1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License, Version 1.0 only 6 * (the "License"). You may not use this file except in compliance 7 * with the License. 8 * 9 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10 * or http://www.opensolaris.org/os/licensing. 11 * See the License for the specific language governing permissions 12 * and limitations under the License. 13 * 14 * When distributing Covered Code, include this CDDL HEADER in each 15 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16 * If applicable, add the following below this CDDL HEADER, with the 17 * fields enclosed by brackets "[]" replaced with your own identifying 18 * information: Portions Copyright [yyyy] [name of copyright owner] 19 * 20 * CDDL HEADER END 21 */ 22 /* 23 * Copyright 2005 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 */ 26 27 #pragma ident "%Z%%M% %I% %E% SMI" 28 29 /* 30 * This file contains RSA helper routines common to 31 * the PKCS11 soft token code and the kernel RSA code. 32 */ 33 34 #include <sys/types.h> 35 #include "rsa_impl.h" 36 37 #ifdef _KERNEL 38 #include <sys/param.h> 39 #else 40 #include <strings.h> 41 #include "softRandom.h" 42 #endif 43 44 /* 45 * DER encoding T of the DigestInfo values for MD5, SHA1, and SHA2 46 * from PKCS#1 v2.1: RSA Cryptography Standard Section 9.2 Note 1 47 * 48 * MD5: (0x)30 20 30 0c 06 08 2a 86 48 86 f7 0d 02 05 05 00 04 10 || H 49 * SHA-1: (0x)30 21 30 09 06 05 2b 0e 03 02 1a 05 00 04 14 || H 50 * SHA-256: (0x)30 31 30 0d 06 09 60 86 48 01 65 03 04 02 01 05 00 04 20 || H. 51 * SHA-384: (0x)30 41 30 0d 06 09 60 86 48 01 65 03 04 02 02 05 00 04 30 || H. 52 * SHA-512: (0x)30 51 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 00 04 40 || H. 53 * 54 * Where H is the digested output from MD5 or SHA1. We define the constant 55 * byte array (the prefix) here and use it rather than doing the DER 56 * encoding of the OID in a separate routine. 57 */ 58 const CK_BYTE MD5_DER_PREFIX[MD5_DER_PREFIX_Len] = {0x30, 0x20, 0x30, 0x0c, 59 0x06, 0x08, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x02, 0x05, 0x05, 0x00, 60 0x04, 0x10}; 61 62 const CK_BYTE SHA1_DER_PREFIX[SHA1_DER_PREFIX_Len] = {0x30, 0x21, 0x30, 63 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02, 0x1a, 0x05, 0x00, 0x04, 0x14}; 64 65 const CK_BYTE SHA1_DER_PREFIX_OID[SHA1_DER_PREFIX_OID_Len] = {0x30, 0x1f, 0x30, 66 0x07, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02, 0x1a, 0x04, 0x14}; 67 68 const CK_BYTE SHA256_DER_PREFIX[SHA2_DER_PREFIX_Len] = {0x30, 0x31, 0x30, 0x0d, 69 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05, 70 0x00, 0x04, 0x20}; 71 72 const CK_BYTE SHA384_DER_PREFIX[SHA2_DER_PREFIX_Len] = {0x30, 0x41, 0x30, 0x0d, 73 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02, 0x05, 74 0x00, 0x04, 0x30}; 75 76 const CK_BYTE SHA512_DER_PREFIX[SHA2_DER_PREFIX_Len] = {0x30, 0x51, 0x30, 0x0d, 77 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, 0x05, 78 0x00, 0x04, 0x40}; 79 80 BIG_ERR_CODE 81 RSA_key_init(RSAkey *key, int psize, int qsize) 82 { 83 BIG_ERR_CODE err = BIG_OK; 84 85 /* EXPORT DELETE START */ 86 87 int plen, qlen, nlen; 88 89 plen = (psize + 31) / 32; 90 qlen = (qsize + 31) / 32; 91 nlen = plen + qlen; 92 key->size = psize + qsize; 93 if ((err = big_init(&(key->p), plen)) != BIG_OK) 94 return (err); 95 if ((err = big_init(&(key->q), qlen)) != BIG_OK) 96 goto ret1; 97 if ((err = big_init(&(key->n), nlen)) != BIG_OK) 98 goto ret2; 99 if ((err = big_init(&(key->d), nlen)) != BIG_OK) 100 goto ret3; 101 if ((err = big_init(&(key->e), nlen)) != BIG_OK) 102 goto ret4; 103 if ((err = big_init(&(key->dmodpminus1), plen)) != BIG_OK) 104 goto ret5; 105 if ((err = big_init(&(key->dmodqminus1), qlen)) != BIG_OK) 106 goto ret6; 107 if ((err = big_init(&(key->pinvmodq), qlen)) != BIG_OK) 108 goto ret7; 109 if ((err = big_init(&(key->p_rr), plen)) != BIG_OK) 110 goto ret8; 111 if ((err = big_init(&(key->q_rr), qlen)) != BIG_OK) 112 goto ret9; 113 if ((err = big_init(&(key->n_rr), nlen)) != BIG_OK) 114 goto ret10; 115 116 return (BIG_OK); 117 118 ret10: 119 big_finish(&(key->q_rr)); 120 ret9: 121 big_finish(&(key->p_rr)); 122 ret8: 123 big_finish(&(key->pinvmodq)); 124 ret7: 125 big_finish(&(key->dmodqminus1)); 126 ret6: 127 big_finish(&(key->dmodpminus1)); 128 ret5: 129 big_finish(&(key->e)); 130 ret4: 131 big_finish(&(key->d)); 132 ret3: 133 big_finish(&(key->n)); 134 ret2: 135 big_finish(&(key->q)); 136 ret1: 137 big_finish(&(key->p)); 138 139 /* EXPORT DELETE END */ 140 141 return (err); 142 } 143 144 145 void 146 RSA_key_finish(RSAkey *key) 147 { 148 149 /* EXPORT DELETE START */ 150 151 big_finish(&(key->n_rr)); 152 big_finish(&(key->q_rr)); 153 big_finish(&(key->p_rr)); 154 big_finish(&(key->pinvmodq)); 155 big_finish(&(key->dmodqminus1)); 156 big_finish(&(key->dmodpminus1)); 157 big_finish(&(key->e)); 158 big_finish(&(key->d)); 159 big_finish(&(key->n)); 160 big_finish(&(key->q)); 161 big_finish(&(key->p)); 162 163 /* EXPORT DELETE END */ 164 165 } 166 167 168 /* 169 * To create a block type "02" encryption block for RSA PKCS encryption 170 * process. 171 * 172 * The RSA PKCS Padding before encryption is in the following format: 173 * +------+--------------------+----+-----------------------------+ 174 * |0x0002| 8 bytes or more RN |0x00| DATA | 175 * +------+--------------------+----+-----------------------------+ 176 * 177 */ 178 CK_RV 179 soft_encrypt_rsa_pkcs_encode(uint8_t *databuf, 180 size_t datalen, uint8_t *padbuf, size_t padbuflen) 181 { 182 183 /* EXPORT DELETE START */ 184 185 size_t padlen; 186 CK_RV rv; 187 188 padlen = padbuflen - datalen; 189 if (padlen < MIN_PKCS1_PADLEN) { 190 return (CKR_DATA_LEN_RANGE); 191 } 192 193 /* Pad with 0x0002+non-zero pseudorandom numbers+0x00. */ 194 padbuf[0] = 0x00; 195 padbuf[1] = 0x02; 196 #ifdef _KERNEL 197 rv = knzero_random_generator(padbuf + 2, padbuflen - 3); 198 #else 199 rv = soft_nzero_random_generator(padbuf + 