1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * RSA Signature Scheme with Appendix - PKCS #1 v1.5 (RFC 8017 sec 8.2) 4 * 5 * https://www.rfc-editor.org/rfc/rfc8017#section-8.2 6 * 7 * Copyright (c) 2015 - 2024 Intel Corporation 8 */ 9 10 #include <linux/module.h> 11 #include <linux/scatterlist.h> 12 #include <crypto/akcipher.h> 13 #include <crypto/algapi.h> 14 #include <crypto/hash.h> 15 #include <crypto/sig.h> 16 #include <crypto/internal/akcipher.h> 17 #include <crypto/internal/rsa.h> 18 #include <crypto/internal/sig.h> 19 20 /* 21 * Full Hash Prefix for EMSA-PKCS1-v1_5 encoding method (RFC 9580 table 24) 22 * 23 * RSA keys are usually much larger than the hash of the message to be signed. 24 * The hash is therefore prepended by the Full Hash Prefix and a 0xff padding. 25 * The Full Hash Prefix is an ASN.1 SEQUENCE containing the hash algorithm OID. 26 * 27 * https://www.rfc-editor.org/rfc/rfc9580#table-24 28 */ 29 30 static const u8 hash_prefix_md5[] = { 31 0x30, 0x20, 0x30, 0x0c, 0x06, 0x08, /* SEQUENCE (SEQUENCE (OID */ 32 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x02, 0x05, /* <algorithm>, */ 33 0x05, 0x00, 0x04, 0x10 /* NULL), OCTET STRING <hash>) */ 34 }; 35 36 static const u8 hash_prefix_sha1[] = { 37 0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 38 0x2b, 0x0e, 0x03, 0x02, 0x1a, 39 0x05, 0x00, 0x04, 0x14 40 }; 41 42 static const u8 hash_prefix_rmd160[] = { 43 0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 44 0x2b, 0x24, 0x03, 0x02, 0x01, 45 0x05, 0x00, 0x04, 0x14 46 }; 47 48 static const u8 hash_prefix_sha224[] = { 49 0x30, 0x2d, 0x30, 0x0d, 0x06, 0x09, 50 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x04, 51 0x05, 0x00, 0x04, 0x1c 52 }; 53 54 static const u8 hash_prefix_sha256[] = { 55 0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 56 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 57 0x05, 0x00, 0x04, 0x20 58 }; 59 60 static const u8 hash_prefix_sha384[] = { 61 0x30, 0x41, 0x30, 0x0d, 0x06, 0x09, 62 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02, 63 0x05, 0x00, 0x04, 0x30 64 }; 65 66 static const u8 hash_prefix_sha512[] = { 67 0x30, 0x51, 0x30, 0x0d, 0x06, 0x09, 68 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, 69 0x05, 0x00, 0x04, 0x40 70 }; 71 72 static const u8 hash_prefix_sha3_256[] = { 73 0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 74 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x08, 75 0x05, 0x00, 0x04, 0x20 76 }; 77 78 static const u8 hash_prefix_sha3_384[] = { 79 0x30, 0x41, 0x30, 0x0d, 0x06, 0x09, 80 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x09, 81 0x05, 0x00, 0x04, 0x30 82 }; 83 84 static const u8 hash_prefix_sha3_512[] = { 85 0x30, 0x51, 0x30, 0x0d, 0x06, 0x09, 86 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x0a, 87 0x05, 0x00, 0x04, 0x40 88 }; 89 90 static const struct hash_prefix { 91 const char *name; 92 const u8 *data; 93 size_t size; 94 } hash_prefixes[] = { 95 #define _(X) { #X, hash_prefix_##X, sizeof(hash_prefix_##X) } 96 _(md5), 97 _(sha1), 98 _(rmd160), 99 _(sha256), 100 _(sha384), 101 _(sha512), 102 _(sha224), 103 #undef _ 104 #define _(X) { "sha3-" #X, hash_prefix_sha3_##X, sizeof(hash_prefix_sha3_##X) } 105 _(256), 106 _(384), 107 _(512), 108 #undef _ 109 { NULL } 110 }; 111 112 static const struct hash_prefix *rsassa_pkcs1_find_hash_prefix(const char *name) 113 { 114 const struct hash_prefix *p; 115 116 for (p = hash_prefixes; p->name; p++) 117 if (strcmp(name, p->name) == 0) 118 return p; 119 return NULL; 120 } 121 122 static unsigned int rsassa_pkcs1_hash_len(const struct hash_prefix *p) 123 { 124 /* 125 * The final byte of the Full Hash Prefix encodes the hash length. 126 * 127 * This needs to be revisited should hash algorithms with more than 128 * 1016 bits (127 bytes * 8) ever be added. The length would then 129 * be encoded into more than one byte by ASN.1. 130 */ 131 static_assert(HASH_MAX_DIGESTSIZE <= 127); 132 133 return p->data[p->size - 1]; 134 } 135 136 struct rsassa_pkcs1_ctx { 137 struct crypto_akcipher *child; 138 unsigned int key_size; 139 }; 140 141 struct rsassa_pkcs1_inst_ctx { 142 struct crypto_akcipher_spawn spawn; 143 const struct hash_prefix *hash_prefix; 144 }; 145 146 static int rsassa_pkcs1_sign(struct crypto_sig *tfm, 147 const void *src, unsigned int slen, 148 void *dst, unsigned int dlen) 149 { 150 struct sig_instance *inst = sig_alg_instance(tfm); 151 struct rsassa_pkcs1_inst_ctx *ictx = sig_instance_ctx(inst); 152 const struct hash_prefix *hash_prefix = ictx->hash_prefix; 153 struct rsassa_pkcs1_ctx *ctx = crypto_sig_ctx(tfm); 154 unsigned int child_reqsize = crypto_akcipher_reqsize(ctx->child); 155 struct akcipher_request *child_req __free(kfree_sensitive) = NULL; 156 struct scatterlist in_sg[3], out_sg; 157 struct crypto_wait cwait; 158 unsigned int pad_len; 159 unsigned int ps_end; 160 unsigned int len; 161 u8 *in_buf; 162 int err; 163 164 if (!ctx->key_size) 165 return -EINVAL; 166 167 if (dlen < ctx->key_size) 168 return -EOVERFLOW; 169 170 if (slen != rsassa_pkcs1_hash_len(hash_prefix)) 171 return -EINVAL; 172 173 if (slen + hash_prefix->size > ctx->key_size - 11) 174 return -EOVERFLOW; 175 176 pad_len = ctx->key_size - slen - hash_prefix->size - 1; 177 178 child_req = kmalloc(sizeof(*child_req) + child_reqsize + pad_len, 179 GFP_KERNEL); 180 if (!child_req) 181 return -ENOMEM; 182 183 /* RFC 8017 sec 8.2.1 step 1 - EMSA-PKCS1-v1_5 encoding generation */ 184 in_buf = (u8 *)(child_req + 1) + child_reqsize; 185 ps_end = pad_len - 1; 186 in_buf[0] = 0x01; 187 memset(in_buf + 1, 0xff, ps_end - 1); 188 in_buf[ps_end] = 0x00; 189 190 /* RFC 8017 sec 8.2.1 step 2 - RSA signature */ 191 crypto_init_wait(&cwait); 192 sg_init_table(in_sg, 3); 193 sg_set_buf(&in_sg[0], in_buf, pad_len); 194 sg_set_buf(&in_sg[1], hash_prefix->data, hash_prefix->size); 195 sg_set_buf(&in_sg[2], src, slen); 196 sg_init_one(&out_sg, dst, dlen); 197 akcipher_request_set_tfm(child_req, ctx->child); 198 akcipher_request_set_crypt(child_req, in_sg, &out_sg, 199 ctx->key_size - 1, dlen); 200 akcipher_request_set_callback(child_req, CRYPTO_TFM_REQ_MAY_SLEEP, 201 crypto_req_done, &cwait); 202 203 err = crypto_akcipher_decrypt(child_req); 204 err = crypto_wait_req(err, &cwait); 205 if (err) 206 return err; 207 208 len = child_req->dst_len; 209 pad_len = ctx->key_size - len; 210 211 /* Four billion to one */ 212 if (unlikely(pad_len)) { 213 memmove(dst + pad_len, dst, len); 214 memset(dst, 0, pad_len); 215 } 216 217 return 