_MAX_PRIME_NUM) {
532 ERR_raise(ERR_LIB_RSA, RSA_R_KEY_PRIME_NUM_INVALID);
533 return -2;
534 }
535 rctx->primes = p1;
536 return 1;
537
538 case EVP_PKEY_CTRL_RSA_OAEP_MD:
539 case EVP_PKEY_CTRL_GET_RSA_OAEP_MD:
540 if (rctx->pad_mode != RSA_PKCS1_OAEP_PADDING) {
541 ERR_raise(ERR_LIB_RSA, RSA_R_INVALID_PADDING_MODE);
542 return -2;
543 }
544 if (type == EVP_PKEY_CTRL_GET_RSA_OAEP_MD)
545 *(const EVP_MD **)p2 = rctx->md;
546 else
547 rctx->md = p2;
548 return 1;
549
550 case EVP_PKEY_CTRL_MD:
551 if (!check_padding_md(p2, rctx->pad_mode))
552 return 0;
553 if (rsa_pss_restricted(rctx)) {
554 if (EVP_MD_get_type(rctx->md) == EVP_MD_get_type(p2))
555 return 1;
556 ERR_raise(ERR_LIB_RSA, RSA_R_DIGEST_NOT_ALLOWED);
557 return 0;
558 }
559 rctx->md = p2;
560 return 1;
561
562 case EVP_PKEY_CTRL_GET_MD:
563 *(const EVP_MD **)p2 = rctx->md;
564 return 1;
565
566 case EVP_PKEY_CTRL_RSA_MGF1_MD:
567 case EVP_PKEY_CTRL_GET_RSA_MGF1_MD:
568 if (rctx->pad_mode != RSA_PKCS1_PSS_PADDING
569 && rctx->pad_mode != RSA_PKCS1_OAEP_PADDING) {
570 ERR_raise(ERR_LIB_RSA, RSA_R_INVALID_MGF1_MD);
571 return -2;
572 }
573 if (type == EVP_PKEY_CTRL_GET_RSA_MGF1_MD) {
574 if (rctx->mgf1md)
575 *(const EVP_MD **)p2 = rctx->mgf1md;
576 else
577 *(const EVP_MD **)p2 = rctx->md;
578 } else {
579 if (rsa_pss_restricted(rctx)) {
580 if (EVP_MD_get_type(rctx->mgf1md) == EVP_MD_get_type(p2))
581 return 1;
582 ERR_raise(ERR_LIB_RSA, RSA_R_MGF1_DIGEST_NOT_ALLOWED);
583 return 0;
584 }
585 rctx->mgf1md = p2;
586 }
587 return 1;
588
589 case EVP_PKEY_CTRL_RSA_OAEP_LABEL:
590 if (rctx->pad_mode != RSA_PKCS1_OAEP_PADDING) {
591 ERR_raise(ERR_LIB_RSA, RSA_R_INVALID_PADDING_MODE);
592 return -2;
593 }
594 OPENSSL_free(rctx->oaep_label);
595 if (p2 && p1 > 0) {
596 rctx->oaep_label = p2;
597 rctx->oaep_labellen = p1;
598 } else {
599 rctx->oaep_label = NULL;
600 rctx->oaep_labellen = 0;
601 }
602 return 1;
603
604 case EVP_PKEY_CTRL_GET_RSA_OAEP_LABEL:
605 if (rctx->pad_mode != RSA_PKCS1_OAEP_PADDING) {
606 ERR_raise(ERR_LIB_RSA, RSA_R_INVALID_PADDING_MODE);
607 return -2;
608 }
609 if (p2 == NULL) {
610 ERR_raise(ERR_LIB_EVP, ERR_R_PASSED_NULL_PARAMETER);
611 return 0;
612 }
613 *(unsigned char **)p2 = rctx->oaep_label;
614 return rctx->oaep_labellen;
615
616 case EVP_PKEY_CTRL_RSA_IMPLICIT_REJECTION:
617 if (rctx->pad_mode != RSA_PKCS1_PADDING) {
618 ERR_raise(ERR_LIB_RSA, RSA_R_INVALID_PADDING_MODE);
619 return -2;
620 }
621 rctx->implicit_rejection = p1;
622 return 1;
623
624 case EVP_PKEY_CTRL_DIGESTINIT:
625 case EVP_PKEY_CTRL_PKCS7_SIGN:
626 #ifndef OPENSSL_NO_CMS
627 case EVP_PKEY_CTRL_CMS_SIGN:
628 #endif
629 return 1;
630
631 case EVP_PKEY_CTRL_PKCS7_ENCRYPT:
632 case EVP_PKEY_CTRL_PKCS7_DECRYPT:
633 #ifndef OPENSSL_NO_CMS
634 case EVP_PKEY_CTRL_CMS_DECRYPT:
635 case EVP_PKEY_CTRL_CMS_ENCRYPT:
636 #endif
637 if (!pkey_ctx_is_pss(ctx))
638 return 1;
639 /* fall through */
640 case EVP_PKEY_CTRL_PEER_KEY:
641 ERR_raise(ERR_LIB_RSA, RSA_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
642 return -2;
643
644 default:
645 return -2;
646 }
647 }
648
pkey_rsa_ctrl_str(EVP_PKEY_CTX * ctx,const char * type,const char * value)649 static int pkey_rsa_ctrl_str(EVP_PKEY_CTX *ctx,
650 const char *type, const char *value)
651 {
652 if (value == NULL) {
653 ERR_raise(ERR_LIB_RSA, RSA_R_VALUE_MISSING);
654 return 0;
655 }
656 if (strcmp(type, "rsa_padding_mode") == 0) {
657 int pm;
658
659 if (strcmp(value, "pkcs1") == 0) {
660 pm = RSA_PKCS1_PADDING;
661 } else if (strcmp(value, "none") == 0) {
662 pm = RSA_NO_PADDING;
663 } else if (strcmp(value, "oeap") == 0) {
664 pm = RSA_PKCS1_OAEP_PADDING;
665 } else if (strcmp(value, "oaep") == 0) {
666 pm = RSA_PKCS1_OAEP_PADDING;
667 } else if (strcmp(value, "x931") == 0) {
668 pm = RSA_X931_PADDING;
669 } else if (strcmp(value, "pss") == 0) {
670 pm = RSA_PKCS1_PSS_PADDING;
671 } else {
672 ERR_raise(ERR_LIB_RSA, RSA_R_UNKNOWN_PADDING_TYPE);
673 return -2;
674 }
675 return EVP_PKEY_CTX_set_rsa_padding(ctx, pm);
676 }
677
678 if (strcmp(type, "rsa_pss_saltlen") == 0) {
679 int saltlen;
680
681 if (!strcmp(value, "digest"))
682 saltlen = RSA_PSS_SALTLEN_DIGEST;
683 else if (!strcmp(value, "max"))
684 saltlen = RSA_PSS_SALTLEN_MAX;
685 else if (!strcmp(value, "auto"))
686 saltlen = RSA_PSS_SALTLEN_AUTO;
687 else
688 saltlen = atoi(value);
689 return EVP_PKEY_CTX_set_rsa_pss_saltlen(ctx, saltlen);
690 }
691
692 if (strcmp(type, "rsa_keygen_bits") == 0) {
693 int nbits = atoi(value);
694
695 return EVP_PKEY_CTX_set_rsa_keygen_bits(ctx, nbits);
696 }
697
698 if (strcmp(type, "rsa_keygen_pubexp") == 0) {
699 int ret;
700
701 BIGNUM *pubexp = NULL;
702 if (!BN_asc2bn(&pubexp, value))
703 return 0;
704 ret = EVP_PKEY_CTX_set1_rsa_keygen_pubexp(ctx, pubexp);
705 BN_free(pubexp);
706 return ret;
707 }
708
709 if (strcmp(type, "rsa_keygen_primes") == 0) {
710 int nprimes = atoi(value);
711
712 return EVP_PKEY_CTX_set_rsa_keygen_primes(ctx, nprimes);
713 }
714
715 if (strcmp(type, "rsa_mgf1_md") == 0)
716 return EVP_PKEY_CTX_md(ctx,
717 EVP_PKEY_OP_TYPE_SIG | EVP_PKEY_OP_TYPE_CRYPT,
718 EVP_PKEY_CTRL_RSA_MGF1_MD, value);
719
720 if (pkey_ctx_is_pss(ctx)) {
721
722 if (strcmp(type, "rsa_pss_keygen_mgf1_md") == 0)
723 return EVP_PKEY_CTX_md(ctx, EVP_PKEY_OP_KEYGEN,
724 EVP_PKEY_CTRL_RSA_MGF1_MD, value);
725
726 if (strcmp(type, "rsa_pss_keygen_md") == 0)
727 return EVP_PKEY_CTX_md(ctx, EVP_PKEY_OP_KEYGEN,
728 EVP_PKEY_CTRL_MD, value);
729
730 if (strcmp(type, "rsa_pss_keygen_saltlen") == 0) {
731 int saltlen = atoi(value);
732
733 return EVP_PKEY_CTX_set_rsa_pss_keygen_saltlen(ctx, saltlen);
734 }
735 }
736
737 if (strcmp(type, "rsa_oaep_md") == 0)
738 return EVP_PKEY_CTX_md(ctx, EVP_PKEY_OP_TYPE_CRYPT,
739 EVP_PKEY_CTRL_RSA_OAEP_MD, value);
740
741 if (strcmp(type, "rsa_oaep_label") == 0) {
742 unsigned char *lab;
743 long lablen;
744 int ret;
745
746 lab = OPENSSL_hexstr2buf(value, &lablen);
747 if (!lab)
748 return 0;
749 ret = EVP_PKEY_CTX_set0_rsa_oaep_label(ctx, lab, lablen);
750 if (ret <= 0)
751 OPENSSL_free(lab);
752 return ret;
753 }
754
755 return -2;
756 }
757
758 /* Set PSS parameters when generating a key, if necessary */
rsa_set_pss_param(RSA * rsa,EVP_PKEY_CTX * ctx)759 static int rsa_set_pss_param(RSA *rsa, EVP_PKEY_CTX *ctx)
760 {
761 RSA_PKEY_CTX *rctx = ctx->data;
762
763 if (!pkey_ctx_is_pss(ctx))
764 return 1;
765 /* If all parameters are default values don't set pss */
766 if (rctx->md == NULL && rctx->mgf1md == NULL && rctx->saltlen == -2)
767 return 1;
768 rsa->pss = ossl_rsa_pss_params_create(rctx->md, rctx->mgf1md,
769 rctx->saltlen == -2
770 ? 0
771 : rctx->saltlen);
772 if (rsa->pss == NULL)
773 return 0;
774 return 1;
775 }
776
pkey_rsa_keygen(EVP_PKEY_CTX * ctx,EVP_PKEY * pkey)777 static int pkey_rsa_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)
778 {
779 RSA *rsa = NULL;
780 RSA_PKEY_CTX *rctx = ctx->data;
781 BN_GENCB *pcb;
782 int ret;
783
784 if (rctx->pub_exp == NULL) {
785 rctx->pub_exp = BN_new();
786 if (rctx->pub_exp == NULL || !BN_set_word(rctx->pub_exp, RSA_F4))
787 return 0;
788 }
789 rsa = RSA_new();
790 if (rsa == NULL)
791 return 0;
792 if (ctx->pkey_gencb) {
793 pcb = BN_GENCB_new();
794 if (pcb == NULL) {
795 RSA_free(rsa);
796 return 0;
797 }
798 evp_pkey_set_cb_translate(pcb, ctx);
799 } else {
800 pcb = NULL;
801 }
802 ret = RSA_generate_multi_prime_key(rsa, rctx->nbits, rctx->primes,
803 rctx->pub_exp, pcb);
804 BN_GENCB_free(pcb);
805 if (ret > 0 && !rsa_set_pss_param(rsa, ctx)) {
806 RSA_free(rsa);
807 return 0;
808 }
809 if (ret > 0)
810 EVP_PKEY_assign(pkey, ctx->pmeth->pkey_id, rsa);
811 else
812 RSA_free(rsa);
813 return ret;
814 }
815
816 static const EVP_PKEY_METHOD rsa_pkey_meth = {
817 EVP_PKEY_RSA,
818 EVP_PKEY_FLAG_AUTOARGLEN,
819 pkey_rsa_init,
820 pkey_rsa_copy,
821 pkey_rsa_cleanup,
822
823 0, 0,
824
825 0,
826 pkey_rsa_keygen,
827
828 0,
829 pkey_rsa_sign,
830
831 0,
832 pkey_rsa_verify,
833
834 0,
835 pkey_rsa_verifyrecover,
836
837 0, 0, 0, 0,
838
839 0,
840 pkey_rsa_encrypt,
841
842 0,
843 pkey_rsa_decrypt,
844
845 0, 0,
846
847 pkey_rsa_ctrl,
848 pkey_rsa_ctrl_str
849 };
850
ossl_rsa_pkey_method(void)851 const EVP_PKEY_METHOD *ossl_rsa_pkey_method(void)
852 {
853 return &rsa_pkey_meth;
854 }
855
856 /*
857 * Called for PSS sign or verify initialisation: checks PSS parameter
858 * sanity and sets any restrictions on key usage.
859 */
860
pkey_pss_init(EVP_PKEY_CTX * ctx)861 static int pkey_pss_init(EVP_PKEY_CTX *ctx)
862 {
863 const RSA *rsa;
864 RSA_PKEY_CTX *rctx = ctx->data;
865 const EVP_MD *md;
866 const EVP_MD *mgf1md;
867 int min_saltlen, max_saltlen, md_size;
868
869 /* Should never happen */
870 if (!pkey_ctx_is_pss(ctx))
871 return 0;
872 rsa = EVP_PKEY_get0_RSA(ctx->pkey);
873 /* If no restrictions just return */
874 if (rsa->pss == NULL)
875 return 1;
876 /* Get and check parameters */
877 if (!ossl_rsa_pss_get_param(rsa->pss, &md, &mgf1md, &min_saltlen))
878 return 0;
879
880 /* See if minimum salt length exceeds maximum possible */
881 md_size = EVP_MD_get_size(md);
882 if (md_size <= 0) {
883 ERR_raise(ERR_LIB_RSA, RSA_R_INVALID_DIGEST_LENGTH);
884 return 0;
885 }
886 max_saltlen = RSA_size(rsa) - md_size;
887 if ((RSA_bits(rsa) & 0x7) == 1)
888 max_saltlen--;
889 if (min_saltlen > max_saltlen) {
890 ERR_raise(ERR_LIB_RSA, RSA_R_INVALID_SALT_LENGTH);
891 return 0;
892 }
893
894 rctx->min_saltlen = min_saltlen;
895
896 /*
897 * Set PSS restrictions as defaults: we can then block any attempt to
898 * use invalid values in pkey_rsa_ctrl
899 */
900
901 rctx->md = md;
902 rctx->mgf1md = mgf1md;
903 rctx->saltlen = min_saltlen;
904
905 return 1;
906 }
907
908 static const EVP_PKEY_METHOD rsa_pss_pkey_meth = {
909 EVP_PKEY_RSA_PSS,
910 EVP_PKEY_FLAG_AUTOARGLEN,
911 pkey_rsa_init,
912 pkey_rsa_copy,
913 pkey_rsa_cleanup,
914
915 0, 0,
916
917 0,
918 pkey_rsa_keygen,
919
920 pkey_pss_init,
921 pkey_rsa_sign,
922
923 pkey_pss_init,
924 pkey_rsa_verify,
925
926 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
927
928 pkey_rsa_ctrl,
929 pkey_rsa_ctrl_str
930 };
931
ossl_rsa_pss_pkey_method(void)932 const EVP_PKEY_METHOD *ossl_rsa_pss_pkey_method(void)
933 {
934 return &rsa_pss_pkey_meth;
935 }
936