1 /* 2 * Copyright 2020-2022 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the Apache License 2.0 (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 /* 11 * RSA low level APIs are deprecated for public use, but still ok for 12 * internal use. 13 */ 14 #include "internal/deprecated.h" 15 #include "internal/nelem.h" 16 17 #include <openssl/crypto.h> 18 #include <openssl/evp.h> 19 #include <openssl/core_dispatch.h> 20 #include <openssl/core_names.h> 21 #include <openssl/rsa.h> 22 #include <openssl/params.h> 23 #include <openssl/err.h> 24 #include "crypto/rsa.h" 25 #include <openssl/proverr.h> 26 #include "prov/provider_ctx.h" 27 #include "prov/implementations.h" 28 #include "prov/securitycheck.h" 29 30 static OSSL_FUNC_kem_newctx_fn rsakem_newctx; 31 static OSSL_FUNC_kem_encapsulate_init_fn rsakem_encapsulate_init; 32 static OSSL_FUNC_kem_encapsulate_fn rsakem_generate; 33 static OSSL_FUNC_kem_decapsulate_init_fn rsakem_decapsulate_init; 34 static OSSL_FUNC_kem_decapsulate_fn rsakem_recover; 35 static OSSL_FUNC_kem_freectx_fn rsakem_freectx; 36 static OSSL_FUNC_kem_dupctx_fn rsakem_dupctx; 37 static OSSL_FUNC_kem_get_ctx_params_fn rsakem_get_ctx_params; 38 static OSSL_FUNC_kem_gettable_ctx_params_fn rsakem_gettable_ctx_params; 39 static OSSL_FUNC_kem_set_ctx_params_fn rsakem_set_ctx_params; 40 static OSSL_FUNC_kem_settable_ctx_params_fn rsakem_settable_ctx_params; 41 42 /* 43 * Only the KEM for RSASVE as defined in SP800-56b r2 is implemented 44 * currently. 45 */ 46 #define KEM_OP_UNDEFINED -1 47 #define KEM_OP_RSASVE 0 48 49 /* 50 * What's passed as an actual key is defined by the KEYMGMT interface. 51 * We happen to know that our KEYMGMT simply passes RSA structures, so 52 * we use that here too. 53 */ 54 typedef struct { 55 OSSL_LIB_CTX *libctx; 56 RSA *rsa; 57 int op; 58 } PROV_RSA_CTX; 59 60 static const OSSL_ITEM rsakem_opname_id_map[] = { 61 { KEM_OP_RSASVE, OSSL_KEM_PARAM_OPERATION_RSASVE }, 62 }; 63 64 static int name2id(const char *name, const OSSL_ITEM *map, size_t sz) 65 { 66 size_t i; 67 68 if (name == NULL) 69 return -1; 70 71 for (i = 0; i < sz; ++i) { 72 if (OPENSSL_strcasecmp(map[i].ptr, name) == 0) 73 return map[i].id; 74 } 75 return -1; 76 } 77 78 static int rsakem_opname2id(const char *name) 79 { 80 return name2id(name, rsakem_opname_id_map, OSSL_NELEM(rsakem_opname_id_map)); 81 } 82 83 static void *rsakem_newctx(void *provctx) 84 { 85 PROV_RSA_CTX *prsactx = OPENSSL_zalloc(sizeof(PROV_RSA_CTX)); 86 87 if (prsactx == NULL) 88 return NULL; 89 prsactx->libctx = PROV_LIBCTX_OF(provctx); 90 prsactx->op = KEM_OP_UNDEFINED; 91 92 return prsactx; 93 } 94 95 static void rsakem_freectx(void *vprsactx) 96 { 97 PROV_RSA_CTX *prsactx = (PROV_RSA_CTX *)vprsactx; 98 99 RSA_free(prsactx->rsa); 100 OPENSSL_free(prsactx); 101 } 102 103 static void *rsakem_dupctx(void *vprsactx) 104 { 105 PROV_RSA_CTX *srcctx = (PROV_RSA_CTX *)vprsactx; 106 PROV_RSA_CTX *dstctx; 107 108 dstctx = OPENSSL_zalloc(sizeof(*srcctx)); 109 if (dstctx == NULL) 110 return NULL; 111 112 *dstctx = *srcctx; 113 if (dstctx->rsa != NULL && !RSA_up_ref(dstctx->rsa)) { 114 OPENSSL_free(dstctx); 115 return NULL; 116 } 117 return dstctx; 118 } 119 120 static int rsakem_init(void *vprsactx, void *vrsa, 121 const OSSL_PARAM params[], int operation) 122 { 123 PROV_RSA_CTX *prsactx = (PROV_RSA_CTX *)vprsactx; 124 125 if (prsactx == NULL || vrsa == NULL) 126 return 0; 127 128 if (!ossl_rsa_check_key(prsactx->libctx, vrsa, operation)) 129 return 0; 130 131 if (!RSA_up_ref(vrsa)) 132 return 0; 133 RSA_free(prsactx->rsa); 134 prsactx->rsa = vrsa; 135 136 return rsakem_set_ctx_params(prsactx, params); 137 } 138 139 static int rsakem_encapsulate_init(void *vprsactx, void *vrsa, 140 const OSSL_PARAM params[]) 141 { 142 return rsakem_init(vprsactx, vrsa, params, EVP_PKEY_OP_ENCAPSULATE); 143 } 144 145 static int rsakem_decapsulate_init(void *vprsactx, void *vrsa, 146 const OSSL_PARAM params[]) 147 { 148 return rsakem_init(vprsactx, vrsa, params, EVP_PKEY_OP_DECAPSULATE); 149 } 150 151 static int rsakem_get_ctx_params(void *vprsactx, OSSL_PARAM *params) 152 { 153 PROV_RSA_CTX *ctx = (PROV_RSA_CTX *)vprsactx; 154 155 return ctx != NULL; 156 } 157 158 static const OSSL_PARAM known_gettable_rsakem_ctx_params[] = { 159 OSSL_PARAM_END 160 }; 161 162 static const OSSL_PARAM *rsakem_gettable_ctx_params(ossl_unused void *vprsactx, 163 ossl_unused void *provctx) 164 { 165 return known_gettable_rsakem_ctx_params; 166 } 167 168 static int rsakem_set_ctx_params(void *vprsactx, const OSSL_PARAM params[]) 169 { 170 PROV_RSA_CTX *prsactx = (PROV_RSA_CTX *)vprsactx; 171 const OSSL_PARAM *p; 172 int op; 173 174 if (prsactx == NULL) 175 return 0; 176 if (params == NULL) 177 return 1; 178 179 180 p = OSSL_PARAM_locate_const(params, OSSL_KEM_PARAM_OPERATION); 181 if (p != NULL) { 182 if (p->data_type != OSSL_PARAM_UTF8_STRING) 183 return 0; 184 op = rsakem_opname2id(p->data); 185 if (op < 0) 186 return 0; 187 prsactx->op = op; 188 } 189 return 1; 190 } 191 192 static const OSSL_PARAM known_settable_rsakem_ctx_params[] = { 193 OSSL_PARAM_utf8_string(OSSL_KEM_PARAM_OPERATION, NULL, 0), 194 OSSL_PARAM_END 195 }; 196 197 static const OSSL_PARAM *rsakem_settable_ctx_params(ossl_unused void *vprsactx, 198 ossl_unused void *provctx) 199 { 200 return known_settable_rsakem_ctx_params; 201 } 202 203 /* 204 * NIST.SP.800-56Br2 205 * 7.2.1.2 RSASVE Generate Operation (RSASVE.GENERATE). 206 * 207 * Generate a random in the range 1 < z < (n – 1) 208 */ 209 static int rsasve_gen_rand_bytes(RSA *rsa_pub, 210 unsigned char *out, int outlen) 211 { 212 int ret = 0; 213 BN_CTX *bnctx; 214 BIGNUM *z, *nminus3; 215 216 bnctx = BN_CTX_secure_new_ex(ossl_rsa_get0_libctx(rsa_pub)); 217 if (bnctx == NULL) 218 return 0; 219 220 /* 221 * Generate a random in the range 1 < z < (n – 1). 222 * Since BN_priv_rand_range_ex() returns a value in range 0 <= r < max 223 * We can achieve this by adding 2.. but then we need to subtract 3 from 224 * the upper bound i.e: 2 + (0 <= r < (n - 3)) 225 */ 226 BN_CTX_start(bnctx); 227 nminus3 = BN_CTX_get(bnctx); 228 z = BN_CTX_get(bnctx); 229 ret = (z != NULL 230 && (BN_copy(nminus3, RSA_get0_n(rsa_pub)) != NULL) 231 && BN_sub_word(nminus3, 3) 232 && BN_priv_rand_range_ex(z, nminus3, 0, bnctx) 233 && BN_add_word(z, 2) 234 && (BN_bn2binpad(z, out, outlen) == outlen)); 235 BN_CTX_end(bnctx); 236 BN_CTX_free(bnctx); 237 return ret; 238 } 239 240 /* 241 * NIST.SP.800-56Br2 242 * 7.2.1.2 RSASVE Generate Operation (RSASVE.GENERATE). 243 */ 244 static int rsasve_generate(PROV_RSA_CTX *prsactx, 245 unsigned char *out, size_t *outlen, 246 unsigned char *secret, size_t *secretlen) 247 { 248 int ret; 249 size_t nlen; 250 251 /* Step (1): nlen = Ceil(len(n)/8) */ 252 nlen = RSA_size(prsactx->rsa); 253 254 if (out == NULL) { 255 if (nlen == 0) { 256 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY); 257 return 0; 258 } 259 if (outlen == NULL && secretlen == NULL) 260 return 0; 261 if (outlen != NULL) 262 *outlen = nlen; 263 if (secretlen != NULL) 264 *secretlen = nlen; 265 return 1; 266 } 267 268 /* 269 * If outlen is specified, then it must report the length 270 * of the out buffer on input so that we can confirm 271 * its size is sufficent for encapsulation 272 */ 273 if (outlen != NULL && *outlen < nlen) { 274 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_OUTPUT_LENGTH); 275 return 0; 276 } 277 278 /* 279 * Step (2): Generate a random byte string z of nlen bytes where 280 * 1 < z < n - 1 281 */ 282 if (!rsasve_gen_rand_bytes(prsactx->rsa, secret, nlen)) 283 return 0; 284 285 /* Step(3): out = RSAEP((n,e), z) */ 286 ret = RSA_public_encrypt(nlen, secret, out, prsactx->rsa, RSA_NO_PADDING); 287 if (ret) { 288 ret = 1; 289 if (outlen != NULL) 290 *outlen = nlen; 291 if (secretlen != NULL) 292 *secretlen = nlen; 293 } else { 294 OPENSSL_cleanse(secret, nlen); 295 } 296 return ret; 297 } 298 299 /** 300 * rsasve_recover - Recovers a secret value from ciphertext using an RSA 301 * private key. Once, recovered, the secret value is considered to be a 302 * shared secret. Algorithm is preformed as per 303 * NIST SP 800-56B Rev 2 304 * 7.2.1.3 RSASVE Recovery Operation (RSASVE.RECOVER). 305 * 306 * This function performs RSA decryption using the private key from the 307 * provided RSA context (`prsactx`). It takes the input ciphertext, decrypts 308 * it, and writes the decrypted message to the output buffer. 309 * 310 * @prsactx: The RSA context containing the private key. 311 * @out: The output buffer to store the decrypted message. 312 * @outlen: On input, the size of the output buffer. On successful 313 * completion, the actual length of the decrypted message. 314 * @in: The input buffer containing the ciphertext to be decrypted. 315 * @inlen: The length of the input ciphertext in bytes. 316 * 317 * Returns 1 on success, or 0 on error. In case of error, appropriate 318 * error messages are raised using the ERR_raise function. 319 */ 320 static int rsasve_recover(PROV_RSA_CTX *prsactx, 321 unsigned char *out, size_t *outlen, 322 const unsigned char *in, size_t inlen) 323 { 324 size_t nlen; 325 int ret; 326 327 /* Step (1): get the byte length of n */ 328 nlen = RSA_size(prsactx->rsa); 329 330 if (out == NULL) { 331 if (nlen == 0) { 332 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY); 333 return 0; 334 } 335 *outlen = nlen; 336 return 1; 337 } 338 339 /* 340 * Step (2): check the input ciphertext 'inlen' matches the nlen 341 * and that outlen is at least nlen bytes 342 */ 343 if (inlen != nlen) { 344 ERR_raise(ERR_LIB_PROV, PROV_R_BAD_LENGTH); 345 return 0; 346 } 347 348 /* 349 * If outlen is specified, then it must report the length 350 * of the out buffer, so that we can confirm that it is of 351 * sufficient size to hold the output of decapsulation 352 */ 353 if (outlen != NULL && *outlen < nlen) { 354 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_OUTPUT_LENGTH); 355 return 0; 356 } 357 358 /* Step (3): out = RSADP((n,d), in) */ 359 ret = RSA_private_decrypt(inlen, in, out, prsactx->rsa, RSA_NO_PADDING); 360 if (ret > 0 && outlen != NULL) 361 *outlen = ret; 362 return ret > 0; 363 } 364 365 static int rsakem_generate(void *vprsactx, unsigned char *out, size_t *outlen, 366 unsigned char *secret, size_t *secretlen) 367 { 368 PROV_RSA_CTX *prsactx = (PROV_RSA_CTX *)vprsactx; 369 370 switch (prsactx->op) { 371 case KEM_OP_RSASVE: 372 return rsasve_generate(prsactx, out, outlen, secret, secretlen); 373 default: 374 return -2; 375 } 376 } 377 378 static int rsakem_recover(void *vprsactx, unsigned char *out, size_t *outlen, 379 const unsigned char *in, size_t inlen) 380 { 381 PROV_RSA_CTX *prsactx = (PROV_RSA_CTX *)vprsactx; 382 383 switch (prsactx->op) { 384 case KEM_OP_RSASVE: 385 return rsasve_recover(prsactx, out, outlen, in, inlen); 386 default: 387 return -2; 388 } 389 } 390 391 const OSSL_DISPATCH ossl_rsa_asym_kem_functions[] = { 392 { OSSL_FUNC_KEM_NEWCTX, (void (*)(void))rsakem_newctx }, 393 { OSSL_FUNC_KEM_ENCAPSULATE_INIT, 394 (void (*)(void))rsakem_encapsulate_init }, 395 { OSSL_FUNC_KEM_ENCAPSULATE, (void (*)(void))rsakem_generate }, 396 { OSSL_FUNC_KEM_DECAPSULATE_INIT, 397 (void (*)(void))rsakem_decapsulate_init }, 398 { OSSL_FUNC_KEM_DECAPSULATE, (void (*)(void))rsakem_recover }, 399 { OSSL_FUNC_KEM_FREECTX, (void (*)(void))rsakem_freectx }, 400 { OSSL_FUNC_KEM_DUPCTX, (void (*)(void))rsakem_dupctx }, 401 { OSSL_FUNC_KEM_GET_CTX_PARAMS, 402 (void (*)(void))rsakem_get_ctx_params }, 403 { OSSL_FUNC_KEM_GETTABLE_CTX_PARAMS, 404 (void (*)(void))rsakem_gettable_ctx_params }, 405 { OSSL_FUNC_KEM_SET_CTX_PARAMS, 406 (void (*)(void))rsakem_set_ctx_params }, 407 { OSSL_FUNC_KEM_SETTABLE_CTX_PARAMS, 408 (void (*)(void))rsakem_settable_ctx_params }, 409 { 0, NULL } 410 }; 411