0; 218 } 219 220 static int rsassa_pkcs1_verify(struct crypto_sig *tfm, 221 const void *src, unsigned int slen, 222 const void *digest, unsigned int dlen) 223 { 224 struct sig_instance *inst = sig_alg_instance(tfm); 225 struct rsassa_pkcs1_inst_ctx *ictx = sig_instance_ctx(inst); 226 const struct hash_prefix *hash_prefix = ictx->hash_prefix; 227 struct rsassa_pkcs1_ctx *ctx = crypto_sig_ctx(tfm); 228 unsigned int child_reqsize = crypto_akcipher_reqsize(ctx->child); 229 struct akcipher_request *child_req __free(kfree_sensitive) = NULL; 230 struct scatterlist in_sg, out_sg; 231 struct crypto_wait cwait; 232 unsigned int dst_len; 233 unsigned int pos; 234 u8 *out_buf; 235 int err; 236 237 /* RFC 8017 sec 8.2.2 step 1 - length checking */ 238 if (!ctx->key_size || 239 slen != ctx->key_size || 240 dlen != rsassa_pkcs1_hash_len(hash_prefix)) 241 return -EINVAL; 242 243 /* RFC 8017 sec 8.2.2 step 2 - RSA verification */ 244 child_req = kmalloc(sizeof(*child_req) + child_reqsize + ctx->key_size, 245 GFP_KERNEL); 246 if (!child_req) 247 return -ENOMEM; 248 249 out_buf = (u8 *)(child_req + 1) + child_reqsize; 250 251 crypto_init_wait(&cwait); 252 sg_init_one(&in_sg, src, slen); 253 sg_init_one(&out_sg, out_buf, ctx->key_size); 254 akcipher_request_set_tfm(child_req, ctx->child); 255 akcipher_request_set_crypt(child_req, &in_sg, &out_sg, 256 slen, ctx->key_size); 257 akcipher_request_set_callback(child_req, CRYPTO_TFM_REQ_MAY_SLEEP, 258 crypto_req_done, &cwait); 259 260 err = crypto_akcipher_encrypt(child_req); 261 err = crypto_wait_req(err, &cwait); 262 if (err) 263 return err; 264 265 /* RFC 8017 sec 8.2.2 step 3 - EMSA-PKCS1-v1_5 encoding verification */ 266 dst_len = child_req->dst_len; 267 if (dst_len < ctx->key_size - 1) 268 return -EINVAL; 269 270 if (dst_len == ctx->key_size) { 271 if (out_buf[0] != 0x00) 272 /* Encrypted value had no leading 0 byte */ 273 return -EINVAL; 274 275 dst_len--; 276 out_buf++; 277 } 278 279 if (out_buf[0] != 0x01) 280 return -EBADMSG; 281 282 for (pos = 1; pos < dst_len; pos++) 283 if (out_buf[pos] != 0xff) 284 break; 285 286 if (pos < 9 || pos == dst_len || out_buf[pos] != 0x00) 287 return -EBADMSG; 288 pos++; 289 290 if (hash_prefix->size > dst_len - pos) 291 return -EBADMSG; 292 if (crypto_memneq(out_buf + pos, hash_prefix->data, hash_prefix->size)) 293 return -EBADMSG; 294 pos += hash_prefix->size; 295 296 /* RFC 8017 sec 8.2.2 step 4 - comparison of digest with out_buf */ 297 if (dlen != dst_len - pos) 298 return -EKEYREJECTED; 299 if (memcmp(digest, out_buf + pos, dlen) != 0) 300 return -EKEYREJECTED; 301 302 return 0; 303 } 304 305 static unsigned int rsassa_pkcs1_key_size(struct crypto_sig *tfm) 306 { 307 struct rsassa_pkcs1_ctx *ctx = crypto_sig_ctx(tfm); 308 309 return ctx->key_size; 310 } 311 312 static int rsassa_pkcs1_set_pub_key(struct crypto_sig *tfm, 313 const void *key, unsigned int keylen) 314 { 315 struct rsassa_pkcs1_ctx *ctx = crypto_sig_ctx(tfm); 316 317 return rsa_set_key(ctx->child, &ctx->key_size, RSA_PUB, key, keylen); 318 } 319 320 static int rsassa_pkcs1_set_priv_key(struct crypto_sig *tfm, 321 const void *key, unsigned int keylen) 322 { 323 struct rsassa_pkcs1_ctx *ctx = crypto_sig_ctx(tfm); 324 325 return