2, padbuflen - 3); 200 #endif 201 if (rv != CKR_OK) { 202 return (rv); 203 } 204 padbuf[padlen - 1] = 0x00; 205 206 bcopy(databuf, padbuf + padlen, datalen); 207 208 /* EXPORT DELETE END */ 209 210 return (CKR_OK); 211 } 212 213 214 /* 215 * The RSA PKCS Padding after decryption is in the following format: 216 * +------+--------------------+----+-----------------------------+ 217 * |0x0002| 8 bytes or more RN |0x00| DATA | 218 * +------+--------------------+----+-----------------------------+ 219 * 220 * 'padbuf' points to the recovered message which is the modulus 221 * length. As a result, 'plen' is changed to hold the actual data length. 222 */ 223 CK_RV 224 soft_decrypt_rsa_pkcs_decode(uint8_t *padbuf, int *plen) 225 { 226 227 /* EXPORT DELETE START */ 228 229 int i; 230 231 /* Check to see if the recovered data is padded is 0x0002. */ 232 if (padbuf[0] != 0x00 || padbuf[1] != 0x02) { 233 return (CKR_ENCRYPTED_DATA_INVALID); 234 } 235 236 /* Remove all the random bits up to 0x00 (= NULL char) */ 237 for (i = 2; (*plen - i) > 0; i++) { 238 if (padbuf[i] == 0x00) { 239 i++; 240 if (i < MIN_PKCS1_PADLEN) { 241 return (CKR_ENCRYPTED_DATA_INVALID); 242 } 243 *plen -= i; 244 245 return (CKR_OK); 246 } 247 } 248 249 /* EXPORT DELETE END */ 250 251 return (CKR_ENCRYPTED_DATA_INVALID); 252 } 253 254 /* 255 * To create a block type "01" block for RSA PKCS signature process. 256 * 257 * The RSA PKCS Padding before Signing is in the following format: 258 * +------+--------------+----+-----------------------------+ 259 * |0x0001| 0xFFFF.......|0x00| DATA | 260 * +------+--------------+----+-----------------------------+ 261 */ 262 CK_RV 263 soft_sign_rsa_pkcs_encode(uint8_t *pData, size_t dataLen, uint8_t *data, 264 size_t mbit_l) 265 { 266 267 /* EXPORT DELETE START */ 268 269 size_t padlen; 270 271 padlen = mbit_l - dataLen; 272 if (padlen < MIN_PKCS1_PADLEN) { 273 return (CKR_DATA_LEN_RANGE); 274 } 275 276 padlen -= 3; 277 data[0] = 0x00; 278 data[1] = 0x01; 279 #ifdef _KERNEL 280 kmemset(data + 2, 0xFF, padlen); 281 #else 282 (void) memset(data + 2, 0xFF, padlen); 283 #endif 284 data[padlen + 2] = 0x00; 285 bcopy(pData, data + padlen + 3, dataLen); 286 287 /* EXPORT DELETE END */ 288 289 return (CKR_OK); 290 } 291 292 293 CK_RV 294 soft_verify_rsa_pkcs_decode(uint8_t *data, int *mbit_l) 295 { 296 297 /* EXPORT DELETE START */ 298 299 int i; 300 301 /* Check to see if the padding of recovered data starts with 0x0001. */ 302 if ((data[0] != 0x00) || (data[1] != 0x01)) { 303 return (CKR_SIGNATURE_INVALID); 304 } 305 /* Check to see if the recovered data is padded with 0xFFF...00. */ 306 for (i = 2; i < *mbit_l; i++) { 307 if (data[i] == 0x00) { 308 i++; 309 if (i < MIN_PKCS1_PADLEN) { 310 return (CKR_SIGNATURE_INVALID); 311 } 312 *mbit_l -= i; 313 314 return (CKR_OK); 315 } else if (data[i] != 0xFF) { 316 return (CKR_SIGNATURE_INVALID); 317 } 318 } 319 320 /* EXPORT DELETE END */ 321 322 return (CKR_SIGNATURE_INVALID); 323 } 324