VirtualBox

source: vbox/trunk/src/VBox/Runtime/common/crypto/pkix-signature-rsa.cpp@ 72367

Last change on this file since 72367 was 69111, checked in by vboxsync, 7 years ago

(C) year
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 18.1 KB
Line 
1/* $Id: pkix-signature-rsa.cpp 69111 2017-10-17 14:26:02Z vboxsync $ */
2/** @file
3 * IPRT - Crypto - Public Key Signature Schema Algorithm, RSA Providers.
4 */
5
6/*
7 * Copyright (C) 2006-2017 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 *
17 * The contents of this file may alternatively be used under the terms
18 * of the Common Development and Distribution License Version 1.0
19 * (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20 * VirtualBox OSE distribution, in which case the provisions of the
21 * CDDL are applicable instead of those of the GPL.
22 *
23 * You may elect to license modified versions of this file under the
24 * terms and conditions of either the GPL or the CDDL or both.
25 */
26
27
28/*********************************************************************************************************************************
29* Header Files *
30*********************************************************************************************************************************/
31#include "internal/iprt.h"
32#include <iprt/crypto/rsa.h>
33
34#include <iprt/bignum.h>
35#include <iprt/err.h>
36#include <iprt/mem.h>
37#include <iprt/string.h>
38#include <iprt/crypto/digest.h>
39#include <iprt/crypto/pkix.h>
40
41#include "rsa-internal.h"
42#include "pkix-signature-builtin.h"
43
44
45/*********************************************************************************************************************************
46* Structures and Typedefs *
47*********************************************************************************************************************************/
48/**
49 * RSA signature provider instance.
50 */
51typedef struct RTCRPKIXSIGNATURERSA
52{
53 /** Set if we're signing, clear if verifying. */
54 bool fSigning;
55 /** The modulus. */
56 RTBIGNUM Modulus;
57 /** The exponent. */
58 RTBIGNUM Exponent;
59
60 /** Temporary big number for use when signing or verifiying. */
61 RTBIGNUM TmpBigNum1;
62 /** Temporary big number for use when signing or verifiying. */
63 RTBIGNUM TmpBigNum2;
64
65 /** Scratch space for decoding the key. */
66 union
67 {
68 /** Public key. */
69 RTCRRSAPUBLICKEY PublicKey;
70 /** Private key. */
71 RTCRRSAPRIVATEKEY PrivateKey;
72 /** Scratch area where we assemble the signature. */
73 uint8_t abSignature[RTCRRSA_MAX_MODULUS_BITS / 8 * 2];
74 } Scratch;
75} RTCRPKIXSIGNATURERSA;
76/** Pointer to an RSA signature provider instance. */
77typedef RTCRPKIXSIGNATURERSA *PRTCRPKIXSIGNATURERSA;
78
79
80/*********************************************************************************************************************************
81* Global Variables *
82*********************************************************************************************************************************/
83/** @name Pre-encoded DigestInfo DER sequences.
84 * @{ */
85static const uint8_t g_abMd2[] =
86{/* { { 1.2.840.113549.2.2 (MD2), NULL }, hash octet-string } */
87 0x30,0x20, 0x30,0x0c, 0x06,0x08,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x02,0x02, 0x05,0x00, 0x04,0x10
88};
89static const uint8_t g_abMd4[] =
90{/* { { 1.2.840.113549.2.4 (MD4), NULL }, hash octet-string } */
91 0x30,0x20, 0x30,0x0c, 0x06,0x08,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x02,0x04, 0x05,0x00, 0x04,0x10
92};
93static const uint8_t g_abMd5[] =
94{/* { { 1.2.840.113549.2.5 (MD5), NULL }, hash octet-string } */
95 0x30,0x20, 0x30,0x0c, 0x06,0x08,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x02,0x05, 0x05,0x00, 0x04,0x10
96};
97static const uint8_t g_abSha1[] =
98{/* { { 1.3.14.3.2.26 (SHA-1), NULL }, hash octet-string } */
99 0x30,0x21, 0x30,0x09, 0x06,0x05,0x2b,0x0e,0x03,0x02,0x1a, 0x05,0x00, 0x04,0x14
100};
101static const uint8_t g_abSha256[] =
102{/* { { 2.16.840.1.101.3.4.2.1 (SHA-256), NULL }, hash octet-string } */
103 0x30,0x31, 0x30,0x0d, 0x06,0x09,0x60,0x86,0x48,0x01,0x65,0x03,0x04,0x02,0x01, 0x05,0x00, 0x04,0x20
104};
105static const uint8_t g_abSha384[] =
106{/* { { 2.16.840.1.101.3.4.2.2 (SHA-384), NULL }, hash octet-string } */
107 0x30,0x41, 0x30,0x0d, 0x06,0x09,0x60,0x86,0x48,0x01,0x65,0x03,0x04,0x02,0x02, 0x05,0x00, 0x04,0x30
108};
109static const uint8_t g_abSha512[] =
110{/* { { 2.16.840.1.101.3.4.2.3 (SHA-512), NULL }, hash octet-string } */
111 0x30,0x51, 0x30,0x0d, 0x06,0x09,0x60,0x86,0x48,0x01,0x65,0x03,0x04,0x02,0x03, 0x05,0x00, 0x04,0x40
112};
113static const uint8_t g_abSha224[] =
114{/* { { 2.16.840.1.101.3.4.2.4 (SHA-224), NULL }, hash octet-string } */
115 0x30,0x2d, 0x30,0x0d, 0x06,0x09,0x60,0x86,0x48,0x01,0x65,0x03,0x04,0x02,0x04, 0x05,0x00, 0x04,0x1c
116};
117/** @} */
118
119/** Lookup array for the pre-encoded DigestInfo DER sequences. */
120static struct
121{
122 RTDIGESTTYPE enmDigest;
123 const uint8_t *pb;
124 size_t cb;
125} const g_aDigestInfos[] =
126{
127 { RTDIGESTTYPE_MD2, g_abMd2, sizeof(g_abMd2) },
128 { RTDIGESTTYPE_MD4, g_abMd4, sizeof(g_abMd4) },
129 { RTDIGESTTYPE_MD5, g_abMd5, sizeof(g_abMd5) },
130 { RTDIGESTTYPE_SHA1, g_abSha1, sizeof(g_abSha1) },
131 { RTDIGESTTYPE_SHA256, g_abSha256, sizeof(g_abSha256) },
132 { RTDIGESTTYPE_SHA384, g_abSha384, sizeof(g_abSha384) },
133 { RTDIGESTTYPE_SHA512, g_abSha512, sizeof(g_abSha512) },
134 { RTDIGESTTYPE_SHA224, g_abSha224, sizeof(g_abSha224) },
135};
136
137
138/** @impl_interface_method{RTCRPKIXSIGNATUREDESC,pfnInit} */
139static DECLCALLBACK(int) rtCrPkixSignatureRsa_Init(PCRTCRPKIXSIGNATUREDESC pDesc, void *pvState, void *pvOpaque,
140 bool fSigning, PCRTASN1BITSTRING pKey, PCRTASN1DYNTYPE pParams)
141{
142 RT_NOREF_PV(pDesc); RT_NOREF_PV(pvState); RT_NOREF_PV(pvOpaque);
143
144 if (pParams)
145 return VERR_CR_PKIX_SIGNATURE_TAKES_NO_PARAMETERS;
146
147 PRTCRPKIXSIGNATURERSA pThis = (PRTCRPKIXSIGNATURERSA)pvState;
148 pThis->fSigning = fSigning;
149
150 /*
151 * Decode the key and pick the bits we really need from it.
152 */
153 RTASN1CURSORPRIMARY PrimaryCursor;
154 RTAsn1CursorInitPrimary(&PrimaryCursor, RTASN1BITSTRING_GET_BIT0_PTR(pKey), RTASN1BITSTRING_GET_BYTE_SIZE(pKey),
155 NULL, &g_RTAsn1DefaultAllocator, RTASN1CURSOR_FLAGS_DER, "rsa");
156 int rc;
157 if (!fSigning)
158 {
159 rc = RTCrRsaPublicKey_DecodeAsn1(&PrimaryCursor.Cursor, 0, &pThis->Scratch.PublicKey, "PublicKey");
160 if (RT_SUCCESS(rc))
161 {
162 rc = RTAsn1Integer_ToBigNum(&pThis->Scratch.PublicKey.Modulus, &pThis->Modulus, 0);
163 if (RT_SUCCESS(rc))
164 {
165 rc = RTAsn1Integer_ToBigNum(&pThis->Scratch.PublicKey.PublicExponent, &pThis->Exponent, 0);
166 if (RT_SUCCESS(rc))
167 {
168 RTAsn1VtDelete(&pThis->Scratch.PublicKey.SeqCore.Asn1Core);
169 return VINF_SUCCESS;
170 }
171 RTBigNumDestroy(&pThis->Modulus);
172 }
173 RTAsn1VtDelete(&pThis->Scratch.PublicKey.SeqCore.Asn1Core);
174 }
175 }
176 else
177 {
178 rc = RTCrRsaPrivateKey_DecodeAsn1(&PrimaryCursor.Cursor, 0, &pThis->Scratch.PrivateKey, "PrivateKey");
179 if (RT_SUCCESS(rc))
180 {
181 rc = RTAsn1Integer_ToBigNum(&pThis->Scratch.PrivateKey.Modulus, &pThis->Modulus, RTBIGNUMINIT_F_SENSITIVE);
182 if (RT_SUCCESS(rc))
183 {
184 rc = RTAsn1Integer_ToBigNum(&pThis->Scratch.PrivateKey.PublicExponent, &pThis->Exponent, RTBIGNUMINIT_F_SENSITIVE);
185 if (RT_SUCCESS(rc))
186 {
187 RTAsn1VtDelete(&pThis->Scratch.PrivateKey.SeqCore.Asn1Core);
188 return VINF_SUCCESS;
189 }
190 RTBigNumDestroy(&pThis->Modulus);
191 }
192 RTAsn1VtDelete(&pThis->Scratch.PrivateKey.SeqCore.Asn1Core);
193 }
194 }
195 return rc;
196}
197
198
199/** @impl_interface_method{RTCRPKIXSIGNATUREDESC,pfnReset} */
200static DECLCALLBACK(int) rtCrPkixSignatureRsa_Reset(PCRTCRPKIXSIGNATUREDESC pDesc, void *pvState, bool fSigning)
201{
202 PRTCRPKIXSIGNATURERSA pThis = (PRTCRPKIXSIGNATURERSA)pvState;
203 RT_NOREF_PV(fSigning); RT_NOREF_PV(pDesc);
204 Assert(pThis->fSigning == fSigning); NOREF(pThis);
205 return VINF_SUCCESS;
206}
207
208
209/** @impl_interface_method{RTCRPKIXSIGNATUREDESC,pfnDelete} */
210static DECLCALLBACK(void) rtCrPkixSignatureRsa_Delete(PCRTCRPKIXSIGNATUREDESC pDesc, void *pvState, bool fSigning)
211{
212 PRTCRPKIXSIGNATURERSA pThis = (PRTCRPKIXSIGNATURERSA)pvState;
213 RT_NOREF_PV(fSigning); RT_NOREF_PV(pDesc);
214 Assert(pThis->fSigning == fSigning);
215
216 RTBigNumDestroy(&pThis->Modulus);
217 RTBigNumDestroy(&pThis->Exponent);
218}
219
220
221/**
222 * Common worker for rtCrPkixSignatureRsa_Verify and
223 * rtCrPkixSignatureRsa_Sign that encodes an EMSA-PKCS1-V1_5 signature in
224 * the scratch area.
225 *
226 * This function is referred to as EMSA-PKCS1-v1_5-ENCODE(M,k) in RFC-3447 and
227 * is described in section 9.2
228 *
229 * @returns IPRT status code.
230 * @param pThis The RSA signature provider instance.
231 * @param hDigest The digest which hash to turn into a signature.
232 * @param cbEncodedMsg The desired encoded message length.
233 * @param fNoDigestInfo If true, skip the DigestInfo and encode the digest
234 * without any prefix like described in v1.5 (RFC-2313)
235 * and observed with RSA+MD5 signed timestamps. If
236 * false, include the prefix like v2.0 (RFC-2437)
237 * describes in step in section 9.2.1
238 * (EMSA-PKCS1-v1_5)
239 */
240static int rtCrPkixSignatureRsa_EmsaPkcs1V15Encode(PRTCRPKIXSIGNATURERSA pThis, RTCRDIGEST hDigest, size_t cbEncodedMsg,
241 bool fNoDigestInfo)
242{
243 AssertReturn(cbEncodedMsg * 2 <= sizeof(pThis->Scratch), VERR_CR_PKIX_INTERNAL_ERROR);
244
245 /*
246 * Figure out which hash and select the associate prebaked DigestInfo.
247 */
248 RTDIGESTTYPE const enmDigest = RTCrDigestGetType(hDigest);
249 AssertReturn(enmDigest != RTDIGESTTYPE_INVALID && enmDigest != RTDIGESTTYPE_UNKNOWN, VERR_CR_PKIX_UNKNOWN_DIGEST_TYPE);
250 uint8_t const *pbDigestInfoStart = NULL;
251 size_t cbDigestInfoStart = 0;
252 for (uint32_t i = 0; i < RT_ELEMENTS(g_aDigestInfos); i++)
253 if (g_aDigestInfos[i].enmDigest == enmDigest)
254 {
255 pbDigestInfoStart = g_aDigestInfos[i].pb;
256 cbDigestInfoStart = g_aDigestInfos[i].cb;
257 break;
258 }
259 if (!pbDigestInfoStart)
260 return VERR_CR_PKIX_UNKNOWN_DIGEST_TYPE;
261
262 /*
263 * Get the hash size and verify that it matches what we've got in the
264 * precooked DigestInfo. ASSUMES less that 256 bytes of hash.
265 */
266 uint32_t const cbHash = RTCrDigestGetHashSize(hDigest);
267 AssertReturn(cbHash > 0 && cbHash < _16K, VERR_OUT_OF_RANGE);
268 AssertReturn(cbHash == pbDigestInfoStart[cbDigestInfoStart - 1], VERR_CR_PKIX_INTERNAL_ERROR);
269
270 if (fNoDigestInfo)
271 cbDigestInfoStart = 0;
272
273 if (cbDigestInfoStart + cbHash + 11 > cbEncodedMsg)
274 return VERR_CR_PKIX_HASH_TOO_LONG_FOR_KEY;
275
276 /*
277 * Encode the message the first part of the scratch area.
278 */
279 uint8_t *pbDst = &pThis->Scratch.abSignature[0];
280 pbDst[0] = 0x00;
281 pbDst[1] = 0x01; /* BT - block type, see RFC-2313. */
282 size_t cbFFs = cbEncodedMsg - cbHash - cbDigestInfoStart - 3;
283 memset(&pbDst[2], 0xff, cbFFs);
284 pbDst += cbFFs + 2;
285 *pbDst++ = 0x00;
286 memcpy(pbDst, pbDigestInfoStart, cbDigestInfoStart);
287 pbDst += cbDigestInfoStart;
288 int rc = RTCrDigestFinal(hDigest, pbDst, cbHash);
289 if (RT_FAILURE(rc))
290 return rc;
291 pbDst += cbHash;
292 Assert((size_t)(pbDst - &pThis->Scratch.abSignature[0]) == cbEncodedMsg);
293 return VINF_SUCCESS;
294}
295
296
297
298/** @impl_interface_method{RTCRPKIXSIGNATUREDESC,pfnVerify} */
299static DECLCALLBACK(int) rtCrPkixSignatureRsa_Verify(PCRTCRPKIXSIGNATUREDESC pDesc, void *pvState,
300 RTCRDIGEST hDigest, void const *pvSignature, size_t cbSignature)
301{
302 PRTCRPKIXSIGNATURERSA pThis = (PRTCRPKIXSIGNATURERSA)pvState;
303 RT_NOREF_PV(pDesc);
304 Assert(!pThis->fSigning);
305 if (cbSignature > sizeof(pThis->Scratch) / 2)
306 return VERR_CR_PKIX_SIGNATURE_TOO_LONG;
307
308 /*
309 * 8.2.2.1 - Length check.
310 */
311 if (cbSignature != RTBigNumByteWidth(&pThis->Modulus))
312 return VERR_CR_PKIX_INVALID_SIGNATURE_LENGTH;
313
314 /*
315 * 8.2.2.2 - RSA verification / Decrypt the signature.
316 */
317 /* a) s = OS2IP(S) -- Convert signature to integer. */
318 int rc = RTBigNumInit(&pThis->TmpBigNum1, RTBIGNUMINIT_F_ENDIAN_BIG | RTBIGNUMINIT_F_UNSIGNED,
319 pvSignature, cbSignature);
320 if (RT_FAILURE(rc))
321 return rc;
322 /* b) RSAVP1 - 5.2.2.2: Range check (0 <= s < n). */
323 if (RTBigNumCompare(&pThis->TmpBigNum1, &pThis->Modulus) < 0)
324 {
325 if (RTBigNumCompareWithU64(&pThis->TmpBigNum1, 0) >= 0)
326 {
327 /* b) RSAVP1 - 5.2.2.3: s^e mod n */
328 rc = RTBigNumInitZero(&pThis->TmpBigNum2, 0);
329 if (RT_SUCCESS(rc))
330 {
331 rc = RTBigNumModExp(&pThis->TmpBigNum2, &pThis->TmpBigNum1, &pThis->Exponent, &pThis->Modulus);
332 if (RT_SUCCESS(rc))
333 {
334 /* c) EM' = I2OSP(m, k) -- Convert the result to bytes. */
335 uint32_t cbDecrypted = RTBigNumByteWidth(&pThis->TmpBigNum2) + 1; /* 1 = leading zero byte */
336 if (cbDecrypted <= sizeof(pThis->Scratch) / 2)
337 {
338 uint8_t *pbDecrypted = &pThis->Scratch.abSignature[sizeof(pThis->Scratch) / 2];
339 rc = RTBigNumToBytesBigEndian(&pThis->TmpBigNum2, pbDecrypted, cbDecrypted);
340 if (RT_SUCCESS(rc))
341 {
342 /*
343 * 8.2.2.3 - Build a hopefully identical signature using hDigest.
344 */
345 rc = rtCrPkixSignatureRsa_EmsaPkcs1V15Encode(pThis, hDigest, cbDecrypted, false /* fNoDigestInfo */);
346 if (RT_SUCCESS(rc))
347 {
348 /*
349 * 8.2.2.4 - Compare the two.
350 */
351 if (memcmp(&pThis->Scratch.abSignature[0], pbDecrypted, cbDecrypted) == 0)
352 rc = VINF_SUCCESS;
353 else
354 {
355 /*
356 * Try again without digestinfo. This style signing has been
357 * observed in Vista timestamp counter signatures (Thawte).
358 */
359 rc = rtCrPkixSignatureRsa_EmsaPkcs1V15Encode(pThis, hDigest, cbDecrypted,
360 true /* fNoDigestInfo */);
361 if (RT_SUCCESS(rc))
362 {
363 if (memcmp(&pThis->Scratch.abSignature[0], pbDecrypted, cbDecrypted) == 0)
364 rc = VINF_SUCCESS;
365 else
366 rc = VERR_CR_PKIX_SIGNATURE_MISMATCH;
367 }
368 }
369 }
370 }
371 }
372 else
373 rc = VERR_CR_PKIX_SIGNATURE_TOO_LONG;
374 }
375 RTBigNumDestroy(&pThis->TmpBigNum2);
376 }
377 }
378 else
379 rc = VERR_CR_PKIX_SIGNATURE_NEGATIVE;
380 }
381 else
382 rc = VERR_CR_PKIX_SIGNATURE_GE_KEY;
383 RTBigNumDestroy(&pThis->TmpBigNum1);
384 return rc;
385}
386
387
388/** @impl_interface_method{RTCRPKIXSIGNATUREDESC,pfnSign} */
389static DECLCALLBACK(int) rtCrPkixSignatureRsa_Sign(PCRTCRPKIXSIGNATUREDESC pDesc, void *pvState,
390 RTCRDIGEST hDigest, void *pvSignature, size_t *pcbSignature)
391{
392 PRTCRPKIXSIGNATURERSA pThis = (PRTCRPKIXSIGNATURERSA)pvState;
393 RT_NOREF_PV(pDesc); RT_NOREF_PV(hDigest); RT_NOREF_PV(pvSignature); RT_NOREF_PV(pcbSignature);
394 Assert(pThis->fSigning); NOREF(pThis);
395 return VERR_NOT_IMPLEMENTED;
396}
397
398
399
400
401/** RSA alias ODIs. */
402static const char * const g_apszHashWithRsaAliases[] =
403{
404 RTCR_PKCS1_MD2_WITH_RSA_OID,
405 RTCR_PKCS1_MD4_WITH_RSA_OID,
406 RTCR_PKCS1_MD5_WITH_RSA_OID,
407 RTCR_PKCS1_SHA1_WITH_RSA_OID,
408 RTCR_PKCS1_SHA256_WITH_RSA_OID,
409 RTCR_PKCS1_SHA384_WITH_RSA_OID,
410 RTCR_PKCS1_SHA512_WITH_RSA_OID,
411 RTCR_PKCS1_SHA224_WITH_RSA_OID,
412 /* Note: Note quite sure about these OIW oddballs. */
413 "1.3.14.3.2.11" /* OIW rsaSignature */,
414 "1.3.14.3.2.14" /* OIW mdc2WithRSASignature */,
415 "1.3.14.3.2.15" /* OIW shaWithRSASignature */,
416 "1.3.14.3.2.24" /* OIW md2WithRSASignature */,
417 "1.3.14.3.2.25" /* OIW md5WithRSASignature */,
418 "1.3.14.3.2.29" /* OIW sha1WithRSASignature */,
419 NULL
420};
421
422
423/** RSA descriptor. */
424DECL_HIDDEN_CONST(RTCRPKIXSIGNATUREDESC const) g_rtCrPkixSigningHashWithRsaDesc =
425{
426 "RSASSA-PKCS1-v1_5",
427 RTCR_PKCS1_RSA_OID,
428 g_apszHashWithRsaAliases,
429 sizeof(RTCRPKIXSIGNATURERSA),
430 0,
431 0,
432 rtCrPkixSignatureRsa_Init,
433 rtCrPkixSignatureRsa_Reset,
434 rtCrPkixSignatureRsa_Delete,
435 rtCrPkixSignatureRsa_Verify,
436 rtCrPkixSignatureRsa_Sign,
437};
438
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette