1b077aed3SPierre Pronchery /*
2*e7be843bSPierre Pronchery * Copyright 2020-2024 The OpenSSL Project Authors. All Rights Reserved.
3b077aed3SPierre Pronchery *
4b077aed3SPierre Pronchery * Licensed under the Apache License 2.0 (the "License"). You may not use
5b077aed3SPierre Pronchery * this file except in compliance with the License. You can obtain a copy
6b077aed3SPierre Pronchery * in the file LICENSE in the source distribution or at
7b077aed3SPierre Pronchery * https://www.openssl.org/source/license.html
8b077aed3SPierre Pronchery */
9b077aed3SPierre Pronchery
10b077aed3SPierre Pronchery #include "internal/deprecated.h"
11b077aed3SPierre Pronchery
12b077aed3SPierre Pronchery #include <openssl/rsa.h>
13b077aed3SPierre Pronchery #include <openssl/dsa.h>
14b077aed3SPierre Pronchery #include <openssl/dh.h>
15b077aed3SPierre Pronchery #include <openssl/ec.h>
16b077aed3SPierre Pronchery #include <openssl/evp.h>
17b077aed3SPierre Pronchery #include <openssl/err.h>
18b077aed3SPierre Pronchery #include <openssl/proverr.h>
19b077aed3SPierre Pronchery #include <openssl/core_names.h>
20b077aed3SPierre Pronchery #include <openssl/obj_mac.h>
21b077aed3SPierre Pronchery #include "prov/securitycheck.h"
22b077aed3SPierre Pronchery
23*e7be843bSPierre Pronchery #define OSSL_FIPS_MIN_SECURITY_STRENGTH_BITS 112
24*e7be843bSPierre Pronchery
ossl_rsa_key_op_get_protect(const RSA * rsa,int operation,int * outprotect)25*e7be843bSPierre Pronchery int ossl_rsa_key_op_get_protect(const RSA *rsa, int operation, int *outprotect)
26b077aed3SPierre Pronchery {
27b077aed3SPierre Pronchery int protect = 0;
28b077aed3SPierre Pronchery
29b077aed3SPierre Pronchery switch (operation) {
30b077aed3SPierre Pronchery case EVP_PKEY_OP_SIGN:
31*e7be843bSPierre Pronchery case EVP_PKEY_OP_SIGNMSG:
32b077aed3SPierre Pronchery protect = 1;
33b077aed3SPierre Pronchery /* fallthrough */
34b077aed3SPierre Pronchery case EVP_PKEY_OP_VERIFY:
35*e7be843bSPierre Pronchery case EVP_PKEY_OP_VERIFYMSG:
36b077aed3SPierre Pronchery break;
37b077aed3SPierre Pronchery case EVP_PKEY_OP_ENCAPSULATE:
38b077aed3SPierre Pronchery case EVP_PKEY_OP_ENCRYPT:
39b077aed3SPierre Pronchery protect = 1;
40b077aed3SPierre Pronchery /* fallthrough */
41b077aed3SPierre Pronchery case EVP_PKEY_OP_VERIFYRECOVER:
42b077aed3SPierre Pronchery case EVP_PKEY_OP_DECAPSULATE:
43b077aed3SPierre Pronchery case EVP_PKEY_OP_DECRYPT:
44b077aed3SPierre Pronchery if (RSA_test_flags(rsa,
45b077aed3SPierre Pronchery RSA_FLAG_TYPE_MASK) == RSA_FLAG_TYPE_RSASSAPSS) {
46b077aed3SPierre Pronchery ERR_raise_data(ERR_LIB_PROV,
47b077aed3SPierre Pronchery PROV_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE,
48b077aed3SPierre Pronchery "operation: %d", operation);
49b077aed3SPierre Pronchery return 0;
50b077aed3SPierre Pronchery }
51b077aed3SPierre Pronchery break;
52b077aed3SPierre Pronchery default:
53b077aed3SPierre Pronchery ERR_raise_data(ERR_LIB_PROV, ERR_R_INTERNAL_ERROR,
54b077aed3SPierre Pronchery "invalid operation: %d", operation);
55b077aed3SPierre Pronchery return 0;
56b077aed3SPierre Pronchery }
57*e7be843bSPierre Pronchery *outprotect = protect;
58b077aed3SPierre Pronchery return 1;
59b077aed3SPierre Pronchery }
60b077aed3SPierre Pronchery
61*e7be843bSPierre Pronchery /*
62*e7be843bSPierre Pronchery * FIPS requires a minimum security strength of 112 bits (for encryption or
63*e7be843bSPierre Pronchery * signing), and for legacy purposes 80 bits (for decryption or verifying).
