pkix-signature-rsa.cpp@ 84251

Last change on this file since 84251 was 84251, checked in by vboxsync, 5 years ago
IPRT/crypto: Adding functions for checking whether a key or certificate can handle a given digest (size wise). Also, added OIDs, padding variants and stuff for sha512-224WithRSAEncryption and sha512-256WithRSAEncryption (RFC-8017). Note that OpenSSL does not implement these yet. [missed a couple sha512t* usages] bugref:9699
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 22.1 KB

Line
1	/* $Id: pkix-signature-rsa.cpp 84251 2020-05-11 12:00:59Z vboxsync $ */
2	/** @file
3	* IPRT - Crypto - Public Key Signature Schema Algorithm, RSA Providers.
4	*/
5
6	/*
7	* Copyright (C) 2006-2020 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* The contents of this file may alternatively be used under the terms
18	* of the Common Development and Distribution License Version 1.0
19	* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20	* VirtualBox OSE distribution, in which case the provisions of the
21	* CDDL are applicable instead of those of the GPL.
22	*
23	* You may elect to license modified versions of this file under the
24	* terms and conditions of either the GPL or the CDDL or both.
25	*/
26
27
28	/*********************************************************************************************************************************
29	* Header Files *
30	*********************************************************************************************************************************/
31	#include "internal/iprt.h"
32	#include <iprt/crypto/rsa.h>
33
34	#include <iprt/bignum.h>
35	#include <iprt/err.h>
36	#include <iprt/mem.h>
37	#include <iprt/string.h>
38	#include <iprt/crypto/digest.h>
39	#include <iprt/crypto/pkix.h>
40
41	#include "rsa-internal.h"
42	#include "pkix-signature-builtin.h"
43	#include "key-internal.h"
44
45
46	/*********************************************************************************************************************************
47	* Structures and Typedefs *
48	*********************************************************************************************************************************/
49	/**
50	* RSA signature provider instance.
51	*/
52	typedef struct RTCRPKIXSIGNATURERSA
53	{
54	/** Set if we're signing, clear if verifying. */
55	bool fSigning;
56
57	/** Temporary big number for use when signing or verifiying. */
58	RTBIGNUM TmpBigNum1;
59	/** Temporary big number for use when signing or verifiying. */
60	RTBIGNUM TmpBigNum2;
61
62	/** Scratch space for decoding the key. */
63	union
64	{
65	/** Public key. */
66	RTCRRSAPUBLICKEY PublicKey;
67	/** Private key. */
68	RTCRRSAPRIVATEKEY PrivateKey;
69	/** Scratch area where we assemble the signature. */
70	uint8_t abSignature[RTCRRSA_MAX_MODULUS_BITS / 8 * 2];
71	} Scratch;
72	} RTCRPKIXSIGNATURERSA;
73	/** Pointer to an RSA signature provider instance. */
74	typedef RTCRPKIXSIGNATURERSA *PRTCRPKIXSIGNATURERSA;
75
76
77	/*********************************************************************************************************************************
78	* Global Variables *
79	*********************************************************************************************************************************/
80	/** @name Pre-encoded DigestInfo DER sequences.
81	* @{ */
82	static const uint8_t g_abMd2[] =
83	{/* { { 1.2.840.113549.2.2 (MD2), NULL }, hash octet-string } */
84	0x30,0x20, 0x30,0x0c, 0x06,0x08,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x02,0x02, 0x05,0x00, 0x04,0x10
85	};
86	static const uint8_t g_abMd4[] =
87	{/* { { 1.2.840.113549.2.4 (MD4), NULL }, hash octet-string } */
88	0x30,0x20, 0x30,0x0c, 0x06,0x08,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x02,0x04, 0x05,0x00, 0x04,0x10
89	};
90	static const uint8_t g_abMd5[] =
91	{/* { { 1.2.840.113549.2.5 (MD5), NULL }, hash octet-string } */
92	0x30,0x20, 0x30,0x0c, 0x06,0x08,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x02,0x05, 0x05,0x00, 0x04,0x10
93	};
94	static const uint8_t g_abSha1[] =
95	{/* { { 1.3.14.3.2.26 (SHA-1), NULL }, hash octet-string } */
96	0x30,0x21, 0x30,0x09, 0x06,0x05,0x2b,0x0e,0x03,0x02,0x1a, 0x05,0x00, 0x04,0x14
97	};
98	static const uint8_t g_abSha256[] =
99	{/* { { 2.16.840.1.101.3.4.2.1 (SHA-256), NULL }, hash octet-string } */
100	0x30,0x31, 0x30,0x0d, 0x06,0x09,0x60,0x86,0x48,0x01,0x65,0x03,0x04,0x02,0x01, 0x05,0x00, 0x04,0x20
101	};
102	static const uint8_t g_abSha384[] =
103	{/* { { 2.16.840.1.101.3.4.2.2 (SHA-384), NULL }, hash octet-string } */
104	0x30,0x41, 0x30,0x0d, 0x06,0x09,0x60,0x86,0x48,0x01,0x65,0x03,0x04,0x02,0x02, 0x05,0x00, 0x04,0x30
105	};
106	static const uint8_t g_abSha512[] =
107	{/* { { 2.16.840.1.101.3.4.2.3 (SHA-512), NULL }, hash octet-string } */
108	0x30,0x51, 0x30,0x0d, 0x06,0x09,0x60,0x86,0x48,0x01,0x65,0x03,0x04,0x02,0x03, 0x05,0x00, 0x04,0x40
109	};
110	static const uint8_t g_abSha224[] =
111	{/* { { 2.16.840.1.101.3.4.2.4 (SHA-224), NULL }, hash octet-string } */
112	0x30,0x2d, 0x30,0x0d, 0x06,0x09,0x60,0x86,0x48,0x01,0x65,0x03,0x04,0x02,0x04, 0x05,0x00, 0x04,0x1c
113	};
114	static const uint8_t g_abSha512T224[] =
115	{/* { { 2.16.840.1.101.3.4.2.5 (SHA-512T224), NULL }, hash octet-string } */
116	0x30,0x2d, 0x30,0x0d, 0x06,0x09,0x60,0x86,0x48,0x01,0x65,0x03,0x04,0x02,0x05, 0x05,0x00, 0x04,0x1c
117	};
118	static const uint8_t g_abSha512T256[] =
119	{/* { { 2.16.840.1.101.3.4.2.6 (SHA-512T256), NULL }, hash octet-string } */
120	0x30,0x31, 0x30,0x0d, 0x06,0x09,0x60,0x86,0x48,0x01,0x65,0x03,0x04,0x02,0x06, 0x05,0x00, 0x04,0x20
121	};
122	/** @} */
123
124	/** Lookup array for the pre-encoded DigestInfo DER sequences. */
125	static struct
126	{
127	RTDIGESTTYPE enmDigest;
128	const uint8_t *pb;
129	size_t cb;
130	} const g_aDigestInfos[] =
131	{
132	{ RTDIGESTTYPE_SHA1, g_abSha1, sizeof(g_abSha1) },
133	{ RTDIGESTTYPE_SHA256, g_abSha256, sizeof(g_abSha256) },
134	{ RTDIGESTTYPE_SHA512, g_abSha512, sizeof(g_abSha512) },
135	{ RTDIGESTTYPE_MD2, g_abMd2, sizeof(g_abMd2) },
136	{ RTDIGESTTYPE_MD4, g_abMd4, sizeof(g_abMd4) },
137	{ RTDIGESTTYPE_MD5, g_abMd5, sizeof(g_abMd5) },
138	{ RTDIGESTTYPE_SHA384, g_abSha384, sizeof(g_abSha384) },
139	{ RTDIGESTTYPE_SHA224, g_abSha224, sizeof(g_abSha224) },
140	{ RTDIGESTTYPE_SHA512T224, g_abSha512T224, sizeof(g_abSha512T224)},
141	{ RTDIGESTTYPE_SHA512T256, g_abSha512T256, sizeof(g_abSha512T256)},
142	};
143
144
145	/** @impl_interface_method{RTCRPKIXSIGNATUREDESC,pfnInit} */
146	static DECLCALLBACK(int) rtCrPkixSignatureRsa_Init(PCRTCRPKIXSIGNATUREDESC pDesc, void pvState, void pvOpaque,
147	bool fSigning, RTCRKEY hKey, PCRTASN1DYNTYPE pParams)
148	{
149	RT_NOREF_PV(pDesc); RT_NOREF_PV(pvState); RT_NOREF_PV(pvOpaque);
150
151	if (pParams)
152	return VERR_CR_PKIX_SIGNATURE_TAKES_NO_PARAMETERS;
153
154	RTCRKEYTYPE enmKeyType = RTCrKeyGetType(hKey);
155	if (fSigning)
156	AssertReturn(enmKeyType == RTCRKEYTYPE_RSA_PRIVATE, VERR_CR_PKIX_NOT_RSA_PRIVATE_KEY);
157	else
158	AssertReturn(enmKeyType == RTCRKEYTYPE_RSA_PUBLIC, VERR_CR_PKIX_NOT_RSA_PUBLIC_KEY);
159
160	PRTCRPKIXSIGNATURERSA pThis = (PRTCRPKIXSIGNATURERSA)pvState;
161	pThis->fSigning = fSigning;
162
163	return VINF_SUCCESS;
164	}
165
166
167	/** @impl_interface_method{RTCRPKIXSIGNATUREDESC,pfnReset} */
168	static DECLCALLBACK(int) rtCrPkixSignatureRsa_Reset(PCRTCRPKIXSIGNATUREDESC pDesc, void *pvState, bool fSigning)
169	{
170	PRTCRPKIXSIGNATURERSA pThis = (PRTCRPKIXSIGNATURERSA)pvState;
171	RT_NOREF_PV(fSigning); RT_NOREF_PV(pDesc);
172	Assert(pThis->fSigning == fSigning); NOREF(pThis);
173	return VINF_SUCCESS;
174	}
175
176
177	/** @impl_interface_method{RTCRPKIXSIGNATUREDESC,pfnDelete} */
178	static DECLCALLBACK(void) rtCrPkixSignatureRsa_Delete(PCRTCRPKIXSIGNATUREDESC pDesc, void *pvState, bool fSigning)
179	{
180	PRTCRPKIXSIGNATURERSA pThis = (PRTCRPKIXSIGNATURERSA)pvState;
181	RT_NOREF_PV(fSigning); RT_NOREF_PV(pDesc);
182	Assert(pThis->fSigning == fSigning);
183	NOREF(pThis);
184	}
185
186
187	/**
188	* Common worker for rtCrPkixSignatureRsa_Verify and
189	* rtCrPkixSignatureRsa_Sign that encodes an EMSA-PKCS1-V1_5 signature in
190	* the scratch area.
191	*
192	* This function is referred to as EMSA-PKCS1-v1_5-ENCODE(M,k) in RFC-3447 and
193	* is described in section 9.2
194	*
195	* @returns IPRT status code.
196	* @param pThis The RSA signature provider instance.
197	* @param hDigest The digest which hash to turn into a signature.
198	* @param cbEncodedMsg The desired encoded message length.
199	* @param fNoDigestInfo If true, skip the DigestInfo and encode the digest
200	* without any prefix like described in v1.5 (RFC-2313)
201	* and observed with RSA+MD5 signed timestamps. If
202	* false, include the prefix like v2.0 (RFC-2437)
203	* describes in step in section 9.2.1
204	* (EMSA-PKCS1-v1_5)
205	*
206	* @remarks Must preserve informational status codes!
207	*/
208	static int rtCrPkixSignatureRsa_EmsaPkcs1V15Encode(PRTCRPKIXSIGNATURERSA pThis, RTCRDIGEST hDigest, size_t cbEncodedMsg,
209	bool fNoDigestInfo)
210	{
211	AssertReturn(cbEncodedMsg * 2 <= sizeof(pThis->Scratch), VERR_CR_PKIX_INTERNAL_ERROR);
212
213	/*
214	* Figure out which hash and select the associate prebaked DigestInfo.
