rsa_sig.c@ 94320

Last change on this file since 94320 was 94320, checked in by vboxsync, 3 years ago
libs/openssl-3.0.1: Export to OSE and fix copyright headers in Makefiles, bugref:10128
File size: 48.8 KB

Line
1	/*
2	* Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
3	*
4	* Licensed under the Apache License 2.0 (the "License"). You may not use
5	* this file except in compliance with the License. You can obtain a copy
6	* in the file LICENSE in the source distribution or at
7	* https://www.openssl.org/source/license.html
8	*/
9
10	/*
11	* RSA low level APIs are deprecated for public use, but still ok for
12	* internal use.
13	*/
14	#include "internal/deprecated.h"
15
16	#include "e_os.h" /* strcasecmp */
17	#include <string.h>
18	#include <openssl/crypto.h>
19	#include <openssl/core_dispatch.h>
20	#include <openssl/core_names.h>
21	#include <openssl/err.h>
22	#include <openssl/rsa.h>
23	#include <openssl/params.h>
24	#include <openssl/evp.h>
25	#include <openssl/proverr.h>
26	#include "internal/cryptlib.h"
27	#include "internal/nelem.h"
28	#include "internal/sizes.h"
29	#include "crypto/rsa.h"
30	#include "prov/providercommon.h"
31	#include "prov/implementations.h"
32	#include "prov/provider_ctx.h"
33	#include "prov/der_rsa.h"
34	#include "prov/securitycheck.h"
35
36	#define RSA_DEFAULT_DIGEST_NAME OSSL_DIGEST_NAME_SHA1
37
38	static OSSL_FUNC_signature_newctx_fn rsa_newctx;
39	static OSSL_FUNC_signature_sign_init_fn rsa_sign_init;
40	static OSSL_FUNC_signature_verify_init_fn rsa_verify_init;
41	static OSSL_FUNC_signature_verify_recover_init_fn rsa_verify_recover_init;
42	static OSSL_FUNC_signature_sign_fn rsa_sign;
43	static OSSL_FUNC_signature_verify_fn rsa_verify;
44	static OSSL_FUNC_signature_verify_recover_fn rsa_verify_recover;
45	static OSSL_FUNC_signature_digest_sign_init_fn rsa_digest_sign_init;
46	static OSSL_FUNC_signature_digest_sign_update_fn rsa_digest_signverify_update;
47	static OSSL_FUNC_signature_digest_sign_final_fn rsa_digest_sign_final;
48	static OSSL_FUNC_signature_digest_verify_init_fn rsa_digest_verify_init;
49	static OSSL_FUNC_signature_digest_verify_update_fn rsa_digest_signverify_update;
50	static OSSL_FUNC_signature_digest_verify_final_fn rsa_digest_verify_final;
51	static OSSL_FUNC_signature_freectx_fn rsa_freectx;
52	static OSSL_FUNC_signature_dupctx_fn rsa_dupctx;
53	static OSSL_FUNC_signature_get_ctx_params_fn rsa_get_ctx_params;
54	static OSSL_FUNC_signature_gettable_ctx_params_fn rsa_gettable_ctx_params;
55	static OSSL_FUNC_signature_set_ctx_params_fn rsa_set_ctx_params;
56	static OSSL_FUNC_signature_settable_ctx_params_fn rsa_settable_ctx_params;
57	static OSSL_FUNC_signature_get_ctx_md_params_fn rsa_get_ctx_md_params;
58	static OSSL_FUNC_signature_gettable_ctx_md_params_fn rsa_gettable_ctx_md_params;
59	static OSSL_FUNC_signature_set_ctx_md_params_fn rsa_set_ctx_md_params;
60	static OSSL_FUNC_signature_settable_ctx_md_params_fn rsa_settable_ctx_md_params;
61
62	static OSSL_ITEM padding_item[] = {
63	{ RSA_PKCS1_PADDING, OSSL_PKEY_RSA_PAD_MODE_PKCSV15 },
64	{ RSA_NO_PADDING, OSSL_PKEY_RSA_PAD_MODE_NONE },
65	{ RSA_X931_PADDING, OSSL_PKEY_RSA_PAD_MODE_X931 },
66	{ RSA_PKCS1_PSS_PADDING, OSSL_PKEY_RSA_PAD_MODE_PSS },
67	{ 0, NULL }
68	};
69
70	/*
71	* What's passed as an actual key is defined by the KEYMGMT interface.
72	* We happen to know that our KEYMGMT simply passes RSA structures, so
73	* we use that here too.
74	*/
75
76	typedef struct {
77	OSSL_LIB_CTX *libctx;
78	char *propq;
79	RSA *rsa;
80	int operation;
81
82	/*
83	* Flag to determine if the hash function can be changed (1) or not (0)
84	* Because it's dangerous to change during a DigestSign or DigestVerify
85	* operation, this flag is cleared by their Init function, and set again
86	* by their Final function.
87	*/
88	unsigned int flag_allow_md : 1;
89	unsigned int mgf1_md_set : 1;
90
91	/* main digest */
92	EVP_MD *md;
93	EVP_MD_CTX *mdctx;
94	int mdnid;
95	char mdname[OSSL_MAX_NAME_SIZE]; /* Purely informational */
96
97	/* RSA padding mode */
98	int pad_mode;
99	/* message digest for MGF1 */
100	EVP_MD *mgf1_md;
101	int mgf1_mdnid;
102	char mgf1_mdname[OSSL_MAX_NAME_SIZE]; /* Purely informational */
103	/* PSS salt length */
104	int saltlen;
105	/* Minimum salt length or -1 if no PSS parameter restriction */
106	int min_saltlen;
107
108	/* Temp buffer */
109	unsigned char *tbuf;
110
111	} PROV_RSA_CTX;
112
113	/* True if PSS parameters are restricted */
114	#define rsa_pss_restricted(prsactx) (prsactx->min_saltlen != -1)
115
116	static size_t rsa_get_md_size(const PROV_RSA_CTX *prsactx)
117	{
118	if (prsactx->md != NULL)
119	return EVP_MD_get_size(prsactx->md);
120	return 0;
121	}
122
123	static int rsa_check_padding(const PROV_RSA_CTX *prsactx,
124	const char mdname, const char mgf1_mdname,
125	int mdnid)
126	{
127	switch(prsactx->pad_mode) {
128	case RSA_NO_PADDING:
129	if (mdname != NULL \|\| mdnid != NID_undef) {
130	ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_PADDING_MODE);
131	return 0;
132	}
133	break;
134	case RSA_X931_PADDING:
135	if (RSA_X931_hash_id(mdnid) == -1) {
136	ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_X931_DIGEST);
137	return 0;
138	}
139	break;
140	case RSA_PKCS1_PSS_PADDING:
141	if (rsa_pss_restricted(prsactx))
142	if ((mdname != NULL && !EVP_MD_is_a(prsactx->md, mdname))
143	\|\| (mgf1_mdname != NULL
144	&& !EVP_MD_is_a(prsactx->mgf1_md, mgf1_mdname))) {
145	ERR_raise(ERR_LIB_PROV, PROV_R_DIGEST_NOT_ALLOWED);
146	return 0;
147	}
148	break;
149	default:
150	break;
151	}
152
153	return 1;
154	}
155
156	static int rsa_check_parameters(PROV_RSA_CTX *prsactx, int min_saltlen)
157	{
158	if (prsactx->pad_mode == RSA_PKCS1_PSS_PADDING) {
159	int max_saltlen;
160
161	/* See if minimum salt length exceeds maximum possible */
162	max_saltlen = RSA_size(prsactx->rsa) - EVP_MD_get_size(prsactx->md);
163	if ((RSA_bits(prsactx->rsa) & 0x7) == 1)
164	max_saltlen--;
165	if (min_saltlen < 0 \|\| min_saltlen > max_saltlen) {
166	ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_SALT_LENGTH);
167	return 0;
168	}
169	prsactx->min_saltlen = min_saltlen;
170	}
171	return 1;
172	}
173
174	static void rsa_newctx(void provctx, const char *propq)
175	{
176	PROV_RSA_CTX *prsactx = NULL;
177	char *propq_copy = NULL;
178
179	if (!ossl_prov_is_running())
180	return NULL;
181
182	if ((prsactx = OPENSSL_zalloc(sizeof(PROV_RSA_CTX))) == NULL
183	\|\| (propq != NULL
184	&& (propq_copy = OPENSSL_strdup(propq)) == NULL)) {
185	OPENSSL_free(prsactx);
186	ERR_raise(ERR_LIB_PROV, ERR_R_MALLOC_FAILURE);
187	return NULL;
188	}
189
190	prsactx->libctx = PROV_LIBCTX_OF(provctx);
191	prsactx->flag_allow_md = 1;
192	prsactx->propq = propq_copy;
193	/* Maximum for sign, auto for verify */
194	prsactx->saltlen = RSA_PSS_SALTLEN_AUTO;
195	prsactx->min_saltlen = -1;
196	return prsactx;
197	}
198
199	static int rsa_pss_compute_saltlen(PROV_RSA_CTX *ctx)
200	{
201	int saltlen = ctx->saltlen;
202
203	if (saltlen == RSA_PSS_SALTLEN_DIGEST) {
204	saltlen = EVP_MD_get_size(ctx->md);
205	} else if (saltlen == RSA_PSS_SALTLEN_AUTO \|\| saltlen == RSA_PSS_SALTLEN_MAX) {
206	saltlen = RSA_size(ctx->rsa) - EVP_MD_get_size(ctx->md) - 2;
207	if ((RSA_bits(ctx->rsa) & 0x7) == 1)
208	saltlen--;
209	}
210	if (saltlen < 0) {
211	ERR_raise(ERR_LIB_PROV, ERR_R_INTERNAL_ERROR);
212	return -1;
213	} else if (saltlen < ctx->min_saltlen) {
214	ERR_raise_data(ERR_LIB_PROV, PROV_R_PSS_SALTLEN_TOO_SMALL,
215	"minimum salt length: %d, actual salt length: %d",
216	ctx->min_saltlen, saltlen);
217	return -1;
218	}
219	return saltlen;
220	}
221
222	static unsigned char rsa_generate_signature_aid(PROV_RSA_CTX ctx,
223	unsigned char *aid_buf,
224	size_t buf_len,
225	size_t *aid_len)
226	{
227	WPACKET pkt;
228	unsigned char *aid = NULL;
229	int saltlen;
230	RSA_PSS_PARAMS_30 pss_params;
231	int ret;
232
233	if (!WPACKET_init_der(&pkt, aid_buf, buf_len)) {
234	ERR_raise(ERR_LIB_PROV, ERR_R_MALLOC_FAILURE);
235	return NULL;
236	}
237
238	switch(ctx->pad_mode) {
239	case RSA_PKCS1_PADDING:
240	ret = ossl_DER_w_algorithmIdentifier_MDWithRSAEncryption(&pkt, -1,
241	ctx->mdnid);
242
243	if (ret > 0) {
244	break;
245	} else if (ret == 0) {
246	ERR_raise(ERR_LIB_PROV, ERR_R_INTERNAL_ERROR);
247	goto cleanup;
248	}
249	ERR_raise_data(ERR_LIB_PROV, ERR_R_UNSUPPORTED,
250	"Algorithm ID generation - md NID: %d",
251	ctx->mdnid);
252	goto cleanup;
253	case RSA_PKCS1_PSS_PADDING:
254	saltlen = rsa_pss_compute_saltlen(ctx);
255	if (saltlen < 0)
256	goto cleanup;
257	if (!ossl_rsa_pss_params_30_set_defaults(&pss_params)
258	\|\| !ossl_rsa_pss_params_30_set_hashalg(&pss_params, ctx->mdnid)
259	\|\| !ossl_rsa_pss_params_30_set_maskgenhashalg(&pss_params,
260	ctx->mgf1_mdnid)
261	\|\| !ossl_rsa_pss_params_30_set_saltlen(&pss_params, saltlen)
262	\|\| !ossl_DER_w_algorithmIdentifier_RSA_PSS(&pkt, -1,
263	RSA_FLAG_TYPE_RSASSAPSS,
264	&pss_params)) {
265	ERR_raise(ERR_LIB_PROV, ERR_R_INTERNAL_ERROR);
266	goto cleanup;
267	}
268	break;
269	default:
270	ERR_raise_data(ERR_LIB_PROV, ERR_R_UNSUPPORTED,
271	"Algorithm ID generation - pad mode: %d",
272	ctx->pad_mode);
273	goto cleanup;
274	}
275	if (WPACKET_finish(&pkt)) {
276	WPACKET_get_total_written(&pkt, aid_len);
277	aid = WPACKET_get_curr(&pkt);
278	}
279	cleanup:
280	WPACKET_cleanup(&pkt);
281	return aid;
282	}
283
284	static int rsa_setup_md(PROV_RSA_CTX ctx, const char mdname,
285	const char *mdprops)
286	{
287	if (mdprops == NULL)
288	mdprops = ctx->propq;
289
290	if (mdname != NULL) {
291	EVP_MD *md = EVP_MD_fetch(ctx->libctx, mdname, mdprops);
292	int sha1_allowed = (ctx->operation != EVP_PKEY_OP_SIGN);
293	int md_nid = ossl_digest_rsa_sign_get_md_nid(ctx->libctx, md,
294	sha1_allowed);
295	size_t mdname_len = strlen(mdname);
296
297	if (md == NULL
298	\|\| md_nid <= 0
299	\|\| !rsa_check_padding(ctx, mdname, NULL, md_nid)
300	\|\| mdname_len >= sizeof(ctx->mdname)) {
301	if (md == NULL)
302	ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_DIGEST,
303	"%s could not be fetched", mdname);
304	if (md_nid <= 0)
305	ERR_raise_data(ERR_LIB_PROV, PROV_R_DIGEST_NOT_ALLOWED,
306	"digest=%s", mdname);
307	if (mdname_len >= sizeof(ctx->mdname))
308	ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_DIGEST,
309	"%s exceeds name buffer length", mdname);
310	EVP_MD_free(md);
311	return 0;
312	}
313
314	if (!ctx->flag_allow_md) {
315	if (ctx->mdname[0] != '\0' && !EVP_MD_is_a(md, ctx->mdname)) {
316	ERR_raise_data(ERR_LIB_PROV, PROV_R_DIGEST_NOT_ALLOWED,
317	"digest %s != %s", mdname, ctx->mdname);
318	EVP_MD_free(md);
319	return 0;
320	}
321	EVP_MD_free(md);
322	return 1;
323	}
324
325	if (!ctx->mgf1_md_set) {
326	if (!EVP_MD_up_ref(md)) {
327	EVP_MD_free(md);
328	return 0;
329	}
330	EVP_MD_free(ctx->mgf1_md);
331	ctx->mgf1_md = md;
332	ctx->mgf1_mdnid = md_nid;
333	OPENSSL_strlcpy(ctx->mgf1_mdname, mdname, sizeof(ctx->mgf1_mdname));
334	}
335
336	EVP_MD_CTX_free(ctx->mdctx);
337	EVP_MD_free(ctx->md);
338
339	ctx->mdctx = NULL;
340	ctx->md = md;
341	ctx->mdnid = md_nid;
342	OPENSSL_strlcpy(ctx->mdname, mdname, sizeof(ctx->mdname));
343	}
344
345	return 1;
346	}
347
348	static int rsa_setup_mgf1_md(PROV_RSA_CTX ctx, const char mdname,
349	const char *mdprops)
350	{
351	size_t len;
352	EVP_MD *md = NULL;
353	int mdnid;
354
355	if (mdprops == NULL)
356	mdprops = ctx->propq;
357
358	if ((md = EVP_MD_fetch(ctx->libctx, mdname, mdprops)) == NULL) {
359	ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_DIGEST,
360	"%s could not be fetched", mdname);
361	return 0;
362	}
363	/* The default for mgf1 is SHA1 - so allow SHA1 */
364	if ((mdnid = ossl_digest_rsa_sign_get_md_nid(ctx->libctx, md, 1)) <= 0
365	\|\| !rsa_check_padding(ctx, NULL, mdname, mdnid)) {
366	if (mdnid <= 0)
367	ERR_raise_data(ERR_LIB_PROV, PROV_R_DIGEST_NOT_ALLOWED,
368	"digest=%s", mdname);
369	EVP_MD_free(md);
370	return 0;
371	}
372	len = OPENSSL_strlcpy(ctx->mgf1_mdname, mdname, sizeof(ctx->mgf1_mdname));
373	if (len >= sizeof(ctx->mgf1_mdname)) {
374	ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_DIGEST,
375	"%s exceeds name buffer length", mdname);
376	EVP_MD_free(md);
377	return 0;
378	}
379
380	EVP_MD_free(ctx->mgf1_md);
381	ctx->mgf1_md = md;
382	ctx->mgf1_mdnid = mdnid;
383	ctx->mgf1_md_set = 1;
384	return 1;
385	}
386
387	static int rsa_signverify_init(void vprsactx, void vrsa,
388	const OSSL_PARAM params[], int operation)
389	{
390	PROV_RSA_CTX prsactx = (PROV_RSA_CTX )vprsactx;
391
392	if (!ossl_prov_is_running() \|\| prsactx == NULL)
393	return 0;
394
395	if (vrsa == NULL && prsactx->rsa == NULL) {
396	ERR_raise(ERR_LIB_PROV, PROV_R_NO_KEY_SET);
397	return 0;
398	}
399
400	if (vrsa != NULL) {
401	if (!ossl_rsa_check_key(prsactx->libctx, vrsa, operation))
402	return 0;
403
404	if (!RSA_up_ref(vrsa))
405	return 0;
406	RSA_free(prsactx->rsa);
407	prsactx->rsa = vrsa;
408	}
409
410	prsactx->operation = operation;
411
412	/* Maximum for sign, auto for verify */
413	prsactx->saltlen = RSA_PSS_SALTLEN_AUTO;
414	prsactx->min_saltlen = -1;
415
416	switch (RSA_test_flags(prsactx->rsa, RSA_FLAG_TYPE_MASK)) {
417	case RSA_FLAG_TYPE_RSA:
418	prsactx->pad_mode = RSA_PKCS1_PADDING;
419	break;
420	case RSA_FLAG_TYPE_RSASSAPSS:
421	prsactx->pad_mode = RSA_PKCS1_PSS_PADDING;
422
423	{
424	const RSA_PSS_PARAMS_30 *pss =
425	ossl_rsa_get0_pss_params_30(prsactx->rsa);
426
427	if (!ossl_rsa_pss_params_30_is_unrestricted(pss)) {
428	int md_nid = ossl_rsa_pss_params_30_hashalg(pss);
429	int mgf1md_nid = ossl_rsa_pss_params_30_maskgenhashalg(pss);
430	int min_saltlen = ossl_rsa_pss_params_30_saltlen(pss);
431	const char mdname, mgf1mdname;
432	size_t len;
433
434	mdname = ossl_rsa_oaeppss_nid2name(md_nid);
435	mgf1mdname = ossl_rsa_oaeppss_nid2name(mgf1md_nid);
436
437	if (mdname == NULL) {
438	ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_DIGEST,
439	"PSS restrictions lack hash algorithm");
440	return 0;
441	}
442	if (mgf1mdname == NULL) {
443	ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_DIGEST,
444	"PSS restrictions lack MGF1 hash algorithm");
445	return 0;
446	}
447
448	len = OPENSSL_strlcpy(prsactx->mdname, mdname,
449	sizeof(prsactx->mdname));
450	if (len >= sizeof(prsactx->mdname)) {
451	ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_DIGEST,
452	"hash algorithm name too long");
453	return 0;
454	}
455	len = OPENSSL_strlcpy(prsactx->mgf1_mdname, mgf1mdname,
456	sizeof(prsactx->mgf1_mdname));
457	if (len >= sizeof(prsactx->mgf1_mdname)) {
458	ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_DIGEST,
459	"MGF1 hash algorithm name too long");
460	return 0;
461	}
462	prsactx->saltlen = min_saltlen;
463
464	/* call rsa_setup_mgf1_md before rsa_setup_md to avoid duplication */
465	if (!rsa_setup_mgf1_md(prsactx, mgf1mdname, prsactx->propq)
466	\|\| !rsa_setup_md(prsactx, mdname, prsactx->propq)
467	\|\| !rsa_check_parameters(prsactx, min_saltlen))
468	return 0;
469	}
470	}
471
472	break;
473	default:
474	ERR_raise(ERR_LIB_RSA, PROV_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
475	return 0;
476	}
477
478	if (!rsa_set_ctx_params(prsactx, params))
479	return 0;
480
481	return 1;
482	}
483
484	static int setup_tbuf(PROV_RSA_CTX *ctx)
485	{
486	if (ctx->tbuf != NULL)
487	return 1;
488	if ((ctx->tbuf = OPENSSL_malloc(RSA_size(ctx->rsa))) == NULL) {
489	ERR_raise(ERR_LIB_PROV, ERR_R_MALLOC_FAILURE);
490	return 0;
491	}
492	return 1;
493	}
494
495	static void clean_tbuf(PROV_RSA_CTX *ctx)
496	{
497	if (ctx->tbuf != NULL)
498	OPENSSL_cleanse(ctx->tbuf, RSA_size(ctx->rsa));
499	}
500
501	static void free_tbuf(PROV_RSA_CTX *ctx)
502	{
503	clean_tbuf(ctx);
504	OPENSSL_free(ctx->tbuf);
505	ctx->tbuf = NULL;
506	}
507
508	static int rsa_sign_init(void vprsactx, void vrsa, const OSSL_PARAM params[])
509	{
510	if (!ossl_prov_is_running())
511	return 0;
512	return rsa_signverify_init(vprsactx, vrsa, params, EVP_PKEY_OP_SIGN);
513	}
514
515	static int rsa_sign(void vprsactx, unsigned char sig, size_t *siglen,
516	size_t sigsize, const unsigned char *tbs, size_t tbslen)
517	{
518	PROV_RSA_CTX prsactx = (PROV_RSA_CTX )vprsactx;
519	int ret;
520	size_t rsasize = RSA_size(prsactx->rsa);
521	size_t mdsize = rsa_get_md_size(prsactx);
522
523	if (!ossl_prov_is_running())
524	return 0;
525
526	if (sig == NULL) {
527	*siglen = rsasize;
528	return 1;
529	}
530
531	if (sigsize < rsasize) {
532	ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_SIGNATURE_SIZE,
533	"is %zu, should be at least %zu", sigsize, rsasize);
534	return 0;
535	}
536
537	if (mdsize != 0) {
538	if (tbslen != mdsize) {
539	ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_DIGEST_LENGTH);
540	return 0;
541	}
542
543	#ifndef FIPS_MODULE
544	if (EVP_MD_is_a(prsactx->md, OSSL_DIGEST_NAME_MDC2)) {
545	unsigned int sltmp;
546
547	if (prsactx->pad_mode != RSA_PKCS1_PADDING) {
548	ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_PADDING_MODE,
549	"only PKCS#1 padding supported with MDC2");
550	return 0;
551	}
552	ret = RSA_sign_ASN1_OCTET_STRING(0, tbs, tbslen, sig, &sltmp,
553	prsactx->rsa);
554
555	if (ret <= 0) {
556	ERR_raise(ERR_LIB_PROV, ERR_R_RSA_LIB);
557	return 0;
558	}
559	ret = sltmp;
560	goto end;
561	}
562	#endif
563	switch (prsactx->pad_mode) {
564	case RSA_X931_PADDING:
565	if ((size_t)RSA_size(prsactx->rsa) < tbslen + 1) {
566	ERR_raise_data(ERR_LIB_PROV, PROV_R_KEY_SIZE_TOO_SMALL,
567	"RSA key size = %d, expected minimum = %d",
568	RSA_size(prsactx->rsa), tbslen + 1);
569	return 0;
570	}
571	if (!setup_tbuf(prsactx)) {
572	ERR_raise(ERR_LIB_PROV, ERR_R_MALLOC_FAILURE);
573	return 0;
574	}
575	memcpy(prsactx->tbuf, tbs, tbslen);
576	prsactx->tbuf[tbslen] = RSA_X931_hash_id(prsactx->mdnid);
577	ret = RSA_private_encrypt(tbslen + 1, prsactx->tbuf,
578	sig, prsactx->rsa, RSA_X931_PADDING);
579	clean_tbuf(prsactx);
580	break;
581
582	case RSA_PKCS1_PADDING:
583	{
584	unsigned int sltmp;
585
586	ret = RSA_sign(prsactx->mdnid, tbs, tbslen, sig, &sltmp,
587	prsactx->rsa);
588	if (ret <= 0) {
589	ERR_raise(ERR_LIB_PROV, ERR_R_RSA_LIB);
590	return 0;
591	}
592	ret = sltmp;
593	}
594	break;
595
596	case RSA_PKCS1_PSS_PADDING:
597	/* Check PSS restrictions */
598	if (rsa_pss_restricted(prsactx)) {
599	switch (prsactx->saltlen) {
600	case RSA_PSS_SALTLEN_DIGEST:
601	if (prsactx->min_saltlen > EVP_MD_get_size(prsactx->md)) {
602	ERR_raise_data(ERR_LIB_PROV,
603	PROV_R_PSS_SALTLEN_TOO_SMALL,
604	"minimum salt length set to %d, "
605	"but the digest only gives %d",
606	prsactx->min_saltlen,
607	EVP_MD_get_size(prsactx->md));
608	return 0;
609	}
610	/* FALLTHRU */
611	default:
612	if (prsactx->saltlen >= 0
613	&& prsactx->saltlen < prsactx->min_saltlen) {
614	ERR_raise_data(ERR_LIB_PROV,
615	PROV_R_PSS_SALTLEN_TOO_SMALL,
616	"minimum salt length set to %d, but the"
617	"actual salt length is only set to %d",
618	prsactx->min_saltlen,
619	prsactx->saltlen);
620	return 0;
621	}
622	break;
623	}
624	}
625	if (!setup_tbuf(prsactx))
626	return 0;
627	if (!RSA_padding_add_PKCS1_PSS_mgf1(prsactx->rsa,
628	prsactx->tbuf, tbs,
629	prsactx->md, prsactx->mgf1_md,
630	prsactx->saltlen)) {
631	ERR_raise(ERR_LIB_PROV, ERR_R_RSA_LIB);
632	return 0;
633	}
634	ret = RSA_private_encrypt(RSA_size(prsactx->rsa), prsactx->tbuf,
635	sig, prsactx->rsa, RSA_NO_PADDING);
636	clean_tbuf(prsactx);
637	break;
638
639	default:
640	ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_PADDING_MODE,
641	"Only X.931, PKCS#1 v1.5 or PSS padding allowed");
642	return 0;
643	}
644	} else {
645	ret = RSA_private_encrypt(tbslen, tbs, sig, prsactx->rsa,
646	prsactx->pad_mode);
647	}
648
649	#ifndef FIPS_MODULE
650	end:
651	#endif
652	if (ret <= 0) {
653	ERR_raise(ERR_LIB_PROV, ERR_R_RSA_LIB);
654	return 0;
655	}
656
657	*siglen = ret;
658	return 1;
659	}
660
661	static int rsa_verify_recover_init(void vprsactx, void vrsa,
662	const OSSL_PARAM params[])
663	{
664	if (!ossl_prov_is_running())
665	return 0;
666	return rsa_signverify_init(vprsactx, vrsa, params,
667	EVP_PKEY_OP_VERIFYRECOVER);
668	}
669
670	static int rsa_verify_recover(void *vprsactx,
671	unsigned char *rout,
672	size_t *routlen,
673	size_t routsize,
674	const unsigned char *sig,
675	size_t siglen)
676	{
677	PROV_RSA_CTX prsactx = (PROV_RSA_CTX )vprsactx;
678	int ret;
679
680	if (!ossl_prov_is_running())
681	return 0;
682
683	if (rout == NULL) {
684	*routlen = RSA_size(prsactx->rsa);
685	return 1;
686	}
687
688	if (prsactx->md != NULL) {
689	switch (prsactx->pad_mode) {
690	case RSA_X931_PADDING:
691	if (!setup_tbuf(prsactx))
692	return 0;
693	ret = RSA_public_decrypt(siglen, sig, prsactx->tbuf, prsactx->rsa,
694	RSA_X931_PADDING);
695	if (ret < 1) {
696	ERR_raise(ERR_LIB_PROV, ERR_R_RSA_LIB);
697	return 0;
698	}
699	ret--;
700	if (prsactx->tbuf[ret] != RSA_X931_hash_id(prsactx->mdnid)) {
701	ERR_raise(ERR_LIB_PROV, PROV_R_ALGORITHM_MISMATCH);
702	return 0;
703	}
704	if (ret != EVP_MD_get_size(prsactx->md)) {
705	ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_DIGEST_LENGTH,
706	"Should be %d, but got %d",
707	EVP_MD_get_size(prsactx->md), ret);
708	return 0;
709	}
710
711	*routlen = ret;
712	if (rout != prsactx->tbuf) {
713	if (routsize < (size_t)ret) {
714	ERR_raise_data(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL,
715	"buffer size is %d, should be %d",
716	routsize, ret);
717	return 0;
718	}
719	memcpy(rout, prsactx->tbuf, ret);
720	}
721	break;
722
723	case RSA_PKCS1_PADDING:
724	{
725	size_t sltmp;
726
727	ret = ossl_rsa_verify(prsactx->mdnid, NULL, 0, rout, &sltmp,
728	sig, siglen, prsactx->rsa);
729	if (ret <= 0) {
730	ERR_raise(ERR_LIB_PROV, ERR_R_RSA_LIB);
731	return 0;
732	}
733	ret = sltmp;
734	}
735	break;
736
737	default:
738	ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_PADDING_MODE,
739	"Only X.931 or PKCS#1 v1.5 padding allowed");
740	return 0;
741	}
742	} else {
743	ret = RSA_public_decrypt(siglen, sig, rout, prsactx->rsa,
744	prsactx->pad_mode);
745	if (ret < 0) {
746	ERR_raise(ERR_LIB_PROV, ERR_R_RSA_LIB);
747	return 0;
748	}
749	}
750	*routlen = ret;
751	return 1;
752	}
753
754	static int rsa_verify_init(void vprsactx, void vrsa,
755	const OSSL_PARAM params[])
756	{
757	if (!ossl_prov_is_running())
758	return 0;
759	return rsa_signverify_init(vprsactx, vrsa, params, EVP_PKEY_OP_VERIFY);
760	}
761
762	static int rsa_verify(void vprsactx, const unsigned char sig, size_t siglen,
763	const unsigned char *tbs, size_t tbslen)
764	{
765	PROV_RSA_CTX prsactx = (PROV_RSA_CTX )vprsactx;
766	size_t rslen;
767
768	if (!ossl_prov_is_running())
769	return 0;
770	if (prsactx->md != NULL) {
771	switch (prsactx->pad_mode) {
772	case RSA_PKCS1_PADDING:
773	if (!RSA_verify(prsactx->mdnid, tbs, tbslen, sig, siglen,
774	prsactx->rsa)) {
775	ERR_raise(ERR_LIB_PROV, ERR_R_RSA_LIB);
776	return 0;
777	}
778	return 1;
779	case RSA_X931_PADDING:
780	if (!setup_tbuf(prsactx))
781	return 0;
782	if (rsa_verify_recover(prsactx, prsactx->tbuf, &rslen, 0,
783	sig, siglen) <= 0)
784	return 0;
785	break;
786	case RSA_PKCS1_PSS_PADDING:
787	{
788	int ret;
789	size_t mdsize;
790
791	/*
792	* We need to check this for the RSA_verify_PKCS1_PSS_mgf1()
793	* call
794	*/
795	mdsize = rsa_get_md_size(prsactx);
796	if (tbslen != mdsize) {
797	ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_DIGEST_LENGTH,
798	"Should be %d, but got %d",
799	mdsize, tbslen);
800	return 0;
801	}
802
803	if (!setup_tbuf(prsactx))
804	return 0;
805	ret = RSA_public_decrypt(siglen, sig, prsactx->tbuf,
806	prsactx->rsa, RSA_NO_PADDING);
807	if (ret <= 0) {
808	ERR_raise(ERR_LIB_PROV, ERR_R_RSA_LIB);
809	return 0;
810	}
811	ret = RSA_verify_PKCS1_PSS_mgf1(prsactx->rsa, tbs,
812	prsactx->md, prsactx->mgf1_md,
813	prsactx->tbuf,
814	prsactx->saltlen);
815	if (ret <= 0) {
816	ERR_raise(ERR_LIB_PROV, ERR_R_RSA_LIB);
817	return 0;
818	}
819	return 1;
820	}
821	default:
822	ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_PADDING_MODE,
823	"Only X.931, PKCS#1 v1.5 or PSS padding allowed");
824	return 0;
825	}
826	} else {
827	if (!setup_tbuf(prsactx))
828	return 0;
829	rslen = RSA_public_decrypt(siglen, sig, prsactx->tbuf, prsactx->rsa,
830	prsactx->pad_mode);
831	if (rslen == 0) {
832	ERR_raise(ERR_LIB_PROV, ERR_R_RSA_LIB);
833	return 0;
834	}
835	}
836
837	if ((rslen != tbslen) \|\| memcmp(tbs, prsactx->tbuf, rslen))
838	return 0;
839
840	return 1;
841	}
842
843	static int rsa_digest_signverify_init(void vprsactx, const char mdname,
844	void *vrsa, const OSSL_PARAM params[],
845	int operation)
846	{
847	PROV_RSA_CTX prsactx = (PROV_RSA_CTX )vprsactx;
848
849	if (!ossl_prov_is_running())
850	return 0;
851
852	if (!rsa_signverify_init(vprsactx, vrsa, params, operation))
853	return 0;
854
855	if (mdname != NULL
856	/* was rsa_setup_md already called in rsa_signverify_init()? */
857	&& (mdname[0] == '\0' \|\| strcasecmp(prsactx->mdname, mdname) != 0)
858	&& !rsa_setup_md(prsactx, mdname, prsactx->propq))
859	return 0;
860
861	prsactx->flag_allow_md = 0;
862
863	if (prsactx->mdctx == NULL) {
864	prsactx->mdctx = EVP_MD_CTX_new();
865	if (prsactx->mdctx == NULL)
866	goto error;
867	}
868
869	if (!EVP_DigestInit_ex2(prsactx->mdctx, prsactx->md, params))
870	goto error;
871
872	return 1;
873
874	error:
875	EVP_MD_CTX_free(prsactx->mdctx);
876	prsactx->mdctx = NULL;
877	return 0;
878	}
879
880	static int rsa_digest_signverify_update(void *vprsactx,
881	const unsigned char *data,
882	size_t datalen)
883	{
884	PROV_RSA_CTX prsactx = (PROV_RSA_CTX )vprsactx;
885
886	if (prsactx == NULL \|\| prsactx->mdctx == NULL)
887	return 0;
888
889	return EVP_DigestUpdate(prsactx->mdctx, data, datalen);
890	}
891
892	static int rsa_digest_sign_init(void vprsactx, const char mdname,
893	void *vrsa, const OSSL_PARAM params[])
894	{
895	if (!ossl_prov_is_running())
896	return 0;
897	return rsa_digest_signverify_init(vprsactx, mdname, vrsa,
898	params, EVP_PKEY_OP_SIGN);
899	}
900
901	static int rsa_digest_sign_final(void vprsactx, unsigned char sig,
902	size_t *siglen, size_t sigsize)
903	{
904	PROV_RSA_CTX prsactx = (PROV_RSA_CTX )vprsactx;
905	unsigned char digest[EVP_MAX_MD_SIZE];
906	unsigned int dlen = 0;
907
908	if (!ossl_prov_is_running() \|\| prsactx == NULL)
909	return 0;
910	prsactx->flag_allow_md = 1;
911	if (prsactx->mdctx == NULL)
912	return 0;
913	/*
914	* If sig is NULL then we're just finding out the sig size. Other fields
915	* are ignored. Defer to rsa_sign.
916	*/
917	if (sig != NULL) {
918	/*
919	* The digests used here are all known (see rsa_get_md_nid()), so they
920	* should not exceed the internal buffer size of EVP_MAX_MD_SIZE.
921	*/
922	if (!EVP_DigestFinal_ex(prsactx->mdctx, digest, &dlen))
923	return 0;
924	}
925
926	return rsa_sign(vprsactx, sig, siglen, sigsize, digest, (size_t)dlen);
927	}
928
929	static int rsa_digest_verify_init(void vprsactx, const char mdname,
930	void *vrsa, const OSSL_PARAM params[])
931	{
932	if (!ossl_prov_is_running())
933	return 0;
934	return rsa_digest_signverify_init(vprsactx, mdname, vrsa,
935	params, EVP_PKEY_OP_VERIFY);
936	}
937
938	int rsa_digest_verify_final(void vprsactx, const unsigned char sig,
939	size_t siglen)
940	{
941	PROV_RSA_CTX prsactx = (PROV_RSA_CTX )vprsactx;
942	unsigned char digest[EVP_MAX_MD_SIZE];
943	unsigned int dlen = 0;
944
945	if (!ossl_prov_is_running())
946	return 0;
947
948	if (prsactx == NULL)
949	return 0;
950	prsactx->flag_allow_md = 1;
951	if (prsactx->mdctx == NULL)
952	return 0;
953
954	/*
955	* The digests used here are all known (see rsa_get_md_nid()), so they
956	* should not exceed the internal buffer size of EVP_MAX_MD_SIZE.
957	*/
958	if (!EVP_DigestFinal_ex(prsactx->mdctx, digest, &dlen))
959	return 0;
960
961	return rsa_verify(vprsactx, sig, siglen, digest, (size_t)dlen);
962	}
963
964	static void rsa_freectx(void *vprsactx)
965	{
966	PROV_RSA_CTX prsactx = (PROV_RSA_CTX )vprsactx;
967
968	if (prsactx == NULL)
969	return;
970
971	EVP_MD_CTX_free(prsactx->mdctx);
972	EVP_MD_free(prsactx->md);
973	EVP_MD_free(prsactx->mgf1_md);
974	OPENSSL_free(prsactx->propq);
975	free_tbuf(prsactx);
976	RSA_free(prsactx->rsa);
977
978	OPENSSL_clear_free(prsactx, sizeof(*prsactx));
979	}
980
981	static void rsa_dupctx(void vprsactx)
982	{
983	PROV_RSA_CTX srcctx = (PROV_RSA_CTX )vprsactx;
984	PROV_RSA_CTX *dstctx;
985
986	if (!ossl_prov_is_running())
987	return NULL;
988
989	dstctx = OPENSSL_zalloc(sizeof(*srcctx));
990	if (dstctx == NULL) {
991	ERR_raise(ERR_LIB_PROV, ERR_R_MALLOC_FAILURE);
992	return NULL;
993	}
994
995	dstctx = srcctx;
996	dstctx->rsa = NULL;
997	dstctx->md = NULL;
998	dstctx->mdctx = NULL;
999	dstctx->tbuf = NULL;
1000	dstctx->propq = NULL;
1001
1002	if (srcctx->rsa != NULL && !RSA_up_ref(srcctx->rsa))
1003	goto err;
1004	dstctx->rsa = srcctx->rsa;
1005
1006	if (srcctx->md != NULL && !EVP_MD_up_ref(srcctx->md))
1007	goto err;
1008	dstctx->md = srcctx->md;
1009
1010	if (srcctx->mgf1_md != NULL && !EVP_MD_up_ref(srcctx->mgf1_md))
1011	goto err;
1012	dstctx->mgf1_md = srcctx->mgf1_md;
1013
1014	if (srcctx->mdctx != NULL) {
1015	dstctx->mdctx = EVP_MD_CTX_new();
1016	if (dstctx->mdctx == NULL
1017	\|\| !EVP_MD_CTX_copy_ex(dstctx->mdctx, srcctx->mdctx))
1018	goto err;
1019	}
1020
1021	if (srcctx->propq != NULL) {
1022	dstctx->propq = OPENSSL_strdup(srcctx->propq);
1023	if (dstctx->propq == NULL)
1024	goto err;
1025	}
1026
1027	return dstctx;
1028	err:
1029	rsa_freectx(dstctx);
1030	return NULL;
1031	}
1032
1033	static int rsa_get_ctx_params(void vprsactx, OSSL_PARAM params)
1034	{
1035	PROV_RSA_CTX prsactx = (PROV_RSA_CTX )vprsactx;
1036	OSSL_PARAM *p;
1037
1038	if (prsactx == NULL)
1039	return 0;
1040
1041	p = OSSL_PARAM_locate(params, OSSL_SIGNATURE_PARAM_ALGORITHM_ID);
1042	if (p != NULL) {
1043	/* The Algorithm Identifier of the combined signature algorithm */
1044	unsigned char aid_buf[128];
1045	unsigned char *aid;
1046	size_t aid_len;
1047
1048	aid = rsa_generate_signature_aid(prsactx, aid_buf,
1049	sizeof(aid_buf), &aid_len);
1050	if (aid == NULL \|\| !OSSL_PARAM_set_octet_string(p, aid, aid_len))
1051	return 0;
1052	}
1053
1054	p = OSSL_PARAM_locate(params, OSSL_SIGNATURE_PARAM_PAD_MODE);
1055	if (p != NULL)
1056	switch (p->data_type) {
1057	case OSSL_PARAM_INTEGER:
1058	if (!OSSL_PARAM_set_int(p, prsactx->pad_mode))
1059	return 0;
1060	break;
1061	case OSSL_PARAM_UTF8_STRING:
1062	{
1063	int i;
1064	const char *word = NULL;
1065
1066	for (i = 0; padding_item[i].id != 0; i++) {
1067	if (prsactx->pad_mode == (int)padding_item[i].id) {
1068	word = padding_item[i].ptr;
1069	break;
1070	}
1071	}
1072
1073	if (word != NULL) {
1074	if (!OSSL_PARAM_set_utf8_string(p, word))
1075	return 0;
1076	} else {
1077	ERR_raise(ERR_LIB_PROV, ERR_R_INTERNAL_ERROR);
1078	}
1079	}
1080	break;
1081	default:
1082	return 0;
1083	}
1084
1085	p = OSSL_PARAM_locate(params, OSSL_SIGNATURE_PARAM_DIGEST);
1086	if (p != NULL && !OSSL_PARAM_set_utf8_string(p, prsactx->mdname))
1087	return 0;
1088
1089	p = OSSL_PARAM_locate(params, OSSL_SIGNATURE_PARAM_MGF1_DIGEST);
1090	if (p != NULL && !OSSL_PARAM_set_utf8_string(p, prsactx->mgf1_mdname))
1091	return 0;
1092
1093	p = OSSL_PARAM_locate(params, OSSL_SIGNATURE_PARAM_PSS_SALTLEN);
1094	if (p != NULL) {
1095	if (p->data_type == OSSL_PARAM_INTEGER) {
1096	if (!OSSL_PARAM_set_int(p, prsactx->saltlen))
1097	return 0;
1098	} else if (p->data_type == OSSL_PARAM_UTF8_STRING) {
1099	const char *value = NULL;
1100
1101	switch (prsactx->saltlen) {
1102	case RSA_PSS_SALTLEN_DIGEST:
1103	value = OSSL_PKEY_RSA_PSS_SALT_LEN_DIGEST;
1104	break;
1105	case RSA_PSS_SALTLEN_MAX:
1106	value = OSSL_PKEY_RSA_PSS_SALT_LEN_MAX;
1107	break;
1108	case RSA_PSS_SALTLEN_AUTO:
1109	value = OSSL_PKEY_RSA_PSS_SALT_LEN_AUTO;
1110	break;
1111	default:
1112	{
1113	int len = BIO_snprintf(p->data, p->data_size, "%d",
1114	prsactx->saltlen);
1115
1116	if (len <= 0)
1117	return 0;
1118	p->return_size = len;
1119	break;
1120	}
1121	}
1122	if (value != NULL
1123	&& !OSSL_PARAM_set_utf8_string(p, value))
1124	return 0;
1125	}
1126	}
1127
1128	return 1;
1129	}
1130
1131	static const OSSL_PARAM known_gettable_ctx_params[] = {
1132	OSSL_PARAM_octet_string(OSSL_SIGNATURE_PARAM_ALGORITHM_ID, NULL, 0),
1133	OSSL_PARAM_utf8_string(OSSL_SIGNATURE_PARAM_PAD_MODE, NULL, 0),
1134	OSSL_PARAM_utf8_string(OSSL_SIGNATURE_PARAM_DIGEST, NULL, 0),
1135	OSSL_PARAM_utf8_string(OSSL_SIGNATURE_PARAM_MGF1_DIGEST, NULL, 0),
1136	OSSL_PARAM_utf8_string(OSSL_SIGNATURE_PARAM_PSS_SALTLEN, NULL, 0),
1137	OSSL_PARAM_END
1138	};
1139
1140	static const OSSL_PARAM rsa_gettable_ctx_params(ossl_unused void vprsactx,
1141	ossl_unused void *provctx)
1142	{
1143	return known_gettable_ctx_params;
1144	}
1145
1146	static int rsa_set_ctx_params(void *vprsactx, const OSSL_PARAM params[])
1147	{
1148	PROV_RSA_CTX prsactx = (PROV_RSA_CTX )vprsactx;
1149	const OSSL_PARAM *p;
1150	int pad_mode;
1151	int saltlen;
1152	char mdname[OSSL_MAX_NAME_SIZE] = "", *pmdname = NULL;
1153	char mdprops[OSSL_MAX_PROPQUERY_SIZE] = "", *pmdprops = NULL;
1154	char mgf1mdname[OSSL_MAX_NAME_SIZE] = "", *pmgf1mdname = NULL;
1155	char mgf1mdprops[OSSL_MAX_PROPQUERY_SIZE] = "", *pmgf1mdprops = NULL;
1156
1157	if (prsactx == NULL)
1158	return 0;
1159	if (params == NULL)
1160	return 1;
1161
1162	pad_mode = prsactx->pad_mode;
1163	saltlen = prsactx->saltlen;
1164
1165	p = OSSL_PARAM_locate_const(params, OSSL_SIGNATURE_PARAM_DIGEST);
1166	if (p != NULL) {
1167	const OSSL_PARAM *propsp =
1168	OSSL_PARAM_locate_const(params,
1169	OSSL_SIGNATURE_PARAM_PROPERTIES);
1170
1171	pmdname = mdname;
1172	if (!OSSL_PARAM_get_utf8_string(p, &pmdname, sizeof(mdname)))
1173	return 0;
1174
1175	if (propsp != NULL) {
1176	pmdprops = mdprops;
1177	if (!OSSL_PARAM_get_utf8_string(propsp,
1178	&pmdprops, sizeof(mdprops)))
1179	return 0;
1180	}
1181	}
1182
1183	p = OSSL_PARAM_locate_const(params, OSSL_SIGNATURE_PARAM_PAD_MODE);
1184	if (p != NULL) {
1185	const char *err_extra_text = NULL;
1186
1187	switch (p->data_type) {
1188	case OSSL_PARAM_INTEGER: /* Support for legacy pad mode number */
1189	if (!OSSL_PARAM_get_int(p, &pad_mode))
1190	return 0;
1191	break;
1192	case OSSL_PARAM_UTF8_STRING:
1193	{
1194	int i;
1195
1196	if (p->data == NULL)
1197	return 0;
1198
1199	for (i = 0; padding_item[i].id != 0; i++) {
1200	if (strcmp(p->data, padding_item[i].ptr) == 0) {
1201	pad_mode = padding_item[i].id;
1202	break;
1203	}
1204	}
1205	}
1206	break;
1207	default:
1208	return 0;
1209	}
1210
1211	switch (pad_mode) {
1212	case RSA_PKCS1_OAEP_PADDING:
1213	/*
1214	* OAEP padding is for asymmetric cipher only so is not compatible
1215	* with signature use.
1216	*/
1217	err_extra_text = "OAEP padding not allowed for signing / verifying";
1218	goto bad_pad;
1219	case RSA_PKCS1_PSS_PADDING:
1220	if ((prsactx->operation
1221	& (EVP_PKEY_OP_SIGN \| EVP_PKEY_OP_VERIFY)) == 0) {
1222	err_extra_text =
1223	"PSS padding only allowed for sign and verify operations";
1224	goto bad_pad;
1225	}
1226	break;
1227	case RSA_PKCS1_PADDING:
1228	err_extra_text = "PKCS#1 padding not allowed with RSA-PSS";
1229	goto cont;
1230	case RSA_NO_PADDING:
1231	err_extra_text = "No padding not allowed with RSA-PSS";
1232	goto cont;
1233	case RSA_X931_PADDING:
1234	err_extra_text = "X.931 padding not allowed with RSA-PSS";
1235	cont:
1236	if (RSA_test_flags(prsactx->rsa,
1237	RSA_FLAG_TYPE_MASK) == RSA_FLAG_TYPE_RSA)
1238	break;
1239	/* FALLTHRU */
1240	default:
1241	bad_pad:
1242	if (err_extra_text == NULL)
1243	ERR_raise(ERR_LIB_PROV,
1244	PROV_R_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE);
1245	else
1246	ERR_raise_data(ERR_LIB_PROV,
1247	PROV_R_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE,
1248	err_extra_text);
1249	return 0;
1250	}
1251	}
1252
1253	p = OSSL_PARAM_locate_const(params, OSSL_SIGNATURE_PARAM_PSS_SALTLEN);
1254	if (p != NULL) {
1255	if (pad_mode != RSA_PKCS1_PSS_PADDING) {
1256	ERR_raise_data(ERR_LIB_PROV, PROV_R_NOT_SUPPORTED,
1257	"PSS saltlen can only be specified if "
1258	"PSS padding has been specified first");
1259	return 0;
1260	}
1261
1262	switch (p->data_type) {
1263	case OSSL_PARAM_INTEGER: /* Support for legacy pad mode number */
1264	if (!OSSL_PARAM_get_int(p, &saltlen))
1265	return 0;
1266	break;
1267	case OSSL_PARAM_UTF8_STRING:
1268	if (strcmp(p->data, OSSL_PKEY_RSA_PSS_SALT_LEN_DIGEST) == 0)
1269	saltlen = RSA_PSS_SALTLEN_DIGEST;
1270	else if (strcmp(p->data, OSSL_PKEY_RSA_PSS_SALT_LEN_MAX) == 0)
1271	saltlen = RSA_PSS_SALTLEN_MAX;
1272	else if (strcmp(p->data, OSSL_PKEY_RSA_PSS_SALT_LEN_AUTO) == 0)
1273	saltlen = RSA_PSS_SALTLEN_AUTO;
1274	else
1275	saltlen = atoi(p->data);
1276	break;
1277	default:
1278	return 0;
1279	}
1280
1281	/*
1282	* RSA_PSS_SALTLEN_MAX seems curiously named in this check.
1283	* Contrary to what it's name suggests, it's the currently
1284	* lowest saltlen number possible.
1285	*/
1286	if (saltlen < RSA_PSS_SALTLEN_MAX) {
1287	ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_SALT_LENGTH);
1288	return 0;
1289	}
1290
1291	if (rsa_pss_restricted(prsactx)) {
1292	switch (saltlen) {
1293	case RSA_PSS_SALTLEN_AUTO:
1294	if (prsactx->operation == EVP_PKEY_OP_VERIFY) {
1295	ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_SALT_LENGTH,
1296	"Cannot use autodetected salt length");
1297	return 0;
1298	}
1299	break;
1300	case RSA_PSS_SALTLEN_DIGEST:
1301	if (prsactx->min_saltlen > EVP_MD_get_size(prsactx->md)) {
1302	ERR_raise_data(ERR_LIB_PROV,
1303	PROV_R_PSS_SALTLEN_TOO_SMALL,
1304	"Should be more than %d, but would be "
1305	"set to match digest size (%d)",
1306	prsactx->min_saltlen,
1307	EVP_MD_get_size(prsactx->md));
1308	return 0;
1309	}
1310	break;
1311	default:
1312	if (saltlen >= 0 && saltlen < prsactx->min_saltlen) {
1313	ERR_raise_data(ERR_LIB_PROV,
1314	PROV_R_PSS_SALTLEN_TOO_SMALL,
1315	"Should be more than %d, "
1316	"but would be set to %d",
1317	prsactx->min_saltlen, saltlen);
1318	return 0;
1319	}
1320	}
1321	}
1322	}
1323
1324	p = OSSL_PARAM_locate_const(params, OSSL_SIGNATURE_PARAM_MGF1_DIGEST);
1325	if (p != NULL) {
1326	const OSSL_PARAM *propsp =
1327	OSSL_PARAM_locate_const(params,
1328	OSSL_SIGNATURE_PARAM_MGF1_PROPERTIES);
1329
1330	pmgf1mdname = mgf1mdname;
1331	if (!OSSL_PARAM_get_utf8_string(p, &pmgf1mdname, sizeof(mgf1mdname)))
1332	return 0;
1333
1334	if (propsp != NULL) {
1335	pmgf1mdprops = mgf1mdprops;
1336	if (!OSSL_PARAM_get_utf8_string(propsp,
1337	&pmgf1mdprops, sizeof(mgf1mdprops)))
1338	return 0;
1339	}
1340
1341	if (pad_mode != RSA_PKCS1_PSS_PADDING) {
1342	ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_MGF1_MD);
1343	return 0;
1344	}
1345	}
1346
1347	prsactx->saltlen = saltlen;
1348	prsactx->pad_mode = pad_mode;
1349
1350	if (prsactx->md == NULL && pmdname == NULL
1351	&& pad_mode == RSA_PKCS1_PSS_PADDING)
1352	pmdname = RSA_DEFAULT_DIGEST_NAME;
1353
1354	if (pmgf1mdname != NULL
1355	&& !rsa_setup_mgf1_md(prsactx, pmgf1mdname, pmgf1mdprops))
1356	return 0;
1357
1358	if (pmdname != NULL) {
1359	if (!rsa_setup_md(prsactx, pmdname, pmdprops))
1360	return 0;
1361	} else {
1362	if (!rsa_check_padding(prsactx, NULL, NULL, prsactx->mdnid))
1363	return 0;
1364	}
1365	return 1;
1366	}
1367
1368	static const OSSL_PARAM settable_ctx_params[] = {
1369	OSSL_PARAM_utf8_string(OSSL_SIGNATURE_PARAM_DIGEST, NULL, 0),
1370	OSSL_PARAM_utf8_string(OSSL_SIGNATURE_PARAM_PROPERTIES, NULL, 0),
1371	OSSL_PARAM_utf8_string(OSSL_SIGNATURE_PARAM_PAD_MODE, NULL, 0),
1372	OSSL_PARAM_utf8_string(OSSL_SIGNATURE_PARAM_MGF1_DIGEST, NULL, 0),
1373	OSSL_PARAM_utf8_string(OSSL_SIGNATURE_PARAM_MGF1_PROPERTIES, NULL, 0),
1374	OSSL_PARAM_utf8_string(OSSL_SIGNATURE_PARAM_PSS_SALTLEN, NULL, 0),
1375	OSSL_PARAM_END
1376	};
1377
1378	static const OSSL_PARAM settable_ctx_params_no_digest[] = {
1379	OSSL_PARAM_utf8_string(OSSL_SIGNATURE_PARAM_PAD_MODE, NULL, 0),
1380	OSSL_PARAM_utf8_string(OSSL_SIGNATURE_PARAM_MGF1_DIGEST, NULL, 0),
1381	OSSL_PARAM_utf8_string(OSSL_SIGNATURE_PARAM_MGF1_PROPERTIES, NULL, 0),
1382	OSSL_PARAM_utf8_string(OSSL_SIGNATURE_PARAM_PSS_SALTLEN, NULL, 0),
1383	OSSL_PARAM_END
1384	};
1385
1386	static const OSSL_PARAM rsa_settable_ctx_params(void vprsactx,
1387	ossl_unused void *provctx)
1388	{
1389	PROV_RSA_CTX prsactx = (PROV_RSA_CTX )vprsactx;
1390
1391	if (prsactx != NULL && !prsactx->flag_allow_md)
1392	return settable_ctx_params_no_digest;
1393	return settable_ctx_params;
1394	}
1395
1396	static int rsa_get_ctx_md_params(void vprsactx, OSSL_PARAM params)
1397	{
1398	PROV_RSA_CTX prsactx = (PROV_RSA_CTX )vprsactx;
1399
1400	if (prsactx->mdctx == NULL)
1401	return 0;
1402
1403	return EVP_MD_CTX_get_params(prsactx->mdctx, params);
1404	}
1405
1406	static const OSSL_PARAM rsa_gettable_ctx_md_params(void vprsactx)
1407	{
1408	PROV_RSA_CTX prsactx = (PROV_RSA_CTX )vprsactx;
1409
1410	if (prsactx->md == NULL)
1411	return 0;
1412
1413	return EVP_MD_gettable_ctx_params(prsactx->md);
1414	}
1415
1416	static int rsa_set_ctx_md_params(void *vprsactx, const OSSL_PARAM params[])
1417	{
1418	PROV_RSA_CTX prsactx = (PROV_RSA_CTX )vprsactx;
1419
1420	if (prsactx->mdctx == NULL)
1421	return 0;
1422
1423	return EVP_MD_CTX_set_params(prsactx->mdctx, params);
1424	}
1425
1426	static const OSSL_PARAM rsa_settable_ctx_md_params(void vprsactx)
1427	{
1428	PROV_RSA_CTX prsactx = (PROV_RSA_CTX )vprsactx;
1429
1430	if (prsactx->md == NULL)
1431	return 0;
1432
1433	return EVP_MD_settable_ctx_params(prsactx->md);
1434	}
1435
1436	const OSSL_DISPATCH ossl_rsa_signature_functions[] = {
1437	{ OSSL_FUNC_SIGNATURE_NEWCTX, (void (*)(void))rsa_newctx },
1438	{ OSSL_FUNC_SIGNATURE_SIGN_INIT, (void (*)(void))rsa_sign_init },
1439	{ OSSL_FUNC_SIGNATURE_SIGN, (void (*)(void))rsa_sign },
1440	{ OSSL_FUNC_SIGNATURE_VERIFY_INIT, (void (*)(void))rsa_verify_init },
1441	{ OSSL_FUNC_SIGNATURE_VERIFY, (void (*)(void))rsa_verify },
1442	{ OSSL_FUNC_SIGNATURE_VERIFY_RECOVER_INIT,
1443	(void (*)(void))rsa_verify_recover_init },
1444	{ OSSL_FUNC_SIGNATURE_VERIFY_RECOVER,
1445	(void (*)(void))rsa_verify_recover },
1446	{ OSSL_FUNC_SIGNATURE_DIGEST_SIGN_INIT,
1447	(void (*)(void))rsa_digest_sign_init },
1448	{ OSSL_FUNC_SIGNATURE_DIGEST_SIGN_UPDATE,
1449	(void (*)(void))rsa_digest_signverify_update },
1450	{ OSSL_FUNC_SIGNATURE_DIGEST_SIGN_FINAL,
1451	(void (*)(void))rsa_digest_sign_final },
1452	{ OSSL_FUNC_SIGNATURE_DIGEST_VERIFY_INIT,
1453	(void (*)(void))rsa_digest_verify_init },
1454	{ OSSL_FUNC_SIGNATURE_DIGEST_VERIFY_UPDATE,
1455	(void (*)(void))rsa_digest_signverify_update },
1456	{ OSSL_FUNC_SIGNATURE_DIGEST_VERIFY_FINAL,
1457	(void (*)(void))rsa_digest_verify_final },
1458	{ OSSL_FUNC_SIGNATURE_FREECTX, (void (*)(void))rsa_freectx },
1459	{ OSSL_FUNC_SIGNATURE_DUPCTX, (void (*)(void))rsa_dupctx },
1460	{ OSSL_FUNC_SIGNATURE_GET_CTX_PARAMS, (void (*)(void))rsa_get_ctx_params },
1461	{ OSSL_FUNC_SIGNATURE_GETTABLE_CTX_PARAMS,
1462	(void (*)(void))rsa_gettable_ctx_params },
1463	{ OSSL_FUNC_SIGNATURE_SET_CTX_PARAMS, (void (*)(void))rsa_set_ctx_params },
1464	{ OSSL_FUNC_SIGNATURE_SETTABLE_CTX_PARAMS,
1465	(void (*)(void))rsa_settable_ctx_params },
1466	{ OSSL_FUNC_SIGNATURE_GET_CTX_MD_PARAMS,
1467	(void (*)(void))rsa_get_ctx_md_params },
1468	{ OSSL_FUNC_SIGNATURE_GETTABLE_CTX_MD_PARAMS,
1469	(void (*)(void))rsa_gettable_ctx_md_params },
1470	{ OSSL_FUNC_SIGNATURE_SET_CTX_MD_PARAMS,
1471	(void (*)(void))rsa_set_ctx_md_params },
1472	{ OSSL_FUNC_SIGNATURE_SETTABLE_CTX_MD_PARAMS,
1473	(void (*)(void))rsa_settable_ctx_md_params },
1474	{ 0, NULL }
1475	};

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/libs/openssl-3.0.1/providers/implementations/signature/rsa_sig.c@ 94320

Download in other formats: