VirtualBox

source: vbox/trunk/src/VBox/Runtime/common/crypto/pkix-signature-rsa.cpp

Last change on this file was 100442, checked in by vboxsync, 11 months ago

IPRT,OpenSSL: Support ECDSA for verficiation purposes when IPRT links with OpenSSL. This required quite a bit of cleanups, so not entirely no-risk. bugref:10479 ticketref:21621
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 24.0 KB
Line 
1/* $Id: pkix-signature-rsa.cpp 100442 2023-07-08 11:10:51Z vboxsync $ */
2/** @file
3 * IPRT - Crypto - Public Key Signature Schema Algorithm, RSA Providers.
4 */
5
6/*
7 * Copyright (C) 2006-2023 Oracle and/or its affiliates.
8 *
9 * This file is part of VirtualBox base platform packages, as
10 * available from https://www.virtualbox.org.
11 *
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation, in version 3 of the
15 * License.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20 * General Public License for more details.
21 *
22 * You should have received a copy of the GNU General Public License
23 * along with this program; if not, see <https://www.gnu.org/licenses>.
24 *
25 * The contents of this file may alternatively be used under the terms
26 * of the Common Development and Distribution License Version 1.0
27 * (CDDL), a copy of it is provided in the "COPYING.CDDL" file included
28 * in the VirtualBox distribution, in which case the provisions of the
29 * CDDL are applicable instead of those of the GPL.
30 *
31 * You may elect to license modified versions of this file under the
32 * terms and conditions of either the GPL or the CDDL or both.
33 *
34 * SPDX-License-Identifier: GPL-3.0-only OR CDDL-1.0
35 */
36
37
38/*********************************************************************************************************************************
39* Header Files *
40*********************************************************************************************************************************/
41#include "internal/iprt.h"
42#include <iprt/crypto/rsa.h>
43
44#include <iprt/bignum.h>
45#include <iprt/err.h>
46#include <iprt/mem.h>
47#include <iprt/string.h>
48#include <iprt/crypto/digest.h>
49#include <iprt/crypto/pkix.h>
50
51#include "rsa-internal.h"
52#include "pkix-signature-builtin.h"
53#include "key-internal.h"
54
55
56/*********************************************************************************************************************************
57* Structures and Typedefs *
58*********************************************************************************************************************************/
59/**
60 * RSA signature provider instance.
61 */
62typedef struct RTCRPKIXSIGNATURERSA
63{
64 /** Set if we're signing, clear if verifying. */
65 bool fSigning;
66
67 /** Temporary big number for use when signing or verifiying. */
68 RTBIGNUM TmpBigNum1;
69 /** Temporary big number for use when signing or verifiying. */
70 RTBIGNUM TmpBigNum2;
71
72 /** Scratch space for decoding the key. */
73 union
74 {
75 /** Public key. */
76 RTCRRSAPUBLICKEY PublicKey;
77 /** Private key. */
78 RTCRRSAPRIVATEKEY PrivateKey;
79 /** Scratch area where we assemble the signature. */
80 uint8_t abSignature[RTCRRSA_MAX_MODULUS_BITS / 8 * 2];
81 } Scratch;
82} RTCRPKIXSIGNATURERSA;
83/** Pointer to an RSA signature provider instance. */
84typedef RTCRPKIXSIGNATURERSA *PRTCRPKIXSIGNATURERSA;
85
86
87/*********************************************************************************************************************************
88* Global Variables *
89*********************************************************************************************************************************/
90/** @name Pre-encoded DigestInfo DER sequences.
91 * @{ */
92static const uint8_t g_abMd2[] =
93{/* { { 1.2.840.113549.2.2 (MD2), NULL }, hash octet-string } */
94 0x30,0x20, 0x30,0x0c, 0x06,0x08,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x02,0x02, 0x05,0x00, 0x04,0x10
95};
96static const uint8_t g_abMd4[] =
97{/* { { 1.2.840.113549.2.4 (MD4), NULL }, hash octet-string } */
98 0x30,0x20, 0x30,0x0c, 0x06,0x08,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x02,0x04, 0x05,0x00, 0x04,0x10
99};
100static const uint8_t g_abMd5[] =
101{/* { { 1.2.840.113549.2.5 (MD5), NULL }, hash octet-string } */
102 0x30,0x20, 0x30,0x0c, 0x06,0x08,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x02,0x05, 0x05,0x00, 0x04,0x10
103};
104static const uint8_t g_abSha1[] =
105{/* { { 1.3.14.3.2.26 (SHA-1), NULL }, hash octet-string } */
106 0x30,0x21, 0x30,0x09, 0x06,0x05,0x2b,0x0e,0x03,0x02,0x1a, 0x05,0x00, 0x04,0x14
107};
108static const uint8_t g_abSha256[] =
109{/* { { 2.16.840.1.101.3.4.2.1 (SHA-256), NULL }, hash octet-string } */
110 0x30,0x31, 0x30,0x0d, 0x06,0x09,0x60,0x86,0x48,0x01,0x65,0x03,0x04,0x02,0x01, 0x05,0x00, 0x04,0x20
111};
112static const uint8_t g_abSha384[] =
113{/* { { 2.16.840.1.101.3.4.2.2 (SHA-384), NULL }, hash octet-string } */
114 0x30,0x41, 0x30,0x0d, 0x06,0x09,0x60,0x86,0x48,0x01,0x65,0x03,0x04,0x02,0x02, 0x05,0x00, 0x04,0x30
115};
116static const uint8_t g_abSha512[] =
117{/* { { 2.16.840.1.101.3.4.2.3 (SHA-512), NULL }, hash octet-string } */
118 0x30,0x51, 0x30,0x0d, 0x06,0x09,0x60,0x86,0x48,0x01,0x65,0x03,0x04,0x02,0x03, 0x05,0x00, 0x04,0x40
119};
120static const uint8_t g_abSha224[] =
121{/* { { 2.16.840.1.101.3.4.2.4 (SHA-224), NULL }, hash octet-string } */
122 0x30,0x2d, 0x30,0x0d, 0x06,0x09,0x60,0x86,0x48,0x01,0x65,0x03,0x04,0x02,0x04, 0x05,0x00, 0x04,0x1c
123};
124static const uint8_t g_abSha512t224[] =
125{/* { { 2.16.840.1.101.3.4.2.5 (SHA-512T224), NULL }, hash octet-string } */
126 0x30,0x2d, 0x30,0x0d, 0x06,0x09,0x60,0x86,0x48,0x01,0x65,0x03,0x04,0x02,0x05, 0x05,0x00, 0x04,0x1c
127};
128static const uint8_t g_abSha512t256[] =
129{/* { { 2.16.840.1.101.3.4.2.6 (SHA-512T256), NULL }, hash octet-string } */
130 0x30,0x31, 0x30,0x0d, 0x06,0x09,0x60,0x86,0x48,0x01,0x65,0x03,0x04,0x02,0x06, 0x05,0x00, 0x04,0x20
131};
132static const uint8_t g_abSha3t224[] =
133{/* { { 2.16.840.1.101.3.4.2.7 (SHA3-224), NULL }, hash octet-string } */
134 0x30,0x2d, 0x30,0x0d, 0x06,0x09,0x60,0x86,0x48,0x01,0x65,0x03,0x04,0x02,0x07, 0x05,0x00, 0x04,0x1c
135};
136static const uint8_t g_abSha3t256[] =
137{/* { { 2.16.840.1.101.3.4.2.8 (SHA3-256), NULL }, hash octet-string } */
138 0x30,0x31, 0x30,0x0d, 0x06,0x09,0x60,0x86,0x48,0x01,0x65,0x03,0x04,0x02,0x08, 0x05,0x00, 0x04,0x20
139};
140static const uint8_t g_abSha3t384[] =
141{/* { { 2.16.840.1.101.3.4.2.9 (SHA3-384), NULL }, hash octet-string } */
142 0x30,0x41, 0x30,0x0d, 0x06,0x09,0x60,0x86,0x48,0x01,0x65,0x03,0x04,0x02,0x09, 0x05,0x00, 0x04,0x30
143};
144static const uint8_t g_abSha3t512[] =
145{/* { { 2.16.840.1.101.3.4.2.10 (SHA3-512), NULL }, hash octet-string } */
146 0x30,0x51, 0x30,0x0d, 0x06,0x09,0x60,0x86,0x48,0x01,0x65,0x03,0x04,0x02,0x0a, 0x05,0x00, 0x04,0x40
147};
148/** @} */
149
150/** Lookup array for the pre-encoded DigestInfo DER sequences. */
151static struct
152{
153 RTDIGESTTYPE enmDigest;
154 const uint8_t *pb;
155 size_t cb;
156} const g_aDigestInfos[] =
157{
158 { RTDIGESTTYPE_SHA1, g_abSha1, sizeof(g_abSha1) },
159 { RTDIGESTTYPE_SHA256, g_abSha256, sizeof(g_abSha256) },
160 { RTDIGESTTYPE_SHA512, g_abSha512, sizeof(g_abSha512) },
161 { RTDIGESTTYPE_MD2, g_abMd2, sizeof(g_abMd2) },
162 { RTDIGESTTYPE_MD4, g_abMd4, sizeof(g_abMd4) },
163 { RTDIGESTTYPE_MD5, g_abMd5, sizeof(g_abMd5) },
164 { RTDIGESTTYPE_SHA384, g_abSha384, sizeof(g_abSha384) },
165 { RTDIGESTTYPE_SHA224, g_abSha224, sizeof(g_abSha224) },
166 { RTDIGESTTYPE_SHA512T224, g_abSha512t224, sizeof(g_abSha512t224)},
167 { RTDIGESTTYPE_SHA512T256, g_abSha512t256, sizeof(g_abSha512t256)},
168 { RTDIGESTTYPE_SHA3_224, g_abSha3t224, sizeof(g_abSha3t224) },
169 { RTDIGESTTYPE_SHA3_256, g_abSha3t256, sizeof(g_abSha3t256) },
170 { RTDIGESTTYPE_SHA3_384, g_abSha3t384, sizeof(g_abSha3t384) },
171 { RTDIGESTTYPE_SHA3_512, g_abSha3t512, sizeof(g_abSha3t512) },
172};
173
174
175/** @impl_interface_method{RTCRPKIXSIGNATUREDESC,pfnInit} */
176static DECLCALLBACK(int) rtCrPkixSignatureRsa_Init(PCRTCRPKIXSIGNATUREDESC pDesc, void *pvState, void *pvOpaque,
177 bool fSigning, RTCRKEY hKey, PCRTASN1DYNTYPE pParams)
178{
179 RT_NOREF_PV(pDesc); RT_NOREF_PV(pvState); RT_NOREF_PV(pvOpaque);
180
181 if ( !pParams
182 || pParams->enmType == RTASN1TYPE_NULL
183 || pParams->enmType == RTASN1TYPE_NOT_PRESENT)
184 { /* likely */ }
185 else
186 return VERR_CR_PKIX_SIGNATURE_TAKES_NO_PARAMETERS;
187
188 RTCRKEYTYPE enmKeyType = RTCrKeyGetType(hKey);
189 if (fSigning)
190 AssertReturn(enmKeyType == RTCRKEYTYPE_RSA_PRIVATE, VERR_CR_PKIX_NOT_RSA_PRIVATE_KEY);
191 else
192 AssertReturn(enmKeyType == RTCRKEYTYPE_RSA_PUBLIC, VERR_CR_PKIX_NOT_RSA_PUBLIC_KEY);
193
194 PRTCRPKIXSIGNATURERSA pThis = (PRTCRPKIXSIGNATURERSA)pvState;
195 pThis->fSigning = fSigning;
196
197 return VINF_SUCCESS;
198}
199
200
201/** @impl_interface_method{RTCRPKIXSIGNATUREDESC,pfnReset} */
202static DECLCALLBACK(int) rtCrPkixSignatureRsa_Reset(PCRTCRPKIXSIGNATUREDESC pDesc, void *pvState, bool fSigning)
203{
204 PRTCRPKIXSIGNATURERSA pThis = (PRTCRPKIXSIGNATURERSA)pvState;
205 RT_NOREF_PV(fSigning); RT_NOREF_PV(pDesc);
206 Assert(pThis->fSigning == fSigning); NOREF(pThis);
207 return VINF_SUCCESS;
208}
209
210
211/** @impl_interface_method{RTCRPKIXSIGNATUREDESC,pfnDelete} */
212static DECLCALLBACK(void) rtCrPkixSignatureRsa_Delete(PCRTCRPKIXSIGNATUREDESC pDesc, void *pvState, bool fSigning)
213{
214 PRTCRPKIXSIGNATURERSA pThis = (PRTCRPKIXSIGNATURERSA)pvState;
215 RT_NOREF_PV(fSigning); RT_NOREF_PV(pDesc);
216 Assert(pThis->fSigning == fSigning);
217 NOREF(pThis);
218}
219
220
221/**
222 * Common worker for rtCrPkixSignatureRsa_Verify and
223 * rtCrPkixSignatureRsa_Sign that encodes an EMSA-PKCS1-V1_5 signature in
224 * the scratch area.
225 *
226 * This function is referred to as EMSA-PKCS1-v1_5-ENCODE(M,k) in RFC-3447 and
227 * is described in section 9.2
228 *
229 * @returns IPRT status code.
230 * @param pThis The RSA signature provider instance.
231 * @param hDigest The digest which hash to turn into a signature.
232 * @param cbEncodedMsg The desired encoded message length.
233 * @param fNoDigestInfo If true, skip the DigestInfo and encode the digest
234 * without any prefix like described in v1.5 (RFC-2313)
235 * and observed with RSA+MD5 signed timestamps. If
236 * false, include the prefix like v2.0 (RFC-2437)
237 * describes in step in section 9.2.1
238 * (EMSA-PKCS1-v1_5)
239 *
240 * @remarks Must preserve informational status codes!
241 */
242static int rtCrPkixSignatureRsa_EmsaPkcs1V15Encode(PRTCRPKIXSIGNATURERSA pThis, RTCRDIGEST hDigest, size_t cbEncodedMsg,
243 bool fNoDigestInfo)
244{
245 AssertReturn(cbEncodedMsg * 2 <= sizeof(pThis->Scratch), VERR_CR_PKIX_INTERNAL_ERROR);
246
247 /*
248 * Figure out which hash and select the associate prebaked DigestInfo.
249 */
250 RTDIGESTTYPE const enmDigest = RTCrDigestGetType(hDigest);
251 AssertReturn(enmDigest != RTDIGESTTYPE_INVALID && enmDigest != RTDIGESTTYPE_UNKNOWN, VERR_CR_PKIX_UNKNOWN_DIGEST_TYPE);
252 uint8_t const *pbDigestInfoStart = NULL;
253 size_t cbDigestInfoStart = 0;
254 for (uint32_t i = 0; i < RT_ELEMENTS(g_aDigestInfos); i++)
255 if (g_aDigestInfos[i].enmDigest == enmDigest)
256 {
257 pbDigestInfoStart = g_aDigestInfos[i].pb;
258 cbDigestInfoStart = g_aDigestInfos[i].cb;
259 break;
260 }
261 if (!pbDigestInfoStart)
262 return VERR_CR_PKIX_UNKNOWN_DIGEST_TYPE;
263
264 /*
265 * Get the hash size and verify that it matches what we've got in the
266 * precooked DigestInfo. ASSUMES less that 256 bytes of hash.
267 */
268 uint32_t const cbHash = RTCrDigestGetHashSize(hDigest);
269 AssertReturn(cbHash > 0 && cbHash < _16K, VERR_OUT_OF_RANGE);
270 AssertReturn(cbHash == pbDigestInfoStart[cbDigestInfoStart - 1], VERR_CR_PKIX_INTERNAL_ERROR);
271
272 if (fNoDigestInfo)
273 cbDigestInfoStart = 0;
274
275 if (cbDigestInfoStart + cbHash + 11 > cbEncodedMsg)
276 return VERR_CR_PKIX_HASH_TOO_LONG_FOR_KEY;
277
278 /*
279 * Encode the message the first part of the scratch area.
280 */
281 uint8_t *pbDst = &pThis->Scratch.abSignature[0];
282 pbDst[0] = 0x00;
283 pbDst[1] = 0x01; /* BT - block type, see RFC-2313. */
284 size_t cbFFs = cbEncodedMsg - cbHash - cbDigestInfoStart - 3;
285 memset(&pbDst[2], 0xff, cbFFs);
286 pbDst += cbFFs + 2;
287 *pbDst++ = 0x00;
288 memcpy(pbDst, pbDigestInfoStart, cbDigestInfoStart);
289 pbDst += cbDigestInfoStart;
290 /* Note! Must preserve informational status codes from this call . */
291 int rc = RTCrDigestFinal(hDigest, pbDst, cbHash);
292 if (RT_SUCCESS(rc))
293 {
294 pbDst += cbHash;
295 Assert((size_t)(pbDst - &pThis->Scratch.abSignature[0]) == cbEncodedMsg);
296 }
297 return rc;
298}
299
300
301
302/** @impl_interface_method{RTCRPKIXSIGNATUREDESC,pfnVerify} */
303static DECLCALLBACK(int) rtCrPkixSignatureRsa_Verify(PCRTCRPKIXSIGNATUREDESC pDesc, void *pvState, RTCRKEY hKey,
304 RTCRDIGEST hDigest, void const *pvSignature, size_t cbSignature)
305{
306 PRTCRPKIXSIGNATURERSA pThis = (PRTCRPKIXSIGNATURERSA)pvState;
307 RT_NOREF_PV(pDesc);
308 Assert(!pThis->fSigning);
309 if (cbSignature > sizeof(pThis->Scratch) / 2)
310 return VERR_CR_PKIX_SIGNATURE_TOO_LONG;
311
312 /*
313 * Get the key bits we need.
314 */
315 Assert(RTCrKeyGetType(hKey) == RTCRKEYTYPE_RSA_PUBLIC);
316 PRTBIGNUM pModulus = &hKey->u.RsaPublic.Modulus;
317 PRTBIGNUM pExponent = &hKey->u.RsaPublic.Exponent;
318
319 /*
320 * 8.2.2.1 - Length check. (RFC-3447)
321 */
322 if (cbSignature != RTBigNumByteWidth(pModulus))
323 return VERR_CR_PKIX_INVALID_SIGNATURE_LENGTH;
324
325 /*
326 * 8.2.2.2 - RSA verification / Decrypt the signature.
327 */
328 /* a) s = OS2IP(S) -- Convert signature to integer. */
329 int rc = RTBigNumInit(&pThis->TmpBigNum1, RTBIGNUMINIT_F_ENDIAN_BIG | RTBIGNUMINIT_F_UNSIGNED,
330 pvSignature, cbSignature);
331 if (RT_FAILURE(rc))
332 return rc;
333 /* b) RSAVP1 - 5.2.2.2: Range check (0 <= s < n). */
334 if (RTBigNumCompare(&pThis->TmpBigNum1, pModulus) < 0)
335 {
336 if (RTBigNumCompareWithU64(&pThis->TmpBigNum1, 0) >= 0)
337 {
338 /* b) RSAVP1 - 5.2.2.3: s^e mod n */
339 rc = RTBigNumInitZero(&pThis->TmpBigNum2, 0);
340 if (RT_SUCCESS(rc))
341 {
342 rc = RTBigNumModExp(&pThis->TmpBigNum2, &pThis->TmpBigNum1, pExponent, pModulus);
343 if (RT_SUCCESS(rc))
344 {
345 /* c) EM' = I2OSP(m, k) -- Convert the result to bytes. */
346 uint32_t cbDecrypted = RTBigNumByteWidth(&pThis->TmpBigNum2) + 1; /* 1 = leading zero byte */
347 if (cbDecrypted <= sizeof(pThis->Scratch) / 2)
348 {
349 uint8_t *pbDecrypted = &pThis->Scratch.abSignature[sizeof(pThis->Scratch) / 2];
350 rc = RTBigNumToBytesBigEndian(&pThis->TmpBigNum2, pbDecrypted, cbDecrypted);
351 if (RT_SUCCESS(rc))
352 {
353 /*
354 * 8.2.2.3 - Build a hopefully identical signature using hDigest.
355 */
356 rc = rtCrPkixSignatureRsa_EmsaPkcs1V15Encode(pThis, hDigest, cbDecrypted, false /* fNoDigestInfo */);
357 if (RT_SUCCESS(rc))
358 {
359 /*
360 * 8.2.2.4 - Compare the two.
361 */
362 if (memcmp(&pThis->Scratch.abSignature[0], pbDecrypted, cbDecrypted) == 0)
363 { /* No rc = VINF_SUCCESS here, mustpreserve informational status codes from digest. */ }
364 else
365 {
366 /*
367 * Try again without digestinfo. This style signing has been
368 * observed in Vista timestamp counter signatures (Thawte).
369 */
370 rc = rtCrPkixSignatureRsa_EmsaPkcs1V15Encode(pThis, hDigest, cbDecrypted,
371 true /* fNoDigestInfo */);
372 if (RT_SUCCESS(rc))
373 {
374 if (memcmp(&pThis->Scratch.abSignature[0], pbDecrypted, cbDecrypted) == 0)
375 { /* No rc = VINF_SUCCESS here, mustpreserve informational status codes from digest. */ }
376 else
377 rc = VERR_CR_PKIX_SIGNATURE_MISMATCH;
378 }
379 }
380 }
381 }
382 }
383 else
384 rc = VERR_CR_PKIX_SIGNATURE_TOO_LONG;
385 }
386 RTBigNumDestroy(&pThis->TmpBigNum2);
387 }
388 }
389 else
390 rc = VERR_CR_PKIX_SIGNATURE_NEGATIVE;
391 }
392 else
393 rc = VERR_CR_PKIX_SIGNATURE_GE_KEY;
394 RTBigNumDestroy(&pThis->TmpBigNum1);
395 return rc;
396}
397
398
399/** @impl_interface_method{RTCRPKIXSIGNATUREDESC,pfnSign} */
400static DECLCALLBACK(int) rtCrPkixSignatureRsa_Sign(PCRTCRPKIXSIGNATUREDESC pDesc, void *pvState, RTCRKEY hKey,
401 RTCRDIGEST hDigest, void *pvSignature, size_t *pcbSignature)
402{
403 PRTCRPKIXSIGNATURERSA pThis = (PRTCRPKIXSIGNATURERSA)pvState;
404 RT_NOREF_PV(pDesc);
405 Assert(pThis->fSigning);
406
407 /*
408 * Get the key bits we need.
409 */
410 Assert(RTCrKeyGetType(hKey) == RTCRKEYTYPE_RSA_PRIVATE);
411 PRTBIGNUM pModulus = &hKey->u.RsaPrivate.Modulus;
412 PRTBIGNUM pExponent = &hKey->u.RsaPrivate.PrivateExponent;
413
414 /*
415 * Calc signature length and return if destination buffer isn't big enough.
416 */
417 size_t const cbDst = *pcbSignature;
418 size_t const cbEncodedMsg = RTBigNumByteWidth(pModulus);
419 *pcbSignature = cbEncodedMsg;
420 if (cbEncodedMsg > sizeof(pThis->Scratch) / 2)
421 return VERR_CR_PKIX_SIGNATURE_TOO_LONG;
422 if (!pvSignature || cbDst < cbEncodedMsg)
423 return VERR_BUFFER_OVERFLOW;
424
425 /*
426 * 8.1.1.1 - EMSA-PSS encoding. (RFC-3447)
427 */
428 int rcRetSuccess;
429 int rc = rcRetSuccess = rtCrPkixSignatureRsa_EmsaPkcs1V15Encode(pThis, hDigest, cbEncodedMsg, false /* fNoDigestInfo */);
430 if (RT_SUCCESS(rc))
431 {
432 /*
433 * 8.1.1.2 - RSA signature.
434 */
435 /* a) m = OS2IP(EM) -- Convert the encoded message (EM) to integer. */
436 rc = RTBigNumInit(&pThis->TmpBigNum1, RTBIGNUMINIT_F_ENDIAN_BIG | RTBIGNUMINIT_F_UNSIGNED,
437 pThis->Scratch.abSignature, cbEncodedMsg);
438 if (RT_SUCCESS(rc))
439 {
440 /* b) s = RSASP1(K, m = EM) - 5.2.1.1: Range check (0 <= m < n). */
441 if (RTBigNumCompare(&pThis->TmpBigNum1, pModulus) < 0)
442 {
443 /* b) s = RSAVP1(K, m = EM) - 5.2.1.2.a: s = m^d mod n */
444 rc = RTBigNumInitZero(&pThis->TmpBigNum2, 0);
445 if (RT_SUCCESS(rc))
446 {
447 rc = RTBigNumModExp(&pThis->TmpBigNum2, &pThis->TmpBigNum1, pExponent, pModulus);
448 if (RT_SUCCESS(rc))
449 {
450 /* c) S = I2OSP(s, k) -- Convert the result to bytes. */
451 rc = RTBigNumToBytesBigEndian(&pThis->TmpBigNum2, pvSignature, cbEncodedMsg);
452 AssertStmt(RT_SUCCESS(rc) || rc != VERR_BUFFER_OVERFLOW, rc = VERR_CR_PKIX_INTERNAL_ERROR);
453
454 /* Make sure we return the informational status code from the digest on success. */
455 if (rc == VINF_SUCCESS && rcRetSuccess != VINF_SUCCESS)
456 rc = rcRetSuccess;
457 }
458 RTBigNumDestroy(&pThis->TmpBigNum2);
459 }
460 }
461 else
462 rc = VERR_CR_PKIX_SIGNATURE_GE_KEY;
463 RTBigNumDestroy(&pThis->TmpBigNum1);
464 }
465 }
466 return rc;
467}
468
469
470
471
472/** RSA alias ODIs. */
473static const char * const g_apszHashWithRsaAliases[] =
474{
475 RTCR_PKCS1_MD2_WITH_RSA_OID,
476 RTCR_PKCS1_MD4_WITH_RSA_OID,
477 RTCR_PKCS1_MD5_WITH_RSA_OID,
478 RTCR_PKCS1_SHA1_WITH_RSA_OID,
479 RTCR_PKCS1_SHA256_WITH_RSA_OID,
480 RTCR_PKCS1_SHA384_WITH_RSA_OID,
481 RTCR_PKCS1_SHA512_WITH_RSA_OID,
482 RTCR_PKCS1_SHA224_WITH_RSA_OID,
483 RTCR_PKCS1_SHA512T224_WITH_RSA_OID,
484 RTCR_PKCS1_SHA512T256_WITH_RSA_OID,
485 RTCR_NIST_SHA3_224_WITH_RSA_OID,
486 RTCR_NIST_SHA3_256_WITH_RSA_OID,
487 RTCR_NIST_SHA3_384_WITH_RSA_OID,
488 RTCR_NIST_SHA3_512_WITH_RSA_OID,
489 /* Note: Note quite sure about these OIW oddballs. */
490 "1.3.14.3.2.11" /* OIW rsaSignature */,
491 "1.3.14.3.2.14" /* OIW mdc2WithRSASignature */,
492 "1.3.14.3.2.15" /* OIW shaWithRSASignature */,
493 "1.3.14.3.2.24" /* OIW md2WithRSASignature */,
494 "1.3.14.3.2.25" /* OIW md5WithRSASignature */,
495 "1.3.14.3.2.29" /* OIW sha1WithRSASignature */,
496 NULL
497};
498
499
500/** RSA descriptor. */
501DECL_HIDDEN_CONST(RTCRPKIXSIGNATUREDESC const) g_rtCrPkixSigningHashWithRsaDesc =
502{
503 "RSASSA-PKCS1-v1_5",
504 RTCR_PKCS1_RSA_OID,
505 g_apszHashWithRsaAliases,
506 sizeof(RTCRPKIXSIGNATURERSA),
507 0,
508 0,
509 rtCrPkixSignatureRsa_Init,
510 rtCrPkixSignatureRsa_Reset,
511 rtCrPkixSignatureRsa_Delete,
512 rtCrPkixSignatureRsa_Verify,
513 rtCrPkixSignatureRsa_Sign,
514};
515
516
517/**
518 * Worker for RTCrRsaPublicKey_CanHandleDigestType and
519 * RTCrRsaPrivateKey_CanHandleDigestType.
520 *
521 * We implement these two functions here because we've already got the
522 * DigestInfo sizes nicely lined up here.
523 */
524static bool rtCrRsa_CanHandleDigestType(int32_t cModulusBits, RTDIGESTTYPE enmDigestType, PRTERRINFO pErrInfo)
525{
526 /*
527 * ASSUME EMSA-PKCS1-v1_5 padding scheme (RFC-8017 section 9.2):
528 * - 11 byte padding prefix (00, 01, 8 times ff)
529 * - digest info der sequence for rsaWithXxxxEncryption
530 * - the hash value.
531 */
532 for (uint32_t i = 0; i < RT_ELEMENTS(g_aDigestInfos); i++)
533 if (g_aDigestInfos[i].enmDigest == enmDigestType)
534 {
535 size_t const cbHash = RTCrDigestTypeToHashSize(enmDigestType);
536 AssertBreak(cbHash > 0);
537
538 size_t cbMsg = 11 + g_aDigestInfos[i].cb + cbHash;
539 if ((ssize_t)cbMsg <= cModulusBits / 8)
540 return true;
541 RTErrInfoSetF(pErrInfo, VERR_CR_PKIX_INVALID_SIGNATURE_LENGTH, "cModulusBits=%d cbMsg=%u", cModulusBits, cbMsg);
542 return false;
543 }
544 RTErrInfoSetF(pErrInfo, VERR_CR_PKIX_UNKNOWN_DIGEST_TYPE, "%s", RTCrDigestTypeToName(enmDigestType));
545 return false;
546}
547
548
549RTDECL(bool) RTCrRsaPublicKey_CanHandleDigestType(PCRTCRRSAPUBLICKEY pRsaPublicKey, RTDIGESTTYPE enmDigestType,
550 PRTERRINFO pErrInfo)
551{
552 if (RTCrRsaPublicKey_IsPresent(pRsaPublicKey))
553 return rtCrRsa_CanHandleDigestType(RTAsn1Integer_UnsignedLastBit(&pRsaPublicKey->Modulus) + 1, enmDigestType, pErrInfo);
554 return false;
555}
556
557
558RTDECL(bool) RTCrRsaPrivateKey_CanHandleDigestType(PCRTCRRSAPRIVATEKEY pRsaPrivateKey, RTDIGESTTYPE enmDigestType,
559 PRTERRINFO pErrInfo)
560{
561 if (RTCrRsaPrivateKey_IsPresent(pRsaPrivateKey))
562 return rtCrRsa_CanHandleDigestType(RTAsn1Integer_UnsignedLastBit(&pRsaPrivateKey->Modulus) + 1, enmDigestType, pErrInfo);
563 return false;
564}
565
Note: See TracBrowser for help on using the repository browser.

© 2023 Oracle
Contact – Privacy policy – Terms of Use