215	*/
216	RTDIGESTTYPE const enmDigest = RTCrDigestGetType(hDigest);
217	AssertReturn(enmDigest != RTDIGESTTYPE_INVALID && enmDigest != RTDIGESTTYPE_UNKNOWN, VERR_CR_PKIX_UNKNOWN_DIGEST_TYPE);
218	uint8_t const *pbDigestInfoStart = NULL;
219	size_t cbDigestInfoStart = 0;
220	for (uint32_t i = 0; i < RT_ELEMENTS(g_aDigestInfos); i++)
221	if (g_aDigestInfos[i].enmDigest == enmDigest)
222	{
223	pbDigestInfoStart = g_aDigestInfos[i].pb;
224	cbDigestInfoStart = g_aDigestInfos[i].cb;
225	break;
226	}
227	if (!pbDigestInfoStart)
228	return VERR_CR_PKIX_UNKNOWN_DIGEST_TYPE;
229
230	/*
231	* Get the hash size and verify that it matches what we've got in the
232	* precooked DigestInfo. ASSUMES less that 256 bytes of hash.
233	*/
234	uint32_t const cbHash = RTCrDigestGetHashSize(hDigest);
235	AssertReturn(cbHash > 0 && cbHash < _16K, VERR_OUT_OF_RANGE);
236	AssertReturn(cbHash == pbDigestInfoStart[cbDigestInfoStart - 1], VERR_CR_PKIX_INTERNAL_ERROR);
237
238	if (fNoDigestInfo)
239	cbDigestInfoStart = 0;
240
241	if (cbDigestInfoStart + cbHash + 11 > cbEncodedMsg)
242	return VERR_CR_PKIX_HASH_TOO_LONG_FOR_KEY;
243
244	/*
245	* Encode the message the first part of the scratch area.
246	*/
247	uint8_t *pbDst = &pThis->Scratch.abSignature[0];
248	pbDst[0] = 0x00;
249	pbDst[1] = 0x01; /* BT - block type, see RFC-2313. */
250	size_t cbFFs = cbEncodedMsg - cbHash - cbDigestInfoStart - 3;
251	memset(&pbDst[2], 0xff, cbFFs);
252	pbDst += cbFFs + 2;
253	*pbDst++ = 0x00;
254	memcpy(pbDst, pbDigestInfoStart, cbDigestInfoStart);
255	pbDst += cbDigestInfoStart;
256	/* Note! Must preserve informational status codes from this call . */
257	int rc = RTCrDigestFinal(hDigest, pbDst, cbHash);
258	if (RT_SUCCESS(rc))
259	{
260	pbDst += cbHash;
261	Assert((size_t)(pbDst - &pThis->Scratch.abSignature[0]) == cbEncodedMsg);
262	}
263	return rc;
264	}
265
266
267
268	/** @impl_interface_method{RTCRPKIXSIGNATUREDESC,pfnVerify} */
269	static DECLCALLBACK(int) rtCrPkixSignatureRsa_Verify(PCRTCRPKIXSIGNATUREDESC pDesc, void *pvState, RTCRKEY hKey,
270	RTCRDIGEST hDigest, void const *pvSignature, size_t cbSignature)
271	{
272	PRTCRPKIXSIGNATURERSA pThis = (PRTCRPKIXSIGNATURERSA)pvState;
273	RT_NOREF_PV(pDesc);
274	Assert(!pThis->fSigning);
275	if (cbSignature > sizeof(pThis->Scratch) / 2)
276	return VERR_CR_PKIX_SIGNATURE_TOO_LONG;
277
278	/*
279	* Get the key bits we need.
280	*/
281	Assert(RTCrKeyGetType(hKey) == RTCRKEYTYPE_RSA_PUBLIC);
282	PRTBIGNUM pModulus = &hKey->u.RsaPublic.Modulus;
283	PRTBIGNUM pExponent = &hKey->u.RsaPublic.Exponent;
284
285	/*
286	* 8.2.2.1 - Length check. (RFC-3447)
287	*/
288	if (cbSignature != RTBigNumByteWidth(pModulus))
289	return VERR_CR_PKIX_INVALID_SIGNATURE_LENGTH;
290
291	/*
292	* 8.2.2.2 - RSA verification / Decrypt the signature.
293	*/
294	/* a) s = OS2IP(S) -- Convert signature to integer. */
295	int rc = RTBigNumInit(&pThis->TmpBigNum1, RTBIGNUMINIT_F_ENDIAN_BIG \| RTBIGNUMINIT_F_UNSIGNED,
296	pvSignature, cbSignature);
297	if (RT_FAILURE(rc))
298	return rc;
299	/* b) RSAVP1 - 5.2.2.2: Range check (0 <= s < n). */
300	if (RTBigNumCompare(&pThis->TmpBigNum1, pModulus) < 0)
301	{
302	if (RTBigNumCompareWithU64(&pThis->TmpBigNum1, 0) >= 0)
303	{
304	/* b) RSAVP1 - 5.2.2.3: s^e mod n */
305	rc = RTBigNumInitZero(&pThis->TmpBigNum2, 0);
306	if (RT_SUCCESS(rc))
307	{
308	rc = RTBigNumModExp(&pThis->TmpBigNum2, &pThis->TmpBigNum1, pExponent, pModulus);
309	if (RT_SUCCESS(rc))
310	{
311	/* c) EM' = I2OSP(m, k) -- Convert the result to bytes. */
312	uint32_t cbDecrypted = RTBigNumByteWidth(&pThis->TmpBigNum2) + 1; /* 1 = leading zero byte */
313	if (cbDecrypted <= sizeof(pThis->Scratch) / 2)
314	{
315	uint8_t *pbDecrypted = &pThis->Scratch.abSignature[sizeof(pThis->Scratch) / 2];
316	rc = RTBigNumToBytesBigEndian(&pThis->TmpBigNum2, pbDecrypted, cbDecrypted);
317	if (RT_SUCCESS(rc))
318	{
319	/*
320	* 8.2.2.3 - Build a hopefully identical signature using hDigest.
321	*/
322	rc = rtCrPkixSignatureRsa_EmsaPkcs1V15Encode(pThis, hDigest, cbDecrypted, false /* fNoDigestInfo */);
323	if (RT_SUCCESS(rc))
324	{
325	/*
326	* 8.2.2.4 - Compare the two.
327	*/
328	if (memcmp(&pThis->Scratch.abSignature[0], pbDecrypted, cbDecrypted) == 0)
329	{ /* No rc = VINF_SUCCESS here, mustpreserve informational status codes from digest. */ }
330	else
331	{
332	/*
333	* Try again without digestinfo. This style signing has been
334	* observed in Vista timestamp counter signatures (Thawte).
335	*/
336	rc = rtCrPkixSignatureRsa_EmsaPkcs1V15Encode(pThis, hDigest, cbDecrypted,
337	true /* fNoDigestInfo */);
338	if (RT_SUCCESS(rc))
339	{
340	if (memcmp(&pThis->Scratch.abSignature[0], pbDecrypted, cbDecrypted) == 0)
341	{ /* No rc = VINF_SUCCESS here, mustpreserve informational status codes from digest. */ }
342	else
343	rc = VERR_CR_PKIX_SIGNATURE_MISMATCH;
344	}
345	}
346	}
347	}
348	}
349	else
350	rc = VERR_CR_PKIX_SIGNATURE_TOO_LONG;
351	}
352	RTBigNumDestroy(&pThis->TmpBigNum2);
353	}
354	}
355	else
356	rc = VERR_CR_PKIX_SIGNATURE_NEGATIVE;
357	}
358	else
359	rc = VERR_CR_PKIX_SIGNATURE_GE_KEY;
360	RTBigNumDestroy(&pThis->TmpBigNum1);
361	return rc;
362	}
363
364
365	/** @impl_interface_method{RTCRPKIXSIGNATUREDESC,pfnSign} */
366	static DECLCALLBACK(int) rtCrPkixSignatureRsa_Sign(PCRTCRPKIXSIGNATUREDESC pDesc, void *pvState, RTCRKEY hKey,
367	RTCRDIGEST hDigest, void pvSignature, size_t pcbSignature)
368	{
369	PRTCRPKIXSIGNATURERSA pThis = (PRTCRPKIXSIGNATURERSA)pvState;
370	RT_NOREF_PV(pDesc);
371	Assert(pThis->fSigning);
372
373	/*
374	* Get the key bits we need.
375	*/
376	Assert(RTCrKeyGetType(hKey) == RTCRKEYTYPE_RSA_PRIVATE);
377	PRTBIGNUM pModulus = &hKey->u.RsaPrivate.Modulus;
378	PRTBIGNUM pExponent = &hKey->u.RsaPrivate.PrivateExponent;
379
380	/*
381	* Calc signature length and return if destination buffer isn't big enough.
382	*/
383	size_t const cbDst = *pcbSignature;
384	size_t const cbEncodedMsg = RTBigNumByteWidth(pModulus);
385	*pcbSignature = cbEncodedMsg;
386	if (cbEncodedMsg > sizeof(pThis->Scratch) / 2)
387	return VERR_CR_PKIX_SIGNATURE_TOO_LONG;
388	if (!pvSignature \|\| cbDst < cbEncodedMsg)
389	return VERR_BUFFER_OVERFLOW;
390
391	/*
392	* 8.1.1.1 - EMSA-PSS encoding. (RFC-3447)
393	*/
394	int rcRetSuccess;
395	int rc = rcRetSuccess = rtCrPkixSignatureRsa_EmsaPkcs1V15Encode(pThis, hDigest, cbEncodedMsg, false /* fNoDigestInfo */);
396	if (RT_SUCCESS(rc))
397	{
398	/*
399	* 8.1.1.2 - RSA signature.
400	*/
401	/* a) m = OS2IP(EM) -- Convert the encoded message (EM) to integer. */
402	rc = RTBigNumInit(&pThis->TmpBigNum1, RTBIGNUMINIT_F_ENDIAN_BIG \| RTBIGNUMINIT_F_UNSIGNED,
403	pThis->Scratch.abSignature, cbEncodedMsg);
404	if (RT_SUCCESS(rc))
405	{
406	/* b) s = RSASP1(K, m = EM) - 5.2.1.1: Range check (0 <= m < n). */
407	if (RTBigNumCompare(&pThis->TmpBigNum1, pModulus) < 0)
408	{
409	/* b) s = RSAVP1(K, m = EM) - 5.2.1.2.a: s = m^d mod n */
410	rc = RTBigNumInitZero(&pThis->TmpBigNum2, 0);
411	if (RT_SUCCESS(rc))
412	{
413	rc = RTBigNumModExp(&pThis->TmpBigNum2, &pThis->TmpBigNum1, pExponent, pModulus);
414	if (RT_SUCCESS(rc))
415	{
416	/* c) S = I2OSP(s, k) -- Convert the result to bytes. */
417	rc = RTBigNumToBytesBigEndian(&pThis->TmpBigNum2, pvSignature, cbEncodedMsg);
418	AssertStmt(RT_SUCCESS(rc) \|\| rc != VERR_BUFFER_OVERFLOW, rc = VERR_CR_PKIX_INTERNAL_ERROR);
419
420	/* Make sure we return the informational status code from the digest on success. */
421	if (rc == VINF_SUCCESS && rcRetSuccess != VINF_SUCCESS)
422	rc = rcRetSuccess;
423	}
424	RTBigNumDestroy(&pThis->TmpBigNum2);
425	}
426	}
427	else
428	rc = VERR_CR_PKIX_SIGNATURE_GE_KEY;
429	RTBigNumDestroy(&pThis->TmpBigNum1);
430	}
431	}
432	return rc;
433	}
434
435
436
437
438	/** RSA alias ODIs. */
439	static const char * const g_apszHashWithRsaAliases[] =
440	{
441	RTCR_PKCS1_MD2_WITH_RSA_OID,
442	RTCR_PKCS1_MD4_WITH_RSA_OID,
443	RTCR_PKCS1_MD5_WITH_RSA_OID,
444	RTCR_PKCS1_SHA1_WITH_RSA_OID,
445	RTCR_PKCS1_SHA256_WITH_RSA_OID,
446	RTCR_PKCS1_SHA384_WITH_RSA_OID,
447	RTCR_PKCS1_SHA512_WITH_RSA_OID,
448	RTCR_PKCS1_SHA224_WITH_RSA_OID,
449	RTCR_PKCS1_SHA512T224_WITH_RSA_OID,
450	RTCR_PKCS1_SHA512T256_WITH_RSA_OID,
451	/* Note: Note quite sure about these OIW oddballs. */
452	"1.3.14.3.2.11" /* OIW rsaSignature */,
453	"1.3.14.3.2.14" /* OIW mdc2WithRSASignature */,
454	"1.3.14.3.2.15" /* OIW shaWithRSASignature */,
455	"1.3.14.3.2.24" /* OIW md2WithRSASignature */,
456	"1.3.14.3.2.25" /* OIW md5WithRSASignature */,
457	"1.3.14.3.2.29" /* OIW sha1WithRSASignature */,
458	NULL
459	};
460
461
462	/** RSA descriptor. */
463	DECL_HIDDEN_CONST(RTCRPKIXSIGNATUREDESC const) g_rtCrPkixSigningHashWithRsaDesc =
464	{
465	"RSASSA-PKCS1-v1_5",
466	RTCR_PKCS1_RSA_OID,
467	g_apszHashWithRsaAliases,
468	sizeof(RTCRPKIXSIGNATURERSA),
469	0,
470	0,
471	rtCrPkixSignatureRsa_Init,
472	rtCrPkixSignatureRsa_Reset,
473	rtCrPkixSignatureRsa_Delete,
474	rtCrPkixSignatureRsa_Verify,
475	rtCrPkixSignatureRsa_Sign,
476	};
477
478
479	/**
480	* Worker for RTCrRsaPublicKey_CanHandleDigestType and
481	* RTCrRsaPrivateKey_CanHandleDigestType.
482	*
483	* We implement these two functions here because we've already got the
484	* DigestInfo sizes nicely lined up here.
485	*/
486	static bool rtCrRsa_CanHandleDigestType(int32_t cModulusBits, RTDIGESTTYPE enmDigestType, PRTERRINFO pErrInfo)
487	{
488	/*
489	* ASSUME EMSA-PKCS1-v1_5 padding scheme (RFC-8017 section 9.2):
490	* - 11 byte padding prefix (00, 01, 8 times ff)
491	* - digest info der sequence for rsaWithXxxxEncryption
492	* - the hash value.
493	*/
494	for (uint32_t i = 0; i < RT_ELEMENTS(g_aDigestInfos); i++)
495	if (g_aDigestInfos[i].enmDigest == enmDigestType)
496	{
497	size_t const cbHash = RTCrDigestTypeToHashSize(enmDigestType);
498	AssertBreak(cbHash > 0);
499
500	size_t cbMsg = 11 + g_aDigestInfos[i].cb + cbHash;
501	if ((ssize_t)cbMsg <= cModulusBits / 8)
502	return true;
503	RTErrInfoSetF(pErrInfo, VERR_CR_PKIX_INVALID_SIGNATURE_LENGTH, "cModulusBits=%d cbMsg=%u", cModulusBits, cbMsg);
504	return false;
505	}
506	RTErrInfoSetF(pErrInfo, VERR_CR_PKIX_UNKNOWN_DIGEST_TYPE, "%s", RTCrDigestTypeToName(enmDigestType));
507	return false;
508	}
509
510
511	RTDECL(bool) RTCrRsaPublicKey_CanHandleDigestType(PCRTCRRSAPUBLICKEY pRsaPublicKey, RTDIGESTTYPE enmDigestType,
512	PRTERRINFO pErrInfo)
513	{
514	if (RTCrRsaPublicKey_IsPresent(pRsaPublicKey))
515	return rtCrRsa_CanHandleDigestType(RTAsn1Integer_UnsignedLastBit(&pRsaPublicKey->Modulus) + 1, enmDigestType, pErrInfo);
516	return false;
517	}
518
519
520	RTDECL(bool) RTCrRsaPrivateKey_CanHandleDigestType(PCRTCRRSAPRIVATEKEY pRsaPrivateKey, RTDIGESTTYPE enmDigestType,
521	PRTERRINFO pErrInfo)
522	{
523	if (RTCrRsaPrivateKey_IsPresent(pRsaPrivateKey))
524	return rtCrRsa_CanHandleDigestType(RTAsn1Integer_UnsignedLastBit(&pRsaPrivateKey->Modulus) + 1, enmDigestType, pErrInfo);
525	return false;
526	}
527

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Runtime/common/crypto/pkix-signature-rsa.cpp@ 84251

Download in other formats: