commit c675e4bde5b6cbb66430fe8f9bc4bcfdaca72854
author Manuel Pégourié-Gonnard <mpg@elzevir.fr> Mon Feb 03 11:58:55 2014 +0100
committer Paul Bakker <p.j.bakker@polarssl.org> Mon Jul 07 17:46:29 2014 +0200
tree 3f45d18b4013d17f20d316cb76b2b398b6a34fab
parent af0ccc8fa006c3a806da585f78d9ee6f6449de57

Fix bug in RSA PKCS#1 v1.5 "reversed" operations

ChangeLog

diff --git a/ChangeLog b/ChangeLog
index 3e0ff25..5d8da22 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -17,6 +17,7 @@
    * Potential memory leak in bignum_selftest()
    * Replaced expired test certificate
    * ssl_mail_client now terminates lines with CRLF, instead of LF
+   * Fix bug in RSA PKCS#1 v1.5 "reversed" operations
 
 = Version 1.2.10 released 2013-10-07
 Changes

library/rsa.c

diff --git a/library/rsa.c b/library/rsa.c
index a2a4f8c..f56dd6a 100644
--- a/library/rsa.c
+++ b/library/rsa.c
@@ -745,7 +745,7 @@
          * (minus one, for the 00 byte) */
         for( i = 0; i < ilen - 3; i++ )
         {
-            pad_done |= ( p[i] == 0xFF );
+            pad_done |= ( p[i] != 0xFF );
             pad_count += ( pad_done == 0 );
         }
 

tests/suites/test_suite_rsa.function

diff --git a/tests/suites/test_suite_rsa.function b/tests/suites/test_suite_rsa.function
index 0e7bb65..5ebecc8 100644
--- a/tests/suites/test_suite_rsa.function
+++ b/tests/suites/test_suite_rsa.function
@@ -226,6 +226,21 @@
 
     TEST_ASSERT( strcasecmp( (char *) output_str, {result_hex_str} ) == 0 );
 
+    /* For PKCS#1 v1.5, there is an alternative way to generate signatures */
+    if( {padding_mode} == RSA_PKCS_V15 )
+    {
+        memset( output, 0x00, 1000 );
+        memset( output_str, 0x00, 1000 );
+
+        TEST_ASSERT( rsa_rsaes_pkcs1_v15_encrypt( &ctx,
+                    &rnd_pseudo_rand, &rnd_info, RSA_PRIVATE,
+                    hash_len, hash_result, output ) == 0 );
+
+        hexify( output_str, output, ctx.len );
+
+        TEST_ASSERT( strcasecmp( (char *) output_str, {result_hex_str} ) == 0 );
+    }
+
     mpi_free( &P1 ); mpi_free( &Q1 ); mpi_free( &H ); mpi_free( &G );
     rsa_free( &ctx );
 }
@@ -237,13 +252,15 @@
     unsigned char message_str[1000];
     unsigned char hash_result[1000];
     unsigned char result_str[1000];
+    unsigned char output[1000];
     rsa_context ctx;
-    size_t hash_len;
+    size_t hash_len, olen;
 
     rsa_init( &ctx, {padding_mode}, 0 );
     memset( message_str, 0x00, 1000 );
     memset( hash_result, 0x00, 1000 );
     memset( result_str, 0x00, 1000 );
+    memset( output, 0x00, sizeof( output ) );
 
     ctx.len = {mod} / 8;
     TEST_ASSERT( mpi_read_string( &ctx.N, {radix_N}, {input_N} ) == 0 );
@@ -257,6 +274,22 @@
 
     TEST_ASSERT( rsa_pkcs1_verify( &ctx, NULL, NULL, RSA_PUBLIC, SIG_RSA_RAW, hash_len, hash_result, result_str ) == {correct} );
 
+    /* For PKCS#1 v1.5, there is an alternative way to verify signatures */
+    if( {padding_mode} == RSA_PKCS_V15 )
+    {
+        int ok;
+
+        TEST_ASSERT( rsa_rsaes_pkcs1_v15_decrypt( &ctx,
+                    NULL, NULL, RSA_PUBLIC,
+                    &olen, result_str, output, sizeof( output ) ) == 0 );
+
+        ok = olen == hash_len && memcmp( output, hash_result, olen ) == 0;
+        if( {correct} == 0 )
+            TEST_ASSERT( ok == 1 );
+        else
+            TEST_ASSERT( ok == 0 );
+    }
+
     rsa_free( &ctx );
 }
 END_CASE