64*e7be843bSPierre Pronchery * Set protect = 1 for encryption or signing operations, or 0 otherwise. See
65*e7be843bSPierre Pronchery * https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar2.pdf.
66*e7be843bSPierre Pronchery */
ossl_rsa_check_key_size(const RSA * rsa,int protect)67*e7be843bSPierre Pronchery int ossl_rsa_check_key_size(const RSA *rsa, int protect)
68*e7be843bSPierre Pronchery {
69*e7be843bSPierre Pronchery int sz = RSA_bits(rsa);
70*e7be843bSPierre Pronchery
71*e7be843bSPierre Pronchery if (protect ? (sz < 2048) : (sz < 1024))
72*e7be843bSPierre Pronchery return 0;
73*e7be843bSPierre Pronchery return 1;
74*e7be843bSPierre Pronchery }
75*e7be843bSPierre Pronchery
76*e7be843bSPierre Pronchery /*
77*e7be843bSPierre Pronchery * FIPS requires a minimum security strength of 112 bits for key-derivation key.
78*e7be843bSPierre Pronchery * https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar2.pdf.
79*e7be843bSPierre Pronchery */
ossl_kdf_check_key_size(size_t keylen)80*e7be843bSPierre Pronchery int ossl_kdf_check_key_size(size_t keylen)
81*e7be843bSPierre Pronchery {
82*e7be843bSPierre Pronchery return (keylen * 8) >= OSSL_FIPS_MIN_SECURITY_STRENGTH_BITS;
83*e7be843bSPierre Pronchery }
84*e7be843bSPierre Pronchery
ossl_mac_check_key_size(size_t keylen)85*e7be843bSPierre Pronchery int ossl_mac_check_key_size(size_t keylen)
86*e7be843bSPierre Pronchery {
87*e7be843bSPierre Pronchery return ossl_kdf_check_key_size(keylen);
88*e7be843bSPierre Pronchery }
89*e7be843bSPierre Pronchery
90b077aed3SPierre Pronchery #ifndef OPENSSL_NO_EC
91*e7be843bSPierre Pronchery
ossl_ec_check_curve_allowed(const EC_GROUP * group)92*e7be843bSPierre Pronchery int ossl_ec_check_curve_allowed(const EC_GROUP *group)
93*e7be843bSPierre Pronchery {
94*e7be843bSPierre Pronchery const char *curve_name;
95*e7be843bSPierre Pronchery int nid = EC_GROUP_get_curve_name(group);
96*e7be843bSPierre Pronchery
97*e7be843bSPierre Pronchery /* Explicit curves are not FIPS approved */
98*e7be843bSPierre Pronchery if (nid == NID_undef)
99*e7be843bSPierre Pronchery return 0;
100*e7be843bSPierre Pronchery /* Only NIST curves are FIPS approved */
101*e7be843bSPierre Pronchery curve_name = EC_curve_nid2nist(nid);
102*e7be843bSPierre Pronchery if (curve_name == NULL)
103*e7be843bSPierre Pronchery return 0;
104*e7be843bSPierre Pronchery return 1;
105*e7be843bSPierre Pronchery }
106*e7be843bSPierre Pronchery
107b077aed3SPierre Pronchery /*
108b077aed3SPierre Pronchery * In FIPS mode:
109b077aed3SPierre Pronchery * protect should be 1 for any operations that need 112 bits of security
110b077aed3SPierre Pronchery * strength (such as signing, and key exchange), or 0 for operations that allow
111b077aed3SPierre Pronchery * a lower security strength (such as verify).
112b077aed3SPierre Pronchery *
113b077aed3SPierre Pronchery * For ECDH key agreement refer to SP800-56A
114b077aed3SPierre Pronchery * https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Ar3.pdf
115b077aed3SPierre Pronchery * "Appendix D"
116b077aed3SPierre Pronchery *
117b077aed3SPierre Pronchery * For ECDSA signatures refer to
118b077aed3SPierre Pronchery * https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar2.pdf
119b077aed3SPierre Pronchery * "Table 2"
120b077aed3SPierre Pronchery */
ossl_ec_check_security_strength(const EC_GROUP * group,int protect)121*e7be843bSPierre Pronchery int ossl_ec_check_security_strength(const EC_GROUP *group, int protect)
122b077aed3SPierre Pronchery {
123b077aed3SPierre Pronchery /*
124b077aed3SPierre Pronchery * For EC the security strength is the (order_bits / 2)
125b077aed3SPierre Pronchery * e.g. P-224 is 112 bits.
126b077aed3SPierre Pronchery */
127*e7be843bSPierre Pronchery int strength = EC_GROUP_order_bits(group) / 2;
128b077aed3SPierre Pronchery /* The min security strength allowed for legacy verification is 80 bits */
129*e7be843bSPierre Pronchery if (strength < 80)
130b077aed3SPierre Pronchery return 0;
131b077aed3SPierre Pronchery /*
132b077aed3SPierre Pronchery * For signing or key agreement only allow curves with at least 112 bits of
133b077aed3SPierre Pronchery * security strength
134b077aed3SPierre Pronchery */
135*e7be843bSPierre Pronchery if (protect && strength < OSSL_FIPS_MIN_SECURITY_STRENGTH_BITS)
136b077aed3SPierre Pronchery return 0;
137b077aed3SPierre Pronchery return 1;
138b077aed3SPierre Pronchery }
139*e7be843bSPierre Pronchery
140b077aed3SPierre Pronchery #endif /* OPENSSL_NO_EC */
141b077aed3SPierre Pronchery
142b077aed3SPierre Pronchery #ifndef OPENSSL_NO_DSA
143b077aed3SPierre Pronchery /*
144b077aed3SPierre Pronchery * Check for valid key sizes if fips mode. Refer to
145b077aed3SPierre Pronchery * https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar2.pdf
146b077aed3SPierre Pronchery * "Table 2"
147b077aed3SPierre Pronchery */
ossl_dsa_check_key(const DSA * dsa,int sign)148*e7be843bSPierre Pronchery int ossl_dsa_check_key(const DSA *dsa, int sign)
149b077aed3SPierre Pronchery {
150b077aed3SPierre Pronchery size_t L, N;
151b077aed3SPierre Pronchery const BIGNUM *p, *q;
152b077aed3SPierre Pronchery
153b077aed3SPierre Pronchery if (dsa == NULL)
154b077aed3SPierre Pronchery return 0;
155b077aed3SPierre Pronchery
156b077aed3SPierre Pronchery p = DSA_get0_p(dsa);
157b077aed3SPierre Pronchery q = DSA_get0_q(dsa);
158b077aed3SPierre Pronchery if (p == NULL || q == NULL)
159b077aed3SPierre Pronchery return 0;
160b077aed3SPierre Pronchery
161b077aed3SPierre Pronchery L = BN_num_bits(p);
162b077aed3SPierre Pronchery N = BN_num_bits(q);
163b077aed3SPierre Pronchery
164b077aed3SPierre Pronchery /*
165b077aed3SPierre Pronchery * For Digital signature verification DSA keys with < 112 bits of
166aa795734SPierre Pronchery * security strength, are still allowed for legacy
167aa795734SPierre Pronchery * use. The bounds given in SP 800-131Ar2 - Table 2 are
168aa795734SPierre Pronchery * (512 <= L < 2048 or 160 <= N < 224).
169aa795734SPierre Pronchery *
170aa795734SPierre Pronchery * We are a little stricter and insist that both minimums are met.
171aa795734SPierre Pronchery * For example a L = 256, N = 160 key *would* be allowed by SP 800-131Ar2
172aa795734SPierre Pronchery * but we don't.
173b077aed3SPierre Pronchery */
174aa795734SPierre Pronchery if (!sign) {
175aa795734SPierre Pronchery if (L < 512 || N < 160)
176aa795734SPierre Pronchery return 0;
177aa795734SPierre Pronchery if (L < 2048 || N < 224)
178aa795734SPierre Pronchery return 1;
179aa795734SPierre Pronchery }
180b077aed3SPierre Pronchery
181b077aed3SPierre Pronchery /* Valid sizes for both sign and verify */
182aa795734SPierre Pronchery if (L == 2048 && (N == 224 || N == 256)) /* 112 bits */
183b077aed3SPierre Pronchery return 1;
184aa795734SPierre Pronchery return (L == 3072 && N == 256); /* 128 bits */
185b077aed3SPierre Pronchery }
186b077aed3SPierre Pronchery #endif /* OPENSSL_NO_DSA */
187b077aed3SPierre Pronchery
188b077aed3SPierre Pronchery #ifndef OPENSSL_NO_DH
189b077aed3SPierre Pronchery /*
190b077aed3SPierre Pronchery * For DH key agreement refer to SP800-56A
191b077aed3SPierre Pronchery * https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Ar3.pdf
192b077aed3SPierre Pronchery * "Section 5.5.1.1FFC Domain Parameter Selection/Generation" and
193b077aed3SPierre Pronchery * "Appendix D" FFC Safe-prime Groups
194b077aed3SPierre Pronchery */
ossl_dh_check_key(const DH * dh)195*e7be843bSPierre Pronchery int ossl_dh_check_key(const DH *dh)
196b077aed3SPierre Pronchery {
197b077aed3SPierre Pronchery size_t L, N;
198b077aed3SPierre Pronchery const BIGNUM *p, *q;
199b077aed3SPierre Pronchery
200b077aed3SPierre Pronchery if (dh == NULL)
201b077aed3SPierre Pronchery return 0;
202b077aed3SPierre Pronchery
203b077aed3SPierre Pronchery p = DH_get0_p(dh);
204b077aed3SPierre Pronchery q = DH_get0_q(dh);
205b077aed3SPierre Pronchery if (p == NULL || q == NULL)
206b077aed3SPierre Pronchery return 0;
207b077aed3SPierre Pronchery
208b077aed3SPierre Pronchery L = BN_num_bits(p);
209b077aed3SPierre Pronchery if (L < 2048)
210b077aed3SPierre Pronchery return 0;
211b077aed3SPierre Pronchery
212b077aed3SPierre Pronchery /* If it is a safe prime group then it is ok */
213b077aed3SPierre Pronchery if (DH_get_nid(dh))
214b077aed3SPierre Pronchery return 1;
215b077aed3SPierre Pronchery
216b077aed3SPierre Pronchery /* If not then it must be FFC, which only allows certain sizes. */
217b077aed3SPierre Pronchery N = BN_num_bits(q);
218b077aed3SPierre Pronchery
219b077aed3SPierre Pronchery return (L == 2048 && (N == 224 || N == 256));
220b077aed3SPierre Pronchery }
221b077aed3SPierre Pronchery #endif /* OPENSSL_NO_DH */
222