rsa_set_key(ctx->child, &ctx->key_size, RSA_PRIV, key, keylen); 326 } 327 328 static int rsassa_pkcs1_init_tfm(struct crypto_sig *tfm) 329 { 330 struct sig_instance *inst = sig_alg_instance(tfm); 331 struct rsassa_pkcs1_inst_ctx *ictx = sig_instance_ctx(inst); 332 struct rsassa_pkcs1_ctx *ctx = crypto_sig_ctx(tfm); 333 struct crypto_akcipher *child_tfm; 334 335 child_tfm = crypto_spawn_akcipher(&ictx->spawn); 336 if (IS_ERR(child_tfm)) 337 return PTR_ERR(child_tfm); 338 339 ctx->child = child_tfm; 340 341 return 0; 342 } 343 344 static void rsassa_pkcs1_exit_tfm(struct crypto_sig *tfm) 345 { 346 struct rsassa_pkcs1_ctx *ctx = crypto_sig_ctx(tfm); 347 348 crypto_free_akcipher(ctx->child); 349 } 350 351 static void rsassa_pkcs1_free(struct sig_instance *inst) 352 { 353 struct rsassa_pkcs1_inst_ctx *ctx = sig_instance_ctx(inst); 354 struct crypto_akcipher_spawn *spawn = &ctx->spawn; 355 356 crypto_drop_akcipher(spawn); 357 kfree(inst); 358 } 359 360 static int rsassa_pkcs1_create(struct crypto_template *tmpl, struct rtattr **tb) 361 { 362 struct rsassa_pkcs1_inst_ctx *ctx; 363 struct akcipher_alg *rsa_alg; 364 struct sig_instance *inst; 365 const char *hash_name; 366 u32 mask; 367 int err; 368 369 err = crypto_check_attr_type(tb, CRYPTO_ALG_TYPE_SIG, &mask); 370 if (err) 371 return err; 372 373 inst = kzalloc(sizeof(*inst) + sizeof(*ctx), GFP_KERNEL); 374 if (!inst) 375 return -ENOMEM; 376 377 ctx = sig_instance_ctx(inst); 378 379 err = crypto_grab_akcipher(&ctx->spawn, sig_crypto_instance(inst), 380 crypto_attr_alg_name(tb[1]), 0, mask); 381 if (err) 382 goto err_free_inst; 383 384 rsa_alg = crypto_spawn_akcipher_alg(&ctx->spawn); 385 386 if (strcmp(rsa_alg->base.cra_name, "rsa") != 0) { 387 err = -EINVAL; 388 goto err_free_inst; 389 } 390 391 hash_name = crypto_attr_alg_name(tb[2]); 392 if (IS_ERR(hash_name)) { 393 err = PTR_ERR(hash_name); 394 goto err_free_inst; 395 } 396 397 ctx->hash_prefix = rsassa_pkcs1_find_hash_prefix(hash_name); 398 if (!ctx->hash_prefix) { 399 err = -EINVAL; 400 goto err_free_inst; 401 } 402 403 err = -ENAMETOOLONG; 404 if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME, 405 "pkcs1(%s,%s)", rsa_alg->base.cra_name, 406 hash_name) >= CRYPTO_MAX_ALG_NAME) 407 goto err_free_inst; 408 409 if (snprintf(inst->alg.base.cra_driver_name, CRYPTO_MAX_ALG_NAME, 410 "pkcs1(%s,%s)", rsa_alg->base.cra_driver_name, 411 hash_name) >= CRYPTO_MAX_ALG_NAME) 412 goto err_free_inst; 413 414 inst->alg.base.cra_priority = rsa_alg->base.cra_priority; 415 inst->alg.base.cra_ctxsize = sizeof(struct rsassa_pkcs1_ctx); 416 417 inst->alg.init = rsassa_pkcs1_init_tfm; 418 inst->alg.exit = rsassa_pkcs1_exit_tfm; 419 420 inst->alg.sign = rsassa_pkcs1_sign; 421 inst->alg.verify = rsassa_pkcs1_verify; 422 inst->alg.key_size = rsassa_pkcs1_key_size; 423 inst->alg.set_pub_key = rsassa_pkcs1_set_pub_key; 424 inst->alg.set_priv_key = rsassa_pkcs1_set_priv_key; 425 426 inst->free = rsassa_pkcs1_free; 427 428 err = sig_register_instance(tmpl, inst); 429 if (err) { 430 err_free_inst: 431 rsassa_pkcs1_free(inst); 432 } 433 return err; 434 } 435 436 struct crypto_template rsassa_pkcs1_tmpl = { 437 .name = "pkcs1", 438 .create = rsassa_pkcs1_create, 439 .module = THIS_MODULE, 440 }; 441 442 MODULE_ALIAS_CRYPTO("pkcs1"); 443